@reticlehq/server 2.14.0 → 3.2.0

package/dist/flows/annotate-tools.js

@@ -1,179 +0,0 @@
-import { z } from 'zod';
-import { aliasParam } from '../tools/alias-args.js';
-import { AnnotationErrorCode, AnnotationSchema } from '@reticlehq/core';
-import { RECOVERY } from '../tools/error-recovery.js';
-/**
- * An unknown kind is almost always a free-text annotation, which this tool deliberately refuses to
- * guess into a predicate. Naming the six kinds turns a dead end into one retry.
- */
-const UNKNOWN_KIND_RECOVERY = 'Annotations are structured, never free text. Pass one of: ' +
-    '{ kind: "assert-signal", name }, { kind: "assert-visible", testid }, ' +
-    '{ kind: "assert-state", statePath }, { kind: "mark-dynamic", testid }, ' +
-    '{ kind: "success-state", signal|testid }, or { kind: "intent", text }.';
-import { ReticleTool } from '../tools/tool-names.js';
-import { asString } from '../tools/tools-helpers.js';
-import { compileAnnotation } from './annotate.js';
-import { resolveAnnotateTarget } from './annotate-target.js';
-/**
- * The reticle_annotate tool. A STRUCTURED annotation (the AnnotationSchema
- * discriminated union) is compiled into the live recording's per-step expect / flow dynamic[] /
- * flow success, which reticle_flow_save then folds onto disk. Returns the AnnotateResult envelope
- * with the compiled-predicate confirmation text ("will assert signal diff:shown").
- *
- * FIRST CUT: structured annotations only. A free NATURAL-LANGUAGE annotation never compiles — it
- * fails AnnotationSchema and is returned as UNKNOWN_KIND. NL → predicate compilation is explicitly
- * FUTURE; no NL parser exists or is faked here.
- *
- * No-active-recording and no-step are SAFE, returned as structured codes (never thrown), so an
- * agent that annotates at the wrong moment gets a clear error rather than a crash.
- */
-export const ANNOTATE_TOOLS = [
-    {
-        name: ReticleTool.ANNOTATE,
-        example: { kind: 'assert-signal', name: 'todos:loaded' },
-        description: 'Attach a STRUCTURED annotation to the active recording, compiling it into the flow. kind: ' +
-            'assert-signal { name, dataMatches? } → the last step asserts that signal; assert-visible ' +
-            '{ testid } → the last step asserts that element is present; assert-state ' +
-            '{ statePath, store?, equals? } → the last step asserts a registered store value (the source ' +
-            'of truth no DOM read can reach); mark-dynamic { testid } → the ' +
-            "flow records that region as LLM-dynamic (replay won't assert its content); success-state " +
-            '{ signal | statePath(+store,+equals) | net(+count) | console(+absent) | testid } → the flow golden ' +
-            'end-condition (statePath asserts a registered store value — the source of truth no DOM read can ' +
-            'reach; net asserts a request fired EXACTLY `count` times — catches double-submit; console+absent ' +
-            'asserts a clean console — catches an action that logs an error). Folded onto disk by reticle_flow_save. ' +
-            'Returns { ok:true, target:step|flow, compiled } (e.g. "will assert signal diff:shown") or ' +
-            '{ ok:false, code } (annotate_no_recording | annotate_no_step | annotate_unknown_kind | ' +
-            'annotate_missing_field). FIRST CUT: structured only — a free natural-language string is ' +
-            'rejected (annotate_unknown_kind), never guessed into a predicate. Pass `flow` to target a ' +
-            "named recording (defaults to 'default'); `name` is the assert-signal's SIGNAL name, not the recording.",
-        inputSchema: {
-            // `flow` selects the recording; `name`/`signal`/`testid`/`dataMatches` are the annotation fields.
-            flow: z.string().optional().describe("Named recording to annotate. Defaults to 'default'."),
-            // Every other flow tool says `flowName`, and reticle_flow_save's own description sends the
-            // agent here — so the spelling it arrives with is the one this tool did not accept.
-            flowName: z
-                .string()
-                .optional()
-                .describe('Alias for `flow` (the name every other flow tool uses).'),
-            kind: z
-                .string()
-                .describe('Annotation kind: assert-signal | assert-visible | assert-state | mark-dynamic | success-state | intent.'),
-            name: z.string().optional().describe('Signal name for assert-signal annotations.'),
-            text: z
-                .string()
-                .optional()
-                .describe("Business goal for an intent annotation, e.g. 'ship a deploy to production'."),
-            testid: z
-                .string()
-                .optional()
-                .describe('data-testid value for assert-visible / mark-dynamic / success-state annotations.'),
-            signal: z.string().optional().describe('Signal name for success-state annotations.'),
-            statePath: z
-                .string()
-                .optional()
-                .describe("Store dot-path for an assert-state (last step) or success-state (golden end) store-truth assertion (e.g. 'deployments.0.status'). With `store` and optional `equals` — asserts the app's source of truth, not just the DOM."),
-            store: z
-                .string()
-                .optional()
-                .describe('Store name for a statePath assert-state/success-state annotation.'),
-            equals: z
-                .unknown()
-                .optional()
-                .describe('Expected value for statePath: a literal, or a { $gte | $contains | $length }.'),
-            hold: z
