harnery 0.45.0 → 0.45.1

package/dist/core/turn-rollback/index.js

@@ -1,443 +0,0 @@
-import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { readJsonRecord, stableDigest, writeImmutableJson } from "../workflow/durable-record.js";
-import { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
-import { createLocalGitWorktreeProvider } from "../workflow/workspaces/local-git.js";
-import { claimOverlapsWorkspace, reserveWorkspaceReclaim, } from "../workflow/workspaces/ownership.js";
-import { descriptorBackedPathsSupported } from "../workflow/workspaces/paths.js";
-import { readWorkflowLiveness } from "../workflow/workspaces/recovery.js";
-import { appendWorkspaceEvent, readWorkspaceClaim, readWorkspaceClaims, workspaceLockPath, } from "../workflow/workspaces/state.js";
-import { currentMatches, ensureDirectory, git, lockIndex, observe, persistSnapshot, restoreFile, safePaths, stageBefore, verifySnapshot, } from "./content.js";
-const PROVIDER = "local-git-worktree";
-const CAPTURE = /^turn-[a-f0-9]{32}$/;
-const TOTAL_LIMIT = 64 * 1024 * 1024;
-function statePath(coordRoot, binding) {
-    if (binding?.provider?.id !== PROVIDER ||
-        !/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(binding.binding_id))
-        throw new Error("exclusive local provider binding is required");
-    return join(resolve(coordRoot), ".harnery", "turn-rollback", PROVIDER, binding.binding_id);
-}
-function capturePath(scope, id, name) {
-    if (!CAPTURE.test(id))
-        throw new Error("invalid capture id");
-    return join(scope.state, "captures", id, name);
-}
-function record(path) {
-    if (!lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
-        throw new Error("rollback record is unsafe");
-    return readJsonRecord(path, "turn rollback record");
-}
-function load(scope, id) {
-    if (!existsSync(capturePath(scope, id, "begin.json")))
-        throw new Error("capture outcome is unknown; incomplete pending capture blocks further turns");
-    const capture = record(capturePath(scope, id, "begin.json"));
-    const { sha256, end: invalidEnd, ...basis } = capture;
-    if (invalidEnd ||
-        sha256 !== stableDigest(basis) ||
-        capture.schema_version !== 1 ||
-        capture.capture_id !== id ||
-        capture.binding_sha256 !== stableDigest(scope.binding) ||
-        capture.binding_generation !== scope.binding.generation ||
-        !Number.isSafeInteger(capture.turn?.generation) ||
-        capture.turn.generation < 1 ||
-        !/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(capture.turn?.turn_id) ||
-        stableDigest(safePaths(scope.binding, capture.paths)) !== stableDigest(capture.paths) ||
-        stableDigest(capture.before.entries.map((entry) => entry.path)) !== stableDigest(capture.paths))
-        throw new Error("capture authority changed");
-    const sealed = capturePath(scope, id, "end.json");
-    if (existsSync(sealed)) {
-        const end = record(sealed);
-        if (end.capture_sha256 !== sha256 ||
-            stableDigest(end.snapshot.entries.map((entry) => entry.path)) !== stableDigest(capture.paths))
-            throw new Error("sealed capture authority changed");
-        return { ...capture, end: end.snapshot };
-    }
-    if (existsSync(capturePath(scope, id, "seal-pending.json")))
-        throw new Error("seal outcome is unknown; incomplete pending snapshot blocks further turns");
-    return capture;
-}
-function allCaptures(scope) {
-    const root = join(scope.state, "captures");
-    if (!existsSync(root))
-        return [];
-    const captures = readdirSync(root)
-        .map((id) => load(scope, id))
-        .sort((a, b) => a.turn.generation - b.turn.generation);
-    if (captures.length > 64 ||
-        new Set(captures.map((c) => c.turn.generation)).size !== captures.length)
-        throw new Error("capture generation or retention limit is invalid");
-    return captures;
-}
-function latest(scope, id) {
-    const capture = allCaptures(scope).at(-1);
-    if (!capture || capture.capture_id !== id)
-        throw new Error("restore requires the latest turn capture");
-    return capture;
-}
-function usage(captures) {
-    return captures.reduce((sum, c) => sum + c.before.total_bytes + (c.end?.total_bytes ?? 0), 0);
-}
-async function withScope(coordRoot, binding, operation) {
-    const state = statePath(coordRoot, binding);
-    if (!descriptorBackedPathsSupported())
-        throw new Error("descriptor-backed containment is unsupported");
-    const provider = createLocalGitWorktreeProvider({ coordRoot });
-    await provider.readBinding(binding);
-    const claim = readWorkspaceClaim(coordRoot, PROVIDER, binding.binding_id);
-    const authority = stableDigest({
-        binding_id: claim.binding_id,
-        request_sha256: claim.request_sha256,
-        scope: "binding",
-    });
-    const path = workspaceLockPath(coordRoot, PROVIDER, binding.binding_id);
