@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/external/org/beat-register.js

@@ -0,0 +1,198 @@
+/*
+ * external/org/beat-register.ts — shared shapes + GET
+ * /api/external/org/leads/:leadId/beat-register (iterate-2026-08-18-org-route-beat-register,
+ * V4a-2B point 7 — the open-register finding).
+ *
+ * Reads leadwright's `~/.claude/leads/<lead-id>/beat-register.json`
+ * (contract name (a), decided by leadwright: `{version:1, entries:
+ * BeatRegisterEntry[]}`, open iff `closedAt === null`, a second entry under
+ * one `sessionId` is a fault). This is a JSON-safe MIRROR of leadwright's
+ * `lib/beat-register.ts` (`evaluateRegisterHealth`) — not an import,
+ * cross-repo — matching its contract exactly, including one of its known
+ * limitations (see the `MIRRORED LIMITATION` comment below).
+ *
+ * The release action (point 4.4) lives in `beat-register-release.ts`, which
+ * imports the shared shapes/helpers from this file.
+ */
+import { readFileSync, lstatSync, writeFileSync, renameSync, existsSync, unlinkSync } from "node:fs";
+import path, { dirname, basename } from "node:path";
+import { randomBytes } from "node:crypto";
+import { LEAD_ID_RE } from "./_helpers.js";
+import { realPathGuard } from "../../core/path-guard.js";
+function isValidEntry(v) {
+    if (typeof v !== "object" || v === null)
+        return false;
+    const e = v;
+    return (typeof e.sessionId === "string" &&
+        e.sessionId.length > 0 &&
+        typeof e.beatId === "string" &&
+        typeof e.leadId === "string" &&
+        typeof e.pid === "number" &&
+        typeof e.startedAt === "string" &&
+        (e.closedAt === null || typeof e.closedAt === "string"));
+}
+/** Structural validation only — mirrors leadwright's own schema, not a
+ *  re-derivation. Rejects an unsupported `version` or malformed entries
+ *  rather than guessing a health/staleness value from corrupt data
+ *  (plan-review PR-4). */
+export function isValidRegisterFile(v) {
+    if (typeof v !== "object" || v === null)
+        return false;
+    const f = v;
+    return f.version === 1 && Array.isArray(f.entries) && f.entries.every(isValidEntry);
+}
+/**
+ * Mirrors leadwright's `evaluateRegisterHealth` exactly, including its
+ * scope: duplicate-sessionId is checked first (fault always wins), then the
+ * FIRST open entry is reported.
+ *
+ * MIRRORED LIMITATION (plan-review PR-10, disclosed not fixed): two
+ * DISTINCT open entries (different sessionIds, neither duplicated) are NOT
+ * flagged as a fault — only the first found is reported as "open". This
+ * matches leadwright's own function precisely (verified by reading
+ * `lib/beat-register.ts`); FR-04.41's lock is what is supposed to prevent
+ * this state from occurring at all.
+ */
+export function evaluateRegisterHealth(file) {
+    const bySession = new Map();
+    for (const entry of file.entries) {
+        const list = bySession.get(entry.sessionId) ?? [];
+        list.push(entry);
+        bySession.set(entry.sessionId, list);
+    }
+    for (const [sessionId, entries] of bySession) {
+        if (entries.length > 1) {
+            return { status: "fault", reason: "duplicate-session-id", sessionId, entries };
+        }
+    }
+    const open = file.entries.find((e) => e.closedAt === null);
+    if (open) {
+        return { status: "open", entry: open };
+    }
+    return { status: "clear" };
+}
+export function registerPathFor(leadsRoot, leadId) {
+    return path.join(leadsRoot, leadId, "beat-register.json");
+}
+export function auditPathFor(leadsRoot, leadId) {
+    return path.join(leadsRoot, leadId, "audit.jsonl");
+}
+/**
+ * Symlink + containment guard for a target already known to exist.
+ *
+ * Code-review fix (Stage 2, medium/correctness): the original version let
+ * `lstat` throw uncaught, so a target deleted between the caller's own
+ * existence check and this call (the register file genuinely has a second
