lossless-openclaw-orchestrator 1.1.2 → 1.1.3

package/README.md

@@ -14,7 +14,7 @@ safe action without rereading raw transcripts.
 [![License](https://img.shields.io/badge/license-PolyForm%20Noncommercial-blue)](LICENSE)
 [![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CONTRIBUTING.md)
 
-[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.1.2.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
+[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.1.3.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
 
 ## Why It Matters
 

package/dist/packages/cli/src/index.js

@@ -16,7 +16,9 @@ import { runOpenClawGatewayLiveControlSmoke } from "./openclaw-live-control-smok
 import { runOpenClawPostActionRefreshSmoke } from "./openclaw-post-action-refresh-smoke.js";
 import { createScorecardSweep } from "./scorecard-sweep.js";
 import { createScenarioSweep } from "./scenario-sweep.js";
+import { createRuntimeProofIssuePacket } from "./runtime-issue-packet.js";
 import { createOnboardingStatusReport, writeOnboardingStatusReport } from "./onboarding-status.js";
+import { createRuntimeSweepSummary } from "./runtime-sweep-summary.js";
 import { normalizeReleaseClaimScope } from "./release-claim-scope.js";
 import { AppServerLiveControlSmokeClient, runLiveControlSmoke } from "./live-control-smoke.js";
 import { createLocalMacSearchUiShell, REQUIRED_LOCAL_MAC_SEARCH_UI_TOOLS, sampleLocalMacSearchUiShell, writeLocalMacSearchUiEvidence } from "../../local-mac-ui/src/shell.js";
@@ -380,6 +382,18 @@ async function main() {
             process.exitCode = 1;
         return;
     }
+    if (command === "runtime" && args[0] === "sweep-summary") {
+        if (hasHelpFlag(args.slice(1))) {
+            printRuntimeSweepSummaryHelp();
+            return;
+        }
+        const parsed = parseRuntimeSweepSummaryArgs(args.slice(1));
+        const report = createRuntimeSweepSummary(parsed);
+        console.log(JSON.stringify(report, null, 2));
+        if (parsed.strict && (!report.summaryReady || report.claimBoundary.supportedClaimScope === "none"))
+            process.exitCode = 1;
+        return;
+    }
     if (command === "ui" && args[0] === "local-mac-search") {
         if (hasHelpFlag(args.slice(1))) {
             printLocalMacSearchUiHelp();
@@ -456,6 +470,25 @@ async function main() {
             process.exitCode = 1;
         return;
     }
+    if (command === "runtime" && args[0] === "issue-packet") {
+        if (hasHelpFlag(args.slice(1))) {
+            printRuntimeIssuePacketHelp();
+            return;
+        }
+        const parsed = parseRuntimeIssuePacketArgs(args.slice(1));
+        const report = createRuntimeProofIssuePacket({
+            evidenceDir: parsed.evidenceDir,
+            failureReport: parsed.failureReport,
+            parentIssue: parsed.parentIssue,
+            operatingLoopIssue: parsed.operatingLoopIssue,
+            milestone: parsed.milestone,
+            now: parsed.now
+        });
+        console.log(JSON.stringify(report, null, 2));
+        if (parsed.strict && !report.issuePacketReady)
+            process.exitCode = 1;
+        return;
+    }
     if (command === "release" && args[0] === "preflight") {
         if (hasHelpFlag(args.slice(1))) {
             printReleasePreflightHelp();
@@ -750,9 +783,11 @@ function mainUsageText() {
         "  loo openclaw live-control-smoke --evidence-dir path --thread-id id [--openclaw-bin path] [--dev] [--profile name] [--gateway-url ws://127.0.0.1:port] [--token token] [--gateway-timeout-ms ms] [--session-key key] [--message text] [--strict]",
         "  loo openclaw post-action-refresh-smoke --evidence-dir path --thread-id id --live-proof-report path [--openclaw-bin path] [--dev] [--profile name] [--gateway-url ws://127.0.0.1:port] [--token token] [--gateway-timeout-ms ms] [--session-key key] [--query text] [--expand-profile metadata|brief|evidence] [--token-budget n] [--strict]",
         "  loo scorecards sweep --evidence-dir path [--scorecard-dir path] [--claim-scope codex-live-control|codex-read-search-expand-dry-run|codex-working-app-proof] [--strict]",
