@rafinery/cli 0.13.0 → 0.15.0

package/lib/distill.mjs

@@ -1,665 +0,0 @@
-// rafa distill --headless <branch> — merge-to-main DISTILLATION in the org's
-// own CI (working-set architecture, ratified 2026-07-10, rule 7).
-//
-// The rigor moment of the gradient: every working-set file the branch captured
-// is validated against the CHECKED-OUT MERGED MAIN (prism-shaped skepticism),
-// survivors are authored into the org brain (atlas-shaped), and only what
-// passes verify-citations + compile is pushed to the brain repo. Contested or
-// low-confidence items are NEVER guessed — flagged needs-adjudication for the
-// next dev session's digest offer.
-//
-// The judgment runs on the Agent SDK, driven by the ORG'S OWN LLM key
-// (ANTHROPIC_API_KEY from CI secrets — never stored on the rafinery platform).
-// The gates stay deterministic and OURS: this CLI collects, stages, re-runs
-// the checkers itself (trust-but-verify), pushes, and resolves. The agent
-// judges; it never ships.
-//
-// Collection is branch-match PLUS ancestry sweep (capture-engine spec P1,
-// 2026-07-17): any still-active row on ANY branch whose capturedAtSha is
-// reachable from this checkout's HEAD *off the first-parent mainline* is
-// provably-merged backlog — an earlier merge whose distill never ran — and
-// folds into this run. Mainline-grounded rows (a checkpoint before the
-// branch's first commit) and squash/rebase-merged commits are NOT provable;
-// those rows stay active for their own merge event or the platform
-// reconciler. Same-path collisions: the merged branch's copy is judged
-// (backlog never displaces the triggering merge); other copies stay active
-// for their own later judgment — a verdict never applies to unjudged content.
-//
-// Fallback chain when this can't run (no key, no CI): the dev-session flow —
-// /rafa distill <branch> in Claude Code (the bootstrap digest offers it).
-
-import { execSync } from "node:child_process";
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
-import { pathToFileURL } from "node:url";
-import { callTool } from "./mcp-client.mjs";
-import { trunkBranchOf } from "./stamp.mjs";
-import { runCompile, SCHEMA_VERSION } from "./gate/compile.mjs";
-import { runVerifyCitations } from "./gate/verify-citations.mjs";
-import {
-  applyLadder,
-  brainSchemaVersion,
-  classOf,
-  resolveSchemaPlan,
-  sourceSchemaVersion,
-  walkBrainNotes,
-} from "./distiller/schema-ladder.mjs";
-import pull from "./pull.mjs";
-import push from "./push.mjs";
-
-const die = (m) => {
-  console.error(`✗ ${m}`);
-  process.exit(1);
-};
-
-// A brain-relative path from the platform must stay inside .rafa/ — a row that
-// would escape is refused loudly (never written, never guessed).
-const safeRel = (p) => {
-  if (p.startsWith("/") || p.split("/").includes(".."))
-    die(`unsafe working-set path: ${p}`);
-  return p;
-};
-
-// The Agent SDK is deliberately NOT a dependency of this CLI (it is heavy and
-// only CI distillation needs it). Resolution order: $RAFA_AGENT_SDK_DIR (the
-// workflow's ISOLATED install — `npm i` inside the client checkout breaks on
-// pnpm workspaces, "workspace:*" is not an npm protocol) → normal import →
-// the host repo's node_modules.
-async function loadAgentSdk(cwd) {
-  const roots = [process.env.RAFA_AGENT_SDK_DIR, null, cwd];
-  for (const root of roots) {
-    try {
-      if (root === null) return await import("@anthropic-ai/claude-agent-sdk");
-      if (!root) continue;
-      const req = createRequire(join(root, "package.json"));
-      return await import(
-        pathToFileURL(req.resolve("@anthropic-ai/claude-agent-sdk")).href
-      );
-    } catch {
-      // try the next root
-    }
-  }
-  die(
-    "@anthropic-ai/claude-agent-sdk is not installed — the reconcile workflow installs it\n" +
-      "  into an isolated dir and points RAFA_AGENT_SDK_DIR at it (see rafa ci-setup;\n" +
-      "  re-run `npx @rafinery/cli ci-setup --overwrite` if your workflow predates this).",
-  );
-}
-
-const VERDICTS = ["distilled", "refuted", "needs-adjudication"];
-
-// ── collection helpers (pure; exported for tests) ───────────────────────────
-
-// Same-path collision across branches. The MERGED branch's own row always
-// wins — this run exists to judge the merge that triggered it; a swept
-// backlog row must never displace it. Between swept rows, newest updatedAt
-// wins with a deterministic branch-name tiebreak (platform iteration order
-// must never pick the winner). Superseded copies are NOT resolved here —
-// each copy is judged on its own merits in a later run (a verdict never
-// applies to content the judge did not see).
