@telora/daemon 0.21.26 → 0.21.82

package/dist/verify/verification-baseline.js

@@ -0,0 +1,267 @@
+/**
+ * Baseline-diff attribution keyed by the focus-base SHA.
+ *
+ * Replaces per-delivery LLM failure attribution with an exact mechanical diff:
+ * run the verification command ONCE against the focus base (the merge-base of
+ * the focus branch and integration), cache the parsed failing-test set per
+ * (product, base SHA), then classify each delivery-HEAD failure as NEW (in HEAD
+ * not baseline -> gates) or PRE-EXISTING (in both -> recorded, non-blocking).
+ * The differential gate then measures only the delta the focus introduced.
+ *
+ * Correctness note: the HEAD run must execute in the FOCUS WORKTREE (HEAD of the
+ * focus branch), and the baseline in a detached worktree at the merge-base --
+ * otherwise the two sides are not comparable. verification-engine resolves the
+ * focus-worktree cwd for the HEAD run; this module owns the base side.
+ *
+ * @module verification-baseline
+ */
+import { spawn } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { resolveGlobalStateDir } from '../shell/daemon-process.js';
+import { parseFailingTests } from './verification-failure-parser.js';
+import { runGitSync } from '../git/exec.js';
+import { configForProduct } from '../shell/config.js';
+import { getFocusWorktree } from '../focus/focus-worktree-state.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'verification' });
+/** Default timeout for a baseline run when the verification config sets none: 30 min. */
+const DEFAULT_BASELINE_TIMEOUT_MS = 30 * 60 * 1000;
+/**
+ * Partition a HEAD failing-test set against the baseline failing-test set. Pure.
+ * Sorted for stable output / comparison.
+ */
+export function classifyFailures(headFailing, baselineFailing) {
+    const newFailures = [];
+    const preExisting = [];
+    for (const id of headFailing) {
+        if (baselineFailing.has(id))
+            preExisting.push(id);
+        else
+            newFailures.push(id);
+    }
+    return { newFailures: newFailures.sort(), preExisting: preExisting.sort() };
+}
+// ---------------------------------------------------------------------------
+// SHA-keyed baseline cache (under the global state dir)
+// ---------------------------------------------------------------------------
+function baselineCacheDir() {
+    return resolve(resolveGlobalStateDir(), 'verification-baseline');
+}
+/** Cache file path for a (product, base SHA). Exported for tests. */
+export function baselineCachePath(productId, baseSha) {
+    // Sanitize: productId is a uuid and baseSha a hex sha, both filename-safe, but
+    // guard against separators defensively.
+    const safe = `${productId}-${baseSha}`.replace(/[^a-zA-Z0-9._-]/g, '_');
+    return resolve(baselineCacheDir(), `${safe}.json`);
+}
+/** Read the cached baseline failing-test set, or null on miss / unreadable. */
+export function readBaselineCache(productId, baseSha) {
+    const path = baselineCachePath(productId, baseSha);
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (!Array.isArray(parsed.failingTests))
+            return null;
+        return parsed.failingTests.filter((t) => typeof t === 'string');
+    }
+    catch {
+        return null;
+    }
+}
+/** Write the baseline failing-test set for a (product, base SHA). Best-effort. */
+export function writeBaselineCache(productId, baseSha, failingTests) {
+    try {
+        mkdirSync(baselineCacheDir(), { recursive: true });
+        writeFileSync(baselineCachePath(productId, baseSha), JSON.stringify({ productId, baseSha, failingTests }, null, 2), { mode: 0o600 });
+    }
+    catch (err) {
+        log.warn(`failed to write baseline cache for ${productId}@${baseSha.slice(0, 8)}:`, err.message);
+    }
+}
+/**
+ * Resolve the baseline failing-test set for a (product, base SHA): a cache hit
+ * short-circuits (an unchanged SHA never re-runs the suite); a miss runs the
+ * baseline once, parses, and caches.
