codictator 0.1.3 → 0.2.1

package/dist/cli/setup.js

@@ -0,0 +1,143 @@
+// SPEC §4.19.6: one-shot adoption. Flags mirror init (§4.19.2); the run
+// is the init path (or regen over an existing config) plus install, hooks
+// and verify, ending at the extension handoff (§4.20.1). Every step
+// delegates to the existing init, guardrail and verify handlers; no step
+// logic is duplicated here.
+import { ENGINE_VERSION } from "../features/config/index.js";
+import { err, ok } from "../kernel/index.js";
+import { configureHooksPath, handleRegen, writeHookFiles, } from "./guardrail.js";
+import { parseInitFlags } from "./init.js";
+import { defaultHarnesses, initPreamble, runInitSequence, } from "./init-plan.js";
+import { handleVerify } from "./inspect.js";
+import { setupGitignoreStep } from "./setup-gitignore.js";
+import { hasEffectivePacks, SETUP_EXTENSION_ID, SETUP_EXTENSION_INSTALL, setupHandoffLines, } from "./setup-handoff.js";
+import { setupInstallHere, setupInstallLayout } from "./setup-install.js";
+import { fail, MIN_NODE_MAJOR, nodeMajor, nodeTooOldMessage, printHuman, printJson, readStateText, usageError, } from "./shared.js";
+export const SETUP_USAGE = "usage: codictator setup [--harness <id> ...] [--profile <app|library|cli|service>] [--pack <id> ...] [--tool <role>=<command>@<pin> ...] [--repair]";
+// SPEC §4.19.6 step 1: the Node floor, the human gate and the repo root.
+async function setupPreflight(req) {
+    const version = req.nodeVersion ?? process.version;
+    if (nodeMajor(version) < MIN_NODE_MAJOR) {
+        return fail("CDX-E002", nodeTooOldMessage(version), "Install a newer Node, then retry the tool call.", req.json);
+    }
+    return initPreamble(req);
+}
+// SPEC §4.19.6 step 2: the adoption path. An existing config without
+// --repair re-renders from config; otherwise the init path runs.
+async function setupRegenPath(req, steps) {
+    const regen = await handleRegen({ ...req, args: [] });
+    if (!regen.ok) {
+        return regen;
+    }
+    steps.push({ step: "init", ok: true, detail: { mode: "regen" } });
+    printHuman("setup: guardrails regenerated from the existing config", req.quiet);
+    return ok(0);
+}
+async function setupInitPath(req, root, flags, steps) {
+    const engineVersion = req.engineVersion ?? ENGINE_VERSION;
+    const sequenced = await runInitSequence(root, req, flags, defaultHarnesses(flags), engineVersion);
+    if (!sequenced.ok) {
+        return sequenced;
+    }
+    steps.push({
+        step: "init",
+        ok: true,
+        detail: {
+            mode: flags.repair ? "repair" : "fresh",
+            files: sequenced.value.written.map((entry) => entry.path),
+        },
+    });
+    printHuman("setup: guardrails written from the init path", req.quiet);
+    return ok(0);
+}
+async function setupAdopt(req, root, flags, steps) {
+    const existing = await readStateText(root, ".codictator/config.json");
+    if (existing !== undefined && !flags.repair) {
