@ornexus/neocortex 4.60.72 → 4.60.73

package/packages/client/dist/commands/qa-scan-review.js

@@ -1,5 +1,826 @@
-import{createHash as he,randomUUID as Y}from"node:crypto";import{closeSync as $,constants as X,existsSync as D,fstatSync as Z,fsyncSync as J,linkSync as ee,lstatSync as k,mkdirSync as re,openSync as z,readFileSync as j,realpathSync as B,unlinkSync as te,writeFileSync as ne}from"node:fs";import{isAbsolute as ve,join as b,resolve as E}from"node:path";import{inflateSync as pe}from"node:zlib";import{mutationQaGit as Q}from"./mutation-qa-git.js";const F=/^[a-f0-9]{64}$/,we=/^[a-z][a-z0-9-]{0,63}$/,ge=/^[a-z][a-z0-9-]{0,63}\.(?:png|json)$/,oe=8*1024*1024,T=128*1024,V=2,se=Buffer.from([137,80,78,71,13,10,26,10]),ye=Uint32Array.from({length:256},(r,t)=>{let e=t;for(let n=0;n<8;n++)e=(e&1)!==0?3988292384^e>>>1:e>>>1;return e>>>0}),M=["visual","responsive","responsive-tablet","responsive-desktop","accessibility","interaction","console-network","performance"],Se=Object.freeze({visual:"browser-screenshot",responsive:"browser-screenshot","responsive-tablet":"browser-screenshot","responsive-desktop":"browser-screenshot",accessibility:"axe-scan",interaction:"browser-interaction","console-network":"console-capture",performance:"performance-trace"}),me=Object.freeze({visual:"PNG 8-bit non-interlaced CRC+IDAT verified; width=1440, 600<=height<=4096, pixels<=8000000",responsive:"PNG 8-bit non-interlaced CRC+IDAT verified; width=375, 600<=height<=4096","responsive-tablet":"PNG 8-bit non-interlaced CRC+IDAT verified; width=768, 600<=height<=4096","responsive-desktop":"PNG 8-bit non-interlaced CRC+IDAT verified; width=1024, 600<=height<=4096",accessibility:"JSON: schemaVersion=1 engine=axe-core violationCount=0 incompleteCount=0 passCount>0",interaction:"JSON: schemaVersion=2 syntheticTarget=true networkAttemptsAfterAction=0 checks=[{id:functional-safe-slug,passed:true}] (1..32 distinct)","console-network":"JSON: schemaVersion=1 initialCapture=true consoleErrors=0 pageErrors=0 failedRequests=0 requestsObserved>0",performance:"JSON: schemaVersion=1 metric=load 0<=observedMs<=budgetMs<=30000"});function _(r,t=1e6){return Number.isSafeInteger(r)&&r>=0&&r<=t}function qe(r,t,e){let n=4294967295;for(let o=t;o<e;o++)n=ye[(n^r[o])&255]^n>>>8;return(n^4294967295)>>>0}function Ee(r,t){if(r.length<57||!r.subarray(0,8).equals(se))return!1;let e=8,n=0,o=0,s=0,c=0,d=!1,a=!1,g=!1,f=!1,l=0;const p=[];for(;e<r.length;){if(++l>1024||r.length-e<12)return!1;const w=r.readUInt32BE(e),S=e+8+w,x=S+4;if(w>oe||x>r.length)return!1;const A=r.toString("ascii",e+4,e+8);if(!/^[A-Za-z]{4}$/.test(A)||qe(r,e+4,S)!==r.readUInt32BE(S))return!1;if(A==="IHDR"){if(d||e!==8||w!==13||(d=!0,n=r.readUInt32BE(e+8),o=r.readUInt32BE(e+12),c=r[e+17],s=c===0?1:c===2?3:c===4?2:c===6?4:0,!s||r[e+16]!==8||r[e+18]!==0||r[e+19]!==0||r[e+20]!==0||n<1||o<1||n>4096||o>4096||n*o>8e6))return!1}else if(A==="IDAT"){if(!d||f||w===0)return!1;p.push(r.subarray(e+8,S))}else if(A==="PLTE"){if(!d||g||p.length>0||c!==2&&c!==6||w===0||w>768||w%3!==0)return!1;g=!0}else if(A==="IEND"){if(!d||p.length===0||w!==0||x!==r.length)return!1;a=!0;break}else{if(!d||A[0]===A[0]?.toUpperCase())return!1;p.length&&(f=!0)}e=x}const y={visual:1440,responsive:375,"responsive-tablet":768,"responsive-desktop":1024}[t];if(!a||n!==y||o<600)return!1;const i=n*s,v=o*(i+1);try{const w=pe(Buffer.concat(p),{maxOutputLength:v+1});if(w.length!==v)return!1;for(let S=0;S<o;S++)if(w[S*(i+1)]>4)return!1;return!0}catch{return!1}}function Ae(r,t){if(r==="visual"||r==="responsive"||r==="responsive-tablet"||r==="responsive-desktop")return Ee(t,r);let e;try{e=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t))}catch{return!1}if(r==="accessibility")return m(e,["schemaVersion","engine","violationCount","incompleteCount","passCount"])&&e.schemaVersion===1&&e.engine==="axe-core"&&e.violationCount===0&&e.incompleteCount===0&&_(e.passCount)&&e.passCount>0;if(r==="interaction"){if(!m(e,["schemaVersion","syntheticTarget","networkAttemptsAfterAction","checks"])||e.schemaVersion!==2||e.syntheticTarget!==!0||e.networkAttemptsAfterAction!==0||!Array.isArray(e.checks)||e.checks.length<1||e.checks.length>32)return!1;const n=new Set;return e.checks.every(o=>!m(o,["id","passed"])||typeof o.id!="string"||!/^functional-[a-z][a-z0-9-]{0,50}$/.test(o.id)||n.has(o.id)||o.passed!==!0?!1:(n.add(o.id),!0))}return r==="console-network"?m(e,["schemaVersion","initialCapture","consoleErrors","pageErrors","failedRequests","requestsObserved"])&&e.schemaVersion===1&&e.initialCapture===!0&&e.consoleErrors===0&&e.pageErrors===0&&e.failedRequests===0&&_(e.requestsObserved)&&e.requestsObserved>0:m(e,["schemaVersion","metric","observedMs","budgetMs"])&&e.schemaVersion===1&&e.metric==="load"&&_(e.observedMs,3e4)&&_(e.budgetMs,3e4)&&e.budgetMs>0&&e.observedMs<=e.budgetMs}function C(r){return he("sha256").update(r).digest("hex")}function m(r,t){return r!==null&&typeof r=="object"&&!Array.isArray(r)&&Object.keys(r).sort().join("\0")===[...t].sort().join("\0")}function I(r,t){const e=Q(r,["rev-parse","--git-common-dir"]).toString("utf8").trim(),n=ve(e)?E(e):E(r,e);if(B(n)!==n||k(n).isSymbolicLink()||k(n).uid!==process.getuid?.())throw new Error("qa-scan-review-unverified");const o=b(n,"neocortex-qa-scan");t&&re(o,{recursive:!0,mode:448});const s=k(o);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==process.getuid?.()||(s.mode&63)!==0)throw new Error("qa-scan-review-unverified");return o}function H(r,t){const e=b(I(r,t),"evidence");t&&re(e,{recursive:!0,mode:448});const n=k(e);if(!n.isDirectory()||n.isSymbolicLink()||n.uid!==process.getuid?.()||(n.mode&63)!==0)throw new Error("qa-scan-review-unverified");return e}function Ve(r){return H(E(r),!1)}function L(r){if(B(r)!==r||!k(r).isDirectory()||Q(r,["rev-parse","--show-toplevel"]).toString("utf8").trim()!==r)throw new Error("qa-scan-review-unverified");if(Q(r,["status","--porcelain=v1","-z","--untracked-files=all"]).toString("utf8").split("\0").filter(Boolean).some(n=>!/^.{2} \.neocortex\//.test(n)))throw new Error("qa-scan-review-source-dirty");const e=Q(r,["rev-parse","--verify","HEAD"]).toString("utf8").trim();if(!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(e))throw new Error("qa-scan-review-unverified");return e}function ke(r){let t;try{t=new URL(r)}catch{throw new Error("qa-scan-review-target-invalid")}if(t.protocol!=="http:"||!["127.0.0.1","localhost","[::1]"].includes(t.hostname)||!t.port||t.username||t.password||t.search||t.hash)throw new Error("qa-scan-review-target-invalid");return C(`qa-scan-loopback-target-v1\0${t.href}`)}function P(r,t,e){try{if(!we.test(t))throw new Error("qa-scan-review-surface-invalid");const n=E(r),o=L(n),s=ke(e);H(n,!0);const c={schemaVersion:1,evidenceContractVersion:V,kind:"root-qa-scan-plan",sourceHead:o,surface:t,targetSha256:s,requiredKinds:M,qaAccepted:!1,localOnly:!0};return Object.freeze({...c,planSha256:C(`root-qa-scan-plan-v2\0${JSON.stringify(c)}`)})}catch(n){throw n instanceof Error&&n.message.startsWith("qa-scan-review-")?n:new Error("qa-scan-review-unverified")}}function ie(r,t){const e=new Set,n=[];for(const o of t.observations){if(!m(o,["kind","artifactId","captureMethod","sha256","capturedAt","rationale"])||!M.includes(o.kind)||!ge.test(o.artifactId)||e.has(o.artifactId)||o.captureMethod!==Se[o.kind]||!F.test(o.sha256)||typeof o.rationale!="string"||o.rationale.length<30||o.rationale.length>500||/[\x00-\x1f\x7f]/.test(o.rationale))throw new Error("qa-scan-review-unverified");const s=typeof o.capturedAt=="string"?Date.parse(o.capturedAt):NaN;if(!Number.isFinite(s)||new Date(s).toISOString()!