karajan-code 4.70.4 → 5.0.1

package/src/review/sonar-pregate.js

@@ -82,6 +82,58 @@ export function groupByScanRoot(files, { root = process.cwd(), exists = existsSy
   return groups;
 }
 
+// One scan root: scan it, prove its coverage, read its issues (repo-relative).
+async function scanGroup(config, dir, { projectDir, rootCwd, logger }) {
+  const prefix = dir ? `${dir}/` : "";
+  // KJC-TSK-0838: verbose, so the scanner names every file it indexed.
+  const scanCwd = dir ? join(projectDir, dir) : rootCwd;
+  const scan = await runSonarScan(config, null, { verbose: true, ...(scanCwd ? { cwd: scanCwd } : {}) });
+  if (scan.note) logger?.warn?.(scan.note); // KJC-BUG-0156: precedence is said, never silent
+  if (!scan.ok) {
+    return { failure: { available: false, reason: (scan.stderr || scan.stdout || "sonar scan failed").trim() } };
+  }
+  // Coverage is PROVED by the scanner's own index, never inferred from
+  // config — a root-scoped properties file let 4 PRs under packages/radar
+  // pass as "0 issues on staged files". No index in the log = no proof.
+  const own = indexedFilesFrom(scan.stdout);
+  if (own.size === 0) {
+    return { failure: { available: false, reason: `the scanner log names no indexed file (sonar.verbose) — coverage cannot be proved for ${dir || "the repo root"}` } };
+  }
+  // The scan above ALWAYS runs before issues are read (single-flight), and
+  // it returns once the server has processed it (KJC-BUG-0263: before, the
+  // upload returned first and the issues read were the previous analysis).
+  const res = await getOpenIssues(config, scan.projectKey);
+  return {
+    indexed: [...own].map((f) => `${prefix}${f}`),
+    projectKey: scan.projectKey,
+    total: res.total ?? (res.issues || []).length,
+    // Issue components are package-relative: made repo-relative here.
+    issues: (res.issues || []).map((i) => ({ ...i, component: `${scan.projectKey}:${prefix}${issueFile(i)}` })),
+  };
+}
+
+function pregateResult({ config, stagedFiles, touchedLines, indexed, issues, keys, totalProject }) {
+  const { sources } = sourceFilesOf(config, stagedFiles);
+  const staged = new Set(stagedFiles);
+  const onStaged = issues.filter((i) => staged.has(issueFile(i)));
+  // KJC-TSK-0795 AC3: with the diff's line map, only issues on lines the PR
+  // ADDS can veto — a 3-line PR must not answer for 30 preexisting issues.
+  // No line, or an untouched line, is the file's TREND: reported, never a block.
+  const isTouched = (i) => !touchedLines || (i.line != null && touchedLines.get(issueFile(i))?.has(Number(i.line)));
+  const mine = onStaged.filter(isTouched);
+  const isBlocking = (i) => BLOCKING_SEVERITIES.has(String(i.severity).toUpperCase());
+  return {
+    available: true,
+    projectKey: keys.join(","),
+    covered: sources.filter((f) => indexed.has(f)),
+    uncovered: sources.filter((f) => !indexed.has(f)),
+    blocking: mine.filter(isBlocking),
+    advisory: mine.filter((i) => !isBlocking(i)),
+    preexisting: touchedLines ? onStaged.filter((i) => !isTouched(i)) : [],
+    totalProject,
+  };
+}
+
 // KJC-TSK-1078: projectDir is where the files live (a third-party PR's clone may not be the cwd).
 export async function runSonarPregate({ config, stagedFiles = [], touchedLines = null, logger = null, exists = existsSync, projectDir = process.cwd() }) {
   if (config?.review_gate?.sonar === false) {
@@ -104,51 +156,14 @@ export async function runSonarPregate({ config, stagedFiles = [], touchedLines =
     const keys = [];
     let totalProject = 0;
     for (const dir of groups.keys()) {
-      const prefix = dir ? `${dir}/` : "";
-      // KJC-TSK-0838: verbose, so the scanner names every file it indexed.
-      const scanCwd = dir ? join(projectDir, dir) : rootCwd;
-      const scan = await runSonarScan(config, null, { verbose: true, ...(scanCwd ? { cwd: scanCwd } : {}) });
-      if (scan.note) logger?.warn?.(scan.note); // KJC-BUG-0156: precedence is said, never silent
-      if (!scan.ok) {
-        return { available: false, reason: (scan.stderr || scan.stdout || "sonar scan failed").trim() };
-      }
-      // Coverage is PROVED by the scanner's own index, never inferred from
-      // config — a root-scoped properties file let 4 PRs under packages/radar
-      // pass as "0 issues on staged files". No index in the log = no proof.
-      const own = indexedFilesFrom(scan.stdout);
-      if (own.size === 0) {
-        return { available: false, reason: `the scanner log names no indexed file (sonar.verbose) — coverage cannot be proved for ${dir || "the repo root"}` };
-      }
-      for (const f of own) indexed.add(`${prefix}${f}`);
-      keys.push(scan.projectKey);
-      // The scan above ALWAYS runs before issues are read (single-flight), and
-      // it returns once the server has processed it (KJC-BUG-0263: before, the
-      // upload returned first and the issues read were the previous analysis).
-      const res = await getOpenIssues(config, scan.projectKey);
-      totalProject += res.total ?? (res.issues || []).length;
-      // Issue components are package-relative: made repo-relative here.
-      for (const i of res.issues || []) issues.push({ ...i, component: `${scan.projectKey}:${prefix}${issueFile(i)}` });
+      const group = await scanGroup(config, dir, { projectDir, rootCwd, logger });
+      if (group.failure) return group.failure;
+      for (const f of group.indexed) indexed.add(f);
+      keys.push(group.projectKey);
+      totalProject += group.total;
+      issues.push(...group.issues);
     }
-    const { sources } = sourceFilesOf(config, stagedFiles);
-    const covered = sources.filter((f) => indexed.has(f));
-    const uncovered = sources.filter((f) => !indexed.has(f));
-    const staged = new Set(stagedFiles);
-    const onStaged = issues.filter((i) => staged.has(issueFile(i)));
-    // KJC-TSK-0795 AC3: with the diff's line map, only issues on lines the PR
-    // ADDS can veto — a 3-line PR must not answer for 30 preexisting issues.
-    // No line, or an untouched line, is the file's TREND: reported, never a block.
-    const isTouched = (i) => !touchedLines || (i.line != null && touchedLines.get(issueFile(i))?.has(Number(i.line)));
-    const mine = onStaged.filter(isTouched);
-    return {
-      available: true,
-      projectKey: keys.join(","),
-      covered,
-      uncovered,
-      blocking: mine.filter((i) => BLOCKING_SEVERITIES.has(String(i.severity).toUpperCase())),
-      advisory: mine.filter((i) => !BLOCKING_SEVERITIES.has(String(i.severity).toUpperCase())),
-      preexisting: touchedLines ? onStaged.filter((i) => !isTouched(i)) : [],
-      totalProject,
-    };
+    return pregateResult({ config, stagedFiles, touchedLines, indexed, issues, keys, totalProject });
   } catch (err) {
     logger?.warn?.(`[sonar-pregate] ${err.message}`);
     return { available: false, reason: err.message };

