audit-tools 0.45.0 → 0.48.0

package/dist/shared/submission/hostHandoffCore.d.ts

@@ -0,0 +1,155 @@
+/** Code-unit lexical order — the shared comparator for every id sort here. */
+export declare function compareCodeUnits(left: string, right: string): number;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/** Exact key set, order-insensitive: a persisted envelope admits no extra keys. */
+export declare function hasExactKeys(value: Record<string, unknown>, expected: readonly string[]): boolean;
+export declare function isSha256(value: unknown): value is string;
+/** Full sha1/sha256 commit id — the only form a baseline may take. */
+export declare function isCommit(value: unknown): value is string;
+export declare function requireNonEmptyString(value: unknown, label: string): string;
+export declare function stringArray(value: unknown): readonly string[] | null;
+/** Element-wise equality of two string arrays (order-significant). */
+export declare function sameStrings(left: readonly string[], right: readonly string[]): boolean;
+/** The dedupe key for an accepted binding: work item × prompt digest. */
+export declare function bindingIdentity(entry: {
+    readonly work_item_id: string;
+    readonly prompt_sha256: string;
+}): string;
+/**
+ * The run-scoped paths one host-handoff boundary lives at.
+ *
+ * Both twins resolved these with the same three calls (`assertSubmissionRunId`,
+ * containment on the artifacts dir, containment on `runs/<runId>`), differing
+ * only in whether the run directory carried a sub-segment. The sub-segment is a
+ * parameter here, not a fork: remediate's run dir sits under `runs/<id>/implement`
+ * because its runs dir also holds triage/closing lanes; audit's sits directly
+ * under `runs/<id>`.
+ */
+export interface HostHandoffPaths {
+    /** Absolute repository root everything is contained beneath. */
+    readonly root: string;
+    /** Absolute artifacts dir (`.audit-tools/<tool>/`). */
+    readonly artifactsDir: string;
+    /** Absolute run directory the workload and results live under. */
+    readonly runDir: string;
+    /** Absolute directory submissions land in. */
+    readonly resultDir: string;
+    /** Absolute path of the persisted workload document. */
+    readonly workloadPath: string;
+}
+/**
+ * Resolve the run-scoped boundary paths. Throws when the run id leaves the
+ * shared grammar or either declared root escapes containment — before any
+ * caller has a path to write to.
+ */
+export declare function resolveHostHandoffPaths(params: {
+    readonly root: string;
+    readonly artifactsDir: string;
+    readonly runId: string;
+    /**
+     * Segments between the RUN DIRECTORY and its lane sub-directory — i.e. AFTER
+     * the run id: `runs/<runId>/<segments…>`. Empty for audit's flat
+     * `runs/<runId>/`; `["implement"]` for remediate's lane-scoped one. Order is
+     * load-bearing: validators join submissions to their run by the FIRST path
+     * segment under `runs/`, so the run id must stay that segment.
+     */
+    readonly runDirSegments?: readonly string[];
+    /** Names this draw in the run-id refusal (`Invalid <label>: …`). */
+    readonly runIdLabel?: string;
+}): HostHandoffPaths;
+/**
+ * The bound path for one work item's submission — the SHARED rule, not a local
+ * copy of it. `<resultDir>/<sha256(id)>.json`, repository-relative and
+ * forward-slashed. This replaces the byte-equivalent private `resultPathFor`
+ * copies both twins carried; a divergence between them would have been silent
+ * on both sides.
+ */
+export declare function hostHandoffResultPath(paths: HostHandoffPaths, id: string): string;
+/** Absolute form of {@link hostHandoffResultPath}, for readers on disk. */
+export declare function absoluteHostHandoffResultPath(paths: HostHandoffPaths, id: string): string;
+/** Content digest of one prompt text — the binding between ask and answer. */
+export declare function promptSha256(promptText: string): string;
+/** Content digest of one canonical JSON rendering. */
+export declare function contentSha256(value: unknown): string;
+export type WorkloadEnvelopeParse = {
+    readonly ok: true;
+    readonly rawItems: readonly unknown[];
+} | {
+    readonly ok: false;
+};
+/**
+ * Validate a persisted workload ENVELOPE against this run: exact keys, the
+ * draw's contract version, the run id, and an array of raw items. Item-level
+ * shape is the draw's parser ({@link parseAllWorkloadItems}); anything the
+ * persisted trusted binding further pins (a digest, a baseline) is the draw's
+ * policy layered on top of the `ok` case.
+ */
+export declare function parseWorkloadEnvelope(value: unknown, params: {
+    readonly contractVersion: string;
+    readonly runId: string;
+}): WorkloadEnvelopeParse;
+/** Map raw items through the draw's parser; `null` when ANY item refuses. */
+export declare function parseAllWorkloadItems<T>(rawItems: readonly unknown[], parseItem: (raw: unknown) => T | null): readonly T[] | null;
+/** Every id distinct — the duplicate-work-item refusal. */
+export declare function idsAreUnique(ids: readonly string[]): boolean;
+/**
+ * Strictly ascending in code-unit order — which is BOTH "sorted" and
+ * "duplicate-free", the two properties every persisted workload's id list must
+ * have for a re-derivation to compare equal byte-for-byte.
+ */
+export declare function idsAreStrictlyAscending(ids: readonly string[]): boolean;
+/**
+ * The identity binding EVERY submitted result carries, identical on both
+ * draws: a non-empty `result_id`, this run's id, this work item's id, and the
+ * prompt digest of the ask. A refusal here is a REFUSAL, never a repair — the
+ * tool cannot know which of the three the host meant.
+ */
+export declare function resultIdentityIsBound(value: Record<string, unknown>, params: {
+    readonly runId: string;
+    readonly workItemId: string;
+    readonly promptSha256: string;
+}): boolean;
+/** The minimal view of a parsed work item the result-map check needs. */
+export interface ResultMappedItem {
+    readonly id: string;
+    readonly prompt: {
+        readonly sha256: string;
+    };
+    readonly result_path: string;
+}
+/** One `host-result-map.json` entry, as both draws persist it. */
+export interface ResultMapEntry {
+    readonly work_item_id: string;
+    readonly prompt_sha256: string;
+    readonly result_path: string;
+}
+/**
+ * RESULT-MAP IDENTITY: the map names exactly the workload's items, once each,
+ * with each item's own prompt digest and derived bound path. This was the
+ * second half of the audit twin's `validateHandoffBinding`, hand-inlined there;
+ * the remediate draw pins the same facts through its whole-document digest
+ * instead — but the CHECK itself is the draw-independent statement of "the map
+ * and the workload agree", so it lives here for whichever draw parses a map.
+ *
+ * The failure is CLASSIFIED, not collapsed: `coverage` means the map does not
+ * name this workload's items exactly once each; `identity` means an entry
+ * names the right item but pins another item's prompt digest or a bound path
+ * the shared rule does not derive. The two are not interchangeable to the
+ * caller — one says the MAP is wrong, the other names the BINDING that broke.
+ */
+export type ResultMapIdentity<TItem extends ResultMappedItem> = {
+    readonly ok: true;
+    readonly byId: ReadonlyMap<string, TItem>;
+} | {
+    readonly ok: false;
+    readonly reason: "coverage" | "identity";
+    readonly workItemId?: string;
+};
+export declare function resultMapIdentity<TItem extends ResultMappedItem>(items: readonly TItem[], entries: readonly ResultMapEntry[]): ResultMapIdentity<TItem>;
+/**
+ * First duplicate identity in `entries`, or null. The accepted-results ledger
+ * and any other keyed record derives its dedupe refusal from this rather than
+ * from a hand-rolled Set walk whose message and predicate can drift apart.
+ */
+export declare function firstDuplicateIdentity<T>(entries: readonly T[], identity: (entry: T) => string): T | null;
+//# sourceMappingURL=hostHandoffCore.d.ts.map

