@quantiya/codevibe-core 2.0.0 → 2.0.2

package/dist/local-executor/class-a-sign.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The device's raw P-256 key material, as stored on the device identity
+ * (`KeychainManager`). Both halves are STANDARD base64 of the raw bytes:
+ *   - `privateKeyB64`: 32-byte P-256 scalar (`getPrivateKey()` raw form).
+ *   - `publicKeyB64`: 64-byte uncompressed point x‖y, NO 0x04 prefix
+ *     (`getPublicKey().subarray(1)` raw form).
+ * This matches `crypto-service.ts:52-68` + the 2f.3.a wire-format lock.
+ */
+export interface DeviceSigningKey {
+    privateKeyB64: string;
+    publicKeyB64: string;
+}
+/**
+ * Produce the RFC 8785 JCS canonical-JSON STRING of `obj` with its
+ * `signatureFieldName` key REMOVED (the signature cannot be part of its own
+ * signing input). Mirrors the Rust `canonical_json_for_signing` /
+ * `canonical_json_for_merge_classification` discipline: materialize the
+ * object, drop the signature key, then canonicalize. The object's keys are
+ * already camelCase on the wire; JCS sorts them lexicographically so the
+ * camelCase wire names are what get hashed.
+ *
+ * Exported so tests (and the golden-vector fixture generator) can assert the
+ * exact canonical string and catch future json-freeze JCS drift.
+ */
+export declare function canonicalJsonForSigning(obj: Record<string, unknown>, signatureFieldName: string): string;
+/**
+ * Sign a Class A envelope object. The canonical bytes are the JCS of the
+ * envelope with `signature` removed (matching Rust
+ * `canonical_json_for_signing`, signing.rs:126-141). Returns the
+ * STANDARD-base64 raw-64-byte signature to assign to `envelope.signature`.
+ *
+ * `unsignedEnvelope` is the envelope object WITHOUT (or before) the
+ * `signature` field is set; any existing `signature` key is stripped before
+ * canonicalizing, so passing a partially-populated object is safe.
+ */
+export declare function signClassAEnvelope(unsignedEnvelope: Record<string, unknown>, keys: DeviceSigningKey): string;
+/**
+ * Sign a MergeGate classification (#C12-8). The signing domain is the JCS of
+ * the classification with `signatureB64` removed AND `leDeviceId` INSIDE the
+ * domain (only `signatureB64` is stripped) — the device binds itself into
+ * its own signature. Matches the Rust
+ * `canonical_json_for_merge_classification`, which removes only the
+ * camelCase `signatureB64` key.
+ *
+ * Callers (W2.b) build the classification object, set `leDeviceId`, leave
+ * `signatureB64` empty/unset, call this helper, then assign the returned
+ * base64 to `signatureB64`. The crypto lives here so W2.b only orchestrates.
+ *
+ * @param classificationWithoutSig the camelCase classification object with
+ *        `leDeviceId` populated and `signatureB64` empty/absent.
+ * @param keys the LE's device P-256 key material.
+ * @param leDeviceId the signing device id; written into the classification's
+ *        `leDeviceId` field (inside the signing domain) before canonicalizing
+ *        — so the caller cannot accidentally sign over a stale/blank value.
+ * @returns the STANDARD-base64 raw-64-byte signature for `signatureB64`.
+ */
+export declare function signMergeClassification(classificationWithoutSig: Record<string, unknown>, keys: DeviceSigningKey, leDeviceId: string): string;

