@telora/daemon 0.21.26 → 0.21.82

package/dist/verification-engine.js

@@ -1,716 +0,0 @@
-/**
- * Pluggable verification engine -- Differential Focus Spec.
- *
- * Each delivery is the materialization of an injection. When the delivery
- * reaches the 'verify' execution status, this engine selects a strategy
- * based on the delivery's verification_method and runs it. On a 'passed'
- * outcome the injection is retired (its FRT statement promotes to CRT)
- * via the existing reality_tree_verify_injection compound op.
- *
- * Per-delivery verification is opt-in: it runs only when a delivery carries
- * an explicit method. A delivery with no method does not block -- focus-level
- * AI review is the sole verify->done authority. Humans observe via the focus
- * debug tab, never via a gate.
- *
- * Methods:
- *   deterministic   -- run a shell command (tests, lint, types). Pass = exit 0.
- *   behavioral      -- runtime telemetry observation (scaffold; needs drift
- *                      detection from delivery 82bdf164 to provide signal).
- *   ai_inspection   -- AI reads code/state and decides (scaffold; needs an
- *                      AI inspection driver that walks the reality tree in
- *                      conversation via `telora_reality_tree_*` MCP calls).
- *
- * @module verification-engine
- */
-import { runDeterministicStrategy } from './verification-deterministic.js';
-export { runDeterministicStrategy } from './verification-deterministic.js';
-import { getPendingVerifications, recordDeliveryVerificationOutcome, verifyInjectionOnPass, emitInwardDriftProposals, } from './queries/verification.js';
-import { configForProduct } from './config.js';
-import { authorTargetRestatements as defaultAuthorTargetRestatements, } from './verify-restatement.js';
-import { fileEscalation as defaultFileEscalation } from './escalations.js';
-import { getCommitsAhead, filterCommitsByDelivery, selectDeliveryCommitsAcrossBatches, batchHasAnyTrailer, diagnoseEmptyDiffSource } from './assembly-resolvers.js';
-import { resolveDefaultVerification as defaultResolveDefaultVerification } from './verification-config.js';
-import { getActiveFocuses, getFocusDeliveries } from './supabase.js';
-import { collectDefaultOnVerifications, markDefaultOnRan, resolveDaemonWideVerifyCap, resolveProductVerificationScopes, verificationSemaphore, } from './verification-default-on.js';
-import { deliverVerificationFailureFeedback, requeueShortfallAsRework, requeueEvidenceUnavailableAsRework } from './verification-feedback.js';
-import { buildDefaultAttributeFailures, buildResolveVerificationCwd, applyAttribution } from './verification-baseline.js';
-// Re-export the default-on selection + concurrency surface so existing
-// importers (and tests) can reach it through verification-engine.
-export { collectDefaultOnVerifications, resolveDaemonWideVerifyCap, resolveProductVerificationScopes, verificationSemaphore, VerificationSemaphore, __getVerificationSemaphoreForTests, __resetDefaultOnGuardForTests, __getDefaultOnGuardForTests, __markDefaultOnRanForTests, } from './verification-default-on.js';
-import { resolveAiInspectionInputs as defaultResolveAiInspectionInputs } from './ai-inspection-context.js';
-import { runAiInspection as defaultRunAiInspection, } from './ai-inspection-runner.js';
-import { buildDefaultSecurityFindingGateDeps, evaluateFindingNoLongerPresent, escalateOnGateFail, } from './security-finding-gate.js';
-import { callApi } from './queries/shared.js';
-import { runInstallProbeTick } from './install-probe-tick.js';
-import { createLogger } from './log.js';
-const log = createLogger({ module: 'verification' });
-// ---------------------------------------------------------------------------
-// Strategies
-// ---------------------------------------------------------------------------
-export async function runBehavioralStrategy() {
-    return {
-        outcome: 'pending',
-        rationale: 'behavioral strategy scaffold -- runtime telemetry source not yet wired (see drift detection 82bdf164)',
-    };
-}
-/**
- * Spawn a tool-augmented Claude runner against the focus worktree to judge
- * whether the injection's FRT statement holds in the code state. Maps the
- * runner verdict to a verification outcome:
- *   - passed       → outcome 'passed' (caller will retire injection)
- *   - failed       → outcome 'failed' (caller will revert delivery to coding)
- *   - inconclusive → outcome 'pending' (caller leaves the row in queue)
- *
- * The strategy itself does NOT call verifyInjection or emit drift proposals;
- * those side effects are wired by runVerificationForDelivery (next task)
- * so the dispatch layer stays the single owner of the pass-path side effect.
- *
- * Drift observations from the runner are returned via the rationale field
- * (compact JSON) so the caller can persist them as crt_drift_proposals.
