intentdna 1.7.5 → 1.8.1

package/dist/runtime/sync-target-plan.d.ts

@@ -0,0 +1,45 @@
+import type { SyncOutputArtifactId } from "./output-artifact-registry.js";
+export type SyncTarget = "claude_code" | "codex_cli";
+export type SyncTargetMode = "write" | "remove" | "dry_run";
+export type CapabilitySupportStatus = "supported" | "partial" | "unknown" | "unsupported";
+export type EvidenceClassification = "enterprise_evidence" | "diagnostic_only" | "unsupported";
+export interface PlannedArtifact {
+    kind: string;
+    path: string;
+    ownership: "intentdna_owned" | "owned_block" | "merge_preserve_user" | "diagnostic";
+    trackedByLock: boolean;
+    outputArtifact?: SyncOutputArtifactId;
+}
+export interface CapabilityReportEntry {
+    status: CapabilitySupportStatus;
+    surfaces: string[];
+    evidenceRefs: string[];
+    notes: string[];
+}
+export interface AdapterCapabilityReport {
+    adapter: SyncTarget;
+    runtime?: string;
+    capabilities: Record<string, CapabilityReportEntry>;
+    unsupported: string[];
+}
+export interface EvidencePlan {
+    primary: "RuntimeDecisionEvent" | "none";
+    diagnosticArtifacts: string[];
+    classification: EvidenceClassification;
+    notes: string[];
+}
+export interface SyncTargetPlan {
+    target: SyncTarget;
+    mode?: SyncTargetMode;
+    plannedArtifacts: PlannedArtifact[];
+    capabilityReport?: AdapterCapabilityReport;
+    evidencePlan: EvidencePlan;
+    warnings: string[];
+    unsupported: string[];
+}
+export interface SyncTargetTrackedOutput {
+    artifact: SyncOutputArtifactId;
+    path: string;
+}
+export declare function trackedOutputsForSyncTargetPlan(plan: SyncTargetPlan): SyncTargetTrackedOutput[];
+export declare function formatSyncTargetPlanDiagnostics(plan: SyncTargetPlan): string;

package/dist/runtime/sync-target-plan.js

@@ -0,0 +1,19 @@
+export function trackedOutputsForSyncTargetPlan(plan) {
+    return plan.plannedArtifacts
+        .filter((artifact) => typeof artifact.outputArtifact === "string" && artifact.outputArtifact.length > 0)
+        .map((artifact) => ({ artifact: artifact.outputArtifact, path: artifact.path }));
+}
+export function formatSyncTargetPlanDiagnostics(plan) {
+    const lines = [];
+    if (plan.warnings.length > 0) {
+        lines.push(`${plan.target} warnings:`);
+        for (const warning of plan.warnings)
+            lines.push(`  - ${warning}`);
+    }
+    if (plan.unsupported.length > 0) {
+        lines.push(`${plan.target} unsupported gaps:`);
+        for (const gap of plan.unsupported)
+            lines.push(`  - ${gap}`);
+    }
+    return lines.length > 0 ? `${lines.join("\n")}\n` : "";
+}

package/dist/runtime/verifier.d.ts

@@ -0,0 +1,51 @@
+import type { CompletionCheck, ConstraintIR, StepCheckpoint, VerifierCommandPolicy } from "../schema/types.js";
+export declare const DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS = 30000;
+export declare const MAX_VERIFIER_EVIDENCE_BYTES = 4096;
+export interface VerifierRuntimeContext {
+    projectDir: string;
+    variables?: Record<string, string>;
+    commandTimeoutMs?: number;
+}
+export interface VerifierCheckResult {
+    passed: boolean;
+    target?: string;
+    evidence?: string;
+    exit_code?: number;
+    artifact?: string;
+    message?: string;
+    timedOut?: boolean;
+}
+export declare function resolveVerifierTemplate(template: string, variables?: Record<string, string>): string;
+export declare function verifierTemplateVariableNames(template: string): string[];
+export declare function validateVerifierTemplateVariables(template: string, variables?: Record<string, string>, mode?: "command" | "path"): {
