cool-workflow 0.1.81 → 0.1.82

package/dist/commit.js

@@ -18,6 +18,7 @@ const collaboration_1 = require("./collaboration");
 const evidence_grounding_1 = require("./evidence-grounding");
 const verifier_1 = require("./verifier");
 const compare_1 = require("./compare");
+const gates_1 = require("./gates");
 class CommitGateError extends Error {
     structured;
     feedbackId;
@@ -119,26 +120,6 @@ function verifierNodeRequiresEvidence(run, verifierNode) {
         return (0, verifier_1.taskRequiresEvidence)(task);
     return true; // candidate/selection verifier with no 1:1 task — enforce grounding.
 }
-/** The HARD no-false-green gate (DIRECTION.md "ambiguity is a visible state").
- *  A verifier node is built FROM a result node; when that result captured no
- *  structured signal at all the result node carries an `metadata.captureWarning`
- *  marker (set in worker-isolation / lifecycle ingest via isEmptyCapture). The
- *  worker output is still ACCEPTED (a recorded warning, never a silent pass), but
- *  a verifier-GATED commit must NOT be able to present that zero-evidence result
- *  as clean/green. We detect it here, reading ONLY persisted state (the source
- *  result node's metadata) — purely functional, no clock/ordering — so snapshot
- *  replay reaches the same gate decision. Returns the marker string, or undefined.
- *
- *  Resolution trail: verifier node -> its input/parent result node. We look at
- *  `inputs.inputNodeId` (set by runPipelineStage) first, then fall back to the
- *  first parent, so it works regardless of which ingest path produced the node. */
-function emptyCaptureWarning(run, verifierNode) {
-    const resultNodeId = (typeof verifierNode.inputs?.inputNodeId === "string" ? verifierNode.inputs.inputNodeId : undefined) ||
-        verifierNode.parents[0];
-    const resultNode = resultNodeId ? findNode(run, resultNodeId) : undefined;
-    const warning = resultNode?.metadata?.captureWarning;
-    return typeof warning === "string" && warning ? warning : undefined;
-}
 function evidenceLocatorString(entry) {
     const ref = entry.locator || entry.path || entry.summary || entry.id;
     return ref ? String(ref) : undefined;
@@ -165,10 +146,6 @@ function resolveCommitGate(run, options) {
     const taskVerifierNodeId = taskVerifierFromReason(run, options.reason);
     const explicitGate = Boolean(options.verifierNodeId || options.candidateId || options.selectionId || options.verifierGated);
     const verifierGated = explicitGate || Boolean(taskVerifierNodeId);
-    let verifierNodeId = options.verifierNodeId || taskVerifierNodeId;
-    let candidateId = options.candidateId;
-    let selectionId = options.selectionId;
-    let selectionNodeId;
     if (!verifierGated) {
         return {
             verifierGated: false,
@@ -179,177 +156,234 @@ function resolveCommitGate(run, options) {
     }
     metadata.verifierGated = true;
     metadata.checkpoint = false;
-    if (selectionId) {
-        const selection = findSelection(run, selectionId);
-        if (!selection) {
-            errors.push(error("commit-selection-not-found", `Commit selection not found: ${selectionId}`, { details: { selectionId } }));
-        }
-        else {
-            candidateId = candidateId || selection.candidateId;
-            verifierNodeId = resolveLinkedVerifier(verifierNodeId, selection.verifierNodeId, errors, "selection", selection.id);
-            const selectionNode = findSelectionNode(run, selection.id);
-            selectionNodeId = selectionNode?.id;
-            if (!selectionNode) {
-                errors.push(error("commit-selection-node-missing", `Selection ${selection.id} has no state node`, {
-                    details: { selectionId: selection.id, candidateId: selection.candidateId }
-                }));
-            }
-            else if (selectionNode.kind !== "candidate" || selectionNode.status !== "verified") {
-                errors.push(error("commit-selection-not-verified", `Selection ${selection.id} is not a verified candidate selection`, {
-                    nodeId: selectionNode.id,
-                    details: { selectionId: selection.id, status: selectionNode.status, kind: selectionNode.kind }
-                }));
-            }
-            if (!selection.scoreId) {
-                errors.push(error("commit-candidate-unscored", `Selection ${selection.id} has no score evidence`, {
-                    details: { selectionId: selection.id, candidateId: selection.candidateId }
-                }));
-            }
-        }
-    }
-    if (candidateId) {
-        const candidate = findCandidate(run, candidateId);
-        if (!candidate) {
-            errors.push(error("commit-candidate-not-found", `Commit candidate not found: ${candidateId}`, { details: { candidateId } }));
-        }
-        else {
