oxe-cc 0.9.3 → 1.2.1

package/lib/runtime/delivery/promotion-pipeline.d.ts

@@ -0,0 +1,39 @@
+import type { PRManager } from './pr-manager';
+import type { BranchManager } from './branch-manager';
+import type { VerificationManifest, ResidualRiskLedger } from '../verification/verification-manifest';
+import type { RunResult } from '../scheduler/scheduler';
+export interface RunPRLink {
+    run_id: string;
+    branch: string;
+    pr_url: string | null;
+    pr_number: number | null;
+    status: 'pending' | 'open' | 'merged' | 'closed' | 'blocked';
+    created_at: string;
+    merged_at: string | null;
+}
+export interface PromotionOptions {
+    baseBranch?: string;
+    draftPR?: boolean;
+    autoMerge?: boolean;
+    mergeMethod?: 'merge' | 'squash' | 'rebase';
+}
+export type MergeGateVerdict = 'approved' | 'blocked' | 'needs_review';
+export interface MergeGateReport {
+    verdict: MergeGateVerdict;
+    reasons: string[];
+    blocking_risks: string[];
+}
+export declare class MergeGateEvaluator {
+    evaluate(runResult: RunResult, manifest: VerificationManifest | null, riskLedger: ResidualRiskLedger | null): MergeGateReport;
+}
+export declare class PromotionPipeline {
+    private readonly projectRoot;
+    private readonly branchManager;
+    private readonly prManager;
+    private readonly gateEvaluator;
+    constructor(projectRoot: string, branchManager: BranchManager, prManager: PRManager, gateEvaluator?: MergeGateEvaluator);
+    buildPRBody(runResult: RunResult, manifest: VerificationManifest | null, riskLedger: ResidualRiskLedger | null): string;
+    promote(runResult: RunResult, manifest: VerificationManifest | null, riskLedger: ResidualRiskLedger | null, opts?: PromotionOptions): Promise<RunPRLink>;
+    savePRLink(runId: string, link: RunPRLink): void;
+    loadPRLink(runId: string): RunPRLink | null;
+}

