pincer-workflow 0.6.0 → 1.0.0

package/template/scripts/pincer-runtime/runner.cjs

@@ -1,242 +0,0 @@
-'use strict';
-// PINCER runtime — the attempt runner (docs/runtime-contracts.md, "Attempts",
-// "Capture and sanitization"). Persists a `running` record before launch (which
-// supersedes prior readiness for the context immediately), snapshots inputs
-// before and after, executes the check through `bash -eo pipefail` in its own
-// process group with bounded sanitized capture, enforces the timeout with
-// escalation, handles signals, and finalizes the record from what actually
-// happened. Nothing here decides readiness; readiness.cjs reads the records.
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const { spawn, execFileSync } = require('node:child_process');
-const parse = require('./parse.cjs');
-const source = require('./source.cjs');
-const state = require('./state.cjs');
-const { sanitizeLine, sanitizeText } = require('./sanitize.cjs');
-const { nowIso } = require('./fsutil.cjs');
-
-const CAPTURE_LIMIT = 1024 * 1024;
-const PARTIAL_LINE_LIMIT = 64 * 1024;
-const GRACE_MS = 5000;
-const DRAIN_MS = 2000;
-const RUNNER_ARGS = ['-eo', 'pipefail', '-c'];
-
-let bashInfo = null;
-function runnerInfo() {
-  if (bashInfo) return bashInfo;
-  let shell = 'bash', version = 'unknown';
-  try { shell = execFileSync('bash', ['-c', 'command -v bash'], { encoding: 'utf8' }).trim() || 'bash'; } catch { /* keep default */ }
-  try { version = execFileSync('bash', ['--version'], { encoding: 'utf8' }).split('\n')[0]; } catch { /* keep default */ }
-  bashInfo = { shell, args: RUNNER_ARGS, version };
-  return bashInfo;
-}
-
-// A bounded, sanitized capture of one stream into a file, echoed to `echo` when given.
-class Capture {
-  constructor(file, echo) {
-    this.file = file; this.echo = echo;
-    this.fd = fs.openSync(file, 'w');
-    this.bytes = 0; this.dropped = 0; this.redactions = 0; this.truncated = false;
-    this.partial = ''; this.state = {}; this.failed = null;
-  }
-  write(chunk) {
-    this.partial += chunk.toString('utf8');
-    let index;
-    while ((index = this.partial.indexOf('\n')) !== -1) {
-      this.emit(this.partial.slice(0, index), true);
-      this.partial = this.partial.slice(index + 1);
-    }
-    if (this.partial.length > PARTIAL_LINE_LIMIT) { this.emit(this.partial, false); this.partial = ''; }
-  }
-  emit(line, newline) {
-    const { text, redactions } = sanitizeLine(line, this.state);
-    this.redactions += redactions;
-    const out = newline ? `${text}\n` : text;
-    if (this.echo) this.echo.write(out);
-    const buffer = Buffer.from(out, 'utf8');
-    if (this.bytes + buffer.length <= CAPTURE_LIMIT) {
-      try { fs.writeSync(this.fd, buffer); this.bytes += buffer.length; } catch (error) { this.failed = this.failed || error.message; }
-    } else {
-      if (!this.truncated) {
-        const room = CAPTURE_LIMIT - this.bytes;
-        if (room > 0) { try { fs.writeSync(this.fd, buffer.subarray(0, room)); this.bytes += room; } catch (error) { this.failed = this.failed || error.message; } }
-        this.truncated = true;
-        this.dropped += buffer.length - Math.max(room, 0);
-      } else this.dropped += buffer.length;
-    }
-  }
-  close() {
-    if (this.partial) { this.emit(this.partial, false); this.partial = ''; }
-    if (this.truncated) {
-      try { fs.writeSync(this.fd, `\n[pincer: truncated, ${this.dropped} more bytes not stored]\n`); } catch (error) { this.failed = this.failed || error.message; }
-    }
-    fs.closeSync(this.fd);
-    return { bytes: this.bytes, truncated: this.truncated, redactions: this.redactions, failed: this.failed };
-  }
-}
-
-// Run one attempt. `context` is the attempt context (kind, change, prd, prd_revision,
-// base, ticket/ticket_digest or candidate/check); `commands` the block lines;
-// `timeoutSeconds` the effective timeout; `echo` when the output should also reach
-// the terminal. `revalidate`, when given, is called under the worktree lock
-// immediately before the `running` record is written and returns the context to
-// record (docs/runtime-contracts.md, "Command gates"): the gates the caller passed
-// before the lock are evaluated again there, so a transition, revision or
-// authorization committed in between is seen and the attempt is refused (a thrown
-// transaction Refusal becomes { code, problem, refused: true }) or recorded against
-// the current agreement. `announce` is called once the record is registered and
-// before the launch, so a refusal prints nothing. Returns { attempt } or { code,
-// problem } for refusals before launch; nothing is written for a refusal.