-            if (candidate.status === "rejected" || candidate.status === "failed") {
-                errors.push(error("commit-candidate-not-selectable", `Candidate ${candidateId} is ${candidate.status}`, {
-                    details: { candidateId, status: candidate.status }
-                }));
-            }
-            if (!candidate.scores.length) {
-                errors.push(error("commit-candidate-unscored", `Candidate ${candidateId} has no score evidence`, {
-                    details: { candidateId }
-                }));
-            }
-            if (candidate.status !== "verified") {
-                errors.push(error("commit-candidate-not-verified", `Candidate ${candidateId} is not verifier-gated`, {
-                    details: { candidateId, status: candidate.status }
-                }));
-            }
-            const selection = selectionId ? findSelection(run, selectionId) : latestSelectionForCandidate(run, candidateId);
-            if (!selection) {
-                errors.push(error("commit-candidate-selection-missing", `Candidate ${candidateId} has no verified selection`, {
-                    details: { candidateId }
-                }));
-            }
-            else {
-                selectionId = selection.id;
-                verifierNodeId = resolveLinkedVerifier(verifierNodeId, selection.verifierNodeId || candidate.verifierNodeId, errors, "candidate", candidateId);
-                const selectionNode = findSelectionNode(run, selection.id);
-                selectionNodeId = selectionNode?.id;
-                if (!selectionNode || selectionNode.status !== "verified") {
-                    errors.push(error("commit-selection-not-verified", `Candidate ${candidateId} selection ${selection.id} is not verified`, {
-                        nodeId: selectionNode?.id,
-                        details: { candidateId, selectionId: selection.id, status: selectionNode?.status || "missing" }
-                    }));
-                }
-                if (!selection.scoreId) {
-                    errors.push(error("commit-candidate-unscored", `Candidate ${candidateId} selection ${selection.id} has no score evidence`, {
-                        details: { candidateId, selectionId: selection.id }
-                    }));
-                }
-            }
-        }
-    }
-    if (!verifierNodeId) {
+    const resolution = {
+        verifierNodeId: options.verifierNodeId || taskVerifierNodeId,
+        candidateId: options.candidateId,
+        selectionId: options.selectionId,
+        selectionNodeId: undefined,
+        errors
+    };
+    resolveSelectionForCommit(run, resolution);
+    resolveCandidateForCommit(run, resolution);
+    if (!resolution.verifierNodeId) {
         errors.push(error("commit-verifier-required", "Verifier-gated commit requires --verifier, --candidate, or --selection", {
             details: {
                 hint: "Use --allow-unverified-checkpoint to write a non-gated checkpoint."
             }
         }));
     }
-    const verifierNode = verifierNodeId ? findNode(run, verifierNodeId) : undefined;
-    if (verifierNodeId && !verifierNode) {
-        errors.push(error("commit-verifier-not-found", `Verifier node not found: ${verifierNodeId}`, { details: { verifierNodeId } }));
+    const verifierNode = resolution.verifierNodeId ? findNode(run, resolution.verifierNodeId) : undefined;
+    if (resolution.verifierNodeId && !verifierNode) {
+        errors.push(error("commit-verifier-not-found", `Verifier node not found: ${resolution.verifierNodeId}`, {
+            details: { verifierNodeId: resolution.verifierNodeId }
+        }));
     }
     if (verifierNode) {
-        if (verifierNode.kind !== "verifier") {
-            errors.push(error("commit-verifier-wrong-kind", `Node ${verifierNode.id} is not a verifier node`, {
-                nodeId: verifierNode.id,
-                details: { verifierNodeId: verifierNode.id, kind: verifierNode.kind }
-            }));
-        }
-        if (verifierNode.status !== "verified") {
-            errors.push(error("commit-verifier-not-verified", `Verifier node ${verifierNode.id} is ${verifierNode.status}`, {
-                nodeId: verifierNode.id,
-                details: { verifierNodeId: verifierNode.id, status: verifierNode.status }
-            }));
-        }
-        // HARD no-false-green gate (v0.1.43): if the backing result was an
-        // empty-capture (no findings AND no evidence even after robust
-        // normalization), the verifier node only carries a non-grounded summary
-        // fallback. That can otherwise pass the length-only path for
-        // optional-evidence tasks and present a 0-real-evidence review as
-        // clean/green. Block it BEFORE the rationale is built so the commit fails
-        // visibly (commit-gate-failed node + feedback) instead of silently passing.