package/lib/runtime/delivery/promotion-pipeline.js

@@ -0,0 +1,127 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PromotionPipeline = exports.MergeGateEvaluator = void 0;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+class MergeGateEvaluator {
+    evaluate(runResult, manifest, riskLedger) {
+        const reasons = [];
+        const blockingRisks = [];
+        if (runResult.failed.length > 0) {
+            reasons.push(`${runResult.failed.length} task(s) failed: ${runResult.failed.join(', ')}`);
+        }
+        if (runResult.blocked.length > 0) {
+            reasons.push(`${runResult.blocked.length} task(s) blocked: ${runResult.blocked.join(', ')}`);
+        }
+        if (manifest && !manifest.summary.all_passed) {
+            reasons.push(`Verification: ${manifest.summary.fail} check(s) failed, ${manifest.summary.error} error(s)`);
+        }
+        if (riskLedger) {
+            const critical = riskLedger.risks.filter((r) => r.severity === 'critical' || r.severity === 'high');
+            for (const risk of critical) {
+                blockingRisks.push(`[${risk.severity.toUpperCase()}] ${risk.description}`);
+            }
+        }
+        const hasBlockers = reasons.length > 0 || blockingRisks.length > 0;
+        const verdict = hasBlockers ? 'blocked' : 'approved';
+        return { verdict, reasons, blocking_risks: blockingRisks };
+    }
+}
+exports.MergeGateEvaluator = MergeGateEvaluator;
+class PromotionPipeline {
+    constructor(projectRoot, branchManager, prManager, gateEvaluator = new MergeGateEvaluator()) {
+        this.projectRoot = projectRoot;
+        this.branchManager = branchManager;
+        this.prManager = prManager;
+        this.gateEvaluator = gateEvaluator;
+    }
+    buildPRBody(runResult, manifest, riskLedger) {
+        const lines = [];
+        lines.push('## OXE Run Summary');
+        lines.push('');
+        lines.push(`**Run ID:** \`${runResult.run_id}\``);
+        lines.push(`**Status:** ${runResult.status}`);
+        lines.push(`**Completed:** ${runResult.completed.length} tasks`);
+        if (runResult.failed.length > 0) {
+            lines.push(`**Failed:** ${runResult.failed.join(', ')}`);
+        }
+        if (runResult.blocked.length > 0) {
+            lines.push(`**Blocked:** ${runResult.blocked.join(', ')}`);
+        }
+        if (manifest) {
+            lines.push('');
+            lines.push('## Verification');
+            lines.push(`- Total: ${manifest.summary.total}`);
+            lines.push(`- Pass: ${manifest.summary.pass}`);
+            lines.push(`- Fail: ${manifest.summary.fail}`);
+            lines.push(`- Skip: ${manifest.summary.skip}`);
+        }
+        if (riskLedger && riskLedger.risks.length > 0) {
+            lines.push('');
+            lines.push('## Residual Risks');
+            for (const risk of riskLedger.risks) {
+                lines.push(`- [${risk.severity.toUpperCase()}] ${risk.description}`);
+                if (risk.mitigation)
+                    lines.push(`  - Mitigation: ${risk.mitigation}`);
+            }
+        }
+        lines.push('');
+        lines.push('---');
+        lines.push('*Generated by OXE Runtime*');
+        return lines.join('\n');
+    }
+    async promote(runResult, manifest, riskLedger, opts = {}) {
+        const gateReport = this.gateEvaluator.evaluate(runResult, manifest, riskLedger);
+        const link = {
+            run_id: runResult.run_id,
+            branch: this.branchManager.currentBranch(),
+            pr_url: null,
+            pr_number: null,
+            status: 'pending',
+            created_at: new Date().toISOString(),
+            merged_at: null,
+        };
+        if (gateReport.verdict === 'blocked') {
+            link.status = 'blocked';
+            this.savePRLink(runResult.run_id, link);
+            return link;
+        }
+        const body = this.buildPRBody(runResult, manifest, riskLedger);
+        const title = `oxe: run ${runResult.run_id} — ${runResult.completed.length} tasks`;
+        const prResult = this.prManager.createDraft({
+            title,
+            body,
+            base: opts.baseBranch ?? 'main',
+            draft: opts.draftPR !== false,
+        });
+        if (!prResult.success || !prResult.url) {
+            link.status = 'blocked';
+            this.savePRLink(runResult.run_id, link);
+            return link;
+        }
+        link.pr_url = prResult.url;
+        link.status = 'open';
+        this.savePRLink(runResult.run_id, link);
+        return link;
+    }
+    savePRLink(runId, link) {
+        const p = path_1.default.join(this.projectRoot, '.oxe', 'runs', runId, 'pr-link.json');
+        fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
+        fs_1.default.writeFileSync(p, JSON.stringify(link, null, 2), 'utf8');
+    }
+    loadPRLink(runId) {
+        const p = path_1.default.join(this.projectRoot, '.oxe', 'runs', runId, 'pr-link.json');
+        if (!fs_1.default.existsSync(p))
+            return null;
+        try {
+            return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.PromotionPipeline = PromotionPipeline;

package/lib/runtime/events/bus.d.ts

@@ -0,0 +1,9 @@
+import type { OxeEvent } from './envelope';
+import type { EventType } from './catalog';
+export type EventInput = Partial<Omit<OxeEvent, 'type'>> & {
+    type: EventType;
+};
+export declare function appendEvent(projectRoot: string, sessionId: string | null, input: EventInput, causationId?: string): OxeEvent;
+export declare function readEvents(projectRoot: string, sessionId: string | null): OxeEvent[];
+export declare function filterByRun(events: OxeEvent[], runId: string): OxeEvent[];
+export declare function filterByWorkItem(events: OxeEvent[], workItemId: string): OxeEvent[];

