cool-workflow 0.1.80 → 0.1.82

package/dist/commit.js

@@ -17,6 +17,8 @@ const trust_audit_1 = require("./trust-audit");
 const collaboration_1 = require("./collaboration");
 const evidence_grounding_1 = require("./evidence-grounding");
 const verifier_1 = require("./verifier");
+const compare_1 = require("./compare");
+const gates_1 = require("./gates");
 class CommitGateError extends Error {
     structured;
     feedbackId;
@@ -37,7 +39,7 @@ function commitState(run, input) {
         throw recordCommitGateFailure(run, options, gate);
     }
     node_fs_1.default.mkdirSync(run.paths.commitsDir, { recursive: true });
-    const id = createCommitId();
+    const id = createCommitId(run);
     const snapshotPath = node_path_1.default.join(run.paths.commitsDir, `${id}.json`);
     const audit = gate.verifierGated
         ? (0, trust_audit_1.recordTrustAuditEvent)(run, {
@@ -118,26 +120,6 @@ function verifierNodeRequiresEvidence(run, verifierNode) {
         return (0, verifier_1.taskRequiresEvidence)(task);
     return true; // candidate/selection verifier with no 1:1 task — enforce grounding.
 }
-/** The HARD no-false-green gate (DIRECTION.md "ambiguity is a visible state").
- *  A verifier node is built FROM a result node; when that result captured no
- *  structured signal at all the result node carries an `metadata.captureWarning`
- *  marker (set in worker-isolation / lifecycle ingest via isEmptyCapture). The
- *  worker output is still ACCEPTED (a recorded warning, never a silent pass), but
- *  a verifier-GATED commit must NOT be able to present that zero-evidence result
- *  as clean/green. We detect it here, reading ONLY persisted state (the source
- *  result node's metadata) — purely functional, no clock/ordering — so snapshot
- *  replay reaches the same gate decision. Returns the marker string, or undefined.
- *
- *  Resolution trail: verifier node -> its input/parent result node. We look at
- *  `inputs.inputNodeId` (set by runPipelineStage) first, then fall back to the
- *  first parent, so it works regardless of which ingest path produced the node. */
-function emptyCaptureWarning(run, verifierNode) {
-    const resultNodeId = (typeof verifierNode.inputs?.inputNodeId === "string" ? verifierNode.inputs.inputNodeId : undefined) ||
-        verifierNode.parents[0];
-    const resultNode = resultNodeId ? findNode(run, resultNodeId) : undefined;
-    const warning = resultNode?.metadata?.captureWarning;
-    return typeof warning === "string" && warning ? warning : undefined;
-}
 function evidenceLocatorString(entry) {
     const ref = entry.locator || entry.path || entry.summary || entry.id;
     return ref ? String(ref) : undefined;
@@ -164,10 +146,6 @@ function resolveCommitGate(run, options) {
     const taskVerifierNodeId = taskVerifierFromReason(run, options.reason);
     const explicitGate = Boolean(options.verifierNodeId || options.candidateId || options.selectionId || options.verifierGated);
     const verifierGated = explicitGate || Boolean(taskVerifierNodeId);
-    let verifierNodeId = options.verifierNodeId || taskVerifierNodeId;
-    let candidateId = options.candidateId;
-    let selectionId = options.selectionId;
-    let selectionNodeId;
     if (!verifierGated) {
         return {
             verifierGated: false,
@@ -178,177 +156,234 @@ function resolveCommitGate(run, options) {
     }
     metadata.verifierGated = true;
     metadata.checkpoint = false;
-    if (selectionId) {
-        const selection = findSelection(run, selectionId);
-        if (!selection) {
-            errors.push(error("commit-selection-not-found", `Commit selection not found: ${selectionId}`, { details: { selectionId } }));
-        }
-        else {
-            candidateId = candidateId || selection.candidateId;
-            verifierNodeId = resolveLinkedVerifier(verifierNodeId, selection.verifierNodeId, errors, "selection", selection.id);
-            const selectionNode = findSelectionNode(run, selection.id);
-            selectionNodeId = selectionNode?.id;
-            if (!selectionNode) {
-                errors.push(error("commit-selection-node-missing", `Selection ${selection.id} has no state node`, {
