@tokenfactory/acc-runner 0.44.0 → 0.44.1

package/dist/runtime/decision-provenance.js

@@ -0,0 +1,107 @@
+/**
+ * REVIEW-DECISION-PROVENANCE (runner half; mirrors
+ * api/_lib/reviewer/decision-provenance.ts, which carries the full rationale).
+ *
+ * MEASURED FAULT (PR #1913): `decision = "reject"` was persisted while every
+ * entry in `reasons[]` concluded "Met." — a full-pass analysis — with nothing on
+ * the row explaining the disagreement. That verdict was not asserted by the
+ * reviewer; the prose fallback in `extractReviewerDecision` SYNTHESIZED it from
+ * the first approve/reject keyword when the model answered in markdown, and left
+ * no trace. The contrast case (PR #1911) was a legitimate forced reject that
+ * named its rationale in `reasons[]`.
+ *
+ * INVARIANT: a forced or synthesized decision carries its justification in
+ * `reasons[]` plus a machine-readable marker naming the override source. The
+ * runner is the hot-path writer (acc.submit_review), so the guard runs here,
+ * immediately before the row is persisted.
+ *
+ * JUDGEMENT IS NEVER ALTERED — nothing here flips approve↔reject. `reasons[]` is
+ * the only channel (acc.review_queue stores `reasons text[]` and submit_review
+ * takes no extra argument), so the marker rides there in a parseable form, the
+ * same way the read-coverage telemetry line does.
+ *
+ * PURE. No I/O, no clock, no client.
+ */
+/** Stable prefix for cheap row detection. */
+export const DECISION_PROVENANCE_PREFIX = "decision_provenance:";
+const PROVENANCE_RE = /^decision_provenance:\s*decision_source=(\S+)\s+override_reason=([\s\S]*)$/i;
+/** Rationale stamped when the prose fallback synthesizes the verdict. */
+export const PROSE_KEYWORD_OVERRIDE_REASON = "the reviewer answered in prose instead of the structured verdict object, so " +
+    "this decision was synthesized by the parser from the first approve/reject " +
+    "keyword in the text rather than asserted as a verdict";
+/** Rationale stamped when a reject is contradicted by its own reasons. */
+export const CONTRADICTION_OVERRIDE_REASON = "the analysis recorded every acceptance criterion as met, yet the verdict is " +
+    "reject and the row states no override rationale — the verdict is kept as " +
+    "submitted and flagged here for the operator";
+/** Render a provenance record as the reasons[] line that persists it. */
+export function decisionProvenanceReason(p) {
+    const rationale = p.override_reason.replace(/\s+/g, " ").trim() || "(unstated)";
+    return `${DECISION_PROVENANCE_PREFIX} decision_source=${p.decision_source} override_reason=${rationale}`;
+}
+/** True when a single reason IS the provenance marker (never a finding). */
+export function isDecisionProvenanceReason(reason) {
+    return typeof reason === "string" && PROVENANCE_RE.test(reason.trim());
+}
+/** The first provenance marker carried by a verdict's reasons, or null. */
+export function parseDecisionProvenance(reasons) {
+    for (const raw of reasons ?? []) {
+        if (typeof raw !== "string")
+            continue;
+        const m = PROVENANCE_RE.exec(raw.trim());
+        if (m) {
+            return { decision_source: m[1], override_reason: m[2].trim() };
+        }
+    }
+    return null;
+}
+/** Severity tag the server-side calibrator stamps on stored findings. */
+const SEVERITY_TAG_RE = /^\s*\[(?:blocking|advisory)\]\s*/i;
+/** A finding that concludes the criterion it names was satisfied. */
+const MET_RE = /\bmet\b\s*[.)\]]?\s*$/i;
+/**
+ * Defect / non-satisfaction language. Present anywhere ⇒ the analysis is not a
+ * clean full pass and the guard stands down — deliberately biased toward NOT
+ * stamping, since a missed stamp is an audit gap while a wrong one would
+ * editorialize a real reject.
+ */
+const DEFECT_RE = /\b(?:not\s+met|unmet|partially\s+met|fail(?:s|ed|ing|ure)?|missing|absent|violat\w*|blocking|defect|regression|broken|incorrect|unsafe|does\s+not|is\s+not|are\s+not|was\s+not|cannot|can['’]?t)\b/i;
+/**
+ * True when a verdict's reasons read as a FULL-PASS analysis: at least one
+ * criterion recorded as met and no defect language anywhere. Lines that are
+ * neither (telemetry such as the coverage line) are tolerated.
