@ornexus/neocortex 4.60.72 → 4.60.73

package/packages/client/dist/commands/refactor-cpp-assertions.js

@@ -1,3 +1,93 @@
-function u(t){let n="",e=0,s="code",r="",c=!1,o="";for(;e<t.length;){const i=t[e];if(i===`
-`){n+=`
-`,e++,s==="line"&&(s="code"),s==="quote"&&(c=!1);continue}if(s==="line"){e++;continue}if(s==="block"){t.startsWith("*/",e)?(s="code",e+=2):e++;continue}if(s==="quote"){c?c=!1:i==="\\"?c=!0:i===r&&(s="code"),e++;continue}if(s==="raw"){t.startsWith(o,e)?(s="code",e+=o.length):e++;continue}if(t.startsWith("//",e)){s="line",e+=2,n+=" ";continue}if(t.startsWith("/*",e)){s="block",e+=2,n+=" ";continue}const f=/^(?:u8|u|U|L)?R"([^\s()\\]{0,16})\(/.exec(t.slice(e,e+24));if(f){o=`)${f[1]}"`,s="raw",e+=f[0].length,n+=" ";continue}if(i==='"'||i==="'"){r=i,s="quote",c=!1,e++,n+=" ";continue}if(/[A-Za-z_0-9]/.test(i)){const a=e++,l=/[0-9]/.test(i);for(;e<t.length&&(l?/[A-Za-z_0-9.']/.test(t[e]):/[A-Za-z_0-9]/.test(t[e]));)e++;n+=t.slice(a,e);continue}n+=i,e++}return n.split(/\r?\n/)}function h(t){return!/^\s*#/.test(t)&&(/\bassert\s*\(/.test(t)||/\bthrow\s+\S/.test(t)||/^\s*(?:else\s+)?if\s*\(/.test(t))}export{u as cppRefactorExecutableLines,h as isCppRefactorAssertionSite};
+/** Preserve line numbers while excluding C++ comments and quoted/raw string data. */
+export function cppRefactorExecutableLines(text) {
+    let code = '', i = 0, state = 'code';
+    let quote = '', escaped = false, rawEnd = '';
+    while (i < text.length) {
+        const char = text[i];
+        if (char === '\n') {
+            code += '\n';
+            i++;
+            if (state === 'line')
+                state = 'code';
+            if (state === 'quote')
+                escaped = false;
+            continue;
+        }
+        if (state === 'line') {
+            i++;
+            continue;
+        }
+        if (state === 'block') {
+            if (text.startsWith('*/', i)) {
+                state = 'code';
+                i += 2;
+            }
+            else
+                i++;
+            continue;
+        }
+        if (state === 'quote') {
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === quote)
+                state = 'code';
+            i++;
+            continue;
+        }
+        if (state === 'raw') {
+            if (text.startsWith(rawEnd, i)) {
+                state = 'code';
+                i += rawEnd.length;
+            }
+            else
+                i++;
+            continue;
+        }
+        if (text.startsWith('//', i)) {
+            state = 'line';
+            i += 2;
+            code += ' ';
+            continue;
+        }
+        if (text.startsWith('/*', i)) {
+            state = 'block';
+            i += 2;
+            code += ' ';
+            continue;
+        }
+        const raw = /^(?:u8|u|U|L)?R"([^\s()\\]{0,16})\(/.exec(text.slice(i, i + 24));
+        if (raw) {
+            rawEnd = `)${raw[1]}"`;
+            state = 'raw';
+            i += raw[0].length;
+            code += ' ';
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            state = 'quote';
+            escaped = false;
+            i++;
+            code += ' ';
+            continue;
+        }
+        // Consume identifiers and numeric tokens so prefixed characters and digit separators stay distinct.
