scriptonia 0.9.0-rc.1 → 0.9.0-rc.2

package/dist/index.js

@@ -1,76 +1,54 @@
 #!/usr/bin/env node
+import {
+  BrainStore,
+  MAX_DEEP_COVERAGE_DIAGNOSTIC_ITEMS,
+  brainExtractResponseV1Schema,
+  buildBrain,
+  buildContextPack,
+  buildSnapshot,
+  configSchema,
+  createBrainImpactProvider,
+  createContextGraphExpansionAdapter,
+  decisionSchema,
+  evalCaseSchema,
+  evidenceRequirementSchema,
+  findRepositoryRoot,
+  initializeTelemetry,
+  listFilesAtRef,
+  loadCurrentBrainImpactProvider,
+  parseDiffHunks,
+  readFileAtRef,
+  runEventSchema,
+  withSpan
+} from "./chunk-ZLKAW77A.js";
+import {
+  aggregateGate,
+  assertInside,
+  createId,
+  exitCodeForGate,
+  hashObject,
+  normalizeRepoPath,
+  nowIso,
+  sha256,
+  walkRepo
+} from "./chunk-6TLQP3LV.js";
 
 // src/index.ts
 import fs9 from "fs";
-import os from "os";
-import path10 from "path";
+import os2 from "os";
+import path9 from "path";
 import { Command } from "commander";
-import pc from "picocolors";
+import pc2 from "picocolors";
 import YAML3 from "yaml";
 
-// ../packages/core/src/index.ts
-import { createHash, randomBytes } from "crypto";
-import path from "path";
-function canonicalize(value) {
-  return JSON.stringify(normalize(value));
-}
-function normalize(value) {
-  if (value === null || typeof value === "string" || typeof value === "boolean") return typeof value === "string" ? value.replace(/\r\n?/g, "\n") : value;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new TypeError("canonical JSON rejects non-finite numbers");
-    return value;
-  }
-  if (Array.isArray(value)) return value.map(normalize);
-  if (typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).filter(([, item2]) => item2 !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, item2]) => [key, normalize(item2)]));
-  }
-  throw new TypeError(`canonical JSON rejects ${typeof value}`);
-}
-function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
-}
-function hashObject(value) {
-  return sha256(canonicalize(value));
-}
-function createId(prefix, at = Date.now()) {
-  return `${prefix}_${at.toString(36).padStart(9, "0")}${randomBytes(8).toString("hex")}`;
-}
-function normalizeRepoPath(input) {
-  if (input.includes("\0")) throw new Error("repository path contains a null byte");
-  const normalized = input.replaceAll("\\", "/").replace(/^\.\//, "");
-  if (path.posix.isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../") || normalized.includes("/../")) {
-    throw new Error(`path escapes repository: ${input}`);
-  }
-  return path.posix.normalize(normalized);
-}
-function assertInside(root, candidate) {
-  const resolvedRoot = path.resolve(root);
-  const resolved = path.resolve(candidate);
-  if (resolved !== resolvedRoot && !resolved.startsWith(`${resolvedRoot}${path.sep}`)) throw new Error(`path escapes repository: ${candidate}`);
-  return resolved;
-}
-function aggregateGate(checks, incompleteBlocks = true) {
-  if (checks.some((item2) => item2.state === "FAIL" && item2.enforcement === "block")) return "BLOCKED";
-  if (checks.some((item2) => item2.state === "FAIL" && item2.enforcement === "action_required")) return "ACTION_REQUIRED";
-  if (checks.some((item2) => item2.state === "ERROR" || incompleteBlocks && item2.state === "INCONCLUSIVE" && item2.enforcement === "block")) return "INCOMPLETE";
-  if (checks.some((item2) => item2.state === "FAIL" || item2.state === "INCONCLUSIVE")) return "PASS_WITH_WARNINGS";
-  return "PASS";
-}
-function exitCodeForGate(state) {
-  return state === "PASS" || state === "PASS_WITH_WARNINGS" ? 0 : state === "ACTION_REQUIRED" ? 2 : state === "BLOCKED" ? 3 : 4;
-}
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-
 // ../packages/eval-engine/src/index.ts
-import fs7 from "fs";
-import path8 from "path";
+import fs5 from "fs";
+import path5 from "path";
 import YAML2 from "yaml";
 
 // ../packages/evidence/src/index.ts
 import fs from "fs";
-import path2 from "path";
+import path from "path";
 import fg from "fast-glob";
 import { XMLParser } from "fast-xml-parser";
 function item(kind, collector, source, state, payload) {
@@ -103,20 +81,20 @@ function collectJUnit(root, patterns) {
         const skipped = Boolean(test.skipped);
         const suite = String(test.classname ?? test.suite ?? "");
         const name = String(test.name ?? "unnamed");
-        items.push(item("junit_test", "junit-xml", path2.relative(root, filename), skipped ? "missing" : failed ? "failed" : "available", { suite, test: name, failed, skipped }));
+        items.push(item("junit_test", "junit-xml", path.relative(root, filename), skipped ? "missing" : failed ? "failed" : "available", { suite, test: name, failed, skipped }));
       }
     } catch (error) {
-      items.push(item("junit_test", "junit-xml", path2.relative(root, filename), "error", { error: error instanceof Error ? error.message : String(error) }));
+      items.push(item("junit_test", "junit-xml", path.relative(root, filename), "error", { error: error instanceof Error ? error.message : String(error) }));
     }
   }
   return items;
 }
 function flattenTests(value, suite = "") {
   if (!value || typeof value !== "object") return [];
-  const record = value;
-  const currentSuite = String(record["@_name"] ?? suite);
-  const tests = asArray(record.testcase).map((entry) => ({ ...entry, suite: currentSuite, classname: entry["@_classname"], name: entry["@_name"], failure: entry.failure, error: entry.error, skipped: entry.skipped }));
-  for (const key of ["testsuite", "testsuites"]) for (const child of asArray(record[key])) tests.push(...flattenTests(child, currentSuite));
+  const record3 = value;
+  const currentSuite = String(record3["@_name"] ?? suite);
+  const tests = asArray(record3.testcase).map((entry) => ({ ...entry, suite: currentSuite, classname: entry["@_classname"], name: entry["@_name"], failure: entry.failure, error: entry.error, skipped: entry.skipped }));
+  for (const key of ["testsuite", "testsuites"]) for (const child of asArray(record3[key])) tests.push(...flattenTests(child, currentSuite));
   return tests;
 }
 function asArray(value) {
@@ -124,7 +102,7 @@ function asArray(value) {
 }
 function collectRepositoryFacts(root, changedFiles) {
   return changedFiles.map((file) => {
-    const full = path2.join(root, file);
+    const full = path.join(root, file);
     let exists = false;
     let size = 0;
     try {
@@ -154,124 +132,9 @@ function requirementMatches(requirement, candidate) {
   return true;
 }
 
-// ../packages/git-snapshot/src/index.ts
-import fs2 from "fs";
-import path3 from "path";
-import { spawnSync } from "child_process";
-function git(root, args, allowFailure = false) {
-  const result = spawnSync("git", args, { cwd: root, encoding: "utf8", maxBuffer: 4e7, shell: false });
-  if (result.error) throw result.error;
-  if (result.status !== 0 && !allowFailure) throw new Error(`git ${args[0] ?? "command"} failed: ${(result.stderr || "").trim()}`);
-  return result.status === 0 ? (result.stdout || "").trimEnd() : "";
-}
-function findRepositoryRoot(cwd = process.cwd()) {
-  const root = git(cwd, ["rev-parse", "--show-toplevel"]);
-  if (!root) throw new Error("not inside a Git repository");
-  return path3.resolve(root);
-}
-function resolveRef(root, ref) {
-  const sha = git(root, ["rev-parse", "--verify", `${ref}^{commit}`]);
-  if (!/^[0-9a-f]{40}$/i.test(sha)) throw new Error(`invalid Git ref: ${ref}`);
-  return sha.toLowerCase();
-}
-function readFileAtRef(root, ref, filename) {
-  const sha = resolveRef(root, ref);
-  const safe = normalizeRepoPath(filename);
-  const result = spawnSync("git", ["show", `${sha}:${safe}`], { cwd: root, encoding: "utf8", maxBuffer: 1e7, shell: false });
-  return result.status === 0 ? result.stdout : void 0;
-}
-function listFilesAtRef(root, ref, prefixes) {
-  const sha = resolveRef(root, ref);
-  const safe = prefixes.map(normalizeRepoPath);
-  const output = git(root, ["ls-tree", "-r", "--name-only", sha, "--", ...safe], true);
-  return output.split("\n").filter(Boolean).map(normalizeRepoPath).sort();
-}
-function parseNameStatus(text) {
-  const out = [];
-  for (const line of text.split("\n")) {
-    if (!line) continue;
-    const [rawStatus = "", first = "", second] = line.split("	");
-    const code = rawStatus[0];
-    const status = code === "A" ? "added" : code === "M" ? "modified" : code === "D" ? "deleted" : code === "R" ? "renamed" : code === "C" ? "copied" : "unknown";
-    const target = status === "renamed" || status === "copied" ? second : first;
-    if (!target) continue;
-    const item2 = { path: normalizeRepoPath(target), status, binary: false };
-    if ((status === "renamed" || status === "copied") && first) item2.oldPath = normalizeRepoPath(first);
-    out.push(item2);
-  }
-  return out;
-}
-function untrackedFiles(root) {
-  return git(root, ["ls-files", "--others", "--exclude-standard"], true).split("\n").filter(Boolean).map(normalizeRepoPath).filter((file) => !isRuntimeFile(file)).map((file) => ({ path: file, status: "added", binary: isBinary(path3.join(root, file)) }));
-}
-function isRuntimeFile(file) {
-  return /^\.scriptonia\/(?:brain\.db(?:-shm|-wal)?|artifacts\/|result(?:\.|-)|self-verification\.)/.test(file);
-}
-function isBinary(filename) {
-  try {
-    const fd = fs2.openSync(filename, "r");
-    const buffer = Buffer.alloc(8192);
-    const read = fs2.readSync(fd, buffer, 0, buffer.length, 0);
-    fs2.closeSync(fd);
-    return buffer.subarray(0, read).includes(0);
-  } catch {
-    return false;
-  }
-}
-function untrackedPatch(root, files) {
-  const chunks = [];
-  for (const file of files) {
-    if (file.binary) {
-      chunks.push(`diff --git a/${file.path} b/${file.path}
-new file mode 100644
-Binary files /dev/null and b/${file.path} differ`);
-      continue;
-    }
-    const full = path3.join(root, file.path);
-    try {
-      const stat = fs2.statSync(full);
-      if (!stat.isFile() || stat.size > 1e6) continue;
-      const body = fs2.readFileSync(full, "utf8").replace(/\r\n?/g, "\n");
-      const lines = body.split("\n");
-      chunks.push(`diff --git a/${file.path} b/${file.path}
-new file mode 100644
---- /dev/null
-+++ b/${file.path}
-@@ -0,0 +1,${lines.length} @@
-${lines.map((line) => `+${line}`).join("\n")}`);
-    } catch {
-    }
-  }
-  return chunks.join("\n");
-}
-function buildSnapshot(options = {}) {
-  const root = findRepositoryRoot(options.cwd);
-  const baseRef = options.base ?? "HEAD";
-  const baseSha = resolveRef(root, baseRef);
-  const headSha = resolveRef(root, "HEAD");
-  const includeWorkingTree = options.includeWorkingTree ?? true;
-  const range = baseSha === headSha ? "HEAD" : `${baseSha}...${headSha}`;
-  let diff = git(root, ["diff", "--no-ext-diff", "--binary", "--unified=20", range]);
-  let files = parseNameStatus(git(root, ["diff", "--name-status", "--find-renames", range]));
-  let dirty = false;
-  if (includeWorkingTree) {
-    const working = git(root, ["diff", "--no-ext-diff", "--binary", "--unified=20", "HEAD"]);
-    const workingFiles = parseNameStatus(git(root, ["diff", "--name-status", "--find-renames", "HEAD"]));
-    const untracked = untrackedFiles(root);
-    dirty = workingFiles.length > 0 || untracked.length > 0;
-    diff = [diff, working, untrackedPatch(root, untracked)].filter(Boolean).join("\n");
-    const map = new Map([...files, ...workingFiles, ...untracked].map((file) => [file.path, file]));
-    files = [...map.values()].sort((a, b) => a.path.localeCompare(b.path));
-  }
-  for (const file of files) if (!file.binary && file.status !== "deleted") file.binary = isBinary(path3.join(root, file.path));
-  const diffHash = sha256(diff.replace(/\r\n?/g, "\n"));
-  const identity = { schemaVersion: "1", baseSha, headSha, dirty, diffHash, files: files.map(({ path: name, status, oldPath, binary }) => ({ path: name, status, oldPath, binary })) };
-  return { schemaVersion: "1", repositoryRoot: root, baseRef, baseSha, headSha, dirty, diff, diffHash, files, snapshotId: hashObject(identity) };
-}
-
 // ../packages/impact/src/index.ts
-import fs3 from "fs";
-import path4 from "path";
+import fs2 from "fs";
+import path2 from "path";
 import fg2 from "fast-glob";
 var SOURCE = ["**/*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}", "!**/node_modules/**", "!**/dist/**", "!**/.next/**", "!**/coverage/**"];
 var EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", ".mjs", ".cjs", "/index.ts", "/index.tsx", "/index.js", "/index.jsx"];
@@ -282,7 +145,7 @@ function buildFallbackImpactIndex(root) {
   for (const file of files) {
     let text;
     try {
-      text = fs3.readFileSync(path4.join(root, file), "utf8");
+      text = fs2.readFileSync(path2.join(root, file), "utf8");
     } catch {
       continue;
     }
@@ -293,7 +156,7 @@ function buildFallbackImpactIndex(root) {
     for (const match of imports) {
       const specifier = match[1];
       if (!specifier?.startsWith(".")) continue;
-      const base = normalizeRepoPath(path4.posix.join(path4.posix.dirname(file), specifier));
+      const base = normalizeRepoPath(path2.posix.join(path2.posix.dirname(file), specifier));
       const target = EXTENSIONS.map((extension) => `${base}${extension}`).find((candidate) => known.has(candidate));
       if (target) edges.push({ from: file, to: target, kind: "import", confidence: "high", provenance: `static-import:${file}` });
     }
@@ -324,16 +187,39 @@ function relatedTests(index, changedFiles) {
   return impacted.filter((file) => /(?:^|\/)(?:__tests__|tests?|spec)(?:\/|$)|\.(?:test|spec)\.[^.]+$/i.test(file));
 }
 function loadCodeGraphIndex(root) {
-  const filename = path4.join(root, ".scriptonia", "codegraph.json");
-  if (!fs3.existsSync(filename)) return void 0;
+  const filename = path2.join(root, ".scriptonia", "codegraph.json");
+  if (!fs2.existsSync(filename)) return void 0;
   try {
-    const value = JSON.parse(fs3.readFileSync(filename, "utf8"));
+    const value = JSON.parse(fs2.readFileSync(filename, "utf8"));
     const edges = (value.edges ?? []).filter((edge) => edge && typeof edge.from === "string" && typeof edge.to === "string" && ["high", "medium", "low"].includes(edge.confidence));
     return { provider: "codegraph-file-adapter", version: "1", id: hashObject({ sourceVersion: value.version, edges }), edges };
   } catch {
     return void 0;
   }
 }
+function createIndexImpactProvider(index) {
+  return {
+    index,
+    generation: index.id,
+    coverageValid: true,
+    changedSymbols: () => [],
+    dependents: (change, depth = 2) => impactedFiles(index, change.files, depth),
+    relatedTests: (change) => relatedTests(index, change.files)
+  };
+}
+function selectImpactProvider(options) {
+  if (options.brain?.coverageValid) return options.brain;
+  return createIndexImpactProvider(options.codeGraph ?? options.fallback());
+}
+function impactProviderIdentity(provider) {
+  return {
+    provider: provider.index.provider,
+    version: provider.index.version,
+    id: provider.index.id,
+    generation: provider.generation,
+    coverageValid: provider.coverageValid
+  };
+}
 
 // ../packages/model-gateway/src/index.ts
 import { z } from "zod";
@@ -343,19 +229,34 @@ var judgeResultSchema = z.object({
   evidenceRefs: z.array(z.string()).default([]),
   reason: z.string()
 });
+function secureBaseUrl(value, label) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return { error: `${label} must be a valid absolute URL` };
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    return { error: `${label} must use HTTPS except for localhost, 127.0.0.1, or [::1]` };
+  }
+  return { url: url.toString().replace(/\/$/, "") };
+}
 async function semanticJudge(input) {
   const model = input.model ?? process.env.OPENAI_OUTPUT_MODEL ?? "gpt-5.6-terra";
   const rubric = "Assess only whether the supplied evidence supports or contradicts the criterion. Return uncertain when evidence is insufficient. Never infer behavior from code style or plausibility.";
   const serialized = JSON.stringify(input.evidenceBundle);
   const maxBytes = input.maxBytes ?? 12e4;
   if (Buffer.byteLength(serialized) > maxBytes) return { available: false, error: `evidence bundle exceeds ${maxBytes} byte limit` };
-  const gatewayUrl = process.env.SCRIPTONIA_MODEL_GATEWAY_URL?.replace(/\/$/, "");
+  const configuredGatewayUrl = process.env.SCRIPTONIA_MODEL_GATEWAY_URL;
   const gatewayToken = process.env.SCRIPTONIA_API_TOKEN;
-  if (gatewayUrl && gatewayToken) {
+  if (configuredGatewayUrl && gatewayToken) {
+    const gateway = secureBaseUrl(configuredGatewayUrl, "Scriptonia model gateway URL");
+    if (!gateway.url) return { available: false, error: gateway.error };
     const controller2 = new AbortController();
     const timeout2 = setTimeout(() => controller2.abort(), input.timeoutMs ?? 2e4);
     try {
-      const response = await (input.fetchImpl ?? fetch)(`${gatewayUrl}/api/v2/judge`, { method: "POST", headers: { authorization: `Bearer ${gatewayToken}`, "content-type": "application/json" }, signal: controller2.signal, body: JSON.stringify({ criterion: input.criterion, evidence: input.evidenceBundle }) });
+      const response = await (input.fetchImpl ?? fetch)(`${gateway.url}/api/v2/judge`, { method: "POST", headers: { authorization: `Bearer ${gatewayToken}`, "content-type": "application/json" }, signal: controller2.signal, body: JSON.stringify({ criterion: input.criterion, evidence: input.evidenceBundle }) });
       const body = await response.json();
       if (!response.ok) return { available: false, error: `Scriptonia model gateway returned ${response.status}` };
       const parsed = judgeResultSchema.safeParse(body);
@@ -370,10 +271,12 @@ async function semanticJudge(input) {
   const endpoint = input.endpoint ?? process.env.LITELLM_BASE_URL;
   const apiKey = input.apiKey ?? process.env.LITELLM_MASTER_KEY;
   if (!endpoint || !apiKey) return { available: false, error: "Scriptonia model gateway is not configured" };
+  const liteLLM = secureBaseUrl(endpoint, "LiteLLM base URL");
+  if (!liteLLM.url) return { available: false, error: liteLLM.error };
   const directModel = input.model ?? process.env.LITELLM_MODEL ?? "semantic-judge";
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), input.timeoutMs ?? 2e4);
-  const url = `${endpoint.replace(/\/$/, "")}/v1/chat/completions`;
+  const url = `${liteLLM.url}/v1/chat/completions`;
   try {
     const response = await (input.fetchImpl ?? fetch)(url, {
       method: "POST",
@@ -404,168 +307,28 @@ Return JSON with result, confidence, evidenceRefs, reason.` },
   }
 }
 
