create-agdf 0.20.2 → 0.31.0

package/generated/plugins/agdf/runtime/create-agdf/runtime/core/lib/control-state/run-recovery.js

@@ -1,296 +0,0 @@
-import { assertRecoveryOperationsTrusted } from "./run-state-writer.js";
-import { createHash, randomUUID } from "node:crypto";
-import {
-  closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, writeFileSync, fsyncSync,
-} from "node:fs";
-import { dirname, join } from "node:path";
-import { transitionDecisionForRunState } from "../control-evaluation/gate-policy.js";
-import { prepareRunContentState, userGateOrder } from "../control-evaluation/run-state.js";
-import { containedRegularFile, hasSymlinkComponent } from "./contained-file.js";
-import { duplicateArtefactRowTypes, parseControlState, parseRunState, scalarFields, sectionTableRows } from "./run-state-parser.js";
-import { applyRunSeals, artefactFileDigest, canonicalRunText, computeRunSeals, listedArtefactPaths, pendingArtefactPaths, runSealState } from "./run-seal.js";
-import { runPath } from "./run-state-reader.js";
-import { atomicWrite, recoveryRunContent, unapproveRecoveryApprovals, withRunLock, writeRunRecoveryLocked } from "./run-state-writer.js";
-
-const sha256 = (value) => `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
-const digestContent = (content) => sha256(canonicalRunText(content));
-function recoveryPreviewDigest(preview) {
-  const bound = {
-    schema_version: preview.schema_version, preview_id: preview.preview_id, run_id: preview.run_id,
-    source_revision_id: preview.source_revision_id, source_content_digest: preview.source_content_digest,
-    source_content: preview.source_content, source_artefacts: preview.source_artefacts,
-    git_history: preview.git_history, prior_approvals: preview.prior_approvals,
-    approval_provenance: preview.approval_provenance, approvals_to_invalidate: preview.approvals_to_invalidate,
-    next_gate: preview.next_gate, next_revision_id: preview.next_revision_id,
-    candidate_content: preview.candidate_content, candidate_digest: preview.candidate_digest,
-  };
-  // Version 1 journals did not bind the activity timestamp. Keep their stored digest readable;
-  // new previews bind the timestamp used by both the expected state and the atomic writer.
-  if (preview.preview_format_version === 2) {
-    bound.preview_format_version = 2;
-    bound.created_at = preview.created_at;
-  }
-  return sha256(JSON.stringify(bound));
-}
-
-const PREVIEW_CONFIRMATION = (runId, previewId, digest) => `RECOVER ${runId} ${previewId} ${digest}`;
-
-// Read-only proof of the former self-reference hashing defect. This does not accept arbitrary
-// changed seals: the complete current record must equal the validated journal's old writer result.
-export function inspectSelfReferenceRecovery(root, runId) {
-  const { path, runDir } = safeRunFiles(root, runId);
-  const content = readFileSync(path, "utf8");
-  const parsed = parseRunState(content, runId);
-  const selfPath = `.agdf/control/runs/${runId}/RUN_STATE.md`;
-  if (!parsed.valid || parsed.meta.lifecycle !== "active" || runSealState(root, content).status !== "content_changed"
-      || !listedArtefactPaths(content).includes(selfPath)) return null;
-  const directory = join(runDir, "recovery-previews");
-  if (!existsSync(directory)) return null;
-  const stat = lstatSync(directory);
-  if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error("AGDF_RUN_PATH_INVALID");
-  for (const name of readdirSync(directory).filter((value) => /^[0-9a-f-]{36}\.json$/iu.test(value))) {
-    try {
-      const { preview } = readPreview(root, runDir, runId, name.slice(0, -5));
-      if (preview.phase !== "committed" || preview.preview_format_version !== 2
-          || preview.result_digest !== digestContent(content) || preview.result_revision_id !== parsed.meta.revision_id
-          || preview.next_revision_id !== parsed.meta.revision_id) continue;
-      const currentArtefacts = artifactSnapshot(root, content).filter((entry) => entry.path !== selfPath);
-      if (JSON.stringify(currentArtefacts) !== JSON.stringify(preview.source_artefacts.filter((entry) => entry.path !== selfPath))) continue;
-      const source = parseRunState(preview.source_content, runId);
-      const restored = recoveryRunContent(root, preview.candidate_content, {
-        revision: source.meta.revision, nextRevisionId: preview.next_revision_id, updatedAt: preview.created_at,
-      });
-      const legacy = applyRunSeals(restored, computeRunSeals(root, restored, { selfReferenceDigest: preview.source_content_digest }));
