@cleocode/core 2026.9.20 → 2026.9.21

package/schemas/config.schema.json

@@ -1181,6 +1181,60 @@
         }
       }
     },
+    "decide": {
+      "type": "object",
+      "description": "Typed 'System One' decisions (T12486). The provider itself (URL + API key) is stored by `cleo decide config` in <cleoHome>/decide-credentials.json, never here. These keys only choose how each call site uses it.",
+      "additionalProperties": false,
+      "properties": {
+        "sites": {
+          "type": "object",
+          "description": "Per call-site mode.",
+          "additionalProperties": false,
+          "properties": {
+            "duplicateDetection": {
+              "type": "string",
+              "enum": ["off", "shadow", "on"],
+              "default": "shadow",
+              "description": "`cleo add` duplicate detection (T12492). shadow = ask the provider, audit its answers next to the heuristic's in .cleo/audit/decisions.jsonl, act on the heuristic. on = act on the provider's answer. off = never ask. Always off when no provider is configured."
+            },
+            "decisionContradiction": {
+              "type": "string",
+              "enum": ["off", "shadow", "on"],
+              "default": "shadow",
+              "description": "ADR decision contradiction check on `storeDecision` writes that request model validation (T12493). One choice question per prior decision (contradicts | supersedes | refines | unrelated), top 3 by word overlap, 300 ms budget. shadow = ask, audit next to the heuristic, act on the heuristic. on = act on the answers when every confidence is >= 0.6. off = never ask. Always off when no provider is configured."
+            },
+            "observationType": {
+              "type": "string",
+              "enum": ["off", "shadow", "on"],
+              "default": "shadow",
+              "description": "Observation type when `cleo memory observe` gets no `type` (T12494). Only callers that opt in (`askTypeDecision`) ask; background writers never send content to the provider. One choice question over bugfix | refactor | feature | decision | change | discovery, 300 ms budget. shadow = ask, audit next to the whole-word keyword type, store the keyword type. on = store the decided type when its confidence is >= 0.6. off = never ask. Always off when no provider is configured."
+            },
+            "ownerDecision": {
+              "type": "string",
+              "enum": ["off", "shadow", "on"],
+              "default": "shadow",
+              "description": "Readiness grill gate (`cleo classify`, sentient auto-promote) for a task with a `blockedBy` reason and no `owner-decision` label (T12494). One noul question: does the block need a human owner's decision? 300 ms budget. shadow = ask, audit next to the `owner`/`decision` substring rule, act on the rule. on = a confident (>= 0.6) yes ADDS the flag the substring rule missed; escalate-only, it never clears a flag the rule or the label raised. It only flags: a flagged task grills and goes to the owner through the ask tool. off = never ask. Always off when no provider is configured."
+            }
+          }
+        },
+        "generativeFallback": {
+          "type": "object",
+          "description": "Opt-ins for the older generative-LLM tiers that System One replaces.",
+          "additionalProperties": false,
+          "properties": {
+            "duplicateDetection": {
+              "type": "boolean",
+              "default": false,
+              "description": "Run the T1681 generative-LLM duplicate check (up to 15 s on the `cleo add` write path). Off by default."
+            },
+            "decisionContradiction": {
+              "type": "boolean",
+              "description": "Run the T1828 generative-LLM decision contradiction check (up to 15 s on the decision write path, backend resolution included). When unset: on unless decide.sites.decisionContradiction is `on` — unconfigured, off and shadow keep the pre-T12493 behaviour; only `on` replaces it."
+            }
+          }
+        }
+      }
+    },
     "llm": {
       "type": "object",
       "description": "LLM configuration — default provider+model, per-provider API key overrides, and role-based routing. T-LLM-CRED-CENTRALIZATION Phase 4 (T9306).",

