clinkx 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -1,6 +1,44 @@
 # Changelog
 
-## Unreleased
+## 1.1.2 — 2026-10-09
+
+### Added
+
+- Built-in `architecture-comparison` through `run_workflow`: two parallel authors receive the same bounded frozen packet, a fresh judge receives a separate semantic view with candidate aliases, and a deterministic reducer writes a strict owner-facing comparison record. References, output bounds, retained artifact digests, route bindings, and resume inputs are checked; incomplete evidence stays incomplete. The record preserves independent owner acceptance and states the limits of caller-declared source identity and free-text anonymity.
+- Native `workflow_verification_attach` re-inspects project proof with the owner's original expectations digest and retains a bounded, separately versioned inspection history on a workflow run. MCP status and dashboard detail expose inspected-at applicability, required coverage, check failures and safe digest references, with retention and owner acceptance kept separate. Progress-report test counts remain caller-reported.
+- Native MCP tools `provider_doctor`, `verification_run`, and `verification_inspect` work from an npm installation without a ClinkX clone or client shell access. Readiness is structured and authentication probes are explicit. Project verification runs reviewed argv commands within allowed roots, binds required checks to declared input and verifier identities, and retains private evidence for inspection with the owner's original expectations digest. The proposed standalone doctor/verifier npm CLI entry points were withdrawn before release. No Git or browser is required for project checks.
+- Packaged engineering-recipe wiring, verification overview, project-check guide, and example manifest. Recipe instructions remain in the separately installed companion `chief-of-staff` skill; ClinkX's dashboard and workflow-handoff regression fixtures remain source-only.
+- A source-checkout workflow-handoff verification procedure using the real YAML loader, MCP child session, workflow engine, validators, and artifact store. A host coverage evaluator checks frozen requirements and retained evidence; offline inspection requires the owner's original expectations digest and ignores cached success claims.
+- `scripts/provider-doctor.mjs` remains a source-checkout JSONL wrapper over the shared provider-doctor core. The MCP tool returns structured adapter readiness and a final verdict; all diagnostics are credential-redacted. Documented in `docs/configuration.md`.
+- A real-disk doctor (`clinkx-workflows/dashboard-ui/e2e/real-disk-doctor.mjs`) gates the dashboard real-disk e2e procedure: `preflight` checks node, dist freshness, chromium, the test-child seam, and an isolated `EVIDENCE_ROOT` before exercising the real fixture, `classify` maps a finished run to passed / blocked / not_run / harness_drift / failed_assertion / failed_fixture, and `identity` binds a run to its checkout and built artifacts. `docs/verification/dashboard-real-disk.md` documents the repeatable procedure.
+- A "Verified bug fix" recipe in `docs/engineering-recipes.md`.
+
+### Fixed
+
+- Dashboard-doctor Chromium preflight now removes only its owned profile and artifact directory, preserving other concurrent Playwright runs.
+- Provider-doctor interruption stops all concurrent version checks and cancels active authentication probes with their owned descendants before exiting.
+- Provider-doctor probes enforce their own 120-second cancellation deadline regardless of an adapter's timeout floor and require an exit-zero stdout or validated result-contract-file result with the exact trimmed `OK` answer before reporting authentication success.
+- Workflow-handoff inspection preserves independently observed execution, consumer, and cleanup failures when source/build identity has drifted.
+- Secret-redaction warnings deduplicate line numbers with a `Set`, preserving their ordering and bounded output without quadratic array scans.
+- `context_builder` opt-out secret redaction (`allow_secrets:false`) can no longer gut ordinary code: a quote inside a regex literal or a mid-value `key: quote` no longer opens a redaction span that runs to the end of the file, an in-place redaction that would move line breaks or span more than three lines omits the body fail-closed instead of shipping it redacted, and remaining redactions surface as one aggregate `content_secret_redacted` warning. `CONTEXT_DISCOVERY_ALGORITHM_VERSION` advances to 6.
+- A repeated SIGTERM no longer kills the dashboard, dashboard gateway, and server mid-shutdown: SIGTERM/SIGHUP handlers stay installed for repeats, teardown exits explicitly, and the dashboard and gateway close under an 8-second deadline that forces exit if closing stalls.
+- Codex app-server diagnostics now redact hyphenated vendor tokens (`sk-ant-`, `sk-proj-`, `sk-or-`) in stderr and recent-failure text.
+
+### Docs
+
+- Recipe wiring pins the merged three-recipe companion revision and records the completed evaluation and settled secret-policy decision.
+- The pstack integration evaluation for ClinkX (reports, three-arm evaluation protocol, and implementation plan under `.ai/plans/`), the dashboard verification runbook (`docs/verification/`), and the opt-out redaction bound in the context-builder notes.
+
+## 1.1.1 — 2026-10-05
+
+### Changed
+
+- The npm package now ships `docs/configuration.md` and `docs/security.md`, and the README is rewritten as a self-contained, install-facing page in Simplified Technical English. `package.json` `homepage` points at the npm package page and `bugs` is removed, because the source repository is private.
+
+### Fixed
+
+- `context_builder` secret scanning (`allow_secrets:false`) on large bodies is 6-8x faster on Node 24: comment masking now returns the input string when nothing is masked, so memo lookups no longer compare a distinct but equal copy of the whole body. Output is unchanged.
+- npm publish confirmation now waits up to about eight minutes for npm to expose the new version instead of failing after a few seconds; 1.1.0's automated publish succeeded but failed confirmation and needed a manual re-run to go green.
 