+        "  loo runtime sweep-summary --evidence-dir path --dry-run-scenarios path --runtime-scenarios path --scorecard-sweep path --published-smoke path [--runtime-proof-dir path] [--now iso] [--strict]",
         "  loo ui local-mac-search --evidence-dir path [--sample] [--strict]",
         "  loo eval retrieval --scenario-file path [--evidence-path path] [--strict]",
         "  loo eval scenarios --evidence-dir path [--scenario-dir path] [--runtime-proof-dir path] [--strict]",
+        "  loo runtime issue-packet --evidence-dir path --failure-report path [--parent-issue #n] [--operating-loop #n] [--milestone name] [--now iso] [--strict]",
         "  loo release preflight [--evidence-dir path] [--claim-scope codex-live-control|codex-read-search-expand-dry-run|codex-working-app-proof] [--approved-live-control-evidence path] [--runtime-proof-dir path] [--strict]",
         "  loo release bundle --evidence-dir path [--claim-scope codex-live-control|codex-read-search-expand-dry-run|codex-working-app-proof] [--approved-live-control-evidence path] [--runtime-proof-dir path] [--strict]",
         "  loo release status --evidence-dir path --candidate-sha sha [--claim-scope codex-live-control|codex-read-search-expand-dry-run|codex-working-app-proof] [--approved-live-control-evidence path] [--runtime-proof-dir path] [--npm-publish-approval-evidence path] [--github-release-approval-evidence path] [--github-ci-evidence path] [--codeql-evidence path] [--desktop-gui-required --desktop-gui-approval-evidence path] [--now iso] [--strict]",
@@ -906,6 +941,48 @@ function printScenarioSweepHelp() {
         "  It does not read raw Codex transcripts, run live Codex control, mutate a desktop GUI, publish npm, or create a GitHub Release."
     ].join("\n"));
 }
+function printRuntimeIssuePacketHelp() {
+    console.log([
+        "Usage:",
+        "  loo runtime issue-packet --evidence-dir path --failure-report path [--parent-issue #n] [--operating-loop #n] [--milestone name] [--now iso] [--strict]",
+        "",
+        "Writes a public-safe issue-ready handoff packet from a failed runtime proof or scenario sweep report.",
+        "",
+        "Required:",
+        "  --evidence-dir is required and receives runtime-proof-issue-packet.json.",
+        "  --failure-report points to the failed public-safe runtime proof, smoke, or scenario-sweep JSON report.",
+        "",
+        "Strict mode:",
+        "  --strict exits non-zero when the failure report is missing, malformed, lacks blocker codes, or when packet redaction fails.",
+        "",
+        "Safety boundary:",
+        "  The command never runs gh issue create and never writes to GitHub.",
+        "  It records only blocker codes, scenario ids, duplicate-check query, acceptance criteria, proof boundary, and redaction categories.",
+        "  It does not read raw Codex transcripts, run live Codex control, mutate a GUI, publish npm, or create a GitHub Release."
+    ].join("\n"));
+}
+function printRuntimeSweepSummaryHelp() {
+    console.log([
+        "Usage:",
+        "  loo runtime sweep-summary --evidence-dir path --dry-run-scenarios path --runtime-scenarios path --scorecard-sweep path --published-smoke path [--runtime-proof-dir path] [--now iso] [--strict]",
+        "",
+        "Writes a public-safe summary that separates dry-run scenario readiness from missing runtime proof markers.",
+        "",
+        "Required:",
+        "  --dry-run-scenarios points to the v1 dry-run scenario sweep report.",
+        "  --runtime-scenarios points to the v1.1 runtime-required scenario sweep report.",
+        "  --scorecard-sweep points to the working-app scorecard sweep report.",
+        "  --published-smoke points to the published-package or gateway setup smoke report.",
+        "",
+        "Strict mode:",
+        "  --strict exits non-zero when the summary itself cannot be produced safely or no claim scope is supported.",
+        "  Missing runtime markers remain claim-boundary blockers, not packet-generation failures.",
+        "",
+        "Safety boundary:",
+        "  The command consumes public-safe reports only.",
+        "  It does not read raw Codex transcripts, run live Codex control, mutate a GUI, publish npm, create tags, or create a GitHub Release."
