@telora/daemon 0.22.104 → 0.22.131

package/dist/verify/commit-gate-configured.js

@@ -0,0 +1,234 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/completion/review-exit-verdict-gate.test.ts,
+//   packages/daemon/src/focus/listener-product-poll.test.ts,
+//   packages/daemon/src/integration/delivery-gate-write-interleaving.test.ts,
+//   packages/daemon/src/integration/explicit-gate-identity-unreadable.test.ts,
+//   packages/daemon/src/integration/explicit-gate-outcome-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-invalidation-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-reuse.test.ts,
+//   packages/daemon/src/integration/focus-commit-verdict-scenario.test.ts,
+//   packages/daemon/src/integration/review-rework-resume-verdict.test.ts,
+//   packages/daemon/src/integration/verification-rework-resume-verdict.test.ts,
+//   packages/daemon/src/spawn/prompt-assembly-resume-verdict.test.ts,
+//   packages/daemon/src/verify/commit-gate-configured.test.ts,
+//   packages/daemon/src/verify/verification-commit-sharing.test.ts
+// PINNED-BY-END
+/**
+ * Whether a deterministic gate is configured for a verify delivery -- whether the
+ * verification tick runs a gate whose verdict the review exit can wait on, and
+ * WHICH gate that is -- plus the production gate seams every verify routing
+ * decision reads.
+ *
+ * The review exit holds a verify delivery out of done until a passing verdict
+ * exists for the commit it judges (completion/review-exit-verdict-gate.ts). That
+ * hold is only safe where a verdict will actually be rendered -- holding a
+ * delivery no gate will ever judge strands it in verify -- so this predicate
+ * mirrors the tick's own selection (runVerificationTick ->
+ * resolveProductVerificationScopes -> collectDefaultOnVerifications) instead of
+ * restating it:
+ *   - the verification loop runs (TELORA_VERIFICATION_LOOP is not '0');
+ *   - the focus is not read-only and the delivery is anchored to an injection;
+ *   - the delivery is an explicit-method row with a method that renders verdicts,
+ *     OR its product resolves a command, or -- unless the operator declined -- the
+ *     telora.verify.json its judged commit ships declares one (or is malformed,
+ *     which the dispatch still runs and fails loudly).
+ *
+ * An explicit-method delivery is gated by its own run, and is known as one from
+ * the DURABLE delivery row (its verification_method, on the focus delivery read),
+ * not from the pending-verification queue: that queue drops a row once its
+ * outcome is terminal, and an explicit pass must not then read as a default-on
+ * delivery. Only a row from an edge that does not send the column yet (undefined,
+ * not null), or an unreadable row, falls back to the queue. Where neither names a
+ * method, a verdict an explicit run recorded (verify/explicit-gate-outcome.ts: in
+ * process, or on the gate_state the subject carries) still reads "configured", so
+ * a restarted daemon never takes that verdict for no gate at all. The exception
+ * is the behavioral method, a scaffold that always returns pending: no verdict is
+ * ever rendered for it, so waiting on one would strand the delivery -- not
+ * configured.
+ *
+ * Where an explicit run writes no per-commit verdict (an in-place run has no
+ * judged sha; an ai_inspection writes none), the outcome it records IS the
+ * verdict, from two sources read in order (readDeliveryGateOutcome):
+ *   (a) this process's own record (verify/gate-run-registry.ts);
+ *   (b) else the record on the delivery's gate_state
+ *       (verificationHistory.explicitOutcome), which carries failures, no-SHA
+ *       outcomes and the commit the run judged, and is removed before a
+ *       replacement run starts -- so it never outlives the run that supersedes it.
+ * The row's own verification_outcome is NOT a verdict source: the edge stores a
+ * pass with no judged commit, so a pass rendered for commit A would read as a
+ * pass for every later commit. Where neither (a) nor (b) knows the run, the
+ * explicit re-arm scan (verify/explicit-rearm.ts) selects the row again, so the
+ * gate renders a verdict bound to the judged commit.
+ *
+ * The gate is part of the answer (resolveCommitGate). A per-commit verdict is
+ * recorded under the gate its run APPLIED (verify/commit-verdict-record.ts), and
+ * one commit can carry verdicts of several gates: a sibling's default-on pass says
+ * nothing about a delivery whose own explicit command never ran, and a sibling's
+ * failure must not hold it. Routing reads a verdict only under the delivery's own
+ * gate -- its explicit row's command + timeout, or, for a default-on delivery, the
+ * gate its run applies at the judged commit (verify/judged-commit-gate.ts: a
+ * branch manifest that overrides the repoPath gate is the gate that runs), or the
+ * scan's gate where no focus worktree exists and the run is in place. No gate (no
+ * command, a judged commit nobody could read or whose manifest is malformed, or a
+ * delivery gated only by its recorded explicit verdict) matches no per-commit
+ * record. Every own-gate source is read, and a failure from any wins
+ * (completion/review-exit-verdict-gate.ts).
