create-agent-rig 0.9.1 → 0.10.1

package/packages/cli/dist/policy/core/validation.js

@@ -1,275 +0,0 @@
-/**
- * The small set of checks the declaration and the decision record share.
- *
- * Every check appends to a problem list instead of throwing, so a caller sees
- * every defect of a record at once — `validateDeclaration` › "reports every
- * problem at once rather than stopping at the first" in
- * `packages/cli/test/policy-declaration.test.ts`. Each message that refuses an
- * enumerated value quotes the value, because a refusal that names the field
- * and not the word leaves the caller guessing which of two spellings it sent.
- */
-export const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
-/**
- * Whether an outside record CARRIES a field — own and enumerable, which is
- * exactly the set `Object.keys` walks, and which `JSON.stringify` writes out
- * whenever the value is serialisable.
- *
- * ⚠ The second half is a "whenever", not an equivalence, and the earlier
- * wording claimed the equivalence. `{ downgradeReason: undefined }` is own and
- * enumerable, so this returns `true`, while `JSON.stringify` drops it — which
- * is why a `SUPPORTED` row written that way is refused for carrying a reason
- * even though its serialisation carries none. The refusal is the conservative
- * direction, but a reader who took "the rule is what `JSON.stringify` sees"
- * literally would predict acceptance. `Object.keys` is the set this actually
- * implements; that is the half to reason from.
- *
- * 🔴 The two halves are one rule, and each was a real false pass. A field found
- * on the PROTOTYPE let a hook serialising as `{}` be read as running the
- * generated command, and let an evidence row own nothing and still validate; a
- * field that is own but NOT ENUMERABLE let a row validate and then serialise
- * without the pointer that made it pass. Both are the same defect stated twice:
- * something was accepted as evidence that no serialisation of the value
- * carries. `unknownKeys` already judges a record by `Object.keys`, so reading
- * by any wider notion made the closed-shape check and the field reads disagree
- * about what the record even contains — and the reads were the wider of the
- * two.
- *
- * Held over both readers at once: `packages/cli/test/policy-coverage.test.ts`
- * (absent in a generated rig) › "refuses a hook entry whose command is only
- * inherited, because the entry itself carries no command" and › "refuses a row
- * whose evidence pointer is own but not enumerable, because the rule is what
- * JSON.stringify sees".
- */
-export const carriesField = (input, field) => Object.prototype.propertyIsEnumerable.call(input, field);
-/**
- * Read one field the way the record's own serialisation would carry it, or
- * `undefined` when the record does not carry it at all.
- *
- * Presence and value travel through the same predicate on purpose: a caller
- * that tested presence one way and read the value another is how the two
- * came apart the first time.
- */
-export const ownField = (input, field) => carriesField(input, field) ? input[field] : undefined;
-/**
- * A value as it appeared, escaped, for a message a person reads. Exported
- * because every module here that puts OUTSIDE data into a diagnostic must put
- * it through the same escaping — a raw newline or ANSI sequence in a matcher
- * can otherwise forge a line of the report it lands in (`./probe.ts`).
- */
-export const quote = (value) => {
-    try {
-        return JSON.stringify(value) ?? String(value);
-    }
-    catch {
-        return String(value);
-    }
-};
-const list = (vocabulary) => vocabulary.map(quote).join(', ');
-/**
- * Refuse a key the shape does not declare — the shape is closed on purpose.
- * A nested shape passes its own field name as `prefix`, so the problem names
- * `verdict.severity` rather than a bare `severity` the caller cannot place.
- */
-export const unknownKeys = (problems, input, known, prefix = '') => {
-    for (const key of Object.keys(input)) {
-        if (!known.includes(key)) {
-            problems.push({ field: prefix === '' ? key : `${prefix}.${key}`, message: 'unknown field' });
-        }
-    }
-};
-/** Refuse a string that is absent, not a string, or empty. */
-export const nonEmptyString = (problems, field, value) => {
-    if (typeof value !== 'string' || value === '') {
-        problems.push({ field, message: `must be a non-empty string, got ${quote(value)}` });
-        return false;
-    }
-    return true;
-};
-/**
- * Refuse a string that is absent, not a string, or has no non-space character.
