@sackville-mcp/verify 0.0.1-alpha.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Curtis Autery
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/index.d.mts

@@ -0,0 +1,102 @@
+import { CaptureVerdictFacts, CompositeVerdict, VerdictPolicy } from "@sackville-mcp/verdict";
+import { ContractResult } from "@sackville-mcp/api";
+import { DiffCoverageReport } from "@sackville-mcp/coverage";
+import { DependencyAudit } from "@sackville-mcp/deps";
+import { FlakeVerdict } from "@sackville-mcp/flake";
+import { MutationSummary } from "@sackville-mcp/mutate";
+
+//#region src/gate.d.ts
+/**
+ * The gate-denial brand (ADR 0013 Addendum, milestone 5c — "compose, never widen").
+ *
+ * A run-driving pillar can reject for two very different reasons: its **own**
+ * operator gate denied the run (the pillar was never executed — `skipReason:
+ * 'gate-not-set'`), or it ran and **crashed** (`errorReason`). The orchestrator must
+ * tell them apart, but it must NOT import any engine runtime to do so (the
+ * spawn-free invariant, § gate (e)). So the contract is a structural brand carried
+ * on the error itself, keyed by a GLOBAL symbol — `Symbol.for(...)` resolves to the
+ * same symbol in every package WITHOUT a shared import, so each pillar's own
+ * `*GateError` (and the surface's no-fetcher / no-DB checks) can set it and the
+ * orchestrator can read it with zero coupling.
+ *
+ * This reuses each pillar's REAL gate decision (`assertAllowed`) — there is no
+ * reimplemented gate predicate here to drift out of sync.
+ */
+declare const GATE_DENIAL: unique symbol;
+/** True when `reason` is branded as a pillar gate DENIAL (not a runtime failure). */
+declare function isGateDenial(reason: unknown): boolean;
+/**
+ * Mint a gate-denial error. Used by the surface for an unmet gate that does NOT
+ * surface as a pillar `*GateError` — e.g. deps with network off (no packument
+ * fetcher) or flake with no history DB configured. Both must read as
+ * `skipReason:'gate-not-set'`, never `errored` (ADR 0013 Addendum § execution).
+ */
+declare function gateDenied(message: string): Error;
+//#endregion
+//#region src/orchestrate.d.ts
+/**
+ * Per-pillar run request. Each present pillar carries an async `run` thunk that
+ * produces that pillar's NATIVE result — the orchestrator maps it via the existing
+ * `@sackville-mcp/verdict` `from*` adapter. The thunk is wired by the surface (bin/CLI)
+ * to the pillar's own gated runner, so `@sackville-mcp/verify` itself imports zero
+ * spawn-capable engine code (§ gate (e)). A rejection branded as a gate denial maps
+ * to `skipReason:'gate-not-set'`; any other rejection to a redacted `errorReason`.
+ */
+interface OrchestrateRequest {
+  /** The contract thunk returns EITHER the bare results (compose path — folded by
+   * `fromContractResults`) OR the FULL capture verdict facts (consume / produce paths —
+   * folded by `fromCaptureVerdict` so a not-`clean` capture is inconclusive, never a pass;
+   * 5f, ADR 0013 Addendum 4). */
+  contract?: {
+    run: () => Promise<ContractResult[] | CaptureVerdictFacts>;
+    source?: 'run' | 'capture-from-HAR';
+  };
+  coverage?: {
+    run: () => Promise<DiffCoverageReport>;
+  };
+  deps?: {
+    run: () => Promise<{
+      audits: DependencyAudit[];
+      osvSnapshotLoaded: boolean;
+    }>;
+  };
+  flake?: {
+    run: () => Promise<FlakeVerdict[]>;
+  };
+  mutate?: {
+    run: () => Promise<MutationSummary>;
+  };
+}
+interface OrchestrateOptions {
+  /** The policy cut threaded straight through to `composeVerdict` (no default). */
+  policy?: VerdictPolicy;
+  /** Mint the verdict id (default `randomUUID`); tests inject a deterministic stub. */
+  idFactory?: () => string;
+  /** Redact a string before it enters the verdict (default identity). */
+  redact?: (value: string) => string;
+}
+interface OrchestrateResult {
+  /** The id under which the surface stores the full verdict by handle. */
+  id: string;
+  verdict: CompositeVerdict;
+}
+/**
+ * Drive the requested pillars and fold them into one `CompositeVerdict` (ADR 0013
+ * Addendum, milestone 5c). Each requested pillar's `run` thunk is invoked
+ * concurrently; each task catches its own rejection (the per-pillar failure
+ * isolation `Promise.allSettled` gives) so one pillar's crash/timeout never sinks the
+ * verdict. A fulfilled run is mapped through the existing `from*` adapter; a rejected
+ * run becomes a `no-signal` contributor: a branded gate denial ⇒
+ * `skipReason:'gate-not-set'` (never run), any other crash ⇒ a **redacted**
+ * `errorReason`. Pillars not in the request are folded as `missing`. "Absence is
+ * never a pass" therefore holds for skipped/errored/missing pillars for free (all
+ * fold to `inconclusive`).
