@ybotok/loam 0.1.0-beta.2 → 0.2.0-alpha.1

package/dist/commands/verify/cross/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../../../src/commands/verify/cross/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAmC,MAAM,iCAAiC,CAAC;AAChG,OAAO,EAA8B,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAoB,MAAM,oCAAoC,CAAC;AACpG,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAqB,MAAM,cAAc,CAAC;AA8BjD;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAgB,EAAE,GAAY;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAChC,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,CAAE,GAAG,CAAC,SAAS,CAAe;YAC/B,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,OAAO;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC3B,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAClG;KACF,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,CACL,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,SAAS,CAAC,OAAO,4CAA4C;QACtG,aAAa,KAAK,CAAC,IAAI,+BAA+B,KAAK,CAAC,MAAM,CAAC,MAAM,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,UAAU,CACxH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CAAC,KAAgB,EAAE,IAAY,EAAE,IAAwB;IAC9E,MAAM,KAAK,GAAG,GAAG,IAAI,gBAAgB,IAAI,GAAG,CAAC;IAC7C,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,0EAA0E;QAC1E,wEAAwE;QACxE,iDAAiD;QACjD,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,GAAG,KAAK,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACtF,CAAC;IACJ,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,GAAG,KAAK,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACnH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAC9G,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,0DAA0D;IAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1G,CAAC;AAED,SAAS,QAAQ,CAAC,MAAmB;IACnC,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;QAAE,OAAO,cAAc,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvF,OAAO,cAAc,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAoB,EACpB,SAAoB,EACpB,KAAkB,EAClB,KAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,mEAAmE;IACnE,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC1G,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,oBAAoB;IACpB,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CACT,IAAI,EACJ,iBAAiB,EACjB,eAAe,SAAS,CAAC,OAAO,8CAA8C,IAAI,IAAI,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAc,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAE5F,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;YACnC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,qEAAqE;YACrE,6DAA6D;YAC7D,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1F,KAAK,EAAE;gBACL,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;gBACtC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;aACvC;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GACb,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,QAAQ,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC;IAClH,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,CAAC,OAAO,6BAA6B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,CAC/H,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,uEAAuE;QACvE,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;QACxG,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,KAAK,sBAAsB,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9H,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc,qBAAqB,KAAK,CAAC,OAAO,CAAC,gBAAgB,uBAAuB,KAAK,CAAC,OAAO,CAAC,QAAQ,YAAY,CAC9I,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;AACxF,CAAC","sourcesContent":["/**\n * `loam verify <FEAT> --diff-answers a.json b.json` — the command surface of\n * the cross-examination lens.\n *\n * A third read form beside the report and frozen views: it takes no lock,\n * needs no service binding, and writes nothing. The payload deliberately\n * carries NO `verified`, `verdict` or `attested` key — their absence is the\n * doctrine made structural (`core/verify/cross/diff.ts` holds the\n * reasoning): this surface ranks review, it grades nothing.\n *\n * Both files validate through the same `checkAnswers` the record path uses,\n * against the same scoped checklist, with `runnerOwned` unset: under a diff\n * both agents answer everything in scope, `scenario.tested` included — that\n * is the attested channel, and this command records nothing. If a future\n * wave ever makes scenario claims runner-only even without `--results`,\n * blind agents can no longer answer them and this command starts refusing;\n * `checkAnswers`' own `runnerOwned` note carries the same warning where that\n * editor will see it.\n */\nimport { createHash } from \"node:crypto\";\nimport { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { emitJson, fail, repoPath } from \"../../../core/envelope/json.js\";\nimport { isRecord } from \"../../../core/kernel/records.js\";\nimport { checkAnswers, type Answer, type AnswerRefusal } from \"../../../core/verify/answers.js\";\nimport { type Checklist, type Claim } from \"../../../core/verify/checklist.js\";\nimport { crossExamine, disjointNotice, type CrossAnswer } from \"../../../core/verify/cross/diff.js\";\nimport { plural } from \"../../policy/format.js\";\nimport { type VerifyTarget } from \"../report.js\";\n\n/**\n * The two files, named for the order they were given: `a` is the first and\n * every refusal about it says \"first answer set\". One record rather than two\n * loose strings because they are never asked about separately, and because a\n * transposed pair is exactly the mistake a positional form invites.\n */\nexport interface AnswerFiles {\n  a: string;\n  b: string;\n}\n\ntype SideRead =\n  | { ok: true; answers: Answer[]; digest: string }\n  | { ok: false; code: AnswerRefusal; message: string };\n\n/**\n * Everything a side is validated against: the lens-scoped claims, the whole\n * checklist behind them (what the honest off-lens diagnosis is written from),\n * and the lens itself. One record because the three are never asked about\n * separately — a scoped array without its checklist is how the false \"not on\n * the checklist\" diagnosis happened.\n */\ninterface DiffScope {\n  scoped: Claim[];\n  checklist: Checklist;\n  lens?: string;\n}\n\n/**\n * The honest half of a lens-narrowed mismatch. `checkAnswers` is handed only\n * the scoped claims, so an answer naming another service's claim — which IS\n * on the feature's checklist — would otherwise be called \"not on the\n * checklist\": the same false diagnosis `runnerOwned` exists to prevent on the\n * recording path. When the stray ids are real claims the lens filtered out,\n * say that, and say what the lens narrowed.\n */\nfunction offLensNote(scope: DiffScope, raw: unknown): string {\n  if (scope.lens === undefined) return \"\";\n  const entries = Array.isArray(raw)\n    ? raw\n    : isRecord(raw) && Array.isArray(raw[\"answers\"])\n      ? (raw[\"answers\"] as unknown[])\n      : [];\n  const scoped = new Set(scope.scoped.map((c) => c.id));\n  const onChecklist = new Set(scope.checklist.claims.map((c) => c.id));\n  const foreign = [\n    ...new Set(\n      entries\n        .filter(isRecord)\n        .map((entry) => entry[\"id\"])\n        .filter((id): id is string => typeof id === \"string\" && onChecklist.has(id) && !scoped.has(id)),\n    ),\n  ];\n  if (foreign.length === 0) return \"\";\n  return (\n    ` (${foreign.join(\", \")}: on the ${scope.checklist.feature} checklist but owned by another service — ` +\n    `--service ${scope.lens} narrowed the comparison to ${scope.scoped.length} of ${scope.checklist.claims.length} claims)`\n  );\n}\n\n/**\n * Read, digest and validate ONE answer set. Fail-closed on purpose at every\n * step: an unreadable or malformed file is a refusal naming which file and\n * why — never a silently empty side, which would grade as \"no disagreement\"\n * about claims nobody compared.