-// ../packages/observability/src/index.ts
-import { SpanStatusCode, trace } from "@opentelemetry/api";
-var started = false;
-async function initializeTelemetry() {
-  if (started || process.env.SCRIPTONIA_TELEMETRY !== "1" || !process.env.OTEL_EXPORTER_OTLP_ENDPOINT) return;
-  const [{ NodeSDK }, { OTLPTraceExporter }] = await Promise.all([import("@opentelemetry/sdk-node"), import("@opentelemetry/exporter-trace-otlp-http")]);
-  const sdk = new NodeSDK({ traceExporter: new OTLPTraceExporter({ url: `${process.env.OTEL_EXPORTER_OTLP_ENDPOINT.replace(/\/$/, "")}/v1/traces` }) });
-  await sdk.start();
-  started = true;
-}
-async function withSpan(name, attributes, operation) {
-  const tracer = trace.getTracer("scriptonia", "0.9.0-rc.1");
-  return tracer.startActiveSpan(name, { attributes }, async (span) => {
-    const startedAt = performance.now();
-    try {
-      const result = await operation();
-      span.setAttribute("duration_bucket_ms", bucket(performance.now() - startedAt));
-      span.setStatus({ code: SpanStatusCode.OK });
-      return result;
-    } catch (error) {
-      span.setStatus({ code: SpanStatusCode.ERROR, message: error instanceof Error ? error.message : String(error) });
-      throw error;
-    } finally {
-      span.end();
-    }
-  });
-}
-function bucket(duration) {
-  const buckets = [10, 25, 50, 100, 250, 500, 1e3, 2e3, 5e3, 1e4, 3e4];
-  return buckets.find((value) => duration <= value) ?? 6e4;
-}
-
 // ../packages/policy-engine/src/index.ts
-import fs5 from "fs";
-import path6 from "path";
+import fs4 from "fs";
+import path4 from "path";
 import picomatch2 from "picomatch";
 import YAML from "yaml";
 
-// ../packages/schemas/src/index.ts
-import { z as z2 } from "zod";
-var checkStateSchema = z2.enum(["PASS", "FAIL", "INCONCLUSIVE", "SKIPPED", "ERROR"]);
-var gateStateSchema = z2.enum(["PASS", "PASS_WITH_WARNINGS", "ACTION_REQUIRED", "BLOCKED", "INCOMPLETE"]);
-var enforcementSchema = z2.enum(["observe", "warn", "action_required", "block"]);
-var lifecycleSchema = z2.enum(["draft", "active", "superseded", "expired", "stale", "quarantined", "archived"]);
-var defaultScope = {
-  repositories: [],
-  packages: [],
-  services: [],
-  paths: { include: ["**"], exclude: [] },
-  symbols: [],
-  dependencies: [],
-  owners: [],
-  tags: []
-};
-var scopeSchema = z2.object({
-  repositories: z2.array(z2.string()).default([]),
-  packages: z2.array(z2.string()).default([]),
-  services: z2.array(z2.string()).default([]),
-  paths: z2.object({ include: z2.array(z2.string()).default(["**"]), exclude: z2.array(z2.string()).default([]) }).default({ include: ["**"], exclude: [] }),
-  symbols: z2.array(z2.string()).default([]),
-  dependencies: z2.array(z2.string()).default([]),
-  owners: z2.array(z2.string()).default([]),
-  tags: z2.array(z2.string()).default([])
-}).default(defaultScope);
-var predicateKinds = [
-  "path_forbidden",
-  "path_requires_owner",
-  "dependency_forbidden",
-  "dependency_required",
-  "symbol_forbidden",
-  "symbol_requires_test",
-  "file_pattern_required",
-  "permission_required",
-  "check_required"
-];
-var predicateSchema = z2.object({
-  kind: z2.enum(predicateKinds),
-  names: z2.array(z2.string()).default([]),
-  patterns: z2.array(z2.string()).default([]),
-  owner: z2.string().optional(),
-  permission: z2.string().optional(),
-  check: z2.string().optional()
-});
-var decisionSchema = z2.object({
-  schema_version: z2.literal("1").default("1"),
-  id: z2.string().min(1),
-  version: z2.number().int().positive().default(1),
-  title: z2.string().min(1),
-  state: lifecycleSchema.default("draft"),
-  owner: z2.string().optional(),
-  source_refs: z2.array(z2.string()).default([]),
-  scope: scopeSchema,
-  predicate: predicateSchema,
-  enforcement: enforcementSchema.default("observe"),
-  created_at: z2.string().datetime().optional(),
-  confirmed_by: z2.string().optional(),
-  supersedes: z2.string().optional()
-});
-var evidenceRequirementSchema = z2.object({
-  kind: z2.enum(["github_check", "junit_test", "repository_fact", "decision_predicate", "state_validator", "human_confirmation", "semantic_judge"]),
-  name: z2.string().optional(),
-  suite: z2.string().optional(),
-  test: z2.string().optional(),
-  path: z2.string().optional(),
-  value: z2.string().optional()
-});
-var evalCaseSchema = z2.object({
-  schema_version: z2.literal("1").default("1"),
-  id: z2.string().min(1),
-  version: z2.number().int().positive().default(1),
-  title: z2.string().min(1),
-  state: lifecycleSchema.default("draft"),
-  owner: z2.string().optional(),
-  origin: z2.object({ kind: z2.string(), run_ref: z2.string().optional(), finding_ref: z2.string().optional() }),
-  decision_refs: z2.array(z2.string()).default([]),
-  signal_refs: z2.array(z2.string()).default([]),
-  scope: scopeSchema,
-  assertion: z2.object({ kind: z2.string(), description: z2.string().optional() }),
-  evidence: z2.object({ all: z2.array(evidenceRequirementSchema).default([]), any: z2.array(evidenceRequirementSchema).default([]) }).default({ all: [], any: [] }),
-  enforcement: enforcementSchema.default("observe"),
-  fingerprint: z2.string().optional(),
-  last_confirmed_at: z2.string().datetime().optional(),
-  review_after: z2.string().datetime().optional()
-});
-var runEventSchema = z2.object({
-  schemaVersion: z2.literal("1"),
-  eventId: z2.string(),
-  runId: z2.string(),
-  sequence: z2.number().int().nonnegative(),
-  occurredAt: z2.string().datetime(),
-  source: z2.object({ adapter: z2.string(), adapterVersion: z2.string(), agent: z2.string().optional(), agentVersion: z2.string().optional() }),
-  type: z2.enum(["run.started", "run.finished", "tool.requested", "tool.completed", "file.changed", "command.requested", "human.corrected", "error"]),
-  payload: z2.unknown(),
-  redaction: z2.object({ applied: z2.boolean(), policyVersion: z2.string() })
-});
-var configSchema = z2.object({
-  schema_version: z2.literal("1").default("1"),
-  base_ref: z2.string().default("HEAD"),
-  required_plan: z2.boolean().default(false),
-  incomplete_blocks: z2.boolean().default(true),
-  trusted_config_ref: z2.string().default("HEAD"),
-  evidence: z2.object({ junit: z2.array(z2.string()).default([]), github_needs_env: z2.string().default("SCRIPTONIA_NEEDS_JSON") }).default({ junit: [], github_needs_env: "SCRIPTONIA_NEEDS_JSON" }),
-  semantic: z2.object({ enabled: z2.boolean().default(false), endpoint: z2.string().url().optional(), model: z2.string().optional(), max_bytes: z2.number().int().positive().default(12e4), timeout_ms: z2.number().int().positive().default(2e4) }).default({ enabled: false, max_bytes: 12e4, timeout_ms: 2e4 }),
-  redaction: z2.object({ env_names: z2.array(z2.string()).default([]), patterns: z2.array(z2.string()).default([]), max_payload_bytes: z2.number().int().positive().default(128e3) }).default({ env_names: [], patterns: [], max_payload_bytes: 128e3 })
-});
-
 // ../packages/scope-engine/src/index.ts
-import fs4 from "fs";
-import path5 from "path";
+import fs3 from "fs";
+import path3 from "path";
 import picomatch from "picomatch";
 function discoverPackages(root) {
   const result = /* @__PURE__ */ new Map();
   const visit = (relative, depth) => {
     if (depth > 4) return;
-    const absolute = path5.join(root, relative);
+    const absolute = path3.join(root, relative);
     for (const entry of safeReadDir(absolute)) {
       if (!entry.isDirectory() || entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "dist") continue;
-      const next = normalizeRepoPath(path5.posix.join(relative.replaceAll("\\", "/"), entry.name));
-      const pkgFile = path5.join(root, next, "package.json");
-      if (fs4.existsSync(pkgFile)) {
+      const next = normalizeRepoPath(path3.posix.join(relative.replaceAll("\\", "/"), entry.name));
+      const pkgFile = path3.join(root, next, "package.json");
+      if (fs3.existsSync(pkgFile)) {
         try {
-          result.set(next, String(JSON.parse(fs4.readFileSync(pkgFile, "utf8")).name || next));
+          result.set(next, String(JSON.parse(fs3.readFileSync(pkgFile, "utf8")).name || next));
         } catch {
           result.set(next, next);
         }
@@ -573,9 +336,9 @@ function discoverPackages(root) {
       visit(next, depth + 1);
     }
   };
-  if (fs4.existsSync(path5.join(root, "package.json"))) {
+  if (fs3.existsSync(path3.join(root, "package.json"))) {
     try {
-      result.set(".", String(JSON.parse(fs4.readFileSync(path5.join(root, "package.json"), "utf8")).name || "."));
+      result.set(".", String(JSON.parse(fs3.readFileSync(path3.join(root, "package.json"), "utf8")).name || "."));
     } catch {
       result.set(".", ".");
     }
@@ -585,17 +348,17 @@ function discoverPackages(root) {
 }
 function safeReadDir(dir) {
   try {
-    return fs4.readdirSync(dir, { withFileTypes: true });
+    return fs3.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
 }
 function parseCodeowners(root) {
   const candidates = ["CODEOWNERS", ".github/CODEOWNERS", "docs/CODEOWNERS"];
-  const file = candidates.map((name) => path5.join(root, name)).find(fs4.existsSync);
+  const file = candidates.map((name) => path3.join(root, name)).find(fs3.existsSync);
   const owners = /* @__PURE__ */ new Map();
   if (!file) return owners;
-  for (const raw of fs4.readFileSync(file, "utf8").split("\n")) {
+  for (const raw of fs3.readFileSync(file, "utf8").split("\n")) {
     const line = raw.trim();
     if (!line || line.startsWith("#")) continue;
     const [pattern, ...names] = line.split(/\s+/);
@@ -645,7 +408,7 @@ function discoverDependencies(root) {
   const names = /* @__PURE__ */ new Set();
   for (const [directory] of discoverPackages(root)) {
     try {
-      const pkg = JSON.parse(fs4.readFileSync(path5.join(root, directory, "package.json"), "utf8"));
+      const pkg = JSON.parse(fs3.readFileSync(path3.join(root, directory, "package.json"), "utf8"));
       for (const section of [pkg.dependencies, pkg.devDependencies, pkg.peerDependencies]) for (const name of Object.keys(section || {})) names.add(name);
     } catch {
     }
@@ -658,7 +421,7 @@ function extractSymbols(root, files) {
   for (const file of files) {
     if (!/\.[cm]?[jt]sx?$/.test(file)) continue;
     try {
-      const text = fs4.readFileSync(path5.join(root, file), "utf8");
+      const text = fs3.readFileSync(path3.join(root, file), "utf8");
       for (const match of text.matchAll(pattern)) if (match[1]) symbols.add(match[1]);
     } catch {
     }
@@ -668,13 +431,13 @@ function extractSymbols(root, files) {
 
 // ../packages/policy-engine/src/index.ts
 function loadDecisions(root) {
-  const directory = path6.join(root, ".scriptonia", "decisions");
-  if (!fs5.existsSync(directory)) return { decisions: [], errors: [] };
+  const directory = path4.join(root, ".scriptonia", "decisions");
+  if (!fs4.existsSync(directory)) return { decisions: [], errors: [] };
   const decisions = [];
   const errors = [];
-  for (const name of fs5.readdirSync(directory).filter((file) => /\.ya?ml$/i.test(file)).sort()) {
+  for (const name of fs4.readdirSync(directory).filter((file) => /\.ya?ml$/i.test(file)).sort()) {
     try {
-      decisions.push(decisionSchema.parse(YAML.parse(fs5.readFileSync(path6.join(directory, name), "utf8"))));
+      decisions.push(decisionSchema.parse(YAML.parse(fs4.readFileSync(path4.join(directory, name), "utf8"))));
     } catch (error) {
       errors.push(`${name}: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -753,247 +516,13 @@ function evaluateDecision(decision, context) {
   }
 }
 
