instar 1.3.762 → 1.3.764

package/dist/monitoring/ExternalHogScanTick.js

@@ -0,0 +1,126 @@
+/**
+ * ExternalHogScanTick — the orchestrator that composes the External-Hog sentinel's modules into
+ * ONE scan tick (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1-§6).
+ *
+ * This is the "make it alive" integration: discovery (sampler) → classify (worst-CPU-first under
+ * the cap) → floor → kill funnel → P19 ledger → P17 coalesced notices. All I/O is INJECTED
+ * (read ps, build ownership, classify, the kill-funnel deps, clock, deliver) so the whole tick
+ * is end-to-end testable without a real ps read, a real model call, or a real signal. The thin
+ * server-side wiring (the actual ps spawn, LlmQueue call, notice delivery, interval) is a
+ * separate slice; this is the pure control flow that ties the reviewed modules together.
+ *
+ * Watch-only rides through: the kill funnel returns `would-kill` (no signal) unless a live kill
+ * is authorized, so in the shipped dryRun state a scan tick produces would-kill records + the
+ * §4 observability notices, and kills NOTHING.
+ */
+import { advanceSampler } from './ExternalHogSampler.js';
+import { selectForClassification, parseClassifierVerdict } from './ExternalHogClassifier.js';
+import { evaluateKillFloor } from './ExternalHogFloor.js';
+import { runKillFunnel } from './ExternalHogKillFunnel.js';
+import { isBreakerTripped, recordKill, } from './ExternalHogKillLedger.js';
+import { coalesceNotices } from './ExternalHogNoticeCoalescer.js';
+import { advanceSustained, isSustained, candidateSignature } from './ExternalHogSustained.js';
+/**
+ * Run one scan tick. Pure control flow over the injected I/O; mutates nothing. In the shipped
+ * dryRun state every `outcome` is `would-kill`/`alert-only` and no signal is sent.
+ */
+export async function runScanTick(state, deps, opts) {
+    const now = deps.nowMs();
+    const table = deps.readProcTable();
+    const { tree, owned } = deps.buildOwnership(table);
+    // Stage-1 candidacy.
+    const tick = advanceSampler(state.sampler, table, tree, owned, now, opts.sampler);
+    const nextSampler = tick.nextState;
+    // Stage-2 sustained confirmation (§1 anti-spike): advance the per-signature streak with THIS
+    // tick's over-threshold candidates. A failed/empty parse yields no candidates → every streak
+    // resets (fail toward not-sustained). This is the AUTHORITATIVE N-window signal that overrides
+    // whatever single-window read the fact builder produced.
+    const sustainedTick = advanceSustained(state.sustained, tick.candidates.map((c) => candidateSignature(c.pid, c.startTime)));
+    const nextSustained = sustainedTick.nextState;
+    // Worst-CPU-first under the per-scan classifier cap.
+    const outcomes = [];
+    const notices = [];
+    let ledger = state.ledger;
+    // Enrich candidates. A candidate whose facts VANISHED (factsFor null) is skipped silently —
+    // the process is gone, there is nothing to surface. But a PRESENT candidate (non-null facts)
+    // that we can't fully IDENTIFY (identityFor null — e.g. a sustained hog outside the killable
+    // allowlist class, or an identity race on the command-hash) is NEVER a killable target, yet
+    // it IS a sustained external hog: it MUST be SURFACED, never silently dropped (round-13 —
+    // second-pass reviewer: the §4 broad-observability guarantee — no present hog is invisible).
+    const enriched = [];
+    for (const c of tick.candidates) {
+        const rawFacts = await deps.factsFor(c);
+        if (!rawFacts)
+            continue; // vanished → nothing to surface (safe)
+        // Override sustainedHighCpu with the AUTHORITATIVE N-window signal: it stays true ONLY if the
+        // fact builder's single-window read was GENUINELY boolean-true AND the streak has reached N
+        // consecutive windows (§1). A one-window spike (streak < N) is forced to false → the floor's
+        // hard veto downgrades it to alert — never a kill on a transient burst.
+        //
+        // We apply the AND-gate ONLY to a strict `=== true`; a MALFORMED value (a degraded fact
+        // builder emitting `1`/undefined/null under the CPU starvation this sentinel hunts) is
+        // PRESERVED verbatim, NOT coerced. `x && sustained` would launder a truthy non-boolean into
+        // boolean `true`, defeating the floor's round-11 `typeof !== 'boolean' → field-unknown` veto
+        // in the kill-PERMITTING direction (Phase-5 reviewer). Preserving it keeps that veto intact.
+        const sustained = isSustained(sustainedTick, candidateSignature(c.pid, c.startTime), opts.sustainedSampleCount);
+        const facts = { ...rawFacts, sustainedHighCpu: rawFacts.sustainedHighCpu === true ? sustained : rawFacts.sustainedHighCpu };
+        const id = deps.identityFor(c, facts);
+        if (!id) {
+            // Present sustained hog, not kill-eligible → surface (observability), never classify/kill.
+            notices.push({ cls: 'hog-left-alive', signature: `${c.pid} ${c.startTime}`, text: `sustained external hog (not kill-eligible): pid ${c.pid}` });
+            continue;
+        }
+        enriched.push({ c, facts, id, tuple: { pid: c.pid, startTime: c.startTime, commandHash: id.commandHash }, coreEquivalents: c.coreEquivalents });
+    }
+    const { toClassify, degradedToAlert } = selectForClassification(enriched, opts.maxClassificationsPerScan);
+    for (const cand of toClassify) {
+        const floor = evaluateKillFloor(cand.facts);
+        const raw = await deps.classify(cand.facts);
+        const verdict = parseClassifierVerdict(raw); // null → decider-unavailable → alert
+        // The §4 observability floor: a deterministic sustained hog that is NOT killed is ALWAYS
+        // surfaced (the model can never silence it).
+        const surfaceLeftAlive = () => notices.push({ cls: 'hog-left-alive', signature: cand.id.ledgerKey, text: `sustained hog left alive: pid ${cand.c.pid}` });
+        if (verdict === null) {
+            // Decider unavailable → no kill → alert.
+            outcomes.push({ pid: cand.c.pid, ledgerKey: cand.id.ledgerKey, classId: cand.id.classId, verdict: 'decider-unavailable', outcome: 'alert-only' });
+            notices.push({ cls: 'decider-unavailable', signature: cand.id.ledgerKey, text: `decider unavailable: pid ${cand.c.pid}` });
+            continue;
+        }
+        if (verdict !== 'kill' || !floor.permitted) {
+            // Model spared it, or the floor vetoes → alert-only (observability floor still surfaces).
+            outcomes.push({ pid: cand.c.pid, ledgerKey: cand.id.ledgerKey, classId: cand.id.classId, verdict, outcome: 'alert-only' });
+            surfaceLeftAlive();
+            if (!floor.permitted)
+                notices.push({ cls: 'floor-veto-downgrade', signature: cand.id.ledgerKey, text: `floor vetoed a kill: pid ${cand.c.pid}` });
+            continue;
+        }
+        // verdict === 'kill' && floor permits. Check the P19 breaker before acting.
+        const tripped = isBreakerTripped(ledger, cand.id.ledgerKey, cand.id.classId, { ...opts.breaker, nowMs: now });
+        if (tripped) {
+            outcomes.push({ pid: cand.c.pid, ledgerKey: cand.id.ledgerKey, classId: cand.id.classId, verdict, outcome: 'alert-only' });
+            surfaceLeftAlive(); // shielded from KILL only, never from surfacing
+            continue;
+        }
+        // Run the kill funnel (watch-only unless armed → would-kill, no signal).
+        const target = { pid: cand.c.pid, startTime: cand.c.startTime, commandHash: cand.id.commandHash, classId: cand.id.classId };
+        const funnelOpts = { ...opts.killFunnel, currentDeferrals: deps.deferralsFor(cand.id.ledgerKey) };
+        const outcome = await runKillFunnel(target, funnelOpts, deps.killFunnelDeps);
+        outcomes.push({ pid: cand.c.pid, ledgerKey: cand.id.ledgerKey, classId: cand.id.classId, verdict, outcome });
+        if (outcome.action === 'killed') {
+            ledger = recordKill(ledger, { key: cand.id.ledgerKey, classId: cand.id.classId, atMs: now }, opts.killLedgerRetentionMs, now);
+            notices.push({ cls: 'kill', signature: cand.id.ledgerKey, text: `auto-killed zombie: pid ${cand.c.pid}` });
+        }
+        else {
+            // would-kill (watch-only) / deferred / aborted / sigterm-exited → surface as left-alive.
+            surfaceLeftAlive();
+        }
+    }
+    // The over-cap remainder degrades to alert-only (observability floor).
+    for (const cand of degradedToAlert) {
+        outcomes.push({ pid: cand.c.pid, ledgerKey: cand.id.ledgerKey, classId: cand.id.classId, verdict: 'decider-unavailable', outcome: 'alert-only' });
+        notices.push({ cls: 'hog-left-alive', signature: cand.id.ledgerKey, text: `sustained hog left alive (over cap): pid ${cand.c.pid}` });
+    }
+    const coalesced = coalesceNotices(notices, { budgetPerWindow: opts.noticeBudgetPerWindow });
+    return { nextState: { sampler: nextSampler, ledger, sustained: nextSustained }, outcomes, notices: coalesced };
+}
+//# sourceMappingURL=ExternalHogScanTick.js.map