package/schemas/project-context.schema.json

@@ -55,6 +55,11 @@
           "type": "string",
           "description": "Test execution command"
         },
+        "affectedCommand": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Affected-scope test command template for tool:test-affected (D11150). {projects}, {filters} and {packages} expand per affected package, e.g. \"pnpm exec vitest run {projects}\"."
+        },
         "testFilePatterns": {
           "type": "array",
           "items": {
@@ -221,11 +226,32 @@
         "prRequiredWorkflows": {
           "type": "array",
           "items": {
-            "type": "string",
-            "minLength": 1
+            "oneOf": [
+              { "type": "string", "minLength": 1 },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["name"],
+                "properties": {
+                  "name": { "type": "string", "minLength": 1 },
+                  "app": {
+                    "oneOf": [
+                      { "type": "string", "minLength": 1 },
+                      { "type": "integer", "minimum": 1 }
+                    ],
+                    "description": "GitHub App slug or id that must post this check."
+                  },
+                  "workflow": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Workflow file path that must produce this check."
+                  }
+                }
+              }
+            ]
           },
           "uniqueItems": true,
-          "description": "Required successful checks for PR evidence atoms."
+          "description": "Required successful checks for PR and CI evidence atoms. An object entry pins the check to the GitHub App (and workflow file) that must post it (T12634)."
         }
       }
     },
@@ -238,6 +264,28 @@
           "type": "string",
           "minLength": 1,
           "description": "Checkout that git/gh evidence tools run in, relative to the CLEO store root (absolute is also accepted). Needed only when the store root is not itself a git work tree and parents more than one repository."
+        },
+        "ciSatisfies": {
+          "type": "boolean",
+          "description": "Accept required CI green on a merged PR's merge commit as testsPassed/qaPassed evidence (ci:<pr>, D11149)."
+        },
+        "ciChecks": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "tests": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 },
+            "qa": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 },
+            "jobs": {
+              "type": "object",
+              "additionalProperties": false,
+              "description": "Job-name globs (* wildcard) that must each have run and succeeded in the pinned workflows before ci:<pr> attests a code task's gate.",
+              "properties": {
+                "tests": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 },
+                "qa": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }
+              }
+            }
+          },
+          "description": "Required checks that attest testsPassed (tests) and qaPassed (qa) for ci:<pr>; each must be a subset of the required list."
         }
       }
     }

package/schemas/project-info.schema.json

@@ -23,10 +23,37 @@
       "minLength": 1,
       "description": "Portable project-local identity (UUIDv4). Survives .cleo/ moves between filesystems. Used as the stable brain key for cross-system project sharing."
     },
+    "checkoutNonce": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{32}$",
+      "description": "Random per-checkout secret (T12470). Lives only in this untracked file; the global registry records it on each confirmed location, so a moved or restored checkout is recognised while a clone (which cannot have it) stays an unconfirmed candidate. Never copy it between checkouts."
+    },
     "projectHash": {
       "type": "string",
       "pattern": "^[a-f0-9]{12}$",
-      "description": "Path-derived 12-character hex hash (SHA-256 prefix of absolute project path). Links to global nexus registry entry. Re-computed on project move."
+      "description": "Write-once 12-character hex identity key (SHA-256 prefix of the real main-checkout path at init). Keys release ids, audit rows and idempotency. Never re-computed: not on project move, relocation, restore or `cleo upgrade` (T12557)."
+    },
+    "previousProjectIds": {
+      "type": "array",
+      "maxItems": 50,
+      "items": { "type": "string", "minLength": 1 },
+      "description": "Local ids this project was re-keyed away from by `cleo doctor project-identity --resolve` (T12353). Receipt only; they stay resolvable through the registry alias table."
+    },
+    "strippedFields": {
+      "type": "array",
+      "maxItems": 50,
+      "description": "Receipt of persisted path facts removed by `cleo doctor project-identity --resolve` (T12557), newest last.",
+      "items": {
+        "type": "object",
+        "required": ["file", "field", "value", "strippedAt"],
+        "additionalProperties": false,
+        "properties": {
+          "file": { "type": "string", "enum": ["project-info.json", "project-context.json"] },
+          "field": { "type": "string", "enum": ["projectRoot"] },
+          "value": { "description": "The removed value, verbatim." },
+          "strippedAt": { "type": "string", "format": "date-time" }
+        }
+      }
     },
     "name": {
       "type": "string",