audit-tools 0.30.14 → 0.30.16

package/dist/remediate/steps/dispatch.d.ts

@@ -156,6 +156,16 @@ export declare function rebaseBranchOntoHead(root: string, worktreePath: string,
 /** Worktree path for a remediation block. */
 export declare function worktreePath(root: string, blockId: string, runId: string): string;
 export declare function remediationBranchName(runId: string): string;
+/**
+ * Lock path for the base-mutating accept critical section (INV-2/CE-001), keyed on
+ * the base repo root + run's remediation branch. DISTINCT from the per-run
+ * `rolling-session.lock` (`withFileLock` is non-reentrant — an exclusive `wx`
+ * create — so the base lock MUST be a different path than the session lock
+ * `advanceHostRolling` already holds, or the nested acquire would self-deadlock).
+ * Both rolling drivers (host-subagent + in-process) serialize the rebase →
+ * cherry-pick → cross-package check → reset sequence through this single lock.
+ */
+export declare function baseBranchLockPath(root: string, runId: string): string;
 /**
  * Preserve a failed-but-committed node's work so it can never be lost. A node that
  * committed real edits to its worktree branch but then failed verify / the
@@ -188,18 +198,7 @@ export declare function listQuarantinedCommits(root: string, runId: string): Arr
  * non-git callers/tests are unaffected. Returns the branch name on success.
  */
 export declare function ensureRemediationBranchCheckedOut(root: string, runId: string): string | null;
-/**
- * Stage and commit all of a worktree's edits onto its branch. The TOOL owns this
- * commit (never the worker/host) so that the branch has a real commit for two
- * downstream invariants: `gitEditedFilesForBranch` (the write-scope ground truth,
- * `HEAD...<branch>`) and `mergeWorktree`'s cherry-pick both operate on the worker's
- * changes rather than an empty diff against HEAD. Gitignored paths (node_modules,
- * .audit-tools artifacts, the result file written to the main artifacts dir) are
- * excluded by `git add -A` honoring .gitignore, so the commit captures exactly the
- * source edits. Returns `committed:false` (not an error) when the worker made no
- * tracked edits — there is then nothing to verify or merge.
- */
-export declare function commitWorktree(worktreeRoot: string, message: string): {
+export declare function commitWorktree(worktreeRoot: string, message: string, declaredWritePaths?: string[]): {
     committed: boolean;
     error?: string;
 };
@@ -260,6 +259,21 @@ export interface AcceptNodeWorktreeParams {
             write_paths: string[];
         }>;
     };
+    /**
+     * The block's OWN declared write paths (INV-1). Threaded into `commitWorktree`
+     * so worker-created new SOURCE files under scope are force-added past
+     * `.gitignore` and a generated-artifact / out-of-scope new file fails loudly.
+     * Omit (lifecycle unit tests with no scope) → no new-file inclusion.
+     */
+    writePaths?: string[];
+    /**
+     * The cross-package check command run in the MAIN checkout AFTER the cherry-pick
+     * lands (INV-2): a RED check rolls the base back to its captured HEAD OID. Defaults
+     * to `npm run check`. Tests inject a deterministic pass/fail command (a `t.mock.module`
+     * seam is unusable under tsx/esm). Pass `null` to skip the merged-base check entirely
+     * (legacy lifecycle unit tests on a minimal repo with no check script).
+     */
+    mergedBaseCheckCommand?: string | null;
 }
 export interface AcceptNodeWorktreeResult {
     /** The LIFECYCLE outcome (verify/merge applied), distinct from the worker transport outcome. */
@@ -295,7 +309,7 @@ export interface AcceptNodeWorktreeResult {
  * verified branch, aborts cleanly on conflict). No state mutation here — the
  * caller persists via `mergeImplementResults`.
  */
-export declare function acceptNodeWorktree(params: AcceptNodeWorktreeParams): AcceptNodeWorktreeResult;
+export declare function acceptNodeWorktree(params: AcceptNodeWorktreeParams): Promise<AcceptNodeWorktreeResult>;
 /**
  * Sidecar path for a node's tool-owned accept (verify/merge) outcome. Written by
  * BOTH rolling drivers as each node is accepted, read by `mergeImplementResults`.