+        return setupRegenPath(req, steps);
+    }
+    return setupInitPath(req, root, flags, steps);
+}
+// SPEC §4.19.6 step 6: hooks via the install-hooks writers.
+async function setupHooksStep(req, root, steps) {
+    const written = await writeHookFiles(root);
+    if (!written.ok) {
+        return fail("CDX-E903", written.error.message, written.error.remediation, req.json);
+    }
+    await configureHooksPath(root, req);
+    steps.push({ step: "hooks", ok: true });
+    printHuman("setup: hooks installed", req.quiet);
+    return ok(0);
+}
+// SPEC §4.19.6 step 7: the first evaluation over the adopted repo. A
+// blocking verdict stops the run with verify's own mapping (exit 1).
+async function setupVerifyStep(req, steps) {
+    const verdict = await handleVerify({ ...req, args: [] });
+    if (!verdict.ok || verdict.value !== 0) {
+        return verdict;
+    }
+    steps.push({ step: "verify", ok: true });
+    return ok(0);
+}
+// SPEC §4.19.6 step 8 + §4.20.1: the views connect once a config exists;
+// the human installs the extension with the printed command.
+function setupHandoff(req, root, steps, emptyPacks) {
+    steps.push({
+        step: "handoff",
+        ok: true,
+        detail: { extension: SETUP_EXTENSION_ID },
+    });
+    if (req.json) {
+        printJson({
+            setup: true,
+            root,
+            steps,
+            extension: { id: SETUP_EXTENSION_ID, install: SETUP_EXTENSION_INSTALL },
+        });
+    }
+    else {
+        for (const line of setupHandoffLines(emptyPacks)) {
+            printHuman(line, req.quiet);
+        }
+    }
+    return ok(0);
+}
+// SPEC §4.19.6: the eight adoption steps in order; a step failure stops
+// the run with that step's §8.2 mapping.
+export async function handleSetup(req) {
+    const flags = parseInitFlags(req.args);
+    if (flags === undefined) {
+        return usageError(SETUP_USAGE);
+    }
+    const preflight = await setupPreflight(req);
+    if (typeof preflight !== "string") {
+        return preflight;
+    }
+    const root = preflight;
+    const steps = [{ step: "preflight", ok: true }];
+    const adopted = await setupAdopt(req, root, flags, steps);
+    if (!adopted.ok) {
+        return adopted;
+    }
+    const ignored = await setupGitignoreStep(req, root, steps);
+    if (!ignored.ok) {
+        return ignored;
+    }
+    const layout = await setupInstallLayout(req, root, steps);
+    if (!layout.ok) {
+        return err(layout.error);
+    }
+    const installed = await setupInstallHere(req, root, layout.value, steps);
+    if (!installed.ok) {
+        return installed;
+    }
+    const hooked = await setupHooksStep(req, root, steps);
+    if (!hooked.ok) {
+        return hooked;
+    }
+    const verified = await setupVerifyStep(req, steps);
+    if (!verified.ok) {
+        return verified;
+    }
+    const emptyPacks = !(await hasEffectivePacks(root, flags));
+    return setupHandoff(req, root, steps, emptyPacks);
+}

