oh-my-super-agent 0.1.0

package/dist/src/verification/result-gate.js

@@ -0,0 +1,731 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { readOmsConfig } from "../config.js";
+import { deriveWorktreeId } from "../dispatch/authority.js";
+import { readGoal } from "../goals/authority.js";
+import { discloseLiveContact, readLiveDeliveryAuthorization } from "../live/contact-journal.js";
+import { selectGrader } from "../providers/grading.js";
+import { createClaudeStructuredRoleTransport, } from "../providers/claude-structured.js";
+import { runCodexStructured } from "../providers/codex-exec.js";
+import { runProcess } from "../providers/process.js";
+import { canonicalTimestamp } from "../queue/model.js";
+import { recordFailureReflection } from "../reflections/store.js";
+import { acquireDirectoryLock } from "../runtime/lock.js";
+import { createStableId } from "../runtime/stable-id.js";
+import { recordTrustRun } from "../trust/runs.js";
+import { readJsonFileNoFollow, validateExistingDirectory, } from "../utils/fs.js";
+import { createRuntimeWorkerAuthorities } from "../workers/runtime.js";
+import { parseTicketWorktreeRecord } from "../worktrees/manager.js";
+import { createProtectedVerificationAuthority, } from "./authority.js";
+import { createResultGateStore, } from "./result-gate-store.js";
+const MAX_GATE_STEPS = 12;
+const MAX_DIFF_BYTES = 256 * 1024;
+const RESULT_GATE_SERVICES = new WeakSet();
+export function createResultGateService(options) {
+    const packageRoot = validateExistingDirectory(options.packageRoot, "result-gate package root");
+    const configRoot = validateExistingDirectory(options.configRoot ?? packageRoot, "result-gate configuration root");
+    const workspaceRoot = validateExistingDirectory(options.workspaceRoot, "result-gate workspace root");
+    const stateRoot = validateExistingDirectory(options.stateRoot, "result-gate state root");
+    const clock = options.clock ?? (() => new Date().toISOString());
+    const env = options.env ?? globalThis.process.env;
+    const runtime = options.runtime ?? createRuntimeWorkerAuthorities({
+        packageRoot,
+        configRoot,
+        workspaceRoot,
+        stateRoot,
+        actorId: "oms-conductor",
+        clock,
+    });
+    const verification = options.verification ?? createProtectedVerificationAuthority({
+        packageRoot,
+        configRoot,
+        evidenceStore: runtime.tickets.evidenceStore,
+    });
+    const claudeStructured = options.claudeStructured ?? createClaudeStructuredRoleTransport({
+        packageRoot,
+        configRoot,
+        workspaceRoot,
+        stateRoot,
+        executablePath: options.executablePath,
+        env,
+        clock,
+    });
+    const codexStructured = options.codexStructured ?? runCodexStructured;
+    const gitRunner = options.gitRunner ?? runProcess;
+    const gates = createResultGateStore({ packageRoot, stateRoot });
+    const nextGateTimestamp = (gate) => nextTimestamp(gate.payload.updated_at, clock);
+    function process(dispatchId) {
+        const dispatch = runtime.dispatch.read(dispatchId);
+        const gateId = gateIdForDispatch(dispatch);
+        const lock = acquireDirectoryLock({
+            locksRoot: join(stateRoot, "locks"),
+            lockId: createStableId("rgate-lock", gateId),
+            ownerId: "oms-system",
+            note: gateId,
+        });
+        try {
+            let gate = gates.readIfExists(gateId) ?? createGate(dispatch, gateId);
+            for (let step = 0; step < MAX_GATE_STEPS; step += 1) {
+                if (gate.state === "finalized" || gate.state === "blocked")
+                    return progress(gate);
+                if (gate.state === "checking")
+                    gate = check(gate);
+                else if (gate.state === "checked" || gate.state === "grading") {
+                    const advanced = grade(gate);
+                    gate = advanced.gate;
+                    if (advanced.waiting)
+                        return progress(gate);
+                }
+                else {
+                    const advanced = decide(gate);
+                    gate = advanced.gate;
+                    if (advanced.waiting)
+                        return progress(gate);
+                }
+            }
+            return progress(block(gate, "result gate exceeded its bounded transition budget"));
+        }
+        finally {
+            lock.release();
