cool-workflow 0.1.98 → 0.2.0

package/dist/core/pipeline/drive-decide.js

@@ -0,0 +1,227 @@
+"use strict";
+// core/pipeline/drive-decide.ts — driveStep/driveConcurrentRound's PURE
+// decision core: task selection, terminal/gate logic, token-budget check,
+// retry/park math, cache-key formulas.
+//
+// MILESTONE 6+7 (combined; the big one — see v2/PLAN.md Open risk 9).
+// Every branch here is a pure function of already-loaded run state; it
+// does not itself spawn a process or touch disk. shell/drive.ts is the
+// thin imperative loop that calls these functions once per step and
+// performs the actual spawn/commit/cache-write IO the decision names.
+//
+// Evidence: SPEC/pipeline-run.md "Drive loop — src/drive.ts", "Drive
+// internals a rebuild must copy", "`--incremental` and the result
+// cache".
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SCHEDULING_POLICY = exports.MAX_SUB_WORKFLOW_DEPTH = exports.DRIVE_SCHEMA_VERSION = void 0;
+exports.makeStep = makeStep;
+exports.selectDriveTask = selectDriveTask;
+exports.countCompleted = countCompleted;
+exports.countParked = countParked;
+exports.verdictVerifierNodeId = verdictVerifierNodeId;
+exports.exitCodeFromEvidence = exitCodeFromEvidence;
+exports.hasTerminalCommit = hasTerminalCommit;
+exports.terminalOrConfigStep = terminalOrConfigStep;
+exports.retryOrPark = retryOrPark;
+exports.priorAttempts = priorAttempts;
+exports.maxIterations = maxIterations;
+exports.autoWidth = autoWidth;
+exports.roundWidth = roundWidth;
+exports.finalDriveStatus = finalDriveStatus;
+exports.cacheFileName = cacheFileName;
+exports.defaultCacheKey = defaultCacheKey;
+exports.incrementalCacheKey = incrementalCacheKey;
+exports.incrementalDelegationDigest = incrementalDelegationDigest;
+const dispatch_1 = require("./dispatch");
+const hash_1 = require("../hash");
+exports.DRIVE_SCHEMA_VERSION = 1;
+exports.MAX_SUB_WORKFLOW_DEPTH = 4;
+function makeStep(action, status, fields) {
+    return { schemaVersion: 1, action, status, ...fields };
+}
+/** The task the next drive step would advance: a running task first,
+ *  else the next pending task of the first runnable phase. */
+function selectDriveTask(run) {
+    const phase = (0, dispatch_1.firstRunnablePhase)(run);
+    if (!phase)
+        return undefined;
+    const phaseTasks = run.tasks.filter((task) => phase.taskIds.includes(task.id));
+    return phaseTasks.find((task) => task.status === "running") || phaseTasks.find((task) => task.status === "pending");
+}
+function countCompleted(run) {
+    return run.tasks.filter((task) => task.status === "completed").length;
+}
+function countParked(run) {
+    return run.tasks.filter((task) => task.status === "failed").length;
+}
+/** The completed verdict/synthesis task's verifierNodeId, if any. */
+function verdictVerifierNodeId(run) {
+    const verdict = run.tasks.find((task) => /^verdict[:/]|^synthesis[:/]/i.test(task.id) && task.status === "completed");
+    return verdict?.verifierNodeId;
+}
+function exitCodeFromEvidence(evidence) {
+    const entry = evidence.find((line) => line.startsWith("exitCode:"));
+    if (!entry)
+        return null;
+    const raw = entry.slice("exitCode:".length);
+    return raw === "null" ? null : Number(raw);
+}
+/** Whether a commit already exists whose reason starts with
+ *  "agent-delegation-drive" (the once-only terminal-commit check). */
+function hasTerminalCommit(run) {
+    return (run.commits || []).some((commit) => commit.reason && commit.reason.startsWith("agent-delegation-drive"));
+}
+/** terminalOrConfigStep's pure decision half. Returns a DriveStep only
+ *  for the non-advancing outcomes (terminal commit/complete, blocked
+ *  phase, blocked token budget, blocked unconfigured agent); returns
+ *  `{kind: undefined}` when there is a ready task to actually process. */
+function terminalOrConfigStep(run, selected, agentConfigured, tokenBudget) {
+    if (!selected) {
+        const allComplete = run.tasks.every((task) => task.status === "completed");