+ */
+export async function getBaselineFailingSet(productId, baseSha, deps) {
+    const cached = deps.readCache(productId, baseSha);
+    if (cached)
+        return new Set(cached);
+    const output = await deps.runBaseline(baseSha);
+    const failing = [...parseFailingTests(output)];
+    deps.writeCache(productId, baseSha, failing);
+    return new Set(failing);
+}
+// ---------------------------------------------------------------------------
+// git + shell helpers for the default baseline runner
+// ---------------------------------------------------------------------------
+/** Resolve the focus base = merge-base(integrationBranch, HEAD) in a worktree. Null on failure. */
+export function resolveFocusBaseSha(worktreePath, integrationBranch) {
+    const result = runGitSync(['merge-base', integrationBranch, 'HEAD'], worktreePath);
+    if (!result.success || result.output.trim().length === 0)
+        return null;
+    return result.output.trim();
+}
+/** Spawn `sh -c command` in cwd and capture the FULL combined stdout+stderr. */
+function runShellCapture(command, cwd, timeoutMs) {
+    return new Promise((resolvePromise) => {
+        const child = spawn('sh', ['-c', command], { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+        let out = '';
+        child.stdout?.on('data', (c) => { out += c.toString('utf8'); });
+        child.stderr?.on('data', (c) => { out += c.toString('utf8'); });
+        const timer = setTimeout(() => { try {
+            child.kill('SIGKILL');
+        }
+        catch { /* ignore */ } }, timeoutMs);
+        child.on('error', () => { clearTimeout(timer); resolvePromise(out); });
+        child.on('close', () => { clearTimeout(timer); resolvePromise(out); });
+    });
+}
+/**
+ * Default baseline runner: create a detached worktree at the base SHA off the
+ * product's main repo, run the command there, capture output, and remove the
+ * worktree. Best-effort -- on any git failure returns '' (no baseline -> the
+ * caller treats all HEAD failures as new, i.e. the pre-attribution gate).
+ */
+export function buildDefaultRunBaseline(config, productId, command, timeoutMs) {
+    return async (baseSha) => {
+        const product = config.products.find(p => p.id === productId);
+        const repoPath = product ? configForProduct(config, product).repoPath : config.repoPath;
+        const wtDir = resolve(resolveGlobalStateDir(), 'verification-baseline-wt');
+        const wtPath = resolve(wtDir, `${productId}-${baseSha.slice(0, 12)}`.replace(/[^a-zA-Z0-9._-]/g, '_'));
+        try {
+            mkdirSync(wtDir, { recursive: true });
+            runGitSync(['worktree', 'prune'], repoPath);
+            if (existsSync(wtPath)) {
+                runGitSync(['worktree', 'remove', '--force', wtPath], repoPath);
+                rmSync(wtPath, { recursive: true, force: true });
+            }
+            const add = runGitSync(['worktree', 'add', '--detach', wtPath, baseSha], repoPath);
+            if (!add.success) {
+                log.warn(`baseline worktree add failed at ${baseSha.slice(0, 8)}: ${add.error}`);
+                return '';
+            }
+        }
+        catch (err) {
+            log.warn(`baseline worktree setup failed:`, err.message);
+            return '';
+        }
+        try {
+            return await runShellCapture(command, wtPath, timeoutMs);
+        }
+        finally {
+            try {
+                runGitSync(['worktree', 'remove', '--force', wtPath], repoPath);
+                rmSync(wtPath, { recursive: true, force: true });
+                runGitSync(['worktree', 'prune'], repoPath);
+            }
+            catch { /* best-effort cleanup */ }
+        }
+    };
+}
+/**
+ * Classify a failed HEAD run against the focus base. Returns null when no
+ * baseline could be resolved (no worktree / no merge-base) -- the caller then
+ * treats all HEAD failures as new (fail-closed toward gating, the behavior
+ * before attribution existed).
+ */
+export async function attributeFailures(v, result, deps) {
+    const worktreePath = deps.resolveWorktreePath(v);
+    if (!worktreePath)
+        return null;
+    const baseSha = resolveFocusBaseSha(worktreePath, deps.integrationBranch);
+    if (!baseSha || !v.productId)
+        return null;
+    const headFailing = parseFailingTests(deps.readHeadOutput(result));
+    const baselineFailing = await deps.getBaselineFailingSet(v.productId, baseSha);
+    return classifyFailures(headFailing, baselineFailing);
+}
+/** Default HEAD-output reader: full log file when present, else the tails. */
+export function readHeadOutputDefault(result) {
+    if (result.logPath && existsSync(result.logPath)) {
+        try {
+            return readFileSync(result.logPath, 'utf8');
+        }
+        catch (err) {
+            // fall through to tails
+            log.debug('fall through to tails', { error: String(err?.message ?? err) });
+        }
+    }
+    return `${result.stdoutTail ?? ''}\n${result.stderrTail ?? ''}`;
+}
+// ---------------------------------------------------------------------------
+// Default wiring consumed by verification-engine (kept here to keep that file
+// under the daemon 800-line limit).