+        }
+    }
+    function createGate(dispatch, gateId) {
+        const subject = captureSubject(dispatch);
+        return gates.create(gateId, subject, nextTimestamp(runtime.tickets.lifecycle.read(subject.ticket_id).payload.lifecycle_updated_at, clock));
+    }
+    function captureSubject(dispatch) {
+        const result = dispatch.payload.result;
+        if (dispatch.state !== "resolved"
+            || dispatch.payload.resolution !== "done"
+            || result?.status !== "done"
+            || dispatch.payload.executor_evidence === null)
+            throw new Error("result gate requires one resolved successful dispatch result");
+        const goal = readGoal(runtime.goals.authority, dispatch.payload.goal_id);
+        const ticket = runtime.tickets.lifecycle.read(dispatch.payload.ticket_id);
+        const worker = runtime.workers.read(dispatch.record_id);
+        const session = runtime.sessions.read(dispatch.payload.session_id);
+        const worktree = parseTicketWorktreeRecord(readJsonFileNoFollow(join(stateRoot, "worktree-records", `${dispatch.payload.ticket_id}.json`), 64 * 1024), "result-gate worktree record");
+        if (goal.state !== "active"
+            || goal.version !== dispatch.payload.goal_version
+            || goal.payload.repository_scope !== workspaceRoot
+            || result.goal_id !== goal.record_id
+            || result.goal_version !== goal.version
+            || ticket.state !== "verifying"
+            || ticket.attempt !== dispatch.payload.attempt
+            || ticket.actor !== dispatch.payload.worker_id
+            || ticket.lease_token === null
+            || String(ticket.lease_token) !== dispatch.payload.lease_token
+            || ticket.payload.session_id !== dispatch.payload.session_id
+            || !sameEvidenceReference(ticket.payload.executor_evidence, dispatch.payload.executor_evidence)
+            || ticket.payload.verification_plan_ref === null
+            || ticket.payload.gate_digest !== verification.planDigest
+            || ticket.payload.policy_version !== verification.policyVersion
+            || ticket.payload.policy_digest !== verification.policyDigest
+            || worker.state !== "done"
+            || worker.payload.session_id !== dispatch.payload.session_id
+            || worker.payload.ticket_id !== dispatch.payload.ticket_id
+            || session.payload.ticket_id !== dispatch.payload.ticket_id
+            || session.payload.role_id !== dispatch.payload.role_id
+            || session.payload.engine !== dispatch.payload.engine
+            || session.payload.native_session_ref !== dispatch.payload.session_id
+            || worktree.ticket_id !== dispatch.payload.ticket_id
+            || worktree.repository_root !== workspaceRoot
+            || worktree.worktree_root !== dispatch.payload.worktree_path
+            || worktree.branch !== dispatch.payload.worktree_branch
+            || worktree.base_commit !== dispatch.payload.worktree_base_commit
+            || deriveWorktreeId(worktree) !== dispatch.payload.worktree_id)
+            throw new Error("result gate subject no longer matches goal, ticket, session, worker, or worktree authority");
+        const plan = runtime.tickets.evidenceStore.read(ticket.payload.verification_plan_ref);
+        if (plan.evidence_kind !== "verification-plan"
+            || plan.ticket_id !== ticket.record_id
+            || plan.payload.digest !== verification.planDigest)
+            throw new Error("result gate verification plan binding changed");
+        return Object.freeze({
+            goal_id: goal.record_id,
+            goal_version: goal.version,
+            dispatch_id: dispatch.record_id,
+            dispatch_version: dispatch.version,
+            ticket_id: ticket.record_id,
+            verifying_ticket_version: ticket.version,
+            attempt: ticket.attempt,
+            max_attempts: ticket.max_attempts,
+            lease_token: dispatch.payload.lease_token,
+            worker_record_id: dispatch.payload.worker_record_id,
+            worker_id: dispatch.payload.worker_id,
+            session_id: dispatch.payload.session_id,
+            executor_role: dispatch.payload.role_id,
+            executor_engine: dispatch.payload.engine,
+            worktree_id: dispatch.payload.worktree_id,
+            worktree_root: dispatch.payload.worktree_path,
+            worktree_branch: dispatch.payload.worktree_branch,