+    valid: true;
+} | {
+    valid: false;
+    variable: string;
+    evidence: string;
+    message: string;
+};
+export declare function hasUnresolvedVerifierTemplate(value: string): boolean;
+export declare function unresolvedVerifierTemplateMessage(value: string): string;
+export declare function hasUnsafeShellControl(command: string): boolean;
+export declare function isVerifierCommandAllowed(policy: VerifierCommandPolicy | undefined, command: string): boolean;
+export declare function verifierCommandPolicyMessage(command: string): string;
+export declare function isBuiltinAssertAllowed(policy: VerifierCommandPolicy | undefined, assertName: string): boolean;
+export declare function verifierAssertPolicyMessage(assertName: string): string;
+export declare function trimVerifierEvidence(raw: string | undefined): string | undefined;
+export declare function summarizeCommandEvidence(stdout: string, stderr: string): string | undefined;
+export declare function execVerifierCommand(projectDir: string, command: string, timeoutMs?: number, env?: NodeJS.ProcessEnv): Promise<{
+    passed: boolean;
+    timedOut: boolean;
+    exitCode?: number;
+    evidence?: string;
+}>;
+export declare function resolveVerifierTarget(projectDir: string, targetPath: string): Promise<string | null>;
+export declare function toProjectRelativePath(projectDir: string, filePath: string): Promise<string>;
+export declare function getCompletionCheckFields(completion: CompletionCheck): string[];
+export declare function validateCompletionVerifier(completion: CompletionCheck): {
+    message: string;
+    evidence: string;
+} | null;
+export declare function runCompletionVerifier(completion: CompletionCheck, ir: Pick<ConstraintIR, "verifier_policy">, context: VerifierRuntimeContext): Promise<VerifierCheckResult>;
+export declare function runCheckpointVerifier(checkpoint: StepCheckpoint, ir: Pick<ConstraintIR, "verifier_policy">, context: VerifierRuntimeContext): Promise<VerifierCheckResult>;

package/dist/runtime/verifier.js

@@ -0,0 +1,462 @@
+import { spawn } from "node:child_process";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+export const DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS = 30_000;
+export const MAX_VERIFIER_EVIDENCE_BYTES = 4096;
+const SAFE_COMMAND_VARIABLE_RE = /^[A-Za-z0-9_-]+$/;
+const SAFE_PATH_VARIABLE_RE = /^[-A-Za-z0-9_./]+$/;
+export function resolveVerifierTemplate(template, variables) {
+    let resolved = template;
+    if (variables?.ARGUMENTS !== undefined) {
+        resolved = resolved.replace(/(^|[^\\])\$ARGUMENTS/g, (_match, prefix) => `${prefix}${variables.ARGUMENTS}`);
+    }
+    resolved = resolved.replace(/\{\{(\w+)\}\}/g, (match, key) => variables?.[key] ?? match);
+    return resolved;
+}
+export function verifierTemplateVariableNames(template) {
+    const names = new Set();
+    if (/(^|[^\\])\$ARGUMENTS/.test(template))
+        names.add("ARGUMENTS");
+    for (const match of template.matchAll(/\{\{(\w+)\}\}/g))
+        names.add(match[1]);
+    return [...names];
+}
+function isWholeVerifierCommandTemplate(command) {
+    return /^\{\{\w+\}\}$/.test(command.trim()) || command.trim() === "$ARGUMENTS";
+}
+export function validateVerifierTemplateVariables(template, variables, mode = "command") {
+    for (const name of verifierTemplateVariableNames(template)) {
+        const value = variables?.[name];
+        if (value === undefined)
+            continue;
+        const matchesSafeCharacters = mode === "path"
+            ? SAFE_PATH_VARIABLE_RE.test(value) && !value.startsWith("/") && !value.includes("//") && !value.split(/[\\/]+/).includes("..")