+ */
+export function allCriteriaMet(reasons) {
+    const findings = (reasons ?? [])
+        .filter((r) => typeof r === "string")
+        .filter((r) => !isDecisionProvenanceReason(r))
+        .map((r) => r.replace(SEVERITY_TAG_RE, "").trim())
+        .filter((r) => r.length > 0);
+    if (findings.length === 0)
+        return false;
+    if (findings.some((r) => DEFECT_RE.test(r)))
+        return false;
+    return findings.some((r) => MET_RE.test(r));
+}
+/**
+ * The submit-seam guard. A reject whose reasons record a clean full pass and
+ * which carries no provenance marker gets one appended, so the #1913 shape can
+ * never be persisted unexplained. Every other verdict is returned untouched and
+ * the DECISION IS NEVER CHANGED. Idempotent.
+ */
+export function reconcileReviewDecision(verdict) {
+    const reasons = (verdict.reasons ?? []).filter((r) => typeof r === "string");
+    const existing = parseDecisionProvenance(reasons);
+    if (verdict.decision !== "reject" || existing !== null || !allCriteriaMet(reasons)) {
+        return { decision: verdict.decision, reasons, provenance: existing };
+    }
+    const provenance = {
+        decision_source: "reconciled_contradiction",
+        override_reason: CONTRADICTION_OVERRIDE_REASON,
+    };
+    return {
+        decision: verdict.decision,
+        reasons: [...reasons, decisionProvenanceReason(provenance)],
+        provenance,
+    };
+}
+//# sourceMappingURL=decision-provenance.js.map

package/dist/runtime/decision-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-provenance.js","sourceRoot":"","sources":["../../src/runtime/decision-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE,MAAM,aAAa,GACjB,6EAA6E,CAAC;AAEhF,yEAAyE;AACzE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E;IAC9E,4EAA4E;IAC5E,uDAAuD,CAAC;AAE1D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E;IAC9E,2EAA2E;IAC3E,6CAA6C,CAAC;AAEhD,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,CAAqB;IAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC;IAChF,OAAO,GAAG,0BAA0B,oBAAoB,CAAC,CAAC,eAAe,oBAAoB,SAAS,EAAE,CAAC;AAC3G,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC1E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CACrC,OAAkE;IAElE,KAAK,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC;YACN,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAmB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAC5D,qEAAqE;AACrE,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC;;;;;GAKG;AACH,MAAM,SAAS,GACb,qMAAqM,CAAC;AAExM;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAkE;IAElE,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAmB,OAGzD;IACC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,GAAuB;QACrC,eAAe,EAAE,0BAA0B;QAC3C,eAAe,EAAE,6BAA6B;KAC/C,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC3D,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/runtime/prompt-substitute.d.ts

@@ -0,0 +1,100 @@
+/**
+ * S15-FU/REVIEW-1 (AC1) — literal-safe reviewer-prompt placeholder substitution.
+ *
+ * THE FAULT THIS CLOSES (the LEDGER-1 #1933 episode)
+ * ----------------------------------------------------------------------------
+ * `renderReviewerPrompt` interpolated the PR diff into the reviewer prompt with
+ *
+ *     template.replace("{{pr_diff}}", diff)
+ *
+ * `String.prototype.replace` treats a STRING replacement as a pattern: `$$`,
+ * `$&`, `` $` ``, `$'` and `$1`…`$9` are expanded, not copied. So a diff whose
+ * text contains `$'` — which every one of these clean SQL literals does —
+ *
+ *     select seq, slug, sha from acc.applied_migrations where seq ~ '^[0-9]+$' order by 1
+ *                                                                         ^^ $'
+ *
+ * made `replace` splice in "the portion of the template AFTER the match": the
+ * reviewer's OWN instruction text, starting at
+ * "Now answer in this exact JSON shape, with no surrounding prose:". The
+ * reviewer then read that prose INSIDE the SQL literal and — correctly, given
+ * what it was shown — reported "prose spliced into the literal" as a corruption
+ * defect, at 0.75–0.85 confidence, across several independent sessions. The
+ * diff on disk was clean the whole time; the harness corrupted it on the way in.
