@deftai/directive-core 0.101.0 → 0.103.0

package/dist/authz/classify.js

@@ -218,10 +218,37 @@ const DOWNLOADER_DECODER_BINS = new Set([
     "aria2",
     "mbuffer",
     "cpio",
+    // #3311 residual after #3288: versioned / alternate write bins.
+    "gpg2",
+    "gpg1",
+    "rage",
+    "xh",
+    "httpie",
+    "wcurl",
+    "curlie",
+    "uudecode",
+    "iconv",
+    "gtar",
+    "star",
+    "gnutar",
+    "pax",
+    // #3336 residual after #3311: further write bins (oras/ncat/patch peers).
+    "oras",
+    "lwp-download",
+    "ncat",
+    "patch",
+    "base32",
+    "lrzip",
+    "unar",
+    "cabextract",
+    "ditto",
+    "dpkg-deb",
+    "hg",
+    "msguniq",
 ]);
 /**
  * Archive extractors / alt writers that can plant via pathish operands without
- * shell redirects (#3245 / #3288). Used for pathish authz/kill scans (prefer deny)
+ * shell redirects (#3245 / #3288 / #3311 / #3336). Used for pathish authz/kill scans (prefer deny)
  * and write-shape residual under UAT — not bare curl-class URL fetches.
  */
 const ARCHIVE_ALT_WRITE_BINS = new Set([
@@ -250,9 +277,36 @@ const ARCHIVE_ALT_WRITE_BINS = new Set([
     "aria2",
     "mbuffer",
     "cpio",
+    // #3311 residual after #3288.
+    "gpg2",
+    "gpg1",
+    "rage",
+    "xh",
+    "httpie",
+    "wcurl",
+    "curlie",
+    "uudecode",
+    "iconv",
+    "gtar",
+    "star",
+    "gnutar",
+    "pax",
+    // #3336 residual after #3311.
+    "oras",
+    "lwp-download",
+    "ncat",
+    "patch",
+    "base32",
+    "lrzip",
+    "unar",
+    "cabextract",
+    "ditto",
+    "dpkg-deb",
+    "hg",
+    "msguniq",
 ]);
 /**
- * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288).
+ * Bins whose pathish operands are scanned for authz/kill destinations (#3213 / #3245 / #3288 / #3311 / #3336).
  * Prefer a Set over a long `||` chain so coverage counts one membership check, not N branches.
  */
 const PROTECTED_POSITIONAL_BINS = new Set([
@@ -275,6 +329,29 @@ const PROTECTED_POSITIONAL_BINS = new Set([
     "zstd",
     "unzstd",
     "mbuffer",
+    // #3311 residual: versioned crypto + archive/decoder peers.
+    "gpg2",
+    "gpg1",
+    "rage",
+    "uudecode",
+    "iconv",
+    "gtar",
+    "star",
+    "gnutar",
+    "pax",
+    // #3336 residual: positional dest writers (ditto/dpkg-deb/hg/lwp-download).
+    "oras",
+    "lwp-download",
+    "ncat",
+    "patch",
+    "base32",
+    "lrzip",
+    "unar",
+    "cabextract",
+    "ditto",
+    "dpkg-deb",
+    "hg",
+    "msguniq",
 ]);
 /** wget family (directory-prefix dest flags). */
 const WGET_FAMILY_BINS = new Set(["wget", "wget2"]);
@@ -282,8 +359,10 @@ const WGET_FAMILY_BINS = new Set(["wget", "wget2"]);
 const ARIA2_FAMILY_BINS = new Set(["aria2c", "aria2"]);
 /** 7z family (attached -oDIR only). */
 const SEVEN_Z_FAMILY_BINS = new Set(["7z", "7za", "7zr"]);
-/** tar family (chdir -C / --directory). */
-const TAR_FAMILY_BINS = new Set(["tar", "bsdtar"]);
+/** tar family (chdir -C / --directory). Includes GNU/Schily aliases (#3311). */
+const TAR_FAMILY_BINS = new Set(["tar", "bsdtar", "gtar", "star", "gnutar"]);
+/** xh / httpie family (download-dir dest flags) (#3311). */
+const XH_FAMILY_BINS = new Set(["xh", "httpie"]);
 /**
  * File destination flags for downloaders/decoders (#3206).
  * normalizeToken lowercases, so wget `-O` and curl `-o` share `-o`.
@@ -294,8 +373,13 @@ const DOWNLOADER_FILE_DEST_FLAGS = new Set([
     "-o",
     "--output",
     "--output-document",
+    "--output-file",
     "-out",
     "--out",
+    "--outfile",
+    // unar single-dash long form; GNU/others use --output-directory.
+    "-output-directory",
+    "--output-directory",
 ]);
 /** Directory destination flags (curl --output-dir / wget -P / aria2c -d); bin-scoped below. */
 const CURL_DIR_DEST_FLAGS = new Set(["--output-dir"]);
@@ -307,8 +391,11 @@ const ARIA2C_DIR_DEST_FLAGS = new Set(["-d", "--dir"]);
  */
 const TAR_DIR_DEST_FLAGS_EXACT = new Set(["-C"]);
 const TAR_DIR_DEST_FLAGS_LOWER = new Set(["--directory"]);
-/** unzip extract directory (#3245). */
+/** unzip / cabextract extract directory (#3245 / #3336). */
 const UNZIP_DIR_DEST_FLAGS = new Set(["-d"]);
+const UNZIP_DIR_DEST_BINS = new Set(["unzip", "cabextract"]);
+/** xh / httpie download directory (#3311). */
+const XH_DIR_DEST_FLAGS = new Set(["--download-dir"]);
 /**
  * cpio chdir before extract/create (#3288).
  * Case-sensitive short form: POSIX cpio uses capital `-D`; lower `-d` is a create option bit.
@@ -383,7 +470,9 @@ function isDownloaderDestFlag(flag, bin, rawFlag) {
             return true;
         return false;
     }
-    if (bin === "unzip" && UNZIP_DIR_DEST_FLAGS.has(flag))
+    if (UNZIP_DIR_DEST_BINS.has(bin) && UNZIP_DIR_DEST_FLAGS.has(flag))
+        return true;
+    if (XH_FAMILY_BINS.has(bin) && XH_DIR_DEST_FLAGS.has(flag))
         return true;
     return false;
 }
@@ -551,8 +640,8 @@ function downloaderDecoderDestinations(tokens) {
                     i++;
                     continue;
                 }
-                // unzip attached -dDIR (#3245)
-                if (bin === "unzip" && n.startsWith("-d") && n.length > 2) {
+                // unzip / cabextract attached -dDIR (#3245 / #3336)
+                if (UNZIP_DIR_DEST_BINS.has(bin) && n.startsWith("-d") && n.length > 2) {
                     dests.push(pathishToken(raw.slice(2)));
                     i++;
                     continue;

