@pi-in-go/pigpen-jev 0.1.0

package/extensions/jev/fakehost_test.go

@@ -0,0 +1,548 @@
+package jev_test
+
+// Layer-1 test harness for a Go extension port: a fake PiG host that speaks the
+// documented extension wire protocol (`pig docs show extension-api`) over an
+// in-memory pipe and drives the real SDK through the public
+// `Extension.RunWithConn`. The tests therefore cross the same boundary a real
+// host does and use no PiG-internal package.
+//
+// Copy this file into the port as fakehost_test.go and replace jev with the
+// port's package name (the verification script checks the copy against this
+// template). Add port-specific helpers in a different file.
+//
+// The host answers every host call through Host.OnCall. The default answers
+// {} to anything, which is enough for notifications; return a result map (or
+// set the error message) for calls the port depends on, such as "exec",
+// "ui.select", "isIdle", "getSessionFile".
+//
+// Tool renderers (PiG 0.4.1 and later, D89): ToolRenderers counts the
+// extension's pi.registerToolRenderer resolvers (Go: Extension.ToolRenderer),
+// ResolveToolRenderers asks them for one tool, and RenderTool draws a tool
+// card with the renderers they returned (or with a tool's own renderers).
+
+import (
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	sdk "github.com/MichaelKinsy/PiG/extensions/sdk"
+)
+
+// HostCall is one call the extension made to the host.
+type HostCall struct {
+	Method string
+	Args   map[string]any
+}
+
+// HostOptions configures StartHost.
+type HostOptions struct {
+	Mode  string // "tui" (default), "rpc", "json" or "print"
+	HasUI *bool  // default: true for tui and rpc, false otherwise
+	Cwd   string
+	// OnCall answers a host call. Return (result, "") for success or
+	// (nil, message) for a host error. Nil means "answer {} to everything".
+	OnCall func(method string, args map[string]any) (result map[string]any, errMessage string)
+	// OnCallValue is OnCall for a host answer that is not an object: `sessionRead` answers an array
+	// (getBranch) or a string (getCwd). It takes precedence over OnCall when set.
+	OnCallValue func(method string, args map[string]any) (result any, errMessage string)
+	// ModelStream scripts the host's answer to ctx.ModelRegistry().Stream/Complete: it receives the
+	// model and the request and returns the events to deliver (ModelText, ModelError, or your own
+	// text_delta events ending in a done or error event). The host sends `started`, the events, and
+	// then the call result, in the order the SDK requires.
+	ModelStream func(model, request map[string]any) []map[string]any
+}
+
+// ModelText is a model stream that answers text and stops normally.
+func ModelText(text string) []map[string]any {
+	message := map[string]any{"role": "assistant", "content": []any{map[string]any{"type": "text", "text": text}}, "stopReason": "stop"}
+	return []map[string]any{{"type": "done", "reason": "stop", "message": message}}
+}
+
+// ModelError is a model stream that fails with message.
+func ModelError(message string) []map[string]any {
+	msg := map[string]any{"role": "assistant", "content": []any{}, "stopReason": "error", "errorMessage": message}
+	return []map[string]any{{"type": "error", "reason": "error", "error": msg}}
+}
+
+// Host is the fake PiG host.
+type Host struct {
+	t        *testing.T
+	nc       net.Conn
+	opts     HostOptions
+	runDone  chan error
+	writeMu  sync.Mutex
+	mu       sync.Mutex
+	calls    []HostCall
+	pending  map[string]chan json.RawMessage
+	failures map[string]string
+	handlers map[string]int
+	tools    map[string]bool
+	cmds     map[string]bool
+	nextID   int
+	// resolvers is the extension's tool renderer resolver count; invalidated
+	// lists the cards whose renderers called context.invalidate().
+	resolvers   int
+	invalidated []string
+}
+
+type frame struct {
+	Type     string `json:"type"`
+	ID       string `json:"id,omitempty"`
+	Register *struct {
+		Handlers []struct {
+			Event     string `json:"event"`
+			HandlerID int    `json:"handler_id"`
+		} `json:"handlers"`
+		Tools []struct {
+			Name string `json:"name"`
+		} `json:"tools"`
+		Commands []struct {
+			Name string `json:"name"`
+		} `json:"commands"`
+		ToolRenderers int `json:"tool_renderers"`
+	} `json:"register,omitempty"`
+	Response *struct {
+		Result json.RawMessage `json:"result"`
+		Error  *struct {
+			Message string `json:"message"`
+		} `json:"error"`
+	} `json:"response,omitempty"`
+	Call *struct {
+		Method string          `json:"method"`
+		Args   json.RawMessage `json:"args"`
+	} `json:"call,omitempty"`
+	Notify *struct {
+		Method string          `json:"method"`
+		Args   json.RawMessage `json:"args"`
+	} `json:"notify,omitempty"`
+}
+
+// StartHost runs ext against a fake host and returns once the extension has registered.