package/src/review/third-party-review.js

@@ -14,8 +14,14 @@ import { isGenerated } from "./loc-budget.js";
 import { prSecurityChecks } from "./pr-security.js";
 import { sonarCheck } from "./pr-sonar.js";
 import { batchDiff, splitByFile } from "./diff-batches.js";
+import { ceilingOf, isTooLarge, measureCode, tooLargeSummary } from "./third-party-size.js";
 import { lensTask } from "./review-lens.js";
-import { thirdPartyTask } from "./untrusted-context.js";
+import { thirdPartyTask, THIRD_PARTY_INSTRUCTION } from "./untrusted-context.js";
+import { baseOf, readRepoDocs, repoDocsTask } from "./repo-docs.js";
+import { detectStack } from "./repo-stack.js";
+import { thirdPartySkills } from "./third-party-skills.js";
+import { hasAtrilStore } from "../skills/atril-skills.js";
+import { MAX_SKILLS } from "../skills/role-skills.js";
 import { readTaskFile } from "../utils/task-file.js";
 import { DIFF_CLIP_CHARS } from "../prompts/diff-clip.js";
 import { assertCrossFamily, verifyFindings } from "./run-verifier.js";
@@ -37,13 +43,13 @@ const finding = (i) => ({
 });
 
 /** The review as data: verdict, findings, suggestions, security checks and, apart, the house requirements. */
-export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck, limit = DIFF_CLIP_CHARS, maxBatches = MAX_REVIEW_BATCHES, sizeLimit = null, verifier = null, verifierModel = null, verify = verifyFindings, reviewers = null }) {
-  // KJC-TSK-1195: a verifier of the reviewer's own family is refused before any token is spent.
-  const reviewerRole = resolveRole(config, "reviewer");
-  if (verifier) assertCrossFamily({ reviewer: reviewerRole.provider, reviewerModel: reviewerRole.model, verifier, verifierModel, logger });
-  // KJC-TSK-1248 (#2623): two reviewers of the same family would share their blind spots.
-  if (reviewers) assertCrossFamily({ reviewer: reviewers[0].provider, reviewerModel: reviewers[0].model, verifier: reviewers[1].provider, verifierModel: reviewers[1].model, logger, flag: "--reviewers" });
+export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck, limit = DIFF_CLIP_CHARS, maxBatches = MAX_REVIEW_BATCHES, sizeLimit = null, verifier = null, verifierModel = null, verify = verifyFindings, reviewers = null, repoDocs = readRepoDocs, hasStore = hasAtrilStore, stackOf = detectStack, skillsFor = thirdPartySkills }) {
+  const reviewerRole = assertPanel({ config, verifier, verifierModel, reviewers, logger });
   const diff = await gitDiff(projectDir, range);
+  const budget = () => sizeLimit ?? prSizeLimit({ projectDir, config }).limit;
+  // KJC-TSK-1356 (#3027): past the ceiling, no reviewer runs: the size, the ceiling and the split.
+  const tooLarge = sizeVerdict({ diff, config, range, budget });
+  if (tooLarge) return tooLarge;
   // KJC-TSK-1076/1077: the PR's requirements and its security, with no tokens; they never stop the review.
   // KJC-BUG-0379 (#2263): the house requirements (size, commits, attribution, tests) travel apart:
   // on another repo with other conventions they must not read as findings next to security.
@@ -54,34 +60,87 @@ export async function thirdPartyReview({ range, config, projectDir, logger, task
   const provider = reviewerRole.provider || null;
   const { batches, coverage } = batchDiff(diff, { limit, maxBatches });
   if (coverage.files.total === 0) throw new Error(`nothing to review — ${range} has no file changes`);
+  // KJC-TSK-1266 (#2753): the repo's own docs at the base, fenced as untrusted, and named in the output.
+  const { repoContext, reviewTask } = await withRepoDocs({ repoDocs, projectDir, range, task, logger });
