sortie-dogs 0.8.2 → 0.9.0

package/README.md

@@ -24,7 +24,7 @@ Requirements: Node.js 22.6 or newer, npm, and OpenCode.
 
 Guides: [日本語](docs/guide-ja.md) · [简体中文](docs/guide-zh-CN.md) · [CLI testing](docs/cli-testing.md)
 
-Release: [v0.8.2](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.8.2)
+Release: [v0.9.0](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.9.0)
 
 ## Quick start
 

package/dist/asset-version.d.ts

@@ -2,5 +2,5 @@
  * Version of the installable runtime assets. Kept in its own module so the plugin can compare an
  * installed project marker without importing every asset body.
  */
-export declare const RUNTIME_ASSET_VERSION = "0.3.69-luna-combined-validation-replay-v1";
+export declare const RUNTIME_ASSET_VERSION = "0.3.75-sequential-acceptance-parent-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -2,4 +2,4 @@
  * Version of the installable runtime assets. Kept in its own module so the plugin can compare an
  * installed project marker without importing every asset body.
  */
-export const RUNTIME_ASSET_VERSION = "0.3.69-luna-combined-validation-replay-v1";
+export const RUNTIME_ASSET_VERSION = "0.3.75-sequential-acceptance-parent-v1";

package/dist/core/acceptance-compiler.d.ts

@@ -0,0 +1,66 @@
+import type { FlightReferenceSet } from "./run-flight-ledger.js";
+export declare const ACCEPTANCE_COMPILER_VERSION: "0.1";
+export declare const MAX_ACCEPTANCE_COMPILE_ITEMS = 64;
+export declare const MAX_ACCEPTANCE_COMPILE_GAPS = 128;
+export interface AcceptanceCompileItem {
+    readonly acceptance_id: string;
+    readonly observable_criterion: string;
+}
+export interface AcceptanceCompileValidation {
+    readonly validation_id: string;
+    readonly unit_id: string;
+    readonly command_fingerprint: string;
+    readonly references: FlightReferenceSet;
+}
+export interface AcceptanceCompileCoverage {
+    readonly acceptance_id: string;
+    readonly unit_id: string;
+    readonly validation_ids: readonly string[];
+}
+export interface AcceptanceCompileProposal {
+    readonly version: typeof ACCEPTANCE_COMPILER_VERSION;
+    readonly provenance: {
+        readonly producer: "dog-coordinator";
+        readonly acceptance_fingerprint: string;
+        /** The capsule producer, not this compiler, is responsible for excluding secrets from capsule input. */
+        readonly capsule_inputs_exclude_secrets: true;
+    };
+    /** Identifier boundary for later binding to LunaFabricUnit; scope/dependency data stays in the DAG contract. */
+    readonly unit_ids: readonly string[];
+    readonly declared_capsule_ids: readonly string[];
+    readonly acceptance_items: readonly AcceptanceCompileItem[];
+    readonly validations: readonly AcceptanceCompileValidation[];
+    readonly coverage: readonly AcceptanceCompileCoverage[];
+}
+export type AcceptanceCompileGapCode = "malformed_proposal" | "duplicate_acceptance_id" | "duplicate_unit_id" | "duplicate_validation_id" | "duplicate_coverage" | "unknown_acceptance_id" | "unknown_unit_id" | "unknown_validation_id" | "validation_unit_mismatch" | "undeclared_capsule" | "validation_evidence_missing" | "uncovered_acceptance";
+export interface AcceptanceCompileGap {
+    readonly code: AcceptanceCompileGapCode;
+    readonly pointer: string;
+    readonly acceptance_id: string | null;
+    readonly unit_id: string | null;
+    readonly validation_id: string | null;
+}
+export interface AcceptanceCoverageMapEntry {
+    readonly acceptance_id: string;
+    readonly unit_id: string;
+    readonly validation_ids: readonly string[];
+    readonly references: FlightReferenceSet;
+}
+interface CompileResultBase {
+    readonly proposal_id: string;
+    readonly acceptance_fingerprint: string | null;
+}
+export type AcceptanceCompileResult = (CompileResultBase & {
+    readonly status: "accepted";
+    readonly plan_id: string;
+    readonly coverage_map: readonly AcceptanceCoverageMapEntry[];
+    readonly gaps: readonly AcceptanceCompileGap[];
+}) | (CompileResultBase & {
+    readonly status: "rejected";
+    readonly plan_id: string;
+    readonly coverage_map: readonly AcceptanceCoverageMapEntry[];
+    readonly gaps: readonly AcceptanceCompileGap[];
+});
+/** Deterministic schema/semantic compiler. It performs no natural-language inference, dispatch, or user interaction. */
+export declare function compileAcceptanceCoverage(value: unknown): AcceptanceCompileResult;
+export {};

