voratiq 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/domain/verify/competition/adapter.js

@@ -0,0 +1,444 @@
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { detectAgentProcessFailureDetail } from "../../../agents/runtime/failures.js";
+import { runSandboxedAgent } from "../../../agents/runtime/harness.js";
+import { stageExtraContextFiles, } from "../../../competition/shared/extra-context.js";
+import { composeStageSandboxPolicy } from "../../../competition/shared/sandbox-policy.js";
+import { buildUnavailableTokenUsageResult, resolveTokenUsage, } from "../../../domain/shared/token-usage.js";
+import { emitStageProgressEvent } from "../../../render/transcripts/stage-progress.js";
+import { toErrorMessage } from "../../../utils/errors.js";
+import { pathExists } from "../../../utils/fs.js";
+import { prepareScratchAgentWorkspace } from "../../../workspace/agents.js";
+import { extractProviderNativeTokenUsageForSession } from "../../../workspace/chat/native-usage.js";
+import { ensureWorkspaceDependencies } from "../../../workspace/dependencies.js";
+import { buildScopedAgentWorkspacePaths, } from "../../../workspace/layout.js";
+import { getVerificationRubricExecutionDirectoryPath, getVerificationRubricResultPath, VORATIQ_VERIFICATION_DIR, } from "../../../workspace/structure.js";
+import { verificationResultArtifactSchema, } from "../model/types.js";
+import { writeVerificationArtifact } from "./artifacts.js";
+import { assertNoVerificationIdentityLeak, assertRubricResultSelectorsMatchAliasMap, buildForbiddenVerificationIdentityTokens, parseRubricResultPayload, } from "./blinding.js";
+import { buildRubricPrompt } from "./prompt.js";
+import { attachVerifierWorkspaceMounts, buildStagedVerificationInputs, sharedInputsUseReferenceRepo, } from "./shared-layout.js";
+export function createVerifyCompetitionAdapter(input) {
+    const { root, verificationId, resolvedTarget, aliasMap, environment, extraContextFiles, sharedInputs, teardown, mutators, renderer, } = input;
+    const startedAtByExecutionKey = new Map();
+    const tokenUsageResultByExecutionKey = new Map();
+    function executionKeyForCandidate(candidate) {
+        return `${candidate.template.template}:${candidate.agent.id}`;
+    }
+    return {
+        prepareCandidates: (candidates) => ({
+            ready: candidates.map((candidate) => {
+                const workspacePaths = buildVerifierRubricWorkspacePaths({
+                    root,
+                    verificationId,
+                    verifierId: candidate.agent.id,
+                    template: candidate.template.template,
+                });
+                registerScratchWorkspaceTeardown(teardown, workspacePaths, candidate.agent.id, candidate.template.template);
+                return { candidate, workspacePaths };
+            }),
+            failures: [],
+        }),
+        queueCandidate: async (candidate) => {
+            await mutators.recordMethodSnapshot({
+                method: "rubric",
+                template: candidate.template.template,
+                verifierId: candidate.agent.id,
+                scope: resolvedTarget.target.kind === "run"
+                    ? { kind: "run" }
+                    : { kind: "target" },
+                status: "queued",
+            });
+            emitStageProgressEvent(renderer, {
+                type: "stage.candidate",
+                stage: "verify",
+                candidate: {
+                    methodKey: `rubric:${candidate.template.template}:${candidate.agent.id}`,
+                    verifierLabel: candidate.template.template,
+                    agentLabel: candidate.agent.id,
+                    status: "queued",
+                },
+            });
+        },
+        onCandidateRunning: async (prepared) => {
+            const startedAt = new Date().toISOString();
+            const executionKey = executionKeyForCandidate(prepared.candidate);
+            startedAtByExecutionKey.set(executionKey, startedAt);
+            await mutators.recordMethodSnapshot({
+                method: "rubric",
+                template: prepared.candidate.template.template,
+                verifierId: prepared.candidate.agent.id,
+                scope: resolvedTarget.target.kind === "run"
+                    ? { kind: "run" }
+                    : { kind: "target" },
+                status: "running",
+                startedAt,
+            });
+            emitStageProgressEvent(renderer, {
+                type: "stage.candidate",
+                stage: "verify",
+                candidate: {
+                    methodKey: `rubric:${prepared.candidate.template.template}:${prepared.candidate.agent.id}`,
+                    verifierLabel: prepared.candidate.template.template,
+                    agentLabel: prepared.candidate.agent.id,
+                    status: "running",
+                    startedAt,
+                },
+            });
+        },
+        executeCandidate: async (prepared) => {
+            const executionKey = executionKeyForCandidate(prepared.candidate);
+            const startedAt = startedAtByExecutionKey.get(executionKey) ?? new Date().toISOString();
+            const { workspacePaths } = prepared;
