scriptonia 0.8.0 → 0.9.0-rc.2

package/dist/index.js

@@ -0,0 +1,2431 @@
+#!/usr/bin/env node
+import {
+  BrainStore,
+  MAX_DEEP_COVERAGE_DIAGNOSTIC_ITEMS,
+  brainExtractResponseV1Schema,
+  buildBrain,
+  buildContextPack,
+  buildSnapshot,
+  configSchema,
+  createBrainImpactProvider,
+  createContextGraphExpansionAdapter,
+  decisionSchema,
+  evalCaseSchema,
+  evidenceRequirementSchema,
+  findRepositoryRoot,
+  initializeTelemetry,
+  listFilesAtRef,
+  loadCurrentBrainImpactProvider,
+  parseDiffHunks,
+  readFileAtRef,
+  runEventSchema,
+  withSpan
+} from "./chunk-ZLKAW77A.js";
+import {
+  aggregateGate,
+  assertInside,
+  createId,
+  exitCodeForGate,
+  hashObject,
+  normalizeRepoPath,
+  nowIso,
+  sha256,
+  walkRepo
+} from "./chunk-6TLQP3LV.js";
+
+// src/index.ts
+import fs9 from "fs";
+import os2 from "os";
+import path9 from "path";
+import { Command } from "commander";
+import pc2 from "picocolors";
+import YAML3 from "yaml";
+
+// ../packages/eval-engine/src/index.ts
+import fs5 from "fs";
+import path5 from "path";
+import YAML2 from "yaml";
+
+// ../packages/evidence/src/index.ts
+import fs from "fs";
+import path from "path";
+import fg from "fast-glob";
+import { XMLParser } from "fast-xml-parser";
+function item(kind, collector, source, state, payload) {
+  return { id: createId("evidence"), kind, collector, collectorVersion: "1", source, state, contentHash: hashObject({ kind, source, state, payload }), payload, collectedAt: nowIso(), redaction: { applied: false, policyVersion: "1" } };
+}
+function collectGitHubNeeds(raw = process.env.SCRIPTONIA_NEEDS_JSON) {
+  if (!raw) return [];
+  try {
+    const needs = JSON.parse(raw);
+    return Object.entries(needs).map(([name, value]) => {
+      const result = String(value?.result ?? "unknown").toLowerCase();
+      const state = result === "success" ? "available" : result === "failure" || result === "cancelled" ? "failed" : "missing";
+      return item("github_check", "github-needs", `github:${name}`, state, { name, conclusion: result, outputs: value?.outputs ?? {} });
+    });
+  } catch (error) {
+    return [item("github_check", "github-needs", "env:SCRIPTONIA_NEEDS_JSON", "error", { error: error instanceof Error ? error.message : String(error) })];
+  }
+}
+function collectJUnit(root, patterns) {
+  const files = fg.sync(patterns, { cwd: root, absolute: true, onlyFiles: true, unique: true, suppressErrors: true });
+  const parser = new XMLParser({ ignoreAttributes: false, attributeNamePrefix: "@_", allowBooleanAttributes: true });
+  const items = [];
+  for (const filename of files) {
+    try {
+      const xml = fs.readFileSync(filename, "utf8");
+      if (Buffer.byteLength(xml) > 1e7) throw new Error("JUnit artifact exceeds 10 MB limit");
+      const parsed = parser.parse(xml);
+      for (const test of flattenTests(parsed)) {
+        const failed = Boolean(test.failure || test.error);
+        const skipped = Boolean(test.skipped);
+        const suite = String(test.classname ?? test.suite ?? "");
+        const name = String(test.name ?? "unnamed");
+        items.push(item("junit_test", "junit-xml", path.relative(root, filename), skipped ? "missing" : failed ? "failed" : "available", { suite, test: name, failed, skipped }));
+      }
+    } catch (error) {
+      items.push(item("junit_test", "junit-xml", path.relative(root, filename), "error", { error: error instanceof Error ? error.message : String(error) }));
+    }
+  }
+  return items;
+}
+function flattenTests(value, suite = "") {
+  if (!value || typeof value !== "object") return [];
+  const record3 = value;
+  const currentSuite = String(record3["@_name"] ?? suite);
+  const tests = asArray(record3.testcase).map((entry) => ({ ...entry, suite: currentSuite, classname: entry["@_classname"], name: entry["@_name"], failure: entry.failure, error: entry.error, skipped: entry.skipped }));
+  for (const key of ["testsuite", "testsuites"]) for (const child of asArray(record3[key])) tests.push(...flattenTests(child, currentSuite));
+  return tests;
+}
+function asArray(value) {
+  return value === void 0 ? [] : Array.isArray(value) ? value : [value];
+}
+function collectRepositoryFacts(root, changedFiles) {
+  return changedFiles.map((file) => {
+    const full = path.join(root, file);
+    let exists = false;
+    let size = 0;
+    try {
+      const stat = fs.statSync(full);
+      exists = stat.isFile();
+      size = stat.size;
+    } catch {
+    }
+    return item("repository_fact", "repository-fact", `path:${file}`, "available", { path: file, exists, size });
+  });
+}
+function evaluateRequirement(requirement, evidence) {
+  const relevant = evidence.filter((candidate) => candidate.kind === requirement.kind && requirementMatches(requirement, candidate));
+  if (!relevant.length) return { state: "INCONCLUSIVE", reason: `Required ${requirement.kind} evidence is unavailable.`, evidence: [] };
+  if (relevant.some((candidate) => candidate.state === "error")) return { state: "ERROR", reason: `${requirement.kind} collector failed.`, evidence: relevant };
+  if (relevant.some((candidate) => candidate.state === "failed")) return { state: "FAIL", reason: `Required ${requirement.kind} evidence failed.`, evidence: relevant };
+  if (relevant.some((candidate) => candidate.state === "available")) return { state: "PASS", reason: `Required ${requirement.kind} evidence passed.`, evidence: relevant };
+  return { state: "INCONCLUSIVE", reason: `Required ${requirement.kind} evidence is incomplete.`, evidence: relevant };
+}
+function requirementMatches(requirement, candidate) {
+  const payload = candidate.payload;
+  if (requirement.name && String(payload.name ?? payload.test ?? "") !== requirement.name) return false;
+  if (requirement.suite && String(payload.suite ?? "") !== requirement.suite) return false;
+  if (requirement.test && String(payload.test ?? "") !== requirement.test) return false;
+  if (requirement.path && String(payload.path ?? "") !== requirement.path) return false;
+  if (requirement.value && !Object.values(payload).map(String).includes(requirement.value)) return false;
+  return true;
+}
+
+// ../packages/impact/src/index.ts
+import fs2 from "fs";
+import path2 from "path";
+import fg2 from "fast-glob";
+var SOURCE = ["**/*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}", "!**/node_modules/**", "!**/dist/**", "!**/.next/**", "!**/coverage/**"];
+var EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", ".mjs", ".cjs", "/index.ts", "/index.tsx", "/index.js", "/index.jsx"];
+function buildFallbackImpactIndex(root) {
+  const files = fg2.sync(SOURCE, { cwd: root, onlyFiles: true, unique: true }).map(normalizeRepoPath).sort();
+  const known = new Set(files);
+  const edges = [];
+  for (const file of files) {
+    let text;
+    try {
+      text = fs2.readFileSync(path2.join(root, file), "utf8");
+    } catch {
+      continue;
+    }
+    const imports = [
+      ...text.matchAll(/(?:import|export)\s+(?:[^'";]+?\s+from\s+)?["']([^"']+)["']/g),
+      ...text.matchAll(/(?:require|import)\(\s*["']([^"']+)["']\s*\)/g)
+    ];
+    for (const match of imports) {
+      const specifier = match[1];
+      if (!specifier?.startsWith(".")) continue;
+      const base = normalizeRepoPath(path2.posix.join(path2.posix.dirname(file), specifier));
+      const target = EXTENSIONS.map((extension) => `${base}${extension}`).find((candidate) => known.has(candidate));
+      if (target) edges.push({ from: file, to: target, kind: "import", confidence: "high", provenance: `static-import:${file}` });
+    }
+  }
+  const stable = edges.sort((a, b) => `${a.from}:${a.to}`.localeCompare(`${b.from}:${b.to}`));
+  return { provider: "fallback-import-graph", version: "1", id: hashObject(stable), edges: stable };
+}
+function impactedFiles(index, changedFiles, depth = 2) {
+  const changed = new Set(changedFiles.map(normalizeRepoPath));
+  const files = new Set(changed);
+  const used = [];
+  let frontier = new Set(changed);
+  for (let step = 0; step < depth; step++) {
+    const next = /* @__PURE__ */ new Set();
+    for (const edge of index.edges) {
+      if (edge.confidence !== "high" || !frontier.has(edge.to) || files.has(edge.from)) continue;
+      files.add(edge.from);
+      next.add(edge.from);
+      used.push(edge);
+    }
+    frontier = next;
+    if (!frontier.size) break;
+  }
+  return { files: [...files].sort(), edges: used };
+}
+function relatedTests(index, changedFiles) {
+  const impacted = impactedFiles(index, changedFiles, 3).files;
+  return impacted.filter((file) => /(?:^|\/)(?:__tests__|tests?|spec)(?:\/|$)|\.(?:test|spec)\.[^.]+$/i.test(file));
+}
+function loadCodeGraphIndex(root) {
+  const filename = path2.join(root, ".scriptonia", "codegraph.json");
+  if (!fs2.existsSync(filename)) return void 0;
+  try {
+    const value = JSON.parse(fs2.readFileSync(filename, "utf8"));
+    const edges = (value.edges ?? []).filter((edge) => edge && typeof edge.from === "string" && typeof edge.to === "string" && ["high", "medium", "low"].includes(edge.confidence));
+    return { provider: "codegraph-file-adapter", version: "1", id: hashObject({ sourceVersion: value.version, edges }), edges };
+  } catch {
+    return void 0;
+  }
+}
+function createIndexImpactProvider(index) {
+  return {
+    index,
+    generation: index.id,
+    coverageValid: true,
+    changedSymbols: () => [],
+    dependents: (change, depth = 2) => impactedFiles(index, change.files, depth),
+    relatedTests: (change) => relatedTests(index, change.files)
+  };
+}
+function selectImpactProvider(options) {
+  if (options.brain?.coverageValid) return options.brain;
+  return createIndexImpactProvider(options.codeGraph ?? options.fallback());
+}
+function impactProviderIdentity(provider) {
+  return {
+    provider: provider.index.provider,
+    version: provider.index.version,
+    id: provider.index.id,
+    generation: provider.generation,
+    coverageValid: provider.coverageValid
+  };
+}
+
+// ../packages/model-gateway/src/index.ts
+import { z } from "zod";
+var judgeResultSchema = z.object({
+  result: z.enum(["supports", "contradicts", "uncertain"]),
+  confidence: z.number().min(0).max(1),
+  evidenceRefs: z.array(z.string()).default([]),
+  reason: z.string()
+});
+function secureBaseUrl(value, label) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return { error: `${label} must be a valid absolute URL` };
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    return { error: `${label} must use HTTPS except for localhost, 127.0.0.1, or [::1]` };
+  }
+  return { url: url.toString().replace(/\/$/, "") };
+}
+async function semanticJudge(input) {
+  const model = input.model ?? process.env.OPENAI_OUTPUT_MODEL ?? "gpt-5.6-terra";
+  const rubric = "Assess only whether the supplied evidence supports or contradicts the criterion. Return uncertain when evidence is insufficient. Never infer behavior from code style or plausibility.";
+  const serialized = JSON.stringify(input.evidenceBundle);
+  const maxBytes = input.maxBytes ?? 12e4;
+  if (Buffer.byteLength(serialized) > maxBytes) return { available: false, error: `evidence bundle exceeds ${maxBytes} byte limit` };
+  const configuredGatewayUrl = process.env.SCRIPTONIA_MODEL_GATEWAY_URL;
+  const gatewayToken = process.env.SCRIPTONIA_API_TOKEN;
+  if (configuredGatewayUrl && gatewayToken) {
+    const gateway = secureBaseUrl(configuredGatewayUrl, "Scriptonia model gateway URL");
+    if (!gateway.url) return { available: false, error: gateway.error };
+    const controller2 = new AbortController();
+    const timeout2 = setTimeout(() => controller2.abort(), input.timeoutMs ?? 2e4);
+    try {
+      const response = await (input.fetchImpl ?? fetch)(`${gateway.url}/api/v2/judge`, { method: "POST", headers: { authorization: `Bearer ${gatewayToken}`, "content-type": "application/json" }, signal: controller2.signal, body: JSON.stringify({ criterion: input.criterion, evidence: input.evidenceBundle }) });
+      const body = await response.json();
+      if (!response.ok) return { available: false, error: `Scriptonia model gateway returned ${response.status}` };
+      const parsed = judgeResultSchema.safeParse(body);
+      if (!parsed.success) return { available: false, error: "Scriptonia model gateway returned invalid structured output" };
+      return { available: true, result: { ...parsed.data, schemaVersion: "1", evaluatorVersion: "1", model: String(body.model ?? model), ...typeof body.providerRevision === "string" ? { providerRevision: body.providerRevision } : {}, rubricHash: String(body.rubricHash ?? hashObject(rubric)) } };
+    } catch (error) {
+      return { available: false, error: error instanceof Error ? error.message : String(error) };
+    } finally {
+      clearTimeout(timeout2);
+    }
+  }
+  const endpoint = input.endpoint ?? process.env.LITELLM_BASE_URL;
+  const apiKey = input.apiKey ?? process.env.LITELLM_MASTER_KEY;
+  if (!endpoint || !apiKey) return { available: false, error: "Scriptonia model gateway is not configured" };
+  const liteLLM = secureBaseUrl(endpoint, "LiteLLM base URL");
+  if (!liteLLM.url) return { available: false, error: liteLLM.error };
+  const directModel = input.model ?? process.env.LITELLM_MODEL ?? "semantic-judge";
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), input.timeoutMs ?? 2e4);
+  const url = `${liteLLM.url}/v1/chat/completions`;
+  try {
+    const response = await (input.fetchImpl ?? fetch)(url, {
+      method: "POST",
+      headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" },
+      signal: controller.signal,
+      body: JSON.stringify({
+        model: directModel,
+        temperature: 0,
+        response_format: { type: "json_object" },
+        messages: [
+          { role: "system", content: `${rubric}
+Return JSON with result, confidence, evidenceRefs, reason.` },
+          { role: "user", content: JSON.stringify({ criterion: input.criterion, evidence: input.evidenceBundle }) }
+        ]
+      })
+    });
+    const body = await response.json();
+    if (!response.ok) return { available: false, error: `LiteLLM returned ${response.status}` };
+    const content = body.choices?.[0]?.message?.content;
+    if (typeof content !== "string") return { available: false, error: "LiteLLM response contains no message content" };
+    const parsed = judgeResultSchema.safeParse(JSON.parse(content));
+    if (!parsed.success) return { available: false, error: "semantic judge returned invalid structured output" };
+    return { available: true, result: { ...parsed.data, schemaVersion: "1", evaluatorVersion: "1", model: directModel, rubricHash: hashObject(rubric) } };
+  } catch (error) {
+    return { available: false, error: error instanceof Error ? error.message : String(error) };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../packages/policy-engine/src/index.ts
+import fs4 from "fs";
+import path4 from "path";
+import picomatch2 from "picomatch";
+import YAML from "yaml";
+
+// ../packages/scope-engine/src/index.ts
+import fs3 from "fs";
+import path3 from "path";
+import picomatch from "picomatch";
+function discoverPackages(root) {
+  const result = /* @__PURE__ */ new Map();
+  const visit = (relative, depth) => {
+    if (depth > 4) return;
+    const absolute = path3.join(root, relative);
+    for (const entry of safeReadDir(absolute)) {
+      if (!entry.isDirectory() || entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "dist") continue;
+      const next = normalizeRepoPath(path3.posix.join(relative.replaceAll("\\", "/"), entry.name));
+      const pkgFile = path3.join(root, next, "package.json");
+      if (fs3.existsSync(pkgFile)) {
+        try {
+          result.set(next, String(JSON.parse(fs3.readFileSync(pkgFile, "utf8")).name || next));
+        } catch {
+          result.set(next, next);
+        }
+      }
+      visit(next, depth + 1);
+    }
+  };
+  if (fs3.existsSync(path3.join(root, "package.json"))) {
+    try {
+      result.set(".", String(JSON.parse(fs3.readFileSync(path3.join(root, "package.json"), "utf8")).name || "."));
+    } catch {
+      result.set(".", ".");
+    }
+  }
+  visit(".", 0);
+  return result;
+}
+function safeReadDir(dir) {
+  try {
+    return fs3.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function parseCodeowners(root) {
+  const candidates = ["CODEOWNERS", ".github/CODEOWNERS", "docs/CODEOWNERS"];
+  const file = candidates.map((name) => path3.join(root, name)).find(fs3.existsSync);
+  const owners = /* @__PURE__ */ new Map();
+  if (!file) return owners;
+  for (const raw of fs3.readFileSync(file, "utf8").split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const [pattern, ...names] = line.split(/\s+/);
+    if (pattern && names.length) owners.set(pattern.replace(/^\//, ""), names);
