sdd-agent-platform 0.4.1 → 0.4.2

package/node_modules/@sdd-agent-platform/core/src/sync-back/inspect.ts

@@ -1,655 +0,0 @@
-import { createHash } from 'node:crypto';
-import { stat } from 'node:fs/promises';
-import path from 'node:path';
-import { normalizePortablePath } from '../path-safety.js';
-import { toArtifactRootRelativePath } from '../runtime-paths.js';
-import type { RunState } from '../run-state/model.js';
-import { readArtifact } from '../run-state/artifacts.js';
-import { readRunEvents } from '../run-state/events.js';
-import { readAllRunStates, readRunState } from '../run-state/run-state.js';
-import { resolveWorkflowState } from '../workflow-state/resolve.js';
-import { affectedFileConflictsForSelectedRun, type WorkflowAffectedFileConflict } from '../workflow-state/affected-file-conflicts.js';
-import { resolveRunStateContext, resolveSddContext } from '../sdd-docs/context.js';
-import type { ContextResolverContract } from '../sdd-docs/context.js';
-import { inspectSddTask } from '../sdd-docs/task-inspection.js';
-import { parseSddBranch } from '../sdd-docs/task-parser.js';
-import type { SddTask, SddTaskGap, SddTaskModel, SddTaskStatus } from '../sdd-docs/task-parser.js';
-import { buildTaskRiskProfile } from '../task-risk-profile.js';
-import { inspectVerifyContract, type VerifyContractIssue, type VerifyContractStatus } from '../verification/verify-contract.js';
-import { evaluateLifecycleRiskDecisionForModel, inspectLifecycleRiskDecisionForModel, type LifecycleRiskConsumerDiagnostic } from '../risk.js';
-import { dependencyBlockingReasonsForTask } from '../workflow-state/dependencies.js';
-import { listRuntimeTestRuns, readRuntimeSyncBackDecision } from '../storage/runtime-store.js';
-import { readTaskEvidenceView, type TaskEvidenceView } from '../run-state/task-evidence.js';
-import type { CapabilityEvidenceClassification } from '../evidence-runtime.js';
-import { evaluateAndRecordWorkflowGateDecision } from '../workflow-gate/evidence-packet.js';
-
-export interface ResolvedTaskRun {
-  runId: string;
-  state: RunState;
-  context: ContextResolverContract;
-  model: SddTaskModel;
-  task: SddTask | null;
-  explicitRunId: boolean;
-  staleReasons: string[];
-  affectedFileConflicts: WorkflowAffectedFileConflict[];
-  selectorRejectionReasons: string[];
-}
-
-export type SyncBackInspectionStatus = 'ready' | 'blocked' | 'applied';
-
-export interface SyncBackApplyPolicy {
-  mode: 'direct' | 'confirm';
-  requiresApproval: boolean;
-  reasons: string[];
-}
-
-export type SyncBackCapabilityReadinessStatus = 'not_recorded' | 'runtime_evidence_ready' | 'candidate_only' | 'blocked';
-
-export interface SyncBackCapabilityReadiness {
-  status: SyncBackCapabilityReadinessStatus;
-  authoritativeForApply: false;
-  requiredDomains: string[];
-  accepted: string[];
-  candidate: string[];
-  quarantined: string[];
-  diagnostic: string[];
-  blocked: string[];
-  reason: string;
-}
-
-export interface SyncBackApprovalCard {
-  contract: 'sdd-sync-back-approval-card-v1';
-  scope: {
-    runId: string;
-    branch: string;
-    taskId: string | null;
-    targetTasksPath: string;
-  };
-  status: SyncBackInspectionStatus;
-  risk: 'low' | 'review' | 'blocked';
-  proposal: {
-    path: string | null;
-    digest: string | null;
-    digestValid: boolean | null;
-  };
-  approval: SyncBackApplyPolicy;
-  capabilityReadiness: SyncBackCapabilityReadiness;
-  blockers: string[];
-  staleReasons: string[];
-  affectedFileConflicts: Array<{
-    file: string;
-    partition: string;
-    taskId: string;