 ## 1.1.0 — 2026-10-03
 

package/README.md

@@ -1,146 +1,204 @@
 # ClinkX
 
-An MCP STDIO server with local tools for CLI delegation and workflow orchestration.
+ClinkX is an MCP server that connects your AI coding assistant to other command-line AI agents. It runs Codex, Claude Code, agy, GLM, or Grok as child processes and returns their output as MCP tool results. You can send one task to one agent. You can run a council of many agents on one question. You can also build a context bundle for a later task.
 
-- `clink` runs a configured CLI adapter (agy, Codex, Claude, Grok, or anything you add) as a subprocess and returns the output.
-- `context_builder` writes a persisted context bundle from allowed local roots. Selection is deterministic by default. You can also run explicit curator and finalizer adapters, then the server validates and materializes locally.
-- `list_workflows`, `resume_workflow`, and `run_workflow` run multi-stage workflows.
+ClinkX uses MCP over STDIO. It works with any MCP client that can start a local command.
 
-Adapters come from config. There is no hardcoded CLI allowlist. Field-level PAL compatibility is intentional.
+## Requirements
 
-## Quick start
+- Node.js 24.0.0 or later.
+- At least one of these command-line tools on your `PATH`: `codex`, `claude`, `agy`, or `grok`. The `glm` adapter also uses the `claude` command.
+- The `codex` command, if you run workflows. Workflows use Codex to select repository context before the first stage. See [Workflows](#workflows) for the opt-out switch.
 
-Node.js >= 24, plus at least one CLI adapter.
+## Installation
 
-```bash
-npm install
-npm run build:all
-node dist/index.js
-```
-
-stdout is MCP JSON-RPC only (one JSON object per line). Logs go to stderr.
-
-Reviewed version bumps publish through CI after main checks pass. See
-[npm releases](docs/npm-releases.md) for trusted publisher setup, release policy,
-artifact verification, and recovery.
-
-Both STDIO servers detect parent death even when stdin never delivers EOF.
-Idle shutdown is separately opt-in: `CLINKX_SERVER_IDLE_TIMEOUT_SECONDS=1800`
-enables a 30-minute idle lifetime, while the default `0` preserves quiet
-sessions. Active work and response delivery prevent idle expiry. Enable it only
-for hosts that can reconnect; restart loses process-local session aliases and
-logs. See [STDIO server lifetime](docs/configuration.md#stdio-server-lifetime)
-for shutdown reasons and parent-wrapper limitations.
-
-## Local workflow dashboard
-
-After `npm run build:all`:
+Add ClinkX to the MCP server list of your client. The exact file and format depend on the client. This is the common JSON shape:
 
-```bash
-node dist/dashboard-cli.js --port 0
+```json
+{
+  "mcpServers": {
+    "clinkx": {
+      "command": "npx",
+      "args": ["-y", "clinkx@latest"],
+      "env": {
+        "CLINKX_ALLOWED_ROOTS": "/path/to/your/workspace",
+        "CLINKX_WORKFLOWS_WORKSPACE_ROOT": "/path/to/your/workspace"
+      }
+    }
+  }
+}
 ```
 
-Passkey auth is the default. The process binds `127.0.0.1` and `::1` on the same port and prints `http://localhost:<port>`. An empty credential store also prints one enrollment code. Register a passkey with that code, then sign in as a separate step. Credentials live under `CLINKX_WORKFLOWS_DASHBOARD_CREDENTIAL_DIR` (default `${CLINKX_WORKFLOWS_STATE_DIR}/dashboard/webauthn`). Sessions die on restart.
-
-Screens: Runs, Single Calls, Context Runs, Workflows, Adapters, Artifacts. They show retained workflow state, direct-call lifecycle, standalone/refine context-builder lifecycle, persisted pre-dispatch workflow input, final outputs and errors, validated JSON artifacts, and the launch-time workflow/adapter catalogs. Runs, Single Calls, and Context Runs have their own path routes. The persisted-call inspector is an overlay that still shows up as a nested route in history.
-
-Workflow-call, activity, and context-run detail pages also have local session logs (observability only). Timeline and Conversation are chronological; order comes from the log sequence. Each lane is fenced to one immutable parent generation (run, activity, or context) plus the matching attempt, turn, or curator/finalizer execution. Pages are at most 500 events. A lane stops at 100,000 events. Events are normalized and pattern-redacted. They are not raw provider payloads, a session browser, or a live tail.
-
-Live tool arguments, sanitized argument-derived summaries, and `redaction.coverage: "pattern_best_effort"` require `CLINKX_SESSION_LOG_TOOL_ARGUMENTS_PERSISTENCE_ENABLED=true` (exact value, default off, read once per producer at creation). Disabled producers omit those additions; Claude keeps `"Tool invocation"` and Codex/agy keep legacy summaries. Deploy capable backend and browser readers first; readers always accept extended events. Rollback disables producers first and keeps capable readers until extended journals age out. Flag-off does not make existing gate-on journals old-reader-safe. Redaction hardening remains unconditional; coverage and match counts do not prove cleanliness. See [rollout configuration](docs/configuration.md#session-log-tool-arguments-rollout) and [detector scope](docs/security.md#dashboard-session-logs).
-
-The [native projection foundation](clinkx-workflows/src/dashboard/native-transcript/README.md) is unwired and persists nothing, independently of that gate. It handles JSON and text results, preserves source-file/component order, and scopes unverified synthesized identity to the affected call/result pair. Native capture, workers, storage, routes, and UI remain unfinished; #56 stays open.
+Set the two paths to the directory that tool calls can reference. Use absolute paths.
 
-The dashboard has no SSE, filesystem watch, worker-health inference, cross-process cancellation, or run-creation form. Session logs cannot replay, approve, cancel, or otherwise control a run. Copied action objects are MCP tool handoffs, not JSON-RPC requests.
-
-Point the dashboard at the same `CLINKX_WORKFLOWS_STATE_DIR` as the workflow process or you will see a different (often empty) run set. Successful sync and async runs are kept for one day by default so you can inspect them. `CLINKX_WORKFLOWS_RETAIN_SUCCEEDED_DAYS=0` or `CLINKX_WORKFLOWS_RETAIN_ASYNC_DAYS=0` means keep that class forever, which can fill the disk.
-
-Workflow and activity session logs follow retention of that exact parent generation. Context session logs follow the parent context-run/manual lifecycle. There is no separate context-run pruner yet.
-
-Persisted inputs, outputs, errors, and artifact bytes can be sensitive. Access is loopback-only and passkey-gated. That is a shared-account boundary, not isolation from other processes as the same OS user. Redaction strips high-confidence credentials and user-home paths before write. Prompts, outputs, tool summaries, and reasoning can still be sensitive after that. Per-run state admission defaults to 16 MiB (configurable 1–64 MiB via `CLINKX_WORKFLOWS_DASHBOARD_MAX_STATE_BYTES`). Raw result/call reads use smaller fixed caps.
-
-For local Docker, `compose.dashboard-local.yml` runs the real UI + API over plain HTTP. Caddy publishes on `127.0.0.1` and `::1`. The browser uses `http://localhost:<port>`. Caddy shares the dashboard network namespace and proxies IPv4 to Node at `127.0.0.1:4180`. The same Node process also listens on `::1:4180`. See `docs/dashboard-local-compose.md`.
-
-Hosted passkey topology is one UI+API service behind Traefik on a private Docker network. See `deploy/dashboard-cloud/README.md`. The older gateway/companion and split-origin paths exist only as a temporary bearer rollback until local and live cloud passkey ceremonies pass the proof-gated cutover.
-
-To build the local CLI as one host-native executable, use an official Node 25.5+ runtime with SEA support:
+To install ClinkX globally, run this command. Then set `"command": "clinkx"` with no `args`:
 