+// ---------------------------------------------------------------------------
+/**
+ * Build the default `attributeFailures` closure: reads the focus-worktree cwd,
+ * resolves the merge-base, runs (or reuses a cached) baseline at that SHA in a
+ * detached worktree, and classifies HEAD failures against it. Returns null when
+ * no baseline is resolvable (caller gates all failures).
+ */
+export function buildDefaultAttributeFailures(config) {
+    return (v, result) => {
+        const cfg = v.verificationConfig ?? {};
+        const command = typeof cfg.command === 'string' ? cfg.command : '';
+        const timeoutMs = typeof cfg.timeoutMs === 'number' && cfg.timeoutMs > 0
+            ? cfg.timeoutMs
+            : DEFAULT_BASELINE_TIMEOUT_MS;
+        const runBaseline = buildDefaultRunBaseline(config, v.productId ?? config.productId, command, timeoutMs);
+        return attributeFailures(v, result, {
+            resolveWorktreePath: (pv) => (pv.focusId ? getFocusWorktree(pv.focusId)?.worktreePath ?? null : null),
+            integrationBranch: config.integrationBranch,
+            getBaselineFailingSet: (productId, baseSha) => getBaselineFailingSet(productId, baseSha, {
+                readCache: readBaselineCache,
+                writeCache: writeBaselineCache,
+                runBaseline,
+            }),
+            readHeadOutput: readHeadOutputDefault,
+        });
+    };
+}
+/**
+ * Build the default `resolveVerificationCwd`: the focus worktree (HEAD of the
+ * focus branch) so the deterministic run measures the focus's changes, falling
+ * back to the product repo path when no focus worktree exists.
+ */
+export function buildResolveVerificationCwd(resolveCwd) {
+    return (v) => {
+        if (v.focusId) {
+            const wt = getFocusWorktree(v.focusId);
+            if (wt?.worktreePath)
+                return wt.worktreePath;
+        }
+        return resolveCwd(v.productId);
+    };
+}
+/**
+ * Decide the attributed outcome for a failed deterministic run: all-pre-existing
+ * demotes to 'passed' (the focus introduced no regression); any new failure keeps
+ * it 'failed'. Pure -- exported for testing.
+ */
+export function applyAttribution(deliveryId, classification) {
+    const { newFailures, preExisting } = classification;
+    if (newFailures.length === 0) {
+        return {
+            outcome: 'passed',
+            rationale: `deterministic check exited non-zero but all ${preExisting.length} failure(s) ` +
+                `pre-exist on the focus base -- no new regression (differential pass)`,
+            newFailures,
+            preExisting,
+            log: preExisting.length > 0
+                ? `[verification] delivery ${deliveryId}: ${preExisting.length} pre-existing base failure(s) recorded, non-blocking (differential pass)`
+                : null,
+        };
+    }
+    return {
+        outcome: 'failed',
+        rationale: `deterministic check failed: ${newFailures.length} NEW failure(s) vs focus base` +
+            (preExisting.length > 0 ? `, ${preExisting.length} pre-existing (recorded, non-blocking)` : ''),
+        newFailures,
+        preExisting,
+        log: null,
+    };
+}
+//# sourceMappingURL=verification-baseline.js.map

package/dist/verify/verification-baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-baseline.js","sourceRoot":"","sources":["../../src/verify/verification-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAGrD,yFAAyF;AACzF,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAUnD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAgC,EAChC,eAAoC;IAEpC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;YAC7C,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,SAAS,gBAAgB;IACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,EAAE,uBAAuB,CAAC,CAAC;AACnE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAe;IAClE,+EAA+E;IAC/E,wCAAwC;IACxC,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC,gBAAgB,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAe;IAClE,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA+B,CAAC;QACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,OAAe,EAAE,YAAsB;IAC3F,IAAI,CAAC;QACH,SAAS,CAAC,gBAAgB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,aAAa,CACX,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAC7D,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,sCAAsC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,IAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,iBAAyB;IACjF,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;IACtE,OAAO,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACvF,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,SAAiB;IAEjB,OAAO,KAAK,EAAE,OAAe,EAAmB,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QACxF,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC;YACH,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAChE,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YACnF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,mCAAmC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBACjF,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACpE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,UAAU,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAChE,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,CAAsB,EACtB,MAA8B,EAC9B,IAAqB;IAErB,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/E,OAAO,gBAAgB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,IAAI,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACnB,wBAAwB;YAClB,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,KAAK,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAoB;IAEpB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACnB,MAAM,GAAG,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC;YACtE,CAAC,CAAC,GAAG,CAAC,SAAS;YACf,CAAC,CAAC,2BAA2B,CAAC;QAChC,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzG,OAAO,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE;YAClC,mBAAmB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrG,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,qBAAqB,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAC5C,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE;gBACxC,SAAS,EAAE,iBAAiB;gBAC5B,UAAU,EAAE,kBAAkB;gBAC9B,WAAW;aACZ,CAAC;YACJ,cAAc,EAAE,qBAAqB;SACtC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAgD;IAEhD,OAAO,CAAC,CAAC,EAAE,EAAE;QACX,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,EAAE,EAAE,YAAY;gBAAE,OAAO,EAAE,CAAC,YAAY,CAAC;QAC/C,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,cAAqC;IACxF,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC;IACpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,SAAS,EACP,+CAA+C,WAAW,CAAC,MAAM,cAAc;gBAC/E,sEAAsE;YACxE,WAAW;YACX,WAAW;YACX,GAAG,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,2BAA2B,UAAU,KAAK,WAAW,CAAC,MAAM,0EAA0E;gBACxI,CAAC,CAAC,IAAI;SACT,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,SAAS,EACP,+BAA+B,WAAW,CAAC,MAAM,+BAA+B;YAChF,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,MAAM,wCAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,WAAW;QACX,WAAW;QACX,GAAG,EAAE,IAAI;KACV,CAAC;AACJ,CAAC"}

package/dist/verify/verification-config.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Resolve the default-on deterministic verification config.
+ *
+ * The deterministic verification method used to be opt-in (a delivery only ran
+ * a check when it carried an explicit verification_method). This module makes
+ * it the DEFAULT for every delivery entering verify, using a config-default
+ * command run daemon-side at the coding->verify edge.
+ *
+ * Resolution precedence (env > operator file > repo manifest > typed default),
+ * mirroring how resolveTelemetryConfig / resolveLacunaConfig work in the daemon:
+ *   - command:      TELORA_DEFAULT_VERIFY_COMMAND    > config.defaultVerification.command    > telora.verify.json > '' (disabled)
+ *   - timeoutMs:    TELORA_DEFAULT_VERIFY_TIMEOUT_MS > config.defaultVerification.timeoutMs   > telora.verify.json > 30 min
+ *   - maxConcurrent:TELORA_DEFAULT_VERIFY_MAX_CONCURRENT > config.defaultVerification.maxConcurrent > telora.verify.json > 1
+ *
+ * The repo-manifest layer (`telora.verify.json`, see verification-manifest.ts)
+ * is what lets a REPO declare its own gate: the two layers above it are both
+ * per-workstation and untracked (`.gitignore:72` ignores `.telora/` wholesale;
+ * cli/verify-setup.ts:218 writes to ~/.telora/daemon.json), so without it no PR
+ * could arm the gate and a fresh clone was ungated by construction.
+ *
+ * The seam stays OPT-IN: a repo shipping no manifest still resolves to ''
+ * (disabled). No default command is ever hard-coded here -- the daemon manages
+ * products that have no whole-repo verification command at all.
+ *
+ * The env knobs are read directly from `process.env` here rather than through
+ * daemon-core's env-config Zod index: daemon-core is a registry-installed
+ * dependency (not a workspace symlink), so an env-config edit there would not
+ * take effect at runtime for this daemon. Reading process.env directly is the
+ * same pattern buildEngineRuntimeConfig uses for telemetry/lacuna.
+ *
+ * @module verification-config
+ */
+import type { DaemonConfig, DefaultVerificationConfig } from '../types/index.js';
+import { type VerifyManifestReader } from './verification-manifest.js';
+/** Default timeout for the default-on deterministic run: 30 min (full build+test sweep). */
+export declare const DEFAULT_VERIFY_TIMEOUT_MS: number;
+/** Default max concurrent daemon-side verification runs. */
+export declare const DEFAULT_VERIFY_MAX_CONCURRENT = 1;
+/** Env var names for the default-on verification knobs. */
+export declare const VERIFY_ENV: {
+    readonly COMMAND: "TELORA_DEFAULT_VERIFY_COMMAND";
+    readonly TIMEOUT_MS: "TELORA_DEFAULT_VERIFY_TIMEOUT_MS";
+    readonly MAX_CONCURRENT: "TELORA_DEFAULT_VERIFY_MAX_CONCURRENT";
+};
+/**
+ * Fully-resolved default-on verification settings. `enabled` is a convenience
+ * flag: true iff a non-empty command is configured (the default-on path only
+ * runs for deliveries with no explicit method WHEN enabled).
