@aiwg/cli 2026.10.10 → 2026.10.12

package/dist/src/decision/ensemble/contract.js

@@ -1,3 +1,4 @@
+import { assertDecisionCeiling, ceilingDecision, GATE_RANK, GateDecisionUpgradeError } from '../../gates/lattice.js';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
@@ -10,8 +11,8 @@ import { admitEntry } from '../entry.js';
 export class EnsembleContractError extends Error {
     layer;
     details;
-    constructor(message, layer = 'semantic', details = []) {
-        super(message);
+    constructor(message, layer = 'semantic', details = [], cause) {
+        super(message, { cause });
         this.layer = layer;
         this.details = details;
         this.name = 'EnsembleContractError';
@@ -41,7 +42,6 @@ export const ENSEMBLE_DISAGREEMENT_PRIMITIVES = {
 const UNCERTAINTY_COMBINING = new Set(['mean-probability-v1', 'jensen-shannon-v1']);
 export const REQUIRED_PAIRED_METRICS = ['quality', 'calibration', 'risk-coverage', 'abstention', 'latency', 'tokens', 'cost', 'slice'];
 const CEILING_FIELDS = ['members', 'attempts', 'deadlineMs', 'tokens', 'costMicros', 'concurrency', 'fallbackDepth'];
-const GATE_RANK = { PROMOTE: 0, HOLD: 1, ROLLBACK: 2 };
 let validators = null;
 function schemaValidator(kind) {
     if (!validators) {
@@ -334,7 +334,7 @@ export function pairedDeltaFinding(threshold, item) {
 export function ensembleIntegrityDecision(integrity, findingCount) {
     const upstream = integrity.release_gate.decision;
     const compromised = integrity.integrity_state === 'compromised' || integrity.compromise_labels.length > 0;
-    return upstream === 'ROLLBACK' || compromised ? 'ROLLBACK' : upstream === 'HOLD' || findingCount > 0 ? 'HOLD' : 'PROMOTE';
+    return ceilingDecision(upstream, compromised ? 'ROLLBACK' : 'PROMOTE', findingCount > 0 ? 'HOLD' : 'PROMOTE');
 }
 /** A D17 report may keep or tighten the upstream #2037/#2048 decision, never loosen it. Every
  * finding, passed flag and the decision are recomputed from the carried integrity fields and the
@@ -346,6 +346,15 @@ export function validateEnsembleIntegrityReport(value) {
     const problems = [];
     if (report.upstreamDecision !== report.integrity.release_gate.decision)
         problems.push('upstream decision must be the eval-integrity release gate decision');
+    let upgrade;
+    try {
+        assertDecisionCeiling(report.decision, report.upstreamDecision, ensembleIntegrityDecision(report.integrity, report.findings.length));
+    }
+    catch (error) {
+        if (!(error instanceof GateDecisionUpgradeError))
+            throw error;
+        upgrade = error;
+    }
     if (GATE_RANK[report.decision] < GATE_RANK[report.upstreamDecision])
         problems.push(`D17 cannot upgrade ${report.upstreamDecision} to ${report.decision}`);
     if (report.decision === 'PROMOTE' && (report.findings.length > 0 || report.pairedDeltas.some(item => !item.passed)))
@@ -372,6 +381,8 @@ export function validateEnsembleIntegrityReport(value) {
         problems.push(`decision ${report.decision} does not follow from its integrity and findings (${decision})`);
     if (digest !== ensembleContractDigest(payload))
         problems.push('integrity report digest does not match its content');
+    if (upgrade)
+        throw new EnsembleContractError('ensemble integrity report rejected', 'semantic', problems, upgrade);
     semantic(problems, 'ensemble integrity report rejected');
     return report;
 }

package/dist/src/decision/ensemble-study/artifacts.js

@@ -1,3 +1,4 @@
+import { assertDecisionCeiling, ceilingDecision } from '../../gates/lattice.js';
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -32,6 +33,10 @@ export function validateD17Artifact(name, value) {
     admitEntry(value, name === 'report' || name === 'reportV2' ? reportLimits : limits);
     if (!validators[name]?.(value))
         throw new Error(`D17 invalid ${name} artifact`);
+    if (name === 'report' || name === 'reportV2') {
+        const report = value;
+        assertDecisionCeiling(report.decision, ceilingDecision('HOLD', report.integrity.release_gate.decision, report.integrity.compromise_labels.length ? 'ROLLBACK' : 'PROMOTE'));
+    }
     if (name === 'splits') {
         const manifest = value;
         const ids = new Set(), inputs = new Set(), families = new Map();

