@pome-sh/cli 0.20.0 → 0.21.0

package/node_modules/@pome-sh/twin-gmail/package.json

@@ -1,76 +0,0 @@
-{
-  "name": "@pome-sh/twin-gmail",
-  "version": "0.3.3",
-  "description": "Deterministic Gmail-shaped twin for agent testing — SQLite-backed domain core.",
-  "private": false,
-  "type": "module",
-  "main": "./dist/src/index.js",
-  "types": "./dist/src/index.d.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/src/index.d.ts",
-      "default": "./dist/src/index.js"
-    },
-    "./server": {
-      "types": "./dist/src/server.d.ts",
-      "default": "./dist/src/server.js"
-    },
-    "./*": {
-      "types": "./dist/src/*.d.ts",
-      "default": "./dist/src/*.js"
-    }
-  },
-  "bin": {
-    "twin-gmail": "./dist/src/server.js"
-  },
-  "files": [
-    "dist",
-    "CHANGELOG.md",
-    "HOSTED.md",
-    "LIMITS.md",
-    "README.md",
-    "REFERENCE-DIVERGENCES.md",
-    "fidelity.inventory.json",
-    "fixtures/README.md",
-    "fixtures/gmail-discovery-v1.meta.json",
-    "fixtures/gmail-discovery-v1.raw.json",
-    "fixtures/mcp-initialize.meta.json",
-    "fixtures/mcp-initialize.raw.json",
-    "fixtures/mcp-tools-call-unauth-error.raw.json",
-    "fixtures/mcp-tools-call.representative.json",
-    "fixtures/mcp-tools-list.canonical.json",
-    "fixtures/mcp-tools-list.meta.json",
-    "fixtures/mcp-tools-list.raw.json",
-    "fixtures/rest-surface.json"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "@hono/node-server": "^2.1.0",
-    "@pome-sh/sdk": "0.11.1",
-    "hono": "^4.13.0",
-    "zod": "^4.4.3"
-  },
-  "keywords": [
-    "gmail",
-    "twin",
-    "test-double",
-    "agent-testing",
-    "pome",
-    "mcp"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/pome-sh/digital-twins.git",
-    "directory": "packages/twin-gmail"
-  },
-  "homepage": "https://github.com/pome-sh/digital-twins/tree/main/packages/twin-gmail",
-  "bugs": {
-    "url": "https://github.com/pome-sh/digital-twins/issues"
-  },
-  "license": "Apache-2.0",
-  "engines": {
-    "node": ">=24"
-  }
-}

package/node_modules/@pome-sh/twin-linear/CHANGELOG.md

@@ -1,204 +0,0 @@
-# @pome-sh/twin-linear — CHANGELOG
-
-
-## 0.3.3 — 2026-08-04
-
-Dependency-only patch (#302): `hono` `^4.12.31` → `^4.13.0`, `zod` `^4.1.13` → `^4.4.3`, `@hono/node-server` `^2.0.10` → `^2.1.0`.
-No source file changed and `npm run test:contract` is green, so the surface is
-identical — this exists so the npm artifact stops differing from `main`, which is
-the staleness the publish skip-guard cannot see.
-
-## 0.3.2 — 2026-08-04
-
-- Re-pinned to `@pome-sh/sdk@0.11.0` for the F-1200 parent-vocabulary
-  change: a recorded row now carries `parent_event_id` rather than `parent_id`.
-  No change to this twin's own surface — `npm run test:contract` is green.
-
-## 0.3.1 — 2026-08-03
-
-Every state-reading check says where it looked (F-1197).
-
-- 7 declarations now fill `CheckOutcome.evidenceStatePaths` (new in
-  `@pome-sh/sdk` 0.10.1) with RFC 6901 pointers into this twin's exported tree.
-- `check-state.ts`'s resolvers return the pointer they walked. `Resolved<T>`'s
-  found arm gains `path`; its missing arm gains an optional `searched`, naming
-  the collection a failed lookup scanned.
-- `checks-contract.test.ts` gains the citation gate and an EMPTY
-  `HONEST_UNCITED_CHECKS` ledger.
-
-A failed lookup cites too, and that is the half worth knowing about. A title that resolves to nothing, or to two issues, is the refusal task 26 turns on.
-So the honest citation on that arm is not the row — there is none — but the list:
-*this is where I looked, see for yourself that it is not in it.*
-
-Requires `@pome-sh/sdk` 0.10.1: the declarations call `statePath` /
-`childStatePath`, which 0.10.0 does not export.
