@telora/daemon 0.22.97 → 0.22.131

package/dist/verify/gate-run-registry.d.ts

@@ -0,0 +1,105 @@
+/**
+ * The gate runs a routing decision can still wait on, held in process.
+ *
+ * Two facts the review exit and the live open-work pass read before they route a
+ * verify delivery on review evidence alone (completion/review-exit-verdict-gate.ts):
+ *
+ *   - which gate runs are SELECTED BUT NOT FINISHED, per focus. The verification
+ *     tick registers every candidate the moment it selects it -- before the run
+ *     waits on the shared verification semaphore behind another focus's gate --
+ *     and ends the registration when its dispatch settles, however it settles
+ *     (a verdict, a timeout, no checkout, a delivery that left verify, a throw).
+ *     Once a run's detached checkout exists it names the commit it judges, so a
+ *     wait keyed on one commit is not held by a run judging another; until then a
+ *     registration may judge any commit on its focus (a dispatch reads HEAD only
+ *     when it starts).
+ *   - the outcome an EXPLICIT-METHOD run last recorded for its delivery. Such a run
+ *     may execute in place or render a non-deterministic verdict, and neither
+ *     writes a per-commit verdict record (verify/commit-verdict-record.ts), so its
+ *     recorded outcome is its gate verdict: a pass or a failure, at the commit it
+ *     judged, or for the delivery when it judged none. A run that rendered no
+ *     verdict leaves none, and a new selection of the delivery forgets the outcome
+ *     of the run before it -- both are remembered as "no verdict", so the durable
+ *     copy of an older outcome is not read in their place. The tick also removes
+ *     that durable copy before the selected run can start
+ *     (verify/verification-commit-sharing.ts), so a restart reads "no verdict" too.
+ *
+ * The selected runs are in process on purpose. A daemon restart abandons every
+ * selected run, and an abandoned run renders no verdict, so after a restart
+ * nothing waits on one: a toward-intent route is never stranded behind a verdict
+ * no process will render. The explicit outcomes here are only the in-process fast
+ * path: each is also written to the delivery's gate_state
+ * (verify/explicit-gate-outcome.ts), which is what routing reads after a restart,
+ * when this process has seen no explicit run for the delivery.
+ *
+ * A leaf with no imports.
+ *
+ * @module verify/gate-run-registry
+ */
+/** A candidate the verification tick selected. */
+export interface GateRunSelection {
+    deliveryId: string;
+    focusId: string | null;
+    /** An explicit-method row: its run supersedes the outcome the delivery's previous run recorded. */
+    explicit: boolean;
+}
+/** The handle a selection is ended through. Idempotent. */
+export interface GateRunRegistration {
+    end: () => void;
+}
+/** The outcome kept for an explicit-method delivery. */
+export type RecordedGateOutcome = 'passed' | 'failed';
+/** A verdict an explicit-method run rendered, the commit it applies to (null: it judged none, so it applies to any), and its gate. */
+export interface RecordedExplicitOutcome {
+    outcome: RecordedGateOutcome;
+    sha: string | null;
+    /** The gate the run applied (verify/commit-verdict-record.ts explicitGateKeyOf); absent on a record that kept none. */
+    gateKey?: string;
+}
+/** Register a candidate the tick selected; end the registration when its dispatch settles. */
+export declare function registerGateRun(selection: GateRunSelection): GateRunRegistration;
+/** Name the commit a selected run judges (its detached checkout's sha). A no-op when the delivery has no selected run. */
+export declare function noteGateRunCommit(deliveryId: string, sha: string): void;
+/**
+ * Whether a selected, unfinished gate run on the focus may judge `sha`: one that
+ * names that commit, or one that names none yet. A null `sha` (a judged commit
+ * nobody could read) matches every run on the focus.
+ */
+export declare function hasPendingGateRun(focusId: string, sha: string | null): boolean;
+/** Whether a gate run for the delivery is selected and not yet finished (verify/explicit-rearm.ts selects no second one). */
+export declare function isGateRunSelected(deliveryId: string): boolean;
+/**
+ * The verdict a run's result renders: a pass or a failure, at its judged commit
+ * when that is a well-formed sha, else for no commit, under the gate the run
+ * applied (`gateKey`); null for any other outcome (no verdict). The one rule the
+ * in-process record and the durable one (verify/explicit-gate-outcome.ts) both
+ * apply. Pure.
+ */
+export declare function explicitGateOutcomeOf(result: {
+    outcome: string;
+    verifiedSha?: string;
+}, gateKey?: string): RecordedExplicitOutcome | null;
+/** Note the run id a selected explicit candidate's selection named, so its verdict is recorded as that run's. */
+export declare function noteExplicitRunId(candidate: object, runId: string): void;
+/** The run id the candidate's selection named, or undefined when none did. */
+export declare function explicitRunIdOf(candidate: object): string | undefined;
+/** Record the outcome an explicit-method run rendered under the gate it applied (see the module header for what is kept). */
+export declare function recordExplicitGateOutcome(deliveryId: string, result: {
+    outcome: string;
+    verifiedSha?: string;
+}, gateKey?: string): void;
+/**
+ * What this process knows about the delivery's explicit-method verdict: the
+ * verdict its latest run rendered, null for "no verdict" (a selection since, or a
+ * run that rendered none), or undefined when this process has seen no explicit run
+ * for the delivery -- the durable record is then the one to read.
+ */
+export declare function readLiveExplicitGateOutcome(deliveryId: string): RecordedExplicitOutcome | null | undefined;
+/**
+ * The outcome an explicit-method run recorded for the delivery in this process when
+ * it applies to `sha` -- the run judged that commit, or judged none -- else null.
+ */
+export declare function readExplicitGateOutcome(deliveryId: string, sha: string | null): RecordedGateOutcome | null;
+/** Test seam: forget every selected run and recorded outcome. */
+export declare function __resetGateRunRegistryForTests(): void;
+//# sourceMappingURL=gate-run-registry.d.ts.map