+        if (allComplete) {
+            if (!hasTerminalCommit(run)) {
+                return { kind: "commit", verifierNodeId: verdictVerifierNodeId(run) };
+            }
+            return { kind: "complete", step: makeStep("complete", "complete", { runId: run.id }) };
+        }
+        return {
+            kind: "blocked",
+            step: makeStep("blocked", "blocked", { runId: run.id, reason: "no eligible worker (a parked/failed worker blocks the phase gate)" }),
+        };
+    }
+    if (tokenBudget && tokenBudget.budget > 0 && tokenBudget.spent >= tokenBudget.budget) {
+        return {
+            kind: "blocked",
+            step: makeStep("blocked", "blocked", {
+                runId: run.id,
+                taskId: selected.id,
+                phase: selected.phase,
+                reason: `token budget exhausted: ${tokenBudget.spent} recorded tokens >= budget ${tokenBudget.budget} — refusing to spawn further agents`,
+            }),
+        };
+    }
+    if (!agentConfigured) {
+        return {
+            kind: "blocked",
+            step: makeStep("blocked", "blocked", {
+                runId: run.id,
+                taskId: selected.id,
+                phase: selected.phase,
+                reason: "agent backend not configured (set CW_AGENT_COMMAND/CW_AGENT_ENDPOINT or pass --agent-command/--agent-endpoint) — refusing rather than fabricating a completion",
+            }),
+        };
+    }
+    return { kind: undefined };
+}
+exports.DEFAULT_SCHEDULING_POLICY = { maxAttempts: 3 };
+/** `retryOrPark` — adds one attempt; at `attempts >= maxAttempts` parks
+ *  with `parkedReason = "<reason> (attempt <n>/<max>)"`. */
+function retryOrPark(priorAttempts, policy, reason) {
+    const attempts = priorAttempts + 1;
+    if (attempts >= policy.maxAttempts) {
+        return { status: "parked", attempts, parkedReason: `${reason} (attempt ${attempts}/${policy.maxAttempts})` };
+    }
+    return { status: "retryable", attempts };
+}
+/** `handleHop`'s attempt-accounting rule: prior attempts = max(in-memory
+ *  count, the worker scope's persisted retryCount). */
+function priorAttempts(inMemoryAttempts, persistedRetryCount) {
+    return Math.max(inMemoryAttempts, persistedRetryCount);
+}
+// ---------------------------------------------------------------------------
+// Loop iteration bound.
+// ---------------------------------------------------------------------------
+/** `maxIterations = (plannedWorkers + maxLoopExpansion) * (maxAttempts +
+ *  1) + 5`. */
+function maxIterations(plannedWorkers, loopExpansion, policy) {
+    return (plannedWorkers + loopExpansion) * (policy.maxAttempts + 1) + 5;
+}
+/** Round width per iteration: an explicit concurrency > 1 wins; else
+ *  autoWidth for a first-runnable parallel phase. */
+function autoWidth(run) {
+    const phase = (0, dispatch_1.firstRunnablePhase)(run);
+    if (!phase || phase.mode !== "parallel")
+        return 1;
+    const cap = Math.max(1, Math.floor(run.workflow.limits?.maxConcurrentAgents || 1));
+    return Math.max(1, Math.min(cap, phase.taskIds.length));
+}
+function roundWidth(run, concurrency) {
+    return concurrency && concurrency > 1 ? concurrency : autoWidth(run);
+}
+function finalDriveStatus(inputs) {
+    if (inputs.once) {
+        if (inputs.completedWorkers === inputs.plannedWorkers && inputs.committed)
+            return "complete";
+        if (inputs.lastStepStatus === "parked" || inputs.lastStepStatus === "blocked")
+            return inputs.lastStepStatus;
+        return "in-progress";
+    }
+    if (inputs.exhaustedMaxIterations)
+        return "blocked";
+    if (inputs.parkedWorkers > 0 || inputs.lastStepStatus === "parked")
+        return "parked";
+    if (inputs.lastStepStatus === "blocked")
+        return "blocked";
+    return "complete";
+}
+// ---------------------------------------------------------------------------
+// Result cache key formulas.