+ *
+ * Pure orchestration: the `run` thunks (wired by the surface to each pillar's own
+ * gated runner) are the only side-effecting code; this module imports no engine
+ * runtime — gate denials are recognized structurally via the global-symbol brand.
+ */
+declare function orchestrate(request: OrchestrateRequest, options?: OrchestrateOptions): Promise<OrchestrateResult>;
+//#endregion
+export { GATE_DENIAL, type OrchestrateOptions, type OrchestrateRequest, type OrchestrateResult, gateDenied, isGateDenial, orchestrate };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/gate.ts","../src/orchestrate.ts"],"mappings":";;;;;;;;;;;;;;;;AAgBA;;;;AAA6E;AAG7E;;;cAHa,WAAA;AAG+B;AAAA,iBAA5B,YAAA,CAAa,MAAe;;;;AAcM;;;iBAAlC,UAAA,CAAW,OAAA,WAAkB,KAAK;;;;;AAjBlD;;;;AAA6E;AAG7E;UCYiB,kBAAA;;;ADZ2B;AAc5C;ECGE,QAAA;IACE,GAAA,QAAW,OAAA,CAAQ,cAAA,KAAmB,mBAAA;IACtC,MAAA;EAAA;EAEF,QAAA;IAAa,GAAA,QAAW,OAAA,CAAQ,kBAAA;EAAA;EAChC,IAAA;IAAS,GAAA,QAAW,OAAA;MAAU,MAAA,EAAQ,eAAA;MAAmB,iBAAA;IAAA;EAAA;EACzD,KAAA;IAAU,GAAA,QAAW,OAAA,CAAQ,YAAA;EAAA;EAC7B,MAAA;IAAW,GAAA,QAAW,OAAA,CAAQ,eAAA;EAAA;AAAA;AAAA,UAGf,kBAAA;EAHc;EAK7B,MAAA,GAAS,aAAa;EAZtB;EAcA,SAAA;EAba;EAeb,MAAA,IAAU,KAAA;AAAA;AAAA,UAGK,iBAAA;EAff;EAiBA,EAAA;EACA,OAAA,EAAS,gBAAgB;AAAA;;;;;;;;;;;;;;;;AAfoB;iBAkCzB,WAAA,CACpB,OAAA,EAAS,kBAAA,EACT,OAAA,GAAS,kBAAA,GACR,OAAA,CAAQ,iBAAA"}

package/dist/index.mjs

@@ -0,0 +1,121 @@
+import { randomUUID } from "node:crypto";
+import { composeVerdict, fromCaptureVerdict, fromContractResults, fromDependencyAudits, fromDiffCoverage, fromFlakeVerdicts, fromMutationSummary } from "@sackville-mcp/verdict";
+//#region src/gate.ts
+/**
+* The gate-denial brand (ADR 0013 Addendum, milestone 5c — "compose, never widen").
+*
+* A run-driving pillar can reject for two very different reasons: its **own**
+* operator gate denied the run (the pillar was never executed — `skipReason:
+* 'gate-not-set'`), or it ran and **crashed** (`errorReason`). The orchestrator must
+* tell them apart, but it must NOT import any engine runtime to do so (the
+* spawn-free invariant, § gate (e)). So the contract is a structural brand carried
+* on the error itself, keyed by a GLOBAL symbol — `Symbol.for(...)` resolves to the
+* same symbol in every package WITHOUT a shared import, so each pillar's own
+* `*GateError` (and the surface's no-fetcher / no-DB checks) can set it and the
+* orchestrator can read it with zero coupling.
+*
+* This reuses each pillar's REAL gate decision (`assertAllowed`) — there is no
+* reimplemented gate predicate here to drift out of sync.