-      if (legacy !== content || runSealState(root, restored).status !== "valid") continue;
-      return { source: `recovery-previews/${name}`, source_revision_id: parsed.meta.revision_id, content: restored };
-    } catch { /* A damaged checkpoint cannot prove an original. */ }
-  }
-  return null;
-}
-
-function gitHistoryCandidates(root, runId, readGitHistory) {
-  if (typeof readGitHistory !== "function") return { status: "unavailable", candidates: [] };
-  const relativePath = `.agdf/control/runs/${runId}/RUN_STATE.md`;
-  let entries;
-  try { entries = readGitHistory(root, relativePath); } catch { return { status: "unavailable", candidates: [] }; }
-  if (!Array.isArray(entries) || entries.length > 25) return { status: "unavailable", candidates: [] };
-  const candidates = [];
-  for (const entry of entries) {
-    if (!entry || entry.path !== relativePath || !/^[0-9a-f]{40,64}$/u.test(entry.commit) || typeof entry.content !== "string" || Buffer.byteLength(entry.content) > 1024 * 1024) continue;
-    const parsed = parseRunState(entry.content, runId);
-    if (!parsed.valid) continue;
-    const meta = scalarFields(entry.content).values;
-    const sealPattern = /^sha256:[0-9a-f]{64}$/u;
-    candidates.push({ commit: entry.commit, revision_id: parsed.meta.revision_id, content_digest: digestContent(entry.content),
-      seal_lines_present: sealPattern.test(meta.get("content_seal") ?? "") && sealPattern.test(meta.get("approval_seal") ?? ""), approval_provenance: "not_proven_by_git_revision" });
-  }
-  return { status: "available", candidates };
-}
-
-function safeRunFiles(root, runId) {
-  const path = runPath(root, runId);
-  const runDir = dirname(path);
-  let rootStat;
-  try { rootStat = lstatSync(root); } catch { throw new Error("AGDF_RUN_PATH_INVALID"); }
-  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) throw new Error("AGDF_RUN_PATH_INVALID");
-  for (const target of [join(root, ".agdf"), join(root, ".agdf", "control"), join(root, ".agdf", "control", "runs"), runDir, path]) {
-    let stat;
-    try { stat = lstatSync(target); } catch { throw new Error("AGDF_RUN_PATH_INVALID"); }
-    if (stat.isSymbolicLink() || (target === path ? !stat.isFile() : !stat.isDirectory())) throw new Error("AGDF_RUN_PATH_INVALID");
-  }
-  return { path, runDir };
-}
-
-function artifactSnapshot(root, content) {
-  const paths = listedArtefactPaths(content);
-  const pending = new Set(pendingArtefactPaths(content));
-  const entries = paths.map((path) => {
-    const resolved = containedRegularFile(root, path);
-    const status = hasSymlinkComponent(root, path) ? "invalid" : resolved.status;
-    return { path, status, digest: status === "valid" ? artefactFileDigest(root, path) : status,
-      ...(status === "missing" && pending.has(path) ? { planned: true } : {}) };
-  });
-  return entries;
-}
-
-function approvalSnapshot(content) {
-  return ["Approvals", "Gate Checklist"].flatMap((section) => sectionTableRows(content, section)
-    .filter(([gate]) => userGateOrder.includes(gate))
-    .map(([gate, status = "", evidence = ""]) => ({ section, gate, status: status.replace(/^`|`$/gu, "").trim(), evidence: evidence.trim() })));
-}
-
-function deriveNextGate(root, content, path) {
-  const state = prepareRunContentState(root, content, path);
-  return transitionDecisionForRunState(state).current_gate;
-}
-
-export function inspectRunRecovery(root, runId, { inspectHistory = true, readGitHistory } = {}) {
-  const { path } = safeRunFiles(root, runId);
-  const content = readFileSync(path, "utf8");
-  const state = parseRunState(content, runId);
-  if (!state.valid) throw new Error("AGDF_RUN_STATE_INVALID");
-  if (state.meta.lifecycle !== "active") throw new Error("AGDF_RECOVERY_LIFECYCLE_UNSUPPORTED");
-  if (duplicateArtefactRowTypes(content).length) throw new Error("AGDF_ARTEFACT_ROW_DUPLICATE");
-  const seal = runSealState(root, content);
-  assertRecoveryOperationsTrusted(content);
-  if (!["unsealed", "invalid"].includes(seal.status)) throw new Error("AGDF_RUN_RECOVERY_NOT_REQUIRED");
-  const artefacts = artifactSnapshot(root, content);
-  const gitHistory = inspectHistory ? gitHistoryCandidates(root, runId, readGitHistory) : { status: "not_checked", candidates: [] };
-  return Object.freeze({
-    schema_version: "1", run_id: runId, revision: state.meta.revision,
-    revision_id: state.meta.revision_id, seal_status: seal.status,
-    content_digest: digestContent(content), artefacts,
-    git_history: gitHistory,
-    approvals: approvalSnapshot(content), approval_provenance: "no_independent_provenance",