- *
- * Stricter than `nonEmptyString` in exactly one place — a value of whitespace
- * only — and a separate helper rather than a tightening of that one, because
- * the shapes already validated by it are not in this change's scope. Where a
- * field is a fact a later reader has to act on (an exact version, a pointer to
- * evidence), a blank is the same defect as an absence and is refused as one.
- */
-export const nonBlankString = (problems, field, value) => {
-    if (typeof value !== 'string' || value.trim() === '') {
-        problems.push({ field, message: `must be a non-blank string, got ${quote(value)}` });
-        return false;
-    }
-    return true;
-};
-/**
- * A real calendar date, `T`, time to the second (fractions allowed), and an
- * explicit zone.
- *
- * One spelling of one fact (`rules/invariants.md`, "One mechanism, one
- * implementation"). Its three readers are `./decision-record.ts`
- * (`recordedAt`), `./evidence-matrix.ts` (`observedAt`) and `./coverage.ts`
- * (`verifiedAt`, through `requireTimestamp`), so a bare date is refused the
- * same way whichever of them is validating — including lexically shaped but
- * impossible dates — `packages/cli/test/policy-coverage.test.ts`
- * › "refuses the probe timestamp %j, which is exactly what the shared ISO-8601
- * pattern refuses" imports this pattern rather than restating it, so the two
- * sides cannot drift apart. A timestamp is always supplied by the caller —
- * nothing under this directory reads a clock.
- */
-const ISO_8601_SHAPE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/;
-/**
- * A date-time shape whose `test` also proves the named calendar instant exists.
- * Keeping the semantic check behind the same exported predicate prevents the
- * coverage, decision-record and evidence-row validators from drifting apart.
- */
-export const ISO_8601 = {
-    test(value) {
-        const match = ISO_8601_SHAPE.exec(value);
-        if (match === null)
-            return false;
-        const [, yearText, monthText, dayText, hourText, minuteText, secondText, zoneHour, zoneMinute] = match;
-        const year = Number(yearText);
-        const month = Number(monthText);
-        const day = Number(dayText);
-        const hour = Number(hourText);
-        const minute = Number(minuteText);
-        const second = Number(secondText);
-        const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-        const daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-        return (month >= 1 &&
-            month <= 12 &&
-            day >= 1 &&
-            day <= daysInMonth[month - 1] &&
-            hour <= 23 &&
-            minute <= 59 &&
-            second <= 59 &&
-            (zoneHour === undefined || (Number(zoneHour) <= 23 && Number(zoneMinute) <= 59)));
-    },
-};
-/** Refuse a string outside a closed vocabulary, quoting the offending value. */
-export const member = (problems, field, value, vocabulary) => {
-    if (typeof value === 'string' && vocabulary.includes(value))
-        return true;
-    problems.push({ field, message: `${quote(value)} is not one of ${list(vocabulary)}` });
-    return false;
-};
-/**
- * Refuse a list that is not an array, carries a value outside the vocabulary,
- * repeats one, or — when `nonEmpty` — is empty.