+            worktree_base_commit: dispatch.payload.worktree_base_commit,
+            expected_commit: result.worktree_commit,
+            policy_version: verification.policyVersion,
+            policy_digest: verification.policyDigest,
+            plan_digest: verification.planDigest,
+            verification_plan_ref: ticket.payload.verification_plan_ref,
+            executor_evidence: dispatch.payload.executor_evidence,
+        });
+    }
+    function check(gate) {
+        try {
+            const result = verification.verify(gate.payload.subject);
+            return gates.transition({
+                record: gate,
+                step: "checked",
+                toState: "checked",
+                at: nextGateTimestamp(gate),
+                update: (payload) => ({ ...payload, deterministic_evidence: result.ref }),
+            });
+        }
+        catch (error) {
+            return block(gate, boundedReason(error));
+        }
+    }
+    function grade(gate) {
+        let current = gate;
+        try {
+            verification.verify(current.payload.subject);
+            if (current.payload.deterministic_evidence === null)
+                throw new Error("grade requires deterministic evidence");
+            if (current.payload.grade_request === null) {
+                const request = gradeRequest(current);
+                current = gates.transition({
+                    record: current,
+                    step: "grade-prepared",
+                    toState: "grading",
+                    at: nextGateTimestamp(current),
+                    update: (payload) => ({ ...payload, grade_request: request }),
+                });
+            }
+            const request = current.payload.grade_request;
+            if (!request)
+                throw new Error("grade request disappeared");
+            discloseRoleRequest(current, request, "opposite-engine-grade");
+            const output = request.engine === "codex"
+                ? advanceCodexGrade(current, request)
+                : advanceClaudeRequest(current, request);
+            current = output.gate;
+            if (output.waiting)
+                return { gate: current, waiting: true };
+            if (!output.value)
+                throw new Error("grader completed without schema output");
+            if (!output.source)
+                throw new Error("grader completed without a protected fresh-provider source");
+            const gradeEvidence = writeGrade(current, request, output.value, output.submittedAt, output.source);
+            current = gates.transition({
+                record: current,
+                step: "grade-recorded",
+                toState: "graded",
+                at: nextGateTimestamp(current),
+                update: (payload) => ({ ...payload, grade_evidence: gradeEvidence }),
+            });
+            return { gate: current, waiting: false };
+        }
+        catch (error) {
+            return { gate: block(gates.read(current.record_id), boundedReason(error)), waiting: false };
+        }
+    }
+    function gradeRequest(gate) {
+        const dispatch = runtime.dispatch.read(gate.payload.subject.dispatch_id);
+        const config = readOmsConfig(configRoot);
+        const role = selectGrader(config, dispatch.payload.role_id);
+        const deterministicEvidence = gate.payload.deterministic_evidence;
+        if (deterministicEvidence === null)
+            throw new Error("grade request lacks deterministic evidence");
+        const input = Object.freeze({
+            schema_version: 1,
+            ticket_id: dispatch.payload.ticket_id,
+            goal_id: dispatch.payload.goal_id,
+            dispatch_id: dispatch.record_id,
+            attempt: dispatch.payload.attempt,
+            lease_token: dispatch.payload.lease_token,
+            executor_engine: dispatch.payload.engine,
+            grader_engine: role.engine,
+            task_body: dispatch.payload.task_body,
+            acceptance_criteria: [...dispatch.payload.acceptance_criteria],
+            deterministic_evidence: deterministicEvidence,
+            deterministic_check: runtime.tickets.evidenceStore.read(deterministicEvidence).payload,
+            diff: readProtectedDiff(gate.payload.subject, env, gitRunner),
+        });
+        return Object.freeze({