+            : SAFE_COMMAND_VARIABLE_RE.test(value);
+        if (!matchesSafeCharacters) {
+            return {
+                valid: false,
+                variable: name,
+                evidence: `unsafe_variable:${name}`,
+                message: `Verifier template variable '${name}' contains unsafe ${mode} characters`,
+            };
+        }
+    }
+    return { valid: true };
+}
+function resolveVerifierCommand(rawCommand, policy, variables) {
+    const declaredCommand = rawCommand.trim();
+    if (isWholeVerifierCommandTemplate(declaredCommand)) {
+        const command = resolveVerifierTemplate(declaredCommand, variables).trim();
+        if (hasUnresolvedVerifierTemplate(command)) {
+            return { target: command, evidence: "unresolved_template", exit_code: 126, message: unresolvedVerifierTemplateMessage(command) };
+        }
+        if (!isVerifierCommandAllowed(policy, command)) {
+            return { target: command, evidence: "policy_denied", exit_code: 126, message: verifierCommandPolicyMessage(command) };
+        }
+        return { command };
+    }
+    if (!isVerifierCommandAllowed(policy, declaredCommand)) {
+        return { target: declaredCommand, evidence: "policy_denied", exit_code: 126, message: verifierCommandPolicyMessage(declaredCommand) };
+    }
+    const safeVariables = validateVerifierTemplateVariables(declaredCommand, variables, "command");
+    if (!safeVariables.valid) {
+        return { target: declaredCommand, evidence: safeVariables.evidence, exit_code: 126, message: safeVariables.message };
+    }
+    const command = resolveVerifierTemplate(declaredCommand, variables).trim();
+    if (hasUnresolvedVerifierTemplate(command)) {
+        return { target: command, evidence: "unresolved_template", exit_code: 126, message: unresolvedVerifierTemplateMessage(command) };
+    }
+    return { command };
+}
+function verifierCommandEnv(variables) {
+    const env = {};
+    for (const [name, value] of Object.entries(variables ?? {})) {
+        if (/^\w+$/.test(name) && SAFE_COMMAND_VARIABLE_RE.test(value)) {
+            env[name] = value;
+        }
+    }
+    return env;
+}
+export function hasUnresolvedVerifierTemplate(value) {
+    return /\{\{\w+\}\}/.test(value) || /(^|[^\\])\$ARGUMENTS/.test(value);
+}
+export function unresolvedVerifierTemplateMessage(value) {
+    return `Verifier template could not be fully resolved: ${value}`;
+}
+export function hasUnsafeShellControl(command) {
+    let inSingle = false;
+    let inDouble = false;
+    let escaped = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        const next = command[i + 1] ?? "";
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\" && !inSingle) {
+            escaped = true;
+            continue;
+        }
+        if (ch === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (ch === '"' && !inSingle) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (!inSingle && !inDouble) {
+            if (ch === ";" || ch === "`" || ch === "\n" || ch === "\r")
+                return true;
+            if ((ch === "&" || ch === "|" || ch === "<" || ch === ">") && next === ch)
+                return true;
+            if (ch === "$" && next === "(")
+                return true;
+            if ((ch === "<" || ch === ">") && next === "(")
+                return true;
+            if (ch === "|" || ch === "&" || ch === "<" || ch === ">")
+                return true;
+        }
+        if (inDouble) {
+            if (ch === "`")
+                return true;
+            if (ch === "$" && next === "(")
+                return true;
+        }
+    }
+    return false;
+}
+export function isVerifierCommandAllowed(policy, command) {
+    const normalized = command.trim();
+    if (!policy)
+        return false;
+    if (policy.allow_commands?.includes(normalized))
+        return true;
+    if (hasUnsafeShellControl(normalized))
+        return false;
+    return policy.allow_command_prefixes?.some((prefix) => normalized.startsWith(prefix)) ?? false;
+}
+export function verifierCommandPolicyMessage(command) {
+    return `Verifier command not allowed by verifier_policy: ${command}`;
+}
+export function isBuiltinAssertAllowed(policy, assertName) {
+    return policy?.allow_builtin_asserts?.includes(assertName) ?? false;
+}
+export function verifierAssertPolicyMessage(assertName) {
+    return `Verifier assert not allowed by verifier_policy: ${assertName}`;
+}
+export function trimVerifierEvidence(raw) {
+    if (!raw)
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return undefined;
+    return trimmed.length > MAX_VERIFIER_EVIDENCE_BYTES
+        ? trimmed.slice(0, MAX_VERIFIER_EVIDENCE_BYTES)