-
-No sentence, template, substrate or check id changed, so `checksDigest` is
-identical and no criterion re-binds.
-
-## 0.3.0 — 2026-08-02
-
-**BREAKING RELEASE — read this before upgrading.** Two things a consumer must
-act on:
-
-1. **`AgentSession` is renamed to Linear's real field names (F-1172).** No
-   aliases, no deprecation window: `state` → `status` (now a real
-   `AgentSessionStatus` enum), `externalUrl` → `externalUrls` (a collection),
-   `agentUser` → `appUser`, plus `id: ID!`, `createdAt` / `updatedAt: DateTime!`
-   and `plan: JSON`. Queries, mutation inputs, the `/_pome/state` export and the
-   `AgentSessionEvent` webhook payload all change shape. Any agent, task or
-   check that names the old fields must be updated.
-2. **An existing `LINEAR_TWIN_DB` file is migrated in place on open.** The
-   `agent_sessions` table is rewritten (`agent_user_id` → `app_user_id`,
-   `state` → `status`, `external_url` → `external_urls_json`), and the three
-   retired status values are remapped: **`completed` → `complete`,
-   `failed` → `error`, `canceled` → `stale`.** The migration is idempotent and
-   there is no downgrade path — a 0.2.x twin cannot read a migrated database.
-
-Also in this release: partial updates stop wiping fields the caller never
-mentioned (F-1166), across `agentSessionUpdate` and six sibling mutations.
-
-- **BREAKING — `AgentSession` now uses Linear's real field names and types
-  (F-1172).** The twin declared four fields Linear does not have, so an agent
-  written against real Linear read `undefined` from the twin and an agent
-  written against the twin broke in production. There is no alias and no
-  deprecation window: a twin carrying both the old and the new name would still
-  expose a field Linear does not declare, which is the defect itself.
-
-  | was | is now |
-  | --- | --- |
-  | `state: String!` | `status: AgentSessionStatus!` |
-  | `externalUrl: String` | `externalUrls: JSON!` |
-  | `agentUser: User!` | `appUser: User!` |
-  | `id: String!` | `id: ID!` |
-  | `createdAt` / `updatedAt: String!` | `createdAt` / `updatedAt: DateTime!` |
-  | `plan: String` | `plan: JSON` |
-
-  `AgentSessionStatus` is now a real enum carrying Linear's six members —
-  `pending`, `active`, `awaitingInput`, `complete`, `error`, `stale`. The twin
-  previously accepted `completed`, `failed` and `canceled`, which Linear does
-  not have; those are rejected now. All three are rewritten on open:
-  `completed` → `complete`, `failed` → `error`, and `canceled` → `stale`
-  (Linear has no cancellation state; `stale`, "no longer progressing", is its
-  closest neighbour).
-
-  **An existing `LINEAR_TWIN_DB` file migrates in place on open.**
-  `agent_sessions` renames `agent_user_id` → `app_user_id` and `state` →
-  `status`, adds `external_urls_json`, backfills a non-empty `external_url`
-  into a one-entry collection (`[{ url, label: "" }]` — Linear's label is
-  non-null and the old shape carried none), drops `external_url`, and maps the
-  three retired status values. It is idempotent and a no-op on a database
-  created by the current schema. Cloud's per-session databases are ephemeral
-  (ADR-012) and unaffected. A status that still cannot be mapped now fails at
-  the read boundary with a message naming the value and the cause, rather than
-  surviving to die at GraphQL enum serialisation.
-
-  `externalUrls` is a collection, matching Linear: it replaces the single
-  nullable `externalUrl` string with a JSON array of `{ url, label }` objects,
-  and it is never null (an empty array when there are none). The mutation
-  inputs follow: `agentSessionCreateOnIssue` / `agentSessionCreateOnComment`
-  take `appUserId` and `externalUrls: [AgentSessionExternalUrlInput!]`, and
-  `agentSessionUpdate` takes `status` and `externalUrls`. F-1166's tri-state
-  contract is unchanged — key absent or `undefined` leaves a field alone, and
-  `null` clears it (`externalUrls: null` clears to `[]`).
-
-  The `/state` export and the `AgentSessionEvent` webhook payload rename with
-  the wire surface (`appUserId`, `status`, `externalUrls`).