-                .boolean()
-                .optional()
-                .describe('Treat statePath as an INVARIANT that must still hold AFTER the action settles (a blast-radius "this unrelated path must not have moved" check), not a condition to wait for. Without it a wait-until-true read passes before an over-reaching side-effect lands.'),
-            dataMatches: z
-                .record(z.unknown())
-                .optional()
-                .describe('Key/value pairs the signal payload must match (assert-signal only).'),
-            net: z
-                .object({
-                method: z.string().optional(),
-                urlContains: z.string().optional(),
-                status: z.number().optional(),
-                count: z.number().int().nonnegative().optional(),
-            })
-                .optional()
-                .describe('Network golden end-condition for success-state: the flow succeeds only when EXACTLY `count` requests match { method?, urlContains?, status? } since the action (omit count = presence). Catches the double-submit / retry-storm regression a presence check passes.'),
-            console: z
-                .object({
-                level: z.string().optional(),
-                absent: z.boolean().optional(),
-            })
-                .optional()
-                .describe('Console golden end-condition for success-state: with absent:true the flow succeeds only when the action logged NO console message at `level` (default "error") — "completed with a clean console". Catches an action that logs a caught error/rejection while the UI still renders fine.'),
-            sessionId: z
-                .string()
-                .optional()
-                .describe('Active session ID from reticle_sessions. Omit when only one browser session is open.'),
-            annotation: z
-                .unknown()
-                .optional()
-                .describe('Structured annotation: { kind, name, dataMatches? } for assert-signal; { kind, testid } for assert-visible / mark-dynamic; { kind, signal?, testid? } for success-state.'),
-        },
-        outputSchema: {
-            ok: z.boolean(),
-            recovery: z.string().optional(),
-            target: z.string().optional(),
-            compiled: z.string().optional(),
-            // Set when the compiled annotation would overstate what a replay can check — e.g. a
-            // success-state that flow_save will grade assertion-free (#395).
-            note: z.string().optional(),
-            code: z.string().optional(),
-        },
-        handler: (deps, args) => {
-            // The recording actually RUNNING when there is exactly one, not the literal name `default`.
-            // Reproduced on three apps: a named recording plus an unnamed annotate reported
-            // `annotate_no_step` while the steps sat in the recording the agent had started.
-            const name = resolveAnnotateTarget(asString(aliasParam(args, 'flow', ['flowName'])['flow']), deps.recordings.active());
-            // Structured boundary: a free NL string / unknown kind fails the schema → UNKNOWN_KIND.
-            const parsed = AnnotationSchema.safeParse(args);
-            if (!parsed.success) {
-                return Promise.resolve({
-                    ok: false,
-                    code: AnnotationErrorCode.UNKNOWN_KIND,
-                    recovery: UNKNOWN_KIND_RECOVERY,
-                });
-            }
-            const stepCount = deps.recordings.stepCount(name);
-            const compiled = deps.recordings.getCompiled(name) !== undefined;
-            if (stepCount === undefined && !compiled) {
-                return Promise.resolve({
-                    ok: false,
-                    code: AnnotationErrorCode.NO_ACTIVE_RECORDING,
-                    recovery: RECOVERY.MISSING_RECORDING,
-                });
-            }
-            const outcome = compileAnnotation(parsed.data, stepCount ?? 0);
-            if (!outcome.result.ok) {
-                // Name what IS recording. `annotate_no_step` alone sent the agent off to record MORE steps —
-                // into the same empty recording — when the steps it already has are in another one.
-                const active = deps.recordings.active();
-                const elsewhere = active.filter((r) => r !== name && (deps.recordings.stepCount(r) ?? 0) > 0);
-                if (outcome.result.code === AnnotationErrorCode.NO_STEP_TO_ANNOTATE &&
-                    elsewhere.length > 0) {
-                    return Promise.resolve({
-                        ...outcome.result,
-                        recovery: `'${name}' has no steps yet, but ${elsewhere.map((r) => `'${r}'`).join(', ')} does. Pass \`flow\` to say which recording this belongs to, or drive an action first.`,
-                    });
-                }
-                return Promise.resolve(outcome.result);
-            }
-            const patch = outcome.patch;
-            if (patch !== undefined) {
-                if (patch.dynamicAdd !== undefined)
-                    deps.annotations.addDynamic(name, patch.dynamicAdd);
-                if (patch.success !== undefined)
-                    deps.annotations.setSuccess(name, patch.success);
-                if (patch.intent !== undefined)
-                    deps.annotations.setIntent(name, patch.intent);
-                if (patch.stepIndex !== undefined && patch.stepExpect !== undefined) {
-                    deps.annotations.setStepExpect(name, patch.stepIndex, patch.stepExpect);
-                }
-            }
-            return Promise.resolve(outcome.result);
-        },
-    },
-];

