codehere 0.8.0 → 1.0.1

package/README.md

@@ -1,37 +1,36 @@
 # codehere
 
-> **Your AI agents shouldn't lock you in.**
-> Codehere keeps your memory, audit, safety, and reports portable across every coding agent you use.
+> **One owned, signed record of what your AI coding agents did, and what they cost.**
+> For a team running more than one coding agent: an independent, cross-vendor record on your own machine. One `npm install`, no account.
 
 [![npm](https://img.shields.io/npm/v/codehere)](https://www.npmjs.com/package/codehere)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow)](../LICENSE)
-[![Internal tests](https://img.shields.io/badge/internal_tests-1200%2F1200-brightgreen)]()
-[![Honest status](https://img.shields.io/badge/v0.7--honest--reframe-2026--05--19-blue)](../docs/TRUTHFUL_STATE_2026-05-19.md)
+[![Internal tests](https://img.shields.io/badge/internal_tests-1371%2F1371-brightgreen)]()
+[![Honest status](https://img.shields.io/badge/honest--status-PRODUCT__STATE-blue)](../docs/PRODUCT_STATE.md)
 
-**Codehere is the vendor-neutral layer between you and the coding agents you already use** — Claude Code, Codex, Aider, Gemini, OpenCode. One `npm install`. Local-first, OSS, no account, no IAM, no compliance prereqs. Switch agent, keep your memory. End the day with one Final Report covering everything they did.
+**Codehere is the vendor-neutral layer between you and the coding agents you already use** — Claude Code, Codex, Aider, Gemini, OpenCode. One `npm install`. Local-first, OSS, no account, no IAM, no compliance prereqs. Switch agent, keep your memory. End the day with one Final Report covering what they did.
 
 All 5 adapters (Claude Code, Codex, Aider, Gemini, OpenCode) ship adapter code for session-tracing, Final Reports, and trust scoring. Claude Code additionally gets full pre-execution safety-hook enforcement on every tool call via the Claude Agent SDK. The *memory*, *audit log*, *failover*, and *Final Report* surfaces are wired across all 5 adapters today.
 
-> **Honest status (2026-05-19)** — The 1200 internal tests verify codehere's code against codehere's own assumptions about what each adapter emits. They do **not** systematically verify against real-adapter outputs in production. Real-adapter contract verification is the v0.7 release work — see [`docs/TRUTHFUL_STATE_2026-05-19.md`](../docs/TRUTHFUL_STATE_2026-05-19.md) for the verified / assumed / unverified classification of every surface.
+> **Honest status** — 1371 internal tests verify codehere's code against codehere's own assumptions about what each adapter emits, plus an end-to-end suite (`npm run e2e`) that drives the real product in a browser. The current verified / planned / blocked state of every surface lives in [`docs/PRODUCT_STATE.md`](../docs/PRODUCT_STATE.md) and the capability scoreboard [`docs/CAPABILITIES.md`](../docs/CAPABILITIES.md).
 
 The enterprise tier is owned by [OpenAI Frontier](https://openai.com/index/introducing-openai-frontier/) (8-14 weeks of deploy prereqs, sales-team gated) and [Anthropic Cowork](https://www.anthropic.com/product/claude-cowork) (paid Claude subscription, single-vendor). Codehere fills the gap they structurally can't reach: **the individual / small-team / no-IT-department tier, vendor-neutral**.
 
 > See [`docs/STRATEGIC_VISION.md`](../docs/STRATEGIC_VISION.md) Appendix C and [`docs/figures/positioning-matrix.svg`](../docs/figures/positioning-matrix.svg) for the full positioning chart.
 
-One layer, every agent, your work stays portable.
+5 vendors supported, 2 proven on a real billed run. Your record, your machine, nobody's vendor.
 
 ---
 
 ## Recipe — setup to first audit in 30 minutes
 
 > One folder convention, one prompt formula, four ready-to-use prompts.
-> Full version: **[docs/RECIPE.md](../docs/RECIPE.md)**.
 
