@pome-sh/checks 0.1.0

package/dist/chunk-5SJ4PVO5.js

@@ -0,0 +1,981 @@
+import { oneOf, defineCheck, repoRef, VACUITY_SENTINEL_NUMBER, childStatePath, VACUITY_SENTINEL, statePath } from './chunk-4WXX5VPA.js';
+import { z } from 'zod';
+
+// ../twin-github/dist/src/tape-assertable-tools.js
+var TAPE_ASSERTABLE_TOOLS = ["create_commit_status", "create_check_run"];
+
+// ../twin-github/dist/src/check-params.js
+var entityNumber = (name) => ({
+  name,
+  pattern: "[1-9][0-9]*",
+  example: "1",
+  render: (value) => value,
+  parse: (raw) => raw
+});
+var issueNumber = entityNumber("issue");
+var prNumber = entityNumber("pr");
+var labelName = {
+  name: "label",
+  pattern: "[^`\\n]+",
+  example: "bug",
+  render: (value) => value,
+  parse: (raw) => raw
+};
+var login = {
+  name: "login",
+  pattern: "[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?",
+  example: "alice",
+  render: (value) => value,
+  parse: (raw) => raw
+};
+var filePath = {
+  name: "path",
+  pattern: "[^`\\n]+",
+  example: "src/index.ts",
+  render: (value) => value,
+  parse: (raw) => raw
+};
+var commentNeedle = {
+  name: "needle",
+  pattern: '[^"\\n]+',
+  example: "Deploy blocked",
+  render: (value) => value,
+  parse: (raw) => raw
+};
+var statusContext = {
+  name: "context",
+  pattern: '[^"\\n]+',
+  example: "ci/build",
+  render: (value) => value,
+  parse: (raw) => raw
+};
+var issueState = oneOf("state", ["open", "closed"]);
+var pullRequestState = oneOf("state", ["merged", "not merged", "open", "closed"]);
+var reviewState = oneOf("review", ["APPROVED", "CHANGES_REQUESTED", "COMMENTED"], "APPROVED");
+var commitStatusState = oneOf("state", ["success", "failure", "pending", "error"], "success");
+var toolActionName = oneOf("tool", [...TAPE_ASSERTABLE_TOOLS], TAPE_ASSERTABLE_TOOLS[0]);
+
+// ../twin-github/dist/src/check-state.js
+function findRepo(state, ref) {
+  const repositories = state.repositories ?? [];
+  for (const [index, repo] of repositories.entries()) {
+    if (repo.full_name === ref)
+      return { repo, index };
+    if (repo.owner != null && repo.name != null && `${repo.owner}/${repo.name}` === ref) {
+      return { repo, index };
+    }
+  }
+  return null;
+}
+function issueNumbers(repo) {
+  const numbers = /* @__PURE__ */ new Set();
+  for (const issue of repo.issues ?? []) {
+    if (typeof issue.number === "number" && Number.isFinite(issue.number))
+      numbers.add(issue.number);
+  }
+  return numbers;
+}
+function labelNames(repo) {
+  const names = /* @__PURE__ */ new Set();
+  for (const label of repo.labels ?? []) {
+    if (typeof label.name === "string" && label.name.length > 0)
+      names.add(label.name);
+  }
+  return names;
+}
+function missOutcome(miss) {
+  if (miss.searched === void 0)
+    return { passed: false, reason: miss.missing };
+  return { passed: false, reason: miss.missing, evidenceStatePaths: [miss.searched] };
+}
+function resolveRepo(state, ref, where) {
+  const hit = findRepo(state, ref);
+  if (hit)
+    return { found: hit.repo, path: statePath("repositories", hit.index) };
+  return {
+    missing: `repo ${ref} not found in ${where}`,
+    // `undefined` — the key absent from the export — is the only case with
+    // nothing to point at. A `null` repository list is a citable fact: it says
+    // the export carried the field and it was empty.
+    searched: state.repositories === void 0 ? void 0 : statePath("repositories")
+  };
+}
+function resolveIssue(state, ref, number) {
+  const repo = resolveRepo(state, ref, "state_final");
+  if ("missing" in repo)
+    return repo;
+  const issues = repo.found.issues ?? [];
+  const index = issues.findIndex((candidate) => candidate.number === Number(number));
+  if (index >= 0) {
+    return { found: issues[index], path: childStatePath(repo.path, "issues", index) };
+  }
+  return {
+    missing: `issue #${number} not found in ${ref}`,
+    searched: repo.found.issues === void 0 ? void 0 : childStatePath(repo.path, "issues")
+  };
+}
+function resolvePullRequest(state, ref, number) {
+  const repo = resolveRepo(state, ref, "state_final");
+  if ("missing" in repo)
+    return repo;
+  const pulls = repo.found.pull_requests ?? [];
+  const index = pulls.findIndex((candidate) => candidate.number === Number(number));
+  if (index >= 0) {
+    return { found: pulls[index], path: childStatePath(repo.path, "pull_requests", index) };
+  }
+  return {
+    missing: `pull request #${number} not found in ${ref}`,
+    searched: repo.found.pull_requests === void 0 ? void 0 : childStatePath(repo.path, "pull_requests")
+  };
+}
+function isMerged(pull) {
+  return pull.merged === 1 || pull.merged === true;
+}
+function sameLabel(a, b) {
+  return a.toLowerCase() === b.toLowerCase();
+}
+function appliedLabelNames(issue) {
+  return (issue.labels ?? []).map((label) => label.name).filter((name) => typeof name === "string");
+}
+
+// ../twin-github/dist/src/check-worlds.js
+function finalWorld(final) {
+  return { seed: null, final, tape: null };
+}
+function deltaWorld(seed, final) {
+  return { seed, final, tape: null };
+}
+function tapeWorld(tape) {
+  return { seed: null, final: { repositories: [] }, tape };
+}
+function repoState(repo = {}) {
+  return { repositories: [{ owner: "acme", name: "api", full_name: "acme/api", ...repo }] };
+}
+
+// ../twin-github/dist/src/check-issues.js
+var issueExists = defineCheck({
+  id: "github.issue-exists",
+  description: "Asserts an issue with this number is present in the repository's final state. It says NOTHING about the issue's content, state, labels or assignee \u2014 pair it with those checks when they matter. Its natural use is a task whose examinee must CREATE the issue; asserting the existence of a seeded issue is trivially true and grades nothing.",
+  template: "Issue #{issue} exists in `{repo}`",
+  params: { issue: issueNumber, repo: repoRef },
+  substrate: "final",
+  polarity: () => "positive",
+  // A number, not a string hunted for inside free text — no redactor can
+  // delete it out from under the lookup.