package/dist/flows/assertion-tiers-store.d.ts

@@ -1,16 +0,0 @@
-import type { FileSystemPort } from '../project/fs-port.js';
-import type { StepExpect } from './assertion-integrity.js';
-interface FlowBaseline {
-    steps: StepExpect[];
-    sources: string[];
-}
-type FlowTiers = Record<string, FlowBaseline>;
-export declare class AssertionTiersStore {
-    #private;
-    constructor(fs: FileSystemPort, root: string);
-    load(): Promise<FlowTiers>;
-    save(tiers: FlowTiers): Promise<void>;
-    /** Record one flow's assertion shape + covered sources after it PASSED. Never breaks a replay. */
-    recordPassing(name: string, steps: readonly StepExpect[], sources?: readonly string[]): Promise<void>;
-}
-export {};

package/dist/flows/assertion-tiers-store.js

@@ -1,98 +0,0 @@
-import { dirname } from 'node:path';
-import { z } from 'zod';
-import { reticleDirPaths } from '../project/reticle-dir.js';
-import { withFileLock } from '../project/file-lock.js';
-/**
- * The anti-reward-hacking baseline. Detecting an assertion DOWNGRADE requires knowing what the
- * flow asserted the last time it PASSED — otherwise a weakened flow simply looks like a flow that always
- * asserted little. Flows are git-checked and agent-editable, so we cannot trust the file itself as its own
- * history.
- *
- * So: on every passing replay we record that flow's per-step assertion shape here, and the gate diffs the
- * current file against it. Recorded only on PASS, deliberately — a failing run must never become the
- * baseline a later weakening is measured against.
- *
- * Loads never throw: a missing/corrupt ledger degrades to "no baseline", which means no downgrade can be
- * claimed. Failing OPEN is right here — accusing an agent of gaming the gate on the strength of an
- * unreadable file would be worse than missing one downgrade.
- */
-const AssertionTiersFileSchema = z.object({
-    version: z.literal(1),
-    flows: z.record(z.object({
-        steps: z.array(z.object({ step: z.number(), expect: z.unknown().optional() })),
-        /** Source files this flow covered when it last passed — lets the gate scope DELETION findings to
-         * the files that actually changed, instead of flagging every intentionally-removed flow. */
-        sources: z.array(z.string()).default([]),
-    })),
-});
-const ASSERTION_TIERS_VERSION = 1;
-export class AssertionTiersStore {
-    #fs;
-    #path;
-    constructor(fs, root) {
-        this.#fs = fs;
-        this.#path = reticleDirPaths(root).tiers;
-    }
-    async load() {
-        let text;
-        try {
-            text = await this.#fs.readFile(this.#path);
-        }
-        catch (error) {
-            if (this.#fs.isNotFound(error))
-                return {};
-            throw error;
-        }
-        let parsed;
-        try {
-            parsed = JSON.parse(text);
-        }
-        catch {
-            return {};
-        }
-        const result = AssertionTiersFileSchema.safeParse(parsed);
-        if (!result.success)
-            return {};
-        const out = {};
-        for (const [name, entry] of Object.entries(result.data.flows)) {
-            out[name] = {
-                steps: entry.steps.map((s) => ({
-                    step: s.step,
-                    ...(s.expect === undefined ? {} : { expect: s.expect }),
-                })),
-                sources: entry.sources,
-            };
-        }
-        return out;
-    }
-    async save(tiers) {
-        await this.#fs.mkdir(dirname(this.#path));
-        const body = `${JSON.stringify({ version: ASSERTION_TIERS_VERSION, flows: tiers }, null, 2)}\n`;
-        const tmp = `${this.#path}.tmp`;
-        await this.#fs.writeFile(tmp, body);
-        await this.#fs.rename(tmp, this.#path);
-    }
-    /** Record one flow's assertion shape + covered sources after it PASSED. Never breaks a replay. */
-    async recordPassing(name, steps, sources = []) {
-        try {
-            // Serialized per file: a fresh store instance is created per flow (flow-replay-run), so parallel
-            // passing replays would otherwise each load the same baseline, add only THEIR flow, and the last
-            // save would drop every other flow's baseline — the downgrade-detection gate silently losing
-            // coverage. The lock is keyed by path, so it serializes across those distinct instances.
-            await withFileLock(this.#path, async () => {
-                const all = await this.load();
-                all[name] = {
-                    steps: steps.map((s) => ({
-                        step: s.step,
-                        ...(s.expect === undefined ? {} : { expect: s.expect }),
-                    })),
-                    sources: [...sources],
-                };
-                await this.save(all);
-            });
-        }
-        catch {
-            // a ledger write must never fail a green replay
-        }
-    }
-}

package/dist/flows/decision.d.ts

@@ -1,25 +0,0 @@
-import { type FlowFile, type FlowReplayResult, type ReplayDecision, type SuiteVerdict } from '@reticlehq/core';
-/**
- * @param intentStatement the ledger's current wording, when the flow is bound to an intent row.
- * Falls back to the copy on the flow file, which is what a flow saved before the link carries.
- */
-export declare function buildDecision(result: FlowReplayResult, flow?: FlowFile, intentStatement?: string): ReplayDecision;
-/**
- * Aggregate per-flow replays into one suite verdict — the autonomous loop's consolidated answer
- * after a build: did anything break, and what's the prioritized fix list. Pure: pass the already
- * decision-annotated replay results + their flows. Passing flows are counted; only failures carry
- * detail (token-cheap), each with the actionable decision so the agent fixes without re-querying.
- */
-/**
- * Why a green replay still verified nothing, or undefined when it genuinely did.
- *
- * A flow with no steps, or one that asserts no observable consequence, replays green no matter what
- * the app does — the grader already knows this at save time and says so. Counting it as `passed`
- * turned that warning into "all 1 flow pass", which is a false green in the exact feature sold as
- * the regression suite. Classified only when the flow file is available; never guessed.
- */
-export declare function unverifiableReason(flow: FlowFile | undefined): string | undefined;
-export declare function buildSuiteVerdict(runs: ReadonlyArray<{
-    replay: FlowReplayResult;
-    flow?: FlowFile;
-}>): SuiteVerdict;

