instar 1.3.511 → 1.3.512

package/dist/monitoring/MergeRunner.js

@@ -0,0 +1,296 @@
+/**
+ * MergeRunner — the act-path engine for the GreenPrAutoMerger (Step 4 of
+ * green-pr-automerge-enforcement §3.1/R5). Owns everything that touches a real
+ * process:
+ *
+ *  - probeContract(): runs `safe-merge --capabilities`, pins the script's
+ *    content hash + absolute path for the attempt (round-3 mid-run-swap defense),
+ *    and re-verifies that hash IMMEDIATELY before exec (round-5: the spawn runs
+ *    the verified bytes).
+ *  - run(): writes a DURABLE two-phase in-flight record BEFORE the spawn (intent
+ *    first, pid/pgid patched in after), spawns safe-merge in its OWN process
+ *    group, hard-kills the group at mergeTimeoutMs + grace, parses the classified
+ *    `safe-merge-result:` line, and confirms a `merged` outcome INDEPENDENTLY
+ *    (B10). The record is cleared on classification.
+ *  - reapOrphan(): at boot/warm-up, reaps a surviving orphan from a crash —
+ *    verifies the recorded pid/pgid identity via a unique attempt token before
+ *    signalling (pid-reuse safe), handles the dead-leader/live-group corner
+ *    (orphan-reap-incomplete), and re-verifies PR state via gh. A pid-less
+ *    in-flight record is treated as attempt-of-unknown-outcome (re-verify,
+ *    never assume not-spawned).
+ *
+ * The guarantee survives the server's own death: the watcher's merges trigger
+ * releases → auto-update restarts, so a restart mid-attempt is a NORMAL
+ * condition. The durable record + own-process-group + shutdown group-kill +
+ * warm-up reap close the double-attempt / wedged-orphan classes.
+ *
+ * All process + fs + gh I/O is behind injected seams so the runner is testable
+ * without spawning anything.
+ *
+ * RULE 3.1 RATIONALE
+ *   Criticality: high — this code drives an autonomous merge to main.
+ *   Frequency:   per-merge-attempt (at most one per ~10-minute tick).
+ *   Stability:   stable — parses safe-merge's OWN structured contract line
+ *                (`safe-merge-result: {...}`), not human gh output; and
+ *                `gh ... --json` structured responses, never regex over prose.
+ *   Fallback:    every parse failure is caught and resolves to a NON-merged
+ *                outcome (fail-toward-skip); a `merged` outcome is never trusted
+ *                without an INDEPENDENT `gh pr view` confirmation (B10).
+ *   Verdict:     deterministic; the act-time authority is safe-merge, which
+ *                re-verifies, so a misread here can only refuse, never over-merge.
+ */
+import { spawn as realSpawn } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { SafeFsExecutor } from '../core/SafeFsExecutor.js';
+export class DefaultMergeRunner {
+    cfg;
+    deps;
+    now;
+    /** Pinned per-attempt: the probed script's hash + path. */
+    pinnedHash = null;
+    constructor(cfg, deps) {
+        this.cfg = cfg;
+        this.deps = deps;
+        this.now = deps.now ?? (() => Date.now());
+    }
+    // ---- contract probe -----------------------------------------------------
+    async probeContract() {
+        try {
+            const out = await this.spawn({
+                command: this.cfg.nodePath ?? process.execPath,
+                args: [this.cfg.safeMergePath, '--capabilities'],
+                env: process.env,
+                deadlineMs: 30_000,
+            });
+            if (out.status !== 0)
+                return { ok: false };
+            const json = JSON.parse(out.stdout.trim());
+            const version = Number(json?.contract);
+            if (version !== this.cfg.expectedContractVersion)
+                return { ok: false, version };
+            // Pin the script's content hash for the attempt (re-verified before exec).
