principles 0.0.1

data/lib/principles/models/repoint.rb

@@ -0,0 +1,112 @@
+# typed: strict
+# frozen_string_literal: true
+
+require_relative "../error"
+require_relative "answer_fields"
+require_relative "answer_place"
+require_relative "audit_record"
+require_relative "project_history"
+require_relative "request_id"
+require_relative "write_up_repoint"
+
+module Principles
+  # The domain logic, and the mediation of persistence. models/CLAUDE.md owns the boundary.
+  module Models
+    # A repoint of a principle's open findings' write-ups without a full audit (D59): the agent, having checked
+    # where a write-up moved to, gives each finding it names a new recorded_at, and the last completed record keeps
+    # it, with where it pointed before, when and why. Judging that the new place holds the write-up is the agent's.
+    class Repoint
+      PHASE = "repointing"
+
+      # record is the principle's audit record now; history says whether a new pointer's file is committed.
+      #: (principle_id: String, record: AuditRecord?, history: ProjectHistory) -> void
+      def initialize(principle_id:, record:, history:)
+        @principle_id = principle_id
+        @record = record
+        @history = history
+        freeze
+      end
+
+      # The request's id, digesting the last completed record's revision it was printed after, so an answer is
+      # matched to the record it read.
+      #: () -> RequestId
+      def request_id = RequestId.for(principle_id: @principle_id, phase: PHASE, parts: [revision])
+
+      # The completed record's revision, which the request prints and the answer hands back.
+      #: () -> String
+      def revision = completed.revision
+
+      # The record with each repoint the answer gives in it, once each names a different open finding and each new
+      # pointer is located by the block, in a committed file; a repoint whose recorded_at is null leaves its
+      # finding as it is.
+      #: (untyped, at: String) { (Locator) -> void } -> AuditRecord
+      def accepted(response, at:, &locate)
+        fields = AnswerFields.new(locate)
+        repoints = response.fetch("repoints")
+        each_open_once(repoints.map { |repoint| repoint.fetch("finding_id") })
+        given = repoints.each_with_index.select { |repoint, _| repoint["recorded_at"] }
+        completed.repointed(given.map { |repoint, index| located(repoint, index, fields) }, at: at)
+      end
+
+      # The ids of the completed record's open findings that repointed, the record accepted, points elsewhere (T16).
+      #: (AuditRecord) -> Array[String]
+      def moved_ids(repointed) = repointed.write_ups_moved_since(completed)
+
+      # The ids of the rest, which repointed leaves where they pointed, so a repeat or a skipped finding is seen as one.
+      #: (AuditRecord) -> Array[String]
+      def unchanged_ids(repointed) = completed.open_ids - moved_ids(repointed)
+
+      # Refuses unless the principle's record is a completed audit's: an open record outside git keeps the completed
+      # one, whose findings its correction will decide, and with none there is nothing to repoint (D59).
+      #: () -> AuditRecord
+      def completed
+        record = @record
+        return record if record&.completed?
+
+        start = "#{Error::EXECUTABLE} start-audit #{@principle_id}"
+        if record
+          raise Error.new("cannot_repoint",
+                          "#{@principle_id} has an audit left open, whose correction decides its findings",
+                          "Answer that correction, or start the audit again: #{start}")
+        end
+
+        raise Error.new("cannot_repoint", "#{@principle_id} has no completed audit, so no finding is open",
+                        "Run a full audit first: #{start}")
+      end
+
+      private
+
+      # Refuses ids, the findings an answer's repoints name, when one is not open in the completed record or two
+      # name one finding, since either would otherwise read as a success (#760, T20).
+      #: (Array[String]) -> void
+      def each_open_once(ids)
+        open = completed.open_ids
+        unknown = ids - open
+        unless unknown.empty?
+          raise Error.new("unknown_finding", "#{@principle_id}'s last completed audit leaves no finding " \
+                                             "#{unknown.join(", ")} open",
+                          "Repoint only its open findings: #{open.join(", ")}")
+        end
+        each_once(ids)
+      end
+
+      #: (Array[String]) -> void
+      def each_once(ids)
+        repeated = ids.tally.select { |_, count| count > 1 }.keys
+        return if repeated.empty?
+
+        raise Error.new("duplicate_finding", "Repoints name #{repeated.join(", ")} more than once",
+                        "Give each finding one repoint.")
+      end
+
+      # The repoint at index, its recorded_at located and committed, and its reason given.
+      #: (Hash[String, untyped], Integer, AnswerFields) -> WriteUpRepoint
+      def located(repoint, index, fields)
+        place = AnswerPlace.new("/repoints/#{index}", "Finding #{repoint["finding_id"]}")
+        pointer = fields.write_up_pointer(repoint["recorded_at"], place.child("recorded_at"))
+        @history.refuse_uncommitted_write_up(pointer.path)
+        WriteUpRepoint.answered(repoint, pointer, fields, place)
+      end
+    end
+  end
+end