+            await prepareScratchAgentWorkspace({ paths: workspacePaths });
+            await attachVerifierWorkspaceMounts({
+                workspacePath: workspacePaths.workspacePath,
+                contextPath: workspacePaths.contextPath,
+                sharedInputs,
+            });
+            await ensureWorkspaceDependencies({
+                root,
+                workspacePath: workspacePaths.workspacePath,
+                environment,
+            });
+            await stageExtraContextFiles({
+                contextPath: workspacePaths.contextPath,
+                files: extraContextFiles,
+            });
+            const staged = buildStagedVerificationInputs({
+                workspacePaths,
+                sharedInputs,
+            });
+            const prompt = buildRubricPrompt({
+                template: prepared.candidate.template,
+                target: resolvedTarget.target,
+                staged,
+                extraContextFiles,
+            });
+            assertNoVerificationIdentityLeak({
+                text: prompt,
+                forbidden: buildForbiddenVerificationIdentityTokens({
+                    resolvedTarget,
+                    allowed: [
+                        prepared.candidate.agent.id,
+                        prepared.candidate.agent.model,
+                    ],
+                }),
+            });
+            const sandboxPolicy = composeStageSandboxPolicy({
+                stageWriteProtectedPaths: [
+                    workspacePaths.contextPath,
+                    join(workspacePaths.workspacePath, "context"),
+                    join(workspacePaths.workspacePath, "inputs"),
+                    sharedInputs.sharedInputsAbsolute,
+                    ...(sharedInputsUseReferenceRepo(sharedInputs)
+                        ? [
+                            join(workspacePaths.workspacePath, "reference_repo"),
+                            sharedInputs.referenceRepoAbsolute,
+                        ]
+                        : []),
+                ],
+            });
+            const result = await runSandboxedAgent({
+                root,
+                sessionId: verificationId,
+                sandboxStageId: "verify",
+                agent: prepared.candidate.agent,
+                prompt,
+                environment,
+                teardownAuthOnExit: false,
+                captureChat: true,
+                paths: {
+                    agentRoot: workspacePaths.agentRoot,
+                    workspacePath: workspacePaths.workspacePath,
+                    sandboxHomePath: workspacePaths.sandboxHomePath,
+                    runtimeManifestPath: workspacePaths.runtimeManifestPath,
+                    sandboxSettingsPath: workspacePaths.sandboxSettingsPath,
+                    runtimePath: workspacePaths.runtimePath,
+                    artifactsPath: workspacePaths.artifactsPath,
+                    stdoutPath: workspacePaths.stdoutPath,
+                    stderrPath: workspacePaths.stderrPath,
+                },
+                extraWriteProtectedPaths: sandboxPolicy.extraWriteProtectedPaths,
+                extraReadProtectedPaths: sandboxPolicy.extraReadProtectedPaths,
+            });
+            const tokenUsageResult = await extractProviderNativeTokenUsageForSession({
+                root,
+                domain: VORATIQ_VERIFICATION_DIR,
+                sessionId: verificationId,
+                agentId: prepared.candidate.agent.id,
+                provider: prepared.candidate.agent.provider,
+                modelId: prepared.candidate.agent.model,
+                chatCaptured: result.chat?.captured === true,
+                format: result.chat?.format,
+                artifactPath: result.chat?.artifactPath,
+            });
+            tokenUsageResultByExecutionKey.set(executionKey, tokenUsageResult);
+            const tokenUsage = resolveTokenUsage(tokenUsageResult);
+            const completedAt = new Date().toISOString();
+            const artifactPath = getVerificationRubricResultPath({
+                sessionId: verificationId,
+                verifierId: prepared.candidate.agent.id,
+                template: prepared.candidate.template.template,
+            });
+            if (result.exitCode !== 0 || result.errorMessage) {
+                const detectedDetail = result.watchdog?.trigger && result.errorMessage
+                    ? result.errorMessage
+                    : await detectAgentProcessFailureDetail({
+                        provider: prepared.candidate.agent.provider,
+                        stdoutPath: workspacePaths.stdoutPath,
+                        stderrPath: workspacePaths.stderrPath,
+                    });
+                const detail = detectedDetail ??
+                    result.errorMessage ??
+                    `Agent exited with code ${result.exitCode ?? "unknown"}`;
+                await writeFailureRubricArtifact({
+                    root,
+                    artifactPath,
+                    verifierId: prepared.candidate.agent.id,
+                    template: prepared.candidate.template.template,
+                    generatedAt: completedAt,
