project-tiny-context-harness 0.8.17 → 0.12.0

package/dist/lib/long-task-explain-source-links.d.ts

@@ -1,99 +0,0 @@
-import type { ClaimCoverageSummaryV2, DeliveryContractV2, SourceClaimV2 } from "./long-task-delivery-types.js";
-export declare function explainSourceLinks(contract: DeliveryContractV2, coverage: ClaimCoverageSummaryV2, source: SourceClaimV2): ({
-    type: "acceptance" | "claim" | "decision_required" | "external_confirmation" | "global_constraint" | "outcome_result" | "risk_fact";
-    reason: string | null;
-} | {
-    type: "acceptance";
-    reference: string;
-    scope: "global" | "outcome";
-    outcome_key: string | null;
-    criterion: string | null;
-    claims: string[];
-    source_backed_claims: string[];
-    required_proof_surfaces: Record<string, string[]>;
-    covered_proof_surfaces: Record<string, string[]>;
-    proof_surface: import("./long-task-contract-types.js").ProofSurface;
-    evidence_adapter: import("./long-task-evidence-adapter-types.js").EvidenceAdapter;
-    observation: string;
-    counterfactuals: {
-        key: string;
-        claims: string[];
-        binding_ref: string;
-        owning_outcome_key: string;
-        expected_assertion_failures: string[];
-        preserved_assertions: string[];
-        allowed_fanout_assertions: string[];
-    }[] | {
-        key: string;
-        claims: string[];
-        binding_key: string;
-        owning_outcome_key: string | null;
-        expected_assertion_failures: string[];
-        preserved_assertions: string[];
-        allowed_fanout_assertions: string[];
-    }[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: string;
-    reference: string;
-    scope: null;
-    outcome_key: null;
-    criterion: null;
-    claims: never[];
-    source_backed_claims: never[];
-    required_proof_surfaces: {};
-    covered_proof_surfaces: {};
-    proof_surface: null;
-    evidence_adapter: null;
-    observation: null;
-    counterfactuals: never[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "claim";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-    assertions: (string | null)[];
-    required_proof_surfaces: import("./long-task-contract-types.js").ProofSurface[];
-    covered_proof_surfaces: import("./long-task-contract-types.js").ProofSurface[];
-    evidence_adapters: (import("./long-task-evidence-adapter-types.js").EvidenceAdapter | null)[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "outcome_result";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "global_constraint";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-    assertions: (string | null)[];
-    evidence_adapters: (import("./long-task-evidence-adapter-types.js").EvidenceAdapter | null)[];
-    counterfactuals: {
-        key: string;
-        check_key: string;
-        binding_ref: string;
-        owning_outcome: string;
-        owner_paths: string[];
-        carrier_paths: string[];
-        expected_assertion_failures: string[];
-        preserved_assertions: string[];
-        allowed_fanout_assertions: string[];
-        mutation: import("./long-task-counterfactual-types.js").CounterfactualMutationV2;
-    }[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "external_confirmation";
-    reference: string;
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "risk_fact";
-    reference: string;
-    risk_fact: string;
-    affected_outcome: string;
-    effective_risk: import("./long-task-risk-types.js").EffectiveRiskLevel;
-    risk_reasons: ("critical_user_path" | "data_migration" | "full_population_operation" | "irreversible_external_effect" | "multi_repository_change" | "permission_boundary_change" | "persistent_data_change" | "public_api_or_schema_change" | "security_boundary_change" | "weak_observability")[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-})[];

