patchwork-os 0.2.0-beta.9.canary.93 → 1.1.0-beta.1

package/dist/workers/graduation.js

@@ -0,0 +1,112 @@
+import { classifyActionClass, outcomeWeight, reachableLevels, } from "./actionClass.js";
+import { applyOutcome, levelFromPosterior, } from "./trustLevel.js";
+/** Default novel-class floor — MUST match levelFromPosterior's internal `?? 10`
+ *  so a config that omits the field behaves identically through both paths. */
+const DEFAULT_MIN_EVIDENCE = 10;
+export const DEFAULT_GRADUATION_CONFIG = {
+    dwellMs: 6 * 60 * 60 * 1000, // 6h between climbs
+    demoteCooldownMs: 24 * 60 * 60 * 1000, // 24h freeze after a fall
+    minEvidenceForGraduation: DEFAULT_MIN_EVIDENCE,
+};
+export function initialState(classKey, prior, at = 0) {
+    return {
+        classKey,
+        posterior: prior,
+        prior,
+        level: 0,
+        lastChangeAt: at,
+        demoteUntil: 0,
+        observations: 0,
+    };
+}
+export function graduate(state, outcome, cfg = DEFAULT_GRADUATION_CONFIG) {
+    const ac = classifyActionClass(outcome.toolName, outcome.params);
+    const weight = outcomeWeight(ac, outcome.good);
+    const posterior = applyOutcome(state.posterior, outcome.good, weight);
+    const observations = state.observations + 1;
+    // Novel-class floor threshold. For a class already ABOVE L1, honour the
+    // (possibly looser) threshold it graduated under so a later config TIGHTENING
+    // can't retroactively floor it back to L1 and trigger a spurious demote. A
+    // class still in cold-start (≤ L1) always faces the current config in full.
+    // `Math.min` also lets a config LOOSENING apply immediately. Genuine
+    // evidence-based demotions (LCB crash from real failures) are unaffected —
+    // they don't go through the floor.
+    // Resolve to a concrete number (matches levelFromPosterior's internal `?? 10`)
+    // so the recorded threshold is always defined.
+    const cfgMinEvidence = cfg.minEvidenceForGraduation ?? DEFAULT_MIN_EVIDENCE;
+    const floorMinEvidence = state.level > 1 && state.minEvidenceAtLastPromotion !== undefined
+        ? Math.min(cfgMinEvidence, state.minEvidenceAtLastPromotion)
+        : cfgMinEvidence;
+    const result = levelFromPosterior(posterior, state.prior, {
+        k: cfg.k,
+        minEvidenceForGraduation: floorMinEvidence,
+        reachable: reachableLevels(ac),
+    });
+    const candidate = result.level;
+    const base = {
+        ...state,
+        posterior,
+        observations,
+    };
+    // DEMOTE — instant, may skip rungs.
+    if (candidate < state.level) {
+        const next = {
+            ...base,
+            level: candidate,
+            lastChangeAt: outcome.at,
+            demoteUntil: outcome.at + cfg.demoteCooldownMs,
+        };
+        return {
+            state: next,
+            event: {
+                type: "demote",
+                classKey: state.classKey,
+                from: state.level,
+                to: candidate,
+                at: outcome.at,
+                lcb: result.lcb,
+                evidence: result.evidence,
+                reason: `blast-weighted failure (weight=${weight})`,
+            },
+        };
+    }
+    // PROMOTE — gated by dwell + cooldown, one reachable rung at a time.
+    if (candidate > state.level) {
+        const dwellOk = outcome.at >= state.lastChangeAt + cfg.dwellMs;
+        const cooldownOk = outcome.at >= state.demoteUntil;
+        if (dwellOk && cooldownOk) {
+            const nextRung = reachableLevels(ac)
+                .filter((r) => r > state.level && r <= candidate)
+                .sort((a, b) => a - b)[0];
+            if (nextRung !== undefined) {
+                const to = nextRung;
+                return {
+                    state: {
+                        ...base,
+                        level: to,
+                        lastChangeAt: outcome.at,
+                        // Record the floor it just cleared (only meaningful above L1, where
+                        // the floor actually gates). Keeps the running threshold the class
+                        // has demonstrably satisfied, for the retroactive-demotion guard.