+    ].join("\n"));
+}
 function printOnboardingStatusHelp() {
     console.log([
         "Usage:",
@@ -1640,6 +1717,47 @@ function parseScenarioSweepArgs(input) {
         throw new Error("eval scenarios requires --evidence-dir");
     return { evidenceDir, scenarioDir, runtimeProofDir, scenarioIds: scenarioIds.length ? scenarioIds : undefined, strict };
 }
+function parseRuntimeIssuePacketArgs(input) {
+    let evidenceDir = "";
+    let failureReport = "";
+    let parentIssue;
+    let operatingLoopIssue;
+    let milestone;
+    let now;
+    let strict = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const arg = input[index];
+        if (arg === "--evidence-dir") {
+            evidenceDir = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--failure-report") {
+            failureReport = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--parent-issue") {
+            parentIssue = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--operating-loop") {
+            operatingLoopIssue = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--milestone") {
+            milestone = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--now") {
+            now = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--strict") {
+            strict = true;
+        }
+        else {
+            throw new Error(`Unknown runtime issue-packet option: ${arg}`);
+        }
+    }
+    if (!evidenceDir)
+        throw new Error("runtime issue-packet requires --evidence-dir");
+    if (!failureReport)
+        throw new Error("runtime issue-packet requires --failure-report");
+    return { evidenceDir, failureReport, parentIssue, operatingLoopIssue, milestone, now, strict };
+}
 function readRetrievalScenarioFile(path) {
     const scenarioPath = resolve(path);
     if (!existsSync(scenarioPath))
@@ -2066,6 +2184,57 @@ function parseScorecardSweepArgs(input) {
         throw new Error("scorecards sweep requires --evidence-dir");
     return { evidenceDir, scorecardDir, claimScope, strict };
 }
+function parseRuntimeSweepSummaryArgs(input) {
+    let evidenceDir;
+    let dryRunScenarios;
+    let runtimeScenarios;
+    let scorecardSweep;
+    let publishedSmoke;
+    let runtimeProofDir;
+    let now;
+    let strict = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const arg = input[index];
+        if (arg === "--evidence-dir") {
+            evidenceDir = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--dry-run-scenarios") {
+            dryRunScenarios = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--runtime-scenarios") {
+            runtimeScenarios = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--scorecard-sweep") {
+            scorecardSweep = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--published-smoke") {
+            publishedSmoke = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--runtime-proof-dir") {
+            runtimeProofDir = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--now") {
+            now = requireOptionValue(input[++index], arg);
+        }
+        else if (arg === "--strict") {
+            strict = true;
+        }
+        else {
+            throw new Error(`Unknown runtime sweep-summary option: ${arg}`);
+        }
+    }
+    if (!evidenceDir)
+        throw new Error("runtime sweep-summary requires --evidence-dir");
+    if (!dryRunScenarios)
+        throw new Error("runtime sweep-summary requires --dry-run-scenarios");
+    if (!runtimeScenarios)
+        throw new Error("runtime sweep-summary requires --runtime-scenarios");
+    if (!scorecardSweep)
+        throw new Error("runtime sweep-summary requires --scorecard-sweep");
+    if (!publishedSmoke)
+        throw new Error("runtime sweep-summary requires --published-smoke");
+    return { evidenceDir, dryRunScenarios, runtimeScenarios, scorecardSweep, publishedSmoke, runtimeProofDir, now, strict };
+}
 function parsePositiveInteger(value, name, max) {
     const parsed = Number(value);