==o.capturedAt||s>Date.now()+5*6e4||Date.now()-s>60*6e4)throw new Error("qa-scan-review-unverified");e.add(o.artifactId);const c=b(H(r,!1),o.artifactId),d=k(c);if(!d.isFile()||d.isSymbolicLink()||d.uid!==process.getuid?.()||(d.mode&63)!==0||d.size<8||d.size>oe||B(c)!==c)throw new Error("qa-scan-review-unverified");const a=z(c,X.O_RDONLY|(X.O_NOFOLLOW??0));let g;try{const f=Z(a);if(!f.isFile()||f.dev!==d.dev||f.ino!==d.ino||f.uid!==d.uid||f.size!==d.size)throw new Error("qa-scan-review-unverified");g=j(a);const l=Z(a),p=k(c);if(l.dev!==f.dev||l.ino!==f.ino||l.size!==f.size||l.mtimeMs!==f.mtimeMs||l.ctimeMs!==f.ctimeMs||p.dev!==f.dev||p.ino!==f.ino)throw new Error("qa-scan-review-unverified")}finally{$(a)}if(C(g)!==o.sha256)throw new Error("qa-scan-review-unverified");if(o.artifactId.endsWith(".png")){if(o.captureMethod!=="browser-screenshot"||!g.subarray(0,8).equals(se))throw new Error("qa-scan-review-unverified")}else{if(o.captureMethod==="browser-screenshot")throw new Error("qa-scan-review-unverified");try{const f=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(g));if(!f||typeof f!="object"||Array.isArray(f))throw new Error}catch{throw new Error("qa-scan-review-unverified")}}if(t.verdict==="approved"&&!Ae(o.kind,g))throw new Error("qa-scan-review-unverified");n.push(`${o.kind}:${o.artifactId}:${o.sha256}`)}return C(`root-qa-scan-evidence-v2\0${n.sort().join("\0")}`)}function G(r,t,e,n){try{const o=P(r,t,e);if(!m(n,["schemaVersion","evidenceContractVersion","kind","sourceHead","planSha256","surface","targetSha256","verdict","observations","issues"])||n.schemaVersion!==1||n.evidenceContractVersion!==V||n.kind!=="root-qa-scan-report"||n.sourceHead!==o.sourceHead||n.planSha256!==o.planSha256||n.surface!==o.surface||n.targetSha256!==o.targetSha256||n.verdict!=="approved"&&n.verdict!=="issues-found"||!Array.isArray(n.observations)||n.observations.length!==M.length||!Array.isArray(n.issues)||n.issues.length>128||Buffer.byteLength(JSON.stringify(n))>T)throw new Error("qa-scan-review-unverified");const s=n;if(s.observations.map(a=>a.kind).sort().join("\0")!==[...M].sort().join("\0"))throw new Error("qa-scan-review-unverified");const c=ie(E(r),s),d=new Set(s.observations.map(a=>a.artifactId));for(const a of s.issues)if(!m(a,["severity","evidenceArtifactId","summary"])||!["critical","high","medium","low"].includes(a.severity)||!d.has(a.evidenceArtifactId)||typeof a.summary!="string"||a.summary.length<20||a.summary.length>500||/[\x00-\x1f\x7f]/.test(a.summary))throw new Error("qa-scan-review-unverified");if(s.verdict==="approved"!=(s.issues.length===0))throw new Error("qa-scan-review-unverified");if(L(E(r))!==o.sourceHead||ie(E(r),s)!==c)throw new Error("qa-scan-review-unverified");return Object.freeze({plan:o,report:s,evidenceSha256:c,reviewSha256:C(`root-qa-scan-review-v2\0${JSON.stringify(s)}`)})}catch{throw new Error("qa-scan-review-unverified")}}function ae(r){return Object.freeze({schemaVersion:1,evidenceContractVersion:V,kind:"root-qa-scan-review",sourceHead:r.plan.sourceHead,planSha256:r.plan.planSha256,evidenceSha256:r.evidenceSha256,reviewSha256:r.reviewSha256,evidenceCount:8,issueCount:r.report.issues.length,verdict:r.report.verdict,qaAccepted:r.report.verdict==="approved",checkpointAccepted:!1,workflowContinuationAuthorized:!1,localOnly:!0,publicSafe:!0})}function Ce(r,t,e,n){try{const o=E(r),s=G(o,t,e,n),c=ae(s),d=I(o,!0),a=b(d,`review-${c.planSha256}.json`),g={report:s.report,receipt:c},f={schemaVersion:1,kind:"root-qa-scan-review-record",...g,checksumSha256:C(`root-qa-scan-review-record-v1\0${JSON.stringify(g)}`)},l=`${JSON.stringify(f)}
-`;if(D(a)){const i=k(a);if(!i.isFile()||i.isSymbolicLink()||i.uid!==process.getuid?.()||(i.mode&63)!==0||j(a,"utf8")!==l)throw new Error("qa-scan-review-unverified");return c}const p=b(d,`review-${Y()}.tmp`),y=z(p,"wx",384);try{ne(y,l),J(y)}finally{$(y)}try{if(G(o,t,e,n).reviewSha256!==c.reviewSha256)throw new Error("qa-scan-review-unverified");ee(p,a);const i=z(d,"r");try{J(i)}finally{$(i)}}finally{D(p)&&te(p)}return c}catch{throw new Error("qa-scan-review-unverified")}}function ce(r,t,e){return Oe(r,t,e).receipt}function Oe(r,t,e){try{const n=E(r),o=P(n,t,e),s=b(I(n,!1),`review-${o.planSha256}.json`),c=k(s);if(!c.isFile()||c.isSymbolicLink()||c.uid!==process.getuid?.()||(c.mode&63)!==0||c.size<1||c.size>T+4096)throw new Error("qa-scan-review-unverified");const d=j(s,"utf8"),a=JSON.parse(d);if(!m(a,["schemaVersion","kind","report","receipt","checksumSha256"])||a.schemaVersion!==1||a.kind!=="root-qa-scan-review-record"||typeof a.checksumSha256!="string"||!F.test(a.checksumSha256)||d!==`${JSON.stringify(a)}
-`)throw new Error("qa-scan-review-unverified");const g={report:a.report,receipt:a.receipt};if(a.checksumSha256!==C(`root-qa-scan-review-record-v1\0${JSON.stringify(g)}`))throw new Error("qa-scan-review-unverified");const f=G(n,t,e,a.report),l=ae(f);if(!m(a.receipt,Object.keys(l))||JSON.stringify(a.receipt)!==JSON.stringify(l))throw new Error("qa-scan-review-unverified");return Object.freeze({receipt:l,report:Object.freeze(structuredClone(f.report))})}catch{throw new Error("qa-scan-review-unverified")}}function U(r,t){try{if(!m(t,["schemaVersion","targets"])||t.schemaVersion!==1||!Array.isArray(t.targets)||t.targets.length<1||t.targets.length>16)throw new Error("qa-scan-review-aggregate-unverified");const e=E(r),n=L(e),o=new Set,s=new Set;let c;const d=t.targets.map(i=>{if(!m(i,["surface","targetUrl"])||typeof i.surface!="string"||typeof i.targetUrl!="string"||o.has(i.surface))throw new Error("qa-scan-review-aggregate-unverified");const v=P(e,i.surface,i.targetUrl),w=new URL(i.targetUrl).origin;if(v.sourceHead!==n||s.has(v.targetSha256)||c!==void 0&&c!==w)throw new Error("qa-scan-review-aggregate-unverified");return c=w,o.add(i.surface),s.add(v.targetSha256),{surface:i.surface,targetUrl:i.targetUrl,plan:v}}).sort((i,v)=>i.surface<v.surface?-1:i.surface>v.surface?1:0),a=()=>d.map(({surface:i,targetUrl:v,plan:w})=>{const S=ce(e,i,v);if(S.sourceHead!==n||S.planSha256!==w.planSha256)throw new Error("qa-scan-review-aggregate-unverified");return S}),g=a(),f=a();if(L(e)!==n||JSON.stringify(g)!==JSON.stringify(f))throw new Error("qa-scan-review-aggregate-unverified");if(new Set(f.map(i=>i.evidenceSha256)).size!==f.length)throw new Error("qa-scan-review-aggregate-unverified");const l=f.reduce((i,v)=>i+v.issueCount,0),p=f.every(i=>i.qaAccepted&&i.verdict==="approved"),y=C(`root-qa-scan-aggregate-v2\0${n}\0${f.map(i=>[i.planSha256,i.evidenceSha256,i.reviewSha256,i.verdict,i.issueCount].join(":")).join("\0")}`);return Object.freeze({schemaVersion:1,evidenceContractVersion:V,kind:"root-qa-scan-aggregate",sourceHead:n,aggregateSha256:y,surfaceCount:f.length,evidenceCount:f.reduce((i,v)=>i+v.evidenceCount,0),issueCount:l,verdict:p?"approved":"issues-found",qaAccepted:p,checkpointAccepted:!1,workflowContinuationAuthorized:!1,localOnly:!0,publicSafe:!0})}catch{throw new Error("qa-scan-review-aggregate-unverified")}}function K(r){if(r.qaAccepted&&(r.verdict!=="approved"||r.issueCount!==0)||!r.qaAccepted&&(r.verdict!=="issues-found"||r.issueCount<1))throw new Error("qa-scan-review-phase-unverified");return Object.freeze({schemaVersion:1,evidenceContractVersion:V,kind:"root-qa-scan-phase-checkpoint",sourceHead:r.sourceHead,aggregateSha256:r.aggregateSha256,surfaceCount:r.surfaceCount,q01DiscoveryEvidenceValidated:!0,q02InteractionEvidenceValidated:!0,q03RootTriageValidated:!0,qaAccepted:r.qaAccepted,rootPhaseCheckpointAccepted:!0,workflowContinuationAuthorized:!1,localOnly:!0,publicSafe:!0})}function be(r,t){try{const e=E(r),n=U(e,t),o=K(n),s=I(e,!0),c=b(s,`phase-${o.aggregateSha256}.json`),d={receipt:o},a={schemaVersion:1,kind:"root-qa-scan-phase-record",...d,checksumSha256:C(`root-qa-scan-phase-record-v1\0${JSON.stringify(d)}`)},g=`${JSON.stringify(a)}
