@ai-sdlc/orchestrator 0.9.0 → 0.13.0

package/dist/__test-helpers/git-env.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Hermetic git env for orchestrator test fixtures (AISDLC-257).
+ *
+ * Cross-link: mirrors `pipeline-cli/src/__test-helpers/git-env.ts` (AISDLC-253).
+ * See that file for the canonical rationale. This copy exists so orchestrator
+ * tests don't take a cross-package import dependency on pipeline-cli's test
+ * helpers.
+ *
+ * Why this exists
+ * ───────────────
+ * Test fixtures that shell out to `git` (e.g. `execSync('git init', { cwd: d })`)
+ * are vulnerable to env-var bleed from the parent shell:
+ *
+ *   - `GIT_DIR=...` overrides cwd-based repo discovery — every git command
+ *     writes into the parent shell's GIT_DIR, NOT the fixture's `cwd`.
+ *   - `GIT_WORK_TREE=...` ditto for the working tree.
+ *   - `core.hooksPath` from system/global config can fire husky hooks during
+ *     fixture commits.
+ *   - `commit.gpgsign=true` from operator config can break unattended commits.
+ *
+ * The `cleanGitEnv()` helper in `orchestrator/src/runtime/git-env.ts` strips
+ * GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE but still inherits `process.env`
+ * in full, meaning `git config user.email` writes still land wherever git
+ * resolves config (which may be a polluted GIT_DIR or the operator's global
+ * config). AISDLC-257 identified `worktree-pool.integration.test.ts` as the
+ * confirmed leak source.
+ *
+ * `makeGitEnv()` uses an ALLOW-LIST approach rather than a DENY-LIST: it
+ * constructs a minimal env from scratch, deliberately omitting GIT_DIR and
+ * GIT_WORK_TREE. Identity is provided via `GIT_AUTHOR_*` / `GIT_COMMITTER_*`
+ * env vars so fixtures never need `git config user.email`.
+ *
+ * Pattern (matches pipeline-cli AISDLC-253 + orchestrator AISDLC-241/246):
+ *
+ *   const env = makeGitEnv();
+ *   execSync('git init -b main', { cwd: repoDir, env, stdio: 'pipe' });
+ *   // No `git config user.email` needed — identity comes from GIT_AUTHOR_*
+ */
+export declare function makeGitEnv(): NodeJS.ProcessEnv;
+//# sourceMappingURL=git-env.d.ts.map

package/dist/__test-helpers/git-env.js

@@ -0,0 +1,73 @@
+/**
+ * Hermetic git env for orchestrator test fixtures (AISDLC-257).
+ *
+ * Cross-link: mirrors `pipeline-cli/src/__test-helpers/git-env.ts` (AISDLC-253).
+ * See that file for the canonical rationale. This copy exists so orchestrator
+ * tests don't take a cross-package import dependency on pipeline-cli's test
+ * helpers.
+ *
+ * Why this exists
+ * ───────────────
+ * Test fixtures that shell out to `git` (e.g. `execSync('git init', { cwd: d })`)
+ * are vulnerable to env-var bleed from the parent shell:
+ *
+ *   - `GIT_DIR=...` overrides cwd-based repo discovery — every git command
+ *     writes into the parent shell's GIT_DIR, NOT the fixture's `cwd`.
+ *   - `GIT_WORK_TREE=...` ditto for the working tree.
+ *   - `core.hooksPath` from system/global config can fire husky hooks during
+ *     fixture commits.
+ *   - `commit.gpgsign=true` from operator config can break unattended commits.
+ *
+ * The `cleanGitEnv()` helper in `orchestrator/src/runtime/git-env.ts` strips
+ * GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE but still inherits `process.env`
+ * in full, meaning `git config user.email` writes still land wherever git
+ * resolves config (which may be a polluted GIT_DIR or the operator's global
+ * config). AISDLC-257 identified `worktree-pool.integration.test.ts` as the
+ * confirmed leak source.