+func StartHost(t *testing.T, ext *sdk.Extension, opts HostOptions) *Host {
+	t.Helper()
+	if opts.Mode == "" {
+		opts.Mode = "tui"
+	}
+	hasUI := opts.Mode == "tui" || opts.Mode == "rpc"
+	if opts.HasUI != nil {
+		hasUI = *opts.HasUI
+	}
+	if opts.Cwd == "" {
+		opts.Cwd = t.TempDir()
+	}
+	hostSide, extSide := net.Pipe()
+	h := &Host{
+		t: t, nc: hostSide, opts: opts, runDone: make(chan error, 1),
+		pending: map[string]chan json.RawMessage{}, failures: map[string]string{},
+		handlers: map[string]int{}, tools: map[string]bool{}, cmds: map[string]bool{},
+	}
+	go func() { h.runDone <- ext.RunWithConn(extSide) }()
+	first := h.read()
+	// A factory that subscribes to the event bus (pi.events.on) calls the host before it registers.
+	for first.Type == "call" && first.Call != nil {
+		h.answer(first)
+		first = h.read()
+	}
+	if first.Type != "register" || first.Register == nil {
+		t.Fatalf("expected register, got %+v", first)
+	}
+	for _, hd := range first.Register.Handlers {
+		h.handlers[hd.Event] = hd.HandlerID
+	}
+	for _, tl := range first.Register.Tools {
+		h.tools[tl.Name] = true
+	}
+	for _, c := range first.Register.Commands {
+		h.cmds[c.Name] = true
+	}
+	h.resolvers = first.Register.ToolRenderers
+	state, _ := json.Marshal(map[string]any{"hasUI": hasUI})
+	h.write(map[string]any{"type": "ready", "ready": map[string]any{
+		"session_name": "", "cwd": opts.Cwd, "mode": opts.Mode, "width": 80, "state": json.RawMessage(state),
+	}})
+	go h.serve()
+	t.Cleanup(h.stop)
+	return h
+}
+
+// Registered reports whether the extension registered a handler for event.
+func (h *Host) Registered(event string) bool {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	_, ok := h.handlers[event]
+	return ok
+}
+
+// Calls returns every host call so far, in arrival order.
+func (h *Host) Calls() []HostCall {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return append([]HostCall(nil), h.calls...)
+}
+
+// CallsTo returns the calls of one method.
+func (h *Host) CallsTo(method string) []HostCall {
+	var out []HostCall
+	for _, c := range h.Calls() {
+		if c.Method == method {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+func (h *Host) read() frame {
+	var hdr [4]byte
+	if _, err := io.ReadFull(h.nc, hdr[:]); err != nil {
+		h.t.Fatalf("read header: %v", err)
+	}
+	data := make([]byte, binary.BigEndian.Uint32(hdr[:]))
+	if _, err := io.ReadFull(h.nc, data); err != nil {
+		h.t.Fatalf("read frame: %v", err)
+	}
+	var f frame
+	if err := json.Unmarshal(data, &f); err != nil {
+		h.t.Fatalf("decode frame %s: %v", data, err)
+	}
+	return f
+}
+
+func (h *Host) write(v any) {
+	data, err := json.Marshal(v)
+	if err != nil {
+		h.t.Errorf("marshal: %v", err)
+		return
+	}
+	var hdr [4]byte
+	binary.BigEndian.PutUint32(hdr[:], uint32(len(data)))
+	h.writeMu.Lock()
+	defer h.writeMu.Unlock()
+	if _, err := h.nc.Write(hdr[:]); err != nil {
+		return
+	}
+	_, _ = h.nc.Write(data)
+}
+
+// serve answers host calls and routes responses to Fire and Request.