-        const captureWarning = emptyCaptureWarning(run, verifierNode);
-        if (captureWarning) {
-            errors.push(error("commit-rationale-empty-capture", `Verifier node ${verifierNode.id} cannot back a commit: ${captureWarning}`, {
-                nodeId: verifierNode.id,
-                details: { verifierNodeId: verifierNode.id, reason: captureWarning }
-            }));
+        groundVerifierEvidence(run, verifierNode, errors);
+    }
+    const rationale = buildCommitRationale(run, resolution, verifierNode);
+    const review = layerCommitReviewGate(run, resolution, errors);
+    return {
+        verifierGated: true,
+        verifierNodeId: resolution.verifierNodeId,
+        candidateId: resolution.candidateId,
+        selectionId: resolution.selectionId,
+        selectionNodeId: resolution.selectionNodeId,
+        evidence: verifierNode?.evidence || [],
+        errors,
+        rationale,
+        review,
+        metadata: {
+            ...metadata,
+            verifierNodeId: resolution.verifierNodeId,
+            candidateId: resolution.candidateId,
+            selectionId: resolution.selectionId,
+            selectionNodeId: resolution.selectionNodeId
         }
-        if (!verifierNode.evidence.length) {
-            errors.push(error("commit-verifier-missing-evidence", `Verifier node ${verifierNode.id} has no evidence`, {
+    };
+}
+/** Selection pass: when a selectionId is supplied, resolve the candidate it
+ *  carries, the linked verifier, and its state node — pushing the SAME errors as
+ *  the inline block did, in the same order. No-op when no selectionId is set. */
+function resolveSelectionForCommit(run, resolution) {
+    const { selectionId, errors } = resolution;
+    if (!selectionId)
+        return;
+    const selection = findSelection(run, selectionId);
+    if (!selection) {
+        errors.push(error("commit-selection-not-found", `Commit selection not found: ${selectionId}`, { details: { selectionId } }));
+        return;
+    }
+    resolution.candidateId = resolution.candidateId || selection.candidateId;
+    resolution.verifierNodeId = resolveLinkedVerifier(resolution.verifierNodeId, selection.verifierNodeId, errors, "selection", selection.id);
+    const selectionNode = findSelectionNode(run, selection.id);
+    resolution.selectionNodeId = selectionNode?.id;
+    if (!selectionNode) {
+        errors.push(error("commit-selection-node-missing", `Selection ${selection.id} has no state node`, {
+            details: { selectionId: selection.id, candidateId: selection.candidateId }
+        }));
+    }
+    else if (selectionNode.kind !== "candidate" || selectionNode.status !== "verified") {
+        errors.push(error("commit-selection-not-verified", `Selection ${selection.id} is not a verified candidate selection`, {
+            nodeId: selectionNode.id,
+            details: { selectionId: selection.id, status: selectionNode.status, kind: selectionNode.kind }
+        }));
+    }
+    if (!selection.scoreId) {
+        errors.push(error("commit-candidate-unscored", `Selection ${selection.id} has no score evidence`, {
+            details: { selectionId: selection.id, candidateId: selection.candidateId }
+        }));
+    }
+}
+/** Candidate pass: when a candidateId is resolved, enforce its status/score bar
+ *  and bind it to a verified selection (the supplied one, else the latest). Same
+ *  errors, same order, same mutations as the inline block. No-op without one. */
+function resolveCandidateForCommit(run, resolution) {
+    const { candidateId, errors } = resolution;
+    if (!candidateId)
+        return;
+    const candidate = findCandidate(run, candidateId);
+    if (!candidate) {
+        errors.push(error("commit-candidate-not-found", `Commit candidate not found: ${candidateId}`, { details: { candidateId } }));
+        return;
+    }
+    if (candidate.status === "rejected" || candidate.status === "failed") {
+        errors.push(error("commit-candidate-not-selectable", `Candidate ${candidateId} is ${candidate.status}`, {
+            details: { candidateId, status: candidate.status }
+        }));
+    }
+    if (!candidate.scores.length) {
+        errors.push(error("commit-candidate-unscored", `Candidate ${candidateId} has no score evidence`, {
+            details: { candidateId }
+        }));
+    }
+    if (candidate.status !== "verified") {
