Next Clinic — API

export API="https://api.skillsafe.ai/v1/app-api"
export TOKEN="YOUR_TOKEN"      # see step 1

# every call looks like:
#   curl -s "$API/..." -H "Authorization: Bearer $TOKEN" [-d '{json}']
# jq is used below to pull fields out of the {"data": ...} envelope

import json, requests

API = "https://api.skillsafe.ai/v1/app-api"
TOKEN = "YOUR_TOKEN"  # see step 1 — read it from your shell environment in real code

def api(method, path, body=None, **headers):
    res = requests.request(method, API + path, json=body,
                           headers={"Authorization": f"Bearer {TOKEN}", **headers})
    payload = res.json()
    if not res.ok:
        raise RuntimeError(payload.get("error", {}).get("message", res.reason))
    return payload["data"]

// Node 18+ (built-in fetch)
const API = "https://api.skillsafe.ai/v1/app-api";
const TOKEN = "YOUR_TOKEN"; // see step 1 — read it from your shell environment in real code

async function api(method, path, body, extraHeaders = {}) {
  const res = await fetch(API + path, {
    method,
    headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", ...extraHeaders },
    body: body === undefined ? undefined : JSON.stringify(body),
  });
  const json = await res.json();
  if (!res.ok) throw new Error(json.error?.message ?? res.statusText);
  return json.data;
}

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

const API = "https://api.skillsafe.ai/v1/app-api"

var token = os.Getenv("SKILLSAFE_TOKEN") // see step 1

func call(method, path string, body, out any) error {
	var buf bytes.Buffer
	if body != nil {
		json.NewEncoder(&buf).Encode(body)
	}
	req, _ := http.NewRequest(method, API+path, &buf)
	req.Header.Set("Authorization", "Bearer "+token)
	req.Header.Set("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return err
	}
	defer res.Body.Close()
	var env struct {
		Data  json.RawMessage `json:"data"`
		Error *struct{ Message string `json:"message"` } `json:"error"`
	}
	json.NewDecoder(res.Body).Decode(&env)
	if res.StatusCode >= 400 {
		return fmt.Errorf("api %s %s: %s", method, path, env.Error.Message)
	}
	if out == nil {
		return nil
	}
	return json.Unmarshal(env.Data, out)
}

// Java 17+, no dependencies. Pair with your JSON library (Jackson, Gson…)
// to read fields out of the returned envelope.
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class SkillSafe {
    static final String API = "https://api.skillsafe.ai/v1/app-api";
    static final String TOKEN = System.getenv("SKILLSAFE_TOKEN"); // see step 1
    static final HttpClient HTTP = HttpClient.newHttpClient();

    static String api(String method, String path, String jsonBody) throws Exception {
        var req = HttpRequest.newBuilder(URI.create(API + path))
            .header("Authorization", "Bearer " + TOKEN)
            .header("Content-Type", "application/json")
            .method(method, jsonBody == null
                ? HttpRequest.BodyPublishers.noBody()
                : HttpRequest.BodyPublishers.ofString(jsonBody))
            .build();
        var res = HTTP.send(req, HttpResponse.BodyHandlers.ofString());
        if (res.statusCode() >= 400) throw new RuntimeException(res.body());
        return res.body(); // envelope: {"data": …}
    }
}

require "net/http"
require "json"

API = "https://api.skillsafe.ai/v1/app-api"
TOKEN = ENV.fetch("SKILLSAFE_TOKEN") # see step 1

def api(method, path, body = nil)
  uri = URI(API + path)
  req = Net::HTTP.const_get(method.capitalize).new(uri)
  req["Authorization"] = "Bearer #{TOKEN}"
  req["Content-Type"] = "application/json"
  req.body = body.to_json if body
  res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
  payload = JSON.parse(res.body)
  raise (payload.dig("error", "message") || res.message) unless res.is_a?(Net::HTTPSuccess)
  payload["data"]
end

<?php
const API = "https://api.skillsafe.ai/v1/app-api";
$TOKEN = getenv("SKILLSAFE_TOKEN"); // see step 1

function api(string $method, string $path, ?array $body = null): mixed {
    global $TOKEN;
    $ch = curl_init(API . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            "Authorization: Bearer $TOKEN",
            "Content-Type: application/json",
        ],
        CURLOPT_POSTFIELDS     => $body === null ? null : json_encode($body),
    ]);
    $payload = json_decode(curl_exec($ch), true);
    $status  = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);
    if ($status >= 400) {
        throw new Exception($payload["error"]["message"] ?? "HTTP $status");
    }
    return $payload["data"];
}

// .NET 8+
using System.Net.Http.Json;
using System.Text.Json;

static class SkillSafe
{
    const string Api = "https://api.skillsafe.ai/v1/app-api";
    static readonly HttpClient Http = new();

    static SkillSafe() =>
        Http.DefaultRequestHeaders.Authorization =
            new("Bearer", Environment.GetEnvironmentVariable("SKILLSAFE_TOKEN")); // see step 1

    public static async Task<JsonElement> ApiAsync(HttpMethod method, string path, object? body = null)
    {
        var req = new HttpRequestMessage(method, Api + path);
        if (body != null) req.Content = JsonContent.Create(body);
        var res = await Http.SendAsync(req);
        var json = await res.Content.ReadFromJsonAsync<JsonElement>();
        if (!res.IsSuccessStatusCode)
            throw new Exception(json.GetProperty("error").GetProperty("message").GetString());
        return json.GetProperty("data");
    }
}

curl -s -X POST "$API/guest" \
  -H "Content-Type: application/json" \
  -d '{"slug":"next-clinic"}' | jq -r '.data.token'

token = api("POST", "/guest", {"slug": "next-clinic"})["token"]

const { token } = await api("POST", "/guest", { slug: "next-clinic" });

var guest struct{ Token string `json:"token"` }
err := call("POST", "/guest", map[string]string{"slug": "next-clinic"}, &guest)

String envelope = api("POST", "/guest", """
    {"slug":"next-clinic"}""");
// token is at data.token in the returned JSON

token = api("POST", "/guest", { slug: "next-clinic" })["token"]