-    const lease = acquireNoClobberLease({
-        path,
-        scope: "binding",
-        authoritySha256: authority,
-        staleAfterMs: 300_000,
-        metadata: { binding_id: claim.binding_id, request_sha256: claim.request_sha256 },
-        validateStaleOwner: (owner) => owner.authority_sha256 === authority &&
-            owner.metadata?.binding_id === claim.binding_id &&
-            owner.metadata?.request_sha256 === claim.request_sha256,
-    });
-    try {
-        const reservation = reserveWorkspaceReclaim(coordRoot, claim);
-        try {
-            const guard = async () => {
-                reservation.assertCurrent();
-                const ownerPath = join(path, lease.owner.owner_file);
-                const current = join(path, "current");
-                const a = lstatSync(current, { bigint: true });
-                const b = lstatSync(ownerPath, { bigint: true });
-                if (!a.isFile() ||
-                    a.dev !== b.dev ||
-                    a.ino !== b.ino ||
-                    readFileSync(current, "utf8") !== readFileSync(ownerPath, "utf8") ||
-                    stableDigest(record(current)) !== stableDigest(lease.owner))
-                    throw new Error("binding lease changed");
-                await provider.readBinding(binding);
-                const attestation = await provider.attest(binding);
-                if (attestation.status !== "ok" ||
-                    attestation.resource_state !== "active" ||
-                    attestation.repository?.conflicts.length ||
-                    attestation.repository?.operation_in_progress.length)
-                    throw new Error("workspace ownership is unproven");
-                for (const peer of readWorkspaceClaims(coordRoot, PROVIDER)) {
-                    if (peer.binding_id !== binding.binding_id &&
-                        claimOverlapsWorkspace(peer, claim.workspace_root))
-                        throw new Error(`retained peer ${peer.binding_id} overlaps rollback workspace`);
-                }
-            };
-            await guard();
-            ensureDirectory(state);
-            const store = join(state, "content.git");
-            if (!existsSync(store))
-                git(state, ["init", "--bare", "-q", store]);
-            ensureDirectory(store);
-            return await operation({
-                binding,
-                state,
-                store,
-                guard,
-                audit: (event, data) => {
-                    appendWorkspaceEvent(coordRoot, claim, `turn_rollback.${event}`, data);
-                },
-            });
-        }
-        finally {
-            reservation.release();
-        }
-    }
-    finally {
-        lease.release();
-    }
-}
-/** Capture the exact named files before a turn, without staging anything. */
-export async function beginTurnRollback(coordRoot, input) {
-    return withScope(coordRoot, input.binding, async (scope) => {
-        if (!input.turn ||
-            !/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(input.turn.turn_id) ||
-            !Number.isSafeInteger(input.turn.generation) ||
-            input.turn.generation < 1)
-            throw new Error("invalid turn identity");
-        const paths = safePaths(input.binding, input.paths);
-        const prior = allCaptures(scope);
-        const last = prior.at(-1);
-        if (last &&
-            (!last.end ||
-                input.turn.generation <= last.turn.generation ||
-                inspectTurnRollback(coordRoot, { binding: input.binding, capture_id: last.capture_id })
-                    .status === "unknown"))
-            throw new Error("latest turn is open, unknown, or newer");
-        if (prior.length >= 64)
-            throw new Error("capture count limit exceeded");
-        const index = lockIndex(input.binding, scope.state);
-        try {
-            const observed = observe(input.binding, scope.store, paths);
-            if (usage(prior) + observed.total > TOTAL_LIMIT)
-                throw new Error("binding retention byte limit exceeded");
-            await scope.guard();
-            const binding_sha256 = stableDigest(input.binding);
-            const capture_id = `turn-${stableDigest({ binding_sha256, turn: input.turn, paths }).slice(0, 32)}`;
-            ensureDirectory(join(scope.state, "captures", capture_id));
-            writeImmutableJson(capturePath(scope, capture_id, "pending.json"), {
-                schema_version: 1,
-                capture_id,
-                binding_sha256,
-                turn: input.turn,
-                paths,
-                phase: "before",
-                total_bytes: observed.total,
-            });
-            const before = persistSnapshot(scope.store, observed, `${capture_id}/before`);