package/dist/remediate/steps/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/dispatch.ts"],"names":[],"mappings":"AASA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,eAAe,EAEf,oBAAoB,EACpB,2BAA2B,EAE3B,oBAAoB,EACpB,YAAY,EAEZ,YAAY,EACZ,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAiC5B,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAapB,OAAO,EAEL,8BAA8B,EAM/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAC1C,OAAO,EACL,6BAA6B,IAAI,4BAA4B,GAC9D,MAAM,wBAAwB,CAAC;AAOhC,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAIrC,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC3C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAKzF;AAQD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,sBAAsB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD,cAAc,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAChD;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,oBAAoB,GAAG,IAAI,CAM9B;AAiCD,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkHxF;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,CAAC,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAsE1B;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,kBAAkB,EAC5B,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,GACvC,wBAAwB,CA4B1B;AAmCD,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,qBAA4B,CAAC;AAepE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAStD;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CA2B3F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,GAC9B,IAAI,CAoBN;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAYvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,IAAI,CAeN;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,EAAE,GACzB,oBAAoB,CAoBtB;AAED,+HAA+H;AAC/H,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA6BvD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA2B7C;AAED,6CAA6C;AAC7C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAmBD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAOD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAwBxC;AAED,sGAAsG;AACtG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAMzF;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAevD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BxC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAWtF;AAED,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,OAAO,GAAG,cAAc,GAAG,SAAS,CAAC;AAEjF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,aAAa,EAAE,iBAAiB,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE;QACN,gFAAgF;QAChF,cAAc,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;KACpE,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,gGAAgG;IAChG,OAAO,EAAE,iBAAiB,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,CAuG7F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,MAAM,CAER;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,4EAA4E;AAC5E,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,gBAAgB,CAAC;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,KAAK,OAAO,CAAC,qBAAqB,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC;AAE3D,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,iGAAiG;IACjG,MAAM,EAAE,qBAAqB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,sGAAsG;IACtG,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAC;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4FAA4F;IAC5F,cAAc,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACnE,+FAA+F;IAC/F,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,YAAY,EAAE,kBAAkB,CAAC;CAClC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4CjC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;CACxC;AA4BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM5D;AAwBD;;;;;;;;;;GAUG;AACH;mEACmE;AACnE,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAiB9E;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAS3F;AA+FD;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAYhE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,aAAa,EAAE,EACtB,WAAW,EAAE,MAAM,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,EAAE,CAsBV;AAgHD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GACtB,iBAAiB,CA6DnB;AA0FD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAWnE;AA0QD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE;IACZ,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,CAAC,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,GACA,OAAO,CAAC,uBAAuB,CAAC,CAiJlC;AAaD,sEAAsE;AACtE,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE;AACzC,2EAA2E;GACzE;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC7D,mFAAmF;GACjF;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAsB9D;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CA+B3D;AAYD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,kBAAkB,EAAE,MAAM,EAAE,EAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,IAAI,EAAE,MAAM,GACX,MAAM,EAAE,CAYV;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBpF;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,kBAAkB,EAAE,MAAM,EAAE,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,GACX,kBAAkB,CAsBpB;AAED;;+EAE+E;AAC/E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,uBAAuB,GAC5B,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAMpD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,uBAAuB,EAC7B,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAIV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,GACX,kBAAkB,CAoCpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACpE,GAAG,kBAAkB,CAQrB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GACtB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,qBAAqB,CAAC,cAAc,CAAC,EAClD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,GAC3B;IACD,SAAS,EAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACjD,UAAU,EAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;CACnD,CA0DA;AAMD,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,SAAS,GACT,SAAS,GACT,gBAAgB,CAAC;AAErB,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,qBAAqB,CAAC;IACnC,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GACtB,eAAe,CA+BjB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,eAAe,EAAE,MAAM,EAAE,EACzB,iBAAiB,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,EACrE,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAaf;AAMD,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACpB;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,gBAAgB,EAAE,GAChC,eAAe,EAAE,CAwBnB;AAoBD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAkC3B;AAojBD,wBAAsB,0BAA0B,CAC9C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAE9B;AAED,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAElC"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/remediate/steps/dispatch.ts"],"names":[],"mappings":"AASA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,eAAe,EAEf,oBAAoB,EACpB,2BAA2B,EAE3B,oBAAoB,EACpB,YAAY,EAEZ,YAAY,EACZ,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAkC5B,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAapB,OAAO,EAEL,8BAA8B,EAM/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAC1C,OAAO,EACL,6BAA6B,IAAI,4BAA4B,GAC9D,MAAM,wBAAwB,CAAC;AAOhC,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAIrC,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC3C;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAKzF;AAQD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,sBAAsB