-- **Added: a guard that fails when the twin invents a field Linear does not
-  have (F-1172).** `test/linear-schema-subset.test.ts` asserts the twin's
-  `AgentSession`, `AgentSessionStatus` and `AgentSessionExternalUrlInput`
-  members are a subset of Linear's, read from a committed, credential-free
-  slice of Linear's real introspection response
-  (`fixtures/linear-introspection.json`, refreshed by
-  `node scripts/regen-linear-introspection.mjs`). The old drift only surfaced
-  when a capture query happened to select the field; this fails at authoring
-  time instead. Scope: the guard covers the output type and the one input
-  object the twin mirrors exactly. The mutation-input surface
-  (`AgentSessionUpdateInput`, `AgentSessionCreateOnIssue` / `OnComment`,
-  `AgentActivityCreateInput`) still diverges from Linear, predates this change,
-  and is tracked separately.
-- **Fixed: partial updates no longer wipe fields the caller never mentioned
-  (F-1166).** Nullable fields on update mutations are tri-state — key absent
-  and key present with `undefined` both mean "leave alone", `null` means
-  "clear". The twin tested presence with the `in` operator, but every caller
-  builds its patch as an object literal with all keys present, so an
-  `agentSessionUpdate` that only set `state` silently erased `plan` and
-  `externalUrl`. The same shape bug affected `issueUpdate`, `issueLabelUpdate`,
-  `updateProject`, `updateDocument`, and the MCP `save_issue`, `save_project`,
-  and `save_document` tools; `save_document` with only a title additionally
-  failed outright with a spurious reparenting error. Presence is now tested as
-  `!== undefined` at both the input-parsing and domain layers.
-- **Fixed: `issueUpdate` with an explicit `stateId: null` no longer erases an
-  issue's lifecycle timestamps (F-1166).** The block that derives
-  `started_at` / `completed_at` / `canceled_at` was gated on `stateId != null`,
-  but the flags that wrote them were gated on `stateId !== undefined`, so a
-  rename sent alongside `stateId: null` wrote the uncomputed nulls while
-  `COALESCE` correctly held `state_id` — leaving a Done issue with no
-  completion timestamp. The flags now match the guard. A real transition still
-  clears the stamps.
-
-## 0.2.0 — 2026-07-30
-
-Linear declares its assertable check vocabulary (F-1129, milestone A3) — the
-last of the five twins, and the one whose migration could not be a rename.
-
-- New `./checks` subpath: `LINEAR_CHECKS`, eight declarations, plus the
-  `LinearCheckState` model they read (`check-state.ts`). pome-cloud deletes its
-  hand-maintained mirror of that shape in the same milestone — the twin's model
-  is now the only one. `LINEAR_CHECKS` is also re-exported from the package
-  root, as twin-slack does.
-- **Every check names its TEAM**, where twin-slack's vocabulary names no scope
-  at all. `seed.ts` validates issue-title uniqueness via `issueTitlesByTeam` —
-  per team, not per workspace — so a title-keyed selector over a two-team world
-  is exactly the ambiguity twin-github's repo rule exists to close. The contract
-  test enforces it, and only a check that reads no state may be ledgered out.
-- **A selector miss FAILS; a truncated export SKIPS.** twin-github fails on a
-  miss and twin-slack skips; Linear needs both from one resolver, so
-  `Resolved<T>` carries the disposition. The split is evidenced rather than
-  chosen: `state.ts` exports `exportBounds.truncatedCollections`, so the twin
-  itself reports when rows were dropped past `STATE_EXPORT_CAP`. That is the
-  only place in this vocabulary where "not found" and "absent" are different
-  facts, and neither `GitHubCheckState` nor `SlackCheckState` has an analogue.
-- Five checks read an issue row — `linear.issue-exists`, `linear.issue-state`,
-  `linear.issue-has-label`, `linear.issue-estimate`, `linear.issue-assignee` —
-  two read comments, one reads the tape. `linear.issue-threaded-reply` is the
-  only `seed+final` member: it asserts a reply whose parent existed IN THE SEED,
-  because a final-only reading is satisfied by an agent that posts a comment and
-  then replies to itself.
-- `linear.no-unsupported-endpoint` drops the twin word — it is now the same
-  sentence twin-github and twin-gmail declare, resolved per-twin by the engine.
-- **`linear.issue-lifecycle` is NOT migrated**, and that is a narrowing rather
-  than an oversight. A declared `... is {lifecycle}` near-misses every
-  `is in state "..."` sentence and would report a corrupted state criterion under
-  a check the author never picked. It had zero corpus users; `is in state "Done"`
-  / `"Canceled"` re-expresses what mattered.
-- `cli/tasks/24`, `25` and `26` are rewritten in the same commit. Six of the nine
-  shipped criteria named their subject with "that issue", with no subject at all,
-  or by pointing at an id in the seed — and a rendered sentence cannot carry a
-  pronoun, because a check only ever sees its own arguments. Task 26 LOSES a
-  criterion rather than gaining a subject: `linear.issue-state` fails on a
-  missing issue and already subsumes `An issue titled "..." exists`.