+            this.pinnedHash = this.hashScript();
+            return { ok: this.pinnedHash !== null, version };
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+            return { ok: false };
+        }
+    }
+    hashScript() {
+        try {
+            const buf = fs.readFileSync(this.cfg.safeMergePath);
+            return crypto.createHash('sha256').update(buf).digest('hex');
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+            return null;
+        }
+    }
+    // ---- run ----------------------------------------------------------------
+    async run(attempt) {
+        // Pre-exec hash re-verify (round-5): a checkout swap between probe and exec
+        // must refuse — the spawn runs the VERIFIED bytes.
+        const currentHash = this.hashScript();
+        if (!this.pinnedHash || currentHash !== this.pinnedHash) {
+            this.log(`safe-merge hash changed between probe and exec — refusing (${attempt.pr})`);
+            return { outcome: 'skipped:safe-merge-contract', confirmedMerged: false };
+        }
+        const attemptToken = crypto.randomBytes(8).toString('hex');
+        // Phase 1: durable intent record BEFORE the spawn.
+        const record = {
+            pr: attempt.pr, headRefOid: attempt.headRefOid, repo: this.cfg.repo,
+            attemptToken, startedAt: this.now(), pid: null, pgid: null,
+        };
+        this.writeInFlight(record);
+        let out;
+        try {
+            out = await this.spawn({
+                command: this.cfg.nodePath ?? process.execPath,
+                args: [
+                    this.cfg.safeMergePath, String(attempt.pr),
+                    '--repo', this.cfg.repo, '--squash', '--delete-branch', '--admin',
+                    '--match-head-commit', attempt.headRefOid,
+                    '--deadline-ms', String(this.cfg.mergeTimeoutMs),
+                ],
+                env: { ...process.env, GREEN_PR_ATTEMPT_TOKEN: attemptToken },
+                deadlineMs: this.cfg.mergeTimeoutMs + this.cfg.mergeKillGraceMs,
+                onPid: (pid) => {
+                    // Phase 2: patch pid/pgid (the child's pid IS its pgid when detached).
+                    record.pid = pid;
+                    record.pgid = pid;
+                    this.writeInFlight(record);
+                },
+            });
+        }
+        catch (e) { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+            this.clearInFlight();
+            return { outcome: `error:spawn-${String(e?.message).slice(0, 40)}`, confirmedMerged: false };
+        }
+        const outcome = parseResultLine(out.stdout) ?? (out.deadlineKilled ? 'refused:checks-timeout' : 'error:no-result-line');
+        let confirmedMerged = false;
+        if (outcome === 'merged') {
+            try {
+                confirmedMerged = await this.deps.confirmMerged(attempt.pr, this.cfg.repo);
+            }
+            catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+                confirmedMerged = false;
+            }
+        }
+        this.clearInFlight();
+        return { outcome, confirmedMerged, deadlineKilled: out.deadlineKilled };
+    }
+    // ---- orphan reap (boot/warm-up) ----------------------------------------
+    async reapOrphan() {
+        const record = this.readInFlight();
+        if (!record)
+            return { reaped: false };
+        const isAlive = this.deps.isAlive ?? ((pid) => { try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+            return false;
+        } });
+        const killGroup = this.deps.killGroup ?? ((pgid) => { try {
+            process.kill(-pgid, 'SIGKILL');
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */ /* best-effort */ } });
+        // A pid-less record = attempt-of-unknown-outcome (crash between phase 1 and 2).
+        if (record.pid === null || record.pgid === null) {
+            const cleared = await this.reverifyAndClear(record);
+            return { reaped: true, outcome: cleared };
+        }
+        if (isAlive(record.pid)) {
+            // Verify identity before signalling (pid-reuse safe): the live process must
+            // carry our attempt token. If we cannot confirm identity, do NOT kill an
+            // unrelated process — surface orphan-reap-incomplete and re-verify PR state.
+            const identityOk = this.verifyAttemptToken(record.pid, record.attemptToken);
+            if (identityOk) {
+                killGroup(record.pgid);
+            }
+            else {
+                this.log(`orphan pid ${record.pid} identity unconfirmed — not signalling (orphan-reap-incomplete)`);
+                // Leave the record; re-verify PR state so a completed merge is recorded.