+        errors.push(error("commit-candidate-not-verified", `Candidate ${candidateId} is not verifier-gated`, {
+            details: { candidateId, status: candidate.status }
+        }));
+    }
+    const selection = resolution.selectionId ? findSelection(run, resolution.selectionId) : latestSelectionForCandidate(run, candidateId);
+    if (!selection) {
+        errors.push(error("commit-candidate-selection-missing", `Candidate ${candidateId} has no verified selection`, {
+            details: { candidateId }
+        }));
+        return;
+    }
+    resolution.selectionId = selection.id;
+    resolution.verifierNodeId = resolveLinkedVerifier(resolution.verifierNodeId, selection.verifierNodeId || candidate.verifierNodeId, errors, "candidate", candidateId);
+    const selectionNode = findSelectionNode(run, selection.id);
+    resolution.selectionNodeId = selectionNode?.id;
+    if (!selectionNode || selectionNode.status !== "verified") {
+        errors.push(error("commit-selection-not-verified", `Candidate ${candidateId} selection ${selection.id} is not verified`, {
+            nodeId: selectionNode?.id,
+            details: { candidateId, selectionId: selection.id, status: selectionNode?.status || "missing" }
+        }));
+    }
+    if (!selection.scoreId) {
+        errors.push(error("commit-candidate-unscored", `Candidate ${candidateId} selection ${selection.id} has no score evidence`, {
+            details: { candidateId, selectionId: selection.id }
+        }));
+    }
+}
+/** Verifier-node grounding pass: kind/status checks plus the HARD no-false-green
+ *  gate (empty-capture) and the grounded-evidence gate. These remain EXACTLY as
+ *  strict — same predicates, same error codes, same order — only lifted out of
+ *  the monolith. */
+function groundVerifierEvidence(run, verifierNode, errors) {
+    if (verifierNode.kind !== "verifier") {
+        errors.push(error("commit-verifier-wrong-kind", `Node ${verifierNode.id} is not a verifier node`, {
+            nodeId: verifierNode.id,
+            details: { verifierNodeId: verifierNode.id, kind: verifierNode.kind }
+        }));
+    }
+    if (verifierNode.status !== "verified") {
+        errors.push(error("commit-verifier-not-verified", `Verifier node ${verifierNode.id} is ${verifierNode.status}`, {
+            nodeId: verifierNode.id,
+            details: { verifierNodeId: verifierNode.id, status: verifierNode.status }
+        }));
+    }
+    // HARD no-false-green gate (v0.1.43): if the backing result was an
+    // empty-capture (no findings AND no evidence even after robust
+    // normalization), the verifier node only carries a non-grounded summary
+    // fallback. That can otherwise pass the length-only path for
+    // optional-evidence tasks and present a 0-real-evidence review as
+    // clean/green. Block it BEFORE the rationale is built so the commit fails
+    // visibly (commit-gate-failed node + feedback) instead of silently passing.
+    const captureWarning = (0, gates_1.emptyCaptureWarning)(run, verifierNode);
+    if (captureWarning) {
+        errors.push(error("commit-rationale-empty-capture", `Verifier node ${verifierNode.id} cannot back a commit: ${captureWarning}`, {
+            nodeId: verifierNode.id,
+            details: { verifierNodeId: verifierNode.id, reason: captureWarning }
+        }));
+    }
+    if (!verifierNode.evidence.length) {
+        errors.push(error("commit-verifier-missing-evidence", `Verifier node ${verifierNode.id} has no evidence`, {
+            nodeId: verifierNode.id,
+            details: { verifierNodeId: verifierNode.id }
+        }));
+    }
+    else if (verifierNodeRequiresEvidence(run, verifierNode)) {
+        // Evidence grounding (v0.1.40 self-audit P1/P2): for verifier nodes whose
+        // task REQUIRES evidence (verify/verdict/requiresEvidence, and explicit
+        // candidate/selection commits), the gate must not accept unverifiable free
+        // text. Require at least one GROUNDED locator (path-like / URL /
+        // namespace:value), and — when the operator opts in via
+        // CW_REQUIRE_RESOLVABLE_EVIDENCE — that file-style locators actually resolve
+        // on disk. Closes the "presence != existence" gap. Optional-evidence tasks
+        // (e.g. map/assess) keep the length-only check so the gate is never stricter
+        // than result acceptance was.
