project-tiny-context-harness 0.2.84 → 0.6.0

package/dist/lib/long-task-risk-surfaces.js

@@ -0,0 +1,60 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { matchesRepoPattern } from "./long-task-paths.js";
+import { parseStrictYaml } from "./strict-codec.js";
+export async function validateActualRiskSurfaces(repository, changedPaths, contract) {
+    const inferred = new Set();
+    const surfaces = await readRiskSurfaces(repository);
+    for (const surface of surfaces)
+        if (changedPaths.some((changed) => surface.paths.some((pattern) => matchesRepoPattern(changed, pattern)))) {
+            if (surface.risk === "classification_required")
+                throw new Error("risk_classification_required");
+            inferred.add(surface.risk);
+        }
+    for (const fact of inferred)
+        if (contract.risk.facts[fact].length === 0)
+            throw new Error(`risk_fact_underdeclared:${fact}`);
+}
+async function readRiskSurfaces(repository) {
+    const file = path.join(repository, "project_context", "risk-surfaces.yaml");
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const value = parseStrictYaml(raw);
+    if (!Array.isArray(value))
+        throw new Error("risk_surfaces_invalid:root");
+    const facts = new Set([
+        "public_api_or_schema_change",
+        "persistent_data_change",
+        "data_migration",
+        "security_boundary_change",
+        "permission_boundary_change",
+        "irreversible_external_effect",
+        "critical_user_path",
+        "full_population_operation",
+        "multi_repository_change",
+        "weak_observability",
+        "classification_required",
+    ]);
+    return value.map((item, index) => {
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            throw new Error(`risk_surfaces_invalid:${index}`);
+        const row = item;
+        if (Object.keys(row).some((key) => !["risk", "paths"].includes(key)) ||
+            typeof row.risk !== "string" ||
+            !facts.has(row.risk) ||
+            !Array.isArray(row.paths) ||
+            row.paths.some((value) => typeof value !== "string" || !value))
+            throw new Error(`risk_surfaces_invalid:${index}`);
+        return {
+            risk: row.risk,
+            paths: row.paths,
+        };
+    });
+}

package/dist/lib/long-task-risk-types.d.ts

@@ -0,0 +1,5 @@
+export type RequestedRiskLevel = "auto" | "standard" | "strict";
+export type EffectiveRiskLevel = "standard" | "strict";
+export declare const RISK_FACT_NAMES: readonly ["public_api_or_schema_change", "persistent_data_change", "data_migration", "security_boundary_change", "permission_boundary_change", "irreversible_external_effect", "critical_user_path", "full_population_operation", "multi_repository_change", "weak_observability"];
+export type RiskFactName = (typeof RISK_FACT_NAMES)[number];
+export type LongTaskRiskFacts = Record<RiskFactName, string[]>;

package/dist/lib/long-task-risk-types.js

@@ -0,0 +1,12 @@
+export const RISK_FACT_NAMES = [
+    "public_api_or_schema_change",
+    "persistent_data_change",
+    "data_migration",
+    "security_boundary_change",
+    "permission_boundary_change",
+    "irreversible_external_effect",
+    "critical_user_path",
+    "full_population_operation",
+    "multi_repository_change",
+    "weak_observability",
+];

package/dist/lib/long-task-risk.d.ts

@@ -0,0 +1,9 @@
+import type { DeliveryContractV2, EffectiveRiskLevel, RiskFactName } from "./long-task-delivery-types.js";
+export interface RiskDecisionV2 {
+    effective_level: EffectiveRiskLevel;
+    minimum_level: EffectiveRiskLevel;
+    reasons: string[];
+    reasons_by_outcome: Record<string, RiskFactName[]>;
+}
+export declare function classifyLongTaskRisk(contract: DeliveryContractV2): RiskDecisionV2;
+export declare function validateRiskProof(contract: DeliveryContractV2, decision: RiskDecisionV2): void;