+  subject: () => null,
+  // The ONE check where the issue number is the SCANNED literal rather than a
+  // selector. Everywhere else `resolveIssue` early-returns "not found" before
+  // the real comparison runs, so falsifying the number would move the verdict
+  // for a reason that never reaches the assertion. Here the lookup IS the
+  // assertion, so falsifying it is exactly right.
+  vacuityMutant: (args) => ({ ...args, issue: String(VACUITY_SENTINEL_NUMBER) }),
+  // The repo is PRESENT in both worlds; only the issue moves. A world without
+  // the repo would fail the way an EMPTY world does, which arm 3 rejects.
+  discriminatingWorlds: ({ issue }) => ({
+    passing: finalWorld(repoState({ issues: [{ number: Number(issue) }] })),
+    failing: finalWorld(repoState({ issues: [{ number: Number(issue) + 1 }] }))
+  }),
+  evaluate({ issue, repo }, { final }) {
+    const found = resolveIssue(final, repo, issue);
+    if ("missing" in found)
+      return missOutcome(found);
+    return {
+      passed: true,
+      reason: `issue #${issue} exists in ${repo}`,
+      evidenceStatePaths: [found.path]
+    };
+  }
+});
+var issueStateCheck = defineCheck({
+  id: "github.issue-state",
+  description: "Compares the issue row's `state` column against the named state. A missing issue FAILS; an issue whose export carries no state at all is SKIPPED rather than judged, because absent is not the same as open. The `open` form is a prohibition \u2014 it asks the examinee NOT to close the issue \u2014 which is why polarity is read from the state word.",
+  // "is in state X", not "is X", for two reasons. It borrows the idiom the
+  // Linear tasks already use (`Issue "…" is in state In Progress`), so one
+  // reading habit spans twins. And it keeps this template's literal tail from
+  // swallowing `… is assigned to \`{login}\``: near-miss patterns open every
+  // slot to `.+?`, so `Issue #{issue} in \`{repo}\` is {state}` would resemble
+  // the assignee sentence, and a corrupted assignee would be reported as a
+  // corrupted STATE check — pointing an author at a check they never picked.
+  // The contract test asserts this directly; it is the reason this wording is
+  // not "is {state}".
+  //
+  // `github.pr-state` keeps the shorter "is {state}" deliberately: half its set
+  // (`merged`/`not merged`) is a different column from `state`, so "is in
+  // state merged" would name the wrong field.
+  template: "Issue #{issue} in `{repo}` is in state {state}",
+  params: { issue: issueNumber, repo: repoRef, state: issueState },
+  substrate: "final",
+  // Per-arg. "is closed" asks the examinee to close it; "is open" is the twin's
+  // "the agent did not close issue #1" — a prohibition wearing a state word.
+  polarity: ({ state }) => state === "open" ? "negative" : "positive",
+  subject: () => null,
+  // No falsifiable trigger. The state word comes from a CLOSED SET, so there is
+  // no value guaranteed to be false — every member might legitimately be true
+  // of the state. The issue number only resolves: mutating it early-returns
+  // "not found", which moves the verdict on every seed for a reason unrelated
+  // to the trigger clause. A mutant guaranteed to move is a check that measures
+  // nothing, so this admits the blind spot as `no_trigger` instead of buying a
+  // false clean bill.
+  vacuityMutant: () => null,
+  // The closed set costs the vacuity mutant but not this: a world can simply
+  // hold the other member.
+  discriminatingWorlds: ({ issue, state }) => ({
+    passing: finalWorld(repoState({ issues: [{ number: Number(issue), state }] })),
+    failing: finalWorld(repoState({ issues: [{ number: Number(issue), state: state === "closed" ? "open" : "closed" }] }))
+  }),
+  evaluate({ issue, repo, state }, { final }) {
+    const found = resolveIssue(final, repo, issue);
+    if ("missing" in found)
+      return missOutcome(found);
+    if (found.found.state == null) {
+      return {
+        passed: false,
+        status: "skipped",
+        reason: `issue #${issue} has no state in state_final (state_incomplete)`,
+        // The ROW, not `…/state` — the field this branch exists for is the one
+        // that is absent, and a pointer at it would not resolve. Pointing at the
+        // row is what lets a reader see the gap for themselves instead of taking
+        // the reason's word for it.
+        evidenceStatePaths: [found.path]
+      };
+    }
+    const actual = found.found.state.toLowerCase();
+    return {
+      passed: actual === state,
+      reason: `issue #${issue} state is "${found.found.state}" (wanted "${state}")`,
+      evidenceStatePaths: [childStatePath(found.path, "state")]
+    };
+  }
+});
+var issueHasLabel = defineCheck({
+  id: "github.issue-has-label",
+  description: "Asserts the label is among those APPLIED to the issue \u2014 it does not assert the issue carries only that one. An agent that applies the right label alongside three wrong ones passes this check; `github.issue-exactly-one-label` is the assertion that catches that. The comparison is case-insensitive, because GitHub creates label names case-insensitively while preserving the caller's display casing.",
+  template: "Issue #{issue} in `{repo}` has the `{label}` label applied",
+  params: { issue: issueNumber, repo: repoRef, label: labelName },
+  substrate: "final",
+  polarity: () => "positive",
+  // The label is a caller-supplied literal compared against the state tree, so
+  // a redactor that destroys it makes this check unable to fire.
+  subject: ({ label }) => label,
+  // The label is what the scan ranges over; the issue number only resolves.
+  vacuityMutant: (args) => ({ ...args, label: VACUITY_SENTINEL }),
+  // `labels` are ROW OBJECTS, not strings. The failing world carries a DIFFERENT
+  // label rather than none, so its reason names a non-empty applied set and
+  // cannot be mistaken for a missing issue.