package/dist/check/cached-orchestrator.d.ts

@@ -19,6 +19,10 @@ export interface CachedCheckOptions extends CheckOrchestratorSeams {
     readonly sessionId?: string;
     /** #3282: disable run-summary emission (tests). */
     readonly emitRunSummary?: boolean;
+    /** PATH lookup seam (tests). */
+    readonly which?: (name: string) => string | null;
+    /** Override global CLI binary when dispatching CLI-native gates (#3335). */
+    readonly cliBin?: string | null;
 }
 /**
  * Run check gates sequentially with content-hash caching (#1713).

package/dist/check/cached-orchestrator.js

@@ -2,16 +2,19 @@ import { spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { join, resolve } from "node:path";
 import { lintShippedRegistry, resolveTaskContract, runWithCache, } from "../cache/task-cache/index.js";
+import { defaultWhich } from "../doctor/which.js";
 import { readCorePackageVersion } from "../engine-version.js";
-import { applyProductFirstGateMode, isHygieneGate, isProductAcGate, resolveProductFirstCheckMode, } from "../product-first-done-gate/index.js";
+import { applyProductFirstGateMode, EMPTY_AC_CAUSE, EMPTY_AC_REMEDY, isHygieneGate, isProductAcGate, isSoftEmptyAcText, resolveProductFirstCheckMode, } from "../product-first-done-gate/index.js";
 import { RunSummaryEmitter } from "../run-summary/emit.js";
 import { runToolchainPreflight, SKIP_ALL_GATES, } from "../session/toolchain-preflight.js";
+import { checkGateCliArgv, cliSpawnPlan, resolveGateDispatch, resolveGlobalCliBin, } from "./cli-native-gates.js";
 import { evaluateConsumerGateIntegrity, formatConsumerGateIntegrityFailure, } from "./consumer-gate-integrity.js";
 import { resolveCheckTarget } from "./context.js";
 import { checkGateId, checkGateSpawnArgs, gatesForCheckTarget, isSuiteCheckGate, } from "./gate-lists.js";
 import { formatDegradedSkipReport, formatNamedCauseFailure, remedyForGate } from "./named-cause.js";
 function captureSpawn(taskBin, args, opts) {
-    const result = spawnSync(taskBin, args, {
+    const plan = opts.cli === true ? cliSpawnPlan(taskBin, args) : { command: taskBin, args };
+    const result = spawnSync(plan.command, plan.args, {
         cwd: opts.cwd,
         encoding: "utf8",
         env: opts.env ?? process.env,
@@ -88,6 +91,7 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
                 degraded,
                 gates: gateOutcomes,
             });
+            emitter.emitKnownToolTurnDenominator();
         }
         catch {
             // fail-open
@@ -123,12 +127,18 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
         return 2;
     }
     // #3282: toolchain preflight — degraded skip when framework tools missing.
+    const which = options.which ?? defaultWhich;
     const preflight = options.preflight === undefined
         ? runToolchainPreflight({
             projectRoot: resolvedProject,
             frameworkRoot: resolvedFramework,
+            composedGates: gates,
+            consumerDeposit: target === "check:consumer",
+            which,
         })
         : options.preflight;
+    const taskPresent = preflight === null || !preflight.findings.some((f) => f.tool === "task" && !f.present);
+    const cliBin = options.cliBin !== undefined ? options.cliBin : resolveGlobalCliBin(which);
     // Expand SKIP_ALL_GATES sentinel to the live composition (avoids hardcode drift).
     const skipSet = new Set();
     for (const id of preflight?.skipGateIds ?? []) {
@@ -192,7 +202,26 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
         }
         options.onGateStart?.(gateId);
         const contract = resolveTaskContract(gateId);
-        const taskArgs = checkGateSpawnArgs(gateSpec, taskfilePath);
+        const dispatch = resolveGateDispatch({
+            gateId,
+            taskPresent,
