patchwork-os 0.2.0-beta.9.canary.93 → 1.1.0-beta.1

package/dist/workers/actionClass.js

@@ -0,0 +1,155 @@
+import { classifyTool } from "../riskTier.js";
+/**
+ * Tool → capability domain. Coarse on purpose. Unknown tools fall to "other"
+ * (treated as irreversible — conservative: an unrecognised side effect is
+ * assumed unrecoverable until proven otherwise).
+ */
+const DOMAIN_BY_TOOL = {
+    // version control — read
+    getGitStatus: "vcs-read",
+    getGitDiff: "vcs-read",
+    getGitLog: "vcs-read",
+    gitBlame: "vcs-read",
+    gitListBranches: "vcs-read",
+    // version control — local mutations (reversible: reset/reflog/restore)
+    gitAdd: "vcs-local",
+    gitCommit: "vcs-local",
+    gitCheckout: "vcs-local",
+    gitStash: "vcs-local",
+    // version control — remote / shared history.
+    // Each operation has its OWN domain so trust earned on one never unlocks
+    // another (trust-transfer prevention: a worker grinding PR creation must
+    // separately earn evidence on push, and separately on merge).
+    gitPush: "vcs-push", // can be force-reverted; compensable
+    githubCreatePR: "vcs-remote", // PR is a proposal; closeable
+    githubMergePR: "vcs-merge", // lands commits in main; hard to undo cleanly
+    // filesystem
+    editText: "fs-write",
+    searchAndReplace: "fs-write",
+    createFile: "fs-write",
+    formatDocument: "fs-write",
+    getBufferContent: "fs-read",
+    findFiles: "fs-read",
+    // shell
+    runCommand: "shell",
+    runInTerminal: "shell",
+    sendTerminalCommand: "shell",
+    // outbound messaging
+    slackPostMessage: "messaging",
+    // generic network
+    sendHttpRequest: "http",
+    WebFetch: "http",
+    // issue trackers
+    githubCreateIssue: "issue",
+    createLinearIssue: "issue",
+    addLinearComment: "issue",
+    updateLinearIssue: "issue",
+    // CI / tests
+    runTests: "ci",
+    githubActions: "ci",
+    // dependency intel (read-only)
+    auditDependencies: "deps-read",
+    getSecurityAdvisories: "deps-read",
+    // recipe-tool ids — RecipeRunLog records THESE (not the MCP names), so the
+    // shadow dial attributes recipe-run steps by them. git.*/github.list_* are
+    // reads; file.* writes; slack/http are outbound. (worker-ramp-v0 dogfood)
+    "git.log_since": "vcs-read",
+    "git.stale_branches": "vcs-read",
+    "github.list_commits": "vcs-read",
+    "github.list_prs": "vcs-read",
+    "github.list_issues": "vcs-read",
+    "github.create_issue": "issue", // write — compensable (closeable) + brand-exposed
+    "file.read": "fs-read",
+    "file.write": "fs-write",
+    "file.append": "fs-write",
+    "slack.post_message": "messaging",
+    "http.post": "http",
+    "linear.list_issues": "issue-read", // read-only; reversible
+    "sentry.get_issue": "issue-read", // read-only; reversible
+    "diagnostics.get": "fs-read",
+};
+/** Domain → reversibility. The middle ramp rungs (L2/L3) only exist for a class
+ * whose reversibility is not "irreversible", so this is load-bearing. */
+const REVERSIBILITY_BY_DOMAIN = {
+    "vcs-read": "reversible",
+    "vcs-local": "reversible", // reset / reflog / restore
+    "vcs-remote": "compensable", // close PR — lossy but possible
+    "vcs-push": "compensable", // force-revert / reflog — lossy but possible
+    "vcs-merge": "compensable", // git revert on main — painful but recoverable
+    "fs-write": "reversible", // transactions + WriteEffectLedger
+    "fs-read": "reversible",
+    shell: "irreversible", // arbitrary side effects — assume unrecoverable
+    messaging: "irreversible", // a sent message can't be unsent reliably
+    http: "irreversible", // a POST may not be undoable
+    issue: "compensable", // close / delete the created issue
+    "issue-read": "reversible", // read-only issue queries
+    ci: "reversible", // re-runnable, no durable side effect
+    "deps-read": "reversible",
+    other: "irreversible",
+};
+/** Domains whose actions are externally visible — failure is reputational. */
+const BRAND_EXPOSED_DOMAINS = new Set([
+    "messaging",
+    "vcs-remote",
+    "vcs-push",
+    "vcs-merge",
+    "issue",
+    "http",
+]);
+/**
+ * The tool names this module can classify (MCP names + recipe-tool ids). Exposed
+ * so the worker-agent sandbox can enumerate every risky tool to consider
+ * blocking. NOT exhaustive of the whole MCP surface — any unknown tool classifies
+ * as `other:irreversible` and is gated at the per-step gate regardless.
+ */
+export function knownActionTools() {
+    return Object.keys(DOMAIN_BY_TOOL);
+}
+export function classifyActionClass(toolName, _params) {
+    const domain = DOMAIN_BY_TOOL[toolName] ?? "other";
+    const reversibility = REVERSIBILITY_BY_DOMAIN[domain] ?? "irreversible";
+    const blastTier = classifyTool(toolName);
+    return {
+        key: `${domain}:${reversibility}:${blastTier}`,
+        domain,
+        reversibility,
+        blastTier,
+        brandExposed: BRAND_EXPOSED_DOMAINS.has(domain),
+    };
+}
+const BLAST_MULTIPLIER = {
+    low: 2,
+    medium: 5,
+    high: 12,
+};
+const REVERSIBILITY_MULTIPLIER = {
+    reversible: 1,
+    compensable: 1.5,
+    irreversible: 3,
+};
+/**
+ * Evidence weight for one outcome. A routine success is low-information
+ * (weight 1 → the posterior climbs slowly). A failure is weighted by
+ * blast-tier × reversibility, so a high-blast irreversible failure is high
+ * information and craters the posterior (instant demote). This is the entire
+ * anti-trust-transfer-grinding defence: count alone never graduates a risky
+ * class, and one catastrophic outcome dominates a thousand trivial ones.
+ */
+const BRAND_MULTIPLIER = 1.5;
+export function outcomeWeight(actionClass, good) {
+    if (good)
+        return 1;
+    const brand = actionClass.brandExposed ? BRAND_MULTIPLIER : 1;
+    return (BLAST_MULTIPLIER[actionClass.blastTier] *
+        REVERSIBILITY_MULTIPLIER[actionClass.reversibility] *
+        brand);
+}
+/** Which ramp rungs are reachable for a class. Irreversible classes skip the
+ * safety-net rungs L2/L3 (no compensating action exists), so they must clear a
+ * higher bar to reach L4. */
+export function reachableLevels(actionClass) {
+    return actionClass.reversibility === "irreversible"
+        ? [0, 1, 4]
+        : [0, 1, 2, 3, 4];
+}
+//# sourceMappingURL=actionClass.js.map

