code-ai-installer 3.0.0 → 4.0.1-a

package/dist/mcp/task_state.d.ts

@@ -0,0 +1,198 @@
+import { z } from "zod";
+import { GateName, PipelineMode } from "../shared/index.js";
+/**
+ * Per-task fs-backed state for the gate state machine.
+ * Stored at .code-ai/state/tasks/<task_id>.json (cwd-relative).
+ *
+ * Invariant: every gate is either current, signed (advanced past), or upcoming.
+ * `signoffs` records sign_off events; `classifications` records classify_gate
+ * outcomes. `dev_rollback_count` powers the circuit breaker.
+ */
+export declare const GateSignoff: z.ZodObject<{
+    gate: z.ZodEnum<{
+        PM: "PM";
+        UX: "UX";
+        ARCH: "ARCH";
+        DEV: "DEV";
+        REV: "REV";
+        OPS: "OPS";
+        TEST: "TEST";
+        RG: "RG";
+        STRATEGIST: "STRATEGIST";
+        RESEARCHER: "RESEARCHER";
+        COPYWRITER: "COPYWRITER";
+        VISUAL_CONCEPT: "VISUAL_CONCEPT";
+        REVIEWER: "REVIEWER";
+        RELEASE_GATE: "RELEASE_GATE";
+        INTERVIEWER: "INTERVIEWER";
+        DATA_ANALYST: "DATA_ANALYST";
+        MEDIATOR: "MEDIATOR";
+        DESIGNER: "DESIGNER";
+        LAYOUTER: "LAYOUTER";
+        DISCOVERY: "DISCOVERY";
+        PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+        UX_DESIGNER: "UX_DESIGNER";
+        TECH_LEAD: "TECH_LEAD";
+    }>;
+    signer: z.ZodEnum<{
+        den: "den";
+        mcp: "mcp";
+        system: "system";
+    }>;
+    timestamp: z.ZodString;
+    evidence: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+export type GateSignoff = z.infer<typeof GateSignoff>;
+export declare const GateClassification: z.ZodObject<{
+    gate: z.ZodEnum<{
+        PM: "PM";
+        UX: "UX";
+        ARCH: "ARCH";
+        DEV: "DEV";
+        REV: "REV";
+        OPS: "OPS";
+        TEST: "TEST";
+        RG: "RG";
+        STRATEGIST: "STRATEGIST";
+        RESEARCHER: "RESEARCHER";
+        COPYWRITER: "COPYWRITER";
+        VISUAL_CONCEPT: "VISUAL_CONCEPT";
+        REVIEWER: "REVIEWER";
+        RELEASE_GATE: "RELEASE_GATE";
+        INTERVIEWER: "INTERVIEWER";
+        DATA_ANALYST: "DATA_ANALYST";
+        MEDIATOR: "MEDIATOR";
+        DESIGNER: "DESIGNER";
+        LAYOUTER: "LAYOUTER";
+        DISCOVERY: "DISCOVERY";
+        PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+        UX_DESIGNER: "UX_DESIGNER";
+        TECH_LEAD: "TECH_LEAD";
+    }>;
+    outcome: z.ZodEnum<{
+        auto_resolve: "auto_resolve";
+        fork: "fork";
+        exception: "exception";
+    }>;
+    rationale: z.ZodString;
+    timestamp: z.ZodString;
+}, z.core.$strip>;
+export type GateClassification = z.infer<typeof GateClassification>;
+export declare const TaskState: z.ZodObject<{
+    task_id: z.ZodString;
+    mode: z.ZodEnum<{
+        full: "full";
+        bugfix: "bugfix";
+        hotfix: "hotfix";
+    }>;
+    current_gate: z.ZodEnum<{
+        PM: "PM";
+        UX: "UX";
+        ARCH: "ARCH";
+        DEV: "DEV";
+        REV: "REV";
+        OPS: "OPS";
+        TEST: "TEST";
+        RG: "RG";
+        STRATEGIST: "STRATEGIST";
+        RESEARCHER: "RESEARCHER";
+        COPYWRITER: "COPYWRITER";
+        VISUAL_CONCEPT: "VISUAL_CONCEPT";
+        REVIEWER: "REVIEWER";
+        RELEASE_GATE: "RELEASE_GATE";
+        INTERVIEWER: "INTERVIEWER";
+        DATA_ANALYST: "DATA_ANALYST";
+        MEDIATOR: "MEDIATOR";
+        DESIGNER: "DESIGNER";
