ai-maestro 1.0.0

package/src/orchestration/rc-check-adapters.mjs

@@ -0,0 +1,817 @@
+import crypto from 'crypto';
+import fs from 'fs/promises';
+import os from 'os';
+import path from 'path';
+
+import { CONFIG } from '../config.mjs';
+import { redactCredentials, redactObject, truncatePreview } from '../format.mjs';
+import { execFileRaw } from '../shell.mjs';
+import { schemaCheck, doctor } from '../session-commands.mjs';
+import { validateBudget, validateEnginesFile } from '../schema.mjs';
+import { loadEngineRegistry } from './capability-registry.mjs';
+import { loadBudget } from './budget-manager.mjs';
+import { getFullHealthSnapshot } from './provider-health.mjs';
+import {
+  FALLBACK_CHAIN_TERMINAL_EVENTS,
+  groupChainsById,
+  readFallbackChainEvents,
+  replayFallbackChain,
+  validateFallbackChainEvent
+} from './fallback-chain-trail.mjs';
+import { inspectFallbackChainLock } from './fallback-chain-lock.mjs';
+import { runReadinessCheck } from './self-hosting-readiness.mjs';
+import { runControlledCanary } from './self-hosting-canary.mjs';
+
+const SENSITIVE_PATH_RE = /(^|[\\/])\.env($|[\\/])|(^|[\\/])package-lock\.json$/i;
+const SOURCE_PATH_RE = /^(src|bin|tests)[\\/]|^package\.json$/i;
+const QUIET_TRUNCATION = { maxBytes: 4096, maxLines: 80 };
+const OLD_TEMP_MS = 24 * 60 * 60 * 1000;
+const TEMP_YOUNG_MS = 60 * 60 * 1000;
+
+function result(input = {}) {
+  return redactObject({
+    checkId: input.checkId,
+    category: input.category,
+    status: input.status || 'PASS',
+    severity: input.severity || 'INFO',
+    required: input.required !== false,
+    executed: input.executed !== false,
+    skipped: input.skipped === true,
+    skipReason: input.skipReason == null ? null : String(input.skipReason),
+    durationMs: input.durationMs || 0,
+    timeoutMs: input.timeoutMs || 0,
+    exitCode: input.exitCode == null ? null : input.exitCode,
+    summary: redactCredentials(input.summary || ''),
+    evidence: Array.isArray(input.evidence) ? input.evidence.map(evidence => ({
+      kind: evidence.kind || 'note',
+      path: evidence.path || null,
+      line: Number.isInteger(evidence.line) ? evidence.line : null,
+      identifier: evidence.identifier || null,
+      redacted: evidence.redacted !== false,
+      details: redactCredentials(evidence.details || '')
+    })) : [],
+    sideEffectClass: input.sideEffectClass || 'PURE_READ_ONLY',
+    remediation: input.remediation == null ? null : redactCredentials(input.remediation)
+  });
+}
+
+function commandOutputEvidence(commandResult) {
+  const stdout = truncatePreview(redactCredentials(commandResult.stdout || ''), QUIET_TRUNCATION);
+  const stderr = truncatePreview(redactCredentials(commandResult.stderr || ''), QUIET_TRUNCATION);
+  return [
+    { kind: 'stdout', details: stdout.text + (stdout.truncated ? '\n[truncated]' : '') },
+    { kind: 'stderr', details: stderr.text + (stderr.truncated ? '\n[truncated]' : '') }
+  ];
+}
+
+function npmCommand(commandArgs) {
+  if (process.platform === 'win32') {
+    return {
+      command: 'cmd.exe',
+      args: ['/d', '/s', '/c', ['npm', ...commandArgs].join(' ')]
+    };
+  }
+  return { command: 'npm', args: commandArgs };
+}
+
+async function runNpmAdapter(checkId, commandArgs, context, category = 'test') {
+  const deps = context.dependencies || {};
+  const runner = deps.execFileRaw || execFileRaw;
+  const invocation = npmCommand(commandArgs);
+  const commandResult = await runner(invocation.command, invocation.args, {
+    cwd: context.projectRoot,
+    quiet: true,
+    timeoutMs: context.timeoutMs
+  });
+  const ok = commandResult.code === 0 && commandResult.timedOut !== true;
+  return result({
+    checkId,
+    category,
+    status: commandResult.timedOut ? 'TIMEOUT' : (ok ? 'PASS' : 'FAIL'),
+    severity: ok ? 'INFO' : 'BLOCKER',
+    exitCode: commandResult.code,
+    timeoutMs: context.timeoutMs,
+    summary: ok ? checkId + ' passed' : checkId + ' failed',
+    evidence: commandOutputEvidence(commandResult),
+    sideEffectClass: checkId === 'npm-test' ? 'TEMPORARY_SANDBOX_WRITE' : 'READ_ONLY_WITH_DIAGNOSTIC_OUTPUT',
+    remediation: ok ? null : 'Run ' + ['npm', ...commandArgs].join(' ') + ' locally and fix failures.'