+// ---------------------------------------------------------------------------
+/** Cache file path (relative to `<run.cwd>/.cw/cache/worker-results/`).
+ *  Actual path join / atomic write is shell-side. */
+function cacheFileName(taskId, digest) {
+    return `${safeFileNamePart(taskId)}-${digest.replace(/^sha256:/, "").slice(0, 32)}.md`;
+}
+/** Kept in sync with shell/fs-atomic.ts's `safeFileName` by the same
+ *  regex (this pure module cannot import the shell-side impure copy);
+ *  both are pinned by SPEC/pipeline-run.md's cache-file-path line, which
+ *  names it `safeFileName` explicitly — the charset MUST include `:` so
+ *  a task id like `golden:path` keeps its colon in the cache filename. */
+function safeFileNamePart(value) {
+    return String(value).replace(/[^a-zA-Z0-9_.:-]+/g, "_");
+}
+/** Default (no `--incremental`) cache key. `undefined` disables caching
+ *  for this call (no keyInput, empty keyValue, or an unavailable
+ *  completedResultsDigest upstream). */
+function defaultCacheKey(workflowId, taskId, keyInput, keyValue, promptDigest, completedResultsDigest) {
+    if (!keyInput || !keyValue || !keyValue.trim())
+        return undefined;
+    if (completedResultsDigest === undefined)
+        return undefined;
+    return (0, hash_1.sha256)(JSON.stringify({
+        schemaVersion: 1,
+        workflowId,
+        taskId,
+        keyInput,
+        keyValue: keyValue.trim(),
+        promptDigest,
+        completedResultsDigest,
+    }));
+}
+/** `--incremental` cache key (schemaVersion 2 — never collides with
+ *  schemaVersion 1). `undefined` disables caching (an upstream result is
+ *  unavailable). */
+function incrementalCacheKey(workflowId, taskId, promptDigest, runInputsDigest, delegationDigest, upstreamResultsDigest) {
+    if (upstreamResultsDigest === undefined)
+        return undefined;
+    return (0, hash_1.sha256)((0, hash_1.stableStringify)({
+        schemaVersion: 2,
+        workflowId,
+        taskId,
+        promptDigest,
+        runInputsDigest,
+        delegationDigest,
+        upstreamResultsDigest,
+    }));
+}
+/** The delegation digest folded into the incremental cache key. */
+function incrementalDelegationDigest(model, agentType, sandboxProfileId, command, strippedArgs, endpoint) {
+    return (0, hash_1.sha256)((0, hash_1.stableStringify)({
+        model,
+        agentType,
+        sandboxProfileId,
+        command,
+        args: strippedArgs,
+        endpoint,
+    }));
+}

package/dist/core/pipeline/error-feedback.js

@@ -0,0 +1,161 @@
+"use strict";
+// core/pipeline/error-feedback.ts — classifyFeedback, recordFeedback's
+// decision half, dedup key.
+//
+// MILESTONE 6+7 (combined). Byte-exact port of the DECISION half of the
+// old build's src/error-feedback.ts (record shape, classification,
+// severity, dedup key, id formatting). The disk write (feedback/*.json +
+// index.json + saveCheckpoint) is the caller's job (shell/), since this
+// file stays pure per the core/shell split.
+//
+// Evidence: SPEC/pipeline-run.md "Error feedback — src/error-feedback.ts".