package/dist/src/decision/ensemble-study/score.js

@@ -1,3 +1,4 @@
+import { ceilingDecision } from '../../gates/lattice.js';
 import { heldoutDigest, validateHeldoutAttempt, validateHeldoutInputs } from '../heldout/contract.js';
 import { artifactPin } from '../validate.js';
 import { aggregateEnsembleResults } from '../ensemble/aggregate.js';
@@ -145,7 +146,7 @@ export async function scoreD17Study(input, prepared) {
         calibrationDiagnostics: { champion: binary('champion'), challenger: binary('challenger'), calibrated: false },
         pending: ['D09 compatible member and aggregate calibration', 'blind gold audit and delayed repeats', 'separate extra-cost tradeoff approval',
             'protected native report approval and eligibility'],
-        decision: input.integrity.release_gate.decision === 'ROLLBACK' || input.integrity.compromise_labels.length ? 'ROLLBACK' : 'HOLD' };
+        decision: ceilingDecision('HOLD', input.integrity.release_gate.decision, input.integrity.compromise_labels.length ? 'ROLLBACK' : 'PROMOTE') };
     validateD17Artifact('report', report);
     return report;
 }
@@ -325,7 +326,7 @@ export async function scoreD17StagedStudy(input, prepared, context) {
         mappingDigest: heldoutDigest(verified[role].mapping), compatibility: { action: 'allow',
             state: verified[role].compatibility.state, pinId: verified[role].compatibility.pinId } });
     const approved = input.approvedCalibration;
-    const decision = input.integrity.release_gate.decision === 'ROLLBACK' || input.integrity.compromise_labels.length ? 'ROLLBACK' : 'HOLD';
+    const decision = ceilingDecision('HOLD', input.integrity.release_gate.decision, input.integrity.compromise_labels.length ? 'ROLLBACK' : 'PROMOTE');
     const report = { schemaVersion: 'decision-d17-study-report/v2', scope: 'synthetic-staged-calibrated',
         calibrated: true, d09Qualified: true, calibratedGate: true,
         corpusDigest: heldoutDigest(prepared.corpus), preregistrationDigest: heldoutDigest(prepared.preregistration),
@@ -453,7 +454,7 @@ export function d17NativeIntegrity(input) {
     // The ensemble integrity contract carries only the gate decision and reasons (eval-tool thresholds are dropped).
     const gate = { decision: input.base.release_gate.decision, reasons: [...input.base.release_gate.reasons] };
     const release_gate = gate.decision === 'PROMOTE' && missing.length
-        ? { decision: 'HOLD', reasons: [...gate.reasons, ...missing.map(reason => `promotion withheld: ${reason}`)] } : gate;
+        ? { decision: ceilingDecision(gate.decision, 'HOLD'), reasons: [...gate.reasons, ...missing.map(reason => `promotion withheld: ${reason}`)] } : gate;
     const { sample_n, uncertainty, integrity_mode, fresh_workspace_required, fresh_workspace_verified, integrity_state, trusted_score_source, compromise_labels, weak_signal_reason } = input.base;
     return { sample_n, uncertainty, paired_baseline: { ...input.pairedBaseline, d17TradeoffApprovalDigest: tradeoffDigest },
         integrity_mode, fresh_workspace_required, fresh_workspace_verified, integrity_state, trusted_score_source,

package/dist/src/decision/feature-export.js

@@ -1,3 +1,4 @@
+import { assertDecisionCeiling } from '../gates/lattice.js';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
@@ -942,9 +943,7 @@ function normalizeEvalIntegrity(value) {
     if (value.upstreamDisposition !== value.qualificationRelease.decision) {
         throw new DecisionFeatureExportError('Feature export integrity must preserve the upstream qualification release decision');
     }
-    if (integrityRank(value.disposition) < integrityRank(value.upstreamDisposition)) {
-        throw new DecisionFeatureExportError(`Feature export integrity cannot upgrade ${value.upstreamDisposition} to ${value.disposition}`);
-    }
+    assertDecisionCeiling(value.disposition, value.upstreamDisposition);
     const { digest, ...payload } = value;
     if (digest !== digestEvalIntegrity(payload))
         throw new DecisionFeatureExportError('Feature export integrity digest does not match its content');
@@ -966,9 +965,7 @@ function validateQualificationRelease(record) {
         throw new DecisionFeatureExportError('Feature export qualification release digest does not match its content');
     }
     validateQualificationIntegrity(record.integrity);
-    if (integrityRank(record.decision) < integrityRank(record.integrity.release_gate.decision)) {
-        throw new DecisionFeatureExportError('Feature export qualification release cannot upgrade its integrity release gate');
-    }
+    assertDecisionCeiling(record.decision, record.integrity.release_gate.decision, record.integrity.integrity_state === 'compromised' || record.integrity.compromise_labels.length ? 'ROLLBACK' : 'PROMOTE', ...record.gates.map(gate => gate.status === 'pass' ? 'PROMOTE' : 'HOLD'));
 }
 function validateQualificationIntegrity(value) {
     if (!value || !Number.isSafeInteger(value.sample_n) || value.sample_n < 0
@@ -986,9 +983,6 @@ function validateQualificationIntegrity(value) {
 function digestEvalIntegrity(value) {
     return `sha256:${createHash('sha256').update(canonicalJson(value)).digest('hex')}`;
 }
-function integrityRank(decision) {
-    return { PROMOTE: 0, HOLD: 1, ROLLBACK: 2 }[decision];
-}
 function activeExportHold(hold, subject, nowEpochMs) {
     return hold.subject === subject && hold.expiresAt > nowEpochMs && hold.scope.includes('export');
 }