package/dist/shared/submission/hostHandoffCore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostHandoffCore.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/hostHandoffCore.ts"],"names":[],"mappings":"AA0BA,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAQT;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKxD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK3E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAIpE;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAKT;AASD,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,gBAAgB,CAoBnB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,GACT,MAAM,CAKR;AAED,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,GACT,MAAM,CAMR;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAcD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAE3B;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE;IACN,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACA,qBAAqB,CAWvB;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,IAAI,GACpC,SAAS,CAAC,EAAE,GAAG,IAAI,CAQrB;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAKvE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE;IACN,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,GACA,OAAO,CAQT;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,CAAC,KAAK,SAAS,gBAAgB,IACxD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE,GAChE;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,wBAAgB,iBAAiB,CAAC,KAAK,SAAS,gBAAgB,EAC9D,KAAK,EAAE,SAAS,KAAK,EAAE,EACvB,OAAO,EAAE,SAAS,cAAc,EAAE,GACjC,iBAAiB,CAAC,KAAK,CAAC,CAsB1B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,GAC7B,CAAC,GAAG,IAAI,CAQV"}

package/dist/shared/submission/hostHandoffCore.js

@@ -0,0 +1,210 @@
+/**
+ * The ONE host-handoff boundary both orchestrators draw from.
+ *
+ * The audit host handoff (`src/audit/cli/dispatch/hostHandoff.ts`) and the
+ * remediation one (`src/remediate/steps/dispatch/hostHandoff.ts`) were two
+ * independently evolved bodies that had already converged on the same skeleton:
+ * resolve a run-scoped boundary, derive each work item's bound result path
+ * through the shared submission-path rule, hash the prompt, validate the
+ * workload against its bindings, and refuse a result whose identity, prompt
+ * binding, or result-map entry does not match the derivation. Every place they
+ * differed in TEXT but not in MEANING is what this core owns now; what remains
+ * in each twin is its DRAW — the contract versions and shapes it persists, the
+ * domain validation it applies on top, the state it mutates.
+ */
+// Sibling modules imported DIRECTLY, never through ../index.js: the barrel
+// re-exports this module, so importing the barrel here would close a cycle
+// (index → hostHandoffCore → index) that check:depgraph refuses.
+import { hashContent } from "../hash.js";
+import { stableStringify } from "../stableStringify.js";
+import { assertSubmissionRunId, resolveContainedPath, submissionPathFor, } from "./submissionIdentity.js";
+import { join, resolve } from "node:path";
+/** Code-unit lexical order — the shared comparator for every id sort here. */
+export function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Exact key set, order-insensitive: a persisted envelope admits no extra keys. */
+export function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort(compareCodeUnits);
+    return (actual.length === expected.length &&
+        actual.every((key, index) => key === [...expected].sort(compareCodeUnits)[index]));
+}
+export function isSha256(value) {
+    return typeof value === "string" && /^[0-9a-f]{64}$/u.test(value);
+}
+/** Full sha1/sha256 commit id — the only form a baseline may take. */
+export function isCommit(value) {
+    return (typeof value === "string" &&
+        /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(value));
+}
+export function requireNonEmptyString(value, label) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`${label} must be a non-empty string`);
+    }
+    return value;
+}
+export function stringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string")
+        ? value
+        : null;
+}
+/** Element-wise equality of two string arrays (order-significant). */
+export function sameStrings(left, right) {
+    return (left.length === right.length &&
+        left.every((entry, index) => entry === right[index]));
+}
+/**
+ * The dedupe key for an accepted binding: work item × prompt digest, joined by
+ * NUL (`String.fromCharCode(0)` in source — never the raw control byte in this
+ * file, which git would treat as binary).
+ */
+const BINDING_IDENTITY_SEPARATOR = String.fromCharCode(0);
+/** The dedupe key for an accepted binding: work item × prompt digest. */
+export function bindingIdentity(entry) {
+    return `${entry.work_item_id}${BINDING_IDENTITY_SEPARATOR}${entry.prompt_sha256}`;
+}
+/**
+ * Resolve the run-scoped boundary paths. Throws when the run id leaves the
+ * shared grammar or either declared root escapes containment — before any
+ * caller has a path to write to.
+ */
+export function resolveHostHandoffPaths(params) {
+    assertSubmissionRunId(params.runId, params.runIdLabel ?? "host handoff run id");
+    const root = resolve(params.root);
+    const artifactsDir = resolveContainedPath(root, params.artifactsDir, "artifactsDir");
+    const segments = params.runDirSegments ?? [];
+    const runDir = resolveContainedPath(artifactsDir, join("runs", params.runId, ...segments), "host handoff run directory");
