@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/core/status/verification.js

@@ -0,0 +1,216 @@
+import { featureChecklist } from "../verify/checklist.js";
+import { answering, readVerificationState } from "../verify/read/file.js";
+import { attestedNotice, confirmedProvenance, tallyRecord, verificationVerdict, } from "../verify/record.js";
+/**
+ * Is the done-check discharged? `verificationVerdict`'s answer and nobody
+ * else's — status re-deriving it would be a fourth place the words "verified"
+ * are defined, and the day one of them changed (a scenario claim on an agent's
+ * word stopped counting) the reader's copy would be the one still saying yes.
+ * `attested` is deliberately NOT `done` here: it is complete work resting on an
+ * assertion, which is what `ready` has always meant — the document is right and
+ * the world has not caught up.
+ */
+export function fullyVerified(v) {
+    return v.verdict === "verified";
+}
+/**
+ * The record's own rung. `stale` and `unreadable` are `draft` because both mean
+ * the file on disk is the thing to fix; unconfirmed claims are `ready` because
+ * the file is fine and the answer lives in the code.
+ *
+ * All four states are spelled, `recorded` included, so the `never` below fails
+ * the build rather than the reader: a fifth record state added to
+ * {@link VerificationState} would otherwise fall through into the last branch
+ * and be graded by `fullyVerified` alone — silently answering `ready` about a
+ * record whose new state nobody here has decided a rung for.
+ */
+export function verificationStatus(v) {
+    if (v.state === "absent")
+        return "missing";
+    if (v.state === "unreadable" || v.state === "stale")
+        return "draft";
+    if (v.state === "recorded")
+        return fullyVerified(v) ? "done" : "ready";
+    const unreachable = v.state;
+    throw new Error(`verificationStatus: no rung for verification state '${String(unreachable)}'`);
+}
+/**
+ * Read the record and, only when there is one, ask whether it still answers
+ * this feature. The checklist is derived on demand and never speculatively: it
+ * loads the delta into a LikeC4 workspace, and paying that in order to print
+ * "no record" is the cost `list` refused for its verification column.
+ *
+ * An archived feature's record is frozen history — archive merged its
+ * operations into the living contract, so a re-derived checklist can only
+ * mismatch, and calling it stale would slander every feature that shipped.
+ * What it CAN be held to is the checklist archive captured as it merged, and
+ * that is `grading.shipped`'s: a record answering an older checklist than the
+ * one the feature shipped with is stale, archived or not — the gap `gate
+ * --since` used to let through, since archiving a feature whose record had
+ * gone stale made it read `verified` again.
+ */
+export async function verificationState(docsDir, feature, grading = {}) {
+    const empty = {
+        recorded: null,
+        verdict: "unverified",
+        claims: 0,
+        confirmed: 0,
+        unconfirmed: 0,
+        unanswered: 0,
+        attested: 0,
+        answered: { runner: 0, "external-runner": 0, agent: 0 },
+    };
+    const read = await readVerificationState(feature.dir);
+    if (read.state === "absent")
+        return { state: { state: "absent", ...empty }, notice: null };
+    // A record whose summary contradicts its own claims is refused by the reader
+    // itself (`verify.record-miscounted`), so this branch reports zeros rather
+    // than salvaging counts from a file nobody can say which half of was edited.
+    // Where there ARE counts they are `tallyRecord`'s, never the summary's — the
+    // block used to be copied out verbatim, and a record `verify --json` calls
+    // unverified read here as "11 of 11 confirmed".
+    if (read.state === "unreadable")
+        return { state: { state: "unreadable", ...empty }, notice: null };
+    // The checklist the record is held to: the one asked now for an in-flight
+    // feature, the one captured at the merge for an archived one when the caller
+    // asks for that, none at all otherwise (frozen history). The files are then
+    // added up AGAINST it — the per-service files that answered it are the ones
+    // that count (`core/verify/read/union.ts`) — without reading them twice.
+    const against = feature.archived
+        ? (grading.shipped ?? null)
+        : (await featureChecklist(docsDir, feature.dir, feature.id, grading.fleet)).digest;
+    const v = against === null ? read.verification : (answering(read.files, against) ?? read.verification);
+    const stale = against !== null && against !== v.checklist;
+    const tally = tallyRecord(v);
+    return {
+        state: {
+            state: stale ? "stale" : "recorded",
+            recorded: v.recorded,
+            verdict: verificationVerdict(tally, stale),
+            claims: tally.claims,
+            confirmed: tally.confirmed,
+            unconfirmed: tally.unconfirmed,
+            unanswered: tally.unanswered,
+            attested: tally.attested,
+            answered: confirmedProvenance(v.claims),
+        },
+        notice: attestedNotice(v.claims, feature.id),
+    };
+}
+export function verifyStep(id, verification, view) {
+    const { artifacts = [], services, boundService } = view;
+    const record = artifacts.find((a) => a.id === "verification");
+    const open = verification.unconfirmed + verification.unanswered;
+    // The code is spelled at each call site as a `code:` property rather than
+    // passed positionally, and the helper takes the whole pair: test/codes-drift.ts
+    // collects the vocabulary by reading the source for that exact shape, so a
+    // factory with a `code` PARAMETER would hide every code it emits from the one
+    // guard that checks they are documented. Same DRY-ness, visible to the guard.
+    const step = (s) => [
+        { ...s, command: `loam verify ${id} --json`, artifact: "verification", path: record.path },
+    ];
+    if (record.status === "blocked") {
+        return step({
+            code: "next.verify",
+            statement: `${id} has nothing to derive a checklist from yet — write the delta and the requirement deltas first.`,
+        });
+    }
+    if (verification.state === "absent") {
+        return step({
+            code: "next.verify",
+            statement: `Nothing has been verified for ${id} — derive the checklist and answer every claim with evidence.`,
+        });
+    }
+    if (verification.state === "unreadable") {
+        return step({
+            code: "next.verify",
+            // Never "or delete it": the record may be the one-file verification.yaml
+            // holding other services' attestations, and the command names the file
+            // that actually failed together with the repair that is safe for it.
+            statement: `${id}'s record at ${record.path} does not read as a record — the command names the file that failed and its safe repair; never delete a file other services' attestations may be in. Nothing will overwrite it while it is unreadable.`,
+        });
+    }
+    if (verification.state === "stale") {
+        return step({
+            code: "next.verify",
+            statement: `${id} moved after ${record.path} was written — the record answers a checklist that is no longer the one being asked.`,
+        });
+    }
+    if (open > 0) {
+        // The recording form only when this repository is one of the services that
+        // owes an answer: `verify --record --service` binds the answers to THIS
+        // repo's HEAD and refuses anywhere else, so handing a docs-repo reader that
+        // command would name a step it cannot take.
