patchwork-os 0.2.0-beta.13.canary.263 → 0.2.0-beta.13.canary.265

package/dist/approvalQueue.d.ts

@@ -11,7 +11,7 @@ import type { RiskTier } from "./riskTier.js";
  *  - TTL prevents zombie entries if the dashboard never responds
  */
 export interface RiskSignal {
-    kind: "destructive_flag" | "domain_reputation" | "path_escape" | "chaining";
+    kind: "destructive_flag" | "domain_reputation" | "path_escape" | "chaining" | "destructive_command" | "data_exfiltration";
     label: string;
     severity: "low" | "medium" | "high";
 }

package/dist/approvalQueue.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvalQueue.js","sourceRoot":"","sources":["../src/approvalQueue.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AA0GrB;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAC/B,MAA+B,EAC/B,aAAwC,EACxC,KAAY;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,CAAC;YAAE,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,qEAAqE;IACrE,KAAK,aAAa,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAW,EAAE;QACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC;YAAE,OAAO,YAAY,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpD,6DAA6D;IAC5C,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtD;;;;;OAKG;IACc,eAAe,GAAG,IAAI,GAAG,EAGvC,CAAC;IACa,KAAK,CAAS;IACd,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAEnD,YAAY,OAA2B,EAAE;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC;IACxC,CAAC;IAED,8EAA8E;IAC9E,SAAS,CAAC,EAAc;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAEO,MAAM;QACZ,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,EAAE,EAAE,CAAC;YACP,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CACL,KAAsD,EACtD,OAAsD,EAAE;QAMxD,0EAA0E;QAC1E,oEAAoE;QACpE,oEAAoE;QACpE,yDAAyD;QACzD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;aACtB,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aACnC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,IAAI,OAAO,CAAmB,CAAC,GAAG,EAAE,EAAE;oBACpD,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrC,CAAC,CAAC,CAAC;gBACH,oEAAoE;gBACpE,gEAAgE;gBAChE,gEAAgE;gBAChE,2DAA2D;gBAC3D,mDAAmD;gBACnD,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACzD,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACrC,OAAO;iBACR,CAAC;YACJ,CAAC;YACD,oEAAoE;YACpE,2CAA2C;YAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS;YAClC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,SAAyC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAmB,CAAC,GAAG,EAAE,EAAE;YACpD,SAAS,GAAG,GAAG,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe;gBAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAEjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;YACvB,MAAM;YACN,WAAW;YACX,OAAO,EAAE,SAAS;YAClB,KAAK;YACL,aAAa;YACb,WAAW;YACX,eAAe,EAAE,EAAE;YACnB,aAAa,EAAE,CAAC;YAChB,GAAG,KAAK;SACT,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,8DAA8D;QAC9D,8DAA8D;QAC9D,kEAAkE;QAClE,mEAAmE;QACnE,6DAA6D;QAC7D,4DAA4D;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,mEAAmE;gBACnE,iEAAiE;gBACjE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,MAAM,CAAU,kBAAkB,GAAG,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACH,aAAa,CAAC,MAAc,EAAE,KAAa;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,aAAa;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,kBAAkB,EAAE,CAAC;YAC5D,uEAAuE;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,gEAAgE;YAChE,iDAAiD;YACjD,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,aAAa,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC;gBAAE,CAAC,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI;QACF,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,oFAAoF;aACrF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,sEAAsE;IACtE,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzB,kEAAkE;YAClE,+DAA+D;YAC/D,8BAA8B;YAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe;gBAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,uEAAuE;QACvE,qEAAqE;QACrE,qCAAqC;QACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,QAA0B;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxC,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,+DAA+D;QAC/D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxB,iEAAiE;QACjE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe;YAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,iBAAiB,CAAC,MAAc;QAC9B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAEO,oBAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,CAAC;QACpD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;;AAGH;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,mEAAmE;AACnE,IAAI,SAAoC,CAAC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,SAAS;QAAE,SAAS,GAAG,IAAI,aAAa,EAAE,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sBAAsB;AACtB,MAAM,UAAU,0BAA0B;IACxC,SAAS,EAAE,KAAK,EAAE,CAAC;IACnB,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC"}
+{"version":3,"file":"approvalQueue.js","sourceRoot":"","sources":["../src/approvalQueue.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AAgHrB;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAC/B,MAA+B,EAC/B,aAAwC,EACxC,KAAY;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,CAAC;YAAE,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,qEAAqE;IACrE,KAAK,aAAa,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAW,EAAE;QACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC;YAAE,OAAO,YAAY,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpD,6DAA6D;IAC5C,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtD;;;;;OAKG;IACc,eAAe,GAAG,IAAI,GAAG,EAGvC,CAAC;IACa,KAAK,CAAS;IACd,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAEnD,YAAY,OAA2B,EAAE;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC;IACxC,CAAC;IAED,8EAA8E;IAC9E,SAAS,CAAC,EAAc;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAEO,MAAM;QACZ,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,EAAE,EAAE,CAAC;YACP,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CACL,KAAsD,EACtD,OAAsD,EAAE;QAMxD,0EAA0E;QAC1E,oEAAoE;QACpE,oEAAoE;QACpE,yDAAyD;QACzD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;aACtB,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aACnC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,IAAI,OAAO,CAAmB,CAAC,GAAG,EAAE,EAAE;oBACpD,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrC,CAAC,CAAC,CAAC;gBACH,oEAAoE;gBACpE,gEAAgE;gBAChE,gEAAgE;gBAChE,2DAA2D;gBAC3D,mDAAmD;gBACnD,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACzD,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACrC,OAAO;iBACR,CAAC;YACJ,CAAC;YACD,oEAAoE;YACpE,2CAA2C;YAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS;YAClC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,SAAyC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAmB,CAAC,GAAG,EAAE,EAAE;YACpD,SAAS,GAAG,GAAG,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe;gBAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAEjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;YACvB,MAAM;YACN,WAAW;YACX,OAAO,EAAE,SAAS;YAClB,KAAK;YACL,aAAa;YACb,WAAW;YACX,eAAe,EAAE,EAAE;YACnB,aAAa,EAAE,CAAC;YAChB,GAAG,KAAK;SACT,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,8DAA8D;QAC9D,8DAA8D;QAC9D,kEAAkE;QAClE,mEAAmE;QACnE,6DAA6D;QAC7D,4DAA4D;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,mEAAmE;gBACnE,iEAAiE;gBACjE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,MAAM,CAAU,kBAAkB,GAAG,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACH,aAAa,CAAC,MAAc,EAAE,KAAa;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,aAAa;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,kBAAkB,EAAE,CAAC;YAC5D,uEAAuE;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,gEAAgE;YAChE,iDAAiD;YACjD,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,aAAa,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC;gBAAE,CAAC,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI;QACF,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,oFAAoF;aACrF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,sEAAsE;IACtE,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzB,kEAAkE;YAClE,+DAA+D;YAC/D,8BAA8B;YAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe;gBAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,uEAAuE;QACvE,qEAAqE;QACrE,qCAAqC;QACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,QAA0B;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxC,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,+DAA+D;QAC/D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxB,iEAAiE;QACjE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe;YAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,iBAAiB,CAAC,MAAc;QAC9B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAEO,oBAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,CAAC;QACpD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;;AAGH;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,mEAAmE;AACnE,IAAI,SAAoC,CAAC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,SAAS;QAAE,SAAS,GAAG,IAAI,aAAa,EAAE,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sBAAsB;AACtB,MAAM,UAAU,0BAA0B;IACxC,SAAS,EAAE,KAAK,EAAE,CAAC;IACnB,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC"}

