harnery 0.35.0 → 0.37.0

package/dist/core/diagnostics/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAC3D,eAAO,MAAM,iCAAiC,EAAG,CAAU,CAAC;AAC5D,eAAO,MAAM,+BAA+B,EAAG,CAAU,CAAC;AAC1D,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAC7D,eAAO,MAAM,iCAAiC,EAAG,CAAU,CAAC;AAC5D,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAC3D,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAE/D,eAAO,MAAM,wBAAwB;;;CAG3B,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAChF,MAAM,MAAM,8BAA8B,GACtC,SAAS,GACT,aAAa,GACb,mBAAmB,GACnB,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,SAAS,GAAG,UAAU,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,aAAa,GAAG,wBAAwB,GAAG,SAAS,CAAC;CAC9E;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,0BAA0B,GAC1B,yBAAyB,GACzB,6BAA6B,GAC7B,6BAA6B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,OAAO,gCAAgC,CAAC;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,sBAAsB,EAAE,8BAA8B,CAAC;IACvD,aAAa,EAAE,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0BAA0B,EAAE,MAAM,CAAC;IACnC,kCAAkC,EAAE,MAAM,CAAC;IAC3C,qBAAqB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC1D,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC5C;AAED,eAAO,MAAM,uBAAuB,8HAM1B,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,CAAC;IACpE,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,0BAA0B,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,OAAO,gCAAgC,CAAC;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC3C,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9C,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvC,MAAM,EAAE;QACN,UAAU,EAAE,0BAA0B,CAAC;QACvC,eAAe,EAAE,wBAAwB,CAAC;QAC1C,aAAa,EAAE,eAAe,CAAC;KAChC,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,+BAA+B,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,OAAO,+BAA+B,CAAC;IACvD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,OAAO,kCAAkC,CAAC;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC,YAAY,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACtD,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,OAAO,iCAAiC,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,cAAc,CAAC;IAChC,SAAS,EAAE,mBAAmB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,wBAAwB,CAAC;IACnC,YAAY,EAAE,sBAAsB,CAAC;IACrC,UAAU,EAAE,oBAAoB,CAAC;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,iCAAiC,CAAC;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,0BAA0B,GAClC,YAAY,GACZ,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,GACV,WAAW,CAAC;AAEhB,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,UAAU,GAAG,YAAY,CAAC;AAE/E,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EACD,UAAU,GACV,OAAO,GACP,kBAAkB,GAClB,qBAAqB,GACrB,OAAO,GACP,uBAAuB,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,4BAA4B,CAAC;IAC3C,MAAM,EAAE,0BAA0B,CAAC;IACnC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACxD;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,SAAS,8BAA8B,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC,CAAC,CAAC;IACnD,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,KAAK,CAAC,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EACA,0BAA0B,GAC1B,wBAAwB,GACxB,iBAAiB,GACjB,wBAAwB,GACxB,uBAAuB,GACvB,2BAA2B,GAC3B,yBAAyB,GACzB,8BAA8B,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,aAAa,EAAE,IAAI,CAAC;IACpB,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,EAAE,6BAA6B,CAAC;IACrC,aAAa,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,QAAQ,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACjD,MAAM,EAAE;QACN,MAAM,EAAE,gBAAgB,CAAC;QACzB,KAAK,EAAE,gBAAgB,CAAC;QACxB,SAAS,EAAE,WAAW,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,SAAS,2BAA2B,EAAE,CAAC;KAC9C,CAAC;IACF,YAAY,EAAE,SAAS,8BAA8B,EAAE,CAAC;IACxD,WAAW,EAAE,kCAAkC,CAAC,2BAA2B,CAAC,CAAC;IAC7E,gBAAgB,EAAE,kCAAkC,CAAC,gCAAgC,CAAC,CAAC;IACvF,iBAAiB,EAAE,MAAM,CAAC;CAC3B"}

