@ybotok/loam 0.2.0-alpha.6 → 0.2.0-alpha.9

package/dist/commands/verify/report.js

@@ -12,17 +12,12 @@ import {} from "../../core/staging/interrupted.js";
 import {} from "../../core/verify/answers.js";
 import {} from "../../core/verify/checklist.js";
 import {} from "../../core/verify/pins/pin.js";
-import { openClaimsNotice, tallyAnswers, verificationPath, verificationVerdict, } from "../../core/verify/record.js";
+import { countedAnswers, openClaimsNotice, tallyAnswers, verificationVerdict, } from "../../core/verify/record.js";
+import { verificationDir } from "../../core/verify/location.js";
 import { EXPLAIN_FOOTER, plural } from "../policy/format.js";
-import { answeredMark, contestedNotices, contractReportLine, forkedChecklistNotices, MARK, noticesFor, reportLine } from "./frozen.js";
+import { answeredMark, contestedNotices, contractReportLine, forkedChecklistNotices, MARK, noticesFor, recordedPayload, reportLine, } from "./frozen.js";
 export function statuses(checklist, claims, recorded) {
-    const subjects = new Map(checklist.claims.map((claim) => [claim.id, claim.subject]));
-    const attested = recorded?.schema !== 2
-        ? null
-        : new Set((recorded.attestations ?? []).flatMap((attestation) => attestation.claims.filter((id) => subjects.get(id) === attestation.service)));
-    const byId = new Map((recorded?.claims ?? [])
-        .filter((claim) => attested === null || attested.has(claim.id))
-        .map((claim) => [claim.id, claim]));
+    const byId = recorded === null ? new Map() : countedAnswers(checklist.claims, recorded);
     return claims.map((c) => {
         const answer = byId.get(c.id);
         return {
@@ -38,23 +33,33 @@ export function statuses(checklist, claims, recorded) {
         };
     });
 }
+/**
+ * The read view.
+ *
+ * `lens` is `--service`: the same checklist, narrowed to the claims that
+ * service's code answers. It exists because in a ten-repo fleet the whole
+ * checklist is never one repository's business, and an agent that cannot ask
+ * "what do I still owe on FEAT-1?" answers the question by guessing. Narrowing
+ * narrows the verdict too — `verified` then means "every claim owned by this
+ * service is confirmed", which is why the payload names the service it applied.
+ *
+ * `bound` is loam.json's `service` — what this repository says it is. It only
+ * shapes the footer, and it is the whole of how federation is discoverable:
+ * the recording form printed here is the one that will actually work from here.
+ */
 export function report(target, checklist, recorded, scope = {}) {
     const { docsDir, featureDir, json } = target;
     const lens = scope.lens;
     const owners = [...new Set(checklist.claims.map((c) => c.subject))].sort();
     const scoped = lens === undefined ? checklist.claims : checklist.claims.filter((c) => c.subject === lens);
     const claims = statuses(checklist, scoped, recorded);
-    const count = (v) => claims.filter((c) => c.verdict === v).length;
-    const summary = {
-        claims: claims.length,
-        confirmed: count("confirmed"),
-        unconfirmed: count("unconfirmed"),
-        unanswered: count("unanswered"),
-    };
+    const tally = tallyAnswers(claims);
+    // The payload's `summary` is the tally without its `attested` count, which
+    // travels as a key of its own beside it.
+    const summary = { claims: tally.claims, confirmed: tally.confirmed, unconfirmed: tally.unconfirmed, unanswered: tally.unanswered };
     // A record that answers a different question set is not an answer to this one,
     // however complete it looks — so staleness disqualifies it as a whole.
     const stale = recorded !== null && recorded.checklist !== checklist.digest;
-    const tally = tallyAnswers(claims);
     const verdict = verificationVerdict(tally, stale);
     // `verified` keeps its name and its type, and loses its old meaning: a
     // scenario claim on an agent's word is answered, not run, so it no longer
@@ -89,17 +94,7 @@ export function report(target, checklist, recorded, scope = {}) {
             attested: tally.attested,
             summary,
             services: owners,
-            recorded: recorded === null
-                ? null
-                : {
-                    path: repoPath(docsDir, verificationPath(featureDir)),
-                    recorded: recorded.recorded,
-                    checklist: recorded.checklist,
-                    stale,
-                    ...(recorded.attestations === undefined ? {} : { attestations: recorded.attestations }),
-                    ...(recorded.report === undefined ? {} : { report: recorded.report }),
-                    ...(recorded.contractReport === undefined ? {} : { contractReport: recorded.contractReport }),
-                },
+            recorded: recorded === null ? null : recordedPayload(target, recorded, { stale }),
             claims,
             ...(notices.length === 0 ? {} : { notices }),
         });
@@ -122,7 +117,10 @@ export function report(target, checklist, recorded, scope = {}) {
     }
     console.log("");
     if (recorded === null) {
-        console.log(`  Not verified — no ${repoPath(docsDir, verificationPath(featureDir))}.`);
+        // Both places a record can be, because which one the next record lands in
+        // depends on the form that writes it — a service's attestation goes to its
+        // own file under verification/, the all-at-once form to verification.yaml.
+        console.log(`  Not verified — no ${repoPath(docsDir, verificationDir(featureDir))}/ or verification.yaml yet.`);
     }
     else {
         console.log(`  Recorded ${recorded.recorded} — ${summary.confirmed} confirmed, ${summary.unconfirmed} unconfirmed, ${summary.unanswered} unanswered.`);
@@ -205,19 +203,4 @@ export function federationNote(scope, owners) {
     }
     return [];
 }
-/**
- * The frozen view: an archived feature's record, verbatim. No checklist is
- * derived and no staleness is judged — there is nothing current to judge
- * against, and pretending otherwise is how a true record reads as a lie.
- * `frozen` is the marker a consumer branches on.
- *
- * The verdict is recounted from `claims[]`, never taken from `summary`: this is
- * the post-ship verdict on a feature nobody can re-derive a checklist for, so a
- * record whose counts had drifted from its own answers reported a shipped
- * feature as fully confirmed. (A record that contradicts itself never reaches
- * here — `readVerificationState` refuses it — so the recount and the summary
- * agree; the recount is what says WHY.) No record at all is reported as exactly
- * that, with `summary: null`, not zero claims, which would falsely say the
- * feature promised nothing.
- */
 //# sourceMappingURL=report.js.map

package/dist/commands/verify/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/commands/verify/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAuB,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAmB,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAoB,MAAM,+BAA+B,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEZ,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAevI,MAAM,UAAU,QAAQ,CAAC,SAAoB,EAAE,MAA2B,EAAE,QAA6B;IACvG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GACZ,QAAQ,EAAE,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,GAAG,CACL,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CACpD,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,CAC5E,CACF,CAAC;IACR,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;SACrB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SAC9D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CACrC,CAAC;IACF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,YAAY;YACxC,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACjF,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE;YAChC,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAoCD,MAAM,UAAU,MAAM,CACpB,MAAoB,EACpB,SAAoB,EACpB,QAA6B,EAC7B,KAAK,GAAsC,EAAE;IAE7C,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC;QACjC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;KAChC,CAAC;IACF,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC;IAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC;IACxC,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,8EAA8E;IAC9E,gCAAgC;IAChC,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;QACxC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,GAAG,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;KACtD,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;YACnC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,wEAAwE;YACxE,6BAA6B;YAC7B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1F,QAAQ;YACR,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;YACP,QAAQ,EAAE,MAAM;YAChB,QAAQ,EACN,QAAQ,KAAK,IAAI;gBACf,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBACrD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,KAAK;oBACL,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;oBACvF,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACrE,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;iBAC9F;YACP,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GACb,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,QAAQ,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC;IAClH,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,CAAC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,iBAAiB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CACvH,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,6CAA6C,IAAI,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0CAA0C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,uBAAuB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,cAAc,QAAQ,CAAC,QAAQ,MAAM,OAAO,CAAC,SAAS,eAAe,OAAO,CAAC,WAAW,iBAAiB,OAAO,CAAC,UAAU,cAAc,CAC1I,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACtG,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CACT,iBAAiB,WAAW,CAAC,OAAO,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CACvJ,CAAC;YACF,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClG,IAAI,WAAW,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,kBAAkB,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClG,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,8EAA8E;IAC9E,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;QACjG,OAAO,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,OAAO,yBAAyB,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAChG,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwC,EAAE,MAAgB;IACrF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,cAAc,KAAK,CAAC,KAAK,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,KAAwC,EAAE,MAAgB;IACvF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO;YACL,EAAE;YACF,wBAAwB,KAAK,CAAC,KAAK,wBAAwB,KAAK,CAAC,KAAK,mCAAmC;YACzG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBACrB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO;YACL,EAAE;YACF,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;YACjH,gEAAgE;SACjE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;GAcG","sourcesContent":["/**\n * The done-check as an answer: every claim, its verdict, and who said so.\n *\n * The per-claim rows are computed once and both surfaces read them — `--json`\n * and the terminal cannot disagree about a count, which is the failure this\n * shape prevents. The federation note is here rather than at the call sites\n * because a federated record answers per SERVICE and a reader looking at one\n * lens has to be told which of the others have not answered yet.\n */\nimport { emitJson, repoPath } from \"../../core/envelope/json.js\";\nimport { type CommitRecovery } from \"../../core/staging/interrupted.js\";\nimport { type AnsweredBy } from \"../../core/verify/answers.js\";\nimport { type Checklist } from \"../../core/verify/checklist.js\";\nimport { type EvidencePin } from \"../../core/verify/pins/pin.js\";\nimport {\n  openClaimsNotice,\n  tallyAnswers,\n  type Verification,\n  verificationPath,\n  verificationVerdict,\n} from \"../../core/verify/record.js\";\nimport { EXPLAIN_FOOTER, plural } from \"../policy/format.js\";\nimport { answeredMark, contestedNotices, contractReportLine, forkedChecklistNotices, MARK, noticesFor, reportLine } from \"./frozen.js\";\n\nexport interface ClaimStatus {\n  id: string;\n  kind: string;\n  subject: string;\n  claim: string;\n  verdict: \"confirmed\" | \"unconfirmed\" | \"unanswered\";\n  answered_by?: AnsweredBy;\n  evidence: string[];\n  note?: string;\n  /** The recorded pins, passed through where the record carries them — additive payload key. */\n  evidence_pins?: EvidencePin[];\n}\n\nexport function statuses(checklist: Checklist, claims: Checklist[\"claims\"], recorded: Verification | null): ClaimStatus[] {\n  const subjects = new Map(checklist.claims.map((claim) => [claim.id, claim.subject]));\n  const attested =\n    recorded?.schema !