package/dist/monitoring/ExternalHogScanTick.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogScanTick.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogScanTick.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,cAAc,EAAuD,MAAM,yBAAyB,CAAC;AAE9G,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAA0B,MAAM,4BAA4B,CAAC;AACrH,OAAO,EAAE,iBAAiB,EAA8C,MAAM,uBAAuB,CAAC;AACtG,OAAO,EAAE,aAAa,EAA+E,MAAM,4BAA4B,CAAC;AACxI,OAAO,EACL,gBAAgB,EAAE,UAAU,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAoC,MAAM,iCAAiC,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,kBAAkB,EAAuB,MAAM,2BAA2B,CAAC;AA2DnH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAgB,EAAE,IAAc,EAAE,IAAc;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAEnD,qBAAqB;IACrB,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;IAEnC,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,yDAAyD;IACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC;IAE9C,qDAAqD;IACrD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAE1B,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,4FAA4F;IAC5F,0FAA0F;IAC1F,6FAA6F;IAC7F,MAAM,QAAQ,GAA+M,EAAE,CAAC;IAChO,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,uCAAuC;QAChE,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,wEAAwE;QACxE,EAAE;QACF,wFAAwF;QACxF,uFAAuF;QACvF,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,MAAM,SAAS,GAAG,WAAW,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChH,MAAM,KAAK,GAAqB,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9I,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,2FAA2F;YAC3F,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChJ,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IAClJ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAE1G,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,qCAAqC;QAElF,yFAAyF;QACzF,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,iCAAiC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAE1J,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,yCAAyC;YACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YAClJ,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3H,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3C,0FAA0F;YAC1F,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3H,gBAAgB,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAClJ,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9G,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3H,gBAAgB,EAAE,CAAC,CAAC,gDAAgD;YACpE,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAe,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QACxI,MAAM,UAAU,GAAmB,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAClH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAE7G,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC9H,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,2BAA2B,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,yFAAyF;YACzF,gBAAgB,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAClJ,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,4CAA4C,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACjH,CAAC"}