package/dist/core/acceptance-compiler.js

@@ -0,0 +1,125 @@
+import { createHash } from "node:crypto";
+export const ACCEPTANCE_COMPILER_VERSION = "0.1";
+export const MAX_ACCEPTANCE_COMPILE_ITEMS = 64;
+export const MAX_ACCEPTANCE_COMPILE_GAPS = 128;
+const HASH = /^sha256:[a-f0-9]{64}$/u;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const MAX_TEXT = 1000;
+const object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const only = (value, keys) => Object.keys(value).every((key) => keys.includes(key));
+const id = (value) => typeof value === "string" && ID.test(value);
+const hash = (value) => typeof value === "string" && HASH.test(value);
+const text = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_TEXT && !/[\u0000-\u001f\u007f]/u.test(value);
+function canonicalValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (object(value))
+        return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalValue(value[key])]));
+    return value;
+}
+function identity(value) {
+    let body;
+    try {
+        body = JSON.stringify(canonicalValue(value));
+    }
+    catch {
+        body = "unserializable";
+    }
+    return `sha256:${createHash("sha256").update(body ?? "undefined").digest("hex")}`;
+}
+function freezeReferences(references) {
+    return Object.freeze({ capsule_ids: Object.freeze([...references.capsule_ids]), artifact_ids: Object.freeze([...references.artifact_ids]) });
+}
+function validReferences(value) {
+    return object(value) && only(value, ["capsule_ids", "artifact_ids"]) && Array.isArray(value.capsule_ids) && Array.isArray(value.artifact_ids) &&
+        value.capsule_ids.length <= MAX_ACCEPTANCE_COMPILE_ITEMS && value.artifact_ids.length <= MAX_ACCEPTANCE_COMPILE_ITEMS &&
+        value.capsule_ids.every(hash) && value.artifact_ids.every(hash) && new Set(value.capsule_ids).size === value.capsule_ids.length &&
+        new Set(value.artifact_ids).size === value.artifact_ids.length;
+}
+function malformed(value) {
+    if (!object(value) || !only(value, ["version", "provenance", "unit_ids", "declared_capsule_ids", "acceptance_items", "validations", "coverage"]) || value.version !== ACCEPTANCE_COMPILER_VERSION ||
+        !object(value.provenance) || !only(value.provenance, ["producer", "acceptance_fingerprint", "capsule_inputs_exclude_secrets"]) ||
+        value.provenance.producer !== "dog-coordinator" || !hash(value.provenance.acceptance_fingerprint) || value.provenance.capsule_inputs_exclude_secrets !== true)
+        return true;
+    const { unit_ids: unitIds, declared_capsule_ids: capsuleIds, acceptance_items: items, validations, coverage } = value;
+    if (![unitIds, capsuleIds, items, validations, coverage].every((entry) => Array.isArray(entry) && entry.length <= MAX_ACCEPTANCE_COMPILE_ITEMS) ||
+        !Array.isArray(items) || !Array.isArray(unitIds) || !Array.isArray(capsuleIds) || !Array.isArray(validations) || !Array.isArray(coverage) || items.length === 0 || unitIds.length === 0)
+        return true;
+    if (!unitIds.every(id) || !capsuleIds.every(hash))
+        return true;
+    if (!items.every((entry) => object(entry) && only(entry, ["acceptance_id", "observable_criterion"]) && id(entry.acceptance_id) && text(entry.observable_criterion)))
+        return true;
+    if (!validations.every((entry) => object(entry) && only(entry, ["validation_id", "unit_id", "command_fingerprint", "references"]) && id(entry.validation_id) && id(entry.unit_id) && hash(entry.command_fingerprint) && validReferences(entry.references)))
+        return true;
+    return !coverage.every((entry) => object(entry) && only(entry, ["acceptance_id", "unit_id", "validation_ids"]) && id(entry.acceptance_id) && id(entry.unit_id) &&
+        Array.isArray(entry.validation_ids) && entry.validation_ids.length > 0 && entry.validation_ids.length <= MAX_ACCEPTANCE_COMPILE_ITEMS && entry.validation_ids.every(id));
+}
+function gap(code, pointer, acceptanceId = null, unitId = null, validationId = null) {
+    return Object.freeze({ code, pointer, acceptance_id: acceptanceId, unit_id: unitId, validation_id: validationId });
+}
+function duplicates(values) {
+    const seen = new Set();
+    return new Set(values.filter((value) => seen.has(value) || !seen.add(value)));
+}
+/** Deterministic schema/semantic compiler. It performs no natural-language inference, dispatch, or user interaction. */
+export function compileAcceptanceCoverage(value) {
+    const proposalId = identity(value);
+    if (malformed(value))
+        return Object.freeze({ status: "rejected", proposal_id: proposalId, plan_id: identity({ proposal_id: proposalId, status: "rejected", gaps: ["malformed_proposal"] }), acceptance_fingerprint: null, coverage_map: Object.freeze([]), gaps: Object.freeze([gap("malformed_proposal", "/")]) });