-async function runAttempt({ root, context, commands, timeoutSeconds, command = 'verify', echo = true, declared = {}, revalidate = null, announce = null, cwd = null }) {
-  const block = commands.length ? `${commands.join('\n')}\n` : '';
-  const checkDigest = parse.sha256(`${block}timeout=${timeoutSeconds}\n`);
-  const display = sanitizeText(block).text.slice(0, 2000);
-  const before = source.snapshot(root);
-  if (before.problems.length) return { code: before.problems[0].code, problem: before.problems.map(p => `${p.code}: ${p.detail}`).join('\n'), problems: before.problems };
-
-  let attempt, logDir, relLogDir;
-  try {
-    state.withLock(root, () => {
-      // Finish any committed transaction before writing: its staged files would
-      // otherwise be renamed over this attempt and its index pointer later.
-      require('./transaction.cjs').recoverPending(root);
-      if (revalidate) context = revalidate();
-      const key = state.contextKey(context);
-      // Changes mode records (schema 2) carry the agreement digest; `mode` only
-      // selects the key format and is not part of the record.
-      const { mode, ...persisted } = context;
-      const schema = persisted.coverage ? 3 : persisted.agreement ? 2 : 1;
-      const read = state.readIndex(root);
-      if (read.error) { const e = new Error(read.error); e.code = 'INVALID'; throw e; }
-      const index = read.index;
-      const sequence = index.sequence + 1;
-      const id = state.attemptId(sequence);
-      source.storeManifest(root, before);
-      relLogDir = `${state.RUNTIME_DIR}/attempts/${id}`;
-      logDir = path.join(root, relLogDir);
-      fs.mkdirSync(logDir, { recursive: true });
-      attempt = {
-        schema, runtime: schema, id, sequence, context: persisted,
-        check: { digest: checkDigest, display, timeout_seconds: timeoutSeconds },
-        outcome: 'running', exit_code: null, signal: null,
-        runner: runnerInfo(), cwd: cwd || '.',
-        environment: { os: `${os.platform()} ${os.release()}`, node: process.version, declared },
-        started: nowIso(), finished: null,
-        source: { before: before.digest, after: null, files: before.files.length, limitations: before.limitations },
-        artifacts: { stdout: { path: `${relLogDir}/stdout.log`, sha256: null, bytes: 0, truncated: false, redactions: 0 }, stderr: { path: `${relLogDir}/stderr.log`, sha256: null, bytes: 0, truncated: false, redactions: 0 } },
-        owner: { pid: process.pid, ppid: process.ppid, host: os.hostname() }, child: null,
-        limitations: [],
-      };
-      state.writeAttempt(root, attempt);
-      index.sequence = sequence;
-      index.current[key] = id;
-      index.running.push(id);
-      state.writeIndex(root, index);
-    }, { command });
-  } catch (error) {
-    if (error && error.refusal) return { code: error.code, problem: error.message, refused: true };
-    if (error.code === 'STATE_BUSY') return { code: 'STATE_BUSY', problem: error.message };
-    if (error.code === 'INVALID') return { code: 'INPUT_INVALID', problem: error.message };
-    return { code: 'ATTEMPT_ERROR', problem: `cannot persist the attempt record: ${error.message}` };
-  }
-
-  if (announce) announce(attempt);
-  // Execute in a fresh process group so timeouts and signals reach every descendant.