+  // KJC-TSK-1272 (#2753): a repo with no atril store gets skills for its stack; the temporary store goes after the review.
+  const stackSkills = await gatherStackSkills({ projectDir, range, config, logger, hasStore, stackOf, skillsFor });
+  repoContext.skills = stackSkills.report;
   const reviewWith = async (who, cfg) => {
     const recs = [];
-    for (const batch of batches) recs.push(await run({ diff: batch.text, task, config: cfg, logger, projectDir, reviewerOverride: who, persist: false }));
+    for (const batch of batches) recs.push(await run({ diff: batch.text, task: reviewTask, config: cfg, logger, projectDir, reviewerOverride: who, persist: false, skills: stackSkills.block }));
     return recs;
   };
-  if (reviewers) {
-    const dual = await dualReview({ reviewers, reviewWith, verify, diff, coverage, config, logger });
-    return { mode: "third-party", range, ...dual, checks, policyChecks, advice: adviceFor(diff, sizeLimit ?? prSizeLimit({ projectDir, config }).limit) };
+  const advice = () => adviceFor(diff, budget());
+  try {
+    const review = reviewers
+      ? await dualReview({ reviewers, reviewWith, verify, diff, coverage, config, logger })
+      : await singleReview({ provider, reviewWith, verifier, verifierModel, verify, diff, coverage, config, logger });
+    return { mode: "third-party", range, ...review, checks, policyChecks, repoContext, advice: advice() };
+  } finally {
+    stackSkills.cleanup();
   }
+}
+
+// Panel checks before any token is spent; returns the configured reviewer role.
+function assertPanel({ config, verifier, verifierModel, reviewers, logger }) {
+  // KJC-TSK-1195: a verifier of the reviewer's own family is refused before any token is spent.
+  const reviewerRole = resolveRole(config, "reviewer");
+  if (verifier) assertCrossFamily({ reviewer: reviewerRole.provider, reviewerModel: reviewerRole.model, verifier, verifierModel, logger });
+  // KJC-TSK-1248 (#2623): two reviewers of the same family would share their blind spots.
+  if (reviewers) assertCrossFamily({ reviewer: reviewers[0].provider, reviewerModel: reviewers[0].model, verifier: reviewers[1].provider, verifierModel: reviewers[1].model, logger, flag: "--reviewers" });
+  return reviewerRole;
+}
+
+// KJC-TSK-1266 (#2753): the repo's own docs at the base, fenced as untrusted, and named in the output.
+async function withRepoDocs({ repoDocs, projectDir, range, task, logger }) {
+  const docs = await repoDocs({ projectDir, base: baseOf(range) });
+  if (docs.error) logger.warn?.(docs.error);
+  return {
+    repoContext: { files: docs.files, omitted: docs.omitted, ...(docs.error && { error: docs.error }) },
+    reviewTask: docs.text ? repoDocsTask(task ?? THIRD_PARTY_INSTRUCTION, docs) : task,
+  };
+}
+
+async function singleReview({ provider, reviewWith, verifier, verifierModel, verify, diff, coverage, config, logger }) {
   const records = await reviewWith(provider, config);
   const findings = records.flatMap((r) => (r.issues ?? []).map(finding));
   // KJC-TSK-1195 (#2369): with a verifier, the findings are the verified ones and the block says what changed.
   const verified = verifier ? await verify({ findings, diff, verifier, model: verifierModel, config, logger }) : null;
   return {
-    mode: "third-party",
-    range,
     reviewer: records[0]?.reviewer ?? provider,
     verdict: verdictOf(records, coverage),
     coverage,
     findings: verified ? verified.findings : findings,
     ...(verified && { verification: verified.verification }),
     suggestions: records.flatMap((r) => r.suggestions ?? []),
-    checks,
-    policyChecks,
-    advice: adviceFor(diff, sizeLimit ?? prSizeLimit({ projectDir, config }).limit),
   };
 }
 
