claude-flow 3.20.0 → 3.21.0

package/v3/@claude-flow/cli/dist/src/ruvector/run-transcript-recorder.js

@@ -0,0 +1,209 @@
+/**
+ * run-transcript-recorder.ts — Opt-in FULL run-transcript recorder for the
+ * weight-eft training-data export path (agenticow / ADR-150 weight-eft slice).
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * The existing `router-trajectory.ts` recorder captures only the ROUTING
+ * DECISION for a task: task text, embedding, scalar quality, tokens, cost.
+ * `@metaharness/weight-eft` needs something the routing recorder never had —
+ * the full ReAct message TRANSCRIPT, the produced patch, and a resolved
+ * boolean — to build SFT/DPO training rows. This module is that missing
+ * capture surface. It writes one JSON-line per completed run to
+ * `.swarm/run-transcripts.jsonl`, in a shape the archive-builder in
+ * `services/weight-eft.ts` maps directly to `DarwinTrajectory[]`.
+ *
+ * OFF BY DEFAULT (PII / RETENTION SURFACE)
+ * ----------------------------------------
+ * Rows carry the FULL prompt + assistant transcript + patch — a much larger
+ * PII/retention surface than the routing recorder. Mirroring why
+ * router-trajectory.ts is off-by-default, every write goes through the
+ * `CLAUDE_FLOW_RUN_TRANSCRIPTS=1` env gate. When unset (the default),
+ * `recordRunTranscript()` is a no-op. There is no way to enable it implicitly.
+ *
+ * HONESTY: `resolved` IS A PROXY
+ * ------------------------------
+ * `DarwinTrajectory.resolved` is meant to be GOLD-resolved status from the
+ * official SWE-bench harness. Ruflo has NO SWE-bench oracle. Every record
+ * therefore stamps `resolved_source` describing where the boolean actually
+ * came from, so no downstream consumer can mistake a proxy for gold:
+ *   - 'gold-oracle'      — a real conformant gold eval supplied it (never
+ *                          ruflo today; reserved for an external caller)
+ *   - 'output-verifier'  — ruflo's structural output-verifier confidence,
+ *                          thresholded — an EXPLICIT proxy
+ *   - 'api-success'      — the model returned without an API error — the
+ *                          weakest proxy (says nothing about correctness)
+ *   - 'external'         — supplied verbatim by the caller, provenance unknown
+ *
+ * ARCHITECTURAL CONSTRAINTS (mirror router-trajectory.ts / ADR-150)
+ * -----------------------------------------------------------------
+ * 1. OPT-IN — gated behind CLAUDE_FLOW_RUN_TRANSCRIPTS=1; default off.
+ * 2. NEVER THROWS — every fs op is try/caught at the append boundary; a
+ *    failed write is silent (DEBUG-logged) and never breaks the run.
+ * 3. NO metaharness COUPLING — this module imports nothing from
+ *    `@metaharness/*`; it only defines a portable record shape. The
+ *    services/weight-eft.ts archive-builder does the (optional) mapping.
+ *
+ * SCHEMA (versioned, additive) — one JSONL row per completed run:
+ *   { v, ts, instance_id, task_hash, model, tier, resolved, resolved_source,
+ *     messages[], model_patch, sample?, source?, tokens?, cost_usd? }
+ *
+ * @module run-transcript-recorder
+ */
+import { appendFileSync, mkdirSync, existsSync, statSync, renameSync, unlinkSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve as resolvePath } from 'node:path';
+import { taskHash } from './router-trajectory.js';
+let _cfg = null;
+let _cachedSize = -1;
+function getConfig() {
+    if (_cfg !== null)
+        return _cfg;
+    const swarmDir = process.env.CLAUDE_FLOW_SWARM_DIR ?? resolvePath(process.cwd(), '.swarm');
+    _cfg = {
+        enabled: process.env.CLAUDE_FLOW_RUN_TRANSCRIPTS === '1',
+        path: process.env.CLAUDE_FLOW_RUN_TRANSCRIPTS_PATH ?? join(swarmDir, 'run-transcripts.jsonl'),
+        maxSizeBytes: parseInt(process.env.CLAUDE_FLOW_RUN_TRANSCRIPTS_MAXSIZE ?? `${25 * 1024 * 1024}`, 10) | 0,
+        maxRotations: Math.max(0, parseInt(process.env.CLAUDE_FLOW_RUN_TRANSCRIPTS_MAXROTATIONS ?? '3', 10) || 3),
+    };
+    return _cfg;
+}
+function rotate(cfg) {
+    if (!existsSync(cfg.path))
+        return;
+    try {
+        if (cfg.maxRotations === 0) {
+            unlinkSync(cfg.path);
+            return;
+        }