+            }
+        }
+        const outcome = await this.reverifyAndClear(record);
+        return { reaped: true, outcome };
+    }
+    async reverifyAndClear(record) {
+        let outcome = 'unknown';
+        try {
+            const st = await this.deps.prState(record.pr, record.repo);
+            outcome = st === 'MERGED' ? 'merged-by-other' : st === 'CLOSED' ? 'closed-by-other' : 'reaped-open';
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+            outcome = 'reaped-unverified';
+        }
+        this.clearInFlight();
+        return outcome;
+    }
+    /** Best-effort identity check: does the live pid's argv carry our token? */
+    verifyAttemptToken(pid, token) {
+        // On Linux, /proc/<pid>/environ carries the token. On other platforms we
+        // cannot cheaply confirm — be conservative (return false → do not kill).
+        try {
+            const environ = fs.readFileSync(`/proc/${pid}/environ`, 'utf-8');
+            return environ.includes(`GREEN_PR_ATTEMPT_TOKEN=${token}`);
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+            return false;
+        }
+    }
+    // ---- durable in-flight record ------------------------------------------
+    inFlightPath() {
+        return path.join(this.cfg.stateDir, 'state', 'green-pr-automerge-inflight.json');
+    }
+    writeInFlight(record) {
+        const p = this.inFlightPath();
+        try {
+            const dir = path.dirname(p);
+            if (!fs.existsSync(dir))
+                fs.mkdirSync(dir, { recursive: true });
+            const tmp = p + '.tmp';
+            fs.writeFileSync(tmp, JSON.stringify(record), { mode: 0o600 });
+            fs.renameSync(tmp, p);
+        }
+        catch (e) { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+            this.log(`in-flight write failed: ${e?.message}`);
+        }
+    }
+    readInFlight() {
+        try {
+            const raw = fs.readFileSync(this.inFlightPath(), 'utf-8');
+            const obj = JSON.parse(raw);
+            if (typeof obj.pr === 'number' && typeof obj.attemptToken === 'string')
+                return obj;
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */ /* none */ }
+        return null;
+    }
+    clearInFlight() {
+        try {
+            SafeFsExecutor.safeRmSync(this.inFlightPath(), { force: true, operation: 'merge-runner:clear-in-flight' });
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */ /* best-effort */ }
+    }
+    // ---- spawn seam ---------------------------------------------------------
+    spawn(a) {
+        if (this.deps.spawn)
+            return this.deps.spawn(a);
+        return defaultSpawn(a);
+    }
+    log(msg) {
+        this.deps.logger?.(`[merge-runner] ${msg}`);
+    }
+}
+/** Parse safe-merge's classified `safe-merge-result: {...}` line from stdout. */
+export function parseResultLine(stdout) {
+    const lines = stdout.split('\n');
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const m = lines[i].match(/safe-merge-result:\s*(\{.*\})/);
+        if (m) {
+            try {
+                return String(JSON.parse(m[1]).result);
+            }
+            catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+                return null;
+            }
+        }
+    }
+    return null;
+}
+/** Real spawn: detached (own process group) + deadline hard-kill of the group. */
+function defaultSpawn(a) {
+    return new Promise((resolve) => {
+        const child = realSpawn(a.command, a.args, { env: a.env, detached: true });
+        if (child.pid && a.onPid)
+            a.onPid(child.pid);
+        let stdout = '';
+        let stderr = '';
+        let deadlineKilled = false;
+        child.stdout?.on('data', (d) => { stdout += d.toString(); });
+        child.stderr?.on('data', (d) => { stderr += d.toString(); });
+        const timer = setTimeout(() => {
+            deadlineKilled = true;
+            if (child.pid) {
+                try {
+                    process.kill(-child.pid, 'SIGKILL');
+                }
+                catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */ /* best-effort */ }
+            }
+        }, a.deadlineMs);
+        if (typeof timer.unref === 'function')
+            timer.unref();
+        child.on('close', (status, signal) => {
+            clearTimeout(timer);
+            resolve({ stdout, stderr, status: status ?? null, signal: signal ?? null, deadlineKilled, pid: child.pid ?? null });
+        });
+        child.on('error', () => {
+            clearTimeout(timer);
+            resolve({ stdout, stderr, status: null, signal: null, deadlineKilled, pid: child.pid ?? null });
+        });
+    });
+}
+//# sourceMappingURL=MergeRunner.js.map