package/dist/src/decision/heldout/collector.js

@@ -1,3 +1,4 @@
+import { ceilingDecision } from '../../gates/lattice.js';
 import { createHash } from 'node:crypto';
 import { mkdir, readFile, rm } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
@@ -425,7 +426,6 @@ export async function scoreHeldoutStudy(input) {
     return { schemaVersion: 'decision-heldout-score/v1', source: frozen.priorRuns.some(run => run.source === 'injected-transport') ? 'injected-transport' : frozen.source, evidenceDigest: input.trustedEvidenceDigest, integrityDigest: input.trustedIntegrityDigest,
         complete, diagnostics, approvedCalibration, calibrated: studyValidated ? true : calibrated, d09Qualified: studyValidated,
         calibratedGate: studyValidated && study?.calibratedGate === true,
-        calibrationArtifactValidation: studyValidated ? 'performed-by-study-scorer' : 'not-performed', integrityProblems: problems, decision: input.integrity.release_gate.decision === 'ROLLBACK'
-            || input.integrity.compromise_labels.length > 0 ? 'ROLLBACK' : 'HOLD' };
+        calibrationArtifactValidation: studyValidated ? 'performed-by-study-scorer' : 'not-performed', integrityProblems: problems, decision: ceilingDecision('HOLD', input.integrity.release_gate.decision, input.integrity.compromise_labels.length > 0 ? 'ROLLBACK' : 'PROMOTE') };
 }
 //# sourceMappingURL=collector.js.map

package/dist/src/decision/issue-triage/runtime.js

@@ -1,3 +1,4 @@
+import { assertDecisionCeiling, ceilingDecision } from '../../gates/lattice.js';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
@@ -26,7 +27,6 @@ const SCHEMA_FILES = {
     manifest: 'DecisionIssueTriageEvaluationManifest.v1.schema.json',
     report: 'DecisionIssueTriageEvaluationReport.v1.schema.json',
 };
-const GATE_RANK = { PROMOTE: 0, HOLD: 1, ROLLBACK: 2 };
 const FINAL_FIELDS = ['finalLabels', 'finalDuplicateOf', 'resolution', 'closedAt'];
 const RESPONSE_FIELDS = ['issueId', 'issueType', 'area', 'urgency', 'completeness', 'clarificationNeed', 'duplicate',
     'uncertaintyProfile', 'accepted', 'actualModel', 'requestedModel', 'latencyMs', 'usage', 'usageReceipts', 'calls', 'retries', 'fallbacks',
@@ -156,9 +156,7 @@ function checkIssueTriageEvaluationReportShape(value) {
     checkSchema('report', value);
     const report = value;
     const problems = [];
-    if (GATE_RANK[report.decision] < GATE_RANK[report.integrity.upstreamDecision]) {
-        problems.push(`issue triage report cannot upgrade ${report.integrity.upstreamDecision} to ${report.decision}`);
-    }
+    assertDecisionCeiling(report.decision, report.integrity.upstreamDecision, gateDecision(report.integrity.upstreamDecision, report.integrity.findings));
     if (report.decision === 'PROMOTE' && report.integrity.findings.length > 0)
         problems.push('PROMOTE requires no findings');
     if (report.decision === 'PROMOTE' && report.baselineComparison.qualityNonInferiority?.decision !== 'non-inferior') {
@@ -603,11 +601,7 @@ function correct(sample, which) {
         && observed.duplicate.issueId === sample.label.duplicateOf;
 }
 function gateDecision(upstream, findings) {
-    if (upstream === 'ROLLBACK')
-        return 'ROLLBACK';
-    if (upstream === 'HOLD' || findings.length > 0)
-        return 'HOLD';
-    return 'PROMOTE';
+    return ceilingDecision(upstream, findings.length > 0 ? 'HOLD' : 'PROMOTE');
 }
 /** Supported interval level in bps, or null. The paired helpers accept integer levels strictly in (5000, 9999). */
 function levelInBps(confidenceInterval) {