+ *
+ * `makeGitEnv()` uses an ALLOW-LIST approach rather than a DENY-LIST: it
+ * constructs a minimal env from scratch, deliberately omitting GIT_DIR and
+ * GIT_WORK_TREE. Identity is provided via `GIT_AUTHOR_*` / `GIT_COMMITTER_*`
+ * env vars so fixtures never need `git config user.email`.
+ *
+ * Pattern (matches pipeline-cli AISDLC-253 + orchestrator AISDLC-241/246):
+ *
+ *   const env = makeGitEnv();
+ *   execSync('git init -b main', { cwd: repoDir, env, stdio: 'pipe' });
+ *   // No `git config user.email` needed — identity comes from GIT_AUTHOR_*
+ */
+export function makeGitEnv() {
+    return {
+        // Minimal OS plumbing.
+        PATH: process.env['PATH'] ?? '/usr/bin:/bin',
+        HOME: process.env['HOME'] ?? '/tmp',
+        ...(process.env['TMPDIR'] ? { TMPDIR: process.env['TMPDIR'] } : {}),
+        ...(process.env['TEMP'] ? { TEMP: process.env['TEMP'] } : {}),
+        ...(process.env['TMP'] ? { TMP: process.env['TMP'] } : {}),
+        // Locale — prevent non-ASCII error strings in git output.
+        LANG: process.env['LANG'] ?? 'en_US.UTF-8',
+        LC_ALL: 'C',
+        // Git identity — supplied via env so `git config user.email/user.name`
+        // is never needed inside the fixture (those writes would land in either
+        // the fixture's .git/config or, if GIT_DIR is polluted, in the host
+        // worktree's config).
+        GIT_AUTHOR_NAME: 'Test',
+        GIT_AUTHOR_EMAIL: 'test@test.invalid',
+        GIT_COMMITTER_NAME: 'Test',
+        GIT_COMMITTER_EMAIL: 'test@test.invalid',
+        // Disable system + global git config to prevent gpgsign / hookPath /
+        // user-config bleed from the operator's machine.
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: '/dev/null',
+        // Disable husky so the calling project's pre-commit hooks don't fire.
+        HUSKY: '0',
+        // Suppress credential helpers / interactive prompts.
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_SSH_COMMAND: 'ssh -o BatchMode=yes',
+        // Note: deliberately NO `GIT_DIR` / `GIT_WORK_TREE` keys — by omitting
+        // them from the returned object, child processes inherit nothing for
+        // those vars (the env REPLACES the parent's env when passed to execSync,
+        // it doesn't merge). That's the load-bearing guarantee against the leak.
+    };
+}
+//# sourceMappingURL=git-env.js.map

package/dist/adapters.d.ts

@@ -4,7 +4,7 @@
  * into the dogfood pipeline.
  */
 import type { AiSdlcConfig } from './config.js';
-import { type IssueTracker, type AdapterRegistry, type ScanOptions, type ScanResult, type WebhookBridge, type GitAdapterFetcher, type GitResolveResult, type AuditLog, type AuditSink, type Sandbox, type SecretStore, type MemoryStore, type EventBus, type CIPipeline } from '@ai-sdlc/reference';
+import { type IssueTracker, type SourceControl, type AdapterRegistry, type ScanOptions, type ScanResult, type WebhookBridge, type GitAdapterFetcher, type GitResolveResult, type AuditLog, type AuditSink, type Sandbox, type SecretStore, type MemoryStore, type EventBus, type CIPipeline } from '@ai-sdlc/reference';
 /**
  * Create an adapter registry pre-loaded with all built-in and community adapters.