package/dist/monitoring/MergeRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MergeRunner.js","sourceRoot":"","sources":["../../src/monitoring/MergeRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA8D3D,MAAM,OAAO,kBAAkB;IACZ,GAAG,CAAoB;IACvB,IAAI,CAAkB;IACtB,GAAG,CAAe;IACnC,2DAA2D;IACnD,UAAU,GAAkB,IAAI,CAAC;IAEzC,YAAY,GAAsB,EAAE,IAAqB;QACvD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBAC3B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;gBAC9C,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC;gBAChD,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,UAAU,EAAE,MAAM;aACnB,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,IAAI,CAAC,GAAG,CAAC,uBAAuB;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAChF,2EAA2E;YAC3E,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H;YACrI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H;YACrI,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,GAAG,CAAC,OAAqB;QAC7B,4EAA4E;QAC5E,mDAAmD;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,8DAA8D,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YACtF,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC5E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3D,mDAAmD;QACnD,MAAM,MAAM,GAAmB;YAC7B,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;YACnE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;SAC3D,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,GAAiB,CAAC;QACtB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;gBACrB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;gBAC9C,IAAI,EAAE;oBACJ,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,SAAS;oBACjE,qBAAqB,EAAE,OAAO,CAAC,UAAU;oBACzC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;iBACjD;gBACD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,sBAAsB,EAAE,YAAY,EAAE;gBAC7D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB;gBAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;oBACb,uEAAuE;oBACvE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;oBACjB,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC;oBAClB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC7B,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6HAA6H;YACzI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,eAAe,MAAM,CAAE,CAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC1G,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QACxH,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBAAC,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACnF,MAAM,CAAC,CAAC,6HAA6H;gBAAC,eAAe,GAAG,KAAK,CAAC;YAAC,CAAC;QAClK,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;IAC1E,CAAC;IAED,2EAA2E;IAE3E,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7P,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnQ,gFAAgF;QAChF,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,4EAA4E;YAC5E,yEAAyE;YACzE,6EAA6E;YAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5E,IAAI,UAAU,EAAE,CAAC;gBACf,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,GAAG,iEAAiE,CAAC,CAAC;gBACpG,yEAAyE;YAC3E,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,MAAsB;QACnD,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3D,OAAO,GAAG,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H;YAAC,OAAO,GAAG,mBAAmB,CAAC;QAAC,CAAC;QACxK,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IACpE,kBAAkB,CAAC,GAAW,EAAE,KAAa;QACnD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,QAAQ,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H;YACrI,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,YAAY;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,kCAAkC,CAAC,CAAC;IACnF,CAAC;IAEO,aAAa,CAAC,MAAsB;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC;YACvB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6HAA6H;YACzI,IAAI,CAAC,GAAG,CAAC,2BAA4B,CAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;YAC9C,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H,CAAC,UAAU,CAAC,CAAC;QACpJ,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H,CAAC,iBAAiB,CAAC,CAAC;IAC/Q,CAAC;IAED,4EAA4E;IAEpE,KAAK,CAAC,CAAY;QACxB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAEO,GAAG,CAAC,GAAW;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC;gBAAC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6HAA6H;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;QACtM,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,CAAY;IAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK;YAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,cAAc,GAAG,IAAI,CAAC;YACtB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,6HAA6H,CAAC,iBAAiB,CAAC,CAAC;YAAC,CAAC;QAC3N,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QACjB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACnC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QACtH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/monitoring/floorDriftCanary.d.ts

@@ -0,0 +1,88 @@
+/**
+ * floorDriftCanary — verifies the code-pinned required-contexts floor still
+ * matches reality, so a renamed workflow / split job / changed app slug surfaces
+ * as `floor-drift` instead of turning the watcher into a silent permanent
+ * refuser (green-pr-automerge-enforcement R8, L5(b)/P18). Observe-only.
