agentwrangler 0.1.0

package/dist/evidence/g2/adjudicate.js

@@ -0,0 +1,20 @@
+export async function adjudicatePacket(entries, judge) {
+    const adjudicatedEntries = [];
+    for (const entry of entries) {
+        const result = await judge({
+            findingAlias: entry.findingAlias,
+            evidenceKind: entry.evidenceKind,
+            evidence: entry.evidence,
+        });
+        if (!result.ok) {
+            return { ok: false, reason: result.reason, findingAlias: entry.findingAlias };
+        }
+        adjudicatedEntries.push({
+            findingAlias: entry.findingAlias,
+            verdict: result.verdict,
+            confidence: result.confidence,
+            rationaleTag: result.rationaleTag,
+        });
+    }
+    return { ok: true, entries: adjudicatedEntries };
+}

package/dist/evidence/g2/cli.js

@@ -0,0 +1,207 @@
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { openDb } from "../../db/open.js";
+import { readAnthropicApiKey } from "../../oauth/anthropic-api-key.js";
+import { claudeJudgeClient } from "../../oauth/judge-g2-client.js";
+import { G2_KAPPA_GATE, G2_MIN_SEED_N } from "./kappa.js";
+import { runG2JudgePipeline } from "./pipeline.js";
+import { isG2JudgeOptIn } from "./store.js";
+function defaultLiveDb() {
+    return path.join(os.homedir(), ".agentwrangler", "db.sqlite");
+}
+function parseArgs(argv) {
+    let execute = false;
+    let liveDb = defaultLiveDb();
+    let scratchState = "";
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--execute") {
+            execute = true;
+            continue;
+        }
+        if (arg === "--live-db") {
+            const val = argv[i + 1];
+            if (val === undefined)
+                throw new Error("--live-db requires a value");
+            liveDb = val;
+            i++;
+            continue;
+        }
+        if (arg === "--scratch-state") {
+            const val = argv[i + 1];
+            if (val === undefined)
+                throw new Error("--scratch-state requires a value");
+            scratchState = val;
+            i++;
+        }
+    }
+    return { execute, liveDb, scratchState };
+}
+/**
+ * Load G2 artifacts from the scratch state directory produced by `evidence:prepare-g2 -- --execute`.
+ *
+ * Expected files:
+ *   <scratchState>/manifest.json  — Cond1CorpusManifest
+ *   <scratchState>/packet.json    — Cond1BlindedPacket (entries mapped to G2PacketEntry)
+ *   <scratchState>/key.json       — Cond1SealedKey
+ *   <scratchState>/seed.json      — G2SeedLabel[] (~10 hand-labeled findings for kappa calibration)
+ */
+function loadArtifactsFromState(scratchState) {
+    const manifestBytes = fs.readFileSync(path.join(scratchState, "manifest.json"));
+    const corpusManifestFileSha256 = createHash("sha256").update(manifestBytes).digest("hex");
+    const manifest = JSON.parse(manifestBytes.toString("utf8"));
+    const packet = JSON.parse(fs.readFileSync(path.join(scratchState, "packet.json"), "utf8"));
+    const packetEntries = packet.entries.map(({ findingAlias, evidenceKind, evidence }) => ({
+        findingAlias,
+        evidenceKind,
+        evidence,
+    }));
+    const key = JSON.parse(fs.readFileSync(path.join(scratchState, "key.json"), "utf8"));
+    const seed = JSON.parse(fs.readFileSync(path.join(scratchState, "seed.json"), "utf8"));
+    return { packetEntries, key, manifest, corpusManifestFileSha256, seed };
+}
+/**
+ * Testable core of the evidence:judge-g2 CLI.
+ *
+ * Deps are optional so tests can inject fakes without touching disk or the network.
+ * When execute=false (no --execute flag), prints a plan and returns 0 without any DB or API calls.
+ *
+ * SEC-101: rationaleTag from judge verdicts is never written to disk, DB, or output.
+ */
+export async function runG2JudgeCli(argv, deps = {}) {
+    const writeOut = deps.stdout ?? ((line) => process.stdout.write(`${line}\n`));
+    const writeErr = deps.stderr ?? ((line) => process.stderr.write(`${line}\n`));
+    const args = parseArgs(argv);
+    if (!args.execute) {
+        writeOut(`evidence:judge-g2 — G2 Claude-judge pipeline
+
+What leaves your machine:
+  On --execute (with a valid seed), ALL blinded evidence excerpts in the packet are sent to the
+  Claude API (Anthropic) in one offline batch — not just the seed. The κ gate below decides whether
+  labels are persisted and scored; it does NOT reduce what is transmitted. An invalid seed is
+  rejected up front and sends nothing.
+
+Plan:
+  1. ADJUDICATE — Judge every blinded packet finding (CONFIRMED/REJECTED + confidence).
+     Rationale text is never written to disk (SEC-101).
+  2. CALIBRATE — Compute Cohen's κ over the hand-labeled human seed (seed.json in the scratch
+     state directory) vs the judge's verdicts on those same findings.