-    runId: string;
-    runStatus: string;
-    syncBackStatus: string;
-  }>;
-  nextAction: string;
-  verifyContractStatus: VerifyContractStatus;
-  verifyContractIssues: VerifyContractIssue[];
-  staleVerifyRecoveryCommand: string | null;
-  lifecycleRisk: LifecycleRiskConsumerDiagnostic;
-  workflowGateDecision: TaskEvidenceView['workflowGate']['latestDecision'];
-}
-
-export interface SyncBackInspection {
-  runId: string;
-  branch: string;
-  taskId: string | null;
-  status: SyncBackInspectionStatus;
-  reasons: string[];
-  proposalPath: string | null;
-  proposal: string | null;
-  proposalDigest: string | null;
-  proposalDigestValid: boolean | null;
-  runTaskStatus: string | null;
-  markdownTask: SddTask | null;
-  markdownStatus: SddTaskStatus | null;
-  targetTasksPath: string;
-  artifacts: string[];
-  gaps: SddTaskGap[];
-  applyPolicy: SyncBackApplyPolicy;
-  approvalCard: SyncBackApprovalCard;
-  capabilityReadiness: SyncBackCapabilityReadiness;
-  staleReasons: string[];
-  affectedFileConflicts: WorkflowAffectedFileConflict[];
-  verifyContractStatus: VerifyContractStatus;
-  verifyContractIssues: VerifyContractIssue[];
-  staleVerifyRecoveryCommand: string | null;
-  lifecycleRisk: LifecycleRiskConsumerDiagnostic;
-  workflowGateDecision: TaskEvidenceView['workflowGate']['latestDecision'];
-  taskEvidenceView: TaskEvidenceView;
-}
-
-export async function resolveTaskRun(projectRoot: string, options: { runId?: string; branch?: string; taskId: string }): Promise<ResolvedTaskRun> {
-  if (options.runId) {
-    const state = await readRunState(projectRoot, options.runId);
-    const context = options.branch
-      ? await resolveSddContext(projectRoot, { branch: options.branch, branchSource: 'cli_option' })
-      : await resolveRunStateContext(projectRoot, state);
-    const model = await parseSddBranch(projectRoot, context.partition);
-    const inspected = inspectSddTask(model, options.taskId);
-    if (state.partition && state.partition !== context.partition) {
-      throw new Error(`Run ${state.runId} belongs to partition ${state.partition}, not ${context.partition}.`);
-    }
-    if (state.taskId && state.taskId !== options.taskId) {
-      throw new Error(`Run ${state.runId} belongs to task ${state.taskId}, not ${options.taskId}.`);
-    }
-    return {
-      runId: state.runId,
-      state,
-      context,
-      model,
-      task: inspected.task,
-      explicitRunId: true,
-      staleReasons: await runDocumentStaleReasons(projectRoot, state, model),
-      affectedFileConflicts: await affectedFileConflictsForRun(projectRoot, state),
-      selectorRejectionReasons: []
-    };
-  }
-
-  const workflow = await resolveWorkflowState(projectRoot, {
-    branch: options.branch,
-    branchSource: options.branch ? 'cli_option' : undefined,
-    taskId: options.taskId
-  });
-  const inspected = inspectSddTask(workflow.model, options.taskId);
-  const selection = workflow.latestEligibleRunsByTask.find((entry) => entry.taskId === options.taskId);
-  const candidate = selection?.selected ?? selection?.rejected[0] ?? null;
-  if (!candidate) {
-    throw new Error(`No eligible run found for ${workflow.context.partition}/${options.taskId}. Run sdd do task ${options.taskId} first, or pass --run <run_id>.`);
-  }
-  const state = selection?.selected && workflow.latestRunState && selection.selected.runId === workflow.latestRunState.runId
-    ? workflow.latestRunState
-    : await readRunState(projectRoot, candidate.runId);
-  if (!state) {