package/dist/local-executor/class-b-consumer.d.ts

@@ -0,0 +1,276 @@
+import type { AuthorityScope } from './authority';
+import { ClassAEmitter, ClassAEmitterContext } from './class-a-emit';
+import { EmitShellEventFn } from './hook-bridge';
+import { ClassBInbound, GateDispatchPayload, MergeGateDispatchPayload, ReviewerDispatchPayload, ReviseFeedbackPayload, TaskGroupHaltedPayload, TrackAssignedPayload } from './types';
+import type { ContinuationPacketWriter } from '../continuation/packet-writer';
+import type { PacketWriteInput } from '../continuation/types';
+export type ClassBVerificationResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'malformed_envelope' | 'algorithm_unsupported';
+};
+/**
+ * CP-1.e signature-verification STUB per design §4.1.
+ *
+ * Returns `{ ok: false }` on:
+ *   - missing/empty `signedEnvelope` or `signatureB64`
+ *   - unsupported `algorithm` (only `ed25519` / `p384-ecdsa` per CP-0 §2.3 enum)
+ *   - missing/empty `publicKeyId`
+ *   - missing/malformed `nonceUlid` (must be 26-char ULID)
+ *
+ * Returns `{ ok: true }` for every structurally-well-formed envelope. CP-2
+ * Stage A replaces the implementation with real signature verification but
+ * preserves this exact return-type contract (LOCK #E1-1 stability).
+ */
+export declare function verifyClassBSignature(envelope: ClassBInbound): ClassBVerificationResult;
+export declare const INBOUND_REPLAY_CAP = 10000;
+export declare const INBOUND_REPLAY_TTL_MS: number;
+/**
+ * INBOUND ULID-replay registry per design §5.1 + CP-0 §2.5 invariant #5.
+ *
+ * SCOPE DISAMBIGUATION (LOCK inherited from CP-1.c §6.2):
+ *   - OUTBOUND emitter dedupe = `ClassAEmitter.seenUlids` (CP-1.c scope).
+ *   - INBOUND consumer replay refusal = this class (CP-1.e scope).
+ *
+ * Bounded memory: 10K LRU entries × 24h TTL. Sweep is O(n) worst case but
+ * amortizes O(1) per insert because JS Map iterates in insertion order — a
+ * single non-expired entry means all subsequent ones are non-expired.
+ */
+export declare class UlidReplayRegistry {
+    private readonly cap;
+    private readonly ttlMs;
+    private readonly nowMs;
+    private readonly seenAt;
+    constructor(cap?: number, ttlMs?: number, nowMs?: () => number);
+    /**
+     * Returns `true` if the ULID is a replay (already seen within the active
+     * window). On `false`, the ULID is inserted and the registry is swept for
+     * expired entries + cap overflow.
+     */
+    checkAndInsert(ulid: string): boolean;
+    private sweepExpired;
+    /** Test-only — exposes seen-set size. */
+    get sizeForTests(): number;
+}
+/**
+ * Normalize an inbound `TrackAssigned` wire object (engine camelCase +
+ * lowercase agent) into the desktop's internal snake_case `TrackAssignedPayload`
+ * shape. Returns a plain object that `isValidTrackAssignedPayload` then deeply
+ * validates — invalid input still flows through to the validator (which drops).
+ * Best-effort: never throws (Class B consumption is best-effort per LOCK #E3-1).
+ */
+export declare function normalizeTrackAssignedWire(raw: unknown): Partial<TrackAssignedPayload>;
+/**
+ * FIX-3 — deep-validate a `TrackAssigned` payload BEFORE caching it or invoking
+ * the `launchTrack` DI callback. The shallow truthiness check left malformed
+ * NESTED fields (`write_paths` / `auto_modified_files` not arrays, invalid
+ * `implementor_agent` enum, non-numeric `track_index` / `dispatch_generation`,
+ * missing `ownership_scope` sub-arrays) to throw later inside
+ * `scopeFromOwnership` / `launchTrack` / `buildChangedFileSets`, crashing Class
+ * B consumption. Returns `true` only when EVERY field the team path reads is
+ * well-typed; the caller drops + logs on `false`.
+ *
+ * NOTE: kept structural (no throw) — Class B consumption is best-effort per
+ * LOCK #E3-1, so an invalid packet is dropped, never surfaced as an exception.
+ */
+export declare function isValidTrackAssignedPayload(payload: Partial<TrackAssignedPayload> | undefined): payload is TrackAssignedPayload;
+export interface ClassBConsumerState {
+    /** Last received PlannerDecisionApproved per taskId; CP-2 reads. */
+    plannerDecisionByTask: Map<string, Extract<ClassBInbound, {
+        kind: 'PlannerDecisionApproved';
+    }>>;
+    /** Last received GateDispatch per gateRunId; CP-2 reads. */
+    gateDispatchByRun: Map<string, Extract<ClassBInbound, {
+        kind: 'GateDispatch';
+    }>>;
+    /** Last received ContinuationOffer per handoffId; CP-2 reads. */
+    continuationOfferByHandoff: Map<string, Extract<ClassBInbound, {
+        kind: 'ContinuationOffer';
+    }>>;
+    /**
+     * CP-12 W2.b — last received TrackAssigned per `<task_group_id>::<track_index>`
+     * (introspection / re-dispatch reconciliation). The idempotency-by-generation
+     * decision lives in the `TrackRegistry` (track-registry.ts), NOT here — this
+     * is a record of what the consumer saw, not the spawn gate.
+     */
+    trackAssignedByTrack: Map<string, TrackAssignedPayload>;
+    /** CP-12 W2.b — last received MergeGateDispatch per `merge_gate_id`. */
+    mergeGateDispatchByGate: Map<string, MergeGateDispatchPayload>;