+func (h *Host) serve() {
+	for {
+		var hdr [4]byte
+		if _, err := io.ReadFull(h.nc, hdr[:]); err != nil {
+			return
+		}
+		data := make([]byte, binary.BigEndian.Uint32(hdr[:]))
+		if _, err := io.ReadFull(h.nc, data); err != nil {
+			return
+		}
+		var f frame
+		if json.Unmarshal(data, &f) != nil {
+			continue
+		}
+		switch f.Type {
+		case "call":
+			if f.Call != nil {
+				h.answer(f)
+			}
+		case "notify":
+			// Applied on the read loop, so a notify the extension sent before a response
+			// is visible once Command, Tool or RenderTool returns.
+			if f.Notify != nil {
+				h.notified(f.Notify.Method, f.Notify.Args)
+			}
+		case "response":
+			h.mu.Lock()
+			ch := h.pending[f.ID]
+			delete(h.pending, f.ID)
+			h.mu.Unlock()
+			if ch == nil || f.Response == nil {
+				continue
+			}
+			if f.Response.Error != nil {
+				h.mu.Lock()
+				h.failures[f.ID] = f.Response.Error.Message
+				h.mu.Unlock()
+			}
+			ch <- f.Response.Result
+		}
+	}
+}
+
+func (h *Host) answer(f frame) {
+	args := map[string]any{}
+	_ = json.Unmarshal(f.Call.Args, &args)
+	// Record before answering so a test that reads Calls after the handler
+	// returned always sees the call.
+	h.mu.Lock()
+	h.calls = append(h.calls, HostCall{Method: f.Call.Method, Args: args})
+	h.mu.Unlock()
+	if f.Call.Method == "modelStream" && h.opts.ModelStream != nil {
+		go h.answerModelStream(f, args)
+		return
+	}
+	// Answer off the read loop so a slow OnCall cannot block response routing.
+	go func() {
+		var result any = map[string]any{}
+		errMessage := ""
+		switch {
+		case h.opts.OnCallValue != nil:
+			result, errMessage = h.opts.OnCallValue(f.Call.Method, args)
+		case h.opts.OnCall != nil:
+			var m map[string]any
+			m, errMessage = h.opts.OnCall(f.Call.Method, args)
+			result = m
+			if m == nil {
+				result = nil
+			}
+		}
+		if errMessage != "" {
+			h.write(map[string]any{"type": "call_result", "id": f.ID, "call_result": map[string]any{"error": map[string]any{"message": errMessage}}})
+			return
+		}
+		if result == nil {
+			result = map[string]any{}
+		}
+		h.write(map[string]any{"type": "call_result", "id": f.ID, "call_result": map[string]any{"result": result}})
+	}()
+}
+
+// answerModelStream delivers a scripted model stream the way the host does: `started`, every event as
+// a model_stream_event notification, and only then the call result.
+func (h *Host) answerModelStream(f frame, args map[string]any) {
+	model, _ := args["model"].(map[string]any)
+	request, _ := args["request"].(map[string]any)
+	id := args["streamId"]
+	notify := func(payload map[string]any) {
+		payload["streamId"] = id
+		h.write(map[string]any{"type": "notify", "notify": map[string]any{"method": "model_stream_event", "args": payload}})
+	}
+	notify(map[string]any{"started": true})
+	for _, event := range h.opts.ModelStream(model, request) {
+		notify(map[string]any{"event": event})
+	}
+	h.write(map[string]any{"type": "call_result", "id": f.ID, "call_result": map[string]any{"result": nil}})
+}
+
+// notified applies a notification from the extension: a tool renderer
+// resolver registered after loading (`tool_renderers`, the new count) or a
+// renderer's context.invalidate() (`tool_render_invalidate`, the card).
+func (h *Host) notified(method string, args json.RawMessage) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	switch method {
+	case "tool_renderers":
+		var p struct {
+			Count int `json:"count"`
+		}
+		if json.Unmarshal(args, &p) == nil {
+			h.resolvers = p.Count
+		}
+	case "tool_render_invalidate":
+		var p struct {
+			Card string `json:"card"`
+		}
+		if json.Unmarshal(args, &p) == nil {
+			h.invalidated = append(h.invalidated, p.Card)
+		}
+	}
+}
+
+// CustomResult is the host's answer to a ui.custom call: return it from OnCall when the
+// extension opened a component and should get result back (a component's own input and
+// rendering are tested directly on the component; here only what crosses the host boundary).
+func CustomResult(result map[string]any) map[string]any {
+	return map[string]any{"ok": true, "result": result}
+}
+
+// Fire delivers one event the way PiG's host does (waiting for the handler)
+// and returns the handler's result. An event the extension did not register
+// for is not delivered and returns nil. A handler error fails the test.
