scriptonia 0.8.0 → 0.9.0-rc.1

package/dist/index.js

@@ -0,0 +1,1686 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import fs9 from "fs";
+import os from "os";
+import path10 from "path";
+import { Command } from "commander";
+import pc from "picocolors";
+import YAML3 from "yaml";
+
+// ../packages/core/src/index.ts
+import { createHash, randomBytes } from "crypto";
+import path from "path";
+function canonicalize(value) {
+  return JSON.stringify(normalize(value));
+}
+function normalize(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return typeof value === "string" ? value.replace(/\r\n?/g, "\n") : value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("canonical JSON rejects non-finite numbers");
+    return value;
+  }
+  if (Array.isArray(value)) return value.map(normalize);
+  if (typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([, item2]) => item2 !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, item2]) => [key, normalize(item2)]));
+  }
+  throw new TypeError(`canonical JSON rejects ${typeof value}`);
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function hashObject(value) {
+  return sha256(canonicalize(value));
+}
+function createId(prefix, at = Date.now()) {
+  return `${prefix}_${at.toString(36).padStart(9, "0")}${randomBytes(8).toString("hex")}`;
+}
+function normalizeRepoPath(input) {
+  if (input.includes("\0")) throw new Error("repository path contains a null byte");
+  const normalized = input.replaceAll("\\", "/").replace(/^\.\//, "");
+  if (path.posix.isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../") || normalized.includes("/../")) {
+    throw new Error(`path escapes repository: ${input}`);
+  }
+  return path.posix.normalize(normalized);
+}
+function assertInside(root, candidate) {
+  const resolvedRoot = path.resolve(root);
+  const resolved = path.resolve(candidate);
+  if (resolved !== resolvedRoot && !resolved.startsWith(`${resolvedRoot}${path.sep}`)) throw new Error(`path escapes repository: ${candidate}`);
+  return resolved;
+}
+function aggregateGate(checks, incompleteBlocks = true) {
+  if (checks.some((item2) => item2.state === "FAIL" && item2.enforcement === "block")) return "BLOCKED";
+  if (checks.some((item2) => item2.state === "FAIL" && item2.enforcement === "action_required")) return "ACTION_REQUIRED";
+  if (checks.some((item2) => item2.state === "ERROR" || incompleteBlocks && item2.state === "INCONCLUSIVE" && item2.enforcement === "block")) return "INCOMPLETE";
+  if (checks.some((item2) => item2.state === "FAIL" || item2.state === "INCONCLUSIVE")) return "PASS_WITH_WARNINGS";
+  return "PASS";
+}
+function exitCodeForGate(state) {
+  return state === "PASS" || state === "PASS_WITH_WARNINGS" ? 0 : state === "ACTION_REQUIRED" ? 2 : state === "BLOCKED" ? 3 : 4;
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+
+// ../packages/eval-engine/src/index.ts
+import fs7 from "fs";
+import path8 from "path";
+import YAML2 from "yaml";
+
+// ../packages/evidence/src/index.ts
+import fs from "fs";
+import path2 from "path";
+import fg from "fast-glob";
+import { XMLParser } from "fast-xml-parser";
+function item(kind, collector, source, state, payload) {
+  return { id: createId("evidence"), kind, collector, collectorVersion: "1", source, state, contentHash: hashObject({ kind, source, state, payload }), payload, collectedAt: nowIso(), redaction: { applied: false, policyVersion: "1" } };
+}
+function collectGitHubNeeds(raw = process.env.SCRIPTONIA_NEEDS_JSON) {
+  if (!raw) return [];
+  try {
+    const needs = JSON.parse(raw);
+    return Object.entries(needs).map(([name, value]) => {
+      const result = String(value?.result ?? "unknown").toLowerCase();
+      const state = result === "success" ? "available" : result === "failure" || result === "cancelled" ? "failed" : "missing";
+      return item("github_check", "github-needs", `github:${name}`, state, { name, conclusion: result, outputs: value?.outputs ?? {} });
+    });
+  } catch (error) {
+    return [item("github_check", "github-needs", "env:SCRIPTONIA_NEEDS_JSON", "error", { error: error instanceof Error ? error.message : String(error) })];
+  }
+}
+function collectJUnit(root, patterns) {
+  const files = fg.sync(patterns, { cwd: root, absolute: true, onlyFiles: true, unique: true, suppressErrors: true });
+  const parser = new XMLParser({ ignoreAttributes: false, attributeNamePrefix: "@_", allowBooleanAttributes: true });
+  const items = [];
+  for (const filename of files) {
+    try {
+      const xml = fs.readFileSync(filename, "utf8");
+      if (Buffer.byteLength(xml) > 1e7) throw new Error("JUnit artifact exceeds 10 MB limit");
+      const parsed = parser.parse(xml);
+      for (const test of flattenTests(parsed)) {
+        const failed = Boolean(test.failure || test.error);
+        const skipped = Boolean(test.skipped);
+        const suite = String(test.classname ?? test.suite ?? "");
+        const name = String(test.name ?? "unnamed");
+        items.push(item("junit_test", "junit-xml", path2.relative(root, filename), skipped ? "missing" : failed ? "failed" : "available", { suite, test: name, failed, skipped }));
+      }
+    } catch (error) {
+      items.push(item("junit_test", "junit-xml", path2.relative(root, filename), "error", { error: error instanceof Error ? error.message : String(error) }));
+    }
+  }
+  return items;
+}
+function flattenTests(value, suite = "") {
+  if (!value || typeof value !== "object") return [];
+  const record = value;
+  const currentSuite = String(record["@_name"] ?? suite);
+  const tests = asArray(record.testcase).map((entry) => ({ ...entry, suite: currentSuite, classname: entry["@_classname"], name: entry["@_name"], failure: entry.failure, error: entry.error, skipped: entry.skipped }));
+  for (const key of ["testsuite", "testsuites"]) for (const child of asArray(record[key])) tests.push(...flattenTests(child, currentSuite));
+  return tests;
+}
+function asArray(value) {
+  return value === void 0 ? [] : Array.isArray(value) ? value : [value];
+}
+function collectRepositoryFacts(root, changedFiles) {
+  return changedFiles.map((file) => {
+    const full = path2.join(root, file);
+    let exists = false;
+    let size = 0;
+    try {
+      const stat = fs.statSync(full);
+      exists = stat.isFile();
+      size = stat.size;
+    } catch {
+    }
+    return item("repository_fact", "repository-fact", `path:${file}`, "available", { path: file, exists, size });
+  });
+}
+function evaluateRequirement(requirement, evidence) {
+  const relevant = evidence.filter((candidate) => candidate.kind === requirement.kind && requirementMatches(requirement, candidate));
+  if (!relevant.length) return { state: "INCONCLUSIVE", reason: `Required ${requirement.kind} evidence is unavailable.`, evidence: [] };
+  if (relevant.some((candidate) => candidate.state === "error")) return { state: "ERROR", reason: `${requirement.kind} collector failed.`, evidence: relevant };
+  if (relevant.some((candidate) => candidate.state === "failed")) return { state: "FAIL", reason: `Required ${requirement.kind} evidence failed.`, evidence: relevant };
+  if (relevant.some((candidate) => candidate.state === "available")) return { state: "PASS", reason: `Required ${requirement.kind} evidence passed.`, evidence: relevant };
+  return { state: "INCONCLUSIVE", reason: `Required ${requirement.kind} evidence is incomplete.`, evidence: relevant };
+}
+function requirementMatches(requirement, candidate) {
+  const payload = candidate.payload;
+  if (requirement.name && String(payload.name ?? payload.test ?? "") !== requirement.name) return false;
+  if (requirement.suite && String(payload.suite ?? "") !== requirement.suite) return false;
+  if (requirement.test && String(payload.test ?? "") !== requirement.test) return false;
+  if (requirement.path && String(payload.path ?? "") !== requirement.path) return false;
+  if (requirement.value && !Object.values(payload).map(String).includes(requirement.value)) return false;
+  return true;
+}
+
+// ../packages/git-snapshot/src/index.ts
+import fs2 from "fs";
+import path3 from "path";
+import { spawnSync } from "child_process";
+function git(root, args, allowFailure = false) {
+  const result = spawnSync("git", args, { cwd: root, encoding: "utf8", maxBuffer: 4e7, shell: false });
+  if (result.error) throw result.error;
+  if (result.status !== 0 && !allowFailure) throw new Error(`git ${args[0] ?? "command"} failed: ${(result.stderr || "").trim()}`);
+  return result.status === 0 ? (result.stdout || "").trimEnd() : "";
+}
+function findRepositoryRoot(cwd = process.cwd()) {
+  const root = git(cwd, ["rev-parse", "--show-toplevel"]);
+  if (!root) throw new Error("not inside a Git repository");
+  return path3.resolve(root);
+}
+function resolveRef(root, ref) {
+  const sha = git(root, ["rev-parse", "--verify", `${ref}^{commit}`]);
+  if (!/^[0-9a-f]{40}$/i.test(sha)) throw new Error(`invalid Git ref: ${ref}`);
+  return sha.toLowerCase();
+}
+function readFileAtRef(root, ref, filename) {
+  const sha = resolveRef(root, ref);
+  const safe = normalizeRepoPath(filename);
+  const result = spawnSync("git", ["show", `${sha}:${safe}`], { cwd: root, encoding: "utf8", maxBuffer: 1e7, shell: false });
+  return result.status === 0 ? result.stdout : void 0;
+}
+function listFilesAtRef(root, ref, prefixes) {
+  const sha = resolveRef(root, ref);
+  const safe = prefixes.map(normalizeRepoPath);
+  const output = git(root, ["ls-tree", "-r", "--name-only", sha, "--", ...safe], true);
+  return output.split("\n").filter(Boolean).map(normalizeRepoPath).sort();
+}
+function parseNameStatus(text) {
+  const out = [];
+  for (const line of text.split("\n")) {
+    if (!line) continue;
+    const [rawStatus = "", first = "", second] = line.split("	");
+    const code = rawStatus[0];
+    const status = code === "A" ? "added" : code === "M" ? "modified" : code === "D" ? "deleted" : code === "R" ? "renamed" : code === "C" ? "copied" : "unknown";
+    const target = status === "renamed" || status === "copied" ? second : first;
+    if (!target) continue;
+    const item2 = { path: normalizeRepoPath(target), status, binary: false };
+    if ((status === "renamed" || status === "copied") && first) item2.oldPath = normalizeRepoPath(first);
+    out.push(item2);
+  }
+  return out;
+}
+function untrackedFiles(root) {
+  return git(root, ["ls-files", "--others", "--exclude-standard"], true).split("\n").filter(Boolean).map(normalizeRepoPath).filter((file) => !isRuntimeFile(file)).map((file) => ({ path: file, status: "added", binary: isBinary(path3.join(root, file)) }));
+}
+function isRuntimeFile(file) {
+  return /^\.scriptonia\/(?:brain\.db(?:-shm|-wal)?|artifacts\/|result(?:\.|-)|self-verification\.)/.test(file);
+}
+function isBinary(filename) {
+  try {
+    const fd = fs2.openSync(filename, "r");
+    const buffer = Buffer.alloc(8192);
+    const read = fs2.readSync(fd, buffer, 0, buffer.length, 0);
+    fs2.closeSync(fd);
+    return buffer.subarray(0, read).includes(0);
+  } catch {
+    return false;
+  }
+}
+function untrackedPatch(root, files) {
+  const chunks = [];
+  for (const file of files) {
+    if (file.binary) {
+      chunks.push(`diff --git a/${file.path} b/${file.path}
+new file mode 100644
+Binary files /dev/null and b/${file.path} differ`);
+      continue;
+    }
+    const full = path3.join(root, file.path);
+    try {
+      const stat = fs2.statSync(full);
+      if (!stat.isFile() || stat.size > 1e6) continue;
+      const body = fs2.readFileSync(full, "utf8").replace(/\r\n?/g, "\n");
+      const lines = body.split("\n");
+      chunks.push(`diff --git a/${file.path} b/${file.path}
+new file mode 100644
+--- /dev/null
++++ b/${file.path}
+@@ -0,0 +1,${lines.length} @@
+${lines.map((line) => `+${line}`).join("\n")}`);
+    } catch {
+    }
+  }
+  return chunks.join("\n");
+}
+function buildSnapshot(options = {}) {
+  const root = findRepositoryRoot(options.cwd);
+  const baseRef = options.base ?? "HEAD";
+  const baseSha = resolveRef(root, baseRef);
+  const headSha = resolveRef(root, "HEAD");
+  const includeWorkingTree = options.includeWorkingTree ?? true;
+  const range = baseSha === headSha ? "HEAD" : `${baseSha}...${headSha}`;
+  let diff = git(root, ["diff", "--no-ext-diff", "--binary", "--unified=20", range]);
+  let files = parseNameStatus(git(root, ["diff", "--name-status", "--find-renames", range]));
+  let dirty = false;
+  if (includeWorkingTree) {
+    const working = git(root, ["diff", "--no-ext-diff", "--binary", "--unified=20", "HEAD"]);
+    const workingFiles = parseNameStatus(git(root, ["diff", "--name-status", "--find-renames", "HEAD"]));
+    const untracked = untrackedFiles(root);
+    dirty = workingFiles.length > 0 || untracked.length > 0;
+    diff = [diff, working, untrackedPatch(root, untracked)].filter(Boolean).join("\n");
+    const map = new Map([...files, ...workingFiles, ...untracked].map((file) => [file.path, file]));