+  });
+}
+
+async function captureConsole(fn) {
+  const original = {
+    log: console.log,
+    warn: console.warn,
+    error: console.error
+  };
+  const lines = [];
+  console.log = (...args) => { lines.push(args.join(' ')); };
+  console.warn = (...args) => { lines.push(args.join(' ')); };
+  console.error = (...args) => { lines.push(args.join(' ')); };
+  try {
+    const value = await fn();
+    return { value, output: lines.join('\n') };
+  } finally {
+    console.log = original.log;
+    console.warn = original.warn;
+    console.error = original.error;
+  }
+}
+
+function normalizeStatusLine(line) {
+  if (!line) return null;
+  const status = line.slice(0, 2);
+  const rel = line.slice(3).trim().replace(/^"|"$/g, '');
+  if (!rel) return null;
+  return { status, path: rel };
+}
+
+function pathIsKnownDirty(relPath, policy = {}) {
+  return (policy.knownDirtyPaths || []).some(prefix => relPath === prefix || relPath.startsWith(prefix.replace(/[\\/]+$/, '') + path.sep) || relPath.startsWith(prefix.replace(/[\\/]+$/, '') + '/'));
+}
+
+function classifyGitEntries(entries, policy, branch, detached) {
+  const blockers = [];
+  const warnings = [];
+  const human = [];
+  for (const entry of entries) {
+    const rel = entry.path.replace(/\\/g, '/');
+    const staged = entry.status[0] !== ' ' && entry.status[0] !== '?';
+    const untracked = entry.status === '??';
+    if (rel === 'package-lock.json') blockers.push({ rel, reason: 'unexpected package-lock change' });
+    else if (SENSITIVE_PATH_RE.test(rel)) blockers.push({ rel, reason: 'sensitive path changed' });
+    else if (SOURCE_PATH_RE.test(rel) && (staged || untracked || entry.status.trim())) blockers.push({ rel, reason: staged ? 'staged/source dirty' : 'source dirty' });
+    else if (rel.startsWith('.maestro/') || rel.startsWith('.memory/') || pathIsKnownDirty(rel, policy)) warnings.push({ rel, reason: 'known control-plane or memory dirty path' });
+    else warnings.push({ rel, reason: 'non-source dirty path' });
+  }
+  if (!branch || branch === 'HEAD' || detached) human.push({ rel: null, reason: 'detached HEAD or unknown branch' });
+  else if (branch !== 'master') {
+    if (policy.strictGitState) blockers.push({ rel: null, reason: 'unexpected branch in strictGitState: ' + branch });
+    else human.push({ rel: null, reason: 'unexpected branch: ' + branch });
+  }
+  return { blockers, warnings, human };
+}
+
+function statusForFindings({ blockers, warnings, human }, strict) {
+  if (blockers.length) return { status: 'FAIL', severity: 'BLOCKER' };
+  if (human.length) return { status: 'NEEDS_HUMAN', severity: 'HUMAN' };
+  if (warnings.length && strict) return { status: 'FAIL', severity: 'BLOCKER' };
+  if (warnings.length) return { status: 'WARNING', severity: 'INFRA_WARNING' };
+  return { status: 'PASS', severity: 'INFO' };
+}
+
+async function gitStateAdapterRun(context) {
+  const deps = context.dependencies || {};
+  if (deps.gitState) {
+    const fake = deps.gitState;
+    const findings = classifyGitEntries((fake.entries || []).map(entry => typeof entry === 'string' ? normalizeStatusLine(entry) : entry).filter(Boolean), context.policy, fake.branch, fake.detached);
+    const classified = statusForFindings(findings, context.strict || context.policy.strictGitState);
+    return result({
+      checkId: 'git-state',
+      category: 'git',
+      ...classified,
+      summary: classified.status === 'PASS' ? 'Git state is clean' : 'Git state requires attention',
+      evidence: [
+        { kind: 'git', identifier: 'head', details: fake.head || 'unknown' },
+        { kind: 'git', identifier: 'branch', details: fake.branch || 'unknown' },
+        ...[...findings.blockers, ...findings.warnings, ...findings.human].map(item => ({ kind: 'git-status', path: item.rel, details: item.reason }))
+      ],
+      remediation: classified.status === 'PASS' ? null : 'Review Git status without staging unrelated files.'
+    });
+  }
+  const runner = deps.execFileRaw || execFileRaw;
+  const [head, branch, status] = await Promise.all([
+    runner('git', ['rev-parse', 'HEAD'], { cwd: context.projectRoot, quiet: true, timeoutMs: context.timeoutMs }),
+    runner('git', ['branch', '--show-current'], { cwd: context.projectRoot, quiet: true, timeoutMs: context.timeoutMs }),
+    runner('git', ['status', '--porcelain'], { cwd: context.projectRoot, quiet: true, timeoutMs: context.timeoutMs })
+  ]);
+  if (head.code !== 0 || status.code !== 0) {
+    return result({
+      checkId: 'git-state',
+      category: 'git',
+      status: 'FAIL',
+      severity: 'BLOCKER',
+      exitCode: head.code || status.code,
+      summary: 'Git inspection failed',
+      evidence: [...commandOutputEvidence(head), ...commandOutputEvidence(status)],
+      remediation: 'Fix local Git repository access before RC classification.'
+    });
+  }
+  const branchName = (branch.stdout || '').trim() || 'HEAD';
+  const entries = (status.stdout || '').split(/\r?\n/).map(normalizeStatusLine).filter(Boolean);
+  const findings = classifyGitEntries(entries, context.policy, branchName, branchName === 'HEAD');
+  const classified = statusForFindings(findings, context.strict || context.policy.strictGitState);
+  return result({
+    checkId: 'git-state',
+    category: 'git',
+    ...classified,
+    summary: classified.status === 'PASS' ? 'Git state is clean' : 'Git state requires attention',
+    evidence: [
+      { kind: 'git', identifier: 'head', details: (head.stdout || '').trim() },
+      { kind: 'git', identifier: 'branch', details: branchName },
+      ...[...findings.blockers, ...findings.warnings, ...findings.human].map(item => ({ kind: 'git-status', path: item.rel, details: item.reason }))
+    ],
+    remediation: classified.status === 'PASS' ? null : 'Commit or account for dirty paths before release.'