+ */
+export interface ResolvedDefaultVerification {
+    command: string;
+    timeoutMs: number;
+    maxConcurrent: number;
+    enabled: boolean;
+}
+/**
+ * The config slice these resolvers need: the (already per-product-selected)
+ * verification block, plus the product's repo root so the repo-manifest layer
+ * can be read.
+ *
+ * `repoPath` is OPTIONAL rather than picked from DaemonConfig (where it is
+ * required) so that callers holding only a scoped `{ defaultVerification }`
+ * still typecheck; a missing repoPath simply means "no repo manifest layer".
+ * A product-scoped config always carries it -- `configForProduct`
+ * (config.ts:351) sets `repoPath` per product -- so the real daemon paths get
+ * the manifest layer for free.
+ */
+export type VerificationConfigScope = Pick<DaemonConfig, 'defaultVerification'> & {
+    /** Product repo root; the manifest is read from `<repoPath>/telora.verify.json`. */
+    repoPath?: string;
+};
+/**
+ * Resolve the default-on verification config from
+ * env > operator file > repo manifest > typed default.
+ *
+ * Pure w.r.t. its inputs: env is injectable, and the repo-manifest read is
+ * injected via `readManifest` rather than touching fs inside this resolver, so
+ * the whole precedence chain is assertable without a real repo.
+ *
+ * Env values are parsed by daemon-core's loadEnvConfig, so an invalid numeric
+ * value fails loudly at daemon startup (naming the var) instead of silently
+ * degrading mid-tick. A malformed repo manifest fails the same way (naming the
+ * file) -- see verification-manifest.ts for why that is never degraded to
+ * "disabled".
+ *
+ * The manifest is read whenever a repoPath is present, regardless of which
+ * layer ultimately wins, so a broken repo declaration surfaces even on a
+ * workstation whose env/operator file happens to override it.
+ *
+ * One asymmetry worth naming: an operator's explicit `declined: true` marker
+ * SUPPRESSES the repo-manifest command. The marker is a recorded operator
+ * decision to gate on AI review only, and the operator file outranks the repo
+ * manifest -- so a repo declaring a command cannot silently overturn it. Env
+ * still wins over both (an explicit env command beats a stale decline marker,
+ * unchanged).
+ */
+export declare function resolveDefaultVerification(config: VerificationConfigScope, env?: NodeJS.ProcessEnv, readManifest?: VerifyManifestReader): ResolvedDefaultVerification;
+/**
+ * Declarative verification posture, derived at read time from config (never a
+ * filed event, so it cannot spam and self-clears once configured):
+ *  - `configured`   -- a non-empty verification command resolves (env, operator
+ *                      file, or the repo's committed `telora.verify.json`).
+ *  - `declined`     -- no command resolves AND an explicit review-only decline
+ *                      marker is recorded. Deliveries gate on AI review only,
+ *                      by deliberate decision (not a gap).
+ *  - `unconfigured` -- no command resolves and no decline recorded. Deliveries
+ *                      gate on AI review only because setup is incomplete.
+ */
+export type VerificationPosture = 'configured' | 'declined' | 'unconfigured';
+/**
+ * Derive the verification posture for one (product-scoped) config.
+ *
+ * Pure w.r.t. its inputs (env is injectable for tests) and free of any
+ * escalation/side-effect path -- posture is declarative state, surfaced on
+ * ambient read surfaces, never a filed escalation. Callers pass a product-scoped
+ * config (from `configForProduct`) so `config.defaultVerification` is already the
+ * selected per-product-or-global block and `repoPath` points at that product's
+ * repo -- which is what lets a repo-manifest-only command read `configured`.
+ *
+ * An explicitly resolved command wins over the decline marker: an operator who
+ * sets a command (via env or file) has configured verification regardless of a
+ * stale `declined` flag. The marker still suppresses the repo manifest (the
+ * operator file outranks it), so `declined: true` keeps reading `declined`.
