audit-tools 0.32.7 → 0.32.9

package/dist/shared/dispatch/admissionLoop.d.ts

@@ -0,0 +1,245 @@
+import { z } from "zod";
+import type { ReservationLedger } from "../quota/reservationLedger.js";
+/** One packet the admission loop may grant this pass. */
+export interface AdmissionCandidate {
+    id: string;
+    /** Reservation cost = input estimate + output envelope (estimatePacketCost). */
+    cost: number;
+    /** Complexity in [0, 1] — the default capability gate's routing signal. */
+    complexity: number;
+}
+/** One pool a packet may be routed to. */
+export interface AdmissionPool {
+    poolId: string;
+    /** `provider#account/model` — the metered account the lease keys to. */
+    resourceKey: string;
+    /** Live remaining token budget for `resourceKey`. `+Infinity` ⇒ optimistic. */
+    budget: number;
+    /** Declared hard in-flight cap (e.g. Codex's 6), passed verbatim. null ⇒ none. */
+    declaredCap: number | null;
+    /** Cost rank — LOWER is cheaper; the loop routes cheapest-capable-first. */
+    costRank: number;
+    /** Capability rank — HIGHER is more capable; ties break toward more capable. */
+    capabilityRank: number;
+    /** Largest packet cost this pool can fit (context window − output). */
+    capacityTokens: number;
+}
+/** A successful admission: one packet leased to one pool. */
+export interface AdmissionGrant {
+    packet_id: string;
+    pool_id: string;
+    resource_key: string;
+    lease_id: string;
+    cost: number;
+}
+export declare const AdmissionGrantSchema: z.ZodObject<{
+    packet_id: z.ZodString;
+    pool_id: z.ZodString;
+    resource_key: z.ZodString;
+    lease_id: z.ZodString;
+    cost: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    packet_id: string;
+    cost: number;
+    pool_id: string;
+    resource_key: string;
+    lease_id: string;
+}, {
+    packet_id: string;
+    cost: number;
+    pool_id: string;
+    resource_key: string;
+    lease_id: string;
+}>;
+/** Why a packet was admitted or blocked — the per-admission explain record. */
+export declare const AdmissionExplainSchema: z.ZodObject<{
+    packet_id: z.ZodString;
+    /** null only when NO pool was capable of the packet at all. */
+    pool_id: z.ZodNullable<z.ZodString>;
+    resource_key: z.ZodNullable<z.ZodString>;
+    admitted: z.ZodBoolean;
+    reason: z.ZodEnum<["admitted", "no_capable_pool", "budget_exhausted", "cap_reached"]>;
+    /** Present on an admit attempt against a real pool (budget headroom before it). */
+    headroom_before: z.ZodOptional<z.ZodNumber>;
+    outstanding_before: z.ZodOptional<z.ZodNumber>;
+    cost: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+    admitted: boolean;
+    packet_id: string;
+    cost: number;
+    pool_id: string | null;
+    resource_key: string | null;
+    headroom_before?: number | undefined;
+    outstanding_before?: number | undefined;
+}, {
+    reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+    admitted: boolean;
+    packet_id: string;
+    cost: number;
+    pool_id: string | null;
+    resource_key: string | null;
+    headroom_before?: number | undefined;
+    outstanding_before?: number | undefined;
+}>;
+export type AdmissionExplain = z.infer<typeof AdmissionExplainSchema>;
+/**
+ * The admission artifact both orchestrators embed in their dispatch-quota contract,
+ * REPLACING the removed `max_concurrent_agents` scalar. `granted_packet_ids` is the
+ * set the host dispatches this step (its size is the emergent admission width);
+ * `declared_cap` is the verbatim per-environment hard in-flight cap (null when
+ * none); `leases` are reconciled (freed) at result-ingest; `explains` reconstruct
+ * why the fan-out was the width it was.
