@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/commands/verify/record.js

@@ -0,0 +1,278 @@
+/**
+ * Writing the answers down.
+ *
+ * The one command in loam that takes somebody's word for something, so every
+ * refusal here is about whose word is on the file. The legacy all-at-once form
+ * run over a federated record does not merge and does not migrate — it would
+ * erase every other service's commit-bound attestation, invisibly, because what
+ * replaces it is a well-formed and plausible record.
+ */
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { emitJson, fail, repoPath } from "../../core/envelope/json.js";
+import { today } from "../../core/provenance/stamp.js";
+import { runnerAnswers } from "../../core/results.js";
+import { checkAnswers } from "../../core/verify/answers.js";
+import { buildServiceRecord, buildVerification } from "../../core/verify/build.js";
+import {} from "../../core/verify/checklist.js";
+import { contractAnswers } from "../../core/verify/evidence/contract.js";
+import {} from "../../core/verify/read/file.js";
+import { assembleRecord } from "../../core/verify/read/union.js";
+import { commitVerification } from "../../core/verify/store/commit.js";
+import { tallyRecord, verificationVerdict, } from "../../core/verify/record.js";
+import { recordLocation, serviceRecordPath, verificationPath } from "../../core/verify/location.js";
+import { plural, sayDiscarded, sayRecovered } from "../policy/format.js";
+import { readContractResults } from "./evidence/contract.js";
+import { claimTokens, pinAnswers } from "./evidence/pins.js";
+import { readResults, repositoryCommit, validateLocalEvidence, validateServiceEvidence } from "./results.js";
+import { contestedNotices, contestedOperationNotices, contractReportLine, forkedChecklistNotices, noticesFor, reportLine, } from "./frozen.js";
+import {} from "./report.js";
+export async function record(target, checklist, attestor, opts) {
+    const { docsDir, featureDir, json } = target;
+    const { service, repoDir, previous } = attestor;
+    // The legacy all-at-once form answers the WHOLE checklist on one repository's
+    // word and writes a schema-1 record — no attestations, no commits. Run over a
+    // federated record it does not merge and it does not migrate: over a one-file
+    // federated record it would erase every other service's commit-bound
+    // attestation, invisibly, because what replaces it is a well-formed,
+    // plausible record; beside a `verification/` directory it would write a file
+    // whose answers can never count (no attestation binds them) while reporting
+    // them as recorded. Either way it refuses, and names the repositories whose
+    // word is on the record.
+    const attested = previous?.verification.schema === 2 ? (previous.verification.attestations ?? []) : [];
+    if (service === undefined && attested.length > 0) {
+        const services = [...new Set(attested.map((a) => a.service))].sort();
+        return fail(json, "record-federated", `${repoPath(docsDir, recordLocation(featureDir))} is a federated record: ${plural(services.length, "service")} (${services.join(", ")}) have attested claims against their own git commits. ` +
+            "Recording without --service would put one unattested answer set over all of it. " +
+            `Record this service's claims from its own repo instead: \`loam verify ${checklist.feature} --record answers.json --service <svc>\`.`);
+    }
+    const scopedClaims = service === undefined ? checklist.claims : checklist.claims.filter((claim) => claim.subject === service);
+    if (service !== undefined && scopedClaims.length === 0) {
+        return fail(json, "unknown-service", `The current ${checklist.feature} checklist has no claims owned by service '${service}'.`);
+    }
+    // The mechanical halves: with --results, every scenario.tested claim is the
+    // cucumber report's to answer — matched by digest, confirmed only by a green
+    // run — and with --contract-results, every api.exposes claim is the contract
+    // report's, matched by operationId under the same ownership discipline. A
+    // partial suite leaves its unexercised claims unconfirmed rather than
+    // agent-attestable in the same run: silence must not read as checked, and
+    // the escape is a --record run without the flag.
+    const runnerClaims = opts.results === undefined ? [] : scopedClaims.filter((c) => c.kind === "scenario.tested");
+    const contractClaims = opts.contractResults === undefined ? [] : scopedClaims.filter((c) => c.kind === "api.exposes");
+    const agentClaims = scopedClaims.filter((c) => (opts.results === undefined || c.kind !== "scenario.tested") &&
+        (opts.contractResults === undefined || c.kind !== "api.exposes"));
+    let fromRunner = [];
+    let fromContract = [];
+    const reports = {};
+    if (opts.results !== undefined) {
+        // A federated record attests for THIS repository, so its report has to be a
+        // file inside it — see evidence/read.ts.
+        const read = await readResults(opts.results, service === undefined ? undefined : repoDir);
+        if (!read.ok)
+            return fail(json, read.code, read.message);
+        reports.results = read.report;
+        fromRunner = runnerAnswers(runnerClaims, read.scenarios, read.report.path);
+    }
+    if (opts.contractResults !== undefined) {
+        // Same resolution rules as the cucumber report, same refusal code: the two
+        // pins make the same promise about the same repository.
+        const read = await readContractResults(opts.contractResults, service === undefined ? undefined : repoDir);
+        if (!read.ok)
+            return fail(json, read.code, read.message);
+        reports.contract = read.report;
+        fromContract = contractAnswers(contractClaims, read.runs, read.report.path);
+    }
+    // The agent's half — exactly what no report owns. A mechanical flag alone is
+    // legal only when the reports own the whole checklist: anything left over
+    // refuses with the ids, the same discipline as a claim with no answer.
+    let raw = [];
+    if (opts.record !== undefined) {
+        try {
+            // The one path that stays cwd-relative, and deliberately: the answer set
+            // is a file the caller just wrote and hands to the command, not part of
+            // the repository being attested. Nothing on the record points at it.
+            raw = JSON.parse(await readFile(resolve(process.cwd(), opts.record), "utf8"));
+        }
+        catch (err) {
+            return fail(json, "answers-unreadable", `Cannot read ${opts.record}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    else if (agentClaims.length > 0 && (opts.results !== undefined || opts.contractResults !== undefined)) {
+        const owns = [
+            ...(opts.results === undefined ? [] : ["--results answers only the scenario.tested claims"]),
+            ...(opts.contractResults === undefined ? [] : ["--contract-results answers only the api.exposes claims"]),
+        ].join(" and ");
+        return fail(json, "answers-mismatch", `${owns}; ${agentClaims.length} claim(s) have no answer: ` +
+            `${agentClaims.map((c) => c.id).join(", ")}. Record them with --record <answers.json> alongside.`);
+    }
+    const checked = checkAnswers(agentClaims, raw, opts.results === undefined && opts.contractResults === undefined
+        ? undefined
+        : new Set([...runnerClaims, ...contractClaims].map((c) => c.id)), { feature: checklist.feature, ...(service === undefined ? {} : { service }) });
+    if (!checked.ok)
+        return fail(json, checked.code, checked.message);
+    let serviceCommit;
+    let answers = [...fromRunner, ...fromContract, ...checked.answers];
+    let pinNotice = null;
+    if (service !== undefined) {
+        const commit = await repositoryCommit(repoDir);
+        if (!commit.ok)
+            return fail(json, "repository-unavailable", commit.message);
+        serviceCommit = commit.commit;
+        // All halves, one validator. The runner's evidence used to skip it
+        // entirely: `--results` minted confirmations whose evidence strings nothing
+        // ever checked, in the one mode that promises every answer is bound to this
+        // repository at this commit. The same pass stamps each agent citation's
+        // evidence pin and scans its blob for the claim's token (evidence/pins.ts).
+        const evidence = await validateServiceEvidence(answers, { repoDir, commit: serviceCommit }, reports, claimTokens(scopedClaims));
+        if (!evidence.ok)
+            return fail(json, "answers-unevidenced", evidence.message);
+        ({ answers, notice: pinNotice } = pinAnswers(answers, evidence, serviceCommit));
+    }
+    else {
+        // The all-at-once form binds to no commit, but a citation still has to be
+        // a line that exists — see `validateLocalEvidence`. Resolved against the
+        // repository loam.json was found in, which is the one place a reviewer
+        // reading this record can go and look.
