audit-tools 0.30.3 → 0.30.4

package/dist/shared/contentKey.js

@@ -0,0 +1,163 @@
+/**
+ * The shared content-key seam (O2 ↔ F1) — the SOLE definition of the workflow's
+ * derived keys (INV-CK-1). O2's append-only results ledger (re-association +
+ * append-time idempotency) and F1's element-staleness gate both import their keys
+ * from HERE, so the two cannot drift.
+ *
+ * THREE derived keys, one canonical-input derivation chain (OBL-content-key-seam-contract):
+ *
+ *  - `identityKey` (INV-CK-3 / INV-CK-4): sha256 over the canonical
+ *    {unit_id, lens, pass_id} tuple. EXCLUDES task_id and every volatile/provenance
+ *    field (INV-CK-3). It is a ONE-TO-MANY GROUPING key (INV-CK-4 / CE-001) used to
+ *    re-associate ledger records — NEVER a primary key. `{unit_id, lens, pass_id}` is
+ *    not unique within a pass (base vs. deepening/steward, or an O3 re-dispatch), so
+ *    multiple distinct results legitimately share one identityKey.
+ *
+ *  - `idempotencyKey` (INV-CK-7, signature-STABLE): sha256 over
+ *    {identity_key, result_content_discriminator}. It is the anchor O2 ingests on:
+ *    a replay of the *same* logical result is a no-op (CE-001b / fail-4), because a
+ *    benign edit to the task content (which only moves the task_content_signature)
+ *    does NOT move the idempotencyKey. Two genuinely-different same-coordinate
+ *    results carry distinct discriminators → distinct idempotencyKeys → both persist
+ *    (CE-001). This is signature-STABLE by construction: task_content_signature is
+ *    not one of its inputs.
+ *
+ *  - `contentKey` (INV-CK-5, signature-SENSITIVE): sha256 over
+ *    {idempotency_key, task_content_signature}. It BUMPS when the idempotencyKey OR
+ *    the task_content_signature changes, so it is the correct driver for staleness:
+ *    a benign content edit (idempotencyKey fixed, signature C1→C2) bumps ONLY the
+ *    contentKey (fail-4), letting idempotent re-ingest stay a no-op while staleness
+ *    still fires.
+ *
+ *  - `newInstanceId`: a per-record unique id (INV-CK / CE-001). The ledger is keyed
+ *    by this — every appended record is distinct — so identityKey/idempotencyKey are
+ *    grouping/idempotency keys, never primary keys (fail-2). This is the ONLY
+ *    non-pure helper here (it mints randomness); the three key derivations above are
+ *    pure and deterministic (INV-CK-2).
+ *
+ * Tool-owned inputs (never caller discretion):
+ *  - `buildTaskContentSignature` (FC-002 / fail-1): the signature recipe lives HERE.
+ *    Derived ONLY from task-defining content; `task_id` and timestamp/provenance
+ *    fields are STRIPPED — a caller-built signature is a false-fresh latent bug.
+ *  - `buildResultContentDiscriminator` (C-002 / fail-3): the discriminator recipe
+ *    lives HERE too, keyed off the emit-source enum (base | deepening | steward |
+ *    redispatch). Because the discriminator feeds the signature-STABLE
+ *    idempotencyKey, a caller-chosen discriminator is a correctness hazard (a wrongly
+ *    identical one collapses two distinct results; a wrongly distinct one on a replay
+ *    mints a duplicate). The recipe is owned, never operator-chosen.
+ *
+ * Relating invariant (INV-CK-6, OBL-content-key-seam-inv-7/inv-8):
+ *   equal contentKey ⟹ equal idempotencyKey ⟹ equal identityKey
+ * (NOT the converses), and `idempotencyKey` is invariant under a change to
+ * `task_content_signature` alone. The chain holds because each key nests the prior
+ * one as a signed input: contentKey signs idempotency_key, which signs identity_key.
+ * One canonical input thus yields all three keys with this documented relation —
+ * re-association stability (idempotencyKey) and staleness-on-change (contentKey) are
+ * reconciled, not in tension.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { stableStringify } from "./stableStringify.js";
+import { normalizeForMetadataHash } from "../audit/orchestrator/artifactFreshness.js";
+function sha256(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+// Provenance / non-content fields stripped before signing. Renumbering a task,
+// or restamping it, must not change the task-content signature (FC-002). The
+// artifact name routes through the shared normalizeForMetadataHash so the same
+// non-semantic-stripping discipline is reused (INV-CK-2), never re-implemented.
