project-tiny-context-harness 0.7.9 → 0.8.0

package/dist/lib/long-task-ui-surface-shape.js

@@ -0,0 +1,94 @@
+import { DESIGN_RESOURCE_VERIFICATION_METHODS } from "./design-resource-handoff-types.js";
+import { array, key, literal, object, repositoryFile, repositoryFiles, string, strings, } from "./long-task-shape-primitives.js";
+export function parseSurfaceBindings(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "surface_ref",
+            "target_ref",
+            "control_refs",
+            "route_binding_ref",
+            "component_binding_refs",
+            "root_journey_check_ref",
+            "entry_action_ref",
+            "design_targets",
+            "acceptance_blockers",
+        ]);
+        return {
+            key: key(row.key, `${itemLabel}.key`),
+            surface_ref: string(row.surface_ref, `${itemLabel}.surface_ref`),
+            target_ref: key(row.target_ref, `${itemLabel}.target_ref`),
+            control_refs: keys(row.control_refs, `${itemLabel}.control_refs`),
+            route_binding_ref: key(row.route_binding_ref, `${itemLabel}.route_binding_ref`),
+            component_binding_refs: keys(row.component_binding_refs, `${itemLabel}.component_binding_refs`),
+            root_journey_check_ref: key(row.root_journey_check_ref, `${itemLabel}.root_journey_check_ref`),
+            entry_action_ref: key(row.entry_action_ref, `${itemLabel}.entry_action_ref`),
+            design_targets: parseDesignTargets(row.design_targets, `${itemLabel}.design_targets`),
+            acceptance_blockers: parseAcceptanceBlockers(row.acceptance_blockers, `${itemLabel}.acceptance_blockers`),
+        };
+    });
+}
+function parseDesignTargets(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "interpretation",
+            "source_paths",
+            "condition_keys",
+            "claim_refs",
+            "conformance_check_ref",
+            "conformance_assertion_ref",
+            "verification_method_bindings",
+            "actual_artifact_path",
+            "comparison_artifact_path",
+        ]);
+        return {
+            key: key(row.key, `${itemLabel}.key`),
+            interpretation: literal(row.interpretation, ["exact_target", "constraint"], `${itemLabel}.interpretation`),
+            source_paths: repositoryFiles(row.source_paths, `${itemLabel}.source_paths`),
+            condition_keys: keys(row.condition_keys, `${itemLabel}.condition_keys`),
+            claim_refs: strings(row.claim_refs, `${itemLabel}.claim_refs`),
+            conformance_check_ref: key(row.conformance_check_ref, `${itemLabel}.conformance_check_ref`),
+            conformance_assertion_ref: key(row.conformance_assertion_ref, `${itemLabel}.conformance_assertion_ref`),
+            verification_method_bindings: parseVerificationMethodBindings(row.verification_method_bindings, `${itemLabel}.verification_method_bindings`),
+            actual_artifact_path: repositoryFile(row.actual_artifact_path, `${itemLabel}.actual_artifact_path`),
+            comparison_artifact_path: repositoryFile(row.comparison_artifact_path, `${itemLabel}.comparison_artifact_path`),
+        };
+    });
+}
+function parseAcceptanceBlockers(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "status",
+            "refs",
+            "source_item_refs",
+            "verification_methods",
+            "rationale",
+        ]);
+        return {
+            key: key(row.key, `${itemLabel}.key`),
+            status: literal(row.status, ["machine_claim", "external_confirmation"], `${itemLabel}.status`),
+            refs: strings(row.refs, `${itemLabel}.refs`),
+            source_item_refs: strings(row.source_item_refs, `${itemLabel}.source_item_refs`),
+            verification_methods: array(row.verification_methods, `${itemLabel}.verification_methods`).map((method, methodIndex) => literal(method, DESIGN_RESOURCE_VERIFICATION_METHODS, `${itemLabel}.verification_methods[${methodIndex}]`)),
+            rationale: string(row.rationale, `${itemLabel}.rationale`),
+        };
+    });
+}
+function parseVerificationMethodBindings(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, ["method", "assertion_ref"]);
+        return {
+            method: literal(row.method, DESIGN_RESOURCE_VERIFICATION_METHODS, `${itemLabel}.method`),
+            assertion_ref: key(row.assertion_ref, `${itemLabel}.assertion_ref`),
+        };
+    });
+}
+function keys(value, label) {
+    return array(value, label).map((item, index) => key(item, `${label}[${index}]`));
+}