+        const evidence = await validateLocalEvidence(answers, repoDir);
+        if (!evidence.ok) {
+            return fail(json, "answers-unevidenced", `${evidence.message} The all-at-once form resolves every citation inside this repository; ` +
+                "evidence that lives in a service's own repository is recorded from there, with `--service`.");
+        }
+    }
+    const recorded = today(new Date());
+    // What goes on disk and what the record reads as afterwards are two
+    // different objects now. The all-at-once form IS its file. A service's write
+    // is one file among several, so the verdict it prints is the union of the
+    // files as they will stand once the commit lands — added up by the very
+    // function the next read will use, so this run cannot print a verdict the
+    // following `loam verify` disagrees with.
+    let verification;
+    let writes;
+    let discarded = [];
+    if (service === undefined) {
+        verification = buildVerification(checklist, answers, recorded, reports);
+        // The legacy all-at-once form keeps the one file, deliberately. It answers
+        // the whole checklist from one place on one word, with no commit and no
+        // service, so there is no second writer for it to collide with and no
+        // service to name a file after — and every record it ever wrote, the
+        // example fleet's included, stays byte-for-byte what it is. The moment a
+        // service attests, the refusal above keeps it off the record for good.
+        writes = [{ path: verificationPath(featureDir), record: verification, preImage: previous?.files.legacy?.raw ?? null }];
+    }
+    else {
+        // The docs side of the pin, and it is ASKED FOR rather than required: a
+        // docs repo is not obliged to be a git checkout, and the attestation simply
+        // carries no `docsCommit` when git cannot answer. Failing the record over
+        // it would refuse a working fleet for a field that is optional by design.
+        const docsHead = await repositoryCommit(docsDir);
+        const files = previous?.files ?? { legacy: null, services: new Map() };
+        const own = files.services.get(service) ?? null;
+        const built = buildServiceRecord(checklist, {
+            service,
+            recorded,
+            commit: serviceCommit,
+            reports,
+            ...(docsHead.ok ? { docsCommit: docsHead.commit } : {}),
+        }, answers, { legacy: files.legacy?.verification ?? null, own: own?.verification ?? null, filed: new Set(files.services.keys()) });
+        discarded = built.discarded;
+        // This service's own file FIRST — see `commitVerification` for why the
+        // order is what a kill between the two renames leaves standing.
+        writes = [
+            { path: serviceRecordPath(featureDir, service), record: built.record, preImage: own?.raw ?? null },
+            ...(built.dropLegacy && files.legacy !== null
+                ? [{ path: files.legacy.path, record: null, preImage: files.legacy.raw }]
+                : []),
+        ];
+        const after = new Map([...files.services].map(([svc, file]) => [svc, file.verification]));
+        after.set(service, built.record);
+        // Added up against THIS checklist — the one the answers just written
+        // answer. Left to pick by date, a same-day file with a later service id
+        // that answered an older checklist won the tie, and this run printed a
+        // tally its own answers were not in (`core/verify/read/union.ts`).
+        verification = assembleRecord(built.dropLegacy ? null : (files.legacy?.verification ?? null), [...after.keys()].sort().map((svc) => after.get(svc)), checklist.digest);
+    }
+    // Staged, compared against the locked read's bytes, swapped in by one
+    // rename per file — see core/verify/store/commit.ts for what each refusal
+    // means.
+    const committed = await commitVerification(writes, docsDir);
+    if (!committed.ok)
+        return fail(json, committed.code, committed.message);
+    const path = writes[0].path;
+    const unconfirmed = verification.claims.filter((c) => c.verdict === "unconfirmed");
+    // The same judgment read mode makes (see report): the record just written IS
+    // the current checklist's answer, so `stale` is false by construction and the
+    // remaining question is whether every claim was confirmed — and, now, by
+    // whom. Counted from the claims, not from the summary this same call wrote.
+    // Without these fields an agent that recorded all-confirmed answers would
+    // have to re-run verify just to learn the state it created.
+    const tally = tallyRecord(verification);
+    const verdict = verificationVerdict(tally);
+    const verified = verdict === "verified";
+    const notices = [
+        ...noticesFor(verification.claims, verification.feature),
+        // The read view's notice, on the write that makes it true: a service
+        // whose file answered another version of the checklist is named here,
+        // because its answers are exactly the ones this tally leaves out.
+        ...forkedChecklistNotices(verification, checklist.digest),
+        ...contestedNotices(runnerClaims),
+        ...contestedOperationNotices(contractClaims),
+        ...(pinNotice === null ? [] : [pinNotice]),
+    ];
+    if (json) {
+        emitJson({
+            command: "verify",
+            feature: verification.feature,
+            path: repoPath(docsDir, path),
+            ...(target.recovered == null ? {} : { recovered: target.recovered }),
+            digest: verification.checklist,
+            verified,
+            verdict,
+            attested: tally.attested,
+            recorded: verification.recorded,
+            summary: verification.summary,
+            ...(verification.attestations === undefined ? {} : { attestations: verification.attestations }),
+            ...(reports.results === undefined ? {} : { report: reports.results }),
+            ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),
+            unconfirmed: unconfirmed.map((c) => ({ id: c.id, claim: c.claim, ...(c.note === undefined ? {} : { note: c.note }) })),
+            ...(discarded.length === 0 ? {} : { discarded }),
+            ...(notices.length === 0 ? {} : { notices }),
+        });
+        return;
+    }
+    if (target.recovered != null)
+        console.log(`${sayRecovered(target.recovered)}\n`);
+    console.log(`${verification.feature} verification recorded — ${repoPath(docsDir, path)}\n`);
+    console.log(`  ${tally.confirmed} of ${plural(tally.claims, "claim")} confirmed with evidence.`);
+    if (reports.results !== undefined) {
+        console.log(`  ${plural(fromRunner.length, "scenario claim")} answered by the test runner (${opts.results}).`);
+        console.log(`  Report read: ${reportLine(reports.results)}.`);
+    }
+    if (reports.contract !== undefined) {
+        console.log(`  ${plural(fromContract.length, "api.exposes claim")} answered by the contract test run (${opts.contractResults}).`);
+        console.log(`  Contract report read: ${contractReportLine(reports.contract)}.`);
+    }
+    if (opts.record !== undefined && (reports.results !== undefined || reports.contract !== undefined)) {
+        console.log(`  ${plural(checked.answers.length, "claim")} answered by ${opts.record}.`);
+    }
+    if (service !== undefined) {
+        const attestation = verification.attestations?.find((item) => item.service === service);
+        if (attestation !== undefined) {
+            console.log(`  ${service} attested at git commit ${attestation.commit}.`);
+        }
+    }
+    for (const c of unconfirmed) {
+        console.log(`  ✗ ${c.claim}${c.note === undefined ? "" : ` — ${c.note}`}`);
+    }
+    sayDiscarded(discarded, repoPath(docsDir, recordLocation(featureDir)), verification.feature);
+    console.log("");
+    for (const notice of notices)
+        console.log(`  ⚠ ${notice.code}: ${notice.message}`);
+    console.log(tally.unanswered > 0
+        ? `  Partial federation — ${plural(tally.unanswered, "claim")} remain unanswered for their owning service repositories.`
+        : verdict === "attested"
+            ? "  Recorded as attested, not verified: the record travels into features/archive/ saying so."
+            : unconfirmed.length === 0
+                ? "  The record travels with the feature into features/archive/."