+const TASK_SIGNATURE_ARTIFACT = 'task_content_signature';
+const NON_CONTENT_SIGNATURE_FIELDS = new Set([
+    'task_id',
+    'generated_at',
+    'created_at',
+    'updated_at',
+    'timestamp',
+    'provenance',
+]);
+/**
+ * TOOL-OWNED task-content signature (FC-002 / fail-1). Derives a stable signature
+ * from the task-defining content ONLY — `task_id` and timestamp/provenance fields
+ * are stripped, then the remaining fields are run through the shared
+ * `normalizeForMetadataHash` + canonical `stableStringify` (the single serializer,
+ * INV-CK-2), so reordered keys produce an identical signature.
+ */
+export function buildTaskContentSignature(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new Error('buildTaskContentSignature: input must be a plain object of task-defining content');
+    }
+    const content = Object.fromEntries(Object.entries(input).filter(([key]) => !NON_CONTENT_SIGNATURE_FIELDS.has(key)));
+    return sha256(stableStringify(normalizeForMetadataHash(TASK_SIGNATURE_ARTIFACT, content)));
+}
+/**
+ * TOOL-OWNED result-content discriminator (C-002 / fail-3). The discriminator
+ * string is derived from the emit-source enum (plus the attempt counter for a
+ * re-dispatch), never chosen by a caller — because it feeds the signature-STABLE
+ * idempotencyKey, an operator-chosen value would be a correctness hazard.
+ */
+export function buildResultContentDiscriminator(input) {
+    const source = input?.source;
+    if (source === 'base' || source === 'deepening' || source === 'steward') {
+        return source;
+    }
+    if (source === 'redispatch') {
+        const attempt = input.attempt;
+        if (!Number.isInteger(attempt) || attempt < 1) {
+            // Without a distinct attempt counter two re-dispatches would collide
+            // (fail-3) — refuse rather than mint a colliding discriminator.
+            throw new Error("buildResultContentDiscriminator: source 'redispatch' requires an integer attempt >= 1");
+        }
+        return `redispatch-attempt-${attempt}`;
+    }
+    throw new Error(`buildResultContentDiscriminator: unknown emit source ${JSON.stringify(source)}`);
+}
+function requireField(value, name) {
+    if (typeof value !== 'string' || value.length === 0) {
+        // No silent colliding key (fail-3): a missing component would otherwise hash
+        // to the same key for distinct coordinates.
+        throw new Error(`contentKey: ${name} is required and must be a non-empty string`);
+    }
+    return value;
+}
+/**
+ * sha256 over the canonical {unit_id, lens, pass_id} tuple (INV-CK-3). EXCLUDES
+ * task_id and all volatile fields. ONE-TO-MANY grouping key (INV-CK-4) — never a
+ * primary key. Throws if any component is missing (fail-3).
+ */
+export function identityKey(input) {
+    const unit_id = requireField(input?.unit_id, 'unit_id');
+    const lens = requireField(input?.lens, 'lens');
+    const pass_id = requireField(input?.pass_id, 'pass_id');
+    return sha256(stableStringify({ unit_id, lens, pass_id }));
+}
+/**
+ * sha256 over {identity_key, result_content_discriminator} (INV-CK-7). SIGNATURE-
+ * STABLE: the task_content_signature is deliberately NOT an input, so a benign
+ * content edit does not move it (fail-4). This is the key O2 ingests on. equal
+ * idempotencyKey ⟹ equal identityKey, since identity_key is a signed input.
+ */
+export function idempotencyKey(input) {
+    const identity_key = identityKey(input);
+    const result_content_discriminator = requireField(input?.result_content_discriminator, 'result_content_discriminator');
+    return sha256(stableStringify({ identity_key, result_content_discriminator }));
+}
+/**
+ * sha256 over {idempotency_key, task_content_signature} (INV-CK-5). SIGNATURE-
+ * SENSITIVE: bumps when the idempotencyKey OR the task_content_signature changes,
+ * so it drives staleness (CE-001 / inv-5). equal contentKey ⟹ equal idempotencyKey
+ * ⟹ equal identityKey, since each is a signed input of the next.
+ */
+export function contentKey(input) {
+    const idempotency_key = idempotencyKey(input);
+    const task_content_signature = requireField(input?.task_content_signature, 'task_content_signature');
+    return sha256(stableStringify({ idempotency_key, task_content_signature }));
+}
+/**
+ * Mint a fresh per-record instance id (CE-001 / fail-2). The ledger keys on this,
+ * so every appended record is distinct and identityKey/idempotencyKey are never
+ * primary keys. This is the ONLY non-deterministic helper in the seam — the three
+ * key derivations above are pure.