package/dist/verify/gate-run-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-run-registry.d.ts","sourceRoot":"","sources":["../../src/verify/gate-run-registry.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mGAAmG;IACnG,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,wDAAwD;AACxD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAStD,sIAAsI;AACtI,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,uHAAuH;IACvH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAQD,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,SAAS,EAAE,gBAAgB,GAAG,mBAAmB,CAShF;AAED,0HAA0H;AAC1H,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAIvE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAK9E;AAED,6HAA6H;AAC7H,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAKzI;AAKD,iHAAiH;AACjH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAExE;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,6HAA6H;AAC7H,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAEvI;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,GAAG,SAAS,CAE1G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,mBAAmB,GAAG,IAAI,CAI1G;AAED,iEAAiE;AACjE,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}

package/dist/verify/gate-run-registry.js

@@ -0,0 +1,111 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/completion/commit-verdict-release.test.ts,
+//   packages/daemon/src/focus/listener-product-poll.test.ts,
+//   packages/daemon/src/focus/verify-routing-passes.test.ts,
+//   packages/daemon/src/integration/delivery-gate-write-interleaving.test.ts,
+//   packages/daemon/src/integration/explicit-gate-identity-unreadable.test.ts,
+//   packages/daemon/src/integration/explicit-gate-outcome-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-departure-during-removal.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-invalidation-restart.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-reuse.test.ts,
+//   packages/daemon/src/integration/focus-commit-verdict-scenario.test.ts,
+//   packages/daemon/src/integration/review-rework-resume-verdict.test.ts,
+//   packages/daemon/src/verify/explicit-run-ledger.test.ts,
+//   packages/daemon/src/verify/verification-commit-sharing.test.ts
+// PINNED-BY-END
+const SHA_RE = /^[0-9a-f]{7,64}$/i;
+const selectedRuns = new Set();
+/** Per delivery this process has seen an explicit run for: its verdict, or null for "no verdict" (see the module header). */
+const explicitOutcomes = new Map();
+/** Register a candidate the tick selected; end the registration when its dispatch settles. */
+export function registerGateRun(selection) {
+    const run = { deliveryId: selection.deliveryId, focusId: selection.focusId, sha: null };
+    selectedRuns.add(run);
+    if (selection.explicit)
+        explicitOutcomes.set(selection.deliveryId, null);
+    return {
+        end: () => {
+            selectedRuns.delete(run);
+        },
+    };
+}
+/** Name the commit a selected run judges (its detached checkout's sha). A no-op when the delivery has no selected run. */
+export function noteGateRunCommit(deliveryId, sha) {
+    for (const run of selectedRuns) {
+        if (run.deliveryId === deliveryId)
+            run.sha = sha;
+    }
+}
+/**
+ * Whether a selected, unfinished gate run on the focus may judge `sha`: one that
+ * names that commit, or one that names none yet. A null `sha` (a judged commit
+ * nobody could read) matches every run on the focus.
+ */
+export function hasPendingGateRun(focusId, sha) {
+    for (const run of selectedRuns) {
+        if (run.focusId === focusId && (run.sha === null || sha === null || run.sha === sha))
+            return true;
+    }
+    return false;
+}
+/** Whether a gate run for the delivery is selected and not yet finished (verify/explicit-rearm.ts selects no second one). */
+export function isGateRunSelected(deliveryId) {
+    for (const run of selectedRuns) {
+        if (run.deliveryId === deliveryId)
+            return true;
+    }
+    return false;
+}
+/**
+ * The verdict a run's result renders: a pass or a failure, at its judged commit
+ * when that is a well-formed sha, else for no commit, under the gate the run
+ * applied (`gateKey`); null for any other outcome (no verdict). The one rule the
+ * in-process record and the durable one (verify/explicit-gate-outcome.ts) both
+ * apply. Pure.
+ */
+export function explicitGateOutcomeOf(result, gateKey) {
+    const { outcome } = result;
+    if (outcome !== 'passed' && outcome !== 'failed')
+        return null;
+    const sha = typeof result.verifiedSha === 'string' && SHA_RE.test(result.verifiedSha) ? result.verifiedSha : null;
+    return { outcome, sha, ...(gateKey !== undefined ? { gateKey } : {}) };
+}
+/** The run id each selected explicit candidate was named (verify/explicit-run-ledger.ts), keyed by the candidate itself. */
+const explicitRunIds = new WeakMap();
+/** Note the run id a selected explicit candidate's selection named, so its verdict is recorded as that run's. */
+export function noteExplicitRunId(candidate, runId) {
+    explicitRunIds.set(candidate, runId);
+}
+/** The run id the candidate's selection named, or undefined when none did. */
+export function explicitRunIdOf(candidate) {
+    return explicitRunIds.get(candidate);
+}
+/** Record the outcome an explicit-method run rendered under the gate it applied (see the module header for what is kept). */
+export function recordExplicitGateOutcome(deliveryId, result, gateKey) {
+    explicitOutcomes.set(deliveryId, explicitGateOutcomeOf(result, gateKey));
+}
+/**
+ * What this process knows about the delivery's explicit-method verdict: the
+ * verdict its latest run rendered, null for "no verdict" (a selection since, or a
+ * run that rendered none), or undefined when this process has seen no explicit run
+ * for the delivery -- the durable record is then the one to read.
+ */
+export function readLiveExplicitGateOutcome(deliveryId) {
+    return explicitOutcomes.get(deliveryId);
+}
+/**
+ * The outcome an explicit-method run recorded for the delivery in this process when
+ * it applies to `sha` -- the run judged that commit, or judged none -- else null.
+ */
+export function readExplicitGateOutcome(deliveryId, sha) {
+    const recorded = explicitOutcomes.get(deliveryId);
+    if (!recorded)
+        return null;
+    return recorded.sha === null || recorded.sha === sha ? recorded.outcome : null;
+}
+/** Test seam: forget every selected run and recorded outcome. */
+export function __resetGateRunRegistryForTests() {
+    selectedRuns.clear();
+    explicitOutcomes.clear();
+}
+//# sourceMappingURL=gate-run-registry.js.map

package/dist/verify/gate-run-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-run-registry.js","sourceRoot":"","sources":["../../src/verify/gate-run-registry.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,4EAA4E;AAC5E,6DAA6D;AAC7D,6DAA6D;AAC7D,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,uFAAuF;AACvF,mFAAmF;AACnF,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,4DAA4D;AAC5D,mEAAmE;AACnE,gBAAgB;AAwEhB,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAe,CAAC;AAC5C,6HAA6H;AAC7H,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA0C,CAAC;AAE3E,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,SAA2B;IACzD,MAAM,GAAG,GAAgB,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACrG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,SAAS,CAAC,QAAQ;QAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACzE,OAAO;QACL,GAAG,EAAE,GAAG,EAAE;YACR,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,GAAW;IAC/D,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU;YAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAkB;IACnE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiD,EAAE,OAAgB;IACvG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAClH,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,4HAA4H;AAC5H,MAAM,cAAc,GAAG,IAAI,OAAO,EAAkB,CAAC;AAErD,iHAAiH;AACjH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,KAAa;IAChE,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,MAAiD,EAAE,OAAgB;IAC/H,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,OAAO,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,GAAkB;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,QAAQ,CAAC,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,8BAA8B;IAC5C,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC"}

