looply-cli 0.0.0-stage → 0.2.0

package/dist/pending-action.d.ts

@@ -0,0 +1,154 @@
+import { type ActionRequest, type BuildActionErrorCode, type TrustedActionContext } from '@looply/core';
+import { type PublishPolicy } from './config';
+/**
+ * A MODEL ASKING FOR SOMETHING IT MAY NOT DO, SAID AS DATA.
+ *
+ * 7B1 gave a requested action an exact shape and an exact fingerprint, and left
+ * the seam inert: nothing produced one. This is the producer, and it is the
+ * narrowest one that could work — a model turn either carries a declaration in
+ * the structured channel it already answers on, or it does not.
+ *
+ * NOT PROSE, AND THAT IS THE WHOLE POINT. There is no phrase that stops a run,
+ * no word a transcript can contain to make Looply ask a person for permission.
+ * A run that could be halted by an agent writing "I need approval to push" is a
+ * run that can be halted by an agent QUOTING somebody who wrote it — and the
+ * same reasoning in reverse is worse: a consequential act sliding past because
+ * the sentence announcing it was worded unusually. The declaration is a shape
+ * or it is nothing.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHAT THE MODEL SAYS, AND WHAT IT CANNOT SAY
+ *
+ * It names the action and fills in the action's own fields. That is the entire
+ * surface. The project, the actor, the pursuit, the run, the request key and
+ * the risk class are all supplied by the code that is executing, because every
+ * one of them is a way of describing WHOSE authority this is — and a thing
+ * asking for authority does not get to describe the authority it is asking for.
+ *
+ * The risk class in particular is recomputed here from Looply's own classifier
+ * and never read off anything the model wrote. `buildActionRequest` already
+ * refuses a payload carrying a `riskClass` key; this asks the classifier again
+ * afterwards, so a declaration that somehow arrived pre-classified would still
+ * be judged by policy rather than by claim.
+ */
+/**
+ * The envelope version, carried so an older machine meets a newer declaration
+ * and refuses it rather than reading four of its five fields.
+ *
+ * Separate from `ACTION_REQUEST_VERSION`: that one versions what an action IS,
+ * shared by the server and the phone, and this one versions how a model may ask
+ * for one — which only ever travels between a provider and this process.
+ */
+export declare const PENDING_ACTION_VERSION = 1;
+/** The key a declaration must appear under. One name, checked exactly. */
+export declare const PENDING_ACTION_KEY = "pendingAction";
+/**
+ * What a model wrote, before anything trusted has touched it.
+ *
+ * `type` and `action` are `unknown` on purpose and stay that way until
+ * {@link buildPendingActionSignal} hands them to the 7B1 parser. Typing them as
+ * strings and objects here would mean this file had already decided they were
+ * well-formed, in the one place whose entire job is to assume they are not.
+ */
+export interface PendingActionDeclaration {
+    readonly type: unknown;
+    readonly action: unknown;
+    /** Why the model wants it, for a person to read. Never authority — see 7B1. */
+    readonly note?: string;
+}
+export type ReadDeclaration = 
+/** No declaration here. The ordinary answer for the ordinary turn. */
+{
+    readonly kind: 'none';
+} | {
+    readonly kind: 'declared';
+    readonly declaration: PendingActionDeclaration;
+}
+/**
+ * Something claimed to be a declaration and was not.
+ *
+ * Kept apart from `none`, because they must not lead to the same place: a
+ * turn with no declaration is a turn that asked for nothing, and a turn with
+ * a broken one asked for something nobody can identify. Silently treating the
+ * second as the first would let a malformed request become ordinary work.
+ */
+ | {
+    readonly kind: 'malformed';
+    readonly because: string;
+};
+/**
+ * Is this one parsed JSON object a declaration?
+ *
+ * Takes a value rather than a transcript so that the transcript scan stays in
+ * one place — `agent-driver` owns what counts as a candidate, and the prover
+ * and the implementer parser already share it. A second scanner here would be a
+ * second definition of "the model's structured answer".
+ */
+export declare function readPendingActionDeclaration(value: Record<string, unknown>): ReadDeclaration;
+/**
+ * A REQUEST FOR HUMAN AUTHORITY, BUILT AND CHECKED.
+ *
+ * One field, and no state. This is not an approval and it is not a decision:
+ * it is the exact thing a person is about to be asked about, and it exists for
+ * exactly as long as it takes to write that question down somewhere durable.
+ */
+export interface PendingActionSignal {
+    readonly request: ActionRequest;
+}
+/**
+ * Why a declaration did not become a signal.
+ *
+ * `not_consequential` is the interesting one and is deliberately its own code.
+ * A model asking for a routine action is not misbehaving — the run is already
+ * authorised to edit files, and nothing about that needs a person — so this
+ * must not read as a refusal of the model. What it means is that this path is
+ * the wrong one, and the run carries on being an ordinary run.
+ *
+ * `unverifiable` should be unreachable: `buildActionRequest` derives the
+ * fingerprint it then fails to reproduce. It is checked anyway, because the one
+ * value this whole system turns on is that a fingerprint describes the action
+ * standing next to it, and a place that assumes it rather than asking is a
+ * place where it can quietly stop being true.
+ */
+export type PendingActionRefusal = BuildActionErrorCode | 'not_consequential' | 'unverifiable'
+/**
+ * The action would leave this machine and the project has not permitted that.
+ *
+ * REFUSED HERE, BEFORE AN APPROVAL EXISTS, and that placement is the point. A
+ * policy checked at execution time would let a model raise a request, put a
+ * publishing question on somebody's phone, and have them approve something
+ * that then cannot happen — teaching people that approving is theatre. Under
+ * `never` the question is never asked at all.
+ */
+ | 'publishing_not_permitted';
+export type PendingActionOutcome = {
+    readonly ok: true;
+    readonly signal: PendingActionSignal;
+} | {
+    readonly ok: false;
+    readonly code: PendingActionRefusal;
+    readonly because: string;
+};
+/**
+ * Turn what a model asked for into what a person will be asked about.
+ *
+ * The two halves arrive separately and are never merged before this point:
+ * `declaration` is model input and is validated to death by 7B1's registry;
+ * `ctx` is the run's own and is taken as given. There is no arrangement of the
+ * first that can reach the second.
+ *
+ * FAILS CLOSED at every step. An unregistered action type is refused rather
+ * than assumed harmless, a payload that does not match its schema is refused
+ * rather than trimmed, and an action Looply classifies as anything other than
+ * consequential does not travel this road at all.
+ */
+export declare function buildPendingActionSignal(declaration: PendingActionDeclaration, ctx: TrustedActionContext, 
+/**
+ * Whether this project permits Looply to publish. Absent means it does not.
+ *
+ * NOT OPTIONAL BECAUSE IT IS UNIMPORTANT — optional because a caller with no
+ * config has certainly not been granted anything, and the safe reading of a
+ * missing policy is the same as the safe reading of `never`.
+ */
+policy?: PublishPolicy): PendingActionOutcome;
+//# sourceMappingURL=pending-action.d.ts.map