+ *
+ * (Same root cause as the 3× `gatherAppliedLedger` corruption in
+ * `scripts/ci/migration-lint.mjs`: `$'` expansion in a string replacement, not
+ * context bleed.)
+ *
+ * THE RULE: NEVER pass untrusted text as `replace`'s string replacement. A
+ * FUNCTION replacement is copied verbatim — `$` has no meaning in its return
+ * value — so `substitutePlaceholder` below is the only sanctioned way to put a
+ * diff, PR body, title, description, or acceptance criterion into a prompt.
+ *
+ * Mirrored, byte-for-byte in behaviour, from
+ * `api/_lib/reviewer/prompt-substitute.ts` (the server path). The runner ships as
+ * a published npm package and cannot import from `api/_lib`, so the module is
+ * duplicated and pinned by a cross-implementation parity test.
+ * // keep in sync with api/_lib/reviewer/prompt-substitute.ts
+ */
+/**
+ * The `$`-sequences `String.prototype.replace` expands inside a STRING
+ * replacement. Documented here because the whole module exists to defeat them.
+ *
+ *   `$$`  → a literal `$`
+ *   `$&`  → the matched substring
+ *   ``$` `` → everything BEFORE the match
+ *   `$'`  → everything AFTER the match  ← the #1933 corruption
+ *   `$n`  → capture group n
+ */
+export declare const REPLACEMENT_EXPANSION_SEQUENCES: readonly ["$$", "$&", "$`", "$'"];
+/**
+ * True when `value` contains a sequence that `String.prototype.replace` would
+ * expand if it were used as a string replacement. Diagnostic only — the
+ * substitution below is safe either way — but it lets the render seam log that a
+ * value was in the dangerous class without ever emitting the value itself.
+ */
+export declare function hasReplacementExpansion(value: string | null | undefined): boolean;
+/**
+ * Substitute the FIRST occurrence of `placeholder` with `value`, VERBATIM.
+ *
+ * The replacement is a function, so no `$`-sequence in `value` is expanded and
+ * no template text can bleed into it. An absent placeholder is a no-op (the
+ * template is returned unchanged) — same as the string form it replaces.
+ */
+export declare function substitutePlaceholder(template: string, placeholder: string, value: string | null | undefined): string;
+/**
+ * Apply an ORDERED list of `[placeholder, value]` pairs. Order matters only in
+ * that each pass sees the output of the previous one; because values are
+ * inserted verbatim, a value that happens to contain a later placeholder's
+ * literal text (`"{{pr_diff}}"` inside a PR body, say) is NOT re-substituted
+ * away — the later pass still matches the TEMPLATE's own placeholder first,
+ * since it appears earlier in the string only if the template put it there.
+ */
+export declare function substitutePlaceholders(template: string, pairs: ReadonlyArray<readonly [string, string | null | undefined]>): string;
+/** One value that did not survive substitution verbatim. */
+export interface PromptRenderBleed {
+    /** The placeholder whose value was corrupted (e.g. `{{pr_diff}}`). */
+    placeholder: string;
+    /** Length of the value we expected to find verbatim (never the value itself). */
+    expected_chars: number;
+}
+/**
+ * INTEGRITY CHECK: every value substituted for a placeholder THE TEMPLATE
+ * ACTUALLY CONTAINS must appear VERBATIM in the rendered output. Anything else
+ * means the render mangled file content — the #1933 class — and the review must
+ * NOT proceed on that prompt (the reviewer would be judging text the repo does
+ * not contain).
+ *
+ * `template` is required precisely so a placeholder the template OMITS is not
+ * reported: a prompt that never asks for the PR body was not corrupted by the
+ * body's absence, it simply does not carry it. Only a value the template asked
+ * for and did not receive verbatim is a bleed.
+ *
+ * Pure and allocation-cheap (`includes`, no regex). Values are never echoed into
+ * the result, so a bleed report is safe to log.
+ */
+export declare function findPromptRenderBleed(template: string, rendered: string, pairs: ReadonlyArray<readonly [string, string | null | undefined]>): PromptRenderBleed[];
+/** Operator-facing one-liner naming the corrupted placeholders (never the values). */
+export declare function describePromptRenderBleed(bleeds: PromptRenderBleed[]): string;
+//# sourceMappingURL=prompt-substitute.d.ts.map

package/dist/runtime/prompt-substitute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-substitute.d.ts","sourceRoot":"","sources":["../../src/runtime/prompt-substitute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,mCAAoC,CAAC;AAEjF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGjF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAGR;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACjE,MAAM,CAMR;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACjE,iBAAiB,EAAE,CAarB;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAI7E"}

package/dist/runtime/prompt-substitute.js

@@ -0,0 +1,124 @@
+/**
+ * S15-FU/REVIEW-1 (AC1) — literal-safe reviewer-prompt placeholder substitution.