     if (!Number.isInteger(parsed) || parsed < 1 || (max !== undefined && parsed > max)) {

package/dist/packages/cli/src/runtime-issue-packet.js

@@ -0,0 +1,357 @@
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+const DEFAULT_LABELS = ["enhancement", "safety", "orchestrator", "eval"];
+const DEFAULT_PARENT_REFS = ["#309", "#16"];
+const SECRET_LIKE_PATTERN = /(npm_[A-Za-z0-9]{20,}|Bearer\s+[A-Za-z0-9._-]{20,}|sk-[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9_]{20,}|-----BEGIN [A-Z ]*PRIVATE KEY-----)/g;
+const RAW_TRANSCRIPT_PATH_PATTERN = /(?:~|\/[^\s"'`]*)\/\.codex\/(?:sessions|archived_sessions)\/[^\s"'`]+|\b[\w.-]+\.jsonl(?:\.gz)?\b/g;
+const SQLITE_ARTIFACT_PATTERN = /\b[\w.-]+\.(?:sqlite|sqlite-wal|sqlite-shm|db|db-journal|db-wal|db-shm)\b/g;
+const SCREENSHOT_PATTERN = /\b[\w.-]+\.(?:png|jpg|jpeg|webp|heic|gif|tiff|mov|mp4|m4v|webm)\b/gi;
+export function createRuntimeProofIssuePacket(options) {
+    const evidenceDir = resolve(options.evidenceDir);
+    const failureReportPath = resolve(options.failureReport);
+    const evidenceDirRejected = hasPrivateFinding(evidenceDir, "raw_transcript_path");
+    const packetPath = evidenceDirRejected ? "not_written:evidence_dir_transcript_path_rejected" : join(evidenceDir, "runtime-proof-issue-packet.json");
+    if (!evidenceDirRejected)
+        mkdirSync(evidenceDir, { recursive: true });
+    const generatedAtResult = normalizeGeneratedAt(options.now);
+    const generatedAt = generatedAtResult.value;
+    const explicitParentRefs = [
+        normalizeIssueRef(options.parentIssue),
+        normalizeIssueRef(options.operatingLoopIssue)
+    ].filter(Boolean);
+    const parentRefs = uniqueStrings(explicitParentRefs.length > 0 ? explicitParentRefs : DEFAULT_PARENT_REFS);
+    const sourceMissing = !existsSync(failureReportPath);
+    const resolvedFailureReportPath = sourceMissing ? failureReportPath : safeRealpath(failureReportPath);
+    const transcriptPathRejected = !sourceMissing && (hasPrivateFinding(failureReportPath, "raw_transcript_path") ||
+        hasPrivateFinding(resolvedFailureReportPath, "raw_transcript_path"));
+    const sourceText = !sourceMissing && !transcriptPathRejected ? readFileSync(resolvedFailureReportPath, "utf8") : "";
+    const inputFindings = scanTextForPrivateFindings(sourceText);
+    const parsed = readJsonObject(sourceText);
+    const invalidJson = !sourceMissing && !transcriptPathRejected && !parsed;
+    const blockerCodes = sourceMissing
+        ? ["failure_report_missing"]
+        : transcriptPathRejected
+            ? ["failure_report_transcript_path_rejected"]
+            : parsed
+                ? extractBlockerCodes(parsed)
+                : ["failure_report_invalid_json"];
+    const scenarioIds = parsed ? extractScenarioIds(parsed) : [];
+    const rawClaimScope = parsed ? stringField(parsed, "claimScope") ?? stringField(parsed, "claim_scope") : null;
+    const claimScope = rawClaimScope ? safePublicCode(rawClaimScope) : null;
+    const primaryBlocker = blockerCodes[0] ?? "runtime_proof_failure";
+    const title = `Runtime proof failed: ${safeTitleSegment(primaryBlocker)}`;
+    const labels = uniqueStrings([
+        ...DEFAULT_LABELS,
+        ...(scenarioIds.some((id) => /codex|gateway|desktop/i.test(id)) || blockerCodes.some((blocker) => /codex|gateway|desktop/i.test(blocker)) ? ["codex"] : [])
+    ]);
+    const duplicateCheckQuery = buildDuplicateCheckQuery(title, primaryBlocker);
+    const evidencePath = publicEvidencePath(evidenceDir);
+    const steps = [
+        "Run the relevant LCO runtime proof or scenario sweep with a public-safe evidence directory.",
+        "Inspect the sanitized failure report and blocker codes.",
+        "Open or update a GitHub issue only after duplicate-check review and maintainer approval.",
+        "Attach public-safe evidence links only; do not paste raw gateway output, raw prompts, raw transcripts, screenshots, SQLite DB contents, tokens, cookies, or credentials."