+    const proposal = value;
+    const gaps = [];
+    const itemIds = proposal.acceptance_items.map((entry) => entry.acceptance_id);
+    const validationIds = proposal.validations.map((entry) => entry.validation_id);
+    for (const duplicate of duplicates(itemIds))
+        gaps.push(gap("duplicate_acceptance_id", "/acceptance_items", duplicate));
+    for (const duplicate of duplicates(proposal.unit_ids))
+        gaps.push(gap("duplicate_unit_id", "/unit_ids", null, duplicate));
+    for (const duplicate of duplicates(validationIds))
+        gaps.push(gap("duplicate_validation_id", "/validations", null, null, duplicate));
+    for (const duplicate of duplicates(proposal.coverage.map((entry) => entry.acceptance_id)))
+        gaps.push(gap("duplicate_coverage", "/coverage", duplicate));
+    const items = new Set(itemIds);
+    const units = new Set(proposal.unit_ids);
+    const declaredCapsules = new Set(proposal.declared_capsule_ids);
+    const validations = new Map(proposal.validations.map((entry) => [entry.validation_id, entry]));
+    proposal.validations.forEach((validation, index) => {
+        if (!units.has(validation.unit_id))
+            gaps.push(gap("unknown_unit_id", `/validations/${index}/unit_id`, null, validation.unit_id, validation.validation_id));
+        if (validation.references.capsule_ids.length + validation.references.artifact_ids.length === 0)
+            gaps.push(gap("validation_evidence_missing", `/validations/${index}/references`, null, validation.unit_id, validation.validation_id));
+        for (const capsuleId of validation.references.capsule_ids)
+            if (!declaredCapsules.has(capsuleId))
+                gaps.push(gap("undeclared_capsule", `/validations/${index}/references/capsule_ids`, null, validation.unit_id, validation.validation_id));
+    });
+    proposal.coverage.forEach((entry, index) => {
+        if (!items.has(entry.acceptance_id))
+            gaps.push(gap("unknown_acceptance_id", `/coverage/${index}/acceptance_id`, entry.acceptance_id, entry.unit_id));
+        if (!units.has(entry.unit_id))
+            gaps.push(gap("unknown_unit_id", `/coverage/${index}/unit_id`, entry.acceptance_id, entry.unit_id));
+        for (const validationId of entry.validation_ids) {
+            const validation = validations.get(validationId);
+            if (validation === undefined)
+                gaps.push(gap("unknown_validation_id", `/coverage/${index}/validation_ids`, entry.acceptance_id, entry.unit_id, validationId));
+            else if (validation.unit_id !== entry.unit_id)
+                gaps.push(gap("validation_unit_mismatch", `/coverage/${index}/validation_ids`, entry.acceptance_id, entry.unit_id, validationId));
+        }
+    });
+    const covered = new Set(proposal.coverage.map((entry) => entry.acceptance_id));
+    proposal.acceptance_items.forEach((entry, index) => { if (!covered.has(entry.acceptance_id))
+        gaps.push(gap("uncovered_acceptance", `/acceptance_items/${index}`, entry.acceptance_id)); });
+    const bounded = gaps.slice(0, MAX_ACCEPTANCE_COMPILE_GAPS);
+    if (bounded.length > 0) {
+        const frozenGaps = Object.freeze(bounded);
+        return Object.freeze({ status: "rejected", proposal_id: proposalId, plan_id: identity({ proposal_id: proposalId, status: "rejected", gaps: frozenGaps }), acceptance_fingerprint: proposal.provenance.acceptance_fingerprint, coverage_map: Object.freeze([]), gaps: frozenGaps });
+    }
+    const coverageMap = proposal.acceptance_items.map((item) => {
+        const coverage = proposal.coverage.find((entry) => entry.acceptance_id === item.acceptance_id);
+        const references = coverage.validation_ids.reduce((result, validationId) => {
+            const source = validations.get(validationId).references;
+            return { capsule_ids: [...new Set([...result.capsule_ids, ...source.capsule_ids])], artifact_ids: [...new Set([...result.artifact_ids, ...source.artifact_ids])] };
+        }, { capsule_ids: [], artifact_ids: [] });
+        return Object.freeze({ acceptance_id: item.acceptance_id, unit_id: coverage.unit_id, validation_ids: Object.freeze([...coverage.validation_ids]), references: freezeReferences(references) });
+    });
+    const planId = identity({ acceptance_fingerprint: proposal.provenance.acceptance_fingerprint, coverage_map: coverageMap });
+    return Object.freeze({ status: "accepted", proposal_id: proposalId, plan_id: planId, acceptance_fingerprint: proposal.provenance.acceptance_fingerprint, coverage_map: Object.freeze(coverageMap), gaps: Object.freeze([]) });
+}