+ *
+ * THE FAULT THIS CLOSES (the LEDGER-1 #1933 episode)
+ * ----------------------------------------------------------------------------
+ * `renderReviewerPrompt` interpolated the PR diff into the reviewer prompt with
+ *
+ *     template.replace("{{pr_diff}}", diff)
+ *
+ * `String.prototype.replace` treats a STRING replacement as a pattern: `$$`,
+ * `$&`, `` $` ``, `$'` and `$1`…`$9` are expanded, not copied. So a diff whose
+ * text contains `$'` — which every one of these clean SQL literals does —
+ *
+ *     select seq, slug, sha from acc.applied_migrations where seq ~ '^[0-9]+$' order by 1
+ *                                                                         ^^ $'
+ *
+ * made `replace` splice in "the portion of the template AFTER the match": the
+ * reviewer's OWN instruction text, starting at
+ * "Now answer in this exact JSON shape, with no surrounding prose:". The
+ * reviewer then read that prose INSIDE the SQL literal and — correctly, given
+ * what it was shown — reported "prose spliced into the literal" as a corruption
+ * defect, at 0.75–0.85 confidence, across several independent sessions. The
+ * diff on disk was clean the whole time; the harness corrupted it on the way in.
+ *
+ * (Same root cause as the 3× `gatherAppliedLedger` corruption in
+ * `scripts/ci/migration-lint.mjs`: `$'` expansion in a string replacement, not
+ * context bleed.)
+ *
+ * THE RULE: NEVER pass untrusted text as `replace`'s string replacement. A
+ * FUNCTION replacement is copied verbatim — `$` has no meaning in its return
+ * value — so `substitutePlaceholder` below is the only sanctioned way to put a
+ * diff, PR body, title, description, or acceptance criterion into a prompt.
+ *
+ * Mirrored, byte-for-byte in behaviour, from
+ * `api/_lib/reviewer/prompt-substitute.ts` (the server path). The runner ships as
+ * a published npm package and cannot import from `api/_lib`, so the module is
+ * duplicated and pinned by a cross-implementation parity test.
+ * // keep in sync with api/_lib/reviewer/prompt-substitute.ts
+ */
+/**
+ * The `$`-sequences `String.prototype.replace` expands inside a STRING
+ * replacement. Documented here because the whole module exists to defeat them.
+ *
+ *   `$$`  → a literal `$`
+ *   `$&`  → the matched substring
+ *   ``$` `` → everything BEFORE the match
+ *   `$'`  → everything AFTER the match  ← the #1933 corruption
+ *   `$n`  → capture group n
+ */
+export const REPLACEMENT_EXPANSION_SEQUENCES = ["$$", "$&", "$`", "$'"];
+/**
+ * True when `value` contains a sequence that `String.prototype.replace` would
+ * expand if it were used as a string replacement. Diagnostic only — the
+ * substitution below is safe either way — but it lets the render seam log that a
+ * value was in the dangerous class without ever emitting the value itself.
+ */
+export function hasReplacementExpansion(value) {
+    const text = value ?? "";
+    return /\$[$&`'\d]/.test(text);
+}
+/**
+ * Substitute the FIRST occurrence of `placeholder` with `value`, VERBATIM.
+ *
+ * The replacement is a function, so no `$`-sequence in `value` is expanded and
+ * no template text can bleed into it. An absent placeholder is a no-op (the
+ * template is returned unchanged) — same as the string form it replaces.
+ */
+export function substitutePlaceholder(template, placeholder, value) {
+    const text = value ?? "";
+    return (template ?? "").replace(placeholder, () => text);
+}
+/**
+ * Apply an ORDERED list of `[placeholder, value]` pairs. Order matters only in
+ * that each pass sees the output of the previous one; because values are
+ * inserted verbatim, a value that happens to contain a later placeholder's
+ * literal text (`"{{pr_diff}}"` inside a PR body, say) is NOT re-substituted
+ * away — the later pass still matches the TEMPLATE's own placeholder first,
+ * since it appears earlier in the string only if the template put it there.