+    ];
+    const expected = "Runtime proof markers satisfy the claimed scenario, or the failure is converted into a public-safe issue handoff with exact blocker codes and acceptance criteria.";
+    const actual = sourceMissing
+        ? "No failure report was available for packet generation."
+        : transcriptPathRejected
+            ? "The failure report path looked like a raw Codex transcript path and was rejected before reading."
+            : invalidJson
+                ? "The failure report was not valid JSON; only sanitized category-level findings were retained."
+                : `Runtime proof failed with blocker codes: ${blockerCodes.join(", ") || "none reported"}.`;
+    const acceptanceCriteria = [
+        "Reproduce the failed runtime proof or scenario sweep from the public-safe command and evidence path.",
+        "Resolve or explicitly defer each blocker code listed in this packet.",
+        "Record a new public-safe proof marker or a new fail-closed issue packet after the fix.",
+        "Keep external GitHub writes manual or approval-gated; this packet alone must not create issues.",
+        "Verify the final packet contains no raw transcript text, raw transcript paths, screenshots, SQLite DBs, tokens, cookies, credentials, or private customer data."
+    ];
+    const proofBoundary = "This packet is a public-safe GitHub issue handoff for failed runtime proof only. It does not create GitHub issues, mutate external systems, run live Codex control, mutate a GUI, publish npm, or create a GitHub Release.";
+    const issueBody = buildIssueBody({
+        parentRefs,
+        evidencePath,
+        scenarioIds,
+        blockerCodes,
+        steps,
+        expected,
+        actual,
+        proofBoundary,
+        acceptanceCriteria,
+        duplicateCheckQuery
+    });
+    const initialReport = {
+        kind: "loo_runtime_proof_issue_packet",
+        ok: false,
+        issuePacketReady: false,
+        generatedAt,
+        packetPath,
+        title,
+        labels,
+        milestone: options.milestone?.trim() || null,
+        parentRefs,
+        duplicateCheckQuery,
+        steps,
+        expected,
+        actual,
+        proofBoundary,
+        acceptanceCriteria,
+        evidencePath,
+        issueBody,
+        source: {
+            failureReportPath: redactPrivateSpans(failureReportPath),
+            claimScope,
+            scenarioIds,
+            blockerCodes,
+            inputFindings
+        },
+        redactionScan: {
+            publicSafe: true,
+            rawSecretIncluded: false,
+            rawTranscriptPathIncluded: false,
+            sqliteIncluded: false,
+            screenshotOrVideoIncluded: false,
+            findings: []
+        },
+        actionsPerformed: {
+            githubIssueCreated: false,
+            externalWrite: false,
+            liveCodexControlRun: false,
+            desktopGuiActionRun: false,
+            rawTranscriptRead: false
+        },
+        privateDataExclusions: [
+            "raw gateway output",
+            "raw Codex transcripts",
+            "raw prompts or transcript spans",
+            "absolute transcript paths",
+            "SQLite DBs",
+            "screenshots or videos",
+            "tokens, credentials, API keys, cookies",
+            "private customer data"
+        ],
+        blockers: [
+            ...(evidenceDirRejected ? ["evidence_dir_transcript_path_rejected"] : []),
+            ...(generatedAtResult.invalid ? ["invalid_generated_at"] : []),
+            ...(sourceMissing ? ["failure_report_missing"] : []),
+            ...(transcriptPathRejected ? ["failure_report_transcript_path_rejected"] : []),
+            ...(invalidJson ? ["failure_report_invalid_json"] : []),
+            ...(!sourceMissing && !transcriptPathRejected && !invalidJson && blockerCodes.length === 0 ? ["failure_report_blockers_missing"] : [])
+        ],
+        nextAction: ""
+    };
+    const outputFindings = scanTextForPrivateFindings(JSON.stringify(initialReport));
+    const redactionScan = {
+        publicSafe: outputFindings.length === 0,
+        rawSecretIncluded: outputFindings.some((finding) => finding.reason === "secret_like_value"),
+        rawTranscriptPathIncluded: outputFindings.some((finding) => finding.reason === "raw_transcript_path"),
+        sqliteIncluded: outputFindings.some((finding) => finding.reason === "sqlite_artifact"),
+        screenshotOrVideoIncluded: outputFindings.some((finding) => finding.reason === "screenshot_or_video"),
+        findings: outputFindings
+    };
+    const blockers = [
+        ...initialReport.blockers,
+        ...(redactionScan.publicSafe ? [] : ["issue_packet_redaction_failed"])
+    ];
+    const report = {
+        ...initialReport,
+        ok: blockers.length === 0,
+        issuePacketReady: blockers.length === 0,
+        redactionScan,
+        blockers,
+        nextAction: blockers.length === 0
+            ? "Review the duplicate-check query, then manually create or update the GitHub issue with this public-safe packet."
