textus 0.52.0 → 0.54.0

data/lib/textus/manifest/entry/publish.rb

@@ -18,8 +18,6 @@ module Textus
         # the block groups the two but does not make exclusivity structural, so
         # this stays the one enforcement point (ADR 0052 D2).
         def self.resolve(entry)
-          reject_removed_publish_each(entry)
-
           set = []
           set << "publish.to"   unless Array(entry.publish_to).empty?
           set << "publish.tree" unless entry.publish_tree.nil?
@@ -33,16 +31,6 @@ module Textus
           mode_for(entry, set.first)
         end
 
-        def self.reject_removed_publish_each(entry)
-          return unless entry.raw["publish_each"]
-
-          raise Textus::UsageError.new(
-            "entry '#{entry.key}': publish_each was removed in 0.42.0 (ADR 0051) — " \
-            "mirror the subtree with `publish: { tree: \"...\" }`.",
-          )
-        end
-        private_class_method :reject_removed_publish_each
-
         def self.mode_for(entry, key)
           case key
           when "publish.to"   then ToPaths.new(entry)

data/lib/textus/manifest/entry/validators/format_matrix.rb

@@ -5,7 +5,7 @@ module Textus
         module FormatMatrix
           def self.call(entry, policy:) # rubocop:disable Lint/UnusedMethodArgument
             begin
-              Textus::Entry.for_format(entry.format).validate_path_extension(entry.path, entry.nested?)
+              Textus::Format.for(entry.format).validate_path_extension(entry.path, entry.nested?)
             rescue UsageError => e
               raise UsageError.new("entry '#{entry.key}': #{e.message}")
             end

data/lib/textus/manifest/entry/validators.rb

@@ -3,7 +3,6 @@ module Textus
     class Entry
       module Validators
         REGISTERED = [
-          Events,
           Publish,
           Ignore,
           FormatMatrix,

data/lib/textus/{domain → manifest}/policy/matcher.rb

@@ -1,6 +1,6 @@
 module Textus
-  module Domain
-    module Policy
+  class Manifest
+    class Policy
       module Matcher
         module_function
 

data/lib/textus/{domain → manifest}/policy/publish_target.rb

@@ -1,6 +1,6 @@
 module Textus
-  module Domain
-    module Policy
+  class Manifest
+    class Policy
       # One publish destination (ADR 0094). Exactly one of:
       #   to-target   { to:, template:?, inject_boot:? }  — render data through a
       #               template, or copy verbatim when no template

data/lib/textus/manifest/policy/react.rb

@@ -0,0 +1,30 @@
+module Textus
+  class Manifest
+    class Policy
+      class React
+        ALLOWED_KEYS = %w[on when do scope budget idempotency observe priority].freeze
+
+        attr_reader :raw
+
+        def initialize(raw:)
+          raise Textus::BadManifest.new("react: must be a map") unless raw.is_a?(Hash)
+
+          raw = raw.each_with_object({}) do |(key, value), out|
+            normalized = key == true ? "on" : key.to_s
+            out[normalized] = value
+          end
+          raise Textus::BadManifest.new("react.ttl is invalid; ttl belongs only to source.ttl or retention.ttl") if raw.key?("ttl")
+
+          unknown = raw.keys - ALLOWED_KEYS
+          raise Textus::BadManifest.new("react: unknown key(s): #{unknown.join(", ")}") unless unknown.empty?
+
+          @raw = raw
+        end
+
+        def to_h
+          @raw
+        end
+      end
+    end
+  end
+end

data/lib/textus/{domain → manifest}/policy/retention.rb

@@ -1,6 +1,6 @@
 module Textus
-  module Domain
-    module Policy
+  class Manifest
+    class Policy
       # Garbage collection (ADR 0093). A glob-matched rule slot: when an entry
       # ages past `ttl`, retire it. Destructive only — runs on the full
       # `converge` pass, never on a write (ADR 0079's invariant). Orthogonal to
@@ -21,7 +21,7 @@ module Textus
           raise Textus::BadManifest.new("retention action must be one of #{ACTIONS.join("|")}, got #{raw["action"].inspect}")
         end
 