package/dist/lib/long-task-risk.js

@@ -0,0 +1,132 @@
+const STRICT_FACTS = new Set([
+    "public_api_or_schema_change",
+    "persistent_data_change",
+    "data_migration",
+    "security_boundary_change",
+    "permission_boundary_change",
+    "irreversible_external_effect",
+    "full_population_operation",
+    "multi_repository_change",
+]);
+export function classifyLongTaskRisk(contract) {
+    const outcomeKeys = new Set(contract.outcomes.map((outcome) => outcome.key));
+    const reasonsByOutcome = Object.fromEntries(contract.outcomes.map((outcome) => [outcome.key, []]));
+    for (const [fact, outcomes] of Object.entries(contract.risk.facts)) {
+        for (const outcome of outcomes) {
+            if (!outcomeKeys.has(outcome))
+                throw new Error(`risk_outcome_unknown:${fact}:${outcome}`);
+            reasonsByOutcome[outcome].push(fact);
+        }
+    }
+    if (contract.risk.facts.multi_repository_change.length)
+        throw new Error("multi_repository_delivery_not_supported_v2");
+    const reasons = Object.entries(reasonsByOutcome)
+        .flatMap(([outcome, facts]) => facts
+        .filter((fact) => STRICT_FACTS.has(fact))
+        .map((fact) => `${fact}:${outcome}`))
+        .concat(contract.outcomes
+        .filter((outcome) => contract.risk.facts.critical_user_path.includes(outcome.key) &&
+        contract.risk.facts.weak_observability.includes(outcome.key))
+        .map((outcome) => `critical_user_path_with_weak_observability:${outcome.key}`));
+    const minimum = reasons.length ? "strict" : "standard";
+    if (contract.risk.requested_level === "standard" && minimum === "strict")
+        throw new Error(`risk_level_below_required:${reasons.join(",")}`);
+    return {
+        minimum_level: minimum,
+        effective_level: contract.risk.requested_level === "strict" ? "strict" : minimum,
+        reasons,
+        reasons_by_outcome: reasonsByOutcome,
+    };
+}
+export function validateRiskProof(contract, decision) {
+    const errors = [];
+    if (!contract.outcomes.length)
+        errors.push("outcome_required");
+    for (const check of contract.global.acceptance.checks)
+        validateCheck(check, "global", errors);
+    for (const outcome of contract.outcomes)
+        validateOutcome(outcome, errors);
+    if (decision.effective_level === "strict")
+        validateStrict(contract, decision, errors);
+    if (errors.length)
+        throw new Error(`delivery_contract_preflight_failed:\n${errors.join("\n")}`);
+}
+function validateOutcome(outcome, errors) {
+    const checks = new Map(outcome.acceptance.checks.map((check) => [check.key, check]));
+    if (!checks.size)
+        errors.push(`outcome_without_executable_check:${outcome.key}`);
+    if (!outcome.technical.expected_change_paths.length)
+        errors.push(`expected_change_paths_empty:${outcome.key}`);
+    for (const check of checks.values())
+        validateCheck(check, outcome.key, errors);
+    if ((outcome.product.owner_surfaces.length ||
+        outcome.product.controls.length) &&
+        ![...checks.values()].some((check) => check.proof_surface === "ui_browser"))
+        errors.push(`ui_outcome_requires_ui_browser_proof:${outcome.key}`);
+    const referenced = [
+        ...(outcome.acceptance.population
+            ? [outcome.acceptance.population.check_key]
+            : []),
+        ...outcome.acceptance.counterfactual_controls.map((control) => control.check_key),
+        ...(outcome.technical.rollback_and_recovery?.verification_check_keys ?? []),
