0xray 3.0.12 → 3.1.0

package/dist/enforcement/validators/architecture-validators.js

@@ -598,84 +598,3 @@ export class EmergentImprovementValidator extends BaseValidator {
         return this.createSuccessResult("Emergent improvement requirements met");
     }
 }
-/**
- * Validates boot wiring completeness (Codex Term #74).
- * Detects exported functions with boot-relevant naming patterns (register*, init*, boot*, setup*)
- * that are defined and possibly tested but may not be wired into any boot sequence.
- * Flags when new boot-like functions appear without corresponding calls in known boot files.
- */
-export class BootWiringValidator extends BaseValidator {
-    id = "boot-wiring-validator";
-    ruleId = "boot-wiring";
-    category = "architecture";
-    severity = "error";
-    /** Known boot entry point file patterns */
-    bootFilePatterns = [
-        /orchestrat[^/]*\.ts$/,
-        /boot[^/]*\.ts$/,
-        /init[^/]*\.ts$/,
-        /kernel[^/]*\.ts$/,
-        /activation[^/]*\.ts$/,
-        /processor-manager[^/]*\.ts$/,
-        /plugin-regist[^/]*\.ts$/,
-        /default-plugin[^/]*\.ts$/,
-    ];
-    /** Function name patterns suggesting boot-relevant behavior */
-    bootFuncPatterns = [
-        /^register[A-Z]/,
-        /^init[A-Z]/,
-        /^boot[A-Z]/,
-        /^setup[A-Z]/,
-        /^start[A-Z]/,
-        /^configure[A-Z]/,
-        /^load[A-Z]/,
-    ];
-    async validate(context) {
-        const { newCode, files } = context;
-        if (!newCode || !files || files.length === 0) {
-            return this.createSuccessResult("No code to validate for boot wiring");
-        }
-        const violations = [];
-        const suggestions = [];
-        // Check if any changed files are putative boot files
-        const hasBootFiles = files.some((f) => this.bootFilePatterns.some((p) => p.test(f)));
-        // Collect unique exported function/const names
-        const exportMatches = newCode.match(/export\s+(?:async\s+)?(?:function\s+(\w+)|const\s+(\w+)\s*=\s*(?:async\s*)?\(|default\s+(?:async\s+)?function\s+(\w+))/g) || [];
-        const exportedNames = [];
-        for (const match of exportMatches) {
-            const name = match.match(/(?:function|const|default)\s+(\w+)/);
-            if (name?.[1])
-                exportedNames.push(name[1]);
-        }
-        const namedExports = newCode.match(/export\s+const\s+(\w+)/g) || [];
-        for (const match of namedExports) {
-            const name = match.match(/export\s+const\s+(\w+)/);
-            if (name?.[1])
-                exportedNames.push(name[1]);
-        }
-        // Flag exported boot-like functions not accompanied by boot file changes
-        for (const name of [...new Set(exportedNames)]) {
-            const isBootFunc = this.bootFuncPatterns.some((p) => p.test(name));
-            if (!isBootFunc)
-                continue;
-            violations.push(`Exported boot-like function '${name}' detected without boot sequence updates`);
-            suggestions.push(`Ensure ${name}() is called in a boot entry point (orchestrator.bootSteps, init path, etc.)`);
-        }
-        // When boot files ARE in the change set, also flag files containing
-        // boot-like internal calls that reference a new export by name
-        if (hasBootFiles && exportedNames.length > 0) {
-            for (const name of [...new Set(exportedNames)]) {
-                const isBootFunc = this.bootFuncPatterns.some((p) => p.test(name));
-                if (!isBootFunc)
-                    continue;
-                violations.push(`Modified boot files exist but no call to '${name}()' detected in them — verify wiring`);
-                suggestions.push(`Add a call to ${name}() in the appropriate boot sequence file`);
-            }
-        }
-        if (violations.length > 0) {
-            return this.createFailureResult(`Boot wiring concerns: ${violations.join("; ")}`, [...new Set(suggestions)]);
-        }
-        return this.createSuccessResult("Boot wiring patterns validated");
-    }
-}
-//# sourceMappingURL=architecture-validators.js.map

package/dist/enforcement/validators/base-validator.js

@@ -106,4 +106,3 @@ export class BaseValidator {
         return result;
     }
 }
-//# sourceMappingURL=base-validator.js.map