package/dist/lib/long-task-ui-surface-types.d.ts

@@ -0,0 +1,44 @@
+import type { DesignResourceVerificationMethod } from "./design-resource-handoff-types.js";
+export type DesignTargetInterpretationV2 = "exact_target" | "constraint";
+export interface DeliveryDesignVerificationBindingV2 {
+    method: DesignResourceVerificationMethod;
+    assertion_ref: string;
+}
+export interface DeliveryDesignTargetV2 {
+    key: string;
+    interpretation: DesignTargetInterpretationV2;
+    source_paths: string[];
+    condition_keys: string[];
+    claim_refs: string[];
+    conformance_check_ref: string;
+    conformance_assertion_ref: string;
+    verification_method_bindings: DeliveryDesignVerificationBindingV2[];
+    actual_artifact_path: string;
+    comparison_artifact_path: string;
+}
+export type DesignAcceptanceBlockerStatusV2 = "machine_claim" | "external_confirmation";
+export interface DeliveryDesignAcceptanceBlockerV2 {
+    key: string;
+    status: DesignAcceptanceBlockerStatusV2;
+    refs: string[];
+    source_item_refs: string[];
+    verification_methods: DesignResourceVerificationMethod[];
+    rationale: string;
+}
+export interface DeliverySurfaceBindingV2 {
+    key: string;
+    surface_ref: string;
+    target_ref: string;
+    control_refs: string[];
+    route_binding_ref: string;
+    component_binding_refs: string[];
+    root_journey_check_ref: string;
+    entry_action_ref: string;
+    design_targets: DeliveryDesignTargetV2[];
+    acceptance_blockers: DeliveryDesignAcceptanceBlockerV2[];
+}
+export interface CompiledDesignTargetV2 extends DeliveryDesignTargetV2 {
+    surface_binding_ref: string;
+    surface_ref: string;
+    target_ref: string;
+}

package/dist/lib/long-task-ui-surface-types.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/long-task-ui-surface-validation.d.ts

@@ -0,0 +1,11 @@
+import type { CompiledClaimsV2 } from "./long-task-claims.js";
+import type { DeliveryCheckV2, DeliveryOutcomeV2, ProductClaimV2, ProofSurface } from "./long-task-delivery-types.js";
+export type Reporter = (message: string) => void;
+export declare function bindingCarriers(routeRef: string, componentRefs: string[], bindings: Map<string, DeliveryOutcomeV2["technical"]["bindings"][number]>, label: string, report?: Reporter): string[];
+export declare function validateRootJourney(binding: DeliveryOutcomeV2["product"]["surface_bindings"][number], check: DeliveryCheckV2, label: string, report?: Reporter): void;
+export declare function validateTargetLocalClaimProof(outcome: DeliveryOutcomeV2, claim: ProductClaimV2, targetRef: string, expectedSurface: ProofSurface | null, claims: CompiledClaimsV2, checks: Map<string, DeliveryCheckV2>, label: string, report?: Reporter): void;
+export declare function expectedControlProofSurface(runtimeFamily: string | undefined): ProofSurface;
+export declare function controlClaims(claims: Map<string, ProductClaimV2>, controlRef: string): ProductClaimV2[];
+export declare function validateCarrierInputs(check: DeliveryCheckV2, carriers: string[], label: string, report?: Reporter): void;
+export declare function unique(values: string[], code: string, detail: string, report?: Reporter): void;
+export declare function issue(report: Reporter | undefined, code: string, detail: string): void;

