cool-workflow 0.1.82 → 0.1.84

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"
@@ -14,7 +14,7 @@
   "bugs": {
     "url": "https://github.com/coo1white/cool-workflow/issues"
   },
-  "description": "Auditable workflow control-plane and orchestration runtime: TypeScript dispatch, evidence-gated verification, state commits, scheduling, routines, multi-agent coordination, and MCP. Delegates execution to external agents — never runs models.",
+  "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "type": "commonjs",
   "license": "BSD-2-Clause",
   "author": {
@@ -51,6 +51,7 @@
     "forward-ref": "node scripts/forward-ref-docs.js",
     "verify:container": "node scripts/verify-container-selfref.js",
     "gen:manifests": "node scripts/gen-manifests.js",
+    "gen:parity": "node scripts/gen-parity-doc.js",
     "manifest:load-check": "node test/vendor-manifest-load-smoke.js",
     "parity:check": "node scripts/parity-check.js --check",
     "version:sync": "node scripts/version-sync-check.js",

package/scripts/bump-version.js

@@ -59,7 +59,15 @@ function main() {
   if (!SEMVER.test(next)) fail(`"${next}" is not a x.y.z version`);
 
   const current = JSON.parse(fs.readFileSync(path.join(pluginRoot, "package.json"), "utf8")).version;
-  if (next === current) fail(`already at ${next}`);
+  if (next === current) {
+    // Idempotent: re-running the bump for the same version is a no-op (exit 0)
+    // rather than a hard fail. Required by `release-flow --cut --version X` when
+    // the bump was already landed in a prior PR (e.g. a release-prep PR that
+    // committed the version surfaces, then a follow-up fix on top — cut should
+    // still be able to commit the verdict and tag without re-bumping).
+    process.stdout.write(`bump:version: already at ${next}, no surfaces to update\n`);
+    process.exit(0);
+  }
 
   const touched = [];
   const note = (rel) => touched.push(rel);

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.82",
+      "Cool Workflow v0.1.84",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.82");
+    assert.equal(summary.version, "0.1.84");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.82");
+    assert.equal(shown.app.version, "0.1.84");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.82");
+    assert.equal(state.workflow.app.version, "0.1.84");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/dogfood-release.js

@@ -5,7 +5,7 @@ const { spawnSync } = require("node:child_process");
 const fs = require("node:fs");
 const path = require("node:path");
 