+  });
+}
+
+function healthEntryState(snapshot, targetId) {
+  return snapshot && snapshot.targets ? snapshot.targets[targetId] : null;
+}
+
+async function providerHealthAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const snapshot = deps.providerHealthSnapshot || await (deps.getFullHealthSnapshot || getFullHealthSnapshot)({ projectRoot: context.projectRoot });
+  if (snapshot.diagnostics && snapshot.diagnostics.degradedReason === 'io-error') {
+    return result({
+      checkId: 'provider-health',
+      category: 'health',
+      status: 'FAIL',
+      severity: 'BLOCKER',
+      summary: 'Provider health could not be read',
+      evidence: [{ kind: 'provider-health', details: 'degradedReason=io-error' }],
+      remediation: 'Fix provider health files or filesystem access.'
+    });
+  }
+  if (snapshot.diagnostics && snapshot.diagnostics.degraded && snapshot.diagnostics.degradedReason === 'corrupted-json') {
+    return result({
+      checkId: 'provider-health',
+      category: 'health',
+      status: 'NEEDS_HUMAN',
+      severity: 'HUMAN',
+      summary: 'Provider health snapshot is corrupted',
+      evidence: [{ kind: 'provider-health', details: 'degradedReason=corrupted-json' }],
+      remediation: 'Inspect .maestro/PROVIDER_HEALTH.json manually.'
+    });
+  }
+  const evidence = [];
+  let blocked = false;
+  let human = false;
+  let warning = false;
+  for (const targetId of context.policy.requiredHealthTargets || []) {
+    const entry = healthEntryState(snapshot, targetId);
+    if (!entry) {
+      human = true;
+      evidence.push({ kind: 'required-health-target', identifier: targetId, details: 'missing' });
+    } else if (entry.state === 'OPEN' || entry.state === 'HALF_OPEN') {
+      blocked = true;
+      evidence.push({ kind: 'required-health-target', identifier: targetId, details: entry.state });
+    } else if (entry.state === 'CLOSED') {
+      evidence.push({ kind: 'required-health-target', identifier: targetId, details: 'CLOSED' });
+    } else {
+      human = true;
+      evidence.push({ kind: 'required-health-target', identifier: targetId, details: 'unknown state' });
+    }
+  }
+  for (const targetId of context.policy.optionalHealthTargets || []) {
+    const entry = healthEntryState(snapshot, targetId);
+    if (!entry) {
+      warning = true;
+      evidence.push({ kind: 'optional-health-target', identifier: targetId, details: 'missing history' });
+    } else if (entry.state === 'OPEN' || entry.state === 'HALF_OPEN') {
+      warning = true;
+      evidence.push({ kind: 'optional-health-target', identifier: targetId, details: entry.state });
+    } else if (entry.state !== 'CLOSED') {
+      human = true;
+      evidence.push({ kind: 'optional-health-target', identifier: targetId, details: 'unknown state' });
+    }
+  }
+  const targetCount = Object.keys(snapshot.targets || {}).length;
+  if (!evidence.length) evidence.push({ kind: 'provider-health', details: 'observed targets=' + targetCount + '; no required providers inferred' });
+  const status = blocked ? 'FAIL' : human ? 'NEEDS_HUMAN' : warning ? 'WARNING' : 'PASS';
+  const severity = blocked ? 'BLOCKER' : human ? 'HUMAN' : warning ? 'INFRA_WARNING' : 'INFO';
+  return result({
+    checkId: 'provider-health',
+    category: 'health',
+    status,
+    severity,
+    summary: status === 'PASS' ? 'Provider health query-only check passed' : 'Provider health requires attention',
+    evidence,
+    remediation: status === 'PASS' ? null : 'Inspect provider health and required health target policy.'
+  });
+}
+
+async function schemaCheckAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const captured = await captureConsole(() => (deps.schemaCheck || schemaCheck)());
+  return result({
+    checkId: 'schema-check',
+    category: 'schema',
+    status: captured.value && captured.value.ok ? 'PASS' : 'FAIL',
+    severity: captured.value && captured.value.ok ? 'INFO' : 'BLOCKER',
+    summary: captured.value && captured.value.ok ? 'schema-check passed' : 'schema-check failed',
+    evidence: [
+      { kind: 'schema-check', details: JSON.stringify(redactObject(captured.value && captured.value.checks ? captured.value.checks : [])) },
+      { kind: 'diagnostic-output', details: truncatePreview(redactCredentials(captured.output), QUIET_TRUNCATION).text }
+    ],
+    remediation: captured.value && captured.value.ok ? null : 'Run node bin/maestro.mjs schema-check and fix schema errors.'
+  });
+}
+
+async function readJsonOrStatus(filePath) {
+  try {
+    return { exists: true, value: JSON.parse(await fs.readFile(filePath, 'utf-8')) };
+  } catch (error) {
+    if (error.code === 'ENOENT') return { exists: false, value: null };
+    if (error instanceof SyntaxError) return { exists: true, corrupted: true, error: error.message };
+    throw error;
+  }
+}
+
+async function engineConfigAdapterRun(context) {
+  const deps = context.dependencies || {};
+  if (deps.engineConfig) {
+    const validation = validateEnginesFile(deps.engineConfig);
+    return result({
+      checkId: 'engine-config',
+      category: 'config',
+      status: validation.ok ? 'PASS' : 'FAIL',
+      severity: validation.ok ? 'INFO' : 'BLOCKER',
+      summary: validation.ok ? 'Engine config is valid' : 'Engine config is invalid',
+      evidence: validation.errors.map(error => ({ kind: 'engine-config', details: error })),
+      remediation: validation.ok ? null : 'Fix .maestro/engines.json.'