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD,cAAc,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAChD;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACnD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,oBAAoB,GAAG,IAAI,CAM9B;AAiCD,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkHxF;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,CAAC,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAsE1B;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,kBAAkB,EAC5B,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,GACvC,wBAAwB,CA4B1B;AAmCD,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,qBAA4B,CAAC;AAepE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAStD;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CA2B3F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,GAC9B,IAAI,CAoBN;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAYvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,IAAI,CAeN;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,EAAE,GACzB,oBAAoB,CAoBtB;AAED,+HAA+H;AAC/H,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA6BvD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA2B7C;AAED,6CAA6C;AAC7C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjF;AAmBD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtE;AAOD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAwBxC;AAED,sGAAsG;AACtG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAMzF;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAevD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB5F;AAwJD,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAC5B;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAiCxC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAWtF;AAED,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,OAAO,GAAG,cAAc,GAAG,SAAS,CAAC;AAEjF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,aAAa,EAAE,iBAAiB,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE;QACN,gFAAgF;QAChF,cAAc,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;KACpE,CAAC;IACF;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,wBAAwB;IACvC,gGAAgG;IAChG,OAAO,EAAE,iBAAiB,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAiLnC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,MAAM,CAER;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,4EAA4E;AAC5E,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,gBAAgB,CAAC;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,KAAK,OAAO,CAAC,qBAAqB,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC;AAE3D,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,iGAAiG;IACjG,MAAM,EAAE,qBAAqB,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,sGAAsG;IACtG,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAC;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4FAA4F;IAC5F,cAAc,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACnE,+FAA+F;IAC/F,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,YAAY,EAAE,kBAAkB,CAAC;CAClC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8CjC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3C,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;CACxC;AA4BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM5D;AAwBD;;;;;;;;;;GAUG;AACH;mEACmE;AACnE,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAiB9E;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAS3F;AA+FD;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAYhE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,aAAa,EAAE,EACtB,WAAW,EAAE,MAAM,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,EAAE,CAsBV;AAgHD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GACtB,iBAAiB,CA6DnB;AA0FD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAWnE;AA0QD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE;IACZ,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,CAAC,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,GACA,OAAO,CAAC,uBAAuB,CAAC,CAiJlC;AAaD,sEAAsE;AACtE,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE;AACzC,2EAA2E;GACzE;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC7D,mFAAmF;GACjF;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAsB9D;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CA+B3D;AAYD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,kBAAkB,EAAE,MAAM,EAAE,EAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,IAAI,EAAE,MAAM,GACX,MAAM,EAAE,CAYV;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAmBpF;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,kBAAkB,EAAE,MAAM,EAAE,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,GACX,kBAAkB,CAsBpB;AAED;;+EAE+E;AAC/E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,uBAAuB,GAC5B,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAMpD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,uBAAuB,EAC7B,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAIV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,GACX,kBAAkB,CAoCpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACpE,GAAG,kBAAkB,CAQrB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GACtB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,qBAAqB,CAAC,cAAc,CAAC,EAClD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,GAC3B;IACD,SAAS,EAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACjD,UAAU,EAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;CACnD,CA0DA;AAMD,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,SAAS,GACT,SAAS,GACT,gBAAgB,CAAC;AAErB,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,qBAAqB,CAAC;IACnC,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IACvB,qFAAqF;IACrF,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,gBAAgB,GACtB,eAAe,CA+BjB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,eAAe,EAAE,MAAM,EAAE,EACzB,iBAAiB,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,EACrE,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAaf;AAMD,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACpB;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,gBAAgB,EAAE,GAChC,eAAe,EAAE,CAwBnB;AAoBD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAkC3B;AAojBD,wBAAsB,0BAA0B,CAC9C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAE9B;AAED,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAElC"}

package/dist/remediate/steps/dispatch.js

@@ -9,6 +9,7 @@ import { verifyPairingForFinding } from "../contractPipeline/changeClassificatio
 import { spawnSync } from "node:child_process";
 import { StateStore } from "../state/store.js";
 import { REMEDIATION_STEP, isClarificationCategory, } from "../state/types.js";
+import { withFileLock } from "audit-tools/shared";
 import { captureStepBoundaryFriction } from "audit-tools/shared";
 import { findingLead, renderFindingBadgeBody } from "audit-tools/shared";
 import { runShellCommand } from "../utils/commands.js";
@@ -566,6 +567,18 @@ function refSafeSegment(s, fallback) {
 export function remediationBranchName(runId) {
     return `remediation/${refSafeSegment(runId, "run")}`;
 }
+/**
+ * Lock path for the base-mutating accept critical section (INV-2/CE-001), keyed on
+ * the base repo root + run's remediation branch. DISTINCT from the per-run
+ * `rolling-session.lock` (`withFileLock` is non-reentrant — an exclusive `wx`
+ * create — so the base lock MUST be a different path than the session lock
+ * `advanceHostRolling` already holds, or the nested acquire would self-deadlock).