+  discriminatingWorlds: ({ issue, label }) => ({
+    passing: finalWorld(repoState({ issues: [{ number: Number(issue), labels: [{ name: label }] }] })),
+    failing: finalWorld(repoState({ issues: [{ number: Number(issue), labels: [{ name: "unrelated" }] }] }))
+  }),
+  evaluate({ issue, repo, label }, { final }) {
+    const found = resolveIssue(final, repo, issue);
+    if ("missing" in found)
+      return missOutcome(found);
+    const applied = appliedLabelNames(found.found);
+    const passed = applied.some((name) => sameLabel(name, label));
+    return {
+      passed,
+      reason: passed ? `issue #${issue} has label "${label}"` : `issue #${issue} labels are [${applied.join(", ")}], missing "${label}"`,
+      // The APPLIED set, which is the set this check scanned — not the repo's
+      // label definitions, which is the neighbouring set `no-new-labels` reads
+      // and the one this check's description exists to keep it distinct from.
+      evidenceStatePaths: [childStatePath(found.path, "labels")]
+    };
+  }
+});
+var issueExactlyOneLabel = defineCheck({
+  id: "github.issue-exactly-one-label",
+  description: "Asserts the issue carries EXACTLY ONE applied label and that it is this one. Strictly stronger than `github.issue-has-label`: it fails an agent that piles a correct label on top of an incorrect one, which is the defect a triage task usually exists to catch. It counts every applied label, not only ones a human would call a classification.",
+  template: "Issue #{issue} in `{repo}` has exactly one classification label, and it is `{label}`",
+  params: { issue: issueNumber, repo: repoRef, label: labelName },
+  substrate: "final",
+  polarity: () => "positive",
+  subject: ({ label }) => label,
+  vacuityMutant: (args) => ({ ...args, label: VACUITY_SENTINEL }),
+  // The failing world holds the RIGHT label plus one more — the defect this
+  // check exists to catch, and precisely the one `issue-has-label` passes.
+  discriminatingWorlds: ({ issue, label }) => ({
+    passing: finalWorld(repoState({ issues: [{ number: Number(issue), labels: [{ name: label }] }] })),
+    failing: finalWorld(repoState({ issues: [{ number: Number(issue), labels: [{ name: label }, { name: "extra" }] }] }))
+  }),
+  evaluate({ issue, repo, label }, { final }) {
+    const found = resolveIssue(final, repo, issue);
+    if ("missing" in found)
+      return missOutcome(found);
+    const applied = appliedLabelNames(found.found);
+    const passed = applied.length === 1 && sameLabel(applied[0], label);
+    return {
+      passed,
+      reason: passed ? `issue #${issue} has exactly one label ("${label}")` : `issue #${issue} has labels [${applied.join(", ")}], expected exactly one label "${label}"`,
+      // The same pointer `issue-has-label` cites, because both read the same
+      // field — the difference between them is the assertion, not the address.
+      evidenceStatePaths: [childStatePath(found.path, "labels")]
+    };
+  }
+});
+var issueAssignee = defineCheck({
+  id: "github.issue-assignee",
+  description: "Asserts this login is among the issue's assignees. GitHub issues can carry several, so this does not assert sole ownership. It compares LOGINS exactly and case-sensitively, not display names \u2014 `alice` matches the collaborator `alice`, and `Alice Smith` matches nothing.",
+  template: "Issue #{issue} in `{repo}` is assigned to `{login}`",
+  params: { issue: issueNumber, repo: repoRef, login },
+  substrate: "final",
+  polarity: () => "positive",
+  subject: (args) => args.login,
+  vacuityMutant: (args) => ({ ...args, login: VACUITY_SENTINEL }),
+  // `assignees` really is `string[]` of logins here, while its label neighbours
+  // are row objects — the domain resolves it through a separate join.
+  discriminatingWorlds: ({ issue, login: wanted }) => ({
+    passing: finalWorld(repoState({ issues: [{ number: Number(issue), assignees: [wanted] }] })),
+    failing: finalWorld(repoState({ issues: [{ number: Number(issue), assignees: ["someone-else"] }] }))
+  }),
+  evaluate(args, { final }) {
+    const found = resolveIssue(final, args.repo, args.issue);
+    if ("missing" in found)
+      return missOutcome(found);
+    const assignees = found.found.assignees ?? [];
+    const passed = assignees.includes(args.login);
+    return {
+      passed,
+      reason: passed ? `issue #${args.issue} is assigned to "${args.login}"` : `issue #${args.issue} assignees are [${assignees.join(", ")}], missing "${args.login}"`,
+      evidenceStatePaths: [childStatePath(found.path, "assignees")]
+    };
+  }
+});
+var issueCommentContains = defineCheck({
+  id: "github.issue-comment-contains",
+  description: "Scans the bodies of every comment on the issue for this text as a SUBSTRING, case-sensitively. It does not assert who commented, how many did, or where in the body the text sits. Because the text is hunted inside free prose rather than compared to a field, a redaction rule that destroys it makes this check unable to fire \u2014 the engine skips it as `subject_redacted` rather than passing it vacuously.",
+  template: 'A comment containing "{needle}" exists on issue #{issue} in `{repo}`',
+  params: { needle: commentNeedle, issue: issueNumber, repo: repoRef },
+  substrate: "final",
+  polarity: () => "positive",
+  subject: ({ needle }) => needle,
+  // The issue RESOLVES, the needle is SCANNED within it. Falsifying the issue
+  // number instead would early-return "not found" and move the verdict for
+  // every seed, for a reason that never reaches the comment scan.
+  vacuityMutant: (args) => ({ ...args, needle: VACUITY_SENTINEL }),
+  // A comment that does not contain the needle, rather than zero comments: the
+  // reason then states a scanned count, which distinguishes it from an
+  // unresolvable issue.
+  discriminatingWorlds: ({ issue, needle }) => ({
+    passing: finalWorld(repoState({ issues: [{ number: Number(issue), comments: [{ body: `left pad ${needle} right pad` }] }] })),
+    failing: finalWorld(repoState({ issues: [{ number: Number(issue), comments: [{ body: "unrelated chatter" }] }] }))
+  }),
+  evaluate({ needle, issue, repo }, { final }) {
+    const found = resolveIssue(final, repo, issue);
+    if ("missing" in found)
+      return missOutcome(found);
+    const comments = found.found.comments ?? [];
+    const passed = comments.some((comment) => (comment.body ?? "").includes(needle));
+    return {
+      passed,
+      reason: passed ? `issue #${issue} has a comment containing "${needle}"` : `issue #${issue} has no comment containing "${needle}" (${comments.length} comment(s) scanned)`,
+      // The whole comment list, not the matching comment. The check scans every
+      // body, so the list is what it read — and on the FAILING side there is no
+      // matching row to point at, which would leave the citation present on a
+      // pass and absent on a fail. A pointer that appears only when the verdict
+      // is good is worse than none: its absence would read as a verdict class.