+ */
+export function newInstanceId() {
+    return randomUUID();
+}
+//# sourceMappingURL=contentKey.js.map

package/dist/shared/contentKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contentKey.js","sourceRoot":"","sources":["../../src/shared/contentKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAgDtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AACzD,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IAChE,SAAS;IACT,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1B,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,CAClD,CACF,CAAC;IACF,OAAO,MAAM,CACX,eAAe,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAsC;IAEtC,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAK,OAAkB,GAAG,CAAC,EAAE,CAAC;YAC1D,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,6EAA6E;QAC7E,4CAA4C;QAC5C,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,6CAA6C,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,4BAA4B,GAAG,YAAY,CAC/C,KAAK,EAAE,4BAA4B,EACnC,8BAA8B,CAC/B,CAAC;IACF,OAAO,MAAM,CACX,eAAe,CAAC,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAChE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,sBAAsB,GAAG,YAAY,CACzC,KAAK,EAAE,sBAAsB,EAC7B,wBAAwB,CACzB,CAAC;IACF,OAAO,MAAM,CACX,eAAe,CAAC,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/shared/friction/captureFrictionEvent.d.ts

@@ -0,0 +1,50 @@
+import { type FrictionCaptureArtifact, type FrictionItem } from '../io/frictionCapture.js';
+/**
+ * The single mechanical-friction sink (FC-005). Mechanical seams (O3
+ * validation/coercion/repair warnings; O2 recovery / ingest-merge-retry) call
+ * `captureFrictionEvent(artifactsDir, runId, event)` with a stable distinct
+ * event id; the call accretes the event onto the per-run friction record that
+ * `src/shared/io/frictionCapture.ts` owns.
+ *
+ * This module is landed FIRST, before O1's full triage UI, as a callable,
+ * inert-no-op-safe API so O2/O3 can wire it at their seams immediately.
+ *
+ * Guaranteed properties (INV-O1-5 / INV-O1-6 / INV-O1-7, FC-005):
+ *  - BEST-EFFORT / NON-FATAL: every read/write is swallowed. A failed or
+ *    contended capture write NEVER throws into the in-flight obligation — the
+ *    sink resolves regardless. A caller may `await` it or fire-and-forget.
+ *  - NO-OP-SAFE: callable before any triage UI exists; with nothing wired it is
+ *    a pure append to an otherwise-unread per-run record, and a missing/locked
+ *    artifacts dir simply degrades to a swallowed write.
+ *  - IDEMPOTENT / PER-EVENT DE-DUP: an event whose `id` already appears in the
+ *    run record is dropped, so re-entrant passes (re-dispatch, retry) never
+ *    double-record the same logical event (INV-O1-6, FAIL-O1-5).
+ *  - OS/PATH-AGNOSTIC: the record path comes only from the substrate's
+ *    `frictionCapturePath` (node:path joins off `artifactsDir` + `sanitizeRunId`);
+ *    no platform-baked literal, never coupled to any repo doc (INV-O1-7).
+ *
+ * This is the substrate-wrapping sink only: live triage dispositions over the
+ * accreted events are owned by O1's triage module, the locked append ordering by
+ * O2 — this layer just appends one de-duped event, best-effort.
+ */
+/** A single mechanical friction event recorded through the sink. */
+export interface FrictionEvent extends FrictionItem {
+    /**
+     * Stable distinct id for this logical event. Re-recording an event with an id
+     * already present in the run record is a no-op (per-event de-dup, INV-O1-6).
+     */
+    id: string;
+}
+/** A friction record item carrying its mechanical-event de-dup id. */
+export interface CapturedFrictionItem extends FrictionItem {
+    id: string;
+}
+/**
+ * Append one mechanical friction event to the per-run record, best-effort.
+ *
+ * Never throws: any failure (missing/locked dir, malformed existing record,
+ * write contention) is swallowed so the calling obligation is never broken
+ * (INV-O1-5, FAIL-O1-3). De-duped on `event.id` (INV-O1-6, FAIL-O1-5).
+ */
+export declare function captureFrictionEvent(artifactsDir: string, runId: string, event: FrictionEvent, tool?: FrictionCaptureArtifact['tool']): Promise<void>;
+//# sourceMappingURL=captureFrictionEvent.d.ts.map

package/dist/shared/friction/captureFrictionEvent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"captureFrictionEvent.d.ts","sourceRoot":"","sources":["../../../src/shared/friction/captureFrictionEvent.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,YAAY,EAIlB,MAAM,0BAA0B,CAAC;AAGlC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,oEAAoE;AACpE,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACxD,EAAE,EAAE,MAAM,CAAC;CACZ;AAOD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,aAAa,EACpB,IAAI,GAAE,uBAAuB,CAAC,MAAM,CAAoB,GACvD,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/dist/shared/friction/captureFrictionEvent.js

@@ -0,0 +1,34 @@
+import { FRICTION_CAPTURE_SCHEMA_VERSION, frictionCapturePath, sanitizeRunId, } from '../io/frictionCapture.js';
+import { readOptionalJsonFile, writeJsonFile } from '../io/json.js';
+/**
+ * Append one mechanical friction event to the per-run record, best-effort.
+ *
+ * Never throws: any failure (missing/locked dir, malformed existing record,
+ * write contention) is swallowed so the calling obligation is never broken
+ * (INV-O1-5, FAIL-O1-3). De-duped on `event.id` (INV-O1-6, FAIL-O1-5).