\n */\nasync function readSide(scope: DiffScope, file: string, side: \"first\" | \"second\"): Promise<SideRead> {\n  const label = `${side} answer set (${file})`;\n  let bytes: Buffer;\n  try {\n    // cwd-relative deliberately — record.ts's reason for the same choice: the\n    // answer sets are the caller's hand-offs, not repository artifacts, and\n    // nothing on any record will ever point at them.\n    bytes = await readFile(resolve(process.cwd(), file));\n  } catch (err) {\n    return {\n      ok: false,\n      code: \"answers-unreadable\",\n      message: `${label}: cannot read: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n  let raw: unknown;\n  try {\n    raw = JSON.parse(bytes.toString(\"utf8\"));\n  } catch (err) {\n    return {\n      ok: false,\n      code: \"answers-unreadable\",\n      message: `${label}: not JSON: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n  const context = { feature: scope.checklist.feature, ...(scope.lens === undefined ? {} : { service: scope.lens }) };\n  const checked = checkAnswers(scope.scoped, raw, undefined, context);\n  if (!checked.ok) {\n    return { ok: false, code: checked.code, message: `${label}: ${checked.message}${offLensNote(scope, raw)}` };\n  }\n  // The digest is over the exact bytes read — the same reviewer-checkable\n  // promise `reportLine` makes for consumed reports: `shasum -a 256 <file>`\n  // answers whether the diff in hand read the file in hand.\n  return { ok: true, answers: checked.answers, digest: createHash(\"sha256\").update(bytes).digest(\"hex\") };\n}\n\nfunction sideLine(answer: CrossAnswer): string {\n  if (answer.verdict === \"confirmed\") return `confirmed (${answer.evidence.join(\", \")})`;\n  return `unconfirmed${answer.note === undefined ? \"\" : ` — ${answer.note}`}`;\n}\n\nexport async function diffAnswers(\n  target: VerifyTarget,\n  checklist: Checklist,\n  files: AnswerFiles,\n  scope: { lens?: string },\n): Promise<void> {\n  const { docsDir, featureDir, json } = target;\n  const lens = scope.lens;\n  // The same lens the read view applies (report.ts): the claims that\n  // service's code answers, no repository binding asked for — a diff writes\n  // nothing, so there is nothing to bind.\n  const scoped = lens === undefined ? checklist.claims : checklist.claims.filter((c) => c.subject === lens);\n  // record.ts's refusal, mirrored: a lens that owns nothing here is almost\n  // always a typo'd service id, and validating two files against an empty\n  // claim set would call every honest answer off-checklist instead of naming\n  // the real mistake.\n  if (lens !== undefined && scoped.length === 0) {\n    return fail(\n      json,\n      \"unknown-service\",\n      `The current ${checklist.feature} checklist has no claims owned by service '${lens}'.`,\n    );\n  }\n  const diffScope: DiffScope = { scoped, checklist, ...(lens === undefined ? {} : { lens }) };\n\n  // Sequential on purpose — a short-circuit, not a race: readSide never\n  // rejects, but when the first file refuses, the second is never read or\n  // parsed, so the refusal a caller sees always names the earliest problem\n  // and no work is spent on a file whose sibling already failed the run.\n  const a = await readSide(diffScope, files.a, \"first\");\n  if (!a.ok) return fail(json, a.code, a.message);\n  const b = await readSide(diffScope, files.b, \"second\");\n  if (!b.ok) return fail(json, b.code, b.message);\n\n  const cross = crossExamine(scoped, a.answers, b.answers);\n  const notice = disjointNotice(cross.rows);\n\n  if (json) {\n    emitJson({\n      command: \"verify\",\n      feature: checklist.feature,\n      path: repoPath(docsDir, featureDir),\n      digest: checklist.digest,\n      // Named only when narrowed — report.ts's rule: a consumer must never\n      // mistake one service's cross-examination for the feature's.\n      ...(lens === undefined ? {} : { service: lens, checklistClaims: checklist.claims.length }),\n      files: {\n        a: { path: files.a, digest: a.digest },\n        b: { path: files.b, digest: b.digest },\n      },\n      summary: cross.summary,\n      claims: cross.rows,\n      disagreements: cross.disagreements,\n      ...(notice === null ? {} : { notices: [notice] }),\n    });\n    return;\n  }\n\n  const scopeNote =\n    lens === undefined ? \"\" : ` owned by ${lens} (of ${plural(checklist.claims.length, \"claim\")} on the checklist)`;\n  console.log(\n    `${checklist.feature} — cross-examination over ${plural(cross.rows.length, \"claim\")}${scopeNote} (${files.a} vs ${files.b})\\n`,\n  );\n  if (cross.rows.length === 0) {\n    // Only the whole-checklist form can get here: a lens that owns nothing\n    // refused `unknown-service` above.\n    console.log(\"  Nothing to cross-examine: this feature's delta, specs and openapi promise nothing yet.\");\n    return;\n  }\n  for (const row of cross.rows) {\n    if (row.code === \"cross.disagree\") {\n      console.log(`  ✗ cross.disagree ${row.id}  [${row.subject}]  ${row.claim}`);\n      console.log(`      a: ${sideLine(row.a)}`);\n      console.log(`      b: ${sideLine(row.b)}`);\n    } else if (row.code === \"cross.agree-unconfirmed\") {\n      console.log(`  = ${row.id}  [${row.subject}]  ${row.claim}  (both unconfirmed)`);\n    } else {\n      console.log(`  = ${row.id}  [${row.subject}]  ${row.claim}${row.evidenceDisjoint === true ? \"  (disjoint evidence)\" : \"\"}`);\n    }\n  }\n  console.log(\"\");\n  if (notice !== null) console.log(`  ⚠ ${notice.code}: ${notice.message}`);\n  console.log(\n    `  ${cross.summary.agreeConfirmed} agree-confirmed, ${cross.summary.agreeUnconfirmed} agree-unconfirmed, ${cross.summary.disagree} disagree.`,\n  );\n  console.log(\"\\n  Agreement is not verification — nothing was written and no verdict changed.\");\n  console.log(\"  Read the disagreements first, then the disjoint-evidence agreements.\");\n}\n"]}

package/dist/commands/verify/evidence/contract.js

@@ -0,0 +1,32 @@
+/**
+ * `--contract-results` consumed: the file read and pinned through the shared
+ * plumbing in `./read.ts`, then graded by the format reader in
+ * `core/verify/evidence/contract.ts`. Mirrors what `../results.ts` is for the
+ * cucumber report — the command-side half that touches the filesystem, kept
+ * apart from the core half that only ever judges a parsed document.
+ */
+import { readContractReport } from "../../../core/verify/evidence/contract.js";
+import {} from "../../../core/verify/record.js";
+import { readReportArtifact } from "./read.js";
+export async function readContractResults(spelled, repoDir) {
+    const artifact = await readReportArtifact(spelled, repoDir, "contract-test report");
+    if (!artifact.ok)
+        return artifact;
+    const parsed = readContractReport(artifact.doc, spelled);
+    if (!parsed.ok)
+        return { ok: false, code: "answers-unreadable", message: parsed.message };
+    return {
+        ok: true,
+        runs: parsed.runs,
+        report: {
+            path: artifact.spelled,
+            digest: artifact.digest,
+            mtime: artifact.mtime,
+            // Distinct operationIds, not entries: the pin says how much of an API
+            // the file speaks about, and a re-run is not a second operation.