+  }
+  return owners;
+}
+function ownerFor(file, owners) {
+  let found;
+  for (const [pattern, names] of owners) {
+    try {
+      if (picomatch.isMatch(file, pattern, { dot: true, basename: !pattern.includes("/") })) found = names;
+    } catch {
+    }
+  }
+  return found?.join(",");
+}
+function buildScopeContext(root, files, extras = {}) {
+  return {
+    root,
+    files: files.map(normalizeRepoPath),
+    symbols: extras.symbols ?? extractSymbols(root, files),
+    dependencies: extras.dependencies ?? discoverDependencies(root),
+    checks: extras.checks ?? [],
+    permissions: extras.permissions ?? [],
+    owners: parseCodeowners(root),
+    packages: discoverPackages(root)
+  };
+}
+function matchScope(scope, context) {
+  const include = scope.paths.include.length ? scope.paths.include : ["**"];
+  const included = picomatch(include, { dot: true });
+  const excluded = scope.paths.exclude.length ? picomatch(scope.paths.exclude, { dot: true }) : () => false;
+  const pathFiles = context.files.filter((file) => included(file) && !excluded(file));
+  const packageRoots = [...context.packages.entries()].filter(([, name]) => scope.packages.includes(name)).map(([root]) => root);
+  const packageFiles = scope.packages.length ? context.files.filter((file) => packageRoots.some((root) => root === "." || file === root || file.startsWith(`${root}/`))) : [];
+  const symbols = scope.symbols.filter((symbol) => context.symbols.includes(symbol));
+  const deps = scope.dependencies.filter((dependency) => context.dependencies.includes(dependency));
+  const hasConstraint = scope.packages.length + scope.services.length + scope.symbols.length + scope.dependencies.length > 0 || scope.paths.include.some((item2) => item2 !== "**");
+  const matched = hasConstraint ? Boolean(pathFiles.length || packageFiles.length || symbols.length || deps.length) : Boolean(context.files.length);
+  const specificity = symbols.length ? 5 : pathFiles.some((file) => scope.paths.include.includes(file)) ? 4 : pathFiles.length ? 3 : packageFiles.length ? 2 : matched ? 1 : 0;
+  const files = [.../* @__PURE__ */ new Set([...pathFiles, ...packageFiles])];
+  const reasons = [files.length && `paths:${files.length}`, symbols.length && `symbols:${symbols.join(",")}`, deps.length && `dependencies:${deps.join(",")}`].filter(Boolean);
+  return { matched, specificity, files, reasons, owner: files.map((file) => ownerFor(file, context.owners)).find(Boolean) };
+}
+function discoverDependencies(root) {
+  const names = /* @__PURE__ */ new Set();
+  for (const [directory] of discoverPackages(root)) {
+    try {
+      const pkg = JSON.parse(fs3.readFileSync(path3.join(root, directory, "package.json"), "utf8"));
+      for (const section of [pkg.dependencies, pkg.devDependencies, pkg.peerDependencies]) for (const name of Object.keys(section || {})) names.add(name);
+    } catch {
+    }
+  }
+  return [...names].sort();
+}
+function extractSymbols(root, files) {
+  const symbols = /* @__PURE__ */ new Set();
+  const pattern = /\b(?:export\s+)?(?:async\s+)?(?:function|class|interface|type|const|let|var)\s+([A-Za-z_$][\w$]*)/g;
+  for (const file of files) {
+    if (!/\.[cm]?[jt]sx?$/.test(file)) continue;
+    try {
+      const text = fs3.readFileSync(path3.join(root, file), "utf8");
+      for (const match of text.matchAll(pattern)) if (match[1]) symbols.add(match[1]);
+    } catch {
+    }
+  }
+  return [...symbols].sort();
+}
+
+// ../packages/policy-engine/src/index.ts
+function loadDecisions(root) {
+  const directory = path4.join(root, ".scriptonia", "decisions");
+  if (!fs4.existsSync(directory)) return { decisions: [], errors: [] };
+  const decisions = [];
+  const errors = [];
+  for (const name of fs4.readdirSync(directory).filter((file) => /\.ya?ml$/i.test(file)).sort()) {
+    try {
+      decisions.push(decisionSchema.parse(YAML.parse(fs4.readFileSync(path4.join(directory, name), "utf8"))));
+    } catch (error) {
+      errors.push(`${name}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { decisions, errors };
+}
+function parseDecisionDocuments(documents) {
+  const decisions = [];
+  const errors = [];
+  for (const document of documents) {
+    try {
+      decisions.push(decisionSchema.parse(YAML.parse(document.text)));
+    } catch (error) {
+      errors.push(`${document.name}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { decisions, errors };
+}
+function evaluateDecisions(decisions, context) {
+  return decisions.map((decision) => evaluateDecision(decision, context));
+}
+function evaluateDecision(decision, context) {
+  const base = { id: `decision:${decision.id}@${decision.version}`, evaluator: `predicate:${decision.predicate.kind}`, evaluatorVersion: "1", enforcement: decision.enforcement, title: decision.title, decisionRef: `${decision.id}@${decision.version}` };
+  const finish = (state, reason, evidence, owner) => {
+    const identity = { decision: base.decisionRef, state, evidence, evaluator: base.evaluator, version: base.evaluatorVersion };
+    return { ...base, state, reason, evidence, ...owner ? { owner } : {}, fingerprint: hashObject(identity) };
+  };
+  if (decision.state !== "active") return finish("SKIPPED", `Decision is ${decision.state}; only active decisions enforce.`, []);
+  if (!decision.confirmed_by) return finish("INCONCLUSIVE", "Active decision has no human confirmation.", []);
+  const scoped = matchScope(decision.scope, context);
+  if (!scoped.matched) return finish("SKIPPED", "Decision scope does not intersect this change.", []);
+  const p = decision.predicate;
+  const names = p.names.length ? p.names : p.patterns;
+  const matches = (patterns) => context.files.filter((file) => picomatch2.isMatch(file, patterns, { dot: true }));
+  switch (p.kind) {
+    case "path_forbidden": {
+      const found = matches(names);
+      return finish(found.length ? "FAIL" : "PASS", found.length ? `Forbidden paths changed: ${found.join(", ")}` : "No forbidden path changed.", found.map((value) => ({ kind: "path", value })), decision.owner ?? scoped.owner);
+    }
+    case "path_requires_owner": {
+      const target = matches(names.length ? names : decision.scope.paths.include);
+      const missing = target.filter((file) => !ownerFor(file, context.owners) && !decision.owner && !p.owner);
+      return finish(missing.length ? "FAIL" : "PASS", missing.length ? `Changed paths have no owner: ${missing.join(", ")}` : "All applicable paths have an owner.", target.map((value) => ({ kind: "path", value })), decision.owner ?? p.owner ?? scoped.owner);
+    }
+    case "dependency_forbidden": {
+      const found = names.filter((name) => context.dependencies.includes(name));
+      return finish(found.length ? "FAIL" : "PASS", found.length ? `Forbidden dependencies present: ${found.join(", ")}` : "No forbidden dependency is present.", found.map((value) => ({ kind: "dependency", value })), decision.owner ?? scoped.owner);
+    }
+    case "dependency_required": {
+      const missing = names.filter((name) => !context.dependencies.includes(name));
+      return finish(missing.length ? "FAIL" : "PASS", missing.length ? `Required dependencies missing: ${missing.join(", ")}` : "Required dependencies are present.", names.map((value) => ({ kind: "dependency", value })), decision.owner ?? scoped.owner);
+    }
+    case "symbol_forbidden": {
+      const found = names.filter((name) => context.symbols.includes(name));
+      return finish(found.length ? "FAIL" : "PASS", found.length ? `Forbidden symbols changed: ${found.join(", ")}` : "No forbidden symbol changed.", found.map((value) => ({ kind: "symbol", value })), decision.owner ?? scoped.owner);
+    }
+    case "symbol_requires_test": {
+      const targeted = names.some((name) => context.symbols.includes(name));
+      const tests = context.files.filter((file) => /(?:^|\/)(?:__tests__|tests?|spec)(?:\/|$)|\.(?:test|spec)\.[^.]+$/i.test(file));
+      return finish(targeted && !tests.length ? "FAIL" : "PASS", targeted && !tests.length ? "Changed symbol requires a changed test." : "Required test-file evidence is present or the symbol is unchanged.", tests.map((value) => ({ kind: "path", value })), decision.owner ?? scoped.owner);
+    }
+    case "file_pattern_required": {
+      const found = matches(names);
+      return finish(found.length ? "PASS" : "FAIL", found.length ? "Required file pattern is present in the change." : `No changed file matches: ${names.join(", ")}`, found.map((value) => ({ kind: "path", value })), decision.owner ?? scoped.owner);
+    }
+    case "permission_required": {
+      const required = p.permission ?? names[0];
+      if (!required) return finish("ERROR", "permission_required has no permission value.", []);
+      return finish(context.permissions.includes(required) ? "PASS" : "INCONCLUSIVE", context.permissions.includes(required) ? `Permission confirmed: ${required}` : `Permission not confirmed: ${required}`, [{ kind: "permission", value: required }], decision.owner ?? scoped.owner);
+    }
+    case "check_required": {
+      const required = p.check ?? names[0];
+      if (!required) return finish("ERROR", "check_required has no check name.", []);
+      return finish(context.checks.includes(required) ? "PASS" : "INCONCLUSIVE", context.checks.includes(required) ? `Required check passed: ${required}` : `Required check evidence unavailable: ${required}`, [{ kind: "check", value: required }], decision.owner ?? scoped.owner);
+    }
+  }
+}
+
+// ../packages/eval-engine/src/index.ts
+var DEFAULT_CONFIG = configSchema.parse({});
+function loadConfig(root) {
+  const filename = path5.join(root, ".scriptonia", "config.yaml");
+  if (!fs5.existsSync(filename)) return { config: DEFAULT_CONFIG, errors: [] };
+  try {
+    return { config: configSchema.parse(YAML2.parse(fs5.readFileSync(filename, "utf8"))), errors: [] };
+  } catch (error) {
+    return { config: DEFAULT_CONFIG, errors: [`config.yaml: ${error instanceof Error ? error.message : String(error)}`] };
+  }
+}
+function parseConfigDocument(text, name = "config.yaml") {
+  if (text === void 0) return { config: DEFAULT_CONFIG, errors: [] };
+  try {
+    return { config: configSchema.parse(YAML2.parse(text)), errors: [] };
+  } catch (error) {
+    return { config: DEFAULT_CONFIG, errors: [`${name}: ${error instanceof Error ? error.message : String(error)}`] };
+  }
+}
+function ensureConfig(root) {
+  const directory = path5.join(root, ".scriptonia");
+  const filename = path5.join(directory, "config.yaml");
+  fs5.mkdirSync(path5.join(directory, "decisions"), { recursive: true });
+  fs5.mkdirSync(path5.join(directory, "evals"), { recursive: true });
+  if (!fs5.existsSync(filename)) fs5.writeFileSync(filename, YAML2.stringify(DEFAULT_CONFIG));
+  return filename;
+}
+function loadEvals(root) {
+  const directory = path5.join(root, ".scriptonia", "evals");
+  if (!fs5.existsSync(directory)) return { evals: [], errors: [] };
+  const evals = [];
+  const errors = [];
+  for (const filename of fs5.readdirSync(directory).filter((file) => /\.ya?ml$/i.test(file)).sort()) {
+    try {
+      evals.push(evalCaseSchema.parse(YAML2.parse(fs5.readFileSync(path5.join(directory, filename), "utf8"))));
+    } catch (error) {
+      errors.push(`${filename}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { evals, errors };
+}
+function parseEvalDocuments(documents) {
+  const evals = [];
+  const errors = [];
+  for (const document of documents) {
+    try {
+      evals.push(evalCaseSchema.parse(YAML2.parse(document.text)));
+    } catch (error) {
+      errors.push(`${document.name}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { evals, errors };
+}
+async function verifyRepository(options) {
+  if (!options.trustedBase) ensureConfig(options.root);
+  const trustedRef = options.trustedBase ? options.base : void 0;
+  const loadedConfig = trustedRef ? parseConfigDocument(readFileAtRef(options.root, trustedRef, ".scriptonia/config.yaml"), `${trustedRef}:.scriptonia/config.yaml`) : loadConfig(options.root);
+  const config = loadedConfig.config;
+  const snapshot = await withSpan("snapshot.build", { base_configured: Boolean(options.base ?? config.base_ref) }, () => buildSnapshot({ cwd: options.root, base: options.base ?? config.base_ref }));
+  const planPath = path5.resolve(options.root, options.plan ?? "PLAN.md");
+  const plan = fs5.existsSync(planPath) ? fs5.readFileSync(planPath, "utf8") : void 0;
+  const loadedDecisions = trustedRef ? parseDecisionDocuments(listFilesAtRef(options.root, trustedRef, [".scriptonia/decisions"]).filter((name) => /\.ya?ml$/i.test(name)).map((name) => ({ name: `${trustedRef}:${name}`, text: readFileAtRef(options.root, trustedRef, name) ?? "" }))) : loadDecisions(options.root);
+  const loadedEvals = trustedRef ? parseEvalDocuments(listFilesAtRef(options.root, trustedRef, [".scriptonia/evals"]).filter((name) => /\.ya?ml$/i.test(name)).map((name) => ({ name: `${trustedRef}:${name}`, text: readFileAtRef(options.root, trustedRef, name) ?? "" }))) : loadEvals(options.root);
+  const evals = options.evalFilter ? loadedEvals.evals.filter((entry) => entry.id === options.evalFilter || entry.title.toLowerCase().includes(options.evalFilter.toLowerCase())) : loadedEvals.evals;
+  const collected = await withSpan("evidence.collect", { changed_file_count: snapshot.files.length }, () => {
+    const github2 = collectGitHubNeeds(options.githubNeeds ?? process.env[config.evidence.github_needs_env]);
+    const junit = collectJUnit(options.root, config.evidence.junit);
+    const repositoryFacts = collectRepositoryFacts(options.root, snapshot.files.map((file) => file.path));
+    return { github: github2, evidence: [...github2, ...junit, ...repositoryFacts] };
+  });
+  const { github, evidence } = collected;
+  const passedChecks = github.filter((item2) => item2.state === "available").map((item2) => String(item2.payload.name));
+  const impactChange = {
+    files: snapshot.files.map((file) => file.path),
+    lines: parseDiffHunks(snapshot.diff).map((hunk) => ({ path: hunk.path, startLine: Math.max(1, hunk.newRange.startLine), endLineExclusive: Math.max(1, hunk.newRange.endLineExclusive) }))
+  };
+  const impactProvider = await withSpan("impact.index", { changed_file_count: snapshot.files.length }, () => selectImpactProvider({
+    brain: loadCurrentBrainImpactProvider(options.root),
+    codeGraph: loadCodeGraphIndex(options.root),
+    fallback: () => buildFallbackImpactIndex(options.root)
+  }));
+  const impactIndex = impactProvider.index;
+  const impact = impactProvider.dependents(impactChange, 2);
+  const scope = await withSpan("scope.resolve", { impacted_file_count: impact.files.length }, () => buildScopeContext(options.root, impact.files, { checks: passedChecks }));
+  const policy = await withSpan("policy.evaluate", { decision_count: loadedDecisions.decisions.length }, () => evaluateDecisions(loadedDecisions.decisions, scope));
+  const identity = {
+    schemaVersion: "1",
+    baseSha: snapshot.baseSha,
+    headSha: snapshot.headSha,
+    diffHash: snapshot.diffHash,
+    config,
+    plan: plan ? hashObject(plan) : null,
+    decisions: loadedDecisions.decisions.map((entry) => ({ id: entry.id, version: entry.version, hash: hashObject(entry) })),
+    evals: evals.map((entry) => ({ id: entry.id, version: entry.version, hash: hashObject(entry) })),
+    evidence: evidence.map((entry) => ({ hash: entry.contentHash, state: entry.state })),
+    impact: { ...impactProviderIdentity(impactProvider), edges: impact.edges },
+    evaluators: { policy: "1", eval: "1", plan: "1", gate: "1", testCoverage: "2" },
+    semantic: config.semantic.enabled || options.semantic ? {
+      model: config.semantic.model ?? process.env.OPENAI_OUTPUT_MODEL ?? process.env.LITELLM_MODEL ?? "gpt-5.6-terra",
+      endpoint: config.semantic.endpoint ?? process.env.SCRIPTONIA_MODEL_GATEWAY_URL ?? process.env.LITELLM_BASE_URL ?? "unconfigured"
+    } : null,
+    trustedConfigurationRef: trustedRef ?? "working-tree"
+  };
+  const snapshotId = hashObject(identity);
+  const store = new BrainStore(options.root);
+  try {
+    for (const decision of loadedDecisions.decisions) store.indexDecision({ ...decision });
+    for (const evaluation of loadedEvals.evals) store.indexEval({ ...evaluation });
+    store.saveSnapshot({ id: snapshotId, baseSha: snapshot.baseSha, headSha: snapshot.headSha, diffHash: snapshot.diffHash, payload: identity, files: snapshot.files });
+    store.saveImpact({ id: impactIndex.id, provider: impactIndex.provider, version: impactIndex.version, snapshotId, edges: impact.edges });
+    store.saveEvidence(evidence.map((entry) => ({ id: entry.id, contentHash: entry.contentHash, kind: entry.kind, state: entry.state, payload: entry.payload, collectedAt: entry.collectedAt })));