package/dist/workers/actionClass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionClass.js","sourceRoot":"","sources":["../../src/workers/actionClass.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAiB,MAAM,gBAAgB,CAAC;AA6B7D;;;;GAIG;AACH,MAAM,cAAc,GAA2B;IAC7C,yBAAyB;IACzB,YAAY,EAAE,UAAU;IACxB,UAAU,EAAE,UAAU;IACtB,SAAS,EAAE,UAAU;IACrB,QAAQ,EAAE,UAAU;IACpB,eAAe,EAAE,UAAU;IAC3B,uEAAuE;IACvE,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,WAAW;IACxB,QAAQ,EAAE,WAAW;IACrB,6CAA6C;IAC7C,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,OAAO,EAAE,UAAU,EAAE,qCAAqC;IAC1D,cAAc,EAAE,YAAY,EAAE,8BAA8B;IAC5D,aAAa,EAAE,WAAW,EAAE,8CAA8C;IAC1E,aAAa;IACb,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,UAAU;IAC5B,UAAU,EAAE,UAAU;IACtB,cAAc,EAAE,UAAU;IAC1B,gBAAgB,EAAE,SAAS;IAC3B,SAAS,EAAE,SAAS;IACpB,QAAQ;IACR,UAAU,EAAE,OAAO;IACnB,aAAa,EAAE,OAAO;IACtB,mBAAmB,EAAE,OAAO;IAC5B,qBAAqB;IACrB,gBAAgB,EAAE,WAAW;IAC7B,kBAAkB;IAClB,eAAe,EAAE,MAAM;IACvB,QAAQ,EAAE,MAAM;IAChB,iBAAiB;IACjB,iBAAiB,EAAE,OAAO;IAC1B,iBAAiB,EAAE,OAAO;IAC1B,gBAAgB,EAAE,OAAO;IACzB,iBAAiB,EAAE,OAAO;IAC1B,aAAa;IACb,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,+BAA+B;IAC/B,iBAAiB,EAAE,WAAW;IAC9B,qBAAqB,EAAE,WAAW;IAClC,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,eAAe,EAAE,UAAU;IAC3B,oBAAoB,EAAE,UAAU;IAChC,qBAAqB,EAAE,UAAU;IACjC,iBAAiB,EAAE,UAAU;IAC7B,oBAAoB,EAAE,UAAU;IAChC,qBAAqB,EAAE,OAAO,EAAE,kDAAkD;IAClF,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,aAAa,EAAE,UAAU;IACzB,oBAAoB,EAAE,WAAW;IACjC,WAAW,EAAE,MAAM;IACnB,oBAAoB,EAAE,YAAY,EAAE,wBAAwB;IAC5D,kBAAkB,EAAE,YAAY,EAAE,wBAAwB;IAC1D,iBAAiB,EAAE,SAAS;CAC7B,CAAC;AAEF;yEACyE;AACzE,MAAM,uBAAuB,GAAkC;IAC7D,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,YAAY,EAAE,2BAA2B;IACtD,YAAY,EAAE,aAAa,EAAE,gCAAgC;IAC7D,UAAU,EAAE,aAAa,EAAE,6CAA6C;IACxE,WAAW,EAAE,aAAa,EAAE,+CAA+C;IAC3E,UAAU,EAAE,YAAY,EAAE,mCAAmC;IAC7D,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,cAAc,EAAE,gDAAgD;IACvE,SAAS,EAAE,cAAc,EAAE,0CAA0C;IACrE,IAAI,EAAE,cAAc,EAAE,6BAA6B;IACnD,KAAK,EAAE,aAAa,EAAE,mCAAmC;IACzD,YAAY,EAAE,YAAY,EAAE,0BAA0B;IACtD,EAAE,EAAE,YAAY,EAAE,sCAAsC;IACxD,WAAW,EAAE,YAAY;IACzB,KAAK,EAAE,cAAc;CACtB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,WAAW;IACX,YAAY;IACZ,UAAU;IACV,WAAW;IACX,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,OAAiC;IAEjC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC;IACnD,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC;IACxE,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO;QACL,GAAG,EAAE,GAAG,MAAM,IAAI,aAAa,IAAI,SAAS,EAAE;QAC9C,MAAM;QACN,aAAa;QACb,SAAS;QACT,YAAY,EAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAA6B;IACjD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,EAAE;CACT,CAAC;AACF,MAAM,wBAAwB,GAAkC;IAC9D,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,GAAG;IAChB,YAAY,EAAE,CAAC;CAChB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,UAAU,aAAa,CAAC,WAAwB,EAAE,IAAa;IACnE,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC;IACnB,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CACL,gBAAgB,CAAC,WAAW,CAAC,SAAS,CAAC;QACvC,wBAAwB,CAAC,WAAW,CAAC,aAAa,CAAC;QACnD,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,OAAO,WAAW,CAAC,aAAa,KAAK,cAAc;QACjD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC"}