-// ../packages/storage-sqlite/src/index.ts
-import fs6 from "fs";
-import path7 from "path";
-import Database from "better-sqlite3";
-var MIGRATION_1 = `
-CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL);
-CREATE TABLE IF NOT EXISTS agent_runs (
-  id TEXT PRIMARY KEY, adapter TEXT NOT NULL, command_json TEXT NOT NULL, started_at TEXT NOT NULL,
-  finished_at TEXT, base_sha TEXT, head_sha TEXT, diff_hash TEXT, exit_code INTEGER, status TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS run_events (
-  event_id TEXT PRIMARY KEY, run_id TEXT NOT NULL REFERENCES agent_runs(id), sequence INTEGER NOT NULL,
-  occurred_at TEXT NOT NULL, type TEXT NOT NULL, payload_json TEXT NOT NULL, redacted INTEGER NOT NULL,
-  UNIQUE(run_id, sequence)
-);
-CREATE TABLE IF NOT EXISTS git_snapshots (
-  id TEXT PRIMARY KEY, base_sha TEXT NOT NULL, head_sha TEXT NOT NULL, diff_hash TEXT NOT NULL,
-  payload_json TEXT NOT NULL, created_at TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS verification_runs (
-  id TEXT PRIMARY KEY, snapshot_id TEXT NOT NULL, gate_state TEXT NOT NULL, result_json TEXT NOT NULL,
-  created_at TEXT NOT NULL, refreshed_from TEXT
-);
-CREATE TABLE IF NOT EXISTS verdict_cache (
-  snapshot_id TEXT PRIMARY KEY, verification_id TEXT NOT NULL REFERENCES verification_runs(id), result_json TEXT NOT NULL,
-  created_at TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS findings (
-  id TEXT PRIMARY KEY, snapshot_id TEXT NOT NULL, fingerprint TEXT NOT NULL, evaluator TEXT NOT NULL,
-  state TEXT NOT NULL, enforcement TEXT NOT NULL, owner TEXT, payload_json TEXT NOT NULL,
-  first_seen TEXT NOT NULL, last_seen TEXT NOT NULL, UNIQUE(fingerprint, snapshot_id)
-);
-CREATE TABLE IF NOT EXISTS acknowledgements (
-  id TEXT PRIMARY KEY, finding_id TEXT NOT NULL REFERENCES findings(id), reason TEXT NOT NULL,
-  comment TEXT, actor TEXT NOT NULL, snapshot_id TEXT NOT NULL, created_at TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS eval_cases (
-  id TEXT NOT NULL, version INTEGER NOT NULL, state TEXT NOT NULL, fingerprint TEXT,
-  payload_json TEXT NOT NULL, indexed_at TEXT NOT NULL, PRIMARY KEY(id, version)
-);
-CREATE TABLE IF NOT EXISTS decision_versions (
-  id TEXT NOT NULL, version INTEGER NOT NULL, state TEXT NOT NULL, payload_json TEXT NOT NULL,
-  indexed_at TEXT NOT NULL, PRIMARY KEY(id, version)
-);
-CREATE TABLE IF NOT EXISTS evidence_items (
-  id TEXT PRIMARY KEY, content_hash TEXT NOT NULL, kind TEXT NOT NULL, state TEXT NOT NULL,
-  payload_json TEXT NOT NULL, collected_at TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_findings_fingerprint ON findings(fingerprint);
-CREATE INDEX IF NOT EXISTS idx_runs_started ON agent_runs(started_at DESC);
-CREATE INDEX IF NOT EXISTS idx_verifications_created ON verification_runs(created_at DESC);
-`;
-var MIGRATION_2 = `
-CREATE TABLE IF NOT EXISTS signals (
-  id TEXT PRIMARY KEY, source TEXT NOT NULL, body TEXT NOT NULL, content_hash TEXT NOT NULL,
-  metadata_json TEXT NOT NULL DEFAULT '{}', created_at TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS plans (
-  id TEXT NOT NULL, version INTEGER NOT NULL, state TEXT NOT NULL, body TEXT NOT NULL,
-  content_hash TEXT NOT NULL, created_at TEXT NOT NULL, PRIMARY KEY(id, version)
-);
-CREATE TABLE IF NOT EXISTS decisions (
-  id TEXT PRIMARY KEY, current_version INTEGER NOT NULL, state TEXT NOT NULL, title TEXT NOT NULL, owner TEXT
-);
-CREATE TABLE IF NOT EXISTS decision_links (
-  decision_id TEXT NOT NULL, ref_type TEXT NOT NULL, ref_id TEXT NOT NULL,
-  PRIMARY KEY(decision_id, ref_type, ref_id)
-);
-CREATE TABLE IF NOT EXISTS changed_files (
-  snapshot_id TEXT NOT NULL, path TEXT NOT NULL, status TEXT NOT NULL, old_path TEXT, binary INTEGER NOT NULL,
-  PRIMARY KEY(snapshot_id, path)
-);
-CREATE TABLE IF NOT EXISTS changed_symbols (
-  snapshot_id TEXT NOT NULL, symbol TEXT NOT NULL, path TEXT NOT NULL, language TEXT,
-  PRIMARY KEY(snapshot_id, symbol, path)
-);
-CREATE TABLE IF NOT EXISTS impact_indexes (
-  id TEXT PRIMARY KEY, provider TEXT NOT NULL, version TEXT NOT NULL, snapshot_id TEXT NOT NULL,
-  payload_json TEXT NOT NULL, created_at TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS impact_edges (
-  impact_index_id TEXT NOT NULL, from_ref TEXT NOT NULL, to_ref TEXT NOT NULL, kind TEXT NOT NULL,
-  confidence TEXT NOT NULL, provenance TEXT NOT NULL,
-  PRIMARY KEY(impact_index_id, from_ref, to_ref, kind)
-);
-CREATE TABLE IF NOT EXISTS eval_versions (
-  id TEXT NOT NULL, version INTEGER NOT NULL, state TEXT NOT NULL, payload_json TEXT NOT NULL,
-  indexed_at TEXT NOT NULL, PRIMARY KEY(id, version)
-);
-CREATE TABLE IF NOT EXISTS eval_links (
-  eval_id TEXT NOT NULL, ref_type TEXT NOT NULL, ref_id TEXT NOT NULL,
-  PRIMARY KEY(eval_id, ref_type, ref_id)
-);
-CREATE TABLE IF NOT EXISTS verification_checks (
-  verification_id TEXT NOT NULL, check_id TEXT NOT NULL, state TEXT NOT NULL, enforcement TEXT NOT NULL,
-  fingerprint TEXT NOT NULL, payload_json TEXT NOT NULL, PRIMARY KEY(verification_id, check_id)
-);
-CREATE TABLE IF NOT EXISTS evaluator_calibration (
-  evaluator TEXT NOT NULL, version TEXT NOT NULL, sample_id TEXT NOT NULL, judge_result TEXT NOT NULL,
-  human_result TEXT NOT NULL, agreed INTEGER NOT NULL, created_at TEXT NOT NULL,
-  PRIMARY KEY(evaluator, version, sample_id)
-);
-CREATE VIRTUAL TABLE IF NOT EXISTS fts_memory USING fts5(kind, ref_id UNINDEXED, title, body, tokenize='unicode61');
-`;
-var BrainStore = class {
-  db;
-  filename;
-  constructor(repoRoot, filename = path7.join(repoRoot, ".scriptonia", "brain.db")) {
-    fs6.mkdirSync(path7.dirname(filename), { recursive: true });
-    this.filename = filename;
-    this.db = new Database(filename);
-    this.db.pragma("journal_mode = WAL");
-    this.db.pragma("foreign_keys = ON");
-    this.db.pragma("busy_timeout = 5000");
-    this.db.pragma("synchronous = NORMAL");
-    this.migrate();
-  }
-  migrate() {
-    const current = Number(this.db.pragma("user_version", { simple: true }));
-    if (current < 1) this.db.transaction(() => {
-      this.db.exec(MIGRATION_1);
-      this.db.prepare("INSERT OR IGNORE INTO schema_migrations(version, applied_at) VALUES (?, ?)").run(1, nowIso());
-      this.db.pragma("user_version = 1");
-    })();
-    if (current < 2) this.db.transaction(() => {
-      this.db.exec(MIGRATION_2);
-      this.db.prepare("INSERT OR IGNORE INTO schema_migrations(version, applied_at) VALUES (?, ?)").run(2, nowIso());
-      this.db.pragma("user_version = 2");
-    })();
-  }
-  close() {
-    this.db.close();
-  }
-  createRun(run) {
-    this.db.prepare(`INSERT INTO agent_runs(id,adapter,command_json,started_at,base_sha,status) VALUES (?,?,?,?,?,?)`).run(run.id, run.adapter, canonicalize(run.command), run.startedAt, run.baseSha ?? null, "running");
-  }
-  appendEvent(event) {
-    this.db.prepare(`INSERT INTO run_events(event_id,run_id,sequence,occurred_at,type,payload_json,redacted) VALUES (?,?,?,?,?,?,?)`).run(event.eventId, event.runId, event.sequence, event.occurredAt, event.type, canonicalize(event.payload), event.redacted ? 1 : 0);
-  }
-  finishRun(run) {
-    this.db.prepare(`UPDATE agent_runs SET finished_at=?, head_sha=?, diff_hash=?, exit_code=?, status=? WHERE id=?`).run(run.finishedAt, run.headSha ?? null, run.diffHash ?? null, run.exitCode, run.status, run.id);
-  }
-  listRuns(limit = 20) {
-    return this.db.prepare(`SELECT id,adapter,command_json AS command,started_at,finished_at,base_sha,head_sha,diff_hash,exit_code,status FROM agent_runs ORDER BY started_at DESC LIMIT ?`).all(limit).map((row) => ({ ...row, command: JSON.parse(String(row.command)) }));
-  }
-  getRun(id) {
-    const run = this.db.prepare(`SELECT * FROM agent_runs WHERE id=?`).get(id);
-    if (!run) return void 0;
-    const events = this.db.prepare(`SELECT event_id,sequence,occurred_at,type,payload_json,redacted FROM run_events WHERE run_id=? ORDER BY sequence`).all(id).map((row) => {
-      const { payload_json, ...rest2 } = row;
-      return { ...rest2, payload: JSON.parse(String(payload_json)) };
-    });
-    const { command_json, ...rest } = run;
-    return { ...rest, command: JSON.parse(String(command_json)), events };
-  }
-  getCached(snapshotId) {
-    const row = this.db.prepare(`SELECT result_json FROM verdict_cache WHERE snapshot_id=?`).get(snapshotId);
-    return row ? JSON.parse(row.result_json) : void 0;
-  }
-  indexDecision(decision) {
-    const json = canonicalize(decision);
-    this.db.transaction(() => {
-      this.db.prepare(`INSERT INTO decisions(id,current_version,state,title,owner) VALUES (?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET current_version=excluded.current_version,state=excluded.state,title=excluded.title,owner=excluded.owner`).run(decision.id, decision.version, decision.state, decision.title, decision.owner ?? null);
-      this.db.prepare(`INSERT INTO decision_versions(id,version,state,payload_json,indexed_at) VALUES (?,?,?,?,?) ON CONFLICT(id,version) DO UPDATE SET state=excluded.state,payload_json=excluded.payload_json,indexed_at=excluded.indexed_at`).run(decision.id, decision.version, decision.state, json, nowIso());
-      this.db.prepare(`DELETE FROM fts_memory WHERE kind='decision' AND ref_id=?`).run(decision.id);
-      this.db.prepare(`INSERT INTO fts_memory(kind,ref_id,title,body) VALUES ('decision',?,?,?)`).run(decision.id, decision.title, json);
-      for (const ref of decision.source_refs ?? []) this.db.prepare(`INSERT OR IGNORE INTO decision_links(decision_id,ref_type,ref_id) VALUES (?,?,?)`).run(decision.id, ref.split("_")[0] || "ref", ref);
-    })();
-  }
-  indexEval(evaluation) {
-    const json = canonicalize(evaluation);
-    this.db.transaction(() => {
-      this.db.prepare(`INSERT INTO eval_cases(id,version,state,fingerprint,payload_json,indexed_at) VALUES (?,?,?,?,?,?) ON CONFLICT(id,version) DO UPDATE SET state=excluded.state,fingerprint=excluded.fingerprint,payload_json=excluded.payload_json,indexed_at=excluded.indexed_at`).run(evaluation.id, evaluation.version, evaluation.state, String(evaluation.fingerprint ?? ""), json, nowIso());
-      this.db.prepare(`INSERT INTO eval_versions(id,version,state,payload_json,indexed_at) VALUES (?,?,?,?,?) ON CONFLICT(id,version) DO UPDATE SET state=excluded.state,payload_json=excluded.payload_json,indexed_at=excluded.indexed_at`).run(evaluation.id, evaluation.version, evaluation.state, json, nowIso());
-      this.db.prepare(`DELETE FROM fts_memory WHERE kind='eval' AND ref_id=?`).run(evaluation.id);
-      this.db.prepare(`INSERT INTO fts_memory(kind,ref_id,title,body) VALUES ('eval',?,?,?)`).run(evaluation.id, evaluation.title, json);
-      for (const ref of evaluation.decision_refs ?? []) this.db.prepare(`INSERT OR IGNORE INTO eval_links(eval_id,ref_type,ref_id) VALUES (?,?,?)`).run(evaluation.id, "decision", ref);
-      for (const ref of evaluation.signal_refs ?? []) this.db.prepare(`INSERT OR IGNORE INTO eval_links(eval_id,ref_type,ref_id) VALUES (?,?,?)`).run(evaluation.id, "signal", ref);
-    })();
-  }
-  saveSnapshot(snapshot) {
-    this.db.transaction(() => {
-      this.db.prepare(`INSERT OR IGNORE INTO git_snapshots(id,base_sha,head_sha,diff_hash,payload_json,created_at) VALUES (?,?,?,?,?,?)`).run(snapshot.id, snapshot.baseSha, snapshot.headSha, snapshot.diffHash, canonicalize(snapshot.payload), nowIso());
-      const statement = this.db.prepare(`INSERT OR REPLACE INTO changed_files(snapshot_id,path,status,old_path,binary) VALUES (?,?,?,?,?)`);
-      for (const file of snapshot.files) statement.run(snapshot.id, file.path, file.status, file.oldPath ?? null, file.binary ? 1 : 0);
-    })();
-  }
-  saveImpact(input) {
-    this.db.transaction(() => {
-      this.db.prepare(`INSERT OR IGNORE INTO impact_indexes(id,provider,version,snapshot_id,payload_json,created_at) VALUES (?,?,?,?,?,?)`).run(input.id, input.provider, input.version, input.snapshotId, canonicalize(input), nowIso());
-      const statement = this.db.prepare(`INSERT OR IGNORE INTO impact_edges(impact_index_id,from_ref,to_ref,kind,confidence,provenance) VALUES (?,?,?,?,?,?)`);
-      for (const edge of input.edges) statement.run(input.id, edge.from, edge.to, edge.kind, edge.confidence, edge.provenance);
-    })();
-  }
-  saveEvidence(items) {
-    const statement = this.db.prepare(`INSERT OR REPLACE INTO evidence_items(id,content_hash,kind,state,payload_json,collected_at) VALUES (?,?,?,?,?,?)`);
-    this.db.transaction(() => {
-      for (const evidence of items) statement.run(evidence.id, evidence.contentHash, evidence.kind, evidence.state, canonicalize(evidence.payload), evidence.collectedAt);
-    })();
-  }
-  saveChecks(verificationId, checks) {
-    const statement = this.db.prepare(`INSERT OR REPLACE INTO verification_checks(verification_id,check_id,state,enforcement,fingerprint,payload_json) VALUES (?,?,?,?,?,?)`);
-    this.db.transaction(() => {
-      for (const check of checks) statement.run(verificationId, check.id, check.state, check.enforcement, check.fingerprint, canonicalize(check));
-    })();
-  }
-  saveVerification(input) {
-    const json = canonicalize(input.result);
-    this.db.transaction(() => {
-      this.db.prepare(`INSERT INTO verification_runs(id,snapshot_id,gate_state,result_json,created_at) VALUES (?,?,?,?,?)`).run(input.id, input.snapshotId, input.gateState, json, nowIso());
-      this.db.prepare(`INSERT INTO verdict_cache(snapshot_id,verification_id,result_json,created_at) VALUES (?,?,?,?) ON CONFLICT(snapshot_id) DO UPDATE SET verification_id=excluded.verification_id,result_json=excluded.result_json,created_at=excluded.created_at`).run(input.snapshotId, input.id, json, nowIso());
-    })();
-  }
-  saveFinding(finding) {
-    const now = nowIso();
-    const existing = this.db.prepare(`SELECT id FROM findings WHERE fingerprint=? ORDER BY first_seen LIMIT 1`).get(finding.fingerprint);
-    if (existing) {
-      this.db.prepare(`UPDATE findings SET snapshot_id=?,state=?,enforcement=?,owner=?,payload_json=?,last_seen=? WHERE id=?`).run(finding.snapshotId, finding.state, finding.enforcement, finding.owner ?? null, canonicalize(finding.payload), now, existing.id);
-      return;
-    }
-    this.db.prepare(`INSERT INTO findings(id,snapshot_id,fingerprint,evaluator,state,enforcement,owner,payload_json,first_seen,last_seen) VALUES (?,?,?,?,?,?,?,?,?,?)`).run(finding.id, finding.snapshotId, finding.fingerprint, finding.evaluator, finding.state, finding.enforcement, finding.owner ?? null, canonicalize(finding.payload), now, now);
-  }
-  findFindingId(fingerprint) {
-    return this.db.prepare(`SELECT id FROM findings WHERE fingerprint=? ORDER BY first_seen LIMIT 1`).get(fingerprint)?.id;
-  }
-  getFinding(id) {
-    const row = this.db.prepare(`SELECT * FROM findings WHERE id=?`).get(id);
-    return row ? { ...row, payload: JSON.parse(String(row.payload_json)) } : void 0;
-  }
-  acknowledge(input) {
-    this.db.prepare(`INSERT INTO acknowledgements(id,finding_id,reason,comment,actor,snapshot_id,created_at) VALUES (?,?,?,?,?,?,?)`).run(input.id, input.findingId, input.reason, input.comment ?? null, input.actor, input.snapshotId, nowIso());
-  }
-};
-
 // ../packages/eval-engine/src/index.ts
 var DEFAULT_CONFIG = configSchema.parse({});
 function loadConfig(root) {
-  const filename = path8.join(root, ".scriptonia", "config.yaml");
-  if (!fs7.existsSync(filename)) return { config: DEFAULT_CONFIG, errors: [] };
+  const filename = path5.join(root, ".scriptonia", "config.yaml");
+  if (!fs5.existsSync(filename)) return { config: DEFAULT_CONFIG, errors: [] };
   try {
-    return { config: configSchema.parse(YAML2.parse(fs7.readFileSync(filename, "utf8"))), errors: [] };
+    return { config: configSchema.parse(YAML2.parse(fs5.readFileSync(filename, "utf8"))), errors: [] };
   } catch (error) {
     return { config: DEFAULT_CONFIG, errors: [`config.yaml: ${error instanceof Error ? error.message : String(error)}`] };
   }
@@ -1007,21 +536,21 @@ function parseConfigDocument(text, name = "config.yaml") {
   }
 }
 function ensureConfig(root) {
-  const directory = path8.join(root, ".scriptonia");
-  const filename = path8.join(directory, "config.yaml");
-  fs7.mkdirSync(path8.join(directory, "decisions"), { recursive: true });
-  fs7.mkdirSync(path8.join(directory, "evals"), { recursive: true });
-  if (!fs7.existsSync(filename)) fs7.writeFileSync(filename, YAML2.stringify(DEFAULT_CONFIG));
+  const directory = path5.join(root, ".scriptonia");
+  const filename = path5.join(directory, "config.yaml");
+  fs5.mkdirSync(path5.join(directory, "decisions"), { recursive: true });
+  fs5.mkdirSync(path5.join(directory, "evals"), { recursive: true });
+  if (!fs5.existsSync(filename)) fs5.writeFileSync(filename, YAML2.stringify(DEFAULT_CONFIG));
   return filename;
 }
 function loadEvals(root) {
-  const directory = path8.join(root, ".scriptonia", "evals");
-  if (!fs7.existsSync(directory)) return { evals: [], errors: [] };
+  const directory = path5.join(root, ".scriptonia", "evals");
+  if (!fs5.existsSync(directory)) return { evals: [], errors: [] };
   const evals = [];
   const errors = [];
-  for (const filename of fs7.readdirSync(directory).filter((file) => /\.ya?ml$/i.test(file)).sort()) {
+  for (const filename of fs5.readdirSync(directory).filter((file) => /\.ya?ml$/i.test(file)).sort()) {
     try {
-      evals.push(evalCaseSchema.parse(YAML2.parse(fs7.readFileSync(path8.join(directory, filename), "utf8"))));
+      evals.push(evalCaseSchema.parse(YAML2.parse(fs5.readFileSync(path5.join(directory, filename), "utf8"))));
     } catch (error) {