+ * Both rolling drivers (host-subagent + in-process) serialize the rebase →
+ * cherry-pick → cross-package check → reset sequence through this single lock.
+ */
+export function baseBranchLockPath(root, runId) {
+    return join(root, ".audit-tools", "remediation", "runs", refSafeSegment(runId, "run"), "base-branch.lock");
+}
 /** Durable ref under which a failed-but-committed node's commit is preserved. */
 function quarantineRef(runId, blockId) {
     return `refs/remediation-quarantine/${refSafeSegment(runId, "run")}/${refSafeSegment(blockId, "node")}`;
@@ -670,7 +683,143 @@ export function ensureRemediationBranchCheckedOut(root, runId) {
  * source edits. Returns `committed:false` (not an error) when the worker made no
  * tracked edits — there is then nothing to verify or merge.
  */
-export function commitWorktree(worktreeRoot, message) {
+/**
+ * Source-file extensions a worker is allowed to CREATE as a brand-new untracked
+ * file that `.gitignore` happens to shadow. A new source file (a .ts the build
+ * compiles, a .js shim, a source .json fixture/config) is real work that MUST land
+ * even though `git add -A` honours `.gitignore` and would silently drop it
+ * (CE-003/CE-004 — the dogfood lost a gitignored friction-dir file exactly this
+ * way). A new
+ * file with any OTHER suffix under write scope is a GENERATED artifact (`.tsbuildinfo`,
+ * an emitted `.d.ts`, a coverage dump, …) — committing it would land a stale build
+ * output, so those FAIL LOUDLY rather than commit a half-change.
+ */
+const SOURCE_NEW_FILE_EXTENSIONS = new Set([
+    ".ts",
+    ".tsx",
+    ".mts",
+    ".cts",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".json",
+]);
+/**
+ * A new untracked-ignored file is a SOURCE file (force-add it) iff its extension
+ * is in {@link SOURCE_NEW_FILE_EXTENSIONS} AND it is not a generated declaration
+ * (`.d.ts` / `.d.mts` / `.d.cts`) — a generated `.d.ts` has a `.ts` suffix but is
+ * build output, so it must be excluded from the source set.
+ */
+function isSourceNewFile(rel) {
+    const lower = rel.toLowerCase();
+    if (/\.d\.[cm]?ts$/.test(lower))
+        return false;
+    const dot = lower.lastIndexOf(".");
+    if (dot < 0)
+        return false;
+    return SOURCE_NEW_FILE_EXTENSIONS.has(lower.slice(dot));
+}
+/**
+ * Whether a repo-relative path falls UNDER one of the block's declared write
+ * paths. A declared path matches a new file when it is the file itself, a
+ * directory prefix of it (declared `src/x` matches `src/x/new.ts`), or a glob
+ * whose pre-wildcard directory prefix contains it (a leading-wildcard glob like
+ * a friction-dir pattern matches `src/a/friction/new.ts`). Declared paths and the
+ * candidate are normalized to
+ * repo-relative forward-slash form so the comparison is OS-agnostic.
+ */
+function isUnderWritePaths(rel, declaredWritePaths, root) {
+    const target = toRepoRelative(rel, root);
+    for (const raw of declaredWritePaths) {
+        const declared = toRepoRelative(raw, root);
+        if (declared === target)
+            return true;
+        // Glob: reduce a wildcard pattern to the leading literal dir segment(s)
+        // before the first wildcard and treat that as a containing prefix.
+        const wildcard = declared.search(/[*?[]/);
+        const literalPrefix = (wildcard >= 0 ? declared.slice(0, wildcard) : declared)
+            .replace(/\/+$/, "");
+        if (literalPrefix.length === 0) {
+            // A leading-wildcard glob (a friction-dir style pattern) — match on the
+            // trailing literal segment appearing anywhere in the candidate's path.