package/dist/enforcement/validators/code-quality-validators.js

@@ -125,11 +125,6 @@ export class DocumentationRequiredValidator extends BaseValidator {
         }
         const violations = [];
         const suggestions = [];
-        const isSimple = (newCode.split("\n").length < 5 &&
-            !newCode.includes("async") &&
-            !newCode.includes("class")) ||
-            newCode.includes("get ") ||
-            newCode.includes("set ");
         // 1. Check for exported functions/classes without JSDoc
         const exportedItems = newCode.match(/export\s+(?:function|class|const|let)\s+(\w+)/g);
         if (exportedItems) {
@@ -140,6 +135,11 @@ export class DocumentationRequiredValidator extends BaseValidator {
                         .substring(0, newCode.indexOf(exportMatch))
                         .trim();
                     const hasJSDoc = beforeExport.endsWith("*/") && beforeExport.includes("/**");
+                    const isSimple = (newCode.split("\n").length < 5 &&
+                        !newCode.includes("async") &&
+                        !newCode.includes("class")) ||
+                        newCode.includes("get ") ||
+                        newCode.includes("set ");
                     if (!hasJSDoc &&
                         !isSimple &&
                         !newCode.includes("Mock documentation")) {
@@ -167,12 +167,10 @@ export class DocumentationRequiredValidator extends BaseValidator {
             violations.push("Configuration changes detected - version updates required");
             suggestions.push("Update version fields in package.json and codex.json");
         }
-        // 5. Universal researcher consultation requirement (skip for trivial changes)
-        if (!isSimple) {
-            violations.push("Universal researcher consultation required for code changes");
-            suggestions.push("Consult researcher for documentation review and version updates");
-            suggestions.push("Ensure README.md, architecture docs, and API docs are current");
-        }
+        // 5. Universal researcher consultation requirement
+        violations.push("Universal researcher consultation required for all code changes");
+        suggestions.push("Consult researcher for documentation review and version updates");
+        suggestions.push("Ensure README.md, architecture docs, and API docs are current");
         if (violations.length > 0) {
             return this.createFailureResult(`Documentation violations: ${violations.join(", ")}`, [
                 ...suggestions,
@@ -317,7 +315,6 @@ export class CleanDebugLogsValidator extends BaseValidator {
  * Validates console log usage restrictions.
  * Console.log must be used only for debugging in dev mode.
  * Retained logs must use framework logger.
- * CLI command files (src/cli/) are exempt as console.* provides user-facing output.
  */
 export class ConsoleLogUsageValidator extends BaseValidator {
     id = "console-log-usage-validator";
@@ -325,44 +322,15 @@ export class ConsoleLogUsageValidator extends BaseValidator {
     category = "code-quality";
     severity = "error";
     async validate(context) {
-        const { newCode, files } = context;
+        const { newCode } = context;
+        // Skip validation if no code to check
         if (!newCode) {
             return this.createSuccessResult("No code to validate for console.log usage");
         }
-        // Check if ALL affected files are CLI-command files (exempt)
-        const allFilesAreCLI = files && files.length > 0 && files.every((f) => f.includes("/cli/") || f.includes("src\\cli\\"));
-        // Remove comments before checking for console usage
-        const codeWithoutComments = newCode
-            .replace(/\/\/.*$/gm, "")
-            .replace(/\/\*[\s\S]*?\*\//g, "");
-        // Check for console.log/warn/error patterns (not console.debug/info which have other validators)
-        const consolePatterns = [
-            { pattern: /\bconsole\.log\s*\(/g, name: "console.log" },
-            { pattern: /\bconsole\.warn\s*\(/g, name: "console.warn" },
-            { pattern: /\bconsole\.error\s*\(/g, name: "console.error" },
-        ];
-        const violations = [];
-        for (const { pattern, name } of consolePatterns) {
-            pattern.lastIndex = 0;
-            const matches = codeWithoutComments.match(pattern);
-            if (matches && matches.length > 0) {
-                violations.push(`${matches.length} use(s) of ${name}`);
-            }
-        }
-        // Also check for process.stderr.write / process.stdout.write
-        const writePattern = /\bprocess\.(stderr|stdout)\.write\s*\(/g;
-        const writeMatches = codeWithoutComments.match(writePattern);
-        if (writeMatches && writeMatches.length > 0) {
-            violations.push(`${writeMatches.length} use(s) of process.stderr/stdout.write`);
-        }
-        if (violations.length > 0 && !allFilesAreCLI) {
-            return this.createFailureResult(`Console/log usage in non-CLI code: ${violations.join("; ")}`, [
-                "Use frameworkLogger.log / frameworkLogger.error instead of console.* in production code",
-                "CLI command files (src/cli/) are exempt and may use console.* for user-facing output",
-                "For hooks/scripts use the internal log()/logError() pattern",
-            ]);
+        // Check for console.log usage
+        if (newCode.includes("await frameworkLogger.log('rule-enforcer', '-return-passed-false-message-console-log-', 'info', { message: ")) {
+            return this.createFailureResult("await frameworkLogger.log('rule-enforcer', '-', 'info', { message:  } }); detected - use frameworkLogger for production logs or remove for debugging");
         }
         return this.createSuccessResult("Console log usage follows proper guidelines");
     }
 }
-//# sourceMappingURL=code-quality-validators.js.map