 ```bash
-npm run build:dashboard:standalone -- \
-  --node-executable /absolute/path/to/official-node \
-  --output ./artifacts/clinkx-dashboard
+npm install -g clinkx
 ```
 
-The binary embeds the dashboard UI, bundled configuration, workflows, and templates. At runtime it still reads state, context runs, and the inspected workspace from the usual environment paths.
+Restart your MCP client after you change its configuration. To control when upgrades happen, replace `clinkx@latest` with a fixed version.
 
-## Configuration
-
-Adapter JSON is discovered in this order:
-
-1. `CLINKX_CONFIG_PATH` (file or directory). This replaces the whole search path. Shipped adapters are not loaded.
-2. `${XDG_CONFIG_HOME:-~/.config}/clinkx/adapters/*.json`. First-wins on `name`.
-3. Packaged `conf/adapters/*.json` next to the installed package (`import.meta.url`). Not `process.cwd()`.
+## First call
 
-A `conf/adapters/*.json` file in the current working directory is ignored unless `CLINKX_CONFIG_PATH` points at it. Full reference: `docs/configuration.md`.
-
-Per-call model and effort are optional and require support declared by the resolved adapter:
+Ask your assistant to use the `clink` tool. This is the smallest valid request:
 
 ```json
-{"cli_name":"codex","prompt":"Summarize the module boundaries without editing files.","model":"gpt-5.4","effort":"low"}
+{
+  "cli_name": "codex",
+  "prompt": "Summarize the module boundaries in this project. Do not edit files.",
+  "absolute_file_paths": ["/path/to/your/workspace/src/server.ts"]
+}
 ```
 
-Omit either field to retain that CLI setting. Unsupported overrides fail with MCP `-32602` before spawning; XDG adapter files must declare their own override support.
+ClinkX starts the Codex CLI, sends the prompt and the file references, and returns the final answer. You can run many `clink` calls at the same time, up to the concurrency limit.
 
-Dashboard deployment controls:
+## Tools
 
-| Setting | Contract |
+| Tool | Function |
 |---|---|
-| `CLINKX_WORKFLOWS_DASHBOARD_CREDENTIAL_DIR` | Optional absolute, non-root credential directory. Host default: `${CLINKX_WORKFLOWS_STATE_DIR}/dashboard/webauthn`. Compose pins the writable `/data/dashboard-credentials` volume. |
-| `DASHBOARD_DEPLOYMENT_SLUG` | Required Compose identity, `^[a-z][a-z0-9-]{0,31}$`. Local and cloud names keep distinct stack-kind prefixes. |
-| `DASHBOARD_CREDENTIAL_BOOTSTRAP_MODE` | Required Compose state assertion. First start is `bootstrap`. Flip to `existing-enrolled` right after enrollment, before restart. |
+| `clink` | Runs one task on one configured CLI and returns the result. |
+| `context_builder` | Selects a bounded set of files from permitted roots and writes a reusable context bundle to disk. |
+| `refine_context_run` | Makes a new bundle from an earlier one. You can add, remove, promote, or demote files, or set their slices. |
+| `provider_doctor` | Checks provider configuration, executables, and startup readiness. Optional explicit probes make real authentication calls. |
+| `verification_run` | Runs a reviewed project-check manifest and retains private evidence with a digest for later inspection. |
+| `verification_inspect` | Reassesses retained evidence using the original owner-held digest, without running project commands. |
+| `workflow_verification_attach` | Re-inspects proof with the original owner-held digest and records its historical coverage on a workflow run. |
+| `list_workflows` | Lists the available workflows, CLIs, and roster presets. |
+| `run_workflow` | Starts a multi-stage workflow. Runs in blocking mode by default, or in the background with `async: true`. |
+| `workflow_run_status` | Reports the progress and result of a workflow run. |
+| `resume_workflow` | Continues a workflow run that stopped before completion. |
+| `cancel_workflow` | Cancels a workflow run. |
+| `progress_report_start`, `progress_report_update`, `progress_report_get`, `progress_report_list` | Keep a live progress report that the dashboard shows. |
+
+Two more tool groups are off by default:
+
+- `clink_agent_run` and `clink_agent_manage` control a stateful Codex app-server session with approvals. Set `CLINKX_APP_SERVER_ENABLED=true` to publish them.
+- `clink_elaris_run` and `clink_elaris_manage` start remote Elaris agent sessions over HTTPS. Set `CLINKX_ELARIS_ENABLED=true` and the Elaris connection variables to publish them.