package/dist/monitoring/ExternalHogSentinel.d.ts

@@ -0,0 +1,127 @@
+/**
+ * ExternalHogSentinel — the composition shell that turns the reviewed pure modules into a live,
+ * tickable monitor (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1-§8).
+ *
+ * This is the ADAPTER LAYER, not new decision logic: it holds the cross-tick scan state (sampler
+ * baseline + kill ledger + per-signature deferral counts), reads the real I/O through an INJECTED
+ * adapter seam (so the whole shell is unit-testable with fakes — no real `ps`, model call, or
+ * signal), and on each tick delegates the ENTIRE decision to the reviewed `runScanTick`
+ * orchestrator. It adds nothing to the kill decision: the watch-only guarantee, the floor veto,
+ * the classifier authority, the P19 breaker and P17 coalescing all live below it and are unchanged.
+ *
+ * The shell's only responsibilities:
+ *  - carry state across ticks (sampler map, kill ledger, deferral counts) — none of which the
+ *    pure orchestrator can hold;
+ *  - bridge the async real reads (spawn `ps` off-loop, resolve owned pids) into the sync closures
+ *    the orchestrator expects, by reading BEFORE the tick and closing over the snapshot;
+ *  - persist the deferral count per target signature so `maxKillDeferrals` actually bounds across
+ *    ticks (a target deferred for an open workspace file eventually proceeds to SIGKILL);
+ *  - deliver the coalesced notices and expose an honest guard-posture `status()`.
+ *
+ * Watch-only rides straight through: in the shipped dryRun state the funnel returns `would-kill`
+ * and no signal is sent, so a tick produces would-kill records + the §4 observability notices and
+ * kills NOTHING.
+ *
+ * Self-action convergence (Capacity Safety — No Unbounded Self-Action): the kill loop's respawn
+ * brake is registered in the convergence ratchet, driving the REAL pure ledger functions.
+ */
+import { type ScanOpts, type ScanOutcome, type ScanResult } from './ExternalHogScanTick.js';
+import type { ProcTableRow } from './ExternalHogProcTable.js';
+import type { ProcTree, OwnedRefs } from './ExternalHogOwnership.js';
+import type { ExternalHogFacts } from './ExternalHogFloor.js';
+import type { Candidate } from './ExternalHogSampler.js';
+import type { KillFunnelDeps } from './ExternalHogKillFunnel.js';
+import type { CoalesceResult } from './ExternalHogNoticeCoalescer.js';
+import type { GuardEffectiveState } from './guardPostureView.js';
+/** The real-I/O seam. Every method is injected so the shell is fully testable with fakes. */
+export interface ExternalHogAdapters {
+    /** Spawn `ps` off the event loop and parse it. Empty/failed read → []. */
+    readProcTable(): Promise<readonly ProcTableRow[]>;
+    /** instar-owned pids → their EXPECTED start-time (server pid, sampler pid, tmux panes). */
+    ownedRefs(): Promise<OwnedRefs>;
+    /** Deterministic facts for a candidate (the floor input); null if it vanished/unreadable. May be
+     *  async (a per-candidate ps -o args= read + launchctl) — the orchestrator awaits it. */
+    factsFor(candidate: Candidate, table: readonly ProcTableRow[]): ExternalHogFacts | null | Promise<ExternalHogFacts | null>;
+    /** command-hash + ledger key + class for a candidate; null if not a killable allowlist class. */
+    identityFor(candidate: Candidate, facts: ExternalHogFacts): {
+        commandHash: string;
+        ledgerKey: string;
+        classId: string;
+    } | null;
+    /** The classifier (LlmQueue). Raw model output, or null when the decider is unavailable. */
+    classify(facts: ExternalHogFacts): Promise<unknown>;
+    /** The hardened kill-funnel I/O (re-read facts/arm, fd-probe, signal, aliveness, wait). */
+    killFunnelDeps: KillFunnelDeps;
+    /** Deliver the coalesced notices (attention queue / telegram). */
+    deliverNotices(result: CoalesceResult): void;
+    /** The live arm status for the guard posture (enabled/dryRun/valid PIN marker). */
+    armStatus(): {
+        enabled: boolean;
+        dryRun: boolean;
+        markerValid: boolean;
+    };
+    /** A monotonic clock reading (ms). Same clock the sampler + kill-funnel use. */
+    nowMs(): number;
+    /** Append one audit row per tick (scrubbed, metadata-only). Never throws into the tick. */
+    auditTick?(row: ExternalHogAuditRow): void;
+}
+export interface ExternalHogRuntimeOpts extends ScanOpts {
+    /** Heartbeat age past which the sampler is DEAD (blind) → guard posture on-stale (§1). */
+    readonly samplerDeadThresholdMs: number;
+    /** Hard cap on the deferral map (memory bound; oldest pruned past this). */
+    readonly deferralMapMax?: number;
+}
+export interface ExternalHogAuditRow {
+    readonly at: number;
+    readonly candidates: number;
+    readonly killed: number;
+    readonly wouldKill: number;
+    readonly alertOnly: number;
+    readonly deferred: number;
+}
+export interface ExternalHogStatus {
+    readonly effectiveState: GuardEffectiveState;
+    readonly enabled: boolean;
+    readonly dryRun: boolean;
+    readonly markerValid: boolean;
+    readonly samplerDead: boolean;
+    readonly lastTickAt: number | null;
+    readonly recentOutcomes: readonly ScanOutcome[];
+    readonly trackedDeferrals: number;
+}
+/** Build a ProcTree (pid → node) from a parsed ps table — the ownership walk's input. */
+export declare function buildProcTree(table: readonly ProcTableRow[]): ProcTree;
+export declare class ExternalHogSentinel {
+    private readonly adapters;
+    private readonly opts;
+    private state;
+    /** ledgerKey → how many times this signature has been deferred (persisted across ticks). */
+    private readonly deferrals;
+    private lastTickAt;
+    private lastOutcomes;
+    constructor(adapters: ExternalHogAdapters, opts: ExternalHogRuntimeOpts);
+    /**
+     * Run one scan tick. Reads the real table + owned pids (async, off-loop), then delegates the
+     * whole decision to the reviewed orchestrator over a snapshot-closing ScanDeps. Watch-only in
+     * the shipped state (no signal). Never throws — a read failure degrades to an empty tick
+     * (the sampler heartbeat simply does not advance → eventually on-stale).
+     */
+    tick(): Promise<ScanResult>;
+    /**
+     * The `/guards` runtime getter (GuardRegistry). `lastTickAt` is the last SUCCESSFUL PARSE (the
+     * sampler heartbeat), NOT the tick time — so a sentinel that is ticking but BLIND (ps failing,
+     * never parsing) reports a stale/zero lastTickAt and `/guards` honestly derives `on-stale`
+     * instead of a falsely-reassuring `on-confirmed`. A never-parsed sentinel → 0 → on-stale.
+     */
+    guardRuntimeStatus(): {
+        enabled: boolean;
+        dryRun: boolean;
+        lastTickAt: number;
+    };
+    /** Honest guard posture (§8): reflects VERIFIED kill-capability, never a config wish. */
+    status(): ExternalHogStatus;
+    /** Bump deferral counts for live deferrals; clear resolved targets; bound the map. */
+    private updateDeferrals;
+    private emitAudit;
+}
+//# sourceMappingURL=ExternalHogSentinel.d.ts.map