-
-## 0.1.1 — 2026-07-30
-
-Dependency-only patch: repin `@pome-sh/sdk` to 0.10.0 (F-1126). No surface change.
-
-The repin is not cosmetic. npm only symlinks a workspace sibling when the
-declared pin matches its version; a stale pin makes npm install a nested
-PUBLISHED copy instead, so the package is built and tested against the registry
-rather than this tree. `scripts/check-workspace-pins-match-workspace.mjs` now
-gates it.
-
-## 0.1.0 — 2026-07-21
-
-First public release of the deterministic Linear twin:
-
-- Frozen GraphQL + OAuth surface with SQLite-backed LinearCommands.
-- Captured twenty-tool first-party Linear MCP listing and structured results.
-- Deterministic seed/reset, webhooks log, bounded state export, and recorder
-  payload projection.
-- CLI, scenario, runtime-contract, package, and signed-image integration.
-
-Authentication is Pome-owned for hosted runs. Local seeds include
-`lin_test_admin` for `resolveCredential`, and `POME_LINEAR_TOKEN` aliases the
-session JWT. There is no `provider_credentials.linear` contract.

package/node_modules/@pome-sh/twin-linear/FIDELITY.md

@@ -1,62 +0,0 @@
-# Linear twin fidelity
-
-Heat × fidelity per [`ENDPOINT-TIERS.md`](../sdk/ENDPOINT-TIERS.md). Machine-readable twin: [`fidelity.inventory.json`](fidelity.inventory.json).
-
-## MCP launch tools (22)
-
-| Surface | Heat | Fidelity | Justification |
-| --- | --- | --- | --- |
-| `list_issues` | hot | semantic | `TC:issue-triage`; `MCP:list_issues` |
-| `get_issue` | hot | semantic | `TC:issue-triage`; `MCP:get_issue` |
-| `save_issue` | hot | semantic | `TC:issue-create\|issue-triage`; estimate/parentId/relations |
-| `list_comments` | hot | semantic | `TC:comment`; `MCP:list_comments` |
-| `save_comment` | hot | semantic | `TC:comment`; threaded `parentId` |
-| `delete_comment` | warm | semantic | Gate-1; GraphQL `commentDelete` parity |
-| `list_teams` | hot | semantic | `TC:issue-create`; `MCP:list_teams` |
-| `get_team` | warm | shape | `MCP:get_team` |
-| `list_users` | hot | semantic | `TC:issue-create`; `MCP:list_users` |
-| `get_user` | warm | shape | `MCP:get_user` |
-| `list_issue_statuses` | hot | semantic | `TC:issue-triage`; `MCP:list_issue_statuses` |
-| `get_issue_status` | warm | shape | `MCP:get_issue_status` |
-| `list_issue_labels` | hot | semantic | `TC:issue-triage`; `MCP:list_issue_labels` |
-| `create_issue_label` | warm | shape | `MCP:create_issue_label` |
-| `list_projects` | warm | semantic | SQLite project CRUD + issue linkage |
-| `get_project` | warm | semantic | SQLite project CRUD + issue linkage |
-| `save_project` | warm | semantic | SQLite project create/update |
-| `list_cycles` | warm | semantic | SQLite cycle list + issue linkage |
-| `search_documentation` | cold | shape | `MCP:search_documentation` — static/empty twin docs |
-| `list_documents` | warm | semantic | Gate-1 workspace documents (SQLite) |
-| `get_document` | warm | semantic | Gate-1 workspace documents (SQLite) |
-| `save_document` | warm | semantic | Gate-1 create/update with one parent |
-
-## GraphQL (selected)
-
-| Surface | Heat | Fidelity | Justification |
-| --- | --- | --- | --- |
-| `issues` / `issue` / issue mutations | hot | semantic | `TC:issue-triage\|issue-create`; estimate/parent |
-| `comments` / comment mutations | hot | semantic | `TC:comment`; threaded parent; `commentDelete` |
-| `teams` / `users` / `workflowStates` | hot | semantic | Context for agent chains |
-| `issueLabels` / label mutations | hot | semantic | Triage labels |
-| `projects` / `cycles` | warm | semantic | PM context backed by SQLite domain |
-| `webhooks` / webhook mutations | hot | semantic | `TC:webhook-integrate` |
-| agent session / activity mutations | warm | semantic | Emulate agent subset; MCP-absent |
-| OAuth authorize/token/revoke | hot | semantic | `TC:oauth-app` |
-
-## Named cold / unsupported
-
-| Surface | Heat | Fidelity | Notes |
-| --- | --- | --- | --- |
-| Initiatives / milestones / releases MCP | cold | unsupported | Outside Gate-1 tool set |
-| Full Linear schema tail | cold | unsupported | Loud GraphQL / 501 |
-| Document parents: initiative | cold | unsupported | Twin accepts project/team/issue/cycle only |
-
-## Opt-in OAuth scope denial
-
-`seed.strictScopes` defaults to `false`. Enable it for tasks that mint
-restricted tokens and expect Linear-like scope errors. With the flag on, GraphQL
-and MCP writes share `LinearDomain.requireScopes`. JWT / provider sessions are
-granted the full default scope set so common agent paths stay unblocked.