-  let child, launchError = null;
-  const stdout = new Capture(path.join(logDir, 'stdout.log'), echo ? process.stdout : null);
-  const stderr = new Capture(path.join(logDir, 'stderr.log'), echo ? process.stderr : null);
-  let timedOut = false, interruptedBy = null, abandoned = false, killTimer = null, graceTimer = null, drainTimer = null, settle = null;
-  const sent = [];
-  // Signal the whole group, whether or not the shell itself has exited: a
-  // background child that inherited the output pipes keeps the run alive and
-  // must be terminated the same way. The bare pid is a fallback only while the
-  // shell is known to be alive (after it is reaped the pid may be reused). The
-  // group id itself can be reused only once every member is gone; the window
-  // between the two attempts is a documented limit, not something detected here.
-  // `sent` records only signals a kill call delivered.
-  const signalGroup = signal => {
-    try { process.kill(-child.pid, signal); sent.push(signal); return; } catch { /* no group left */ }
-    if (child.exitCode === null && child.signalCode === null) { try { process.kill(child.pid, signal); sent.push(signal); } catch { /* gone */ } }
-  };
-  let terminating = false;
-  const terminate = () => {
-    if (!child || !child.pid || terminating) return;
-    terminating = true;
-    signalGroup('SIGTERM');
-    graceTimer = setTimeout(() => {
-      signalGroup('SIGKILL');
-      // Bound the wait for the pipes to close: a descendant that survives
-      // SIGKILL (or was never reachable) must not hold the run open forever.
-      drainTimer = setTimeout(() => {
-        abandoned = true;
-        try { child.stdout.destroy(); child.stderr.destroy(); child.unref(); } catch { /* best effort */ }
-        settle({ code: child.exitCode, signal: child.signalCode });
-      }, DRAIN_MS);
-    }, GRACE_MS);
-  };
-  const onSignal = signal => { interruptedBy = signal; terminate(); };
-  const exit = await new Promise(resolve => {
-    let settled = false;
-    settle = result => { if (!settled) { settled = true; resolve(result); } };
-    try {
-      child = spawn(runnerInfo().shell, [...RUNNER_ARGS, block], { cwd: cwd ? path.join(root, cwd) : root, detached: true, stdio: ['ignore', 'pipe', 'pipe'], env: process.env });
-    } catch (error) { launchError = error.message; return settle({ code: null, signal: null }); }
-    child.on('error', error => { launchError = error.message; });
-    if (child.pid) {
-      attempt.child = { pid: child.pid };
-      try { state.withLock(root, () => state.writeAttempt(root, attempt), { command }); } catch { /* the final write records it */ }
-    }
-    child.stdout.on('data', chunk => stdout.write(chunk));
-    child.stderr.on('data', chunk => stderr.write(chunk));
-    process.on('SIGINT', onSignal); process.on('SIGTERM', onSignal);
-    killTimer = setTimeout(() => { timedOut = true; terminate(); }, timeoutSeconds * 1000);
-    child.on('close', (code, signal) => settle({ code, signal }));
-  });
-  clearTimeout(killTimer); clearTimeout(graceTimer); clearTimeout(drainTimer);
-  process.off('SIGINT', onSignal); process.off('SIGTERM', onSignal);
-  const outInfo = stdout.close(), errInfo = stderr.close();
-  const termination = `${sent.length ? `the child process group was sent ${sent.join(' then ')}` : 'no reachable process remained in the child\'s group (the shell had exited and its descendants left the group)'}${abandoned ? `; output capture was abandoned ${DRAIN_MS / 1000} s after the SIGKILL point and a descendant may still be running` : ''}`;
-
-  const after = source.snapshot(root);
-  const changed = after.digest && before.digest !== after.digest ? source.diffManifests(before, after) : [];
