approval-md 0.2.0 → 0.4.0

package/dist/src/core/gesture-refusal.js

@@ -0,0 +1,188 @@
+/**
+ * What the log says when a decision surface refused a gesture that is not a
+ * decision (APRV-355, amended SPEC.md §8).
+ *
+ * ## The fact this module is about
+ *
+ * Found while landing APRV-324 (PR #427, 2026-09-17). Once the policy maps
+ * Telegram senders, a tap on a CHECKPOINT signature or on a REVIEW from an
+ * account the attested policy names nobody for is refused before any verb runs
+ * — and records nothing. The only refusal record in the system is
+ * `audit.decision_refused`, and it requires a record-level `action_key` and a
+ * `payload.decision` of grant, reject or revoke. A signature answers for a
+ * chain head and a review answers for a sampled record; neither has either
+ * field, so writing one of these there would mean manufacturing both. The lane
+ * that found it declined to, correctly.
+ *
+ * The cost of recording nothing is the same cost `core/decision-refusal.ts`
+ * exists to end. Somebody's attention was spent — SPEC.md §11 calls human
+ * attention the audit budget — and an attempt was made from an account the
+ * operator did not map, and the only trace is a line on a terminal and an
+ * answer in a chat. An operator deciding whether to map that account has
+ * nothing in the log to read.
+ *
+ * ## What this record is, and what it is not
+ *
+ * `audit.gesture_refused` is an AUDIT-TIER record on the strict terms
+ * `audit.decision_refused` set, and the terms are the whole of its safety:
+ *
+ * - it grants nothing and mints no token;
+ * - `core/state.ts` settles nothing on it, so no verdict moves;
+ * - `core/budgets.ts` charges nothing for it, so no budget moves;
+ * - `core/audit.ts` does not sample it and no streak counts it;
+ * - NO ENFORCEMENT PATH READS IT. `tests/gesture-refusal.test.ts` pins that by
+ *   reading the module graph rather than by asserting an intention.
+ *
+ * The record's own actor is `system:`, for the reason `audit.dark_session`'s
+ * and `audit.decision_refused`'s are: this is the runtime's statement about a
+ * refusal the runtime made, and a record of a refusal authored by either party
+ * to it is a record neither party can be held to. The person, when the runtime
+ * can name one, is the SUBJECT and sits in the payload.
+ *
+ * ## The asymmetry it inherits
+ *
+ * Refusals handed to AGENTS stay unlogged here too. An agent that is refused
+ * reads the code, stops or asks again, and nothing was spent that a record
+ * could account for. And a gesture is human by construction: an agent has no
+ * checkpoint to sign and no review to give.
+ *
+ * ## No attestation check, deliberately
+ *
+ * Nothing here asks whether the policy is attested, for the reason
+ * `core/decision-refusal.ts` does not: this write confers no authority.
+ * Refusing to record a refusal because a file changed would be the strict
+ * direction pointing the wrong way, and the case where it would bite hardest is
+ * `policy-not-attested` itself — exactly the refusal an operator most needs the
+ * log to remember. The write boundary still validates every record.
+ *
+ * ## Invariants
+ *
+ * - **Gate-typed events never accept caller timestamps** (§11.1). `ts` comes
+ *   from the injected clock at the write boundary; there is no parameter.
+ * - **Every check-then-append passes through compare-and-append** (§11.1(5)).
+ *   The write states the head it was derived against and the whole cycle
+ *   re-enters from a fresh read on `head-moved` through {@link withHeadRetry}.
+ * - **Self-reported fields never reduce scrutiny** (§11.1). Everything here
+ *   only ADDS to what a reviewer sees. The sender is the transport's own
+ *   attribution, never anything the message claimed about itself.
+ * - **Refusals stay machine-readable and distinct** (§11.1). The surface's code
+ *   is copied verbatim; nothing here invents, merges or softens one.