-    throw new Error(`Run state ${candidate.runId} is unavailable for ${workflow.context.partition}/${options.taskId}. Pass --run <run_id> or rerun the task.`);
-  }
-  return {
-    runId: state.runId,
-    state,
-    context: workflow.context,
-    model: workflow.model,
-    task: inspected.task,
-    explicitRunId: false,
-    staleReasons: await runDocumentStaleReasons(projectRoot, state, workflow.model),
-    affectedFileConflicts: workflow.affectedFileConflicts,
-    selectorRejectionReasons: selection?.selected ? [] : candidate.reasons
-  };
-}
-
-export async function inspectSyncBack(projectRoot: string, options: { runId?: string; branch?: string; taskId?: string }): Promise<SyncBackInspection> {
-  const taskId = options.taskId ?? (options.runId ? await taskIdFromRun(projectRoot, options.runId) : null);
-  if (!taskId) {
-    throw new Error('Cannot inspect sync-back without a task id. Pass --task <task_id> or use a run with currentTask.');
-  }
-
-  const resolved = await resolveTaskRun(projectRoot, { runId: options.runId, branch: options.branch, taskId });
-  const branch = resolved.context.partition;
-  const state = resolved.state;
-  const model = resolved.model;
-  const syncBackDecision = await readRuntimeSyncBackDecision(projectRoot, state.runId, taskId);
-  const taskEvidenceView = await readTaskEvidenceView(projectRoot, { branch, taskId });
-  const workflowGateDecision = (await evaluateAndRecordWorkflowGateDecision(projectRoot, { branch, taskId, runId: state.runId, decisionKind: 'sync_back' })).decision;
-  const inspected = inspectSddTask(model, taskId);
-  const reasons: string[] = [];
-  if (workflowGateDecision.status === 'BLOCKED') {
-    reasons.push(...syncBackWorkflowGateReasons(workflowGateDecision, resolved.explicitRunId));
-  }
-  if (workflowGateDecision.status === 'HUMAN_REQUIRED') {
-    reasons.push(...workflowGateDecision.reasons.map((reason) => `Workflow gate requires human decision before sync-back: ${reason}`));
-  }
-  const markdownTask = inspected.task;
-  const taskGaps = inspected.gaps;
-  if (!inspected.task) {
-    reasons.push(`Task ${taskId} is missing or ambiguous in specs/${branch}/tasks.md.`);
-  }
-  if (markdownTask) {
-    reasons.push(...dependencyBlockingReasonsForTask(model, taskId));
-  }
-  for (const reason of resolved.staleReasons) {
-    reasons.push(reason);
-  }
-  for (const reason of resolved.selectorRejectionReasons) {
-    reasons.push(reason);
-  }
-  for (const conflict of resolved.affectedFileConflicts) {
-    reasons.push(`Affected file ${conflict.file} is active in run ${conflict.runId} for ${conflict.partition}/${conflict.taskId}.`);
-  }
-
-  const verifyContract = await inspectVerifyContract(projectRoot, { branch, branchSource: 'cli_option' });
-  const blockingVerifyIssues = verifyContract.status === 'PASS' ? [] : verifyContract.issues;
-  const staleVerifyRecoveryCommand = verifyContract.status === 'PASS' ? null : `sdd verifies write --branch ${branch} --force && sdd sync-back inspect ${state.runId} --branch ${branch} --task ${taskId}`;
-  const proposalPath = syncBackDecision?.proposalPath ?? state.syncBack.proposalPath;
-  const expectedProposalDigest = syncBackDecision?.proposalDigest ?? state.syncBack.proposalDigest ?? null;
-  let proposal: string | null = null;
-  let proposalDigestValid: boolean | null = null;
-  if (!proposalPath) {
-    reasons.push('Run has no sync-back proposal.');
-  } else {
-    try {
-      proposal = await readArtifact(projectRoot, state.runId, toArtifactRootRelativePath(proposalPath));
-      if (expectedProposalDigest) {
-        const actualProposalDigest = hashDocumentContent(proposal);