-`;if(D(c)){if(de(e,t).aggregateSha256!==o.aggregateSha256)throw new Error("qa-scan-review-phase-unverified");return o}const f=b(s,`phase-${Y()}.tmp`),l=z(f,"wx",384);try{ne(l,g),J(l)}finally{$(l)}try{const p=K(U(e,t));if(JSON.stringify(p)!==JSON.stringify(o))throw new Error("qa-scan-review-phase-unverified");ee(f,c);const y=z(s,"r");try{J(y)}finally{$(y)}}finally{D(f)&&te(f)}return o}catch{throw new Error("qa-scan-review-phase-unverified")}}function de(r,t){try{const e=E(r),n=K(U(e,t)),o=b(I(e,!1),`phase-${n.aggregateSha256}.json`),s=k(o);if(!s.isFile()||s.isSymbolicLink()||s.uid!==process.getuid?.()||(s.mode&63)!==0||s.size<1||s.size>4096)throw new Error("qa-scan-review-phase-unverified");const c=j(o,"utf8"),d=JSON.parse(c);if(!m(d,["schemaVersion","kind","receipt","checksumSha256"])||d.schemaVersion!==1||d.kind!=="root-qa-scan-phase-record"||d.checksumSha256!==C(`root-qa-scan-phase-record-v1\0${JSON.stringify({receipt:d.receipt})}`)||!m(d.receipt,Object.keys(n))||JSON.stringify(d.receipt)!==JSON.stringify(n)||c!==`${JSON.stringify(d)}
-`)throw new Error("qa-scan-review-phase-unverified");return n}catch{throw new Error("qa-scan-review-phase-unverified")}}async function Ie(r){const t=r[0];let e=process.cwd(),n="",o="",s="plain",c=!1,d=!1,a=!1,g=!1,f=!1,l="",p="",y="";const i=new Set;try{if(t!=="plan"&&t!=="capture"&&t!=="interact"&&t!=="accept"&&t!=="status"&&t!=="aggregate"&&t!=="phase-checkpoint"&&t!=="phase-status"&&t!=="discover"&&t!=="discovery-status"&&t!=="discovered-phase-checkpoint"&&t!=="discovered-phase-status")throw new Error("qa-scan-review-action-invalid");for(let u=1;u<r.length;u++){const h=r[u];if(i.has(h))throw new Error("qa-scan-review-argument-duplicate");i.add(h);const q=()=>r[++u]??"";if(h==="--project-root")e=q();else if(h==="--surface")n=q();else if(h==="--target-url")o=q();else if(h==="--action-id")p=q();else if(h==="--expected-status")y=q();else if(h==="--discovery-sha")l=q();else if(h==="--format"){const O=q();if(O!=="json"&&O!=="plain")throw new Error("qa-scan-review-format-invalid");s=O}else if(h==="--authorize-review")c=!0;else if(h==="--authorize-capture")d=!0;else if(h==="--authorize-interaction")a=!0;else if(h==="--authorize-discovery")g=!0;else if(h==="--authorize-root-checkpoint")f=!0;else throw new Error("qa-scan-review-argument-invalid")}const v=t==="discovered-phase-checkpoint"||t==="discovered-phase-status",w=t==="aggregate"||t==="phase-checkpoint"||t==="phase-status"||v,S=t==="discover"||t==="discovery-status",x=t==="phase-checkpoint"||t==="discovered-phase-checkpoint";if(!e||(w||t==="discovery-status"?i.has("--surface")||i.has("--target-url"):t==="discover"?i.has("--surface")||!o:!n||!o)||c!==(t==="accept")||d!==(t==="capture")||a!==(t==="interact")||g!==(t==="discover")||f!==x||(v||t==="discovery-status"?!F.test(l):i.has("--discovery-sha"))||(t==="interact"?!p||!y:i.has("--action-id")||i.has("--expected-status")))throw new Error("qa-scan-review-authorization-or-target-required");if(w){let u="";for await(const le of process.stdin)if(u+=String(le),Buffer.byteLength(u)>T)throw new Error("qa-scan-review-too-large");const{parseDocument:h}=await import("yaml"),q=h(u,{strict:!0,uniqueKeys:!0,schema:"core",customTags:[]});if(q.errors.length||q.warnings.length)throw new Error(t==="aggregate"?"qa-scan-review-aggregate-unverified":"qa-scan-review-phase-unverified");const O=JSON.parse(u),N=v?t==="discovered-phase-checkpoint"?(await import("./qa-scan-discovery.js")).acceptRootQaScanDiscoveredPhase(e,l,O):(await import("./qa-scan-discovery.js")).readRootQaScanDiscoveredPhase(e,l,O):t==="aggregate"?U(e,O):t==="phase-checkpoint"?be(e,O):de(e,O);return s==="json"?console.log(JSON.stringify(N)):"verdict"in N?console.log(`Root QA scan aggregate ${N.verdict}; surfaces=${N.surfaceCount}, issues=${N.issueCount}, workflow-continuation=unauthorized`):console.log(`Root QA scan bounded local evidence checkpoint; surfaces=${N.surfaceCount}, qa-accepted=${N.qaAccepted}, workflow-continuation=unauthorized`),N.qaAccepted?0:2}if(S){const{discoverRootQaScanLinks:u,readRootQaScanDiscovery:h}=await import("./qa-scan-discovery.js"),q=t==="discover"?await u({projectRoot:e,seedUrl:o,authorizeDiscovery:g}):h(e,l);return console.log(s==="json"?JSON.stringify(q):`Root QA scan link inventory; targets=${q.targetCount}, QA=not-accepted`),0}if(t==="capture"){const{captureRootQaScan:u}=await import("./qa-scan-capture.js"),h=await u({projectRoot:e,surface:n,targetUrl:o,authorizeCapture:d});return console.log(s==="json"?JSON.stringify(h):`Root QA scan captured ${h.evidenceCount} private artifacts; independent review required`),0}if(t==="interact"){const{captureRootQaScanInteraction:u}=await import("./qa-scan-capture.js"),h=await u({projectRoot:e,surface:n,targetUrl:o,actionId:p,expectedStatus:y,authorizeInteraction:a});return console.log(s==="json"?JSON.stringify(h):"Root QA scan synthetic interaction captured; independent review required"),0}if(t==="plan"){const u=P(e,n,o),h=H(E(e),!1);return console.log(s==="json"?JSON.stringify({plan:u,evidenceDirectory:h,approvedEvidenceContract:me}):`Root QA scan plan ${u.planSha256}; evidence directory ${h}; no QA accepted; use --format json for approved evidence contract`),0}if(t==="status"){const u=ce(e,n,o);return console.log(s==="json"?JSON.stringify(u):`Root QA scan ${u.verdict}; evidence=${u.evidenceCount}, issues=${u.issueCount}, qaAccepted=${u.qaAccepted}`),u.qaAccepted?0:2}let A="";for await(const u of process.stdin)if(A+=String(u),Buffer.byteLength(A)>T)throw new Error("qa-scan-review-too-large");const{parseDocument:fe}=await import("yaml"),W=fe(A,{strict:!0,uniqueKeys:!0,schema:"core",customTags:[]});if(W.errors.length||W.warnings.length)throw new Error("qa-scan-review-unverified");const ue=JSON.parse(A),R=Ce(e,n,o,ue);return console.log(s==="json"?JSON.stringify(R):`Root QA scan ${R.verdict}; evidence=${R.evidenceCount}, issues=${R.issueCount}, qaAccepted=${R.qaAccepted}`),R.qaAccepted?0:2}catch(v){const w=v instanceof Error&&/^qa-scan-review-[a-z-]+$/.test(v.message)?v.message:"qa-scan-review-unverified";return s==="json"?console.log(JSON.stringify({ok:!1,reasonCode:w})):console.error(w),1}}export{be as acceptRootQaScanPhaseCheckpoint,Ce as acceptRootQaScanReview,U as aggregateRootQaScanReviews,P as planRootQaScan,Ie as qaScanReviewCliHandler,de as readRootQaScanPhaseCheckpoint,ce as readRootQaScanReview,Oe as readRootQaScanReviewedEvidence,Ve as rootQaScanEvidenceDirectory,Ae as validateRootQaScanArtifact,Ee as validateRootQaScanPng,G as validateRootQaScanReview};
+/** Root-owned, local-only QA scan review bound to physical browser evidence. */
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, constants, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { inflateSync } from 'node:zlib';
+import { mutationQaGit } from './mutation-qa-git.js';
+const SHA256 = /^[a-f0-9]{64}$/;
+const SURFACE = /^[a-z][a-z0-9-]{0,63}$/;
+const ARTIFACT = /^[a-z][a-z0-9-]{0,63}\.(?:png|json)$/;
+const MAX_ARTIFACT_BYTES = 8 * 1024 * 1024;
+const MAX_REPORT_BYTES = 128 * 1024;
+const EVIDENCE_CONTRACT_VERSION = 2;
+const PNG = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+const PNG_CRC_TABLE = Uint32Array.from({ length: 256 }, (_, index) => {
+    let value = index;
