@tea-agent/loop-agent 0.39.0-beta.2 → 0.39.0-beta.3

package/dist/workflows/dag/frontend-design-policy.js

@@ -0,0 +1,347 @@
+import { deterministicSha256, } from "./frontend-implementation-contract.js";
+import { pathMatchesPattern } from "../../shared/git-progress.js";
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+const NPM_PACKAGE_NAME = /^(?:@[a-zA-Z0-9_.-]+\/)?[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+function normalizeRelativePath(value) {
+    return value.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function sortFindings(findings) {
+    return [...findings].sort((a, b) => {
+        if (a.code !== b.code)
+            return a.code < b.code ? -1 : 1;
+        if (a.message !== b.message)
+            return a.message < b.message ? -1 : 1;
+        const pathA = a.path ?? "";
+        const pathB = b.path ?? "";
+        if (pathA !== pathB)
+            return pathA < pathB ? -1 : 1;
+        return 0;
+    });
+}
+/** 1. UI-visible requirements must map to a design decision. Every applicable
+ * UI state and every interaction must be covered by an exact `purpose` match in
+ * `uiComponentChoices`; a present `stylingStrategy` additionally covers the
+ * visual UI-state dimension (it cannot cover behavioural interactions). */
+export function checkUiDesignCoverage(contract) {
+    const findings = [];
+    const purposes = new Set((contract.uiComponentChoices ?? []).map((choice) => choice.purpose));
+    const hasStyling = Boolean(contract.stylingStrategy?.trim());
+    for (const state of contract.uiStates) {
+        if (!state.applicable)
+            continue;
+        const covered = purposes.has(state.name) || hasStyling;
+        if (!covered) {
+            findings.push({
+                code: "ui-design-coverage-missing",
+                message: `applicable UI state "${state.name}" has no matching uiComponentChoices.purpose or stylingStrategy`,
+                path: state.name,
+            });
+        }
+    }
+    for (const interaction of contract.interactions) {
+        if (!purposes.has(interaction.name)) {
+            findings.push({
+                code: "ui-design-coverage-missing",
+                message: `interaction "${interaction.name}" has no matching uiComponentChoices.purpose`,
+                path: interaction.name,
+            });
+        }
+    }
+    return findings;
+}
+/** 2. Source freshness: every injected entry must be fresh with a valid hash;
+ * every design-evidence path must appear in the freshness set with a single,
+ * self-consistent sha256; any declared conflict is blocking. */
+export function checkSourceFreshness(contract, sourceFreshness) {
+    const findings = [];
+    const hashesByPath = new Map();
+    for (const entry of sourceFreshness) {
+        if (!entry.fresh) {
+            findings.push({
+                code: "source-stale",
+                message: `source is stale: ${entry.path}`,
+                path: entry.path,
+            });
+        }
+        if (!SHA256_HEX.test(entry.sha256)) {
+            findings.push({
+                code: "source-hash-invalid",
+                message: `source sha256 is not a valid 64-hex digest: ${entry.path}`,
+                path: entry.path,
+            });
+        }
+        const hashes = hashesByPath.get(entry.path) ?? [];
+        hashes.push(entry.sha256);
+        hashesByPath.set(entry.path, hashes);
+    }
+    for (const [path, hashes] of hashesByPath) {
+        if (new Set(hashes).size > 1) {
+            findings.push({
+                code: "source-hash-conflict",
+                message: `source freshness entries disagree on sha256: ${path}`,
+                path,
+            });
+        }
+    }
+    for (const evidencePath of contract.designEvidence.paths) {
+        if (!hashesByPath.has(evidencePath)) {
+            findings.push({
+                code: "design-evidence-path-missing-freshness",
+                message: `design evidence path is absent from the freshness set: ${evidencePath}`,
+                path: evidencePath,
+            });
+        }
+    }
+    // `designEvidence.conflicts` is the plan's honest disclosure of design
+    // deviations (e.g. task text demands a test form the frozen constraints
+    // make infeasible). Whether a disclosed conflict is acceptable is decided
+    // by the design reviewer via `approve_design` / `request_design_changes`,
+    // which `checkDesignApproval` enforces separately. Treating any conflict
+    // as blocking here would strand every honest plan that reports one — the
+    // model cannot "fix" a conflict it correctly identified. Conflicts must be
+    // disclosed (schema-required array), never silently dropped, but disclosure
+    // itself is not a policy violation.