data/lib/principles/models/reported_check.rb

@@ -0,0 +1,130 @@
+# typed: strict
+# frozen_string_literal: true
+
+require_relative "../error"
+require_relative "answer_place"
+require_relative "answer_text"
+require_relative "dated_line"
+
+module Principles
+  # The domain logic, and the mediation of persistence. models/CLAUDE.md owns the boundary.
+  module Models
+    # One member's check and the result an agent reports for it (D30). This tool never runs the check: it
+    # refuses a report that cannot be about the member's own check, and cannot confirm the run happened.
+    class ReportedCheck
+      SHAPES = "Give check_result as answer_guide.check_result shows."
+      BASIS = "Say in review_basis, in one line, what the review before the run rested on, such as " \
+              "\"The owner reviewed the command in this session.\" or the document that confirms it. If you did " \
+              "the review yourself, such as confirming against the documentation a check you changed, say so: " \
+              "\"Self-reviewed by the agent: <what you checked it against>\". If no record of the review was " \
+              "kept, say so, such as \"Reviewed in an earlier session; basis not kept.\"" #: String
+
+      # assessment is the place of the member's assessment in the answer, whose check_result each refusal points
+      # into (#817). ran is the command the principle's stored record was given an exit status for, nil when it ran
+      # none; a check it did not run is reviewed before it runs, and the result says in review_basis what that review
+      # rested on (D63). kept is the line the stored record keeps for that run's review, with its
+      # review_basis_since, which an unchanged check's result carries until the answer gives another (D52).
+      #: (AnswerPlace, String?, ran: String?, kept: Hash[String, untyped]) -> void
+      def initialize(assessment, check, ran:, kept:)
+        @assessment = assessment
+        @check = check
+        @ran = ran
+        @kept = kept
+        freeze
+      end
+
+      # The reported result, once it is checked against the member's check; nil when it has none.
+      #: (untyped) -> Hash[String, untyped]?
+      def result(reported)
+        return no_check(reported) unless @check
+
+        missing_result unless reported
+        same_command(reported.fetch("command"))
+        status_or_reason(reported)
+        review_basis(reported)
+        carrying_review(reported)
+      end
+
+      private
+
+      # The place of the reported check_result, or of one of its fields.
+      #: (?String?) -> AnswerPlace
+      def reported_at(field = nil)
+        place = @assessment.child("check_result")
+        field ? place.child(field) : place
+      end
+
+      # Refuses an assessment of a checked member that reports no result for its check, pointing at the assessment
+      # it is missing from.
+      #: () -> bot
+      def missing_result
+        refuse(@assessment, "the member has a check, which context.members gives, so its assessment needs a " \
+                            "check_result",
+               "Report the member's check once you have run it, after a review if " \
+               "answer_guide.check_result.limits asks for one. #{SHAPES}")
+      end
+
+      #: (untyped) -> nil
+      def no_check(reported)
+        return unless reported
+
+        refuse(reported_at, "the member has no check, so its assessment takes no check_result",
+               "Remove check_result from this member's assessment.")
+      end
+
+      #: (String) -> void
+      def same_command(command)
+        return if command == @check
+
+        refuse(reported_at("command"), "check_result.command is not the member's check as context.members gives it",
+               "Report the command exactly as context.members lists it, run after a review if " \
+               "answer_guide.check_result.limits asks for one.")
+      end
+
+      #: (Hash[String, untyped]) -> void
+      def status_or_reason(reported)
+        unless reported.key?("exit_status") ^ reported.key?("not_run_reason")
+          refuse(reported_at, "check_result needs exactly one of exit_status and not_run_reason",
+                 "Give exit_status once the command has run, or not_run_reason if it could not, including when " \
+                 "no review it needed was possible. #{SHAPES}")
+        end
+        return if !reported.key?("not_run_reason") || AnswerText.new(reported["not_run_reason"]).written?
+
+        refuse(reported_at("not_run_reason"), "check_result.not_run_reason must be a nonempty string",
+               "Say why the command could not be run here.")
+      end
+
+      # Refuses an exit status for a check the stored record did not run unless review_basis says what its review
+      # rested on, and any review_basis that is not one written line. What the line says is the agent's: this tool
+      # keeps it and cannot verify it.
+      #: (Hash[String, untyped]) -> void
+      def review_basis(reported)
+        if reported.key?("review_basis")
+          return if AnswerText.new(reported["review_basis"]).one_line?
+
+          refuse(reported_at("review_basis"), "check_result.review_basis is not one written line", BASIS)
+        end
+        return unless reported.key?("exit_status") && @ran != @check
+
+        refuse(reported_at("review_basis"),
+               "check_result needs review_basis beside exit_status, since no audit ran this command", BASIS)
+      end
+
+      # The result as the record keeps it: an unchanged check's exit status with the kept line and its date when the
+      # answer gives the same line or none, or the answer's new line alone; any other result as reported.
+      #: (Hash[String, untyped]) -> Hash[String, untyped]
+      def carrying_review(reported)
+        return reported unless reported.key?("exit_status") && @ran == @check
+
+        line = DatedLine.new(reported.fetch("review_basis", @kept["review_basis"]), field: "review_basis")
+        reported.except("review_basis").merge(line.kept_over(@kept))
+      end
+
+      # Refuses with what is wrong at place, which the refusal names with whose it is and points at (#817).
+      #: (AnswerPlace, String, String) -> bot
+      def refuse(place, message, repair)
+        raise place.refusal(Error.new("invalid_check_result", message, repair))
+      end
+    end
+  end
+end