== 2\n      ? null\n      : new Set(\n          (recorded.attestations ?? []).flatMap((attestation) =>\n            attestation.claims.filter((id) => subjects.get(id) === attestation.service),\n          ),\n        );\n  const byId = new Map(\n    (recorded?.claims ?? [])\n      .filter((claim) => attested === null || attested.has(claim.id))\n      .map((claim) => [claim.id, claim]),\n  );\n  return claims.map((c) => {\n    const answer = byId.get(c.id);\n    return {\n      id: c.id,\n      kind: c.kind,\n      subject: c.subject,\n      claim: c.claim,\n      verdict: answer?.verdict ?? \"unanswered\",\n      ...(answer?.answered_by === undefined ? {} : { answered_by: answer.answered_by }),\n      evidence: answer?.evidence ?? [],\n      ...(answer?.note === undefined ? {} : { note: answer.note }),\n      ...(answer?.evidence_pins === undefined ? {} : { evidence_pins: answer.evidence_pins }),\n    };\n  });\n}\n\n/**\n * The read view.\n *\n * `lens` is `--service`: the same checklist, narrowed to the claims that\n * service's code answers. It exists because in a ten-repo fleet the whole\n * checklist is never one repository's business, and an agent that cannot ask\n * \"what do I still owe on FEAT-1?\" answers the question by guessing. Narrowing\n * narrows the verdict too — `verified` then means \"every claim owned by this\n * service is confirmed\", which is why the payload names the service it applied.\n *\n * `bound` is loam.json's `service` — what this repository says it is. It only\n * shapes the footer, and it is the whole of how federation is discoverable:\n * the recording form printed here is the one that will actually work from here.\n */\n/**\n * Which feature is being reported on, and in what voice.\n *\n * Three of these travelled as loose strings beside two booleans through every\n * reporting path. They are one thing — the target of this run — and a record\n * makes the `--json` flag impossible to transpose with a lens name, which is\n * what the positional form allowed.\n */\nexport interface VerifyTarget {\n  docsDir: string;\n  featureDir: string;\n  json: boolean;\n  /**\n   * Non-null when the record path first rolled a predecessor's interrupted\n   * commit forward under its lock. Only `record` reports it; the read path\n   * never recovers, so it never carries one.\n   */\n  recovered?: CommitRecovery | null;\n}\n\nexport function report(\n  target: VerifyTarget,\n  checklist: Checklist,\n  recorded: Verification | null,\n  scope: { lens?: string; bound?: string } = {},\n): void {\n  const { docsDir, featureDir, json } = target;\n  const lens = scope.lens;\n  const owners = [...new Set(checklist.claims.map((c) => c.subject))].sort();\n  const scoped = lens === undefined ? checklist.claims : checklist.claims.filter((c) => c.subject === lens);\n  const claims = statuses(checklist, scoped, recorded);\n  const count = (v: string): number => claims.filter((c) => c.verdict === v).length;\n  const summary = {\n    claims: claims.length,\n    confirmed: count(\"confirmed\"),\n    unconfirmed: count(\"unconfirmed\"),\n    unanswered: count(\"unanswered\"),\n  };\n  // A record that answers a different question set is not an answer to this one,\n  // however complete it looks — so staleness disqualifies it as a whole.\n  const stale = recorded !== null && recorded.checklist !== checklist.digest;\n  const tally = tallyAnswers(claims);\n  const verdict = verificationVerdict(tally, stale);\n  // `verified` keeps its name and its type, and loses its old meaning: a\n  // scenario claim on an agent's word is answered, not run, so it no longer\n  // reads the same as a green suite. `verdict` carries the distinction.\n  const verified = verdict === \"verified\";\n  // Contest is derivable from the checklist alone, so the read view says it\n  // too: an agent looking at what it owes should learn that a second service\n  // answers the same claim BEFORE it runs a suite whose report cannot be\n  // attributed. Always from the whole checklist, never the lens — a shared\n  // digest is a fact about the feature, and a narrowed view is the one place it\n  // would otherwise be invisible.\n  // The open-claims honesty line only where a record EXISTS: with none, the\n  // surface already says \"Not verified\", and not-started is not partial.\n  const open = recorded === null ? null : openClaimsNotice(tally, checklist.feature);\n  const notices = [\n    ...noticesFor(claims, checklist.feature),\n    ...(open === null ? [] : [open]),\n    ...contestedNotices(checklist.claims),\n    ...forkedChecklistNotices(recorded, checklist.digest),\n  ];\n\n  if (json) {\n    emitJson({\n      command: \"verify\",\n      feature: checklist.feature,\n      path: repoPath(docsDir, featureDir),\n      digest: checklist.digest,\n      // Named only when narrowed, so a consumer can never mistake a service's\n      // verdict for the feature's.\n      ...(lens === undefined ? {} : { service: lens, checklistClaims: checklist.claims.length }),\n      verified,\n      verdict,\n      attested: tally.attested,\n      summary,\n      services: owners,\n      recorded:\n        recorded === null\n          ? null\n          : {\n              path: repoPath(docsDir, verificationPath(featureDir)),\n              recorded: recorded.recorded,\n              checklist: recorded.checklist,\n              stale,\n              ...(recorded.attestations === undefined ? {} : { attestations: recorded.attestations }),\n              ...(recorded.report === undefined ? {} : { report: recorded.report }),\n              ...(recorded.contractReport === undefined ? {} : { contractReport: recorded.contractReport }),\n            },\n      claims,\n      ...(notices.length === 0 ? {} : { notices }),\n    });\n    return;\n  }\n\n  const scopeNote =\n    lens === undefined ? \"\" : ` owned by ${lens} (of ${plural(checklist.claims.length, \"claim\")} on the checklist)`;\n  console.log(\n    `${checklist.feature} — ${plural(claims.length, \"claim\")}${scopeNote} derived from ${repoPath(docsDir, featureDir)}\\n`,\n  );\n  if (claims.length === 0) {\n    console.log(\n      lens === undefined\n        ? \"  Nothing to check: this feature's delta, specs and openapi promise nothing yet.\"\n        : `  No claim on this checklist is owned by '${lens}'.${owners.length > 0 ? ` The services that own claims here are ${owners.join(\", \")}.` : \"\"}`,\n    );\n    return;\n  }\n  for (const c of claims) {\n    console.log(`  ${MARK[c.verdict]} ${c.id}  [${c.subject}]  ${c.claim}${answeredMark(c)}`);\n    for (const e of c.evidence) console.log(`      ${e}`);\n    if (c.note !== undefined) console.log(`      note: ${c.note}`);\n  }\n\n  console.log(\"\");\n  if (recorded === null) {\n    console.log(`  Not verified — no ${repoPath(docsDir, verificationPath(featureDir))}.`);\n  } else {\n    console.log(\n      `  Recorded ${recorded.recorded} — ${summary.confirmed} confirmed, ${summary.unconfirmed} unconfirmed, ${summary.unanswered} unanswered.`,\n    );\n    if (stale) {\n      console.log(\"  STALE: the feature changed after this was recorded. Answer the claims above again.\");\n    }\n    for (const attestation of recorded.attestations ?? []) {\n      console.log(\n        `  Attested by ${attestation.service} at ${attestation.commit.slice(0, 12)} (${attestation.recorded}, ${plural(attestation.claims.length, \"claim\")}).`,\n      );\n      if (attestation.report !== undefined) console.log(`      from ${reportLine(attestation.report)}`);\n      if (attestation.contractReport !== undefined) {\n        console.log(`      from ${contractReportLine(attestation.contractReport)}`);\n      }\n    }\n    if (recorded.report !== undefined) console.log(`  Answered from ${reportLine(recorded.report)}.`);\n    if (recorded.contractReport !== undefined) {\n      console.log(`  Contract report read: ${contractReportLine(recorded.contractReport)}.`);\n    }\n  }\n  // The notice's code LEADS the line here, where validate's findings now carry\n  // theirs in a trailing `(code)` — and the two shapes are deliberate, not\n  // drift. A notice is one line and its code is its subject, so it reads as a\n  // label; a finding is one of hundreds in a report whose subject is the\n  // message, so its code is an aside. Appending a second copy to satisfy the\n  // one-shape instinct would print `⚠ verify.claims-open: … (verify.claims-open)`,\n  // and the leading form is also the one the frozen post-archive view prints\n  // (frozen.ts) — a live record and a shipped one must not describe the same\n  // notice two ways. Either way the code is on screen, which is the whole of\n  // what EXPLAIN_FOOTER below needs to be true.\n  for (const notice of notices) console.log(`  ⚠ ${notice.code}: ${notice.message}`);\n  // An attested record has answered every question — telling it to \"answer each\n  // claim\" would send an agent round a loop it has already run. The notice\n  // above names the one thing left, which is a test run.\n  if (verdict === \"unverified\") {\n    console.log(\"\\n  Answer each claim, then record the answers:\\n\");\n    console.log('    [{ \"id\": \"<claim id>\", \"verdict\": \"confirmed\", \"evidence\": [\"src/x.ts:42\"] }]');\n    console.log(`\\n    loam verify ${checklist.feature} --record answers.json${recordSuffix(scope, owners)}`);\n    for (const line of federationNote(scope, owners)) console.log(line);\n    console.log(\"\\n  A claim you cannot show evidence for is `unconfirmed` — say why in `note`.\");\n  }\n  // APPENDED, as format.ts promises — the report's last line, never a wedge\n  // between the notices and the recording instructions that follow them. It\n  // follows printed notice codes only: claim marks carry no code to look up,\n  // and the frozen post-archive view (frozen.ts) stays without it on purpose,\n  // because shipped history is not a fix-it surface.\n  if (notices.length > 0) console.log(`\\n${EXPLAIN_FOOTER}`);\n}\n\n/**\n * The `--service` the printed form should carry. It comes from loam.json, never\n * from the checklist: the only attestation this repository can make is its own,\n * and a hint naming a service that lives somewhere else is a hint that fails.\n */\nexport function recordSuffix(scope: { lens?: string; bound?: string }, owners: string[]): string {\n  if (scope.bound !== undefined) return ` --service ${scope.bound}`;\n  return owners.length > 1 || scope.lens !== undefined ? \" --service <svc>\" : \"\";\n}\n\n/** Why the form above has a `--service` on it — the one place federation is taught. */\nexport function federationNote(scope: { lens?: string; bound?: string }, owners: string[]): string[] {\n  if (scope.bound !== undefined) {\n    const others = owners.filter((s) => s !== scope.bound);\n    return [\n      \"\",\n      `  This repository is ${scope.bound}, so it attests only ${scope.bound}'s claims, bound to its git HEAD.`,\n      ...(others.length === 0\n        ? []\n        : [`  The claims owned by ${others.join(\", \")} are recorded the same way from those repositories.`]),\n    ];\n  }\n  if (owners.length > 1 || scope.lens !== undefined) {\n    return [\n      \"\",\n      `  This checklist spans ${plural(owners.length, \"service\")} (${owners.join(\", \")}) — each attests its own claims`,\n      \"  from its own repository, where loam.json names that service.\",\n    ];\n  }\n  return [];\n}\n\n/**\n * The frozen view: an archived feature's record, verbatim. No checklist is\n * derived and no staleness is judged — there is nothing current to judge\n * against, and pretending otherwise is how a true record reads as a lie.