+        return boundService !== undefined && services.includes(boundService)
+            ? [
+                {
+                    code: "next.attest-service",
+                    statement: `${open} of ${verification.claims} claim(s) on ${id} are open, and this repository is '${boundService}' — ` +
+                        `answer the ones filed under it, bound to this commit; the rest belong to their own repositories.`,
+                    command: `loam verify ${id} --record answers.json --service ${boundService}`,
+                    artifact: "verification",
+                    service: boundService,
+                    path: record.path,
+                },
+            ]
+            : step({
+                code: "next.verify-unconfirmed",
+                statement: `${open} of ${verification.claims} claim(s) on ${id} are not confirmed — close them from each affected service's own repository.`,
+            });
+    }
+    if (verification.claims === 0) {
+        return step({
+            code: "next.verify",
+            statement: `${record.path} answers no claims at all — nothing was asked, so nothing was checked; re-derive the checklist and see what this feature actually promises.`,
+        });
+    }
+    if (verification.verdict === "attested") {
+        return [
+            {
+                code: "next.verify-attested",
+                statement: `${verification.attested} of ${id}'s scenario claim(s) are confirmed on an agent's word, not on a test run ` +
+                    `(verify.scenario-attested) — answer them from a test report (a cucumber JSON report, or loam's runner-neutral ` +
+                    `loamScenarioReport shape for any other runner), and the record stops resting on an assertion.`,
+                // The runner-neutral placeholder `verify.scenario-attested` itself
+                // suggests: a step that said "cucumber" alone told a fleet whose
+                // runner has no cucumber formatter that it had no route to `verified`.
+                command: `loam verify ${id} --results <report.json>`,
+                artifact: "verification",
+                path: record.path,
+            },
+        ];
+    }
+    return [];
+}
+/**
+ * Where a test comes from. `loam gherkin` writes the .feature files whose green
+ * run is the only thing that may answer a `scenario.tested` claim, and it runs
+ * from the service's own repository — so the step exists wherever there are
+ * scenarios to generate from, and names the repository to run it in when that
+ * is not this one.
+ */
+export function testStep(id, verification, view) {
+    const { services, scans, boundService } = view;
+    if (fullyVerified(verification))
+        return [];
+    const withScenarios = [
+        ...new Set(scans.filter((s) => s.scenarios > 0 && services.includes(s.service)).map((s) => s.service)),
+    ];
+    if (withScenarios.length === 0)
+        return [];
+    const svc = boundService !== undefined && withScenarios.includes(boundService) ? boundService : withScenarios[0];
+    const here = svc === boundService;
+    return [
+        {
+            code: "next.generate-tests",
+            statement: `${id}'s delta for ${svc} carries scenarios that no test run has answered yet — generate the suite, then implement against it` +
+                (here
+                    ? "."
+                    : `. \`loam gherkin\` writes into the service's own repository, so run it from ${svc}'s${withScenarios.length > 1 ? ` (and likewise for ${withScenarios.slice(1).join(", ")})` : ""}.`),
+            command: `loam gherkin ${id} --service ${svc}`,
+            artifact: "spec",
+            service: svc,
+        },
+    ];
+}
+//# sourceMappingURL=verification.js.map

package/dist/core/status/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../../src/core/status/verification.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,WAAW,EAGX,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAK7B;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,CAAoB;IAChD,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC;AAClC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAoB;IACrD,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACpE,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,MAAM,WAAW,GAAU,CAAC,CAAC,KAAK,CAAC;IACnC,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;AACjG,CAAC;AA0BD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,OAAqB,EACrB,OAAO,GAAiB,EAAE;IAE1B,MAAM,KAAK,GAAG;QACZ,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,YAAmC;QAC5C,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC;QACd,UAAU,EAAE,CAAC;QACb,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;KACxD,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3F,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEnG,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ;QAC9B,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACrF,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO;QACL,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YACnC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC;SACxC;QACD,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,YAA+B,EAAE,IAAc;IACpF,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC;IAChE,0EAA0E;IAC1E,gFAAgF;IAChF,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,CAAC,CAAsC,EAAc,EAAE,CAAC;QACnE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;KAC3F,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,GAAG,EAAE,iGAAiG;SAClH,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,iCAAiC,EAAE,+DAA+D;SAC9G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,yEAAyE;YACzE,uEAAuE;YACvE,qEAAqE;YACrE,SAAS,EAAE,GAAG,EAAE,gBAAgB,MAAM,CAAC,IAAI,wMAAwM;SACpP,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,GAAG,EAAE,gBAAgB,MAAM,CAAC,IAAI,sFAAsF;SAClI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,4CAA4C;QAC5C,OAAO,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClE,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,SAAS,EACP,GAAG,IAAI,OAAO,YAAY,CAAC,MAAM,gBAAgB,EAAE,sCAAsC,YAAY,MAAM;wBAC3G,kGAAkG;oBACpG,OAAO,EAAE,eAAe,EAAE,oCAAoC,YAAY,EAAE;oBAC5E,QAAQ,EAAE,cAAc;oBACxB,OAAO,EAAE,YAAY;oBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB;aACF;YACH,CAAC,CAAC,IAAI,CAAC;gBACH,IAAI,EAAE,yBAAyB;gBAC/B,SAAS,EAAE,GAAG,IAAI,OAAO,YAAY,CAAC,MAAM,gBAAgB,EAAE,8EAA8E;aAC7I,CAAC,CAAC;IACT,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,6IAA6I;SACvK,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;YACL;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EACP,GAAG,YAAY,CAAC,QAAQ,OAAO,EAAE,2EAA2E;oBAC5G,gHAAgH;oBAChH,+FAA+F;gBACjG,mEAAmE;gBACnE,iEAAiE;gBACjE,uEAAuE;gBACvE,OAAO,EAAE,eAAe,EAAE,0BAA0B;gBACpD,QAAQ,EAAE,cAAc;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,EAAU,EACV,YAA+B,EAC/B,IAAkF;IAElF,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,aAAa,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG;QACpB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;KACvG,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAE,CAAC;IAClH,MAAM,IAAI,GAAG,GAAG,KAAK,YAAY,CAAC;IAClC,OAAO;QACL;YACE,IAAI,EAAE,qBAAqB;YAC3B,SAAS,EACP,GAAG,EAAE,gBAAgB,GAAG,sGAAsG;gBAC9H,CAAC,IAAI;oBACH,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,+EAA+E,GAAG,KAChF,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAC1F,GAAG,CAAC;YACV,OAAO,EAAE,gBAAgB,EAAE,cAAc,GAAG,EAAE;YAC9C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG;SACb;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The verification record as `status` reads it: the rung the record stands on,\n * the projection of what it says, and the two `next[]` steps that discharge it\n * — where a test comes from, and what `loam verify` still wants answered.\n * Every verdict here is `core/verify/`'s own, re-read; nothing in this module is\n * a second definition of \"verified\".