-const TARGET_VERSION = "0.1.82";
+const TARGET_VERSION = "0.1.84";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/gen-parity-doc.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+"use strict";
+
+// gen-parity-doc.js — generate the CLI<->MCP parity matrix, counts, and the
+// surface-specific (cli-only / projected) enumerations in
+// docs/cli-mcp-parity.7.md DIRECTLY from the capability registry (the single
+// source of truth). The matrix declares itself "machine-complete by design", so
+// it must BE machine-generated — a hand-maintained table drifts (it did: 132
+// rows vs a 190-capability registry). Mechanism, not policy.
+//
+//   node scripts/gen-parity-doc.js            # rewrite the generated regions
+//   node scripts/gen-parity-doc.js --check    # fail closed if the doc drifted
+//
+// Idempotent: re-running with no registry change is a no-op. Only the four
+// marker-delimited regions are touched; all surrounding prose (incl. the Basic
+// English narrative and version trailers) is preserved byte-for-byte.
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const pluginRoot = path.resolve(__dirname, "..");
+const DOC = path.join(pluginRoot, "docs", "cli-mcp-parity.7.md");
+const CHECK = process.argv.includes("--check");
+
+const { CAPABILITY_REGISTRY } = require(path.join(pluginRoot, "dist", "capability-registry.js"));
+
+const NUM_WORDS = ["Zero", "One", "Two", "Three", "Four", "Five", "Six", "Seven", "Eight", "Nine", "Ten", "Eleven", "Twelve"];
+const numWord = (n) => NUM_WORDS[n] || String(n);
+
+function cliCommand(cap) {
+  return cap.cli ? `cw ${cap.cli.path.join(" ")}` : "—";
+}
+function cliDisplay(cap) {
+  // Human form used in the prose bullets (e.g. "schedule daemon", "demo tamper").
+  return cap.cli ? cap.cli.path.join(" ") : cap.capability;
+}
+function mcpTool(cap) {
+  return cap.mcp ? cap.mcp.tool : "—";
+}
+function payload(cap) {
+  if (cap.surface !== "both") return cap.surface;
+  return cap.payloadIdentical === false ? "projected" : "identical";
+}
+
+function buildCount() {
+  const caps = CAPABILITY_REGISTRY.length;
+  const tools = CAPABILITY_REGISTRY.filter((c) => c.mcp && c.mcp.tool).length;
+  return `machine-complete by design: ${caps} capabilities, ${tools} MCP tools.`;
+}
+
+function buildTable() {
+  const lines = [
+    "| Capability | CLI command | MCP tool | Core entry | Surface | Payload |",
+    "| --- | --- | --- | --- | --- | --- |"
+  ];
+  for (const cap of CAPABILITY_REGISTRY) {
+    lines.push(`| \`${cap.capability}\` | \`${cliCommand(cap)}\` | \`${mcpTool(cap)}\` | \`${cap.entry}\` | ${payload(cap) === "cli-only" || cap.surface !== "both" ? cap.surface : "both"} | ${payload(cap)} |`);
+  }
+  return lines.join("\n");
+}
+
+function buildCliOnly() {
+  const caps = CAPABILITY_REGISTRY.filter((c) => c.surface === "cli-only");
+  const head = `${numWord(caps.length)} ${caps.length === 1 ? "capability is" : "capabilities are"} CLI-only:`;
+  const bullets = caps.map((c) => `- \`${cliDisplay(c)}\` — ${c.reason || "(reason recorded in the registry)"}`);
+  return [head, "", ...bullets].join("\n");
+}
+
+function buildProjected() {
+  const caps = CAPABILITY_REGISTRY.filter((c) => c.surface === "both" && c.payloadIdentical === false);
+  const head = `${numWord(caps.length)} ${caps.length === 1 ? "capability is" : "capabilities are"} payload-divergent on purpose (\`projected\`):`;
+  const bullets = caps.map((c) => `- \`${c.capability}\` — ${c.reason || "(reason recorded in the registry)"}`);
+  return [head, "", ...bullets].join("\n");
+}
+
+const REGIONS = {
+  count: buildCount(),
+  table: buildTable(),
+  cliOnly: buildCliOnly(),
+  projected: buildProjected()
+};
+
+function replaceRegion(text, name, body) {
+  const begin = `<!-- gen:parity:${name} -->`;
+  const end = `<!-- /gen:parity:${name} -->`;
+  const re = new RegExp(`${begin}[\\s\\S]*?${end}`);
+  if (!re.test(text)) {
+    throw new Error(`marker ${begin} … ${end} not found in cli-mcp-parity.7.md — add the markers once, then re-run.`);
+  }
+  return text.replace(re, `${begin}\n${body}\n${end}`);
+}
+
+const original = fs.readFileSync(DOC, "utf8");
+let next = original;
+for (const [name, body] of Object.entries(REGIONS)) next = replaceRegion(next, name, body);
+
+if (CHECK) {
+  if (next !== original) {
+    process.stderr.write("gen-parity-doc: docs/cli-mcp-parity.7.md is OUT OF SYNC with the capability registry. Run `node scripts/gen-parity-doc.js` and commit.\n");
+    process.exit(1);
+  }
+  process.stdout.write("gen-parity-doc: cli-mcp-parity.7.md in sync with the registry.\n");
+} else {
+  if (next !== original) fs.writeFileSync(DOC, next);
+  process.stdout.write(`gen-parity-doc: ${next !== original ? "updated" : "unchanged"} — ${CAPABILITY_REGISTRY.length} capabilities, ${CAPABILITY_REGISTRY.filter((c) => c.mcp).length} MCP tools.\n`);
+}

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.82");
+    assert.equal(appValidation.summary.version, "0.1.84");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.82 end-to-end golden path."
+        "Prove the deterministic v0.1.84 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.82");
+    assert.equal(state.workflow.app.version, "0.1.84");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.82/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.84/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/parity-check.js

