instar 1.3.761 → 1.3.763

package/dist/monitoring/ExternalHogKillFunnel.js

@@ -0,0 +1,72 @@
+/**
+ * ExternalHogKillFunnel — the hardened kill sequence of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §4).
+ *
+ * The ONLY place a real signal is sent. Structured so the watch-only guarantee is by
+ * construction: unless a LIVE kill is authorized (`canKillLive` — enabled && !dryRun && a valid
+ * PIN armed marker for this class), the funnel sends NO signal and returns a `would-kill`
+ * record. All I/O (fact re-read, arm re-read, fd-probe, signal send, aliveness, clock, wait) is
+ * INJECTED so the sequence is fully testable without ever killing a process.
+ *
+ * Sequence (a candidate that has already passed §4 Stage-A CPU admission + §5 classifier=kill):
+ *   1. Gate: re-read the LIVE arm state → not authorized ⇒ `would-kill` (dry-run / not-armed).
+ *   2. Stage-B (pre-SIGTERM): re-read the LIVE facts → the §4 floor must still PERMIT; abort→alert.
+ *   3. SIGTERM → wait `sigtermGraceMs`.
+ *   4. If the process exited during grace → `sigterm-exited` (no SIGKILL needed).
+ *   5. Stage-B (pre-SIGKILL): re-read facts + arm → any change/disarm ⇒ abort (never SIGKILL).
+ *   6. fd-skip: an open writable WORKSPACE file ⇒ DEFER the SIGKILL (bounded by maxKillDeferrals).
+ *   7. SIGKILL → `killed`.
+ */
+import { evaluateKillFloor, matchAllowlistClass } from './ExternalHogFloor.js';
+import { canKillLive } from './ExternalHogArmMarker.js';
+/** Re-check the full authorization + floor for a target, live. Returns null if OK to proceed,
+ *  or a `would-kill`/`aborted` outcome to short-circuit. */
+async function reCheck(target, deps) {
+    const arm = deps.reReadArmState();
+    if (!canKillLive(arm.config, arm.marker, arm.lastDisarmEpoch, target.classId, deps.currentClassContentHash(target.classId))) {
+        return { action: 'would-kill', reason: arm.config && arm.config.dryRun !== false ? 'dry-run' : 'not-armed' };
+    }
+    const facts = await deps.reReadFacts(target.pid, target.startTime);
+    if (!facts)
+        return { action: 'aborted', reason: 'identity-changed-or-gone' };
+    // Re-verify the target is still in the allowlist class it was matched under (belt + suspenders).
+    if (matchAllowlistClass(facts.name, facts.argv) !== target.classId) {
+        return { action: 'aborted', reason: 'class-changed' };
+    }
+    const floor = evaluateKillFloor(facts);
+    if (!floor.permitted)
+        return { action: 'aborted', reason: `floor-veto:${floor.vetoReason}` };
+    return null;
+}
+/**
+ * Run the kill funnel for one target. Sends real signals ONLY when a live kill is authorized at
+ * BOTH re-check points; otherwise returns a non-destructive outcome. Pure control flow over the
+ * injected I/O.
+ */
+export async function runKillFunnel(target, opts, deps) {
+    // (1)+(2) Pre-SIGTERM gate + Stage-B floor re-check.
+    const pre = await reCheck(target, deps);
+    if (pre)
+        return pre; // would-kill (watch-only/unarmed) or aborted — NO signal sent.
+    // (3) SIGTERM → grace.
+    deps.sendSignal(target.pid, 'SIGTERM');
+    await deps.wait(Math.max(0, opts.sigtermGraceMs));
+    // (4) Exited gracefully during grace? Done.
+    if (!deps.stillAlive(target.pid, target.startTime))
+        return { action: 'sigterm-exited' };
+    // (5) Pre-SIGKILL re-check: a disarm / identity change / floor veto in the grace window aborts
+    //     the escalation (the SIGTERM already sent is a graceful ask; we do NOT force-kill).
+    const post = await reCheck(target, deps);
+    if (post) {
+        // If it de-authorized (would-kill) or a fact changed (aborted) mid-grace, do NOT SIGKILL.
+        return post.action === 'would-kill' ? { action: 'aborted', reason: `disarmed-mid-grace:${post.reason}` } : post;
+    }
+    // (6) fd-skip: an in-progress workspace write DEFERS the SIGKILL (bounded).
+    if ((await deps.hasOpenWritableWorkspaceFile(target.pid)) && opts.currentDeferrals < opts.maxKillDeferrals) {
+        return { action: 'deferred', reason: 'writable-workspace-file' };
+    }
+    // (7) SIGKILL.
+    deps.sendSignal(target.pid, 'SIGKILL');
+    return { action: 'killed' };
+}
+//# sourceMappingURL=ExternalHogKillFunnel.js.map

package/dist/monitoring/ExternalHogKillFunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogKillFunnel.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogKillFunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAyB,MAAM,uBAAuB,CAAC;AACtG,OAAO,EAAE,WAAW,EAAkC,MAAM,2BAA2B,CAAC;AAgDxF;4DAC4D;AAC5D,KAAK,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5H,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/G,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC7E,iGAAiG;IACjG,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB,EAAE,IAAoB,EAAE,IAAoB;IAChG,qDAAqD;IACrD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,CAAC,+DAA+D;IAEpF,uBAAuB;IACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAElD,4CAA4C;IAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExF,+FAA+F;IAC/F,yFAAyF;IACzF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,0FAA0F;QAC1F,OAAO,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClH,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3G,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACnE,CAAC;IAED,eAAe;IACf,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/monitoring/ExternalHogKillLedger.d.ts

