@stage5/lumine 0.2.40 → 0.2.42

package/lib/admin.js

@@ -1,12 +1,28 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { assertAuthScope, resolveAuth } from "./auth.js";
 import { requestJson } from "./http.js";
+import {
+  extractNewsClaim,
+  readAdminJsonFile,
+  validateNewsEditorial,
+  writeNewsClaimArtifacts,
+} from "./admin-news.js";
+import {
+  runAutomaticPagination,
+  runBatchSkips,
+} from "./admin-workflows.js";
+import {
+  parseBuildReviewReceipt,
+  runManagedBuildReview,
+} from "./build-review.js";
 
 const MAX_EDITORIAL_FILE_BYTES = 256 * 1024;
 const MAX_COMPOSED_TEXT_FILE_BYTES = 64 * 1024;
 const MAX_COMPOSED_TEXT_LENGTH = 10_000;
 const MAX_NOTABLE_NOTE_LENGTH = 2_000;
+const MAX_IDENTITY_INSPECTION_REASON_LENGTH = 500;
+const MAX_ESCALATION_DECISION_NOTE_LENGTH = 2_000;
 
 // Operator-composed persona text (plain UTF-8, not JSON). The agent writes
 // the content in the bot's persona itself; the server never invokes
@@ -64,6 +80,19 @@ function readEditorialFile(filePath) {
 