+        : trimmed;
+}
+export function summarizeCommandEvidence(stdout, stderr) {
+    const stdoutBytes = Buffer.byteLength(stdout, "utf8");
+    const stderrBytes = Buffer.byteLength(stderr, "utf8");
+    if (stdoutBytes === 0 && stderrBytes === 0)
+        return undefined;
+    return trimVerifierEvidence(`stdout_bytes=${stdoutBytes} stderr_bytes=${stderrBytes}`);
+}
+export async function execVerifierCommand(projectDir, command, timeoutMs = DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS, env) {
+    return new Promise((resolvePromise) => {
+        const child = spawn("bash", ["-lc", command], {
+            cwd: projectDir,
+            stdio: ["ignore", "pipe", "pipe"],
+            env: { ...process.env, ...(env ?? {}) },
+        });
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutId);
+            resolvePromise(result);
+        };
+        const timeoutId = setTimeout(() => {
+            child.kill("SIGTERM");
+            setTimeout(() => child.kill("SIGKILL"), 1000).unref();
+            settle({ passed: false, timedOut: true, exitCode: 124, evidence: summarizeCommandEvidence(stdout, stderr) });
+        }, timeoutMs);
+        child.stdout.on("data", (chunk) => {
+            stdout += String(chunk);
+            if (stdout.length > MAX_VERIFIER_EVIDENCE_BYTES)
+                stdout = stdout.slice(0, MAX_VERIFIER_EVIDENCE_BYTES);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += String(chunk);
+            if (stderr.length > MAX_VERIFIER_EVIDENCE_BYTES)
+                stderr = stderr.slice(0, MAX_VERIFIER_EVIDENCE_BYTES);
+        });
+        child.on("error", () => settle({
+            passed: false,
+            timedOut: false,
+            exitCode: 1,
+            evidence: summarizeCommandEvidence(stdout, stderr),
+        }));
+        child.on("close", (code) => settle({
+            passed: code === 0,
+            timedOut: false,
+            exitCode: code ?? 1,
+            evidence: summarizeCommandEvidence(stdout, stderr),
+        }));
+    });
+}
+async function execVerifierStdout(projectDir, command, args) {
+    return new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(command, args, { cwd: projectDir, stdio: ["ignore", "pipe", "ignore"] });
+        let stdout = "";
+        child.stdout.on("data", (chunk) => { stdout += String(chunk); });
+        child.on("error", rejectPromise);
+        child.on("close", (code) => resolvePromise({ stdout, exitCode: code ?? 1 }));
+    });
+}
+function isWithinProjectRoot(projectRoot, targetPath) {
+    const relPath = relative(projectRoot, targetPath);
+    return relPath === "" || (!relPath.startsWith("..") && !isAbsolute(relPath));
+}
+export async function resolveVerifierTarget(projectDir, targetPath) {
+    const projectRoot = await realpath(projectDir).catch(() => resolve(projectDir));
+    const resolvedPath = resolve(projectRoot, targetPath);
+    if (!isWithinProjectRoot(projectRoot, resolvedPath))
+        return null;
+    const canonicalParent = await realpath(dirname(resolvedPath)).catch(() => null);
+    if (canonicalParent && !isWithinProjectRoot(projectRoot, canonicalParent))
+        return null;
+    const canonicalTarget = await realpath(resolvedPath).catch(() => null);
+    if (canonicalTarget && !isWithinProjectRoot(projectRoot, canonicalTarget))
+        return null;
+    return canonicalTarget ?? resolvedPath;
+}
+export async function toProjectRelativePath(projectDir, filePath) {
+    const projectRoot = await realpath(projectDir).catch(() => resolve(projectDir));
+    const resolvedPath = resolve(projectRoot, filePath);
+    const canonicalPath = await realpath(resolvedPath).catch(() => resolvedPath);
+    const targetPath = isWithinProjectRoot(projectRoot, canonicalPath) ? canonicalPath : resolvedPath;
+    const relPath = relative(projectRoot, targetPath);
+    return relPath === "" ? "." : relPath;
+}
+export function getCompletionCheckFields(completion) {
+    if (typeof completion !== "object" || completion === null || Array.isArray(completion))
+        return [];
+    const fields = [];
+    if (completion.file_exists !== undefined)
+        fields.push("file_exists");
+    if (completion.file_not_empty !== undefined)
+        fields.push("file_not_empty");
+    if (completion.file_contains !== undefined)
+        fields.push("file_contains");
+    if (completion.command_success !== undefined)
+        fields.push("command_success");
+    return fields;
+}
+export function validateCompletionVerifier(completion) {
+    const fields = getCompletionCheckFields(completion);
+    if (fields.length !== 1) {
+        return {