-                    details: { selectionId: selection.id, candidateId: selection.candidateId }
-                }));
-            }
-            else if (selectionNode.kind !== "candidate" || selectionNode.status !== "verified") {
-                errors.push(error("commit-selection-not-verified", `Selection ${selection.id} is not a verified candidate selection`, {
-                    nodeId: selectionNode.id,
-                    details: { selectionId: selection.id, status: selectionNode.status, kind: selectionNode.kind }
-                }));
-            }
-            if (!selection.scoreId) {
-                errors.push(error("commit-candidate-unscored", `Selection ${selection.id} has no score evidence`, {
-                    details: { selectionId: selection.id, candidateId: selection.candidateId }
-                }));
-            }
-        }
-    }
-    if (candidateId) {
-        const candidate = findCandidate(run, candidateId);
-        if (!candidate) {
-            errors.push(error("commit-candidate-not-found", `Commit candidate not found: ${candidateId}`, { details: { candidateId } }));
-        }
-        else {
-            if (candidate.status === "rejected" || candidate.status === "failed") {
-                errors.push(error("commit-candidate-not-selectable", `Candidate ${candidateId} is ${candidate.status}`, {
-                    details: { candidateId, status: candidate.status }
-                }));
-            }
-            if (!candidate.scores.length) {
-                errors.push(error("commit-candidate-unscored", `Candidate ${candidateId} has no score evidence`, {
-                    details: { candidateId }
-                }));
-            }
-            if (candidate.status !== "verified") {
-                errors.push(error("commit-candidate-not-verified", `Candidate ${candidateId} is not verifier-gated`, {
-                    details: { candidateId, status: candidate.status }
-                }));
-            }
-            const selection = selectionId ? findSelection(run, selectionId) : latestSelectionForCandidate(run, candidateId);
-            if (!selection) {
-                errors.push(error("commit-candidate-selection-missing", `Candidate ${candidateId} has no verified selection`, {
-                    details: { candidateId }
-                }));
-            }
-            else {
-                selectionId = selection.id;
-                verifierNodeId = resolveLinkedVerifier(verifierNodeId, selection.verifierNodeId || candidate.verifierNodeId, errors, "candidate", candidateId);
-                const selectionNode = findSelectionNode(run, selection.id);
-                selectionNodeId = selectionNode?.id;
-                if (!selectionNode || selectionNode.status !== "verified") {
-                    errors.push(error("commit-selection-not-verified", `Candidate ${candidateId} selection ${selection.id} is not verified`, {
-                        nodeId: selectionNode?.id,
-                        details: { candidateId, selectionId: selection.id, status: selectionNode?.status || "missing" }
-                    }));
-                }
-                if (!selection.scoreId) {
-                    errors.push(error("commit-candidate-unscored", `Candidate ${candidateId} selection ${selection.id} has no score evidence`, {
-                        details: { candidateId, selectionId: selection.id }
-                    }));
-                }
-            }
-        }
-    }
-    if (!verifierNodeId) {
+    const resolution = {
+        verifierNodeId: options.verifierNodeId || taskVerifierNodeId,
+        candidateId: options.candidateId,
+        selectionId: options.selectionId,
+        selectionNodeId: undefined,
+        errors
+    };
+    resolveSelectionForCommit(run, resolution);
+    resolveCandidateForCommit(run, resolution);
+    if (!resolution.verifierNodeId) {
         errors.push(error("commit-verifier-required", "Verifier-gated commit requires --verifier, --candidate, or --selection", {
             details: {
                 hint: "Use --allow-unverified-checkpoint to write a non-gated checkpoint."