+    return findings;
+}
+/** 3. Mock/API strategy must be allowed; non-`not-needed` strategies require
+ * at least one endpoint and every endpoint must carry fixture + consumer. */
+export function checkMockStrategy(contract, allowedMockStrategies) {
+    const findings = [];
+    if (!allowedMockStrategies.includes(contract.mockApi.strategy)) {
+        findings.push({
+            code: "mock-strategy-not-allowed",
+            message: `mockApi.strategy "${contract.mockApi.strategy}" is not in allowedMockStrategies`,
+        });
+    }
+    if (contract.mockApi.strategy !== "not-needed") {
+        if (contract.mockApi.endpoints.length === 0) {
+            findings.push({
+                code: "mock-endpoints-empty",
+                message: `mockApi.strategy "${contract.mockApi.strategy}" requires at least one endpoint`,
+            });
+        }
+        contract.mockApi.endpoints.forEach((endpoint, index) => {
+            if (!endpoint.fixture) {
+                findings.push({
+                    code: "mock-endpoint-missing-fixture",
+                    message: `mock endpoint ${index} is missing a fixture path`,
+                    path: endpoint.path,
+                });
+            }
+            if (!endpoint.consumer) {
+                findings.push({
+                    code: "mock-endpoint-missing-consumer",
+                    message: `mock endpoint ${index} is missing a consumer path`,
+                    path: endpoint.path,
+                });
+            }
+        });
+    }
+    return findings;
+}
+/** 4. Component choice must be precisely spec-referenced: `specified` requires
+ * a specReference whose normalized path is a candidate and a non-empty section;
+ * `new` must not carry a specReference; `reuse-existing` may omit it. */
+export function checkComponentChoice(contract, componentSpecCandidatePaths) {
+    const findings = [];
+    const candidates = new Set(componentSpecCandidatePaths.map(normalizeRelativePath));
+    (contract.uiComponentChoices ?? []).forEach((choice, index) => {
+        if (choice.decision === "specified") {
+            if (!choice.specReference) {
+                findings.push({
+                    code: "component-spec-reference-missing",
+                    message: `specified component choice #${index} is missing specReference`,
+                    path: choice.purpose,
+                });
+                return;
+            }
+            if (!choice.specReference.section.trim()) {
+                findings.push({
+                    code: "component-spec-reference-missing",
+                    message: `specified component choice #${index} has an empty section`,
+                    path: choice.purpose,
+                });
+            }
+            const normalized = normalizeRelativePath(choice.specReference.path);
+            if (!candidates.has(normalized)) {
+                findings.push({
+                    code: "component-spec-reference-path-outside-candidates",
+                    message: `specified component choice #${index} specReference.path "${choice.specReference.path}" is not a candidate spec path`,
+                    path: choice.specReference.path,
+                });
+            }
+        }
+        else if (choice.decision === "new" && choice.specReference) {
+            findings.push({
+                code: "component-new-with-spec-reference",
+                message: `new component choice #${index} must not carry a specReference`,
+                path: choice.purpose,
+            });
+        }
+    });
+    return findings;
+}
+/** 5. Every implementation target and every non-static verification target
+ * must fall inside the declared writeSet patterns. */
+export function checkTargetPaths(contract, writeSetPatterns) {
+    const findings = [];
+    const matches = (file) => writeSetPatterns.some((pattern) => pathMatchesPattern(file, pattern));
+    for (const file of contract.targets.files) {
+        if (!matches(file)) {
+            findings.push({
+                code: "target-path-outside-write-set",
+                message: `implementation target is outside the writeSet patterns: ${file}`,
+                path: file,
+            });
+        }
+    }
+    for (const target of contract.verificationTargets) {
+        if (target.type === "static")
+            continue;
+        if (!matches(target.file)) {
+            findings.push({
+                code: "target-path-outside-write-set",
+                message: `verification target "${target.id}" file is outside the writeSet patterns: ${target.file}`,
+                path: target.file,
+            });
+        }
+    }
+    return findings;
+}
+/** 6. Any declared dependency identifier must be authorized. A declarative
+ * "no new dependencies" policy declares nothing; package-name-like tokens are
+ * matched exactly against `allowedDependencies`.