+        LAYOUTER: "LAYOUTER";
+        DISCOVERY: "DISCOVERY";
+        PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+        UX_DESIGNER: "UX_DESIGNER";
+        TECH_LEAD: "TECH_LEAD";
+    }>;
+    signoffs: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        gate: z.ZodEnum<{
+            PM: "PM";
+            UX: "UX";
+            ARCH: "ARCH";
+            DEV: "DEV";
+            REV: "REV";
+            OPS: "OPS";
+            TEST: "TEST";
+            RG: "RG";
+            STRATEGIST: "STRATEGIST";
+            RESEARCHER: "RESEARCHER";
+            COPYWRITER: "COPYWRITER";
+            VISUAL_CONCEPT: "VISUAL_CONCEPT";
+            REVIEWER: "REVIEWER";
+            RELEASE_GATE: "RELEASE_GATE";
+            INTERVIEWER: "INTERVIEWER";
+            DATA_ANALYST: "DATA_ANALYST";
+            MEDIATOR: "MEDIATOR";
+            DESIGNER: "DESIGNER";
+            LAYOUTER: "LAYOUTER";
+            DISCOVERY: "DISCOVERY";
+            PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+            UX_DESIGNER: "UX_DESIGNER";
+            TECH_LEAD: "TECH_LEAD";
+        }>;
+        signer: z.ZodEnum<{
+            den: "den";
+            mcp: "mcp";
+            system: "system";
+        }>;
+        timestamp: z.ZodString;
+        evidence: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>>>;
+    classifications: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        gate: z.ZodEnum<{
+            PM: "PM";
+            UX: "UX";
+            ARCH: "ARCH";
+            DEV: "DEV";
+            REV: "REV";
+            OPS: "OPS";
+            TEST: "TEST";
+            RG: "RG";
+            STRATEGIST: "STRATEGIST";
+            RESEARCHER: "RESEARCHER";
+            COPYWRITER: "COPYWRITER";
+            VISUAL_CONCEPT: "VISUAL_CONCEPT";
+            REVIEWER: "REVIEWER";
+            RELEASE_GATE: "RELEASE_GATE";
+            INTERVIEWER: "INTERVIEWER";
+            DATA_ANALYST: "DATA_ANALYST";
+            MEDIATOR: "MEDIATOR";
+            DESIGNER: "DESIGNER";
+            LAYOUTER: "LAYOUTER";
+            DISCOVERY: "DISCOVERY";
+            PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+            UX_DESIGNER: "UX_DESIGNER";
+            TECH_LEAD: "TECH_LEAD";
+        }>;
+        outcome: z.ZodEnum<{
+            auto_resolve: "auto_resolve";
+            fork: "fork";
+            exception: "exception";
+        }>;
+        rationale: z.ZodString;
+        timestamp: z.ZodString;
+    }, z.core.$strip>>>;
+    dev_rollback_count: z.ZodDefault<z.ZodNumber>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+    completed_at: z.ZodOptional<z.ZodString>;
+    audit_required_at: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TaskState = z.infer<typeof TaskState>;
+export declare function readTaskState(taskId: string): Promise<TaskState | null>;
+export declare function writeTaskState(state: TaskState): Promise<void>;
+export declare function createTaskState(args: {
+    task_id: string;
+    mode: PipelineMode;
+    initial_gate: GateName;
+}): Promise<TaskState>;
+/** Returns the most recent classification for the given gate, or null. */
+export declare function latestClassification(state: TaskState, gate: GateName): GateClassification | null;
+/** Returns the most recent sign-off for the given gate, or null. */
+export declare function latestSignoff(state: TaskState, gate: GateName): GateSignoff | null;