- */
-export const members = (problems, field, value, vocabulary, { nonEmpty }) => {
-    if (!Array.isArray(value)) {
-        problems.push({ field, message: `must be a list, got ${quote(value)}` });
-        return false;
-    }
-    let clean = true;
-    if (nonEmpty && value.length === 0) {
-        problems.push({ field, message: 'must not be empty' });
-        clean = false;
-    }
-    const seen = new Set();
-    for (const entry of value) {
-        if (!member(problems, field, entry, vocabulary)) {
-            clean = false;
-            continue;
-        }
-        if (seen.has(entry)) {
-            problems.push({ field, message: `${quote(entry)} is listed twice` });
-            clean = false;
-        }
-        seen.add(entry);
-    }
-    return clean;
-};
-/** Refuse a string that does not match the pattern, saying what shape was expected. */
-export const matching = (problems, field, value, pattern, expected) => {
-    if (typeof value === 'string' && pattern.test(value))
-        return true;
-    problems.push({ field, message: `must be ${expected}, got ${quote(value)}` });
-    return false;
-};
-/**
- * A version that names one build rather than a set of them.
- *
- * One spelling of one fact: `./evidence-matrix.ts` refuses a matrix row on it
- * and `./coverage.ts` refuses a surface identity on it, so "the exact version
- * observed" means the same thing wherever it is written.
- *
- * 🔴 This is an ALLOWLIST, and it replaced a denylist that could not be
- * finished. The denylist refused five vague words, the range operator
- * characters, a wildcard component and two npm range spellings — and accepted
- * `main`, `master`, `stable`, `next`, `nightly`, `dev`, `edge`, `canary` and
- * `1.2.3 or 2.0.0`, because none of them is any of those things. A moving label
- * is not a shape you can enumerate: every branch name a harness ever publishes
- * from is a new entry, added by whoever notices, which is nobody. So the check
- * asks what a build identifier LOOKS LIKE instead of what a moving target is
- * called, and a word the grammar does not describe is refused whether or not
- * anyone anticipated it.
- *
- * Two shapes are accepted, and they are the two this rig actually reads:
- *
- * - a build NUMBER — a dotted numeric version, optionally `v`-prefixed, with an
- *   optional pre-release or build-metadata suffix after `-` or `+`. That covers
- *   `2.0.14`, `v2.0.14`, `1.104.2`, a date build id like `2026-09-05`, a plain
- *   build id like `20260904.3`, and a suffix carrying any letter at all,
- *   including `1.0.0-X` and `0.0.0-fixture`;
- * - a build ID — 7 to 64 hex characters, which is a git object id at every
- *   length git itself abbreviates to.
- *
- * The distinction that costs the most to get wrong is the one between a bare
- * channel word and a suffix: `beta` names whatever is on that channel today and
- * is refused, while `1.0.0-beta.2` names one build and is accepted. The grammar
- * draws that line by requiring the number first — a suffix cannot stand alone.
- *
- * The value is matched AS GIVEN, with no trim. An earlier version validated
- * `value.trim()` while both callers stored the value verbatim, so `" 2.0.14 "`,
- * `"2.0.14\r\n"` and a BOM-prefixed form were accepted and then persisted with
- * their padding: two rows for one build that compare unequal, and a version
- * carrying a newline sitting in a field a report will one day render. What is
- * checked and what is stored are now the same string: ›
- * "refuses an evidence row whose harness version carries %s, because the row
- * would store what it was not validated on" and › "refuses to probe against a
- * harness version carrying %s, so two maps of one build cannot compare
- * unequal", with › "still accepts the same build once %s is gone, because it is
- * the padding that is refused and not the version" holding the other side.
- *
- * Refused, and now by construction rather than by enumeration: the vague words,
- * every moving branch label, range OPERATORS, wildcard components, both npm
- * range spellings, and any text carrying whitespace or a comma — which is what
- * `1.2.3 or 2.0.0` and `1.2.3, 2.0.0` are. Both readers are pinned in
- * `packages/cli/test/policy-coverage.test.ts` (absent in a generated rig) ›
- * "refuses the harness version %j, because it names a moving label or more than
- * one build" and › "refuses to probe against the harness version %j, because it
- * names a moving label or more than one build", with the other direction held
- * so the grammar cannot swallow a real build id: › "still accepts the harness
- * version %j, because it names one build" and › "still probes against the
- * harness version %j, because it names one build".
