review-council 3.0.0 → 3.1.0

package/README.md

@@ -292,6 +292,63 @@ harness:
 
 ---
 
+### `rcl evidence status` and `rcl evidence show`
+
+What Harness holds — never the client's own claim. `rcl evidence status`
+prints the gate status Harness computed for a pull request: its known head,
+the advisory and enforced projections (status, the rounds behind them, the
+actionable findings still open) and the merge decision once it merged. The
+exit code is the contract the skills gate on:
+
+| exit | meaning |
+| --- | --- |
+| 0 | the judged projection (advisory by default, `--enforced` on request) is `converged` |
+| 1 | any other status: `none`, `stale`, `unverified`, `inconclusive`, `fixes_pending`, `unresolved` |
+| 2 | the pull request could not be named |
+| 3 | the read could not be answered: no credential, evidence off for the organization, unknown pull request, refused credential, unreachable host — never reported as "not converged" |
+
+`rcl evidence show <run id>` prints one recorded run: header and verification,
+credential tier and runner, reviewer health, artifact state, and every finding
+with its identity, gating reason and triage verdict (`—` until the server
+joins the verdict onto the finding).
+
+The reads use the same credential rules as delivery — the stored `harness
+login`, or `HARNESS_API_TOKEN` + `HARNESS_API_URL` in CI, the token sent to
+its own host only — and need `reviews:read`. They do not depend on the
+telemetry level: switching delivery off does not blind them.
+
+```bash
+rcl evidence status                   # error: name the pull request
+rcl evidence status 8524              # against the current checkout's origin remote
+rcl evidence status '#8524' --enforced
+rcl evidence status allocator-one/rcl#42 --json
+rcl evidence status https://github.com/allocator-one/rcl/pull/42
+rcl evidence show 01a08032-0838-76db-ade3-1990f6e54072
+```
+
+### `--for-pr` on a patch-file review
+
+A patch-file review (`rcl review changes.patch`) carries no repository or pull
+request, so Harness records it as a `patch` run it cannot verify or count for
+any gate. `--for-pr owner/repo#N` (or a pull request URL) names the pull
+request the patch was taken from (`RCL_FOR_PR` in the environment does the
+same for patch files): the run is bound to that pull request and its
+`--head-sha` — required with the flag — is verified against the pull
+request's head. Owner and repository are lower-cased, as GitHub reads them. Counting the round for that pull request's
+gate is the server half (IO-12585); until it lands, `rcl evidence status`
+still reads `stale`/`none` for patch-file loops. The flag is refused on PR and
+git-mode targets, which name their own pull request or checkout. `rcl-converge` passes `--converge-target`, `--round`
+and `--attempt` on every round and adds `--for-pr` when a pull request loop
+reviews a patch file taken from the pull request (a pull request target names
+its own). A converge
+target of the `owner/repo#N` form attributes the run the same way; a slug such
+as `rcl-7` does not.
+
+```bash
+rcl review round-3.patch --head-sha "$HEAD" --base-sha "$BASE" --for-pr allocator-one/rcl#42 \
+  --converge-target allocator-one/rcl#42 --round 3 --attempt 3 --evidence-required
+```
+
 ### `rcl models`
 
 The tool's own memory of which reviewers earn their seat. Every reviewer call
@@ -316,6 +373,43 @@ rcl models seed --from ~/recovered-rcl-artifacts   # backfill from reports + con
 
