@telora/daemon 0.21.26 → 0.21.81

package/dist/verify/verification-default-on.js

@@ -0,0 +1,272 @@
+/**
+ * Default-on deterministic verification: selection + concurrency cap.
+ *
+ * The deterministic verification method used to be opt-in (a delivery only ran
+ * a check when it carried an explicit verification_method). This module makes
+ * it the DEFAULT for every delivery entering verify: it discovers verify-status
+ * deliveries with no explicit method and synthesizes a `deterministic`
+ * PendingVerification carrying the config-default command, and it caps
+ * concurrent daemon-side runs so a burst cannot spawn N whole-repo suites.
+ *
+ * Extracted from verification-engine.ts to keep that file under the daemon
+ * 800-line limit. The dispatch (runVerificationForDelivery / runVerificationTick)
+ * stays in verification-engine.ts and imports from here.
+ *
+ * @module verification-default-on
+ */
+import { DELIVERY_STATUS } from '@telora/daemon-core';
+import { DEFAULT_VERIFY_MAX_CONCURRENT } from './verification-config.js';
+import { resolveVerifyManifestPath } from './verification-manifest.js';
+import { configForProduct } from '../shell/config.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'verification' });
+// ---------------------------------------------------------------------------
+// Concurrency cap
+// ---------------------------------------------------------------------------
+/**
+ * Counting semaphore capping concurrent daemon-side verification runs.
+ *
+ * A default-on deterministic run is a full build+test sweep (minutes). The
+ * verification tick passes `skipIfRunning`, so ticks themselves no longer
+ * overlap; the cap guards the remaining fan-out (multiple products within one
+ * tick, and any future callers outside the latched tick). The module-level
+ * singleton below is shared across every invocation, so the cap holds
+ * globally, not just within one call.
+ *
+ * A dedicated semaphore (rather than the shared ResourceGovernor) because the
+ * governor's per-engine slots model agent-team spawns and are wired through
+ * the governor-construction path; runVerificationTick is invoked with only
+ * `config` and has no governor handle. The cap value comes from
+ * resolveDefaultVerification (maxConcurrent).
+ */
+export class VerificationSemaphore {
+    permits;
+    limit;
+    waiters = [];
+    constructor(limit) {
+        this.limit = Math.max(1, limit);
+        this.permits = this.limit;
+    }
+    /** Adjust the cap (config change between ticks). Only frees waiters on a raise. */
+    setLimit(limit) {
+        const next = Math.max(1, limit);
+        if (next === this.limit)
+            return;
+        const delta = next - this.limit;
+        this.limit = next;
+        this.permits += delta;
+        while (this.permits > 0 && this.waiters.length > 0) {
+            const w = this.waiters.shift();
+            this.permits--;
+            w?.();
+        }
+    }
+    async acquire() {
+        if (this.permits > 0) {
+            this.permits--;
+            return;
+        }
+        await new Promise((resolve) => this.waiters.push(resolve));
+    }
+    release() {
+        const w = this.waiters.shift();
+        if (w) {
+            w();
+        }
+        else if (this.permits < this.limit) {
+            this.permits++;
+        }
+    }
+    /** Test-only: how many permits are currently available. */
+    availablePermits() {
+        return this.permits;
+    }
+}
+/** Shared cap across all tick invocations. Sized from config at each tick. */
+export const verificationSemaphore = new VerificationSemaphore(1);
+/** Test-only: inspect the concurrency semaphore. */
+export function __getVerificationSemaphoreForTests() {
+    return verificationSemaphore;
+}
+/**
+ * Resolve the default-on verification config for every product, from each
+ * product's OWN scoped config.