-  attempt.finished = nowIso();
-  attempt.exit_code = exit.code;
-  attempt.signal = exit.signal;
-  attempt.source.after = after.digest;
-  for (const [name, info] of [['stdout', outInfo], ['stderr', errInfo]]) {
-    const file = path.join(logDir, `${name}.log`);
-    let sha = null;
-    try { sha = parse.sha256(fs.readFileSync(file)); } catch { sha = null; }
-    attempt.artifacts[name] = { ...attempt.artifacts[name], sha256: sha, bytes: info.bytes, truncated: info.truncated, redactions: info.redactions };
-  }
-  const captureFailure = outInfo.failed || errInfo.failed;
-  if (launchError) { attempt.outcome = 'error'; attempt.error = `cannot launch the check: ${launchError}`; }
-  else if (interruptedBy) { attempt.outcome = 'interrupted'; attempt.limitations.push(`interrupted by ${interruptedBy}; ${termination}`); }
-  else if (timedOut) { attempt.outcome = 'timed_out'; attempt.limitations.push(`terminated after ${timeoutSeconds} s; ${termination}`); }
-  else if (captureFailure) { attempt.outcome = 'error'; attempt.error = `capture failed: ${captureFailure}`; }
-  else if (after.problems.length) { attempt.outcome = 'error'; attempt.error = `source view invalid after the run: ${after.problems[0].code} ${after.problems[0].detail}`; }
-  else if (exit.code === 0 && changed.length) { attempt.outcome = 'error'; attempt.error = `SOURCE_CHANGED: the check mutated source: ${changed.slice(0, 5).join(', ')}${changed.length > 5 ? ` (+${changed.length - 5})` : ''}`; }
-  else if (exit.code === 0) attempt.outcome = 'passed';
-  else attempt.outcome = 'failed';
-  if (changed.length && attempt.outcome !== 'error') attempt.limitations.push(`source changed during the run: ${changed.slice(0, 5).join(', ')}`);
-  if (after.digest) { try { source.storeManifest(root, after); } catch { /* best effort; the digest is recorded */ } }
-
-  try {
-    state.withLock(root, () => {
-      const read = state.readIndex(root);
-      if (read.error) { const e = new Error(read.error); e.code = 'INVALID'; throw e; }
-      const index = read.index;
-      state.writeAttempt(root, attempt);
-      index.running = index.running.filter(id => id !== attempt.id);
-      state.writeIndex(root, index);
-    }, { command });
-  } catch (error) {
-    return { code: 'ATTEMPT_ERROR', problem: `attempt ${attempt.id} finished ${attempt.outcome} but the record could not be finalized: ${error.message}`, attempt };
-  }
-  return { attempt, changed };
-}
-
-const exitFor = attempt => ({ passed: 0, failed: 1, timed_out: 124, interrupted: 130, error: 4 })[attempt.outcome] ?? 4;
-
-module.exports = { runAttempt, exitFor, CAPTURE_LIMIT, GRACE_MS, DRAIN_MS, runnerInfo };

package/template/scripts/pincer-runtime/sanitize.cjs

@@ -1,63 +0,0 @@
-'use strict';
-// PINCER runtime — output sanitizer (docs/runtime-contracts.md, "Capture and
-// sanitization"). A safety net applied to every captured line and to command
-// display text before anything is persisted: documented secret patterns are
-// replaced by [redacted] and counted. It is not a guarantee; checks must avoid
-// printing secrets, and no raw log is ever exported.
-const PATTERNS = [
-  // Bearer tokens first, so an `Authorization: Bearer <token>` header keeps the
-  // token, not the word Bearer, as the redacted value.
-  { re: /((?:bearer|basic|token|digest)\s+)[A-Za-z0-9\-._~+/=]+/gi, replace: '$1[redacted]' },
-  // key/secret/password/token/authorization assignments and JSON fields; a
-  // quoted value is redacted up to its closing quote, an unquoted one to the
-  // next whitespace or separator. Bounded quantifiers: an unbounded prefix would
-  // backtrack quadratically on long lines.