+            request_id: createStableId("grade-request", deterministicEvidence.evidence_id, deterministicEvidence.sha256),
+            role_id: role.role_id,
+            engine: role.engine,
+            evidence_schema: "grader-output.v1",
+            input,
+            started_at: null,
+            session_id: null,
+        });
+    }
+    function advanceCodexGrade(gate, request) {
+        const outputPath = join(stateRoot, "codex-structured-results", `${request.request_id}.final.json`);
+        if (existsSync(outputPath)) {
+            throw new Error("Codex grade output exists without an in-process fresh-provider receipt; duplicate launch is forbidden");
+        }
+        if (request.started_at !== null) {
+            throw new Error("Codex grade invocation is ambiguous after restart; same-engine fallback and duplicate launch are forbidden");
+        }
+        const startedAt = nextGateTimestamp(gate);
+        const started = gates.transition({
+            record: gate,
+            step: "grade-codex-started",
+            toState: "grading",
+            at: startedAt,
+            update: (payload) => ({
+                ...payload,
+                grade_request: { ...request, started_at: startedAt, session_id: request.request_id },
+            }),
+        });
+        let result;
+        try {
+            result = codexStructured({
+                config: readOmsConfig(configRoot),
+                roleId: "oms.grader.codex",
+                prompt: gradePrompt(request.input),
+                requestId: request.request_id,
+                cwd: gate.payload.subject.worktree_root,
+                temporaryRoot: join(stateRoot, "codex-structured-results"),
+                packageRoot,
+                env,
+            });
+        }
+        catch (error) {
+            if (existsSync(outputPath)) {
+                throw new Error("Codex grade ended ambiguously after creating output; duplicate launch is forbidden");
+            }
+            throw error;
+        }
+        return {
+            gate: started,
+            waiting: false,
+            value: result.value,
+            submittedAt: nextGateTimestamp(started),
+            source: { engine: "codex", result },
+        };
+    }
+    function advanceClaudeRequest(gate, request) {
+        let current = gate;
+        if (request.role_id !== "oms.grader.claude" && request.role_id !== "oms.bounded-dreamer") {
+            throw new Error("Claude structured request has an ineligible role");
+        }
+        if (request.started_at === null) {
+            const prepared = claudeStructured.prepare({
+                requestId: request.request_id,
+                roleId: request.role_id,
+                evidenceSchema: request.evidence_schema,
+                input: request.input,
+            });
+            const startedAt = nextGateTimestamp(current);
+            current = gates.transition({
+                record: current,
+                step: `${request.evidence_schema}-claude-started`,
+                toState: current.state,
+                at: startedAt,
+                update: (payload) => updateRoleRequest(payload, request, {
+                    ...request,
+                    started_at: startedAt,
+                    session_id: prepared.request.claude_session_id,
+                }),
+            });
+            const progress = claudeStructured.advance(prepared);
+            if (progress.status === "blocked")
+                throw new Error(progress.reason);
+            if (progress.status !== "complete")
+                return { gate: current, waiting: true, submittedAt: startedAt };
+            return {
+                gate: current,
+                waiting: false,
+                value: progress.result.result,
+                submittedAt: progress.result.submitted_at,
+                ...(request.role_id === "oms.grader.claude"
+                    ? { source: { engine: "claude", result: progress.result } }
+                    : {}),
+            };
+        }
+        const progress = claudeStructured.read(request.request_id);
+        if (progress.status === "blocked")
+            throw new Error(progress.reason);
+        if (progress.status !== "complete")
+            return { gate: current, waiting: true, submittedAt: nextGateTimestamp(current) };
+        if (request.session_id !== progress.result.claude_session_id) {