+                        ...(to > 1 && {
+                            minEvidenceAtLastPromotion: floorMinEvidence,
+                        }),
+                    },
+                    event: {
+                        type: "promote",
+                        classKey: state.classKey,
+                        from: state.level,
+                        to,
+                        at: outcome.at,
+                        lcb: result.lcb,
+                        evidence: result.evidence,
+                        reason: `sustained evidence (lcb=${result.lcb.toFixed(3)})`,
+                    },
+                };
+            }
+        }
+    }
+    // No level change — posterior still updates.
+    return { state: base };
+}
+//# sourceMappingURL=graduation.js.map

package/dist/workers/graduation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graduation.js","sourceRoot":"","sources":["../../src/workers/graduation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EACnB,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,kBAAkB,GAGnB,MAAM,iBAAiB,CAAC;AAkDzB;+EAC+E;AAC/E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,oBAAoB;IACjD,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,0BAA0B;IACjE,wBAAwB,EAAE,oBAAoB;CAC/C,CAAC;AAaF,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,KAAgB,EAChB,EAAE,GAAG,CAAC;IAEN,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,KAAK;QACL,KAAK,EAAE,CAAC;QACR,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,KAAsB,EACtB,OAAgB,EAChB,MAAwB,yBAAyB;IAEjD,MAAM,EAAE,GAAgB,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC;IAE5C,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,2EAA2E;IAC3E,mCAAmC;IACnC,+EAA+E;IAC/E,+CAA+C;IAC/C,MAAM,cAAc,GAAG,GAAG,CAAC,wBAAwB,IAAI,oBAAoB,CAAC;IAC5E,MAAM,gBAAgB,GACpB,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,0BAA0B,KAAK,SAAS;QAC/D,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,0BAA0B,CAAC;QAC5D,CAAC,CAAC,cAAc,CAAC;IAErB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE;QACxD,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,wBAAwB,EAAE,gBAAgB;QAC1C,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;IAE/B,MAAM,IAAI,GAAoB;QAC5B,GAAG,KAAK;QACR,SAAS;QACT,YAAY;KACb,CAAC;IAEF,oCAAoC;IACpC,IAAI,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAoB;YAC5B,GAAG,IAAI;YACP,KAAK,EAAE,SAAS;YAChB,YAAY,EAAE,OAAO,CAAC,EAAE;YACxB,WAAW,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,gBAAgB;SAC/C,CAAC;QACF,OAAO;YACL,KAAK,EAAE,IAAI;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,KAAK;gBACjB,EAAE,EAAE,SAAS;gBACb,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,kCAAkC,MAAM,GAAG;aACpD;SACF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,IAAI,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC;QAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,WAAW,CAAC;QACnD,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,CAAC;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC;iBAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,EAAE,GAAG,QAAsB,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE;wBACL,GAAG,IAAI;wBACP,KAAK,EAAE,EAAE;wBACT,YAAY,EAAE,OAAO,CAAC,EAAE;wBACxB,oEAAoE;wBACpE,mEAAmE;wBACnE,kEAAkE;wBAClE,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI;4BACZ,0BAA0B,EAAE,gBAAgB;yBAC7C,CAAC;qBACH;oBACD,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,IAAI,EAAE,KAAK,CAAC,KAAK;wBACjB,EAAE;wBACF,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,MAAM,EAAE,2BAA2B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;qBAC5D;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/workers/outcomeStore.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Outcome disposition for a filed issue. Drives the trust signal the ramp
+ * folds in once the durability window has elapsed:
+ *
+ *   confirmed — issue closed-as-completed or labelled valid. Strong positive:
+ *               the worker's filing was real and accepted. Counts as good:true
+ *               with full weight (same as today, but now human-verified).
