swarm-orchestrator 7.0.0-alpha.0

package/dist/src/verification/cosign-attestation.js

@@ -0,0 +1,137 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signWithCosign = signWithCosign;
+exports.signWithCosignKey = signWithCosignKey;
+exports.verifyCosignSignature = verifyCosignSignature;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const command_runner_1 = require("./command-runner");
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function writeEnvelope(prefix, envelope) {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    const envelopePath = path.join(tmp, 'envelope.json');
+    fs.writeFileSync(envelopePath, JSON.stringify(envelope, null, 2), 'utf8');
+    return { tmp, envelopePath };
+}
+/**
+ * Sign an attestation envelope with cosign keyless signing.
+ *
+ * @param envelope - In-toto statement to sign.
+ * @param repoPath - Repository root for temporary signing files.
+ * @returns Cosign signature metadata.
+ */
+async function signWithCosign(envelope, repoPath) {
+    const { tmp, envelopePath } = writeEnvelope('swarm-attest-', envelope);
+    const bundlePath = path.join(tmp, 'bundle.json');
+    const command = `cosign sign-blob --yes --bundle ${shellQuote(bundlePath)} ${shellQuote(envelopePath)}`;
+    const result = await (0, command_runner_1.runVerificationCommand)(command, repoPath, 300_000);
+    if (result.exitCode !== 0) {
+        throw new Error(`cosign sign-blob failed: ${(result.stderr || result.stdout).trim()}`);
+    }
+    return {
+        kind: 'cosign',
+        signature: result.stdout.trim(),
+        bundlePath,
+    };
+}
+/**
+ * Sign an attestation envelope with a local cosign key pair.
+ *
+ * This is intended for offline integration tests and controlled environments.
+ * Production attestations should use keyless `signWithCosign`.
+ *
+ * @param envelope - In-toto statement to sign.
+ * @param repoPath - Repository root for temporary signing files.
+ * @param options - Cosign key paths and optional password.
+ * @returns Cosign key signature metadata.
+ */
+async function signWithCosignKey(envelope, repoPath, options) {
+    const { tmp, envelopePath } = writeEnvelope('swarm-attest-key-', envelope);
+    const signaturePath = path.join(tmp, 'signature.sig');
+    const password = options.password ?? '';
+    const command = `COSIGN_PASSWORD=${shellQuote(password)} cosign sign-blob --key ${shellQuote(options.privateKeyPath)} --output-signature ${shellQuote(signaturePath)} ${shellQuote(envelopePath)}`;
+    const result = await (0, command_runner_1.runVerificationCommand)(command, repoPath, 300_000);
+    if (result.exitCode !== 0) {
+        throw new Error(`cosign key sign-blob failed: ${(result.stderr || result.stdout).trim()}`);
+    }
+    return {
+        kind: 'cosign',
+        signature: fs.readFileSync(signaturePath, 'utf8').trim(),
+        signaturePath,
+        publicKeyPath: options.publicKeyPath,
+    };
+}
+function missingCosignMetadata(attestation) {
+    return {
+        found: true,
+        verified: false,
+        reason: 'cosign bundle or key signature metadata missing',
+        attestation,
+    };
+}
+/**
+ * Verify a cosign-backed attestation signature.
+ *
+ * @param repoPath - Repository root.
+ * @param attestation - Parsed signed attestation.
+ * @returns Verification result.