-export function latestWinsByPath(rows, preferredBranch) {
-  const beats = (a, b) => {
-    const aPref = a.branch === preferredBranch,
-      bPref = b.branch === preferredBranch;
-    if (aPref !== bPref) return aPref;
-    const aAt = a.updatedAt ?? 0,
-      bAt = b.updatedAt ?? 0;
-    if (aAt !== bAt) return aAt > bAt;
-    return String(a.branch) > String(b.branch);
-  };
-  const byPath = new Map();
-  for (const r of rows) {
-    const prev = byPath.get(r.path);
-    if (!prev) byPath.set(r.path, { winner: r, superseded: [] });
-    else if (beats(r, prev.winner)) {
-      prev.superseded.push(prev.winner);
-      prev.winner = r;
-    } else prev.superseded.push(r);
-  }
-  return [...byPath.values()];
-}
-
-// Rows whose capture commit git can PROVE belongs to merged branch work:
-// reachable from HEAD AND off the first-parent mainline. Reachability alone
-// is not proof — a session that checkpoints before its branch's first commit
-// grounds at a MAINLINE sha (the branch point), which is reachable forever;
-// sweeping it would steal in-flight rows from open branches. Off-mainline
-// reachable = the commit arrived via a merge. Rebase/squash-merged work is
-// unprovable here and stays active (safety over recall — the platform
-// reconciler and the session digest remain its path). Only full shas match
-// (checkpoint stamps `git rev-parse HEAD`); anything else counts unproven,
-// never guessed.
-export function sweepByAncestry(rows, provenMerged) {
-  const swept = [];
-  let unproven = 0;
-  for (const r of rows) {
-    if (
-      typeof r.capturedAtSha === "string" &&
-      /^[0-9a-f]{40,64}$/i.test(r.capturedAtSha) &&
-      provenMerged(r.capturedAtSha.toLowerCase())
-    )
-      swept.push(r);
-    else unproven++;
-  }
-  return { swept, unproven };
-}
-
-export default async function distill(args = []) {
-  // U7 recursion guard, belt-and-braces: the Agent SDK worker must never fire
-  // the M5 session sensors (a worker's own tool calls re-triggering hooks would
-  // loop). The ci-setup workflow sets this too; this covers ad-hoc invocations.
-  process.env.RAFA_HOOKS_DISABLED = "1";
-  const branch = args.filter((a) => !a.startsWith("-"))[0];
-  if (!args.includes("--headless"))
-    die(
-      "session distillation runs in Claude Code (/rafa distill <branch> — offer-driven at bootstrap).\n" +
-        "  This CLI runs the CI path:  rafa distill --headless <branch>",
-    );
-  if (!branch) die("usage: rafa distill --headless <branch>");
-  if (!process.env.ANTHROPIC_API_KEY)
-    die(
-      "ANTHROPIC_API_KEY is not set — CI distillation runs on the ORG'S OWN LLM key from CI\n" +
-        "  secrets (never stored on the rafinery platform). Add the secret (rafa ci-setup names\n" +
-        "  it), or fall back to the dev session: /rafa distill " +
-        branch,
-    );
-
-  const ROOT = process.cwd();
-  // Telemetry (owner feedback #9): every phase is timed and printed, so a CI
-  // log answers "where is it, and where did the time go" at a glance.
-  const t0 = Date.now();
-  const secs = (t) => ((Date.now() - t) / 1000).toFixed(1);
-  let agentModel = "unreported";
-
-  // Run record (capture-engine P5): the Reconciliations tab renders CI runs
-  // too — a terminal report_distill_run per NON-EMPTY run, keyed by the merge
-  // commit (RAFA_MERGE_SHA from the workflow; HEAD of the merged checkout as
-  // the fallback). Telemetry — best-effort, never fatal, and empty merges
-  // write no row (honest no-op stays row-less).