+ *   junk      — issue closed-as-not-planned, labelled invalid/duplicate/wontfix,
+ *               or otherwise dismissed. Strong negative: the worker filed noise.
+ *               Flipped to good:false in trust-replay — junk must lower trust,
+ *               not be neutral (surviving 24h unopened ≠ correctness).
+ *   unknown   — issue still open past the window, or no signal yet. WITHHELD —
+ *               not folded as evidence at all (an unactioned filing must not
+ *               earn trust just by sitting unopened; trust-by-neglect fix,
+ *               #1064). A null return from getDisposition is treated identically.
+ */
+export type OutcomeDisposition = "confirmed" | "junk" | "unknown";
+/**
+ * The directory that holds `outcome-log.jsonl`. Honors `PATCHWORK_HOME` (when
+ * set) so the WRITE path — `patchwork outcomes confirm|reject`, the
+ * outcome-ingester, and `POST /outcomes` — and the READ path — the trust-replay
+ * dial + the live gate in `runWorkerShadow` — always resolve to the SAME file.
+ * An explicit `override` (a test tmp dir, or the shadow's `opts.patchworkDir`)
+ * wins. This is the single source of truth for the log location: resolving it
+ * inconsistently on the read vs write side silently breaks the confirm loop on
+ * any box that sets `PATCHWORK_HOME` (a dashboard/CLI confirm writes one file
+ * while the dial reads another).
+ */
+export declare function resolveOutcomeLogDir(override?: string): string;
+export interface OutcomeRecord {
+    /** GitHub issue URL — the lookup key. */
+    issueUrl: string;
+    disposition: OutcomeDisposition;
+    /** Epoch ms when this record was written by the ingester. */
+    checkedAt: number;
+    /** Optional context for auditing. */
+    recipeName?: string;
+    workerClass?: string;
+}
+/**
+ * Persist + query outcome dispositions for filed issues.
+ *
+ * Storage: append-only JSONL at `~/.patchwork/outcome-log.jsonl` (one record
+ * per line). Later writes for the same issueUrl supersede earlier ones — the
+ * in-memory cache always resolves to the LAST record for a URL (last-writer-
+ * wins). This lets the ingester update a disposition as an issue evolves
+ * (e.g. open → closed-as-completed over days).
+ *
+ * Write path: `upsert()` — called by the outcome-ingester cron recipe.
+ * Read path: `getDisposition(url)` — called by WorkerShadowObserver.ingestRun
+ *             on the hot trust-replay path. Cache is lazy-loaded once per
+ *             instance; create a new instance per trust-replay (the observer
+ *             already does one replay per gate decision).
+ */
+export declare class OutcomeStore {
+    private readonly logPath;
+    /** Lazy-loaded from disk. null = not yet loaded. */
+    private _cache;
+    constructor(patchworkDir: string);
+    /** Last-writer-wins map of issueUrl → disposition. Loaded once per instance. */
+    private get cache();
+    /**
+     * Disposition for `issueUrl`, or null when no record exists.
+     * Null is treated by trust-replay as "unknown" — WITHHELD (not folded as
+     * evidence). A filing with no recorded disposition can neither raise nor
+     * lower trust. (#1064)
+     */
+    getDisposition(issueUrl: string): OutcomeDisposition | null;
+    /**
+     * Persist a disposition for `issueUrl`. Later calls supersede earlier ones
+     * (both on disk via append, and in the in-memory cache).
+     */
+    upsert(record: OutcomeRecord): void;
+    /** All records (deduped, last-writer-wins). For reporting / ingester diffing. */
+    readAll(): OutcomeRecord[];
+}
+/**
+ * Map a GitHub issue's state/labels to an OutcomeDisposition.
+ * Pure function — used both by the ingester recipe agent prompt and by tests.
+ *
+ * Junk signals (any one → junk):
+ *   - state_reason: "not_planned"
+ *   - labels containing: "invalid", "duplicate", "wontfix", "won't fix",
+ *     "not a bug", "by design", "spam"
+ *
+ * Confirmed signals (issue closed with a positive signal):
+ *   - state: "closed" + state_reason: "completed" (GitHub's default close)
+ *   - labels containing: "patchwork:valid", "confirmed", "verified"
+ *
+ * Unknown: still open, or closed with no clear signal.