- */
-const BUILD_NUMBER = /^v?\d+(?:\.\d+)*(?:[-+][0-9A-Za-z][0-9A-Za-z.+-]*)?$/;
-const BUILD_ID = /^[0-9a-fA-F]{7,64}$/;
-/**
- * What a refusal says is expected — one spelling, read by this module and by
- * `./coverage.ts`, so the two cannot come to describe different grammars.
- */
-export const EXACT_VERSION_EXPECTED = 'must name one immutable build: a version number like 2.0.14, ' +
-    'optionally v-prefixed and optionally carrying a -pre-release or +build suffix, ' +
-    'or a 7-to-64-character hex build id';
-export const isExactVersion = (value) => BUILD_NUMBER.test(value) || BUILD_ID.test(value);
-/**
- * Refuse a version the grammar does not describe, quoting the value and naming
- * the two shapes that are accepted.
- *
- * The message says what would be accepted rather than what was wrong, because
- * the check is an allowlist: it also refuses `1.0.0.beta` and `2026_09_05`,
- * which are neither a range nor a moving target, and the earlier message told
- * their author they had written one. `./probe.ts` states the principle this
- * trips over — a refusal naming a cause that did not occur sends an operator
- * looking for something that is not there.
- */
-export const exactVersion = (problems, field, value) => {
-    if (typeof value !== 'string' || value.trim() === '')
-        return;
-    if (!isExactVersion(value)) {
-        problems.push({ field, message: `${EXACT_VERSION_EXPECTED}; got ${quote(value)}` });
-    }
-};

package/packages/cli/dist/policy/core/vocabulary.js

@@ -1,123 +0,0 @@
-/**
- * The closed vocabularies of the policy declaration (RP-76).
- *
- * Every value a declaration or a decision record may carry in an enumerated
- * field is listed here and nowhere else. Adding a value is a schema edit — a
- * change to this file plus the test that pins the list — never a string a
- * caller invents at runtime. That is what makes a record auditable: an unknown
- * word is refused rather than read as something close to a known one.
- *
- * Harness-neutral by construction: nothing here names a harness, a vendor, a
- * native tool or a native path. The per-harness spellings live in
- * `../harness/`, and `test/template/policy-declaration.test.ts` › "no file
- * under src/policy/core mentions a harness, a vendor, a native tool or a native
- * path" is what keeps them out of here.
- */
-const closed = (values) => Object.freeze(values);
-/**
- * Whether a declared policy can actually be enforced on a given harness
- * surface. `UNSUPPORTED` and `INTEGRATION-FAILED` must never yield a silent
- * pass: a decision record carrying either has to qualify its verdict
- * `UNVERIFIABLE` (`./decision-record.ts`). The four states are defined here.
- *
- * ⚠ That is the rule, and the enforcement behind it is narrower than the rule
- * — see `UNENFORCEABLE_STATES` below, which states the gap once for every
- * reader of this file.
- */
-export const CAPABILITY_STATES = closed([
-    'SUPPORTED',
-    'DEGRADED',
-    'UNSUPPORTED',
-    'INTEGRATION-FAILED',
-]);
-/**
- * The states under which no question was actually put to a working mechanism.
- *
- * One spelling of one fact (`rules/invariants.md`, "One mechanism, one
- * implementation"): `./decision-record.ts` refuses an unqualified verdict
- * carrying one of these, and `./coverage.ts` › `qualifierFor` returns
- * `UNVERIFIABLE` for exactly the same set. Two copies would disagree, and the
- * one nobody is looking at would be the one that let a silent pass through.
- *
- * ⚠ **"Refuses" now holds against a hand-built prototype too** — this note used
- * to say the opposite, and this is the file a reader auditing that question
- * lands on first, so it is corrected here rather than only where the fix landed.
