pi-daddy 0.13.0

package/src/fanout.ts

@@ -0,0 +1,96 @@
+/**
+ * Bounded synchronous fan-out — ADR-0015's option A′, and the cardinality bound ADR-0008 never had.
+ *
+ * **The gap this closes.** ADR-0008 bounds what each child may *hold* and says nothing about how many
+ * children exist. `resolve()` is a set operation; nowhere in `src/` was there a count. Blocking `delegate`
+ * bounded cardinality to one *by accident of being blocking*, so the invariant was never tested. Fan-out
+ * removes that accident: with `maxDepth: 2` and five children per call, five delegators each spawning five
+ * is thirty concurrent model sessions — **every ledger line individually correct and narrow, the aggregate
+ * a machine DoS and an uncapped bill.** The critic's verdict on this was that silence is itself a finding.
+ *
+ * **Why a budget rather than a per-call limit.** A per-call cap of K with depth D still permits K^D
+ * descendants, which is the same exponential wearing a smaller number. A *budget* is subtractive and
+ * therefore total: a session holding budget B may create at most B descendants in its whole subtree,
+ * because it spends from B to spawn and hands each child a share of what is left. That composes across
+ * process boundaries with **no shared state** — the same property that makes depth work — so it needs no
+ * registry, no lock and no counter file.
+ *
+ * It is deliberately NOT a concurrency limit. How many run at once is a resource question for the executor;
+ * how many may exist at all is a governance question, and this is the governance answer.
+ */
+
+import { parseBound } from "./propagation.ts";
+
+/** Total descendants a session may create across its entire subtree, when nothing is configured. */
+export const DEFAULT_FANOUT_BUDGET = 8;
+
+/**
+ * Hard ceiling on children in a single call, independent of budget.
+ *
+ * A budget alone would let one call spend all of it at once, and a hundred simultaneous `pi` processes is
+ * a different failure from a hundred spread over a session. This is the blast-radius bound; the budget is
+ * the total bound. Both are needed because they answer different questions.
+ */
+export const MAX_CHILDREN_PER_CALL = 8;
+
+/** Read the budget from the environment, failing to the default on absent *or* malformed input. */
+export function budgetFromEnv(raw: string | undefined): number {
+  const parsed = parseBound(raw);
+  // Malformed and zero both fall back rather than disabling fan-out silently — G7's rule. A budget that a
+  // typo can switch off is the A-S4 defect wearing different clothes. To genuinely forbid delegation an
+  // operator sets `maxDepth: 0`, which says what it means.
+  return parsed === undefined || parsed === null || parsed === 0 ? DEFAULT_FANOUT_BUDGET : parsed;
+}
+
+export interface BudgetSplit {
+  ok: boolean;
+  reason?: string;
+  /** Budget each child receives. */
+  perChild: number;
+}
+
+/**
+ * Spend `count` from a budget and divide the remainder among the children.
+ *
+ * The parent pays one unit per child it creates *before* sharing what is left, so a subtree can never
+ * exceed the budget it started with: spawning is itself an expenditure, not a free act that only its
+ * descendants pay for. `Math.floor` on the division means rounding always loses budget rather than
+ * inventing it — the safe direction, and the reason a deep tree converges to zero instead of oscillating.
+ */
+export function splitBudget(budget: number, count: number): BudgetSplit {
+  if (count <= 0) return { ok: false, reason: "a fan-out needs at least one child", perChild: 0 };
+  if (count > MAX_CHILDREN_PER_CALL) {
+    return {
+      ok: false,
+      reason: `${count} children exceeds the per-call limit of ${MAX_CHILDREN_PER_CALL}`,
+      perChild: 0,
+    };
+  }
+  if (budget < count) {
+    return {
+      ok: false,
+      reason:
+        `fan-out budget exhausted: ${count} children requested, ${budget} remaining in this subtree ` +
+        `(raise PI_GRANTS_FANOUT at the root, or delegate fewer at a time)`,
+      perChild: 0,
+    };
+  }
+  return { ok: true, perChild: Math.floor((budget - count) / count) };
+}
+
+/**
+ * A ledger id that distinguishes siblings.
+ *
+ * **Review finding F8.** Every child was recorded as `delegate@d1`, so four concurrent children produced
+ * four lines identical except `ts` — and two landing in the same millisecond were indistinguishable.