+  3. KAPPA GATE (κ ≥ ${G2_KAPPA_GATE}, seed ≥ ${G2_MIN_SEED_N}) — If calibration fails the run is
+     BLOCKED_LOW_KAPPA: no verdicts are persisted and nothing is scored.
+  4. LABEL + SCORE — On pass, de-blind against the sealed key, persist verdicts to the live DB,
+     and score precision.
+
+Opt-in required:
+  The key "g2_claude_judge_opt_in" in user_config must be set to "true" in the live DB.
+  This confirms consent to sending the blinded PR evidence excerpts to the Claude API.
+
+Usage:
+  npm run evidence:judge-g2 -- --execute --scratch-state <path/to/state>
+  npm run evidence:judge-g2 -- --execute --scratch-state <path> --live-db <path/to/db.sqlite>`);
+        return 0;
+    }
+    const db = deps.db ?? openDb(args.liveDb);
+    if (!isG2JudgeOptIn(db)) {
+        writeErr(`[judge-g2] REFUSED: g2_claude_judge_opt_in is not set to "true" in user_config.
+
+Set it with:
+  INSERT OR REPLACE INTO user_config (key, value)
+  VALUES ('g2_claude_judge_opt_in', 'true');
+
+This confirms consent to sending blinded PR evidence excerpts to the Claude API (Anthropic).
+The evidence leaves your machine. No rationale text is written to disk (SEC-101).`);
+        return 1;
+    }
+    const loadArtifacts = deps.loadArtifacts ?? (() => loadArtifactsFromState(args.scratchState));
+    let artifacts;
+    try {
+        artifacts = loadArtifacts();
+    }
+    catch {
+        // Do NOT echo the underlying error — a JSON parse error can embed a fragment
+        // of the evidence payload (SEC-101).
+        writeErr("[judge-g2] Could not load G2 artifacts. Expected manifest.json, packet.json, key.json, " +
+            "and a hand-authored seed.json in the --scratch-state directory (from evidence:prepare-g2).");
+        return 1;
+    }
+    let judge = deps.judge;
+    if (judge === undefined) {
+        // Prefer a raw Anthropic API key (separate rate-limit pool) over the shared
+        // Claude Code subscription OAuth token. SEC-101: log the source, never the key.
+        const keyResult = await readAnthropicApiKey();
+        if (keyResult.ok) {
+            writeOut(`[judge-g2] auth: api-key (${keyResult.source})`);
+            judge = claudeJudgeClient({ apiKey: keyResult.data });
+        }
+        else {
+            writeOut(`[judge-g2] auth: oauth (subscription; no API key: ${keyResult.reason})`);
+            judge = claudeJudgeClient();
+        }
+    }
+    const result = await runG2JudgePipeline({
+        db,
+        judge,
+        packetEntries: artifacts.packetEntries,
+        seed: artifacts.seed,
+        key: artifacts.key,
+        manifest: artifacts.manifest,
+        corpusManifestFileSha256: artifacts.corpusManifestFileSha256,
+    }, deps.pipelineDeps);
+    if (result.status === "JUDGE_ERROR") {
+        writeErr(`[judge-g2] JUDGE_ERROR on ${result.findingAlias}: ${result.reason}`);
+        return 1;
+    }
+    if (result.status === "INVALID_SEED") {
+        writeErr(`[judge-g2] INVALID_SEED: ${result.reason}
+seedN: ${result.seedN}  matchedN: ${result.matchedN}  minSeedN: ${result.minSeedN}
+No evidence was sent, no verdicts were persisted, and nothing was scored.`);
+        return 1;
+    }
+    if (result.status === "BLOCKED_LOW_KAPPA") {
+        writeOut(`status: BLOCKED_LOW_KAPPA
+kappa: ${result.kappa.toFixed(4)}
+rawAgreement: ${result.rawAgreement.toFixed(4)}
+seedN: ${result.seedN}
+gate: ${result.gate}
+
+Calibration failed (κ < ${result.gate}). Auto-labeling was skipped; no DB writes occurred.`);
+        return 1;
+    }
+    // SCORED — print aggregate summary (SEC-101: no rationaleTag)
+    const { score } = result;
+    const extLines = ["E1", "E2", "E3"]
+        .map((id) => {
+        const ex = score.extractors[id];
+        if (ex === undefined)
+            return `  ${id}: not scored`;
+        const p = ex.precision !== null ? ex.precision.toFixed(4) : "null";
+        return `  ${id}: status=${ex.status} precision=${p} emittedN=${ex.emittedN}`;
+    })
+        .join("\n");
+    writeOut(`status: SCORED
+kappa: ${result.kappa.toFixed(4)}
+rawAgreement: ${result.rawAgreement.toFixed(4)}
+seedN: ${result.seedN}
+labeledN: ${result.labeledN}
+overallStatus: ${score.overallStatus}
+extractors:
+${extLines}`);
+    return 0;
+}
+const invokedPath = process.argv[1];
+if (invokedPath !== undefined &&
+    pathToFileURL(path.resolve(invokedPath)).href ===
+        pathToFileURL(fileURLToPath(import.meta.url)).href) {
+    runG2JudgeCli(process.argv.slice(2))
+        .then((code) => {
+        process.exitCode = code;
+    })
+        .catch(() => {
+        // Never surface a raw stack — it could echo evidence (SEC-101). Fail closed.
+        process.stderr.write("[judge-g2] fatal error\n");
+        process.exitCode = 1;
+    });
+}