+ *
+ * The dependency policy is a natural-language statement, not a machine list.
+ * Three rules keep this check deterministic and aligned with the plan facts:
+ *
+ * 1. An empty allowedDependencies set skips the check entirely — with no
+ *    allowlist there is no ground truth to reject against. The DAG generator
+ *    normally fills this set from the project package.json, so an empty set
+ *    means the manifest could not be read (no authorization is configured).
+ * 2. A declarative "no new dependencies" intent (零新增/不新增/无新增/不引入/
+ *    no new…) satisfies the check: the model explicitly claims it adds
+ *    nothing, so prose mentioning the existing toolchain ("DOM",
+ *    "devDependencies", already-declared deps) must not be misread as new
+ *    dependency claims.
+ * 3. Otherwise, every package-name-like token must match the allowlist —
+ *    an unauthorized new dependency (a library absent from the project
+ *    manifest) still fails closed.
+ */
+export function checkDependencies(contract, allowedDependencies) {
+    const findings = [];
+    const policy = contract.dependencyPolicy?.trim();
+    if (!policy)
+        return findings;
+    // No explicit allowlist: nothing can be judged unauthorized.
+    if (allowedDependencies.length === 0)
+        return findings;
+    // Declarative no-new-dependencies intent: trust the claim, do not parse
+    // prose tokens (they mention the already-declared toolchain). The allowlist
+    // below already passes any already-declared dependency by exact match, so
+    // this exemption is deliberately narrow: only explicit negatives escape the
+    // token scan, never neutral descriptions that could conceal a new dep.
+    if (/零新增|不新增|无新增|不引入|不添加|不依赖|no\s*new\s*deps?|no\s*new\s*dependencies/i.test(policy)) {
+        return findings;
+    }
+    const allowed = new Set(allowedDependencies);
+    const tokens = policy
+        .split(/[,;\s]+/)
+        .filter((token) => token.length > 0);
+    for (const token of tokens) {
+        if (!NPM_PACKAGE_NAME.test(token))
+            continue;
+        // Already-declared dependencies are authorized by definition.
+        if (allowed.has(token))
+            continue;
+        // Versioned/scoped variants: pkg@1.2.3 or @scope/pkg@1 → match bare name.
+        const bareName = token.startsWith("@")
+            ? token.split("@").slice(0, 2).join("@")
+            : token.split("@")[0];
+        if (allowed.has(bareName))
+            continue;
+        findings.push({
+            code: "dependency-not-allowed",
+            message: `declared dependency "${token}" is not in allowedDependencies`,
+            path: token,
+        });
+    }
+    return findings;
+}
+/** 7. Every declared UI state must carry a complete attribution:
+ * applicable → expectedBehavior, non-applicable → notApplicableReason.
+ *
+ * The check validates the states the contract DECLARES, not a hardcoded list
+ * of canonical names: the plan prompts say "Do not invent UI states", so a
+ * contract that reasonably covers loading/empty/error/permission without a
+ * `disabled` entry must not be blocked for missing a state the model had no
+ * reason to declare — the model cannot fix that without inventing one, which
+ * the ladder then retries to exhaustion.
+ *
+ * Pure-logic contracts (no user-visible UI states AND no interactions) are
+ * exempt entirely: the schema and prompts explicitly allow `uiStates: []`.
+ * Once any state or interaction is declared, every declared state must carry
+ * complete attribution.