+            throw new Error("Claude structured result changed its fresh session binding");
+        }
+        return {
+            gate: current,
+            waiting: false,
+            value: progress.result.result,
+            submittedAt: progress.result.submitted_at,
+            ...(request.role_id === "oms.grader.claude"
+                ? { source: { engine: "claude", result: progress.result } }
+                : {}),
+        };
+    }
+    function writeGrade(gate, request, value, createdAt, source) {
+        const deterministicEvidence = gate.payload.deterministic_evidence;
+        if (deterministicEvidence === null)
+            throw new Error("grade evidence lacks deterministic evidence");
+        if (!sameEvidenceReference(value.deterministic_evidence, deterministicEvidence)) {
+            throw new Error("grader returned another deterministic evidence reference");
+        }
+        const written = verification.writeGrade({
+            schema_version: 1,
+            evidence_id: createStableId("grade", deterministicEvidence.evidence_id, request.request_id),
+            evidence_kind: "grader-output",
+            ticket_id: gate.payload.subject.ticket_id,
+            producer_role: request.role_id,
+            created_at: canonicalTimestamp(createdAt, "grade evidence timestamp"),
+            payload: value,
+        }, source);
+        return written.ref;
+    }
+    function decide(gate) {
+        let current = gate;
+        try {
+            verification.verify(current.payload.subject);
+            const deterministic = requiredEvidence(current.payload.deterministic_evidence, "deterministic");
+            const gradeEvidence = requiredEvidence(current.payload.grade_evidence, "grade");
+            const check = runtime.tickets.evidenceStore.read(deterministic);
+            const gradeRecord = runtime.tickets.evidenceStore.read(gradeEvidence);
+            if (check.payload.passed === true && gradeRecord.payload.verdict === "pass") {
+                return { gate: complete(current, deterministic, gradeEvidence), waiting: false };
+            }
+            if (current.payload.reflection_request === null) {
+                const failureEvidence = check.payload.passed === true ? gradeEvidence : deterministic;
+                const request = reflectionRequest(current, failureEvidence, check, gradeRecord);
+                current = gates.transition({
+                    record: current,
+                    step: "reflection-prepared",
+                    toState: "reflecting",
+                    at: nextGateTimestamp(current),
+                    update: (payload) => ({ ...payload, reflection_request: request }),
+                });
+            }
+            const request = current.payload.reflection_request;
+            if (!request)
+                throw new Error("reflection request disappeared");
+            discloseRoleRequest(current, request, "bounded-reflection");
+            const reflected = advanceClaudeRequest(current, request);
+            current = reflected.gate;
+            if (reflected.waiting)
+                return { gate: current, waiting: true };
+            if (!reflected.value)
+                throw new Error("reflection completed without schema output");
+            return { gate: failAttempt(current, reflected.value), waiting: false };
+        }
+        catch (error) {
+            return { gate: block(gates.read(current.record_id), boundedReason(error)), waiting: false };
+        }
+    }
+    function reflectionRequest(gate, failureEvidence, deterministic, grade) {
+        return Object.freeze({
+            request_id: createStableId("dream-request", failureEvidence.evidence_id, failureEvidence.sha256),
+            role_id: "oms.bounded-dreamer",
+            engine: "claude",
+            evidence_schema: "reflection.v1",
+            input: Object.freeze({
+                schema_version: 1,
+                ticket_id: gate.payload.subject.ticket_id,
+                attempt: gate.payload.subject.attempt,
+                failure_evidence: failureEvidence,
+                deterministic_evidence: gate.payload.deterministic_evidence,
+                deterministic_check: deterministic.payload,
+                grade_evidence: gate.payload.grade_evidence,
+                grade: grade.payload,
+            }),
+            started_at: null,
+            session_id: null,
+        });
+    }
