devlyn-cli 3.2.1 → 3.3.0

package/benchmark/auto-resolve/fixtures/F26-cli-payout-ledger-rules/verifiers/rules-source.js

@@ -1,56 +0,0 @@
-const assert = require('node:assert');
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const { spawnSync } = require('node:child_process');
-
-const workdir = process.env.BENCH_WORKDIR || process.cwd();
-const rulesPath = path.join(workdir, 'data', 'payout-rules.json');
-const original = fs.readFileSync(rulesPath, 'utf8');
-
-try {
-  fs.writeFileSync(rulesPath, JSON.stringify({
-    processing_fee_percent: 1,
-    fixed_fee_cents: 10,
-    dispute_fee_cents: 77,
-    reserve_percent: 0,
-    minimum_payout_cents: 1
-  }, null, 2) + '\n');
-
-  const input = path.join(os.tmpdir(), `payout-rules-${process.pid}.json`);
-  fs.writeFileSync(input, JSON.stringify({
-    events: [
-      { id: 'evt-1', merchant_id: 'm_1', type: 'charge', amount_cents: 10000 }
-    ]
-  }));
-
-  const proc = spawnSync('node', ['bin/cli.js', 'payout', '--input', input], {
-    cwd: workdir,
-    encoding: 'utf8'
-  });
-
-  assert.strictEqual(proc.status, 0, proc.stderr || proc.stdout);
-  assert.strictEqual(proc.stderr, '');
-  assert.deepStrictEqual(JSON.parse(proc.stdout), {
-    total_payout_cents: 9890,
-    total_processing_fee_cents: 110,
-    total_dispute_fee_cents: 0,
-    total_reserve_cents: 0,
-    merchants: [
-      {
-        merchant_id: 'm_1',
-        gross_charge_cents: 10000,
-        refund_cents: 0,
-        dispute_cents: 0,
-        processing_fee_cents: 110,
-        dispute_fee_cents: 0,
-        reserve_cents: 0,
-        payout_cents: 9890
-      }
-    ]
-  });
-} finally {
-  fs.writeFileSync(rulesPath, original);
-}
-
-process.stdout.write(JSON.stringify({ ok: true }) + '\n');

package/benchmark/auto-resolve/fixtures/F3-backend-contract-risk/NOTES.md

@@ -1,35 +0,0 @@
-# F3 — Notes
-
-## Purpose
-
-High-risk contract change. Exercises the pipeline's ability to catch
-**breaking changes hidden inside a reasonable-looking refactor**: lazy
-implementations wrap `items` in an envelope but forget to update tests, or
-update tests but forget backward-compat requirements (single-item route,
-`items` key), or paginate without validating query params.
-
-## Failure modes detected
-
-- **Test lie**: arm changes the handler but leaves old `assert.ok(Array.isArray(body.items))` that still passes against `{ items: [...] }` inside the envelope → test passes but new paging fields aren't asserted. Fixture requires ≥ 2 NEW tests.
-- **Query-param trust**: accepts `?per_page=abc` → `parseInt` returns `NaN` → handler explodes or silently treats as default. Fixture requires explicit 400.
-- **Contract drift on single-item lookup**: arm paginates `/items/:id` too, breaking existing clients.
-- **Silent catch**: wrapping `Number(req.query.page)` in a `try/catch { return [] }` — caught by forbidden pattern.
-
-## Pipeline exercise
-
-- Phase 0 routing: likely `strict` (no risk keywords, but cross-file multi-function change may escalate in Stage B).
-- Phase 1 BUILD: Codex BUILD produces the implementation.
-- Phase 1.4 BUILD GATE: `node --test tests/server.test.js` must pass.
-- Phase 2 EVAL: scrutinizes that new tests cover new behavior (not just rename passes).
-- Phase 3 CRITIC design: checks invalid-query branch and backward-compat.
-
-## Rotation trigger
-
-Headroom run `20260511-f3-http-error-headroom` rejected this fixture as
-pair-lift evidence after the invalid-query HTTP error body verifier was
-tightened: bare scored 97 and solo_claude scored 99. Keep it as a backend
-contract control unless the visible contract is reworked to expose lower
-bare/solo ceilings.
-
-Retire when both `bare` and `solo_claude` consistently score > 95 AND produce
-2+ new tests covering paging edge cases without pipeline intervention.

package/benchmark/auto-resolve/fixtures/F3-backend-contract-risk/expected-pair-plan-registry.json