+    /** CP-12 W2.b — last received TaskGroupHalted per `task_group_id`. */
+    taskGroupHaltedByGroup: Map<string, TaskGroupHaltedPayload>;
+}
+export interface ClassBConsumerDeps {
+    emitter: ClassAEmitter;
+    emitShellEvent: EmitShellEventFn;
+    getContext: () => ClassAEmitterContext;
+    /** Called on TaskAuthorized to mutate the LocalExecutorImpl's authority scope (CP-0 §2.5 invariant #6). */
+    advanceAuthorityScope: (newScope: AuthorityScope, taskId: string) => void;
+    /**
+     * CP-1.f execute-first (D5 / #PR-1 / #PR-3) — called on the `TaskAuthorized`
+     * Class-B edge (the engine's SINGLE canonical "authorized-to-execute" signal,
+     * which fires for ALL THREE authorize paths: FinalApprovalPending+Approve,
+     * Halted+Accept, Halted+AcceptWithNotes — NOT keyed on `final_approval_resolved`
+     * alone). PROMOTES the task's shadow onto the real tree (the ONLY place the
+     * real workspace is mutated). Idempotent (#PR-4) — a packet + recovery
+     * double-fire is a safe no-op. When OMITTED (non-loop LE / tests), no promote
+     * runs (back-compat; only `advanceAuthorityScope` fires).
+     */
+    promoteOnTaskAuthorized?: (taskId: string) => Promise<void>;
+    /**
+     * Called on PolicyRejection to surface the rejection to the user (LOCK C4-3
+     * user-visible channel). Audited-path fix (Fix B) — `rejectedTaskId` carries
+     * the rejected task's OWN taskId (from the outer Class B envelope; the
+     * PolicyRejection payload has none) so the desktop wiring discards EXACTLY
+     * that task's shadow rather than the now-active task's. Undefined when the
+     * envelope lacked a taskId.
+     */
+    notifyPolicyRejection?: (detail: string, category: string, recommendedRecovery: string, rejectedTaskId?: string) => void;
+    /** Test seam for deterministic UlidReplayRegistry behavior. */
+    replayRegistry?: UlidReplayRegistry;
+    /**
+     * CP-6 LOCK #C6-A-10 — optional continuation packet writer. When
+     * present, `handleContinuationOffer` writes the local
+     * `CONTINUATION.md` packet after caching the offer and computes the
+     * authoritative JCS-canonical-JSON SHA-256 hash, then invokes the
+     * direct `recordContinuationPacketWritten` mutation. When omitted
+     * (back-compat for unit tests + pre-CP-6 LocalExecutorImpl instances),
+     * the consumer behaves exactly as before — cache-update only.
+     */
+    continuationPacketWriter?: ContinuationPacketWriter;
+    /**
+     * CP-6 — caller-supplied builder that turns an inbound
+     * `ContinuationOffer` into a `PacketWriteInput`. The class-B consumer
+     * has no view of the local sessionId / taskSummary / completedWork
+     * narrative — those live in the LocalExecutorImpl session state.
+     * When omitted, the consumer derives a minimal sentinel-only packet
+     * from the inbound offer payload (handoffId → taskId fall-back).
+     */
+    buildContinuationPacketInput?: (packet: Extract<ClassBInbound, {
+        kind: 'ContinuationOffer';
+    }>) => PacketWriteInput | null;
+    /**
+     * Launch the implementor for a track (#C12-14). MUST be idempotent by
+     * `(task_group_id, track_index, dispatch_generation)` — the LE's
+     * `TrackRegistry` ignores a duplicate generation (a duplicate `TrackAssigned`
+     * spawns NOTHING). Advances the per-track authority scope to
+     * `ownership_scope` and runs the track in its isolated `state_dir`.
+     */
+    launchTrack?: (payload: TrackAssignedPayload) => Promise<void>;
+    /**
+     * Run the MergeGate integration check on the `owner_track_index` track,
+     * classify + sign the result, and `submitMergeGateVerdict` (#C12-7/#C12-8).
+     */
+    runMergeGate?: (payload: MergeGateDispatchPayload) => Promise<void>;
+    /**
+     * Surface a group halt to the UI (NOTIFICATION + choices) and signal the
+     * in-flight track processes to stop (#C12-12). Deep choice-driven
+     * auto-resolution is server-side (#C12-3) — the LE only surfaces + stops.
+     */
+    haltTaskGroup?: (payload: TaskGroupHaltedPayload) => Promise<void>;
+    /**
+     * §3.C.18 — REAL Ed25519 signature verifier. Resolves (+ caches) the
+     * engine's Class-B public key and cryptographically verifies the packet's
+     * signature fail-closed. Returns `true` ONLY when the signature is
+     * cryptographically valid. When OMITTED (CP-1.e unit tests + pre-CP-1.f LE
+     * instances that never receive live packets), only the structural
+     * `verifyClassBSignature` check runs (back-compat). #C1F-9: production wires
+     * this so live Class B is fail-closed.
+     */
+    classBSignatureVerifier?: (packet: ClassBInbound) => Promise<boolean>;
+    /**
+     * CP-1.f Wave 3 FIX — §3.C.20 — consume a `GATE_DISPATCH` packet. For the
+     * round-0 `reviewer_quorum` gate (`gateType === "reviewer_quorum"`,
+     * `reviewerSeats` absent at START), the shell spawns the implementor + submits
+     * its output against `gateRunId` (the engine's round-0 gate_id — the desktop
+     * CANNOT learn it from the `startTask` mutation response, which only carries