+ *
+ * An explicit run's recorded verdict is read the same way: only under the gate its
+ * run applied (explicitGateKey: the row's method + config). The edge lets an
+ * operator change a row's method or config without resetting its outcome, so a
+ * verdict rendered under the old gate governs nothing, and a row that names no
+ * method takes no explicit verdict at all. A row an older edge sends without the
+ * columns, which the queue does not list, takes a recorded verdict of any gate, as
+ * before those columns existed. But a row that cannot be read at all, or that a
+ * successful read of the focus's deliveries does not contain, which the queue does
+ * not list, has an identity nobody knows -- it may name a changed gate,
+ * or be explicit where the product also has a default-on gate -- so it is gated by
+ * NO gate: configured, with no per-commit gate and no explicit gate. It holds until
+ * the row reads again, and never borrows the default-on gate's verdict or one an
+ * arbitrary explicit gate rendered.
+ *
+ * Deliberately NOT mirrored: the tick's re-run guards (already ran this
+ * verify-entry; failed on the unchanged HEAD). They decide whether to run AGAIN,
+ * not whether a gate is configured, and the verdict is read from the durable
+ * per-commit record either way.
+ *
+ * Direction of error: an answer git could not give (the judged commit's manifest
+ * is unreadable) and an unreadable explicit-method list read as "configured" --
+ * hold, fail closed -- because the release pass re-asks every poll and releases
+ * the moment this reads "not configured". No daemon config or no such product (no
+ * running daemon context) reads "not configured": nothing would run a gate there.
+ *
+ * @module verify/commit-gate-configured
+ */
+import { loadEnvConfig } from '@telora/daemon-core';
+import { config as liveDaemonConfig } from '../focus/listener-state.js';
+import { findProduct } from '../shell/config.js';
+import { resolveDefaultVerification } from './verification-config.js';
+import { buildJudgedCommitManifestReader, resolveProductVerificationScopes, } from './verification-default-on.js';
+import { judgedCommitGate } from './judged-commit-gate.js';
+import { getPendingVerifications } from '../queries/verification.js';
+import { getFocusDeliveries } from '../queries/focuses.js';
+import { getFocusWorktree } from '../focus/focus-worktree-state.js';
+import { resolveHeadSha } from './verification-baseline.js';
+import { commitVerdictGateOf, explicitGateKeyOf, readCommitVerdict, } from './commit-verdict-record.js';
+import { hasPendingGateRun } from './gate-run-registry.js';
+import { hasRecordedExplicitGateOutcome, readDeliveryGateOutcome } from './explicit-gate-outcome.js';
+const defaultReadJudgedCommitManifest = buildJudgedCommitManifestReader();
+const NOT_CONFIGURED = { configured: false, gate: null };
+/** The commit a focus's deliveries are judged on: its registered worktree's HEAD, or null when unreadable. */
+export function resolveFocusJudgedCommit(focusId) {
+    const worktree = getFocusWorktree(focusId);
+    return worktree ? resolveHeadSha(worktree.worktreePath) : null;
+}
+function configRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : null;
+}
+/**
+ * The delivery's explicit verification identity: from the durable row, or -- when
+ * the row does not carry the columns or cannot be read -- from the
+ * pending-verification queue. See the module header.
+ */
+async function readExplicitIdentity(subject, deps) {
+    // Until a read shows the row itself, its identity is unknown: a read that throws, or one that omits the row.
+    let unlisted = { kind: 'unknown' };
+    try {
+        const rows = await (deps.getFocusDeliveries ?? getFocusDeliveries)(subject.focusId);
+        const row = rows.find((d) => d.id === subject.deliveryId);
+        if (row && row.verificationMethod !== undefined) {
+            return row.verificationMethod
+                ? { kind: 'explicit', identity: { method: row.verificationMethod, config: configRecord(row.verificationConfig), outcome: row.verificationOutcome ?? null } }
+                : { kind: 'none' };
+        }
+        // A present row without the columns is an older edge's; an absent one stays unknown.
+        if (row)
+            unlisted = { kind: 'unsent' };
+    }
+    catch {
+        // Unreadable row: the pending queue below may still name its identity.
+    }
+    try {
+        const pending = await (deps.getPendingVerifications ?? getPendingVerifications)(subject.productId);
+        const row = pending.find((p) => p.deliveryId === subject.deliveryId);
+        return row
+            ? { kind: 'explicit', identity: { method: row.verificationMethod ?? '', config: row.verificationConfig ?? null, outcome: row.verificationOutcome ?? null } }
+            : unlisted;
+    }
+    catch {
+        // Unreadable: the tick skips the product on this same failure and retries.