\n */\nimport type { FeatureEntry } from \"../repo/entries.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport { featureChecklist } from \"../verify/checklist.js\";\nimport { answering, readVerificationState } from \"../verify/read/file.js\";\nimport {\n  attestedNotice,\n  confirmedProvenance,\n  tallyRecord,\n  type VerificationVerdict,\n  type VerifyNotice,\n  verificationVerdict,\n} from \"../verify/record.js\";\nimport type { ArtifactState, ArtifactStatus, NextStep, VerificationState } from \"./report.js\";\nimport type { DeltaScan } from \"./scan.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\n\n/**\n * Is the done-check discharged? `verificationVerdict`'s answer and nobody\n * else's — status re-deriving it would be a fourth place the words \"verified\"\n * are defined, and the day one of them changed (a scenario claim on an agent's\n * word stopped counting) the reader's copy would be the one still saying yes.\n * `attested` is deliberately NOT `done` here: it is complete work resting on an\n * assertion, which is what `ready` has always meant — the document is right and\n * the world has not caught up.\n */\nexport function fullyVerified(v: VerificationState): boolean {\n  return v.verdict === \"verified\";\n}\n\n/**\n * The record's own rung. `stale` and `unreadable` are `draft` because both mean\n * the file on disk is the thing to fix; unconfirmed claims are `ready` because\n * the file is fine and the answer lives in the code.\n *\n * All four states are spelled, `recorded` included, so the `never` below fails\n * the build rather than the reader: a fifth record state added to\n * {@link VerificationState} would otherwise fall through into the last branch\n * and be graded by `fullyVerified` alone — silently answering `ready` about a\n * record whose new state nobody here has decided a rung for.\n */\nexport function verificationStatus(v: VerificationState): ArtifactStatus {\n  if (v.state === \"absent\") return \"missing\";\n  if (v.state === \"unreadable\" || v.state === \"stale\") return \"draft\";\n  if (v.state === \"recorded\") return fullyVerified(v) ? \"done\" : \"ready\";\n  const unreachable: never = v.state;\n  throw new Error(`verificationStatus: no rung for verification state '${String(unreachable)}'`);\n}\n\n/**\n * How a caller wants the record graded, beyond reading it.\n */\nexport interface StateGrading {\n  /**\n   * The invocation's read index, when the caller holds one. It reaches the\n   * checklist derivation, whose enumerations and delta parse are memo hits\n   * through it — the difference between one fleet walk per invocation and one\n   * per feature for a caller grading several (`loam gate`'s check 3).\n   */\n  fleet?: FleetContext;\n  /**\n   * For an ARCHIVED feature only: the checklist digest `loam archive` captured\n   * just before its merge (`readSnapshotChecklist`) — the question the feature\n   * asked as it shipped, which a frozen record can still be graded against\n   * without re-deriving anything. Only `loam gate --since` passes it, because\n   * only the deploy question asks whether a record answered the feature that\n   * SHIPPED; every other reader leaves it out and reads the record as frozen\n   * history, as before. Null — an archive that captured none, by an older loam\n   * or over a feature with no record then — is the frozen reading too.\n   */\n  shipped?: string | null;\n}\n\n/**\n * Read the record and, only when there is one, ask whether it still answers\n * this feature. The checklist is derived on demand and never speculatively: it\n * loads the delta into a LikeC4 workspace, and paying that in order to print\n * \"no record\" is the cost `list` refused for its verification column.\n *\n * An archived feature's record is frozen history — archive merged its\n * operations into the living contract, so a re-derived checklist can only\n * mismatch, and calling it stale would slander every feature that shipped.\n * What it CAN be held to is the checklist archive captured as it merged, and\n * that is `grading.shipped`'s: a record answering an older checklist than the\n * one the feature shipped with is stale, archived or not — the gap `gate\n * --since` used to let through, since archiving a feature whose record had\n * gone stale made it read `verified` again.\n */\nexport async function verificationState(\n  docsDir: DocsDir,\n  feature: FeatureEntry,\n  grading: StateGrading = {},\n): Promise<{ state: VerificationState; notice: VerifyNotice | null }> {\n  const empty = {\n    recorded: null,\n    verdict: \"unverified\" as VerificationVerdict,\n    claims: 0,\n    confirmed: 0,\n    unconfirmed: 0,\n    unanswered: 0,\n    attested: 0,\n    answered: { runner: 0, \"external-runner\": 0, agent: 0 },\n  };\n  const read = await readVerificationState(feature.dir);\n  if (read.state === \"absent\") return { state: { state: \"absent\", ...empty }, notice: null };\n  // A record whose summary contradicts its own claims is refused by the reader\n  // itself (`verify.record-miscounted`), so this branch reports zeros rather\n  // than salvaging counts from a file nobody can say which half of was edited.\n  // Where there ARE counts they are `tallyRecord`'s, never the summary's — the\n  // block used to be copied out verbatim, and a record `verify --json` calls\n  // unverified read here as \"11 of 11 confirmed\".\n  if (read.state === \"unreadable\") return { state: { state: \"unreadable\", ...empty }, notice: null };\n\n  // The checklist the record is held to: the one asked now for an in-flight\n  // feature, the one captured at the merge for an archived one when the caller\n  // asks for that, none at all otherwise (frozen history). The files are then\n  // added up AGAINST it — the per-service files that answered it are the ones\n  // that count (`core/verify/read/union.ts`) — without reading them twice.\n  const against = feature.archived\n    ? (grading.shipped ?? null)\n    : (await featureChecklist(docsDir, feature.dir, feature.id, grading.fleet)).digest;\n  const v = against === null ? read.verification : (answering(read.files, against) ?? read.verification);\n  const stale = against !== null && against !== v.checklist;\n  const tally = tallyRecord(v);\n  return {\n    state: {\n      state: stale ? \"stale\" : \"recorded\",\n      recorded: v.recorded,\n      verdict: verificationVerdict(tally, stale),\n      claims: tally.claims,\n      confirmed: tally.confirmed,\n      unconfirmed: tally.unconfirmed,\n      unanswered: tally.unanswered,\n      attested: tally.attested,\n      answered: confirmedProvenance(v.claims),\n    },\n    notice: attestedNotice(v.claims, feature.id),\n  };\n}\n\n/**\n * The done-check step, or none. Four different situations reach `loam verify`\n * and they are not the same work — nothing recorded, a file that will not read,\n * a record the feature has moved out from under, and claims still open — so the\n * statement says which. The code splits only where the WORK splits: starting a\n * verification and finishing one are different jobs, and an agent that treats a\n * stale record as a finished one ships a feature nobody checked.\n */\n/** The narrowed view a step is written for: what to name, and to whom. */\nexport interface StepView {\n  artifacts?: ArtifactState[];\n  services: string[];\n  /** The service this repository is bound to, when a command is standing in one. */\n  boundService: string | undefined;\n}\n\nexport function verifyStep(id: string, verification: VerificationState, view: StepView): NextStep[] {\n  const { artifacts = [], services, boundService } = view;\n  const record = artifacts.find((a) => a.id === \"verification\")!;\n  const open = verification.unconfirmed + verification.unanswered;\n  // The code is spelled at each call site as a `code:` property rather than\n  // passed positionally, and the helper takes the whole pair: test/codes-drift.ts\n  // collects the vocabulary by reading the source for that exact shape, so a\n  // factory with a `code` PARAMETER would hide every code it emits from the one\n  // guard that checks they are documented. Same DRY-ness, visible to the guard.