+ * ADR-0008 names `parent_id`/`child_id` as the correlation keys, but they were depth *labels* wearing id
+ * names, which made the ledger unjoinable to the returned result, to the OS process, or to the child's own
+ * lines one level down.
+ *
+ * The id is hierarchical and derived, not random: a child of `d0` is `d0.1`, its own second child `d0.1.2`.
+ * That means a line's ancestry is readable from the id alone with no join at all, and it is reproducible —
+ * two runs of the same fan-out produce the same ids, which is what makes a ledger diffable.
+ */
+export function childSpawnId(parentId: string, index: number): string {
+  return `${parentId}.${index + 1}`;
+}

package/src/file-lock.ts

@@ -0,0 +1,142 @@
+/**
+ * One cross-process file lock, used by both files this package writes.
+ *
+ * **Extracted rather than copied (R-49).** The ledger has had this lock since fan-out made a second writer
+ * possible; the approvals store had an unlocked read-modify-write, so session 1 could load, session 2 could
+ * revoke, and session 1's next save would **restore the revoked entry** — falsifying a property
+ * `approval-store.ts` documents in so many words. The mitigation already existed twenty lines away. A
+ * second implementation is how a fix comes to contain a smaller copy of the bug it fixed, which has happened
+ * twice in this package (R-38's preview, ADR-0022's republish path), so there is exactly one of these.
+ *
+ * **The two callers want opposite failure behaviour, and that is the caller's decision, not this module's.**
+ * A ledger write that cannot take the lock must fail the delegation closed — a child running with granted
+ * capabilities and no audit line is the thing the ledger exists to prevent. An approvals write that cannot
+ * take the lock must NOT fail the work: the human already said yes, and the store is a convenience cache
+ * (ADR-0020). So this throws `LockTimeoutError`, distinguishable from every other failure, and each caller
+ * decides what that means.
+ */
+
+import { open, readFile, rm, stat } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+
+/** How long to wait for another writer to finish before giving up. Short: failing closed beats hanging. */
+export const LOCK_TIMEOUT_MS = 2000;
+/** A lock older than this is treated as abandoned by a killed process and broken. */
+export const STALE_LOCK_MS = 10_000;
+
+/**
+ * Raised only when the wait ran out. Its own type so a caller can tell "somebody else is writing" from
+ * "this filesystem rejected the write", which want different messages and, for the approvals store,
+ * different outcomes.
+ */
+export class LockTimeoutError extends Error {
+  constructor(label: string) {
+    super(`${label} is locked by another writer (waited ${LOCK_TIMEOUT_MS}ms)`);
+    this.name = "LockTimeoutError";
+  }
+}
+
+/**
+ * Run `work` while holding an exclusive lock beside `path`.
+ *
+ * **Why a lock at all.** `O_APPEND` is atomic for one write to a regular file on a POSIX filesystem, and the
+ * guarantee does **not** hold on drvfs (`/mnt/c` under WSL2) or NFS — which is exactly where this project
+ * runs. The approvals store never had the guarantee anyway: read-modify-write is not one write.
+ *
+ * **A lock introduces its own failure mode and it is handled deliberately.** A process killed while holding
+ * the lock would otherwise block every future write forever, so a lock older than `STALE_LOCK_MS` is broken.
+ * Every delete proves ownership first (`removeIfOurs`) — see the token comment in the loop for the two
+ * mutual-exclusion breaks that came from not doing so, both reproduced across real OS processes.
+ *
+ * **What staleness actually measures, stated because it is not what it sounds like.** `STALE_LOCK_MS`
+ * compares the lock's mtime to now; it never checks whether the owner is alive. So *any* 10s stall of the
+ * holder hands the lock on — a `SIGSTOP`, a laptop suspend, swap thrash, a debugger breakpoint, a long GC
+ * pause. Measured on this project's own filesystems, no realistic `work()` comes near it: one ledger append
+ * is 0.1ms on ext4 and 21ms on drvfs, and a 10,000-entry `saveApproval` is 30ms / 97ms. Sixteen-way
+ * contention raises *waiters'* time, never the holder's — max hold measured at 49ms. So the threshold is
+ * two orders of magnitude clear of normal operation and is not guarded against abnormal suspension.
+ *
+ * The timeout is short *on purpose*: work refused because a file was busy is recoverable and loud, while
+ * work that hangs waiting for a lock is neither.