- * `./decision-record.ts` used to decide whether a verdict carries a qualifier
- * with the `in` operator, so a verdict INHERITING one satisfied the check and
- * then serialised without it. RP-153 closed that: every field of both
- * `./decision-record.ts` and `./declaration.ts` is read through
- * `carriesField`/`ownField`, the way `./probe.ts` and `./evidence-matrix.ts`
- * already read theirs, and both uncarried shapes are pinned in
- * `packages/cli/test/policy-declaration.test.ts` › "refuses an UNSUPPORTED
- * record whose verdict qualifier is %s, because what it writes out is a silent
- * pass" — `%s` as the `it.each` case declares it, so one grep lands on it.
- *
- * What remains is narrower and is NOT this sentence's subject: a value carrying
- * a live accessor is validated on one read and serialised from another (RP-157),
- * and an array HOLE serialises as `null` while the two `forEach` loops in
- * `./decision-record.ts` skip it (RP-161) — those two only, since `members` in
- * `./validation.ts` and `./probe.ts` iterate with `for…of`, which sees a hole as
- * `undefined` and refuses it. `docs/decisions/capability-coverage.md`, "What
- * this does NOT do", carries the current limits at length.
- *
- * It is deliberately NOT derived from a rank or an ordering. `coverage.ts`
- * carries an enforcement ordering for deciding what counts as a downgrade;
- * keying verdict qualification off that would mean a future re-rank silently
- * changed which verdicts are unverifiable.
- */
-export const UNENFORCEABLE_STATES = closed(['UNSUPPORTED', 'INTEGRATION-FAILED']);
-/**
- * The two ways a capability status is established, and the only two.
- *
- * `probe` is one active read of the surface's own wiring, taken when the
- * surface changes (`PROBE_TRIGGERS`). `traffic` is passive: an operation that
- * was expected to produce an observable signal, and what it actually produced.
- * There is deliberately no third source meaning "time passed" — silence is
- * absence of evidence, not evidence of absence.
- */
-export const VERIFICATION_SOURCES = closed(['probe', 'traffic']);
-/**
- * The occasions on which a surface is probed. Every member is an event on the
- * surface; none of them is an interval.
- *
- * What this vocabulary does, exactly: `./coverage.ts` › `coverageFromProbe`
- * takes a trigger as a required argument and refuses a word outside this list,
- * so a probe must NAME its occasion and cannot name a schedule — ›
- * "refuses the trigger %j, because the coverage contract accepts only a
- * declared surface-change trigger".
- *
- * ⚠ What it does NOT do, stated because an earlier draft of this comment
- * claimed it: nothing here stops a caller passing `'upgrade'` on a timer. The
- * check refuses a LABEL outside the vocabulary, not the practice of probing
- * periodically. `docs/decisions/capability-coverage.md` §1 says the same, and
- * this file used to contradict it.
- */
-export const PROBE_TRIGGERS = closed(['install', 'upgrade', 'registration', 'reconnect']);
-/** The autonomy tiers of `rules/autonomy.md`; `never` is the tier the guards enforce. */
-export const AUTONOMY_TIERS = closed(['tier-0', 'tier-1', 'tier-2', 'never']);
-/** The operations a policy can apply to, named by what the agent does, not by a tool. */
-export const OPERATIONS = closed(['file-edit', 'shell-command']);
-/** When the mechanism decides, relative to the operation it judges. */
-export const ENFORCEMENT_TIMINGS = closed(['before-operation']);
-/** What a harness must provide for the mechanism to run at all. */
-export const HARNESS_CAPABILITIES = closed(['pre-operation-hook']);
-/**
- * The three outcomes a guard can reach: allow, block, or refuse to inspect —
- * the third being neither a match nor an error (`rules/invariants.md`,
- * "Refusing to inspect is a third outcome").