+        if (/[A-Za-z_0-9]/.test(char)) {
+            const start = i++, numeric = /[0-9]/.test(char);
+            while (i < text.length && (numeric ? /[A-Za-z_0-9.']/.test(text[i]) : /[A-Za-z_0-9]/.test(text[i])))
+                i++;
+            code += text.slice(start, i);
+            continue;
+        }
+        code += char;
+        i++;
+    }
+    return code.split(/\r?\n/);
+}
+/** Syntactic anchor only; independent root review checks the failure body and behavior. */
+export function isCppRefactorAssertionSite(line) {
+    return !/^\s*#/.test(line) && (/\bassert\s*\(/.test(line)
+        || /\bthrow\s+\S/.test(line) || /^\s*(?:else\s+)?if\s*\(/.test(line));
+}

package/packages/client/dist/commands/refactor-review.js

@@ -1,5 +1,283 @@
-import{createHash as $,randomUUID as C}from"node:crypto";import{closeSync as R,existsSync as k,fsyncSync as x,linkSync as H,lstatSync as N,openSync as O,readFileSync as F,realpathSync as j,unlinkSync as I,writeFileSync as V}from"node:fs";import{join as y,resolve as B}from"node:path";import{readRootRefactorBaseline as W,runRootRefactorCharacterization as D}from"./refactor-characterization.js";import{cppRefactorExecutableLines as M,isCppRefactorAssertionSite as T}from"./refactor-cpp-assertions.js";import{privateRefactorDirectory as z,readPrivateRefactorAdmission as q,verifyRootRefactor as _}from"./refactor-root.js";const l=/^[a-f0-9]{64}$/,S=128*1024;function v(t){return $("sha256").update(t).digest("hex")}function p(t,e){return t!==null&&typeof t=="object"&&!Array.isArray(t)&&Object.keys(t).sort().join("\0")===[...e].sort().join("\0")}function J(t,e){return typeof t=="string"&&t.length>=30&&t.length<=e&&!/[\x00-\x1f\x7f]/.test(t)}function g(t,e,n){if(!l.test(e)||!l.test(n))throw new Error("refactor-root-review-unverified");const o=B(t),i=q(o,e),a=W(o,n),c=_(o,e),r=D(o,e,a.testFiles.map(u=>u.path),a.dependencies.map(u=>u.path),"after",!0,a.causalPath,n,a.schemaVersion===2?a.runner:"native");if(a.admissionSha256!==e||a.sourceHead!==i.sourceHead||r.baselineSha256!==n||!r.testsPassedObserved||!r.causalFailureObserved||c.changedFileCount<2)throw new Error("refactor-root-review-unverified");return Object.freeze({root:o,storyId:i.storyId,sourceHead:i.sourceHead,admissionSha256:e,baselineSha256:n,candidateSha256:r.candidateSha256,testFiles:a.testFiles,changedFileCount:c.changedFileCount})}function P(t,e){if(!p(e,["schemaVersion","kind","storyId","sourceHead","admissionSha256","baselineSha256","candidateSha256","verdict","behaviorRationale","assertions"])||e.schemaVersion!==1||e.kind!=="root-refactor-semantic-review"||e.storyId!==t.storyId||e.sourceHead!==t.sourceHead||e.admissionSha256!==t.admissionSha256||e.baselineSha256!==t.baselineSha256||e.candidateSha256!==t.candidateSha256||e.verdict!=="approved"||!J(e.behaviorRationale,1e3)||!Array.isArray(e.assertions)||e.assertions.length<t.testFiles.length||e.assertions.length>64||Buffer.byteLength(JSON.stringify(e))>S)throw new Error("refactor-root-review-unverified");const n=new Map(t.testFiles.map(r=>[r.path,r.sha256])),o=new Map,i=new Map;for(const[r,u]of n){const f=y(t.root,r),s=N(f);if(!s.isFile()||s.isSymbolicLink()||j(f)!==f||s.size<1||s.size>8*1024*1024)throw new Error("refactor-root-review-unverified");const d=F(f);if(v(d)!==u)throw new Error("refactor-root-review-unverified");const h=new TextDecoder("utf-8",{fatal:!0}).decode(d);o.set(r,h.split(/\r?\n/)),r.endsWith(".cpp")&&i.set(r,M(h))}const a=new Set,c=new Set;for(const r of e.assertions){if(!p(r,["testPath","assertionLine","rationale"])||typeof r.testPath!="string"||!n.has(r.testPath)||!Number.isSafeInteger(r.assertionLine)||Number(r.assertionLine)<1||Number(r.assertionLine)>(o.get(r.testPath)?.length??0)||!J(r.rationale,500))throw new Error("refactor-root-review-unverified");const u=`${r.testPath}:${r.assertionLine}`;if(a.has(u))throw new Error("refactor-root-review-unverified");a.add(u),c.add(r.testPath);const f=o.get(r.testPath)[Number(r.assertionLine)-1],s=r.testPath.endsWith(".py")?