+ */
+export declare const DispatchAdmissionSchema: z.ZodObject<{
+    granted_packet_ids: z.ZodArray<z.ZodString, "many">;
+    declared_cap: z.ZodNullable<z.ZodNumber>;
+    leases: z.ZodArray<z.ZodObject<{
+        packet_id: z.ZodString;
+        pool_id: z.ZodString;
+        resource_key: z.ZodString;
+        lease_id: z.ZodString;
+        cost: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        packet_id: string;
+        cost: number;
+        pool_id: string;
+        resource_key: string;
+        lease_id: string;
+    }, {
+        packet_id: string;
+        cost: number;
+        pool_id: string;
+        resource_key: string;
+        lease_id: string;
+    }>, "many">;
+    explains: z.ZodArray<z.ZodObject<{
+        packet_id: z.ZodString;
+        /** null only when NO pool was capable of the packet at all. */
+        pool_id: z.ZodNullable<z.ZodString>;
+        resource_key: z.ZodNullable<z.ZodString>;
+        admitted: z.ZodBoolean;
+        reason: z.ZodEnum<["admitted", "no_capable_pool", "budget_exhausted", "cap_reached"]>;
+        /** Present on an admit attempt against a real pool (budget headroom before it). */
+        headroom_before: z.ZodOptional<z.ZodNumber>;
+        outstanding_before: z.ZodOptional<z.ZodNumber>;
+        cost: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+        admitted: boolean;
+        packet_id: string;
+        cost: number;
+        pool_id: string | null;
+        resource_key: string | null;
+        headroom_before?: number | undefined;
+        outstanding_before?: number | undefined;
+    }, {
+        reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+        admitted: boolean;
+        packet_id: string;
+        cost: number;
+        pool_id: string | null;
+        resource_key: string | null;
+        headroom_before?: number | undefined;
+        outstanding_before?: number | undefined;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    leases: {
+        packet_id: string;
+        cost: number;
+        pool_id: string;
+        resource_key: string;
+        lease_id: string;
+    }[];
+    granted_packet_ids: string[];
+    declared_cap: number | null;
+    explains: {
+        reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+        admitted: boolean;
+        packet_id: string;
+        cost: number;
+        pool_id: string | null;
+        resource_key: string | null;
+        headroom_before?: number | undefined;
+        outstanding_before?: number | undefined;
+    }[];
+}, {
+    leases: {
+        packet_id: string;
+        cost: number;
+        pool_id: string;
+        resource_key: string;
+        lease_id: string;
+    }[];
+    granted_packet_ids: string[];
+    declared_cap: number | null;
+    explains: {
+        reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+        admitted: boolean;
+        packet_id: string;
+        cost: number;
+        pool_id: string | null;
+        resource_key: string | null;
+        headroom_before?: number | undefined;
+        outstanding_before?: number | undefined;
+    }[];
+}>;
+export type DispatchAdmission = z.infer<typeof DispatchAdmissionSchema>;
+/** Outcome of one admission pass. */
+export interface AdmitBatchResult {
+    granted: AdmissionGrant[];
+    explains: AdmissionExplain[];
+    /** Packet ids not admitted this pass — deferred to a later grant (re-invoke). */
+    blocked: string[];
+}
+export interface AdmitBatchInput {
+    /** Candidate packets in PRIORITY order (highest-priority first). */
+    packets: AdmissionCandidate[];
+    pools: AdmissionPool[];
+    ledger: ReservationLedger;
+    /**
+     * Capability gate: may this pool handle this packet? Defaults to a size fit
+     * (`pool.capacityTokens >= packet.cost`) — a grounded, provider-neutral gate. A
+     * caller refines the complexity/risk gate by supplying its own predicate (the
+     * intended extension point for cost/capability routing policy).
+     */
+    capable?: (pool: AdmissionPool, packet: AdmissionCandidate) => boolean;
+    leaseTtlMs?: number;
+}
+/**
+ * Admit as many packets as budget + declared caps allow this pass, routing each to
+ * the cheapest capable pool with headroom. Every admission RESERVES the packet's
+ * cost against the shared ledger under its lock, so co-located dispatch loops on one
+ * account cannot collectively over-admit. Returns the granted set (the host
+ * dispatches exactly these), the explain trail, and the blocked remainder.