+        const oldest = `${cfg.path}.${cfg.maxRotations}`;
+        if (existsSync(oldest))
+            unlinkSync(oldest);
+        for (let i = cfg.maxRotations - 1; i >= 1; i--) {
+            const src = `${cfg.path}.${i}`;
+            if (existsSync(src))
+                renameSync(src, `${cfg.path}.${i + 1}`);
+        }
+        renameSync(cfg.path, `${cfg.path}.1`);
+    }
+    catch {
+        try {
+            unlinkSync(cfg.path);
+        }
+        catch { /* */ }
+    }
+    _cachedSize = 0;
+}
+function appendRow(row) {
+    const cfg = getConfig();
+    if (!cfg.enabled)
+        return;
+    try {
+        const dir = dirname(cfg.path);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        if (_cachedSize < 0) {
+            _cachedSize = existsSync(cfg.path) ? statSync(cfg.path).size : 0;
+        }
+        const line = JSON.stringify(row) + '\n';
+        const bytes = Buffer.byteLength(line, 'utf8');
+        if (cfg.maxSizeBytes > 0 && _cachedSize + bytes > cfg.maxSizeBytes)
+            rotate(cfg);
+        appendFileSync(cfg.path, line);
+        _cachedSize += bytes;
+    }
+    catch (e) {
+        if (process.env.DEBUG) {
+            // eslint-disable-next-line no-console
+            console.error('run-transcript: appendRow failed:', e.message);
+        }
+        // Never throw — transcript collection must never break a run.
+    }
+}
+// ============================================================================
+// Public API
+// ============================================================================
+/**
+ * Record one completed run transcript. Cheap — a single appendFileSync of a
+ * JSONL row. No-op when CLAUDE_FLOW_RUN_TRANSCRIPTS is unset (the default).
+ * Never throws.
+ *
+ * `resolvedSource` is REQUIRED so a proxy can never masquerade as gold. If you
+ * only have "the API returned", pass 'api-success' — the honest weakest label.
+ */
+export function recordRunTranscript(args) {
+    const cfg = getConfig();
+    const hash = taskHash(args.task);
+    const instanceId = args.instanceId ?? `run-${hash}`;
+    if (!cfg.enabled)
+        return { recorded: false, instanceId, taskHash: hash };
+    const row = {
+        v: 1,
+        ts: new Date().toISOString(),
+        instance_id: instanceId,
+        task_hash: hash,
+        model: args.model,
+        tier: args.tier,
+        resolved: args.resolved,
+        resolved_source: args.resolvedSource,
+        messages: args.messages,
+        model_patch: args.modelPatch ?? '',
+        ...(args.sample !== undefined ? { sample: args.sample } : {}),
+        ...(args.source ? { source: args.source } : {}),
+        ...(args.tokens ? { tokens: args.tokens } : {}),
+        ...(args.costUsd != null ? { cost_usd: args.costUsd } : {}),
+    };
+    appendRow(row);
+    return { recorded: true, instanceId, taskHash: hash };
+}
+/**
+ * Read + parse the run-transcript JSONL back into records. Used by the
+ * archive-builder (`services/weight-eft.ts`). Malformed lines are skipped and
+ * counted, never thrown. Returns `[]` if the file is absent.
+ */
+export function readRunTranscripts(path) {
+    const p = path ?? getConfig().path;
+    if (!existsSync(p))
+        return { records: [], malformed: 0, path: p };
+    const records = [];
+    let malformed = 0;
+    try {
+        for (const line of readFileSync(p, 'utf8').split('\n')) {
+            if (!line.trim())
+                continue;
+            try {
+                const r = JSON.parse(line);
+                if (r && typeof r === 'object' && r.v === 1 && r.instance_id && Array.isArray(r.messages)) {
+                    records.push(r);
+                }
+                else {
+                    malformed++;
+                }
+            }
+            catch {
+                malformed++;
+            }
+        }
+    }
+    catch {
+        // unreadable file — treat as empty, never throw
+    }
+    return { records, malformed, path: p };
+}
+/** Map a ruflo model tier label to the weight-eft policy tier. */
+export function tierForModel(model) {
+    // haiku (and any explicitly-cheap label) → 'cheap' (cascade first tier).