package/dist/enforcement/validators/index.js

@@ -19,4 +19,3 @@ export { InputValidationValidator, SecurityByDesignValidator, } from "./security
 export { TestsRequiredValidator, TestCoverageValidator, ContinuousIntegrationValidator, TestFailureReportingValidator, PerformanceRegressionReportingValidator, SecurityVulnerabilityReportingValidator, } from "./testing-validators.js";
 // Architecture validators
 export { DependencyManagementValidator, SrcDistIntegrityValidator, ImportConsistencyValidator, ModuleSystemConsistencyValidator, ErrorResolutionValidator, LoopSafetyValidator, StateManagementPatternsValidator, SingleResponsibilityValidator, DeploymentSafetyValidator, MultiAgentEnsembleValidator, SubstrateExternalizationValidator, FrameworkSelfValidationValidator, EmergentImprovementValidator, } from "./architecture-validators.js";
-//# sourceMappingURL=index.js.map

package/dist/enforcement/validators/security-validators.js

@@ -218,4 +218,3 @@ export class SecurityByDesignValidator extends BaseValidator {
         };
     }
 }
-//# sourceMappingURL=security-validators.js.map

package/dist/enforcement/validators/testing-validators.js

@@ -251,4 +251,3 @@ export class SecurityVulnerabilityReportingValidator extends BaseValidator {
         return this.createSuccessResult("Security vulnerability reporting requirements met");
     }
 }
-//# sourceMappingURL=testing-validators.js.map

package/dist/enforcement/validators/validator-registry.js

@@ -10,7 +10,7 @@
 import { NoDuplicateCodeValidator, ContextAnalysisIntegrationValidator, MemoryOptimizationValidator, DocumentationRequiredValidator, NoOverEngineeringValidator, CleanDebugLogsValidator, ConsoleLogUsageValidator, } from "./code-quality-validators.js";
 import { InputValidationValidator, SecurityByDesignValidator, } from "./security-validators.js";
 import { TestsRequiredValidator, TestCoverageValidator, ContinuousIntegrationValidator, TestFailureReportingValidator, PerformanceRegressionReportingValidator, SecurityVulnerabilityReportingValidator, } from "./testing-validators.js";
-import { DependencyManagementValidator, SrcDistIntegrityValidator, ImportConsistencyValidator, ModuleSystemConsistencyValidator, ErrorResolutionValidator, LoopSafetyValidator, StateManagementPatternsValidator, SingleResponsibilityValidator, DeploymentSafetyValidator, MultiAgentEnsembleValidator, SubstrateExternalizationValidator, FrameworkSelfValidationValidator, EmergentImprovementValidator, BootWiringValidator, } from "./architecture-validators.js";
+import { DependencyManagementValidator, SrcDistIntegrityValidator, ImportConsistencyValidator, ModuleSystemConsistencyValidator, ErrorResolutionValidator, LoopSafetyValidator, StateManagementPatternsValidator, SingleResponsibilityValidator, DeploymentSafetyValidator, MultiAgentEnsembleValidator, SubstrateExternalizationValidator, FrameworkSelfValidationValidator, EmergentImprovementValidator, } from "./architecture-validators.js";
 /**
  * Implementation of the validator registry.
  * Manages validator instances in a Map for O(1) lookup by rule ID.
@@ -67,7 +67,6 @@ export class ValidatorRegistry {
         this.register(new SubstrateExternalizationValidator());
         this.register(new FrameworkSelfValidationValidator());
         this.register(new EmergentImprovementValidator());
-        this.register(new BootWiringValidator());
         // Reporting Validators
         this.register(new PerformanceRegressionReportingValidator());
         this.register(new SecurityVulnerabilityReportingValidator());
@@ -149,4 +148,3 @@ export class ValidatorRegistry {
  * Use this for global validator management.
  */
 export const globalValidatorRegistry = new ValidatorRegistry();
-//# sourceMappingURL=validator-registry.js.map

