approval-md 0.0.1 → 0.2.0

package/dist/src/cli/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../src/cli/attest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEvF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,KAAK,GAA6B;IACtC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,SAAS,EAAE,QAAQ;IACnB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,sEAAsE;AACtE,SAAS,iBAAiB,CACxB,KAAa,EACb,IAAY;IAEZ,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gCAAgC,IAAI,qJAAqJ;SACnO,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAClE,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC/D,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC5E,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAID;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,oCAAoC,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,qBAAqB,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,UAAyB,EAAE,GAAW,EAAE,GAAW;IAC5E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1F,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,2BAA2B,GAAG,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;KACxH,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAAC,SAAiB,EAAE,GAAa;IACnD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IAC9B,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAErE,8EAA8E;IAC9E,0EAA0E;IAC1E,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE5C,+EAA+E;IAC/E,mEAAmE;IACnE,MAAM,MAAM,GAAG,sBAAsB,CACnC,GAAG,CAAC,OAAO,EACX,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,EACtC,GAAG,CAAC,KAAK,CACV,CAAC;IAEF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,MAAM,GAAI,MAAM,CAAC,MAAM,CAAC,OAAmC,CAAC,QAAQ,CAAW,CAAC;QACtF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,EAAE,EAAE,IAAI;gBACR,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;gBACtB,MAAM;gBACN,IAAI,EAAE,MAAM;gBACZ,UAAU,EAAE,QAAQ,CAAC,IAAI;aAC1B,CAAC,IAAI,CACP,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,uBAAuB,QAAQ,CAAC,IAAI,WAAW,MAAM,CAAC,MAAM,CAAC,GAAG,YAAY,MAAM,IAAI,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CACxG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,yEAAyE;QACzE,sEAAsE;QACtE,4EAA4E;QAC5E,uEAAuE;QACvE,0CAA0C;QAC1C,KAAK,gBAAgB,CAAC;QACtB,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB,CAAC;QACvB,KAAK,YAAY;YACf,OAAO,UAAU,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC;QACxB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAEjE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,0DAA0D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,8EAA8E,CAC/J,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,0BAA0B,eAAe,qCAAqC,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAEtF,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC,SAAS,EAAE;YAC5B,OAAO;YACP,IAAI;YACJ,KAAK;YACL,GAAG;YACH,OAAO;YACP,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAE9D,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,MAAM,GAAI,MAAM,CAAC,MAAM,CAAC,OAAmC,CAAC,QAAQ,CAAW,CAAC;QACtF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CACvF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,MAAM,CAAC,GAAG,YAAY,MAAM,IAAI,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CACxG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,iBAAiB;YACpB,0EAA0E;YAC1E,yEAAyE;YACzE,6CAA6C;YAC7C,OAAO,UAAU,CAAC;QACpB,KAAK,YAAY;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,OAAO,UAAU,CAAC;QACpB,KAAK,cAAc;YACjB,uEAAuE;YACvE,2DAA2D;YAC3D,OAAO,cAAc,CAAC;QACxB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/src/cli/audit-card.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The retrospective review card, built from the log (SPEC.md §5.2, §9.1, §10.3;
+ * APRV-299).
+ *
+ * The daemon draws `audit.sampled` records and, until this task, the only place
+ * to answer one was `approval audit list` / `approval audit review` in a
+ * terminal. The supervised bargain is "execute now, a fraction is reviewed
+ * after", and a review nobody is shown is a review that does not happen: on
+ * 2026-09-07 sixty of them were sitting in `QUEUE.md` while the approver's
+ * phone showed nothing.
+ *
+ * This module turns each open sample into a {@link ReviewCard} the Telegram
+ * channel renders. Three properties are the whole of its contract:
+ *
+ * - **Everything is derived, nothing is self-reported.** The class comes from
+ *   the `task.registered` declaration the log already holds, the command
+ *   breakdown is recomputed by the classifier's own tokenizer over the bytes
+ *   the payload store holds under the hash the `execution.started` recorded,
+ *   the rate is the one the `audit.sampled` record states, and the claimed
+ *   summary carries the actor that registered the action. No payload key an
+ *   authoring party wrote chooses a row (SPEC.md §11.1 invariant 4).