package/dist/features/adapters/harness-files.d.ts

@@ -0,0 +1,15 @@
+export interface HarnessFile {
+    readonly path: string;
+    readonly content: string;
+    readonly owner: string;
+}
+export declare function renderHarnessFiles(harnesses: ReadonlyArray<string>, root: string): Array<HarnessFile>;
+export declare function withCodictatorOwner(files: ReadonlyArray<{
+    path: string;
+    content: string;
+}>): Array<{
+    path: string;
+    content: string;
+    owner: string;
+    mode: "file";
+}>;

package/dist/features/adapters/harness-files.js

@@ -0,0 +1,85 @@
+// SPEC §4.5 + §4.13.1 step 2: built-in harness file rendering for the
+// guardrail plan. Each known harness id dispatches to its own adapter's
+// render, so L1 enforcement ships with init and regen; the adapters stay
+// the sole owners of their file shapes (§3.3).
+import { claudeCodeAdapter } from "./claude-code.js";
+import { codexCliAdapter } from "./codex-cli.js";
+import { copilotAdapter } from "./copilot.js";
+import { cursorAdapter } from "./cursor.js";
+import { geminiCliAdapter } from "./gemini-cli.js";
+import { museAdapter } from "./muse-code.js";
+import { opencodeAdapter } from "./opencode.js";
+// SPEC §4.5.8 EC-12: regen input is fixed, so unchanged config reproduces
+// every harness file byte for byte. All built-in renders ignore the input;
+// the cwd is still threaded through honestly for the adapters that read it.
+function regenInput(harness, root) {
+    return {
+        event: {
+            harness,
+            event: "session.start",
+            trigger: "startup",
+            sessionId: "regen",
+            cwd: root,
+        },
+        decision: { decision: "allow", eventId: "regen" },
+    };
+}
+// SPEC §4.14.1: every generated artifact carries its adapter owner.
+// Unknown non-custom ids are skipped here because config validation owns
+// CDX-E301 and rejects them there; this render path never emits that error.
+export function renderHarnessFiles(harnesses, root) {
+    const ids = [...new Set(harnesses)].sort();
+    const files = [];
+    for (const harness of ids) {
+        if (harness.startsWith("custom:")) {
+            continue;
+        }
+        const input = regenInput(harness, root);
+        if (harness === museAdapter.id) {
+            for (const artifact of museAdapter.render(input)) {
+                files.push({ ...artifact, owner: harness });
+            }
+        }
+        else if (harness === claudeCodeAdapter.id) {
+            for (const artifact of claudeCodeAdapter.render(input)) {
+                files.push({ ...artifact, owner: harness });
+            }
+        }
+        else if (harness === opencodeAdapter.id) {
+            for (const artifact of opencodeAdapter.render(input)) {
+                files.push({ ...artifact, owner: harness });
+            }
+        }
+        else if (harness === copilotAdapter.id) {
+            for (const artifact of copilotAdapter.render(input)) {
+                files.push({ ...artifact, owner: harness });
+            }
+        }
+        else if (harness === codexCliAdapter.id) {
+            for (const artifact of codexCliAdapter.render(input)) {
+                files.push({ ...artifact, owner: harness });
+            }
+        }
+        else if (harness === cursorAdapter.id) {
+            for (const artifact of cursorAdapter.render(input)) {
+                files.push({ ...artifact, owner: harness });
+            }
+        }
+        else if (harness === geminiCliAdapter.id) {
+            for (const artifact of geminiCliAdapter.render(input)) {
+                files.push({ ...artifact, owner: harness });
+            }
+        }
+    }
+    files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return files;
+}
+// SPEC §4.14.1: custom fragments carry no owner of their own, so they keep
+// the historical codictator owner instead of inheriting a harness.
+export function withCodictatorOwner(files) {
+    return files.map((entry) => ({
+        ...entry,
+        owner: "codictator",
+        mode: "file",
+    }));
+}