 ---
 
+Since 3.1 the table merges the organization's window from Harness
+(`GET /api/v1/reviews/model-stats`, the server-side `rcl models` over every run
+the org recorded, backfilled history included) with this machine's store: for a
+model the server holds at least 20 outcomes for, the server's weight is used
+(`source: server`); below that the local store decides (`local`); a model
+neither knows enough about keeps the neutral weight (`neutral`). Reviews weight
+consensus the same way, asking the server with a three-second bound and falling
+back to the local store when it cannot answer. `--local` shows this machine's
+view alone; `--json` carries `server` (host, window, rows) and `weights` with
+their `source`.
+
+```bash
+rcl models                       # org-wide where Harness has enough history, local otherwise
+rcl models show --local          # this machine's store only
+rcl models show --window 30 --json
+```
+
+### `rcl telemetry backfill`
+
+Recovered history becomes day-one evidence on Harness. `rcl telemetry backfill
+--from <dir> --repo <owner/repo>` reads the pre-3.0 `rcl-report-*.json`
+reports and `rcl-converge-*-ledger.md` ledgers in a directory (the same layout
+`rcl models seed` reads) and posts each report as a run with `provenance:
+backfill`: a synthesized header bound to the named repository (target `patch`,
+the report bytes as the digest, a runner claim naming this command), the
+report's findings with their stable identities, its reviewer calls, and the
+report files as artifacts. Ledger bullets matched to a round's findings become
+`verdicts_recorded` events. Run ids are UUIDv5 of `(host, repo, sha256 of the
+report)` and event ids derive from them, so running the backfill twice reports
+the second run as `0 new` — nothing is duplicated. Backfilled runs count for
+model stats and analytics and never enter a gate decision.
+
+```bash
+rcl telemetry backfill --from ~/recovered-rcl-artifacts --repo allocator-one/allocator-one --dry-run
+rcl telemetry backfill --from ~/recovered-rcl-artifacts --repo allocator-one/allocator-one
+```
+
 ## Config File
 
 Place `.review-council.yml` in your project root (or any parent directory). All fields are optional.

package/dist/evidence/format.d.ts

@@ -0,0 +1,19 @@
+import type { GateStatus, RunDetail } from './types.js';
+/**
+ * Terminal rendering of what Harness holds; one line per entry, no colour,
+ * safe to grep. Every server-supplied string — repository names, titles,
+ * paths, model names, errors, URLs — can trace back to reviewed code or model
+ * output, so it reaches the terminal only through `text()`: control and
+ * escape characters (C0, DEL, C1) become spaces, secrets are scrubbed, and
+ * the length is bounded, which also keeps every entry on its one line.
+ */
+export declare function text(value: unknown, limit?: number): string;
+/**
+ * `JSON.stringify` escapes C0 controls but writes DEL and the C1 range
+ * (U+007F–U+009F — 8-bit CSI and OSC introducers) literally; a title carrying
+ * one would reach the terminal or a CI log intact. They become `\\u00xx`
+ * escapes, which parse back to the same string.
+ */
+export declare function safeJson(value: unknown): string;
+export declare function formatGateStatus(status: GateStatus, judged: 'advisory' | 'enforced'): string[];
+export declare function formatRun(run: RunDetail): string[];