+ *
+ * Per-family references (round-6 — the round-5 single-reference design was
+ * structurally unsatisfiable): the pinned floor mixes PR-triggered gates (eli16,
+ * decision-audit) whose runs attach to PR HEAD shas, never default-branch
+ * commits, and push-triggered contexts (CI suite) that DO run on main. So:
+ *   - PR-triggered floor contexts validate against the head shas of recently
+ *     MERGED agent-namespace PRs (newest-qualifying-wins).
+ *   - push-triggered contexts validate against the most recent default-branch
+ *     commit qualified INDEPENDENTLY of the pinned set (any completed non-skip-ci
+ *     runs present — qualifying ON the pinned set would let a rename hide).
+ * No qualifying reference within a family's bound → `floor-drift-unverifiable`
+ * (distinct from `floor-drift`: "couldn't check" never wears the "drifted" label).
+ *
+ * All gh I/O is injected so this is unit-testable without the network.
+ */
+export interface FloorPin {
+    context: string;
+    workflowPath: string;
+    appSlug: string;
+    /** Which event the producing workflow fires on. */
+    trigger: 'pull_request' | 'push';
+}
+/** A completed check run on some commit (own + producer identity). */
+export interface ReferenceCheckRun {
+    name: string;
+    conclusion: string;
+    appSlug: string | null;
+    workflowPath: string | null;
+}
+/** A candidate reference: a commit/head sha plus its completed check runs. */
+export interface ReferenceCandidate {
+    sha: string;
+    checkRuns: ReferenceCheckRun[];
+}
+export interface FloorDriftDeps {
+    /**
+     * Recently MERGED agent-namespace PR heads, newest-first, bounded by
+     * `floorDriftLookbackPrs`. Each carries that head's completed check runs.
+     */
+    recentMergedPrRefs(limit: number): Promise<ReferenceCandidate[]>;
+    /**
+     * Recent default-branch commits, newest-first, bounded by
+     * `floorDriftLookbackCommits`, each with its completed check runs.
+     */
+    recentDefaultBranchRefs(limit: number): Promise<ReferenceCandidate[]>;
+}
+export interface FloorDriftConfig {
+    floorDriftLookbackPrs: number;
+    floorDriftLookbackCommits: number;
+}
+export type FloorDriftClass = 'ok' | 'floor-drift' | 'floor-drift-unverifiable';
+export interface FloorDriftFinding {
+    context: string;
+    cls: FloorDriftClass;
+    detail?: string;
+}
+export interface FloorDriftResult {
+    findings: FloorDriftFinding[];
+    drifted: FloorDriftFinding[];
+    unverifiable: FloorDriftFinding[];
+}
+/** Does this candidate "qualify" as a reference for a push-triggered family? */
+export declare function qualifiesAsPushReference(c: ReferenceCandidate): boolean;
+/** A PR head qualifies as a PR-family reference if it carries any completed runs. */
+export declare function qualifiesAsPrReference(c: ReferenceCandidate): boolean;
+/** Is the pin satisfied at this reference (name + producer binding)? */
+export declare function pinSatisfiedAt(pin: FloorPin, ref: ReferenceCandidate): boolean;
+export declare class FloorDriftCanary {
+    private readonly pins;
+    private readonly deps;
+    private readonly cfg;
+    constructor(pins: FloorPin[], deps: FloorDriftDeps, cfg: FloorDriftConfig);
+    check(): Promise<FloorDriftResult>;
+    /**
+     * Newest-qualifying-wins (round-7 build note): walk references newest-first;
+     * the FIRST that qualifies is authoritative. If it satisfies the pin → ok;
+     * else → floor-drift. If NO reference in the bound qualifies →
+     * floor-drift-unverifiable (never floor-drift).