             }
         }));
     }
-    const verifierNode = verifierNodeId ? findNode(run, verifierNodeId) : undefined;
-    if (verifierNodeId && !verifierNode) {
-        errors.push(error("commit-verifier-not-found", `Verifier node not found: ${verifierNodeId}`, { details: { verifierNodeId } }));
+    const verifierNode = resolution.verifierNodeId ? findNode(run, resolution.verifierNodeId) : undefined;
+    if (resolution.verifierNodeId && !verifierNode) {
+        errors.push(error("commit-verifier-not-found", `Verifier node not found: ${resolution.verifierNodeId}`, {
+            details: { verifierNodeId: resolution.verifierNodeId }
+        }));
     }
     if (verifierNode) {
-        if (verifierNode.kind !== "verifier") {
-            errors.push(error("commit-verifier-wrong-kind", `Node ${verifierNode.id} is not a verifier node`, {
-                nodeId: verifierNode.id,
-                details: { verifierNodeId: verifierNode.id, kind: verifierNode.kind }
-            }));
-        }
-        if (verifierNode.status !== "verified") {
-            errors.push(error("commit-verifier-not-verified", `Verifier node ${verifierNode.id} is ${verifierNode.status}`, {
-                nodeId: verifierNode.id,
-                details: { verifierNodeId: verifierNode.id, status: verifierNode.status }
-            }));
-        }
-        // HARD no-false-green gate (v0.1.43): if the backing result was an
-        // empty-capture (no findings AND no evidence even after robust
-        // normalization), the verifier node only carries a non-grounded summary
-        // fallback. That can otherwise pass the length-only path for
-        // optional-evidence tasks and present a 0-real-evidence review as
-        // clean/green. Block it BEFORE the rationale is built so the commit fails
-        // visibly (commit-gate-failed node + feedback) instead of silently passing.
-        const captureWarning = emptyCaptureWarning(run, verifierNode);
-        if (captureWarning) {
-            errors.push(error("commit-rationale-empty-capture", `Verifier node ${verifierNode.id} cannot back a commit: ${captureWarning}`, {
-                nodeId: verifierNode.id,
-                details: { verifierNodeId: verifierNode.id, reason: captureWarning }
-            }));
+        groundVerifierEvidence(run, verifierNode, errors);
+    }
+    const rationale = buildCommitRationale(run, resolution, verifierNode);
+    const review = layerCommitReviewGate(run, resolution, errors);
+    return {
+        verifierGated: true,
+        verifierNodeId: resolution.verifierNodeId,
+        candidateId: resolution.candidateId,
+        selectionId: resolution.selectionId,
+        selectionNodeId: resolution.selectionNodeId,
+        evidence: verifierNode?.evidence || [],
+        errors,
+        rationale,
+        review,
+        metadata: {
+            ...metadata,
+            verifierNodeId: resolution.verifierNodeId,
+            candidateId: resolution.candidateId,
+            selectionId: resolution.selectionId,
+            selectionNodeId: resolution.selectionNodeId
         }
-        if (!verifierNode.evidence.length) {
-            errors.push(error("commit-verifier-missing-evidence", `Verifier node ${verifierNode.id} has no evidence`, {
+    };
+}
+/** Selection pass: when a selectionId is supplied, resolve the candidate it
+ *  carries, the linked verifier, and its state node — pushing the SAME errors as
+ *  the inline block did, in the same order. No-op when no selectionId is set. */
+function resolveSelectionForCommit(run, resolution) {
+    const { selectionId, errors } = resolution;
+    if (!selectionId)
+        return;
+    const selection = findSelection(run, selectionId);
+    if (!selection) {
+        errors.push(error("commit-selection-not-found", `Commit selection not found: ${selectionId}`, { details: { selectionId } }));
+        return;
+    }
+    resolution.candidateId = resolution.candidateId || selection.candidateId;
+    resolution.verifierNodeId = resolveLinkedVerifier(resolution.verifierNodeId, selection.verifierNodeId, errors, "selection", selection.id);
+    const selectionNode = findSelectionNode(run, selection.id);
+    resolution.selectionNodeId = selectionNode?.id;
+    if (!selectionNode) {
+        errors.push(error("commit-selection-node-missing", `Selection ${selection.id} has no state node`, {
+            details: { selectionId: selection.id, candidateId: selection.candidateId }
+        }));
+    }
+    else if (selectionNode.kind !== "candidate" || selectionNode.status !== "verified") {