package/dist/monitoring/ExternalHogSentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogSentinel.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogSentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAA8C,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIxI,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAY,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,aAAa,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAClD,2FAA2F;IAC3F,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC;6FACyF;IACzF,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3H,iGAAiG;IACjG,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/H,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,2FAA2F;IAC3F,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC7C,mFAAmF;IACnF,SAAS,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IACzE,gFAAgF;IAChF,KAAK,IAAI,MAAM,CAAC;IAChB,2FAA2F;IAC3F,SAAS,CAAC,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAuB,SAAQ,QAAQ;IACtD,0FAA0F;IAC1F,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAID,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,QAAQ,CAOtE;AAWD,qBAAa,mBAAmB;IAQ5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IARvB,OAAO,CAAC,KAAK,CAA4G;IACzH,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAA8B;gBAG/B,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,sBAAsB;IAG/C;;;;;OAKG;IACG,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IA2BjC;;;;;OAKG;IACH,kBAAkB,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAK/E,yFAAyF;IACzF,MAAM,IAAI,iBAAiB;IAwB3B,sFAAsF;IACtF,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,SAAS;CAelB"}

package/dist/monitoring/ExternalHogSentinel.js

@@ -0,0 +1,168 @@
+/**
+ * ExternalHogSentinel — the composition shell that turns the reviewed pure modules into a live,
+ * tickable monitor (CMT-1901, docs/specs/external-hog-zombie-autokill-sentinel.md §1-§8).
+ *
+ * This is the ADAPTER LAYER, not new decision logic: it holds the cross-tick scan state (sampler
+ * baseline + kill ledger + per-signature deferral counts), reads the real I/O through an INJECTED
+ * adapter seam (so the whole shell is unit-testable with fakes — no real `ps`, model call, or
+ * signal), and on each tick delegates the ENTIRE decision to the reviewed `runScanTick`
+ * orchestrator. It adds nothing to the kill decision: the watch-only guarantee, the floor veto,
+ * the classifier authority, the P19 breaker and P17 coalescing all live below it and are unchanged.
+ *
+ * The shell's only responsibilities:
+ *  - carry state across ticks (sampler map, kill ledger, deferral counts) — none of which the
+ *    pure orchestrator can hold;
+ *  - bridge the async real reads (spawn `ps` off-loop, resolve owned pids) into the sync closures
+ *    the orchestrator expects, by reading BEFORE the tick and closing over the snapshot;
+ *  - persist the deferral count per target signature so `maxKillDeferrals` actually bounds across
+ *    ticks (a target deferred for an open workspace file eventually proceeds to SIGKILL);
+ *  - deliver the coalesced notices and expose an honest guard-posture `status()`.
+ *
+ * Watch-only rides straight through: in the shipped dryRun state the funnel returns `would-kill`
+ * and no signal is sent, so a tick produces would-kill records + the §4 observability notices and
+ * kills NOTHING.
+ *
+ * Self-action convergence (Capacity Safety — No Unbounded Self-Action): the kill loop's respawn
+ * brake is registered in the convergence ratchet, driving the REAL pure ledger functions.
+ */
+/* @self-action-controller: external-hog-kill-breaker */
+import { runScanTick } from './ExternalHogScanTick.js';
+import { EMPTY_SAMPLER_STATE, isSamplerDead } from './ExternalHogSampler.js';
+import { EMPTY_KILL_LEDGER } from './ExternalHogKillLedger.js';
+import { EMPTY_SUSTAINED_STATE } from './ExternalHogSustained.js';
+import { externalHogEffectiveState } from './ExternalHogGuardStatus.js';
+const DEFAULT_DEFERRAL_MAP_MAX = 128;
+/** Build a ProcTree (pid → node) from a parsed ps table — the ownership walk's input. */
+export function buildProcTree(table) {
+    const tree = new Map();
+    for (const row of table) {
+        if (!Number.isInteger(row.pid) || row.pid <= 0)
+            continue;
+        tree.set(row.pid, { pid: row.pid, ppid: row.ppid, startTime: row.startTime });
+    }
+    return tree;
+}
+/** Is this outcome a live deferral that should bump the per-signature count? */
+function isDeferred(o) {
+    return typeof o === 'object' && o !== null && o.action === 'deferred';
+}
+/** Is this a TERMINAL outcome that resolves a target (so its deferral count is cleared)? */
+function isTerminal(o) {
+    return typeof o === 'object' && o !== null && (o.action === 'killed' || o.action === 'sigterm-exited' || o.action === 'aborted');
+}
+export class ExternalHogSentinel {
+    adapters;
+    opts;
+    state = { sampler: EMPTY_SAMPLER_STATE, ledger: EMPTY_KILL_LEDGER, sustained: EMPTY_SUSTAINED_STATE };
+    /** ledgerKey → how many times this signature has been deferred (persisted across ticks). */
+    deferrals = new Map();
+    lastTickAt = null;
+    lastOutcomes = [];
+    constructor(adapters, opts) {