(f.split("#")[0]??"").trimStart():f.split("//")[0]??"";if(!(r.testPath.endsWith(".cpp")?T(i.get(r.testPath)?.[Number(r.assertionLine)-1]??""):r.testPath.endsWith(".py")?/^self\.assert[A-Z][A-Za-z0-9_]*\s*\(/.test(s)||/^assert\s+\S/.test(s):/\b(?:assert|expect|throw)\b/.test(s)))throw new Error("refactor-root-review-unverified")}if(c.size!==n.size)throw new Error("refactor-root-review-unverified");return e}function A(t,e){return Object.freeze({schemaVersion:1,kind:"root-refactor-semantic-acceptance",storyId:t.storyId,sourceHead:t.sourceHead,admissionSha256:t.admissionSha256,baselineSha256:t.baselineSha256,candidateSha256:t.candidateSha256,reviewSha256:v(`root-refactor-semantic-review-v1\0${JSON.stringify(e)}`),testFileCount:t.testFiles.length,assertionCount:e.assertions.length,changedFileCount:t.changedFileCount,executionVerified:!0,qaAccepted:!0,gitCommitAuthorized:!1,publicSafe:!0})}function L(t,e,n){return y(z(t),`review-${e}-${n}.json`)}function E(t){const e=N(t);if(!e.isFile()||e.isSymbolicLink()||e.uid!==process.getuid?.()||(e.mode&63)!==0||e.size<100||e.size>S+4096)throw new Error("refactor-root-review-unverified");const n=F(t),o=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(n));if(!p(o,["schemaVersion","kind","report","receipt","checksumSha256"])||o.schemaVersion!==1||o.kind!=="root-refactor-semantic-record"||typeof o.checksumSha256!="string"||!l.test(o.checksumSha256)||!n.equals(Buffer.from(`${JSON.stringify(o)}
-`))||o.checksumSha256!==v(`root-refactor-semantic-record-v1\0${JSON.stringify({report:o.report,receipt:o.receipt})}`))throw new Error("refactor-root-review-unverified");return o}function U(t,e,n,o){try{const i=g(t,e,n),a=P(i,o),c=A(i,a),r=L(i.root,e,i.candidateSha256),u={report:a,receipt:c},f={schemaVersion:1,kind:"root-refactor-semantic-record",...u,checksumSha256:v(`root-refactor-semantic-record-v1\0${JSON.stringify(u)}`)},s=Buffer.from(`${JSON.stringify(f)}
-`);if(k(r)){const m=E(r);if(JSON.stringify(m.report)!==JSON.stringify(a)||JSON.stringify(m.receipt)!==JSON.stringify(c))throw new Error("refactor-root-review-conflict");return c}const d=z(i.root),h=y(d,`review-${C()}.tmp`),w=O(h,"wx",384);try{V(w,s),x(w)}finally{R(w)}try{if(g(i.root,e,n).candidateSha256!==c.candidateSha256)throw new Error("refactor-root-review-unverified");H(h,r);const b=O(d,"r");try{x(b)}finally{R(b)}}finally{k(h)&&I(h)}return E(r),c}catch(i){throw i instanceof Error&&i.message==="refactor-root-review-conflict"?i:new Error("refactor-root-review-unverified")}}function Z(t,e,n){try{const o=g(t,e,n),i=E(L(o.root,e,o.candidateSha256));if(!p(i,["schemaVersion","kind","report","receipt","checksumSha256"]))throw new Error("refactor-root-review-unverified");const a=P(o,i.report),c=A(o,a);if(JSON.stringify(i.receipt)!==JSON.stringify(c))throw new Error("refactor-root-review-unverified");return c}catch{throw new Error("refactor-root-review-unverified")}}async function te(t){const e=t[0];let n="",o="",i="",a=!1,c=!1,r="plain";const u=new Set;try{if(e!=="review-accept"&&e!=="review-status")throw new Error("refactor-root-review-arguments-invalid");for(let s=1;s<t.length;s++){const d=t[s];if(u.has(d))throw new Error("refactor-root-review-arguments-invalid");u.add(d);const h=()=>{const w=t[++s];if(!w||w.startsWith("--"))throw new Error("refactor-root-review-arguments-invalid");return w};if(d==="--project-root")n=h();else if(d==="--admission-sha")o=h();else if(d==="--baseline-sha")i=h();else if(d==="--authorize-run")a=!0;else if(d==="--authorize-root-review")c=!0;else if(d==="--format")r=h();else throw new Error("refactor-root-review-arguments-invalid")}if(!n||!l.test(o)||!l.test(i)||!["plain","json"].includes(r)||!a||c!==(e==="review-accept"))throw new Error("refactor-root-review-arguments-invalid");let f;if(e==="review-accept"){let s="";for await(const w of process.stdin)if(s+=String(w),Buffer.byteLength(s)>S)throw new Error("refactor-root-review-unverified");const{parseDocument:d}=await import("yaml"),h=d(s,{strict:!0,uniqueKeys:!0,schema:"core",customTags:[]});if(h.errors.length||h.warnings.length)throw new Error("refactor-root-review-unverified");f=U(n,o,i,JSON.parse(s))}else f=Z(n,o,i);return process.stdout.write(`${JSON.stringify({ok:!0,acceptance:f})}