+ * writer — leadwright's own daemon) propagated as an unhandled exception
+ * into a bare 500 instead of a graceful outcome. Mirrors
+ * `decisions-lock.ts`'s `assertNotSymlink`, which is ENOENT-tolerant for
+ * exactly this reason — the difference here is a vanished target is
+ * reported back as its OWN status (`404 vanished`) rather than silently
+ * treated as "fine, proceed", because (unlike `assertNotSymlink`'s
+ * create-if-absent callers) every current caller of this function needs
+ * the target to actually be there for what it does next.
+ */
+export function guardExistingTarget(leadsRoot, absolute, lstat) {
+    let lst;
+    try {
+        lst = lstat(absolute);
+    }
+    catch (err) {
+        if (err?.code === "ENOENT") {
+            return { ok: false, status: 404, error: "vanished" };
+        }
+        throw err;
+    }
+    if (lst.isSymbolicLink()) {
+        return { ok: false, status: 403, error: "symlink_forbidden" };
+    }
+    const containment = realPathGuard(leadsRoot, absolute);
+    if (!containment.ok) {
+        return { ok: false, status: 400, error: "path_traversal", detail: containment.reason };
+    }
+    return { ok: true };
+}
+export function atomicWriteJson(target, value) {
+    const tmp = path.join(dirname(target), `.${basename(target)}.tmp-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}`);
+    try {
+        writeFileSync(tmp, JSON.stringify(value, null, 2), "utf8");
+        renameSync(tmp, target);
+    }
+    catch (err) {
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch {
+            /* swallow */
+        }
+        throw err;
+    }
+}
+/** ENOENT/empty-file both read as a `{version:1, entries:[]}` clear
+ *  register — mirrors leadwright's own `readRegisterUnlocked`. Any other
+ *  parse/structural failure returns `ok:false` (never a guessed value). */
+export function readRegisterFileTolerant(absolute) {
+    let raw;
+    try {
+        raw = readFileSync(absolute, "utf8");
+    }
+    catch (err) {
+        if (err?.code === "ENOENT") {
+            return { ok: true, file: { version: 1, entries: [] } };
+        }
+        return { ok: false };
+    }
+    if (raw.trim().length === 0) {
+        return { ok: true, file: { version: 1, entries: [] } };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false };
+    }
+    if (!isValidRegisterFile(parsed)) {
+        return { ok: false };
+    }
+    return { ok: true, file: parsed };
+}
+export function registerBeatRegisterHealthRoute(app, deps) {
+    const { leadsRoot } = deps;
+    const lstat = deps.lstatSync ?? ((p) => lstatSync(p));
+    app.get("/api/external/org/leads/:leadId/beat-register", async (c) => {
+        const leadId = c.req.param("leadId");
+        if (!LEAD_ID_RE.test(leadId)) {
+            return c.json({ error: "invalid_lead_id", leadId }, 400);
+        }
+        const absolute = registerPathFor(leadsRoot, leadId);
+        let lst;
+        try {
+            lst = lstat(absolute);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ENOENT") {
+                const body = { leadId, status: "clear" };
+                return c.json(body, 200);
+            }
+            return c.json({ error: "beat_register_read_failed", detail: String(err).slice(0, 200) }, 500);
+        }
+        if (lst.isSymbolicLink()) {
+            return c.json({ error: "symlink_forbidden", leadId }, 403);
+        }
+        const containment = realPathGuard(leadsRoot, absolute);
+        if (!containment.ok) {
+            return c.json({ error: "path_traversal", detail: containment.reason }, 400);
+        }
+        const read = readRegisterFileTolerant(absolute);
+        if (!read.ok) {
+            return c.json({ error: "beat_register_invalid", leadId }, 502);
+        }
+        const health = evaluateRegisterHealth(read.file);
+        const body = { leadId, ...health };
+        return c.json(body, 200);
+    });
+}
+//# sourceMappingURL=beat-register.js.map