+        this.adapters = adapters;
+        this.opts = opts;
+    }
+    /**
+     * Run one scan tick. Reads the real table + owned pids (async, off-loop), then delegates the
+     * whole decision to the reviewed orchestrator over a snapshot-closing ScanDeps. Watch-only in
+     * the shipped state (no signal). Never throws — a read failure degrades to an empty tick
+     * (the sampler heartbeat simply does not advance → eventually on-stale).
+     */
+    async tick() {
+        const table = await this.adapters.readProcTable();
+        const owned = await this.adapters.ownedRefs();
+        const tree = buildProcTree(table);
+        const deps = {
+            readProcTable: () => table,
+            buildOwnership: () => ({ tree, owned }),
+            factsFor: (c) => this.adapters.factsFor(c, table),
+            identityFor: (c, f) => this.adapters.identityFor(c, f),
+            classify: (f) => this.adapters.classify(f),
+            killFunnelDeps: this.adapters.killFunnelDeps,
+            nowMs: () => this.adapters.nowMs(),
+            deferralsFor: (key) => this.deferrals.get(key) ?? 0,
+        };
+        const result = await runScanTick(this.state, deps, this.opts);
+        this.state = result.nextState;
+        this.updateDeferrals(result.outcomes);
+        this.lastOutcomes = result.outcomes.slice(-16);
+        this.lastTickAt = this.adapters.nowMs();
+        this.adapters.deliverNotices(result.notices);
+        this.emitAudit(result.outcomes);
+        return result;
+    }
+    /**
+     * The `/guards` runtime getter (GuardRegistry). `lastTickAt` is the last SUCCESSFUL PARSE (the
+     * sampler heartbeat), NOT the tick time — so a sentinel that is ticking but BLIND (ps failing,
+     * never parsing) reports a stale/zero lastTickAt and `/guards` honestly derives `on-stale`
+     * instead of a falsely-reassuring `on-confirmed`. A never-parsed sentinel → 0 → on-stale.
+     */
+    guardRuntimeStatus() {
+        const arm = this.adapters.armStatus();
+        return { enabled: arm.enabled, dryRun: arm.dryRun, lastTickAt: this.state.sampler.lastSnapshotAt ?? 0 };
+    }
+    /** Honest guard posture (§8): reflects VERIFIED kill-capability, never a config wish. */
+    status() {
+        const arm = this.adapters.armStatus();
+        // BLIND ⇒ on-stale, never on-confirmed. Two ways to be blind: (1) NO successful parse has
+        // EVER happened (a boot where `ps` fails from the start — Phase-5 reviewer note D: without
+        // this, an armed-but-never-parsed sentinel would falsely read on-confirmed), or (2) the
+        // heartbeat has gone stale after previously parsing. on-confirmed REQUIRES a fresh successful
+        // parse — a feature that has never read the process table is not verified kill-capable.
+        const everParsed = this.state.sampler.lastSnapshotAt !== null;
+        const samplerDead = !everParsed
+            || isSamplerDead(this.state.sampler, this.adapters.nowMs(), this.opts.samplerDeadThresholdMs);
+        return {
+            effectiveState: externalHogEffectiveState({
+                enabled: arm.enabled, dryRun: arm.dryRun, markerValid: arm.markerValid, samplerDead,
+            }),
+            enabled: arm.enabled,
+            dryRun: arm.dryRun,
+            markerValid: arm.markerValid,
+            samplerDead,
+            lastTickAt: this.lastTickAt,
+            recentOutcomes: this.lastOutcomes,
+            trackedDeferrals: this.deferrals.size,
+        };
+    }
+    /** Bump deferral counts for live deferrals; clear resolved targets; bound the map. */
+    updateDeferrals(outcomes) {
+        for (const o of outcomes) {
+            if (isDeferred(o.outcome)) {
+                this.deferrals.set(o.ledgerKey, (this.deferrals.get(o.ledgerKey) ?? 0) + 1);
+            }
+            else if (isTerminal(o.outcome)) {
+                this.deferrals.delete(o.ledgerKey); // resolved or gone → forget it
+            }
+        }
+        const max = this.opts.deferralMapMax ?? DEFAULT_DEFERRAL_MAP_MAX;
+        while (this.deferrals.size > max) {
+            const oldest = this.deferrals.keys().next().value; // Map preserves insertion order
+            if (oldest === undefined)
+                break;
+            this.deferrals.delete(oldest);
+        }
+    }
+    emitAudit(outcomes) {
+        if (!this.adapters.auditTick)
+            return;
+        let killed = 0, wouldKill = 0, alertOnly = 0, deferred = 0;
+        for (const o of outcomes) {
+            if (o.outcome === 'alert-only')
+                alertOnly++;
+            else if (o.outcome.action === 'killed')
+                killed++;
+            else if (o.outcome.action === 'would-kill')
+                wouldKill++;
+            else if (o.outcome.action === 'deferred')
+                deferred++;
+        }
+        try {
+            this.adapters.auditTick({ at: this.lastTickAt ?? this.adapters.nowMs(), candidates: outcomes.length, killed, wouldKill, alertOnly, deferred });
+        }
+        catch {
+            /* audit is best-effort — never break a tick on an audit-write failure */
+        }
+    }
+}
+//# sourceMappingURL=ExternalHogSentinel.js.map