+    for (let bit = 0; bit < 8; bit++) {
+        value = (value & 1) !== 0 ? 0xedb88320 ^ (value >>> 1) : value >>> 1;
+    }
+    return value >>> 0;
+});
+const KINDS = ['visual', 'responsive', 'responsive-tablet', 'responsive-desktop',
+    'accessibility', 'interaction', 'console-network', 'performance'];
+const METHODS = Object.freeze({
+    visual: 'browser-screenshot', responsive: 'browser-screenshot',
+    'responsive-tablet': 'browser-screenshot', 'responsive-desktop': 'browser-screenshot',
+    accessibility: 'axe-scan', interaction: 'browser-interaction',
+    'console-network': 'console-capture', performance: 'performance-trace',
+});
+const APPROVED_EVIDENCE_CONTRACT = Object.freeze({
+    visual: 'PNG 8-bit non-interlaced CRC+IDAT verified; width=1440, 600<=height<=4096, pixels<=8000000',
+    responsive: 'PNG 8-bit non-interlaced CRC+IDAT verified; width=375, 600<=height<=4096',
+    'responsive-tablet': 'PNG 8-bit non-interlaced CRC+IDAT verified; width=768, 600<=height<=4096',
+    'responsive-desktop': 'PNG 8-bit non-interlaced CRC+IDAT verified; width=1024, 600<=height<=4096',
+    accessibility: 'JSON: schemaVersion=1 engine=axe-core violationCount=0 incompleteCount=0 passCount>0',
+    interaction: 'JSON: schemaVersion=2 syntheticTarget=true networkAttemptsAfterAction=0 checks=[{id:functional-safe-slug,passed:true}] (1..32 distinct)',
+    'console-network': 'JSON: schemaVersion=1 initialCapture=true consoleErrors=0 pageErrors=0 failedRequests=0 requestsObserved>0',
+    performance: 'JSON: schemaVersion=1 metric=load 0<=observedMs<=budgetMs<=30000',
+});
+function nonnegativeInteger(value, maximum = 1_000_000) {
+    return Number.isSafeInteger(value) && value >= 0 && value <= maximum;
+}
+function pngCrc(bytes, start, end) {
+    let crc = 0xffffffff;
+    for (let index = start; index < end; index++) {
+        crc = PNG_CRC_TABLE[(crc ^ bytes[index]) & 0xff] ^ (crc >>> 8);
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+/** An IHDR-sized prefix is not a screenshot. Check the bounded PNG stream,
+ * chunk checksums and decompressed scanlines before an approved QA verdict. */
+export function validateRootQaScanPng(bytes, kind) {
+    if (bytes.length < 57 || !bytes.subarray(0, 8).equals(PNG))
+        return false;
+    let offset = 8;
+    let width = 0;
+    let height = 0;
+    let channels = 0;
+    let colorType = 0;
+    let seenIhdr = false;
+    let seenIend = false;
+    let seenPalette = false;
+    let closedIdat = false;
+    let chunks = 0;
+    const idat = [];
+    while (offset < bytes.length) {
+        if (++chunks > 1024)
+            return false;
+        if (bytes.length - offset < 12)
+            return false;
+        const length = bytes.readUInt32BE(offset);
+        const dataEnd = offset + 8 + length;
+        const next = dataEnd + 4;
+        if (length > MAX_ARTIFACT_BYTES || next > bytes.length)
+            return false;
+        const type = bytes.toString('ascii', offset + 4, offset + 8);
+        if (!/^[A-Za-z]{4}$/.test(type)
+            || pngCrc(bytes, offset + 4, dataEnd) !== bytes.readUInt32BE(dataEnd))
+            return false;
+        if (type === 'IHDR') {
+            if (seenIhdr || offset !== 8 || length !== 13)
+                return false;
+            seenIhdr = true;
+            width = bytes.readUInt32BE(offset + 8);
+            height = bytes.readUInt32BE(offset + 12);
+            colorType = bytes[offset + 17];
+            channels = colorType === 0 ? 1 : colorType === 2 ? 3 : colorType === 4 ? 2
+                : colorType === 6 ? 4 : 0;
+            if (!channels || bytes[offset + 16] !== 8 || bytes[offset + 18] !== 0
+                || bytes[offset + 19] !== 0 || bytes[offset + 20] !== 0
+                || width < 1 || height < 1 || width > 4096 || height > 4096
+                || width * height > 8_000_000)
+                return false;
+        }
+        else if (type === 'IDAT') {
+            if (!seenIhdr || closedIdat || length === 0)
+                return false;
+            idat.push(bytes.subarray(offset + 8, dataEnd));
+        }
+        else if (type === 'PLTE') {
+            if (!seenIhdr || seenPalette || idat.length > 0
+                || (colorType !== 2 && colorType !== 6)
+                || length === 0 || length > 768 || length % 3 !== 0)
+                return false;
+            seenPalette = true;
+        }
+        else if (type === 'IEND') {
+            if (!seenIhdr || idat.length === 0 || length !== 0 || next !== bytes.length)
+                return false;
+            seenIend = true;
+            break;
+        }
+        else {
+            if (!seenIhdr || type[0] === type[0]?.toUpperCase())
+                return false;
+            if (idat.length)
+                closedIdat = true;
+        }
+        offset = next;
+    }
+    const requiredWidth = { visual: 1440, responsive: 375,
+        'responsive-tablet': 768, 'responsive-desktop': 1024 }[kind];
+    if (!seenIend || width !== requiredWidth || height < 600)
+        return false;
+    const rowBytes = width * channels;
+    const expectedBytes = height * (rowBytes + 1);
+    try {
+        const pixels = inflateSync(Buffer.concat(idat), { maxOutputLength: expectedBytes + 1 });
+        if (pixels.length !== expectedBytes)
+            return false;
+        for (let row = 0; row < height; row++) {
+            if (pixels[row * (rowBytes + 1)] > 4)
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** A positive root verdict needs closed, complete observation claims, not generic JSON. */
+export function validateRootQaScanArtifact(kind, bytes) {
+    if (kind === 'visual' || kind === 'responsive'
+        || kind === 'responsive-tablet' || kind === 'responsive-desktop') {
+        return validateRootQaScanPng(bytes, kind);
+    }
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        return false;
+    }
+    if (kind === 'accessibility') {
+        return exact(value, ['schemaVersion', 'engine', 'violationCount', 'incompleteCount', 'passCount'])
+            && value.schemaVersion === 1 && value.engine === 'axe-core'
+            && value.violationCount === 0 && value.incompleteCount === 0
+            && nonnegativeInteger(value.passCount) && value.passCount > 0;
+    }
+    if (kind === 'interaction') {
+        if (!exact(value, ['schemaVersion', 'syntheticTarget', 'networkAttemptsAfterAction', 'checks'])
+            || value.schemaVersion !== 2 || value.syntheticTarget !== true
+            || value.networkAttemptsAfterAction !== 0
+            || !Array.isArray(value.checks) || value.checks.length < 1 || value.checks.length > 32)
+            return false;
+        const ids = new Set();
+        return value.checks.every((item) => {
+            if (!exact(item, ['id', 'passed']) || typeof item.id !== 'string'
+                || !/^functional-[a-z][a-z0-9-]{0,50}$/.test(item.id)
+                || ids.has(item.id) || item.passed !== true)
+                return false;
+            ids.add(item.id);
+            return true;
+        });
+    }
+    if (kind === 'console-network') {
+        return exact(value, ['schemaVersion', 'initialCapture', 'consoleErrors', 'pageErrors',
+            'failedRequests', 'requestsObserved']) && value.schemaVersion === 1
+            && value.initialCapture === true && value.consoleErrors === 0
+            && value.pageErrors === 0 && value.failedRequests === 0
+            && nonnegativeInteger(value.requestsObserved) && value.requestsObserved > 0;
+    }