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ERROR_FEEDBACK_SCHEMA_VERSION = void 0;
+exports.classifyFeedback = classifyFeedback;
+exports.feedbackKey = feedbackKey;
+exports.formatFeedbackId = formatFeedbackId;
+exports.findExistingFeedback = findExistingFeedback;
+exports.buildFeedbackRecord = buildFeedbackRecord;
+exports.summarizeFeedback = summarizeFeedback;
+exports.ERROR_FEEDBACK_SCHEMA_VERSION = 1;
+function normalizeError(error, now) {
+    if (typeof error === "string") {
+        return { code: "runtime-error", message: error, at: now };
+    }
+    if (error instanceof Error) {
+        return { code: codeFromError(error), message: error.message, at: now };
+    }
+    return { ...error, code: error.code || "runtime-error", message: error.message || "Unknown error", at: error.at || now };
+}
+function codeFromError(error) {
+    if (/Invalid cw:result JSON/i.test(error.message))
+        return "result-parse-error";
+    if (/requires cw:result evidence/i.test(error.message))
+        return "missing-required-evidence";
+    if (/requires evidence/i.test(error.message))
+        return "missing-required-evidence";
+    if (/Phase gate blocked/i.test(error.message))
+        return "phase-gate-blocked";
+    return "runtime-error";
+}
+/** classifyFeedback — fixed order, byte-exact to the old build. */
+function classifyFeedback(error, context = {}, now = new Date(0).toISOString()) {
+    const normalized = normalizeError(error, now);
+    const code = normalized.code.toLowerCase();
+    if (code.includes("missing-artifact") || code.includes("artifact-path"))
+        return "missing-artifact";
+    if (code.includes("missing-required-evidence") || code.includes("missing-evidence"))
+        return "missing-evidence";
+    if (code.includes("verifier") || context.stageId === "verify" || context.source === "verifier")
+        return "verifier-failure";
+    if (code.includes("illegal-transition") || code.includes("state-transition"))
+        return "state-transition";
+    if (code.includes("contract") || code.includes("unexpected-node") || context.contractId)
+        return "contract-violation";
+    if (code.startsWith("sandbox-"))
+        return "sandbox-policy";
+    if (code.includes("parse") || code.includes("json"))
+        return "parse-error";
+    if (code.includes("pipeline"))
+        return "pipeline-failure";
+    if (normalized.code === "runtime-error")
+        return "runtime-error";
+    return "unknown";
+}
+function severityFor(classification, error) {
+    if (classification === "verifier-failure" || classification === "contract-violation")
+        return "high";
+    if (classification === "sandbox-policy")
+        return "medium";
+    if (classification === "state-transition" || classification === "missing-evidence")
+        return "medium";
+    if (classification === "missing-artifact" || classification === "parse-error" || classification === "pipeline-failure") {
+        return error.retryable ? "medium" : "low";
+    }
+    return "low";
+}
+function sourceFor(classification) {
+    if (classification === "contract-violation")
+        return "contract";
+    if (classification === "verifier-failure" || classification === "missing-evidence")
+        return "verifier";
+    if (classification === "pipeline-failure")
+        return "pipeline-runner";
+    if (classification === "sandbox-policy")
+        return "contract";
+    return "manual";
+}
+/** Feedback dedup key: joined with `` (runId, code, message, nodeId,
+ *  stageId, contractId, path). */
+function feedbackKey(value) {
+    return [value.runId || "", value.code || "", value.message || "", value.nodeId || "", value.stageId || "", value.contractId || "", value.path || ""].join("");