+    });
+  }
+  const filePath = path.join(context.projectRoot, CONFIG.maestroPath, 'engines.json');
+  const parsed = await readJsonOrStatus(filePath);
+  if (!parsed.exists) {
+    return result({ checkId: 'engine-config', category: 'config', status: 'NEEDS_HUMAN', severity: 'HUMAN', summary: 'Engine config is absent', evidence: [{ kind: 'engine-config', path: filePath, details: 'missing' }], remediation: 'Create or verify .maestro/engines.json before release.' });
+  }
+  if (parsed.corrupted) {
+    return result({ checkId: 'engine-config', category: 'config', status: 'FAIL', severity: 'BLOCKER', summary: 'Engine config JSON is invalid', evidence: [{ kind: 'engine-config', path: filePath, details: parsed.error }], remediation: 'Fix .maestro/engines.json syntax.' });
+  }
+  await (deps.loadEngineRegistry || loadEngineRegistry)();
+  const validation = validateEnginesFile(parsed.value);
+  return result({ checkId: 'engine-config', category: 'config', status: validation.ok ? 'PASS' : 'FAIL', severity: validation.ok ? 'INFO' : 'BLOCKER', summary: validation.ok ? 'Engine config is valid' : 'Engine config is invalid', evidence: validation.errors.map(error => ({ kind: 'engine-config', path: filePath, details: error })), remediation: validation.ok ? null : 'Fix .maestro/engines.json.' });
+}
+
+async function budgetConfigAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const budget = deps.budgetConfig || await (deps.loadBudget || loadBudget)();
+  const validation = validateBudget(budget);
+  return result({
+    checkId: 'budget-config',
+    category: 'config',
+    status: validation.ok ? 'PASS' : 'FAIL',
+    severity: validation.ok ? 'INFO' : 'BLOCKER',
+    summary: validation.ok ? 'Budget config is valid' : 'Budget config is invalid',
+    evidence: validation.errors.map(error => ({ kind: 'budget-config', details: error })),
+    remediation: validation.ok ? null : 'Fix .maestro/budget.json.'
+  });
+}
+
+async function safetyConfigAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const value = deps.safetyConfig;
+  let parsed = value ? { exists: true, value } : await readJsonOrStatus(path.join(context.projectRoot, CONFIG.maestroPath, 'safety.json'));
+  if (!parsed.exists) {
+    return result({ checkId: 'safety-config', category: 'config', status: 'WARNING', severity: 'INFRA_WARNING', summary: 'Safety config absent; runtime defaults apply', evidence: [{ kind: 'safety-config', details: 'missing safety.json; not created by rc-check' }] });
+  }
+  if (parsed.corrupted) {
+    return result({ checkId: 'safety-config', category: 'config', status: 'FAIL', severity: 'BLOCKER', summary: 'Safety config JSON is invalid', evidence: [{ kind: 'safety-config', details: parsed.error }], remediation: 'Fix .maestro/safety.json syntax.' });
+  }
+  const ok = parsed.value && typeof parsed.value === 'object' && !Array.isArray(parsed.value);
+  return result({ checkId: 'safety-config', category: 'config', status: ok ? 'PASS' : 'FAIL', severity: ok ? 'INFO' : 'BLOCKER', summary: ok ? 'Safety config is readable' : 'Safety config is invalid', evidence: [], remediation: ok ? null : 'Fix .maestro/safety.json.' });
+}
+
+function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error && error.code === 'EPERM';
+  }
+}
+
+async function listTaskLockFiles(projectRoot) {
+  const dir = path.join(projectRoot, CONFIG.maestroPath, 'locks', 'tasks');
+  try {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    return entries.filter(entry => entry.isFile() && entry.name.endsWith('.lock.json')).map(entry => path.join(dir, entry.name));
+  } catch (error) {
+    if (error.code === 'ENOENT') return [];
+    throw error;
+  }
+}
+
+async function readLockFile(filePath) {
+  try {
+    const lock = JSON.parse(await fs.readFile(filePath, 'utf-8'));
+    const pidAlive = isPidAlive(lock && lock.pid);
+    return { exists: true, lock, corrupted: false, pidAlive };
+  } catch (error) {
+    if (error.code === 'ENOENT') return { exists: false, lock: null, corrupted: false, pidAlive: false };
+    if (error instanceof SyntaxError) return { exists: true, lock: null, corrupted: true, error: error.message, pidAlive: false };
+    throw error;
+  }
+}
+
+async function lockObservationAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const observations = deps.lockObservations || [];
+  const evidence = [];
+  let blocked = false;
+  let human = false;
+  const addObservation = (label, obs, filePath = null) => {
+    if (!obs || !obs.exists) return;
+    if (obs.corrupted || obs.lockCorrupted) {
+      blocked = true;
+      evidence.push({ kind: 'lock', path: filePath, identifier: label, details: 'corrupted' });
+    } else if (obs.heldByActive || obs.pidAlive) {
+      human = true;
+      evidence.push({ kind: 'lock', path: filePath, identifier: label, details: 'active pid=' + (obs.lock && obs.lock.pid) });
+    } else {
+      human = true;
+      evidence.push({ kind: 'lock', path: filePath, identifier: label, details: 'orphan lock observed; not removed' });
+    }
+  };
+  if (observations.length) {
+    for (const item of observations) addObservation(item.label || 'lock', item, item.path || null);
+  } else {
+    addObservation('fallback-chain-global', await (deps.inspectFallbackChainLock || inspectFallbackChainLock)({ projectRoot: context.projectRoot }), path.join(context.projectRoot, CONFIG.maestroPath, 'locks', 'fallback-chain-global.lock.json'));