package/dist/verify/gate-verdict-source.d.ts

@@ -0,0 +1,68 @@
+import { type GateVerdictSummary, type JudgedCommit } from '../queries/delivery-gate-state.js';
+import { type CommitVerdict } from './commit-verdict-record.js';
+/** The slice of a deterministic StrategyResult a verdict is derived from. */
+export interface GateRunVerdictSource {
+    outcome?: string;
+    exitCode?: number | null;
+    timedOut?: boolean;
+    checkoutUnavailable?: boolean;
+    configUnresolved?: boolean;
+    verifiedSha?: string;
+    failedStage?: string;
+    preExistingStages?: string[];
+}
+/** The commit a run judged (its well-formed verifiedSha), or null for a run that judged none. Pure. */
+export declare function judgedShaOfRun(run: Pick<GateRunVerdictSource, 'verifiedSha'>): string | null;
+/** The verdict a finished deterministic run rendered for its commit, or null when it rendered none. Pure. */
+export declare function gateVerdictFromRun(run: GateRunVerdictSource): GateVerdictSummary | null;
+/** The summary of a durable commit verdict. Pure. */
+export declare function gateVerdictFromCommitVerdict(verdict: CommitVerdict): GateVerdictSummary;
+/** Injected IO for the judged-commit read; the default reaches the record store. */
+export interface JudgedCommitVerdictDeps {
+    readVerdict: (productId: string, focusId: string, sha: string) => CommitVerdict | null;
+}
+/** Which judged commit to read: the exact sha a run judged, on its product + focus. */
+export interface JudgedCommitTarget {
+    productId?: string | null;
+    focusId?: string | null;
+    sha?: string | null;
+}
+/**
+ * The recorded gate verdict for exactly the judged commit `target.sha`, or null
+ * (no product/focus, no or malformed sha, no record). Never resolves HEAD and
+ * never throws: a message that cannot read the verdict still goes out, just
+ * without the section.
+ */
+export declare function readJudgedCommitGateVerdict(target: JudgedCommitTarget, deps?: Partial<JudgedCommitVerdictDeps>): GateVerdictSummary | null;
+/**
+ * The recorded verdict for the commit a re-work's run judged, through the
+ * re-work's reader, or null when the run judged none (the reader is then not
+ * asked: no sha is never "the HEAD").
+ */
+export declare function readJudgedVerdictFor(d: {
+    readGateVerdict: (target: JudgedCommitTarget) => GateVerdictSummary | null;
+}, v: {
+    productId?: string | null;
+    focusId?: string | null;
+}, judgedSha: string | null): GateVerdictSummary | null;
+/** A focus delivery as the resume path reads it. */
+export interface JudgedDeliveryRow {
+    executionStatus?: string | null;
+    gateState?: unknown;
+}
+/**
+ * The live (not done, not cancelled) delivery carrying the most recent judged
+ * commit stamped on its gate_state, with that judged commit, or null when none
+ * carries one. The delivery is what the resume resolves its own gate for. Pure.
+ */
+export declare function latestJudgedDelivery<T extends JudgedDeliveryRow>(deliveries: readonly T[]): {
+    delivery: T;
+    judged: JudgedCommit;
+} | null;
+/**
+ * The most recent judged commit stamped on a live delivery's gate_state
+ * (latestJudgedDelivery), or null. What a resumed focus session is shown the
+ * verdict for. Pure.
+ */
+export declare function latestJudgedCommit(deliveries: readonly JudgedDeliveryRow[]): JudgedCommit | null;
+//# sourceMappingURL=gate-verdict-source.d.ts.map

package/dist/verify/gate-verdict-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-verdict-source.d.ts","sourceRoot":"","sources":["../../src/verify/gate-verdict-source.ts"],"names":[],"mappings":"AA4CA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAMnF,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAMD,uGAAuG;AACvG,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,CAAC,GAAG,MAAM,GAAG,IAAI,CAG5F;AAED,6GAA6G;AAC7G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,IAAI,CAiBvF;AAED,qDAAqD;AACrD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,aAAa,GAAG,kBAAkB,CAOvF;AAED,oFAAoF;AACpF,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,aAAa,GAAG,IAAI,CAAC;CACxF;AAMD,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,OAAO,CAAC,uBAAuB,CAAM,GAC1C,kBAAkB,GAAG,IAAI,CAW3B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EAAE;IAAE,eAAe,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,kBAAkB,GAAG,IAAI,CAAA;CAAE,EACjF,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACzD,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,kBAAkB,GAAG,IAAI,CAE3B;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAKD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG;IAAE,QAAQ,EAAE,CAAC,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAQxI;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,GAAG,YAAY,GAAG,IAAI,CAEhG"}