package/dist/lib/long-task-explain-source-links.js

@@ -1,51 +0,0 @@
-import { explainAcceptanceLinks } from "./long-task-explain-acceptance-link.js";
-import { explainGlobalClaimLinks, explainOutcomeClaimLinks, explainOutcomeResultLinks, } from "./long-task-explain-claim-links.js";
-import { buildCanonicalSourceTargetIndex } from "./long-task-source-target-index.js";
-import { classifyLongTaskRisk } from "./long-task-risk.js";
-export function explainSourceLinks(contract, coverage, source) {
-    const disposition = source.disposition;
-    const targets = buildCanonicalSourceTargetIndex(contract);
-    let links;
-    if (disposition.type === "acceptance")
-        links = explainAcceptanceLinks(contract, coverage, disposition);
-    if (disposition.type === "claim")
-        links = explainOutcomeClaimLinks(contract, coverage, disposition);
-    if (disposition.type === "outcome_result")
-        links = explainOutcomeResultLinks(contract, coverage, disposition);
-    if (disposition.type === "global_constraint")
-        links = explainGlobalClaimLinks(contract, coverage, disposition);
-    if (disposition.type === "external_confirmation")
-        links = disposition.refs.map((reference) => ({
-            type: disposition.type,
-            reference,
-        }));
-    if (disposition.type === "risk_fact") {
-        const risk = classifyLongTaskRisk(contract);
-        links = disposition.refs.map((reference) => {
-            const [fact, affectedOutcome] = reference.split(":");
-            return {
-                type: disposition.type,
-                reference,
-                risk_fact: fact,
-                affected_outcome: affectedOutcome,
-                effective_risk: risk.effective_level,
-                risk_reasons: risk.reasons_by_outcome[affectedOutcome] ?? [],
-            };
-        });
-    }
-    links ??= [
-        {
-            type: disposition.type,
-            reason: "reason" in disposition ? disposition.reason : null,
-        },
-    ];
-    return links.map((link) => {
-        if (!("reference" in link))
-            return link;
-        const target = targets.get(link.reference);
-        return {
-            ...link,
-            canonical_target: target ?? null,
-        };
-    });
-}

package/dist/lib/long-task-final-integrity.d.ts

@@ -1,16 +0,0 @@
-import type { CompiledDeliveryContractV2, LongTaskFindingV2 } from "./long-task-delivery-types.js";
-import { type ActiveAuthorityIdentityExpectation, type ActiveLongTaskAuthorityV3 } from "./long-task-state.js";
-import { currentGitState } from "./long-task-workspace.js";
-export interface FinalGateProtectedInputIdentity {
-    compiled_identity: string;
-    raw_contract_sha256: string;
-}
-export declare function captureFinalGateProtectedInputIdentity(repository: string, compiled: CompiledDeliveryContractV2): Promise<FinalGateProtectedInputIdentity>;
-export declare function finalGateIntegrityFindings(input: {
-    repository: string;
-    active: ActiveLongTaskAuthorityV3;
-    accepted_authority: ActiveAuthorityIdentityExpectation;
-    candidate: Awaited<ReturnType<typeof currentGitState>>;
-    workspace_identity_before: string;
-    protected_inputs_before: FinalGateProtectedInputIdentity;
-}): Promise<LongTaskFindingV2[]>;