data/lib/principles/models/request_id.rb

@@ -0,0 +1,70 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require_relative "../error"
+
+module Principles
+  # The domain logic, which loads and saves itself through data/. models/CLAUDE.md owns the boundary.
+  module Models
+    # The id of a judgement request: the principle, the phase and a digest of everything the request
+    # depends on, as ID.PHASE.DIGEST. This tool stores no request, so an answer is matched by recomputing
+    # the digest from the project as it is now: a different digest means something the request depended
+    # on has changed (D25). The digest has no secret, so it catches mistakes, not forgery.
+    class RequestId
+      PHASES = %w[assessment correction acknowledgement repointing].freeze
+      FORMAT = /\A(?<principle>[a-z0-9]+(?:-[a-z0-9]+)*)\.(?<phase>[a-z]+)\.(?<digest>[0-9a-f]{12})\z/
+
+      #: String
+      attr_reader :principle_id
+      #: String
+      attr_reader :phase
+
+      # The id of a request in phase for principle_id, which depends on parts.
+      #: (principle_id: String, phase: String, parts: Array[untyped]) -> RequestId
+      def self.for(principle_id:, phase:, parts:)
+        new(principle_id, phase, Digest::SHA256.hexdigest(JSON.generate([principle_id, phase, *parts]))[0, 12].to_s)
+      end
+
+      # An id as an agent passed it, refused unless it has the shape this tool prints.
+      #: (String) -> RequestId
+      def self.parse(text)
+        match = FORMAT.match(text)
+        unless match && PHASES.include?(match[:phase])
+          raise Error.new("unknown_request", "#{text} does not have the form of a request id",
+                          "Use the request_id of the latest start-audit or submit-answer result.")
+        end
+
+        new(match[:principle].to_s, match[:phase].to_s, match[:digest].to_s)
+      end
+
+      #: (String, String, String) -> void
+      def initialize(principle_id, phase, digest)
+        @principle_id = principle_id
+        @phase = phase
+        @digest = digest
+        freeze
+      end
+
+      # Refuses answer unless it is an object whose request_id is this id.
+      #: (untyped) -> void
+      def check_answer(answer)
+        return if answer.is_a?(Hash) && answer["request_id"] == to_s
+
+        raise Error.new("request_mismatch", "answer.request_id must equal #{self}",
+                        "Start from the response_template of this request.")
+      end
+
+      #: () -> String
+      def to_s
+        "#{@principle_id}.#{@phase}.#{@digest}"
+      end
+
+      #: (untyped) -> bool
+      def ==(other)
+        other.is_a?(RequestId) ? other.to_s == to_s : false
+      end
+    end
+  end
+end