 ### Setup (once)
 
 | | | |
 |---|---|---|
-| 1 | **Install** | `npm install -g codehere` (Node 20+) — v0.6.0 is the current stable |
+| 1 | **Install** | `npm install -g codehere` (Node 20+) — v0.8.0 is the current published stable (`@latest`) |
 | 2 | **Detect environment** | `codehere setup` — checks API key, finds your repo |
 | 3 | **Install the safety hook** | `codehere hook install` — every Claude Code tool call now audited |
 | 4 | **Install at least one specialist** | Claude Code: `npm i -g @anthropic-ai/claude-code` (Codex / Aider / OpenCode / Gemini also supported · see [docs/integrations/](../docs/integrations/) for Cursor MCP setup) |
@@ -135,7 +134,7 @@ For technical readers — the living documents that describe codehere as a syste
 
 | Doc | What it is |
 |---|---|
-| [`docs/decisions/`](../docs/decisions/) | ADR registry — every locked architectural decision (audit-first moat, supervisor-agent positioning, local-first, F3 memory layout, generic-CLI adapter, ...) numbered, dated, with rejected alternatives + rollback triggers |
+| [`docs/BLUEPRINT.md`](../docs/BLUEPRINT.md) | The HOW — system overview, module map, data flow, adapter contracts, audit chain, failover, F3 memory, cost-bounded execution |
 | [`docs/THREAT_MODEL.md`](../docs/THREAT_MODEL.md) | Every attack surface, current mitigation, residual risk, planned hardening — npm supply chain, hook bypass, symlink redirect, audit log tampering, MCP server, prompt injection |
 | [`docs/CAPABILITIES.md`](../docs/CAPABILITIES.md) | Honest matrix of what each adapter can and cannot do today — Claude Code, Codex, Aider, OpenCode, Gemini, Generic CLI — across spawn, stream, per-tool block, audit, F3 memory, auth |
 | [`agent/REPO_MAP.md`](./REPO_MAP.md) | One-line-per-file index of the 54 source files with their top-level exports — generated, regenerated via `npm run repomap` after renames |
@@ -181,12 +180,22 @@ Every blocked call is logged with the reason; every allowed call is logged with
 codehere serve
 ```
 
-Exposes 4 read-only tools to any MCP client (Claude Desktop, Cursor, Zed, Continue, Cline, etc.):
+Exposes 6 read-only tools to any MCP client (Claude Desktop, Cursor, Zed, Continue, Cline, etc.):
 
 - `codehere_trust` · score a file or code snippet
 - `codehere_scan` · scan text for injection / threat patterns
 - `codehere_review` · scan a directory and return riskiest files
 - `codehere_audit` · read the local hook audit log
+- `codehere_spend` · today's estimated spend by agent and project, vs your budget
+- `codehere_team` · the team's merged cost and record across machines
+
+Connect it to **Claude Code** in one command (the daemon must be running):
+
+```
+claude mcp add --transport http codehere http://127.0.0.1:3773/mcp
+```
+
+Then from inside a Claude Code session you can ask things like "what did we spend today?" or "what did each agent do on this repo?" and it answers inline, no switching to the browser. Remove with `claude mcp remove codehere`.
 
 `codehere serve --show-config` prints the JSON block to paste into Claude Desktop's MCP settings.
 
@@ -196,8 +205,8 @@ For depth beyond this README:
 
 - **[docs/STRATEGIC_VISION.md](../docs/STRATEGIC_VISION.md)** · 20-year invariants + v4 positioning (individual-tier vendor-neutral) · figures in `docs/figures/`
 - **[docs/PRD.md](../docs/PRD.md)** · master decision document · features, architecture, roadmap
-- **[docs/SECURITY_AUDIT_2026-05-01.md](../docs/SECURITY_AUDIT_2026-05-01.md)** · first-party security audit · OWASP Top 10 + STRIDE · 0 critical / 0 high · 2 medium fixed inline · methodology disclosed · reproducible
-- **[docs/archive/](../docs/archive/)** · earlier living docs (CODEHERE spec, EXPERIENCE story, AUDIT) preserved for history
+- **[docs/THREAT_MODEL.md](../docs/THREAT_MODEL.md)** · security posture · OWASP Top 10 + STRIDE · trust boundaries · hook-bypass analysis
+- **[docs/STRATEGY.md](../docs/STRATEGY.md)** · current strategy · competitive analysis (Conductor / Whim / Hermes), positioning, the wedge
 - **[CONTRIBUTING.md](../CONTRIBUTING.md)** · how to contribute · setup, commit discipline, testing philosophy
 - **[SECURITY.md](../SECURITY.md)** · responsible disclosure · `security@codehere.uk`