+ */
+export async function captureFrictionEvent(artifactsDir, runId, event, tool = 'remediate-code') {
+    try {
+        const path = frictionCapturePath(artifactsDir, sanitizeRunId(runId));
+        const existing = await readOptionalJsonFile(path);
+        const frictions = Array.isArray(existing?.frictions)
+            ? existing.frictions
+            : [];
+        // Per-event de-dup: drop an event whose id is already recorded.
+        if (frictions.some((item) => item.id === event.id)) {
+            return;
+        }
+        const artifact = {
+            schema_version: FRICTION_CAPTURE_SCHEMA_VERSION,
+            tool: existing?.tool ?? tool,
+            run_id: runId,
+            captured_at: new Date().toISOString(),
+            frictions: [...frictions, { ...event }],
+        };
+        await writeJsonFile(path, artifact);
+    }
+    catch {
+        // Best-effort: swallow every failure so capture never breaks the obligation.
+    }
+}
+//# sourceMappingURL=captureFrictionEvent.js.map

package/dist/shared/friction/captureFrictionEvent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"captureFrictionEvent.js","sourceRoot":"","sources":["../../../src/shared/friction/captureFrictionEvent.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,+BAA+B,EAC/B,mBAAmB,EACnB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAkDpE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,KAAa,EACb,KAAoB,EACpB,OAAwC,gBAAgB;IAExD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAA2B,IAAI,CAAC,CAAC;QAE5E,MAAM,SAAS,GAA2B,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC1E,CAAC,CAAC,QAAS,CAAC,SAAS;YACrB,CAAC,CAAC,EAAE,CAAC;QAEP,gEAAgE;QAChE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAA6B;YACzC,cAAc,EAAE,+BAA+B;YAC/C,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI;YAC5B,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC;SACxC,CAAC;QAEF,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;AACH,CAAC"}

package/dist/shared/friction/triage.d.ts

@@ -0,0 +1,126 @@
+import { type FrictionCaptureArtifact } from '../io/frictionCapture.js';
+import { type AgentReflection } from '../agentReflections.js';
+import type { CapturedFrictionItem } from './captureFrictionEvent.js';
+/**
+ * O1 end-of-run friction TRIAGE — single-sourced for BOTH orchestrators so the
+ * triage step shape, the disposition vocabulary, the blocking semantics, and the
+ * close-out deciders cannot drift between the two halves of the pipeline. This is
+ * the analog (and now the single source) of the former per-orchestrator
+ * `decideAuditFrictionCloseout` / `decideRemediateFrictionCloseout` deciders,
+ * collapsed here as one parameterized decider.
+ *
+ * What the triage gates:
+ *  - The MECHANICAL friction events the O3/O2 seams accreted through the sink
+ *    (`captureFrictionEvent` → the per-run `friction/<run_id>.json` record).
+ *  - The OPT-IN agent-feedback reflections workers appended to
+ *    `agent-feedback.jsonl` during the run.
+ *
+ * The satisfaction predicate set is the UNION of those two sources. The triage is
+ * a MANDATORY, BLOCKING end-of-run step: it stays unsatisfied until every captured
+ * event AND every surfaced reflection carries a recorded disposition. This is
+ * DISTINCT from the optional, untouched mid-run worker reflection channel — a
+ * worker MAY append a reflection line, but the blocking triage is the host's
+ * end-of-run obligation to dispose of what was captured.
+ *
+ * False-green is dropped: an empty up-front zero-friction record NO LONGER
+ * satisfies the close-out. Satisfaction requires either:
+ *  - EMPTY SET: zero events AND zero reflections → trivially disposed (the
+ *    close-out fires once, persists a disposed record, and never re-loops); or
+ *  - DISPOSED: every event id and every reflection key has a `keep|discard|
+ *    annotate` disposition recorded against it.
+ *
+ * Friction appends ride O2's `withFileLock` (keyed off the friction record path)
+ * so a friction append never races the locked critical section.
+ */
+/** The triage disposition vocabulary — the host's verdict per captured item. */
+export type FrictionDisposition = 'keep' | 'discard' | 'annotate';
+/** The set of valid dispositions, for validation at the contract boundary. */
+export declare const FRICTION_DISPOSITIONS: readonly FrictionDisposition[];
+/** Whether a value is a valid disposition (mechanical contract check). */
+export declare function isFrictionDisposition(value: unknown): value is FrictionDisposition;
+/**
+ * One triage record: a host disposition against a captured item key. `target_id`
+ * is the friction-event id (mechanical sink) or the reflection key (a stable key
+ * derived from a surfaced agent-feedback reflection). `annotation` is required
+ * only for the `annotate` disposition.