+ */
+export async function withFileLock<T>(path: string, label: string, work: () => Promise<T>): Promise<T> {
+  const lockPath = `${path}.lock`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+
+  for (;;) {
+    // **A token, and the reason mutual exclusion depends on it (R-67).** `rm(path)` deletes whatever is at
+    // the path *now*, not the lock this process created — so the previous version broke its own invariant
+    // two ways, both reproduced across real OS processes:
+    //
+    //  - the stale-break `stat` and `rm` are two awaits, so a process descheduled between them could delete
+    //    a LIVE lock another waiter had just created, and then succeed at its own create: two holders;
+    //  - worse, the `finally` removed the lock unconditionally. A holder whose lock had been broken out
+    //    from under it still freed the NEW owner's lock on the way out — and the damage then propagated to
+    //    processes that raced nothing and observed nothing wrong, which is how one break became a chain.
+    //
+    // Writing a unique token and re-reading it before every delete makes both inexpressible: this process
+    // only ever removes a file it can prove is its own. The docstring used to claim "whichever wins the
+    // exclusive create proceeds, which is correct because only one can" — true of the create and false of
+    // the delete, which is what made it convincing.
+    const token = `${process.pid}:${randomUUID()}`;
+    let handle: Awaited<ReturnType<typeof open>> | undefined;
+    try {
+      handle = await open(lockPath, "wx");
+      await handle.writeFile(`${token}\n`, "utf8");
+    } catch (error) {
+      // The handle may exist even though the WRITE failed (ENOSPC, EDQUOT, EFBIG). The old code jumped
+      // straight here and rethrew, so the already-created lock file was left on disk and its descriptor
+      // leaked to GC — an orphan that blocks every writer for a full STALE_LOCK_MS and feeds the EMFILE
+      // path below. Close and remove before doing anything else; `ours` is safe because we just made it.
+      if (handle) {
+        await handle.close().catch(() => undefined);
+        await removeIfOurs(lockPath, token);
+        handle = undefined;
+      }
+      const code = (error as { code?: string }).code;
+      if (code !== "EEXIST") throw error;
+
+      // Someone else holds it. Break it only if it is old enough to be abandoned — and only the exact file
+      // we judged, so a lock created in the gap survives.
+      try {
+        const held = await stat(lockPath);
+        if (Date.now() - held.mtimeMs > STALE_LOCK_MS) {
+          const abandoned = await readFile(lockPath, "utf8").catch(() => undefined);
+          if (abandoned !== undefined) await removeIfOurs(lockPath, abandoned.trim());
+        }
+      } catch {
+        /* it vanished between the check and the stat — the next attempt will simply take it */
+      }
+
+      if (Date.now() >= deadline) throw new LockTimeoutError(label);
+      await new Promise((r) => setTimeout(r, 25));
+      continue;
+    }
+
+    try {
+      return await work();
+    } finally {
+      await handle.close().catch(() => undefined);
+      // Only if it is still OURS. A lock broken out from under us belongs to somebody else now, and
+      // deleting it is what turned one lost race into a cascade.
+      await removeIfOurs(lockPath, token);
+    }
+  }
+}
+
+/**
+ * Delete the lock only if it still holds `token`.
+ *
+ * Read-then-delete is itself two operations, so this is not atomic either — but it narrows the window from
+ * "the whole of `work()`" to "between a read and an unlink", and it removes the *systematic* break entirely:
+ * a process can no longer delete a lock it demonstrably never owned.