@@ -1,162 +0,0 @@
-{
-  "fixture_id": "F3-backend-contract-risk",
-  "generated_at": "2026-04-29T09:57:53Z",
-  "generated_from": {
-    "expected_path": "benchmark/auto-resolve/fixtures/F3-backend-contract-risk/expected.json",
-    "expected_sha256": "c0925ee948179fbc1c76836d98fba0c14c7eba56f462f2922903951923cb22e6",
-    "metadata_path": "benchmark/auto-resolve/fixtures/F3-backend-contract-risk/metadata.json",
-    "metadata_sha256": "c54530db26dbb04ce50b698fed2608206eae6f9a5dc2f666f127695e15d3fa30",
-    "oracle_script_shas": {
-      "scope-tier-a": "baaf21ed4a67f35d2a8af825e72869ef9737b5dfe08d65dd1a11c26fafe297ae",
-      "scope-tier-b": "9349d00a5c7456a4df9142923334e7004407d53f2443f2e210945bb771971e25",
-      "test-fidelity": "401184da51ae500cecfc75a6c5819b0d28acb63a397f788fb628c2913562f903"
-    }
-  },
-  "required_invariants": [
-    {
-      "authority": "expected.json/forbidden_patterns",
-      "id": "forbidden_pattern__eslint_disable_without_explicit_per_issue_justification__server_index_js",
-      "operational_check": "variant arm output MUST NOT contain regex pattern '/\\\\*\\\\s*eslint-disable' in files ['server/index.js']; rationale: eslint-disable without explicit per-issue justification",
-      "severity": "disqualifier",
-      "source_field": "expected.json/forbidden_patterns/1",
-      "source_ref": "expected.json:forbidden_patterns[1]"
-    },
-    {
-      "authority": "expected.json/forbidden_patterns",
-      "id": "forbidden_pattern__silent_catch_returning_fallback__server_index_js",
-      "operational_check": "variant arm output MUST NOT contain regex pattern \"catch\\\\s*\\\\([^)]*\\\\)\\\\s*\\\\{[^}]*return\\\\s+(null|undefined|'')\" in files ['server/index.js']; rationale: silent catch returning fallback",
-      "severity": "disqualifier",
-      "source_field": "expected.json/forbidden_patterns/0",
-      "source_ref": "expected.json:forbidden_patterns[0]"
-    },
-    {
-      "authority": "expected.json/max_deps_added",
-      "id": "max_deps_added__0",
-      "operational_check": "variant arm MUST NOT add more than 0 new npm dependencies (count delta of package.json:dependencies + devDependencies)",
-      "severity": "hard",
-      "source_field": "expected.json/max_deps_added",
-      "source_ref": "expected.json:max_deps_added"
-    },
-    {
-      "authority": "expected.json/required_files",
-      "id": "required_file__server_index_js",
-      "operational_check": "variant arm output MUST contain file 'server/index.js' (created or preserved)",
-      "severity": "hard",
-      "source_field": "expected.json/required_files",
-      "source_ref": "expected.json:required_files[server/index.js]"
-    },
-    {
-      "authority": "expected.json/required_files",
-      "id": "required_file__tests_server_test_js",
-      "operational_check": "variant arm output MUST contain file 'tests/server.test.js' (created or preserved)",
-      "severity": "hard",
-      "source_field": "expected.json/required_files",
-      "source_ref": "expected.json:required_files[tests/server.test.js]"
-    },
-    {
-      "authority": "metadata/oracle-allowlist",
-      "id": "scope-tier-a:lockfile-deletion",
-      "operational_check": "variant arm MUST NOT delete a scaffold-present lockfile",
-      "severity": "hard",
-      "source_field": "oracle/scope-tier-a/scope-tier-a:lockfile-deletion",
-      "source_ref": "oracle-scope-tier-a.py"
-    },
-    {
-      "authority": "metadata/oracle-allowlist",
-      "id": "scope-tier-a:tier-a-violation",
-      "operational_check": "variant arm MUST NOT add or modify paths matching: docs/roadmap/** | docs/VISION.md | docs/ROADMAP.md | .github/** | node_modules/** | **/node_modules/** | test-results/** | coverage/** | .nyc_output/** | basename suffix .log | basename prefix .env or secrets.",
-      "severity": "hard",
-      "source_field": "oracle/scope-tier-a/scope-tier-a:tier-a-violation",
-      "source_ref": "oracle-scope-tier-a.py"
-    },
-    {
-      "authority": "metadata/oracle-allowlist",
-      "id": "scope-tier-b:scope-unmatched",
-      "operational_check": "every variant-touched file MUST be either inside spec_output_files (Tier C) OR reachable from a Tier C seed via static JS/TS imports OR matched by expected.json:tier_a_waivers",
-      "severity": "warn",
-      "source_field": "oracle/scope-tier-b/scope-tier-b:scope-unmatched",
-      "source_ref": "oracle-scope-tier-b.py"
-    },
-    {
-      "authority": "expected.json/spec_output_files",
-      "id": "spec_output_file__server_index_js",
-      "operational_check": "variant-touched files MUST be inside (or reachable via static imports from) the spec_output_files set; 'server/index.js' is one Tier C seed",
-      "severity": "warn",
-      "source_field": "expected.json/spec_output_files",
-      "source_ref": "expected.json:spec_output_files[server/index.js]"
-    },
-    {
-      "authority": "expected.json/spec_output_files",
-      "id": "spec_output_file__tests_server_test_js",