package/dist/pending-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-action.d.ts","sourceRoot":"","sources":["../src/pending-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,eAAe;AACzB,sEAAsE;AACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAA;CAAE;AAC/E;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAiC5F;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,oBAAoB,GAC5B,oBAAoB,GACpB,mBAAmB,GACnB,cAAc;AAChB;;;;;;;;GAQG;GACD,0BAA0B,CAAC;AAE/B,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,wBAAwB,EACrC,GAAG,EAAE,oBAAoB;AACzB;;;;;;GAMG;AACH,MAAM,CAAC,EAAE,aAAa,GACrB,oBAAoB,CAqCtB"}

package/dist/pending-action.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PENDING_ACTION_KEY = exports.PENDING_ACTION_VERSION = void 0;
+exports.readPendingActionDeclaration = readPendingActionDeclaration;
+exports.buildPendingActionSignal = buildPendingActionSignal;
+const core_1 = require("@looply/core");
+const config_1 = require("./config");
+/**
+ * A MODEL ASKING FOR SOMETHING IT MAY NOT DO, SAID AS DATA.
+ *
+ * 7B1 gave a requested action an exact shape and an exact fingerprint, and left
+ * the seam inert: nothing produced one. This is the producer, and it is the
+ * narrowest one that could work — a model turn either carries a declaration in
+ * the structured channel it already answers on, or it does not.
+ *
+ * NOT PROSE, AND THAT IS THE WHOLE POINT. There is no phrase that stops a run,
+ * no word a transcript can contain to make Looply ask a person for permission.
+ * A run that could be halted by an agent writing "I need approval to push" is a
+ * run that can be halted by an agent QUOTING somebody who wrote it — and the
+ * same reasoning in reverse is worse: a consequential act sliding past because
+ * the sentence announcing it was worded unusually. The declaration is a shape
+ * or it is nothing.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHAT THE MODEL SAYS, AND WHAT IT CANNOT SAY
+ *
+ * It names the action and fills in the action's own fields. That is the entire
+ * surface. The project, the actor, the pursuit, the run, the request key and
+ * the risk class are all supplied by the code that is executing, because every
+ * one of them is a way of describing WHOSE authority this is — and a thing
+ * asking for authority does not get to describe the authority it is asking for.
+ *
+ * The risk class in particular is recomputed here from Looply's own classifier
+ * and never read off anything the model wrote. `buildActionRequest` already
+ * refuses a payload carrying a `riskClass` key; this asks the classifier again
+ * afterwards, so a declaration that somehow arrived pre-classified would still
+ * be judged by policy rather than by claim.
+ */
+/**
+ * The envelope version, carried so an older machine meets a newer declaration
+ * and refuses it rather than reading four of its five fields.
+ *
+ * Separate from `ACTION_REQUEST_VERSION`: that one versions what an action IS,
+ * shared by the server and the phone, and this one versions how a model may ask
+ * for one — which only ever travels between a provider and this process.
+ */
+exports.PENDING_ACTION_VERSION = 1;
+/** The key a declaration must appear under. One name, checked exactly. */
+exports.PENDING_ACTION_KEY = 'pendingAction';
+/**
+ * Is this one parsed JSON object a declaration?
+ *
+ * Takes a value rather than a transcript so that the transcript scan stays in
+ * one place — `agent-driver` owns what counts as a candidate, and the prover
+ * and the implementer parser already share it. A second scanner here would be a
+ * second definition of "the model's structured answer".
+ */
+function readPendingActionDeclaration(value) {
+    if (!Object.prototype.hasOwnProperty.call(value, exports.PENDING_ACTION_KEY))
+        return { kind: 'none' };
+    const raw = value[exports.PENDING_ACTION_KEY];
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+        return { kind: 'malformed', because: `${exports.PENDING_ACTION_KEY} must be an object` };