-  { re: /((?:^|[^A-Za-z0-9_.-])[A-Za-z0-9_.-]{0,64}?(?:key|secret|password|passwd|token|authorization)[A-Za-z0-9_.-]{0,64}["']?[ \t]{0,8}[:=][ \t]{0,8})(?:"([^"\n]{0,512})"|'([^'\n]{0,512})'|([^\s"',;]+))/gi, replace: (m, head, dq, sq, bare) => `${head}${dq !== undefined ? '"[redacted]"' : sq !== undefined ? "'[redacted]'" : '[redacted]'}` },
-  { re: /AKIA[0-9A-Z]{16}/g, replace: '[redacted]' },
-  { re: /gh[pousr]_[A-Za-z0-9]{20,}/g, replace: '[redacted]' },
-];
-const PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
-const PEM_END = /-----END [A-Z ]*PRIVATE KEY-----/;
-
-// Stateful: PEM private key blocks span lines. `state` is a plain object the
-// caller keeps per stream.
-function sanitizeLine(line, state = {}) {
-  let redactions = 0;
-  if (state.inPem) {
-    if (PEM_END.test(line)) state.inPem = false;
-    return { text: '[redacted]', redactions: 1 };
-  }
-  if (PEM_BEGIN.test(line)) {
-    state.inPem = !PEM_END.test(line);
-    return { text: '[redacted]', redactions: 1 };
-  }
-  let text = line;
-  for (const { re, replace } of PATTERNS) {
-    text = text.replace(re, (...args) => {
-      redactions++;
-      return typeof replace === 'function' ? replace(...args) : replace.replace(/\$(\d)/g, (_, n) => args[Number(n)]);
-    });
-  }
-  return { text, redactions };
-}
-
-function sanitizeText(text) {
-  const state = {};
-  let redactions = 0;
-  const lines = String(text).split('\n').map(line => { const r = sanitizeLine(line, state); redactions += r.redactions; return r.text; });
-  return { text: lines.join('\n'), redactions };
-}
-
-// A Verification block must not carry an inline secret literal: the block is
-// recorded as display text and would persist the value. `$references` and
-// empty values are fine.
-// An assignment anywhere in the line (after a word boundary, so `env TOKEN=x cmd`
-// and `true; TOKEN=x cmd` count); `$VAR`, `"$VAR"`, `$(…)` and backtick
-// references are allowed, literals are not.
-const INLINE_SECRET = /(?:^|[\s;&|(])(?:export\s+)?[A-Za-z0-9_]*(?:KEY|SECRET|PASSWORD|PASSWD|TOKEN)[A-Za-z0-9_]*=(?!["']?\$|["']?`|\s|$)\S/i;
-function inlineSecretLine(commands) {
-  const index = commands.findIndex(line => INLINE_SECRET.test(line));
-  return index === -1 ? null : index + 1;
-}
-
-module.exports = { sanitizeLine, sanitizeText, inlineSecretLine, PATTERNS };

package/template/scripts/pincer-runtime/source.cjs

@@ -1,129 +0,0 @@
-'use strict';
-// PINCER runtime — the source manifest (docs/runtime-contracts.md, "Source
-// manifest"): a versioned SHA-256 identity of the inputs a verification ran
-// against. Tracked plus untracked non-ignored files, modes, deletions; tickets
-// and PRDs normalized; fixed and configured exclusions; secret paths, symlinks
-// and submodules refused rather than silently omitted.