package/dist/src/decision/qualification/gates.js

@@ -1,3 +1,4 @@
+import { ceilingDecision } from '../../gates/lattice.js';
 import { expectedQualificationCaseIds, validateCaseInventory } from './manifest.js';
 import { deriveGateEvidence, DERIVED_GATE_EVIDENCE } from './gate-evidence.js';
 // Negative evidence always overrides a positive suite result. A release reviewer
@@ -76,7 +77,7 @@ export function evaluateQualification(manifest, definitions = DECISION_RELEASE_G
         schemaVersion: 'decision-qualification-report/v1',
         runId: manifest.runId,
         generatedAt: manifest.generatedAt,
-        decision: mandatoryFailed ? 'HOLD' : 'PROMOTE',
+        decision: ceilingDecision('PROMOTE', mandatoryFailed ? 'HOLD' : 'PROMOTE'),
         gates,
     };
 }

package/dist/src/decision/qualification/release.js

@@ -1,3 +1,4 @@
+import { ceilingDecision } from '../../gates/lattice.js';
 import { canonicalSha256, matchEvidenceDigest } from '../../gates/stats/index.js';
 /**
  * #2037/#2048 integrity modes whose verified state has a trusted score source.
@@ -133,9 +134,7 @@ export function buildQualificationReleaseRecord(executed, input) {
         && suites.length === manifest.cases.length && suites.every(item => item.outcome === 'pass' && item.verified)
         && report.gates.length === 7 && report.gates.every(gate => gate.status === 'pass')
         && report.decision === 'PROMOTE';
-    const decision = releaseDecision === 'ROLLBACK'
-        || report.decision === 'ROLLBACK' || input.integrity.integrity_state === 'compromised' || input.integrity.compromise_labels.length > 0 ? 'ROLLBACK'
-        : complete && releaseDecision === 'PROMOTE' ? 'PROMOTE' : 'HOLD';
+    const decision = ceilingDecision(releaseDecision, report.decision, complete ? 'PROMOTE' : 'HOLD', input.integrity.integrity_state === 'compromised' || input.integrity.compromise_labels.length > 0 ? 'ROLLBACK' : 'PROMOTE');
     const fields = {
         schemaVersion: 'decision-qualification-release/v2',
         runId: manifest.runId, sourceCommit: manifest.sourceCommit, dirty: manifest.dirty,

package/dist/src/decision/routing/report.js

@@ -1,3 +1,4 @@
+import { assertDecisionCeiling } from '../../gates/lattice.js';
 import { canonicalJson } from '../../security/artifact-trust.js';
 import { ensembleIntegrityDecision, integrityMetadataFindings } from '../ensemble/contract.js';
 import { pairedBinaryDifferenceInterval, pairedNonInferiority } from '../qualification/quality.js';
@@ -20,6 +21,7 @@ export function buildRoutingShadowReport(input) {
 export function validateRoutingShadowReport(value, trustedPreregistrationDigest) {
     checkRoutingSchema('shadowReport', value);
     const report = value;
+    assertDecisionCeiling(report.decision, ensembleIntegrityDecision(report.integrity, report.reasons.length));
     const rebuilt = computeRoutingShadowReport({
         id: report.id, preregistration: report.preregistration, trustedPreregistrationDigest,
         holdoutAccessedAt: report.holdoutAccessedAt, evaluatedAt: report.evaluatedAt,

package/dist/src/decision/sdlc-screening.js

@@ -1,3 +1,4 @@
+import { ceilingDecision } from '../gates/lattice.js';
 import { createHash } from 'node:crypto';
 import { DECISION_API_VERSION, DECISION_API_VERSION_STRUCTURED, } from './types.js';
 import { reviewDigest } from './review/validate.js';
@@ -1135,11 +1136,8 @@ export function buildSdlcScreeningReleaseReport(input) {
     const preregistered = evaluateSdlcScreeningPreregistration(input.preregistration, input.trustedPreregistrationDigest, input.heldout, input.nowEpochMs);
     const integrityProblems = qualificationIntegrityAllowlistProblems(input.integrity);
     const readable = !integrityProblems.includes('integrity-invalid');
-    const compromised = readable && (input.integrity.release_gate.decision === 'ROLLBACK'
-        || input.integrity.integrity_state === 'compromised' || input.integrity.compromise_labels.length > 0);
-    const decision = compromised ? 'ROLLBACK'
-        : readable && integrityProblems.length === 0 && preregistered.decision === 'pass'
-            && input.integrity.release_gate.decision === 'PROMOTE' ? 'PROMOTE' : 'HOLD';
+    const compromised = readable && (input.integrity.integrity_state === 'compromised' || input.integrity.compromise_labels.length > 0);
+    const decision = ceilingDecision(readable ? input.integrity.release_gate.decision : 'HOLD', compromised ? 'ROLLBACK' : 'PROMOTE', integrityProblems.length === 0 && preregistered.decision === 'pass' ? 'PROMOTE' : 'HOLD');
     const unsigned = {
         schemaVersion: input.preregistration.schemaVersion === SDLC_SCREENING_PREREGISTRATION_VERSION_V2
             ? SDLC_SCREENING_RELEASE_VERSION_V2 : SDLC_SCREENING_RELEASE_VERSION,