+            message: "Completion verifier must define exactly one check",
+            evidence: `fields:${fields.join(",") || "none"}`,
+        };
+    }
+    const field = fields[0];
+    if (field === "file_exists" && (typeof completion.file_exists !== "string" || !completion.file_exists)) {
+        return { message: "Completion verifier file_exists must be a non-empty string", evidence: "invalid:file_exists" };
+    }
+    if (field === "file_not_empty" && (typeof completion.file_not_empty !== "string" || !completion.file_not_empty)) {
+        return { message: "Completion verifier file_not_empty must be a non-empty string", evidence: "invalid:file_not_empty" };
+    }
+    if (field === "command_success" && (typeof completion.command_success !== "string" || !completion.command_success)) {
+        return { message: "Completion verifier command_success must be a non-empty string", evidence: "invalid:command_success" };
+    }
+    if (field === "file_contains") {
+        const fileContains = completion.file_contains;
+        if (typeof fileContains !== "object" || fileContains === null) {
+            return { message: "Completion verifier file_contains must define path and pattern", evidence: "invalid:file_contains" };
+        }
+        if (typeof fileContains.path !== "string" || !fileContains.path) {
+            return { message: "Completion verifier file_contains.path must be a non-empty string", evidence: "invalid:file_contains.path" };
+        }
+        if (typeof fileContains.pattern !== "string" || !fileContains.pattern) {
+            return { message: "Completion verifier file_contains.pattern must be a non-empty string", evidence: "invalid:file_contains.pattern" };
+        }
+    }
+    return null;
+}
+export async function runCompletionVerifier(completion, ir, context) {
+    const invalidCompletion = validateCompletionVerifier(completion);
+    if (invalidCompletion) {
+        return { passed: false, evidence: invalidCompletion.evidence, message: invalidCompletion.message };
+    }
+    if (completion.file_exists) {
+        const safeVariables = validateVerifierTemplateVariables(completion.file_exists, context.variables, "path");
+        if (!safeVariables.valid)
+            return { passed: false, target: completion.file_exists, evidence: safeVariables.evidence, message: safeVariables.message };
+        const target = resolveVerifierTemplate(completion.file_exists, context.variables);
+        if (hasUnresolvedVerifierTemplate(target))
+            return { passed: false, target, evidence: "unresolved_template", message: unresolvedVerifierTemplateMessage(target) };
+        const resolvedTarget = await resolveVerifierTarget(context.projectDir, target);
+        const artifact = resolvedTarget ?? undefined;
+        const evidence = resolvedTarget ? `exists:${resolvedTarget}` : "path_escape";
+        if (!resolvedTarget)
+            return { passed: false, target, evidence, artifact, message: `Verifier target escapes project root: ${target}` };
+        try {
+            await stat(resolvedTarget);
+            return { passed: true, target, evidence, artifact };
+        }
+        catch {
+            return { passed: false, target, evidence, artifact, message: `Required file missing: ${target}` };
+        }
+    }
+    if (completion.file_not_empty) {
+        const safeVariables = validateVerifierTemplateVariables(completion.file_not_empty, context.variables, "path");
+        if (!safeVariables.valid)
+            return { passed: false, target: completion.file_not_empty, evidence: safeVariables.evidence, message: safeVariables.message };
+        const target = resolveVerifierTemplate(completion.file_not_empty, context.variables);
+        if (hasUnresolvedVerifierTemplate(target))
+            return { passed: false, target, evidence: "unresolved_template", message: unresolvedVerifierTemplateMessage(target) };
+        const resolvedTarget = await resolveVerifierTarget(context.projectDir, target);
+        const artifact = resolvedTarget ?? undefined;
+        if (!resolvedTarget)
+            return { passed: false, target, evidence: "path_escape", artifact, message: `Verifier target escapes project root: ${target}` };
+        try {
+            const raw = await readFile(resolvedTarget, "utf-8");
+            const evidence = `bytes=${Buffer.byteLength(raw, "utf8")}`;
+            return raw.trim().length === 0
+                ? { passed: false, target, evidence, artifact, message: `Required file is empty: ${target}` }
+                : { passed: true, target, evidence, artifact };
+        }
+        catch {
+            return { passed: false, target, evidence: `not_empty:${resolvedTarget}`, artifact, message: `Required file missing: ${target}` };