 export async function adminCommand(options) {
   const operation = parseAdminOperation(options);
+  if (operation.name === "news.validate") {
+    const validation = validateNewsEditorial({
+      claim: operation.claim,
+      editorial: operation.editorial,
+    });
+    const result = {
+      ok: true,
+      status: "success",
+      changed: false,
+      data: { validation },
+    };
+    return finishAdminOutput({ options, operation, result });
+  }
   const viewFilter = resolveOperatorViewFilter({
     operation,
     unviewed: options.adminUnviewed,
@@ -112,34 +141,76 @@ export async function adminCommand(options) {
     options.idempotencyKey || (operation.mutates ? `cli:${randomUUID()}` : "");
   let result;
   try {
-    result = await requestJson({
-      method: operation.method,
-      url: `${options.apiUrl}${operation.path}`,
-      authToken: auth.token,
-      body: operation.body,
-      headers: {
-        ...(runId ? { "x-lumine-admin-run-id": String(runId) } : {}),
-        ...(requestId ? { "x-lumine-idempotency-key": requestId } : {}),
-      },
-      timeoutMs: options.timeoutMs,
-    });
-    if (operation.name === "builds.candidates") {
-      result = normalizeAdminBuildCandidatesResult({
-        result,
-        siteUrl: options.siteUrl,
+    const fetchOperation = async (requestPath = operation.path) =>
+      requestJson({
+        method: operation.method,
+        url: `${options.apiUrl}${requestPath}`,
+        authToken: auth.token,
+        body: operation.body,
+        headers: {
+          ...(runId ? { "x-lumine-admin-run-id": String(runId) } : {}),
+          ...(requestId ? { "x-lumine-idempotency-key": requestId } : {}),
+        },
+        timeoutMs: options.timeoutMs,
       });
-    }
-    if (recommendationContentTypes) {
-      result = filterRecommendationQueueResult({
-        result,
-        contentTypes: recommendationContentTypes,
+    const transformResult = (rawResult) =>
+      transformAdminResult({
+        operation,
+        result: rawResult,
+        options,
+        recommendationContentTypes,
+        viewFilter,
       });
-    }
-    if (viewFilter) {
-      result = filterListResultByOperatorView({ result, viewFilter });
+    if (operation.name === "build.review") {
+      result = await runManagedBuildReview({
+        options,
+        authToken: auth.token,
+        buildId: operation.buildId,
+      });
+    } else if (operation.name === "post.skip-batch") {
+      result = await runBatchSkips({
+        options,
+        authToken: auth.token,
+        runId,
+        parseTarget: parseRecommendationTarget,
+      });
+    } else if (options.adminAll) {
+      if (options.adminCursor) {
+        throw cliValidationError(
+          "Use --resume with the scan checkpoint instead of combining --all with --cursor.",
+        );
+      }
+      result = await runAutomaticPagination({
+        options,
+        operation,
+        runId,
+        fetchPage: fetchOperation,
+        transformPage: transformResult,
+        recordCoverage: async (coverage) =>
+          requestJson({
+            method: "POST",
+            url: `${options.apiUrl}/cli/admin/daily-runs/coverage`,
+            authToken: auth.token,
+            body: coverage,
+            headers: {
+              "x-lumine-admin-run-id": String(runId),
+              "x-lumine-idempotency-key": `cli:queue-coverage:${runId}:${adminValueFingerprint(coverage).slice(0, 32)}`,
+            },
+            timeoutMs: options.timeoutMs,
+          }),
+      });
+    } else {
+      if (options.adminResume) {
+        throw cliValidationError("--resume requires --all or post skip-batch.");
+      }
+      result = transformResult(await fetchOperation());
     }
   } catch (error) {
-    if (operation.mutates && requestId) {
+    if (
+      operation.mutates &&
+      requestId &&
+      operation.name !== "post.skip-batch"
+    ) {
       const retryInstruction = `Retry with --idempotency-key ${requestId}.`;
       error.data = error.data || {
         ok: false,
@@ -175,6 +246,81 @@ export async function adminCommand(options) {
       expectedContent: operation.body.content,
     });
   }
+  if (operation.name === "news.claim") {
+    const artifacts = writeNewsClaimArtifacts({
+      result,
+      outputPath: options.adminOutput,
+      scaffoldPath: options.adminScaffoldFile,
+    });
+    result = {
+      ...result,
+      data: { ...(result.data || {}), artifacts },
+    };
+  }
+  return finishAdminOutput({ options, operation, result });
+}
+
+function transformAdminResult({
+  operation,
+  result,
+  options,
+  recommendationContentTypes,
+  viewFilter,
+}) {
+  let transformed = result;
+  if (operation.name === "recommendations.list") {
+    assertRecommendationWindowResult({ operation, result: transformed });
+  }
+  if (operation.name === "builds.candidates") {
+    transformed = normalizeAdminBuildCandidatesResult({
+      result: transformed,
+      siteUrl: options.siteUrl,
+    });
+  }
+  if (recommendationContentTypes) {
+    transformed = filterRecommendationQueueResult({
+      result: transformed,
+      contentTypes: recommendationContentTypes,
+    });
+  }
+  if (viewFilter) {
+    transformed = filterListResultByOperatorView({
+      result: transformed,
+      viewFilter,
+    });
+  }
+  return transformed;
+}
+
+export function assertRecommendationWindowResult({ operation, result }) {
+  const mode = operation?.pagination?.coverageMode;
+  if (!mode || mode === "legacy") return;
+  const after = result?.data?.pagination?.after;
+  const snapshotTimeStamp = result?.data?.pagination?.snapshotTimeStamp;
+  if (
+    !Number.isSafeInteger(after) ||
+    after < 0 ||
+    !Number.isSafeInteger(snapshotTimeStamp) ||
+    snapshotTimeStamp < 0
+  ) {
+    const error = new Error(
+      "The deployed API did not confirm the bounded recommendation window and snapshot. Deploy the matching API before using this CLI; use --include-legacy only for an intentional historical scan.",
+    );
+    error.code = "LUMINE_ADMIN_RECOMMENDATION_WINDOW_UNSUPPORTED";
+    error.data = {
+      ok: false,
+      status: "validation_error",
+      error: {
+        code: error.code,
+        message: error.message,
+        details: { requestedMode: mode },
+      },
+    };
+    throw error;
+  }
+}
+
+function finishAdminOutput({ options, operation, result }) {
   if (options.json) {
     console.log(JSON.stringify(result));
     return result;
@@ -354,8 +500,12 @@ function adminOperationRequiresRun(operation) {
       "identity.list",
       "identity.status",
       "identity.use",
+      "identity.inspect",
       "daily-run.start",
       "daily-run.status",
+      "escalation.list",
+      "escalation.set",
+      "notable.add",
     ].includes(operation.name) && !operation.name.startsWith("ai-bucket.")
   );
 }
@@ -396,6 +546,35 @@ export function parseAdminOperation(options) {
         { identity: parseIdentity(target) },
       );
     }
+    if (action === "inspect") {
+      const inspectionTarget = String(target || "").trim();
+      const reason = String(options.adminReason || "").trim();
+      if (!inspectionTarget) {
+        throw cliValidationError(
+          "Usage: lumine admin identity inspect <userId|username> --reason <management reason> [--include-private-evidence].",
+        );
+      }
+      if (!reason) {
+        throw cliValidationError(
+          "Explain why private identity evidence is needed with --reason <management reason>.",
+        );
+      }
+      if (reason.length > MAX_IDENTITY_INSPECTION_REASON_LENGTH) {
+        throw cliValidationError(
+          `An identity-inspection reason must be at most ${MAX_IDENTITY_INSPECTION_REASON_LENGTH} characters.`,
+        );
+      }
+      return writeOperation(
+        "identity.inspect",
+        "POST",
+        "/cli/admin/identity/inspect",
+        {
+          target: inspectionTarget,
+          reason,
+          includePrivateEvidence: options.adminIncludePrivateEvidence === true,
+        },
+      );
+    }
   }
 