- */
-export const DECISION_OUTCOMES = closed(['allow', 'block', 'refuse-to-inspect']);
-/** What a mechanism does when it cannot decide: let the operation through, or stop it. */
-export const FAILURE_SEMANTICS = closed(['fail-open', 'fail-closed']);
-/** The kinds of evidence a decision record may carry, and a policy may require. */
-export const EVIDENCE_KINDS = closed(['exit-code', 'diagnostic-text', 'test-pointer']);
-/** How a mechanism treats what it matched when it reports: verbatim, or omitted. */
-export const REDACTION_RULES = closed(['none', 'omit-matched-values']);
-/** Where a policy is in its life; a `retired` policy is no longer offered by the registry. */
-export const LIFECYCLE_STATES = closed(['active', 'deprecated', 'retired']);
-/**
- * The two ways a verdict can say "this word is weaker than it looks": the
- * question could not be put (`UNVERIFIABLE`), or nothing backs the answer
- * (`UNMEASURED`). Either one must carry a reason.
- */
-export const VERDICT_QUALIFIERS = closed(['UNVERIFIABLE', 'UNMEASURED']);

package/packages/cli/dist/policy/harness/claude.js

@@ -1,47 +0,0 @@
-/**
- * The Claude Code adapter: a declaration → the native hook surface Claude Code
- * wires for it. The authoring surface of this rulebook is Claude-shaped
- * (`CLAUDE.md`, "One operating system, two harnesses"), so the hook files
- * themselves live in the historical directory `./shared-hooks.ts` names and are
- * shared by every harness.
- *
- * What is native here and nowhere in the core: the `PreToolUse` event, the
- * tool names in the matchers, and the snapshot path. The matcher strings are
- * the ones `.claude/settings.json` carries, and the correspondence test holds
- * the two to the SAME tool set, not a subset: a tool dropped here or gained
- * there is reported for this adapter —
- * `test/template/policy-declaration.test.ts` › "reports the no-verify policy
- * on %s when the shell matcher loses PowerShell (mutation: matcher)", › "reports
- * the no-verify policy on %s when the snapshot gains a tool the adapter does
- * not name (mutation: widened snapshot)" and › "reports a policy on %s whose
- * adapter matcher drops a tool the snapshot still wires (mutation: narrowed
- * adapter)". The shell matcher's tool set is owned by `shell-tools.mjs` in the
- * shipped scripts, and `test/template/shell-tools.test.ts` holds that
- * correspondence.
- */
-import { SHARED_HOOK_ROOT_ENV, SHARED_HOOKS_DIR } from './shared-hooks.js';
-const EVENT_OF = {
-    'before-operation': 'PreToolUse',
-};
-const MATCHER_OF = {
-    'file-edit': 'Write|Edit|MultiEdit|NotebookEdit|apply_patch',
-    'shell-command': 'Bash|PowerShell',
-};
-export const nativeSurfaceOf = (policy) => ({
-    event: EVENT_OF[policy.timing],
-    matcher: policy.operations.map((operation) => MATCHER_OF[operation]).join('|'),
-    hookPath: `${SHARED_HOOKS_DIR}/${policy.mechanism}.mjs`,
-    // The exact command this harness generates for a hook. The probe compares
-    // against this rather than parsing what it finds, so this string and the one
-    // in the shipped snapshot must agree — pinned in both directions by
-    // `test/template/policy-coverage.test.ts` (absent in a generated rig) ›
-    // "the %s snapshot wires %s with exactly the command that adapter generates".