+
+Each tool publishes its full input schema through MCP. MCP clients can show the schema with the tool description.
+
+Readiness and project verification are available through the same npm-installed
+MCP connection; no ClinkX checkout or client shell access is needed. See
+[provider readiness](docs/configuration.md#provider-readiness-doctor) and
+[project checks](docs/verification/project-checks.md) for tool calls, authorized
+project/evidence roots, and evidence limits. Project execution v1 supports
+macOS/Linux and runs trusted manifest commands with the server account's permissions.
+
+## Supported CLIs
+
+An adapter file tells ClinkX how to start one CLI, how to pass the prompt, and how to read the output. These adapters are included:
+
+| `cli_name` | Command (short form) | Notes |
+|---|---|---|
+| `codex` | `codex exec --json` | Default curator and finalizer for workflow context. |
+| `claude` | `claude -p --output-format stream-json` | |
+| `agy` | `agy --output-format stream-json` | Use an agy build that emits stream-json (1.1.8 or later). |
+| `glm` | `claude -p ... --model glm-5.3[1m]` | Runs GLM through the Claude Code CLI. |
+| `grok` | `grok --output-format streaming-messages-json` | |
+
+All included adapters accept the optional `model` and `effort` fields on each call:
 
-Passkey challenge capacity is 96 login slots and 32 registration/add-passkey slots, with 8 concurrent verifications. Saturation returns 503 `auth_busy` and `Retry-After: 1`. Live challenges are not evicted. Local session and challenge cookie names are port-scoped. WebAuthn still uses the shared bare `localhost` RP ID.
+```json
+{ "cli_name": "codex", "prompt": "...", "model": "gpt-5.4", "effort": "low" }
+```
+
+If you omit a field, ClinkX uses the adapter setting or the CLI default. If the adapter does not declare the field or the value, ClinkX returns MCP error `-32602` and does not start the process.
 
-On browser startup, a valid same-origin passkey status beats provisional bearer state. The only bearer fallback is the split-origin static server's exact no-store 404 `{"error":{"code":"not_found"}}`. Malformed or ambiguous status, and uncertain logout, fail closed. Bearer is the explicit tested rollback.
+The `conf/adapters/hapi/` directory in the package holds optional templates that start each CLI through a `hapi` gateway. These templates are not ready to use. You must set the gateway URL and credentials in your copy.
 
-Dashboard shutdown closes listeners first, then auth/gateway resources. Cleanup failures are aggregated across both.
+## Configuration
 
-## Council roster presets
+### Adapter files
 
-`run_workflow.roster` names a JSON preset instead of passing `members`, `chairman`, or `cb_delegate`. Council workflows only. Combining `roster` with any of those fields (or a non-empty `cb_delegate`) is MCP `-32602` and creates no run.
+ClinkX reads adapter JSON files from these locations, in this order. ClinkX uses the first file with a given `name`.
 
-Discovery is first-wins by file stem, same as adapters:
+1. `CLINKX_CONFIG_PATH`, a file or a directory. When you set it, ClinkX reads only this location and does not load the included adapters. The location must also contain a `codex` adapter with a `json` role, or you must set `CLINKX_WORKFLOWS_CONTEXT_PREFLIGHT_ENABLED=false`.
+2. `${XDG_CONFIG_HOME:-~/.config}/clinkx/adapters/*.json`.
+3. The `conf/adapters/` directory inside the installed package.
 
-1. `CLINKX_ROSTERS_PATH` (file or directory). Replaces the rest when set.
-2. `${XDG_CONFIG_HOME:-~/.config}/clinkx/rosters/*.json`
-3. Packaged `conf/rosters/*.json` on the root server only. Standalone `createWorkflowServer` loads env/user only.
+To change an included adapter, copy its file to `~/.config/clinkx/adapters/` and edit the copy. The copy replaces the included file completely. ClinkX does not merge the two files. After you upgrade ClinkX, compare your copy with the new included file. Copy the new file again if necessary.
 
-Put a user preset at `~/.config/clinkx/rosters/<name>.json`. The file stem is the name (`^[a-z0-9][a-z0-9_-]{0,63}$`). Schema is Zod-strict `clinkx-roster-v1`; at least one of `members`, `chairman`, or `delegate` is required. Shipped `conf/rosters/default-council.json`:
+To add a CLI that is not included, write a new file in the same directory. This example adapter returns the prompt unchanged:
 