 - **[CODE_OF_CONDUCT.md](../CODE_OF_CONDUCT.md)** · community standards

package/dist/application/services/verdict-service.js

@@ -0,0 +1,154 @@
+/**
+ * VerdictService — the single owner of how a session's honesty verdict is
+ * ASSESSED from its parts (R11 / ARCHITECTURE.md M2).
+ *
+ * Before this, every surface re-derived the verdict inputs inline: the HTTP
+ * `/api/tasks` route did it twice (spawned + persisted records) and the
+ * `codehere verify` CLI did it a third time, each independently mapping a session
+ * to `verifyClaim({ summary, artifacts, steps })`. A change to what feeds the
+ * verdict meant editing 3+ sites in 2 layers — the "verdict has no owner" finding.
+ *
+ * This is the one entry point. It COMPOSES the pure use-cases (today `verifyClaim`;
+ * `reconcileAudit`, composed into the single `SessionVerdict`) — it does
+ * NOT re-implement their logic. Surfaces render what this returns; they never
+ * recompute a verdict rule.
+ */
+import { verifyClaim } from '../use-cases/verify-claim.js';
+/**
+ * Assess a session's claim-vs-reality verdict. The single owner of the
+ * session → `verifyClaim` input mapping. Pure (delegates to the pure use-case).
+ */
+export function assessSession(session) {
+    return verifyClaim({
+        summary: session.finalReport?.summary,
+        artifacts: session.artifacts,
+        steps: session.steps,
+    });
+}
+/** Compose the single verdict object every surface consumes. */
+export function composeVerdict(session, audit, crossVendor) {
+    const verdict = {
+        claim: assessSession(session),
+        ...(audit !== undefined ? { audit } : {}),
+        ...(crossVendor !== undefined ? { crossVendor } : {}),
+    };
+    // The one owner attaches the grade so no surface re-derives "is this green".
+    verdict.grade = gradeComposite(verdict);
+    return verdict;
+}
+/**
+ * The one canonical verdict vocabulary. Every surface (web app + CLI) reads its
+ * verdict word from here, so the same state reads the same word everywhere
+ * instead of each surface re-deriving its own ("Proven" vs "Verified" vs
+ * "verified" for the flagship cross-vendor case was a real three-way split).
+ * Wording locked with Ega 2026-06-23, refined 2026-07-17: a green composite grade
+ * reads "Verified" on EVERY surface — a single other-vendor review CORROBORATES,
+ * it doesn't prove, so the seal expands it as "Corroborated by <vendor>" and no
+ * headline says "Proven" for a lone reviewer. "Proven" stays in the vocab
+ * (reserved) but is not rendered today. "Caught" = a contradicted claim.
+ *
+ * The first seven are the canonical headline words. `partial` is a residual the
+ * web still emits for two narrow "couldn't fully verify" branches (not-a-git-repo
+ * and the catch-all); it is kept here so nothing is silently dropped, pending a
+ * decision to fold it into `unverified`.
+ */
+export const VERDICT_WORDS = {
+    proven: 'Proven',
+    verified: 'Verified',
+    reported: 'Reported',
+    stopped: 'Stopped',
+    caught: 'Caught',
+    unverified: 'Unverified',
+    practice: 'Practice',
+    partial: 'Partial',
+};
+/**
+ * The green-verdict corroboration clause, scoped to the ACTUAL independent
+ * signal(s) that earned the green. A LONE cross-vendor pass is one reviewer's
+ * corroboration — "corroborated by one other vendor" — never "independently
+ * corroborated", which would overstate a single reviewer. Disk-observed writes
+ * and multi-signal greens keep the "independently corroborated" wording. The
+ * web mirrors this inline (app-script `indepClause`) so both surfaces name the
+ * same signal for the same state.
+ */
+export function corroborationClause(grade) {
+    const pass = grade.signals.filter((s) => s.provenance !== 'self-reported' && s.state === 'pass');
+    if (pass.length === 1 && pass[0].provenance === 'adversarial')
+        return 'corroborated by one other vendor.';
+    const hasDisk = pass.some((s) => s.provenance === 'observed');
+    return hasDisk ? 'independently corroborated · file writes confirmed on disk.' : 'independently corroborated.';
+}
+/**
+ * Grade a composed `SessionVerdict` into the headline the surface may show.