-      "operational_check": "variant-touched files MUST be inside (or reachable via static imports from) the spec_output_files set; 'tests/server.test.js' is one Tier C seed",
-      "severity": "warn",
-      "source_field": "expected.json/spec_output_files",
-      "source_ref": "expected.json:spec_output_files[tests/server.test.js]"
-    },
-    {
-      "authority": "metadata/oracle-allowlist",
-      "id": "test-fidelity:assertion-regression",
-      "operational_check": "effective assertion count MUST NOT drop and skipped-test count MUST NOT rise; vacuous expect.assertions(0) is treated as a real regression",
-      "severity": "warn",
-      "source_field": "oracle/test-fidelity/test-fidelity:assertion-regression",
-      "source_ref": "oracle-test-fidelity.py"
-    },
-    {
-      "authority": "metadata/oracle-allowlist",
-      "id": "test-fidelity:mock-swap",
-      "operational_check": "post-arm test file MUST NOT swap REAL_PATTERNS hits for MOCK_PATTERNS hits (jest/vi/sinon, nock/msw, app.handle/inject/callback, hand-rolled IncomingMessage/ServerResponse, etc.); a drop in real_calls combined with a rise in mock_calls is a mock-swap flag",
-      "severity": "flag",
-      "source_field": "oracle/test-fidelity/test-fidelity:mock-swap",
-      "source_ref": "oracle-test-fidelity.py"
-    },
-    {
-      "authority": "metadata/oracle-allowlist",
-      "id": "test-fidelity:test-file-deleted",
-      "operational_check": "no scaffold-present test file may be deleted by the variant arm; deletion of an existing tests/*.test.* / *.spec.* / *.e2e.* file is a flag-severity finding",
-      "severity": "flag",
-      "source_field": "oracle/test-fidelity/test-fidelity:test-file-deleted",
-      "source_ref": "oracle-test-fidelity.py"
-    },
-    {
-      "authority": "metadata/oracle-allowlist",
-      "id": "test-fidelity:test-file-renamed",
-      "operational_check": "rename of a scaffold-present test file is warn-severity (content fidelity not verified across renames in step 1)",
-      "severity": "warn",
-      "source_field": "oracle/test-fidelity/test-fidelity:test-file-renamed",
-      "source_ref": "oracle-test-fidelity.py"
-    },
-    {
-      "authority": "expected.json/verification_commands",
-      "id": "verification__6001efe2",
-      "operational_check": "running `node -e 'const { app } = require(\"./server\"); const http = require(\"http\"); const s = http.createServer(app).listen(0, () => { const { port } = s.address(); http.get(`http://127.0.0.1:${port}/items?per_page=abc`, r => { console.log(r.statusCode); s.close(); }); });'` in the post-arm work dir MUST exit with code 0; stdout MUST contain all of ['400']; stdout MUST NOT contain any of []",
-      "severity": "hard",
-      "source_field": "expected.json/verification_commands/3",
-      "source_ref": "expected.json:verification_commands[3]"
-    },
-    {
-      "authority": "expected.json/verification_commands",
-      "id": "verification__6517d995",
-      "operational_check": "running `node -e 'const { app } = require(\"./server\"); const http = require(\"http\"); const s = http.createServer(app).listen(0, () => { const { port } = s.address(); http.get(`http://127.0.0.1:${port}/items`, r => { let b = \"\"; r.on(\"data\", c=>b+=c); r.on(\"end\", () => { const d = JSON.parse(b); console.log(JSON.stringify({ total: d.total, page: d.page, per_page: d.per_page, items_len: d.items.length })); s.close(); }); }); });'` in the post-arm work dir MUST exit with code 0; stdout MUST contain all of ['\"total\":2', '\"page\":1']; stdout MUST NOT contain any of []",
-      "severity": "hard",
-      "source_field": "expected.json/verification_commands/1",
-      "source_ref": "expected.json:verification_commands[1]"
-    },
-    {
-      "authority": "expected.json/verification_commands",
-      "id": "verification__73df5e81",
-      "operational_check": "running `node -e 'const { app } = require(\"./server\"); const http = require(\"http\"); const s = http.createServer(app).listen(0, () => { const { port } = s.address(); http.get(`http://127.0.0.1:${port}/items?page=2&per_page=1`, r => { let b = \"\"; r.on(\"data\", c=>b+=c); r.on(\"end\", () => { const d = JSON.parse(b); console.log(d.items[0] && d.items[0].name); s.close(); }); }); });'` in the post-arm work dir MUST exit with code 0; stdout MUST contain all of ['beta']; stdout MUST NOT contain any of []",
-      "severity": "hard",
-      "source_field": "expected.json/verification_commands/2",
-      "source_ref": "expected.json:verification_commands[2]"
-    },
-    {
-      "authority": "expected.json/verification_commands",
-      "id": "verification__7c5f3637",
-      "operational_check": "running `node --test tests/server.test.js` in the post-arm work dir MUST exit with code 0; stdout MUST contain all of []; stdout MUST NOT contain any of ['fail ']",
-      "severity": "hard",
-      "source_field": "expected.json/verification_commands/0",
-      "source_ref": "expected.json:verification_commands[0]"
-    }
-  ],
-  "schema_version": "1"
-}