package/dist/lib/long-task-ui-surface-validation.js

@@ -0,0 +1,62 @@
+import { proveRepositoryPatternSubset } from "./long-task-paths.js";
+export function bindingCarriers(routeRef, componentRefs, bindings, label, report) {
+    if (!componentRefs.length)
+        issue(report, "ui_surface_binding_component_ref_required", label);
+    unique(componentRefs, "ui_surface_binding_component_ref_duplicate", label, report);
+    const carriers = [];
+    for (const ref of [routeRef, ...componentRefs]) {
+        const binding = bindings.get(ref);
+        if (!binding) {
+            issue(report, "ui_surface_binding_technical_binding_unknown", `${label}:${ref}`);
+            continue;
+        }
+        if (!binding.carrier_paths.length)
+            issue(report, "ui_surface_binding_carrier_required", `${label}:${ref}`);
+        carriers.push(...binding.carrier_paths);
+    }
+    return [...new Set(carriers)].sort();
+}
+export function validateRootJourney(binding, check, label, report) {
+    if (check.execution_target.target_ref !== binding.target_ref ||
+        check.execution_target.entrypoint !== "root")
+        issue(report, "ui_surface_binding_root_target_mismatch", label);
+    if (!check.journey_roles.includes("success"))
+        issue(report, "ui_surface_binding_root_success_required", label);
+    if (!check.scenario.when.some((step) => step.key === binding.entry_action_ref))
+        issue(report, "ui_surface_binding_entry_action_unknown", `${label}:${binding.entry_action_ref}`);
+}
+export function validateTargetLocalClaimProof(outcome, claim, targetRef, expectedSurface, claims, checks, label, report) {
+    const proofs = claims.summary.claims_by_outcome[outcome.key]?.[claim.local_key]?.proofs ??
+        [];
+    const matched = proofs.some((proof) => {
+        const check = checks.get(proof.check_key);
+        return (check?.execution_target.target_ref === targetRef &&
+            (expectedSurface === null || proof.proof_surface === expectedSurface));
+    });
+    if (!matched)
+        issue(report, "ui_surface_binding_target_claim_proof_missing", `${label}:${claim.local_key}:${targetRef}:${expectedSurface ?? "any"}`);
+}
+export function expectedControlProofSurface(runtimeFamily) {
+    return runtimeFamily === "browser" ? "ui_browser" : "runtime_behavior";
+}
+export function controlClaims(claims, controlRef) {
+    return [...claims.values()].filter((claim) => claim.kind === "control" &&
+        claim.local_key.startsWith(`control.${controlRef}.`));
+}
+export function validateCarrierInputs(check, carriers, label, report) {
+    for (const carrier of carriers)
+        if (!check.input_paths.some((input) => proveRepositoryPatternSubset(carrier, input).status ===
+            "proven_subset"))
+            issue(report, "ui_surface_binding_carrier_outside_check_inputs", `${label}:${check.key}:${carrier}`);
+}
+export function unique(values, code, detail, report) {
+    if (new Set(values).size !== values.length)
+        issue(report, code, detail);
+}
+export function issue(report, code, detail) {
+    const message = `delivery_contract_invalid:${code}:${detail}`;
+    if (report)
+        report(message);
+    else
+        throw new Error(message);
+}

package/dist/lib/long-task-verification-preview.d.ts

@@ -0,0 +1,55 @@
+import type { CompiledCheckV2, CompiledDeliveryContractV2 } from "./long-task-delivery-types.js";
+export interface VerificationExecutionPreviewV1 {
+    schema_version: "long-task-verification-preview-v1";
+    compiled_identity: string;
+    authority_revision: number;
+    acceptance_authorized: false;
+    executes_checks: false;
+    writes_progress: false;
+    selected_outcome: string | null;
+    selected_check: string | null;
+    main_raw_executions: MainRawExecutionPreviewV1[];
+    counterfactual_executions: CounterfactualExecutionPreviewV1[];
+    summary: {
+        selected_checks: number;
+        unique_main_runner_invocations: number;
+        counterfactual_runner_invocation_upper_bound: number;
+        declared_runner_invocation_upper_bound: number;
+        declared_command_attempt_upper_bound: number;
+    };
+    limitations: string[];
+}
+interface MainRawExecutionPreviewV1 {
+    raw_execution_identity: string;
+    check_refs: string[];
+    execution_target: CompiledCheckV2["execution_target"];
+    execution_target_definition: CompiledCheckV2["execution_target_definition"];
+    runner: RunnerPreviewV1;
+    environment_requirements: CompiledCheckV2["environment_requirements"];
+}
+interface CounterfactualExecutionPreviewV1 {
+    scope: "global" | "outcome";
+    outcome_key: string | null;
+    control_key: string;
+    check_ref: string;
+    raw_execution_identity: string;
+    mutation: {
+        type: "remove_paths";
+        paths: string[];
+    } | {
+        type: "replace_file";
+        path: string;
+        fixture_path: string;
+    };
+    runner: RunnerPreviewV1;
+}
+type RunnerPreviewV1 = Pick<CompiledCheckV2["runner"], "type" | "target" | "argv" | "cwd" | "timeout_ms" | "effect" | "retry_policy" | "idempotent" | "resolved_cwd" | "resolved_target" | "definition_sha256">;
+export declare function previewVerificationExecution(workdirInput: string, selection?: {
+    outcome?: string;
+    check?: string;
+}): Promise<VerificationExecutionPreviewV1>;
+export declare function projectVerificationExecutionPreview(compiled: CompiledDeliveryContractV2, authorityRevision: number, selection?: {
+    outcome?: string;
+    check?: string;
+}): VerificationExecutionPreviewV1;
+export {};