+    }
+    const o = raw;
+    if (o['version'] !== exports.PENDING_ACTION_VERSION) {
+        return {
+            kind: 'malformed',
+            because: `this is a version ${String(o['version'])} request and this build speaks ${exports.PENDING_ACTION_VERSION}`,
+        };
+    }
+    if (!('type' in o))
+        return { kind: 'malformed', because: 'type is required' };
+    if (!('action' in o))
+        return { kind: 'malformed', because: 'action is required' };
+    const note = o['note'];
+    if (note !== undefined && typeof note !== 'string') {
+        return { kind: 'malformed', because: 'note must be a string' };
+    }
+    // Anything beyond the four is refused rather than ignored, for the reason
+    // 7B1's `exactly` gives: a field this skips and something downstream reads is
+    // a request nobody validated travelling inside one somebody did.
+    const extra = Object.keys(o).filter((k) => !['version', 'type', 'action', 'note'].includes(k));
+    if (extra.length > 0) {
+        return { kind: 'malformed', because: `${extra.sort().join(', ')} is not part of a pending action` };
+    }
+    return {
+        kind: 'declared',
+        declaration: { type: o['type'], action: o['action'], ...(note === undefined ? {} : { note }) },
+    };
+}
+/**
+ * Turn what a model asked for into what a person will be asked about.
+ *
+ * The two halves arrive separately and are never merged before this point:
+ * `declaration` is model input and is validated to death by 7B1's registry;
+ * `ctx` is the run's own and is taken as given. There is no arrangement of the
+ * first that can reach the second.
+ *
+ * FAILS CLOSED at every step. An unregistered action type is refused rather
+ * than assumed harmless, a payload that does not match its schema is refused
+ * rather than trimmed, and an action Looply classifies as anything other than
+ * consequential does not travel this road at all.
+ */
+function buildPendingActionSignal(declaration, ctx, 
+/**
+ * Whether this project permits Looply to publish. Absent means it does not.
+ *
+ * NOT OPTIONAL BECAUSE IT IS UNIMPORTANT — optional because a caller with no
+ * config has certainly not been granted anything, and the safe reading of a
+ * missing policy is the same as the safe reading of `never`.
+ */
+policy) {
+    const built = (0, core_1.buildActionRequest)(declaration.type, declaration.action, ctx, declaration.note);
+    if (!built.ok)
+        return { ok: false, code: built.code, because: built.because };
+    // ASKED AGAIN, of the classifier rather than of the request. `built.request`
+    // carries a risk field, and reading it here would make this check circular
+    // the day anything else can construct one.
+    const risk = (0, core_1.classifyAction)(built.request.type);
+    if (risk !== 'consequential') {
+        return {
+            ok: false,
+            code: 'not_consequential',
+            because: `${built.request.type} is ${risk ?? 'unknown'}, and only a consequential action needs a person`,
+        };
+    }
+    // ASKED OF THE REGISTRY, NOT OF THE NAME. `actionPublishes` is Looply's own
+    // judgement about the action, and it fails closed for a type nobody has
+    // judged — so an executor added later cannot slip past a publish policy by
+    // being unknown to it.
+    if ((0, core_1.actionPublishes)(built.request.type) && !(0, config_1.mayPublish)(policy ?? 'never')) {
+        return {
+            ok: false,
+            code: 'publishing_not_permitted',
+            because: `${built.request.type} would leave this machine, and this project's publish policy is ${policy ?? 'never'}`,
+        };
+    }
+    if (!(0, core_1.verifyActionRequest)(built.request)) {
+        return {
+            ok: false,
+            code: 'unverifiable',
+            because: 'the request did not survive its own fingerprint check',
+        };
+    }
+    return { ok: true, signal: { request: built.request } };
+}
+//# sourceMappingURL=pending-action.js.map