package/dist/core/diagnostics/contract.js

@@ -0,0 +1,18 @@
+export const DIAGNOSTIC_BUNDLE_SCHEMA_VERSION = 3;
+export const DIAGNOSTIC_COMMAND_SCHEMA_VERSION = 1;
+export const DIAGNOSTIC_INPUT_SCHEMA_VERSION = 2;
+export const DIAGNOSTIC_EXPECTED_SCHEMA_VERSION = 3;
+export const DIAGNOSTIC_SUMMARY_SCHEMA_VERSION = 1;
+export const DIAGNOSTIC_ADVICE_SCHEMA_VERSION = 1;
+export const DIAGNOSTIC_COMPARISON_SCHEMA_VERSION = 1;
+export const DIAGNOSTIC_ADVICE_LIMITS = {
+    max_contributing_findings: 8,
+    max_reasons: 4,
+};
+export const DIAGNOSTIC_BUNDLE_FILES = [
+    "diagnostic-manifest.json",
+    "inputs/observations.json",
+    "inputs/thresholds.json",
+    "expected.json",
+    "summary.json",
+];

package/dist/core/diagnostics/identity.d.ts

@@ -0,0 +1,3 @@
+/** Stable within one machine label, but not reversible to that label. */
+export declare function pseudonymousMachineId(machineLabel?: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/core/diagnostics/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/identity.ts"],"names":[],"mappings":"AAGA,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,YAAY,SAAwB,GAAG,MAAM,CAMlF"}

package/dist/core/diagnostics/identity.js

@@ -0,0 +1,10 @@
+import { createHash } from "node:crypto";
+import { resolveMachineLabel } from "../../lib/machine.js";
+/** Stable within one machine label, but not reversible to that label. */
+export function pseudonymousMachineId(machineLabel = resolveMachineLabel()) {
+    const digest = createHash("sha256")
+        .update("harnery-diagnostic-machine-v1\0")
+        .update(machineLabel)
+        .digest("hex");
+    return `machine_${digest}`;
+}

package/dist/core/diagnostics/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./advice.js";
+export * from "./bundle.js";
+export * from "./comparison.js";
+export * from "./contract.js";
+export * from "./identity.js";
+export * from "./replay.js";
+export * from "./sanitize.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/diagnostics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/dist/core/diagnostics/index.js

@@ -0,0 +1,7 @@
+export * from "./advice.js";
+export * from "./bundle.js";
+export * from "./comparison.js";
+export * from "./contract.js";
+export * from "./identity.js";
+export * from "./replay.js";
+export * from "./sanitize.js";

package/dist/core/diagnostics/replay.d.ts

@@ -0,0 +1,8 @@
+import { type DiagnosticExpected, type DiagnosticObservations, type DiagnosticThresholds } from "./contract.js";
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256(value: string | Buffer): string;
+/** Record the live engine's frozen output. Replay never uses this as an input. */
+export declare function deriveCapturedExpected(observations: DiagnosticObservations, thresholds: DiagnosticThresholds): DiagnosticExpected;
+/** Re-run the pure finding engine from frozen source inputs only. */
+export declare function replayDiagnosticInputs(observations: DiagnosticObservations, thresholds: DiagnosticThresholds): DiagnosticExpected;
+//# sourceMappingURL=replay.d.ts.map

package/dist/core/diagnostics/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/replay.ts"],"names":[],"mappings":"AA0BA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAE3B,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAC;AAEvB,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAErD;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,sBAAsB,EACpC,UAAU,EAAE,oBAAoB,GAC/B,kBAAkB,CAkBpB;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,sBAAsB,EACpC,UAAU,EAAE,oBAAoB,GAC/B,kBAAkB,CAiDpB"}