 ```json
 {
-  "schema_version": "clinkx-roster-v1",
-  "description": "Three-member council with a Codex chairman and an enabled curator/finalizer delegate.",
-  "members": [
-    { "cli_name": "codex" },
-    { "cli_name": "claude" },
-    { "cli_name": "glm" }
-  ],
-  "chairman": { "cli_name": "codex" },
-  "delegate": {
-    "enabled": true,
-    "curator": { "cli_name": "codex", "role": "json" },
-    "finalizer": {
-      "cli_name": "codex",
-      "role": "json-codereviewer",
-      "enabled": true,
-      "min_score": 8.5
-    },
-    "failure_policy": "fail"
-  }
+  "name": "echo",
+  "command": "node",
+  "args": ["-e", "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>process.stdout.write(d));"],
+  "parser": "text",
+  "prompt_mode": "stdin",
+  "timeout_seconds": 60
 }
 ```
 
-Call `run_workflow` with the preset name:
+### Environment variables
+
+These are the variables that most installations set. Every variable has a default.
+
+| Variable | Default | Function |
+|---|---|---|
+| `CLINKX_ALLOWED_ROOTS` | Current directory of the server process | Comma-separated list of directories that tool calls can reference. Set it so path checks do not depend on the directory in which the client starts ClinkX. |
+| `CLINKX_WORKFLOWS_WORKSPACE_ROOT` | Current directory of the server process | Workspace for workflows. Set it to the same directory as the allowed root. |
+| `CLINKX_WORKFLOWS_STATE_DIR` | `${XDG_STATE_HOME:-~/.local/state}/clinkx-workflows` | Directory for workflow runs, progress reports, and dashboard state. |
+| `CLINKX_CONTEXT_BUILDER_RUNS_DIR` | `${XDG_STATE_HOME:-~/.local/state}/clinkx/context-builder/runs` | Directory for `context_builder` runs and bundles. |
+| `CLINKX_CONFIG_PATH` | not set | Replaces the adapter search path. See [Adapter files](#adapter-files). |
+| `CLINKX_ROSTERS_PATH` | not set | Replaces the roster-preset search path. See [Workflows](#workflows). |
+| `CLINKX_MAX_CONCURRENT` | `5` | Maximum number of `clink` processes at one time. ClinkX returns an error when the limit is reached. It does not queue requests. |
+| `CLINKX_TIMEOUT_SECONDS` | `600` | Default time limit for one child process. |
+| `CLINKX_MAX_RESPONSE_CHARS` | `20000` | Maximum number of characters in one tool result. |
+| `CLINKX_LOG_LEVEL` | `info` | Log level. Logs go to stderr. |
+| `CLINKX_CONTEXT_ALLOW_SECRETS` | `true` | When `true`, `context_builder` copies secret material into bundles as written. See [Safety](#safety). |
+| `CLINKX_WORKFLOWS_CONTEXT_PREFLIGHT_ENABLED` | `true` | Set to `false` to run workflows without the Codex context step. |
+| `CLINKX_WORKFLOWS_RETAIN_SUCCEEDED_DAYS` | `1` | Days to keep completed blocking workflow runs on disk. `0` keeps them without limit. |
+| `CLINKX_WORKFLOWS_RETAIN_ASYNC_DAYS` | `1` | Days to keep completed background workflow runs on disk. `0` keeps them without limit. |
+| `CLINKX_SERVER_IDLE_TIMEOUT_SECONDS` | `0` | Seconds of inactivity after which the server exits. `0` disables the timer. Active tool calls, workflows, and Codex turns reset it. |
+| `CLINKX_APP_SERVER_ENABLED` | `false` | Set to `true` to publish the Codex app-server tools. |
+| `CLINKX_ELARIS_ENABLED` | `false` | Set to `true` to publish the Elaris tools. |
+
+ClinkX writes only MCP JSON-RPC to stdout. All logs go to stderr. The server detects the exit of its parent process and stops.
+
+## Workflows
+
+A workflow runs many CLI calls in stages and returns one result. A council workflow asks each member for an independent answer. The members then review each other. A chairman writes the final answer. These workflows are included:
+
+| Workflow | Purpose |
+|---|---|
+| `architecture-comparison` | Compare two designs using frozen shared input and a fresh judge with candidate aliases. |
+| `verified-repair` | Repair declared existing files in place, reproduce the defect, and prove the fix through native checks and independent causal verification. |
+| `council-answer` | Answer one hard question. |
+| `council-code-review` | Review a change set. |
+| `council-debug` | Find the cause of a defect. |
+| `council-discover` | Inspect a codebase or a design space. |
+| `council-plan-review` | Review a plan document. |
+| `council-default` | General-purpose council. |
+| `plan-review-receipts` | Typed plan review that returns receipt candidates for an external approval process. |
+
+Before the first stage, ordinary workflows run `context_builder` with Codex as curator and finalizer. This step selects the repository files that the members receive. The `codex` command must be on your `PATH`. To skip this step, set `CLINKX_WORKFLOWS_CONTEXT_PREFLIGHT_ENABLED=false`. `verified-repair` uses its host-frozen declared inputs instead of this context preflight.
+
+Select `architecture-comparison` explicitly and provide `user_request`,
+`source_identity`, and optional `context_files` in `variables`. Its built-in
+templates and validators ship in the npm package. Two authors receive the same
+frozen packet; the independent judge receives a separate view with candidate
+aliases. The result reports comparison completeness and leaves owner acceptance
+unrecorded. See [engineering recipes](docs/engineering-recipes.md) for an example,
+route settings, bounds, and evidence limits.
+
+For a bug fix, invoke the companion `verified-repair` skill in Claude Code,
+Codex, or another connected MCP agent. It prepares the repair contract and
+native manifests, then calls `run_workflow` with
+`workflow: "verified-repair"`. The workflow needs three explicit provider routes
+and separate authorized project, evidence and verification-copy locations on
+the MCP host. It preserves unrelated changes and retains applied edits on
+failure; qualification never records owner acceptance. See the
+[paste-ready agent prompt and MCP calls](docs/engineering-recipes.md#using-verified-repair-from-an-agent-runtime)
+and [minimal contract and manifests](docs/verification/project-checks.md#native-verified-repair).
+The dashboard's **Verified repair** prompt-builder target prepares this caller
+skill invocation for copying; it does not execute the repair or authorize host paths.
+
+### Roster presets
+
+A roster preset names the members, the chairman, and the context delegate of a council in one file. Pass the preset name as `roster` in place of `members`, `chairman`, and `cb_delegate`:
 