+            const trailing = declared.replace(/^[*?/]+/, "").replace(/\/+$/, "");
+            if (trailing.length > 0 && (target === trailing || target.includes(`/${trailing}/`) || target.includes(`${trailing}/`))) {
+                return true;
+            }
+            continue;
+        }
+        if (target === literalPrefix || target.startsWith(`${literalPrefix}/`))
+            return true;
+    }
+    return false;
+}
+/**
+ * Force-add worker-created NEW files that `.gitignore` shadows so genuine new
+ * source work lands in the commit. `git add -A` (and any diff) honour `.gitignore`
+ * and can ONLY be enumerated via `git ls-files --others --ignored
+ * --exclude-standard`. For each such file: a source-extension file UNDER the
+ * block's declared write scope is `git add -f`'d so it lands; a non-source file
+ * under scope (generated artifact) OR any new file OUTSIDE scope FAILS LOUDLY
+ * (returns an error naming the file) rather than committing a half-change.
+ * `declaredWritePaths` undefined → the lifecycle unit-test path with no scope:
+ * skip force-add entirely (no new-file inclusion, legacy behaviour).
+ */
+function forceAddNewSourceFiles(worktreeRoot, declaredWritePaths) {
+    if (declaredWritePaths === undefined)
+        return { ok: true };
+    const ls = spawnSync("git", ["ls-files", "--others", "--ignored", "--exclude-standard"], { cwd: worktreeRoot, encoding: "utf8", shell: false });
+    if (ls.error || ls.status !== 0) {
+        return {
+            ok: false,
+            error: `git ls-files (untracked-ignored enumeration) failed: ${(ls.stderr ?? ls.error?.message ?? "").toString().trim()}`,
+        };
+    }
+    const newFiles = (ls.stdout ?? "")
+        .split(/\r?\n/)
+        .map((l) => l.trim().replace(/\\/g, "/"))
+        .filter((l) => l.length > 0);
+    const toForceAdd = [];
+    for (const rel of newFiles) {
+        const underScope = isUnderWritePaths(rel, declaredWritePaths, worktreeRoot);
+        if (underScope && isSourceNewFile(rel)) {
+            toForceAdd.push(rel);
+            continue;
+        }
+        if (underScope) {
+            return {
+                ok: false,
+                error: `Worker created a new non-source (generated) file under its write scope: ${rel}. ` +
+                    `Only source-extension new files are committed; a generated artifact must not land. ` +
+                    `Refusing to commit a half-change.`,
+            };
+        }
+        return {
+            ok: false,
+            error: `Worker created a new file OUTSIDE its declared write scope: ${rel}. ` +
+                `New files must fall under the block's write_paths. Refusing to commit a half-change.`,
+        };
+    }
+    for (const rel of toForceAdd) {
+        const add = spawnSync("git", ["add", "-f", "--", rel], {
+            cwd: worktreeRoot,
+            encoding: "utf8",
+            shell: false,
+        });
+        if (add.status !== 0) {
+            return { ok: false, error: `git add -f ${rel} failed: ${(add.stderr ?? "").trim()}` };
+        }
+    }
+    return { ok: true };
+}
+export function commitWorktree(worktreeRoot, message, declaredWritePaths) {
+    // Force-add worker-created new SOURCE files that `.gitignore` shadows (and fail
+    // loudly on a generated-artifact / out-of-scope new file) BEFORE `git add -A`,
+    // which on its own silently drops every untracked-ignored path (CE-003/CE-004).
+    const forced = forceAddNewSourceFiles(worktreeRoot, declaredWritePaths);
+    if (!forced.ok) {
+        return { committed: false, error: forced.error };
+    }
     const add = spawnSync("git", ["add", "-A"], {
         cwd: worktreeRoot,
         encoding: "utf8",
@@ -742,7 +891,7 @@ export function ensureWorktreeNodeModules(mainRoot, worktreeRoot) {
  * verified branch, aborts cleanly on conflict). No state mutation here — the
  * caller persists via `mergeImplementResults`.
  */
-export function acceptNodeWorktree(params) {
+export async function acceptNodeWorktree(params) {
     const { root, runId, blockId, worktreeRoot: wt, branch, workerOutcome, targetedCommands, additionalVerifyCommands } = params;
     let verifyPassed = false;
     let merged = false;
@@ -751,9 +900,10 @@ export function acceptNodeWorktree(params) {
         removeWorktree(root, wt);
         return { outcome: workerOutcome, verifyPassed, merged };
     }
-    const commit = commitWorktree(wt, `remediate ${blockId} (${runId})`);
+    const commit = commitWorktree(wt, `remediate ${blockId} (${runId})`, params.writePaths);
     if (commit.error) {
-        // Could not commit the worker's edits → cannot safely land; drop it.