package/dist/riskSignals.js

@@ -25,9 +25,19 @@ export function computeRiskSignals(toolName, params, workspace) {
     const signals = [];
     // Destructive flags — shell commands
     if (COMMAND_TOOLS.has(toolName)) {
-        const cmd = (typeof params.command === "string" && params.command) ||
+        const cmdBase = (typeof params.command === "string" && params.command) ||
             (typeof params.text === "string" && params.text) ||
             "";
+        // runCommand delivers the subcommand + flags in params.args (its `command`
+        // is the bare basename, e.g. "git"); runInTerminal / sendTerminalCommand
+        // carry the whole shell string and have no `args`. Join them so every
+        // pattern below sees the FULL command for all four tools — otherwise a
+        // `git reset --hard` issued as runCommand{command:"git",args:[…]} reduces
+        // to "git" and silently matches nothing. (P1-3 / P1-7)
+        const argsArr = Array.isArray(params.args)
+            ? params.args.filter((a) => typeof a === "string")
+            : [];
+        const cmd = argsArr.length > 0 ? `${cmdBase} ${argsArr.join(" ")}` : cmdBase;
         if (/\brm\b.*-[a-z]*r[a-z]*f|\brm\b.*-[a-z]*f[a-z]*r/i.test(cmd)) {
             signals.push({
                 kind: "destructive_flag",
@@ -84,6 +94,37 @@ export function computeRiskSignals(toolName, params, workspace) {
                 severity: "low",
             });
         }
+        // Destructive git / system commands — mirrors the SubprocessDriver deny-list
+        // (claudeDriver.ts / subprocessSettings.ts). The driver HARD-denies these on
+        // its ungated subprocess path; the bridge's gated path escalates them to
+        // human approval instead. `--force-with-lease` is intentionally NOT flagged
+        // (it is the safe force-push the bridge itself uses). `rm -rf` / `sudo` are
+        // already covered above. (audit P1-3)
+        if (/\bgit\b.*\breset\b.*--hard\b/i.test(cmd) ||
+            /\bgit\b.*\bclean\b.*(-[a-z]*f|--force|-d)/i.test(cmd) ||
+            /\bgit\b.*\bpush\b.*(--force(?!-with-lease)|(?:^|\s)-f)\b/i.test(cmd) ||
+            /\beval\b/i.test(cmd) ||
+            /\bchmod\b.*\b777\b/i.test(cmd) ||
+            /\bkill\b.*\s-9\b/i.test(cmd) ||
+            /\bpkill\b/i.test(cmd)) {
+            signals.push({
+                kind: "destructive_command",
+                label: "destructive git/system command",
+                severity: "high",
+            });
+        }
+        // Data exfiltration — a network-egress upload flag co-occurring with a
+        // credential-path reference. Near-zero legitimate use at an agent approval
+        // gate, so escalate to approval. (audit P1-7)
+        const exfilEgress = /\bcurl\b.*(-T\b|--upload-file\b|--data(?:-binary)?\s+@|(?:^|\s)-d\s+@)|\bwget\b.*--post-file=/i;
+        const credPath = /\.ssh\b|\.aws\b|\bid_rsa\b|\bid_ed25519\b|\.env\b|\bcredentials\b|\.npmrc\b|\.netrc\b/i;
+        if (exfilEgress.test(cmd) && credPath.test(cmd)) {
+            signals.push({
+                kind: "data_exfiltration",
+                label: "network upload of credential file",
+                severity: "high",
+            });
+        }
     }
     // Domain reputation — WebFetch / sendHttpRequest
     if (toolName === "WebFetch" || toolName === "sendHttpRequest") {

package/dist/riskSignals.js.map

@@ -1 +1 @@
-{"version":3,"file":"riskSignals.js","sourceRoot":"","sources":["../src/riskSignals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AAE5D;;;;GAIG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,YAAY;IACZ,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,MAA+B,EAC/B,SAAiB;IAEjB,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,qCAAqC;IACrC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GACP,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC;YACtD,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC;YAChD,EAAE,CAAC;QACL,IAAI,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,uBAAuB;gBAC9B,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,oBAAoB;gBAC3B,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,wBAAwB;gBAC/B,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,gBAAgB;gBACvB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,kCAAkC;gBACzC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,eAAe;gBACtB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACvC,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,mBAAmB;oBACzB,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACvE,MAAM,QAAQ,GACZ,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,6BAA6B;oBACpC,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAKrC;IACC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,kBAAkB,CACpC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,SAAS,CACf,CAAC;IACF,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAClD,CAAC"}
+{"version":3,"file":"riskSignals.js","sourceRoot":"","sources":["../src/riskSignals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AAE5D;;;;GAIG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,YAAY;IACZ,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,MAA+B,EAC/B,SAAiB;IAEjB,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,qCAAqC;IACrC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GACX,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC;YACtD,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC;YAChD,EAAE,CAAC;QACL,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,0EAA0E;QAC1E,uDAAuD;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACxC,CAAC,CAAE,MAAM,CAAC,IAAkB,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,GAAG,GACP,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,IAAI,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,uBAAuB;gBAC9B,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,oBAAoB;gBAC3B,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,wBAAwB;gBAC/B,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,gBAAgB;gBACvB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,kCAAkC;gBACzC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;QACD,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,sCAAsC;QACtC,IACE,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC;YACzC,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,2DAA2D,CAAC,IAAI,CAAC,GAAG,CAAC;YACrE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YACrB,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EACtB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,qBAAqB;gBAC3B,KAAK,EAAE,gCAAgC;gBACvC,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QACD,uEAAuE;QACvE,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,WAAW,GACf,gGAAgG,CAAC;QACnG,MAAM,QAAQ,GACZ,wFAAwF,CAAC;QAC3F,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,mCAAmC;gBAC1C,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,eAAe;gBACtB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACvC,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,mBAAmB;oBACzB,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACvE,MAAM,QAAQ,GACZ,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,6BAA6B;oBACpC,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAKrC;IACC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,kBAAkB,CACpC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,SAAS,CACf,CAAC;IACF,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAClD,CAAC"}

package/dist/workers/actionClass.d.ts

@@ -0,0 +1,31 @@
+import { type RiskTier } from "../riskTier.js";
+/**
+ * Worker trust is scoped per (worker × action-class), never globally. An
+ * action-class is the unit that accumulates evidence. It is intentionally
+ * COARSE enough to graduate (a worker touches only a handful) yet keyed on
+ * blast-tier so that a rarer, higher-blast action in the same domain is a
+ * DISTINCT, less-trusted class — competence on routine `git status` can never
+ * transfer to `git push --force`. (worker-ramp-v0)
+ */
+export type Reversibility = "reversible" | "compensable" | "irreversible";
+export interface ActionClass {
+    /** Stable identity: `${domain}:${reversibility}:${blastTier}`. */
+    key: string;
+    domain: string;
+    reversibility: Reversibility;
+    blastTier: RiskTier;
+    /**
+     * Brand/reputational exposure — a DISTINCT gating dimension from safety blast
+     * radius (cf. Arts & Media: low safety risk, high reputational risk). An
+     * externally-visible action (outbound message, public PR/push, issue) whose
+     * failure damages reputation rather than (or as well as) systems. Folds into
+     * the failure weight so reputational mistakes demote trust harder.
+     */
+    brandExposed: boolean;
+}
+export declare function classifyActionClass(toolName: string, _params?: Record<string, unknown>): ActionClass;
+export declare function outcomeWeight(actionClass: ActionClass, good: boolean): number;
+/** Which ramp rungs are reachable for a class. Irreversible classes skip the
+ * safety-net rungs L2/L3 (no compensating action exists), so they must clear a
+ * higher bar to reach L4. */
+export declare function reachableLevels(actionClass: ActionClass): number[];