+ */
+export function substitutePlaceholders(template, pairs) {
+    let out = template ?? "";
+    for (const [placeholder, value] of pairs) {
+        out = substitutePlaceholder(out, placeholder, value);
+    }
+    return out;
+}
+/**
+ * INTEGRITY CHECK: every value substituted for a placeholder THE TEMPLATE
+ * ACTUALLY CONTAINS must appear VERBATIM in the rendered output. Anything else
+ * means the render mangled file content — the #1933 class — and the review must
+ * NOT proceed on that prompt (the reviewer would be judging text the repo does
+ * not contain).
+ *
+ * `template` is required precisely so a placeholder the template OMITS is not
+ * reported: a prompt that never asks for the PR body was not corrupted by the
+ * body's absence, it simply does not carry it. Only a value the template asked
+ * for and did not receive verbatim is a bleed.
+ *
+ * Pure and allocation-cheap (`includes`, no regex). Values are never echoed into
+ * the result, so a bleed report is safe to log.
+ */
+export function findPromptRenderBleed(template, rendered, pairs) {
+    const out = [];
+    const tpl = template ?? "";
+    const text = rendered ?? "";
+    for (const [placeholder, value] of pairs) {
+        const expected = value ?? "";
+        if (expected.length === 0)
+            continue;
+        if (!tpl.includes(placeholder))
+            continue;
+        if (!text.includes(expected)) {
+            out.push({ placeholder, expected_chars: expected.length });
+        }
+    }
+    return out;
+}
+/** Operator-facing one-liner naming the corrupted placeholders (never the values). */
+export function describePromptRenderBleed(bleeds) {
+    return bleeds
+        .map((b) => `${b.placeholder} (${b.expected_chars} chars did not survive verbatim)`)
+        .join("; ");
+}
+//# sourceMappingURL=prompt-substitute.js.map

package/dist/runtime/prompt-substitute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-substitute.js","sourceRoot":"","sources":["../../src/runtime/prompt-substitute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAgC;IACtE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,WAAmB,EACnB,KAAgC;IAEhC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,KAAkE;IAElE,IAAI,GAAG,GAAG,QAAQ,IAAI,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,QAAgB,EAChB,KAAkE;IAElE,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,yBAAyB,CAAC,MAA2B;IACnE,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,cAAc,kCAAkC,CAAC;SACnF,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/runtime/review-cost-cap.d.ts

@@ -0,0 +1,167 @@
+/**
+ * REV-COST — runner-side per-review cost cap (size-scaled).
+ *
+ * THE EPISODE (PR #1937). The runner reviewer applied the org's FLAT
+ * `max_cost_usd_per_review` and, the instant the spend crossed it, discarded the
+ * review with `cost_cap_exceeded`. #1937 is a ~1800-line PR: it cost ~$18 against
+ * an $8 flat cap and produced NO verdict at all — the money was spent, the
+ * analysis was done, and the harness threw both away, then re-charged the same
+ * review on the next tick. That is the measured 239-decisions-over-9-tasks loop
+ * AU-5 fixed on the SERVER path (api/_lib/cost-cap.ts) and left unfixed here,
+ * which is why a large PR could still be stranded whenever a runner picked the
+ * broadcast up (the normal case — the server path is the emergency fallback).
+ *
+ * This module is the runner's copy of AU-5's PURE cost-cap core:
+ *
+ *   • `effectiveReviewCostCap` — the cap for THIS review, scaled by assembled
+ *     diff size, FLOORED at the org's flat cap (so a median PR is judged against
+ *     exactly today's number — never inflated) and CLAMPED at
+ *     REVIEW_CAP_MAX_MULTIPLE.
+ *   • `foldReviewCostLedger` — the chargeable-vs-infra split. Only PRODUCTIVE
+ *     attempts (a spawn that returned a readable reviewer envelope) are charged
+ *     to the cap; capacity/auth/tooling faults are reported but never charged.
+ *   • `classifyReviewCost` — within / overrun / runaway. `overrun` keeps the
+ *     verdict (the money is already spent; discarding it only strands the PR);
+ *     `runaway` is the hard backstop that still refuses.