package/dist/core/diagnostics/replay.js

@@ -0,0 +1,213 @@
+import { createHash } from "node:crypto";
+import { RESOURCE_SNAPSHOT_SCHEMA_VERSION } from "../resources/contract.js";
+import { SUPERVISOR_HISTORY_SCHEMA_VERSION, SUPERVISOR_LOG_FEED_SCHEMA_VERSION, SUPERVISOR_SNAPSHOT_SCHEMA_VERSION, } from "../supervisor/contract.js";
+import { explainSupervisorFinding } from "../supervisor/explanations.js";
+import { updateSupervisorFindings } from "../supervisor/findings.js";
+import { projectHookHealth } from "../supervisor/hook-health.js";
+import { buildSupervisorTimeline } from "../supervisor/timeline.js";
+import { buildDiagnosticAdvice } from "./advice.js";
+import { DIAGNOSTIC_EXPECTED_SCHEMA_VERSION, } from "./contract.js";
+export function canonicalJson(value) {
+    return JSON.stringify(sortValue(value));
+}
+export function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+/** Record the live engine's frozen output. Replay never uses this as an input. */
+export function deriveCapturedExpected(observations, thresholds) {
+    const selection = observations.selection;
+    const findings = filterFindings(findingsProjection(sourceValue(observations, "supervisor.findings")), selection);
+    const coordination = sourceValue(observations, "coordination.health");
+    const relatedSources = coordination?.recent_events ?? [];
+    return expected(thresholds, selection, findings, findings.map((finding) => diagnosticTimeline(finding, relatedSources)), findings.map(explainSupervisorFinding), observations);
+}
+/** Re-run the pure finding engine from frozen source inputs only. */
+export function replayDiagnosticInputs(observations, thresholds) {
+    const resource = optionalSource(observations, "resources.snapshot") ??
+        neutralResource(observations.captured_at);
+    const supervisor = optionalSource(observations, "supervisor.snapshot") ??
+        neutralSupervisor(observations.captured_at);
+    const history = optionalSource(observations, "supervisor.history") ?? neutralHistory();
+    const logFeed = optionalSource(observations, "supervisor.log-feed") ??
+        neutralLogFeed(observations.captured_at);
+    const hookHealth = projectHookHealth(logFeed, new Date(observations.captured_at));
+    const coordination = optionalSource(observations, "coordination.health");
+    const activity = optionalSource(observations, "supervisor.activity");
+    const currentProjection = optionalSource(observations, "supervisor.findings");
+    const observedAt = currentProjection?.active[0]?.observed_at ??
+        currentProjection?.transitions.at(-1)?.observed_at ??
+        resource.sampled_at;
+    // The frozen projection supplies lifecycle state only. Candidates, severity,
+    // attribution, workload context, and evidence are all re-evaluated from the
+    // captured source observations. Without this prior state, a replay would
+    // mint fresh IDs and discard recurrence and peak history for open episodes.
+    const evaluated = updateSupervisorFindings({
+        previous: currentProjection,
+        resource,
+        services: supervisor.services,
+        hooks: supervisor.hooks,
+        history,
+        logFeed,
+        hookHealth,
+        coordination,
+        activity,
+        now: new Date(observedAt),
+    });
+    const findings = filterFindings(findingsProjection(evaluated), observations.selection);
+    const relatedSources = coordination?.recent_events ?? [];
+    return expected(thresholds, observations.selection, findings, findings.map((finding) => diagnosticTimeline(finding, relatedSources)), findings.map(explainSupervisorFinding), observations);
+}
+function diagnosticTimeline(finding, relatedSources) {
+    return buildSupervisorTimeline(finding, relatedSources.filter((source) => {
+        const delta = Math.abs(Date.parse(source.observed_at) - Date.parse(finding.observed_at));
+        return Number.isFinite(delta) && delta <= 5 * 60_000;
+    }));
+}
+function expected(thresholds, selection, findings, timelines, explanations, observations) {
+    return {
+        schema_version: DIAGNOSTIC_EXPECTED_SCHEMA_VERSION,
+        threshold_digest: sha256(canonicalJson(thresholds)),
+        selection,
+        findings,
+        timelines: [...timelines].sort((left, right) => left.finding_id.localeCompare(right.finding_id)),
+        explanations: [...explanations].sort((left, right) => left.finding_id.localeCompare(right.finding_id)),
+        advice: buildDiagnosticAdvice({