+      evidenceStatePaths: [childStatePath(found.path, "comments")]
+    };
+  }
+});
+
+// ../twin-github/dist/src/check-pulls.js
+var pullRequestStateCheck = defineCheck({
+  id: "github.pr-state",
+  description: "Reads the pull request's `merged` flag for `merged`/`not merged`, and its `state` column for `open`/`closed`. These are DIFFERENT fields and a PR can be closed without being merged, so the two pairs do not imply each other. Whichever field the sentence turns on must be present: an export missing it is SKIPPED, because defaulting it to false would let `is not merged` pass against a world we cannot see.",
+  template: "Pull request #{pr} in `{repo}` is {state}",
+  params: { pr: prNumber, repo: repoRef, state: pullRequestState },
+  substrate: "final",
+  // Per-arg, and the reason polarity takes the args at all: one shipped task asserts
+  // "PR #1 is merged" and "PR #2 is not merged" through this one template.
+  // "open" is the same prohibition as the issue check's.
+  polarity: ({ state }) => state === "not merged" || state === "open" ? "negative" : "positive",
+  subject: () => null,
+  // No falsifiable trigger, same shape as issue-state: a closed set with no
+  // guaranteed-false member, and a PR number that only resolves.
+  vacuityMutant: () => null,
+  // `merged` is a SQLite integer boolean, and BOTH worlds set the field the
+  // assertion turns on: `merged == null` makes this check SKIP, and a skip
+  // satisfies neither arm.
+  discriminatingWorlds: ({ pr, state }) => {
+    const onMergeFlag = state === "merged" || state === "not merged";
+    if (onMergeFlag) {
+      const wantMerged = state === "merged";
+      return {
+        passing: finalWorld(repoState({ pull_requests: [{ number: Number(pr), merged: wantMerged ? 1 : 0 }] })),
+        failing: finalWorld(repoState({ pull_requests: [{ number: Number(pr), merged: wantMerged ? 0 : 1 }] }))
+      };
+    }
+    return {
+      passing: finalWorld(repoState({ pull_requests: [{ number: Number(pr), state }] })),
+      failing: finalWorld(repoState({
+        pull_requests: [{ number: Number(pr), state: state === "open" ? "closed" : "open" }]
+      }))
+    };
+  },
+  evaluate({ pr, repo, state }, { final }) {
+    const found = resolvePullRequest(final, repo, pr);
+    if ("missing" in found)
+      return missOutcome(found);
+    const pull = found.found;
+    const onMergeFlag = state === "merged" || state === "not merged";
+    const turnsOn = onMergeFlag ? pull.merged : pull.state;
+    if (turnsOn == null) {
+      return {
+        passed: false,
+        status: "skipped",
+        reason: `pull request #${pr} has no ${onMergeFlag ? "merged" : "state"} field in state_final (state_incomplete)`,
+        // The ROW: the field this branch exists for is the absent one, so a
+        // pointer at it would resolve to nothing.
+        evidenceStatePaths: [found.path]
+      };
+    }
+    if (onMergeFlag) {
+      const merged = isMerged(pull);
+      return {
+        passed: state === "merged" ? merged : !merged,
+        reason: `pull request #${pr}: merged=${merged} (wanted "${state}")`,
+        // The SAME discipline the reason above already follows: cite only the
+        // field the assertion turned on. `merged` and `state` are different
+        // columns, and a citation naming both would offer a reader an absent
+        // field as evidence for a verdict that never read it.
+        evidenceStatePaths: [childStatePath(found.path, "merged")]
+      };
+    }
+    return {
+      passed: pull.state === state,
+      reason: `pull request #${pr}: state="${pull.state}" (wanted "${state}")`,
+      evidenceStatePaths: [childStatePath(found.path, "state")]
+    };
+  }
+});
+var pullRequestCommentExists = defineCheck({
+  id: "github.pr-comment-exists",
+  description: "Asserts the pull request's CONVERSATION timeline carries at least one comment \u2014 the surface GitHub's issue-comment endpoints write to. It is not the other two things a reader may call a comment on a PR: a review's body is not one (assert that with `github.pr-review-exists`), and an inline review comment anchored to a file and line is not one either. It says nothing about who commented, how many did, or what any of them say \u2014 and no declaration reads the TEXT of a pull request's comment yet. `github.issue-comment-contains` is the issue-side counterpart and does NOT reach a pull request: it resolves its subject among the repository's issues, so pointing it at a PR number fails as `issue #N not found`. A pull request whose export carries no comments section at all is SKIPPED, because absent is not the same as none.",
+  template: "Pull request #{pr} in `{repo}` has at least one comment",
+  params: { pr: prNumber, repo: repoRef },
+  substrate: "final",
+  polarity: () => "positive",
+  // A count, not a literal hunted inside prose: no redaction rule can destroy
+  // the thing this check compares, so there is no subject to declare.
+  subject: () => null,
+  // No falsifiable trigger. The PR number only RESOLVES — mutating it
+  // early-returns "not found", which moves the verdict on every seed for a reason
+  // that never reaches the comment count — and there is no second slot to
+  // falsify. Same shape as `pr-review-exists`, and admitted as `no_trigger`
+  // rather than buying a false clean bill.
+  vacuityMutant: () => null,
+  // The failing world names `comments: []`, NOT an absent section: absent SKIPS,
+  // because absent is not none — and a skip satisfies no arm.
+  discriminatingWorlds: ({ pr }) => ({
+    passing: finalWorld(repoState({
+      pull_requests: [{ number: Number(pr), comments: [{ body: "Summary: adds an optional discount." }] }]
+    })),
+    failing: finalWorld(repoState({ pull_requests: [{ number: Number(pr), comments: [] }] }))
+  }),
+  evaluate({ pr, repo }, { final }) {
+    const found = resolvePullRequest(final, repo, pr);
+    if ("missing" in found)
+      return missOutcome(found);
+    if (found.found.comments == null) {
+      return {
+        passed: false,
+        status: "skipped",
+        reason: `pull request #${pr} has no comments section in state_final (state_incomplete)`,
+        evidenceStatePaths: [found.path]
+      };
+    }
+    const count = found.found.comments.length;
+    return {
+      passed: count > 0,
+      // Names the surface, so a failure cannot be misread as "the agent left a
+      // review body and this check refused to see it" — which is exactly the
+      // wrong-match complaint the three readings invite.