package/dist/verify/gate-verdict-source.js

@@ -0,0 +1,143 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/gate-verdict-source.test.ts,
+//   packages/daemon/src/verify/rework-judgment.test.ts,
+//   packages/daemon/src/verify/verification-feedback.test.ts,
+//   packages/daemon/src/verify/verify-evidence-unavailable.test.ts
+// PINNED-BY-END
+/**
+ * Where the gate verdict a team is shown comes from.
+ *
+ * One shape (GateVerdictSummary), always for the commit a run JUDGED -- never
+ * for whatever the focus worktree HEAD is when the message is built. Commit B can
+ * land while commit A is being judged; a message about A that re-resolved HEAD
+ * would omit A's verdict or report B's.
+ *
+ *   - the RUN in hand. The deterministic-failure feedback holds the StrategyResult
+ *     and derives the verdict from it by the same rule the durable record uses
+ *     (commit-verdict-record.buildCommitVerdict): no verdict for a timeout, an
+ *     unavailable checkout, an unresolved config, or a run with no judged commit.
+ *   - the durable RECORD for the judged sha. The shortfall and evidence-unavailable
+ *     re-work are handed the sha of the run that judged them (judgedShaOfRun) and
+ *     that run's own verdict (verify/rework-judgment.ts runVerdictOf); only a
+ *     writer handed no run reads the record by exactly that sha.
+ *   - the JUDGED COMMIT a re-work stamped. The resume delta holds no run, so it
+ *     reads the judged commit the latest re-work stamped on a live delivery's
+ *     gate_state (latestJudgedDelivery) -- a verification re-work's, or a
+ *     verify_failed route for review-filed work (the review exit, or the live
+ *     open-work pass; completion/review-exit-verdict-gate.ts). Every writer
+ *     persists the delivery's OWN verdict beside that sha (a verification
+ *     re-work: its run's; a review-filed route: its own-gate read), and the
+ *     resume shows it. A stamp that carries none is resolved under THAT
+ *     delivery's own gate (spawn/prompt-assembly.ts, through the review exit's
+ *     own-gate reads), never by a gate-less record read: one commit can carry
+ *     several gates' verdicts, and a sibling gate's must not answer. No judged
+ *     sha, or no own-gate verdict for it, is no verdict: the message omits the
+ *     section rather than guessing.
+ *
+ * Rendering lives in prompt-sections/gate-verdict-section.ts.
+ *
+ * @module gate-verdict-source
+ */
+import { DELIVERY_STATUS } from '@telora/daemon-core';
+import { createLogger } from '../shell/log.js';
+import { readVerificationHistory, } from '../queries/delivery-gate-state.js';
+import { readCommitVerdict } from './commit-verdict-record.js';
+const log = createLogger({ module: 'verification' });
+const SHA_RE = /^[0-9a-f]{7,64}$/i;
+function carriedStages(stages) {
+    return stages && stages.length > 0 ? { preExistingStages: [...stages] } : {};
+}
+/** The commit a run judged (its well-formed verifiedSha), or null for a run that judged none. Pure. */
+export function judgedShaOfRun(run) {
+    const sha = run.verifiedSha;
+    return typeof sha === 'string' && SHA_RE.test(sha) ? sha : null;
+}
+/** The verdict a finished deterministic run rendered for its commit, or null when it rendered none. Pure. */
+export function gateVerdictFromRun(run) {
+    if (run.timedOut || run.checkoutUnavailable || run.configUnresolved)
+        return null;
+    const sha = judgedShaOfRun(run);
+    if (sha === null)
+        return null;
+    // Exit 0 is the gate command passing: the strategy never reports 'failed' at
+    // exit 0 itself, so a failed outcome at exit 0 was demoted AFTER the gate by a