-    commands: {
-        command: [`node "$${SHARED_HOOK_ROOT_ENV}/${SHARED_HOOKS_DIR}/${policy.mechanism}.mjs"`],
-    },
-});
-export const claudeAdapter = Object.freeze({
-    harness: 'claude',
-    surfaceFile: '.claude/settings.json',
-    nativeSurfaceOf,
-});

package/packages/cli/dist/policy/harness/codex.js

@@ -1,87 +0,0 @@
-/**
- * The Codex adapter: a declaration → the native hook surface Codex wires for
- * it. Codex's hook wiring (`.codex/hooks.json`) is DERIVED from the authoring
- * harness's snapshot by `scripts/sync-codex-adapter.mjs`
- * (`docs/decisions/codex-adapter.md`): it keeps the authoring harness's matcher
- * spellings, adds the canonical edit tool `apply_patch`, and runs the same hook
- * files from the shared hooks directory. So the strings below coincide with the
- * other adapter's today — by derivation, not by accident — and each adapter
- * still owns its own spelling. The correspondence test holds this adapter's
- * matcher and the derived snapshot's to the SAME tool set, so a tool the
- * snapshot gains or loses, or one this adapter drops, is reported for this
- * adapter alone — `test/template/policy-declaration.test.ts` › "reports the
- * no-verify policy on %s when the shell matcher loses PowerShell (mutation:
- * matcher)", › "reports the no-verify policy on %s when the snapshot gains a
- * tool the adapter does not name (mutation: widened snapshot)" and › "reports
- * a policy on %s whose adapter matcher drops a tool the snapshot still wires
- * (mutation: narrowed adapter)".
- *
- * The shared hooks directory is imported from `./shared-hooks.ts` rather than
- * restated, for the same reason the snapshot is derived rather than
- * hand-written: one spelling of one fact.
- */
-import { SHARED_HOOK_ROOT_ENV, SHARED_HOOKS_DIR } from './shared-hooks.js';
-const EVENT_OF = {
-    'before-operation': 'PreToolUse',
-};
-const MATCHER_OF = {
-    'file-edit': 'Write|Edit|MultiEdit|NotebookEdit|apply_patch',
-    'shell-command': 'Bash|PowerShell',
-};
-/**
- * The Windows spelling this harness generates for a hook.
- *
- * ⚠ A SECOND implementation of the wrapper that `scripts/sync-codex-adapter.mjs`
- * writes into the shipped file, and deliberately so: that script is a build tool
- * outside the published package, and this module may not import it. The two are
- * held equal by a correspondence check that goes red in BOTH directions —
- * `test/template/policy-coverage.test.ts` (absent in a generated rig) › "the %s
- * snapshot wires %s with exactly the spelling that adapter generates, in every
- * field it generates one for" — which is what `rules/invariants.md` ("One
- * mechanism, one implementation") requires of a copy that has to stay.
- *
- * The wrapper exists because PowerShell owns its stdin, so the hook would
- * receive an empty stream; it copies the original bytes into the child instead
- * of re-encoding them.
- */
-const windowsCommand = (hookPath) => {
-    const script = [
-        "$ErrorActionPreference = 'Stop'",
-        '$repoRoot = git rev-parse --show-toplevel',
-        'if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }',
-        `$env:${SHARED_HOOK_ROOT_ENV} = $repoRoot`,
-        `$hookPath = Join-Path $repoRoot '${hookPath}'`,
-        '$startInfo = New-Object System.Diagnostics.ProcessStartInfo',
-        "$startInfo.FileName = 'node'",
-        "$startInfo.Arguments = '\"' + $hookPath + '\"'",
-        '$startInfo.UseShellExecute = $false',
-        '$startInfo.RedirectStandardInput = $true',
-        '$child = [System.Diagnostics.Process]::Start($startInfo)',
-        '[Console]::OpenStandardInput().CopyTo($child.StandardInput.BaseStream)',
-        '$child.StandardInput.Close()',
-        '$child.WaitForExit()',
-        'exit $child.ExitCode',
-    ].join('; ');
-    const encoded = Buffer.from(script, 'utf16le').toString('base64');
-    return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${encoded}`;
-};
-export const nativeSurfaceOf = (policy) => ({
-    event: EVENT_OF[policy.timing],
-    matcher: policy.operations.map((operation) => MATCHER_OF[operation]).join('|'),
-    hookPath: `${SHARED_HOOKS_DIR}/${policy.mechanism}.mjs`,
-    // Both commands this harness generates. It runs the first on POSIX and the
-    // second on Windows, so the probe has to know both: replacing only the
-    // Windows spelling in the shipped file used to leave every policy reading
-    // SUPPORTED while the guard no longer ran there.