-            input.onSnapshotStep?.("content_persisted", capture_id);
-            const basis = {
-                schema_version: 1,
-                capture_id,
-                binding_sha256,
-                binding_generation: input.binding.generation,
-                turn: { ...input.turn },
-                paths,
-                before,
-            };
-            const capture = { ...basis, sha256: stableDigest(basis) };
-            writeImmutableJson(capturePath(scope, capture_id, "begin.json"), capture);
-            scope.audit("captured", {
-                capture_id,
-                capture_sha256: capture.sha256,
-                turn: capture.turn,
-                paths,
-            });
-            return capture;
-        }
-        finally {
-            index.close();
-        }
-    });
-}
-/** Seal the end boundary of the latest captured turn. */
-export async function sealTurnRollback(coordRoot, input) {
-    return withScope(coordRoot, input.binding, async (scope) => {
-        const capture = latest(scope, input.capture_id);
-        verifySnapshot(scope.store, capture.before);
-        const index = lockIndex(input.binding, scope.state);
-        try {
-            if (capture.end) {
-                verifySnapshot(scope.store, capture.end);
-                if (!currentMatches(input.binding, scope.store, capture.end))
-                    throw new Error("sealed content changed");
-                return capture;
-            }
-            const observed = observe(input.binding, scope.store, capture.paths);
-            if (observed.head !== capture.before.head)
-                throw new Error("HEAD changed during turn");
-            if (usage(allCaptures(scope)) + observed.total > TOTAL_LIMIT)
-                throw new Error("binding retention byte limit exceeded");
-            await scope.guard();
-            writeImmutableJson(capturePath(scope, capture.capture_id, "seal-pending.json"), {
-                schema_version: 1,
-                capture_id: capture.capture_id,
-                binding_sha256: stableDigest(input.binding),
-                turn: capture.turn,
-                paths: capture.paths,
-                phase: "end",
-                total_bytes: observed.total,
-            });
-            const end = persistSnapshot(scope.store, observed, `${capture.capture_id}/end`);
-            input.onSnapshotStep?.("content_persisted", capture.capture_id);
-            writeImmutableJson(capturePath(scope, capture.capture_id, "end.json"), {
-                capture_sha256: capture.sha256,
-                snapshot: end,
-            });
-            scope.audit("sealed", {
-                capture_id: capture.capture_id,
-                capture_sha256: capture.sha256,
-                end_sha256: end.sha256,
-            });
-            return { ...capture, end };
-        }
-        finally {
-            index.close();
-        }
-    });
-}
-function planFor(capture) {
-    if (!capture.end)
-        throw new Error("turn capture is not sealed");
-    const basis = {
-        schema_version: 1,
-        capture_id: capture.capture_id,
-        binding_sha256: capture.binding_sha256,
-        turn: capture.turn,
-        before_sha256: capture.before.sha256,
-        end_sha256: capture.end.sha256,
-        paths: capture.paths.map((path, index) => ({
-            path,
-            before: capture.before.entries[index],
-            end: capture.end.entries[index],
-        })),
-    };
-    return { ...basis, plan_sha256: stableDigest(basis) };
-}
-/** Produce a dry-run exact-path proposal bound to both captured boundaries. */
-export async function prepareTurnRollback(coordRoot, input) {
-    return withScope(coordRoot, input.binding, async (scope) => {
-        const capture = latest(scope, input.capture_id);
-        const plan = planFor(capture);
-        verifySnapshot(scope.store, capture.before);
-        verifySnapshot(scope.store, capture.end);
-        const index = lockIndex(input.binding, scope.state);
-        try {
-            if (!currentMatches(input.binding, scope.store, capture.end))
-                throw new Error("selected content or HEAD changed since seal");
-            return plan;
-        }
-        finally {
-            index.close();
-        }
-    });
-}
-export async function applyTurnRollback(coordRoot, input) {
-    if (inspectTurnRollback(coordRoot, { binding: input.binding, capture_id: input.plan.capture_id })
-        .status === "unknown")
-        throw new Error("rollback outcome is unknown; automatic retry is refused");
-    return withScope(coordRoot, input.binding, async (scope) => {
-        const capture = latest(scope, input.plan.capture_id);
-        const expected = planFor(capture);
-        if (stableDigest(input.plan) !== stableDigest(expected))
-            throw new Error("rollback proposal digest changed");