 ```json
 {
@@ -150,106 +208,81 @@ Call `run_workflow` with the preset name:
 }
 ```
 
-`list_workflows` still returns `available_cli_names`. The root server also returns `available_clis` (per-adapter model/effort template support, not value validity; `app_server` excluded) and `available_rosters` (`{name, source}` with `source` `env` | `user` | `builtin`). A council run's requested seats and delegate appear as `resolved_roster` on the async ack, a trailing sync content block, and `workflow_run_status`. `provider_spawns` is `2N+1` (ranking is a reducer, not a spawn).
+The included `default-council` preset uses Codex, Claude, and GLM as members and Codex as chairman. ClinkX reads these locations in this order and uses the first file with a given name:
 
-## Context bundles
+1. `CLINKX_ROSTERS_PATH`, a file or a directory. When you set it, ClinkX reads only this location.
+2. `${XDG_CONFIG_HOME:-~/.config}/clinkx/rosters/*.json`.
+3. The `conf/rosters/` directory inside the installed package.
+
+To write your own preset, copy `conf/rosters/default-council.json` to `~/.config/clinkx/rosters/<name>.json` and edit the copy. The file name is the preset name. The preset name must match `^[a-z0-9][a-z0-9_-]{0,63}$`. A request that gives `roster` together with `members`, `chairman`, `chairman_model`, `chairman_effort`, or a non-empty `cb_delegate` returns error `-32602` and starts no run.
 
-Use `context_builder` when a later `clink` call needs curated repo context and you do not want that source inlined in the first tool response. You must pass a bounded anchor: at least one `focus_paths` entry or a nonblank `search_terms` entry. `include_globs` only narrows the scan when those anchors exist. It does not select context by itself.
+### Background runs
 
-The tool writes a durable run directory (`manifest.json`, `artifacts/bundle.md`) and returns one minified JSON receipt. The receipt includes `recommended_clink.absolute_file_paths`. Pass those as `absolute_file_paths` on a later `clink` call. The handoff files are the persisted `artifacts/bundle.md` and `manifest.json`.
+Pass `async: true` to `run_workflow` to get a `run_id` immediately. Call `workflow_run_status` with that `run_id` to see the stage progress. Pass `include_result: true` to get the final result. Use `cancel_workflow` to stop a run. Completed runs stay on disk for the retention period given above.
+
+## Context bundles
 
-Delegate mode needs an explicit request shape and explicit providers:
+Use `context_builder` when a later call needs a selected part of the repository. Then the first tool result does not contain that content. You must give at least one anchor: a `focus_paths` entry or a non-blank `search_terms` entry.
 
 ```json
 {
   "task": "Collect context for the server tool registration",
-  "roots": ["/path/to/workspace"],
+  "roots": ["/path/to/your/workspace"],
   "focus_paths": ["src/server.ts"],
-  "delegate": {
-    "enabled": true,
-    "curator": {
-      "cli_name": "<curator-cli>",
-      "role": "<curator-role>"
-    },
-    "finalizer": {
-      "cli_name": "<finalizer-cli>",
-      "role": "<finalizer-role>",
-      "min_score": 8.5
-    },
-    "failure_policy": "fallback",
-    "timeout_seconds": 120,
-    "max_response_chars": 20000
-  }
+  "search_terms": ["ListToolsRequestSchema"]
 }
 ```
 
-There are no built-in curator or finalizer provider defaults. Provider output is advisory. The server checks strict JSON, rebuilds accepted content from local candidates, reapplies budgets and secret checks, and does not persist raw provider output. `failure_policy:"fallback"` publishes deterministic local selection as a partial v2 run if delegate curation fails. `failure_policy:"fail"` returns an error and does not publish a manifest.
+The tool writes the bundle to the context-runs directory and returns a short JSON receipt. The receipt contains `recommended_clink.absolute_file_paths`. Pass that list as `absolute_file_paths` on the next `clink` call.
 
-### Adding an adapter
+By default the selection is deterministic. You can also set `delegate.enabled: true` and name a curator and a finalizer CLI. The curator makes a selection and the finalizer scores it. ClinkX checks the selection and rebuilds the bundle from local files. It applies the budgets again and writes only content that it checked itself. Provider output is an input that ClinkX checks, not a result.
 
-Put the JSON in `${XDG_CONFIG_HOME:-~/.config}/clinkx/adapters/`. Or set `CLINKX_CONFIG_PATH` to a directory that also contains every shipped adapter you still need. That env var replaces the search path.
+## Dashboard
 
-```json
-{
-  "name": "echo",
-  "command": "node",
-  "args": ["-e", "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>process.stdout.write(d));"],
-  "parser": "text",
-  "prompt_mode": "stdin",
-  "timeout_seconds": 60
-}
+The package includes a local, read-only web dashboard. It shows workflow runs, single calls, context runs, progress reports, the workflow catalog, the adapter catalog, and the saved artifacts. Start it with the second command that the package installs:
+
+```bash
+npx -p clinkx clinkx-workflows-dashboard --port 4180
 ```
 
-## MCP client config
+The dashboard listens on `127.0.0.1` and `::1` and prints `http://localhost:<port>`. Passkey sign-in is the default. On the first start, the dashboard prints one enrollment code. Register a passkey with that code, then sign in. For local tests only, `CLINKX_WORKFLOWS_DASHBOARD_AUTH_MODE=none` disables sign-in.
 