+*/
+const GATE_DENIAL = Symbol.for("sackville.gate-denial");
+/** True when `reason` is branded as a pillar gate DENIAL (not a runtime failure). */
+function isGateDenial(reason) {
+	return typeof reason === "object" && reason !== null && reason[GATE_DENIAL] === true;
+}
+/**
+* Mint a gate-denial error. Used by the surface for an unmet gate that does NOT
+* surface as a pillar `*GateError` — e.g. deps with network off (no packument
+* fetcher) or flake with no history DB configured. Both must read as
+* `skipReason:'gate-not-set'`, never `errored` (ADR 0013 Addendum § execution).
+*/
+function gateDenied(message) {
+	const err = new Error(message);
+	err[GATE_DENIAL] = true;
+	return err;
+}
+//#endregion
+//#region src/orchestrate.ts
+/**
+* Drive the requested pillars and fold them into one `CompositeVerdict` (ADR 0013
+* Addendum, milestone 5c). Each requested pillar's `run` thunk is invoked
+* concurrently; each task catches its own rejection (the per-pillar failure
+* isolation `Promise.allSettled` gives) so one pillar's crash/timeout never sinks the
+* verdict. A fulfilled run is mapped through the existing `from*` adapter; a rejected
+* run becomes a `no-signal` contributor: a branded gate denial ⇒
+* `skipReason:'gate-not-set'` (never run), any other crash ⇒ a **redacted**
+* `errorReason`. Pillars not in the request are folded as `missing`. "Absence is
+* never a pass" therefore holds for skipped/errored/missing pillars for free (all
+* fold to `inconclusive`).
+*
+* Pure orchestration: the `run` thunks (wired by the surface to each pillar's own
+* gated runner) are the only side-effecting code; this module imports no engine
+* runtime — gate denials are recognized structurally via the global-symbol brand.
+*/
+async function orchestrate(request, options = {}) {
+	const idFactory = options.idFactory ?? randomUUID;
+	const redact = options.redact ?? ((value) => value);
+	const tasks = [];
+	const add = (pillar, produce) => {
+		tasks.push(produce().then((verdict) => ({
+			pillar,
+			verdict
+		})).catch((reason) => ({
+			pillar,
+			verdict: rejectionToPillar(pillar, reason, redact)
+		})));
+	};
+	if (request.contract) {
+		const { run, source } = request.contract;
+		add("contract", () => run().then((r) => Array.isArray(r) ? fromContractResults(r, source) : fromCaptureVerdict(r, source)));
+	}
+	if (request.coverage) {
+		const { run } = request.coverage;
+		add("coverage", () => run().then(fromDiffCoverage));
+	}
+	if (request.deps) {
+		const { run } = request.deps;
+		add("deps", () => run().then((r) => fromDependencyAudits(r.audits, { osvSnapshotLoaded: r.osvSnapshotLoaded })));
+	}
+	if (request.flake) {
+		const { run } = request.flake;
+		add("flake", () => run().then(fromFlakeVerdicts));
+	}
+	if (request.mutate) {
+		const { run } = request.mutate;
+		add("mutate", () => run().then(fromMutationSummary));
+	}
+	const inputs = {};
+	for (const { pillar, verdict } of await Promise.all(tasks)) inputs[pillar] = verdict;
+	return {
+		id: idFactory(),
+		verdict: composeVerdict(inputs, options.policy)
+	};
+}
+/**
+* Map a rejected pillar run to its `no-signal` contributor — never a pass (ADR 0013
+* Addendum, milestone 5c). "Compose, never widen": a rejection BRANDED as a gate
+* denial (the pillar's own `assertAllowed`, or the surface's no-fetcher/no-DB check)
+* becomes `skipReason:'gate-not-set'` — the pillar was never run, surfaced, and its
+* raw message is dropped (a skip needs no detail and must not leak a path). Any other
+* rejection is a genuine crash ⇒ `errorReason`, with the message **redacted**.