package/dist/features/adapters/index.d.ts

@@ -10,6 +10,7 @@ import { CURSOR_CAPABILITIES, cursorAdapter, normalizeCursorToolName, parseCurso
 import { checkCustomContract, loadCustomAdapter, renderCustomHarnessFiles, renderCustomRegenFragment } from "./custom.ts";
 import { geminiCliAdapter, parseGeminiEvent, replyGemini, staticBlockGemini } from "./gemini-cli.ts";
 import { GEMINI_CAPABILITIES, normalizeGeminiToolName } from "./gemini-tables.ts";
+import { renderHarnessFiles, withCodictatorOwner } from "./harness-files.ts";
 import { MUSE_CAPABILITIES, museAdapter, normalizeMuseToolName, parseMuseEvent, replyMuse, staticBlockMuse } from "./muse-code.ts";
 import { isOpenCodeVersionSupported, normalizeOpenCodeToolName, OPENCODE_VERSION_MAXIMUM_EXCLUSIVE, OPENCODE_VERSION_MINIMUM, opencodeAdapter, parseOpenCodeEvent, replyOpenCode, staticBlockOpenCode } from "./opencode.ts";
 import { OPENCODE_CAPABILITIES } from "./opencode-capabilities.ts";
@@ -17,6 +18,6 @@ import { parseUniversalEvent, replyUniversal, staticBlockUniversal, UNIVERSAL_CA
 export { hookBudgetMs } from "./hook-dispatch.ts";
 export { type HookAppend, type HookBasePorts, type HookEnforcerLoader, type HookRunRequest, runHookEvent, staticBlock, supportedHarness, } from "./runtime.ts";
 export type { Adapter, CapabilityDeclaration, Decision, FileArtifact, HookDecision, HookEvent, HookReply, HookToolCall, RenderInput, ToolKind, Trigger, };
-export { CLAUDE_CODE_CAPABILITIES, CODEX_CAPABILITIES, COPILOT_CAPABILITIES, COPILOT_TIMEOUT_SEC, CURSOR_CAPABILITIES, checkCustomContract, claudeCodeAdapter, codexCliAdapter, copilotAdapter, cursorAdapter, GEMINI_CAPABILITIES, geminiCliAdapter, HOOK_PAYLOAD_MAX_BYTES, isOpenCodeVersionSupported, loadCustomAdapter, MUSE_CAPABILITIES, museAdapter, normalizeClaudeCodeToolName, normalizeCodexToolName, normalizeCopilotToolName, normalizeCursorToolName, normalizeGeminiToolName, normalizeMuseToolName, normalizeOpenCodeToolName, OPENCODE_CAPABILITIES, OPENCODE_VERSION_MAXIMUM_EXCLUSIVE, OPENCODE_VERSION_MINIMUM, opencodeAdapter, parseClaudeCodeEvent, parseCodexEvent, parseCopilotEvent, parseCursorEvent, parseGeminiEvent, parseMuseEvent, parseOpenCodeEvent, parseUniversalEvent, renderCustomHarnessFiles, renderCustomRegenFragment, replyClaudeCode, replyCodex, replyCopilot, replyCursor, replyGemini, replyMuse, replyOpenCode, replyUniversal, staticBlockClaudeCode, staticBlockCodex, staticBlockCopilot, staticBlockCursor, staticBlockGemini, staticBlockMuse, staticBlockOpenCode, staticBlockUniversal, UNIVERSAL_CAPABILITIES, universalAdapter, };
+export { CLAUDE_CODE_CAPABILITIES, CODEX_CAPABILITIES, COPILOT_CAPABILITIES, COPILOT_TIMEOUT_SEC, CURSOR_CAPABILITIES, checkCustomContract, claudeCodeAdapter, codexCliAdapter, copilotAdapter, cursorAdapter, GEMINI_CAPABILITIES, geminiCliAdapter, HOOK_PAYLOAD_MAX_BYTES, isOpenCodeVersionSupported, loadCustomAdapter, MUSE_CAPABILITIES, museAdapter, normalizeClaudeCodeToolName, normalizeCodexToolName, normalizeCopilotToolName, normalizeCursorToolName, normalizeGeminiToolName, normalizeMuseToolName, normalizeOpenCodeToolName, OPENCODE_CAPABILITIES, OPENCODE_VERSION_MAXIMUM_EXCLUSIVE, OPENCODE_VERSION_MINIMUM, opencodeAdapter, parseClaudeCodeEvent, parseCodexEvent, parseCopilotEvent, parseCursorEvent, parseGeminiEvent, parseMuseEvent, parseOpenCodeEvent, parseUniversalEvent, renderCustomHarnessFiles, renderCustomRegenFragment, renderHarnessFiles, replyClaudeCode, replyCodex, replyCopilot, replyCursor, replyGemini, replyMuse, replyOpenCode, replyUniversal, staticBlockClaudeCode, staticBlockCodex, staticBlockCopilot, staticBlockCursor, staticBlockGemini, staticBlockMuse, staticBlockOpenCode, staticBlockUniversal, UNIVERSAL_CAPABILITIES, universalAdapter, withCodictatorOwner, };
 export declare function parseEvent(harness: string, event: string, raw: unknown): Result<HookEvent>;
 export declare function renderReply(harness: string, decision: HookDecision): HookReply;