package/dist/lib/long-task-verification-preview.js

@@ -0,0 +1,120 @@
+import path from "node:path";
+import { loadActiveLongTaskAuthority } from "./long-task-state.js";
+import { selectChecks } from "./long-task-verifier-v2.js";
+import { repositoryRoot } from "./long-task-workspace.js";
+export async function previewVerificationExecution(workdirInput, selection = {}) {
+    const repository = await repositoryRoot(process.cwd());
+    const active = (await loadActiveLongTaskAuthority(repository, { migrate_legacy: true })).authority;
+    if (!active)
+        throw new Error("active_task_missing");
+    if (active.workdir !== path.resolve(workdirInput))
+        throw new Error("active_task_workdir_mismatch");
+    return projectVerificationExecutionPreview(active.authority_snapshot, active.authority_revision, selection);
+}
+export function projectVerificationExecutionPreview(compiled, authorityRevision, selection = {}) {
+    const selected = selectChecks(compiled, selection);
+    const mainRawExecutions = mainExecutionPreviews(selected);
+    const counterfactualExecutions = counterfactualExecutionPreviews(compiled, selected);
+    const declaredRunnerInvocationUpperBound = mainRawExecutions.length + counterfactualExecutions.length;
+    return {
+        schema_version: "long-task-verification-preview-v1",
+        compiled_identity: compiled.compiled_identity,
+        authority_revision: authorityRevision,
+        acceptance_authorized: false,
+        executes_checks: false,
+        writes_progress: false,
+        selected_outcome: selection.outcome ?? null,
+        selected_check: selection.check ?? null,
+        main_raw_executions: mainRawExecutions,
+        counterfactual_executions: counterfactualExecutions,
+        summary: {
+            selected_checks: selected.length,
+            unique_main_runner_invocations: mainRawExecutions.length,
+            counterfactual_runner_invocation_upper_bound: counterfactualExecutions.length,
+            declared_runner_invocation_upper_bound: declaredRunnerInvocationUpperBound,
+            declared_command_attempt_upper_bound: [
+                ...mainRawExecutions.map((entry) => entry.runner),
+                ...counterfactualExecutions.map((entry) => entry.runner),
+            ].reduce((total, runner) => total + maximumAttempts(runner), 0),
+        },
+        limitations: [
+            "This preview does not evaluate current-snapshot pre-run findings; verification may stop before invoking a runner.",
+            "Counts describe Harness runner invocations and declared retry attempts, not subprocesses, builds, elapsed time, or work performed internally by a project runner.",
+            "The preview is not verification evidence and cannot authorize acceptance.",
+        ],
+    };
+}
+function mainExecutionPreviews(checks) {
+    const groups = new Map();
+    for (const check of checks) {
+        const existing = groups.get(check.raw_execution_identity) ?? [];
+        existing.push(check);
+        groups.set(check.raw_execution_identity, existing);
+    }
+    return [...groups.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([rawExecutionIdentity, groupedChecks]) => {
+        const check = groupedChecks[0];
+        return {
+            raw_execution_identity: rawExecutionIdentity,
+            check_refs: groupedChecks.map(checkRef).sort(),
+            execution_target: check.execution_target,
+            execution_target_definition: check.execution_target_definition,
+            runner: runnerPreview(check),
+            environment_requirements: check.environment_requirements,
+        };
+    });
+}
+function counterfactualExecutionPreviews(compiled, checks) {
+    const selected = new Map(checks.map((check) => [checkRef(check), check]));
+    const result = [];
+    for (const control of compiled.global.acceptance.counterfactual_controls) {
+        const check = selected.get(`GLOBAL:${control.check_key}`);
+        if (check)
+            result.push({
+                scope: "global",
+                outcome_key: null,
+                control_key: control.key,
+                check_ref: checkRef(check),
+                raw_execution_identity: check.raw_execution_identity,
+                mutation: control.mutation,
+                runner: runnerPreview(check),
+            });
+    }
+    for (const outcome of compiled.outcomes)
+        for (const control of outcome.acceptance.counterfactual_controls) {
+            const check = selected.get(`${outcome.key}:${control.check_key}`);
+            if (check)
+                result.push({
+                    scope: "outcome",
+                    outcome_key: outcome.key,
+                    control_key: control.key,
+                    check_ref: checkRef(check),
+                    raw_execution_identity: check.raw_execution_identity,
+                    mutation: control.mutation,
+                    runner: runnerPreview(check),
+                });
+        }
+    return result.sort((left, right) => `${left.check_ref}:${left.control_key}`.localeCompare(`${right.check_ref}:${right.control_key}`));
+}
+function checkRef(check) {
+    return `${check.outcome_key ?? "GLOBAL"}:${check.key}`;
+}
+function runnerPreview(check) {
+    return {
+        type: check.runner.type,
+        target: check.runner.target,
+        argv: check.runner.argv,
+        cwd: check.runner.cwd,
+        timeout_ms: check.runner.timeout_ms,
+        effect: check.runner.effect,
+        retry_policy: check.runner.retry_policy,
+        idempotent: check.runner.idempotent,
+        resolved_cwd: check.runner.resolved_cwd,
+        resolved_target: check.runner.resolved_target,
+        definition_sha256: check.runner.definition_sha256,
+    };
+}
+function maximumAttempts(runner) {
+    return runner.retry_policy === "transient_once" ? 2 : 1;
+}