+ * Pure — no I/O. The single owner of "what is the ✓ allowed to say."
+ */
+export function gradeComposite(verdict) {
+    const signals = [];
+    // 1 · self-reported — the claim vs its own artifacts.
+    const cs = verdict.claim.status;
+    const claimState = cs === 'verified' ? 'pass' : cs === 'broken' ? 'fail' : cs === 'no-report' ? 'absent' : 'neutral';
+    signals.push({
+        name: 'self-report',
+        provenance: 'self-reported',
+        state: claimState,
+        detail: `the agent's report ${cs === 'verified' ? 'matches' : cs === 'broken' ? 'contradicts' : 'makes no checkable claim against'} its own recorded work`,
+    });
+    // 2 · observed — the audit's declared writes vs the real git diff.
+    const av = verdict.audit?.verdict;
+    if (av !== undefined) {
+        const auditState = av === 'consistent' ? 'pass' : 'neutral'; // 'unconfirmed' is honest under-count, never a fail
+        signals.push({
+            name: 'audit-on-disk',
+            provenance: 'observed',
+            state: auditState,
+            detail: av === 'consistent'
+                ? 'declared file writes confirmed on disk'
+                : av === 'no-writes'
+                    ? 'no file writes to confirm'
+                    : av === 'unconfirmed'
+                        ? "couldn't confirm every declared write"
+                        : 'on-disk effect unobservable',
+        });
+    }
+    // 3 · adversarial — a different vendor independently reviewed it.
+    const cv = verdict.crossVendor;
+    if (cv !== undefined) {
+        const cvState = cv.proven ? 'pass' : 'neutral'; // not-proven ⇒ shown, never a fail (codehere doesn't adjudicate)
+        signals.push({
+            name: 'cross-vendor',
+            provenance: 'adversarial',
+            state: cvState,
+            detail: cv.proven
+                ? `${cv.reviewer.agent} independently reviewed ${cv.writer.agent}'s work, integrity-checked`
+                : cv.crossVendor
+                    ? `cross-vendor review ran but isn't a clean proof — ${cv.caveats[0] ?? 'see caveats'}`
+                    : 'not a cross-vendor review',
+        });
+    }
+    const independentPass = signals.some((s) => s.provenance !== 'self-reported' && s.state === 'pass');
+    const selfFailed = claimState === 'fail';
+    let headline;
+    if (cs === 'no-report')
+        headline = 'no-report';
+    else if (selfFailed)
+        headline = 'broken';
+    else if (cs === 'nothing-to-verify' && !independentPass)
+        headline = 'nothing-to-verify';
+    else if (independentPass)
+        headline = 'proven';
+    else
+        headline = 'reported';
+    const green = headline === 'proven';
+    const clause = corroborationClause({ signals });
+    const summary = headline === 'proven'
+        ? clause.charAt(0).toUpperCase() + clause.slice(1)
+        : headline === 'broken'
+            ? 'The report contradicts its own recorded work.'
+            : headline === 'reported'
+                ? 'Self-reported only — no independent signal has corroborated it yet.'
+                : headline === 'nothing-to-verify'
+                    ? 'No checkable claim to verify.'
+                    : 'No report to grade.';
+    return { headline, green, signals, summary };
+}
+//# sourceMappingURL=verdict-service.js.map

package/dist/application/use-cases/assess-cross-vendor.js

@@ -0,0 +1,126 @@
+/**
+ * Cross-vendor verdict — the receipt a model lab structurally cannot sell.
+ *
+ * When one vendor wrote code and a DIFFERENT vendor reviewed it in the same
+ * room, this produces the proof-of-process: who wrote, who reviewed, what the
+ * audit chain attributes to each, and the combined cost. It is the output that
+ * turns the wedge from "two sessions happened to share a room" into a stated,
+ * checkable claim.
+ *
+ * HONESTY (the trap the wedge test already flagged, refuter-pinned):
+ * codehere does NOT adjudicate whether the reviewer found a REAL bug — it can't
+ * judge code correctness, and a generic "found a flaw" tripwire would read green
+ * on a review that found nothing. So this proves the PROCESS (a different vendor
