@telora/daemon 0.21.26 → 0.21.81

package/dist/verify/verification-engine.js

@@ -0,0 +1,717 @@
+/**
+ * Pluggable verification engine -- Differential Focus Spec.
+ *
+ * Each delivery is the materialization of an injection. When the delivery
+ * reaches the 'verify' execution status, this engine selects a strategy
+ * based on the delivery's verification_method and runs it. On a 'passed'
+ * outcome the injection is retired (its FRT statement promotes to CRT)
+ * via the existing reality_tree_verify_injection compound op.
+ *
+ * Per-delivery verification is opt-in: it runs only when a delivery carries
+ * an explicit method. A delivery with no method does not block -- focus-level
+ * AI review is the sole verify->done authority. Humans observe via the focus
+ * debug tab, never via a gate.
+ *
+ * Methods:
+ *   deterministic   -- run a shell command (tests, lint, types). Pass = exit 0.
+ *   behavioral      -- runtime telemetry observation (scaffold; needs drift
+ *                      detection from delivery 82bdf164 to provide signal).
+ *   ai_inspection   -- AI reads code/state and decides (scaffold; needs an
+ *                      AI inspection driver that walks the reality tree in
+ *                      conversation via `telora_reality_tree_*` MCP calls).
+ *
+ * @module verification-engine
+ */
+import { runDeterministicStrategy } from './verification-deterministic.js';
+export { runDeterministicStrategy } from './verification-deterministic.js';
+import { getPendingVerifications, recordDeliveryVerificationOutcome, verifyInjectionOnPass, emitInwardDriftProposals, } from '../queries/verification.js';
+import { configForProduct } from '../shell/config.js';
+import { authorTargetRestatements as defaultAuthorTargetRestatements, } from './verify-restatement.js';
+import { fileEscalation as defaultFileEscalation } from '../completion/escalations.js';
+import { getCommitsAhead, filterCommitsByDelivery, selectDeliveryCommitsAcrossBatches, batchHasAnyTrailer, diagnoseEmptyDiffSource } from '../resolvers/index.js';
+import { getActiveFocuses } from '../queries/deliveries.js';
+import { resolveDefaultVerification as defaultResolveDefaultVerification } from './verification-config.js';
+import { getFocusDeliveries } from '../queries/focuses.js';
+import { collectDefaultOnVerifications, markDefaultOnRan, resolveDaemonWideVerifyCap, resolveProductVerificationScopes, verificationSemaphore, } from './verification-default-on.js';
+import { deliverVerificationFailureFeedback, requeueShortfallAsRework, requeueEvidenceUnavailableAsRework } from './verification-feedback.js';
+import { buildDefaultAttributeFailures, buildResolveVerificationCwd, applyAttribution } from './verification-baseline.js';
+// Re-export the default-on selection + concurrency surface so existing
+// importers (and tests) can reach it through verification-engine.
+export { collectDefaultOnVerifications, resolveDaemonWideVerifyCap, resolveProductVerificationScopes, verificationSemaphore, VerificationSemaphore, __getVerificationSemaphoreForTests, __resetDefaultOnGuardForTests, __getDefaultOnGuardForTests, __markDefaultOnRanForTests, } from './verification-default-on.js';
+import { resolveAiInspectionInputs as defaultResolveAiInspectionInputs } from './ai-inspection-context.js';
+import { runAiInspection as defaultRunAiInspection, } from './ai-inspection-runner.js';
+import { buildDefaultSecurityFindingGateDeps, evaluateFindingNoLongerPresent, escalateOnGateFail, } from '../security/security-finding-gate.js';
+import { callApi } from '../queries/shared.js';
+import { runInstallProbeTick } from '../shell/install-probe-tick.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'verification' });
+// ---------------------------------------------------------------------------
+// Strategies
+// ---------------------------------------------------------------------------
+export async function runBehavioralStrategy() {
+    return {
+        outcome: 'pending',
+        rationale: 'behavioral strategy scaffold -- runtime telemetry source not yet wired (see drift detection 82bdf164)',
+    };
+}
+/**
+ * Spawn a tool-augmented Claude runner against the focus worktree to judge
+ * whether the injection's FRT statement holds in the code state. Maps the
+ * runner verdict to a verification outcome:
+ *   - passed       → outcome 'passed' (caller will retire injection)
+ *   - failed       → outcome 'failed' (caller will revert delivery to coding)
+ *   - inconclusive → outcome 'pending' (caller leaves the row in queue)
+ *
+ * The strategy itself does NOT call verifyInjection or emit drift proposals;
+ * those side effects are wired by runVerificationForDelivery (next task)
+ * so the dispatch layer stays the single owner of the pass-path side effect.
+ *
+ * Drift observations from the runner are returned via the rationale field
+ * (compact JSON) so the caller can persist them as crt_drift_proposals.