\n  const step = (s: { code: string; statement: string }): NextStep[] => [\n    { ...s, command: `loam verify ${id} --json`, artifact: \"verification\", path: record.path },\n  ];\n\n  if (record.status === \"blocked\") {\n    return step({\n      code: \"next.verify\",\n      statement: `${id} has nothing to derive a checklist from yet — write the delta and the requirement deltas first.`,\n    });\n  }\n  if (verification.state === \"absent\") {\n    return step({\n      code: \"next.verify\",\n      statement: `Nothing has been verified for ${id} — derive the checklist and answer every claim with evidence.`,\n    });\n  }\n  if (verification.state === \"unreadable\") {\n    return step({\n      code: \"next.verify\",\n      // Never \"or delete it\": the record may be the one-file verification.yaml\n      // holding other services' attestations, and the command names the file\n      // that actually failed together with the repair that is safe for it.\n      statement: `${id}'s record at ${record.path} does not read as a record — the command names the file that failed and its safe repair; never delete a file other services' attestations may be in. Nothing will overwrite it while it is unreadable.`,\n    });\n  }\n  if (verification.state === \"stale\") {\n    return step({\n      code: \"next.verify\",\n      statement: `${id} moved after ${record.path} was written — the record answers a checklist that is no longer the one being asked.`,\n    });\n  }\n  if (open > 0) {\n    // The recording form only when this repository is one of the services that\n    // owes an answer: `verify --record --service` binds the answers to THIS\n    // repo's HEAD and refuses anywhere else, so handing a docs-repo reader that\n    // command would name a step it cannot take.\n    return boundService !== undefined && services.includes(boundService)\n      ? [\n          {\n            code: \"next.attest-service\",\n            statement:\n              `${open} of ${verification.claims} claim(s) on ${id} are open, and this repository is '${boundService}' — ` +\n              `answer the ones filed under it, bound to this commit; the rest belong to their own repositories.`,\n            command: `loam verify ${id} --record answers.json --service ${boundService}`,\n            artifact: \"verification\",\n            service: boundService,\n            path: record.path,\n          },\n        ]\n      : step({\n          code: \"next.verify-unconfirmed\",\n          statement: `${open} of ${verification.claims} claim(s) on ${id} are not confirmed — close them from each affected service's own repository.`,\n        });\n  }\n  if (verification.claims === 0) {\n    return step({\n      code: \"next.verify\",\n      statement: `${record.path} answers no claims at all — nothing was asked, so nothing was checked; re-derive the checklist and see what this feature actually promises.`,\n    });\n  }\n  if (verification.verdict === \"attested\") {\n    return [\n      {\n        code: \"next.verify-attested\",\n        statement:\n          `${verification.attested} of ${id}'s scenario claim(s) are confirmed on an agent's word, not on a test run ` +\n          `(verify.scenario-attested) — answer them from a test report (a cucumber JSON report, or loam's runner-neutral ` +\n          `loamScenarioReport shape for any other runner), and the record stops resting on an assertion.`,\n        // The runner-neutral placeholder `verify.scenario-attested` itself\n        // suggests: a step that said \"cucumber\" alone told a fleet whose\n        // runner has no cucumber formatter that it had no route to `verified`.\n        command: `loam verify ${id} --results <report.json>`,\n        artifact: \"verification\",\n        path: record.path,\n      },\n    ];\n  }\n  return [];\n}\n\n/**\n * Where a test comes from. `loam gherkin` writes the .feature files whose green\n * run is the only thing that may answer a `scenario.tested` claim, and it runs\n * from the service's own repository — so the step exists wherever there are\n * scenarios to generate from, and names the repository to run it in when that\n * is not this one.\n */\nexport function testStep(\n  id: string,\n  verification: VerificationState,\n  view: { services: string[]; scans: DeltaScan[]; boundService: string | undefined },\n): NextStep[] {\n  const { services, scans, boundService } = view;\n  if (fullyVerified(verification)) return [];\n  const withScenarios = [\n    ...new Set(scans.filter((s) => s.scenarios > 0 && services.includes(s.service)).map((s) => s.service)),\n  ];\n  if (withScenarios.length === 0) return [];\n  const svc = boundService !== undefined && withScenarios.includes(boundService) ? boundService : withScenarios[0]!;\n  const here = svc === boundService;\n  return [\n    {\n      code: \"next.generate-tests\",\n      statement:\n        `${id}'s delta for ${svc} carries scenarios that no test run has answered yet — generate the suite, then implement against it` +\n        (here\n          ? \".\"\n          : `. \\`loam gherkin\\` writes into the service's own repository, so run it from ${svc}'s${\n              withScenarios.length > 1 ? ` (and likewise for ${withScenarios.slice(1).join(\", \")})` : \"\"\n            }.`),\n      command: `loam gherkin ${id} --service ${svc}`,\n      artifact: \"spec\",\n      service: svc,\n    },\n  ];\n}\n"]}

package/dist/core/tasks/packet.js

@@ -0,0 +1,199 @@
+/**
+ * The work packet: one feature's unit-of-work list, derived and never stored.
+ *
+ * It is a READ. Nothing here writes, nothing caches, and there is no state
+ * anywhere that says a unit is finished — done is "the unit no longer appears",
+ * which is what makes the list impossible to falsify by editing a checkbox. The
+ * inputs are the same documents `loam verify` derives its questions from
+ * (`core/verify/checklist.ts`), the same delta scans `loam status` reads, the
+ * record beside the feature, and — only when standing in the bound service repo
+ * — the stamps in the generated suite.
+ *
+ * Everything the packet reports is therefore re-derivable from the tree by
+ * anybody holding it, which is the property an agent orchestrating other agents
+ * actually needs: it can ask again and compare, rather than trusting a report.
+ */
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { stripFrontmatter } from "../document/frontmatter.js";
+import { repoPath } from "../envelope/json.js";
+import { FleetContext } from "../fleet-context.js";
+import { compareIds } from "../repo/entries.js";
+import { featurePaths } from "../repo/paths.js";
+import { featureChecklist } from "../verify/checklist.js";
+import { readRecordView, settledClaims } from "./record.js";
+import { readStamps } from "./stamps.js";
+import { axisSize, describeUnits, readContracts, readDeltaAxes, scenarioSources, } from "./sources.js";
+import { doneCheck, FRONTIER_LIMIT, isOpen, linkDependencies, sortUnits } from "./unit.js";
+/** The step a claim-backed unit is waiting at. */
+function stepFor(claim, stamps) {
+    if (claim.kind !== "scenario.tested")
+        return "implement";
+    // Only this repository's suite may be graded. Another service's tests live in
+    // another repository, and reporting `generate` for them would be a claim about
+    // a directory this run has never seen.
+    if (stamps.state !== "read" || stamps.service !== claim.subject)
+        return "implement";
+    return claim.digest !== undefined && stamps.digests.has(claim.digest) ? "implement" : "generate";
+}
+/**
+ * The claim-backed units: every claim the record has not closed.
