audit-tools 0.52.3 → 0.52.4

package/dist/remediate/steps/dispatch/hostContracts.js

@@ -0,0 +1,104 @@
+// sites-pinned: tests/remediate/host-handoff.test.ts, tests/remediate/host-handoff-corroboration.test.ts
+import { SUBMISSION_ISSUE_CODES, WORKLOAD_ISSUE_CODES } from "audit-tools/shared";
+export const CONFORMANCE_REVIEW_ISSUES = [
+    "conformance_review_required", "conformance_review_unavailable", "conformance_review_insufficient",
+];
+/**
+ * Remediation's issue vocabulary: the SHARED submission codes plus this draw's
+ * own domain corroboration codes.
+ *
+ * The submission half is imported, never restated — a submission that is
+ * missing, unparseable, contract-invalid, or a duplicate identity means exactly
+ * the same thing on both sides of the pipeline, and the two used to spell it
+ * differently (`result_missing` here, a bare `null` in the audit ingest). The
+ * git/worktree/test half stays here: audit has no analogue and dragging
+ * `commit_not_landed` into the shared core would suggest it could emit one.
+ */
+export const REMEDIATION_ISSUE_CODES = [
+    ...SUBMISSION_ISSUE_CODES,
+    "workload_missing",
+    "workload_invalid",
+    "trusted_binding_missing",
+    "commit_missing",
+    "commit_not_landed",
+    "baseline_not_ancestor",
+    "changed_files_mismatch",
+    "run_start_dirty_overlap",
+    "required_test_failed",
+    /**
+     * A required test exceeded its deadline. DISTINCT from `required_test_failed`
+     * by code alone: a hung suite and a genuine red are different facts about the
+     * work, and telling them apart must not require parsing a joined message.
+     */
+    "required_test_timed_out",
+    /**
+     * A required test produced more output than the capture buffer holds, so the
+     * runner killed it. NOT a verdict on the tests: the child was terminated by
+     * the capture cap, and whether the suite would have passed is unknown. It has
+     * its own code because it was previously indistinguishable from a hang — node
+     * kills an over-buffer child with a signal, which the old discriminator read
+     * as a deadline miss.
+     */
+    "required_test_output_overflow",
+    /**
+     * A plan block declares a dependency id that exists in NO block of the plan.
+     * The block is unschedulable — never level 0 — and the producer bug is named
+     * rather than absorbed.
+     */
+    "dependency_missing",
+    /**
+     * A block arrived outside the normalized write-scope / declared-command shape
+     * this boundary consumes (artifact:normalized-block-write-scope). Refused, not
+     * silently normalized: a silently sorted, deduped or re-rooted write scope
+     * hides the producer bug and widens what a host may touch.
+     */
+    "block_contract_invalid",
+    /**
+     * A recovery-mode acceptance could not be marked on the submission ledger, so
+     * it was refused. An acceptance that used the relaxation MUST stay
+     * distinguishable from a clean one; an unrecordable mark is a refusal, never
+     * a silent acceptance.
+     */
+    "recovery_unrecorded",
+    /**
+     * The repository HEAD moved between the recovery verb's unlocked test phase
+     * and its locked write phase, so the pre-computed test verdicts describe a
+     * tree that is no longer current. The whole recovery aborts.
+     */
+    "tree_moved_between_phases",
+    /**
+     * The run's own WORKLOAD BINDING changed between the recovery verb's unlocked
+     * test phase and its locked write phase — the sibling of
+     * `tree_moved_between_phases` for a concurrent state writer that settles items
+     * and re-mints the binding without moving a commit. The pre-computed verdicts
+     * describe work that is no longer pending, so the whole recovery aborts.
+     */
+    "state_moved_between_phases",
+    /**
+     * The work item's baseline commit is not in this repository, so nothing can
+     * be corroborated against it. The run's recorded state is at fault, not the
+     * result.
+     */
+    "baseline_missing",
+    /**
+     * The work item's baseline commit exists but is no longer an ancestor of HEAD
+     * (history was rewritten under the run). The spawn-free `recover-ingest` verb
+     * is the named repair; no worker can make it.
+     */
+    "baseline_orphaned",
+    /**
+     * `landed_commit` names a commit that cannot be this item's landed work: the
+     * baseline itself, or a commit whose diff against the baseline is empty.
+     */
+    "landed_commit_invalid",
+    /**
+     * A result names a work item that the persisted workload binds but that is no
+     * longer pending (it settled, or its dependencies are not complete).