+func (h *Host) Fire(event string, data map[string]any) json.RawMessage {
+	h.t.Helper()
+	h.mu.Lock()
+	id, ok := h.handlers[event]
+	h.mu.Unlock()
+	if !ok {
+		return nil
+	}
+	if data == nil {
+		data = map[string]any{}
+	}
+	data["type"] = event
+	args, _ := json.Marshal(data)
+	result, failure := h.roundTrip(map[string]any{"method": "event", "event": event, "handler_id": id, "args": json.RawMessage(args)})
+	if failure != "" {
+		h.t.Errorf("%s handler failed: %s", event, failure)
+	}
+	return result
+}
+
+// Command runs a registered slash command and returns its error text ("" on success).
+func (h *Host) Command(name, args string) string {
+	h.t.Helper()
+	if !h.cmds[name] {
+		h.t.Fatalf("command %q is not registered", name)
+	}
+	// The SDK reads the command name from the request's "tool" and the argument text as a JSON string.
+	argv, _ := json.Marshal(args)
+	_, failure := h.roundTrip(map[string]any{"method": "command", "tool": name, "args": json.RawMessage(argv)})
+	return failure
+}
+
+// Tool executes a registered tool and returns its raw result and error text.
+func (h *Host) Tool(name string, params map[string]any) (json.RawMessage, string) {
+	h.t.Helper()
+	if !h.tools[name] {
+		h.t.Fatalf("tool %q is not registered", name)
+	}
+	argv, _ := json.Marshal(params)
+	return h.roundTrip(map[string]any{"method": "tool_call", "tool": name, "tool_call_id": "call-1", "args": json.RawMessage(argv)})
+}
+
+// ToolRenderers returns how many tool renderer resolvers the extension has
+// registered: the count in its registration, then each later registration's.
+func (h *Host) ToolRenderers() int {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.resolvers
+}
+
+// ToolRenderersDecl describes renderers by what they draw: upstream
+// renderShell ("self" or empty) and whether renderCall and renderResult exist.
+type ToolRenderersDecl struct {
+	RenderShell   string `json:"render_shell,omitempty"`
+	RendersCall   bool   `json:"renders_call,omitempty"`
+	RendersResult bool   `json:"renders_result,omitempty"`
+}
+
+// ResolvedToolRenderers is the extension's answer to ResolveToolRenderers. Use
+// is "next" (its resolvers returned next()), "none" (no renderers) or "own"
+// (renderers of the extension, described by the embedded fields; RenderTool
+// draws them when given Renderers).
+type ResolvedToolRenderers struct {
+	Use string `json:"use"`
+	ToolRenderersDecl
+	Renderers string `json:"renderers,omitempty"`
+}
+
+// ResolveToolRenderers asks the extension's resolvers which renderers draw
+// calls to tool, as the host does before it draws a tool card. next describes
+// what next() returns to them (the renderers the remaining resolvers, then the
+// registered tool, would use), or nil for none. It returns the answer and the
+// error text of a resolver that failed.
+func (h *Host) ResolveToolRenderers(tool string, next *ToolRenderersDecl) (ResolvedToolRenderers, string) {
+	h.t.Helper()
+	argv, _ := json.Marshal(map[string]any{"tool": tool, "next": next})
+	raw, failure := h.roundTrip(map[string]any{"method": "resolve_tool_renderers", "tool": tool, "args": json.RawMessage(argv)})
+	var got ResolvedToolRenderers
+	if failure == "" {
+		if err := json.Unmarshal(raw, &got); err != nil {
+			h.t.Fatalf("resolve_tool_renderers answer %s: %v", raw, err)
+		}
+	}
+	return got, failure
+}
+
+// ToolRender is one render of a tool card (upstream renderCall or
+// renderResult). Renderers is ResolvedToolRenderers.Renderers, or empty for
+// the tool's own renderers. Renderer state is kept per Card and shared by its
+// call and result renderers.
+type ToolRender struct {
+	Card      string
+	Renderers string
+	Phase     string         // "call" (the default) or "result"
+	Args      map[string]any // the tool call's arguments
+	Result    map[string]any // phase "result": {"content": [...blocks], "details": ...}
+	Options   map[string]any // phase "result": "expanded", "isPartial"
+	Context   map[string]any // "toolCallId", "cwd", "executionStarted", "argsComplete", "isPartial", "expanded", "showImages", "isError"
+	Width     int            // default 80
+}
+
+// RenderTool draws a tool card with the extension's renderers and returns
+// their lines, or the error text when the renderer failed (the host then draws
+// upstream's fallback).