package/dist/monitoring/ExternalHogSentinel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogSentinel.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogSentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wDAAwD;AAExD,OAAO,EAAE,WAAW,EAAmF,MAAM,0BAA0B,CAAC;AACxI,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAOlE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAuDxE,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,KAA8B;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;YAAE,SAAS;QACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,CAAyB;IAC3C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;AACxE,CAAC;AACD,4FAA4F;AAC5F,SAAS,UAAU,CAAC,CAAyB;IAC3C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;AACnI,CAAC;AAED,MAAM,OAAO,mBAAmB;IAQX;IACA;IARX,KAAK,GAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACzH,4FAA4F;IAC3E,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,UAAU,GAAkB,IAAI,CAAC;IACjC,YAAY,GAA2B,EAAE,CAAC;IAElD,YACmB,QAA6B,EAC7B,IAA4B;QAD5B,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,SAAI,GAAJ,IAAI,CAAwB;IAC5C,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,IAAI,GAAa;YACrB,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK;YAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACvC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC;YACjD,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;YACtD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;YAC5C,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;YAClC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;SACpD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAExC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,kBAAkB;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;IAC1G,CAAC;IAED,yFAAyF;IACzF,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtC,0FAA0F;QAC1F,2FAA2F;QAC3F,wFAAwF;QACxF,8FAA8F;QAC9F,wFAAwF;QACxF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC;QAC9D,MAAM,WAAW,GAAG,CAAC,UAAU;eAC1B,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAChG,OAAO;YACL,cAAc,EAAE,yBAAyB,CAAC;gBACxC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW;aACpF,CAAC;YACF,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,WAAW;YACX,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,YAAY;YACjC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;SACtC,CAAC;IACJ,CAAC;IAED,sFAAsF;IAC9E,eAAe,CAAC,QAAgC;QACtD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,CAAC;iBAAM,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;YACrE,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACjE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,gCAAgC;YACnF,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,QAAgC;QAChD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,OAAO;QACrC,IAAI,MAAM,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,OAAO,KAAK,YAAY;gBAAE,SAAS,EAAE,CAAC;iBACvC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,EAAE,CAAC;iBAC5C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,YAAY;gBAAE,SAAS,EAAE,CAAC;iBACnD,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjJ,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;CACF"}