-`),0}catch(f){const s=f instanceof Error&&/^refactor-root-[a-z-]+$/.test(f.message)?f.message:"refactor-root-review-unverified";return process.stdout.write(`${JSON.stringify({ok:!1,reasonCode:s})}
-`),1}}export{U as acceptRootRefactorSemanticReview,Z as readRootRefactorSemanticReview,te as refactorReviewCliHandler};
+/** Explicit root semantic QA for one physically characterized refactor candidate. */
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, linkSync, lstatSync, openSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { readRootRefactorBaseline, runRootRefactorCharacterization } from './refactor-characterization.js';
+import { cppRefactorExecutableLines, isCppRefactorAssertionSite } from './refactor-cpp-assertions.js';
+import { privateRefactorDirectory, readPrivateRefactorAdmission, verifyRootRefactor } from './refactor-root.js';
+const SHA256 = /^[a-f0-9]{64}$/;
+const MAX_REVIEW_BYTES = 128 * 1024;
+function sha(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function exact(value, keys) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        && Object.keys(value).sort().join('\0') === [...keys].sort().join('\0');
+}
+function rationale(value, maximum) {
+    return typeof value === 'string' && value.length >= 30 && value.length <= maximum
+        && !/[\x00-\x1f\x7f]/.test(value);
+}
+/** Re-execute the unchanged suite; a saved observation is not QA authority. */
+function currentCandidate(projectRoot, admissionSha256, baselineSha256) {
+    if (!SHA256.test(admissionSha256) || !SHA256.test(baselineSha256)) {
+        throw new Error('refactor-root-review-unverified');
+    }
+    const root = resolve(projectRoot);
+    const admission = readPrivateRefactorAdmission(root, admissionSha256);
+    const baseline = readRootRefactorBaseline(root, baselineSha256);
+    const containment = verifyRootRefactor(root, admissionSha256);
+    const observation = runRootRefactorCharacterization(root, admissionSha256, baseline.testFiles.map((file) => file.path), baseline.dependencies.map((file) => file.path), 'after', true, baseline.causalPath, baselineSha256, baseline.schemaVersion === 2 ? baseline.runner : 'native');
+    if (baseline.admissionSha256 !== admissionSha256 || baseline.sourceHead !== admission.sourceHead
+        || observation.baselineSha256 !== baselineSha256 || !observation.testsPassedObserved
+        || !observation.causalFailureObserved || containment.changedFileCount < 2) {
+        throw new Error('refactor-root-review-unverified');
+    }
+    return Object.freeze({ root, storyId: admission.storyId, sourceHead: admission.sourceHead,
+        admissionSha256, baselineSha256, candidateSha256: observation.candidateSha256,
+        testFiles: baseline.testFiles, changedFileCount: containment.changedFileCount });
+}
+function validatedReview(current, report) {
+    if (!exact(report, ['schemaVersion', 'kind', 'storyId', 'sourceHead', 'admissionSha256',
+        'baselineSha256', 'candidateSha256', 'verdict', 'behaviorRationale', 'assertions'])
+        || report.schemaVersion !== 1 || report.kind !== 'root-refactor-semantic-review'
+        || report.storyId !== current.storyId || report.sourceHead !== current.sourceHead
+        || report.admissionSha256 !== current.admissionSha256
+        || report.baselineSha256 !== current.baselineSha256