+    files = [...map.values()].sort((a, b) => a.path.localeCompare(b.path));
+  }
+  for (const file of files) if (!file.binary && file.status !== "deleted") file.binary = isBinary(path3.join(root, file.path));
+  const diffHash = sha256(diff.replace(/\r\n?/g, "\n"));
+  const identity = { schemaVersion: "1", baseSha, headSha, dirty, diffHash, files: files.map(({ path: name, status, oldPath, binary }) => ({ path: name, status, oldPath, binary })) };
+  return { schemaVersion: "1", repositoryRoot: root, baseRef, baseSha, headSha, dirty, diff, diffHash, files, snapshotId: hashObject(identity) };
+}
+
+// ../packages/impact/src/index.ts
+import fs3 from "fs";
+import path4 from "path";
+import fg2 from "fast-glob";
+var SOURCE = ["**/*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}", "!**/node_modules/**", "!**/dist/**", "!**/.next/**", "!**/coverage/**"];
+var EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", ".mjs", ".cjs", "/index.ts", "/index.tsx", "/index.js", "/index.jsx"];
+function buildFallbackImpactIndex(root) {
+  const files = fg2.sync(SOURCE, { cwd: root, onlyFiles: true, unique: true }).map(normalizeRepoPath).sort();
+  const known = new Set(files);
+  const edges = [];
+  for (const file of files) {
+    let text;
+    try {
+      text = fs3.readFileSync(path4.join(root, file), "utf8");
+    } catch {
+      continue;
+    }
+    const imports = [
+      ...text.matchAll(/(?:import|export)\s+(?:[^'";]+?\s+from\s+)?["']([^"']+)["']/g),
+      ...text.matchAll(/(?:require|import)\(\s*["']([^"']+)["']\s*\)/g)
+    ];
+    for (const match of imports) {
+      const specifier = match[1];
+      if (!specifier?.startsWith(".")) continue;
+      const base = normalizeRepoPath(path4.posix.join(path4.posix.dirname(file), specifier));
+      const target = EXTENSIONS.map((extension) => `${base}${extension}`).find((candidate) => known.has(candidate));
+      if (target) edges.push({ from: file, to: target, kind: "import", confidence: "high", provenance: `static-import:${file}` });
+    }
+  }
+  const stable = edges.sort((a, b) => `${a.from}:${a.to}`.localeCompare(`${b.from}:${b.to}`));
+  return { provider: "fallback-import-graph", version: "1", id: hashObject(stable), edges: stable };
+}
+function impactedFiles(index, changedFiles, depth = 2) {
+  const changed = new Set(changedFiles.map(normalizeRepoPath));
+  const files = new Set(changed);
+  const used = [];
+  let frontier = new Set(changed);
+  for (let step = 0; step < depth; step++) {
+    const next = /* @__PURE__ */ new Set();
+    for (const edge of index.edges) {
+      if (edge.confidence !== "high" || !frontier.has(edge.to) || files.has(edge.from)) continue;
+      files.add(edge.from);
+      next.add(edge.from);
+      used.push(edge);
+    }
+    frontier = next;
+    if (!frontier.size) break;
+  }
+  return { files: [...files].sort(), edges: used };
+}
+function relatedTests(index, changedFiles) {
+  const impacted = impactedFiles(index, changedFiles, 3).files;
+  return impacted.filter((file) => /(?:^|\/)(?:__tests__|tests?|spec)(?:\/|$)|\.(?:test|spec)\.[^.]+$/i.test(file));
+}
+function loadCodeGraphIndex(root) {
+  const filename = path4.join(root, ".scriptonia", "codegraph.json");
+  if (!fs3.existsSync(filename)) return void 0;
+  try {
+    const value = JSON.parse(fs3.readFileSync(filename, "utf8"));
+    const edges = (value.edges ?? []).filter((edge) => edge && typeof edge.from === "string" && typeof edge.to === "string" && ["high", "medium", "low"].includes(edge.confidence));
+    return { provider: "codegraph-file-adapter", version: "1", id: hashObject({ sourceVersion: value.version, edges }), edges };
+  } catch {
+    return void 0;
+  }
+}
+
+// ../packages/model-gateway/src/index.ts
+import { z } from "zod";
+var judgeResultSchema = z.object({
+  result: z.enum(["supports", "contradicts", "uncertain"]),
+  confidence: z.number().min(0).max(1),
+  evidenceRefs: z.array(z.string()).default([]),
+  reason: z.string()
+});
+async function semanticJudge(input) {
+  const model = input.model ?? process.env.OPENAI_OUTPUT_MODEL ?? "gpt-5.6-terra";
+  const rubric = "Assess only whether the supplied evidence supports or contradicts the criterion. Return uncertain when evidence is insufficient. Never infer behavior from code style or plausibility.";
+  const serialized = JSON.stringify(input.evidenceBundle);
+  const maxBytes = input.maxBytes ?? 12e4;
+  if (Buffer.byteLength(serialized) > maxBytes) return { available: false, error: `evidence bundle exceeds ${maxBytes} byte limit` };
+  const gatewayUrl = process.env.SCRIPTONIA_MODEL_GATEWAY_URL?.replace(/\/$/, "");
+  const gatewayToken = process.env.SCRIPTONIA_API_TOKEN;
+  if (gatewayUrl && gatewayToken) {
+    const controller2 = new AbortController();
+    const timeout2 = setTimeout(() => controller2.abort(), input.timeoutMs ?? 2e4);
+    try {
+      const response = await (input.fetchImpl ?? fetch)(`${gatewayUrl}/api/v2/judge`, { method: "POST", headers: { authorization: `Bearer ${gatewayToken}`, "content-type": "application/json" }, signal: controller2.signal, body: JSON.stringify({ criterion: input.criterion, evidence: input.evidenceBundle }) });
+      const body = await response.json();
+      if (!response.ok) return { available: false, error: `Scriptonia model gateway returned ${response.status}` };
+      const parsed = judgeResultSchema.safeParse(body);
+      if (!parsed.success) return { available: false, error: "Scriptonia model gateway returned invalid structured output" };
+      return { available: true, result: { ...parsed.data, schemaVersion: "1", evaluatorVersion: "1", model: String(body.model ?? model), ...typeof body.providerRevision === "string" ? { providerRevision: body.providerRevision } : {}, rubricHash: String(body.rubricHash ?? hashObject(rubric)) } };
+    } catch (error) {
+      return { available: false, error: error instanceof Error ? error.message : String(error) };
+    } finally {
+      clearTimeout(timeout2);
+    }
+  }
+  const endpoint = input.endpoint ?? process.env.LITELLM_BASE_URL;
+  const apiKey = input.apiKey ?? process.env.LITELLM_MASTER_KEY;
+  if (!endpoint || !apiKey) return { available: false, error: "Scriptonia model gateway is not configured" };
+  const directModel = input.model ?? process.env.LITELLM_MODEL ?? "semantic-judge";
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), input.timeoutMs ?? 2e4);
+  const url = `${endpoint.replace(/\/$/, "")}/v1/chat/completions`;
+  try {
+    const response = await (input.fetchImpl ?? fetch)(url, {
+      method: "POST",
+      headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" },
+      signal: controller.signal,
+      body: JSON.stringify({
+        model: directModel,
+        temperature: 0,
+        response_format: { type: "json_object" },
+        messages: [
+          { role: "system", content: `${rubric}
+Return JSON with result, confidence, evidenceRefs, reason.` },
+          { role: "user", content: JSON.stringify({ criterion: input.criterion, evidence: input.evidenceBundle }) }
+        ]
+      })
+    });
+    const body = await response.json();
+    if (!response.ok) return { available: false, error: `LiteLLM returned ${response.status}` };
+    const content = body.choices?.[0]?.message?.content;
+    if (typeof content !== "string") return { available: false, error: "LiteLLM response contains no message content" };
+    const parsed = judgeResultSchema.safeParse(JSON.parse(content));
+    if (!parsed.success) return { available: false, error: "semantic judge returned invalid structured output" };
+    return { available: true, result: { ...parsed.data, schemaVersion: "1", evaluatorVersion: "1", model: directModel, rubricHash: hashObject(rubric) } };
+  } catch (error) {
+    return { available: false, error: error instanceof Error ? error.message : String(error) };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../packages/observability/src/index.ts
+import { SpanStatusCode, trace } from "@opentelemetry/api";
+var started = false;
+async function initializeTelemetry() {
+  if (started || process.env.SCRIPTONIA_TELEMETRY !== "1" || !process.env.OTEL_EXPORTER_OTLP_ENDPOINT) return;
+  const [{ NodeSDK }, { OTLPTraceExporter }] = await Promise.all([import("@opentelemetry/sdk-node"), import("@opentelemetry/exporter-trace-otlp-http")]);
+  const sdk = new NodeSDK({ traceExporter: new OTLPTraceExporter({ url: `${process.env.OTEL_EXPORTER_OTLP_ENDPOINT.replace(/\/$/, "")}/v1/traces` }) });
+  await sdk.start();
+  started = true;
+}
+async function withSpan(name, attributes, operation) {
+  const tracer = trace.getTracer("scriptonia", "0.9.0-rc.1");
+  return tracer.startActiveSpan(name, { attributes }, async (span) => {
+    const startedAt = performance.now();
+    try {
+      const result = await operation();
+      span.setAttribute("duration_bucket_ms", bucket(performance.now() - startedAt));
+      span.setStatus({ code: SpanStatusCode.OK });
+      return result;
+    } catch (error) {
+      span.setStatus({ code: SpanStatusCode.ERROR, message: error instanceof Error ? error.message : String(error) });
+      throw error;
+    } finally {
+      span.end();
+    }
+  });
+}
+function bucket(duration) {
+  const buckets = [10, 25, 50, 100, 250, 500, 1e3, 2e3, 5e3, 1e4, 3e4];
+  return buckets.find((value) => duration <= value) ?? 6e4;
+}
+
+// ../packages/policy-engine/src/index.ts
+import fs5 from "fs";
+import path6 from "path";
+import picomatch2 from "picomatch";
+import YAML from "yaml";
+
+// ../packages/schemas/src/index.ts
+import { z as z2 } from "zod";
+var checkStateSchema = z2.enum(["PASS", "FAIL", "INCONCLUSIVE", "SKIPPED", "ERROR"]);
+var gateStateSchema = z2.enum(["PASS", "PASS_WITH_WARNINGS", "ACTION_REQUIRED", "BLOCKED", "INCOMPLETE"]);
+var enforcementSchema = z2.enum(["observe", "warn", "action_required", "block"]);
+var lifecycleSchema = z2.enum(["draft", "active", "superseded", "expired", "stale", "quarantined", "archived"]);
+var defaultScope = {
+  repositories: [],
+  packages: [],
+  services: [],
+  paths: { include: ["**"], exclude: [] },
+  symbols: [],
+  dependencies: [],
+  owners: [],
+  tags: []
+};
+var scopeSchema = z2.object({
+  repositories: z2.array(z2.string()).default([]),
+  packages: z2.array(z2.string()).default([]),
+  services: z2.array(z2.string()).default([]),
+  paths: z2.object({ include: z2.array(z2.string()).default(["**"]), exclude: z2.array(z2.string()).default([]) }).default({ include: ["**"], exclude: [] }),
+  symbols: z2.array(z2.string()).default([]),
+  dependencies: z2.array(z2.string()).default([]),
+  owners: z2.array(z2.string()).default([]),
+  tags: z2.array(z2.string()).default([])
+}).default(defaultScope);
+var predicateKinds = [
+  "path_forbidden",
+  "path_requires_owner",
+  "dependency_forbidden",
+  "dependency_required",
+  "symbol_forbidden",
+  "symbol_requires_test",
+  "file_pattern_required",
+  "permission_required",
+  "check_required"
+];
+var predicateSchema = z2.object({
+  kind: z2.enum(predicateKinds),
+  names: z2.array(z2.string()).default([]),
+  patterns: z2.array(z2.string()).default([]),
+  owner: z2.string().optional(),
+  permission: z2.string().optional(),
+  check: z2.string().optional()
+});
+var decisionSchema = z2.object({
+  schema_version: z2.literal("1").default("1"),
+  id: z2.string().min(1),
+  version: z2.number().int().positive().default(1),
+  title: z2.string().min(1),
+  state: lifecycleSchema.default("draft"),
+  owner: z2.string().optional(),
+  source_refs: z2.array(z2.string()).default([]),
+  scope: scopeSchema,
+  predicate: predicateSchema,
+  enforcement: enforcementSchema.default("observe"),
+  created_at: z2.string().datetime().optional(),
+  confirmed_by: z2.string().optional(),
+  supersedes: z2.string().optional()
+});
+var evidenceRequirementSchema = z2.object({
+  kind: z2.enum(["github_check", "junit_test", "repository_fact", "decision_predicate", "state_validator", "human_confirmation", "semantic_judge"]),
+  name: z2.string().optional(),
+  suite: z2.string().optional(),
+  test: z2.string().optional(),
+  path: z2.string().optional(),
+  value: z2.string().optional()
+});
+var evalCaseSchema = z2.object({
+  schema_version: z2.literal("1").default("1"),
+  id: z2.string().min(1),
+  version: z2.number().int().positive().default(1),
+  title: z2.string().min(1),
+  state: lifecycleSchema.default("draft"),
+  owner: z2.string().optional(),
+  origin: z2.object({ kind: z2.string(), run_ref: z2.string().optional(), finding_ref: z2.string().optional() }),
+  decision_refs: z2.array(z2.string()).default([]),
+  signal_refs: z2.array(z2.string()).default([]),
+  scope: scopeSchema,
+  assertion: z2.object({ kind: z2.string(), description: z2.string().optional() }),
+  evidence: z2.object({ all: z2.array(evidenceRequirementSchema).default([]), any: z2.array(evidenceRequirementSchema).default([]) }).default({ all: [], any: [] }),