package/lib/runtime/events/bus.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appendEvent = appendEvent;
+exports.readEvents = readEvents;
+exports.filterByRun = filterByRun;
+exports.filterByWorkItem = filterByWorkItem;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+function loadOperationalModule() {
+    const candidates = [
+        path_1.default.resolve(__dirname, '../../../bin/lib/oxe-operational.cjs'),
+        path_1.default.resolve(__dirname, '../../../../bin/lib/oxe-operational.cjs'),
+        path_1.default.resolve(__dirname, '../../../../../bin/lib/oxe-operational.cjs'),
+    ];
+    for (const candidate of candidates) {
+        if (!fs_1.default.existsSync(candidate))
+            continue;
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        return require(candidate);
+    }
+    throw new Error(`Unable to locate oxe-operational.cjs from ${__dirname}`);
+}
+const operational = loadOperationalModule();
+function fromOperationalEvent(raw) {
+    return {
+        id: String(raw.event_id || ''),
+        type: String(raw.type || 'RunStarted'),
+        timestamp: String(raw.timestamp || new Date().toISOString()),
+        session_id: raw.session_id ?? null,
+        run_id: raw.run_id ?? null,
+        work_item_id: raw.work_item_id ?? raw.task_id ?? null,
+        attempt_id: raw.attempt_id ?? null,
+        causation_id: raw.causation_id ?? null,
+        correlation_id: raw.correlation_id ?? null,
+        payload: raw.payload && typeof raw.payload === 'object' ? raw.payload : {},
+    };
+}
+function appendEvent(projectRoot, sessionId, input, causationId) {
+    const event = operational.appendEvent(projectRoot, sessionId, {
+        event_id: input.id,
+        type: input.type,
+        timestamp: input.timestamp,
+        run_id: input.run_id ?? null,
+        work_item_id: input.work_item_id ?? null,
+        attempt_id: input.attempt_id ?? null,
+        causation_id: input.causation_id ?? causationId ?? null,
+        correlation_id: input.correlation_id ?? null,
+        payload: input.payload && typeof input.payload === 'object' ? input.payload : {},
+    });
+    return fromOperationalEvent(event);
+}
+function readEvents(projectRoot, sessionId) {
+    return operational.readEvents(projectRoot, sessionId).map(fromOperationalEvent);
+}
+function filterByRun(events, runId) {
+    return events.filter((e) => e.run_id === runId);
+}
+function filterByWorkItem(events, workItemId) {
+    return events.filter((e) => e.work_item_id === workItemId);
+}

package/lib/runtime/events/catalog.d.ts

@@ -0,0 +1,3 @@
+export declare const EVENT_TYPES: readonly ["SessionCreated", "RunStarted", "GraphCompiled", "WorkItemReady", "WorkspaceAllocated", "AttemptStarted", "ToolInvoked", "ToolCompleted", "ToolFailed", "EvidenceCollected", "PolicyEvaluated", "GateRequested", "GateResolved", "VerificationStarted", "VerificationCompleted", "RetryScheduled", "WorkItemCompleted", "WorkItemBlocked", "RunCompleted", "RetroPublished", "LessonPromoted"];
+export type EventType = (typeof EVENT_TYPES)[number];
+export declare function isValidEventType(type: string): type is EventType;

package/lib/runtime/events/catalog.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EVENT_TYPES = void 0;
+exports.isValidEventType = isValidEventType;
+exports.EVENT_TYPES = [
+    'SessionCreated',
+    'RunStarted',
+    'GraphCompiled',
+    'WorkItemReady',
+    'WorkspaceAllocated',
+    'AttemptStarted',
+    'ToolInvoked',
+    'ToolCompleted',
+    'ToolFailed',
+    'EvidenceCollected',
+    'PolicyEvaluated',
+    'GateRequested',
+    'GateResolved',
+    'VerificationStarted',
+    'VerificationCompleted',
+    'RetryScheduled',
+    'WorkItemCompleted',
+    'WorkItemBlocked',
+    'RunCompleted',
+    'RetroPublished',
+    'LessonPromoted',
+];
+function isValidEventType(type) {
+    return exports.EVENT_TYPES.includes(type);
+}