package/dist/flows/decision.js

@@ -1,201 +0,0 @@
-import { AnchorKind, ReplayStatus, } from '@reticlehq/core';
-import { classifyFlowAssertions, FlowAssertionGrade } from './flow-classify.js';
-import { SUCCESS_STEP_TOOL } from './flow-success.js';
-/**
- * Turn a replay result into the autonomy DECISION envelope — the judgement a human reviewer used to
- * make, expressed so a coding agent can act on it without one. Pure: no IO, no clock.
- *
- * pass → intent held; next action is none (or "add a consequence oracle" if the flow asserts nothing).
- * drift → a locator/anchor missed; point at WHERE (file:line from the source anchor) + a rebind hint.
- * fail → an action ran but its consequence/success oracle didn't fire (green-but-wrong) — check the handler.
- */
-/** The first step that drifted or failed (drift takes precedence as the legible cause). */
-function failingStep(steps) {
-    return steps.find((s) => s.drift !== undefined) ?? steps.find((s) => !s.ok);
-}
-/**
- * `file:line` for a step, from whichever anchor recorded provenance — or nothing.
- *
- * It used to fall back to `step.page`, which meant a field named "whereInSource" could return
- * "/checkout". The report writer renders it as **Where:** `<value>`, so a route arrived looking
- * exactly like a file path. A locator that is sometimes a route cannot be trusted when it genuinely
- * is a path, which costs more than the fallback ever added — the page is already reported separately
- * on the step.
- */
-function whereInSource(step, flow) {
-    const anchor = flow?.steps[step.step]?.anchor;
-    const source = anchor?.kind === AnchorKind.COMPONENT || anchor?.kind === AnchorKind.TESTID
-        ? anchor.source
-        : undefined;
-    return source === undefined ? undefined : `${source.file}:${String(source.line)}`;
-}
-/**
- * The business outcome that stopped being true, said before the mechanism that broke it.
- *
- * Order is the point. The intent is what makes a failure legible — a human or an agent reading
- * "step 3 assertion failed" has to reconstruct the stakes — and the mechanical detail underneath is
- * what makes it actionable. Dropping either one costs something, so the summary carries both.
- */
-const INTENT_BROKEN_PREFIX = 'NO LONGER TRUE: ';
-/**
- * What a report says when nothing declared what the flow is for.
- *
- * Never an intent derived from step names: a guessed goal reads as the product owner's words and an
- * agent will act on it. The same rule as the source pointer — absence stays honest.
- */
-const NO_INTENT_ON_PASS = 'no intent declared, so this proves the steps ran, not what they were for — declare one with reticle_intent.';
-const NO_INTENT_ON_FAIL = 'no intent declared, so this names the mechanism, not the stakes.';
-/** `<intent> — <mechanical>`, or the mechanical sentence plus the honest absence. */
-function withIntent(mechanical, statement) {
-    return statement === undefined
-        ? `${mechanical} — ${NO_INTENT_ON_FAIL}`
-        : `${INTENT_BROKEN_PREFIX}"${statement}" — ${mechanical}`;
-}
-/**
- * @param intentStatement the ledger's current wording, when the flow is bound to an intent row.
- * Falls back to the copy on the flow file, which is what a flow saved before the link carries.
- */
-export function buildDecision(result, flow, intentStatement) {
-    const { name, status, steps } = result;
-    const intentSaid = intentStatement ?? flow?.intent;
-    if (status === ReplayStatus.OK) {
-        // Green — but is it green-for-the-right-reason? A flow that asserts no consequence can pass while
-        // broken, so the honest next action is to add one.
-        const grade = flow !== undefined ? classifyFlowAssertions(flow) : undefined;
-        const verifiesOutcome = true === grade?.hasConsequenceAssertion;