$token = api("POST", "/guest", ["slug" => "next-clinic"])["token"];

var guest = await SkillSafe.ApiAsync(HttpMethod.Post, "/guest",
    new { slug = "next-clinic" });
var token = guest.GetProperty("token").GetString();

curl -s "$API/me" -H "Authorization: Bearer $TOKEN" | jq '.data'

me = api("GET", "/me")
print(me["subject_type"], me["credits"])

const me = await api("GET", "/me");
console.log(me.subject_type, me.credits);

var me struct {
	SubjectType string `json:"subject_type"`
	Credits     int64  `json:"credits"`
}
err := call("GET", "/me", nil, &me)

String envelope = api("GET", "/me", null);
// data.subject_type, data.credits

me = api("GET", "/me")
puts "#{me["subject_type"]}: #{me["credits"]} credits"

$me = api("GET", "/me");
echo "{$me['subject_type']}: {$me['credits']} credits\n";

var me = await SkillSafe.ApiAsync(HttpMethod.Get, "/me");
Console.WriteLine($"{me.GetProperty("subject_type")}: {me.GetProperty("credits")} credits");

cat > sources.txt <<'FILES'
// file: next.config.ts
import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  swcMinify: true,
  webpack(config) {
    config.module.rules.push({ test: /\.svg$/, use: ["@svgr/webpack"] });
    return config;
  },
};
export default nextConfig;

// file: package.json
{
  "scripts": {
    "dev": "rm -rf .next && next dev --webpack",
    "build": "next build"
  },
  "dependencies": { "next": "16.0.1", "react": "19.0.0" }
}
FILES

jq -n --rawfile sources sources.txt \
  '{sources: $sources,
    next_version: "16",
    concern: "migration",
    context: "pnpm monorepo, deploys to Vercel; next dev takes about 14s to first paint.",
    prescan_facts: {resources: [], flags: []}}' > input.json

curl -s -X POST "$API/estimate" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d @input.json | jq '.data.hold_credits'

SOURCES = r"""// file: next.config.ts
import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  swcMinify: true,
  webpack(config) {
    config.module.rules.push({ test: /\.svg$/, use: ["@svgr/webpack"] });
    return config;
  },
};
export default nextConfig;

// file: package.json
{
  "scripts": {
    "dev": "rm -rf .next && next dev --webpack",
    "build": "next build"
  },
  "dependencies": { "next": "16.0.1", "react": "19.0.0" }
}
"""

payload = {
    "sources": SOURCES,
    "next_version": "16",
    "concern": "migration",
    "context": "pnpm monorepo, deploys to Vercel; next dev takes about 14s to first paint.",
    "prescan_facts": {"resources": [], "flags": []},
}

est = api("POST", "/estimate", payload)
print("worst case:", est.get("hold_credits", est.get("credits")), "credits")

// String.raw keeps the backslash in the SVG rule's regex intact
const sources = String.raw`// file: next.config.ts
import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  swcMinify: true,
  webpack(config) {
    config.module.rules.push({ test: /\.svg$/, use: ["@svgr/webpack"] });
    return config;
  },
};
export default nextConfig;

// file: package.json
{
  "scripts": {
    "dev": "rm -rf .next && next dev --webpack",
    "build": "next build"
  },
  "dependencies": { "next": "16.0.1", "react": "19.0.0" }
}
`;

const payload = {
  sources,
  next_version: "16",
  concern: "migration",
  context: "pnpm monorepo, deploys to Vercel; next dev takes about 14s to first paint.",
  prescan_facts: { resources: [], flags: [] },
};

const est = await api("POST", "/estimate", payload);
console.log("worst case:", est.hold_credits ?? est.credits, "credits");

const sources = `// file: next.config.ts
import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  swcMinify: true,
  webpack(config) {
    config.module.rules.push({ test: /\.svg$/, use: ["@svgr/webpack"] });
    return config;
  },
};
export default nextConfig;

// file: package.json
{
  "scripts": {
    "dev": "rm -rf .next && next dev --webpack",
    "build": "next build"
  },
  "dependencies": { "next": "16.0.1", "react": "19.0.0" }
}
`

payload := map[string]any{
	"sources":      sources,
	"next_version": "16",
	"concern":      "migration",
	"context":      "pnpm monorepo, deploys to Vercel; next dev takes about 14s to first paint.",
	"prescan_facts": map[string]any{
		"resources": []any{}, "flags": []any{},
	},
}

var est struct{ HoldCredits int64 `json:"hold_credits"` }
err := call("POST", "/estimate", payload, &est)

// In a text block \\. produces the single backslash the regex needs.
String sources = """
    // file: next.config.ts
    import type { NextConfig } from "next";

    const nextConfig: NextConfig = {
      swcMinify: true,
      webpack(config) {
        config.module.rules.push({ test: /\\.svg$/, use: ["@svgr/webpack"] });
        return config;
      },
    };
    export default nextConfig;

    // file: package.json
    {
      "scripts": {
        "dev": "rm -rf .next && next dev --webpack",
        "build": "next build"
      },
      "dependencies": { "next": "16.0.1", "react": "19.0.0" }
    }
    """;

String jsonPayload = """
    {"sources": %s,
     "next_version": "16",
     "concern": "migration",
     "context": "pnpm monorepo, deploys to Vercel; next dev takes about 14s to first paint.",
     "prescan_facts": {"resources": [], "flags": []}}
    """.formatted(toJsonString(sources));

String envelope = api("POST", "/estimate", jsonPayload);
// worst-case cost is at data.hold_credits

# the single-quoted heredoc keeps \. literal
SOURCES = <<~'FILES'
  // file: next.config.ts
  import type { NextConfig } from "next";

  const nextConfig: NextConfig = {
    swcMinify: true,
    webpack(config) {
      config.module.rules.push({ test: /\.svg$/, use: ["@svgr/webpack"] });
      return config;
    },
  };
  export default nextConfig;