-    next_gate_if_recovered: deriveNextGate(root, unapproveRecoveryApprovals(content), path),
-  });
-}
-
-function previewDirectory(runDir) {
-  const path = join(runDir, "recovery-previews");
-  try { mkdirSync(path, { mode: 0o700 }); } catch (error) { if (error.code !== "EEXIST") throw error; }
-  const stat = lstatSync(path);
-  if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error("AGDF_RUN_PATH_INVALID");
-  if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) throw new Error("AGDF_RECOVERY_JOURNAL_PERMISSIONS_INVALID");
-  return path;
-}
-
-function createJournal(path, record) {
-  let fd;
-  try {
-    fd = openSync(path, "wx", 0o600);
-    writeFileSync(fd, `${JSON.stringify(record, null, 2)}\n`, "utf8");
-    fsyncSync(fd);
-  } finally {
-    if (fd !== undefined) closeSync(fd);
-  }
-}
-
-export function previewRunRecovery(root, runId, options = {}) {
-  const inspection = inspectRunRecovery(root, runId, options);
-  if (inspection.artefacts.some((entry) => entry.status !== "valid" && !entry.planned)) {
-    throw new Error(inspection.artefacts.some((entry) => entry.status === "invalid")
-      ? "AGDF_RECOVERY_ARTEFACT_PATH_INVALID" : "AGDF_RECOVERY_ARTEFACT_MISSING");
-  }
-  const { path, runDir } = safeRunFiles(root, runId);
-  const source = readFileSync(path, "utf8");
-  if (digestContent(source) !== inspection.content_digest) throw new Error("AGDF_STALE_RUN_REVISION");
-  if (JSON.stringify(artifactSnapshot(root, source)) !== JSON.stringify(inspection.artefacts)) throw new Error("AGDF_STALE_RUN_REVISION");
-  const previewId = randomUUID();
-  const nextRevisionId = randomUUID();
-  const candidate = unapproveRecoveryApprovals(source);
-  const preview = {
-    schema_version: "1", preview_format_version: 2, preview_id: previewId, run_id: runId,
-    created_at: new Date().toISOString(),
-    source_revision_id: inspection.revision_id, source_content_digest: inspection.content_digest,
-    source_content: source,
-    source_artefacts: inspection.artefacts, git_history: inspection.git_history,
-    prior_approvals: inspection.approvals,
-    approval_provenance: "no_independent_provenance", approvals_to_invalidate: userGateOrder,
-    next_gate: inspection.next_gate_if_recovered, next_revision_id: nextRevisionId,
-    candidate_content: candidate, candidate_digest: digestContent(candidate),
-    phase: "prepared",
-  };
-  preview.preview_digest = recoveryPreviewDigest(preview);
-  preview.confirmation = PREVIEW_CONFIRMATION(runId, previewId, preview.preview_digest);
-  const dir = previewDirectory(runDir);
-  const journalPath = join(dir, `${previewId}.json`);
-  createJournal(journalPath, preview);
-  return Object.freeze({
-    schema_version: "1", outcome: "previewed", run_id: runId, preview_id: previewId,
-    confirmation: preview.confirmation, source_content_digest: preview.source_content_digest,
-    source_artefacts: preview.source_artefacts, git_history: preview.git_history,
-    approvals_to_invalidate: preview.approvals_to_invalidate,
-    approval_provenance: preview.approval_provenance, next_gate: preview.next_gate,
-    journal: journalPath.slice(root.length + 1),
-  });
-}
-
-function readPreview(root, runDir, runId, previewId) {
-  if (!/^[0-9a-f-]{36}$/iu.test(previewId)) throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-  const dir = join(runDir, "recovery-previews");
-  const dirStat = lstatSync(dir);
-  if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) throw new Error("AGDF_RUN_PATH_INVALID");
-  const path = join(dir, `${previewId}.json`);
-  const fileStat = lstatSync(path);
-  if (fileStat.isSymbolicLink() || !fileStat.isFile()) throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-  const preview = JSON.parse(readFileSync(path, "utf8"));
-  if (preview.preview_format_version !== undefined && preview.preview_format_version !== 2) {
-    throw new Error("AGDF_RECOVERY_PREVIEW_VERSION_UNSUPPORTED");
-  }
-  if (preview.schema_version !== "1" || preview.preview_id !== previewId || preview.run_id !== runId
-      || preview.preview_digest !== recoveryPreviewDigest(preview)
-      || preview.confirmation !== PREVIEW_CONFIRMATION(runId, previewId, preview.preview_digest)
-      || preview.source_content_digest !== digestContent(preview.source_content)
-      || preview.candidate_digest !== digestContent(unapproveRecoveryApprovals(preview.source_content))
-      || preview.candidate_content !== unapproveRecoveryApprovals(preview.source_content)
-      || JSON.stringify(preview.prior_approvals) !== JSON.stringify(approvalSnapshot(preview.source_content))) {
-    throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-  }