-        return {
-            verdict: 'pass',
-            summary: intentSaid !== undefined
-                ? `"${name}" passed — intent "${intentSaid}" ${verifiesOutcome ? 'verified' : 'NOT asserted'}.`
-                : `"${name}" passed (${steps.length} steps) — ${NO_INTENT_ON_PASS}`,
-            nextAction: verifiesOutcome
-                ? 'none — the flow held and its consequence was observed.'
-                : 'add a consequence assertion (assert-signal / success-state) so this flow can fail when the feature breaks.',
-        };
-    }
-    const step = failingStep(steps);
-    const where = step !== undefined ? whereInSource(step, flow) : undefined;
-    if (status === ReplayStatus.DRIFT && step?.drift !== undefined) {
-        const { drift } = step;
-        const fix = drift.nearest !== null && drift.ambiguous !== true
-            ? `rebind the anchor to "${drift.nearest}" (closest survivor)`
-            : drift.nearest !== null
-                ? `candidates exist (e.g. "${drift.nearest}") but are ambiguous — choose deliberately`
-                : undefined;
-        return {
-            verdict: 'drift',
-            summary: withIntent(`"${name}" drifted at step ${step.step} (${step.anchor}).`, intentSaid),
-            whatChanged: drift.reason,
-            ...(where !== undefined ? { whereInSource: where } : {}),
-            ...(fix !== undefined ? { suggestedFix: fix } : {}),
-            nextAction: fix !== undefined
-                ? `${fix}, or update the flow if the change was intended.`
-                : `inspect ${where ?? 'the step'} — the anchored element is gone; rebind or update the flow.`,
-        };
-    }
-    // status error: an action failed, or the success oracle was not satisfied (green-but-wrong).
-    const message = result.error?.message ?? step?.error ?? 'the flow failed';
-    const isSuccessOracle = step?.tool === SUCCESS_STEP_TOOL;
-    return {
-        verdict: 'fail',
-        summary: withIntent(`"${name}" failed${step !== undefined ? ` at step ${step.step} (${step.anchor})` : ''}.`, intentSaid),
-        whatChanged: message,
-        ...(where !== undefined ? { whereInSource: where } : {}),
-        nextAction: isSuccessOracle
-            ? 'the steps ran but the business outcome never fired — check the handler/effect behind the action, not the locator.'
-            : 'the action could not complete — check the element state and the handler at the step above.',
-    };
-}
-/** Map a replay status to the suite verdict's three-state outcome. */
-function suiteVerdictOf(status) {
-    if (status === ReplayStatus.OK)
-        return 'pass';
-    return status === ReplayStatus.DRIFT ? 'drift' : 'fail';
-}
-/**
- * Aggregate per-flow replays into one suite verdict — the autonomous loop's consolidated answer
- * after a build: did anything break, and what's the prioritized fix list. Pure: pass the already
- * decision-annotated replay results + their flows. Passing flows are counted; only failures carry
- * detail (token-cheap), each with the actionable decision so the agent fixes without re-querying.
- */
-/**
- * Why a green replay still verified nothing, or undefined when it genuinely did.
- *
- * A flow with no steps, or one that asserts no observable consequence, replays green no matter what
- * the app does — the grader already knows this at save time and says so. Counting it as `passed`
- * turned that warning into "all 1 flow pass", which is a false green in the exact feature sold as
- * the regression suite. Classified only when the flow file is available; never guessed.
- */
-export function unverifiableReason(flow) {
-    if (flow === undefined)
-        return undefined;
-    if (0 === flow.steps.length) {