-        verifySnapshot(scope.store, capture.before);
-        verifySnapshot(scope.store, capture.end);
-        const result = {
-            schema_version: 1,
-            capture_id: capture.capture_id,
-            plan_sha256: expected.plan_sha256,
-        };
-        const receiptPath = capturePath(scope, capture.capture_id, "receipt.json");
-        const startedPath = capturePath(scope, capture.capture_id, "started.json");
-        const index = lockIndex(input.binding, scope.state);
-        try {
-            if (existsSync(receiptPath)) {
-                const receipt = record(receiptPath);
-                if (receipt.schema_version !== 1 ||
-                    receipt.status !== "applied" ||
-                    receipt.plan_sha256 !== expected.plan_sha256 ||
-                    receipt.capture_id !== capture.capture_id ||
-                    !currentMatches(input.binding, scope.store, capture.before))
-                    throw new Error("applied receipt or restored content changed");
-                return { ...result, status: "already_applied" };
-            }
-            if (!currentMatches(input.binding, scope.store, capture.end))
-                throw new Error("selected content or HEAD changed since proposal");
-            if (!input.yes)
-                return { ...result, status: "preview" };
-            if (!input.actor?.trim() ||
-                !input.reason?.trim() ||
-                input.actor.length > 200 ||
-                input.reason.length > 1000)
-                throw new Error("actor and reason are required and bounded");
-            if (readWorkflowLiveness(coordRoot, input.binding.run_id) !== "inactive")
-                throw new Error("workflow must be proven inactive before rollback");
-            await scope.guard();
-            scope.audit("apply_requested", {
-                ...result,
-                turn: capture.turn,
-                actor: input.actor,
-                reason: input.reason,
-                paths: capture.paths,
-            });
-            writeImmutableJson(startedPath, {
-                ...result,
-                turn: capture.turn,
-                actor: input.actor,
-                reason: input.reason,
-            });
-            try {
-                input.onStep?.("started");
-                // Each published path changes the expected worktree for subsequent guards.
-                const progress = structuredClone(capture.end);
-                for (const [position, entry] of capture.before.entries.entries()) {
-                    await scope.guard();
-                    if (readWorkflowLiveness(coordRoot, input.binding.run_id) !== "inactive" ||
-                        !currentMatches(input.binding, scope.store, progress))
-                        throw new Error("content or workflow changed during restore");
-                    restoreFile(input.binding, scope.store, entry);
-                    progress.entries[position].worktree = entry.worktree;
-                    progress.entries[position].untracked =
-                        !progress.entries[position].index && entry.worktree !== null;
-                    input.onStep?.("worktree_published");
-                }
-                await scope.guard();
-                if (readWorkflowLiveness(coordRoot, input.binding.run_id) !== "inactive" ||
-                    !currentMatches(input.binding, scope.store, progress))
-                    throw new Error("content or workflow changed before index publication");
-                stageBefore(input.binding, scope.store, capture.before, index);
-                await scope.guard();
-                if (readWorkflowLiveness(coordRoot, input.binding.run_id) !== "inactive" ||
-                    !currentMatches(input.binding, scope.store, progress))
-                    throw new Error("content changed before index publication");
-                index.publish();
-                input.onStep?.("index_published");
-                await scope.guard();
-                if (readWorkflowLiveness(coordRoot, input.binding.run_id) !== "inactive" ||
-                    !currentMatches(input.binding, scope.store, capture.before))
-                    throw new Error("restored content verification failed");
-                const receipt = { ...result, status: "applied" };
-                scope.audit("applied", { ...result, turn: capture.turn, paths: capture.paths });
-                writeImmutableJson(receiptPath, receipt);
-                return receipt;
-            }
-            catch (error) {
-                scope.audit("unknown", { ...result, reason: String(error).slice(0, 1000) });
-                return { ...result, status: "unknown", reason: String(error) };
-            }
-        }
-        finally {
-            index.close();
-        }
-    });
-}
-/** Read recovery evidence without attempting to continue an interrupted restore. */