+                : "  Recorded as it stands. Nothing gates on this — it is what a reviewer reads later, so leave it true.");
+}
+//# sourceMappingURL=record.js.map

package/dist/commands/verify/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../../../src/commands/verify/record.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAe,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,4BAA4B,CAAC;AACzG,OAAO,EAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAoB,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAoB,MAAM,mCAAmC,CAAC;AACzF,OAAO,EACL,WAAW,EAIX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEpG,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAqB,MAAM,aAAa,CAAC;AAkDhD,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAoB,EACpB,SAAoB,EACpB,QAAkB,EAClB,IAAmB;IAEnB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAChD,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,qEAAqE;IACrE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,QAAQ,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,OAAO,IAAI,CACT,IAAI,EACJ,kBAAkB,EAClB,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD;YAC3L,kFAAkF;YAClF,yEAAyE,SAAS,CAAC,OAAO,2CAA2C,CACxI,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC3G,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,IAAI,CACT,IAAI,EACJ,iBAAiB,EACjB,eAAe,SAAS,CAAC,OAAO,8CAA8C,OAAO,IAAI,CAC1F,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;IAC7F,MAAM,cAAc,GAClB,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACjG,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;QAC5D,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CACnE,CAAC;IAEF,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,4EAA4E;QAC5E,yCAAyC;QACzC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC9B,UAAU,GAAG,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1G,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC/B,YAAY,GAAG,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,GAAG,GAAY,EAAE,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CACT,IAAI,EACJ,oBAAoB,EACpB,eAAe,IAAI,CAAC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,GAAG;YACX,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC;SAC1G,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChB,OAAO,IAAI,CACT,IAAI,EACJ,kBAAkB,EAClB,GAAG,IAAI,KAAK,WAAW,CAAC,MAAM,4BAA4B;YACxD,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAC1B,WAAW,EACX,GAAG,EACH,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;QAC9D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAClE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAC9E,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,aAAiC,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,SAAS,GAAwB,IAAI,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,mEAAmE;QACnE,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;QAChI,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CACT,IAAI,EACJ,qBAAqB,EACrB,GAAG,QAAQ,CAAC,OAAO,wEAAwE;gBACzF,6FAA6F,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnC,oEAAoE;IACpE,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1C,IAAI,YAA0B,CAAC;IAC/B,IAAI,MAAqB,CAAC;IAC1B,IAAI,SAAS,GAAsB,EAAE,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,YAAY,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACzH,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QAChD,MAAM,KAAK,GAAG,kBAAkB,CAC9B,SAAS,EACT;YACE,OAAO;YACP,QAAQ;YACR,MAAM,EAAE,aAAc;YACtB,OAAO;YACP,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,EACD,OAAO,EACP,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,IAAI,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CACtH,CAAC;QACF,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAC5B,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,GAAG;YACP,EAAE,IAAI,EAAE,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE;YAClG,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;gBAC3C,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBACzE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,YAAY,GAAG,cAAc,CAC3B,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC,EAC9D,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,EACtD,SAAS,CAAC,MAAM,CAChB,CAAC;IACL,CAAC;IACD,sEAAsE;IACtE,0EAA0E;IAC1E,SAAS;IACT,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;IAC7B,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC;IAEnF,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC;IACxC,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;QACxD,qEAAqE;QACrE,sEAAsE;QACtE,kEAAkE;QAClE,GAAG,sBAAsB,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC;QACzD,GAAG,gBAAgB,CAAC,YAAY,CAAC;QACjC,GAAG,yBAAyB,CAAC,cAAc,CAAC;QAC5C,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KAC3C,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACpE,MAAM,EAAE,YAAY,CAAC,SAAS;YAC9B,QAAQ;YACR,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,GAAG,CAAC,YAAY,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC;YAC/F,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/E,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACtH,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YAChD,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,4BAA4B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,SAAS,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,iCAAiC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/G,OAAO,CAAC,GAAG,CAAC,kBAAkB,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,mBAAmB,CAAC,uCAAuC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAClI,OAAO,CAAC,GAAG,CAAC,2BAA2B,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACxF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,2BAA2B,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,UAAU,GAAG,CAAC;QAClB,CAAC,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,2DAA2D;QACxH,CAAC,CAAC,OAAO,KAAK,UAAU;YACtB,CAAC,CAAC,4FAA4F;YAC9F,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,+DAA+D;gBACjE,CAAC,CAAC,uGAAuG,CAChH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Writing the answers down.\n *\n * The one command in loam that takes somebody's word for something, so every\n * refusal here is about whose word is on the file. The legacy all-at-once form\n * run over a federated record does not merge and does not migrate — it would\n * erase every other service's commit-bound attestation, invisibly, because what\n * replaces it is a well-formed and plausible record.\n */\nimport { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { emitJson, fail, repoPath } from \"../../core/envelope/json.js\";\nimport { today } from \"../../core/provenance/stamp.js\";\nimport { runnerAnswers } from \"../../core/results.js\";\nimport { checkAnswers, type Answer } from \"../../core/verify/answers.js\";\nimport { buildServiceRecord, buildVerification, type DiscardedAnswer } from \"../../core/verify/build.js\";\nimport { type Checklist } from \"../../core/verify/checklist.js\";\nimport { contractAnswers } from \"../../core/verify/evidence/contract.js\";\nimport { type RecordFiles } from \"../../core/verify/read/file.js\";\nimport { assembleRecord } from \"../../core/verify/read/union.js\";\nimport { commitVerification, type RecordWrite } from \"../../core/verify/store/commit.js\";\nimport {\n  tallyRecord,\n  type ConsumedReports,\n  type Verification,\n  type VerifyNotice,\n  verificationVerdict,\n} from \"../../core/verify/record.js\";\nimport { recordLocation, serviceRecordPath, verificationPath } from \"../../core/verify/location.js\";\nimport type { PathableService } from \"../../core/kernel/ids/service.js\";\nimport { plural, sayDiscarded, sayRecovered } from \"../policy/format.js\";\nimport { readContractResults } from \"./evidence/contract.js\";\nimport { claimTokens, pinAnswers } from \"./evidence/pins.js\";\nimport { readResults, repositoryCommit, validateLocalEvidence, validateServiceEvidence } from \"./results.js\";\nimport {\n  contestedNotices,\n  contestedOperationNotices,\n  contractReportLine,\n  forkedChecklistNotices,\n  noticesFor,\n  reportLine,\n} from \"./frozen.js\";\nimport { type VerifyTarget } from \"./report.js\";\n\n/** The flags `loam verify --record` reads. */\nexport interface VerifyOptions {\n  record?: string;\n  results?: string;\n  contractResults?: string;\n  /** `--diff-answers a.json b.json` — the read-only cross-examination lens\n   * (./cross/diff.ts): both files validate against the current checklist and\n   * nothing is written. verify.ts refuses recording combinations and arity ≠ 2. */\n  diffAnswers?: string[];\n  service?: string;\n  json?: boolean;\n}\n\n/**\n * The repository whose word this record is taking, for which service, and over\n * which existing record.\n *\n * `previous` belongs here rather than beside it: every refusal in this function\n * is about whether THIS attestor may write over what that record already says,\n * so the two are never asked about separately.\n */\nexport interface Attestor {\n  /**\n   * Undefined in the legacy all-at-once form, which answers for every service.\n   * Branded because it becomes a file name (`verification/<svc>.yaml`): the\n   * caller hands in loam.json's own validated id, never the raw flag.