+        ...outcome.technical.bindings.flatMap((binding) => binding.verification_check_key ? [binding.verification_check_key] : []),
+    ];
+    for (const checkKey of referenced)
+        if (!checks.has(checkKey))
+            errors.push(`outcome_check_reference_unknown:${outcome.key}:${checkKey}`);
+}
+function validateStrict(contract, decision, errors) {
+    const explicitStrictWithoutFacts = contract.risk.requested_level === "strict" && decision.reasons.length === 0;
+    for (const outcome of contract.outcomes) {
+        const facts = new Set(decision.reasons_by_outcome[outcome.key]);
+        const checks = outcome.acceptance.checks;
+        const hasNegative = checks.some((check) => check.negative_assertions.length > 0);
+        const hasCounterfactual = outcome.acceptance.counterfactual_controls.length > 0;
+        if (explicitStrictWithoutFacts) {
+            if (!hasNegative)
+                errors.push(`strict_negative_assertion_required:${outcome.key}`);
+            if (!hasCounterfactual)
+                errors.push(`strict_counterfactual_control_required:${outcome.key}`);
+        }
+        if (facts.has("security_boundary_change") ||
+            facts.has("permission_boundary_change"))
+            requireStrictProof(outcome, "security_boundary", hasNegative, hasCounterfactual, errors);
+        if (facts.has("public_api_or_schema_change"))
+            requireStrictProof(outcome, "api_contract", hasNegative, hasCounterfactual, errors);
+        if (facts.has("persistent_data_change") || facts.has("data_migration")) {
+            requireStrictProof(outcome, "data_state", hasNegative, hasCounterfactual, errors);
+            if (!outcome.technical.rollback_and_recovery)
+                errors.push(`strict_rollback_and_recovery_required:${outcome.key}`);
+        }
+        if (facts.has("irreversible_external_effect") &&
+            !outcome.technical.rollback_and_recovery)
+            errors.push(`strict_rollback_and_recovery_required:${outcome.key}`);
+        if (facts.has("full_population_operation")) {
+            if (!checks.some((check) => check.proof_surface === "population_coverage"))
+                errors.push(`strict_population_coverage_proof_required:${outcome.key}`);
+            if (!outcome.acceptance.population)
+                errors.push(`strict_population_declaration_required:${outcome.key}`);
+        }
+        if (facts.has("critical_user_path") &&
+            facts.has("weak_observability") &&
+            !checks.some((check) => check.proof_surface === "ui_browser" ||
+                check.proof_surface === "runtime_behavior"))
+            errors.push(`strict_critical_path_observable_proof_required:${outcome.key}`);
+    }
+}
+function requireStrictProof(outcome, surface, hasNegative, hasCounterfactual, errors) {
+    if (!outcome.acceptance.checks.some((check) => check.proof_surface === surface))
+        errors.push(`strict_${surface}_proof_required:${outcome.key}`);
+    if (!hasNegative)
+        errors.push(`strict_negative_assertion_required:${outcome.key}`);
+    if (!hasCounterfactual)
+        errors.push(`strict_counterfactual_control_required:${outcome.key}`);
+}
+function validateCheck(check, owner, errors) {
+    if (!check.verification_inputs.length)
+        errors.push(`verification_inputs_empty:${owner}:${check.key}`);
+    if (check.runner.retry_policy === "transient_once" &&
+        (!check.runner.idempotent ||
+            !["read_only", "test_sandbox"].includes(check.runner.effect)))
+        errors.push(`unsafe_retry_policy:${owner}:${check.key}`);
+}