+    return exact(value, ['schemaVersion', 'metric', 'observedMs', 'budgetMs'])
+        && value.schemaVersion === 1 && value.metric === 'load'
+        && nonnegativeInteger(value.observedMs, 30_000)
+        && nonnegativeInteger(value.budgetMs, 30_000) && value.budgetMs > 0
+        && value.observedMs <= value.budgetMs;
+}
+function sha(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function exact(value, keys) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        && Object.keys(value).sort().join('\0') === [...keys].sort().join('\0');
+}
+function privateDirectory(root, create) {
+    const commonRaw = mutationQaGit(root, ['rev-parse', '--git-common-dir']).toString('utf8').trim();
+    const common = isAbsolute(commonRaw) ? resolve(commonRaw) : resolve(root, commonRaw);
+    if (realpathSync(common) !== common || lstatSync(common).isSymbolicLink()
+        || lstatSync(common).uid !== process.getuid?.())
+        throw new Error('qa-scan-review-unverified');
+    const directory = join(common, 'neocortex-qa-scan');
+    if (create)
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+        || (stat.mode & 0o077) !== 0)
+        throw new Error('qa-scan-review-unverified');
+    return directory;
+}
+function evidenceDirectory(root, create) {
+    const directory = join(privateDirectory(root, create), 'evidence');
+    if (create)
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+        || (stat.mode & 0o077) !== 0)
+        throw new Error('qa-scan-review-unverified');
+    return directory;
+}
+/** The capture adapter may write only beneath the same private directory that
+ * the independent root reviewer reopens and hashes. */
+export function rootQaScanEvidenceDirectory(projectRoot) {
+    return evidenceDirectory(resolve(projectRoot), false);
+}
+function physicalSource(root) {
+    if (realpathSync(root) !== root || !lstatSync(root).isDirectory()
+        || mutationQaGit(root, ['rev-parse', '--show-toplevel']).toString('utf8').trim() !== root) {
+        throw new Error('qa-scan-review-unverified');
+    }
+    const status = mutationQaGit(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all'])
+        .toString('utf8').split('\0').filter(Boolean);
+    if (status.some((entry) => !/^.{2} \.neocortex\//.test(entry))) {
+        throw new Error('qa-scan-review-source-dirty');
+    }
+    const head = mutationQaGit(root, ['rev-parse', '--verify', 'HEAD']).toString('utf8').trim();
+    if (!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(head))
+        throw new Error('qa-scan-review-unverified');
+    return head;
+}
+function targetDigest(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error('qa-scan-review-target-invalid');
+    }
+    if (parsed.protocol !== 'http:' || !['127.0.0.1', 'localhost', '[::1]'].includes(parsed.hostname)
+        || !parsed.port || parsed.username || parsed.password || parsed.search || parsed.hash) {
+        throw new Error('qa-scan-review-target-invalid');
+    }
+    return sha(`qa-scan-loopback-target-v1\0${parsed.href}`);
+}
+/** Creates only an owner-private evidence directory; no project or QA state is changed. */
+export function planRootQaScan(projectRoot, surface, targetUrl) {
+    try {
+        if (!SURFACE.test(surface))
+            throw new Error('qa-scan-review-surface-invalid');
+        const root = resolve(projectRoot);
+        const sourceHead = physicalSource(root);
+        const targetSha256 = targetDigest(targetUrl);
+        evidenceDirectory(root, true);
+        const fields = { schemaVersion: 1, evidenceContractVersion: EVIDENCE_CONTRACT_VERSION,
+            kind: 'root-qa-scan-plan',
+            sourceHead, surface, targetSha256, requiredKinds: KINDS,
+            qaAccepted: false, localOnly: true };
+        return Object.freeze({ ...fields,
+            planSha256: sha(`root-qa-scan-plan-v2\0${JSON.stringify(fields)}`) });
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('qa-scan-review-'))
+            throw error;
+        throw new Error('qa-scan-review-unverified');
+    }
+}
+function checkedEvidence(root, report) {
+    const ids = new Set();
+    const hashes = [];
+    for (const row of report.observations) {
+        if (!exact(row, ['kind', 'artifactId', 'captureMethod', 'sha256', 'capturedAt', 'rationale'])
+            || !KINDS.includes(row.kind) || !ARTIFACT.test(row.artifactId)
+            || ids.has(row.artifactId) || row.captureMethod !== METHODS[row.kind]
+            || !SHA256.test(row.sha256) || typeof row.rationale !== 'string'
+            || row.rationale.length < 30 || row.rationale.length > 500
+            || /[\x00-\x1f\x7f]/.test(row.rationale))
+            throw new Error('qa-scan-review-unverified');
+        const capturedMs = typeof row.capturedAt === 'string' ? Date.parse(row.capturedAt) : NaN;
+        if (!Number.isFinite(capturedMs) || new Date(capturedMs).toISOString() !== row.capturedAt
+            || capturedMs > Date.now() + 5 * 60_000 || Date.now() - capturedMs > 60 * 60_000) {
+            throw new Error('qa-scan-review-unverified');
+        }
+        ids.add(row.artifactId);
+        const path = join(evidenceDirectory(root, false), row.artifactId);
+        const stat = lstatSync(path);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+            || (stat.mode & 0o077) !== 0 || stat.size < 8 || stat.size > MAX_ARTIFACT_BYTES
+            || realpathSync(path) !== path)
+            throw new Error('qa-scan-review-unverified');
+        const handle = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        let bytes;
+        try {
+            const before = fstatSync(handle);
+            if (!before.isFile() || before.dev !== stat.dev || before.ino !== stat.ino
+                || before.uid !== stat.uid || before.size !== stat.size) {
+                throw new Error('qa-scan-review-unverified');
+            }
+            bytes = readFileSync(handle);
+            const after = fstatSync(handle);
+            const current = lstatSync(path);
+            if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size
+                || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs
+                || current.dev !== before.dev || current.ino !== before.ino) {
+                throw new Error('qa-scan-review-unverified');
+            }
+        }
+        finally {
+            closeSync(handle);
+        }
+        if (sha(bytes) !== row.sha256)
+            throw new Error('qa-scan-review-unverified');
+        if (row.artifactId.endsWith('.png')) {
+            if (row.captureMethod !== 'browser-screenshot' || !bytes.subarray(0, 8).equals(PNG)) {
+                throw new Error('qa-scan-review-unverified');
+            }
+        }
+        else {
+            if (row.captureMethod === 'browser-screenshot')
+                throw new Error('qa-scan-review-unverified');
+            try {
+                const parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                    throw new Error();
+            }
+            catch {
+                throw new Error('qa-scan-review-unverified');
+            }
+        }
+        if (report.verdict === 'approved' && !validateRootQaScanArtifact(row.kind, bytes)) {
+            throw new Error('qa-scan-review-unverified');
+        }
+        hashes.push(`${row.kind}:${row.artifactId}:${row.sha256}`);
+    }
+    return sha(`root-qa-scan-evidence-v2\0${hashes.sort().join('\0')}`);
+}
+/** The root must independently inspect every physical artifact before signing this report. */