+ */
+export async function runAiInspectionStrategy(deps, v) {
+    const inputs = await deps.resolveAiInspectionInputs(v);
+    if (!inputs) {
+        return {
+            outcome: 'pending',
+            rationale: 'ai_inspection skipped: injection node not found',
+        };
+    }
+    const inspection = await deps.runAiInspection(inputs);
+    const outcome = inspection.verdict === 'passed' ? 'passed'
+        : inspection.verdict === 'failed' ? 'failed'
+            : 'pending';
+    return {
+        outcome,
+        rationale: inspection.rationale,
+        deliveryDiff: inputs.deliveryDiff,
+        inspection,
+    };
+}
+async function defaultEmitDriftProposal(payload) {
+    await callApi('crt_drift_proposal_create', {
+        focusId: payload.focusId,
+        productId: payload.productId,
+        nodeId: payload.observation.nodeId,
+        proposalKind: payload.observation.kind,
+        observedState: payload.observation.observed,
+        proposedCorrection: payload.observation.suggestedCorrection,
+    });
+}
+const defaultDeps = (config) => {
+    const resolveCwd = (productId) => {
+        if (!productId)
+            return config.repoPath;
+        const product = config.products.find(p => p.id === productId);
+        if (!product)
+            return config.repoPath;
+        return configForProduct(config, product).repoPath;
+    };
+    const resolveVerificationCwd = buildResolveVerificationCwd(resolveCwd);
+    return {
+        getPendingVerifications,
+        recordOutcome: recordDeliveryVerificationOutcome,
+        verifyInjection: verifyInjectionOnPass,
+        authorTargetRestatements: (injectionNodeId, focusId, evidence, evidenceIncomplete) => defaultAuthorTargetRestatements(injectionNodeId, focusId, evidence, {}, evidenceIncomplete),
+        fileEscalation: defaultFileEscalation,
+        organizationId: config.organizationId,
+        emitDriftProposal: defaultEmitDriftProposal,
+        emitInwardDrift: emitInwardDriftProposals,
+        runDeterministic: runDeterministicStrategy,
+        runAiInspection: defaultRunAiInspection,
+        resolveAiInspectionInputs: (v) => defaultResolveAiInspectionInputs(v, {
+            callApi,
+            resolveCwd,
+            integrationBranch: config.integrationBranch,
+        }),
+        resolveCwd,
+        integrationBranch: config.integrationBranch,
+        securityFindingGate: buildDefaultSecurityFindingGateDeps(),
+        resolveDefaultVerification: (c) => defaultResolveDefaultVerification(c),
+        getActiveFocuses,
+        getFocusDeliveries,
+        deliverFailureFeedback: (v, result) => deliverVerificationFailureFeedback(v, result, config.organizationId).then(() => undefined),
+        deliverShortfallFeedback: (v, shortfalls) => requeueShortfallAsRework(v, shortfalls, config.organizationId).then(() => undefined),
+        requeueEvidenceUnavailableAsRework: (v, fault) => requeueEvidenceUnavailableAsRework(v, fault, config.organizationId).then(() => undefined),
+        resolveVerificationCwd,
+        resolveCommitsAhead: (v) => getCommitsAhead(resolveVerificationCwd(v), config.integrationBranch),
+        resolveRecordedCommitShas: async (v) => {
+            // Only look up the recorded commit set when the row records a merged-back
+            // git state with a merge sha (same gating as recordedMergeShaForVerify); an
+            // unmerged delivery has no focus_merges row and stays on the topology path.
+            const sha = recordedMergeShaForVerifyImpl(v);
+            if (!sha || !v.focusId)
+                return [];
+            const cwd = resolveVerificationCwd(v);
+            // Attribute the delivery from ITS OWN commits across the focus's WHOLE
+            // merge history, not just the batch stamped on its row. The stamped sha
+            // names the batch merged in the delivery's session, which is NOT
+            // necessarily the batch that carried its own commits: a delivery whose work
+            // landed in an EARLIER batch (or split across batches) is filtered to zero
+            // by a single-row lookup, and on a fast-forward merge-back that leaves the
+            // gate blind on merged, CI-green work (2026-08-15, delivery 4ab18c49).
+            // Searching every batch by the per-commit Telora-Delivery trailer recovers
+            // the delivery's commits regardless of which batch its row points at.
+            // Branch on the three-state history lookup: only a `found` history is worth
+            // partitioning. An `empty` (no history) or `undetermined` (API unreachable)
+            // result falls through to the single-row / legacy path -- and an undetermined
+            // read is reported as an instrument fault SEPARATELY (resolveEvidenceInstrumentFault),
+            // never silently collapsed into "no evidence" here.
+            const batches = await getAllRecordedCommitShasForFocus(v.focusId);
+            if (batches.state === 'found') {
+                const own = selectDeliveryCommitsAcrossBatches(cwd, batches.value, v.deliveryId);
+                if (own !== null)
+                    return own;
+            }
+            // Total-legacy focus (no Telora-Delivery trailer anywhere -> the history is
+            // un-partitionable), no history, or an undetermined read: preserve the
+            // single-row behavior and judge against the batch stamped on the row.