package/dist/execution/opencode-cli-invoker.js

@@ -5,6 +5,7 @@
  * Owned by Autonomous Engine. All direct child_process and agent spawn execution here.
  * InferenceCycle is pure sensing + proposal + governance orchestration.
  */
+import * as fs from "fs";
 import * as path from "path";
 import { execSync, spawn } from "child_process";
 import { frameworkLogger } from "../core/framework-logger.js";
@@ -15,6 +16,10 @@ import { getConfigDir } from "../core/config-paths.js";
 // Module-level cache for opencode availability check
 let opencodeAvailable = null;
 export async function invokeViaOpencode(agentName, prompt, projectRoot = process.cwd()) {
+    // In pure MCP mode we must never reach here
+    if (process.env.STRRAY_FORCE_MCP_GOVERNANCE === "true") {
+        throw new Error(`[PURE MCP] invokeViaOpencode called for "${agentName}" — this path is forbidden.`);
+    }
     // GATE: Centralized spawn gate — blocks all agent spawning by default
     spawnGate.assertAllowed("opencode-cli-invoker");
     // BLOCKED: Never spawn real opencode processes during tests — causes
@@ -54,8 +59,8 @@ export async function invokeViaOpencode(agentName, prompt, projectRoot = process
             await agentSpawnGovernor.failSpawn(trackingId, new Error("opencode CLI not available"));
         throw new Error("opencode CLI is not available in PATH");
     }
-    // Resolve project root via the canonical config-path resolver
-    const opencodeRoot = path.dirname(getConfigDir(projectRoot));
+    // Resolve the actual opencode project root (where .opencode/ config lives)
+    const opencodeRoot = resolveOpencodeRoot(projectRoot);
     frameworkLogger.log("inference-cycle", "opencode-spawn-start", "info", {
         agentName,
         trackingId,
@@ -74,7 +79,7 @@ export async function invokeViaOpencode(agentName, prompt, projectRoot = process
                 settled = true;
                 child.kill("SIGKILL");
                 if (trackingId) {
-                    agentSpawnGovernor.failSpawn(trackingId, new Error(`opencode ${agentName} timed out`)).catch((err) => frameworkLogger.log("opencode-cli-invoker", "spawn-governor-error", "error", { error: String(err) }));
+                    agentSpawnGovernor.failSpawn(trackingId, new Error(`opencode ${agentName} timed out`)).catch(() => { });
                 }
                 reject(new Error(`opencode ${agentName} timed out`));
             }
@@ -98,7 +103,7 @@ export async function invokeViaOpencode(agentName, prompt, projectRoot = process
             settled = true;
             if (code === 0 && stdout.trim()) {
                 if (trackingId) {
-                    await agentSpawnGovernor.completeSpawn(trackingId, true).catch((err) => frameworkLogger.log("opencode-cli-invoker", "spawn-governor-error", "error", { error: String(err) }));
+                    await agentSpawnGovernor.completeSpawn(trackingId, true).catch(() => { });
                 }
                 frameworkLogger.log("inference-cycle", "opencode-spawn-success", "info", { agentName, trackingId });
                 const textResponse = extractTextFromNdjson(stdout.trim());
@@ -112,7 +117,7 @@ export async function invokeViaOpencode(agentName, prompt, projectRoot = process
             else {
                 const error = new Error(`${agentName} exited ${code}`);
                 if (trackingId) {
-                    await agentSpawnGovernor.failSpawn(trackingId, error).catch((err) => frameworkLogger.log("opencode-cli-invoker", "spawn-governor-error", "error", { error: String(err) }));
+                    await agentSpawnGovernor.failSpawn(trackingId, error).catch(() => { });
                 }
                 frameworkLogger.log("inference-cycle", "opencode-spawn-failed", "error", { agentName, trackingId, code });
                 reject(error);
@@ -123,7 +128,7 @@ export async function invokeViaOpencode(agentName, prompt, projectRoot = process
             if (!settled) {
                 settled = true;
                 if (trackingId) {
-                    await agentSpawnGovernor.failSpawn(trackingId, err).catch((e) => frameworkLogger.log("opencode-cli-invoker", "spawn-governor-error", "error", { error: String(e) }));
+                    await agentSpawnGovernor.failSpawn(trackingId, err).catch(() => { });
                 }
                 frameworkLogger.log("inference-cycle", "opencode-spawn-error", "error", { agentName, trackingId, error: err.message });
                 reject(err);
@@ -149,8 +154,20 @@ function extractTextFromNdjson(output) {
     }
     return texts.join("\n").trim();
 }
+function resolveOpencodeRoot(projectRoot) {
+    const configDir = getConfigDir(projectRoot);
+    let dir = projectRoot;
+    for (let i = 0; i < 10; i++) {
+        if (fs.existsSync(path.join(dir, ".opencode")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    const cwd = process.cwd();
+    if (fs.existsSync(path.join(cwd, ".opencode")))
+        return cwd;
+    return projectRoot;
+}
 // OpenCode execution owned by Autonomous Engine (thin fallback).
-// Kept as a standalone execution helper — InferenceCycle calls this directly
-// via invokeOpencodeFromEngine import. The separation is clean: this file owns
-// child_process spawn + lifecycle; InferenceCycle owns sensing + governance.
-//# sourceMappingURL=opencode-cli-invoker.js.map