+ */
+export function checkUiStateAttribution(contract) {
+    if (contract.uiStates.length === 0 && contract.interactions.length === 0)
+        return [];
+    const findings = [];
+    for (const state of contract.uiStates) {
+        if (state.applicable && !state.expectedBehavior) {
+            findings.push({
+                code: "ui-state-attribution-incomplete",
+                message: `applicable UI state "${state.name}" is missing expectedBehavior`,
+                path: state.name,
+            });
+        }
+        if (!state.applicable && !state.notApplicableReason) {
+            findings.push({
+                code: "ui-state-attribution-incomplete",
+                message: `non-applicable UI state "${state.name}" is missing notApplicableReason`,
+                path: state.name,
+            });
+        }
+    }
+    return findings;
+}
+/** Design approval: a `request-revision` verdict from the design reviewer is
+ * blocking. This is injected as structured input, never parsed from model text. */
+export function checkDesignApproval(designApproval) {
+    if (designApproval.verdict === "request-revision") {
+        return [
+            {
+                code: "design-approval-request-revision",
+                message: "design approval verdict is request-revision",
+            },
+        ];
+    }
+    return [];
+}
+/** Aggregate the deterministic design-policy checks into a single
+ * deterministic result. Any finding blocks; an empty finding list approves. */
+export function evaluateFrontendDesignPolicy(input) {
+    const findings = sortFindings([
+        ...(input.designApproval ? checkDesignApproval(input.designApproval) : []),
+        ...checkUiDesignCoverage(input.contract),
+        ...checkSourceFreshness(input.contract, input.sourceFreshness),
+        ...checkMockStrategy(input.contract, input.allowedMockStrategies),
+        ...checkComponentChoice(input.contract, input.componentSpecCandidatePaths),
+        ...checkTargetPaths(input.contract, input.writeSetPatterns),
+        ...checkDependencies(input.contract, input.allowedDependencies),
+        ...checkUiStateAttribution(input.contract),
+    ]);
+    const classification = findings.length > 0 ? "blocked" : "approved";
+    const result = {
+        schemaId: "frontend-design-policy-v1",
+        classification,
+        findings,
+        digest: "",
+    };
+    result.digest = deterministicSha256({
+        schemaId: result.schemaId,
+        classification: result.classification,
+        findings: result.findings,
+    });
+    return result;
+}

package/dist/workflows/dag/frontend-human-decision.js

@@ -0,0 +1,182 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+const id = z.string().trim().min(1);
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const revision = z.number().int().positive();
+const instant = z.string().datetime();
+const factRef = z.object({ ref: id, digest }).strict();
+function canonicalValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (value !== null && typeof value === "object")
+        return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, canonicalValue(item)]));
+    return value;
+}
+export function canonicalFrontendHumanDecisionJson(value) {
+    return JSON.stringify(canonicalValue(value));
+}
+export function computeFrontendHumanDecisionDigest(value) {
+    return createHash("sha256").update(canonicalFrontendHumanDecisionJson(value), "utf8").digest("hex");
+}
+const baseEnvelope = {
+    operationId: id,
+    runId: id,
+    operationRevision: revision,
+    targetDigest: digest,
+    staleOnTargetDigestChange: z.literal(true),
+    expiresAt: instant.optional(),
+};
+const contractEnvelopeInput = z.object({ ...baseEnvelope, kind: z.literal("contract-decision"), resumeAction: z.literal("resume-contract"), payload: z.object({ questionFactIds: z.array(id).min(1) }).strict() }).strict();
+const highEnvelopeInput = z.object({ ...baseEnvelope, kind: z.literal("high-admission"), resumeAction: z.literal("admit-high"), payload: z.object({ admissionCandidateRef: factRef }).strict() }).strict();
+const splitEnvelopeInput = z.object({ ...baseEnvelope, kind: z.literal("split-materialization-approval"), resumeAction: z.literal("materialize-split"), payload: z.object({ splitManifestRef: factRef }).strict() }).strict();
+const baselineEnvelopeInput = z.object({ ...baseEnvelope, kind: z.literal("baseline-debt-acceptance"), resumeAction: z.literal("accept-baseline-debt"), payload: z.object({ baselineEvidenceRefs: z.array(factRef).min(1), candidateDigest: digest, commandDigest: digest, resultingPolicy: z.literal("allow-non-regression") }).strict() }).strict();