-  return { path, preview };
-}
-
-export function applyRunRecovery(root, { runId, previewId, confirmation }, hooks = {}) {
-  if (typeof confirmation !== "string") throw new Error("AGDF_RECOVERY_CONFIRMATION_REQUIRED");
-  const { path, runDir } = safeRunFiles(root, runId);
-  const { path: journalPath, preview } = readPreview(root, runDir, runId, previewId);
-  if (confirmation !== preview.confirmation) throw new Error("AGDF_RECOVERY_CONFIRMATION_REQUIRED");
-  return withRunLock(path, () => {
-    const lockedPreview = readPreview(root, runDir, runId, previewId).preview;
-    if (lockedPreview.preview_digest !== preview.preview_digest || lockedPreview.confirmation !== confirmation) {
-      throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-    }
-    Object.assign(preview, lockedPreview);
-    const current = readFileSync(path, "utf8");
-    const currentDigest = digestContent(current);
-    if (JSON.stringify(artifactSnapshot(root, current)) !== JSON.stringify(preview.source_artefacts)) {
-      throw new Error("AGDF_STALE_RUN_REVISION");
-    }
-    if (preview.phase === "committed") {
-      const committed = parseRunState(current, runId);
-      if (currentDigest !== preview.result_digest || runSealState(root, current).status !== "valid"
-          || !committed.valid || committed.meta.revision_id !== preview.next_revision_id
-          || preview.result_revision_id !== preview.next_revision_id) throw new Error("AGDF_RECOVERY_JOURNAL_CONFLICT");
-      return Object.freeze({ schema_version: "1", outcome: "already_recovered", run_id: runId, preview_id: previewId, revision_id: preview.result_revision_id,
-        backlog: "pending", backlog_reason: "run_only_recovery",
-        backlog_next_action: `Synchronize this Run with run-update --run ${runId} --revision ${preview.result_revision_id}.` });
-    }
-    if (preview.phase !== "prepared" && preview.phase !== "applying") throw new Error("AGDF_RECOVERY_JOURNAL_PHASE_INVALID");
-    if (preview.phase === "prepared" && (currentDigest !== preview.source_content_digest
-        || current !== preview.source_content || JSON.stringify(artifactSnapshot(root, current)) !== JSON.stringify(preview.source_artefacts))) {
-      throw new Error("AGDF_STALE_RUN_REVISION");
-    }
-    const parsedSource = parseRunState(preview.source_content, runId);
-    if (!parsedSource.valid || parsedSource.meta.revision_id !== preview.source_revision_id) throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-    const expectedResultContent = recoveryRunContent(root, preview.candidate_content, {
-      revision: parsedSource.meta.revision, nextRevisionId: preview.next_revision_id, updatedAt: preview.created_at,
-    });
-    const expectedResultDigest = digestContent(expectedResultContent);
-    let written;
-    if (preview.phase === "applying" && currentDigest === preview.result_digest
-        && currentDigest === expectedResultDigest && runSealState(root, current).status === "valid") {
-      written = parseRunState(current, runId);
-    } else {
-      if (preview.phase === "applying" && currentDigest !== preview.source_content_digest) throw new Error("AGDF_RECOVERY_JOURNAL_CONFLICT");
-      const applying = { ...preview, phase: "applying", source_content: current,
-        result_digest: expectedResultDigest, result_revision_id: preview.next_revision_id };
-      atomicWrite(journalPath, `${JSON.stringify(applying, null, 2)}\n`);
-      hooks.beforeRunWrite?.();
-      written = writeRunRecoveryLocked(path, preview.candidate_content, {
-        expectedContent: current, expectedRevisionId: preview.source_revision_id,
-        nextRevisionId: preview.next_revision_id,
-        updatedAt: preview.created_at,
-      });
-      hooks.afterRunWrite?.();
-    }
-    const resultContent = readFileSync(path, "utf8");
-    const completed = { ...preview, phase: "committed", result_digest: digestContent(resultContent), result_revision_id: written.meta.revision_id };
-    hooks.beforeJournalCommit?.();
-    atomicWrite(journalPath, `${JSON.stringify(completed, null, 2)}\n`);
-    return Object.freeze({ schema_version: "1", outcome: "recovered", run_id: runId,
-      backlog: "pending", backlog_reason: "run_only_recovery",
-      backlog_next_action: `Synchronize this Run with run-update --run ${runId} --revision ${written.meta.revision_id}.`,
-      preview_id: previewId, revision: written.meta.revision, revision_id: written.meta.revision_id,
-      seal_status: runSealState(root, resultContent).status, next_gate: deriveNextGate(root, resultContent, path) });
-  });
-}