+ *
+ * WHY per-product (this is the whole point): the repo-manifest layer is read
+ * from `config.repoPath`, so resolution is only meaningful on a product-scoped
+ * config. A multi-product `daemon.json` (products[] each with their own
+ * repoPath) carries no meaningful TOP-LEVEL repoPath -- `config.ts:158` falls
+ * back to `process.cwd()`, the daemon's LAUNCH DIRECTORY. Resolving once from
+ * the un-scoped config therefore made every product's gate a function of where
+ * the daemon happened to be started: launched outside a repo -> no manifest ->
+ * silently inert; launched inside one product's repo -> that repo's command
+ * applied to every OTHER product's deliveries. Neither is a gate.
+ *
+ * Error containment: `resolveDefaultVerification` THROWS on a malformed
+ * manifest by design (verification-manifest.ts -- a typo must never silently
+ * un-arm the gate). Per-product, an uncaught throw would kill the tick for every
+ * product including healthy ones, so it is contained HERE: logged at ERROR
+ * naming the product and the manifest path (every tick -- a persistent,
+ * operator-visible state, never a debug line), and that product's `resolved`
+ * comes back `undefined` so its default-on scan stays off while other products
+ * keep gating. The product's EXPLICIT-method deliveries still verify: they carry
+ * their own command on the delivery row, so a repo-root manifest typo has no
+ * bearing on them and must not disarm them.
+ */
+export function resolveProductVerificationScopes(config, resolve) {
+    return config.products.map((product) => {
+        const productConfig = configForProduct(config, product);
+        try {
+            return { product, productConfig, resolved: resolve(productConfig) };
+        }
+        catch (err) {
+            log.error(`[verification] default-on config unresolvable for product ${product.id} `
+                + `(manifest: ${resolveVerifyManifestPath(productConfig.repoPath)}): `
+                + `${err.message} -- this product's default-on gate is OFF until it is fixed; `
+                + `its explicit-method deliveries and all other products are unaffected.`);
+            return { product, productConfig, resolved: undefined };
+        }
+    });
+}
+/**
+ * Resolve the ONE daemon-wide concurrency cap for the shared semaphore.
+ *
+ * The cap is DAEMON-WIDE, not per-product, and deliberately so: the semaphore is
+ * a module-level singleton and the resource it protects is the daemon's HOST
+ * (CPU/RAM/disk for a minutes-long build+test sweep), which every product shares.
+ * Three products each declaring `maxConcurrent: 3` must not mean 9 concurrent
+ * suites on one box. So a single value must be chosen -- and simply calling
+ * `setLimit` inside the per-product loop would be incoherent: the LAST product
+ * iterated would silently win for the rest of the tick.
+ *
+ * RULE: the minimum across the products that resolved one. Chosen because:
+ *  - it is order-independent (min is commutative), so no "last product wins";
+ *  - it is fail-safe -- the cap never exceeds any declaration, and over-capping
+ *    only slows a tick where under-capping can thrash the host;
+ *  - it keeps every layer's declaration live rather than silently dropping the
+ *    manifest's `maxConcurrent`. Each product still resolves through the full
+ *    env > operator file > manifest chain, so an operator setting the env var or
+ *    the global block pins EVERY product's value and therefore the min: the
+ *    operator, who alone knows the box, always has the last word. A repo can
+ *    only make the daemon more conservative than the operator's setting, never
+ *    less.
+ * Stated plainly: the daemon runs at most as many concurrent suites as the most
+ * conservative managed repo allows.
+ *
+ * No resolved values at all (every product's manifest malformed) => the
+ * conservative floor, not a stale limit from a previous tick.