+    return {
+        root,
+        artifactsDir,
+        runDir,
+        resultDir: join(runDir, "host-results"),
+        workloadPath: join(runDir, "host-workload.json"),
+    };
+}
+/**
+ * The bound path for one work item's submission — the SHARED rule, not a local
+ * copy of it. `<resultDir>/<sha256(id)>.json`, repository-relative and
+ * forward-slashed. This replaces the byte-equivalent private `resultPathFor`
+ * copies both twins carried; a divergence between them would have been silent
+ * on both sides.
+ */
+export function hostHandoffResultPath(paths, id) {
+    return submissionPathFor({ root: paths.root, submissionDir: paths.resultDir }, id);
+}
+/** Absolute form of {@link hostHandoffResultPath}, for readers on disk. */
+export function absoluteHostHandoffResultPath(paths, id) {
+    return resolveContainedPath(paths.root, hostHandoffResultPath(paths, id), `result path for ${id}`);
+}
+/** Content digest of one prompt text — the binding between ask and answer. */
+export function promptSha256(promptText) {
+    return hashContent(promptText);
+}
+/** Content digest of one canonical JSON rendering. */
+export function contentSha256(value) {
+    return hashContent(stableStringify(value));
+}
+// ── Envelope, item, and binding validation ──────────────────────────────────
+//
+// Both draws parse the SAME document family out of the run directory — a
+// workload envelope carrying `work_items`, per-item trusted bindings keyed by
+// work item, and a result map naming where each answer lands — and both used to
+// re-derive the scaffolding by hand. The shapes below are the shared skeleton;
+// a draw adds only its own contract version, its own item parser, and whatever
+// domain fields its bindings carry.
+/** The `{ contract_version, run_id, work_items }` envelope both workloads use. */
+const WORKLOAD_ENVELOPE_KEYS = ["contract_version", "run_id", "work_items"];
+/**
+ * Validate a persisted workload ENVELOPE against this run: exact keys, the
+ * draw's contract version, the run id, and an array of raw items. Item-level
+ * shape is the draw's parser ({@link parseAllWorkloadItems}); anything the
+ * persisted trusted binding further pins (a digest, a baseline) is the draw's
+ * policy layered on top of the `ok` case.
+ */
+export function parseWorkloadEnvelope(value, params) {
+    if (!isRecord(value) ||
+        !hasExactKeys(value, WORKLOAD_ENVELOPE_KEYS) ||
+        value.contract_version !== params.contractVersion ||
+        value.run_id !== params.runId ||
+        !Array.isArray(value.work_items)) {
+        return { ok: false };
+    }
+    return { ok: true, rawItems: value.work_items };
+}
+/** Map raw items through the draw's parser; `null` when ANY item refuses. */
+export function parseAllWorkloadItems(rawItems, parseItem) {
+    const items = [];
+    for (const raw of rawItems) {
+        const item = parseItem(raw);
+        if (item === null)
+            return null;
+        items.push(item);
+    }
+    return items;
+}
+/** Every id distinct — the duplicate-work-item refusal. */
+export function idsAreUnique(ids) {
+    return new Set(ids).size === ids.length;
+}
+/**
+ * Strictly ascending in code-unit order — which is BOTH "sorted" and
+ * "duplicate-free", the two properties every persisted workload's id list must
+ * have for a re-derivation to compare equal byte-for-byte.
+ */
+export function idsAreStrictlyAscending(ids) {
+    return !ids.some((id, index) => index > 0 && compareCodeUnits(ids[index - 1], id) >= 0);
+}
+/**
+ * The identity binding EVERY submitted result carries, identical on both
+ * draws: a non-empty `result_id`, this run's id, this work item's id, and the
+ * prompt digest of the ask. A refusal here is a REFUSAL, never a repair — the
+ * tool cannot know which of the three the host meant.
+ */
+export function resultIdentityIsBound(value, params) {
+    return (typeof value.result_id === "string" &&
+        value.result_id.length > 0 &&
+        value.run_id === params.runId &&
+        value.work_item_id === params.workItemId &&
+        value.prompt_sha256 === params.promptSha256);
+}
+export function resultMapIdentity(items, entries) {
+    const byId = new Map(items.map((item) => [item.id, item]));
+    if (entries.length !== byId.size)
+        return { ok: false, reason: "coverage" };
+    const seen = new Set();
+    for (const entry of entries) {
+        const item = byId.get(entry.work_item_id);
+        if (item === undefined || seen.has(entry.work_item_id)) {
+            return { ok: false, reason: "coverage" };
+        }
+        if (entry.prompt_sha256 !== item.prompt.sha256 ||
+            entry.result_path !== item.result_path) {
+            return {
+                ok: false,
+                reason: "identity",
+                workItemId: entry.work_item_id,
+            };
+        }
+        seen.add(entry.work_item_id);
+    }
+    return { ok: true, byId };
+}
+/**
+ * First duplicate identity in `entries`, or null. The accepted-results ledger
+ * and any other keyed record derives its dedupe refusal from this rather than
+ * from a hand-rolled Set walk whose message and predicate can drift apart.
+ */
+export function firstDuplicateIdentity(entries, identity) {
+    const seen = new Set();
+    for (const entry of entries) {
+        const key = identity(entry);
+        if (seen.has(key))
+            return entry;
+        seen.add(key);
+    }
+    return null;
+}
+//# sourceMappingURL=hostHandoffCore.js.map