+ */
+async function verifyCosignSignature(repoPath, attestation) {
+    const { tmp, envelopePath } = writeEnvelope('swarm-attest-verify-', attestation.envelope);
+    const sig = attestation.signature;
+    const command = sig.bundlePath
+        ? `cosign verify-blob --bundle ${shellQuote(sig.bundlePath)} ${shellQuote(envelopePath)}`
+        : sig.signaturePath && sig.publicKeyPath
+            ? `cosign verify-blob --key ${shellQuote(sig.publicKeyPath)} --signature ${shellQuote(sig.signaturePath)} ${shellQuote(envelopePath)}`
+            : '';
+    if (!command) {
+        fs.rmSync(tmp, { recursive: true, force: true });
+        return missingCosignMetadata(attestation);
+    }
+    const result = await (0, command_runner_1.runVerificationCommand)(command, repoPath, 300_000);
+    fs.rmSync(tmp, { recursive: true, force: true });
+    return {
+        found: true,
+        verified: result.exitCode === 0,
+        reason: result.exitCode === 0
+            ? (sig.bundlePath ? 'cosign signature verified' : 'cosign key signature verified')
+            : (result.stderr || result.stdout).trim(),
+        attestation,
+    };
+}

package/dist/src/verification/diff-analysis.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTestFilePath = isTestFilePath;
+exports.parseUnifiedDiff = parseUnifiedDiff;
+exports.extractLiterals = extractLiterals;
+const TEST_FILE_RE = /(^|\/)(test|tests|__tests__)(\/|$)|(?:\.test|\.spec)\.[cm]?[jt]sx?$|(^|\/)test_.*\.py$|_test\.py$/;
+function parsePath(raw) {
+    return raw === '/dev/null' ? raw : raw.replace(/^[ab]\//, '');
+}
+/**
+ * Return true when a repo-relative path is a common test file path.
+ *
+ * @param filePath - Repo-relative file path.
+ * @returns Whether the file is test-owned.
+ */
+function isTestFilePath(filePath) {
+    return TEST_FILE_RE.test(filePath);
+}
+/**
+ * Parse a unified git diff into per-file line records.
+ *
+ * @param diffText - Unified diff text.
+ * @returns Parsed file sections with added and removed line numbers.
+ */
+function parseUnifiedDiff(diffText) {
+    const files = [];
+    let current;
+    let oldLine = 0;
+    let newLine = 0;
+    for (const line of diffText.split('\n')) {
+        const header = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
+        if (header?.[1] && header[2]) {
+            current = { oldPath: header[1], newPath: header[2], lines: [] };
+            files.push(current);
+            continue;
+        }
+        if (!current)
+            continue;
+        if (line.startsWith('--- ')) {
+            current.oldPath = parsePath(line.slice(4).trim());
+            continue;
+        }
+        if (line.startsWith('+++ ')) {
+            current.newPath = parsePath(line.slice(4).trim());
+            continue;
+        }
+        const hunk = line.match(/^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+        if (hunk?.[1] && hunk[2]) {
+            oldLine = Number.parseInt(hunk[1], 10);
+            newLine = Number.parseInt(hunk[2], 10);
+            continue;
+        }
+        if (line.startsWith('+++') || line.startsWith('---') || line.startsWith('\\')) {
+            continue;
+        }
+        if (line.startsWith('+')) {
+            current.lines.push({ kind: 'add', content: line.slice(1), newLine });
+            newLine += 1;
+        }
+        else if (line.startsWith('-')) {
+            current.lines.push({ kind: 'remove', content: line.slice(1), oldLine });
+            oldLine += 1;
+        }
+        else if (line.startsWith(' ')) {
+            current.lines.push({ kind: 'context', content: line.slice(1), oldLine, newLine });
+            oldLine += 1;
+            newLine += 1;
+        }
+    }
+    return files;
+}
+/**
+ * Extract simple string and numeric literals from one source line.
+ *
+ * @param line - Source line.
+ * @returns Literal values without quotes.