-        return 'the flow has no steps — it replays green whatever the app does. Record it again, or add steps with reticle_annotate.';
-    }
-    const c = classifyFlowAssertions(flow);
-    if (c.grade !== FlowAssertionGrade.ASSERTION_FREE)
-        return undefined;
-    return (c.warning ??
-        'the flow asserts no observable consequence, so it passes even when the feature is broken.');
-}
-export function buildSuiteVerdict(runs) {
-    const failures = [];
-    const unverifiable = [];
-    let passed = 0;
-    for (const { replay, flow } of runs) {
-        if (replay.status === ReplayStatus.OK) {
-            const reason = unverifiableReason(flow);
-            // A green that cannot go red is not a pass. Counted apart, so `passed` stays a count of things
-            // actually verified rather than of replays that merely completed.
-            if (reason !== undefined)
-                unverifiable.push({ flow: replay.name, reason });
-            else
-                passed += 1;
-            continue;
-        }
-        const decision = replay.decision ?? buildDecision(replay, flow);
-        const row = { flow: replay.name, verdict: suiteVerdictOf(replay.status) };
-        // Zero step results PLUS an error is the signature of a replay that never STARTED — the flow file
-        // failed to load (before the session is even resolved), or its leased context never came up. A
-        // flow that ran and failed always carries its failing step; a flow with no steps replays OK and
-        // never reaches here. Both arrive as ReplayStatus.ERROR, so without this the suite cannot tell
-        // "the app broke" from "Reticle could not run this" — and the bug metric reported the second as
-        // the first, 8 times in one sweep.
-        if (0 === replay.steps.length && replay.error !== undefined)
-            row.couldNotRun = true;
-        if (decision.whatChanged !== undefined)
-            row.whatChanged = decision.whatChanged;
-        if (decision.whereInSource !== undefined)
-            row.whereInSource = decision.whereInSource;
-        row.nextAction = decision.nextAction;
-        failures.push(row);
-    }
-    const total = runs.length;
-    const failed = failures.length;
-    // A real failure outranks an unverifiable flow: a broken flow is worse news than an empty one.
-    // An EMPTY suite is unverifiable for the same reason a flow that asserts nothing is — it is the
-    // purest green that cannot go red. It used to report `pass` with the summary "all 0 flows pass",
-    // which meant `reticle verify` went green on every project that had not written a flow yet, and on
-    // any project where the flows directory failed to resolve. Found by the adversarial MCP sweep; it
-    // was the only invented answer in 994 calls.
-    const status = failed > 0 ? 'fail' : unverifiable.length > 0 || 0 === total ? 'unverifiable' : 'pass';
-    const cannotFail = 0 === unverifiable.length
-        ? ''
-        : ` — ${String(unverifiable.length)} verified nothing (${unverifiable.map((u) => u.flow).join(', ')})`;
-    const summary = 0 === total
-        ? 'no flows to verify — nothing was checked. Record one with reticle_record { action: "start" }, then reticle_flow_save.'
-        : 0 === failed
-            ? 0 === unverifiable.length
-                ? `all ${total} flow${1 === total ? '' : 's'} pass`
-                : `${String(passed)}/${String(total)} flows verified${cannotFail}`
-            : `${passed}/${total} flows pass — ${failed} need attention: ${failures.map((f) => f.flow).join(', ')}${cannotFail}`;
-    return {
-        status,
-        total,
-        passed,
-        failed,
-        summary,
-        failures,
-        ...(unverifiable.length > 0 ? { unverifiable } : {}),
-    };
-}