+ */
+export interface FrictionDispositionRecord {
+    target_id: string;
+    disposition: FrictionDisposition;
+    annotation?: string;
+}
+/** A captured item the host must dispose of, normalized across both sources. */
+export interface TriageSubject {
+    /** Stable key the disposition is recorded against. */
+    id: string;
+    /** Which source surfaced it — a mechanical event or an agent reflection. */
+    source: 'event' | 'reflection';
+    /** Human-readable summary for the triage prompt. */
+    note: string;
+}
+/**
+ * The mandatory blocking triage decision. `pending` means the close-out is NOT
+ * satisfied — the host must record a disposition for every subject in `pending`
+ * before the run can present complete. `action`:
+ *  - "dispose"  → there are pending subjects; the run is BLOCKED on triage.
+ *  - "disposed" → nothing pending (empty set, or all subjects disposed); the
+ *    close-out is satisfied and the run proceeds. Fires at most once.
+ */
+export interface FrictionTriageDecision {
+    action: 'dispose' | 'disposed';
+    /** Subjects still awaiting a disposition (empty when `disposed`). */
+    pending: TriageSubject[];
+    /** The run_id-keyed friction record path (always set, for the handoff). */
+    recordPath: string;
+}
+/** A stable key for a surfaced reflection (task_id + ordinal within the run). */
+export declare function reflectionKey(reflection: AgentReflection, ordinal: number): string;
+/**
+ * The per-run friction record the triage reads/writes. Extends the captured
+ * artifact (mechanical events) with the host's `dispositions[]` — the tool owns
+ * every field except the host-recorded disposition content.
+ */
+export interface TriagedFrictionArtifact extends Omit<FrictionCaptureArtifact, 'frictions'> {
+    frictions: CapturedFrictionItem[];
+    dispositions?: FrictionDispositionRecord[];
+}
+/** Where the friction append/triage lock lives (rides O2's withFileLock). */
+export declare function frictionLockPath(artifactsDir: string, runId: string): string;
+/**
+ * Build the union triage-subject set for a run: every captured mechanical event
+ * UNION every surfaced agent-feedback reflection. Deterministic — pure read off
+ * the on-disk record + the reflections file, never host discretion.
+ */
+export declare function collectTriageSubjects(artifactsDir: string, runId: string): Promise<TriageSubject[]>;
+/**
+ * The MANDATORY BLOCKING end-of-run triage close-out, single-sourced for both
+ * orchestrators (caller passes its `tool`). Drops the former false-green: an
+ * empty up-front record never satisfies — satisfaction is decided off the union
+ * subject set vs. the recorded dispositions:
+ *
+ *  - empty set (zero events AND zero reflections) → "disposed" trivially, and a
+ *    disposed record is persisted once so it never re-loops;
+ *  - every subject disposed → "disposed";
+ *  - any subject undisposed → "dispose" (the run is BLOCKED) with the pending
+ *    subjects surfaced for the host to dispose of.
+ *
+ * Deterministic — keyed only off the on-disk record + reflections at
+ * `(artifactsDir, runId)`. Never coupled to any repo's backlog doc. The persist
+ * on the trivial-empty path rides O2's `withFileLock` so it cannot race a
+ * concurrent friction append into the same record.
+ */
+export declare function decideFrictionTriage(artifactsDir: string, runId: string, tool: FrictionCaptureArtifact['tool']): Promise<FrictionTriageDecision>;
+/**
+ * Mutate the per-run friction record under O2's `withFileLock` so a friction
+ * append (mechanical event OR host disposition) never races the locked critical
+ * section. The mutator receives the current record (a fresh degrade-clean shell
+ * when none exists) and returns the next record to persist atomically.
+ */
+export declare function appendFrictionUnderLock(artifactsDir: string, runId: string, mutate: (record: TriagedFrictionArtifact) => Promise<TriagedFrictionArtifact> | TriagedFrictionArtifact, tool?: FrictionCaptureArtifact['tool']): Promise<TriagedFrictionArtifact>;
+/**
+ * Record one host disposition against a captured subject, under the shared lock.
+ * Re-disposing the same `target_id` overwrites the prior verdict (idempotent on
+ * the key). The `annotate` disposition carries the host annotation.