       errors.push(`${filename}: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -1046,8 +575,8 @@ async function verifyRepository(options) {
   const loadedConfig = trustedRef ? parseConfigDocument(readFileAtRef(options.root, trustedRef, ".scriptonia/config.yaml"), `${trustedRef}:.scriptonia/config.yaml`) : loadConfig(options.root);
   const config = loadedConfig.config;
   const snapshot = await withSpan("snapshot.build", { base_configured: Boolean(options.base ?? config.base_ref) }, () => buildSnapshot({ cwd: options.root, base: options.base ?? config.base_ref }));
-  const planPath = path8.resolve(options.root, options.plan ?? "PLAN.md");
-  const plan = fs7.existsSync(planPath) ? fs7.readFileSync(planPath, "utf8") : void 0;
+  const planPath = path5.resolve(options.root, options.plan ?? "PLAN.md");
+  const plan = fs5.existsSync(planPath) ? fs5.readFileSync(planPath, "utf8") : void 0;
   const loadedDecisions = trustedRef ? parseDecisionDocuments(listFilesAtRef(options.root, trustedRef, [".scriptonia/decisions"]).filter((name) => /\.ya?ml$/i.test(name)).map((name) => ({ name: `${trustedRef}:${name}`, text: readFileAtRef(options.root, trustedRef, name) ?? "" }))) : loadDecisions(options.root);
   const loadedEvals = trustedRef ? parseEvalDocuments(listFilesAtRef(options.root, trustedRef, [".scriptonia/evals"]).filter((name) => /\.ya?ml$/i.test(name)).map((name) => ({ name: `${trustedRef}:${name}`, text: readFileAtRef(options.root, trustedRef, name) ?? "" }))) : loadEvals(options.root);
   const evals = options.evalFilter ? loadedEvals.evals.filter((entry) => entry.id === options.evalFilter || entry.title.toLowerCase().includes(options.evalFilter.toLowerCase())) : loadedEvals.evals;
@@ -1059,8 +588,17 @@ async function verifyRepository(options) {
   });
   const { github, evidence } = collected;
   const passedChecks = github.filter((item2) => item2.state === "available").map((item2) => String(item2.payload.name));
-  const impactIndex = await withSpan("impact.index", { changed_file_count: snapshot.files.length }, () => loadCodeGraphIndex(options.root) ?? buildFallbackImpactIndex(options.root));
-  const impact = impactedFiles(impactIndex, snapshot.files.map((file) => file.path));
+  const impactChange = {
+    files: snapshot.files.map((file) => file.path),
+    lines: parseDiffHunks(snapshot.diff).map((hunk) => ({ path: hunk.path, startLine: Math.max(1, hunk.newRange.startLine), endLineExclusive: Math.max(1, hunk.newRange.endLineExclusive) }))
+  };
+  const impactProvider = await withSpan("impact.index", { changed_file_count: snapshot.files.length }, () => selectImpactProvider({
+    brain: loadCurrentBrainImpactProvider(options.root),
+    codeGraph: loadCodeGraphIndex(options.root),
+    fallback: () => buildFallbackImpactIndex(options.root)
+  }));
+  const impactIndex = impactProvider.index;
+  const impact = impactProvider.dependents(impactChange, 2);
   const scope = await withSpan("scope.resolve", { impacted_file_count: impact.files.length }, () => buildScopeContext(options.root, impact.files, { checks: passedChecks }));
   const policy = await withSpan("policy.evaluate", { decision_count: loadedDecisions.decisions.length }, () => evaluateDecisions(loadedDecisions.decisions, scope));
   const identity = {
@@ -1073,8 +611,8 @@ async function verifyRepository(options) {
     decisions: loadedDecisions.decisions.map((entry) => ({ id: entry.id, version: entry.version, hash: hashObject(entry) })),
     evals: evals.map((entry) => ({ id: entry.id, version: entry.version, hash: hashObject(entry) })),
     evidence: evidence.map((entry) => ({ hash: entry.contentHash, state: entry.state })),
-    impact: { provider: impactIndex.provider, version: impactIndex.version, id: impactIndex.id, edges: impact.edges },
-    evaluators: { policy: "1", eval: "1", plan: "1", gate: "1" },
+    impact: { ...impactProviderIdentity(impactProvider), edges: impact.edges },
+    evaluators: { policy: "1", eval: "1", plan: "1", gate: "1", testCoverage: "2" },
     semantic: config.semantic.enabled || options.semantic ? {
       model: config.semantic.model ?? process.env.OPENAI_OUTPUT_MODEL ?? process.env.LITELLM_MODEL ?? "gpt-5.6-terra",
       endpoint: config.semantic.endpoint ?? process.env.SCRIPTONIA_MODEL_GATEWAY_URL ?? process.env.LITELLM_BASE_URL ?? "unconfigured"
@@ -1098,7 +636,12 @@ async function verifyRepository(options) {
     checks.push(...policy.map(policyToCheck));
     checks.push(...evaluateEvals(evals, scope, evidence, policy));
     checks.push(...evaluatePlan(plan, config.required_plan, evidence));
-    checks.push(testCoverageCheck(snapshot, relatedTests(impactIndex, snapshot.files.map((file) => file.path))));
+    const coverageSourcePaths = new Set(snapshot.files.filter((file) => isProductSourceForCoverage(file.path, coverageSample(snapshot, file.path, file.binary), file.binary)).map((file) => file.path.replaceAll("\\", "/")));
+    const coverageChange = {
+      files: impactChange.files.filter((file) => coverageSourcePaths.has(file.replaceAll("\\", "/"))),
+      lines: impactChange.lines.filter((range) => coverageSourcePaths.has(range.path.replaceAll("\\", "/")))
+    };
+    checks.push(testCoverageCheck(snapshot, impactProvider.relatedTests(coverageChange), impactProvider.changedSymbols(coverageChange.lines)));
     checks.push(...github.map(githubCheck));
     let semanticCoverage = config.semantic.enabled || options.semantic ? "unavailable" : "disabled";
     if ((config.semantic.enabled || options.semantic) && plan) {
@@ -1203,12 +746,178 @@ function parseInlineEvidence(text) {
     return parsed.success ? [parsed.data] : [];
   });
 }
-function testCoverageCheck(snapshot, impactedTests) {
-  const source = snapshot.files.filter((file) => /\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|php|swift|kt)$/i.test(file.path) && !/(?:^|\/)(?:scripts?|migrations?|drizzle)(?:\/|$)/i.test(file.path));
-  const tests = snapshot.files.filter((file) => /(?:^|\/)(?:__tests__|tests?|spec)(?:\/|$)|\.(?:test|spec)\.[^.]+$/i.test(file.path));
-  const state = source.length && !tests.length ? impactedTests.length ? "INCONCLUSIVE" : "FAIL" : "PASS";
-  const evidence = tests.length ? tests.map((file) => ({ kind: "path", value: file.path })) : impactedTests.length ? impactedTests.map((file) => ({ kind: "related_test", value: file })) : source.map((file) => ({ kind: "path", value: file.path }));
-  return makeCheck({ evaluator: "test-coverage", title: "Changed behavior has test evidence", state, enforcement: "warn", reason: state === "FAIL" ? "Product code changed without a changed or statically related test file." : state === "INCONCLUSIVE" ? "Related tests exist, but no result artifact proves they ran." : "A changed test is present or no product code changed.", evidence, refs: [] });
+var COVERAGE_TEST_EXTENSION = "(?:c|cc|cp|cpp|cxx|h|hh|hpp|hxx|inc|m|mm|cs|dart|ex|exs|go|java|js|jsx|mjs|cjs|kt|kts|lua|pl|pm|php|proto|py|pyi|rb|rs|scala|sh|bash|zsh|fish|bzl|bazel|star|swift|ts|tsx|mts|cts|vue)";
+var COVERAGE_TEST_BASENAME = new RegExp(`(?:^|/)(?:test_[^/]+|[^/]+_(?:test|spec)|[^/]+\\.(?:test|spec))\\.${COVERAGE_TEST_EXTENSION}$`, "i");
+var COVERAGE_SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".c",
+  ".h",
+  ".cc",
+  ".cp",
+  ".cpp",
+  ".cxx",
+  ".hh",
+  ".hpp",
+  ".hxx",
+  ".inc",
+  ".m",
+  ".mm",
+  ".cs",
+  ".css",
+  ".scss",
+  ".sass",
+  ".less",
+  ".dart",
+  ".ex",
+  ".exs",
+  ".go",
+  ".graphql",
+  ".gql",
+  ".html",
+  ".htm",
+  ".java",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".json",
+  ".jsonc",
+  ".kt",
+  ".kts",
+  ".lua",
+  ".pl",
+  ".pm",
+  ".php",
+  ".proto",
+  ".py",
+  ".pyi",
+  ".rb",
+  ".rs",
+  ".scala",
+  ".sh",
+  ".bash",
+  ".zsh",
+  ".fish",
+  ".sql",
+  ".bzl",
+  ".bazel",
+  ".star",
+  ".swift",
+  ".toml",
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".vue",
+  ".xml",
+  ".plist",
+  ".yaml",
+  ".yml"
+]);
+var COVERAGE_STARLARK_BASENAMES = /* @__PURE__ */ new Set(["BUILD", "BUILD.bazel", "WORKSPACE", "WORKSPACE.bzlmod", "MODULE.bazel"]);
+var COVERAGE_CONFIG_BASENAMES = /* @__PURE__ */ new Set([
+  ".bazelignore",
+  ".bazelrc",
+  ".bazelversion",
+  ".clang-format",
+  ".clang-tidy",
+  ".dockerignore",
+  ".editorconfig",
+  ".env.example",
+  ".flake8",
+  ".gitignore",
+  ".npmrc",
+  ".nvmrc",
+  ".prettierrc",
+  ".yamllint",
+  "CMakeLists.txt",
+  "CODEOWNERS",
+  "Cargo.toml",
+  "Dockerfile",
+  "Gemfile",
+  "Gemfile.lock",
+  "Makefile",
+  "Podfile",
+  "analysis_options.yaml",
+  "build.gradle",
+  "build.gradle.kts",
+  "composer.json",
+  "composer.lock",
+  "deps.yaml",
+  "extensions_metadata.yaml",
+  "go.mod",
+  "go.sum",
+  "gradle.properties",
+  "MODULE.bazel.lock",
+  "package-lock.json",
+  "package.json",
+  "pnpm-lock.yaml",
+  "pnpm-workspace.yaml",
+  "pom.xml",
+  "pubspec.lock",
+  "pubspec.yaml",
+  "pyproject.toml",
+  "requirements.txt",
+  "settings.gradle",
+  "settings.gradle.kts",
+  "tsconfig.json",
+  "yarn.lock"
+]);
+function isTestFileForCoverage(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return /(?:^|\/)(?:__tests__|tests?|spec|integration_test)(?:\/|$)/i.test(normalized) || COVERAGE_TEST_BASENAME.test(normalized) || /(?:^|\/)[^/]+(?:Test|Tests|Spec)\.(?:cs|java|kt|kts|scala|swift)$/.test(normalized);
+}
+function isProductSourceForCoverage(filePath, sample = "", binary = false) {
+  if (binary || isTestFileForCoverage(filePath)) return false;
+  const normalized = filePath.replaceAll("\\", "/");
+  const base = path5.posix.basename(normalized);
+  if (/(?:^|\/)(?:third_party|vendor|external|docs?|adr|changelogs?)(?:\/|$)/i.test(normalized)) return false;
+  if (/(?:^|\/)generated(?:\/|$)/i.test(normalized) || /\.(?:g|freezed)\.dart$|\.pb\.go$|\.generated\.[^.]+$|\.min\.(?:js|css)$/i.test(base) || /generated|do not edit/i.test(sample.split(/\r?\n/).slice(0, 3).join("\n"))) return false;
+  if (COVERAGE_STARLARK_BASENAMES.has(base) || /\.(?:bzl|bazel|star)$/i.test(base)) return true;
+  if (COVERAGE_CONFIG_BASENAMES.has(base) || /\.(?:lock|config|conf|ini|properties)$/i.test(base) || /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/i.test(normalized) || /^(?:Dockerfile(?:\..+)?|requirements(?:[-_.][^/]*)?\.txt|tsconfig(?:\.[^/]+)?\.json|(?:docker-)?compose(?:\.[^/]+)?\.ya?ml)$/i.test(base)) return false;
+  if (COVERAGE_SOURCE_EXTENSIONS.has(path5.posix.extname(base).toLowerCase())) return true;
+  const firstLine = sample.split(/\r?\n/, 1)[0] ?? "";
+  return /^#!.*\b(?:python3?|bash|sh|zsh|fish|node|ruby)\b/.test(firstLine);
+}
+function coverageSample(snapshot, filePath, binary) {
+  if (binary) return "";
+  try {
+    return fs5.readFileSync(path5.join(snapshot.repositoryRoot, filePath), "utf8").slice(0, 8192);
+  } catch {
+    return "";
+  }
+}
+function changedSymbolIdentity(symbol) {
+  return `${symbol.path}::${symbol.name} (${symbol.kind}, ${symbol.id})`;
+}
+function summarizeChangedSymbols(symbols) {
+  const identities = symbols.map(changedSymbolIdentity);
+  const shown = identities.slice(0, 20);
+  return `${shown.join(", ")}${identities.length > shown.length ? `, +${identities.length - shown.length} more (see evidence)` : ""}`;
+}
+function testCoverageCheck(snapshot, impactedTests, mappedSymbols) {
+  const tests = snapshot.files.filter((file) => isTestFileForCoverage(file.path));
+  const source = snapshot.files.filter((file) => isProductSourceForCoverage(file.path, coverageSample(snapshot, file.path, file.binary), file.binary));
+  const sourcePaths = new Set(source.map((file) => file.path.replaceAll("\\", "/")));
+  const changedSymbols = mappedSymbols.filter((symbol) => sourcePaths.has(symbol.path.replaceAll("\\", "/")));
+  const changedTestPaths = new Set(tests.map((file) => file.path.replaceAll("\\", "/")));
+  const changedRelatedTests = impactedTests.filter((file) => changedTestPaths.has(file.replaceAll("\\", "/")));
+  const state = !source.length || changedRelatedTests.length ? "PASS" : impactedTests.length ? "INCONCLUSIVE" : "FAIL";
+  const evidence = state === "PASS" ? (source.length ? changedRelatedTests : tests.map((file) => file.path)).map((file) => ({ kind: "path", value: file })) : impactedTests.length ? [
+    ...changedSymbols.map((symbol) => ({ kind: "changed_symbol", value: changedSymbolIdentity(symbol) })),
+    ...impactedTests.map((file) => ({ kind: "related_test", value: file }))
+  ] : changedSymbols.length ? changedSymbols.map((symbol) => ({ kind: "uncovered_symbol", value: changedSymbolIdentity(symbol) })) : source.map((file) => ({ kind: "path", value: file.path }));
+  const subject = changedSymbols.length ? `changed symbols ${summarizeChangedSymbols(changedSymbols)}` : `changed product source ${source.map((file) => file.path).join(", ")}`;
+  const reason = state === "FAIL" ? `No changed or statically related test covers ${subject}.` : state === "INCONCLUSIVE" ? `Related tests exist for ${subject}, but no result artifact proves they ran.` : source.length ? "A statically related test changed with the product behavior." : "No product code changed.";
+  return makeCheck({
+    evaluator: "test-coverage",
+    evaluatorVersion: "2",
+    title: "Changed behavior has test evidence",
+    state,
+    enforcement: "warn",
+    reason,
+    evidence,
+    refs: changedSymbols.map((symbol) => symbol.id)
+  });
 }
 function githubCheck(evidence) {
   return makeCheck({ evaluator: "github-check", title: `CI check: ${String(evidence.payload.name)}`, state: evidence.state === "available" ? "PASS" : evidence.state === "failed" ? "FAIL" : evidence.state === "error" ? "ERROR" : "INCONCLUSIVE", enforcement: "block", reason: evidence.state === "available" ? "GitHub job succeeded." : evidence.state === "failed" ? `GitHub job concluded ${String(evidence.payload.conclusion)}.` : "GitHub job conclusion is unavailable.", evidence: [{ id: evidence.id, kind: evidence.kind, value: evidence.source }], refs: [] });
@@ -1224,8 +933,9 @@ async function evaluateSemanticCriteria(plan, snapshot, config) {
   return results;
 }
 function makeCheck(input) {
-  const identity = { evaluator: input.evaluator, version: "1", title: input.title, state: input.state, evidence: input.evidence ?? [], refs: input.refs };
-  return { id: input.id ?? createId("check"), evaluator: input.evaluator, evaluatorVersion: "1", title: input.title, state: input.state, enforcement: input.enforcement, reason: input.reason, evidence: input.evidence ?? [], refs: input.refs, ...input.owner ? { owner: input.owner } : {}, fingerprint: hashObject(identity) };
+  const evaluatorVersion = input.evaluatorVersion ?? "1";
+  const identity = { evaluator: input.evaluator, version: evaluatorVersion, title: input.title, state: input.state, evidence: input.evidence ?? [], refs: input.refs };
+  return { id: input.id ?? createId("check"), evaluator: input.evaluator, evaluatorVersion, title: input.title, state: input.state, enforcement: input.enforcement, reason: input.reason, evidence: input.evidence ?? [], refs: input.refs, ...input.owner ? { owner: input.owner } : {}, fingerprint: hashObject(identity) };
 }
 function escapeRegex(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1253,10 +963,10 @@ function learnFromFinding(root, findingId) {
       enforcement: "observe",
       fingerprint: payload.fingerprint
     });
-    const filename = path8.join(root, ".scriptonia", "evals", `${id}.yaml`);
-    if (fs7.existsSync(filename)) throw new Error(`draft eval already exists: ${path8.relative(root, filename)}`);
-    fs7.mkdirSync(path8.dirname(filename), { recursive: true });
-    fs7.writeFileSync(filename, YAML2.stringify(evalCase));
+    const filename = path5.join(root, ".scriptonia", "evals", `${id}.yaml`);
+    if (fs5.existsSync(filename)) throw new Error(`draft eval already exists: ${path5.relative(root, filename)}`);
+    fs5.mkdirSync(path5.dirname(filename), { recursive: true });
+    fs5.writeFileSync(filename, YAML2.stringify(evalCase));
     return { path: filename, evalCase };
   } finally {
     store.close();
@@ -1293,7 +1003,7 @@ function evalDoctor(root) {
 }
 function toSarif(result) {
   const actionable = result.checks.filter((check) => check.state === "FAIL" || check.state === "ERROR" || check.state === "INCONCLUSIVE");
-  return { version: "2.1.0", $schema: "https://json.schemastore.org/sarif-2.1.0.json", runs: [{ tool: { driver: { name: "Scriptonia", version: "0.9.0-rc.1", informationUri: "https://scriptonia.dev", rules: [...new Map(actionable.map((check) => [check.evaluator, { id: check.evaluator, name: check.evaluator, shortDescription: { text: check.title } }])).values()] } }, results: actionable.map((check) => ({ ruleId: check.evaluator, level: check.enforcement === "block" ? "error" : "warning", message: { text: `${check.title}: ${check.reason}` }, properties: { state: check.state, enforcement: check.enforcement, fingerprint: check.fingerprint, refs: check.refs } })) }] };
+  return { version: "2.1.0", $schema: "https://json.schemastore.org/sarif-2.1.0.json", runs: [{ tool: { driver: { name: "Scriptonia", version: "0.9.0-rc.2", informationUri: "https://scriptonia.dev", rules: [...new Map(actionable.map((check) => [check.evaluator, { id: check.evaluator, name: check.evaluator, shortDescription: { text: check.title } }])).values()] } }, results: actionable.map((check) => ({ ruleId: check.evaluator, level: check.enforcement === "block" ? "error" : "warning", message: { text: `${check.title}: ${check.reason}` }, properties: { state: check.state, enforcement: check.enforcement, fingerprint: check.fingerprint, refs: check.refs } })) }] };
 }
 