+     * the workflow-state label string). MUST dedup on `gateRunId` (a sweeper / WS
+     * re-deliver must NOT double-spawn). `verification` / `final_approval` gate
+     * types are OUT OF SCOPE for CP-1.f single-task (the shell logs + ignores
+     * them). When OMITTED (non-loop LE / tests), the kind is cached + logged
+     * (back-compat — the existing `gateDispatchByRun` cache update still runs).
+     *
+     * CP-12 W2.b (§3.C.2 / H1) — `envelopeTaskId` carries the OUTER Class-B
+     * envelope's `task_id` (the `GateDispatchPayload` has none), so the team
+     * quorum loop can route the round-0 dispatch to the right per-track `task_id`.
+     * The engine stamps this on EVERY gate dispatch — single-impl INCLUDED (it
+     * equals the loop's single active task). The quorum loop discriminates team vs
+     * single-impl by `envelopeTaskId !== activeTaskId`, NOT by presence, so a
+     * single-impl dispatch (envelopeTaskId === activeTaskId) falls back to the
+     * single active task — byte-identical to today. Mirrors the
+     * `notifyPolicyRejection(.., rejectedTaskId?)` precedent.
+     */
+    gateDispatch?: (payload: GateDispatchPayload, envelopeTaskId?: string) => Promise<void>;
+    /**
+     * §3.C.21 — spawn ALL assigned reviewer seats for a REVIEWER_DISPATCH packet.
+     * The shell fetches+decrypts each seat's prompt, runs `registry.evaluate`,
+     * synthesizes ESCALATE on reviewer error (#C1F-8), and submits the verdict.
+     * MUST be idempotent per `(gateId, seatId)` so a dropped-packet recovery
+     * re-spawn is a no-op (§3.C.21b double-guard lives shell-side).
+     */
+    spawnReviewers?: (payload: ReviewerDispatchPayload) => Promise<void>;
+    /**
+     * §3.C.23 — re-run the implementor for round N+1 with the aggregated REVISE
+     * findings, then `submitImplementorOutput(nextGateId)`. MUST dedup on
+     * `reviseFeedbackId` + the implementor double-spawn guard (shell-side) so a
+     * sweeper re-emit after a crash is idempotent.
+     */
+    runReviseRound?: (payload: ReviseFeedbackPayload) => Promise<void>;
+}
+/**
+ * Class B inbound consumer per design §6.1.
+ *
+ * Single-entrypoint `consume(packet)` enforces LOCK #E3-1 ordering:
+ *   1. verify (LOCK #E1-1 — refuses signature_invalid via Class A audit)
+ *   2. replay-check (LOCK #E2-1 — refuses ulid_replay via Class A audit)
+ *   3. per-kind dispatch (5 locked variants per CP-0 §2.F.9-§2.F.13)
+ *
+ * Reverse ordering would let a tampered-but-replayed envelope advance state —
+ * explicitly forbidden by LOCK #E3-1.
+ */
+export declare class ClassBConsumer {
+    private readonly deps;
+    private readonly state;
+    private readonly replayRegistry;
+    constructor(deps: ClassBConsumerDeps);
+    /**
+     * @param envelopeTaskId Audited-path fix (Fix B) — the OUTER Class B envelope's
+     *   `taskId` (`ClassBPacketEnvelopeMeta.taskId`). Forwarded ONLY to
+     *   `handlePolicyRejection`, whose payload (`PolicyRejectionPayload`) carries no
+     *   taskId of its own, so the rejection can discard EXACTLY the rejected task's
+     *   shadow instead of "whatever task is active now". Optional — undefined for
+     *   unit tests / non-WS callers (the discard then degrades to a no-op for that
+     *   rejection, never the wrong task's shadow).
+     */
+    consume(packet: ClassBInbound, envelopeTaskId?: string): Promise<void>;
+    private handlePlannerDecisionApproved;
+    private handleGateDispatch;
+    private handleContinuationOffer;
+    private handleTaskAuthorized;
+    private handlePolicyRejection;
+    private handleTrackAssigned;
+    private handleMergeGateDispatch;
+    private handleTaskGroupHalted;
+    private handleReviewerDispatch;
+    private handleReviseFeedback;
+    /**
+     * Constructs an AuthorityRefusal with one of the LOCK #E4-1 widened category
+     * literals and emits an EXECUTOR_REFUSAL via the CP-1.c emitter. Audit-only:
+     * the user-visible NOTIFICATION channel is reserved for PolicyRejection (the
+     * only Class B variant that surfaces hosted policy decisions to the user).
+     *
+     * `recommendedRecovery` is derived per-category to match CP-0 §2.F.14 fixture
+     * row literals verbatim on the wire (was Codex Stage-2 r1 H-1 — emitter
+     * default `'reauthorize_locally'` is correct for `authority_scope_conflict`
+     * (CP-1.c authority paths) but wrong for the CP-1.e Class-B variants):
+     *   - signature_invalid     → 'retry_after_resync' (CP-0 fixture line 458)
+     *   - ulid_replay           → 'abort_task'         (CP-0 fixture line 486)
+     *   - policy_rejection      → 'ask_user'           (consumer of policy reject)
+     *   - authority_scope_conflict → 'reauthorize_locally' (inherited CP-1.c default)
+     */
+    private refuseWithCategory;
+    /** Test-only — exposes cached-decision registry for §6.4 assertions. */
+    get stateForTests(): Readonly<ClassBConsumerState>;
+    /** Test-only — exposes replay registry for §5.3 / §6.4 introspection. */
+    get replayRegistryForTests(): UlidReplayRegistry;
+}