+            const batch = await getRecordedCommitShasForMerge(v.focusId, sha);
+            return filterCommitsByDelivery(cwd, evidenceValueOr(batch, []), v.deliveryId);
+        },
+        resolveRecordedPreMergeRef: async (v) => {
+            // Same gating as resolveRecordedCommitShas: a pre-merge boundary exists only
+            // for a merged-back row keyed by the recorded merge sha. The boundary is
+            // batch-level (shared across the batch) -- the fast-forward-safe FALLBACK
+            // source, used when the per-delivery commit set came back empty.
+            const sha = recordedMergeShaForVerifyImpl(v);
+            if (!sha || !v.focusId)
+                return null;
+            const cwd = resolveVerificationCwd(v);
+            // But the boundary is only safe when the STAMPED batch actually carries
+            // THIS delivery's own commits. When the stamped batch holds NONE of them
+            // (its work is in another batch), <preMergeRef>...<stampedSha> would span a
+            // SIBLING delivery's work -- converting a blind gate into a confident WRONG
+            // verdict (tree node #19 / AC #4). Suppress the boundary in that case so the
+            // gate stays honestly blind and re-enters bounded re-work. An EMPTY stamped
+            // batch is exactly the fast-forward incident the boundary exists to cure
+            // (the per-delivery set came back empty) -- keep offering it there; a
+            // total-legacy (untrailered) batch also keeps it (no regression).
+            const batchShas = evidenceValueOr(await getRecordedCommitShasForMerge(v.focusId, sha), []);
+            if (batchShas.length > 0 && batchHasAnyTrailer(cwd, batchShas)) {
+                const own = filterCommitsByDelivery(cwd, batchShas, v.deliveryId);
+                if (own.length === 0)
+                    return null;
+            }
+            const ref = await getRecordedPreMergeRefForMerge(v.focusId, sha);
+            return ref.state === 'found' ? ref.value : null;
+        },
+        resolveAttributionFailure: async (v) => {
+            // TOTAL ATTRIBUTION FAILURE: a recorded batch with ZERO parseable trailers
+            // on a focus with MORE THAN ONE delivery. filterCommitsByDelivery returns
+            // the whole batch for such a set (its legacy fallback), and coverage then
+            // reports complete because the range covers that whole set exactly -- so
+            // without this signal the gate would render a confident verdict against the
+            // combined sibling diff. A single-delivery focus is genuinely
+            // unpartitionable, so it is NOT a failure and keeps today's behavior.
+            const sha = recordedMergeShaForVerifyImpl(v);
+            if (!sha || !v.focusId)
+                return null;
+            const batchLookup = await getRecordedCommitShasForMerge(v.focusId, sha);
+            // Only a `found` batch (query ran AND the row carries commits) can be a
+            // total-attribution failure. An `empty` batch has nothing to misattribute;
+            // an `undetermined` batch is a blind instrument, not a partition failure --
+            // reported distinctly via resolveEvidenceInstrumentFault, not here.
+            if (batchLookup.state !== 'found')
+                return null;
+            const batch = batchLookup.value;
+            const cwd = resolveVerificationCwd(v);
+            if (batchHasAnyTrailer(cwd, batch))
+                return null; // partitionable -> not a total failure
+            const deliveries = await getFocusDeliveries(v.focusId);
+            if (deliveries.length <= 1)
+                return null; // genuine legacy single-delivery batch
+            return { batch: batch.length, deliveries: deliveries.length };
+        },
+        resolveEvidenceInstrumentFault: async (v) => {
+            // Probe whether the durable record could be READ at all. An `undetermined`
+            // lookup (the focus_merge_list API unreachable) is the instrument fault the
+            // gate must report DISTINCTLY from an honest empty record: it names the seam
+            // so a blind gate is diagnosable, rather than collapsing "could not
+            // determine" into "there is nothing here". Gated identically to the
+            // commit-set lookup -- an unmerged delivery has no record to read and is not
+            // a fault.
+            const sha = recordedMergeShaForVerifyImpl(v);
+            if (!sha || !v.focusId)
+                return null;
+            const history = await getAllRecordedCommitShasForFocus(v.focusId);
+            if (history.state === 'undetermined') {
+                return { seam: 'focus_merges (whole-history commit set)', reason: history.reason };
+            }
+            return null;
+        },
+        attributeFailures: buildDefaultAttributeFailures(config),
+    };
+};
+const STRATEGIES = {
+    deterministic: (deps, v) => deps.runDeterministic(v.verificationConfig, (deps.resolveVerificationCwd ?? ((pv) => deps.resolveCwd(pv.productId)))(v), { deliveryId: v.deliveryId, startedAtMs: Date.now() }),
+    behavioral: () => runBehavioralStrategy(),
+    ai_inspection: (deps, v) => runAiInspectionStrategy(deps, v),
+};
+/**
+ * Verify-gate evidence resolution lives in verification-evidence.ts (diff-range
+ * resolution, structured change signals, and the missing-slot naming the
+ * instrument-fault hold consumes). Imported for use below and re-exported so
+ * existing importers/tests that reach these through verification-engine keep
+ * resolving.