+ * independently reviewed and recorded findings, integrity-checked) and surfaces
+ * the reviewer's findings verbatim for the human to judge. `proven` is true ONLY
+ * when it really is a cross-vendor review, the chain verifies, both vendors are
+ * attributed in it, and the review actually produced output. Anything short of
+ * that is stated plainly, never laundered into a green check.
+ *
+ * Wording stays "integrity-checked", never "tamper-evident" (domain/audit.ts:
+ * the unkeyed SHA-256 chain detects naive edits, not a determined re-walk).
+ */
+import { reconcileAudit } from './reconcile-audit.js';
+import { estimateCostUsd } from '../../infrastructure/cost/spend-aggregator.js';
+/** Read-ish tool names across adapters — used to report "reviewer read N files".
+ *  Conservative: only names that are unambiguously a read. A reviewer SHOULD
+ *  have only reads; any write is surfaced as a caveat, not hidden. */
+const READ_TOOLS = new Set(['read', 'glob', 'grep', 'ls', 'cat', 'view', 'search_file', 'list_files'].map((t) => t.toLowerCase()));
+/** Same WRITE_TOOLS spirit as reconcile-audit, kept local + minimal: we only
+ *  need "did the reviewer mutate anything" (it shouldn't). */
+const WRITE_TOOLS = new Set([
+    'write',
+    'edit',
+    'multiedit',
+    'notebookedit',
+    'delete',
+    'write_file',
+    'edit_file',
+    'create_file',
+    'str_replace',
+    'apply_patch',
+].map((t) => t.toLowerCase()));
+function countTools(entries, set) {
+    return entries.filter((e) => set.has((e.toolName || '').toLowerCase())).length;
+}
+function fmtUsd(n) {
+    return n === 0 ? '$0' : `$${n.toFixed(2)}`;
+}
+export function assessCrossVendor(input) {
+    const { writer, reviewer, entries, chain } = input;
+    const crossVendor = writer.agent !== reviewer.agent;
+    // Attribute by the sessionId the tool-call entries carry. For a direct run
+    // that's the run's own sessionId; for a conductor-routed run the audit hook
+    // keyed the entries by the SPECIALIST's runtime id (delegateSessionId), not
+    // the conductor task's id — so match EITHER (1.3). Without the delegate leg,
+    // every Auto-routed task reads "couldn't attribute" though its writes are in
+    // the chain. pre_prompt scans use a separate scan id and carry no write/read
+    // tool, so they never inflate counts; sessionId scoping stays precise and
+    // immune to mixing other rooms' same-vendor sessions.
+    const matchesRun = (e, run) => e.sessionId === run.sessionId || (run.delegateSessionId !== undefined && e.sessionId === run.delegateSessionId);
+    const writerEntries = entries.filter((e) => matchesRun(e, writer));
+    const reviewerEntries = entries.filter((e) => matchesRun(e, reviewer));
+    const writerRecon = reconcileAudit(writerEntries, writer.artifacts);
+    const reviewerRead = countTools(reviewerEntries, READ_TOOLS);
+    const reviewerWrote = countTools(reviewerEntries, WRITE_TOOLS);
+    const reviewHasFindings = !!(reviewer.reviewText && reviewer.reviewText.trim().length > 0);
+    const writerAttributed = writerEntries.length > 0;
+    const reviewerAttributed = reviewerEntries.length > 0;
+    const totalCostUsd = estimateCostUsd(writer.agent, writer.artifacts?.usage) + estimateCostUsd(reviewer.agent, reviewer.artifacts?.usage);
+    const caveats = [];
+    if (!crossVendor)
+        caveats.push(`Same vendor on both sides (${writer.agent}) — not a cross-vendor proof.`);
+    if (!chain.valid)
+        caveats.push("Audit chain didn't verify — the proof is withheld until it does.");
+    if (crossVendor && !writerAttributed)
+        caveats.push(`Couldn't attribute ${writer.agent}'s work in the audit chain.`);
+    if (crossVendor && !reviewerAttributed)
+        caveats.push(`Couldn't attribute ${reviewer.agent}'s review in the audit chain.`);
+    if (reviewerWrote > 0)
+        caveats.push(`${reviewer.agent} also changed ${reviewerWrote} file(s) — this wasn't a read-only review.`);
+    if (!reviewHasFindings)
+        caveats.push(`${reviewer.agent}'s review recorded no findings text.`);
+    // A clean cross-vendor REVIEW proof is read-only — if the reviewer also wrote,