package/dist/workers/actionClass.js

@@ -0,0 +1,137 @@
+import { classifyTool } from "../riskTier.js";
+/**
+ * Tool → capability domain. Coarse on purpose. Unknown tools fall to "other"
+ * (treated as irreversible — conservative: an unrecognised side effect is
+ * assumed unrecoverable until proven otherwise).
+ */
+const DOMAIN_BY_TOOL = {
+    // version control — read
+    getGitStatus: "vcs-read",
+    getGitDiff: "vcs-read",
+    getGitLog: "vcs-read",
+    gitBlame: "vcs-read",
+    gitListBranches: "vcs-read",
+    // version control — local mutations (reversible: reset/reflog/restore)
+    gitAdd: "vcs-local",
+    gitCommit: "vcs-local",
+    gitCheckout: "vcs-local",
+    gitStash: "vcs-local",
+    // version control — remote / shared history
+    gitPush: "vcs-remote",
+    githubCreatePR: "vcs-remote",
+    githubMergePR: "vcs-remote",
+    // filesystem
+    editText: "fs-write",
+    searchAndReplace: "fs-write",
+    createFile: "fs-write",
+    formatDocument: "fs-write",
+    getBufferContent: "fs-read",
+    findFiles: "fs-read",
+    // shell
+    runCommand: "shell",
+    runInTerminal: "shell",
+    sendTerminalCommand: "shell",
+    // outbound messaging
+    slackPostMessage: "messaging",
+    // generic network
+    sendHttpRequest: "http",
+    WebFetch: "http",
+    // issue trackers
+    githubCreateIssue: "issue",
+    createLinearIssue: "issue",
+    addLinearComment: "issue",
+    updateLinearIssue: "issue",
+    // CI / tests
+    runTests: "ci",
+    githubActions: "ci",
+    // dependency intel (read-only)
+    auditDependencies: "deps-read",
+    getSecurityAdvisories: "deps-read",
+    // recipe-tool ids — RecipeRunLog records THESE (not the MCP names), so the
+    // shadow dial attributes recipe-run steps by them. git.*/github.list_* are
+    // reads; file.* writes; slack/http are outbound. (worker-ramp-v0 dogfood)
+    "git.log_since": "vcs-read",
+    "git.stale_branches": "vcs-read",
+    "github.list_commits": "vcs-read",
+    "github.list_prs": "vcs-read",
+    "github.list_issues": "vcs-read",
+    "file.read": "fs-read",
+    "file.write": "fs-write",
+    "file.append": "fs-write",
+    "slack.post_message": "messaging",
+    "http.post": "http",
+    "linear.list_issues": "issue",
+    "sentry.get_issue": "issue",
+    "diagnostics.get": "fs-read",
+};
+/** Domain → reversibility. The middle ramp rungs (L2/L3) only exist for a class
+ * whose reversibility is not "irreversible", so this is load-bearing. */
+const REVERSIBILITY_BY_DOMAIN = {
+    "vcs-read": "reversible",
+    "vcs-local": "reversible", // reset / reflog / restore
+    "vcs-remote": "compensable", // force-push back / close PR — lossy, possible
+    "fs-write": "reversible", // transactions + WriteEffectLedger
+    "fs-read": "reversible",
+    shell: "irreversible", // arbitrary side effects — assume unrecoverable
+    messaging: "irreversible", // a sent message can't be unsent reliably
+    http: "irreversible", // a POST may not be undoable
+    issue: "compensable", // close / delete the created issue
+    ci: "reversible", // re-runnable, no durable side effect
+    "deps-read": "reversible",
+    other: "irreversible",
+};
+/** Domains whose actions are externally visible — failure is reputational. */
+const BRAND_EXPOSED_DOMAINS = new Set([
+    "messaging",
+    "vcs-remote",
+    "issue",
+    "http",
+]);
+export function classifyActionClass(toolName, _params) {
+    const domain = DOMAIN_BY_TOOL[toolName] ?? "other";
+    const reversibility = REVERSIBILITY_BY_DOMAIN[domain] ?? "irreversible";
+    const blastTier = classifyTool(toolName);
+    return {
+        key: `${domain}:${reversibility}:${blastTier}`,
+        domain,
+        reversibility,
+        blastTier,
+        brandExposed: BRAND_EXPOSED_DOMAINS.has(domain),
+    };
+}
+const BLAST_MULTIPLIER = {
+    low: 2,
+    medium: 5,
+    high: 12,
+};
+const REVERSIBILITY_MULTIPLIER = {
+    reversible: 1,
+    compensable: 1.5,
+    irreversible: 3,
+};
+/**
+ * Evidence weight for one outcome. A routine success is low-information
+ * (weight 1 → the posterior climbs slowly). A failure is weighted by
+ * blast-tier × reversibility, so a high-blast irreversible failure is high
+ * information and craters the posterior (instant demote). This is the entire
+ * anti-trust-transfer-grinding defence: count alone never graduates a risky
+ * class, and one catastrophic outcome dominates a thousand trivial ones.
+ */
+const BRAND_MULTIPLIER = 1.5;
+export function outcomeWeight(actionClass, good) {
+    if (good)
+        return 1;
+    const brand = actionClass.brandExposed ? BRAND_MULTIPLIER : 1;
+    return (BLAST_MULTIPLIER[actionClass.blastTier] *
+        REVERSIBILITY_MULTIPLIER[actionClass.reversibility] *
+        brand);
+}
+/** Which ramp rungs are reachable for a class. Irreversible classes skip the
+ * safety-net rungs L2/L3 (no compensating action exists), so they must clear a
+ * higher bar to reach L4. */
+export function reachableLevels(actionClass) {
+    return actionClass.reversibility === "irreversible"
+        ? [0, 1, 4]
+        : [0, 1, 2, 3, 4];
+}
+//# sourceMappingURL=actionClass.js.map

package/dist/workers/actionClass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionClass.js","sourceRoot":"","sources":["../../src/workers/actionClass.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAiB,MAAM,gBAAgB,CAAC;AA6B7D;;;;GAIG;AACH,MAAM,cAAc,GAA2B;IAC7C,yBAAyB;IACzB,YAAY,EAAE,UAAU;IACxB,UAAU,EAAE,UAAU;IACtB,SAAS,EAAE,UAAU;IACrB,QAAQ,EAAE,UAAU;IACpB,eAAe,EAAE,UAAU;IAC3B,uEAAuE;IACvE,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,WAAW;IACxB,QAAQ,EAAE,WAAW;IACrB,4CAA4C;IAC5C,OAAO,EAAE,YAAY;IACrB,cAAc,EAAE,YAAY;IAC5B,aAAa,EAAE,YAAY;IAC3B,aAAa;IACb,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,UAAU;IAC5B,UAAU,EAAE,UAAU;IACtB,cAAc,EAAE,UAAU;IAC1B,gBAAgB,EAAE,SAAS;IAC3B,SAAS,EAAE,SAAS;IACpB,QAAQ;IACR,UAAU,EAAE,OAAO;IACnB,aAAa,EAAE,OAAO;IACtB,mBAAmB,EAAE,OAAO;IAC5B,qBAAqB;IACrB,gBAAgB,EAAE,WAAW;IAC7B,kBAAkB;IAClB,eAAe,EAAE,MAAM;IACvB,QAAQ,EAAE,MAAM;IAChB,iBAAiB;IACjB,iBAAiB,EAAE,OAAO;IAC1B,iBAAiB,EAAE,OAAO;IAC1B,gBAAgB,EAAE,OAAO;IACzB,iBAAiB,EAAE,OAAO;IAC1B,aAAa;IACb,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,+BAA+B;IAC/B,iBAAiB,EAAE,WAAW;IAC9B,qBAAqB,EAAE,WAAW;IAClC,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,eAAe,EAAE,UAAU;IAC3B,oBAAoB,EAAE,UAAU;IAChC,qBAAqB,EAAE,UAAU;IACjC,iBAAiB,EAAE,UAAU;IAC7B,oBAAoB,EAAE,UAAU;IAChC,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,aAAa,EAAE,UAAU;IACzB,oBAAoB,EAAE,WAAW;IACjC,WAAW,EAAE,MAAM;IACnB,oBAAoB,EAAE,OAAO;IAC7B,kBAAkB,EAAE,OAAO;IAC3B,iBAAiB,EAAE,SAAS;CAC7B,CAAC;AAEF;yEACyE;AACzE,MAAM,uBAAuB,GAAkC;IAC7D,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,YAAY,EAAE,2BAA2B;IACtD,YAAY,EAAE,aAAa,EAAE,+CAA+C;IAC5E,UAAU,EAAE,YAAY,EAAE,mCAAmC;IAC7D,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,cAAc,EAAE,gDAAgD;IACvE,SAAS,EAAE,cAAc,EAAE,0CAA0C;IACrE,IAAI,EAAE,cAAc,EAAE,6BAA6B;IACnD,KAAK,EAAE,aAAa,EAAE,mCAAmC;IACzD,EAAE,EAAE,YAAY,EAAE,sCAAsC;IACxD,WAAW,EAAE,YAAY;IACzB,KAAK,EAAE,cAAc;CACtB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,WAAW;IACX,YAAY;IACZ,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,OAAiC;IAEjC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC;IACnD,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC;IACxE,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO;QACL,GAAG,EAAE,GAAG,MAAM,IAAI,aAAa,IAAI,SAAS,EAAE;QAC9C,MAAM;QACN,aAAa;QACb,SAAS;QACT,YAAY,EAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAA6B;IACjD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,EAAE;CACT,CAAC;AACF,MAAM,wBAAwB,GAAkC;IAC9D,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,GAAG;IAChB,YAAY,EAAE,CAAC;CAChB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,UAAU,aAAa,CAAC,WAAwB,EAAE,IAAa;IACnE,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC;IACnB,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CACL,gBAAgB,CAAC,WAAW,CAAC,SAAS,CAAC;QACvC,wBAAwB,CAAC,WAAW,CAAC,aAAa,CAAC;QACnD,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,OAAO,WAAW,CAAC,aAAa,KAAK,cAAc;QACjD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC"}

package/dist/workers/graduation.d.ts

@@ -0,0 +1,52 @@
+import { type Posterior, type TrustLevel } from "./trustLevel.js";
+/**
+ * Folds outcomes into a (worker × action-class) trust state and decides
+ * promotions/demotions with the asymmetry + hysteresis the ramp requires:
+ *   - DEMOTE is instant and can jump multiple rungs (one catastrophic outcome
+ *     craters the posterior; we honor it immediately, even mid-dwell);
+ *   - PROMOTE is gated by dwell-time (real elapsed time since the last level
+ *     change) AND a post-demote cooldown, and climbs only to the NEXT reachable
+ *     rung — so reaching L4 needs both sustained evidence and sustained time.
+ * Every level change emits an event — the promotion/demotion log is the
+ * compliance/audit artifact.
+ */
+export interface Outcome {
+    toolName: string;
+    good: boolean;
+    /** epoch ms (passed in — the runtime has no Date.now() in pure code). */
+    at: number;
+    params?: Record<string, unknown>;
+}
+export interface ClassTrustState {
+    classKey: string;
+    posterior: Posterior;
+    prior: Posterior;
+    level: TrustLevel;
+    /** epoch ms of the last level change (drives dwell). */
+    lastChangeAt: number;
+    /** epoch ms before which promotions are blocked (post-demote cooldown). */
+    demoteUntil: number;
+    observations: number;
+}
+export interface GraduationConfig {
+    dwellMs: number;
+    demoteCooldownMs: number;
+    k?: number;
+    minEvidenceForGraduation?: number;
+}
+export declare const DEFAULT_GRADUATION_CONFIG: GraduationConfig;
+export interface GraduationEvent {
+    type: "promote" | "demote";
+    classKey: string;
+    from: TrustLevel;
+    to: TrustLevel;
+    at: number;
+    lcb: number;
+    evidence: number;
+    reason: string;
+}
+export declare function initialState(classKey: string, prior: Posterior, at?: number): ClassTrustState;
+export declare function graduate(state: ClassTrustState, outcome: Outcome, cfg?: GraduationConfig): {
+    state: ClassTrustState;
+    event?: GraduationEvent;
+};