\n * `frozen` is the marker a consumer branches on.\n *\n * The verdict is recounted from `claims[]`, never taken from `summary`: this is\n * the post-ship verdict on a feature nobody can re-derive a checklist for, so a\n * record whose counts had drifted from its own answers reported a shipped\n * feature as fully confirmed. (A record that contradicts itself never reaches\n * here — `readVerificationState` refuses it — so the recount and the summary\n * agree; the recount is what says WHY.) No record at all is reported as exactly\n * that, with `summary: null`, not zero claims, which would falsely say the\n * feature promised nothing.\n */\n"]}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/commands/verify/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAuB,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAmB,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAoB,MAAM,+BAA+B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,YAAY,EAGZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AAerB,MAAM,UAAU,QAAQ,CAAC,SAAoB,EAAE,MAA2B,EAAE,QAA6B;IACvG,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAyB,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,YAAY;YACxC,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACjF,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE;YAChC,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAsBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,MAAM,CACpB,MAAoB,EACpB,SAAoB,EACpB,QAA6B,EAC7B,KAAK,GAAsC,EAAE;IAE7C,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,2EAA2E;IAC3E,yCAAyC;IACzC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IACnI,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC;IAC3E,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC;IACxC,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,8EAA8E;IAC9E,gCAAgC;IAChC,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;QACxC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,GAAG,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;KACtD,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;YACnC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,wEAAwE;YACxE,6BAA6B;YAC7B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1F,QAAQ;YACR,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;YACP,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC;YACjF,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GACb,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,QAAQ,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC;IAClH,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,CAAC,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,iBAAiB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CACvH,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,6CAA6C,IAAI,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0CAA0C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,OAAO,CAAC,GAAG,CAAC,uBAAuB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAClH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,cAAc,QAAQ,CAAC,QAAQ,MAAM,OAAO,CAAC,SAAS,eAAe,OAAO,CAAC,WAAW,iBAAiB,OAAO,CAAC,UAAU,cAAc,CAC1I,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACtG,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CACT,iBAAiB,WAAW,CAAC,OAAO,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CACvJ,CAAC;YACF,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClG,IAAI,WAAW,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,kBAAkB,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClG,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,8EAA8E;IAC9E,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;QACjG,OAAO,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,OAAO,yBAAyB,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAChG,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwC,EAAE,MAAgB;IACrF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,cAAc,KAAK,CAAC,KAAK,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,KAAwC,EAAE,MAAgB;IACvF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO;YACL,EAAE;YACF,wBAAwB,KAAK,CAAC,KAAK,wBAAwB,KAAK,CAAC,KAAK,mCAAmC;YACzG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBACrB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO;YACL,EAAE;YACF,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;YACjH,gEAAgE;SACjE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC","sourcesContent":["/**\n * The done-check as an answer: every claim, its verdict, and who said so.\n *\n * The per-claim rows are computed once and both surfaces read them — `--json`\n * and the terminal cannot disagree about a count, which is the failure this\n * shape prevents. The federation note is here rather than at the call sites\n * because a federated record answers per SERVICE and a reader looking at one\n * lens has to be told which of the others have not answered yet.\n */\nimport { emitJson, repoPath } from \"../../core/envelope/json.js\";\nimport { type CommitRecovery } from \"../../core/staging/interrupted.js\";\nimport { type AnsweredBy } from \"../../core/verify/answers.js\";\nimport { type Checklist } from \"../../core/verify/checklist.js\";\nimport { type EvidencePin } from \"../../core/verify/pins/pin.js\";\nimport {\n  countedAnswers,\n  openClaimsNotice,\n  tallyAnswers,\n  type RecordedClaim,\n  type Verification,\n  verificationVerdict,\n} from \"../../core/verify/record.js\";\nimport { verificationDir } from \"../../core/verify/location.js\";\nimport { EXPLAIN_FOOTER, plural } from \"../policy/format.js\";\nimport {\n  answeredMark,\n  contestedNotices,\n  contractReportLine,\n  forkedChecklistNotices,\n  MARK,\n  noticesFor,\n  recordedPayload,\n  reportLine,\n} from \"./frozen.js\";\n\nexport interface ClaimStatus {\n  id: string;\n  kind: string;\n  subject: string;\n  claim: string;\n  verdict: \"confirmed\" | \"unconfirmed\" | \"unanswered\";\n  answered_by?: AnsweredBy;\n  evidence: string[];\n  note?: string;\n  /** The recorded pins, passed through where the record carries them — additive payload key. */\n  evidence_pins?: EvidencePin[];\n}\n\nexport function statuses(checklist: Checklist, claims: Checklist[\"claims\"], recorded: Verification | null): ClaimStatus[] {\n  const byId = recorded === null ? new Map<string, RecordedClaim>() : countedAnswers(checklist.claims, recorded);\n  return claims.map((c) => {\n    const answer = byId.get(c.id);\n    return {\n      id: c.id,\n      kind: c.kind,\n      subject: c.subject,\n      claim: c.claim,\n      verdict: answer?.verdict ?? \"unanswered\",\n      ...(answer?.answered_by === undefined ? {} : { answered_by: answer.answered_by }),\n      evidence: answer?.evidence ?? [],\n      ...(answer?.note === undefined ? {} : { note: answer.note }),\n      ...(answer?.evidence_pins === undefined ? {} : { evidence_pins: answer.evidence_pins }),\n    };\n  });\n}\n\n/**\n * Which feature is being reported on, and in what voice.\n *\n * Three of these travelled as loose strings beside two booleans through every\n * reporting path. They are one thing — the target of this run — and a record\n * makes the `--json` flag impossible to transpose with a lens name, which is\n * what the positional form allowed.\n */\nexport interface VerifyTarget {\n  docsDir: string;\n  featureDir: string;\n  json: boolean;\n  /**\n   * Non-null when the record path first rolled a predecessor's interrupted\n   * commit forward under its lock. Only `record` reports it; the read path\n   * never recovers, so it never carries one.\n   */\n  recovered?: CommitRecovery | null;\n}\n\n/**\n * The read view.\n *\n * `lens` is `--service`: the same checklist, narrowed to the claims that\n * service's code answers. It exists because in a ten-repo fleet the whole\n * checklist is never one repository's business, and an agent that cannot ask\n * \"what do I still owe on FEAT-1?\" answers the question by guessing. Narrowing\n * narrows the verdict too — `verified` then means \"every claim owned by this\n * service is confirmed\", which is why the payload names the service it applied.\n *\n * `bound` is loam.json's `service` — what this repository says it is. It only\n * shapes the footer, and it is the whole of how federation is discoverable:\n * the recording form printed here is the one that will actually work from here.\n */\nexport function report(\n  target: VerifyTarget,\n  checklist: Checklist,\n  recorded: Verification | null,\n  scope: { lens?: string; bound?: string } = {},\n): void {\n  const { docsDir, featureDir, json } = target;\n  const lens = scope.lens;\n  const owners = [...new Set(checklist.claims.map((c) => c.subject))].sort();\n  const scoped = lens === undefined ? checklist.claims : checklist.claims.filter((c) => c.subject === lens);\n  const claims = statuses(checklist, scoped, recorded);\n  const tally = tallyAnswers(claims);\n  // The payload's `summary` is the tally without its `attested` count, which\n  // travels as a key of its own beside it.\n  const summary = { claims: tally.claims, confirmed: tally.confirmed, unconfirmed: tally.unconfirmed, unanswered: tally.unanswered };\n  // A record that answers a different question set is not an answer to this one,\n  // however complete it looks — so staleness disqualifies it as a whole.\n  const stale = recorded !== null && recorded.checklist !== checklist.digest;\n  const verdict = verificationVerdict(tally, stale);\n  // `verified` keeps its name and its type, and loses its old meaning: a\n  // scenario claim on an agent's word is answered, not run, so it no longer\n  // reads the same as a green suite. `verdict` carries the distinction.\n  const verified = verdict === \"verified\";\n  // Contest is derivable from the checklist alone, so the read view says it\n  // too: an agent looking at what it owes should learn that a second service\n  // answers the same claim BEFORE it runs a suite whose report cannot be\n  // attributed. Always from the whole checklist, never the lens — a shared\n  // digest is a fact about the feature, and a narrowed view is the one place it\n  // would otherwise be invisible.\n  // The open-claims honesty line only where a record EXISTS: with none, the\n  // surface already says \"Not verified\", and not-started is not partial.\n  const open = recorded === null ? null : openClaimsNotice(tally, checklist.feature);\n  const notices = [\n    ...noticesFor(claims, checklist.feature),\n    ...(open === null ? [] : [open]),\n    ...contestedNotices(checklist.claims),\n    ...forkedChecklistNotices(recorded, checklist.digest),\n  ];\n\n  if (json) {\n    emitJson({\n      command: \"verify\",\n      feature: checklist.feature,\n      path: repoPath(docsDir, featureDir),\n      digest: checklist.digest,\n      // Named only when narrowed, so a consumer can never mistake a service's\n      // verdict for the feature's.\n      ...(lens === undefined ? {} : { service: lens, checklistClaims: checklist.claims.length }),\n      verified,\n      verdict,\n      attested: tally.attested,\n      summary,\n      services: owners,\n      recorded: recorded === null ? null : recordedPayload(target, recorded, { stale }),\n      claims,\n      ...(notices.length === 0 ? {} : { notices }),\n    });\n    return;\n  }\n\n  const scopeNote =\n    lens === undefined ? \"\" : ` owned by ${lens} (of ${plural(checklist.claims.length, \"claim\")} on the checklist)`;\n  console.log(\n    `${checklist.feature} — ${plural(claims.length, \"claim\")}${scopeNote} derived from ${repoPath(docsDir, featureDir)}\\n`,\n  );\n  if (claims.length === 0) {\n    console.log(\n      lens === undefined\n        ? \"  Nothing to check: this feature's delta, specs and openapi promise nothing yet.\"\n        : `  No claim on this checklist is owned by '${lens}'.${owners.length > 0 ? ` The services that own claims here are ${owners.join(\", \")}.` : \"\"}`,\n    );\n    return;\n  }\n  for (const c of claims) {\n    console.log(`  ${MARK[c.verdict]} ${c.id}  [${c.subject}]  ${c.claim}${answeredMark(c)}`);\n    for (const e of c.evidence) console.log(`      ${e}`);\n    if (c.note !== undefined) console.log(`      note: ${c.note}`);\n  }\n\n  console.log(\"\");\n  if (recorded === null) {\n    // Both places a record can be, because which one the next record lands in\n    // depends on the form that writes it — a service's attestation goes to its\n    // own file under verification/, the all-at-once form to verification.yaml.