package/dist/evidence/format.js

@@ -0,0 +1,109 @@
+import { scrubText } from '../telemetry/scrub.js';
+/**
+ * Terminal rendering of what Harness holds; one line per entry, no colour,
+ * safe to grep. Every server-supplied string — repository names, titles,
+ * paths, model names, errors, URLs — can trace back to reviewed code or model
+ * output, so it reaches the terminal only through `text()`: control and
+ * escape characters (C0, DEL, C1) become spaces, secrets are scrubbed, and
+ * the length is bounded, which also keeps every entry on its one line.
+ */
+export function text(value, limit = 300) {
+    if (value === null || value === undefined)
+        return '—';
+    return scrubText(String(value).replace(/[\u0000-\u001f\u007f-\u009f]/g, ' '), limit);
+}
+/**
+ * `JSON.stringify` escapes C0 controls but writes DEL and the C1 range
+ * (U+007F–U+009F — 8-bit CSI and OSC introducers) literally; a title carrying
+ * one would reach the terminal or a CI log intact. They become `\\u00xx`
+ * escapes, which parse back to the same string.
+ */
+export function safeJson(value) {
+    return JSON.stringify(value, null, 2).replace(/[\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+function short(sha) {
+    return typeof sha === 'string' && sha.length > 0 ? text(sha.slice(0, 10), 10) : '—';
+}
+function where(file, line) {
+    if (!file)
+        return '—';
+    return `${text(file)}${typeof line === 'number' ? `:${line}` : ''}`;
+}
+function projectionLines(name, projection, judged) {
+    const lines = [
+        `${name}: ${text(projection.status, 40)}${projection.conclusive === false ? ' (inconclusive)' : ''}${judged ? ' ← judged' : ''}` +
+            (projection.run_id ? ` — run ${short(projection.run_id)}${projection.run_url ? ` ${text(projection.run_url)}` : ''}` : ''),
+    ];
+    for (const round of projection.rounds) {
+        lines.push(`  round ${typeof round.converge_round === 'number' ? round.converge_round : '·'}: ${short(round.id)} head ${short(round.head_sha)} ${text(round.tier, 40)}` +
+            `${round.received_at ? ` ${text(round.received_at, 40)}` : ''}${round.url ? ` ${text(round.url)}` : ''}`);
+    }
+    for (const finding of projection.actionable) {
+        lines.push(`  actionable ${text(finding.identity_key ?? finding.ref ?? '?', 64)} ${text(finding.severity, 20)}/${text(finding.gating_reason, 20)} ` +
+            `${where(finding.file, finding.start_line)} ${text(finding.title, 200)}`);
+    }
+    return lines;
+}
+export function formatGateStatus(status, judged) {
+    const head = status.head;
+    const name = `${text(status.repo, 200)}#${text(status.pr_number, 20)}`;
+    const headLine = !head
+        ? `${name} — no head known to Harness`
+        : `${name} — head ${short(head.sha)}${head.source ? ` (${text(head.source, 40)})` : ''}` +
+            `${head.merged ? ` — merged${head.merge_commit_sha ? ` as ${short(head.merge_commit_sha)}` : ''}` : ''}` +
+            `${head.is_cross_repository ? ' — fork' : ''}`;
+    const decision = status.decision;
+    return [
+        headLine,
+        ...projectionLines('advisory', status.advisory, judged === 'advisory'),
+        ...projectionLines('enforced', status.enforced, judged === 'enforced'),
+        decision
+            ? `decision: ${text(decision.decision, 40)} at ${short(decision.reviewed_head_sha)} (${text(decision.source, 40)}` +
+                `${decision.merged_at ? `, merged ${text(decision.merged_at, 40)}` : ''})`
+            : 'decision: —',
+    ];
+}
+function reviewerHealth(run) {
+    const stats = run.stats ?? {};
+    const total = stats['totalReviews'];
+    const ok = stats['successfulReviews'];
+    if (typeof total === 'number' && typeof ok === 'number')
+        return `${ok}/${total}`;
+    return `${run.calls.filter((call) => call.status === 'success').length}/${run.calls.length}`;
+}
+export function formatRun(run) {
+    const runner = run.runner ?? {};
+    const runnerKind = typeof runner['kind'] === 'string' ? text(runner['kind'], 40) : '—';
+    const ciRunId = typeof runner['ci_run_id'] === 'string' ? ` ${text(runner['ci_run_id'], 40)}` : '';
+    const target = run.target;
+    const named = target.repo && target.pr_number ? `${text(target.repo, 200)}#${text(target.pr_number, 20)}` : text(target.kind, 40);
+    const converge = run.converge;
+    const lines = [
+        `run ${text(run.id, 64)}${run.url ? ` ${text(run.url)}` : ''}`,
+        `target ${named} @ ${short(target.head_sha)} (head ${text(run.head_verified ?? 'unknown', 20)}${run.repo_verified ? ', repo verified' : ''}` +
+            `${run.is_cross_repository ? ', fork' : ''})`,
+        `credential ${text(run.credential_kind, 40)} (${text(run.tier ?? 'asserted', 40)}) — runner ${runnerKind}${ciRunId} — rcl ${text(run.rcl_version, 40)}` +
+            (run.provenance && run.provenance !== 'live' ? ` — ${text(run.provenance, 40)}` : ''),
+        `reviewers ${reviewerHealth(run)} ok` +
+            (converge ? ` — converge ${text(converge.target, 200)}${typeof converge.round === 'number' ? ` round ${converge.round}` : ''}` : '') +
+            (run.received_at ? ` — received ${text(run.received_at, 40)}` : ''),
+    ];
+    for (const artifact of run.artifacts ?? []) {
+        lines.push(`artifact ${text(artifact.kind, 40)} ${artifact.stored ? 'stored' : 'missing'}${artifact.url ? ` ${text(artifact.url)}` : ''}`);
+    }
+    lines.push(`findings (${run.findings.length}): identity severity gating file:line title — verdict`);
+    for (const finding of run.findings) {
+        const verdict = finding.verdict
+            ? `${text(finding.verdict.verdict, 40)}${typeof finding.verdict.round === 'number' ? ` (round ${finding.verdict.round})` : ''}`
+            : '—';
+        lines.push(`  ${text(finding.identity_key ?? finding.ref ?? '?', 64)} ${text(finding.severity, 20)} ${text(finding.gating_reason ?? 'none', 20)} ` +
+            `${where(finding.file, finding.start_line)} ${text(finding.title, 200)} — ${verdict}`);
+    }
+    lines.push(`calls (${run.calls.length}):`);
+    for (const call of run.calls) {
+        const duration = typeof call.duration_ms === 'number' ? ` ${call.duration_ms}ms` : '';
+        lines.push(`  call ${text(call.model, 80)}${call.role ? ` ${text(call.role, 40)}` : ''} ${text(call.status, 20)}${duration}${call.error ? ` — ${text(call.error, 200)}` : ''}`);
+    }
+    return lines;
+}
+//# sourceMappingURL=format.js.map