package/dist/workers/graduation.js

@@ -0,0 +1,86 @@
+import { classifyActionClass, outcomeWeight, reachableLevels, } from "./actionClass.js";
+import { applyOutcome, levelFromPosterior, } from "./trustLevel.js";
+export const DEFAULT_GRADUATION_CONFIG = {
+    dwellMs: 6 * 60 * 60 * 1000, // 6h between climbs
+    demoteCooldownMs: 24 * 60 * 60 * 1000, // 24h freeze after a fall
+    minEvidenceForGraduation: 10,
+};
+export function initialState(classKey, prior, at = 0) {
+    return {
+        classKey,
+        posterior: prior,
+        prior,
+        level: 0,
+        lastChangeAt: at,
+        demoteUntil: 0,
+        observations: 0,
+    };
+}
+export function graduate(state, outcome, cfg = DEFAULT_GRADUATION_CONFIG) {
+    const ac = classifyActionClass(outcome.toolName, outcome.params);
+    const weight = outcomeWeight(ac, outcome.good);
+    const posterior = applyOutcome(state.posterior, outcome.good, weight);
+    const observations = state.observations + 1;
+    const result = levelFromPosterior(posterior, state.prior, {
+        k: cfg.k,
+        minEvidenceForGraduation: cfg.minEvidenceForGraduation,
+        reachable: reachableLevels(ac),
+    });
+    const candidate = result.level;
+    const base = {
+        ...state,
+        posterior,
+        observations,
+    };
+    // DEMOTE — instant, may skip rungs.
+    if (candidate < state.level) {
+        const next = {
+            ...base,
+            level: candidate,
+            lastChangeAt: outcome.at,
+            demoteUntil: outcome.at + cfg.demoteCooldownMs,
+        };
+        return {
+            state: next,
+            event: {
+                type: "demote",
+                classKey: state.classKey,
+                from: state.level,
+                to: candidate,
+                at: outcome.at,
+                lcb: result.lcb,
+                evidence: result.evidence,
+                reason: `blast-weighted failure (weight=${weight})`,
+            },
+        };
+    }
+    // PROMOTE — gated by dwell + cooldown, one reachable rung at a time.
+    if (candidate > state.level) {
+        const dwellOk = outcome.at >= state.lastChangeAt + cfg.dwellMs;
+        const cooldownOk = outcome.at >= state.demoteUntil;
+        if (dwellOk && cooldownOk) {
+            const nextRung = reachableLevels(ac)
+                .filter((r) => r > state.level && r <= candidate)
+                .sort((a, b) => a - b)[0];
+            if (nextRung !== undefined) {
+                const to = nextRung;
+                return {
+                    state: { ...base, level: to, lastChangeAt: outcome.at },
+                    event: {
+                        type: "promote",
+                        classKey: state.classKey,
+                        from: state.level,
+                        to,
+                        at: outcome.at,
+                        lcb: result.lcb,
+                        evidence: result.evidence,
+                        reason: `sustained evidence (lcb=${result.lcb.toFixed(3)})`,
+                    },
+                };
+            }
+        }
+    }
+    // No level change — posterior still updates.
+    return { state: base };
+}
+//# sourceMappingURL=graduation.js.map

package/dist/workers/graduation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graduation.js","sourceRoot":"","sources":["../../src/workers/graduation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EACnB,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,kBAAkB,GAGnB,MAAM,iBAAiB,CAAC;AAyCzB,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,oBAAoB;IACjD,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,0BAA0B;IACjE,wBAAwB,EAAE,EAAE;CAC7B,CAAC;AAaF,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,KAAgB,EAChB,EAAE,GAAG,CAAC;IAEN,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,KAAK;QACL,KAAK,EAAE,CAAC;QACR,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,KAAsB,EACtB,OAAgB,EAChB,MAAwB,yBAAyB;IAEjD,MAAM,EAAE,GAAgB,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE;QACxD,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,wBAAwB,EAAE,GAAG,CAAC,wBAAwB;QACtD,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;IAE/B,MAAM,IAAI,GAAoB;QAC5B,GAAG,KAAK;QACR,SAAS;QACT,YAAY;KACb,CAAC;IAEF,oCAAoC;IACpC,IAAI,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAoB;YAC5B,GAAG,IAAI;YACP,KAAK,EAAE,SAAS;YAChB,YAAY,EAAE,OAAO,CAAC,EAAE;YACxB,WAAW,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,gBAAgB;SAC/C,CAAC;QACF,OAAO;YACL,KAAK,EAAE,IAAI;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,KAAK;gBACjB,EAAE,EAAE,SAAS;gBACb,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,kCAAkC,MAAM,GAAG;aACpD;SACF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,IAAI,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC;QAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,WAAW,CAAC;QACnD,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,CAAC;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC;iBAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,EAAE,GAAG,QAAsB,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE;oBACvD,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,IAAI,EAAE,KAAK,CAAC,KAAK;wBACjB,EAAE;wBACF,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,MAAM,EAAE,2BAA2B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;qBAC5D;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/workers/shadowGate.d.ts

@@ -0,0 +1,30 @@
+import type { TrustLevel } from "./trustLevel.js";
+import { type WorkerManifest } from "./worker.js";
+import type { WorkerLevelStore } from "./workerLevelStore.js";
+/**
+ * What the ramp WOULD decide for a worker's action — a PURE recommendation.
+ *
+ * v0 is shadow-only: this is NOT wired into the live approval gate
+ * (`evaluateInProcessGate`). Flipping the gate to obey the ramp is a deliberate,
+ * flag-gated phase-2 step, taken only after shadow data shows the ramp's
+ * decisions track reality. Until then this exists to log "ramp would bypass /
+ * gate did queue" and to drive the dial.
+ *
+ * Only the two execution modes that already exist are actionable in v0:
+ *   L4 → bypass (autonomous), everything below → queue (approve-each).
+ * The full earned level (0–4) is reported for the dial. The effective level is
+ * `min(earned, autonomyCeiling)`, floored to 0 for actions outside the worker's
+ * domain — a worker has no standing trust on things it doesn't own.
+ */
+export interface ShadowDecision {
+    decision: "queue" | "bypass";
+    classKey: string;
+    owned: boolean;
+    /** Trust the worker has actually earned on this class (drives the dial). */
+    earnedLevel: TrustLevel;
+    autonomyCeiling: TrustLevel;
+    /** What the gate would operate at: min(earned, ceiling), 0 if not owned. */
+    effectiveLevel: TrustLevel;
+    reason: string;
+}
+export declare function recommend(worker: WorkerManifest, toolName: string, params: Record<string, unknown> | undefined, store: WorkerLevelStore): ShadowDecision;

package/dist/workers/shadowGate.js

@@ -0,0 +1,32 @@
+import { classifyActionClass } from "./actionClass.js";
+import { ownsAction } from "./worker.js";
+const AUTONOMOUS_LEVEL = 4;
+export function recommend(worker, toolName, params, store) {
+    const ac = classifyActionClass(toolName, params);
+    const owned = ownsAction(worker, ac);
+    const earnedLevel = (store.getState(worker.id, ac.key)?.level ??
+        0);
+    let effectiveLevel = owned ? earnedLevel : 0;
+    if (effectiveLevel > worker.autonomyCeiling)
+        effectiveLevel = worker.autonomyCeiling;
+    const decision = effectiveLevel >= AUTONOMOUS_LEVEL ? "bypass" : "queue";
+    let reason;
+    if (!owned)
+        reason = "outside-worker-domain";
+    else if (worker.autonomyCeiling < earnedLevel)
+        reason = `capped-by-autonomy-ceiling (L${worker.autonomyCeiling}, earned L${earnedLevel})`;
+    else if (decision === "bypass")
+        reason = "autonomous (earned L4)";
+    else
+        reason = `below-autonomy (effective L${effectiveLevel})`;
+    return {
+        decision,
+        classKey: ac.key,
+        owned,
+        earnedLevel,
+        autonomyCeiling: worker.autonomyCeiling,
+        effectiveLevel,
+        reason,
+    };
+}
+//# sourceMappingURL=shadowGate.js.map