+  enforcement: enforcementSchema.default("observe"),
+  fingerprint: z2.string().optional(),
+  last_confirmed_at: z2.string().datetime().optional(),
+  review_after: z2.string().datetime().optional()
+});
+var runEventSchema = z2.object({
+  schemaVersion: z2.literal("1"),
+  eventId: z2.string(),
+  runId: z2.string(),
+  sequence: z2.number().int().nonnegative(),
+  occurredAt: z2.string().datetime(),
+  source: z2.object({ adapter: z2.string(), adapterVersion: z2.string(), agent: z2.string().optional(), agentVersion: z2.string().optional() }),
+  type: z2.enum(["run.started", "run.finished", "tool.requested", "tool.completed", "file.changed", "command.requested", "human.corrected", "error"]),
+  payload: z2.unknown(),
+  redaction: z2.object({ applied: z2.boolean(), policyVersion: z2.string() })
+});
+var configSchema = z2.object({
+  schema_version: z2.literal("1").default("1"),
+  base_ref: z2.string().default("HEAD"),
+  required_plan: z2.boolean().default(false),
+  incomplete_blocks: z2.boolean().default(true),
+  trusted_config_ref: z2.string().default("HEAD"),
+  evidence: z2.object({ junit: z2.array(z2.string()).default([]), github_needs_env: z2.string().default("SCRIPTONIA_NEEDS_JSON") }).default({ junit: [], github_needs_env: "SCRIPTONIA_NEEDS_JSON" }),
+  semantic: z2.object({ enabled: z2.boolean().default(false), endpoint: z2.string().url().optional(), model: z2.string().optional(), max_bytes: z2.number().int().positive().default(12e4), timeout_ms: z2.number().int().positive().default(2e4) }).default({ enabled: false, max_bytes: 12e4, timeout_ms: 2e4 }),
+  redaction: z2.object({ env_names: z2.array(z2.string()).default([]), patterns: z2.array(z2.string()).default([]), max_payload_bytes: z2.number().int().positive().default(128e3) }).default({ env_names: [], patterns: [], max_payload_bytes: 128e3 })
+});
+
+// ../packages/scope-engine/src/index.ts
+import fs4 from "fs";
+import path5 from "path";
+import picomatch from "picomatch";
+function discoverPackages(root) {
+  const result = /* @__PURE__ */ new Map();
+  const visit = (relative, depth) => {
+    if (depth > 4) return;
+    const absolute = path5.join(root, relative);
+    for (const entry of safeReadDir(absolute)) {
+      if (!entry.isDirectory() || entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "dist") continue;
+      const next = normalizeRepoPath(path5.posix.join(relative.replaceAll("\\", "/"), entry.name));
+      const pkgFile = path5.join(root, next, "package.json");
+      if (fs4.existsSync(pkgFile)) {
+        try {
+          result.set(next, String(JSON.parse(fs4.readFileSync(pkgFile, "utf8")).name || next));
+        } catch {
+          result.set(next, next);
+        }
+      }
+      visit(next, depth + 1);
+    }
+  };
+  if (fs4.existsSync(path5.join(root, "package.json"))) {
+    try {
+      result.set(".", String(JSON.parse(fs4.readFileSync(path5.join(root, "package.json"), "utf8")).name || "."));
+    } catch {
+      result.set(".", ".");
+    }
+  }
+  visit(".", 0);
+  return result;
+}
+function safeReadDir(dir) {
+  try {
+    return fs4.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function parseCodeowners(root) {
+  const candidates = ["CODEOWNERS", ".github/CODEOWNERS", "docs/CODEOWNERS"];
+  const file = candidates.map((name) => path5.join(root, name)).find(fs4.existsSync);
+  const owners = /* @__PURE__ */ new Map();
+  if (!file) return owners;
+  for (const raw of fs4.readFileSync(file, "utf8").split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const [pattern, ...names] = line.split(/\s+/);
+    if (pattern && names.length) owners.set(pattern.replace(/^\//, ""), names);
+  }
+  return owners;
+}
+function ownerFor(file, owners) {
+  let found;
+  for (const [pattern, names] of owners) {
+    try {
+      if (picomatch.isMatch(file, pattern, { dot: true, basename: !pattern.includes("/") })) found = names;
+    } catch {
+    }
+  }
+  return found?.join(",");
+}
+function buildScopeContext(root, files, extras = {}) {
+  return {
+    root,
+    files: files.map(normalizeRepoPath),
+    symbols: extras.symbols ?? extractSymbols(root, files),
+    dependencies: extras.dependencies ?? discoverDependencies(root),
+    checks: extras.checks ?? [],
+    permissions: extras.permissions ?? [],
+    owners: parseCodeowners(root),
+    packages: discoverPackages(root)
+  };
+}
+function matchScope(scope, context) {
+  const include = scope.paths.include.length ? scope.paths.include : ["**"];
+  const included = picomatch(include, { dot: true });
+  const excluded = scope.paths.exclude.length ? picomatch(scope.paths.exclude, { dot: true }) : () => false;
+  const pathFiles = context.files.filter((file) => included(file) && !excluded(file));
+  const packageRoots = [...context.packages.entries()].filter(([, name]) => scope.packages.includes(name)).map(([root]) => root);
+  const packageFiles = scope.packages.length ? context.files.filter((file) => packageRoots.some((root) => root === "." || file === root || file.startsWith(`${root}/`))) : [];
+  const symbols = scope.symbols.filter((symbol) => context.symbols.includes(symbol));
+  const deps = scope.dependencies.filter((dependency) => context.dependencies.includes(dependency));
+  const hasConstraint = scope.packages.length + scope.services.length + scope.symbols.length + scope.dependencies.length > 0 || scope.paths.include.some((item2) => item2 !== "**");
+  const matched = hasConstraint ? Boolean(pathFiles.length || packageFiles.length || symbols.length || deps.length) : Boolean(context.files.length);
+  const specificity = symbols.length ? 5 : pathFiles.some((file) => scope.paths.include.includes(file)) ? 4 : pathFiles.length ? 3 : packageFiles.length ? 2 : matched ? 1 : 0;
+  const files = [.../* @__PURE__ */ new Set([...pathFiles, ...packageFiles])];
+  const reasons = [files.length && `paths:${files.length}`, symbols.length && `symbols:${symbols.join(",")}`, deps.length && `dependencies:${deps.join(",")}`].filter(Boolean);
+  return { matched, specificity, files, reasons, owner: files.map((file) => ownerFor(file, context.owners)).find(Boolean) };
+}
+function discoverDependencies(root) {
+  const names = /* @__PURE__ */ new Set();
+  for (const [directory] of discoverPackages(root)) {
+    try {
+      const pkg = JSON.parse(fs4.readFileSync(path5.join(root, directory, "package.json"), "utf8"));
+      for (const section of [pkg.dependencies, pkg.devDependencies, pkg.peerDependencies]) for (const name of Object.keys(section || {})) names.add(name);
+    } catch {
+    }
+  }
+  return [...names].sort();
+}
+function extractSymbols(root, files) {
+  const symbols = /* @__PURE__ */ new Set();
+  const pattern = /\b(?:export\s+)?(?:async\s+)?(?:function|class|interface|type|const|let|var)\s+([A-Za-z_$][\w$]*)/g;
+  for (const file of files) {
+    if (!/\.[cm]?[jt]sx?$/.test(file)) continue;
+    try {
+      const text = fs4.readFileSync(path5.join(root, file), "utf8");
+      for (const match of text.matchAll(pattern)) if (match[1]) symbols.add(match[1]);
+    } catch {
+    }
+  }
+  return [...symbols].sort();
+}
+
+// ../packages/policy-engine/src/index.ts
+function loadDecisions(root) {
+  const directory = path6.join(root, ".scriptonia", "decisions");
+  if (!fs5.existsSync(directory)) return { decisions: [], errors: [] };
+  const decisions = [];
+  const errors = [];
+  for (const name of fs5.readdirSync(directory).filter((file) => /\.ya?ml$/i.test(file)).sort()) {
+    try {
+      decisions.push(decisionSchema.parse(YAML.parse(fs5.readFileSync(path6.join(directory, name), "utf8"))));
+    } catch (error) {
+      errors.push(`${name}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { decisions, errors };
+}
+function parseDecisionDocuments(documents) {
+  const decisions = [];
+  const errors = [];
+  for (const document of documents) {
+    try {
+      decisions.push(decisionSchema.parse(YAML.parse(document.text)));
+    } catch (error) {
+      errors.push(`${document.name}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { decisions, errors };
+}
+function evaluateDecisions(decisions, context) {
+  return decisions.map((decision) => evaluateDecision(decision, context));
+}
+function evaluateDecision(decision, context) {
+  const base = { id: `decision:${decision.id}@${decision.version}`, evaluator: `predicate:${decision.predicate.kind}`, evaluatorVersion: "1", enforcement: decision.enforcement, title: decision.title, decisionRef: `${decision.id}@${decision.version}` };
+  const finish = (state, reason, evidence, owner) => {
+    const identity = { decision: base.decisionRef, state, evidence, evaluator: base.evaluator, version: base.evaluatorVersion };
+    return { ...base, state, reason, evidence, ...owner ? { owner } : {}, fingerprint: hashObject(identity) };
+  };
+  if (decision.state !== "active") return finish("SKIPPED", `Decision is ${decision.state}; only active decisions enforce.`, []);
+  if (!decision.confirmed_by) return finish("INCONCLUSIVE", "Active decision has no human confirmation.", []);
+  const scoped = matchScope(decision.scope, context);
+  if (!scoped.matched) return finish("SKIPPED", "Decision scope does not intersect this change.", []);
+  const p = decision.predicate;
+  const names = p.names.length ? p.names : p.patterns;
+  const matches = (patterns) => context.files.filter((file) => picomatch2.isMatch(file, patterns, { dot: true }));
+  switch (p.kind) {
+    case "path_forbidden": {
+      const found = matches(names);
+      return finish(found.length ? "FAIL" : "PASS", found.length ? `Forbidden paths changed: ${found.join(", ")}` : "No forbidden path changed.", found.map((value) => ({ kind: "path", value })), decision.owner ?? scoped.owner);
+    }
+    case "path_requires_owner": {
+      const target = matches(names.length ? names : decision.scope.paths.include);
+      const missing = target.filter((file) => !ownerFor(file, context.owners) && !decision.owner && !p.owner);
+      return finish(missing.length ? "FAIL" : "PASS", missing.length ? `Changed paths have no owner: ${missing.join(", ")}` : "All applicable paths have an owner.", target.map((value) => ({ kind: "path", value })), decision.owner ?? p.owner ?? scoped.owner);
+    }
+    case "dependency_forbidden": {
+      const found = names.filter((name) => context.dependencies.includes(name));
+      return finish(found.length ? "FAIL" : "PASS", found.length ? `Forbidden dependencies present: ${found.join(", ")}` : "No forbidden dependency is present.", found.map((value) => ({ kind: "dependency", value })), decision.owner ?? scoped.owner);
+    }
+    case "dependency_required": {
+      const missing = names.filter((name) => !context.dependencies.includes(name));
+      return finish(missing.length ? "FAIL" : "PASS", missing.length ? `Required dependencies missing: ${missing.join(", ")}` : "Required dependencies are present.", names.map((value) => ({ kind: "dependency", value })), decision.owner ?? scoped.owner);
+    }
+    case "symbol_forbidden": {
+      const found = names.filter((name) => context.symbols.includes(name));
+      return finish(found.length ? "FAIL" : "PASS", found.length ? `Forbidden symbols changed: ${found.join(", ")}` : "No forbidden symbol changed.", found.map((value) => ({ kind: "symbol", value })), decision.owner ?? scoped.owner);
+    }
+    case "symbol_requires_test": {
+      const targeted = names.some((name) => context.symbols.includes(name));
+      const tests = context.files.filter((file) => /(?:^|\/)(?:__tests__|tests?|spec)(?:\/|$)|\.(?:test|spec)\.[^.]+$/i.test(file));
+      return finish(targeted && !tests.length ? "FAIL" : "PASS", targeted && !tests.length ? "Changed symbol requires a changed test." : "Required test-file evidence is present or the symbol is unchanged.", tests.map((value) => ({ kind: "path", value })), decision.owner ?? scoped.owner);
+    }
+    case "file_pattern_required": {
+      const found = matches(names);
+      return finish(found.length ? "PASS" : "FAIL", found.length ? "Required file pattern is present in the change." : `No changed file matches: ${names.join(", ")}`, found.map((value) => ({ kind: "path", value })), decision.owner ?? scoped.owner);
+    }
+    case "permission_required": {
+      const required = p.permission ?? names[0];
+      if (!required) return finish("ERROR", "permission_required has no permission value.", []);
+      return finish(context.permissions.includes(required) ? "PASS" : "INCONCLUSIVE", context.permissions.includes(required) ? `Permission confirmed: ${required}` : `Permission not confirmed: ${required}`, [{ kind: "permission", value: required }], decision.owner ?? scoped.owner);
+    }
+    case "check_required": {
+      const required = p.check ?? names[0];
+      if (!required) return finish("ERROR", "check_required has no check name.", []);