+    function complete(gate, deterministicEvidence, gradeEvidence) {
+        let ticket = runtime.tickets.lifecycle.read(gate.payload.subject.ticket_id);
+        if (ticket.state === "verifying") {
+            ticket = runtime.tickets.lifecycle.complete({
+                ticketId: ticket.record_id,
+                operationId: createStableId("gate-complete", gate.record_id),
+                ownerId: gate.payload.subject.worker_id,
+                expectedVersion: ticket.version,
+                expectedAttempt: ticket.attempt,
+                expectedActor: ticket.actor,
+                expectedLeaseToken: ticket.lease_token,
+                at: nextTimestamp(ticket.payload.lifecycle_updated_at, clock),
+                verificationEvidence: deterministicEvidence,
+                gradeEvidence,
+            }).record;
+        }
+        if (ticket.state !== "completed")
+            throw new Error(`passing result gate found ticket in ${ticket.state}`);
+        const trust = recordTrustRun({
+            evidenceStore: runtime.tickets.evidenceStore,
+            deterministicEvidence,
+            ticketMaterializer: runtime.tickets.materializer,
+        });
+        return gates.transition({
+            record: gate,
+            step: "final-completed",
+            toState: "finalized",
+            at: nextGateTimestamp(gate),
+            update: (payload) => ({ ...payload, outcome: "completed", trust_evidence: trust.ref }),
+        });
+    }
+    function failAttempt(gate, advice) {
+        const deterministicEvidence = requiredEvidence(gate.payload.deterministic_evidence, "deterministic");
+        const gradeEvidence = requiredEvidence(gate.payload.grade_evidence, "grade");
+        const deterministic = runtime.tickets.evidenceStore.read(deterministicEvidence);
+        const failureEvidence = deterministic.payload.passed === true ? gradeEvidence : deterministicEvidence;
+        let ticket = runtime.tickets.lifecycle.read(gate.payload.subject.ticket_id);
+        if (ticket.state === "verifying") {
+            ticket = runtime.tickets.lifecycle.failAttempt({
+                ticketId: ticket.record_id,
+                operationId: createStableId("gate-fail", gate.record_id),
+                ownerId: gate.payload.subject.worker_id,
+                expectedVersion: ticket.version,
+                expectedAttempt: ticket.attempt,
+                expectedActor: ticket.actor,
+                expectedLeaseToken: ticket.lease_token,
+                at: nextTimestamp(ticket.payload.lifecycle_updated_at, clock),
+                error: deterministic.payload.passed === true
+                    ? "fresh opposite-engine grader rejected the attempt"
+                    : `deterministic verification failed at ${String(deterministic.payload.failed_step ?? "unknown")}`,
+                executorEvidence: gate.payload.subject.executor_evidence,
+                verificationEvidence: deterministicEvidence,
+                gradeEvidence,
+                failureEvidence,
+            }).record;
+        }
+        if (ticket.state !== "retryable" && ticket.state !== "blocked") {
+            throw new Error(`failed result gate found ticket in ${ticket.state}`);
+        }
+        const reflection = recordFailureReflection({
+            evidenceStore: runtime.tickets.evidenceStore,
+            failureEvidence,
+            ticketMaterializer: runtime.tickets.materializer,
+            advice: {
+                failure: String(advice.failure),
+                lesson: String(advice.lesson),
+                next_attempt: String(advice.next_attempt),
+            },
+        });
+        if (ticket.state === "retryable" && !sameEvidenceReference(ticket.payload.prior_reflection_evidence, reflection.ref)) {
+            ticket = runtime.tickets.lifecycle.attachRetryReflection({
+                ticketId: ticket.record_id,
+                operationId: createStableId("gate-reflect", gate.record_id),
+                ownerId: "oms-system",
+                expectedVersion: ticket.version,
+                expectedAttempt: ticket.attempt,
+                expectedActor: ticket.actor,
+                expectedLeaseToken: ticket.lease_token,
+                at: nextTimestamp(ticket.payload.lifecycle_updated_at, clock),
+                reflectionEvidence: reflection.ref,
+            }).record;
+        }
+        const trust = deterministic.payload.passed === false