package/dist/workers/backtest.d.ts

@@ -0,0 +1,68 @@
+import { type GraduationConfig } from "./graduation.js";
+import type { OutcomeStore } from "./outcomeStore.js";
+import { type RunRecord } from "./shadowObserver.js";
+import { type WorkerManifest } from "./worker.js";
+/**
+ * Backtest-as-DIVERGENCE (cold-start calibration; see
+ * docs/worker-autonomy-policy-gate.md §3c).
+ *
+ * Replays a worker's HISTORICAL run log and, at each risky owned action, asks:
+ * what would the trust ramp have decided AS OF THAT MOMENT (using only the
+ * evidence accrued so far — no lookahead), and how does that compare to what
+ * actually happened? This is deliberately NOT a "success rate" — replaying past
+ * outcomes scores agreement with what already happened, a censored sample. The
+ * honest, demoable metric is DIVERGENCE:
+ *
+ *   - false-allow: the ramp would have AUTO-RUN an action that turned out BAD.
+ *     The dangerous miscalibration — over-trust. This is the number that matters.
+ *   - false-gate: the ramp would have GATED an action that turned out GOOD.
+ *     The cost of caution — over-gating, not unsafe.
+ *
+ * "Agreement" = ramp-bypass on a good outcome OR ramp-queue on a bad outcome.
+ * Only risky (non-reversible) OWNED actions are scored — reversible always
+ * bypasses and unowned always queues, so neither is informative.
+ */
+export type DivergenceKind = "false-allow" | "false-gate";
+export interface BacktestDivergence {
+    classKey: string;
+    tool: string;
+    at: number;
+    ramp: "bypass" | "queue";
+    outcome: "good" | "bad";
+    kind: DivergenceKind;
+    /** Earned level the ramp was operating at when it made the call. */
+    effectiveLevel: number;
+}
+export interface BacktestReport {
+    workerId: string;
+    /** risky owned actions scored */
+    considered: number;
+    agreed: number;
+    /** ramp would auto-run a BAD action (over-trust) — the dangerous miscalibration. */
+    falseAllow: number;
+    /** ramp would gate a GOOD action (over-caution) — the cost, not unsafe. */
+    falseGate: number;
+    /** agreed / considered (0 when nothing scored). */
+    agreementRate: number;
+    divergences: BacktestDivergence[];
+}
+export interface BacktestOpts {
+    cfg?: GraduationConfig;
+    /** Wall-clock for durable-outcome labelling. Defaults to past-all-runs so the
+     *  whole history is treated as durable (a backtest looks at settled outcomes). */
+    now?: number;
+    durabilityWindowMs?: number;
+    /** When present, non-reversible durable successes are outcome-verified exactly
+     *  as the live dial does (junk → bad, unknown/null → withheld) via the shared
+     *  foldOutcome. Without it the backtest falls back to status-only labelling —
+     *  which diverges from `workers shadow` whenever dispositions exist, so the
+     *  live entry (runWorkerBacktest) always passes one. */
+    outcomeStore?: OutcomeStore;
+}
+/**
+ * Pure backtest of one worker over a set of runs. Folds outcomes chronologically
+ * (durable-outcome aware), taking the ramp's recommendation BEFORE folding each
+ * step so every decision uses only prior evidence.
+ */
+export declare function backtestWorker(worker: WorkerManifest, runs: RunRecord[], opts?: BacktestOpts): BacktestReport;
+export declare function formatBacktestReport(r: BacktestReport): string;