+ *
+ * A pool's declared in-flight cap is enforced by COUNT of its outstanding ledger
+ * leases (cross-process) plus this batch's grants — the only place an explicit
+ * agent-count exists (a verbatim environment limit), never a computed concurrency.
+ */
+export declare function admitBatch(input: AdmitBatchInput): Promise<AdmitBatchResult>;
+/**
+ * Build the `DispatchAdmission` contract block both orchestrators embed in their
+ * dispatch-quota — the single-sourced host-path admission derivation (no per-tool
+ * copy that could drift). Computes each packet's envelope reservation
+ * (`estimatePacketCost` with the declared output cap), derives the surfaced declared
+ * cap (the most-constraining pool's in-flight cap), and either GRANTS via
+ * {@link admitBatch} (host-subagent path, `grantLeases: true` — leases persist for
+ * reconcile at ingest) or returns a plan-only block listing every candidate
+ * (`grantLeases: false` — the in-process rolling engine leases per-packet itself,
+ * so a host grant here would double-count).
+ */
+export declare function computeDispatchAdmission(input: {
+    packets: {
+        id: string;
+        inputTokens: number;
+        complexity: number;
+    }[];
+    pools: AdmissionPool[];
+    /** Declared output cap for the packet envelope (cold-start; ratio refines later). */
+    outputCap: number;
+    grantLeases: boolean;
+    ledger: ReservationLedger;
+    capable?: (pool: AdmissionPool, packet: AdmissionCandidate) => boolean;
+}): Promise<DispatchAdmission>;
+//# sourceMappingURL=admissionLoop.d.ts.map

package/dist/shared/dispatch/admissionLoop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admissionLoop.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/admissionLoop.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;EAQtB,CAAC;AAEZ,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB;;IAG/B,+DAA+D;;;;;IAK/D,mFAAmF;;;;;;;;;;;;;;;;;;;;;;EAK5E,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;QArBhC,+DAA+D;;;;;QAK/D,mFAAmF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuB5E,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,iFAAiF;IACjF,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgGlF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnE,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC;CACxE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyB7B"}

package/dist/shared/dispatch/admissionLoop.js

@@ -0,0 +1,204 @@
+// Host-path admission loop — the tool-side "grant the admitted set" primitive of
+// the dispatch admission-control model (spec/audit/dispatch-admission-control.md).
+//
+// The in-process rolling engine (rollingDispatch.ts) admits ONE packet at a time
+// continuously; this is its host-subagent-path analog: at a dispatch step the tool
+// admits a BATCH — as many packets as budget (and any declared in-flight cap) allow
+// right now — reserving each against the shared ReservationLedger, and hands the
+// host EXACTLY that granted set. The host dispatches the set, reports at
+// result-ingest (merge-and-ingest), and the next `next-step` re-admits the
+// remainder. The granted set's size is the instantaneous admission width — there is
+// no computed concurrency number (spec: "concurrency is not a computed quantity").
+//
+// COST-FIRST ROUTING is a first-class property: each packet is routed to the
+// CHEAPEST pool CAPABLE of it (cost-ascending among capable pools) that still has
+// budget + in-flight-cap headroom, so lower-cost providers fill before pricier ones
+// and overflow spills to the next-cheapest-capable pool. The capability gate and
+// cost rank are inputs, so refining the complexity/risk gate is a one-predicate
+// change, never a re-architecture.
+import { z } from "zod";
+import { estimatePacketCost } from "../quota/packetCost.js";
+export const AdmissionGrantSchema = z
+    .object({
+    packet_id: z.string(),
+    pool_id: z.string(),
+    resource_key: z.string(),
+    lease_id: z.string(),
+    cost: z.number(),
+})
+    .strict();
+/** Why a packet was admitted or blocked — the per-admission explain record. */
+export const AdmissionExplainSchema = z
+    .object({
+    packet_id: z.string(),
+    /** null only when NO pool was capable of the packet at all. */
+    pool_id: z.string().nullable(),
+    resource_key: z.string().nullable(),
+    admitted: z.boolean(),
+    reason: z.enum(["admitted", "no_capable_pool", "budget_exhausted", "cap_reached"]),
+    /** Present on an admit attempt against a real pool (budget headroom before it). */
+    headroom_before: z.number().optional(),
+    outstanding_before: z.number().optional(),
+    cost: z.number(),
+})
+    .strict();
+/**
+ * The admission artifact both orchestrators embed in their dispatch-quota contract,
+ * REPLACING the removed `max_concurrent_agents` scalar. `granted_packet_ids` is the
+ * set the host dispatches this step (its size is the emergent admission width);
+ * `declared_cap` is the verbatim per-environment hard in-flight cap (null when
+ * none); `leases` are reconciled (freed) at result-ingest; `explains` reconstruct
+ * why the fan-out was the width it was.