+        return unlisted;
+    }
+}
+/** A delivery whose identity nobody could read: held, and governed by no gate's verdict (see the module header). */
+const UNKNOWN_IDENTITY = { configured: true, gate: null, explicitGateKey: null };
+/** See the module header: whether a gate is configured for the delivery, and which gate governs its verdict. */
+export async function resolveCommitGate(subject, deps = {}) {
+    const env = deps.env ?? process.env;
+    if (!loadEnvConfig(env).TELORA_VERIFICATION_LOOP)
+        return NOT_CONFIGURED;
+    if (subject.focusReadOnly || !subject.injectionId)
+        return NOT_CONFIGURED;
+    const config = (deps.getConfig ?? (() => liveDaemonConfig))();
+    const product = config ? findProduct(config, subject.productId) : undefined;
+    if (!config || !product)
+        return NOT_CONFIGURED;
+    const read = await readExplicitIdentity(subject, deps);
+    if (read.kind === 'explicit') {
+        const explicit = read.identity;
+        if (explicit.method === 'behavioral')
+            return NOT_CONFIGURED;
+        return {
+            configured: true,
+            gate: commitVerdictGateOf({ verificationConfig: explicit.config }),
+            explicitGateKey: explicitGateKeyOf(explicit.method, explicit.config),
+        };
+    }
+    if (read.kind === 'unknown')
+        return UNKNOWN_IDENTITY;
+    const defaultOn = resolveDefaultOnGate(subject, deps, env, config, product);
+    // The row names no method: no explicit verdict governs it, one recorded before its method was cleared included.
+    if (read.kind === 'none')
+        return { ...defaultOn, explicitGateKey: null };
+    if (defaultOn.configured || !hasRecordedExplicitGateOutcome(subject.deliveryId, subject.gateState))
+        return defaultOn;
+    // No method named anywhere, but its explicit run recorded a verdict: gated by that run, with no per-commit gate.
+    return { configured: true, gate: null };
+}
+/** The default-on gate the verification scan arms for the delivery (see the module header), or not configured. */
+function resolveDefaultOnGate(subject, deps, env, config, product) {
+    const resolve = deps.resolveDefaultVerification
+        ?? ((c, readManifest) => resolveDefaultVerification(c, env, readManifest));
+    const [scope] = resolveProductVerificationScopes({ ...config, products: [product] }, resolve);
+    const scanResolved = scope?.resolved ?? scope?.judgedCommitOnly;
+    if (!scope || !scanResolved)
+        return NOT_CONFIGURED;
+    if (!scanResolved.enabled && scope.productConfig.defaultVerification?.declined === true)
+        return NOT_CONFIGURED;
+    const read = (deps.readJudgedCommitManifest ?? defaultReadJudgedCommitManifest)(subject.focusId);
+    if (read === null) {
+        // No focus worktree: an armed candidate runs in place on the scan's own config.
+        return scanResolved.enabled
+            ? { configured: true, gate: { command: scanResolved.command, timeoutMs: scanResolved.timeoutMs } }
+            : NOT_CONFIGURED;
+    }
+    if ('unreadable' in read)
+        return { configured: true, gate: null };
+    if (!scanResolved.enabled && read.manifest === undefined && read.malformed === undefined)
+        return NOT_CONFIGURED;
+    // The run re-resolves its gate from the judged commit and records under what it applied: read under that same gate.
+    const source = { defaultVerification: scope.productConfig.defaultVerification, repoPath: scope.productConfig.repoPath };
+    return { configured: true, gate: judgedCommitGate(source, read, env) };
+}
+/** Whether a gate is configured for the delivery (see the module header). */
+export async function isCommitGateConfigured(subject, deps = {}) {
+    return (await resolveCommitGate(subject, deps)).configured;
+}
+/** The production gate seams (see the module header). */
+export const commitGateSeams = {
+    resolveCommitGate: (subject) => resolveCommitGate(subject),
+    resolveJudgedCommit: resolveFocusJudgedCommit,
+    readCommitVerdict: (productId, focusId, sha, gate) => (gate ? readCommitVerdict(productId, focusId, sha, { gate }) : null),
+    readDeliveryGateOutcome,
+    hasPendingGateRun,
+};
+//# sourceMappingURL=commit-gate-configured.js.map

package/dist/verify/commit-gate-configured.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit-gate-configured.js","sourceRoot":"","sources":["../../src/verify/commit-gate-configured.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAChF,sEAAsE;AACtE,+DAA+D;AAC/D,mEAAmE;AACnE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAoC,MAAM,0BAA0B,CAAC;AAExG,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GAEjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAA4B,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AA6ErG,MAAM,+BAA+B,GAAG,+BAA+B,EAAE,CAAC;AAE1E,MAAM,cAAc,GAAyB,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAE/E,8GAA8G;AAC9G,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AASD,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1H,CAAC;AAWD;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAA0B,EAAE,IAA8B;IAC5F,6GAA6G;IAC7G,IAAI,QAAQ,GAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,GAAG,IAAI,GAAG,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAChD,OAAO,GAAG,CAAC,kBAAkB;gBAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,mBAAmB,IAAI,IAAI,EAAE,EAAE;gBAC5J,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC;QACD,qFAAqF;QACrF,IAAI,GAAG;YAAE,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;QACrE,OAAO,GAAG;YACR,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,mBAAmB,IAAI,IAAI,EAAE,EAAE;YAC5J,CAAC,CAAC,QAAQ,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,oHAAoH;AACpH,MAAM,gBAAgB,GAAyB,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAEvG,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAC1B,OAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,wBAAwB;QAAE,OAAO,cAAc,CAAC;IACxE,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,cAAc,CAAC;IACzE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,cAAc,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY;YAAE,OAAO,cAAc,CAAC;QAC5D,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClE,eAAe,EAAE,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC;IACrD,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5E,gHAAgH;IAChH,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,GAAG,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACzE,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACrH,iHAAiH;IACjH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,kHAAkH;AAClH,SAAS,oBAAoB,CAC3B,OAA0B,EAC1B,IAA8B,EAC9B,GAAsB,EACtB,MAAoB,EACpB,OAAoD;IAEpD,MAAM,OAAO,GAAG,IAAI,CAAC,0BAA0B;WAC1C,CAAC,CAAC,CAAe,EAAE,YAAmC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAClH,MAAM,CAAC,KAAK,CAAC,GAAG,gCAAgC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,gBAAgB,CAAC;IAChE,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,cAAc,CAAC;IACnD,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,CAAC,mBAAmB,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IAE/G,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,+BAA+B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,gFAAgF;QAChF,OAAO,YAAY,CAAC,OAAO;YACzB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE;YAClG,CAAC,CAAC,cAAc,CAAC;IACrB,CAAC;IACD,IAAI,YAAY,IAAI,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAChH,oHAAoH;IACpH,MAAM,MAAM,GAAG,EAAE,mBAAmB,EAAE,KAAK,CAAC,aAAa,CAAC,mBAAmB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;IACxH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA0B,EAC1B,OAAiC,EAAE;IAEnC,OAAO,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7D,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAC1D,mBAAmB,EAAE,wBAAwB;IAC7C,iBAAiB,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1H,uBAAuB;IACvB,iBAAiB;CAClB,CAAC"}

package/dist/verify/commit-verdict-record.d.ts

@@ -0,0 +1,98 @@
+import { type StrategyResult } from './verification-deterministic.js';
+import type { PendingVerification } from '../queries/verification.js';
+/** The gate a verdict was rendered under: the command + timeout the run applied. */
+export interface CommitVerdictGate {
+    command: string;
+    timeoutMs: number;
+}
+/** A recorded deterministic verdict for one focus commit. */
+export interface CommitVerdict {
+    productId: string;
+    focusId: string;
+    /** The judged commit (StrategyResult.verifiedSha). */
+    sha: string;
+    outcome: 'passed' | 'failed';
+    /** The gate the run applied -- the reuse key. */
+    gate: CommitVerdictGate;
+    exitCode: number | null;
+    /** The delivery whose dispatch ran the gate (provenance only; the verdict is the commit's). */
+    judgedDeliveryId: string;
+    recordedAt: string;
+    rationale?: string;
+    failedStage?: string;
+    preExistingStages?: string[];
+    newFailures?: string[];
+    preExisting?: string[];
+    logPath?: string;
+    stdoutTail?: string;
+    stderrTail?: string;
+    appliedConfig?: StrategyResult['appliedConfig'];
+}
+/** Who a verdict is being built for. */
+export interface CommitVerdictSubject {
+    productId: string;
+    focusId: string;
+    deliveryId: string;
+    gate: CommitVerdictGate;
+}
+/**
+ * The record file for a (product, focus, sha, gate); without a gate, the gate-less
+ * file records were written to before they were keyed by gate. `dir` defaults to
+ * the global state dir. Exported for tests.
+ */
+export declare function commitVerdictPath(productId: string, focusId: string, sha: string, dir?: string, gate?: CommitVerdictGate): string;
+/**
+ * The recorded verdict for a focus commit, or null on a miss, an unreadable or
+ * malformed file, or a record for another commit. With `gate`: only a verdict
+ * rendered under that gate. Without: the newest verdict recorded for the commit
+ * under any gate.
+ */
+export declare function readCommitVerdict(productId: string, focusId: string, sha: string, opts?: {
+    gate?: CommitVerdictGate;
+    dir?: string;
+}): CommitVerdict | null;
+/** Write a verdict atomically. Best-effort: returns false (and logs) when the write failed. */
+export declare function writeCommitVerdict(verdict: CommitVerdict, dir?: string): boolean;
+/**
+ * Build the verdict a finished deterministic run renders for its commit, or null
+ * when the run rendered none (see the module header). `instrumentFault` is true
+ * when attribution routed the run to instrument-fault re-work. Pure.