\n   */\n  service: PathableService | undefined;\n  /**\n   * The repository an attestation is ABOUT: the commit it names, the tree its\n   * evidence must resolve inside, and where a `--results` report has to live.\n   * It is threaded rather than read in `record` because it comes from\n   * `config.root`, and a `process.cwd()` in that function was the whole bug —\n   * from a subdirectory, \"this repo\" quietly became that subdirectory.\n   */\n  repoDir: string;\n  /**\n   * The existing record as ONE read — the union the refusals consult and the\n   * files it was added up from, each with the exact bytes it was parsed from —\n   * or null when there was no record. One field rather than a `Verification`\n   * beside a set of `Buffer`s because they are meaningless apart: a pre-image\n   * from any other read would let the commit vouch for a document the merge\n   * never saw, and as separate fields that inconsistent pair is representable\n   * and compiles.\n   */\n  previous: { verification: Verification; files: RecordFiles } | null;\n}\n\nexport async function record(\n  target: VerifyTarget,\n  checklist: Checklist,\n  attestor: Attestor,\n  opts: VerifyOptions,\n): Promise<void> {\n  const { docsDir, featureDir, json } = target;\n  const { service, repoDir, previous } = attestor;\n  // The legacy all-at-once form answers the WHOLE checklist on one repository's\n  // word and writes a schema-1 record — no attestations, no commits. Run over a\n  // federated record it does not merge and it does not migrate: over a one-file\n  // federated record it would erase every other service's commit-bound\n  // attestation, invisibly, because what replaces it is a well-formed,\n  // plausible record; beside a `verification/` directory it would write a file\n  // whose answers can never count (no attestation binds them) while reporting\n  // them as recorded. Either way it refuses, and names the repositories whose\n  // word is on the record.\n  const attested = previous?.verification.schema === 2 ? (previous.verification.attestations ?? []) : [];\n  if (service === undefined && attested.length > 0) {\n    const services = [...new Set(attested.map((a) => a.service))].sort();\n    return fail(\n      json,\n      \"record-federated\",\n      `${repoPath(docsDir, recordLocation(featureDir))} is a federated record: ${plural(services.length, \"service\")} (${services.join(\", \")}) have attested claims against their own git commits. ` +\n        \"Recording without --service would put one unattested answer set over all of it. \" +\n        `Record this service's claims from its own repo instead: \\`loam verify ${checklist.feature} --record answers.json --service <svc>\\`.`,\n    );\n  }\n\n  const scopedClaims =\n    service === undefined ? checklist.claims : checklist.claims.filter((claim) => claim.subject === service);\n  if (service !== undefined && scopedClaims.length === 0) {\n    return fail(\n      json,\n      \"unknown-service\",\n      `The current ${checklist.feature} checklist has no claims owned by service '${service}'.`,\n    );\n  }\n\n  // The mechanical halves: with --results, every scenario.tested claim is the\n  // cucumber report's to answer — matched by digest, confirmed only by a green\n  // run — and with --contract-results, every api.exposes claim is the contract\n  // report's, matched by operationId under the same ownership discipline. A\n  // partial suite leaves its unexercised claims unconfirmed rather than\n  // agent-attestable in the same run: silence must not read as checked, and\n  // the escape is a --record run without the flag.\n  const runnerClaims =\n    opts.results === undefined ? [] : scopedClaims.filter((c) => c.kind === \"scenario.tested\");\n  const contractClaims =\n    opts.contractResults === undefined ? [] : scopedClaims.filter((c) => c.kind === \"api.exposes\");\n  const agentClaims = scopedClaims.filter(\n    (c) =>\n      (opts.results === undefined || c.kind !== \"scenario.tested\") &&\n      (opts.contractResults === undefined || c.kind !== \"api.exposes\"),\n  );\n\n  let fromRunner: Answer[] = [];\n  let fromContract: Answer[] = [];\n  const reports: ConsumedReports = {};\n  if (opts.results !== undefined) {\n    // A federated record attests for THIS repository, so its report has to be a\n    // file inside it — see evidence/read.ts.\n    const read = await readResults(opts.results, service === undefined ? undefined : repoDir);\n    if (!read.ok) return fail(json, read.code, read.message);\n    reports.results = read.report;\n    fromRunner = runnerAnswers(runnerClaims, read.scenarios, read.report.path);\n  }\n  if (opts.contractResults !== undefined) {\n    // Same resolution rules as the cucumber report, same refusal code: the two\n    // pins make the same promise about the same repository.\n    const read = await readContractResults(opts.contractResults, service === undefined ? undefined : repoDir);\n    if (!read.ok) return fail(json, read.code, read.message);\n    reports.contract = read.report;\n    fromContract = contractAnswers(contractClaims, read.runs, read.report.path);\n  }\n\n  // The agent's half — exactly what no report owns. A mechanical flag alone is\n  // legal only when the reports own the whole checklist: anything left over\n  // refuses with the ids, the same discipline as a claim with no answer.\n  let raw: unknown = [];\n  if (opts.record !== undefined) {\n    try {\n      // The one path that stays cwd-relative, and deliberately: the answer set\n      // is a file the caller just wrote and hands to the command, not part of\n      // the repository being attested. Nothing on the record points at it.\n      raw = JSON.parse(await readFile(resolve(process.cwd(), opts.record), \"utf8\"));\n    } catch (err) {\n      return fail(\n        json,\n        \"answers-unreadable\",\n        `Cannot read ${opts.record}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  } else if (agentClaims.length > 0 && (opts.results !== undefined || opts.contractResults !== undefined)) {\n    const owns = [\n      ...(opts.results === undefined ? [] : [\"--results answers only the scenario.tested claims\"]),\n      ...(opts.contractResults === undefined ? [] : [\"--contract-results answers only the api.exposes claims\"]),\n    ].join(\" and \");\n    return fail(\n      json,\n      \"answers-mismatch\",\n      `${owns}; ${agentClaims.length} claim(s) have no answer: ` +\n        `${agentClaims.map((c) => c.id).join(\", \")}. Record them with --record <answers.json> alongside.`,\n    );\n  }\n\n  const checked = checkAnswers(\n    agentClaims,\n    raw,\n    opts.results === undefined && opts.contractResults === undefined\n      ? undefined\n      : new Set([...runnerClaims, ...contractClaims].map((c) => c.id)),\n    { feature: checklist.feature, ...(service === undefined ? {} : { service }) },\n  );\n  if (!checked.ok) return fail(json, checked.code, checked.message);\n\n  let serviceCommit: string | undefined;\n  let answers = [...fromRunner, ...fromContract, ...checked.answers];\n  let pinNotice: VerifyNotice | null = null;\n  if (service !== undefined) {\n    const commit = await repositoryCommit(repoDir);\n    if (!commit.ok) return fail(json, \"repository-unavailable\", commit.message);\n    serviceCommit = commit.commit;\n    // All halves, one validator. The runner's evidence used to skip it\n    // entirely: `--results` minted confirmations whose evidence strings nothing\n    // ever checked, in the one mode that promises every answer is bound to this\n    // repository at this commit. The same pass stamps each agent citation's\n    // evidence pin and scans its blob for the claim's token (evidence/pins.ts).\n    const evidence = await validateServiceEvidence(answers, { repoDir, commit: serviceCommit }, reports, claimTokens(scopedClaims));\n    if (!evidence.ok) return fail(json, \"answers-unevidenced\", evidence.message);\n    ({ answers, notice: pinNotice } = pinAnswers(answers, evidence, serviceCommit));\n  } else {\n    // The all-at-once form binds to no commit, but a citation still has to be\n    // a line that exists — see `validateLocalEvidence`. Resolved against the\n    // repository loam.json was found in, which is the one place a reviewer\n    // reading this record can go and look.\n    const evidence = await validateLocalEvidence(answers, repoDir);\n    if (!evidence.ok) {\n      return fail(\n        json,\n        \"answers-unevidenced\",\n        `${evidence.message} The all-at-once form resolves every citation inside this repository; ` +\n          \"evidence that lives in a service's own repository is recorded from there, with `--service`.\",\n      );\n    }\n  }\n\n  const recorded = today(new Date());\n  // What goes on disk and what the record reads as afterwards are two\n  // different objects now. The all-at-once form IS its file. A service's write\n  // is one file among several, so the verdict it prints is the union of the\n  // files as they will stand once the commit lands — added up by the very\n  // function the next read will use, so this run cannot print a verdict the\n  // following `loam verify` disagrees with.