+ *
+ * The claim's own fields ride through verbatim — the task id IS the claim id,
+ * so a unit can be handed straight back to `loam verify` and two runs of
+ * `loam tasks` are diffable exactly as two checklists are.
+ */
+function claimUnits(claims, settled, stamps, sources) {
+    const out = [];
+    for (const claim of claims) {
+        if (settled.done.has(claim.id))
+            continue;
+        const source = sources.get(claim.id);
+        out.push({
+            id: claim.id,
+            kind: claim.kind,
+            subject: claim.subject,
+            at: settled.attested.has(claim.id) ? "attested" : stepFor(claim, stamps),
+            claim: claim.claim,
+            ...(claim.digest === undefined ? {} : { digest: claim.digest }),
+            ...(claim.operation === undefined ? {} : { operation: claim.operation }),
+            ...(claim.token === undefined ? {} : { token: claim.token }),
+            dependsOn: [],
+            // The digest cross-check is the belt on the id join (`./sources.ts`): a
+            // source whose words hash to something else is somebody ELSE's
+            // Given/When/Then, and no source at all is the honest answer.
+            ...(source !== undefined && source.digest === claim.digest ? { source: source.source } : {}),
+            done: { check: doneCheck(claim) },
+        });
+    }
+    return out;
+}
+/**
+ * The four standing review instructions, computed with this feature's own ids.
+ *
+ * They are on the payload rather than in the docs because the reviewer of a
+ * packet is usually another agent, and an agent that has to go fetch a protocol
+ * to learn how to check the work is an agent that will not. Each one names a
+ * failure that has actually happened: trusting a checkmark instead of
+ * re-deriving, taking one answer set on faith, hand-editing a generated suite
+ * (whose digests are what `--results` matches on), and implementing one half of
+ * a contract.
+ */
+function reviewNotes(feature, gherkinDir) {
+    return [
+        `re-derive, do not trust checkmarks: loam tasks ${feature} --json and compare open units against the implementer's claim`,
+        `cross-examine recorded answers: loam verify ${feature} --diff-answers <a.json> <b.json>`,
+        `generated suite is read-only: no edits under ${gherkinDir}/loam/, and step definitions must not paraphrase scenarios`,
+        "honour the contract in both directions: every expose[] operationId exists under exactly that id; every call[] op is actually called",
+    ];
+}
+/** The operations this lens promises to expose, and the ones it promises to call. */
+function contractTokens(claims, lens) {
+    const scoped = claims.filter((claim) => lens === null || claim.subject === lens);
+    const pick = (kind, field) => [...new Set(scoped.filter((c) => c.kind === kind).map((c) => c[field]).filter((v) => v !== undefined))].sort(compareIds);
+    return { expose: pick("api.exposes", "operation"), call: pick("c4.calls", "token") };
+}
+/**
+ * The lens the packet is actually cut to.
+ *
+ * An explicit lens wins. Without one, a run from a service repository is about
+ * THAT service whenever the feature touches it, because the stamps that tell
+ * `generate` from `implement` are read from this repository's suite alone
+ * (`./stamps.ts`): in a whole-feature view from here, every other service's
+ * scenario reads `implement` whatever its own suite holds — a verdict about a
+ * directory this run has never seen, printed beside one about a directory it
+ * has, in the same words. A feature that does not touch the bound service keeps
+ * the whole view, because narrowing to a service with nothing in it prints an
+ * empty packet, and an agent reads an empty packet as "nothing to do".
+ *
+ * Decided here rather than by the caller because "touches" is the packet's own
+ * service list, which includes a service only the C4 delta names — learning it
+ * first would cost the caller a second checklist derivation of the same delta.
+ */
+function lensOf(request, services) {
+    if (request.lens !== null)
+        return request.lens;
+    const bound = request.binding.service;
+    return bound !== undefined && services.includes(bound) ? bound : null;
+}
+export async function workPacket(request) {
+    const { docsDir, feature, binding } = request;
+    // One read index for the whole derivation: the checklist, the delta axes and
+    // the architecture parse all reach the same documents, and without a shared
+    // context each would be its own fleet walk.
+    const context = new FleetContext();
+    const checklist = await featureChecklist(docsDir, feature.dir, feature.id, context);
+    const view = await readRecordView(feature.dir, checklist);
+    const settled = settledClaims(view);
+    const axes = await readDeltaAxes(docsDir, feature.dir, feature.services, context);
+    const stamps = await readStamps(binding);
+    const contracts = await readContracts(docsDir, feature.dir, feature.services, context);
+    const all = sortUnits(withDependencies([
+        ...describeUnits(feature.id, axes),
+        ...claimUnits(checklist.claims, settled, stamps, scenarioSources(feature.id, axes)),
+    ]));
+    const services = [...new Set([...feature.services, ...checklist.claims.map((c) => c.subject)])].sort(compareIds);
+    const lens = lensOf(request, services);
+    const units = lens === null ? all : all.filter((unit) => unit.subject === lens);
+    const open = units.filter(isOpen);
+    const paths = featurePaths(feature.dir);
+    const intent = existsSync(paths.intent)
+        ? stripFrontmatter(await readFile(paths.intent, "utf8")).trim()
+        : null;
+    return {
+        feature: feature.id,
+        service: lens,
+        services,
+        path: repoPath(docsDir, feature.dir),
+        checklist: checklist.digest,
+        record: view.state,
+        stamps: stamps.state,
+        intent,
+        size: { ...axisSize(axes), operations: contracts.operations, messages: contracts.messages, calls: countCalls(checklist.claims, lens) },
+        units,
+        counts: {
+            open: open.length,
+            done: checklist.claims.filter((c) => settled.done.has(c.id) && (lens === null || c.subject === lens)).length,
+            attested: units.filter((unit) => unit.at === "attested").length,
+        },
+        frontier: open.slice(0, FRONTIER_LIMIT).map((unit) => unit.id),
+        frontierElided: Math.max(0, open.length - FRONTIER_LIMIT),
+        ...(lens === null ? {} : { waitingOn: waitingOn(units, all, lens) }),
+        contracts: contractTokens(checklist.claims, lens),
+        review: reviewNotes(feature.id, binding.gherkinDir ?? "features"),
+        unreadable: contracts.unreadable,
+    };
+}
+/** `linkDependencies` mutates in place; this is the expression form the assembly above reads in. */
+function withDependencies(units) {
+    linkDependencies(units);
+    return units;
+}
+/** How many call edges this lens carries — the c4.calls claims, answered or not. */
+function countCalls(claims, lens) {
+    return claims.filter((claim) => claim.kind === "c4.calls" && (lens === null || claim.subject === lens)).length;
+}
+/**
+ * What this service is waiting on somebody else for.
+ *
+ * Under a lens the dependency edges point out of the view, and a consumer that
+ * could not see where would read `dependsOn` as a dangling id. These are the
+ * units on the other end: OPEN, in another service, and named with enough text
+ * that the reader knows which repository to go ask. Attested units are left out
+ * — they are complete work, and nobody is blocked on somebody else's
+ * outstanding cucumber run.