package/dist/lib/long-task-final-integrity.js

@@ -1,98 +0,0 @@
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { compileDeliveryContract } from "./long-task-delivery-compiler.js";
-import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
-import { activeAuthorityIdentityMatches, assertMatchingActiveBinding, loadActiveLongTaskAuthority, } from "./long-task-state.js";
-import { captureWorkspaceFingerprint, currentGitState, } from "./long-task-workspace.js";
-import { sha256Hex } from "./strict-codec.js";
-export async function captureFinalGateProtectedInputIdentity(repository, compiled) {
-    const file = await assertProtectedRepositoryFile(repository, path.join(repository, ...compiled.contract_file.split("/")), "final_gate_delivery_contract");
-    return {
-        compiled_identity: compiled.compiled_identity,
-        raw_contract_sha256: sha256Hex(await readFile(file)),
-    };
-}
-export async function finalGateIntegrityFindings(input) {
-    const findings = [];
-    const after = await captureWorkspaceFingerprint(input.repository);
-    const gitAfter = await currentGitState(input.repository);
-    if (after.identity !== input.workspace_identity_before ||
-        gitAfter.head !== input.candidate.head ||
-        gitAfter.tree !== input.candidate.tree ||
-        gitAfter.dirty.length)
-        findings.push(workspaceChangedFinding());
-    if (await activeAuthorityChanged(input))
-        findings.push(activeAuthorityChangedFinding());
-    findings.push(...(await protectedInputFindings(input)));
-    return findings;
-}
-async function activeAuthorityChanged(input) {
-    try {
-        const currentActive = (await loadActiveLongTaskAuthority(input.repository))
-            .authority;
-        return (!currentActive ||
-            !activeAuthorityIdentityMatches(currentActive, input.accepted_authority));
-    }
-    catch {
-        return true;
-    }
-}
-async function protectedInputFindings(input) {
-    try {
-        const refreshed = await compileDeliveryContract(input.active.workdir, input.repository, {
-            live_gate: true,
-            initial_task_base: input.active.initial_task_base,
-            authority_revision: input.active.authority_revision,
-            require_completion_gate: true,
-        });
-        await assertMatchingActiveBinding(refreshed);
-        const after = await captureFinalGateProtectedInputIdentity(input.repository, refreshed);
-        return after.compiled_identity !==
-            input.protected_inputs_before.compiled_identity ||
-            after.raw_contract_sha256 !==
-                input.protected_inputs_before.raw_contract_sha256
-            ? [
-                protectedInputsChangedFinding({
-                    before: input.protected_inputs_before,
-                    after,
-                }),
-            ]
-            : [];
-    }
-    catch (error) {
-        return [
-            protectedInputsChangedFinding({
-                before: input.protected_inputs_before,
-                after_error: error instanceof Error ? error.message : String(error),
-            }),
-        ];
-    }
-}
-function workspaceChangedFinding() {
-    return {
-        code: "workspace_changed_during_final_gate",
-        outcome_key: null,
-        check_key: null,
-        message: "The workspace changed while Live Final Gate was running.",
-        next_action: "Stop concurrent mutation and rerun the complete Live Final Gate.",
-    };
-}
-function activeAuthorityChangedFinding() {
-    return {
-        code: "active_authority_changed_during_final_gate",
-        outcome_key: null,
-        check_key: null,
-        message: "Active Authority changed while Live Final Gate was running.",
-        next_action: "Review the new Authority Revision and rerun the complete Live Final Gate.",
-    };
-}
-function protectedInputsChangedFinding(actual) {
-    return {
-        code: "protected_inputs_changed_during_final_gate",
-        outcome_key: null,
-        check_key: null,
-        message: "Protected Contract, Source, controlling Context, verifier/runner, verification-input or workdir input identity changed while Final Gate was running.",
-        actual,
-        next_action: "Stop concurrent protected-input mutation, review any required Authority Revision, and rerun the complete Final Gate.",
-    };
-}

package/dist/lib/long-task-final-v2.d.ts

@@ -1,2 +0,0 @@
-import type { FinalReceiptV2 } from "./long-task-delivery-types.js";
-export declare function runDeliveryFinalGate(workdirInput: string): Promise<FinalReceiptV2>;