-        def ttl_seconds = Textus::Domain::Duration.seconds(@ttl)
+        def ttl_seconds = Textus::Core::Duration.seconds(@ttl)
         def destructive? = true
       end
     end

data/lib/textus/manifest/policy/source.rb

@@ -0,0 +1,30 @@
+module Textus
+  class Manifest
+    class Policy
+      # An entry's external-generator declaration. `source:` now means ONLY
+      # `from: external` — out-of-band runner; textus never invokes it, only
+      # detects drift (doctor generator_drift check).
+      # `from: fetch` and `from: derive` are removed; those concerns now live
+      # in workflow files under .textus/workflows/.
+      class Source
+        attr_reader :command, :sources
+
+        def initialize(raw)
+          from = raw["from"].to_s
+          unless from == "external"
+            raise Textus::BadManifest.new(
+              "from: #{from} is removed — use a workflow file under .textus/workflows/ instead",
+            )
+          end
+
+          @command = raw["command"] or
+            raise Textus::BadManifest.new("source (from: external) requires a `command:` field")
+          @sources = raw["sources"] || []
+        end
+
+        def external? = true
+        def kind      = :external
+      end
+    end
+  end
+end

data/lib/textus/manifest/policy.rb

@@ -1,23 +1,23 @@
 module Textus
   class Manifest
-    # Authority over zones and roles derived from a Manifest::Data snapshot.
+    # Authority over lanes and roles derived from a Manifest::Data snapshot.
     # Encapsulates the lookups previously living on Manifest itself
-    # (zone_writers, permission_for). Write authority is derived from
-    # capabilities × zone-kind (ADR 0030): each zone-kind requires one verb
-    # (Schema::KIND_REQUIRES_VERB) and a role may write a zone iff its caps
-    # include that verb (verb_for_zone, roles_with_capability). Derived /
+    # (lane_writers, permission_for). Write authority is derived from
+    # capabilities x lane-kind (ADR 0030): each lane-kind requires one verb
+    # (Schema::KIND_REQUIRES_VERB) and a role may write a lane iff its caps
+    # include that verb (verb_for_lane, roles_with_capability). Derived /
     # proposal-queue status is authoritative via the declared-kind family
-    # (declared_kind, derived_entry?, queue_zone?, queue_zone).
+    # (declared_kind, derived_entry?, queue_lane?, queue_lane).
     class Policy
       def initialize(data)
         @data = data
       end
 
-      # The capability a zone's kind requires to be written, or nil if the
-      # zone declares no kind. declared_kind returns a Symbol; the table is
+      # The capability a lane's kind requires to be written, or nil if the
+      # lane declares no kind. declared_kind returns a Symbol; the table is
       # keyed by String.
-      def verb_for_zone(zone_name)
-        kind = declared_kind(zone_name)
+      def verb_for_lane(lane_name)
+        kind = declared_kind(lane_name)
         kind && Schema::KIND_REQUIRES_VERB[kind.to_s]
       end
 
@@ -41,67 +41,52 @@ module Textus
         roles_with_capability(verb).first
       end
 
-      # The roles authorized to write `zone_name`: those holding the verb its
-      # kind requires. Raises on an undeclared zone.
-      def zone_writers(zone_name)
-        raise UsageError.new("undeclared zone '#{zone_name}'") unless @data.declared_zone_kinds.key?(zone_name)
-
-        roles_with_capability(verb_for_zone(zone_name))
-      end
-
-      def permission_for(zone_name)
-        Textus::Domain::Permission.new(
-          zone: zone_name,
-          writers: zone_writers(zone_name),
-        )
+      # The kind declared on a lane in the manifest, or nil if undeclared.
+      def declared_kind(lane_name)
+        @data.declared_lane_kinds[lane_name]
       end
 
-      # The kind declared on a zone in the manifest, or nil if undeclared.
-      def declared_kind(zone_name)
-        @data.declared_zone_kinds[zone_name]
+      # Lane names declaring `kind` (a Symbol), in manifest order. Lets callers
+      # (boot) name a kind's live lane instance(s) instead of hardcoding names.
+      def lanes_of_kind(kind)
+        @data.declared_lane_kinds.select { |_name, k| k == kind }.keys
       end
 