+ * - **It reads only verified records** (invariant 1). A log that does not
+ *   verify produces a refusal and no cards: a card is a statement to a human
+ *   about what the log says, and one derived from a log the runtime disowns
+ *   would be worse than no card at all.
+ * - **It decides nothing and appends nothing.** No policy is resolved, no
+ *   reaction is read, and no enforcement path consults anything here
+ *   (invariant 10). The card is a rendering; the human's answer goes back
+ *   through the human-only `reviewSample`.
+ */
+import type { ReviewCard } from "../channels/telegram.js";
+/** Why a build of the review backlog produced nothing. */
+export type ReviewCardRefusalCode = "log-unreadable" | "log-torn-tail" | "log-corrupt";
+export type ReviewCardsResult = {
+    ok: true;
+    cards: ReviewCard[];
+} | {
+    ok: false;
+    code: ReviewCardRefusalCode;
+    message: string;
+};
+/** Where the payload bytes may be found, for the command breakdown. */
+export interface ReviewCardOptions {
+    /**
+     * A caller's override for the payload store, with `TagOptions.payload`'s
+     * semantics: action key and bound hash in, the value or `undefined` out.
+     * Consulted before the store, exactly as the pending queue consults it, so a
+     * test and an operator holding bytes elsewhere reach the same rendering.
+     */
+    payload?: (actionKey: string, payloadHash: string) => unknown;
+    /** The payload store, or `null` for none. Defaults to the one beside the log. */
+    payloadStoreDir?: string | null;
+}
+/**
+ * Every `audit.sampled` with no later `audit.reviewed`, as review cards, oldest
+ * first.
+ *
+ * The same projection `approval audit list` and `.approval/QUEUE.md` read
+ * (`openSamples`), so the phone, the file and the terminal cannot disagree
+ * about what is outstanding. Reads a verified log and writes nothing anywhere.
+ */
+export declare function openReviewCards(logPath: string, options?: ReviewCardOptions): ReviewCardsResult;

package/dist/src/cli/audit-card.js

@@ -0,0 +1,201 @@
+/**
+ * The retrospective review card, built from the log (SPEC.md §5.2, §9.1, §10.3;
+ * APRV-299).
+ *
+ * The daemon draws `audit.sampled` records and, until this task, the only place
+ * to answer one was `approval audit list` / `approval audit review` in a
+ * terminal. The supervised bargain is "execute now, a fraction is reviewed
+ * after", and a review nobody is shown is a review that does not happen: on
+ * 2026-09-07 sixty of them were sitting in `QUEUE.md` while the approver's
+ * phone showed nothing.
+ *
+ * This module turns each open sample into a {@link ReviewCard} the Telegram
+ * channel renders. Three properties are the whole of its contract:
+ *
+ * - **Everything is derived, nothing is self-reported.** The class comes from
+ *   the `task.registered` declaration the log already holds, the command
+ *   breakdown is recomputed by the classifier's own tokenizer over the bytes
+ *   the payload store holds under the hash the `execution.started` recorded,
+ *   the rate is the one the `audit.sampled` record states, and the claimed
+ *   summary carries the actor that registered the action. No payload key an
+ *   authoring party wrote chooses a row (SPEC.md §11.1 invariant 4).
+ * - **It reads only verified records** (invariant 1). A log that does not
+ *   verify produces a refusal and no cards: a card is a statement to a human
+ *   about what the log says, and one derived from a log the runtime disowns
+ *   would be worse than no card at all.
+ * - **It decides nothing and appends nothing.** No policy is resolved, no
+ *   reaction is read, and no enforcement path consults anything here
+ *   (invariant 10). The card is a rendering; the human's answer goes back
+ *   through the human-only `reviewSample`.
+ */
+import { claimed, computed } from "../channels/contract.js";
+import { openSamples } from "../core/audit.js";
+import { indexDeclarations } from "../core/execute.js";
+import { loadPayload, payloadStoreDirFor } from "../core/payload-store.js";
+import { payloadOf, readVerifiedRecords } from "../core/state.js";
+import { commandBreakdown, commandPayloadView } from "../core/wysiwys.js";
+function stringOrNull(value) {
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+/**
+ * The actor that declared an action, per key: the `task.registered` record's
+ * own, and failing that the `execution.started` that ran it.