+*/
+function rejectionToPillar(pillar, reason, redact) {
+	if (isGateDenial(reason)) return {
+		pillar,
+		status: "no-signal",
+		severity: "none",
+		headline: `${pillar} gate not set — pillar not run`,
+		skipReason: "gate-not-set"
+	};
+	return {
+		pillar,
+		status: "no-signal",
+		severity: "none",
+		headline: "pillar run failed",
+		errorReason: redact(reason instanceof Error ? reason.message : String(reason))
+	};
+}
+//#endregion
+export { GATE_DENIAL, gateDenied, isGateDenial, orchestrate };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/gate.ts","../src/orchestrate.ts"],"sourcesContent":["/**\n * The gate-denial brand (ADR 0013 Addendum, milestone 5c — \"compose, never widen\").\n *\n * A run-driving pillar can reject for two very different reasons: its **own**\n * operator gate denied the run (the pillar was never executed — `skipReason:\n * 'gate-not-set'`), or it ran and **crashed** (`errorReason`). The orchestrator must\n * tell them apart, but it must NOT import any engine runtime to do so (the\n * spawn-free invariant, § gate (e)). So the contract is a structural brand carried\n * on the error itself, keyed by a GLOBAL symbol — `Symbol.for(...)` resolves to the\n * same symbol in every package WITHOUT a shared import, so each pillar's own\n * `*GateError` (and the surface's no-fetcher / no-DB checks) can set it and the\n * orchestrator can read it with zero coupling.\n *\n * This reuses each pillar's REAL gate decision (`assertAllowed`) — there is no\n * reimplemented gate predicate here to drift out of sync.\n */\nexport const GATE_DENIAL: unique symbol = Symbol.for('sackville.gate-denial')\n\n/** True when `reason` is branded as a pillar gate DENIAL (not a runtime failure). */\nexport function isGateDenial(reason: unknown): boolean {\n  return (\n    typeof reason === 'object' &&\n    reason !== null &&\n    (reason as Record<symbol, unknown>)[GATE_DENIAL] === true\n  )\n}\n\n/**\n * Mint a gate-denial error. Used by the surface for an unmet gate that does NOT\n * surface as a pillar `*GateError` — e.g. deps with network off (no packument\n * fetcher) or flake with no history DB configured. Both must read as\n * `skipReason:'gate-not-set'`, never `errored` (ADR 0013 Addendum § execution).\n */\nexport function gateDenied(message: string): Error {\n  const err = new Error(message)\n  ;(err as unknown as Record<symbol, unknown>)[GATE_DENIAL] = true\n  return err\n}\n","import { randomUUID } from 'node:crypto'\nimport type { ContractResult } from '@sackville-mcp/api'\nimport type { DiffCoverageReport } from '@sackville-mcp/coverage'\nimport type { DependencyAudit } from '@sackville-mcp/deps'\nimport type { FlakeVerdict } from '@sackville-mcp/flake'\nimport type { MutationSummary } from '@sackville-mcp/mutate'\nimport {\n  type CaptureVerdictFacts,\n  type ComposeInputs,\n  type CompositeVerdict,\n  composeVerdict,\n  fromCaptureVerdict,\n  fromContractResults,\n  fromDependencyAudits,\n  fromDiffCoverage,\n  fromFlakeVerdicts,\n  fromMutationSummary,\n  type PillarName,\n  type PillarVerdict,\n  type VerdictPolicy,\n} from '@sackville-mcp/verdict'\nimport { isGateDenial } from './gate.js'\n\n/**\n * Per-pillar run request. Each present pillar carries an async `run` thunk that\n * produces that pillar's NATIVE result — the orchestrator maps it via the existing\n * `@sackville-mcp/verdict` `from*` adapter. The thunk is wired by the surface (bin/CLI)\n * to the pillar's own gated runner, so `@sackville-mcp/verify` itself imports zero\n * spawn-capable engine code (§ gate (e)). A rejection branded as a gate denial maps\n * to `skipReason:'gate-not-set'`; any other rejection to a redacted `errorReason`.