@@ -9,8 +9,8 @@
 // FAIL CLOSED ON DRIFT (BSD discipline, same shape as gen-manifests --check):
 //   1. STATIC parity — the declared capability registry must exactly match the
 //      live MCP tool list (tools/list) and the CLI dispatch tokens parsed from
-//      dist/cli.js. A tool or command on one surface but not the other, or not
-//      declared in src/capability-registry.ts, is release-blocking.
+//      the built CLI dispatch surface. A tool or command on one surface but not
+//      the other, or not declared in src/capability-registry.ts, is release-blocking.
 //   2. PAYLOAD parity — for every capability declared `payloadIdentical`, the
 //      `cw <cmd> --json` payload must equal the `cw_<tool>` MCP result on a real
 //      bootstrap run (whitespace + generation-moment ISO timestamps aside).
@@ -31,50 +31,16 @@ const cli = path.join(pluginRoot, "dist", "cli.js");
 const mcpServer = path.join(pluginRoot, "dist", "mcp-server.js");
 const registry = require(path.join(pluginRoot, "dist", "capability-registry.js"));
 
-// Read capabilities that are safe to probe on a freshly planned run with only a
-// runId (or no args). Each: [capability, cliArgvAfterRunId, mcpTool].
-// runId-less reads use [] for cli args and {} mcp args.
-const RUN_PROBES = [
-  ["status", ["--json"], "cw_status"],
-  ["operator.status", ["--json"], "cw_operator_status"],
-  ["operator.report", ["--json"], "cw_operator_report"],
-  ["graph", ["--json"], "cw_operator_graph"],
-  ["report", ["--json"], "cw_report"],
-  ["next", [], "cw_next"],
-  ["state.check", [], "cw_state_check"],
-  ["contract.show", [], "cw_contract_show"],
-  ["node.list", [], "cw_node_list"],
-  ["node.graph", ["--json"], "cw_node_graph"],
-  ["worker.summary", ["--json"], "cw_worker_summary"],
-  ["candidate.summary", ["--json"], "cw_candidate_summary"],
-  ["feedback.summary", ["--json"], "cw_feedback_summary"],
-  ["commit.summary", ["--json"], "cw_commit_summary"],
-  ["audit.summary", [], "cw_audit_summary"],
-  ["multi-agent.summary", ["--json"], "cw_multi_agent_summary"],
-  ["workbench.view", ["--json"], "cw_workbench_view"],
-  ["metrics.show", ["--json"], "cw_metrics_show"],
-  ["review.status", ["--json"], "cw_review_status"],
-  ["comment.list", ["--json"], "cw_comment_list"],
-  ["run.drive", ["--json"], "cw_run_drive"],
-  ["gc.plan", ["--json"], "cw_gc_plan"],
-  ["gc.verify", ["--json"], "cw_gc_verify"]
-];
-const GLOBAL_PROBES = [
-  ["list", "cw_list"],
-  ["app.list", "cw_app_list"],
-  ["topology.list", "cw_topology_list"],
-  ["sandbox.list", "cw_sandbox_list"],
-  ["backend.list", "cw_backend_list"],
-  ["backend.agent.config.show", "cw_backend_agent_config_show"],
-  ["metrics.summary", "cw_metrics_summary"]
-];
-
 function capById(id) {
   const cap = registry.CAPABILITY_REGISTRY.find((entry) => entry.capability === id);
   assert.ok(cap, `probe references unknown capability ${id}`);
   return cap;
 }
 
+function jsonFlag(cap) {
+  return cap.cli.jsonMode === "flag" ? ["--json"] : [];
+}
+
 // ---- 1. static surface parity ---------------------------------------------
 function liveMcpTools() {
   const result = execFileSync(node, [mcpServer], {
@@ -91,10 +57,14 @@ function liveMcpTools() {
 }
 
 function cliDispatchTokens() {
-  const source = fs.readFileSync(cli, "utf8");
+  const source = cliDispatchSources().map((file) => fs.readFileSync(file, "utf8")).join("\n");
   return [...new Set([...source.matchAll(/case\s+"([^"]+)":/g)].map((match) => match[1]))];
 }
 