   if (namespace === "ai-bucket" || namespace === "ai-buckets") {
@@ -460,6 +639,31 @@ export function parseAdminOperation(options) {
     if (action === "status") {
       return readOperation("daily-run.status", "/cli/admin/daily-runs/status");
     }
+    if (action === "report") {
+      return readOperation("daily-run.report", "/cli/admin/daily-runs/report");
+    }
+    if (action === "escalation" && target === "add") {
+      const rawTarget = String(options.adminTarget || "").trim();
+      const summary = String(options.note || "").trim();
+      if (!rawTarget || !summary) {
+        throw cliValidationError(
+          "Pass a concrete --target and --note when recording a run escalation.",
+        );
+      }
+      const parsedTarget = parseAdminEscalationTarget(rawTarget);
+      return writeOperation(
+        "daily-run.escalation.add",
+        "POST",
+        "/cli/admin/daily-runs/escalations",
+        {
+          targetType: parsedTarget.targetType || undefined,
+          targetId: parsedTarget.targetId || undefined,
+          url: parsedTarget.url || undefined,
+          summary,
+          severity: options.adminSeverity || "attention",
+        },
+      );
+    }
     if (action === "complete" || action === "fail") {
       return writeOperation(
         `daily-run.${action}`,
@@ -470,6 +674,47 @@ export function parseAdminOperation(options) {
     }
   }
 