+const verificationEnvelopeInput = z.object({ ...baseEnvelope, kind: z.literal("verification-config"), resumeAction: z.literal("select-verification-config"), payload: z.object({ unresolvedEntrypointRefs: z.array(factRef).min(1), allowlistedResolvers: z.array(id).min(1) }).strict() }).strict();
+export const frontendHumanDecisionEnvelopeInputSchema = z.discriminatedUnion("kind", [contractEnvelopeInput, highEnvelopeInput, splitEnvelopeInput, baselineEnvelopeInput, verificationEnvelopeInput]);
+const envelopeSchemas = [contractEnvelopeInput.extend({ digest }).strict(), highEnvelopeInput.extend({ digest }).strict(), splitEnvelopeInput.extend({ digest }).strict(), baselineEnvelopeInput.extend({ digest }).strict(), verificationEnvelopeInput.extend({ digest }).strict()];
+const envelopeStructuralSchema = z.discriminatedUnion("kind", envelopeSchemas);
+export const frontendHumanDecisionEnvelopeSchema = envelopeStructuralSchema.superRefine((value, ctx) => {
+    const { digest: actual, ...payload } = value;
+    if (computeFrontendHumanDecisionDigest(payload) !== actual)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["digest"], message: "envelope digest mismatch" });
+});
+export function buildFrontendHumanDecisionEnvelope(raw) {
+    const payload = frontendHumanDecisionEnvelopeInputSchema.parse(raw);
+    return envelopeStructuralSchema.parse({ ...payload, digest: computeFrontendHumanDecisionDigest(payload) });
+}
+export function parseFrontendHumanDecisionEnvelope(value) { return frontendHumanDecisionEnvelopeSchema.parse(value); }
+const receiptBase = { operationId: id, runId: id, operationRevision: revision, targetDigest: digest, receiptId: id, envelopeDigest: digest, commitState: z.literal("committed"), consumeState: z.enum(["unconsumed", "consumed"]) };
+const resolutionFact = { resolutionFactRef: factRef };
+const contractReceiptInput = z.object({ ...receiptBase, kind: z.literal("contract-decision"), resumeAction: z.literal("resume-contract"), resolution: z.object({ questionFactIds: z.array(id).min(1), outcome: z.literal("resume-contract"), ...resolutionFact }).strict() }).strict();
+const highReceiptInput = z.object({ ...receiptBase, kind: z.literal("high-admission"), resumeAction: z.literal("admit-high"), resolution: z.object({ admissionCandidateRef: factRef, outcome: z.literal("admitted-high"), ...resolutionFact }).strict() }).strict();
+const splitReceiptInput = z.object({ ...receiptBase, kind: z.literal("split-materialization-approval"), resumeAction: z.literal("materialize-split"), resolution: z.object({ splitManifestRef: factRef, ...resolutionFact }).strict() }).strict();
+const baselineReceiptInput = z.object({ ...receiptBase, kind: z.literal("baseline-debt-acceptance"), resumeAction: z.literal("accept-baseline-debt"), resolution: z.object({ baselineEvidenceRefs: z.array(factRef).min(1), candidateDigest: digest, commandDigest: digest, resultingPolicy: z.literal("allow-non-regression"), outcome: z.literal("accepted-baseline-debt"), remediated: z.literal(false), ...resolutionFact }).strict() }).strict();
+const verificationReceiptInput = z.object({ ...receiptBase, kind: z.literal("verification-config"), resumeAction: z.literal("select-verification-config"), resolution: z.object({ entrypointRef: factRef, resolver: id, sourceDigest: digest, commandDigest: digest, ...resolutionFact }).strict() }).strict();
+export const frontendHumanDecisionReceiptInputSchema = z.discriminatedUnion("kind", [contractReceiptInput, highReceiptInput, splitReceiptInput, baselineReceiptInput, verificationReceiptInput]);
+const receiptStructuralSchema = z.discriminatedUnion("kind", [contractReceiptInput.extend({ digest }).strict(), highReceiptInput.extend({ digest }).strict(), splitReceiptInput.extend({ digest }).strict(), baselineReceiptInput.extend({ digest }).strict(), verificationReceiptInput.extend({ digest }).strict()]);
+export const frontendHumanDecisionReceiptSchema = receiptStructuralSchema.superRefine((value, ctx) => {
+    const { digest: actual, ...payload } = value;
+    if (computeFrontendHumanDecisionDigest(payload) !== actual)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["digest"], message: "receipt digest mismatch" });
+});
+export function buildFrontendHumanDecisionReceipt(raw) {
+    const payload = frontendHumanDecisionReceiptInputSchema.parse(raw);
+    return receiptStructuralSchema.parse({ ...payload, digest: computeFrontendHumanDecisionDigest(payload) });