+     */
+    "work_item_not_eligible",
+    // `workload_stale` is shared with the audit draw: its meaning and its remedy
+    // live beside `WORKLOAD_ISSUE_CODES`.
+    ...WORKLOAD_ISSUE_CODES,
+    ...CONFORMANCE_REVIEW_ISSUES,
+];
+//# sourceMappingURL=hostContracts.js.map

package/dist/remediate/steps/dispatch/hostContracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostContracts.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/hostContracts.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAA+D,MAAM,oBAAoB,CAAC;AAK/I,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,6BAA6B,EAAE,gCAAgC,EAAE,iCAAiC;CAC1F,CAAC;AAuDX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,GAAG,sBAAsB;IACzB,kBAAkB;IAClB,kBAAkB;IAClB,yBAAyB;IACzB,gBAAgB;IAChB,mBAAmB;IACnB,uBAAuB;IACvB,wBAAwB;IACxB,yBAAyB;IACzB,sBAAsB;IACtB;;;;OAIG;IACH,yBAAyB;IACzB;;;;;;;OAOG;IACH,+BAA+B;IAC/B;;;;OAIG;IACH,oBAAoB;IACpB;;;;;OAKG;IACH,wBAAwB;IACxB;;;;;OAKG;IACH,qBAAqB;IACrB;;;;OAIG;IACH,2BAA2B;IAC3B;;;;;;OAMG;IACH,4BAA4B;IAC5B;;;;OAIG;IACH,kBAAkB;IAClB;;;;OAIG;IACH,mBAAmB;IACnB;;;OAGG;IACH,uBAAuB;IACvB;;;OAGG;IACH,wBAAwB;IACxB,6EAA6E;IAC7E,sCAAsC;IACtC,GAAG,oBAAoB;IACvB,GAAG,yBAAyB;CACpB,CAAC"}

package/dist/remediate/steps/dispatch/hostCorroboration.d.ts

@@ -0,0 +1,70 @@
+import { type IngestionCheckId } from "audit-tools/shared";
+import type { CurrentRemediationHostState, RemediationHostWorkItem, RemediationHostResult, RemediationHostIngestIssue } from "./hostContracts.js";
+import type { RemediationRequiredTestVerdicts } from "./requiredTests.js";
+type CorroboratedHostResult = {
+    readonly ok: true;
+    readonly changedFiles: readonly string[];
+    /**
+     * True only when the baseline→landed ancestry check was WAIVED under an
+     * orphaned baseline. The caller must record the acceptance on the
+     * submission ledger before it lands.
+     */
+    readonly usedRecovery: boolean;
+} | {
+    readonly ok: false;
+    readonly code: RemediationHostIngestIssue["code"];
+    readonly check: IngestionCheckId;
+    readonly message: string;
+};
+/**
+ * Corroborate an explicit `resolved_no_change` decision against the repository.
+ *
+ * A no-change decision used to be accepted on its evidence STRINGS alone, with
+ * only the required tests re-run — so a host that had in fact edited and then
+ * declared "nothing to do" was recorded as verified-no-change, and the edit
+ * rode into the run unattributed. The claim is mechanically falsifiable, so it
+ * is FALSIFIED.
+ *
+ * The scope of the falsification is the FULL write-scope corroboration every
+ * other acceptance path gets, NOT a narrowing to this item's `allowed_files`.
+ * `corroborateHostResult` refuses a landed commit that touched anything outside
+ * `allowed_files`; a no-change decision that narrowed the check to files INSIDE
+ * `allowed_files` would be the inverse rule — the out-of-scope edit, the more
+ * serious of the two, would be the one silently admitted. So EVERY path the
+ * tree shows as moved since the workload baseline refuses the claim.
+ *
+ * `excusedPaths` is the only exemption, and it is ground truth rather than the
+ * host's word: `run_start_dirty` (already dirty before the run began, so not
+ * evidence that this host edited anything — and because it is captured from
+ * `stagedAndUntracked`, it excuses pre-existing UNTRACKED strays too) unioned
+ * with the accepted edit surface — `applied_edit_surface` plus whatever this
+ * same ingest has already corroborated and accepted, so a sibling work item's
+ * legitimately landed files do not falsify this item's claim.
+ *
+ * Fails CLOSED, like every other corroboration here: a git that cannot answer
+ * refuses the claim rather than admitting it.