+  if (namespace === "escalation" || namespace === "escalations") {
+    if (!action || action === "list") {
+      const status = parseEscalationListStatus(options.adminStatus || "open");
+      return readOperation(
+        "escalation.list",
+        withQuery("/cli/admin/escalations", {
+          status,
+          limit: options.limit,
+        }),
+      );
+    }
+    if (action === "set") {
+      const escalationAuditId = parseRequiredInteger(
+        target,
+        "Escalation audit ID",
+        1,
+      );
+      const status = parseEscalationStatus(options.adminStatus);
+      const note = String(options.note || "").trim();
+      if (!note) {
+        throw cliValidationError(
+          "Record the decision or next step with --note <text>.",
+        );
+      }
+      if (note.length > MAX_ESCALATION_DECISION_NOTE_LENGTH) {
+        throw cliValidationError(
+          `An escalation decision note must be at most ${MAX_ESCALATION_DECISION_NOTE_LENGTH} characters.`,
+        );
+      }
+      return writeOperation(
+        "escalation.set",
+        "PUT",
+        `/cli/admin/escalations/${escalationAuditId}`,
+        { status, note },
+      );
+    }
+    throw cliValidationError(
+      "Usage: lumine admin escalation list [--status open|acknowledged|resolved|all] | escalation set <auditId> --status <status> --note <decision>.",
+    );
+  }
+
   if (
     (namespace === "recommend-queue" && (!action || action === "list")) ||
     (namespace === "recommendations" && action === "list")
@@ -478,6 +723,7 @@ export function parseAdminOperation(options) {
     if (kind !== "recommend") {
       throw cliValidationError("--kind currently supports only recommend.");
     }
+    const recommendationWindow = parseRecommendationWindow(options);
     return readOperation(
       "recommendations.list",
       withQuery("/cli/admin/recommendations", {
@@ -485,7 +731,33 @@ export function parseAdminOperation(options) {
         contentTypes: options.adminContentTypes,
         cursor: options.adminCursor,
         limit: options.limit,
+        sinceRun: recommendationWindow.mode === "since-run" ? "true" : "",
+        after:
+          recommendationWindow.mode === "after"
+            ? recommendationWindow.after
+            : "",
+        includeLegacy:
+          recommendationWindow.mode === "legacy" ? "true" : "",
       }),
+      {
+        pagination: {
+          collectionKey: "items",
+          coverageQueue: "recommendations",
+          coverageMode: recommendationWindow.mode,
+          after:
+            recommendationWindow.mode === "after"
+              ? parseAfterForCoverage(recommendationWindow.after)
+              : null,
+          filters: {
+            contentTypes: options.adminContentTypes || null,
+            operatorView: options.adminUnviewed
+              ? "unviewed"
+              : options.adminViewed
+                ? "viewed"
+                : null,
+          },
+        },
+      },
     );
   }
 
@@ -498,8 +770,33 @@ export function parseAdminOperation(options) {
         cursor: options.adminCursor,
         limit: options.limit,
       }),
+      {
+        pagination: {
+          collectionKey: "builds",
+          coverageQueue: "builds",
+          coverageMode: "all",
+          after: null,
+          filters: { sort: "recent", scope: "all" },
+        },
+      },
     );
   }
+  if (namespace === "builds" && action === "review") {
+    const parsed = parseAdminCommentTarget({ target, explicitType: "build" });
+    if (parsed.type !== "build") {
+      throw cliValidationError(
+        "Build review targets a Build URL or build:<id>.",
+      );
+    }
+    return {
+      name: "build.review",
+      method: "GET",
+      path: "",
+      body: undefined,
+      mutates: false,
+      buildId: parsed.id,
+    };
+  }
 
   if (
     namespace === "subjects" &&
@@ -524,6 +821,7 @@ export function parseAdminOperation(options) {
           cursor: options.adminCursor,
           limit: options.limit,
         }),
+        { pagination: { collectionKey: "comments" } },
       );
     }
     if (action === "reveal") {
@@ -591,6 +889,7 @@ export function parseAdminOperation(options) {
           cursor: options.adminCursor,
           limit: options.limit,
         }),
+        { pagination: { collectionKey: "comments" } },
       );
     }
     if (action === "recommend") {
@@ -613,6 +912,20 @@ export function parseAdminOperation(options) {
         { reason: options.adminReason || undefined },
       );
     }
+    if (action === "skip-batch") {
+      if (!options.adminTargetFile) {
+        throw cliValidationError(
+          "Pass batch skip targets with --target-file <file>.",
+        );
+      }
+      return {
+        name: "post.skip-batch",
+        method: "POST",
+        path: "",
+        body: undefined,
+        mutates: true,
+      };
+    }
     if (action === "reward") {
       const parsedTarget = parseRecommendationTarget({
         target,
@@ -653,22 +966,41 @@ export function parseAdminOperation(options) {
         ...(repairDate ? { date: repairDate } : {}),
       });
     }
-    if (action === "submit") {
-      const editionId = parseRequiredInteger(
-        options.adminEditionId,
-        "--edition-id",
-        1,
+    if (action === "validate") {
+      const claim = extractNewsClaim(
+        readAdminJsonFile(options.adminClaimFile, "--claim <claim.json>"),
       );
-      const leaseToken = String(options.adminLeaseToken || "").trim();
+      return {
+        name: "news.validate",
+        local: true,
+        mutates: false,
+        claim,
+        editorial: readEditorialFile(options.adminFile),
+      };
+    }
+    if (action === "submit") {
+      const claim = options.adminClaimFile
+        ? extractNewsClaim(
+            readAdminJsonFile(options.adminClaimFile, "--claim <claim.json>"),
+          )
+        : null;
+      const editionId = claim
+        ? claim.editionId
+        : parseRequiredInteger(options.adminEditionId, "--edition-id", 1);
+      const leaseToken = claim
+        ? claim.leaseToken
+        : String(options.adminLeaseToken || "").trim();
       if (!leaseToken) {
         throw cliValidationError(
           "Pass the claim's lease token with --lease-token <token>.",
         );
       }
+      const editorial = readEditorialFile(options.adminFile);
+      if (claim) validateNewsEditorial({ claim, editorial });
       return writeOperation("news.submit", "POST", "/cli/admin/news/submit", {
         editionId,
         leaseToken,
-        editorial: readEditorialFile(options.adminFile),
+        editorial,
         model: options.model || undefined,
       });
     }
@@ -776,6 +1108,7 @@ export function parseAdminOperation(options) {
         limit: options.limit,
         full: options.adminFull ? "true" : "",
       }),
+      { pagination: { collectionKey: "events" } },
     );
   }
 