-      # Zone names declaring `kind` (a Symbol), in manifest order. Lets callers
-      # (boot) name a kind's live zone instance(s) instead of hardcoding names.
-      def zones_of_kind(kind)
-        @data.declared_zone_kinds.select { |_name, k| k == kind }.keys
+      # The single lane declaring `kind: queue`, or nil. Schema guarantees <=1.
+      def queue_lane
+        @data.declared_lane_kinds.key(:queue)
       end
 
-      # The single zone declaring `kind: queue`, or nil. Schema guarantees <=1.
-      def queue_zone
-        @data.declared_zone_kinds.key(:queue)
-      end
-
-      # ADR 0091: derived-ness is a property of the ENTRY, not its zone (one
-      # machine zone holds both intake and derived entries). Resolve the entry
+      # ADR 0091: derived-ness is a property of the ENTRY, not its lane (one
+      # machine lane holds both intake and derived entries). Resolve the entry
       # and ask it directly. Returns false if entries are not yet built
       # (validator phase during Data#initialize) — validators must not rely on
       # cross-entry state during construction.
-      def derived_entry?(key)
-        return false if @data.entries.nil?
-
-        entry = @data.entries.find { |e| e.key == key } or return false
-        entry.derived?
+      def derived_entry?(_key)
+        false
       end
 
-      # The single zone declaring kind: machine, or nil.
-      def machine_zone
-        @data.declared_zone_kinds.key(:machine)
+      # The single lane declaring kind: machine, or nil.
+      def machine_lane
+        @data.declared_lane_kinds.key(:machine)
       end
 
-      # A zone is a proposal queue iff it declares kind: queue.
-      def queue_zone?(zone_name)
-        declared_kind(zone_name) == :queue
+      # A lane is a proposal queue iff it declares kind: queue.
+      def queue_lane?(lane_name)
+        declared_kind(lane_name) == :queue
       end
 
-      # The zone a proposer role writes proposals into: the single zone that
+      # The lane a proposer role writes proposals into: the single lane that
       # declares kind: queue, when the role can write it. Returns nil if there
-      # is no queue zone or the role cannot write it.
-      def propose_zone_for(role)
+      # is no queue lane or the role cannot write it.
+      def propose_lane_for(role)
         return nil if role.nil?
 
-        q = queue_zone
-        return nil unless q && zone_writers(q).include?(role)
+        q = queue_lane
+        return nil unless q
+
+        q_verb = verb_for_lane(q)
+        return nil unless roles_with_capability(q_verb).include?(role)
 
         q
       end

data/lib/textus/manifest/resolver.rb

@@ -53,8 +53,9 @@ module Textus
         else
           raise UnknownKey.new(key, suggestions: suggestions_for(key)) unless nested_entry?(entry)
 
-          primary_ext = Textus::Entry.for_format(entry.format).extensions.first
-          path = File.join(@data.root, "zones", entry.path, *remaining) + primary_ext
+          primary_ext = Textus::Format.for(entry.format).extensions.first
+          base = Textus::Key::Path.normalize_relative_path(entry.path)
+          path = File.join(@data.root, base, *remaining) + primary_ext
           Resolution.new(entry: entry, path: path, remaining: remaining)
         end
       end
@@ -73,7 +74,7 @@ module Textus
         # addressable store keys in the public `list` surface.
         return [] if entry.publish_mode.keyless? && !include_keyless
 
-        base = File.join(@data.root, "zones", entry.path)
+        base = File.join(@data.root, Textus::Key::Path.normalize_relative_path(entry.path))
         return [] unless File.directory?(base)
 