+        || report.candidateSha256 !== current.candidateSha256 || report.verdict !== 'approved'
+        || !rationale(report.behaviorRationale, 1000)
+        || !Array.isArray(report.assertions)
+        || report.assertions.length < current.testFiles.length || report.assertions.length > 64
+        || Buffer.byteLength(JSON.stringify(report)) > MAX_REVIEW_BYTES) {
+        throw new Error('refactor-root-review-unverified');
+    }
+    const expected = new Map(current.testFiles.map((file) => [file.path, file.sha256]));
+    const lines = new Map();
+    const cppLines = new Map();
+    for (const [path, expectedSha] of expected) {
+        const physicalPath = join(current.root, path);
+        const stat = lstatSync(physicalPath);
+        if (!stat.isFile() || stat.isSymbolicLink() || realpathSync(physicalPath) !== physicalPath
+            || stat.size < 1 || stat.size > 8 * 1024 * 1024) {
+            throw new Error('refactor-root-review-unverified');
+        }
+        const bytes = readFileSync(physicalPath);
+        if (sha(bytes) !== expectedSha)
+            throw new Error('refactor-root-review-unverified');
+        const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        lines.set(path, text.split(/\r?\n/));
+        if (path.endsWith('.cpp'))
+            cppLines.set(path, cppRefactorExecutableLines(text));
+    }
+    const seen = new Set();
+    const covered = new Set();
+    for (const assertion of report.assertions) {
+        if (!exact(assertion, ['testPath', 'assertionLine', 'rationale'])
+            || typeof assertion.testPath !== 'string' || !expected.has(assertion.testPath)
+            || !Number.isSafeInteger(assertion.assertionLine) || Number(assertion.assertionLine) < 1
+            || Number(assertion.assertionLine) > (lines.get(assertion.testPath)?.length ?? 0)
+            || !rationale(assertion.rationale, 500)) {
+            throw new Error('refactor-root-review-unverified');
+        }
+        const key = `${assertion.testPath}:${assertion.assertionLine}`;
+        if (seen.has(key))
+            throw new Error('refactor-root-review-unverified');
+        seen.add(key);
+        covered.add(assertion.testPath);
+        const line = lines.get(assertion.testPath)[Number(assertion.assertionLine) - 1];
+        const activeLine = assertion.testPath.endsWith('.py')
+            ? (line.split('#')[0] ?? '').trimStart() : line.split('//')[0] ?? '';
+        const hasAssertion = assertion.testPath.endsWith('.cpp')
+            ? isCppRefactorAssertionSite(cppLines.get(assertion.testPath)?.[Number(assertion.assertionLine) - 1] ?? '')
+            : assertion.testPath.endsWith('.py')
+                ? /^self\.assert[A-Z][A-Za-z0-9_]*\s*\(/.test(activeLine)
+                    || /^assert\s+\S/.test(activeLine)
+                : /\b(?:assert|expect|throw)\b/.test(activeLine);
+        if (!hasAssertion) {
+            throw new Error('refactor-root-review-unverified');
+        }
+    }
+    if (covered.size !== expected.size)
+        throw new Error('refactor-root-review-unverified');
+    return report;
+}
+function receipt(current, report) {
+    return Object.freeze({ schemaVersion: 1, kind: 'root-refactor-semantic-acceptance',
+        storyId: current.storyId, sourceHead: current.sourceHead,
+        admissionSha256: current.admissionSha256, baselineSha256: current.baselineSha256,
+        candidateSha256: current.candidateSha256,
+        reviewSha256: sha(`root-refactor-semantic-review-v1\0${JSON.stringify(report)}`),
+        testFileCount: current.testFiles.length, assertionCount: report.assertions.length,
+        changedFileCount: current.changedFileCount, executionVerified: true,
+        qaAccepted: true, gitCommitAuthorized: false, publicSafe: true });
+}
+function recordPath(root, admissionSha256, candidateSha256) {