@@ -0,0 +1,76 @@
+/**
+ * ExternalHogKillLedger — the P19 loop brakes of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §6).
+ *
+ * A durable ledger of kills that STOPS the sentinel from fighting a respawning process
+ * forever (the #863 reaper-kill-loop shape: 17,503 identical requests). Two brakes, both
+ * pure state machines here (the durable persistence + the actual kill are the caller's):
+ *
+ *  1. RESPAWN BREAKER — after K kills of the same respawn-surviving signature within a
+ *     rolling window, STOP killing it and surface ONE degradation ("keeps respawning — may
+ *     be managed"). The key is the command-hash + a stable discriminator (`--user-data-dir`);
+ *     when only a VOLATILE discriminator is available (round-9), the anti-loop guarantee
+ *     falls back to a CLASS-level breaker (a per-volatile-key breaker could never trip), so
+ *     the loop is still bounded. The breaker shields same-key hogs from further KILL only —
+ *     NEVER from the §4 observability floor.
+ *
+ *  2. IN-FLIGHT SET — a size-capped set of (pid, start-time) SIGTERM'd-but-not-yet-dead
+ *     targets, so a process seen again before it dies is not re-killed each scan. Eviction is
+ *     tied to CONFIRMED exit OR `inFlightKillTtlMs` (~3×sigtermGrace, NOT 2× — which could
+ *     SIGKILL a mid-write language server early).
+ */
+export interface KillRecord {
+    /** The respawn-surviving ledger key (command-hash + stable discriminator). */
+    readonly key: string;
+    /** The allowlist class id (used for the class-level fallback breaker). */
+    readonly classId: string;
+    /** Monotonic-ish wall timestamp of the kill (ms). */
+    readonly atMs: number;
+}
+export interface KillLedgerState {
+    readonly records: readonly KillRecord[];
+}
+export declare const EMPTY_KILL_LEDGER: KillLedgerState;
+export interface BreakerOpts {
+    readonly nowMs: number;
+    /** Rolling window (ms) the K-count is measured over (default 1h). */
+    readonly windowMs: number;
+    /** K — kills of the same key within the window before the breaker trips (default 3). */
+    readonly maxPerWindow: number;
+    /** True when the ledger key is a VOLATILE fallback (no stable discriminator) — count by
+     *  CLASS instead of key, since a per-volatile-key count could never accumulate. */
+    readonly keyIsVolatile: boolean;
+}
+/**
+ * Append a kill and PRUNE records older than the retention bound (so the durable ledger can
+ * never grow without limit). Returns a NEW state (pure).
+ *
+ * CALLER PRECONDITION: `retentionMs >= isBreakerTripped(...).windowMs`. `recordKill` cannot
+ * see the breaker window, so if retention were shorter it would prune kills the breaker still
+ * needs and silently UNDERCOUNT (a spurious not-tripped). The config wires retention ≥ window;
+ * a test asserts the breaker still trips at K when retention == window.
+ */
+export declare function recordKill(state: KillLedgerState, record: KillRecord, retentionMs: number, nowMs: number): KillLedgerState;
+/**
+ * Is the breaker TRIPPED for this (key, classId) — i.e. should the sentinel STOP killing it?
+ * True when ≥ `maxPerWindow` kills of the same signature fall within the rolling window. For a
+ * volatile key, the signature is the CLASS; otherwise it is the exact key.
+ */
+export declare function isBreakerTripped(state: KillLedgerState, key: string, classId: string, opts: BreakerOpts): boolean;
+/** Count of in-window kills for a signature (for the degradation message / observability). */
+export declare function killCountInWindow(state: KillLedgerState, key: string, classId: string, opts: BreakerOpts): number;
+export interface InFlightKill {
+    readonly pid: number;
+    readonly startTime: string;
+    /** When SIGTERM was sent (ms). */
+    readonly sigtermAtMs: number;
+}
+/**
+ * Should an in-flight entry be EVICTED? Yes on CONFIRMED exit, or once `ttlMs` has elapsed
+ * since SIGTERM (a ceiling comfortably longer than sigtermGrace so a mid-write LS is not
+ * re-entered early). A non-finite `nowMs`/`ttlMs` evicts (fail toward not leaking the set).
+ */
+export declare function shouldEvictInFlight(entry: InFlightKill, nowMs: number, ttlMs: number, confirmedGone: boolean): boolean;
+/** Is this pid+start-time already in-flight (so we must NOT re-kill it this scan)? */
+export declare function isInFlight(set: readonly InFlightKill[], pid: number, startTime: string): boolean;
+//# sourceMappingURL=ExternalHogKillLedger.d.ts.map