\n    console.log(`  Not verified — no ${repoPath(docsDir, verificationDir(featureDir))}/ or verification.yaml yet.`);\n  } else {\n    console.log(\n      `  Recorded ${recorded.recorded} — ${summary.confirmed} confirmed, ${summary.unconfirmed} unconfirmed, ${summary.unanswered} unanswered.`,\n    );\n    if (stale) {\n      console.log(\"  STALE: the feature changed after this was recorded. Answer the claims above again.\");\n    }\n    for (const attestation of recorded.attestations ?? []) {\n      console.log(\n        `  Attested by ${attestation.service} at ${attestation.commit.slice(0, 12)} (${attestation.recorded}, ${plural(attestation.claims.length, \"claim\")}).`,\n      );\n      if (attestation.report !== undefined) console.log(`      from ${reportLine(attestation.report)}`);\n      if (attestation.contractReport !== undefined) {\n        console.log(`      from ${contractReportLine(attestation.contractReport)}`);\n      }\n    }\n    if (recorded.report !== undefined) console.log(`  Answered from ${reportLine(recorded.report)}.`);\n    if (recorded.contractReport !== undefined) {\n      console.log(`  Contract report read: ${contractReportLine(recorded.contractReport)}.`);\n    }\n  }\n  // The notice's code LEADS the line here, where validate's findings now carry\n  // theirs in a trailing `(code)` — and the two shapes are deliberate, not\n  // drift. A notice is one line and its code is its subject, so it reads as a\n  // label; a finding is one of hundreds in a report whose subject is the\n  // message, so its code is an aside. Appending a second copy to satisfy the\n  // one-shape instinct would print `⚠ verify.claims-open: … (verify.claims-open)`,\n  // and the leading form is also the one the frozen post-archive view prints\n  // (frozen.ts) — a live record and a shipped one must not describe the same\n  // notice two ways. Either way the code is on screen, which is the whole of\n  // what EXPLAIN_FOOTER below needs to be true.\n  for (const notice of notices) console.log(`  ⚠ ${notice.code}: ${notice.message}`);\n  // An attested record has answered every question — telling it to \"answer each\n  // claim\" would send an agent round a loop it has already run. The notice\n  // above names the one thing left, which is a test run.\n  if (verdict === \"unverified\") {\n    console.log(\"\\n  Answer each claim, then record the answers:\\n\");\n    console.log('    [{ \"id\": \"<claim id>\", \"verdict\": \"confirmed\", \"evidence\": [\"src/x.ts:42\"] }]');\n    console.log(`\\n    loam verify ${checklist.feature} --record answers.json${recordSuffix(scope, owners)}`);\n    for (const line of federationNote(scope, owners)) console.log(line);\n    console.log(\"\\n  A claim you cannot show evidence for is `unconfirmed` — say why in `note`.\");\n  }\n  // APPENDED, as format.ts promises — the report's last line, never a wedge\n  // between the notices and the recording instructions that follow them. It\n  // follows printed notice codes only: claim marks carry no code to look up,\n  // and the frozen post-archive view (frozen.ts) stays without it on purpose,\n  // because shipped history is not a fix-it surface.\n  if (notices.length > 0) console.log(`\\n${EXPLAIN_FOOTER}`);\n}\n\n/**\n * The `--service` the printed form should carry. It comes from loam.json, never\n * from the checklist: the only attestation this repository can make is its own,\n * and a hint naming a service that lives somewhere else is a hint that fails.\n */\nexport function recordSuffix(scope: { lens?: string; bound?: string }, owners: string[]): string {\n  if (scope.bound !== undefined) return ` --service ${scope.bound}`;\n  return owners.length > 1 || scope.lens !== undefined ? \" --service <svc>\" : \"\";\n}\n\n/** Why the form above has a `--service` on it — the one place federation is taught. */\nexport function federationNote(scope: { lens?: string; bound?: string }, owners: string[]): string[] {\n  if (scope.bound !== undefined) {\n    const others = owners.filter((s) => s !== scope.bound);\n    return [\n      \"\",\n      `  This repository is ${scope.bound}, so it attests only ${scope.bound}'s claims, bound to its git HEAD.`,\n      ...(others.length === 0\n        ? []\n        : [`  The claims owned by ${others.join(\", \")} are recorded the same way from those repositories.`]),\n    ];\n  }\n  if (owners.length > 1 || scope.lens !== undefined) {\n    return [\n      \"\",\n      `  This checklist spans ${plural(owners.length, \"service\")} (${owners.join(\", \")}) — each attests its own claims`,\n      \"  from its own repository, where loam.json names that service.\",\n    ];\n  }\n  return [];\n}\n"]}

package/dist/commands/verify/results.js

@@ -9,12 +9,22 @@
 import { execFile } from "node:child_process";
 import { readFile, stat } from "node:fs/promises";
 import { resolvePortableFileInside } from "../../core/kernel/path-safety.js";
+import { GIT_TIMEOUT_MS } from "../../core/provenance/git.js";
 import { isScenarioReport, readCucumberReport, readScenarioReport } from "../../core/results.js";
 import {} from "../../core/verify/answers.js";
 import { citedLine, pinnedDigest, sourceLines } from "../../core/verify/pins/pin.js";
 import {} from "../../core/verify/record.js";
 import {} from "./evidence/pins.js";
 import { readReportArtifact } from "./evidence/read.js";
+/**
+ * The two shapes `--results` reads, named wherever a file is refused for being
+ * neither — a fleet whose runner has no cucumber formatter learns here that
+ * the runner-neutral shape exists, rather than from a parse error.
+ */
+const RESULTS_SHAPES = "--results reads two JSON shapes: a cucumber JSON report (cucumber-js --format json, cucumber-jvm, behave, " +
+    "SpecFlow/Reqnroll, pytest-bdd --cucumberjson and godog's cucumber formatter all write one), or loam's runner-neutral " +
+    '{"loamScenarioReport": 1, "results": [{"digest": "<16 hex>", "status": "passed"}]} — the shape a JUnit, pytest, ' +
+    "Vitest or house runner's report is adapted into, keyed by each scenario's @loam-digest tag.";
 /**
  * The report as an artifact, not merely as a parse. The resolve/read/digest
  * plumbing lives in `./evidence/read.ts`, shared with `--contract-results`:
@@ -24,7 +34,7 @@ import { readReportArtifact } from "./evidence/read.js";
  * the record.
  */
 export async function readResults(spelled, repoDir) {
-    const artifact = await readReportArtifact(spelled, repoDir, "test report");
+    const artifact = await readReportArtifact(spelled, repoDir, "test report", RESULTS_SHAPES);
     if (!artifact.ok)
         return artifact;
     // The reader is chosen by MARKER, before either shape has validated
@@ -53,8 +63,8 @@ export async function readResults(spelled, repoDir) {
  * in this repository: an agent's `file:line` resolves to a real line that is
  * unchanged at the attested commit, and each runner's evidence names the report
  * loam just read — the cucumber report for `runner`, the contract report for
- * `external-runner`. Legacy global mode deliberately keeps its original, looser
- * evidence contract for backward compatibility.
+ * `external-runner`. The legacy all-at-once form binds to no commit, so it gets
+ * only the first half of that — {@link validateLocalEvidence}.
  *
  * The same pass now STAMPS what it validated: one `EvidencePin` per agent
  * citation, built where `committedFile`'s blob is already in hand (zero new
@@ -108,29 +118,11 @@ export async function validateServiceEvidence(answers, binding, reports, tokens)
             continue;
         }
         for (const evidence of answer.evidence) {
-            const match = /^(.+):([1-9]\d*)$/.exec(evidence);
-            if (match === null) {
-                return err(`Claim ${answer.id} has evidence '${evidence}' — service evidence must be a canonical relative file:line.`);
-            }
-            const relativePath = match[1];
-            const line = Number(match[2]);
-            let absolutePath;
-            try {
-                absolutePath = resolvePortableFileInside(repoDir, relativePath, `evidence for ${answer.id}`);
-            }
-            catch (cause) {
-                return err(`Claim ${answer.id} has unsafe evidence '${evidence}': ${cause instanceof Error ? cause.message : String(cause)}`);
-            }
+            const cited = await resolveCitation(repoDir, answer.id, evidence);
+            if (!cited.ok)
+                return err(cited.message);
+            const { relativePath, line } = cited;
             try {
-                const info = await stat(absolutePath);
-                if (!info.isFile()) {
-                    return err(`Claim ${answer.id} has evidence '${evidence}', but '${relativePath}' is not a regular file.`);
-                }
-                const source = await readFile(absolutePath, "utf8");
-                const lines = sourceLines(source).length;
-                if (line > lines) {
-                    return err(`Claim ${answer.id} has evidence '${evidence}', but '${relativePath}' has only ${lines} line(s).`);
-                }
                 const committed = await committedFile(repoDir, commit, relativePath);
                 if (!committed.ok) {
                     return err(`Claim ${answer.id} has evidence '${evidence}' that is not bound to ${commit.slice(0, 12)}: ${committed.message}`);
@@ -172,6 +164,92 @@ export async function validateServiceEvidence(answers, binding, reports, tokens)
     }
     return { ok: true, pins, tokenMisses };
 }
+/**
+ * One `file:line` citation, resolved in the working tree: canonical form, a
+ * path that stays inside the repository, a regular file, and a line that
+ * exists. What both recording forms owe every agent citation before anything
+ * else — the federated form then binds it to the attested commit.
+ */
+async function resolveCitation(repoDir, id, evidence) {
+    const err = (message) => ({ ok: false, message });
+    const match = /^(.+):([1-9]\d*)$/.exec(evidence);
+    if (match === null) {
+        return err(`Claim ${id} has evidence '${evidence}' — evidence must be a canonical relative file:line.`);
+    }
+    const relativePath = match[1];
+    const line = Number(match[2]);
+    let absolutePath;
+    try {
+        absolutePath = resolvePortableFileInside(repoDir, relativePath, `evidence for ${id}`);
+    }
+    catch (cause) {
+        return err(`Claim ${id} has unsafe evidence '${evidence}': ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    try {
+        // Absence named in the repository's own spelling: the stat's ENOENT
+        // carries the absolute path of whatever machine ran this, which tells the
+        // reader nothing the citation did not.
+        const info = await stat(absolutePath).catch((cause) => {
+            if (cause.code === "ENOENT")
+                return null;
+            throw cause;
+        });
+        if (info === null)
+            return err(`Claim ${id} has evidence '${evidence}', but '${relativePath}' does not exist in this repository.`);
+        if (!info.isFile())
+            return err(`Claim ${id} has evidence '${evidence}', but '${relativePath}' is not a regular file.`);
+        const lines = sourceLines(await readFile(absolutePath, "utf8")).length;
+        if (line > lines)
+            return err(`Claim ${id} has evidence '${evidence}', but '${relativePath}' has only ${lines} line(s).`);
+    }
+    catch (cause) {
+        return err(`Claim ${id} has unreadable evidence '${evidence}': ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    return { ok: true, relativePath, line };
+}
+/**
+ * The all-at-once form's evidence check: every agent citation must resolve to a
+ * real line of a real file in THIS repository. The form binds to no commit, so
+ * there is nothing to pin and no blob to compare — but it used to check
+ * nothing at all, and accepted `src/foo.py:1` for a file that did not exist
+ * while printing `verified`, in the same release whose `--service` form refused
+ * exactly that citation. The commit binding is the federated form's addition,
+ * not the difference between checked and unchecked.