package/dist/lib/long-task-root-shape.d.ts

@@ -0,0 +1,4 @@
+import type { DeliveryContractV2 } from "./long-task-delivery-types.js";
+export declare function parseTask(value: unknown): DeliveryContractV2["task"];
+export declare function parseRisk(value: unknown): DeliveryContractV2["risk"];
+export declare function parseGlobal(value: unknown): DeliveryContractV2["global"];

package/dist/lib/long-task-root-shape.js

@@ -0,0 +1,86 @@
+import { parseGlobalCounterfactuals } from "./long-task-acceptance-shape.js";
+import { parseCheck } from "./long-task-check-shape.js";
+import { array, key, literal, object, parseKeyedPaths, parseKeyedStatements, repositoryFiles, string, strings, } from "./long-task-delivery-shape.js";
+const RISK_FACTS = [
+    "public_api_or_schema_change",
+    "persistent_data_change",
+    "data_migration",
+    "security_boundary_change",
+    "permission_boundary_change",
+    "irreversible_external_effect",
+    "critical_user_path",
+    "full_population_operation",
+    "multi_repository_change",
+    "weak_observability",
+];
+export function parseTask(value) {
+    const row = object(value, "task", ["id", "title", "goal", "source_paths", "context_refs"], ["context_snapshot_mode"]);
+    return {
+        id: key(row.id, "task.id"),
+        title: string(row.title, "task.title"),
+        goal: string(row.goal, "task.goal"),
+        source_paths: repositoryFiles(row.source_paths, "task.source_paths"),
+        context_refs: repositoryFiles(row.context_refs, "task.context_refs"),
+        context_snapshot_mode: Object.hasOwn(row, "context_snapshot_mode")
+            ? literal(row.context_snapshot_mode, ["referenced", "full"], "task.context_snapshot_mode")
+            : "referenced",
+    };
+}
+export function parseRisk(value) {
+    const row = object(value, "risk", ["facts"], ["requested_level"]);
+    const facts = object(row.facts, "risk.facts", [], [...RISK_FACTS]);
+    return {
+        requested_level: Object.hasOwn(row, "requested_level")
+            ? literal(row.requested_level, ["auto", "standard", "strict"], "risk.requested_level")
+            : "auto",
+        facts: Object.fromEntries(RISK_FACTS.map((name) => [
+            name,
+            Object.hasOwn(facts, name)
+                ? strings(facts[name], `risk.facts.${name}`).map((item, index) => key(item, `risk.facts.${name}[${index}]`))
+                : [],
+        ])),
+    };
+}
+export function parseGlobal(value) {
+    const row = object(value, "global", [], ["product", "technical", "acceptance"]);
+    const product = object(Object.hasOwn(row, "product") ? row.product : {}, "global.product", [], ["non_goals"]);
+    const technical = object(Object.hasOwn(row, "technical") ? row.technical : {}, "global.technical", [], ["constraints", "forbidden_paths", "forbidden_shortcuts"]);
+    const acceptance = object(Object.hasOwn(row, "acceptance") ? row.acceptance : {}, "global.acceptance", [], ["checks", "counterfactual_controls", "external_confirmations"]);
+    return {
+        product: {
+            non_goals: Object.hasOwn(product, "non_goals")
+                ? parseKeyedStatements(product.non_goals, "global.product.non_goals")
+                : [],
+        },
+        technical: {
+            constraints: Object.hasOwn(technical, "constraints")
+                ? parseKeyedStatements(technical.constraints, "global.technical.constraints")
+                : [],
+            forbidden_paths: Object.hasOwn(technical, "forbidden_paths")
+                ? parseKeyedPaths(technical.forbidden_paths, "global.technical.forbidden_paths")
+                : [],
+            forbidden_shortcuts: Object.hasOwn(technical, "forbidden_shortcuts")
+                ? parseKeyedStatements(technical.forbidden_shortcuts, "global.technical.forbidden_shortcuts")
+                : [],
+        },
+        acceptance: {
+            checks: Object.hasOwn(acceptance, "checks")
+                ? array(acceptance.checks, "global.acceptance.checks").map((item, index) => parseCheck(item, `global.acceptance.checks[${index}]`))
+                : [],
+            counterfactual_controls: Object.hasOwn(acceptance, "counterfactual_controls")
+                ? parseGlobalCounterfactuals(acceptance.counterfactual_controls, "global.acceptance.counterfactual_controls")
+                : [],
+            external_confirmations: Object.hasOwn(acceptance, "external_confirmations")
+                ? array(acceptance.external_confirmations, "global.acceptance.external_confirmations").map((item, index) => {
+                    const label = `global.acceptance.external_confirmations[${index}]`;
+                    const entry = object(item, label, ["key", "description", "owner"]);
+                    return {
+                        key: key(entry.key, `${label}.key`),
+                        description: string(entry.description, `${label}.description`),
+                        owner: string(entry.owner, `${label}.owner`),
+                    };
+                })
+                : [],
+        },
+    };
+}