+/**
+ * KJC-TSK-1272 (#2753): the skills for the reviewed repo's stack, the prompt block that carries
+ * them, what to report and how to remove the temporary store. A repo with its own atril store
+ * keeps the usual path; a failure is reported and the review goes on without them.
+ */
+async function gatherStackSkills({ projectDir, range, config, logger, hasStore, stackOf, skillsFor }) {
+  const none = { block: null, cleanup: () => {} };
+  if (projectDir && hasStore(projectDir)) return { ...none, report: { source: "the reviewed repo's atril store" } };
+  try {
+    if (!projectDir) throw new Error("no project directory to read the stack from");
+    const stack = await stackOf({ projectDir, base: baseOf(range) });
+    const max = config?.skills?.max_per_role ?? MAX_SKILLS;
+    const found = await skillsFor({ stack, max, catalogs: config?.review?.third_party?.catalogs ?? [] });
+    return {
+      block: found.skills.length ? { skills: found.skills, dropped: found.dropped, limit: max } : null,
+      report: { stack, used: found.skills.map((s) => s.name), installed: found.installed, dropped: found.dropped, ...(found.reason && { reason: found.reason }) },
+      cleanup: found.cleanup,
+    };
+  } catch (e) {
+    const error = `the stack's skills could not be gathered: ${e.message}`;
+    logger.warn?.(error);
+    return { ...none, report: { error } };
+  }
+}
+
 /**
  * KJC-TSK-1248 (#2623): both reviewers review the whole range on their own, in parallel, each
  * with its model; each one's findings are verified by the other family; one reconciled result.
@@ -99,6 +158,21 @@ async function dualReview({ reviewers, reviewWith, verify, diff, coverage, confi
   return { reviewer: reviewers.map((r) => r.provider).join("+"), ...reconciled, suggestions: records.flat().flatMap((r) => r.suggestions ?? []) };
 }
 