+            findings,
+            sourceCapability: capturedSourceCapability(observations, "supervisor.findings"),
+            evaluatedAt: observations.captured_at,
+        }),
+    };
+}
+function capturedSourceCapability(observations, sourceKind) {
+    const source = observations.sources.find((candidate) => candidate.source_kind === sourceKind);
+    return source
+        ? {
+            source_kind: sourceKind,
+            state: source.capability,
+            reason_code: source.reason_code,
+        }
+        : {
+            source_kind: sourceKind,
+            state: "unsupported",
+            reason_code: "source_missing",
+        };
+}
+function findingsProjection(value) {
+    const record = object(value);
+    return [
+        ...collectNamedRecords(record?.active),
+        ...collectNamedRecords(record?.transitions),
+    ];
+}
+function filterFindings(rows, selection) {
+    const deduped = new Map(rows.map((finding) => [finding.id, finding]));
+    return [...deduped.values()]
+        .filter((finding) => {
+        if (selection.finding_id)
+            return finding.id === selection.finding_id;
+        const observed = Date.parse(finding.observed_at);
+        return observed >= Date.parse(selection.start_at) && observed <= Date.parse(selection.end_at);
+    })
+        .sort((left, right) => left.observed_at.localeCompare(right.observed_at) || left.id.localeCompare(right.id));
+}
+function optionalSource(observations, sourceKind) {
+    const source = observations.sources.find((candidate) => candidate.source_kind === sourceKind);
+    return source?.capability === "supported" && source.value !== undefined
+        ? source.value
+        : undefined;
+}
+function neutralResource(sampledAt) {
+    return {
+        schema_version: RESOURCE_SNAPSHOT_SCHEMA_VERSION,
+        sampled_at: sampledAt,
+        interval_ms: null,
+        sample_duration_ms: 0,
+        collector_cpu_ms: 0,
+        platform: "linux",
+        namespace: "unknown",
+        support: {
+            state: "unsupported",
+            sampler: "unsupported",
+            reason: "captured-source-unavailable",
+        },
+        machine: {
+            cpu_percent: null,
+            cpu_logical_count: 0,
+            load_average: null,
+            memory_total_bytes: null,
+            memory_available_bytes: null,
+            memory_used_bytes: null,
+            memory_percent: null,
+            swap_total_bytes: null,
+            swap_used_bytes: null,
+            process_count: 0,
+        },
+        groups: [],
+        processes: [],
+        visible_process_count: 0,
+        omitted_process_count: 0,
+        unattributed_process_count: 0,
+    };
+}
+function neutralSupervisor(sampledAt) {
+    return {
+        schema_version: SUPERVISOR_SNAPSHOT_SCHEMA_VERSION,
+        sampled_at: sampledAt,
+        sequence: 0,
+        collector_duration_ms: 0,
+        resource_sample_duration_ms: 0,
+        services: [],
+        hooks: [],
+        active_finding_count: 0,
+        history_point_count: 0,
+        log_record_count: 0,
+        live_consumer_count: 0,
+        attributed_agent_count: 0,
+    };
+}
+function neutralHistory() {
+    return {
+        schema_version: SUPERVISOR_HISTORY_SCHEMA_VERSION,
+        interval_ms: 10_000,
+        max_points: 90,
+        points: [],
+    };
+}
+function neutralLogFeed(capturedAt) {
+    return {
+        schema_version: SUPERVISOR_LOG_FEED_SCHEMA_VERSION,
+        captured_at: capturedAt,
+        sequence: 0,
+        lanes: [],
+        total_records: 0,
+        unavailable_families: 0,
+    };
+}
+function sourceValue(observations, sourceKind) {
+    return observations.sources.find((source) => source.source_kind === sourceKind)?.value;
+}
+function collectNamedRecords(value) {
+    if (Array.isArray(value))
+        return value.filter(isObject);
+    const record = object(value);
+    if (!record)
+        return [];
+    if (Array.isArray(record.rows))
+        return record.rows.filter(isObject);
+    return Object.values(record).filter(isObject);
+}
+function sortValue(value) {
+    if (Array.isArray(value))
+        return value.map(sortValue);
+    if (!isObject(value))
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, item]) => [key, sortValue(item)]));
+}
+function object(value) {
+    return isObject(value) ? value : undefined;
+}
+function isObject(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}