+function cliDispatchSources() {
+  return [cli, path.join(pluginRoot, "dist", "cli", "command-surface.js")].filter((file) => fs.existsSync(file));
+}
+
 // ---- 2. payload identity ---------------------------------------------------
 // Generation-moment ISO timestamps are presentation metadata, not capability
 // data: the same field carries the wall-clock instant of the render. Neutralize
@@ -144,31 +114,28 @@ async function payloadParity() {
   const runId = plan.runId;
   const mismatches = [];
   const checked = [];
+  const probePlan = registry.payloadProbePlan();
+  assert.deepEqual(probePlan.unclassified, [], "payload probe classification has unclassified capabilities");
+  assert.deepEqual(probePlan.duplicateClassifications, [], "payload probe classification has duplicates");
+  assert.deepEqual(probePlan.invalidClassifications, [], "payload probe classification names non-payload capabilities");
   const mcp = openMcp();
   try {
     await mcp.rpc("initialize", {});
-    for (const [capability, mcpTool] of GLOBAL_PROBES) {
-      const cap = capById(capability);
-      assert.equal(cap.mcp.tool, mcpTool, `probe/registry MCP tool mismatch for ${capability}`);
+    for (const target of registry.payloadProbeTargets()) {
+      const cap = capById(target.capability);
       // jsonMode is the single source for the CLI's --json policy; this probe only
       // appends --json for "flag" verbs and JSON.parse-es the result. The human
       // rendering and "default"-verb no-flag JSON are pinned to cap.cli.jsonMode by
       // the companion test/cli-jsonmode-parity-smoke.js, so cli.ts can't silently
       // re-encode that policy by hand and drift from this registry data.
-      const cliArgv = [...cap.cli.path, ...(cap.cli.jsonMode === "flag" ? ["--json"] : [])];
-      const cliOut = JSON.parse(execFileSync(node, [cli, ...cliArgv], { cwd: workspace, encoding: "utf8" }));
-      const mcpOut = await mcp.tool(mcpTool, { cwd: workspace });
-      checked.push(capability);
-      if (canonical(cliOut) !== canonical(mcpOut)) mismatches.push(capability);
-    }
-    for (const [capability, extraArgv, mcpTool] of RUN_PROBES) {
-      const cap = capById(capability);
-      assert.equal(cap.mcp.tool, mcpTool, `probe/registry MCP tool mismatch for ${capability}`);
-      const cliArgv = [...cap.cli.path, runId, ...extraArgv];
+      const cliArgv = target.kind === "run"
+        ? [...cap.cli.path, runId, ...jsonFlag(cap)]
+        : [...cap.cli.path, ...jsonFlag(cap)];
       const cliOut = JSON.parse(execFileSync(node, [cli, ...cliArgv], { cwd: workspace, encoding: "utf8" }));
-      const mcpOut = await mcp.tool(mcpTool, { cwd: workspace, runId });
-      checked.push(capability);
-      if (canonical(cliOut) !== canonical(mcpOut)) mismatches.push(capability);
+      const mcpArgs = target.kind === "run" ? { cwd: workspace, runId } : { cwd: workspace };
+      const mcpOut = await mcp.tool(cap.mcp.tool, mcpArgs);
+      checked.push(target.capability);
+      if (canonical(cliOut) !== canonical(mcpOut)) mismatches.push(target.capability);
     }
   } finally {
     mcp.server.kill();
@@ -204,6 +171,9 @@ async function main() {
     if (report.missingCliTokens.length) lines.push(`  - registry declares CLI tokens absent from dist/cli.js: ${report.missingCliTokens.join(", ")}`);
     if (report.undeclaredCliTokens.length) lines.push(`  - dist/cli.js dispatches tokens not declared in the registry: ${report.undeclaredCliTokens.join(", ")}`);
     if (report.reasonlessExceptions.length) lines.push(`  - surface-specific / payload-divergent capabilities missing a recorded reason: ${report.reasonlessExceptions.join(", ")}`);
+    if (report.payloadProbeUnclassified.length) lines.push(`  - payload-identical capabilities neither probed nor deferred: ${report.payloadProbeUnclassified.join(", ")}`);
+    if (report.payloadProbeDuplicateClassifications.length) lines.push(`  - payload probe duplicate classifications: ${report.payloadProbeDuplicateClassifications.join(", ")}`);
+    if (report.payloadProbeInvalidClassifications.length) lines.push(`  - payload probe classifications for invalid capabilities: ${report.payloadProbeInvalidClassifications.join(", ")}`);
     if (report.registryLint.length) lines.push(`  - registry lint: ${report.registryLint.join("; ")}`);
     if (payload.mismatches.length) lines.push(`  - cw --json != cw_<tool> payload for: ${payload.mismatches.join(", ")}`);
     lines.push("Reconcile src/capability-registry.ts, cli.ts, and mcp-server.ts so both surfaces render one data source.\n");