+    // the receipt can't honestly say "changed nothing", so it isn't `proven`
+    // (the reviewerWrote caveat above explains why). Refuter 2026-06-13.
+    const proven = crossVendor && chain.valid && writerAttributed && reviewerAttributed && reviewHasFindings && reviewerWrote === 0;
+    const summary = proven
+        ? `${reviewer.agent} reviewed ${writer.agent}'s work in this room. ` +
+            `${writer.agent} ${writerRecon.verdict === 'consistent' ? `wrote ${writerRecon.filesObserved} file(s), confirmed on disk` : `recorded ${writerRecon.writeToolCalls} write(s)`}; ` +
+            `${reviewer.agent} read ${reviewerRead}, changed nothing. ` +
+            `Audit chain: ${chain.chainedEntries}/${chain.totalEntries} integrity-checked, both vendors attributed. ` +
+            `Combined cost: ${fmtUsd(totalCostUsd)}.`
+        : crossVendor
+            ? `${reviewer.agent} reviewed ${writer.agent}'s work, but this isn't a clean cross-vendor proof yet — ${caveats[0]}`
+            : caveats[0];
+    return {
+        crossVendor,
+        proven,
+        writer: {
+            agent: writer.agent,
+            sessionId: writer.sessionId,
+            wrote: writerRecon.writeToolCalls,
+            reconciliation: writerRecon.verdict,
+            reconNote: writerRecon.note,
+        },
+        reviewer: {
+            agent: reviewer.agent,
+            sessionId: reviewer.sessionId,
+            read: reviewerRead,
+            wrote: reviewerWrote,
+            hasFindings: reviewHasFindings,
+        },
+        chain: {
+            totalEntries: chain.totalEntries,
+            chainedEntries: chain.chainedEntries,
+            valid: chain.valid,
+            writerAttributed,
+            reviewerAttributed,
+        },
+        totalCostUsd,
+        summary,
+        caveats,
+        reviewText: reviewer.reviewText,
+    };
+}
+//# sourceMappingURL=assess-cross-vendor.js.map

package/dist/application/use-cases/build-cross-vendor-verdict.js

@@ -0,0 +1,118 @@
+/**
+ * Gather the live data a cross-vendor verdict needs (room sessions, audit
+ * entries, chain facts) and run the pure `assessCrossVendor`. Shared by the CLI
+ * (`codehere verify`) and the daemon (GET /api/task/:id/cross-vendor) so both
+ * surfaces compute the receipt the same way — one path, no drift.
+ *
+ * The pure judgment lives in assess-cross-vendor.ts; this is the (disk-reading)
+ * glue around it.
+ *
+ * PAIRING is OBSERVED, not inferred: a reviewer records the writer it reviewed
+ * (parentSessionId, stamped at spawn). Older / manual reviews that predate that
+ * ground truth fall back to a STRICT inference — a candidate is only treated as
+ * a reviewer if it changed NO files (a read-only review). A session that wrote
+ * files is a writer, never a reviewer; inferring otherwise mispaired in a
+ * multi-run room (a later writer read as a reviewer of an earlier one).
+ */
+import { existsSync, readFileSync } from 'fs';
+import { loadRecent, loadSessionById, } from '../../infrastructure/orchestration/session-persistence.js';
+import { AUDIT_FILE, verifyAuditChain } from '../../infrastructure/hooks/claude-sdk-hook.js';
+import { assessCrossVendor } from './assess-cross-vendor.js';
+/** Assemble the verdict for a KNOWN writer↔reviewer pair (the role decision is
+ *  the caller's; this just reads the chain + runs the pure assessment). */
+function assembleVerdict(writer, reviewer) {
+    let entries = [];
+    if (existsSync(AUDIT_FILE)) {
+        entries = readFileSync(AUDIT_FILE, 'utf-8')
+            .split('\n')
+            .filter(Boolean)
+            .map((l) => {
+            try {
+                return JSON.parse(l);
+            }
+            catch {
+                return undefined;
+            }
+        })
+            .filter((e) => !!e);
+    }
+    const chain = verifyAuditChain(AUDIT_FILE);
+    const reviewText = reviewer.finalReport?.summary?.trim() ||
+        (reviewer.steps ?? [])
+            .filter((s) => s.kind === 'say')
+            .map((s) => s.label)
+            .join('\n')
+            .trim() ||
+        undefined;
+    return assessCrossVendor({
+        writer: {
+            agent: writer.agent,