+ */
+function waitingOn(units, all, lens) {
+    const byId = new Map(all.map((unit) => [unit.id, unit]));
+    const out = new Map();
+    for (const unit of units) {
+        for (const id of unit.dependsOn) {
+            const provider = byId.get(id);
+            if (provider === undefined || provider.subject === lens || !isOpen(provider))
+                continue;
+            out.set(id, { id, subject: provider.subject, kind: provider.kind, claim: provider.claim });
+        }
+    }
+    return [...out.values()].sort((a, b) => compareIds(a.id, b.id));
+}
+//# sourceMappingURL=packet.js.map

package/dist/core/tasks/packet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packet.js","sourceRoot":"","sources":["../../../src/core/tasks/packet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAc,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAoB,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,UAAU,EAA0C,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,QAAQ,EACR,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,GAIhB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAgC,MAAM,WAAW,CAAC;AAkDzH,kDAAkD;AAClD,SAAS,OAAO,CAAC,KAAY,EAAE,MAAoB;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,WAAW,CAAC;IACzD,8EAA8E;IAC9E,+EAA+E;IAC/E,uCAAuC;IACvC,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC;IACpF,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,MAAwB,EACxB,OAAqD,EACrD,MAAoB,EACpB,OAA0C;IAE1C,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,SAAS;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;YACxE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5D,SAAS,EAAE,EAAE;YACb,wEAAwE;YACxE,+DAA+D;YAC/D,8DAA8D;YAC9D,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,UAAkB;IACtD,OAAO;QACL,kDAAkD,OAAO,gEAAgE;QACzH,+CAA+C,OAAO,mCAAmC;QACzF,gDAAgD,UAAU,4DAA4D;QACtH,qIAAqI;KACtI,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,MAAwB,EAAE,IAAmB;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAA4B,EAAY,EAAE,CACpE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CACvH,UAAU,CACX,CAAC;IACJ,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,MAAM,CAAC,OAAsB,EAAE,QAA2B;IACjE,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC9C,6EAA6E;IAC7E,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAM,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEvF,MAAM,GAAG,GAAG,SAAS,CAAC,gBAAgB,CAAC;QACrC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC;QAClC,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;KACpF,CAAC,CAAC,CAAC;IACJ,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,gBAAgB,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/D,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,EAAE;QACnB,OAAO,EAAE,IAAI;QACb,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,MAAM;QACN,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;QACtI,KAAK;QACL,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,MAAM;YACjB,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM;YAC5G,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,MAAM;SAChE;QACD,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC;QACzD,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACpE,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC;QACjD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;QACjE,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,SAAS,gBAAgB,CAAC,KAAiB;IACzC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,MAAwB,EAAE,IAAmB;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACjH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,KAA0B,EAAE,GAAwB,EAAE,IAAY;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACvF,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC","sourcesContent":["/**\n * The work packet: one feature's unit-of-work list, derived and never stored.\n *\n * It is a READ. Nothing here writes, nothing caches, and there is no state\n * anywhere that says a unit is finished — done is \"the unit no longer appears\",\n * which is what makes the list impossible to falsify by editing a checkbox. The\n * inputs are the same documents `loam verify` derives its questions from\n * (`core/verify/checklist.ts`), the same delta scans `loam status` reads, the\n * record beside the feature, and — only when standing in the bound service repo\n * — the stamps in the generated suite.\n *\n * Everything the packet reports is therefore re-derivable from the tree by\n * anybody holding it, which is the property an agent orchestrating other agents\n * actually needs: it can ask again and compare, rather than trusting a report.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { stripFrontmatter } from \"../document/frontmatter.js\";\nimport { repoPath } from \"../envelope/json.js\";\nimport { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport { compareIds, type FeatureEntry } from \"../repo/entries.js\";\nimport { featurePaths } from \"../repo/paths.js\";\nimport { featureChecklist, type Claim } from \"../verify/checklist.js\";\nimport { readRecordView, settledClaims, type RecordState } from \"./record.js\";\nimport { readStamps, type GherkinBinding, type StampReading } from \"./stamps.js\";\nimport {\n  axisSize,\n  describeUnits,\n  readContracts,\n  readDeltaAxes,\n  scenarioSources,\n  type DeltaSize,\n  type MintedSource,\n  type Unreadable,\n} from \"./sources.js\";\nimport { doneCheck, FRONTIER_LIMIT, isOpen, linkDependencies, sortUnits, type TaskStep, type TaskUnit } from \"./unit.js\";\n\nexport interface PacketRequest {\n  docsDir: DocsDir;\n  /** Active only — an archived feature is refused by the caller, and why is stated there. */\n  feature: FeatureEntry;\n  /**\n   * The `--service` lens, or null when none was asked for. A lens, never a\n   * binding check. Null is not always the whole feature: `lensOf` falls back to\n   * the bound service, and the packet's `service` says which lens was applied.\n   */\n  lens: string | null;\n  binding: GherkinBinding;\n}\n\n/** An open unit in another service that one of this lens's units is waiting on. */\nexport interface WaitingOn {\n  id: string;\n  subject: string;\n  kind: string;\n  claim: string;\n}\n\nexport interface WorkPacket {\n  feature: string;\n  /** The lens applied — the flag's, else the bound service's (`lensOf`) — or null for the whole feature. */\n  service: string | null;\n  services: string[];\n  path: string;\n  /** The checklist digest — how a consumer detects that the question set itself moved. */\n  checklist: string;\n  record: RecordState;\n  stamps: \"read\" | \"unknown\";\n  intent: string | null;\n  /**\n   * The size of the DELTA, not of the open work: how much this feature says,\n   * whatever has been answered. A packet that shrank as work closed would make\n   * \"this feature is small\" and \"this feature is nearly done\" the same sentence.\n   */\n  size: DeltaSize;\n  units: TaskUnit[];\n  counts: { open: number; done: number; attested: number };\n  frontier: string[];\n  frontierElided: number;\n  waitingOn?: WaitingOn[];\n  contracts: { expose: string[]; call: string[] };\n  review: string[];\n  unreadable: Unreadable;\n}\n\n/** The step a claim-backed unit is waiting at. */\nfunction stepFor(claim: Claim, stamps: StampReading): TaskStep {\n  if (claim.kind !== \"scenario.tested\") return \"implement\";\n  // Only this repository's suite may be graded. Another service's tests live in\n  // another repository, and reporting `generate` for them would be a claim about\n  // a directory this run has never seen.\n  if (stamps.state !== \"read\" || stamps.service !== claim.subject) return \"implement\";\n  return claim.digest !== undefined && stamps.digests.has(claim.digest) ? \"implement\" : \"generate\";\n}\n\n/**\n * The claim-backed units: every claim the record has not closed.\n *\n * The claim's own fields ride through verbatim — the task id IS the claim id,\n * so a unit can be handed straight back to `loam verify` and two runs of\n * `loam tasks` are diffable exactly as two checklists are.