package/server/dist/external/org/beat-register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beat-register.js","sourceRoot":"","sources":["../../../src/external/org/beat-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoBzD,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACxD,CAAC;AACJ,CAAC;AAED;;;0BAG0B;AAC1B,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACtF,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAsB;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAC3D,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,MAAc;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,MAAc;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,QAAgB,EAChB,KAAc;IAEd,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,KAAc;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,OAAO,CAAC,MAAM,CAAC,EACf,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACF,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,wBAAwB,CACtC,QAAgB;IAEhB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAsBD,MAAM,UAAU,+BAA+B,CAAC,GAAS,EAAE,IAA2B;IACpF,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,GAAG,CAAC,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAEpD,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,GAA+B,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EACzE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAA+B,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/org/countersign.d.ts

@@ -0,0 +1,8 @@
+import type { Hono } from "hono";
+import { withDecisionsLock, type DecisionsLockDeps } from "./decisions-lock.js";
+export interface CountersignRouteDeps extends DecisionsLockDeps {
+    /** Injectable for tests; production wires the real `withDecisionsLock`. */
+    withDecisionsLock?: typeof withDecisionsLock;
+}
+export declare function registerCountersignRoute(app: Hono, deps: CountersignRouteDeps): void;
+//# sourceMappingURL=countersign.d.ts.map

package/server/dist/external/org/countersign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"countersign.d.ts","sourceRoot":"","sources":["../../../src/external/org/countersign.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAKjC,OAAO,EACL,iBAAiB,EAOjB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAiG7B,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;CAC9C;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,GAAG,IAAI,CA2DpF"}