         Dir.glob(File.join(base, nested_glob(entry.format)))
@@ -110,7 +111,7 @@ module Textus
       end
 
       def nested_glob(format)
-        Textus::Entry.for_format(format).nested_glob
+        Textus::Format.for(format).nested_glob
       end
     end
   end

data/lib/textus/manifest/rules.rb

@@ -22,7 +22,7 @@ module Textus
       def for(key)
         slots = PICK_FIELDS.to_h { |f| [f, []] }
         @blocks.each do |b|
-          next unless Textus::Domain::Policy::Matcher.matches?(b.match, key)
+          next unless Textus::Manifest::Policy::Matcher.matches?(b.match, key)
 
           slots.each_key { |slot| slots[slot] << b if b.public_send(slot) }
         end
@@ -30,7 +30,7 @@ module Textus
       end
 
       def explain(key)
-        @blocks.select { |b| Textus::Domain::Policy::Matcher.matches?(b.match, key) }
+        @blocks.select { |b| Textus::Manifest::Policy::Matcher.matches?(b.match, key) }
       end
 
       private
@@ -39,7 +39,7 @@ module Textus
         return nil if blocks.empty?
 
         globs = blocks.map(&:match)
-        winning = Textus::Domain::Policy::Matcher.pick_most_specific(globs, key: key)
+        winning = Textus::Manifest::Policy::Matcher.pick_most_specific(globs, key: key)
         blocks.find { |b| b.match == winning }&.public_send(slot)
       end
 
@@ -57,7 +57,7 @@ module Textus
 
         # One dispatch over the registry, replacing the four bespoke parse_*
         # methods. :deferred carries the raw Hash after a shape check (its
-        # contents validate later — guard predicates at GuardFactory build time,
+        # contents validate later — guard predicates at Dispatch::Auth check time,
         # ADR 0031); :immediate instantiates the policy class now. :tagged passes
         # the raw Hash straight to a policy class that is a tagged union and
         # dispatches on its discriminator field (e.g. upkeep's on:). A mapping

data/lib/textus/manifest/schema/keys.rb

@@ -4,28 +4,21 @@ module Textus
       # The manifest's key whitelists and the rule-field registry — the schema's
       # data tables (ADR 0109; the vocabulary lives in Schema::Vocabulary).
       module Keys
-        ROOT_KEYS  = %w[version roles zones entries rules audit].freeze
+        ROOT_KEYS  = %w[version roles lanes entries rules audit].freeze
         ROLE_KEYS  = %w[name can].freeze
-        ZONE_KEYS  = %w[name kind owner desc].freeze
+        LANE_KEYS  = %w[name kind owner desc].freeze
         ENTRY_KEYS = %w[
-          key path zone kind schema owner nested format
-          source publish
-          events ignore tracked
+          key path lane kind schema owner nested format
+          source publish tracked ignore
         ].freeze
         # ADR 0052: the typed publish block — `publish: { to: [...] }` (file
         # fan-out) xor `publish: { tree: "dir" }` (subtree mirror).
         PUBLISH_KEYS = %w[to tree].freeze
-        # ADR 0093/0094: entry-level acquisition block. `from: project` sources
-        # expose flat projection fields (select/pluck/sort_by/transform) directly
-        # on the source block (ADR 0094). Render fields (template/inject_boot/
-        # provenance) that were formerly on the source are retired — they live on
-        # publish targets. The legacy `project:` free hash and `template`/
-        # `inject_boot`/`provenance` fields are kept here so the schema walk can
-        # still emit the migration hint rather than a bare "unknown key".
-        SOURCE_KEYS = %w[
-          from handler config template project command sources ttl inject_boot provenance
-          select pluck sort_by transform
-        ].freeze
+        # entry-level external-generator block — only `from: external` is valid.
+        # `from: fetch` and `from: derive` and their specific fields (handler,
+        # config, ttl, select, pluck, sort_by, transform) were removed in the
+        # workflow redesign.
+        SOURCE_KEYS = %w[from command sources].freeze
         # ADR 0093: rule-level GC slot. drop/archive only (refresh gone).
         RETENTION_KEYS = %w[ttl action].freeze
 