+export function validateRootQaScanReview(projectRoot, surface, targetUrl, input) {
+    try {
+        const plan = planRootQaScan(projectRoot, surface, targetUrl);
+        if (!exact(input, ['schemaVersion', 'evidenceContractVersion', 'kind', 'sourceHead', 'planSha256', 'surface',
+            'targetSha256', 'verdict', 'observations', 'issues'])
+            || input.schemaVersion !== 1 || input.evidenceContractVersion !== EVIDENCE_CONTRACT_VERSION
+            || input.kind !== 'root-qa-scan-report'
+            || input.sourceHead !== plan.sourceHead || input.planSha256 !== plan.planSha256
+            || input.surface !== plan.surface || input.targetSha256 !== plan.targetSha256
+            || (input.verdict !== 'approved' && input.verdict !== 'issues-found')
+            || !Array.isArray(input.observations) || input.observations.length !== KINDS.length
+            || !Array.isArray(input.issues) || input.issues.length > 128
+            || Buffer.byteLength(JSON.stringify(input)) > MAX_REPORT_BYTES)
+            throw new Error('qa-scan-review-unverified');
+        const report = input;
+        if (report.observations.map((row) => row.kind).sort().join('\0') !== [...KINDS].sort().join('\0')) {
+            throw new Error('qa-scan-review-unverified');
+        }
+        const evidenceSha256 = checkedEvidence(resolve(projectRoot), report);
+        const ids = new Set(report.observations.map((row) => row.artifactId));
+        for (const issue of report.issues) {
+            if (!exact(issue, ['severity', 'evidenceArtifactId', 'summary'])
+                || !['critical', 'high', 'medium', 'low'].includes(issue.severity)
+                || !ids.has(issue.evidenceArtifactId) || typeof issue.summary !== 'string'
+                || issue.summary.length < 20 || issue.summary.length > 500
+                || /[\x00-\x1f\x7f]/.test(issue.summary))
+                throw new Error('qa-scan-review-unverified');
+        }
+        if ((report.verdict === 'approved') !== (report.issues.length === 0)) {
+            throw new Error('qa-scan-review-unverified');
+        }
+        if (physicalSource(resolve(projectRoot)) !== plan.sourceHead
+            || checkedEvidence(resolve(projectRoot), report) !== evidenceSha256) {
+            throw new Error('qa-scan-review-unverified');
+        }
+        return Object.freeze({ plan, report, evidenceSha256,
+            reviewSha256: sha(`root-qa-scan-review-v2\0${JSON.stringify(report)}`) });
+    }
+    catch {
+        throw new Error('qa-scan-review-unverified');
+    }
+}
+function receiptFrom(checked) {
+    return Object.freeze({ schemaVersion: 1, evidenceContractVersion: EVIDENCE_CONTRACT_VERSION,
+        kind: 'root-qa-scan-review',
+        sourceHead: checked.plan.sourceHead, planSha256: checked.plan.planSha256,
+        evidenceSha256: checked.evidenceSha256, reviewSha256: checked.reviewSha256,
+        evidenceCount: 8, issueCount: checked.report.issues.length, verdict: checked.report.verdict,
+        qaAccepted: checked.report.verdict === 'approved', checkpointAccepted: false,
+        workflowContinuationAuthorized: false, localOnly: true, publicSafe: true });
+}
+/** Immutable local record: a tested report is not inferred from a server selection. */
+export function acceptRootQaScanReview(projectRoot, surface, targetUrl, input) {
+    try {
+        const root = resolve(projectRoot);
+        const checked = validateRootQaScanReview(root, surface, targetUrl, input);
+        const receipt = receiptFrom(checked);
+        const directory = privateDirectory(root, true);
+        const target = join(directory, `review-${receipt.planSha256}.json`);
+        const payload = { report: checked.report, receipt };
+        const record = { schemaVersion: 1, kind: 'root-qa-scan-review-record', ...payload,
+            checksumSha256: sha(`root-qa-scan-review-record-v1\0${JSON.stringify(payload)}`) };
+        const encoded = `${JSON.stringify(record)}\n`;
+        if (existsSync(target)) {
+            const stat = lstatSync(target);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+                || (stat.mode & 0o077) !== 0 || readFileSync(target, 'utf8') !== encoded) {
+                throw new Error('qa-scan-review-unverified');
+            }
+            return receipt;
+        }
+        const temporary = join(directory, `review-${randomUUID()}.tmp`);
+        const handle = openSync(temporary, 'wx', 0o600);
+        try {
+            writeFileSync(handle, encoded);
+            fsyncSync(handle);
+        }
+        finally {
+            closeSync(handle);
+        }
+        try {
+            if (validateRootQaScanReview(root, surface, targetUrl, input).reviewSha256 !== receipt.reviewSha256) {
+                throw new Error('qa-scan-review-unverified');
+            }
+            linkSync(temporary, target);
+            const directoryHandle = openSync(directory, 'r');
+            try {
+                fsyncSync(directoryHandle);
+            }
+            finally {
+                closeSync(directoryHandle);
+            }
+        }
+        finally {
+            if (existsSync(temporary))
+                unlinkSync(temporary);
+        }
+        return receipt;
+    }
+    catch {
+        throw new Error('qa-scan-review-unverified');
+    }
+}
+/** Rechecks the private report and every artifact against the current physical source. */
+export function readRootQaScanReview(projectRoot, surface, targetUrl) {
+    return readRootQaScanReviewedEvidence(projectRoot, surface, targetUrl).receipt;
+}
+/** Private worker/root read only. CLI projections must return the receipt alone. */
+export function readRootQaScanReviewedEvidence(projectRoot, surface, targetUrl) {
+    try {
+        const root = resolve(projectRoot);
+        const plan = planRootQaScan(root, surface, targetUrl);
+        const target = join(privateDirectory(root, false), `review-${plan.planSha256}.json`);
+        const stat = lstatSync(target);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+            || (stat.mode & 0o077) !== 0 || stat.size < 1 || stat.size > MAX_REPORT_BYTES + 4096) {
+            throw new Error('qa-scan-review-unverified');
+        }
+        const raw = readFileSync(target, 'utf8');
+        const record = JSON.parse(raw);
+        if (!exact(record, ['schemaVersion', 'kind', 'report', 'receipt', 'checksumSha256'])
+            || record.schemaVersion !== 1 || record.kind !== 'root-qa-scan-review-record'
+            || typeof record.checksumSha256 !== 'string' || !SHA256.test(record.checksumSha256)
+            || raw !== `${JSON.stringify(record)}\n`)
+            throw new Error('qa-scan-review-unverified');
+        const payload = { report: record.report, receipt: record.receipt };
+        if (record.checksumSha256 !== sha(`root-qa-scan-review-record-v1\0${JSON.stringify(payload)}`)) {
+            throw new Error('qa-scan-review-unverified');
+        }
+        const checked = validateRootQaScanReview(root, surface, targetUrl, record.report);
+        const expected = receiptFrom(checked);
+        if (!exact(record.receipt, Object.keys(expected))
+            || JSON.stringify(record.receipt) !== JSON.stringify(expected))
+            throw new Error('qa-scan-review-unverified');
+        return Object.freeze({ receipt: expected, report: Object.freeze(structuredClone(checked.report)) });
+    }
+    catch {
+        throw new Error('qa-scan-review-unverified');
+    }
+}
+/** Reopens every independent root verdict and its eight physical artifacts.