package/lib/runtime/events/envelope.d.ts

@@ -0,0 +1,13 @@
+import type { EventType } from './catalog';
+export interface OxeEvent {
+    id: string;
+    type: EventType;
+    timestamp: string;
+    session_id: string | null;
+    run_id: string | null;
+    work_item_id: string | null;
+    attempt_id: string | null;
+    causation_id: string | null;
+    correlation_id: string | null;
+    payload: Record<string, unknown>;
+}

package/lib/runtime/events/envelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/runtime/events/index.d.ts

@@ -0,0 +1,3 @@
+export * from './catalog';
+export * from './envelope';
+export * from './bus';

package/lib/runtime/events/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./catalog"), exports);
+__exportStar(require("./envelope"), exports);
+__exportStar(require("./bus"), exports);

package/lib/runtime/evidence/evidence-store.d.ts

@@ -0,0 +1,22 @@
+import type { Evidence, EvidenceType } from '../models/evidence';
+export interface EvidenceCollectOptions {
+    work_item_id: string;
+    run_id: string;
+    attempt_number: number;
+}
+export interface EvidenceContent {
+    evidence: Evidence;
+    content: Buffer;
+}
+export declare class EvidenceStore {
+    private readonly projectRoot;
+    constructor(projectRoot: string);
+    private evidenceDir;
+    private indexPath;
+    private readIndex;
+    private writeIndex;
+    collect(type: EvidenceType, content: Buffer | string, opts: EvidenceCollectOptions): Promise<Evidence>;
+    list(opts: EvidenceCollectOptions): Promise<Evidence[]>;
+    get(evidenceId: string, opts: EvidenceCollectOptions): Promise<EvidenceContent | null>;
+    listByRun(runId: string): Promise<Evidence[]>;
+}