package/dist/features/adapters/index.js

@@ -8,13 +8,14 @@ import { CURSOR_CAPABILITIES, cursorAdapter, normalizeCursorToolName, parseCurso
 import { checkCustomContract, loadCustomAdapter, renderCustomHarnessFiles, renderCustomRegenFragment, } from "./custom.js";
 import { geminiCliAdapter, parseGeminiEvent, replyGemini, staticBlockGemini, } from "./gemini-cli.js";
 import { GEMINI_CAPABILITIES, normalizeGeminiToolName, } from "./gemini-tables.js";
+import { renderHarnessFiles, withCodictatorOwner } from "./harness-files.js";
 import { MUSE_CAPABILITIES, museAdapter, normalizeMuseToolName, parseMuseEvent, replyMuse, staticBlockMuse, } from "./muse-code.js";
 import { isOpenCodeVersionSupported, normalizeOpenCodeToolName, OPENCODE_VERSION_MAXIMUM_EXCLUSIVE, OPENCODE_VERSION_MINIMUM, opencodeAdapter, parseOpenCodeEvent, replyOpenCode, staticBlockOpenCode, } from "./opencode.js";
 import { OPENCODE_CAPABILITIES } from "./opencode-capabilities.js";
 import { parseUniversalEvent, replyUniversal, staticBlockUniversal, UNIVERSAL_CAPABILITIES, universalAdapter, } from "./universal.js";
 export { hookBudgetMs } from "./hook-dispatch.js";
 export { runHookEvent, staticBlock, supportedHarness, } from "./runtime.js";
-export { CLAUDE_CODE_CAPABILITIES, CODEX_CAPABILITIES, COPILOT_CAPABILITIES, COPILOT_TIMEOUT_SEC, CURSOR_CAPABILITIES, checkCustomContract, claudeCodeAdapter, codexCliAdapter, copilotAdapter, cursorAdapter, GEMINI_CAPABILITIES, geminiCliAdapter, HOOK_PAYLOAD_MAX_BYTES, isOpenCodeVersionSupported, loadCustomAdapter, MUSE_CAPABILITIES, museAdapter, normalizeClaudeCodeToolName, normalizeCodexToolName, normalizeCopilotToolName, normalizeCursorToolName, normalizeGeminiToolName, normalizeMuseToolName, normalizeOpenCodeToolName, OPENCODE_CAPABILITIES, OPENCODE_VERSION_MAXIMUM_EXCLUSIVE, OPENCODE_VERSION_MINIMUM, opencodeAdapter, parseClaudeCodeEvent, parseCodexEvent, parseCopilotEvent, parseCursorEvent, parseGeminiEvent, parseMuseEvent, parseOpenCodeEvent, parseUniversalEvent, renderCustomHarnessFiles, renderCustomRegenFragment, replyClaudeCode, replyCodex, replyCopilot, replyCursor, replyGemini, replyMuse, replyOpenCode, replyUniversal, staticBlockClaudeCode, staticBlockCodex, staticBlockCopilot, staticBlockCursor, staticBlockGemini, staticBlockMuse, staticBlockOpenCode, staticBlockUniversal, UNIVERSAL_CAPABILITIES, universalAdapter, };
+export { CLAUDE_CODE_CAPABILITIES, CODEX_CAPABILITIES, COPILOT_CAPABILITIES, COPILOT_TIMEOUT_SEC, CURSOR_CAPABILITIES, checkCustomContract, claudeCodeAdapter, codexCliAdapter, copilotAdapter, cursorAdapter, GEMINI_CAPABILITIES, geminiCliAdapter, HOOK_PAYLOAD_MAX_BYTES, isOpenCodeVersionSupported, loadCustomAdapter, MUSE_CAPABILITIES, museAdapter, normalizeClaudeCodeToolName, normalizeCodexToolName, normalizeCopilotToolName, normalizeCursorToolName, normalizeGeminiToolName, normalizeMuseToolName, normalizeOpenCodeToolName, OPENCODE_CAPABILITIES, OPENCODE_VERSION_MAXIMUM_EXCLUSIVE, OPENCODE_VERSION_MINIMUM, opencodeAdapter, parseClaudeCodeEvent, parseCodexEvent, parseCopilotEvent, parseCursorEvent, parseGeminiEvent, parseMuseEvent, parseOpenCodeEvent, parseUniversalEvent, renderCustomHarnessFiles, renderCustomRegenFragment, renderHarnessFiles, replyClaudeCode, replyCodex, replyCopilot, replyCursor, replyGemini, replyMuse, replyOpenCode, replyUniversal, staticBlockClaudeCode, staticBlockCodex, staticBlockCopilot, staticBlockCursor, staticBlockGemini, staticBlockMuse, staticBlockOpenCode, staticBlockUniversal, UNIVERSAL_CAPABILITIES, universalAdapter, withCodictatorOwner, };
 // SPEC §4.5.3: native harness payload to the normalised event. Payloads
 // over the 8 MiB cap block CDX-E305 here too (§4.5 EC-11), so the parse
 // layer enforces the same limit the runtime stdin read enforces.