+ */
+export declare function corroborateNoChangeClaim(params: {
+    readonly root: string;
+    readonly workItem: RemediationHostWorkItem;
+    /** Repo-relative paths whose movement is already accounted for. */
+    readonly excusedPaths: ReadonlySet<string>;
+}): Promise<{
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: RemediationHostIngestIssue["code"];
+    readonly check: IngestionCheckId;
+    readonly message: string;
+}>;
+export declare function corroborateHostResult(params: {
+    readonly root: string;
+    readonly state: CurrentRemediationHostState;
+    readonly workItem: RemediationHostWorkItem;
+    readonly result: RemediationHostResult;
+    readonly verdicts: RemediationRequiredTestVerdicts | null;
+    /** See `ingestRemediationHostResults`'s `recovery` option. */
+    readonly recovery: boolean;
+}): Promise<CorroboratedHostResult>;
+export {};
+//# sourceMappingURL=hostCorroboration.d.ts.map

package/dist/remediate/steps/dispatch/hostCorroboration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostCorroboration.d.ts","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/hostCorroboration.ts"],"names":[],"mappings":"AACA,OAAO,EAAqI,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC9L,OAAO,KAAK,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAClJ,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAsB1E,KAAK,sBAAsB,GACvB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAsLN;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C,GAAG,OAAO,CACP;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CACJ,CA+CA;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC1D,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAgIlC"}

package/dist/remediate/steps/dispatch/hostCorroboration.js

@@ -0,0 +1,350 @@
+// sites-pinned: tests/remediate/host-handoff-corroboration.test.ts
+import { AUDIT_TOOLS_DIRNAME, compareCodeUnits, isGitRepo, normalizeRepoPath, repoRelativePath, runTrackedAsync, TRACKED_CHILD_DEADLINE_MS } from "audit-tools/shared";
+import { rerunRequiredTests, requiredTestIssue } from "./requiredTests.js";
+function pathIsAllowedByWriteScope(root, candidate, allowedFiles) {
+    let normalized;
+    try {
+        normalized = repoRelativePath(root, candidate, "landed file");
+    }
+    catch {
+        return false;
+    }
+    if (normalized !== candidate)
+        return false;
+    return allowedFiles.some((allowed) => allowed.endsWith("/")
+        ? normalized.startsWith(allowed)
+        : normalized === allowed);
+}
+// The corroboration probes below run while the remediation state lock (and, on
+// the fold path, the phase lock) is held — ASYNC with the shared deadline
+// (INV-SSF), so the held lock's mtime heartbeat keeps beating through each
+// probe and a git that never answers cannot hang the ingest.
+async function gitCommitExists(root, commit) {
+    const result = await runTrackedAsync(["git", "rev-parse", "--verify", "--quiet", `${commit}^{commit}`], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+    return !result.error && result.status === 0;
+}
+// INV-WTS-3 (landed-node ancestry): a landed node's commit must be an ancestor
+// of the ref it claims to have landed on. `git merge-base --is-ancestor` exits 0
+// exactly when that holds.
+async function gitCommitIsAncestor(root, ancestor, descendant) {
+    const result = await runTrackedAsync(["git", "merge-base", "--is-ancestor", ancestor, descendant], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+    return !result.error && result.status === 0;
+}
+/**
+ * Is this commit ORPHANED — unreachable from anything the repository still
+ * keeps?
+ *
+ * "Not an ancestor of HEAD" is NOT orphanhood. A baseline sitting on an
+ * unmerged `feature` branch while the work landed on trunk fails the ancestry
+ * test exactly like a rewritten-away commit does, and treating that as orphaned
+ * would hand the relaxation to the ordinary cross-branch case — precisely the
+ * stale-worker situation the ancestry check exists to catch.
+ *
+ * So orphanhood is the CONJUNCTION of two probes: `git for-each-ref --contains`
+ * lists every branch/tag/remote ref whose history contains the commit (empty
+ * output = no live ref keeps it), and the HEAD ancestry check rides alongside
+ * it.
+ *
+ * A THIRD source of reachability sits outside `for-each-ref` entirely: the
+ * HEADs of this repository's OTHER worktrees, checked into no ref at all. In a
+ * linked worktree git DETACHES HEAD (or parks a per-worktree branch), so a
+ * baseline that is the live HEAD of a sibling worktree — exactly the state a
+ * parallel remediation lane is in — would be reported as contained by nothing,
+ * i.e. orphaned, and the relaxation would be handed out for a commit the
+ * repository is actively keeping. `git worktree list --porcelain` enumerates
+ * every worktree with its current HEAD, so it is read and compared. The linked
+ * worktree's own HEAD is included by this probe, which is why the ordinary
+ * detached-HEAD case needs no separate arm.