+ */
+export declare function classifyIssueDisposition(issue: {
+    state?: string;
+    state_reason?: string | null;
+    labels?: Array<string | {
+        name?: string;
+    }>;
+}): OutcomeDisposition;

package/dist/workers/outcomeStore.js

@@ -0,0 +1,146 @@
+import { appendFileSync, existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+/**
+ * The directory that holds `outcome-log.jsonl`. Honors `PATCHWORK_HOME` (when
+ * set) so the WRITE path — `patchwork outcomes confirm|reject`, the
+ * outcome-ingester, and `POST /outcomes` — and the READ path — the trust-replay
+ * dial + the live gate in `runWorkerShadow` — always resolve to the SAME file.
+ * An explicit `override` (a test tmp dir, or the shadow's `opts.patchworkDir`)
+ * wins. This is the single source of truth for the log location: resolving it
+ * inconsistently on the read vs write side silently breaks the confirm loop on
+ * any box that sets `PATCHWORK_HOME` (a dashboard/CLI confirm writes one file
+ * while the dial reads another).
+ */
+export function resolveOutcomeLogDir(override) {
+    return (override ?? process.env.PATCHWORK_HOME ?? path.join(homedir(), ".patchwork"));
+}
+/**
+ * Persist + query outcome dispositions for filed issues.
+ *
+ * Storage: append-only JSONL at `~/.patchwork/outcome-log.jsonl` (one record
+ * per line). Later writes for the same issueUrl supersede earlier ones — the
+ * in-memory cache always resolves to the LAST record for a URL (last-writer-
+ * wins). This lets the ingester update a disposition as an issue evolves
+ * (e.g. open → closed-as-completed over days).
+ *
+ * Write path: `upsert()` — called by the outcome-ingester cron recipe.
+ * Read path: `getDisposition(url)` — called by WorkerShadowObserver.ingestRun
+ *             on the hot trust-replay path. Cache is lazy-loaded once per
+ *             instance; create a new instance per trust-replay (the observer
+ *             already does one replay per gate decision).
+ */
+export class OutcomeStore {
+    logPath;
+    /** Lazy-loaded from disk. null = not yet loaded. */
+    _cache = null;
+    constructor(patchworkDir) {
+        this.logPath = path.join(patchworkDir, "outcome-log.jsonl");
+    }
+    /** Last-writer-wins map of issueUrl → disposition. Loaded once per instance. */
+    get cache() {
+        if (this._cache)
+            return this._cache;
+        this._cache = new Map();
+        if (!existsSync(this.logPath))
+            return this._cache;
+        const text = readFileSync(this.logPath, "utf-8");
+        for (const line of text.split("\n")) {
+            const t = line.trim();
+            if (!t)
+                continue;
+            try {
+                const r = JSON.parse(t);
+                if (r.issueUrl && r.disposition) {
+                    this._cache.set(r.issueUrl, r.disposition);
+                }
+            }
+            catch {
+                /* skip malformed lines */
+            }
+        }
+        return this._cache;
+    }
+    /**
+     * Disposition for `issueUrl`, or null when no record exists.
+     * Null is treated by trust-replay as "unknown" — WITHHELD (not folded as
+     * evidence). A filing with no recorded disposition can neither raise nor
+     * lower trust. (#1064)
+     */
+    getDisposition(issueUrl) {
+        return this.cache.get(issueUrl) ?? null;
+    }
+    /**
+     * Persist a disposition for `issueUrl`. Later calls supersede earlier ones
+     * (both on disk via append, and in the in-memory cache).
+     */
+    upsert(record) {
+        const line = `${JSON.stringify(record)}\n`;
+        appendFileSync(this.logPath, line, "utf-8");
+        // Update cache so the same instance sees its own write immediately.