@@ -800,20 +1133,46 @@ export function parseAdminOperation(options) {
       const buildReviewMethod = options.adminBuildReviewMethod
         ? parseAdminBuildReviewMethod(options.adminBuildReviewMethod)
         : undefined;
+      const reviewReceipt = options.adminReviewReceipt
+        ? parseBuildReviewReceipt(options.adminReviewReceipt)
+        : null;
+      if (
+        reviewReceipt &&
+        (reviewedBuildVersionId || buildReviewMethod)
+      ) {
+        throw cliValidationError(
+          "Pass either --review-receipt or manual --reviewed-version/--reviewed-via evidence, not both.",
+        );
+      }
+      const confirmedBuildVersionId = reviewReceipt
+        ? Number(reviewReceipt.publishedArtifactVersionId)
+        : reviewedBuildVersionId;
+      const confirmedBuildReviewMethod = reviewReceipt
+        ? "runtime"
+        : buildReviewMethod;
+      if (
+        reviewReceipt &&
+        parsedTarget.type === "build" &&
+        Number(reviewReceipt.buildId) !== parsedTarget.id
+      ) {
+        throw cliValidationError(
+          "The review receipt belongs to a different Build.",
+        );
+      }
       if (parsedTarget.type === "build") {
         if (!options.adminFile) {
           throw cliValidationError(
             "Build comments are management-agent composed only; pass --file <comment.md> after reviewing the project.",
           );
         }
-        if (!reviewedBuildVersionId || !buildReviewMethod) {
+        if (!confirmedBuildVersionId || !confirmedBuildReviewMethod) {
           throw cliValidationError(
             "After reviewing the project, pass both --reviewed-version <published-artifact-id> and --reviewed-via runtime|code.",
           );
         }
       } else if (
         parsedTarget.type !== "comment" &&
-        (reviewedBuildVersionId || buildReviewMethod)
+        (confirmedBuildVersionId || confirmedBuildReviewMethod)
       ) {
         throw cliValidationError(
           "Build review evidence applies only to build:<id> or a comment:<id> inside a Build.",
@@ -832,8 +1191,12 @@ export function parseAdminOperation(options) {
           ...(options.adminFile
             ? { content: readComposedTextFile(options.adminFile) }
             : {}),
-          ...(reviewedBuildVersionId ? { reviewedBuildVersionId } : {}),
-          ...(buildReviewMethod ? { buildReviewMethod } : {}),
+          ...(confirmedBuildVersionId
+            ? { reviewedBuildVersionId: confirmedBuildVersionId }
+            : {}),
+          ...(confirmedBuildReviewMethod
+            ? { buildReviewMethod: confirmedBuildReviewMethod }
+            : {}),
         },
       );
     }
@@ -877,7 +1240,7 @@ export function parseAdminOperation(options) {
   }
 
   throw cliValidationError(
-    "Usage: lumine admin identity|daily-run|recommendations|builds|post|subjects|subject|featured|comment|announcement|chat|news|audit|brief|bot-output|notable ...",
+    "Usage: lumine admin identity|daily-run|escalation|recommendations|builds|post|subjects|subject|featured|comment|announcement|chat|news|audit|brief|bot-output|notable ...",
   );
 }
 