\n */\nexport interface OrchestrateRequest {\n  /** The contract thunk returns EITHER the bare results (compose path — folded by\n   * `fromContractResults`) OR the FULL capture verdict facts (consume / produce paths —\n   * folded by `fromCaptureVerdict` so a not-`clean` capture is inconclusive, never a pass;\n   * 5f, ADR 0013 Addendum 4). */\n  contract?: {\n    run: () => Promise<ContractResult[] | CaptureVerdictFacts>\n    source?: 'run' | 'capture-from-HAR'\n  }\n  coverage?: { run: () => Promise<DiffCoverageReport> }\n  deps?: { run: () => Promise<{ audits: DependencyAudit[]; osvSnapshotLoaded: boolean }> }\n  flake?: { run: () => Promise<FlakeVerdict[]> }\n  mutate?: { run: () => Promise<MutationSummary> }\n}\n\nexport interface OrchestrateOptions {\n  /** The policy cut threaded straight through to `composeVerdict` (no default). */\n  policy?: VerdictPolicy\n  /** Mint the verdict id (default `randomUUID`); tests inject a deterministic stub. */\n  idFactory?: () => string\n  /** Redact a string before it enters the verdict (default identity). */\n  redact?: (value: string) => string\n}\n\nexport interface OrchestrateResult {\n  /** The id under which the surface stores the full verdict by handle. */\n  id: string\n  verdict: CompositeVerdict\n}\n\n/**\n * Drive the requested pillars and fold them into one `CompositeVerdict` (ADR 0013\n * Addendum, milestone 5c). Each requested pillar's `run` thunk is invoked\n * concurrently; each task catches its own rejection (the per-pillar failure\n * isolation `Promise.allSettled` gives) so one pillar's crash/timeout never sinks the\n * verdict. A fulfilled run is mapped through the existing `from*` adapter; a rejected\n * run becomes a `no-signal` contributor: a branded gate denial ⇒\n * `skipReason:'gate-not-set'` (never run), any other crash ⇒ a **redacted**\n * `errorReason`. Pillars not in the request are folded as `missing`. \"Absence is\n * never a pass\" therefore holds for skipped/errored/missing pillars for free (all\n * fold to `inconclusive`).\n *\n * Pure orchestration: the `run` thunks (wired by the surface to each pillar's own\n * gated runner) are the only side-effecting code; this module imports no engine\n * runtime — gate denials are recognized structurally via the global-symbol brand.\n */\nexport async function orchestrate(\n  request: OrchestrateRequest,\n  options: OrchestrateOptions = {},\n): Promise<OrchestrateResult> {\n  const idFactory = options.idFactory ?? randomUUID\n  const redact = options.redact ?? ((value: string) => value)\n\n  // One labelled task per requested pillar, each composing the pillar's native\n  // `run` thunk with its `from*` adapter. Each task catches its OWN rejection and\n  // resolves to a skipped (gate-denied) or errored contributor — so the concurrent\n  // `Promise.all` never rejects (the same per-pillar failure isolation\n  // `Promise.allSettled` gives), while the pillar label rides along with each result.\n  const tasks: Array<Promise<{ pillar: PillarName; verdict: PillarVerdict }>> = []\n  const add = (pillar: PillarName, produce: () => Promise<PillarVerdict>): void => {\n    tasks.push(\n      produce()\n        .then((verdict) => ({ pillar, verdict }))\n        .catch((reason: unknown) => ({\n          pillar,\n          verdict: rejectionToPillar(pillar, reason, redact),\n        })),\n    )\n  }\n\n  if (request.contract) {\n    const { run, source } = request.contract\n    add('contract', () =>\n      run().then((r) =>\n        Array.isArray(r) ? fromContractResults(r, source) : fromCaptureVerdict(r, source),\n      ),\n    )\n  }\n  if (request.coverage) {\n    const { run } = request.coverage\n    add('coverage', () => run().then(fromDiffCoverage))\n  }\n  if (request.deps) {\n    const { run } = request.deps\n    add('deps', () =>\n      run().then((r) => fromDependencyAudits(r.audits, { osvSnapshotLoaded: r.osvSnapshotLoaded })),\n    )\n  }\n  if (request.flake) {\n    const { run } = request.flake\n    add('flake', () => run().then(fromFlakeVerdicts))\n  }\n  if (request.mutate) {\n    const { run } = request.mutate\n    add('mutate', () => run().then(fromMutationSummary))\n  }\n\n  const inputs: ComposeInputs = {}\n  for (const { pillar, verdict } of await Promise.all(tasks)) {\n    inputs[pillar] = verdict\n  }\n\n  return { id: idFactory(), verdict: composeVerdict(inputs, options.policy) }\n}\n\n/**\n * Map a rejected pillar run to its `no-signal` contributor — never a pass (ADR 0013\n * Addendum, milestone 5c). \"Compose, never widen\": a rejection BRANDED as a gate\n * denial (the pillar's own `assertAllowed`, or the surface's no-fetcher/no-DB check)\n * becomes `skipReason:'gate-not-set'` — the pillar was never run, surfaced, and its\n * raw message is dropped (a skip needs no detail and must not leak a path). Any other\n * rejection is a genuine crash ⇒ `errorReason`, with the message **redacted**.\n */\nfunction rejectionToPillar(\n  pillar: PillarName,\n  reason: unknown,\n  redact: (value: string) => string,\n): PillarVerdict {\n  if (isGateDenial(reason)) {\n    return {\n      pillar,\n      status: 'no-signal',\n      severity: 'none',\n      headline: `${pillar} gate not set — pillar not run`,\n      skipReason: 'gate-not-set',\n    }\n  }\n  const message = reason instanceof Error ? reason.message : String(reason)\n  return {\n    pillar,\n    status: 'no-signal',\n    severity: 'none',\n    headline: 'pillar run failed',\n    errorReason: redact(message),\n  }\n}\n\nexport type { PillarName, PillarVerdict }\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgBA,MAAa,cAA6B,OAAO,IAAI,uBAAuB;;AAG5E,SAAgB,aAAa,QAA0B;CACrD,OACE,OAAO,WAAW,YAClB,WAAW,QACV,OAAmC,iBAAiB;AAEzD;;;;;;;AAQA,SAAgB,WAAW,SAAwB;CACjD,MAAM,MAAM,IAAI,MAAM,OAAO;CAC5B,IAA4C,eAAe;CAC5D,OAAO;AACT;;;;;;;;;;;;;;;;;;;ACwCA,eAAsB,YACpB,SACA,UAA8B,CAAC,GACH;CAC5B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,SAAS,QAAQ,YAAY,UAAkB;CAOrD,MAAM,QAAwE,CAAC;CAC/E,MAAM,OAAO,QAAoB,YAAgD;EAC/E,MAAM,KACJ,QAAQ,EACL,MAAM,aAAa;GAAE;GAAQ;EAAQ,EAAE,EACvC,OAAO,YAAqB;GAC3B;GACA,SAAS,kBAAkB,QAAQ,QAAQ,MAAM;EACnD,EAAE,CACN;CACF;CAEA,IAAI,QAAQ,UAAU;EACpB,MAAM,EAAE,KAAK,WAAW,QAAQ;EAChC,IAAI,kBACF,IAAI,EAAE,MAAM,MACV,MAAM,QAAQ,CAAC,IAAI,oBAAoB,GAAG,MAAM,IAAI,mBAAmB,GAAG,MAAM,CAClF,CACF;CACF;CACA,IAAI,QAAQ,UAAU;EACpB,MAAM,EAAE,QAAQ,QAAQ;EACxB,IAAI,kBAAkB,IAAI,EAAE,KAAK,gBAAgB,CAAC;CACpD;CACA,IAAI,QAAQ,MAAM;EAChB,MAAM,EAAE,QAAQ,QAAQ;EACxB,IAAI,cACF,IAAI,EAAE,MAAM,MAAM,qBAAqB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAC9F;CACF;CACA,IAAI,QAAQ,OAAO;EACjB,MAAM,EAAE,QAAQ,QAAQ;EACxB,IAAI,eAAe,IAAI,EAAE,KAAK,iBAAiB,CAAC;CAClD;CACA,IAAI,QAAQ,QAAQ;EAClB,MAAM,EAAE,QAAQ,QAAQ;EACxB,IAAI,gBAAgB,IAAI,EAAE,KAAK,mBAAmB,CAAC;CACrD;CAEA,MAAM,SAAwB,CAAC;CAC/B,KAAK,MAAM,EAAE,QAAQ,aAAa,MAAM,QAAQ,IAAI,KAAK,GACvD,OAAO,UAAU;CAGnB,OAAO;EAAE,IAAI,UAAU;EAAG,SAAS,eAAe,QAAQ,QAAQ,MAAM;CAAE;AAC5E;;;;;;;;;AAUA,SAAS,kBACP,QACA,QACA,QACe;CACf,IAAI,aAAa,MAAM,GACrB,OAAO;EACL;EACA,QAAQ;EACR,UAAU;EACV,UAAU,GAAG,OAAO;EACpB,YAAY;CACd;CAGF,OAAO;EACL;EACA,QAAQ;EACR,UAAU;EACV,UAAU;EACV,aAAa,OANC,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,CAM3C;CAC7B;AACF"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@sackville-mcp/verify",
+  "version": "0.0.1-alpha.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      }
+    }
+  },
+  "main": "./dist/index.mjs",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@sackville-mcp/verdict": "0.0.1-alpha.0"
+  },
+  "devDependencies": {
+    "@sackville-mcp/api": "0.0.1-alpha.0",
+    "@sackville-mcp/coverage": "0.0.1-alpha.0",
+    "@sackville-mcp/deps": "0.0.1-alpha.0",
+    "@sackville-mcp/flake": "0.0.1-alpha.0",
+    "@sackville-mcp/mutate": "0.0.1-alpha.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ceautery/sackville.git",
+    "directory": "packages/verify"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit"
+  }
+}