package/dist/workers/shadowGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadowGate.js","sourceRoot":"","sources":["../../src/workers/shadowGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAuB,MAAM,aAAa,CAAC;AA+B9D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,MAAM,UAAU,SAAS,CACvB,MAAsB,EACtB,QAAgB,EAChB,MAA2C,EAC3C,KAAuB;IAEvB,MAAM,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK;QAC3D,CAAC,CAAe,CAAC;IAEnB,IAAI,cAAc,GAAe,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,cAAc,GAAG,MAAM,CAAC,eAAe;QACzC,cAAc,GAAG,MAAM,CAAC,eAAe,CAAC;IAE1C,MAAM,QAAQ,GAAG,cAAc,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAEzE,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC,KAAK;QAAE,MAAM,GAAG,uBAAuB,CAAC;SACxC,IAAI,MAAM,CAAC,eAAe,GAAG,WAAW;QAC3C,MAAM,GAAG,gCAAgC,MAAM,CAAC,eAAe,aAAa,WAAW,GAAG,CAAC;SACxF,IAAI,QAAQ,KAAK,QAAQ;QAAE,MAAM,GAAG,wBAAwB,CAAC;;QAC7D,MAAM,GAAG,8BAA8B,cAAc,GAAG,CAAC;IAE9D,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,EAAE,CAAC,GAAG;QAChB,KAAK;QACL,WAAW;QACX,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,cAAc;QACd,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/workers/shadowRun.d.ts

@@ -0,0 +1,38 @@
+import { type GraduationConfig, type Outcome } from "./graduation.js";
+import { type WorkerManifest } from "./worker.js";
+import { type AuditEvent, type BoardRow, WorkerLevelStore } from "./workerLevelStore.js";
+/**
+ * Replay an outcome sequence for a worker and capture the per-step dial
+ * trajectory. This is the cheapest test of the evidence-latency risk: it shows,
+ * deterministically, how many real observations (and how much wall-clock) a
+ * worker needs to climb each class — and how one catastrophic outcome demotes
+ * it in a single step. No model calls, no live gate — pure replay.
+ */
+export interface TrajectoryStep {
+    index: number;
+    at: number;
+    toolName: string;
+    good: boolean;
+    classKey: string;
+    level: number;
+    changed: "promote" | "demote" | null;
+}
+export interface ShadowRunResult {
+    workerId: string;
+    trajectory: TrajectoryStep[];
+    board: BoardRow[];
+    events: AuditEvent[];
+    store: WorkerLevelStore;
+}
+export declare function shadowRun(worker: WorkerManifest, outcomes: Outcome[], opts?: {
+    cfg?: GraduationConfig;
+    store?: WorkerLevelStore;
+}): ShadowRunResult;
+/** First trajectory step where `classKey` reached at least `level`. */
+export declare function firstReached(result: ShadowRunResult, classKey: string, level: number): TrajectoryStep | undefined;
+/** Build a steady cadence of same-tool outcomes spaced `intervalMs` apart. */
+export declare function cadence(toolName: string, count: number, opts?: {
+    startAt?: number;
+    intervalMs?: number;
+    good?: boolean;
+}): Outcome[];

package/dist/workers/shadowRun.js

@@ -0,0 +1,44 @@
+import { DEFAULT_GRADUATION_CONFIG, } from "./graduation.js";
+import { priorFor } from "./worker.js";
+import { WorkerLevelStore, } from "./workerLevelStore.js";
+export function shadowRun(worker, outcomes, opts = {}) {
+    const store = opts.store ?? new WorkerLevelStore();
+    const cfg = opts.cfg ?? DEFAULT_GRADUATION_CONFIG;
+    const prior = priorFor(worker);
+    const trajectory = [];
+    outcomes.forEach((o, index) => {
+        const r = store.apply(worker.id, o, { prior, cfg });
+        trajectory.push({
+            index,
+            at: o.at,
+            toolName: o.toolName,
+            good: o.good,
+            classKey: r.classKey,
+            level: r.state.level,
+            changed: r.event?.type ?? null,
+        });
+    });
+    return {
+        workerId: worker.id,
+        trajectory,
+        board: store.board(worker.id),
+        events: store.events(worker.id),
+        store,
+    };
+}
+/** First trajectory step where `classKey` reached at least `level`. */
+export function firstReached(result, classKey, level) {
+    return result.trajectory.find((s) => s.classKey === classKey && s.level >= level);
+}
+/** Build a steady cadence of same-tool outcomes spaced `intervalMs` apart. */
+export function cadence(toolName, count, opts = {}) {
+    const start = opts.startAt ?? 0;
+    const interval = opts.intervalMs ?? 6 * 60 * 60 * 1000; // 6h
+    const good = opts.good ?? true;
+    return Array.from({ length: count }, (_, i) => ({
+        toolName,
+        good,
+        at: start + i * interval,
+    }));
+}
+//# sourceMappingURL=shadowRun.js.map

package/dist/workers/shadowRun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadowRun.js","sourceRoot":"","sources":["../../src/workers/shadowRun.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAG1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAuB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAGL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AA4B/B,MAAM,UAAU,SAAS,CACvB,MAAsB,EACtB,QAAmB,EACnB,OAA6D,EAAE;IAE/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,yBAAyB,CAAC;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,UAAU,CAAC,IAAI,CAAC;YACd,KAAK;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK;YACpB,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,UAAU;QACV,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,KAAK;KACN,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,QAAgB,EAChB,KAAa;IAEb,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CACnD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,OAAO,CACrB,QAAgB,EAChB,KAAa,EACb,OAAkE,EAAE;IAEpE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ;QACR,IAAI;QACJ,EAAE,EAAE,KAAK,GAAG,CAAC,GAAG,QAAQ;KACzB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/workers/trustLevel.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Bayesian trust model for a single (worker × action-class) pair.
+ *
+ * Reliability `p` (the probability that an action of this class is "good") is a
+ * Beta(α, β) posterior. The discrete autonomy rung L0–L4 is a threshold
+ * crossing of the posterior's LOWER confidence bound, not its mean. Using the
+ * lower bound is what makes the ramp behave correctly:
+ *   - cold-start floors automatically: a fresh/wide posterior has a low bound
+ *     even if its mean is optimistic, so a worker (or a marketplace prior) can't
+ *     start trusted — uncertainty must collapse on local evidence first;
+ *   - climbing is slow: the bound only rises as the mean rises AND variance
+ *     shrinks, i.e. with sustained evidence;
+ *   - demotion is instant: one high-weight failure spikes β, the mean drops and
+ *     the bound craters in a single step.
+ *
+ * Asymmetry ("slow up, instant down") is therefore information, not a tuned
+ * rule — it falls out of weighting failures by blast radius (see actionClass).
+ */
+export interface Posterior {
+    readonly alpha: number;
+    readonly beta: number;
+}
+/** Uniform prior — maximally uncertain, no shipped competence. */
+export declare const DEFAULT_PRIOR: Posterior;
+/**
+ * Build a prior from a competence claim: a mean reliability + a strength
+ * (pseudo-count). Low strength = wide uncertainty = the bound stays low until
+ * local evidence accumulates. This is how a marketplace worker ships
+ * competence (a mean) without shipping trust (the bound only tightens on the
+ * operator's own data). Strength is capped low on purpose.
+ */
+export declare function priorFromCompetence(mean: number, strength: number): Posterior;
+export declare function posteriorMean(p: Posterior): number;
+export declare function posteriorStddev(p: Posterior): number;
+/** Lower confidence bound: mean − k·σ, clamped to [0, 1]. The level reads off
+ * THIS, not the mean. */
+export declare function lowerConfidenceBound(p: Posterior, k?: number): number;
+/** Apply one outcome. A good outcome adds to α, a bad one to β, scaled by the
+ * blast-weighted evidence weight from actionClass.outcomeWeight. */
+export declare function applyOutcome(p: Posterior, good: boolean, weight: number): Posterior;
+/** Total evidence accumulated relative to the prior (pseudo-observations). */
+export declare function evidenceCount(p: Posterior, prior: Posterior): number;
+export type TrustLevel = 0 | 1 | 2 | 3 | 4;
+/** LCB → rung. Tunable; conservative by default. */
+export declare const DEFAULT_THRESHOLDS: ReadonlyArray<{
+    min: number;
+    level: TrustLevel;
+}>;
+export interface LevelOpts {
+    k?: number;
+    /** Min evidence before a class may exceed L1 (novel-class floor). */
+    minEvidenceForGraduation?: number;
+    /** Rungs reachable for this class (irreversible classes omit L2/L3). */
+    reachable?: number[];
+    thresholds?: ReadonlyArray<{
+        min: number;
+        level: TrustLevel;
+    }>;
+}
+export interface LevelResult {
+    level: TrustLevel;
+    /** Level before the novel-floor + reachability clamps (for diagnostics). */
+    rawLevel: TrustLevel;
+    lcb: number;
+    mean: number;
+    evidence: number;
+}
+/**
+ * Map a posterior to a discrete rung, applying:
+ *  1. LCB → raw level via thresholds.
+ *  2. Novel-class floor: below the evidence minimum, cap at L1 regardless of how
+ *     good the (necessarily wide) posterior looks — no class graduates on faith.
+ *  3. Reachability clamp: drop to the highest reachable rung ≤ the computed one,
+ *     so an irreversible class climbing through "would-be L2/L3" stays at L1
+ *     until it actually clears the L4 bar.
+ */
+export declare function levelFromPosterior(p: Posterior, prior: Posterior, opts?: LevelOpts): LevelResult;