+ */
+export { MERGED_BACK_GIT_STATES, recordedMergeShaForVerify, } from './verification-evidence.js';
+import { buildVerifyEvidence, describeMissingJudgeEvidence, assessRecordedCoverage, resolveDiffCwd, recordedMergeShaForVerify as recordedMergeShaForVerifyImpl, } from './verification-evidence.js';
+import { getRecordedCommitShasForMerge, getAllRecordedCommitShasForFocus, getRecordedPreMergeRefForMerge, evidenceValueOr } from '../queries/deliveries.js';
+/**
+ * Run verification for a single delivery.
+ *
+ * Ordering invariants:
+ *   1. Run the strategy.
+ *   2. On verdict 'passed' with an injection node: retire injection FIRST
+ *      (verifyInjection runs the reality_tree_verify_injection compound op).
+ *      If retirement fails, the outcome demotes to 'pending' so the loop
+ *      will retry — better to leave the row queued than to record 'passed'
+ *      while the graph is in an inconsistent state.
+ *   3. Record the (possibly demoted) outcome.
+ *   4. Emit any drift_observations the runner attached, regardless of
+ *      verdict. Each becomes a crt_drift_proposal in 'proposed' status.
+ *
+ * Drift emission is best-effort: a single failure logs and continues so
+ * one bad observation does not prevent the rest from being persisted.
+ */
+export async function runVerificationForDelivery(v, deps) {
+    const strategy = STRATEGIES[v.verificationMethod];
+    const strategyResult = await strategy(deps, v);
+    const result = { ...strategyResult };
+    // Baseline-diff attribution (deterministic only): a failed HEAD run whose
+    // failures ALL pre-exist on the focus base introduced no regression -> demote
+    // to 'passed' (the differential gate measures only the focus's delta). Runs
+    // BEFORE the pass path so a demotion feeds injection retirement; a null
+    // classification (no baseline) leaves the outcome unchanged (all failures gate).
+    if (v.verificationMethod === 'deterministic' && result.outcome === 'failed' && deps.attributeFailures) {
+        try {
+            const classification = await deps.attributeFailures(v, result);
+            if (classification) {
+                const attributed = applyAttribution(v.deliveryId, classification);
+                result.newFailures = attributed.newFailures;
+                result.preExisting = attributed.preExisting;
+                result.outcome = attributed.outcome;
+                result.rationale = attributed.rationale;
+                if (attributed.log)
+                    log.info(attributed.log);
+            }
+        }
+        catch (err) {
+            log.warn(`[verification] baseline attribution failed for delivery ${v.deliveryId}:`, err.message);
+        }
+    }
+    // Shortfall-origin tracking: set when the reconciliation demotes a PASSED
+    // outcome to 'failed'. Feedback for a shortfall hold routes under its own
+    // guard (not deterministic_verification), so the origin must survive to the
+    // feedback dispatch below.
+    let shortfallHold = [];
+    // Instrument-fault tracking: set when the verify path was handed no evidence
+    // it could judge the work against (an empty bundle). Distinct origin from a
+    // shortfall -- it holds the gate under the evidence-unavailable guard and
+    // escalates rather than routing to verify_failed.
+    let evidenceUnavailableHold = null;
+    // Pass path FIRST so a verifyInjection failure short-circuits before we
+    // record an outcome that does not match graph state.
+    if (result.outcome === 'passed' && v.injectionNodeId) {
+        // Security workflow verify-closed gate: a security-linked injection
+        // cannot be retired unless the linked finding has flipped to
+        // 'resolved'. On failure, escalate the finding and demote the verify
+        // outcome to 'failed'. Non-security injections pass through as a no-op.
+        let securityGatePassed = true;
+        try {
+            const gate = await evaluateFindingNoLongerPresent(v.injectionNodeId, deps.securityFindingGate);
+            if (!gate.passed) {
+                securityGatePassed = false;
+                await escalateOnGateFail(gate.findingId, 'verify_gate_failed', deps.securityFindingGate);
+                result.outcome = 'failed';
+                result.rationale =
+                    `security verify-closed gate failed: ${gate.reason} ` +
+                        `(finding ${gate.findingId} escalated)`;
+            }
+        }
+        catch (err) {
+            log.warn(`[verification] security finding gate evaluation failed for ${v.injectionNodeId}:`, err.message);
+            // Gate eval failure does NOT block the verify path -- treat as
+            // no-op so a missing edge function does not silently quarantine
+            // every passing delivery. The gate is best-effort defense in depth.
+        }
+        if (securityGatePassed) {
+            // Reconcile declared intent vs achieved outcome for this injection's UDE
+            // targets. The achieved desired effect is authored from the CITED worktree
+            // EVIDENCE (diff/tests/inspection), NOT the UDE problem text; each target is
+            // classified match / legitimate_divergence / shortfall.