package/dist/mcp/task_state.js

@@ -0,0 +1,95 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+import { ClassificationOutcome, GateName, PipelineMode, Signer, TaskId, } from "../shared/index.js";
+import { resolveTaskStateRoot } from "./paths.js";
+/**
+ * Per-task fs-backed state for the gate state machine.
+ * Stored at .code-ai/state/tasks/<task_id>.json (cwd-relative).
+ *
+ * Invariant: every gate is either current, signed (advanced past), or upcoming.
+ * `signoffs` records sign_off events; `classifications` records classify_gate
+ * outcomes. `dev_rollback_count` powers the circuit breaker.
+ */
+export const GateSignoff = z.object({
+    gate: GateName,
+    signer: Signer,
+    timestamp: z.string(),
+    evidence: z.unknown().optional(),
+});
+export const GateClassification = z.object({
+    gate: GateName,
+    outcome: ClassificationOutcome,
+    rationale: z.string(),
+    timestamp: z.string(),
+});
+export const TaskState = z.object({
+    task_id: TaskId,
+    mode: PipelineMode,
+    current_gate: GateName,
+    signoffs: z.array(GateSignoff).default([]),
+    classifications: z.array(GateClassification).default([]),
+    dev_rollback_count: z.number().int().min(0).default(0),
+    created_at: z.string(),
+    updated_at: z.string(),
+    /** Set when the task reaches a terminal gate (RG signed). */
+    completed_at: z.string().optional(),
+    /**
+     * ISO timestamp set when the circuit breaker REFUSED an advance and the
+     * caller must invoke the audit_role deep audit before continuing. Cleared
+     * when record_decision writes a new ARCH ADR (per reset_on=new_arch_adr).
+     * Surfaces in audit_trail / list_artifacts queries; not in current_gate
+     * output (contract is fixed for v0).
+     */
+    audit_required_at: z.string().optional(),
+});
+function pathFor(taskId) {
+    // TaskId zod is z.string().min(1) — no format guarantee, so sanitize for fs.
+    const safe = taskId.replace(/[^A-Za-z0-9_.-]/g, "_");
+    if (!safe || safe === "." || safe === "..") {
+        throw new Error(`invalid task_id for filesystem use: '${taskId}'`);
+    }
+    return join(resolveTaskStateRoot(), `${safe}.json`);
+}
+export async function readTaskState(taskId) {
+    const raw = await readFile(pathFor(taskId), "utf8").catch(() => null);
+    if (!raw)
+        return null;
+    return TaskState.parse(JSON.parse(raw));
+}
+export async function writeTaskState(state) {
+    await mkdir(resolveTaskStateRoot(), { recursive: true });
+    const next = { ...state, updated_at: new Date().toISOString() };
+    await writeFile(pathFor(state.task_id), JSON.stringify(next, null, 2) + "\n", "utf8");
+}
+export async function createTaskState(args) {
+    const now = new Date().toISOString();
+    const state = TaskState.parse({
+        task_id: args.task_id,
+        mode: args.mode,
+        current_gate: args.initial_gate,
+        signoffs: [],
+        classifications: [],
+        dev_rollback_count: 0,
+        created_at: now,
+        updated_at: now,
+    });
+    await writeTaskState(state);
+    return state;
+}
+/** Returns the most recent classification for the given gate, or null. */
+export function latestClassification(state, gate) {
+    for (let i = state.classifications.length - 1; i >= 0; i--) {
+        if (state.classifications[i].gate === gate)
+            return state.classifications[i];
+    }
+    return null;
+}
+/** Returns the most recent sign-off for the given gate, or null. */
+export function latestSignoff(state, gate) {
+    for (let i = state.signoffs.length - 1; i >= 0; i--) {
+        if (state.signoffs[i].gate === gate)
+            return state.signoffs[i];
+    }
+    return null;
+}

package/dist/mcp/tools/_subprocess.d.ts

@@ -0,0 +1,16 @@
+export interface SubprocessResult {
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    durationMs: number;
+    spawnError?: Error;
+}
+export interface SpawnOptions {
+    cwd: string;
+    env?: Record<string, string>;
+    /** When set, the string is written to the process's stdin then closed. */
+    stdin?: string;
+}
+export declare function npmCommand(): string;
+export declare function spawnWithOutput(command: string, args: string[], opts: SpawnOptions): Promise<SubprocessResult>;
+export declare function tail(text: string, maxBytes: number): string;