  */
@@ -70,6 +70,45 @@ export declare function resolveIssueTrackerFromConfig(config: AiSdlcConfig, fall
         secretRef: string;
     };
 }): IssueTracker;
-export { createGitHubCIPipeline, createDockerSandbox, createLinearIssueTracker, resolveSecret, createGitLabSourceControl, createGitLabCIPipeline, createJiraIssueTracker, createBacklogMdIssueTracker, createWebhookServer, createGitHubWebhookProvider, verifyGitHubSignature, createGitLabWebhookProvider, verifyGitLabToken, createJiraWebhookProvider, createLinearWebhookProvider, verifyLinearSignature, createAdapterRegistry, validateAdapterMetadata, parseMetadataYaml, scanLocalAdapters, createStubCodeAnalysis, createStubMessenger, createStubDeploymentTarget, createStubGitLabCI, createStubGitLabSource, createStubJira, createStubBitbucket, createStubSonarQube, createStubSemgrep, createInMemoryAuditSink, createFileSink, createEnvSecretStore, createInMemoryMemoryStore, createInProcessEventBus, createStubSandbox, createCompositeIssueTracker, createWebhookBridge, parseGitAdapterRef, buildRawUrl, createGitAdapterFetcher, createStubGitAdapterFetcher, resolveGitAdapter, } from '@ai-sdlc/reference';
-export type { AdapterRegistry, AdapterMetadata, AdapterStability, AdapterFactory, MetadataValidationResult, ScanOptions, ScanResult, WebhookBridge, WebhookTransformer, GitAdapterReference, GitAdapterFetcher, GitResolveResult, CIPipeline, CodeAnalysis, Messenger, DeploymentTarget, EventBus, IssueTracker, LinearClientLike, IssueComment, AdapterInterfaces, EventStream, IssueFilter, CommitStatus, TestResults, CoverageReport, Finding, SeveritySummary, DeploymentStatus, StubCodeAnalysisConfig, StubCodeAnalysisAdapter, NotificationLogEntry, StubMessengerAdapter, StubDeploymentTargetAdapter, StubGitLabCIAdapter, StubGitLabSourceAdapter, StubJiraAdapter, StubBitbucketAdapter, StubSonarQubeConfig, StubSonarQubeAdapter, StubSemgrepConfig, StubSemgrepAdapter, AuditSink, AuditLog, InMemoryAuditSink, SecretStore, Sandbox, MemoryStore, InMemoryMemoryStore, InProcessEventBus, DockerSandboxConfig, BuildStatus, GitLabConfig, JiraConfig, BacklogMdConfig, BacklogFs, WebhookServer, WebhookServerConfig, WebhookProviderConfig, GitHubWebhookConfig, GitHubWebhookBridges, GitLabWebhookConfig, JiraWebhookConfig, LinearWebhookConfig, CompositeIssueTrackerConfig, BackendRoute, } from '@ai-sdlc/reference';
+/**
+ * A no-op SourceControl adapter for local-only repositories (no remote).
+ *
+ * When an adopter has no 'origin' remote (or sets `type: local` in their
+ * AdapterBinding), the pipeline must not block on API calls. This adapter:
+ *
+ * - `createBranch` — delegates to the local git command-line (via execute.ts)
+ *   so the branch checkout path works unchanged.
+ * - `createPR` — resolves immediately with a sentinel local PR object; the
+ *   caller (execute.ts step 15) should check `pr.url` to detect the skip.
+ * - All other methods are no-ops.
+ *
+ * Callers detect local-only mode by checking `pr.url === 'local'` and skip
+ * tracker comments + Slack notifications for the PR URL.
+ */
+export declare function createLocalSourceControl(): SourceControl;
+/**
+ * Resolve a SourceControl adapter from the AdapterBinding whose
+ * `spec.interface === 'SourceControl'`.
+ *
+ * Resolution order (first wins):
+ *   1. `type: github` → existing GitHub adapter using `spec.config` or fallback.
+ *   2. `type: gitlab` → GitLab adapter with `spec.config.url` (required for
+ *      self-hosted) and optional `spec.config.token.secretRef`.
+ *   3. `type: local`  → local-only no-op adapter that skips push/create-pr.
+ *   4. No SourceControl AdapterBinding present → GitHub (current default, no regression).