+ *
+ * A CITATION is what is checked, and only a citation: an entry shaped like a
+ * `path:line` (see {@link citesALine}). The all-at-once form has always taken
+ * other evidence — "manual QA by Alice", a CI run's URL, `README.md` with no
+ * line — and still records it as it stands; holding every entry to the
+ * `file:line` grammar refused all of that with `answers-unevidenced`, which
+ * was never the defect. What a `path:line` claims is checkable, so it is
+ * checked; prose claims nothing a file can contradict. The federated form
+ * keeps its stricter contract — every agent entry a `file:line` bound to the
+ * attested commit — because its whole promise is that binding.
+ */
+export async function validateLocalEvidence(answers, repoDir) {
+    for (const answer of answers) {
+        if (answer.verdict !== "confirmed" || answer.answered_by === "runner" || answer.answered_by === "external-runner")
+            continue;
+        for (const evidence of answer.evidence.filter(citesALine)) {
+            const cited = await resolveCitation(repoDir, answer.id, evidence);
+            if (!cited.ok)
+                return cited;
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Is this evidence entry shaped like a `path:line` — something that names a
+ * line of a file and can therefore be wrong about it? One token (no
+ * whitespace: prose such as "checked at 10:30" is not a citation), not a URL
+ * (`https://ci.example:8443` ends in a number too), ending in `:<digits>`.
+ * Deliberately wider than `resolveCitation`'s canonical form: `src/x.py:0` and
+ * `../x.py:3` are citations, badly made, and must be refused rather than
+ * waved through as prose.
+ */
+function citesALine(evidence) {
+    return /^\S+:\d+$/.test(evidence) && !/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(evidence);
+}
 /** Require the evidence blob to exist at HEAD and have no uncommitted edits. */
 export async function committedFile(repoDir, commit, path) {
     const clean = await git(repoDir, ["diff", "--quiet", commit, "--", path]);
@@ -193,12 +271,16 @@ export async function committedFile(repoDir, commit, path) {
  * HOLDS the docs lock: a `git rev-parse` blocked on a credential-helper prompt
  * used to hang this process forever with the lock in hand, wedging every
  * archive, rebase and record in the fleet behind a live pid that
- * `breakStaleLock` rightly refuses to break. The timeout mirrors
- * `core/provenance/git.ts`; the cap is sized for `git show` of a source file
- * an attestation cites (the default 1 MiB refused sound evidence the moment a
- * generated client crossed it), not for arbitrary blobs.
+ * `breakStaleLock` rightly refuses to break. The timeout IS
+ * `core/provenance/git.ts`'s (imported, so the two cannot drift); the cap is
+ * sized for `git show` of a source file an attestation cites (the default
+ * 1 MiB refused sound evidence the moment a generated client crossed it), not
+ * for arbitrary blobs.
+ *
+ * Not `gitText` itself: its answer carries no signal, so a child killed by
+ * the deadline and one killed from outside would read alike, and the
+ * deadline's own message below is the one that names the fix.
  */
-const GIT_TIMEOUT_MS = 10_000;
 const GIT_MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
 function git(repoDir, args) {
     return new Promise((done) => {

package/dist/commands/verify/results.js.map

@@ -1 +1 @@
-{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/commands/verify/results.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAuB,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAe,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAoB,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAA6C,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAqC,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAMxD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,OAA2B;IAC5E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yCAAyC;IACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QAC3C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1F,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,OAAO;YACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;SACnC;KACF,CAAC;AACJ,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAiB,EACjB,OAA2B,EAC3B,OAAwB,EACxB,MAAmC;IAEnC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,WAAW,GAAgB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,sEAAsE;YACtE,gDAAgD;YAChD,OAAO,GAAG,CACR,KAAK,CAAC,IAAI,KAAK,CAAC;gBACd,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,sDAAsD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kDAAkD;gBAC5J,CAAC,CAAC,wCAAwC,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C,KAAK,CAAC,MAAM,IAAI,iBAAiB,EAAE,CACzK,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;YAAE,SAAS;QAC7C,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;YAChF,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACvG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,wBAAwB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACzI,CAAC;YACD,SAAS;QACX,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,kBAAkB,QAAQ,8DAA8D,CAAC,CAAC;YACzH,CAAC;YACD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,YAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,YAAY,GAAG,yBAAyB,CAAC,OAAO,EAAE,YAAY,EAAE,gBAAgB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,yBAAyB,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChI,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBACnB,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,kBAAkB,QAAQ,WAAW,YAAY,0BAA0B,CAAC,CAAC;gBAC5G,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACpD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBACzC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;oBACjB,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,kBAAkB,QAAQ,WAAW,YAAY,cAAc,KAAK,WAAW,CAAC,CAAC;gBAChH,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;gBACrE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,kBAAkB,QAAQ,0BAA0B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChI,CAAC;gBACD,sEAAsE;gBACtE,uEAAuE;gBACvE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;oBAC5D,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,kBAAkB,QAAQ,WAAW,YAAY,cAAc,cAAc,eAAe,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;gBACnJ,CAAC;gBACD,oEAAoE;gBACpE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,iEAAiE;gBACjE,iEAAiE;gBACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACrE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI;oBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,YAAY;oBAClB,IAAI;oBACJ,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC;oBAC3C,IAAI;oBACJ,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,6BAA6B,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpI,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAKD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,MAAc,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,iBAAiB;SACpG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,iCAAiC,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,SAAS,GAAG,CAAC,OAAe,EAAE,IAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,QAAQ,CACN,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,EACxB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAC9E,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC1B,IAAI,CAAC;gBACH,mEAAmE;gBACnE,uEAAuE;gBACvE,wEAAwE;gBACxE,sDAAsD;gBACtD,sEAAsE;gBACtE,oEAAoE;gBACpE,iEAAiE;gBACjE,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,MAAM;gBACN,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,uEAAuE;gBACvE,sEAAsE;gBACtE,qEAAqE;gBACrE,mEAAmE;gBACnE,qBAAqB;gBACrB,MAAM,EACJ,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;oBACrD,CAAC,CAAC,6BAA6B,cAAc,GAAG,IAAI,kGAAkG;oBACtJ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;aAC7D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,2EAA2E,MAAM,CAAC,MAAM,IAAI,sBAAsB,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,MAAM,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["/**\n * The cucumber report, and the repository it has to be evidence FROM.\n *\n * A results file is only evidence if it describes the commit the attestation\n * names, so reading it and checking the repository are one subject: the git\n * helpers below are here because they answer the same question — is this\n * working tree the one the report was produced from.\n */\nimport { execFile } from \"node:child_process\";\nimport { readFile, stat } from \"node:fs/promises\";\nimport { resolvePortableFileInside } from \"../../core/kernel/path-safety.js\";\nimport { isScenarioReport, readCucumberReport, readScenarioReport, type ReportScenario } from \"../../core/results.js\";\nimport { type Answer } from \"../../core/verify/answers.js\";\nimport { citedLine, pinnedDigest, sourceLines, type EvidencePin } from \"../../core/verify/pins/pin.js\";\nimport { type ConsumedReport, type ConsumedReports } from \"../../core/verify/record.js\";\nimport { type EvidencePins, type TokenMiss } from \"./evidence/pins.js\";\nimport { readReportArtifact } from \"./evidence/read.js\";\n\nexport type ResultsRead =\n  | { ok: true; report: ConsumedReport; scenarios: ReportScenario[] }\n  | { ok: false; code: \"answers-unreadable\"; message: string };\n\n/**\n * The report as an artifact, not merely as a parse. The resolve/read/digest\n * plumbing lives in `./evidence/read.ts`, shared with `--contract-results`:\n * the bytes are digested and the file's mtime read, because loam cannot prove\n * a JSON file came from executing this commit and should stop implying\n * otherwise. It can say precisely which file it consumed, and that goes on\n * the record.\n */\nexport async function readResults(spelled: string, repoDir: string | undefined): Promise<ResultsRead> {\n  const artifact = await readReportArtifact(spelled, repoDir, \"test report\");\n  if (!artifact.ok) return artifact;\n  // The reader is chosen by MARKER, before either shape has validated\n  // anything. A file declaring `loamScenarioReport` must be graded as that\n  // shape even when it is malformed — falling through to the cucumber parser\n  // would tell an author their report is not a cucumber array, which is true,\n  // useless, and hides the actual mistake.\n  const parsed = isScenarioReport(artifact.doc)\n    ? readScenarioReport(artifact.doc, spelled)\n    : readCucumberReport(artifact.doc, spelled);\n  if (!parsed.ok) return { ok: false, code: \"answers-unreadable\", message: parsed.message };\n  return {\n    ok: true,\n    scenarios: parsed.scenarios,\n    report: {\n      path: artifact.spelled,\n      digest: artifact.digest,\n      mtime: artifact.mtime,\n      scenarios: parsed.scenarios.length,\n    },\n  };\n}\n\n/**\n * The repository an attestation binds to and the commit it binds at — two\n * values only ever asked about together, so they travel as one and the\n * inconsistent pair (this repo, that commit) stops being representable.\n */\nexport interface AttestationBinding {\n  repoDir: string;\n  commit: string;\n}\n\nexport type ServiceEvidenceCheck =\n  /** Every citation held up; `pins`/`tokenMisses` are the stamp and the honesty it computed en route. */\n  | ({ ok: true } & EvidencePins)\n  | { ok: false; message: string };\n\n/**\n * In federated mode, a confirmation is accepted only when its evidence holds up\n * in this repository: an agent's `file:line` resolves to a real line that is\n * unchanged at the attested commit, and each runner's evidence names the report\n * loam just read — the cucumber report for `runner`, the contract report for\n * `external-runner`. Legacy global mode deliberately keeps its original, looser\n * evidence contract for backward compatibility.\n *\n * The same pass now STAMPS what it validated: one `EvidencePin` per agent\n * citation, built where `committedFile`'s blob is already in hand (zero new\n * git calls), and one `TokenMiss` per citation whose blob does not contain the\n * claim's token (`tokens`, claim id → the literal the claim asserts). Runner\n * and contract answers get no pins — their evidence names a report entry, not\n * a file — and the legacy all-at-once form never calls this validator, so it\n * stamps nothing.