-
-## Tier-mismatch ledger
-
-_(empty at launch)_

package/node_modules/@pome-sh/twin-linear/HOSTED.md

@@ -1,46 +0,0 @@
-# Hosted Linear handoff
-
-OSS package + CLI are release-ready independently of hosted support. Use this
-checklist to split **OSS-ready** work from **cloud-owned** gating. No cloud
-imports belong in this package.
-
-## OSS-ready (this repo)
-
-| Item | Status / note |
-| --- | --- |
-| Package `@pome-sh/twin-linear` | Deterministic domain, GraphQL, launch MCP tools |
-| Registry id | `linear` (twin id / CLI `--twin linear`) |
-| JWT claim | `linear_email` — default admin `admin@pome-twin.test` |
-| Agent token env | `POME_AUTH_TOKEN` + alias `POME_LINEAR_TOKEN` (same JWT) |
-| Local tokens | Seeded personal tokens (e.g. `lin_test_admin`) via `resolveCredential` |
-| Seed / admin | `/admin/seed`, `/admin/reset`, `/_pome/state`, `/_pome/events` |
-| Image tag family | `ghcr.io/pome-sh/twins:linear-*` (publish after CI + secret-scan) |
-| Local tasks | Issue triage; multi-twin with GitHub |
-| Fidelity artifacts | `fidelity.inventory.json`, `FIDELITY.md`, fixtures under `fixtures/` |
-
-## Cloud-owned (Pome Cloud — not this repo)
-
-Complete before advertising hosted Linear:
-
-1. **Registry** — Add `linear` to the mounted/provisionable twin registry and
-   consume `@pome-sh/shared-types` with `linearSeedStateSchema`.
-2. **JWT claims** — Mint the session JWT with
-   `linear_email: "admin@pome-twin.test"` by default, or the normalized
-   primary admin email from the accepted Linear seed.
-3. **Credentials** — Do **not** add `provider_credentials.linear`. Return the
-   normal `agent_token`; clients expose it as both `POME_AUTH_TOKEN` and
-   `POME_LINEAR_TOKEN`. Seeded personal tokens remain a local/dev convenience.
-4. **Digest routing** — Route the signed `ghcr.io/pome-sh/twins:linear-*`
-   digest (cosign-verify + pin). Publish Linear `api_url`, `mcp_url`, and
-   `openapi_url` under `per_twin.linear`.
-5. **Pod seed / capture** — Forward the Linear seed unchanged to the pod,
-   capture `/_pome/state` and `/_pome/events`, retain OAuth/token projection
-   redaction.
-6. **Hosted verification** — Run official-client, launch-tool MCP parity, and
-   multi-twin tasks against the hosted route before enabling the product
-   flag.
-7. **Fidelity watch** — Register the signed digest on the fidelity
-   dashboard/watch list.
-
-Until that gate passes, documentation must describe Linear as **local/OSS-ready**,
-not hosted-ready.

package/node_modules/@pome-sh/twin-linear/LIMITS.md

@@ -1,54 +0,0 @@
-# Domain limits
-
-Pinned limits enforced by seed, GraphQL, MCP, and OAuth paths.