package/dist/core/adaptive-eligibility.d.ts

@@ -0,0 +1,34 @@
+import type { AdaptiveRemediationPlatform, AdaptiveRemediationSelection } from "./types.js";
+type Observation = boolean | null;
+export interface AdaptiveEligibilityInput {
+    readonly platform: AdaptiveRemediationPlatform;
+    readonly canonical_validation_expensive: Observation;
+    readonly repeatable_typed_signal: Observation;
+    readonly signal_id: string | null;
+    readonly signal_definition: string | null;
+    readonly patch_reversible: Observation;
+    readonly patch_isolated: Observation;
+    readonly scope_bounded: Observation;
+    readonly security_sensitive: Observation;
+    readonly schema_migration: Observation;
+    readonly release_or_publication: Observation;
+    readonly irreversible_external_operation: Observation;
+    readonly explicit_standard_override: Observation;
+}
+export type AdaptiveEligibilityDetailReason = "eligible" | "explicit-standard-override" | "security-sensitive" | "schema-migration" | "release-or-publication" | "irreversible-external-operation" | "canonical-validation-not-expensive" | "canonical-validation-unknown" | "signal-not-repeatable" | "signal-repeatability-unknown" | "signal-undefined" | "patch-not-reversible" | "patch-reversibility-unknown" | "patch-not-isolated" | "patch-isolation-unknown" | "scope-not-bounded" | "scope-bounds-unknown" | "risk-status-unknown";
+export type AdaptiveEligibilityRejectionReason = "invalid-input" | "unsupported-platform";
+export type AdaptiveEligibilityOutcome = {
+    readonly status: "selected";
+    readonly selection: AdaptiveRemediationSelection;
+    readonly detail_reason: AdaptiveEligibilityDetailReason;
+} | {
+    readonly status: "rejected";
+    readonly selection: null;
+    readonly reason: AdaptiveEligibilityRejectionReason;
+};
+/**
+ * Selects an inert remediation mode from declared eligibility observations only.
+ * It does not probe the platform, construct a runtime contract, or perform remediation.
+ */
+export declare function selectAdaptiveRemediation(input: unknown): AdaptiveEligibilityOutcome;
+export {};