-        proposalDigestValid = actualProposalDigest === expectedProposalDigest;
-        if (!proposalDigestValid) {
-          reasons.push(`Sync-back proposal ${proposalPath} digest changed from ${expectedProposalDigest} to ${actualProposalDigest}.`);
-        }
-      }
-    } catch (error) {
-      reasons.push(`Cannot read sync-back proposal ${proposalPath}: ${messageFromError(error)}`);
-    }
-  }
-
-  const runtimeGaps = runtimeTaskGaps(state.tasks[taskId]);
-  const blockingGaps = [...taskGaps, ...runtimeGaps].filter((gap) => gap.severity === 'blocking');
-  if (state.status !== 'completed') {
-    reasons.push(`Run status is ${state.status}, expected completed.`);
-  }
-  if (state.validation.status !== 'pass') {
-    reasons.push(`Run validation status is ${state.validation.status}, expected pass.`);
-  }
-  if (blockingGaps.length > 0) {
-    reasons.push(`Sync-back is blocked by ${blockingGaps.length} blocking gap(s).`);
-  }
-  const lifecycleRisk = await inspectLifecycleRiskDecisionForModel(projectRoot, branch, model);
-  reasons.push(...syncBackTaskLifecycleRiskReasons(branch, model, markdownTask));
-
-  let applyPolicy = deriveSyncBackApplyPolicy(state, markdownTask);
-  if (state.gitBranch && resolved.context.currentGitBranch && state.gitBranch !== resolved.context.currentGitBranch) {
-    applyPolicy = requireSyncBackApproval(applyPolicy, `Current Git branch is ${resolved.context.currentGitBranch}, but run ${state.runId} belongs to ${state.gitBranch}.`);
-  }
-
-  const capabilityReadiness = await inspectSyncBackCapabilityReadiness(projectRoot, state.runId, taskId, state.validation.status);
-  const capabilityReadinessReasons = syncBackCapabilityReadinessReasons(capabilityReadiness);
-  reasons.push(...capabilityReadinessReasons);
-  const status: SyncBackInspectionStatus = (syncBackDecision?.status ?? state.syncBack.status) === 'applied' ? 'applied' : reasons.length === 0 ? 'ready' : 'blocked';
-  const artifacts = state.validation.evidence.length > 0 ? state.validation.evidence : state.artifacts.map((artifact) => artifact.path);
-  const gaps = [...taskGaps, ...runtimeGaps];
-
-  return {
-    runId: state.runId,
-    branch,
-    taskId,
-    status,
-    reasons,
-    proposalPath,
-    proposal,
-    proposalDigest: expectedProposalDigest,
-    proposalDigestValid,
-    runTaskStatus: runtimeTaskStatus(state.tasks[taskId]),
-    markdownTask,
-    markdownStatus: markdownTask?.status ?? null,
-    targetTasksPath: model.tasksPath,
-    artifacts,
-    gaps,
-    applyPolicy,
-    capabilityReadiness,
-    approvalCard: buildSyncBackApprovalCard({
-      runId: state.runId,
-      branch,
-      taskId,
-      status,
-      reasons,
-      proposalPath,
-      proposalDigest: expectedProposalDigest,
-      proposalDigestValid,
-      targetTasksPath: model.tasksPath,
-      applyPolicy,
-      staleReasons: resolved.staleReasons,
-      affectedFileConflicts: resolved.affectedFileConflicts,
-      verifyContractStatus: verifyContract.status,
-      verifyContractIssues: blockingVerifyIssues,
-      staleVerifyRecoveryCommand,
-      lifecycleRisk,
-      capabilityReadiness,
-      workflowGateDecision
-    }),
-    staleReasons: resolved.staleReasons,
-    affectedFileConflicts: resolved.affectedFileConflicts,
-    verifyContractStatus: verifyContract.status,
-    verifyContractIssues: blockingVerifyIssues,
-    staleVerifyRecoveryCommand,
-    lifecycleRisk,
-    workflowGateDecision,
-    taskEvidenceView
-  };
-}
-
-function buildSyncBackApprovalCard(input: {
-  runId: string;