+            sessionId: writer.sessionId,
+            delegateSessionId: writer.delegateSessionId,
+            artifacts: writer.artifacts,
+        },
+        reviewer: {
+            agent: reviewer.agent,
+            sessionId: reviewer.sessionId,
+            delegateSessionId: reviewer.delegateSessionId,
+            artifacts: reviewer.artifacts,
+            reviewText,
+        },
+        entries,
+        chain: { totalEntries: chain.totalEntries, chainedEntries: chain.chainedEntries, valid: chain.valid },
+    });
+}
+/** Build the cross-vendor verdict for a session that REVIEWED an earlier writer
+ *  in the same room. Returns undefined when there's no such pair (the session
+ *  isn't a cross-vendor review). */
+export function buildCrossVendorVerdict(reviewer) {
+    if (!reviewer.cwd)
+        return undefined;
+    // OBSERVED link: an auto-review records the exact writer it reviewed. Gate on
+    // isReview, NOT parentSessionId alone — parentSessionId is overloaded (the room
+    // composer also sets it when a goal is HANDED OFF to a different vendor to
+    // CONTINUE the work, which is not a review). Only isReview means "this session
+    // reviewed its parent." Without this gate a continuation would be falsely
+    // labeled "X reviewed Y's work."
+    if (reviewer.isReview && reviewer.parentSessionId) {
+        const writer = loadSessionById(reviewer.parentSessionId);
+        if (!writer || writer.agent === reviewer.agent)
+            return undefined;
+        return assembleVerdict(writer, reviewer);
+    }
+    // LEGACY / manual: no recorded link. Only a READ-ONLY session (changed no
+    // files) can be a reviewer — a session that wrote files is a writer. This is
+    // the guard that stops a later writer being mispaired as a reviewer.
+    if ((reviewer.artifacts?.files?.length ?? 0) > 0)
+        return undefined;
+    const writer = loadRecent(50)
+        .filter((s) => s.cwd === reviewer.cwd &&
+        s.sessionId !== reviewer.sessionId &&
+        s.startedAt < reviewer.startedAt &&
+        s.agent !== reviewer.agent &&
+        (s.artifacts?.files?.length ?? 0) > 0)
+        .sort((a, b) => b.startedAt - a.startedAt)[0];
+    if (!writer)
+        return undefined;
+    return assembleVerdict(writer, reviewer);
+}
+/** Convenience for the daemon route: load the session by id, then build. */
+export function buildCrossVendorVerdictById(sessionId) {
+    const reviewer = loadSessionById(sessionId);
+    return reviewer ? buildCrossVendorVerdict(reviewer) : undefined;
+}
+/** The WRITER-keyed mirror: given a writer, find the reviewer that reviewed IT
+ *  and build the verdict. A user opens the WRITER's run and wants to see "a
+ *  different vendor reviewed this"; the reviewer recorded the link, so we read
+ *  it directly (parentSessionId === this writer + isReview) — no inference, no
+ *  mispairing. Returns undefined when no review of this writer exists. */
+export function buildCrossVendorVerdictForWriter(writerId) {
+    const writer = loadSessionById(writerId);
+    if (!writer || !writer.cwd)
+        return undefined;
+    const reviewer = loadRecent(50).find((s) => s.isReview === true && s.parentSessionId === writerId);
+    if (!reviewer || reviewer.agent === writer.agent)
+        return undefined;
+    return assembleVerdict(writer, reviewer);
+}
+//# sourceMappingURL=build-cross-vendor-verdict.js.map

package/dist/application/use-cases/export-aat.js

@@ -0,0 +1,107 @@
+/**
+ * export-aat — map codehere's hash-chained audit log to the IETF
+ * draft-sharif-agent-audit-trail-00 (AAT) record structure, JSONL (the
+ * draft's RECOMMENDED primary export format).
+ *
+ * Why: the 2026 wave-4 swarm discourse converged on audit-trail
+ * standardization (EU AI Act Art. 12 logging lands Aug 2026; the AAT draft
+ * maps to SOC 2 / ISO 42001). codehere's chain already carries the
+ * substance — agent identity, action, outcome, risk, hash-chained
+ * SHA-256 linking — so speaking the emerging standard is a mapping, not a
+ * rebuild.
+ *
+ * HONEST MAPPING NOTES (each also stated in the export header record):
+ *  - trust_level is "L0" for every record: AAT's levels describe the