package/dist/lib/long-task-verifier-v2.js

@@ -3,10 +3,11 @@ import { assertVerifierAuthorityCurrent } from "./long-task-freshness.js";
 import { enrichCheckResultFindings, enrichFinding, } from "./long-task-finding-context.js";
 import { executeCheckRunner } from "./long-task-check-runner.js";
 import { evaluateCheckEvidence, evaluateGlobalCounterfactuals, evaluateOutcomeCounterfactuals, } from "./long-task-evidence-v2.js";
-import { findScopeEscapes, matchesRepoPattern } from "./long-task-paths.js";
+import { matchesRepoPattern } from "./long-task-paths.js";
 import { activeAuthorityIdentityMatches, loadActiveLongTaskAuthority, writeProgressRecord, } from "./long-task-state.js";
 import { createProgressRecord } from "./long-task-progress.js";
 import { changedWorkspacePaths, createWorkspaceSnapshot, repositoryRoot, } from "./long-task-workspace.js";
+import { classifyWorkspaceScope, protectedWorkspacePaths, } from "./long-task-workspace-scope.js";
 export async function verifyDeliveryContract(workdir, selection = {}) {
     const repository = await repositoryRoot(process.cwd());
     const active = (await loadActiveLongTaskAuthority(repository, { migrate_legacy: true })).authority;
@@ -235,29 +236,21 @@ async function preRunFindings(compiled, current) {
             message: "A compiled Contract input changed.",
             next_action: "Run ty-context long-task compile --revise after reviewing the Contract change.",
         }));
-    const protectedAuthorityFiles = new Set([
-        ...Object.keys(compiled.contract_files),
-        ...Object.keys(compiled.source_hashes),
-        ...Object.keys(compiled.context_snapshot.sha256),
-        ...allCompiledChecks(compiled).flatMap((check) => Object.keys(check.verification_input_hashes)),
-    ]);
-    const changed = changedWorkspacePaths(compiled.initial_task_base.workspace_manifest, current).filter((file) => !protectedAuthorityFiles.has(file));
-    const allowed = compiled.outcomes.flatMap((outcome) => [
-        ...outcome.technical.expected_change_paths,
-        ...outcome.technical.allowed_support_paths,
-    ]);
-    const forbidden = [
-        ...compiled.global.technical.forbidden_paths.map((entry) => entry.path),
-        ...compiled.outcomes.flatMap((outcome) => outcome.technical.forbidden_paths),
-    ];
-    const escaped = findScopeEscapes(changed, allowed, forbidden);
+    const changed = changedWorkspacePaths(compiled.initial_task_base.workspace_manifest, current);
+    const classification = classifyWorkspaceScope(compiled, changed, protectedWorkspacePaths({
+        contract_files: compiled.contract_files,
+        source_hashes: compiled.source_hashes,
+        context_hashes: compiled.context_snapshot.sha256,
+        checks: allCompiledChecks(compiled),
+    }));
+    const escaped = classification.blocking_paths;
     return escaped.length
         ? [
             {
                 code: "scope_escape",
                 outcome_key: null,
                 check_key: null,
-                message: `Changed paths are outside the Contract boundary: ${escaped.join(",")}`,
+                message: `Changed paths escape the Contract boundary (forbidden: ${classification.forbidden.join(",") || "none"}; unclassified: ${classification.unclassified.join(",") || "none"}).`,
                 actual: escaped,
                 next_action: "Review risk/ownership, revise declared change paths and recompile in the same Goal.",
             },