+ *
+ * When multiple SourceControl bindings exist, the FIRST one wins.  This is an
+ * intentional design choice — multiple SourceControl bindings are unusual and
+ * the pipeline has a single active remote. If this constraint is too tight,
+ * escalate to the Decision Catalog before changing it.
+ */
+export declare function resolveSourceControlFromConfig(config: AiSdlcConfig, fallbackGitHubConfig: {
+    org: string;
+    repo: string;
+    token: {
+        secretRef: string;
+    };
+}): SourceControl;
+export { createGitHubCIPipeline, createGitHubSourceControl, createDockerSandbox, createLinearIssueTracker, resolveSecret, createGitLabSourceControl, createGitLabCIPipeline, createJiraIssueTracker, createBacklogMdIssueTracker, createWebhookServer, createGitHubWebhookProvider, verifyGitHubSignature, createGitLabWebhookProvider, verifyGitLabToken, createJiraWebhookProvider, createLinearWebhookProvider, verifyLinearSignature, createAdapterRegistry, validateAdapterMetadata, parseMetadataYaml, scanLocalAdapters, createStubCodeAnalysis, createStubMessenger, createStubDeploymentTarget, createStubGitLabCI, createStubGitLabSource, createStubJira, createStubBitbucket, createStubSonarQube, createStubSemgrep, createInMemoryAuditSink, createFileSink, createEnvSecretStore, createInMemoryMemoryStore, createInProcessEventBus, createStubSandbox, createCompositeIssueTracker, createWebhookBridge, parseGitAdapterRef, buildRawUrl, createGitAdapterFetcher, createStubGitAdapterFetcher, resolveGitAdapter, } from '@ai-sdlc/reference';
+export type { AdapterRegistry, AdapterMetadata, AdapterStability, AdapterFactory, MetadataValidationResult, ScanOptions, ScanResult, WebhookBridge, WebhookTransformer, GitAdapterReference, GitAdapterFetcher, GitResolveResult, CIPipeline, SourceControl, CodeAnalysis, Messenger, DeploymentTarget, EventBus, IssueTracker, LinearClientLike, IssueComment, AdapterInterfaces, EventStream, IssueFilter, CommitStatus, TestResults, CoverageReport, Finding, SeveritySummary, DeploymentStatus, StubCodeAnalysisConfig, StubCodeAnalysisAdapter, NotificationLogEntry, StubMessengerAdapter, StubDeploymentTargetAdapter, StubGitLabCIAdapter, StubGitLabSourceAdapter, StubJiraAdapter, StubBitbucketAdapter, StubSonarQubeConfig, StubSonarQubeAdapter, StubSemgrepConfig, StubSemgrepAdapter, AuditSink, AuditLog, InMemoryAuditSink, SecretStore, Sandbox, MemoryStore, InMemoryMemoryStore, InProcessEventBus, DockerSandboxConfig, BuildStatus, GitLabConfig, JiraConfig, BacklogMdConfig, BacklogFs, WebhookServer, WebhookServerConfig, WebhookProviderConfig, GitHubWebhookConfig, GitHubWebhookBridges, GitLabWebhookConfig, JiraWebhookConfig, LinearWebhookConfig, CompositeIssueTrackerConfig, BackendRoute, } from '@ai-sdlc/reference';
 //# sourceMappingURL=adapters.d.ts.map

package/dist/adapters.js

@@ -24,8 +24,10 @@ createWebhookBridge,
 createStubGitAdapterFetcher, createGitAdapterFetcher, resolveGitAdapter, 
 // GitHub CI adapter
 createGitHubCIPipeline, 
-// GitHub issue tracker
-createGitHubIssueTracker, 
+// GitHub source control + issue tracker
+createGitHubSourceControl, createGitHubIssueTracker, 
+// GitLab source control
+createGitLabSourceControl, 
 // Composite issue tracker
 createCompositeIssueTracker, 
 // Production adapters (for resolveIssueTrackerFromConfig)
@@ -228,10 +230,138 @@ export function resolveIssueTrackerFromConfig(config, fallbackGitHubConfig) {
     }
     return createCompositeIssueTracker({ backends });
 }
+// ── Source-control resolution from config ────────────────────────────
+/**
+ * A no-op SourceControl adapter for local-only repositories (no remote).