- */
-export async function runAiInspectionStrategy(deps, v) {
-    const inputs = await deps.resolveAiInspectionInputs(v);
-    if (!inputs) {
-        return {
-            outcome: 'pending',
-            rationale: 'ai_inspection skipped: injection node not found',
-        };
-    }
-    const inspection = await deps.runAiInspection(inputs);
-    const outcome = inspection.verdict === 'passed' ? 'passed'
-        : inspection.verdict === 'failed' ? 'failed'
-            : 'pending';
-    return {
-        outcome,
-        rationale: inspection.rationale,
-        deliveryDiff: inputs.deliveryDiff,
-        inspection,
-    };
-}
-async function defaultEmitDriftProposal(payload) {
-    await callApi('crt_drift_proposal_create', {
-        focusId: payload.focusId,
-        productId: payload.productId,
-        nodeId: payload.observation.nodeId,
-        proposalKind: payload.observation.kind,
-        observedState: payload.observation.observed,
-        proposedCorrection: payload.observation.suggestedCorrection,
-    });
-}
-const defaultDeps = (config) => {
-    const resolveCwd = (productId) => {
-        if (!productId)
-            return config.repoPath;
-        const product = config.products.find(p => p.id === productId);
-        if (!product)
-            return config.repoPath;
-        return configForProduct(config, product).repoPath;
-    };
-    const resolveVerificationCwd = buildResolveVerificationCwd(resolveCwd);
-    return {
-        getPendingVerifications,
-        recordOutcome: recordDeliveryVerificationOutcome,
-        verifyInjection: verifyInjectionOnPass,
-        authorTargetRestatements: (injectionNodeId, focusId, evidence, evidenceIncomplete) => defaultAuthorTargetRestatements(injectionNodeId, focusId, evidence, {}, evidenceIncomplete),
-        fileEscalation: defaultFileEscalation,
-        organizationId: config.organizationId,
-        emitDriftProposal: defaultEmitDriftProposal,
-        emitInwardDrift: emitInwardDriftProposals,
-        runDeterministic: runDeterministicStrategy,
-        runAiInspection: defaultRunAiInspection,
-        resolveAiInspectionInputs: (v) => defaultResolveAiInspectionInputs(v, {
-            callApi,
-            resolveCwd,
-            integrationBranch: config.integrationBranch,
-        }),
-        resolveCwd,
-        integrationBranch: config.integrationBranch,
-        securityFindingGate: buildDefaultSecurityFindingGateDeps(),
-        resolveDefaultVerification: (c) => defaultResolveDefaultVerification(c),
-        getActiveFocuses,
-        getFocusDeliveries,
-        deliverFailureFeedback: (v, result) => deliverVerificationFailureFeedback(v, result, config.organizationId).then(() => undefined),
-        deliverShortfallFeedback: (v, shortfalls) => requeueShortfallAsRework(v, shortfalls, config.organizationId).then(() => undefined),
-        requeueEvidenceUnavailableAsRework: (v, fault) => requeueEvidenceUnavailableAsRework(v, fault, config.organizationId).then(() => undefined),
-        resolveVerificationCwd,
-        resolveCommitsAhead: (v) => getCommitsAhead(resolveVerificationCwd(v), config.integrationBranch),
-        resolveRecordedCommitShas: async (v) => {
-            // Only look up the recorded commit set when the row records a merged-back
-            // git state with a merge sha (same gating as recordedMergeShaForVerify); an
-            // unmerged delivery has no focus_merges row and stays on the topology path.
-            const sha = recordedMergeShaForVerifyImpl(v);
-            if (!sha || !v.focusId)
-                return [];
-            const cwd = resolveVerificationCwd(v);
-            // Attribute the delivery from ITS OWN commits across the focus's WHOLE
-            // merge history, not just the batch stamped on its row. The stamped sha
-            // names the batch merged in the delivery's session, which is NOT
-            // necessarily the batch that carried its own commits: a delivery whose work
-            // landed in an EARLIER batch (or split across batches) is filtered to zero
-            // by a single-row lookup, and on a fast-forward merge-back that leaves the
-            // gate blind on merged, CI-green work (2026-08-15, delivery 4ab18c49).
-            // Searching every batch by the per-commit Telora-Delivery trailer recovers
-            // the delivery's commits regardless of which batch its row points at.
-            // Branch on the three-state history lookup: only a `found` history is worth
-            // partitioning. An `empty` (no history) or `undetermined` (API unreachable)
-            // result falls through to the single-row / legacy path -- and an undetermined
-            // read is reported as an instrument fault SEPARATELY (resolveEvidenceInstrumentFault),
-            // never silently collapsed into "no evidence" here.
-            const batches = await getAllRecordedCommitShasForFocus(v.focusId);
-            if (batches.state === 'found') {
-                const own = selectDeliveryCommitsAcrossBatches(cwd, batches.value, v.deliveryId);
-                if (own !== null)
-                    return own;
-            }
-            // Total-legacy focus (no Telora-Delivery trailer anywhere -> the history is
-            // un-partitionable), no history, or an undetermined read: preserve the
-            // single-row behavior and judge against the batch stamped on the row.