package/lib/runtime/evidence/evidence-store.js

@@ -0,0 +1,106 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EvidenceStore = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const EXT_MAP = {
+    diff: 'patch',
+    stdout: 'txt',
+    stderr: 'txt',
+    junit_xml: 'xml',
+    coverage: 'json',
+    screenshot: 'png',
+    trace: 'json',
+    log: 'txt',
+    security_report: 'json',
+    api_output: 'json',
+    summary: 'json',
+};
+class EvidenceStore {
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+    }
+    evidenceDir(runId, workItemId, attemptNumber) {
+        return path_1.default.join(this.projectRoot, '.oxe', 'evidence', 'runs', runId, workItemId, `attempt-${attemptNumber}`);
+    }
+    indexPath(runId, workItemId, attemptNumber) {
+        return path_1.default.join(this.evidenceDir(runId, workItemId, attemptNumber), 'index.json');
+    }
+    readIndex(runId, workItemId, attemptNumber) {
+        const p = this.indexPath(runId, workItemId, attemptNumber);
+        if (!fs_1.default.existsSync(p))
+            return [];
+        try {
+            return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+        }
+        catch {
+            return [];
+        }
+    }
+    writeIndex(runId, workItemId, attemptNumber, items) {
+        fs_1.default.writeFileSync(this.indexPath(runId, workItemId, attemptNumber), JSON.stringify(items, null, 2), 'utf8');
+    }
+    async collect(type, content, opts) {
+        const { work_item_id, run_id, attempt_number } = opts;
+        const dir = this.evidenceDir(run_id, work_item_id, attempt_number);
+        fs_1.default.mkdirSync(dir, { recursive: true });
+        const buf = Buffer.isBuffer(content) ? content : Buffer.from(content, 'utf8');
+        const checksum = crypto_1.default.createHash('sha256').update(buf).digest('hex').slice(0, 16);
+        const ext = EXT_MAP[type] ?? 'bin';
+        const existing = this.readIndex(run_id, work_item_id, attempt_number);
+        const seq = existing.filter((e) => e.type === type).length + 1;
+        const filename = seq === 1 ? `${type}.${ext}` : `${type}-${seq}.${ext}`;
+        const filePath = path_1.default.join(dir, filename);
+        fs_1.default.writeFileSync(filePath, buf);
+        const evidence = {
+            evidence_id: `ev-${run_id}-${work_item_id}-a${attempt_number}-${type}-${seq}`,
+            attempt_id: `${work_item_id}-a${attempt_number}`,
+            type,
+            path: path_1.default.relative(this.projectRoot, filePath),
+            checksum,
+            created_at: new Date().toISOString(),
+        };
+        this.writeIndex(run_id, work_item_id, attempt_number, [...existing, evidence]);
+        return evidence;
+    }
+    async list(opts) {
+        return this.readIndex(opts.run_id, opts.work_item_id, opts.attempt_number);
+    }
+    async get(evidenceId, opts) {
+        const items = this.readIndex(opts.run_id, opts.work_item_id, opts.attempt_number);
+        const ev = items.find((e) => e.evidence_id === evidenceId);
+        if (!ev)
+            return null;
+        const absPath = path_1.default.join(this.projectRoot, ev.path);
+        if (!fs_1.default.existsSync(absPath))
+            return null;
+        return { evidence: ev, content: fs_1.default.readFileSync(absPath) };
+    }
+    async listByRun(runId) {
+        const runDir = path_1.default.join(this.projectRoot, '.oxe', 'evidence', 'runs', runId);
+        if (!fs_1.default.existsSync(runDir))
+            return [];
+        const all = [];
+        for (const workItem of fs_1.default.readdirSync(runDir)) {
+            const wiDir = path_1.default.join(runDir, workItem);
+            for (const attempt of fs_1.default.readdirSync(wiDir)) {
+                const indexPath = path_1.default.join(wiDir, attempt, 'index.json');
+                if (fs_1.default.existsSync(indexPath)) {
+                    try {
+                        const items = JSON.parse(fs_1.default.readFileSync(indexPath, 'utf8'));
+                        all.push(...items);
+                    }
+                    catch {
+                        // skip corrupt index
+                    }
+                }
+            }
+        }
+        return all;
+    }
+}
+exports.EvidenceStore = EvidenceStore;

package/lib/runtime/evidence/index.d.ts

@@ -0,0 +1 @@
+export * from './evidence-store';

package/lib/runtime/evidence/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./evidence-store"), exports);

package/lib/runtime/gate/gate-manager.d.ts

@@ -0,0 +1,39 @@
+import type { GateScope, GateDecisionValue } from '../models/gate-decision';
+export interface GateContext {
+    work_item_id?: string;
+    run_id?: string;
+    description: string;
+    evidence_refs: string[];
+    risks: string[];
+}
+export interface GateToken {
+    gate_id: string;
+    scope: GateScope;
+    requested_at: string;
+    context: GateContext;
+    status: 'pending' | 'resolved';
+    decision?: GateDecisionValue;
+    actor?: string;
+    reason?: string;
+    resolved_at?: string;
+}
+export interface GateResolution {
+    decision: GateDecisionValue;
+    actor: string;
+    reason?: string;
+}
+export declare class GateManager {
+    private readonly projectRoot;
+    private readonly sessionId;
+    private readonly runId;
+    constructor(projectRoot: string, sessionId: string | null, runId: string);
+    private gatesPath;
+    private readGates;
+    private writeGates;
+    request(scope: GateScope, ctx: GateContext): Promise<GateToken>;
+    resolve(token: GateToken, resolution: GateResolution): Promise<GateToken>;
+    isPending(scope: GateScope): boolean;
+    listPending(): GateToken[];
+    listAll(): GateToken[];
+    get(gateId: string): GateToken | null;
+}