+      return finish(context.checks.includes(required) ? "PASS" : "INCONCLUSIVE", context.checks.includes(required) ? `Required check passed: ${required}` : `Required check evidence unavailable: ${required}`, [{ kind: "check", value: required }], decision.owner ?? scoped.owner);
+    }
+  }
+}
+
+// ../packages/storage-sqlite/src/index.ts
+import fs6 from "fs";
+import path7 from "path";
+import Database from "better-sqlite3";
+var MIGRATION_1 = `
+CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS agent_runs (
+  id TEXT PRIMARY KEY, adapter TEXT NOT NULL, command_json TEXT NOT NULL, started_at TEXT NOT NULL,
+  finished_at TEXT, base_sha TEXT, head_sha TEXT, diff_hash TEXT, exit_code INTEGER, status TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS run_events (
+  event_id TEXT PRIMARY KEY, run_id TEXT NOT NULL REFERENCES agent_runs(id), sequence INTEGER NOT NULL,
+  occurred_at TEXT NOT NULL, type TEXT NOT NULL, payload_json TEXT NOT NULL, redacted INTEGER NOT NULL,
+  UNIQUE(run_id, sequence)
+);
+CREATE TABLE IF NOT EXISTS git_snapshots (
+  id TEXT PRIMARY KEY, base_sha TEXT NOT NULL, head_sha TEXT NOT NULL, diff_hash TEXT NOT NULL,
+  payload_json TEXT NOT NULL, created_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS verification_runs (
+  id TEXT PRIMARY KEY, snapshot_id TEXT NOT NULL, gate_state TEXT NOT NULL, result_json TEXT NOT NULL,
+  created_at TEXT NOT NULL, refreshed_from TEXT
+);
+CREATE TABLE IF NOT EXISTS verdict_cache (
+  snapshot_id TEXT PRIMARY KEY, verification_id TEXT NOT NULL REFERENCES verification_runs(id), result_json TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS findings (
+  id TEXT PRIMARY KEY, snapshot_id TEXT NOT NULL, fingerprint TEXT NOT NULL, evaluator TEXT NOT NULL,
+  state TEXT NOT NULL, enforcement TEXT NOT NULL, owner TEXT, payload_json TEXT NOT NULL,
+  first_seen TEXT NOT NULL, last_seen TEXT NOT NULL, UNIQUE(fingerprint, snapshot_id)
+);
+CREATE TABLE IF NOT EXISTS acknowledgements (
+  id TEXT PRIMARY KEY, finding_id TEXT NOT NULL REFERENCES findings(id), reason TEXT NOT NULL,
+  comment TEXT, actor TEXT NOT NULL, snapshot_id TEXT NOT NULL, created_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS eval_cases (
+  id TEXT NOT NULL, version INTEGER NOT NULL, state TEXT NOT NULL, fingerprint TEXT,
+  payload_json TEXT NOT NULL, indexed_at TEXT NOT NULL, PRIMARY KEY(id, version)
+);
+CREATE TABLE IF NOT EXISTS decision_versions (
+  id TEXT NOT NULL, version INTEGER NOT NULL, state TEXT NOT NULL, payload_json TEXT NOT NULL,
+  indexed_at TEXT NOT NULL, PRIMARY KEY(id, version)
+);
+CREATE TABLE IF NOT EXISTS evidence_items (
+  id TEXT PRIMARY KEY, content_hash TEXT NOT NULL, kind TEXT NOT NULL, state TEXT NOT NULL,
+  payload_json TEXT NOT NULL, collected_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_findings_fingerprint ON findings(fingerprint);
+CREATE INDEX IF NOT EXISTS idx_runs_started ON agent_runs(started_at DESC);
+CREATE INDEX IF NOT EXISTS idx_verifications_created ON verification_runs(created_at DESC);
+`;
+var MIGRATION_2 = `
+CREATE TABLE IF NOT EXISTS signals (
+  id TEXT PRIMARY KEY, source TEXT NOT NULL, body TEXT NOT NULL, content_hash TEXT NOT NULL,
+  metadata_json TEXT NOT NULL DEFAULT '{}', created_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS plans (
+  id TEXT NOT NULL, version INTEGER NOT NULL, state TEXT NOT NULL, body TEXT NOT NULL,
+  content_hash TEXT NOT NULL, created_at TEXT NOT NULL, PRIMARY KEY(id, version)
+);
+CREATE TABLE IF NOT EXISTS decisions (
+  id TEXT PRIMARY KEY, current_version INTEGER NOT NULL, state TEXT NOT NULL, title TEXT NOT NULL, owner TEXT
+);
+CREATE TABLE IF NOT EXISTS decision_links (
+  decision_id TEXT NOT NULL, ref_type TEXT NOT NULL, ref_id TEXT NOT NULL,
+  PRIMARY KEY(decision_id, ref_type, ref_id)
+);
+CREATE TABLE IF NOT EXISTS changed_files (
+  snapshot_id TEXT NOT NULL, path TEXT NOT NULL, status TEXT NOT NULL, old_path TEXT, binary INTEGER NOT NULL,
+  PRIMARY KEY(snapshot_id, path)
+);
+CREATE TABLE IF NOT EXISTS changed_symbols (
+  snapshot_id TEXT NOT NULL, symbol TEXT NOT NULL, path TEXT NOT NULL, language TEXT,
+  PRIMARY KEY(snapshot_id, symbol, path)
+);
+CREATE TABLE IF NOT EXISTS impact_indexes (
+  id TEXT PRIMARY KEY, provider TEXT NOT NULL, version TEXT NOT NULL, snapshot_id TEXT NOT NULL,
+  payload_json TEXT NOT NULL, created_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS impact_edges (
+  impact_index_id TEXT NOT NULL, from_ref TEXT NOT NULL, to_ref TEXT NOT NULL, kind TEXT NOT NULL,
+  confidence TEXT NOT NULL, provenance TEXT NOT NULL,
+  PRIMARY KEY(impact_index_id, from_ref, to_ref, kind)
+);
+CREATE TABLE IF NOT EXISTS eval_versions (
+  id TEXT NOT NULL, version INTEGER NOT NULL, state TEXT NOT NULL, payload_json TEXT NOT NULL,
+  indexed_at TEXT NOT NULL, PRIMARY KEY(id, version)
+);
+CREATE TABLE IF NOT EXISTS eval_links (
+  eval_id TEXT NOT NULL, ref_type TEXT NOT NULL, ref_id TEXT NOT NULL,
+  PRIMARY KEY(eval_id, ref_type, ref_id)
+);
+CREATE TABLE IF NOT EXISTS verification_checks (
+  verification_id TEXT NOT NULL, check_id TEXT NOT NULL, state TEXT NOT NULL, enforcement TEXT NOT NULL,
+  fingerprint TEXT NOT NULL, payload_json TEXT NOT NULL, PRIMARY KEY(verification_id, check_id)
+);
+CREATE TABLE IF NOT EXISTS evaluator_calibration (
+  evaluator TEXT NOT NULL, version TEXT NOT NULL, sample_id TEXT NOT NULL, judge_result TEXT NOT NULL,
+  human_result TEXT NOT NULL, agreed INTEGER NOT NULL, created_at TEXT NOT NULL,
+  PRIMARY KEY(evaluator, version, sample_id)
+);
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_memory USING fts5(kind, ref_id UNINDEXED, title, body, tokenize='unicode61');
+`;
+var BrainStore = class {
+  db;
+  filename;
+  constructor(repoRoot, filename = path7.join(repoRoot, ".scriptonia", "brain.db")) {
+    fs6.mkdirSync(path7.dirname(filename), { recursive: true });
+    this.filename = filename;
+    this.db = new Database(filename);
+    this.db.pragma("journal_mode = WAL");
+    this.db.pragma("foreign_keys = ON");
+    this.db.pragma("busy_timeout = 5000");
+    this.db.pragma("synchronous = NORMAL");
+    this.migrate();
+  }
+  migrate() {
+    const current = Number(this.db.pragma("user_version", { simple: true }));
+    if (current < 1) this.db.transaction(() => {
+      this.db.exec(MIGRATION_1);
+      this.db.prepare("INSERT OR IGNORE INTO schema_migrations(version, applied_at) VALUES (?, ?)").run(1, nowIso());
+      this.db.pragma("user_version = 1");
+    })();
+    if (current < 2) this.db.transaction(() => {
+      this.db.exec(MIGRATION_2);
+      this.db.prepare("INSERT OR IGNORE INTO schema_migrations(version, applied_at) VALUES (?, ?)").run(2, nowIso());
+      this.db.pragma("user_version = 2");
+    })();
+  }
+  close() {
+    this.db.close();
+  }
+  createRun(run) {
+    this.db.prepare(`INSERT INTO agent_runs(id,adapter,command_json,started_at,base_sha,status) VALUES (?,?,?,?,?,?)`).run(run.id, run.adapter, canonicalize(run.command), run.startedAt, run.baseSha ?? null, "running");
+  }
+  appendEvent(event) {
+    this.db.prepare(`INSERT INTO run_events(event_id,run_id,sequence,occurred_at,type,payload_json,redacted) VALUES (?,?,?,?,?,?,?)`).run(event.eventId, event.runId, event.sequence, event.occurredAt, event.type, canonicalize(event.payload), event.redacted ? 1 : 0);
+  }
+  finishRun(run) {
+    this.db.prepare(`UPDATE agent_runs SET finished_at=?, head_sha=?, diff_hash=?, exit_code=?, status=? WHERE id=?`).run(run.finishedAt, run.headSha ?? null, run.diffHash ?? null, run.exitCode, run.status, run.id);
+  }
+  listRuns(limit = 20) {
+    return this.db.prepare(`SELECT id,adapter,command_json AS command,started_at,finished_at,base_sha,head_sha,diff_hash,exit_code,status FROM agent_runs ORDER BY started_at DESC LIMIT ?`).all(limit).map((row) => ({ ...row, command: JSON.parse(String(row.command)) }));
+  }
+  getRun(id) {
+    const run = this.db.prepare(`SELECT * FROM agent_runs WHERE id=?`).get(id);
+    if (!run) return void 0;
+    const events = this.db.prepare(`SELECT event_id,sequence,occurred_at,type,payload_json,redacted FROM run_events WHERE run_id=? ORDER BY sequence`).all(id).map((row) => {
+      const { payload_json, ...rest2 } = row;
+      return { ...rest2, payload: JSON.parse(String(payload_json)) };
+    });
+    const { command_json, ...rest } = run;
+    return { ...rest, command: JSON.parse(String(command_json)), events };
+  }
+  getCached(snapshotId) {
+    const row = this.db.prepare(`SELECT result_json FROM verdict_cache WHERE snapshot_id=?`).get(snapshotId);
+    return row ? JSON.parse(row.result_json) : void 0;
+  }
+  indexDecision(decision) {
+    const json = canonicalize(decision);
+    this.db.transaction(() => {
+      this.db.prepare(`INSERT INTO decisions(id,current_version,state,title,owner) VALUES (?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET current_version=excluded.current_version,state=excluded.state,title=excluded.title,owner=excluded.owner`).run(decision.id, decision.version, decision.state, decision.title, decision.owner ?? null);
+      this.db.prepare(`INSERT INTO decision_versions(id,version,state,payload_json,indexed_at) VALUES (?,?,?,?,?) ON CONFLICT(id,version) DO UPDATE SET state=excluded.state,payload_json=excluded.payload_json,indexed_at=excluded.indexed_at`).run(decision.id, decision.version, decision.state, json, nowIso());
+      this.db.prepare(`DELETE FROM fts_memory WHERE kind='decision' AND ref_id=?`).run(decision.id);
+      this.db.prepare(`INSERT INTO fts_memory(kind,ref_id,title,body) VALUES ('decision',?,?,?)`).run(decision.id, decision.title, json);
+      for (const ref of decision.source_refs ?? []) this.db.prepare(`INSERT OR IGNORE INTO decision_links(decision_id,ref_type,ref_id) VALUES (?,?,?)`).run(decision.id, ref.split("_")[0] || "ref", ref);
+    })();
+  }
+  indexEval(evaluation) {
+    const json = canonicalize(evaluation);
+    this.db.transaction(() => {
+      this.db.prepare(`INSERT INTO eval_cases(id,version,state,fingerprint,payload_json,indexed_at) VALUES (?,?,?,?,?,?) ON CONFLICT(id,version) DO UPDATE SET state=excluded.state,fingerprint=excluded.fingerprint,payload_json=excluded.payload_json,indexed_at=excluded.indexed_at`).run(evaluation.id, evaluation.version, evaluation.state, String(evaluation.fingerprint ?? ""), json, nowIso());
+      this.db.prepare(`INSERT INTO eval_versions(id,version,state,payload_json,indexed_at) VALUES (?,?,?,?,?) ON CONFLICT(id,version) DO UPDATE SET state=excluded.state,payload_json=excluded.payload_json,indexed_at=excluded.indexed_at`).run(evaluation.id, evaluation.version, evaluation.state, json, nowIso());
+      this.db.prepare(`DELETE FROM fts_memory WHERE kind='eval' AND ref_id=?`).run(evaluation.id);
+      this.db.prepare(`INSERT INTO fts_memory(kind,ref_id,title,body) VALUES ('eval',?,?,?)`).run(evaluation.id, evaluation.title, json);
+      for (const ref of evaluation.decision_refs ?? []) this.db.prepare(`INSERT OR IGNORE INTO eval_links(eval_id,ref_type,ref_id) VALUES (?,?,?)`).run(evaluation.id, "decision", ref);
+      for (const ref of evaluation.signal_refs ?? []) this.db.prepare(`INSERT OR IGNORE INTO eval_links(eval_id,ref_type,ref_id) VALUES (?,?,?)`).run(evaluation.id, "signal", ref);
+    })();
+  }
+  saveSnapshot(snapshot) {
+    this.db.transaction(() => {
+      this.db.prepare(`INSERT OR IGNORE INTO git_snapshots(id,base_sha,head_sha,diff_hash,payload_json,created_at) VALUES (?,?,?,?,?,?)`).run(snapshot.id, snapshot.baseSha, snapshot.headSha, snapshot.diffHash, canonicalize(snapshot.payload), nowIso());
+      const statement = this.db.prepare(`INSERT OR REPLACE INTO changed_files(snapshot_id,path,status,old_path,binary) VALUES (?,?,?,?,?)`);
+      for (const file of snapshot.files) statement.run(snapshot.id, file.path, file.status, file.oldPath ?? null, file.binary ? 1 : 0);
+    })();
+  }
+  saveImpact(input) {
+    this.db.transaction(() => {
+      this.db.prepare(`INSERT OR IGNORE INTO impact_indexes(id,provider,version,snapshot_id,payload_json,created_at) VALUES (?,?,?,?,?,?)`).run(input.id, input.provider, input.version, input.snapshotId, canonicalize(input), nowIso());
+      const statement = this.db.prepare(`INSERT OR IGNORE INTO impact_edges(impact_index_id,from_ref,to_ref,kind,confidence,provenance) VALUES (?,?,?,?,?,?)`);
+      for (const edge of input.edges) statement.run(input.id, edge.from, edge.to, edge.kind, edge.confidence, edge.provenance);
+    })();
+  }
+  saveEvidence(items) {
+    const statement = this.db.prepare(`INSERT OR REPLACE INTO evidence_items(id,content_hash,kind,state,payload_json,collected_at) VALUES (?,?,?,?,?,?)`);
+    this.db.transaction(() => {
+      for (const evidence of items) statement.run(evidence.id, evidence.contentHash, evidence.kind, evidence.state, canonicalize(evidence.payload), evidence.collectedAt);
+    })();
+  }
+  saveChecks(verificationId, checks) {
+    const statement = this.db.prepare(`INSERT OR REPLACE INTO verification_checks(verification_id,check_id,state,enforcement,fingerprint,payload_json) VALUES (?,?,?,?,?,?)`);