+                    error: detail,
+                });
+                return {
+                    template: prepared.candidate.template.template,
+                    verifierId: prepared.candidate.agent.id,
+                    status: "failed",
+                    artifactPath,
+                    startedAt,
+                    completedAt,
+                    error: detail,
+                    tokenUsage,
+                    tokenUsageResult,
+                };
+            }
+            const outputPath = resolve(workspacePaths.workspacePath, "result.json");
+            if (!(await pathExists(outputPath))) {
+                const detail = `Missing result.json. See stderr: ${workspacePaths.stderrPath}`;
+                await writeFailureRubricArtifact({
+                    root,
+                    artifactPath,
+                    verifierId: prepared.candidate.agent.id,
+                    template: prepared.candidate.template.template,
+                    generatedAt: completedAt,
+                    error: detail,
+                });
+                return {
+                    template: prepared.candidate.template.template,
+                    verifierId: prepared.candidate.agent.id,
+                    status: "failed",
+                    artifactPath,
+                    startedAt,
+                    completedAt,
+                    error: detail,
+                    tokenUsage,
+                    tokenUsageResult,
+                };
+            }
+            const raw = await readFile(outputPath, "utf8");
+            try {
+                assertNoVerificationIdentityLeak({
+                    text: raw,
+                    forbidden: buildForbiddenVerificationIdentityTokens({
+                        resolvedTarget,
+                        allowed: [
+                            prepared.candidate.agent.id,
+                            prepared.candidate.agent.model,
+                        ],
+                    }),
+                });
+                const resultPayload = parseRubricResultPayload(raw);
+                const artifact = verificationResultArtifactSchema.parse({
+                    method: "rubric",
+                    template: prepared.candidate.template.template,
+                    verifierId: prepared.candidate.agent.id,
+                    generatedAt: completedAt,
+                    status: "succeeded",
+                    result: resultPayload,
+                });
+                assertRubricResultSelectorsMatchAliasMap({
+                    artifactPath,
+                    result: artifact.method === "rubric" ? artifact.result : undefined,
+                    aliasMap,
+                });
+                await writeVerificationArtifact({
+                    root,
+                    artifactPath,
+                    artifact,
+                });
+                return {
+                    template: prepared.candidate.template.template,
+                    verifierId: prepared.candidate.agent.id,
+                    status: "succeeded",
+                    artifactPath,
+                    startedAt,
+                    completedAt,
+                    tokenUsage,
+                    tokenUsageResult,
+                };
+            }
+            catch (error) {
+                const detail = toErrorMessage(error);
+                await writeFailureRubricArtifact({
+                    root,
+                    artifactPath,
+                    verifierId: prepared.candidate.agent.id,
+                    template: prepared.candidate.template.template,
+                    generatedAt: completedAt,
+                    error: detail,
+                });
+                return {
+                    template: prepared.candidate.template.template,
+                    verifierId: prepared.candidate.agent.id,
+                    status: "failed",
+                    artifactPath,
+                    startedAt,
+                    completedAt,
+                    error: detail,
+                    tokenUsage,
+                    tokenUsageResult,
+                };
+            }
+        },
+        onCandidateCompleted: async (prepared, result) => {
+            const executionKey = executionKeyForCandidate(prepared.candidate);
+            await mutators.recordMethodSnapshot({
+                method: "rubric",
+                template: prepared.candidate.template.template,
+                verifierId: prepared.candidate.agent.id,
+                scope: resolvedTarget.target.kind === "run"
+                    ? { kind: "run" }
+                    : { kind: "target" },
+                status: result.status,
+                artifactPath: result.artifactPath,
+                startedAt: result.startedAt,
+                completedAt: result.completedAt,
+                tokenUsage: result.tokenUsage,
+                ...(result.status === "failed" ? { error: result.error } : {}),
+            });
+            emitStageProgressEvent(renderer, {
+                type: "stage.candidate",
+                stage: "verify",
+                candidate: {
+                    methodKey: `rubric:${prepared.candidate.template.template}:${prepared.candidate.agent.id}`,