package/dist/local-executor/class-b-verify.d.ts

@@ -0,0 +1,30 @@
+import crypto from 'node:crypto';
+/** Outcome of a cryptographic Class B verify. */
+export type ClassBCryptoVerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'malformed_envelope' | 'malformed_key' | 'signature_mismatch';
+};
+/**
+ * Build a Node `KeyObject` Ed25519 public key from the raw 32-byte verifying
+ * key (base64). Ed25519 public keys are an OKP JWK with `crv: 'Ed25519'` and a
+ * base64url `x` of the 32 raw bytes. Throws on a non-32-byte key.
+ */
+export declare function ed25519PublicKeyFromRaw(publicKeyB64: string): crypto.KeyObject;
+/**
+ * Produce the RFC 8785 JCS canonical-JSON STRING of the full Class B envelope
+ * with BOTH signature carriers removed. Mirrors the engine's
+ * `canonical_json_for_signing` exactly. The envelope's keys are already
+ * camelCase on the wire; JCS sorts lexicographically over the wire-key names.
+ */
+export declare function classBCanonicalForSigning(envelope: Record<string, unknown>): string;
+/**
+ * Cryptographically verify an inbound Class B packet's Ed25519 signature
+ * against `publicKeyB64` (the engine's verifying key). FAIL-CLOSED: any
+ * malformed input or signature mismatch → `{ ok: false }`. Never throws.
+ *
+ * `packet` is the parsed `packetJson` (the full `ClassBEnvelope` with all
+ * wire fields — `parseClassBPacketPayload` returns it verbatim).
+ */
+export declare function verifyClassBEd25519(packet: unknown, publicKeyB64: string): ClassBCryptoVerifyResult;