+ */
+async function removeIfOurs(lockPath: string, token: string): Promise<void> {
+  try {
+    const held = await readFile(lockPath, "utf8");
+    if (held.trim() !== token) return;
+    await rm(lockPath, { force: true });
+  } catch {
+    /* already gone, or unreadable — either way this process is not the one that should force it */
+  }
+}

package/src/index.ts

@@ -0,0 +1,59 @@
+export {
+  resolve,
+  assertNarrowing,
+  toPiToolsAllowlist,
+  UNIVERSAL_CAPABILITIES,
+  type Capability,
+  type ResolveInput,
+  type ResolveResult,
+} from "./resolve.ts";
+
+export {
+  appendRecord,
+  buildRecord,
+  isEscalationAttempt,
+  type GrantRecord,
+  type LedgerOptions,
+} from "./ledger.ts";
+
+export { planSpawn, type SpawnPlan, type SpawnPlanInput } from "./spawn.ts";
+
+export {
+  APPROVAL_TTL_DAYS,
+  DELEGATE_SUBJECT,
+  approvalKey,
+  entryVerdict,
+  expiryFor,
+  inheritApprovals,
+  offeredScopes,
+  resolveApprovals,
+  shouldSeekApproval,
+  type ApprovalEntry,
+  type ApprovalPath,
+  type ApprovalScope,
+  type ApprovalSource,
+  type EntryVerdict,
+  type SubjectSnapshot,
+} from "./approval.ts";
+
+export {
+  approvalsPath,
+  loadApprovals,
+  revokeAll,
+  revokeApproval,
+  saveApproval,
+  type DroppedApproval,
+  type SubjectLookup,
+} from "./approval-store.ts";
+
+export {
+  createApprovalGate,
+  createApprovalGateProvider,
+  timeoutMsFromEnv,
+  type ApprovalGate,
+  type InFlightApprovals,
+  type ApprovalUI,
+  type PromptOutcome,
+  type PromptOutcomeKind,
+  type PromptRequest,
+} from "./approval-prompt.ts";

package/src/ledger-report.ts

@@ -0,0 +1,227 @@
+/**
+ * Reading a ledger back — integrity, instruction versions, and the ADR-0020 approval tally.
+ *
+ * Split from `ledger.ts` when the file-size guard refused it at 419 lines. The seam is real rather than
+ * arbitrary: `ledger.ts` **writes** one record at a time and fails closed when it cannot, while everything
+ * here **reads** a whole file and must never fail at all — a report is a diagnostic, and a diagnostic that
+ * throws on damaged input is useless on exactly the input it exists for. Every defect this half has had
+ * (R-63's bias, R-64's three malformed shapes) was a *reporting* defect, and none of them could have
+ * touched the write path.
+ *
+ * Re-exported from `./ledger` so the published subpath is unchanged.
+ */
+
+import { readFile } from "node:fs/promises";
+import type { Capability } from "./resolve.ts";
+import { DELEGATE_SUBJECT } from "./approval.ts";
+import type { ApprovalSource } from "./approval.ts";
+import type { GrantRecord } from "./ledger.ts";
+import { isEscalationAttempt } from "./ledger.ts";
+
+export interface LedgerReport {
+  /** False when the file is absent — a configuration state, not damage. */
+  exists: boolean;
+  /** Lines that parsed as records. */
+  records: number;
+  /** Lines that did not, with 1-based line numbers so the report is actionable. */
+  corrupt: Array<{ line: number; text: string }>;
+  /** Records where an agent asked for more than it held — ADR-0008's designated signal. */
+  escalationAttempts: number;
+  /**
+   * Every distinct set of instructions this ledger saw run, with how many spawns used it (R-51).
+   *
+   * ADR-0018 advertises that a record answers *"did these four children run the same instructions?"* and
+   * *"has this definition changed since?"* — and until this existed **nothing read `definitionDigest` at
+   * all**, so both questions required hand-written `jq` and the second was not even reproducible with
+   * `sha256sum`, because the digest covers the body and not the frontmatter. A field no tool reads is a
+   * field that quietly becomes decoration.
+   *
+   * Grouped by `name` + `sha256`, so two entries with one name are exactly the evidence that a definition
+   * changed mid-ledger. Sorted by name then digest so two runs of the same fan-out produce a diffable
+   * report, like the ids themselves.
+   */
+  definitions: Array<{ name: string; source: string; sha256: string; spawns: number }>;
+  /**
+   * Where the yes came from, per approved capability, tallied across the whole ledger.
+   *
+   * **This is the measurement ADR-0020 asks for.** That ADR keeps the persistence layer on R-25's fatigue
+   * argument with *no number behind it*, and named the evidence that would settle it: counting `persisted`
+   * against `prompt` over a few weeks of real use. It also said this "needs no new machinery" — true of the
+   * data and false of the answer, which required hand-written `jq`. Same shape as R-51: a field no tool
+   * reads becomes decoration, and a measurement nobody can run does not get run.