package/dist/evidence/g2/kappa.js

@@ -0,0 +1,39 @@
+export const G2_KAPPA_GATE = 0.6;
+// Minimum human-seed size for a meaningful κ calibration. Below this, κ is too
+// noisy to anchor on (a single agreeing pair yields κ=1), so the pipeline
+// refuses rather than auto-labeling on a degenerate seed.
+export const G2_MIN_SEED_N = 8;
+export function cohenKappa(a, b) {
+    if (a.length !== b.length) {
+        throw new Error("Judge label arrays must have the same length.");
+    }
+    if (a.length === 0) {
+        throw new Error("Judge label arrays must not be empty.");
+    }
+    let agreements = 0;
+    let aConfirmed = 0;
+    let bConfirmed = 0;
+    for (let index = 0; index < a.length; index += 1) {
+        if (a[index] === b[index]) {
+            agreements += 1;
+        }
+        if (a[index] === "CONFIRMED") {
+            aConfirmed += 1;
+        }
+        if (b[index] === "CONFIRMED") {
+            bConfirmed += 1;
+        }
+    }
+    const n = a.length;
+    const rawAgreement = agreements / n;
+    const aConfirmedFraction = aConfirmed / n;
+    const bConfirmedFraction = bConfirmed / n;
+    const expectedAgreement = aConfirmedFraction * bConfirmedFraction + (1 - aConfirmedFraction) * (1 - bConfirmedFraction);
+    const denominator = 1 - expectedAgreement;
+    const kappa = denominator === 0
+        ? rawAgreement === 1
+            ? 1
+            : 0
+        : (rawAgreement - expectedAgreement) / denominator;
+    return { n, rawAgreement, kappa };
+}