+        errors.push(error("commit-selection-not-verified", `Selection ${selection.id} is not a verified candidate selection`, {
+            nodeId: selectionNode.id,
+            details: { selectionId: selection.id, status: selectionNode.status, kind: selectionNode.kind }
+        }));
+    }
+    if (!selection.scoreId) {
+        errors.push(error("commit-candidate-unscored", `Selection ${selection.id} has no score evidence`, {
+            details: { selectionId: selection.id, candidateId: selection.candidateId }
+        }));
+    }
+}
+/** Candidate pass: when a candidateId is resolved, enforce its status/score bar
+ *  and bind it to a verified selection (the supplied one, else the latest). Same
+ *  errors, same order, same mutations as the inline block. No-op without one. */
+function resolveCandidateForCommit(run, resolution) {
+    const { candidateId, errors } = resolution;
+    if (!candidateId)
+        return;
+    const candidate = findCandidate(run, candidateId);
+    if (!candidate) {
+        errors.push(error("commit-candidate-not-found", `Commit candidate not found: ${candidateId}`, { details: { candidateId } }));
+        return;
+    }
+    if (candidate.status === "rejected" || candidate.status === "failed") {
+        errors.push(error("commit-candidate-not-selectable", `Candidate ${candidateId} is ${candidate.status}`, {
+            details: { candidateId, status: candidate.status }
+        }));
+    }
+    if (!candidate.scores.length) {
+        errors.push(error("commit-candidate-unscored", `Candidate ${candidateId} has no score evidence`, {
+            details: { candidateId }
+        }));
+    }
+    if (candidate.status !== "verified") {
+        errors.push(error("commit-candidate-not-verified", `Candidate ${candidateId} is not verifier-gated`, {
+            details: { candidateId, status: candidate.status }
+        }));
+    }
+    const selection = resolution.selectionId ? findSelection(run, resolution.selectionId) : latestSelectionForCandidate(run, candidateId);
+    if (!selection) {
+        errors.push(error("commit-candidate-selection-missing", `Candidate ${candidateId} has no verified selection`, {
+            details: { candidateId }
+        }));
+        return;
+    }
+    resolution.selectionId = selection.id;
+    resolution.verifierNodeId = resolveLinkedVerifier(resolution.verifierNodeId, selection.verifierNodeId || candidate.verifierNodeId, errors, "candidate", candidateId);
+    const selectionNode = findSelectionNode(run, selection.id);
+    resolution.selectionNodeId = selectionNode?.id;
+    if (!selectionNode || selectionNode.status !== "verified") {
+        errors.push(error("commit-selection-not-verified", `Candidate ${candidateId} selection ${selection.id} is not verified`, {
+            nodeId: selectionNode?.id,
+            details: { candidateId, selectionId: selection.id, status: selectionNode?.status || "missing" }
+        }));
+    }
+    if (!selection.scoreId) {
+        errors.push(error("commit-candidate-unscored", `Candidate ${candidateId} selection ${selection.id} has no score evidence`, {
+            details: { candidateId, selectionId: selection.id }
+        }));
+    }
+}
+/** Verifier-node grounding pass: kind/status checks plus the HARD no-false-green
+ *  gate (empty-capture) and the grounded-evidence gate. These remain EXACTLY as
+ *  strict — same predicates, same error codes, same order — only lifted out of
+ *  the monolith. */
+function groundVerifierEvidence(run, verifierNode, errors) {
+    if (verifierNode.kind !== "verifier") {
+        errors.push(error("commit-verifier-wrong-kind", `Node ${verifierNode.id} is not a verifier node`, {
+            nodeId: verifierNode.id,
+            details: { verifierNodeId: verifierNode.id, kind: verifierNode.kind }
+        }));
+    }
+    if (verifierNode.status !== "verified") {
+        errors.push(error("commit-verifier-not-verified", `Verifier node ${verifierNode.id} is ${verifierNode.status}`, {
+            nodeId: verifierNode.id,
+            details: { verifierNodeId: verifierNode.id, status: verifierNode.status }
+        }));
+    }
+    // HARD no-false-green gate (v0.1.43): if the backing result was an
+    // empty-capture (no findings AND no evidence even after robust
+    // normalization), the verifier node only carries a non-grounded summary
+    // fallback. That can otherwise pass the length-only path for
+    // optional-evidence tasks and present a 0-real-evidence review as
+    // clean/green. Block it BEFORE the rationale is built so the commit fails
+    // visibly (commit-gate-failed node + feedback) instead of silently passing.