package/dist/core/adaptive-eligibility.js

@@ -0,0 +1,98 @@
+const INPUT_KEYS = [
+    "platform",
+    "canonical_validation_expensive",
+    "repeatable_typed_signal",
+    "signal_id",
+    "signal_definition",
+    "patch_reversible",
+    "patch_isolated",
+    "scope_bounded",
+    "security_sensitive",
+    "schema_migration",
+    "release_or_publication",
+    "irreversible_external_operation",
+    "explicit_standard_override",
+];
+const OBSERVATION_KEYS = [
+    "canonical_validation_expensive",
+    "repeatable_typed_signal",
+    "patch_reversible",
+    "patch_isolated",
+    "scope_bounded",
+    "security_sensitive",
+    "schema_migration",
+    "release_or_publication",
+    "irreversible_external_operation",
+    "explicit_standard_override",
+];
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isObservation = (value) => value === true || value === false || value === null;
+const isOptionalIdentifier = (value) => value === null || (typeof value === "string" && value.length > 0 && value.trim() === value);
+function selection(platform, mode, reason, detailReason) {
+    return {
+        status: "selected",
+        selection: { mode, reason, activation_reason: detailReason, platform },
+        detail_reason: detailReason,
+    };
+}
+/**
+ * Selects an inert remediation mode from declared eligibility observations only.
+ * It does not probe the platform, construct a runtime contract, or perform remediation.
+ */
+export function selectAdaptiveRemediation(input) {
+    if (!isObject(input) || Object.keys(input).some((key) => !INPUT_KEYS.includes(key)) ||
+        !OBSERVATION_KEYS.every((key) => Object.hasOwn(input, key) && isObservation(input[key])) ||
+        !Object.hasOwn(input, "signal_id") || !isOptionalIdentifier(input.signal_id) ||
+        !Object.hasOwn(input, "signal_definition") || !isOptionalIdentifier(input.signal_definition)) {
+        return { status: "rejected", selection: null, reason: "invalid-input" };
+    }
+    if (input.platform !== "windows" && input.platform !== "wsl") {
+        return { status: "rejected", selection: null, reason: "unsupported-platform" };
+    }
+    const platform = input.platform;
+    if (input.explicit_standard_override === true) {
+        return selection(platform, "standard", "unsafe-target", "explicit-standard-override");
+    }
+    if (input.security_sensitive === true) {
+        return selection(platform, "standard", "unsafe-target", "security-sensitive");
+    }
+    if (input.schema_migration === true) {
+        return selection(platform, "standard", "unsafe-target", "schema-migration");
+    }
+    if (input.release_or_publication === true) {
+        return selection(platform, "standard", "unsafe-target", "release-or-publication");
+    }
+    if (input.irreversible_external_operation === true) {
+        return selection(platform, "standard", "unsafe-target", "irreversible-external-operation");
+    }
+    if ([
+        input.security_sensitive,
+        input.schema_migration,
+        input.release_or_publication,
+        input.irreversible_external_operation,
+        input.explicit_standard_override,
+    ].some((value) => value === null)) {
+        return selection(platform, "standard", "unsafe-target", "risk-status-unknown");
+    }
+    if (input.canonical_validation_expensive !== true) {
+        return selection(platform, "standard", "validation-ineligible", input.canonical_validation_expensive === false
+            ? "canonical-validation-not-expensive"
+            : "canonical-validation-unknown");
+    }
+    if (input.repeatable_typed_signal !== true) {
+        return selection(platform, "standard", "validation-ineligible", input.repeatable_typed_signal === false ? "signal-not-repeatable" : "signal-repeatability-unknown");
+    }
+    if (input.signal_id === null || input.signal_definition === null) {
+        return selection(platform, "standard", "validation-ineligible", "signal-undefined");
+    }
+    if (input.patch_reversible !== true) {
+        return selection(platform, "standard", "unsafe-target", input.patch_reversible === false ? "patch-not-reversible" : "patch-reversibility-unknown");
+    }
+    if (input.patch_isolated !== true) {
+        return selection(platform, "standard", "scope-ineligible", input.patch_isolated === false ? "patch-not-isolated" : "patch-isolation-unknown");
+    }
+    if (input.scope_bounded !== true) {
+        return selection(platform, "standard", "scope-ineligible", input.scope_bounded === false ? "scope-not-bounded" : "scope-bounds-unknown");
+    }
+    return selection(platform, "adaptive-remediation", "eligible-auto", "eligible");
+}