-            const batch = await getRecordedCommitShasForMerge(v.focusId, sha);
-            return filterCommitsByDelivery(cwd, evidenceValueOr(batch, []), v.deliveryId);
-        },
-        resolveRecordedPreMergeRef: async (v) => {
-            // Same gating as resolveRecordedCommitShas: a pre-merge boundary exists only
-            // for a merged-back row keyed by the recorded merge sha. The boundary is
-            // batch-level (shared across the batch) -- the fast-forward-safe FALLBACK
-            // source, used when the per-delivery commit set came back empty.
-            const sha = recordedMergeShaForVerifyImpl(v);
-            if (!sha || !v.focusId)
-                return null;
-            const cwd = resolveVerificationCwd(v);
-            // But the boundary is only safe when the STAMPED batch actually carries
-            // THIS delivery's own commits. When the stamped batch holds NONE of them
-            // (its work is in another batch), <preMergeRef>...<stampedSha> would span a
-            // SIBLING delivery's work -- converting a blind gate into a confident WRONG
-            // verdict (tree node #19 / AC #4). Suppress the boundary in that case so the
-            // gate stays honestly blind and re-enters bounded re-work. An EMPTY stamped
-            // batch is exactly the fast-forward incident the boundary exists to cure
-            // (the per-delivery set came back empty) -- keep offering it there; a
-            // total-legacy (untrailered) batch also keeps it (no regression).
-            const batchShas = evidenceValueOr(await getRecordedCommitShasForMerge(v.focusId, sha), []);
-            if (batchShas.length > 0 && batchHasAnyTrailer(cwd, batchShas)) {
-                const own = filterCommitsByDelivery(cwd, batchShas, v.deliveryId);
-                if (own.length === 0)
-                    return null;
-            }
-            const ref = await getRecordedPreMergeRefForMerge(v.focusId, sha);
-            return ref.state === 'found' ? ref.value : null;
-        },
-        resolveAttributionFailure: async (v) => {
-            // TOTAL ATTRIBUTION FAILURE: a recorded batch with ZERO parseable trailers
-            // on a focus with MORE THAN ONE delivery. filterCommitsByDelivery returns
-            // the whole batch for such a set (its legacy fallback), and coverage then
-            // reports complete because the range covers that whole set exactly -- so
-            // without this signal the gate would render a confident verdict against the
-            // combined sibling diff. A single-delivery focus is genuinely
-            // unpartitionable, so it is NOT a failure and keeps today's behavior.
-            const sha = recordedMergeShaForVerifyImpl(v);
-            if (!sha || !v.focusId)
-                return null;
-            const batchLookup = await getRecordedCommitShasForMerge(v.focusId, sha);
-            // Only a `found` batch (query ran AND the row carries commits) can be a
-            // total-attribution failure. An `empty` batch has nothing to misattribute;
-            // an `undetermined` batch is a blind instrument, not a partition failure --
-            // reported distinctly via resolveEvidenceInstrumentFault, not here.
-            if (batchLookup.state !== 'found')
-                return null;
-            const batch = batchLookup.value;
-            const cwd = resolveVerificationCwd(v);
-            if (batchHasAnyTrailer(cwd, batch))
-                return null; // partitionable -> not a total failure
-            const deliveries = await getFocusDeliveries(v.focusId);
-            if (deliveries.length <= 1)
-                return null; // genuine legacy single-delivery batch
-            return { batch: batch.length, deliveries: deliveries.length };
-        },
-        resolveEvidenceInstrumentFault: async (v) => {
-            // Probe whether the durable record could be READ at all. An `undetermined`
-            // lookup (the focus_merge_list API unreachable) is the instrument fault the
-            // gate must report DISTINCTLY from an honest empty record: it names the seam
-            // so a blind gate is diagnosable, rather than collapsing "could not
-            // determine" into "there is nothing here". Gated identically to the
-            // commit-set lookup -- an unmerged delivery has no record to read and is not
-            // a fault.
-            const sha = recordedMergeShaForVerifyImpl(v);
-            if (!sha || !v.focusId)
-                return null;
-            const history = await getAllRecordedCommitShasForFocus(v.focusId);
-            if (history.state === 'undetermined') {
-                return { seam: 'focus_merges (whole-history commit set)', reason: history.reason };
-            }
-            return null;
-        },
-        attributeFailures: buildDefaultAttributeFailures(config),
-    };
-};
-const STRATEGIES = {
-    deterministic: (deps, v) => deps.runDeterministic(v.verificationConfig, (deps.resolveVerificationCwd ?? ((pv) => deps.resolveCwd(pv.productId)))(v), { deliveryId: v.deliveryId, startedAtMs: Date.now() }),
-    behavioral: () => runBehavioralStrategy(),
-    ai_inspection: (deps, v) => runAiInspectionStrategy(deps, v),
-};
-/**
- * Verify-gate evidence resolution lives in verification-evidence.ts (diff-range
- * resolution, structured change signals, and the missing-slot naming the
- * instrument-fault hold consumes). Imported for use below and re-exported so
- * existing importers/tests that reach these through verification-engine keep
- * resolving.