+ */
+export const DispatchAdmissionSchema = z
+    .object({
+    granted_packet_ids: z.array(z.string()),
+    declared_cap: z.number().int().min(1).nullable(),
+    leases: z.array(AdmissionGrantSchema),
+    explains: z.array(AdmissionExplainSchema),
+})
+    .strict();
+/** Default capability gate: the pool's window must fit the packet's reservation. */
+function defaultCapable(pool, packet) {
+    if (!Number.isFinite(pool.capacityTokens) || pool.capacityTokens <= 0)
+        return true;
+    return pool.capacityTokens >= packet.cost;
+}
+/**
+ * Admit as many packets as budget + declared caps allow this pass, routing each to
+ * the cheapest capable pool with headroom. Every admission RESERVES the packet's
+ * cost against the shared ledger under its lock, so co-located dispatch loops on one
+ * account cannot collectively over-admit. Returns the granted set (the host
+ * dispatches exactly these), the explain trail, and the blocked remainder.
+ *
+ * A pool's declared in-flight cap is enforced by COUNT of its outstanding ledger
+ * leases (cross-process) plus this batch's grants — the only place an explicit
+ * agent-count exists (a verbatim environment limit), never a computed concurrency.
+ */
+export async function admitBatch(input) {
+    const capable = input.capable ?? defaultCapable;
+    const granted = [];
+    const explains = [];
+    const blocked = [];
+    // Seed per-pool in-flight COUNT from the ledger (other consumers' live leases),
+    // so a declared cap accounts for cross-process in-flight, then add this batch's.
+    const countByPool = new Map();
+    try {
+        const snapshot = await input.ledger.snapshot();
+        for (const leases of Object.values(snapshot)) {
+            for (const lease of leases) {
+                countByPool.set(lease.poolId, (countByPool.get(lease.poolId) ?? 0) + 1);
+            }
+        }
+    }
+    catch {
+        // Degrade-safe: an unreadable ledger just means cap counting starts at 0.
+    }
+    for (const packet of input.packets) {
+        // Cost-first-capable: cheapest capable pool first; ties break toward the more
+        // capable pool so equal-cost lanes prefer the one with more headroom.
+        const candidates = input.pools
+            .filter((pool) => capable(pool, packet))
+            .sort((a, b) => a.costRank - b.costRank || b.capabilityRank - a.capabilityRank);
+        if (candidates.length === 0) {
+            explains.push({
+                packet_id: packet.id,
+                pool_id: null,
+                resource_key: null,
+                admitted: false,
+                reason: "no_capable_pool",
+                cost: packet.cost,
+            });
+            blocked.push(packet.id);
+            continue;
+        }
+        let placed = false;
+        let lastReason = "budget_exhausted";
+        let lastPool = candidates[0];
+        for (const pool of candidates) {
+            if (pool.declaredCap != null && (countByPool.get(pool.poolId) ?? 0) >= pool.declaredCap) {
+                lastReason = "cap_reached";
+                lastPool = pool;
+                continue;
+            }
+            const decision = await input.ledger.admit({
+                resourceKey: pool.resourceKey,
+                cost: packet.cost,
+                budget: pool.budget,
+                poolId: pool.poolId,
+                ...(input.leaseTtlMs != null ? { leaseTtlMs: input.leaseTtlMs } : {}),
+            });
+            if (decision.admitted && decision.leaseId) {
+                granted.push({
+                    packet_id: packet.id,
+                    pool_id: pool.poolId,
+                    resource_key: pool.resourceKey,
+                    lease_id: decision.leaseId,
+                    cost: packet.cost,
+                });
+                countByPool.set(pool.poolId, (countByPool.get(pool.poolId) ?? 0) + 1);
+                explains.push({
+                    packet_id: packet.id,
+                    pool_id: pool.poolId,
+                    resource_key: pool.resourceKey,