  // file: package.json
  {
    "scripts": {
      "dev": "rm -rf .next && next dev --webpack",
      "build": "next build"
    },
    "dependencies": { "next": "16.0.1", "react": "19.0.0" }
  }
FILES

payload = { sources: SOURCES,
            next_version: "16",
            concern: "migration",
            context: "pnpm monorepo, deploys to Vercel; next dev takes about 14s to first paint.",
            prescan_facts: { resources: [], flags: [] } }

est = api("POST", "/estimate", payload)
puts "worst case: #{est["hold_credits"] || est["credits"]} credits"

$sources = <<<'FILES'
// file: next.config.ts
import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  swcMinify: true,
  webpack(config) {
    config.module.rules.push({ test: /\.svg$/, use: ["@svgr/webpack"] });
    return config;
  },
};
export default nextConfig;

// file: package.json
{
  "scripts": {
    "dev": "rm -rf .next && next dev --webpack",
    "build": "next build"
  },
  "dependencies": { "next": "16.0.1", "react": "19.0.0" }
}
FILES;

$payload = [
    "sources"       => $sources,
    "next_version"  => "16",
    "concern"       => "migration",
    "context"       => "pnpm monorepo, deploys to Vercel; next dev takes about 14s to first paint.",
    "prescan_facts" => ["resources" => [], "flags" => []],
];

$est = api("POST", "/estimate", $payload);
echo "worst case: " . ($est["hold_credits"] ?? $est["credits"]) . " credits\n";

// a raw string literal keeps the backslash in /\.svg$/ as written
var sources = """
    // file: next.config.ts
    import type { NextConfig } from "next";

    const nextConfig: NextConfig = {
      swcMinify: true,
      webpack(config) {
        config.module.rules.push({ test: /\.svg$/, use: ["@svgr/webpack"] });
        return config;
      },
    };
    export default nextConfig;

    // file: package.json
    {
      "scripts": {
        "dev": "rm -rf .next && next dev --webpack",
        "build": "next build"
      },
      "dependencies": { "next": "16.0.1", "react": "19.0.0" }
    }
    """;

var payload = new {
    sources,
    next_version = "16",
    concern = "migration",
    context = "pnpm monorepo, deploys to Vercel; next dev takes about 14s to first paint.",
    prescan_facts = new {
        resources = Array.Empty<object>(), flags = Array.Empty<object>(),
    },
};

var est = await SkillSafe.ApiAsync(HttpMethod.Post, "/estimate", payload);
Console.WriteLine($"worst case: {est.GetProperty("hold_credits")} credits");

JOB_ID=$(curl -s -X POST "$API/run" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Idempotency-Key: nc-$(date +%s)" \
  -d @input.json | jq -r '.data.job_id')

while :; do
  JOB=$(curl -s "$API/jobs/$JOB_ID" -H "Authorization: Bearer $TOKEN")
  STATUS=$(echo "$JOB" | jq -r '.data.status')
  [ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ] && break
  sleep 2
done

# unwrap the review once, then read it
echo "$JOB" | jq -r '.data.output.output' > review.json

jq -r '
  "\(.review_name) [\(.posture)]: \(.verdict)",
  "",
  "INVENTORY",
  (.inventory[] | "  \(.kind)/\(.name) in \(.scope) - \(.role)"),
  "",
  "FINDINGS",
  (.findings[] | "  [\(.priority)] \(.id) \(.category) \(.resource): \(.problem)"),
  "",
  "PLAN",
  (.migration_steps[] | "  \(.step) - \(.action) [\(.command)]"),
  "",
  "QUICK WINS",
  (.quick_wins[] | "  - \(.)"),
  "",
  "FOCUS AREAS",
  (.focus_areas[] | "  \(.area) - \(.why)"),
  "",
  "COVERAGE",
  (.coverage_check[] | "  \(.id): \(if .addressed then "ok" else "SET ASIDE" end) - \(.note)")' \
  review.json

# fail the pipeline on anything critical
jq -e '[.findings[] | select(.priority == "critical")] | length == 0' review.json > /dev/null \
  || { echo "critical findings present"; exit 1; }

import time

job_id = api("POST", "/run", payload,
             **{"Idempotency-Key": "nc-001"})["job_id"]

while True:
    job = api("GET", f"/jobs/{job_id}")
    if job["status"] in ("succeeded", "failed"):
        break
    time.sleep(1.5)

if job["status"] == "failed":
    raise RuntimeError(job.get("error", "run failed"))

raw = job["output"]
if isinstance(raw, dict) and "output" in raw:
    raw = raw["output"]
review = json.loads(raw) if isinstance(raw, str) else raw

print(f'{review["review_name"]} [{review["posture"]}]: {review["verdict"]}')
for r in review["inventory"]:
    print(f'  {r["kind"]}/{r["name"]:<24} in={r["scope"] or "-":<20} {r["role"]}')
for f in review["findings"]:
    print(f'  [{f["priority"]:>8}] {f["id"]} {f["category"]} {f["resource"]}')
    print(f'      L:{f["likelihood"]}/S:{f["severity"]} {f["problem"]}')
    print(f'      fix: {f["fix"]}')
    if f["snippet"]:
        print("      snippet:", f["snippet"].splitlines()[0], "...")
for i, s in enumerate(review["migration_steps"], 1):
    print(f'  {i}. {s["step"]} - {s["action"]}')
    if s["command"]:
        print(f'     $ {s["command"]}')
for w in review["quick_wins"]:
    print("  win:", w)
for a in review["focus_areas"]:
    print(f'  focus {a["area"]} {a["finding_ids"]} - {a["why"]}')
for c in review["coverage_check"]:
    print(f'  {c["id"]}: {"ok" if c["addressed"] else "SET ASIDE"} - {c["note"]}')

with open("review.json", "w", encoding="utf-8") as fh:
    json.dump(review, fh, indent=2)

critical = [f for f in review["findings"] if f["priority"] == "critical"]
if critical:
    raise SystemExit(f"{len(critical)} critical finding(s)")

import { writeFileSync } from "node:fs";

const { job_id } = await api("POST", "/run", payload,
  { "Idempotency-Key": crypto.randomUUID() });