package/dist/monitoring/ExternalHogKillLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogKillLedger.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogKillLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;CACzC;AAED,eAAO,MAAM,iBAAiB,EAAE,eAAiC,CAAC;AAElE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;uFACmF;IACnF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,CAI1H;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAqBjH;AAED,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAGjH;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAItH;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEhG"}

package/dist/monitoring/ExternalHogKillLedger.js

@@ -0,0 +1,84 @@
+/**
+ * ExternalHogKillLedger — the P19 loop brakes of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §6).
+ *
+ * A durable ledger of kills that STOPS the sentinel from fighting a respawning process
+ * forever (the #863 reaper-kill-loop shape: 17,503 identical requests). Two brakes, both
+ * pure state machines here (the durable persistence + the actual kill are the caller's):
+ *
+ *  1. RESPAWN BREAKER — after K kills of the same respawn-surviving signature within a
+ *     rolling window, STOP killing it and surface ONE degradation ("keeps respawning — may
+ *     be managed"). The key is the command-hash + a stable discriminator (`--user-data-dir`);
+ *     when only a VOLATILE discriminator is available (round-9), the anti-loop guarantee
+ *     falls back to a CLASS-level breaker (a per-volatile-key breaker could never trip), so
+ *     the loop is still bounded. The breaker shields same-key hogs from further KILL only —
+ *     NEVER from the §4 observability floor.
+ *
+ *  2. IN-FLIGHT SET — a size-capped set of (pid, start-time) SIGTERM'd-but-not-yet-dead
+ *     targets, so a process seen again before it dies is not re-killed each scan. Eviction is
+ *     tied to CONFIRMED exit OR `inFlightKillTtlMs` (~3×sigtermGrace, NOT 2× — which could
+ *     SIGKILL a mid-write language server early).
+ */
+export const EMPTY_KILL_LEDGER = { records: [] };
+/**
+ * Append a kill and PRUNE records older than the retention bound (so the durable ledger can
+ * never grow without limit). Returns a NEW state (pure).
+ *
+ * CALLER PRECONDITION: `retentionMs >= isBreakerTripped(...).windowMs`. `recordKill` cannot
+ * see the breaker window, so if retention were shorter it would prune kills the breaker still
+ * needs and silently UNDERCOUNT (a spurious not-tripped). The config wires retention ≥ window;
+ * a test asserts the breaker still trips at K when retention == window.
+ */
+export function recordKill(state, record, retentionMs, nowMs) {
+    const cutoff = nowMs - retentionMs;
+    const kept = state.records.filter((r) => r.atMs >= cutoff);
+    return { records: [...kept, record] };
+}
+/**
+ * Is the breaker TRIPPED for this (key, classId) — i.e. should the sentinel STOP killing it?
+ * True when ≥ `maxPerWindow` kills of the same signature fall within the rolling window. For a
+ * volatile key, the signature is the CLASS; otherwise it is the exact key.
+ */
+export function isBreakerTripped(state, key, classId, opts) {
+    // Fail toward the SAFE direction for a loop brake: if we can't reason about the window,
+    // TRIP (stop killing) rather than risk an unbounded loop. This must reject not only
+    // NON-FINITE inputs but also a NON-POSITIVE `windowMs` (≤ 0 is finite but nonsensical: it
+    // would make `since = now - windowMs >= now`, so every real record falls before `since`, the
+    // count collapses to ~0, and the breaker would spuriously report NOT-tripped — the dangerous
+    // unbounded-loop direction). `maxPerWindow ≤ 0` is safe either way (trips always) but is
+    // treated as unreasoned too. (round-11 — second-pass reviewer.)
+    if (!Number.isFinite(opts.nowMs) ||
+        !(Number.isFinite(opts.windowMs) && opts.windowMs > 0) ||
+        !(Number.isFinite(opts.maxPerWindow) && opts.maxPerWindow > 0)) {
+        return true;
+    }
+    const since = opts.nowMs - opts.windowMs;
+    const count = state.records.filter((r) => {
+        if (r.atMs < since)
+            return false;
+        return opts.keyIsVolatile ? r.classId === classId : r.key === key;
+    }).length;
+    return count >= opts.maxPerWindow;
+}
+/** Count of in-window kills for a signature (for the degradation message / observability). */
+export function killCountInWindow(state, key, classId, opts) {
+    const since = opts.nowMs - opts.windowMs;
+    return state.records.filter((r) => r.atMs >= since && (opts.keyIsVolatile ? r.classId === classId : r.key === key)).length;
+}
+/**
+ * Should an in-flight entry be EVICTED? Yes on CONFIRMED exit, or once `ttlMs` has elapsed
+ * since SIGTERM (a ceiling comfortably longer than sigtermGrace so a mid-write LS is not
+ * re-entered early). A non-finite `nowMs`/`ttlMs` evicts (fail toward not leaking the set).
+ */
+export function shouldEvictInFlight(entry, nowMs, ttlMs, confirmedGone) {
+    if (confirmedGone)
+        return true;
+    if (!Number.isFinite(nowMs) || !Number.isFinite(ttlMs) || !Number.isFinite(entry.sigtermAtMs))
+        return true;
+    return nowMs - entry.sigtermAtMs >= ttlMs;
+}
+/** Is this pid+start-time already in-flight (so we must NOT re-kill it this scan)? */
+export function isInFlight(set, pid, startTime) {
+    return set.some((e) => e.pid === pid && e.startTime === startTime);
+}
+//# sourceMappingURL=ExternalHogKillLedger.js.map