\n  let verification: Verification;\n  let writes: RecordWrite[];\n  let discarded: DiscardedAnswer[] = [];\n  if (service === undefined) {\n    verification = buildVerification(checklist, answers, recorded, reports);\n    // The legacy all-at-once form keeps the one file, deliberately. It answers\n    // the whole checklist from one place on one word, with no commit and no\n    // service, so there is no second writer for it to collide with and no\n    // service to name a file after — and every record it ever wrote, the\n    // example fleet's included, stays byte-for-byte what it is. The moment a\n    // service attests, the refusal above keeps it off the record for good.\n    writes = [{ path: verificationPath(featureDir), record: verification, preImage: previous?.files.legacy?.raw ?? null }];\n  } else {\n    // The docs side of the pin, and it is ASKED FOR rather than required: a\n    // docs repo is not obliged to be a git checkout, and the attestation simply\n    // carries no `docsCommit` when git cannot answer. Failing the record over\n    // it would refuse a working fleet for a field that is optional by design.\n    const docsHead = await repositoryCommit(docsDir);\n    const files = previous?.files ?? { legacy: null, services: new Map() };\n    const own = files.services.get(service) ?? null;\n    const built = buildServiceRecord(\n      checklist,\n      {\n        service,\n        recorded,\n        commit: serviceCommit!,\n        reports,\n        ...(docsHead.ok ? { docsCommit: docsHead.commit } : {}),\n      },\n      answers,\n      { legacy: files.legacy?.verification ?? null, own: own?.verification ?? null, filed: new Set(files.services.keys()) },\n    );\n    discarded = built.discarded;\n    // This service's own file FIRST — see `commitVerification` for why the\n    // order is what a kill between the two renames leaves standing.\n    writes = [\n      { path: serviceRecordPath(featureDir, service), record: built.record, preImage: own?.raw ?? null },\n      ...(built.dropLegacy && files.legacy !== null\n        ? [{ path: files.legacy.path, record: null, preImage: files.legacy.raw }]\n        : []),\n    ];\n    const after = new Map([...files.services].map(([svc, file]) => [svc, file.verification]));\n    after.set(service, built.record);\n    // Added up against THIS checklist — the one the answers just written\n    // answer. Left to pick by date, a same-day file with a later service id\n    // that answered an older checklist won the tie, and this run printed a\n    // tally its own answers were not in (`core/verify/read/union.ts`).\n    verification = assembleRecord(\n      built.dropLegacy ? null : (files.legacy?.verification ?? null),\n      [...after.keys()].sort().map((svc) => after.get(svc)!),\n      checklist.digest,\n    )!;\n  }\n  // Staged, compared against the locked read's bytes, swapped in by one\n  // rename per file — see core/verify/store/commit.ts for what each refusal\n  // means.\n  const committed = await commitVerification(writes, docsDir);\n  if (!committed.ok) return fail(json, committed.code, committed.message);\n  const path = writes[0]!.path;\n  const unconfirmed = verification.claims.filter((c) => c.verdict === \"unconfirmed\");\n\n  // The same judgment read mode makes (see report): the record just written IS\n  // the current checklist's answer, so `stale` is false by construction and the\n  // remaining question is whether every claim was confirmed — and, now, by\n  // whom. Counted from the claims, not from the summary this same call wrote.\n  // Without these fields an agent that recorded all-confirmed answers would\n  // have to re-run verify just to learn the state it created.\n  const tally = tallyRecord(verification);\n  const verdict = verificationVerdict(tally);\n  const verified = verdict === \"verified\";\n  const notices = [\n    ...noticesFor(verification.claims, verification.feature),\n    // The read view's notice, on the write that makes it true: a service\n    // whose file answered another version of the checklist is named here,\n    // because its answers are exactly the ones this tally leaves out.\n    ...forkedChecklistNotices(verification, checklist.digest),\n    ...contestedNotices(runnerClaims),\n    ...contestedOperationNotices(contractClaims),\n    ...(pinNotice === null ? [] : [pinNotice]),\n  ];\n\n  if (json) {\n    emitJson({\n      command: \"verify\",\n      feature: verification.feature,\n      path: repoPath(docsDir, path),\n      ...(target.recovered == null ? {} : { recovered: target.recovered }),\n      digest: verification.checklist,\n      verified,\n      verdict,\n      attested: tally.attested,\n      recorded: verification.recorded,\n      summary: verification.summary,\n      ...(verification.attestations === undefined ? {} : { attestations: verification.attestations }),\n      ...(reports.results === undefined ? {} : { report: reports.results }),\n      ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),\n      unconfirmed: unconfirmed.map((c) => ({ id: c.id, claim: c.claim, ...(c.note === undefined ? {} : { note: c.note }) })),\n      ...(discarded.length === 0 ? {} : { discarded }),\n      ...(notices.length === 0 ? {} : { notices }),\n    });\n    return;\n  }\n\n  if (target.recovered != null) console.log(`${sayRecovered(target.recovered)}\\n`);\n  console.log(`${verification.feature} verification recorded — ${repoPath(docsDir, path)}\\n`);\n  console.log(`  ${tally.confirmed} of ${plural(tally.claims, \"claim\")} confirmed with evidence.`);\n  if (reports.results !== undefined) {\n    console.log(`  ${plural(fromRunner.length, \"scenario claim\")} answered by the test runner (${opts.results}).`);\n    console.log(`  Report read: ${reportLine(reports.results)}.`);\n  }\n  if (reports.contract !== undefined) {\n    console.log(`  ${plural(fromContract.length, \"api.exposes claim\")} answered by the contract test run (${opts.contractResults}).`);\n    console.log(`  Contract report read: ${contractReportLine(reports.contract)}.`);\n  }\n  if (opts.record !== undefined && (reports.results !== undefined || reports.contract !== undefined)) {\n    console.log(`  ${plural(checked.answers.length, \"claim\")} answered by ${opts.record}.`);\n  }\n  if (service !== undefined) {\n    const attestation = verification.attestations?.find((item) => item.service === service);\n    if (attestation !== undefined) {\n      console.log(`  ${service} attested at git commit ${attestation.commit}.`);\n    }\n  }\n  for (const c of unconfirmed) {\n    console.log(`  ✗ ${c.claim}${c.note === undefined ? \"\" : ` — ${c.note}`}`);\n  }\n\n  sayDiscarded(discarded, repoPath(docsDir, recordLocation(featureDir)), verification.feature);\n  console.log(\"\");\n  for (const notice of notices) console.log(`  ⚠ ${notice.code}: ${notice.message}`);\n  console.log(\n    tally.unanswered > 0\n      ? `  Partial federation — ${plural(tally.unanswered, \"claim\")} remain unanswered for their owning service repositories.`\n      : verdict === \"attested\"\n        ? \"  Recorded as attested, not verified: the record travels into features/archive/ saying so.\"\n        : unconfirmed.length === 0\n          ? \"  The record travels with the feature into features/archive/.\"\n          : \"  Recorded as it stands. Nothing gates on this — it is what a reviewer reads later, so leave it true.\",\n  );\n}\n"]}

package/dist/commands/verify/report.js

@@ -0,0 +1,206 @@
+/**
+ * The done-check as an answer: every claim, its verdict, and who said so.
+ *
+ * The per-claim rows are computed once and both surfaces read them — `--json`
+ * and the terminal cannot disagree about a count, which is the failure this
+ * shape prevents. The federation note is here rather than at the call sites
+ * because a federated record answers per SERVICE and a reader looking at one
+ * lens has to be told which of the others have not answered yet.
+ */
+import { emitJson, repoPath } from "../../core/envelope/json.js";
+import {} from "../../core/staging/interrupted.js";
+import {} from "../../core/verify/answers.js";
+import {} from "../../core/verify/checklist.js";
+import {} from "../../core/verify/pins/pin.js";
+import { countedAnswers, openClaimsNotice, tallyAnswers, verificationVerdict, } from "../../core/verify/record.js";
+import { verificationDir } from "../../core/verify/location.js";
+import { EXPLAIN_FOOTER, plural } from "../policy/format.js";
+import { answeredMark, contestedNotices, contractReportLine, forkedChecklistNotices, MARK, noticesFor, recordedPayload, reportLine, } from "./frozen.js";
+export function statuses(checklist, claims, recorded) {
+    const byId = recorded === null ? new Map() : countedAnswers(checklist.claims, recorded);
+    return claims.map((c) => {
+        const answer = byId.get(c.id);
+        return {
+            id: c.id,
+            kind: c.kind,
+            subject: c.subject,
+            claim: c.claim,
+            verdict: answer?.verdict ?? "unanswered",
+            ...(answer?.answered_by === undefined ? {} : { answered_by: answer.answered_by }),
+            evidence: answer?.evidence ?? [],
+            ...(answer?.note === undefined ? {} : { note: answer.note }),
+            ...(answer?.evidence_pins === undefined ? {} : { evidence_pins: answer.evidence_pins }),
+        };
+    });
+}
+/**
+ * The read view.