-    commands: {
-        command: [
-            `repoRoot="$(git rev-parse --show-toplevel)" && ${SHARED_HOOK_ROOT_ENV}="$repoRoot" node "$repoRoot/${SHARED_HOOKS_DIR}/${policy.mechanism}.mjs"`,
-        ],
-        commandWindows: [windowsCommand(`${SHARED_HOOKS_DIR}/${policy.mechanism}.mjs`)],
-    },
-});
-export const codexAdapter = Object.freeze({
-    harness: 'codex',
-    surfaceFile: '.codex/hooks.json',
-    nativeSurfaceOf,
-});

package/packages/cli/dist/policy/harness/index.js

@@ -1,15 +0,0 @@
-/**
- * The harness adapters this generator knows. Adding a harness is one new
- * module beside these two and one entry in the list below — nothing in
- * `../core/` changes, which `test/template/policy-declaration.test.ts` ›
- * "codex is named only by its own adapter and the adapter index" pins by
- * naming exactly the files that may mention each harness.
- */
-import { claudeAdapter } from './claude.js';
-import { codexAdapter } from './codex.js';
-export { claudeAdapter, codexAdapter };
-export { SHARED_HOOKS_DIR } from './shared-hooks.js';
-export const HARNESS_ADAPTERS = Object.freeze([
-    claudeAdapter,
-    codexAdapter,
-]);

package/packages/cli/dist/policy/harness/shared-hooks.js

@@ -1,28 +0,0 @@
-/**
- * The one directory every harness runs its hook files from. The rulebook's
- * `.claude/` directory keeps its historical name but holds the shared rules,
- * hooks, scripts and agent specifications for both harnesses (`CLAUDE.md`,
- * "One operating system, two harnesses"), so a hook path is the same string
- * whichever adapter names it. Stated once, here, and imported by each adapter
- * — one spelling of one fact (`rules/invariants.md`, "One mechanism, one
- * implementation").
- */
-export const SHARED_HOOKS_DIR = '.claude/hooks';
-/**
- * The environment variable a shared hook reads when it needs the repository
- * root, and therefore the one each harness sets when it runs one.
- *
- * Not every hook needs it: of the eight this rig ships, `guard-rulebook` and
- * `guard-secret-file` read it, both falling back to the working directory.
- * The variable is still part of the wiring contract, because the harness sets
- * it for whichever hook it runs.
- *
- * It carries a harness's name for the same historical reason `.claude/hooks`
- * does — the hooks are shared, so both harnesses speak this one variable — and
- * this module is the one adapter-side file allowed to spell that name for both
- * (`test/template/policy-declaration.test.ts` › "claude is named only by its
- * own adapter, the shared hooks directory and the adapter index"). Stating it
- * here is what lets the other harness's adapter build its generated command
- * without naming a harness that is not its own.
- */
-export const SHARED_HOOK_ROOT_ENV = 'CLAUDE_PROJECT_DIR';

package/packages/cli/dist/policy/index.js

@@ -1,17 +0,0 @@
-/**
- * The policy declaration, registry, decision-record schema and harness
- * adapters (RP-76), plus the capability & degradation contract that says what
- * each of them is worth on a given surface (RP-36).
- *
- * Library surface only — nothing here is reached by the CLI commands yet;
- * emitting decision records at runtime, and rendering the coverage report in
- * `doctor`, are separate tasks.
- */
-export * from './core/vocabulary.js';
-export * from './core/declaration.js';
-export * from './core/registry.js';
-export * from './core/decision-record.js';
-export * from './core/probe.js';
-export * from './core/coverage.js';
-export * from './core/evidence-matrix.js';
-export * from './harness/index.js';