+ */
+export declare function buildCommitVerdict(subject: CommitVerdictSubject, result: StrategyResult, instrumentFault: boolean, now?: Date): CommitVerdict | null;
+/** The recorder a verification is wired with (VerificationDeps.recordCommitVerdict). */
+export type CommitVerdictRecorder = (verdict: CommitVerdict) => void;
+/** The reader a verification is wired with (VerificationDeps.readCommitVerdict): the verdict for a commit under a gate, or null. */
+export type CommitVerdictReader = (productId: string, focusId: string, sha: string, gate: CommitVerdictGate) => CommitVerdict | null;
+/**
+ * The gate a verification carries: the command + timeout on its config -- a
+ * missing or non-positive timeout is the strategy default, exactly as a run
+ * applies it -- or null when it carries no command. It keys an explicit row's
+ * verdict, and a default-on candidate's only where that candidate runs in place;
+ * a default-on run from a checkout of the judged commit is keyed by the gate it
+ * applies there (verify/judged-commit-gate.ts).
+ */
+export declare function commitVerdictGateOf(v: Pick<PendingVerification, 'verificationConfig'>): CommitVerdictGate | null;
+/**
+ * The identity of the gate an EXPLICIT-METHOD row renders its verdict under: its
+ * method and what that method applies -- a deterministic row's command +
+ * normalized timeout (commitVerdictGateOf), any other method's whole config.
+ * Hashed, so it rides on gate_state; key order in the config does not change it.
+ * Two rows that apply the same gate share a key; a changed method, command,
+ * timeout or inspection config does not (verify/explicit-gate-outcome.ts). Pure.
+ */
+export declare function explicitGateKeyOf(method: string, config: Record<string, unknown> | null): string;
+/**
+ * Record the verdict a deterministic run rendered for its commit, keyed by the
+ * gate the run APPLIED (result.appliedConfig -- for a default-on candidate,
+ * re-resolved from the checkout it ran), else by the gate the verification
+ * carries. A no-op without a recorder, without a product + focus to key it by, or
+ * when the run rendered no verdict.
+ */
+export declare function recordCommitVerdictFor(v: Pick<PendingVerification, 'productId' | 'focusId' | 'deliveryId' | 'verificationConfig'>, result: StrategyResult, instrumentFault: boolean, record: CommitVerdictRecorder | undefined): void;
+/**
+ * The StrategyResult a delivery judged on an already-judged commit takes instead
+ * of running the gate: the recorded outcome with its attribution, never a
+ * timeout or unavailable flag (a record is only ever written for a real verdict).
+ */
+export declare function strategyResultFromVerdict(verdict: CommitVerdict): StrategyResult;
+//# sourceMappingURL=commit-verdict-record.d.ts.map

package/dist/verify/commit-verdict-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit-verdict-record.d.ts","sourceRoot":"","sources":["../../src/verify/commit-verdict-record.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAmC,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACvG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAKtE,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,iDAAiD;IACjD,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+FAA+F;IAC/F,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;CACjD;AAED,wCAAwC;AACxC,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAqB,EAC1B,IAAI,CAAC,EAAE,iBAAiB,GACvB,MAAM,CAGR;AAoDD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,aAAa,GAAG,IAAI,CAetB;AAqBD,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,GAAE,MAAqB,GAAG,OAAO,CAY9F;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,cAAc,EACtB,eAAe,EAAE,OAAO,EACxB,GAAG,GAAE,IAAiB,GACrB,aAAa,GAAG,IAAI,CAiBtB;AAiBD,wFAAwF;AACxF,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;AAErE,oIAAoI;AACpI,MAAM,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,KAAK,aAAa,GAAG,IAAI,CAAC;AAErI;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAKhH;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,MAAM,CAGhG;AAYD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,SAAS,GAAG,YAAY,GAAG,oBAAoB,CAAC,EAC3F,MAAM,EAAE,cAAc,EACtB,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,qBAAqB,GAAG,SAAS,GACxC,IAAI,CAMN;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,CAiBhF"}

package/dist/verify/commit-verdict-record.js

@@ -0,0 +1,297 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/completion/mid-flight-merge-gate.test.ts,
+//   packages/daemon/src/completion/review-exit-verdict-gate.test.ts,
+//   packages/daemon/src/completion/teardown-merge-gate.test.ts,
+//   packages/daemon/src/focus/listener-product-poll.test.ts,
+//   packages/daemon/src/integration/delivery-gate-write-interleaving.test.ts,
+//   packages/daemon/src/integration/explicit-gate-identity-unreadable.test.ts,
+//   packages/daemon/src/integration/explicit-gate-outcome-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-departure-during-removal.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-invalidation-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-reuse.test.ts,
+//   packages/daemon/src/integration/focus-commit-verdict-scenario.test.ts,
+//   packages/daemon/src/integration/review-rework-resume-verdict.test.ts,
+//   packages/daemon/src/integration/verification-rework-resume-verdict.test.ts,
+//   packages/daemon/src/merge/resolved-conflict-merge-gate.test.ts,
+//   packages/daemon/src/spawn/prompt-assembly-resume-verdict.test.ts,
+//   packages/daemon/src/verify/commit-gate-configured.test.ts,
+//   packages/daemon/src/verify/commit-verdict-record.test.ts,
+//   packages/daemon/src/verify/gate-verdict-source.test.ts,
+//   packages/daemon/src/verify/verification-commit-sharing.test.ts
+// PINNED-BY-END
+/**
+ * The deterministic gate verdict for a focus commit, recorded durably.