+ */
+import { tick } from "./clock.js";
+import { attemptsOf, withHeadRetry } from "./head-retry.js";
+import { appendEvent } from "./log.js";
+import { readVerifiedRecords } from "./state.js";
+/** The actor every record here carries: the gate stating what the gate did. */
+export const GESTURE_REFUSAL_ACTOR = "system:gate";
+/**
+ * The gestures this record can be about. **Closed and additive-only** (§11.1
+ * invariant 6), and pinned against the event schema's own enum by
+ * `tests/gesture-refusal.test.ts`: a kind the sweep can produce and the write
+ * boundary refuses is an observation that never reaches a human, which is the
+ * failure APRV-358 named a few hours before this task.
+ *
+ * `review` and `review-note` are two members rather than one because a note is
+ * attention spent WRITING rather than attention spent tapping, and an operator
+ * reading this record to decide whether to map an account wants to know which
+ * they lost.
+ */
+export const REFUSED_GESTURES = ["checkpoint-signature", "review", "review-note"];
+/**
+ * The refusals a gesture can meet before any verb runs. **Closed**, and exactly
+ * what sender resolution can answer: `sender-unmapped`, `sender-ambiguous` and
+ * `sender-key-unavailable` from `core/sender-identity.ts`'s own union, and
+ * `policy-not-attested` from `core/attest.ts`, which fires when the policy
+ * declaring the mapping is not the attested one and is therefore not in force.
+ *
+ * `attest-requires-terminal` is deliberately absent: it belongs to an
+ * attestation tap, which is a decision and is recorded as one.
+ */
+export const REFUSED_GESTURE_CODES = [
+    "sender-unmapped",
+    "sender-ambiguous",
+    // APRV-370. A keyed mapping this process holds no key for: the runtime could
+    // resolve no account at all, which is a different fact from "this account is
+    // not mapped" and wants a different repair.
+    "sender-key-unavailable",
+    "policy-not-attested",
+];
+/** Is `code` one this record can carry? Used where a code arrives as a string. */
+export function isRefusedGestureCode(code) {
+    return REFUSED_GESTURE_CODES.includes(code);
+}
+/** The gestures this module records: a person's, and nobody else's. */
+const HUMAN_ACTOR = /^human:.+/u;
+/**
+ * Record that a human's gesture was refused.
+ *
+ * Called by the surface that collected the gesture, on the branch where it
+ * refused — never from inside the verb the gesture would have reached, which is
+ * never called at all on this path.
+ *
+ * Best-effort by design: a failure here is returned, never thrown, and the
+ * caller shows the refusal either way. The gesture was already refused before
+ * this ran, and nothing about that outcome depends on this write landing.
+ *
+ * Two cases append nothing, and both are the honest answer rather than a
+ * silence:
+ *
+ * - a non-human actor, which is the misconfigured-surface case: nobody's
+ *   attention was spent, so there is no spend for a record to account for;
+ * - a code this record cannot carry, which means a surface refused for a reason
+ *   this vocabulary does not name. Minting a member here to fit it would widen
+ *   a closed union at the write boundary from inside a best-effort path.
+ */
+export function recordRefusedGesture(logPath, gesture, refusal, options = {}) {
+    if (gesture.actor !== null && !HUMAN_ACTOR.test(gesture.actor)) {
+        return { ok: true, audit: null };
+    }
+    // No person and no account is nothing to say: the record would name neither
+    // the subject nor the reason it could not, and the schema refuses it.
+    if (gesture.actor === null && gesture.sender === undefined) {
+        return { ok: true, audit: null };
+    }
+    if (!isRefusedGestureCode(refusal.code))
+        return { ok: true, audit: null };
+    const appended = withHeadRetry(attemptsOf(options.retryOnHeadMoved), () => appendAudit(logPath, gesture, refusal, options));
+    return appended.ok ? { ok: true, audit: appended.record } : appended;
+}
+/** The whole cycle: a fresh read for the head, then one append against it. */
+function appendAudit(logPath, gesture, refusal, options) {
+    const ts = tick(options);
+    const read = readVerifiedRecords(logPath, options.schemaDir === undefined ? {} : { schemaDir: options.schemaDir });
+    if (!read.ok) {
+        return { ok: false, code: "log-unreadable", message: read.message };
+    }
+    const payload = {
+        ...(gesture.actor === null ? {} : { actor: gesture.actor }),
+        gesture: gesture.gesture,
+        code: refusal.code,
+        message: refusal.message,
+    };
+    if (gesture.sender !== undefined) {
+        payload["sender"] = {
+            channel: gesture.sender.channel,
+            id: gesture.sender.id,
+            // APRV-370: only when true, so a raw record does not change shape.