+     */
+    private evaluate;
+    private safe;
+}
+//# sourceMappingURL=floorDriftCanary.d.ts.map

package/dist/monitoring/floorDriftCanary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"floorDriftCanary.d.ts","sourceRoot":"","sources":["../../src/monitoring/floorDriftCanary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,OAAO,EAAE,cAAc,GAAG,MAAM,CAAC;CAClC;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjE;;;OAGG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,aAAa,GAAG,0BAA0B,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,eAAe,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,YAAY,EAAE,iBAAiB,EAAE,CAAC;CACnC;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAIvE;AAED,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAErE;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAM9E;AAED,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAFH,IAAI,EAAE,QAAQ,EAAE,EAChB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,gBAAgB;IAGlC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkBxC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;YAUF,IAAI;CAGnB"}

package/dist/monitoring/floorDriftCanary.js

@@ -0,0 +1,89 @@
+/**
+ * floorDriftCanary — verifies the code-pinned required-contexts floor still
+ * matches reality, so a renamed workflow / split job / changed app slug surfaces
+ * as `floor-drift` instead of turning the watcher into a silent permanent
+ * refuser (green-pr-automerge-enforcement R8, L5(b)/P18). Observe-only.
+ *
+ * Per-family references (round-6 — the round-5 single-reference design was
+ * structurally unsatisfiable): the pinned floor mixes PR-triggered gates (eli16,
+ * decision-audit) whose runs attach to PR HEAD shas, never default-branch
+ * commits, and push-triggered contexts (CI suite) that DO run on main. So:
+ *   - PR-triggered floor contexts validate against the head shas of recently
+ *     MERGED agent-namespace PRs (newest-qualifying-wins).
+ *   - push-triggered contexts validate against the most recent default-branch
+ *     commit qualified INDEPENDENTLY of the pinned set (any completed non-skip-ci
+ *     runs present — qualifying ON the pinned set would let a rename hide).
+ * No qualifying reference within a family's bound → `floor-drift-unverifiable`
+ * (distinct from `floor-drift`: "couldn't check" never wears the "drifted" label).
+ *
+ * All gh I/O is injected so this is unit-testable without the network.
+ */
+/** Does this candidate "qualify" as a reference for a push-triggered family? */
+export function qualifiesAsPushReference(c) {
+    // Any completed (non-skip-ci) check runs present — qualified INDEPENDENTLY of
+    // the pinned set, so a rename can still be observed as a mismatch.
+    return c.checkRuns.some((r) => r.conclusion && r.conclusion !== 'skipped' && r.conclusion !== 'neutral');
+}
+/** A PR head qualifies as a PR-family reference if it carries any completed runs. */
+export function qualifiesAsPrReference(c) {
+    return c.checkRuns.some((r) => !!r.conclusion);
+}
+/** Is the pin satisfied at this reference (name + producer binding)? */
+export function pinSatisfiedAt(pin, ref) {
+    return ref.checkRuns.some((r) => r.name === pin.context &&
+        String(r.conclusion).toLowerCase() === 'success' &&
+        (!pin.appSlug || r.appSlug === pin.appSlug) &&
+        (!pin.workflowPath || r.workflowPath === pin.workflowPath));
+}
+export class FloorDriftCanary {
+    pins;
+    deps;
+    cfg;
+    constructor(pins, deps, cfg) {
+        this.pins = pins;
+        this.deps = deps;
+        this.cfg = cfg;
+    }
+    async check() {
+        const prTriggered = this.pins.filter((p) => p.trigger === 'pull_request');
+        const pushTriggered = this.pins.filter((p) => p.trigger === 'push');
+        const prRefs = prTriggered.length > 0 ? await this.safe(() => this.deps.recentMergedPrRefs(this.cfg.floorDriftLookbackPrs)) : [];
+        const pushRefs = pushTriggered.length > 0 ? await this.safe(() => this.deps.recentDefaultBranchRefs(this.cfg.floorDriftLookbackCommits)) : [];
+        const findings = [];
+        for (const pin of prTriggered)
+            findings.push(this.evaluate(pin, prRefs, qualifiesAsPrReference));
+        for (const pin of pushTriggered)
+            findings.push(this.evaluate(pin, pushRefs, qualifiesAsPushReference));
+        return {
+            findings,
+            drifted: findings.filter((f) => f.cls === 'floor-drift'),
+            unverifiable: findings.filter((f) => f.cls === 'floor-drift-unverifiable'),
+        };
+    }
+    /**
+     * Newest-qualifying-wins (round-7 build note): walk references newest-first;
+     * the FIRST that qualifies is authoritative. If it satisfies the pin → ok;
+     * else → floor-drift. If NO reference in the bound qualifies →
+     * floor-drift-unverifiable (never floor-drift).