package/dist/features/engine/evaluate.js

@@ -6,8 +6,8 @@
 // The clock arrives only through CheckContext.
 import { ok, sha256Text, stableStringify, } from "../../kernel/index.js";
 import { buildMessage } from "./message.js";
-import { appendFailedFinding, runEnforcer, sortFindings, } from "./run-enforcer.js";
-import { DEFAULT_WAIVER_STORE, matchWaivers, } from "./waivers.js";
+import { appendFailedFinding, collectFindings } from "./run-enforcer.js";
+import { DEFAULT_WAIVER_STORE, } from "./waivers.js";
 // SPEC §4.3.2: each engine trigger evaluates at one layer. Coarse triggers
 // map to the layer of their first scope; finer hook names arrive with the
 // adapter contract (phase 5).
@@ -52,38 +52,6 @@ function makeVerdictId(now, trigger, scope, decision, findings, waiversApplied,
     });
     return `${stamp}-${sha256Text(canonical).slice(0, 12)}`;
 }
-// SPEC §4.3.4: suppress findings covered by an active waiver, recording
-// the waiver ids. Synthetic fail-closed findings (CDX-E*) never suppress,
-// and an invalid floor-rule waiver blocks loudly instead of suppressing.
-async function applyWaivers(findings, store, now) {
-    const kept = [];
-    const applied = new Set();
-    for (const finding of findings) {
-        if (finding.code?.startsWith("CDX-E") === true) {
-            kept.push(finding);
-            continue;
-        }
-        const matched = matchWaivers(store, finding.ruleId, finding.path ?? "", now);
-        if (!matched.ok) {
-            kept.push(finding);
-            kept.push({
-                ruleId: finding.ruleId,
-                code: matched.error.code,
-                message: matched.error.message,
-                remediation: matched.error.remediation,
-            });
-            continue;
-        }
-        if (matched.value.length === 0) {
-            kept.push(finding);
-            continue;
-        }
-        for (const waiver of matched.value) {
-            applied.add(waiver.id);
-        }
-    }
-    return { kept, waiversApplied: [...applied].sort() };
-}
 function ruleIdsOf(findings) {
     const seen = new Set();
     for (const finding of findings) {
@@ -91,22 +59,18 @@ function ruleIdsOf(findings) {
     }
     return [...seen].sort();
 }
-async function collectFindings(ordered, ctx, store) {
-    const runnable = ordered.filter((enforcer) => enforcer.kinds.includes(ctx.trigger));
-    // SPEC §4.3.3 step 2: bounded concurrency — one guard at a time keeps every
-    // guard's event-loop share (no E902 herd); sortFindings keeps the verdict byte-identical (§4.3.6).
-    const ran = [];
-    for (const enforcer of runnable) {
-        ran.push(await runEnforcer(enforcer, ctx));
-    }
-    return applyWaivers(sortFindings(ran.flat()), store, ctx.now);
-}
 function decideDecision(kept, trigger) {
     if (kept.length === 0) {
         return "allow";
     }
     return ADVISORY_TRIGGERS.includes(trigger) ? "advise" : "block";
 }
+// SPEC §4.3.8 + §4.3.9 EC-19: zero effective enforcers block, except the
+// never-gating L2 layer, which advises. No engine trigger maps to L2 yet