+      reason: count > 0 ? `pull request #${pr} has ${count} conversation comment(s)` : `pull request #${pr} has no conversation comments (reviews and inline review comments are not counted)`,
+      // `comments`, and this pointer is the disambiguation the description
+      // spends a paragraph on. Three fields on a PR can be called "a comment";
+      // the citation names which one was counted, in a form a reader can open.
+      evidenceStatePaths: [childStatePath(found.path, "comments")]
+    };
+  }
+});
+var pullRequestReviewExists = defineCheck({
+  id: "github.pr-review-exists",
+  description: "Asserts at least one submitted review on the pull request carries this state. It does not assert who reviewed, how recently, or that no other review disagrees \u2014 an APPROVED review alongside a CHANGES_REQUESTED one satisfies both. A pull request whose export carries no reviews section at all is SKIPPED, because absent is not the same as none.",
+  template: "A {review} review exists on pull request #{pr} in `{repo}`",
+  params: { review: reviewState, pr: prNumber, repo: repoRef },
+  substrate: "final",
+  polarity: () => "positive",
+  subject: () => null,
+  // A closed set with no guaranteed-false member, and a PR number that only
+  // resolves. Same reasoning as issue-state.
+  vacuityMutant: () => null,
+  // The failing world names `reviews: []`, NOT an absent section: absent SKIPS,
+  // because absent is not none — and a skip satisfies no arm.
+  discriminatingWorlds: ({ pr, review }) => ({
+    passing: finalWorld(repoState({ pull_requests: [{ number: Number(pr), reviews: [{ state: review }] }] })),
+    failing: finalWorld(repoState({ pull_requests: [{ number: Number(pr), reviews: [] }] }))
+  }),
+  evaluate({ review, pr, repo }, { final }) {
+    const found = resolvePullRequest(final, repo, pr);
+    if ("missing" in found)
+      return missOutcome(found);
+    if (found.found.reviews == null) {
+      return {
+        passed: false,
+        status: "skipped",
+        reason: `pull request #${pr} has no reviews section in state_final (state_incomplete)`,
+        evidenceStatePaths: [found.path]
+      };
+    }
+    const states = found.found.reviews.map((row) => row.state ?? "");
+    const passed = states.includes(review);
+    return {
+      passed,
+      reason: passed ? `pull request #${pr} has a ${review} review` : `pull request #${pr} reviews are [${states.join(", ")}], missing a ${review} review`,
+      evidenceStatePaths: [childStatePath(found.path, "reviews")]
+    };
+  }
+});
+
+// ../twin-github/dist/src/check-repos.js
+var noNewLabels = defineCheck({
+  id: "github.no-new-labels",
+  // The same explanation the comment below carries, in the one place
+  // an author can actually reach it.
+  description: "Compares the repository's label DEFINITIONS in the seed against the final state. Applying an ALREADY-DEFINED label to an issue PASSES this check \u2014 only creating a label the repo did not already define fails it. `addIssueLabels` rejects an undefined label, so an examinee cannot apply a new one without creating it first, which is what makes this tight. Needs the seed: it is a delta, not a state assertion.",
+  // The repo is named on purpose. Without it the sentence reads as an
+  // issue-level claim — "the agent did not add labels to the issue" — which is
+  // WIDER than what this predicate compares. `create_label` is repo-scoped in
+  // GitHub's own vocabulary and `add_issue_labels` is the issue-scoped one, so
+  // naming the repo is what tells a reader which of the two is being asserted.
+  //
+  // An agent that applies an ALREADY-DEFINED label to an issue passes this
+  // check, correctly. The assertion that catches that is
+  // `Issue #N … has exactly one classification label`.
+  template: "No new labels were created in `{repo}`",
+  params: { repo: repoRef },
+  // The whole point: this is a delta, and it is unanswerable without the seed.
+  substrate: "seed+final",
+  // It should PASS on the untouched seed and can only be broken by the
+  // examinee acting.
+  polarity: () => "negative",
+  // Nothing here is a caller-supplied literal hunted for inside the state, so
+  // there is nothing a redactor could silently delete out from under it.
+  subject: () => null,
+  // The repo is a SELECTOR, not a scanned value. Falsifying it would move the
+  // verdict ("repo not found") for a reason that never reaches the assertion —
+  // a clean bill this check did not earn. Reported as `no_trigger`.
+  vacuityMutant: () => null,
+  // The only seed+final check, so its worlds are the only ones naming a seed.
+  // The failing world's final gains a definition the seed did not have, which is
+  // the delta itself.
+  discriminatingWorlds: () => ({
+    passing: deltaWorld(repoState({ labels: [{ name: "bug" }] }), repoState({ labels: [{ name: "bug" }] })),
+    failing: deltaWorld(repoState({ labels: [{ name: "bug" }] }), repoState({ labels: [{ name: "bug" }, { name: "invented" }] }))
+  }),
+  evaluate({ repo }, { seed, final }) {
+    if (seed === null)
+      return { passed: false, reason: "seed_missing", status: "skipped" };
+    const seedRepo = resolveRepo(seed, repo, "the seed state");
+    if ("missing" in seedRepo)
+      return missOutcome({ ...seedRepo, searched: void 0 });
+    const finalRepo = resolveRepo(final, repo, "state_final");
+    if ("missing" in finalRepo)
+      return missOutcome(finalRepo);
+    const before = labelNames(seedRepo.found);
+    const created = [...labelNames(finalRepo.found)].filter((name) => !before.has(name)).sort();
+    const definitions = [childStatePath(finalRepo.path, "labels")];
+    if (created.length === 0) {
+      return {
+        passed: true,
+        reason: `no labels were created in ${repo} (${before.size} defined at seed, unchanged at finish)`,
+        evidenceStatePaths: definitions
+      };
+    }
+    return {
+      passed: false,
+      reason: `labels created in ${repo}: ${created.map((name) => `\`${name}\``).join(", ")}`,
+      evidenceStatePaths: definitions
+    };
+  }
+});
+var noNewIssues = defineCheck({
+  id: "github.no-new-issues",
+  description: "Compares the issue NUMBERS present in the seed against the final state, and fails when finish carries one the seed did not. Numbers, not titles: a duplicate issue usually carries the same title as the one it duplicates. It says nothing about what happened to the seeded issues \u2014 closing, relabelling or commenting on one all PASS this check, so pair it with `github.issue-state` or `github.issue-comment-contains` when those matter. Its natural use is the inverse of `github.issue-exists`: a task whose examinee must recognise that an issue already exists and NOT open another. Needs the seed: it is a delta, not a state assertion.",
+  // The repo is named for `noNewLabels`'s reason, one step stronger: without it
+  // the sentence reads as a claim about the whole world, and issue numbers are
+  // per-repository — `#2` in one repo has nothing to do with `#2` in another.