+}
+function compactMetadata(metadata) {
+    const compacted = {};
+    for (const [key, value] of Object.entries(metadata))
+        if (value !== undefined)
+            compacted[key] = value;
+    return Object.keys(compacted).length ? compacted : undefined;
+}
+/** Deterministic feedback id: position in the run's append-only feedback
+ *  log (1-based), qualified by classification. */
+function formatFeedbackId(classification, seq) {
+    return `feedback-${classification}-${String(seq).padStart(4, "0")}`;
+}
+/** Find an existing UNRESOLVED record matching the same
+ *  {code,message,nodeId,stageId,contractId,path} — recordFeedback's dedup
+ *  rule. */
+function findExistingFeedback(existing, error, nodeId, stageId, contractId, path) {
+    return existing.find((record) => record.status !== "resolved" &&
+        record.code === error.code &&
+        record.message === error.message &&
+        record.nodeId === nodeId &&
+        record.stageId === stageId &&
+        record.contractId === contractId &&
+        record.path === path);
+}
+/** Build a new (not-yet-persisted) feedback record. `existingCount` is
+ *  `(run.feedback || []).length` BEFORE this record is appended. */
+function buildFeedbackRecord(runId, input, existingCount, now) {
+    const error = normalizeError(input.error, now);
+    const nodeId = input.nodeId || error.nodeId;
+    const classification = classifyFeedback(error, { source: input.source, stageId: input.stageId, contractId: input.contractId, metadata: input.metadata }, now);
+    return {
+        schemaVersion: exports.ERROR_FEEDBACK_SCHEMA_VERSION,
+        id: formatFeedbackId(classification, existingCount + 1),
+        runId,
+        createdAt: now,
+        updatedAt: now,
+        status: "open",
+        severity: severityFor(classification, error),
+        classification,
+        source: input.source || sourceFor(classification),
+        code: error.code,
+        message: error.message,
+        nodeId,
+        stageId: input.stageId,
+        contractId: input.contractId,
+        taskId: input.taskId,
+        path: input.path || error.path,
+        retryable: input.retryable ?? error.retryable ?? false,
+        evidence: input.evidence || [],
+        artifacts: input.artifacts || [],
+        metadata: compactMetadata({ ...input.metadata, details: input.metadata?.details || error.details }),
+    };
+}
+function summarizeFeedback(records) {
+    return {
+        total: records.length,
+        byStatus: countBy(records, (r) => r.status),
+        bySeverity: countBy(records, (r) => r.severity),
+        byClassification: countBy(records, (r) => r.classification),
+    };
+}
+function countBy(values, key) {
+    const counts = {};
+    for (const value of values) {
+        const bucket = key(value);
+        counts[bucket] = (counts[bucket] || 0) + 1;
+    }
+    return counts;
+}

package/dist/core/pipeline/loop-expansion.js

@@ -0,0 +1,124 @@
+"use strict";
+// core/pipeline/loop-expansion.ts — predicate registry, maxLoopExpansion,
+// maybeExpandLoop's decision half (round clone, stop reasons).
+//
+// MILESTONE 6+7 (combined). Byte-exact port of the old build's
+// src/loop-expansion.ts (predicate registry + maxLoopExpansion are
+// already pure there) plus the DECISION half of
+// src/orchestrator/lifecycle-operations.ts's maybeExpandLoop (materializing
+// the cloned phase/tasks + loop-control node is the caller's job in
+// shell/, since it needs writeTaskFiles + the plan pipeline stage).
+//
+// Evidence: SPEC/pipeline-run.md "loop() expansion — src/loop-
+// expansion.ts + maybeExpandLoop".