+ */
+export declare function deriveVerificationPosture(config: VerificationConfigScope, env?: NodeJS.ProcessEnv, readManifest?: VerifyManifestReader): VerificationPosture;
+/** Structured posture for one product, published for app consumption. */
+export interface ProductVerificationPosture {
+    posture: VerificationPosture;
+    /** The resolved command; empty string unless posture is `configured`. */
+    command: string;
+    /** The resolved timeout (ms) for the command; meaningful when `configured`. */
+    timeoutMs: number;
+}
+/**
+ * Build a `{ [productId]: { posture, command } }` map across products, applying
+ * the per-product-override-else-global fallback (mirrors configForProduct) and
+ * the global env command. Pure; the structured counterpart of
+ * formatVerificationPostureLines, used to PUBLISH posture (e.g. in the daemon
+ * heartbeat metadata) for the web app to read. Never files an escalation.
+ */
+export declare function buildProductPostureMap(products: ReadonlyArray<{
+    id: string;
+    repoPath?: string;
+    defaultVerification?: DefaultVerificationConfig;
+}>, globalBlock: DefaultVerificationConfig | undefined, env?: NodeJS.ProcessEnv, readManifest?: VerifyManifestReader): Record<string, ProductVerificationPosture>;
+//# sourceMappingURL=verification-config.d.ts.map

package/dist/verify/verification-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-config.d.ts","sourceRoot":"","sources":["../../src/verify/verification-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAE3F,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AAExD,4DAA4D;AAC5D,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,2DAA2D;AAC3D,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,GAAG;IAChF,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,uBAAuB,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,GAAE,oBAAyC,GACtD,2BAA2B,CAmC7B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,UAAU,GAAG,cAAc,CAAC;AAE7E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,uBAAuB,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,GAAE,oBAAyC,GACtD,mBAAmB,CAKrB;AAED,yEAAyE;AACzE,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;CAAE,CAAC,EAC3G,WAAW,EAAE,yBAAyB,GAAG,SAAS,EAClD,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,GAAE,oBAAyC,GACtD,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAiB5C"}

package/dist/verify/verification-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-config.js","sourceRoot":"","sources":["../../src/verify/verification-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAA6B,MAAM,4BAA4B,CAAC;AAE3F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,+BAA+B;IACxC,UAAU,EAAE,kCAAkC;IAC9C,cAAc,EAAE,sCAAsC;CAC9C,CAAC;AA+BX;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA+B,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAqC,kBAAkB;IAEvD,MAAM,IAAI,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,MAAM,CAAC,6BAA6B,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QACjF,CAAC,CAAC,IAAI,CAAC,OAAO;QACd,CAAC,CAAC,SAAS,CAAC;IACd,2EAA2E;IAC3E,MAAM,eAAe,GAAG,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC;IAChF,MAAM,OAAO,GACX,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;WAC5E,WAAW;WACX,eAAe;WACf,EAAE,CAAC;IAER,MAAM,SAAS,GACb,MAAM,CAAC,gCAAgC;WACpC,CAAC,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;WACxF,QAAQ,EAAE,SAAS;WACnB,yBAAyB,CAAC;IAE/B,MAAM,aAAa,GACjB,MAAM,CAAC,oCAAoC;WACxC,CAAC,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;WACpG,QAAQ,EAAE,aAAa;WACvB,6BAA6B,CAAC;IAEnC,OAAO;QACL,OAAO;QACP,SAAS;QACT,aAAa;QACb,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA+B,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAqC,kBAAkB;IAEvD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC;IAC1C,IAAI,MAAM,CAAC,mBAAmB,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACrE,OAAO,cAAc,CAAC;AACxB,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAA2G,EAC3G,WAAkD,EAClD,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAqC,kBAAkB;IAEvD,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,MAAM,GAA4B;YACtC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,WAAW;YACzD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QACvE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG;YACV,OAAO,EAAE,yBAAyB,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC;YAC7D,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/verify/verification-default-on.d.ts

@@ -0,0 +1,160 @@
+/**
+ * Default-on deterministic verification: selection + concurrency cap.
+ *
+ * The deterministic verification method used to be opt-in (a delivery only ran
+ * a check when it carried an explicit verification_method). This module makes
+ * it the DEFAULT for every delivery entering verify: it discovers verify-status
+ * deliveries with no explicit method and synthesizes a `deterministic`
+ * PendingVerification carrying the config-default command, and it caps
+ * concurrent daemon-side runs so a burst cannot spawn N whole-repo suites.
+ *
+ * Extracted from verification-engine.ts to keep that file under the daemon
+ * 800-line limit. The dispatch (runVerificationForDelivery / runVerificationTick)
+ * stays in verification-engine.ts and imports from here.