+                    admitted: true,
+                    reason: "admitted",
+                    headroom_before: decision.headroomBefore,
+                    outstanding_before: decision.outstandingBefore,
+                    cost: packet.cost,
+                });
+                placed = true;
+                break;
+            }
+            lastReason = "budget_exhausted";
+            lastPool = pool;
+        }
+        if (!placed) {
+            explains.push({
+                packet_id: packet.id,
+                pool_id: lastPool.poolId,
+                resource_key: lastPool.resourceKey,
+                admitted: false,
+                reason: lastReason,
+                cost: packet.cost,
+            });
+            blocked.push(packet.id);
+        }
+    }
+    return { granted, explains, blocked };
+}
+/**
+ * Build the `DispatchAdmission` contract block both orchestrators embed in their
+ * dispatch-quota — the single-sourced host-path admission derivation (no per-tool
+ * copy that could drift). Computes each packet's envelope reservation
+ * (`estimatePacketCost` with the declared output cap), derives the surfaced declared
+ * cap (the most-constraining pool's in-flight cap), and either GRANTS via
+ * {@link admitBatch} (host-subagent path, `grantLeases: true` — leases persist for
+ * reconcile at ingest) or returns a plan-only block listing every candidate
+ * (`grantLeases: false` — the in-process rolling engine leases per-packet itself,
+ * so a host grant here would double-count).
+ */
+export async function computeDispatchAdmission(input) {
+    const candidates = input.packets.map((p) => ({
+        id: p.id,
+        cost: estimatePacketCost({ inputEstimate: p.inputTokens, declaredOutputCap: input.outputCap }).cost,
+        complexity: p.complexity,
+    }));
+    const declaredCap = input.pools.reduce((min, p) => (p.declaredCap == null ? min : min == null ? p.declaredCap : Math.min(min, p.declaredCap)), null);
+    if (!input.grantLeases) {
+        return { granted_packet_ids: candidates.map((c) => c.id), declared_cap: declaredCap, leases: [], explains: [] };
+    }
+    const admit = await admitBatch({
+        packets: candidates,
+        pools: input.pools,
+        ledger: input.ledger,
+        ...(input.capable ? { capable: input.capable } : {}),
+    });
+    return {
+        granted_packet_ids: admit.granted.map((g) => g.packet_id),
+        declared_cap: declaredCap,
+        leases: admit.granted,
+        explains: admit.explains,
+    };
+}
+//# sourceMappingURL=admissionLoop.js.map

package/dist/shared/dispatch/admissionLoop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admissionLoop.js","sourceRoot":"","sources":["../../../src/shared/dispatch/admissionLoop.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,mFAAmF;AACnF,EAAE;AACF,iFAAiF;AACjF,mFAAmF;AACnF,oFAAoF;AACpF,iFAAiF;AACjF,yEAAyE;AACzE,2EAA2E;AAC3E,oFAAoF;AACpF,mFAAmF;AACnF,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,oFAAoF;AACpF,iFAAiF;AACjF,gFAAgF;AAChF,mCAAmC;AAEnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAqC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,+DAA+D;IAC/D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAClF,mFAAmF;IACnF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AA0BZ,oFAAoF;AACpF,SAAS,cAAc,CAAC,IAAmB,EAAE,MAA0B;IACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,OAAO,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAsB;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,cAAc,CAAC;IAChD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,gFAAgF;IAChF,iFAAiF;IACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,8EAA8E;QAC9E,sEAAsE;QACtE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;aACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAElF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,IAAI;gBAClB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,iBAAiB;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,UAAU,GAA+B,kBAAkB,CAAC;QAChE,IAAI,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxF,UAAU,GAAG,aAAa,CAAC;gBAC3B,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;gBACxC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS,EAAE,MAAM,CAAC,EAAE;oBACpB,OAAO,EAAE,IAAI,CAAC,MAAM;oBACpB,YAAY,EAAE,IAAI,CAAC,WAAW;oBAC9B,QAAQ,EAAE,QAAQ,CAAC,OAAO;oBAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;gBACH,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtE,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,MAAM,CAAC,EAAE;oBACpB,OAAO,EAAE,IAAI,CAAC,MAAM;oBACpB,YAAY,EAAE,IAAI,CAAC,WAAW;oBAC9B,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,UAAU;oBAClB,eAAe,EAAE,QAAQ,CAAC,cAAc;oBACxC,kBAAkB,EAAE,QAAQ,CAAC,iBAAiB;oBAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;YACR,CAAC;YACD,UAAU,GAAG,kBAAkB,CAAC;YAChC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,OAAO,EAAE,QAAQ,CAAC,MAAM;gBACxB,YAAY,EAAE,QAAQ,CAAC,WAAW;gBAClC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAQ9C;IACC,MAAM,UAAU,GAAyB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI;QACnG,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EACtG,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,EAAE,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAClH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC;QAC7B,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;IACH,OAAO;QACL,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK,CAAC,OAAO;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC"}

package/dist/{remediate → shared}/dispatch/ownershipScheduler.d.ts

@@ -22,6 +22,17 @@
  * region-disjoint upstream). If either lacks the flag they serialize into
  * successive sub-waves exactly as before — the conservative default is unchanged.
  *
+ * Three disjointness cases, not two (the read-only distinction): (1) a node that is
+ * provably READ-ONLY (`read_only === true`, no writes at all) conflicts with nothing
+ * and admits into any sub-wave — all read-only nodes collapse into the first maximal
+ * sub-wave (this is how an auditor, which writes nothing, runs fully parallel as a
+ * degenerate case of the same scheduler); (2) a node with a DECLARED write-scope
+ * batches file-disjointly (the `cofile_parallel_safe` relaxation above); (3) a node
+ * with an EMPTY/undeclared scope is conservatively non-disjoint and admits solo among
+ * writers. Case (1) is distinct from case (3): an empty `write_paths` means "scope
+ * unresolved, might touch anything" (serialize), whereas `read_only` means "provably
+ * touches nothing" (always parallel).
+ *
  * Pure and deterministic — no I/O, no Set/Map iteration-order leak — so the
  * admission order is reproducible and unit-testable against a precomputed level.
  */
@@ -36,6 +47,15 @@ export interface OwnershipSchedulerNode {
      * Absent/false ⇒ the node serializes vs. any same-file peer exactly as before.
      */
     cofile_parallel_safe?: boolean;
+    /**
+     * The node is provably READ-ONLY — it performs no writes to the target tree, so it
+     * can never conflict with any peer at merge and admits into any sub-wave in full
+     * parallel. This is DISTINCT from an empty/undeclared `write_paths`: empty means the
+     * write-scope is *unresolved* (conservatively serial); `read_only` means the node is
+     * *known* to write nothing (an auditor). Absent/false ⇒ the node is treated as a
+     * writer and goes through the normal file-disjointness gating.
+     */
+    read_only?: boolean;
 }
 /**
  * Canonicalize a node's declared write-scope to physical-file identity keys.
@@ -52,8 +72,9 @@ export declare function canonicalScopeKeys(node: OwnershipSchedulerNode, root?:
  *
  * A node with an EMPTY canonical scope (unresolved/undeclared) is treated as
  * conservatively NON-disjoint: it only enters a sub-wave by itself (it blocks and
- * is blocked-by every peer), so it never batches with another writer
- * (INV-SOO-01 / CE-008).
+ * is blocked-by every peer writer), so it never batches with another writer
+ * (INV-SOO-01 / CE-008). A `read_only` node is the opposite — it writes nothing, so
+ * it admits into any sub-wave in full parallel (see the three-case note above).