@@ -40,12 +33,11 @@ module Textus
         #     (in_rule_list / in_rule_explain)
         #
         # Per field:
-        #   yaml_key     manifest key (handler_allowlist's intake_ prefix
-        #                disambiguates from entry-level intake:, ADR 0059)
-        #   policy_class the Domain::Policy backing the field (nil = raw value)
+        #   yaml_key     manifest key used in a rule block
+        #   policy_class the Manifest::Policy backing the field (nil = raw value)
         #   validation   :immediate (instantiate the policy at parse, surfacing
         #                shape errors eagerly), :deferred (shape-check + carry
-        #                the raw Hash; guard predicates validate at GuardFactory
+        #                the raw Hash; guard predicates validate at Dispatch::Auth
         #                build time, ADR 0031), or :tagged (pass the raw Hash to a
         #                tagged-union policy that dispatches on its discriminator
         #                field, e.g. upkeep's on:)
@@ -61,13 +53,6 @@ module Textus
         # Key order here fixes the order of RULE_KEYS (after match), the slots,
         # the RuleSet members, and the doctor SLOTS.
         FIELD_REGISTRY = {
-          handler_allowlist: {
-            yaml_key: "intake_handler_allowlist",
-            policy_class: Textus::Domain::Policy::HandlerAllowlist,
-            validation: :immediate, sub_keys: nil, arg_key: :handlers,
-            in_pick: true, in_ambiguity: true,
-            in_rule_list: true, in_rule_explain: %i[detail]
-          },
           guard: {
             yaml_key: "guard",
             policy_class: nil,
@@ -77,11 +62,18 @@ module Textus
           },
           retention: {
             yaml_key: "retention",
-            policy_class: Textus::Domain::Policy::Retention,
+            policy_class: Textus::Manifest::Policy::Retention,
             validation: :tagged, sub_keys: RETENTION_KEYS, arg_key: nil,
             in_pick: true, in_ambiguity: true,
             in_rule_list: true, in_rule_explain: %i[lean detail]
           },
+          react: {
+            yaml_key: "react",
+            policy_class: Textus::Manifest::Policy::React,
+            validation: :immediate, sub_keys: nil, arg_key: :raw,
+            in_pick: true, in_ambiguity: true,
+            in_rule_list: true, in_rule_explain: %i[lean detail]
+          },
         }.freeze
 
         RULE_KEYS = (["match"] + FIELD_REGISTRY.values.map { |m| m[:yaml_key] }).freeze

data/lib/textus/manifest/schema/validator.rb

@@ -14,34 +14,36 @@ module Textus
           raise BadManifest.new("manifest must be a hash") unless raw.is_a?(Hash)
 
           walk(raw, ROOT_KEYS, "$")
+          raise BadManifest.new("manifest must declare lanes:") if Array(raw["lanes"]).empty?
+
           validate_roles!(raw["roles"])
-          validate_zones!(raw["zones"])
+          validate_lanes!(raw["lanes"])
           validate_entries!(raw["entries"])
-          validate_owners!(raw["zones"], raw["entries"])
+          validate_owners!(raw["lanes"], raw["entries"])
           validate_rules!(raw["rules"])
           walk(raw["audit"], AUDIT_KEYS, "$.audit") if raw["audit"].is_a?(Hash)
           validate_single_queue!(raw)
           validate_single_machine!(raw)
-          validate_zone_kind_consistency!(raw)
+          validate_lane_kind_consistency!(raw)
         end
 
-        def validate_zones!(zones)
-          Array(zones).each_with_index do |z, i|
-            walk(z, ZONE_KEYS, "$.zones[#{i}]")
+        def validate_lanes!(lanes)
+          Array(lanes).each_with_index do |z, i|
+            walk(z, LANE_KEYS, "$.lanes[#{i}]")
             if z["kind"].nil?
-              raise BadManifest.new("zone '#{z["name"]}' at '$.zones[#{i}]' must declare a kind (one of: #{ZONE_KINDS.join(", ")})")
+              raise BadManifest.new("lane '#{z["name"]}' at '$.lanes[#{i}]' must declare a kind (one of: #{LANE_KINDS.join(", ")})")
             end
-            next if ZONE_KINDS.include?(z["kind"])
+            next if LANE_KINDS.include?(z["kind"])
 