+            ? recordTrustRun({
+                evidenceStore: runtime.tickets.evidenceStore,
+                deterministicEvidence,
+                ticketMaterializer: runtime.tickets.materializer,
+            })
+            : undefined;
+        return gates.transition({
+            record: gate,
+            step: `final-${ticket.state}`,
+            toState: "finalized",
+            at: nextGateTimestamp(gate),
+            update: (payload) => ({
+                ...payload,
+                reflection_evidence: reflection.ref,
+                trust_evidence: trust?.ref ?? payload.trust_evidence,
+                outcome: ticket.state,
+            }),
+        });
+    }
+    function block(gate, rawReason) {
+        if (gate.state === "blocked")
+            return gate;
+        const reason = boundedReason(rawReason);
+        let ticket = runtime.tickets.lifecycle.read(gate.payload.subject.ticket_id);
+        if (ticket.state === "verifying") {
+            ticket = runtime.tickets.lifecycle.blockVerification({
+                ticketId: ticket.record_id,
+                operationId: createStableId("gate-block", gate.record_id, reason),
+                ownerId: "oms-system",
+                expectedVersion: ticket.version,
+                expectedAttempt: ticket.attempt,
+                expectedActor: ticket.actor,
+                expectedLeaseToken: ticket.lease_token,
+                at: nextTimestamp(ticket.payload.lifecycle_updated_at, clock),
+                error: reason,
+                ...(gate.payload.deterministic_evidence ? { verificationEvidence: gate.payload.deterministic_evidence } : {}),
+                ...(gate.payload.grade_evidence ? { gradeEvidence: gate.payload.grade_evidence } : {}),
+            }).record;
+        }
+        else if (ticket.state !== "blocked") {
+            throw new Error(`cannot block result gate after ticket reached ${ticket.state}`);
+        }
+        const deterministic = gate.payload.deterministic_evidence === null
+            ? undefined
+            : runtime.tickets.evidenceStore.read(gate.payload.deterministic_evidence);
+        const trust = deterministic?.payload.passed === false
+            ? recordTrustRun({
+                evidenceStore: runtime.tickets.evidenceStore,
+                deterministicEvidence: gate.payload.deterministic_evidence,
+                ticketMaterializer: runtime.tickets.materializer,
+            })
+            : undefined;
+        return gates.transition({
+            record: gate,
+            step: "final-blocked",
+            toState: "blocked",
+            at: nextGateTimestamp(gate),
+            update: (payload) => ({
+                ...payload,
+                outcome: "blocked",
+                blocked_reason: reason,
+                trust_evidence: trust?.ref ?? payload.trust_evidence,
+            }),
+        });
+    }
+    function progress(gate) {
+        const ticket = runtime.tickets.lifecycle.read(gate.payload.subject.ticket_id);
+        const status = gate.state === "blocked"
+            ? "blocked"
+            : gate.state === "finalized"
+                ? gate.payload.outcome
+                : gate.state === "grading" || gate.state === "reflecting"
+                    ? "waiting"
+                    : "checking";
+        return Object.freeze({
+            status,
+            gate_id: gate.record_id,
+            gate_state: gate.state,
+            ticket_id: ticket.record_id,
+            ticket_state: ticket.state,
+            deterministic_evidence: gate.payload.deterministic_evidence,
+            grade_evidence: gate.payload.grade_evidence,
+            reflection_evidence: gate.payload.reflection_evidence,
+            trust_evidence: gate.payload.trust_evidence,
+            reason: gate.payload.blocked_reason,
+        });
+    }
+    function discloseRoleRequest(gate, request, operation) {
+        const ticket = runtime.tickets.lifecycle.read(gate.payload.subject.ticket_id);
+        if (ticket.payload.source !== "github")
+            return;
+        const content = runtime.tickets.materializer.readContent({
+            ticket_id: ticket.record_id,
+            sha256: ticket.payload.content_sha256,
+            file_name: ticket.payload.content_file,
+        });
+        if (content.repository === null)
+            throw new Error("GitHub result gate ticket lacks its repository");