package/dist/evidence/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/evidence/format.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD;;;;;;;GAOG;AAEH,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,KAAK,GAAG,GAAG;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACtD,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAClI,CAAC;AAED,SAAS,KAAK,CAAC,GAA8B;IAC3C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtF,CAAC;AAED,SAAS,KAAK,CAAC,IAA+B,EAAE,IAA+B;IAC7E,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IACtB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,UAAsB,EAAE,MAAe;IAC5E,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9H,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7H,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,WAAW,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;YAC1J,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,gBAAgB,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG;YACtI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,MAA+B;IAClF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,CAAC,IAAI;QACpB,CAAC,CAAC,GAAG,IAAI,6BAA6B;QACtC,CAAC,CAAC,GAAG,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtF,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACxG,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,OAAO;QACL,QAAQ;QACR,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,CAAC;QACtE,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,CAAC;QACtE,QAAQ;YACN,CAAC,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;gBAChH,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;YAC5E,CAAC,CAAC,aAAa;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAc;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC;IACjF,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAc;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvF,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClI,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9D,UAAU,KAAK,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1I,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG;QAC/C,cAAc,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC,cAAc,UAAU,GAAG,OAAO,UAAU,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE;YACrJ,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,aAAa,cAAc,CAAC,GAAG,CAAC,KAAK;YACnC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7I,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,QAAQ,CAAC,MAAM,uDAAuD,CAAC,CAAC;IACpG,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;YAC7B,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/H,CAAC,CAAC,GAAG,CAAC;QACR,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,CAAC,GAAG;YACrI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,OAAO,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,KAAK,CAAC,IAAI,CACR,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpK,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/evidence/reads.d.ts

@@ -0,0 +1,11 @@
+import type { HarnessSink, RequestOptions, SinkOutcome } from '../telemetry/sink.js';
+import { type GateStatus, type RunDetail } from './types.js';
+/**
+ * The two evidence reads (epic IO-12475, section 9) on top of the sink's
+ * generic GET: each names what it asked for, so an answer about another pull
+ * request or run — or one shaped wrong — is refused, never trusted.
+ */
+/** `GET /api/v1/reviews/prs/:owner/:repo/:number` — the gate status Harness computed for a pull request. */
+export declare function getGateStatus(sink: HarnessSink, owner: string, repo: string, number: number, options?: RequestOptions): Promise<SinkOutcome<GateStatus>>;
+/** `GET /api/v1/reviews/runs/:id` — one recorded run with its findings, calls and artifact state. */
+export declare function getRun(sink: HarnessSink, id: string, options?: RequestOptions): Promise<SinkOutcome<RunDetail>>;