 // ../packages/github/src/index.ts
@@ -1309,8 +1019,8 @@ function escapeCell(value) {
 
 // ../packages/run-capture/src/index.ts
 import { spawn } from "child_process";
-import fs8 from "fs";
-import path9 from "path";
+import fs6 from "fs";
+import path6 from "path";
 
 // ../packages/run-protocol/src/index.ts
 var BUILTIN_PATTERNS = [
@@ -1420,7 +1130,7 @@ function snapshotFileHashes(root, files) {
       continue;
     }
     try {
-      hashes.set(file.path, sha256(fs8.readFileSync(path9.join(root, file.path))));
+      hashes.set(file.path, sha256(fs6.readFileSync(path6.join(root, file.path))));
     } catch {
       hashes.set(file.path, "unreadable");
     }
@@ -1442,8 +1152,1006 @@ function ingestJsonl(root, text, adapter = "normalized") {
   }
 }
 
+// src/brain-commands.ts
+import fs8 from "fs";
+import path8 from "path";
+import { spawnSync } from "child_process";
+import pc from "picocolors";
+
+// src/brain-knowledge-http.ts
+function apiOrigin(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new TypeError("Scriptonia URL must use http or https");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol === "http:" && !loopback) {
+    throw new TypeError("Scriptonia URL must use HTTPS except for an explicit loopback address");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function responseIssue(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return "unexpected response";
+  const record3 = value;
+  const error = typeof record3.error === "string" ? record3.error : "request_failed";
+  const message = typeof record3.message === "string" ? record3.message : void 0;
+  const issues = Array.isArray(record3.issues) ? record3.issues.map((entry) => typeof entry === "string" ? entry : JSON.stringify(entry)).join("; ") : void 0;
+  return [error, message, issues].filter(Boolean).join(": ");
+}
+function createBrainKnowledgeHttpProvider(options) {
+  const baseUrl = apiOrigin(options.baseUrl.trim());
+  const apiKey = options.apiKey.trim();
+  if (!apiKey) throw new TypeError("Scriptonia API key cannot be empty");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  return {
+    id: "scriptonia-brain-extract-http",
+    version: "1",
+    async extract(call) {
+      const response = await fetchImpl(`${baseUrl}/api/brain/extract`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${apiKey}`,
+          "content-type": "application/json"
+        },
+        // The server endpoint owns model selection and repair. It accepts the
+        // stable BrainExtractRequestV1 contract, never provider internals.
+        body: JSON.stringify(call.request),
+        signal: call.signal
+      });
+      const value = await response.json().catch(() => void 0);
+      if (!response.ok) {
+        throw new Error(`Scriptonia brain extraction failed (${response.status}): ${responseIssue(value)}`);
+      }
+      const parsed = brainExtractResponseV1Schema.safeParse(value);
+      if (!parsed.success) {
+        throw new Error(`Scriptonia brain extraction returned an invalid response: ${parsed.error.message}`);
+      }
+      return {
+        output: parsed.data,
+        usage: {
+          inputTokens: parsed.data.usage.input_tokens,
+          outputTokens: parsed.data.usage.output_tokens,
+          modelCalls: parsed.data.usage.calls
+        },
+        metadata: {
+          ...response.headers.get("x-scriptonia-model")?.trim() ? { model: response.headers.get("x-scriptonia-model").trim() } : {},
+          ...response.headers.get("x-scriptonia-provider-revision")?.trim() ? { providerRevision: response.headers.get("x-scriptonia-provider-revision").trim() } : {},
+          ...response.headers.get("x-scriptonia-response-id")?.trim() ? { responseId: response.headers.get("x-scriptonia-response-id").trim() } : {}
+        }
+      };
+    }
+  };
+}
+
+// src/local-binding.ts
+import fs7 from "fs";
+import os from "os";
+import path7 from "path";
+function readJson(filename) {
+  try {
+    return JSON.parse(fs7.readFileSync(filename, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function realPath(value) {
+  try {
+    return fs7.realpathSync(value);
+  } catch {
+    return path7.resolve(value);
+  }
+}
+function findLocalProjectBinding(repoRoot, home = os.homedir()) {
+  const configRoot = path7.join(home, ".scriptonia");
+  const global = record(readJson(path7.join(configRoot, "config.json")));
+  if (typeof global?.url !== "string" || !global.url.trim()) return void 0;
+  const projectsRoot = path7.join(configRoot, "projects");
+  if (!fs7.existsSync(projectsRoot)) return void 0;
+  const target = realPath(repoRoot);
+  let selected;
+  for (const entry of fs7.readdirSync(projectsRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const value = record(readJson(path7.join(projectsRoot, entry.name, "project.json")));
+    if (typeof value?.repoPath !== "string" || typeof value.token !== "string" || !value.token.trim()) continue;
+    const candidate = realPath(value.repoPath);
+    if (target !== candidate && !target.startsWith(`${candidate}${path7.sep}`)) continue;
+    if (!selected || candidate.length > selected.root.length) selected = { root: candidate, value };
+  }
+  if (!selected || typeof selected.value.token !== "string") return void 0;
+  return {
+    baseUrl: global.url.trim(),
+    apiKey: selected.value.token.trim(),
+    ...typeof selected.value.projectId === "string" ? { projectId: selected.value.projectId } : {},
+    ...typeof selected.value.name === "string" ? { projectName: selected.value.name } : {}
+  };
+}
+
+// src/brain-commands.ts
+var STATUS_CHANGED_PATH_LIMIT = 50;
+var STATUS_GIT_TIMEOUT_MS = 125;
+var STATUS_GIT_OUTPUT_LIMIT = 512 * 1024;
+var STATUS_STAGE_LIMIT = 64;
+var WHY_FACT_LIMIT = 12;
+function registerBrainCommands(program) {
+  const brain = program.command("brain").description("Build and inspect the deterministic repository Deep Brain");
+  brain.command("build").description("Build a new immutable Deep Brain generation").option("--fast", "run the deterministic fast pipeline").option("--deep", "run the full pipeline, including optional enrichment when available").option("--offline", "forbid network/model enrichment and use local deterministic evidence only").option("--github", "mine bounded GitHub pull-request evidence when credentials are available").option("--show-prompts", "store and reveal the exact credential-screened model inputs").option("--force", "request a hard-gate bypass (always rejected; faulty brains are never activated)").option("--json", "print a machine-readable build summary").action(async (options) => {
+    if (options.fast && options.deep) {
+      emitBuildError("--fast and --deep are mutually exclusive", Boolean(options.json));
+      process.exitCode = 2;
+      return;
+    }
+    if (options.force) {
+      emitBuildError("--force is intentionally rejected: Deep Brain hard gates cannot be bypassed, and a faulty generation is never activated", Boolean(options.json), 1);
+      process.exitCode = 1;
+      return;
+    }
+    const root = findRepositoryRoot();
+    const mode = options.fast ? "fast" : options.deep ? "deep" : "incremental";
+    try {
+      const offline = Boolean(options.offline);
+      const binding = mode === "deep" && !offline ? findLocalProjectBinding(root) : void 0;
+      if (mode === "deep" && !offline && !binding) {
+        throw new Error("Online deep build needs this repository's Scriptonia project binding. Run `npx scriptonia login` and `npx scriptonia init`, or use `--offline`.");
+      }
+      const result = await buildBrain(root, {
+        mode,
+        offline,
+        github: { enabled: Boolean(options.github), offline },
+        ...binding ? { knowledgeProvider: createBrainKnowledgeHttpProvider(binding) } : {},
+        showPrompts: Boolean(options.showPrompts),
+        ...options.showPrompts && !options.json ? {
+          onKnowledgeInspection(artifact) {
+            const attempt = artifact.attempt === void 0 ? "" : ` \xB7 attempt ${artifact.attempt}`;
+            console.log(`  ${pc.magenta("model input").padEnd(12)} ${artifact.kind} \xB7 ${artifact.content}${attempt} \xB7 ${path8.relative(root, artifact.path)}`);
+          }
+        } : {},
+        ...options.json ? {} : {
+          onProgress(event) {
+            const detail = event.detail ? ` \xB7 ${event.detail}` : "";
+            const elapsed = event.elapsedMs === void 0 ? "" : ` \xB7 ${Math.round(event.elapsedMs)}ms`;
+            const state = event.status === "failed" ? pc.red(event.status) : event.status === "skipped" || event.status === "partial" ? pc.yellow(event.status) : event.status === "succeeded" ? pc.green(event.status) : pc.cyan(event.status);
+            console.log(`  ${state.padEnd(12)} ${event.stage}${elapsed}${detail}`);
+          }
+        }
+      });
+      if (options.json) console.log(JSON.stringify(summarizeBuild(result, mode, offline), null, 2));
+      else emitBuildResult(result, mode, offline);
+      if (!result.activated) process.exitCode = 1;
+    } catch (error) {
+      emitBuildError(errorMessage(error), Boolean(options.json));
+      process.exitCode = 2;
+    }
+  });
+  brain.command("status").description("Show the active generation, storage, coverage, staleness, and failures").option("--json", "print machine-readable status").option("--check", "exhaustively compare every repository file with the active generation").action((options) => {
+    const root = findRepositoryRoot();
+    const report = readBrainStatus(root, { check: Boolean(options.check) });
+    if (options.json) console.log(JSON.stringify(report, null, 2));
+    else emitBrainStatus(report);
+    if (report.state === "MISSING") process.exitCode = 1;
+  });
+}
+function readBrainStatus(root, options = {}) {
+  const filename = path8.join(root, ".scriptonia", "brain.db");
+  if (!fs8.existsSync(filename)) return missingStatus(0, []);
+  const store = new BrainStore(root);
+  try {
+    return readBrainStatusFromStore(root, store, { ...options, quickCheck: true });
+  } finally {
+    store.close();
+  }
+}
+function readBrainStatusFromStore(root, store, options = {}) {
+  const activeBuild = store.deep.getActiveBuild();
+  const activeGeneration = store.deep.getActiveGeneration();
+  const recentBuilds = store.deep.listBuilds(10);
+  const emptyStorage = storageSummary(store, 0);
+  if (!activeBuild || !activeGeneration || activeGeneration.buildId !== activeBuild.id) {
+    const failures2 = recentBuildFailures(recentBuilds);
+    if (!activeBuild && failures2.length === 0) failures2.push({ source: "build", code: "NO_ACTIVE_GENERATION", message: "No READY Deep Brain generation is active." });
+    return missingStatus(storageTotal(emptyStorage), failures2, emptyStorage);
+  }
+  const aggregate = readStatusAggregate(store, activeBuild.id);
+  const storage = storageSummary(store, aggregate.activeObjectBytes);
+  const coverage = parseCoverage(activeBuild.coverage);
+  const failures = [];
+  if (!coverage) failures.push({ source: "coverage", code: "COVERAGE_MISSING", message: "The active generation has no readable coverage report.", build_id: activeBuild.id });
+  else for (const check of coverage.checks.filter((entry) => !entry.passed)) {
+    failures.push({ source: "coverage", code: check.id, message: check.message, build_id: activeBuild.id, diagnostics: check.diagnostics });
+  }
+  failures.push(...recentBuildFailures(recentBuilds.filter((build) => build.startedAt > activeBuild.startedAt)));
+  const stageTimings = readStageTimings(store, activeBuild.id);
+  const buildTiming = buildTimingFor(activeBuild);
+  const knowledgeFreshness = knowledgeFreshnessFor(stageTimings, coverage);
+  const planQualityEvidence = store.planQuality.latestForActiveGeneration();
+  const brainScore = coverage ? scoreBrain(coverage, buildTiming, planQualityEvidence) : null;
+  let staleness;
+  if (options.check) {
+    try {
+      const current = inspectRepository(root, store.deep.listFiles(activeBuild.id));
+      const stale = current.snapshotHash !== activeBuild.identity.repositorySnapshotId;
+      const visible = current.changedPaths.slice(0, STATUS_CHANGED_PATH_LIMIT);
+      staleness = {
+        is_stale: stale,
+        checked_snapshot_hash: current.snapshotHash,
+        changed_file_count: current.changedPaths.length,
+        changed_paths: visible,
+        changed_paths_omitted: current.changedPaths.length - visible.length,
+        check: "EXHAUSTIVE",
+        proof: "EXACT",
+        detail: stale ? "Every repository file was hashed; the active generation differs." : "Every repository file was hashed; the active generation matches exactly.",
+        current_head: null,
+        working_tree_dirty: null,
+        candidate_changed_file_count: 0,
+        candidate_changed_paths: [],
+        candidate_changed_paths_omitted: 0
+      };
+      if (stale && current.changedPaths.length === 0) {
+        failures.push({
+          source: "staleness",
+          code: "SNAPSHOT_METADATA_CHANGED",
+          message: "The repository snapshot changed without a content-hash delta; rebuild to refresh classification/configuration evidence.",
+          build_id: activeBuild.id
+        });
+      }
+    } catch (error) {
+      staleness = unknownStaleness("EXHAUSTIVE", `Exhaustive staleness check failed: ${errorMessage(error)}`);
+      failures.push({ source: "staleness", code: "STALENESS_CHECK_FAILED", message: errorMessage(error), build_id: activeBuild.id });
+    }
+  } else if (options.quickCheck === false) {
+    staleness = unknownStaleness("FAST", "Quick Git observation was disabled; run `scriptonia brain status --check` for an exact result.");
+  } else {
+    staleness = inspectRepositoryFast(root);
+  }
+  return {
+    schema_version: "1",
+    state: "READY",
+    size_bytes: storageTotal(storage),
+    generation: {
+      number: activeGeneration.generation,
+      build_id: activeBuild.id,
+      build_snapshot_hash: activeBuild.snapshotId,
+      repository_snapshot_hash: activeBuild.identity.repositorySnapshotId,
+      git_evidence_anchor: aggregate.gitEvidenceAnchor
+    },
+    counts: aggregate.counts,
+    coverage,
+    parser_runtime: parserRuntimeStatus(aggregate.astRuntime),
+    storage,
+    stage_timings: stageTimings.map(({ metrics: _metrics, ...stage }) => stage),
+    build_timing: buildTiming,
+    brain_score: brainScore,
+    knowledge_freshness: knowledgeFreshness,
+    staleness,
+    failures
+  };
+}
+function explainDeepBrain(root, inputTarget) {
+  const status = readBrainStatus(root);
+  if (status.state !== "READY" || !status.generation) {
+    return { available: false, generation: null, stale: status.staleness.is_stale, target: null, role: null, ownership: [], signals: [], plans: [], facts: [], dependents: [], related_tests: [] };
+  }
+  const store = new BrainStore(root);
+  try {
+    const activeBuild = store.deep.getActiveBuild();
+    if (!activeBuild) return { available: false, generation: null, stale: null, target: null, role: null, ownership: [], signals: [], plans: [], facts: [], dependents: [], related_tests: [] };
+    const files = store.deep.listFiles(activeBuild.id);
+    const target = resolveWhyTarget(root, store, activeBuild.id, files, inputTarget);
+    if (!target) {
+      return {
+        available: false,
+        generation: status.generation,
+        stale: status.staleness.is_stale,
+        target: null,
+        role: null,
+        ownership: [],
+        signals: [],
+        plans: [],
+        facts: [],
+        dependents: [],
+        related_tests: [],
+        context_error: `No repository file or symbol matched "${inputTarget.trim()}".`
+      };
+    }
+    const relativePath = target.path;
+    let repositoryState;
+    let stale = status.staleness.is_stale;
+    try {
+      repositoryState = inspectRepository(root, files);
+    } catch {
+    }
+    if (repositoryState) stale = repositoryState.snapshotHash !== activeBuild.identity.repositorySnapshotId;
+    const impact = createBrainImpactProvider(store.deep, { root });
+    const traversal = impact?.dependents({ files: [relativePath] }, 2);
+    const dependents = [...new Set((traversal?.files ?? []).filter((entry) => entry !== relativePath))].sort();
+    const relatedTests2 = [...new Set(impact?.relatedTests({ files: [relativePath] }) ?? [])].sort();
+    const metric = store.deep.getFileGraphMetric(relativePath, activeBuild.id);
+    const rank = store.deep.getFileGraphRank(relativePath, activeBuild.id);
+    const role = metric && rank ? {
+      cluster: metric.cluster,
+      component_id: metric.componentId,
+      core_score: metric.coreScore,
+      hotspot_score: metric.hotspotScore,
+      churn_score: metric.churnScore,
+      core_rank: rank.coreRank,
+      hotspot_rank: rank.hotspotRank,
+      total_files: rank.totalFiles
+    } : null;
+    const exactFacts = store.deep.findContextFactsByExactPaths([relativePath], activeBuild.id);
+    const ownership = exactFacts.filter((fact) => fact.kind === "ownership").flatMap((fact) => ownershipFromPayload(fact.payload));
+    const signals = store.searchSignalsMentioning(relativePath, 10).map((entry) => ({
+      id: entry.id,
+      source: entry.source,
+      excerpt: entry.excerpt,
+      created_at: entry.createdAt
+    }));
+    const plans = store.searchPlansMentioning(relativePath, 10).map((entry) => ({
+      id: entry.id,
+      version: entry.version,
+      state: entry.state,
+      excerpt: entry.excerpt,
+      created_at: entry.createdAt
+    }));
+    const localPlan = localPlanMention(root, relativePath);
+    if (localPlan && !plans.some((entry) => entry.id === localPlan.id && entry.version === localPlan.version)) plans.unshift(localPlan);
+    let pack;