\n */\nfunction claimUnits(\n  claims: readonly Claim[],\n  settled: { done: Set<string>; attested: Set<string> },\n  stamps: StampReading,\n  sources: ReadonlyMap<string, MintedSource>,\n): TaskUnit[] {\n  const out: TaskUnit[] = [];\n  for (const claim of claims) {\n    if (settled.done.has(claim.id)) continue;\n    const source = sources.get(claim.id);\n    out.push({\n      id: claim.id,\n      kind: claim.kind,\n      subject: claim.subject,\n      at: settled.attested.has(claim.id) ? \"attested\" : stepFor(claim, stamps),\n      claim: claim.claim,\n      ...(claim.digest === undefined ? {} : { digest: claim.digest }),\n      ...(claim.operation === undefined ? {} : { operation: claim.operation }),\n      ...(claim.token === undefined ? {} : { token: claim.token }),\n      dependsOn: [],\n      // The digest cross-check is the belt on the id join (`./sources.ts`): a\n      // source whose words hash to something else is somebody ELSE's\n      // Given/When/Then, and no source at all is the honest answer.\n      ...(source !== undefined && source.digest === claim.digest ? { source: source.source } : {}),\n      done: { check: doneCheck(claim) },\n    });\n  }\n  return out;\n}\n\n/**\n * The four standing review instructions, computed with this feature's own ids.\n *\n * They are on the payload rather than in the docs because the reviewer of a\n * packet is usually another agent, and an agent that has to go fetch a protocol\n * to learn how to check the work is an agent that will not. Each one names a\n * failure that has actually happened: trusting a checkmark instead of\n * re-deriving, taking one answer set on faith, hand-editing a generated suite\n * (whose digests are what `--results` matches on), and implementing one half of\n * a contract.\n */\nfunction reviewNotes(feature: string, gherkinDir: string): string[] {\n  return [\n    `re-derive, do not trust checkmarks: loam tasks ${feature} --json and compare open units against the implementer's claim`,\n    `cross-examine recorded answers: loam verify ${feature} --diff-answers <a.json> <b.json>`,\n    `generated suite is read-only: no edits under ${gherkinDir}/loam/, and step definitions must not paraphrase scenarios`,\n    \"honour the contract in both directions: every expose[] operationId exists under exactly that id; every call[] op is actually called\",\n  ];\n}\n\n/** The operations this lens promises to expose, and the ones it promises to call. */\nfunction contractTokens(claims: readonly Claim[], lens: string | null): { expose: string[]; call: string[] } {\n  const scoped = claims.filter((claim) => lens === null || claim.subject === lens);\n  const pick = (kind: string, field: \"operation\" | \"token\"): string[] =>\n    [...new Set(scoped.filter((c) => c.kind === kind).map((c) => c[field]).filter((v): v is string => v !== undefined))].sort(\n      compareIds,\n    );\n  return { expose: pick(\"api.exposes\", \"operation\"), call: pick(\"c4.calls\", \"token\") };\n}\n\n/**\n * The lens the packet is actually cut to.\n *\n * An explicit lens wins. Without one, a run from a service repository is about\n * THAT service whenever the feature touches it, because the stamps that tell\n * `generate` from `implement` are read from this repository's suite alone\n * (`./stamps.ts`): in a whole-feature view from here, every other service's\n * scenario reads `implement` whatever its own suite holds — a verdict about a\n * directory this run has never seen, printed beside one about a directory it\n * has, in the same words. A feature that does not touch the bound service keeps\n * the whole view, because narrowing to a service with nothing in it prints an\n * empty packet, and an agent reads an empty packet as \"nothing to do\".\n *\n * Decided here rather than by the caller because \"touches\" is the packet's own\n * service list, which includes a service only the C4 delta names — learning it\n * first would cost the caller a second checklist derivation of the same delta.\n */\nfunction lensOf(request: PacketRequest, services: readonly string[]): string | null {\n  if (request.lens !== null) return request.lens;\n  const bound = request.binding.service;\n  return bound !== undefined && services.includes(bound) ? bound : null;\n}\n\nexport async function workPacket(request: PacketRequest): Promise<WorkPacket> {\n  const { docsDir, feature, binding } = request;\n  // One read index for the whole derivation: the checklist, the delta axes and\n  // the architecture parse all reach the same documents, and without a shared\n  // context each would be its own fleet walk.\n  const context = new FleetContext();\n  const checklist = await featureChecklist(docsDir, feature.dir, feature.id, context);\n  const view = await readRecordView(feature.dir, checklist);\n  const settled = settledClaims(view);\n  const axes = await readDeltaAxes(docsDir, feature.dir, feature.services, context);\n  const stamps = await readStamps(binding);\n  const contracts = await readContracts(docsDir, feature.dir, feature.services, context);\n\n  const all = sortUnits(withDependencies([\n    ...describeUnits(feature.id, axes),\n    ...claimUnits(checklist.claims, settled, stamps, scenarioSources(feature.id, axes)),\n  ]));\n  const services = [...new Set([...feature.services, ...checklist.claims.map((c) => c.subject)])].sort(compareIds);\n  const lens = lensOf(request, services);\n  const units = lens === null ? all : all.filter((unit) => unit.subject === lens);\n  const open = units.filter(isOpen);\n\n  const paths = featurePaths(feature.dir);\n  const intent = existsSync(paths.intent)\n    ? stripFrontmatter(await readFile(paths.intent, \"utf8\")).trim()\n    : null;\n\n  return {\n    feature: feature.id,\n    service: lens,\n    services,\n    path: repoPath(docsDir, feature.dir),\n    checklist: checklist.digest,\n    record: view.state,\n    stamps: stamps.state,\n    intent,\n    size: { ...axisSize(axes), operations: contracts.operations, messages: contracts.messages, calls: countCalls(checklist.claims, lens) },\n    units,\n    counts: {\n      open: open.length,\n      done: checklist.claims.filter((c) => settled.done.has(c.id) && (lens === null || c.subject === lens)).length,\n      attested: units.filter((unit) => unit.at === \"attested\").length,\n    },\n    frontier: open.slice(0, FRONTIER_LIMIT).map((unit) => unit.id),\n    frontierElided: Math.max(0, open.length - FRONTIER_LIMIT),\n    ...(lens === null ? {} : { waitingOn: waitingOn(units, all, lens) }),\n    contracts: contractTokens(checklist.claims, lens),\n    review: reviewNotes(feature.id, binding.gherkinDir ?? \"features\"),\n    unreadable: contracts.unreadable,\n  };\n}\n\n/** `linkDependencies` mutates in place; this is the expression form the assembly above reads in. */\nfunction withDependencies(units: TaskUnit[]): TaskUnit[] {\n  linkDependencies(units);\n  return units;\n}\n\n/** How many call edges this lens carries — the c4.calls claims, answered or not. */\nfunction countCalls(claims: readonly Claim[], lens: string | null): number {\n  return claims.filter((claim) => claim.kind === \"c4.calls\" && (lens === null || claim.subject === lens)).length;\n}\n\n/**\n * What this service is waiting on somebody else for.\n *\n * Under a lens the dependency edges point out of the view, and a consumer that\n * could not see where would read `dependsOn` as a dangling id. These are the\n * units on the other end: OPEN, in another service, and named with enough text\n * that the reader knows which repository to go ask. Attested units are left out\n * — they are complete work, and nobody is blocked on somebody else's\n * outstanding cucumber run.\n */\nfunction waitingOn(units: readonly TaskUnit[], all: readonly TaskUnit[], lens: string): WaitingOn[] {\n  const byId = new Map(all.map((unit) => [unit.id, unit]));\n  const out = new Map<string, WaitingOn>();\n  for (const unit of units) {\n    for (const id of unit.dependsOn) {\n      const provider = byId.get(id);\n      if (provider === undefined || provider.subject === lens || !isOpen(provider)) continue;\n      out.set(id, { id, subject: provider.subject, kind: provider.kind, claim: provider.claim });\n    }\n  }\n  return [...out.values()].sort((a, b) => compareIds(a.id, b.id));\n}\n"]}

package/dist/core/tasks/record.js

@@ -0,0 +1,43 @@
+import { readVerificationState } from "../verify/read/file.js";
+import { attestedClaims, countedAnswers } from "../verify/record.js";
+/**
+ * Read the record beside the feature and say what it answers.