package/dist/monitoring/ExternalHogKillLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogKillLedger.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogKillLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAeH,MAAM,CAAC,MAAM,iBAAiB,GAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAalE;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB,EAAE,MAAkB,EAAE,WAAmB,EAAE,KAAa;IACvG,MAAM,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAsB,EAAE,GAAW,EAAE,OAAe,EAAE,IAAiB;IACtG,wFAAwF;IACxF,oFAAoF;IACpF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,yFAAyF;IACzF,gEAAgE;IAChE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,EAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK;YAAE,OAAO,KAAK,CAAC;QACjC,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;IACpE,CAAC,CAAC,CAAC,MAAM,CAAC;IACV,OAAO,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;AACpC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,KAAsB,EAAE,GAAW,EAAE,OAAe,EAAE,IAAiB;IACvG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7H,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,KAAa,EAAE,KAAa,EAAE,aAAsB;IAC3G,IAAI,aAAa;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3G,OAAO,KAAK,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC;AAC5C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,GAA4B,EAAE,GAAW,EAAE,SAAiB;IACrF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AACrE,CAAC"}

package/dist/monitoring/ExternalHogNoticeCoalescer.d.ts

@@ -0,0 +1,46 @@
+/**
+ * ExternalHogNoticeCoalescer — the P17 notification-bounding of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §6).
+ *
+ * A SINGLE coalescing chokepoint over EVERY notice class — kills, decider-unavailable alerts,
+ * floor-veto downgrades, and the deterministic "sustained hog left alive" observability
+ * alerts — so a persistent condition (a hog the model keeps sparing, a provider outage) raises
+ * ONE coalesced notice, not one-per-scan. Pure selection logic (the actual delivery is the
+ * caller's). Rules (§6):
+ *   - per-signature DEDUP: the same (class, signature) within the window collapses to one.
+ *   - per-window BUDGET (`noticeBudgetPerWindow`): at most N notices per window.
+ *   - budget-exhaustion SEVERITY ORDER: kill > decider-unavailable > floor-veto-downgrade >
+ *     hog-left-alive. Lower classes are dropped first, and the DROPPED count is reported.
+ *   - a LIVE KILL notice ALWAYS pierces the budget (never dropped) — an actual kill must be
+ *     surfaced no matter how noisy the window is.
+ */
+export type NoticeClass = 'kill' | 'decider-unavailable' | 'floor-veto-downgrade' | 'hog-left-alive';
+export interface Notice {
+    readonly cls: NoticeClass;
+    /** Per-signature dedup key (e.g. the command-hash / class id). */
+    readonly signature: string;
+    /** Human-facing text (already scrubbed by the caller). */
+    readonly text: string;
+}
+export interface CoalesceResult {
+    /** The notices to actually emit this cycle (deduped, budget-bounded, kills always kept). */
+    readonly emitted: readonly Notice[];
+    /** How many notices of each class were dropped by the budget (for the coalesced summary). */
+    readonly droppedByClass: Readonly<Partial<Record<NoticeClass, number>>>;
+    /** Total dropped. */
+    readonly droppedTotal: number;
+}
+export interface CoalesceOpts {
+    /** Max notices per window (default 4). Live kills are exempt (always kept). */
+    readonly budgetPerWindow: number;
+    /** Signatures already emitted earlier in this window (per-signature dedup across the window). */
+    readonly alreadyEmittedSignatures?: ReadonlySet<string>;
+}
+/**
+ * Select which notices to emit this cycle. Dedups by (class, signature) within the batch and
+ * against `alreadyEmittedSignatures`, keeps ALL live kills (they pierce the budget), then fills
+ * the remaining budget with the highest-severity classes first; the rest are dropped and
+ * counted. Pure — returns a new result, mutates nothing.
+ */
+export declare function coalesceNotices(notices: readonly Notice[], opts: CoalesceOpts): CoalesceResult;
+//# sourceMappingURL=ExternalHogNoticeCoalescer.d.ts.map