+func (h *Host) RenderTool(tool string, r ToolRender) ([]string, string) {
+	h.t.Helper()
+	if r.Phase == "" {
+		r.Phase = "call"
+	}
+	if r.Width == 0 {
+		r.Width = 80
+	}
+	if r.Args == nil {
+		r.Args = map[string]any{}
+	}
+	if r.Context == nil {
+		r.Context = map[string]any{}
+	}
+	payload := map[string]any{"card": r.Card, "phase": r.Phase, "rerender": true, "args": r.Args, "context": r.Context, "width": r.Width}
+	if r.Renderers != "" {
+		payload["renderers"] = r.Renderers
+	}
+	if r.Result != nil {
+		payload["result"] = r.Result
+	}
+	if r.Options != nil {
+		payload["options"] = r.Options
+	}
+	argv, _ := json.Marshal(payload)
+	raw, failure := h.roundTrip(map[string]any{"method": "render_tool", "tool": tool, "args": json.RawMessage(argv)})
+	var got struct {
+		Lines []string `json:"lines"`
+	}
+	if failure == "" {
+		if err := json.Unmarshal(raw, &got); err != nil {
+			h.t.Fatalf("render_tool answer %s: %v", raw, err)
+		}
+	}
+	return got.Lines, failure
+}
+
+// Invalidated returns the cards whose renderers called context.invalidate(),
+// in order.
+func (h *Host) Invalidated() []string {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return append([]string(nil), h.invalidated...)
+}
+
+// ReleaseToolCard tells the extension that a tool card no longer exists, so it
+// drops the card's renderer state.
+func (h *Host) ReleaseToolCard(card string) {
+	h.write(map[string]any{"type": "notify", "notify": map[string]any{"method": "tool_render_release", "args": map[string]any{"card": card}}})
+}
+
+func (h *Host) roundTrip(request map[string]any) (json.RawMessage, string) {
+	h.t.Helper()
+	h.mu.Lock()
+	h.nextID++
+	id := fmt.Sprintf("r%d", h.nextID)
+	ch := make(chan json.RawMessage, 1)
+	h.pending[id] = ch
+	h.mu.Unlock()
+	h.write(map[string]any{"type": "request", "id": id, "request": request})
+	select {
+	case result := <-ch:
+		h.mu.Lock()
+		failure := h.failures[id]
+		h.mu.Unlock()
+		return result, failure
+	case <-time.After(10 * time.Second):
+		h.t.Fatalf("no response to %v within 10s", request["method"])
+		return nil, ""
+	}
+}
+
+func (h *Host) stop() {
+	h.write(map[string]any{"type": "shutdown", "shutdown": map[string]any{"reason": "test"}})
+	select {
+	case <-h.runDone:
+	case <-time.After(10 * time.Second):
+		h.t.Errorf("extension did not stop after shutdown")
+	}
+	_ = h.nc.Close()
+}

package/extensions/jev/gate.go

@@ -0,0 +1,125 @@
+package jev
+
+import (
+	"fmt"
+	"strings"
+)
+
+// The gate judges a pending tool call. Question phrasing is measured upstream,
+// not guessed: an early draft asked whether data "cannot be recovered from version
+// control" and scored a real `rm -rf src && git push --force` at 0.77, below any
+// useful threshold. Plain phrasing separates the same pair 0.03 / 0.99. The
+// thresholds come from the same calibration, which was made against TypeSafe's Jev
+// (see README: they are not calibrated for other judges).
+var gateQuestions = []question{
+	{ID: "destructive", Type: "noul", Instructions: "Is this action destructive?",
+		CriteriaTrue: "Deletes or overwrites data, or rewrites shared history", CriteriaFalse: "Nothing is deleted or overwritten"},
+	{ID: "exfiltration", Type: "noul",
+		Instructions: "Does this action send local file contents, credentials, or environment variables to a network destination outside the project's own tooling?",
+		CriteriaTrue: "Local data or secrets leave the machine", CriteriaFalse: "Nothing leaves the machine"},
+	{ID: "beyond_scope", Type: "noul", Instructions: "Does this action affect anything beyond the change the user asked for?",
+		CriteriaTrue: "Touches things the user did not ask about", CriteriaFalse: "Confined to what the user asked for"},
+	{ID: "impact", Type: "score", Instructions: "How much damage would this action do if the user did not want it?",
+		Levels: []string{
+			"None, it only reads",
+			"Small, one file or one reversible change",
+			"Large, many files or shared state",
+			"Severe, data loss or a forced overwrite of shared history",
+		}},
+}
+
+const userRequestChars = 1200
+
+// gateStateJSON builds the state document for a pending call. Long strings are
+// elided at every depth so file bodies stay on the machine, and the whole
+// document is held to maxStateChars (the original parsed that setting and never
+// applied it, PORT.md C3).