+        // Could not commit the worker's edits (or a new-file inclusion violation) →
+        // cannot safely land; drop it.
         removeWorktree(root, wt);
         return { outcome: "error", verifyPassed, merged, diagnostic: commit.error };
     }
@@ -763,79 +913,142 @@ export function acceptNodeWorktree(params) {
         removeWorktree(root, wt);
         return { outcome: "success", verifyPassed, merged };
     }
-    // Rebase the node's branch onto the current remediation HEAD BEFORE verify, so a
-    // sibling that merged after this worktree was created is folded in. Verify, the
-    // write-scope gate, and the cherry-pick then all operate on the FINAL to-be-merged
-    // content (green-at-merge; the later cherry-pick can no longer conflict). A true
-    // hunk conflict here is a genuine seam — preserve the work and route to triage
-    // rather than land a broken merge.
-    const rebase = rebaseBranchOntoHead(root, wt, branch);
-    if (!rebase.ok) {
-        quarantineFailedNodeCommit(root, branch, runId, blockId);
-        removeWorktree(root, wt);
-        return { outcome: "error", verifyPassed, merged, diagnostic: rebase.error };
-    }
-    // Verify commands: when the host omits them (real rolling drivers), DERIVE them
-    // from the just-committed branch's touched test files — correct paths/runner by
-    // construction, only this node's own tests, never the whole suite. An explicit
-    // list (or `[]` to skip) overrides; both used by lifecycle unit tests. task_7d35176d:
-    // run the derive AND the node's own build-free `targeted_commands` (deduped) — the
-    // auditor's fix-specific regression checks the derive misses when a fix touches no
-    // test. `additionalVerifyCommands` is ignored on the explicit-override path.
-    const baseCommands = targetedCommands === undefined
-        ? deriveVerifyCommandsFromBranch(root, branch)
-        : targetedCommands;
-    const verifyCommands = targetedCommands === undefined
-        ? [...new Set([...baseCommands, ...buildFreeVerifyCommands(additionalVerifyCommands)])]
-        : baseCommands;
-    const verify = verifyCommands.length > 0
-        ? verifyNodeInWorktree(wt, verifyCommands)
-        : { passed: true, output: "" };
-    verifyPassed = verify.passed;
-    if (!verify.passed) {
-        // Verify failed: do not merge; drop the worktree so the main tree stays clean.
-        // The node DID commit real edits, so preserve them under a durable quarantine
-        // ref before the worktree/branch go away — a tool-verify false-negative must
-        // not destroy a good fix (the dogfood lost one this way). Carry the failing
-        // command + output so triage isn't blind on outcome:error.
-        quarantineFailedNodeCommit(root, branch, runId, blockId);
-        removeWorktree(root, wt);
-        return { outcome: "error", verifyPassed, merged, diagnostic: verify.output };
-    }
-    // Write-scope gate (OBL-DS-06), BEFORE the cherry-pick: an out-of-scope or
-    // seam-conflicting edit must never land in the main tree, so it is adjudicated
-    // against the branch's git diff (the ground truth) here rather than reported
-    // after `mergeWorktree` already merged it. The gate routes the node's ACTUAL
-    // out-of-declared edits (git diff, never a self-report): an edit to a file no
-    // sibling block owns widens the effective scope, while one owned by another
-    // block blocks as a seam conflict.
-    if (params.scope) {
-        const decision = enforceAcceptWriteScope({
-            root,
-            branch,
-            blockId,
-            allBlockScopes: params.scope.allBlockScopes,
+    // Base-mutating critical section (INV-2/INV-3/CE-001/CE-002/CE-005) under a DISTINCT
+    // base-branch lock — NOT the per-run rolling-session.lock `advanceHostRolling` holds
+    // (withFileLock is non-reentrant, so a same-path nested acquire would self-deadlock).
+    // Acquired exactly ONCE here so BOTH rolling drivers serialize the rebase →
+    // cherry-pick → cross-package check → reset sequence through one lock. The base HEAD
+    // OID is captured before the cherry-pick so a RED merged-base check rolls the base
+    // back bit-identically. The lock is released on EVERY exit path (success, verify
+    // fail, scope fail, check fail, subprocess fail) by withFileLock's finally.
+    return withFileLock(baseBranchLockPath(root, runId), async () => {
+        // Rebase the node's branch onto the current remediation HEAD BEFORE verify, so a
+        // sibling that merged after this worktree was created is folded in. Verify, the
+        // write-scope gate, and the cherry-pick then all operate on the FINAL to-be-merged
+        // content (green-at-merge; the later cherry-pick can no longer conflict). A true
+        // hunk conflict here is a genuine seam — preserve the work and route to triage
+        // rather than land a broken merge.