+/** KJC-TSK-1356 (#3027): the too_large result, or null when the PR is within the ceiling. */
+function sizeVerdict({ diff, config, range, budget }) {
+  const ceiling = ceilingOf(config);
+  const files = splitByFile(diff);
+  const size = measureCode(files);
+  if (!isTooLarge(size, ceiling)) return null;
+  const limit = budget();
+  return {
+    mode: "third-party", range,
+    verdict: { status: "too_large", approved: false, summary: tooLargeSummary(size, ceiling, limit) },
+    size, threshold: ceiling, findings: [], suggestions: [],
+    advice: { split: splitAdvice(files.filter((f) => !isGenerated(f.file)), { limit }) },
+  };
+}
+
 /** KJC-TSK-1101: over the size budget, how to split the PR; advice only, never a finding. */
 function adviceFor(diff, budget) {
   const files = splitByFile(diff).filter((f) => !isGenerated(f.file));

package/src/review/third-party-size.js

@@ -0,0 +1,43 @@
+// KJC-TSK-1356 (#3027): how big a third-party PR is, in CODE, and whether it is past the exceptional
+// ceiling past which kj does not review it. Karajan's norm is atomic PRs (the split advice aims at
+// the repo's PR budget); the ceiling is the exception, not the target.
+import { isGenerated } from "./loc-budget.js";
+
+export const MAX_CODE_LINES = 800;
+export const MAX_CODE_FILES = 20;
+
+// Markdown, docs and JSON never count, nor anything generated (lockfiles, build output...).
+const NOT_CODE = /\.(md|mdx|markdown|txt|rst|adoc|json|jsonc)$/i;
+
+/** @param {string} file */
+export const countsAsCode = (file) => Boolean(file) && !isGenerated(file) && !NOT_CODE.test(file);
+
+const positive = (value, key) => {
+  if (value === undefined) return null;
+  if (!Number.isInteger(value) || value <= 0) throw new Error(`review.third_party.${key} must be a positive integer, got ${JSON.stringify(value)}`);
+  return value;
+};
+
+/** The ceiling: review.third_party.max_lines / max_files, or 800 lines / 20 files. */
+export function ceilingOf(config) {
+  const t = config?.review?.third_party ?? {};
+  return {
+    maxLines: positive(t.max_lines, "max_lines") ?? MAX_CODE_LINES,
+    maxFiles: positive(t.max_files, "max_files") ?? MAX_CODE_FILES,
+  };
+}
+
+/** @param {Array<{file: string, changed: number}>} files from splitByFile */
+export function measureCode(files) {
+  const code = files.filter((f) => countsAsCode(f.file));
+  return { codeLines: code.reduce((n, f) => n + f.changed, 0), codeFiles: code.length, otherFiles: files.length - code.length };
+}
+
+export const isTooLarge = (size, ceiling) => size.codeLines > ceiling.maxLines || size.codeFiles > ceiling.maxFiles;
+
+/** What the consumer posts instead of a review. */
+export function tooLargeSummary(size, ceiling, budget) {
+  return `Too large to review well: ${size.codeLines} lines of code in ${size.codeFiles} files `
+    + `(ceiling ${ceiling.maxLines} lines / ${ceiling.maxFiles} files, an exception, never the norm). `
+    + `Karajan recommends atomic PRs of about ${budget} lines of code, one purpose each: split it as advised.`;
+}