+ *
+ * Every delivery on a focus is judged on the same focus-branch HEAD, and a gate
+ * on an unchanged tree renders the same verdict -- so the verdict belongs to the
+ * COMMIT, not to whichever delivery's dispatch happened to run it. Before this
+ * record only a failed sha was durable (per delivery, gate_state
+ * verificationHistory.failedAtSha) and a pass was merely the absence of one, so a
+ * sibling delivery, a status round trip, or a daemon restart at an already-judged
+ * commit paid for the whole gate again.
+ *
+ * One file per (product, focus, sha, gate) under the global state dir, written
+ * atomically (temp + rename) so a reader never sees a torn record. A verdict
+ * under one command or timeout says nothing about another, and one commit can
+ * carry verdicts of several gates (a sibling's explicit command beside the
+ * default-on gate), so no gate's record overwrites another's. A reader that names
+ * a gate gets only that gate's verdict -- what every routing decision does; one
+ * that names none (the team-facing verdict summary) gets the newest recorded for
+ * the commit. A record written before files were keyed by gate is still read, and
+ * still only for the gate it carries.
+ *
+ * What is NOT a verdict, and so is never written: a run killed by its timeout,
+ * a run that could not get a checkout (or whose installs moved mid-run), a run
+ * whose config was unresolvable (nothing ran), a run the attribution routed to
+ * instrument-fault re-work (the gate could not attribute it), and any run with no
+ * judged commit. Those leave the commit unjudged, so the next tick asks again.
+ *
+ * @module commit-verdict-record
+ */
+import { createHash } from 'node:crypto';
+import { mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { basename, resolve } from 'node:path';
+import { resolveGlobalStateDir } from '../shell/daemon-process.js';
+import { judgedFailedSha } from '../queries/delivery-gate-state.js';
+import { DEFAULT_VERIFICATION_TIMEOUT_MS } from './verification-deterministic.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'verification' });
+function verdictDir() {
+    return resolve(resolveGlobalStateDir(), 'verification-verdicts');
+}
+/**
+ * The record file for a (product, focus, sha, gate); without a gate, the gate-less
+ * file records were written to before they were keyed by gate. `dir` defaults to
+ * the global state dir. Exported for tests.
+ */
+export function commitVerdictPath(productId, focusId, sha, dir = verdictDir(), gate) {
+    const base = `${productId}-${focusId}-${sha}`;
+    return resolve(dir, `${gate ? `${base}-${gateKey(gate)}` : base}.json`.replace(/[^a-zA-Z0-9._-]/g, '_'));
+}
+/** A gate's key in a record file name: its command + timeout, hashed. */
+function gateKey(gate) {
+    return createHash('sha256').update(JSON.stringify([gate.command, gate.timeoutMs])).digest('hex').slice(0, 12);
+}
+const SHA_RE = /^[0-9a-f]{7,64}$/i;
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((s) => typeof s === 'string');
+}
+function optionalString(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+/** Validate a parsed record; null when it is not a well-formed verdict. */
+function parseVerdict(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return null;
+    const r = raw;
+    const gate = r.gate;
+    if (typeof r.productId !== 'string' || typeof r.focusId !== 'string' || typeof r.judgedDeliveryId !== 'string')
+        return null;
+    if (typeof r.sha !== 'string' || !SHA_RE.test(r.sha))
+        return null;
+    if (r.outcome !== 'passed' && r.outcome !== 'failed')
+        return null;
+    if (typeof gate?.command !== 'string' || typeof gate.timeoutMs !== 'number')
+        return null;
+    if (typeof r.recordedAt !== 'string')
+        return null;
+    const rationale = optionalString(r.rationale);
+    const failedStage = optionalString(r.failedStage);
+    return {
+        productId: r.productId,
+        focusId: r.focusId,
+        sha: r.sha,
+        outcome: r.outcome,
+        gate: { command: gate.command, timeoutMs: gate.timeoutMs },
+        exitCode: typeof r.exitCode === 'number' ? r.exitCode : null,
+        judgedDeliveryId: r.judgedDeliveryId,
+        recordedAt: r.recordedAt,
+        ...(rationale !== undefined ? { rationale } : {}),
+        ...(failedStage !== undefined ? { failedStage } : {}),
+        ...(isStringArray(r.preExistingStages) ? { preExistingStages: r.preExistingStages } : {}),
+        ...(isStringArray(r.newFailures) ? { newFailures: r.newFailures } : {}),
+        ...(isStringArray(r.preExisting) ? { preExisting: r.preExisting } : {}),
+        ...(typeof r.logPath === 'string' ? { logPath: r.logPath } : {}),
+        ...(typeof r.stdoutTail === 'string' ? { stdoutTail: r.stdoutTail } : {}),
+        ...(typeof r.stderrTail === 'string' ? { stderrTail: r.stderrTail } : {}),
+        ...(typeof r.appliedConfig === 'object' && r.appliedConfig !== null
+            ? { appliedConfig: r.appliedConfig }
+            : {}),
+    };
+}
+/**
+ * The recorded verdict for a focus commit, or null on a miss, an unreadable or
+ * malformed file, or a record for another commit. With `gate`: only a verdict
+ * rendered under that gate. Without: the newest verdict recorded for the commit
+ * under any gate.