package/dist/flows/empty-flow.js

@@ -1,24 +0,0 @@
-/**
- * Refuse to save a flow with no steps.
- *
- * It used to succeed: `flow_save` returned `{ stepCount: 0, grade: "assertion-free" }` with no error,
- * `flow_list` then showed one more flow, and `flow_verify` called it `unverifiable` — forever. The
- * agent believes it saved a regression test; what it wrote is a permanent suite entry that can never
- * go green or red.
- *
- * Zero steps is not a degraded flow, it is the absence of one. And the refusal matters most on the
- * stacks where the recorder is known to capture nothing, because there the empty save is the only
- * signal the agent would ever get that something went wrong.
- */
-import { ReticleTool } from '../tools/tool-names.js';
-export function emptyFlowRefusal(stepCount, name) {
-    if (stepCount > 0)
-        return undefined;
-    return {
-        error: `'${name}' has no steps, so there is nothing to save — a flow with no steps can never pass or fail, and would sit in the suite reporting "unverifiable" forever`,
-        recovery: `Nothing was captured between ${ReticleTool.RECORD} { action: "start" } and { action: "stop" }. ` +
-            `Drive at least one action with ${ReticleTool.ACT} or ${ReticleTool.ACT_AND_WAIT} while the ` +
-            `recording is open, then save. If you DID act and this still says zero, the recorder captured ` +
-            `nothing for this stack — report it with ${ReticleTool.FEEDBACK}.`,
-    };
-}