+            ...(gesture.sender.hashed === true ? { hashed: true } : {}),
+        };
+        if (gesture.senderSource !== undefined)
+            payload["sender_source"] = gesture.senderSource;
+    }
+    return appendOne(logPath, { ts, actor: GESTURE_REFUSAL_ACTOR, channel: gesture.channel, payload }, options, read.head);
+}
+function appendOne(logPath, input, options, expectedHead) {
+    const append = { ...options.append };
+    if (options.schemaDir !== undefined)
+        append.schemaDir = options.schemaDir;
+    const result = appendEvent(logPath, { ...input, event: "audit.gesture_refused" }, { ...append, expectedHead });
+    if (result.ok)
+        return { ok: true, record: result.record };
+    return {
+        ok: false,
+        code: "append-failed",
+        message: `audit.gesture_refused could not be appended: ${result.error.message}`,
+        append: result.error,
+    };
+}
+//# sourceMappingURL=gesture-refusal.js.map

package/dist/src/core/gesture-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gesture-refusal.js","sourceRoot":"","sources":["../../../src/core/gesture-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAoD,MAAM,UAAU,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAIjD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,sBAAsB,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAI3F;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,kBAAkB;IAClB,6EAA6E;IAC7E,6EAA6E;IAC7E,4CAA4C;IAC5C,wBAAwB;IACxB,qBAAqB;CACb,CAAC;AAIX,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAkDD,uEAAuE;AACvE,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAuB,EACvB,OAA4B,EAC5B,OAAO,GAAgB,EAAE;IAEzB,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CACxE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAChD,CAAC;IACF,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvE,CAAC;AAID,8EAA8E;AAC9E,SAAS,WAAW,CAClB,OAAe,EACf,OAAuB,EACvB,OAA4B,EAC5B,OAAoB;IAEpB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;YAClB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;YAC/B,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;YACrB,mEAAmE;YACnE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1F,CAAC;IAED,OAAO,SAAS,CACd,OAAO,EACP,EAAE,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EACvE,OAAO,EACP,IAAI,CAAC,IAAI,CACV,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,OAAe,EACf,KAAuF,EACvF,OAAoB,EACpB,YAA4B;IAE5B,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1E,MAAM,MAAM,GAAG,WAAW,CACxB,OAAO,EACP,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAC5C,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAC5B,CAAC;IACF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,gDAAgD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;QAC/E,MAAM,EAAE,MAAM,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC"}

package/dist/src/core/harness-version.d.ts

@@ -52,7 +52,7 @@
  * only seam, and a test puts a stub binary in front of it.
  */
 /** The harnesses this runtime speaks a hook protocol for. */
-export declare const HARNESS_KINDS: readonly ["claude-code", "cursor", "codex"];
+export declare const HARNESS_KINDS: readonly ["claude-code", "cursor", "codex", "grok", "muse", "hermes"];
 export type HarnessKind = (typeof HARNESS_KINDS)[number];
 /** Is `value` one of the harnesses this runtime knows? */
 export declare function isHarnessKind(value: unknown): value is HarnessKind;
@@ -102,7 +102,30 @@ export declare function normalizeHarnessVersion(raw: unknown): string | null;
  */
 export declare const HARNESS_PROBE_TIMEOUT_MS = 10000;
 /**
- * Run `<binary> --version` once, uncached, and normalize what came back.
+ * How long the RAW first line of `<binary> --version` may be.