package/dist/evidence/reads.js

@@ -0,0 +1,16 @@
+import { isGateStatus, isRunDetail } from './types.js';
+/**
+ * The two evidence reads (epic IO-12475, section 9) on top of the sink's
+ * generic GET: each names what it asked for, so an answer about another pull
+ * request or run — or one shaped wrong — is refused, never trusted.
+ */
+/** `GET /api/v1/reviews/prs/:owner/:repo/:number` — the gate status Harness computed for a pull request. */
+export function getGateStatus(sink, owner, repo, number, options = {}) {
+    const path = `/api/v1/reviews/prs/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encodeURIComponent(String(number))}`;
+    return sink.getJson(path, (data) => (isGateStatus(data, `${owner}/${repo}`, number) ? data : null), options);
+}
+/** `GET /api/v1/reviews/runs/:id` — one recorded run with its findings, calls and artifact state. */
+export function getRun(sink, id, options = {}) {
+    return sink.getJson(`/api/v1/reviews/runs/${encodeURIComponent(id)}`, (data) => (isRunDetail(data, id) ? data : null), options);
+}
+//# sourceMappingURL=reads.js.map

package/dist/evidence/reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reads.js","sourceRoot":"","sources":["../../src/evidence/reads.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAmC,MAAM,YAAY,CAAC;AAExF;;;;GAIG;AAEH,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAC3B,IAAiB,EACjB,KAAa,EACb,IAAY,EACZ,MAAc,EACd,UAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,uBAAuB,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAClI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/G,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,MAAM,CAAC,IAAiB,EAAE,EAAU,EAAE,UAA0B,EAAE;IAChF,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAClI,CAAC"}

package/dist/evidence/show.d.ts

@@ -0,0 +1,10 @@
+import { type EvidenceDeps } from './status.js';
+/**
+ * `rcl evidence show <run-id>` (RCL-41): one recorded run as Harness holds
+ * it — header, verification, reviewer health, artifact state, findings with
+ * their identity, gating reason and (once the server joins it) verdict.
+ * Exit 0 when the run was read (`EVIDENCE_EXIT.ok`), 2 without a run id, 3 when it could not be.
+ */
+export declare function runEvidenceShow(runId: string, options: {
+    json?: boolean;
+}, deps: EvidenceDeps): Promise<number>;

package/dist/evidence/show.js

@@ -0,0 +1,41 @@
+import { describeOutcome } from '../telemetry/sink.js';
+import { formatRun, safeJson, text } from './format.js';
+import { getRun } from './reads.js';
+// Run ids are UUIDs (v7 live, v5 backfill); anything else never reaches the network or the terminal raw.
+const RUN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+import { EVIDENCE_EXIT, openSink } from './status.js';
+/**
+ * `rcl evidence show <run-id>` (RCL-41): one recorded run as Harness holds
+ * it — header, verification, reviewer health, artifact state, findings with
+ * their identity, gating reason and (once the server joins it) verdict.
+ * Exit 0 when the run was read (`EVIDENCE_EXIT.ok`), 2 without a run id, 3 when it could not be.
+ */
+export async function runEvidenceShow(runId, options, deps) {
+    // UUIDs are case-insensitive text; the server echoes the canonical lowercase form.
+    const id = (runId ?? '').trim().toLowerCase();
+    if (id === '') {
+        deps.stderr('Name the run id: `run.id` in a report, or the id in an `Evidence recorded:` URL.');
+        return EVIDENCE_EXIT.usage;
+    }
+    if (!RUN_ID.test(id)) {
+        deps.stderr(`Not a run id (a UUID): ${text(id, 80)}`);
+        return EVIDENCE_EXIT.usage;
+    }
+    const sink = await openSink(deps);
+    if (!sink)
+        return EVIDENCE_EXIT.unanswered;
+    const outcome = await getRun(sink, id);
+    if (outcome.kind !== 'ok') {
+        deps.stderr(`Cannot read run ${id}: ${describeOutcome(outcome)}`);
+        return EVIDENCE_EXIT.unanswered;
+    }
+    if (options.json) {
+        deps.stdout(safeJson(outcome.value));
+    }
+    else {
+        for (const line of formatRun(outcome.value))
+            deps.stdout(line);
+    }
+    return EVIDENCE_EXIT.ok;
+}
+//# sourceMappingURL=show.js.map