+ */
+function extractLiterals(line) {
+    const literals = new Set();
+    for (const match of line.matchAll(/(['"`])([^'"`]{2,})\1/g)) {
+        if (match[2])
+            literals.add(match[2]);
+    }
+    for (const match of line.matchAll(/\b\d+(?:\.\d+)?\b/g)) {
+        if (match[0])
+            literals.add(match[0]);
+    }
+    return [...literals];
+}

package/dist/src/verification/differential-gate.js

@@ -0,0 +1,173 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDifferentialGate = runDifferentialGate;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const command_runner_1 = require("./command-runner");
+function git(repoPath, args) {
+    return (0, child_process_1.execFileSync)('git', args, {
+        cwd: repoPath,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: {
+            ...process.env,
+            GIT_TERMINAL_PROMPT: '0',
+        },
+    }).trim();
+}
+function addDetachedWorktree(repoPath, worktreePath, ref) {
+    (0, child_process_1.execFileSync)('git', ['worktree', 'add', '--detach', worktreePath, ref], {
+        cwd: repoPath,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: {
+            ...process.env,
+            GIT_TERMINAL_PROMPT: '0',
+        },
+    });
+}
+function removeWorktree(repoPath, worktreePath) {
+    try {
+        (0, child_process_1.execFileSync)('git', ['worktree', 'remove', '--force', worktreePath], {
+            cwd: repoPath,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch {
+        fs.rmSync(worktreePath, { recursive: true, force: true });
+    }
+    try {
+        (0, child_process_1.execFileSync)('git', ['worktree', 'prune'], {
+            cwd: repoPath,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch {
+        // Cleanup is best-effort after the target worktree is already gone.
+    }
+}
+function setupFailure(started, reason) {
+    return {
+        status: 'FAIL',
+        reason,
+        durationMs: Date.now() - started,
+    };
+}
+/**
+ * Run a differential intent gate for one synthesized or SWE-bench test.
+ *
+ * The gate runs the same command against a detached worktree at `baseCommit`
+ * and a detached worktree at `agentBranch`. The test must fail at the base
+ * and pass at the patch. If it passes at the base, the test is invalid because
+ * it does not prove the stated bug or feature.
+ *
+ * @param input - Repository path, test command, base commit, and patch branch.
+ * @returns Structured base/patch command evidence and gate status.
+ */
+async function runDifferentialGate(input) {
+    const started = Date.now();
+    const repoPath = path.resolve(input.repoPath);
+    const timeoutMs = input.timeoutMs ?? 120_000;
+    const root = input.worktreeRoot
+        ? path.resolve(input.worktreeRoot)
+        : fs.mkdtempSync(path.join(os.tmpdir(), 'swarm-diff-gate-'));
+    const baseWorktree = path.join(root, 'base');
+    const patchWorktree = path.join(root, 'patch');
+    if (!input.testCommand.trim()) {
+        return setupFailure(started, 'differential gate requires a non-empty test command');
+    }
+    try {
+        git(repoPath, ['rev-parse', '--is-inside-work-tree']);
+        git(repoPath, ['rev-parse', '--verify', input.baseCommit]);
+        git(repoPath, ['rev-parse', '--verify', input.agentBranch]);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return setupFailure(started, `differential gate git setup failed: ${message}`);
+    }
+    let base;
+    let patch;
+    try {
+        fs.mkdirSync(root, { recursive: true });
+        addDetachedWorktree(repoPath, baseWorktree, input.baseCommit);
+        base = await (0, command_runner_1.runVerificationCommand)(input.testCommand, baseWorktree, timeoutMs);
+        if (base.exitCode === 0) {
+            return {
+                status: 'INVALID_TEST',
+                reason: 'test command passed against the base commit',
+                base,
+                durationMs: Date.now() - started,
+            };
+        }