+    addObservation('maestro-global', await readLockFile(path.join(context.projectRoot, CONFIG.maestroPath, '.lock.json')), path.join(context.projectRoot, CONFIG.maestroPath, '.lock.json'));
+    for (const filePath of await listTaskLockFiles(context.projectRoot)) addObservation('task-lock', await readLockFile(filePath), filePath);
+  }
+  return result({
+    checkId: 'lock-observation',
+    category: 'lock',
+    status: blocked ? 'FAIL' : human ? 'NEEDS_HUMAN' : 'PASS',
+    severity: blocked ? 'BLOCKER' : human ? 'HUMAN' : 'INFO',
+    summary: evidence.length ? 'Locks require attention' : 'No blocking locks observed',
+    evidence,
+    remediation: evidence.length ? 'Inspect locks manually; rc-check does not remove or recover locks.' : null
+  });
+}
+
+async function fallbackChainAdapterRun(context) {
+  const deps = context.dependencies || {};
+  let events;
+  try {
+    events = deps.fallbackEvents || await (deps.readFallbackChainEvents || readFallbackChainEvents)({ projectRoot: context.projectRoot });
+  } catch (error) {
+    return result({ checkId: 'fallback-chain-state', category: 'fallback', status: 'FAIL', severity: 'BLOCKER', summary: 'Fallback trail is corrupted or unreadable', evidence: [{ kind: 'fallback-trail', details: error.message || String(error) }], remediation: 'Fix .maestro/FALLBACK_CHAIN_EVENTS.jsonl manually.' });
+  }
+  const evidence = [];
+  let blocked = false;
+  let human = false;
+  for (const event of events) {
+    const validation = validateFallbackChainEvent(event);
+    if (!validation.ok) {
+      blocked = true;
+      evidence.push({ kind: 'fallback-event', identifier: event && event.eventId, details: validation.errors.join('; ') });
+    }
+    if (event && event.engineId && event.healthTargetId && event.engineId !== event.healthTargetId) {
+      human = true;
+      evidence.push({ kind: 'fallback-event', identifier: event.eventId, details: 'healthTargetId differs from engineId' });
+    }
+  }
+  const groups = groupChainsById(events);
+  for (const [chainId, chainEvents] of groups.entries()) {
+    const replayed = replayFallbackChain(chainEvents);
+    if (replayed.terminal && replayed.latestEvent && FALLBACK_CHAIN_TERMINAL_EVENTS.has(replayed.latestEvent.eventType)) {
+      evidence.push({ kind: 'fallback-chain', identifier: chainId, details: 'terminal=' + replayed.latestEvent.eventType });
+    } else if (replayed.inProgressAttempt) {
+      human = true;
+      evidence.push({ kind: 'fallback-chain', identifier: chainId, details: 'in-progress attempt without terminal event' });
+    } else if (chainEvents.length) {
+      human = true;
+      evidence.push({ kind: 'fallback-chain', identifier: chainId, details: 'incomplete chain' });
+    }
+  }
+  return result({
+    checkId: 'fallback-chain-state',
+    category: 'fallback',
+    status: blocked ? 'FAIL' : human ? 'NEEDS_HUMAN' : 'PASS',
+    severity: blocked ? 'BLOCKER' : human ? 'HUMAN' : 'INFO',
+    summary: blocked ? 'Fallback trail is corrupted' : human ? 'Fallback chain state needs human review' : 'Fallback trail is consistent or empty',
+    evidence,
+    remediation: blocked || human ? 'Inspect fallback chain trail and locks manually.' : null
+  });
+}
+
+async function walk(root, options = {}) {
+  const maxFiles = options.maxFiles || 2000;
+  const files = [];
+  async function visit(dir) {
+    if (files.length >= maxFiles) return;
+    let entries;
+    try {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      const rel = path.relative(root, full).replace(/\\/g, '/');
+      if (entry.isDirectory()) {
+        if (['.git', 'node_modules', 'DESCARTE'].includes(entry.name)) continue;
+        await visit(full);
+      } else if (entry.isFile()) {
+        files.push({ full, rel });
+      }
+    }
+  }
+  await visit(root);
+  return files;
+}
+
+function credentialFindingForLine(line, rel, lineNumber) {
+  if (/^tests\//i.test(rel)) return null;
+  const text = line.trim();
+  if (!text || /(<[^>]*(KEY|TOKEN|SECRET|PASSWORD)[^>]*>|example|fixture|synthetic|placeholder|dummy|fake|test-only|REDACTED)/i.test(text)) return null;
+  const patterns = [
+    ['authorization-header', /\bAuthorization\s*:\s*(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{12,}/i],
+    ['cookie', /\b(Set-Cookie|Cookie)\s*:\s*[^;\s=]+=[A-Za-z0-9._~+/=-]{12,}/i],
+    ['url-credential', /https?:\/\/[^\/\s:@]+:[^@\s\/]+@/i],
+    ['openai-like-token', /\b(sk|nr)-[A-Za-z0-9_-]{16,}\b/],
+    ['key-value-secret', /\b(NINEROUTER_API_KEY|api[_-]?key|token|secret|password|passwd|credential)\s*[:=]\s*['"]?[A-Za-z0-9._~+/=-]{12,}/i]
+  ];
+  for (const [kind, pattern] of patterns) {
+    if (pattern.test(text)) {
+      const hash = 'sha256:' + cryptoHash(text).slice(0, 12);
+      const ambiguous = /tests?\//i.test(rel) || /\.(md|txt)$/i.test(rel);
+      return { kind, path: rel, line: lineNumber, identifier: hash, ambiguous };
+    }
+  }
+  return null;
+}
+
+function cryptoHash(text) {
+  return crypto.createHash('sha256').update(text).digest('hex');
+}
+
+async function credentialAuditAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const findings = deps.credentialFindings || [];
+  const observedFindings = findings.length ? findings : [];
+  if (!findings.length) {
+    const files = await walk(context.projectRoot, { maxFiles: 2500 });
+    for (const file of files) {
+      if (!/(\.mjs|\.js|\.json|\.jsonl|\.md|\.txt|\.env)$/i.test(file.rel) && !file.rel.endsWith('.env')) continue;