+// (see TRIGGER_LAYERS), so every trigger blocks until that phase lands.
+function decideZeroEnforcer(trigger) {
+    return TRIGGER_LAYERS[trigger] === "L2" ? "advise" : "block";
+}
 function buildVerdictEvent(trigger, now, decision, kept, waiversApplied, configHash, packs, message, clockSkew) {
     return {
         kind: "verdict",
@@ -135,6 +99,28 @@ function blockedVerdict(now, trigger, scope, configHash) {
         waiversApplied: [],
     };
 }
+// SPEC §4.3.3 steps 4-6: decide the verdict from the collected findings,
+// build the agent message, append the verdict event before returning, and
+// fail closed when the append fails (PRD §6 P5).
+async function finishEvaluation(input, append) {
+    const decision = input.zeroEnforcers
+        ? decideZeroEnforcer(input.trigger)
+        : decideDecision(input.kept, input.trigger);
+    const eventId = makeVerdictId(input.now, input.trigger, input.scope, decision, input.kept, input.waiversApplied, input.configHash);
+    const message = buildMessage(decision, input.kept, eventId);
+    const event = buildVerdictEvent(input.trigger, input.now, decision, input.kept, input.waiversApplied, input.configHash, input.packs, message, input.clockSkew);
+    const appended = await append(event);
+    if (!appended.ok) {
+        return blockedVerdict(input.now, input.trigger, input.scope, input.configHash);
+    }
+    return {
+        decision,
+        findings: input.kept,
+        message,
+        eventId,
+        waiversApplied: input.waiversApplied,
+    };
+}
 // SPEC §4.3.3: pure evaluation over registered enforcers.
 export function createEngine(enforcers, options = {}) {
     const ordered = [...enforcers].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
@@ -155,16 +141,18 @@ export function createEngine(enforcers, options = {}) {
                 lastNow = now;
             }
             const ctx = { trigger, scope, now, configHash };
-            const { kept, waiversApplied } = await collectFindings(ordered, ctx, store);
-            const decision = decideDecision(kept, trigger);
-            const eventId = makeVerdictId(now, trigger, scope, decision, kept, waiversApplied, configHash);
-            const message = buildMessage(decision, kept, eventId);
-            const event = buildVerdictEvent(trigger, now, decision, kept, waiversApplied, configHash, packs, message, clockSkew);
-            const appended = await append(event);
-            if (!appended.ok) {
-                return blockedVerdict(now, trigger, scope, configHash);
-            }
-            return { decision, findings: kept, message, eventId, waiversApplied };
+            const { kept, waiversApplied, zeroEnforcers } = await collectFindings(ordered, ctx, store);
+            return finishEvaluation({
+                trigger,
+                scope,
+                now,
+                configHash,
+                packs,
+                kept,
+                waiversApplied,
+                zeroEnforcers,
+                clockSkew,
+            }, append);
         },
     };
 }