-  const mergeSha = (() => {
-    const env = process.env.RAFA_MERGE_SHA ?? "";
-    if (/^[0-9a-f]{7,64}$/i.test(env)) return env;
-    try {
-      return execSync("git rev-parse HEAD", {
-        cwd: ROOT,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-      }).trim();
-    } catch {
-      return "";
-    }
-  })();
-  const reportRun = async (status, summary) => {
-    if (!mergeSha) return;
-    try {
-      await callTool(ROOT, "report_distill_run", {
-        branch,
-        toBranch: process.env.RAFA_TARGET_BRANCH || trunkBranchOf(ROOT),
-        mergeCommitSha: mergeSha,
-        status,
-        note: summary,
-        actorMeta: { agent: "rafa-distill", runner: "ci", model: agentModel },
-      });
-    } catch {
-      /* the run itself is the deliverable; its record is telemetry */
-    }
-  };
-  const failRun = async (m) => {
-    await reportRun("failed", m);
-    die(m);
-  };
-
-  // Merged-work oracle: TWO subprocesses total — every commit reachable from
-  // HEAD, and the first-parent mainline. provenMerged = reachable ∧
-  // off-mainline (see sweepByAncestry). A shallow checkout truncates both
-  // sets, which only ever UNDER-sweeps (rows stay active) — safe.
-  const revList = (args) => {
-    try {
-      return new Set(
-        execSync(`git rev-list ${args} HEAD`, {
-          cwd: ROOT,
-          encoding: "utf8",
-          stdio: ["ignore", "pipe", "ignore"],
-          maxBuffer: 256 * 1024 * 1024,
-        })
-          .trim()
-          .split("\n")
-          .filter(Boolean),
-      );
-    } catch {
-      return new Set(); // no git history readable → sweep proves nothing
-    }
-  };
-  const reachable = revList("");
-  const mainline = revList("--first-parent");
-  const provenMerged = (sha) => reachable.has(sha) && !mainline.has(sha);
-  let shallow = false;
-  try {
-    shallow =
-      execSync("git rev-parse --is-shallow-repository", {
-        cwd: ROOT,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-      }).trim() === "true";
-  } catch {
-    /* not a git repo would have failed checkout long before this */
-  }
-
-  // 1 · collect: the merged branch's own rows PLUS the ancestry sweep over
-  // every other branch's active rows (provably-merged backlog folds in).
-  // Adjudication-flagged rows are LEFT for a human session (CI can flag
-  // divergence, never resolve it). The sweep is AUXILIARY: its failure warns
-  // and narrows the run to the merged branch — it never kills the primary
-  // distillation the merge event exists for.
-  console.log(`• collecting working set for ${branch} …`);
-  let branchAll;
-  try {
-    branchAll =
-      (await callTool(ROOT, "get_working_set", { branch })).files ?? [];
-  } catch (e) {
-    die(e instanceof Error ? e.message : String(e));
-  }
-  const branchRows = branchAll.filter((r) => r.status === "active");
-  const flagged = branchAll.filter((r) => r.status === "needs-adjudication");
-  const sweptRows = [];
-  let unproven = 0,
-    sweptBranches = 0;
-  try {
-    const { branches } = await callTool(ROOT, "list_working_sets", {});
-    const others = (branches ?? [])
-      .map((b) => (typeof b === "string" ? b : b.branch))
-      .filter((other) => other && other !== branch);
-    const perBranch = await Promise.all(
-      others.map(async (other) => {
-        const rows =
-          (
-            await callTool(ROOT, "get_working_set", {
-              branch: other,
-              status: "active",
-            })
-          ).files ?? [];
-        return sweepByAncestry(rows, provenMerged);
-      }),
-    );
-    for (const { swept, unproven: u } of perBranch) {
-      if (swept.length) sweptBranches++;
-      sweptRows.push(...swept);
-      unproven += u;
-    }
-  } catch (e) {
-    console.log(
-      `  ! ancestry sweep skipped (${e instanceof Error ? e.message : e}) — distilling ${branch}'s own rows only`,
-    );
-  }
-  if (flagged.length)
-    console.log(
-      `  ! ${flagged.length} file(s) already need adjudication — left for the next dev session's digest`,
-    );
-  if (sweptRows.length)
-    console.log(
-      `  + ancestry sweep: ${sweptRows.length} provably-merged row(s) from ${sweptBranches} other branch(es) folded into this run`,
-    );
-  if (unproven > 0)
-    console.log(
-      `  · ${unproven} row(s) on other branches not provably merged — left intact` +
-        (shallow
-          ? `\n    (shallow checkout limits the proof — re-run \`npx @rafinery/cli ci-setup --overwrite\` for full history)`
-          : ""),
-    );
-
-  const allGroups = latestWinsByPath([...branchRows, ...sweptRows], branch);
-  // P2 typed candidates: intent records are PROVENANCE, never truth claims —
-  // they resolve as consumed without staging or judgment; notes and
-  // improvements are the judged kinds (per-kind question in the prompt).