- */
-export { MERGED_BACK_GIT_STATES, recordedMergeShaForVerify, } from './verification-evidence.js';
-import { buildVerifyEvidence, describeMissingJudgeEvidence, assessRecordedCoverage, resolveDiffCwd, recordedMergeShaForVerify as recordedMergeShaForVerifyImpl, } from './verification-evidence.js';
-import { getRecordedCommitShasForMerge, getAllRecordedCommitShasForFocus, getRecordedPreMergeRefForMerge, evidenceValueOr } from './queries/deliveries.js';
-/**
- * Run verification for a single delivery.
- *
- * Ordering invariants:
- *   1. Run the strategy.
- *   2. On verdict 'passed' with an injection node: retire injection FIRST
- *      (verifyInjection runs the reality_tree_verify_injection compound op).
- *      If retirement fails, the outcome demotes to 'pending' so the loop
- *      will retry — better to leave the row queued than to record 'passed'
- *      while the graph is in an inconsistent state.
- *   3. Record the (possibly demoted) outcome.
- *   4. Emit any drift_observations the runner attached, regardless of
- *      verdict. Each becomes a crt_drift_proposal in 'proposed' status.
- *
- * Drift emission is best-effort: a single failure logs and continues so
- * one bad observation does not prevent the rest from being persisted.
- */
-export async function runVerificationForDelivery(v, deps) {
-    const strategy = STRATEGIES[v.verificationMethod];
-    const strategyResult = await strategy(deps, v);
-    const result = { ...strategyResult };
-    // Baseline-diff attribution (deterministic only): a failed HEAD run whose
-    // failures ALL pre-exist on the focus base introduced no regression -> demote
-    // to 'passed' (the differential gate measures only the focus's delta). Runs
-    // BEFORE the pass path so a demotion feeds injection retirement; a null
-    // classification (no baseline) leaves the outcome unchanged (all failures gate).
-    if (v.verificationMethod === 'deterministic' && result.outcome === 'failed' && deps.attributeFailures) {
-        try {
-            const classification = await deps.attributeFailures(v, result);
-            if (classification) {
-                const attributed = applyAttribution(v.deliveryId, classification);
-                result.newFailures = attributed.newFailures;
-                result.preExisting = attributed.preExisting;
-                result.outcome = attributed.outcome;
-                result.rationale = attributed.rationale;
-                if (attributed.log)
-                    log.info(attributed.log);
-            }
-        }
-        catch (err) {
-            log.warn(`[verification] baseline attribution failed for delivery ${v.deliveryId}:`, err.message);
-        }
-    }
-    // Shortfall-origin tracking: set when the reconciliation demotes a PASSED
-    // outcome to 'failed'. Feedback for a shortfall hold routes under its own
-    // guard (not deterministic_verification), so the origin must survive to the
-    // feedback dispatch below.
-    let shortfallHold = [];
-    // Instrument-fault tracking: set when the verify path was handed no evidence
-    // it could judge the work against (an empty bundle). Distinct origin from a
-    // shortfall -- it holds the gate under the evidence-unavailable guard and
-    // escalates rather than routing to verify_failed.
-    let evidenceUnavailableHold = null;
-    // Pass path FIRST so a verifyInjection failure short-circuits before we
-    // record an outcome that does not match graph state.
-    if (result.outcome === 'passed' && v.injectionNodeId) {
-        // Security workflow verify-closed gate: a security-linked injection
-        // cannot be retired unless the linked finding has flipped to
-        // 'resolved'. On failure, escalate the finding and demote the verify
-        // outcome to 'failed'. Non-security injections pass through as a no-op.
-        let securityGatePassed = true;
-        try {
-            const gate = await evaluateFindingNoLongerPresent(v.injectionNodeId, deps.securityFindingGate);
-            if (!gate.passed) {
-                securityGatePassed = false;
-                await escalateOnGateFail(gate.findingId, 'verify_gate_failed', deps.securityFindingGate);
-                result.outcome = 'failed';
-                result.rationale =
-                    `security verify-closed gate failed: ${gate.reason} ` +
-                        `(finding ${gate.findingId} escalated)`;
-            }
-        }
-        catch (err) {
-            log.warn(`[verification] security finding gate evaluation failed for ${v.injectionNodeId}:`, err.message);
-            // Gate eval failure does NOT block the verify path -- treat as
-            // no-op so a missing edge function does not silently quarantine
-            // every passing delivery. The gate is best-effort defense in depth.
-        }
-        if (securityGatePassed) {
-            // Reconcile declared intent vs achieved outcome for this injection's UDE
-            // targets. The achieved desired effect is authored from the CITED worktree
-            // EVIDENCE (diff/tests/inspection), NOT the UDE problem text; each target is
-            // classified match / legitimate_divergence / shortfall.
-            //
-            // ASYMMETRY: a shortfall is NEVER carried into verify and NEVER softens the
-            // declared DE. If ANY target falls short, we hold the gate (demote to
-            // 'failed'), skip the flip, and escalate the gap to a human. Reality is
-            // moved toward intent, never the reverse.