package/dist/workers/trustLevel.js

@@ -0,0 +1,91 @@
+/**
+ * Bayesian trust model for a single (worker × action-class) pair.
+ *
+ * Reliability `p` (the probability that an action of this class is "good") is a
+ * Beta(α, β) posterior. The discrete autonomy rung L0–L4 is a threshold
+ * crossing of the posterior's LOWER confidence bound, not its mean. Using the
+ * lower bound is what makes the ramp behave correctly:
+ *   - cold-start floors automatically: a fresh/wide posterior has a low bound
+ *     even if its mean is optimistic, so a worker (or a marketplace prior) can't
+ *     start trusted — uncertainty must collapse on local evidence first;
+ *   - climbing is slow: the bound only rises as the mean rises AND variance
+ *     shrinks, i.e. with sustained evidence;
+ *   - demotion is instant: one high-weight failure spikes β, the mean drops and
+ *     the bound craters in a single step.
+ *
+ * Asymmetry ("slow up, instant down") is therefore information, not a tuned
+ * rule — it falls out of weighting failures by blast radius (see actionClass).
+ */
+/** Uniform prior — maximally uncertain, no shipped competence. */
+export const DEFAULT_PRIOR = { alpha: 1, beta: 1 };
+/**
+ * Build a prior from a competence claim: a mean reliability + a strength
+ * (pseudo-count). Low strength = wide uncertainty = the bound stays low until
+ * local evidence accumulates. This is how a marketplace worker ships
+ * competence (a mean) without shipping trust (the bound only tightens on the
+ * operator's own data). Strength is capped low on purpose.
+ */
+export function priorFromCompetence(mean, strength) {
+    const m = Math.min(0.99, Math.max(0.01, mean));
+    const s = Math.min(8, Math.max(0.5, strength));
+    return { alpha: m * s, beta: (1 - m) * s };
+}
+export function posteriorMean(p) {
+    return p.alpha / (p.alpha + p.beta);
+}
+export function posteriorStddev(p) {
+    const n = p.alpha + p.beta;
+    return Math.sqrt((p.alpha * p.beta) / (n * n * (n + 1)));
+}
+/** Lower confidence bound: mean − k·σ, clamped to [0, 1]. The level reads off
+ * THIS, not the mean. */
+export function lowerConfidenceBound(p, k = 1.5) {
+    return Math.max(0, Math.min(1, posteriorMean(p) - k * posteriorStddev(p)));
+}
+/** Apply one outcome. A good outcome adds to α, a bad one to β, scaled by the
+ * blast-weighted evidence weight from actionClass.outcomeWeight. */
+export function applyOutcome(p, good, weight) {
+    return good
+        ? { alpha: p.alpha + weight, beta: p.beta }
+        : { alpha: p.alpha, beta: p.beta + weight };
+}
+/** Total evidence accumulated relative to the prior (pseudo-observations). */
+export function evidenceCount(p, prior) {
+    return p.alpha + p.beta - (prior.alpha + prior.beta);
+}
+/** LCB → rung. Tunable; conservative by default. */
+export const DEFAULT_THRESHOLDS = [
+    { min: 0.95, level: 4 },
+    { min: 0.85, level: 3 },
+    { min: 0.7, level: 2 },
+    { min: 0.5, level: 1 },
+    { min: 0, level: 0 },
+];
+/**
+ * Map a posterior to a discrete rung, applying:
+ *  1. LCB → raw level via thresholds.
+ *  2. Novel-class floor: below the evidence minimum, cap at L1 regardless of how
+ *     good the (necessarily wide) posterior looks — no class graduates on faith.
+ *  3. Reachability clamp: drop to the highest reachable rung ≤ the computed one,
+ *     so an irreversible class climbing through "would-be L2/L3" stays at L1
+ *     until it actually clears the L4 bar.
+ */
+export function levelFromPosterior(p, prior, opts = {}) {
+    const k = opts.k ?? 1.5;
+    const minEvidence = opts.minEvidenceForGraduation ?? 10;
+    const reachable = opts.reachable ?? [0, 1, 2, 3, 4];
+    const thresholds = opts.thresholds ?? DEFAULT_THRESHOLDS;
+    const lcb = lowerConfidenceBound(p, k);
+    const mean = posteriorMean(p);
+    const evidence = evidenceCount(p, prior);
+    const rawLevel = thresholds.find((t) => lcb >= t.min)?.level ?? 0;
+    let level = rawLevel;
+    // Novel-class floor.
+    if (evidence < minEvidence && level > 1)
+        level = 1;
+    // Reachability clamp (highest reachable rung ≤ level).
+    const allowed = reachable.filter((r) => r <= level);
+    level = (allowed.length ? Math.max(...allowed) : 0);
+    return { level, rawLevel, lcb, mean, evidence };
+}
+//# sourceMappingURL=trustLevel.js.map

package/dist/workers/trustLevel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustLevel.js","sourceRoot":"","sources":["../../src/workers/trustLevel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAc,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IAChE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAY;IACxC,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAY;IAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;yBACyB;AACzB,MAAM,UAAU,oBAAoB,CAAC,CAAY,EAAE,CAAC,GAAG,GAAG;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,YAAY,CAC1B,CAAY,EACZ,IAAa,EACb,MAAc;IAEd,OAAO,IAAI;QACT,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,CAAY,EAAE,KAAgB;IAC1D,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAID,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAG1B;IACH,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;IACvB,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;IACvB,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE;IACtB,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE;IACtB,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;CACrB,CAAC;AAoBF;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,CAAY,EACZ,KAAgB,EAChB,OAAkB,EAAE;IAEpB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAEzD,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEzC,MAAM,QAAQ,GACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,IAAK,CAAgB,CAAC;IAEnE,IAAI,KAAK,GAAe,QAAQ,CAAC;IACjC,qBAAqB;IACrB,IAAI,QAAQ,GAAG,WAAW,IAAI,KAAK,GAAG,CAAC;QAAE,KAAK,GAAG,CAAC,CAAC;IACnD,uDAAuD;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IACpD,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAe,CAAC;IAElE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC"}

package/dist/workers/worker.d.ts

@@ -0,0 +1,41 @@
+import type { ActionClass } from "./actionClass.js";
+import { type Posterior, type TrustLevel } from "./trustLevel.js";
+export interface WorkerCompetence {
+    /** Claimed reliability mean (0–1) — a competence claim, not trust. */
+    mean: number;
+    /** Prior strength (pseudo-count); capped low so local evidence dominates. */
+    strength: number;
+}
+export interface WorkerManifest {
+    id: string;
+    name: string;
+    responsibilities: string[];
+    /** Recipe name that forms this worker's body (its triggers + steps). */
+    recipe?: string;
+    /**
+     * Action-classes this worker is responsible for. Each pattern matches a
+     * class by its domain, or by an exact/prefix class-key match
+     * (`vcs-local` matches `vcs-local:*`; `fs-write:reversible:medium` is exact).
+     */
+    owns: string[];
+    /**
+     * Policy/regulatory cap on the max ramp level this worker may EVER reach,
+     * independent of earned track record — the schema encoding of the
+     * autonomy-tolerance axis (e.g. a Legal-sector worker is pinned at L2). The
+     * dial still shows *earned* level; the gate operates at min(earned, ceiling).
+     */
+    autonomyCeiling: TrustLevel;
+    /** Optional shipped competence → the per-class prior. */
+    competence?: WorkerCompetence;
+    /** Free-form sector tag (drives default ceilings / reporting). */
+    sector?: string;
+}
+export declare class WorkerParseError extends Error {
+    constructor(message: string);
+}
+export declare function parseWorker(raw: unknown): WorkerManifest;
+/** The per-class trust prior for a worker (its shipped competence, or uniform). */
+export declare function priorFor(worker: WorkerManifest): Posterior;
+/** Whether a worker is responsible for a given action-class. A pattern matches
+ * the class domain, an exact key, or a key prefix. Empty `owns` ⇒ owns nothing. */
+export declare function ownsAction(worker: WorkerManifest, ac: ActionClass): boolean;