package/dist/features/engine/run-enforcer.d.ts

@@ -1,4 +1,11 @@
 import type { CheckContext, Enforcer, Finding } from "./index.ts";
+import { type WaiverStore } from "./waivers.ts";
 export declare function runEnforcer(enforcer: Enforcer, ctx: CheckContext): Promise<Array<Finding>>;
 export declare function sortFindings(findings: Array<Finding>): Array<Finding>;
 export declare function appendFailedFinding(): Finding;
+export declare function zeroEnforcerFinding(): Finding;
+export declare function collectFindings(ordered: ReadonlyArray<Enforcer>, ctx: CheckContext, store: WaiverStore): Promise<{
+    kept: Array<Finding>;
+    waiversApplied: Array<string>;
+    zeroEnforcers: boolean;
+}>;

package/dist/features/engine/run-enforcer.js

@@ -1,3 +1,8 @@
+import { applyWaivers } from "./waivers.js";
+// SPEC §4.3.9 EC-1: the feedback-only triggers (tool.post.write and stop
+// both arrive here as post-tool) allow with the event recorded when no
+// enforcer runs; every other trigger with zero enforcers fails closed.
+const FEEDBACK_ONLY_TRIGGERS = ["post-tool"];
 function failFinding(enforcerId, code, detail, remediation) {
     return {
         ruleId: enforcerId,
@@ -80,3 +85,33 @@ function compareFindings(a, b) {
 export function appendFailedFinding() {
     return failFinding("core/engine", "CDX-E801", "could not record its verdict event (CDX-E801)", "Free disk space and fix permissions on .codictator/state/, then retry.");
 }
+// SPEC §4.3.8: zero effective enforcers fail closed with a synthetic CDX-E904
+// finding. No guard ran, so the finding names the engine, not a rule.
+export function zeroEnforcerFinding() {
+    return failFinding("core/engine", "CDX-E904", "has no effective enforcer for this trigger (CDX-E904)", "Configure a pack with a rule for this trigger, then run codictator verify.");
+}
+// SPEC §4.3.3 steps 1-3: run the trigger's enforcers, then apply waivers to
+// the findings. Zero effective enforcers fail closed with the synthetic
+// CDX-E904 finding, except the feedback-only triggers, which allow with the
+// event recorded (§4.3.9 EC-1/EC-19).
+export async function collectFindings(ordered, ctx, store) {
+    const runnable = ordered.filter((enforcer) => enforcer.kinds.includes(ctx.trigger));
+    if (runnable.length === 0) {
+        if (FEEDBACK_ONLY_TRIGGERS.includes(ctx.trigger)) {
+            return { kept: [], waiversApplied: [], zeroEnforcers: false };
+        }
+        return {
+            kept: [zeroEnforcerFinding()],
+            waiversApplied: [],
+            zeroEnforcers: true,
+        };
+    }
+    // SPEC §4.3.3 step 2: bounded concurrency — one guard at a time keeps every
+    // guard's event-loop share (no E902 herd); sortFindings keeps the verdict byte-identical (§4.3.6).
+    const ran = [];
+    for (const enforcer of runnable) {
+        ran.push(await runEnforcer(enforcer, ctx));
+    }
+    const { kept, waiversApplied } = await applyWaivers(sortFindings(ran.flat()), store, ctx.now);
+    return { kept, waiversApplied, zeroEnforcers: false };
+}

package/dist/features/engine/waivers.d.ts

@@ -1,4 +1,4 @@
-import type { Instant } from "../../kernel/index.ts";
+import type { Finding, Instant } from "../../kernel/index.ts";
 import { type Result } from "../../kernel/index.ts";
 export interface Waiver {
     readonly id: string;
@@ -21,3 +21,7 @@ export declare const MAX_WAIVER_DAYS = 90;
 export declare const DEFAULT_WAIVER_STORE: WaiverStore;
 export declare function matchWaivers(store: WaiverStore, ruleId: string, path: string, now: Instant): Result<ReadonlyArray<Waiver>>;
 export declare function isWaived(ruleId: string, path: string, now: Instant, store?: WaiverStore): Promise<Result<boolean>>;
+export declare function applyWaivers(findings: ReadonlyArray<Finding>, store: WaiverStore, now: Instant): Promise<{
+    kept: Array<Finding>;
+    waiversApplied: Array<string>;
+}>;

package/dist/features/engine/waivers.js

@@ -167,3 +167,35 @@ export function isWaived(ruleId, path, now, store = DEFAULT_WAIVER_STORE) {
     }
     return Promise.resolve(ok(matched.value.length > 0));
 }
+// SPEC §4.3.4: suppress findings covered by an active waiver, recording
+// the waiver ids. Synthetic fail-closed findings (CDX-E*) never suppress,
+// and an invalid floor-rule waiver blocks loudly instead of suppressing.
+export async function applyWaivers(findings, store, now) {
+    const kept = [];
+    const applied = new Set();
+    for (const finding of findings) {
+        if (finding.code?.startsWith("CDX-E") === true) {
+            kept.push(finding);
+            continue;
+        }
+        const matched = matchWaivers(store, finding.ruleId, finding.path ?? "", now);
+        if (!matched.ok) {
+            kept.push(finding);
+            kept.push({
+                ruleId: finding.ruleId,
+                code: matched.error.code,
+                message: matched.error.message,
+                remediation: matched.error.remediation,
+            });
+            continue;
+        }
+        if (matched.value.length === 0) {
+            kept.push(finding);
+            continue;
+        }
+        for (const waiver of matched.value) {
+            applied.add(waiver.id);
+        }
+    }
+    return { kept, waiversApplied: [...applied].sort() };
+}