-const fs = require('node:fs');
-const path = require('node:path');
-const parse = require('./parse.cjs');
-const { atomicWrite, tryGit } = require('./fsutil.cjs');
-
-const SCHEMA = 1;
-const FIXED_EXCLUDES = ['.git/', '.pincer/', 'NOTES.md', '.prd/evidence/', '.prd/changes/'];
-const EXCLUDE_FILE = '.prd/source-exclude';
-const PROTECTED_PREFIXES = ['tickets/'];
-const NUL = String.fromCharCode(0);
-
-const isTicket = p => /^tickets\/T-[0-9]+.*\.md$/.test(p);
-const isPrd = p => parse.PRD_REF.test(p);
-const isSecret = p => { const b = path.posix.basename(p); return b === '.env' || (b.startsWith('.env.') && b !== '.env.example'); };
-const fixedExcluded = p => FIXED_EXCLUDES.some(rule => (rule.endsWith('/') ? p.startsWith(rule) : p === rule));
-
-// Glob -> RegExp: `**` spans directories, `*` stays within a segment, `?` is one
-// character; a pattern without `/` matches a basename anywhere; a trailing `/`
-// matches a directory prefix.
-function compilePattern(pattern) {
-  const escape = s => s.replace(/[.+^${}()|[\]\\]/g, '\\$&');
-  const glob = s => escape(s).replace(/\*\*/g, 'DOUBLESTAR').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]').replace(/DOUBLESTAR/g, '.*');
-  if (pattern.endsWith('/')) return new RegExp(`^${glob(pattern.slice(0, -1))}/`);
-  if (!pattern.includes('/')) return new RegExp(`(^|/)${glob(pattern)}$`);
-  return new RegExp(`^${glob(pattern.replace(/^\//, ''))}$`);
-}
-function readExcludeFile(root) {
-  const file = path.join(root, EXCLUDE_FILE);
-  if (!fs.existsSync(file)) return [];
-  return fs.readFileSync(file, 'utf8').split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'));
-}
-
-const splitZ = buffer => (buffer ? buffer.toString('utf8').split(NUL).filter(Boolean) : []);
-
-// Compute the manifest. Returns { schema, digest, files, excluded, limitations, problems }.
-function snapshot(root) {
-  const problems = [];
-  const limitations = [];
-  const excluded = [];
-  const toplevel = tryGit(root, ['rev-parse', '--show-toplevel']);
-  if (toplevel.error) {
-    return { schema: SCHEMA, digest: null, files: [], excluded, limitations, problems: [{ code: 'UNSUPPORTED_INPUT', detail: 'not inside a git repository; the source identity needs git' }] };
-  }
-  const tracked = new Map(); // path -> mode from the index
-  const staged = tryGit(root, ['ls-files', '-z', '-s'], { buffer: true });
-  if (staged.error) problems.push({ code: 'UNSUPPORTED_INPUT', detail: `git ls-files failed: ${staged.error}` });
-  else {
-    for (const entry of splitZ(staged.out)) {
-      const match = entry.match(/^(\d{6}) [0-9a-f]{40} \d\t([\s\S]*)$/);
-      if (match) tracked.set(match[2], match[1]);
-    }
-  }
-  const listed = tryGit(root, ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], { buffer: true });
-  const paths = listed.error ? [] : [...new Set(splitZ(listed.out))];
-  const deleted = new Set(splitZ(tryGit(root, ['ls-files', '-z', '--deleted'], { buffer: true }).out));
-  const ignoredDirs = splitZ(tryGit(root, ['ls-files', '-z', '--others', '--ignored', '--exclude-standard', '--directory'], { buffer: true }).out)
-    .filter(p => !p.startsWith('.pincer/') && p !== '.pincer/');
-  if (ignoredDirs.length) {
-    const shown = ignoredDirs.slice(0, 10).join(', ') + (ignoredDirs.length > 10 ? `, ... (${ignoredDirs.length} ignored paths)` : '');
-    limitations.push(`ignored paths are not part of the source identity: ${shown}`);
-  }
-  limitations.push('external services and installed toolchains are not part of the source identity');
-
-  const patterns = readExcludeFile(root).map(pattern => ({ pattern, regex: compilePattern(pattern) }));
-  const entries = [];