package/dist/pending-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-action.js","sourceRoot":"","sources":["../src/pending-action.ts"],"names":[],"mappings":";;;AA6FA,oEAiCC;AA4DD,4DAgDC;AA1OD,uCAQsB;AACtB,qCAA0D;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;GAOG;AACU,QAAA,sBAAsB,GAAG,CAAC,CAAC;AAExC,0EAA0E;AAC7D,QAAA,kBAAkB,GAAG,eAAe,CAAC;AA+BlD;;;;;;;GAOG;AACH,SAAgB,4BAA4B,CAAC,KAA8B;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,0BAAkB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,0BAAkB,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,0BAAkB,oBAAoB,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,8BAAsB,EAAE,CAAC;QAC5C,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,qBAAqB,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,kCAAkC,8BAAsB,EAAE;SAC7G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9E,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAElF,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACjE,CAAC;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,EAAE,CAAC;IACtG,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE;KAC/F,CAAC;AACJ,CAAC;AA+CD;;;;;;;;;;;;GAYG;AACH,SAAgB,wBAAwB,CACtC,WAAqC,EACrC,GAAyB;AACzB;;;;;;GAMG;AACH,MAAsB;IAEtB,MAAM,KAAK,GAAG,IAAA,yBAAkB,EAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9F,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAE9E,6EAA6E;IAC7E,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,IAAI,GAAG,IAAA,qBAAc,EAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,SAAS,kDAAkD;SACzG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,uBAAuB;IACvB,IAAI,IAAA,sBAAe,EAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,mEAAmE,MAAM,IAAI,OAAO,EAAE;SACrH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAA,0BAAmB,EAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,uDAAuD;SACjE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;AAC1D,CAAC"}

package/dist/preemptor.d.ts

@@ -0,0 +1,40 @@
+import type { LedgerFs } from './ledger-store';
+import { type ProbeFn } from './workspace';
+/**
+ * THE MACHINE ASKS ONE OF ITS OWN RUNS TO STOP — when the project asked (M4-2).
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * The scheduler has decided preemption since Phase 3 ("it stops at its next
+ * round boundary") and nothing acted on it: every run was reported as not
+ * preemptible, and the tick read only starts. With `machine.preemption: true`
+ * the daemon answers the first `preempt` of a tick here, after the tick: the
+ * run's OWN graceful `stop` request, written into its addressed control file
+ * exactly as `looply stop` writes it (actor `coordinator`), which the run
+ * honours at its round boundary. Never a signal, never a kill.
+ *
+ * ⚠️ A STANDING REQUEST IS NOT REPEATED. An autonomous run leaves a stop on
+ * disk until it has obeyed (its runner does not consume it — see the round
+ * runner), so a tick that names the same victim twice finds the request
+ * already there and writes nothing.
+ *
+ * ⚠️ AND IT KNOWS NOTHING ABOUT GOALS. Whose run this is and why it is asked
+ * are the daemon's to say, in the words it hands over; the gatherer is what
+ * keeps a person's run off the victim list (`startedBy` is not `machine`).
+ */
+export interface PreemptRequest {
+    readonly runId: string;
+    /** The daemon's description of the run — id, goal, who started it — quoted in the log. */
+    readonly who: string;
+    /** The scheduler's reason, quoted in the log. */
+    readonly because: string;
+}
+export type PreemptAnswer = 'requested' | 'standing' | 'unknown-run';
+export type Preemptor = (runId: string) => Promise<PreemptAnswer>;
+export declare function nodePreemptor(projectState: string, fs: LedgerFs, probe?: ProbeFn): Preemptor;
+export type PreemptOutcome = PreemptAnswer | 'failed' | 'none';
+/**
+ * Answer the tick's request, if there was one and preemption is on. Every
+ * outcome is a log line; a failure names itself and is never a throw.
+ */
+export declare function preemptOnce(request: PreemptRequest | null, preemptor: Preemptor | null, log: (line: string) => void): Promise<PreemptOutcome>;
+//# sourceMappingURL=preemptor.d.ts.map