-export function inspectTurnRollback(coordRoot, input) {
-    const state = statePath(coordRoot, input.binding);
-    const scope = { state, binding: input.binding };
-    const beginPath = capturePath(scope, input.capture_id, "begin.json");
-    if (!existsSync(beginPath)) {
-        const pending = capturePath(scope, input.capture_id, "pending.json");
-        if (!existsSync(pending))
-            return { status: "missing", capture_id: input.capture_id };
-        const reservation = record(pending);
-        if (reservation.schema_version !== 1 ||
-            reservation.capture_id !== input.capture_id ||
-            reservation.binding_sha256 !== stableDigest(input.binding))
-            throw new Error("pending capture authority changed");
-        return { status: "unknown", capture_id: input.capture_id };
-    }
-    if (existsSync(capturePath(scope, input.capture_id, "seal-pending.json")) &&
-        !existsSync(capturePath(scope, input.capture_id, "end.json")))
-        return { status: "unknown", capture_id: input.capture_id };
-    const capture = load(scope, input.capture_id);
-    const started = existsSync(capturePath(scope, input.capture_id, "started.json"));
-    const receipt = existsSync(capturePath(scope, input.capture_id, "receipt.json"));
-    if (started) {
-        const pending = record(capturePath(scope, input.capture_id, "started.json"));
-        if (pending.schema_version !== 1 ||
-            pending.capture_id !== capture.capture_id ||
-            pending.plan_sha256 !== planFor(capture).plan_sha256 ||
-            stableDigest(pending.turn) !== stableDigest(capture.turn))
-            throw new Error("started restore authority changed");
-    }
-    if (receipt) {
-        const value = record(capturePath(scope, input.capture_id, "receipt.json"));
-        if (!started ||
-            value.schema_version !== 1 ||
-            value.status !== "applied" ||
-            value.capture_id !== capture.capture_id ||
-            value.plan_sha256 !== planFor(capture).plan_sha256)
-            throw new Error("restore receipt is unproven");
-    }
-    return {
-        status: started ? (receipt ? "applied" : "unknown") : capture.end ? "sealed" : "open",
-        capture_id: input.capture_id,
-    };
-}

package/dist/core/workflow/failure-evidence.d.ts

@@ -1,16 +0,0 @@
-import type { AdapterRawResult } from "../adapters/types.js";
-import type { SpawnFailureEvidence, SpawnOutputSource, SpawnResult } from "./types.js";
-export declare function unknownFailureEvidence(): SpawnFailureEvidence;
-/** Built-in subprocess adapters observe output and process-start failures.
- * Their current vendor envelopes do not prove effects or native refusal.
- * In particular, blank output and 429/5xx statuses leave both unknown. */
-export declare function observeSpawnFailure(raw: Pick<AdapterRawResult, "spawnErrno" | "timedOut"> & Partial<Pick<AdapterRawResult, "stdout" | "resultFileText">>, text: string, source: SpawnOutputSource): SpawnFailureEvidence;
-export declare function isSpawnFailureEvidence(value: unknown): value is SpawnFailureEvidence;
-/** Missing observations are unknown; malformed positive claims are rejected.
- * This is also used when reading persisted workflow proof. */
-export declare function resolveFailureEvidence(value: unknown): SpawnFailureEvidence;
-export declare function failureEvidenceAllowsUncharged(value: unknown): boolean;
-/** A provider retry requires positive no-effect evidence. A missing binary is
- * known not to have started, but retrying that unchanged environment cannot help. */
-export declare function canRetryFailedSpawn(result: SpawnResult): boolean;
-//# sourceMappingURL=failure-evidence.d.ts.map

package/dist/core/workflow/failure-evidence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"failure-evidence.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/failure-evidence.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEvF,wBAAgB,sBAAsB,IAAI,oBAAoB,CAM7D;AAED;;0EAE0E;AAC1E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,GACpD,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,gBAAgB,CAAC,CAAC,EAC9D,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,iBAAiB,GACxB,oBAAoB,CAsBtB;AA+DD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAQpF;AAED;8DAC8D;AAC9D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAI3E;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOtE;AAED;qFACqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAMhE"}

package/dist/core/workflow/failure-evidence.js

@@ -1,114 +0,0 @@
-import { createHash } from "node:crypto";
-export function unknownFailureEvidence() {
-    return {
-        effect: { state: "unknown" },
-        refusal: { state: "unknown" },
-        partial_output: { state: "unknown" },
-    };
-}
-/** Built-in subprocess adapters observe output and process-start failures.