package/dist/evidence/g2/pipeline.js

@@ -0,0 +1,92 @@
+import { scoreCond1 } from "../cond1/score.js";
+import { adjudicatePacket as adjudicate } from "./adjudicate.js";
+import { G2_KAPPA_GATE, G2_MIN_SEED_N, cohenKappa } from "./kappa.js";
+import { persistJudgeVerdicts } from "./store.js";
+export async function runG2JudgePipeline(input, deps = {}) {
+    // Guard the calibration anchor BEFORE sending anything to the judge: refuse to
+    // run on a degenerate seed. Every seed alias must be present in the packet (no
+    // silent drop — a stale seed reused against a re-randomized packet would
+    // otherwise "pass" on a tiny matched subset), and the seed must clear the
+    // minimum-N floor. Checking up front means an invalid seed sends no evidence.
+    const minSeedN = deps.minSeedN ?? G2_MIN_SEED_N;
+    const packetAliases = new Set(input.packetEntries.map((entry) => entry.findingAlias));
+    const matchedSeed = input.seed.filter((seed) => packetAliases.has(seed.findingAlias));
+    if (matchedSeed.length !== input.seed.length || matchedSeed.length < minSeedN) {
+        return {
+            status: "INVALID_SEED",
+            reason: matchedSeed.length !== input.seed.length
+                ? "One or more seed aliases are not present in the packet (stale seed?)."
+                : `Seed size ${matchedSeed.length} is below the minimum ${minSeedN} for calibration.`,
+            seedN: input.seed.length,
+            matchedN: matchedSeed.length,
+            minSeedN,
+        };
+    }
+    const adjudication = await adjudicate(input.packetEntries, input.judge);
+    if (!adjudication.ok) {
+        return {
+            status: "JUDGE_ERROR",
+            reason: adjudication.reason,
+            findingAlias: adjudication.findingAlias,
+        };
+    }
+    const verdictByAlias = new Map(adjudication.entries.map((entry) => [entry.findingAlias, entry]));
+    const seedPairs = input.seed.flatMap((seed) => {
+        const verdict = verdictByAlias.get(seed.findingAlias);
+        return verdict === undefined ? [] : [[seed.label, verdict.verdict]];
+    });
+    const calibration = cohenKappa(seedPairs.map(([seedLabel]) => seedLabel), seedPairs.map(([, judgeLabel]) => judgeLabel));
+    if (calibration.kappa < G2_KAPPA_GATE) {
+        return {
+            status: "BLOCKED_LOW_KAPPA",
+            kappa: calibration.kappa,
+            rawAgreement: calibration.rawAgreement,
+            seedN: calibration.n,
+            gate: G2_KAPPA_GATE,
+        };
+    }
+    const answerByAlias = new Map(input.key.answers.map((answer) => [answer.findingAlias, answer]));
+    const labeledEntries = adjudication.entries.flatMap((entry) => {
+        const answer = answerByAlias.get(entry.findingAlias);
+        return answer === undefined ? [] : [[entry, answer]];
+    });
+    // Persist only findings the scorer counts (evidenceSufficient); redaction-failed
+    // findings score as UNCERTAIN, so writing a confident human_state for them would
+    // make the live DB disagree with the score.
+    persistJudgeVerdicts(input.db, labeledEntries
+        .filter(([, answer]) => answer.evidenceSufficient)
+        .map(([entry, answer]) => ({
+        findingId: answer.sourceFindingId,
+        verdict: entry.verdict,
+        confidence: entry.confidence,
+    })));
+    const verdicts = labeledEntries.map(([entry, answer]) => ({
+        findingAlias: entry.findingAlias,
+        verdict: !answer.evidenceSufficient
+            ? "UNCERTAIN"
+            : entry.verdict === "CONFIRMED"
+                ? "TRUE_POSITIVE"
+                : "FALSE_POSITIVE",
+        adjudicatorAlias: "g2-judge",
+        reasonCode: !answer.evidenceSufficient
+            ? "INSUFFICIENT_EVIDENCE"
+            : entry.verdict === "CONFIRMED"
+                ? "EVIDENCE_SUPPORTS"
+                : "CONTEXT_NEGATES",
+    }));
+    const scorer = deps.scorer ?? scoreCond1;
+    const score = scorer({
+        manifest: input.manifest,
+        corpusManifestFileSha256: input.corpusManifestFileSha256,
+        answers: input.key.answers,
+        verdicts,
+    });
+    return {
+        status: "SCORED",
+        kappa: calibration.kappa,
+        rawAgreement: calibration.rawAgreement,
+        seedN: calibration.n,
+        labeledN: verdicts.length,
+        score,
+    };
+}