package/dist/core/diagnostics/sanitize.d.ts

@@ -0,0 +1,9 @@
+export interface SanitizationStats {
+    sanitized_value_count: number;
+    omitted_value_count: number;
+}
+export declare function sanitizeDiagnosticValue(value: unknown): {
+    value: unknown;
+    stats: SanitizationStats;
+};
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/core/diagnostics/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/core/diagnostics/sanitize.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG;IACvD,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAGA"}

package/dist/core/diagnostics/sanitize.js

@@ -0,0 +1,84 @@
+const SENSITIVE_KEY = /(?:authorization|cookie|credential|password|passwd|private[_-]?key|secret|session[_-]?token|access[_-]?token|refresh[_-]?token|api[_-]?key)/i;
+const OMITTED_CONTENT_KEY = /(?:^|[_-])(?:environment|env|prompt|prompts|tool[_-]?payload|tool[_-]?result|transcript|transcripts)(?:$|[_-])/i;
+const HOME_PATH = /(?:[A-Za-z]:\\Users\\[^\\\s]+|\/home\/[^/\s]+|\/Users\/[^/\s]+)/g;
+const BEARER_VALUE = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
+const URL_CREDENTIALS = /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi;
+const PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+const TOKENISH_VALUE = /\b(?:sk|pk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{16,}\b/g;
+const AWS_ACCESS_KEY = /\bAKIA[A-Z0-9]{16,}\b/g;
+const SENSITIVE_QUERY = /([?&](?:access_token|api_key|key|password|secret|token)=)[^&#\s]+/gi;
+const SENSITIVE_ENV = /(\b[A-Z0-9_]*(?:API_KEY|PASSWORD|SECRET|TOKEN)=)[^\s]+/g;
+const SENSITIVE_ARGUMENT = /(\B--?(?:access-token|api-key|password|secret|token)\s+)[^\s]+/gi;
+export function sanitizeDiagnosticValue(value) {
+    const stats = { sanitized_value_count: 0, omitted_value_count: 0 };
+    return { value: sanitize(value, stats, 0), stats };
+}
+function sanitize(value, stats, depth) {
+    if (depth > 24) {
+        stats.omitted_value_count += 1;
+        return "[OMITTED:depth-limit]";
+    }
+    if (value === null || typeof value === "boolean" || typeof value === "number")
+        return value;
+    if (typeof value === "string")
+        return sanitizeString(value, stats);
+    if (Array.isArray(value)) {
+        const sliced = value.slice(0, 5_000);
+        const kept = sliced.map((item, index) => {
+            if (typeof sliced[index - 1] === "string" &&
+                /^(?:--?)(?:access-token|api-key|password|secret|token)$/i.test(sliced[index - 1])) {
+                stats.sanitized_value_count += 1;
+                return "[REDACTED:argument]";
+            }
+            return sanitize(item, stats, depth + 1);
+        });
+        if (kept.length !== value.length)
+            stats.omitted_value_count += value.length - kept.length;
+        return kept;
+    }
+    if (!value || typeof value !== "object")
+        return String(value);
+    const result = {};
+    const entries = Object.entries(value);
+    const namedSensitiveField = entries.some(([key, item]) => key === "name" && typeof item === "string" && SENSITIVE_KEY.test(item));
+    for (const [key, item] of entries) {
+        if (OMITTED_CONTENT_KEY.test(key)) {
+            result[key] = "[OMITTED:sensitive-content]";
+            stats.omitted_value_count += 1;
+            continue;
+        }
+        if (key === "value" && namedSensitiveField) {
+            result[key] = "[REDACTED:sensitive-field]";
+            stats.sanitized_value_count += 1;
+            continue;
+        }
+        if (SENSITIVE_KEY.test(key)) {
+            result[key] = "[REDACTED:sensitive-field]";
+            stats.sanitized_value_count += 1;
+            continue;
+        }
+        result[key] = sanitize(item, stats, depth + 1);
+    }
+    return result;
+}
+function sanitizeString(value, stats) {
+    let next = value;
+    const replacements = [
+        [PRIVATE_KEY, "[REDACTED:private-key]"],
+        [BEARER_VALUE, "Bearer [REDACTED:token]"],
+        [TOKENISH_VALUE, "[REDACTED:token]"],
+        [AWS_ACCESS_KEY, "[REDACTED:access-key]"],
+        [SENSITIVE_QUERY, "$1[REDACTED]"],
+        [SENSITIVE_ENV, "$1[REDACTED]"],
+        [SENSITIVE_ARGUMENT, "$1[REDACTED]"],
+        [URL_CREDENTIALS, (_match, scheme) => `${scheme}[REDACTED]@`],
+        [HOME_PATH, "[REDACTED:home]"],
+    ];
+    for (const [pattern, replacement] of replacements) {
+        const replaced = next.replace(pattern, replacement);
+        if (replaced !== next)
+            stats.sanitized_value_count += 1;
+        next = replaced;
+    }
+    return next;
+}