let job;
do {
  await new Promise((r) => setTimeout(r, 1500));
  job = await api("GET", `/jobs/${job_id}`);
} while (job.status !== "succeeded" && job.status !== "failed");

if (job.status === "failed") throw new Error(job.error ?? "run failed");

const raw = job.output?.output ?? job.output;
const review = typeof raw === "string" ? JSON.parse(raw) : raw;

console.log(`${review.review_name} [${review.posture}]: ${review.verdict}`);
for (const r of review.inventory) {
  console.log(`  ${r.kind}/${r.name} (${r.scope || "-"}): ${r.role}`);
}
for (const f of review.findings) {
  console.log(`  [${f.priority}] ${f.id} ${f.category} ${f.resource}`);
  console.log(`      L:${f.likelihood}/S:${f.severity} - ${f.fix}`);
}
review.migration_steps.forEach((s, i) => {
  console.log(`  ${i + 1}. ${s.step} - ${s.action}${s.command ? `\n     $ ${s.command}` : ""}`);
});
for (const w of review.quick_wins) console.log(`  win: ${w}`);
for (const a of review.focus_areas) {
  console.log(`  focus ${a.area} (${a.finding_ids.join(", ")}): ${a.why}`);
}
for (const c of review.coverage_check) {
  console.log(`  ${c.id}: ${c.addressed ? "ok" : "SET ASIDE"} - ${c.note}`);
}

writeFileSync("review.json", JSON.stringify(review, null, 2));

const critical = review.findings.filter((f) => f.priority === "critical");
if (critical.length) process.exitCode = 1;

var started struct{ JobID string `json:"job_id"` }
if err := call("POST", "/run", payload, &started); err != nil {
	log.Fatal(err)
}

var job struct {
	Status string          `json:"status"`
	Error  string          `json:"error"`
	Output json.RawMessage `json:"output"`
}
for {
	if err := call("GET", "/jobs/"+started.JobID, nil, &job); err != nil {
		log.Fatal(err)
	}
	if job.Status == "succeeded" || job.Status == "failed" {
		break
	}
	time.Sleep(1500 * time.Millisecond)
}

// job.Output is {"output": "<json string>"} — unwrap, then unmarshal:
type Review struct {
	ReviewName  string `json:"review_name"`
	Posture     string `json:"posture"`
	Verdict     string `json:"verdict"`
	ExecSummary string `json:"exec_summary"`
	Assumptions   []string `json:"assumptions"`
	OpenQuestions []string `json:"open_questions"`
	Inventory []struct {
		Kind, Name, Scope, Role string
	} `json:"inventory"`
	Findings []struct {
		ID, Category, Severity, Likelihood, Priority string
		Resource, Problem, Impact, Fix, Snippet      string
	} `json:"findings"`
	MigrationSteps []struct {
		Step, Action, Why, Command string
	} `json:"migration_steps"`
	CoverageCheck []struct {
		ID, Note  string
		Addressed bool
	} `json:"coverage_check"`
	QuickWins  []string `json:"quick_wins"`
	FocusAreas []struct {
		Area, Why  string
		FindingIDs []string `json:"finding_ids"`
	} `json:"focus_areas"`
	Summary string `json:"summary"`
}
var wrapper struct{ Output string `json:"output"` }
json.Unmarshal(job.Output, &wrapper)
var review Review
json.Unmarshal([]byte(wrapper.Output), &review)

fmt.Printf("%s [%s]: %s\n", review.ReviewName, review.Posture, review.Verdict)
for _, r := range review.Inventory {
	fmt.Printf("  %s/%s (%s): %s\n", r.Kind, r.Name, r.Scope, r.Role)
}
for _, f := range review.Findings {
	fmt.Printf("  [%s] %s %s %s: %s\n", f.Priority, f.ID, f.Category, f.Resource, f.Problem)
}
for i, s := range review.MigrationSteps {
	fmt.Printf("  %d. %s - %s [%s]\n", i+1, s.Step, s.Action, s.Command)
}
for _, a := range review.FocusAreas {
	fmt.Printf("  focus %s %v: %s\n", a.Area, a.FindingIDs, a.Why)
}
os.WriteFile("review.json", []byte(wrapper.Output), 0o644)

String envelope = api("POST", "/run", jsonPayload);
String jobId = /* data.job_id via your JSON library */;

while (true) {
    String job = api("GET", "/jobs/" + jobId, null);
    String status = /* data.status */;
    if (status.equals("succeeded") || status.equals("failed")) break;
    Thread.sleep(1500);
}
// The review is at data.output.output as a JSON string — parse it again, then read
// review_name, posture, verdict, exec_summary, assumptions[], open_questions[],
// inventory[] (kind/name/scope/role),
// findings[] (id/category/severity/likelihood/priority/resource/problem/impact/fix/snippet),
// migration_steps[] (step/action/why/command), coverage_check[] (id/addressed/note),
// quick_wins[], focus_areas[] (area/why/finding_ids[]) and summary.
// Finally keep the review on disk:
//   Files.writeString(Path.of("review.json"), reviewJson);

started = api("POST", "/run", payload)

job = nil
loop do
  job = api("GET", "/jobs/#{started["job_id"]}")
  break if %w[succeeded failed].include?(job["status"])
  sleep 1.5
end
raise (job["error"] || "run failed") if job["status"] == "failed"

raw = job["output"].is_a?(Hash) ? job["output"].fetch("output", job["output"]) : job["output"]
review = raw.is_a?(String) ? JSON.parse(raw) : raw

puts "#{review["review_name"]} [#{review["posture"]}]: #{review["verdict"]}"
review["inventory"].each { |r| puts "  #{r["kind"]}/#{r["name"]} (#{r["scope"]}): #{r["role"]}" }
review["findings"].each do |f|
  puts "  [#{f["priority"]}] #{f["id"]} #{f["category"]} #{f["resource"]}"
  puts "      L:#{f["likelihood"]}/S:#{f["severity"]} - #{f["fix"]}"
end
review["migration_steps"].each_with_index do |s, i|
  puts "  #{i + 1}. #{s["step"]} - #{s["action"]}"
  puts "     $ #{s["command"]}" unless s["command"].to_s.empty?
end
review["quick_wins"].each { |w| puts "  win: #{w}" }
review["focus_areas"].each { |a| puts "  focus #{a["area"]} #{a["finding_ids"].join(", ")}" }
review["coverage_check"].each { |c| puts "  #{c["id"]}: #{c["addressed"] ? "ok" : "SET ASIDE"}" }