+    return join(privateRefactorDirectory(root), `review-${admissionSha256}-${candidateSha256}.json`);
+}
+function readRecord(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+        || (stat.mode & 0o077) !== 0 || stat.size < 100 || stat.size > MAX_REVIEW_BYTES + 4096) {
+        throw new Error('refactor-root-review-unverified');
+    }
+    const raw = readFileSync(path);
+    const record = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(raw));
+    if (!exact(record, ['schemaVersion', 'kind', 'report', 'receipt', 'checksumSha256'])
+        || record.schemaVersion !== 1 || record.kind !== 'root-refactor-semantic-record'
+        || typeof record.checksumSha256 !== 'string' || !SHA256.test(record.checksumSha256)
+        || !raw.equals(Buffer.from(`${JSON.stringify(record)}\n`))
+        || record.checksumSha256 !== sha(`root-refactor-semantic-record-v1\0${JSON.stringify({
+            report: record.report, receipt: record.receipt,
+        })}`)) {
+        throw new Error('refactor-root-review-unverified');
+    }
+    return record;
+}
+export function acceptRootRefactorSemanticReview(projectRoot, admissionSha256, baselineSha256, report) {
+    try {
+        const current = currentCandidate(projectRoot, admissionSha256, baselineSha256);
+        const approved = validatedReview(current, report);
+        const accepted = receipt(current, approved);
+        const target = recordPath(current.root, admissionSha256, current.candidateSha256);
+        const payload = { report: approved, receipt: accepted };
+        const record = { schemaVersion: 1, kind: 'root-refactor-semantic-record', ...payload,
+            checksumSha256: sha(`root-refactor-semantic-record-v1\0${JSON.stringify(payload)}`) };
+        const bytes = Buffer.from(`${JSON.stringify(record)}\n`);
+        if (existsSync(target)) {
+            const existing = readRecord(target);
+            if (JSON.stringify(existing.report) !== JSON.stringify(approved)
+                || JSON.stringify(existing.receipt) !== JSON.stringify(accepted)) {
+                throw new Error('refactor-root-review-conflict');
+            }
+            return accepted;
+        }
+        const directory = privateRefactorDirectory(current.root);
+        const temporary = join(directory, `review-${randomUUID()}.tmp`);
+        const handle = openSync(temporary, 'wx', 0o600);
+        try {
+            writeFileSync(handle, bytes);
+            fsyncSync(handle);
+        }
+        finally {
+            closeSync(handle);
+        }
+        try {
+            const physical = currentCandidate(current.root, admissionSha256, baselineSha256);
+            if (physical.candidateSha256 !== accepted.candidateSha256) {
+                throw new Error('refactor-root-review-unverified');
+            }
+            linkSync(temporary, target);
+            const directoryHandle = openSync(directory, 'r');
+            try {
+                fsyncSync(directoryHandle);
+            }
+            finally {
+                closeSync(directoryHandle);
+            }
+        }
+        finally {
+            if (existsSync(temporary))
+                unlinkSync(temporary);
+        }
+        readRecord(target);
+        return accepted;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === 'refactor-root-review-conflict')
+            throw error;
+        throw new Error('refactor-root-review-unverified');
+    }
+}
+export function readRootRefactorSemanticReview(projectRoot, admissionSha256, baselineSha256) {
+    try {
+        const current = currentCandidate(projectRoot, admissionSha256, baselineSha256);
+        const record = readRecord(recordPath(current.root, admissionSha256, current.candidateSha256));
+        if (!exact(record, ['schemaVersion', 'kind', 'report', 'receipt', 'checksumSha256'])) {