+ *
+ * Wider than {@link HARNESS_VERSION_LIMIT} because it holds a different kind of
+ * value for a different reader: nothing capped by this number is ever appended to
+ * the log (only {@link normalizeHarnessVersion}'s output is), and what needs the
+ * raw line is a diagnostic that must be able to read a build stamp a harness
+ * prints beside its semver. Hermes prints
+ * `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`, which the log's own
+ * rule rejects on the non-ASCII separator alone. Capped and stripped of control
+ * characters all the same: this is third-party output on its way to a terminal.
+ */
+export declare const HARNESS_RAW_VERSION_LIMIT = 200;
+/**
+ * The first line of a `--version` output, as a line a diagnostic may print.
+ *
+ * One line, trimmed, control characters removed, capped. `null` for empty output
+ * or a line past the cap. It keeps non-ASCII bytes, which is the whole difference
+ * from {@link normalizeHarnessVersion}: a build stamp behind a typographic
+ * separator is exactly the fact a version floor has to read, and it is exactly
+ * the fact the write boundary will not accept.
+ */
+export declare function rawHarnessVersionLine(raw: unknown): string | null;
+/**
+ * Run `<binary> --version` once, uncached, and return its raw first line.
  *
  * Every failure is a value rather than an exception, in the manner of
  * {@link spawnGloss}: a missing binary, a non-zero exit and a timeout kill are
@@ -113,16 +136,117 @@ export declare const HARNESS_PROBE_TIMEOUT_MS = 10000;
  * vault passphrase, and it has no use for either. Nothing is declared, because
  * reading a version is not a granted action.
  */
+export declare function probeHarnessVersionRaw(kind: HarnessKind): string | null;
+/**
+ * Run `<binary> --version` once, uncached, and normalize what came back.
+ *
+ * The recordable form: one line, printable ASCII, capped. Exported for the test
+ * that proves the memo below is a memo.
+ */
 export declare function probeHarnessVersion(kind: HarnessKind): string | null;
+/** The raw first line of `<binary> --version`, read at most once per process. */
+export declare function installedHarnessVersionRaw(kind: HarnessKind): string | null;
 /**
  * The installed version of `kind`, read at most once per process.
  *
- * This is the only entry point callers should use. `probeHarnessVersion` is
- * exported for the test that proves the memo is a memo.
+ * This is the only entry point callers should use for a RECORDABLE version.
+ * `probeHarnessVersion` is exported for the test that proves the memo is a memo.
  */
 export declare function installedHarnessVersion(kind: HarnessKind): string | null;
 /** Drop the memo. TEST ONLY: a process reads a version once, by design. */
 export declare function resetHarnessVersionCache(): void;
+/**
+ * The build at which Hermes Agent starts honouring `fail_closed` (APRV-415).
+ *
+ * ## Why a floor exists at all, and why it is a DATE rather than a version
+ *
+ * `approval hook hermes` is enforcement rather than a backstop only because of a
+ * per-entry `fail_closed: true` that makes a hook crash, a hook timeout and
+ * unparseable hook output BLOCK. The live probe measured both halves of that on
+ * two builds of the same harness, and the answer differs between them:
+ *
+ * - `main` at `118984d7`, built 2026-09-20: crash, garbage and hang were all
+ *   REFUSED (the hang at the 300s per-entry cap). The key works;
+ * - `v0.21.3`, built 2026.9.14: all three PROCEEDED. That build does not know the
+ *   key and ignores it SILENTLY. `hermes hooks list` renders no `fail_closed`
+ *   flag on either build, so the listing cannot be used to tell them apart.
+ *
+ * The two builds report the SAME semver. `hermes --version` on the older one
+ * prints `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`, and the update
+ * that fixed the behaviour moved 670 commits without moving `0.21.3`. So a floor
+ * expressed as a semantic version would compare the one field that did not
+ * change, and would pass a build that fails open. The build DATE and the upstream
+ * commit are the two fields that did move, and they are what this compares.