+ *
+ * The author of a card's CLAIMED region, and it is read off who APPENDED a
+ * record rather than out of a payload field, for the reason `humanFeedback`
+ * gives about the same question: an actor is a property of the writer, and a
+ * self-reported one would let the party under oversight choose whose claim the
+ * approver is reading (SPEC.md §11.1 invariant 4).
+ */
+function authorsByKey(records) {
+    const registered = new Map();
+    const executed = new Map();
+    for (const record of records) {
+        const actor = typeof record.actor === "string" && record.actor.length > 0 ? record.actor : null;
+        if (actor === null)
+            continue;
+        if (record.event === "task.registered") {
+            const actions = payloadOf(record)["actions"];
+            if (!Array.isArray(actions))
+                continue;
+            for (const entry of actions) {
+                if (typeof entry !== "object" || entry === null)
+                    continue;
+                const key = entry["idempotency_key"];
+                if (typeof key === "string" && key.length > 0)
+                    registered.set(key, actor);
+            }
+            continue;
+        }
+        if (record.event !== "execution.started")
+            continue;
+        const key = record.action_key;
+        if (typeof key === "string" && key.length > 0 && !executed.has(key))
+            executed.set(key, actor);
+    }
+    for (const [key, actor] of executed) {
+        if (!registered.has(key))
+            registered.set(key, actor);
+    }
+    return registered;
+}
+/**
+ * The bytes the sampled execution bound to, when anybody holds them.
+ *
+ * `null` whenever they cannot be produced honestly: no recorded hash, no
+ * override and no store, a store with no file, or a stored file that does not
+ * hash to what the log recorded. The last case is the one worth naming — a
+ * tampered `<hash>.json` yields NO breakdown rather than a breakdown of bytes
+ * that are not the ones that ran, because a line describing the wrong command
+ * is worse on a review card than an absent line.
+ */
+function materialFor(options, logPath, actionKey, boundHash) {
+    if (boundHash === null)
+        return null;
+    const supplied = options.payload?.(actionKey, boundHash);
+    if (supplied !== undefined)
+        return supplied;
+    const storeDir = options.payloadStoreDir === undefined ? payloadStoreDirFor(logPath) : options.payloadStoreDir;
+    if (storeDir === null)
+        return null;
+    const loaded = loadPayload(storeDir, boundHash);
+    return loaded.ok ? loaded.value : null;
+}
+/**
+ * What the runtime did at the time, in one computed line.
+ *
+ * The three facts a reviewer needs before they can say whether it should have
+ * happened: that NOBODY was asked, which autonomy said so, and the rate the
+ * draw was made at — all three read off the `audit.sampled` record the daemon
+ * wrote, which states the number the verdict was compared against (APRV-183).
+ * The outcome is appended when the log carries one; "not recorded" is the
+ * honest answer for an execution whose end nothing wrote, and it is never
+ * guessed at from the absence.
+ */
+function verdictLine(sample, outcome) {
+    const autonomy = stringOrNull(sample["autonomy"]) ?? "supervised";
+    const rate = sample["rate"];
+    const drawn = typeof rate === "number" ? `, drawn for review at rate ${String(rate)}` : ", drawn for review";
+    return `allowed without asking (autonomy ${autonomy})${drawn} · outcome ${outcome}`;
+}
+/** How the log says the sampled execution ended, or that it does not say. */
+function outcomeOf(records, actionKey, startSeq) {
+    for (let index = records.length - 1; index >= 0; index -= 1) {
+        const record = records[index];
+        if (record.seq <= startSeq || record.action_key !== actionKey)
+            continue;
+        if (record.event === "execution.completed")
+            return "completed";
+        if (record.event === "execution.failed")
+            return "failed";
+    }
+    return "not recorded";
+}
+/**
+ * One card for one open sample, or `null` when the log cannot describe it.
+ *
+ * A sample naming no action key, or an action key no `task.registered` record
+ * declares, produces no card. That is the same refusal to guess `core/audit.ts`
+ * makes when it selects candidates: a class nobody declared is a class the card
+ * would have to invent, and a review card asserting an invented class is a
+ * statement to a human that nothing in the log supports. Such a sample stays in
+ * the backlog and is still answerable with `approval audit review`.