+    if (!options.refresh) {
+      const cached = await withSpan("cache.lookup", { refresh: false }, () => store.getCached(snapshotId));
+      if (cached) return { ...cached, cached: true };
+    }
+    const checks = [];
+    for (const error of [...loadedConfig.errors, ...loadedDecisions.errors, ...loadedEvals.errors]) checks.push(makeCheck({ evaluator: "definition-loader", title: "Definition validation", state: "ERROR", enforcement: "block", reason: error, refs: [] }));
+    checks.push(...policy.map(policyToCheck));
+    checks.push(...evaluateEvals(evals, scope, evidence, policy));
+    checks.push(...evaluatePlan(plan, config.required_plan, evidence));
+    const coverageSourcePaths = new Set(snapshot.files.filter((file) => isProductSourceForCoverage(file.path, coverageSample(snapshot, file.path, file.binary), file.binary)).map((file) => file.path.replaceAll("\\", "/")));
+    const coverageChange = {
+      files: impactChange.files.filter((file) => coverageSourcePaths.has(file.replaceAll("\\", "/"))),
+      lines: impactChange.lines.filter((range) => coverageSourcePaths.has(range.path.replaceAll("\\", "/")))
+    };
+    checks.push(testCoverageCheck(snapshot, impactProvider.relatedTests(coverageChange), impactProvider.changedSymbols(coverageChange.lines)));
+    checks.push(...github.map(githubCheck));
+    let semanticCoverage = config.semantic.enabled || options.semantic ? "unavailable" : "disabled";
+    if ((config.semantic.enabled || options.semantic) && plan) {
+      const semanticChecks = await evaluateSemanticCriteria(plan, snapshot, config);
+      if (semanticChecks.some((check) => !check.reason.includes("unavailable"))) semanticCoverage = "available";
+      checks.push(...semanticChecks);
+    }
+    const gate = await withSpan("verdict.aggregate", { check_count: checks.length }, () => aggregateGate(checks, config.incomplete_blocks));
+    for (const check of checks) {
+      if (check.state === "FAIL" || check.state === "ERROR" || check.state === "INCONCLUSIVE" && check.enforcement === "block") {
+        check.findingId = store.findFindingId(check.fingerprint) ?? `finding_${hashObject({ snapshotId, fingerprint: check.fingerprint }).slice(0, 24)}`;
+      }
+    }
+    const verificationId = createId("verification");
+    const decisionEvaluated = policy.filter((entry) => entry.state !== "SKIPPED").length;
+    const evalEvaluated = checks.filter((entry) => entry.evaluator === "eval-evidence" && entry.state !== "SKIPPED").length;
+    const result = {
+      schemaVersion: "1",
+      verificationId,
+      snapshotId,
+      createdAt: nowIso(),
+      cached: false,
+      gate,
+      exitCode: exitCodeForGate(gate),
+      coverage: { plan: plan ? "present" : "absent", decisions: { total: policy.length, evaluated: decisionEvaluated, skipped: policy.length - decisionEvaluated }, evals: { total: evals.length, evaluated: evalEvaluated, skipped: evals.length - evalEvaluated }, semantic: semanticCoverage },
+      snapshot: { schemaVersion: snapshot.schemaVersion, baseRef: snapshot.baseRef, baseSha: snapshot.baseSha, headSha: snapshot.headSha, dirty: snapshot.dirty, diffHash: snapshot.diffHash, files: snapshot.files, snapshotId: snapshot.snapshotId, repositoryRoot: "." },
+      checks,
+      evidence: evidence.map(({ id, kind, source, state, contentHash }) => ({ id, kind, source, state, contentHash })),
+      configurationHash: hashObject(config)
+    };
+    store.saveVerification({ id: verificationId, snapshotId, gateState: gate, result, refresh: options.refresh });
+    store.saveChecks(verificationId, checks);
+    for (const check of checks.filter((entry) => entry.findingId)) {
+      store.saveFinding({ id: check.findingId, snapshotId, fingerprint: check.fingerprint, evaluator: check.evaluator, state: check.state, enforcement: check.enforcement, owner: check.owner, payload: check });
+    }
+    return result;
+  } finally {
+    store.close();
+  }
+}
+function policyToCheck(result) {
+  return { id: result.id, evaluator: result.evaluator, evaluatorVersion: result.evaluatorVersion, title: result.title, state: result.state, enforcement: result.enforcement, reason: result.reason, evidence: result.evidence.map((entry) => ({ kind: entry.kind, value: entry.value })), refs: [result.decisionRef], ...result.owner ? { owner: result.owner } : {}, fingerprint: result.fingerprint };
+}
+function evaluateEvals(evals, scope, evidence, policies) {
+  return evals.map((evaluation) => {
+    if (evaluation.state !== "active") return makeCheck({ id: `eval:${evaluation.id}@${evaluation.version}`, evaluator: "eval-evidence", title: evaluation.title, state: "SKIPPED", enforcement: evaluation.enforcement, reason: `Eval is ${evaluation.state}; only active evals enforce.`, refs: [evaluation.id], owner: evaluation.owner });
+    const match = matchScope(evaluation.scope, scope);
+    if (!match.matched) return makeCheck({ id: `eval:${evaluation.id}@${evaluation.version}`, evaluator: "eval-evidence", title: evaluation.title, state: "SKIPPED", enforcement: evaluation.enforcement, reason: "Eval scope does not intersect this change.", refs: [evaluation.id], owner: evaluation.owner ?? match.owner });
+    const withPolicies = [...evidence, ...policies.map((policy) => ({ id: policy.id, kind: "decision_predicate", collector: "policy-engine", collectorVersion: "1", source: policy.decisionRef, state: policy.state === "PASS" ? "available" : policy.state === "FAIL" ? "failed" : "missing", contentHash: policy.fingerprint, payload: { name: policy.decisionRef, result: policy.state }, collectedAt: nowIso(), redaction: { applied: false, policyVersion: "1" } }))];
+    const all = evaluation.evidence.all.map((requirement) => evaluateRequirement(requirement, withPolicies));
+    const any = evaluation.evidence.any.map((requirement) => evaluateRequirement(requirement, withPolicies));
+    let state = "PASS";
+    if (all.some((entry) => entry.state === "ERROR") || any.some((entry) => entry.state === "ERROR")) state = "ERROR";
+    else if (all.some((entry) => entry.state === "FAIL") || any.length > 0 && any.every((entry) => entry.state === "FAIL")) state = "FAIL";
+    else if (all.some((entry) => entry.state === "INCONCLUSIVE") || any.length > 0 && !any.some((entry) => entry.state === "PASS")) state = "INCONCLUSIVE";
+    else if (!all.length && !any.length) state = "INCONCLUSIVE";
+    const used = [...all, ...any].flatMap((entry) => entry.evidence);
+    return makeCheck({ id: `eval:${evaluation.id}@${evaluation.version}`, evaluator: "eval-evidence", title: evaluation.title, state, enforcement: evaluation.enforcement, reason: state === "PASS" ? "All declared eval evidence passed." : state === "FAIL" ? "Declared eval evidence failed." : state === "ERROR" ? "An evidence collector failed." : "Declared eval evidence is unavailable or incomplete.", evidence: used.map((entry) => ({ id: entry.id, kind: entry.kind, value: entry.source })), refs: [evaluation.id, ...evaluation.decision_refs, ...evaluation.signal_refs], owner: evaluation.owner ?? match.owner });
+  });
+}
+function evaluatePlan(plan, required, evidence) {
+  if (!plan) return [makeCheck({ evaluator: "plan-coverage", title: "Approved plan", state: required ? "INCONCLUSIVE" : "SKIPPED", enforcement: required ? "block" : "observe", reason: required ? "PLAN.md is required but unavailable." : "No PLAN.md is present; policy-only mode is active.", refs: [] })];
+  const checks = [];
+  const unresolved = plan.split("\n").filter((line) => /(?:⚠\s*)?UNRESOLVED/i.test(line));
+  checks.push(makeCheck({ evaluator: "plan-unresolved", title: "Unresolved constraints", state: unresolved.length ? "FAIL" : "PASS", enforcement: "block", reason: unresolved.length ? "PLAN.md contains unresolved approval gates." : "No unresolved approval gate remains.", evidence: unresolved.map((value) => ({ kind: "plan_line", value: value.trim() })), refs: ["PLAN.md"] }));
+  for (const criterion of parseSectionItems(plan, "acceptance criteria")) {
+    const requirements = parseInlineEvidence(criterion);
+    checks.push(planEvidenceCheck("plan-criterion", criterion, requirements, evidence));
+  }
+  for (const nonGoal of parseSectionItems(plan, "non-goals")) {
+    const requirements = parseInlineEvidence(nonGoal);
+    checks.push(planEvidenceCheck("plan-non-goal", nonGoal, requirements, evidence));
+  }
+  return checks;
+}
+function planEvidenceCheck(evaluator, text, requirements, evidence) {
+  const title = text.replace(/\s*\[evidence:[^\]]+\]/g, "");
+  if (!requirements.length) return makeCheck({ evaluator, title, state: "INCONCLUSIVE", enforcement: "warn", reason: evaluator === "plan-criterion" ? "Acceptance criterion has no declared evidence mapping." : "Non-goal has no deterministic evidence mapping.", refs: ["PLAN.md"] });
+  const results = requirements.map((requirement) => evaluateRequirement(requirement, evidence));
+  const state = results.some((entry) => entry.state === "ERROR") ? "ERROR" : results.some((entry) => entry.state === "FAIL") ? "FAIL" : results.some((entry) => entry.state === "INCONCLUSIVE") ? "INCONCLUSIVE" : "PASS";
+  return makeCheck({ evaluator, title, state, enforcement: "warn", reason: state === "PASS" ? "All declared plan evidence passed." : state === "FAIL" ? "Declared plan evidence failed." : state === "ERROR" ? "A declared plan evidence collector failed." : "Declared plan evidence is unavailable or incomplete.", evidence: results.flatMap((entry) => entry.evidence).map((entry) => ({ id: entry.id, kind: entry.kind, value: entry.source })), refs: ["PLAN.md"] });
+}
+function parseSectionItems(markdown, title) {
+  const lines = markdown.split("\n");
+  const start = lines.findIndex((line) => new RegExp(`^#{1,6}\\s+${escapeRegex(title)}\\s*$`, "i").test(line.trim()));
+  if (start < 0) return [];
+  const items = [];
+  for (const line of lines.slice(start + 1)) {
+    if (/^#{1,6}\s+/.test(line.trim())) break;
+    const match = line.match(/^\s*(?:[-*]|\d+[.)])\s+(?:\[[ xX]\]\s*)?(.+)/);
+    if (match?.[1]) items.push(match[1].trim());
+  }
+  return items;
+}
+function parseInlineEvidence(text) {
+  return [...text.matchAll(/\[evidence:([a-z_]+)(?::([^:\]]+))?(?::([^\]]+))?\]/gi)].flatMap((match) => {
+    const kind = match[1];
+    const first = match[2];
+    const second = match[3];
+    const candidate = kind === "junit_test" ? { kind, suite: first, test: second } : kind === "repository_fact" ? { kind, path: first } : { kind, name: first };
+    const parsed = evidenceRequirementSchema.safeParse(candidate);
+    return parsed.success ? [parsed.data] : [];
+  });
+}
+var COVERAGE_TEST_EXTENSION = "(?:c|cc|cp|cpp|cxx|h|hh|hpp|hxx|inc|m|mm|cs|dart|ex|exs|go|java|js|jsx|mjs|cjs|kt|kts|lua|pl|pm|php|proto|py|pyi|rb|rs|scala|sh|bash|zsh|fish|bzl|bazel|star|swift|ts|tsx|mts|cts|vue)";
+var COVERAGE_TEST_BASENAME = new RegExp(`(?:^|/)(?:test_[^/]+|[^/]+_(?:test|spec)|[^/]+\\.(?:test|spec))\\.${COVERAGE_TEST_EXTENSION}$`, "i");
+var COVERAGE_SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".c",
+  ".h",
+  ".cc",
+  ".cp",
+  ".cpp",
+  ".cxx",
+  ".hh",
+  ".hpp",
+  ".hxx",
+  ".inc",
+  ".m",
+  ".mm",
+  ".cs",
+  ".css",
+  ".scss",
+  ".sass",
+  ".less",
+  ".dart",
+  ".ex",
+  ".exs",
+  ".go",
+  ".graphql",
+  ".gql",
+  ".html",
+  ".htm",
+  ".java",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".json",
+  ".jsonc",
+  ".kt",
+  ".kts",
+  ".lua",
+  ".pl",
+  ".pm",
+  ".php",
+  ".proto",
+  ".py",
+  ".pyi",
+  ".rb",
+  ".rs",
+  ".scala",
+  ".sh",
+  ".bash",
+  ".zsh",
+  ".fish",
+  ".sql",
+  ".bzl",
+  ".bazel",
+  ".star",
+  ".swift",
+  ".toml",
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".vue",
+  ".xml",
+  ".plist",
+  ".yaml",
+  ".yml"
+]);
+var COVERAGE_STARLARK_BASENAMES = /* @__PURE__ */ new Set(["BUILD", "BUILD.bazel", "WORKSPACE", "WORKSPACE.bzlmod", "MODULE.bazel"]);
+var COVERAGE_CONFIG_BASENAMES = /* @__PURE__ */ new Set([
+  ".bazelignore",
+  ".bazelrc",
+  ".bazelversion",
+  ".clang-format",
+  ".clang-tidy",
+  ".dockerignore",
+  ".editorconfig",
+  ".env.example",
+  ".flake8",
+  ".gitignore",
+  ".npmrc",
+  ".nvmrc",
+  ".prettierrc",
+  ".yamllint",
+  "CMakeLists.txt",
+  "CODEOWNERS",
+  "Cargo.toml",
+  "Dockerfile",
+  "Gemfile",
+  "Gemfile.lock",
+  "Makefile",
+  "Podfile",
+  "analysis_options.yaml",
+  "build.gradle",
+  "build.gradle.kts",
+  "composer.json",
+  "composer.lock",
+  "deps.yaml",
+  "extensions_metadata.yaml",
+  "go.mod",
+  "go.sum",
+  "gradle.properties",
+  "MODULE.bazel.lock",
+  "package-lock.json",
+  "package.json",
+  "pnpm-lock.yaml",
+  "pnpm-workspace.yaml",
+  "pom.xml",
+  "pubspec.lock",
+  "pubspec.yaml",
+  "pyproject.toml",
+  "requirements.txt",
+  "settings.gradle",
+  "settings.gradle.kts",
+  "tsconfig.json",
+  "yarn.lock"
+]);
+function isTestFileForCoverage(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return /(?:^|\/)(?:__tests__|tests?|spec|integration_test)(?:\/|$)/i.test(normalized) || COVERAGE_TEST_BASENAME.test(normalized) || /(?:^|\/)[^/]+(?:Test|Tests|Spec)\.(?:cs|java|kt|kts|scala|swift)$/.test(normalized);
+}
+function isProductSourceForCoverage(filePath, sample = "", binary = false) {
+  if (binary || isTestFileForCoverage(filePath)) return false;
+  const normalized = filePath.replaceAll("\\", "/");
+  const base = path5.posix.basename(normalized);
+  if (/(?:^|\/)(?:third_party|vendor|external|docs?|adr|changelogs?)(?:\/|$)/i.test(normalized)) return false;
+  if (/(?:^|\/)generated(?:\/|$)/i.test(normalized) || /\.(?:g|freezed)\.dart$|\.pb\.go$|\.generated\.[^.]+$|\.min\.(?:js|css)$/i.test(base) || /generated|do not edit/i.test(sample.split(/\r?\n/).slice(0, 3).join("\n"))) return false;
+  if (COVERAGE_STARLARK_BASENAMES.has(base) || /\.(?:bzl|bazel|star)$/i.test(base)) return true;
+  if (COVERAGE_CONFIG_BASENAMES.has(base) || /\.(?:lock|config|conf|ini|properties)$/i.test(base) || /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/i.test(normalized) || /^(?:Dockerfile(?:\..+)?|requirements(?:[-_.][^/]*)?\.txt|tsconfig(?:\.[^/]+)?\.json|(?:docker-)?compose(?:\.[^/]+)?\.ya?ml)$/i.test(base)) return false;
+  if (COVERAGE_SOURCE_EXTENSIONS.has(path5.posix.extname(base).toLowerCase())) return true;
+  const firstLine = sample.split(/\r?\n/, 1)[0] ?? "";
+  return /^#!.*\b(?:python3?|bash|sh|zsh|fish|node|ruby)\b/.test(firstLine);
+}
+function coverageSample(snapshot, filePath, binary) {
+  if (binary) return "";
+  try {
+    return fs5.readFileSync(path5.join(snapshot.repositoryRoot, filePath), "utf8").slice(0, 8192);
+  } catch {
+    return "";
+  }
+}
+function changedSymbolIdentity(symbol) {
+  return `${symbol.path}::${symbol.name} (${symbol.kind}, ${symbol.id})`;
+}
+function summarizeChangedSymbols(symbols) {
+  const identities = symbols.map(changedSymbolIdentity);
+  const shown = identities.slice(0, 20);
+  return `${shown.join(", ")}${identities.length > shown.length ? `, +${identities.length - shown.length} more (see evidence)` : ""}`;
+}
+function testCoverageCheck(snapshot, impactedTests, mappedSymbols) {
+  const tests = snapshot.files.filter((file) => isTestFileForCoverage(file.path));
+  const source = snapshot.files.filter((file) => isProductSourceForCoverage(file.path, coverageSample(snapshot, file.path, file.binary), file.binary));
+  const sourcePaths = new Set(source.map((file) => file.path.replaceAll("\\", "/")));
+  const changedSymbols = mappedSymbols.filter((symbol) => sourcePaths.has(symbol.path.replaceAll("\\", "/")));
+  const changedTestPaths = new Set(tests.map((file) => file.path.replaceAll("\\", "/")));
+  const changedRelatedTests = impactedTests.filter((file) => changedTestPaths.has(file.replaceAll("\\", "/")));
+  const state = !source.length || changedRelatedTests.length ? "PASS" : impactedTests.length ? "INCONCLUSIVE" : "FAIL";
+  const evidence = state === "PASS" ? (source.length ? changedRelatedTests : tests.map((file) => file.path)).map((file) => ({ kind: "path", value: file })) : impactedTests.length ? [
+    ...changedSymbols.map((symbol) => ({ kind: "changed_symbol", value: changedSymbolIdentity(symbol) })),
+    ...impactedTests.map((file) => ({ kind: "related_test", value: file }))
+  ] : changedSymbols.length ? changedSymbols.map((symbol) => ({ kind: "uncovered_symbol", value: changedSymbolIdentity(symbol) })) : source.map((file) => ({ kind: "path", value: file.path }));
+  const subject = changedSymbols.length ? `changed symbols ${summarizeChangedSymbols(changedSymbols)}` : `changed product source ${source.map((file) => file.path).join(", ")}`;
+  const reason = state === "FAIL" ? `No changed or statically related test covers ${subject}.` : state === "INCONCLUSIVE" ? `Related tests exist for ${subject}, but no result artifact proves they ran.` : source.length ? "A statically related test changed with the product behavior." : "No product code changed.";