+    const captureWarning = (0, gates_1.emptyCaptureWarning)(run, verifierNode);
+    if (captureWarning) {
+        errors.push(error("commit-rationale-empty-capture", `Verifier node ${verifierNode.id} cannot back a commit: ${captureWarning}`, {
+            nodeId: verifierNode.id,
+            details: { verifierNodeId: verifierNode.id, reason: captureWarning }
+        }));
+    }
+    if (!verifierNode.evidence.length) {
+        errors.push(error("commit-verifier-missing-evidence", `Verifier node ${verifierNode.id} has no evidence`, {
+            nodeId: verifierNode.id,
+            details: { verifierNodeId: verifierNode.id }
+        }));
+    }
+    else if (verifierNodeRequiresEvidence(run, verifierNode)) {
+        // Evidence grounding (v0.1.40 self-audit P1/P2): for verifier nodes whose
+        // task REQUIRES evidence (verify/verdict/requiresEvidence, and explicit
+        // candidate/selection commits), the gate must not accept unverifiable free
+        // text. Require at least one GROUNDED locator (path-like / URL /
+        // namespace:value), and — when the operator opts in via
+        // CW_REQUIRE_RESOLVABLE_EVIDENCE — that file-style locators actually resolve
+        // on disk. Closes the "presence != existence" gap. Optional-evidence tasks
+        // (e.g. map/assess) keep the length-only check so the gate is never stricter
+        // than result acceptance was.
+        const locators = verifierNode.evidence.map(evidenceLocatorString).filter(Boolean);
+        if (!(0, evidence_grounding_1.hasGroundedEvidence)(locators)) {
+            errors.push(error("commit-verifier-evidence-ungrounded", `Verifier node ${verifierNode.id} evidence is not grounded (needs a path-like locator, URL, or namespace:value token)`, {
                 nodeId: verifierNode.id,
-                details: { verifierNodeId: verifierNode.id }
+                details: { verifierNodeId: verifierNode.id, evidence: locators }
             }));
         }
-        else if (verifierNodeRequiresEvidence(run, verifierNode)) {
-            // Evidence grounding (v0.1.40 self-audit P1/P2): for verifier nodes whose
-            // task REQUIRES evidence (verify/verdict/requiresEvidence, and explicit
-            // candidate/selection commits), the gate must not accept unverifiable free
-            // text. Require at least one GROUNDED locator (path-like / URL /
-            // namespace:value), and — when the operator opts in via
-            // CW_REQUIRE_RESOLVABLE_EVIDENCE — that file-style locators actually resolve
-            // on disk. Closes the "presence != existence" gap. Optional-evidence tasks
-            // (e.g. map/assess) keep the length-only check so the gate is never stricter
-            // than result acceptance was.