package/dist/execution/proposal-applier.js

@@ -1,10 +1,21 @@
 import * as fs from "fs";
 import * as path from "path";
+import { spawnSync } from "child_process";
 import { frameworkLogger } from "../core/framework-logger.js";
+function sanitizeGitArgument(s) {
+    if (!/^[a-zA-Z0-9 \-_.\/@]+$/.test(s)) {
+        throw new Error("Invalid git argument: contains disallowed characters");
+    }
+    return s;
+}
 export class ProposalApplier {
     projectRoot;
-    constructor(projectRoot = process.cwd()) {
+    codeChangeCallback;
+    reviewCallback;
+    constructor(projectRoot = process.cwd(), codeChangeCallback, reviewCallback) {
         this.projectRoot = projectRoot;
+        this.codeChangeCallback = codeChangeCallback;
+        this.reviewCallback = reviewCallback;
     }
     async applyProposals(proposals) {
         frameworkLogger.log("execution", "proposal-applier-start", "info", {
@@ -12,26 +23,112 @@ export class ProposalApplier {
         });
         const results = [];
         for (const proposal of proposals) {
-            if (proposal.type === "codify") {
-                results.push(this.applyCodification(proposal));
+            const result = await this.applyProposal(proposal);
+            results.push(result);
+        }
+        return results;
+    }
+    async applyProposal(p) {
+        frameworkLogger.log("execution", "apply-proposal", "info", {
+            proposalId: p.id,
+            type: p.type,
+        });
+        if (p.type === "codify") {
+            return this.applyCodification(p);
+        }
+        const branchName = `inference/${p.type}-${Date.now()}`;
+        const isGit = this.isInsideGitRepo();
+        try {
+            this.recordAppliedProposal(p);
+            const changedFiles = [
+                path.relative(this.projectRoot, this.getAppliedMarkerPath(p)),
+            ];
+            if (isGit) {
+                const branchR = spawnSync('git', ['checkout', '-b', branchName], { cwd: this.projectRoot, stdio: 'pipe' });
+                if (branchR.status !== 0) {
+                    throw new Error(`git checkout -b failed: ${(branchR.stderr || '').toString().trim()}`);
+                }
             }
-            else {
-                this.recordAppliedProposal(proposal);
-                const changedFiles = [
-                    path.relative(this.projectRoot, this.getAppliedMarkerPath(proposal)),
-                ];
-                results.push({
-                    proposalId: proposal.id,
-                    success: true,
-                    filesChanged: changedFiles,
-                    details: [
-                        "Proposal recorded by Autonomous Engine (ProposalApplier)",
-                        `type=${proposal.type}`,
-                    ],
-                });
+            if (this.codeChangeCallback) {
+                const changed = await this.codeChangeCallback(p);
+                if (!changed) {
+                    if (isGit) {
+                        spawnSync('git', ['checkout', 'master'], { cwd: this.projectRoot, stdio: 'pipe' });
+                        spawnSync('git', ['branch', '-D', branchName], { cwd: this.projectRoot, stdio: 'pipe' });
+                    }
+                    return {
+                        proposalId: p.id,
+                        success: false,
+                        error: "Code change returned false (no changes applied)",
+                    };
+                }
             }
+            if (isGit) {
+                const addR = spawnSync('git', ['add', '-A'], { cwd: this.projectRoot, stdio: 'pipe' });
+                if (addR.status !== 0) {
+                    throw new Error(`git add failed: ${(addR.stderr || '').toString().trim()}`);
+                }
+                const commitR = spawnSync('git', ['commit', '-m', p.title], { cwd: this.projectRoot, stdio: 'pipe' });
+                if (commitR.status !== 0) {
+                    throw new Error(`git commit failed: ${(commitR.stderr || '').toString().trim()}`);
+                }
+                const prUrl = this.createPR(p, branchName);
+                if (prUrl) {
+                    frameworkLogger.log("execution", "pr-created", "info", {
+                        prUrl,
+                        proposalId: p.id,
+                    });
+                }
+                if (this.reviewCallback && prUrl) {
+                    const review = await this.reviewCallback(p, prUrl);
+                    if (review === "no-go") {
+                        frameworkLogger.log("execution", "review-no-go", "warning", {