+ *
+ * RESIDUAL, deliberately not closed: that probe compares HEAD for EQUALITY, so
+ * it covers a worktree detached at the baseline ONLY when its HEAD *is* the
+ * baseline. A sibling worktree detached at a DESCENDANT of the baseline — a
+ * lane that landed further commits on top — keeps the baseline reachable while
+ * matching no ref and no worktree HEAD, and is still reported orphaned. Closing
+ * it means an ancestry probe per enumerated worktree HEAD; the residual is
+ * stated here rather than left as an implied full cover.
+ *
+ * A failed scan is not evidence of orphanhood — any probe that cannot answer
+ * fails closed, so a git that cannot answer never unlocks the relaxation.
+ */
+async function gitCommitIsOrphaned(root, commit) {
+    if (await gitCommitIsAncestor(root, commit, "HEAD"))
+        return false;
+    const result = await runTrackedAsync(["git", "for-each-ref", "--contains", commit, "--format=%(refname)"], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+    if (result.error || result.status !== 0)
+        return false;
+    if (result.stdout.trim().length > 0)
+        return false;
+    // Reached only when no REF keeps the commit. Every worktree HEAD is then
+    // checked, so the detached (and per-worktree-branch) HEADs git does not
+    // enumerate as refs are still seen.
+    const worktrees = await runTrackedAsync(["git", "worktree", "list", "--porcelain"], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+    if (worktrees.error || worktrees.status !== 0)
+        return false;
+    return !worktrees.stdout
+        .split("\n")
+        .filter((line) => line.startsWith("HEAD "))
+        .some((line) => line.slice("HEAD ".length).trim() === commit);
+}
+async function gitChangedFilesOfCommit(root, commit) {
+    const result = await runTrackedAsync([
+        "git",
+        "diff-tree",
+        "--root",
+        "--no-commit-id",
+        "--name-only",
+        "-r",
+        "-z",
+        commit,
+    ], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+    if (result.error || result.status !== 0)
+        return null;
+    return [...new Set(result.stdout.split("\0").filter(Boolean))].sort(compareCodeUnits);
+}
+/**
+ * Every repo-relative path the tree shows as touched since `baseline` — the
+ * commits baseline→HEAD, the working tree's own deviation from HEAD (staged and
+ * unstaged alike), and the untracked files git considers repository content.
+ *
+ * All three legs are needed to falsify a no-change claim, and they enumerate the
+ * three ways a host can have edited: committed (leg 1), edited a TRACKED file
+ * and left it uncommitted (leg 2), and CREATED a file (leg 3). A new `src/*.ts`
+ * is a real edit and the most natural shape a remediation takes; without leg 3
+ * the cheapest way to smuggle one past a no-change claim was simply never to
+ * `git add` it. `null` means git could not answer, which callers must treat as
+ * "cannot corroborate" rather than as "nothing changed".
+ *
+ * The untracked leg honours `--exclude-standard`, so it enumerates only what git
+ * itself treats as content — a repo's `.gitignore`d build and coverage output is
+ * already invisible to it. Two exemptions cover the remainder, both ground
+ * truth rather than the host's word:
+ *
+ *  - THIS TOOL'S OWN ARTIFACT TREE ({@link AUDIT_TOOLS_DIRNAME}) is subtracted
+ *    here, explicitly. In a real repository the tool writes a managed
+ *    `.gitignore` block covering it, so it never reaches this probe at all; the
+ *    explicit subtraction is what makes that independent of whether the block
+ *    has been written yet, so a bare root (a fixture, a first run) cannot
+ *    manufacture a false refusal out of the tool's own workload, prompt and
+ *    result documents.
+ *  - PRE-EXISTING untracked strays are excused by the caller's `excusedPaths`,
+ *    for free: `run_start_dirty` is captured from `stagedAndUntracked` before
+ *    any remediation edit exists, so it already enumerates untracked files.
+ *    What survives both is an untracked file that appeared DURING the run — the
+ *    only untracked class that can be this host's edit.