data/lib/principles/models/runs_from.rb

@@ -0,0 +1,36 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Principles
+  # The domain logic, and the mediation of persistence. models/CLAUDE.md owns the boundary.
+  module Models
+    # Where this run of the tool comes from, by the executable its printed commands name. The Claude Code plugin's
+    # bin/principles is the one entry point that names itself bare, since its folder is on the Bash tool's PATH
+    # while the plugin is enabled (#528); a checkout or an installed gem names a Ruby and a path. Only under the
+    # plugin does its session-start hook report beside CLAUDE.md (D41).
+    class RunsFrom
+      # The executable the plugin's entry point names itself by.
+      PLUGIN_EXECUTABLE = "principles"
+
+      #: (String) -> void
+      def initialize(executable)
+        @executable = executable
+        freeze
+      end
+
+      # Where this run comes from, as a fact the agent reads.
+      #: () -> String
+      def to_s = plugin? ? "claude_code_plugin" : "command_line"
+
+      # Whether the plugin's session-start hook runs in the session this run is part of, which only a run from the
+      # plugin shows; it says nothing of any other person's sessions.
+      #: () -> bool
+      def session_start_hook_in_this_session? = plugin?
+
+      private
+
+      #: () -> bool
+      def plugin? = @executable == PLUGIN_EXECUTABLE
+    end
+  end
+end