+                            proposalId: p.id,
+                            prUrl,
+                        });
+                        spawnSync('git', ['checkout', 'master'], { cwd: this.projectRoot, stdio: 'pipe' });
+                        spawnSync('git', ['branch', '-D', branchName], { cwd: this.projectRoot, stdio: 'pipe' });
+                        return {
+                            proposalId: p.id,
+                            success: false,
+                            error: "Researcher review rejected proposal",
+                        };
+                    }
+                }
+                spawnSync('git', ['checkout', 'master'], { cwd: this.projectRoot, stdio: 'pipe' });
+            }
+            return {
+                proposalId: p.id,
+                success: true,
+                filesChanged: changedFiles,
+                details: [
+                    "Proposal applied by Autonomous Engine (ProposalApplier)",
+                    isGit ? `branch=${branchName}` : "non-git (marker only)",
+                    `type=${p.type}`,
+                ],
+            };
+        }
+        catch (err) {
+            const errorMsg = err.message;
+            frameworkLogger.log("execution", "apply-proposal-error", "error", {
+                proposalId: p.id,
+                error: errorMsg,
+            });
+            if (isGit) {
+                try {
+                    spawnSync('git', ['checkout', 'master'], { cwd: this.projectRoot, stdio: 'pipe' });
+                    spawnSync('git', ['branch', '-D', branchName], { cwd: this.projectRoot, stdio: 'pipe' });
+                }
+                catch {
+                    // ignore cleanup
+                }
+            }
+            return {
+                proposalId: p.id,
+                success: false,
+                error: errorMsg,
+            };
         }
-        return results;
     }
     applyCodification(p) {
         try {
@@ -62,6 +159,19 @@ export class ProposalApplier {
             return { proposalId: p.id, success: false, error: errorMsg };
         }
     }
+    isInsideGitRepo() {
+        try {
+            const r = spawnSync('git', ['rev-parse', '--is-inside-work-tree'], {
+                cwd: this.projectRoot,
+                stdio: 'pipe',
+                timeout: 2000,
+            });
+            return r.status === 0;
+        }
+        catch {
+            return false;
+        }
+    }
     getAppliedMarkerPath(p) {
         const appliedDir = path.join(this.projectRoot, "docs", "inference", "applied");
         if (!fs.existsSync(appliedDir)) {
@@ -96,5 +206,49 @@ export class ProposalApplier {
             module: "v2-refactor",
         });
     }
+    createPR(p, branchName) {
+        try {
+            sanitizeGitArgument(p.title);
+            sanitizeGitArgument(branchName);
+            const pushR = spawnSync('git', ['push', '-u', 'origin', branchName], {
+                cwd: this.projectRoot,
+                stdio: 'pipe',
+                timeout: 30000,
+            });
+            if (pushR.status !== 0) {
+                throw new Error(`git push failed: ${(pushR.stderr || '').toString().trim()}`);
+            }
+            const body = [
+                "## Inference Proposal (Autonomous Engine)",
+                "",
+                p.description,
+                "",
+                `**Type:** ${p.type}  **Confidence:** ${(p.confidence * 100).toFixed(0)}%`,
+                "",
+                "## Evidence",
+                p.evidence.slice(0, 5).join("\n"),
+                "",
+                "Executed by ProposalApplier (Engine-owned) — V2 Phase 1.",
+            ].join("\n");
+            const ghR = spawnSync('gh', ['pr', 'create', '--head', branchName, '--title', p.title, '--body', body], {
+                cwd: this.projectRoot,
+                encoding: 'utf-8',
+                stdio: 'pipe',
+                timeout: 30000,
+            });
+            if (ghR.status !== 0) {
+                throw new Error(`gh pr create failed: ${ghR.stderr || 'unknown error'}`);
+            }
+            return (ghR.stdout || '').trim();
+        }
+        catch (err) {
+            frameworkLogger.log("execution", "pr-create-failed", "warning", {
+                error: String(err),
+                proposalId: p.id,
+                module: "v2-refactor",
+            });
+            return "";
+        }
+    }
 }
-//# sourceMappingURL=proposal-applier.js.map
+export const proposalApplier = new ProposalApplier();