+    // sonnet / opus / everything else → 'frontier' (the escalation tier).
+    if (!model)
+        return 'frontier';
+    return /haiku/i.test(model) ? 'cheap' : 'frontier';
+}
+/** Diagnostic for status/CLI. */
+export function runTranscriptRecorderStatus() {
+    return { ...getConfig() };
+}
+/** @internal — test seam: reset cached config so tests can flip env vars. */
+export function __resetRunTranscriptRecorderForTests() {
+    _cfg = null;
+    _cachedSize = -1;
+}
+//# sourceMappingURL=run-transcript-recorder.js.map

package/v3/@claude-flow/cli/dist/src/services/checkpoint-gate.d.ts

@@ -0,0 +1,140 @@
+/**
+ * CheckpointGate — agenticow-backed checkpoint/rollback gate for autopilot
+ * loops and long-horizon workflows (agenticow integration, step 3).
+ *
+ * ── The pattern ───────────────────────────────────────────────────────────
+ * Before a risky loop tick that mutates `.rvf` memory, take an O(1) agenticow
+ * checkpoint (162 bytes, fixed cost — see mcp-tools/agenticow-tools.ts). Run
+ * the tick. If it regresses — throws, or the caller's verdict says the outcome
+ * got worse (verifier fail / error / worse metric) — roll the memory back to
+ * the checkpoint. Rollback is O(edits-since-checkpoint), NOT an O(N) rebuild,
+ * and the earlier history stays intact via the `.agenticow.json` lineage
+ * manifest. On success the checkpoint is simply kept as the new good baseline.
+ *
+ * The three lifecycle verbs (checkpoint / rollback / promote) already exist in
+ * the `agenticow` package and are surfaced as MCP tools in
+ * `mcp-tools/agenticow-tools.ts`. This module is the *orchestration hook* that
+ * calls them from inside a loop — the MCP surface is for agents, this is for
+ * the in-process loop.
+ *
+ * ── Architectural constraint (ADR-150) ────────────────────────────────────
+ * `agenticow` lives in `optionalDependencies` and must NEVER be a hard runtime
+ * dependency. This gate degrades gracefully in three ways, each of which runs
+ * the tick UNGUARDED rather than failing:
+ *   1. package missing            → { degraded: true, reason: 'agenticow-not-found' }
+ *   2. kill-switch env set         → { degraded: true, reason: 'kill-switch' }
+ *   3. no memory path configured   → { degraded: true, reason: 'no-memory-path' }
+ * The package is lazy-loaded on the first guard() call, so importing this
+ * module has zero startup cost.
+ *
+ * The optional-dep loader + path/label/lineage helpers are the canonical ones
+ * from `mcp-tools/agenticow-loader.ts` — one implementation shared across every
+ * agenticow consumer (verbs, swarm branches, speculative, oracle, this gate).
+ *
+ * @module @claude-flow/cli/services/checkpoint-gate
+ */
+/**
+ * Env var pointing at the `.rvf` memory file that a long-horizon loop mutates.
+ * When set, the autopilot loop opts in to checkpoint/rollback around each tick.
+ * When unset, the gate is a transparent pass-through.
+ */
+export declare const CHECKPOINT_MEM_ENV = "CLAUDE_FLOW_AUTOPILOT_CHECKPOINT_MEM";
+/**
+ * Kill switch. When truthy (`1`/`true`/`yes`), the gate never touches agenticow
+ * and every guard() runs the tick unguarded. Lets an operator disable the
+ * feature without changing config or code.
+ */
+export declare const KILL_SWITCH_ENV = "CLAUDE_FLOW_AGENTICOW_DISABLE";
+/** Outcome of a guarded tick. `result` is undefined only when the tick threw
+ *  AND `rethrow` was disabled. */
+export interface CheckpointGuardResult<T> {
+    /** The value fn() returned (undefined if it threw with rethrow:false). */
+    result: T | undefined;
+    /** True when a checkpoint was actually taken before running fn. */
+    checkpointed: boolean;
+    /** True when memory was rolled back to the checkpoint (throw or regression). */
+    rolledBack: boolean;
+    /** True when the gate could not engage agenticow and ran fn unguarded. */
+    degraded: boolean;
+    /** Machine-readable reason for degraded / rollback. */
+    reason?: string;
+    /** The checkpoint label, when one was taken. */
+    checkpointLabel?: string;
+    /** The error fn() threw, when rethrow was disabled. */
+    error?: unknown;
+}
+export interface GuardOptions<T> {
+    /**
+     * Verdict function: return true when `result` represents a regression that
+     * should trigger a rollback. Defaults to treating `{success:false}` /
+     * `{ok:false}` / `{regressed:true}` as regressions.