+ */
+export function resolveDaemonWideVerifyCap(scopes) {
+    const declared = scopes
+        .map((s) => s.resolved?.maxConcurrent)
+        .filter((n) => typeof n === 'number');
+    if (declared.length === 0)
+        return DEFAULT_VERIFY_MAX_CONCURRENT;
+    return Math.min(...declared);
+}
+// ---------------------------------------------------------------------------
+// Steady-state re-run guard
+// ---------------------------------------------------------------------------
+/**
+ * A delivery synthesized by the default-on scan is NOT filtered server-side
+ * (the edge `daemon_get_pending_verifications` only returns explicit-method
+ * rows), so without a guard a delivery sitting in verify -- e.g. awaiting a
+ * review window -- would re-run the whole-repo suite on every verification
+ * tick. This set records deliveries whose default-on run has already been
+ * dispatched during THIS daemon run; a delivery is pruned the moment it is no
+ * longer observed in verify (so a genuine re-entry re-runs). Across a daemon
+ * restart the set is empty, so at most one extra run per stuck-in-verify
+ * delivery -- bounded and idempotent.
+ */
+const defaultOnRan = new Set();
+/** Test-only: reset the default-on re-run guard. */
+export function __resetDefaultOnGuardForTests() {
+    defaultOnRan.clear();
+}
+/** Test-only: snapshot of the default-on re-run guard. */
+export function __getDefaultOnGuardForTests() {
+    return defaultOnRan;
+}
+/** Mark a delivery as already run this verify-entry (dispatch-time bookkeeping). */
+export function markDefaultOnRan(deliveryId) {
+    defaultOnRan.add(deliveryId);
+}
+/** Test-only alias for markDefaultOnRan. */
+export function __markDefaultOnRanForTests(deliveryId) {
+    defaultOnRan.add(deliveryId);
+}
+// ---------------------------------------------------------------------------
+// Selection
+// ---------------------------------------------------------------------------
+/**
+ * Discover deliveries that should receive a DEFAULT-ON deterministic run: in
+ * `verify` status, anchored to an injection, with no explicit verification
+ * method (so not already returned by getPendingVerifications), not in a
+ * read-only audit focus (those are discovery-only and never run a suite), and
+ * not already run this verify-entry (steady-state guard).
+ *
+ * Synthesizes a `deterministic` PendingVerification carrying the resolved
+ * config-default command + timeout. Returns [] when the default-on path is
+ * disabled (no command configured) so the feature is inert until opted in.
+ *
+ * `config` must be product-scoped (config.productId identifies the product).
+ */
+export async function collectDefaultOnVerifications(config, resolved, explicitDeliveryIds, deps) {
+    if (!resolved.enabled)
+        return [];
+    const focuses = await deps.getActiveFocuses(config.organizationId, config.productId);
+    const candidates = [];
+    const observedInVerify = new Set();
+    for (const focus of focuses) {
+        // Read-only audit/discovery focuses terminalize on Context Group findings;
+        // they must never trigger a whole-repo suite.
+        if (focus.read_only === true)
+            continue;
+        let deliveries;
+        try {
+            deliveries = await deps.getFocusDeliveries(focus.focus_id);
+        }
+        catch (err) {
+            log.warn(`[verification] default-on: failed to fetch deliveries for focus ${focus.focus_id.slice(0, 8)}:`, err.message);
+            continue;
+        }
+        for (const d of deliveries) {
+            if (d.executionStatus !== DELIVERY_STATUS.VERIFY)
+                continue;
+            // The default-on path retires an injection on pass, so it requires an
+            // injection anchor. Unanchored deliveries fall through to focus-level review.
+            if (!d.injectionId)
+                continue;
+            // An explicit-method delivery is already handled by getPendingVerifications.
+            if (explicitDeliveryIds.has(d.id))
+                continue;
+            observedInVerify.add(d.id);
+            if (defaultOnRan.has(d.id))
+                continue; // already ran this verify-entry
+            candidates.push({
+                deliveryId: d.id,
+                deliveryName: d.name,
+                productId: config.productId,
+                focusId: focus.focus_id,
+                injectionNodeId: d.injectionId,
+                verificationMethod: 'deterministic',
+                verificationConfig: { command: resolved.command, timeoutMs: resolved.timeoutMs },
+                verificationOutcome: null,
+                verificationLastRunAt: null,
+                // Recorded git state travels with the verification so the evidence
+                // resolver can judge an already-merged-back delivery from its own merge
+                // commit rather than reporting blindness.