+ *
+ * ## What it can and cannot do
+ *
+ * It can only ADD a red line to `approval doctor` (SPEC.md §11.1 invariant 4: a
+ * self-reported field never reduces scrutiny). A build claiming a later date buys
+ * nothing — it defeats a row that would have asked a human to look — and nothing
+ * in the runtime reads this to widen a verdict, skip a wait or lower a class. The
+ * refusals the adapter emits are the same on every build; what changes below the
+ * floor is whether a BROKEN hook stops the call, which no code in this repository
+ * can observe from inside the hook it is broken in.
+ */
+export declare const HERMES_FAIL_CLOSED_FLOOR: {
+    /** The first build observed to honour the key, by upstream commit. */
+    readonly upstream: "118984d7";
+    /** That build's date, in the `YYYY.M.D` stamp `hermes --version` prints. */
+    readonly date: {
+        readonly year: 2026;
+        readonly month: 9;
+        readonly day: 20;
+    };
+    /** The one sentence every surface quotes, so they cannot drift apart. */
+    readonly statement: "a build at or after main 118984d7 of 2026-09-20; v0.21.3 (2026.9.14) fails open silently";
+};
+/** A build stamp, as `hermes --version` prints one. */
+export interface HermesBuildDate {
+    year: number;
+    month: number;
+    day: number;
+}
+/** What `hermes --version`'s first line states, field by field. */
+export interface HermesVersionFields {
+    /** The semver, which did NOT move across the fail-closed fix. */
+    semver: string | null;
+    /** The build date, `(2026.9.14)`, which did. */
+    date: HermesBuildDate | null;
+    /** The upstream commit, `· upstream 913d4098`, which did. */
+    upstream: string | null;
+}
+/**
+ * Read the fields out of `hermes --version`'s first line, or `null`.
+ *
+ * Shape-only and forgiving in one direction: a field this cannot find is `null`
+ * rather than a guess, and a line naming none of the three is not a Hermes
+ * version line at all. The observed line is
+ * `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`; the separator is read
+ * past rather than required, because a release that changes its punctuation must
+ * not silently turn the floor check into an unknown.
+ */
+export declare function parseHermesVersion(raw: unknown): HermesVersionFields | null;
+/**
+ * Does this Hermes build honour `fail_closed`?
+ *
+ * - `"honours"` — its upstream commit IS the floor's, or its build date is on or
+ *   after the floor's date;
+ * - `"ignores"` — its build date is BEFORE the floor's. This is the one answer
+ *   that names a fault, and it is the state a live probe measured rather than
+ *   inferred;
+ * - `"unknown"` — no version could be read, or the line carries neither a build
+ *   date nor the floor's commit. Two commit hashes cannot be ORDERED without a
+ *   repository, so a build stamped with an unfamiliar commit and no date is
+ *   honestly unknown rather than quietly either.
+ *
+ * `"unknown"` is not a synonym for `"ignores"`, deliberately. This value feeds a
+ * health check, and a health check that cried fault on every unreadable banner
+ * would train an operator to stop reading it, which costs more than the case it
+ * would catch. What guards the unknown case instead is the doc, the help block
+ * and the probe's own report, all of which state {@link
+ * HERMES_FAIL_CLOSED_FLOOR.statement} verbatim.
+ */
+export declare function hermesFailClosedSupport(raw: unknown): "honours" | "ignores" | "unknown";
 /**
  * The provenance pair a hook-written record carries, or `null` when this
  * process could not establish one.

package/dist/src/core/harness-version.js

@@ -54,7 +54,14 @@
 import { spawnSync } from "node:child_process";
 import { childEnvironment } from "./child-env.js";
 /** The harnesses this runtime speaks a hook protocol for. */
-export const HARNESS_KINDS = ["claude-code", "cursor", "codex"];
+export const HARNESS_KINDS = [
+    "claude-code",
+    "cursor",
+    "codex",
+    "grok",
+    "muse",
+    "hermes",
+];
 /** Is `value` one of the harnesses this runtime knows? */
 export function isHarnessKind(value) {
     return typeof value === "string" && HARNESS_KINDS.includes(value);
@@ -69,6 +76,9 @@ export const HARNESS_BINARY = {
     "claude-code": "claude",
     cursor: "cursor-agent",
     codex: "codex",
+    grok: "grok",
+    muse: "muse",
+    hermes: "hermes",
 };
 /**
  * How long a version string may be, and the reason there is a cap at all.