@@ -890,6 +1253,17 @@ function subjectsListOperation(options) {
       effort: options.adminEffort,
       limit: options.limit,
     }),
+    {
+      pagination: {
+        collectionKey: "subjects",
+        coverageQueue: "subjects",
+        coverageMode: options.adminAfter ? "after" : "all",
+        after: options.adminAfter
+          ? parseAfterForCoverage(options.adminAfter)
+          : null,
+        filters: { effort: options.adminEffort || "all" },
+      },
+    },
   );
 }
 
@@ -997,6 +1371,35 @@ function recommendOperation(target, options) {
   );
 }
 
+export function parseRecommendationWindow(options) {
+  const selected = [
+    options.adminSinceRun ? "since-run" : "",
+    options.adminAfter ? "after" : "",
+    options.adminIncludeLegacy ? "legacy" : "",
+  ].filter(Boolean);
+  if (selected.length > 1) {
+    throw cliValidationError(
+      "Choose one recommendation window: --since-run, --after, or --include-legacy.",
+    );
+  }
+  const mode = selected[0] || "since-run";
+  if (mode === "after") parseAfterForCoverage(options.adminAfter);
+  return { mode, after: mode === "after" ? options.adminAfter : "" };
+}
+
+function parseAfterForCoverage(value) {
+  const raw = String(value || "").trim();
+  if (/^\d+$/.test(raw)) {
+    const parsed = Number(raw);
+    if (Number.isSafeInteger(parsed) && parsed >= 0) return parsed;
+  }
+  const parsedMs = Date.parse(raw);
+  if (Number.isFinite(parsedMs)) return Math.floor(parsedMs / 1000);
+  throw cliValidationError(
+    "--after must be a Unix timestamp or ISO-8601 date.",
+  );
+}
+
 export function parseSubjectId(value) {
   const normalized = String(value || "").trim();
   const match = normalized.match(/(?:^subject:|\/subjects\/)(\d+)(?:[/?#]|$)/i);
@@ -1090,6 +1493,42 @@ export function parseAdminCommentTarget({ target, explicitType = "" }) {
   return baseTarget;
 }
 
+export function parseAdminEscalationTarget(value) {
+  const normalized = String(value || "").trim();
+  const genericTarget = normalized.match(
+    /^([a-zA-Z][a-zA-Z0-9_-]{0,39}):(\d+)$/,
+  );
+  if (genericTarget) {
+    return {
+      targetType: genericTarget[1],
+      targetId: parseRequiredInteger(genericTarget[2], "escalation target ID", 1),
+      url: null,
+    };
+  }
+  if (/^https:\/\//i.test(normalized)) {
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(normalized);
+    } catch {
+      throw cliValidationError("The escalation target URL is invalid.");
+    }
+    if (parsedUrl.protocol !== "https:") {
+      throw cliValidationError("The escalation target URL must use HTTPS.");
+    }
+    if (
+      /\/(?:subjects|comments|ai-stories|daily-reflections|app|build)\/\d+(?:[/?#]|$)/i.test(
+        normalized,
+      )
+    ) {
+      const parsed = parseAdminCommentTarget({ target: normalized });
+      return { targetType: parsed.type, targetId: parsed.id, url: normalized };
+    }
+    return { targetType: null, targetId: null, url: normalized };
+  }
+  const parsed = parseAdminCommentTarget({ target: normalized });
+  return { targetType: parsed.type, targetId: parsed.id, url: null };
+}
+
 function parseAdminBuildReviewMethod(value) {
   const normalized = String(value || "")
     .trim()
@@ -1134,8 +1573,15 @@ export function formatAdminJsonError(error) {
   };
 }
 