package/dist/flows/flake-store.d.ts

@@ -1,18 +0,0 @@
-import type { FileSystemPort } from '../project/fs-port.js';
-import { type FlakeLedger } from './flake.js';
-/**
- * Persists the per-flow flake ledger at `.reticle/flake.json`. Local single-project memory (stays OSS —
- * OSS-VS-SERVER). Loads never throw: missing/malformed/wrong-version degrades to an empty ledger, so
- * a bad file never blocks a gate — it just re-learns flakiness. `record` accrues one unchanged-code
- * replay outcome; `flakyFlows` is what the gate quarantines.
- */
-export declare class FlakeStore {
-    #private;
-    constructor(fs: FileSystemPort, root: string);
-    load(): Promise<FlakeLedger>;
-    save(ledger: FlakeLedger): Promise<void>;
-    /** Accrue one unchanged-code replay outcome for a flow and persist. */
-    record(flow: string, passed: boolean): Promise<void>;
-    /** The flows currently quarantined as flaky — what the gate excludes from blocking. */
-    flakyFlows(): Promise<string[]>;
-}

package/dist/flows/flake-store.js

@@ -1,58 +0,0 @@
-import { dirname } from 'node:path';
-import { reticleDirPaths } from '../project/reticle-dir.js';
-import { FlakeFileSchema, emptyRecord, isFlaky, recordOutcome } from './flake.js';
-const FLAKE_FILE_VERSION = 1;
-/**
- * Persists the per-flow flake ledger at `.reticle/flake.json`. Local single-project memory (stays OSS —
- * OSS-VS-SERVER). Loads never throw: missing/malformed/wrong-version degrades to an empty ledger, so
- * a bad file never blocks a gate — it just re-learns flakiness. `record` accrues one unchanged-code
- * replay outcome; `flakyFlows` is what the gate quarantines.
- */
-export class FlakeStore {
-    #fs;
-    #path;
-    constructor(fs, root) {
-        this.#fs = fs;
-        this.#path = reticleDirPaths(root).flake;
-    }
-    async load() {
-        let text;
-        try {
-            text = await this.#fs.readFile(this.#path);
-        }
-        catch (error) {
-            if (this.#fs.isNotFound(error))
-                return {};
-            throw error;
-        }
-        let parsed;
-        try {
-            parsed = JSON.parse(text);
-        }
-        catch {
-            return {};
-        }
-        const result = FlakeFileSchema.safeParse(parsed);
-        return result.success ? result.data.flows : {};
-    }
-    async save(ledger) {
-        await this.#fs.mkdir(dirname(this.#path));
-        const body = `${JSON.stringify({ version: FLAKE_FILE_VERSION, flows: ledger }, null, 2)}\n`;
-        const tmp = `${this.#path}.tmp`;
-        await this.#fs.writeFile(tmp, body);
-        await this.#fs.rename(tmp, this.#path);
-    }
-    /** Accrue one unchanged-code replay outcome for a flow and persist. */
-    async record(flow, passed) {
-        const ledger = await this.load();
-        ledger[flow] = recordOutcome(ledger[flow] ?? emptyRecord(), passed);
-        await this.save(ledger);
-    }
-    /** The flows currently quarantined as flaky — what the gate excludes from blocking. */
-    async flakyFlows() {
-        const ledger = await this.load();
-        return Object.entries(ledger)
-            .filter(([, record]) => isFlaky(record))
-            .map(([flow]) => flow);
-    }
-}