-The exact shape depends on the client.
+Point the dashboard at the same `CLINKX_WORKFLOWS_STATE_DIR` as the ClinkX server. If the two directories differ, the dashboard shows a different run set, often an empty one. If you set `CLINKX_CONTEXT_BUILDER_RUNS_DIR` for the server, set the same value for the dashboard.
 
-Via npx (recommended):
+The dashboard does not start, cancel, or approve anything. The data that it shows can contain prompts, outputs, and file contents from your workspace. Access is local and needs a passkey, but any process that runs as the same OS user can read the state directory.
 
-```json
-{
-  "mcpServers": {
-    "clinkx": {
-      "command": "npx",
-      "args": ["-y", "clinkx@latest"],
-      "env": {
-        "CLINKX_ALLOWED_ROOTS": "/path/to/your/workspace",
-        "CLINKX_WORKFLOWS_WORKSPACE_ROOT": "/path/to/your/workspace"
-      }
-    }
-  }
-}
-```
+## Safety
 
-From a local clone:
+ClinkX checks request paths and passes only a small set of environment variables to the child process. It does not sandbox the child process.
 
-```json
-{
-  "mcpServers": {
-    "clinkx": {
-      "command": "node",
-      "args": ["/path/to/clink-mcp/dist/index.js"],
-      "env": {
-        "CLINKX_ALLOWED_ROOTS": "/path/to/your/workspace",
-        "CLINKX_WORKFLOWS_WORKSPACE_ROOT": "/path/to/your/workspace"
-      }
-    }
-  }
-}
-```
+**WARNING: A child process has the same permissions as the user who started ClinkX.** The included adapters start each CLI with no sandbox and with approval prompts turned off or set to accept file edits. The child process can edit and delete files in your workspace and can run commands. Give each prompt clear limits. Do not run ClinkX as root or as an administrator.
 
-## Safety
+**WARNING: `context_builder` copies secrets by default.** The default is `allow_secrets: true`. With this default, ClinkX copies API keys, private keys, tokens, and files such as `.env` and `id_rsa` into bundles. The CLIs that receive the bundle also receive the secrets. To make ClinkX omit or redact common secret forms, set one of these:
+
+- `allow_secrets: false` on the `context_builder` call.
+- `cb_allow_secrets: false` on the `run_workflow` call.
+- `CLINKX_CONTEXT_ALLOW_SECRETS=false` in the server environment.
+
+This filter is a best-effort check, not a security boundary.
 
-ClinkX validates request paths, environment variables, and argument policy. It does not sandbox the spawned process.
+`CLINKX_ALLOWED_ROOTS` limits the paths that tool calls can reference. It does not limit the child process. Set it in all installations so that the limit does not depend on the start directory of the client.
 
-`CLINKX_ALLOWED_ROOTS` limits which file paths the tool accepts. Default is `process.cwd()`. It is required only if the MCP host starts ClinkX with cwd at `/`. Set it anyway so path admission does not depend on whatever cwd the host chose. The subprocess has the same permissions as whoever started ClinkX.
+Only the `council-plan-review` and `plan-review-receipts` prompts tell the members not to edit files. This is an instruction to the model, not a mechanical control. The other workflows give no such instruction.
 
-Set `CLINKX_WORKFLOWS_WORKSPACE_ROOT` to the same workspace. If you omit it, workflows use `process.cwd()` and warn on stderr.
+## Documentation
 
-`context_builder` validates roots and blocks symlink escapes. Secret material (API keys, private keys, tokens, `.env` / `.pem` / `id_rsa` / `credentials.json`) is included as written by default (`allow_secrets:true`) so delegates can probe. Opt out with `allow_secrets:false`, `cb_allow_secrets:false`, or `CLINKX_CONTEXT_ALLOW_SECRETS=false`. Bundle artifacts are not a sandbox and not an access-control boundary.
+The installed package contains these files. After `npm install clinkx`, find them in `node_modules/clinkx/`.
 
-See `docs/security.md`.
+| File | Content |
+|---|---|
+| `docs/configuration.md` | Reference for adapter files, invocation overrides, and environment variables. |
+| `docs/security.md` | Trust boundaries, redaction scope, and the limits of each safety control. |
+| `CHANGELOG.md` | Changes, upgrade notes, and new flags for each release. |
+
+Read the upgrade notes before you upgrade a server that has unfinished workflow runs.
 
 ## License
 
-Copyright (c) 2026 jim380. All rights reserved. Proprietary package (`license: UNLICENSED`). See `LICENSE`.
+Copyright (c) 2026 jim380. All rights reserved.
+
+ClinkX is free to use but not open source. You may install and run the published npm package for your own use. You may not copy, change, redistribute, or sell it. The `package.json` license field is `UNLICENSED`. See the `LICENSE` file in the package for the full text.