+ *
+ * The runner is a standalone published package and cannot import from api/_lib
+ * (the same convention as the duplicated PRICING / MODEL_ALIASES maps and
+ * review-diff-guard.ts). KEEP IN SYNC with the AU-5 block at the bottom of
+ * api/_lib/cost-cap.ts — the constants and all three functions are pinned
+ * byte-for-behaviour by tests/unit/revcost1-runner-cap-parity.test.ts, which
+ * fails the build the moment the two drift.
+ */
+/**
+ * Assembled-diff size the flat cap is treated as calibrated for: the measured
+ * p50 production churn (750 changed lines ≈ 30k chars of unified diff). At or
+ * below this the effective cap is EXACTLY `max_cost_usd_per_review`.
+ * Mirrors api/_lib/cost-cap.ts. // keep in sync
+ */
+export declare const REVIEW_CAP_REFERENCE_DIFF_CHARS = 30000;
+/** Fraction of the base cap added per reference-diff-worth of EXCESS size. */
+export declare const REVIEW_CAP_SIZE_SLOPE = 0.5;
+/**
+ * Ceiling on the scaled cap as a multiple of the base cap. Deliberately tight
+ * (1.5× → $3.00 at a $2 base) because the measured size↔cost correlation is
+ * weak (Pearson r = 0.100): a bigger ramp would be unjustified by the data.
+ */
+export declare const REVIEW_CAP_MAX_MULTIPLE = 1.5;
+/**
+ * Multiple of the effective cap above which an already-PAID review is still
+ * discarded as a runaway — the hard backstop that survives this change. Between
+ * 1× and this, the verdict is KEPT and flagged (`cost_overrun`) instead of
+ * stranding the PR.
+ */
+export declare const REVIEW_COST_OVERRUN_TOLERANCE = 3;
+export interface ReviewCostCapDecision {
+    /** The cap to enforce for THIS review. */
+    cap_usd: number;
+    /** The org's flat `max_cost_usd_per_review` — the floor. */
+    base_cap_usd: number;
+    /** false when the base cap is 0/negative/non-finite (cap disabled). */
+    enabled: boolean;
+    /** Assembled-diff chars the scale was computed from. */
+    diff_chars: number;
+    /** cap_usd / base_cap_usd — 1 when the flat floor applied. */
+    scale: number;
+    /** True when the size ramp hit REVIEW_CAP_MAX_MULTIPLE. */
+    ceiling_applied: boolean;
+    /** Spend above which an already-paid verdict is discarded as a runaway. */
+    runaway_usd: number;
+}
+/**
+ * The size-scaled per-review cost cap. Monotone non-decreasing in `diffChars`,
+ * floored at `baseCapUsd` (so it can only ever LOOSEN relative to the flat cap —
+ * a small PR's effective cap is unchanged) and clamped at
+ * `REVIEW_CAP_MAX_MULTIPLE × baseCapUsd`. Pure.
+ *
+ * A base cap of 0 (or a non-finite/negative one) means "cap disabled" — the
+ * existing `max_cost_usd_per_review > 0` semantics — and is returned verbatim.
+ *
+ * Mirrors api/_lib/cost-cap.ts `effectiveReviewCostCap`. // keep in sync
+ */
+export declare function effectiveReviewCostCap(baseCapUsd: number, diffChars: number): ReviewCostCapDecision;
+/**
+ * How one reviewer attempt is classified for BUDGET purposes. Only `productive`
+ * attempts (a spawn that returned a reviewer envelope we can read a verdict out
+ * of) are charged to the per-review cap. Every other class is an INFRA fault: it
+ * is still reported in the review's total spend so the accounting stays honest,
+ * but it must never consume the budget set aside for reviewing this PR.
+ *
+ * Mirrors api/_lib/cost-cap.ts `ReviewAttemptClass`. // keep in sync
+ */
+export type ReviewAttemptClass = "productive"
+/** Parse-repair re-prompt — a harness cost, not review work. */
+ | "parse_repair"
+/** 429 / overloaded / rate-limit brownout (budget-exempt). */
+ | "infra_capacity"
+/** Hard billing/quota wall. */
+ | "infra_billing"
+/** Account-level spend cap. */
+ | "infra_billing_capped"
+/** Missing/invalid credential — env broken. */
+ | "infra_auth"
+/** Verification-tooling failure (unread file / truncated diff). */
+ | "infra_tooling";
+export interface ReviewCostAttempt {
+    /** 1-based attempt ordinal within this review. */
+    attempt: number;
+    model_id: string;
+    attempt_class: ReviewAttemptClass;
+    /** Spend this attempt actually incurred (0 for a throw before any tokens). */
+    cost_usd: number;
+}
+export interface ReviewCostLedger {
+    attempts: ReviewCostAttempt[];
+    /** Sum of PRODUCTIVE attempt cost — the only figure the cap is checked against. */
+    chargeable_usd: number;
+    /** Sum of every non-productive attempt cost (reported, never charged). */
+    infra_usd: number;
+    /** chargeable + infra — what the review truly cost (stored on the queue row). */
+    total_usd: number;
+    productive_attempts: number;
+    infra_attempts: number;
+}
+/**
+ * Fold an attempt list into the chargeable / infra split. Pure.