+    // per-delivery check (the security verify-closed gate) -- not the commit's
+    // verdict. A non-zero exit whose reds all pre-exist was demoted to 'passed' by
+    // attribution, and that pass IS what the record holds for the commit.
+    const passed = run.exitCode === 0 || run.outcome === 'passed';
+    if (!passed && (run.outcome !== 'failed' || typeof run.exitCode !== 'number'))
+        return null;
+    return {
+        outcome: passed ? 'passed' : 'failed',
+        sha,
+        ...(!passed && run.failedStage ? { failedStage: run.failedStage } : {}),
+        ...carriedStages(run.preExistingStages),
+    };
+}
+/** The summary of a durable commit verdict. Pure. */
+export function gateVerdictFromCommitVerdict(verdict) {
+    return {
+        outcome: verdict.outcome,
+        sha: verdict.sha,
+        ...(verdict.outcome === 'failed' && verdict.failedStage ? { failedStage: verdict.failedStage } : {}),
+        ...carriedStages(verdict.preExistingStages),
+    };
+}
+const defaultJudgedCommitVerdictDeps = () => ({
+    readVerdict: (productId, focusId, sha) => readCommitVerdict(productId, focusId, sha),
+});
+/**
+ * The recorded gate verdict for exactly the judged commit `target.sha`, or null
+ * (no product/focus, no or malformed sha, no record). Never resolves HEAD and
+ * never throws: a message that cannot read the verdict still goes out, just
+ * without the section.
+ */
+export function readJudgedCommitGateVerdict(target, deps = {}) {
+    const { productId, focusId, sha } = target;
+    if (!productId || !focusId || !sha || !SHA_RE.test(sha))
+        return null;
+    const d = { ...defaultJudgedCommitVerdictDeps(), ...deps };
+    try {
+        const verdict = d.readVerdict(productId, focusId, sha);
+        return verdict ? gateVerdictFromCommitVerdict(verdict) : null;
+    }
+    catch (err) {
+        log.debug(`[verification] judged-commit verdict read failed for ${focusId}@${sha.slice(0, 8)}:`, err.message);
+        return null;
+    }
+}
+/**
+ * The recorded verdict for the commit a re-work's run judged, through the
+ * re-work's reader, or null when the run judged none (the reader is then not
+ * asked: no sha is never "the HEAD").
+ */
+export function readJudgedVerdictFor(d, v, judgedSha) {
+    return judgedSha ? d.readGateVerdict({ productId: v.productId, focusId: v.focusId, sha: judgedSha }) : null;
+}
+/** Deliveries whose judgment no longer describes work a resumed team is doing. */
+const SETTLED_STATUSES = new Set([DELIVERY_STATUS.DONE, DELIVERY_STATUS.CANCELLED]);
+/**
+ * The live (not done, not cancelled) delivery carrying the most recent judged
+ * commit stamped on its gate_state, with that judged commit, or null when none
+ * carries one. The delivery is what the resume resolves its own gate for. Pure.
+ */
+export function latestJudgedDelivery(deliveries) {
+    let latest = null;
+    for (const delivery of deliveries) {
+        if (delivery.executionStatus && SETTLED_STATUSES.has(delivery.executionStatus))
+            continue;
+        const judged = readVerificationHistory(delivery.gateState).judgedCommit;
+        if (judged && (latest === null || judged.judgedAt > latest.judged.judgedAt))
+            latest = { delivery, judged };
+    }
+    return latest;
+}
+/**
+ * The most recent judged commit stamped on a live delivery's gate_state
+ * (latestJudgedDelivery), or null. What a resumed focus session is shown the
+ * verdict for. Pure.
+ */
+export function latestJudgedCommit(deliveries) {
+    return latestJudgedDelivery(deliveries)?.judged ?? null;
+}
+//# sourceMappingURL=gate-verdict-source.js.map