package/dist/src/decision/sensitivity/comparative.js

@@ -1,3 +1,4 @@
+import { assertDecisionCeiling, ceilingDecision } from '../../gates/lattice.js';
 import { pairedBinaryDifferenceInterval, wilsonScoreInterval } from '../qualification/quality.js';
 import { qualificationIntegrityAllowlistProblems } from '../qualification/release.js';
 import { checkSensitivitySchema, sensitivityDigest, validateSensitivityReport } from './contract.js';
@@ -128,9 +129,8 @@ export function buildComparativeReplayReport(input) {
         throw new Error('operator review ingestion is not implemented');
     findings.add('reviewer-audit-pending');
     const upstreamDecision = input.integrity.release_gate.decision;
-    const decision = upstreamDecision === 'ROLLBACK' || input.integrity.integrity_state === 'compromised'
-        || input.integrity.compromise_labels.length > 0 ? 'ROLLBACK'
-        : upstreamDecision === 'HOLD' || findings.size > 0 ? 'HOLD' : 'PROMOTE';
+    const decision = ceilingDecision(upstreamDecision, input.integrity.integrity_state === 'compromised'
+        || input.integrity.compromise_labels.length > 0 ? 'ROLLBACK' : 'PROMOTE', findings.size > 0 ? 'HOLD' : 'PROMOTE');
     const payload = {
         schemaVersion: 'decision-comparative-replay-report/v1', mode: 'shadow',
         semantics: 'associative-sensitivity-not-causal', actionAuthorization: 'not-authorized',
@@ -147,7 +147,9 @@ export function buildComparativeReplayReport(input) {
 }
 export function validateComparativeReplayReport(report, input) {
     checkSensitivitySchema('comparativeReport', report);
+    assertDecisionCeiling(report.decision, report.upstreamDecision, input.integrity.release_gate.decision);
     const expected = buildComparativeReplayReport(input);
+    assertDecisionCeiling(report.decision, expected.decision);
     if (sensitivityDigest(report) !== sensitivityDigest(expected))
         throw new Error('comparative replay report differs from bound inputs');
 }

package/dist/src/gates/driver.js

@@ -1,3 +1,4 @@
+import { assertGateReportDecision } from './report.js';
 import { lstatSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
@@ -159,11 +160,12 @@ export async function validateGateFile(kind, filePath, options = {}) {
         else {
             // Full report validation needs the trusted evaluation context
             // (`validateGateReport` re-derives the report byte-identically).
-            // `validate` checks the closed schema, the kind and the self-digest,
+            // `validate` checks component ceilings, the closed schema, kind and self-digest,
             // so rewritten evidence with a stale digest still fails here.
             const report = validateGateDocument(document);
             if (!isRecord(document) || document.kind !== 'GateReport')
                 throw new Error('expected kind GateReport');
+            assertGateReportDecision(report);
             const { digest, ...fields } = report;
             if (typeof digest !== 'string' || artifactDigest(fields) !== digest) {
                 throw new Error('report digest does not match its content');
@@ -276,83 +278,10 @@ export function listGatePacks(options = {}) {
         return summaries.filter(entry => entry.namespace === options.namespace);
     return summaries;
 }
-/**
- * Packs referenced by one rule's `enforcedBy` frontmatter (#2830 stub; full
- * coverage is #2839). Scans bundled and project-local `rules/*.md` for an
- * `enforcedBy: [aiwg:<bundle>/<pack>#<gate>]` list naming the rule. Returns
- * the referenced pack ids (without gate fragments). Empty when no rule
- * declares `enforcedBy` — rules remain guidance until they name a check.
- */
+/** List the distinct packs named by validated rule coverage declarations. */
 export async function packsReferencedByRule(ruleId, options = {}) {
-    const { readdir, readFile: readRuleFile, stat } = await import('node:fs/promises');
-    const roots = [];
-    const root = rootDir(options);
-    for (const sub of ['frameworks', 'addons', 'extensions']) {
-        roots.push(path.join(root, 'agentic/code', sub));
-    }
-    roots.push(path.join(baseDir(options), '.aiwg'));
-    const ruleFiles = [];
-    const walk = async (dir, depth) => {
-        if (depth > 5 || ruleFiles.length > 500)
-            return;
-        let entries;
-        try {
-            entries = await readdir(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-            if (ruleFiles.length > 500)
-                return;
-            const full = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                if (entry.name === 'node_modules' || entry.name.startsWith('.git'))
-                    continue;
-                await walk(full, depth + 1);
-            }
-            else if (entry.isFile() && entry.name.endsWith('.md')) {
-                if (!full.replace(/\\/g, '/').includes('/rules/'))
-                    continue;
-                ruleFiles.push(full);
-            }
-        }
-    };
-    for (const dir of roots)
-        await walk(dir, 0);
-    const referenced = new Set();
-    for (const file of ruleFiles) {
-        let content;
-        try {
-            const st = await stat(file);
-            if (st.size > 65_536)
-                continue;
-            content = await readRuleFile(file, 'utf8');
-        }
-        catch {
-            continue;
-        }
-        const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n/);
-        if (!match)
-            continue;
-        const frontmatter = match[1];
-        if (!frontmatter.includes('enforcedBy'))
-            continue;
-        const ruleName = path.basename(file, '.md');
-        const dirName = path.basename(path.dirname(file));
-        const names = new Set([ruleName, dirName === 'rules' ? null : `${dirName}/${ruleName}`, file]);
-        if (!names.has(ruleId) && ![...names].filter(Boolean).some(name => ruleId.endsWith(String(name))))
-            continue;
-        for (const line of frontmatter.split('\n')) {
-            const trimmed = line.trim().replace(/^-\s*/, '');
-            const id = trimmed.match(/(aiwg|framework|addon|extension|project):[^\s,'"\]]+/)?.[1]
-                ? trimmed.match(/((?:aiwg|framework|addon|extension|project):[^\s,'"\]]+)/)?.[1]
-                : null;
-            if (id)
-                referenced.add(id.split('#')[0]);
-        }
-    }
-    return [...referenced].sort();
+    const { listRuleGateCoverage } = await import('../rules/gate-coverage.js');
+    return [...new Set(listRuleGateCoverage(options, ruleId).flatMap(rule => rule.enforcedBy.map(reference => reference.split('#')[0])))].sort();
 }
 /** Show one pack by full id, rest-path or short pack name. */
 export function showGatePack(id, options = {}) {