+}
+export function parseFrontendHumanDecisionReceipt(value) { return frontendHumanDecisionReceiptSchema.parse(value); }
+const activeInput = z.object({ status: z.literal("active"), operationId: id, runId: id, revision }).strict();
+const blockedInput = z.object({ status: z.literal("blocked-human"), operationId: id, runId: id, revision, envelope: frontendHumanDecisionEnvelopeSchema }).strict();
+const resolvedInput = z.object({ status: z.literal("resolved"), operationId: id, runId: id, revision, receipt: frontendHumanDecisionReceiptSchema }).strict();
+export const frontendHumanDecisionProjectionInputSchema = z.discriminatedUnion("status", [activeInput, blockedInput, resolvedInput]);
+const projectionStructuralSchema = z.discriminatedUnion("status", [activeInput.extend({ digest }).strict(), blockedInput.extend({ digest }).strict(), resolvedInput.extend({ digest }).strict()]);
+export const frontendHumanDecisionProjectionSchema = projectionStructuralSchema.superRefine((value, ctx) => { const { digest: actual, ...payload } = value; if (computeFrontendHumanDecisionDigest(payload) !== actual)
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["digest"], message: "projection digest mismatch" }); });
+export function buildFrontendHumanDecisionProjection(raw) { const payload = frontendHumanDecisionProjectionInputSchema.parse(raw); return projectionStructuralSchema.parse({ ...payload, digest: computeFrontendHumanDecisionDigest(payload) }); }
+export function parseFrontendHumanDecisionProjection(value) { return frontendHumanDecisionProjectionSchema.parse(value); }
+const reject = (projection, reason) => ({ outcome: "rejected", reason, projection });
+export function materializeFrontendHumanDecision(input) {
+    const projection = parseFrontendHumanDecisionProjection(input.projection);
+    const envelope = parseFrontendHumanDecisionEnvelope(input.envelope);
+    if (projection.status !== "active")
+        return reject(projection, "projection is not active");
+    if (projection.revision !== input.expectedRecordRevision || projection.digest !== input.expectedProjectionDigest)
+        return reject(projection, "revision or projection digest conflict");
+    if (envelope.operationId !== projection.operationId || envelope.runId !== projection.runId || envelope.operationRevision !== projection.revision)
+        return reject(projection, "envelope binding mismatch");
+    return { outcome: "applied", projection: buildFrontendHumanDecisionProjection({ status: "blocked-human", operationId: projection.operationId, runId: projection.runId, revision: projection.revision + 1, envelope }) };
+}
+function receiptMatchesEnvelope(receipt, envelope) {
+    if (receipt.kind !== envelope.kind || receipt.resumeAction !== envelope.resumeAction || receipt.operationId !== envelope.operationId || receipt.runId !== envelope.runId || receipt.operationRevision !== envelope.operationRevision || receipt.targetDigest !== envelope.targetDigest || receipt.envelopeDigest !== envelope.digest)
+        return false;
+    switch (envelope.kind) {
+        case "contract-decision": return receipt.kind === envelope.kind && canonicalFrontendHumanDecisionJson(receipt.resolution.questionFactIds) === canonicalFrontendHumanDecisionJson(envelope.payload.questionFactIds);
+        case "high-admission": return receipt.kind === envelope.kind && canonicalFrontendHumanDecisionJson(receipt.resolution.admissionCandidateRef) === canonicalFrontendHumanDecisionJson(envelope.payload.admissionCandidateRef);
+        case "split-materialization-approval": return receipt.kind === envelope.kind && canonicalFrontendHumanDecisionJson(receipt.resolution.splitManifestRef) === canonicalFrontendHumanDecisionJson(envelope.payload.splitManifestRef);
+        case "baseline-debt-acceptance": return receipt.kind === envelope.kind && receipt.resolution.candidateDigest === envelope.payload.candidateDigest && receipt.resolution.commandDigest === envelope.payload.commandDigest && canonicalFrontendHumanDecisionJson(receipt.resolution.baselineEvidenceRefs) === canonicalFrontendHumanDecisionJson(envelope.payload.baselineEvidenceRefs);
+        case "verification-config": return receipt.kind === envelope.kind && envelope.payload.allowlistedResolvers.includes(receipt.resolution.resolver) && envelope.payload.unresolvedEntrypointRefs.some((item) => canonicalFrontendHumanDecisionJson(item) === canonicalFrontendHumanDecisionJson(receipt.resolution.entrypointRef));
+    }
+}
+export function consumeFrontendHumanDecision(input) {
+    const projection = parseFrontendHumanDecisionProjection(input.projection);