+            cliBin,
+        });
+        if ("skip" in dispatch) {
+            process.stderr.write(`check: skipping gate ${gateId} (no runner) — cause: ${dispatch.cause}; remedy: ${dispatch.remedy}\n`);
+            gateOutcomes.push({
+                id: gateId,
+                status: "skipped",
+                cause: dispatch.cause,
+                remedy: dispatch.remedy,
+            });
+            options.onGateComplete?.(gateId, 0, false);
+            continue;
+        }
+        const spawnBin = dispatch.mode === "cli" ? dispatch.bin : taskBin;
+        const spawnArgs = dispatch.mode === "cli"
+            ? checkGateCliArgv(gateSpec)
+            : checkGateSpawnArgs(gateSpec, taskfilePath);
         let lastSpawn = { exitCode: 0, stdout: "", stderr: "" };
         const result = runWithCache({
             projectRoot: cwd,
@@ -201,11 +230,15 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
             noCache: options.noCache,
             runner: () => {
                 const spawned = options.gateSpawnFn
-                    ? options.gateSpawnFn(gateId, taskBin, taskArgs, {
+                    ? options.gateSpawnFn(gateId, spawnBin, spawnArgs, {
                         cwd,
                         env: options.env,
                     })
-                    : captureSpawn(taskBin, taskArgs, { cwd, env: options.env });
+                    : captureSpawn(spawnBin, spawnArgs, {
+                        cwd,
+                        env: options.env,
+                        cli: dispatch.mode === "cli",
+                    });
                 lastSpawn = {
                     exitCode: spawned.exitCode,
                     stdout: spawned.stdout,
@@ -225,6 +258,38 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
         // Fail-fast: do not start later gates (including suite) after a failure —
         // unless this is a hygiene gate under pressure mode (advisory only, #3284).
         if (result.exitCode !== 0) {
+            const combinedOut = `${lastSpawn.stdout}\n${lastSpawn.stderr}`;
+            if (isProductAcGate(gateId) && isSoftEmptyAcText(combinedOut)) {
+                process.stderr.write(`check: verify:ac empty-resolution is not a green run (soft_empty); ` +
+                    `degraded (#3334) — cause: ${EMPTY_AC_CAUSE}; remedy: ${EMPTY_AC_REMEDY}\n`);
+                gateOutcomes.push({
+                    id: gateId,
+                    status: "skipped",
+                    exit_code: result.exitCode,
+                    cause: EMPTY_AC_CAUSE,
+                    remedy: EMPTY_AC_REMEDY,
+                    from_cache: result.fromCache,
+                });
+                let sawCurrent = false;
+                for (const later of gates) {
+                    const id = checkGateId(later);
+                    if (!sawCurrent) {
+                        if (id === gateId)
+                            sawCurrent = true;
+                        continue;
+                    }
+                    if (!gateOutcomes.some((o) => o.id === id)) {
+                        gateOutcomes.push({
+                            id,
+                            status: "skipped",
+                            cause: `skipped after ${gateId} soft_empty`,
+                            remedy: EMPTY_AC_REMEDY,
+                        });
+                    }
+                }
+                emitSummary(1, true);
+                return 1;
+            }
             if (modeResolution.hygieneAdvisory && isHygieneGate(gateId) && !isProductAcGate(gateId)) {
                 process.stderr.write(`check: hygiene gate ${gateId} failed (exit ${result.exitCode}) but is ADVISORY ` +
                     `under ${modeResolution.mode} mode — continuing (#3284)\n`);