+   *
+   * **`bySource` counts RECORDS and is an upper bound, not an answer.** Deleting the persistence layer does
+   * not turn every `persisted` record back into a prompt: precedence is `inherited → session → persisted →
+   * prompt`, and `session` approvals live in memory and do not depend on the store at all. So a session that
+   * spawns `deploy` twenty times under one persisted entry writes twenty `persisted` records, while without
+   * the store it would raise **one** prompt and satisfy the other nineteen from the session cache. Reporting
+   * twenty prompts avoided would overstate the layer's value twentyfold, on the one number that decides
+   * whether to keep it — the same direction of bias `unattributed` exists to avoid, arrived at a different way.
+   *
+   * `distinctBySource` is the closer estimate: distinct `capability@subject` pairs, which bounds the cost of
+   * deletion at one prompt per pair per session. The ledger carries no session id, so the exact figure is not
+   * computable from it; both numbers are printed and labelled rather than one being presented as the truth.
+   *
+   * Counted from `approvalSources` **only**. `approvalSource` is deliberately not used as a fallback: before
+   * 0.11.1 that scalar was written for the whole set even when the sources differed (R-46), so folding it in
+   * would report humans as having been asked about capabilities they were never asked about — biasing the
+   * one direction this measurement must not be biased in. Those records are counted as `unattributed`
+   * instead, so the sample size is visible rather than silently smaller.
+   */
+  approvals: {
+    /** Raw record counts. An UPPER bound on prompts avoided — see above before quoting one. */
+    bySource: Record<ApprovalSource, number>;
+    /** Distinct `capability@subject` pairs per source. The closer estimate. */
+    distinctBySource: Record<ApprovalSource, number>;
+    /** Records carrying approvals from before per-capability sources existed. Not attributable; see above. */
+    unattributed: number;
+    /** Records where a human was asked and said no — the fatigue argument's other half. */
+    humanDenied: number;
+    /**
+     * Distinct `capability@subject` pairs a human declined.
+     *
+     * Same reason `distinctBySource` exists: R-29 shares a decline across every concurrent caller, so one
+     * click of *Deny* under an eight-wide fan-out writes eight `humanDenied` records. Reporting the raw
+     * count as "times a human declined" is the per-record bias R-63 removed from `persisted`, left in place
+     * on the number that argues hardest FOR the layer — which is the direction that flatters this package's
+     * own gating and therefore the one to be most careful with.
+     */
+    humanDeniedPairs: number;
+  };
+  ok: boolean;
+}
+
+/**
+ * Read the ledger back and report what is wrong with it.
+ *
+ * **This is the gap that mattered most.** `appendRecord`'s strict mode catches write *errors*, never
+ * corruption, and nothing in this package had ever read a ledger back — so a torn line was silently
+ * indistinguishable from a spawn that never happened. An audit trail whose damage is invisible is not a
+ * compensating control, and ADR-0008 leans on the ledger as exactly that.
+ *
+ * Deliberately reports rather than repairs. A corrupt line is evidence; rewriting the file to make it parse
+ * would destroy the one artifact an investigation has.
+ */
+export async function verifyLedger(path: string): Promise<LedgerReport> {
+  let text: string;
+  try {
+    text = await readFile(path, "utf8");
+  } catch (error) {
+    if ((error as { code?: string }).code === "ENOENT") {
+      return {
+        exists: false,
+        records: 0,
+        corrupt: [],
+        escalationAttempts: 0,
+        definitions: [],
+        approvals: {
+          bySource: { prompt: 0, session: 0, persisted: 0, inherited: 0 },
+          distinctBySource: { prompt: 0, session: 0, persisted: 0, inherited: 0 },
+          unattributed: 0,
+          humanDenied: 0,
+          humanDeniedPairs: 0,
+        },
+        ok: true,
+      };
+    }
+    throw error;
+  }
+
+  const corrupt: Array<{ line: number; text: string }> = [];
+  // Keyed by name+digest: one name with two entries is the signal that the definition changed mid-ledger.
+  const digests = new Map<string, { name: string; source: string; sha256: string; spawns: number }>();
+  let records = 0;
+  let escalationAttempts = 0;
+  const bySource: Record<ApprovalSource, number> = { prompt: 0, session: 0, persisted: 0, inherited: 0 };
+  // `capability@subject` seen per source, so the report can state a bound as well as a raw count.