+        addDetachedWorktree(repoPath, patchWorktree, input.agentBranch);
+        patch = await (0, command_runner_1.runVerificationCommand)(input.testCommand, patchWorktree, timeoutMs);
+        if (patch.exitCode === 0) {
+            return {
+                status: 'PASS',
+                reason: 'test failed at base and passed at patch',
+                base,
+                patch,
+                durationMs: Date.now() - started,
+            };
+        }
+        return {
+            status: 'FAIL',
+            reason: 'test command failed against the patch',
+            base,
+            patch,
+            durationMs: Date.now() - started,
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            status: 'FAIL',
+            reason: `differential gate execution failed: ${message}`,
+            ...(base ? { base } : {}),
+            ...(patch ? { patch } : {}),
+            durationMs: Date.now() - started,
+        };
+    }
+    finally {
+        if (fs.existsSync(baseWorktree))
+            removeWorktree(repoPath, baseWorktree);
+        if (fs.existsSync(patchWorktree))
+            removeWorktree(repoPath, patchWorktree);
+        if (!input.worktreeRoot)
+            fs.rmSync(root, { recursive: true, force: true });
+    }
+}

package/dist/src/verification/index.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCompositeScoreConfig = exports.computeCompositeScore = exports.DEFAULT_COMPOSITE_CONFIG = exports.signWithCosignKey = exports.verifyAttestation = exports.unsignedTestSigner = exports.signWithCosign = exports.readAttestationNote = exports.generateSignedAttestation = exports.createAttestationEnvelope = exports.attachAttestationNote = exports.runPropertyGate = exports.discoverPropertyTargets = exports.parseUnifiedDiff = exports.isTestFilePath = exports.extractLiterals = exports.runCheatDetector = exports.runMutationGate = exports.parseMutationOutput = exports.loadMutationThresholds = exports.evaluateMutationScore = exports.detectMutationLanguages = exports.buildMutationCommand = exports.DEFAULT_MUTATION_THRESHOLDS = exports.validateSynthesizedTestCandidate = exports.synthesizeRegressionTest = exports.runDifferentialGate = exports.runVerificationCommand = void 0;
+var command_runner_1 = require("./command-runner");
+Object.defineProperty(exports, "runVerificationCommand", { enumerable: true, get: function () { return command_runner_1.runVerificationCommand; } });
+var differential_gate_1 = require("./differential-gate");
+Object.defineProperty(exports, "runDifferentialGate", { enumerable: true, get: function () { return differential_gate_1.runDifferentialGate; } });
+var test_synthesizer_1 = require("./test-synthesizer");
+Object.defineProperty(exports, "synthesizeRegressionTest", { enumerable: true, get: function () { return test_synthesizer_1.synthesizeRegressionTest; } });
+Object.defineProperty(exports, "validateSynthesizedTestCandidate", { enumerable: true, get: function () { return test_synthesizer_1.validateSynthesizedTestCandidate; } });
+var mutation_gate_1 = require("./mutation-gate");
+Object.defineProperty(exports, "DEFAULT_MUTATION_THRESHOLDS", { enumerable: true, get: function () { return mutation_gate_1.DEFAULT_MUTATION_THRESHOLDS; } });
+Object.defineProperty(exports, "buildMutationCommand", { enumerable: true, get: function () { return mutation_gate_1.buildMutationCommand; } });
+Object.defineProperty(exports, "detectMutationLanguages", { enumerable: true, get: function () { return mutation_gate_1.detectMutationLanguages; } });
+Object.defineProperty(exports, "evaluateMutationScore", { enumerable: true, get: function () { return mutation_gate_1.evaluateMutationScore; } });
+Object.defineProperty(exports, "loadMutationThresholds", { enumerable: true, get: function () { return mutation_gate_1.loadMutationThresholds; } });
+Object.defineProperty(exports, "parseMutationOutput", { enumerable: true, get: function () { return mutation_gate_1.parseMutationOutput; } });