package/dist/mcp/tools/_subprocess.js

@@ -0,0 +1,56 @@
+import { spawn } from "node:child_process";
+import { performance } from "node:perf_hooks";
+export function npmCommand() {
+    return process.platform === "win32" ? "npm.cmd" : "npm";
+}
+export async function spawnWithOutput(command, args, opts) {
+    return new Promise((resolve) => {
+        const start = performance.now();
+        let stdout = "";
+        let stderr = "";
+        const env = opts.env ? { ...process.env, ...opts.env } : process.env;
+        // Windows: Node 20+ refuses to spawn .cmd/.bat without a shell (CVE-2024-27980).
+        // `npm` and `npx` are .cmd shims on Windows, so we run through cmd.exe there.
+        // We control args (no untrusted user input), so shell: true is safe here.
+        const useShell = process.platform === "win32";
+        const stdinMode = opts.stdin !== undefined ? "pipe" : "ignore";
+        const proc = spawn(command, args, {
+            cwd: opts.cwd,
+            env,
+            stdio: [stdinMode, "pipe", "pipe"],
+            shell: useShell,
+        });
+        if (opts.stdin !== undefined && proc.stdin) {
+            proc.stdin.write(opts.stdin);
+            proc.stdin.end();
+        }
+        proc.stdout?.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+        });
+        proc.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        proc.on("error", (err) => {
+            resolve({
+                exitCode: null,
+                stdout,
+                stderr,
+                durationMs: Math.round(performance.now() - start),
+                spawnError: err,
+            });
+        });
+        proc.on("close", (code) => {
+            resolve({
+                exitCode: code,
+                stdout,
+                stderr,
+                durationMs: Math.round(performance.now() - start),
+            });
+        });
+    });
+}
+export function tail(text, maxBytes) {
+    if (text.length <= maxBytes)
+        return text;
+    return "…" + text.slice(text.length - maxBytes);
+}

package/dist/mcp/tools/advance_gate.d.ts

@@ -0,0 +1,20 @@
+import { type AdvanceGateInput, type AdvanceGateOutput } from "../../shared/index.js";
+/**
+ * Advances the task from `from_gate` to `to_gate`.
+ *
+ * Preconditions:
+ *   - Task exists and is at from_gate.
+ *   - from_gate has a sign-off (matching its policy).
+ *   - to_gate is the next gate in the mode sequence (no skipping) UNLESS
+ *     to_gate=DEV and we're coming from REV/OPS/TEST — that's a rollback,
+ *     handled separately (see below).
+ *
+ * Rollback semantics: when to_gate=DEV and from_gate ∈ {REV, OPS, TEST}, this
+ * is a Fix Cycle. dev_rollback_count++. If the count reaches the circuit
+ * breaker threshold (default 2), advance_gate REFUSES and the caller must
+ * invoke the architect deep audit instead.
+ *
+ * RG completion: when advancing INTO RG and RG signs, task is marked completed.
+ * Future call resets dev_rollback_count if pipeline.reset_on includes rg_pass.
+ */
+export declare function advanceGate(input: AdvanceGateInput): Promise<AdvanceGateOutput>;