+    this.db.transaction(() => {
+      for (const check of checks) statement.run(verificationId, check.id, check.state, check.enforcement, check.fingerprint, canonicalize(check));
+    })();
+  }
+  saveVerification(input) {
+    const json = canonicalize(input.result);
+    this.db.transaction(() => {
+      this.db.prepare(`INSERT INTO verification_runs(id,snapshot_id,gate_state,result_json,created_at) VALUES (?,?,?,?,?)`).run(input.id, input.snapshotId, input.gateState, json, nowIso());
+      this.db.prepare(`INSERT INTO verdict_cache(snapshot_id,verification_id,result_json,created_at) VALUES (?,?,?,?) ON CONFLICT(snapshot_id) DO UPDATE SET verification_id=excluded.verification_id,result_json=excluded.result_json,created_at=excluded.created_at`).run(input.snapshotId, input.id, json, nowIso());
+    })();
+  }
+  saveFinding(finding) {
+    const now = nowIso();
+    const existing = this.db.prepare(`SELECT id FROM findings WHERE fingerprint=? ORDER BY first_seen LIMIT 1`).get(finding.fingerprint);
+    if (existing) {
+      this.db.prepare(`UPDATE findings SET snapshot_id=?,state=?,enforcement=?,owner=?,payload_json=?,last_seen=? WHERE id=?`).run(finding.snapshotId, finding.state, finding.enforcement, finding.owner ?? null, canonicalize(finding.payload), now, existing.id);
+      return;
+    }
+    this.db.prepare(`INSERT INTO findings(id,snapshot_id,fingerprint,evaluator,state,enforcement,owner,payload_json,first_seen,last_seen) VALUES (?,?,?,?,?,?,?,?,?,?)`).run(finding.id, finding.snapshotId, finding.fingerprint, finding.evaluator, finding.state, finding.enforcement, finding.owner ?? null, canonicalize(finding.payload), now, now);
+  }
+  findFindingId(fingerprint) {
+    return this.db.prepare(`SELECT id FROM findings WHERE fingerprint=? ORDER BY first_seen LIMIT 1`).get(fingerprint)?.id;
+  }
+  getFinding(id) {
+    const row = this.db.prepare(`SELECT * FROM findings WHERE id=?`).get(id);
+    return row ? { ...row, payload: JSON.parse(String(row.payload_json)) } : void 0;
+  }
+  acknowledge(input) {
+    this.db.prepare(`INSERT INTO acknowledgements(id,finding_id,reason,comment,actor,snapshot_id,created_at) VALUES (?,?,?,?,?,?,?)`).run(input.id, input.findingId, input.reason, input.comment ?? null, input.actor, input.snapshotId, nowIso());
+  }
+};
+
+// ../packages/eval-engine/src/index.ts
+var DEFAULT_CONFIG = configSchema.parse({});
+function loadConfig(root) {
+  const filename = path8.join(root, ".scriptonia", "config.yaml");
+  if (!fs7.existsSync(filename)) return { config: DEFAULT_CONFIG, errors: [] };
+  try {
+    return { config: configSchema.parse(YAML2.parse(fs7.readFileSync(filename, "utf8"))), errors: [] };
+  } catch (error) {
+    return { config: DEFAULT_CONFIG, errors: [`config.yaml: ${error instanceof Error ? error.message : String(error)}`] };
+  }
+}
+function parseConfigDocument(text, name = "config.yaml") {
+  if (text === void 0) return { config: DEFAULT_CONFIG, errors: [] };
+  try {
+    return { config: configSchema.parse(YAML2.parse(text)), errors: [] };
+  } catch (error) {
+    return { config: DEFAULT_CONFIG, errors: [`${name}: ${error instanceof Error ? error.message : String(error)}`] };
+  }
+}
+function ensureConfig(root) {
+  const directory = path8.join(root, ".scriptonia");
+  const filename = path8.join(directory, "config.yaml");
+  fs7.mkdirSync(path8.join(directory, "decisions"), { recursive: true });
+  fs7.mkdirSync(path8.join(directory, "evals"), { recursive: true });
+  if (!fs7.existsSync(filename)) fs7.writeFileSync(filename, YAML2.stringify(DEFAULT_CONFIG));
+  return filename;
+}
+function loadEvals(root) {
+  const directory = path8.join(root, ".scriptonia", "evals");
+  if (!fs7.existsSync(directory)) return { evals: [], errors: [] };
+  const evals = [];
+  const errors = [];
+  for (const filename of fs7.readdirSync(directory).filter((file) => /\.ya?ml$/i.test(file)).sort()) {
+    try {
+      evals.push(evalCaseSchema.parse(YAML2.parse(fs7.readFileSync(path8.join(directory, filename), "utf8"))));
+    } catch (error) {
+      errors.push(`${filename}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { evals, errors };
+}
+function parseEvalDocuments(documents) {
+  const evals = [];
+  const errors = [];
+  for (const document of documents) {
+    try {
+      evals.push(evalCaseSchema.parse(YAML2.parse(document.text)));
+    } catch (error) {
+      errors.push(`${document.name}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { evals, errors };
+}
+async function verifyRepository(options) {
+  if (!options.trustedBase) ensureConfig(options.root);
+  const trustedRef = options.trustedBase ? options.base : void 0;
+  const loadedConfig = trustedRef ? parseConfigDocument(readFileAtRef(options.root, trustedRef, ".scriptonia/config.yaml"), `${trustedRef}:.scriptonia/config.yaml`) : loadConfig(options.root);
+  const config = loadedConfig.config;
+  const snapshot = await withSpan("snapshot.build", { base_configured: Boolean(options.base ?? config.base_ref) }, () => buildSnapshot({ cwd: options.root, base: options.base ?? config.base_ref }));
+  const planPath = path8.resolve(options.root, options.plan ?? "PLAN.md");
+  const plan = fs7.existsSync(planPath) ? fs7.readFileSync(planPath, "utf8") : void 0;
+  const loadedDecisions = trustedRef ? parseDecisionDocuments(listFilesAtRef(options.root, trustedRef, [".scriptonia/decisions"]).filter((name) => /\.ya?ml$/i.test(name)).map((name) => ({ name: `${trustedRef}:${name}`, text: readFileAtRef(options.root, trustedRef, name) ?? "" }))) : loadDecisions(options.root);
+  const loadedEvals = trustedRef ? parseEvalDocuments(listFilesAtRef(options.root, trustedRef, [".scriptonia/evals"]).filter((name) => /\.ya?ml$/i.test(name)).map((name) => ({ name: `${trustedRef}:${name}`, text: readFileAtRef(options.root, trustedRef, name) ?? "" }))) : loadEvals(options.root);
+  const evals = options.evalFilter ? loadedEvals.evals.filter((entry) => entry.id === options.evalFilter || entry.title.toLowerCase().includes(options.evalFilter.toLowerCase())) : loadedEvals.evals;
+  const collected = await withSpan("evidence.collect", { changed_file_count: snapshot.files.length }, () => {
+    const github2 = collectGitHubNeeds(options.githubNeeds ?? process.env[config.evidence.github_needs_env]);
+    const junit = collectJUnit(options.root, config.evidence.junit);
+    const repositoryFacts = collectRepositoryFacts(options.root, snapshot.files.map((file) => file.path));
+    return { github: github2, evidence: [...github2, ...junit, ...repositoryFacts] };
+  });
+  const { github, evidence } = collected;
+  const passedChecks = github.filter((item2) => item2.state === "available").map((item2) => String(item2.payload.name));
+  const impactIndex = await withSpan("impact.index", { changed_file_count: snapshot.files.length }, () => loadCodeGraphIndex(options.root) ?? buildFallbackImpactIndex(options.root));
+  const impact = impactedFiles(impactIndex, snapshot.files.map((file) => file.path));
+  const scope = await withSpan("scope.resolve", { impacted_file_count: impact.files.length }, () => buildScopeContext(options.root, impact.files, { checks: passedChecks }));
+  const policy = await withSpan("policy.evaluate", { decision_count: loadedDecisions.decisions.length }, () => evaluateDecisions(loadedDecisions.decisions, scope));
+  const identity = {
+    schemaVersion: "1",
+    baseSha: snapshot.baseSha,
+    headSha: snapshot.headSha,
+    diffHash: snapshot.diffHash,
+    config,
+    plan: plan ? hashObject(plan) : null,
+    decisions: loadedDecisions.decisions.map((entry) => ({ id: entry.id, version: entry.version, hash: hashObject(entry) })),
+    evals: evals.map((entry) => ({ id: entry.id, version: entry.version, hash: hashObject(entry) })),
+    evidence: evidence.map((entry) => ({ hash: entry.contentHash, state: entry.state })),
+    impact: { provider: impactIndex.provider, version: impactIndex.version, id: impactIndex.id, edges: impact.edges },
+    evaluators: { policy: "1", eval: "1", plan: "1", gate: "1" },
+    semantic: config.semantic.enabled || options.semantic ? {
+      model: config.semantic.model ?? process.env.OPENAI_OUTPUT_MODEL ?? process.env.LITELLM_MODEL ?? "gpt-5.6-terra",
+      endpoint: config.semantic.endpoint ?? process.env.SCRIPTONIA_MODEL_GATEWAY_URL ?? process.env.LITELLM_BASE_URL ?? "unconfigured"
+    } : null,
+    trustedConfigurationRef: trustedRef ?? "working-tree"
+  };
+  const snapshotId = hashObject(identity);
+  const store = new BrainStore(options.root);
+  try {
+    for (const decision of loadedDecisions.decisions) store.indexDecision({ ...decision });
+    for (const evaluation of loadedEvals.evals) store.indexEval({ ...evaluation });
+    store.saveSnapshot({ id: snapshotId, baseSha: snapshot.baseSha, headSha: snapshot.headSha, diffHash: snapshot.diffHash, payload: identity, files: snapshot.files });
+    store.saveImpact({ id: impactIndex.id, provider: impactIndex.provider, version: impactIndex.version, snapshotId, edges: impact.edges });
+    store.saveEvidence(evidence.map((entry) => ({ id: entry.id, contentHash: entry.contentHash, kind: entry.kind, state: entry.state, payload: entry.payload, collectedAt: entry.collectedAt })));
+    if (!options.refresh) {
+      const cached = await withSpan("cache.lookup", { refresh: false }, () => store.getCached(snapshotId));
+      if (cached) return { ...cached, cached: true };
+    }
+    const checks = [];
+    for (const error of [...loadedConfig.errors, ...loadedDecisions.errors, ...loadedEvals.errors]) checks.push(makeCheck({ evaluator: "definition-loader", title: "Definition validation", state: "ERROR", enforcement: "block", reason: error, refs: [] }));
+    checks.push(...policy.map(policyToCheck));
+    checks.push(...evaluateEvals(evals, scope, evidence, policy));
+    checks.push(...evaluatePlan(plan, config.required_plan, evidence));
+    checks.push(testCoverageCheck(snapshot, relatedTests(impactIndex, snapshot.files.map((file) => file.path))));
+    checks.push(...github.map(githubCheck));
+    let semanticCoverage = config.semantic.enabled || options.semantic ? "unavailable" : "disabled";
+    if ((config.semantic.enabled || options.semantic) && plan) {
+      const semanticChecks = await evaluateSemanticCriteria(plan, snapshot, config);
+      if (semanticChecks.some((check) => !check.reason.includes("unavailable"))) semanticCoverage = "available";
+      checks.push(...semanticChecks);
+    }
+    const gate = await withSpan("verdict.aggregate", { check_count: checks.length }, () => aggregateGate(checks, config.incomplete_blocks));
+    for (const check of checks) {
+      if (check.state === "FAIL" || check.state === "ERROR" || check.state === "INCONCLUSIVE" && check.enforcement === "block") {
+        check.findingId = store.findFindingId(check.fingerprint) ?? `finding_${hashObject({ snapshotId, fingerprint: check.fingerprint }).slice(0, 24)}`;
+      }
+    }
+    const verificationId = createId("verification");
+    const decisionEvaluated = policy.filter((entry) => entry.state !== "SKIPPED").length;
+    const evalEvaluated = checks.filter((entry) => entry.evaluator === "eval-evidence" && entry.state !== "SKIPPED").length;
+    const result = {
+      schemaVersion: "1",
+      verificationId,
+      snapshotId,
+      createdAt: nowIso(),
+      cached: false,
+      gate,
+      exitCode: exitCodeForGate(gate),
+      coverage: { plan: plan ? "present" : "absent", decisions: { total: policy.length, evaluated: decisionEvaluated, skipped: policy.length - decisionEvaluated }, evals: { total: evals.length, evaluated: evalEvaluated, skipped: evals.length - evalEvaluated }, semantic: semanticCoverage },
+      snapshot: { schemaVersion: snapshot.schemaVersion, baseRef: snapshot.baseRef, baseSha: snapshot.baseSha, headSha: snapshot.headSha, dirty: snapshot.dirty, diffHash: snapshot.diffHash, files: snapshot.files, snapshotId: snapshot.snapshotId, repositoryRoot: "." },
+      checks,
+      evidence: evidence.map(({ id, kind, source, state, contentHash }) => ({ id, kind, source, state, contentHash })),
+      configurationHash: hashObject(config)
+    };
+    store.saveVerification({ id: verificationId, snapshotId, gateState: gate, result, refresh: options.refresh });
+    store.saveChecks(verificationId, checks);
+    for (const check of checks.filter((entry) => entry.findingId)) {
+      store.saveFinding({ id: check.findingId, snapshotId, fingerprint: check.fingerprint, evaluator: check.evaluator, state: check.state, enforcement: check.enforcement, owner: check.owner, payload: check });
+    }
+    return result;
+  } finally {
+    store.close();
+  }
+}
+function policyToCheck(result) {