-  branch: string;
-  taskId: string | null;
-  status: SyncBackInspectionStatus;
-  reasons: string[];
-  proposalPath: string | null;
-  proposalDigest: string | null;
-  proposalDigestValid: boolean | null;
-  targetTasksPath: string;
-  applyPolicy: SyncBackApplyPolicy;
-  staleReasons: string[];
-  affectedFileConflicts: WorkflowAffectedFileConflict[];
-  verifyContractStatus: VerifyContractStatus;
-  verifyContractIssues: VerifyContractIssue[];
-  staleVerifyRecoveryCommand: string | null;
-  lifecycleRisk: LifecycleRiskConsumerDiagnostic;
-  capabilityReadiness: SyncBackCapabilityReadiness;
-  workflowGateDecision: TaskEvidenceView['workflowGate']['latestDecision'];
-}): SyncBackApprovalCard {
-  return {
-    contract: 'sdd-sync-back-approval-card-v1',
-    scope: {
-      runId: input.runId,
-      branch: input.branch,
-      taskId: input.taskId,
-      targetTasksPath: input.targetTasksPath
-    },
-    status: input.status,
-    risk: syncBackApprovalRisk(input.status, input.applyPolicy),
-    proposal: {
-      path: input.proposalPath,
-      digest: input.proposalDigest,
-      digestValid: input.proposalDigestValid
-    },
-    approval: input.applyPolicy,
-    capabilityReadiness: input.capabilityReadiness,
-    blockers: input.reasons,
-    staleReasons: input.staleReasons,
-    affectedFileConflicts: input.affectedFileConflicts.map((conflict) => ({
-      file: conflict.file,
-      partition: conflict.partition,
-      taskId: conflict.taskId,
-      runId: conflict.runId,
-      runStatus: conflict.runStatus,
-      syncBackStatus: conflict.syncBackStatus
-    })),
-    verifyContractStatus: input.verifyContractStatus,
-    verifyContractIssues: input.verifyContractIssues,
-    staleVerifyRecoveryCommand: input.staleVerifyRecoveryCommand,
-    lifecycleRisk: input.lifecycleRisk,
-    workflowGateDecision: input.workflowGateDecision,
-    nextAction: syncBackApprovalNextAction(input.status, input.applyPolicy, input.runId, input.branch, input.taskId, input.staleVerifyRecoveryCommand, input.proposalPath)
-  };
-}
-
-function syncBackWorkflowGateReasons(decision: NonNullable<TaskEvidenceView['workflowGate']['latestDecision']>, explicitRunId: boolean): string[] {
-  return decision.hardBlocks
-    .filter((check) => check.code !== 'stale_documents' && check.code !== 'contract_hash_mismatch')
-    .filter((check) => !(explicitRunId && check.code === 'run_rejected'))
-    .map((check) => `Workflow gate blocked sync-back: ${check.code}: ${check.message}`);
-}
-
-function syncBackApprovalRisk(status: SyncBackInspectionStatus, applyPolicy: SyncBackApplyPolicy): SyncBackApprovalCard['risk'] {
-  if (status === 'blocked') {
-    return 'blocked';
-  }
-  return applyPolicy.requiresApproval ? 'review' : 'low';
-}
-
-function syncBackApprovalNextAction(status: SyncBackInspectionStatus, applyPolicy: SyncBackApplyPolicy, runId: string, branch: string, taskId: string | null, staleVerifyRecoveryCommand: string | null, proposalPath: string | null): string {
-  if (status === 'applied') {
-    return 'sdd status';
-  }
-  if (status === 'blocked') {
-    return staleVerifyRecoveryCommand ?? 'Resolve the listed blockers, rerun the required validation or verify step, then inspect sync-back again.';
-  }
-  const taskFlag = taskId ? ` --task ${taskId}` : '';
-  const approvedFlag = applyPolicy.requiresApproval ? ' --approved' : '';
-  const command = `sdd sync-back apply ${runId} --branch ${branch}${taskFlag}${approvedFlag}`;
-  return applyPolicy.requiresApproval