+            throw new Error('refactor-root-review-unverified');
+        }
+        const approved = validatedReview(current, record.report);
+        const expected = receipt(current, approved);
+        if (JSON.stringify(record.receipt) !== JSON.stringify(expected)) {
+            throw new Error('refactor-root-review-unverified');
+        }
+        return expected;
+    }
+    catch {
+        throw new Error('refactor-root-review-unverified');
+    }
+}
+/** The report travels only over stdin and is never echoed on public CLI output. */
+export async function refactorReviewCliHandler(args) {
+    const action = args[0];
+    let projectRoot = '';
+    let admissionSha256 = '';
+    let baselineSha256 = '';
+    let authorizeRun = false;
+    let authorizeReview = false;
+    let format = 'plain';
+    const seen = new Set();
+    try {
+        if (action !== 'review-accept' && action !== 'review-status') {
+            throw new Error('refactor-root-review-arguments-invalid');
+        }
+        for (let index = 1; index < args.length; index++) {
+            const token = args[index];
+            if (seen.has(token))
+                throw new Error('refactor-root-review-arguments-invalid');
+            seen.add(token);
+            const next = () => {
+                const value = args[++index];
+                if (!value || value.startsWith('--'))
+                    throw new Error('refactor-root-review-arguments-invalid');
+                return value;
+            };
+            if (token === '--project-root')
+                projectRoot = next();
+            else if (token === '--admission-sha')
+                admissionSha256 = next();
+            else if (token === '--baseline-sha')
+                baselineSha256 = next();
+            else if (token === '--authorize-run')
+                authorizeRun = true;
+            else if (token === '--authorize-root-review')
+                authorizeReview = true;
+            else if (token === '--format')
+                format = next();
+            else
+                throw new Error('refactor-root-review-arguments-invalid');
+        }
+        if (!projectRoot || !SHA256.test(admissionSha256) || !SHA256.test(baselineSha256)
+            || !['plain', 'json'].includes(format) || !authorizeRun
+            || authorizeReview !== (action === 'review-accept')) {
+            throw new Error('refactor-root-review-arguments-invalid');
+        }
+        let accepted;
+        if (action === 'review-accept') {
+            let input = '';
+            for await (const chunk of process.stdin) {
+                input += String(chunk);
+                if (Buffer.byteLength(input) > MAX_REVIEW_BYTES) {
+                    throw new Error('refactor-root-review-unverified');
+                }
+            }
+            const { parseDocument } = await import('yaml');
+            const document = parseDocument(input, { strict: true, uniqueKeys: true,
+                schema: 'core', customTags: [] });
+            if (document.errors.length || document.warnings.length) {
+                throw new Error('refactor-root-review-unverified');
+            }
+            accepted = acceptRootRefactorSemanticReview(projectRoot, admissionSha256, baselineSha256, JSON.parse(input));
+        }
+        else {
+            accepted = readRootRefactorSemanticReview(projectRoot, admissionSha256, baselineSha256);
+        }
+        process.stdout.write(`${JSON.stringify({ ok: true, acceptance: accepted })}\n`);
+        return 0;
+    }
+    catch (error) {
+        const reasonCode = error instanceof Error && /^refactor-root-[a-z-]+$/.test(error.message)
+            ? error.message : 'refactor-root-review-unverified';
+        process.stdout.write(`${JSON.stringify({ ok: false, reasonCode })}\n`);
+        return 1;
+    }
+}