+    let contextError;
+    if (repositoryState && repositoryState.snapshotHash !== activeBuild.identity.repositorySnapshotId && repositoryState.changedPaths.length === 0) {
+      contextError = "Deep Brain is stale because repository metadata changed; rebuild before trusting focused context.";
+    } else {
+      try {
+        const focusedQuery = target.kind === "symbol" && target.symbol ? `Explain symbol "${target.symbol.name}" and the impact of "${relativePath}"` : `Explain the impact of "${relativePath}"`;
+        pack = buildContextPack(store.deep, focusedQuery, {
+          repositoryRoot: root,
+          maxItems: WHY_FACT_LIMIT,
+          maxBytes: 6e4,
+          graph: createContextGraphExpansionAdapter(store.deep),
+          ...repositoryState ? {
+            currentSnapshotHash: repositoryState.snapshotHash,
+            changedPaths: repositoryState.changedPaths
+          } : {}
+        });
+      } catch (error) {
+        contextError = errorMessage(error);
+      }
+    }
+    const facts = pack?.sections.flatMap((section) => section.facts.map((fact) => ({
+      section: section.kind,
+      id: fact.fact_id,
+      title: fact.title,
+      kind: fact.kind,
+      path: fact.source.path,
+      start_line: fact.source.start_line,
+      end_line: fact.source.end_line,
+      relevance: fact.relevance
+    }))) ?? [];
+    return {
+      available: true,
+      generation: status.generation,
+      stale,
+      target,
+      role,
+      ownership,
+      signals,
+      plans,
+      facts,
+      dependents,
+      related_tests: relatedTests2,
+      ...contextError ? { context_error: contextError } : {}
+    };
+  } finally {
+    store.close();
+  }
+}
+function resolveWhyTarget(root, store, buildId, files, input) {
+  const query = input.trim();
+  if (!query || query.length > 500) return void 0;
+  const knownPaths = new Set(files.map((file) => file.path));
+  try {
+    const relative = path8.relative(root, assertInside(root, path8.resolve(root, query))).replaceAll("\\", "/");
+    if (knownPaths.has(relative)) return { input: query, kind: "file", path: relative, alternatives: [] };
+  } catch {
+  }
+  const exact = store.deep.findContextSymbolsByExactNames([query], buildId);
+  const match = exact.length > 0 ? "exact" : "trigram";
+  const candidates = exact.length > 0 ? exact : store.deep.findContextSymbolsByTrigram([query], 20, buildId);
+  if (candidates.length === 0) return void 0;
+  const ranked = rankWhySymbols(store, buildId, candidates);
+  const selected = ranked[0];
+  return {
+    input: query,
+    kind: "symbol",
+    path: selected.filePath,
+    symbol: { id: selected.id, name: selected.name, kind: selected.kind, match },
+    alternatives: ranked.slice(1, 6).map((symbol) => ({ id: symbol.id, name: symbol.name, kind: symbol.kind, path: symbol.filePath }))
+  };
+}
+function rankWhySymbols(store, buildId, symbols) {
+  const scores = /* @__PURE__ */ new Map();
+  for (const symbol of symbols) {
+    if (!scores.has(symbol.filePath)) scores.set(symbol.filePath, store.deep.getFileGraphMetric(symbol.filePath, buildId)?.coreScore ?? 0);
+  }
+  return [...symbols].sort((left, right) => (scores.get(right.filePath) ?? 0) - (scores.get(left.filePath) ?? 0) || left.name.localeCompare(right.name) || left.filePath.localeCompare(right.filePath) || left.id.localeCompare(right.id));
+}
+function ownershipFromPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return [];
+  const record3 = payload;
+  if (record3.advisory !== true || record3.source !== "codeowners" && record3.source !== "git_author") return [];
+  if (typeof record3.confidence !== "number" || !Number.isFinite(record3.confidence) || !Array.isArray(record3.principals)) return [];
+  const principals = record3.principals.flatMap((principal) => {
+    if (!principal || typeof principal !== "object" || Array.isArray(principal)) return [];
+    const value = principal;
+    if (value.kind !== "codeowners" && value.kind !== "git_author" || typeof value.value !== "string" || !value.value.trim()) return [];
+    return [{ kind: value.kind, value: value.value }];
+  });
+  if (!principals.length) return [];
+  return [{ source: record3.source, principals, confidence: record3.confidence, advisory: true, evidence: record3.evidence ?? null }];
+}
+function localPlanMention(root, relativePath) {
+  const filename = path8.join(root, "PLAN.md");
+  if (!fs8.existsSync(filename)) return void 0;
+  let body;
+  try {
+    body = fs8.readFileSync(filename, "utf8");
+  } catch {
+    return void 0;
+  }
+  const index = body.indexOf(relativePath);
+  if (index < 0) return void 0;
+  const start = Math.max(0, index - 160);
+  const end = Math.min(body.length, index + relativePath.length + 240);
+  const excerpt = body.slice(start, end).replace(/[\r\n]+/g, " ").trim();
+  let createdAt = (/* @__PURE__ */ new Date(0)).toISOString();
+  try {
+    createdAt = fs8.statSync(filename).mtime.toISOString();
+  } catch {
+  }
+  return { id: "PLAN.md", version: 1, state: "local", excerpt, created_at: createdAt };
+}
+function summarizeBuild(result, mode, offline) {
+  return {
+    schema_version: "1",
+    state: result.activated ? "READY" : "FAILED",
+    exit_code: result.activated ? 0 : 1,
+    mode,
+    offline,
+    changed: result.changed,
+    activated: result.activated,
+    build_id: result.build.id,
+    active_build_id: result.activeBuildId ?? null,
+    repository_snapshot_hash: result.repositorySnapshotId,
+    files: result.census.files.length,
+    ast: {
+      candidates: result.ast.candidates,
+      parsed: result.ast.parsed,
+      partial: result.ast.partial,
+      failed: result.ast.failed,
+      unsupported: result.ast.unsupported,
+      parser_runtimes: result.ast.parserRuntimes,
+      by_language: result.ast.byLanguage
+    },
+    coverage: result.coverage,
+    stages: result.stages.map((stage) => ({ name: stage.name, required: stage.required, status: stage.status, elapsed_ms: Math.round(stage.elapsedMs), ...stage.error ? { error: stage.error } : {} })),
+    github: result.github ? { status: result.github.status, result_id: result.github.resultId } : null,
+    model_inputs: result.knowledge?.inputInspections?.map((artifact) => ({
+      kind: artifact.kind,
+      content: artifact.content,
+      attempt: artifact.attempt ?? null,
+      hash: artifact.hash,
+      size_bytes: artifact.sizeBytes,
+      path: path8.relative(result.census.root, artifact.path)
+    })) ?? [],
+    projections: result.projections.map((filename) => path8.basename(filename))
+  };
+}
+function emitBuildResult(result, mode, offline) {
+  const state = result.activated ? pc.green("READY") : pc.red("FAILED");
+  console.log(`
+${pc.bold("DEEP BRAIN BUILD")} \xB7 ${state}`);
+  console.log(`  mode        ${mode}${offline ? " \xB7 offline" : ""}${result.changed ? "" : " \xB7 unchanged"}`);
+  console.log(`  files       ${result.census.files.length} \xB7 syntax ${result.ast.parsed + result.ast.partial}/${result.ast.candidates} successful`);
+  console.log(`  Tree-sitter ${result.ast.parserRuntimes["web-tree-sitter"].parsed + result.ast.parserRuntimes["web-tree-sitter"].partial}/${result.ast.parserRuntimes["web-tree-sitter"].candidates}`);
+  console.log(`  structural ${result.ast.parserRuntimes["structural-fallback"].parsed + result.ast.parserRuntimes["structural-fallback"].partial}/${result.ast.parserRuntimes["structural-fallback"].candidates} \xB7 explicitly non-Tree-sitter`);
+  if (result.ast.parserRuntimes.unavailable.candidates > 0) {
+    console.log(`  unavailable ${result.ast.parserRuntimes.unavailable.candidates}`);
+  }
+  console.log(`  coverage    ${result.coverage.passed ? pc.green("PASS") : pc.red("FAIL")}`);
+  for (const check of result.coverage.checks.filter((entry) => !entry.passed)) {
+    console.log(`              ${pc.red(check.id)} \xB7 ${check.message}`);
+    emitCoverageDiagnostics(check.diagnostics, "                ");
+  }
+  console.log(`  snapshot    ${result.repositorySnapshotId}`);
+  console.log(`  build       ${result.build.id}`);
+  if (!result.activated) console.log(`
+  ${pc.red("Not activated.")} The previous READY generation, if any, remains untouched.`);
+  console.log("");
+}
+function emitBuildError(message, json, exitCode = 2) {
+  if (json) console.log(JSON.stringify({ schema_version: "1", state: "FAILED", exit_code: exitCode, error: message }, null, 2));
+  else console.error(`
+${pc.bold("DEEP BRAIN BUILD")} \xB7 ${pc.red("FAILED")}
+  ${message}
+  No previous READY generation was deleted.
+`);
+}
+function emitBrainStatus(report) {
+  if (report.state === "MISSING" || !report.generation) {
+    console.log(`
+${pc.bold("DEEP BRAIN STATUS")} \xB7 ${pc.yellow("NOT BUILT")}`);
+    console.log("  Run: scriptonia brain build --fast --offline");
+    for (const failure of report.failures) {
+      console.log(`  ${pc.red(failure.code)} \xB7 ${failure.message}`);
+      if (failure.diagnostics) emitCoverageDiagnostics(failure.diagnostics, "    ");
+    }
+    console.log("");
+    return;
+  }
+  const freshness = report.staleness.is_stale === false ? pc.green("fresh") : report.staleness.is_stale === true ? pc.yellow("stale") : pc.yellow("unknown freshness");
+  const coverage = report.coverage?.passed ? pc.green("PASS") : pc.red("FAIL");
+  console.log(`
+${pc.bold("DEEP BRAIN STATUS")} \xB7 ${pc.green(report.state)}`);
+  console.log(`  generation  ${report.generation.number} \xB7 ${report.generation.build_id}`);
+  console.log(`  snapshot    ${report.generation.repository_snapshot_hash} \xB7 ${freshness}`);
+  if (report.generation.git_evidence_anchor) console.log(`  git anchor  ${report.generation.git_evidence_anchor} \xB7 bounded history evidence, not a freshness proof`);
+  console.log(`  size        ${formatBytes(report.size_bytes)}`);
+  console.log(`  contents    ${report.counts.files} files \xB7 ${report.counts.symbols} symbols \xB7 ${report.counts.facts} facts \xB7 ${report.counts.edges} edges`);
+  console.log(`  coverage    ${coverage}${report.coverage ? ` \xB7 ${report.coverage.checks.filter((entry) => entry.passed).length}/${report.coverage.checks.length} checks` : " \xB7 missing"}`);
+  if (report.parser_runtime) {
+    const treeSitter = report.parser_runtime.overall["web-tree-sitter"];
+    const structural = report.parser_runtime.overall["structural-fallback"];
+    console.log(`  parsers     Tree-sitter ${treeSitter ? `${treeSitter.parsed + treeSitter.partial}/${treeSitter.candidates}` : "0/0"} \xB7 structural ${structural ? `${structural.parsed + structural.partial}/${structural.candidates}` : "0/0"} (non-Tree-sitter)`);
+  }
+  if (report.brain_score) {
+    const measured = report.brain_score.measured_score === null ? "unavailable" : `${report.brain_score.measured_score.toFixed(1)}/100 measured`;
+    const release = report.brain_score.complete ? ` \xB7 release score ${report.brain_score.release_score?.toFixed(1)}` : ` \xB7 ${report.brain_score.available_points}/100 points have build-scoped evidence`;
+    console.log(`  brain score ${measured}${release}`);
+    for (const component of report.brain_score.components.filter((entry) => entry.status === "UNAVAILABLE")) {
+      console.log(`              ${pc.yellow("unavailable")} ${component.id} \xB7 ${component.detail}`);
+    }
+  }
+  console.log(`  knowledge   ${knowledgeLabel(report.knowledge_freshness.status)} \xB7 ${report.knowledge_freshness.detail}`);
+  if (report.build_timing) {
+    const timing = report.build_timing.elapsed_ms === null ? "elapsed unavailable" : `${formatDuration(report.build_timing.elapsed_ms)} / ${formatDuration(report.build_timing.budget_ms)} budget`;
+    console.log(`  build time  ${report.build_timing.mode.toLowerCase()} \xB7 ${timing}`);
+  }
+  if (report.stage_timings.length > 0) {
+    console.log("  stages");
+    for (const stage of report.stage_timings) {
+      console.log(`              ${stage.status.padEnd(9)} ${stage.name.padEnd(12)} ${stage.elapsed_ms === null ? "unknown" : formatDuration(stage.elapsed_ms)}`);
+    }
+  }
+  if (report.staleness.changed_file_count > 0) {
+    console.log(`  changed     ${report.staleness.changed_file_count} files${report.staleness.changed_paths_omitted ? ` \xB7 ${report.staleness.changed_paths_omitted} omitted` : ""}`);
+    for (const filename of report.staleness.changed_paths.slice(0, 10)) console.log(`              ${filename}`);
+  }
+  if (report.staleness.candidate_changed_file_count > 0) {
+    console.log(`  git status  ${report.staleness.candidate_changed_file_count} current paths observed${report.staleness.candidate_changed_paths_omitted ? ` \xB7 ${report.staleness.candidate_changed_paths_omitted} omitted` : ""}`);
+    for (const filename of report.staleness.candidate_changed_paths.slice(0, 10)) console.log(`              ${filename}`);
+  }
+  if (report.staleness.proof === "UNAVAILABLE") console.log(`  freshness   ${pc.yellow("UNKNOWN")} \xB7 ${report.staleness.detail}`);
+  if (report.failures.length > 0) {
+    console.log("  failures");
+    for (const failure of report.failures) {
+      console.log(`              ${pc.red(failure.code)} \xB7 ${failure.message}`);
+      if (failure.diagnostics) emitCoverageDiagnostics(failure.diagnostics, "                ");
+    }
+  } else console.log(`  failures    ${pc.green("none")}`);
+  console.log("");
+}
+function missingStatus(sizeBytes, failures, storage = emptyStorageSummary(sizeBytes)) {
+  return {
+    schema_version: "1",
+    state: "MISSING",
+    size_bytes: sizeBytes,
+    generation: null,
+    counts: { files: 0, symbols: 0, facts: 0, edges: 0, routes: 0, manifests: 0 },
+    coverage: null,
+    parser_runtime: null,
+    storage,
+    stage_timings: [],
+    build_timing: null,
+    brain_score: null,
+    knowledge_freshness: { status: "NOT_BUILT", changed_files_since_extract: null, detail: "No active Deep Brain generation exists." },
+    staleness: unknownStaleness("FAST", "No active Deep Brain generation exists."),
+    failures
+  };
+}
+function readStatusAggregate(store, buildId) {
+  const summary = store.deep.getBuildSummary(buildId);
+  if (!summary) throw new Error(`Deep Brain status aggregate returned no row for ${buildId}`);
+  return {
+    counts: {
+      files: summary.files,
+      symbols: summary.symbols,
+      facts: summary.facts,
+      edges: summary.edges,
+      routes: summary.routes,
+      manifests: summary.manifests
+    },
+    activeObjectBytes: summary.activeObjectBytes,
+    gitEvidenceAnchor: summary.gitEvidenceAnchor ?? null,
+    ...summary.astRuntime ? { astRuntime: summary.astRuntime } : {}
+  };
+}
+function parserRuntimeStatus(summary) {
+  if (!summary) return null;
+  return {
+    schema_version: summary.schemaVersion,
+    overall: summary.overall,
+    by_language: summary.byLanguage
+  };
+}
+function readStageTimings(store, buildId) {
+  return store.deep.listBuildStages(buildId, STATUS_STAGE_LIMIT).map((row) => {
+    const metrics = record2(row.metrics) ?? null;
+    const error = record2(row.error) ?? null;
+    const elapsedMetric = finiteNonnegative(metrics?.elapsedMs);
+    const elapsedWall = elapsedBetween(row.startedAt, row.finishedAt);
+    return {
+      name: row.name,
+      required: row.required,
+      status: row.status,
+      elapsed_ms: elapsedMetric ?? elapsedWall,
+      error: typeof error?.message === "string" ? error.message : row.error === void 0 ? null : String(row.error),
+      metrics
+    };
+  });
+}
+function buildTimingFor(build) {
+  const mode = build.identity.mode;
+  const budgetMs = mode === "DEEP" ? 7 * 6e4 : mode === "FAST" ? 9e4 : 3e4;
+  const elapsedMs = elapsedBetween(build.startedAt, build.finishedAt ?? null);
+  return {
+    mode,
+    elapsed_ms: elapsedMs,
+    budget_ms: budgetMs,
+    within_budget: elapsedMs === null ? null : elapsedMs <= budgetMs
+  };
+}
+function knowledgeFreshnessFor(stages, coverage) {
+  const stage = stages.find((entry) => entry.name === "knowledge");
+  if (!stage) return { status: "UNKNOWN", changed_files_since_extract: null, detail: "The generation has no knowledge-stage metadata." };
+  const status = typeof stage.metrics?.status === "string" ? stage.metrics.status.toUpperCase() : void 0;
+  const reason = typeof stage.metrics?.reason === "string" ? stage.metrics.reason : void 0;
+  const staleFiles = finiteNonnegative(stage.metrics?.knowledgeStaleByFiles);
+  if (status === "REUSED") {
+    const count = staleFiles ?? 0;
+    return count > 0 ? { status: "STALE", changed_files_since_extract: count, detail: `Citation-valid knowledge was reused and is stale by ${count} changed file${count === 1 ? "" : "s"}.` } : { status: "CURRENT", changed_files_since_extract: 0, detail: "Citation-valid knowledge was reused with no changed source files." };
+  }
+  if (status === "VALIDATED") return { status: "CURRENT", changed_files_since_extract: 0, detail: "Knowledge claims were validated for this generation." };
+  if (status === "SKIPPED" || reason === "offline" || reason === "fast-or-incremental") {
+    return { status: "NOT_BUILT", changed_files_since_extract: null, detail: reason ? `Knowledge extraction was skipped (${reason}).` : "Knowledge extraction was skipped." };
+  }
+  const llmClaims = finiteNonnegative(coverage?.metrics.llmClaims);
+  if (stage.status === "SUCCEEDED" && llmClaims !== null && llmClaims > 0) {
+    return { status: "CURRENT", changed_files_since_extract: 0, detail: "Stored knowledge claims belong to this completed generation." };
+  }
+  return { status: "UNKNOWN", changed_files_since_extract: null, detail: "Knowledge freshness cannot be proven from this generation's stage metadata." };
+}
+function scoreBrain(coverage, timing, planEvidence) {