package/dist/local-executor/class1-reconcilers.d.ts

@@ -0,0 +1,58 @@
+import type { ConflictFileMeta } from './conflict-types';
+/** The outcome of attempting a class-1 reconciler. */
+export type Class1ReconcileResult = {
+    status: 'resolved';
+    /** The deterministic resolved file bytes. */
+    bytes: Buffer;
+    /** Which deterministic reconciler produced this (lockfile-only in W3-core). */
+    reconciler: 'lockfile';
+    /** Byte-level explanation (audited rationale). */
+    explanation: string;
+} | {
+    /** Escalate OUT of class-1 to a reviewed path. `to:3` = human gate. */
+    status: 'escalate';
+    to: 2 | 3;
+    reason: string;
+    humanGateTrigger?: 'lockfile_version_delta';
+} | {
+    status: 'not_applicable';
+};
+/**
+ * Extract a deterministic, order-insensitive multiset of CANONICAL FULL entries
+ * from a lockfile by type, or `null` if the type is unsupported/unparseable (→
+ * fail closed). "Full" is the point (Stage-2 r2 Codex HIGH): each entry carries
+ * EVERY provenance/verification field, not just `name@version` —
+ *   - Cargo.lock: the whole `[[package]]` block (name, version, **source**,
+ *     **checksum**, dependencies), normalized + line-sorted within the block;
+ *   - package-lock.json: each entry's FULL object (version, **resolved**,
+ *     **integrity**, …) via {@link stableStringify};
+ *   - go.sum: the FULL line (module version **hash**, incl. `/go.mod` rows).
+ * So a pure re-serialization (reorder) yields an EQUAL multiset, while ANY field
+ * delta — a version change OR a same-version checksum/integrity/source swap (a
+ * supply-chain substitution) — yields a DIFFERENT multiset → escalation.
+ */
+export declare function lockfileCanonicalEntries(path: string, content: string): string[] | null;
+/**
+ * §4.3 class-1 — lockfile reconciliation, EXACT FULL-ENTRY-SET only. If the track
+ * and counterpart lockfiles resolve the **exact same** canonical full-entry
+ * multiset (a pure re-sort/re-serialization — NO field changed anywhere,
+ * including every checksum/integrity/source/hash), the resolution = the track
+ * lockfile verbatim (both encode byte-equivalent dependencies). If the entry
+ * sets DIFFER in ANY field — a version change OR a same-version checksum/
+ * integrity/source swap (a supply-chain substitution, Stage-2 r2 Codex HIGH) —
+ * it is a real change → **escalate to class-3 (human)**, never a silent merge.
+ * Unsupported/unparseable lockfile → also escalate (fail closed).
+ */
+export declare function reconcileLockfile(meta: ConflictFileMeta): Class1ReconcileResult;
+/**
+ * Attempt the class-1 reconcilers for a conflict. In W3-core the ONLY class-1
+ * reconciler is the lockfile reconciler, so `lockfileHint` is required for a
+ * resolution: with it, the lockfile reconciler runs (and ESCALATES a
+ * version-delta rather than silently falling through); without it, no class-1
+ * reconciler applies → `not_applicable` (→ the resolve pipeline routes the
+ * conflict to class-2, reviewed). Whitespace/import-order class-1 reconciliation
+ * is deferred to the language-aware follow-on (see the module header).
+ */
+export declare function attemptClass1(meta: ConflictFileMeta, opts?: {
+    lockfileHint?: boolean;
+}): Class1ReconcileResult;