+  return makeCheck({
+    evaluator: "test-coverage",
+    evaluatorVersion: "2",
+    title: "Changed behavior has test evidence",
+    state,
+    enforcement: "warn",
+    reason,
+    evidence,
+    refs: changedSymbols.map((symbol) => symbol.id)
+  });
+}
+function githubCheck(evidence) {
+  return makeCheck({ evaluator: "github-check", title: `CI check: ${String(evidence.payload.name)}`, state: evidence.state === "available" ? "PASS" : evidence.state === "failed" ? "FAIL" : evidence.state === "error" ? "ERROR" : "INCONCLUSIVE", enforcement: "block", reason: evidence.state === "available" ? "GitHub job succeeded." : evidence.state === "failed" ? `GitHub job concluded ${String(evidence.payload.conclusion)}.` : "GitHub job conclusion is unavailable.", evidence: [{ id: evidence.id, kind: evidence.kind, value: evidence.source }], refs: [] });
+}
+async function evaluateSemanticCriteria(plan, snapshot, config) {
+  const criteria = parseSectionItems(plan, "acceptance criteria").filter((line) => !parseInlineEvidence(line).length);
+  const results = [];
+  for (const criterion of criteria.slice(0, 20)) {
+    const judged = await withSpan("judge.evaluate", { criterion_length: criterion.length }, () => semanticJudge({ criterion, evidenceBundle: { changedFiles: snapshot.files, diff: snapshot.diff.slice(0, config.semantic.max_bytes) }, endpoint: config.semantic.endpoint, model: config.semantic.model, timeoutMs: config.semantic.timeout_ms, maxBytes: config.semantic.max_bytes }));
+    const state = !judged.available || !judged.result || judged.result.result === "uncertain" ? "INCONCLUSIVE" : judged.result.result === "supports" ? "PASS" : "FAIL";
+    results.push(makeCheck({ evaluator: "semantic-judge", title: criterion, state, enforcement: "warn", reason: judged.result?.reason ?? `Semantic evaluation unavailable: ${judged.error ?? "unknown error"}`, evidence: judged.result?.evidenceRefs.map((value) => ({ kind: "semantic_ref", value })) ?? [], refs: ["PLAN.md"] }));
+  }
+  return results;
+}
+function makeCheck(input) {
+  const evaluatorVersion = input.evaluatorVersion ?? "1";
+  const identity = { evaluator: input.evaluator, version: evaluatorVersion, title: input.title, state: input.state, evidence: input.evidence ?? [], refs: input.refs };
+  return { id: input.id ?? createId("check"), evaluator: input.evaluator, evaluatorVersion, title: input.title, state: input.state, enforcement: input.enforcement, reason: input.reason, evidence: input.evidence ?? [], refs: input.refs, ...input.owner ? { owner: input.owner } : {}, fingerprint: hashObject(identity) };
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function learnFromFinding(root, findingId) {
+  const store = new BrainStore(root);
+  try {
+    const finding = store.getFinding(findingId);
+    if (!finding) throw new Error(`finding not found: ${findingId}`);
+    const payload = finding.payload;
+    const id = `eval_${payload.fingerprint.slice(0, 16)}`;
+    const evalCase = evalCaseSchema.parse({
+      schema_version: "1",
+      id,
+      version: 1,
+      title: payload.title,
+      state: "draft",
+      owner: payload.owner,
+      origin: { kind: "confirmed_failure", finding_ref: findingId },
+      decision_refs: payload.refs.filter((ref) => ref.startsWith("decision_")),
+      signal_refs: payload.refs.filter((ref) => ref.startsWith("signal_")),
+      scope: { paths: { include: payload.evidence.filter((entry) => entry.kind === "path").map((entry) => entry.value).slice(0, 20).length ? payload.evidence.filter((entry) => entry.kind === "path").map((entry) => entry.value).slice(0, 20) : ["**"], exclude: [] } },
+      assertion: { kind: "required_evidence", description: payload.reason },
+      evidence: { all: [], any: [] },
+      enforcement: "observe",
+      fingerprint: payload.fingerprint
+    });
+    const filename = path5.join(root, ".scriptonia", "evals", `${id}.yaml`);
+    if (fs5.existsSync(filename)) throw new Error(`draft eval already exists: ${path5.relative(root, filename)}`);
+    fs5.mkdirSync(path5.dirname(filename), { recursive: true });
+    fs5.writeFileSync(filename, YAML2.stringify(evalCase));
+    return { path: filename, evalCase };
+  } finally {
+    store.close();
+  }
+}
+function acknowledgeFinding(root, findingId, reason, actor, comment) {
+  const store = new BrainStore(root);
+  try {
+    const finding = store.getFinding(findingId);
+    if (!finding) throw new Error(`finding not found: ${findingId}`);
+    const id = createId("ack");
+    store.acknowledge({ id, findingId, reason, comment, actor, snapshotId: String(finding.snapshot_id) });
+    return id;
+  } finally {
+    store.close();
+  }
+}
+function evalDoctor(root) {
+  const { evals, errors } = loadEvals(root);
+  const { decisions } = loadDecisions(root);
+  const issues = errors.map((message) => ({ kind: "invalid", id: "definition", message }));
+  const activeDecisions = new Map(decisions.filter((entry) => entry.state === "active").map((entry) => [entry.id, entry]));
+  const fingerprints = /* @__PURE__ */ new Map();
+  for (const evaluation of evals) {
+    if (!evaluation.owner) issues.push({ kind: "missing_owner", id: evaluation.id, message: "Eval has no owner." });
+    if (evaluation.review_after && Date.parse(evaluation.review_after) < Date.now() && evaluation.state === "active") issues.push({ kind: "expired_review", id: evaluation.id, message: `Review date passed: ${evaluation.review_after}` });
+    for (const ref of evaluation.decision_refs) if (!activeDecisions.has(ref) && evaluation.state === "active") issues.push({ kind: "stale_decision", id: evaluation.id, message: `Referenced decision is not active: ${ref}` });
+    const fingerprint = evaluation.fingerprint ?? hashObject({ assertion: evaluation.assertion, scope: evaluation.scope, origin: evaluation.origin, evidence: evaluation.evidence });
+    const duplicate = fingerprints.get(fingerprint);
+    if (duplicate) issues.push({ kind: "duplicate", id: evaluation.id, message: `Duplicates ${duplicate}.` });
+    else fingerprints.set(fingerprint, evaluation.id);
+  }
+  return { healthy: issues.length === 0, issues };
+}
+function toSarif(result) {
+  const actionable = result.checks.filter((check) => check.state === "FAIL" || check.state === "ERROR" || check.state === "INCONCLUSIVE");
+  return { version: "2.1.0", $schema: "https://json.schemastore.org/sarif-2.1.0.json", runs: [{ tool: { driver: { name: "Scriptonia", version: "0.9.0-rc.2", informationUri: "https://scriptonia.dev", rules: [...new Map(actionable.map((check) => [check.evaluator, { id: check.evaluator, name: check.evaluator, shortDescription: { text: check.title } }])).values()] } }, results: actionable.map((check) => ({ ruleId: check.evaluator, level: check.enforcement === "block" ? "error" : "warning", message: { text: `${check.title}: ${check.reason}` }, properties: { state: check.state, enforcement: check.enforcement, fingerprint: check.fingerprint, refs: check.refs } })) }] };
+}
+
+// ../packages/github/src/index.ts
+function githubStepSummary(result) {
+  const lines = [`# Scriptonia gate: ${result.gate}`, "", `Snapshot: \`${result.snapshotId}\``, "", "| State | Check | Reason |", "|---|---|---|"];
+  for (const check of result.checks) lines.push(`| ${check.state} | ${escapeCell(check.title)} | ${escapeCell(check.reason)} |`);
+  return `${lines.join("\n")}
+`;
+}
+function escapeCell(value) {
+  return value.replaceAll("|", "\\|").replaceAll("\n", " ");
+}
+
+// ../packages/run-capture/src/index.ts
+import { spawn } from "child_process";
+import fs6 from "fs";
+import path6 from "path";
+
+// ../packages/run-protocol/src/index.ts
+var BUILTIN_PATTERNS = [
+  /\b(?:sk|sk-ant|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{12,}\b/g,
+  /\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/gi,
+  /\b[A-Za-z0-9_-]*(?:TOKEN|SECRET|PASSWORD|API_KEY)\s*[=:]\s*[^\s,;]+/gi
+];
+function redact(value, options = {}) {
+  const secrets = (options.envNames ?? []).map((name) => process.env[name]).filter((entry) => Boolean(entry && entry.length >= 4));
+  const custom = (options.patterns ?? []).map((pattern) => new RegExp(pattern, "gi"));
+  let text = JSON.stringify(value);
+  const original = text;
+  for (const secret of secrets) text = text.replaceAll(secret, "[REDACTED]");
+  for (const pattern of [...BUILTIN_PATTERNS, ...custom]) text = text.replace(pattern, "[REDACTED]");
+  const maxBytes = options.maxBytes ?? 128e3;
+  if (Buffer.byteLength(text) > maxBytes) text = JSON.stringify({ truncated: true, bytes: Buffer.byteLength(text), preview: text.slice(0, maxBytes - 128) });
+  try {
+    return { value: JSON.parse(text), applied: text !== original };
+  } catch {
+    return { value: "[REDACTED:invalid-payload]", applied: true };
+  }
+}
+function createEvent(input) {
+  const sanitized = redact(input.payload, input.redaction);
+  return runEventSchema.parse({
+    schemaVersion: "1",
+    eventId: createId("event"),
+    runId: input.runId,
+    sequence: input.sequence,
+    occurredAt: nowIso(),
+    source: { adapter: input.adapter ?? "explicit-wrapper", adapterVersion: "1", ...input.agent ? { agent: input.agent } : {} },
+    type: input.type,
+    payload: sanitized.value,
+    redaction: { applied: sanitized.applied, policyVersion: "1" }
+  });
+}
+function parseJsonl(text) {
+  if (Buffer.byteLength(text) > 1e7) throw new Error("JSONL payload exceeds 10 MB limit");
+  return text.split("\n").filter(Boolean).map((line, index) => {
+    if (Buffer.byteLength(line) > 512e3) throw new Error(`JSONL line ${index + 1} exceeds 512 KB limit`);
+    return runEventSchema.parse(JSON.parse(line));
+  });
+}
+function normalizeCodexJsonl(text, importedRunId = createId("run")) {
+  if (Buffer.byteLength(text) > 1e7) throw new Error("Codex JSONL payload exceeds 10 MB limit");
+  let sequence = 0;
+  const events = [];
+  for (const [index, line] of text.split("\n").filter(Boolean).entries()) {
+    if (Buffer.byteLength(line) > 512e3) throw new Error(`Codex JSONL line ${index + 1} exceeds 512 KB limit`);
+    const raw = JSON.parse(line);
+    const type = String(raw.type ?? raw.event ?? "");
+    const payload = raw.payload ?? raw.item ?? raw;
+    let normalized = "tool.completed";
+    if (/session_meta|thread\.started|turn\.started|run\.started/.test(type)) normalized = "run.started";
+    else if (/turn\.completed|thread\.completed|run\.finished/.test(type)) normalized = "run.finished";
+    else if (/error|failed/.test(type)) normalized = "error";
+    else if (/file_change|file\.changed/.test(type) || payload.type === "file_change") normalized = "file.changed";
+    else if (/command.*requested|command_execution.*started/.test(type)) normalized = "command.requested";
+    else if (/tool.*requested|item\.started/.test(type)) normalized = "tool.requested";
+    events.push(createEvent({ runId: String(raw.runId ?? raw.thread_id ?? importedRunId), sequence: sequence++, type: normalized, payload: raw, adapter: "codex-jsonl", agent: "codex" }));
+  }
+  return events;
+}
+
+// ../packages/run-capture/src/index.ts
+async function captureCommand(input) {
+  if (!input.command.length || !input.command[0]) throw new Error("usage: scriptonia run -- <command> [args...]");
+  const store = new BrainStore(input.root);
+  const runId = createId("run");
+  const before = buildSnapshot({ cwd: input.root, base: "HEAD" });
+  const beforeHashes = snapshotFileHashes(input.root, before.files);
+  let sequence = 0;
+  const persist = (type, payload) => {
+    const event = createEvent({ runId, sequence: sequence++, type, payload, adapter: input.adapter, agent: input.agent, redaction: input.redaction });
+    store.appendEvent({ eventId: event.eventId, runId, sequence: event.sequence, occurredAt: event.occurredAt, type: event.type, payload: event.payload, redacted: event.redaction.applied });
+  };
+  store.createRun({ id: runId, adapter: input.adapter ?? "explicit-wrapper", command: input.command, startedAt: nowIso(), baseSha: before.headSha });
+  persist("run.started", { baseSha: before.headSha, dirty: before.dirty });
+  persist("command.requested", { argv: input.command, cwd: ".", inheritedAuthority: true });
+  let exitCode = 1;
+  try {
+    exitCode = await new Promise((resolve, reject) => {
+      const child = spawn(input.command[0], input.command.slice(1), { cwd: input.root, stdio: "inherit", shell: false, env: process.env });
+      child.once("error", reject);
+      child.once("exit", (code, signal) => resolve(code ?? (signal ? 128 : 1)));
+    });
+    const after = buildSnapshot({ cwd: input.root, base: before.headSha });
+    const afterHashes = snapshotFileHashes(input.root, after.files);
+    const changedByCommand = after.files.filter((file) => beforeHashes.get(file.path) !== afterHashes.get(file.path));
+    for (const file of changedByCommand) persist("file.changed", { path: file.path, status: file.status, binary: file.binary });
+    persist("run.finished", { exitCode, headSha: after.headSha, diffHash: after.diffHash, changedFiles: changedByCommand.length });
+    store.finishRun({ id: runId, finishedAt: nowIso(), headSha: after.headSha, diffHash: after.diffHash, exitCode, status: exitCode === 0 ? "completed" : "failed" });
+    return { runId, exitCode };
+  } catch (error) {
+    persist("error", { message: error instanceof Error ? error.message : String(error) });
+    store.finishRun({ id: runId, finishedAt: nowIso(), exitCode, status: "error" });
+    throw error;
+  } finally {
+    store.close();
+  }
+}
+function snapshotFileHashes(root, files) {
+  const hashes = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    if (file.status === "deleted") {
+      hashes.set(file.path, "deleted");
+      continue;
+    }
+    try {
+      hashes.set(file.path, sha256(fs6.readFileSync(path6.join(root, file.path))));
+    } catch {
+      hashes.set(file.path, "unreadable");
+    }
+  }
+  return hashes;
+}
+function ingestJsonl(root, text, adapter = "normalized") {
+  const events = adapter === "codex" ? normalizeCodexJsonl(text) : parseJsonl(text);
+  if (!events.length) return 0;
+  const store = new BrainStore(root);
+  try {
+    const runIds = new Set(events.map((event) => event.runId));
+    for (const runId of runIds) if (!store.getRun(runId)) store.createRun({ id: runId, adapter: events.find((event) => event.runId === runId)?.source.adapter ?? adapter, command: ["imported-events"], startedAt: events.find((event) => event.runId === runId)?.occurredAt ?? nowIso() });
+    for (const event of events) store.appendEvent({ eventId: event.eventId, runId: event.runId, sequence: event.sequence, occurredAt: event.occurredAt, type: event.type, payload: event.payload, redacted: event.redaction.applied });
+    for (const runId of runIds) store.finishRun({ id: runId, finishedAt: nowIso(), exitCode: 0, status: "imported" });
+    return events.length;
+  } finally {
+    store.close();
+  }
+}
+
+// src/brain-commands.ts
+import fs8 from "fs";
+import path8 from "path";
+import { spawnSync } from "child_process";
+import pc from "picocolors";
+
+// src/brain-knowledge-http.ts
+function apiOrigin(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new TypeError("Scriptonia URL must use http or https");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol === "http:" && !loopback) {
+    throw new TypeError("Scriptonia URL must use HTTPS except for an explicit loopback address");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function responseIssue(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return "unexpected response";
+  const record3 = value;
+  const error = typeof record3.error === "string" ? record3.error : "request_failed";
+  const message = typeof record3.message === "string" ? record3.message : void 0;
+  const issues = Array.isArray(record3.issues) ? record3.issues.map((entry) => typeof entry === "string" ? entry : JSON.stringify(entry)).join("; ") : void 0;
+  return [error, message, issues].filter(Boolean).join(": ");
+}
+function createBrainKnowledgeHttpProvider(options) {
+  const baseUrl = apiOrigin(options.baseUrl.trim());
+  const apiKey = options.apiKey.trim();
+  if (!apiKey) throw new TypeError("Scriptonia API key cannot be empty");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  return {
+    id: "scriptonia-brain-extract-http",
+    version: "1",
+    async extract(call) {
+      const response = await fetchImpl(`${baseUrl}/api/brain/extract`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${apiKey}`,
+          "content-type": "application/json"
+        },
+        // The server endpoint owns model selection and repair. It accepts the
+        // stable BrainExtractRequestV1 contract, never provider internals.