+  const metric = (name) => finiteNonnegative(coverage.metrics[name]);
+  const sourceFiles = metric("sourceFiles");
+  const languageFiles = metric("identifiedLanguageFiles");
+  const supportedAst = metric("supportedAstFiles");
+  const parsedAst = metric("parsedAstFiles");
+  const internalImports = metric("internalImports");
+  const resolvedImports = metric("resolvedInternalImports");
+  const coverageRatios = [
+    safeRatio(languageFiles, sourceFiles, false),
+    safeRatio(parsedAst, supportedAst, true),
+    safeRatio(resolvedImports, internalImports, true)
+  ];
+  const coverageValue = coverageRatios.every((value) => value !== null) ? coverageRatios.reduce((sum, value) => sum + (value ?? 0), 0) / coverageRatios.length : null;
+  const coverageComponent = coverageValue === null ? unavailableScoreComponent("coverage", 40, "Language, AST, or import coverage metrics are missing.") : measuredScoreComponent("coverage", 40, coverageValue, "Mean of language identification, AST parse, and internal-import resolution rates.");
+  const llmClaims = metric("llmClaims");
+  const citedClaims = metric("citedLlmClaims");
+  const citationValue = llmClaims !== null && citedClaims !== null && llmClaims > 0 ? Math.min(1, citedClaims / llmClaims) : null;
+  const citationComponent = citationValue === null ? unavailableScoreComponent("citation_rate", 20, llmClaims === 0 ? "No LLM knowledge claims exist in this generation." : "Citation metrics are missing.") : measuredScoreComponent("citation_rate", 20, citationValue, "Cited LLM knowledge claims divided by all LLM knowledge claims.");
+  const planComponent = planEvidence ? measuredScoreComponent(
+    "plan_file_validity",
+    25,
+    planEvidence.quality.metrics.plan_file_validity,
+    `Latest valid ${planEvidence.flow} plan ${planEvidence.planSlug} v${planEvidence.planVersion} is bound to this generation (quality ${roundScore(planEvidence.quality.score)}/100).`
+  ) : unavailableScoreComponent(
+    "plan_file_validity",
+    25,
+    "No schema-valid plan-quality evidence is stored for this active generation."
+  );
+  const budgetComponent = timing.within_budget === null ? unavailableScoreComponent("budget_compliance", 15, "The build has no trustworthy finished timestamp.") : measuredScoreComponent(
+    "budget_compliance",
+    15,
+    timing.within_budget ? 1 : 0,
+    `${timing.mode.toLowerCase()} build ${timing.within_budget ? "met" : "exceeded"} the ${formatDuration(timing.budget_ms)} published budget.`
+  );
+  const components = [coverageComponent, citationComponent, planComponent, budgetComponent];
+  const measured = components.filter((component) => component.status === "MEASURED");
+  const earnedPoints = roundScore(measured.reduce((sum, component) => sum + (component.earned_points ?? 0), 0));
+  const availablePoints = measured.reduce((sum, component) => sum + component.weight, 0);
+  const complete = availablePoints === 100;
+  return {
+    measured_score: availablePoints === 0 ? null : roundScore(earnedPoints / availablePoints * 100),
+    earned_points: earnedPoints,
+    available_points: availablePoints,
+    total_points: 100,
+    complete,
+    release_score: complete ? earnedPoints : null,
+    components
+  };
+}
+function measuredScoreComponent(id, weight, value, detail) {
+  const bounded = Math.max(0, Math.min(1, value));
+  return { id, weight, status: "MEASURED", value: roundScore(bounded), earned_points: roundScore(bounded * weight), detail };
+}
+function unavailableScoreComponent(id, weight, detail) {
+  return { id, weight, status: "UNAVAILABLE", value: null, earned_points: null, detail };
+}
+function inspectRepositoryFast(root) {
+  const result = spawnSync("git", ["status", "--porcelain=v2", "--branch", "-z", "--untracked-files=all", "--ignore-submodules=dirty"], {
+    cwd: root,
+    encoding: "utf8",
+    timeout: STATUS_GIT_TIMEOUT_MS,
+    maxBuffer: STATUS_GIT_OUTPUT_LIMIT,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error || result.status !== 0) {
+    const reason = result.error?.message ?? (result.stderr.trim() || `git status exited ${result.status ?? "without a status"}`);
+    return unknownStaleness("FAST", `Bounded Git observation was unavailable: ${reason}. Run \`scriptonia brain status --check\` for an exact result.`);
+  }
+  const parsed = parseGitStatusV2(result.stdout);
+  const visible = parsed.paths.slice(0, STATUS_CHANGED_PATH_LIMIT);
+  return {
+    is_stale: null,
+    checked_snapshot_hash: null,
+    changed_file_count: 0,
+    changed_paths: [],
+    changed_paths_omitted: 0,
+    check: "FAST",
+    proof: "UNAVAILABLE",
+    detail: "Git status describes the current checkout, but this generation does not persist the Git tree and dirty-state proof needed to compare it exactly. Run `scriptonia brain status --check`.",
+    current_head: parsed.head,
+    working_tree_dirty: parsed.paths.length > 0,
+    candidate_changed_file_count: parsed.paths.length,
+    candidate_changed_paths: visible,
+    candidate_changed_paths_omitted: parsed.paths.length - visible.length
+  };
+}
+function parseGitStatusV2(output) {
+  const records = output.split("\0");
+  const paths = /* @__PURE__ */ new Set();
+  let head = null;
+  for (let index = 0; index < records.length; index += 1) {
+    const record3 = records[index] ?? "";
+    if (record3.startsWith("# branch.oid ")) {
+      const candidate = record3.slice("# branch.oid ".length).trim();
+      if (/^[0-9a-f]{40,64}$/.test(candidate)) head = candidate;
+      continue;
+    }
+    let filename;
+    if (record3.startsWith("1 ")) filename = record3.split(" ").slice(8).join(" ");
+    else if (record3.startsWith("2 ")) {
+      filename = record3.split(" ").slice(9).join(" ");
+      const oldPath = records[index + 1];
+      if (oldPath) addGitCandidate(paths, oldPath);
+      index += 1;
+    } else if (record3.startsWith("u ")) filename = record3.split(" ").slice(10).join(" ");
+    else if (record3.startsWith("? ")) filename = record3.slice(2);
+    if (filename) addGitCandidate(paths, filename);
+  }
+  return { head, paths: [...paths].sort() };
+}
+function addGitCandidate(paths, filename) {
+  const normalized = filename.replaceAll("\\", "/");
+  if (!normalized || normalized === ".scriptonia" || normalized.startsWith(".scriptonia/") || normalized === ".git" || normalized.startsWith(".git/")) return;
+  paths.add(normalized);
+}
+function unknownStaleness(check, detail) {
+  return {
+    is_stale: null,
+    checked_snapshot_hash: null,
+    changed_file_count: 0,
+    changed_paths: [],
+    changed_paths_omitted: 0,
+    check,
+    proof: "UNAVAILABLE",
+    detail,
+    current_head: null,
+    working_tree_dirty: null,
+    candidate_changed_file_count: 0,
+    candidate_changed_paths: [],
+    candidate_changed_paths_omitted: 0
+  };
+}
+function inspectRepository(root, storedFiles) {
+  const census = walkRepo(root);
+  const snapshotHash = hashObject(census.files.map((file) => ({
+    path: file.path,
+    sha256: file.sha256,
+    class: file.class,
+    language: file.language,
+    analysisMode: file.analysisMode
+  })));
+  const current = new Map(census.files.map((file) => [file.path, file.sha256]));
+  const stored = new Map(storedFiles.map((file) => [file.path, file.contentHash]));
+  const changedPaths = [.../* @__PURE__ */ new Set([...current.keys(), ...stored.keys()])].filter((filename) => current.get(filename) !== stored.get(filename)).sort();
+  return { snapshotHash, changedPaths };
+}
+function parseCoverage(value) {
+  const envelope = record2(value);
+  const report = record2(envelope?.report);
+  const metrics = record2(envelope?.metrics);
+  if (typeof report?.passed !== "boolean" || !metrics || !Array.isArray(report.checks)) return null;
+  const checks = [];
+  for (const value2 of report.checks) {
+    const check = record2(value2);
+    if (!check || typeof check.id !== "string" || typeof check.passed !== "boolean" || typeof check.message !== "string") continue;
+    checks.push({
+      id: check.id,
+      passed: check.passed,
+      message: check.message,
+      ...typeof check.actual === "number" ? { actual: check.actual } : {},
+      ...typeof check.total === "number" ? { total: check.total } : {},
+      ...typeof check.threshold === "number" ? { threshold: check.threshold } : {},
+      diagnostics: parseCoverageDiagnostics(check.diagnostics)
+    });
+  }
+  return { passed: report.passed, metrics, checks };
+}
+function recentBuildFailures(builds) {
+  const failures = [];
+  for (const build of builds.filter((candidate) => candidate.status === "FAILED").slice(0, 5)) {
+    failures.push({ source: "build", code: "BUILD_FAILED", message: failureMessage(build.failure), build_id: build.id });
+    const coverage = parseCoverage(build.coverage);
+    for (const check of coverage?.checks.filter((candidate) => !candidate.passed) ?? []) {
+      failures.push({
+        source: "coverage",
+        code: check.id,
+        message: check.message,
+        build_id: build.id,
+        diagnostics: check.diagnostics
+      });
+    }
+  }
+  return failures;
+}
+function emptyCoverageDiagnostics() {
+  return { schemaVersion: "1", items: [], omittedCount: 0 };
+}
+function parseCoverageDiagnostics(value) {
+  const object = record2(value);
+  if (object?.schemaVersion !== "1" || !Array.isArray(object.items)) return emptyCoverageDiagnostics();
+  const items = [];
+  let invalidOrCapped = Math.max(0, object.items.length - MAX_DEEP_COVERAGE_DIAGNOSTIC_ITEMS);
+  for (const raw of object.items.slice(0, MAX_DEEP_COVERAGE_DIAGNOSTIC_ITEMS)) {
+    const parsed = parseCoverageGapItem(raw);
+    if (parsed) items.push(parsed);
+    else invalidOrCapped += 1;
+  }
+  const omitted = finiteNonnegative(object.omittedCount) ?? 0;
+  return { schemaVersion: "1", items, omittedCount: Math.floor(omitted) + invalidOrCapped };
+}
+function parseCoverageGapItem(value) {
+  const item2 = record2(value);
+  if (!item2 || typeof item2.kind !== "string") return void 0;
+  if (item2.kind === "source_file_shortfall" && typeof item2.actual === "number" && typeof item2.required === "number") {
+    return { kind: item2.kind, actual: item2.actual, required: item2.required };
+  }
+  if (item2.kind === "required_stage" && typeof item2.stage === "string" && typeof item2.status === "string") {
+    return { kind: item2.kind, stage: item2.stage, status: item2.status, ...typeof item2.reason === "string" ? { reason: item2.reason } : {} };
+  }
+  if (item2.kind === "unknown_language" && typeof item2.path === "string" && (item2.category === "SOURCE" || item2.category === "TEST")) {
+    return { kind: item2.kind, path: item2.path, category: item2.category };
+  }
+  if (item2.kind === "ast_required_file" && typeof item2.path === "string" && (item2.status === "FAILED" || item2.status === "PENDING" || item2.status === "UNSUPPORTED") && typeof item2.reason === "string") {
+    return { kind: item2.kind, path: item2.path, status: item2.status, reason: item2.reason };
+  }
+  if (item2.kind === "unresolved_internal_import" && typeof item2.sourcePath === "string" && typeof item2.specifier === "string") {
+    return { kind: item2.kind, sourcePath: item2.sourcePath, specifier: item2.specifier, ...typeof item2.reason === "string" ? { reason: item2.reason } : {} };
+  }
+  if (item2.kind === "failed_manifest" && typeof item2.path === "string" && typeof item2.manifestKind === "string" && typeof item2.error === "string") {
+    return { kind: item2.kind, path: item2.path, manifestKind: item2.manifestKind, error: item2.error };
+  }
+  if (item2.kind === "knowledge_claim" && typeof item2.claimId === "string" && typeof item2.claimKind === "string" && (item2.status === "UNCITED" || item2.status === "REJECTED") && typeof item2.reason === "string") {
+    return { kind: item2.kind, claimId: item2.claimId, claimKind: item2.claimKind, status: item2.status, reason: item2.reason };
+  }
+  return void 0;
+}
+function emitCoverageDiagnostics(diagnostics, indent) {
+  for (const item2 of diagnostics.items) console.log(`${indent}${coverageDiagnosticLabel(item2)}`);
+  if (diagnostics.omittedCount > 0) console.log(`${indent}+${diagnostics.omittedCount} additional gap${diagnostics.omittedCount === 1 ? "" : "s"} omitted`);
+}
+function coverageDiagnosticLabel(item2) {
+  if (item2.kind === "source_file_shortfall") return `source files ${item2.actual}/${item2.required}`;
+  if (item2.kind === "required_stage") return `${item2.stage} \xB7 ${item2.status}${item2.reason ? ` \xB7 ${item2.reason}` : ""}`;
+  if (item2.kind === "unknown_language") return `${item2.path} \xB7 ${item2.category.toLowerCase()} language unknown`;
+  if (item2.kind === "ast_required_file") return `${item2.path} \xB7 AST ${item2.status.toLowerCase()} \xB7 ${item2.reason}`;
+  if (item2.kind === "unresolved_internal_import") return `${item2.sourcePath} imports ${item2.specifier} \xB7 ${item2.reason ?? "unresolved"}`;
+  if (item2.kind === "failed_manifest") return `${item2.path} \xB7 ${item2.manifestKind} \xB7 ${item2.error}`;
+  return `${item2.claimId} \xB7 ${item2.claimKind} ${item2.status.toLowerCase()} \xB7 ${item2.reason}`;
+}
+function failureMessage(value) {
+  const object = record2(value);
+  if (typeof object?.message === "string") return object.message;
+  if (typeof object?.code === "string") return object.code;
+  if (value === void 0) return "A Deep Brain build failed without a recorded reason.";
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function storageSummary(store, activeObjectBytes) {
+  return {
+    database_bytes: fileSize(store.filename),
+    wal_bytes: fileSize(`${store.filename}-wal`),
+    shared_memory_bytes: fileSize(`${store.filename}-shm`),
+    active_object_bytes: activeObjectBytes,
+    inactive_object_bytes_included: false
+  };
+}
+function emptyStorageSummary(databaseBytes = 0) {
+  return {
+    database_bytes: databaseBytes,
+    wal_bytes: 0,
+    shared_memory_bytes: 0,
+    active_object_bytes: 0,
+    inactive_object_bytes_included: false
+  };
+}
+function storageTotal(storage) {
+  return storage.database_bytes + storage.wal_bytes + storage.shared_memory_bytes + storage.active_object_bytes;
+}
+function fileSize(filename) {
+  try {
+    const stat = fs8.lstatSync(filename);
+    return stat.isFile() && !stat.isSymbolicLink() ? stat.size : 0;
+  } catch {
+    return 0;
+  }
+}
+function formatBytes(value) {
+  if (value < 1024) return `${value} B`;
+  if (value < 1024 ** 2) return `${(value / 1024).toFixed(1)} KiB`;
+  if (value < 1024 ** 3) return `${(value / 1024 ** 2).toFixed(1)} MiB`;
+  return `${(value / 1024 ** 3).toFixed(1)} GiB`;
+}
+function formatDuration(value) {
+  if (value < 1e3) return `${Math.round(value)}ms`;
+  if (value < 6e4) return `${(value / 1e3).toFixed(1)}s`;
+  return `${(value / 6e4).toFixed(1)}m`;
+}
+function knowledgeLabel(status) {
+  if (status === "CURRENT") return pc.green(status.toLowerCase());
+  if (status === "STALE") return pc.yellow(status.toLowerCase());
+  return pc.dim(status.toLowerCase().replace("_", " "));
+}
+function finiteNonnegative(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+function elapsedBetween(startedAt, finishedAt) {
+  if (typeof startedAt !== "string" || typeof finishedAt !== "string") return null;
+  const started = Date.parse(startedAt);
+  const finished = Date.parse(finishedAt);
+  return Number.isFinite(started) && Number.isFinite(finished) && finished >= started ? finished - started : null;
+}
+function safeRatio(actual, total, zeroIsComplete) {
+  if (actual === null || total === null || actual > total) return null;
+  if (total === 0) return zeroIsComplete ? 1 : null;
+  return actual / total;
+}
+function roundScore(value) {
+  return Math.round(value * 100) / 100;
+}
+function record2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // src/index.ts
-var V2_COMMANDS = /* @__PURE__ */ new Set(["run", "runs", "verify", "gate", "learn", "eval", "acknowledge", "events", "v2-init", "report-summary", "diff-check", "why", "recall", "decide", "pulse"]);
+var V2_COMMANDS = /* @__PURE__ */ new Set(["--version", "-V", "run", "runs", "verify", "gate", "learn", "eval", "acknowledge", "events", "v2-init", "report-summary", "diff-check", "why", "recall", "decide", "pulse", "brain"]);
 var requested = process.argv[2];
 if (!requested || !V2_COMMANDS.has(requested)) {
   await import(new URL("../bin/scriptonia.mjs", import.meta.url).href);
@@ -1453,31 +2161,32 @@ if (!requested || !V2_COMMANDS.has(requested)) {
 async function runV2() {
   await initializeTelemetry();
   const program = new Command();
-  program.name("scriptonia").description("Evidence-based product memory and verification for AI coding agents").version("0.9.0-rc.1");
+  program.name("scriptonia").description("Evidence-based product memory and verification for AI coding agents").version("0.9.0-rc.2");
+  registerBrainCommands(program);
   program.command("v2-init").description("Create inspectable V2 configuration directories").action(() => {
     const root = findRepositoryRoot();
     const filename = ensureConfig(root);
-    console.log(`${pc.green("\u2713")} V2 brain configured at ${path10.relative(root, filename)}`);
+    console.log(`${pc2.green("\u2713")} V2 brain configured at ${path9.relative(root, filename)}`);
   });
   program.command("diff-check").description("Run only sub-second deterministic changed-file policies").option("--base <ref>", "base Git reference", "HEAD").action((options) => {
-    const started2 = performance.now();
+    const started = performance.now();
     const root = findRepositoryRoot();
     const snapshot = buildSnapshot({ cwd: root, base: options.base });
     const definitions = loadDecisions(root);