package/generated/plugins/agdf/runtime/create-agdf/runtime/core/lib/control-state/run-relationship-correction.js

@@ -1,74 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { canonicalJson } from "./approval-command-contract.js";
-import { readArtefactBindings } from "./artefact-bindings.js";
-import { exactApprovedArtefacts, validateBindingProof } from "./artefact-binding-proof.js";
-import { APPROVAL_GATES, runSealState } from "./run-seal.js";
-import { readRun, appendTableRow, guardedWrite, rejected } from "./run-state-edits.js";
-import { prepareRunContentState } from "../control-evaluation/run-state.js";
-import { parseControlState } from "./run-state-parser.js";
-import { runPath } from "./run-state-reader.js";
-import { flushRunCommit, withRunLock, writeRunLocked } from "./run-state-writer.js";
-import { sameRelationship } from "../control-evaluation/delivery-relationships.js";
-import { transitionDecisionForRunState } from "../control-evaluation/gate-policy.js";
-
-const controlFor = (root, run) => ({ ...prepareRunContentState(root, run.content, run.path), meta: run.meta });
-
-// Mutation owner for authorized bound continuation only. Evaluators never call it.
-export function correctRunRelationship(root, { runId, revisionId }, { evaluateGateCheck, checkpoint, confirmCommit = flushRunCommit } = {}) {
-  const locked = guardedWrite(runId, () => withRunLock(runPath(root, runId), () => {
-    const run = readRun(root, runId);
-    if (run.rejection) return run.rejection;
-    if (run.meta.revision_id !== revisionId) return rejected(runId, "stale_revision");
-    if (runSealState(root, run.content).status !== "valid") return rejected(runId, "seal_invalid");
-    const report = evaluateGateCheck(root, { runId });
-    const decisive = (report.delivery_map?.findings ?? []).filter(row => ["block", "revise"].includes(row.severity));
-    const missing = (report.delivery_map?.relationships ?? []).filter(row => row.required && row.status === "missing");
-    if (missing.length === 0 && decisive.length === 0) return { schema_version: "1", outcome: "unchanged", run_id: runId, revision_id: revisionId };
-    const unrelatedDoctor = (report.doctor_report?.findings ?? []).filter(row => ["block", "revise"].includes(row.severity)
-      && row.code !== "AGDF_DELIVERY_RELATIONSHIP_MISSING");
-    if (unrelatedDoctor.length || decisive.length !== 1 || decisive[0].code !== "AGDF_DELIVERY_RELATIONSHIP_MISSING"
-        || missing.length !== 1 || report.blocking_reason !== "AGDF_DELIVERY_RELATIONSHIP_MISSING") return rejected(runId, "correction_not_eligible");
-    const control = controlFor(root, run), expected = missing[0];
-    if (control.artefact_chain.some(row => row.from === expected.from)) return rejected(runId, "correction_not_eligible");
-    const history = readArtefactBindings(run.content);
-    const eligible = history.active.filter(receipt => receipt.run_id === runId && receipt.operation.revision <= Number(run.meta.revision)
-      && sameRelationship(receipt.relationship, expected));
-    if (!history.valid || eligible.length !== 1) return rejected(runId, "binding_proof_missing_or_ambiguous");
-    const receipt = eligible[0], destinationGate = expected.from === "QA_REPORT" ? "QA" : expected.from;
-    const destination = control.artefacts.get(destinationGate), source = control.artefacts.get(expected.to);
-    if (destination?.path !== receipt.destination.path || source?.path !== receipt.source.path
-        || !validateBindingProof(root, receipt) || !exactApprovedArtefacts(root, control)) return rejected(runId, "artefact_binding_proof_invalid");
-    const before = canonicalJson(transitionDecisionForRunState(control));
-    let next = appendTableRow(run.content, "Artefact Chain", [expected.from, expected.relationship, expected.to,
-      `binding ${receipt.binding_id}; exact sealed reviewed mapping ${receipt.review.path}`]);
-    if (!next) return rejected(runId, "run_layout_unsupported");
-    const nextRevisionId = randomUUID();
-    next = appendTableRow(next, "Evidence", ["Relationship correction", receipt.review.path,
-      `binding ${receipt.binding_id}; ${expected.from} ${expected.relationship} ${expected.to}; revision ${revisionId} -> ${nextRevisionId}`, "exact sealed reviewed mapping"]);
-    if (!next || canonicalJson(transitionDecisionForRunState(controlFor(root, { ...run, content: next }))) !== before) return rejected(runId, "correction_permission_changed");
-    let written, recoveredCommit = false;
-    try { written = writeRunLocked(run.path, next, revisionId, { expectedContent: run.content, nextRevisionId, checkpoint,
-      validateBeforeWrite: () => {
-        if (!validateBindingProof(root, receipt) || !exactApprovedArtefacts(root, control)
-            || runSealState(root, run.content).status !== "valid") throw new Error("AGDF_ARTEFACT_BINDING_PROOF_INVALID");
-      } }); }
-    catch (error) {
-      const actual = readRun(root, runId);
-      if (actual.rejection || actual.meta.revision_id !== nextRevisionId || runSealState(root, actual.content).status !== "valid") throw error;
-      // Reuse the existing owner's durability confirmation; never retry into another revision.
-      try { confirmCommit(run.path); }
-      catch {
-        const unconfirmed = new Error("AGDF_CORRECTION_COMMIT_UNCONFIRMED");
-        unconfirmed.committed_revision_id = nextRevisionId;
-        throw unconfirmed;
-      }
-      written = { meta: actual.meta }; recoveredCommit = true;
-    }
-    return { schema_version: "1", outcome: "corrected", run_id: runId, binding_id: receipt.binding_id,
-      backlog: "pending", backlog_reason: "run_only_relationship_correction",
-      backlog_next_action: `Synchronize this Run with run-update --run ${runId} --revision ${written.meta.revision_id}.`,
-      relationship: receipt.relationship, previous_revision_id: revisionId, revision_id: written.meta.revision_id, revision: written.meta.revision,
-      ...(recoveredCommit ? { recovered_commit: true } : {}) };
-  }));
-  return locked.rejection ?? locked.state;
-}