+        body: JSON.stringify(call.request),
+        signal: call.signal
+      });
+      const value = await response.json().catch(() => void 0);
+      if (!response.ok) {
+        throw new Error(`Scriptonia brain extraction failed (${response.status}): ${responseIssue(value)}`);
+      }
+      const parsed = brainExtractResponseV1Schema.safeParse(value);
+      if (!parsed.success) {
+        throw new Error(`Scriptonia brain extraction returned an invalid response: ${parsed.error.message}`);
+      }
+      return {
+        output: parsed.data,
+        usage: {
+          inputTokens: parsed.data.usage.input_tokens,
+          outputTokens: parsed.data.usage.output_tokens,
+          modelCalls: parsed.data.usage.calls
+        },
+        metadata: {
+          ...response.headers.get("x-scriptonia-model")?.trim() ? { model: response.headers.get("x-scriptonia-model").trim() } : {},
+          ...response.headers.get("x-scriptonia-provider-revision")?.trim() ? { providerRevision: response.headers.get("x-scriptonia-provider-revision").trim() } : {},
+          ...response.headers.get("x-scriptonia-response-id")?.trim() ? { responseId: response.headers.get("x-scriptonia-response-id").trim() } : {}
+        }
+      };
+    }
+  };
+}
+
+// src/local-binding.ts
+import fs7 from "fs";
+import os from "os";
+import path7 from "path";
+function readJson(filename) {
+  try {
+    return JSON.parse(fs7.readFileSync(filename, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function realPath(value) {
+  try {
+    return fs7.realpathSync(value);
+  } catch {
+    return path7.resolve(value);
+  }
+}
+function findLocalProjectBinding(repoRoot, home = os.homedir()) {
+  const configRoot = path7.join(home, ".scriptonia");
+  const global = record(readJson(path7.join(configRoot, "config.json")));
+  if (typeof global?.url !== "string" || !global.url.trim()) return void 0;
+  const projectsRoot = path7.join(configRoot, "projects");
+  if (!fs7.existsSync(projectsRoot)) return void 0;
+  const target = realPath(repoRoot);
+  let selected;
+  for (const entry of fs7.readdirSync(projectsRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const value = record(readJson(path7.join(projectsRoot, entry.name, "project.json")));
+    if (typeof value?.repoPath !== "string" || typeof value.token !== "string" || !value.token.trim()) continue;
+    const candidate = realPath(value.repoPath);
+    if (target !== candidate && !target.startsWith(`${candidate}${path7.sep}`)) continue;
+    if (!selected || candidate.length > selected.root.length) selected = { root: candidate, value };
+  }
+  if (!selected || typeof selected.value.token !== "string") return void 0;
+  return {
+    baseUrl: global.url.trim(),
+    apiKey: selected.value.token.trim(),
+    ...typeof selected.value.projectId === "string" ? { projectId: selected.value.projectId } : {},
+    ...typeof selected.value.name === "string" ? { projectName: selected.value.name } : {}
+  };
+}
+
+// src/brain-commands.ts
+var STATUS_CHANGED_PATH_LIMIT = 50;
+var STATUS_GIT_TIMEOUT_MS = 125;
+var STATUS_GIT_OUTPUT_LIMIT = 512 * 1024;
+var STATUS_STAGE_LIMIT = 64;
+var WHY_FACT_LIMIT = 12;
+function registerBrainCommands(program) {
+  const brain = program.command("brain").description("Build and inspect the deterministic repository Deep Brain");
+  brain.command("build").description("Build a new immutable Deep Brain generation").option("--fast", "run the deterministic fast pipeline").option("--deep", "run the full pipeline, including optional enrichment when available").option("--offline", "forbid network/model enrichment and use local deterministic evidence only").option("--github", "mine bounded GitHub pull-request evidence when credentials are available").option("--show-prompts", "store and reveal the exact credential-screened model inputs").option("--force", "request a hard-gate bypass (always rejected; faulty brains are never activated)").option("--json", "print a machine-readable build summary").action(async (options) => {
+    if (options.fast && options.deep) {
+      emitBuildError("--fast and --deep are mutually exclusive", Boolean(options.json));
+      process.exitCode = 2;
+      return;
+    }
+    if (options.force) {
+      emitBuildError("--force is intentionally rejected: Deep Brain hard gates cannot be bypassed, and a faulty generation is never activated", Boolean(options.json), 1);
+      process.exitCode = 1;
+      return;
+    }
+    const root = findRepositoryRoot();
+    const mode = options.fast ? "fast" : options.deep ? "deep" : "incremental";
+    try {
+      const offline = Boolean(options.offline);
+      const binding = mode === "deep" && !offline ? findLocalProjectBinding(root) : void 0;
+      if (mode === "deep" && !offline && !binding) {
+        throw new Error("Online deep build needs this repository's Scriptonia project binding. Run `npx scriptonia login` and `npx scriptonia init`, or use `--offline`.");
+      }
+      const result = await buildBrain(root, {
+        mode,
+        offline,
+        github: { enabled: Boolean(options.github), offline },
+        ...binding ? { knowledgeProvider: createBrainKnowledgeHttpProvider(binding) } : {},
+        showPrompts: Boolean(options.showPrompts),
+        ...options.showPrompts && !options.json ? {
+          onKnowledgeInspection(artifact) {
+            const attempt = artifact.attempt === void 0 ? "" : ` \xB7 attempt ${artifact.attempt}`;
+            console.log(`  ${pc.magenta("model input").padEnd(12)} ${artifact.kind} \xB7 ${artifact.content}${attempt} \xB7 ${path8.relative(root, artifact.path)}`);
+          }
+        } : {},
+        ...options.json ? {} : {
+          onProgress(event) {
+            const detail = event.detail ? ` \xB7 ${event.detail}` : "";
+            const elapsed = event.elapsedMs === void 0 ? "" : ` \xB7 ${Math.round(event.elapsedMs)}ms`;
+            const state = event.status === "failed" ? pc.red(event.status) : event.status === "skipped" || event.status === "partial" ? pc.yellow(event.status) : event.status === "succeeded" ? pc.green(event.status) : pc.cyan(event.status);
+            console.log(`  ${state.padEnd(12)} ${event.stage}${elapsed}${detail}`);
+          }
+        }
+      });
+      if (options.json) console.log(JSON.stringify(summarizeBuild(result, mode, offline), null, 2));
+      else emitBuildResult(result, mode, offline);
+      if (!result.activated) process.exitCode = 1;
+    } catch (error) {
+      emitBuildError(errorMessage(error), Boolean(options.json));
+      process.exitCode = 2;
+    }
+  });
+  brain.command("status").description("Show the active generation, storage, coverage, staleness, and failures").option("--json", "print machine-readable status").option("--check", "exhaustively compare every repository file with the active generation").action((options) => {
+    const root = findRepositoryRoot();
+    const report = readBrainStatus(root, { check: Boolean(options.check) });
+    if (options.json) console.log(JSON.stringify(report, null, 2));
+    else emitBrainStatus(report);
+    if (report.state === "MISSING") process.exitCode = 1;
+  });
+}
+function readBrainStatus(root, options = {}) {
+  const filename = path8.join(root, ".scriptonia", "brain.db");
+  if (!fs8.existsSync(filename)) return missingStatus(0, []);
+  const store = new BrainStore(root);
+  try {
+    return readBrainStatusFromStore(root, store, { ...options, quickCheck: true });
+  } finally {
+    store.close();
+  }
+}
+function readBrainStatusFromStore(root, store, options = {}) {
+  const activeBuild = store.deep.getActiveBuild();
+  const activeGeneration = store.deep.getActiveGeneration();
+  const recentBuilds = store.deep.listBuilds(10);
+  const emptyStorage = storageSummary(store, 0);
+  if (!activeBuild || !activeGeneration || activeGeneration.buildId !== activeBuild.id) {
+    const failures2 = recentBuildFailures(recentBuilds);
+    if (!activeBuild && failures2.length === 0) failures2.push({ source: "build", code: "NO_ACTIVE_GENERATION", message: "No READY Deep Brain generation is active." });
+    return missingStatus(storageTotal(emptyStorage), failures2, emptyStorage);
+  }
+  const aggregate = readStatusAggregate(store, activeBuild.id);
+  const storage = storageSummary(store, aggregate.activeObjectBytes);
+  const coverage = parseCoverage(activeBuild.coverage);
+  const failures = [];
+  if (!coverage) failures.push({ source: "coverage", code: "COVERAGE_MISSING", message: "The active generation has no readable coverage report.", build_id: activeBuild.id });
+  else for (const check of coverage.checks.filter((entry) => !entry.passed)) {
+    failures.push({ source: "coverage", code: check.id, message: check.message, build_id: activeBuild.id, diagnostics: check.diagnostics });
+  }
+  failures.push(...recentBuildFailures(recentBuilds.filter((build) => build.startedAt > activeBuild.startedAt)));
+  const stageTimings = readStageTimings(store, activeBuild.id);
+  const buildTiming = buildTimingFor(activeBuild);
+  const knowledgeFreshness = knowledgeFreshnessFor(stageTimings, coverage);
+  const planQualityEvidence = store.planQuality.latestForActiveGeneration();
+  const brainScore = coverage ? scoreBrain(coverage, buildTiming, planQualityEvidence) : null;
+  let staleness;
+  if (options.check) {
+    try {
+      const current = inspectRepository(root, store.deep.listFiles(activeBuild.id));
+      const stale = current.snapshotHash !== activeBuild.identity.repositorySnapshotId;
+      const visible = current.changedPaths.slice(0, STATUS_CHANGED_PATH_LIMIT);
+      staleness = {
+        is_stale: stale,
+        checked_snapshot_hash: current.snapshotHash,
+        changed_file_count: current.changedPaths.length,
+        changed_paths: visible,
+        changed_paths_omitted: current.changedPaths.length - visible.length,
+        check: "EXHAUSTIVE",
+        proof: "EXACT",
+        detail: stale ? "Every repository file was hashed; the active generation differs." : "Every repository file was hashed; the active generation matches exactly.",
+        current_head: null,
+        working_tree_dirty: null,
+        candidate_changed_file_count: 0,
+        candidate_changed_paths: [],
+        candidate_changed_paths_omitted: 0
+      };
+      if (stale && current.changedPaths.length === 0) {
+        failures.push({
+          source: "staleness",
+          code: "SNAPSHOT_METADATA_CHANGED",
+          message: "The repository snapshot changed without a content-hash delta; rebuild to refresh classification/configuration evidence.",
+          build_id: activeBuild.id
+        });
+      }
+    } catch (error) {
+      staleness = unknownStaleness("EXHAUSTIVE", `Exhaustive staleness check failed: ${errorMessage(error)}`);
+      failures.push({ source: "staleness", code: "STALENESS_CHECK_FAILED", message: errorMessage(error), build_id: activeBuild.id });
+    }
+  } else if (options.quickCheck === false) {
+    staleness = unknownStaleness("FAST", "Quick Git observation was disabled; run `scriptonia brain status --check` for an exact result.");
+  } else {
+    staleness = inspectRepositoryFast(root);
+  }
+  return {
+    schema_version: "1",
+    state: "READY",
+    size_bytes: storageTotal(storage),
+    generation: {
+      number: activeGeneration.generation,
+      build_id: activeBuild.id,
+      build_snapshot_hash: activeBuild.snapshotId,
+      repository_snapshot_hash: activeBuild.identity.repositorySnapshotId,
+      git_evidence_anchor: aggregate.gitEvidenceAnchor
+    },
+    counts: aggregate.counts,
+    coverage,
+    parser_runtime: parserRuntimeStatus(aggregate.astRuntime),
+    storage,
+    stage_timings: stageTimings.map(({ metrics: _metrics, ...stage }) => stage),
+    build_timing: buildTiming,
+    brain_score: brainScore,
+    knowledge_freshness: knowledgeFreshness,
+    staleness,
+    failures
+  };
+}
+function explainDeepBrain(root, inputTarget) {
+  const status = readBrainStatus(root);
+  if (status.state !== "READY" || !status.generation) {
+    return { available: false, generation: null, stale: status.staleness.is_stale, target: null, role: null, ownership: [], signals: [], plans: [], facts: [], dependents: [], related_tests: [] };
+  }
+  const store = new BrainStore(root);
+  try {
+    const activeBuild = store.deep.getActiveBuild();
+    if (!activeBuild) return { available: false, generation: null, stale: null, target: null, role: null, ownership: [], signals: [], plans: [], facts: [], dependents: [], related_tests: [] };
+    const files = store.deep.listFiles(activeBuild.id);
+    const target = resolveWhyTarget(root, store, activeBuild.id, files, inputTarget);
+    if (!target) {
+      return {
+        available: false,
+        generation: status.generation,
+        stale: status.staleness.is_stale,
+        target: null,
+        role: null,
+        ownership: [],
+        signals: [],
+        plans: [],
+        facts: [],
+        dependents: [],
+        related_tests: [],
+        context_error: `No repository file or symbol matched "${inputTarget.trim()}".`
+      };
+    }
+    const relativePath = target.path;
+    let repositoryState;
+    let stale = status.staleness.is_stale;
+    try {
+      repositoryState = inspectRepository(root, files);
+    } catch {
+    }
+    if (repositoryState) stale = repositoryState.snapshotHash !== activeBuild.identity.repositorySnapshotId;
+    const impact = createBrainImpactProvider(store.deep, { root });
+    const traversal = impact?.dependents({ files: [relativePath] }, 2);
+    const dependents = [...new Set((traversal?.files ?? []).filter((entry) => entry !== relativePath))].sort();
+    const relatedTests2 = [...new Set(impact?.relatedTests({ files: [relativePath] }) ?? [])].sort();
+    const metric = store.deep.getFileGraphMetric(relativePath, activeBuild.id);
+    const rank = store.deep.getFileGraphRank(relativePath, activeBuild.id);
+    const role = metric && rank ? {
+      cluster: metric.cluster,
+      component_id: metric.componentId,
+      core_score: metric.coreScore,
+      hotspot_score: metric.hotspotScore,
+      churn_score: metric.churnScore,
+      core_rank: rank.coreRank,
+      hotspot_rank: rank.hotspotRank,
+      total_files: rank.totalFiles
+    } : null;
+    const exactFacts = store.deep.findContextFactsByExactPaths([relativePath], activeBuild.id);
+    const ownership = exactFacts.filter((fact) => fact.kind === "ownership").flatMap((fact) => ownershipFromPayload(fact.payload));
+    const signals = store.searchSignalsMentioning(relativePath, 10).map((entry) => ({
+      id: entry.id,
+      source: entry.source,
+      excerpt: entry.excerpt,
+      created_at: entry.createdAt
+    }));
+    const plans = store.searchPlansMentioning(relativePath, 10).map((entry) => ({
+      id: entry.id,
+      version: entry.version,
+      state: entry.state,
+      excerpt: entry.excerpt,
+      created_at: entry.createdAt
+    }));
+    const localPlan = localPlanMention(root, relativePath);
+    if (localPlan && !plans.some((entry) => entry.id === localPlan.id && entry.version === localPlan.version)) plans.unshift(localPlan);
+    let pack;
+    let contextError;
+    if (repositoryState && repositoryState.snapshotHash !== activeBuild.identity.repositorySnapshotId && repositoryState.changedPaths.length === 0) {
+      contextError = "Deep Brain is stale because repository metadata changed; rebuild before trusting focused context.";
+    } else {
+      try {
+        const focusedQuery = target.kind === "symbol" && target.symbol ? `Explain symbol "${target.symbol.name}" and the impact of "${relativePath}"` : `Explain the impact of "${relativePath}"`;
+        pack = buildContextPack(store.deep, focusedQuery, {
+          repositoryRoot: root,
+          maxItems: WHY_FACT_LIMIT,
+          maxBytes: 6e4,
+          graph: createContextGraphExpansionAdapter(store.deep),
+          ...repositoryState ? {
+            currentSnapshotHash: repositoryState.snapshotHash,
+            changedPaths: repositoryState.changedPaths
+          } : {}
+        });
+      } catch (error) {
+        contextError = errorMessage(error);
+      }
+    }
+    const facts = pack?.sections.flatMap((section) => section.facts.map((fact) => ({
+      section: section.kind,
+      id: fact.fact_id,
+      title: fact.title,
+      kind: fact.kind,
+      path: fact.source.path,
+      start_line: fact.source.start_line,
+      end_line: fact.source.end_line,
+      relevance: fact.relevance
+    }))) ?? [];
+    return {
+      available: true,
+      generation: status.generation,
+      stale,
+      target,
+      role,
+      ownership,
+      signals,
+      plans,
+      facts,
+      dependents,
+      related_tests: relatedTests2,
+      ...contextError ? { context_error: contextError } : {}
+    };
+  } finally {
+    store.close();
+  }
+}
+function resolveWhyTarget(root, store, buildId, files, input) {
+  const query = input.trim();
+  if (!query || query.length > 500) return void 0;
+  const knownPaths = new Set(files.map((file) => file.path));
+  try {
+    const relative = path8.relative(root, assertInside(root, path8.resolve(root, query))).replaceAll("\\", "/");
+    if (knownPaths.has(relative)) return { input: query, kind: "file", path: relative, alternatives: [] };
+  } catch {
+  }
+  const exact = store.deep.findContextSymbolsByExactNames([query], buildId);
+  const match = exact.length > 0 ? "exact" : "trigram";