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerLoopPredicate = registerLoopPredicate;
+exports.getLoopPredicate = getLoopPredicate;
+exports.hasLoopPredicate = hasLoopPredicate;
+exports.maxLoopExpansion = maxLoopExpansion;
+exports.evaluateLoopStop = evaluateLoopStop;
+exports.cloneLoopRoundTasks = cloneLoopRoundTasks;
+exports.loopControlNodeId = loopControlNodeId;
+const REGISTRY = new Map();
+function registerLoopPredicate(name, fn) {
+    REGISTRY.set(name, fn);
+}
+function getLoopPredicate(name) {
+    return REGISTRY.get(name);
+}
+function hasLoopPredicate(name) {
+    return REGISTRY.has(name);
+}
+registerLoopPredicate("no-new-findings", (ctx) => {
+    const empty = ctx.roundResults.every((r) => !r || !Array.isArray(r.findings) || r.findings.length === 0);
+    return empty
+        ? { done: true, reason: "no-new-findings: the latest round produced no findings" }
+        : { done: false, reason: "no-new-findings: the latest round still has findings" };
+});
+registerLoopPredicate("single-round", () => ({ done: true, reason: "single-round: stop after one round" }));
+/** Static worst-case number of EXTRA tasks a fully-expanded run could
+ *  mint, derived purely from the workflow declaration. Zero with no loop
+ *  phases. */
+function maxLoopExpansion(run) {
+    let extra = 0;
+    for (const phase of run.phases) {
+        const loop = phase.loop;
+        if (loop && typeof loop.maxRounds === "number" && loop.maxRounds > 1) {
+            extra += (loop.maxRounds - 1) * phase.taskIds.length;
+        }
+    }
+    return extra;
+}
+/** Decide whether a just-completed loop round should stop, given the
+ *  origin phase's loop spec and the round's recorded results. Pure —
+ *  `until:{kind:"predicate"}` looks up the registry; an unregistered ref
+ *  stops fail-closed (never throws). */
+function evaluateLoopStop(origin, round, ctx) {
+    const loop = origin.loop;
+    if (!loop)
+        return { done: true, atCap: false, reason: "no loop spec" };
+    const maxRounds = loop.maxRounds;
+    let decision;
+    if (loop.until.kind === "budget-target") {
+        const target = loop.until.target || 0;
+        const spent = ctx.usageTotals.totalTokens;
+        decision = spent >= target
+            ? { done: true, reason: `budget-target: ${spent}/${target} recorded tokens` }
+            : { done: false, reason: `budget-target: ${spent}/${target} recorded tokens` };
+    }
+    else {
+        const ref = loop.until.ref || "";
+        const predicate = getLoopPredicate(ref);
+        decision = predicate ? predicate(ctx) : { done: true, reason: `loop predicate "${ref}" not registered — stopping fail-closed` };
+    }
+    const atCap = round >= maxRounds;
+    return { done: decision.done || atCap, atCap, reason: decision.reason };
+}
+/** Clone round-1 template tasks into `<base-id>@r<nextRound>` for a fresh
+ *  phase `id: <origin-id>@r<nextRound>`, `name: <origin name> (round
+ *  <n>)`. Pure data transform; the caller writes task files + runs the
+ *  plan pipeline stage per new task. */
+function cloneLoopRoundTasks(origin, templateTasks, nextRound) {
+    // Round-suffix strips any prior @rN so round 3 clones round 1's base id,
+    // never round 2's suffixed id — byte-exact to the old build's
+    // `t.id.replace(/@r\d+$/, "")` in maybeExpandLoop.
+    const suffix = `@r${nextRound}`;
+    const nextPhaseName = `${origin.name} (round ${nextRound})`;
+    const tasks = templateTasks.map((task) => ({
+        ...task,
+        id: `${task.id.replace(/@r\d+$/, "")}${suffix}`,
+        // The cloned tasks belong to the NEW round phase, not round 1 — the old
+        // build set `phase: nextPhaseName` on every cloned task so progress views
+        // and previousPhaseResultsDigest resolve to the right phase.
+        phase: nextPhaseName,
+        status: "pending",
+        loopStage: "interpret",
+        loopRound: nextRound,
+        dispatchId: undefined,
+        dispatchedAt: undefined,
+        startedAt: undefined,
+        completedAt: undefined,
+        result: undefined,
+        stateNodeId: undefined,
+        resultNodeId: undefined,
+        verifierNodeId: undefined,
+        workerId: undefined,
+        workerManifestPath: undefined,
+        taskPath: "",
+        resultPath: "",
+    }));
+    const phase = {
+        id: `${origin.id}${suffix}`,
+        name: nextPhaseName,
+        status: "pending",
+        taskIds: tasks.map((t) => t.id),
+        ...(origin.mode ? { mode: origin.mode } : {}),
+        loopOrigin: origin.id,
+        loopRound: nextRound,
+    };
+    return { phase, tasks };
+}
+/** Loop-control node id: `<run-id>:loop-control:<origin-phase-id>:r<round>`. */
+function loopControlNodeId(runId, originPhaseId, round) {
+    return `${runId}:loop-control:${originPhaseId}:r${round}`;
+}

package/dist/{result-normalize.js → core/pipeline/result-normalize.js}

@@ -1,10 +1,16 @@
 "use strict";
+// core/pipeline/result-normalize.ts — normalizeResultEnvelope,
+// isEmptyCapture.