+        if (this._cache)
+            this._cache.set(record.issueUrl, record.disposition);
+    }
+    /** All records (deduped, last-writer-wins). For reporting / ingester diffing. */
+    readAll() {
+        // Re-parse to get full records (cache only stores disposition).
+        const seen = new Map();
+        if (!existsSync(this.logPath))
+            return [];
+        const text = readFileSync(this.logPath, "utf-8");
+        for (const line of text.split("\n")) {
+            const t = line.trim();
+            if (!t)
+                continue;
+            try {
+                const r = JSON.parse(t);
+                if (r.issueUrl && r.disposition)
+                    seen.set(r.issueUrl, r);
+            }
+            catch {
+                /* skip malformed */
+            }
+        }
+        return Array.from(seen.values());
+    }
+}
+/**
+ * Map a GitHub issue's state/labels to an OutcomeDisposition.
+ * Pure function — used both by the ingester recipe agent prompt and by tests.
+ *
+ * Junk signals (any one → junk):
+ *   - state_reason: "not_planned"
+ *   - labels containing: "invalid", "duplicate", "wontfix", "won't fix",
+ *     "not a bug", "by design", "spam"
+ *
+ * Confirmed signals (issue closed with a positive signal):
+ *   - state: "closed" + state_reason: "completed" (GitHub's default close)
+ *   - labels containing: "patchwork:valid", "confirmed", "verified"
+ *
+ * Unknown: still open, or closed with no clear signal.
+ */
+export function classifyIssueDisposition(issue) {
+    const labelNames = (issue.labels ?? [])
+        .map((l) => (typeof l === "string" ? l : (l.name ?? "")))
+        .map((s) => s.toLowerCase());
+    const JUNK_LABELS = [
+        "invalid",
+        "duplicate",
+        "wontfix",
+        "won't fix",
+        "not a bug",
+        "by design",
+        "spam",
+    ];
+    const CONFIRMED_LABELS = ["patchwork:valid", "confirmed", "verified"];
+    if (JUNK_LABELS.some((j) => labelNames.some((l) => l.includes(j))))
+        return "junk";
+    if (issue.state_reason === "not_planned")
+        return "junk";
+    if (CONFIRMED_LABELS.some((c) => labelNames.some((l) => l.includes(c))))
+        return "confirmed";
+    if (issue.state === "closed" && issue.state_reason === "completed")
+        return "confirmed";
+    return "unknown";
+}
+//# sourceMappingURL=outcomeStore.js.map

package/dist/workers/outcomeStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomeStore.js","sourceRoot":"","sources":["../../src/workers/outcomeStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAoB7B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiB;IACpD,OAAO,CACL,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAC7E,CAAC;AACJ,CAAC;AAaD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,YAAY;IACN,OAAO,CAAS;IACjC,oDAAoD;IAC5C,MAAM,GAA2C,IAAI,CAAC;IAE9D,YAAY,YAAoB;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IAED,gFAAgF;IAChF,IAAY,KAAK;QACf,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAkB,CAAC;gBACzC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;oBAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,QAAgB;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAqB;QAC1B,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3C,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,oEAAoE;QACpE,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,iFAAiF;IACjF,OAAO;QACL,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAkB,CAAC;gBACzC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW;oBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG;QAClB,SAAS;QACT,WAAW;QACX,SAAS;QACT,WAAW;QACX,WAAW;QACX,WAAW;QACX,MAAM;KACP,CAAC;IACF,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAEtE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,IAAI,KAAK,CAAC,YAAY,KAAK,aAAa;QAAE,OAAO,MAAM,CAAC;IAExD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,WAAW,CAAC;IACrB,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,KAAK,WAAW;QAChE,OAAO,WAAW,CAAC;IAErB,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/workers/outcomesCli.d.ts

@@ -0,0 +1,34 @@
+import type { OutcomeRecord, OutcomeStore } from "./outcomeStore.js";
+/**
+ * `patchwork outcomes confirm|reject|list` — the operator's positive-act
+ * confirmation path for worker-filed issues.