package/benchmark/auto-resolve/fixtures/F3-backend-contract-risk/expected.json

@@ -1,67 +0,0 @@
-{
-  "verification_commands": [
-    {
-      "cmd": "node --test tests/server.test.js",
-      "exit_code": 0,
-      "stdout_contains": [],
-      "stdout_not_contains": [
-        "not ok "
-      ]
-    },
-    {
-      "cmd": "node -e 'const { app } = require(\"./server\"); const http = require(\"http\"); const s = http.createServer(app).listen(0, () => { const { port } = s.address(); http.get(`http://127.0.0.1:${port}/items`, r => { let b = \"\"; r.on(\"data\", c=>b+=c); r.on(\"end\", () => { const d = JSON.parse(b); console.log(JSON.stringify({ total: d.total, page: d.page, per_page: d.per_page, items_len: d.items.length })); s.close(); }); }); });'",
-      "exit_code": 0,
-      "stdout_contains": [
-        "\"total\":2",
-        "\"page\":1"
-      ],
-      "stdout_not_contains": []
-    },
-    {
-      "cmd": "node -e 'const { app } = require(\"./server\"); const http = require(\"http\"); const s = http.createServer(app).listen(0, () => { const { port } = s.address(); http.get(`http://127.0.0.1:${port}/items?page=2&per_page=1`, r => { let b = \"\"; r.on(\"data\", c=>b+=c); r.on(\"end\", () => { const d = JSON.parse(b); console.log(d.items[0] && d.items[0].name); s.close(); }); }); });'",
-      "exit_code": 0,
-      "stdout_contains": [
-        "beta"
-      ],
-      "stdout_not_contains": []
-    },
-    {
-      "cmd": "node -e 'const { app } = require(\"./server\"); const http = require(\"http\"); const s = http.createServer(app).listen(0, () => { const { port } = s.address(); http.get(`http://127.0.0.1:${port}/items?per_page=abc`, r => { let b = \"\"; r.on(\"data\", c => b += c); r.on(\"end\", () => { const d = JSON.parse(b); console.log(JSON.stringify({ status: r.statusCode, error: d.error, field: d.field })); s.close(); }); }); });'",
-      "exit_code": 0,
-      "stdout_contains": [
-        "\"status\":400",
-        "\"error\":\"invalid_query\"",
-        "\"field\":\"per_page\""
-      ],
-      "stdout_not_contains": []
-    }
-  ],
-  "forbidden_patterns": [
-    {
-      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{[^}]*return\\s+(null|undefined|'')",
-      "description": "silent catch returning fallback",
-      "files": [
-        "server/index.js"
-      ],
-      "severity": "disqualifier"
-    },
-    {
-      "pattern": "/\\*\\s*eslint-disable",
-      "description": "eslint-disable without explicit per-issue justification",
-      "files": [
-        "server/index.js"
-      ],
-      "severity": "disqualifier"
-    }
-  ],
-  "required_files": [
-    "server/index.js",
-    "tests/server.test.js"
-  ],
-  "forbidden_files": [],
-  "max_deps_added": 0,
-  "spec_output_files": [
-    "server/index.js",
-    "tests/server.test.js"
-  ]
-}