+ */
+async function gitChangedFilesSince(root, baseline) {
+    const files = new Set();
+    for (const args of [
+        // baseline → HEAD: what the host committed.
+        ["diff", "--name-only", "-z", baseline, "HEAD"],
+        // HEAD → working tree: what the host edited and did not commit.
+        ["diff", "--name-only", "-z", "HEAD"],
+        // Never added: what the host CREATED. `--exclude-standard` keeps git's own
+        // ignore rules authoritative.
+        ["ls-files", "--others", "--exclude-standard", "-z"],
+    ]) {
+        const probe = await runTrackedAsync(["git", ...args], {
+            cwd: root,
+            encoding: "utf8",
+            timeout: TRACKED_CHILD_DEADLINE_MS,
+        });
+        if (probe.error || probe.status !== 0)
+            return null;
+        for (const file of probe.stdout.split("\0").filter(Boolean)) {
+            if (isAuditToolsArtifactPath(file))
+                continue;
+            files.add(file);
+        }
+    }
+    return [...files].sort(compareCodeUnits);
+}
+/** Whether a repo-relative path lives inside this tool's own artifact tree. */
+function isAuditToolsArtifactPath(path) {
+    const normalized = normalizeRepoPath(path);
+    return (normalized === AUDIT_TOOLS_DIRNAME ||
+        normalized.startsWith(`${AUDIT_TOOLS_DIRNAME}/`));
+}
+/**
+ * Corroborate an explicit `resolved_no_change` decision against the repository.
+ *
+ * A no-change decision used to be accepted on its evidence STRINGS alone, with
+ * only the required tests re-run — so a host that had in fact edited and then
+ * declared "nothing to do" was recorded as verified-no-change, and the edit
+ * rode into the run unattributed. The claim is mechanically falsifiable, so it
+ * is FALSIFIED.
+ *
+ * The scope of the falsification is the FULL write-scope corroboration every
+ * other acceptance path gets, NOT a narrowing to this item's `allowed_files`.
+ * `corroborateHostResult` refuses a landed commit that touched anything outside
+ * `allowed_files`; a no-change decision that narrowed the check to files INSIDE
+ * `allowed_files` would be the inverse rule — the out-of-scope edit, the more
+ * serious of the two, would be the one silently admitted. So EVERY path the
+ * tree shows as moved since the workload baseline refuses the claim.
+ *
+ * `excusedPaths` is the only exemption, and it is ground truth rather than the
+ * host's word: `run_start_dirty` (already dirty before the run began, so not
+ * evidence that this host edited anything — and because it is captured from
+ * `stagedAndUntracked`, it excuses pre-existing UNTRACKED strays too) unioned
+ * with the accepted edit surface — `applied_edit_surface` plus whatever this
+ * same ingest has already corroborated and accepted, so a sibling work item's
+ * legitimately landed files do not falsify this item's claim.
+ *
+ * Fails CLOSED, like every other corroboration here: a git that cannot answer
+ * refuses the claim rather than admitting it.
+ */
+export async function corroborateNoChangeClaim(params) {
+    const { root, workItem, excusedPaths } = params;
+    if (!(await isGitRepo(root)))
+        return { ok: true };
+    const baseline = workItem.baseline_commit;
+    if (!(await gitCommitExists(root, baseline))) {
+        return {
+            ok: false,
+            code: "commit_missing",
+            check: "no_change_corroboration",
+            message: "resolved_no_change cannot be corroborated: baseline_commit does not resolve to a real commit",
+        };
+    }
+    const changed = await gitChangedFilesSince(root, baseline);
+    if (changed === null) {
+        return {
+            ok: false,
+            code: "commit_missing",
+            check: "no_change_corroboration",
+            message: "resolved_no_change cannot be corroborated: git could not enumerate the changes since the workload baseline",
+        };
+    }
+    const violating = changed.filter((path) => !excusedPaths.has(normalizeRepoPath(path)));
+    if (violating.length > 0) {
+        const inScope = violating.filter((path) => pathIsAllowedByWriteScope(root, path, workItem.allowed_files));
+        const outOfScope = violating.filter((path) => !pathIsAllowedByWriteScope(root, path, workItem.allowed_files));
+        return {
+            ok: false,
+            code: "changed_files_mismatch",
+            check: "no_change_corroboration",
+            message: "resolved_no_change is contradicted by the tree — these files changed since the " +
+                `workload baseline: ${violating.join(", ")}` +
+                (outOfScope.length > 0
+                    ? ` (outside the prompt-bound allowed_files: ${outOfScope.join(", ")}` +
+                        (inScope.length > 0 ? `; inside: ${inScope.join(", ")})` : ")")
+                    : ""),
+        };
+    }
+    return { ok: true };
+}
+export async function corroborateHostResult(params) {
+    const { root, state, workItem, result, verdicts } = params;