+                    verifierLabel: prepared.candidate.template.template,
+                    agentLabel: prepared.candidate.agent.id,
+                    status: result.status,
+                    startedAt: result.startedAt,
+                    completedAt: result.completedAt,
+                    artifactPath: result.artifactPath,
+                    tokenUsage: result.tokenUsage,
+                    tokenUsageResult: result.tokenUsageResult,
+                },
+            });
+            startedAtByExecutionKey.delete(executionKey);
+            tokenUsageResultByExecutionKey.delete(executionKey);
+        },
+        captureExecutionFailure: async ({ prepared, error }) => {
+            const executionKey = executionKeyForCandidate(prepared.candidate);
+            const startedAt = startedAtByExecutionKey.get(executionKey) ?? new Date().toISOString();
+            const completedAt = new Date().toISOString();
+            const artifactPath = getVerificationRubricResultPath({
+                sessionId: verificationId,
+                verifierId: prepared.candidate.agent.id,
+                template: prepared.candidate.template.template,
+            });
+            const detail = toErrorMessage(error);
+            const tokenUsageResult = tokenUsageResultByExecutionKey.get(executionKey) ??
+                buildUnavailableTokenUsageResult({
+                    provider: prepared.candidate.agent.provider,
+                    modelId: prepared.candidate.agent.model,
+                    message: detail,
+                });
+            const tokenUsage = resolveTokenUsage(tokenUsageResult);
+            await writeFailureRubricArtifact({
+                root,
+                artifactPath,
+                verifierId: prepared.candidate.agent.id,
+                template: prepared.candidate.template.template,
+                generatedAt: completedAt,
+                error: detail,
+            });
+            await mutators.recordMethodSnapshot({
+                method: "rubric",
+                template: prepared.candidate.template.template,
+                verifierId: prepared.candidate.agent.id,
+                scope: resolvedTarget.target.kind === "run"
+                    ? { kind: "run" }
+                    : { kind: "target" },
+                status: "failed",
+                artifactPath,
+                startedAt,
+                completedAt,
+                tokenUsage,
+                error: detail,
+            });
+            emitStageProgressEvent(renderer, {
+                type: "stage.candidate",
+                stage: "verify",
+                candidate: {
+                    methodKey: `rubric:${prepared.candidate.template.template}:${prepared.candidate.agent.id}`,
+                    verifierLabel: prepared.candidate.template.template,
+                    agentLabel: prepared.candidate.agent.id,
+                    status: "failed",
+                    startedAt,
+                    completedAt,
+                    artifactPath,
+                    tokenUsage,
+                    tokenUsageResult,
+                },
+            });
+            startedAtByExecutionKey.delete(executionKey);
+            tokenUsageResultByExecutionKey.delete(executionKey);
+            return {
+                template: prepared.candidate.template.template,
+                verifierId: prepared.candidate.agent.id,
+                status: "failed",
+                artifactPath,
+                startedAt,
+                completedAt,
+                error: detail,
+                tokenUsage,
+                tokenUsageResult,
+            };
+        },
+        sortResults: compareVerificationsByTemplateThenVerifierId,
+    };
+}
+async function writeFailureRubricArtifact(options) {
+    const { root, artifactPath, verifierId, template, generatedAt, error } = options;
+    await writeVerificationArtifact({
+        root,
+        artifactPath,
+        artifact: {
+            method: "rubric",
+            template,
+            verifierId,
+            generatedAt,
+            status: "failed",
+            result: {},
+            error,
+        },
+    });
+}
+function buildVerifierRubricWorkspacePaths(options) {
+    const { root, verificationId, verifierId, template } = options;
+    return buildScopedAgentWorkspacePaths({
+        agentRoot: resolve(root, getVerificationRubricExecutionDirectoryPath({
+            sessionId: verificationId,
+            verifierId,
+            template,
+        })),
+    });
+}
+function compareVerificationsByTemplateThenVerifierId(left, right) {
+    return (left.template.localeCompare(right.template) ||
+        left.verifierId.localeCompare(right.verifierId));
+}
+function registerScratchWorkspaceTeardown(teardown, workspacePaths, verifierId, template) {
+    const labelPrefix = `${verifierId}/${template}`;
+    teardown.addPath(workspacePaths.workspacePath, `${labelPrefix} workspace`);
+    teardown.addPath(workspacePaths.contextPath, `${labelPrefix} context`);
+    teardown.addPath(workspacePaths.runtimePath, `${labelPrefix} runtime`);
+    teardown.addPath(workspacePaths.sandboxPath, `${labelPrefix} sandbox`);
+}