package/dist/lib/long-task-final-v2.js

@@ -1,151 +0,0 @@
-import { compileDeliveryContract } from "./long-task-delivery-compiler.js";
-import { outcomeResultExternallyBlocked } from "./long-task-claims.js";
-import { captureFinalGateProtectedInputIdentity, finalGateIntegrityFindings, } from "./long-task-final-integrity.js";
-import { assertMatchingActiveBinding, loadActiveLongTaskAuthority, writeFinalReceipt, } from "./long-task-state.js";
-import { assertVerifierAuthorityCurrent, deliveryCompileFreshness, } from "./long-task-freshness.js";
-import { allCompiledChecks, runDeliveryChecks, } from "./long-task-verifier-v2.js";
-import { captureWorkspaceFingerprint, createWorkspaceSnapshot, currentGitState, repositoryRoot, } from "./long-task-workspace.js";
-export async function runDeliveryFinalGate(workdirInput) {
-    const startedAt = new Date().toISOString();
-    const repository = await repositoryRoot(process.cwd());
-    const active = (await loadActiveLongTaskAuthority(repository, { migrate_legacy: true })).authority;
-    if (!active)
-        throw new Error("active_task_missing");
-    if (active.workdir !== (await resolved(workdirInput)))
-        throw new Error("active_task_workdir_mismatch");
-    await assertVerifierAuthorityCurrent(repository, active.verifier_identity);
-    const acceptedAuthority = {
-        task_id: active.task_id,
-        authority_revision: active.authority_revision,
-        compiled_identity: active.active_authority_identity,
-        worktree_identity: active.worktree_identity,
-    };
-    const candidate = await currentGitState(repository);
-    if (candidate.dirty.length)
-        throw new Error(`final_gate_requires_clean_candidate_commit:${candidate.dirty.join(",")}`);
-    const acceptedCompiled = active.authority_snapshot;
-    await assertMatchingActiveBinding(acceptedCompiled);
-    const staleAuthorityInputs = await deliveryCompileFreshness(acceptedCompiled);
-    if (staleAuthorityInputs.length)
-        throw new Error(`final_gate_protected_input_stale:${staleAuthorityInputs.join(",")}`);
-    const compiled = await compileDeliveryContract(active.workdir, repository, {
-        live_gate: true,
-        initial_task_base: active.initial_task_base,
-        authority_revision: active.authority_revision,
-        require_completion_gate: true,
-    });
-    await assertMatchingActiveBinding(compiled);
-    const protectedInputsBefore = await captureFinalGateProtectedInputIdentity(repository, compiled);
-    const before = await captureWorkspaceFingerprint(repository);
-    const snapshot = await createWorkspaceSnapshot(repository, active.workdir, `final-${compiled.task.id}`);
-    try {
-        const run = await runDeliveryChecks(compiled, snapshot, allCompiledChecks(compiled), true, true);
-        run.findings.push(...(await finalGateIntegrityFindings({
-            repository,
-            active,
-            accepted_authority: acceptedAuthority,
-            candidate,
-            workspace_identity_before: before.identity,
-            protected_inputs_before: protectedInputsBefore,
-        })));
-        const outcomeResults = projectOutcomes(compiled, run.check_results, run.findings);
-        const globalChecks = run.check_results.filter((check) => check.outcome_key === null);
-        const globalHardFailure = globalChecks.some((check) => check.status !== "passed" && check.status !== "blocked_external");
-        const globalBlocked = globalChecks.some((check) => check.status === "blocked_external");
-        const failed = globalHardFailure ||
-            Object.values(outcomeResults).includes("failed") ||
-            run.findings.some((finding) => finding.code !== "blocked_external");
-        const blocked = globalBlocked ||
-            Object.values(outcomeResults).includes("blocked_external") ||
-            run.findings.some((finding) => finding.code === "blocked_external");
-        const targetBlocked = compiled.global.acceptance.external_confirmations.some((confirmation) => confirmation.blocks_target);
-        const workflowStatus = failed