+        const locators = verifierNode.evidence.map(evidenceLocatorString).filter(Boolean);
+        if (!(0, evidence_grounding_1.hasGroundedEvidence)(locators)) {
+            errors.push(error("commit-verifier-evidence-ungrounded", `Verifier node ${verifierNode.id} evidence is not grounded (needs a path-like locator, URL, or namespace:value token)`, {
                 nodeId: verifierNode.id,
-                details: { verifierNodeId: verifierNode.id }
+                details: { verifierNodeId: verifierNode.id, evidence: locators }
             }));
         }
-        else if (verifierNodeRequiresEvidence(run, verifierNode)) {
-            // Evidence grounding (v0.1.40 self-audit P1/P2): for verifier nodes whose
-            // task REQUIRES evidence (verify/verdict/requiresEvidence, and explicit
-            // candidate/selection commits), the gate must not accept unverifiable free
-            // text. Require at least one GROUNDED locator (path-like / URL /
-            // namespace:value), and — when the operator opts in via
-            // CW_REQUIRE_RESOLVABLE_EVIDENCE — that file-style locators actually resolve
-            // on disk. Closes the "presence != existence" gap. Optional-evidence tasks
-            // (e.g. map/assess) keep the length-only check so the gate is never stricter
-            // than result acceptance was.
-            const locators = verifierNode.evidence.map(evidenceLocatorString).filter(Boolean);
-            if (!(0, evidence_grounding_1.hasGroundedEvidence)(locators)) {
-                errors.push(error("commit-verifier-evidence-ungrounded", `Verifier node ${verifierNode.id} evidence is not grounded (needs a path-like locator, URL, or namespace:value token)`, {
+        if ((0, evidence_grounding_1.requireResolvableEvidence)()) {
+            const unresolved = (0, evidence_grounding_1.unresolvedFileEvidence)(locators, commitEvidenceBaseDirs(run));
+            if (unresolved.length) {
+                errors.push(error("commit-verifier-evidence-unresolvable", `Verifier node ${verifierNode.id} cites file evidence that does not resolve on disk: ${unresolved.join(", ")}`, {
                     nodeId: verifierNode.id,
-                    details: { verifierNodeId: verifierNode.id, evidence: locators }
+                    details: { verifierNodeId: verifierNode.id, unresolved }
                 }));
             }
-            if ((0, evidence_grounding_1.requireResolvableEvidence)()) {
-                const unresolved = (0, evidence_grounding_1.unresolvedFileEvidence)(locators, commitEvidenceBaseDirs(run));
-                if (unresolved.length) {
-                    errors.push(error("commit-verifier-evidence-unresolvable", `Verifier node ${verifierNode.id} cites file evidence that does not resolve on disk: ${unresolved.join(", ")}`, {
-                        nodeId: verifierNode.id,
-                        details: { verifierNodeId: verifierNode.id, unresolved }
-                    }));
-                }
-            }
         }
     }
-    let rationale;
-    if (verifierGated && candidateId && selectionId) {
-        const candidate = findCandidate(run, candidateId);
-        const selection = findSelection(run, selectionId);
-        const score = selection?.scoreId ? findScore(run, candidateId, selection.scoreId) : undefined;
-        rationale = selection?.acceptanceRationale || (0, trust_audit_1.buildAcceptanceRationale)({
-            selectedCandidateId: candidateId,
-            scoreId: selection?.scoreId,
-            scoreCriteria: score?.criteria,
-            verifierNodeId,
-            evidenceCount: verifierNode?.evidence.length || 0,
-            sandboxProfileId: sandboxProfileForCandidate(run, candidate),
-            workerId: candidate?.workerId,
-            commitGateResult: "passed"
-        });
-        for (const failure of (0, trust_audit_1.validateAcceptanceRationale)(rationale)) {
-            errors.push(error("commit-rationale-incomplete", `Verifier-gated commit cannot explain acceptance: ${failure}`, {
-                details: { candidateId, selectionId, verifierNodeId }
-            }));
-        }
+}
+/** Rationale pass: when candidate + selection are both resolved, reuse the
+ *  selection's acceptance rationale or rebuild it, then push completeness errors.