package/dist/monitoring/ExternalHogNoticeCoalescer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogNoticeCoalescer.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogNoticeCoalescer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,qBAAqB,GAAG,sBAAsB,GAAG,gBAAgB,CAAC;AAUrG,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,qBAAqB;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,GAAG,cAAc,CAkC9F"}

package/dist/monitoring/ExternalHogNoticeCoalescer.js

@@ -0,0 +1,67 @@
+/**
+ * ExternalHogNoticeCoalescer — the P17 notification-bounding of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §6).
+ *
+ * A SINGLE coalescing chokepoint over EVERY notice class — kills, decider-unavailable alerts,
+ * floor-veto downgrades, and the deterministic "sustained hog left alive" observability
+ * alerts — so a persistent condition (a hog the model keeps sparing, a provider outage) raises
+ * ONE coalesced notice, not one-per-scan. Pure selection logic (the actual delivery is the
+ * caller's). Rules (§6):
+ *   - per-signature DEDUP: the same (class, signature) within the window collapses to one.
+ *   - per-window BUDGET (`noticeBudgetPerWindow`): at most N notices per window.
+ *   - budget-exhaustion SEVERITY ORDER: kill > decider-unavailable > floor-veto-downgrade >
+ *     hog-left-alive. Lower classes are dropped first, and the DROPPED count is reported.
+ *   - a LIVE KILL notice ALWAYS pierces the budget (never dropped) — an actual kill must be
+ *     surfaced no matter how noisy the window is.
+ */
+/** Severity for budget-exhaustion ordering (higher = kept first). */
+const CLASS_SEVERITY = {
+    kill: 3,
+    'decider-unavailable': 2,
+    'floor-veto-downgrade': 1,
+    'hog-left-alive': 0,
+};
+/**
+ * Select which notices to emit this cycle. Dedups by (class, signature) within the batch and
+ * against `alreadyEmittedSignatures`, keeps ALL live kills (they pierce the budget), then fills
+ * the remaining budget with the highest-severity classes first; the rest are dropped and
+ * counted. Pure — returns a new result, mutates nothing.
+ */
+export function coalesceNotices(notices, opts) {
+    const budget = Number.isFinite(opts.budgetPerWindow) && opts.budgetPerWindow > 0 ? Math.floor(opts.budgetPerWindow) : 0;
+    const already = opts.alreadyEmittedSignatures ?? new Set();
+    // (1) per-signature dedup within the batch (first wins) AND vs the window's prior emissions.
+    const seen = new Set();
+    const deduped = [];
+    for (const n of notices) {
+        if (!n || !isNoticeClass(n.cls))
+            continue;
+        const key = `${n.cls}::${n.signature}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (already.has(key))
+            continue; // already surfaced this window
+        deduped.push(n);
+    }
+    // (2) live kills ALWAYS pierce the budget.
+    const kills = deduped.filter((n) => n.cls === 'kill');
+    const nonKills = deduped.filter((n) => n.cls !== 'kill');
+    // (3) fill the remaining budget with the highest-severity non-kill classes first (stable).
+    const remaining = Math.max(0, budget - kills.length);
+    const orderedNonKills = [...nonKills].sort((a, b) => CLASS_SEVERITY[b.cls] - CLASS_SEVERITY[a.cls]);
+    const keptNonKills = orderedNonKills.slice(0, remaining);
+    const droppedNonKills = orderedNonKills.slice(remaining);
+    const droppedByClass = {};
+    for (const n of droppedNonKills)
+        droppedByClass[n.cls] = (droppedByClass[n.cls] ?? 0) + 1;
+    return {
+        emitted: [...kills, ...keptNonKills],
+        droppedByClass,
+        droppedTotal: droppedNonKills.length,
+    };
+}
+function isNoticeClass(c) {
+    return c === 'kill' || c === 'decider-unavailable' || c === 'floor-veto-downgrade' || c === 'hog-left-alive';
+}
+//# sourceMappingURL=ExternalHogNoticeCoalescer.js.map

package/dist/monitoring/ExternalHogNoticeCoalescer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogNoticeCoalescer.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogNoticeCoalescer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,qEAAqE;AACrE,MAAM,cAAc,GAAgC;IAClD,IAAI,EAAE,CAAC;IACP,qBAAqB,EAAE,CAAC;IACxB,sBAAsB,EAAE,CAAC;IACzB,gBAAgB,EAAE,CAAC;CACpB,CAAC;AA0BF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B,EAAE,IAAkB;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,IAAI,IAAI,GAAG,EAAU,CAAC;IAEnE,6FAA6F;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,+BAA+B;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2CAA2C;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;IAEzD,2FAA2F;IAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpG,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,cAAc,GAAyC,EAAE,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,eAAe;QAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAE1F,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,YAAY,CAAC;QACpC,cAAc;QACd,YAAY,EAAE,eAAe,CAAC,MAAM;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,qBAAqB,IAAI,CAAC,KAAK,sBAAsB,IAAI,CAAC,KAAK,gBAAgB,CAAC;AAC/G,CAAC"}