@@ -119,7 +129,40 @@ export function normalizeHarnessVersion(raw) {
  */
 export const HARNESS_PROBE_TIMEOUT_MS = 10_000;
 /**
- * Run `<binary> --version` once, uncached, and normalize what came back.
+ * How long the RAW first line of `<binary> --version` may be.
+ *
+ * Wider than {@link HARNESS_VERSION_LIMIT} because it holds a different kind of
+ * value for a different reader: nothing capped by this number is ever appended to
+ * the log (only {@link normalizeHarnessVersion}'s output is), and what needs the
+ * raw line is a diagnostic that must be able to read a build stamp a harness
+ * prints beside its semver. Hermes prints
+ * `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`, which the log's own
+ * rule rejects on the non-ASCII separator alone. Capped and stripped of control
+ * characters all the same: this is third-party output on its way to a terminal.
+ */
+export const HARNESS_RAW_VERSION_LIMIT = 200;
+/**
+ * The first line of a `--version` output, as a line a diagnostic may print.
+ *
+ * One line, trimmed, control characters removed, capped. `null` for empty output
+ * or a line past the cap. It keeps non-ASCII bytes, which is the whole difference
+ * from {@link normalizeHarnessVersion}: a build stamp behind a typographic
+ * separator is exactly the fact a version floor has to read, and it is exactly
+ * the fact the write boundary will not accept.
+ */
+export function rawHarnessVersionLine(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const first = raw.split("\n", 1)[0] ?? "";
+    // `\p{Cc}` rather than an escaped range: the class is the Unicode CONTROL
+    // category, which is the thing being removed, and it reads as that.
+    const text = first.replace(/\p{Cc}/gu, "").trim();
+    if (text.length === 0 || text.length > HARNESS_RAW_VERSION_LIMIT)
+        return null;
+    return text;
+}
+/**
+ * Run `<binary> --version` once, uncached, and return its raw first line.
  *
  * Every failure is a value rather than an exception, in the manner of
  * {@link spawnGloss}: a missing binary, a non-zero exit and a timeout kill are
@@ -130,7 +173,7 @@ export const HARNESS_PROBE_TIMEOUT_MS = 10_000;
  * vault passphrase, and it has no use for either. Nothing is declared, because
  * reading a version is not a granted action.
  */
-export function probeHarnessVersion(kind) {
+export function probeHarnessVersionRaw(kind) {
     let result;
     try {
         result = spawnSync(HARNESS_BINARY[kind], ["--version"], {
@@ -148,32 +191,158 @@ export function probeHarnessVersion(kind) {
     }
     if (result.error !== undefined || result.status !== 0)
         return null;
-    return normalizeHarnessVersion(result.stdout);
+    return rawHarnessVersionLine(result.stdout);
+}
+/**
+ * Run `<binary> --version` once, uncached, and normalize what came back.
+ *
+ * The recordable form: one line, printable ASCII, capped. Exported for the test
+ * that proves the memo below is a memo.
+ */
+export function probeHarnessVersion(kind) {
+    return normalizeHarnessVersion(probeHarnessVersionRaw(kind));
 }
 /**
  * The memo. Holds the FAILURES too: a harness that is not on PATH is not on
  * PATH, and asking a second time in the same process would pay a second spawn
  * for the same `null`.
- */
-const probed = new Map();
-/**
- * The installed version of `kind`, read at most once per process.
  *
- * This is the only entry point callers should use. `probeHarnessVersion` is
- * exported for the test that proves the memo is a memo.
+ * It holds the RAW line rather than the recordable one, so the two readers — the
+ * provenance field and the version floor — still cost ONE spawn per process
+ * between them. A harness whose raw line the write boundary rejects has a
+ * `null` recordable version and a readable raw one, which is precisely Hermes's
+ * case and precisely why the floor is not read off a record.