package/clinkx-workflows/dist/architecture-comparison/admission.d.ts

@@ -0,0 +1,5 @@
+import type { NormalizedWorkflowDefinition } from "../definition-normalizer.js";
+export declare function materializeArchitectureRoutes(definition: NormalizedWorkflowDefinition, variables: Readonly<Record<string, unknown>>, available?: readonly string[], validateOverrides?: (cli: string, knobs: {
+    model?: string;
+    effort?: string;
+}) => void): NormalizedWorkflowDefinition;

package/clinkx-workflows/dist/architecture-comparison/admission.js

@@ -0,0 +1,50 @@
+import { getMaxPromptBytes } from "../config.js";
+import { DEFAULT_RESERVE_BYTES } from "../prompt-budget.js";
+import { ARCHITECTURE_WORKFLOW, MAX_JUDGE_BYTES, MAX_VIEW_BYTES, RouteSchema } from "./contract.js";
+const ROUTE_VARIABLES = { "candidates.author_a": "candidate_a", "candidates.author_b": "candidate_b", "judge.judge": "judge" };
+export function materializeArchitectureRoutes(definition, variables, available, validateOverrides) {
+    if (definition.name !== ARCHITECTURE_WORKFLOW)
+        return definition;
+    for (const name of ["user_request", "source_identity"]) {
+        const value = variables[name];
+        const cap = name === "user_request" ? 16 * 1024 : 2000;
+        if (typeof value !== "string" || value.trim() === "" || Buffer.byteLength(value, "utf8") > cap)
+            throw new Error(`${name} must be nonblank and at most ${cap} UTF-8 bytes`);
+    }
+    const contextFiles = variables["context_files"] ?? [];
+    if (!Array.isArray(contextFiles) || contextFiles.length > 32 || new Set(contextFiles).size !== contextFiles.length)
+        throw new Error("context_files must contain at most 32 distinct source files");
+    const judge = definition.stages.find((stage) => stage.id === "judge")?.calls[0];
+    const worstCase = MAX_VIEW_BYTES + MAX_JUDGE_BYTES + DEFAULT_RESERVE_BYTES + Buffer.byteLength(judge?.prompt ?? "", "utf8");
+    if (worstCase > getMaxPromptBytes())
+        throw new Error(`architecture worst-case judge input and response reserve (${worstCase} bytes) exceeds workflow prompt budget`);
+    const tokenLimit = variables["judge_prompt_token_limit"];
+    if (tokenLimit !== undefined && (!Number.isSafeInteger(tokenLimit) || tokenLimit < worstCase))
+        throw new Error(`judge_prompt_token_limit must cover the conservative byte-token upper bound ${worstCase}; shorten the contract or use a larger route`);
+    const materialized = {
+        ...definition,
+        stages: definition.stages.map((stage) => ({ ...stage, calls: stage.calls.map((call) => {
+                const prefix = ROUTE_VARIABLES[`${stage.id}.${call.id}`];
+                if (prefix === undefined)
+                    return call;
+                const cli = variables[`${prefix}_cli`];
+                const model = variables[`${prefix}_model`];
+                const effort = variables[`${prefix}_effort`];
+                const route = RouteSchema.parse({ cli_name: typeof cli === "string" ? cli.trim() : cli, ...(model !== undefined ? { model } : {}), ...(effort !== undefined ? { effort } : {}) });
+                if (!/^[A-Za-z0-9_-]+$/.test(route.cli_name))
+                    throw new Error(`invalid ${prefix}_cli`);
+                if (route.model !== undefined && !/^[^\s\u0000-][^\s\u0000]*$/.test(route.model))
+                    throw new Error(`invalid ${prefix}_model`);
+                if (route.effort !== undefined && !/^[a-z0-9][a-z0-9_-]*$/.test(route.effort))
+                    throw new Error(`invalid ${prefix}_effort`);
+                if (available !== undefined && !available.includes(route.cli_name))
+                    throw new Error(`${prefix}_cli ${route.cli_name} is not an available JSON-capable route`);
+                validateOverrides?.(route.cli_name, { ...(route.model !== undefined ? { model: route.model } : {}), ...(route.effort !== undefined ? { effort: route.effort } : {}) });
+                const { model: _model, effort: _effort, ...base } = call;
+                return { ...base, ...route, role: "json" };
+            }) })),
+    };
+    const judgeCli = String(variables["judge_cli"]);
+    return { ...materialized, stages: materialized.stages.map((stage) => ({ ...stage, calls: stage.calls.map((call) => call.reducer === undefined ? call : { ...call, cli_name: judgeCli }) })) };
+}
+//# sourceMappingURL=admission.js.map

package/clinkx-workflows/dist/architecture-comparison/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../src/architecture-comparison/admission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEpG,MAAM,eAAe,GAAG,EAAE,qBAAqB,EAAE,aAAa,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAW,CAAC;AAExI,MAAM,UAAU,6BAA6B,CAC3C,UAAwC,EACxC,SAA4C,EAC5C,SAA6B,EAC7B,iBAAqF;IAErF,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,UAAU,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iCAAiC,GAAG,cAAc,CAAC,CAAC;IAC7K,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnM,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,cAAc,GAAG,eAAe,GAAG,qBAAqB,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5H,IAAI,SAAS,GAAG,iBAAiB,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,SAAS,wCAAwC,CAAC,CAAC;IACrK,MAAM,UAAU,GAAG,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACzD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAK,UAAqB,GAAG,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,SAAS,8CAA8C,CAAC,CAAC;IACnQ,MAAM,YAAY,GAAG;QACnB,GAAG,UAAU;QACb,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACpF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,EAAkC,CAAC,CAAC;gBACzF,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC;gBACtC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC;gBAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClL,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,MAAM,CAAC,CAAC;gBACvF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,QAAQ,CAAC,CAAC;gBAC7H,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,SAAS,CAAC,CAAC;gBAC3H,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,QAAQ,KAAK,CAAC,QAAQ,yCAAyC,CAAC,CAAC;gBAC9J,iBAAiB,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;gBACzD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC7C,CAAC,CAAC,EAAE,CAAC,CAAC;KACP,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAChM,CAAC"}