package/dist/domain/verify/competition/artifacts.d.ts

@@ -0,0 +1,6 @@
+import type { VerificationResultArtifact } from "../model/types.js";
+export declare function writeVerificationArtifact(options: {
+    root: string;
+    artifactPath: string;
+    artifact: VerificationResultArtifact;
+}): Promise<void>;

package/dist/domain/verify/competition/artifacts.js

@@ -0,0 +1,7 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+export async function writeVerificationArtifact(options) {
+    const absolutePath = resolve(options.root, options.artifactPath);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, `${JSON.stringify(options.artifact, null, 2)}\n`, "utf8");
+}

package/dist/domain/verify/competition/blinding.d.ts

@@ -0,0 +1,24 @@
+import { parseRubricResultPayload, type RubricResultPayload } from "../rubric-result.js";
+import type { ResolvedVerificationTarget } from "./target.js";
+export declare function buildBlindedAliasMap(resolvedTarget: ResolvedVerificationTarget): Record<string, string> | undefined;
+export declare function aliasForCandidate(canonicalId: string, aliasMap?: Record<string, string>): string;
+export declare function assertRubricResultSelectorsMatchAliasMap(options: {
+    artifactPath: string;
+    result?: RubricResultPayload;
+    aliasMap?: Record<string, string>;
+}): void;
+export declare function buildForbiddenVerificationIdentityTokens(options: {
+    resolvedTarget: ResolvedVerificationTarget;
+    allowed?: readonly string[];
+}): string[];
+/**
+ * Build an overlap-safe allowlist: verifier self-identity tokens are only
+ * permitted when they are not also candidate-identity tokens under
+ * verification.
+ */
+export declare function overlapSafeAllowlist(allowed: readonly string[], candidateTokens: ReadonlySet<string>): Set<string>;
+export declare function assertNoVerificationIdentityLeak(options: {
+    text: string;
+    forbidden: readonly string[];
+}): void;
+export { parseRubricResultPayload };