+                gitState: d.gitState,
+                mergeCommitSha: d.mergeCommitSha,
+            });
+        }
+    }
+    // Prune guard entries for deliveries no longer sitting in verify, so a
+    // genuine re-entry (verify_failed -> coding -> verify) runs again.
+    for (const id of [...defaultOnRan]) {
+        if (!observedInVerify.has(id))
+            defaultOnRan.delete(id);
+    }
+    return candidates;
+}
+//# sourceMappingURL=verification-default-on.js.map

package/dist/verify/verification-default-on.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-default-on.js","sourceRoot":"","sources":["../../src/verify/verification-default-on.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAGzE,OAAO,EAAE,6BAA6B,EAAoC,MAAM,0BAA0B,CAAC;AAC3G,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAarD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACxB,OAAO,CAAS;IAChB,KAAK,CAAS;IACL,OAAO,GAAsB,EAAE,CAAC;IAEjD,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;IAC5B,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,KAAa;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO;QAChC,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;QACtB,OAAO,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,CAAC,EAAE,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,gBAAgB;QACd,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAElE,oDAAoD;AACpD,MAAM,UAAU,kCAAkC;IAChD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,MAAoB,EACpB,OAAyD;IAEzD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CACP,6DAA6D,OAAO,CAAC,EAAE,GAAG;kBACxE,cAAc,yBAAyB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK;kBACpE,GAAI,GAAa,CAAC,OAAO,+DAA+D;kBACxF,uEAAuE,CAC1E,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA2C;IAE3C,MAAM,QAAQ,GAAG,MAAM;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAC;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AAEvC,oDAAoD;AACpD,MAAM,UAAU,6BAA6B;IAC3C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,2BAA2B;IACzC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAoB,EACpB,QAAqC,EACrC,mBAAwC,EACxC,IAAuB;IAEvB,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QAEvC,IAAI,UAA0D,CAAC;QAC/D,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,mEAAmE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAC/F,GAAa,CAAC,OAAO,CACvB,CAAC;YACF,SAAS;QACX,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,eAAe,KAAK,eAAe,CAAC,MAAM;gBAAE,SAAS;YAC3D,sEAAsE;YACtE,8EAA8E;YAC9E,IAAI,CAAC,CAAC,CAAC,WAAW;gBAAE,SAAS;YAC7B,6EAA6E;YAC7E,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YAE5C,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS,CAAC,gCAAgC;YAEtE,UAAU,CAAC,IAAI,CAAC;gBACd,UAAU,EAAE,CAAC,CAAC,EAAE;gBAChB,YAAY,EAAE,CAAC,CAAC,IAAI;gBACpB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,KAAK,CAAC,QAAQ;gBACvB,eAAe,EAAE,CAAC,CAAC,WAAW;gBAC9B,kBAAkB,EAAE,eAAe;gBACnC,kBAAkB,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;gBAChF,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,IAAI;gBAC3B,mEAAmE;gBACnE,wEAAwE;gBACxE,0CAA0C;gBAC1C,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,cAAc;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/verify/verification-deps.d.ts

@@ -0,0 +1,191 @@
+/**
+ * The verification engine's injectable dependency surface.
+ *
+ * Split out of `verification-engine.ts` (which holds the dispatch + tick logic)
+ * because this is a CONTRACT, not behavior: every seam the engine reaches
+ * reality through -- pending-verification reads, the injection flip, target
+ * reconciliation, escalation filing, drift emission, the three strategies, cwd
+ * and commit-set resolution, the security gate, and the three feedback re-entry
+ * paths -- is declared here, and every test that drives the engine constructs
+ * one of these. The wiring that fills it (`defaultDeps`) stays in the engine,
+ * next to the imports it binds.
+ *
+ * Type-only module: no runtime imports, so it adds no edge to the module graph
+ * that `import-x/no-cycle` has to reason about.