+            operations: new Set(parsed.runs.map((r) => r.operationId)).size,
+            format: "generic",
+        },
+    };
+}
+//# sourceMappingURL=contract.js.map

package/dist/commands/verify/evidence/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../../src/commands/verify/evidence/contract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,kBAAkB,EAAoB,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAA+B,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAM/C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,OAA2B;IAE3B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1F,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,OAAO;YACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,sEAAsE;YACtE,iEAAiE;YACjE,UAAU,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;YAC/D,MAAM,EAAE,SAAS;SAClB;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * `--contract-results` consumed: the file read and pinned through the shared\n * plumbing in `./read.ts`, then graded by the format reader in\n * `core/verify/evidence/contract.ts`. Mirrors what `../results.ts` is for the\n * cucumber report — the command-side half that touches the filesystem, kept\n * apart from the core half that only ever judges a parsed document.\n */\nimport { readContractReport, type ContractRun } from \"../../../core/verify/evidence/contract.js\";\nimport { type ConsumedContractReport } from \"../../../core/verify/record.js\";\nimport { readReportArtifact } from \"./read.js\";\n\nexport type ContractResultsRead =\n  | { ok: true; report: ConsumedContractReport; runs: ContractRun[] }\n  | { ok: false; code: \"answers-unreadable\"; message: string };\n\nexport async function readContractResults(\n  spelled: string,\n  repoDir: string | undefined,\n): Promise<ContractResultsRead> {\n  const artifact = await readReportArtifact(spelled, repoDir, \"contract-test report\");\n  if (!artifact.ok) return artifact;\n  const parsed = readContractReport(artifact.doc, spelled);\n  if (!parsed.ok) return { ok: false, code: \"answers-unreadable\", message: parsed.message };\n  return {\n    ok: true,\n    runs: parsed.runs,\n    report: {\n      path: artifact.spelled,\n      digest: artifact.digest,\n      mtime: artifact.mtime,\n      // Distinct operationIds, not entries: the pin says how much of an API\n      // the file speaks about, and a re-run is not a second operation.\n      operations: new Set(parsed.runs.map((r) => r.operationId)).size,\n      format: \"generic\",\n    },\n  };\n}\n"]}

package/dist/commands/verify/evidence/pins.js

@@ -0,0 +1,52 @@
+/**
+ * The record path's half of evidence pins: attaching what the evidence
+ * validation computed onto the answers being recorded, and saying — once,
+ * while the agent is still in the loop — when a cited blob does not contain
+ * the string its claim asserts.
+ *
+ * It lives in `evidence/` beside the report readers because it is the same
+ * subject (what a federated confirmation rests on), and because `record.ts`
+ * sits against the line limit: the notice's wording and the attach loop are a
+ * seam of their own, not lines seventeen-through-forty of the record flow.
+ */
+import {} from "../../../core/verify/answers.js";
+import {} from "../../../core/verify/checklist.js";
+import {} from "../../../core/verify/pins/pin.js";
+import {} from "../../../core/verify/record.js";
+import { plural } from "../../policy/format.js";
+/** Claim id → the literal the claim asserts, for the kinds that assert one. */
+export function claimTokens(claims) {
+    return new Map(claims.flatMap((c) => (c.token === undefined ? [] : [[c.id, c.token]])));
+}
+/**
+ * Stamp the computed pins onto the answers they were computed from, and build
+ * the one record-time notice. The notice is verdict-neutral and gates nothing
+ * — verify has never gated — but it fires HERE rather than only at the next
+ * `loam validate` because record time is the anti-fabrication moment: the
+ * agent whose evidence does not spell the claim is still in the loop to
+ * re-read it. The validate-side `evidence.token-missing` finding describes the
+ * same fact later and continuously, in a different repository's run; neither
+ * surface is derivable from the other's.
+ */
+export function pinAnswers(answers, evidence, commit) {
+    const pinned = answers.map((answer) => {
+        const pins = evidence.pins.get(answer.id);
+        return pins === undefined ? answer : { ...answer, evidence_pins: pins };
+    });
+    if (evidence.tokenMisses.length === 0)
+        return { answers: pinned, notice: null };
+    const cited = evidence.tokenMisses.map((m) => `${m.id} ${m.evidence} (token '${m.token}')`);
+    return {
+        answers: pinned,
+        notice: {
+            code: "verify.evidence-token-missing",
+            severity: "warn",
+            message: `${plural(evidence.tokenMisses.length, "confirmed citation")} whose file at ${commit.slice(0, 12)} does not contain ` +
+                `the literal string the claim asserts: ${cited.join("; ")}. ` +
+                "Read that evidence before trusting it — a pin records what was cited, not that the claim is true. " +
+                "The answer stands as given; nothing gates on this.",
+            claims: [...new Set(evidence.tokenMisses.map((m) => m.id))],
+        },
+    };
+}
+//# sourceMappingURL=pins.js.map

package/dist/commands/verify/evidence/pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pins.js","sourceRoot":"","sources":["../../../../src/commands/verify/evidence/pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAe,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAc,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAoB,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAqB,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAgBhD,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,MAAwB;IAClD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAeD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,OAAiB,EAAE,QAAsB,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5F,OAAO;QACL,OAAO,EAAE,MAAM;QACf,MAAM,EAAE;YACN,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,MAAM;YAChB,OAAO,EACL,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB;gBACrH,yCAAyC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC7D,oGAAoG;gBACpG,oDAAoD;YACtD,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The record path's half of evidence pins: attaching what the evidence\n * validation computed onto the answers being recorded, and saying — once,\n * while the agent is still in the loop — when a cited blob does not contain\n * the string its claim asserts.\n *\n * It lives in `evidence/` beside the report readers because it is the same\n * subject (what a federated confirmation rests on), and because `record.ts`\n * sits against the line limit: the notice's wording and the attach loop are a\n * seam of their own, not lines seventeen-through-forty of the record flow.\n */\nimport { type Answer } from \"../../../core/verify/answers.js\";\nimport { type Claim } from \"../../../core/verify/checklist.js\";\nimport { type EvidencePin } from \"../../../core/verify/pins/pin.js\";\nimport { type VerifyNotice } from \"../../../core/verify/record.js\";\nimport { plural } from \"../../policy/format.js\";\n\n/**\n * One citation whose committed blob does not contain the claim's token —\n * collected by `validateServiceEvidence` in the same pass that builds the pin,\n * where the blob is already in hand. The type lives here rather than in\n * `../results.ts` so this package never imports its parent back (the package\n * graph's acyclicity is a checked obligation, not a taste).\n */\nexport interface TokenMiss {\n  id: string;\n  /** The `path:line` citation whose blob was scanned. */\n  evidence: string;\n  token: string;\n}\n\n/** Claim id → the literal the claim asserts, for the kinds that assert one. */\nexport function claimTokens(claims: readonly Claim[]): ReadonlyMap<string, string> {\n  return new Map(claims.flatMap((c) => (c.token === undefined ? [] : [[c.id, c.token] as const])));\n}\n\n/** The validation's pin and token-miss halves together — they come from one pass. */\nexport interface EvidencePins {\n  /** Claim id → one pin per file:line citation, in evidence order. */\n  pins: ReadonlyMap<string, EvidencePin[]>;\n  tokenMisses: TokenMiss[];\n}\n\nexport interface PinnedAnswers {\n  answers: Answer[];\n  /** The record-time token warning, or null when every scanned blob held its token. */\n  notice: VerifyNotice | null;\n}\n\n/**\n * Stamp the computed pins onto the answers they were computed from, and build\n * the one record-time notice. The notice is verdict-neutral and gates nothing\n * — verify has never gated — but it fires HERE rather than only at the next\n * `loam validate` because record time is the anti-fabrication moment: the\n * agent whose evidence does not spell the claim is still in the loop to\n * re-read it. The validate-side `evidence.token-missing` finding describes the\n * same fact later and continuously, in a different repository's run; neither\n * surface is derivable from the other's.\n */\nexport function pinAnswers(answers: Answer[], evidence: EvidencePins, commit: string): PinnedAnswers {\n  const pinned = answers.map((answer) => {\n    const pins = evidence.pins.get(answer.id);\n    return pins === undefined ? answer : { ...answer, evidence_pins: pins };\n  });\n  if (evidence.tokenMisses.length === 0) return { answers: pinned, notice: null };\n  const cited = evidence.tokenMisses.map((m) => `${m.id} ${m.evidence} (token '${m.token}')`);\n  return {\n    answers: pinned,\n    notice: {\n      code: \"verify.evidence-token-missing\",\n      severity: \"warn\",\n      message:\n        `${plural(evidence.tokenMisses.length, \"confirmed citation\")} whose file at ${commit.slice(0, 12)} does not contain ` +\n        `the literal string the claim asserts: ${cited.join(\"; \")}. ` +\n        \"Read that evidence before trusting it — a pin records what was cited, not that the claim is true. \" +\n        \"The answer stands as given; nothing gates on this.\",\n      claims: [...new Set(evidence.tokenMisses.map((m) => m.id))],\n    },\n  };\n}\n"]}

package/dist/commands/verify/evidence/read.js

@@ -0,0 +1,72 @@
+/**
+ * A report file as an artifact: resolved, read, digested, parsed — the
+ * plumbing `--results` and `--contract-results` share, extracted from
+ * `../results.ts` when the contract path became its second consumer. One
+ * spelling on purpose: the two flags must agree byte-for-byte about what "the
+ * file loam read" means, because both pins end up on the same record making
+ * the same promise.