File.write("review.json", JSON.pretty_generate(review))
exit 1 if review["findings"].any? { |f| f["priority"] == "critical" }

$started = api("POST", "/run", $payload);

do {
    sleep(2);
    $job = api("GET", "/jobs/" . $started["job_id"]);
} while (!in_array($job["status"], ["succeeded", "failed"]));

if ($job["status"] === "failed") {
    throw new Exception($job["error"] ?? "run failed");
}

$raw = is_array($job["output"]) ? ($job["output"]["output"] ?? $job["output"]) : $job["output"];
$review = is_string($raw) ? json_decode($raw, true) : $raw;

echo "{$review['review_name']} [{$review['posture']}]: {$review['verdict']}\n";
foreach ($review["inventory"] as $r) {
    echo "  {$r['kind']}/{$r['name']} ({$r['scope']}): {$r['role']}\n";
}
foreach ($review["findings"] as $f) {
    echo "  [{$f['priority']}] {$f['id']} {$f['category']} {$f['resource']}\n";
    echo "      L:{$f['likelihood']}/S:{$f['severity']} - {$f['fix']}\n";
}
foreach ($review["migration_steps"] as $i => $s) {
    echo "  " . ($i + 1) . ". {$s['step']} - {$s['action']}\n";
    if ($s["command"] !== "") { echo "     $ {$s['command']}\n"; }
}
foreach ($review["quick_wins"] as $w) {
    echo "  win: $w\n";
}
foreach ($review["focus_areas"] as $a) {
    echo "  focus {$a['area']}: " . implode(", ", $a["finding_ids"]) . "\n";
}
foreach ($review["coverage_check"] as $c) {
    echo "  {$c['id']}: " . ($c["addressed"] ? "ok" : "SET ASIDE") . "\n";
}

file_put_contents("review.json", json_encode($review, JSON_PRETTY_PRINT));

var started = await SkillSafe.ApiAsync(HttpMethod.Post, "/run", payload);
var jobId = started.GetProperty("job_id").GetString();

JsonElement job;
while (true)
{
    job = await SkillSafe.ApiAsync(HttpMethod.Get, $"/jobs/{jobId}");
    var status = job.GetProperty("status").GetString();
    if (status is "succeeded" or "failed") break;
    await Task.Delay(1500);
}

var rawText = job.GetProperty("output").GetProperty("output").GetString();
using var doc = JsonDocument.Parse(rawText!);
var review = doc.RootElement;

Console.WriteLine($"{review.GetProperty("review_name")} " +
                  $"[{review.GetProperty("posture")}]: {review.GetProperty("verdict")}");
foreach (var r in review.GetProperty("inventory").EnumerateArray())
{
    Console.WriteLine($"  {r.GetProperty("kind")}/{r.GetProperty("name")}: {r.GetProperty("role")}");
}
foreach (var f in review.GetProperty("findings").EnumerateArray())
{
    Console.WriteLine($"  [{f.GetProperty("priority")}] {f.GetProperty("id")} " +
                      $"{f.GetProperty("category")} {f.GetProperty("resource")} " +
                      $"(L:{f.GetProperty("likelihood")}/S:{f.GetProperty("severity")})");
}
foreach (var s in review.GetProperty("migration_steps").EnumerateArray())
{
    Console.WriteLine($"  {s.GetProperty("step")}: {s.GetProperty("action")} " +
                      $"[{s.GetProperty("command")}]");
}
foreach (var a in review.GetProperty("focus_areas").EnumerateArray())
{
    Console.WriteLine($"  focus {a.GetProperty("area")}: {a.GetProperty("why")}");
}

await File.WriteAllTextAsync("review.json", rawText!);

# -N disables buffering so events print as they arrive
curl -N -s -X POST "$API/run-stream" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Idempotency-Key: nc-$(date +%s)" \
  -d @input.json

# event: job
# data: {"job_id":"job_...","status":"running"}
#
# event: delta
# data: {"text":"{\"review_name\":\"store"}
# ...
# event: done
# data: {"job_id":"job_...","status":"succeeded","charged_credits":648,"output":{"output":"{...}"}}

import json, requests

result = None
with requests.post(
    API + "/run-stream",
    headers={"Authorization": f"Bearer {TOKEN}",
             "Idempotency-Key": "nc-001"},
    json=payload,
    stream=True,
) as r:
    r.raise_for_status()
    event = None
    for line in r.iter_lines(decode_unicode=True):
        if not line:
            continue
        if line.startswith("event:"):
            event = line[len("event:"):].strip()
        elif line.startswith("data:"):
            data = json.loads(line[len("data:"):].strip())
            if event == "delta":
                print(".", end="", flush=True)          # live progress
            elif event == "done":
                result = data
            elif event == "error":
                raise RuntimeError(data.get("message", "run failed"))

review = json.loads(result["output"]["output"])          # authoritative
print("charged:", result["charged_credits"], "-", review["review_name"])
print("posture:", review["posture"])
for f in review["findings"]:
    print(f'  [{f["priority"]}] {f["id"]} {f["resource"]}: {f["problem"]}')
with open("review.json", "w", encoding="utf-8") as fh:
    json.dump(review, fh, indent=2)

const res = await fetch(API + "/run-stream", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${TOKEN}`,
    "Content-Type": "application/json",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: JSON.stringify(payload),
});

const reader = res.body.getReader();
const decoder = new TextDecoder();
let buf = "", done = null;

for (;;) {
  const chunk = await reader.read();
  if (chunk.done) break;
  buf += decoder.decode(chunk.value, { stream: true });
  const frames = buf.split("\n\n");
  buf = frames.pop();
  for (const frame of frames) {
    const name = /^event:\s*(.+)$/m.exec(frame)?.[1];
    const body = /^data:\s*(.+)$/m.exec(frame)?.[1];
    if (!name || !body) continue;
    const data = JSON.parse(body);
    if (name === "delta") process.stdout.write(".");   // live progress
    if (name === "done") done = data;
    if (name === "error") throw new Error(data.message ?? "run failed");
  }
}