package/dist/mcp/tools/advance_gate.js

@@ -0,0 +1,82 @@
+import { getGateConfig, getNextGate, loadPipeline } from "../pipeline.js";
+import { latestSignoff, readTaskState, writeTaskState } from "../task_state.js";
+import { resolveActiveDomain } from "../config.js";
+/**
+ * Advances the task from `from_gate` to `to_gate`.
+ *
+ * Preconditions:
+ *   - Task exists and is at from_gate.
+ *   - from_gate has a sign-off (matching its policy).
+ *   - to_gate is the next gate in the mode sequence (no skipping) UNLESS
+ *     to_gate=DEV and we're coming from REV/OPS/TEST — that's a rollback,
+ *     handled separately (see below).
+ *
+ * Rollback semantics: when to_gate=DEV and from_gate ∈ {REV, OPS, TEST}, this
+ * is a Fix Cycle. dev_rollback_count++. If the count reaches the circuit
+ * breaker threshold (default 2), advance_gate REFUSES and the caller must
+ * invoke the architect deep audit instead.
+ *
+ * RG completion: when advancing INTO RG and RG signs, task is marked completed.
+ * Future call resets dev_rollback_count if pipeline.reset_on includes rg_pass.
+ */
+export async function advanceGate(input) {
+    const pipeline = await loadPipeline(await resolveActiveDomain());
+    const state = await readTaskState(input.task_id);
+    if (!state) {
+        throw new Error(`advance_gate: no task state for ${input.task_id}`);
+    }
+    if (state.current_gate !== input.from_gate) {
+        throw new Error(`advance_gate: task ${input.task_id} is at ${state.current_gate}, not ${input.from_gate}`);
+    }
+    if (state.mode !== input.mode) {
+        throw new Error(`advance_gate: task ${input.task_id} mode is ${state.mode}, not ${input.mode}`);
+    }
+    const fromCfg = getGateConfig(pipeline, state.mode, input.from_gate);
+    const fromSignoff = latestSignoff(state, input.from_gate);
+    if (!fromSignoff) {
+        throw new Error(`advance_gate: gate ${input.from_gate} has no sign-off (sign_off_policy=${fromCfg.sign_off_policy})`);
+    }
+    const isRollbackToDev = input.to_gate === "DEV" && ["REV", "OPS", "TEST"].includes(input.from_gate);
+    if (isRollbackToDev) {
+        const nextCount = state.dev_rollback_count + 1;
+        if (pipeline.circuit_breaker.enabled &&
+            nextCount >= pipeline.circuit_breaker.dev_rollback_threshold) {
+            // Mark task as audit-required and persist BEFORE throwing so downstream
+            // tools (audit_trail, list_artifacts) can see the state.
+            state.audit_required_at = new Date().toISOString();
+            await writeTaskState(state);
+            const skills = pipeline.circuit_breaker.audit_required_skills.join(", ");
+            throw new Error([
+                `advance_gate: circuit breaker tripped — dev_rollback_count would reach ${nextCount} (threshold ${pipeline.circuit_breaker.dev_rollback_threshold}).`,
+                `Recommended: run the audit in a FRESH session (clean-context principle — see wing_codex_product/decisions 2026-05-23, "SUBAGENTS FOR CONSISTENCY CHECKS"). In-session retry from the same Claude that just hit the wall reproduces the blind spot that caused the rollback in the first place.`,
+                `Required next steps:`,
+                `  1) load_role(role_name="${pipeline.circuit_breaker.audit_role}", domain="${pipeline.domain}")`,
+                `  2) Read skills: ${skills}`,
+                `  3) Produce architect audit (root-cause analysis, not patch attempt).`,
+                `  4) record_decision(task_id="${input.task_id}", gate="ARCH", ...) — new ARCH ADR resets dev_rollback_count to 0 via reset_on=new_arch_adr.`,
+                `  5) After reset, re-run sign_off("DEV", "den") + advance_gate(DEV → ${input.from_gate}).`,
+            ].join("\n"));
+        }
+        state.dev_rollback_count = nextCount;
+    }
+    else {
+        const expectedNext = getNextGate(pipeline, state.mode, input.from_gate);
+        if (expectedNext !== input.to_gate) {
+            throw new Error(`advance_gate: invalid transition ${input.from_gate} → ${input.to_gate} (expected ${expectedNext ?? "terminal"})`);
+        }
+    }
+    state.current_gate = input.to_gate;
+    if (state.completed_at === undefined && input.to_gate === "RG") {
+        // entered RG; completion happens when RG itself is signed; left as a marker
+    }
+    // Reset rollback counter on RG entry per reset_on policy (treat RG entry as rg_pass moment for prototype)
+    if (input.to_gate === "RG" && pipeline.circuit_breaker.reset_on.includes("rg_pass")) {
+        state.dev_rollback_count = 0;
+    }
+    await writeTaskState(state);
+    return {
+        task_id: input.task_id,
+        current_gate: input.to_gate,
+        allowed_tools: [],
+    };
+}

package/dist/mcp/tools/aggregate_run_metrics.d.ts

@@ -0,0 +1,19 @@
+import type { AggregateRunMetricsInput, AggregateRunMetricsOutput } from "../../shared/index.js";
+/**
+ * Aggregate run scorecards from the local ledger into deterministic per-agent
+ * and per-workflow statistics. Read-only surfacing tool (like
+ * audit_budget_compliance): it reports numbers, it does not judge — judgment is
+ * the Auditor agent's job (a later ADR).
+ *
+ * Attribution: per-AGENT via gate→produced_by[0] from pipeline.yaml (single
+ * source); per-WORKFLOW via mode. Only COMPLETED runs (RG signed) are
+ * aggregated; `min_runs` (default 3) is the design's small-sample guard — below
+ * it `met_threshold=false` and the Auditor should stay silent.
+ *
+ * Honest gaps surfaced in `notes`, not faked: skill invocations ARE captured as
+ * per_skill (incl. the gates a skill was pulled at) via get_skill instrumentation
+ * (ADR-DEV-121) — the remaining gap is trigger_accuracy (relevant-vs-invoked),
+ * which needs a relevance oracle; no explicit human-rejection signal; completed =
+ * RG signed (completed_at unset).
+ */
+export declare function aggregateRunMetrics(input: AggregateRunMetricsInput): Promise<AggregateRunMetricsOutput>;