+Object.defineProperty(exports, "runMutationGate", { enumerable: true, get: function () { return mutation_gate_1.runMutationGate; } });
+var cheat_detector_1 = require("./cheat-detector");
+Object.defineProperty(exports, "runCheatDetector", { enumerable: true, get: function () { return cheat_detector_1.runCheatDetector; } });
+var diff_analysis_1 = require("./diff-analysis");
+Object.defineProperty(exports, "extractLiterals", { enumerable: true, get: function () { return diff_analysis_1.extractLiterals; } });
+Object.defineProperty(exports, "isTestFilePath", { enumerable: true, get: function () { return diff_analysis_1.isTestFilePath; } });
+Object.defineProperty(exports, "parseUnifiedDiff", { enumerable: true, get: function () { return diff_analysis_1.parseUnifiedDiff; } });
+var property_gate_1 = require("./property-gate");
+Object.defineProperty(exports, "discoverPropertyTargets", { enumerable: true, get: function () { return property_gate_1.discoverPropertyTargets; } });
+Object.defineProperty(exports, "runPropertyGate", { enumerable: true, get: function () { return property_gate_1.runPropertyGate; } });
+var attestation_1 = require("./attestation");
+Object.defineProperty(exports, "attachAttestationNote", { enumerable: true, get: function () { return attestation_1.attachAttestationNote; } });
+Object.defineProperty(exports, "createAttestationEnvelope", { enumerable: true, get: function () { return attestation_1.createAttestationEnvelope; } });
+Object.defineProperty(exports, "generateSignedAttestation", { enumerable: true, get: function () { return attestation_1.generateSignedAttestation; } });
+Object.defineProperty(exports, "readAttestationNote", { enumerable: true, get: function () { return attestation_1.readAttestationNote; } });
+Object.defineProperty(exports, "signWithCosign", { enumerable: true, get: function () { return attestation_1.signWithCosign; } });
+Object.defineProperty(exports, "unsignedTestSigner", { enumerable: true, get: function () { return attestation_1.unsignedTestSigner; } });
+Object.defineProperty(exports, "verifyAttestation", { enumerable: true, get: function () { return attestation_1.verifyAttestation; } });
+var cosign_attestation_1 = require("./cosign-attestation");
+Object.defineProperty(exports, "signWithCosignKey", { enumerable: true, get: function () { return cosign_attestation_1.signWithCosignKey; } });
+var composite_score_1 = require("./composite-score");
+Object.defineProperty(exports, "DEFAULT_COMPOSITE_CONFIG", { enumerable: true, get: function () { return composite_score_1.DEFAULT_COMPOSITE_CONFIG; } });
+Object.defineProperty(exports, "computeCompositeScore", { enumerable: true, get: function () { return composite_score_1.computeCompositeScore; } });
+Object.defineProperty(exports, "loadCompositeScoreConfig", { enumerable: true, get: function () { return composite_score_1.loadCompositeScoreConfig; } });

package/dist/src/verification/mutation-gate.js

@@ -0,0 +1,242 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MUTATION_THRESHOLDS = void 0;
+exports.loadMutationThresholds = loadMutationThresholds;
+exports.detectMutationLanguages = detectMutationLanguages;
+exports.buildMutationCommand = buildMutationCommand;
+exports.parseMutationOutput = parseMutationOutput;
+exports.evaluateMutationScore = evaluateMutationScore;
+exports.runMutationGate = runMutationGate;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml = __importStar(require("js-yaml"));
+const command_runner_1 = require("./command-runner");
+exports.DEFAULT_MUTATION_THRESHOLDS = {
+    failBelow: 0.6,
+    warnBelow: 0.8,
+};
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function readNumber(record, key) {
+    const value = record[key];
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+/**
+ * Load mutation thresholds from `.swarm/gates.yaml`, falling back to defaults.
+ *
+ * @param projectRoot - Target repository root.
+ * @returns Configured mutation score thresholds.