  */
 export declare function ownershipSubWaves(level: OwnershipSchedulerNode[], root?: string): OwnershipSchedulerNode[][];
 //# sourceMappingURL=ownershipScheduler.d.ts.map

package/dist/shared/dispatch/ownershipScheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipScheduler.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/ownershipScheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAIH,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,sBAAsB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,GAAG,CAAC,MAAM,CAAC,CAIb;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,EAAE,EAC/B,IAAI,CAAC,EAAE,MAAM,GACZ,sBAAsB,EAAE,EAAE,CAoF5B"}

package/dist/{remediate → shared}/dispatch/ownershipScheduler.js

@@ -22,10 +22,21 @@
  * region-disjoint upstream). If either lacks the flag they serialize into
  * successive sub-waves exactly as before — the conservative default is unchanged.
  *
+ * Three disjointness cases, not two (the read-only distinction): (1) a node that is
+ * provably READ-ONLY (`read_only === true`, no writes at all) conflicts with nothing
+ * and admits into any sub-wave — all read-only nodes collapse into the first maximal
+ * sub-wave (this is how an auditor, which writes nothing, runs fully parallel as a
+ * degenerate case of the same scheduler); (2) a node with a DECLARED write-scope
+ * batches file-disjointly (the `cofile_parallel_safe` relaxation above); (3) a node
+ * with an EMPTY/undeclared scope is conservatively non-disjoint and admits solo among
+ * writers. Case (1) is distinct from case (3): an empty `write_paths` means "scope
+ * unresolved, might touch anything" (serialize), whereas `read_only` means "provably
+ * touches nothing" (always parallel).
+ *
  * Pure and deterministic — no I/O, no Set/Map iteration-order leak — so the
  * admission order is reproducible and unit-testable against a precomputed level.
  */
-import { canonicalizeFilePath } from "./ownershipRegistry.js";
+import { canonicalizeFilePath } from "./pathIdentity.js";
 /**
  * Canonicalize a node's declared write-scope to physical-file identity keys.
  * Empty input ⇒ empty set (handled conservatively by the disjointness gate).
@@ -46,8 +57,9 @@ export function canonicalScopeKeys(node, root) {
  *
  * A node with an EMPTY canonical scope (unresolved/undeclared) is treated as
  * conservatively NON-disjoint: it only enters a sub-wave by itself (it blocks and
- * is blocked-by every peer), so it never batches with another writer
- * (INV-SOO-01 / CE-008).
+ * is blocked-by every peer writer), so it never batches with another writer
+ * (INV-SOO-01 / CE-008). A `read_only` node is the opposite — it writes nothing, so
+ * it admits into any sub-wave in full parallel (see the three-case note above).
  */
 export function ownershipSubWaves(level, root) {
     const ordered = [...level].sort((a, b) => a.block_id.localeCompare(b.block_id));
@@ -63,13 +75,28 @@ export function ownershipSubWaves(level, root) {
         // co-batch on a shared key IFF both are `cofile_parallel_safe`.
         const claimant = new Map();
         let waveHasEmptyScopeNode = false;
+        // A writer or empty-scope node has been admitted to this sub-wave. Gates the
+        // empty-scope node's solo admission: it may enter only when no writer and no
+        // prior empty-scope node is present. A `read_only` co-resident is NOT a writer,
+        // so it never trips this — read-only nodes stay fully inert to the conflict logic.
+        let waveHasWriter = false;
         const leftover = [];
         for (const node of remaining) {
             const scope = scopeOf.get(node.block_id);
+            // Case 1: provably READ-ONLY (writes nothing) ⇒ conflicts with nothing. Admit to
+            // the current sub-wave unconditionally; never claim a path, never set or consult
+            // the writer/empty-scope flags. All read-only nodes therefore collapse into the
+            // first (maximal) sub-wave — an auditor's full-parallel degenerate case.
+            if (node.read_only === true) {
+                wave.push(node);
+                continue;
+            }
             const isEmpty = scope.size === 0;
-            // Empty-scope node admits only into an otherwise-empty sub-wave (solo).