+ *
+ * When an adopter has no 'origin' remote (or sets `type: local` in their
+ * AdapterBinding), the pipeline must not block on API calls. This adapter:
+ *
+ * - `createBranch` — delegates to the local git command-line (via execute.ts)
+ *   so the branch checkout path works unchanged.
+ * - `createPR` — resolves immediately with a sentinel local PR object; the
+ *   caller (execute.ts step 15) should check `pr.url` to detect the skip.
+ * - All other methods are no-ops.
+ *
+ * Callers detect local-only mode by checking `pr.url === 'local'` and skip
+ * tracker comments + Slack notifications for the PR URL.
+ */
+export function createLocalSourceControl() {
+    return {
+        async createBranch(input) {
+            // Branches are created via git CLI in execute.ts; this is a passthrough stub.
+            return { name: input.name, sha: '' };
+        },
+        async createPR(_input) {
+            // Sentinel URL signals to the pipeline that we are in local-only mode and
+            // no remote PR was created. The pipeline checks for this and skips the
+            // "PR created" comment + Slack notification (avoiding noise).
+            return {
+                id: 'local',
+                title: _input.title,
+                sourceBranch: _input.sourceBranch,
+                targetBranch: _input.targetBranch ?? 'main',
+                status: 'open',
+                author: 'local',
+                url: 'local',
+            };
+        },
+        async mergePR(_id, _strategy) {
+            return { sha: '', merged: false };
+        },
+        async getFileContents(_path, _ref) {
+            throw new Error('getFileContents: local-only source control has no remote to read from');
+        },
+        async listChangedFiles(_prId) {
+            return [];
+        },
+        async setCommitStatus(_sha, _status) {
+            /* no-op: no remote to post status to */
+        },
+        watchPREvents(_filter) {
+            return {
+                async *[Symbol.asyncIterator]() {
+                    /* no-op: no remote events in local-only mode */
+                },
+            };
+        },
+    };
+}
+/**
+ * Resolve a SourceControl adapter from the AdapterBinding whose
+ * `spec.interface === 'SourceControl'`.
+ *
+ * Resolution order (first wins):
+ *   1. `type: github` → existing GitHub adapter using `spec.config` or fallback.
+ *   2. `type: gitlab` → GitLab adapter with `spec.config.url` (required for
+ *      self-hosted) and optional `spec.config.token.secretRef`.
+ *   3. `type: local`  → local-only no-op adapter that skips push/create-pr.
+ *   4. No SourceControl AdapterBinding present → GitHub (current default, no regression).
+ *
+ * When multiple SourceControl bindings exist, the FIRST one wins.  This is an
+ * intentional design choice — multiple SourceControl bindings are unusual and
+ * the pipeline has a single active remote. If this constraint is too tight,
+ * escalate to the Decision Catalog before changing it.
+ */
+export function resolveSourceControlFromConfig(config, fallbackGitHubConfig) {
+    const bindings = (config.adapterBindings ?? []).filter((b) => b.spec.interface === 'SourceControl');
+    if (bindings.length === 0) {
+        // No SourceControl binding — default to GitHub exactly as before (AC #2).
+        return createGitHubSourceControl(fallbackGitHubConfig);
+    }
+    // First binding wins (see JSDoc above for rationale).
+    const binding = bindings[0];
+    const cfg = binding.spec.config ?? {};
+    switch (binding.spec.type) {
+        case 'github': {
+            // Honor spec.config.token.secretRef when present (consistent with the GitLab case).
+            // Fall back to the fallback token so existing GitHub adopters are unaffected.