package/dist/mcp/tools/aggregate_run_metrics.js

@@ -0,0 +1,139 @@
+import { loadPipeline } from "../pipeline.js";
+import { readLedger } from "../audit_ledger.js";
+import { resolveActiveDomain } from "../config.js";
+/**
+ * Aggregate run scorecards from the local ledger into deterministic per-agent
+ * and per-workflow statistics. Read-only surfacing tool (like
+ * audit_budget_compliance): it reports numbers, it does not judge — judgment is
+ * the Auditor agent's job (a later ADR).
+ *
+ * Attribution: per-AGENT via gate→produced_by[0] from pipeline.yaml (single
+ * source); per-WORKFLOW via mode. Only COMPLETED runs (RG signed) are
+ * aggregated; `min_runs` (default 3) is the design's small-sample guard — below
+ * it `met_threshold=false` and the Auditor should stay silent.
+ *
+ * Honest gaps surfaced in `notes`, not faked: skill invocations ARE captured as
+ * per_skill (incl. the gates a skill was pulled at) via get_skill instrumentation
+ * (ADR-DEV-121) — the remaining gap is trigger_accuracy (relevant-vs-invoked),
+ * which needs a relevance oracle; no explicit human-rejection signal; completed =
+ * RG signed (completed_at unset).
+ */
+export async function aggregateRunMetrics(input) {
+    const minRuns = input.min_runs;
+    const cards = await readLedger();
+    const completed = cards.filter((c) => c.completed);
+    // gate → owning role, from pipeline.yaml (first produced_by per gate).
+    const pipeline = await loadPipeline(await resolveActiveDomain());
+    const gateRole = new Map();
+    for (const m of pipeline.modes) {
+        for (const g of m.gates) {
+            if (!gateRole.has(g.gate) && g.produced_by.length > 0) {
+                gateRole.set(g.gate, g.produced_by[0]);
+            }
+        }
+    }
+    // ── per-workflow (mode) ──
+    const wf = new Map();
+    for (const c of completed) {
+        const e = wf.get(c.mode) ?? { runs: 0, completed: 0, rollbacks: 0, cb: 0, exceptions: 0 };
+        e.runs++;
+        e.completed++;
+        e.rollbacks += c.dev_rollback_count;
+        e.cb += c.circuit_breaker_tripped ? 1 : 0;
+        e.exceptions += c.exceptions_count;
+        wf.set(c.mode, e);
+    }
+    const per_workflow = [...wf.entries()].sort().map(([mode, e]) => ({
+        mode: mode,
+        runs: e.runs,
+        completed: e.completed,
+        avg_dev_rollbacks: round2(e.rollbacks / e.runs),
+        circuit_breaker_trips: e.cb,
+        total_exceptions: e.exceptions,
+    }));
+    const agents = new Map();
+    for (const c of completed) {
+        for (const g of c.gates) {
+            const role = gateRole.get(g.gate) ?? "unknown";
+            const key = `${role}|${g.gate}`;
+            const a = agents.get(key) ??
+                {
+                    role,
+                    gate: g.gate,
+                    runs_involved: 0,
+                    reworked: 0,
+                    exceptions: 0,
+                    auto_resolve: 0,
+                    fork: 0,
+                    exception: 0,
+                };
+            a.runs_involved++;
+            if (g.signoff_count > 1)
+                a.reworked++;
+            a.exceptions += g.exceptions_count;
+            if (g.classification === "auto_resolve")
+                a.auto_resolve++;
+            else if (g.classification === "fork")
+                a.fork++;
+            else if (g.classification === "exception")
+                a.exception++;
+            agents.set(key, a);
+        }
+    }
+    const per_agent = [...agents.values()]
+        .sort((x, y) => (x.role + x.gate).localeCompare(y.role + y.gate))
+        .map((a) => ({
+        role: a.role,
+        gate: a.gate,
+        runs_involved: a.runs_involved,
+        reworked: a.reworked,
+        first_try_rate: round2((a.runs_involved - a.reworked) / a.runs_involved),
+        exceptions: a.exceptions,
+        classification_breakdown: {
+            auto_resolve: a.auto_resolve,
+            fork: a.fork,
+            exception: a.exception,
+        },
+    }));
+    // ── per-skill (invocation frequency + gate/run co-occurrence) ──
+    const skills = new Map();
+    for (const c of completed) {
+        for (const s of c.skill_invocations) {
+            const a = skills.get(s.skill) ??
+                { skill: s.skill, invocations: 0, runs: new Set(), gates: new Set() };
+            a.invocations += s.count;
+            a.runs.add(c.task_id);
+            if (s.gate)
+                a.gates.add(s.gate);
+            skills.set(s.skill, a);
+        }
+    }
+    const per_skill = [...skills.values()]
+        .sort((x, y) => x.skill.localeCompare(y.skill))
+        .map((a) => ({
+        skill: a.skill,
+        invocations: a.invocations,
+        runs_invoked_in: a.runs.size,
+        gates: [...a.gates].sort(),
+    }));
+    const notes = [
+        "completed = RG sign-off present (state machine does not populate completed_at).",
+        "Skill invocations ARE captured (get_skill instrumentation, ADR-DEV-121): per_skill carries invocation counts + the gates each skill was pulled at, so skill.gates can be tuned to observed usage. The remaining gap is trigger_accuracy (relevant-vs-invoked), which needs a relevance oracle — not this data layer.",
+        "No explicit human gate-rejection signal; rejections manifest as rollbacks/exceptions.",
+        "Per-agent attribution uses gate→produced_by[0] from the active domain's pipeline.yaml.",
+        "Skill invocation = a get_skill fetch tied to a run (proxy: a skill applied from memory without re-fetching is invisible). trigger_accuracy (relevant-vs-invoked) is the Auditor agent's judgment — needs a relevance oracle, not in this data layer.",
+    ];
+    return {
+        runs_in_ledger: cards.length,
+        runs_completed: completed.length,
+        min_runs: minRuns,
+        met_threshold: completed.length >= minRuns,
+        per_workflow,
+        per_agent,
+        per_skill,
+        notes,
+    };
+}
+function round2(n) {
+    return Number.isFinite(n) ? Math.round(n * 100) / 100 : 0;
+}