package/dist/evidence/show.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"show.js","sourceRoot":"","sources":["../../src/evidence/show.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,yGAAyG;AACzG,MAAM,MAAM,GAAG,iEAAiE,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,OAA2B,EAAE,IAAkB;IAClG,mFAAmF;IACnF,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,MAAM,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,aAAa,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,0BAA0B,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,aAAa,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC;IAE3C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,UAAU,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,aAAa,CAAC,EAAE,CAAC;AAC1B,CAAC"}

package/dist/evidence/status.d.ts

@@ -0,0 +1,37 @@
+import { type HarnessSink } from '../telemetry/sink.js';
+import { type RepoRef } from './target.js';
+/**
+ * `rcl evidence status [<pr>]` (RCL-41): the gate status Harness computed for
+ * a pull request — never the client's own claim. The exit code is the
+ * contract the skills gate on: 0 only when the judged projection (advisory by
+ * default, `--enforced` on request) is `converged`; 1 for every other
+ * status; 2 when the pull request cannot be named; 3 when the read could not
+ * be answered (no credential, evidence off for the organization, unknown
+ * pull request, refused credential, unreachable host) — an unanswered read is
+ * never "not converged".
+ */
+export declare const EVIDENCE_EXIT: {
+    readonly converged: 0;
+    readonly ok: 0;
+    readonly notConverged: 1;
+    readonly usage: 2;
+    readonly unanswered: 3;
+};
+export interface EvidenceDeps {
+    rclVersion: string;
+    fetchImpl?: typeof fetch;
+    env?: Record<string, string | undefined>;
+    cwd?: string;
+    credentialsPath?: string;
+    /** The repository the checkout's `origin` names; injected by tests. */
+    remoteRepo?: () => Promise<RepoRef | null>;
+    stdout: (line: string) => void;
+    stderr: (line: string) => void;
+}
+export interface StatusOptions {
+    json?: boolean;
+    enforced?: boolean;
+}
+/** The read sink, or `null` after telling the user why there is none. */
+export declare function openSink(deps: EvidenceDeps): Promise<HarnessSink | null>;
+export declare function runEvidenceStatus(prArg: string | undefined, options: StatusOptions, deps: EvidenceDeps): Promise<number>;