-            const locators = verifierNode.evidence.map(evidenceLocatorString).filter(Boolean);
-            if (!(0, evidence_grounding_1.hasGroundedEvidence)(locators)) {
-                errors.push(error("commit-verifier-evidence-ungrounded", `Verifier node ${verifierNode.id} evidence is not grounded (needs a path-like locator, URL, or namespace:value token)`, {
+        if ((0, evidence_grounding_1.requireResolvableEvidence)()) {
+            const unresolved = (0, evidence_grounding_1.unresolvedFileEvidence)(locators, commitEvidenceBaseDirs(run));
+            if (unresolved.length) {
+                errors.push(error("commit-verifier-evidence-unresolvable", `Verifier node ${verifierNode.id} cites file evidence that does not resolve on disk: ${unresolved.join(", ")}`, {
                     nodeId: verifierNode.id,
-                    details: { verifierNodeId: verifierNode.id, evidence: locators }
+                    details: { verifierNodeId: verifierNode.id, unresolved }
                 }));
             }
-            if ((0, evidence_grounding_1.requireResolvableEvidence)()) {
-                const unresolved = (0, evidence_grounding_1.unresolvedFileEvidence)(locators, commitEvidenceBaseDirs(run));
-                if (unresolved.length) {
-                    errors.push(error("commit-verifier-evidence-unresolvable", `Verifier node ${verifierNode.id} cites file evidence that does not resolve on disk: ${unresolved.join(", ")}`, {
-                        nodeId: verifierNode.id,
-                        details: { verifierNodeId: verifierNode.id, unresolved }
-                    }));
-                }
-            }
         }
     }
-    let rationale;
-    if (verifierGated && candidateId && selectionId) {
-        const candidate = findCandidate(run, candidateId);
-        const selection = findSelection(run, selectionId);
-        const score = selection?.scoreId ? findScore(run, candidateId, selection.scoreId) : undefined;
-        rationale = selection?.acceptanceRationale || (0, trust_audit_1.buildAcceptanceRationale)({
-            selectedCandidateId: candidateId,
-            scoreId: selection?.scoreId,
-            scoreCriteria: score?.criteria,
-            verifierNodeId,
-            evidenceCount: verifierNode?.evidence.length || 0,
-            sandboxProfileId: sandboxProfileForCandidate(run, candidate),
-            workerId: candidate?.workerId,
-            commitGateResult: "passed"
-        });
-        for (const failure of (0, trust_audit_1.validateAcceptanceRationale)(rationale)) {
-            errors.push(error("commit-rationale-incomplete", `Verifier-gated commit cannot explain acceptance: ${failure}`, {
-                details: { candidateId, selectionId, verifierNodeId }
-            }));
-        }
+}
+/** Rationale pass: when candidate + selection are both resolved, reuse the
+ *  selection's acceptance rationale or rebuild it, then push completeness errors.
+ *  Returns the rationale (or undefined). Identical to the inline block. */
+function buildCommitRationale(run, resolution, verifierNode) {
+    const { candidateId, selectionId, verifierNodeId, errors } = resolution;
+    if (!candidateId || !selectionId)
+        return undefined;
+    const candidate = findCandidate(run, candidateId);
+    const selection = findSelection(run, selectionId);
+    const score = selection?.scoreId ? findScore(run, candidateId, selection.scoreId) : undefined;
+    const rationale = selection?.acceptanceRationale || (0, trust_audit_1.buildAcceptanceRationale)({
+        selectedCandidateId: candidateId,
+        scoreId: selection?.scoreId,
+        scoreCriteria: score?.criteria,
+        verifierNodeId,
+        evidenceCount: verifierNode?.evidence.length || 0,
+        sandboxProfileId: (0, gates_1.sandboxProfileForCandidate)(run, candidate),
+        workerId: candidate?.workerId,
+        commitGateResult: "passed"
+    });
+    for (const failure of (0, trust_audit_1.validateAcceptanceRationale)(rationale)) {
+        errors.push(error("commit-rationale-incomplete", `Verifier-gated commit cannot explain acceptance: ${failure}`, {
+            details: { candidateId, selectionId, verifierNodeId }
+        }));
     }
-    // REVIEW GATE — POLICY layered ON TOP of the verifier MECHANISM. These errors
-    // can only ADD constraints (required approvals from authorized roles); they
-    // never relax verifier acceptance. Empty unless a policy applies to commits.
-    // Fail closed: a commit lacking its required approvals is BLOCKED here.