+      let content;
+      try {
+        const stat = await fs.stat(file.full);
+        if (stat.size > 1024 * 1024) continue;
+        content = await fs.readFile(file.full, 'utf-8');
+      } catch {
+        continue;
+      }
+      const lines = content.split(/\r?\n/);
+      for (let index = 0; index < lines.length; index += 1) {
+        const finding = credentialFindingForLine(lines[index], file.rel, index + 1);
+        if (finding) observedFindings.push(finding);
+      }
+    }
+  }
+  const real = observedFindings.filter(item => item.real === true || item.ambiguous !== true);
+  const ambiguous = observedFindings.filter(item => item.real !== true && item.ambiguous === true);
+  const status = real.length ? 'FAIL' : ambiguous.length ? 'NEEDS_HUMAN' : 'PASS';
+  const severity = real.length ? 'BLOCKER' : ambiguous.length ? 'HUMAN' : 'INFO';
+  return result({
+    checkId: 'credential-audit',
+    category: 'credential',
+    status,
+    severity,
+    summary: status === 'PASS' ? 'No real credentials detected' : 'Credential audit found redacted risks',
+    evidence: observedFindings.map(item => ({
+      kind: item.kind || 'credential-risk',
+      path: item.path || null,
+      line: item.line || null,
+      identifier: item.identifier || null,
+      redacted: true,
+      details: item.ambiguous ? 'ambiguous credential-like value' : 'credential-like value redacted'
+    })),
+    remediation: status === 'PASS' ? null : 'Remove real credentials or mark synthetic fixtures unambiguously.'
+  });
+}
+
+function tempKind(rel) {
+  const base = path.basename(rel);
+  if (/\.recovery$/i.test(base) || base === '.recovery') return 'recovery';
+  if (/canary/i.test(base) && /(^|[-_.])(clone|tmp|temp|sandbox)([-_.]|$)/i.test(base)) return 'canary-clone';
+  if (/report/i.test(base) && /\.(tmp|partial|incomplete)$/i.test(base)) return 'incomplete-report';
+  if (/^\.tmp-|^tmp-|^temp-|^sandbox-|\.lock\.tmp$/i.test(base)) return 'temp';
+  return null;
+}
+
+async function tempFilesAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const now = deps.nowMs || Date.now();
+  const items = deps.tempFiles || [];
+  const observed = items.length ? items : [];
+  if (!items.length) {
+    const files = await walk(context.projectRoot, { maxFiles: 2500 });
+    for (const file of files) {
+      const kind = tempKind(file.rel);
+      if (!kind) continue;
+      const stat = await fs.stat(file.full).catch(() => null);
+      observed.push({ path: file.rel, kind, ageMs: stat ? now - stat.mtimeMs : 0 });
+    }
+  }
+  const evidence = [];
+  let warning = false;
+  let human = false;
+  let blocked = false;
+  for (const item of observed) {
+    const ageMs = Number.isFinite(item.ageMs) ? item.ageMs : 0;
+    const kind = item.kind || tempKind(item.path || '') || 'unknown';
+    if (item.associatedCorruptedLock) blocked = true;
+    else if (kind === 'recovery' && ageMs > TEMP_YOUNG_MS) human = true;
+    else if (kind === 'unknown') human = true;
+    else if (ageMs > OLD_TEMP_MS || kind === 'canary-clone' || kind === 'incomplete-report') warning = true;
+    evidence.push({ kind: 'temp-file', path: item.path || null, identifier: kind, details: 'ageMs=' + Math.round(ageMs) + (item.associatedCorruptedLock ? '; associated corrupted lock' : '') });
+  }
+  return result({
+    checkId: 'temp-files',
+    category: 'temp',
+    status: blocked ? 'FAIL' : human ? 'NEEDS_HUMAN' : warning ? 'WARNING' : 'PASS',
+    severity: blocked ? 'BLOCKER' : human ? 'HUMAN' : warning ? 'INFRA_WARNING' : 'INFO',
+    summary: evidence.length ? 'Temporary files observed; nothing removed' : 'No relevant temporary files observed',
+    evidence,
+    remediation: evidence.length ? 'Inspect temporary files manually; rc-check does not clean them.' : null
+  });
+}
+
+async function listProcessesNative(context) {
+  if (process.platform !== 'win32') {
+    return { supported: false, processes: [], reason: 'process observation not implemented for this platform' };
+  }
+  const deps = context.dependencies || {};
+  const runner = deps.execFileRaw || execFileRaw;
+  const script = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CommandLine,ExecutablePath | ConvertTo-Json -Compress";
+  const output = await runner('powershell', ['-NoProfile', '-Command', script], { quiet: true, timeoutMs: context.timeoutMs });
+  if (output.code !== 0) return { supported: false, processes: [], reason: 'native process query failed' };
+  const parsed = output.stdout.trim() ? JSON.parse(output.stdout) : [];
+  const rows = Array.isArray(parsed) ? parsed : [parsed];
+  return {
+    supported: true,
+    processes: rows.map(row => ({
+      pid: row.ProcessId,
+      ppid: row.ParentProcessId,
+      commandLine: row.CommandLine || '',
+      cwd: null
+    }))
+  };
+}
+
+async function processObservationAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const observed = deps.processes ? { supported: true, processes: deps.processes } : await listProcessesNative(context);
+  if (!observed.supported) {
+    return result({
+      checkId: 'process-observation',
+      category: 'process',
+      status: 'WARNING',
+      severity: 'INFRA_WARNING',
+      required: false,
+      summary: 'Process observation has limited platform support',
+      evidence: [{ kind: 'process', details: observed.reason || 'unsupported' }],
+      remediation: 'Perform manual process inspection if release state depends on locks.'