package/dist/monitoring/ExternalHogServerPrimitives.d.ts

@@ -0,0 +1,50 @@
+/**
+ * ExternalHogServerPrimitives — builds the real-OS ExternalHogPrimitives the server injects into
+ * createExternalHogAdapters (CMT-1901). Kept OUT of the giant server command so the one non-trivial
+ * composed primitive — the §4.5 kill-time CPU micro-probe — is unit-testable in isolation.
+ *
+ * Everything here is thin over injected low-level deps (an async `exec`, `process.kill`, a monotonic
+ * clock, a `sleep`, the intelligence `evaluate`, the `raiseAttention` sink, the resolved config
+ * getter, the arm-file loader). The server passes the real implementations; a test passes fakes.
+ */
+import type { ExternalHogPrimitives } from './ExternalHogRealAdapters.js';
+/** The low-level deps the server wires in. */
+export interface ServerPrimitiveDeps {
+    /** Run a command off the event loop → stdout (execFile-based; rejects on non-zero exit). */
+    exec(cmd: string, args: readonly string[]): Promise<string>;
+    /** Send a signal (0 = aliveness probe). */
+    signal(pid: number, sig: 'SIGTERM' | 'SIGKILL' | 0): boolean;
+    /** The classifier model call (intelligence.evaluate, routed off-Claude by default). */
+    evaluate(prompt: string): Promise<string>;
+    /** Raise ONE attention item (already mapped to the platform's createAttentionItem in the server). */
+    raiseAttention(item: {
+        title: string;
+        body: string;
+        priority?: 'low' | 'medium' | 'high';
+        source?: string;
+    }): Promise<unknown> | unknown;
+    /** The LIVE, dev-gate-RESOLVED kill-capability config (enabled resolved, dryRun from config). */
+    config(): {
+        enabled: boolean;
+        dryRun: boolean;
+    };
+    readonly stateDir: string;
+    readonly ownEuid: number;
+    readonly serverPid: number;
+    /** Await ms (injected so tests don't really sleep). */
+    sleep(ms: number): Promise<void>;
+    auditRow?(row: unknown): void;
+}
+/**
+ * Build the §4.5 kill-time CPU re-confirm probe: sample a pid's cumulative cputime TWICE over
+ * `windowMs` (monotonic Δwall) and resolve core-equivalents RIGHT NOW. Returns null (→ the caller
+ * aborts the kill, fail-safe) if the pid vanished, is unreadable, was pid-REUSED mid-window
+ * (startTime changed), or the delta is UNKNOWN (non-positive/implausible window per the reviewed
+ * CPU-delta guards). Pure over the injected exec/now/sleep — testable with fakes.
+ */
+export declare function makeCpuCoresOver(exec: (cmd: string, args: readonly string[]) => Promise<string>, nowMs: () => number, sleep: (ms: number) => Promise<void>): (pid: number, windowMs: number) => Promise<number | null>;
+/** Parse `tmux list-panes -a -F '#{pane_pid}'` output into pids. Pure. */
+export declare function parseTmuxPanePids(out: string): number[];
+/** Assemble the full ExternalHogPrimitives from the low-level server deps. */
+export declare function createExternalHogServerPrimitives(deps: ServerPrimitiveDeps): ExternalHogPrimitives;
+//# sourceMappingURL=ExternalHogServerPrimitives.d.ts.map

package/dist/monitoring/ExternalHogServerPrimitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogServerPrimitives.d.ts","sourceRoot":"","sources":["../../src/monitoring/ExternalHogServerPrimitives.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,2CAA2C;IAC3C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC;IAC7D,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,qGAAqG;IACrG,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACzI,iGAAiG;IACjG,MAAM,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uDAAuD;IACvD,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,QAAQ,CAAC,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B;AAID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,EAC/D,KAAK,EAAE,MAAM,MAAM,EACnB,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACnC,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyB3D;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAOvD;AAED,8EAA8E;AAC9E,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,mBAAmB,GAAG,qBAAqB,CA4BlG"}