+  template: "No new issues were created in `{repo}`",
+  params: { repo: repoRef },
+  substrate: "seed+final",
+  // Passes on the untouched seed; only the examinee acting can break it.
+  polarity: () => "negative",
+  // Nothing is hunted inside free text, so there is nothing a redactor could
+  // delete out from under this check.
+  subject: () => null,
+  // Same admission `noNewLabels` makes: the repo SELECTS, it is not a scanned
+  // literal. Falsifying it moves the verdict to "repo not found" for a reason
+  // that never reaches the comparison — a clean bill this check did not earn.
+  vacuityMutant: () => null,
+  discriminatingWorlds: () => ({
+    passing: deltaWorld(repoState({ issues: [{ number: 1 }] }), repoState({ issues: [{ number: 1 }] })),
+    failing: deltaWorld(repoState({ issues: [{ number: 1 }] }), repoState({ issues: [{ number: 1 }, { number: 2 }] }))
+  }),
+  evaluate({ repo }, { seed, final }) {
+    if (seed === null)
+      return { passed: false, reason: "seed_missing", status: "skipped" };
+    const seedRepo = resolveRepo(seed, repo, "the seed state");
+    if ("missing" in seedRepo)
+      return missOutcome({ ...seedRepo, searched: void 0 });
+    const finalRepo = resolveRepo(final, repo, "state_final");
+    if ("missing" in finalRepo)
+      return missOutcome(finalRepo);
+    const before = issueNumbers(seedRepo.found);
+    const created = [...issueNumbers(finalRepo.found)].filter((number) => !before.has(number)).sort((a, b) => a - b);
+    const issues = [childStatePath(finalRepo.path, "issues")];
+    if (created.length === 0) {
+      return {
+        passed: true,
+        reason: `no issues were created in ${repo} (${before.size} at seed, unchanged at finish)`,
+        evidenceStatePaths: issues
+      };
+    }
+    return {
+      passed: false,
+      reason: `issues created in ${repo}: ${created.map((number) => `#${number}`).join(", ")}`,
+      evidenceStatePaths: issues
+    };
+  }
+});
+var fileExists = defineCheck({
+  id: "github.file-exists",
+  description: "Asserts a file with this exact path exists in the repository on ANY branch \u2014 the twin exports files per branch and this check does not distinguish them, so a file committed only to a side branch satisfies it. The path is compared exactly and case-sensitively; it asserts nothing about the file's contents.",
+  template: "File `{path}` exists in `{repo}`",
+  params: { path: filePath, repo: repoRef },
+  substrate: "final",
+  polarity: () => "positive",
+  subject: ({ path }) => path,
+  // The path IS the scanned literal.
+  vacuityMutant: (args) => ({ ...args, path: `${VACUITY_SENTINEL}.txt` }),
+  discriminatingWorlds: ({ path }) => ({
+    passing: finalWorld(repoState({ files: [{ path }] })),
+    failing: finalWorld(repoState({ files: [{ path: "some/other/file.ts" }] }))
+  }),
+  evaluate({ path, repo }, { final }) {
+    const found = resolveRepo(final, repo, "state_final");
+    if ("missing" in found)
+      return missOutcome(found);
+    const files = found.found.files ?? [];
+    const passed = files.some((file) => file.path === path);
+    return {
+      passed,
+      reason: passed ? `file exists at "${path}" in ${repo}` : `no file found at "${path}" in ${repo} (${files.length} file(s) exported)`,
+      evidenceStatePaths: [childStatePath(found.path, "files")]
+    };
+  }
+});
+var commitStatus = defineCheck({
+  id: "github.commit-status",
+  description: "Asserts at least one commit status reported under this context carries this state. It does not say WHICH commit: the twin exports every status row for the repo and this check scans them all, so a green status on an old commit satisfies it. Nor does it assert the status is the latest one for that context.",
+  template: 'Commit status "{context}" in `{repo}` is {state}',
+  params: { context: statusContext, repo: repoRef, state: commitStatusState },
+  substrate: "final",
+  polarity: () => "positive",
+  subject: ({ context }) => context,
+  // No falsifiable trigger, and this one is a DELIBERATE loss against the regex
+  // it replaces. The legacy rule mutated the state word, which worked only
+  // because `(\w+)` would accept an invented sentinel. Typing the state as a
+  // closed set is the right call — an author picks from four real values — but
+  // a closed set has no guaranteed-false member, so a mutant could assert a
+  // different state that happens to also be true and report a clean bill this
+  // check did not earn. Mutating the context instead would empty the candidate
+  // set and move the verdict without the state comparison ranging over
+  // anything, which is the same false clean bill one step earlier. `no_trigger`
+  // is the honest answer.
+  vacuityMutant: () => null,
+  // The failing world keeps the CONTEXT and moves the STATE. Dropping the
+  // context instead would empty the candidate set and produce a reason about
+  // nothing having been found, which is the shape arm 3 distrusts.
+  discriminatingWorlds: ({ context, state }) => ({
+    passing: finalWorld(repoState({ commit_statuses: [{ context, state }] })),
+    failing: finalWorld(repoState({ commit_statuses: [{ context, state: state === "failure" ? "success" : "failure" }] }))
+  }),
+  evaluate({ context, repo, state }, { final }) {
+    const found = resolveRepo(final, repo, "state_final");
+    if ("missing" in found)
+      return missOutcome(found);
+    const candidates = (found.found.commit_statuses ?? []).filter((row) => row.context === context);
+    const passed = candidates.some((row) => (row.state ?? "").toLowerCase() === state);
+    return {
+      passed,
+      reason: passed ? `commit status "${context}" is "${state}" in ${repo}` : `no commit status "${context}" with state "${state}" in ${repo} (found: [${candidates.map((row) => row.state).join(", ")}])`,
+      // Every status row, not the filtered candidates. The filter is part of the
+      // assertion — "which commit" is explicitly not asserted — and a pointer at
+      // a set this check computed rather than a set the tree holds would address
+      // nothing a reader could open.