+  const candidates = exact.length > 0 ? exact : store.deep.findContextSymbolsByTrigram([query], 20, buildId);
+  if (candidates.length === 0) return void 0;
+  const ranked = rankWhySymbols(store, buildId, candidates);
+  const selected = ranked[0];
+  return {
+    input: query,
+    kind: "symbol",
+    path: selected.filePath,
+    symbol: { id: selected.id, name: selected.name, kind: selected.kind, match },
+    alternatives: ranked.slice(1, 6).map((symbol) => ({ id: symbol.id, name: symbol.name, kind: symbol.kind, path: symbol.filePath }))
+  };
+}
+function rankWhySymbols(store, buildId, symbols) {
+  const scores = /* @__PURE__ */ new Map();
+  for (const symbol of symbols) {
+    if (!scores.has(symbol.filePath)) scores.set(symbol.filePath, store.deep.getFileGraphMetric(symbol.filePath, buildId)?.coreScore ?? 0);
+  }
+  return [...symbols].sort((left, right) => (scores.get(right.filePath) ?? 0) - (scores.get(left.filePath) ?? 0) || left.name.localeCompare(right.name) || left.filePath.localeCompare(right.filePath) || left.id.localeCompare(right.id));
+}
+function ownershipFromPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return [];
+  const record3 = payload;
+  if (record3.advisory !== true || record3.source !== "codeowners" && record3.source !== "git_author") return [];
+  if (typeof record3.confidence !== "number" || !Number.isFinite(record3.confidence) || !Array.isArray(record3.principals)) return [];
+  const principals = record3.principals.flatMap((principal) => {
+    if (!principal || typeof principal !== "object" || Array.isArray(principal)) return [];
+    const value = principal;
+    if (value.kind !== "codeowners" && value.kind !== "git_author" || typeof value.value !== "string" || !value.value.trim()) return [];
+    return [{ kind: value.kind, value: value.value }];
+  });
+  if (!principals.length) return [];
+  return [{ source: record3.source, principals, confidence: record3.confidence, advisory: true, evidence: record3.evidence ?? null }];
+}
+function localPlanMention(root, relativePath) {
+  const filename = path8.join(root, "PLAN.md");
+  if (!fs8.existsSync(filename)) return void 0;
+  let body;
+  try {
+    body = fs8.readFileSync(filename, "utf8");
+  } catch {
+    return void 0;
+  }
+  const index = body.indexOf(relativePath);
+  if (index < 0) return void 0;
+  const start = Math.max(0, index - 160);
+  const end = Math.min(body.length, index + relativePath.length + 240);
+  const excerpt = body.slice(start, end).replace(/[\r\n]+/g, " ").trim();
+  let createdAt = (/* @__PURE__ */ new Date(0)).toISOString();
+  try {
+    createdAt = fs8.statSync(filename).mtime.toISOString();
+  } catch {
+  }
+  return { id: "PLAN.md", version: 1, state: "local", excerpt, created_at: createdAt };
+}
+function summarizeBuild(result, mode, offline) {
+  return {
+    schema_version: "1",
+    state: result.activated ? "READY" : "FAILED",
+    exit_code: result.activated ? 0 : 1,
+    mode,
+    offline,
+    changed: result.changed,
+    activated: result.activated,
+    build_id: result.build.id,
+    active_build_id: result.activeBuildId ?? null,
+    repository_snapshot_hash: result.repositorySnapshotId,
+    files: result.census.files.length,
+    ast: {
+      candidates: result.ast.candidates,
+      parsed: result.ast.parsed,
+      partial: result.ast.partial,
+      failed: result.ast.failed,
+      unsupported: result.ast.unsupported,
+      parser_runtimes: result.ast.parserRuntimes,
+      by_language: result.ast.byLanguage
+    },
+    coverage: result.coverage,
+    stages: result.stages.map((stage) => ({ name: stage.name, required: stage.required, status: stage.status, elapsed_ms: Math.round(stage.elapsedMs), ...stage.error ? { error: stage.error } : {} })),
+    github: result.github ? { status: result.github.status, result_id: result.github.resultId } : null,
+    model_inputs: result.knowledge?.inputInspections?.map((artifact) => ({
+      kind: artifact.kind,
+      content: artifact.content,
+      attempt: artifact.attempt ?? null,
+      hash: artifact.hash,
+      size_bytes: artifact.sizeBytes,
+      path: path8.relative(result.census.root, artifact.path)
+    })) ?? [],
+    projections: result.projections.map((filename) => path8.basename(filename))
+  };
+}
+function emitBuildResult(result, mode, offline) {
+  const state = result.activated ? pc.green("READY") : pc.red("FAILED");
+  console.log(`
+${pc.bold("DEEP BRAIN BUILD")} \xB7 ${state}`);
+  console.log(`  mode        ${mode}${offline ? " \xB7 offline" : ""}${result.changed ? "" : " \xB7 unchanged"}`);
+  console.log(`  files       ${result.census.files.length} \xB7 syntax ${result.ast.parsed + result.ast.partial}/${result.ast.candidates} successful`);
+  console.log(`  Tree-sitter ${result.ast.parserRuntimes["web-tree-sitter"].parsed + result.ast.parserRuntimes["web-tree-sitter"].partial}/${result.ast.parserRuntimes["web-tree-sitter"].candidates}`);
+  console.log(`  structural ${result.ast.parserRuntimes["structural-fallback"].parsed + result.ast.parserRuntimes["structural-fallback"].partial}/${result.ast.parserRuntimes["structural-fallback"].candidates} \xB7 explicitly non-Tree-sitter`);
+  if (result.ast.parserRuntimes.unavailable.candidates > 0) {
+    console.log(`  unavailable ${result.ast.parserRuntimes.unavailable.candidates}`);
+  }
+  console.log(`  coverage    ${result.coverage.passed ? pc.green("PASS") : pc.red("FAIL")}`);
+  for (const check of result.coverage.checks.filter((entry) => !entry.passed)) {
+    console.log(`              ${pc.red(check.id)} \xB7 ${check.message}`);
+    emitCoverageDiagnostics(check.diagnostics, "                ");
+  }
+  console.log(`  snapshot    ${result.repositorySnapshotId}`);
+  console.log(`  build       ${result.build.id}`);
+  if (!result.activated) console.log(`
+  ${pc.red("Not activated.")} The previous READY generation, if any, remains untouched.`);
+  console.log("");
+}
+function emitBuildError(message, json, exitCode = 2) {
+  if (json) console.log(JSON.stringify({ schema_version: "1", state: "FAILED", exit_code: exitCode, error: message }, null, 2));
+  else console.error(`
+${pc.bold("DEEP BRAIN BUILD")} \xB7 ${pc.red("FAILED")}
+  ${message}
+  No previous READY generation was deleted.
+`);
+}
+function emitBrainStatus(report) {
+  if (report.state === "MISSING" || !report.generation) {
+    console.log(`
+${pc.bold("DEEP BRAIN STATUS")} \xB7 ${pc.yellow("NOT BUILT")}`);
+    console.log("  Run: scriptonia brain build --fast --offline");
+    for (const failure of report.failures) {
+      console.log(`  ${pc.red(failure.code)} \xB7 ${failure.message}`);
+      if (failure.diagnostics) emitCoverageDiagnostics(failure.diagnostics, "    ");
+    }
+    console.log("");
+    return;
+  }
+  const freshness = report.staleness.is_stale === false ? pc.green("fresh") : report.staleness.is_stale === true ? pc.yellow("stale") : pc.yellow("unknown freshness");
+  const coverage = report.coverage?.passed ? pc.green("PASS") : pc.red("FAIL");
+  console.log(`
+${pc.bold("DEEP BRAIN STATUS")} \xB7 ${pc.green(report.state)}`);
+  console.log(`  generation  ${report.generation.number} \xB7 ${report.generation.build_id}`);
+  console.log(`  snapshot    ${report.generation.repository_snapshot_hash} \xB7 ${freshness}`);
+  if (report.generation.git_evidence_anchor) console.log(`  git anchor  ${report.generation.git_evidence_anchor} \xB7 bounded history evidence, not a freshness proof`);
+  console.log(`  size        ${formatBytes(report.size_bytes)}`);
+  console.log(`  contents    ${report.counts.files} files \xB7 ${report.counts.symbols} symbols \xB7 ${report.counts.facts} facts \xB7 ${report.counts.edges} edges`);
+  console.log(`  coverage    ${coverage}${report.coverage ? ` \xB7 ${report.coverage.checks.filter((entry) => entry.passed).length}/${report.coverage.checks.length} checks` : " \xB7 missing"}`);
+  if (report.parser_runtime) {
+    const treeSitter = report.parser_runtime.overall["web-tree-sitter"];
+    const structural = report.parser_runtime.overall["structural-fallback"];
+    console.log(`  parsers     Tree-sitter ${treeSitter ? `${treeSitter.parsed + treeSitter.partial}/${treeSitter.candidates}` : "0/0"} \xB7 structural ${structural ? `${structural.parsed + structural.partial}/${structural.candidates}` : "0/0"} (non-Tree-sitter)`);
+  }
+  if (report.brain_score) {
+    const measured = report.brain_score.measured_score === null ? "unavailable" : `${report.brain_score.measured_score.toFixed(1)}/100 measured`;
+    const release = report.brain_score.complete ? ` \xB7 release score ${report.brain_score.release_score?.toFixed(1)}` : ` \xB7 ${report.brain_score.available_points}/100 points have build-scoped evidence`;
+    console.log(`  brain score ${measured}${release}`);
+    for (const component of report.brain_score.components.filter((entry) => entry.status === "UNAVAILABLE")) {
+      console.log(`              ${pc.yellow("unavailable")} ${component.id} \xB7 ${component.detail}`);
+    }
+  }
+  console.log(`  knowledge   ${knowledgeLabel(report.knowledge_freshness.status)} \xB7 ${report.knowledge_freshness.detail}`);
+  if (report.build_timing) {
+    const timing = report.build_timing.elapsed_ms === null ? "elapsed unavailable" : `${formatDuration(report.build_timing.elapsed_ms)} / ${formatDuration(report.build_timing.budget_ms)} budget`;
+    console.log(`  build time  ${report.build_timing.mode.toLowerCase()} \xB7 ${timing}`);
+  }
+  if (report.stage_timings.length > 0) {
+    console.log("  stages");
+    for (const stage of report.stage_timings) {
+      console.log(`              ${stage.status.padEnd(9)} ${stage.name.padEnd(12)} ${stage.elapsed_ms === null ? "unknown" : formatDuration(stage.elapsed_ms)}`);
+    }
+  }
+  if (report.staleness.changed_file_count > 0) {
+    console.log(`  changed     ${report.staleness.changed_file_count} files${report.staleness.changed_paths_omitted ? ` \xB7 ${report.staleness.changed_paths_omitted} omitted` : ""}`);
+    for (const filename of report.staleness.changed_paths.slice(0, 10)) console.log(`              ${filename}`);
+  }
+  if (report.staleness.candidate_changed_file_count > 0) {
+    console.log(`  git status  ${report.staleness.candidate_changed_file_count} current paths observed${report.staleness.candidate_changed_paths_omitted ? ` \xB7 ${report.staleness.candidate_changed_paths_omitted} omitted` : ""}`);
+    for (const filename of report.staleness.candidate_changed_paths.slice(0, 10)) console.log(`              ${filename}`);
+  }
+  if (report.staleness.proof === "UNAVAILABLE") console.log(`  freshness   ${pc.yellow("UNKNOWN")} \xB7 ${report.staleness.detail}`);
+  if (report.failures.length > 0) {
+    console.log("  failures");
+    for (const failure of report.failures) {
+      console.log(`              ${pc.red(failure.code)} \xB7 ${failure.message}`);
+      if (failure.diagnostics) emitCoverageDiagnostics(failure.diagnostics, "                ");
+    }
+  } else console.log(`  failures    ${pc.green("none")}`);
+  console.log("");
+}
+function missingStatus(sizeBytes, failures, storage = emptyStorageSummary(sizeBytes)) {
+  return {
+    schema_version: "1",
+    state: "MISSING",
+    size_bytes: sizeBytes,
+    generation: null,
+    counts: { files: 0, symbols: 0, facts: 0, edges: 0, routes: 0, manifests: 0 },
+    coverage: null,
+    parser_runtime: null,
+    storage,
+    stage_timings: [],
+    build_timing: null,
+    brain_score: null,
+    knowledge_freshness: { status: "NOT_BUILT", changed_files_since_extract: null, detail: "No active Deep Brain generation exists." },
+    staleness: unknownStaleness("FAST", "No active Deep Brain generation exists."),
+    failures
+  };
+}
+function readStatusAggregate(store, buildId) {
+  const summary = store.deep.getBuildSummary(buildId);
+  if (!summary) throw new Error(`Deep Brain status aggregate returned no row for ${buildId}`);
+  return {
+    counts: {
+      files: summary.files,
+      symbols: summary.symbols,
+      facts: summary.facts,
+      edges: summary.edges,
+      routes: summary.routes,
+      manifests: summary.manifests
+    },
+    activeObjectBytes: summary.activeObjectBytes,
+    gitEvidenceAnchor: summary.gitEvidenceAnchor ?? null,
+    ...summary.astRuntime ? { astRuntime: summary.astRuntime } : {}
+  };
+}
+function parserRuntimeStatus(summary) {
+  if (!summary) return null;
+  return {
+    schema_version: summary.schemaVersion,
+    overall: summary.overall,
+    by_language: summary.byLanguage
+  };
+}
+function readStageTimings(store, buildId) {
+  return store.deep.listBuildStages(buildId, STATUS_STAGE_LIMIT).map((row) => {
+    const metrics = record2(row.metrics) ?? null;
+    const error = record2(row.error) ?? null;
+    const elapsedMetric = finiteNonnegative(metrics?.elapsedMs);
+    const elapsedWall = elapsedBetween(row.startedAt, row.finishedAt);
+    return {
+      name: row.name,
+      required: row.required,
+      status: row.status,
+      elapsed_ms: elapsedMetric ?? elapsedWall,
+      error: typeof error?.message === "string" ? error.message : row.error === void 0 ? null : String(row.error),
+      metrics
+    };
+  });
+}
+function buildTimingFor(build) {
+  const mode = build.identity.mode;
+  const budgetMs = mode === "DEEP" ? 7 * 6e4 : mode === "FAST" ? 9e4 : 3e4;
+  const elapsedMs = elapsedBetween(build.startedAt, build.finishedAt ?? null);
+  return {
+    mode,
+    elapsed_ms: elapsedMs,
+    budget_ms: budgetMs,
+    within_budget: elapsedMs === null ? null : elapsedMs <= budgetMs
+  };
+}
+function knowledgeFreshnessFor(stages, coverage) {
+  const stage = stages.find((entry) => entry.name === "knowledge");
+  if (!stage) return { status: "UNKNOWN", changed_files_since_extract: null, detail: "The generation has no knowledge-stage metadata." };
+  const status = typeof stage.metrics?.status === "string" ? stage.metrics.status.toUpperCase() : void 0;
+  const reason = typeof stage.metrics?.reason === "string" ? stage.metrics.reason : void 0;
+  const staleFiles = finiteNonnegative(stage.metrics?.knowledgeStaleByFiles);
+  if (status === "REUSED") {
+    const count = staleFiles ?? 0;
+    return count > 0 ? { status: "STALE", changed_files_since_extract: count, detail: `Citation-valid knowledge was reused and is stale by ${count} changed file${count === 1 ? "" : "s"}.` } : { status: "CURRENT", changed_files_since_extract: 0, detail: "Citation-valid knowledge was reused with no changed source files." };
+  }
+  if (status === "VALIDATED") return { status: "CURRENT", changed_files_since_extract: 0, detail: "Knowledge claims were validated for this generation." };
+  if (status === "SKIPPED" || reason === "offline" || reason === "fast-or-incremental") {
+    return { status: "NOT_BUILT", changed_files_since_extract: null, detail: reason ? `Knowledge extraction was skipped (${reason}).` : "Knowledge extraction was skipped." };
+  }
+  const llmClaims = finiteNonnegative(coverage?.metrics.llmClaims);
+  if (stage.status === "SUCCEEDED" && llmClaims !== null && llmClaims > 0) {
+    return { status: "CURRENT", changed_files_since_extract: 0, detail: "Stored knowledge claims belong to this completed generation." };
+  }
+  return { status: "UNKNOWN", changed_files_since_extract: null, detail: "Knowledge freshness cannot be proven from this generation's stage metadata." };
+}
+function scoreBrain(coverage, timing, planEvidence) {
+  const metric = (name) => finiteNonnegative(coverage.metrics[name]);
+  const sourceFiles = metric("sourceFiles");
+  const languageFiles = metric("identifiedLanguageFiles");
+  const supportedAst = metric("supportedAstFiles");
+  const parsedAst = metric("parsedAstFiles");
+  const internalImports = metric("internalImports");
+  const resolvedImports = metric("resolvedInternalImports");
+  const coverageRatios = [
+    safeRatio(languageFiles, sourceFiles, false),
+    safeRatio(parsedAst, supportedAst, true),
+    safeRatio(resolvedImports, internalImports, true)
+  ];
+  const coverageValue = coverageRatios.every((value) => value !== null) ? coverageRatios.reduce((sum, value) => sum + (value ?? 0), 0) / coverageRatios.length : null;
+  const coverageComponent = coverageValue === null ? unavailableScoreComponent("coverage", 40, "Language, AST, or import coverage metrics are missing.") : measuredScoreComponent("coverage", 40, coverageValue, "Mean of language identification, AST parse, and internal-import resolution rates.");
+  const llmClaims = metric("llmClaims");
+  const citedClaims = metric("citedLlmClaims");
+  const citationValue = llmClaims !== null && citedClaims !== null && llmClaims > 0 ? Math.min(1, citedClaims / llmClaims) : null;
+  const citationComponent = citationValue === null ? unavailableScoreComponent("citation_rate", 20, llmClaims === 0 ? "No LLM knowledge claims exist in this generation." : "Citation metrics are missing.") : measuredScoreComponent("citation_rate", 20, citationValue, "Cited LLM knowledge claims divided by all LLM knowledge claims.");
+  const planComponent = planEvidence ? measuredScoreComponent(
+    "plan_file_validity",
+    25,
+    planEvidence.quality.metrics.plan_file_validity,
+    `Latest valid ${planEvidence.flow} plan ${planEvidence.planSlug} v${planEvidence.planVersion} is bound to this generation (quality ${roundScore(planEvidence.quality.score)}/100).`
+  ) : unavailableScoreComponent(
+    "plan_file_validity",
+    25,
+    "No schema-valid plan-quality evidence is stored for this active generation."