package/dist/workers/worker.js

@@ -0,0 +1,77 @@
+import { DEFAULT_PRIOR, priorFromCompetence, } from "./trustLevel.js";
+/**
+ * A worker manifest. Deliberately NOT a fork of the recipe schema — the recipe
+ * is the worker's *body* (triggers + steps); this manifest adds identity, the
+ * action-classes it owns, a trust prior, and the policy autonomy ceiling. It
+ * references a recipe by name rather than redefining execution. (worker-ramp-v0)
+ */
+const WORKER_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+export class WorkerParseError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WorkerParseError";
+    }
+}
+function reqString(o, key) {
+    const v = o[key];
+    if (typeof v !== "string" || !v)
+        throw new WorkerParseError(`worker.${key} must be a non-empty string`);
+    return v;
+}
+export function parseWorker(raw) {
+    if (typeof raw !== "object" || raw === null)
+        throw new WorkerParseError("worker must be an object");
+    const r = raw;
+    const id = reqString(r, "id");
+    if (!WORKER_ID_RE.test(id))
+        throw new WorkerParseError(`worker.id must be kebab-case (got ${JSON.stringify(id)})`);
+    const name = reqString(r, "name");
+    const owns = Array.isArray(r.owns)
+        ? r.owns.filter((x) => typeof x === "string")
+        : [];
+    const responsibilities = Array.isArray(r.responsibilities)
+        ? r.responsibilities.filter((x) => typeof x === "string")
+        : [];
+    // autonomyCeiling: 0–4, default 4 (uncapped).
+    let autonomyCeiling = 4;
+    if (r.autonomyCeiling !== undefined) {
+        const c = r.autonomyCeiling;
+        if (typeof c !== "number" || !Number.isInteger(c) || c < 0 || c > 4)
+            throw new WorkerParseError("worker.autonomyCeiling must be an integer 0–4");
+        autonomyCeiling = c;
+    }
+    let competence;
+    if (r.competence !== undefined) {
+        const c = r.competence;
+        if (typeof c !== "object" ||
+            c === null ||
+            typeof c.mean !== "number" ||
+            typeof c.strength !== "number")
+            throw new WorkerParseError("worker.competence must be { mean: number, strength: number }");
+        if (c.mean < 0 || c.mean > 1)
+            throw new WorkerParseError("worker.competence.mean must be in [0,1]");
+        competence = { mean: c.mean, strength: c.strength };
+    }
+    return {
+        id,
+        name,
+        responsibilities,
+        recipe: typeof r.recipe === "string" ? r.recipe : undefined,
+        owns,
+        autonomyCeiling,
+        competence,
+        sector: typeof r.sector === "string" ? r.sector : undefined,
+    };
+}
+/** The per-class trust prior for a worker (its shipped competence, or uniform). */
+export function priorFor(worker) {
+    return worker.competence
+        ? priorFromCompetence(worker.competence.mean, worker.competence.strength)
+        : DEFAULT_PRIOR;
+}
+/** Whether a worker is responsible for a given action-class. A pattern matches
+ * the class domain, an exact key, or a key prefix. Empty `owns` ⇒ owns nothing. */
+export function ownsAction(worker, ac) {
+    return worker.owns.some((p) => p === ac.domain || p === ac.key || ac.key.startsWith(`${p}:`));
+}
+//# sourceMappingURL=worker.js.map

package/dist/workers/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/workers/worker.ts"],"names":[],"mappings":"AACA,OAAO,EACL,aAAa,EAEb,mBAAmB,GAEpB,MAAM,iBAAiB,CAAC;AAEzB;;;;;GAKG;AAEH,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAkCjD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,SAAS,SAAS,CAAC,CAA0B,EAAE,GAAW;IACxD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CAAC,UAAU,GAAG,6BAA6B,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QACzC,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CACxB,qCAAqC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAC3D,CAAC;IACJ,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,EAAE,CAAC;IAEP,8CAA8C;IAC9C,IAAI,eAAe,GAAe,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC;QAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,CAChD,CAAC;QACJ,eAAe,GAAG,CAAe,CAAC;IACpC,CAAC;IAED,IAAI,UAAwC,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAqC,CAAC;QAClD,IACE,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,IAAI;YACV,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAE9B,MAAM,IAAI,gBAAgB,CACxB,8DAA8D,CAC/D,CAAC;QACJ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;QACxE,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC;IAED,OAAO;QACL,EAAE;QACF,IAAI;QACJ,gBAAgB;QAChB,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC3D,IAAI;QACJ,eAAe;QACf,UAAU;QACV,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,QAAQ,CAAC,MAAsB;IAC7C,OAAO,MAAM,CAAC,UAAU;QACtB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzE,CAAC,CAAC,aAAa,CAAC;AACpB,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,UAAU,CAAC,MAAsB,EAAE,EAAe;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC"}

package/dist/workers/workerLevelStore.d.ts

@@ -0,0 +1,33 @@
+import { type ClassTrustState, type GraduationConfig, type GraduationEvent, type Outcome } from "./graduation.js";
+import { type Posterior } from "./trustLevel.js";
+export type AuditEvent = GraduationEvent & {
+    workerId: string;
+};
+export interface AppliedOutcome {
+    classKey: string;
+    state: ClassTrustState;
+    event?: AuditEvent;
+}
+export interface BoardRow {
+    classKey: string;
+    level: number;
+    observations: number;
+    mean: number;
+}
+export declare class WorkerLevelStore {
+    private states;
+    private log;
+    /** Fold one outcome for a worker; derives the action-class from the tool. */
+    apply(workerId: string, outcome: Outcome, opts?: {
+        prior?: Posterior;
+        cfg?: GraduationConfig;
+    }): AppliedOutcome;
+    getState(workerId: string, classKey: string): ClassTrustState | undefined;
+    /** Dial snapshot for one worker: every action-class it has touched, sorted. */
+    board(workerId: string): BoardRow[];
+    /** The audit log (optionally filtered to one worker). */
+    events(workerId?: string): AuditEvent[];
+    /** Serialize states + events to JSONL (one record per line). */
+    toJSONL(): string;
+    static fromJSONL(text: string): WorkerLevelStore;
+}

package/dist/workers/workerLevelStore.js

@@ -0,0 +1,87 @@
+import { classifyActionClass } from "./actionClass.js";
+import { DEFAULT_GRADUATION_CONFIG, graduate, initialState, } from "./graduation.js";
+import { DEFAULT_PRIOR, posteriorMean } from "./trustLevel.js";
+/**
+ * Holds the per-(worker × action-class) trust state and the promotion/demotion
+ * event log. The state map is the dial; the event log is the compliance/audit
+ * artifact ("prove this worker never acted beyond its authority"). In-memory
+ * with a JSONL round-trip; wiring it to a live append-only JSONL file with the
+ * tail-on-read concurrency pattern (ADR-0007, as the existing trace stores do)
+ * is the productionization step — kept out of v0 to stay pure + testable.
+ */
+function compositeKey(workerId, classKey) {
+    return `${workerId}::${classKey}`;
+}
+export class WorkerLevelStore {
+    states = new Map();
+    log = [];
+    /** Fold one outcome for a worker; derives the action-class from the tool. */
+    apply(workerId, outcome, opts = {}) {
+        const ac = classifyActionClass(outcome.toolName, outcome.params);
+        const k = compositeKey(workerId, ac.key);
+        const prior = opts.prior ?? DEFAULT_PRIOR;
+        const current = this.states.get(k) ?? initialState(ac.key, prior, outcome.at);
+        const { state, event } = graduate(current, outcome, opts.cfg ?? DEFAULT_GRADUATION_CONFIG);
+        this.states.set(k, state);
+        const audit = event ? { ...event, workerId } : undefined;
+        if (audit)
+            this.log.push(audit);
+        return { classKey: ac.key, state, event: audit };
+    }
+    getState(workerId, classKey) {
+        return this.states.get(compositeKey(workerId, classKey));
+    }
+    /** Dial snapshot for one worker: every action-class it has touched, sorted. */
+    board(workerId) {
+        const prefix = `${workerId}::`;
+        const rows = [];
+        for (const [k, s] of this.states) {
+            if (!k.startsWith(prefix))
+                continue;
+            rows.push({
+                classKey: s.classKey,
+                level: s.level,
+                observations: s.observations,
+                mean: posteriorMean(s.posterior),
+            });
+        }
+        return rows.sort((a, b) => a.classKey.localeCompare(b.classKey));
+    }
+    /** The audit log (optionally filtered to one worker). */
+    events(workerId) {
+        return workerId
+            ? this.log.filter((e) => e.workerId === workerId)
+            : this.log;
+    }
+    /** Serialize states + events to JSONL (one record per line). */
+    toJSONL() {
+        const lines = [];
+        for (const [k, s] of this.states) {
+            const workerId = k.slice(0, k.indexOf("::"));
+            lines.push(JSON.stringify({ rec: "state", workerId, state: s }));
+        }
+        for (const e of this.log)
+            lines.push(JSON.stringify({ rec: "event", ...e }));
+        return lines.join("\n");
+    }
+    static fromJSONL(text) {
+        const store = new WorkerLevelStore();
+        for (const line of text.split("\n")) {
+            const t = line.trim();
+            if (!t)
+                continue;
+            const obj = JSON.parse(t);
+            if (obj.rec === "state") {
+                const workerId = obj.workerId;
+                const state = obj.state;
+                store.states.set(compositeKey(workerId, state.classKey), state);
+            }
+            else if (obj.rec === "event") {
+                const { rec: _rec, ...event } = obj;
+                store.log.push(event);
+            }
+        }
+        return store;
+    }
+}
+//# sourceMappingURL=workerLevelStore.js.map