+      evidenceStatePaths: [childStatePath(found.path, "commit_statuses")]
+    };
+  }
+});
+
+// ../twin-github/dist/src/check-tape.js
+var noUnsupportedEndpoint = defineCheck({
+  id: "github.no-unsupported-endpoint",
+  description: 'Scans the recorded call tape for any request the twin answered with fidelity "unsupported" \u2014 a route it does not implement, answered 501. It asserts nothing about whether the run SUCCEEDED, and nothing about calls that were merely rejected: a 404 or a 422 from a route the twin does implement is a semantic answer and passes this check. The tape is scoped to this twin by the engine before the check sees it, so an unsupported call to a DIFFERENT twin in a multi-twin session cannot fail it.',
+  // No slots. The corpus says this exact sentence in all ten places it appears,
+  // and under position 2 an author PICKS the check rather than typing it — so
+  // the legacy regex's optional twin word ("No unsupported GitHub endpoint was
+  // called") and its plural/`were` variants are retired rather than ported,
+  // exactly as the generic `issue-has-label` phrasing was retired.
+  template: "No unsupported endpoint was called",
+  params: {},
+  substrate: "tape",
+  // A prohibition. Nothing is required to happen; only the examinee reaching
+  // for an unimplemented route can break it.
+  polarity: () => "negative",
+  // No caller-supplied literal is hunted for in any substrate, so there is
+  // nothing a redactor could silently delete out from under this check.
+  subject: () => null,
+  // No capture groups, so the sentence carries no literal to falsify. The
+  // trigger is "a call with fidelity=unsupported exists", which lives on the
+  // tape and not in the sentence. Reported as `no_trigger`, never as clean.
+  vacuityMutant: () => null,
+  // Both of these already shipped as tests; this is the same pair,
+  // promoted to the declaration.
+  discriminatingWorlds: () => ({
+    passing: tapeWorld([
+      { twin: "github", method: "GET", path: "/repos/acme/api", status: 200, fidelity: "semantic", event_id: "evt_ok" }
+    ]),
+    failing: tapeWorld([
+      { twin: "github", method: "POST", path: "/repos/acme/api/hooks", status: 501, fidelity: "unsupported", event_id: "evt_bad" }
+    ])
+  }),
+  evaluate(_args, { tape }) {
+    if (tape === null)
+      return { passed: false, reason: "tape_missing", status: "skipped" };
+    const unsupported = tape.filter((event) => event.fidelity === "unsupported");
+    if (unsupported.length === 0) {
+      return {
+        passed: true,
+        reason: `no unsupported GitHub endpoint was called (${tape.length} call(s) inspected)`
+      };
+    }
+    const evidenceEventIds = unsupported.map((event) => event.event_id).filter((id) => typeof id === "string" && id !== "");
+    const outcome = {
+      passed: false,
+      reason: `${unsupported.length} unsupported GitHub call(s): [${unsupported.map((event) => event.path ?? "?").join(", ")}]`
+    };
+    return evidenceEventIds.length > 0 ? { ...outcome, evidenceEventIds } : outcome;
+  }
+});
+var toolNeverCalled = defineCheck({
+  id: "github.tool-never-called",
+  description: "Scans the recorded call tape for any request that invoked the named twin action, and fails if one did. The action is matched on the recorded `tool` field, which the runtime stamps identically for an MCP `tools/call` and for the REST route that performs the same thing \u2014 so it asserts about the ACTION, not about the transport the examinee chose. It counts an ATTEMPT: a call the twin rejected (bad arguments, 4xx) still called the action, because the question is what the examinee reached for. It asserts nothing about the resulting state, and nothing about other actions. Rows recorded before the `tool` field existed carry no action name and are not read as a match. The tape is scoped to this twin by the engine before the check sees it.",
+  template: "`{tool}` was never called",
+  params: { tool: toolActionName },
+  substrate: "tape",
+  // A prohibition: nothing is required to happen, and only the examinee invoking
+  // the named action can break it.
+  polarity: () => "negative",
+  // The action name IS a caller-supplied literal hunted for in a substrate, so
+  // it is declared — unlike `noUnsupportedEndpoint`, which scans a fidelity
+  // stamp. No redactor pattern touches a snake_case tool name, so the check will
+  // never be skipped as `subject_redacted`; declaring it anyway is what keeps
+  // that a verified fact rather than an assumption.
+  subject: (args) => args.tool,
+  // Null, and admitted in `HONEST_NULL_MUTANTS`. The only slot is a closed set,
+  // so there is no value guaranteed to be false: a mutant naming the OTHER
+  // assertable action asserts something that may well also be true, and a value
+  // outside the set does not re-bind at all — which reads as "the verdict moved"
+  // and would bless the very criterion the probe exists to catch.
+  vacuityMutant: () => null,
+  // A NEGATIVE check, so the failing world is the one where the action WAS
+  // called. Both tapes are non-empty: `[]` is a real pass (an agent that called
+  // nothing called nothing forbidden) and `null` is a skip, so neither is the
+  // world this assertion turns on.
+  discriminatingWorlds: ({ tool }) => ({
+    passing: tapeWorld([
+      { twin: "github", method: "GET", path: "/repos/acme/api", status: 200, tool: "list_issues", event_id: "evt_ok" }
+    ]),
+    failing: tapeWorld([
+      { twin: "github", method: "POST", path: "/repos/acme/api/statuses/abc", status: 201, tool, event_id: "evt_bad" }
+    ])
+  }),
+  evaluate(args, { tape }) {
+    if (tape === null)
+      return { passed: false, reason: "tape_missing", status: "skipped" };
+    const calls = tape.filter((event) => event.tool === args.tool);
+    if (calls.length === 0) {
+      return {
+        passed: true,
+        reason: `\`${args.tool}\` was never called (${tape.length} call(s) inspected)`
+      };
+    }
+    const evidenceEventIds = calls.map((event) => event.event_id).filter((id) => typeof id === "string" && id !== "");
+    const outcome = {
+      passed: false,
+      reason: `${calls.length} call(s) to \`${args.tool}\`: [${calls.map((event) => `${event.method ?? "?"} ${event.path ?? "?"}`).join(", ")}]`
+    };
+    return evidenceEventIds.length > 0 ? { ...outcome, evidenceEventIds } : outcome;
+  }
+});
+
+// ../twin-github/dist/src/checks.js
+var GITHUB_CHECKS = [
+  issueExists,
+  issueStateCheck,
+  issueHasLabel,
+  issueExactlyOneLabel,
+  issueAssignee,
+  issueCommentContains,
+  // The two repo-scoped deltas sit together, right after the issue assertions
+  // they are the negatives of: `no-new-issues` is what `issue-exists` cannot
+  // say, and an author reaching for one usually wants to see the other.