+ *
+ * `repoDir` is set in federated mode, and there the report must be a file
+ * INSIDE the repository being attested, resolved by the same rules as evidence
+ * (`portablePathOf` then `resolveInside`): an attestation says "at this
+ * commit, in this repository", and a report living somewhere else answers for
+ * a run nobody standing here can find. The legacy all-at-once form binds to no
+ * repository at all, so it takes the path as spelled — its looser contract,
+ * unchanged.
+ *
+ * Every refusal is `answers-unreadable` with the failing fact named — a path
+ * that is a directory arrives here as the read's own EISDIR, a file that is
+ * not UTF-8 is refused by name rather than parsed through U+FFFD substitution
+ * (JSON.parse's "unexpected token" over bytes nobody wrote is a message that
+ * sends the caller hunting a typo that is not there), and broken JSON carries
+ * the parser's message. Never `internal`: the file is the caller's, so the
+ * refusal must name the file.
+ */
+import { isUtf8 } from "node:buffer";
+import { createHash } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
+import { resolve } from "node:path";
+import { resolvePortableFileInside } from "../../../core/kernel/path-safety.js";
+export async function readReportArtifact(spelled, repoDir, label) {
+    const refuse = (message) => ({ ok: false, code: "answers-unreadable", message });
+    let path;
+    if (repoDir === undefined) {
+        path = resolve(process.cwd(), spelled);
+    }
+    else {
+        try {
+            path = resolvePortableFileInside(repoDir, spelled, label);
+        }
+        catch (err) {
+            return refuse(`Cannot answer from ${spelled}: ${err instanceof Error ? err.message : String(err)}. ` +
+                "A federated attestation rests on a report inside the repository it attests — give the path relative to the repo root.");
+        }
+    }
+    let bytes;
+    let mtime;
+    try {
+        bytes = await readFile(path);
+        mtime = (await stat(path)).mtime;
+    }
+    catch (err) {
+        return refuse(`Cannot read ${spelled} as a ${label}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!isUtf8(bytes)) {
+        return refuse(`Cannot read ${spelled} as a ${label}: the file is not valid UTF-8`);
+    }
+    let doc;
+    try {
+        doc = JSON.parse(bytes.toString("utf8"));
+    }
+    catch (err) {
+        return refuse(`Cannot read ${spelled} as a ${label}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return {
+        ok: true,
+        spelled,
+        digest: createHash("sha256").update(bytes).digest("hex"),
+        mtime: mtime.toISOString(),
+        doc,
+    };
+}
+//# sourceMappingURL=read.js.map

package/dist/commands/verify/evidence/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../../../src/commands/verify/evidence/read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAgBhF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,OAA2B,EAC3B,KAAa;IAEb,MAAM,MAAM,GAAG,CAAC,OAAe,EAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7G,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,MAAM,CACX,sBAAsB,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;gBACpF,uHAAuH,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAa,CAAC;IAClB,IAAI,KAAW,CAAC;IAChB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,eAAe,OAAO,SAAS,KAAK,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,eAAe,OAAO,SAAS,KAAK,+BAA+B,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,eAAe,OAAO,SAAS,KAAK,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACxD,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,GAAG;KACJ,CAAC;AACJ,CAAC","sourcesContent":["/**\n * A report file as an artifact: resolved, read, digested, parsed — the\n * plumbing `--results` and `--contract-results` share, extracted from\n * `../results.ts` when the contract path became its second consumer. One\n * spelling on purpose: the two flags must agree byte-for-byte about what \"the\n * file loam read\" means, because both pins end up on the same record making\n * the same promise.\n *\n * `repoDir` is set in federated mode, and there the report must be a file\n * INSIDE the repository being attested, resolved by the same rules as evidence\n * (`portablePathOf` then `resolveInside`): an attestation says \"at this\n * commit, in this repository\", and a report living somewhere else answers for\n * a run nobody standing here can find. The legacy all-at-once form binds to no\n * repository at all, so it takes the path as spelled — its looser contract,\n * unchanged.\n *\n * Every refusal is `answers-unreadable` with the failing fact named — a path\n * that is a directory arrives here as the read's own EISDIR, a file that is\n * not UTF-8 is refused by name rather than parsed through U+FFFD substitution\n * (JSON.parse's \"unexpected token\" over bytes nobody wrote is a message that\n * sends the caller hunting a typo that is not there), and broken JSON carries\n * the parser's message. Never `internal`: the file is the caller's, so the\n * refusal must name the file.\n */\nimport { isUtf8 } from \"node:buffer\";\nimport { createHash } from \"node:crypto\";\nimport { readFile, stat } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { resolvePortableFileInside } from \"../../../core/kernel/path-safety.js\";\n\nexport type ReportArtifactRead =\n  | {\n      ok: true;\n      /** The path as the caller spelled it — what goes on the record. */\n      spelled: string;\n      /** Full sha256 of the exact bytes read. */\n      digest: string;\n      /** ISO-8601 mtime of the report file. */\n      mtime: string;\n      /** The parsed JSON document, for the format reader to grade. */\n      doc: unknown;\n    }\n  | { ok: false; code: \"answers-unreadable\"; message: string };\n\nexport async function readReportArtifact(\n  spelled: string,\n  repoDir: string | undefined,\n  label: string,\n): Promise<ReportArtifactRead> {\n  const refuse = (message: string): ReportArtifactRead => ({ ok: false, code: \"answers-unreadable\", message });\n  let path: string;\n  if (repoDir === undefined) {\n    path = resolve(process.cwd(), spelled);\n  } else {\n    try {\n      path = resolvePortableFileInside(repoDir, spelled, label);\n    } catch (err) {\n      return refuse(\n        `Cannot answer from ${spelled}: ${err instanceof Error ? err.message : String(err)}. ` +\n          \"A federated attestation rests on a report inside the repository it attests — give the path relative to the repo root.\",\n      );\n    }\n  }\n\n  let bytes: Buffer;\n  let mtime: Date;\n  try {\n    bytes = await readFile(path);\n    mtime = (await stat(path)).mtime;\n  } catch (err) {\n    return refuse(`Cannot read ${spelled} as a ${label}: ${err instanceof Error ? err.message : String(err)}`);\n  }\n  if (!isUtf8(bytes)) {\n    return refuse(`Cannot read ${spelled} as a ${label}: the file is not valid UTF-8`);\n  }\n  let doc: unknown;\n  try {\n    doc = JSON.parse(bytes.toString(\"utf8\"));\n  } catch (err) {\n    return refuse(`Cannot read ${spelled} as a ${label}: ${err instanceof Error ? err.message : String(err)}`);\n  }\n  return {\n    ok: true,\n    spelled,\n    digest: createHash(\"sha256\").update(bytes).digest(\"hex\"),\n    mtime: mtime.toISOString(),\n    doc,\n  };\n}\n"]}

package/dist/commands/verify/frozen.js

@@ -0,0 +1,241 @@
+/**
+ * An archived feature's record, read back and never recomputed.