package/server/dist/external/org/countersign.js

@@ -0,0 +1,157 @@
+/*
+ * external/org/countersign.ts — POST /api/external/org/decisions/countersign.
+ *
+ * Moves EXACTLY ONE entry from `decisions-proposed.md` to `decision_log.md`,
+ * assigning the next sequential `ADR-NNNN` number inside the FR-04.28 lock
+ * (`decisions-lock.ts`). Two plan-review fixes baked in from the start:
+ *
+ *   - Request identifies the entry by `{timestamp, leadId}`, not timestamp
+ *     alone (two leads, or two proposals in the same wall-clock second,
+ *     could otherwise collide).
+ *   - Crash-safe / idempotent retry: `decision_log.md` is the source of
+ *     truth for "already done" — if an entry with the same
+ *     (timestamp, leadId) is already logged, the action does NOT mint a
+ *     second number; it just makes sure the proposed-side copy is (still)
+ *     removed and returns the existing number. This is why the log write
+ *     happens BEFORE the proposed-side removal: a crash between the two
+ *     leaves `decision_log.md` durable and the retry finds it there.
+ *
+ * External-review fix (MEDIUM, edge-case): "(timestamp, leadId) as identity"
+ * does not guarantee UNIQUENESS by construction, only disambiguation in the
+ * common case — the daemon could still write two genuinely distinct
+ * proposals sharing the same pair (e.g. two rapid proposals from one lead in
+ * the same wall-clock second). Both the initial-match and the
+ * idempotent-retry path now count matches: exactly one proceeds as before;
+ * two or more is a `409 duplicate_proposal_identity` conflict rather than
+ * silently discarding every match past the first.
+ */
+import { writeFileSync, renameSync, existsSync, unlinkSync } from "node:fs";
+import { dirname, basename, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { withDecisionsLock, parseProposedEntries, parseLoggedEntries, findLoggedEntry, nextLoggedNumber, toLoggedBlock, OrgSymlinkEscapeError, } from "./decisions-lock.js";
+import { LEAD_ID_RE } from "./_helpers.js";
+/** Canonical ISO-8601 UTC ('Z') timestamp — the transfer format's own shape
+ *  (spec: "Design decisions I own"). Tolerates 0-N fractional-second digits. */
+const ISO_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+function atomicWrite(target, content) {
+    const tmp = join(dirname(target), `.${basename(target)}.tmp-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}`);
+    try {
+        writeFileSync(tmp, content, "utf8");
+        renameSync(tmp, target);
+    }
+    catch (err) {
+        // Doubt-review fix (minor): mirror file-write.ts's performWrite — don't
+        // leave an orphaned .tmp-* file behind on a failed rename.
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch {
+            /* swallow */
+        }
+        throw err;
+    }
+}
+async function countersign(deps, timestamp, leadId) {
+    const lockFn = deps.withDecisionsLock ?? withDecisionsLock;
+    return lockFn(deps, (ctx) => {
+        const loggedRaw = ctx.readLogged();
+        const loggedEntries = parseLoggedEntries(loggedRaw);
+        const existing = findLoggedEntry(loggedEntries, timestamp, leadId);
+        if (existing) {
+            const proposedRaw = ctx.readProposed();
+            // External-review fix (MEDIUM, edge-case): two genuinely-distinct
+            // proposals can share the same (timestamp, leadId) pair (the ADR that
+            // adopted the pair as identity already acknowledged timestamp
+            // collisions are possible). `.find()` here used to silently discard
+            // every residual match past the first without ever logging it —
+            // indistinguishable from ordinary post-countersign cleanup. `.filter()`
+            // lets a genuine duplicate surface as a conflict instead.
+            const stillProposedMatches = parseProposedEntries(proposedRaw).filter((e) => e.timestamp === timestamp && e.leadId === leadId);
+            if (stillProposedMatches.length > 1) {
+                return { status: "duplicate_identity", count: stillProposedMatches.length };
+            }
+            if (stillProposedMatches.length === 1) {
+                const stillProposed = stillProposedMatches[0];
+                const nextProposed = proposedRaw.slice(0, stillProposed.startIndex) +
+                    proposedRaw.slice(stillProposed.endIndex);
+                atomicWrite(ctx.proposedPath, nextProposed);
+            }
+            return { status: "already_countersigned", number: existing.number };
+        }
+        const proposedRaw = ctx.readProposed();
+        const matches = parseProposedEntries(proposedRaw).filter((e) => e.timestamp === timestamp && e.leadId === leadId);
+        if (matches.length === 0) {
+            return { status: "not_found" };
+        }
+        if (matches.length > 1) {
+            return { status: "duplicate_identity", count: matches.length };
+        }
+        const target = matches[0];
+        const number = nextLoggedNumber(loggedEntries);
+        const loggedBlock = toLoggedBlock(target.block, number);
+        const separator = loggedRaw.length > 0 && !loggedRaw.endsWith("\n") ? "\n" : "";
+        const nextLogged = loggedRaw + separator + loggedBlock;
+        const nextProposed = proposedRaw.slice(0, target.startIndex) + proposedRaw.slice(target.endIndex);
+        // Log FIRST (durable), then remove from proposed — the idempotent-retry
+        // check above trusts decision_log.md as "already done".
+        atomicWrite(ctx.loggedPath, nextLogged);
+        atomicWrite(ctx.proposedPath, nextProposed);
+        return { status: "countersigned", number };
+    });
+}
+export function registerCountersignRoute(app, deps) {
+    app.post("/api/external/org/decisions/countersign", async (c) => {
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "invalid_json" }, 400);
+        }
+        const { timestamp, leadId } = (body ?? {});
+        if (typeof timestamp !== "string" || timestamp.length === 0) {
+            return c.json({ error: "timestamp_required" }, 400);
+        }
+        if (typeof leadId !== "string" || leadId.length === 0) {
+            return c.json({ error: "leadId_required" }, 400);
+        }
+        // External-review fix (MEDIUM, spec): the transfer format's identity pair
+        // is a canonical ISO-8601 timestamp + a kebab-case lead id, not merely
+        // "any non-empty string" — an arbitrary value silently 404s as
+        // proposal_not_found instead of being rejected as malformed input.
+        if (!ISO_TIMESTAMP_RE.test(timestamp)) {
+            return c.json({ error: "timestamp_invalid", timestamp }, 400);
+        }
+        if (!LEAD_ID_RE.test(leadId)) {
+            return c.json({ error: "leadId_invalid", leadId }, 400);
+        }
+        let outcome;
+        try {
+            outcome = await countersign(deps, timestamp, leadId);
+        }
+        catch (err) {
+            // Code-review fix: without this, a symlinked decisions-proposed.md /
+            // decision_log.md fell through to the generic 500 error handler
+            // instead of the family's typed 403 symlink_forbidden (file-write.ts
+            // applies the same defense class explicitly).
+            if (err instanceof OrgSymlinkEscapeError) {
+                return c.json({ error: "symlink_forbidden", path: err.path }, 403);
+            }
+            throw err;
+        }
+        if (outcome.status === "not_found") {
+            return c.json({ error: "proposal_not_found", timestamp, leadId }, 404);
+        }
+        if (outcome.status === "duplicate_identity") {
+            return c.json({ error: "duplicate_proposal_identity", timestamp, leadId, count: outcome.count }, 409);
+        }
+        return c.json({
+            countersigned: true,
+            alreadyCountersigned: outcome.status === "already_countersigned",
+            number: outcome.number,
+            adr: `ADR-${String(outcome.number).padStart(4, "0")}`,
+        });
+    });
+}
+//# sourceMappingURL=countersign.js.map