package/dist/shared/submission/hostHandoffCore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostHandoffCore.js","sourceRoot":"","sources":["../../../src/shared/submission/hostHandoffCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,KAA8B,EAC9B,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzD,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,KAAK,CACV,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CACpE,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,KAAa;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC9E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CACzB,IAAuB,EACvB,KAAwB;IAExB,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAE1D,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,KAG/B;IACC,OAAO,GAAG,KAAK,CAAC,YAAY,GAAG,0BAA0B,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;AACpF,CAAC;AAyBD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAcvC;IACC,qBAAqB,CACnB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,UAAU,IAAI,qBAAqB,CAC3C,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,oBAAoB,CACjC,YAAY,EACZ,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,EACvC,4BAA4B,CAC7B,CAAC;IACF,OAAO;QACL,IAAI;QACJ,YAAY;QACZ,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;QACvC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,EAAU;IAEV,OAAO,iBAAiB,CACtB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,EACpD,EAAE,CACH,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B,CAC3C,KAAuB,EACvB,EAAU;IAEV,OAAO,oBAAoB,CACzB,KAAK,CAAC,IAAI,EACV,qBAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,EAChC,mBAAmB,EAAE,EAAE,CACxB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,oCAAoC;AAEpC,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,CAAC,kBAAkB,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AAMrF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,MAGC;IAED,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,YAAY,CAAC,KAAK,EAAE,sBAAsB,CAAC;QAC5C,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,eAAe;QACjD,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK;QAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAChC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,SAAqC;IAErC,MAAM,KAAK,GAAQ,EAAE,CAAC;IACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,GAAsB;IACjD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CACZ,KAAK,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA8B,EAC9B,MAIC;IAED,OAAO,CACL,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC1B,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK;QAC7B,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,UAAU;QACxC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,YAAY,CAC5C,CAAC;AACJ,CAAC;AAsCD,MAAM,UAAU,iBAAiB,CAC/B,KAAuB,EACvB,OAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3C,CAAC;QACD,IACE,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EACtC,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,KAAK,CAAC,YAAY;aAC/B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAqB,EACrB,QAA8B;IAE9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shared/submission/submissionLedger.d.ts