-  for (const p of paths) {
-    if (fixedExcluded(p)) { excluded.push(p); continue; }
-    if (isSecret(p)) { problems.push({ code: 'SECRET_PATH', detail: `${p}: secret file in the source view; remove it or ignore it (its contents were not read)` }); continue; }
-    const mode = tracked.get(p);
-    if (mode === '160000') { problems.push({ code: 'UNSUPPORTED_INPUT', detail: `${p}: submodules are not supported` }); continue; }
-    const abs = path.join(root, p);
-    let stat = null;
-    try { stat = fs.lstatSync(abs); } catch { stat = null; }
-    if (mode === '120000' || (stat && stat.isSymbolicLink())) { problems.push({ code: 'UNSUPPORTED_INPUT', detail: `${p}: symbolic links are not supported` }); continue; }
-    const rule = patterns.find(({ regex }) => regex.test(p));
-    if (rule) {
-      if (PROTECTED_PREFIXES.some(prefix => p.startsWith(prefix)) || isPrd(p) || p === EXCLUDE_FILE) problems.push({ code: 'UNSUPPORTED_INPUT', detail: `${EXCLUDE_FILE}: pattern "${rule.pattern}" matches protected path ${p}` });
-      else if (tracked.has(p)) problems.push({ code: 'UNSUPPORTED_INPUT', detail: `${EXCLUDE_FILE}: pattern "${rule.pattern}" matches tracked file ${p}; exclusions may cover untracked paths only` });
-      else excluded.push(p);
-      continue;
-    }
-    if (deleted.has(p) || !stat) { entries.push({ path: p, deleted: true }); continue; }
-    if (stat.isDirectory()) continue;
-    let content;
-    try { content = fs.readFileSync(abs); } catch (error) { problems.push({ code: 'UNSUPPORTED_INPUT', detail: `${p}: cannot read (${error.code || error.message})` }); continue; }
-    let sha;
-    if (isTicket(p)) sha = parse.sha256(parse.normalizeTicket(content.toString('utf8')));
-    else if (isPrd(p)) sha = parse.sha256(parse.normalizePrd(content.toString('utf8')));
-    else sha = parse.sha256(content);
-    entries.push({ path: p, sha256: sha, mode: (stat.mode & 0o111) ? '100755' : '100644' });
-  }
-  entries.sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)));
-  const digestInput = entries.map(e => `${e.deleted ? 'deleted' : e.mode} ${e.deleted ? '-' : e.sha256} ${e.path}\n`).join('');
-  const digest = problems.length ? null : parse.sha256(digestInput);
-  return { schema: SCHEMA, digest, files: entries, excluded, limitations, problems };
-}
-
-function storeManifest(root, manifest) {
-  if (!manifest.digest) throw new Error('cannot store a manifest with problems');
-  const file = path.join(root, '.pincer', 'runtime', 'manifests', `${manifest.digest}.json`);
-  if (!fs.existsSync(file)) atomicWrite(file, `${JSON.stringify(manifest, null, 2)}\n`, { journalDir: path.join(root, '.pincer', 'runtime', 'journal') });
-  return `.pincer/runtime/manifests/${manifest.digest}.json`;
-}
-function readManifest(root, digest) {
-  const file = path.join(root, '.pincer', 'runtime', 'manifests', `${digest}.json`);
-  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
-}
-
-// Paths that differ between two manifests, for diagnostics.
-function diffManifests(before, after) {
-  const a = new Map(before.files.map(e => [e.path, e]));
-  const b = new Map(after.files.map(e => [e.path, e]));
-  const changed = [];
-  for (const [p, e] of b) {
-    const prior = a.get(p);
-    if (!prior) changed.push(`${p} (added)`);
-    else if (JSON.stringify(prior) !== JSON.stringify(e)) changed.push(`${p}${e.deleted ? ' (deleted)' : prior.mode !== e.mode ? ' (mode)' : ''}`);
-  }
-  for (const p of a.keys()) if (!b.has(p)) changed.push(`${p} (removed)`);
-  return changed;
-}
-
-module.exports = { SCHEMA, FIXED_EXCLUDES, EXCLUDE_FILE, snapshot, storeManifest, readManifest, diffManifests, compilePattern, isSecret };