package/lib/runtime/gate/gate-manager.js

@@ -0,0 +1,104 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GateManager = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const bus_1 = require("../events/bus");
+class GateManager {
+    constructor(projectRoot, sessionId, runId) {
+        this.projectRoot = projectRoot;
+        this.sessionId = sessionId;
+        this.runId = runId;
+    }
+    gatesPath() {
+        if (this.sessionId) {
+            return path_1.default.join(this.projectRoot, '.oxe', this.sessionId, 'execution', 'GATES.json');
+        }
+        return path_1.default.join(this.projectRoot, '.oxe', 'execution', 'GATES.json');
+    }
+    readGates() {
+        const p = this.gatesPath();
+        if (!fs_1.default.existsSync(p))
+            return [];
+        try {
+            return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+        }
+        catch {
+            return [];
+        }
+    }
+    writeGates(gates) {
+        const p = this.gatesPath();
+        fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
+        fs_1.default.writeFileSync(p, JSON.stringify(gates, null, 2), 'utf8');
+    }
+    async request(scope, ctx) {
+        const token = {
+            gate_id: `gate-${crypto_1.default.randomBytes(4).toString('hex')}`,
+            scope,
+            requested_at: new Date().toISOString(),
+            context: ctx,
+            status: 'pending',
+        };
+        const gates = this.readGates();
+        gates.push(token);
+        this.writeGates(gates);
+        (0, bus_1.appendEvent)(this.projectRoot, this.sessionId, {
+            type: 'GateRequested',
+            run_id: this.runId,
+            work_item_id: ctx.work_item_id ?? null,
+            payload: {
+                gate_id: token.gate_id,
+                scope,
+                description: ctx.description,
+                evidence_refs: ctx.evidence_refs,
+                risks: ctx.risks,
+            },
+        });
+        return token;
+    }
+    async resolve(token, resolution) {
+        const gates = this.readGates();
+        const idx = gates.findIndex((g) => g.gate_id === token.gate_id);
+        if (idx === -1)
+            throw new Error(`Gate ${token.gate_id} not found`);
+        const resolved = {
+            ...gates[idx],
+            status: 'resolved',
+            decision: resolution.decision,
+            actor: resolution.actor,
+            reason: resolution.reason ?? undefined,
+            resolved_at: new Date().toISOString(),
+        };
+        gates[idx] = resolved;
+        this.writeGates(gates);
+        (0, bus_1.appendEvent)(this.projectRoot, this.sessionId, {
+            type: 'GateResolved',
+            run_id: this.runId,
+            payload: {
+                gate_id: token.gate_id,
+                scope: token.scope,
+                decision: resolution.decision,
+                actor: resolution.actor,
+            },
+        });
+        return resolved;
+    }
+    isPending(scope) {
+        return this.readGates().some((g) => g.scope === scope && g.status === 'pending');
+    }
+    listPending() {
+        return this.readGates().filter((g) => g.status === 'pending');
+    }
+    listAll() {
+        return this.readGates();
+    }
+    get(gateId) {
+        return this.readGates().find((g) => g.gate_id === gateId) ?? null;
+    }
+}
+exports.GateManager = GateManager;

package/lib/runtime/gate/index.d.ts

@@ -0,0 +1 @@
+export * from './gate-manager';

package/lib/runtime/gate/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./gate-manager"), exports);

package/lib/runtime/index.d.ts

@@ -0,0 +1,19 @@
+export * from './models/index';
+export * from './events/index';
+export * from './reducers/index';
+export * from './compiler/index';
+export * from './scheduler/index';
+export * from './workspace/index';
+export * from './evidence/index';
+export { compile as compileVerification, runCheck, runSuite, summarizeSuite, } from './verification/verification-compiler';
+export type { CheckType, AcceptanceCheck, AcceptanceCheckSuite, CheckResult, } from './verification/verification-compiler';
+export * from './verification/verification-manifest';
+export * from './policy/index';
+export * from './gate/index';
+export * from './projection/index';
+export * from './plugins/index';
+export * from './delivery/index';
+export * from './context/index';
+export * from './scheduler/multi-agent-coordinator';
+export * from './decision/index';
+export * from './audit/index';