+    return rationale;
+}
+/** Review-gate pass — POLICY layered ON TOP of the verifier MECHANISM. These
+ *  errors can only ADD constraints (required approvals from authorized roles);
+ *  they never relax verifier acceptance. Empty unless a policy applies to
+ *  commits. Fail closed: a commit lacking its required approvals is BLOCKED here,
+ *  and provenance is only emitted when NO errors remain. */
+function layerCommitReviewGate(run, resolution, errors) {
+    const { candidateId, selectionId } = resolution;
     const reviewErrors = (0, collaboration_1.reviewGateErrors)(run, {
         targetKind: "commit",
         candidateId,
@@ -356,7 +391,7 @@ function resolveCommitGate(run, options) {
         selfActorIds: (0, collaboration_1.selfActorIdsForCandidate)(run, candidateId, selectionId)
     });
     errors.push(...reviewErrors);
-    const review = errors.length
+    return errors.length
         ? undefined
         : (0, collaboration_1.commitReviewProvenance)(run, {
             targetKind: "commit",
@@ -364,24 +399,6 @@ function resolveCommitGate(run, options) {
             selectionId,
             selfActorIds: (0, collaboration_1.selfActorIdsForCandidate)(run, candidateId, selectionId)
         });
-    return {
-        verifierGated: true,
-        verifierNodeId,
-        candidateId,
-        selectionId,
-        selectionNodeId,
-        evidence: verifierNode?.evidence || [],
-        errors,
-        rationale,
-        review,
-        metadata: {
-            ...metadata,
-            verifierNodeId,
-            candidateId,
-            selectionId,
-            selectionNodeId
-        }
-    };
 }
 function recordCommitNode(run, commit, options, gate) {
     const contract = (0, state_node_1.upsertRunContract)(run, (0, pipeline_contract_1.createDefaultPipelineContract)());
@@ -440,7 +457,7 @@ function recordCommitNode(run, commit, options, gate) {
 function recordCommitGateFailure(run, options, gate) {
     const first = gate.errors[0] || error("commit-gate-blocked", "Verifier-gated commit blocked");
     const node = (0, state_node_1.recordNodeError)((0, state_node_1.createStateNode)({
-        id: `${run.id}:commit-gate-failed:${createCommitId()}`,
+        id: `${run.id}:commit-gate-failed:${gateFailureSeq(run)}`,
         kind: "error",
         status: "pending",
         loopStage: "checkpoint",
@@ -511,7 +528,7 @@ function resolveLinkedVerifier(requested, linked, errors, ownerKind, ownerId) {
 function latestSelectionForCandidate(run, candidateId) {
     return [...(run.candidateSelections || [])]
         .filter((selection) => selection.candidateId === candidateId)
-        .sort((left, right) => right.selectedAt.localeCompare(left.selectedAt))[0];
+        .sort((left, right) => (0, compare_1.compareBytes)(right.selectedAt, left.selectedAt))[0];
 }
 function findSelection(run, selectionId) {
     return (run.candidateSelections || []).find((selection) => selection.id === selectionId);
@@ -533,13 +550,6 @@ function findScore(run, candidateId, scoreId) {
         return undefined;
     }
 }
-function sandboxProfileForCandidate(run, candidate) {
-    const worker = candidate?.workerId ? (run.workers || []).find((entry) => entry.id === candidate.workerId) : undefined;
-    if (worker?.sandboxProfileId)
-        return worker.sandboxProfileId;
-    const task = candidate?.taskId ? (run.tasks || []).find((entry) => entry.id === candidate.taskId) : undefined;
-    return task?.sandboxProfileId;
-}
 function findNode(run, nodeId) {
     return (run.nodes || []).find((node) => node.id === nodeId);
 }
@@ -552,9 +562,22 @@ function error(code, message, options = {}) {
         ...options
     };
 }
-function createCommitId() {
-    const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    return `state-${stamp}-${(0, state_1.safeFileName)(Math.random().toString(36).slice(2, 8))}`;
+// Deterministic commit id (FreeBSD-audit L12/L13): the commit's POSITION in the
+// run's append-only commit log, not a wall-clock stamp + PRNG suffix. Re-running
+// the same workflow mints byte-identical commit ids, so snapshot/replay digests
+// match. The sequence is unique within a run (commits only ever append), and the
+// commitState caller writes the snapshot under this id before pushing the commit.
+function createCommitId(run) {
+    const seq = (run.commits || []).length + 1;
+    return `state-${String(seq).padStart(4, "0")}`;
+}
+// Deterministic suffix for a blocked-commit node id. Counts the commit-gate-failed
+// nodes already recorded on the run and returns the next position, so repeated
+// gate failures in one run stay collision-free and replay-stable.