+ *
+ * @module verification-deps
+ */
+import type { StrategyResult } from './verification-deterministic.js';
+import type { runDeterministicStrategy } from './verification-deterministic.js';
+import type { getPendingVerifications, PendingVerification, VerificationOutcome } from '../queries/verification.js';
+import type { NodeWriteback } from '../reality/reality-writeback.js';
+import type { ReconcileTargetsResult, TargetRestatement, TargetShortfall, VerifyEvidence } from './verify-restatement.js';
+import type { FileEscalationInput } from '../completion/escalations.js';
+import type { EvidenceUnavailableDetail } from '../queries/delivery-gate-state.js';
+import type { DaemonConfig } from '../types/index.js';
+import type { ResolvedDefaultVerification } from './verification-config.js';
+import type { getActiveFocuses } from '../queries/deliveries.js';
+import type { getFocusDeliveries } from '../queries/focuses.js';
+import type { AiInspectionInputs } from './ai-inspection-context.js';
+import type { runAiInspection as defaultRunAiInspection } from './ai-inspection-runner.js';
+import type { SecurityFindingGateDeps } from '../security/security-finding-gate.js';
+import type { FailureClassification } from './verification-baseline.js';
+export interface DriftProposalCreatePayload {
+    focusId: string | null;
+    productId: string | null;
+    injectionNodeId: string;
+    observation: {
+        nodeId: string | null;
+        kind: 'update_statement' | 'add_node' | 'retire_node' | 'change_node_type' | 'flip_ude_to_de';
+        observed: string;
+        suggestedCorrection: string;
+    };
+}
+export interface VerificationDeps {
+    getPendingVerifications: typeof getPendingVerifications;
+    recordOutcome: (deliveryId: string, outcome: VerificationOutcome) => Promise<void>;
+    verifyInjection: (injectionNodeId: string, restatements?: TargetRestatement[]) => Promise<void>;
+    /**
+     * Reconcile the declared desired effect against the achieved outcome (authored
+     * from the supplied EVIDENCE -- diff/tests/inspection, NOT the UDE problem text)
+     * for each UDE the injection targets, classifying match / legitimate_divergence
+     * / shortfall. match / legitimate_divergence come back in `restatements` for the
+     * engine to carry INTO the verify call; shortfalls come back in `shortfalls` so
+     * the engine can hold the gate and escalate. The edge applies the supplied prose
+     * + classification; it never runs the LLM.
+     */
+    authorTargetRestatements?: (injectionNodeId: string, focusId: string | null, evidence: VerifyEvidence, 
+    /**
+     * True when the resolved diff range does not cover the delivery's recorded
+     * commit set (half-blind). Treated the same as an empty bundle: the gate
+     * declines to render a verdict and returns the instrument-fault signal.
+     */
+    evidenceIncomplete: boolean) => Promise<ReconcileTargetsResult>;
+    /**
+     * File a human escalation when an injection's achieved outcome falls SHORT of
+     * its declared desired effect. Reality is asymmetric: we never soften the
+     * declared DE to match a lesser achievement -- we hold the gate and hand the
+     * gap to the intent owner.
+     */
+    fileEscalation: (input: FileEscalationInput) => Promise<void>;
+    /** Org scope for filed escalations. */
+    organizationId: string;
+    /** Persist a single drift proposal observed during ai_inspection. */
+    emitDriftProposal: (payload: DriftProposalCreatePayload) => Promise<void>;
+    /**
+     * Surface INWARD drift proposals (TEL-4): for each target the verify path
+     * stamped `legitimate_divergence`, create one `update_statement` drift
+     * proposal flagged `inward:true` so a confident-but-wrong tree claim is
+     * corrected by drift rather than frozen. Best-effort + non-fatal: a failure
+     * here must not undo the verify flip that already landed. Defaults to the
+     * `emitInwardDriftProposals` seam in queries/verification.