+  noNewIssues,
+  noNewLabels,
+  pullRequestStateCheck,
+  pullRequestCommentExists,
+  pullRequestReviewExists,
+  fileExists,
+  commitStatus,
+  // Last, because the listing order runs from the assertion an author reaches
+  // for first to the ones a specialised task needs — and these are the only ones
+  // that assert about the RUN rather than the world it left behind.
+  noUnsupportedEndpoint,
+  toolNeverCalled
+];
+var seedSchema = z.object({
+  users: z.array(z.object({
+    login: z.string().min(1),
+    type: z.enum(["User", "Organization"]).default("User"),
+    name: z.string().default("")
+  })).default([]),
+  repositories: z.array(z.object({
+    owner: z.string().min(1),
+    name: z.string().min(1),
+    description: z.string().default(""),
+    private: z.boolean().default(false),
+    default_branch: z.string().min(1).default("main"),
+    collaborators: z.array(z.string().min(1)).default([]),
+    labels: z.array(z.object({
+      name: z.string().min(1),
+      color: z.string().default("ededed"),
+      description: z.string().default("")
+    })).default([]),
+    files: z.array(z.object({ path: z.string().min(1), content: z.string(), branch: z.string().optional() })).default([]),
+    issues: z.array(z.object({
+      number: z.number().int().positive().optional(),
+      title: z.string().min(1),
+      body: z.string().default(""),
+      state: z.enum(["open", "closed"]).default("open"),
+      labels: z.array(z.string().min(1)).default([]),
+      assignees: z.array(z.string().min(1)).default([])
+    })).default([]),
+    pull_requests: z.array(z.object({
+      number: z.number().int().positive().optional(),
+      title: z.string().min(1),
+      body: z.string().default(""),
+      head: z.string().min(1),
+      base: z.string().min(1).default("main"),
+      state: z.enum(["open", "closed"]).default("open"),
+      author: z.string().min(1).optional(),
+      // Reviews seeded on this PR. `state` mirrors GitHub's review
+      // state enum; `author` must exist in the user/collaborator set.
+      reviews: z.array(z.object({
+        author: z.string().min(1),
+        state: z.enum(["APPROVED", "CHANGES_REQUESTED", "COMMENTED"]).default("APPROVED"),
+        body: z.string().default("")
+      })).default([]),
+      // Commit statuses applied to this PR's head SHA. Wired into the
+      // commit_statuses table so get_pull_request_status and the merge
+      // path see them without needing a separate setup call.
+      statuses: z.array(z.object({
+        context: z.string().min(1).default("ci/build"),
+        state: z.enum(["error", "failure", "pending", "success"]).default("success"),
+        description: z.string().default("")
+      })).default([])
+    })).default([])
+  }))
+});
+function parseSeed(input) {
+  const seed = seedSchema.parse(normalizeLegacyGitHubSeed(input));
+  if (seed.repositories.length === 0) {
+    throw new Error("GitHub seed must contain at least one repository");
+  }
+  return seed;
+}
+function normalizeLegacyGitHubSeed(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    return input;
+  const seed = input;
+  if (!Array.isArray(seed.repositories))
+    return input;
+  return {
+    ...seed,
+    repositories: seed.repositories.map((repo) => {
+      if (!repo || typeof repo !== "object" || Array.isArray(repo))
+        return repo;
+      const record = repo;
+      if (!Array.isArray(record.issues))
+        return repo;
+      return {
+        ...record,
+        issues: record.issues.map((issue) => normalizeLegacyIssueAssignee(issue))
+      };
+    })
+  };
+}
+function normalizeLegacyIssueAssignee(issue) {
+  if (!issue || typeof issue !== "object" || Array.isArray(issue))
+    return issue;
+  const record = issue;
+  if (!("assignee" in record) || "assignees" in record)
+    return issue;
+  const { assignee, ...rest } = record;
+  if (assignee === null || assignee === void 0 || assignee === "") {
+    return { ...rest, assignees: [] };
+  }
+  if (typeof assignee === "string") {
+    return { ...rest, assignees: [assignee] };
+  }
+  return issue;
+}
+function defaultSeedState() {
+  return {
+    users: [
+      { login: "acme", type: "Organization", name: "Acme" },
+      { login: "alice", type: "User", name: "Alice" },
+      { login: "bob", type: "User", name: "Bob" },
+      { login: "pome-agent", type: "User", name: "Pome Agent" }
+    ],
+    repositories: [
+      {
+        owner: "acme",
+        name: "api",
+        description: "Example API service used by GitHub twin tests.",
+        default_branch: "main",
+        collaborators: ["alice", "bob", "pome-agent"],
+        labels: [
+          { name: "bug", color: "d73a4a", description: "Something is not working" },
+          { name: "feature", color: "a2eeef", description: "New feature or request" },
+          { name: "question", color: "d876e3", description: "More information needed" }
+        ],
+        files: [
+          { path: "README.md", content: "# Acme API\n\nA seeded repository for local GitHub twin tests.\n" },
+          { path: "src/index.ts", content: "export function handler() {\n  return 'ok';\n}\n" }
+        ],
+        issues: [
+          {
+            number: 1,
+            title: "500 error on POST /orders after deploy",
+            body: "Started failing right after the 14:00 deploy. Stack trace points to OrderController#create.",
+            labels: ["bug"],
+            assignees: []
+          }
+        ]
+      }
+    ]
+  };
+}
+
+export { GITHUB_CHECKS, defaultSeedState, parseSeed, seedSchema };