package/dist/monitoring/ExternalHogOwnership.d.ts

@@ -0,0 +1,48 @@
+/**
+ * ExternalHogOwnership — the instar-own-process exclusion of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1).
+ *
+ * A candidate must be EXCLUDED from discovery if its ancestry reaches an instar-owned pid —
+ * otherwise a legitimately-busy build/test child of a live instar session (a vitest worker,
+ * `tsc`, a compiler) becomes a confirmed sustained hog and spams the observability floor
+ * during exactly the heavy work instar is designed for (the 2026-07-02 29-vitest-root storm).
+ *
+ * This is the PURE ancestry walk over a process-tree SNAPSHOT (the actual `ps` read that
+ * builds the tree is a later I/O slice). Two round-9/10-reviewed design points:
+ *
+ *  1. START-TIME-AWARE (not a bare pid walk): `resolveOwningSession` supplies only the
+ *     cycle-guard + hop-bound and takes NO start-time — so this EXTENDS it. Each owned pid is
+ *     matched by BOTH pid AND its recorded start-time, so a REUSED pid that coincidentally
+ *     equals an instar-owned pid number does NOT falsely exclude (its start-time won't match).
+ *
+ *  2. INCLUDE-on-uncertainty is the ANTI-EVASION direction: if the chain can't be resolved
+ *     (a hop's pid isn't in the snapshot, or a cycle/hop-bound), the candidate is treated as
+ *     NOT instar-owned (stays a candidate). instar-own KILL protection is carried NOT by this
+ *     walk but by reparent-to-pid-1 semantics + the §4 allowlist floor (an instar build child
+ *     won't match the exthost allowlist regex anyway) — so INCLUDE-on-uncertainty costs only
+ *     occasional observability noise, never a wrong kill, and it prevents an external hog from
+ *     FALSE-EXCLUDING itself by faking an instar ancestor via a stale/foreign edge.
+ *
+ *  BOTH a tmux-pane ancestor AND an own-root pid count (round-10 integration: under launchd
+ *  supervision the launchd-direct lifeline has NO tmux ancestor, so a tmux-only walk misses
+ *  its descendants). The caller supplies both sets, merged into `ownedRefs`.
+ */
+export interface ProcNode {
+    readonly pid: number;
+    readonly ppid: number;
+    /** The process's start-time (from `ps lstart=`), used to defeat pid reuse. */
+    readonly startTime: string;
+}
+/** A process-tree snapshot: pid → its node. Built by the sampler from one `ps` read. */
+export type ProcTree = ReadonlyMap<number, ProcNode>;
+/** instar-owned pids (server `process.pid`, sampler pid, resolvable lifeline pid, tmux panes),
+ *  each mapped to its EXPECTED start-time so a reused pid can't spoof ownership. */
+export type OwnedRefs = ReadonlyMap<number, string>;
+/**
+ * Is `candidatePid` instar-owned — i.e. does its ppid-chain reach an owned pid whose recorded
+ * start-time matches? Walks up to `maxHops`, cycle-guarded. Returns FALSE (not owned → stays a
+ * candidate) on any unresolvable edge or on reaching init (ppid ≤ 1) — the anti-evasion
+ * direction. `maxHops <= 0` or a non-finite candidate → not owned (nothing to verify).
+ */
+export declare function isInstarOwned(candidatePid: number, tree: ProcTree, ownedRefs: OwnedRefs, maxHops: number): boolean;
+//# sourceMappingURL=ExternalHogOwnership.d.ts.map

package/dist/monitoring/ExternalHogOwnership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogOwnership.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogOwnership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAErD;oFACoF;AACpF,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAqBlH"}