+            const tokenSecretRef = cfg.token?.secretRef ??
+                fallbackGitHubConfig.token.secretRef;
+            return createGitHubSourceControl({
+                org: cfg.org ?? fallbackGitHubConfig.org,
+                repo: cfg.repo ?? fallbackGitHubConfig.repo,
+                token: { secretRef: tokenSecretRef },
+            });
+        }
+        case 'gitlab': {
+            // `url` is required for self-hosted GitLab; defaults to gitlab.com for SaaS.
+            const baseUrl = cfg.url ?? 'https://gitlab.com';
+            // projectId is required — an empty value produces confusing API responses
+            // (encodeURIComponent('') → '' → the request hits /api/v4/projects/ which
+            // returns the list of all projects, not the configured one).
+            const projectId = cfg.projectId;
+            if (!projectId && projectId !== 0) {
+                throw new Error(`SourceControl AdapterBinding '${binding.metadata.name}' (type: gitlab) is missing a required ` +
+                    `spec.config.projectId. Set it to the numeric project ID or the URL-encoded path ` +
+                    `(e.g. "group%2Fsubgroup%2Fproject" or 12345).`);
+            }
+            // Token: use secretRef from config if present, else fall back to env GITLAB_TOKEN.
+            const tokenSecretRef = cfg.token?.secretRef ?? 'gitlab-token';
+            const gitLabCfg = {
+                baseUrl,
+                projectId,
+                token: { secretRef: tokenSecretRef },
+            };
+            return createGitLabSourceControl(gitLabCfg);
+        }
+        case 'local': {
+            return createLocalSourceControl();
+        }
+        default: {
+            // Unknown type — emit a warning so mistyped types (e.g. 'bitbucket') surface
+            // visibly, then fall back to GitHub so the pipeline keeps running.
+            console.warn(`[ai-sdlc] SourceControl AdapterBinding '${binding.metadata.name}' has unknown type ` +
+                `'${binding.spec.type}'. Falling back to the GitHub adapter. ` +
+                `Supported types: github, gitlab, local.`);
+            return createGitHubSourceControl(fallbackGitHubConfig);
+        }
+    }
+}
 // Direct re-exports (passthrough)
 export { 
 // Core adapters
-createGitHubCIPipeline, createDockerSandbox, createLinearIssueTracker, resolveSecret, 
+createGitHubCIPipeline, createGitHubSourceControl, createDockerSandbox, createLinearIssueTracker, resolveSecret, 
 // Production adapters
 createGitLabSourceControl, createGitLabCIPipeline, createJiraIssueTracker, 
 // Backlog.md adapter

package/dist/admission-composite.d.ts

@@ -1,5 +1,5 @@
 /**
- * Admission-subset composite (RFC-0008 §A.6).
+ * Admission-subset composite (RFC-0008 §A.6 + RFC-0009 Phase 2.1).
  *
  * The admission gate uses a subset of the full PPA composite:
  *
@@ -23,10 +23,18 @@
  * The `override` bypass is preserved at position 1: when the input has
  * `override: true`, we return `composite = Infinity` without running
  * the admission math — identical to the legacy PPA behaviour.
+ *
+ * **RFC-0009 Phase 2.1 tessellation extension:**
+ * When `AdmissionCompositeOptions.tessellationContext` is provided, the
+ * composite routes SA and Eρ₄ (designSystemReadiness) through soul scope
+ * per RFC-0009 §6. See `tessellation-admission.ts` for the routing algorithm.