- * Their current vendor envelopes do not prove effects or native refusal.
- * In particular, blank output and 429/5xx statuses leave both unknown. */
-export function observeSpawnFailure(raw, text, source) {
-    const bytes = Buffer.byteLength(text);
-    return {
-        effect: raw.spawnErrno === "ENOENT" &&
-            !raw.timedOut &&
-            bytes === 0 &&
-            !raw.stdout?.trim() &&
-            !raw.resultFileText?.trim()
-            ? { state: "none", source: "spawn_errno", reference: "ENOENT" }
-            : { state: "unknown" },
-        refusal: { state: "unknown" },
-        partial_output: bytes > 0
-            ? {
-                state: "present",
-                source,
-                bytes,
-                sha256: createHash("sha256").update(text).digest("hex"),
-            }
-            : { state: "absent", source },
-    };
-}
-function record(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function keys(value, expected) {
-    return (Object.keys(value).length === expected.length &&
-        expected.every((key) => Object.hasOwn(value, key)));
-}
-function reference(value) {
-    return typeof value === "string" && value.trim().length > 0 && value.length <= 512;
-}
-function validEffect(value) {
-    if (!record(value))
-        return false;
-    if (value.state === "unknown")
-        return keys(value, ["state"]);
-    if (!keys(value, ["state", "source", "reference"]))
-        return false;
-    if (value.state === "none" && value.source === "spawn_errno") {
-        return value.reference === "ENOENT";
-    }
-    return ((value.state === "none" || value.state === "observed") &&
-        value.source === "adapter_evidence" &&
-        reference(value.reference));
-}
-function validRefusal(value) {
-    if (!record(value))
-        return false;
-    if (value.state === "unknown")
-        return keys(value, ["state"]);
-    return (keys(value, ["state", "source", "reference"]) &&
-        value.state === "refused" &&
-        value.source === "vendor_envelope" &&
-        reference(value.reference));
-}
-function validOutput(value) {
-    if (!record(value))
-        return false;
-    if (value.state === "unknown")
-        return keys(value, ["state"]);
-    if (value.source !== "final_message" &&
-        value.source !== "vendor_envelope" &&
-        value.source !== "stdout") {
-        return false;
-    }
-    if (value.state === "absent")
-        return keys(value, ["state", "source"]);
-    return (value.state === "present" &&
-        keys(value, ["state", "source", "bytes", "sha256"]) &&
-        Number.isSafeInteger(value.bytes) &&
-        value.bytes > 0 &&
-        typeof value.sha256 === "string" &&
-        /^[a-f0-9]{64}$/.test(value.sha256));
-}
-export function isSpawnFailureEvidence(value) {
-    return (record(value) &&
-        keys(value, ["effect", "refusal", "partial_output"]) &&
-        validEffect(value.effect) &&
-        validRefusal(value.refusal) &&
-        validOutput(value.partial_output));
-}
-/** Missing observations are unknown; malformed positive claims are rejected.
- * This is also used when reading persisted workflow proof. */
-export function resolveFailureEvidence(value) {
-    if (value === undefined)
-        return unknownFailureEvidence();
-    if (!isSpawnFailureEvidence(value))
-        throw new Error("invalid spawn failure evidence");
-    return value;
-}
-export function failureEvidenceAllowsUncharged(value) {
-    const evidence = resolveFailureEvidence(value);
-    return (evidence.effect.state === "none" &&
-        evidence.refusal.state !== "refused" &&
-        evidence.partial_output.state === "absent");
-}
-/** A provider retry requires positive no-effect evidence. A missing binary is
- * known not to have started, but retrying that unchanged environment cannot help. */
-export function canRetryFailedSpawn(result) {
-    return (!result.ok &&
-        result.class !== "environment" &&
-        failureEvidenceAllowsUncharged(result.failureEvidence));
-}