+    if (projection.status !== "blocked-human")
+        return reject(projection, "projection has no pending envelope");
+    const consumeInput = z.object({ expectedRecordRevision: revision, expectedProjectionDigest: digest, currentTargetDigest: digest, now: instant }).strict().safeParse({
+        expectedRecordRevision: input.expectedRecordRevision,
+        expectedProjectionDigest: input.expectedProjectionDigest,
+        currentTargetDigest: input.currentTargetDigest,
+        now: input.now,
+    });
+    if (!consumeInput.success)
+        return reject(projection, "invalid consume input");
+    const receipt = parseFrontendHumanDecisionReceipt(input.receipt);
+    if (projection.revision !== input.expectedRecordRevision || projection.digest !== input.expectedProjectionDigest)
+        return reject(projection, "revision or projection digest conflict");
+    if (input.currentTargetDigest !== projection.envelope.targetDigest) {
+        const payload = { kind: "frontend-human-decision-stale", operationId: projection.operationId, envelopeDigest: projection.envelope.digest, previousTargetDigest: projection.envelope.targetDigest, currentTargetDigest: input.currentTargetDigest };
+        return { outcome: "stale", reason: "target digest changed", projection, auditFact: { ...payload, digest: computeFrontendHumanDecisionDigest(payload) } };
+    }
+    if (projection.envelope.expiresAt && Date.parse(input.now) >= Date.parse(projection.envelope.expiresAt))
+        return reject(projection, "envelope expired");
+    if (receipt.commitState !== "committed" || receipt.consumeState !== "unconsumed" || !receiptMatchesEnvelope(receipt, projection.envelope))
+        return reject(projection, "receipt freshness or payload mismatch");
+    const { digest: _digest, ...receiptPayload } = receipt;
+    const consumed = buildFrontendHumanDecisionReceipt({ ...receiptPayload, consumeState: "consumed" });
+    return { outcome: "applied", projection: buildFrontendHumanDecisionProjection({ status: "resolved", operationId: projection.operationId, runId: projection.runId, revision: projection.revision + 1, receipt: consumed }) };
+}
+/* ------------------------------------------------------------------ *
+ * A+B producer/consumer wiring (no new envelope schema in the frozen  *
+ * five-kind union).                                                    *
+ * ------------------------------------------------------------------ */
+/**
+ * A+B (AC-002): contract `blocked` uniquely maps to `blocked-human`
+ * (contract-decision envelope) or `blocked-external` (wait-external), reusing
+ * the existing five-envelope schema without widening it. Any other disposition
+ * is `not-blocked`.
+ */
+export function mapContractBlockedOwner(input) {
+    if (input.disposition !== "blocked")
+        return "not-blocked";
+    return input.blockingOwner === "blocked-external"
+        ? "blocked-external"
+        : "blocked-human";
+}
+/**
+ * A+B (AC-007): High-topology `high-admission-receipt`. The receipt is a
+ * runtime-materialized catalog (not a sixth human-decision envelope): a receipt
+ * whose candidate digest matches the admission digest resolves to `accepted`;
+ * any digest drift resolves to `stale`.
+ */
+export const highAdmissionReceiptSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    schemaId: z.literal("high-admission-receipt-v1"),
+    candidateDigest: digest,
+    admissionDigest: digest,
+    status: z.enum(["accepted", "stale"]),
+})
+    .strict();
+export function evaluateHighAdmissionReceipt(input) {
+    return highAdmissionReceiptSchema.parse({
+        schemaVersion: 1,
+        schemaId: "high-admission-receipt-v1",
+        candidateDigest: input.candidateDigest,
+        admissionDigest: input.admissionDigest,
+        status: input.candidateDigest === input.admissionDigest
+            ? "accepted"
+            : "stale",
+    });
+}
+/**
+ * A+B (AC-008): verification-config routing. A verification-config signal
+ * either restarts the contract or produces a verification-config-decision
+ * (independent of the frozen `verification-config` envelope). Fail-closed to
+ * contract restart when the signal is untyped.
+ */
+export function routeVerificationConfig(input) {
+    const entrypointRefs = [...new Set(input.unresolvedEntrypointRefs)].filter((item) => item.length > 0);
+    return {
+        decision: entrypointRefs.length > 0
+            ? "verification-config-decision"
+            : "contract-restart",
+        entrypointRefs,
+    };
+}