  */
-export function installedHarnessVersion(kind) {
+const probed = new Map();
+/** The raw first line of `<binary> --version`, read at most once per process. */
+export function installedHarnessVersionRaw(kind) {
     const memo = probed.get(kind);
     if (memo !== undefined)
         return memo;
-    const value = probeHarnessVersion(kind);
+    const value = probeHarnessVersionRaw(kind);
     probed.set(kind, value);
     return value;
 }
+/**
+ * The installed version of `kind`, read at most once per process.
+ *
+ * This is the only entry point callers should use for a RECORDABLE version.
+ * `probeHarnessVersion` is exported for the test that proves the memo is a memo.
+ */
+export function installedHarnessVersion(kind) {
+    return normalizeHarnessVersion(installedHarnessVersionRaw(kind));
+}
 /** Drop the memo. TEST ONLY: a process reads a version once, by design. */
 export function resetHarnessVersionCache() {
     probed.clear();
 }
+// ---------------------------------------------------------------------------
+// The Hermes fail-closed version floor (APRV-415)
+// ---------------------------------------------------------------------------
+/**
+ * The build at which Hermes Agent starts honouring `fail_closed` (APRV-415).
+ *
+ * ## Why a floor exists at all, and why it is a DATE rather than a version
+ *
+ * `approval hook hermes` is enforcement rather than a backstop only because of a
+ * per-entry `fail_closed: true` that makes a hook crash, a hook timeout and
+ * unparseable hook output BLOCK. The live probe measured both halves of that on
+ * two builds of the same harness, and the answer differs between them:
+ *
+ * - `main` at `118984d7`, built 2026-09-20: crash, garbage and hang were all
+ *   REFUSED (the hang at the 300s per-entry cap). The key works;
+ * - `v0.21.3`, built 2026.9.14: all three PROCEEDED. That build does not know the
+ *   key and ignores it SILENTLY. `hermes hooks list` renders no `fail_closed`
+ *   flag on either build, so the listing cannot be used to tell them apart.
+ *
+ * The two builds report the SAME semver. `hermes --version` on the older one
+ * prints `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`, and the update
+ * that fixed the behaviour moved 670 commits without moving `0.21.3`. So a floor
+ * expressed as a semantic version would compare the one field that did not
+ * change, and would pass a build that fails open. The build DATE and the upstream
+ * commit are the two fields that did move, and they are what this compares.
+ *
+ * ## What it can and cannot do
+ *
+ * It can only ADD a red line to `approval doctor` (SPEC.md §11.1 invariant 4: a
+ * self-reported field never reduces scrutiny). A build claiming a later date buys
+ * nothing — it defeats a row that would have asked a human to look — and nothing
+ * in the runtime reads this to widen a verdict, skip a wait or lower a class. The
+ * refusals the adapter emits are the same on every build; what changes below the
+ * floor is whether a BROKEN hook stops the call, which no code in this repository
+ * can observe from inside the hook it is broken in.
+ */
+export const HERMES_FAIL_CLOSED_FLOOR = {
+    /** The first build observed to honour the key, by upstream commit. */
+    upstream: "118984d7",
+    /** That build's date, in the `YYYY.M.D` stamp `hermes --version` prints. */
+    date: { year: 2026, month: 9, day: 20 },
+    /** The one sentence every surface quotes, so they cannot drift apart. */
+    statement: "a build at or after main 118984d7 of 2026-09-20; v0.21.3 (2026.9.14) fails open silently",
+};
+/**
+ * Read the fields out of `hermes --version`'s first line, or `null`.
+ *
+ * Shape-only and forgiving in one direction: a field this cannot find is `null`
+ * rather than a guess, and a line naming none of the three is not a Hermes
+ * version line at all. The observed line is
+ * `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`; the separator is read
+ * past rather than required, because a release that changes its punctuation must
+ * not silently turn the floor check into an unknown.