-            ? "needs_work"
-            : blocked || targetBlocked
-                ? "blocked_external"
-                : compiled.global.acceptance.external_confirmations.length
-                    ? "machine_accepted_external_pending"
-                    : "machine_accepted";
-        const targetState = workflowStatus === "machine_accepted" ||
-            workflowStatus === "machine_accepted_external_pending"
-            ? compiled.task.target_profile.required_state
-            : workflowStatus === "blocked_external"
-                ? "blocked_external"
-                : "not_accepted";
-        return writeFinalReceipt(repository, active.workdir, {
-            schema_version: "long-task-final-receipt-v2",
-            authority_scope: "audit_only",
-            reusable_for_acceptance: false,
-            workflow_status: workflowStatus,
-            target_profile: compiled.task.target_profile,
-            target_state: targetState,
-            stage_results: projectStages(compiled, outcomeResults),
-            compiled_identity: compiled.compiled_identity,
-            contract_sha256: compiled.contract_sha256,
-            snapshot_sha256: snapshot.manifest.snapshot_sha256,
-            git_head: candidate.head,
-            git_tree: candidate.tree,
-            source_hashes: compiled.source_hashes,
-            context_hashes: compiled.context_snapshot.sha256,
-            verifier_identity: compiled.verifier_identity,
-            check_results: run.check_results,
-            outcome_results: outcomeResults,
-            external_confirmations: compiled.global.acceptance.external_confirmations,
-            findings: run.findings,
-            snapshot_preparation_ms: snapshot.preparation_ms,
-            started_at: startedAt,
-            completed_at: new Date().toISOString(),
-        });
-    }
-    finally {
-        await snapshot.dispose();
-    }
-}
-function projectStages(compiled, outcomes) {
-    const result = {};
-    const remaining = new Set(compiled.stages.map((stage) => stage.key));
-    while (remaining.size) {
-        let advanced = false;
-        for (const stage of compiled.stages) {
-            if (!remaining.has(stage.key))
-                continue;
-            if (stage.depends_on.some((dependency) => remaining.has(dependency)))
-                continue;
-            const owned = compiled.outcomes
-                .filter((outcome) => outcome.stage === stage.key)
-                .map((outcome) => outcomes[outcome.key]);
-            result[stage.key] = owned.includes("failed")
-                ? "failed"
-                : owned.includes("blocked_external")
-                    ? "blocked_external"
-                    : stage.depends_on.some((dependency) => result[dependency] !== "passed")
-                        ? "blocked_dependency"
-                        : "passed";
-            remaining.delete(stage.key);
-            advanced = true;
-        }
-        if (!advanced) {
-            for (const stage of remaining)
-                result[stage] = "blocked_dependency";
-            break;
-        }
-    }
-    return result;
-}
-function projectOutcomes(compiled, checks, findings) {
-    return Object.fromEntries(compiled.outcomes.map((outcome) => {
-        const outcomeKey = outcome.key;
-        const owned = checks.filter((check) => check.outcome_key === outcomeKey);
-        const ownFindings = findings.filter((finding) => finding.outcome_key === outcomeKey || finding.outcome_key === null);
-        const status = owned.some((check) => check.status !== "passed" && check.status !== "blocked_external") || ownFindings.some((finding) => finding.code !== "blocked_external")
-            ? "failed"
-            : outcomeResultExternallyBlocked(compiled, outcomeKey) ||
-                owned.some((check) => check.status === "blocked_external")
-                ? "blocked_external"
-                : "passed";
-        return [outcomeKey, status];
-    }));
-}
-async function resolved(workdir) {
-    return (await import("node:path")).default.resolve(workdir);
-}