+ * Mirrors api/_lib/cost-cap.ts `foldReviewCostLedger`. // keep in sync
+ */
+export declare function foldReviewCostLedger(attempts: ReviewCostAttempt[]): ReviewCostLedger;
+/**
+ * Verdict on this review's chargeable spend:
+ *   • `within`  — at or under the effective cap. Nothing changes.
+ *   • `overrun` — over the cap but under the runaway threshold. The money is
+ *     ALREADY SPENT, so discarding the verdict buys nothing and strands the PR
+ *     (#1937). Keep the verdict and flag it.
+ *   • `runaway` — past the tolerance band. Refuse the verdict; something is
+ *     pathological and the operator must see it.
+ *
+ * Mirrors api/_lib/cost-cap.ts `classifyReviewCost`. // keep in sync
+ */
+export type ReviewCostVerdict = "within" | "overrun" | "runaway";
+export declare function classifyReviewCost(chargeableUsd: number, cap: ReviewCostCapDecision): ReviewCostVerdict;
+/** Mutable cost state for ONE review, shared by every pass it runs. */
+export interface ReviewCostContext {
+    cap: ReviewCostCapDecision;
+    attempts: ReviewCostAttempt[];
+}
+/** Open a cost context for a review over `diffChars` of assembled diff. */
+export declare function openReviewCostContext(baseCapUsd: number, diffChars: number): ReviewCostContext;
+/** Record one attempt and return the folded ledger. */
+export declare function chargeReviewAttempt(ctx: ReviewCostContext, modelId: string, attemptClass: ReviewAttemptClass, costUsd: number): ReviewCostLedger;
+/** The current folded ledger without recording anything. */
+export declare function reviewCostLedger(ctx: ReviewCostContext): ReviewCostLedger;
+/**
+ * Advisory reason for an ACCEPTED overrun. Deliberately phrased to match none of
+ * the absence-claim patterns in review-chunking.ts (asserted by this wave's
+ * test), so an audit line can never be re-read as a read-coverage claim.
+ */
+export declare function reviewCostOverrunReason(cap: ReviewCostCapDecision, ledger: ReviewCostLedger): string;
+/**
+ * Refusal reason for a RUNAWAY — the backstop above the scaled cap. Carries the
+ * PRODUCTIVE attempt count, which is what distinguishes a single-pass runaway
+ * from a chunked review that accumulated past the tolerance over several part
+ * passes (the old chunked-only reason string), without needing two call sites.
+ */
+export declare function reviewCostRunawayReason(cap: ReviewCostCapDecision, ledger: ReviewCostLedger): string;
+//# sourceMappingURL=review-cost-cap.d.ts.map

package/dist/runtime/review-cost-cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-cost-cap.d.ts","sourceRoot":"","sources":["../../src/runtime/review-cost-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;IACjB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,eAAe,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,qBAAqB,CAiCvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAC1B,YAAY;AACd,gEAAgE;GAC9D,cAAc;AAChB,8DAA8D;GAC5D,gBAAgB;AAClB,+BAA+B;GAC7B,eAAe;AACjB,+BAA+B;GAC7B,sBAAsB;AACxB,+CAA+C;GAC7C,YAAY;AACd,mEAAmE;GACjE,eAAe,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,kBAAkB,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,iBAAiB,EAAE,GAC5B,gBAAgB,CAuBlB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjE,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,qBAAqB,GACzB,iBAAiB,CAKnB;AASD,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,qBAAqB,CAAC;IAC3B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAEnB;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,iBAAiB,EACtB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,MAAM,GACd,gBAAgB,CAQlB;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,gBAAgB,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,gBAAgB,GACvB,MAAM,CAOR;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,gBAAgB,GACvB,MAAM,CASR"}