package/dist/core/events/legacy-storage/canary.d.ts

@@ -0,0 +1,18 @@
+import { type LegacyV1SegmentManifest } from "./manifest.js";
+export interface LegacyV1CanaryResult {
+    manifest: LegacyV1SegmentManifest;
+    manifest_path: string;
+    payload_path: string;
+    source_unchanged: true;
+    replacement_enabled: false;
+}
+/** Shadow-compress one fenced legacy segment, then prove byte and row parity. */
+export declare function writeLegacyV1Canary(input: {
+    coord_root: string;
+    source_filename: string;
+    output_directory: string;
+    minimum_harnery_version: string;
+    created_at: string;
+}): Promise<LegacyV1CanaryResult>;
+export declare function activateLegacyV1CanaryReplacement(): never;
+//# sourceMappingURL=canary.d.ts.map

package/dist/core/events/legacy-storage/canary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/canary.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,uBAAuB,EAAmC,MAAM,eAAe,CAAC;AAG9F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,IAAI,CAAC;IACvB,mBAAmB,EAAE,KAAK,CAAC;CAC5B;AAED,iFAAiF;AACjF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyFhC;AAED,wBAAgB,iCAAiC,IAAI,KAAK,CAEzD"}

package/dist/core/events/legacy-storage/canary.js

@@ -0,0 +1,150 @@
+import { createHash } from "node:crypto";
+import { constants, createReadStream, createWriteStream } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
+import { basename, join, resolve } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { createGzip } from "node:zlib";
+import { canonicalJsonV3 } from "../v3/canonical.js";
+import { verifyLegacyV1HardFence } from "./fence.js";
+import { validateLegacyV1SegmentManifest } from "./manifest.js";
+import { streamLegacyV1Rows } from "./reader.js";
+/** Shadow-compress one fenced legacy segment, then prove byte and row parity. */
+export async function writeLegacyV1Canary(input) {
+    await verifyLegacyV1HardFence(input.coord_root);
+    if (!/^events.+\.ndjson$/.test(input.source_filename) ||
+        input.source_filename.includes("/") ||
+        input.source_filename.includes("\\")) {
+        throw new Error("legacy_v1_canary_source_name_invalid");
+    }
+    const harnery = resolve(input.coord_root, ".harnery");
+    const source = join(harnery, input.source_filename);
+    const sourceStat = await lstat(source);
+    if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
+        throw new Error("legacy_v1_canary_source_not_regular");
+    }
+    const sourceDigest = await hashFile(source);
+    const sourceFacts = await inspectRows(source);
+    const segmentId = `v1s_${createHash("sha256")
+        .update(`${input.source_filename}\0${sourceStat.size}\0${sourceDigest}`)
+        .digest("hex")
+        .slice(0, 32)}`;
+    const outputDirectory = resolve(input.output_directory);
+    await mkdir(outputDirectory, { recursive: true, mode: 0o700 });
+    await chmod(outputDirectory, 0o700);
+    const payloadPath = join(outputDirectory, `${segmentId}.ndjson.gz`);
+    const manifestPath = join(outputDirectory, `${segmentId}.manifest.json`);
+    const partialPayload = `${payloadPath}.partial`;
+    const partialManifest = `${manifestPath}.partial`;
+    await rejectExisting([payloadPath, manifestPath, partialPayload, partialManifest]);
+    try {
+        await pipeline(createReadStream(source), createGzip({ level: 9 }), createWriteStream(partialPayload, { flags: "wx", mode: 0o600 }));
+        await rename(partialPayload, payloadPath);
+        const payloadStat = await lstat(payloadPath);
+        const manifest = validateLegacyV1SegmentManifest({
+            format: "harnery-legacy-v1-segment",
+            format_version: 1,
+            segment_id: segmentId,
+            source: {
+                filename: input.source_filename,
+                bytes: sourceStat.size,
+                digest: sourceDigest,
+                row_count: sourceFacts.rows,
+                minimum_recorded_at: sourceFacts.minimum,
+                maximum_recorded_at: sourceFacts.maximum,
+            },
+            payload: {
+                algorithm: "gzip",
+                path: basename(payloadPath),
+                bytes: payloadStat.size,
+                digest: await hashFile(payloadPath),
+            },