package/dist/governance/codex-policy.service.js

@@ -1,15 +1,32 @@
 /**
  * CodexPolicyService
  *
- * Governance-owned Single Source of Truth (SSOT) for Codex / policy loading.
+ * The initial Governance-owned Single Source of Truth (SSOT) for Codex / policy loading.
+ * This is the V2-P1-S02-REAL first concrete migration slice.
  *
- * Role: External Governance owns "what the policy is".
- * Consumers (enforcers, injectors, formatters, MCPs, plugins) should ask here
- * instead of direct fs reads or scattered loaders.
+ * Role (per 3-subsystem architecture + researcher mapping):
+ *   - External Governance (Decision Layer & SSOT) owns "what the policy is".
+ *   - All consumers (enforcement CodexLoader, injectors, formatters, MCP surfaces, plugins)
+ *     will eventually ask here instead of performing direct fs reads.
  *
- * Provides read-only ActiveCodexSnapshot and term count.
- * Uses canonical resolveCodexPath.
- * Full frameworkLogger on all paths.
+ * Current scope (minimal safe skeleton):
+ *   - Read-only query surface.
+ *   - Uses canonical resolveCodexPath + async file load (no duplication of resolution logic).
+ *   - Returns ActiveCodexSnapshot compatible with the existing get_active_codex MCP tool.
+ *   - Provides getTermCount() with safe 60-term fallback (preserves prior behavior of bypasses).
+ *   - Full frameworkLogger discipline on every load/decision/error.
+ *   - No caching in v1 skeleton (additive later); no mutation; no enforcement.
+ *
+ * First wired consumer: src/mcps/enforcer-tools.server.ts (getCodexTermCount bypass removed;
+ * now delegates through this service).
+ *
+ * Next recommended slices (documented in researcher mapping append):
+ *   - Wire governance.server.ts handleGetActiveCodex to delegate (remove its direct read).
+ *   - S02b/S02c follow-ups: update codex-injector, context-loader, codex-formatter, plugin.
+ *   - Make CodexLoader delegate its raw data load here, then re-export from governance.
+ *
+ * @module governance/codex-policy.service
+ * @version 2.0.0-s02-real
  */
 import { frameworkLogger } from '../core/framework-logger.js';
 import { resolveCodexPath } from '../core/config-paths.js';
@@ -103,7 +120,7 @@ export class CodexPolicyService {
             is_fallback: isFallback,
             note: isFallback
                 ? 'Governance CodexPolicyService — builtin fallback (no external codex.json resolved)'
-                : 'Returned via Governance CodexPolicyService',
+                : 'Returned via Governance CodexPolicyService — V2 Single Source of Truth (S02-REAL)',
             dynamo_required: true,
             ...(includeRaw ? { codex: data } : {}),
         };
@@ -147,4 +164,4 @@ export function getCodexPolicyService() {
     return codexPolicyServiceInstance;
 }
 // Also export the class for direct construction in tests / advanced wiring
-//# sourceMappingURL=codex-policy.service.js.map
+export { CodexPolicyService as default };