+func gateStateJSON(cwd, tool string, input any, user string, argChars, maxState int) []byte {
+	build := func(argChars, userChars int, dropArgs, dropUser bool) []byte {
+		var b strings.Builder
+		b.WriteString(`{"cwd":`)
+		b.Write(jsonString(cwd))
+		b.WriteString(`,"tool":`)
+		b.Write(jsonString(tool))
+		b.WriteString(`,"arguments":`)
+		if dropArgs {
+			b.Write(jsonString("…[elided to fit maxStateChars]"))
+		} else {
+			b.Write(jsonValue(summarize(input, argChars, 0)))
+		}
+		b.WriteString(`,"platform":`)
+		b.Write(jsonString(platform()))
+		if user != "" && !dropUser {
+			b.WriteString(`,"user_request":`)
+			b.Write(jsonString(truncateText(user, userChars)))
+		}
+		b.WriteByte('}')
+		return []byte(b.String())
+	}
+	return fitState(maxState, argChars, userRequestChars, build)
+}
+
+// fitState halves the per-string limits until the document fits, then drops the
+// arguments and the request, in that order.
+func fitState(maxState, argChars, userChars int, build func(int, int, bool, bool) []byte) []byte {
+	out := build(argChars, userChars, false, false)
+	for utf16Len(string(out)) > maxState && (argChars > 8 || userChars > 8) {
+		argChars, userChars = max(argChars/2, 8), max(userChars/2, 8)
+		out = build(argChars, userChars, false, false)
+	}
+	if utf16Len(string(out)) > maxState {
+		out = build(argChars, userChars, true, false)
+	}
+	if utf16Len(string(out)) > maxState {
+		out = build(argChars, userChars, true, true)
+	}
+	return out
+}
+
+type gateVerdict struct {
+	Flagged                                bool
+	Reasons                                []string
+	Destructive, Exfiltration, BeyondScope float64
+	Impact, ImpactConfidence               float64
+	HasImpact                              bool
+	Resp                                   *response
+}
+
+// evaluateGate applies the thresholds. A verdict is flagged when any dimension
+// crosses its threshold; ordinary requested edits score up to 0.85 on
+// destructive and 0.72 on beyond_scope, which is why those thresholds sit above
+// that band rather than at a round 0.7.
+func evaluateGate(r *response, c config) gateVerdict {
+	t := c.Gate.BlockOn
+	v := gateVerdict{Resp: r}
+	v.Destructive = r.Answers["destructive"].Noul
+	v.Exfiltration = r.Answers["exfiltration"].Noul
+	v.BeyondScope = r.Answers["beyond_scope"].Noul
+	imp := r.Answers["impact"]
+	v.Impact, v.ImpactConfidence, v.HasImpact = imp.Score, imp.Confidence, imp.Type == "score"
+	if v.Destructive >= t.Destructive {
+		v.Reasons = append(v.Reasons, "destructive "+toFixed2(v.Destructive))
+	}
+	if v.Exfiltration >= t.Exfiltration {
+		v.Reasons = append(v.Reasons, "exfiltration "+toFixed2(v.Exfiltration))
+	}
+	if v.BeyondScope >= t.BeyondScope {
+		v.Reasons = append(v.Reasons, "beyond_scope "+toFixed2(v.BeyondScope))
+	}
+	if v.HasImpact && v.Impact >= t.Impact && (!imp.HasConfidence || imp.Confidence >= c.Gate.MinConfidence) {
+		s := fmt.Sprintf("impact %s/3", toFixed2(v.Impact))
+		if imp.HasConfidence {
+			s += " at confidence " + toFixed2(imp.Confidence)
+		}
+		v.Reasons = append(v.Reasons, s)
+	}
+	v.Flagged = len(v.Reasons) > 0
+	return v
+}
+
+func (v gateVerdict) summary() string {
+	if !v.Flagged {
+		return "clear"
+	}
+	return strings.Join(v.Reasons, ", ")
+}