+ *
+ * A frozen record is history: the checklist it answered no longer exists in
+ * `features/`, so there is nothing to re-derive it from and re-deriving it would
+ * be an opinion about a feature nobody can change. Everything here reads the
+ * recorded claims, which is also why the shared marks (`answeredMark`), the
+ * contested-claim notices and the report-pin lines live beside it: the read
+ * and record views print the same facts about the same claims, in one voice.
+ */
+import { emitJson, repoPath } from "../../core/envelope/json.js";
+import { contestedDigests } from "../../core/results.js";
+import {} from "../../core/verify/checklist.js";
+import { contestedOperations } from "../../core/verify/evidence/contract.js";
+import { attestedNotice, openClaimsNotice, tallyRecord, verificationPath, verificationVerdict, } from "../../core/verify/record.js";
+import { plural } from "../policy/format.js";
+import {} from "./report.js";
+export function reportFrozen(target, featureId, v) {
+    const { docsDir, featureDir, json } = target;
+    const tally = v === null ? null : tallyRecord(v);
+    const verdict = tally === null ? "unverified" : verificationVerdict(tally);
+    // The open-claims line rides into the frozen view too: a feature archived on
+    // a partial record must keep saying so after it ships, not only before. No
+    // record stays bare — the prose already says nothing was recorded.
+    const open = tally === null ? null : openClaimsNotice(tally, featureId);
+    const notices = [...(v === null ? [] : noticesFor(v.claims, featureId)), ...(open === null ? [] : [open])];
+    if (json) {
+        emitJson({
+            command: "verify",
+            feature: featureId,
+            path: repoPath(docsDir, featureDir),
+            frozen: true,
+            verified: verdict === "verified",
+            verdict,
+            attested: tally?.attested ?? 0,
+            summary: v === null ? null : v.summary,
+            recorded: v === null
+                ? null
+                : {
+                    path: repoPath(docsDir, verificationPath(featureDir)),
+                    recorded: v.recorded,
+                    checklist: v.checklist,
+                    ...(v.attestations === undefined ? {} : { attestations: v.attestations }),
+                    ...(v.report === undefined ? {} : { report: v.report }),
+                    ...(v.contractReport === undefined ? {} : { contractReport: v.contractReport }),
+                },
+            claims: v === null ? [] : v.claims,
+            ...(notices.length === 0 ? {} : { notices }),
+        });
+        return;
+    }
+    if (v === null) {
+        console.log(`${featureId} is archived and has no verification record — nothing was recorded before it shipped.`);
+        return;
+    }
+    console.log(`${featureId} — verification recorded ${v.recorded}, frozen at archive (${repoPath(docsDir, featureDir)})\n`);
+    for (const c of v.claims) {
+        // `subject` is absent in records written before schema 2 — an old record
+        // must read as itself, not gain a service it never named.
+        const subject = c.subject === undefined ? "" : `  [${c.subject}]`;
+        console.log(`  ${MARK[c.verdict]} ${c.id}${subject}  ${c.claim}${answeredMark(c)}`);
+        for (const e of c.evidence)
+            console.log(`      ${e}`);
+        if (c.note !== undefined)
+            console.log(`      note: ${c.note}`);
+    }
+    const counts = tallyRecord(v);
+    console.log(`\n  Recorded ${v.recorded} — ${counts.confirmed} confirmed, ${counts.unconfirmed} unconfirmed.`);
+    console.log("  This checklist is frozen at record time: the feature is archived and its claims are not re-derived.");
+    for (const attestation of v.attestations ?? []) {
+        console.log(`  Attested by ${attestation.service} at ${attestation.commit.slice(0, 12)} (${attestation.recorded}).`);
+        if (attestation.report !== undefined)
+            console.log(`      from ${reportLine(attestation.report)}`);
+        if (attestation.contractReport !== undefined) {
+            console.log(`      from ${contractReportLine(attestation.contractReport)}`);
+        }
+    }
+    if (v.report !== undefined)
+        console.log(`  Answered from ${reportLine(v.report)}.`);
+    if (v.contractReport !== undefined)
+        console.log(`  Contract report read: ${contractReportLine(v.contractReport)}.`);
+    for (const notice of notices)
+        console.log(`  ⚠ ${notice.code}: ${notice.message}`);
+}
+export const MARK = { confirmed: "✓", unconfirmed: "✗", unanswered: "?" };
+/**
+ * Who answered, where that changes what the verdict means. `[runner]` is a
+ * digest-matched green run; `[contract]` is an operationId-matched green
+ * contract-test run — mechanical too, and marked so the record's provenance is
+ * readable per line, not only in `contractReport:`; `[attested]` is a scenario
+ * claim confirmed on somebody's word — the same ✓, a weaker fact, and it must
+ * be visible on the line itself and not only in the summary. The attested test
+ * runs FIRST and uses `attestedClaims`' own predicate (a confirmed scenario
+ * claim not answered by the runner), so the mark can never disagree with the
+ * tally: a scenario claim carrying `answered_by: external-runner` — a hand
+ * edit, or a future loam; the reader accepts any string on purpose — COUNTS as
+ * attested, and printing `[contract]` two lines above a notice saying "an
+ * agent's word" would be the mark calling the tally a liar. Everything else is
+ * unmarked: an agent's answer about a service existing or an operation being
+ * exposed is exactly what the checklist asks for.
+ */
+export function answeredMark(c) {
+    if (c.answered_by === "runner")
+        return "  [runner]";
+    if (c.kind === "scenario.tested") {
+        return c.verdict === "confirmed" ? "  [attested]" : "";
+    }
+    return c.answered_by === "external-runner" ? "  [contract]" : "";
+}
+/** Everything a verify surface has to say about a set of answers beyond the counts. */
+export function noticesFor(claims, feature) {
+    const attested = attestedNotice(claims, feature);
+    return attested === null ? [] : [attested];
+}
+/**
+ * `verify.checklist-forked` — two services answered DIFFERENT versions of this
+ * feature{@link ServiceAttestation}'s question set.