+    });
+  }
+  const evidence = [];
+  let blocked = false;
+  let human = false;
+  const normalizedRoot = path.resolve(context.projectRoot).toLowerCase();
+  for (const proc of observed.processes || []) {
+    if (proc.pid === process.pid) continue;
+    const commandLine = String(proc.commandLine || '');
+    const cwd = proc.cwd ? path.resolve(proc.cwd).toLowerCase() : '';
+    const relatedToRoot = cwd === normalizedRoot || commandLine.toLowerCase().includes(normalizedRoot);
+    const maestro = /\bmaestro(\.mjs)?\b|bin[\\/]maestro\.mjs/i.test(commandLine);
+    const codexClaude = /\b(codex|claude)\b/i.test(commandLine);
+    if (maestro && relatedToRoot && proc.orphan === true) {
+      blocked = true;
+      evidence.push({ kind: 'process', identifier: String(proc.pid), details: 'orphan Maestro process ppid=' + (proc.ppid || 'unknown') + ' cwd=' + (proc.cwd || 'unknown') });
+    } else if (maestro && relatedToRoot) {
+      human = true;
+      evidence.push({ kind: 'process', identifier: String(proc.pid), details: 'active Maestro process ppid=' + (proc.ppid || 'unknown') + ' cwd=' + (proc.cwd || 'unknown') });
+    } else if (proc.lockRelated === true) {
+      human = true;
+      evidence.push({ kind: 'process', identifier: String(proc.pid), details: 'unknown process related to lock' });
+    } else if (codexClaude) {
+      evidence.push({ kind: 'process', identifier: String(proc.pid), details: 'external Codex/Claude process not linked to projectRoot' });
+    }
+  }
+  return result({
+    checkId: 'process-observation',
+    category: 'process',
+    status: blocked ? 'FAIL' : human ? 'NEEDS_HUMAN' : 'PASS',
+    severity: blocked ? 'BLOCKER' : human ? 'HUMAN' : 'INFO',
+    summary: blocked ? 'Orphan Maestro process observed' : human ? 'Project-related process needs human review' : 'No project-blocking processes observed',
+    evidence,
+    remediation: blocked || human ? 'Inspect processes manually; rc-check never terminates processes.' : null
+  });
+}
+
+async function readinessAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const captured = await captureConsole(() => (deps.runReadinessCheck || runReadinessCheck)({ quiet: true }));
+  const ok = captured.value && captured.value.ok === true;
+  const infraWarning = captured.value && captured.value.infrastructure === true;
+  return result({
+    checkId: 'readiness',
+    category: 'release',
+    status: ok ? 'PASS' : infraWarning ? 'WARNING' : 'FAIL',
+    severity: ok ? 'INFO' : infraWarning ? 'INFRA_WARNING' : 'BLOCKER',
+    summary: ok ? 'Readiness passed' : 'Readiness did not pass',
+    evidence: [
+      { kind: 'readiness', path: captured.value && captured.value.reportPath, details: JSON.stringify(redactObject({ ok: captured.value && captured.value.ok, tempRemoved: captured.value && captured.value.tempRemoved })) },
+      { kind: 'diagnostic-output', details: truncatePreview(redactCredentials(captured.output), QUIET_TRUNCATION).text }
+    ],
+    sideEffectClass: 'PROJECT_CONTROL_PLANE_WRITE',
+    remediation: ok ? null : 'Review readiness output and .maestro/READINESS_CHECK.md.'