package/server/dist/external/org/countersign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"countersign.js","sourceRoot":"","sources":["../../../src/external/org/countersign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C;gFACgF;AAChF,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;AAE1E,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe;IAClD,MAAM,GAAG,GAAG,IAAI,CACd,OAAO,CAAC,MAAM,CAAC,EACf,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACF,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW,CACxB,IAA0B,EAC1B,SAAiB,EACjB,MAAc;IAEd,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;YACvC,kEAAkE;YAClE,sEAAsE;YACtE,8DAA8D;YAC9D,oEAAoE;YACpE,gEAAgE;YAChE,wEAAwE;YACxE,0DAA0D;YAC1D,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CACxD,CAAC;YACF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,YAAY,GAChB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC;oBAC9C,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC5C,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CACxD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACjE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;QACvD,MAAM,YAAY,GAChB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE/E,wEAAwE;QACxE,wDAAwD;QACxD,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAE5C,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,UAAU,wBAAwB,CAAC,GAAS,EAAE,IAA0B;IAC5E,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAGxC,CAAC;QACF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,0EAA0E;QAC1E,uEAAuE;QACvE,+DAA+D;QAC/D,mEAAmE;QACnE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,gEAAgE;YAChE,qEAAqE;YACrE,8CAA8C;YAC9C,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,6BAA6B,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACjF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,aAAa,EAAE,IAAI;YACnB,oBAAoB,EAAE,OAAO,CAAC,MAAM,KAAK,uBAAuB;YAChE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACtD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/server/dist/external/org/cron.d.ts

@@ -0,0 +1,22 @@
+export type CronIntervalResult = {
+    ok: true;
+    ms: number;
+} | {
+    ok: false;
+};
+/** The gap (ms) between the next two occurrences of `cron` after `from`. */
+export declare function cronIntervalMs(cron: string, from: Date): CronIntervalResult;
+export type Staleness = "fresh" | "stale";
+export interface StalenessEvaluation {
+    staleness: Staleness;
+    thresholdMs: number;
+    ageMs: number;
+}
+/**
+ * `stale` iff the age of `lastRunAt` (relative to `now`) is STRICTLY
+ * greater than `3 * cadenceMs` — an age exactly at the threshold is fresh.
+ * Boundary is deliberate and tested (task brief: "the boundary case is
+ * tested").
+ */
+export declare function evaluateStaleness(lastRunAt: string, cadenceMs: number, now: Date): StalenessEvaluation;
+//# sourceMappingURL=cron.d.ts.map