+            : "Repair the failure report input or packet redaction blockers before filing an issue."
+    };
+    const persistedReport = redactionScan.publicSafe ? report : createRedactionFailureStub(report, redactionScan, blockers);
+    if (!evidenceDirRejected)
+        writeFileSync(packetPath, `${JSON.stringify(persistedReport, null, 2)}\n`);
+    return persistedReport;
+}
+function readJsonObject(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeGeneratedAt(value) {
+    if (!value)
+        return { value: new Date().toISOString(), invalid: false };
+    const parsed = new Date(value);
+    if (!Number.isFinite(parsed.getTime()))
+        return { value: new Date().toISOString(), invalid: true };
+    const normalized = parsed.toISOString();
+    return { value: normalized, invalid: normalized !== value };
+}
+function publicEvidencePath(evidenceDir) {
+    return `local-evidence-dir:${safeCode(basename(evidenceDir) || "evidence")}`;
+}
+function safeRealpath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+function createRedactionFailureStub(report, redactionScan, blockers) {
+    return {
+        ...report,
+        ok: false,
+        issuePacketReady: false,
+        title: "Runtime proof packet redaction failed",
+        milestone: null,
+        duplicateCheckQuery: "",
+        steps: [],
+        expected: "A runtime proof issue packet must be public-safe before it is persisted.",
+        actual: "The generated packet failed its final redaction scan; unsafe fields were replaced by this minimal fail-closed stub.",
+        acceptanceCriteria: [],
+        issueBody: "",
+        source: {
+            failureReportPath: redactPrivateSpans(report.source.failureReportPath),
+            claimScope: null,
+            scenarioIds: [],
+            blockerCodes: [],
+            inputFindings: report.source.inputFindings
+        },
+        redactionScan,
+        blockers,
+        nextAction: "Repair the failure report input or packet redaction blockers before filing an issue."
+    };
+}
+function scanTextForPrivateFindings(text) {
+    return [
+        countFinding("secret_like_value", text.match(SECRET_LIKE_PATTERN)?.length ?? 0),
+        countFinding("raw_transcript_path", text.match(RAW_TRANSCRIPT_PATH_PATTERN)?.length ?? 0),
+        countFinding("sqlite_artifact", text.match(SQLITE_ARTIFACT_PATTERN)?.length ?? 0),
+        countFinding("screenshot_or_video", text.match(SCREENSHOT_PATTERN)?.length ?? 0)
+    ].filter((finding) => Boolean(finding));
+}
+function hasPrivateFinding(text, reason) {
+    return scanTextForPrivateFindings(text).some((finding) => finding.reason === reason);
+}
+function countFinding(reason, count) {
+    return count > 0 ? { reason, count } : null;
+}
+function extractBlockerCodes(report) {
+    return uniqueStrings([
+        ...stringArrayField(report, "blockers"),
+        ...stringArrayField(report, "setupBlockers"),
+        ...stringArrayField(report, "rawEvidenceBlockers"),
+        ...extractScenarioBlockers(report),
+        stringField(report, "blocker")
+    ].filter(Boolean)).map((blocker) => safePublicCode(blocker));
+}
+function extractScenarioBlockers(report) {
+    const scenarios = Array.isArray(report.scenarios) ? report.scenarios : [];
+    return scenarios.flatMap((scenario) => {
+        if (!scenario || typeof scenario !== "object" || Array.isArray(scenario))
+            return [];
+        return stringArrayField(scenario, "blockers");
+    });
+}
+function extractScenarioIds(report) {