+ *
+ * The record carries one top-level `checklist` digest, so before attestations
+ * carried their own the file could not represent this at all: a service that
+ * attested last week against a delta since rewritten wrote the same digest as
+ * one that attested this morning, and the record-level staleness check flagged
+ * both or neither. It could never say WHICH answers went stale, which is the
+ * only question a reader has.
+ *
+ * A warn, and only ever a warn: a fork is normal mid-rollout — services attest
+ * as they finish, and a feature legitimately changes between the first and the
+ * last. What it must not do is stay invisible. Attestations with no `checklist`
+ * field are excluded rather than counted as a third version: they make no claim
+ * about what they answered, and reading silence as disagreement would fire this
+ * on every record written before the field existed.
+ */
+export function forkedChecklistNotices(recorded, current) {
+    const stated = (recorded?.attestations ?? []).filter((a) => a.checklist !== undefined);
+    // Measured against the CURRENT checklist, not pairwise between attestations.
+    // The pairwise reading answers the wrong question: three services that all
+    // attested against a since-rewritten delta agree with each other perfectly
+    // and are all stale, which pairwise calls clean. What a reader needs is
+    // WHICH services answered something other than what is being asked now.
+    const behind = stated.filter((a) => a.checklist !== current);
+    if (behind.length === 0)
+        return [];
+    const byVersion = [...new Set(behind.map((a) => a.checklist))]
+        .sort()
+        .map((v) => `${v} (${behind.filter((a) => a.checklist === v).map((a) => a.service).sort().join(", ")})`);
+    return [
+        {
+            code: "verify.checklist-forked",
+            severity: "warn",
+            message: `${plural(behind.length, "service")} answered a different version of this feature's question set ` +
+                `than the one it now asks (${current}): ${byVersion.join("; ")}. ` +
+                "The feature changed after they recorded, so their answers are not about the questions being asked now. " +
+                "Re-record them from their own repositories (`loam verify <FEAT> --service <id> --record`), " +
+                "or accept the split knowingly — nothing gates on it.",
+        },
+    ];
+}
+/**
+ * The claims one report could not attribute: a scenario digest — and therefore
+ * an `@loam-digest-…` tag — that more than one service claims.
+ *
+ * This is now a GUARD rather than a diagnosis of ordinary authoring. Until the
+ * digest was salted by service, two services wording a scenario identically
+ * really did share one tag, and this is what stopped one repository's green run
+ * from confirming the other's claim. `scenarioBodyHash` folds the owning
+ * service into the hash, so a claim's digest is computed from the same service
+ * the claim is filed under and two subjects cannot share one short of a
+ * truncated-sha256 collision. It stays because the invariant is worth asserting
+ * where it is relied on: if this ever fires, a digest is answering for two
+ * services and no report can say which, so nothing here may confirm.
+ *
+ * Derived from claims rather than from a report, so the read view raises it too
+ * — the collision exists the moment the checklist does, and learning about it
+ * from a `--results` run that already happened is learning too late.
+ */
+export function contestedNotices(claims) {
+    const contested = contestedDigests(claims);
+    if (contested.size === 0)
+        return [];
+    const shared = [...contested].map(([digest, services]) => `${digest} (${services.join(", ")})`);
+    return [
+        {
+            code: "verify.digest-contested",
+            severity: "warn",
+            message: `${plural(contested.size, "scenario digest")} claimed by more than one service: ${shared.join("; ")}. ` +
+                "The digest is salted by service, so this is a hash collision, not shared wording — but one report still " +
+                "cannot say whose suite ran them, so a shared --results run leaves them unconfirmed. " +
+                "Record each service's claims from its own repository with --service.",
+            claims: claims.filter((c) => c.digest !== undefined && contested.has(c.digest)).map((c) => c.id),
+        },
+    ];
+}
+/**
+ * The digest-contested rule's twin on the contract axis: operationIds that
+ * more than one service on this checklist exposes, which one report can
+ * therefore never attribute (`contestedOperations`, the module that also
+ * leaves those claims unconfirmed). Raised where the contract report is
+ * consumed, so the record path says WHY the claims came back unconfirmed
+ * instead of leaving two bare ✗ lines to be misread as failures.
+ */
+export function contestedOperationNotices(claims) {
+    const contested = contestedOperations(claims);
+    if (contested.size === 0)
+        return [];
+    const shared = [...contested].map(([operation, services]) => `${operation} (${services.join(", ")})`);
+    return [
+        {
+            code: "verify.operation-contested",
+            severity: "warn",
+            message: `${plural(contested.size, "operationId")} exposed by more than one service on this checklist: ${shared.join("; ")}. ` +
+                "A contract report entry names no service, so a shared --contract-results run cannot say whose suite exercised them and leaves them unconfirmed. " +
+                "Record each service's claims from its own repository with --service.",
+            claims: claims.filter((c) => c.operation !== undefined && contested.has(c.operation)).map((c) => c.id),
+        },
+    ];
+}
+/** The report a `--results` run consumed, as one line a reviewer can check by hand. */
+export function reportLine(r) {
+    return `${r.path} (sha256 ${r.digest.slice(0, 12)}…, ${plural(r.scenarios, "tagged scenario")}, written ${r.mtime})`;
+}
+/**
+ * The contract report a `--contract-results` run consumed — the same line for
+ * the same promise, counting operations where the cucumber one counts tagged
+ * scenarios. A separate function rather than a parameter on `reportLine`
+ * because the two pins are different shapes, and a merged formatter would need
+ * exactly the switching flag that near-duplicates are kept apart to avoid.
+ */
+export function contractReportLine(r) {
+    return `${r.path} (sha256 ${r.digest.slice(0, 12)}…, ${plural(r.operations, "operation")}, written ${r.mtime})`;
+}
+/* ------------------------------------------------------------------ */
+/* Recording                                                           */
+/* ------------------------------------------------------------------ */
+/**
+ * `repoDir` is the repository an attestation is ABOUT: the commit it names, the
+ * tree its evidence must resolve inside, and where a `--results` report has to
+ * live. It is threaded rather than read here because it comes from
+ * `config.root`, and a `process.cwd()` in this function was the whole bug —
+ * from a subdirectory, "this repo" quietly became that subdirectory.