package/dist/lib/long-task-finding-context.d.ts

@@ -1,3 +0,0 @@
-import type { CheckExecutionResultV2, CompiledDeliveryContractV2, LongTaskFindingV2 } from "./long-task-delivery-types.js";
-export declare function enrichCheckResultFindings(compiled: CompiledDeliveryContractV2, result: CheckExecutionResultV2): CheckExecutionResultV2;
-export declare function enrichFinding(compiled: CompiledDeliveryContractV2, finding: LongTaskFindingV2): LongTaskFindingV2;

package/dist/lib/long-task-finding-context.js

@@ -1,63 +0,0 @@
-import { resolveAcceptanceAssertion } from "./long-task-acceptance-reference.js";
-export function enrichCheckResultFindings(compiled, result) {
-    return {
-        ...result,
-        findings: result.findings.map((finding) => enrichFinding(compiled, finding)),
-    };
-}
-export function enrichFinding(compiled, finding) {
-    const outcome = finding.outcome_key
-        ? compiled.outcomes.find((item) => item.key === finding.outcome_key)
-        : null;
-    const sourceClaims = sourceClaimsForFinding(compiled, finding);
-    const sourceTargets = compiled.source_claims
-        .filter((source) => sourceClaims.includes(source.key))
-        .flatMap((source) => dispositionTargetRefs(source.disposition))
-        .filter((reference, index, all) => all.indexOf(reference) === index)
-        .sort();
-    return {
-        ...finding,
-        ...(sourceClaims.length ? { source_claim_keys: sourceClaims } : {}),
-        ...(sourceTargets.length ? { source_target_refs: sourceTargets } : {}),
-        ...(outcome && !finding.owner_paths
-            ? { owner_paths: outcome.product.owner.path_globs }
-            : {}),
-    };
-}
-function dispositionTargetRefs(disposition) {
-    if (disposition.type === "outcome_result")
-        return [disposition.ref];
-    if (disposition.type === "claim" ||
-        disposition.type === "acceptance" ||
-        disposition.type === "global_constraint" ||
-        disposition.type === "risk_fact" ||
-        disposition.type === "external_confirmation")
-        return disposition.refs;
-    return [];
-}
-function sourceClaimsForFinding(compiled, finding) {
-    const acceptanceRef = finding.check_key && finding.assertion_key
-        ? `${finding.outcome_key ?? "GLOBAL"}.${finding.check_key}.${finding.assertion_key}`
-        : null;
-    const resolvedAcceptance = acceptanceRef
-        ? resolveAcceptanceAssertion(compiled, acceptanceRef)
-        : null;
-    const productRefs = new Set((finding.claim_keys ?? []).map((claim) => finding.outcome_key ? `${finding.outcome_key}.${claim}` : claim));
-    return compiled.source_claims
-        .filter((source) => {
-        if (source.disposition.type === "acceptance" &&
-            resolvedAcceptance &&
-            source.disposition.refs.includes(resolvedAcceptance.ref))
-            return true;
-        if (source.disposition.type === "claim" &&
-            source.disposition.refs.some((reference) => productRefs.has(reference)))
-            return true;
-        if (source.disposition.type === "outcome_result" &&
-            productRefs.has(source.disposition.ref))
-            return true;
-        return (source.disposition.type === "global_constraint" &&
-            source.disposition.refs.some((reference) => productRefs.has(reference)));
-    })
-        .map((source) => source.key)
-        .sort();
-}

package/dist/lib/long-task-freshness.d.ts

@@ -1,3 +0,0 @@
-import type { CompiledDeliveryContractV2, VerifierIdentityV2 } from "./long-task-delivery-types.js";
-export declare function deliveryCompileFreshness(compiled: CompiledDeliveryContractV2): Promise<string[]>;
-export declare function assertVerifierAuthorityCurrent(repositoryRoot: string, expected: VerifierIdentityV2): Promise<void>;