\n */\nexport async function validateServiceEvidence(\n  answers: Answer[],\n  binding: AttestationBinding,\n  reports: ConsumedReports,\n  tokens: ReadonlyMap<string, string>,\n): Promise<ServiceEvidenceCheck> {\n  const { repoDir, commit } = binding;\n  const err = (message: string): ServiceEvidenceCheck => ({ ok: false, message });\n  const pins = new Map<string, EvidencePin[]>();\n  const tokenMisses: TokenMiss[] = [];\n  for (const report of [reports.results, reports.contract]) {\n    if (report === undefined) continue;\n    // Most reports are build output and untracked, and `git diff` is quiet on\n    // those — nothing here invents a rule for them. One the repository DOES\n    // carry has to match the commit being attested, like any other file the\n    // evidence rests on. Both reports independently: each is its own file\n    // making its own claim about this commit.\n    const clean = await git(repoDir, [\"diff\", \"--quiet\", commit, \"--\", report.path]);\n    if (clean.code !== 0) {\n      // Only `1` is git ANSWERING — \"that file differs\". Every other non-zero\n      // code is git failing to answer at all: no git on PATH, a fork that never\n      // happened, a child killed by a CI timeout or the OOM killer. Testing for\n      // `1` alone made those silently pass the check, so the one run that most\n      // needs the binding — the one where the machine is falling over — is the\n      // one that would mint an attestation whose report was never bound to the\n      // commit. An unanswered check is not a passed one, so the unknown refuses\n      // on the same terms as the known, and `clean.stderr` carries whatever\n      // account of itself the child managed to leave.\n      return err(\n        clean.code === 1\n          ? `The test report '${report.path}' is committed to this repository and differs from ${commit.slice(0, 12)} — commit it or attest the commit it belongs to.`\n          : `Cannot tell whether the test report '${report.path}' is bound to ${commit.slice(0, 12)} — git could not be run to completion: ${clean.stderr || \"git diff failed\"}`,\n      );\n    }\n  }\n  for (const answer of answers) {\n    if (answer.verdict !== \"confirmed\") continue;\n    if (answer.answered_by === \"runner\" || answer.answered_by === \"external-runner\") {\n      // A runner's evidence is an entry inside its report, not a file:line in\n      // the source — there is nothing to resolve. What must hold is that it\n      // names THAT report: an answer pointing anywhere else is not this run's.\n      const report = answer.answered_by === \"runner\" ? reports.results : reports.contract;\n      const stray = answer.evidence.filter((e) => report === undefined || !e.startsWith(`${report.path}: `));\n      if (stray.length > 0) {\n        return err(`Claim ${answer.id} has runner evidence ${stray.map((e) => `'${e}'`).join(\", \")} that does not name the report loam read.`);\n      }\n      continue;\n    }\n    for (const evidence of answer.evidence) {\n      const match = /^(.+):([1-9]\\d*)$/.exec(evidence);\n      if (match === null) {\n        return err(`Claim ${answer.id} has evidence '${evidence}' — service evidence must be a canonical relative file:line.`);\n      }\n      const relativePath = match[1]!;\n      const line = Number(match[2]);\n      let absolutePath: string;\n      try {\n        absolutePath = resolvePortableFileInside(repoDir, relativePath, `evidence for ${answer.id}`);\n      } catch (cause) {\n        return err(`Claim ${answer.id} has unsafe evidence '${evidence}': ${cause instanceof Error ? cause.message : String(cause)}`);\n      }\n      try {\n        const info = await stat(absolutePath);\n        if (!info.isFile()) {\n          return err(`Claim ${answer.id} has evidence '${evidence}', but '${relativePath}' is not a regular file.`);\n        }\n        const source = await readFile(absolutePath, \"utf8\");\n        const lines = sourceLines(source).length;\n        if (line > lines) {\n          return err(`Claim ${answer.id} has evidence '${evidence}', but '${relativePath}' has only ${lines} line(s).`);\n        }\n        const committed = await committedFile(repoDir, commit, relativePath);\n        if (!committed.ok) {\n          return err(`Claim ${answer.id} has evidence '${evidence}' that is not bound to ${commit.slice(0, 12)}: ${committed.message}`);\n        }\n        // The pin, built from the blob just fetched. `citedLine` is undefined\n        // exactly when the line is past the committed file's end — the refusal\n        // this validator already owed — so the bounds check and the pinned\n        // text can never disagree about where lines fall.\n        const text = citedLine(committed.source, line);\n        if (text === undefined) {\n          const committedLines = sourceLines(committed.source).length;\n          return err(`Claim ${answer.id} has evidence '${evidence}', but '${relativePath}' has only ${committedLines} line(s) at ${commit.slice(0, 12)}.`);\n        }\n        // The token scan happens here, per citation, because the blob is in\n        // hand and record time is when the answerer can still re-read what\n        // they cited. Substring, never a parse: the claim asserts a literal.\n        // A blob that does NOT contain the token is warned once (the notice\n        // built from `tokenMisses`) and the pin then omits the token — see\n        // EvidencePin.token for why re-litigating a never-there token at\n        // every later validate would be a false sentence with no repair.\n        const token = tokens.get(answer.id);\n        const held = token !== undefined && committed.source.includes(token);\n        if (token !== undefined && !held) tokenMisses.push({ id: answer.id, evidence, token });\n        const list = pins.get(answer.id) ?? [];\n        list.push({\n          path: relativePath,\n          line,\n          file_sha256: pinnedDigest(committed.source),\n          text,\n          ...(held && token !== undefined ? { token } : {}),\n        });\n        pins.set(answer.id, list);\n      } catch (cause) {\n        return err(`Claim ${answer.id} has unreadable evidence '${evidence}': ${cause instanceof Error ? cause.message : String(cause)}`);\n      }\n    }\n  }\n  return { ok: true, pins, tokenMisses };\n}\n\ntype CommitResult = { ok: true; commit: string } | { ok: false; message: string };\ntype CommittedFileResult = { ok: true; source: string } | { ok: false; message: string };\n\n/** Require the evidence blob to exist at HEAD and have no uncommitted edits. */\nexport async function committedFile(repoDir: string, commit: string, path: string): Promise<CommittedFileResult> {\n  const clean = await git(repoDir, [\"diff\", \"--quiet\", commit, \"--\", path]);\n  if (clean.code !== 0) {\n    return {\n      ok: false,\n      message: clean.code === 1 ? `'${path}' has uncommitted changes` : clean.stderr || \"git diff failed\",\n    };\n  }\n  const blob = await git(repoDir, [\"show\", `${commit}:${path}`]);\n  if (blob.code !== 0) {\n    return { ok: false, message: blob.stderr || `'${path}' is not tracked by that commit` };\n  }\n  return { ok: true, source: blob.stdout };\n}\n\ninterface GitResult {\n  /**\n   * Git's own exit status, or `-1` for \"git could not be run to completion\" —\n   * no git on PATH, a spawn failure, a child killed by a signal (the deadline\n   * below included), or output past the declared cap. Callers read specific\n   * meaning into small numbers (`1` from `git diff --quiet` is \"that file\n   * differs\"), so a run that never reached an exit status must not borrow one\n   * of them.\n   */\n  code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * How long one git question may take, and how much it may say. Both bounds\n * exist because every call in this module now runs while `loam verify --record`\n * HOLDS the docs lock: a `git rev-parse` blocked on a credential-helper prompt\n * used to hang this process forever with the lock in hand, wedging every\n * archive, rebase and record in the fleet behind a live pid that\n * `breakStaleLock` rightly refuses to break. The timeout mirrors\n * `core/provenance/git.ts`; the cap is sized for `git show` of a source file\n * an attestation cites (the default 1 MiB refused sound evidence the moment a\n * generated client crossed it), not for arbitrary blobs.\n */\nconst GIT_TIMEOUT_MS = 10_000;\nconst GIT_MAX_OUTPUT_BYTES = 64 * 1024 * 1024;\n\nfunction git(repoDir: string, args: string[]): Promise<GitResult> {\n  return new Promise((done) => {\n    execFile(\n      \"git\",\n      [\"-C\", repoDir, ...args],\n      { encoding: \"utf8\", timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_OUTPUT_BYTES },\n      (error, stdout, stderr) => {\n      done({\n        // `error.code` is an exit status only when it is a number: a spawn\n        // failure reports an errno string (\"ENOENT\") and a signal-killed child\n        // reports none at all. Folding those onto 1 would state that `git diff`\n        // found a difference — a Ctrl-C or an OOM kill during\n        // `loam verify --record` would read as an uncommitted edit and refuse\n        // a sound attestation. -1 is not a status git assigns, so both diff\n        // sites fall to their stderr-carrying arm and say what happened.\n        code: error === null ? 0 : typeof error.code === \"number\" ? error.code : -1,\n        stdout,\n        // A child that never ran writes nothing to stderr, so its only account\n        // of itself is on the error; without this the refusal would name no\n        // cause at all. A child WE killed gets its account written for it: the\n        // deadline exists for a git blocked on a credential-helper prompt, and\n        // the raw \"Command failed: git …\" says nothing about a deadline — the\n        // operator re-runs, waits the same 10 s, and reads the same message,\n        // with the actual fix (GIT_TERMINAL_PROMPT=0, or the helper) never\n        // reachable from it.\n        stderr:\n          error !== null && error.killed && error.signal !== null\n            ? `git did not answer within ${GIT_TIMEOUT_MS / 1000}s and was stopped — a prompt or a hung remote; GIT_TERMINAL_PROMPT=0 disables credential prompts`\n            : stderr.trim() || (error === null ? \"\" : error.message),\n      });\n    });\n  });\n}\n\n/** Resolve HEAD without a shell, so repository paths remain data, never code. */\nexport async function repositoryCommit(repoDir: string): Promise<CommitResult> {\n  const result = await git(repoDir, [\"rev-parse\", \"--verify\", \"HEAD^{commit}\"]);\n  if (result.code !== 0) {\n    return {\n      ok: false,\n      message: `Federated verification requires a git repository with a committed HEAD: ${result.stderr || \"git rev-parse failed\"}`,\n    };\n  }\n  const commit = result.stdout.trim();\n  if (!/^[0-9a-f]{40,64}$/i.test(commit)) {\n    return { ok: false, message: `Git returned an invalid HEAD commit '${commit}'.` };\n  }\n  return { ok: true, commit };\n}\n"]}