-
-| Limit | Value | Notes |
-| --- | --- | --- |
-| Issue title bytes | `512` | Loud reject above |
-| Issue / comment body bytes | `65536` | Loud reject above |
-| GraphQL query bytes | `100000` | Loud reject above |
-| GraphQL selection depth | `20` | Loud reject above |
-| Seed users / teams / issues | `500` / `50` / `5000` | Seed parse caps |
-| Seed labels / projects / cycles | `500` / `200` / `200` | Seed parse caps |
-| Seed documents | `500` | Seed parse caps |
-| Seed oauth apps / tokens / webhooks | `20` / `50` / `50` | Seed parse caps |
-| MCP `limit` / pageSize | default `50`, max `250` | list tools |
-| Relay `first`/`last` | default `50`, max `250` | GraphQL connections |
-| State export collection rows | `2000` | Newest webhook deliveries / agent activities when capped |
-| Webhook delivery log | newest `2000` | Truncation prefers newest |
-| OAuth code TTL | `600s` | From seed clock |
-| Access token TTL | `3600s` | From seed clock unless seed overrides |
-
-See `performanceBudgets` in [`fidelity.inventory.json`](fidelity.inventory.json).
-
-## Scopes
-
-- OAuth/API token **scope denial is opt-in fidelity**: set `seed.strictScopes: true`.
-  The default (`false`) matches other twins — auth gate is always on; fine-grained
-  Linear scopes are not enforced unless a task opts in.
-- When `strictScopes` is on, write mutators call `requireScopes` (`write`,
-  `issues:create`, `comments:create`; `admin` bypasses). JWT / `lin_pome_*`
-  sessions receive the full default scope set.
-
-## Webhooks
-
-- Outbound delivery enforces a **default-deny SSRF policy**: loopback, private,
-  link-local (incl. the `169.254.169.254` cloud metadata endpoint), unique-local,
-  and other non-public destinations are refused at dispatch time, validated
-  against the host's *resolved* addresses (a public name that resolves to an
-  internal IP is blocked too). Refused attempts are logged with
-  `error: "blocked_destination"` and never leave the process.
-- Loopback/private delivery for trusted lab callbacks (often `127.0.0.1`) is
-  opt-in via `LINEAR_TWIN_ALLOW_PRIVATE_WEBHOOKS=1` — an operator/deployment
-  trust decision, never settable by the agent under test.
-- URLs must be `http`/`https` without embedded credentials.
-- Delivery `fetch` also refuses redirects (`redirect: "error"`) so an allowed
-  public URL cannot bounce into link-local/metadata targets.
-
-## Recording notes
-
-- GraphQL and MCP writes go through `recorder.handle` / `reportDelta`.
-- Public OAuth (`/oauth/authorize`, `/oauth/token`, `/oauth/revoke`) sits outside
-  bearerAuth via `withPublicOAuth` and is **not** wrapped in `recorder.handle`.
-  Secrets must stay out of `/_pome/state` and any incidental recorder payloads;
-  covered by the OAuth canary matrix.

package/node_modules/@pome-sh/twin-linear/README.md

@@ -1,151 +0,0 @@
-# `@pome-sh/twin-linear`
-
-Deterministic Linear-shaped twin for agent testing (Pome).
-
-**Status: OSS release candidate.** This package includes the deterministic
-SQLite workspace model, strict seed/reset APIs, GraphQL + OAuth surfaces,
-bounded semantic state export, recording projection, and the captured
-twenty-two-tool first-party MCP contract (Gate 0 launch + Gate-1 Wave 4).
-
-## Auth identity (frozen)
-
-| Item | Value |
-| --- | --- |
-| Claim | `linear_email` on the Pome session JWT |
-| Default local email | `admin@pome-twin.test` |
-| Agent token env | `POME_LINEAR_TOKEN` (alias of `POME_AUTH_TOKEN`) |
-| Seeded personal token | `lin_test_admin` (resolved via `resolveCredential`) |
-| Provider token prefix | `lin_pome_` |
-| Bearer | Pome session JWT, seeded Linear tokens, or `lin_pome_*` |
-
-Pome owns hosted authentication. Local runs also accept DB-backed Linear API
-tokens from the seed for official-client parity.
-
-## Gate 0 / Gate-1 artifacts
-
-| Path | Role |
-| --- | --- |
-| [`fixtures/graphql-surface.json`](fixtures/graphql-surface.json) | Frozen GraphQL query/mutation/OAuth operation floor |
-| [`fixtures/mcp-tools-list.canonical.json`](fixtures/mcp-tools-list.canonical.json) | Official Linear MCP launch set (22 tools) |
-| [`fidelity.inventory.json`](fidelity.inventory.json) | Heat × fidelity × evidence for every launch MCP/GraphQL row |
-| [`REFERENCE-DIVERGENCES.md`](REFERENCE-DIVERGENCES.md) | Emulate rejected; never an oracle |
-| [`LIMITS.md`](LIMITS.md) | Seed/GraphQL/MCP/state-export caps |
-
-See [`fixtures/README.md`](fixtures/README.md) for capture provenance.