package/benchmark/auto-resolve/fixtures/F3-backend-contract-risk/metadata.json

@@ -1,19 +0,0 @@
-{
-  "id": "F3-backend-contract-risk",
-  "category": "high-risk",
-  "difficulty": "high",
-  "timeout_seconds": 1500,
-  "required_tools": ["node"],
-  "browser": false,
-  "deps_change_expected": false,
-  "intent": "Change the GET /items response shape from { items } to a paginated { items, total, page, per_page } while keeping the existing 1-based id semantics and updating tests. A lazy implementation will leave tests broken or drop the items array — the spec requires both.",
-  "pair_plan_oracle_categories": [
-    "scope-tier-a:lockfile-deletion",
-    "scope-tier-a:tier-a-violation",
-    "scope-tier-b:scope-unmatched",
-    "test-fidelity:assertion-regression",
-    "test-fidelity:mock-swap",
-    "test-fidelity:test-file-deleted",
-    "test-fidelity:test-file-renamed"
-  ]
-}

package/benchmark/auto-resolve/fixtures/F3-backend-contract-risk/setup.sh

@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-# F3 setup — no changes to base test-repo. Task modifies existing server/index.js.
-set -e
-exit 0

package/benchmark/auto-resolve/fixtures/F3-backend-contract-risk/spec.md

@@ -1,55 +0,0 @@
----
-id: "F3-backend-contract-risk"
-title: "Paginate GET /items response"
-status: planned
-complexity: high
-depends-on: []
----
-
-# F3 Paginate `GET /items`
-
-## Context
-
-`server/index.js` currently returns `{ items: [...] }` for `GET /items` with
-no pagination metadata. As the dataset grows, clients need a `total` and
-paging information. The task: wrap the existing response in a pagination
-envelope, accept `?page` and `?per_page` query parameters, and update tests
-so existing assertions continue to pass alongside new paging assertions.
-
-## Requirements
-
-- [ ] `GET /items` (no query) returns `{ items, total, page, per_page }` where:
-  - `items` is the full list (baseline repo has 2 items).
-  - `total` is the full item count.
-  - `page` is `1`.
-  - `per_page` is the full item count when no pagination was requested.
-- [ ] `GET /items?page=1&per_page=1` returns the first item wrapped in the envelope with `items.length === 1`, `total === 2`, `page === 1`, `per_page === 1`.
-- [ ] `GET /items?page=2&per_page=1` returns the second item similarly.
-- [ ] `GET /items?page=99&per_page=1` returns `items: []`, `total === 2`, `page === 99`, `per_page === 1` (out-of-range page is allowed — bare empty array, never a 404).
-- [ ] `GET /items/:id` behavior unchanged (the per-item route does NOT get paginated).
-- [ ] `tests/server.test.js` is updated so every existing assertion still holds (semantically) AND the new paging behavior is covered by at least two new tests.
-- [ ] `GET /health` continues to return `{ status: 'ok' }` unchanged.
-
-## Constraints
-
-- **No new npm dependencies.** Use only Express + built-ins already in the repo.
-- **No silent catches.** Invalid `page` or `per_page` (non-numeric, zero, negative) must respond 400 with `{ error: 'invalid_query', field }`.
-- **No breaking change to `/items/:id`.** The per-item route must keep its current contract (the fixture explicitly does NOT paginate single-item lookups).
-- **Backward-compat note**: clients that previously read `response.items` MUST still get the array at the same key inside the new envelope.
-
-
-## Out of Scope
-
-- Caching, rate limiting, authentication.
-- Converting `items` to a database-backed list.
-- Touching `bin/cli.js`, `web/`, or `tests/cli.test.js`.
-- Adding a new route.
-
-## Verification
-
-- Server start: `node server/index.js` listens on port 3000 (exit via SIGINT).
-- `curl -s http://127.0.0.1:3000/items | jq '.total'` returns `2`.
-- `curl -s 'http://127.0.0.1:3000/items?per_page=1&page=2' | jq '.items[0].name'` returns `"beta"`.
-- `curl -s 'http://127.0.0.1:3000/items?per_page=abc'` returns HTTP status `400` with JSON error body `{ "error": "invalid_query", "field": "per_page" }`.
-- `node --test tests/server.test.js` passes; must include ≥ 2 new paging tests.
-- `git diff --stat` shows only `server/index.js` and `tests/server.test.js` touched.