package/dist/lib/long-task-workspace-scope.d.ts

@@ -0,0 +1,38 @@
+interface WorkspaceScopeAuthority {
+    global: {
+        technical: {
+            forbidden_paths: Array<{
+                path: string;
+            }>;
+        };
+    };
+    outcomes: Array<{
+        technical: {
+            expected_change_paths: string[];
+            allowed_support_paths: string[];
+            forbidden_paths: string[];
+        };
+    }>;
+}
+export interface WorkspaceScopeClassificationV2 {
+    protected: string[];
+    expected_change: string[];
+    allowed_support: string[];
+    forbidden: string[];
+    unclassified: string[];
+    blocking_paths: string[];
+}
+export declare function classifyWorkspaceScope(authority: WorkspaceScopeAuthority, changedPaths: string[], protectedPaths: string[]): WorkspaceScopeClassificationV2;
+export declare function protectedWorkspacePaths(input: {
+    contract_files?: Record<string, string> | null;
+    source_hashes?: Record<string, string> | null;
+    context_hashes?: Record<string, string> | null;
+    checks?: Array<{
+        verification_input_hashes: Record<string, string>;
+    }>;
+    additional_files?: string[];
+}): string[];
+export declare function firstLockManagedWorkspacePaths(repository: string, changedPaths: string[]): Promise<string[]>;
+export declare function workspaceScopeErrors(classification: WorkspaceScopeClassificationV2): string[];
+export declare function assertWorkspaceScope(classification: WorkspaceScopeClassificationV2): void;
+export {};