package/dist/workers/backtest.js

@@ -0,0 +1,113 @@
+import { categoriseHaltReason } from "../recipes/haltCategory.js";
+import { classifyActionClass } from "./actionClass.js";
+import { DEFAULT_GRADUATION_CONFIG, } from "./graduation.js";
+import { recommend } from "./shadowGate.js";
+import { DEFAULT_DURABILITY_WINDOW_MS, foldOutcome, } from "./shadowObserver.js";
+import { ownsAction, priorFor } from "./worker.js";
+import { WorkerLevelStore } from "./workerLevelStore.js";
+/**
+ * Pure backtest of one worker over a set of runs. Folds outcomes chronologically
+ * (durable-outcome aware), taking the ramp's recommendation BEFORE folding each
+ * step so every decision uses only prior evidence.
+ */
+export function backtestWorker(worker, runs, opts = {}) {
+    const store = new WorkerLevelStore();
+    const prior = priorFor(worker);
+    const cfg = opts.cfg ?? DEFAULT_GRADUATION_CONFIG;
+    const windowMs = opts.durabilityWindowMs ?? DEFAULT_DURABILITY_WINDOW_MS;
+    const sorted = [...runs]
+        .filter((r) => r.recipeName === worker.recipe)
+        .sort((a, b) => a.at - b.at);
+    // Default `now` past every run so settled history counts as durable.
+    const last = sorted.at(-1);
+    const now = opts.now ?? (last ? last.at + windowMs + 1 : 0);
+    const divergences = [];
+    let considered = 0;
+    let agreed = 0;
+    let falseAllow = 0;
+    let falseGate = 0;
+    for (const run of sorted) {
+        for (const step of run.steps) {
+            if (!step.tool || step.status === "skipped")
+                continue;
+            // Human reject/expire/cancel is a control decision, not worker evidence.
+            if (step.status === "error" &&
+                categoriseHaltReason(step.haltReason) === "approval_rejected")
+                continue;
+            const ac = classifyActionClass(step.tool);
+            // Durable-outcome fold — the SAME labelling the live dial/gate uses (shared
+            // foldOutcome): junk → bad, unknown/null → withheld, pending → withheld.
+            const decision = foldOutcome(step, run.at, {
+                now,
+                windowMs,
+                outcomeStore: opts.outcomeStore,
+            });
+            // Score only risky OWNED actions with a KNOWN durable outcome. A withheld
+            // step (pending, or unknown disposition) has no ground truth to calibrate
+            // against, so it is excluded from the divergence sample rather than counted
+            // as a spurious "good" (which is exactly the status-only bug this fixes).
+            if (ac.reversibility !== "reversible" &&
+                ownsAction(worker, ac) &&
+                decision.fold) {
+                const rec = recommend(worker, step.tool, undefined, store); // as-of decision
+                const outcomeGood = decision.good;
+                const rampBypass = rec.decision === "bypass";
+                considered++;
+                if (rampBypass === outcomeGood) {
+                    agreed++;
+                }
+                else {
+                    const kind = rampBypass
+                        ? "false-allow"
+                        : "false-gate";
+                    if (rampBypass)
+                        falseAllow++;
+                    else
+                        falseGate++;
+                    divergences.push({
+                        classKey: ac.key,
+                        tool: step.tool,
+                        at: run.at,
+                        ramp: rec.decision,
+                        outcome: outcomeGood ? "good" : "bad",
+                        kind,
+                        effectiveLevel: rec.effectiveLevel,
+                    });
+                }
+            }
+            // Fold so the ramp evolves over the replay (skips withheld steps).
+            if (decision.fold) {
+                store.apply(worker.id, { toolName: step.tool, good: decision.good, at: run.at }, { prior, cfg });
+            }
+        }
+    }
+    return {
+        workerId: worker.id,
+        considered,
+        agreed,
+        falseAllow,
+        falseGate,
+        agreementRate: considered ? agreed / considered : 0,
+        divergences,
+    };
+}
+export function formatBacktestReport(r) {
+    if (r.considered === 0) {
+        return `▸ ${r.workerId}: no risky owned actions in the replay window — nothing to calibrate.\n`;
+    }
+    const pct = (r.agreementRate * 100).toFixed(0);
+    const lines = [
+        `▸ ${r.workerId} — backtest over ${r.considered} risky owned action(s)`,
+        `    agreed with the outcome: ${r.agreed}/${r.considered} (${pct}%)`,
+        `    false-allow: ${r.falseAllow}  (ramp would AUTO-RUN a bad action — over-trust)`,
+        `    false-gate:  ${r.falseGate}  (ramp would gate a good action — cost of caution)`,
+    ];
+    const fa = r.divergences.filter((d) => d.kind === "false-allow").slice(0, 5);
+    if (fa.length) {
+        lines.push("    ⚠ false-allow divergences (the ones to look at):");
+        for (const d of fa)
+            lines.push(`      ${d.tool} [${d.classKey}] at L${d.effectiveLevel} → ramp bypass, outcome BAD`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=backtest.js.map