package/dist/check/cli-native-gates.d.ts

@@ -0,0 +1,43 @@
+/**
+ * CLI-native check-gate dispatch (#3335).
+ *
+ * Consumer `verify:*` (and sibling CLI verbs) must run via global
+ * `deft`/`directive` when go-task is absent. Coordinate with the #3324
+ * engine-invoke deposit marker: same global-CLI surface, no install-go-task
+ * remedy when every composed gate is CLI-dispatchable.
+ */
+import type { CheckGateSpec } from "./gate-lists.js";
+/** Install the published CLI — not go-task — when a deposit has no global deft. */
+export declare const GLOBAL_CLI_REMEDY = "Install: npm i -g @deftai/directive@latest";
+export type GateDispatchMode = "task" | "cli";
+/** True when the gate is a native CLI verb and does not require go-task. */
+export declare function isCliNativeGate(gateId: string): boolean;
+export declare function allGatesCliDispatchable(gates: readonly CheckGateSpec[]): boolean;
+/**
+ * Argv for `deft <verb> …` (no go-task `--` separator, no `--taskfile`).
+ */
+export declare function checkGateCliArgv(spec: CheckGateSpec): string[];
+export declare function resolveGlobalCliBin(which: (name: string) => string | null): string | null;
+/** Quote one argv token for `cmd.exe /d /s /c` (mirrors tasks/engine-invoke.cjs). */
+export declare function quoteWin32Arg(arg: string): string;
+/**
+ * Spawn plan for the global CLI. Win32 uses cmd.exe so `.cmd` shims run
+ * without `shell: true` (#3324 / #2547).
+ */
+export declare function cliSpawnPlan(cliBin: string, argv: readonly string[], platform?: NodeJS.Platform): {
+    command: string;
+    args: string[];
+};
+export declare function resolveGateDispatch(input: {
+    readonly gateId: string;
+    readonly taskPresent: boolean;
+    readonly cliBin: string | null;
+}): {
+    readonly mode: GateDispatchMode;
+    readonly bin: string;
+} | {
+    readonly skip: true;
+    readonly cause: string;
+    readonly remedy: string;
+};
+//# sourceMappingURL=cli-native-gates.d.ts.map