-  const kindOf = (p) =>
-    p.startsWith("improve/improvements/")
-      ? "improvement"
-      : p.startsWith("intent/")
-        ? "intent"
-        : "note";
-  const intentGroups = allGroups.filter((g) => kindOf(g.winner.path) === "intent");
-  const groups = allGroups.filter((g) => kindOf(g.winner.path) !== "intent");
-  const active = groups.map((g) => g.winner);
-  if (intentGroups.length)
-    console.log(
-      `  · ${intentGroups.length} intent record(s) — provenance, consumed without judgment`,
-    );
-  let intentConsumed = 0;
-  for (const g of intentGroups) {
-    for (const row of [g.winner, ...g.superseded]) {
-      try {
-        await callTool(ROOT, "resolve_working_file", {
-          branch: row.branch ?? branch,
-          path: row.path,
-          resolution: "distilled",
-          actorMeta: { agent: "rafa-distill", runner: "ci", model: agentModel },
-          note: "intent record — provenance consumed by the merge run (never a truth claim)",
-          ...(typeof row.version === "number" ? { baseVersion: row.version } : {}),
-        });
-        intentConsumed++;
-      } catch {
-        /* stays active for a later run — the brain branch keeps the trail */
-      }
-    }
-  }
-
-  if (active.length === 0) {
-    // Diagnostic empty (owner catch 2026-07-17): silence must explain itself —
-    // "never captured" and "already reconciled" are different states.
-    if (branchAll.length === 0) {
-      console.log(
-        `✓ nothing to distill on ${branch} — 0 rows were ever captured on this branch.\n` +
-          `  Capture never fired during its dev sessions (see \`rafa status\` → SENSORS; ` +
-          `candidates land via \`rafa checkpoint\`).`,
-      );
-    } else {
-      const counts = {};
-      for (const r of branchAll) counts[r.status] = (counts[r.status] ?? 0) + 1;
-      const parts = Object.entries(counts)
-        .map(([s, n]) => `${n} ${s}`)
-        .join(" · ");
-      console.log(
-        `✓ nothing to distill on ${branch} — ${branchAll.length} row(s) exist, none active: ${parts}\n` +
-          `  (distilled/refuted = already reconciled by an earlier run · folded = moved to the parent branch)`,
-      );
-    }
-    return;
-  }
-  console.log(`  ${active.length} file(s) to distill`);
-
-  // 2 · mirror the org brain locally — the authoring target + the base the
-  // survivors fold into. (CI checkout is merged main = the validation target.)
-  const tPull = Date.now();
-  await pull(["--full"]);
-  console.log(`  ⏱ brain mirror: ${secs(tPull)}s`);
-
-  // 2b · SCHEMA LADDER (0.11.0 — the owner's 4-case doctrine): resolve the
-  // version lattice BEFORE any claim-level judging, so knowledge from two
-  // lineages always meets on ONE schema — the newest this runner understands.
-  // Lifted target notes ride THIS run's gates + push (one migration+reconcile
-  // commit); an unknown future schema aborts loudly, never downgrades.
-  {
-    const target = brainSchemaVersion(join(ROOT, ".rafa"));
-    const source = sourceSchemaVersion(active.map((f) => f.content));
-    const plan = resolveSchemaPlan({ target, source, latest: SCHEMA_VERSION });
-    console.log(
-      `• schema ladder: target v${target} · source v${source} · runner v${SCHEMA_VERSION} → ${plan.mode}`,
-    );
-    if (plan.mode === "abort-newer-than-runner") die(plan.reason);
-    if (plan.mode !== "diff") console.log(`  ${plan.reason}`);
-    // Per-OKF-type lifts (class derives from the PATH — typed-candidates
-    // doctrine); non-laddered paths (intent records …) pass through untouched.