package/dist/lib/long-task-runner-environment.d.ts

@@ -0,0 +1,7 @@
+import type { EnvironmentRequirementV2 } from "./long-task-delivery-types.js";
+export declare function runnerEnvironment(requirements: EnvironmentRequirementV2[]): NodeJS.ProcessEnv;
+export declare function declaredEnvironmentValues(requirements: EnvironmentRequirementV2[]): string[];
+export declare function outputContainsDeclaredEnvironmentValue(raw: {
+    stdout: Buffer;
+    stderr: Buffer;
+}, values: string[]): boolean;

package/dist/lib/long-task-runner-environment.js

@@ -0,0 +1,57 @@
+const BASE_ENVIRONMENT_KEYS = [
+    "PATH",
+    "PATHEXT",
+    "SystemRoot",
+    "WINDIR",
+    "ComSpec",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "HOME",
+    "USERPROFILE",
+    "HOMEDRIVE",
+    "HOMEPATH",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "LANG",
+    "LC_ALL",
+    "TZ",
+    "CI",
+    "TERM",
+    "NO_COLOR",
+    "FORCE_COLOR",
+];
+export function runnerEnvironment(requirements) {
+    const environment = {
+        TY_CONTEXT_CHECK_PROTOCOL: "long-task-check-result-v2",
+    };
+    for (const key of BASE_ENVIRONMENT_KEYS)
+        copyEnvironmentValue(environment, key);
+    for (const requirement of requirements)
+        if (requirement.kind === "env_var")
+            copyEnvironmentValue(environment, requirement.target);
+    return environment;
+}
+export function declaredEnvironmentValues(requirements) {
+    const values = [];
+    for (const requirement of requirements) {
+        if (requirement.kind !== "env_var")
+            continue;
+        const value = process.env[requirement.target];
+        if (value)
+            values.push(value);
+    }
+    return values;
+}
+export function outputContainsDeclaredEnvironmentValue(raw, values) {
+    if (!values.length)
+        return false;
+    const stdout = raw.stdout.toString("utf8");
+    const stderr = raw.stderr.toString("utf8");
+    return values.some((value) => stdout.includes(value) || stderr.includes(value));
+}
+function copyEnvironmentValue(environment, key) {
+    const value = process.env[key];
+    if (value !== undefined)
+        environment[key] = value;
+}

package/dist/lib/long-task-runner-files.d.ts

@@ -0,0 +1,3 @@
+export declare function nearestRunnerFile(start: string, repository: string, name: string): Promise<string | null>;
+export declare function npmCliPath(): Promise<string>;
+export declare function npxCliPath(): Promise<string>;

package/dist/lib/long-task-runner-files.js

@@ -0,0 +1,39 @@
+import { stat } from "node:fs/promises";
+import path from "node:path";
+export async function nearestRunnerFile(start, repository, name) {
+    let current = path.resolve(start);
+    const root = path.resolve(repository);
+    for (;;) {
+        const candidate = path.join(current, name);
+        if ((await stat(candidate).catch(() => null))?.isFile())
+            return candidate;
+        if (current === root)
+            return null;
+        const parent = path.dirname(current);
+        if (parent === current || !parent.startsWith(root))
+            return null;
+        current = parent;
+    }
+}
+export async function npmCliPath() {
+    const candidates = [
+        process.env.npm_execpath,
+        path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"),
+    ].filter((candidate) => Boolean(candidate));
+    for (const candidate of candidates)
+        if ((await stat(candidate).catch(() => null))?.isFile())
+            return candidate;
+    throw new Error("npm_cli_not_found_for_package_script_runner");
+}
+export async function npxCliPath() {
+    const candidates = [
+        process.env.npm_execpath
+            ? path.join(path.dirname(process.env.npm_execpath), "npx-cli.js")
+            : null,
+        path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", "npx-cli.js"),
+    ].filter((candidate) => Boolean(candidate));
+    for (const candidate of candidates)
+        if ((await stat(candidate).catch(() => null))?.isFile())
+            return candidate;
+    throw new Error("npx_cli_not_found_for_playwright_runner");
+}