package/dist/preemptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preemptor.d.ts","sourceRoot":"","sources":["../src/preemptor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AACrE,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAElE,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAa5F;AAED,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE/D;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,GAAG,IAAI,EAC9B,SAAS,EAAE,SAAS,GAAG,IAAI,EAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC,cAAc,CAAC,CAgBzB"}

package/dist/preemptor.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodePreemptor = nodePreemptor;
+exports.preemptOnce = preemptOnce;
+const control_file_1 = require("./control-file");
+const workspace_1 = require("./workspace");
+function nodePreemptor(projectState, fs, probe) {
+    return async (runId) => {
+        const registry = probe === undefined ? new workspace_1.RunRegistry(projectState) : new workspace_1.RunRegistry(projectState, probe);
+        const live = registry
+            .list()
+            .find((e) => e.kind === 'active' && e.record.runId === runId);
+        if (live === undefined)
+            return 'unknown-run';
+        const control = control_file_1.ControlStore.addressed(live.record.stateDir, runId, fs);
+        const standing = await control.read();
+        if (standing !== null && standing.kind === 'stop')
+            return 'standing';
+        await control.request('stop', 'coordinator');
+        return 'requested';
+    };
+}
+/**
+ * Answer the tick's request, if there was one and preemption is on. Every
+ * outcome is a log line; a failure names itself and is never a throw.
+ */
+async function preemptOnce(request, preemptor, log) {
+    if (request === null)
+        return 'none';
+    if (preemptor === null) {
+        log(`daemon  : the scheduler would preempt ${request.who}, but preemption is off — not asked`);
+        return 'none';
+    }
+    try {
+        const answer = await preemptor(request.runId);
+        if (answer === 'requested')
+            log(`daemon  : asked ${request.who} to stop at its round boundary — ${request.because}`);
+        else if (answer === 'standing')
+            log(`daemon  : ${request.who} was already asked to stop — not asked again`);
+        else
+            log(`daemon  : ${request.who} is not an active run on this machine — nothing to stop`);
+        return answer;
+    }
+    catch (e) {
+        log(`daemon  : could not ask ${request.who} to stop — ${e.message}`);
+        return 'failed';
+    }
+}
+//# sourceMappingURL=preemptor.js.map

package/dist/preemptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preemptor.js","sourceRoot":"","sources":["../src/preemptor.ts"],"names":[],"mappings":";;AAqCA,sCAaC;AAQD,kCAoBC;AA9ED,iDAA8C;AAE9C,2CAAwD;AAmCxD,SAAgB,aAAa,CAAC,YAAoB,EAAE,EAAY,EAAE,KAAe;IAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,uBAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,uBAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,QAAQ;aAClB,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,CAAC,EAA8C,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAC5G,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC;QAC7C,MAAM,OAAO,GAAG,2BAAY,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,UAAU,CAAC;QACrE,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC7C,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAID;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,OAA8B,EAC9B,SAA2B,EAC3B,GAA2B;IAE3B,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,yCAAyC,OAAO,CAAC,GAAG,qCAAqC,CAAC,CAAC;QAC/F,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,WAAW;YAAE,GAAG,CAAC,mBAAmB,OAAO,CAAC,GAAG,oCAAoC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;aAChH,IAAI,MAAM,KAAK,UAAU;YAAE,GAAG,CAAC,aAAa,OAAO,CAAC,GAAG,8CAA8C,CAAC,CAAC;;YACvG,GAAG,CAAC,aAAa,OAAO,CAAC,GAAG,yDAAyD,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,2BAA2B,OAAO,CAAC,GAAG,cAAe,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/programme-mode.d.ts

@@ -0,0 +1,29 @@
+/**
+ * PROGRAMME MODE, slice 2 (M6-10): ONE SENTENCE FOR THE OWNER.
+ *
+ * The parser has already applied the umbrella (config.ts: `parseProgrammeBlock`,
+ * every face on unless turned off explicitly, the limits landed on their
+ * knobs). This says what came of it — the same sentence in `looply doctor` and
+ * on the daemon's first lines, so a person can see the mode the machine is in
+ * without reading the config back.
+ */
+import type { LooplyConfig } from './config';
+/**
+ * Is this machine running as a programme at all?
+ *
+ * 🔴 EITHER FORM COUNTS, AND THE DIRECTION IS DELIBERATE. The block
+ * (`machine.programme: { on, limits }`) is the full mode; `machine.programme:
+ * true` is slice 1, continuation-only — a machine that carries on from an
+ * approved decision without another tap. Both mean completions are reached
+ * with nobody reading each one, which is the condition that makes an unearned
+ * completion dangerous.
+ *
+ * ⚠️ OVER-BLOCKING A COMPLETION IS RECOVERABLE AND UNDER-BLOCKING ONE IS NOT,
+ * which is the same direction `isMandatory` takes for an unclassified
+ * statement. A machine that stops one Start early costs a person a sentence; a
+ * machine that declares a goal met on a green tree nobody claimed costs them
+ * the thing the goal was about.
+ */
+export declare function programmeIsOn(cfg: LooplyConfig): boolean;
+export declare function describeProgramme(cfg: LooplyConfig): string;
+//# sourceMappingURL=programme-mode.d.ts.map