-    ? `Review ${proposalPath ?? 'the sync-back proposal'} and apply policy, then run ${command}.`
-    : `Run ${command}.`;
-}
-
-async function taskIdFromRun(projectRoot: string, runId: string): Promise<string | null> {
-  const state = await readRunState(projectRoot, runId);
-  return state.taskId ?? state.currentTask;
-}
-
-export async function runDocumentStaleReasons(projectRoot: string, state: RunState, model: SddTaskModel): Promise<string[]> {
-  const reasons: string[] = [];
-  const snapshot = state.documentSnapshot;
-  if (!snapshot.specHash && !snapshot.planHash && !snapshot.tasksHash) {
-    reasons.push('Run has no document snapshot hashes; rerun do task before test or sync-back apply.');
-  }
-  appendDocumentHashMismatch(reasons, 'spec.md', snapshot.specHash, model.documents.specHash ?? null);
-  appendDocumentHashMismatch(reasons, 'plan.md', snapshot.planHash, model.documents.planHash ?? null);
-  const tasksHash = model.documents.tasksHash ?? null;
-  if (shouldReportDocumentHashMismatch(snapshot.tasksHash, tasksHash)) {
-    const suppressTasksMismatch = await isAppliedSyncBackTasksWritebackCurrent(projectRoot, state, model.tasksPath);
-    if (!suppressTasksMismatch) {
-      appendDocumentHashMismatch(reasons, 'tasks.md', snapshot.tasksHash, tasksHash);
-    }
-  }
-  if (model.documents.planStale) {
-    reasons.push('Current plan.md is stale against spec.md.');
-  }
-  if (model.documents.tasksStale) {
-    reasons.push('Current tasks.md is stale against plan.md or spec.md.');
-  }
-  return reasons;
-}
-
-function shouldReportDocumentHashMismatch(expected: string | null, actual: string | null): boolean {
-  if (!expected && !actual) {
-    return false;
-  }
-  return !expected || !actual || !documentHashMatches(expected, actual);
-}
-
-function appendDocumentHashMismatch(reasons: string[], documentName: string, expected: string | null, actual: string | null): void {
-  if (shouldReportDocumentHashMismatch(expected, actual)) {
-    reasons.push(`Run snapshot for ${documentName} is ${expected ?? 'missing'}, current hash is ${actual ?? 'missing'}.`);
-  }
-}
-
-async function isAppliedSyncBackTasksWritebackCurrent(projectRoot: string, state: RunState, tasksPath: string): Promise<boolean> {
-  if (state.syncBack.status !== 'applied') {
-    return false;
-  }
-  try {
-    const [tasksStat, events] = await Promise.all([stat(tasksPath), readRunEvents(projectRoot, state.runId)]);
-    const relativeTasksPath = normalizePortablePath(path.relative(projectRoot, tasksPath));
-    const appliedAtMs = Math.max(...events
-      .filter((event) => {
-        if (event.event !== 'sync_back_applied') {
-          return false;
-        }
-        const eventTasksPath = typeof event.data?.tasksPath === 'string' ? normalizePortablePath(event.data.tasksPath) : null;
-        return !eventTasksPath || eventTasksPath === relativeTasksPath;
-      })
-      .map((event) => Date.parse(event.time))
-      .filter((time) => Number.isFinite(time)));
-    return Number.isFinite(appliedAtMs) && tasksStat.mtimeMs <= appliedAtMs + 1;
-  } catch {
-    return false;
-  }
-}
-
-export async function affectedFileConflictsForRun(projectRoot: string, state: RunState): Promise<WorkflowAffectedFileConflict[]> {
-  const states = await readAllRunStates(projectRoot);
-  return affectedFileConflictsForSelectedRun(states, state);
-}
-
-function syncBackTaskLifecycleRiskReasons(branch: string, model: SddTaskModel, task: SddTask | null): string[] {
-  if (!task) {
-    return [];
-  }
-
-  const decision = evaluateLifecycleRiskDecisionForModel(branch, {
-    ...model,
-    tasks: [task],