package/dist/workers/backtest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backtest.js","sourceRoot":"","sources":["../../src/workers/backtest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,yBAAyB,GAE1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,4BAA4B,EAC5B,WAAW,GAEZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAuB,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAgEzD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,IAAiB,EACjB,OAAqB,EAAE;IAEvB,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,yBAAyB,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;IACzE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/B,qEAAqE;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5D,MAAM,WAAW,GAAyB,EAAE,CAAC;IAC7C,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YACtD,yEAAyE;YACzE,IACE,IAAI,CAAC,MAAM,KAAK,OAAO;gBACvB,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,mBAAmB;gBAE7D,SAAS;YAEX,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,4EAA4E;YAC5E,yEAAyE;YACzE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;gBACzC,GAAG;gBACH,QAAQ;gBACR,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC,CAAC;YAEH,0EAA0E;YAC1E,0EAA0E;YAC1E,4EAA4E;YAC5E,0EAA0E;YAC1E,IACE,EAAE,CAAC,aAAa,KAAK,YAAY;gBACjC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,EACb,CAAC;gBACD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB;gBAC7E,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAClC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAC7C,UAAU,EAAE,CAAC;gBACb,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;oBAC/B,MAAM,EAAE,CAAC;gBACX,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAmB,UAAU;wBACrC,CAAC,CAAC,aAAa;wBACf,CAAC,CAAC,YAAY,CAAC;oBACjB,IAAI,UAAU;wBAAE,UAAU,EAAE,CAAC;;wBACxB,SAAS,EAAE,CAAC;oBACjB,WAAW,CAAC,IAAI,CAAC;wBACf,QAAQ,EAAE,EAAE,CAAC,GAAG;wBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,IAAI,EAAE,GAAG,CAAC,QAAQ;wBAClB,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;wBACrC,IAAI;wBACJ,cAAc,EAAE,GAAG,CAAC,cAAc;qBACnC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,CAAC,KAAK,CACT,MAAM,CAAC,EAAE,EACT,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EACxD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,UAAU;QACV,MAAM;QACN,UAAU;QACV,SAAS;QACT,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACnD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAiB;IACpD,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,QAAQ,yEAAyE,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAa;QACtB,KAAK,CAAC,CAAC,QAAQ,oBAAoB,CAAC,CAAC,UAAU,wBAAwB;QACvE,gCAAgC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI;QACpE,oBAAoB,CAAC,CAAC,UAAU,mDAAmD;QACnF,oBAAoB,CAAC,CAAC,SAAS,qDAAqD;KACrF,CAAC;IACF,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,EAAE;YAChB,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,cAAc,6BAA6B,CACrF,CAAC;IACN,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/workers/contextRisk.d.ts