+     */
+    emitInwardDrift: (injectionNodeId: string, writebacks: readonly NodeWriteback[], realityTreeId?: string) => Promise<void>;
+    runDeterministic: typeof runDeterministicStrategy;
+    runAiInspection: typeof defaultRunAiInspection;
+    resolveAiInspectionInputs: (v: PendingVerification) => Promise<AiInspectionInputs | null>;
+    resolveCwd: (productId: string | null) => string;
+    integrationBranch: string;
+    /**
+     * Security workflow verify-closed gate. Consulted before
+     * `verifyInjection` so a security-linked injection cannot be retired
+     * unless the linked finding has flipped to 'resolved'. On failure the
+     * gate escalates the finding (status='escalated', reason='verify_gate_failed')
+     * and the engine demotes the verification outcome to 'failed'.
+     */
+    securityFindingGate: SecurityFindingGateDeps;
+    /**
+     * Resolve the default-on deterministic verification config (env > file >
+     * default). When it yields `enabled: false` (no command configured) the
+     * default-on scan is a no-op and only explicit-method deliveries verify.
+     */
+    resolveDefaultVerification: (config: DaemonConfig) => ResolvedDefaultVerification;
+    /** Enumerate active focuses for a product (default-on candidate discovery). */
+    getActiveFocuses: typeof getActiveFocuses;
+    /** Fetch a focus's deliveries (default-on candidate discovery). */
+    getFocusDeliveries: typeof getFocusDeliveries;
+    /** Failed-run feedback (gate_state + live inject). Optional; defaultDeps provides it. */
+    deliverFailureFeedback?: (v: PendingVerification, result: StrategyResult) => Promise<void>;
+    /**
+     * Shortfall-origin re-work re-entry: route the delivery verify -> verify_failed
+     * through the single-writer reconciler (carrying the declared-vs-achieved gap in
+     * gate_state under the shortfall guard) so it re-enters bounded re-work instead
+     * of a human inbox, and live-inject the gap into a running coding team.
+     * Distinct from deliverFailureFeedback so a shortfall hold never reports under
+     * the deterministic guard. Optional; defaultDeps provides it (requeueShortfallAsRework).
+     */
+    deliverShortfallFeedback?: (v: PendingVerification, shortfalls: readonly TargetShortfall[]) => Promise<void>;
+    /**
+     * Instrument-fault re-work re-entry: the verify path was handed no evidence it
+     * could judge the work against (an empty bundle). Routes the delivery
+     * verify -> verify_failed through the single-writer reconciler (carrying the
+     * instrument-fault context in gate_state under the evidence-unavailable guard)
+     * so it re-enters the EXISTING bounded verify_failed re-work cycle, and
+     * live-injects the fault into a running coding team. Files NO escalation --
+     * "fix the diff range / confirm the merge" names no act only a human can
+     * perform, so an empty bundle never reaches a human inbox
+     * (verify_gate_unclearable, from the iteration cap, is the sole residue).
+     * Optional; defaultDeps provides it (requeueEvidenceUnavailableAsRework).
+     */
+    requeueEvidenceUnavailableAsRework?: (v: PendingVerification, fault: Omit<EvidenceUnavailableDetail, 'heldAt'>) => Promise<void>;
+    /** cwd for the HEAD run -- the focus worktree. Optional; dispatch falls back to resolveCwd. */
+    resolveVerificationCwd?: (v: PendingVerification) => string;
+    /**
+     * Count of commits the delivery branch is ahead of the integration base.
+     * Used by the evidence-integrity guard to tell a broken diff MEASUREMENT
+     * (commits present but diff empty -> hold) from genuine inaction (no commits
+     * -> a real shortfall). Optional; defaultDeps resolves it in the focus worktree.