package/dist/evidence/g2/store.js

@@ -0,0 +1,14 @@
+export function isG2JudgeOptIn(db) {
+    const row = db
+        .prepare("SELECT value FROM user_config WHERE key = 'g2_claude_judge_opt_in'")
+        .get();
+    return row?.value === "true";
+}
+export function persistJudgeVerdicts(db, verdicts) {
+    const updateVerdict = db.prepare("UPDATE review_findings SET human_state = ?, confidence = ?, source = 'LLM' WHERE finding_id = ?");
+    db.transaction(() => {
+        for (const verdict of verdicts) {
+            updateVerdict.run(verdict.verdict, verdict.confidence, verdict.findingId);
+        }
+    })();
+}

package/dist/evidence/github/client.js

@@ -0,0 +1 @@
+export {};

package/dist/evidence/github/gh-cli-client.js

@@ -0,0 +1,301 @@
+import { projectPRHeadKey } from "../../outcomes/github/client.js";
+import { defaultGhRunner, } from "../../outcomes/github/gh-cli-client.js";
+const MAX_PAGES = 1_000;
+export const EVIDENCE_DIFF_MAX_BYTES = 16 * 1024 * 1024;
+const SAFE_SEGMENT = /^[A-Za-z0-9_.-]+$/;
+const SAFE_ALIAS = /^[A-Za-z0-9_.-]+$/;
+const STRICT_UTC_RFC3339 = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{1,9}))?Z$/;
+const REVIEW_THREADS_QUERY = `query($owner:String!, $repo:String!, $pr:Int!, $cursor:String) {
+  repository(owner:$owner, name:$repo) {
+    pullRequest(number:$pr) {
+      reviewThreads(first:100, after:$cursor) {
+        pageInfo { hasNextPage endCursor }
+        nodes { id isResolved }
+      }
+    }
+  }
+}`;
+function fail(reason) {
+    return { ok: false, reason };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isValidRepo(owner, repo) {
+    return (owner.length > 0 &&
+        repo.length > 0 &&
+        owner !== "." &&
+        owner !== ".." &&
+        repo !== "." &&
+        repo !== ".." &&
+        SAFE_SEGMENT.test(owner) &&
+        SAFE_SEGMENT.test(repo));
+}
+function isValidPrNumber(value) {
+    return Number.isSafeInteger(value) && value > 0;
+}
+/** Fixed-width UTC key retains the approved timestamp's nanosecond ordering. */
+function utcSortKey(value) {
+    const match = STRICT_UTC_RFC3339.exec(value);
+    const seconds = match?.[1];
+    if (seconds === undefined)
+        return null;
+    const parsed = new Date(`${seconds}Z`);
+    if (!Number.isFinite(parsed.getTime()) || parsed.toISOString().slice(0, 19) !== seconds) {
+        return null;
+    }
+    return `${seconds}.${(match?.[2] ?? "").padEnd(9, "0")}Z`;
+}
+function binaryCompare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function isRunnerResult(value) {
+    if (!isRecord(value))
+        return false;
+    return (typeof value.ok === "boolean" &&
+        typeof value.stdout === "string" &&
+        typeof value.stderr === "string" &&
+        (typeof value.code === "number" || value.code === null));
+}
+export class EvidenceGhCliClient {
+    token;
+    runner;
+    constructor(tokenResult, runner = defaultGhRunner) {
+        this.token = tokenResult.ok ? tokenResult.data : null;
+        this.runner = runner;
+    }
+    get enabled() {
+        return this.token !== null;
+    }
+    async run(args, input, maxStdoutBytes) {
+        if (!this.enabled)
+            return fail("EVIDENCE_GITHUB_DISABLED");
+        let result;
+        try {
+            result = await this.runner(args, {
+                token: this.token,
+                ...(input === undefined ? {} : { input }),
+                ...(maxStdoutBytes === undefined ? {} : { maxStdoutBytes }),
+            });
+        }
+        catch {
+            return fail("EVIDENCE_GITHUB_COMMAND_FAILED");
+        }
+        if (isRunnerResult(result) && result.failure === "stdout-limit") {
+            return fail("EVIDENCE_GITHUB_RESPONSE_TOO_LARGE");
+        }
+        if (!isRunnerResult(result) || !result.ok) {
+            return fail("EVIDENCE_GITHUB_COMMAND_FAILED");
+        }
+        return { ok: true, data: result };
+    }
+    async getPRHeadKey(owner, repo, prNumber) {
+        if (!this.enabled)
+            return { ok: false, reason: "EVIDENCE_GITHUB_DISABLED" };
+        if (!isValidRepo(owner, repo) || !isValidPrNumber(prNumber)) {
+            return { ok: false, reason: "EVIDENCE_GITHUB_REQUEST_INVALID" };
+        }
+        const result = await this.run(["api", `repos/${owner}/${repo}/pulls/${prNumber}`]);
+        if (!result.ok)
+            return result;
+        let payload;
+        try {
+            payload = JSON.parse(result.data.stdout);
+        }
+        catch {
+            return { ok: false, reason: "EVIDENCE_GITHUB_PAYLOAD_INVALID" };
+        }