+            minimum_harnery_version: input.minimum_harnery_version,
+            created_at: input.created_at,
+        });
+        const handle = await open(partialManifest, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+        try {
+            await handle.writeFile(`${canonicalJsonV3(manifest)}\n`, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(partialManifest, manifestPath);
+        await proveRowParity(source, manifestPath);
+        const after = await lstat(source);
+        if (after.size !== sourceStat.size || (await hashFile(source)) !== sourceDigest) {
+            throw new Error("legacy_v1_canary_source_changed");
+        }
+        return {
+            manifest,
+            manifest_path: manifestPath,
+            payload_path: payloadPath,
+            source_unchanged: true,
+            replacement_enabled: false,
+        };
+    }
+    catch (error) {
+        await rm(partialPayload, { force: true });
+        await rm(partialManifest, { force: true });
+        await rm(payloadPath, { force: true });
+        await rm(manifestPath, { force: true });
+        throw error;
+    }
+}
+export function activateLegacyV1CanaryReplacement() {
+    throw new Error("legacy_v1_replacement_activation_disabled");
+}
+async function inspectRows(path) {
+    let rows = 0;
+    const timestamps = [];
+    for await (const row of streamLegacyV1Rows(path)) {
+        rows += 1;
+        const value = JSON.parse(row.bytes.toString("utf8"));
+        const candidate = typeof value.at === "string"
+            ? value.at
+            : typeof value.timestamp === "string"
+                ? value.timestamp
+                : value.time &&
+                    typeof value.time === "object" &&
+                    typeof value.time.observed_at === "string"
+                    ? value.time.observed_at
+                    : undefined;
+        if (candidate && Number.isFinite(Date.parse(candidate)))
+            timestamps.push(new Date(candidate).toISOString());
+    }
+    timestamps.sort();
+    return { rows, minimum: timestamps[0] ?? null, maximum: timestamps.at(-1) ?? null };
+}
+async function proveRowParity(loose, manifest) {
+    const left = streamLegacyV1Rows(loose)[Symbol.asyncIterator]();
+    const right = streamLegacyV1Rows(manifest)[Symbol.asyncIterator]();
+    while (true) {
+        const [looseRow, packedRow] = await Promise.all([left.next(), right.next()]);
+        if (looseRow.done || packedRow.done) {
+            if (looseRow.done !== packedRow.done)
+                throw new Error("legacy_v1_canary_row_count_mismatch");
+            break;
+        }
+        if (!looseRow.value.bytes.equals(packedRow.value.bytes)) {
+            throw new Error(`legacy_v1_canary_row_mismatch:${looseRow.value.row_number}`);
+        }
+    }
+}
+async function hashFile(path) {
+    const hash = createHash("sha256");
+    for await (const current of createReadStream(path))
+        hash.update(current);
+    return `sha256:${hash.digest("hex")}`;
+}
+async function rejectExisting(paths) {
+    for (const path of paths) {
+        try {
+            await lstat(path);
+            throw new Error("legacy_v1_canary_output_exists");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}

package/dist/core/events/legacy-storage/compression.d.ts

@@ -0,0 +1,13 @@
+/** Verified in-place compression for sealed, non-terminal legacy V1 shards. */
+export interface LegacyV1CompressionEntry {
+    filename: string;
+    path: string;
+    bytes_before: number;
+    bytes_after: number | null;
+    action: "keep" | "would-compress" | "compressed";
+    reason: string;
+}
+export declare function compressSealedLegacyV1Segments(coordRoot: string, opts?: {
+    yes?: boolean;
+}): Promise<LegacyV1CompressionEntry[]>;
+//# sourceMappingURL=compression.d.ts.map

package/dist/core/events/legacy-storage/compression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compression.d.ts","sourceRoot":"","sources":["../../../../src/core/events/legacy-storage/compression.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAW/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,YAAY,CAAC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,wBAAwB,EAAE,CAAC,CA0FrC"}