package/dist/src/gates/evaluate.js

@@ -1,3 +1,4 @@
+import { ceilingDecision, maxOutcome } from './lattice.js';
 import { qualificationIntegrityAllowlistProblems } from '../decision/qualification/release.js';
 import { artifactDigest } from '../decision/validate.js';
 import { evaluatePredicate } from '../decision/predicates.js';
@@ -12,11 +13,7 @@ import { qualifyGateParameter } from './types.js';
 export class GateEvaluationError extends Error {
     constructor(message) { super(message); this.name = 'GateEvaluationError'; }
 }
-const RANK = { PROMOTE: 0, HOLD: 1, ROLLBACK: 2 };
-/** Shared outcome lattice. The maximum never upgrades any component. */
-export function maxOutcome(...outcomes) {
-    return outcomes.reduce((worst, outcome) => (RANK[outcome] > RANK[worst] ? outcome : worst), 'PROMOTE');
-}
+export { maxOutcome } from './lattice.js';
 /**
  * Per-gate outcome from its own status: `pass` promotes, `fail` takes the
  * gate's `onFail`, `insufficient` takes `onInsufficient` (always HOLD by load
@@ -447,11 +444,7 @@ function upstreamOutcome(upstream) {
     const compromised = problems.includes('compromised')
         || release === 'ROLLBACK'
         || upstream.metadata.integrity_state === 'compromised';
-    if (compromised)
-        return { ceiling: 'ROLLBACK', problems };
-    if (problems.length || release === 'HOLD')
-        return { ceiling: 'HOLD', problems };
-    return { ceiling: 'PROMOTE', problems };
+    return { ceiling: ceilingDecision(release ?? 'HOLD', compromised ? 'ROLLBACK' : 'PROMOTE', problems.length ? 'HOLD' : 'PROMOTE'), problems };
 }
 /**
  * Pure, deterministic gate evaluation. The binding is resolved internally
@@ -685,7 +678,7 @@ export function evaluateGates(input) {
     const packOutcome = maxOutcome(...gateEvidence.map(entry => entry.outcome));
     const { ceiling: upstreamCeiling, problems: upstreamProblems } = upstreamOutcome(upstream);
     const bindingCeiling = binding.spec.ceiling ?? 'PROMOTE';
-    const decision = maxOutcome(packOutcome, upstreamCeiling, bindingCeiling);
+    const decision = ceilingDecision(packOutcome, upstreamCeiling, bindingCeiling);
     const body = {
         apiVersion: binding.apiVersion,
         kind: 'GateReport',