+ *
+ * WHY THIS EXISTS. The trust ramp only folds a durable non-reversible filing as
+ * earned trust once its outcome disposition is `confirmed`; an `unknown` (still
+ * open, nobody acted) filing is WITHHELD, never counted (the trust-by-neglect
+ * fix). So a worker's `issue` dial cannot move on its own — something external
+ * must confirm the filing was real. Closing the issue as completed on GitHub
+ * does this (the outcome-ingester cron picks it up), but that needs the GitHub
+ * connector and a round-trip. This verb is the direct, local alternative:
+ * an operator records the disposition straight into ~/.patchwork/outcome-log.jsonl.
+ *
+ * Crucially, this is a HUMAN CLI, not a recipe step — no worker recipe can call
+ * it, so a worker cannot self-confirm its own filings. The reward path stays as
+ * independent of the worker as the penalty path (junk).
+ */
+export interface OutcomesCliResult {
+    stdout?: string;
+    stderr?: string;
+    exitCode: number;
+}
+/**
+ * Pure command core — takes argv (after `outcomes`) + an OutcomeStore and a
+ * wall-clock, returns what to print and the exit code. No process.exit / no
+ * Date.now so it is fully unit-testable; the index.ts dispatch supplies I/O.
+ */
+export declare function runOutcomesCli(args: string[], deps: {
+    store: OutcomeStore;
+    now: number;
+}): OutcomesCliResult;
+/** Human-readable rendering of all recorded outcomes (last-writer-wins). */
+export declare function formatOutcomeList(records: OutcomeRecord[]): string;

package/dist/workers/outcomesCli.js

@@ -0,0 +1,91 @@
+const OUTCOMES_USAGE = `Usage:
+  patchwork outcomes confirm <issue-url> [--recipe <name>] [--class <actionClass>]
+  patchwork outcomes reject  <issue-url> [--recipe <name>] [--class <actionClass>]
+  patchwork outcomes list [--json]
+  patchwork outcomes pending [--json]
+
+Manually record an outcome disposition for a worker-filed issue so the trust
+ramp can fold it as evidence. Writes to ~/.patchwork/outcome-log.jsonl. This is
+an operator positive-act — NOT a step any worker recipe can run, so a worker
+cannot self-confirm its own filings.
+
+  confirm   the filing was real / accepted  -> "confirmed" (earns trust)
+  reject    the filing was noise            -> "junk"      (lowers trust)
+  list      print all recorded outcomes     (--json for raw output)
+  pending   list filings still awaiting confirmation + the exact confirm command
+
+  --recipe <name>       stamp the filing recipe onto the record (audit context)
+  --class <actionClass> stamp the action class onto the record (audit context)
+`;
+/** Value following `--flag` in argv, or undefined. */
+function flagValue(args, name) {
+    const i = args.indexOf(name);
+    return i >= 0 && i + 1 < args.length ? args[i + 1] : undefined;
+}
+/**
+ * Pure command core — takes argv (after `outcomes`) + an OutcomeStore and a
+ * wall-clock, returns what to print and the exit code. No process.exit / no
+ * Date.now so it is fully unit-testable; the index.ts dispatch supplies I/O.
+ */
+export function runOutcomesCli(args, deps) {
+    const sub = args[0];
+    if (!sub || args.includes("--help") || args.includes("-h")) {
+        // Bare `outcomes` is a usage error (exit 1); an explicit --help is exit 0.