+ */
+export function readCommitVerdict(productId, focusId, sha, opts = {}) {
+    const dir = opts.dir ?? verdictDir();
+    const gateless = commitVerdictPath(productId, focusId, sha, dir);
+    const paths = opts.gate
+        ? [commitVerdictPath(productId, focusId, sha, dir, opts.gate), gateless]
+        : [gateless, ...gateKeyedPaths(gateless, dir)];
+    let newest = null;
+    for (const path of paths) {
+        const parsed = readVerdictFile(path);
+        if (!parsed || parsed.productId !== productId || parsed.focusId !== focusId || parsed.sha !== sha)
+            continue;
+        if (opts.gate && (parsed.gate.command !== opts.gate.command || parsed.gate.timeoutMs !== opts.gate.timeoutMs))
+            continue;
+        if (opts.gate)
+            return parsed;
+        if (newest === null || parsed.recordedAt > newest.recordedAt)
+            newest = parsed;
+    }
+    return newest;
+}
+/** A parsed record file, or null when it is missing, unreadable, or malformed. */
+function readVerdictFile(path) {
+    try {
+        return parseVerdict(JSON.parse(readFileSync(path, 'utf8')));
+    }
+    catch {
+        return null;
+    }
+}
+/** Every gate-keyed record file of the commit whose gate-less record file is `gateless`. */
+function gateKeyedPaths(gateless, dir) {
+    const prefix = `${basename(gateless, '.json')}-`;
+    try {
+        return readdirSync(dir).filter((name) => name.startsWith(prefix) && name.endsWith('.json')).map((name) => resolve(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
+/** Write a verdict atomically. Best-effort: returns false (and logs) when the write failed. */
+export function writeCommitVerdict(verdict, dir = verdictDir()) {
+    const path = commitVerdictPath(verdict.productId, verdict.focusId, verdict.sha, dir, verdict.gate);
+    const tmp = `${path}.${process.pid}.tmp`;
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(tmp, JSON.stringify(verdict, null, 2), { mode: 0o600 });
+        renameSync(tmp, path);
+        return true;
+    }
+    catch (err) {
+        log.warn(`[verification] failed to record the verdict for ${verdict.focusId}@${verdict.sha.slice(0, 8)}:`, err.message);
+        return false;
+    }
+}
+/**
+ * Build the verdict a finished deterministic run renders for its commit, or null
+ * when the run rendered none (see the module header). `instrumentFault` is true
+ * when attribution routed the run to instrument-fault re-work. Pure.