package/dist/lib/long-task-workspace-scope.js

@@ -0,0 +1,121 @@
+import path from "node:path";
+import { readConfig } from "./config.js";
+import { harnessConfigPath, harnessPath, harnessRoot } from "./harness-root.js";
+import { listFiles, pathExists } from "./fs.js";
+import { matchesRepoPattern, normalizeRepositoryFile, } from "./long-task-paths.js";
+import { packageAssetPath } from "./paths.js";
+import { enabledManagedSkillNames } from "./profiles.js";
+export function classifyWorkspaceScope(authority, changedPaths, protectedPaths) {
+    const protectedSet = new Set(normalizeFiles(protectedPaths));
+    const expectedPatterns = authority.outcomes.flatMap((outcome) => outcome.technical.expected_change_paths);
+    const supportPatterns = authority.outcomes.flatMap((outcome) => outcome.technical.allowed_support_paths);
+    const forbiddenPatterns = [
+        ...authority.global.technical.forbidden_paths.map((entry) => entry.path),
+        ...authority.outcomes.flatMap((outcome) => outcome.technical.forbidden_paths),
+    ];
+    const result = {
+        protected: [],
+        expected_change: [],
+        allowed_support: [],
+        forbidden: [],
+        unclassified: [],
+        blocking_paths: [],
+    };
+    for (const file of normalizeFiles(changedPaths)) {
+        if (protectedSet.has(file))
+            result.protected.push(file);
+        else if (matchesAny(file, forbiddenPatterns))
+            result.forbidden.push(file);
+        else if (matchesAny(file, expectedPatterns))
+            result.expected_change.push(file);
+        else if (matchesAny(file, supportPatterns))
+            result.allowed_support.push(file);
+        else
+            result.unclassified.push(file);
+    }
+    result.blocking_paths = [...result.forbidden, ...result.unclassified].sort();
+    return result;
+}
+export function protectedWorkspacePaths(input) {
+    return normalizeFiles([
+        ...Object.keys(input.contract_files ?? {}),
+        ...Object.keys(input.source_hashes ?? {}),
+        ...Object.keys(input.context_hashes ?? {}),
+        ...(input.checks ?? []).flatMap((check) => Object.keys(check.verification_input_hashes)),
+        ...(input.additional_files ?? []),
+    ]);
+}
+export async function firstLockManagedWorkspacePaths(repository, changedPaths) {
+    const root = await harnessRoot(repository);
+    const config = await readConfig(repository);
+    const managedFiles = new Set([
+        await harnessConfigPath(repository),
+        ".codex/hooks.json",
+        ...(await packageManagedBootstrapFiles(root, config)),
+    ].map(normalizeManagedRoot));
+    return normalizeFiles(changedPaths).filter((file) => managedFiles.has(file));
+}
+export function workspaceScopeErrors(classification) {
+    return [
+        ...classification.forbidden.map((file) => `workspace_path_forbidden:${file}`),
+        ...classification.unclassified.map((file) => `workspace_path_unclassified:${file}`),
+    ];
+}
+export function assertWorkspaceScope(classification) {
+    const [error] = workspaceScopeErrors(classification);
+    if (error)
+        throw new Error(error);
+}
+function normalizeFiles(files) {
+    return [
+        ...new Set(files.map((file) => normalizeRepositoryFile(file))),
+    ].sort();
+}
+function matchesAny(file, patterns) {
+    return patterns.some((pattern) => matchesRepoPattern(file, pattern));
+}
+function normalizeManagedRoot(file) {
+    return normalizeRepositoryFile(file.replace(/\/+$/u, ""));
+}
+async function packageManagedBootstrapFiles(root, config) {
+    const files = [];
+    for (const managed of config.managed_files)
+        files.push(...(await managedBootstrapFiles(root, config, managed)));
+    return files;
+}
+async function managedBootstrapFiles(root, config, managed) {
+    const normalized = normalizeManagedRoot(managed.path);
+    if (managed.path === "AGENTS.md" ||
+        managed.path === "Makefile" ||
+        managed.path === ".github/workflows/harness.yml")
+        return [managed.path];
+    if (isSkillsManagedPath(normalized, root)) {
+        const files = [];
+        for (const name of enabledManagedSkillNames(config))
+            files.push(...(await assetTreeFiles(harnessPath(root, "skills", name), "skills", name)));
+        return files;
+    }
+    if (normalized === harnessPath(root, "ty-context-managed", "context_templates"))
+        return assetTreeFiles(managed.path, "context_templates");
+    if (normalized === harnessPath(root, "ty-context-managed", "templates"))
+        return assetTreeFiles(managed.path, "templates");
+    if (normalized === harnessPath(root, "ty-context-managed", "policies"))
+        return assetTreeFiles(managed.path, "policies");
+    if (normalized ===
+        harnessPath(root, "ty-context-managed", "make", "ty-context.mk"))
+        return [managed.path];
+    if (managed.path === "tools")
+        return assetTreeFiles(managed.path, "tools");
+    return [];
+}
+async function assetTreeFiles(destinationRoot, ...assetSegments) {
+    const sourceRoot = packageAssetPath(...assetSegments);
+    if (!(await pathExists(sourceRoot)))
+        return [];
+    return (await listFiles(sourceRoot)).map((file) => normalizeManagedRoot(harnessPath(destinationRoot, path.relative(sourceRoot, file).replace(/\\/gu, "/"))));
+}
+function isSkillsManagedPath(managedPath, root) {
+    return (managedPath === harnessPath(root, "skills") ||
+        managedPath === ".harness/agents/skills" ||
+        (managedPath === ".agents/skills" && root !== ".agents"));
+}

package/dist/lib/long-task-workspace.d.ts

@@ -11,6 +11,7 @@ export declare function captureWorkspaceFingerprint(rootInput: string, excludedP
 export declare function captureWorkspaceManifest(rootInput: string, workdirInput: string, _copyRoot?: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceManifestV2>;
 export declare function createWorkspaceSnapshot(rootInput: string, workdirInput: string, label: string, additionalExcludedWorkdirs?: string[]): Promise<WorkspaceSnapshotV2>;
 export declare function changedWorkspacePaths(baseline: WorkspaceManifestV2, current: WorkspaceManifestV2): string[];
+export declare function changedWorkspacePathsFromHead(rootInput: string, workdirInput: string, additionalExcludedWorkdirs?: string[]): Promise<string[]>;
 export declare function currentGitState(root: string): Promise<{
     head: string;
     tree: string;