+ */
+//# sourceMappingURL=frozen.js.map

package/dist/commands/verify/frozen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frozen.js","sourceRoot":"","sources":["../../../src/commands/verify/frozen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAc,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EAMX,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAqB,MAAM,aAAa,CAAC;AAEhD,MAAM,UAAU,YAAY,CAC1B,MAAoB,EACpB,SAAiB,EACjB,CAAsB;IAEtB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3G,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;YACnC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,OAAO,KAAK,UAAU;YAChC,OAAO;YACP,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC;YAC9B,OAAO,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;YACtC,QAAQ,EACN,CAAC,KAAK,IAAI;gBACR,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBACrD,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;oBACzE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;oBACvD,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;iBAChF;YACP,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;YAClC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,uFAAuF,CACpG,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,4BAA4B,CAAC,CAAC,QAAQ,wBAAwB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAC7G,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,GAAG,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,SAAS,eAAe,MAAM,CAAC,WAAW,eAAe,CAAC,CAAC;IAC9G,OAAO,CAAC,GAAG,CACT,uGAAuG,CACxG,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,CAAC,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,iBAAiB,WAAW,CAAC,OAAO,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,WAAW,CAAC,QAAQ,IAAI,CACxG,CAAC;QACF,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,WAAW,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,kBAAkB,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpH,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAA2B,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAElG;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,CAAgB;IAC3C,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IACpD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACjC,OAAO,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,MAAgC,EAAE,OAAe;IAC1E,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAA6B,EAC7B,OAAe;IAEf,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACvF,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAU,CAAC,CAAC,CAAC;SAC5D,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,MAAM;YAChB,OAAO,EACL,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,+DAA+D;gBAClG,6BAA6B,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAClE,yGAAyG;gBACzG,6FAA6F;gBAC7F,sDAAsD;SACzD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,MAAM;YAChB,OAAO,EACL,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACvG,0GAA0G;gBAC1G,sFAAsF;gBACtF,sEAAsE;YACxE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjG;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtG,OAAO;QACL;YACE,IAAI,EAAE,4BAA4B;YAClC,QAAQ,EAAE,MAAM;YAChB,OAAO,EACL,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,wDAAwD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrH,kJAAkJ;gBAClJ,sEAAsE;YACxE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvG;KACF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,CAAiB;IAC1C,OAAO,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,iBAAiB,CAAC,aAAa,CAAC,CAAC,KAAK,GAAG,CAAC;AACvH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAyB;IAC1D,OAAO,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,KAAK,GAAG,CAAC;AAClH,CAAC;AAGD,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;GAMG","sourcesContent":["/**\n * An archived feature's record, read back and never recomputed.\n *\n * A frozen record is history: the checklist it answered no longer exists in\n * `features/`, so there is nothing to re-derive it from and re-deriving it would\n * be an opinion about a feature nobody can change. Everything here reads the\n * recorded claims, which is also why the shared marks (`answeredMark`), the\n * contested-claim notices and the report-pin lines live beside it: the read\n * and record views print the same facts about the same claims, in one voice.\n */\nimport { emitJson, repoPath } from \"../../core/envelope/json.js\";\nimport { contestedDigests } from \"../../core/results.js\";\nimport { type Claim } from \"../../core/verify/checklist.js\";\nimport { contestedOperations } from \"../../core/verify/evidence/contract.js\";\nimport {\n  attestedNotice,\n  openClaimsNotice,\n  tallyRecord,\n  type AnsweredClaim,\n  type ConsumedContractReport,\n  type ConsumedReport,\n  type Verification,\n  type VerifyNotice,\n  verificationPath,\n  verificationVerdict,\n} from \"../../core/verify/record.js\";\nimport { plural } from \"../policy/format.js\";\nimport { type VerifyTarget } from \"./report.js\";\n\nexport function reportFrozen(\n  target: VerifyTarget,\n  featureId: string,\n  v: Verification | null,\n): void {\n  const { docsDir, featureDir, json } = target;\n  const tally = v === null ? null : tallyRecord(v);\n  const verdict = tally === null ? \"unverified\" : verificationVerdict(tally);\n  // The open-claims line rides into the frozen view too: a feature archived on\n  // a partial record must keep saying so after it ships, not only before. No\n  // record stays bare — the prose already says nothing was recorded.\n  const open = tally === null ? null : openClaimsNotice(tally, featureId);\n  const notices = [...(v === null ? [] : noticesFor(v.claims, featureId)), ...(open === null ? [] : [open])];\n\n  if (json) {\n    emitJson({\n      command: \"verify\",\n      feature: featureId,\n      path: repoPath(docsDir, featureDir),\n      frozen: true,\n      verified: verdict === \"verified\",\n      verdict,\n      attested: tally?.attested ?? 0,\n      summary: v === null ? null : v.summary,\n      recorded:\n        v === null\n          ? null\n          : {\n              path: repoPath(docsDir, verificationPath(featureDir)),\n              recorded: v.recorded,\n              checklist: v.checklist,\n              ...(v.attestations === undefined ? {} : { attestations: v.attestations }),\n              ...(v.report === undefined ? {} : { report: v.report }),\n              ...(v.contractReport === undefined ? {} : { contractReport: v.contractReport }),\n            },\n      claims: v === null ? [] : v.claims,\n      ...(notices.length === 0 ? {} : { notices }),\n    });\n    return;\n  }\n\n  if (v === null) {\n    console.log(\n      `${featureId} is archived and has no verification record — nothing was recorded before it shipped.`,\n    );\n    return;\n  }\n\n  console.log(\n    `${featureId} — verification recorded ${v.recorded}, frozen at archive (${repoPath(docsDir, featureDir)})\\n`,\n  );\n  for (const c of v.claims) {\n    // `subject` is absent in records written before schema 2 — an old record\n    // must read as itself, not gain a service it never named.\n    const subject = c.subject === undefined ? \"\" : `  [${c.subject}]`;\n    console.log(`  ${MARK[c.verdict]} ${c.id}${subject}  ${c.claim}${answeredMark(c)}`);\n    for (const e of c.evidence) console.log(`      ${e}`);\n    if (c.note !== undefined) console.log(`      note: ${c.note}`);\n  }\n  const counts = tallyRecord(v);\n  console.log(`\\n  Recorded ${v.recorded} — ${counts.confirmed} confirmed, ${counts.unconfirmed} unconfirmed.`);\n  console.log(\n    \"  This checklist is frozen at record time: the feature is archived and its claims are not re-derived.\",\n  );\n  for (const attestation of v.attestations ?? []) {\n    console.log(\n      `  Attested by ${attestation.service} at ${attestation.commit.slice(0, 12)} (${attestation.recorded}).`,\n    );\n    if (attestation.report !== undefined) console.log(`      from ${reportLine(attestation.report)}`);\n    if (attestation.contractReport !== undefined) {\n      console.log(`      from ${contractReportLine(attestation.contractReport)}`);\n    }\n  }\n  if (v.report !== undefined) console.log(`  Answered from ${reportLine(v.report)}.`);\n  if (v.contractReport !== undefined) console.log(`  Contract report read: ${contractReportLine(v.contractReport)}.`);\n  for (const notice of notices) console.log(`  ⚠ ${notice.code}: ${notice.message}`);\n}\n\nexport const MARK: Record<string, string> = { confirmed: \"✓\", unconfirmed: \"✗\", unanswered: \"?