+ *
+ * @module verification-default-on
+ */
+import { type ProductEntry } from '@telora/daemon-core';
+import type { DaemonConfig } from '../types/index.js';
+import type { PendingVerification } from '../queries/verification.js';
+import { type ResolvedDefaultVerification } from './verification-config.js';
+import type { getActiveFocuses } from '../queries/deliveries.js';
+import type { getFocusDeliveries } from '../queries/focuses.js';
+/**
+ * The subset of verification dependencies the default-on scan needs. Kept as a
+ * narrow structural type (rather than importing the full VerificationDeps) so
+ * there is no runtime import cycle with verification-engine.ts.
+ */
+export interface DefaultOnScanDeps {
+    getActiveFocuses: typeof getActiveFocuses;
+    getFocusDeliveries: typeof getFocusDeliveries;
+}
+/**
+ * Counting semaphore capping concurrent daemon-side verification runs.
+ *
+ * A default-on deterministic run is a full build+test sweep (minutes). The
+ * verification tick passes `skipIfRunning`, so ticks themselves no longer
+ * overlap; the cap guards the remaining fan-out (multiple products within one
+ * tick, and any future callers outside the latched tick). The module-level
+ * singleton below is shared across every invocation, so the cap holds
+ * globally, not just within one call.
+ *
+ * A dedicated semaphore (rather than the shared ResourceGovernor) because the
+ * governor's per-engine slots model agent-team spawns and are wired through
+ * the governor-construction path; runVerificationTick is invoked with only
+ * `config` and has no governor handle. The cap value comes from
+ * resolveDefaultVerification (maxConcurrent).
+ */
+export declare class VerificationSemaphore {
+    private permits;
+    private limit;
+    private readonly waiters;
+    constructor(limit: number);
+    /** Adjust the cap (config change between ticks). Only frees waiters on a raise. */
+    setLimit(limit: number): void;
+    acquire(): Promise<void>;
+    release(): void;
+    /** Test-only: how many permits are currently available. */
+    availablePermits(): number;
+}
+/** Shared cap across all tick invocations. Sized from config at each tick. */
+export declare const verificationSemaphore: VerificationSemaphore;
+/** Test-only: inspect the concurrency semaphore. */
+export declare function __getVerificationSemaphoreForTests(): {
+    availablePermits(): number;
+    setLimit(n: number): void;
+};
+/**
+ * One product's verification scope for a tick: its product-scoped config and
+ * the default-on config resolved FROM that scoped config.
+ */
+export interface ProductVerificationScope {
+    product: ProductEntry;
+    /** Product-scoped config (`configForProduct`): productId + repoPath are this product's. */
+    productConfig: DaemonConfig;
+    /**
+     * The resolved default-on config, or `undefined` when resolution FAILED (a
+     * malformed repo manifest). Undefined means "this product's default-on gate is
+     * off this tick" -- never "verification is disabled here", which is what a
+     * silent degrade to '' would have said.
+     */
+    resolved: ResolvedDefaultVerification | undefined;
+}
+/**
+ * Resolve the default-on verification config for every product, from each
+ * product's OWN scoped config.
+ *
+ * WHY per-product (this is the whole point): the repo-manifest layer is read
+ * from `config.repoPath`, so resolution is only meaningful on a product-scoped
+ * config. A multi-product `daemon.json` (products[] each with their own
+ * repoPath) carries no meaningful TOP-LEVEL repoPath -- `config.ts:158` falls
+ * back to `process.cwd()`, the daemon's LAUNCH DIRECTORY. Resolving once from
+ * the un-scoped config therefore made every product's gate a function of where
+ * the daemon happened to be started: launched outside a repo -> no manifest ->
+ * silently inert; launched inside one product's repo -> that repo's command
+ * applied to every OTHER product's deliveries. Neither is a gate.
+ *
+ * Error containment: `resolveDefaultVerification` THROWS on a malformed
+ * manifest by design (verification-manifest.ts -- a typo must never silently
+ * un-arm the gate). Per-product, an uncaught throw would kill the tick for every
+ * product including healthy ones, so it is contained HERE: logged at ERROR
+ * naming the product and the manifest path (every tick -- a persistent,
+ * operator-visible state, never a debug line), and that product's `resolved`
+ * comes back `undefined` so its default-on scan stays off while other products
+ * keep gating. The product's EXPLICIT-method deliveries still verify: they carry
+ * their own command on the delivery row, so a repo-root manifest typo has no
+ * bearing on them and must not disarm them.
+ */
+export declare function resolveProductVerificationScopes(config: DaemonConfig, resolve: (c: DaemonConfig) => ResolvedDefaultVerification): ProductVerificationScope[];
+/**
+ * Resolve the ONE daemon-wide concurrency cap for the shared semaphore.