  */
 import type { PriorityConfig, PriorityInput, PriorityScore } from '@ai-sdlc/reference';
 import type { AdmissionInput } from './admission-score.js';
 import { type AdmissionHumanCurveResult } from './admission-hc.js';
+import { type TessellationContext, type TessellatedSaResult } from './tessellation-admission.js';
+import { type VariantContext, type VariantScopedSaResult } from './variant-admission.js';
+import { type ComplianceClearanceContext, type ComplianceClearanceResult } from './compliance-clearance.js';
 /**
  * Result of the admission composite — returns a `PriorityScore`
  * (backward-compatible with `scoreIssueForAdmission` consumers) plus
@@ -44,6 +52,33 @@ export interface AdmissionComposite {
         designSystemReadiness: number;
         executionReality: number;
         humanCurve: AdmissionHumanCurveResult;
+        /**
+         * RFC-0009 Phase 2.1 — tessellation routing result.
+         * Present when `AdmissionCompositeOptions.tessellationContext` was
+         * supplied. Absent (undefined) when the single-DID path was used.
+         */
+        tessellation?: TessellatedSaResult;
+        /**
+         * RFC-0017 Phase 2 — variant routing result.
+         * Present when `AdmissionCompositeOptions.variantContext` was supplied.
+         * Absent (undefined) when the single-soul path was used (backward-compat).
+         *
+         * `variantScopedSa` represents the variant-resolved soul-alignment value
+         * that REPLACED the tessellation/soul-aggregate `soulAlignment` when the
+         * work item declared `targetedVariants` of one of the affected souls.
+         */
+        variant?: VariantScopedSaResult;
+        /**
+         * RFC-0009 Phase 4.1 — Eρ₅ Compliance Clearance result.
+         * Present when `AdmissionCompositeOptions.complianceClearanceContext`
+         * was supplied AND the adopter has opted in (`enabled: true`).
+         *
+         * When `er5 === 0` the composite is GATED to zero — the work item cannot
+         * proceed without resolving the violation. The `routingPath` field
+         * surfaces the decision branch for audit purposes; when the adopter has
+         * not opted in, the breakdown field is elided (backward-compat).
+         */
+        complianceClearance?: ComplianceClearanceResult;
     };
 }
 export interface AdmissionCompositeOptions {
@@ -62,6 +97,104 @@ export interface AdmissionCompositeOptions {
      * cannot extract. Only fields with defined values overwrite.
      */
     priorityInputOverrides?: Partial<PriorityInput>;
+    /**
+     * RFC-0009 Phase 2.1 — Tessellated DID context.
+     *
+     * When present, SA and Eρ₄ (designSystemReadiness) are computed using
+     * soul-scope routing per RFC-0009 §6 instead of the platform-aggregate
+     * DSB. The routing algorithm:
+     *
+     *   resolveAffectedSouls(w) → scope filter from dep-graph snapshot
+     *   |souls| == 0 → min over ALL souls (substrate-only degenerate)
+     *   |souls| == 1 → score against that soul's DSB
+     *   |souls| > 1 → crossSoulScoringRule (default `min`) over affected souls
+     *
+     * @see tessellation-admission.ts + spec/rfcs/RFC-0009 §6
+     */
+    tessellationContext?: TessellationContext;
+    /**
+     * RFC-0017 Phase 2 — variant-scope routing context.
+     *
+     * When present AND the work item declares `targetedVariants[]` of one of
+     * the affected souls, the composite's `soulAlignment` value is REFINED
+     * by per-variant Sα₁ + Sα₂ scoring per RFC-0017 §5.4:
+     *
+     *   resolveTargetedVariants(w) → variant scope filter from work-item targeting
+     *   |targets| == 0  → backward-compat: soul-aggregate Sα/Eρ₄ unchanged
+     *   |targets| == 1  → variant's per-variant Sα₁ + Sα₂ replaces soul-aggregate
+     *   |targets| > 1   → crossVariantAggregation (default `min`) over targeted variants
+     *
+     * Composes cleanly with `tessellationContext` — soul-scope tessellation runs
+     * first, then variant routing refines the resulting Sα/Eρ₄ to variant scope.
+     * Work items WITHOUT `targetedVariants` preserve the tessellation result
+     * unchanged (backward-compat per RFC-0017 §7).