package/server/dist/external/org/cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../../../src/external/org/cron.ts"],"names":[],"mappings":"AA6BA,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAE1E,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,kBAAkB,CAa3E;AAED,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,mBAAmB,CAQrB"}

package/server/dist/external/org/cron.js

@@ -0,0 +1,59 @@
+/*
+ * external/org/cron.ts — pure cron/staleness math for FR-04.06's "3x
+ * cadence" threshold (iterate-2026-08-18-org-route-beat-register, contract
+ * name (c): `Lead.triggers.cron`, decided by leadwright, consumed here).
+ *
+ * No filesystem access — see `org-chart-lookup.ts` for the reader that
+ * supplies `cron`. Kept separate so the arithmetic is trivially unit-
+ * testable without any fixture directory.
+ *
+ * Plan-review fix (PR-7, openai): `cron-parser` resolves relative to the
+ * SYSTEM timezone by default, which is nondeterministic across deployments
+ * — every timestamp elsewhere in this route family is UTC (ISO-8601 'Z'),
+ * so this module pins `tz: "UTC"` explicitly rather than inheriting the
+ * host's local zone.
+ *
+ * Disclosed limitation (plan-review PR-7 / iterate spec "Confidence
+ * Calibration"): the cadence is derived from the gap between the NEXT TWO
+ * occurrences after `from`, not from the cron expression's fixed period.
+ * For a regular schedule (e.g. every 15 minutes) these are identical. For an
+ * irregular one (monthly, day-of-week combinations, a DST transition
+ * inside the window) the gap can vary depending on where `from` falls in
+ * the schedule — this is an accepted approximation of "configured cadence"
+ * for staleness alerting, not an exact-occurrence scheduler. The task
+ * brief asks to derive the threshold from `triggers.cron` rather than
+ * hard-code it; it does not ask for recurrence-aware staleness.
+ */
+import { CronExpressionParser } from "cron-parser";
+/** The gap (ms) between the next two occurrences of `cron` after `from`. */
+export function cronIntervalMs(cron, from) {
+    try {
+        const interval = CronExpressionParser.parse(cron, { currentDate: from, tz: "UTC" });
+        const first = interval.next().getTime();
+        const second = interval.next().getTime();
+        const ms = second - first;
+        if (!Number.isFinite(ms) || ms <= 0) {
+            return { ok: false };
+        }
+        return { ok: true, ms };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+/**
+ * `stale` iff the age of `lastRunAt` (relative to `now`) is STRICTLY
+ * greater than `3 * cadenceMs` — an age exactly at the threshold is fresh.
+ * Boundary is deliberate and tested (task brief: "the boundary case is
+ * tested").
+ */
+export function evaluateStaleness(lastRunAt, cadenceMs, now) {
+    const thresholdMs = 3 * cadenceMs;
+    const ageMs = now.getTime() - new Date(lastRunAt).getTime();
+    return {
+        staleness: ageMs > thresholdMs ? "stale" : "fresh",
+        thresholdMs,
+        ageMs,
+    };
+}
+//# sourceMappingURL=cron.js.map

package/server/dist/external/org/cron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.js","sourceRoot":"","sources":["../../../src/external/org/cron.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAInD,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAU;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,SAAiB,EACjB,GAAS;IAET,MAAM,WAAW,GAAG,CAAC,GAAG,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,OAAO;QACL,SAAS,EAAE,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAClD,WAAW;QACX,KAAK;KACN,CAAC;AACJ,CAAC"}