+ * Covers the selected nonempty surface set, never server graph or release authority. */
+export function aggregateRootQaScanReviews(projectRoot, input) {
+    try {
+        if (!exact(input, ['schemaVersion', 'targets']) || input.schemaVersion !== 1
+            || !Array.isArray(input.targets) || input.targets.length < 1 || input.targets.length > 16) {
+            throw new Error('qa-scan-review-aggregate-unverified');
+        }
+        const root = resolve(projectRoot);
+        const sourceHead = physicalSource(root);
+        const surfaces = new Set();
+        const targetDigests = new Set();
+        let origin;
+        const targets = input.targets.map((target) => {
+            if (!exact(target, ['surface', 'targetUrl']) || typeof target.surface !== 'string'
+                || typeof target.targetUrl !== 'string' || surfaces.has(target.surface)) {
+                throw new Error('qa-scan-review-aggregate-unverified');
+            }
+            const plan = planRootQaScan(root, target.surface, target.targetUrl);
+            const targetOrigin = new URL(target.targetUrl).origin;
+            if (plan.sourceHead !== sourceHead || targetDigests.has(plan.targetSha256)
+                || (origin !== undefined && origin !== targetOrigin)) {
+                throw new Error('qa-scan-review-aggregate-unverified');
+            }
+            origin = targetOrigin;
+            surfaces.add(target.surface);
+            targetDigests.add(plan.targetSha256);
+            return { surface: target.surface, targetUrl: target.targetUrl, plan };
+        }).sort((a, b) => a.surface < b.surface ? -1 : a.surface > b.surface ? 1 : 0);
+        const read = () => targets.map(({ surface, targetUrl, plan }) => {
+            const receipt = readRootQaScanReview(root, surface, targetUrl);
+            if (receipt.sourceHead !== sourceHead || receipt.planSha256 !== plan.planSha256) {
+                throw new Error('qa-scan-review-aggregate-unverified');
+            }
+            return receipt;
+        });
+        const first = read();
+        const last = read();
+        if (physicalSource(root) !== sourceHead || JSON.stringify(first) !== JSON.stringify(last)) {
+            throw new Error('qa-scan-review-aggregate-unverified');
+        }
+        if (new Set(last.map((receipt) => receipt.evidenceSha256)).size !== last.length) {
+            throw new Error('qa-scan-review-aggregate-unverified');
+        }
+        const issueCount = last.reduce((total, receipt) => total + receipt.issueCount, 0);
+        const approved = last.every((receipt) => receipt.qaAccepted && receipt.verdict === 'approved');
+        const aggregateSha256 = sha(`root-qa-scan-aggregate-v2\0${sourceHead}\0${last.map((receipt) => [
+            receipt.planSha256, receipt.evidenceSha256, receipt.reviewSha256,
+            receipt.verdict, receipt.issueCount,
+        ].join(':')).join('\0')}`);
+        return Object.freeze({ schemaVersion: 1, evidenceContractVersion: EVIDENCE_CONTRACT_VERSION,
+            kind: 'root-qa-scan-aggregate',
+            sourceHead, aggregateSha256, surfaceCount: last.length,
+            evidenceCount: last.reduce((total, receipt) => total + receipt.evidenceCount, 0),
+            issueCount, verdict: approved ? 'approved' : 'issues-found', qaAccepted: approved,
+            checkpointAccepted: false, workflowContinuationAuthorized: false,
+            localOnly: true, publicSafe: true });
+    }
+    catch {
+        throw new Error('qa-scan-review-aggregate-unverified');
+    }
+}
+function phaseCheckpointFrom(aggregate) {
+    if ((aggregate.qaAccepted && (aggregate.verdict !== 'approved' || aggregate.issueCount !== 0))
+        || (!aggregate.qaAccepted && (aggregate.verdict !== 'issues-found' || aggregate.issueCount < 1))) {
+        throw new Error('qa-scan-review-phase-unverified');
+    }
+    return Object.freeze({ schemaVersion: 1, evidenceContractVersion: EVIDENCE_CONTRACT_VERSION,
+        kind: 'root-qa-scan-phase-checkpoint',
+        sourceHead: aggregate.sourceHead, aggregateSha256: aggregate.aggregateSha256,
+        surfaceCount: aggregate.surfaceCount,
+        q01DiscoveryEvidenceValidated: true, q02InteractionEvidenceValidated: true,
+        q03RootTriageValidated: true, qaAccepted: aggregate.qaAccepted,
+        rootPhaseCheckpointAccepted: true, workflowContinuationAuthorized: false,
+        localOnly: true, publicSafe: true });
+}
+/** Revalidates every private review and artifact, then saves an immutable root
+ * synthesis. This is local QA state only, never a server graph advancement. */
+export function acceptRootQaScanPhaseCheckpoint(projectRoot, input) {
+    try {
+        const root = resolve(projectRoot);
+        const aggregate = aggregateRootQaScanReviews(root, input);
+        const receipt = phaseCheckpointFrom(aggregate);
+        const directory = privateDirectory(root, true);
+        const target = join(directory, `phase-${receipt.aggregateSha256}.json`);
+        const payload = { receipt };
+        const record = { schemaVersion: 1, kind: 'root-qa-scan-phase-record', ...payload,
+            checksumSha256: sha(`root-qa-scan-phase-record-v1\0${JSON.stringify(payload)}`) };
+        const encoded = `${JSON.stringify(record)}\n`;
+        if (existsSync(target)) {
+            if (readRootQaScanPhaseCheckpoint(root, input).aggregateSha256 !== receipt.aggregateSha256) {
+                throw new Error('qa-scan-review-phase-unverified');
+            }
+            return receipt;
+        }
+        const temporary = join(directory, `phase-${randomUUID()}.tmp`);
+        const handle = openSync(temporary, 'wx', 0o600);
+        try {
+            writeFileSync(handle, encoded);
+            fsyncSync(handle);
+        }
+        finally {
+            closeSync(handle);
+        }
+        try {
+            const fresh = phaseCheckpointFrom(aggregateRootQaScanReviews(root, input));
+            if (JSON.stringify(fresh) !== JSON.stringify(receipt)) {
+                throw new Error('qa-scan-review-phase-unverified');
+            }
+            linkSync(temporary, target);
+            const directoryHandle = openSync(directory, 'r');
+            try {
+                fsyncSync(directoryHandle);
+            }
+            finally {
+                closeSync(directoryHandle);
+            }
+        }
+        finally {
+            if (existsSync(temporary))
+                unlinkSync(temporary);
+        }
+        return receipt;
+    }
+    catch {
+        throw new Error('qa-scan-review-phase-unverified');
+    }
+}
+/** A checkpoint is valid only while the current source and all underlying
+ * root reviews and artifacts still match its immutable aggregate. */
+export function readRootQaScanPhaseCheckpoint(projectRoot, input) {
+    try {
+        const root = resolve(projectRoot);
+        const expected = phaseCheckpointFrom(aggregateRootQaScanReviews(root, input));
+        const target = join(privateDirectory(root, false), `phase-${expected.aggregateSha256}.json`);
+        const stat = lstatSync(target);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+            || (stat.mode & 0o077) !== 0 || stat.size < 1 || stat.size > 4096) {
+            throw new Error('qa-scan-review-phase-unverified');
+        }
+        const raw = readFileSync(target, 'utf8');
+        const record = JSON.parse(raw);
+        if (!exact(record, ['schemaVersion', 'kind', 'receipt', 'checksumSha256'])
+            || record.schemaVersion !== 1 || record.kind !== 'root-qa-scan-phase-record'
+            || record.checksumSha256 !== sha(`root-qa-scan-phase-record-v1\0${JSON.stringify({ receipt: record.receipt })}`)
+            || !exact(record.receipt, Object.keys(expected))
+            || JSON.stringify(record.receipt) !== JSON.stringify(expected)
+            || raw !== `${JSON.stringify(record)}\n`)
+            throw new Error('qa-scan-review-phase-unverified');
+        return expected;
+    }
+    catch {
+        throw new Error('qa-scan-review-phase-unverified');
+    }
+}
+export async function qaScanReviewCliHandler(args) {
+    const action = args[0];
+    let projectRoot = process.cwd();
+    let surface = '';
+    let targetUrl = '';
+    let format = 'plain';
+    let authorizeReview = false;
+    let authorizeCapture = false;
+    let authorizeInteraction = false;
+    let authorizeDiscovery = false;
+    let authorizeRootCheckpoint = false;
+    let discoverySha256 = '';
+    let actionId = '';
+    let expectedStatus = '';
+    const seen = new Set();
+    try {
+        if (action !== 'plan' && action !== 'capture' && action !== 'interact' && action !== 'accept'
+            && action !== 'status' && action !== 'aggregate' && action !== 'phase-checkpoint'
+            && action !== 'phase-status' && action !== 'discover' && action !== 'discovery-status'
+            && action !== 'discovered-phase-checkpoint' && action !== 'discovered-phase-status') {
+            throw new Error('qa-scan-review-action-invalid');
+        }
+        for (let index = 1; index < args.length; index++) {
+            const token = args[index];