package/dist/verify/gate-verdict-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-verdict-source.js","sourceRoot":"","sources":["../../src/verify/gate-verdict-source.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,qEAAqE;AACrE,wDAAwD;AACxD,8DAA8D;AAC9D,mEAAmE;AACnE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,uBAAuB,GAGxB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAsB,MAAM,4BAA4B,CAAC;AAEnF,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAcnC,SAAS,aAAa,CAAC,MAAqC;IAC1D,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,cAAc,CAAC,GAA8C;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC;IAC5B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,kBAAkB,CAAC,GAAyB;IAC1D,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACrC,GAAG;QACH,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,4BAA4B,CAAC,OAAsB;IACjE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC;KAC5C,CAAC;AACJ,CAAC;AAOD,MAAM,8BAA8B,GAAG,GAA4B,EAAE,CAAC,CAAC;IACrE,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC;CACrF,CAAC,CAAC;AASH;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA0B,EAC1B,OAAyC,EAAE;IAE3C,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC3C,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,CAAC,GAAG,EAAE,GAAG,8BAA8B,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wDAAwD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACzH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,CAAiF,EACjF,CAAyD,EACzD,SAAwB;IAExB,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9G,CAAC;AAQD,kFAAkF;AAClF,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;AAEzG;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAA8B,UAAwB;IACxF,IAAI,MAAM,GAAiD,IAAI,CAAC;IAChE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,eAAe,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,SAAS;QACzF,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC;QACxE,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,MAAM,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAwC;IACzE,OAAO,oBAAoB,CAAC,UAAU,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAC1D,CAAC"}