+    const baseline = workItem.baseline_commit;
+    const landed = result.landed_commit;
+    let usedRecovery = false;
+    if (!(await gitCommitExists(root, baseline))) {
+        return {
+            ok: false,
+            code: "baseline_missing",
+            check: "landed_commit",
+            message: "the work item's baseline_commit is not in this repository",
+        };
+    }
+    if (!(await gitCommitExists(root, landed))) {
+        return {
+            ok: false,
+            code: "commit_missing",
+            check: "landed_commit",
+            message: "landed_commit is not a commit in this repository",
+        };
+    }
+    if (landed === baseline) {
+        return {
+            ok: false,
+            code: "landed_commit_invalid",
+            check: "landed_commit",
+            message: "landed_commit is the baseline commit; name the commit that carries this item's edits",
+        };
+    }
+    if (!(await gitCommitIsAncestor(root, baseline, landed))) {
+        if (!params.recovery) {
+            // An ORPHANED baseline (no ref contains it, HEAD cannot reach it) is a
+            // fault in the run, not in the work: no commit could ever descend from
+            // it. The spawn-free recovery verb is its named repair.
+            if (await gitCommitIsOrphaned(root, baseline)) {
+                return {
+                    ok: false,
+                    code: "baseline_orphaned",
+                    check: "landed_commit",
+                    message: "the work item's baseline_commit is orphaned (history was rewritten under the run); " +
+                        "the operator can run `recover-ingest` to accept the landed work",
+                };
+            }
+            return {
+                ok: false,
+                code: "baseline_not_ancestor",
+                check: "landed_commit",
+                message: "the trusted workload baseline is not an ancestor of the claimed landed commit",
+            };
+        }
+        // The relaxation is precondition-bound: it applies ONLY when the trusted
+        // baseline is genuinely ORPHANED — contained by no ref AND unreachable from
+        // HEAD (see gitCommitIsOrphaned). That is the one state in which no landed
+        // commit could ever descend from it, so the item is unacceptable under
+        // every preparable binding. A baseline the repository still keeps — on an
+        // unmerged branch, a tag, a remote ref, or HEAD itself — is a HEALTHY
+        // binding, and a landed commit that does not descend from it is exactly the
+        // stale-worker case the ancestry check exists to catch; recovery refuses it
+        // identically to the normal lane.
+        if (!(await gitCommitIsOrphaned(root, baseline))) {
+            return {
+                ok: false,
+                code: "baseline_not_ancestor",
+                check: "landed_commit",
+                message: "the trusted workload baseline is not an ancestor of the claimed landed commit, " +
+                    "and the baseline is NOT orphaned (a ref still contains it, or it is reachable " +
+                    "from HEAD), so the stale-worker protection stands and recovery cannot waive it",
+            };
+        }
+        usedRecovery = true;
+    }
+    if (!(await gitCommitIsAncestor(root, landed, "HEAD"))) {
+        return {
+            ok: false,
+            code: "commit_not_landed",
+            check: "landed_commit",
+            message: "landed_commit is not reachable from the repository HEAD",
+        };
+    }
+    const actualFiles = await gitChangedFilesOfCommit(root, landed);
+    if (!actualFiles || actualFiles.length === 0) {
+        return {
+            ok: false,
+            code: "landed_commit_invalid",
+            check: "landed_commit",
+            message: "landed_commit changes no file; name the commit that carries this item's edits",
+        };
+    }
+    const outOfScope = actualFiles.filter((path) => !pathIsAllowedByWriteScope(root, path, workItem.allowed_files));
+    if (outOfScope.length > 0) {
+        return {
+            ok: false,
+            code: "changed_files_mismatch",
+            check: "write_scope",
+            message: "the landed commit changed files outside the prompt-bound allowed_files: " +
+                outOfScope.join(", "),
+        };
+    }
+    const runStartDirty = new Set((state.run_start_dirty ?? []).map(normalizeRepoPath));
+    const dirtyOverlap = actualFiles.filter((path) => runStartDirty.has(normalizeRepoPath(path)));
+    if (dirtyOverlap.length > 0) {
+        return {
+            ok: false,
+            code: "run_start_dirty_overlap",
+            check: "run_start_dirt",
+            message: `landed files overlap pre-existing run-start dirt: ${dirtyOverlap.join(", ")}`,
+        };
+    }
+    const failedTests = await rerunRequiredTests(root, workItem.required_tests, verdicts);
+    if (failedTests.length > 0) {
+        const issue = requiredTestIssue(workItem, failedTests);