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/commands/verify/results.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAuB,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAe,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAoB,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAA6C,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAqC,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAMxD;;;;GAIG;AACH,MAAM,cAAc,GAClB,4GAA4G;IAC5G,uHAAuH;IACvH,kHAAkH;IAClH,6FAA6F,CAAC;AAEhG;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,OAA2B;IAC5E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IAC3F,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yCAAyC;IACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QAC3C,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1F,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,OAAO;YACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;SACnC;KACF,CAAC;AACJ,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAiB,EACjB,OAA2B,EAC3B,OAAwB,EACxB,MAAmC;IAEnC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,WAAW,GAAgB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,sEAAsE;YACtE,gDAAgD;YAChD,OAAO,GAAG,CACR,KAAK,CAAC,IAAI,KAAK,CAAC;gBACd,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,sDAAsD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kDAAkD;gBAC5J,CAAC,CAAC,wCAAwC,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C,KAAK,CAAC,MAAM,IAAI,iBAAiB,EAAE,CACzK,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;YAAE,SAAS;QAC7C,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;YAChF,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACvG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,wBAAwB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACzI,CAAC;YACD,SAAS;QACX,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;gBACrE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,kBAAkB,QAAQ,0BAA0B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChI,CAAC;gBACD,sEAAsE;gBACtE,uEAAuE;gBACvE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;oBAC5D,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,kBAAkB,QAAQ,WAAW,YAAY,cAAc,cAAc,eAAe,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;gBACnJ,CAAC;gBACD,oEAAoE;gBACpE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,iEAAiE;gBACjE,iEAAiE;gBACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACrE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI;oBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,YAAY;oBAClB,IAAI;oBACJ,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC;oBAC3C,IAAI;oBACJ,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,SAAS,MAAM,CAAC,EAAE,6BAA6B,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpI,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAID;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,EAAU,EAAE,QAAgB;IAC1E,MAAM,GAAG,GAAG,CAAC,OAAe,EAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,SAAS,EAAE,kBAAkB,QAAQ,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,yBAAyB,CAAC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,SAAS,EAAE,yBAAyB,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAC;QACH,oEAAoE;QACpE,0EAA0E;QAC1E,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;YAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,SAAS,EAAE,kBAAkB,QAAQ,WAAW,YAAY,sCAAsC,CAAC,CAAC;QAClI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,GAAG,CAAC,SAAS,EAAE,kBAAkB,QAAQ,WAAW,YAAY,0BAA0B,CAAC,CAAC;QACvH,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACvE,IAAI,IAAI,GAAG,KAAK;YAAE,OAAO,GAAG,CAAC,SAAS,EAAE,kBAAkB,QAAQ,WAAW,YAAY,cAAc,KAAK,WAAW,CAAC,CAAC;IAC3H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,SAAS,EAAE,6BAA6B,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAiB,EAAE,OAAe;IAC5E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,iBAAiB;YAAE,SAAS;QAC5H,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACvF,CAAC;AAKD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,MAAc,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,iBAAiB;SACpG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,iCAAiC,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,SAAS,GAAG,CAAC,OAAe,EAAE,IAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,QAAQ,CACN,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,EACxB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAC9E,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC1B,IAAI,CAAC;gBACH,mEAAmE;gBACnE,uEAAuE;gBACvE,wEAAwE;gBACxE,sDAAsD;gBACtD,sEAAsE;gBACtE,oEAAoE;gBACpE,iEAAiE;gBACjE,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,MAAM;gBACN,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,uEAAuE;gBACvE,sEAAsE;gBACtE,qEAAqE;gBACrE,mEAAmE;gBACnE,qBAAqB;gBACrB,MAAM,EACJ,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;oBACrD,CAAC,CAAC,6BAA6B,cAAc,GAAG,IAAI,kGAAkG;oBACtJ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;aAC7D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,2EAA2E,MAAM,CAAC,MAAM,IAAI,sBAAsB,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,MAAM,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["/**\n * The cucumber report, and the repository it has to be evidence FROM.\n *\n * A results file is only evidence if it describes the commit the attestation\n * names, so reading it and checking the repository are one subject: the git\n * helpers below are here because they answer the same question — is this\n * working tree the one the report was produced from.\n */\nimport { execFile } from \"node:child_process\";\nimport { readFile, stat } from \"node:fs/promises\";\nimport { resolvePortableFileInside } from \"../../core/kernel/path-safety.js\";\nimport { GIT_TIMEOUT_MS } from \"../../core/provenance/git.js\";\nimport { isScenarioReport, readCucumberReport, readScenarioReport, type ReportScenario } from \"../../core/results.js\";\nimport { type Answer } from \"../../core/verify/answers.js\";\nimport { citedLine, pinnedDigest, sourceLines, type EvidencePin } from \"../../core/verify/pins/pin.js\";\nimport { type ConsumedReport, type ConsumedReports } from \"../../core/verify/record.js\";\nimport { type EvidencePins, type TokenMiss } from \"./evidence/pins.js\";\nimport { readReportArtifact } from \"./evidence/read.js\";\n\nexport type ResultsRead =\n  | { ok: true; report: ConsumedReport; scenarios: ReportScenario[] }\n  | { ok: false; code: \"answers-unreadable\"; message: string };\n\n/**\n * The two shapes `--results` reads, named wherever a file is refused for being\n * neither — a fleet whose runner has no cucumber formatter learns here that\n * the runner-neutral shape exists, rather than from a parse error.\n */\nconst RESULTS_SHAPES =\n  \"--results reads two JSON shapes: a cucumber JSON report (cucumber-js --format json, cucumber-jvm, behave, \" +\n  \"SpecFlow/Reqnroll, pytest-bdd --cucumberjson and godog's cucumber formatter all write one), or loam's runner-neutral \" +\n  '{\"loamScenarioReport\": 1, \"results\": [{\"digest\": \"<16 hex>\", \"status\": \"passed\"}]} — the shape a JUnit, pytest, ' +\n  \"Vitest or house runner's report is adapted into, keyed by each scenario's @loam-digest tag.\";\n\n/**\n * The report as an artifact, not merely as a parse. The resolve/read/digest\n * plumbing lives in `./evidence/read.ts`, shared with `--contract-results`:\n * the bytes are digested and the file's mtime read, because loam cannot prove\n * a JSON file came from executing this commit and should stop implying\n * otherwise. It can say precisely which file it consumed, and that goes on\n * the record.\n */\nexport async function readResults(spelled: string, repoDir: string | undefined): Promise<ResultsRead> {\n  const artifact = await readReportArtifact(spelled, repoDir, \"test report\", RESULTS_SHAPES);\n  if (!artifact.ok) return artifact;\n  // The reader is chosen by MARKER, before either shape has validated\n  // anything. A file declaring `loamScenarioReport` must be graded as that\n  // shape even when it is malformed — falling through to the cucumber parser\n  // would tell an author their report is not a cucumber array, which is true,\n  // useless, and hides the actual mistake.\n  const parsed = isScenarioReport(artifact.doc)\n    ? readScenarioReport(artifact.doc, spelled)\n    : readCucumberReport(artifact.doc, spelled);\n  if (!parsed.ok) return { ok: false, code: \"answers-unreadable\", message: parsed.message };\n  return {\n    ok: true,\n    scenarios: parsed.scenarios,\n    report: {\n      path: artifact.spelled,\n      digest: artifact.digest,\n      mtime: artifact.mtime,\n      scenarios: parsed.scenarios.length,\n    },\n  };\n}\n\n/**\n * The repository an attestation binds to and the commit it binds at — two\n * values only ever asked about together, so they travel as one and the\n * inconsistent pair (this repo, that commit) stops being representable.\n */\nexport interface AttestationBinding {\n  repoDir: string;\n  commit: string;\n}\n\nexport type ServiceEvidenceCheck =\n  /** Every citation held up; `pins`/`tokenMisses` are the stamp and the honesty it computed en route. */\n  | ({ ok: true } & EvidencePins)\n  | { ok: false; message: string };\n\n/**\n * In federated mode, a confirmation is accepted only when its evidence holds up\n * in this repository: an agent's `file:line` resolves to a real line that is\n * unchanged at the attested commit, and each runner's evidence names the report\n * loam just read — the cucumber report for `runner`, the contract report for\n * `external-runner`. The legacy all-at-once form binds to no commit, so it gets\n * only the first half of that — {@link validateLocalEvidence}.\n *\n * The same pass now STAMPS what it validated: one `EvidencePin` per agent\n * citation, built where `committedFile`'s blob is already in hand (zero new\n * git calls), and one `TokenMiss` per citation whose blob does not contain the\n * claim's token (`tokens`, claim id → the literal the claim asserts). Runner\n * and contract answers get no pins — their evidence names a report entry, not\n * a file — and the legacy all-at-once form never calls this validator, so it\n * stamps nothing.\n */\nexport async function validateServiceEvidence(\n  answers: Answer[],\n  binding: AttestationBinding,\n  reports: ConsumedReports,\n  tokens: ReadonlyMap<string, string>,\n): Promise<ServiceEvidenceCheck> {\n  const { repoDir, commit } = binding;\n  const err = (message: string): ServiceEvidenceCheck => ({ ok: false, message });\n  const pins = new Map<string, EvidencePin[]>();\n  const tokenMisses: TokenMiss[] = [];\n  for (const report of [reports.results, reports.contract]) {\n    if (report === undefined) continue;\n    // Most reports are build output and untracked, and `git diff` is quiet on\n    // those — nothing here invents a rule for them. One the repository DOES\n    // carry has to match the commit being attested, like any other file the\n    // evidence rests on. Both reports independently: each is its own file\n    // making its own claim about this commit.\n    const clean = await git(repoDir, [\"diff\", \"--quiet\", commit, \"--\", report.path]);\n    if (clean.code !== 0) {\n      // Only `1` is git ANSWERING — \"that file differs\". Every other non-zero\n      // code is git failing to answer at all: no git on PATH, a fork that never\n      // happened, a child killed by a CI timeout or the OOM killer. Testing for\n      // `1` alone made those silently pass the check, so the one run that most\n      // needs the binding — the one where the machine is falling over — is the\n      // one that would mint an attestation whose report was never bound to the\n      // commit. An unanswered check is not a passed one, so the unknown refuses\n      // on the same terms as the known, and `clean.stderr` carries whatever\n      // account of itself the child managed to leave.\n      return err(\n        clean.code === 1\n          ? `The test report '${report.path}' is committed to this repository and differs from ${commit.slice(0, 12)} — commit it or attest the commit it belongs to.`\n          : `Cannot tell whether the test report '${report.path}' is bound to ${commit.slice(0, 12)} — git could not be run to completion: ${clean.stderr || \"git diff failed\"}`,\n      );\n    }\n  }\n  for (const answer of answers) {\n    if (answer.verdict !== \"confirmed\") continue;\n    if (answer.answered_by === \"runner\" || answer.answered_by === \"external-runner\") {\n      // A runner's evidence is an entry inside its report, not a file:line in\n      // the source — there is nothing to resolve. What must hold is that it\n      // names THAT report: an answer pointing anywhere else is not this run's.\n      const report = answer.answered_by === \"runner\" ? reports.results : reports.contract;\n      const stray = answer.evidence.filter((e) => report === undefined || !e.startsWith(`${report.path}: `));\n      if (stray.length > 0) {\n        return err(`Claim ${answer.id} has runner evidence ${stray.map((e) => `'${e}'`).join(\", \")} that does not name the report loam read.