+        }
+    }
+    if (completion.file_contains) {
+        const safeTargetVariables = validateVerifierTemplateVariables(completion.file_contains.path, context.variables, "path");
+        if (!safeTargetVariables.valid)
+            return { passed: false, target: completion.file_contains.path, evidence: safeTargetVariables.evidence, message: safeTargetVariables.message };
+        const safePatternVariables = validateVerifierTemplateVariables(completion.file_contains.pattern, context.variables);
+        if (!safePatternVariables.valid)
+            return { passed: false, target: completion.file_contains.pattern, evidence: safePatternVariables.evidence, message: safePatternVariables.message };
+        const target = resolveVerifierTemplate(completion.file_contains.path, context.variables);
+        const pattern = resolveVerifierTemplate(completion.file_contains.pattern, context.variables);
+        if (hasUnresolvedVerifierTemplate(target) || hasUnresolvedVerifierTemplate(pattern)) {
+            return { passed: false, target, evidence: "unresolved_template", message: unresolvedVerifierTemplateMessage(hasUnresolvedVerifierTemplate(target) ? target : pattern) };
+        }
+        const resolvedTarget = await resolveVerifierTarget(context.projectDir, target);
+        const artifact = resolvedTarget ?? undefined;
+        const evidence = `pattern:${pattern}`;
+        if (!resolvedTarget)
+            return { passed: false, target, evidence: "path_escape", artifact, message: `Verifier target escapes project root: ${target}` };
+        try {
+            const raw = await readFile(resolvedTarget, "utf-8");
+            const re = new RegExp(pattern);
+            return re.test(raw)
+                ? { passed: true, target, evidence, artifact }
+                : { passed: false, target, evidence, artifact, message: `Required pattern missing in ${target}` };
+        }
+        catch {
+            return { passed: false, target, evidence, artifact, message: `Required file missing: ${target}` };
+        }
+    }
+    const rawCommand = completion.command_success;
+    const commandResolution = resolveVerifierCommand(rawCommand, ir.verifier_policy, context.variables);
+    if (!commandResolution.command)
+        return { passed: false, target: commandResolution.target, evidence: commandResolution.evidence, exit_code: commandResolution.exit_code, message: commandResolution.message };
+    const command = commandResolution.command;
+    const commandResult = await execVerifierCommand(context.projectDir, command, context.commandTimeoutMs, verifierCommandEnv(context.variables));
+    return {
+        passed: commandResult.passed,
+        target: command,
+        evidence: commandResult.evidence,
+        exit_code: commandResult.exitCode,
+        timedOut: commandResult.timedOut,
+        message: commandResult.passed
+            ? undefined
+            : commandResult.timedOut
+                ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms: ${command}`
+                : `Verifier command failed: ${command}`,
+    };
+}
+export async function runCheckpointVerifier(checkpoint, ir, context) {
+    const assertCommands = {
+        clean_working_tree: "git status --porcelain",
+        lint_passing: "npm run lint --silent 2>/dev/null",
+        build_passing: "npm run build --silent 2>/dev/null",
+    };
+    if (checkpoint.command) {
+        const rawCommand = checkpoint.command;
+        const commandResolution = resolveVerifierCommand(rawCommand, ir.verifier_policy, context.variables);
+        if (!commandResolution.command)
+            return { passed: false, target: commandResolution.target, evidence: commandResolution.evidence, exit_code: commandResolution.exit_code, message: commandResolution.message };
+        const command = commandResolution.command;
+        const commandResult = await execVerifierCommand(context.projectDir, command, context.commandTimeoutMs, verifierCommandEnv(context.variables));
+        return {
+            passed: commandResult.passed,
+            target: command,
+            evidence: commandResult.evidence,
+            exit_code: commandResult.exitCode,
+            timedOut: commandResult.timedOut,
+            message: commandResult.passed
+                ? checkpoint.message
+                : commandResult.timedOut
+                    ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms: ${command}`
+                    : `Verifier command failed: ${command}`,
+        };
+    }
+    if (checkpoint.assert === "clean_working_tree") {