+ */
+export function buildCommitVerdict(subject, result, instrumentFault, now = new Date()) {
+    if (instrumentFault || result.timedOut || result.checkoutUnavailable || result.configUnresolved)
+        return null;
+    const sha = result.outcome === 'failed'
+        ? judgedFailedSha(result)
+        : result.outcome === 'passed' && result.verifiedSha && SHA_RE.test(result.verifiedSha) ? result.verifiedSha : null;
+    if (!sha || (result.outcome !== 'passed' && result.outcome !== 'failed'))
+        return null;
+    return {
+        productId: subject.productId,
+        focusId: subject.focusId,
+        sha,
+        outcome: result.outcome,
+        gate: { command: subject.gate.command, timeoutMs: subject.gate.timeoutMs },
+        exitCode: typeof result.exitCode === 'number' ? result.exitCode : null,
+        judgedDeliveryId: subject.deliveryId,
+        recordedAt: now.toISOString(),
+        ...pickCarried(result),
+    };
+}
+/** The result fields a verdict carries forward to the deliveries that reuse it. */
+function pickCarried(result) {
+    return {
+        ...(result.rationale !== undefined ? { rationale: result.rationale } : {}),
+        ...(result.failedStage !== undefined ? { failedStage: result.failedStage } : {}),
+        ...(result.preExistingStages ? { preExistingStages: result.preExistingStages } : {}),
+        ...(result.newFailures ? { newFailures: result.newFailures } : {}),
+        ...(result.preExisting ? { preExisting: result.preExisting } : {}),
+        ...(result.logPath !== undefined ? { logPath: result.logPath } : {}),
+        ...(result.stdoutTail !== undefined ? { stdoutTail: result.stdoutTail } : {}),
+        ...(result.stderrTail !== undefined ? { stderrTail: result.stderrTail } : {}),
+        ...(result.appliedConfig ? { appliedConfig: result.appliedConfig } : {}),
+    };
+}
+/**
+ * The gate a verification carries: the command + timeout on its config -- a
+ * missing or non-positive timeout is the strategy default, exactly as a run
+ * applies it -- or null when it carries no command. It keys an explicit row's
+ * verdict, and a default-on candidate's only where that candidate runs in place;
+ * a default-on run from a checkout of the judged commit is keyed by the gate it
+ * applies there (verify/judged-commit-gate.ts).
+ */
+export function commitVerdictGateOf(v) {
+    const cfg = v.verificationConfig ?? {};
+    if (typeof cfg.command !== 'string')
+        return null;
+    const timeoutMs = typeof cfg.timeoutMs === 'number' && cfg.timeoutMs > 0 ? cfg.timeoutMs : DEFAULT_VERIFICATION_TIMEOUT_MS;
+    return { command: cfg.command, timeoutMs };
+}
+/**
+ * The identity of the gate an EXPLICIT-METHOD row renders its verdict under: its
+ * method and what that method applies -- a deterministic row's command +
+ * normalized timeout (commitVerdictGateOf), any other method's whole config.
+ * Hashed, so it rides on gate_state; key order in the config does not change it.
+ * Two rows that apply the same gate share a key; a changed method, command,
+ * timeout or inspection config does not (verify/explicit-gate-outcome.ts). Pure.
+ */
+export function explicitGateKeyOf(method, config) {
+    const applied = method === 'deterministic' ? commitVerdictGateOf({ verificationConfig: config }) : config;
+    return createHash('sha256').update(canonicalJson([method, applied])).digest('hex').slice(0, 16);
+}
+/** JSON with every object's keys sorted, so equal values serialize equally. Pure. */
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (typeof value === 'object' && value !== null) {
+        const record = value;
+        return `{${Object.keys(record).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(record[k])}`).join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+/**
+ * Record the verdict a deterministic run rendered for its commit, keyed by the
+ * gate the run APPLIED (result.appliedConfig -- for a default-on candidate,
+ * re-resolved from the checkout it ran), else by the gate the verification
+ * carries. A no-op without a recorder, without a product + focus to key it by, or
+ * when the run rendered no verdict.
+ */
+export function recordCommitVerdictFor(v, result, instrumentFault, record) {
+    const applied = result.appliedConfig;
+    const gate = applied ? { command: applied.command, timeoutMs: applied.timeoutMs } : commitVerdictGateOf(v);
+    if (!record || !v.productId || !v.focusId || !gate)
+        return;
+    const verdict = buildCommitVerdict({ productId: v.productId, focusId: v.focusId, deliveryId: v.deliveryId, gate }, result, instrumentFault);
+    if (verdict)
+        record(verdict);
+}
+/**
+ * The StrategyResult a delivery judged on an already-judged commit takes instead
+ * of running the gate: the recorded outcome with its attribution, never a
+ * timeout or unavailable flag (a record is only ever written for a real verdict).
+ */
+export function strategyResultFromVerdict(verdict) {
+    const { rationale, failedStage, preExistingStages, newFailures, preExisting, logPath, stdoutTail, stderrTail, appliedConfig } = verdict;
+    return {
+        outcome: verdict.outcome,
+        exitCode: verdict.exitCode,
+        verifiedSha: verdict.sha,
+        rationale: `reused the verdict recorded for ${verdict.sha.slice(0, 8)} at ${verdict.recordedAt}`
+            + (rationale ? `: ${rationale}` : ''),
+        ...(failedStage !== undefined ? { failedStage } : {}),
+        ...(preExistingStages ? { preExistingStages } : {}),
+        ...(newFailures ? { newFailures } : {}),
+        ...(preExisting ? { preExisting } : {}),
+        ...(logPath !== undefined ? { logPath } : {}),
+        ...(stdoutTail !== undefined ? { stdoutTail } : {}),
+        ...(stderrTail !== undefined ? { stderrTail } : {}),
+        ...(appliedConfig ? { appliedConfig } : {}),
+    };
+}
+//# sourceMappingURL=commit-verdict-record.js.map