data/lib/principles/models/skill_loads.rb

@@ -0,0 +1,123 @@
+# typed: strict
+# frozen_string_literal: true
+
+require_relative "../error"
+require_relative "frontmatter_fields"
+require_relative "json_path_query"
+
+module Principles
+  # The domain logic, and the mediation of persistence. models/CLAUDE.md owns the boundary.
+  module Models
+    # When Claude Code loads a skill: its body when the skill is invoked, and its description, which tells the
+    # model the skill exists, at session start, on the files its paths field names, or, for a skill in a folder
+    # below the project root, when a file there is first touched. A skill only a person invokes puts nothing in
+    # the model's context until they do. This follows Claude Code's skills documentation and the #354 experiment.
+    # This tool shows the paths field as written, and reads disable-model-invocation only as a plain true or false.
+    class SkillLoads
+      # A skill's own file: SKILL.md in a skill's folder in a .claude/skills folder, at the root or below it.
+      SKILL_FILE = %r{\A(?<folder>(?:.*/)?)\.claude/skills/[^/]+/SKILL\.md\z} #: Regexp
+
+      PERSON_ONLY = "disable-model-invocation" #: String
+
+      # The characters of a skill's description and when_to_use the listing keeps (code.claude.com/docs/en/skills,
+      # read 2026-11-09); a project can set another with skillListingMaxDescChars, which this tool does not read.
+      LISTING_LIMIT = 1536 #: Integer
+
+      # text is the skill's whole file, or nil when it cannot be read; query is the member's, when it is a
+      # frontmatter field of the skill.
+      #: (String, String?, ?query: String?) -> void
+      def initialize(path, text, query: nil)
+        @path = path
+        @text = text
+        @query = query
+        freeze
+      end
+
+      #: () -> Hash[String, untyped]
+      def to_h
+        lines = @text&.lines or return { "when" => "not_determined" }
+        frontmatter = FrontmatterFields.new(path: @path, lines: lines)
+        person_only = person_only(frontmatter)
+        return not_derived("#{PERSON_ONLY} is not a plain true or false") if person_only.nil?
+
+        description = description(frontmatter, person_only)
+        return description if description.key?("not_derived")
+
+        description_member? ? description.merge("skill_part" => "description") : body(person_only, description)
+      rescue Error => e
+        { "when" => "not_determined", "frontmatter_refused" => e.payload.fetch("code") }
+      end
+
+      # What the skill listing loads of the skill: its description and when_to_use lines as written, cut at the
+      # listing's limit; nil for a skill only a person invokes, which the listing leaves out, or one this tool cannot
+      # read.
+      #: () -> String?
+      def description_text
+        lines = @text&.lines or return nil
+        frontmatter = FrontmatterFields.new(path: @path, lines: lines)
+        return nil unless person_only(frontmatter) == false
+
+        %w[description when_to_use].filter_map { |field| frontmatter.field_lines("$.#{field}")&.join }
+                                   .join[0, LISTING_LIMIT]
+      rescue Error
+        nil
+      end
+
+      private
+
+      # When the skill's body loads, who may invoke it, and when its description loads.
+      #: (bool, Hash[String, untyped]) -> Hash[String, untyped]
+      def body(person_only, description)
+        { "when" => "on_invocation", "invoked_by" => person_only ? "person" : "model_or_person",
+          "description" => description }
+      end
+
+      # Whether the member is the skill's description field, however its query names it. The docs summary says
+      # when_to_use joins the description in the listing; until that is read verbatim, it keeps the body's answer.
+      #: () -> bool
+      def description_member?
+        query = @query or return false
+        JsonPathQuery.new(query).top_level_name == "description"
+      end
+
+      # Whether only a person invokes the skill: false without the field, nil when it is not a plain true or false.
+      #: (FrontmatterFields) -> bool?
+      def person_only(frontmatter)
+        field = frontmatter.field_lines("$[\"#{PERSON_ONLY}\"]") or return false
+        value = field.join.strip.delete_prefix("#{PERSON_ONLY}:").strip
+        value == "true" if %w[true false].include?(value)
+      end
+
+      # When the description loads.
+      #: (FrontmatterFields, bool) -> Hash[String, untyped]
+      def description(frontmatter, person_only)
+        return { "when" => "not_loaded" } if person_only
+
+        paths = frontmatter.field_lines("$.paths")
+        return on_paths(paths) if paths
+        return { "when" => "on_files", "files" => [folder] } unless folder.empty?
+
+        { "when" => "session_start" }
+      end
+
+      # The description's moment for a skill with a paths field, shown as written.
+      #: (Array[String]) -> Hash[String, untyped]
+      def on_paths(paths)
+        return not_derived("a skill below the project root with a paths field") unless folder.empty?
+
+        { "when" => "on_files", "paths_field" => paths.map(&:chomp) }
+      end
+
+      # The folder whose .claude/skills holds the skill: empty at the project root, else ending in a slash.
+      #: () -> String
+      def folder
+        SKILL_FILE.match(@path)&.[](:folder).to_s
+      end
+
+      #: (String) -> Hash[String, untyped]
+      def not_derived(why)
+        { "when" => "not_determined", "not_derived" => why }
+      end
+    end
+  end
+end