package/dist/programme-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"programme-mode.d.ts","sourceRoot":"","sources":["../src/programme-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAExD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAoB3D"}

package/dist/programme-mode.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.programmeIsOn = programmeIsOn;
+exports.describeProgramme = describeProgramme;
+/**
+ * Is this machine running as a programme at all?
+ *
+ * 🔴 EITHER FORM COUNTS, AND THE DIRECTION IS DELIBERATE. The block
+ * (`machine.programme: { on, limits }`) is the full mode; `machine.programme:
+ * true` is slice 1, continuation-only — a machine that carries on from an
+ * approved decision without another tap. Both mean completions are reached
+ * with nobody reading each one, which is the condition that makes an unearned
+ * completion dangerous.
+ *
+ * ⚠️ OVER-BLOCKING A COMPLETION IS RECOVERABLE AND UNDER-BLOCKING ONE IS NOT,
+ * which is the same direction `isMandatory` takes for an unclassified
+ * statement. A machine that stops one Start early costs a person a sentence; a
+ * machine that declares a goal met on a green tree nobody claimed costs them
+ * the thing the goal was about.
+ */
+function programmeIsOn(cfg) {
+    return cfg.machine?.programmeMode !== undefined || cfg.machine?.programme === true;
+}
+function describeProgramme(cfg) {
+    const m = cfg.machine;
+    if (m?.programmeMode !== undefined) {
+        const l = m.programmeMode.limits;
+        const n = (count, word) => `${count} ${word}${count === 1 ? '' : 's'}`;
+        const off = [];
+        if (m.coordinator !== true)
+            off.push('coordinator');
+        if (m.provisionWorkspaces !== true)
+            off.push('provisioning');
+        if (m.reapProvisioned !== true)
+            off.push('reaping');
+        if (m.preemption !== true)
+            off.push('preemption');
+        if (m.integrate !== true || cfg.run.integration !== true)
+            off.push('integration');
+        if (cfg.run.brain !== true)
+            off.push('brain');
+        return (`programme mode: on — ${n(l.maxWorkspaces, 'checkout')}, ${n(l.maxAgentsInFlight, 'agent')} in flight, ` +
+            `${n(l.startsPerGrant, 'Start')} per grant, ${l.windowMinutes}-minute window, integrates to ${l.integrationRef}` +
+            (off.length === 0 ? '' : ` — turned off here: ${off.join(', ')}`));
+    }
+    if (m?.programme === true)
+        return 'programme mode: continuation only (machine.programme: true)';
+    return 'programme mode: off (manual defaults)';
+}
+//# sourceMappingURL=programme-mode.js.map

package/dist/programme-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"programme-mode.js","sourceRoot":"","sources":["../src/programme-mode.ts"],"names":[],"mappings":";;AA2BA,sCAEC;AAED,8CAoBC;AAxCD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,aAAa,CAAC,GAAiB;IAC7C,OAAO,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AACrF,CAAC;AAED,SAAgB,iBAAiB,CAAC,GAAiB;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACvF,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,mBAAmB,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClF,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CACL,wBAAwB,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc;YACxG,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,aAAa,iCAAiC,CAAC,CAAC,cAAc,EAAE;YAChH,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,SAAS,KAAK,IAAI;QAAE,OAAO,6DAA6D,CAAC;IAChG,OAAO,uCAAuC,CAAC;AACjD,CAAC"}

package/dist/progress-view.d.ts

@@ -0,0 +1,14 @@
+import type { RoundFinishInfo, RunEndInfo, RunProgressNotifier, RunStartInfo } from './notify-cadence';
+export declare class TerminalNotifier implements RunProgressNotifier {
+    private readonly log;
+    private round;
+    constructor(log: (line: string) => void);
+    /** Called by the runner's phase wrappers, not by the notifier interface. */
+    phase(round: number, phase: string, detail: string): void;
+    runStarted(_info: RunStartInfo): Promise<void>;
+    roundFinished(info: RoundFinishInfo): Promise<void>;
+    runEnded(info: RunEndInfo): Promise<void>;
+}
+/** Report to several notifiers at once; one throwing must not silence the rest. */
+export declare function fanOut(...notifiers: readonly RunProgressNotifier[]): RunProgressNotifier;
+//# sourceMappingURL=progress-view.d.ts.map