package/dist/lib/long-task-freshness.js

@@ -1,80 +0,0 @@
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { captureContextGraphSnapshot } from "./context-graph-snapshot.js";
-import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
-import { captureVerifierIdentity } from "./long-task-verifier-identity.js";
-import { verifierAuthorityDiff } from "./long-task-verifier-authority.js";
-import { parseDeliveryContractBundle } from "./long-task-delivery-parser.js";
-export async function deliveryCompileFreshness(compiled) {
-    const findings = [];
-    try {
-        const currentContract = await parseDeliveryContractBundle(compiled.workdir, compiled.repository_root, { validate_structure: false });
-        if (sha256Hex(canonicalValueJson(currentContract.contract)) !==
-            compiled.contract_sha256)
-            findings.push(`contract_changed_after_compile:${compiled.contract_file}`);
-    }
-    catch {
-        findings.push(`contract_changed_after_compile:${compiled.contract_file}`);
-    }
-    for (const [file, hash] of Object.entries(compiled.contract_files))
-        await compareFile(path.join(compiled.repository_root, file), hash, `contract_changed_after_compile:${file}`, findings);
-    for (const [file, hash] of Object.entries(compiled.source_hashes))
-        await compareFile(path.join(compiled.repository_root, file), hash, `source_changed_after_compile:${file}`, findings);
-    try {
-        const current = await captureContextGraphSnapshot(compiled.repository_root, compiled.task.context_refs, compiled.context_snapshot.mode);
-        if (current.topology_sha256 !== compiled.context_snapshot.topology_sha256)
-            findings.push("context_changed_after_compile:topology");
-        if (canonicalValueJson(current.files) !==
-            canonicalValueJson(compiled.context_snapshot.files))
-            findings.push("context_changed_after_compile:file_set");
-        for (const [file, hash] of Object.entries(compiled.context_snapshot.sha256))
-            if (current.sha256[file] !== hash)
-                findings.push(`context_changed_after_compile:${file}`);
-    }
-    catch (error) {
-        findings.push(`context_changed_after_compile:${message(error)}`);
-    }
-    try {
-        const currentVerifier = await captureVerifierIdentity(compiled.repository_root, compiled.verifier_identity.hook_sha256 !== "not-required");
-        const verifierDiff = verifierAuthorityDiff(compiled.verifier_identity, currentVerifier);
-        if (verifierDiff.verifier_content_changed)
-            findings.push("verifier_changed_after_compile:bundle");
-        if (verifierDiff.verifier_runtime_locator_changed)
-            findings.push("verifier_changed_after_compile:runtime_locator");
-    }
-    catch {
-        findings.push("verifier_changed_after_compile:bundle");
-    }
-    const checks = [
-        ...compiled.global.acceptance.checks,
-        ...compiled.outcomes.flatMap((outcome) => outcome.acceptance.checks),
-    ];
-    for (const check of checks)
-        for (const [file, hash] of Object.entries(check.runner.frozen_files))
-            await compareFile(path.join(compiled.repository_root, file), hash, `runner_changed_after_compile:${check.internal_id}:${file}`, findings);
-    return [...new Set(findings)].sort();
-}
-export async function assertVerifierAuthorityCurrent(repositoryRoot, expected) {
-    let current;
-    try {
-        current = await captureVerifierIdentity(repositoryRoot, expected.hook_sha256 !== "not-required");
-    }
-    catch {
-        throw new Error("verifier_authority_migration_required");
-    }
-    const diff = verifierAuthorityDiff(expected, current);
-    if (diff.verifier_content_changed || diff.verifier_runtime_locator_changed)
-        throw new Error("verifier_authority_migration_required");
-}
-async function compareFile(file, expected, finding, findings) {
-    try {
-        if (sha256Hex(await readFile(file)) !== expected)
-            findings.push(finding);
-    }
-    catch {
-        findings.push(finding);
-    }
-}
-function message(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/lib/long-task-hook-install.d.ts

@@ -1,26 +0,0 @@
-import { type Stats } from "node:fs";
-import type { SyncReport } from "./sync-engine.js";
-export declare const LONG_TASK_HOOK_TRUST_REVIEW_NOTICE = "Codex Hook review required: open /hooks and trust the current Tiny Context project Hook before relying on PreToolUse, SubagentStart, SessionStart or Stop behavior. Tiny Context cannot observe or persist Codex Hook trust.";
-export interface LongTaskHookFileOperations {
-    lstat(target: string): Promise<Stats>;
-    readFile(target: string, encoding: "utf8"): Promise<string>;
-    mkdir(target: string, options: {
-        recursive: true;
-    }): Promise<unknown>;
-    writeFile(target: string, content: string, options: {
-        flag: "wx";
-    }): Promise<void>;
-    rename(source: string, destination: string): Promise<void>;
-    rm(target: string, options: {
-        force: true;
-    }): Promise<void>;
-    randomId(): string;
-}
-export declare function installLongTaskHooks(projectRoot: string, report: SyncReport, fileOperations?: Partial<LongTaskHookFileOperations>): Promise<void>;
-export declare function uninstallLongTaskHooks(projectRoot: string, report: SyncReport, fileOperations?: Partial<LongTaskHookFileOperations>): Promise<void>;
-export declare function packageOwnedCommand(entry: string): string;
-export declare function removeManagedHookEntries(groups: unknown, currentPackageCommand?: string): {
-    groups: unknown[];
-    removed: number;
-};
-export declare function isManagedHookEntry(entry: unknown, currentPackageCommand?: string): boolean;