+  return { id: result.id, evaluator: result.evaluator, evaluatorVersion: result.evaluatorVersion, title: result.title, state: result.state, enforcement: result.enforcement, reason: result.reason, evidence: result.evidence.map((entry) => ({ kind: entry.kind, value: entry.value })), refs: [result.decisionRef], ...result.owner ? { owner: result.owner } : {}, fingerprint: result.fingerprint };
+}
+function evaluateEvals(evals, scope, evidence, policies) {
+  return evals.map((evaluation) => {
+    if (evaluation.state !== "active") return makeCheck({ id: `eval:${evaluation.id}@${evaluation.version}`, evaluator: "eval-evidence", title: evaluation.title, state: "SKIPPED", enforcement: evaluation.enforcement, reason: `Eval is ${evaluation.state}; only active evals enforce.`, refs: [evaluation.id], owner: evaluation.owner });
+    const match = matchScope(evaluation.scope, scope);
+    if (!match.matched) return makeCheck({ id: `eval:${evaluation.id}@${evaluation.version}`, evaluator: "eval-evidence", title: evaluation.title, state: "SKIPPED", enforcement: evaluation.enforcement, reason: "Eval scope does not intersect this change.", refs: [evaluation.id], owner: evaluation.owner ?? match.owner });
+    const withPolicies = [...evidence, ...policies.map((policy) => ({ id: policy.id, kind: "decision_predicate", collector: "policy-engine", collectorVersion: "1", source: policy.decisionRef, state: policy.state === "PASS" ? "available" : policy.state === "FAIL" ? "failed" : "missing", contentHash: policy.fingerprint, payload: { name: policy.decisionRef, result: policy.state }, collectedAt: nowIso(), redaction: { applied: false, policyVersion: "1" } }))];
+    const all = evaluation.evidence.all.map((requirement) => evaluateRequirement(requirement, withPolicies));
+    const any = evaluation.evidence.any.map((requirement) => evaluateRequirement(requirement, withPolicies));
+    let state = "PASS";
+    if (all.some((entry) => entry.state === "ERROR") || any.some((entry) => entry.state === "ERROR")) state = "ERROR";
+    else if (all.some((entry) => entry.state === "FAIL") || any.length > 0 && any.every((entry) => entry.state === "FAIL")) state = "FAIL";
+    else if (all.some((entry) => entry.state === "INCONCLUSIVE") || any.length > 0 && !any.some((entry) => entry.state === "PASS")) state = "INCONCLUSIVE";
+    else if (!all.length && !any.length) state = "INCONCLUSIVE";
+    const used = [...all, ...any].flatMap((entry) => entry.evidence);
+    return makeCheck({ id: `eval:${evaluation.id}@${evaluation.version}`, evaluator: "eval-evidence", title: evaluation.title, state, enforcement: evaluation.enforcement, reason: state === "PASS" ? "All declared eval evidence passed." : state === "FAIL" ? "Declared eval evidence failed." : state === "ERROR" ? "An evidence collector failed." : "Declared eval evidence is unavailable or incomplete.", evidence: used.map((entry) => ({ id: entry.id, kind: entry.kind, value: entry.source })), refs: [evaluation.id, ...evaluation.decision_refs, ...evaluation.signal_refs], owner: evaluation.owner ?? match.owner });
+  });
+}
+function evaluatePlan(plan, required, evidence) {
+  if (!plan) return [makeCheck({ evaluator: "plan-coverage", title: "Approved plan", state: required ? "INCONCLUSIVE" : "SKIPPED", enforcement: required ? "block" : "observe", reason: required ? "PLAN.md is required but unavailable." : "No PLAN.md is present; policy-only mode is active.", refs: [] })];
+  const checks = [];
+  const unresolved = plan.split("\n").filter((line) => /(?:⚠\s*)?UNRESOLVED/i.test(line));
+  checks.push(makeCheck({ evaluator: "plan-unresolved", title: "Unresolved constraints", state: unresolved.length ? "FAIL" : "PASS", enforcement: "block", reason: unresolved.length ? "PLAN.md contains unresolved approval gates." : "No unresolved approval gate remains.", evidence: unresolved.map((value) => ({ kind: "plan_line", value: value.trim() })), refs: ["PLAN.md"] }));
+  for (const criterion of parseSectionItems(plan, "acceptance criteria")) {
+    const requirements = parseInlineEvidence(criterion);
+    checks.push(planEvidenceCheck("plan-criterion", criterion, requirements, evidence));
+  }
+  for (const nonGoal of parseSectionItems(plan, "non-goals")) {
+    const requirements = parseInlineEvidence(nonGoal);
+    checks.push(planEvidenceCheck("plan-non-goal", nonGoal, requirements, evidence));
+  }
+  return checks;
+}
+function planEvidenceCheck(evaluator, text, requirements, evidence) {
+  const title = text.replace(/\s*\[evidence:[^\]]+\]/g, "");
+  if (!requirements.length) return makeCheck({ evaluator, title, state: "INCONCLUSIVE", enforcement: "warn", reason: evaluator === "plan-criterion" ? "Acceptance criterion has no declared evidence mapping." : "Non-goal has no deterministic evidence mapping.", refs: ["PLAN.md"] });
+  const results = requirements.map((requirement) => evaluateRequirement(requirement, evidence));
+  const state = results.some((entry) => entry.state === "ERROR") ? "ERROR" : results.some((entry) => entry.state === "FAIL") ? "FAIL" : results.some((entry) => entry.state === "INCONCLUSIVE") ? "INCONCLUSIVE" : "PASS";
+  return makeCheck({ evaluator, title, state, enforcement: "warn", reason: state === "PASS" ? "All declared plan evidence passed." : state === "FAIL" ? "Declared plan evidence failed." : state === "ERROR" ? "A declared plan evidence collector failed." : "Declared plan evidence is unavailable or incomplete.", evidence: results.flatMap((entry) => entry.evidence).map((entry) => ({ id: entry.id, kind: entry.kind, value: entry.source })), refs: ["PLAN.md"] });
+}
+function parseSectionItems(markdown, title) {
+  const lines = markdown.split("\n");
+  const start = lines.findIndex((line) => new RegExp(`^#{1,6}\\s+${escapeRegex(title)}\\s*$`, "i").test(line.trim()));
+  if (start < 0) return [];
+  const items = [];
+  for (const line of lines.slice(start + 1)) {
+    if (/^#{1,6}\s+/.test(line.trim())) break;
+    const match = line.match(/^\s*(?:[-*]|\d+[.)])\s+(?:\[[ xX]\]\s*)?(.+)/);
+    if (match?.[1]) items.push(match[1].trim());
+  }
+  return items;
+}
+function parseInlineEvidence(text) {
+  return [...text.matchAll(/\[evidence:([a-z_]+)(?::([^:\]]+))?(?::([^\]]+))?\]/gi)].flatMap((match) => {
+    const kind = match[1];
+    const first = match[2];
+    const second = match[3];
+    const candidate = kind === "junit_test" ? { kind, suite: first, test: second } : kind === "repository_fact" ? { kind, path: first } : { kind, name: first };
+    const parsed = evidenceRequirementSchema.safeParse(candidate);
+    return parsed.success ? [parsed.data] : [];
+  });
+}
+function testCoverageCheck(snapshot, impactedTests) {
+  const source = snapshot.files.filter((file) => /\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|php|swift|kt)$/i.test(file.path) && !/(?:^|\/)(?:scripts?|migrations?|drizzle)(?:\/|$)/i.test(file.path));
+  const tests = snapshot.files.filter((file) => /(?:^|\/)(?:__tests__|tests?|spec)(?:\/|$)|\.(?:test|spec)\.[^.]+$/i.test(file.path));
+  const state = source.length && !tests.length ? impactedTests.length ? "INCONCLUSIVE" : "FAIL" : "PASS";
+  const evidence = tests.length ? tests.map((file) => ({ kind: "path", value: file.path })) : impactedTests.length ? impactedTests.map((file) => ({ kind: "related_test", value: file })) : source.map((file) => ({ kind: "path", value: file.path }));
+  return makeCheck({ evaluator: "test-coverage", title: "Changed behavior has test evidence", state, enforcement: "warn", reason: state === "FAIL" ? "Product code changed without a changed or statically related test file." : state === "INCONCLUSIVE" ? "Related tests exist, but no result artifact proves they ran." : "A changed test is present or no product code changed.", evidence, refs: [] });
+}
+function githubCheck(evidence) {
+  return makeCheck({ evaluator: "github-check", title: `CI check: ${String(evidence.payload.name)}`, state: evidence.state === "available" ? "PASS" : evidence.state === "failed" ? "FAIL" : evidence.state === "error" ? "ERROR" : "INCONCLUSIVE", enforcement: "block", reason: evidence.state === "available" ? "GitHub job succeeded." : evidence.state === "failed" ? `GitHub job concluded ${String(evidence.payload.conclusion)}.` : "GitHub job conclusion is unavailable.", evidence: [{ id: evidence.id, kind: evidence.kind, value: evidence.source }], refs: [] });
+}
+async function evaluateSemanticCriteria(plan, snapshot, config) {
+  const criteria = parseSectionItems(plan, "acceptance criteria").filter((line) => !parseInlineEvidence(line).length);
+  const results = [];
+  for (const criterion of criteria.slice(0, 20)) {
+    const judged = await withSpan("judge.evaluate", { criterion_length: criterion.length }, () => semanticJudge({ criterion, evidenceBundle: { changedFiles: snapshot.files, diff: snapshot.diff.slice(0, config.semantic.max_bytes) }, endpoint: config.semantic.endpoint, model: config.semantic.model, timeoutMs: config.semantic.timeout_ms, maxBytes: config.semantic.max_bytes }));
+    const state = !judged.available || !judged.result || judged.result.result === "uncertain" ? "INCONCLUSIVE" : judged.result.result === "supports" ? "PASS" : "FAIL";
+    results.push(makeCheck({ evaluator: "semantic-judge", title: criterion, state, enforcement: "warn", reason: judged.result?.reason ?? `Semantic evaluation unavailable: ${judged.error ?? "unknown error"}`, evidence: judged.result?.evidenceRefs.map((value) => ({ kind: "semantic_ref", value })) ?? [], refs: ["PLAN.md"] }));
+  }
+  return results;
+}
+function makeCheck(input) {
+  const identity = { evaluator: input.evaluator, version: "1", title: input.title, state: input.state, evidence: input.evidence ?? [], refs: input.refs };
+  return { id: input.id ?? createId("check"), evaluator: input.evaluator, evaluatorVersion: "1", title: input.title, state: input.state, enforcement: input.enforcement, reason: input.reason, evidence: input.evidence ?? [], refs: input.refs, ...input.owner ? { owner: input.owner } : {}, fingerprint: hashObject(identity) };
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function learnFromFinding(root, findingId) {
+  const store = new BrainStore(root);
+  try {
+    const finding = store.getFinding(findingId);
+    if (!finding) throw new Error(`finding not found: ${findingId}`);
+    const payload = finding.payload;
+    const id = `eval_${payload.fingerprint.slice(0, 16)}`;
+    const evalCase = evalCaseSchema.parse({
+      schema_version: "1",
+      id,
+      version: 1,
+      title: payload.title,
+      state: "draft",
+      owner: payload.owner,
+      origin: { kind: "confirmed_failure", finding_ref: findingId },
+      decision_refs: payload.refs.filter((ref) => ref.startsWith("decision_")),
+      signal_refs: payload.refs.filter((ref) => ref.startsWith("signal_")),
+      scope: { paths: { include: payload.evidence.filter((entry) => entry.kind === "path").map((entry) => entry.value).slice(0, 20).length ? payload.evidence.filter((entry) => entry.kind === "path").map((entry) => entry.value).slice(0, 20) : ["**"], exclude: [] } },
+      assertion: { kind: "required_evidence", description: payload.reason },
+      evidence: { all: [], any: [] },
+      enforcement: "observe",
+      fingerprint: payload.fingerprint
+    });
+    const filename = path8.join(root, ".scriptonia", "evals", `${id}.yaml`);
+    if (fs7.existsSync(filename)) throw new Error(`draft eval already exists: ${path8.relative(root, filename)}`);
+    fs7.mkdirSync(path8.dirname(filename), { recursive: true });
+    fs7.writeFileSync(filename, YAML2.stringify(evalCase));
+    return { path: filename, evalCase };
+  } finally {
+    store.close();
+  }
+}
+function acknowledgeFinding(root, findingId, reason, actor, comment) {
+  const store = new BrainStore(root);
+  try {
+    const finding = store.getFinding(findingId);
+    if (!finding) throw new Error(`finding not found: ${findingId}`);
+    const id = createId("ack");
+    store.acknowledge({ id, findingId, reason, comment, actor, snapshotId: String(finding.snapshot_id) });
+    return id;
+  } finally {
+    store.close();
+  }
+}
+function evalDoctor(root) {
+  const { evals, errors } = loadEvals(root);
+  const { decisions } = loadDecisions(root);
+  const issues = errors.map((message) => ({ kind: "invalid", id: "definition", message }));
+  const activeDecisions = new Map(decisions.filter((entry) => entry.state === "active").map((entry) => [entry.id, entry]));
+  const fingerprints = /* @__PURE__ */ new Map();
+  for (const evaluation of evals) {
+    if (!evaluation.owner) issues.push({ kind: "missing_owner", id: evaluation.id, message: "Eval has no owner." });
+    if (evaluation.review_after && Date.parse(evaluation.review_after) < Date.now() && evaluation.state === "active") issues.push({ kind: "expired_review", id: evaluation.id, message: `Review date passed: ${evaluation.review_after}` });
+    for (const ref of evaluation.decision_refs) if (!activeDecisions.has(ref) && evaluation.state === "active") issues.push({ kind: "stale_decision", id: evaluation.id, message: `Referenced decision is not active: ${ref}` });