+        return { stdout: OUTCOMES_USAGE, exitCode: sub ? 0 : 1 };
+    }
+    if (sub === "list") {
+        const records = deps.store.readAll();
+        if (args.includes("--json")) {
+            return { stdout: `${JSON.stringify(records, null, 2)}\n`, exitCode: 0 };
+        }
+        return { stdout: formatOutcomeList(records), exitCode: 0 };
+    }
+    if (sub === "confirm" || sub === "reject") {
+        const issueUrl = args[1];
+        if (!issueUrl || issueUrl.startsWith("-")) {
+            return {
+                stderr: `Error: \`outcomes ${sub}\` requires an <issue-url>.\n\n${OUTCOMES_USAGE}`,
+                exitCode: 1,
+            };
+        }
+        if (!/^https?:\/\//.test(issueUrl)) {
+            return {
+                stderr: `Error: <issue-url> must be an http(s) URL (got "${issueUrl}"). Pass the issue's GitHub URL exactly as the worker filed it.\n`,
+                exitCode: 1,
+            };
+        }
+        const disposition = sub === "confirm" ? "confirmed" : "junk";
+        const recipeName = flagValue(args, "--recipe");
+        const workerClass = flagValue(args, "--class");
+        const record = {
+            issueUrl,
+            disposition,
+            checkedAt: deps.now,
+            ...(recipeName ? { recipeName } : {}),
+            ...(workerClass ? { workerClass } : {}),
+        };
+        deps.store.upsert(record);
+        return {
+            stdout: `Recorded ${disposition} for ${issueUrl}\n` +
+                "The trust ramp folds this on its next replay — run `patchwork workers shadow` to see the dial move.\n",
+            exitCode: 0,
+        };
+    }
+    return {
+        stderr: `Error: unknown subcommand "${sub}".\n\n${OUTCOMES_USAGE}`,
+        exitCode: 1,
+    };
+}
+/** Human-readable rendering of all recorded outcomes (last-writer-wins). */
+export function formatOutcomeList(records) {
+    if (records.length === 0) {
+        return "No recorded outcomes yet (~/.patchwork/outcome-log.jsonl is empty or absent).\n";
+    }
+    const lines = records.map((r) => {
+        const when = new Date(r.checkedAt).toISOString();
+        const ctx = [r.recipeName, r.workerClass].filter(Boolean).join(" · ");
+        return `  ${r.disposition.padEnd(9)} ${r.issueUrl}${ctx ? `  (${ctx})` : ""}  @ ${when}`;
+    });
+    return `${records.length} recorded outcome(s):\n${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=outcomesCli.js.map

package/dist/workers/outcomesCli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomesCli.js","sourceRoot":"","sources":["../../src/workers/outcomesCli.ts"],"names":[],"mappings":"AA8BA,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;CAkBtB,CAAC;AAEF,sDAAsD;AACtD,SAAS,SAAS,CAAC,IAAc,EAAE,IAAY;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAc,EACd,IAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,qBAAqB,GAAG,kCAAkC,cAAc,EAAE;gBAClF,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,MAAM,EAAE,mDAAmD,QAAQ,mEAAmE;gBACtI,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAkB;YAC5B,QAAQ;YACR,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO;YACL,MAAM,EACJ,YAAY,WAAW,QAAQ,QAAQ,IAAI;gBAC3C,uGAAuG;YACzG,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,8BAA8B,GAAG,SAAS,cAAc,EAAE;QAClE,QAAQ,EAAE,CAAC;KACZ,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,iFAAiF,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IAC3F,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,OAAO,CAAC,MAAM,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACzE,CAAC"}

package/dist/workers/runWorkerShadow.d.ts

@@ -0,0 +1,90 @@
+import { type WorkerShadowReport } from "./shadowObserver.js";
+import type { WorkerManifest } from "./worker.js";
+import type { WorkerLevelStore } from "./workerLevelStore.js";
+/**
+ * I/O entry for the shadow logger: read the REAL logs the bridge already
+ * writes — `~/.patchwork/runs.jsonl` (RecipeRunLog → the dial's evidence) and
+ * `~/.claude/ide/activity-*.jsonl` (the live gate's approval decisions) — and
+ * produce the trust-dial + ramp-vs-gate report. Fully read-only; touches
+ * nothing. Empty logs are honest, not an error (new workers have no activity).