+            if (seen.has(token))
+                throw new Error('qa-scan-review-argument-duplicate');
+            seen.add(token);
+            const next = () => args[++index] ?? '';
+            if (token === '--project-root')
+                projectRoot = next();
+            else if (token === '--surface')
+                surface = next();
+            else if (token === '--target-url')
+                targetUrl = next();
+            else if (token === '--action-id')
+                actionId = next();
+            else if (token === '--expected-status')
+                expectedStatus = next();
+            else if (token === '--discovery-sha')
+                discoverySha256 = next();
+            else if (token === '--format') {
+                const selected = next();
+                if (selected !== 'json' && selected !== 'plain')
+                    throw new Error('qa-scan-review-format-invalid');
+                format = selected;
+            }
+            else if (token === '--authorize-review')
+                authorizeReview = true;
+            else if (token === '--authorize-capture')
+                authorizeCapture = true;
+            else if (token === '--authorize-interaction')
+                authorizeInteraction = true;
+            else if (token === '--authorize-discovery')
+                authorizeDiscovery = true;
+            else if (token === '--authorize-root-checkpoint')
+                authorizeRootCheckpoint = true;
+            else
+                throw new Error('qa-scan-review-argument-invalid');
+        }
+        const discoveredPhaseAction = action === 'discovered-phase-checkpoint'
+            || action === 'discovered-phase-status';
+        const targetListAction = action === 'aggregate' || action === 'phase-checkpoint'
+            || action === 'phase-status' || discoveredPhaseAction;
+        const discoveryAction = action === 'discover' || action === 'discovery-status';
+        const checkpointAction = action === 'phase-checkpoint' || action === 'discovered-phase-checkpoint';
+        if (!projectRoot || (targetListAction || action === 'discovery-status'
+            ? seen.has('--surface') || seen.has('--target-url')
+            : action === 'discover' ? seen.has('--surface') || !targetUrl : !surface || !targetUrl)
+            || authorizeReview !== (action === 'accept')
+            || authorizeCapture !== (action === 'capture')
+            || authorizeInteraction !== (action === 'interact')
+            || authorizeDiscovery !== (action === 'discover')
+            || authorizeRootCheckpoint !== checkpointAction
+            || (discoveredPhaseAction || action === 'discovery-status'
+                ? !SHA256.test(discoverySha256) : seen.has('--discovery-sha'))
+            || (action === 'interact' ? !actionId || !expectedStatus
+                : seen.has('--action-id') || seen.has('--expected-status'))) {
+            throw new Error('qa-scan-review-authorization-or-target-required');
+        }
+        if (targetListAction) {
+            let input = '';
+            for await (const chunk of process.stdin) {
+                input += String(chunk);
+                if (Buffer.byteLength(input) > MAX_REPORT_BYTES)
+                    throw new Error('qa-scan-review-too-large');
+            }
+            const { parseDocument } = await import('yaml');
+            const document = parseDocument(input, { strict: true, uniqueKeys: true,
+                schema: 'core', customTags: [] });
+            if (document.errors.length || document.warnings.length)
+                throw new Error(action === 'aggregate'
+                    ? 'qa-scan-review-aggregate-unverified' : 'qa-scan-review-phase-unverified');
+            const targets = JSON.parse(input);
+            const receipt = discoveredPhaseAction
+                ? action === 'discovered-phase-checkpoint'
+                    ? (await import('./qa-scan-discovery.js')).acceptRootQaScanDiscoveredPhase(projectRoot, discoverySha256, targets)
+                    : (await import('./qa-scan-discovery.js')).readRootQaScanDiscoveredPhase(projectRoot, discoverySha256, targets)
+                : action === 'aggregate' ? aggregateRootQaScanReviews(projectRoot, targets)
+                    : action === 'phase-checkpoint' ? acceptRootQaScanPhaseCheckpoint(projectRoot, targets)
+                        : readRootQaScanPhaseCheckpoint(projectRoot, targets);
+            if (format === 'json')
+                console.log(JSON.stringify(receipt));
+            else if ('verdict' in receipt)
+                console.log(`Root QA scan aggregate ${receipt.verdict}; surfaces=${receipt.surfaceCount}, issues=${receipt.issueCount}, workflow-continuation=unauthorized`);
+            else
+                console.log(`Root QA scan bounded local evidence checkpoint; surfaces=${receipt.surfaceCount}, qa-accepted=${receipt.qaAccepted}, workflow-continuation=unauthorized`);
+            return receipt.qaAccepted ? 0 : 2;
+        }
+        if (discoveryAction) {
+            const { discoverRootQaScanLinks, readRootQaScanDiscovery } = await import('./qa-scan-discovery.js');
+            const receipt = action === 'discover'
+                ? await discoverRootQaScanLinks({ projectRoot, seedUrl: targetUrl, authorizeDiscovery })
+                : readRootQaScanDiscovery(projectRoot, discoverySha256);
+            if (format === 'json')
+                console.log(JSON.stringify(receipt));
+            else
+                console.log(`Root QA scan link inventory; targets=${receipt.targetCount}, QA=not-accepted`);
+            return 0;
+        }
+        if (action === 'capture') {
+            const { captureRootQaScan } = await import('./qa-scan-capture.js');
+            const receipt = await captureRootQaScan({ projectRoot, surface, targetUrl,
+                authorizeCapture });
+            if (format === 'json')
+                console.log(JSON.stringify(receipt));
+            else
+                console.log(`Root QA scan captured ${receipt.evidenceCount} private artifacts; independent review required`);
+            return 0;
+        }
+        if (action === 'interact') {
+            const { captureRootQaScanInteraction } = await import('./qa-scan-capture.js');
+            const receipt = await captureRootQaScanInteraction({ projectRoot, surface, targetUrl,
+                actionId, expectedStatus, authorizeInteraction });
+            if (format === 'json')
+                console.log(JSON.stringify(receipt));
+            else
+                console.log('Root QA scan synthetic interaction captured; independent review required');
+            return 0;
+        }
+        if (action === 'plan') {
+            const plan = planRootQaScan(projectRoot, surface, targetUrl);
+            const evidencePath = evidenceDirectory(resolve(projectRoot), false);
+            if (format === 'json')
+                console.log(JSON.stringify({ plan, evidenceDirectory: evidencePath,
+                    approvedEvidenceContract: APPROVED_EVIDENCE_CONTRACT }));
+            else
+                console.log(`Root QA scan plan ${plan.planSha256}; evidence directory ${evidencePath}; no QA accepted; use --format json for approved evidence contract`);
+            return 0;
+        }
+        if (action === 'status') {
+            const receipt = readRootQaScanReview(projectRoot, surface, targetUrl);
+            if (format === 'json')
+                console.log(JSON.stringify(receipt));
+            else
+                console.log(`Root QA scan ${receipt.verdict}; evidence=${receipt.evidenceCount}, issues=${receipt.issueCount}, qaAccepted=${receipt.qaAccepted}`);
+            return receipt.qaAccepted ? 0 : 2;
+        }
+        let input = '';
+        for await (const chunk of process.stdin) {
+            input += String(chunk);
+            if (Buffer.byteLength(input) > MAX_REPORT_BYTES)
+                throw new Error('qa-scan-review-too-large');
+        }
+        const { parseDocument } = await import('yaml');
+        const document = parseDocument(input, { strict: true, uniqueKeys: true,
+            schema: 'core', customTags: [] });
+        if (document.errors.length || document.warnings.length)
+            throw new Error('qa-scan-review-unverified');
+        const report = JSON.parse(input);
+        const receipt = acceptRootQaScanReview(projectRoot, surface, targetUrl, report);
+        if (format === 'json')
+            console.log(JSON.stringify(receipt));
+        else
+            console.log(`Root QA scan ${receipt.verdict}; evidence=${receipt.evidenceCount}, issues=${receipt.issueCount}, qaAccepted=${receipt.qaAccepted}`);
+        return receipt.qaAccepted ? 0 : 2;
+    }
+    catch (error) {
+        const reasonCode = error instanceof Error && /^qa-scan-review-[a-z-]+$/.test(error.message)
+            ? error.message : 'qa-scan-review-unverified';
+        if (format === 'json')
+            console.log(JSON.stringify({ ok: false, reasonCode }));
+        else
+            console.error(reasonCode);
+        return 1;
+    }
+}