+//
+// MILESTONE 6+7 (combined). Byte-exact port of the old build's
+// src/result-normalize.ts. Pure (no fs/clock/random).
+//
+// Evidence: SPEC/pipeline-run.md "Result ingest — src/result-normalize.ts".
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeResultEnvelope = normalizeResultEnvelope;
 exports.firstNonEmptyLine = firstNonEmptyLine;
 exports.isEmptyCapture = isEmptyCapture;
-const evidence_grounding_1 = require("./evidence-grounding");
-// Alternative keys a capable model naturally uses for the findings array.
+const evidence_grounding_1 = require("../trust/evidence-grounding");
 const FINDING_ARRAY_KEYS = [
     "findings",
     "candidate_risks",
@@ -16,22 +22,15 @@ const FINDING_ARRAY_KEYS = [
     "topRisks",
     "issues",
     "problems",
-    "concerns"
+    "concerns",
 ];
-// Per-finding keys that may carry evidence locators.
 const FINDING_EVIDENCE_KEYS = ["evidence", "evidence_paths", "evidencePaths", "locators", "refs", "files", "location", "locations", "path", "paths", "line", "lines", "where"];
 const CLASSIFICATIONS = new Set(["real", "conditional", "non-issue", "unknown"]);
-// Evidence caps (v0.1.42): the v0.1.41 experiment hit a single flat cap of 64 on
-// the top-level union, silently dropping locators on richly-cited workers. The
-// top-level array now holds the whole run's harvested locators (high cap), while
-// each finding keeps a focused, readable set.
 const TOP_LEVEL_EVIDENCE_CAP = 256;
 const PER_FINDING_EVIDENCE_CAP = 32;
 function normalizeResultEnvelope(markdown) {
     const match = markdown.match(/```cw:result\s*([\s\S]*?)```/);
     if (!match) {
-        // No fence: still DERIVE grounded evidence from the prose so a fence-less but
-        // well-cited report is not silently captured as empty.
         return { summary: firstNonEmptyLine(markdown), findings: [], evidence: harvestGrounded([markdown], TOP_LEVEL_EVIDENCE_CAP) };
     }
     let parsed;
@@ -43,27 +42,17 @@ function normalizeResultEnvelope(markdown) {
         throw new Error(`Invalid cw:result JSON: ${message}`);
     }
     const summary = pickString(parsed, ["summary", "short_answer", "shortAnswer", "verdict", "answer", "conclusion"]) || firstNonEmptyLine(markdown);
-    // Findings: prefer the canonical `findings` array, else the first present
-    // alternative array. EVERY finding is then normalized (id guaranteed, severity/
-    // classification coerced, evidence derived) so a capable agent that omits an `id`
-    // or uses `high`/`candidate_risks` is captured rather than fail-closed-rejected.
     const canonicalFindings = Array.isArray(parsed.findings) ? parsed.findings : undefined;
     const rawFindings = (canonicalFindings && canonicalFindings.length ? canonicalFindings : extractFindingsRaw(parsed)) ?? [];
     const findings = rawFindings.map((item, index) => normalizeFinding(item, index));
-    // Evidence: canonical non-empty wins; else CW derives grounded locators itself
-    // from the entire envelope JSON, the findings, and the prose.