package/dist/evidence/status.js

@@ -0,0 +1,72 @@
+import { openReadSink } from '../telemetry/read-sink.js';
+import { describeOutcome } from '../telemetry/sink.js';
+import { formatGateStatus, safeJson, text } from './format.js';
+import { getGateStatus } from './reads.js';
+import { needsRemote, parsePullRequestArg, resolveRemoteRepo } from './target.js';
+/**
+ * `rcl evidence status [<pr>]` (RCL-41): the gate status Harness computed for
+ * a pull request — never the client's own claim. The exit code is the
+ * contract the skills gate on: 0 only when the judged projection (advisory by
+ * default, `--enforced` on request) is `converged`; 1 for every other
+ * status; 2 when the pull request cannot be named; 3 when the read could not
+ * be answered (no credential, evidence off for the organization, unknown
+ * pull request, refused credential, unreachable host) — an unanswered read is
+ * never "not converged".
+ */
+export const EVIDENCE_EXIT = { converged: 0, ok: 0, notConverged: 1, usage: 2, unanswered: 3 };
+/** The read sink, or `null` after telling the user why there is none. */
+export async function openSink(deps) {
+    const opened = await openReadSink({
+        rclVersion: deps.rclVersion,
+        ...(deps.env !== undefined ? { env: deps.env } : {}),
+        ...(deps.cwd !== undefined ? { cwd: deps.cwd } : {}),
+        ...(deps.credentialsPath !== undefined ? { credentialsPath: deps.credentialsPath } : {}),
+        ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+    });
+    if (!opened.sink) {
+        deps.stderr(`Cannot read evidence: ${opened.note}`);
+        return null;
+    }
+    return opened.sink;
+}
+export async function runEvidenceStatus(prArg, options, deps) {
+    if (prArg === undefined || prArg.trim() === '') {
+        deps.stderr('Name the pull request: N or #N (against the current git remote), owner/repo#N, or its URL.');
+        return EVIDENCE_EXIT.usage;
+    }
+    let target;
+    try {
+        const remote = needsRemote(prArg)
+            ? await (deps.remoteRepo ?? (() => resolveRemoteRepo(deps.cwd ?? process.cwd())))()
+            : null;
+        target = parsePullRequestArg(prArg, remote);
+    }
+    catch (err) {
+        // The argument or the remote may be the reason; neither reaches the terminal raw.
+        deps.stderr(text(err instanceof Error ? err.message : String(err), 400));
+        return EVIDENCE_EXIT.usage;
+    }
+    const sink = await openSink(deps);
+    if (!sink)
+        return EVIDENCE_EXIT.unanswered;
+    const outcome = await getGateStatus(sink, target.owner, target.repo, target.number);
+    const name = text(`${target.owner}/${target.repo}#${target.number}`, 200);
+    if (outcome.kind !== 'ok') {
+        deps.stderr(`Cannot read the gate status of ${name}: ${describeOutcome(outcome)}`);
+        return EVIDENCE_EXIT.unanswered;
+    }
+    const status = outcome.value;
+    const judged = options.enforced ? 'enforced' : 'advisory';
+    if (options.json) {
+        deps.stdout(safeJson(status));
+    }
+    else {
+        for (const line of formatGateStatus(status, judged))
+            deps.stdout(line);
+    }
+    // Converged is only ever conclusive on the server; a payload saying
+    // otherwise does not open the gate.
+    const projection = status[judged];
+    return projection.status === 'converged' && projection.conclusive ? EVIDENCE_EXIT.converged : EVIDENCE_EXIT.notConverged;
+}
+//# sourceMappingURL=status.js.map

package/dist/evidence/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/evidence/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAoB,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,iBAAiB,EAAgB,MAAM,aAAa,CAAC;AAEhG;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAW,CAAC;AAmBxG,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,yBAAyB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAyB,EACzB,OAAsB,EACtB,IAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,4FAA4F,CAAC,CAAC;QAC1G,OAAO,aAAa,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;YACnF,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kFAAkF;QAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzE,OAAO,aAAa,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC;IAE3C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,kCAAkC,IAAI,KAAK,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,aAAa,CAAC,UAAU,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IACD,oEAAoE;IACpE,oCAAoC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC;AAC3H,CAAC"}

package/dist/evidence/target.d.ts

@@ -0,0 +1,17 @@
+import { parseRepoName, type RepoRef } from '../resolver/github.js';
+export { parseRepoName, type RepoRef };
+/**
+ * Which pull request `rcl evidence status` asks about: `owner/repo#N` or a
+ * pull request URL stand alone; a bare `N` or `#N` is read against the
+ * repository the current checkout's `origin` remote points at.
+ */
+export interface PullRequestRef extends RepoRef {
+    number: number;
+}
+/** The GitHub repository a remote URL names, or `null` for anything else. */
+export declare function parseRemoteUrl(url: string): RepoRef | null;
+/** The repository `origin` points at, or `null` outside a checkout with a GitHub remote. Never throws. */
+export declare function resolveRemoteRepo(cwd?: string): Promise<RepoRef | null>;
+/** Whether an argument is a bare number or `#N`, which needs the remote to become a pull request. */
+export declare function needsRemote(arg: string): boolean;
+export declare function parsePullRequestArg(arg: string, remote: RepoRef | null): PullRequestRef;