+    const scenarios = Array.isArray(report.scenarios) ? report.scenarios : [];
+    return uniqueStrings([
+        stringField(report, "scenario_id"),
+        stringField(report, "scenarioId"),
+        stringField(report, "id"),
+        ...scenarios.flatMap((scenario) => {
+            if (!scenario || typeof scenario !== "object" || Array.isArray(scenario))
+                return [];
+            return [
+                stringField(scenario, "id"),
+                stringField(scenario, "scenario_id"),
+                stringField(scenario, "scenarioId")
+            ];
+        })
+    ].filter(Boolean)).map((id) => safePublicCode(id));
+}
+function buildDuplicateCheckQuery(title, primaryBlocker) {
+    return `repo:100yenadmin/Lossless-Codex-Orchestrator-LCO is:issue is:open "${safeQueryPhrase(primaryBlocker)}" "${safeQueryPhrase(title)}"`;
+}
+function buildIssueBody(input) {
+    return [
+        `Parent: ${input.parentRefs.join(" / ")}`,
+        "",
+        "## Summary",
+        "",
+        "A runtime proof or scenario sweep failed and has been converted into a public-safe issue handoff packet.",
+        "",
+        "## Duplicate Check",
+        "",
+        `- Query: \`${input.duplicateCheckQuery}\``,
+        "",
+        "## Evidence",
+        "",
+        `- Evidence path: \`${input.evidencePath}\``,
+        `- Scenario ids: ${input.scenarioIds.length > 0 ? input.scenarioIds.map((id) => `\`${id}\``).join(", ") : "`unknown`"}`,
+        `- Blockers: ${input.blockerCodes.length > 0 ? input.blockerCodes.map((code) => `\`${code}\``).join(", ") : "`none reported`"}`,
+        "",
+        "## Steps",
+        "",
+        ...input.steps.map((step) => `- ${step}`),
+        "",
+        "## Expected",
+        "",
+        input.expected,
+        "",
+        "## Actual",
+        "",
+        input.actual,
+        "",
+        "## Acceptance Criteria",
+        "",
+        ...input.acceptanceCriteria.map((criterion) => `- ${criterion}`),
+        "",
+        "## Proof Boundary",
+        "",
+        input.proofBoundary,
+        ""
+    ].join("\n");
+}
+function stringField(record, field) {
+    const value = record?.[field];
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function stringArrayField(record, field) {
+    const value = record[field];
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => typeof entry === "string" && Boolean(entry.trim())).map((entry) => entry.trim());
+}
+function normalizeIssueRef(value) {
+    if (!value)
+        return null;
+    const trimmed = value.trim();
+    if (/^#\d+$/.test(trimmed))
+        return trimmed;
+    if (/^\d+$/.test(trimmed))
+        return `#${trimmed}`;
+    return null;
+}
+function uniqueStrings(values) {
+    return [...new Set(values.filter(Boolean))];
+}
+function safeCode(value) {
+    return value.replace(/[^A-Za-z0-9_:#./-]/g, "_").slice(0, 180);
+}
+function safePublicCode(value) {
+    return safeCode(redactPrivateSpans(value));
+}
+function safeTitleSegment(value) {
+    return safeCode(value).replace(/_/g, " ").slice(0, 120).trim() || "runtime proof failure";
+}
+function safeQueryPhrase(value) {
+    return redactPrivateSpans(value).replace(/["`$\\]/g, "").slice(0, 140);
+}
+function redactPrivateSpans(value) {
+    return value
+        .replace(SECRET_LIKE_PATTERN, "redacted_secret_like_value")
+        .replace(RAW_TRANSCRIPT_PATH_PATTERN, "redacted_raw_transcript_path")
+        .replace(SQLITE_ARTIFACT_PATTERN, "redacted_sqlite_artifact")
+        .replace(SCREENSHOT_PATTERN, "redacted_media_artifact");
+}