+ *
+ * The cap is DAEMON-WIDE, not per-product, and deliberately so: the semaphore is
+ * a module-level singleton and the resource it protects is the daemon's HOST
+ * (CPU/RAM/disk for a minutes-long build+test sweep), which every product shares.
+ * Three products each declaring `maxConcurrent: 3` must not mean 9 concurrent
+ * suites on one box. So a single value must be chosen -- and simply calling
+ * `setLimit` inside the per-product loop would be incoherent: the LAST product
+ * iterated would silently win for the rest of the tick.
+ *
+ * RULE: the minimum across the products that resolved one. Chosen because:
+ *  - it is order-independent (min is commutative), so no "last product wins";
+ *  - it is fail-safe -- the cap never exceeds any declaration, and over-capping
+ *    only slows a tick where under-capping can thrash the host;
+ *  - it keeps every layer's declaration live rather than silently dropping the
+ *    manifest's `maxConcurrent`. Each product still resolves through the full
+ *    env > operator file > manifest chain, so an operator setting the env var or
+ *    the global block pins EVERY product's value and therefore the min: the
+ *    operator, who alone knows the box, always has the last word. A repo can
+ *    only make the daemon more conservative than the operator's setting, never
+ *    less.
+ * Stated plainly: the daemon runs at most as many concurrent suites as the most
+ * conservative managed repo allows.
+ *
+ * No resolved values at all (every product's manifest malformed) => the
+ * conservative floor, not a stale limit from a previous tick.
+ */
+export declare function resolveDaemonWideVerifyCap(scopes: readonly ProductVerificationScope[]): number;
+/** Test-only: reset the default-on re-run guard. */
+export declare function __resetDefaultOnGuardForTests(): void;
+/** Test-only: snapshot of the default-on re-run guard. */
+export declare function __getDefaultOnGuardForTests(): ReadonlySet<string>;
+/** Mark a delivery as already run this verify-entry (dispatch-time bookkeeping). */
+export declare function markDefaultOnRan(deliveryId: string): void;
+/** Test-only alias for markDefaultOnRan. */
+export declare function __markDefaultOnRanForTests(deliveryId: string): void;
+/**
+ * Discover deliveries that should receive a DEFAULT-ON deterministic run: in
+ * `verify` status, anchored to an injection, with no explicit verification
+ * method (so not already returned by getPendingVerifications), not in a
+ * read-only audit focus (those are discovery-only and never run a suite), and
+ * not already run this verify-entry (steady-state guard).
+ *
+ * Synthesizes a `deterministic` PendingVerification carrying the resolved
+ * config-default command + timeout. Returns [] when the default-on path is
+ * disabled (no command configured) so the feature is inert until opted in.
+ *
+ * `config` must be product-scoped (config.productId identifies the product).
+ */
+export declare function collectDefaultOnVerifications(config: DaemonConfig, resolved: ResolvedDefaultVerification, explicitDeliveryIds: ReadonlySet<string>, deps: DefaultOnScanDeps): Promise<PendingVerification[]>;
+//# sourceMappingURL=verification-default-on.d.ts.map

package/dist/verify/verification-default-on.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-default-on.d.ts","sourceRoot":"","sources":["../../src/verify/verification-default-on.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAiC,KAAK,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAG3G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAMhE;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;CAC/C;AAMD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAErC,KAAK,EAAE,MAAM;IAKzB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAavB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B,OAAO,IAAI,IAAI;IASf,2DAA2D;IAC3D,gBAAgB,IAAI,MAAM;CAG3B;AAED,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,uBAA+B,CAAC;AAElE,oDAAoD;AACpD,wBAAgB,kCAAkC,IAAI;IAAE,gBAAgB,IAAI,MAAM,CAAC;IAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAE9G;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,YAAY,CAAC;IACtB,2FAA2F;IAC3F,aAAa,EAAE,YAAY,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,EAAE,2BAA2B,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,2BAA2B,GACxD,wBAAwB,EAAE,CAe5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,wBAAwB,EAAE,GAC1C,MAAM,CAMR;AAmBD,oDAAoD;AACpD,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED,0DAA0D;AAC1D,wBAAgB,2BAA2B,IAAI,WAAW,CAAC,MAAM,CAAC,CAEjE;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,4CAA4C;AAC5C,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEnE;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,2BAA2B,EACrC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,EACxC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA4DhC"}