package/dist/monitoring/ExternalHogOwnership.js

@@ -0,0 +1,60 @@
+/**
+ * ExternalHogOwnership — the instar-own-process exclusion of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1).
+ *
+ * A candidate must be EXCLUDED from discovery if its ancestry reaches an instar-owned pid —
+ * otherwise a legitimately-busy build/test child of a live instar session (a vitest worker,
+ * `tsc`, a compiler) becomes a confirmed sustained hog and spams the observability floor
+ * during exactly the heavy work instar is designed for (the 2026-07-02 29-vitest-root storm).
+ *
+ * This is the PURE ancestry walk over a process-tree SNAPSHOT (the actual `ps` read that
+ * builds the tree is a later I/O slice). Two round-9/10-reviewed design points:
+ *
+ *  1. START-TIME-AWARE (not a bare pid walk): `resolveOwningSession` supplies only the
+ *     cycle-guard + hop-bound and takes NO start-time — so this EXTENDS it. Each owned pid is
+ *     matched by BOTH pid AND its recorded start-time, so a REUSED pid that coincidentally
+ *     equals an instar-owned pid number does NOT falsely exclude (its start-time won't match).
+ *
+ *  2. INCLUDE-on-uncertainty is the ANTI-EVASION direction: if the chain can't be resolved
+ *     (a hop's pid isn't in the snapshot, or a cycle/hop-bound), the candidate is treated as
+ *     NOT instar-owned (stays a candidate). instar-own KILL protection is carried NOT by this
+ *     walk but by reparent-to-pid-1 semantics + the §4 allowlist floor (an instar build child
+ *     won't match the exthost allowlist regex anyway) — so INCLUDE-on-uncertainty costs only
+ *     occasional observability noise, never a wrong kill, and it prevents an external hog from
+ *     FALSE-EXCLUDING itself by faking an instar ancestor via a stale/foreign edge.
+ *
+ *  BOTH a tmux-pane ancestor AND an own-root pid count (round-10 integration: under launchd
+ *  supervision the launchd-direct lifeline has NO tmux ancestor, so a tmux-only walk misses
+ *  its descendants). The caller supplies both sets, merged into `ownedRefs`.
+ */
+/**
+ * Is `candidatePid` instar-owned — i.e. does its ppid-chain reach an owned pid whose recorded
+ * start-time matches? Walks up to `maxHops`, cycle-guarded. Returns FALSE (not owned → stays a
+ * candidate) on any unresolvable edge or on reaching init (ppid ≤ 1) — the anti-evasion
+ * direction. `maxHops <= 0` or a non-finite candidate → not owned (nothing to verify).
+ */
+export function isInstarOwned(candidatePid, tree, ownedRefs, maxHops) {
+    if (!Number.isInteger(candidatePid) || candidatePid <= 0)
+        return false;
+    if (!Number.isFinite(maxHops) || maxHops <= 0)
+        return false;
+    const seen = new Set();
+    let current = candidatePid;
+    for (let hop = 0; hop < maxHops; hop++) {
+        if (seen.has(current))
+            return false; // cycle → can't resolve → not owned (anti-evasion)
+        seen.add(current);
+        const node = tree.get(current);
+        if (!node)
+            return false; // pid not in the snapshot → unresolvable → not owned
+        // Owned iff this pid is a known instar pid AND its start-time matches (defeats pid reuse).
+        const expectedStart = ownedRefs.get(current);
+        if (expectedStart !== undefined && expectedStart === node.startTime)
+            return true;
+        if (node.ppid <= 1)
+            return false; // reached init/launchd — a genuine orphan, no instar ancestor
+        current = node.ppid;
+    }
+    return false; // hop-bound exceeded → not owned (bounded; the floor still gates any kill)
+}
+//# sourceMappingURL=ExternalHogOwnership.js.map

package/dist/monitoring/ExternalHogOwnership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogOwnership.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogOwnership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAgBH;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,IAAc,EAAE,SAAoB,EAAE,OAAe;IACvG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAG,YAAY,CAAC;IAC3B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,mDAAmD;QACxF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAElB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,qDAAqD;QAE9E,2FAA2F;QAC3F,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAEjF,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,8DAA8D;QAChG,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,2EAA2E;AAC3F,CAAC"}

package/dist/monitoring/ExternalHogProcTable.d.ts

@@ -0,0 +1,37 @@
+/**
+ * ExternalHogProcTable — the whole-table `ps` parser of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1).
+ *
+ * Parses the output of `ps -o pid=,ppid=,uid=,lstart=,time=,comm=` (no header) into rows the
+ * sampler uses to build the ProcTree + the per-pid cumulative-CPU-time map. This parser is
+ * LOAD-BEARING for kill eligibility (the CPU-delta pivots on `time=`), so it is REGISTERED in
+ * SCRAPE_PARSERS with a captured realness fixture (§Testing) — it must survive the real
+ * structural bytes: a `[dd-]hh:mm:ss` day-prefix time (the ~24h anchor case), an `lstart`
+ * value with embedded spaces + space-padded day-of-month, a `comm` with embedded spaces, a
+ * `<defunct>` row, and a short/permission-denied row.
+ *
+ * Fail-closed: a row whose pid/ppid/uid can't be parsed is SKIPPED (an unidentifiable process
+ * is not a candidate); a row whose `time=` is malformed keeps the row but sets
+ * `cputimeSeconds: undefined` → the CPU-delta yields UNKNOWN → alert-never-kill.
+ */
+export interface ProcTableRow {
+    readonly pid: number;
+    readonly ppid: number;
+    readonly uid: number;
+    /** The `lstart` value (5 whitespace tokens joined) — an OPAQUE identity token (pid-reuse
+     *  guard), never parsed as a date. */
+    readonly startTime: string;
+    /** Cumulative (user+system) CPU seconds from `time=`, or `undefined` if unparseable. */
+    readonly cputimeSeconds: number | undefined;
+    /** The command (last field; may contain spaces). Attacker-controllable — treated as data. */
+    readonly comm: string;
+}
+/**
+ * Parse `ps -o pid=,ppid=,uid=,lstart=,time=,comm=` output into rows. Column layout per line:
+ *   pid ppid uid  <Dow Mon DD HH:MM:SS YYYY>  time  comm...
+ * The first 3 fields are numeric, `lstart` is exactly 5 whitespace tokens (the space-padded
+ * day-of-month collapses under a whitespace-run split), `time` is one token, and `comm` is the
+ * remainder. Splitting on whitespace RUNS makes the space-padding and column alignment robust.
+ */
+export declare function parseProcTable(psOutput: string): ProcTableRow[];
+//# sourceMappingURL=ExternalHogProcTable.d.ts.map