+            //
+            // ASYMMETRY: a shortfall is NEVER carried into verify and NEVER softens the
+            // declared DE. If ANY target falls short, we hold the gate (demote to
+            // 'failed'), skip the flip, and escalate the gap to a human. Reality is
+            // moved toward intent, never the reverse.
+            // Resolve the delivery's recorded commit set (durable attribution) so the
+            // diff range is sourced from the record, not truncated live topology.
+            // Best-effort: [] falls through to the topology sources.
+            let recordedCommitShas = [];
+            if (deps.resolveRecordedCommitShas) {
+                try {
+                    recordedCommitShas = await deps.resolveRecordedCommitShas(v);
+                }
+                catch (err) {
+                    log.debug(`[verification] recorded commit-set lookup failed for ${v.deliveryId}:`, err.message);
+                }
+            }
+            // Recorded pre-merge boundary: the FAST-FORWARD-safe source, used when the
+            // merge-back left no merge commit AND the per-delivery commit set came back
+            // empty. Best-effort: null falls through to the remaining sources.
+            let recordedPreMergeRef = null;
+            if (deps.resolveRecordedPreMergeRef) {
+                try {
+                    recordedPreMergeRef = await deps.resolveRecordedPreMergeRef(v);
+                }
+                catch (err) {
+                    log.debug(`[verification] recorded pre-merge boundary lookup failed for ${v.deliveryId}:`, err.message);
+                }
+            }
+            const evidence = buildVerifyEvidence(result, v, deps, recordedCommitShas, recordedPreMergeRef);
+            // COMPLETENESS: does the resolved range cover the delivery's recorded
+            // commits? A non-empty but truncated bundle is HALF-BLIND -- the gate must
+            // not vouch for a verdict rendered against only part of the work. When the
+            // record itself sourced the range this is complete by construction; the
+            // check bites only when attribution fell back to topology / a searched
+            // merge and that under-covers the recorded truth.
+            const coverage = assessRecordedCoverage(v, deps, recordedCommitShas);
+            // TOTAL ATTRIBUTION FAILURE (loud, not a legacy batch): a recorded batch
+            // with zero parseable trailers on a multi-delivery focus. Its coverage
+            // reports COMPLETE (the range covers the whole batch exactly) -- so unlike
+            // the half-blind case it slips past the coverage guard -- but the batch is
+            // the wrong evidence: this delivery would be judged against the combined
+            // sibling diff. Treat it as unjudgeable and force the same non-verdict path.
+            let attributionFailure = null;
+            if (deps.resolveAttributionFailure) {
+                try {
+                    attributionFailure = await deps.resolveAttributionFailure(v);
+                }
+                catch (err) {
+                    log.debug(`[verification] attribution-failure check failed for ${v.deliveryId}:`, err.message);
+                }
+            }
+            let restatements = [];
+            let shortfalls = [];
+            let realityTreeId;
+            // A GATE MUST NOT REPORT ITS OWN BLINDNESS AS A VERDICT. The reconciliation
+            // sets this when it has a declared-DE target to judge but the evidence is
+            // empty of anything the achieved DE can be authored from -- it then renders
+            // NO verdict (match/legitimate_divergence/shortfall) and returns the
+            // instrument-fault signal instead. Handled below as a distinct non-verdict
+            // hold, never as a shortfall.
+            let evidenceUnavailable = false;
+            if (deps.authorTargetRestatements) {
+                try {
+                    const reconciled = await deps.authorTargetRestatements(v.injectionNodeId, v.focusId, evidence, !coverage.complete || attributionFailure !== null);
+                    restatements = reconciled.restatements;
+                    shortfalls = reconciled.shortfalls;
+                    realityTreeId = reconciled.realityTreeId;
+                    evidenceUnavailable = reconciled.evidenceUnavailable === true;
+                }
+                catch (err) {
+                    // A reconciliation we could not run at all is asymmetric-unsafe: do not
+                    // flip an injection whose achievement we could not verify. Treat the
+                    // whole injection as a shortfall and hold the gate.
+                    log.warn(`[verification] verify-time reconciliation failed for ${v.injectionNodeId}:`, err.message);
+                    shortfalls = [{
+                            nodeId: v.injectionNodeId,
+                            declaredStatement: '(unknown -- reconciliation failed)',
+                            achievedStatement: '(reconciliation failed)',
+                            reason: `Reconciliation failed: ${err.message}`,
+                        }];
+                }
+            }
+            if (evidenceUnavailable) {
+                // Instrument fault: the reconciliation had a declared DE to judge but
+                // could not vouch for the evidence handed to it -- EMPTY (nothing
+                // judgeable) or INCOMPLETE (half-blind: the range covered only part of
+                // the recorded commit set) -- so it rendered no verdict. It is NOT a
+                // shortfall (the gate is blind, not the work short) and -- per "A hold
+                // must name a human act" (2026-07-28) -- it is NOT an operator escalation
+                // either: "fix the diff range / confirm the merge" names no act only a
+                // human can perform. Route it into the EXISTING bounded verify_failed
+                // re-work cycle (below, via deps.requeueEvidenceUnavailableAsRework),
+                // demoting to 'failed' exactly as a shortfall does so the reconciler
+                // steps verify -> verify_failed and the iteration cap bounds it. Where the
+                // resolver CAN recover the diff (a real merge commit), this branch is
+                // never reached and a verdict is rendered instead.