+ *  Returns the rationale (or undefined). Identical to the inline block. */
+function buildCommitRationale(run, resolution, verifierNode) {
+    const { candidateId, selectionId, verifierNodeId, errors } = resolution;
+    if (!candidateId || !selectionId)
+        return undefined;
+    const candidate = findCandidate(run, candidateId);
+    const selection = findSelection(run, selectionId);
+    const score = selection?.scoreId ? findScore(run, candidateId, selection.scoreId) : undefined;
+    const rationale = selection?.acceptanceRationale || (0, trust_audit_1.buildAcceptanceRationale)({
+        selectedCandidateId: candidateId,
+        scoreId: selection?.scoreId,
+        scoreCriteria: score?.criteria,
+        verifierNodeId,
+        evidenceCount: verifierNode?.evidence.length || 0,
+        sandboxProfileId: (0, gates_1.sandboxProfileForCandidate)(run, candidate),
+        workerId: candidate?.workerId,
+        commitGateResult: "passed"
+    });
+    for (const failure of (0, trust_audit_1.validateAcceptanceRationale)(rationale)) {
+        errors.push(error("commit-rationale-incomplete", `Verifier-gated commit cannot explain acceptance: ${failure}`, {
+            details: { candidateId, selectionId, verifierNodeId }
+        }));
     }
-    // REVIEW GATE — POLICY layered ON TOP of the verifier MECHANISM. These errors
-    // can only ADD constraints (required approvals from authorized roles); they
-    // never relax verifier acceptance. Empty unless a policy applies to commits.
-    // Fail closed: a commit lacking its required approvals is BLOCKED here.
+    return rationale;
+}
+/** Review-gate pass — POLICY layered ON TOP of the verifier MECHANISM. These
+ *  errors can only ADD constraints (required approvals from authorized roles);
+ *  they never relax verifier acceptance. Empty unless a policy applies to
+ *  commits. Fail closed: a commit lacking its required approvals is BLOCKED here,
+ *  and provenance is only emitted when NO errors remain. */
+function layerCommitReviewGate(run, resolution, errors) {
+    const { candidateId, selectionId } = resolution;
     const reviewErrors = (0, collaboration_1.reviewGateErrors)(run, {
         targetKind: "commit",
         candidateId,
@@ -357,7 +391,7 @@ function resolveCommitGate(run, options) {
         selfActorIds: (0, collaboration_1.selfActorIdsForCandidate)(run, candidateId, selectionId)
     });
     errors.push(...reviewErrors);
-    const review = errors.length
+    return errors.length
         ? undefined
         : (0, collaboration_1.commitReviewProvenance)(run, {
             targetKind: "commit",
@@ -365,24 +399,6 @@ function resolveCommitGate(run, options) {
             selectionId,
             selfActorIds: (0, collaboration_1.selfActorIdsForCandidate)(run, candidateId, selectionId)
         });
-    return {
-        verifierGated: true,
-        verifierNodeId,
-        candidateId,
-        selectionId,
-        selectionNodeId,
-        evidence: verifierNode?.evidence || [],
-        errors,
-        rationale,
-        review,
-        metadata: {
-            ...metadata,
-            verifierNodeId,
-            candidateId,
-            selectionId,
-            selectionNodeId
-        }
-    };
 }
 function recordCommitNode(run, commit, options, gate) {
     const contract = (0, state_node_1.upsertRunContract)(run, (0, pipeline_contract_1.createDefaultPipelineContract)());
@@ -534,13 +550,6 @@ function findScore(run, candidateId, scoreId) {
         return undefined;
     }
 }
-function sandboxProfileForCandidate(run, candidate) {
-    const worker = candidate?.workerId ? (run.workers || []).find((entry) => entry.id === candidate.workerId) : undefined;
-    if (worker?.sandboxProfileId)
-        return worker.sandboxProfileId;
-    const task = candidate?.taskId ? (run.tasks || []).find((entry) => entry.id === candidate.taskId) : undefined;
-    return task?.sandboxProfileId;
-}
 function findNode(run, nodeId) {
     return (run.nodes || []).find((node) => node.id === nodeId);
 }

package/dist/coordinator/util.js