package/dist/src/gates/floors.js

@@ -1,6 +1,6 @@
+import { GATE_RANK } from './lattice.js';
 import { validateGateDocument } from './schema.js';
 import { splitPackId } from './registry.js';
-const OUTCOME_RANK = { PROMOTE: 0, HOLD: 1, ROLLBACK: 2 };
 const OUTCOMES = ['PROMOTE', 'HOLD', 'ROLLBACK'];
 const VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
 const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
@@ -22,7 +22,7 @@ export const INTEGRITY_CEILING_FLOOR_PACK_VERSION = '1.0.0';
 export function projectCeilingSatisfied(declared, configured) {
     if (configured === undefined)
         return true;
-    return OUTCOME_RANK[declared ?? 'PROMOTE'] >= OUTCOME_RANK[configured];
+    return GATE_RANK[declared ?? 'PROMOTE'] >= GATE_RANK[configured];
 }
 /**
  * Resolves the effective project floors: the configured entries, verbatim.
@@ -64,7 +64,7 @@ export function assertCeilingDefaults(ceilings) {
             continue;
         if (!starValid)
             throw new Error(`gates.ceilings: per-study ceilings require the project-wide '*' default ceiling`);
-        if (OUTCOME_RANK[ceiling] < OUTCOME_RANK[star]) {
+        if (GATE_RANK[ceiling] < GATE_RANK[star]) {
             throw new Error(`gates.ceilings.${study}: must tighten the project default ceiling ${String(star)}, not loosen it`);
         }
     }
@@ -124,7 +124,7 @@ export function validateGatesConfig(gates) {
                 for (const [study, ceiling] of Object.entries(gates.ceilings)) {
                     if (study !== '*' && typeof ceiling === 'string'
                         && OUTCOMES.includes(ceiling)
-                        && OUTCOME_RANK[ceiling] < OUTCOME_RANK[star]) {
+                        && GATE_RANK[ceiling] < GATE_RANK[star]) {
                         errors.push(`gates.ceilings.${study}: must tighten the project default ceiling ${star}, not loosen it`);
                     }
                 }

package/dist/src/gates/index.js

@@ -1,17 +1,17 @@
 /**
  * Gates capability phase 1 core (epic #2824): declarative gate packs, a pure deterministic
- * evaluator and digest-bound reports. Experimental and default-off: nothing in the
- * decision runtime imports this module, so existing behavior is unchanged.
+ * evaluator and digest-bound reports. Decision consumers share its outcome lattice.
  */
 export { GATES_API_VERSION, qualifyGateParameter } from './types.js';
 export { GateSchemaError, validateGateDocument } from './schema.js';
 export { GateRegistryError, GATE_NAMESPACES, splitPackId, validateResolvedPack, resolveThresholdDefault, assertGateTightens, applyGateExtends, composeGatePack, resolveGateBinding, expandFloorPacks, enforceProjectFloors, authoredGatePacksOf, gateProvidersOf, GateRegistry, } from './registry.js';
 export { INTEGRITY_CEILING_FLOOR_PACK_ID, INTEGRITY_CEILING_FLOOR_PACK_VERSION, assertCeilingDefaults, projectCeilingSatisfied, resolveProjectFloors, validateGatesConfig, } from './floors.js';
 export { GateEvaluationError, maxOutcome, gateStatusOutcome, sealUpstream, sealGateHoldout, evaluateGates, } from './evaluate.js';
-export { validateGateReport } from './report.js';
+export { assertGateReportDecision, validateGateReport } from './report.js';
 export { createCoreProviderRegistry, evidenceProvider, pairedProvider, proportionProvider, scalarProvider, screeningProvider } from './providers/index.js';
 export { MetricProviderRegistry } from './providers/index.js';
 export { GATE_PACKS_DIR, GATE_PACK_MAX_BYTES, isGatePackFile, listGatePackFiles, readBundleGatePacksDeclaration, loadGatePackFile, originForPackDir, registerBundleGatePacks, resolveGatePacksDir, discoverShippedGatePacks, } from './discovery.js';
 export { buildGatesRegistry, validateGateFile, loadHoldoutFile, loadUpstreamFile, evaluateGatesFromFiles, installedAiwgRoot, listGatePacks, loadProjectFloorsForEvaluate, showGatePack, packsReferencedByRule, } from './driver.js';
 export { GateProviderError, computeProviderCodeDigest, deriveIsolatedSeed, loadGateBundleProviders, invokeBundleProvider, providerBindingPin, runIsolatedProvider, runIsolatedProviderSync, sealProviderSection, snapshotProviderDir, isLoaderIssuedProvider, isolationLaunchPlan, isolationSandboxStatus, parseIsolatedFrame, probeIsolationSandbox, isBundleProvidersEnabled, GATE_PROVIDER_MAX_FILE_BYTES, GATE_PROVIDER_MAX_FILES, GATE_PROVIDER_MAX_TOTAL_BYTES, GATE_PROVIDER_DEFAULT_TIMEOUT_MS, GATE_PROVIDER_MAX_TIMEOUT_MS, GATE_PROVIDER_DEFAULT_MAX_RECORDS, GATE_PROVIDER_MAX_OUTPUT_BYTES, } from './providers/loader.js';
+export { GATE_RANK, ceilingDecision, assertDecisionCeiling, GateDecisionUpgradeError } from './lattice.js';
 //# sourceMappingURL=index.js.map