package/dist/progress-view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress-view.d.ts","sourceRoot":"","sources":["../src/progress-view.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAwCvG,qBAAa,gBAAiB,YAAW,mBAAmB;IAG9C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,KAAK,CAAK;gBAEW,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI;IAExD,4EAA4E;IAC5E,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAKnD,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IASnD,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAuChD;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,GAAG,SAAS,EAAE,SAAS,mBAAmB,EAAE,GAAG,mBAAmB,CAYxF"}

package/dist/progress-view.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TerminalNotifier = void 0;
+exports.fanOut = fanOut;
+const ui_1 = require("./ui");
+/**
+ * What a run says in the terminal it is running in.
+ *
+ * A run printed three header lines and then nothing at all until it stopped —
+ * for hours. Somebody watching it could not tell a working loop from a hung
+ * one, which is the exact failure mode the whole product is written against:
+ * silence is worse than bad news. `notify.every_min` governs the *phone*, so it
+ * cannot cover this; a terminal has a person already looking at it.
+ *
+ * Kept separate from CadenceNotifier because the two answer different
+ * questions. The cadence one decides whether to interrupt somebody who is not
+ * here; this one narrates to somebody who is, and so has no rate limit and no
+ * off switch beyond redirecting stdout.
+ */
+const OUTCOME_MARK = {
+    committed: ui_1.volt,
+    discarded: ui_1.amber,
+    abandoned: ui_1.red,
+};
+const OUTCOME_WORD = {
+    committed: 'kept',
+    discarded: 'thrown away',
+    abandoned: 'abandoned',
+};
+function clip(s, n) {
+    return s.length <= n ? s : `${s.slice(0, n - 1)}…`;
+}
+function mins(ms) {
+    const m = Math.round(ms / 60_000);
+    if (m < 60)
+        return `${m}m`;
+    return `${Math.floor(m / 60)}h${String(m % 60).padStart(2, '0')}`;
+}
+class TerminalNotifier {
+    log;
+    round = 0;
+    constructor(log) {
+        this.log = log;
+    }
+    /** Called by the runner's phase wrappers, not by the notifier interface. */
+    phase(round, phase, detail) {
+        this.round = round;
+        this.log(`${(0, ui_1.grey)(`round ${String(round).padStart(2)}`)} ${(0, ui_1.white)(phase.padEnd(12))} ${(0, ui_1.dim)(clip(detail, 58))}`);
+    }
+    async runStarted(_info) {
+        this.log('');
+    }
+    async roundFinished(info) {
+        const paint = OUTCOME_MARK[info.outcome];
+        const left = info.remainingMs > 0 ? ` ${(0, ui_1.dim)(`· ${mins(info.remainingMs)} left`)}` : '';
+        this.log(`${(0, ui_1.grey)(`round ${String(this.round).padStart(2)}`)} ${paint(OUTCOME_WORD[info.outcome].padEnd(12))}` +
+            ` ${(0, ui_1.dim)(clip(info.itemTitle, 46))} ${(0, ui_1.dim)(`(${mins(info.elapsedMs)})`)}${left}`);
+    }
+    async runEnded(info) {
+        const t = info.totals;
+        this.log('');
+        this.log(`${(0, ui_1.grey)('run')}     ${(0, ui_1.white)(`${t.rounds} round${t.rounds === 1 ? '' : 's'}`)} · ` +
+            `${(0, ui_1.volt)(`${t.committed} kept`)} · ${(0, ui_1.amber)(`${t.discarded} thrown away`)} · ` +
+            `${t.abandoned ? (0, ui_1.red)(`${t.abandoned} abandoned`) : (0, ui_1.dim)('0 abandoned')}`);
+        /**
+         * The number the plan calls the honesty check: a prover that never rejects
+         * anything is not checking, and this is where a run says so out loud.
+         *
+         * 🔴 IT USED TO COUNT EVERY DISCARD AS A PROVER REJECTION. `t.discarded`
+         * counts reds of every kind, so a round killed by a GATE — which the prover
+         * never even saw — was reported as "rejected by the second agent".
+         * Measured live on a run whose gate timed out and whose spend ledger shows
+         * the prover was never invoked: "100% of finished rounds were rejected by
+         * the second agent". The honesty check was the dishonest line.
+         *
+         * ⚠️ AND ABSENT IS NOT ZERO. A producer that did not count says nothing
+         * here rather than claiming the prover rejected none — that claim is
+         * exactly what this must stop making without evidence.
+         */
+        const judged = t.committed + t.discarded;
+        if (judged > 0) {
+            const rejected = t.proverRejected;
+            if (rejected === undefined) {
+                const pct = Math.round((t.discarded / judged) * 100);
+                this.log(`${(0, ui_1.grey)('proof')}   ${(0, ui_1.dim)(`${pct}% of finished rounds were thrown away — the ledger says where each one failed`)}`);
+            }
+            else {
+                const pct = Math.round((rejected / judged) * 100);
+                this.log(`${(0, ui_1.grey)('proof')}   ${(0, ui_1.dim)(`${pct}% of finished rounds were rejected by the second agent`)}`);
+            }
+        }
+        this.log(`${(0, ui_1.grey)('branch')}  ${(0, ui_1.dim)(info.branch)} ${(0, ui_1.dim)(`· ${info.stopReason} · ${mins(info.elapsedMs)}`)}`);
+        this.log('');
+    }
+}
+exports.TerminalNotifier = TerminalNotifier;
+/** Report to several notifiers at once; one throwing must not silence the rest. */
+function fanOut(...notifiers) {
+    const each = async (fn) => {
+        // DESIGN section 12 case 33: a notifier must never fail a round. One that
+        // throws here would take the round down with it, which is a far worse
+        // outcome than a missed message.
+        await Promise.all(notifiers.map(async (n) => { try {
+            await fn(n);
+        }
+        catch { /* reported, never fatal */ } }));
+    };
+    return {
+        runStarted: (i) => each((n) => n.runStarted(i)),
+        roundFinished: (i) => each((n) => n.roundFinished(i)),
+        runEnded: (i) => each((n) => n.runEnded(i)),
+    };
+}
+//# sourceMappingURL=progress-view.js.map