+                const commitsAhead = deps.resolveCommitsAhead ? deps.resolveCommitsAhead(v) : 0;
+                // HALF-BLIND (incomplete) vs fully blind (empty): when the resolved range
+                // covered only part of the recorded commit set, carry the coverage so the
+                // hold names the blind spot rather than reporting "no evidence".
+                const isIncomplete = !coverage.complete && coverage.recorded > 0;
+                // FULLY BLIND (no source at all): re-walk the four diff sources and record
+                // why each was empty, so a second fast-forward blinding is diagnosable from
+                // the daemon log alone (the 2026-08-15 investigation could not get past "the
+                // surviving source returned nothing"). Only for the empty-source case: a
+                // half-blind / attribution-failure hold DID resolve a source, so a four-
+                // source dry diagnosis would not describe its fault.
+                const isFullyBlind = !attributionFailure && !isIncomplete;
+                let sourceDiagnostics;
+                // INSTRUMENT-READ fault: did the durable record fail to READ (API
+                // unreachable), as opposed to reading fine and confirming nothing? Probed
+                // only on the fully-blind path, where it names WHICH seam went blind so a
+                // "could not determine" is never reported as "there is nothing here".
+                let instrumentUndetermined = null;
+                if (isFullyBlind) {
+                    try {
+                        sourceDiagnostics = diagnoseEmptyDiffSource(resolveDiffCwd(v, deps), deps.integrationBranch, recordedMergeShaForVerifyImpl(v), recordedCommitShas, recordedPreMergeRef, v.deliveryId).map((p) => ({ source: p.source, reason: p.reason }));
+                    }
+                    catch (err) {
+                        log.debug(`[verification] source diagnosis failed for delivery ${v.deliveryId}:`, err.message);
+                    }
+                    if (deps.resolveEvidenceInstrumentFault) {
+                        try {
+                            instrumentUndetermined = await deps.resolveEvidenceInstrumentFault(v);
+                        }
+                        catch (err) {
+                            log.debug(`[verification] instrument-fault probe failed for delivery ${v.deliveryId}:`, err.message);
+                        }
+                    }
+                    // Prepend the read-fault as its own diagnostic source so the blind-source
+                    // line names the seam that could not be determined, distinctly from the
+                    // topology sources that were read and found empty.
+                    if (instrumentUndetermined) {
+                        sourceDiagnostics = [
+                            { source: instrumentUndetermined.seam, reason: `undetermined (could not read record: ${instrumentUndetermined.reason})` },
+                            ...(sourceDiagnostics ?? []),
+                        ];
+                    }
+                }
+                evidenceUnavailableHold = {
+                    missing: describeMissingJudgeEvidence(evidence),
+                    commitsAhead,
+                    ...(isIncomplete ? { coverage: { recorded: coverage.recorded, covered: coverage.covered } } : {}),
+                    ...(attributionFailure
+                        ? { attribution: { batch: attributionFailure.batch, parsed: 0, deliveries: attributionFailure.deliveries } }
+                        : {}),
+                    ...(sourceDiagnostics && sourceDiagnostics.length > 0 ? { sourceDiagnostics } : {}),
+                    ...(instrumentUndetermined ? { instrumentUndetermined } : {}),
+                };
+                result.outcome = 'failed';
+                result.rationale = attributionFailure
+                    ? `verify unattributable (total attribution failure): none of the ${attributionFailure.batch} ` +
+                        `merged-batch commit(s) carry a parseable Telora-Delivery trailer on a ` +
+                        `${attributionFailure.deliveries}-delivery focus, so the batch cannot be partitioned and this ` +
+                        `delivery would be judged against the combined sibling diff -- the gate renders no verdict; ` +
+                        `re-entering bounded re-work (injection ${v.injectionNodeId} not flipped)`
+                    : isIncomplete
+                        ? `verify half-blind (instrument fault): resolved diff covers only ${coverage.covered}/` +
+                            `${coverage.recorded} of the delivery's recorded commits -- the gate cannot vouch for a ` +
+                            `verdict rendered against part of the work; re-entering bounded re-work ` +
+                            `(injection ${v.injectionNodeId} not flipped)`
+                        : instrumentUndetermined
+                            ? `verify blind (instrument READ fault): could not read the durable record ` +
+                                `(${instrumentUndetermined.seam}: ${instrumentUndetermined.reason}) -- "could not determine", ` +
+                                `NOT "no evidence"; re-entering bounded re-work (injection ${v.injectionNodeId} not flipped)`
+                            : commitsAhead > 0
+                                ? `verify blind (instrument fault): delivery branch is ${commitsAhead} commit(s) ahead of ` +
+                                    `${deps.integrationBranch} but the resolved diff is empty -- broken diff measurement, ` +
+                                    `not a shortfall; re-entering bounded re-work (injection ${v.injectionNodeId} not flipped)`
+                                : `verify blind (instrument fault): no diff/changed-files/inspection evidence to judge the ` +
+                                    `work -- the gate is blind, not the work short; re-entering bounded re-work ` +
+                                    `(injection ${v.injectionNodeId} not flipped)`;
+                log.warn(`[verification] ${result.rationale} (delivery ${v.deliveryId})`);
+                // Diagnostic record: name each consulted source and why it was empty, at
+                // the SAME warn level as the rationale (no level bump), so a repeat
+                // fast-forward blinding is diagnosable via `telora-daemon logs` without
+                // database access.