-
-## Launch MCP tools (exactly 22)
-
-`list_issues`, `get_issue`, `save_issue`, `list_comments`, `save_comment`,
-`delete_comment`, `list_teams`, `get_team`, `list_users`, `get_user`,
-`list_issue_statuses`, `get_issue_status`, `list_issue_labels`,
-`create_issue_label`, `list_projects`, `get_project`, `save_project`,
-`list_cycles`, `search_documentation`, `list_documents`, `get_document`,
-`save_document`.
-
-These 22 are a **curated Gate-1 subset** of the official Linear MCP surface
-(which currently exposes ~50+ tools); order and names are frozen to match it
-(`save_*` upserts). Everything outside the subset is a named gap below, not a
-silent success. GraphQL still exposes `issueCreate`/`issueUpdate` for SDK
-parity.
-
-## Named gaps (not fake success)
-
-MCP tool families outside the 22-tool Gate-1 subset are not implemented:
-
-- Initiatives (`*_initiative*`), milestones (`*_milestone`), releases
-  (`*_release*`), attachments (`*_attachment*`), git diffs / PR review
-  (`*_diff*`, `merge_diff`, `submit_diff_review`), status updates
-  (`*_status_update`), agent skills (`*_agent_skill*`), and
-  `list_project_labels`
-- Implemented tools still omit some real parameters (e.g. `save_issue`
-  omits `milestone` / dueDate via MCP; `save_document` omits initiative parents)
-- Full Linear GraphQL schema tail — loud unsupported / 501
-- External webhook delivery beyond logged attempts
-
-## Non-goals
-
-- Live Linear network calls
-- Expanding MCP beyond the frozen 22-tool Gate-1 set without a new ruling
-- Hosted product enablement (see [`HOSTED.md`](HOSTED.md))
-
-## Limits
-
-See [`LIMITS.md`](LIMITS.md). Defaults/maxima are pinned in
-`fidelity.inventory.json` `performanceBudgets`.
-
-## Stateful parity with other first-party twins
-
-Linear follows the same SDK chassis as GitHub / Slack / Stripe / Gmail:
-
-| Capability | Linear | Notes vs peers |
-| --- | --- | --- |
-| `defineTwin` + SQLite domain | yes | Same `@pome-sh/sdk` boot path |
-| `/_pome/state` | yes | Bounded collection rows |
-| `/_pome/events` + durable recorder | yes | `recordingProjection` redacts secrets |
-| `/admin/reset` + `/admin/seed` | yes | Reports `state_delta` |
-| MCP + GraphQL on one domain | yes | `LinearDomain` |
-| Session identity claim | `linear_email` | Peers use provider-shaped claims |
-| Root session mount | yes | `mountSessionAtRoot: true` |
-
-## Runtime contract (for snapshot consumers)
-
-`pome-cloud` builds a Vercel Sandbox snapshot from this package's signed source
-artifact. The following constraints must hold for that build to succeed and for
-the resulting snapshot to boot. Changing any of these is a breaking change for
-hosted; land the producer change here first, then open the cloud consumer PR
-that pins and verifies the new signed digest.
-
-### Build
-
-- Package is `npm install`-able from `package.json` alone (no `workspace:*`
-  protocols, no package-manager-specific deps; no committed lockfile is required, the snapshot
-  build regenerates one on each rebuild)
-- `npm run build` exits 0 and emits `dist/src/server.js`
-- Built output is loadable under Node 24 — the snapshot runs `runtime: "node24"`.
-  SQLite is the built-in `node:sqlite` (via the sdk's `openTwinDatabase()`) —
-  no native modules, no compiler toolchain.
-
-### Runtime
-
-- Server entry: `node dist/src/server.js` (cwd = package root)
-- Listens on `:3337` by default (`LINEAR_TWIN_PORT`, then the native default)
-- **Hosted normalizes the port to `PORT=3333`.** The server honors the `PORT`
-  env var first (`PORT` → `LINEAR_TWIN_PORT` → `3337`); the pome-cloud
-  control-plane sets `PORT=3333` at spawn for every twin, so the native `3337`
-  default is only used for standalone local runs.