@@ -22,7 +22,11 @@ export interface SubmissionLedgerEvent<TIssueCode extends string = SubmissionIss
 }
 /** `<artifactsDir>/submissions/submission-ledger.jsonl`. */
 export declare function submissionLedgerPath(artifactsDir: string): string;
-/** Append one event. The parent directory is created on demand. */
+/**
+ * Append one event under the shared file lock, so concurrent appends cannot
+ * interleave mid-line. The parent directory is created on demand (the lock
+ * acquire creates its own parent; `appendNdjsonFile` creates the ledger's).
+ */
 export declare function appendSubmissionEvent<TIssueCode extends string = SubmissionIssueCode>(artifactsDir: string, event: SubmissionLedgerEvent<TIssueCode>): Promise<void>;
 /** Why one ledger line did not become an event. */
 export type SubmissionLedgerDropReason = 

package/dist/shared/submission/submissionLedger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"submissionLedger.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,sBAAsB,oHA0BzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB,CACpC,UAAU,SAAS,MAAM,GAAG,mBAAmB;IAE/C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,UAAU,SAAS,MAAM,GAAG,mBAAmB,EAC/C,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E;AAED,mDAAmD;AACnD,MAAM,MAAM,0BAA0B;AACpC,yEAAyE;AACvE,YAAY;AACd,sEAAsE;GACpE,yBAAyB,CAAC;AAE9B,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,qBAAqB,EAAE,GAAG;IACpE,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAkC/B"}
+{"version":3,"file":"submissionLedger.d.ts","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,wCAAwC,EACnD,kCAA2C,CAAC;AAE9C,eAAO,MAAM,sBAAsB,oHA0BzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB,CACpC,UAAU,SAAS,MAAM,GAAG,mBAAmB;IAE/C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAcD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,SAAS,MAAM,GAAG,mBAAmB,EAC/C,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/E;AAED,mDAAmD;AACnD,MAAM,MAAM,0BAA0B;AACpC,yEAAyE;AACvE,YAAY;AACd,sEAAsE;GACpE,yBAAyB,CAAC;AAE9B,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,qBAAqB,EAAE,GAAG;IACpE,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC,CA4C/B"}