`);\n      }\n      continue;\n    }\n    for (const evidence of answer.evidence) {\n      const cited = await resolveCitation(repoDir, answer.id, evidence);\n      if (!cited.ok) return err(cited.message);\n      const { relativePath, line } = cited;\n      try {\n        const committed = await committedFile(repoDir, commit, relativePath);\n        if (!committed.ok) {\n          return err(`Claim ${answer.id} has evidence '${evidence}' that is not bound to ${commit.slice(0, 12)}: ${committed.message}`);\n        }\n        // The pin, built from the blob just fetched. `citedLine` is undefined\n        // exactly when the line is past the committed file's end — the refusal\n        // this validator already owed — so the bounds check and the pinned\n        // text can never disagree about where lines fall.\n        const text = citedLine(committed.source, line);\n        if (text === undefined) {\n          const committedLines = sourceLines(committed.source).length;\n          return err(`Claim ${answer.id} has evidence '${evidence}', but '${relativePath}' has only ${committedLines} line(s) at ${commit.slice(0, 12)}.`);\n        }\n        // The token scan happens here, per citation, because the blob is in\n        // hand and record time is when the answerer can still re-read what\n        // they cited. Substring, never a parse: the claim asserts a literal.\n        // A blob that does NOT contain the token is warned once (the notice\n        // built from `tokenMisses`) and the pin then omits the token — see\n        // EvidencePin.token for why re-litigating a never-there token at\n        // every later validate would be a false sentence with no repair.\n        const token = tokens.get(answer.id);\n        const held = token !== undefined && committed.source.includes(token);\n        if (token !== undefined && !held) tokenMisses.push({ id: answer.id, evidence, token });\n        const list = pins.get(answer.id) ?? [];\n        list.push({\n          path: relativePath,\n          line,\n          file_sha256: pinnedDigest(committed.source),\n          text,\n          ...(held && token !== undefined ? { token } : {}),\n        });\n        pins.set(answer.id, list);\n      } catch (cause) {\n        return err(`Claim ${answer.id} has unreadable evidence '${evidence}': ${cause instanceof Error ? cause.message : String(cause)}`);\n      }\n    }\n  }\n  return { ok: true, pins, tokenMisses };\n}\n\ntype Citation = { ok: true; relativePath: string; line: number } | { ok: false; message: string };\n\n/**\n * One `file:line` citation, resolved in the working tree: canonical form, a\n * path that stays inside the repository, a regular file, and a line that\n * exists. What both recording forms owe every agent citation before anything\n * else — the federated form then binds it to the attested commit.\n */\nasync function resolveCitation(repoDir: string, id: string, evidence: string): Promise<Citation> {\n  const err = (message: string): Citation => ({ ok: false, message });\n  const match = /^(.+):([1-9]\\d*)$/.exec(evidence);\n  if (match === null) {\n    return err(`Claim ${id} has evidence '${evidence}' — evidence must be a canonical relative file:line.`);\n  }\n  const relativePath = match[1]!;\n  const line = Number(match[2]);\n  let absolutePath: string;\n  try {\n    absolutePath = resolvePortableFileInside(repoDir, relativePath, `evidence for ${id}`);\n  } catch (cause) {\n    return err(`Claim ${id} has unsafe evidence '${evidence}': ${cause instanceof Error ? cause.message : String(cause)}`);\n  }\n  try {\n    // Absence named in the repository's own spelling: the stat's ENOENT\n    // carries the absolute path of whatever machine ran this, which tells the\n    // reader nothing the citation did not.\n    const info = await stat(absolutePath).catch((cause: NodeJS.ErrnoException) => {\n      if (cause.code === \"ENOENT\") return null;\n      throw cause;\n    });\n    if (info === null) return err(`Claim ${id} has evidence '${evidence}', but '${relativePath}' does not exist in this repository.`);\n    if (!info.isFile()) return err(`Claim ${id} has evidence '${evidence}', but '${relativePath}' is not a regular file.`);\n    const lines = sourceLines(await readFile(absolutePath, \"utf8\")).length;\n    if (line > lines) return err(`Claim ${id} has evidence '${evidence}', but '${relativePath}' has only ${lines} line(s).`);\n  } catch (cause) {\n    return err(`Claim ${id} has unreadable evidence '${evidence}': ${cause instanceof Error ? cause.message : String(cause)}`);\n  }\n  return { ok: true, relativePath, line };\n}\n\n/**\n * The all-at-once form's evidence check: every agent citation must resolve to a\n * real line of a real file in THIS repository. The form binds to no commit, so\n * there is nothing to pin and no blob to compare — but it used to check\n * nothing at all, and accepted `src/foo.py:1` for a file that did not exist\n * while printing `verified`, in the same release whose `--service` form refused\n * exactly that citation. The commit binding is the federated form's addition,\n * not the difference between checked and unchecked.\n *\n * A CITATION is what is checked, and only a citation: an entry shaped like a\n * `path:line` (see {@link citesALine}). The all-at-once form has always taken\n * other evidence — \"manual QA by Alice\", a CI run's URL, `README.md` with no\n * line — and still records it as it stands; holding every entry to the\n * `file:line` grammar refused all of that with `answers-unevidenced`, which\n * was never the defect. What a `path:line` claims is checkable, so it is\n * checked; prose claims nothing a file can contradict. The federated form\n * keeps its stricter contract — every agent entry a `file:line` bound to the\n * attested commit — because its whole promise is that binding.\n */\nexport async function validateLocalEvidence(answers: Answer[], repoDir: string): Promise<{ ok: true } | { ok: false; message: string }> {\n  for (const answer of answers) {\n    if (answer.verdict !== \"confirmed\" || answer.answered_by === \"runner\" || answer.answered_by === \"external-runner\") continue;\n    for (const evidence of answer.evidence.filter(citesALine)) {\n      const cited = await resolveCitation(repoDir, answer.id, evidence);\n      if (!cited.ok) return cited;\n    }\n  }\n  return { ok: true };\n}\n\n/**\n * Is this evidence entry shaped like a `path:line` — something that names a\n * line of a file and can therefore be wrong about it? One token (no\n * whitespace: prose such as \"checked at 10:30\" is not a citation), not a URL\n * (`https://ci.example:8443` ends in a number too), ending in `:<digits>`.\n * Deliberately wider than `resolveCitation`'s canonical form: `src/x.py:0` and\n * `../x.py:3` are citations, badly made, and must be refused rather than\n * waved through as prose.\n */\nfunction citesALine(evidence: string): boolean {\n  return /^\\S+:\\d+$/.test(evidence) && !/^[A-Za-z][A-Za-z0-9+.-]*:\\/\\//.test(evidence);\n}\n\ntype CommitResult = { ok: true; commit: string } | { ok: false; message: string };\ntype CommittedFileResult = { ok: true; source: string } | { ok: false; message: string };\n\n/** Require the evidence blob to exist at HEAD and have no uncommitted edits. */\nexport async function committedFile(repoDir: string, commit: string, path: string): Promise<CommittedFileResult> {\n  const clean = await git(repoDir, [\"diff\", \"--quiet\", commit, \"--\", path]);\n  if (clean.code !== 0) {\n    return {\n      ok: false,\n      message: clean.code === 1 ? `'${path}' has uncommitted changes` : clean.stderr || \"git diff failed\",\n    };\n  }\n  const blob = await git(repoDir, [\"show\", `${commit}:${path}`]);\n  if (blob.code !== 0) {\n    return { ok: false, message: blob.stderr || `'${path}' is not tracked by that commit` };\n  }\n  return { ok: true, source: blob.stdout };\n}\n\ninterface GitResult {\n  /**\n   * Git's own exit status, or `-1` for \"git could not be run to completion\" —\n   * no git on PATH, a spawn failure, a child killed by a signal (the deadline\n   * below included), or output past the declared cap. Callers read specific\n   * meaning into small numbers (`1` from `git diff --quiet` is \"that file\n   * differs\"), so a run that never reached an exit status must not borrow one\n   * of them.\n   */\n  code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * How long one git question may take, and how much it may say. Both bounds\n * exist because every call in this module now runs while `loam verify --record`\n * HOLDS the docs lock: a `git rev-parse` blocked on a credential-helper prompt\n * used to hang this process forever with the lock in hand, wedging every\n * archive, rebase and record in the fleet behind a live pid that\n * `breakStaleLock` rightly refuses to break. The timeout IS\n * `core/provenance/git.ts`'s (imported, so the two cannot drift); the cap is\n * sized for `git show` of a source file an attestation cites (the default\n * 1 MiB refused sound evidence the moment a generated client crossed it), not\n * for arbitrary blobs.\n *\n * Not `gitText` itself: its answer carries no signal, so a child killed by\n * the deadline and one killed from outside would read alike, and the\n * deadline's own message below is the one that names the fix.\n */\nconst GIT_MAX_OUTPUT_BYTES = 64 * 1024 * 1024;\n\nfunction git(repoDir: string, args: string[]): Promise<GitResult> {\n  return new Promise((done) => {\n    execFile(\n      \"git\",\n      [\"-C\", repoDir, ...args],\n      { encoding: \"utf8\", timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_OUTPUT_BYTES },\n      (error, stdout, stderr) => {\n      done({\n        // `error.code` is an exit status only when it is a number: a spawn\n        // failure reports an errno string (\"ENOENT\") and a signal-killed child\n        // reports none at all. Folding those onto 1 would state that `git diff`\n        // found a difference — a Ctrl-C or an OOM kill during\n        // `loam verify --record` would read as an uncommitted edit and refuse\n        // a sound attestation. -1 is not a status git assigns, so both diff\n        // sites fall to their stderr-carrying arm and say what happened.\n        code: error === null ? 0 : typeof error.code === \"number\" ? error.code : -1,\n        stdout,\n        // A child that never ran writes nothing to stderr, so its only account\n        // of itself is on the error; without this the refusal would name no\n        // cause at all. A child WE killed gets its account written for it: the\n        // deadline exists for a git blocked on a credential-helper prompt, and\n        // the raw \"Command failed: git …\" says nothing about a deadline — the\n        // operator re-runs, waits the same 10 s, and reads the same message,\n        // with the actual fix (GIT_TERMINAL_PROMPT=0, or the helper) never\n        // reachable from it.\n        stderr:\n          error !== null && error.killed && error.signal !== null\n            ? `git did not answer within ${GIT_TIMEOUT_MS / 1000}s and was stopped — a prompt or a hung remote; GIT_TERMINAL_PROMPT=0 disables credential prompts`\n            : stderr.trim() || (error === null ? \"\" : error.message),\n      });\n    });\n  });\n}\n\n/** Resolve HEAD without a shell, so repository paths remain data, never code. */\nexport async function repositoryCommit(repoDir: string): Promise<CommitResult> {\n  const result = await git(repoDir, [\"rev-parse\", \"--verify\", \"HEAD^{commit}\"]);\n  if (result.code !== 0) {\n    return {\n      ok: false,\n      message: `Federated verification requires a git repository with a committed HEAD: ${result.stderr || \"git rev-parse failed\"}`,\n    };\n  }\n  const commit = result.stdout.trim();\n  if (!/^[0-9a-f]{40,64}$/i.test(commit)) {\n    return { ok: false, message: `Git returned an invalid HEAD commit '${commit}'.` };\n  }\n  return { ok: true, commit };\n}\n"]}