+            // Case 3: empty/undeclared scope ⇒ conservatively non-disjoint. Admits only into
+            // a sub-wave with no other writer and no prior empty-scope node (solo among
+            // writers; read-only co-residents don't count).
             if (isEmpty) {
-                if (wave.length === 0) {
+                if (!waveHasWriter && !waveHasEmptyScopeNode) {
                     wave.push(node);
                     waveHasEmptyScopeNode = true;
                 }
@@ -78,7 +105,7 @@ export function ownershipSubWaves(level, root) {
                 }
                 continue;
             }
-            // A real-scope node cannot share a wave with an empty-scope node, nor with
+            // Case 2: a real-scope node cannot share a wave with an empty-scope node, nor with
             // any node it shares a canonical path with — UNLESS both this node and every
             // same-file incumbent it collides with are `cofile_parallel_safe`.
             if (waveHasEmptyScopeNode) {
@@ -104,6 +131,7 @@ export function ownershipSubWaves(level, root) {
             for (const key of scope)
                 claimant.set(key, node);
             wave.push(node);
+            waveHasWriter = true;
         }
         subWaves.push(wave);
         remaining.length = 0;

package/dist/shared/dispatch/ownershipScheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipScheduler.js","sourceRoot":"","sources":["../../../src/shared/dispatch/ownershipScheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAwBzD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA4B,EAC5B,IAAa;IAEb,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA+B,EAC/B,IAAa;IAEb,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAE9E,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAEhD,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAA6B,EAAE,CAAC;QAC1C,6EAA6E;QAC7E,4EAA4E;QAC5E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAC3D,IAAI,qBAAqB,GAAG,KAAK,CAAC;QAClC,6EAA6E;QAC7E,6EAA6E;QAC7E,gFAAgF;QAChF,mFAAmF;QACnF,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,MAAM,QAAQ,GAA6B,EAAE,CAAC;QAE9C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAE,CAAC;YAE1C,iFAAiF;YACjF,iFAAiF;YACjF,gFAAgF;YAChF,yEAAyE;YACzE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;YAEjC,iFAAiF;YACjF,4EAA4E;YAC5E,gDAAgD;YAChD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,aAAa,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,qBAAqB,GAAG,IAAI,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBACD,SAAS;YACX,CAAC;YAED,mFAAmF;YACnF,6EAA6E;YAC7E,mEAAmE;YACnE,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GACZ,IAAI,CAAC,oBAAoB,KAAK,IAAI;wBAClC,SAAS,CAAC,oBAAoB,KAAK,IAAI,CAAC;oBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,QAAQ,GAAG,IAAI,CAAC;wBAChB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,KAAK;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/shared/dispatch/pathIdentity.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The single-sourced path canonicalization for ownership identity (INV-SOO-09).
+ *
+ * Resolves a path to a stable physical-file key: absolute (against `root` when
+ * supplied, else cwd), `..`/`.`-collapsed (via `resolve`), separators normalized
+ * to `/`, and case-folded on a case-insensitive filesystem. All spellings of one
+ * file therefore collide, closing the rel/abs/case/`..` mismatch (CE-004).
+ *
+ * Symlink identity is a RECORDED RESIDUAL, not silently treated as disjoint
+ * (INV-SOO-09 / fail-3): when `resolveSymlinks` is set and the path exists, the
+ * realpath is folded in so `link.ts → x.ts` collides; when realpath is
+ * unavailable (path absent, or FS symlink resolution out of scope) the lexical
+ * canonical key is used and the unresolved case degrades to the downstream merge
+ * guard rather than being asserted disjoint here.
+ *
+ * This is the ONLY normalization scheme for ownership identity — callers must
+ * not introduce a second one (failure-mode: path-identity mismatch). It lives in
+ * `audit-tools/shared` so BOTH orchestrators' ownership scheduling resolves file
+ * identity identically (a remediate write-scope and an audit read-scope key the
+ * same file the same way).
+ */
+export declare function canonicalizeFilePath(path: string, opts?: {
+    root?: string;
+    resolveSymlinks?: boolean;
+}): string;
+//# sourceMappingURL=pathIdentity.d.ts.map

package/dist/shared/dispatch/pathIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathIdentity.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/pathIdentity.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GACtD,MAAM,CAgBR"}