const review = JSON.parse(done.output.output);
console.log(`\n${done.charged_credits} credits - ${review.review_name} [${review.posture}]`);
for (const f of review.findings) console.log(`  [${f.priority}] ${f.id} ${f.resource}`);
writeFileSync("review.json", JSON.stringify(review, null, 2));

body, _ := json.Marshal(payload)
req, _ := http.NewRequest("POST", API+"/run-stream", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Idempotency-Key", "nc-001")

res, err := http.DefaultClient.Do(req)
if err != nil {
	log.Fatal(err)
}
defer res.Body.Close()

var event string
var final map[string]any
sc := bufio.NewScanner(res.Body)
sc.Buffer(make([]byte, 0, 64*1024), 4*1024*1024)
for sc.Scan() {
	line := sc.Text()
	switch {
	case strings.HasPrefix(line, "event:"):
		event = strings.TrimSpace(strings.TrimPrefix(line, "event:"))
	case strings.HasPrefix(line, "data:"):
		var data map[string]any
		json.Unmarshal([]byte(strings.TrimPrefix(line, "data:")), &data)
		switch event {
		case "delta":
			fmt.Print(".") // live progress
		case "done":
			final = data
		case "error":
			log.Fatal(data["message"])
		}
	}
}
// final["output"].(map[string]any)["output"].(string) is the review JSON —
// unmarshal it into the Review struct from step 4, then write it to review.json.

// Java 17+ — read the stream line by line instead of buffering the body.
var req = HttpRequest.newBuilder(URI.create(API + "/run-stream"))
    .header("Authorization", "Bearer " + TOKEN)
    .header("Content-Type", "application/json")
    .header("Idempotency-Key", "nc-001")
    .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
    .build();

var res = HTTP.send(req, HttpResponse.BodyHandlers.ofLines());
String event = null, done = null;
for (String line : (Iterable<String>) res.body()::iterator) {
    if (line.startsWith("event:")) {
        event = line.substring(6).trim();
    } else if (line.startsWith("data:")) {
        String data = line.substring(5).trim();
        if ("delta".equals(event)) System.out.print(".");   // live progress
        else if ("done".equals(event)) done = data;
        else if ("error".equals(event)) throw new RuntimeException(data);
    }
}
// parse `done`, then parse data.output.output again — it is a JSON string holding
// review_name, posture, verdict, inventory[], findings[], migration_steps[],
// coverage_check[], quick_wins[], focus_areas[] and the rest.

require "net/http"
require "json"

uri = URI(API + "/run-stream")
req = Net::HTTP::Post.new(uri)
req["Authorization"] = "Bearer #{TOKEN}"
req["Content-Type"] = "application/json"
req["Idempotency-Key"] = "nc-001"
req.body = payload.to_json

event = nil
done = nil
Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
  http.request(req) do |res|
    res.read_body do |chunk|
      chunk.each_line do |line|
        line = line.strip
        if line.start_with?("event:")
          event = line.delete_prefix("event:").strip
        elsif line.start_with?("data:")
          data = JSON.parse(line.delete_prefix("data:").strip)
          case event
          when "delta" then print "."           # live progress
          when "done"  then done = data
          when "error" then raise (data["message"] || "run failed")
          end
        end
      end
    end
  end
end

review = JSON.parse(done["output"]["output"])
puts "\n#{done["charged_credits"]} credits - #{review["review_name"]} [#{review["posture"]}]"
review["findings"].each { |f| puts "  [#{f["priority"]}] #{f["id"]} #{f["resource"]}" }
File.write("review.json", JSON.pretty_generate(review))

$event = null;
$done  = null;

$ch = curl_init(API . "/run-stream");
curl_setopt_array($ch, [
    CURLOPT_POST       => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer $TOKEN",
        "Content-Type: application/json",
        "Idempotency-Key: nc-001",
    ],
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_WRITEFUNCTION => function ($ch, $chunk) use (&$event, &$done) {
        foreach (explode("\n", $chunk) as $line) {
            $line = trim($line);
            if (str_starts_with($line, "event:")) {
                $event = trim(substr($line, 6));
            } elseif (str_starts_with($line, "data:")) {
                $data = json_decode(trim(substr($line, 5)), true);
                if ($event === "delta") { echo "."; }        // live progress
                elseif ($event === "done") { $done = $data; }
                elseif ($event === "error") { throw new Exception($data["message"] ?? "run failed"); }
            }
        }
        return strlen($chunk);
    },
]);
curl_exec($ch);
curl_close($ch);

$review = json_decode($done["output"]["output"], true);
echo "\n{$done['charged_credits']} credits - {$review['review_name']} [{$review['posture']}]\n";
foreach ($review["findings"] as $f) {
    echo "  [{$f['priority']}] {$f['id']} {$f['resource']}\n";
}
file_put_contents("review.json", json_encode($review, JSON_PRETTY_PRINT));

var req = new HttpRequestMessage(HttpMethod.Post, Api + "/run-stream") {
    Content = JsonContent.Create(payload),
};
req.Headers.Add("Idempotency-Key", "nc-001");

using var res = await Http.SendAsync(req, HttpCompletionOption.ResponseHeadersRead);
using var reader = new StreamReader(await res.Content.ReadAsStreamAsync());

string? evt = null, done = null;
while (await reader.ReadLineAsync() is { } line)
{
    if (line.StartsWith("event:")) evt = line[6..].Trim();
    else if (line.StartsWith("data:"))
    {
        var data = line[5..].Trim();
        if (evt == "delta") Console.Write(".");            // live progress
        else if (evt == "done") done = data;
        else if (evt == "error") throw new Exception(data);
    }
}

using var final = JsonDocument.Parse(done!);
var text = final.RootElement.GetProperty("output").GetProperty("output").GetString();
using var reviewDoc = JsonDocument.Parse(text!);
var review = reviewDoc.RootElement;
Console.WriteLine($"{review.GetProperty("review_name")} [{review.GetProperty("posture")}]");
foreach (var f in review.GetProperty("findings").EnumerateArray())
    Console.WriteLine($"  [{f.GetProperty("priority")}] {f.GetProperty("id")} {f.GetProperty("resource")}");
await File.WriteAllTextAsync("review.json", text!);