+ *
+ * `lens` is `--service`: the same checklist, narrowed to the claims that
+ * service's code answers. It exists because in a ten-repo fleet the whole
+ * checklist is never one repository's business, and an agent that cannot ask
+ * "what do I still owe on FEAT-1?" answers the question by guessing. Narrowing
+ * narrows the verdict too — `verified` then means "every claim owned by this
+ * service is confirmed", which is why the payload names the service it applied.
+ *
+ * `bound` is loam.json's `service` — what this repository says it is. It only
+ * shapes the footer, and it is the whole of how federation is discoverable:
+ * the recording form printed here is the one that will actually work from here.
+ */
+export function report(target, checklist, recorded, scope = {}) {
+    const { docsDir, featureDir, json } = target;
+    const lens = scope.lens;
+    const owners = [...new Set(checklist.claims.map((c) => c.subject))].sort();
+    const scoped = lens === undefined ? checklist.claims : checklist.claims.filter((c) => c.subject === lens);
+    const claims = statuses(checklist, scoped, recorded);
+    const tally = tallyAnswers(claims);
+    // The payload's `summary` is the tally without its `attested` count, which
+    // travels as a key of its own beside it.
+    const summary = { claims: tally.claims, confirmed: tally.confirmed, unconfirmed: tally.unconfirmed, unanswered: tally.unanswered };
+    // A record that answers a different question set is not an answer to this one,
+    // however complete it looks — so staleness disqualifies it as a whole.
+    const stale = recorded !== null && recorded.checklist !== checklist.digest;
+    const verdict = verificationVerdict(tally, stale);
+    // `verified` keeps its name and its type, and loses its old meaning: a
+    // scenario claim on an agent's word is answered, not run, so it no longer
+    // reads the same as a green suite. `verdict` carries the distinction.
+    const verified = verdict === "verified";
+    // Contest is derivable from the checklist alone, so the read view says it
+    // too: an agent looking at what it owes should learn that a second service
+    // answers the same claim BEFORE it runs a suite whose report cannot be
+    // attributed. Always from the whole checklist, never the lens — a shared
+    // digest is a fact about the feature, and a narrowed view is the one place it
+    // would otherwise be invisible.
+    // The open-claims honesty line only where a record EXISTS: with none, the
+    // surface already says "Not verified", and not-started is not partial.
+    const open = recorded === null ? null : openClaimsNotice(tally, checklist.feature);
+    const notices = [
+        ...noticesFor(claims, checklist.feature),
+        ...(open === null ? [] : [open]),
+        ...contestedNotices(checklist.claims),
+        ...forkedChecklistNotices(recorded, checklist.digest),
+    ];
+    if (json) {
+        emitJson({
+            command: "verify",
+            feature: checklist.feature,
+            path: repoPath(docsDir, featureDir),
+            digest: checklist.digest,
+            // Named only when narrowed, so a consumer can never mistake a service's
+            // verdict for the feature's.
+            ...(lens === undefined ? {} : { service: lens, checklistClaims: checklist.claims.length }),
+            verified,
+            verdict,
+            attested: tally.attested,
+            summary,
+            services: owners,
+            recorded: recorded === null ? null : recordedPayload(target, recorded, { stale }),
+            claims,
+            ...(notices.length === 0 ? {} : { notices }),
+        });
+        return;
+    }
+    const scopeNote = lens === undefined ? "" : ` owned by ${lens} (of ${plural(checklist.claims.length, "claim")} on the checklist)`;
+    console.log(`${checklist.feature} — ${plural(claims.length, "claim")}${scopeNote} derived from ${repoPath(docsDir, featureDir)}\n`);
+    if (claims.length === 0) {
+        console.log(lens === undefined
+            ? "  Nothing to check: this feature's delta, specs and openapi promise nothing yet."
+            : `  No claim on this checklist is owned by '${lens}'.${owners.length > 0 ? ` The services that own claims here are ${owners.join(", ")}.` : ""}`);
+        return;
+    }
+    for (const c of claims) {
+        console.log(`  ${MARK[c.verdict]} ${c.id}  [${c.subject}]  ${c.claim}${answeredMark(c)}`);
+        for (const e of c.evidence)
+            console.log(`      ${e}`);
+        if (c.note !== undefined)
+            console.log(`      note: ${c.note}`);
+    }
+    console.log("");
+    if (recorded === null) {
+        // Both places a record can be, because which one the next record lands in
+        // depends on the form that writes it — a service's attestation goes to its
+        // own file under verification/, the all-at-once form to verification.yaml.
+        console.log(`  Not verified — no ${repoPath(docsDir, verificationDir(featureDir))}/ or verification.yaml yet.`);
+    }
+    else {
+        console.log(`  Recorded ${recorded.recorded} — ${summary.confirmed} confirmed, ${summary.unconfirmed} unconfirmed, ${summary.unanswered} unanswered.`);
+        if (stale) {
+            console.log("  STALE: the feature changed after this was recorded. Answer the claims above again.");
+        }
+        for (const attestation of recorded.attestations ?? []) {
+            console.log(`  Attested by ${attestation.service} at ${attestation.commit.slice(0, 12)} (${attestation.recorded}, ${plural(attestation.claims.length, "claim")}).`);
+            if (attestation.report !== undefined)
+                console.log(`      from ${reportLine(attestation.report)}`);
+            if (attestation.contractReport !== undefined) {
+                console.log(`      from ${contractReportLine(attestation.contractReport)}`);
+            }
+        }
+        if (recorded.report !== undefined)
+            console.log(`  Answered from ${reportLine(recorded.report)}.`);
+        if (recorded.contractReport !== undefined) {
+            console.log(`  Contract report read: ${contractReportLine(recorded.contractReport)}.`);
+        }
+    }
+    // The notice's code LEADS the line here, where validate's findings now carry
+    // theirs in a trailing `(code)` — and the two shapes are deliberate, not
+    // drift. A notice is one line and its code is its subject, so it reads as a
+    // label; a finding is one of hundreds in a report whose subject is the
+    // message, so its code is an aside. Appending a second copy to satisfy the
+    // one-shape instinct would print `⚠ verify.claims-open: … (verify.claims-open)`,
+    // and the leading form is also the one the frozen post-archive view prints
+    // (frozen.ts) — a live record and a shipped one must not describe the same
+    // notice two ways. Either way the code is on screen, which is the whole of
+    // what EXPLAIN_FOOTER below needs to be true.
+    for (const notice of notices)
+        console.log(`  ⚠ ${notice.code}: ${notice.message}`);
+    // An attested record has answered every question — telling it to "answer each
+    // claim" would send an agent round a loop it has already run. The notice
+    // above names the one thing left, which is a test run.
+    if (verdict === "unverified") {
+        console.log("\n  Answer each claim, then record the answers:\n");
+        console.log('    [{ "id": "<claim id>", "verdict": "confirmed", "evidence": ["src/x.ts:42"] }]');
+        console.log(`\n    loam verify ${checklist.feature} --record answers.json${recordSuffix(scope, owners)}`);
+        for (const line of federationNote(scope, owners))
+            console.log(line);
+        console.log("\n  A claim you cannot show evidence for is `unconfirmed` — say why in `note`.");
+    }
+    // APPENDED, as format.ts promises — the report's last line, never a wedge
+    // between the notices and the recording instructions that follow them. It
+    // follows printed notice codes only: claim marks carry no code to look up,
+    // and the frozen post-archive view (frozen.ts) stays without it on purpose,
+    // because shipped history is not a fix-it surface.
+    if (notices.length > 0)
+        console.log(`\n${EXPLAIN_FOOTER}`);
+}
+/**
+ * The `--service` the printed form should carry. It comes from loam.json, never
+ * from the checklist: the only attestation this repository can make is its own,
+ * and a hint naming a service that lives somewhere else is a hint that fails.