+ */
+function cardFor(records, subject, authors, declarations, logPath, options) {
+    const actionKey = subject.actionKey;
+    if (actionKey === null)
+        return null;
+    const declared = declarations.get(actionKey);
+    if (declared === undefined)
+        return null;
+    const sampleRecord = records.find((record) => record.seq === subject.seq);
+    const sample = sampleRecord === undefined ? {} : payloadOf(sampleRecord);
+    const start = subject.subjectSeq === null
+        ? undefined
+        : records.find((record) => record.seq === subject.subjectSeq && record.event === "execution.started");
+    const startPayload = start === undefined ? {} : payloadOf(start);
+    const ranAt = start?.ts ?? stringOrNull(sample["subject_ts"]) ?? subject.ts;
+    const material = materialFor(options, logPath, actionKey, stringOrNull(startPayload["payload_hash"]) ?? declared.payload_hash);
+    const command = material === null ? null : commandPayloadView(material);
+    const breakdown = command === null ? null : commandBreakdown(command.command);
+    const author = authors.get(actionKey) ?? "the requesting party";
+    const fields = {
+        action_key: computed(actionKey, "log"),
+        class: computed(declared.class, "log"),
+        task: computed(subject.task ?? declared.task, "log"),
+        summary: claimed(declared.summary, author),
+        ...(breakdown === null ? {} : { command_breakdown: computed(breakdown, "classifier") }),
+    };
+    return {
+        sampleSeq: subject.seq,
+        fields,
+        ranAtTs: ranAt,
+        ranAt: computed(start === undefined
+            ? `${ranAt} (the sample's record of when it started)`
+            : `${ranAt} (execution.started at seq ${String(start.seq)})`, "log"),
+        verdict: computed(verdictLine(sample, start === undefined ? "not recorded" : outcomeOf(records, actionKey, start.seq)), "log"),
+    };
+}
+/**
+ * Every `audit.sampled` with no later `audit.reviewed`, as review cards, oldest
+ * first.
+ *
+ * The same projection `approval audit list` and `.approval/QUEUE.md` read
+ * (`openSamples`), so the phone, the file and the terminal cannot disagree
+ * about what is outstanding. Reads a verified log and writes nothing anywhere.
+ */
+export function openReviewCards(logPath, options = {}) {
+    const read = readVerifiedRecords(logPath);
+    if (!read.ok)
+        return { ok: false, code: read.code, message: read.message };
+    const index = indexDeclarations(read.records);
+    const authors = authorsByKey(read.records);
+    const cards = [];
+    for (const subject of openSamples(read.records)) {
+        const card = cardFor(read.records, subject, authors, index.declarations, logPath, options);
+        if (card !== null)
+            cards.push(card);
+    }
+    return { ok: true, cards };
+}
+//# sourceMappingURL=audit-card.js.map

package/dist/src/cli/audit-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-card.js","sourceRoot":"","sources":["../../../src/cli/audit-card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAuB,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAsB1E,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,OAA+B;IACnD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;oBAAE,SAAS;gBAC1D,MAAM,GAAG,GAAI,KAAiC,CAAC,iBAAiB,CAAC,CAAC;gBAClE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;oBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5E,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB;YAAE,SAAS;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAClB,OAA0B,EAC1B,OAAe,EACf,SAAiB,EACjB,SAAwB;IAExB,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,QAAQ,GACZ,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChG,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,MAA+B,EAAE,OAAe;IACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,YAAY,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GACT,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,8BAA8B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACjG,OAAO,oCAAoC,QAAQ,IAAI,KAAK,cAAc,OAAO,EAAE,CAAC;AACtF,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAAC,OAA+B,EAAE,SAAiB,EAAE,QAAgB;IACrF,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAgB,CAAC;QAC7C,IAAI,MAAM,CAAC,GAAG,IAAI,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,SAAS;QACxE,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAAE,OAAO,WAAW,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB;YAAE,OAAO,QAAQ,CAAC;IAC3D,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,OAAO,CACd,OAA+B,EAC/B,OAAuB,EACvB,OAA4B,EAC5B,YAAkE,EAClE,OAAe,EACf,OAA0B;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACzE,MAAM,KAAK,GACT,OAAO,CAAC,UAAU,KAAK,IAAI;