# input.json is the payload built in step 3
KEY="nc-$(shasum -a 256 input.json | cut -c1-32)"   # same input, same key, no double charge

JOB_ID=$(curl -s -X POST "$API/run" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Idempotency-Key: $KEY" \
  -d @input.json | jq -r '.data.job_id')

while :; do
  JOB=$(curl -s "$API/jobs/$JOB_ID" -H "Authorization: Bearer $TOKEN")
  STATUS=$(echo "$JOB" | jq -r '.data.status')
  [ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ] && break
  sleep 2
done
[ "$STATUS" = "succeeded" ] || { echo "run failed"; exit 2; }

echo "$JOB" | jq -r '.data.output.output' > review.json

POSTURE=$(jq -r '.posture' review.json)
CRIT=$(jq '[.findings[] | select(.priority == "critical")] | length' review.json)
UNSEEN=$(jq -r '[.coverage_check[] | select(.addressed | not) | .id] | join(", ")' review.json)

echo "posture: $POSTURE   critical: $CRIT"
[ -n "$UNSEEN" ] && echo "set aside: $UNSEEN"
jq -r '.migration_steps[] | "next: \(.step) - \(.action)"' review.json | head -3

if [ "$POSTURE" = "migration-blocked" ] || [ "$CRIT" -gt 0 ]; then
  jq -r '"BLOCKED: \(.verdict)"' review.json
  exit 1
fi
[ "$POSTURE" = "tuning-recommended" ] && jq -r '"warning: \(.verdict)"' review.json
exit 0

import hashlib, json, sys, time

# The key is a hash of the payload itself: identical input replays, changed input re-runs.
canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
key = "nc-" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()[:32]

job_id = api("POST", "/run", payload, **{"Idempotency-Key": key})["job_id"]
while True:
    job = api("GET", f"/jobs/{job_id}")
    if job["status"] in ("succeeded", "failed"):
        break
    time.sleep(1.5)
if job["status"] != "succeeded":
    sys.exit(2)

raw = job["output"]
if isinstance(raw, dict) and "output" in raw:
    raw = raw["output"]
review = json.loads(raw) if isinstance(raw, str) else raw

critical = [f for f in review["findings"] if f["priority"] == "critical"]
set_aside = [c["id"] for c in review["coverage_check"] if not c["addressed"]]
sent = {f["id"] for f in payload["prescan_facts"]["flags"]}
missing = sent - {c["id"] for c in review["coverage_check"]}

print(f'posture: {review["posture"]}   critical: {len(critical)}')
if set_aside:
    print("set aside:", ", ".join(set_aside))
if missing:
    print("NOT RECONCILED:", ", ".join(sorted(missing)))
for s in review["migration_steps"][:3]:
    print(f'next: {s["step"]} - {s["action"]}')

if review["posture"] == "migration-blocked" or critical or missing:
    sys.exit(f'BLOCKED: {review["verdict"]}')
if review["posture"] == "tuning-recommended":
    print("warning:", review["verdict"])

import { createHash } from "node:crypto";

// The key is a hash of the payload itself: identical input replays, changed input re-runs.
const canonical = JSON.stringify(payload, Object.keys(payload).sort());
const key = "nc-" + createHash("sha256").update(canonical).digest("hex").slice(0, 32);

const { job_id } = await api("POST", "/run", payload, { "Idempotency-Key": key });

let job;
do {
  await new Promise((r) => setTimeout(r, 1500));
  job = await api("GET", `/jobs/${job_id}`);
} while (job.status !== "succeeded" && job.status !== "failed");
if (job.status !== "succeeded") process.exit(2);

const raw = job.output?.output ?? job.output;
const review = typeof raw === "string" ? JSON.parse(raw) : raw;

const critical = review.findings.filter((f) => f.priority === "critical");
const setAside = review.coverage_check.filter((c) => !c.addressed).map((c) => c.id);
const seen = new Set(review.coverage_check.map((c) => c.id));
const missing = payload.prescan_facts.flags.map((f) => f.id).filter((id) => !seen.has(id));

console.log(`posture: ${review.posture}   critical: ${critical.length}`);
if (setAside.length) console.log("set aside:", setAside.join(", "));
if (missing.length) console.log("NOT RECONCILED:", missing.join(", "));
for (const s of review.migration_steps.slice(0, 3)) {
  console.log(`next: ${s.step} - ${s.action}`);
}

if (review.posture === "migration-blocked" || critical.length || missing.length) {
  console.error(`BLOCKED: ${review.verdict}`);
  process.exit(1);
}
if (review.posture === "tuning-recommended") console.warn(`warning: ${review.verdict}`);

// The key is a hash of the payload itself: identical input replays, changed input re-runs.
raw, _ := json.Marshal(payload)
sum := sha256.Sum256(raw)
key := "nc-" + hex.EncodeToString(sum[:])[:32]

body := bytes.NewReader(raw)
req, _ := http.NewRequest("POST", API+"/run", body)
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Idempotency-Key", key)
// ...send it, read data.job_id, then poll /jobs/{id} exactly as in step 4.