     const canonicalEvidence = Array.isArray(parsed.evidence) ? parsed.evidence : undefined;
-    const evidence = canonicalEvidence && canonicalEvidence.length
-        ? canonicalEvidence
-        : harvestGrounded([parsed, findings, stripFence(markdown)], TOP_LEVEL_EVIDENCE_CAP);
+    const evidence = canonicalEvidence && canonicalEvidence.length ? canonicalEvidence : harvestGrounded([parsed, findings, stripFence(markdown)], TOP_LEVEL_EVIDENCE_CAP);
     return { summary, findings, evidence };
 }
-/** The first recognized alternative findings array (raw items, normalized by the
- *  caller). Returns undefined when no alternative findings source is present. */
 function extractFindingsRaw(parsed) {
     for (const key of FINDING_ARRAY_KEYS) {
         if (key === "findings")
-            continue; // canonical handled by the caller
+            continue;
         const raw = parsed[key];
         if (Array.isArray(raw) && raw.length)
             return raw;
@@ -76,19 +65,16 @@ function normalizeFinding(item, index) {
         const id = pickString(obj, ["id", "key", "name", "title"]) || `finding-${index + 1}`;
         const classification = normalizeClassification(pickString(obj, ["classification", "class", "kind", "status"]));
         const severity = normalizeSeverity(pickString(obj, ["severity", "priority", "level", "rank", "rating"]));
-        // Evidence: explicit per-finding evidence keys first, else derive grounded
-        // locators from the whole finding object (so `{title, detail, file, line}` works).
         const explicit = harvestGrounded(FINDING_EVIDENCE_KEYS.map((k) => obj[k]).filter((v) => v !== undefined), PER_FINDING_EVIDENCE_CAP);
         const evidence = explicit.length ? explicit : harvestGrounded([obj], PER_FINDING_EVIDENCE_CAP);
-        return { id, classification, severity, evidence };
+        return { id, classification: classification ?? "unknown", severity, evidence };
     }
-    // A bare string finding ("P1 — revoke stays live (app.ts:1644)").
     const text = String(item ?? "");
     return {
         id: `finding-${index + 1}`,
         classification: "unknown",
         severity: normalizeSeverity(text),
-        evidence: harvestGrounded([text], PER_FINDING_EVIDENCE_CAP)
+        evidence: harvestGrounded([text], PER_FINDING_EVIDENCE_CAP),
     };
 }
 function normalizeClassification(value) {
@@ -120,9 +106,6 @@ function normalizeSeverity(value) {
         return "P3";
     return "none";
 }
-/** Collect GROUNDED locators (path:line / URL / namespace:value) from any mix of
- *  JSON values and prose strings. This is how CW derives evidence itself instead
- *  of trusting the agent's `evidence` key. Deterministic: deduped + sorted + capped. */
 function harvestGrounded(values, cap = TOP_LEVEL_EVIDENCE_CAP) {
     const acc = [];
     for (const v of values)
@@ -136,9 +119,6 @@ function collect(value, acc) {
         return;
     if (typeof value === "string") {
         const v = value.trim();
-        // A single whitespace-free token that is itself a grounded locator is kept
-        // verbatim; anything with spaces is PROSE — extract the locator tokens from it
-        // (a sentence containing a "/" must not be captured whole as one "locator").
         if (v && !/\s/.test(v) && (0, evidence_grounding_1.isGroundedEvidence)(v))
             acc.push(v);
         else
@@ -156,8 +136,6 @@ function collect(value, acc) {
             collect(item, acc);
     }
 }
-// Pull file:line / file.ext / URL / `backtick` tokens out of a prose string, then
-// keep only the grounded ones. Backtick spans are a strong signal for code refs.
 const LOCATOR_RE = /`([^`]+)`|([A-Za-z0-9_@./-]+\.[A-Za-z]{1,8}(?::\d+(?:-\d+)?)?)|(https?:\/\/[^\s)]+)/g;
 function locatorsFromText(text) {
     const out = [];
@@ -187,8 +165,7 @@ function firstNonEmptyLine(markdown) {
         .map((line) => line.trim())
         .find((line) => line && !line.startsWith("#") && !line.startsWith("```")) || "");
 }
-/** True when an accepted result captured no structured signal at all. Drives the
- *  "warn, don't silently pass" surface in the record paths. */
+/** True when an accepted result captured no structured signal at all. */
 function isEmptyCapture(envelope) {
     return (envelope.findings?.length || 0) === 0 && (envelope.evidence?.length || 0) === 0;
 }