-    gaps: model.gaps.filter((gap) => gap.taskId === task.id)
-  });
-
-  if (decision.profile === 'blocked' || decision.approvalPolicy === 'blocked') {
-    return [`Lifecycle risk blocks sync-back for ${task.id}: ${decision.reasons.join(' ')}`];
-  }
-  return [];
-}
-
-async function inspectSyncBackCapabilityReadiness(projectRoot: string, runId: string, taskId: string, validationStatus: string): Promise<SyncBackCapabilityReadiness> {
-  const testRuns = await listRuntimeTestRuns(projectRoot, runId);
-  const latest = testRuns.find((run) => run.taskId === taskId);
-  const evidence = capabilityEvidenceFromPayload(latest?.payload);
-  if (evidence.length === 0) {
-    return {
-      status: 'not_recorded',
-      authoritativeForApply: false,
-      requiredDomains: [],
-      accepted: [],
-      candidate: [],
-      quarantined: [],
-      diagnostic: [],
-      blocked: [],
-      reason: 'No capability evidence classification was recorded for this sync-back candidate; apply readiness still depends on accepted runtime validation evidence.'
-    };
-  }
-  const professional = evidence.filter((item) => item.source === 'professional_capability');
-  const blockingEvidence = evidence.filter(isSyncBackBlockingCapabilityEvidence);
-  const readiness: SyncBackCapabilityReadiness = {
-    status: 'candidate_only',
-    authoritativeForApply: false,
-    requiredDomains: uniqueStrings(professional.map((item) => item.domainOrSourceId)),
-    accepted: evidenceNames(evidence, 'accepted'),
-    candidate: evidenceNames(evidence, 'candidate'),
-    quarantined: evidenceNames(evidence, 'quarantined'),
-    diagnostic: evidenceNames(evidence, 'diagnostic'),
-    blocked: evidenceNames(blockingEvidence, 'blocked'),
-    reason: 'Capability evidence is advisory for sync-back; task completion writeback is governed by accepted runtime validation evidence and apply policy.'
-  };
-  if (readiness.blocked.length > 0) {
-    return { ...readiness, status: 'blocked', reason: 'Blocked capability sources cannot authorize sync-back apply.' };
-  }
-  if (validationStatus === 'pass') {
-    return { ...readiness, status: 'runtime_evidence_ready', reason: 'Runtime validation evidence is accepted; capability evidence remains advisory and cannot mark completion by itself.' };
-  }
-  return readiness;
-}
-
-function syncBackCapabilityReadinessReasons(readiness: SyncBackCapabilityReadiness): string[] {
-  return readiness.status === 'blocked' ? [readiness.reason] : [];
-}
-
-function isSyncBackBlockingCapabilityEvidence(item: CapabilityEvidenceClassification): boolean {
-  return item.class === 'blocked' && (item.source === 'professional_capability' || item.acceptanceRefs.length > 0);
-}
-
-function capabilityEvidenceFromPayload(payload: unknown): CapabilityEvidenceClassification[] {
-  if (!isRecord(payload) || !Array.isArray(payload.capabilityEvidence)) {
-    return [];
-  }
-  return payload.capabilityEvidence.filter(isCapabilityEvidenceClassification);
-}
-
-function isCapabilityEvidenceClassification(value: unknown): value is CapabilityEvidenceClassification {
-  return isRecord(value)
-    && (value.class === 'accepted' || value.class === 'candidate' || value.class === 'quarantined' || value.class === 'diagnostic' || value.class === 'blocked')
-    && (value.source === 'professional_capability' || value.source === 'external_source' || value.source === 'runtime_diagnostic')
-    && typeof value.domainOrSourceId === 'string';
-}
-
-function evidenceNames(evidence: CapabilityEvidenceClassification[], evidenceClass: CapabilityEvidenceClassification['class']): string[] {