package/scripts/release-flow.js

@@ -124,6 +124,7 @@ function reviewerPromptBody() {
 
 function buildReviewerInput(resultPath) {
   const action = MODE_CUT ? `tag v${cutVersion || "<next>"}` : "check (no tag)";
+  const resultDisplay = path.relative(repoRoot, resultPath);
   return [
     reviewerPromptBody(),
     "",
@@ -133,11 +134,11 @@ function buildReviewerInput(resultPath) {
     `- Previous tag: ${PREV_TAG || "(none)"}`,
     `- Diff range: ${PREV_TAG ? `${PREV_TAG}..HEAD` : "(no previous tag)"}`,
     `- Proposed action: ${action}`,
-    `- Repo root (run git here): ${repoRoot}`,
+    "- Repo root (run git here): .",
     "",
     "## Required output — write ONLY this file, nothing else",
     `Write your verdict to this exact path:`,
-    `  ${resultPath}`,
+    `  ${resultDisplay}`,
     "First line MUST be exactly one of:",
     `  APPROVED ${HEAD}`,
     "  <one concrete sentence: the user-visible capability this ships>",
@@ -174,10 +175,10 @@ function delegateReview(resultPath, inputPath) {
   }
 
   const subMap = {
-    input: inputPath,
-    manifest: inputPath,
-    result: resultPath,
-    workerDir: repoRoot,
+    input: path.relative(repoRoot, inputPath),
+    manifest: path.relative(repoRoot, inputPath),
+    result: path.relative(repoRoot, resultPath),
+    workerDir: ".",
     model: cfg.model || "",
     prompt: fs.readFileSync(inputPath, "utf8")
   };

package/scripts/sync-project-index.js

@@ -311,7 +311,7 @@ function ensureLine(file, line, afterHeading) {
 }
 
 function detectObsidianVault() {
-  const candidate = path.join(process.env.HOME || "", "Documents", "Nick");
+  const candidate = process.env.CW_OBSIDIAN_VAULT || path.join(process.env.HOME || "", "Documents", "Cool Workflow");
   return fs.existsSync(path.join(candidate, ".obsidian")) ? candidate : "";
 }
 

package/dist/verifier-registry.js

@@ -1,46 +0,0 @@
-"use strict";
-// Verifier Registry — open pluggability for commit-gate verifiers.
-//
-// BSD discipline (mechanism separate from policy):
-//  - MECHANISM: a Map<string, Verifier> with register + resolve.
-//  - POLICY: which verifiers exist is declared via registerVerifier() at load time.
-//  - FAIL CLOSED: unknown verifier id → named refusal.
-//  - COMPOSABLE: multiple verifiers can be chained; each runs in registration order.
-//
-// From v0.1.58: the built-in verifier (validateResultEnvelope, validateRunGates,
-// hasGroundedEvidence) remains the default. Registered verifiers run BEFORE the
-// default — they can block or add evidence but cannot override the default gate.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerVerifier = registerVerifier;
-exports.getVerifier = getVerifier;
-exports.listVerifiers = listVerifiers;
-exports.runAllVerifiers = runAllVerifiers;
-const _verifierRegistry = new Map();
-function registerVerifier(verifier) {
-    _verifierRegistry.set(verifier.id, verifier);
-}
-function getVerifier(id) {
-    return _verifierRegistry.get(id);
-}
-function listVerifiers() {
-    return [..._verifierRegistry.values()];
-}
-/** Run all registered verifiers against a run. Returns the aggregated verdict:
- *  "pass" if all pass, "block" if any block (first block reason wins). */
-async function runAllVerifiers(input) {
-    const reasons = [];
-    const evidence = [];
-    for (const verifier of _verifierRegistry.values()) {
-        const result = await verifier.verify(input);
-        if (result.evidence)
-            evidence.push(...result.evidence);
-        if (result.verdict === "block") {
-            reasons.push(`[${verifier.id}] ${result.reason || "blocked by verifier"}`);
-        }
-        else if (result.verdict === "warn") {
-            reasons.push(`[${verifier.id}] warn: ${result.reason || "warning"}`);
-        }
-    }
-    const blocked = reasons.some((r) => !r.includes("warn:"));
-    return { verdict: blocked ? "block" : "pass", reasons, evidence };
-}