+        const authorization = readLiveDeliveryAuthorization(stateRoot);
+        if (!authorization || authorization.repository !== content.repository.toLowerCase()) {
+            throw new Error("provider role contact lacks matching human-started live authorization");
+        }
+        discloseLiveContact({
+            stateRoot,
+            authorization,
+            operation,
+            contactSurface: request.engine === "codex" ? "codex-exec" : "claude-interactive",
+            subjectId: request.request_id,
+            request: {
+                request_id: request.request_id,
+                role_id: request.role_id,
+                engine: request.engine,
+                evidence_schema: request.evidence_schema,
+                input: request.input,
+            },
+            disclosedAt: gate.payload.updated_at,
+        });
+    }
+    const serviceValue = {
+        process,
+        read(dispatchId) {
+            const dispatch = runtime.dispatch.read(dispatchId);
+            const gate = gates.readIfExists(gateIdForDispatch(dispatch));
+            return gate ? progress(gate) : undefined;
+        },
+        list() {
+            return Object.freeze(gates.list().map(progress));
+        },
+    };
+    const service = Object.freeze(serviceValue);
+    RESULT_GATE_SERVICES.add(service);
+    return service;
+}
+function gateIdForDispatch(dispatch) {
+    const result = dispatch.payload.result;
+    if (!result)
+        throw new Error("dispatch has no result receipt");
+    return createStableId("rgate", dispatch.record_id, result.operation_nonce);
+}
+function updateRoleRequest(payload, current, next) {
+    return current.evidence_schema === "grader-output.v1"
+        ? { ...payload, grade_request: next }
+        : { ...payload, reflection_request: next };
+}
+function gradePrompt(input) {
+    return [
+        "Act as the fresh read-only OMS cross-engine grader.",
+        "Use the raw deterministic evidence and diff below. A failed deterministic check is final.",
+        "Return only the configured grader-output schema and repeat the exact deterministic_evidence reference.",
+        JSON.stringify(input),
+    ].join("\n\n");
+}
+function readProtectedDiff(subject, sourceEnv, runner) {
+    const result = runner({
+        command: "git",
+        args: [
+            "-c", "core.attributesfile=/dev/null",
+            "diff", "--no-ext-diff", "--no-textconv", "--unified=80",
+            subject.worktree_base_commit, subject.expected_commit, "--", ".",
+        ],
+        cwd: subject.worktree_root,
+        env: protectedGitEnvironment(sourceEnv),
+        timeoutMs: 30_000,
+        maxBufferBytes: MAX_DIFF_BYTES,
+    });
+    if (result.error || result.status !== 0 || result.signal !== null) {
+        throw new Error("protected grader diff could not be captured");
+    }
+    return Object.freeze({
+        base_commit: subject.worktree_base_commit,
+        head_commit: subject.expected_commit,
+        patch: result.stdout,
+    });
+}
+function protectedGitEnvironment(source) {
+    const env = {};
+    for (const key of ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "LANG", "LC_ALL", "SYSTEMROOT"]) {
+        if (source[key] !== undefined)
+            env[key] = source[key];
+    }
+    env.GIT_TERMINAL_PROMPT = "0";
+    env.GIT_CONFIG_NOSYSTEM = "1";
+    env.GIT_CONFIG_GLOBAL = "/dev/null";
+    return env;
+}
+function requiredEvidence(reference, label) {
+    if (reference === null)
+        throw new Error(`result gate lacks ${label} evidence`);
+    return reference;
+}
+function sameEvidenceReference(left, right) {
+    return left !== null
+        && left !== undefined
+        && right !== null
+        && right !== undefined
+        && left.evidence_id === right.evidence_id
+        && left.sha256 === right.sha256
+        && left.file_name === right.file_name;
+}
+function nextTimestamp(after, clock) {
+    const floor = Date.parse(canonicalTimestamp(after, "previous timestamp"));
+    const sampled = Date.parse(canonicalTimestamp(clock(), "result-gate timestamp"));
+    return new Date(Math.max(sampled, floor + 1)).toISOString();
+}
+function boundedReason(error) {
+    const value = error instanceof Error ? error.message : String(error);
+    return (value.trim().replace(/[\0\r\n]+/gu, " ") || "result gate blocked").slice(0, 2048);
+}
+//# sourceMappingURL=result-gate.js.map