+     */
+    isRegression?: (result: T) => boolean;
+    /**
+     * When the tick throws: roll back, then re-throw the original error
+     * (default true). Set false to swallow the error and return it on the
+     * result object instead — useful when the loop must never crash.
+     */
+    rethrow?: boolean;
+    /** Optional checkpoint id to roll back to (defaults to most recent). */
+    checkpointId?: string;
+}
+export declare class CheckpointGate {
+    /** True when the kill-switch env is set to a truthy value. */
+    static isKillSwitchSet(): boolean;
+    /** The configured loop memory path, or undefined when the feature is off. */
+    static configuredMemPath(): string | undefined;
+    /**
+     * Lazy-load agenticow. Returns null when the package is absent (optional dep)
+     * or the kill switch is set. Any *other* import error is re-thrown — a broken
+     * install should be loud, a missing optional dep should be silent.
+     */
+    private load;
+    /** True when agenticow can be engaged (present + not killed). */
+    available(): Promise<boolean>;
+    /**
+     * Take a checkpoint on the given `.rvf` memory file. Non-throwing except for
+     * validation errors (path traversal, bad label) — those are surfaced so a
+     * misconfiguration is caught early.
+     */
+    checkpoint(memPath: string, label: string): Promise<{
+        ok: boolean;
+        degraded: boolean;
+        reason?: string;
+        checkpoint?: unknown;
+    }>;
+    /**
+     * Roll the given `.rvf` memory file back to a checkpoint. Discards edits made
+     * since (O(edits-since-checkpoint)). Omit `checkpointId` to target the most
+     * recent checkpoint.
+     */
+    rollback(memPath: string, checkpointId?: string): Promise<{
+        ok: boolean;
+        degraded: boolean;
+        reason?: string;
+        result?: unknown;
+    }>;
+    /**
+     * Guard a risky loop tick with a checkpoint/rollback bracket.
+     *
+     *   const outcome = await gate.guard(memPath, 'iter-7', async () => runTick());
+     *
+     * Behaviour:
+     *   - No memPath / kill-switch / agenticow-absent → run fn unguarded, degraded:true.
+     *   - Checkpoint fails to engage (degraded) → run fn unguarded, degraded:true.
+     *   - fn throws → roll back to checkpoint, then re-throw (unless rethrow:false).
+     *   - fn returns a regression verdict → roll back, return result with rolledBack:true.
+     *   - fn succeeds → keep the checkpoint, return result with rolledBack:false.
+     *
+     * The gate is non-fatal: an internal agenticow failure never masks fn()'s own
+     * result — if checkpointing throws, fn still runs unguarded.
+     */
+    guard<T>(memPath: string | undefined, label: string, fn: () => Promise<T>, opts?: GuardOptions<T>): Promise<CheckpointGuardResult<T>>;
+    /** Roll back without throwing — used on the failure path so a rollback error
+     *  never masks the original tick failure. */
+    private safeRollback;
+}
+export declare function getCheckpointGate(): CheckpointGate;
+/** Reset the lazy-load cache — test-only. */
+export declare function __resetCheckpointGateForTests(): void;
+//# sourceMappingURL=checkpoint-gate.d.ts.map

package/v3/@claude-flow/cli/dist/src/services/checkpoint-gate.js

@@ -0,0 +1,223 @@
+/**
+ * CheckpointGate — agenticow-backed checkpoint/rollback gate for autopilot
+ * loops and long-horizon workflows (agenticow integration, step 3).
+ *
+ * ── The pattern ───────────────────────────────────────────────────────────
+ * Before a risky loop tick that mutates `.rvf` memory, take an O(1) agenticow
+ * checkpoint (162 bytes, fixed cost — see mcp-tools/agenticow-tools.ts). Run
+ * the tick. If it regresses — throws, or the caller's verdict says the outcome
+ * got worse (verifier fail / error / worse metric) — roll the memory back to
+ * the checkpoint. Rollback is O(edits-since-checkpoint), NOT an O(N) rebuild,
+ * and the earlier history stays intact via the `.agenticow.json` lineage
+ * manifest. On success the checkpoint is simply kept as the new good baseline.