-- Honors `LINEAR_TWIN_HOST=0.0.0.0` env (default `127.0.0.1` is unreachable via
-  Vercel Sandbox port forwarding)
-- Boots via a manual `@hono/node-server` path (not the SDK `serve()` helper),
-  with graceful `SIGINT`/`SIGTERM` handlers that flush and close the recorder
-  store before exit
-- Serves GraphQL at `/graphql` (in addition to the session MCP surface)
-- `GET /healthz` returns 200 within ~3s of process start (the snapshot build
-  sleeps 3s after `node dist/src/server.js` before probing)
-- Seed via `POME_SEED_JSON` (strict Linear seed schema; `LINEAR_TWIN_NO_SEED=1`
-  boots empty)
-- Bearer auth at `Authorization: Bearer <jwt>` — Pome session JWT, seeded Linear
-  tokens, or `lin_pome_*` provider tokens
-
-### Cloud consumer coordination
-
-- Bumping any of the above = publish a signed twin digest and open the matching
-  `pome-cloud` consumer PR.
-
-## Development
-
-```bash
-npm test -w @pome-sh/twin-linear
-npm run typecheck -w @pome-sh/twin-linear
-npm run fidelity:parity -w @pome-sh/twin-linear
-```
-
-## CLI
-
-```bash
-npx @pome-sh/cli twin start linear
-# prints POME_LINEAR_REST_URL, POME_LINEAR_MCP_URL, POME_AUTH_TOKEN,
-# and the identical POME_LINEAR_TOKEN alias
-```
-
-Use `pome tasks linear --copy` for the issue-triage and comment+label
-tasks. Hosted rollout is gated separately; see [`HOSTED.md`](HOSTED.md).

package/node_modules/@pome-sh/twin-linear/REFERENCE-DIVERGENCES.md

@@ -1,50 +0,0 @@
-# Reference divergences — Emulate is not an oracle
-
-Emulate’s Linear package may be used as a **coverage checklist**. It is **never** a behavioral oracle for `@pome-sh/twin-linear`.
-
-## Oracles
-
-1. Frozen official Linear MCP launch listing → [`fixtures/mcp-tools-list.canonical.json`](fixtures/mcp-tools-list.canonical.json)
-2. Frozen GraphQL operation inventory → [`fixtures/graphql-surface.json`](fixtures/graphql-surface.json)
-3. Linear public GraphQL / OAuth / webhook docs
-4. `@linear/sdk` smoke tests against root `/graphql`
-5. This package’s invariants (SQLite, seed clock, null state_delta on no-ops, loud 501)
-
-## Explicitly rejected Emulate-known behaviors
-
-| Rejected behavior | Twin rule |
-| --- | --- |
-| In-memory Store nondeterminism | SQLite + deterministic ids from seed clock / sequences |
-| HTML inspector as product surface | `/_pome/state` digests only |
-| Silent stub success for unsupported fields | Loud GraphQL errors or 501 unsupported envelope |
-| Session-less opaque tokens without sid binding | Tokens table binds `sid`; root mount uses `resolveCredential` |
-
-## Offline fidelity notes
-
-| Surface | Official expectation | Twin behavior |
-| --- | --- | --- |
-| Issue archive | Soft archive with `archivedAt` | `issueArchive` / `issueUnarchive` set/clear timestamps |
-| OAuth actor | user vs app | Seed `oauth_apps[].actor` authoritative |
-| Webhook headers | `Linear-Delivery`, `Linear-Event`, optional `Linear-Signature` | Emitted on mutation dispatch |
-| Agent sessions | Subset for local agent tests | GraphQL-only create/update/activity (not in MCP launch set) |
-| MCP documents tools | Full parent set incl. initiative | Gate-1: project/team/issue/cycle parents only |
-| MCP tool count | ~50+ live tools | Frozen 22-tool Gate-1 subset |
-
-## Webhook asymmetries (documented Gate-0 gaps)
-
-These are intentional twin divergences — not silent stubs:
-
-| Mutation / path | Official-ish expectation | Twin behavior |
-| --- | --- | --- |
-| `agentSessionCreateOnIssue` | `AgentSessionEvent` create webhook | Emits webhook (`action: created`) |
-| `agentSessionCreateOnComment` | Same family as on-issue create | **No webhook** — session row only (mention path stays quiet) |
-| `createProject` / `updateProject` (MCP `save_project`) | Project create/update webhook | **No webhook emit** — projects mutate SQLite state only |
-| `agentActivityCreate` with `type: prompt` | Prompted session event | Emits `AgentSessionEvent` / `prompted` |
-| Issue / comment CRUD | Issue / Comment webhooks | Emitted (create/update/remove/archive) |
-
-## Other non-oracles
-
-- Real Linear.app network sync
-- Full GraphQL schema / introspection dump
-- Production rate limits, inbox, initiatives, customer APIs
-- Expanding MCP beyond the frozen 22-tool Gate-1 set without a new ruling