package/dist/core/adaptive-progression.d.ts

@@ -0,0 +1,35 @@
+import type { AdaptiveRemediationContract, AdaptiveRemediationFailureCode, AdaptiveRemediationIteration } from "./types.js";
+export type AdaptiveProgressionRejectionCode = "iteration-sequence-mismatch" | "iteration-count-mismatch" | "validation-count-mismatch" | "selection-metrics-mismatch" | "iteration-state-mismatch" | "cleanup-state-mismatch" | "convergence-state-mismatch" | "review-state-mismatch" | "promotion-state-mismatch" | "verification-state-mismatch";
+export type AdaptiveProgressionHoldReason = "standard-mode" | "initial-iteration-pending" | "review-remediation-required";
+export type AdaptiveProgressionRequest = {
+    readonly phase: "probe";
+    readonly iteration: AdaptiveRemediationIteration["iteration"];
+} | {
+    readonly phase: "full-validation";
+} | {
+    readonly phase: "review";
+} | {
+    readonly phase: "promotion";
+    readonly expected_target_head: string;
+    readonly candidate_head: string;
+} | {
+    readonly phase: "post-merge-validation";
+};
+export type AdaptiveProgressionDecision = {
+    readonly kind: "rejected";
+    readonly code: AdaptiveProgressionRejectionCode;
+    readonly detail: string;
+} | {
+    readonly kind: "hold";
+    readonly reason: AdaptiveProgressionHoldReason;
+} | {
+    readonly kind: "request";
+    readonly request: AdaptiveProgressionRequest;
+} | {
+    readonly kind: "stop";
+    readonly reason: AdaptiveRemediationFailureCode;
+} | {
+    readonly kind: "complete";
+};
+/** Pure consistency guard mirroring the executing runtime's non-skippable stage order. */
+export declare function decideAdaptiveProgression(contract: AdaptiveRemediationContract): AdaptiveProgressionDecision;