-function readOperation(name, path) {
-  return { name, method: "GET", path, body: undefined, mutates: false };
+function readOperation(name, path, extra = {}) {
+  return {
+    name,
+    method: "GET",
+    path,
+    body: undefined,
+    mutates: false,
+    ...extra,
+  };
 }
 
 function writeOperation(name, method, path, body) {
@@ -1173,6 +1619,30 @@ function parseCommentMode(value) {
   return mode;
 }
 
+function parseEscalationStatus(value) {
+  const status = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!["open", "acknowledged", "resolved"].includes(status)) {
+    throw cliValidationError(
+      "--status must be open, acknowledged, or resolved.",
+    );
+  }
+  return status;
+}
+
+function parseEscalationListStatus(value) {
+  const status = String(value || "open")
+    .trim()
+    .toLowerCase();
+  if (!["open", "acknowledged", "resolved", "all"].includes(status)) {
+    throw cliValidationError(
+      "--status must be open, acknowledged, resolved, or all.",
+    );
+  }
+  return status;
+}
+
 function parseOrderedIds(value) {
   const ids = String(value || "")
     .split(",")
@@ -1276,8 +1746,121 @@ function cliValidationError(message) {
   return error;
 }
 
+function adminValueFingerprint(value) {
+  return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+
 function printAdminResult({ operation, result }) {
   const data = result?.data || {};
+  if (data.review) {
+    console.log(
+      `Confirmed Build #${data.review.buildId} runtime at published artifact #${data.review.publishedArtifactVersionId}.`,
+    );
+    console.log(`Screenshot: ${data.screenshotPath}`);
+    console.log(`Review receipt: ${data.receiptPath}`);
+    return;
+  }
+  if (data.validation) {
+    console.log(
+      `Editorial valid for edition #${data.validation.editionId}: ${data.validation.citedEventCount} cited and ${data.validation.coveredEventCount} covered event(s).`,
+    );
+    return;
+  }
+  if (data.batch) {
+    console.log(
+      `Skipped ${data.batch.completedCount} audited target(s); ${data.batch.changedCount} changed canonical state.`,
+    );
+    console.log(`Checkpoint: ${data.batch.checkpointPath}`);
+    return;
+  }
+  if (data.report) {
+    const report = data.report;
+    console.log(
+      `Run #${report.run.id}: ${report.mutations.successfulMutationCount} successful mutation(s), ${report.queueCoverage.length} queue coverage record(s), ${report.escalations.length} escalation(s).`,
+    );
+    for (const coverage of report.queueCoverage) {
+      console.log(
+        `  ${coverage.queue}: ${coverage.candidateCount} candidate(s), ${coverage.scannedCount} row(s) scanned across ${coverage.pages} page(s).`,
+      );
+    }
+    for (const escalation of report.escalations) {
+      const target =
+        escalation.url ||
+        `${escalation.targetType || "target"}:${escalation.targetId || "?"}`;
+      console.log(
+        `  ${String(escalation.severity || "attention").toUpperCase()} ${target} — ${escalation.summary}`,
+      );
+    }
+    const surfaces = report.brief?.engagementPulse?.surfaces;
+    if (surfaces && typeof surfaces === "object") {
+      const deltas = Object.entries(surfaces)
+        .filter(([, value]) => Number(value?.delta || 0) !== 0)
+        .sort(
+          ([, left], [, right]) =>
+            Math.abs(Number(right?.delta || 0)) -
+            Math.abs(Number(left?.delta || 0)),
+        )
+        .slice(0, 5)
+        .map(
+          ([name, value]) =>
+            `${name} ${Number(value.delta) > 0 ? "+" : ""}${Number(value.delta)}`,
+        );
+      if (deltas.length) console.log(`Engagement deltas: ${deltas.join(", ")}.`);
+    }
+    const notableCount = Array.isArray(report.brief?.notableCandidates)
+      ? report.brief.notableCandidates.length
+      : 0;
+    console.log(`Notable-user candidates in this brief: ${notableCount}.`);
+    return;
+  }