+        const projected = projectPRHeadKey(payload);
+        return projected.ok ? projected : { ok: false, reason: "EVIDENCE_GITHUB_PAYLOAD_INVALID" };
+    }
+    async listMergedPRs(repositories, asOf) {
+        if (!this.enabled)
+            return fail("EVIDENCE_GITHUB_DISABLED");
+        const asOfKey = utcSortKey(asOf);
+        if (asOfKey === null || repositories.length === 0) {
+            return fail("EVIDENCE_GITHUB_REQUEST_INVALID");
+        }
+        const aliases = new Set();
+        for (const repository of repositories) {
+            if (!isValidRepo(repository.owner, repository.repo) ||
+                !SAFE_ALIAS.test(repository.reportAlias) ||
+                repository.reportAlias.length === 0 ||
+                aliases.has(repository.reportAlias)) {
+                return fail("EVIDENCE_GITHUB_REQUEST_INVALID");
+            }
+            aliases.add(repository.reportAlias);
+        }
+        const orderedRepos = [...repositories].sort((a, b) => binaryCompare(a.reportAlias, b.reportAlias));
+        const rows = [];
+        for (const repository of orderedRepos) {
+            const seen = new Map();
+            let completed = false;
+            for (let page = 1; page <= MAX_PAGES; page += 1) {
+                const path = `repos/${repository.owner}/${repository.repo}/pulls?` +
+                    `state=closed&sort=updated&direction=desc&per_page=100&page=${page}`;
+                const result = await this.run(["api", path]);
+                if (!result.ok)
+                    return result;
+                let payload;
+                try {
+                    payload = JSON.parse(result.data.stdout);
+                }
+                catch {
+                    return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+                }
+                if (!Array.isArray(payload))
+                    return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+                if (payload.length > 100)
+                    return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+                if (payload.length === 0) {
+                    completed = true;
+                    break;
+                }
+                for (const item of payload) {
+                    if (!isRecord(item) ||
+                        !isValidPrNumber(item.number) ||
+                        !(typeof item.merged_at === "string" || item.merged_at === null)) {
+                        return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+                    }
+                    const number = item.number;
+                    const mergedAt = item.merged_at;
+                    const mergedAtKey = mergedAt === null ? null : utcSortKey(mergedAt);
+                    if (mergedAt !== null && mergedAtKey === null) {
+                        return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+                    }
+                    if (seen.has(number)) {
+                        return fail(seen.get(number) === mergedAt
+                            ? "EVIDENCE_GITHUB_DUPLICATE"
+                            : "EVIDENCE_GITHUB_DUPLICATE_CONFLICT");
+                    }
+                    seen.set(number, mergedAt);
+                    if (mergedAt !== null && mergedAtKey !== null && mergedAtKey <= asOfKey) {
+                        rows.push({ reportAlias: repository.reportAlias, number, mergedAt });
+                    }
+                }
+            }
+            if (!completed)
+                return fail("EVIDENCE_GITHUB_PAGINATION_LIMIT");
+        }
+        rows.sort((a, b) => binaryCompare(a.reportAlias, b.reportAlias) || a.number - b.number);
+        return { ok: true, data: rows };
+    }
+    async getPRBody(owner, repo, prNumber) {
+        if (!this.enabled)
+            return fail("EVIDENCE_GITHUB_DISABLED");
+        if (!isValidRepo(owner, repo) || !isValidPrNumber(prNumber)) {
+            return fail("EVIDENCE_GITHUB_REQUEST_INVALID");
+        }
+        const result = await this.run(["api", `repos/${owner}/${repo}/pulls/${prNumber}`]);
+        if (!result.ok)
+            return result;
+        let payload;
+        try {
+            payload = JSON.parse(result.data.stdout);
+        }
+        catch {
+            return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+        }
+        if (!isRecord(payload) || !(typeof payload.body === "string" || payload.body === null)) {
+            return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+        }
+        return { ok: true, data: payload.body };