@@ -3,13 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createId = void 0;
 exports.checksumFile = checksumFile;
 exports.assertUnique = assertUnique;
 exports.assertNoRecordPathCollisions = assertNoRecordPathCollisions;
 exports.indexRow = indexRow;
 exports.compareRecords = compareRecords;
 exports.uniqueEdges = uniqueEdges;
-exports.createId = createId;
 exports.touch = touch;
 exports.timestamp = timestamp;
 exports.unique = unique;
@@ -68,14 +68,11 @@ function uniqueEdges(edges) {
     }
     return result;
 }
-// Deterministic record id (FreeBSD-audit L12/L13): the record's POSITION in its
-// per-run blackboard collection, threaded from the call site. No wall-clock stamp,
-// no PRNG suffix — replaying the same coordination mints byte-identical ids, so
-// snapshot/replay digests match. Each call site already asserts the minted id is
-// unique within its collection, and these collections only ever append.
-function createId(prefix, seq) {
-    return `${prefix}-${String(seq).padStart(4, "0")}`;
-}
+// Deterministic record id — single source of truth in ../multi-agent/ids.
+// Re-exported here so coordinator.ts importers stay byte-unchanged (F10 dedup:
+// the multi-agent kernel shares the exact same helper).
+var ids_1 = require("../multi-agent/ids");
+Object.defineProperty(exports, "createId", { enumerable: true, get: function () { return ids_1.createId; } });
 function touch(record) {
     record.updatedAt = timestamp();
     return record;

package/dist/dispatch.js

@@ -55,7 +55,7 @@ function createDispatchManifest(run, limit, options = {}) {
             backendSelection
         };
     }
-    const dispatchId = createDispatchId();
+    const dispatchId = createDispatchId(run);
     const manifestPath = node_path_1.default.join(run.paths.dispatchesDir, `${dispatchId}.json`);
     node_fs_1.default.mkdirSync(run.paths.dispatchesDir, { recursive: true });
     const taskIds = new Set(tasks.map((task) => task.id));
@@ -201,9 +201,17 @@ function formatDispatchTask(task) {
         multiAgent: task.multiAgent
     };
 }
-function createDispatchId() {
+// Deterministic dispatch id (replay-determinism self-audit): the wall-clock stamp
+// is an edge timestamp (stripped on replay), but the former Math.random() suffix
+// made every dispatch mint a non-reproducible id. The suffix is now a per-run
+// sequence — the count of dispatches already allocated on this run — so re-running
+// the same workflow yields byte-identical dispatch ids while each dispatch within a
+// run still gets a distinct, monotonically increasing id. Mirrors the de-clock done
+// for worker ids in src/worker-isolation/paths.ts.
+function createDispatchId(run) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    return `dispatch-${stamp}-${Math.random().toString(36).slice(2, 8)}`;
+    const seq = (run.dispatches?.length || 0) + 1;
+    return `dispatch-${stamp}-${String(seq).padStart(4, "0")}`;
 }
 // H7: persist a CUSTOM sandbox profile DEFINITION (loaded from a FILE at dispatch)
 // onto run.customSandboxProfiles, keyed by the definition's logical id. Only fires

package/dist/evidence-reasoning.js

@@ -19,6 +19,7 @@ const state_1 = require("./state");
 const multi_agent_operator_ux_1 = require("./multi-agent-operator-ux");
 const trust_audit_1 = require("./trust-audit");
 const multi_agent_trust_1 = require("./multi-agent-trust");
+const validation_1 = require("./validation");
 // ---------------------------------------------------------------------------
 // Evidence Adoption Reasoning Chain (v0.1.26)
 //
@@ -616,7 +617,9 @@ function readAllScores(run) {
             continue;
         for (const file of node_fs_1.default.readdirSync(dir).filter((entry) => entry.endsWith(".json")).sort()) {
             try {
-                const score = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8"));
+                const score = (0, validation_1.tryValidateCandidateScore)(JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8")));
+                if (!score)
+                    continue; // Malformed/forged score shape: skip; the score gate fails closed.