package/dist/lib/long-task-runner-freeze.d.ts

@@ -0,0 +1,2 @@
+import type { CompiledCheckV2, DeliveryCheckV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+export declare function freezeDeliveryCheck(check: DeliveryCheckV2, outcomeKey: string | null, repository: string, baseline: WorkspaceManifestV2): Promise<CompiledCheckV2>;

package/dist/lib/long-task-runner-freeze.js

@@ -0,0 +1,168 @@
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { computeRawExecutionIdentity } from "./long-task-check-execution-policy.js";
+import { assertRepositoryPattern, classifyRepositoryPatternOverlap, matchesRepoPattern, } from "./long-task-paths.js";
+import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
+import { nearestRunnerFile, npmCliPath, npxCliPath, } from "./long-task-runner-files.js";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+import { repoRelative, resolveInsideRepository, } from "./long-task-workspace.js";
+import { evidenceAdapterForRunner } from "./long-task-evidence-adapter-policy.js";
+export async function freezeDeliveryCheck(check, outcomeKey, repository, baseline) {
+    const prefix = outcomeKey ? `CHECK.${outcomeKey}` : "CHECK.GLOBAL";
+    const expectedOutputs = check.expected_output_paths.map((pattern, index) => assertRepositoryPattern(repository, pattern, `${check.key}.expected_output_paths[${index}]`));
+    for (const [index, pattern] of check.input_paths.entries()) {
+        const normalized = assertRepositoryPattern(repository, pattern, `${check.key}.input_paths[${index}]`);
+        if (!baseline.files.some((file) => matchesRepoPattern(file.path, normalized)) &&
+            !expectedOutputs.some((output) => classifyRepositoryPatternOverlap(output, normalized).status ===
+                "proven_overlap"))
+            throw new Error(`input_path_not_found:${check.key}:${pattern}`);
+    }
+    check.artifact_globs.forEach((pattern, index) => assertRepositoryPattern(repository, pattern, `${check.key}.artifact_globs[${index}]`));
+    const cwd = resolveInsideRepository(repository, check.runner.cwd, `${check.key}.cwd`);
+    if (!(await stat(cwd).catch(() => null))?.isDirectory())
+        throw new Error(`runner_cwd_not_found:${check.key}:${check.runner.cwd}`);
+    const target = await resolvedRunnerTarget(check, repository, cwd);
+    const verificationInputHashes = await freezeVerificationInputs(check, repository, baseline, cwd, target);
+    const compiled = {
+        ...check,
+        internal_id: `${prefix}.${check.key}`,
+        outcome_key: outcomeKey,
+        evidence_adapter: evidenceAdapterForRunner(check.runner.type),
+        runner: await freezeRunner(check, repository, cwd, target, verificationInputHashes),
+        verification_input_hashes: verificationInputHashes,
+    };
+    return {
+        ...compiled,
+        raw_execution_identity: computeRawExecutionIdentity(compiled),
+    };
+}
+async function resolvedRunnerTarget(check, repository, cwd) {
+    if (check.runner.type === "package_script") {
+        const packageFile = await nearestRunnerFile(cwd, repository, "package.json");
+        if (!packageFile)
+            throw new Error(`package_json_not_found:${check.key}:${check.runner.cwd}`);
+        return assertProtectedRepositoryFile(repository, packageFile, `${check.key}.package_json`);
+    }
+    const target = resolveInsideRepository(cwd, check.runner.target, `${check.key}.target`);
+    if (!(await stat(target).catch(() => null))?.isFile())
+        throw new Error(`${check.runner.type}_path_not_found:${check.key}:${check.runner.target}`);
+    const protectedTarget = await assertProtectedRepositoryFile(repository, target, `${check.key}.runner_target`);
+    repoRelative(repository, protectedTarget);
+    return protectedTarget;
+}
+async function freezeRunner(check, repository, cwd, target, verificationInputHashes) {
+    const runner = check.runner;
+    if (runner.argv.some((value) => value.includes("\0")))
+        throw new Error(`runner_argument_invalid:${check.key}`);
+    const resolvedCwd = repoRelative(repository, cwd);
+    const resolvedTarget = repoRelative(repository, target);
+    const frozenFiles = { ...verificationInputHashes };
+    let executable;
+    let prefix;
+    let packageScript = null;
+    if (runner.type === "package_script") {