+ */
+export declare function recordFrictionDisposition(artifactsDir: string, runId: string, disposition: FrictionDispositionRecord, tool?: FrictionCaptureArtifact['tool']): Promise<TriagedFrictionArtifact>;
+//# sourceMappingURL=triage.d.ts.map

package/dist/shared/friction/triage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.d.ts","sourceRoot":"","sources":["../../../src/shared/friction/triage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uBAAuB,EAI7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,EAAE,SAAS,mBAAmB,EAI/D,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAKlF;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,mBAAmB,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,MAAM,EAAE,OAAO,GAAG,YAAY,CAAC;IAC/B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,qEAAqE;IACrE,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAkBD;;;;GAIG;AACH,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC;IAClD,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,yBAAyB,EAAE,CAAC;CAC5C;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5E;AAkBD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,EAAE,CAAC,CAkB1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAiCjC;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,OAAO,CAAC,uBAAuB,CAAC,GAAG,uBAAuB,EACvG,IAAI,GAAE,uBAAuB,CAAC,MAAM,CAAoB,GACvD,OAAO,CAAC,uBAAuB,CAAC,CAoBlC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,yBAAyB,EACtC,IAAI,GAAE,uBAAuB,CAAC,MAAM,CAAoB,GACvD,OAAO,CAAC,uBAAuB,CAAC,CAalC"}

package/dist/shared/friction/triage.js

@@ -0,0 +1,149 @@
+import { FRICTION_CAPTURE_SCHEMA_VERSION, frictionCapturePath, sanitizeRunId, } from '../io/frictionCapture.js';
+import { AGENT_FEEDBACK_FILENAME, parseReflectionsNdjson, } from '../agentReflections.js';
+import { readOptionalJsonFile, readOptionalTextFile, writeJsonFile } from '../io/json.js';
+import { withFileLock } from '../quota/fileLock.js';
+/** The set of valid dispositions, for validation at the contract boundary. */
+export const FRICTION_DISPOSITIONS = [
+    'keep',
+    'discard',
+    'annotate',
+];
+/** Whether a value is a valid disposition (mechanical contract check). */
+export function isFrictionDisposition(value) {
+    return (typeof value === 'string' &&
+        FRICTION_DISPOSITIONS.includes(value));
+}
+/** A stable key for a surfaced reflection (task_id + ordinal within the run). */
+export function reflectionKey(reflection, ordinal) {
+    return `reflection:${reflection.task_id}:${ordinal}`;
+}
+function summarizeReflection(reflection) {
+    const parts = [`[${reflection.severity}] ${reflection.task_id}`];
+    const detail = [
+        ...(reflection.ambiguities ?? []),
+        ...(reflection.tool_friction ?? []),
+        ...(reflection.suggestions ?? []),
+    ].filter((item) => item.trim().length > 0);
+    if (detail.length > 0)
+        parts.push(detail.join('; '));
+    return parts.join(' — ');
+}
+function summarizeEvent(item) {
+    const sev = item.severity ? `[${item.severity}] ` : '';
+    return `${sev}${item.note}`;
+}
+/** Where the friction append/triage lock lives (rides O2's withFileLock). */
+export function frictionLockPath(artifactsDir, runId) {
+    return `${frictionCapturePath(artifactsDir, sanitizeRunId(runId))}.lock`;
+}
+async function readReflections(artifactsDir) {
+    const text = await readOptionalTextFile(`${artifactsDir}/${AGENT_FEEDBACK_FILENAME}`);
+    return text ? parseReflectionsNdjson(text) : [];
+}
+async function readRecord(artifactsDir, runId) {
+    return readOptionalJsonFile(frictionCapturePath(artifactsDir, sanitizeRunId(runId)));
+}
+/**
+ * Build the union triage-subject set for a run: every captured mechanical event
+ * UNION every surfaced agent-feedback reflection. Deterministic — pure read off
+ * the on-disk record + the reflections file, never host discretion.
+ */
+export async function collectTriageSubjects(artifactsDir, runId) {
+    const [record, reflections] = await Promise.all([
+        readRecord(artifactsDir, runId),
+        readReflections(artifactsDir),
+    ]);
+    const subjects = [];
+    for (const item of record?.frictions ?? []) {
+        subjects.push({ id: item.id, source: 'event', note: summarizeEvent(item) });
+    }
+    reflections.forEach((reflection, index) => {
+        subjects.push({
+            id: reflectionKey(reflection, index),
+            source: 'reflection',
+            note: summarizeReflection(reflection),
+        });
+    });
+    return subjects;
+}
+/**
+ * The MANDATORY BLOCKING end-of-run triage close-out, single-sourced for both
+ * orchestrators (caller passes its `tool`). Drops the former false-green: an
+ * empty up-front record never satisfies — satisfaction is decided off the union
+ * subject set vs. the recorded dispositions:
+ *
+ *  - empty set (zero events AND zero reflections) → "disposed" trivially, and a
+ *    disposed record is persisted once so it never re-loops;
+ *  - every subject disposed → "disposed";
+ *  - any subject undisposed → "dispose" (the run is BLOCKED) with the pending
+ *    subjects surfaced for the host to dispose of.
+ *
+ * Deterministic — keyed only off the on-disk record + reflections at
+ * `(artifactsDir, runId)`. Never coupled to any repo's backlog doc. The persist
+ * on the trivial-empty path rides O2's `withFileLock` so it cannot race a
+ * concurrent friction append into the same record.