             if %w[quarantine derived].include?(z["kind"])
               raise BadManifest.new(
-                "zone kind '#{z["kind"]}' at '$.zones[#{i}]' was folded into 'machine' (ADR 0091) — " \
+                "lane kind '#{z["kind"]}' at '$.lanes[#{i}]' was folded into 'machine' (ADR 0091) — " \
                 "use `kind: machine`",
               )
             end
 
             raise BadManifest.new(
-              "unknown zone kind '#{z["kind"]}' at '$.zones[#{i}]' (known: #{ZONE_KINDS.join(", ")})",
+              "unknown lane kind '#{z["kind"]}' at '$.lanes[#{i}]' (known: #{LANE_KINDS.join(", ")})",
             )
           end
         end
@@ -217,9 +219,9 @@ module Textus
         # (ADR 0045 D1) so attribution can't bypass the closed-name guarantee.
         # Applies to both zone owners and entry owners; owner is optional, so a
         # nil owner is not an error.
-        def validate_owners!(zones, entries)
-          Array(zones).each_with_index do |z, i|
-            check_owner!(z["owner"], "$.zones[#{i}]")
+        def validate_owners!(lanes, entries)
+          Array(lanes).each_with_index do |z, i|
+            check_owner!(z["owner"], "$.lanes[#{i}]")
           end
           Array(entries).each_with_index do |e, i|
             check_owner!(e["owner"], "$.entries[#{i}]")
@@ -265,20 +267,20 @@ module Textus
         end
 
         def validate_single_queue!(raw)
-          queues = Array(raw["zones"]).select { |z| z["kind"] == "queue" }.map { |z| z["name"] }
+          queues = Array(raw["lanes"]).select { |z| z["kind"] == "queue" }.map { |z| z["name"] }
           return if queues.size <= 1
 
           raise BadManifest.new(
-            "at most one zone may declare kind: queue (found: #{queues.join(", ")})",
+            "at most one lane may declare kind: queue (found: #{queues.join(", ")})",
           )
         end
 
         def validate_single_machine!(raw)
-          machines = Array(raw["zones"]).select { |z| z["kind"] == "machine" }.map { |z| z["name"] }
+          machines = Array(raw["lanes"]).select { |z| z["kind"] == "machine" }.map { |z| z["name"] }
           return if machines.size <= 1
 
           raise BadManifest.new(
-            "at most one zone may declare kind: machine (found: #{machines.join(", ")})",
+            "at most one lane may declare kind: machine (found: #{machines.join(", ")})",
           )
         end
 
@@ -287,33 +289,25 @@ module Textus
         # out). Per ADR 0095 the produce-method is read from source.from on the one
         # Produced kind, so there is no longer a kind to agree against the source.
         # (Replaces validate_upkeep_kinds!.)
-        def validate_source_and_retention!(manifest)
-          manifest.data.entries.each do |entry|
-            retention = manifest.rules.for(entry.key).retention
-            next if retention.nil?
-            next unless entry.derived?
-
-            raise BadManifest.new(
-              "entry '#{entry.key}': a derived entry regenerates from its source; " \
-              "retention (drop/archive) is invalid",
-            )
-          end
+        def validate_source_and_retention!(_manifest)
+          # No-op: from: derive is removed; retention + produced entries are
+          # always valid (retention drives age-GC on workflow-produced entries).
         end
 
-        # Write authority is derived from capabilities (ADR 0030): a zone of a
+        # Write authority is derived from capabilities (ADR 0030): a lane of a
         # given kind can only be written by a role that holds the kind's required
-        # verb. Reject a manifest declaring a zone whose required verb is held by
+        # verb. Reject a manifest declaring a lane whose required verb is held by
         # no role. Capabilities.resolve returns the defaults when `roles:` is nil,
         # so the capability union is all four verbs and every kind is satisfied.
-        def validate_zone_kind_consistency!(raw)
+        def validate_lane_kind_consistency!(raw)
           held = Capabilities.resolve(raw["roles"]).values.flatten.uniq
 