+        const packageJson = JSON.parse(await readFile(target, "utf8"));
+        const script = packageJson.scripts?.[runner.target];
+        if (typeof script !== "string" || !script.trim())
+            throw new Error(`package_script_not_found:${check.key}:${runner.target}`);
+        packageScript = script;
+        executable = process.execPath;
+        prefix = [await npmCliPath(), "run", runner.target, "--"];
+    }
+    else {
+        const relativeFromCwd = path.relative(cwd, target).replace(/\\/gu, "/");
+        if (runner.type === "node_oracle") {
+            executable = process.execPath;
+            prefix = [relativeFromCwd];
+        }
+        else if (runner.type === "playwright_test") {
+            executable = process.execPath;
+            prefix = [
+                await npxCliPath(),
+                "--no-install",
+                "playwright",
+                "test",
+                relativeFromCwd,
+                "--reporter=json",
+            ];
+        }
+        else {
+            executable = resolvedTarget;
+            prefix = [];
+        }
+    }
+    const definition = sha256Hex(canonicalValueJson({
+        runner,
+        resolved_cwd: resolvedCwd,
+        resolved_target: resolvedTarget,
+        package_script: packageScript,
+    }));
+    return {
+        ...runner,
+        executable,
+        executable_argv_prefix: prefix,
+        resolved_cwd: resolvedCwd,
+        resolved_target: resolvedTarget,
+        definition_sha256: definition,
+        frozen_files: sortRecord(frozenFiles),
+        package_script: packageScript,
+        execution_identity: sha256Hex(canonicalValueJson({
+            runner,
+            executable,
+            prefix,
+            resolved_cwd: resolvedCwd,
+            resolved_target: resolvedTarget,
+            package_script: packageScript,
+            frozen_files: frozenFiles,
+        })),
+    };
+}
+async function freezeVerificationInputs(check, repository, manifest, cwd, target) {
+    const result = {};
+    for (const [index, source] of check.verification_inputs.entries()) {
+        const pattern = assertRepositoryPattern(repository, source, `${check.key}.verification_inputs[${index}]`);
+        const matches = manifest.files.filter((file) => matchesRepoPattern(file.path, pattern));
+        if (!matches.length)
+            throw new Error(`verification_input_not_found:${check.key}:${source}`);
+        for (const file of matches) {
+            const protectedFile = await assertProtectedRepositoryFile(repository, path.join(repository, ...file.path.split("/")), `${check.key}.verification_input`);
+            result[file.path] = sha256Hex(await readFile(protectedFile));
+        }
+    }
+    const automatic = new Set([repoRelative(repository, target)]);
+    const packageFile = await nearestRunnerFile(cwd, repository, "package.json");
+    if (packageFile)
+        automatic.add(repoRelative(repository, packageFile));
+    for (const name of [
+        "package-lock.json",
+        "npm-shrinkwrap.json",
+        "pnpm-lock.yaml",
+        "yarn.lock",
+    ]) {
+        const file = await nearestRunnerFile(cwd, repository, name);
+        if (file)
+            automatic.add(repoRelative(repository, file));
+    }
+    if (check.runner.type === "playwright_test")
+        for (const name of [
+            "playwright.config.ts",
+            "playwright.config.js",
+            "playwright.config.mjs",
+            "playwright.config.cjs",
+        ]) {
+            const file = await nearestRunnerFile(cwd, repository, name);
+            if (file)
+                automatic.add(repoRelative(repository, file));
+        }
+    for (const relative of automatic) {
+        const file = manifest.files.find((candidate) => candidate.path === relative);
+        if (!file)
+            throw new Error(`verification_input_not_found:${check.key}:${relative}`);
+        const protectedFile = await assertProtectedRepositoryFile(repository, path.join(repository, ...relative.split("/")), `${check.key}.automatic_verification_input`);
+        result[relative] = sha256Hex(await readFile(protectedFile));
+    }
+    return sortRecord(result);
+}
+function sortRecord(value) {
+    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
+}