package/dist/src/gates/lattice.js

@@ -0,0 +1,26 @@
+export const GATE_RANK = Object.freeze({ PROMOTE: 0, HOLD: 1, ROLLBACK: 2 });
+/** The strictest outcome wins; an empty set has no restriction. */
+export function maxOutcome(...outcomes) {
+    return outcomes.reduce((worst, outcome) => GATE_RANK[outcome] > GATE_RANK[worst] ? outcome : worst, 'PROMOTE');
+}
+export function ceilingDecision(decision, ...ceilings) {
+    return maxOutcome(decision, ...ceilings);
+}
+export class GateDecisionUpgradeError extends Error {
+    code = 'report-upgrades-component';
+    decision;
+    component;
+    constructor(decision, component) {
+        super(`Report decision differs from components: cannot upgrade ${component} to ${decision} (report-upgrades-component)`);
+        this.name = 'GateDecisionUpgradeError';
+        this.decision = decision;
+        this.component = component;
+    }
+}
+/** Validate a carried verdict independently of its digest or reproducibility checks. */
+export function assertDecisionCeiling(decision, ...components) {
+    const component = maxOutcome(...components);
+    if (GATE_RANK[decision] < GATE_RANK[component])
+        throw new GateDecisionUpgradeError(decision, component);
+}
+//# sourceMappingURL=lattice.js.map

package/dist/src/gates/registry.js

@@ -1,3 +1,4 @@
+import { ceilingDecision } from './lattice.js';
 import { canonicalJson } from '../security/artifact-trust.js';
 import { artifactDigest } from '../decision/validate.js';
 import { validateGateDocument } from './schema.js';
@@ -428,7 +429,7 @@ export function assertGateTightens(parent, child, params) {
     else if (minimumAfter < minimumBefore) {
         fail(`gate ${child.id} may only raise minimumN`);
     }
-    if (parent.onFail === 'ROLLBACK' && child.onFail !== 'ROLLBACK') {
+    if (ceilingDecision(child.onFail, parent.onFail) !== child.onFail) {
         fail(`gate ${child.id} may not demote onFail ROLLBACK -> HOLD`);
     }
     // Insufficient evidence always holds: ROLLBACK needs an observed blocking

package/dist/src/gates/report.js

@@ -1,6 +1,7 @@
+import { assertDecisionCeiling, GateDecisionUpgradeError } from './lattice.js';
 import { canonicalJson } from '../security/artifact-trust.js';
 import { artifactDigest } from '../decision/validate.js';
-import { evaluateGates, maxOutcome } from './evaluate.js';
+import { evaluateGates } from './evaluate.js';
 import { validateGateDocument } from './schema.js';
 /**
  * Validates a gate report against its trusted inputs. The report is re-derived
@@ -85,12 +86,14 @@ export function validateGateReport(report, input) {
     }
     if (expected.decision !== parsed.decision)
         reasons.push('report-decision-mismatch');
-    const components = [
-        ...parsed.gateEvidence.map(entry => entry.outcome),
-        parsed.ceilings.packOutcome, parsed.ceilings.upstreamCeiling, parsed.ceilings.bindingCeiling,
-    ];
-    if (maxOutcome(parsed.decision, maxOutcome(...components)) !== parsed.decision) {
-        reasons.push('report-upgrades-component');
+    try {
+        assertGateReportDecision(parsed);
+        assertDecisionCeiling(parsed.decision, input.upstream?.metadata.release_gate.decision ?? 'PROMOTE', input.binding.spec.ceiling ?? 'PROMOTE');
+    }
+    catch (error) {
+        if (!(error instanceof GateDecisionUpgradeError))
+            throw error;
+        return { valid: false, reasons: [...reasons, error.code], error };
     }
     return { valid: reasons.length === 0, reasons };
 }
@@ -99,4 +102,13 @@ function stripDigest(report) {
     void _dropped;
     return fields;
 }
+/** Validate carried component ceilings even when no trusted replay context is available. */
+export function assertGateReportDecision(report) {
+    const components = [
+        ...report.gateEvidence.map(entry => entry.outcome),
+        report.ceilings.packOutcome, report.ceilings.upstreamCeiling, report.ceilings.bindingCeiling,
+        report.upstream?.decision ?? 'PROMOTE',
+    ];
+    assertDecisionCeiling(report.decision, ...components);
+}
 //# sourceMappingURL=report.js.map