-            // Resolve the delivery's recorded commit set (durable attribution) so the
-            // diff range is sourced from the record, not truncated live topology.
-            // Best-effort: [] falls through to the topology sources.
-            let recordedCommitShas = [];
-            if (deps.resolveRecordedCommitShas) {
-                try {
-                    recordedCommitShas = await deps.resolveRecordedCommitShas(v);
-                }
-                catch (err) {
-                    log.debug(`[verification] recorded commit-set lookup failed for ${v.deliveryId}:`, err.message);
-                }
-            }
-            // Recorded pre-merge boundary: the FAST-FORWARD-safe source, used when the
-            // merge-back left no merge commit AND the per-delivery commit set came back
-            // empty. Best-effort: null falls through to the remaining sources.
-            let recordedPreMergeRef = null;
-            if (deps.resolveRecordedPreMergeRef) {
-                try {
-                    recordedPreMergeRef = await deps.resolveRecordedPreMergeRef(v);
-                }
-                catch (err) {
-                    log.debug(`[verification] recorded pre-merge boundary lookup failed for ${v.deliveryId}:`, err.message);
-                }
-            }
-            const evidence = buildVerifyEvidence(result, v, deps, recordedCommitShas, recordedPreMergeRef);
-            // COMPLETENESS: does the resolved range cover the delivery's recorded
-            // commits? A non-empty but truncated bundle is HALF-BLIND -- the gate must
-            // not vouch for a verdict rendered against only part of the work. When the
-            // record itself sourced the range this is complete by construction; the
-            // check bites only when attribution fell back to topology / a searched
-            // merge and that under-covers the recorded truth.
-            const coverage = assessRecordedCoverage(v, deps, recordedCommitShas);
-            // TOTAL ATTRIBUTION FAILURE (loud, not a legacy batch): a recorded batch
-            // with zero parseable trailers on a multi-delivery focus. Its coverage
-            // reports COMPLETE (the range covers the whole batch exactly) -- so unlike
-            // the half-blind case it slips past the coverage guard -- but the batch is
-            // the wrong evidence: this delivery would be judged against the combined
-            // sibling diff. Treat it as unjudgeable and force the same non-verdict path.
-            let attributionFailure = null;
-            if (deps.resolveAttributionFailure) {
-                try {
-                    attributionFailure = await deps.resolveAttributionFailure(v);
-                }
-                catch (err) {
-                    log.debug(`[verification] attribution-failure check failed for ${v.deliveryId}:`, err.message);
-                }
-            }
-            let restatements = [];
-            let shortfalls = [];
-            let realityTreeId;
-            // A GATE MUST NOT REPORT ITS OWN BLINDNESS AS A VERDICT. The reconciliation
-            // sets this when it has a declared-DE target to judge but the evidence is
-            // empty of anything the achieved DE can be authored from -- it then renders
-            // NO verdict (match/legitimate_divergence/shortfall) and returns the
-            // instrument-fault signal instead. Handled below as a distinct non-verdict
-            // hold, never as a shortfall.
-            let evidenceUnavailable = false;
-            if (deps.authorTargetRestatements) {
-                try {
-                    const reconciled = await deps.authorTargetRestatements(v.injectionNodeId, v.focusId, evidence, !coverage.complete || attributionFailure !== null);
-                    restatements = reconciled.restatements;
-                    shortfalls = reconciled.shortfalls;
-                    realityTreeId = reconciled.realityTreeId;
-                    evidenceUnavailable = reconciled.evidenceUnavailable === true;
-                }
-                catch (err) {
-                    // A reconciliation we could not run at all is asymmetric-unsafe: do not
-                    // flip an injection whose achievement we could not verify. Treat the
-                    // whole injection as a shortfall and hold the gate.
-                    log.warn(`[verification] verify-time reconciliation failed for ${v.injectionNodeId}:`, err.message);
-                    shortfalls = [{
-                            nodeId: v.injectionNodeId,
-                            declaredStatement: '(unknown -- reconciliation failed)',
-                            achievedStatement: '(reconciliation failed)',
-                            reason: `Reconciliation failed: ${err.message}`,
-                        }];
-                }
-            }
-            if (evidenceUnavailable) {
-                // Instrument fault: the reconciliation had a declared DE to judge but
-                // could not vouch for the evidence handed to it -- EMPTY (nothing
-                // judgeable) or INCOMPLETE (half-blind: the range covered only part of
-                // the recorded commit set) -- so it rendered no verdict. It is NOT a
-                // shortfall (the gate is blind, not the work short) and -- per "A hold
-                // must name a human act" (2026-07-28) -- it is NOT an operator escalation
-                // either: "fix the diff range / confirm the merge" names no act only a
-                // human can perform. Route it into the EXISTING bounded verify_failed
-                // re-work cycle (below, via deps.requeueEvidenceUnavailableAsRework),
-                // demoting to 'failed' exactly as a shortfall does so the reconciler
-                // steps verify -> verify_failed and the iteration cap bounds it. Where the
-                // resolver CAN recover the diff (a real merge commit), this branch is
-                // never reached and a verdict is rendered instead.