-    if (plan.upgradeSource)
-      for (const f of active) {
-        const cls = classOf(f.path);
-        if (cls) f.content = applyLadder(f.content, plan.toVersion, cls);
-      }
-    if (plan.rewriteTarget)
-      for (const noteFile of walkBrainNotes(join(ROOT, ".rafa"))) {
-        const cls = classOf(noteFile);
-        if (cls)
-          writeFileSync(noteFile, applyLadder(readFileSync(noteFile, "utf8"), plan.toVersion, cls));
-      }
-  }
-
-  // 3 · stage the incoming working set for the agent (gitignored inside .rafa).
-  const stagingRoot = join(ROOT, ".rafa", "distill-incoming");
-  rmSync(stagingRoot, { recursive: true, force: true });
-  for (const f of active) {
-    const abs = join(stagingRoot, safeRel(f.path));
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(
-      abs,
-      `<!-- incoming working-set file · branch: ${f.branch ?? branch} · author: ${f.lastAuthor} · v${f.version}` +
-        `${f.baseBrainSha ? ` · base: ${f.baseBrainSha}` : ""}` +
-        `${f.capturedAtSha ? ` · captured-at: ${f.capturedAtSha}` : ""} -->\n` +
-        f.content,
-    );
-  }
-  const verdictsPath = join(ROOT, ".rafa", "distill-verdicts.json");
-  rmSync(verdictsPath, { force: true });
-
-  // 4 · the judgment pass (org's own key; gates stay deterministic below).
-  const sdk = await loadAgentSdk(ROOT);
-  const fileList = active
-    .map(
-      (f) =>
-        `- ${f.path} (kind: ${kindOf(f.path)} · branch: ${f.branch ?? branch} · author: ${f.lastAuthor})`,
-    )
-    .join("\n");
-  const prompt = `You are running rafa's CI DISTILLATION — merge-time reconciliation of branch "${branch}"'s
-working set into the org brain. Some staged files were swept in from OTHER already-merged
-branches (their provenance comments name the source branch) — judge them identically.
-The checked-out repo IS merged main (the ground truth).
-The current org brain is mirrored at .rafa/brain/. The incoming candidate-grade files are
-staged under .rafa/distill-incoming/ (brain-relative paths mirrored; a provenance comment
-tops each file).
-
-Read .claude/skills/rafa-distill/SKILL.md (the SOP) and .claude/rafa/contract.md §2 (the
-note schema) + §3 (the improvement schema) first.
-
-Each staged file names its KIND in the list below — the judge question differs:
-
-For each kind:note file:
-1. VALIDATE like prism — skeptical, code-grounded: does every claim hold against the code
-   as it now stands on main? Confirm each citation resolves (the cited line contains the
-   token; run \`git grep\` yourself). A claim you cannot confirm with a file:line is
-   REFUTED (note the cited reason). Contested or genuinely uncertain → verdict
-   "needs-adjudication" (NEVER guess; a wrong note is worse than none).
-2. For survivors, AUTHOR like atlas — write/update the org-brain file under .rafa/brain/
-   per the contract: valid frontmatter, real cites into main, \`anchor:\` on contracts;
-   fold into an existing note when one already covers the topic (supersede, never
-   duplicate). Never copy the provenance comment into the brain file.
-
-For each kind:improvement file — the LIFECYCLE question, not the claim question:
-1. If it reports a FIX (status: fixed): is the cited defect actually GONE on merged main?
-   Gone → verdict "distilled", note "confirmed-fixed — <cite>"; author the status change
-   into .rafa/improve/improvements/<id>.md. Still present → verdict "refuted", note
-   "still-open — <cite>" (the ledger keeps saying open, truthfully).
-2. If it proposes a NEW improvement: does the defect actually EXIST on merged main, at the
-   cited lines? Exists → verdict "distilled", note "opened"; author the file under
-   .rafa/improve/improvements/. Not reproducible → "refuted" with the cited reason.
-3. After ANY improvement change, regenerate .rafa/improve/ledger.md counts to match the
-   rows — the ledger is DERIVED and compile cross-checks it.