package/src/review/third-party-skills.js

@@ -0,0 +1,54 @@
+/**
+ * KJC-TSK-1271 (#2753): a third-party repo has no atril store, so its reviewer
+ * gets skills the way a store-backed project does, through atril's public API,
+ * from a temporary store outside the reviewed repo: atril resolves the reviewer's
+ * skill for the detected stack (the reviewer's own store, ~/.atril, counts), and
+ * when nothing installed fits, the best catalog skill is installed in the
+ * temporary store first. The maintainer's choice (2026-10-29): catalogs too,
+ * installed in a temporary folder. Nothing is written in the reviewed repo.
+ */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { catalogSync, installFromCatalog, resolve, search } from "@karajan-family/atril";
+import { atrilRoleSkills } from "../skills/atril-skills.js";
+
+const ROOT = ".atril";
+const defaultAtril = { resolve, search, installFromCatalog, catalogSync };
+
+/**
+ * @param {{ stack: {languages: string[], frameworks: string[]}, max: number, catalogs?: string[], atril?: typeof defaultAtril }} opts
+ *   catalogs: absolute paths of catalog folders or source files, as in atril.json
+ * @returns {Promise<{skills: object[], others: object[], dropped: string[], installed: string[], reason?: string, cleanup: () => void}>}
+ *   cleanup() removes the temporary store once the review has read the skills
+ */
+export async function thirdPartySkills({ stack, max, catalogs = [], atril = defaultAtril }) {
+  const relative = catalogs.find((ref) => !isAbsolute(ref));
+  if (relative) throw new Error(`catalog "${relative}" must be an absolute path: it would resolve against a temporary folder`);
+  const terms = [...stack.frameworks, ...stack.languages];
+  if (terms.length === 0) return { skills: [], others: [], dropped: [], installed: [], reason: "no stack detected in the reviewed repo", cleanup: () => {} };
+  const dir = mkdtempSync(join(tmpdir(), "kj-3p-skills-"));
+  const cleanup = () => rmSync(dir, { recursive: true, force: true });
+  try {
+    const opts = { projectDir: dir, root: ROOT };
+    mkdirSync(join(dir, ROOT), { recursive: true });
+    writeFileSync(join(dir, ROOT, "atril.json"), `${JSON.stringify({ catalogs })}\n`);
+    if (catalogs.length) atril.catalogSync(opts);
+    const task = `${terms.join(" ")} code review`;
+    const resolveSkills = () => atrilRoleSkills({ role: "reviewer", task, projectDir: dir, root: ROOT, max, resolveFn: atril.resolve });
+    let found = resolveSkills();
+    const installed = [];
+    if (found.skills.length === 0) {
+      const pick = atril.search(task, { ...opts, kind: "skill", plugins: false }).find((hit) => !hit.installed);
+      if (pick) {
+        atril.installFromCatalog(`skill:${pick.name}`, opts);
+        installed.push(pick.name);
+        found = resolveSkills();
+      }
+    }
+    return { ...found, installed, cleanup };
+  } catch (e) {
+    cleanup();
+    throw e;
+  }
+}

package/src/review/verify-pr.js

@@ -10,7 +10,7 @@ import { diffHash } from "./verdict-store.js";
 import { MARKER, TRUSTED } from "./publish-pr.js";
 import { isCleanMerge } from "./clean-merge.js";
 import { verifiedSupervisorFiles } from "../policy/supervisor-verify.js";
-import { PROVENANCE_FILE } from "../harden/supervisor-commit.js";
+import { isSealCommit } from "./seal-commit.js";
 
 // The marker of a kj review for any head: what MARKER writes up to the head itself.
 const MARKER_PREFIX = MARKER("\0").split("\0")[0];
@@ -39,29 +39,6 @@ async function hashesOf(projectDir, sha, run) {
   return hashes;
 }
 
-// KJC-BUG-0388: kj harden --commit is the human's act, signed from the phone, and no AI
-// reviews it. The proof is the signature, never the message: a commit that only touches
-// files the roster-signed seal vouches for at the head is that act.
-async function isSealCommit(projectDir, sha, run, sealed) {
-  if (sealed.signed !== true) return false;
-  const res = await run("git", ["-C", projectDir, "diff", "--name-only", `${sha}^`, sha]);
-  if (res.exitCode !== 0) throw new Error(`git diff --name-only ${sha.slice(0, 7)} failed: ${(res.stderr || "").trim()}`);
-  const files = (res.stdout || "").split("\n").filter(Boolean);
-  // KJC-BUG-0438: the seal act writes the signed provenance; a commit without it only touched files.
-  if (!files.includes(PROVENANCE_FILE)) return false;
-  if (!files.every((f) => sealed.files.has(f) || (f === PROVENANCE_FILE && sealed.complete === true))) return false;
-  // What the commit leaves is byte for byte what the signed seal vouches for at the head: a
-  // precursor whose provenance or hooks a later commit replaced is not the seal act.
-  for (const f of files) if ((await blobAt(projectDir, sha, f, run)) !== (await blobAt(projectDir, "HEAD", f, run))) return false;
-  return true;
-}
-
-/** The blob id of a file at a revision, or null when the file is absent there. */
-async function blobAt(projectDir, rev, file, run) {
-  const res = await run("git", ["-C", projectDir, "rev-parse", "--verify", "--quiet", `${rev}:${file}`]);
-  return res.exitCode === 0 ? String(res.stdout || "").trim() : null;
-}
-
 /**
  * @returns {Promise<{ok: boolean, commits: number, problems: string[], sealCommits?: string[]}>}
  */