                 scores.set(score.id, score);
             }
             catch {

package/dist/execution-backend/agent.js

@@ -255,53 +255,16 @@ function prepareAgentSpawn(request) {
         timeoutMs: resolved.timeoutMs || 600000
     };
 }
-// Reads jobs JSON on stdin, spawns ALL concurrently (shell:false, inherited env —
-// the agent's own credentials resolve; CW never reads them), per-job SIGTERM at
-// timeoutMs + SIGKILL at +5s, caps each captured stdout at 32MB, and prints the
-// outcome array when every job has settled. stderr is drained (a full pipe must
-// never wedge a child). A kill yields exitCode null — the no-exit-code refusal.
-const BATCH_DELEGATE_CHILD = `
-const { spawn } = require("node:child_process");
-let raw = "";
-process.stdin.setEncoding("utf8");
-process.stdin.on("data", (d) => (raw += d));
-process.stdin.on("end", () => {
-  const jobs = JSON.parse(raw);
-  if (!jobs.length) { process.stdout.write("[]"); return; }
-  const out = new Array(jobs.length);
-  let pending = jobs.length;
-  const CAP = 32 * 1024 * 1024;
-  jobs.forEach((job, i) => {
-    let stdout = "";
-    let settled = false;
-    const settle = (o) => {
-      if (settled) return;
-      settled = true;
-      out[i] = o;
-      if (--pending === 0) process.stdout.write(JSON.stringify(out));
-    };
-    let child;
-    try {
-      child = spawn(job.binary, job.args, { cwd: job.cwd, env: process.env, shell: false });
-    } catch (error) {
-      settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout: "" });
-      return;
-    }
-    const term = setTimeout(() => { try { child.kill("SIGTERM"); } catch {} }, job.timeoutMs);
-    const kill = setTimeout(() => { try { child.kill("SIGKILL"); } catch {} }, job.timeoutMs + 5000);
-    child.stdout.on("data", (d) => { if (stdout.length < CAP) stdout += d; });
-    child.stderr.on("data", () => {});
-    child.on("error", (error) => {
-      clearTimeout(term); clearTimeout(kill);
-      settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout });
-    });
-    child.on("close", (code) => {
-      clearTimeout(term); clearTimeout(kill);
-      settle({ exitCode: typeof code === "number" ? code : null, stdout });
-    });
-  });
-});
-`;
+// The batch delegate child is a real, packaged Node script (not an embedded
+// `node -e` string — F11). It reads jobs JSON on stdin, spawns ALL concurrently
+// (shell:false, inherited env — the agent's own credentials resolve; CW never
+// reads them), per-job SIGTERM at timeoutMs + SIGKILL at +5s, caps each captured
+// stdout at 32MB, and prints the outcome array when every job has settled. stderr
+// is drained (a full pipe must never wedge a child). A kill yields exitCode null —
+// the no-exit-code refusal. We spawn it BY PATH (shell:false); the path is
+// resolved from this compiled module (dist/execution-backend/agent.js) up to the
+// package's `scripts/children/` dir, which package.json ships in "files".
+const BATCH_DELEGATE_CHILD_SCRIPT = node_path_1.default.resolve(__dirname, "..", "..", "scripts", "children", "batch-delegate-child.js");
 /** Run a batch of agent spawns concurrently; outcomes index-align with jobs. The
  *  parent backstop timeout (max job timeout + 30s) means even a wedged delegate
  *  child cannot deadlock the drive: on any batch-level failure EVERY job settles
@@ -310,7 +273,7 @@ function runAgentBatchOutcomes(jobs) {
     if (!jobs.length)
         return [];
     const maxTimeout = Math.max(...jobs.map((job) => job.timeoutMs));
-    const child = (0, node_child_process_1.spawnSync)(process.execPath, ["-e", BATCH_DELEGATE_CHILD], {
+    const child = (0, node_child_process_1.spawnSync)(process.execPath, [BATCH_DELEGATE_CHILD_SCRIPT], {
         input: JSON.stringify(jobs),
         encoding: "utf8",
         maxBuffer: 33 * 1024 * 1024 * jobs.length,