@@ -0,0 +1,35 @@
+import type { TrustLevel } from "./trustLevel.js";
+/**
+ * Context-risk — the FAST, situational half of the autonomy decision.
+ *
+ * Earned trust answers "is this worker generally reliable on this action-class?"
+ * (slow, accrued over many runs). Context-risk answers a DIFFERENT, orthogonal
+ * question: "is THIS situation safe to act in RIGHT NOW?" — computed per-action
+ * from signals the bridge already exposes (open diagnostics in the touched
+ * files, test coverage, git hotspot-ness, diff size, CI status). It has no
+ * cold-start: it is fully computable on day one, so it can de-rate autonomy from
+ * the very first action while the trust posterior is still accruing.
+ *
+ * It is a DE-RATER only: it can lower the effective autonomy level, never raise
+ * it (never-widen). Combined with earned trust + the autonomy ceiling, the gate
+ * becomes `min(earned, ceiling, contextCeiling)` — a worker stays at its earned
+ * level when the situation is clean and is throttled toward propose-only as live
+ * risk climbs. This is the dimension "approve-once / approve-similar" structurally
+ * cannot model. See docs/worker-autonomy-policy-gate.md §3a.
+ */
+export interface ContextRisk {
+    /** 0 (clean) … 1 (dangerous). Out-of-range / NaN is treated as "unknown". */
+    score: number;
+    /** Human-readable contributors (e.g. "CI red", "diff 1.2k lines", "hotspot
+     *  file"), surfaced in the gate reason + audit trail. */
+    reasons?: string[];
+}
+/**
+ * Map a context-risk score to the MAX autonomy rung permitted in this situation.
+ * DESCENDING only — higher risk ⇒ lower ceiling. Returns L4 (no de-rate) for a
+ * clean OR unknown/unmeasurable score: context-risk adds caution when danger is
+ * MEASURED; when it can't be measured the base gate (earned trust + ceiling)
+ * still applies its own floor, so an unknown situation must not silently throttle
+ * everything to zero.
+ */
+export declare function contextRiskCeiling(score: number): TrustLevel;

package/dist/workers/contextRisk.js

@@ -0,0 +1,20 @@
+/**
+ * Map a context-risk score to the MAX autonomy rung permitted in this situation.
+ * DESCENDING only — higher risk ⇒ lower ceiling. Returns L4 (no de-rate) for a
+ * clean OR unknown/unmeasurable score: context-risk adds caution when danger is
+ * MEASURED; when it can't be measured the base gate (earned trust + ceiling)
+ * still applies its own floor, so an unknown situation must not silently throttle
+ * everything to zero.
+ */
+export function contextRiskCeiling(score) {
+    if (!Number.isFinite(score) || score <= 0)
+        return 4; // clean / unknown → no de-rate
+    if (score >= 0.8)
+        return 0; // dangerous → propose-only: every risky action gated
+    if (score >= 0.5)
+        return 1; // elevated → reversible only flows freely
+    if (score >= 0.3)
+        return 2; // moderate → compensable ok, irreversible still gated
+    return 4; // mild → no de-rate
+}
+//# sourceMappingURL=contextRisk.js.map

package/dist/workers/contextRisk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextRisk.js","sourceRoot":"","sources":["../../src/workers/contextRisk.ts"],"names":[],"mappings":"AA4BA;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,+BAA+B;IACpF,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAC,qDAAqD;IACjF,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAC,0CAA0C;IACtE,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC,CAAC,sDAAsD;IAClF,OAAO,CAAC,CAAC,CAAC,oBAAoB;AAChC,CAAC"}