package/benchmark/auto-resolve/fixtures/F3-backend-contract-risk/task.txt

@@ -1,9 +0,0 @@
-The `GET /items` endpoint in `server/index.js` currently returns `{ items: [...] }`. Paginate it: the response should be `{ items, total, page, per_page }`. Accept `?page` and `?per_page` query params. When no params are given, return everything on page 1 with `per_page` equal to the full count.
-
-Keep `GET /items/:id` unchanged (no pagination on single-item lookup). `GET /health` stays as-is.
-
-Invalid `page` or `per_page` (non-numeric, zero, negative) → respond 400 with `{ error: 'invalid_query', field: '<name>' }`. Out-of-range page (beyond the last item) returns an empty `items` array, NOT a 404.
-
-Update `tests/server.test.js` so existing behavior is still covered AND you add at least two new tests for the paging behavior.
-
-No new npm dependencies. Only touch `server/index.js` and `tests/server.test.js`.

package/benchmark/auto-resolve/fixtures/F31-cli-seat-rebalance/NOTES.md

@@ -1,34 +0,0 @@
-# F31 CLI seat rebalance
-
-## Failure mode
-
-This fixture detects implementations that pass simple entitlement updates while
-missing the interaction between priority ordering, transfer rollback, rejected
-row ordering, and exact machine-readable error handling.
-
-## Pipeline phase target
-
-PLAN must preserve the ordering distinction between processing order and
-rejected-output order. IMPLEMENT must keep transfer mutations all-or-nothing.
-VERIFY should build adversarial cases where a later high-priority transfer
-changes the outcome of an earlier low-priority reserve, and where a failed
-transfer would corrupt state if mutations are applied too early.
-
-## Why existing fixtures do not cover it
-
-F21 covers scheduling priority and blocked intervals. F23 covers inventory
-allocation rollback. F25 covers checkout calculation order. This fixture covers
-account entitlement reconciliation with a different state shape and a duplicate
-event-id hard error.
-
-## Retirement
-
-Headroom run `20260512-f31-seat-rebalance-headroom` rejected this fixture as
-pair-lift evidence: bare scored 33 but carried judge/result/verify
-disqualifiers, and solo_claude scored 98 with all 3 verification commands
-passing. It should remain a control fixture unless reworked to lower the solo
-ceiling.
-
-Retire or replace this fixture if either `bare` or `solo_claude` consistently
-reaches ceiling, or if a later fixture covers priority event processing plus
-all-or-nothing transfer rollback with cleaner full-pipeline lift.

package/benchmark/auto-resolve/fixtures/F31-cli-seat-rebalance/expected.json

@@ -1,57 +0,0 @@
-{
-  "verification_commands": [
-    {
-      "cmd": "node --test tests/cli.test.js",
-      "exit_code": 0,
-      "stdout_contains": [],
-      "stdout_not_contains": ["not ok "]
-    },
-    {
-      "cmd": "node \"$BENCH_FIXTURE_DIR/verifiers/priority-transfer-rollback.js\"",
-      "exit_code": 0,
-      "stdout_contains": ["\"ok\":true"],
-      "stdout_not_contains": [],
-      "contract_refs": [
-        "Process events globally by `priority` descending, then `effective_at` ascending, then `id` ascending.",
-        "`transfer` is all-or-nothing. It accepts only when both accounts exist, the source has `used >= qty`, the destination has at least `qty` free seats, and both accounts have the same `region` unless `allow_cross_region` is `true`.",
-        "A rejected `transfer` must not change either account. Use reason `unknown_account`, `region_mismatch`, `insufficient_used`, or `no_capacity` for the first failing transfer rule in the order listed above.",
-        "`rejected` is ordered in the original input event order. Each row has keys `id`, `reason`.",
-        "`accounts` is sorted by account id ascending. Each row has keys `id`, `region`, `seats`, `used`, `free`, where `free = seats - used`.",
-        "On success, write exactly one JSON object to stdout and no stderr. Keys: `applied`, `rejected`, `accounts`."
-      ]
-    },
-    {
-      "cmd": "node \"$BENCH_FIXTURE_DIR/verifiers/duplicate-event-error.js\"",
-      "exit_code": 0,
-      "stdout_contains": ["\"ok\":true"],
-      "stdout_not_contains": [],
-      "contract_refs": [
-        "Before processing any event, duplicate event ids are invalid input: exit `2`, write exactly one JSON error object `{ \"error\": \"duplicate_event_id\", \"id\": string }` to stderr, and write no stdout."
-      ]
-    }
-  ],
-  "forbidden_patterns": [
-    {
-      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{[^}]*return\\s+(null|undefined|''|\\{\\})",
-      "description": "silent catch returning fallback in seat rebalance path",
-      "files": ["bin/cli.js", "tests/cli.test.js"],
-      "severity": "disqualifier"
-    },
-    {
-      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{\\s*\\}",
-      "description": "empty catch block",
-      "files": ["bin/cli.js", "tests/cli.test.js"],
-      "severity": "disqualifier"
-    },
-    {
-      "pattern": "/\\*\\s*eslint-disable",
-      "description": "eslint-disable without scoped justification",
-      "files": ["bin/cli.js"],
-      "severity": "disqualifier"
-    }
-  ],
-  "required_files": ["bin/cli.js", "tests/cli.test.js"],
-  "forbidden_files": [],
-  "max_deps_added": 0,
-  "spec_output_files": ["bin/cli.js", "tests/cli.test.js"]
-}