package/dist/core/adaptive-progression.js

@@ -0,0 +1,60 @@
+const reject = (code, detail) => ({ kind: "rejected", code, detail });
+/** Pure consistency guard mirroring the executing runtime's non-skippable stage order. */
+export function decideAdaptiveProgression(contract) {
+    for (let index = 0; index < contract.iterations.length; index += 1) {
+        if (contract.iterations[index]?.iteration !== index + 1)
+            return reject("iteration-sequence-mismatch", "Iterations must be consecutive from one.");
+    }
+    if (contract.iterations.length !== contract.metrics.iteration_count)
+        return reject("iteration-count-mismatch", "Iteration metric differs from evidence.");
+    const expectedProbes = (contract.baseline_probe === null ? 0 : 1) + contract.iterations.length;
+    const expectedFull = contract.full_validation.status === "pending" ? 0 : 1;
+    const expectedPost = contract.post_merge.status === "pending" ? 0 : 1;
+    if (contract.metrics.probe_count !== expectedProbes || contract.metrics.full_validation_count !== expectedFull ||
+        contract.metrics.post_merge_validation_count !== expectedPost)
+        return reject("validation-count-mismatch", "Validation counts differ from measured evidence.");
+    if (contract.metrics.mode !== contract.selection.mode || contract.metrics.reason !== contract.selection.reason ||
+        contract.metrics.activation_reason !== contract.selection.activation_reason)
+        return reject("selection-metrics-mismatch", "Selection audit fields differ.");
+    if (contract.iterations.some((entry) => entry.cleanup.status === "pass" && entry.cleanup.remaining_paths.length > 0)) {
+        return reject("cleanup-state-mismatch", "Passing cleanup retains residue.");
+    }
+    for (const entry of contract.iterations.slice(0, -1)) {
+        if (entry.measured_probe.outcome !== "improved" || entry.cleanup.status !== "pass")
+            return reject("iteration-state-mismatch", "Only improved clean candidates may be refined.");
+    }
+    const latest = contract.iterations.at(-1);
+    if (contract.converged && (latest?.measured_probe.outcome !== "improved" || latest.cleanup.status !== "pass")) {
+        return reject("convergence-state-mismatch", "Convergence requires measured improvement and cleanup.");
+    }
+    if (!contract.converged && contract.full_validation.status !== "pending")
+        return reject("convergence-state-mismatch", "Canonical validation preceded convergence.");
+    if (contract.review.status !== "pending" && contract.full_validation.status !== "pass")
+        return reject("review-state-mismatch", "Review preceded canonical success.");
+    if (contract.promotion.status !== "pending" && contract.review.status !== "pass")
+        return reject("promotion-state-mismatch", "Promotion preceded review approval.");
+    if (contract.post_merge.status !== "pending" && contract.promotion.status !== "promoted")
+        return reject("verification-state-mismatch", "Post-merge validation preceded promotion.");
+    if (contract.state === "VERIFIED") {
+        if (contract.post_merge.status !== "pass" || contract.failure !== null)
+            return reject("verification-state-mismatch", "VERIFIED requires passing post-merge evidence and no failure.");
+        return { kind: "complete" };
+    }
+    if (contract.failure !== null)
+        return { kind: "stop", reason: contract.failure.code };
+    if (contract.selection.mode === "standard")
+        return { kind: "hold", reason: "standard-mode" };
+    if (latest === undefined)
+        return { kind: "hold", reason: "initial-iteration-pending" };
+    if (!contract.converged)
+        return { kind: "request", request: { phase: "probe", iteration: (contract.iterations.length + 1) } };
+    if (contract.full_validation.status === "pending")
+        return { kind: "request", request: { phase: "full-validation" } };
+    if (contract.review.status === "pending")
+        return { kind: "request", request: { phase: "review" } };
+    if (contract.review.status === "remediation-required")
+        return { kind: "hold", reason: "review-remediation-required" };
+    if (contract.promotion.status === "pending")
+        return { kind: "request", request: { phase: "promotion", expected_target_head: contract.promotion.expected_target_head, candidate_head: latest.candidate_head } };
+    return { kind: "request", request: { phase: "post-merge-validation" } };
+}