+  );
+  const budgetComponent = timing.within_budget === null ? unavailableScoreComponent("budget_compliance", 15, "The build has no trustworthy finished timestamp.") : measuredScoreComponent(
+    "budget_compliance",
+    15,
+    timing.within_budget ? 1 : 0,
+    `${timing.mode.toLowerCase()} build ${timing.within_budget ? "met" : "exceeded"} the ${formatDuration(timing.budget_ms)} published budget.`
+  );
+  const components = [coverageComponent, citationComponent, planComponent, budgetComponent];
+  const measured = components.filter((component) => component.status === "MEASURED");
+  const earnedPoints = roundScore(measured.reduce((sum, component) => sum + (component.earned_points ?? 0), 0));
+  const availablePoints = measured.reduce((sum, component) => sum + component.weight, 0);
+  const complete = availablePoints === 100;
+  return {
+    measured_score: availablePoints === 0 ? null : roundScore(earnedPoints / availablePoints * 100),
+    earned_points: earnedPoints,
+    available_points: availablePoints,
+    total_points: 100,
+    complete,
+    release_score: complete ? earnedPoints : null,
+    components
+  };
+}
+function measuredScoreComponent(id, weight, value, detail) {
+  const bounded = Math.max(0, Math.min(1, value));
+  return { id, weight, status: "MEASURED", value: roundScore(bounded), earned_points: roundScore(bounded * weight), detail };
+}
+function unavailableScoreComponent(id, weight, detail) {
+  return { id, weight, status: "UNAVAILABLE", value: null, earned_points: null, detail };
+}
+function inspectRepositoryFast(root) {
+  const result = spawnSync("git", ["status", "--porcelain=v2", "--branch", "-z", "--untracked-files=all", "--ignore-submodules=dirty"], {
+    cwd: root,
+    encoding: "utf8",
+    timeout: STATUS_GIT_TIMEOUT_MS,
+    maxBuffer: STATUS_GIT_OUTPUT_LIMIT,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error || result.status !== 0) {
+    const reason = result.error?.message ?? (result.stderr.trim() || `git status exited ${result.status ?? "without a status"}`);
+    return unknownStaleness("FAST", `Bounded Git observation was unavailable: ${reason}. Run \`scriptonia brain status --check\` for an exact result.`);
+  }
+  const parsed = parseGitStatusV2(result.stdout);
+  const visible = parsed.paths.slice(0, STATUS_CHANGED_PATH_LIMIT);
+  return {
+    is_stale: null,
+    checked_snapshot_hash: null,
+    changed_file_count: 0,
+    changed_paths: [],
+    changed_paths_omitted: 0,
+    check: "FAST",
+    proof: "UNAVAILABLE",
+    detail: "Git status describes the current checkout, but this generation does not persist the Git tree and dirty-state proof needed to compare it exactly. Run `scriptonia brain status --check`.",
+    current_head: parsed.head,
+    working_tree_dirty: parsed.paths.length > 0,
+    candidate_changed_file_count: parsed.paths.length,
+    candidate_changed_paths: visible,
+    candidate_changed_paths_omitted: parsed.paths.length - visible.length
+  };
+}
+function parseGitStatusV2(output) {
+  const records = output.split("\0");
+  const paths = /* @__PURE__ */ new Set();
+  let head = null;
+  for (let index = 0; index < records.length; index += 1) {
+    const record3 = records[index] ?? "";
+    if (record3.startsWith("# branch.oid ")) {
+      const candidate = record3.slice("# branch.oid ".length).trim();
+      if (/^[0-9a-f]{40,64}$/.test(candidate)) head = candidate;
+      continue;
+    }
+    let filename;
+    if (record3.startsWith("1 ")) filename = record3.split(" ").slice(8).join(" ");
+    else if (record3.startsWith("2 ")) {
+      filename = record3.split(" ").slice(9).join(" ");
+      const oldPath = records[index + 1];
+      if (oldPath) addGitCandidate(paths, oldPath);
+      index += 1;
+    } else if (record3.startsWith("u ")) filename = record3.split(" ").slice(10).join(" ");
+    else if (record3.startsWith("? ")) filename = record3.slice(2);
+    if (filename) addGitCandidate(paths, filename);
+  }
+  return { head, paths: [...paths].sort() };
+}
+function addGitCandidate(paths, filename) {
+  const normalized = filename.replaceAll("\\", "/");
+  if (!normalized || normalized === ".scriptonia" || normalized.startsWith(".scriptonia/") || normalized === ".git" || normalized.startsWith(".git/")) return;
+  paths.add(normalized);
+}
+function unknownStaleness(check, detail) {
+  return {
+    is_stale: null,
+    checked_snapshot_hash: null,
+    changed_file_count: 0,
+    changed_paths: [],
+    changed_paths_omitted: 0,
+    check,
+    proof: "UNAVAILABLE",
+    detail,
+    current_head: null,
+    working_tree_dirty: null,
+    candidate_changed_file_count: 0,
+    candidate_changed_paths: [],
+    candidate_changed_paths_omitted: 0
+  };
+}
+function inspectRepository(root, storedFiles) {
+  const census = walkRepo(root);
+  const snapshotHash = hashObject(census.files.map((file) => ({
+    path: file.path,
+    sha256: file.sha256,
+    class: file.class,
+    language: file.language,
+    analysisMode: file.analysisMode
+  })));
+  const current = new Map(census.files.map((file) => [file.path, file.sha256]));
+  const stored = new Map(storedFiles.map((file) => [file.path, file.contentHash]));
+  const changedPaths = [.../* @__PURE__ */ new Set([...current.keys(), ...stored.keys()])].filter((filename) => current.get(filename) !== stored.get(filename)).sort();
+  return { snapshotHash, changedPaths };
+}
+function parseCoverage(value) {
+  const envelope = record2(value);
+  const report = record2(envelope?.report);
+  const metrics = record2(envelope?.metrics);
+  if (typeof report?.passed !== "boolean" || !metrics || !Array.isArray(report.checks)) return null;
+  const checks = [];
+  for (const value2 of report.checks) {
+    const check = record2(value2);
+    if (!check || typeof check.id !== "string" || typeof check.passed !== "boolean" || typeof check.message !== "string") continue;
+    checks.push({
+      id: check.id,
+      passed: check.passed,
+      message: check.message,
+      ...typeof check.actual === "number" ? { actual: check.actual } : {},
+      ...typeof check.total === "number" ? { total: check.total } : {},
+      ...typeof check.threshold === "number" ? { threshold: check.threshold } : {},
+      diagnostics: parseCoverageDiagnostics(check.diagnostics)
+    });
+  }
+  return { passed: report.passed, metrics, checks };
+}
+function recentBuildFailures(builds) {
+  const failures = [];
+  for (const build of builds.filter((candidate) => candidate.status === "FAILED").slice(0, 5)) {
+    failures.push({ source: "build", code: "BUILD_FAILED", message: failureMessage(build.failure), build_id: build.id });
+    const coverage = parseCoverage(build.coverage);
+    for (const check of coverage?.checks.filter((candidate) => !candidate.passed) ?? []) {
+      failures.push({
+        source: "coverage",
+        code: check.id,
+        message: check.message,
+        build_id: build.id,
+        diagnostics: check.diagnostics
+      });
+    }
+  }
+  return failures;
+}
+function emptyCoverageDiagnostics() {
+  return { schemaVersion: "1", items: [], omittedCount: 0 };
+}
+function parseCoverageDiagnostics(value) {
+  const object = record2(value);
+  if (object?.schemaVersion !== "1" || !Array.isArray(object.items)) return emptyCoverageDiagnostics();
+  const items = [];
+  let invalidOrCapped = Math.max(0, object.items.length - MAX_DEEP_COVERAGE_DIAGNOSTIC_ITEMS);
+  for (const raw of object.items.slice(0, MAX_DEEP_COVERAGE_DIAGNOSTIC_ITEMS)) {
+    const parsed = parseCoverageGapItem(raw);
+    if (parsed) items.push(parsed);
+    else invalidOrCapped += 1;
+  }
+  const omitted = finiteNonnegative(object.omittedCount) ?? 0;
+  return { schemaVersion: "1", items, omittedCount: Math.floor(omitted) + invalidOrCapped };
+}
+function parseCoverageGapItem(value) {
+  const item2 = record2(value);
+  if (!item2 || typeof item2.kind !== "string") return void 0;
+  if (item2.kind === "source_file_shortfall" && typeof item2.actual === "number" && typeof item2.required === "number") {
+    return { kind: item2.kind, actual: item2.actual, required: item2.required };
+  }
+  if (item2.kind === "required_stage" && typeof item2.stage === "string" && typeof item2.status === "string") {
+    return { kind: item2.kind, stage: item2.stage, status: item2.status, ...typeof item2.reason === "string" ? { reason: item2.reason } : {} };
+  }
+  if (item2.kind === "unknown_language" && typeof item2.path === "string" && (item2.category === "SOURCE" || item2.category === "TEST")) {
+    return { kind: item2.kind, path: item2.path, category: item2.category };
+  }
+  if (item2.kind === "ast_required_file" && typeof item2.path === "string" && (item2.status === "FAILED" || item2.status === "PENDING" || item2.status === "UNSUPPORTED") && typeof item2.reason === "string") {
+    return { kind: item2.kind, path: item2.path, status: item2.status, reason: item2.reason };
+  }
+  if (item2.kind === "unresolved_internal_import" && typeof item2.sourcePath === "string" && typeof item2.specifier === "string") {
+    return { kind: item2.kind, sourcePath: item2.sourcePath, specifier: item2.specifier, ...typeof item2.reason === "string" ? { reason: item2.reason } : {} };
+  }
+  if (item2.kind === "failed_manifest" && typeof item2.path === "string" && typeof item2.manifestKind === "string" && typeof item2.error === "string") {
+    return { kind: item2.kind, path: item2.path, manifestKind: item2.manifestKind, error: item2.error };
+  }
+  if (item2.kind === "knowledge_claim" && typeof item2.claimId === "string" && typeof item2.claimKind === "string" && (item2.status === "UNCITED" || item2.status === "REJECTED") && typeof item2.reason === "string") {
+    return { kind: item2.kind, claimId: item2.claimId, claimKind: item2.claimKind, status: item2.status, reason: item2.reason };
+  }
+  return void 0;
+}
+function emitCoverageDiagnostics(diagnostics, indent) {
+  for (const item2 of diagnostics.items) console.log(`${indent}${coverageDiagnosticLabel(item2)}`);
+  if (diagnostics.omittedCount > 0) console.log(`${indent}+${diagnostics.omittedCount} additional gap${diagnostics.omittedCount === 1 ? "" : "s"} omitted`);
+}
+function coverageDiagnosticLabel(item2) {
+  if (item2.kind === "source_file_shortfall") return `source files ${item2.actual}/${item2.required}`;
+  if (item2.kind === "required_stage") return `${item2.stage} \xB7 ${item2.status}${item2.reason ? ` \xB7 ${item2.reason}` : ""}`;
+  if (item2.kind === "unknown_language") return `${item2.path} \xB7 ${item2.category.toLowerCase()} language unknown`;
+  if (item2.kind === "ast_required_file") return `${item2.path} \xB7 AST ${item2.status.toLowerCase()} \xB7 ${item2.reason}`;
+  if (item2.kind === "unresolved_internal_import") return `${item2.sourcePath} imports ${item2.specifier} \xB7 ${item2.reason ?? "unresolved"}`;
+  if (item2.kind === "failed_manifest") return `${item2.path} \xB7 ${item2.manifestKind} \xB7 ${item2.error}`;
+  return `${item2.claimId} \xB7 ${item2.claimKind} ${item2.status.toLowerCase()} \xB7 ${item2.reason}`;
+}
+function failureMessage(value) {
+  const object = record2(value);
+  if (typeof object?.message === "string") return object.message;
+  if (typeof object?.code === "string") return object.code;
+  if (value === void 0) return "A Deep Brain build failed without a recorded reason.";
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function storageSummary(store, activeObjectBytes) {
+  return {
+    database_bytes: fileSize(store.filename),
+    wal_bytes: fileSize(`${store.filename}-wal`),
+    shared_memory_bytes: fileSize(`${store.filename}-shm`),
+    active_object_bytes: activeObjectBytes,
+    inactive_object_bytes_included: false
+  };
+}
+function emptyStorageSummary(databaseBytes = 0) {
+  return {
+    database_bytes: databaseBytes,
+    wal_bytes: 0,
+    shared_memory_bytes: 0,
+    active_object_bytes: 0,
+    inactive_object_bytes_included: false
+  };
+}
+function storageTotal(storage) {
+  return storage.database_bytes + storage.wal_bytes + storage.shared_memory_bytes + storage.active_object_bytes;
+}
+function fileSize(filename) {
+  try {
+    const stat = fs8.lstatSync(filename);
+    return stat.isFile() && !stat.isSymbolicLink() ? stat.size : 0;
+  } catch {
+    return 0;
+  }
+}
+function formatBytes(value) {
+  if (value < 1024) return `${value} B`;
+  if (value < 1024 ** 2) return `${(value / 1024).toFixed(1)} KiB`;
+  if (value < 1024 ** 3) return `${(value / 1024 ** 2).toFixed(1)} MiB`;
+  return `${(value / 1024 ** 3).toFixed(1)} GiB`;
+}
+function formatDuration(value) {
+  if (value < 1e3) return `${Math.round(value)}ms`;
+  if (value < 6e4) return `${(value / 1e3).toFixed(1)}s`;
+  return `${(value / 6e4).toFixed(1)}m`;
+}
+function knowledgeLabel(status) {
+  if (status === "CURRENT") return pc.green(status.toLowerCase());
+  if (status === "STALE") return pc.yellow(status.toLowerCase());
+  return pc.dim(status.toLowerCase().replace("_", " "));
+}
+function finiteNonnegative(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+function elapsedBetween(startedAt, finishedAt) {
+  if (typeof startedAt !== "string" || typeof finishedAt !== "string") return null;
+  const started = Date.parse(startedAt);
+  const finished = Date.parse(finishedAt);
+  return Number.isFinite(started) && Number.isFinite(finished) && finished >= started ? finished - started : null;
+}
+function safeRatio(actual, total, zeroIsComplete) {
+  if (actual === null || total === null || actual > total) return null;
+  if (total === 0) return zeroIsComplete ? 1 : null;
+  return actual / total;
+}
+function roundScore(value) {
+  return Math.round(value * 100) / 100;
+}
+function record2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/index.ts
+var V2_COMMANDS = /* @__PURE__ */ new Set(["--version", "-V", "run", "runs", "verify", "gate", "learn", "eval", "acknowledge", "events", "v2-init", "report-summary", "diff-check", "why", "recall", "decide", "pulse", "brain"]);
+var requested = process.argv[2];
+if (!requested || !V2_COMMANDS.has(requested)) {
+  await import(new URL("../bin/scriptonia.mjs", import.meta.url).href);
+} else {
+  await runV2();
+}
+async function runV2() {
+  await initializeTelemetry();
+  const program = new Command();
+  program.name("scriptonia").description("Evidence-based product memory and verification for AI coding agents").version("0.9.0-rc.2");
+  registerBrainCommands(program);
+  program.command("v2-init").description("Create inspectable V2 configuration directories").action(() => {
+    const root = findRepositoryRoot();
+    const filename = ensureConfig(root);
+    console.log(`${pc2.green("\u2713")} V2 brain configured at ${path9.relative(root, filename)}`);
+  });
+  program.command("diff-check").description("Run only sub-second deterministic changed-file policies").option("--base <ref>", "base Git reference", "HEAD").action((options) => {
+    const started = performance.now();
+    const root = findRepositoryRoot();
+    const snapshot = buildSnapshot({ cwd: root, base: options.base });
+    const definitions = loadDecisions(root);
+    const context = buildScopeContext(root, snapshot.files.map((file) => file.path));
+    const results = evaluateDecisions(definitions.decisions, context).filter((result) => result.state !== "SKIPPED");
+    const plan = path9.join(root, "PLAN.md");
+    const unresolved = fs9.existsSync(plan) ? fs9.readFileSync(plan, "utf8").split("\n").filter((line) => /(?:⚠\s*)?UNRESOLVED/i.test(line)) : [];
+    console.log(`
+${pc2.bold("SCRIPTONIA DIFF CHECK")} \xB7 ${snapshot.files.length} changed files
+`);
+    for (const error of definitions.errors) console.log(`  ${pc2.red("ERROR")} ${error}`);
+    for (const result of results) console.log(`  ${result.state === "PASS" ? pc2.green(result.state) : pc2.red(result.state)} ${result.title} \xB7 ${result.reason}`);
+    if (unresolved.length) console.log(`  ${pc2.red("FAIL")} PLAN.md contains ${unresolved.length} unresolved constraint(s).`);
+    const blocked = unresolved.length > 0 || results.some((result) => result.state === "FAIL" && result.enforcement === "block");
+    const errored = definitions.errors.length > 0 || results.some((result) => result.state === "ERROR");
+    console.log(`
+${errored ? "ERROR" : blocked ? "BLOCKED" : "PASS"} \xB7 ${Math.round(performance.now() - started)}ms
+`);
+    process.exitCode = errored ? 4 : blocked ? 3 : 0;
+  });
+  program.command("decide <title>").description("Create a reviewable structured product or architecture decision").requiredOption("--kind <predicate>", "deterministic predicate kind").option("--names <values>", "comma-separated dependency, symbol, or path values", "").option("--include <globs>", "comma-separated scope globs", "**").option("--exclude <globs>", "comma-separated excluded globs", "").option("--owner <owner>", "responsible owner").option("--enforcement <level>", "observe, warn, action_required, or block", "observe").option("--confirm <actor>", "activate and record the confirming human").action((title, options) => {