     const context = buildScopeContext(root, snapshot.files.map((file) => file.path));
     const results = evaluateDecisions(definitions.decisions, context).filter((result) => result.state !== "SKIPPED");
-    const plan = path10.join(root, "PLAN.md");
+    const plan = path9.join(root, "PLAN.md");
     const unresolved = fs9.existsSync(plan) ? fs9.readFileSync(plan, "utf8").split("\n").filter((line) => /(?:⚠\s*)?UNRESOLVED/i.test(line)) : [];
     console.log(`
-${pc.bold("SCRIPTONIA DIFF CHECK")} \xB7 ${snapshot.files.length} changed files
+${pc2.bold("SCRIPTONIA DIFF CHECK")} \xB7 ${snapshot.files.length} changed files
 `);
-    for (const error of definitions.errors) console.log(`  ${pc.red("ERROR")} ${error}`);
-    for (const result of results) console.log(`  ${result.state === "PASS" ? pc.green(result.state) : pc.red(result.state)} ${result.title} \xB7 ${result.reason}`);
-    if (unresolved.length) console.log(`  ${pc.red("FAIL")} PLAN.md contains ${unresolved.length} unresolved constraint(s).`);
+    for (const error of definitions.errors) console.log(`  ${pc2.red("ERROR")} ${error}`);
+    for (const result of results) console.log(`  ${result.state === "PASS" ? pc2.green(result.state) : pc2.red(result.state)} ${result.title} \xB7 ${result.reason}`);
+    if (unresolved.length) console.log(`  ${pc2.red("FAIL")} PLAN.md contains ${unresolved.length} unresolved constraint(s).`);
     const blocked = unresolved.length > 0 || results.some((result) => result.state === "FAIL" && result.enforcement === "block");
     const errored = definitions.errors.length > 0 || results.some((result) => result.state === "ERROR");
     console.log(`
-${errored ? "ERROR" : blocked ? "BLOCKED" : "PASS"} \xB7 ${Math.round(performance.now() - started2)}ms
+${errored ? "ERROR" : blocked ? "BLOCKED" : "PASS"} \xB7 ${Math.round(performance.now() - started)}ms
 `);
     process.exitCode = errored ? 4 : blocked ? 3 : 0;
   });
@@ -1486,23 +2195,59 @@ ${errored ? "ERROR" : blocked ? "BLOCKED" : "PASS"} \xB7 ${Math.round(performanc
     ensureConfig(root);
     const id = `decision_${slug(title)}_${Date.now().toString(36)}`;
     const decision = decisionSchema.parse({ schema_version: "1", id, version: 1, title, state: options.confirm ? "active" : "draft", owner: options.owner, source_refs: [], scope: { paths: { include: csv(options.include), exclude: csv(options.exclude) } }, predicate: { kind: options.kind, names: csv(options.names) }, enforcement: options.enforcement, created_at: (/* @__PURE__ */ new Date()).toISOString(), confirmed_by: options.confirm });
-    const filename = path10.join(root, ".scriptonia", "decisions", `${id}.yaml`);
+    const filename = path9.join(root, ".scriptonia", "decisions", `${id}.yaml`);
     fs9.writeFileSync(filename, YAML3.stringify(decision));
-    console.log(`${pc.green("\u2713")} ${decision.state} decision written to ${path10.relative(root, filename)}`);
+    console.log(`${pc2.green("\u2713")} ${decision.state} decision written to ${path9.relative(root, filename)}`);
     if (decision.state === "draft") console.log("  Review its scope and predicate, then confirm it before enforcement.");
   });
-  program.command("why <file>").description("Explain the active product memory affecting a file").action((file) => {
+  program.command("why <target>").description("Explain Deep Brain evidence, impact, tests, decisions, and evals affecting a file or symbol").option("--json", "print a machine-readable explanation").action((target, options) => {
     const root = findRepositoryRoot();
-    const relative = path10.relative(root, assertInside(root, path10.resolve(root, file))).replaceAll("\\", "/");
-    const context = buildScopeContext(root, [relative]);
-    const decisions = loadDecisions(root).decisions.filter((entry) => entry.state === "active" && matchScope(entry.scope, context).matched);
-    const evals = loadEvals(root).evals.filter((entry) => entry.state === "active" && matchScope(entry.scope, context).matched);
+    const deep = explainDeepBrain(root, target);
+    const relative = deep.target?.path;
+    const context = relative ? buildScopeContext(root, [relative]) : void 0;
+    const decisions = context ? loadDecisions(root).decisions.filter((entry) => entry.state === "active" && matchScope(entry.scope, context).matched) : [];
+    const evals = context ? loadEvals(root).evals.filter((entry) => entry.state === "active" && matchScope(entry.scope, context).matched) : [];
+    if (options.json) {
+      console.log(JSON.stringify({
+        schema_version: "1",
+        query: target,
+        file: relative ?? null,
+        deep_brain: deep,
+        decisions: decisions.map((entry) => ({ id: entry.id, version: entry.version, title: entry.title, enforcement: entry.enforcement })),
+        evals: evals.map((entry) => ({ id: entry.id, version: entry.version, title: entry.title, enforcement: entry.enforcement }))
+      }, null, 2));
+      return;
+    }
     console.log(`
-${pc.bold("WHY")} ${relative}
+${pc2.bold("WHY")} ${target}${relative && relative !== target ? ` \u2192 ${relative}` : ""}
 `);
+    if (deep.available && deep.generation) {
+      const freshness = deep.stale === false ? pc2.green("fresh") : deep.stale === true ? pc2.yellow("stale") : pc2.yellow("freshness unknown");
+      console.log(`  brain     generation ${deep.generation.number} \xB7 ${freshness} \xB7 ${deep.generation.build_id}`);
+      if (deep.target?.symbol) {
+        console.log(`  symbol    ${deep.target.symbol.name} \xB7 ${deep.target.symbol.kind} \xB7 ${deep.target.symbol.match} match \xB7 ${deep.target.symbol.id}`);
+        for (const alternative of deep.target.alternatives) console.log(`  also      ${alternative.name} \xB7 ${alternative.kind} \xB7 ${alternative.path}`);
+      }
+      if (deep.role) {
+        console.log(`  role      ${deep.role.cluster} \xB7 core #${deep.role.core_rank}/${deep.role.total_files} (${deep.role.core_score.toFixed(2)}) \xB7 hotspot #${deep.role.hotspot_rank} (${deep.role.hotspot_score.toFixed(2)}) \xB7 churn ${deep.role.churn_score.toFixed(2)}`);
+      }
+      for (const owner of deep.ownership) console.log(`  owner     ${owner.principals.map((principal) => principal.value).join(", ")} \xB7 ${owner.source} \xB7 ${(owner.confidence * 100).toFixed(0)}% \xB7 advisory`);
+      for (const fact of deep.facts) {
+        console.log(`  evidence  ${fact.title} \xB7 ${fact.path}:${fact.start_line} \xB7 ${(fact.relevance * 100).toFixed(0)}% \xB7 ${fact.id}`);
+      }
+      for (const dependent of deep.dependents) console.log(`  dependent ${dependent}`);
+      for (const test of deep.related_tests) console.log(`  test      ${test}`);
+      for (const signal of deep.signals) console.log(`  signal    ${signal.id} \xB7 ${signal.source} \xB7 ${signal.excerpt.replace(/[\r\n]+/g, " ").slice(0, 180)}`);
+      for (const plan of deep.plans) console.log(`  plan      ${plan.id}@${plan.version} \xB7 ${plan.state} \xB7 ${plan.excerpt.replace(/[\r\n]+/g, " ").slice(0, 180)}`);
+      if (deep.context_error) console.log(`  ${pc2.yellow("context")}   ${deep.context_error}`);
+    } else if (deep.generation) {
+      console.log(`  brain     ${pc2.yellow(deep.context_error ?? `no file or symbol matched "${target}"`)}`);
+    } else {
+      console.log(`  brain     ${pc2.dim("not built \xB7 run scriptonia brain build --fast --offline")}`);
+    }
     for (const decision of decisions) console.log(`  decision  ${decision.id}@${decision.version} \xB7 ${decision.title} \xB7 ${decision.enforcement}`);
     for (const evaluation2 of evals) console.log(`  eval      ${evaluation2.id}@${evaluation2.version} \xB7 ${evaluation2.title} \xB7 ${evaluation2.enforcement}`);
-    if (!decisions.length && !evals.length) console.log("  No active scoped decisions or evals apply.");
+    if (!deep.facts.length && !deep.dependents.length && !deep.related_tests.length && !deep.ownership.length && !deep.signals.length && !deep.plans.length && !decisions.length && !evals.length) console.log("  No active Deep Brain evidence, scoped decisions, signals, plans, or evals apply.");
     console.log("");
   });
   program.command("recall <query>").description("Search inspectable local decisions and evals").option("--limit <number>", "maximum matches", "10").action((query, options) => {
@@ -1514,7 +2259,7 @@ ${pc.bold("WHY")} ${relative}
     const tokens = query.toLowerCase().split(/\W+/).filter(Boolean);
     const matches = entries.map((entry) => ({ ...entry, score: tokens.reduce((score, token) => score + (entry.body.toLowerCase().split(token).length - 1), 0) })).filter((entry) => entry.score > 0).sort((a, b) => b.score - a.score).slice(0, Math.max(1, Number(options.limit) || 10));
     console.log(`
-${pc.bold("RECALL")} \u201C${query}\u201D
+${pc2.bold("RECALL")} \u201C${query}\u201D
 `);
     for (const entry of matches) console.log(`  ${entry.kind.padEnd(9)} ${entry.id} \xB7 ${entry.title}`);
     if (!matches.length) console.log("  No matching local memory.");
@@ -1531,13 +2276,13 @@ ${pc.bold("RECALL")} \u201C${query}\u201D
     try {
       const runs = store.listRuns(5);
       console.log(`
-${pc.bold("SCRIPTONIA PULSE")}
+${pc2.bold("SCRIPTONIA PULSE")}
 `);
-      console.log(`  repository  ${snapshot.dirty ? pc.yellow("dirty") : pc.green("clean")} \xB7 ${snapshot.files.length} changed files`);
+      console.log(`  repository  ${snapshot.dirty ? pc2.yellow("dirty") : pc2.green("clean")} \xB7 ${snapshot.files.length} changed files`);
       console.log(`  decisions   ${decisions.decisions.filter((entry) => entry.state === "active").length} active \xB7 ${decisions.errors.length} invalid`);
       console.log(`  evals       ${evals.evals.filter((entry) => entry.state === "active").length} active \xB7 ${health.issues.length} health issues`);
       console.log(`  runs        ${runs.length} recent captured`);
-      console.log(`  semantic    ${process.env.SCRIPTONIA_MODEL_GATEWAY_URL && process.env.SCRIPTONIA_API_TOKEN || process.env.LITELLM_BASE_URL && process.env.LITELLM_MASTER_KEY ? pc.green("configured") : pc.dim("disabled until credentials are added")}`);
+      console.log(`  semantic    ${process.env.SCRIPTONIA_MODEL_GATEWAY_URL && process.env.SCRIPTONIA_API_TOKEN || process.env.LITELLM_BASE_URL && process.env.LITELLM_MASTER_KEY ? pc2.green("configured") : pc2.dim("disabled until credentials are added")}`);
       console.log("");
     } finally {
       store.close();
@@ -1561,7 +2306,7 @@ ${pc.bold("SCRIPTONIA PULSE")}
     const exact = separator >= 0 ? process.argv.slice(separator + 1) : argv;
     const result = await captureCommand({ root, command: exact, adapter: options.adapter, agent: options.agent });
     console.log(`
-${pc.green("\u2713")} captured ${result.runId} \xB7 child exit ${result.exitCode}`);
+${pc2.green("\u2713")} captured ${result.runId} \xB7 child exit ${result.exitCode}`);
     process.exitCode = result.exitCode;
   });
   program.command("runs").description("List recent captured agent runs").option("--json", "print JSON").option("--limit <number>", "maximum rows", "20").action((options) => {
@@ -1572,7 +2317,7 @@ ${pc.green("\u2713")} captured ${result.runId} \xB7 child exit ${result.exitCode
       if (options.json) console.log(JSON.stringify(runs, null, 2));
       else {
         console.log(`
-${pc.bold("RECENT AGENT RUNS")}
+${pc2.bold("RECENT AGENT RUNS")}
 `);
         if (!runs.length) console.log("  No captured runs yet. Use: scriptonia run -- <agent-command>");
         for (const run of runs) console.log(`  ${String(run.status).padEnd(10)} ${run.id}  ${JSON.stringify(run.command)}  exit=${run.exit_code ?? "-"}`);
@@ -1594,7 +2339,7 @@ ${pc.bold("RECENT AGENT RUNS")}
   program.command("learn <finding-id>").description("Convert a confirmed finding into a reviewable draft eval").action((findingId) => {
     const root = findRepositoryRoot();
     const learned = learnFromFinding(root, findingId);
-    console.log(`${pc.green("\u2713")} draft eval ${learned.evalCase.id} written to ${path10.relative(root, learned.path)}`);
+    console.log(`${pc2.green("\u2713")} draft eval ${learned.evalCase.id} written to ${path9.relative(root, learned.path)}`);
     console.log("  Review its scope and evidence, add an owner, then change state to active.");
   });
   const evaluation = program.command("eval").description("Run and maintain versioned regression cases");
@@ -1608,7 +2353,7 @@ ${pc.bold("RECENT AGENT RUNS")}
     const root = findRepositoryRoot();
     const report = evalDoctor(root);
     console.log(`
-${pc.bold("EVAL DOCTOR")} \xB7 ${report.healthy ? pc.green("HEALTHY") : pc.yellow("NEEDS ATTENTION")}
+${pc2.bold("EVAL DOCTOR")} \xB7 ${report.healthy ? pc2.green("HEALTHY") : pc2.yellow("NEEDS ATTENTION")}
 `);
     for (const issue of report.issues) console.log(`  ${issue.kind.padEnd(16)} ${issue.id} \xB7 ${issue.message}`);
     if (!report.issues.length) console.log("  No duplicate, stale, ownerless, invalid, or expired evals.");
@@ -1620,19 +2365,19 @@ ${pc.bold("EVAL DOCTOR")} \xB7 ${report.healthy ? pc.green("HEALTHY") : pc.yello
     if (!allowed.includes(options.reason)) throw new Error(`invalid reason: ${options.reason}`);
     const root = findRepositoryRoot();
     const id = acknowledgeFinding(root, findingId, options.reason, options.actor, options.comment);
-    console.log(`${pc.green("\u2713")} acknowledgement recorded: ${id}`);
+    console.log(`${pc2.green("\u2713")} acknowledgement recorded: ${id}`);
   });
   const events = program.command("events").description("Ingest normalized adapter events");
   events.command("ingest <file>").option("--adapter <name>", "normalized or codex", "normalized").action((filename, options) => {
     const root = findRepositoryRoot();
-    const full = assertInside(root, path10.resolve(root, filename));
+    const full = assertInside(root, path9.resolve(root, filename));
     if (options.adapter !== "normalized" && options.adapter !== "codex") throw new Error(`unsupported event adapter: ${options.adapter}`);
     const count = ingestJsonl(root, fs9.readFileSync(full, "utf8"), options.adapter);
-    console.log(`${pc.green("\u2713")} ingested ${count} normalized run events`);
+    console.log(`${pc2.green("\u2713")} ingested ${count} normalized run events`);
   });
   program.command("report-summary <file>").action((filename) => {
     const root = findRepositoryRoot();
-    const full = assertInside(root, path10.resolve(root, filename));
+    const full = assertInside(root, path9.resolve(root, filename));
     const result = JSON.parse(fs9.readFileSync(full, "utf8"));
     const markdown = githubStepSummary(result);
     if (process.env.GITHUB_STEP_SUMMARY) fs9.appendFileSync(process.env.GITHUB_STEP_SUMMARY, markdown);
@@ -1643,16 +2388,16 @@ ${pc.bold("EVAL DOCTOR")} \xB7 ${report.healthy ? pc.green("HEALTHY") : pc.yello
 function emitVerification(root, result, options) {
   if (options.json === true) console.log(JSON.stringify(result, null, 2));
   else {
-    const color = result.gate === "PASS" ? pc.green : result.gate === "PASS_WITH_WARNINGS" ? pc.yellow : pc.red;
+    const color = result.gate === "PASS" ? pc2.green : result.gate === "PASS_WITH_WARNINGS" ? pc2.yellow : pc2.red;
     console.log(`
-${pc.bold("SCRIPTONIA VERIFY")} \xB7 ${color(result.gate)}${result.cached ? pc.dim(" \xB7 cached") : ""}`);
-    console.log(pc.dim(`snapshot ${result.snapshotId}`));
+${pc2.bold("SCRIPTONIA VERIFY")} \xB7 ${color(result.gate)}${result.cached ? pc2.dim(" \xB7 cached") : ""}`);
+    console.log(pc2.dim(`snapshot ${result.snapshotId}`));
     console.log(`coverage plan=${result.coverage.plan} decisions=${result.coverage.decisions.evaluated}/${result.coverage.decisions.total} evals=${result.coverage.evals.evaluated}/${result.coverage.evals.total} semantic=${result.coverage.semantic}
 `);
     for (const check of result.checks) {
-      const state = check.state === "PASS" ? pc.green(check.state) : check.state === "SKIPPED" ? pc.dim(check.state) : check.state === "INCONCLUSIVE" ? pc.yellow(check.state) : pc.red(check.state);
+      const state = check.state === "PASS" ? pc2.green(check.state) : check.state === "SKIPPED" ? pc2.dim(check.state) : check.state === "INCONCLUSIVE" ? pc2.yellow(check.state) : pc2.red(check.state);
       console.log(`  ${state.padEnd(18)} ${check.title}`);
-      if (check.state !== "PASS" && check.state !== "SKIPPED") console.log(`                     ${pc.dim(check.reason)} \xB7 ${check.findingId ?? check.id}`);
+      if (check.state !== "PASS" && check.state !== "SKIPPED") console.log(`                     ${pc2.dim(check.reason)} \xB7 ${check.findingId ?? check.id}`);
     }
     console.log(`
 exit ${result.exitCode}
@@ -1664,8 +2409,8 @@ exit ${result.exitCode}
 `);
 }
 function writeOutput(root, filename, content) {
-  const full = assertInside(root, path10.resolve(root, filename));
-  fs9.mkdirSync(path10.dirname(full), { recursive: true });
+  const full = assertInside(root, path9.resolve(root, filename));
+  fs9.mkdirSync(path9.dirname(full), { recursive: true });
   fs9.writeFileSync(full, content);
 }
 function csv(value) {
@@ -1677,7 +2422,7 @@ function slug(value) {
 function configureGatewayFromLegacyLogin() {
   if (process.env.SCRIPTONIA_MODEL_GATEWAY_URL && process.env.SCRIPTONIA_API_TOKEN) return;
   try {
-    const config = JSON.parse(fs9.readFileSync(path10.join(os.homedir(), ".scriptonia", "config.json"), "utf8"));
+    const config = JSON.parse(fs9.readFileSync(path9.join(os2.homedir(), ".scriptonia", "config.json"), "utf8"));
     if (config.url && !process.env.SCRIPTONIA_MODEL_GATEWAY_URL) process.env.SCRIPTONIA_MODEL_GATEWAY_URL = config.url;
     if (config.token && !process.env.SCRIPTONIA_API_TOKEN) process.env.SCRIPTONIA_API_TOKEN = config.token;
   } catch {