+                if (sourceDiagnostics && sourceDiagnostics.length > 0) {
+                    const diag = sourceDiagnostics.map((p) => `${p.source}: ${p.reason}`).join('; ');
+                    log.warn(`[verification] blind-source diagnosis (delivery ${v.deliveryId}): ${diag}`);
+                }
+            }
+            else if (shortfalls.length > 0) {
+                // Hold the gate, do NOT flip. A shortfall is an EXECUTION gap the team
+                // that produced it can close, not an intent question for a human -- so
+                // it re-enters the loop as bounded re-work (via deps.deliverShortfallFeedback
+                // below, which routes verify -> verify_failed through the reconciler),
+                // never a needs_intent inbox item. The genuine human residue is the
+                // EXISTING verify_failed iteration cap (verify_gate_unclearable).
+                shortfallHold = shortfalls;
+                result.outcome = 'failed';
+                result.rationale =
+                    `verify reconciliation found ${shortfalls.length} shortfall(s) vs declared intent; ` +
+                        `injection ${v.injectionNodeId} not flipped (re-entering bounded re-work)`;
+            }
+            else {
+                let flipped = false;
+                try {
+                    await deps.verifyInjection(v.injectionNodeId, restatements);
+                    flipped = true;
+                }
+                catch (err) {
+                    result.outcome = 'pending';
+                    result.rationale = `verifyInjection failed for ${v.injectionNodeId}: ${err.message}`;
+                }
+                // INWARD drift (TEL-3/TEL-4): any target the reconciliation stamped
+                // `legitimate_divergence` is a tree CLAIM reality contradicted. Surface
+                // each as an inward drift proposal -- AFTER the flip landed -- so a
+                // confident-but-wrong assertion is corrected by drift rather than
+                // frozen. observedState carries the tree's ORIGINAL claim (not the
+                // achieved reality); proposedCorrection carries what reality showed.
+                // Best-effort + non-fatal: a failure must not undo the verify flip.
+                if (flipped) {
+                    const divergedWritebacks = restatements
+                        .filter((r) => r.classification === 'legitimate_divergence')
+                        .map((r) => ({
+                        nodeId: r.nodeId,
+                        classification: 'legitimate_divergence',
+                        statement: r.statement,
+                        originalClaim: r.originalClaim,
+                        ...(r.divergenceReason ? { verifyDivergenceReason: r.divergenceReason } : {}),
+                    }));
+                    if (divergedWritebacks.length > 0) {
+                        try {
+                            await deps.emitInwardDrift(v.injectionNodeId, divergedWritebacks, realityTreeId);
+                        }
+                        catch (err) {
+                            log.warn(`[verification] inward drift emit failed for ${v.injectionNodeId}:`, err.message);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    await deps.recordOutcome(v.deliveryId, result.outcome);
+    // Feedback dispatch by FAILURE ORIGIN. The three origins are mutually
+    // exclusive: a shortfall / instrument-fault hold only demotes a PASSED
+    // outcome, so a deterministic-failed run carries neither.
+    //
+    // Instrument-fault re-work FIRST: the verify path was handed nothing to judge,
+    // so it re-enters the bounded verify_failed re-work cycle (carrying the
+    // instrument-fault context in gate_state under the evidence-unavailable guard)
+    // and files NO escalation -- an empty bundle names no human-only act, so it
+    // never reaches a human inbox. Distinct guard from the deterministic/shortfall
+    // holds; the iteration cap (verify_gate_unclearable) is the sole residue.
+    if (evidenceUnavailableHold && deps.requeueEvidenceUnavailableAsRework) {
+        try {
+            await deps.requeueEvidenceUnavailableAsRework(v, evidenceUnavailableHold);
+        }
+        catch (err) {
+            log.warn(`[verification] evidence-unavailable re-work failed for delivery ${v.deliveryId}:`, err.message);
+        }
+    }
+    else if (shortfallHold.length > 0 && deps.deliverShortfallFeedback) {
+        try {
+            await deps.deliverShortfallFeedback(v, shortfallHold);
+        }
+        catch (err) {
+            log.warn(`[verification] shortfall feedback failed for delivery ${v.deliveryId}:`, err.message);
+        }
+    }
+    else if (result.outcome === 'failed' && v.verificationMethod === 'deterministic' && deps.deliverFailureFeedback) {
+        // Genuine deterministic failure (the shell command actually failed): write
+        // gate_state under deterministic_verification + inject. Best-effort.