+    }
+    async getPRDiff(owner, repo, prNumber) {
+        if (!this.enabled)
+            return fail("EVIDENCE_GITHUB_DISABLED");
+        if (!isValidRepo(owner, repo) || !isValidPrNumber(prNumber)) {
+            return fail("EVIDENCE_GITHUB_REQUEST_INVALID");
+        }
+        const result = await this.run([
+            "api",
+            `repos/${owner}/${repo}/pulls/${prNumber}`,
+            "-H",
+            "Accept: application/vnd.github.diff",
+        ], undefined, EVIDENCE_DIFF_MAX_BYTES);
+        return result.ok ? { ok: true, data: result.data.stdout } : result;
+    }
+    async getReviewThreads(owner, repo, prNumber) {
+        if (!this.enabled)
+            return fail("EVIDENCE_GITHUB_DISABLED");
+        if (!isValidRepo(owner, repo) || !isValidPrNumber(prNumber)) {
+            return fail("EVIDENCE_GITHUB_REQUEST_INVALID");
+        }
+        const threads = [];
+        const threadStates = new Map();
+        const cursors = new Set();
+        let cursor = null;
+        for (let page = 1; page <= MAX_PAGES; page += 1) {
+            const input = JSON.stringify({
+                query: REVIEW_THREADS_QUERY,
+                variables: { owner, repo, pr: prNumber, cursor },
+            });
+            const result = await this.run(["api", "graphql", "--input", "-"], input);
+            if (!result.ok)
+                return result;
+            let payload;
+            try {
+                payload = JSON.parse(result.data.stdout);
+            }
+            catch {
+                return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+            }
+            if (!isRecord(payload))
+                return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+            if (payload.errors !== undefined) {
+                if (!Array.isArray(payload.errors))
+                    return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+                if (payload.errors.length > 0)
+                    return fail("EVIDENCE_GITHUB_COMMAND_FAILED");
+            }
+            const data = payload.data;
+            if (!isRecord(data))
+                return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+            const repository = data.repository;
+            if (!isRecord(repository))
+                return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+            const pullRequest = repository.pullRequest;
+            if (!isRecord(pullRequest))
+                return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+            const reviewThreads = pullRequest.reviewThreads;
+            if (!isRecord(reviewThreads) || !Array.isArray(reviewThreads.nodes)) {
+                return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+            }
+            if (reviewThreads.nodes.length > 100)
+                return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+            const pageInfo = reviewThreads.pageInfo;
+            if (!isRecord(pageInfo) ||
+                typeof pageInfo.hasNextPage !== "boolean" ||
+                !(typeof pageInfo.endCursor === "string" || pageInfo.endCursor === null)) {
+                return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+            }
+            for (const node of reviewThreads.nodes) {
+                if (!isRecord(node) ||
+                    typeof node.id !== "string" ||
+                    node.id.length === 0 ||
+                    typeof node.isResolved !== "boolean") {
+                    return fail("EVIDENCE_GITHUB_PAYLOAD_INVALID");
+                }
+                if (threadStates.has(node.id)) {
+                    return fail(threadStates.get(node.id) === node.isResolved
+                        ? "EVIDENCE_GITHUB_DUPLICATE"
+                        : "EVIDENCE_GITHUB_DUPLICATE_CONFLICT");
+                }
+                threadStates.set(node.id, node.isResolved);
+                threads.push({ id: node.id, isResolved: node.isResolved });
+            }
+            if (!pageInfo.hasNextPage) {
+                threads.sort((a, b) => binaryCompare(a.id, b.id));
+                return { ok: true, data: threads };
+            }
+            if (pageInfo.endCursor === null ||
+                pageInfo.endCursor.length === 0 ||
+                cursors.has(pageInfo.endCursor)) {
+                return fail("EVIDENCE_GITHUB_CURSOR_INVALID");
+            }
+            cursors.add(pageInfo.endCursor);
+            cursor = pageInfo.endCursor;
+        }
+        return fail("EVIDENCE_GITHUB_PAGINATION_LIMIT");
+    }
+}