package/generated/plugins/copilot/agdf/control/templates/AGDF_RUN.md

@@ -1,139 +0,0 @@
-# AGDF Run State
-
-## Run Meta
-
-- run_id:
-- started_at:
-- mode: `quick_task | verified_change | structured_delivery`
-- current_gate: `none | UR | Brownfield Review | Mode/Slice Decision | PRD | SD | TP | Quick Task Execution | Verified Change Execution | Brownfield Analysis | CD+Tests | CR | QA | UAT | OR`
-- decision: `pass | revise | block | in_progress`
-- owner:
-
-## Objective
-
-What outcome is this run trying to make trustworthy?
-
-## Current Control State
-
-| Question | Answer |
-|---|---|
-| What is known? |  |
-| What is approved? |  |
-| What is missing? |  |
-| What is the next allowed action? |  |
-| What is explicitly forbidden right now? |  |
-
-## Source And Scope State
-
-- normative_instruction_source:
-- multi_scope_state: `clear | ambiguous | blocked`
-- active_scope_evidence:
-- competing_scope_lines:
-- branch_workspace_evidence:
-- branch_workspace_scope_effect: `supports | conflicts | insufficient | not_checked`
-
-## Run Status Card
-
-This is a compact projection of the control state. It does not replace gate-check, QA, OR or approvals.
-
-| Run status | Value |
-|---|---|
-| Status |  |
-| Current gate |  |
-| Allowed now |  |
-| Blocked by |  |
-| Missing approval |  |
-| Next step |  |
-| Quality outlook |  |
-
-## Approvals
-
-Valid approval format for new runs: `Approval: <GateName>`.
-
-| Gate | Status | Evidence |
-|---|---|---|
-| UR | `missing | approved | not_applicable` |  |
-| PRD | `missing | approved | not_applicable` |  |
-| SD | `missing | approved | not_applicable` |  |
-| TP | `missing | approved | not_applicable` |  |
-| QA | `missing | approved | not_applicable` |  |
-| UAT | `missing | approved | not_applicable` |  |
-
-## Artefacts
-
-| Type | Path | Status | Notes |
-|---|---|---|---|
-| UR |  | `draft | approved | superseded | not_applicable` |  |
-| PRD |  | `draft | approved | superseded | not_applicable` |  |
-| SD |  | `draft | approved | superseded | not_applicable` |  |
-| TP |  | `draft | approved | superseded | not_applicable` |  |
-| Brownfield Review |  | `missing | draft | done | not_applicable | superseded` |  |
-| Verified Change |  | `missing | draft | eligible | executed | escalated` |  |
-| Review |  | `missing | done | not_applicable` |  |
-| QA |  | `missing | pass | revise | block | not_applicable` |  |
-| OR |  | `missing | done | not_applicable` |  |
-
-## Mode / Slice Decision
-
-Set this after Brownfield Review. Do not assume the full gate chain before the existing-system impact is understood.
-Quick Task execution or implementation is not allowed until this decision is visible with scope reason and evidence.
-
-- decision: `undecided | quick_task | verified_change | structured_slice | structured_delivery | block`
-- required_next_gate: `none | PRD | SD | TP | Brownfield Analysis`
-- scope_reason:
-- evidence:
-- transparency_note:
-
-## Artefact Chain
-
-Keep the active work item traceable. A gate may open only when the previous gate has both exact approval and a durable or linked artefact.
-
-| From | Relationship | To | Evidence |
-|---|---|---|---|
-| UR | `approved_by` | `Approval: UR` |  |
-| PRD | `derived_from` | UR |  |
-| SD | `derived_from` | PRD |  |
-| TP | `derived_from` | SD |  |
-| QA_REPORT | `tests` | TP |  |
-
-## Evidence
-
-| Evidence | Source | Covers | Strength |
-|---|---|---|---|
-|  |  |  | `direct | indirect | weak` |
-
-## Missing Evidence
-
-| Missing evidence | Impact | Required next step |
-|---|---|---|
-|  | `warn | revise | block` |  |
-
-## Risks
-
-| Risk | Impact | Mitigation or owner |
-|---|---|---|
-|  | `warn | revise | block` |  |
-
-## Context Graph Impact
-
-- context_graph_impact: `none | link_only | update_existing_node | new_node_required | sot_drift`
-- context_graph_refs:
-- context_graph_reconciliation: `resolved | not_applicable | open_gap`
-- context_graph_required_action: `none | link | update | create | resolve_drift`
-- context_graph_gate_effect: `none | warning | revise | block`
-- context_graph_evidence:
-
-## Knowledge Persistence Decision
-
-- memory_target: `context_graph | sot_registry | scope_artifact | open_questions | none`
-- memory_reason:
-- memory_refs:
-
-## Closeout
-
-- delivered:
-- not_delivered:
-- verification_performed:
-- unverified:
-- next_allowed_action:
-- quality_outlook:

package/generated/plugins/copilot/agdf/control/templates/MASTER_BACKLOG.md

@@ -1,39 +0,0 @@
-# AGDF Master Backlog
-
-This file is the living control pointer for active AGDF delivery work. Detailed UR, Brownfield Review, PRD, SD, TP, QA and OR artefacts should live in stable paths and be linked from here.
-
-## Rules
-
-1. New product semantics, functional change or user-visible behaviour change starts as a new UR draft in a stable local artefact path, for example `.agdf/control/artefacts/<key>/UR.md`, unless an authoritative repository SoT already exists and is linked here.
-2. `Approval: UR` adds or updates exactly one steering row with a document-relative Markdown link to the UR.
-3. Brownfield Review is created for the same work item after UR approval when existing-system impact must be sized before PRD depth or Quick Task execution.
-4. PRD, SD, TP and QA report artefacts are created for the same work item after the previous gate is approved and persisted or linked.
-5. `Approval: PRD`, `Approval: SD`, `Approval: TP` and `Approval: QA` require the corresponding durable artefact or linked repository SoT before the next gate can open.
-6. Generic consent such as "ok", "go ahead", "do it", "continue", "leg los" or "approved" does not update a gate. Only `Approval: <GateName>` does.
-7. Keep only steering-relevant work in `Active Backlog`.
-8. Every active item has exactly one linked current spec and a visible linked artefact chain.
-9. Historical artefacts remain linkable but do not override the current pointer.
-10. If an item is superseded, mark the replacement.
-11. If active work grows beyond roughly ten items, triage the backlog.
-12. `Status` must be one of the human-readable labels normalized by `packages/core/lib/control-evaluation/shared.js`: Needs UR, Awaiting Brownfield Review, Awaiting PRD, Awaiting PRD Approval, Awaiting SD, Awaiting SD Approval, Awaiting TP, Awaiting TP Approval, In Progress, Blocked, Awaiting QA, Awaiting UAT, Awaiting OR, Completed, Superseded, Abandoned. Generated observations also use Work pending, Approval pending, QA report pending, QA evidence open, QA correction open, QA source decision required, QA blocked, Source unconfirmed, Closeout pending, Unconfirmed, and phase-specific Brownfield Analysis/CD+Tests/CR/Quick Task Execution/Verified Change Execution/Mode/Slice Decision work pending. The parser module is authoritative; this list only mirrors it for readability.
-13. `Artefacts` link labels must be one of the labels normalized by the same parser module: `ur`, `brownfield`, `prd`, `sd`, `tp`, `qa`, `or` (case-insensitive). Do not invent other labels such as a raw artefact filename.
-14. After writing or updating this file, run `doctor --json` (or the locally available equivalent) and resolve any `AGDF_BACKLOG_STATUS_UNKNOWN` or `AGDF_BACKLOG_ARTEFACT_LABEL_UNKNOWN` finding before treating the edit as done.
-15. A `Work item` cell may optionally start with a bracketed scope tag, one of `[framework-maintenance]` or `[external-delivery]`, so the split between AGDF's own maintenance work and external product delivery stays visible at a glance. The tag is never required retroactively on `Completed / Superseded Pointers` rows. `packages/core/lib/control-evaluation/shared.js` is authoritative for the accepted values.
-16. After writing or updating this file, also resolve any `AGDF_BACKLOG_SCOPE_LABEL_UNKNOWN` finding, which fires only for a present-but-unrecognized bracketed tag, never for an absent one.
-
-17. Core writers may place a bounded `agdf-backlog-summary-v1` comment after a complete table, separated by a blank line. It records the addressed row, target, actual Run revision, observation time and consumed source digests; it never authorizes. Preserve it with its row. Older rows remain readable without it. Invalid/foreign/ambiguous observations remain visibly unconfirmed; reading does not synchronize or scan all Runs.
-
-## Active Backlog
-
-| Priority | Key | Work item | Status | Artefacts | Current spec | Next step |
-|---:|---|---|---|---|---|---|
-
-## Planned / Parking Lot
-
-| Priority | Key | Work item | Status | Artefacts | Current spec | Next step |
-|---:|---|---|---|---|---|---|
-
-## Completed / Superseded Pointers
-
-| Key | Work item | Final status | Historical record | Outcome |
-|---|---|---|---|---|