data/lib/principles/models/still_holds_restatement.rb

@@ -0,0 +1,87 @@
+# typed: strict
+# frozen_string_literal: true
+
+require_relative "answer_fields"
+require_relative "answer_place"
+require_relative "answer_text"
+require_relative "evidence_replacements"
+require_relative "open_finding"
+
+module Principles
+  # The domain logic, and the mediation of persistence. models/CLAUDE.md owns the boundary.
+  module Models
+    # What a decision on a prior finding restates of that finding, which only a still_holds decision may: the
+    # problem its record lacks, a new pointer to its write-up (D35), the evidence its record lacks (D64) and a new
+    # place for each kept evidence item no longer found (D70).
+    # PriorFindingDecision checks the rest of the decision, and refuses for this through refuse.
+    class StillHoldsRestatement
+      # finding is the prior finding as its record left it open; place is the decision's place in the answer; refuse
+      # raises the decision's refusal for a reason and a repair, or the decision's own repair for nil.
+      #: (Hash[String, untyped], OpenFinding, AnswerPlace, refuse: ^(String, String?) -> void) -> void
+      def initialize(decision, finding, place, refuse:)
+        @decision = decision
+        @finding = finding
+        @place = place
+        @refuse = refuse
+        @id = finding.id #: String
+        freeze
+      end
+
+      # Refuses a restatement on any decision but still_holds, a problem the finding already states or that is not
+      # one line, kept evidence it replaces but that is still found or named by no replaces, and a pointer locate
+      # cannot resolve.
+      #: (^(Locator) -> void) -> void
+      def check(locate)
+        evidence(locate) if @decision.key?("problem_evidence")
+        return if @decision.slice("problem", "recorded_at").empty?
+
+        unless @decision["decision"] == "still_holds"
+          @refuse.call("only still_holds may give a problem or recorded_at",
+                       "Drop problem and recorded_at from #{@id}'s decision, or decide it still_holds.")
+        end
+        problem if @decision.key?("problem")
+        return unless @decision["recorded_at"]
+
+        AnswerFields.new(locate).pointer(@decision["recorded_at"], @place.child("recorded_at"))
+      end
+
+      private
+
+      # The evidence a still_holds decision may give: a finding whose record keeps none, its evidence (D64), and one
+      # whose record keeps it, the new place of each kept item no longer found, which EvidenceReplacements checks, so a
+      # decision never rewrites what an audit found (D70). This checks only that each pointer resolves.
+      #: (^(Locator) -> void) -> void
+      def evidence(locate)
+        unless @decision["decision"] == "still_holds"
+          @refuse.call("only still_holds may give problem_evidence",
+                       "Drop problem_evidence from #{@id}'s decision, or decide it still_holds.")
+        end
+        place = @place.child("problem_evidence")
+        if @finding.evidence_kept?
+          return @finding.replacements(@decision["problem_evidence"]).check(locate, @id, place, refuse: @refuse)
+        end
+
+        lacking(locate, place)
+      end
+
+      # The evidence a decision gives a finding whose record keeps none, which has nothing to replace (D64).
+      #: (^(Locator) -> void, AnswerPlace) -> void
+      def lacking(locate, place)
+        given = @decision["problem_evidence"]
+        if given.any? { |entry| entry.key?(EvidenceReplacements::REPLACES) }
+          @refuse.call("its record keeps no evidence to replace", "Drop replaces from #{@id}'s problem_evidence.")
+        end
+        AnswerFields.new(locate).evidence(given, place)
+      end
+
+      #: () -> void
+      def problem
+        if @finding.states_problem?
+          @refuse.call("it already states its problem",
+                       "Drop problem from #{@id}'s decision, or raise it again as a new finding to restate it.")
+        end
+        @refuse.call("problem must be one line", nil) unless AnswerText.new(@decision["problem"]).one_line?
+      end
+    end
+  end
+end