+        const rebase = rebaseBranchOntoHead(root, wt, branch);
+        if (!rebase.ok) {
+            quarantineFailedNodeCommit(root, branch, runId, blockId);
+            removeWorktree(root, wt);
+            return { outcome: "error", verifyPassed, merged, diagnostic: rebase.error };
+        }
+        // Verify commands: when the host omits them (real rolling drivers), DERIVE them
+        // from the just-committed branch's touched test files — correct paths/runner by
+        // construction, only this node's own tests, never the whole suite. An explicit
+        // list (or `[]` to skip) overrides; both used by lifecycle unit tests. task_7d35176d:
+        // run the derive AND the node's own build-free `targeted_commands` (deduped) — the
+        // auditor's fix-specific regression checks the derive misses when a fix touches no
+        // test. `additionalVerifyCommands` is ignored on the explicit-override path.
+        const baseCommands = targetedCommands === undefined
+            ? deriveVerifyCommandsFromBranch(root, branch)
+            : targetedCommands;
+        const verifyCommands = targetedCommands === undefined
+            ? [...new Set([...baseCommands, ...buildFreeVerifyCommands(additionalVerifyCommands)])]
+            : baseCommands;
+        const verify = verifyCommands.length > 0
+            ? verifyNodeInWorktree(wt, verifyCommands)
+            : { passed: true, output: "" };
+        verifyPassed = verify.passed;
+        if (!verify.passed) {
+            // Verify failed: do not merge; drop the worktree so the main tree stays clean.
+            // The node DID commit real edits, so preserve them under a durable quarantine
+            // ref before the worktree/branch go away — a tool-verify false-negative must
+            // not destroy a good fix (the dogfood lost one this way). Carry the failing
+            // command + output so triage isn't blind on outcome:error.
+            quarantineFailedNodeCommit(root, branch, runId, blockId);
+            removeWorktree(root, wt);
+            return { outcome: "error", verifyPassed, merged, diagnostic: verify.output };
+        }
+        // Write-scope gate (OBL-DS-06), BEFORE the cherry-pick: an out-of-scope or
+        // seam-conflicting edit must never land in the main tree, so it is adjudicated
+        // against the branch's git diff (the ground truth) here rather than reported
+        // after `mergeWorktree` already merged it. The gate routes the node's ACTUAL
+        // out-of-declared edits (git diff, never a self-report): an edit to a file no
+        // sibling block owns widens the effective scope, while one owned by another
+        // block blocks as a seam conflict.
+        if (params.scope) {
+            const decision = enforceAcceptWriteScope({
+                root,
+                branch,
+                blockId,
+                allBlockScopes: params.scope.allBlockScopes,
+            });
+            if (decision.blocked) {
+                // Scope-blocked but the node committed real work — preserve it for recovery.
+                quarantineFailedNodeCommit(root, branch, runId, blockId);
+                removeWorktree(root, wt);
+                return { outcome: "error", verifyPassed, merged: false, diagnostic: decision.reason };
+            }
+        }
+        // Capture the base HEAD OID BEFORE the cherry-pick so a RED merged-base check can
+        // roll the base back to a bit-identical state.
+        const baseHeadBefore = spawnSync("git", ["rev-parse", "HEAD"], {
+            cwd: root,
+            encoding: "utf8",
+            shell: false,
         });
-        if (decision.blocked) {
-            // Scope-blocked but the node committed real work — preserve it for recovery.
+        if (baseHeadBefore.error || baseHeadBefore.status !== 0) {
             quarantineFailedNodeCommit(root, branch, runId, blockId);
             removeWorktree(root, wt);
-            return { outcome: "error", verifyPassed, merged: false, diagnostic: decision.reason };
+            return {
+                outcome: "error",
+                verifyPassed,
+                merged,
+                diagnostic: `could not capture base HEAD before merge: ${(baseHeadBefore.stderr ?? baseHeadBefore.error?.message ?? "").toString().trim()}`,
+            };
         }
-    }
-    // mergeWorktree cherry-picks the verified branch and removes the worktree (on
-    // success AND on conflict-abort), so no explicit cleanup is needed afterwards.
-    const mergeRes = mergeWorktree(root, wt, branch);
-    merged = mergeRes.success;
-    if (!mergeRes.success) {
-        // Cherry-pick conflict: the committed work would otherwise be orphaned — preserve it.