+ */
+export function recordSuffix(scope, owners) {
+    if (scope.bound !== undefined)
+        return ` --service ${scope.bound}`;
+    return owners.length > 1 || scope.lens !== undefined ? " --service <svc>" : "";
+}
+/** Why the form above has a `--service` on it — the one place federation is taught. */
+export function federationNote(scope, owners) {
+    if (scope.bound !== undefined) {
+        const others = owners.filter((s) => s !== scope.bound);
+        return [
+            "",
+            `  This repository is ${scope.bound}, so it attests only ${scope.bound}'s claims, bound to its git HEAD.`,
+            ...(others.length === 0
+                ? []
+                : [`  The claims owned by ${others.join(", ")} are recorded the same way from those repositories.`]),
+        ];
+    }
+    if (owners.length > 1 || scope.lens !== undefined) {
+        return [
+            "",
+            `  This checklist spans ${plural(owners.length, "service")} (${owners.join(", ")}) — each attests its own claims`,
+            "  from its own repository, where loam.json names that service.",
+        ];
+    }
+    return [];
+}
+//# sourceMappingURL=report.js.map

package/dist/commands/verify/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/commands/verify/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAuB,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAmB,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAoB,MAAM,+BAA+B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,YAAY,EAGZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AAerB,MAAM,UAAU,QAAQ,CAAC,SAAoB,EAAE,MAA2B,EAAE,QAA6B;IACvG,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAyB,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,YAAY;YACxC,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACjF,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE;YAChC,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAsBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,MAAM,CACpB,MAAoB,EACpB,SAAoB,EACpB,QAA6B,EAC7B,KAAK,GAAsC,EAAE;IAE7C,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,2EAA2E;IAC3E,yCAAyC;IACzC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IACnI,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC;IAC3E,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC;IACxC,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,8EAA8E;IAC9E,gCAAgC;IAChC,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;QACxC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,GAAG,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;KACtD,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;YACnC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,wEAAwE;YACxE,6BAA6B;YAC7B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1F,QAAQ;YACR,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;YACP,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC;YACjF,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GACb,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,QAAQ,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC;IAClH,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,CAAC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,iBAAiB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CACvH,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,6CAA6C,IAAI,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0CAA0C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,OAAO,CAAC,GAAG,CAAC,uBAAuB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAClH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,cAAc,QAAQ,CAAC,QAAQ,MAAM,OAAO,CAAC,SAAS,eAAe,OAAO,CAAC,WAAW,iBAAiB,OAAO,CAAC,UAAU,cAAc,CAC1I,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACtG,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CACT,iBAAiB,WAAW,CAAC,OAAO,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CACvJ,CAAC;YACF,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClG,IAAI,WAAW,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,kBAAkB,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClG,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,8EAA8E;IAC9E,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;QACjG,OAAO,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,OAAO,yBAAyB,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAChG,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwC,EAAE,MAAgB;IACrF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,cAAc,KAAK,CAAC,KAAK,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,KAAwC,EAAE,MAAgB;IACvF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO;YACL,EAAE;YACF,wBAAwB,KAAK,CAAC,KAAK,wBAAwB,KAAK,CAAC,KAAK,mCAAmC;YACzG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBACrB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO;YACL,EAAE;YACF,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;YACjH,gEAAgE;SACjE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC","sourcesContent":["/**\n * The done-check as an answer: every claim, its verdict, and who said so.\n *\n * The per-claim rows are computed once and both surfaces read them — `--json`\n * and the terminal cannot disagree about a count, which is the failure this\n * shape prevents. The federation note is here rather than at the call sites\n * because a federated record answers per SERVICE and a reader looking at one\n * lens has to be told which of the others have not answered yet.\n */\nimport { emitJson, repoPath } from \"../../core/envelope/json.js\";\nimport { type CommitRecovery } from \"../../core/staging/interrupted.js\";\nimport { type AnsweredBy } from \"../../core/verify/answers.js\";\nimport { type Checklist } from \"../../core/verify/checklist.js\";\nimport { type EvidencePin } from \"../../core/verify/pins/pin.js\";\nimport {\n  countedAnswers,\n  openClaimsNotice,\n  tallyAnswers,\n  type RecordedClaim,\n  type Verification,\n  verificationVerdict,\n} from \"../../core/verify/record.js\";\nimport { verificationDir } from \"../../core/verify/location.js\";\nimport { EXPLAIN_FOOTER, plural } from \"../policy/format.js\";\nimport {\n  answeredMark,\n  contestedNotices,\n  contractReportLine,\n  forkedChecklistNotices,\n  MARK,\n  noticesFor,\n  recordedPayload,\n  reportLine,\n} from \"./frozen.js\";\n\nexport interface ClaimStatus {\n  id: string;\n  kind: string;\n  subject: string;\n  claim: string;\n  verdict: \"confirmed\" | \"unconfirmed\" | \"unanswered\";\n  answered_by?: AnsweredBy;\n  evidence: string[];\n  note?: string;\n  /** The recorded pins, passed through where the record carries them — additive payload key. */\n  evidence_pins?: EvidencePin[];\n}\n\nexport function statuses(checklist: Checklist, claims: Checklist[\"claims\"], recorded: Verification | null): ClaimStatus[] {\n  const byId = recorded === null ? new Map<string, RecordedClaim>() : countedAnswers(checklist.claims, recorded);\n  return claims.map((c) => {\n    const answer = byId.get(c.id);\n    return {\n      id: c.id,\n      kind: c.kind,\n      subject: c.subject,\n      claim: c.claim,\n      verdict: answer?.verdict ?? \"unanswered\",\n      ...(answer?.answered_by === undefined ? {} : { answered_by: answer.answered_by }),\n      evidence: answer?.evidence ?? [],\n      ...(answer?.note === undefined ? {} : { note: answer.note }),\n      ...(answer?.evidence_pins === undefined ? {} : { evidence_pins: answer.evidence_pins }),\n    };\n  });\n}\n\n/**\n * Which feature is being reported on, and in what voice.\n *\n * Three of these travelled as loose strings beside two booleans through every\n * reporting path. They are one thing — the target of this run — and a record\n * makes the `--json` flag impossible to transpose with a lens name, which is\n * what the positional form allowed.\n */\nexport interface VerifyTarget {\n  docsDir: string;\n  featureDir: string;\n  json: boolean;\n  /**\n   * Non-null when the record path first rolled a predecessor's interrupted\n   * commit forward under its lock. Only `record` reports it; the read path\n   * never recovers, so it never carries one.\n   */\n  recovered?: CommitRecovery | null;\n}\n\n/**\n * The read view.\n *\n * `lens` is `--service`: the same checklist, narrowed to the claims that\n * service's code answers. It exists because in a ten-repo fleet the whole\n * checklist is never one repository's business, and an agent that cannot ask\n * \"what do I still owe on FEAT-1?\" answers the question by guessing. Narrowing\n * narrows the verdict too — `verified` then means \"every claim owned by this\n * service is confirmed\", which is why the payload names the service it applied.\n *\n * `bound` is loam.json's `service` — what this repository says it is. It only\n * shapes the footer, and it is the whole of how federation is discoverable:\n * the recording form printed here is the one that will actually work from here.