+        return { ok: false, code: issue.code, check: "required_tests", message: issue.message };
+    }
+    return { ok: true, changedFiles: actualFiles, usedRecovery };
+}
+//# sourceMappingURL=hostCorroboration.js.map

package/dist/remediate/steps/dispatch/hostCorroboration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostCorroboration.js","sourceRoot":"","sources":["../../../../src/remediate/steps/dispatch/hostCorroboration.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,yBAAyB,EAAyB,MAAM,oBAAoB,CAAC;AAG9L,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE3E,SAAS,yBAAyB,CAChC,IAAY,EACZ,SAAiB,EACjB,YAA+B;IAE/B,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,UAAU,KAAK,OAAO,CAC3B,CAAC;AACJ,CAAC;AAoBD,+EAA+E;AAC/E,0EAA0E;AAC1E,2EAA2E;AAC3E,6DAA6D;AAC7D,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,EACjE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACpE,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,2BAA2B;AAC3B,KAAK,UAAU,mBAAmB,CAChC,IAAY,EACZ,QAAgB,EAChB,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,CAAC,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,EAC5D,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACpE,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAY,EACZ,MAAc;IAEd,IAAI,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,CAAC,EACpE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACpE,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,yEAAyE;IACzE,wEAAwE;IACxE,oCAAoC;IACpC,MAAM,SAAS,GAAG,MAAM,eAAe,CACrC,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAC1C,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACpE,CAAC;IACF,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,CAAC,SAAS,CAAC,MAAM;SACrB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SAC1C,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAY,EACZ,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;QACE,KAAK;QACL,WAAW;QACX,QAAQ;QACR,gBAAgB;QAChB,aAAa;QACb,IAAI;QACJ,IAAI;QACJ,MAAM;KACP,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACpE,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CACjE,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,QAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI;QACjB,4CAA4C;QAC5C,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC/C,gEAAgE;QAChE,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC;QACrC,2EAA2E;QAC3E,8BAA8B;QAC9B,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC;KACrD,EAAE,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE;YACpD,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,IAAI,wBAAwB,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAC/E,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,CACL,UAAU,KAAK,mBAAmB;QAClC,UAAU,CAAC,UAAU,CAAC,GAAG,mBAAmB,GAAG,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAK9C;IASC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAChD,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,yBAAyB;YAChC,OAAO,EACL,8FAA8F;SACjG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,yBAAyB;YAChC,OAAO,EACL,4GAA4G;SAC/G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CACrD,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,CACzE,CAAC;QACF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,wBAAwB;YAC9B,KAAK,EAAE,yBAAyB;YAChC,OAAO,EACL,iFAAiF;gBACjF,sBAAsB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5C,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBACpB,CAAC,CAAC,6CAA6C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBACpE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;oBACjE,CAAC,CAAC,EAAE,CAAC;SACV,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAQ3C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;IACpC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,2DAA2D;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,kDAAkD;SAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,eAAe;YACtB,OAAO,EACL,sFAAsF;SACzF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,uEAAuE;YACvE,uEAAuE;YACvE,wDAAwD;YACxD,IAAI,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC9C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,mBAAmB;oBACzB,KAAK,EAAE,eAAe;oBACtB,OAAO,EACL,qFAAqF;wBACrF,iEAAiE;iBACpE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,+EAA+E;aACzF,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,eAAe;gBACtB,OAAO,EACL,iFAAiF;oBACjF,gFAAgF;oBAChF,gFAAgF;aACnF,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,yDAAyD;SACnE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,+EAA+E;SACzF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,CACzE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,wBAAwB;YAC9B,KAAK,EAAE,aAAa;YACpB,OAAO,EACL,0EAA0E;gBAC1E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CACrD,CAAC;IACF,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAC3C,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,qDAAqD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAC1C,IAAI,EACJ,QAAQ,CAAC,cAAc,EACvB,QAAQ,CACT,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC/D,CAAC"}