+        if (!isBuiltinAssertAllowed(ir.verifier_policy, checkpoint.assert)) {
+            return { passed: false, target: checkpoint.assert, evidence: "policy_denied", exit_code: 126, message: verifierAssertPolicyMessage(checkpoint.assert) };
+        }
+        try {
+            const { stdout, exitCode } = await execVerifierStdout(context.projectDir, "git", ["status", "--porcelain"]);
+            const changedEntries = stdout.split("\n").filter(Boolean).length;
+            return {
+                passed: exitCode === 0 && stdout.trim() === "",
+                target: checkpoint.assert,
+                evidence: `changed_entries=${changedEntries}`,
+                exit_code: exitCode,
+                message: checkpoint.message,
+            };
+        }
+        catch {
+            return { passed: false, target: checkpoint.assert, exit_code: 1, message: checkpoint.message };
+        }
+    }
+    if (checkpoint.assert === "no_test_regression") {
+        if (!isBuiltinAssertAllowed(ir.verifier_policy, checkpoint.assert)) {
+            return { passed: false, target: checkpoint.assert, evidence: "policy_denied", exit_code: 126, message: verifierAssertPolicyMessage(checkpoint.assert) };
+        }
+        try {
+            const baseline = parseInt(await readFile(resolve(context.projectDir, ".dna/test-baseline"), "utf-8").catch(() => "0"), 10);
+            const current = parseInt(await readFile(resolve(context.projectDir, ".dna/test-current"), "utf-8").catch(() => "0"), 10);
+            return { passed: current <= baseline, target: checkpoint.assert, evidence: `baseline=${baseline} current=${current}`, exit_code: 0, message: checkpoint.message };
+        }
+        catch {
+            return { passed: false, target: checkpoint.assert, exit_code: 1, message: checkpoint.message };
+        }
+    }
+    if (assertCommands[checkpoint.assert]) {
+        if (!isBuiltinAssertAllowed(ir.verifier_policy, checkpoint.assert)) {
+            return { passed: false, target: checkpoint.assert, evidence: "policy_denied", exit_code: 126, message: verifierAssertPolicyMessage(checkpoint.assert) };
+        }
+        const commandResult = await execVerifierCommand(context.projectDir, assertCommands[checkpoint.assert], context.commandTimeoutMs);
+        return {
+            passed: commandResult.passed,
+            target: checkpoint.assert,
+            evidence: commandResult.evidence,
+            exit_code: commandResult.exitCode,
+            message: commandResult.passed
+                ? checkpoint.message
+                : commandResult.timedOut
+                    ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms: ${assertCommands[checkpoint.assert]}`
+                    : checkpoint.message,
+        };
+    }
+    return { passed: false, target: checkpoint.assert, exit_code: 1, message: checkpoint.message };
+}

package/dist/schema/controller-registry.d.ts

@@ -5,7 +5,7 @@ export interface ControllerKindMetadata {
     kind: ControllerKind;
     label: string;
     supportsSkillGeneration: boolean;
-    requiredRoleKeys: readonly ControllerRoleKey[];
+    requiredRoleKeys: readonly string[];
     diagnosisRoleKeys: readonly ControllerRoleKey[];
     fixRoleKeys: readonly ControllerRoleKey[];
 }
@@ -23,6 +23,13 @@ export declare const CONTROLLER_KIND_REGISTRY: readonly [{
     readonly requiredRoleKeys: readonly ["analyzer", "analysis_reviewer", "surgeon", "fix_reviewer", "test_runner"];
     readonly diagnosisRoleKeys: readonly ["analyzer", "analysis_reviewer"];
     readonly fixRoleKeys: readonly ["surgeon", "fix_reviewer", "test_runner"];
+}, {
+    readonly kind: "sequential";
+    readonly label: "Sequential workflow gate";
+    readonly supportsSkillGeneration: false;
+    readonly requiredRoleKeys: readonly [];
+    readonly diagnosisRoleKeys: readonly [];
+    readonly fixRoleKeys: readonly [];
 }];
 export declare function getControllerKindMetadata(kind: unknown): ControllerKindMetadata | undefined;
 export declare function isSupportedControllerKind(kind: unknown): kind is ControllerKind;

package/dist/schema/controller-registry.js

@@ -22,6 +22,14 @@ export const CONTROLLER_KIND_REGISTRY = [
         diagnosisRoleKeys: ["analyzer", "analysis_reviewer"],
         fixRoleKeys: ["surgeon", "fix_reviewer", "test_runner"],
     },
+    {
+        kind: "sequential",
+        label: "Sequential workflow gate",
+        supportsSkillGeneration: false,
+        requiredRoleKeys: [],
+        diagnosisRoleKeys: [],
+        fixRoleKeys: [],
+    },
 ];
 const CONTROLLER_KIND_BY_ID = new Map(CONTROLLER_KIND_REGISTRY.map((entry) => [entry.kind, entry]));
 export function getControllerKindMetadata(kind) {