-                const commitsAhead = deps.resolveCommitsAhead ? deps.resolveCommitsAhead(v) : 0;
-                // HALF-BLIND (incomplete) vs fully blind (empty): when the resolved range
-                // covered only part of the recorded commit set, carry the coverage so the
-                // hold names the blind spot rather than reporting "no evidence".
-                const isIncomplete = !coverage.complete && coverage.recorded > 0;
-                // FULLY BLIND (no source at all): re-walk the four diff sources and record
-                // why each was empty, so a second fast-forward blinding is diagnosable from
-                // the daemon log alone (the 2026-08-15 investigation could not get past "the
-                // surviving source returned nothing"). Only for the empty-source case: a
-                // half-blind / attribution-failure hold DID resolve a source, so a four-
-                // source dry diagnosis would not describe its fault.
-                const isFullyBlind = !attributionFailure && !isIncomplete;
-                let sourceDiagnostics;
-                // INSTRUMENT-READ fault: did the durable record fail to READ (API
-                // unreachable), as opposed to reading fine and confirming nothing? Probed
-                // only on the fully-blind path, where it names WHICH seam went blind so a
-                // "could not determine" is never reported as "there is nothing here".
-                let instrumentUndetermined = null;
-                if (isFullyBlind) {
-                    try {
-                        sourceDiagnostics = diagnoseEmptyDiffSource(resolveDiffCwd(v, deps), deps.integrationBranch, recordedMergeShaForVerifyImpl(v), recordedCommitShas, recordedPreMergeRef, v.deliveryId).map((p) => ({ source: p.source, reason: p.reason }));
-                    }
-                    catch (err) {
-                        log.debug(`[verification] source diagnosis failed for delivery ${v.deliveryId}:`, err.message);
-                    }
-                    if (deps.resolveEvidenceInstrumentFault) {
-                        try {
-                            instrumentUndetermined = await deps.resolveEvidenceInstrumentFault(v);
-                        }
-                        catch (err) {
-                            log.debug(`[verification] instrument-fault probe failed for delivery ${v.deliveryId}:`, err.message);
-                        }
-                    }
-                    // Prepend the read-fault as its own diagnostic source so the blind-source
-                    // line names the seam that could not be determined, distinctly from the
-                    // topology sources that were read and found empty.
-                    if (instrumentUndetermined) {
-                        sourceDiagnostics = [
-                            { source: instrumentUndetermined.seam, reason: `undetermined (could not read record: ${instrumentUndetermined.reason})` },
-                            ...(sourceDiagnostics ?? []),
-                        ];
-                    }
-                }
-                evidenceUnavailableHold = {
-                    missing: describeMissingJudgeEvidence(evidence),
-                    commitsAhead,
-                    ...(isIncomplete ? { coverage: { recorded: coverage.recorded, covered: coverage.covered } } : {}),
-                    ...(attributionFailure
-                        ? { attribution: { batch: attributionFailure.batch, parsed: 0, deliveries: attributionFailure.deliveries } }
-                        : {}),
-                    ...(sourceDiagnostics && sourceDiagnostics.length > 0 ? { sourceDiagnostics } : {}),
-                    ...(instrumentUndetermined ? { instrumentUndetermined } : {}),
-                };
-                result.outcome = 'failed';
-                result.rationale = attributionFailure
-                    ? `verify unattributable (total attribution failure): none of the ${attributionFailure.batch} ` +
-                        `merged-batch commit(s) carry a parseable Telora-Delivery trailer on a ` +
-                        `${attributionFailure.deliveries}-delivery focus, so the batch cannot be partitioned and this ` +
-                        `delivery would be judged against the combined sibling diff -- the gate renders no verdict; ` +
-                        `re-entering bounded re-work (injection ${v.injectionNodeId} not flipped)`
-                    : isIncomplete
-                        ? `verify half-blind (instrument fault): resolved diff covers only ${coverage.covered}/` +
-                            `${coverage.recorded} of the delivery's recorded commits -- the gate cannot vouch for a ` +
-                            `verdict rendered against part of the work; re-entering bounded re-work ` +
-                            `(injection ${v.injectionNodeId} not flipped)`
-                        : instrumentUndetermined
-                            ? `verify blind (instrument READ fault): could not read the durable record ` +
-                                `(${instrumentUndetermined.seam}: ${instrumentUndetermined.reason}) -- "could not determine", ` +
-                                `NOT "no evidence"; re-entering bounded re-work (injection ${v.injectionNodeId} not flipped)`
-                            : commitsAhead > 0
-                                ? `verify blind (instrument fault): delivery branch is ${commitsAhead} commit(s) ahead of ` +
-                                    `${deps.integrationBranch} but the resolved diff is empty -- broken diff measurement, ` +
-                                    `not a shortfall; re-entering bounded re-work (injection ${v.injectionNodeId} not flipped)`
-                                : `verify blind (instrument fault): no diff/changed-files/inspection evidence to judge the ` +
-                                    `work -- the gate is blind, not the work short; re-entering bounded re-work ` +
-                                    `(injection ${v.injectionNodeId} not flipped)`;
-                log.warn(`[verification] ${result.rationale} (delivery ${v.deliveryId})`);
-                // Diagnostic record: name each consulted source and why it was empty, at
-                // the SAME warn level as the rationale (no level bump), so a repeat
-                // fast-forward blinding is diagnosable via `telora-daemon logs` without
-                // database access.