+    const fingerprint = evaluation.fingerprint ?? hashObject({ assertion: evaluation.assertion, scope: evaluation.scope, origin: evaluation.origin, evidence: evaluation.evidence });
+    const duplicate = fingerprints.get(fingerprint);
+    if (duplicate) issues.push({ kind: "duplicate", id: evaluation.id, message: `Duplicates ${duplicate}.` });
+    else fingerprints.set(fingerprint, evaluation.id);
+  }
+  return { healthy: issues.length === 0, issues };
+}
+function toSarif(result) {
+  const actionable = result.checks.filter((check) => check.state === "FAIL" || check.state === "ERROR" || check.state === "INCONCLUSIVE");
+  return { version: "2.1.0", $schema: "https://json.schemastore.org/sarif-2.1.0.json", runs: [{ tool: { driver: { name: "Scriptonia", version: "0.9.0-rc.1", informationUri: "https://scriptonia.dev", rules: [...new Map(actionable.map((check) => [check.evaluator, { id: check.evaluator, name: check.evaluator, shortDescription: { text: check.title } }])).values()] } }, results: actionable.map((check) => ({ ruleId: check.evaluator, level: check.enforcement === "block" ? "error" : "warning", message: { text: `${check.title}: ${check.reason}` }, properties: { state: check.state, enforcement: check.enforcement, fingerprint: check.fingerprint, refs: check.refs } })) }] };
+}
+
+// ../packages/github/src/index.ts
+function githubStepSummary(result) {
+  const lines = [`# Scriptonia gate: ${result.gate}`, "", `Snapshot: \`${result.snapshotId}\``, "", "| State | Check | Reason |", "|---|---|---|"];
+  for (const check of result.checks) lines.push(`| ${check.state} | ${escapeCell(check.title)} | ${escapeCell(check.reason)} |`);
+  return `${lines.join("\n")}
+`;
+}
+function escapeCell(value) {
+  return value.replaceAll("|", "\\|").replaceAll("\n", " ");
+}
+
+// ../packages/run-capture/src/index.ts
+import { spawn } from "child_process";
+import fs8 from "fs";
+import path9 from "path";
+
+// ../packages/run-protocol/src/index.ts
+var BUILTIN_PATTERNS = [
+  /\b(?:sk|sk-ant|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{12,}\b/g,
+  /\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/gi,
+  /\b[A-Za-z0-9_-]*(?:TOKEN|SECRET|PASSWORD|API_KEY)\s*[=:]\s*[^\s,;]+/gi
+];
+function redact(value, options = {}) {
+  const secrets = (options.envNames ?? []).map((name) => process.env[name]).filter((entry) => Boolean(entry && entry.length >= 4));
+  const custom = (options.patterns ?? []).map((pattern) => new RegExp(pattern, "gi"));
+  let text = JSON.stringify(value);
+  const original = text;
+  for (const secret of secrets) text = text.replaceAll(secret, "[REDACTED]");
+  for (const pattern of [...BUILTIN_PATTERNS, ...custom]) text = text.replace(pattern, "[REDACTED]");
+  const maxBytes = options.maxBytes ?? 128e3;
+  if (Buffer.byteLength(text) > maxBytes) text = JSON.stringify({ truncated: true, bytes: Buffer.byteLength(text), preview: text.slice(0, maxBytes - 128) });
+  try {
+    return { value: JSON.parse(text), applied: text !== original };
+  } catch {
+    return { value: "[REDACTED:invalid-payload]", applied: true };
+  }
+}
+function createEvent(input) {
+  const sanitized = redact(input.payload, input.redaction);
+  return runEventSchema.parse({
+    schemaVersion: "1",
+    eventId: createId("event"),
+    runId: input.runId,
+    sequence: input.sequence,
+    occurredAt: nowIso(),
+    source: { adapter: input.adapter ?? "explicit-wrapper", adapterVersion: "1", ...input.agent ? { agent: input.agent } : {} },
+    type: input.type,
+    payload: sanitized.value,
+    redaction: { applied: sanitized.applied, policyVersion: "1" }
+  });
+}
+function parseJsonl(text) {
+  if (Buffer.byteLength(text) > 1e7) throw new Error("JSONL payload exceeds 10 MB limit");
+  return text.split("\n").filter(Boolean).map((line, index) => {
+    if (Buffer.byteLength(line) > 512e3) throw new Error(`JSONL line ${index + 1} exceeds 512 KB limit`);
+    return runEventSchema.parse(JSON.parse(line));
+  });
+}
+function normalizeCodexJsonl(text, importedRunId = createId("run")) {
+  if (Buffer.byteLength(text) > 1e7) throw new Error("Codex JSONL payload exceeds 10 MB limit");
+  let sequence = 0;
+  const events = [];
+  for (const [index, line] of text.split("\n").filter(Boolean).entries()) {
+    if (Buffer.byteLength(line) > 512e3) throw new Error(`Codex JSONL line ${index + 1} exceeds 512 KB limit`);
+    const raw = JSON.parse(line);
+    const type = String(raw.type ?? raw.event ?? "");
+    const payload = raw.payload ?? raw.item ?? raw;
+    let normalized = "tool.completed";
+    if (/session_meta|thread\.started|turn\.started|run\.started/.test(type)) normalized = "run.started";
+    else if (/turn\.completed|thread\.completed|run\.finished/.test(type)) normalized = "run.finished";
+    else if (/error|failed/.test(type)) normalized = "error";
+    else if (/file_change|file\.changed/.test(type) || payload.type === "file_change") normalized = "file.changed";
+    else if (/command.*requested|command_execution.*started/.test(type)) normalized = "command.requested";
+    else if (/tool.*requested|item\.started/.test(type)) normalized = "tool.requested";
+    events.push(createEvent({ runId: String(raw.runId ?? raw.thread_id ?? importedRunId), sequence: sequence++, type: normalized, payload: raw, adapter: "codex-jsonl", agent: "codex" }));
+  }
+  return events;
+}
+
+// ../packages/run-capture/src/index.ts
+async function captureCommand(input) {
+  if (!input.command.length || !input.command[0]) throw new Error("usage: scriptonia run -- <command> [args...]");
+  const store = new BrainStore(input.root);
+  const runId = createId("run");
+  const before = buildSnapshot({ cwd: input.root, base: "HEAD" });
+  const beforeHashes = snapshotFileHashes(input.root, before.files);
+  let sequence = 0;
+  const persist = (type, payload) => {
+    const event = createEvent({ runId, sequence: sequence++, type, payload, adapter: input.adapter, agent: input.agent, redaction: input.redaction });
+    store.appendEvent({ eventId: event.eventId, runId, sequence: event.sequence, occurredAt: event.occurredAt, type: event.type, payload: event.payload, redacted: event.redaction.applied });
+  };
+  store.createRun({ id: runId, adapter: input.adapter ?? "explicit-wrapper", command: input.command, startedAt: nowIso(), baseSha: before.headSha });
+  persist("run.started", { baseSha: before.headSha, dirty: before.dirty });
+  persist("command.requested", { argv: input.command, cwd: ".", inheritedAuthority: true });
+  let exitCode = 1;
+  try {
+    exitCode = await new Promise((resolve, reject) => {
+      const child = spawn(input.command[0], input.command.slice(1), { cwd: input.root, stdio: "inherit", shell: false, env: process.env });
+      child.once("error", reject);
+      child.once("exit", (code, signal) => resolve(code ?? (signal ? 128 : 1)));
+    });
+    const after = buildSnapshot({ cwd: input.root, base: before.headSha });
+    const afterHashes = snapshotFileHashes(input.root, after.files);
+    const changedByCommand = after.files.filter((file) => beforeHashes.get(file.path) !== afterHashes.get(file.path));
+    for (const file of changedByCommand) persist("file.changed", { path: file.path, status: file.status, binary: file.binary });
+    persist("run.finished", { exitCode, headSha: after.headSha, diffHash: after.diffHash, changedFiles: changedByCommand.length });
+    store.finishRun({ id: runId, finishedAt: nowIso(), headSha: after.headSha, diffHash: after.diffHash, exitCode, status: exitCode === 0 ? "completed" : "failed" });
+    return { runId, exitCode };
+  } catch (error) {
+    persist("error", { message: error instanceof Error ? error.message : String(error) });
+    store.finishRun({ id: runId, finishedAt: nowIso(), exitCode, status: "error" });
+    throw error;
+  } finally {
+    store.close();
+  }
+}
+function snapshotFileHashes(root, files) {
+  const hashes = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    if (file.status === "deleted") {
+      hashes.set(file.path, "deleted");
+      continue;
+    }
+    try {
+      hashes.set(file.path, sha256(fs8.readFileSync(path9.join(root, file.path))));
+    } catch {
+      hashes.set(file.path, "unreadable");
+    }
+  }
+  return hashes;
+}
+function ingestJsonl(root, text, adapter = "normalized") {
+  const events = adapter === "codex" ? normalizeCodexJsonl(text) : parseJsonl(text);
+  if (!events.length) return 0;
+  const store = new BrainStore(root);
+  try {
+    const runIds = new Set(events.map((event) => event.runId));
+    for (const runId of runIds) if (!store.getRun(runId)) store.createRun({ id: runId, adapter: events.find((event) => event.runId === runId)?.source.adapter ?? adapter, command: ["imported-events"], startedAt: events.find((event) => event.runId === runId)?.occurredAt ?? nowIso() });
+    for (const event of events) store.appendEvent({ eventId: event.eventId, runId: event.runId, sequence: event.sequence, occurredAt: event.occurredAt, type: event.type, payload: event.payload, redacted: event.redaction.applied });
+    for (const runId of runIds) store.finishRun({ id: runId, finishedAt: nowIso(), exitCode: 0, status: "imported" });
+    return events.length;
+  } finally {
+    store.close();
+  }
+}
+
+// src/index.ts
+var V2_COMMANDS = /* @__PURE__ */ new Set(["run", "runs", "verify", "gate", "learn", "eval", "acknowledge", "events", "v2-init", "report-summary", "diff-check", "why", "recall", "decide", "pulse"]);
+var requested = process.argv[2];
+if (!requested || !V2_COMMANDS.has(requested)) {
+  await import(new URL("../bin/scriptonia.mjs", import.meta.url).href);
+} else {
+  await runV2();
+}
+async function runV2() {
+  await initializeTelemetry();
+  const program = new Command();
+  program.name("scriptonia").description("Evidence-based product memory and verification for AI coding agents").version("0.9.0-rc.1");
+  program.command("v2-init").description("Create inspectable V2 configuration directories").action(() => {
+    const root = findRepositoryRoot();
+    const filename = ensureConfig(root);
+    console.log(`${pc.green("\u2713")} V2 brain configured at ${path10.relative(root, filename)}`);
+  });
+  program.command("diff-check").description("Run only sub-second deterministic changed-file policies").option("--base <ref>", "base Git reference", "HEAD").action((options) => {
+    const started2 = performance.now();
+    const root = findRepositoryRoot();
+    const snapshot = buildSnapshot({ cwd: root, base: options.base });
+    const definitions = loadDecisions(root);
+    const context = buildScopeContext(root, snapshot.files.map((file) => file.path));
+    const results = evaluateDecisions(definitions.decisions, context).filter((result) => result.state !== "SKIPPED");
+    const plan = path10.join(root, "PLAN.md");
+    const unresolved = fs9.existsSync(plan) ? fs9.readFileSync(plan, "utf8").split("\n").filter((line) => /(?:⚠\s*)?UNRESOLVED/i.test(line)) : [];
+    console.log(`
+${pc.bold("SCRIPTONIA DIFF CHECK")} \xB7 ${snapshot.files.length} changed files
+`);
+    for (const error of definitions.errors) console.log(`  ${pc.red("ERROR")} ${error}`);
+    for (const result of results) console.log(`  ${result.state === "PASS" ? pc.green(result.state) : pc.red(result.state)} ${result.title} \xB7 ${result.reason}`);
+    if (unresolved.length) console.log(`  ${pc.red("FAIL")} PLAN.md contains ${unresolved.length} unresolved constraint(s).`);
+    const blocked = unresolved.length > 0 || results.some((result) => result.state === "FAIL" && result.enforcement === "block");
+    const errored = definitions.errors.length > 0 || results.some((result) => result.state === "ERROR");
+    console.log(`
+${errored ? "ERROR" : blocked ? "BLOCKED" : "PASS"} \xB7 ${Math.round(performance.now() - started2)}ms
+`);
+    process.exitCode = errored ? 4 : blocked ? 3 : 0;
+  });
+  program.command("decide <title>").description("Create a reviewable structured product or architecture decision").requiredOption("--kind <predicate>", "deterministic predicate kind").option("--names <values>", "comma-separated dependency, symbol, or path values", "").option("--include <globs>", "comma-separated scope globs", "**").option("--exclude <globs>", "comma-separated excluded globs", "").option("--owner <owner>", "responsible owner").option("--enforcement <level>", "observe, warn, action_required, or block", "observe").option("--confirm <actor>", "activate and record the confirming human").action((title, options) => {
+    const root = findRepositoryRoot();
+    ensureConfig(root);
+    const id = `decision_${slug(title)}_${Date.now().toString(36)}`;
+    const decision = decisionSchema.parse({ schema_version: "1", id, version: 1, title, state: options.confirm ? "active" : "draft", owner: options.owner, source_refs: [], scope: { paths: { include: csv(options.include), exclude: csv(options.exclude) } }, predicate: { kind: options.kind, names: csv(options.names) }, enforcement: options.enforcement, created_at: (/* @__PURE__ */ new Date()).toISOString(), confirmed_by: options.confirm });