-
-When all survivors are authored, run \`npx @rafinery/cli verify-citations\` and
-\`npx @rafinery/cli compile\` and fix your authored files until BOTH exit 0.
-
-Finally write .rafa/distill-verdicts.json:
-  {"verdicts":[{"path":"<staged brain-relative path>","verdict":"distilled|refuted|needs-adjudication","note":"<cited reason — required for refuted and needs-adjudication>"}]}
-with EXACTLY one entry per staged file listed below. Do not modify anything outside
-.rafa/ except nothing — the code repo is read-only ground truth.
-
-Staged files:
-${fileList}`;
-
-  console.log(
-    "• running the distillation agent (org's own ANTHROPIC_API_KEY) …",
-  );
-  const tAgent = Date.now();
-  const run = sdk.query({
-    prompt,
-    options: {
-      cwd: ROOT,
-      permissionMode: "bypassPermissions",
-      allowedTools: ["Read", "Grep", "Glob", "Bash", "Write", "Edit"],
-      settingSources: [],
-      maxTurns: 150,
-    },
-  });
-  // Stream the agent's narration lines — a silent multi-minute CI step reads
-  // as hung; a narrated one reads as working (and shows WHERE it hangs).
-  let lastLine = "";
-  for await (const message of run) {
-    if (
-      message.type === "assistant" &&
-      typeof message.message?.model === "string"
-    )
-      agentModel = message.message.model;
-    if (message.type === "assistant") {
-      const blocks = message.message?.content ?? [];
-      for (const b of blocks) {
-        if (b.type !== "text" || !b.text?.trim()) continue;
-        const line = b.text.trim().split("\n")[0].slice(0, 110);
-        if (line && line !== lastLine) {
-          console.log(`  · ${line}`);
-          lastLine = line;
-        }
-      }
-    }
-    if (message.type === "result") {
-      if (message.subtype !== "success")
-        await failRun(
-          `distillation agent did not complete (${message.subtype}) — nothing resolved, nothing pushed`,
-        );
-      console.log(
-        `  ⏱ agent: ${secs(tAgent)}s (${message.num_turns ?? "?"} turns · ` +
-          `$${(message.total_cost_usd ?? 0).toFixed(4)} on the org's key)`,
-      );
-      // Self-report the metered run (backlog #6) — best-effort, never fatal.
-      try {
-        await callTool(ROOT, "log_usage", {
-          provider: "anthropic",
-          model: agentModel,
-          inputTokens: message.usage?.input_tokens ?? 0,
-          outputTokens: message.usage?.output_tokens ?? 0,
-          ...(typeof message.total_cost_usd === "number"
-            ? { costUsd: message.total_cost_usd }
-            : {}),
-          purpose: "distill",
-          runner: "ci",
-        });
-      } catch (e) {
-        console.log(
-          `  ! usage not reported: ${e instanceof Error ? e.message : e}`,
-        );
-      }
-    }
-  }
-
-  // 5 · verdicts must be complete — a missing entry is a hard stop, never a guess.
-  if (!existsSync(verdictsPath))
-    await failRun(
-      "agent produced no .rafa/distill-verdicts.json — nothing resolved, nothing pushed; working set left intact",
-    );
-  let verdicts;
-  try {
-    verdicts = JSON.parse(readFileSync(verdictsPath, "utf8")).verdicts;
-  } catch {
-    await failRun(
-      "distill-verdicts.json is not valid JSON — nothing resolved, nothing pushed",
-    );
-  }
-  if (!Array.isArray(verdicts))
-    await failRun("distill-verdicts.json has no verdicts[] — aborting");
-  const byPath = new Map(verdicts.map((v) => [v.path, v]));
-  for (const f of active) {
-    const v = byPath.get(f.path);
-    if (!v || !VERDICTS.includes(v.verdict))
-      await failRun(
-        `no valid verdict for ${f.path} — nothing resolved, nothing pushed; working set left intact`,
-      );
-    if (
-      v.verdict !== "distilled" &&
-      (typeof v.note !== "string" || v.note.trim() === "")
-    )
-      await failRun(`${f.path}: verdict "${v.verdict}" requires a cited note — aborting`);
-  }
-
-  // 6 · trust-but-verify: OUR gates re-run regardless of what the agent claims.