+ *
+ * The three lifecycle verbs (checkpoint / rollback / promote) already exist in
+ * the `agenticow` package and are surfaced as MCP tools in
+ * `mcp-tools/agenticow-tools.ts`. This module is the *orchestration hook* that
+ * calls them from inside a loop — the MCP surface is for agents, this is for
+ * the in-process loop.
+ *
+ * ── Architectural constraint (ADR-150) ────────────────────────────────────
+ * `agenticow` lives in `optionalDependencies` and must NEVER be a hard runtime
+ * dependency. This gate degrades gracefully in three ways, each of which runs
+ * the tick UNGUARDED rather than failing:
+ *   1. package missing            → { degraded: true, reason: 'agenticow-not-found' }
+ *   2. kill-switch env set         → { degraded: true, reason: 'kill-switch' }
+ *   3. no memory path configured   → { degraded: true, reason: 'no-memory-path' }
+ * The package is lazy-loaded on the first guard() call, so importing this
+ * module has zero startup cost.
+ *
+ * The optional-dep loader + path/label/lineage helpers are the canonical ones
+ * from `mcp-tools/agenticow-loader.ts` — one implementation shared across every
+ * agenticow consumer (verbs, swarm branches, speculative, oracle, this gate).
+ *
+ * @module @claude-flow/cli/services/checkpoint-gate
+ */
+import { loadAgenticow, __resetAgenticowCache, resolveMemoryPath, manifestFor, validateLabel, openWithLineage, } from '../mcp-tools/agenticow-loader.js';
+/**
+ * Env var pointing at the `.rvf` memory file that a long-horizon loop mutates.
+ * When set, the autopilot loop opts in to checkpoint/rollback around each tick.
+ * When unset, the gate is a transparent pass-through.
+ */
+export const CHECKPOINT_MEM_ENV = 'CLAUDE_FLOW_AUTOPILOT_CHECKPOINT_MEM';
+/**
+ * Kill switch. When truthy (`1`/`true`/`yes`), the gate never touches agenticow
+ * and every guard() runs the tick unguarded. Lets an operator disable the
+ * feature without changing config or code.
+ */
+export const KILL_SWITCH_ENV = 'CLAUDE_FLOW_AGENTICOW_DISABLE';
+function defaultIsRegression(result) {
+    if (!result || typeof result !== 'object')
+        return false;
+    const r = result;
+    return r.success === false || r.ok === false || r.regressed === true;
+}
+// ── The gate ────────────────────────────────────────────────────────────────
+export class CheckpointGate {
+    /** True when the kill-switch env is set to a truthy value. */
+    static isKillSwitchSet() {
+        const v = (process.env[KILL_SWITCH_ENV] || '').trim().toLowerCase();
+        return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+    }
+    /** The configured loop memory path, or undefined when the feature is off. */
+    static configuredMemPath() {
+        const p = (process.env[CHECKPOINT_MEM_ENV] || '').trim();
+        return p || undefined;
+    }
+    /**
+     * Lazy-load agenticow. Returns null when the package is absent (optional dep)
+     * or the kill switch is set. Any *other* import error is re-thrown — a broken
+     * install should be loud, a missing optional dep should be silent.
+     */
+    async load() {
+        if (CheckpointGate.isKillSwitchSet())
+            return null;
+        // Delegates to the canonical loader (#22) — one cache, one degradation
+        // policy shared across every agenticow consumer.
+        return loadAgenticow();
+    }
+    /** True when agenticow can be engaged (present + not killed). */
+    async available() {
+        return (await this.load()) !== null;
+    }
+    /**
+     * Take a checkpoint on the given `.rvf` memory file. Non-throwing except for
+     * validation errors (path traversal, bad label) — those are surfaced so a
+     * misconfiguration is caught early.
+     */
+    async checkpoint(memPath, label) {
+        const api = await this.load();
+        if (!api)
+            return { ok: false, degraded: true, reason: CheckpointGate.isKillSwitchSet() ? 'kill-switch' : 'agenticow-not-found' };
+        const path = resolveMemoryPath(String(memPath));
+        const lbl = validateLabel(String(label));
+        const mem = await openWithLineage(api, path);
+        try {
+            const cp = await mem.checkpoint(lbl);
+            await mem.save?.(manifestFor(path));
+            return { ok: true, degraded: false, checkpoint: cp };
+        }
+        finally {
+            await mem.close?.();
+        }
+    }
+    /**
+     * Roll the given `.rvf` memory file back to a checkpoint. Discards edits made
+     * since (O(edits-since-checkpoint)). Omit `checkpointId` to target the most
+     * recent checkpoint.