+     *
+     * @see variant-admission.ts + spec/rfcs/RFC-0017 §5.4 + §6.2
+     */
+    variantContext?: VariantContext;
+    /**
+     * RFC-0009 Phase 4.1 — Eρ₅ Compliance Clearance context.
+     *
+     * When present AND `enabled: true`, the admission composite applies the
+     * Eρ₅ multiplier (categorical 0/1 gating) per RFC-0009 §7.1:
+     *
+     *   Eρ₅ = 0 if any declared regime is violated → composite gated to 0
+     *   Eρ₅ = 1 otherwise → composite unchanged
+     *
+     * When absent OR `enabled: false`, Eρ₅ is not applied — backward-compatible
+     * with Phase 2/3 behavior. The opt-in gate is intentional per RFC-0009 §10
+     * Phase 4; promotion to default-on is subject to ecosystem feedback.
+     *
+     * The regime set is the union of (a) each affected soul's
+     * `triad.engineering.complianceRegimes` (passed through
+     * `perSoulRegimes`) and (b) any RFC-0022 `CompliancePosture` regimes
+     * (passed through `posture`). Both pass the OQ-5 hard-regulatory scope
+     * filter; soft regimes are filtered at declaration time.
+     *
+     * Composes with `tessellationContext` — the soul scope from tessellation
+     * routing is used to select which souls' regimes apply to this work item.
+     *
+     * @see compliance-clearance.ts + spec/rfcs/RFC-0009 §7.1 + §10
+     * @see spec/rfcs/RFC-0022 (consumption surface)
+     */
+    complianceClearanceContext?: ComplianceClearanceContext;
 }
 export declare function computeAdmissionComposite(input: AdmissionInput, config?: PriorityConfig, options?: AdmissionCompositeOptions): AdmissionComposite;
+/**
+ * Combine variant-scope Sα₁ (audience resonance) + Sα₂ (vibe coherence) into
+ * a single soul-alignment value for the admission composite's SA pillar.
+ *
+ * The legacy admission composite uses a single `soulAlignment` scalar that
+ * conceptually rolls Sα₁ + Sα₂ together (RFC-0008 §A.6 SA pillar). When
+ * variant routing splits them out per RFC-0017 §5.4, we recombine via the
+ * arithmetic mean — equal weighting matches the soul-aggregate combination
+ * implied by `pillar-breakdown.ts` and avoids favouring one Sα facet over
+ * the other when both are equally variant-bounded.
+ *
+ * Exported for unit testing + so downstream callers can replicate the
+ * combination logic if they need to surface the constituent pieces.
+ */
+export declare function combineVariantSaForSoulAlignment(sa1: number, sa2: number): number;
+/**
+ * Compute admission confidence in [0, 1] as a 50/50 blend of two
+ * independent evidence channels:
+ *
+ *   1. **Mapper coverage** — fraction of `ADMISSION_MAPPER_FIELDS`
+ *      explicitly populated on the derived `PriorityInput`. Captures
+ *      "how much issue/backlog signal did `mapIssueToPriorityInput`
+ *      extract".
+ *
+ *   2. **Enrichment loaded** — fraction of RFC-0008 enrichment slots
+ *      present on the input (or supplied via `options`). Captures "how
+ *      much external context did the enrichment readers contribute".
+ *
+ * Bug fixed (AISDLC-172 / RFC-0009 §13 OQ-9): previously
+ * `computeConfidence(priorityInput)` from `priority.ts` was used, which
+ * counts against the full 16-field `SCORABLE_FIELDS` list and ignores
+ * enrichment success entirely. The result was a hard ~0.5 ceiling on
+ * admit confidence even when DID + DSB + maintainers + soul-tracks all
+ * loaded — those four positive observations contributed exactly zero
+ * to the formula's denominator and zero to its numerator.
+ */
+export declare function computeAdmissionConfidence(input: AdmissionInput, priorityInput: PriorityInput, options?: AdmissionCompositeOptions): number;
 //# sourceMappingURL=admission-composite.d.ts.map