-          Array(raw["zones"]).each_with_index do |z, i|
+          Array(raw["lanes"]).each_with_index do |z, i|
             verb = KIND_REQUIRES_VERB[z["kind"]]
             next if verb.nil? || held.include?(verb)
 
             raise BadManifest.new(
-              "zone '#{z["name"]}' (#{z["kind"]}) at '$.zones[#{i}]' " \
+              "lane '#{z["name"]}' (#{z["kind"]}) at '$.lanes[#{i}]' " \
               "needs a role with capability '#{verb}'; none declared",
             )
           end

data/lib/textus/manifest/schema/vocabulary.rb

@@ -13,9 +13,10 @@ module Textus
           "workspace" => "keep",
           "machine" => "converge",
           "queue" => "propose",
+          "raw" => "ingest",
         }.freeze
 
-        ZONE_KINDS         = LANES.keys.freeze
+        LANE_KINDS         = LANES.keys.freeze
         CAPABILITIES       = LANES.values.uniq.freeze
         KIND_REQUIRES_VERB = LANES
       end

data/lib/textus/manifest/schema.rb

@@ -7,13 +7,13 @@ module Textus
     module Schema
       # Re-export the vocabulary.
       LANES              = Vocabulary::LANES
-      ZONE_KINDS         = Vocabulary::ZONE_KINDS
+      LANE_KINDS         = Vocabulary::LANE_KINDS
       CAPABILITIES       = Vocabulary::CAPABILITIES
       KIND_REQUIRES_VERB = Vocabulary::KIND_REQUIRES_VERB
       # Re-export the keys + registry.
       ROOT_KEYS             = Keys::ROOT_KEYS
       ROLE_KEYS             = Keys::ROLE_KEYS
-      ZONE_KEYS             = Keys::ZONE_KEYS
+      LANE_KEYS             = Keys::LANE_KEYS
       ENTRY_KEYS            = Keys::ENTRY_KEYS
       PUBLISH_KEYS          = Keys::PUBLISH_KEYS
       SOURCE_KEYS           = Keys::SOURCE_KEYS

data/lib/textus/manifest.rb

@@ -6,8 +6,8 @@ module Textus
   #
   #   * data     — frozen value: raw, root, zones, entries, audit_config, role_caps
   #   * resolver — resolves keys → entry + path
-  #   * policy   — zone/role authority (zone_writers, declared_kind, derived_entry?,
-  #     queue_zone?, permission_for, …)
+  #   * policy   — zone/role authority (lane_writers, declared_kind, derived_entry?,
+  #     queue_lane?, permission_for, …)
   #   * rules    — match-block rule engine (lifecycle, handler allowlist, materialize, …)
   #
   # Use `manifest.data.entries`, `manifest.policy.declared_kind(z)`, etc.

data/lib/textus/ports/audit_log.rb

@@ -78,16 +78,42 @@ module Textus
       def verify_integrity
         return [] unless File.exist?(@path)
 
-        out = []
-        File.foreach(@path).with_index(1) do |line, lineno|
-          violation = check_line(line.chomp, lineno)
-          out << violation if violation
+        [].tap do |out|
+          iterate_with_prev_seq do |line, lineno, prev_seq|
+            check_line_integrity(line, lineno, prev_seq, out)
+          end
         end
-        out
       end
 
       private
 
+      def iterate_with_prev_seq
+        prev_seq = nil
+        File.foreach(@path).with_index(1) do |line, lineno|
+          yield line.chomp, lineno, prev_seq
+          parsed = parse_row(line.chomp)
+          prev_seq = parsed["seq"] if parsed&.dig("seq").is_a?(Integer)
+        end
+      end
+
+      def check_line_integrity(line, lineno, prev_seq, out)
+        violation = check_line(line, lineno)
+        if violation
+          out << violation
+          return
+        end
+
+        parsed = parse_row(line)
+        return unless parsed && (seq = parsed["seq"]).is_a?(Integer)
+        return unless prev_seq && seq != prev_seq + 1
+
+        out << {
+          "lineno" => lineno,
+          "reason" => "seq_gap",
+          "detail" => "expected #{prev_seq + 1}, got #{seq}",
+        }
+      end
+
       def rotated(n)
         File.join(Textus::Layout.audit_dir(@root), "audit.log.#{n}")
       end