+ */
+function loadMutationThresholds(projectRoot) {
+    const configPath = path.join(projectRoot, '.swarm', 'gates.yaml');
+    if (!fs.existsSync(configPath))
+        return { ...exports.DEFAULT_MUTATION_THRESHOLDS };
+    const parsed = yaml.load(fs.readFileSync(configPath, 'utf8'));
+    if (!isRecord(parsed))
+        return { ...exports.DEFAULT_MUTATION_THRESHOLDS };
+    const verification = parsed.verification;
+    if (!isRecord(verification))
+        return { ...exports.DEFAULT_MUTATION_THRESHOLDS };
+    const mutation = verification.mutation;
+    if (!isRecord(mutation))
+        return { ...exports.DEFAULT_MUTATION_THRESHOLDS };
+    return {
+        failBelow: readNumber(mutation, 'failBelow') ?? exports.DEFAULT_MUTATION_THRESHOLDS.failBelow,
+        warnBelow: readNumber(mutation, 'warnBelow') ?? exports.DEFAULT_MUTATION_THRESHOLDS.warnBelow,
+    };
+}
+/**
+ * Group changed files by mutation tool language.
+ *
+ * @param changedFiles - Repo-relative changed file paths.
+ * @returns Mutation targets for supported languages.
+ */
+function detectMutationLanguages(changedFiles) {
+    const jsTs = changedFiles.filter(file => /\.(?:[cm]?js|jsx|ts|tsx)$/.test(file) && !file.endsWith('.d.ts'));
+    const python = changedFiles.filter(file => file.endsWith('.py'));
+    const java = changedFiles.filter(file => file.endsWith('.java'));
+    const targets = [];
+    if (jsTs.length > 0)
+        targets.push({ language: 'javascript-typescript', files: jsTs });
+    if (python.length > 0)
+        targets.push({ language: 'python', files: python });
+    if (java.length > 0)
+        targets.push({ language: 'java', files: java });
+    return targets;
+}
+function javaClassGlobs(files) {
+    return files.map(file => {
+        const normalized = file.replace(/\\/g, '/').replace(/\.java$/, '');
+        const marker = '/src/main/java/';
+        const idx = normalized.indexOf(marker);
+        const classPath = idx >= 0 ? normalized.slice(idx + marker.length) : normalized;
+        return classPath.replace(/\//g, '.');
+    }).join(',');
+}
+/**
+ * Build the mutation tool command for one language target.
+ *
+ * @param projectRoot - Target repository root.
+ * @param target - Language target to mutate.
+ * @returns Shell command scoped to the changed files.
+ */
+function buildMutationCommand(projectRoot, target) {
+    if (target.language === 'javascript-typescript') {
+        return `npx stryker run --mutate ${shellQuote(target.files.join(','))} --reporters clear-text`;
+    }
+    if (target.language === 'python') {
+        return `python -m mutmut run --paths-to-mutate ${target.files.map(shellQuote).join(' ')}`;
+    }
+    const classGlobs = javaClassGlobs(target.files);
+    if (fs.existsSync(path.join(projectRoot, 'gradlew'))) {
+        return `./gradlew pitest -PtargetClasses=${shellQuote(classGlobs)}`;
+    }
+    return `mvn org.pitest:pitest-maven:mutationCoverage -DtargetClasses=${shellQuote(classGlobs)}`;
+}
+function parseCount(text, labels) {
+    for (const label of labels) {
+        const pattern = new RegExp(`${label}\\s*[:=]?\\s*(\\d+)`, 'i');
+        const match = text.match(pattern);
+        if (match?.[1])
+            return Number.parseInt(match[1], 10);
+        const leadingPattern = new RegExp(`(\\d+)\\s+(?:mutant\\(s\\)|mutants?)\\s+${label}`, 'i');
+        const leadingMatch = text.match(leadingPattern);
+        if (leadingMatch?.[1])
+            return Number.parseInt(leadingMatch[1], 10);
+    }
+    return undefined;
+}
+/**
+ * Parse common Stryker, mutmut, and PITest output into mutation metrics.
+ *
+ * @param stdout - Tool stdout.
+ * @param stderr - Tool stderr.
+ * @returns Parsed mutant counts and score.