package/dist/domain/verify/competition/blinding.js

@@ -0,0 +1,109 @@
+import { generateBlindedCandidateAlias } from "../blinding/aliases.js";
+import { parseRubricResultPayload, readRubricResultPreferred, readRubricResultRanking, } from "../rubric-result.js";
+export function buildBlindedAliasMap(resolvedTarget) {
+    const candidateIds = resolvedTarget.competitiveCandidates.map((candidate) => candidate.canonicalId);
+    if (candidateIds.length === 0) {
+        return undefined;
+    }
+    const aliasMap = {};
+    const seen = new Set();
+    for (const candidateId of [...new Set(candidateIds)].sort((a, b) => a.localeCompare(b))) {
+        const alias = generateBlindedCandidateAlias({ seen });
+        seen.add(alias);
+        aliasMap[alias] = candidateId;
+    }
+    return aliasMap;
+}
+export function aliasForCandidate(canonicalId, aliasMap) {
+    if (!aliasMap) {
+        return canonicalId;
+    }
+    const match = Object.entries(aliasMap).find(([, value]) => value === canonicalId);
+    return match?.[0] ?? canonicalId;
+}
+export function assertRubricResultSelectorsMatchAliasMap(options) {
+    const { artifactPath, result, aliasMap } = options;
+    if (!aliasMap || !result) {
+        return;
+    }
+    const unknownSelectors = new Set();
+    const preferred = readRubricResultPreferred(result);
+    if (preferred && !aliasMap[preferred]) {
+        unknownSelectors.add(preferred);
+    }
+    for (const selector of readRubricResultRanking(result) ?? []) {
+        if (!aliasMap[selector]) {
+            unknownSelectors.add(selector);
+        }
+    }
+    if (unknownSelectors.size === 0) {
+        return;
+    }
+    const selectors = Array.from(unknownSelectors)
+        .sort((left, right) => left.localeCompare(right))
+        .map((selector) => `\`${selector}\``)
+        .join(", ");
+    throw new Error(`Invalid verifier result.json for \`${artifactPath}\`: unknown blinded selector(s) ${selectors}.`);
+}
+export function buildForbiddenVerificationIdentityTokens(options) {
+    const { resolvedTarget, allowed = [] } = options;
+    // Collect all candidate identity tokens first so we can detect overlap
+    // with verifier self-identity tokens.
+    const candidateTokens = new Set();
+    for (const candidate of resolvedTarget.competitiveCandidates) {
+        for (const token of candidate.forbiddenIdentityTokens) {
+            const normalized = token.toLowerCase().trim();
+            if (normalized) {
+                candidateTokens.add(normalized);
+            }
+        }
+    }
+    // Only allowlist verifier self-identity tokens that do NOT overlap with
+    // candidate identity tokens. Overlapping tokens must stay forbidden so
+    // that a shared identity between verifier and candidate is still detected
+    // as a leakage vector.
+    const allowedTokens = overlapSafeAllowlist(allowed, candidateTokens);
+    const tokens = new Set();
+    for (const candidate of resolvedTarget.competitiveCandidates) {
+        for (const token of candidate.forbiddenIdentityTokens) {
+            const normalized = token.toLowerCase().trim();
+            if (!normalized || allowedTokens.has(normalized)) {
+                continue;
+            }
+            tokens.add(normalized);
+        }
+    }
+    return Array.from(tokens);
+}
+/**
+ * Build an overlap-safe allowlist: verifier self-identity tokens are only
+ * permitted when they are not also candidate-identity tokens under
+ * verification.
+ */
+export function overlapSafeAllowlist(allowed, candidateTokens) {
+    return new Set(allowed
+        .map((token) => token.toLowerCase().trim())
+        .filter((token) => token !== "" && !candidateTokens.has(token)));
+}
+export function assertNoVerificationIdentityLeak(options) {
+    const { text, forbidden } = options;
+    const haystack = text.toLowerCase();
+    const leaks = forbidden.filter((token) => containsBoundedToken(haystack, token));
+    if (leaks.length === 0) {
+        return;
+    }
+    const preview = leaks
+        .slice(0, 5)
+        .map((token) => `\`${token}\``)
+        .join(", ");
+    throw new Error(`Blinded verification leakage validation failed: forbidden candidate identity token(s) detected: ${preview}${leaks.length > 5 ? ", ..." : ""}.`);
+}
+function containsBoundedToken(text, token) {
+    if (!token) {
+        return false;
+    }
+    const escaped = token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const pattern = new RegExp(`(?<![a-z0-9_-])${escaped}(?![a-z0-9_-])`, "iu");
+    return pattern.test(text);
+}
+export { parseRubricResultPayload };