package/dist/shared/submission/submissionLedger.js

@@ -17,6 +17,8 @@
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";
 import { appendNdjsonFile } from "../io/json.js";
+import { siblingLockPath } from "../io/lockedJsonStore.js";
+import { withFileLock } from "../io/fileLock.js";
 import { discardOnSchemaVersionMismatch } from "../io/schemaVersion.js";
 import { submissionsDir } from "../io/auditToolsPaths.js";
 export const SUBMISSION_LEDGER_EVENT_CONTRACT_VERSION = "submission-ledger-event/v1alpha1";
@@ -51,9 +53,27 @@ export const SUBMISSION_EVENT_KINDS = [
 export function submissionLedgerPath(artifactsDir) {
     return join(submissionsDir(artifactsDir), "submission-ledger.jsonl");
 }
-/** Append one event. The parent directory is created on demand. */
+// Sibling lock serializing every append. Two concurrent appends used to be two
+// independent open-append syscalls on one file: on Windows (and wherever O_APPEND
+// is not what the runtime actually performs) they can interleave so one event's
+// line lands INSIDE the other's, and both lines are then torn — the ledger
+// silently loses an event, which is precisely the clean-vs-repaired collapse it
+// exists to prevent. The name is the locked-JSON-store module's OWN derivation
+// (`siblingLockPath`), so the ledger's lock is the same rule the stores use
+// rather than a second spelling of it.
+function ledgerLockPath(ledgerPath) {
+    return siblingLockPath(ledgerPath);
+}
+/**
+ * Append one event under the shared file lock, so concurrent appends cannot
+ * interleave mid-line. The parent directory is created on demand (the lock
+ * acquire creates its own parent; `appendNdjsonFile` creates the ledger's).
+ */
 export async function appendSubmissionEvent(artifactsDir, event) {
-    await appendNdjsonFile(submissionLedgerPath(artifactsDir), event);
+    const ledgerPath = submissionLedgerPath(artifactsDir);
+    await withFileLock(ledgerLockPath(ledgerPath), async () => {
+        await appendNdjsonFile(ledgerPath, event);
+    });
 }
 function ledgerRead(events, dropped) {
     Object.defineProperty(events, "events", {
@@ -115,7 +135,17 @@ export async function readSubmissionLedger(artifactsDir) {
             continue;
         let parsed;
         try {
-            parsed = JSON.parse(line);
+            const value = JSON.parse(line);
+            // A line that is valid JSON but not an OBJECT is still not an event: the
+            // version check below reads properties off it (`in`), which throws on a
+            // primitive or array and broke this function's documented never-throw
+            // guarantee — one stray line failed the whole call that records drift.
+            // Classified exactly like a torn line instead.
+            if (value === null || typeof value !== "object" || Array.isArray(value)) {
+                dropped.push({ line: lineNumber, reason: "unparsable" });
+                continue;
+            }
+            parsed = value;
         }
         catch {
             dropped.push({ line: lineNumber, reason: "unparsable" });

package/dist/shared/submission/submissionLedger.js.map

@@ -1 +1 @@
-{"version":3,"file":"submissionLedger.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yDAAyD;IACzD,UAAU;IACV,kDAAkD;IAClD,UAAU;IACV,oEAAoE;IACpE,UAAU;IACV,4EAA4E;IAC5E,mBAAmB;IACnB;;;;;;OAMG;IACH,uBAAuB;IACvB;;;;;;;OAOG;IACH,qBAAqB;CACb,CAAC;AAyBX,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAEzC,YAAoB,EAAE,KAAwC;IAC9D,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAqCD,SAAS,UAAU,CACjB,MAA+B,EAC/B,OAA+B;IAE/B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE;QACtC,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE;QACvC,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,MAAyC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,8EAA8E;IAC9E,uEAAuE;IACvE,oBAAoB;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,UAAU,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,8BAA8B,CAC1C,MAAM,EACN,wCAAwC,CACzC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"submissionLedger.js","sourceRoot":"","sources":["../../../src/shared/submission/submissionLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,CAAC,MAAM,wCAAwC,GACnD,kCAA2C,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,yDAAyD;IACzD,UAAU;IACV,kDAAkD;IAClD,UAAU;IACV,oEAAoE;IACpE,UAAU;IACV,4EAA4E;IAC5E,mBAAmB;IACnB;;;;;;OAMG;IACH,uBAAuB;IACvB;;;;;;;OAOG;IACH,qBAAqB;CACb,CAAC;AAyBX,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,uCAAuC;AACvC,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAEzC,YAAoB,EAAE,KAAwC;IAC9D,MAAM,UAAU,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,YAAY,CAChB,cAAc,CAAC,UAAU,CAAC,EAC1B,KAAK,IAAI,EAAE;QACT,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,CACF,CAAC;AACJ,CAAC;AAqCD,SAAS,UAAU,CACjB,MAA+B,EAC/B,OAA+B;IAE/B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE;QACtC,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE;QACvC,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,MAAyC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,8EAA8E;IAC9E,uEAAuE;IACvE,oBAAoB;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,UAAU,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,+CAA+C;YAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,KAA8B,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,8BAA8B,CAC1C,MAAM,EACN,wCAAwC,CACzC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/shared/tooling/commandShape.d.ts