package/dist/monitoring/ExternalHogProcTable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogProcTable.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogProcTable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;0CACsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAQD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAuB/D"}

package/dist/monitoring/ExternalHogProcTable.js

@@ -0,0 +1,65 @@
+/**
+ * ExternalHogProcTable — the whole-table `ps` parser of the External-Hog sentinel
+ * (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1).
+ *
+ * Parses the output of `ps -o pid=,ppid=,uid=,lstart=,time=,comm=` (no header) into rows the
+ * sampler uses to build the ProcTree + the per-pid cumulative-CPU-time map. This parser is
+ * LOAD-BEARING for kill eligibility (the CPU-delta pivots on `time=`), so it is REGISTERED in
+ * SCRAPE_PARSERS with a captured realness fixture (§Testing) — it must survive the real
+ * structural bytes: a `[dd-]hh:mm:ss` day-prefix time (the ~24h anchor case), an `lstart`
+ * value with embedded spaces + space-padded day-of-month, a `comm` with embedded spaces, a
+ * `<defunct>` row, and a short/permission-denied row.
+ *
+ * Fail-closed: a row whose pid/ppid/uid can't be parsed is SKIPPED (an unidentifiable process
+ * is not a candidate); a row whose `time=` is malformed keeps the row but sets
+ * `cputimeSeconds: undefined` → the CPU-delta yields UNKNOWN → alert-never-kill.
+ */
+import { parseProcTimeToSeconds } from '../core/SessionManager.js';
+/** A `time=` value: optional `dd-`, then `[[hh:]mm:]ss[.ff]` — at most TWO colon groups
+ *  (`hh:mm:ss`). Bounded to the real ps format (the round-9 reviewer noted an unbounded
+ *  `(\d+:)*` was cosmetically lax though unreachable via t[8]; this closes it, strictly toward
+ *  fail-closed). */
+const PROC_TIME_RE = /^(\d+-)?(\d+:){0,2}\d+(\.\d+)?$/;
+/**
+ * Parse `ps -o pid=,ppid=,uid=,lstart=,time=,comm=` output into rows. Column layout per line:
+ *   pid ppid uid  <Dow Mon DD HH:MM:SS YYYY>  time  comm...
+ * The first 3 fields are numeric, `lstart` is exactly 5 whitespace tokens (the space-padded
+ * day-of-month collapses under a whitespace-run split), `time` is one token, and `comm` is the
+ * remainder. Splitting on whitespace RUNS makes the space-padding and column alignment robust.
+ */
+export function parseProcTable(psOutput) {
+    if (typeof psOutput !== 'string')
+        return [];
+    const rows = [];
+    for (const rawLine of psOutput.split('\n')) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        const t = line.split(/\s+/);
+        // Need pid ppid uid (3) + lstart (5) + time (1) + >=1 comm token = >=10 tokens.
+        if (t.length < 10)
+            continue;
+        const pid = toPosInt(t[0]);
+        const ppid = toInt(t[1]);
+        const uid = toInt(t[2]);
+        if (pid === null || ppid === null || uid === null)
+            continue; // unidentifiable → skip
+        const startTime = t.slice(3, 8).join(' ');
+        const timeTok = t[8];
+        const cputimeSeconds = PROC_TIME_RE.test(timeTok) ? parseProcTimeToSeconds(timeTok) : undefined;
+        const comm = t.slice(9).join(' ');
+        rows.push({ pid, ppid, uid, startTime, cputimeSeconds, comm });
+    }
+    return rows;
+}
+function toInt(s) {
+    if (s === undefined || !/^-?\d+$/.test(s))
+        return null;
+    const n = Number(s);
+    return Number.isInteger(n) ? n : null;
+}
+function toPosInt(s) {
+    const n = toInt(s);
+    return n !== null && n > 0 ? n : null;
+}
+//# sourceMappingURL=ExternalHogProcTable.js.map

package/dist/monitoring/ExternalHogProcTable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogProcTable.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogProcTable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAenE;;;oBAGoB;AACpB,MAAM,YAAY,GAAG,iCAAiC,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,gFAAgF;QAChF,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;YAAE,SAAS;QAE5B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS,CAAC,wBAAwB;QAErF,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,CAAqB;IAClC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC"}