package/dist/progress-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress-view.js","sourceRoot":"","sources":["../src/progress-view.ts"],"names":[],"mappings":";;;AA2GA,wBAYC;AArHD,6BAA0D;AAE1D;;;;;;;;;;;;;GAaG;AAEH,MAAM,YAAY,GAAgD;IAChE,SAAS,EAAE,SAAI;IACf,SAAS,EAAE,UAAK;IAChB,SAAS,EAAE,QAAG;CACf,CAAC;AAEF,MAAM,YAAY,GAAiC;IACjD,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS;IAChC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;AACrD,CAAC;AAED,SAAS,IAAI,CAAC,EAAU;IACtB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAa,gBAAgB;IAGE;IAFrB,KAAK,GAAG,CAAC,CAAC;IAElB,YAA6B,GAA2B;QAA3B,QAAG,GAAH,GAAG,CAAwB;IAAG,CAAC;IAE5D,4EAA4E;IAC5E,KAAK,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;QAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAA,SAAI,EAAC,SAAS,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAA,UAAK,EAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAA,QAAG,EAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAqB;QACvC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAA,QAAG,EAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC,GAAG,CACN,GAAG,IAAA,SAAI,EAAC,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE;YAClG,IAAI,IAAA,QAAG,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,IAAA,QAAG,EAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CACjF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAgB;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CACN,GAAG,IAAA,SAAI,EAAC,KAAK,CAAC,QAAQ,IAAA,UAAK,EAAC,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK;YAC/E,GAAG,IAAA,SAAI,EAAC,GAAG,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,IAAA,UAAK,EAAC,GAAG,CAAC,CAAC,SAAS,cAAc,CAAC,KAAK;YAC5E,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,QAAG,EAAC,GAAG,CAAC,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,CAAC,IAAA,QAAG,EAAC,aAAa,CAAC,EAAE,CAC1E,CAAC;QACF;;;;;;;;;;;;;;WAcG;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACzC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,CAAC,CAAC,cAAc,CAAC;YAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;gBACrD,IAAI,CAAC,GAAG,CACN,GAAG,IAAA,SAAI,EAAC,OAAO,CAAC,MAAM,IAAA,QAAG,EAAC,GAAG,GAAG,+EAA+E,CAAC,EAAE,CACnH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;gBAClD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAA,SAAI,EAAC,OAAO,CAAC,MAAM,IAAA,QAAG,EAAC,GAAG,GAAG,wDAAwD,CAAC,EAAE,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAA,SAAI,EAAC,QAAQ,CAAC,KAAK,IAAA,QAAG,EAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAA,QAAG,EAAC,KAAK,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;CACF;AA/DD,4CA+DC;AAED,mFAAmF;AACnF,SAAgB,MAAM,CAAC,GAAG,SAAyC;IACjE,MAAM,IAAI,GAAG,KAAK,EAAE,EAA6C,EAAiB,EAAE;QAClF,0EAA0E;QAC1E,sEAAsE;QACtE,iCAAiC;QACjC,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChH,CAAC,CAAC;IACF,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KAC5C,CAAC;AACJ,CAAC"}