package/dist/domain/verify/competition/finalize.d.ts

@@ -0,0 +1,11 @@
+import type { VerificationMethodResultRef, VerificationStatus } from "../model/types.js";
+import type { ResolvedVerificationTarget } from "./target.js";
+export declare function deriveVerificationStatusFromMethods(methods: readonly VerificationMethodResultRef[]): VerificationStatus;
+export declare function maybePersistSelectedSpecPath(options: {
+    root: string;
+    verificationsFilePath: string;
+    verificationId: string;
+    resolvedTarget: ResolvedVerificationTarget;
+    aliasMap?: Record<string, string>;
+    methods: readonly VerificationMethodResultRef[];
+}): Promise<void>;

package/dist/domain/verify/competition/finalize.js

@@ -0,0 +1,65 @@
+import { loadVerificationSelectionPolicyOutput } from "../../../policy/index.js";
+import { rewriteVerificationRecord } from "../persistence/adapter.js";
+export function deriveVerificationStatusFromMethods(methods) {
+    if (methods.some((method) => method.status === "failed")) {
+        return "failed";
+    }
+    if (methods.some((method) => method.status === "aborted")) {
+        return "aborted";
+    }
+    return "succeeded";
+}
+export async function maybePersistSelectedSpecPath(options) {
+    const { root, verificationsFilePath, verificationId, resolvedTarget, aliasMap, methods, } = options;
+    if (!("specRecord" in resolvedTarget)) {
+        return;
+    }
+    const record = await loadVerificationSelectionPolicyOutput({
+        root,
+        record: {
+            sessionId: verificationId,
+            createdAt: new Date(0).toISOString(),
+            status: "succeeded",
+            target: resolvedTarget.target,
+            methods: [...methods],
+            ...(resolvedTarget.specRecord.extraContext
+                ? { extraContext: resolvedTarget.specRecord.extraContext }
+                : {}),
+            ...(resolvedTarget.specRecord.extraContextMetadata
+                ? {
+                    extraContextMetadata: resolvedTarget.specRecord.extraContextMetadata,
+                }
+                : {}),
+            ...(aliasMap ? { blinded: { enabled: true, aliasMap } } : {}),
+        },
+        canonicalCandidateIds: resolvedTarget.specRecord.agents.map((agent) => agent.agentId),
+    });
+    const decision = record.decision;
+    if (decision.state !== "resolvable") {
+        return;
+    }
+    const selected = resolvedTarget.specRecord.agents.find((agent) => agent.status === "succeeded" &&
+        agent.agentId === decision.selectedCanonicalAgentId &&
+        agent.outputPath);
+    if (!selected?.outputPath) {
+        return;
+    }
+    await rewriteVerificationRecord({
+        root,
+        verificationsFilePath,
+        sessionId: verificationId,
+        mutate: (existing) => {
+            if (existing.target.kind !== "spec") {
+                return existing;
+            }
+            return {
+                ...existing,
+                target: {
+                    ...existing.target,
+                    specPath: selected.outputPath,
+                },
+            };
+        },
+        forceFlush: true,
+    });
+}