package/dist/monitoring/ExternalHogServerPrimitives.js

@@ -0,0 +1,93 @@
+/**
+ * ExternalHogServerPrimitives — builds the real-OS ExternalHogPrimitives the server injects into
+ * createExternalHogAdapters (CMT-1901). Kept OUT of the giant server command so the one non-trivial
+ * composed primitive — the §4.5 kill-time CPU micro-probe — is unit-testable in isolation.
+ *
+ * Everything here is thin over injected low-level deps (an async `exec`, `process.kill`, a monotonic
+ * clock, a `sleep`, the intelligence `evaluate`, the `raiseAttention` sink, the resolved config
+ * getter, the arm-file loader). The server passes the real implementations; a test passes fakes.
+ */
+import { monotonicNowMs, computeCoreEquivalents, isUnknown } from './ExternalHogCpuDelta.js';
+import { parseProcTable } from './ExternalHogProcTable.js';
+import { loadArmState } from './ExternalHogArmStore.js';
+const CPU_PROBE_PS_ARGS = ['-o', 'pid=,ppid=,uid=,lstart=,time=,comm='];
+/**
+ * Build the §4.5 kill-time CPU re-confirm probe: sample a pid's cumulative cputime TWICE over
+ * `windowMs` (monotonic Δwall) and resolve core-equivalents RIGHT NOW. Returns null (→ the caller
+ * aborts the kill, fail-safe) if the pid vanished, is unreadable, was pid-REUSED mid-window
+ * (startTime changed), or the delta is UNKNOWN (non-positive/implausible window per the reviewed
+ * CPU-delta guards). Pure over the injected exec/now/sleep — testable with fakes.
+ */
+export function makeCpuCoresOver(exec, nowMs, sleep) {
+    return async (pid, windowMs) => {
+        const readOne = async () => {
+            try {
+                const at = nowMs();
+                const row = parseProcTable(await exec('ps', [...CPU_PROBE_PS_ARGS, '-p', String(pid)]))[0];
+                if (!row || row.cputimeSeconds === undefined || !Number.isFinite(row.cputimeSeconds))
+                    return null;
+                return { cpu: row.cputimeSeconds, start: row.startTime, at };
+            }
+            catch {
+                // @silent-fallback-ok: fail-SAFE direction — a probe that can't read the process
+                // yields null = an uncertain reading, which the measurement REFUSES to trust (no kill).
+                return null;
+            }
+        };
+        const a = await readOne();
+        if (!a)
+            return null;
+        await sleep(Math.max(0, windowMs));
+        const b = await readOne();
+        if (!b)
+            return null;
+        if (b.start !== a.start)
+            return null; // pid reused mid-window → identity changed → abort
+        const prev = { cumulativeCpuSeconds: a.cpu, monotonicWallMs: a.at };
+        const curr = { cumulativeCpuSeconds: b.cpu, monotonicWallMs: b.at };
+        const cores = computeCoreEquivalents(prev, curr, { intendedWindowMs: windowMs });
+        return isUnknown(cores) ? null : cores;
+    };
+}
+/** Parse `tmux list-panes -a -F '#{pane_pid}'` output into pids. Pure. */
+export function parseTmuxPanePids(out) {
+    const pids = [];
+    for (const line of out.split('\n')) {
+        const n = Number(line.trim());
+        if (Number.isInteger(n) && n > 0)
+            pids.push(n);
+    }
+    return pids;
+}
+/** Assemble the full ExternalHogPrimitives from the low-level server deps. */
+export function createExternalHogServerPrimitives(deps) {
+    const now = monotonicNowMs;
+    return {
+        exec: deps.exec,
+        signal: deps.signal,
+        cpuCoresOver: makeCpuCoresOver(deps.exec, now, deps.sleep),
+        callModel: deps.evaluate,
+        raiseAttention: deps.raiseAttention,
+        now,
+        ownEuid: () => deps.ownEuid,
+        serverPid: () => deps.serverPid,
+        listTmuxPanePids: async () => {
+            try {
+                return parseTmuxPanePids(await deps.exec('tmux', ['list-panes', '-a', '-F', '#{pane_pid}']));
+            }
+            catch {
+                // @silent-fallback-ok: no tmux server / tmux unavailable → empty pane set. The server
+                // pid remains an owned root, and any process a lost pane hosted still has a LIVING
+                // parent (the tmux server), so the orphan floor invariant blocks a kill regardless.
+                return [];
+            }
+        },
+        loadArm: () => {
+            const s = loadArmState(deps.stateDir);
+            return { marker: s.marker, lastDisarmEpoch: s.lastDisarmEpoch };
+        },
+        config: deps.config,
+        ...(deps.auditRow ? { auditRow: deps.auditRow } : {}),
+    };
+}
+//# sourceMappingURL=ExternalHogServerPrimitives.js.map

package/dist/monitoring/ExternalHogServerPrimitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalHogServerPrimitives.js","sourceRoot":"","sources":["../../src/monitoring/ExternalHogServerPrimitives.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAkB,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAwBxD,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,qCAAqC,CAAU,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA+D,EAC/D,KAAmB,EACnB,KAAoC;IAEpC,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,KAAK,IAAgE,EAAE;YACrF,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3F,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAClG,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,iFAAiF;gBACjF,wFAAwF;gBACxF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;QACzF,MAAM,IAAI,GAAc,EAAE,oBAAoB,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAc,EAAE,oBAAoB,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iCAAiC,CAAC,IAAyB;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC;IAC3B,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;QAC1D,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,GAAG;QACH,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;QAC/B,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC3B,IAAI,CAAC;gBACH,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YAC/F,CAAC;YAAC,MAAM,CAAC;gBACP,sFAAsF;gBACtF,mFAAmF;gBACnF,oFAAoF;gBACpF,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAA0D,EAAE;YACnE,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC"}