+    const filename = path10.join(root, ".scriptonia", "decisions", `${id}.yaml`);
+    fs9.writeFileSync(filename, YAML3.stringify(decision));
+    console.log(`${pc.green("\u2713")} ${decision.state} decision written to ${path10.relative(root, filename)}`);
+    if (decision.state === "draft") console.log("  Review its scope and predicate, then confirm it before enforcement.");
+  });
+  program.command("why <file>").description("Explain the active product memory affecting a file").action((file) => {
+    const root = findRepositoryRoot();
+    const relative = path10.relative(root, assertInside(root, path10.resolve(root, file))).replaceAll("\\", "/");
+    const context = buildScopeContext(root, [relative]);
+    const decisions = loadDecisions(root).decisions.filter((entry) => entry.state === "active" && matchScope(entry.scope, context).matched);
+    const evals = loadEvals(root).evals.filter((entry) => entry.state === "active" && matchScope(entry.scope, context).matched);
+    console.log(`
+${pc.bold("WHY")} ${relative}
+`);
+    for (const decision of decisions) console.log(`  decision  ${decision.id}@${decision.version} \xB7 ${decision.title} \xB7 ${decision.enforcement}`);
+    for (const evaluation2 of evals) console.log(`  eval      ${evaluation2.id}@${evaluation2.version} \xB7 ${evaluation2.title} \xB7 ${evaluation2.enforcement}`);
+    if (!decisions.length && !evals.length) console.log("  No active scoped decisions or evals apply.");
+    console.log("");
+  });
+  program.command("recall <query>").description("Search inspectable local decisions and evals").option("--limit <number>", "maximum matches", "10").action((query, options) => {
+    const root = findRepositoryRoot();
+    const entries = [
+      ...loadDecisions(root).decisions.map((value) => ({ kind: "decision", id: value.id, title: value.title, body: JSON.stringify(value) })),
+      ...loadEvals(root).evals.map((value) => ({ kind: "eval", id: value.id, title: value.title, body: JSON.stringify(value) }))
+    ];
+    const tokens = query.toLowerCase().split(/\W+/).filter(Boolean);
+    const matches = entries.map((entry) => ({ ...entry, score: tokens.reduce((score, token) => score + (entry.body.toLowerCase().split(token).length - 1), 0) })).filter((entry) => entry.score > 0).sort((a, b) => b.score - a.score).slice(0, Math.max(1, Number(options.limit) || 10));
+    console.log(`
+${pc.bold("RECALL")} \u201C${query}\u201D
+`);
+    for (const entry of matches) console.log(`  ${entry.kind.padEnd(9)} ${entry.id} \xB7 ${entry.title}`);
+    if (!matches.length) console.log("  No matching local memory.");
+    console.log("");
+  });
+  program.command("pulse").description("Show local brain and repository health").action(() => {
+    const root = findRepositoryRoot();
+    ensureConfig(root);
+    const snapshot = buildSnapshot({ cwd: root, base: "HEAD" });
+    const decisions = loadDecisions(root);
+    const evals = loadEvals(root);
+    const health = evalDoctor(root);
+    const store = new BrainStore(root);
+    try {
+      const runs = store.listRuns(5);
+      console.log(`
+${pc.bold("SCRIPTONIA PULSE")}
+`);
+      console.log(`  repository  ${snapshot.dirty ? pc.yellow("dirty") : pc.green("clean")} \xB7 ${snapshot.files.length} changed files`);
+      console.log(`  decisions   ${decisions.decisions.filter((entry) => entry.state === "active").length} active \xB7 ${decisions.errors.length} invalid`);
+      console.log(`  evals       ${evals.evals.filter((entry) => entry.state === "active").length} active \xB7 ${health.issues.length} health issues`);
+      console.log(`  runs        ${runs.length} recent captured`);
+      console.log(`  semantic    ${process.env.SCRIPTONIA_MODEL_GATEWAY_URL && process.env.SCRIPTONIA_API_TOKEN || process.env.LITELLM_BASE_URL && process.env.LITELLM_MASTER_KEY ? pc.green("configured") : pc.dim("disabled until credentials are added")}`);
+      console.log("");
+    } finally {
+      store.close();
+    }
+  });
+  program.command("run [argv...]").description("Capture exactly the agent command supplied after --").option("--adapter <name>", "adapter identity", "explicit-wrapper").option("--agent <name>", "agent identity").allowUnknownOption(true).action(async (argv, options) => {
+    const root = findRepositoryRoot();
+    if (argv[0] === "show") {
+      if (!argv[1]) throw new Error("usage: scriptonia run show <run-id>");
+      const store = new BrainStore(root);
+      try {
+        const run = store.getRun(argv[1]);
+        if (!run) throw new Error(`run not found: ${argv[1]}`);
+        console.log(JSON.stringify(run, null, 2));
+      } finally {
+        store.close();
+      }
+      return;
+    }
+    const separator = process.argv.indexOf("--");
+    const exact = separator >= 0 ? process.argv.slice(separator + 1) : argv;
+    const result = await captureCommand({ root, command: exact, adapter: options.adapter, agent: options.agent });
+    console.log(`
+${pc.green("\u2713")} captured ${result.runId} \xB7 child exit ${result.exitCode}`);
+    process.exitCode = result.exitCode;
+  });
+  program.command("runs").description("List recent captured agent runs").option("--json", "print JSON").option("--limit <number>", "maximum rows", "20").action((options) => {
+    const root = findRepositoryRoot();
+    const store = new BrainStore(root);
+    try {
+      const runs = store.listRuns(Math.max(1, Math.min(200, Number(options.limit) || 20)));
+      if (options.json) console.log(JSON.stringify(runs, null, 2));
+      else {
+        console.log(`
+${pc.bold("RECENT AGENT RUNS")}
+`);
+        if (!runs.length) console.log("  No captured runs yet. Use: scriptonia run -- <agent-command>");
+        for (const run of runs) console.log(`  ${String(run.status).padEnd(10)} ${run.id}  ${JSON.stringify(run.command)}  exit=${run.exit_code ?? "-"}`);
+        console.log("");
+      }
+    } finally {
+      store.close();
+    }
+  });
+  for (const name of ["verify", "gate"]) {
+    program.command(name).description(name === "gate" ? "Aggregate evidence into a CI-safe exit status" : "Produce a complete local evidence report").option("--base <ref>", "base Git reference").option("--plan <file>", "plan file", "PLAN.md").option("--refresh", "create a new verification instead of using the immutable cache").option("--semantic", "enable advisory semantic evaluation").option("--ci", "consume CI evidence from SCRIPTONIA_NEEDS_JSON").option("--json [file]", "print JSON or write it to a file").option("--sarif <file>", "write SARIF output").action(async (options) => {
+      const root = findRepositoryRoot();
+      if (options.semantic) configureGatewayFromLegacyLogin();
+      const result = await verifyRepository({ root, base: options.base, plan: options.plan, refresh: options.refresh, semantic: options.semantic, trustedBase: Boolean(options.ci) });
+      emitVerification(root, result, options);
+      if (name === "gate") process.exitCode = result.exitCode;
+    });
+  }
+  program.command("learn <finding-id>").description("Convert a confirmed finding into a reviewable draft eval").action((findingId) => {
+    const root = findRepositoryRoot();
+    const learned = learnFromFinding(root, findingId);
+    console.log(`${pc.green("\u2713")} draft eval ${learned.evalCase.id} written to ${path10.relative(root, learned.path)}`);
+    console.log("  Review its scope and evidence, add an owner, then change state to active.");
+  });
+  const evaluation = program.command("eval").description("Run and maintain versioned regression cases");
+  evaluation.command("run [id-or-scope]").option("--base <ref>", "base Git reference").option("--refresh", "bypass immutable cache").option("--json [file]", "print JSON or write it to a file").action(async (filter, options) => {
+    const root = findRepositoryRoot();
+    const result = await verifyRepository({ root, base: options.base, refresh: options.refresh, evalFilter: filter });
+    emitVerification(root, result, options);
+    process.exitCode = result.exitCode;
+  });
+  evaluation.command("doctor").action(() => {
+    const root = findRepositoryRoot();
+    const report = evalDoctor(root);
+    console.log(`
+${pc.bold("EVAL DOCTOR")} \xB7 ${report.healthy ? pc.green("HEALTHY") : pc.yellow("NEEDS ATTENTION")}
+`);
+    for (const issue of report.issues) console.log(`  ${issue.kind.padEnd(16)} ${issue.id} \xB7 ${issue.message}`);
+    if (!report.issues.length) console.log("  No duplicate, stale, ownerless, invalid, or expired evals.");
+    console.log("");
+    process.exitCode = report.healthy ? 0 : 1;
+  });
+  program.command("acknowledge <finding-id>").requiredOption("--reason <reason>", "accepted_risk, false_positive, not_applicable, or fix_later").requiredOption("--actor <identity>", "human identity").option("--comment <text>", "reason details").action((findingId, options) => {
+    const allowed = ["accepted_risk", "false_positive", "not_applicable", "fix_later"];
+    if (!allowed.includes(options.reason)) throw new Error(`invalid reason: ${options.reason}`);
+    const root = findRepositoryRoot();
+    const id = acknowledgeFinding(root, findingId, options.reason, options.actor, options.comment);
+    console.log(`${pc.green("\u2713")} acknowledgement recorded: ${id}`);
+  });
+  const events = program.command("events").description("Ingest normalized adapter events");
+  events.command("ingest <file>").option("--adapter <name>", "normalized or codex", "normalized").action((filename, options) => {
+    const root = findRepositoryRoot();
+    const full = assertInside(root, path10.resolve(root, filename));
+    if (options.adapter !== "normalized" && options.adapter !== "codex") throw new Error(`unsupported event adapter: ${options.adapter}`);
+    const count = ingestJsonl(root, fs9.readFileSync(full, "utf8"), options.adapter);
+    console.log(`${pc.green("\u2713")} ingested ${count} normalized run events`);
+  });
+  program.command("report-summary <file>").action((filename) => {
+    const root = findRepositoryRoot();
+    const full = assertInside(root, path10.resolve(root, filename));
+    const result = JSON.parse(fs9.readFileSync(full, "utf8"));
+    const markdown = githubStepSummary(result);
+    if (process.env.GITHUB_STEP_SUMMARY) fs9.appendFileSync(process.env.GITHUB_STEP_SUMMARY, markdown);
+    else console.log(markdown);
+  });
+  await program.parseAsync(process.argv);
+}
+function emitVerification(root, result, options) {
+  if (options.json === true) console.log(JSON.stringify(result, null, 2));
+  else {
+    const color = result.gate === "PASS" ? pc.green : result.gate === "PASS_WITH_WARNINGS" ? pc.yellow : pc.red;
+    console.log(`
+${pc.bold("SCRIPTONIA VERIFY")} \xB7 ${color(result.gate)}${result.cached ? pc.dim(" \xB7 cached") : ""}`);
+    console.log(pc.dim(`snapshot ${result.snapshotId}`));
+    console.log(`coverage plan=${result.coverage.plan} decisions=${result.coverage.decisions.evaluated}/${result.coverage.decisions.total} evals=${result.coverage.evals.evaluated}/${result.coverage.evals.total} semantic=${result.coverage.semantic}
+`);
+    for (const check of result.checks) {
+      const state = check.state === "PASS" ? pc.green(check.state) : check.state === "SKIPPED" ? pc.dim(check.state) : check.state === "INCONCLUSIVE" ? pc.yellow(check.state) : pc.red(check.state);
+      console.log(`  ${state.padEnd(18)} ${check.title}`);
+      if (check.state !== "PASS" && check.state !== "SKIPPED") console.log(`                     ${pc.dim(check.reason)} \xB7 ${check.findingId ?? check.id}`);
+    }
+    console.log(`
+exit ${result.exitCode}
+`);
+  }
+  if (typeof options.json === "string") writeOutput(root, options.json, `${JSON.stringify(result, null, 2)}
+`);
+  if (options.sarif) writeOutput(root, options.sarif, `${JSON.stringify(toSarif(result), null, 2)}
+`);
+}
+function writeOutput(root, filename, content) {
+  const full = assertInside(root, path10.resolve(root, filename));
+  fs9.mkdirSync(path10.dirname(full), { recursive: true });
+  fs9.writeFileSync(full, content);
+}
+function csv(value) {
+  return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function slug(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "").slice(0, 48) || "decision";
+}
+function configureGatewayFromLegacyLogin() {
+  if (process.env.SCRIPTONIA_MODEL_GATEWAY_URL && process.env.SCRIPTONIA_API_TOKEN) return;
+  try {
+    const config = JSON.parse(fs9.readFileSync(path10.join(os.homedir(), ".scriptonia", "config.json"), "utf8"));
+    if (config.url && !process.env.SCRIPTONIA_MODEL_GATEWAY_URL) process.env.SCRIPTONIA_MODEL_GATEWAY_URL = config.url;
+    if (config.token && !process.env.SCRIPTONIA_API_TOKEN) process.env.SCRIPTONIA_API_TOKEN = config.token;
+  } catch {
+  }
+}
+//# sourceMappingURL=index.js.map