\" };\n\n/**\n * Who answered, where that changes what the verdict means. `[runner]` is a\n * digest-matched green run; `[contract]` is an operationId-matched green\n * contract-test run — mechanical too, and marked so the record's provenance is\n * readable per line, not only in `contractReport:`; `[attested]` is a scenario\n * claim confirmed on somebody's word — the same ✓, a weaker fact, and it must\n * be visible on the line itself and not only in the summary. The attested test\n * runs FIRST and uses `attestedClaims`' own predicate (a confirmed scenario\n * claim not answered by the runner), so the mark can never disagree with the\n * tally: a scenario claim carrying `answered_by: external-runner` — a hand\n * edit, or a future loam; the reader accepts any string on purpose — COUNTS as\n * attested, and printing `[contract]` two lines above a notice saying \"an\n * agent's word\" would be the mark calling the tally a liar. Everything else is\n * unmarked: an agent's answer about a service existing or an operation being\n * exposed is exactly what the checklist asks for.\n */\nexport function answeredMark(c: AnsweredClaim): string {\n  if (c.answered_by === \"runner\") return \"  [runner]\";\n  if (c.kind === \"scenario.tested\") {\n    return c.verdict === \"confirmed\" ? \"  [attested]\" : \"\";\n  }\n  return c.answered_by === \"external-runner\" ? \"  [contract]\" : \"\";\n}\n\n/** Everything a verify surface has to say about a set of answers beyond the counts. */\nexport function noticesFor(claims: readonly AnsweredClaim[], feature: string): VerifyNotice[] {\n  const attested = attestedNotice(claims, feature);\n  return attested === null ? [] : [attested];\n}\n\n/**\n * `verify.checklist-forked` — two services answered DIFFERENT versions of this\n * feature{@link ServiceAttestation}'s question set.\n *\n * The record carries one top-level `checklist` digest, so before attestations\n * carried their own the file could not represent this at all: a service that\n * attested last week against a delta since rewritten wrote the same digest as\n * one that attested this morning, and the record-level staleness check flagged\n * both or neither. It could never say WHICH answers went stale, which is the\n * only question a reader has.\n *\n * A warn, and only ever a warn: a fork is normal mid-rollout — services attest\n * as they finish, and a feature legitimately changes between the first and the\n * last. What it must not do is stay invisible. Attestations with no `checklist`\n * field are excluded rather than counted as a third version: they make no claim\n * about what they answered, and reading silence as disagreement would fire this\n * on every record written before the field existed.\n */\nexport function forkedChecklistNotices(\n  recorded: Verification | null,\n  current: string,\n): VerifyNotice[] {\n  const stated = (recorded?.attestations ?? []).filter((a) => a.checklist !== undefined);\n  // Measured against the CURRENT checklist, not pairwise between attestations.\n  // The pairwise reading answers the wrong question: three services that all\n  // attested against a since-rewritten delta agree with each other perfectly\n  // and are all stale, which pairwise calls clean. What a reader needs is\n  // WHICH services answered something other than what is being asked now.\n  const behind = stated.filter((a) => a.checklist !== current);\n  if (behind.length === 0) return [];\n  const byVersion = [...new Set(behind.map((a) => a.checklist!))]\n    .sort()\n    .map((v) => `${v} (${behind.filter((a) => a.checklist === v).map((a) => a.service).sort().join(\", \")})`);\n  return [\n    {\n      code: \"verify.checklist-forked\",\n      severity: \"warn\",\n      message:\n        `${plural(behind.length, \"service\")} answered a different version of this feature's question set ` +\n        `than the one it now asks (${current}): ${byVersion.join(\"; \")}. ` +\n        \"The feature changed after they recorded, so their answers are not about the questions being asked now. \" +\n        \"Re-record them from their own repositories (`loam verify <FEAT> --service <id> --record`), \" +\n        \"or accept the split knowingly — nothing gates on it.\",\n    },\n  ];\n}\n\n/**\n * The claims one report could not attribute: a scenario digest — and therefore\n * an `@loam-digest-…` tag — that more than one service claims.\n *\n * This is now a GUARD rather than a diagnosis of ordinary authoring. Until the\n * digest was salted by service, two services wording a scenario identically\n * really did share one tag, and this is what stopped one repository's green run\n * from confirming the other's claim. `scenarioBodyHash` folds the owning\n * service into the hash, so a claim's digest is computed from the same service\n * the claim is filed under and two subjects cannot share one short of a\n * truncated-sha256 collision. It stays because the invariant is worth asserting\n * where it is relied on: if this ever fires, a digest is answering for two\n * services and no report can say which, so nothing here may confirm.\n *\n * Derived from claims rather than from a report, so the read view raises it too\n * — the collision exists the moment the checklist does, and learning about it\n * from a `--results` run that already happened is learning too late.\n */\nexport function contestedNotices(claims: readonly Claim[]): VerifyNotice[] {\n  const contested = contestedDigests(claims);\n  if (contested.size === 0) return [];\n  const shared = [...contested].map(([digest, services]) => `${digest} (${services.join(\", \")})`);\n  return [\n    {\n      code: \"verify.digest-contested\",\n      severity: \"warn\",\n      message:\n        `${plural(contested.size, \"scenario digest\")} claimed by more than one service: ${shared.join(\"; \")}. ` +\n        \"The digest is salted by service, so this is a hash collision, not shared wording — but one report still \" +\n        \"cannot say whose suite ran them, so a shared --results run leaves them unconfirmed. \" +\n        \"Record each service's claims from its own repository with --service.\",\n      claims: claims.filter((c) => c.digest !== undefined && contested.has(c.digest)).map((c) => c.id),\n    },\n  ];\n}\n\n/**\n * The digest-contested rule's twin on the contract axis: operationIds that\n * more than one service on this checklist exposes, which one report can\n * therefore never attribute (`contestedOperations`, the module that also\n * leaves those claims unconfirmed). Raised where the contract report is\n * consumed, so the record path says WHY the claims came back unconfirmed\n * instead of leaving two bare ✗ lines to be misread as failures.\n */\nexport function contestedOperationNotices(claims: readonly Claim[]): VerifyNotice[] {\n  const contested = contestedOperations(claims);\n  if (contested.size === 0) return [];\n  const shared = [...contested].map(([operation, services]) => `${operation} (${services.join(\", \")})`);\n  return [\n    {\n      code: \"verify.operation-contested\",\n      severity: \"warn\",\n      message:\n        `${plural(contested.size, \"operationId\")} exposed by more than one service on this checklist: ${shared.join(\"; \")}. ` +\n        \"A contract report entry names no service, so a shared --contract-results run cannot say whose suite exercised them and leaves them unconfirmed. \" +\n        \"Record each service's claims from its own repository with --service.\",\n      claims: claims.filter((c) => c.operation !== undefined && contested.has(c.operation)).map((c) => c.id),\n    },\n  ];\n}\n\n/** The report a `--results` run consumed, as one line a reviewer can check by hand. */\nexport function reportLine(r: ConsumedReport): string {\n  return `${r.path} (sha256 ${r.digest.slice(0, 12)}…, ${plural(r.scenarios, \"tagged scenario\")}, written ${r.mtime})`;\n}\n\n/**\n * The contract report a `--contract-results` run consumed — the same line for\n * the same promise, counting operations where the cucumber one counts tagged\n * scenarios. A separate function rather than a parameter on `reportLine`\n * because the two pins are different shapes, and a merged formatter would need\n * exactly the switching flag that near-duplicates are kept apart to avoid.\n */\nexport function contractReportLine(r: ConsumedContractReport): string {\n  return `${r.path} (sha256 ${r.digest.slice(0, 12)}…, ${plural(r.operations, \"operation\")}, written ${r.mtime})`;\n}\n\n\n/* ------------------------------------------------------------------ */\n/* Recording                                                           */\n/* ------------------------------------------------------------------ */\n\n/**\n * `repoDir` is the repository an attestation is ABOUT: the commit it names, the\n * tree its evidence must resolve inside, and where a `--results` report has to\n * live. It is threaded rather than read here because it comes from\n * `config.root`, and a `process.cwd()` in this function was the whole bug —\n * from a subdirectory, \"this repo\" quietly became that subdirectory.\n */\n"]}