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,CACtF,CAAC;IACR,MAAM,YAAY,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,EAAE,EAAE,IAAI,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC;IAE5E,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EACP,OAAO,EACP,SAAS,EACT,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,IAAI,QAAQ,CAAC,YAAY,CACpE,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC;IAChE,MAAM,MAAM,GAAqB;QAC/B,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;QACtC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtC,IAAI,EAAE,QAAQ,CAAgB,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACnE,OAAO,EAAE,OAAO,CAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzD,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;KACxF,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,GAAG;QACtB,MAAM;QACN,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,QAAQ,CACb,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,GAAG,KAAK,2CAA2C;YACrD,CAAC,CAAC,GAAG,KAAK,8BAA8B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAC9D,KAAK,CACN;QACD,OAAO,EAAE,QAAQ,CACf,WAAW,CACT,MAAM,EACN,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAChF,EACD,KAAK,CACN;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,OAAO,GAAsB,EAAE;IAE/B,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAE3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAClB,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,KAAK,CAAC,YAAY,EAClB,OAAO,EACP,OAAO,CACR,CAAC;QACF,IAAI,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/src/cli/audit.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `approval audit` — the retrospective-review verbs (SPEC.md §5.2, §9.1).
+ *
+ * Two subcommands, and neither of them samples:
+ *
+ * - `audit list` reads the open sampled-audit backlog and writes nothing;
+ * - `audit review <seq|action-key>` appends `audit.reviewed` and is HUMAN-ONLY.
+ *
+ * There is deliberately no `approval audit sample`. Sampling is the runtime's
+ * decision, made by the daemon from an operator-held secret, and a verb that let
+ * a caller sample (or decline to sample) an action of its choosing would hand
+ * the party under oversight the control that exists to oversee it. The daemon
+ * samples on its tick; that is the only path.
+ *
+ * The CLI holds no logic, as everywhere else here: eligibility, matching, and
+ * the human-only rule live in `core/audit.ts`, and this file is argument
+ * parsing, output formatting, and the mapping from a core result to an exit code.
+ */
+import type { Streams } from "./main.js";
+/**
+ * The open sampled-audit backlog: `audit.sampled` events with no later
+ * `audit.reviewed`, oldest first.
+ *
+ * The same set `.approval/QUEUE.md` renders and the same set the daemon counts,
+ * from the same projection, so the file, the daemon's `audit_backlog`, and this
+ * verb cannot disagree. Reads a verified log and writes nothing anywhere.
+ */
+export declare function commandAuditList(argv: string[], streams: Streams, cwd: string): number;
+/**
+ * `approval audit review <seq|action-key> [--note "<text>"]`
+ *
+ * HUMAN-ONLY, enforced in `core/audit.ts` and checked here first so a malformed
+ * invocation never reaches the log. `--note` is optional: the event's content is
+ * that a person looked, and a note is the reviewer's own record of what they
+ * concluded.
+ *
+ * No attestation is required, for the reason `execution resolve` states: review
+ * records an observation, exercises no policy authority, authorizes nothing, and
+ * spends no budget. A review blocked because a policy file was edited afterwards
+ * would be a supervision backlog held open by an unrelated fact.
+ */
+export declare function commandAuditReview(argv: string[], streams: Streams, cwd: string): number;
+/**
+ * The open reconciliation backlog: `reconciliation.required` records with no
+ * later `reconciliation.satisfied`.
+ *
+ * Reads a verified log and writes nothing. The same projection `status` and
+ * `doctor` read, so the three can never disagree about what is outstanding.
+ */
+export declare function commandAuditObligations(argv: string[], streams: Streams, cwd: string): number;
+/**
+ * `approval audit reconcile <obligation-seq> --note "<text>" [--revert <key>]`
+ *
+ * HUMAN-ONLY, enforced in `core/audit.ts` and again by the event schema, and
+ * checked here first so a malformed invocation never reaches the log.
+ */
+export declare function commandAuditReconcile(argv: string[], streams: Streams, cwd: string): number;
+/** `approval audit <subcommand>` — `list`, `review`, `obligations`, `reconcile`. */
+export declare function commandAudit(argv: string[], streams: Streams, cwd: string): number;