package/dist/local-executor/class2-resolver.d.ts

@@ -0,0 +1,74 @@
+import type { ConflictFileMeta, ConflictHunk } from './conflict-types';
+import { type ConflictResolutionRecord, type ConflictResolutionStore } from './conflict-resolution-store';
+/** The bounded prompt handed to the broker (only these bytes cross the boundary). */
+export interface ResolverPrompt {
+    path: string;
+    conflictKind: string;
+    hunkOrdinal: number;
+    baseLines: string[];
+    trackLines: string[];
+    counterpartLines: string[];
+    /** Bounded surrounding-file context (already budget-checked). */
+    surroundingContext: string;
+}
+/** The model's reply, as returned by the brokered call. */
+export interface ResolverModelResult {
+    /** The resolved hunk lines the model proposes. */
+    resolvedHunkLines: string[];
+    /** The model's rationale. */
+    rationale: string;
+    /** Best-effort self-reported confidence (0..1). NOT a gate (class-2 is Tier-2'd). */
+    confidence?: number;
+}
+/**
+ * Abstracts the single allowlisted BROKERED model call (§8). The live impl
+ * (W3-6) constructs a `BrokerRequest` and calls the CP-7 broker's `handle()`;
+ * tests inject a deterministic stub. It receives ONLY the bounded prompt and
+ * returns ONLY the bounded result — no raw network, no ambient creds.
+ */
+export interface ConflictModelCaller {
+    resolve(prompt: ResolverPrompt): Promise<ResolverModelResult>;
+}
+/** Inputs for resolving one class-2 conflict hunk. */
+export interface ResolveClass2Input {
+    meta: ConflictFileMeta;
+    hunk: ConflictHunk;
+    repoId: string;
+    mergeImplId: string;
+    /** Bounded surrounding-file context bytes (the assembler's responsibility). */
+    surroundingContext: string;
+    /** Max prompt bytes; exceeding → escalate to human (§8). */
+    maxContextBytes: number;
+}
+export interface ResolveClass2Deps {
+    store: ConflictResolutionStore;
+    caller: ConflictModelCaller;
+}
+/** The outcome of a class-2 resolve attempt. */
+export type ResolveClass2Result = {
+    status: 'resolved';
+    /** The recorded ConflictResolution (`replayed` true = served from the store). */
+    record: ConflictResolutionRecord;
+    replayed: boolean;
+    /** SHA-256 of the prompt bytes sent to the broker (audit). Absent on replay. */
+    promptHash?: string;
+    /** SHA-256 of the model response bytes (audit). Absent on replay. */
+    responseHash?: string;
+} | {
+    /** Escalate to the human gate (class-3) — over-budget context or a
+     * fail-closed model-call failure. NEVER an ambient fallback. */
+    status: 'escalate';
+    reason: string;
+    humanGateTrigger: 'context_budget' | 'model_call_failed';
+};
+/** Assemble the bounded resolver prompt (only these bytes cross the boundary). */
+export declare function assembleResolverPrompt(input: ResolveClass2Input): ResolverPrompt;
+/** Deterministic byte size of a prompt (for the §8 budget check). */
+export declare function promptByteSize(prompt: ResolverPrompt): number;
+/**
+ * Resolve one class-2 conflict hunk (§4.3 / §8). Replay-first, bounded-context,
+ * brokered, fail-closed. Records the resolution on a fresh resolve. The caller
+ * (W3-6) composes the resolved hunk into the file and Tier-2-reviews the merged
+ * result before promote.
+ */
+export declare function resolveClass2(input: ResolveClass2Input, deps: ResolveClass2Deps): Promise<ResolveClass2Result>;

package/dist/local-executor/confined-model-caller.d.ts

@@ -0,0 +1,39 @@
+import type { ConflictModelCaller, ResolverModelResult, ResolverPrompt } from './class2-resolver';
+/** The single confined model invocation the caller depends on (injected). */
+export interface ConfinedModelRunner {
+    /**
+     * Run the model over `promptText` under the engaged confinement (substrate
+     * broker path A, or trusted-container legacy spawn path B) and return its raw
+     * stdout. MUST run read-only over only the prompt bytes; MUST NOT expose an
+     * ambient vendor credential to an unconfined child (the factory guarantees the
+     * confinement before constructing the caller). Throws on spawn/timeout failure.
+     */
+    runConfinedModel(promptText: string): Promise<string>;
+    /** The merge-gate audit scope (Stage-2 r2 codex LOW) — carried for the audit trail. */
+    ownerTaskId: string;
+}
+/**
+ * Render the bounded class-2 resolver prompt as model-ready text. Only the
+ * `ResolverPrompt` bytes (the three 3-way sides + the already-budget-checked
+ * surrounding context) cross the boundary. Instructs a STRICT JSON reply so the
+ * parse is unambiguous + fail-closed.
+ */
+export declare function renderResolverPromptText(prompt: ResolverPrompt): string;
+/**
+ * Extract the STRICT JSON `ResolverModelResult` from the model's raw stdout.
+ * Tolerates surrounding whitespace + a single fenced ```json block, but requires
+ * a well-formed object with a string[] `resolvedHunkLines`. Throws (fail-closed)
+ * on anything else — `resolveClass2` escalates the hunk to the human gate.
+ */
+export declare function parseResolverModelResult(raw: string): ResolverModelResult;
+/**
+ * The concrete confined class-2 model caller (§2.1). Constructed ONLY when a
+ * confinement holds (path A/B); path C never reaches here (the factory returns
+ * `null` → the gate runs without a resolver → halt-on-conflict). Errors propagate
+ * to `resolveClass2`, which escalates fail-closed to the human gate.
+ */
+export declare class ConfinedModelCaller implements ConflictModelCaller {
+    private readonly runner;
+    constructor(runner: ConfinedModelRunner);
+    resolve(prompt: ResolverPrompt): Promise<ResolverModelResult>;
+}