+ *
+ * Staleness is all-or-nothing and it is the checklist digest that decides: a
+ * record that answers a different question set is not an answer to this one,
+ * however complete it looks. So a stale, unreadable or absent record confirms
+ * NOTHING — every unit stays open, and the `record` key on the payload is what
+ * says why the packet looks untouched. Silently crediting a stale record would
+ * be the worst failure this command can have: an agent reading a thin packet as
+ * "nothing left to do" over answers to questions nobody is asking any more.
+ */
+export async function readRecordView(featureDir, checklist) {
+    // The digest rides into the read: a record kept as per-service files counts
+    // the files that answered THIS checklist (`core/verify/read/union.ts`), so
+    // a same-day file answering an older one cannot make the packet look stale.
+    const read = await readVerificationState(featureDir, checklist.digest);
+    if (read.state === "absent")
+        return { state: "absent", answers: new Map() };
+    if (read.state === "unreadable")
+        return { state: "unreadable", answers: new Map() };
+    if (read.verification.checklist !== checklist.digest)
+        return { state: "stale", answers: new Map() };
+    return { state: "recorded", answers: countedAnswers(checklist.claims, read.verification) };
+}
+/**
+ * Which claims have stopped being work, and which are complete-but-unrun.
+ *
+ * `attestedClaims` is the authority for the second set — a confirmed
+ * `scenario.tested` whose `answered_by` is not a runner — and it is imported
+ * rather than restated because the same predicate decides `verify`'s verdict,
+ * `status`'s rung and the `verify.scenario-attested` notice. An attested unit
+ * NEVER vanishes: it is somebody's word about a test, and the whole reason loam
+ * exists is that a word must not read the same as a run.
+ */
+export function settledClaims(view) {
+    const answers = [...view.answers.values()];
+    const attested = new Set(attestedClaims(answers));
+    const done = new Set(answers.filter((claim) => claim.verdict === "confirmed" && !attested.has(claim.id)).map((claim) => claim.id));
+    return { done, attested };
+}
+//# sourceMappingURL=record.js.map

package/dist/core/tasks/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../../../src/core/tasks/record.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAC;AAWzF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAsB,EAAE,SAAoB;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC5E,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACpF,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACpG,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAC7G,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["/**\n * What the verification record says about this checklist, for the one\n * question a packet asks of it: which units have stopped being work.\n *\n * Nothing here decides what \"confirmed\" or \"attested\" MEAN — those verdicts are\n * `core/verify/record.ts`'s and nowhere else's, and they are imported rather\n * than re-derived. Nor, now, which recorded row counts as the answer to which\n * claim: that attestation-scoping rule was carried here as \"a deliberate\n * mirror\" of `statuses()` in `src/commands/verify/report.ts`, because core may\n * never import commands, and it moved down into `countedAnswers` in\n * `core/verify/record.ts` so both read one copy. What this module still owns\n * is the rule that a record which answers a different question set answers\n * nothing at all.\n */\nimport type { FeatureDir } from \"../kernel/ids/dirs.js\";\nimport type { Checklist } from \"../verify/checklist.js\";\nimport { readVerificationState } from \"../verify/read/file.js\";\nimport { attestedClaims, countedAnswers, type RecordedClaim } from \"../verify/record.js\";\n\n/** The four states a packet reports, and the four a reader has to tell apart. */\nexport type RecordState = \"absent\" | \"recorded\" | \"stale\" | \"unreadable\";\n\nexport interface RecordView {\n  state: RecordState;\n  /** Claim id → the answer that counts for it. Empty unless `state` is \"recorded\". */\n  answers: ReadonlyMap<string, RecordedClaim>;\n}\n\n/**\n * Read the record beside the feature and say what it answers.\n *\n * Staleness is all-or-nothing and it is the checklist digest that decides: a\n * record that answers a different question set is not an answer to this one,\n * however complete it looks. So a stale, unreadable or absent record confirms\n * NOTHING — every unit stays open, and the `record` key on the payload is what\n * says why the packet looks untouched. Silently crediting a stale record would\n * be the worst failure this command can have: an agent reading a thin packet as\n * \"nothing left to do\" over answers to questions nobody is asking any more.\n */\nexport async function readRecordView(featureDir: FeatureDir, checklist: Checklist): Promise<RecordView> {\n  // The digest rides into the read: a record kept as per-service files counts\n  // the files that answered THIS checklist (`core/verify/read/union.ts`), so\n  // a same-day file answering an older one cannot make the packet look stale.\n  const read = await readVerificationState(featureDir, checklist.digest);\n  if (read.state === \"absent\") return { state: \"absent\", answers: new Map() };\n  if (read.state === \"unreadable\") return { state: \"unreadable\", answers: new Map() };\n  if (read.verification.checklist !== checklist.digest) return { state: \"stale\", answers: new Map() };\n  return { state: \"recorded\", answers: countedAnswers(checklist.claims, read.verification) };\n}\n\n/**\n * Which claims have stopped being work, and which are complete-but-unrun.\n *\n * `attestedClaims` is the authority for the second set — a confirmed\n * `scenario.tested` whose `answered_by` is not a runner — and it is imported\n * rather than restated because the same predicate decides `verify`'s verdict,\n * `status`'s rung and the `verify.scenario-attested` notice. An attested unit\n * NEVER vanishes: it is somebody's word about a test, and the whole reason loam\n * exists is that a word must not read the same as a run.\n */\nexport function settledClaims(view: RecordView): { done: Set<string>; attested: Set<string> } {\n  const answers = [...view.answers.values()];\n  const attested = new Set(attestedClaims(answers));\n  const done = new Set(\n    answers.filter((claim) => claim.verdict === \"confirmed\" && !attested.has(claim.id)).map((claim) => claim.id),\n  );\n  return { done, attested };\n}\n"]}