package/dist/core/adaptive-remediation-runtime.d.ts

@@ -0,0 +1,133 @@
+import { type AdaptiveEligibilityInput } from "./adaptive-eligibility.js";
+import { RunFlightLedger } from "./run-flight-ledger.js";
+import type { AdaptiveRemediationCommand, AdaptiveRemediationContract, AdaptiveRemediationProbeCommand, AdaptiveRemediationSignal, AdaptiveRemediationValidationEvidence } from "./types.js";
+export interface AdaptiveRemediationRequest {
+    readonly task_id: string;
+    readonly eligibility: AdaptiveEligibilityInput;
+    readonly target_ref: string;
+    readonly allowed_paths: {
+        readonly read: readonly string[];
+        readonly write: readonly string[];
+    };
+    readonly iteration_budget: 1 | 2 | 3;
+    readonly max_changed_paths: number;
+    readonly cleanup_timeout_ms: number;
+    readonly probe_validation: AdaptiveRemediationProbeCommand;
+    readonly canonical_validation: AdaptiveRemediationCommand;
+    readonly improvement_signal: AdaptiveRemediationSignal;
+    readonly risk_class: "low" | "medium" | "high";
+    readonly post_merge_validation: AdaptiveRemediationCommand;
+    readonly acceptance: readonly string[];
+}
+export interface AdaptiveProbeEvidence {
+    readonly command: readonly string[];
+    readonly exit_code: number | null;
+    readonly fingerprint: string;
+    readonly signal_id: string;
+    readonly value: number | null;
+}
+export interface AdaptiveCandidate {
+    readonly worktree_id: string;
+    readonly path: string;
+    readonly parent_head: string;
+}
+export interface AdaptivePatchEvidence {
+    readonly candidate: AdaptiveCandidate;
+    readonly candidate_head: string;
+    readonly hypothesis: string;
+    readonly patch_fingerprint: string;
+    readonly changed_paths: readonly string[];
+    readonly probe: AdaptiveProbeEvidence;
+}
+export interface AdaptiveRemediationRuntimeHost {
+    snapshotTarget(targetRef: string): Promise<{
+        readonly head: string;
+        readonly tree: string;
+    }>;
+    openCandidate(parentHead: string, iteration: 1 | 2 | 3): Promise<AdaptiveCandidate>;
+    runBaselineProbe(candidate: AdaptiveCandidate, command: AdaptiveRemediationProbeCommand): Promise<AdaptiveProbeEvidence>;
+    producePatch(input: {
+        readonly candidate: AdaptiveCandidate;
+        readonly iteration: 1 | 2 | 3;
+        readonly acceptance: readonly string[];
+        readonly allowed_paths: AdaptiveRemediationRequest["allowed_paths"];
+        readonly probe_validation: AdaptiveRemediationProbeCommand;
+    }): Promise<AdaptivePatchEvidence>;
+    reserveProbe?(input: {
+        readonly task_id: string;
+        readonly iteration: 1 | 2 | 3;
+        readonly parent_candidate: string;
+    }): Promise<string>;
+    finishProbe?(input: {
+        readonly reservation_id: string;
+        readonly patch: AdaptivePatchEvidence;
+        readonly duration_ms: number;
+    }): Promise<void>;
+    failProbe?(input: {
+        readonly reservation_id: string;
+        readonly duration_ms: number;
+        readonly code: string;
+    }): Promise<void>;
+    inspectCleanup(candidate: AdaptiveCandidate, timeoutMs: number): Promise<{
+        readonly ok: boolean;
+        readonly remaining_paths: readonly string[];
+    }>;
+    discardCandidate(candidate: AdaptiveCandidate): Promise<void>;
+    runCanonical(candidate: AdaptiveCandidate, command: AdaptiveRemediationCommand): Promise<AdaptiveRemediationValidationEvidence>;
+    review(input: {
+        readonly candidate: AdaptiveCandidate;
+        readonly candidate_head: string;
+        readonly risk_class: AdaptiveRemediationRequest["risk_class"];
+    }): Promise<{
+        readonly status: "pass" | "remediation-required" | "fail";
+        readonly fingerprint: string;
+    }>;
+    promote(input: {
+        readonly target_ref: string;
+        readonly expected_head: string;
+        readonly candidate_head: string;
+    }): Promise<{
+        readonly status: "promoted" | "cas-drift";
+        readonly observed_head: string;
+    }>;
+    runPostMerge(command: AdaptiveRemediationCommand): Promise<AdaptiveRemediationValidationEvidence>;
+    release(candidates: readonly AdaptiveCandidate[]): Promise<{
+        readonly ok: boolean;
+        readonly remaining_paths: readonly string[];
+    }>;
+}
+export interface AdaptiveLineageOptions {
+    readonly ledger: RunFlightLedger;
+    readonly unit_id: string;
+    readonly route_id: string;
+    readonly candidate_id: string;
+    readonly selected_model: string;
+    readonly selected_variant: string | null;
+    readonly predecessor_attempt_id: string | null;
+    /** Set only when a model is actually dispatched for each patch. */
+    readonly model_attempt_per_patch: boolean;
+}
+/** Shared RunFlightLedger adapter: probe iterations charge the existing cumulative recovery authority. */
+export declare class AdaptiveRunFlightLineage {
+    readonly options: AdaptiveLineageOptions;
+    private predecessor;
+    private readonly reservations;
+    constructor(options: AdaptiveLineageOptions);
+    reserveProbe(): Promise<string>;
+    finishProbe(input: {
+        readonly reservation_id: string;
+        readonly patch: AdaptivePatchEvidence;
+        readonly duration_ms: number;
+    }): Promise<void>;
+    failProbe(input: {
+        readonly reservation_id: string;
+        readonly duration_ms: number;
+        readonly code: string;
+    }): Promise<void>;
+}
+/** Executes the bounded state machine. Hosts own process/worktree mechanics; evidence cannot skip a stage. */
+export declare class AdaptiveRemediationRuntime {
+    readonly host: AdaptiveRemediationRuntimeHost;
+    constructor(host: AdaptiveRemediationRuntimeHost);
+    execute(request: AdaptiveRemediationRequest): Promise<AdaptiveRemediationContract>;
+}