+function gateFailureSeq(run) {
+    const marker = ":commit-gate-failed:";
+    const seq = (run.nodes || []).filter((node) => node.id.includes(marker)).length + 1;
+    return String(seq).padStart(4, "0");
 }
 function readGitHead(cwd) {
     try {

package/dist/compare.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareBytes = compareBytes;
+// Locale-INDEPENDENT total order for strings (FreeBSD-audit L12 determinism).
+//
+// `String.localeCompare` is host/locale-sensitive: two hosts can order the same
+// byte-identical strings differently. That is fine for human-facing display, but
+// FATAL when the sorted order feeds a sha256 digest, a tombstone/hash chain, or a
+// stable-persisted projection (index.json, messages.jsonl, an export manifest):
+// the same content would then serialize/hash differently across hosts, breaking
+// CW's cross-host reproducibility and replay-determinism guarantees.
+//
+// Use compareBytes() for any ordering that flows into a hash, an export, a
+// persisted projection, or a commit/replay-bearing decision. Pure display sorts
+// may keep localeCompare.
+function compareBytes(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}

package/dist/coordinator/classify.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statusToNodeStatus = statusToNodeStatus;
+exports.decisionStatus = decisionStatus;
+exports.auditDecision = auditDecision;
+exports.sourceForAuthor = sourceForAuthor;
+function statusToNodeStatus(status) {
+    switch (status) {
+        case "active":
+        case "open":
+            return "running";
+        case "resolved":
+        case "superseded":
+            return "completed";
+        case "conflicting":
+            return "blocked";
+        case "rejected":
+            return "rejected";
+        default:
+            return "completed";
+    }
+}
+function decisionStatus(outcome) {
+    if (outcome === "conflicting" || outcome === "blocked")
+        return "conflicting";
+    if (outcome === "rejected")
+        return "rejected";
+    if (outcome === "superseded")
+        return "superseded";
+    return "active";
+}
+function auditDecision(outcome) {
+    if (outcome === "rejected")
+        return "rejected";
+    if (outcome === "blocked" || outcome === "conflicting")
+        return "failed";
+    return "accepted";
+}
+function sourceForAuthor(author) {
+    if (author.kind === "runtime" || author.kind === "coordinator")
+        return "runtime-derived";
+    if (author.kind === "worker" || author.kind === "verifier")
+        return "cw-validated";
+    return "operator-recorded";
+}

package/dist/coordinator/paths.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.boardPaths = boardPaths;
+exports.blackboardRoot = blackboardRoot;
+exports.messagesPath = messagesPath;
+exports.recordPath = recordPath;
+// Filesystem path derivation for the coordinator/blackboard layer
+// (FreeBSD-audit R-carve). Carved out of coordinator.ts so the module no longer
+// bundles the per-run path computation alongside the stateful blackboard
+// operations. Re-exported from coordinator.ts to keep the public surface
+// byte-identical.
+//
+// BEHAVIOR-PRESERVING — pure code movement, zero logic change. Each function is a
+// function of a WorkflowRun's paths only: it reads run.paths and joins names; it
+// never mutates run, never touches the blackboard state, never writes the disk.
+const node_path_1 = __importDefault(require("node:path"));
+const state_1 = require("../state");
+function boardPaths(run) {
+    const root = blackboardRoot(run);
+    return {
+        root,
+        index: node_path_1.default.join(root, "index.json"),
+        messages: messagesPath(run),
+        topicsDir: node_path_1.default.join(root, "topics"),
+        contextsDir: node_path_1.default.join(root, "contexts"),
+        artifactsDir: node_path_1.default.join(root, "artifacts"),
+        snapshotsDir: node_path_1.default.join(root, "snapshots"),
+        decisionsDir: node_path_1.default.join(root, "decisions")
+    };
+}
+function blackboardRoot(run) {
+    return run.paths.blackboardDir || node_path_1.default.join(run.paths.runDir, "blackboard");
+}
+function messagesPath(run) {
+    return node_path_1.default.join(blackboardRoot(run), "messages.jsonl");
+}
+function recordPath(run, kind, id) {
+    return node_path_1.default.join(blackboardRoot(run), kind, `${(0, state_1.safeFileName)(id)}.json`);
+}