package/dist/workers/contextRiskScorer.d.ts

@@ -0,0 +1,48 @@
+import type { ContextRisk } from "./contextRisk.js";
+/**
+ * The live producer behind the context-risk seam (workerGate / contextRisk.ts).
+ * Gathers cheap, dependency-light situational signals from the workspace and
+ * scores them into a `ContextRisk` the gate uses as a DESCENDING de-rater.
+ *
+ * Signals are deliberately the ones reliably available server-side during a
+ * recipe run (the bridge runs in a git repo): working-tree size + which branch.
+ * Diagnostics / coverage / CI are richer but require the extension / network and
+ * are added later. Everything is fail-soft: an unavailable signal simply doesn't
+ * contribute, and a total failure yields score 0 (no de-rate, never widens).
+ * See docs/worker-autonomy-policy-gate.md §3a.
+ */
+/** Raw situational signals. All optional — absent ⇒ no contribution. */
+export interface ContextSignals {
+    /** Uncommitted lines changed (added + deleted) vs HEAD. */
+    diffLines?: number;
+    /** Files with uncommitted changes vs HEAD. */
+    dirtyFiles?: number;
+    /** HEAD is the default branch (main/master) — acting on trunk is riskier
+     *  than on a feature branch that can be reviewed before merge. */
+    onDefaultBranch?: boolean;
+}
+/**
+ * Pure scorer: signals → ContextRisk (0..1 + human reasons). Each signal
+ * contributes risk independently and they combine by NOISY-OR
+ * (`1 − ∏(1 − sᵢ)`), so several moderate signals compound toward "act with
+ * caution" without any single one needing to be severe. Higher = more dangerous
+ * to act RIGHT NOW. Pure + deterministic.
+ */
+export declare function scoreContextRisk(signals: ContextSignals): ContextRisk;
+/** Injectable command runner (returns stdout). Defaults to the bridge's
+ *  allowlisted `execSafe` over `cwd`. Exposed so tests supply fake git output. */
+export type ExecFn = (cmd: string, args: string[]) => Promise<string>;
+/**
+ * Gather git working-tree signals. Fully fail-soft: any git error leaves the
+ * corresponding signal undefined (→ no contribution). Never throws.
+ */
+export declare function collectGitContextSignals(opts: {
+    cwd: string;
+    exec?: ExecFn;
+}): Promise<ContextSignals>;
+/** Convenience: collect + score in one fail-soft call. Returns undefined when
+ *  the situation is clean (score 0) so callers can omit the field. */
+export declare function resolveGitContextRisk(opts: {
+    cwd: string;
+    exec?: ExecFn;
+}): Promise<ContextRisk | undefined>;

package/dist/workers/contextRiskScorer.js

@@ -0,0 +1,94 @@
+import { execSafe } from "../tools/utils.js";
+/**
+ * Pure scorer: signals → ContextRisk (0..1 + human reasons). Each signal
+ * contributes risk independently and they combine by NOISY-OR
+ * (`1 − ∏(1 − sᵢ)`), so several moderate signals compound toward "act with
+ * caution" without any single one needing to be severe. Higher = more dangerous
+ * to act RIGHT NOW. Pure + deterministic.
+ */
+export function scoreContextRisk(signals) {
+    const contribs = [];
+    if (signals.diffLines !== undefined) {
+        if (signals.diffLines >= 2000)
+            contribs.push({
+                score: 0.9,
+                reason: `huge uncommitted diff (${signals.diffLines} lines)`,
+            });
+        else if (signals.diffLines >= 500)
+            contribs.push({
+                score: 0.5,
+                reason: `large uncommitted diff (${signals.diffLines} lines)`,
+            });
+        else if (signals.diffLines >= 200)
+            contribs.push({
+                score: 0.3,
+                reason: `sizeable uncommitted diff (${signals.diffLines} lines)`,
+            });
+    }
+    if (signals.dirtyFiles !== undefined && signals.dirtyFiles >= 20)
+        contribs.push({
+            score: 0.5,
+            reason: `${signals.dirtyFiles} files with uncommitted changes`,
+        });
+    if (signals.onDefaultBranch)
+        contribs.push({
+            score: 0.3,
+            reason: "operating directly on the default branch",
+        });
+    const score = contribs.length === 0
+        ? 0
+        : 1 - contribs.reduce((p, c) => p * (1 - c.score), 1);
+    return {
+        score,
+        ...(contribs.length > 0 && { reasons: contribs.map((c) => c.reason) }),
+    };
+}
+/**
+ * Gather git working-tree signals. Fully fail-soft: any git error leaves the
+ * corresponding signal undefined (→ no contribution). Never throws.
+ */
+export async function collectGitContextSignals(opts) {
+    const exec = opts.exec ??
+        (async (cmd, args) => (await execSafe(cmd, args, { cwd: opts.cwd, timeout: 5000 })).stdout);
+    const signals = {};
+    try {
+        // `diff HEAD` = staged + unstaged vs the last commit (the full uncommitted
+        // delta). `--numstat` is `<added>\t<deleted>\t<path>` per file ("-" binary).
+        const numstat = await exec("git", ["diff", "HEAD", "--numstat"]);
+        let lines = 0;
+        let files = 0;
+        for (const row of numstat.split("\n")) {
+            const m = /^(\d+|-)\t(\d+|-)\t/.exec(row);
+            if (!m)
+                continue;
+            files++;
+            lines +=
+                (m[1] === "-" ? 0 : Number(m[1])) + (m[2] === "-" ? 0 : Number(m[2]));
+        }
+        signals.diffLines = lines;
+        signals.dirtyFiles = files;
+    }
+    catch {
+        /* git unavailable / not a repo → leave diff signals undefined */
+    }
+    try {
+        const branch = (await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+        signals.onDefaultBranch = branch === "main" || branch === "master";
+    }
+    catch {
+        /* ignore */
+    }
+    return signals;
+}
+/** Convenience: collect + score in one fail-soft call. Returns undefined when
+ *  the situation is clean (score 0) so callers can omit the field. */
+export async function resolveGitContextRisk(opts) {
+    try {
+        const risk = scoreContextRisk(await collectGitContextSignals(opts));
+        return risk.score > 0 ? risk : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=contextRiskScorer.js.map