// review is the Review struct from step 4:
critical := 0
for _, f := range review.Findings {
	if f.Priority == "critical" {
		critical++
	}
}
for _, c := range review.CoverageCheck {
	if !c.Addressed {
		fmt.Println("set aside:", c.ID, "-", c.Note)
	}
}
fmt.Printf("posture: %s   critical: %d\n", review.Posture, critical)
for i, s := range review.MigrationSteps {
	if i < 3 {
		fmt.Printf("next: %s - %s\n", s.Step, s.Action)
	}
}
if review.Posture == "migration-blocked" || critical > 0 {
	fmt.Fprintln(os.Stderr, "BLOCKED: "+review.Verdict)
	os.Exit(1)
}

// The key is a hash of the payload itself: identical input replays, changed input re-runs.
import java.security.MessageDigest;
import java.util.HexFormat;

byte[] digest = MessageDigest.getInstance("SHA-256")
    .digest(jsonPayload.getBytes(java.nio.charset.StandardCharsets.UTF_8));
String key = "nc-" + HexFormat.of().formatHex(digest).substring(0, 32);

var req = HttpRequest.newBuilder(URI.create(API + "/run"))
    .header("Authorization", "Bearer " + TOKEN)
    .header("Content-Type", "application/json")
    .header("Idempotency-Key", key)
    .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
    .build();
// send it, read data.job_id, poll /jobs/{id} as in step 4, then parse data.output.output.

// With the review parsed (your JSON library of choice):
//   String posture = review.get("posture");
//   long critical  = count of findings[] whose priority equals "critical";
//   every coverage_check[] entry with addressed == false is a set-aside prescan flag.
// if (posture.equals("migration-blocked") || critical > 0) {
//     System.err.println("BLOCKED: " + review.get("verdict"));
//     System.exit(1);
// }
// migration_steps[] is the ordered to-do list to print above the failure.

require "digest"

# The key is a hash of the payload itself: identical input replays, changed input re-runs.
key = "nc-" + Digest::SHA256.hexdigest(JSON.generate(payload))[0, 32]

started = api("POST", "/run", payload) # add the header in your api() helper:
                                       #   req["Idempotency-Key"] = key
job = nil
loop do
  job = api("GET", "/jobs/#{started["job_id"]}")
  break if %w[succeeded failed].include?(job["status"])
  sleep 1.5
end
exit 2 unless job["status"] == "succeeded"

raw = job["output"].is_a?(Hash) ? job["output"].fetch("output", job["output"]) : job["output"]
review = raw.is_a?(String) ? JSON.parse(raw) : raw

critical  = review["findings"].count { |f| f["priority"] == "critical" }
set_aside = review["coverage_check"].reject { |c| c["addressed"] }.map { |c| c["id"] }
seen      = review["coverage_check"].map { |c| c["id"] }
missing   = payload[:prescan_facts][:flags].map { |f| f[:id] } - seen

puts "posture: #{review["posture"]}   critical: #{critical}"
puts "set aside: #{set_aside.join(", ")}" unless set_aside.empty?
puts "NOT RECONCILED: #{missing.join(", ")}" unless missing.empty?
review["migration_steps"].first(3).each { |s| puts "next: #{s["step"]} - #{s["action"]}" }

if review["posture"] == "migration-blocked" || critical > 0 || !missing.empty?
  warn "BLOCKED: #{review["verdict"]}"
  exit 1
end
warn "warning: #{review["verdict"]}" if review["posture"] == "tuning-recommended"

<?php
// The key is a hash of the payload itself: identical input replays, changed input re-runs.
$key = "nc-" . substr(hash("sha256", json_encode($payload)), 0, 32);

// pass $key through to the request as the Idempotency-Key header, then poll as in step 4
$started = api("POST", "/run", $payload);
do {
    sleep(2);
    $job = api("GET", "/jobs/" . $started["job_id"]);
} while (!in_array($job["status"], ["succeeded", "failed"]));
if ($job["status"] !== "succeeded") { exit(2); }

$raw = is_array($job["output"]) ? ($job["output"]["output"] ?? $job["output"]) : $job["output"];
$review = is_string($raw) ? json_decode($raw, true) : $raw;

$critical = count(array_filter($review["findings"], fn($f) => $f["priority"] === "critical"));
$setAside = array_column(array_filter($review["coverage_check"], fn($c) => !$c["addressed"]), "id");
$seen     = array_column($review["coverage_check"], "id");
$missing  = array_diff(array_column($payload["prescan_facts"]["flags"], "id"), $seen);

echo "posture: {$review['posture']}   critical: $critical\n";
if ($setAside) { echo "set aside: " . implode(", ", $setAside) . "\n"; }
if ($missing)  { echo "NOT RECONCILED: " . implode(", ", $missing) . "\n"; }
foreach (array_slice($review["migration_steps"], 0, 3) as $s) {
    echo "next: {$s['step']} - {$s['action']}\n";
}

if ($review["posture"] === "migration-blocked" || $critical > 0 || $missing) {
    fwrite(STDERR, "BLOCKED: {$review['verdict']}\n");
    exit(1);
}
if ($review["posture"] === "tuning-recommended") {
    fwrite(STDERR, "warning: {$review['verdict']}\n");
}

using System.Security.Cryptography;

// The key is a hash of the payload itself: identical input replays, changed input re-runs.
var bytes = JsonSerializer.SerializeToUtf8Bytes(payload);
var key = "nc-" + Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant()[..32];

var run = new HttpRequestMessage(HttpMethod.Post, Api + "/run") {
    Content = JsonContent.Create(payload),
};
run.Headers.Add("Idempotency-Key", key);
// send it, read data.job_id, poll /jobs/{id} as in step 4, then:

var reviewText = job.GetProperty("output").GetProperty("output").GetString();
using var reviewDoc = JsonDocument.Parse(reviewText!);
var review = reviewDoc.RootElement;

var posture = review.GetProperty("posture").GetString();
var critical = review.GetProperty("findings").EnumerateArray()
    .Count(f => f.GetProperty("priority").GetString() == "critical");

Console.WriteLine($"posture: {posture}   critical: {critical}");
foreach (var c in review.GetProperty("coverage_check").EnumerateArray())
    if (!c.GetProperty("addressed").GetBoolean())
        Console.WriteLine($"set aside: {c.GetProperty("id")} - {c.GetProperty("note")}");
foreach (var s in review.GetProperty("migration_steps").EnumerateArray().Take(3))
    Console.WriteLine($"next: {s.GetProperty("step")} - {s.GetProperty("action")}");

if (posture == "migration-blocked" || critical > 0)
{
    Console.Error.WriteLine($"BLOCKED: {review.GetProperty("verdict")}");
    Environment.Exit(1);
}