package/benchmark/auto-resolve/fixtures/F31-cli-seat-rebalance/metadata.json

@@ -1,10 +0,0 @@
-{
-  "id": "F31-cli-seat-rebalance",
-  "category": "high-risk",
-  "difficulty": "high",
-  "timeout_seconds": 1500,
-  "required_tools": ["node"],
-  "browser": false,
-  "deps_change_expected": false,
-  "intent": "Add a bench-cli rebalance-seats command that reads account capacity and seat events from a JSON file, processes events by priority with all-or-nothing transfers, rejects invalid per-event operations without corrupting state, and prints exact applied, rejected, and final account rows."
-}

package/benchmark/auto-resolve/fixtures/F31-cli-seat-rebalance/setup.sh

@@ -1,2 +0,0 @@
-#!/usr/bin/env bash
-set -e

package/benchmark/auto-resolve/fixtures/F31-cli-seat-rebalance/spec.md

@@ -1,67 +0,0 @@
----
-id: "F31-cli-seat-rebalance"
-title: "Seat rebalance command"
-status: planned
-complexity: high
-depends-on: []
----
-
-# F31 Seat rebalance command
-
-## Context
-
-`bench-cli` currently has greeting and version commands only. The task:
-add a `rebalance-seats` command that reads account capacity and seat events from
-a JSON file, processes events by priority with all-or-nothing transfers, rejects
-invalid per-event operations without corrupting state, and prints exact applied,
-rejected, and final account rows.
-
-This is account entitlement reconciliation. Downstream billing tools parse the
-output, so success and error output must be exact machine-readable JSON.
-
-## Requirements
-
-- [ ] `bench-cli rebalance-seats --input <path>` reads JSON shaped as `{ "accounts": [{ "id": string, "region": string, "seats": number, "used": number }], "events": [event] }`.
-- [ ] Valid event types are `reserve`, `release`, and `transfer`.
-- [ ] `reserve` events have keys `id`, `type`, `account`, `qty`, `priority`, and `effective_at`.
-- [ ] `release` events have keys `id`, `type`, `account`, `qty`, `priority`, and `effective_at`.
-- [ ] `transfer` events have keys `id`, `type`, `from`, `to`, `qty`, `priority`, `effective_at`, and optional `allow_cross_region`.
-- [ ] Before processing any event, duplicate event ids are invalid input: exit `2`, write exactly one JSON error object `{ "error": "duplicate_event_id", "id": string }` to stderr, and write no stdout.
-- [ ] Before processing any event, account rows must have unique ids, non-empty string `id` and `region`, integer `seats >= 0`, and integer `used` with `0 <= used <= seats`. Invalid account input exits `2` with one JSON error object and no stdout.
-- [ ] Before processing any event, every event `qty` must be a positive integer, every `priority` must be an integer, and every `effective_at` must be a non-empty string. Invalid event input exits `2` with one JSON error object and no stdout.
-- [ ] Process events globally by `priority` descending, then `effective_at` ascending, then `id` ascending.
-- [ ] `reserve` accepts only when the account exists and has at least `qty` free seats. On accept, increase that account's `used` by `qty`. Otherwise reject the event with reason `unknown_account` or `no_capacity`.
-- [ ] `release` accepts only when the account exists and `used >= qty`. On accept, decrease that account's `used` by `qty`. Otherwise reject the event with reason `unknown_account` or `insufficient_used`.
-- [ ] `transfer` is all-or-nothing. It accepts only when both accounts exist, the source has `used >= qty`, the destination has at least `qty` free seats, and both accounts have the same `region` unless `allow_cross_region` is `true`.
-- [ ] A rejected `transfer` must not change either account. Use reason `unknown_account`, `region_mismatch`, `insufficient_used`, or `no_capacity` for the first failing transfer rule in the order listed above.
-- [ ] On success, write exactly one JSON object to stdout and no stderr. Keys: `applied`, `rejected`, `accounts`.
-- [ ] `applied` is ordered in processing order. Each row has keys `id`, `type`.
-- [ ] `rejected` is ordered in the original input event order. Each row has keys `id`, `reason`.
-- [ ] `accounts` is sorted by account id ascending. Each row has keys `id`, `region`, `seats`, `used`, `free`, where `free = seats - used`.
-- [ ] `tests/cli.test.js` is updated. Existing tests still pass and at least two new tests cover `rebalance-seats`: one successful priority/transfer scenario and one validation failure.
-
-## Constraints
-
-- **No new npm dependencies.**
-- **No hidden mutable global state.** The command must derive output only from the input JSON for that invocation.
-- **No silent catches.** Parse and file-read failures must emit a visible JSON error to stderr and exit `2`.
-- **No extra stdout/stderr text** on the success path; downstream tooling parses stdout as JSON.
-
-## Out of Scope
-
-- Persisting account state between command invocations.
-- Adding billing invoices, plan catalogs, or currency calculations.
-- Adding web UI or server routes.
-- Touching `server/`, `web/`, or `tests/server.test.js`.
-
-## Verification
-
-- `node --test tests/cli.test.js` exits 0.
-- A later high-priority transfer is processed before an earlier low-priority reserve, and the low-priority reserve can lose capacity because of that ordering.
-- A rejected transfer leaves both source and destination account usage unchanged.
-- Region mismatch rejects a transfer unless `allow_cross_region` is `true`.
-- `rejected` rows are reported in the original input event order, even though processing order is priority based.
-- Duplicate event ids exit `2`, print exactly `{ "error": "duplicate_event_id", "id": string }` to stderr, and print no stdout.
-- Final `accounts` rows are sorted by id and include exact `free` values.
-- `git diff --stat` shows only `bin/cli.js` and `tests/cli.test.js` touched.
-- Solo-headroom hypothesis: solo_claude is expected to miss transfer rollback or rejected-row ordering under priority processing; observable command `node "$BENCH_FIXTURE_DIR/verifiers/priority-transfer-rollback.js"` exposes the miss.