package/dist/workers/contextRiskScorer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextRiskScorer.js","sourceRoot":"","sources":["../../src/workers/contextRiskScorer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AA2B7C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACtD,MAAM,QAAQ,GAA6C,EAAE,CAAC;IAE9D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,0BAA0B,OAAO,CAAC,SAAS,SAAS;aAC7D,CAAC,CAAC;aACA,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,2BAA2B,OAAO,CAAC,SAAS,SAAS;aAC9D,CAAC,CAAC;aACA,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,8BAA8B,OAAO,CAAC,SAAS,SAAS;aACjE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE;QAC9D,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,iCAAiC;SAC/D,CAAC,CAAC;IACL,IAAI,OAAO,CAAC,eAAe;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,0CAA0C;SACnD,CAAC,CAAC;IAEL,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAG9C;IACC,MAAM,IAAI,GACR,IAAI,CAAC,IAAI;QACT,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACnB,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,KAAK,EAAE,CAAC;YACR,KAAK;gBACH,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;QAC1B,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CACb,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CACzD,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,eAAe,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;sEACsE;AACtE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAG3C;IACC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/workers/graduation.d.ts

@@ -0,0 +1,61 @@
+import { type Posterior, type TrustLevel } from "./trustLevel.js";
+/**
+ * Folds outcomes into a (worker × action-class) trust state and decides
+ * promotions/demotions with the asymmetry + hysteresis the ramp requires:
+ *   - DEMOTE is instant and can jump multiple rungs (one catastrophic outcome
+ *     craters the posterior; we honor it immediately, even mid-dwell);
+ *   - PROMOTE is gated by dwell-time (real elapsed time since the last level
+ *     change) AND a post-demote cooldown, and climbs only to the NEXT reachable
+ *     rung — so reaching L4 needs both sustained evidence and sustained time.
+ * Every level change emits an event — the promotion/demotion log is the
+ * compliance/audit artifact.
+ */
+export interface Outcome {
+    toolName: string;
+    good: boolean;
+    /** epoch ms (passed in — the runtime has no Date.now() in pure code). */
+    at: number;
+    params?: Record<string, unknown>;
+}
+export interface ClassTrustState {
+    classKey: string;
+    posterior: Posterior;
+    prior: Posterior;
+    level: TrustLevel;
+    /** epoch ms of the last level change (drives dwell). */
+    lastChangeAt: number;
+    /** epoch ms before which promotions are blocked (post-demote cooldown). */
+    demoteUntil: number;
+    observations: number;
+    /**
+     * The `minEvidenceForGraduation` threshold in effect when this class last
+     * promoted ABOVE L1. The novel-class floor is a cold-start gate: once a class
+     * has cleared it, RAISING the config later must not retroactively re-apply the
+     * floor and demote an already-earned level. We honour the threshold the class
+     * actually graduated under. `undefined` = never promoted above L1 (cold-start;
+     * the current config applies in full).
+     */
+    minEvidenceAtLastPromotion?: number;
+}
+export interface GraduationConfig {
+    dwellMs: number;
+    demoteCooldownMs: number;
+    k?: number;
+    minEvidenceForGraduation?: number;
+}
+export declare const DEFAULT_GRADUATION_CONFIG: GraduationConfig;
+export interface GraduationEvent {
+    type: "promote" | "demote";
+    classKey: string;
+    from: TrustLevel;
+    to: TrustLevel;
+    at: number;
+    lcb: number;
+    evidence: number;
+    reason: string;
+}
+export declare function initialState(classKey: string, prior: Posterior, at?: number): ClassTrustState;
+export declare function graduate(state: ClassTrustState, outcome: Outcome, cfg?: GraduationConfig): {
+    state: ClassTrustState;
+    event?: GraduationEvent;
+};