+ *    AGENT's cryptographic identity, and codehere agents carry none (the
+ *    DAEMON's keystore signs the chain tip — that is recorder identity,
+ *    not agent identity; claiming L1 would overstate).
+ *  - prev_hash/record hashing is codehere's sorted-key JSON canon over the
+ *    original entries — same SHA-256 chain idea as the draft, but NOT
+ *    RFC 8785 JCS, and the hashes commit to the ORIGINAL codehere entries,
+ *    not to the AAT projection. Verify against the source chain.
+ *  - input_hash is SHA-256 of the recorded toolInput; the raw input stays
+ *    local (the draft's privacy-by-design posture).
+ *  - record_id is the entry's own content hash formatted as a UUID-shaped id —
+ *    deterministic, no invented identity (UUID-shaped, not an RFC 4122 UUID).
+ */
+import { createHash } from 'crypto';
+import { existsSync, readFileSync } from 'fs';
+function hashToUuid(hexHash) {
+    const h = hexHash.padEnd(32, '0').slice(0, 32);
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}
+function agentOf(entry) {
+    try {
+        const ti = JSON.parse(entry.toolInput);
+        if (typeof ti.agent === 'string' && ti.agent)
+            return ti.agent;
+    }
+    catch {
+        /* non-JSON toolInput */
+    }
+    return 'unrecorded';
+}
+export function exportAat(auditFile, now = new Date().toISOString()) {
+    const out = {
+        header: {
+            format: 'codehere-aat-export',
+            source_format: 'draft-sharif-agent-audit-trail-00',
+            exported_at: now,
+            record_count: 0,
+            notes: [
+                'trust_level is L0 for all records: AAT trust levels describe the AGENT’s cryptographic identity and codehere agents carry none — the daemon’s keystore signs the chain tip (recorder identity, not agent identity).',
+                'prev_hash values are codehere’s SHA-256 chain over the ORIGINAL entries (sorted-key JSON canonicalization, not RFC 8785 JCS); verify against the source chain, not this projection.',
+                'input_hash is SHA-256 of the recorded tool input; raw inputs stay local (privacy by design).',
+                'record_id is the source entry’s content hash formatted as a UUID-shaped id — deterministic, not an invented identity.',
+            ],
+        },
+        records: [],
+        skippedLegacy: 0,
+    };
+    if (!existsSync(auditFile))
+        return out;
+    for (const line of readFileSync(auditFile, 'utf-8').split('\n')) {
+        const raw = line.trim();
+        if (!raw)
+            continue;
+        let e;
+        try {
+            e = JSON.parse(raw);
+        }
+        catch {
+            out.skippedLegacy++;
+            continue;
+        }
+        if (typeof e.seq !== 'number' || typeof e.entryHash !== 'string' || typeof e.prevHash !== 'string') {
+            out.skippedLegacy++; // pre-chain legacy — no hash-chained position to export
+            continue;
+        }
+        const rec = {
+            record_id: hashToUuid(e.entryHash),
+            timestamp: e.timestamp,
+            agent_id: `urn:agent:${agentOf(e)}.codehere.local`,
+            session_id: e.sessionId,
+            action_type: e.toolName === 'pre_prompt' ? 'decision' : 'tool_call',
+            action_detail: {
+                tool_name: e.toolName,
+                input_hash: createHash('sha256')
+                    .update(e.toolInput ?? '')
+                    .digest('hex'),
+                ...(e.writer ? { writer: e.writer } : {}),
+            },
+            outcome: e.blocked ? 'blocked' : 'success',
+            trust_level: 'L0',
+            prev_hash: e.prevHash,
+            ...(typeof e.riskScore === 'number' && e.riskScore > 0 ? { risk_score: Math.min(1, e.riskScore / 100) } : {}),
+        };
+        out.records.push(rec);
+    }
+    out.header.record_count = out.records.length;
+    return out;
+}
+/** Serialize per the draft's recommended JSONL: header line first, then one
+ *  record per line. */
+export function aatToJsonl(exp) {
+    return [JSON.stringify(exp.header), ...exp.records.map((r) => JSON.stringify(r))].join('\n') + '\n';
+}
+//# sourceMappingURL=export-aat.js.map