package/server/dist/external/org/decisions-lock.d.ts

@@ -0,0 +1,68 @@
+export interface ProposedEntry {
+    timestamp: string;
+    leadId: string;
+    /** Full block text (header line + body), from this header up to the next
+     *  header or EOF. Opaque — never parsed beyond the header line. */
+    block: string;
+    startIndex: number;
+    endIndex: number;
+}
+export interface LoggedEntry {
+    number: number;
+    timestamp: string;
+    leadId: string;
+    block: string;
+}
+/** Parse `decisions-proposed.md` into its opaque, header-delimited entries. */
+export declare function parseProposedEntries(raw: string): ProposedEntry[];
+/** Parse `decision_log.md` into its numbered, header-delimited entries. */
+export declare function parseLoggedEntries(raw: string): LoggedEntry[];
+export declare function findLoggedEntry(entries: LoggedEntry[], timestamp: string, leadId: string): LoggedEntry | undefined;
+export declare function nextLoggedNumber(entries: LoggedEntry[]): number;
+/**
+ * Rewrite a proposed entry's block into logged form: same body, header line
+ * becomes `## ADR-<NNNN> [<timestamp>] <leadId>`. Byte-preserving beyond the
+ * header line — this route never parses or understands the body prose.
+ */
+export declare function toLoggedBlock(proposedBlock: string, number: number): string;
+export declare class OrgSymlinkEscapeError extends Error {
+    readonly path: string;
+    constructor(path: string);
+}
+export interface DecisionsLockDeps {
+    leadsRoot: string;
+    lstatSync?: (path: string) => {
+        isSymbolicLink(): boolean;
+    };
+}
+/** Resolve `decisions-proposed.md` / `decision_log.md` under `leadsRoot`
+ *  through the SAME allowlist + path-guard as the generic `/file` route. */
+export declare function resolveDecisionsPaths(leadsRoot: string): {
+    proposedPath: string;
+    loggedPath: string;
+};
+export interface DecisionsLockContext {
+    proposedPath: string;
+    loggedPath: string;
+    readProposed(): string;
+    readLogged(): string;
+}
+/**
+ * Acquire the FR-04.28 lock on `decisions-proposed.md`
+ * (`stale: 10_000`, `realpath: true` — both explicit, per the contract;
+ * neither side sets `lockfilePath`, so proper-lockfile's own default
+ * `<path>.lock` is what leadwright's daemon must also target), run `fn`
+ * inside the critical section, then release. The target file is created
+ * (empty) before acquisition if missing. Both files are symlink-checked
+ * before the lock is taken, AND re-checked immediately after it is held
+ * (doubt-review fix, MEDIUM-HIGH): `lockfile.lock()` retries for up to
+ * ~2.75s under contention (8 retries, 50ms→500ms backoff) — a co-resident
+ * writer could swap either path for a symlink in that window, after the
+ * first check ran but before the lock was actually ours. Re-checking right
+ * after acquisition closes that specific gap. It does not extend to
+ * arbitrary time spent inside `fn` itself — that would mean re-lstat'ing on
+ * every read, which is unwarranted for a route whose only writers are this
+ * process and leadwright's daemon, both honoring the same lock.
+ */
+export declare function withDecisionsLock<T>(deps: DecisionsLockDeps, fn: (ctx: DecisionsLockContext) => Promise<T> | T): Promise<T>;
+//# sourceMappingURL=decisions-lock.d.ts.map

package/server/dist/external/org/decisions-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions-lock.d.ts","sourceRoot":"","sources":["../../../src/external/org/decisions-lock.ts"],"names":[],"mappings":"AA8CA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf;uEACmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAiCD,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAQjE;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE,CAO7D;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,WAAW,GAAG,SAAS,CAEzB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAG/D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAY3E;AAMD,qBAAa,qBAAsB,SAAQ,KAAK;aAClB,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAGzC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,cAAc,IAAI,OAAO,CAAA;KAAE,CAAC;CAC7D;AAuCD;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,CASA;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,IAAI,MAAM,CAAC;IACvB,UAAU,IAAI,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CA0BZ"}