+ */
+export function parseHermesVersion(raw) {
+    const line = rawHarnessVersionLine(raw);
+    if (line === null)
+        return null;
+    const semver = /\bv(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/u.exec(line);
+    const stamp = /\((\d{4})\.(\d{1,2})\.(\d{1,2})\)/u.exec(line);
+    const upstream = /\bupstream\s+([0-9a-f]{7,40})\b/iu.exec(line);
+    if (semver === null && stamp === null && upstream === null)
+        return null;
+    return {
+        semver: semver?.[1] ?? null,
+        date: stamp === null
+            ? null
+            : {
+                year: Number(stamp[1]),
+                month: Number(stamp[2]),
+                day: Number(stamp[3]),
+            },
+        upstream: upstream?.[1]?.toLowerCase() ?? null,
+    };
+}
+/**
+ * Does this Hermes build honour `fail_closed`?
+ *
+ * - `"honours"` — its upstream commit IS the floor's, or its build date is on or
+ *   after the floor's date;
+ * - `"ignores"` — its build date is BEFORE the floor's. This is the one answer
+ *   that names a fault, and it is the state a live probe measured rather than
+ *   inferred;
+ * - `"unknown"` — no version could be read, or the line carries neither a build
+ *   date nor the floor's commit. Two commit hashes cannot be ORDERED without a
+ *   repository, so a build stamped with an unfamiliar commit and no date is
+ *   honestly unknown rather than quietly either.
+ *
+ * `"unknown"` is not a synonym for `"ignores"`, deliberately. This value feeds a
+ * health check, and a health check that cried fault on every unreadable banner
+ * would train an operator to stop reading it, which costs more than the case it
+ * would catch. What guards the unknown case instead is the doc, the help block
+ * and the probe's own report, all of which state {@link
+ * HERMES_FAIL_CLOSED_FLOOR.statement} verbatim.
+ */
+export function hermesFailClosedSupport(raw) {
+    const fields = parseHermesVersion(raw);
+    if (fields === null)
+        return "unknown";
+    const floor = HERMES_FAIL_CLOSED_FLOOR;
+    if (fields.upstream !== null && fields.upstream.startsWith(floor.upstream))
+        return "honours";
+    if (fields.date === null)
+        return "unknown";
+    const asNumber = (date) => date.year * 10_000 + date.month * 100 + date.day;
+    return asNumber(fields.date) >= asNumber(floor.date) ? "honours" : "ignores";
+}
 /**
  * Build the pair for `kind`, preferring the version the hook event supplied.
  *

package/dist/src/core/harness-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness-version.js","sourceRoot":"","sources":["../../../src/core/harness-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAIzE,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAA0C;IACnE,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,OAAO;CACf,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,oFAAoF;AACpF,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,gBAAgB,EAAE,CAAC,GAAG;YAC3B,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,SAAS;YACrB,wEAAwE;YACxE,4DAA4D;YAC5D,SAAS,EAAE,EAAE,GAAG,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAiB,EACjB,YAAY,GAAY,IAAI;IAE5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"harness-version.js","sourceRoot":"","sources":["../../../src/core/harness-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,aAAa;IACb,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;CACA,CAAC;AAIX,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAA0C;IACnE,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,oFAAoF;AACpF,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,gBAAgB,EAAE,CAAC,GAAG;YAC3B,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,SAAS;YACrB,wEAAwE;YACxE,4DAA4D;YAC5D,SAAS,EAAE,EAAE,GAAG,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,OAAO,uBAAuB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;AAErD,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,IAAiB;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,OAAO,uBAAuB,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,sEAAsE;IACtE,QAAQ,EAAE,UAAU;IACpB,4EAA4E;IAC5E,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACvC,yEAAyE;IACzE,SAAS,EACP,0FAA0F;CACpF,CAAC;AAmBX;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO;QACL,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3B,IAAI,EACF,KAAK,KAAK,IAAI;YACZ,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aACtB;QACP,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,IAAqB,EAAU,EAAE,CACjD,IAAI,CAAC,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAiB,EACjB,YAAY,GAAY,IAAI;IAE5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}