\n */\nexport function report(\n  target: VerifyTarget,\n  checklist: Checklist,\n  recorded: Verification | null,\n  scope: { lens?: string; bound?: string } = {},\n): void {\n  const { docsDir, featureDir, json } = target;\n  const lens = scope.lens;\n  const owners = [...new Set(checklist.claims.map((c) => c.subject))].sort();\n  const scoped = lens === undefined ? checklist.claims : checklist.claims.filter((c) => c.subject === lens);\n  const claims = statuses(checklist, scoped, recorded);\n  const tally = tallyAnswers(claims);\n  // The payload's `summary` is the tally without its `attested` count, which\n  // travels as a key of its own beside it.\n  const summary = { claims: tally.claims, confirmed: tally.confirmed, unconfirmed: tally.unconfirmed, unanswered: tally.unanswered };\n  // A record that answers a different question set is not an answer to this one,\n  // however complete it looks — so staleness disqualifies it as a whole.\n  const stale = recorded !== null && recorded.checklist !== checklist.digest;\n  const verdict = verificationVerdict(tally, stale);\n  // `verified` keeps its name and its type, and loses its old meaning: a\n  // scenario claim on an agent's word is answered, not run, so it no longer\n  // reads the same as a green suite. `verdict` carries the distinction.\n  const verified = verdict === \"verified\";\n  // Contest is derivable from the checklist alone, so the read view says it\n  // too: an agent looking at what it owes should learn that a second service\n  // answers the same claim BEFORE it runs a suite whose report cannot be\n  // attributed. Always from the whole checklist, never the lens — a shared\n  // digest is a fact about the feature, and a narrowed view is the one place it\n  // would otherwise be invisible.\n  // The open-claims honesty line only where a record EXISTS: with none, the\n  // surface already says \"Not verified\", and not-started is not partial.\n  const open = recorded === null ? null : openClaimsNotice(tally, checklist.feature);\n  const notices = [\n    ...noticesFor(claims, checklist.feature),\n    ...(open === null ? [] : [open]),\n    ...contestedNotices(checklist.claims),\n    ...forkedChecklistNotices(recorded, checklist.digest),\n  ];\n\n  if (json) {\n    emitJson({\n      command: \"verify\",\n      feature: checklist.feature,\n      path: repoPath(docsDir, featureDir),\n      digest: checklist.digest,\n      // Named only when narrowed, so a consumer can never mistake a service's\n      // verdict for the feature's.\n      ...(lens === undefined ? {} : { service: lens, checklistClaims: checklist.claims.length }),\n      verified,\n      verdict,\n      attested: tally.attested,\n      summary,\n      services: owners,\n      recorded: recorded === null ? null : recordedPayload(target, recorded, { stale }),\n      claims,\n      ...(notices.length === 0 ? {} : { notices }),\n    });\n    return;\n  }\n\n  const scopeNote =\n    lens === undefined ? \"\" : ` owned by ${lens} (of ${plural(checklist.claims.length, \"claim\")} on the checklist)`;\n  console.log(\n    `${checklist.feature} — ${plural(claims.length, \"claim\")}${scopeNote} derived from ${repoPath(docsDir, featureDir)}\\n`,\n  );\n  if (claims.length === 0) {\n    console.log(\n      lens === undefined\n        ? \"  Nothing to check: this feature's delta, specs and openapi promise nothing yet.\"\n        : `  No claim on this checklist is owned by '${lens}'.${owners.length > 0 ? ` The services that own claims here are ${owners.join(\", \")}.` : \"\"}`,\n    );\n    return;\n  }\n  for (const c of claims) {\n    console.log(`  ${MARK[c.verdict]} ${c.id}  [${c.subject}]  ${c.claim}${answeredMark(c)}`);\n    for (const e of c.evidence) console.log(`      ${e}`);\n    if (c.note !== undefined) console.log(`      note: ${c.note}`);\n  }\n\n  console.log(\"\");\n  if (recorded === null) {\n    // Both places a record can be, because which one the next record lands in\n    // depends on the form that writes it — a service's attestation goes to its\n    // own file under verification/, the all-at-once form to verification.yaml.\n    console.log(`  Not verified — no ${repoPath(docsDir, verificationDir(featureDir))}/ or verification.yaml yet.`);\n  } else {\n    console.log(\n      `  Recorded ${recorded.recorded} — ${summary.confirmed} confirmed, ${summary.unconfirmed} unconfirmed, ${summary.unanswered} unanswered.`,\n    );\n    if (stale) {\n      console.log(\"  STALE: the feature changed after this was recorded. Answer the claims above again.\");\n    }\n    for (const attestation of recorded.attestations ?? []) {\n      console.log(\n        `  Attested by ${attestation.service} at ${attestation.commit.slice(0, 12)} (${attestation.recorded}, ${plural(attestation.claims.length, \"claim\")}).`,\n      );\n      if (attestation.report !== undefined) console.log(`      from ${reportLine(attestation.report)}`);\n      if (attestation.contractReport !== undefined) {\n        console.log(`      from ${contractReportLine(attestation.contractReport)}`);\n      }\n    }\n    if (recorded.report !== undefined) console.log(`  Answered from ${reportLine(recorded.report)}.`);\n    if (recorded.contractReport !== undefined) {\n      console.log(`  Contract report read: ${contractReportLine(recorded.contractReport)}.`);\n    }\n  }\n  // The notice's code LEADS the line here, where validate's findings now carry\n  // theirs in a trailing `(code)` — and the two shapes are deliberate, not\n  // drift. A notice is one line and its code is its subject, so it reads as a\n  // label; a finding is one of hundreds in a report whose subject is the\n  // message, so its code is an aside. Appending a second copy to satisfy the\n  // one-shape instinct would print `⚠ verify.claims-open: … (verify.claims-open)`,\n  // and the leading form is also the one the frozen post-archive view prints\n  // (frozen.ts) — a live record and a shipped one must not describe the same\n  // notice two ways. Either way the code is on screen, which is the whole of\n  // what EXPLAIN_FOOTER below needs to be true.\n  for (const notice of notices) console.log(`  ⚠ ${notice.code}: ${notice.message}`);\n  // An attested record has answered every question — telling it to \"answer each\n  // claim\" would send an agent round a loop it has already run. The notice\n  // above names the one thing left, which is a test run.\n  if (verdict === \"unverified\") {\n    console.log(\"\\n  Answer each claim, then record the answers:\\n\");\n    console.log('    [{ \"id\": \"<claim id>\", \"verdict\": \"confirmed\", \"evidence\": [\"src/x.ts:42\"] }]');\n    console.log(`\\n    loam verify ${checklist.feature} --record answers.json${recordSuffix(scope, owners)}`);\n    for (const line of federationNote(scope, owners)) console.log(line);\n    console.log(\"\\n  A claim you cannot show evidence for is `unconfirmed` — say why in `note`.\");\n  }\n  // APPENDED, as format.ts promises — the report's last line, never a wedge\n  // between the notices and the recording instructions that follow them. It\n  // follows printed notice codes only: claim marks carry no code to look up,\n  // and the frozen post-archive view (frozen.ts) stays without it on purpose,\n  // because shipped history is not a fix-it surface.\n  if (notices.length > 0) console.log(`\\n${EXPLAIN_FOOTER}`);\n}\n\n/**\n * The `--service` the printed form should carry. It comes from loam.json, never\n * from the checklist: the only attestation this repository can make is its own,\n * and a hint naming a service that lives somewhere else is a hint that fails.\n */\nexport function recordSuffix(scope: { lens?: string; bound?: string }, owners: string[]): string {\n  if (scope.bound !== undefined) return ` --service ${scope.bound}`;\n  return owners.length > 1 || scope.lens !== undefined ? \" --service <svc>\" : \"\";\n}\n\n/** Why the form above has a `--service` on it — the one place federation is taught. */\nexport function federationNote(scope: { lens?: string; bound?: string }, owners: string[]): string[] {\n  if (scope.bound !== undefined) {\n    const others = owners.filter((s) => s !== scope.bound);\n    return [\n      \"\",\n      `  This repository is ${scope.bound}, so it attests only ${scope.bound}'s claims, bound to its git HEAD.`,\n      ...(others.length === 0\n        ? []\n        : [`  The claims owned by ${others.join(\", \")} are recorded the same way from those repositories.`]),\n    ];\n  }\n  if (owners.length > 1 || scope.lens !== undefined) {\n    return [\n      \"\",\n      `  This checklist spans ${plural(owners.length, \"service\")} (${owners.join(\", \")}) — each attests its own claims`,\n      \"  from its own repository, where loam.json names that service.\",\n    ];\n  }\n  return [];\n}\n"]}