+ */
+export async function decideFrictionTriage(artifactsDir, runId, tool) {
+    const recordPath = frictionCapturePath(artifactsDir, sanitizeRunId(runId));
+    const subjects = await collectTriageSubjects(artifactsDir, runId);
+    if (subjects.length === 0) {
+        // Empty set: trivially disposed. Persist a disposed record once (under the
+        // shared lock) so the close-out fires at most once and never re-loops.
+        await appendFrictionUnderLock(artifactsDir, runId, (record) => ({
+            ...record,
+            tool: record.tool ?? tool,
+            dispositions: record.dispositions ?? [],
+        }), tool);
+        return { action: 'disposed', pending: [], recordPath };
+    }
+    const record = await readRecord(artifactsDir, runId);
+    const disposed = new Set((record?.dispositions ?? [])
+        .filter((d) => isFrictionDisposition(d.disposition))
+        .map((d) => d.target_id));
+    const pending = subjects.filter((subject) => !disposed.has(subject.id));
+    return {
+        action: pending.length === 0 ? 'disposed' : 'dispose',
+        pending,
+        recordPath,
+    };
+}
+/**
+ * Mutate the per-run friction record under O2's `withFileLock` so a friction
+ * append (mechanical event OR host disposition) never races the locked critical
+ * section. The mutator receives the current record (a fresh degrade-clean shell
+ * when none exists) and returns the next record to persist atomically.
+ */
+export async function appendFrictionUnderLock(artifactsDir, runId, mutate, tool = 'remediate-code') {
+    const recordPath = frictionCapturePath(artifactsDir, sanitizeRunId(runId));
+    return withFileLock(frictionLockPath(artifactsDir, runId), async () => {
+        const existing = await readOptionalJsonFile(recordPath);
+        const base = existing ?? {
+            schema_version: FRICTION_CAPTURE_SCHEMA_VERSION,
+            tool,
+            run_id: runId,
+            captured_at: new Date().toISOString(),
+            frictions: [],
+            dispositions: [],
+        };
+        const next = await mutate(base);
+        const persisted = {
+            ...next,
+            captured_at: new Date().toISOString(),
+        };
+        await writeJsonFile(recordPath, persisted);
+        return persisted;
+    });
+}
+/**
+ * Record one host disposition against a captured subject, under the shared lock.
+ * Re-disposing the same `target_id` overwrites the prior verdict (idempotent on
+ * the key). The `annotate` disposition carries the host annotation.
+ */
+export async function recordFrictionDisposition(artifactsDir, runId, disposition, tool = 'remediate-code') {
+    return appendFrictionUnderLock(artifactsDir, runId, (record) => {
+        const dispositions = (record.dispositions ?? []).filter((d) => d.target_id !== disposition.target_id);
+        dispositions.push(disposition);
+        return { ...record, dispositions };
+    }, tool);
+}
+//# sourceMappingURL=triage.js.map

package/dist/shared/friction/triage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.js","sourceRoot":"","sources":["../../../src/shared/friction/triage.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,+BAA+B,EAC/B,mBAAmB,EACnB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAsCpD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAmC;IACnE,MAAM;IACN,SAAS;IACT,UAAU;CACX,CAAC;AAEF,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7D,CAAC;AACJ,CAAC;AAwCD,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,UAA2B,EAAE,OAAe;IACxE,OAAO,cAAc,UAAU,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAA2B;IACtD,MAAM,KAAK,GAAa,CAAC,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;KAClC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,IAA0B;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAaD,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,KAAa;IAClE,OAAO,GAAG,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,YAAoB;IACjD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACrC,GAAG,YAAY,IAAI,uBAAuB,EAAE,CAC7C,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,YAAoB,EACpB,KAAa;IAEb,OAAO,oBAAoB,CACzB,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,KAAa;IAEb,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC;QAC/B,eAAe,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC;YACpC,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,mBAAmB,CAAC,UAAU,CAAC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,KAAa,EACb,IAAqC;IAErC,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAElE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,uBAAuB,CAC3B,YAAY,EACZ,KAAK,EACL,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SACxC,CAAC,EACF,IAAI,CACL,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3B,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAExE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACrD,OAAO;QACP,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,KAAa,EACb,MAAuG,EACvG,OAAwC,gBAAgB;IAExD,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,OAAO,YAAY,CAAC,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAA0B,UAAU,CAAC,CAAC;QACjF,MAAM,IAAI,GAA4B,QAAQ,IAAI;YAChD,cAAc,EAAE,+BAA+B;YAC/C,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,SAAS,EAAE,EAAE;YACb,YAAY,EAAE,EAAE;SACjB,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,SAAS,GAA4B;YACzC,GAAG,IAAI;YACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QACF,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,YAAoB,EACpB,KAAa,EACb,WAAsC,EACtC,OAAwC,gBAAgB;IAExD,OAAO,uBAAuB,CAC5B,YAAY,EACZ,KAAK,EACL,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS,CAC7C,CAAC;QACF,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC,EACD,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/shared/index.d.ts

@@ -46,6 +46,9 @@ export type { FindingIdentityFields } from "./findingIdentitySignature.js";
 export { normalizeAnchorPath, normalizeTitle, findingIdentitySignature, findingIdentityFields, findingIdentityKey, } from "./findingIdentitySignature.js";
 export type { HashContentOptions } from "./hash.js";
 export { hashContent } from "./hash.js";
+export { stableStringify } from "./stableStringify.js";
+export type { IdentityKeyInput, TaskContentSignatureInput, ResultEmitSource, ResultContentDiscriminatorInput, IdempotencyKeyInput, ContentKeyInput, } from "./contentKey.js";
+export { buildTaskContentSignature, buildResultContentDiscriminator, identityKey, idempotencyKey, contentKey, newInstanceId, } from "./contentKey.js";
 export type { ProjectionDiffEntry, ReReviewSectionInput, } from "./reReview/projectionDiff.js";
 export { stableStringifyProjection, diffProjections, renderDiffReReviewSection, } from "./reReview/projectionDiff.js";
 export type { RunTrackedOptions, RunTrackedResult } from "./tooling/exec.js";
@@ -60,9 +63,15 @@ export { isGitRepo, gitRefExists, changedFiles, fileCommits, stagedAndUntracked,
 export type { RunLogEvent, RunLoggerOptions } from "./observability/runLog.js";
 export { RunLogger } from "./observability/runLog.js";
 export { isFileMissingError, isTransientFsError, withFsRetry, readJsonFile, writeJsonFile, readJsonStringScalar, readJsonStringScalarChunks, appendNdjsonFile, readNdjsonFile, readOptionalJsonFile, readOptionalNdjsonFile, writeNdjsonFile, readOptionalTextFile, writeTextFile, } from "./io/json.js";
-export { auditToolsDir, auditArtifactsDir, remediationArtifactsDir, stepsDir, incomingDir, outputDirFor, auditReportPath, auditFindingsPath, promotedAuditReportPath, promotedAuditFindingsPath, AUDIT_REPORT_FILENAME, AUDIT_FINDINGS_FILENAME, REMEDIATION_REPORT_FILENAME, REMEDIATION_OUTCOMES_FILENAME, } from "./io/auditToolsPaths.js";
+export { auditToolsDir, auditArtifactsDir, remediationArtifactsDir, stepsDir, artifactTreeLockPath, incomingDir, outputDirFor, auditReportPath, auditFindingsPath, promotedAuditReportPath, promotedAuditFindingsPath, AUDIT_REPORT_FILENAME, AUDIT_FINDINGS_FILENAME, REMEDIATION_REPORT_FILENAME, REMEDIATION_OUTCOMES_FILENAME, } from "./io/auditToolsPaths.js";
 export type { FrictionItem, FrictionCaptureArtifact, } from "./io/frictionCapture.js";
-export { FRICTION_CAPTURE_SCHEMA_VERSION, FRICTION_CAPTURE_DIRNAME, frictionCaptureDir, frictionCapturePath, frictionCaptured, persistFrictionCapture, } from "./io/frictionCapture.js";
+export { FRICTION_CAPTURE_SCHEMA_VERSION, FRICTION_CAPTURE_DIRNAME, frictionCaptureDir, frictionCapturePath, frictionCaptured, persistFrictionCapture, sanitizeRunId, } from "./io/frictionCapture.js";
+export type { FrictionEvent, CapturedFrictionItem, } from "./friction/captureFrictionEvent.js";
+export { captureFrictionEvent } from "./friction/captureFrictionEvent.js";
+export type { FrictionDisposition, FrictionDispositionRecord, TriageSubject, FrictionTriageDecision, TriagedFrictionArtifact, } from "./friction/triage.js";
+export { FRICTION_DISPOSITIONS, isFrictionDisposition, reflectionKey, frictionLockPath, collectTriageSubjects, decideFrictionTriage, appendFrictionUnderLock, recordFrictionDisposition, } from "./friction/triage.js";
+export type { RepairValidationError, RepairValidationResult, RepairCoercion, RepairCoercionResult, RepairPatcher, RepairContract, RepairStatus, RepairStage, RepairRedispatch, RepairOutcome, RunEmitValidateRepairOptions, } from "./repair/index.js";
+export { runEmitValidateRepair } from "./repair/index.js";
 export type { RepoVisibility } from "./io/gitignoreArtifacts.js";
 export { ALWAYS_IGNORE_PATTERNS, VISIBILITY_CONDITIONAL_PATTERNS, GITIGNORE_BLOCK_BEGIN, GITIGNORE_BLOCK_END, renderGitignoreBlock, mergeGitignoreBlock, detectRepoVisibility, ensureArtifactGitignore, } from "./io/gitignoreArtifacts.js";
 export type { BaseStepContract, WriteStepContractInput, } from "./io/stepContractWriter.js";