+        try {
+            await deps.deliverFailureFeedback(v, result);
+        }
+        catch (err) {
+            log.warn(`[verification] failure feedback failed for delivery ${v.deliveryId}:`, err.message);
+        }
+    }
+    // Drift emission is independent of verdict — a 'passed' inspection can
+    // still observe contradictions to other CRT statements.
+    const inspection = result.inspection;
+    if (inspection && inspection.driftObservations.length > 0) {
+        for (const obs of inspection.driftObservations) {
+            try {
+                await deps.emitDriftProposal({
+                    focusId: v.focusId,
+                    productId: v.productId,
+                    injectionNodeId: v.injectionNodeId,
+                    observation: obs,
+                });
+            }
+            catch (err) {
+                log.warn(`[verification] drift proposal emit failed for delivery ${v.deliveryId}:`, err.message);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * One tick: fetch pending verifications across products, dispatch each.
+ * Returns counts for telemetry.
+ */
+export async function runVerificationTick(config, deps) {
+    const merged = { ...defaultDeps(config), ...deps };
+    const counts = { checked: 0, passed: 0, failed: 0, pending: 0, escalated: 0 };
+    // Resolve the default-on config PER PRODUCT, from each product's own scoped
+    // config -- the manifest layer is read from `config.repoPath`, so resolving
+    // once from the un-scoped top-level config made every product's gate a
+    // function of the daemon's launch directory (and silently dropped the
+    // per-product products[].defaultVerification override). A malformed manifest
+    // is contained to its own product there; see resolveProductVerificationScopes.
+    const scopes = resolveProductVerificationScopes(config, merged.resolveDefaultVerification);
+    // The concurrency cap is DAEMON-WIDE (the semaphore is a module-level
+    // singleton guarding this host's CPU/RAM), so it is set ONCE from a single
+    // order-independent value rather than per-product inside the loop, where the
+    // last product iterated would silently win. See resolveDaemonWideVerifyCap for
+    // the rule (min across products) and why.
+    verificationSemaphore.setLimit(resolveDaemonWideVerifyCap(scopes));
+    for (const { product, productConfig, resolved } of scopes) {
+        let pending;
+        try {
+            pending = await merged.getPendingVerifications(product.id);
+        }
+        catch (err) {
+            log.warn(`[verification] fetch failed for product ${product.id}:`, err.message);
+            continue;
+        }
+        // Default-on: append deterministic runs for verify deliveries with no
+        // explicit method (the whole-repo suite the daemon now owns). Inert when
+        // no default command is configured for THIS product (resolved.enabled ===
+        // false) or when its config could not be resolved at all (resolved ===
+        // undefined -- malformed manifest, already logged at ERROR above).
+        const explicitIds = new Set(pending.map((p) => p.deliveryId));
+        let defaultOn = [];
+        if (resolved) {
+            try {
+                defaultOn = await collectDefaultOnVerifications(productConfig, resolved, explicitIds, merged);
+            }
+            catch (err) {
+                log.warn(`[verification] default-on scan failed for product ${product.id}:`, err.message);
+            }
+        }
+        for (const v of [...pending, ...defaultOn]) {
+            counts.checked += 1;
+            // Mark default-on candidates as run BEFORE dispatch so a mid-run failure
+            // does not re-enqueue the same 30-min suite on the next tick.
+            if (v.verificationOutcome === null && !explicitIds.has(v.deliveryId)) {
+                markDefaultOnRan(v.deliveryId);
+            }
+            // Cap concurrent whole-repo runs across overlapping ticks.
+            await verificationSemaphore.acquire();
+            try {
+                const r = await runVerificationForDelivery(v, merged);
+                counts[r.outcome] = (counts[r.outcome] ?? 0) + 1;
+            }
+            catch (err) {
+                log.warn(`[verification] tick failed for delivery ${v.deliveryId}:`, err.message);
+            }
+            finally {
+                verificationSemaphore.release();
+            }
+        }
+    }
+    // Clean-environment install probe (Review Gate Hardening, deferrable): an
+    // ADDITIONAL, out-of-band pass over manifest-touching verify deliveries,
+    // independent of verification_method. Writes the probe result into gate_state.
+    // Best-effort -- never aborts the verification tick.
+    try {
+        const probe = await runInstallProbeTick(config);
+        if (probe.probesRun > 0) {
+            log.info(`[install-probe] tick: focusesScanned=${probe.focusesScanned} probesRun=${probe.probesRun} ` +
+                `blocked=${probe.deliveriesBlocked} unverifiable=${probe.deliveriesUnverifiable}`);
+        }
+    }
+    catch (err) {
+        log.warn('[install-probe] tick failed:', err.message);
+    }
+    return counts;
+}
+//# sourceMappingURL=verification-engine.js.map