+     */
+    resolveCommitsAhead?: (v: PendingVerification) => number;
+    /**
+     * Resolve the delivery's RECORDED constituent commit shas (focus_merges.commit_shas)
+     * for the merge_commit_sha the row carries -- the durable attribution written at
+     * merge time. The verify diff resolver prefers this over live branch topology so a
+     * fast-forwarded or rebased merge-back is judged against the delivery's real commit
+     * set, not a truncated trailing-commit range. Returns [] when no record exists (the
+     * resolver then falls through to topology). Optional; defaultDeps provides it.
+     */
+    resolveRecordedCommitShas?: (v: PendingVerification) => Promise<string[]>;
+    /**
+     * Resolve the delivery's RECORDED pre-merge boundary (focus_merges.pre_merge_ref)
+     * for the merge_commit_sha the row carries. The verify diff resolver uses
+     * `<preMergeRef>...<mergeCommitSha>` as a FAST-FORWARD-safe range when the
+     * merge-back produced no merge commit -- an INDEPENDENT source from
+     * resolveRecordedCommitShas (a scalar that survives an empty commit_shas array).
+     * Returns null when no boundary was recorded (the resolver then falls through to
+     * its remaining sources). Optional; defaultDeps provides it.
+     */
+    resolveRecordedPreMergeRef?: (v: PendingVerification) => Promise<string | null>;
+    /**
+     * Detect a TOTAL ATTRIBUTION FAILURE: the recorded merge batch carries ZERO
+     * parseable Telora-Delivery trailers on a focus with MORE THAN ONE delivery.
+     * Such a batch is un-partitionable AND cannot be the genuine single-delivery
+     * legacy case, so returning the whole set as this delivery's evidence would
+     * judge it against the combined sibling diff (a confident verdict on the wrong
+     * evidence). Returns the batch/deliveries sizes when it IS such a failure, or
+     * null otherwise (partitionable batch, single-delivery focus, or no record).
+     * The engine forces the evidence-unavailable non-verdict path on non-null.
+     * Optional; defaultDeps provides it.
+     */
+    resolveAttributionFailure?: (v: PendingVerification) => Promise<{
+        batch: number;
+        deliveries: number;
+    } | null>;
+    /**
+     * Detect an INSTRUMENT-READ fault: the durable record could not be READ at all
+     * (the focus_merge_list API was unreachable), as distinct from an honest empty
+     * record. Returns the seam that could not be determined + the underlying reason
+     * when the read was UNDETERMINED, or null when the record was read successfully
+     * (whether it held evidence or was confirmed empty). The engine uses this, on
+     * the fully-blind evidence-unavailable path, to report the blindness as a
+     * READ fault naming the seam rather than "there is nothing here". Optional;
+     * defaultDeps provides it.
+     */
+    resolveEvidenceInstrumentFault?: (v: PendingVerification) => Promise<{
+        seam: string;
+        reason: string;
+    } | null>;
+    /** Baseline-diff attribution; null => no baseline resolvable (gate all). Optional. */
+    attributeFailures?: (v: PendingVerification, result: StrategyResult) => Promise<FailureClassification | null>;
+}
+//# sourceMappingURL=verification-deps.d.ts.map

package/dist/verify/verification-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-deps.d.ts","sourceRoot":"","sources":["../../src/verify/verification-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EACV,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,EAAE,kBAAkB,GAAG,UAAU,GAAG,aAAa,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;QAC9F,QAAQ,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,eAAe,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,iBAAiB,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,CACzB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,QAAQ,EAAE,cAAc;IACxB;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,KACxB,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC;;;;;OAKG;IACH,cAAc,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uCAAuC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,eAAe,EAAE,CACf,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,OAAO,wBAAwB,CAAC;IAClD,eAAe,EAAE,OAAO,sBAAsB,CAAC;IAC/C,yBAAyB,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC1F,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,EAAE,uBAAuB,CAAC;IAE7C;;;;OAIG;IACH,0BAA0B,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,2BAA2B,CAAC;IAClF,+EAA+E;IAC/E,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C,mEAAmE;IACnE,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,EAAE,SAAS,eAAe,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7G;;;;;;;;;;;OAWG;IACH,kCAAkC,CAAC,EAAE,CACnC,CAAC,EAAE,mBAAmB,EACtB,KAAK,EAAE,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,KAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,+FAA+F;IAC/F,sBAAsB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,MAAM,CAAC;IAC5D;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,MAAM,CAAC;IACzD;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChF;;;;;;;;;;OAUG;IACH,yBAAyB,CAAC,EAAE,CAC1B,CAAC,EAAE,mBAAmB,KACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,8BAA8B,CAAC,EAAE,CAC/B,CAAC,EAAE,mBAAmB,KACnB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtD,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC/G"}

package/dist/verify/verification-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-deps.js","sourceRoot":"","sources":["../../src/verify/verification-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/dist/verify/verification-deterministic.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Deterministic verification strategy: run a shell command and map exit 0 to a
+ * pass, streaming the full stdout+stderr to a persistent log file under the
+ * daemon state dir.