-                if (sourceDiagnostics && sourceDiagnostics.length > 0) {
-                    const diag = sourceDiagnostics.map((p) => `${p.source}: ${p.reason}`).join('; ');
-                    log.warn(`[verification] blind-source diagnosis (delivery ${v.deliveryId}): ${diag}`);
-                }
-            }
-            else if (shortfalls.length > 0) {
-                // Hold the gate, do NOT flip. A shortfall is an EXECUTION gap the team
-                // that produced it can close, not an intent question for a human -- so
-                // it re-enters the loop as bounded re-work (via deps.deliverShortfallFeedback
-                // below, which routes verify -> verify_failed through the reconciler),
-                // never a needs_intent inbox item. The genuine human residue is the
-                // EXISTING verify_failed iteration cap (verify_gate_unclearable).
-                shortfallHold = shortfalls;
-                result.outcome = 'failed';
-                result.rationale =
-                    `verify reconciliation found ${shortfalls.length} shortfall(s) vs declared intent; ` +
-                        `injection ${v.injectionNodeId} not flipped (re-entering bounded re-work)`;
-            }
-            else {
-                let flipped = false;
-                try {
-                    await deps.verifyInjection(v.injectionNodeId, restatements);
-                    flipped = true;
-                }
-                catch (err) {
-                    result.outcome = 'pending';
-                    result.rationale = `verifyInjection failed for ${v.injectionNodeId}: ${err.message}`;
-                }
-                // INWARD drift (TEL-3/TEL-4): any target the reconciliation stamped
-                // `legitimate_divergence` is a tree CLAIM reality contradicted. Surface
-                // each as an inward drift proposal -- AFTER the flip landed -- so a
-                // confident-but-wrong assertion is corrected by drift rather than
-                // frozen. observedState carries the tree's ORIGINAL claim (not the
-                // achieved reality); proposedCorrection carries what reality showed.
-                // Best-effort + non-fatal: a failure must not undo the verify flip.
-                if (flipped) {
-                    const divergedWritebacks = restatements
-                        .filter((r) => r.classification === 'legitimate_divergence')
-                        .map((r) => ({
-                        nodeId: r.nodeId,
-                        classification: 'legitimate_divergence',
-                        statement: r.statement,
-                        originalClaim: r.originalClaim,
-                        ...(r.divergenceReason ? { verifyDivergenceReason: r.divergenceReason } : {}),
-                    }));
-                    if (divergedWritebacks.length > 0) {
-                        try {
-                            await deps.emitInwardDrift(v.injectionNodeId, divergedWritebacks, realityTreeId);
-                        }
-                        catch (err) {
-                            log.warn(`[verification] inward drift emit failed for ${v.injectionNodeId}:`, err.message);
-                        }
-                    }
-                }
-            }
-        }
-    }
-    await deps.recordOutcome(v.deliveryId, result.outcome);
-    // Feedback dispatch by FAILURE ORIGIN. The three origins are mutually
-    // exclusive: a shortfall / instrument-fault hold only demotes a PASSED
-    // outcome, so a deterministic-failed run carries neither.
-    //
-    // Instrument-fault re-work FIRST: the verify path was handed nothing to judge,
-    // so it re-enters the bounded verify_failed re-work cycle (carrying the
-    // instrument-fault context in gate_state under the evidence-unavailable guard)
-    // and files NO escalation -- an empty bundle names no human-only act, so it
-    // never reaches a human inbox. Distinct guard from the deterministic/shortfall
-    // holds; the iteration cap (verify_gate_unclearable) is the sole residue.
-    if (evidenceUnavailableHold && deps.requeueEvidenceUnavailableAsRework) {
-        try {
-            await deps.requeueEvidenceUnavailableAsRework(v, evidenceUnavailableHold);
-        }
-        catch (err) {
-            log.warn(`[verification] evidence-unavailable re-work failed for delivery ${v.deliveryId}:`, err.message);
-        }
-    }
-    else if (shortfallHold.length > 0 && deps.deliverShortfallFeedback) {
-        try {
-            await deps.deliverShortfallFeedback(v, shortfallHold);
-        }
-        catch (err) {
-            log.warn(`[verification] shortfall feedback failed for delivery ${v.deliveryId}:`, err.message);
-        }
-    }
-    else if (result.outcome === 'failed' && v.verificationMethod === 'deterministic' && deps.deliverFailureFeedback) {
-        // Genuine deterministic failure (the shell command actually failed): write
-        // gate_state under deterministic_verification + inject. Best-effort.