+  if (data.inspection) {
+    const inspection = data.inspection;
+    console.log(
+      `Identity inspection for user #${inspection.targetUserId}: ${inspection.accounts?.length || 0} candidate account(s); oldest #${inspection.oldestAccount?.userId || "unknown"}.`,
+    );
+    if (inspection.manualBucket) {
+      console.log(
+        `AI bucket #${inspection.manualBucket.id} (${inspection.manualBucket.label}); ${inspection.manualBucket.memberCount} canonical member(s).`,
+      );
+    }
+    for (const account of inspection.accounts || []) {
+      console.log(
+        `  #${account.userId} ${account.username || "(no username)"} — joined ${account.joinedAt || "unknown"}; ${account.relationBasis.join(", ") || "no relation evidence"}${account.hasDateOfBirth ? "; DOB on file" : "; no DOB on file"}.`,
+      );
+      if (account.privateEvidence) {
+        console.log(
+          `    Private evidence: DOB ${account.privateEvidence.dateOfBirth || "none"}; verified email(s) ${account.privateEvidence.verifiedEmails.join(", ") || "none"}.`,
+        );
+      }
+    }
+    return;
+  }
+  if (Array.isArray(data.escalations)) {
+    console.log(`${data.escalations.length} escalation(s):`);
+    for (const escalation of data.escalations) {
+      const target =
+        escalation.url ||
+        `${escalation.targetType || "target"}:${escalation.targetId || "?"}`;
+      console.log(
+        `  #${escalation.auditId} ${String(escalation.status || "open").toUpperCase()} ${target} — ${escalation.summary}`,
+      );
+      if (escalation.decisionNote) {
+        console.log(`    Decision: ${escalation.decisionNote}`);
+      }
+    }
+    if (data.truncated) {
+      console.log(
+        "More matching escalations exist than the requested limit; raise --limit or narrow --status.",
+      );
+    }
+    return;
+  }
+  if (data.escalation?.decisionNote) {
+    console.log(
+      `Escalation #${data.escalation.auditId}: ${String(data.escalation.status).toUpperCase()} — ${data.escalation.decisionNote}`,
+    );
+    return;
+  }
   if (data.bucket && Array.isArray(data.memberUserIds)) {
     const added = Array.isArray(data.accounts)
       ? `; added ${data.accounts.length} explicit account(s)`
@@ -1347,12 +1930,28 @@ function printAdminResult({ operation, result }) {
     return;
   }
   if (data.claim) {
-    console.log(
-      `Claimed edition #${data.claim.editionId} (${data.claim.dateKey}): ${data.claim.events.length} event(s); lease token ${data.claim.leaseToken}.`,
-    );
-    console.log(
-      `Write the editorial JSON, then run: lumine admin news submit --edition-id ${data.claim.editionId} --lease-token ${data.claim.leaseToken} --file editorial.json`,
-    );
+    if (data.artifacts?.claimFile) {
+      console.log(
+        `Claimed edition #${data.claim.editionId} (${data.claim.dateKey}): ${data.claim.events.length} event(s).`,
+      );
+      console.log(`Claim file: ${data.artifacts.claimFile}`);
+      if (data.artifacts?.scaffoldFile) {
+        console.log(`Editorial scaffold: ${data.artifacts.scaffoldFile}`);
+      }
+      console.log(
+        `Validate before submission: lumine admin news validate --claim ${data.artifacts.claimFile} --file ${data.artifacts.scaffoldFile || "editorial.json"}`,
+      );
+      console.log(
+        `Submit the confirmed pair: lumine admin news submit --claim ${data.artifacts.claimFile} --file ${data.artifacts.scaffoldFile || "editorial.json"}`,
+      );
+    } else {
+      console.log(
+        `Claimed edition #${data.claim.editionId} (${data.claim.dateKey}): ${data.claim.events.length} event(s); lease token ${data.claim.leaseToken}.`,
+      );
+      console.log(
+        `Write the editorial JSON, then run: lumine admin news submit --edition-id ${data.claim.editionId} --lease-token ${data.claim.leaseToken} --file editorial.json`,
+      );
+    }
     return;
   }
   if (data.newspaper) {