+  const distinct: Record<ApprovalSource, Set<string>> = {
+    prompt: new Set(),
+    session: new Set(),
+    persisted: new Set(),
+    inherited: new Set(),
+  };
+  let unattributed = 0;
+  let humanDenied = 0;
+  const deniedPairs = new Set<string>();
+
+  const lines = text.split("\n");
+  lines.forEach((raw, index) => {
+    // A trailing newline yields one empty final element, which is normal rather than damage.
+    if (raw.trim().length === 0) return;
+    try {
+      const parsed = JSON.parse(raw) as GrantRecord;
+      if (!Array.isArray(parsed.denied)) throw new Error("not a grant record");
+      records += 1;
+      if (isEscalationAttempt(parsed)) escalationAttempts += 1;
+      if (parsed.humanDenied) {
+        humanDenied += 1;
+        const subject = parsed.agentType === undefined || parsed.agentType === "delegate" ? DELEGATE_SUBJECT : parsed.agentType;
+        for (const capability of parsed.gatedBlocked ?? []) deniedPairs.add(`${capability}@${subject}`);
+      }
+      // A **plain, non-empty** object. Three shapes were accepted here that must not be, all of them
+      // reachable from a torn, hand-edited or foreign line — which is the input class `verifyLedger` exists
+      // for, so "this package never writes that" is not a defence:
+      //   - `{}` beside a non-empty `approved` counted NOWHERE, silently shrinking the sample the comment
+      //     below promises to keep visible;
+      //   - an ARRAY passed `typeof === "object"` and was tallied with numeric indices as capability names;
+      //   - `null` is an object.
+      const rawSources = parsed.approvalSources;
+      const sources =
+        rawSources && typeof rawSources === "object" && !Array.isArray(rawSources) && Object.keys(rawSources).length > 0
+          ? rawSources
+          : undefined;
+      if (sources) {
+        // The subject half of `capability@subject`. `agentType` is the definition's name, or the literal
+        // `"delegate"` for the `tools:` form — which is NOT `DELEGATE_SUBJECT`, the `<delegate>` the approval
+        // layer keys on. Mapped here rather than at the write site so old ledgers read correctly too.
+        // **Stated limit:** a definition genuinely named `delegate` is indistinguishable from the `tools:`
+        // form in this field, and their two distinct approvals count as one pair. `DELEGATE_SUBJECT`'s own
+        // angle brackets exist to make that collision impossible, and the ledger drops them.
+        const subject = parsed.agentType === undefined || parsed.agentType === "delegate" ? DELEGATE_SUBJECT : parsed.agentType;
+        for (const [capability, source] of Object.entries(sources)) {
+          // `Object.hasOwn`, never `in`: `in` walks the prototype, so a source of `"toString"` or
+          // `"valueOf"` passed the check, wrote a STRING into a counter, made `attributed` a string, and
+          // deleted the entire measurement from the report while marking an intact ledger corrupt.
+          // An unrecognised source is counted as unattributed rather than dropped: a tally that silently
+          // ignores what it does not understand reports a smaller sample as a cleaner one.
+          if (Object.hasOwn(bySource, source)) {
+            bySource[source] += 1;
+            distinct[source].add(`${capability}@${subject}`);
+          } else unattributed += 1;
+        }
+      } else if (parsed.approved && parsed.approved.length > 0) {
+        unattributed += parsed.approved.length;
+      }
+      const d = parsed.definitionDigest;
+      if (d?.name && d.sha256) {
+        const key = `${d.name}\u0000${d.sha256}`;
+        const seen = digests.get(key);
+        if (seen) seen.spawns += 1;
+        else digests.set(key, { name: d.name, source: d.source, sha256: d.sha256, spawns: 1 });
+      }
+    } catch {
+      corrupt.push({ line: index + 1, text: raw.slice(0, 120) });
+    }
+  });
+
+  return {
+    exists: true,
+    records,
+    corrupt,
+    escalationAttempts,
+    definitions: [...digests.values()].sort((a, b) => a.name.localeCompare(b.name) || a.sha256.localeCompare(b.sha256)),
+    approvals: {
+      bySource,
+      distinctBySource: {
+        prompt: distinct.prompt.size,
+        session: distinct.session.size,
+        persisted: distinct.persisted.size,
+        inherited: distinct.inherited.size,
+      },
+      unattributed,
+      humanDenied,
+      humanDeniedPairs: deniedPairs.size,
+    },
+    ok: corrupt.length === 0,
+  };
+}