+ */
+export interface RunWorkerShadowOpts {
+    /** Where worker manifests live (default ~/.patchwork/workers). */
+    workersDir?: string;
+    /** ~/.patchwork (runs.jsonl) override (tests). */
+    patchworkDir?: string;
+    /** ~/.claude/ide (activity-*.jsonl) override (tests). */
+    ideDir?: string;
+    /** Wall-clock override (tests) for durable-outcome labelling. Defaults to
+     *  Date.now() — supplied here (the I/O entry) so the observer stays pure. */
+    now?: number;
+}
+export interface WorkerShadowData {
+    workers: WorkerShadowReport[];
+    runsScanned: number;
+    decisionsScanned: number;
+    /** The directory worker manifests were loaded from (for empty-state copy). */
+    workersDir: string;
+}
+/**
+ * Structured shadow report — a read-only replay of the run + decision logs
+ * through the (worker × action-class) ramp. Backs both the CLI and the bridge
+ * `GET /workers/shadow` JSON endpoint. Pure aside from the log reads.
+ */
+export declare function getWorkerShadowData(opts?: RunWorkerShadowOpts): WorkerShadowData;
+export interface RecipeWorkerTrust {
+    worker: WorkerManifest;
+    /** Earned-level store, replayed from the run log — same source as the dial. */
+    store: WorkerLevelStore;
+}
+/**
+ * Load the worker that owns `recipeName` (recipe === body) plus its earned-level
+ * store, replayed from the same run log the dial uses. Returns null when no
+ * worker owns the recipe (the common case — non-worker recipes are unaffected).
+ *
+ * This is the LIVE-gate entry: `workerGate.decideWorkerAction(worker, tool,
+ * params, store)` reads the returned store. It replays the run log on each call
+ * (recipe executions are infrequent); a future optimisation could cache it.
+ */
+export declare function loadWorkerTrustForRecipe(recipeName: string, opts?: RunWorkerShadowOpts): RecipeWorkerTrust | null;
+export declare function runWorkerShadowReport(opts?: RunWorkerShadowOpts): string;
+/**
+ * Backtest each installed worker over its historical run log and print the
+ * divergence-calibration report (false-allow / false-gate). Read-only — the
+ * cold-start "what would this worker have done across N real actions, and where
+ * would it have diverged" artifact. See backtest.ts.
+ */
+export declare function runWorkerBacktest(opts?: RunWorkerShadowOpts): string;
+/** One filing awaiting an operator disposition — the confirm queue's unit. */
+export interface PendingConfirmation {
+    /** The captured filing URL — the confirm key. Today only `github.create_issue`
+     *  captures a URL to the run log, so these are issue URLs; a future PR-filing
+     *  recipe tool would flow through unchanged. */
+    issueUrl: string;
+    recipeName: string;
+    workerId: string;
+    workerName: string;
+    /** Epoch ms the filing ran. */
+    filedAt: number;
+    /** `domain:reversibility:blastTier` — the action class it counts toward. */
+    classKey: string;
+    /** The filing's human title, captured at filing time (the write tool echoes
+     *  it back in the step output — e.g. `github.create_issue` returns `title`).
+     *  Lets the dashboard review queue show "Login test failing on main" instead
+     *  of a bare URL. Absent for older run-log rows written before capture. */
+    title?: string;
+}
+/**
+ * The CONFIRM QUEUE — every non-reversible filing (a URL a worker captured) that
+ * has NO operator disposition yet (`unknown` / no record). These are exactly the
+ * filings whose trust is WITHHELD until a human confirms or rejects them — the
+ * queue `patchwork outcomes confirm|reject` exists to drain, and the moat KPI
+ * (evidence latency) is the age of this queue. Read-only. Deduped by URL
+ * (most-recent filing wins), newest first. Confirmed/junk filings are excluded
+ * (already actioned); reversible actions are excluded (they never need
+ * confirmation — they earn trust on their own). In practice today only issue
+ * filings (`github.create_issue`) carry a captured URL.
+ */
+export declare function computePendingConfirmations(opts?: RunWorkerShadowOpts): PendingConfirmation[];
+/** Human-readable confirm queue for `patchwork outcomes pending`. */
+export declare function formatPendingConfirmations(pending: PendingConfirmation[], now?: number): string;