data/lib/principles/models/text_size.rb

@@ -0,0 +1,26 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Principles
+  # The domain logic, and the mediation of persistence. models/CLAUDE.md owns the boundary.
+  module Models
+    # How big a text that loads into context is: its bytes, and its tokens estimated as characters / 4, rounded up,
+    # an estimate rather than a tokenizer count. A text not measured has no size, so nothing is printed for it.
+    class TextSize
+      #: (String?) -> void
+      def initialize(text)
+        @text = text
+        freeze
+      end
+
+      # The size under fields' two names, its bytes then its tokens; empty when there is no text.
+      #: ([String, String]) -> Hash[String, Integer]
+      def under(fields)
+        text = @text or return {}
+
+        bytes, tokens = fields
+        { bytes => text.bytesize, tokens => (text.length / 4.0).ceil }
+      end
+    end
+  end
+end

data/lib/principles/models/uncommitted_outside_the_map.rb

@@ -0,0 +1,30 @@
+# typed: strict
+# frozen_string_literal: true
+
+module Principles
+  # The domain logic, which loads and saves itself through data/. models/CLAUDE.md owns the boundary.
+  module Models
+    # The project's files outside a principle's map that differ from the audit's base commit, as an assessment
+    # request names them (#409). A project with many untracked files would put every one into each request, so
+    # it names the first few and counts the rest (#426, D38).
+    class UncommittedOutsideTheMap
+      # The most paths a request names: enough to show a pattern, such as a generated folder, in a short list of
+      # its own; git status lists them all.
+      NAMED_AT_MOST = 10
+
+      #: (Array[String]) -> void
+      def initialize(paths)
+        @paths = paths
+        freeze
+      end
+
+      # The paths a request names, sorted, and how many beyond them it does not, when any.
+      #: () -> Hash[String, untyped]
+      def shown
+        named = { "paths" => @paths.sort.first(NAMED_AT_MOST) }
+        not_named = @paths.length - NAMED_AT_MOST
+        not_named.positive? ? named.merge("not_named" => not_named) : named
+      end
+    end
+  end
+end

data/lib/principles/models/waits_on.rb

@@ -0,0 +1,58 @@
+# typed: strict
+# frozen_string_literal: true
+
+require_relative "../error"
+require_relative "answer_text"
+require_relative "dated_line"
+
+module Principles
+  # The domain logic, and the mediation of persistence. models/CLAUDE.md owns the boundary.
+  module Models
+    # The one line an answer may give on a deferred finding, saying whom it waits on and to decide what (D52).
+    # What the line says is the agent's judgement; this tool checks only that it is one line, on a finding left
+    # deferred. A null stands on any finding, so a template's null kept on another action is not refused.
+    class WaitsOn
+      # What to write instead of a line this tool cannot keep.
+      REPAIR = "Say in one line whom the deferral waits on and to decide what, or set waits_on to null." #: String
+
+      # line is what the answer gave, and action the finding's action once the answer is applied, or nil when the
+      # answer does not leave it open.
+      #: (untyped, action: String?) -> void
+      def initialize(line, action:)
+        @line = line
+        @action = action
+        freeze
+      end
+
+      # Refuses the line, with code and naming subject, unless it is null, or one line on a finding left deferred.
+      #: (code: String, subject: String) -> void
+      def check(code:, subject:)
+        return if @line.nil?
+
+        unless deferred?
+          raise Error.new(code, "#{subject} gives waits_on, but only a deferred finding waits on anyone",
+                          "Set waits_on to null, or defer the finding.")
+        end
+        return if AnswerText.new(@line).one_line?
+
+        raise Error.new(code, "#{subject} gives a waits_on that is not one line", REPAIR)
+      end
+
+      # What a kept finding waits on once its decision is applied, this being the line the decision gave or, when it
+      # gave none, the one it carried: had, the waits_on and waits_on_since it carried, when the line is unchanged,
+      # so an ask keeps its date; this line alone, dated by the audit that records it, when new; nothing when the
+      # finding is no longer deferred or the decision gave null.
+      #: (Hash[String, untyped]) -> Hash[String, untyped]
+      def kept_over(had)
+        return {} unless deferred?
+
+        DatedLine.new(@line, field: "waits_on").kept_over(had)
+      end
+
+      private
+
+      #: () -> bool
+      def deferred? = @action == "deferred"
+    end
+  end
+end