-  console.log("• re-running the gates (trust-but-verify) …");
-  const tGates = Date.now();
-  if (runVerifyCitations([]) !== 0)
-    await failRun(
-      "citation checker failed on the authored brain — nothing resolved, nothing pushed",
-    );
-  if (runCompile([]) !== 0)
-    await failRun(
-      "compile gate failed on the authored brain — nothing resolved, nothing pushed",
-    );
-  console.log(`  ⏱ gates: ${secs(tGates)}s`);
-
-  // 7 · ship: brain repo push (webhook → ingest), staging cleaned first.
-  rmSync(stagingRoot, { recursive: true, force: true });
-  const distilledCount = active.filter(
-    (f) => byPath.get(f.path).verdict === "distilled",
-  ).length;
-  if (distilledCount > 0) {
-    // Descriptive reconciliation commit (owner 2026-07-26): the subject says
-    // WHAT this run did — branch, per-verdict counts, the banked ids — so any
-    // agent (ours or a foreign OKF reader) walking the brain log understands
-    // the commit without opening it. brain-for trailer untouched (push owns it).
-    {
-      const counts = { distilled: 0, refuted: 0, "needs-adjudication": 0 };
-      for (const v of verdicts) counts[v.verdict] = (counts[v.verdict] ?? 0) + 1;
-      const banked = verdicts
-        .filter((v) => v.verdict === "distilled")
-        .map((v) => String(v.path).split("/").pop().replace(/\.md$/, ""));
-      const idList = banked.slice(0, 4).join(", ") + (banked.length > 4 ? " …" : "");
-      await push([
-        "--verb=distill",
-        `--message=reconcile(${branch}): ${counts.distilled} banked · ${counts.refuted} refuted · ${counts["needs-adjudication"]} adjudication${banked.length ? ` — ${idList}` : ""}`,
-      ]);
-    }
-  } else {
-    console.log("• no survivors — nothing to push to the brain repo");
-  }
-
-  // 8 · resolve the rows (CAS — a racing session's resolve loses loudly).
-  // ONLY judged winners resolve, each under ITS OWN branch key and fenced on
-  // the version this run READ — a checkpoint that landed mid-judgment wins,
-  // never the stale verdict. Superseded same-path copies stay active: a
-  // verdict must never apply to content the judge did not see; each copy is
-  // judged on its own merits in a later run.
-  let refuted = 0,
-    adjudication = 0;
-  for (const g of groups) {
-    const f = g.winner;
-    const v = byPath.get(f.path);
-    if (v.verdict === "refuted") refuted++;
-    if (v.verdict === "needs-adjudication") adjudication++;
-    try {
-      await callTool(ROOT, "resolve_working_file", {
-        branch: f.branch ?? branch,
-        path: f.path,
-        resolution: v.verdict,
-        actorMeta: { agent: "rafa-distill", runner: "ci", model: agentModel },
-        ...(v.note ? { note: v.note } : {}),
-        ...(typeof f.version === "number" ? { baseVersion: f.version } : {}),
-      });
-      console.log(
-        `  ${v.verdict === "distilled" ? "✓" : "!"} ${f.branch ?? branch} · ${f.path} → ${v.verdict}${v.note ? ` (${v.note})` : ""}`,
-      );
-    } catch (e) {
-      console.log(
-        `  ✗ ${f.branch ?? branch} · ${f.path} — resolve failed: ${e instanceof Error ? e.message : e}`,
-      );
-    }
-    for (const s of g.superseded)
-      console.log(
-        `  · ${s.branch ?? branch} · ${s.path} — older same-path copy left active for its own judgment`,
-      );
-  }
-  rmSync(verdictsPath, { force: true });
-
-  await reportRun(
-    "succeeded",
-    `${distilledCount} banked · ${refuted} refuted · ${adjudication} needs-adjudication` +
-      (sweptRows.length ? ` · ${sweptRows.length} swept from earlier merges` : "") +
-      (intentConsumed ? ` · ${intentConsumed} intent record(s) consumed` : ""),
-  );
-  console.log(
-    `✓ distillation: ${distilledCount} into the org brain · ${refuted} refuted (reported, cited) · ` +
-      `${adjudication} flagged needs-adjudication (next session's digest)` +
-      (sweptRows.length ? ` · ${sweptRows.length} swept from earlier merges` : "") +
-      (intentConsumed ? ` · ${intentConsumed} intent consumed` : "") +
-      ` · total ${secs(t0)}s`,
-  );
-}