@@ -18,4 +18,33 @@ export declare function partitionCommandsByDeclaredShape(commands: readonly stri
     commands: string[];
     refusals: string[];
 };
+/**
+ * Split a command string into an argv array, so it can be spawned with
+ * `shell: false`.
+ *
+ * TOTAL, and its guarantee is stated in terms of `shell: false` — not in terms
+ * of a precondition a caller has to remember. Exactly two characters are
+ * special: an unquoted space ENDS a token, and a double quote toggles grouping
+ * and is dropped. EVERY other byte — including `' \ ^ % $` and backtick, and
+ * including `& | ; < > ( )` — is copied into the token literally, which under
+ * `shell: false` is precisely what the child receives, because no shell ever
+ * parses the result. So for any input this produces the argv that a shell-free
+ * spawn will actually deliver; it never silently drops meaning.
+ *
+ * What it does NOT do is decide whether a command was ADMISSIBLE. A string that
+ * fails {@link commandLeavesDeclaredShape} still splits — `a && b` becomes
+ * `["a", "&&", "b"]`, three literal argv tokens — and that argv is a faithful
+ * rendering of what `shell: false` would run, not an execution of the chain the
+ * author wrote. That is a declaration the contract cannot honour, so it must be
+ * REFUSED by the gate before it reaches a spawn; this function is not the place
+ * that decision is made, and it is not a shell parser standing in for one.
+ *
+ * Windows note: because `\` is an ordinary byte here, an absolute Windows path
+ * survives intact through the split (`C:\Program Files\nodejs\node.exe` stays
+ * one token when double-quoted). The declared-shape gate refuses `\` in every
+ * position, so such a path can only reach this function from a caller that did
+ * not gate — see {@link commandLeavesDeclaredShape}'s header for why the
+ * refusal is about the declaration rather than the spawn.
+ */
+export declare function parseCommandString(command: string): string[];
 //# sourceMappingURL=commandShape.d.ts.map

package/dist/shared/tooling/commandShape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commandShape.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAgEA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,eAAe,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,GACxE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAgB5C"}
+{"version":3,"file":"commandShape.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAgFA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA6BnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,eAAe,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,GACxE;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAgB5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAyB5D"}