-  return uniqueStrings(evidence.filter((item) => item.class === evidenceClass).map((item) => `${item.source}:${item.domainOrSourceId}`));
-}
-
-function uniqueStrings(values: string[]): string[] {
-  return [...new Set(values)].sort((left, right) => left.localeCompare(right));
-}
-
-function deriveSyncBackApplyPolicy(state: RunState, task: SddTask | null): SyncBackApplyPolicy {
-  const reasons: string[] = [];
-  const decision = state.lifecycleDecision?.decision;
-
-  if (!task) {
-    reasons.push('Target task is missing, so sync-back apply cannot be classified as direct-safe.');
-  }
-  if (decision?.human_checkpoint_required === true) {
-    reasons.push('Lifecycle decision requires a human checkpoint.');
-  }
-  if (decision?.profile === 'full' || decision?.profile === 'research') {
-    reasons.push(`Lifecycle profile is ${decision.profile}.`);
-  }
-  if ((decision?.hard_gate_hits.length ?? 0) > 0) {
-    reasons.push(`Lifecycle hard gates were hit: ${decision?.hard_gate_hits.join(', ')}.`);
-  }
-  const profile = buildTaskRiskProfile(task);
-  if (profile.approvalRecommendation !== 'direct') {
-    reasons.push(`Task risk profile is ${profile.riskLevel}: ${profile.reasons.join(' ')}`);
-  }
-  if ((task?.dependsOn.length ?? 0) > 0) {
-    reasons.push(`Task depends on ${task?.dependsOn.length} other task(s).`);
-  }
-  if ((task?.affectedFiles.length ?? 0) > 3) {
-    reasons.push(`Task affects ${task?.affectedFiles.length} files.`);
-  }
-
-  if (reasons.length > 0) {
-    return {
-      mode: 'confirm',
-      requiresApproval: true,
-      reasons
-    };
-  }
-
-  return {
-    mode: 'direct',
-    requiresApproval: false,
-    reasons: ['Task is direct-safe: shared risk profile found no checkpoint, source-boundary, runtime-state, security, external, dependency, or broad file fan-out signal.']
-  };
-}
-
-function requireSyncBackApproval(policy: SyncBackApplyPolicy, reason: string): SyncBackApplyPolicy {
-  return {
-    mode: 'confirm',
-    requiresApproval: true,
-    reasons: policy.reasons.includes(reason) ? policy.reasons : [...policy.reasons, reason]
-  };
-}
-
-function hashDocumentContent(raw: string): string {
-  return createHash('sha256').update(raw.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
-}
-
-function documentHashMatches(expected: string, actual: string): boolean {
-  return expected.replace(/^sha256:/, '') === actual;
-}
-
-function runtimeTaskStatus(value: unknown): string | null {
-  if (!isRecord(value)) {
-    return null;
-  }
-  const status = value.status;
-  const verifyStatus = value.verifyStatus;
-  if (typeof verifyStatus === 'string') {
-    return verifyStatus;
-  }
-  return typeof status === 'string' ? status : null;
-}
-
-function runtimeTaskGaps(value: unknown): SddTaskGap[] {
-  if (!isRecord(value) || !Array.isArray(value.gaps)) {
-    return [];
-  }
-  return value.gaps.filter(isTaskGap);
-}
-
-function isTaskGap(value: unknown): value is SddTaskGap {
-  if (!isRecord(value)) {
-    return false;
-  }
-  return (value.type === 'Task Gap' || value.type === 'Document Gap' || value.type === 'Dependency Gap')
-    && (value.severity === 'blocking' || value.severity === 'warning')
-    && (typeof value.taskId === 'string' || value.taskId === null)
-    && typeof value.field === 'string'
-    && typeof value.message === 'string'
-    && typeof value.recommendation === 'string';
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null;
-}
-
-function messageFromError(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}