+     */
+    evaluate(pin, refs, qualifies) {
+        for (const ref of refs) {
+            if (!qualifies(ref))
+                continue;
+            // First qualifying reference is authoritative (newest-wins).
+            if (pinSatisfiedAt(pin, ref))
+                return { context: pin.context, cls: 'ok' };
+            return { context: pin.context, cls: 'floor-drift', detail: `pinned ${pin.context} (${pin.appSlug} ${pin.workflowPath}) not satisfied at ${ref.sha.slice(0, 12)}` };
+        }
+        return { context: pin.context, cls: 'floor-drift-unverifiable', detail: `no qualifying reference within the lookback bound` };
+    }
+    async safe(fn) {
+        try {
+            return await fn();
+        }
+        catch { /* @silent-fallback-ok: green-pr-automerge fail-safe — skip/refuse, never over-merge; safe-merge is the act-time authority */
+            return [];
+        }
+    }
+}
+//# sourceMappingURL=floorDriftCanary.js.map

package/dist/monitoring/floorDriftCanary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"floorDriftCanary.js","sourceRoot":"","sources":["../../src/monitoring/floorDriftCanary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAwDH,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CAAC,CAAqB;IAC5D,8EAA8E;IAC9E,mEAAmE;IACnE,OAAO,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;AAC3G,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,sBAAsB,CAAC,CAAqB;IAC1D,OAAO,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,GAAa,EAAE,GAAuB;IACnE,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO;QACtB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS;QAChD,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,OAAO,gBAAgB;IAER;IACA;IACA;IAHnB,YACmB,IAAgB,EAChB,IAAoB,EACpB,GAAqB;QAFrB,SAAI,GAAJ,IAAI,CAAY;QAChB,SAAI,GAAJ,IAAI,CAAgB;QACpB,QAAG,GAAH,GAAG,CAAkB;IACrC,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjI,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAE9I,MAAM,QAAQ,GAAwB,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,WAAW;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;QACjG,KAAK,MAAM,GAAG,IAAI,aAAa;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAEvG,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC;YACxD,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,0BAA0B,CAAC;SAC3E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,GAAa,EAAE,IAA0B,EAAE,SAA6C;QACvG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,6DAA6D;YAC7D,IAAI,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,sBAAsB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QACrK,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,0BAA0B,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IAChI,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,EAAuC;QACxD,IAAI,CAAC;YAAC,OAAO,MAAM,EAAE,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,6HAA6H;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IAC/K,CAAC;CACF"}

package/dist/monitoring/greenPrAutomergeWiring.d.ts

@@ -0,0 +1,73 @@
+/**
+ * greenPrAutomergeWiring — builds the real gh / fs / lease / latch dependencies
+ * for the GreenPrAutoMerger (green-pr-automerge-enforcement). Extracted from
+ * server.ts so the dependency construction is itself unit-testable (Testing
+ * Integrity: wiring-integrity tests prove deps are real, not nulls/no-ops).
+ *
+ * Repo-gated: the watcher only runs in the dev/maintainer environment where an
+ * analyzable instar git repo AND scripts/safe-merge.mjs are present. On a plain
+ * npm install both are absent → the server constructs nothing → routes 503.
+ *
+ * All gh goes through `execFile` (no shell). The list query is pinned oldest-first
+ * server-side. Identity (R4) is `gh api user`. Audit is one JSONL line per
+ * transition. State is per-machine (machine-local BY DESIGN).