+     */
+    async rollback(memPath, checkpointId) {
+        const api = await this.load();
+        if (!api)
+            return { ok: false, degraded: true, reason: CheckpointGate.isKillSwitchSet() ? 'kill-switch' : 'agenticow-not-found' };
+        const path = resolveMemoryPath(String(memPath));
+        const mem = await openWithLineage(api, path);
+        try {
+            const r = checkpointId ? await mem.rollback(checkpointId) : await mem.rollback();
+            await mem.save?.(manifestFor(path));
+            return { ok: true, degraded: false, result: r };
+        }
+        finally {
+            await mem.close?.();
+        }
+    }
+    /**
+     * Guard a risky loop tick with a checkpoint/rollback bracket.
+     *
+     *   const outcome = await gate.guard(memPath, 'iter-7', async () => runTick());
+     *
+     * Behaviour:
+     *   - No memPath / kill-switch / agenticow-absent → run fn unguarded, degraded:true.
+     *   - Checkpoint fails to engage (degraded) → run fn unguarded, degraded:true.
+     *   - fn throws → roll back to checkpoint, then re-throw (unless rethrow:false).
+     *   - fn returns a regression verdict → roll back, return result with rolledBack:true.
+     *   - fn succeeds → keep the checkpoint, return result with rolledBack:false.
+     *
+     * The gate is non-fatal: an internal agenticow failure never masks fn()'s own
+     * result — if checkpointing throws, fn still runs unguarded.
+     */
+    async guard(memPath, label, fn, opts = {}) {
+        const rethrow = opts.rethrow !== false;
+        const isRegression = opts.isRegression ?? defaultIsRegression;
+        // Fast paths: feature off → transparent pass-through.
+        if (!memPath) {
+            const result = await fn();
+            return { result, checkpointed: false, rolledBack: false, degraded: true, reason: 'no-memory-path' };
+        }
+        if (CheckpointGate.isKillSwitchSet()) {
+            const result = await fn();
+            return { result, checkpointed: false, rolledBack: false, degraded: true, reason: 'kill-switch' };
+        }
+        // Try to checkpoint. Any failure here degrades to unguarded — the loop must
+        // never break because memory branching is unavailable.
+        let checkpointed = false;
+        try {
+            const cp = await this.checkpoint(memPath, label);
+            if (!cp.ok) {
+                const result = await fn();
+                return { result, checkpointed: false, rolledBack: false, degraded: true, reason: cp.reason };
+            }
+            checkpointed = true;
+        }
+        catch (err) {
+            const result = await fn();
+            return {
+                result,
+                checkpointed: false,
+                rolledBack: false,
+                degraded: true,
+                reason: `checkpoint-error: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        // Run the tick under the checkpoint.
+        let result;
+        try {
+            result = await fn();
+        }
+        catch (err) {
+            const rb = await this.safeRollback(memPath, opts.checkpointId);
+            if (rethrow)
+                throw err;
+            return {
+                result: undefined,
+                checkpointed,
+                rolledBack: rb,
+                degraded: false,
+                reason: 'tick-threw',
+                checkpointLabel: label,
+                error: err,
+            };
+        }
+        // Verdict: regression → roll back, keep the returned result for the caller.
+        if (isRegression(result)) {
+            const rb = await this.safeRollback(memPath, opts.checkpointId);
+            return { result, checkpointed, rolledBack: rb, degraded: false, reason: 'regression-verdict', checkpointLabel: label };
+        }
+        // Success → keep the checkpoint as the new baseline.
+        return { result, checkpointed, rolledBack: false, degraded: false, checkpointLabel: label };
+    }
+    /** Roll back without throwing — used on the failure path so a rollback error
+     *  never masks the original tick failure. */
+    async safeRollback(memPath, checkpointId) {
+        try {
+            const r = await this.rollback(memPath, checkpointId);
+            return r.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/** Shared process-wide gate instance. */
+let _shared = null;
+export function getCheckpointGate() {
+    if (!_shared)
+        _shared = new CheckpointGate();
+    return _shared;
+}
+/** Reset the lazy-load cache — test-only. */
+export function __resetCheckpointGateForTests() {
+    __resetAgenticowCache();
+    _shared = null;
+}
+//# sourceMappingURL=checkpoint-gate.js.map