package/dist/shared/tooling/commandShape.js

@@ -2,18 +2,34 @@ import { scanStringAware } from "../parsing/stringAwareScanner.js";
 /**
  * THE declared single-invocation command shape — one rule, every boundary.
  *
- * A declared command (a block's `targeted_commands`) is executed VERBATIM
- * through `shell: true` in the repository root, so anything that chains,
- * redirects, substitutes or subshells turns one declared test into arbitrary
- * execution. A flat regex cannot decide this: `node -e "process.exit(0)"` is an
- * ordinary test invocation whose parens are inside quotes, and refusing it would
- * refuse the normal case.
+ * A declared command (a block's `targeted_commands`) is a string an operator
+ * wrote and this tool then RUNS. The rule exists because such a string must
+ * denote exactly ONE invocation: anything that chains, redirects, substitutes
+ * or subshells turns one declared test into arbitrary execution. A flat regex
+ * cannot decide this: `node -e "process.exit(0)"` is an ordinary test
+ * invocation whose parens are inside quotes, and refusing it would refuse the
+ * normal case.
+ *
+ * WHAT THE RULE IS *NOT*: an escaping scheme for one particular spawn. The
+ * consumers no longer agree on how they spawn — the closing suites and the
+ * required-test rerun split the string with {@link parseCommandString} and
+ * spawn `shell: false`, while the triage re-verification path still hands it to
+ * a shell — and the rule is identical for all of them. That is the point of
+ * stating it once here: the property enforced belongs to the DECLARATION, not
+ * to the spawner. A string carrying `&&` or a redirect declares work this
+ * contract cannot faithfully run as ONE invocation, and must be refused up
+ * front — whether the consumer would have let a shell act on it or would have
+ * silently reduced it to literal argv bytes. Enforcing the same rule at every
+ * boundary is also what keeps producer and consumer agreeing about which
+ * declarations are admissible at all.
  *
  * So the scan is QUOTE-AWARE — a tiny, fully-owned grammar, not a shell parser.
- * It is deliberately narrower than EITHER shell's grammar, because `shell: true`
- * is TWO grammars and no per-grammar state machine is sound for both: `/bin/sh
- * -c` on posix, `cmd.exe /d /s /c` on win32. Where they disagree, tracking state
- * under one of them MIS-CLASSIFIES the other:
+ * It is deliberately narrower than EITHER shell's grammar, because a declared
+ * command historically reached `shell: true` — TWO grammars, and no per-grammar
+ * state machine is sound for both: `/bin/sh -c` on posix, `cmd.exe /d /s /c` on
+ * win32. Where they disagree, tracking state under one of them MIS-CLASSIFIES
+ * the other, and keeping the union-of-both-grammars refusal is what lets the
+ * same admission decision hold on every platform:
  *
  *   - `'` quotes on sh and is an ORDINARY CHARACTER on cmd.exe, so crediting it
  *     reads `echo '& evil.exe'` as fully quoted while cmd.exe reads `&` as a
@@ -117,4 +133,60 @@ export function partitionCommandsByDeclaredShape(commands, describeRefusal) {
     }
     return { commands: admitted, refusals };
 }
+/**
+ * Split a command string into an argv array, so it can be spawned with
+ * `shell: false`.
+ *
+ * TOTAL, and its guarantee is stated in terms of `shell: false` — not in terms
+ * of a precondition a caller has to remember. Exactly two characters are
+ * special: an unquoted space ENDS a token, and a double quote toggles grouping
+ * and is dropped. EVERY other byte — including `' \ ^ % $` and backtick, and
+ * including `& | ; < > ( )` — is copied into the token literally, which under
+ * `shell: false` is precisely what the child receives, because no shell ever
+ * parses the result. So for any input this produces the argv that a shell-free
+ * spawn will actually deliver; it never silently drops meaning.
+ *
+ * What it does NOT do is decide whether a command was ADMISSIBLE. A string that
+ * fails {@link commandLeavesDeclaredShape} still splits — `a && b` becomes
+ * `["a", "&&", "b"]`, three literal argv tokens — and that argv is a faithful
+ * rendering of what `shell: false` would run, not an execution of the chain the
+ * author wrote. That is a declaration the contract cannot honour, so it must be
+ * REFUSED by the gate before it reaches a spawn; this function is not the place
+ * that decision is made, and it is not a shell parser standing in for one.
+ *
+ * Windows note: because `\` is an ordinary byte here, an absolute Windows path
+ * survives intact through the split (`C:\Program Files\nodejs\node.exe` stays
+ * one token when double-quoted). The declared-shape gate refuses `\` in every
+ * position, so such a path can only reach this function from a caller that did
+ * not gate — see {@link commandLeavesDeclaredShape}'s header for why the
+ * refusal is about the declaration rather than the spawn.
+ */
+export function parseCommandString(command) {
+    const argv = [];
+    let current = "";
+    let quoted = false;
+    let started = false;
+    for (const char of command) {
+        if (char === '"') {
+            // A quote both toggles the state and MARKS the token as started, so an
+            // explicit empty argument (`""`) survives as an empty string rather than
+            // vanishing at the length check below.
+            quoted = !quoted;
+            started = true;
+            continue;
+        }
+        if (char === " " && !quoted) {
+            if (started)
+                argv.push(current);
+            current = "";
+            started = false;
+            continue;
+        }
+        current += char;
+        started = true;
+    }
+    if (started)
+        argv.push(current);
+    return argv;
+}
 //# sourceMappingURL=commandShape.js.map

package/dist/shared/tooling/commandShape.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandShape.js","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,eAAe,CACb,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EACxC;QACE,WAAW,EAAE,GAAG,EAAE;YAChB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,YAAY,EAAE,GAAG,EAAE;YACjB,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO;YAClD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CACF,CAAC;IACF,8EAA8E;IAC9E,wCAAwC;IACxC,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAA2B,EAC3B,eAAyE;IAEzE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"commandShape.js","sourceRoot":"","sources":["../../../src/shared/tooling/commandShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,eAAe,CACb,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EACxC;QACE,WAAW,EAAE,GAAG,EAAE;YAChB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,YAAY,EAAE,GAAG,EAAE;YACjB,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO;YAClD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CACF,CAAC;IACF,8EAA8E;IAC9E,wCAAwC;IACxC,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAA2B,EAC3B,eAAyE;IAEzE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,uEAAuE;YACvE,yEAAyE;YACzE,uCAAuC;YACvC,MAAM,GAAG,CAAC,MAAM,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,IAAI,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,IAAI,CAAC;QAChB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC"}