+ *
+ * Extracted from verification-engine.ts (which owns dispatch + the pass-path
+ * side effects) to keep that file under the daemon 800-line limit. The
+ * StrategyResult shape lives here because this is the strategy that produces
+ * every field on it; verification-engine imports the type back.
+ *
+ * @module verification-deterministic
+ */
+import type { VerificationOutcome } from '../queries/verification.js';
+/** Default deterministic timeout when the config sets none: 5 minutes. */
+export declare const DEFAULT_VERIFICATION_TIMEOUT_MS: number;
+export interface StrategyResult {
+    outcome: VerificationOutcome;
+    rationale?: string;
+    exitCode?: number | null;
+    stdoutTail?: string;
+    stderrTail?: string;
+    /**
+     * Absolute path to the persistent full-log file for a deterministic run
+     * (full stdout+stderr, not just the 4000-char tails). Written under the
+     * daemon state dir. Undefined when no log sink was supplied (e.g. a strategy
+     * that runs no shell command). Carried on the result so the feedback loop
+     * (gate_state) can point at it.
+     */
+    logPath?: string;
+    /** Delivery diff against integration, when the strategy resolved one (ai_inspection). */
+    deliveryDiff?: string;
+    /** Baseline-diff attribution: NEW failures the focus introduced (these gate). */
+    newFailures?: string[];
+    /** Baseline-diff attribution: pre-existing base failures (recorded, non-blocking). */
+    preExisting?: string[];
+}
+/**
+ * Context for persisting a deterministic run's full log to a file. When
+ * supplied, runDeterministicStrategy streams the complete stdout+stderr to
+ * `<stateDir>/verification/verification-<deliveryId>-<startedAtMs>.log` and
+ * returns the absolute path on the result. Optional so unit tests that only
+ * assert exit-code handling can omit it (no file written).
+ */
+export interface DeterministicLogContext {
+    deliveryId: string;
+    /** Millisecond timestamp for a stable, unique filename (injectable for tests). */
+    startedAtMs: number;
+    /** Override the log directory (defaults to <stateDir>/verification). */
+    logDir?: string;
+}
+/**
+ * Run a configured shell command in the focus's worktree (or the product
+ * repo path as fallback). Pass = exit 0.
+ */
+export declare function runDeterministicStrategy(config: Record<string, unknown> | null, cwd: string, logContext?: DeterministicLogContext): Promise<StrategyResult>;
+//# sourceMappingURL=verification-deterministic.d.ts.map

package/dist/verify/verification-deterministic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-deterministic.d.ts","sourceRoot":"","sources":["../../src/verify/verification-deterministic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAOtE,0EAA0E;AAC1E,eAAO,MAAM,+BAA+B,QAAgB,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACtC,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,uBAAuB,GACnC,OAAO,CAAC,cAAc,CAAC,CAiIzB"}