package/dist/evidence/target.js

@@ -0,0 +1,74 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { GITHUB_OWNER_PATTERN as OWNER, GITHUB_REPO_PATTERN as REPO, isGitHubTarget, legalRepo, parseGitHubTarget, parseRepoName, } from '../resolver/github.js';
+// The repository primitives live with the GitHub target parser; evidence
+// callers keep reaching them from here.
+export { parseRepoName };
+const execFileAsync = promisify(execFile);
+// The scp-like form has no scheme to hand to `URL`; the repository is matched
+// lazily (`+?`) so an optional `.git` suffix is not swallowed into the name.
+const SCP_REMOTE = new RegExp(`^git@github\\.com:(${OWNER})/(${REPO}?)(?:\\.git)?/?$`, 'i');
+const REPO_PATH = new RegExp(`^/(${OWNER})/(${REPO}?)(?:\\.git)?/?$`, 'i');
+/** The GitHub repository a remote URL names, or `null` for anything else. */
+export function parseRemoteUrl(url) {
+    const trimmed = url.trim();
+    const scp = trimmed.match(SCP_REMOTE);
+    if (scp)
+        return legalRepo(scp[1], scp[2]);
+    // Scheme forms (ssh, https, git) go through `URL`, so user-info (a token,
+    // `user:password`) and a port never take part in the match.
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (!/^(?:ssh|https?|git):$/i.test(parsed.protocol) || (host !== 'github.com' && host !== 'www.github.com'))
+        return null;
+    const path = parsed.pathname.match(REPO_PATH);
+    return path ? legalRepo(path[1], path[2]) : null;
+}
+/** The repository `origin` points at, or `null` outside a checkout with a GitHub remote. Never throws. */
+export async function resolveRemoteRepo(cwd = process.cwd()) {
+    try {
+        const { stdout } = await execFileAsync('git', ['remote', 'get-url', 'origin'], { cwd });
+        return parseRemoteUrl(stdout);
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether an argument is a bare number or `#N`, which needs the remote to become a pull request. */
+export function needsRemote(arg) {
+    return /^#?\d+$/.test(arg.trim());
+}
+export function parsePullRequestArg(arg, remote) {
+    const trimmed = arg.trim();
+    if (isGitHubTarget(trimmed)) {
+        const target = parseGitHubTarget(trimmed);
+        // The GitHub parser is shared with `rcl review`; the read side re-checks
+        // what it hands back so no other target shape passes as a pull request.
+        if (legalRepo(target.owner, target.repo) === null) {
+            throw new Error('The repository in the pull request target is not a GitHub owner/repository name.');
+        }
+        if (!Number.isSafeInteger(target.number) || target.number <= 0) {
+            throw new Error(`Cannot read a pull request number from "${trimmed}": use N, #N, owner/repo#N or a pull request URL.`);
+        }
+        return { owner: target.owner, repo: target.repo, number: target.number };
+    }
+    const numeric = trimmed.match(/^#?(\d+)$/);
+    if (numeric) {
+        const number = Number(numeric[1]);
+        if (!Number.isSafeInteger(number) || number <= 0) {
+            throw new Error(`The pull request number must be positive: "${trimmed}".`);
+        }
+        if (remote === null) {
+            throw new Error(`No GitHub remote to read pull request ${number} against — name it as owner/repo#${number} or as its URL.`);
+        }
+        return { ...remote, number };
+    }
+    throw new Error(`Cannot read a pull request from "${trimmed}": use N, #N, owner/repo#N or a pull request URL.`);
+}
+//# sourceMappingURL=target.js.map

package/dist/evidence/target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../src/evidence/target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,oBAAoB,IAAI,KAAK,EAC7B,mBAAmB,IAAI,IAAI,EAC3B,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,aAAa,GAEd,MAAM,uBAAuB,CAAC;AAE/B,yEAAyE;AACzE,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAgB,CAAC;AAYvC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,sBAAsB,KAAK,MAAM,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC5F,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAE3E,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5C,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAAsB;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,mDAAmD,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,IAAI,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,oCAAoC,MAAM,iBAAiB,CAC3G,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,mDAAmD,CAAC,CAAC;AAClH,CAAC"}