-        quarantineFailedNodeCommit(root, branch, runId, blockId);
-        return { outcome: "error", verifyPassed, merged, diagnostic: mergeRes.error };
-    }
-    // Landed successfully: clear any quarantine ref left by a prior failed attempt
-    // for this node so the recovery report lists only genuinely-unrecovered work.
-    clearQuarantinedCommit(root, runId, blockId);
-    return { outcome: "success", verifyPassed, merged };
+        const baseOid = baseHeadBefore.stdout.trim();
+        // mergeWorktree cherry-picks the verified branch and removes the worktree (on
+        // success AND on conflict-abort), so no explicit cleanup is needed afterwards.
+        const mergeRes = mergeWorktree(root, wt, branch);
+        merged = mergeRes.success;
+        if (!mergeRes.success) {
+            // Cherry-pick conflict: the committed work would otherwise be orphaned — preserve it.
+            quarantineFailedNodeCommit(root, branch, runId, blockId);
+            return { outcome: "error", verifyPassed, merged, diagnostic: mergeRes.error };
+        }
+        // Merged-base-green (INV-2): the cherry-pick landed in the MAIN checkout, where
+        // node_modules is faithful (the worktree's @audit-tools junction resolves to main
+        // and is unfaithful, so the per-node worktree verify cannot catch a cross-package
+        // break). Run the REAL cross-package check in the main tree. On RED, roll the base
+        // back to its captured OID bit-identically, scoped-clean the cherry-pick's emitted
+        // untracked files, quarantine, and fail — never leave a broken base for the sibling.
+        const checkCommand = params.mergedBaseCheckCommand === undefined ? "npm run check" : params.mergedBaseCheckCommand;
+        if (checkCommand !== null) {
+            // Paths the just-landed pick touched, so the scoped clean nukes only those
+            // (never unrelated untracked state). Resolved BEFORE the check runs.
+            const pickedFiles = gitEditedFilesForBranch(root, branch);
+            const check = runShellCommand(checkCommand, { cwd: root, encoding: "utf8" });
+            const checkFailed = !!check.error || check.status !== 0;
+            if (checkFailed) {
+                const detail = check.error
+                    ? check.error.message
+                    : [check.stdout ?? "", check.stderr ?? ""].filter(Boolean).join("\n");
+                // Roll the base back to its pre-pick OID, bit-identical.
+                spawnSync("git", ["reset", "--hard", baseOid], { cwd: root, shell: false });
+                // Scoped clean: remove only the cherry-pick / check-emitted untracked files
+                // under the paths the pick touched — never a blanket `git clean` that could
+                // nuke unrelated untracked state.
+                if (pickedFiles.available && pickedFiles.files.size > 0) {
+                    spawnSync("git", ["clean", "-fdq", "--", ...[...pickedFiles.files]], { cwd: root, shell: false });
+                }
+                quarantineFailedNodeCommit(root, branch, runId, blockId);
+                return {
+                    outcome: "error",
+                    verifyPassed,
+                    merged: false,
+                    diagnostic: `$ ${checkCommand}\n${detail}`,
+                };
+            }
+        }
+        // Landed successfully and the merged base is green: clear any quarantine ref left
+        // by a prior failed attempt for this node so the recovery report lists only
+        // genuinely-unrecovered work.
+        clearQuarantinedCommit(root, runId, blockId);
+        return { outcome: "success", verifyPassed, merged };
+    });
 }
 /**
  * Sidecar path for a node's tool-owned accept (verify/merge) outcome. Written by
@@ -912,7 +1125,7 @@ export async function executeNodeInWorktree(args) {
         // actually-touched tests inside acceptNodeWorktree (post-commit) — omit them so a
         // host-authored path can't mis-verify. The write-scope gate adjudicates the node's
         // ACTUAL git edits against every block's declared scope.
-        const accept = acceptNodeWorktree({
+        const accept = await acceptNodeWorktree({
             root,
             runId,
             blockId: block.block_id,
@@ -921,6 +1134,8 @@ export async function executeNodeInWorktree(args) {
             workerOutcome: result.outcome,
             additionalVerifyCommands,
             scope: { allBlockScopes },
+            // The block's OWN declared write paths (INV-1 new-file inclusion).
+            writePaths: allBlockScopes.find((b) => b.block_id === block.block_id)?.write_paths ?? [],
         });
         await recordNodeAcceptOutcome(artifactsDir, runId, block.block_id, accept);
         return { result, accept };