+ *
+ * RULE 3.1 RATIONALE
+ *   Criticality: high — these adapters surface the PR/identity/protected-paths
+ *                state the merge watcher acts on.
+ *   Frequency:   per-tick (≤ once per ~10-minute interval).
+ *   Stability:   stable — every read uses `gh ... --json`/`gh api --jq`
+ *                STRUCTURED output, never regex over human gh text.
+ *   Fallback:    a failing/unparseable list call THROWS (→ the watcher's
+ *                tick-failed canary feeds the breaker); protectedPaths failure →
+ *                `unverifiable:true` (→ skip, never merge); identity unresolved →
+ *                skip. Every path fails toward NOT merging.
+ *   Verdict:     deterministic; safe-merge re-verifies at act time, so a misread
+ *                here can only cause a refusal, never an unintended merge.
+ */
+import { GuardLatchStore, type GuardLatchEntry } from './GuardLatchStore.js';
+import { type GreenPrAutoMergerDeps } from './GreenPrAutoMerger.js';
+/** Protected globs (round-4/6): a PR touching these never auto-merges. */
+export declare const PROTECTED_PATH_PREFIXES: string[];
+/** Gate scripts the floor contexts execute (extend, never shrink). */
+export declare const PROTECTED_GATE_SCRIPTS: string[];
+export declare function isAnalyzableGreenPrRepo(repoPath: string, safeMergePath: string): boolean;
+/** Does any changed file touch a protected path? */
+export declare function diffTouchesProtected(files: string[]): boolean;
+export interface GreenPrWiringOpts {
+    repoPath: string;
+    safeMergePath: string;
+    stateDir: string;
+    machineId: string;
+    repo: string;
+    agentNamespace: string;
+    mergeTimeoutMs: number;
+    mergeKillGraceMs: number;
+    /** Lease accessors (single-machine: () => true / () => 0). */
+    holdsLease: () => boolean;
+    leaseEpoch: () => number;
+    /** Merged peer guard-latch view (single-machine: () => []). */
+    readPeerLatches?: () => GuardLatchEntry[];
+    /** Replication writer (optional). */
+    journal?: {
+        emitGuardLatch: (d: Record<string, unknown>) => void;
+    };
+    /** Attention sink — raise/refresh the ONE aggregated item. */
+    postAttentionAggregate: (lines: string[]) => Promise<void>;
+    auditPath: string;
+    now?: () => number;
+    logger?: (msg: string) => void;
+    /** Test seam: override the gh exec. */
+    ghExec?: (args: string[]) => Promise<{
+        stdout: string;
+        stderr: string;
+        code: number;
+    }>;
+}
+/** Build the GuardLatchStore for this install. */
+export declare function buildGuardLatchStore(opts: GreenPrWiringOpts): GuardLatchStore;
+/** Build the full GreenPrAutoMerger deps (real gh adapters). */
+export declare function buildGreenPrDeps(opts: GreenPrWiringOpts, latches: GuardLatchStore): GreenPrAutoMergerDeps;
+/** Derive a single SUCCESS|PENDING|FAILURE from the statusCheckRollup array. */
+export declare function deriveRollup(rollup: unknown): string | null;
+//# sourceMappingURL=greenPrAutomergeWiring.d.ts.map

package/dist/monitoring/greenPrAutomergeWiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"greenPrAutomergeWiring.d.ts","sourceRoot":"","sources":["../../src/monitoring/greenPrAutomergeWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE7E,OAAO,EACL,KAAK,qBAAqB,EAI3B,MAAM,wBAAwB,CAAC;AAGhC,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,UASnC,CAAC;AACF,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,UAElC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAMxF;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAE7D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,eAAe,EAAE,CAAC;IAC1C,qCAAqC;IACrC,OAAO,CAAC,EAAE;QAAE,cAAc,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;KAAE,CAAC;IACnE,8DAA8D;IAC9D,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,uCAAuC;IACvC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxF;AAUD,kDAAkD;AAClD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CAU7E;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,GAAG,qBAAqB,CA6HzG;AAiBD,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAW3D"}