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-maintenance/interaction.js

@@ -1,28 +0,0 @@
-import { createInterface } from "node:readline/promises";
-import process from "node:process";
-import { interactionLocales } from "#agdf-core/resources/context.js";
-import { selectControlMigration, selectControlRepair } from "#agdf-core/control-maintenance/interaction.js";
-export * from "#agdf-core/control-maintenance/interaction.js";
-export async function promptControlMigration(plan, {
-  input = process.stdin, output = process.stdout, registry = interactionLocales, language = "en",
-} = {}) {
-  const prompt = createInterface({ input, output });
-  try {
-    return await selectControlMigration(plan, { registry, language,
-      write(value) { output.write(`${value}\n`); },
-      readChoice({ prompt: question }) { return prompt.question(question); },
-    });
-  } finally { prompt.close(); }
-}
-
-export async function promptControlRepair(value, {
-  input = process.stdin, output = process.stdout, registry = interactionLocales, language = "en", phase = "offer",
-} = {}) {
-  const prompt = createInterface({ input, output });
-  try {
-    return await selectControlRepair(value, { registry, language, phase,
-      write(text) { output.write(`${text}\n`); },
-      readChoice({ prompt: question }) { return prompt.question(question); },
-    });
-  } finally { prompt.close(); }
-}

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-maintenance/repair.js

@@ -1,4 +0,0 @@
-import { inspectControlRepair as inspect, repairInstallationControl as repair } from "#agdf-core/control-maintenance/repair.js";
-import { readGitOriginals } from "../runtime/git-originals.js";
-export const inspectControlRepair = (root, options = {}) => inspect(root, { readGitOriginals, ...options });
-export const repairInstallationControl = (control, options = {}) => repair(control, { readGitOriginals, ...options });

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-maintenance/service.js

@@ -1,3 +0,0 @@
-import { runControlMaintenance as run } from "#agdf-core/control-maintenance/service.js";
-import { readGitOriginals } from "../runtime/git-originals.js";
-export const runControlMaintenance = (target, options = {}) => run(target, { readGitOriginals, ...options });

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-state/run-recovery.js

@@ -1,5 +0,0 @@
-import { inspectRunRecovery as inspect, previewRunRecovery as preview } from "#agdf-core/control-state/run-recovery.js";
-import { readGitHistory } from "../runtime/git-history.js";
-export { applyRunRecovery, inspectSelfReferenceRecovery } from "#agdf-core/control-state/run-recovery.js";
-export const inspectRunRecovery = (root, runId, options = {}) => inspect(root, runId, { readGitHistory, ...options });
-export const previewRunRecovery = (root, runId, options = {}) => preview(root, runId, { readGitHistory, ...options });