package/dist/verify/judged-commit-gate.d.ts

@@ -0,0 +1,11 @@
+import { type VerificationConfigScope } from './verification-config.js';
+import { type VerifyManifestReader } from './verification-manifest.js';
+import type { CommitVerdictGate } from './commit-verdict-record.js';
+import type { JudgedCommitManifest } from './verification-default-on.js';
+/**
+ * The gate a default-on run applies at the judged commit `read` names (see the
+ * module header), or null when that run would record no verdict. `source` is the
+ * candidate's default-on source (its operator block and the product repoPath).
+ */
+export declare function judgedCommitGate(source: VerificationConfigScope, read: JudgedCommitManifest, env?: NodeJS.ProcessEnv, readManifest?: VerifyManifestReader): CommitVerdictGate | null;
+//# sourceMappingURL=judged-commit-gate.d.ts.map

package/dist/verify/judged-commit-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"judged-commit-gate.d.ts","sourceRoot":"","sources":["../../src/verify/judged-commit-gate.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAoC,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EAAiD,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACtH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,uBAAuB,EAC/B,IAAI,EAAE,oBAAoB,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,GAAE,oBAAyC,GACtD,iBAAiB,GAAG,IAAI,CAW1B"}

package/dist/verify/judged-commit-gate.js

@@ -0,0 +1,48 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/judged-commit-gate.test.ts
+// PINNED-BY-END
+/**
+ * The gate a default-on run of a focus's judged commit actually APPLIES, resolved
+ * without a checkout -- the ONE derivation the per-commit verdict reuse read
+ * (verify/verification-commit-sharing.ts) and verify routing
+ * (verify/commit-gate-configured.ts) key a default-on verdict by.
+ *
+ * A default-on candidate is selected with a command + timeout resolved against
+ * the product repoPath, but its run re-resolves both from the detached checkout
+ * of the judged commit (verify/verification-checkout.ts) and records its verdict
+ * under the config it APPLIED (commit-verdict-record.ts recordCommitVerdictFor).
+ * A branch whose telora.verify.json overrides the repoPath gate therefore runs --
+ * and records -- gate B while it was selected under gate A. A read keyed by A
+ * would reuse a verdict of a gate that never ran on that commit, and miss the one
+ * that did. So this resolves the same layers the run does -- env > operator block
+ * > the manifest the judged commit ships (read from git at that sha) > the
+ * repoPath manifest as fallback -- through resolveAppliedVerificationConfig itself.
+ *
+ * No gate (null) where the run renders no verdict to key: a malformed committed
+ * manifest or a resolution that throws (the run refuses both as unresolvable), or
+ * no command at all.
+ *
+ * @module verify/judged-commit-gate
+ */
+import { dirname } from 'node:path';
+import { resolveAppliedVerificationConfig } from './verification-config.js';
+import { readVerifyManifest, resolveVerifyManifestPath } from './verification-manifest.js';
+/**
+ * The gate a default-on run applies at the judged commit `read` names (see the
+ * module header), or null when that run would record no verdict. `source` is the
+ * candidate's default-on source (its operator block and the product repoPath).
+ */
+export function judgedCommitGate(source, read, env = process.env, readManifest = readVerifyManifest) {
+    if (read.malformed !== undefined)
+        return null;
+    // The judged commit's manifest answers for the worktree path; every other path (the fallback) is read as the run reads it.
+    const atJudgedCommit = (repoPath, fs) => (repoPath !== undefined && resolveVerifyManifestPath(repoPath) === read.manifestPath ? read.manifest : readManifest(repoPath, fs));
+    try {
+        const applied = resolveAppliedVerificationConfig(source, dirname(read.manifestPath), env, atJudgedCommit);
+        return applied.command.trim() === '' ? null : { command: applied.command, timeoutMs: applied.timeoutMs };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=judged-commit-gate.js.map