+ */
+function parseMutationOutput(stdout, stderr = '') {
+    const text = `${stdout}\n${stderr}`;
+    const scoreMatch = text.match(/(?:mutation\s+score|score)\s*[:=]?\s*(\d+(?:\.\d+)?)\s*%/i);
+    const killed = parseCount(text, ['killed mutants', 'killed']);
+    const survived = parseCount(text, ['survived mutants', 'survived', 'survivors']);
+    const total = parseCount(text, ['total mutants', 'mutant\\(s\\) generated', 'generated', 'total']);
+    const derivedTotal = total ?? (killed !== undefined && survived !== undefined ? killed + survived : undefined);
+    const mutationScore = scoreMatch?.[1]
+        ? Number.parseFloat(scoreMatch[1]) / 100
+        : derivedTotal && killed !== undefined
+            ? killed / derivedTotal
+            : 0;
+    return {
+        totalMutants: derivedTotal ?? 0,
+        killedMutants: killed ?? 0,
+        survivedMutants: survived ?? Math.max((derivedTotal ?? 0) - (killed ?? 0), 0),
+        mutationScore,
+    };
+}
+/**
+ * Classify a mutation score against hard-fail and warning thresholds.
+ *
+ * @param score - Mutation score from 0.0 to 1.0.
+ * @param thresholds - Configured mutation score thresholds.
+ * @returns Gate status for the score.
+ */
+function evaluateMutationScore(score, thresholds = exports.DEFAULT_MUTATION_THRESHOLDS) {
+    if (score < thresholds.failBelow)
+        return 'FAIL';
+    if (score < thresholds.warnBelow)
+        return 'WARNING';
+    return 'PASS';
+}
+/**
+ * Run mutation testing against files changed by an agent patch.
+ *
+ * @param input - Target repo, changed files, thresholds, and optional runner.
+ * @returns Structured mutation score evidence.
+ */
+async function runMutationGate(input) {
+    const thresholds = input.thresholds ?? loadMutationThresholds(input.targetRepoPath);
+    const targets = detectMutationLanguages(input.changedFiles);
+    if (targets.length === 0) {
+        return {
+            status: 'SKIP',
+            reason: 'no changed files use a supported mutation testing language',
+            mutationScore: 1,
+            thresholds,
+            totalMutants: 0,
+            killedMutants: 0,
+            survivedMutants: 0,
+            results: [],
+        };
+    }
+    const runner = input.commandRunner ?? command_runner_1.runVerificationCommand;
+    const results = [];
+    for (const target of targets) {
+        const command = buildMutationCommand(input.targetRepoPath, target);
+        const commandResult = await runner(command, input.targetRepoPath, input.timeoutMs ?? 600_000);
+        const metrics = parseMutationOutput(commandResult.stdout, commandResult.stderr);
+        results.push({
+            language: target.language,
+            files: target.files,
+            command,
+            exitCode: commandResult.exitCode,
+            stdout: commandResult.stdout,
+            stderr: commandResult.stderr,
+            durationMs: commandResult.durationMs,
+            ...metrics,
+        });
+    }
+    const totalMutants = results.reduce((sum, result) => sum + result.totalMutants, 0);
+    const killedMutants = results.reduce((sum, result) => sum + result.killedMutants, 0);
+    const survivedMutants = results.reduce((sum, result) => sum + result.survivedMutants, 0);
+    const mutationScore = totalMutants > 0 ? killedMutants / totalMutants : 0;
+    const toolFailed = results.some(result => result.exitCode !== 0 && result.totalMutants === 0);
+    const status = toolFailed ? 'FAIL' : evaluateMutationScore(mutationScore, thresholds);
+    return {
+        status,
+        reason: toolFailed
+            ? 'mutation tool failed before producing a mutation score'
+            : `mutation score ${mutationScore.toFixed(3)} produced ${status}`,
+        mutationScore,
+        thresholds,
+        totalMutants,
+        killedMutants,
+        survivedMutants,
+        results,
+    };
+}