package/dist/local-executor/conflict-classifier.d.ts

@@ -0,0 +1,21 @@
+import type { ConflictClassification, ConflictFileMeta } from './conflict-types';
+import { type SharedContractDetectorOptions } from './shared-contract-detector';
+/**
+ * Classify a single conflicting path (§4.3). The result's `class` is FINAL for
+ * class-3 and for the lockfile class-1 route; for a general content conflict the
+ * result is class-2 (content-eligible) and the resolve pipeline (W3-6) may
+ * downgrade it to class-1 if a deterministic reconciler proves it order/format
+ * only. Pure + deterministic.
+ *
+ * Order (first match wins, hard triggers first so they can never be bypassed):
+ *   1. non-content conflict kind → class-3 (FINAL)
+ *   2. binary → class-3 (FINAL)
+ *   2b. non-UTF-8 text (no NUL) → class-3 (FINAL) — the UTF-8 diff3 path would corrupt it
+ *   3. Git-LFS → class-3 (FINAL)
+ *   4. dangerous .gitattributes driver → class-3 (FINAL)
+ *   5. HARD shared-contract (detector hardGate ∪ planner) → class-3 (FINAL)
+ *   6. lockfile (detector, non-hard) → class-1 (reconciler: 'lockfile')
+ *   7. otherwise (regular-file text content) → class-2 (content-eligible)
+ *      [add/add is a class-3 hard kind at step 1, never reaches here]
+ */
+export declare function classifyConflict(meta: ConflictFileMeta, opts?: SharedContractDetectorOptions): ConflictClassification;

package/dist/local-executor/conflict-resolution-durable-store.d.ts

@@ -0,0 +1,61 @@
+import type { AgenticResolutionRecord, ConflictResolutionRecord, ConflictResolutionStore } from './conflict-resolution-store';
+import type { ResolutionSetEntry, ResolutionSetIndex } from './resolution-set-index';
+/** Symmetric content cipher for at-rest encryption (the team session key, cli.ts). */
+export interface ContentCipher {
+    encrypt(plaintext: string): string;
+    decrypt(ciphertext: string): string;
+}
+/**
+ * The durable, content-encrypted {@link ConflictResolutionStore} (§2.4). Loads the
+ * per-group file once, serves reads from memory, and flushes atomically on each
+ * `put`. Idempotent on `conflict_id` (the recorded resolution for an exact 3-way
+ * input is immutable — a second put keeps the original).
+ *
+ * SINGLE-WRITER INVARIANT (Stage-2 r1 agy LOW): the in-memory cache assumes ONE
+ * live instance per group at a time. That holds by construction — the store is
+ * built ONCE per merge-gate run (`runWorktreeMergeBranch`) and written only inside
+ * the SEQUENTIAL merge-train (one slot at a time), and the merge gate is dispatched
+ * at most once per group. Two concurrent gate runs for the same group would be a
+ * separate (double-promote) bug; if that invariant is ever relaxed, this store
+ * needs a per-group RMW lock (cf. `RevertManifestStore.withTrackTipLock`).
+ */
+export declare class DurableConflictResolutionStore implements ConflictResolutionStore {
+    private readonly group;
+    private readonly cipher?;
+    private cache;
+    private agenticCache;
+    /** attemptId → keys (conflict_id / instance_id) written PENDING under it (CP-14 WB2). */
+    private pendingCache;
+    constructor(opts: {
+        taskGroupId: string;
+        rootDir?: string;
+        cipher?: ContentCipher;
+    });
+    private load;
+    private decode;
+    private encode;
+    get(conflictId: string): Promise<ConflictResolutionRecord | null>;
+    put(record: ConflictResolutionRecord, attemptId?: string): Promise<ConflictResolutionRecord>;
+    private loadAgentic;
+    private decodeAgentic;
+    private encodeAgentic;
+    getAgentic(instanceId: string): Promise<AgenticResolutionRecord | null>;
+    putAgentic(record: AgenticResolutionRecord, attemptId?: string): Promise<AgenticResolutionRecord>;
+    private loadPending;
+    /** Durably record that `key` was written PENDING under `attemptId` (no-op without an attemptId). */
+    private trackPending;
+    clearPending(attemptId: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** The durable {@link ResolutionSetIndex} (§2.3) — structural, no content, plaintext. */
+export declare class DurableResolutionSetIndex implements ResolutionSetIndex {
+    private readonly group;
+    private cache;
+    constructor(opts: {
+        taskGroupId: string;
+        rootDir?: string;
+    });
+    private load;
+    get(setHash: string): Promise<ResolutionSetEntry | null>;
+    put(setHash: string, entry: ResolutionSetEntry): Promise<void>;
+}