+    const root = findRepositoryRoot();
+    ensureConfig(root);
+    const id = `decision_${slug(title)}_${Date.now().toString(36)}`;
+    const decision = decisionSchema.parse({ schema_version: "1", id, version: 1, title, state: options.confirm ? "active" : "draft", owner: options.owner, source_refs: [], scope: { paths: { include: csv(options.include), exclude: csv(options.exclude) } }, predicate: { kind: options.kind, names: csv(options.names) }, enforcement: options.enforcement, created_at: (/* @__PURE__ */ new Date()).toISOString(), confirmed_by: options.confirm });
+    const filename = path9.join(root, ".scriptonia", "decisions", `${id}.yaml`);
+    fs9.writeFileSync(filename, YAML3.stringify(decision));
+    console.log(`${pc2.green("\u2713")} ${decision.state} decision written to ${path9.relative(root, filename)}`);
+    if (decision.state === "draft") console.log("  Review its scope and predicate, then confirm it before enforcement.");
+  });
+  program.command("why <target>").description("Explain Deep Brain evidence, impact, tests, decisions, and evals affecting a file or symbol").option("--json", "print a machine-readable explanation").action((target, options) => {
+    const root = findRepositoryRoot();
+    const deep = explainDeepBrain(root, target);
+    const relative = deep.target?.path;
+    const context = relative ? buildScopeContext(root, [relative]) : void 0;
+    const decisions = context ? loadDecisions(root).decisions.filter((entry) => entry.state === "active" && matchScope(entry.scope, context).matched) : [];
+    const evals = context ? loadEvals(root).evals.filter((entry) => entry.state === "active" && matchScope(entry.scope, context).matched) : [];
+    if (options.json) {
+      console.log(JSON.stringify({
+        schema_version: "1",
+        query: target,
+        file: relative ?? null,
+        deep_brain: deep,
+        decisions: decisions.map((entry) => ({ id: entry.id, version: entry.version, title: entry.title, enforcement: entry.enforcement })),
+        evals: evals.map((entry) => ({ id: entry.id, version: entry.version, title: entry.title, enforcement: entry.enforcement }))
+      }, null, 2));
+      return;
+    }
+    console.log(`
+${pc2.bold("WHY")} ${target}${relative && relative !== target ? ` \u2192 ${relative}` : ""}
+`);
+    if (deep.available && deep.generation) {
+      const freshness = deep.stale === false ? pc2.green("fresh") : deep.stale === true ? pc2.yellow("stale") : pc2.yellow("freshness unknown");
+      console.log(`  brain     generation ${deep.generation.number} \xB7 ${freshness} \xB7 ${deep.generation.build_id}`);
+      if (deep.target?.symbol) {
+        console.log(`  symbol    ${deep.target.symbol.name} \xB7 ${deep.target.symbol.kind} \xB7 ${deep.target.symbol.match} match \xB7 ${deep.target.symbol.id}`);
+        for (const alternative of deep.target.alternatives) console.log(`  also      ${alternative.name} \xB7 ${alternative.kind} \xB7 ${alternative.path}`);
+      }
+      if (deep.role) {
+        console.log(`  role      ${deep.role.cluster} \xB7 core #${deep.role.core_rank}/${deep.role.total_files} (${deep.role.core_score.toFixed(2)}) \xB7 hotspot #${deep.role.hotspot_rank} (${deep.role.hotspot_score.toFixed(2)}) \xB7 churn ${deep.role.churn_score.toFixed(2)}`);
+      }
+      for (const owner of deep.ownership) console.log(`  owner     ${owner.principals.map((principal) => principal.value).join(", ")} \xB7 ${owner.source} \xB7 ${(owner.confidence * 100).toFixed(0)}% \xB7 advisory`);
+      for (const fact of deep.facts) {
+        console.log(`  evidence  ${fact.title} \xB7 ${fact.path}:${fact.start_line} \xB7 ${(fact.relevance * 100).toFixed(0)}% \xB7 ${fact.id}`);
+      }
+      for (const dependent of deep.dependents) console.log(`  dependent ${dependent}`);
+      for (const test of deep.related_tests) console.log(`  test      ${test}`);
+      for (const signal of deep.signals) console.log(`  signal    ${signal.id} \xB7 ${signal.source} \xB7 ${signal.excerpt.replace(/[\r\n]+/g, " ").slice(0, 180)}`);
+      for (const plan of deep.plans) console.log(`  plan      ${plan.id}@${plan.version} \xB7 ${plan.state} \xB7 ${plan.excerpt.replace(/[\r\n]+/g, " ").slice(0, 180)}`);
+      if (deep.context_error) console.log(`  ${pc2.yellow("context")}   ${deep.context_error}`);
+    } else if (deep.generation) {
+      console.log(`  brain     ${pc2.yellow(deep.context_error ?? `no file or symbol matched "${target}"`)}`);
+    } else {
+      console.log(`  brain     ${pc2.dim("not built \xB7 run scriptonia brain build --fast --offline")}`);
+    }
+    for (const decision of decisions) console.log(`  decision  ${decision.id}@${decision.version} \xB7 ${decision.title} \xB7 ${decision.enforcement}`);
+    for (const evaluation2 of evals) console.log(`  eval      ${evaluation2.id}@${evaluation2.version} \xB7 ${evaluation2.title} \xB7 ${evaluation2.enforcement}`);
+    if (!deep.facts.length && !deep.dependents.length && !deep.related_tests.length && !deep.ownership.length && !deep.signals.length && !deep.plans.length && !decisions.length && !evals.length) console.log("  No active Deep Brain evidence, scoped decisions, signals, plans, or evals apply.");
+    console.log("");
+  });
+  program.command("recall <query>").description("Search inspectable local decisions and evals").option("--limit <number>", "maximum matches", "10").action((query, options) => {
+    const root = findRepositoryRoot();
+    const entries = [
+      ...loadDecisions(root).decisions.map((value) => ({ kind: "decision", id: value.id, title: value.title, body: JSON.stringify(value) })),
+      ...loadEvals(root).evals.map((value) => ({ kind: "eval", id: value.id, title: value.title, body: JSON.stringify(value) }))
+    ];
+    const tokens = query.toLowerCase().split(/\W+/).filter(Boolean);
+    const matches = entries.map((entry) => ({ ...entry, score: tokens.reduce((score, token) => score + (entry.body.toLowerCase().split(token).length - 1), 0) })).filter((entry) => entry.score > 0).sort((a, b) => b.score - a.score).slice(0, Math.max(1, Number(options.limit) || 10));
+    console.log(`
+${pc2.bold("RECALL")} \u201C${query}\u201D
+`);
+    for (const entry of matches) console.log(`  ${entry.kind.padEnd(9)} ${entry.id} \xB7 ${entry.title}`);
+    if (!matches.length) console.log("  No matching local memory.");
+    console.log("");
+  });
+  program.command("pulse").description("Show local brain and repository health").action(() => {
+    const root = findRepositoryRoot();
+    ensureConfig(root);
+    const snapshot = buildSnapshot({ cwd: root, base: "HEAD" });
+    const decisions = loadDecisions(root);
+    const evals = loadEvals(root);
+    const health = evalDoctor(root);
+    const store = new BrainStore(root);
+    try {
+      const runs = store.listRuns(5);
+      console.log(`
+${pc2.bold("SCRIPTONIA PULSE")}
+`);
+      console.log(`  repository  ${snapshot.dirty ? pc2.yellow("dirty") : pc2.green("clean")} \xB7 ${snapshot.files.length} changed files`);
+      console.log(`  decisions   ${decisions.decisions.filter((entry) => entry.state === "active").length} active \xB7 ${decisions.errors.length} invalid`);
+      console.log(`  evals       ${evals.evals.filter((entry) => entry.state === "active").length} active \xB7 ${health.issues.length} health issues`);
+      console.log(`  runs        ${runs.length} recent captured`);
+      console.log(`  semantic    ${process.env.SCRIPTONIA_MODEL_GATEWAY_URL && process.env.SCRIPTONIA_API_TOKEN || process.env.LITELLM_BASE_URL && process.env.LITELLM_MASTER_KEY ? pc2.green("configured") : pc2.dim("disabled until credentials are added")}`);
+      console.log("");
+    } finally {
+      store.close();
+    }
+  });
+  program.command("run [argv...]").description("Capture exactly the agent command supplied after --").option("--adapter <name>", "adapter identity", "explicit-wrapper").option("--agent <name>", "agent identity").allowUnknownOption(true).action(async (argv, options) => {
+    const root = findRepositoryRoot();
+    if (argv[0] === "show") {
+      if (!argv[1]) throw new Error("usage: scriptonia run show <run-id>");
+      const store = new BrainStore(root);
+      try {
+        const run = store.getRun(argv[1]);
+        if (!run) throw new Error(`run not found: ${argv[1]}`);
+        console.log(JSON.stringify(run, null, 2));
+      } finally {
+        store.close();
+      }
+      return;
+    }
+    const separator = process.argv.indexOf("--");
+    const exact = separator >= 0 ? process.argv.slice(separator + 1) : argv;
+    const result = await captureCommand({ root, command: exact, adapter: options.adapter, agent: options.agent });
+    console.log(`
+${pc2.green("\u2713")} captured ${result.runId} \xB7 child exit ${result.exitCode}`);
+    process.exitCode = result.exitCode;
+  });
+  program.command("runs").description("List recent captured agent runs").option("--json", "print JSON").option("--limit <number>", "maximum rows", "20").action((options) => {
+    const root = findRepositoryRoot();
+    const store = new BrainStore(root);
+    try {
+      const runs = store.listRuns(Math.max(1, Math.min(200, Number(options.limit) || 20)));
+      if (options.json) console.log(JSON.stringify(runs, null, 2));
+      else {
+        console.log(`
+${pc2.bold("RECENT AGENT RUNS")}
+`);
+        if (!runs.length) console.log("  No captured runs yet. Use: scriptonia run -- <agent-command>");
+        for (const run of runs) console.log(`  ${String(run.status).padEnd(10)} ${run.id}  ${JSON.stringify(run.command)}  exit=${run.exit_code ?? "-"}`);
+        console.log("");
+      }
+    } finally {
+      store.close();
+    }
+  });
+  for (const name of ["verify", "gate"]) {
+    program.command(name).description(name === "gate" ? "Aggregate evidence into a CI-safe exit status" : "Produce a complete local evidence report").option("--base <ref>", "base Git reference").option("--plan <file>", "plan file", "PLAN.md").option("--refresh", "create a new verification instead of using the immutable cache").option("--semantic", "enable advisory semantic evaluation").option("--ci", "consume CI evidence from SCRIPTONIA_NEEDS_JSON").option("--json [file]", "print JSON or write it to a file").option("--sarif <file>", "write SARIF output").action(async (options) => {
+      const root = findRepositoryRoot();
+      if (options.semantic) configureGatewayFromLegacyLogin();
+      const result = await verifyRepository({ root, base: options.base, plan: options.plan, refresh: options.refresh, semantic: options.semantic, trustedBase: Boolean(options.ci) });
+      emitVerification(root, result, options);
+      if (name === "gate") process.exitCode = result.exitCode;
+    });
+  }
+  program.command("learn <finding-id>").description("Convert a confirmed finding into a reviewable draft eval").action((findingId) => {
+    const root = findRepositoryRoot();
+    const learned = learnFromFinding(root, findingId);
+    console.log(`${pc2.green("\u2713")} draft eval ${learned.evalCase.id} written to ${path9.relative(root, learned.path)}`);
+    console.log("  Review its scope and evidence, add an owner, then change state to active.");
+  });
+  const evaluation = program.command("eval").description("Run and maintain versioned regression cases");
+  evaluation.command("run [id-or-scope]").option("--base <ref>", "base Git reference").option("--refresh", "bypass immutable cache").option("--json [file]", "print JSON or write it to a file").action(async (filter, options) => {
+    const root = findRepositoryRoot();
+    const result = await verifyRepository({ root, base: options.base, refresh: options.refresh, evalFilter: filter });
+    emitVerification(root, result, options);
+    process.exitCode = result.exitCode;
+  });
+  evaluation.command("doctor").action(() => {
+    const root = findRepositoryRoot();
+    const report = evalDoctor(root);
+    console.log(`
+${pc2.bold("EVAL DOCTOR")} \xB7 ${report.healthy ? pc2.green("HEALTHY") : pc2.yellow("NEEDS ATTENTION")}
+`);
+    for (const issue of report.issues) console.log(`  ${issue.kind.padEnd(16)} ${issue.id} \xB7 ${issue.message}`);
+    if (!report.issues.length) console.log("  No duplicate, stale, ownerless, invalid, or expired evals.");
+    console.log("");
+    process.exitCode = report.healthy ? 0 : 1;
+  });
+  program.command("acknowledge <finding-id>").requiredOption("--reason <reason>", "accepted_risk, false_positive, not_applicable, or fix_later").requiredOption("--actor <identity>", "human identity").option("--comment <text>", "reason details").action((findingId, options) => {
+    const allowed = ["accepted_risk", "false_positive", "not_applicable", "fix_later"];
+    if (!allowed.includes(options.reason)) throw new Error(`invalid reason: ${options.reason}`);
+    const root = findRepositoryRoot();
+    const id = acknowledgeFinding(root, findingId, options.reason, options.actor, options.comment);
+    console.log(`${pc2.green("\u2713")} acknowledgement recorded: ${id}`);
+  });
+  const events = program.command("events").description("Ingest normalized adapter events");
+  events.command("ingest <file>").option("--adapter <name>", "normalized or codex", "normalized").action((filename, options) => {
+    const root = findRepositoryRoot();
+    const full = assertInside(root, path9.resolve(root, filename));
+    if (options.adapter !== "normalized" && options.adapter !== "codex") throw new Error(`unsupported event adapter: ${options.adapter}`);
+    const count = ingestJsonl(root, fs9.readFileSync(full, "utf8"), options.adapter);
+    console.log(`${pc2.green("\u2713")} ingested ${count} normalized run events`);
+  });
+  program.command("report-summary <file>").action((filename) => {
+    const root = findRepositoryRoot();
+    const full = assertInside(root, path9.resolve(root, filename));
+    const result = JSON.parse(fs9.readFileSync(full, "utf8"));
+    const markdown = githubStepSummary(result);
+    if (process.env.GITHUB_STEP_SUMMARY) fs9.appendFileSync(process.env.GITHUB_STEP_SUMMARY, markdown);
+    else console.log(markdown);
+  });
+  await program.parseAsync(process.argv);
+}
+function emitVerification(root, result, options) {
+  if (options.json === true) console.log(JSON.stringify(result, null, 2));
+  else {
+    const color = result.gate === "PASS" ? pc2.green : result.gate === "PASS_WITH_WARNINGS" ? pc2.yellow : pc2.red;
+    console.log(`
+${pc2.bold("SCRIPTONIA VERIFY")} \xB7 ${color(result.gate)}${result.cached ? pc2.dim(" \xB7 cached") : ""}`);
+    console.log(pc2.dim(`snapshot ${result.snapshotId}`));
+    console.log(`coverage plan=${result.coverage.plan} decisions=${result.coverage.decisions.evaluated}/${result.coverage.decisions.total} evals=${result.coverage.evals.evaluated}/${result.coverage.evals.total} semantic=${result.coverage.semantic}
+`);
+    for (const check of result.checks) {
+      const state = check.state === "PASS" ? pc2.green(check.state) : check.state === "SKIPPED" ? pc2.dim(check.state) : check.state === "INCONCLUSIVE" ? pc2.yellow(check.state) : pc2.red(check.state);
+      console.log(`  ${state.padEnd(18)} ${check.title}`);
+      if (check.state !== "PASS" && check.state !== "SKIPPED") console.log(`                     ${pc2.dim(check.reason)} \xB7 ${check.findingId ?? check.id}`);
+    }
+    console.log(`
+exit ${result.exitCode}
+`);
+  }
+  if (typeof options.json === "string") writeOutput(root, options.json, `${JSON.stringify(result, null, 2)}
+`);
+  if (options.sarif) writeOutput(root, options.sarif, `${JSON.stringify(toSarif(result), null, 2)}
+`);
+}
+function writeOutput(root, filename, content) {
+  const full = assertInside(root, path9.resolve(root, filename));
+  fs9.mkdirSync(path9.dirname(full), { recursive: true });
+  fs9.writeFileSync(full, content);
+}
+function csv(value) {
+  return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function slug(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "").slice(0, 48) || "decision";
+}
+function configureGatewayFromLegacyLogin() {
+  if (process.env.SCRIPTONIA_MODEL_GATEWAY_URL && process.env.SCRIPTONIA_API_TOKEN) return;
+  try {
+    const config = JSON.parse(fs9.readFileSync(path9.join(os2.homedir(), ".scriptonia", "config.json"), "utf8"));
+    if (config.url && !process.env.SCRIPTONIA_MODEL_GATEWAY_URL) process.env.SCRIPTONIA_MODEL_GATEWAY_URL = config.url;
+    if (config.token && !process.env.SCRIPTONIA_API_TOKEN) process.env.SCRIPTONIA_API_TOKEN = config.token;
+  } catch {
+  }
+}
+//# sourceMappingURL=index.js.map