-        try {
-            await deps.deliverFailureFeedback(v, result);
-        }
-        catch (err) {
-            log.warn(`[verification] failure feedback failed for delivery ${v.deliveryId}:`, err.message);
-        }
-    }
-    // Drift emission is independent of verdict — a 'passed' inspection can
-    // still observe contradictions to other CRT statements.
-    const inspection = result.inspection;
-    if (inspection && inspection.driftObservations.length > 0) {
-        for (const obs of inspection.driftObservations) {
-            try {
-                await deps.emitDriftProposal({
-                    focusId: v.focusId,
-                    productId: v.productId,
-                    injectionNodeId: v.injectionNodeId,
-                    observation: obs,
-                });
-            }
-            catch (err) {
-                log.warn(`[verification] drift proposal emit failed for delivery ${v.deliveryId}:`, err.message);
-            }
-        }
-    }
-    return result;
-}
-/**
- * One tick: fetch pending verifications across products, dispatch each.
- * Returns counts for telemetry.
- */
-export async function runVerificationTick(config, deps) {
-    const merged = { ...defaultDeps(config), ...deps };
-    const counts = { checked: 0, passed: 0, failed: 0, pending: 0, escalated: 0 };
-    // Resolve the default-on config PER PRODUCT, from each product's own scoped
-    // config -- the manifest layer is read from `config.repoPath`, so resolving
-    // once from the un-scoped top-level config made every product's gate a
-    // function of the daemon's launch directory (and silently dropped the
-    // per-product products[].defaultVerification override). A malformed manifest
-    // is contained to its own product there; see resolveProductVerificationScopes.
-    const scopes = resolveProductVerificationScopes(config, merged.resolveDefaultVerification);
-    // The concurrency cap is DAEMON-WIDE (the semaphore is a module-level
-    // singleton guarding this host's CPU/RAM), so it is set ONCE from a single
-    // order-independent value rather than per-product inside the loop, where the
-    // last product iterated would silently win. See resolveDaemonWideVerifyCap for
-    // the rule (min across products) and why.
-    verificationSemaphore.setLimit(resolveDaemonWideVerifyCap(scopes));
-    for (const { product, productConfig, resolved } of scopes) {
-        let pending;
-        try {
-            pending = await merged.getPendingVerifications(product.id);
-        }
-        catch (err) {
-            log.warn(`[verification] fetch failed for product ${product.id}:`, err.message);
-            continue;
-        }
-        // Default-on: append deterministic runs for verify deliveries with no
-        // explicit method (the whole-repo suite the daemon now owns). Inert when
-        // no default command is configured for THIS product (resolved.enabled ===
-        // false) or when its config could not be resolved at all (resolved ===
-        // undefined -- malformed manifest, already logged at ERROR above).
-        const explicitIds = new Set(pending.map((p) => p.deliveryId));
-        let defaultOn = [];
-        if (resolved) {
-            try {
-                defaultOn = await collectDefaultOnVerifications(productConfig, resolved, explicitIds, merged);
-            }
-            catch (err) {
-                log.warn(`[verification] default-on scan failed for product ${product.id}:`, err.message);
-            }
-        }
-        for (const v of [...pending, ...defaultOn]) {
-            counts.checked += 1;
-            // Mark default-on candidates as run BEFORE dispatch so a mid-run failure
-            // does not re-enqueue the same 30-min suite on the next tick.
-            if (v.verificationOutcome === null && !explicitIds.has(v.deliveryId)) {
-                markDefaultOnRan(v.deliveryId);
-            }
-            // Cap concurrent whole-repo runs across overlapping ticks.
-            await verificationSemaphore.acquire();
-            try {
-                const r = await runVerificationForDelivery(v, merged);
-                counts[r.outcome] = (counts[r.outcome] ?? 0) + 1;
-            }
-            catch (err) {
-                log.warn(`[verification] tick failed for delivery ${v.deliveryId}:`, err.message);
-            }
-            finally {
-                verificationSemaphore.release();
-            }
-        }
-    }
-    // Clean-environment install probe (Review Gate Hardening, deferrable): an
-    // ADDITIONAL, out-of-band pass over manifest-touching verify deliveries,
-    // independent of verification_method. Writes the probe result into gate_state.
-    // Best-effort -- never aborts the verification tick.
-    try {
-        const probe = await runInstallProbeTick(config);
-        if (probe.probesRun > 0) {
-            log.info(`[install-probe] tick: focusesScanned=${probe.focusesScanned} probesRun=${probe.probesRun} ` +
-                `blocked=${probe.deliveriesBlocked} unverifiable=${probe.deliveriesUnverifiable}`);
-        }
-    }
-    catch (err) {
-        log.warn('[install-probe] tick failed:', err.message);
-    }
-    return counts;
-}
-//# sourceMappingURL=verification-engine.js.map