+  });
+}
+
+async function doctorAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const captured = await captureConsole(() => (deps.doctor || doctor)());
+  const hasError = /\bERRO\b|\bERROR\b|FAIL/i.test(captured.output);
+  return result({
+    checkId: 'doctor',
+    category: 'release',
+    status: hasError ? 'NEEDS_HUMAN' : 'PASS',
+    severity: hasError ? 'HUMAN' : 'INFO',
+    summary: hasError ? 'Doctor output needs human review' : 'Doctor completed without obvious errors',
+    evidence: [{ kind: 'diagnostic-output', details: truncatePreview(redactCredentials(captured.output), QUIET_TRUNCATION).text }],
+    sideEffectClass: 'PROJECT_CONTROL_PLANE_WRITE',
+    remediation: hasError ? 'Run doctor manually and inspect local environment diagnostics.' : null
+  });
+}
+
+async function canaryAdapterRun(context) {
+  const deps = context.dependencies || {};
+  const targetPath = deps.canaryTargetPath || path.join(os.tmpdir(), 'maestro-rc-canary-' + process.pid + '-' + Date.now());
+  const canary = await (deps.runControlledCanary || runControlledCanary)({ targetPath, timeoutMs: context.timeoutMs });
+  const required = context.policy.canaryRequired === true;
+  let status = 'NEEDS_HUMAN';
+  let severity = 'HUMAN';
+  if (canary.outcome === 'PASSED' && canary.ok === true) {
+    status = 'PASS';
+    severity = 'INFO';
+  } else if (canary.outcome === 'INFRASTRUCTURE_UNAVAILABLE') {
+    status = required && context.policy.allowInfraWarning === false ? 'FAIL' : 'WARNING';
+    severity = status === 'FAIL' ? 'BLOCKER' : 'INFRA_WARNING';
+  } else if (canary.reason && /preflight/i.test(canary.reason)) {
+    status = 'FAIL';
+    severity = 'BLOCKER';
+  } else if (canary.outcome === 'FAILED') {
+    status = 'FAIL';
+    severity = 'BLOCKER';
+  }
+  const correlatedHead = !canary.head || !context.head || canary.head === context.head;
+  if (!correlatedHead) {
+    status = 'NEEDS_HUMAN';
+    severity = 'HUMAN';
+  }
+  if (canary.cleanupFailure === true) {
+    status = 'NEEDS_HUMAN';
+    severity = 'HUMAN';
+  }
+  return result({
+    checkId: 'canary',
+    category: 'canary',
+    status,
+    severity,
+    required,
+    summary: status === 'PASS' ? 'Canary passed' : 'Canary did not provide clean release evidence',
+    evidence: [
+      { kind: 'canary', path: canary.registeredTargetPath || targetPath, identifier: correlatedHead ? 'head-correlated' : 'head-mismatch', details: 'outcome=' + (canary.outcome || 'unknown') }
+    ],
+    sideEffectClass: 'REAL_ENGINE_EXECUTION',
+    remediation: status === 'PASS' ? null : 'Review canary result; canary remains opt-in or policy-required only.'
+  });
+}
+
+function adapter(definition) {
+  return {
+    mayUseNetwork: false,
+    mayUseRealEngine: false,
+    canRunByDefault: true,
+    ...definition
+  };
+}
+
+export function createRcCheckAdapters() {
+  return [
+    adapter({ checkId: 'git-state', category: 'git', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 10000, run: gitStateAdapterRun }),
+    adapter({ checkId: 'npm-run-check', category: 'code', defaultRequired: true, sideEffectClass: 'READ_ONLY_WITH_DIAGNOSTIC_OUTPUT', defaultTimeoutMs: 120000, run: context => runNpmAdapter('npm-run-check', ['run', 'check'], context, 'code') }),
+    adapter({ checkId: 'npm-test', category: 'test', defaultRequired: true, sideEffectClass: 'TEMPORARY_SANDBOX_WRITE', defaultTimeoutMs: 600000, run: context => runNpmAdapter('npm-test', ['test'], context, 'test') }),
+    adapter({ checkId: 'schema-check', category: 'schema', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 30000, run: schemaCheckAdapterRun }),
+    adapter({ checkId: 'provider-health', category: 'health', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 10000, run: providerHealthAdapterRun }),
+    adapter({ checkId: 'engine-config', category: 'config', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 10000, run: engineConfigAdapterRun }),
+    adapter({ checkId: 'budget-config', category: 'config', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 10000, run: budgetConfigAdapterRun }),
+    adapter({ checkId: 'safety-config', category: 'config', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 10000, run: safetyConfigAdapterRun }),
+    adapter({ checkId: 'credential-audit', category: 'credential', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 60000, run: credentialAuditAdapterRun }),
+    adapter({ checkId: 'lock-observation', category: 'lock', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 30000, run: lockObservationAdapterRun }),
+    adapter({ checkId: 'fallback-chain-state', category: 'fallback', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 30000, run: fallbackChainAdapterRun }),
+    adapter({ checkId: 'temp-files', category: 'temp', defaultRequired: true, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 30000, run: tempFilesAdapterRun }),
+    adapter({ checkId: 'process-observation', category: 'process', defaultRequired: false, sideEffectClass: 'PURE_READ_ONLY', defaultTimeoutMs: 30000, run: processObservationAdapterRun }),
+    adapter({ checkId: 'readiness', category: 'release', defaultRequired: false, sideEffectClass: 'PROJECT_CONTROL_PLANE_WRITE', defaultTimeoutMs: 300000, canRunByDefault: false, run: readinessAdapterRun }),
+    adapter({ checkId: 'doctor', category: 'release', defaultRequired: false, sideEffectClass: 'PROJECT_CONTROL_PLANE_WRITE', defaultTimeoutMs: 120000, canRunByDefault: false, run: doctorAdapterRun }),
+    adapter({ checkId: 'canary', category: 'canary', defaultRequired: false, sideEffectClass: 'REAL_ENGINE_EXECUTION', mayUseRealEngine: true, defaultTimeoutMs: 180000, canRunByDefault: false, run: canaryAdapterRun }),
+    adapter({ checkId: 'release-check', category: 'release', defaultRequired: false, sideEffectClass: 'NOT_ALLOWED_IN_RC_CHECK', defaultTimeoutMs: 0, canRunByDefault: false, run: async () => result({ checkId: 'release-check', category: 'release', status: 'SKIPPED', severity: 'INFO', executed: false, skipped: true, skipReason: 'NOT_ALLOWED_IN_RC_CHECK', sideEffectClass: 'NOT_ALLOWED_IN_RC_CHECK', summary: 'release-check is not allowed inside rc-check' }) })
+  ];
+}