package/dist/workers/workerLevelStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerLevelStore.js","sourceRoot":"","sources":["../../src/workers/workerLevelStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAEL,yBAAyB,EAGzB,QAAQ,EACR,YAAY,GAEb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAkB,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE/E;;;;;;;GAOG;AAEH,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAgB;IACtD,OAAO,GAAG,QAAQ,KAAK,QAAQ,EAAE,CAAC;AACpC,CAAC;AAiBD,MAAM,OAAO,gBAAgB;IACnB,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5C,GAAG,GAAiB,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,KAAK,CACH,QAAgB,EAChB,OAAgB,EAChB,OAAsD,EAAE;QAExD,MAAM,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;QAC1C,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAC/B,OAAO,EACP,OAAO,EACP,IAAI,CAAC,GAAG,IAAI,yBAAyB,CACtC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,QAAgB;QACpB,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,IAAI,CAAC;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,yDAAyD;IACzD,MAAM,CAAC,QAAiB;QACtB,OAAO,QAAQ;YACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IACf,CAAC;IAED,gEAAgE;IAChE,OAAO;QACL,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG;YACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,IAAY;QAC3B,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC;YACrD,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAkB,CAAC;gBACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAwB,CAAC;gBAC3C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,GAAG,CAAC;gBACpC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAA8B,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "0.2.0-beta.13.canary.263",
+  "version": "0.2.0-beta.13.canary.265",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",

package/templates/recipes/dependency-bump.yaml

@@ -0,0 +1,33 @@
+# yaml-language-server: $schema=https://patchwork.dev/schemas/recipe.v1.json
+# Body for the Dependency Upkeep Worker
+# (templates/workers/dependency-upkeep.worker.yaml). Weekly cron — reviews the
+# open dependency-update PRs rather than opening them (autonomyCeiling L3: a
+# human still merges).
+apiVersion: patchwork.sh/v1
+name: dependency-bump
+description: Weekly — list open dependency-update PRs and summarize which look safe to merge.
+trigger:
+  type: cron
+  at: "0 9 * * MON"
+steps:
+  - tool: github.list_prs
+    max: 30
+    into: prs
+  - agent:
+      prompt: |
+        Open pull requests:
+        {{prs}}
+
+        Identify the dependency-update PRs (dependabot / renovate / "bump …"
+        titles). For each, note the package, the version jump (patch / minor /
+        major), and a recommendation: SAFE to merge (patch/minor with green CI)
+        or NEEDS REVIEW (major, or a security-sensitive dependency). Output a
+        short markdown table; if there are none, say "No dependency PRs open."
+      driver: claude-code
+      into: review
+  - tool: file.write
+    path: ~/.patchwork/inbox/dependency-review-{{date}}.md
+    content: |
+      # Dependency PR review — {{date}}
+
+      {{review}}

package/templates/recipes/release-notes.yaml

@@ -0,0 +1,30 @@
+# yaml-language-server: $schema=https://patchwork.dev/schemas/recipe.v1.json
+# Body for the Release Worker (templates/workers/release-notes.worker.yaml).
+# Self-waking on every commit (git_hook → onGitCommit, wired in #1016/#1018).
+apiVersion: patchwork.sh/v1
+name: release-notes
+description: After a commit lands, draft a changelog entry from the new commits into the inbox.
+trigger:
+  type: git_hook
+  event: post-commit
+steps:
+  - tool: git.log_since
+    since: 24h
+    into: commits
+  - agent:
+      prompt: |
+        New commits landed in the last 24h:
+        {{commits}}
+
+        Write a concise changelog entry as a markdown bullet list — one line per
+        user-facing change, grouped under feat / fix / chore. Omit pure noise
+        (merge commits, formatting-only). If nothing is user-facing, say so.
+      # subprocess `claude -p` under your existing subscription (no API key)
+      driver: claude-code
+      into: notes
+  - tool: file.write
+    path: ~/.patchwork/inbox/release-notes-{{date}}.md
+    content: |
+      # Release notes draft — {{date}}
+
+      {{notes}}

package/templates/recipes/triage-failing-tests.yaml

@@ -0,0 +1,38 @@
+# yaml-language-server: $schema=https://patchwork.dev/schemas/recipe.v1.json
+# Body for the Test Guardian Worker
+# (templates/workers/test-guardian.worker.yaml). Self-waking on a FAILING test
+# run (on_test_run.filter: failure). Correlates the failure with recent commits
+# and writes a triage note — richer than the plain watch-failing-tests recipe.
+apiVersion: patchwork.sh/v1
+name: triage-failing-tests
+description: On a failing test run, correlate the failure with recent commits and write a triage note.
+trigger:
+  type: on_test_run
+  filter: failure
+steps:
+  - tool: git.log_since
+    since: 12h
+    into: recent
+  - agent:
+      prompt: |
+        Tests just failed. Runner: {{runner}}. Failed {{failed}} / {{total}}.
+
+        Failures:
+        {{failures}}
+
+        Recent commits (last 12h) that may be responsible:
+        {{recent}}
+
+        Write a triage note (≤5 sentences): (1) which test(s) failed, (2) the
+        single most likely cause, (3) the suspect commit if any, (4) the first
+        command to run to confirm.
+      driver: claude-code
+      into: triage
+  - tool: file.write
+    path: ~/.patchwork/inbox/test-triage-{{date}}-{{time}}.md
+    content: |
+      # Test triage — {{date}} {{time}}
+
+      Runner {{runner}} · failed {{failed}}/{{total}}
+
+      {{triage}}

package/templates/workers/dependency-upkeep.worker.yaml

@@ -0,0 +1,18 @@
+# Dependency-upkeep worker — top-right beachhead. The classic low-blast,
+# continuous, verifiable job to land first (the wedge): watch for outdated /
+# vulnerable deps and open a bump PR. A human still merges → ceiling held at L3.
+id: dependency-upkeep-worker
+name: Dependency Upkeep Worker
+sector: engineering
+recipe: dependency-bump
+responsibilities:
+  - Audit dependencies for outdated / vulnerable packages
+  - Open a bump PR with the changelog and advisory links
+owns:
+  - deps-read # auditDependencies / getSecurityAdvisories — read-only
+  - vcs-local # gitCommit / gitCheckout on a branch — reversible
+  - vcs-remote # githubCreatePR — compensable + brand-exposed
+autonomyCeiling: 3 # opening PRs autonomously is fine; merging stays human (policy)
+competence:
+  mean: 0.8
+  strength: 4

package/templates/workers/release-notes.worker.yaml

@@ -0,0 +1,17 @@
+# Release worker — top-right beachhead (high task-impact × high autonomy-tolerance).
+# Body: a chained recipe triggered on merge-to-main that drafts release notes.
+# Reversible, verifiable, internal → fast ramp evidence.
+id: release-notes-worker
+name: Release Worker
+sector: engineering
+recipe: release-notes # the recipe that forms this worker's body
+responsibilities:
+  - Watch merges to main and draft release notes / changelog entries
+  - Summarize the diff and link the PRs in the range
+owns:
+  - vcs-read # getGitStatus / getGitDiff / getGitLog — reversible, low blast
+  - fs-write # editText / createFile (the changelog) — reversible
+autonomyCeiling: 4 # internal + reversible: may earn full autonomy
+competence: # shipped competence (a prior), NOT trust — trust earns locally
+  mean: 0.85
+  strength: 4

package/templates/workers/test-guardian.worker.yaml

@@ -0,0 +1,18 @@
+# Test-guardian worker — top-right beachhead. Fires on a test-run failure
+# (on_test_run trigger), investigates the failure, and files an issue. Reversible
+# investigation + compensable issue creation → may earn full autonomy on triage.
+id: test-guardian-worker
+name: Test Guardian Worker
+sector: engineering
+recipe: triage-failing-tests
+responsibilities:
+  - On a failing test run, investigate the stack trace and identify the cause
+  - File / update an issue with the failure summary and the suspect commit
+owns:
+  - ci # runTests (re-runnable) — reversible
+  - vcs-read # getGitDiff / gitBlame to find the suspect commit
+  - issue # githubCreateIssue / addLinearComment — compensable + brand-exposed
+autonomyCeiling: 4
+competence:
+  mean: 0.8
+  strength: 4