package/dist/verify/judged-commit-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judged-commit-gate.js","sourceRoot":"","sources":["../../src/verify/judged-commit-gate.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mEAAmE;AACnE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gCAAgC,EAAgC,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAA6B,MAAM,4BAA4B,CAAC;AAItH;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA+B,EAC/B,IAA0B,EAC1B,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAqC,kBAAkB;IAEvD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,2HAA2H;IAC3H,MAAM,cAAc,GAAyB,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAC5D,CAAC,QAAQ,KAAK,SAAS,IAAI,yBAAyB,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IACrI,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,gCAAgC,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC1G,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/verify/rework-judgment.d.ts

@@ -0,0 +1,58 @@
+/**
+ * What a verification re-work stamps as the delivery's judged commit: the commit
+ * its run judged, and THAT run's own verdict persisted beside it.
+ *
+ * A run is selected under the delivery's own gate, so the verdict it rendered
+ * (gateVerdictFromRun, by the rule the durable per-commit record uses) is the
+ * delivery's own-gate verdict for the commit. Persisting it beside the sha is what
+ * lets the resume (spawn/prompt-assembly.ts) show it without reading any record.
+ * A stamp that carries none -- the run rendered no verdict (a timeout, an
+ * unavailable checkout, an instrument fault), or a legacy stamp -- is resolved
+ * there under the delivery's own gate, never by a gate-less record read.
+ *
+ * The deterministic-failure, shortfall and evidence-unavailable re-work writers
+ * share it (verify/verification-feedback.ts,
+ * verify/verification-evidence-unavailable-feedback.ts); extracted so
+ * verification-feedback.ts stays under the daemon 800-line cap.
+ *
+ * @module verify/rework-judgment
+ */
+import { type DeliveryGateState, type GateVerdictSummary } from '../queries/delivery-gate-state.js';
+import { type GateRunVerdictSource, type JudgedCommitTarget } from './gate-verdict-source.js';
+/** The run a re-work feeds back, as its writer is handed it. */
+export interface ReworkRunJudgment {
+    /** The commit the run judged; null or absent when it judged none. */
+    judgedSha?: string | null;
+    /**
+     * The verdict that run rendered for `judgedSha` (runVerdictOf); null when it
+     * rendered none. Absent only where the writer was not handed the run at all.
+     */
+    runVerdict?: GateVerdictSummary | null;
+}
+/**
+ * The verdict a finished run rendered for its commit, or null when it rendered
+ * none. `instrumentFault` is true when attribution routed the run to
+ * instrument-fault re-work, which records no verdict for the commit
+ * (commit-verdict-record.buildCommitVerdict), so none is shown for it either. Pure.
+ */
+export declare function runVerdictOf(run: GateRunVerdictSource, instrumentFault: boolean): GateVerdictSummary | null;
+/**
+ * `gateState` with its judged commit replaced by the run's, and the run's own
+ * verdict persisted beside it when it is a verdict for that commit
+ * (stampJudgedCommit). Never a record read. Pure.
+ */
+export declare function stampReworkJudgment(gateState: DeliveryGateState, judgment: ReworkRunJudgment, judgedAt: string): DeliveryGateState;
+/**
+ * The verdict a re-work DETAIL carries (the live inject, and the listing a
+ * respawned team reads): the run's own verdict whenever the writer was handed the
+ * run -- null included, since a run that rendered none has none to show -- else
+ * the recorded verdict for exactly the judged commit through the writer's reader.
+ * No judged sha asks nothing.
+ */
+export declare function reworkDetailVerdict(d: {
+    readGateVerdict: (target: JudgedCommitTarget) => GateVerdictSummary | null;
+}, v: {
+    productId?: string | null;
+    focusId?: string | null;
+}, judgment: ReworkRunJudgment): GateVerdictSummary | null;
+//# sourceMappingURL=rework-judgment.d.ts.map

package/dist/verify/rework-judgment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework-judgment.d.ts","sourceRoot":"","sources":["../../src/verify/rework-judgment.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAqB,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAElC,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACxC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,oBAAoB,EAAE,eAAe,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAElI;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE;IAAE,eAAe,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,kBAAkB,GAAG,IAAI,CAAA;CAAE,EACjF,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACzD,QAAQ,EAAE,iBAAiB,GAC1B,kBAAkB,GAAG,IAAI,CAG3B"}