package/dist/mcp/tools/apply_diff.d.ts

@@ -0,0 +1,2 @@
+import { type ApplyDiffInput, type ApplyDiffOutput } from "../../shared/index.js";
+export declare function applyDiff(input: ApplyDiffInput): Promise<ApplyDiffOutput>;

package/dist/mcp/tools/apply_diff.js

@@ -0,0 +1,29 @@
+import { spawnWithOutput, tail } from "./_subprocess.js";
+const GIT = process.platform === "win32" ? "git.exe" : "git";
+export async function applyDiff(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const apply = await spawnWithOutput(GIT, ["apply", "--whitespace=nowarn", "-"], {
+        cwd,
+        stdin: input.diff,
+    });
+    if (apply.exitCode !== 0) {
+        throw new Error(`git apply failed (exit=${apply.exitCode}): ${tail(apply.stderr, 2000) || tail(apply.stdout, 2000)}`);
+    }
+    const status = await spawnWithOutput(GIT, ["status", "--porcelain"], { cwd });
+    if (status.exitCode !== 0) {
+        throw new Error(`git status failed after apply (exit=${status.exitCode}): ${tail(status.stderr, 1000)}`);
+    }
+    const files = parsePorcelain(status.stdout);
+    return { files_changed: files };
+}
+function parsePorcelain(out) {
+    const lines = out.split(/\r?\n/).filter((l) => l.length > 0);
+    const seen = new Set();
+    for (const line of lines) {
+        const rest = line.slice(3);
+        const arrow = rest.indexOf(" -> ");
+        const path = arrow >= 0 ? rest.slice(arrow + 4) : rest;
+        seen.add(path);
+    }
+    return [...seen].sort();
+}

package/dist/mcp/tools/audit_bilocale_parity.d.ts

@@ -0,0 +1,2 @@
+import { type AuditBilocaleParityInput, type AuditBilocaleParityOutput } from "../../shared/index.js";
+export declare function auditBilocaleParity(input: AuditBilocaleParityInput): Promise<AuditBilocaleParityOutput>;