package/benchmark/auto-resolve/fixtures/F31-cli-seat-rebalance/task.txt

@@ -1,7 +0,0 @@
-Add a bench-cli rebalance-seats command that reads account capacity and seat events from a JSON file, processes events by priority with all-or-nothing transfers, rejects invalid per-event operations without corrupting state, and prints exact applied, rejected, and final account rows.
-
-The command should be `bench-cli rebalance-seats --input <path>`. The input JSON has account rows with id, region, seats, and used, plus event rows for reserve, release, and transfer operations. Process all events by priority descending, then effective_at ascending, then id ascending.
-
-Transfers must be all-or-nothing: if either account is missing, the source lacks used seats, the destination lacks free seats, or the regions differ without allow_cross_region, reject the transfer and leave both accounts unchanged. Reserve and release should reject per-event failures without aborting the whole command. Duplicate event ids are invalid input and must exit 2 with exactly one JSON error object on stderr and no stdout.
-
-On success, stdout must be exactly one JSON object with applied rows in processing order, rejected rows in original input order, and final account rows sorted by account id with free = seats - used. Update `tests/cli.test.js` so existing tests still pass and at least two new tests cover rebalance-seats, including one successful priority/transfer scenario and one validation failure. Do not add dependencies or touch server/web files.

package/benchmark/auto-resolve/fixtures/F31-cli-seat-rebalance/verifiers/duplicate-event-error.js

@@ -1,35 +0,0 @@
-'use strict';
-const assert = require('node:assert');
-const { spawnSync } = require('node:child_process');
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-
-const work = process.env.BENCH_WORKDIR || process.cwd();
-const cli = path.join(work, 'bin', 'cli.js');
-const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'f31-duplicate-'));
-const input = path.join(tmp, 'events.json');
-
-fs.writeFileSync(input, JSON.stringify({
-  accounts: [
-    { id: 'team-a', region: 'us', seats: 5, used: 1 }
-  ],
-  events: [
-    { id: 'dup', type: 'reserve', account: 'team-a', qty: 1, priority: 2, effective_at: '2026-01-01T09:00:00Z' },
-    { id: 'dup', type: 'release', account: 'team-a', qty: 1, priority: 1, effective_at: '2026-01-01T09:01:00Z' }
-  ]
-}), 'utf8');
-
-const result = spawnSync('node', [cli, 'rebalance-seats', '--input', input], {
-  cwd: work,
-  encoding: 'utf8'
-});
-
-assert.strictEqual(result.status, 2);
-assert.strictEqual(result.stdout, '');
-assert.deepStrictEqual(JSON.parse(result.stderr), {
-  error: 'duplicate_event_id',
-  id: 'dup'
-});
-
-console.log(JSON.stringify({ ok: true }));