package/dist/check/cli-native-gates.js

@@ -0,0 +1,84 @@
+/**
+ * CLI-native check-gate dispatch (#3335).
+ *
+ * Consumer `verify:*` (and sibling CLI verbs) must run via global
+ * `deft`/`directive` when go-task is absent. Coordinate with the #3324
+ * engine-invoke deposit marker: same global-CLI surface, no install-go-task
+ * remedy when every composed gate is CLI-dispatchable.
+ */
+import { checkGateId } from "./gate-lists.js";
+/** Install the published CLI — not go-task — when a deposit has no global deft. */
+export const GLOBAL_CLI_REMEDY = "Install: npm i -g @deftai/directive@latest";
+const WIN32_CMD_METACHAR_RE = /[\s"&|<>^()%!]/;
+/** True when the gate is a native CLI verb and does not require go-task. */
+export function isCliNativeGate(gateId) {
+    if (gateId.startsWith("verify:") || gateId.startsWith("verify-"))
+        return true;
+    return (gateId === "doctor" ||
+        gateId === "vbrief:validate" ||
+        gateId === "toolchain:check" ||
+        gateId === "toolchain:check-consumer" ||
+        gateId === "ts:check-lane");
+}
+export function allGatesCliDispatchable(gates) {
+    return gates.every((spec) => isCliNativeGate(checkGateId(spec)));
+}
+/**
+ * Argv for `deft <verb> …` (no go-task `--` separator, no `--taskfile`).
+ */
+export function checkGateCliArgv(spec) {
+    const id = checkGateId(spec);
+    const extra = typeof spec === "string" ? [] : (spec.args ?? []);
+    if (id === "toolchain:check-consumer") {
+        return ["toolchain-check", "--consumer", ...extra];
+    }
+    if (id === "toolchain:check") {
+        return ["toolchain-check", ...extra];
+    }
+    if (id === "ts:check-lane") {
+        return ["ts-check-lane", ...extra];
+    }
+    return [id, ...extra];
+}
+export function resolveGlobalCliBin(which) {
+    return which("deft") ?? which("directive");
+}
+/** Quote one argv token for `cmd.exe /d /s /c` (mirrors tasks/engine-invoke.cjs). */
+export function quoteWin32Arg(arg) {
+    if (arg.length > 0 && !WIN32_CMD_METACHAR_RE.test(arg)) {
+        return arg;
+    }
+    return `"${arg.replace(/"/g, '""')}"`;
+}
+/**
+ * Spawn plan for the global CLI. Win32 uses cmd.exe so `.cmd` shims run
+ * without `shell: true` (#3324 / #2547).
+ */
+export function cliSpawnPlan(cliBin, argv, platform = process.platform) {
+    if (platform === "win32") {
+        const commandLine = [cliBin, ...argv].map(quoteWin32Arg).join(" ");
+        return { command: "cmd.exe", args: ["/d", "/s", "/c", commandLine] };
+    }
+    return { command: cliBin, args: [...argv] };
+}
+export function resolveGateDispatch(input) {
+    if (input.taskPresent) {
+        return { mode: "task", bin: "task" };
+    }
+    if (isCliNativeGate(input.gateId) && input.cliBin !== null) {
+        return { mode: "cli", bin: input.cliBin };
+    }
+    if (isCliNativeGate(input.gateId)) {
+        return {
+            skip: true,
+            cause: "no go-task and no global deft/directive CLI",
+            remedy: GLOBAL_CLI_REMEDY,
+        };
+    }
+    return {
+        skip: true,
+        cause: "go-task binary not found on PATH",
+        remedy: "Install go-task: https://taskfile.dev/installation/",
+    };
+}
+//# sourceMappingURL=cli-native-gates.js.map

package/dist/check/index.d.ts

@@ -1,4 +1,5 @@
 export { type CachedCheckOptions, dispatchCachedTaskCheck } from "./cached-orchestrator.js";
+export { allGatesCliDispatchable, checkGateCliArgv, cliSpawnPlan, GLOBAL_CLI_REMEDY, isCliNativeGate, resolveGateDispatch, resolveGlobalCliBin, } from "./cli-native-gates.js";
 export { CHECK_GRAPH_REQUIRED_NAMESPACES, CONSUMER_GATE_INTEGRITY_RECOVERY, type ConsumerGateIntegrityFinding, type ConsumerGateIntegrityResult, type ConsumerGateIntegritySeams, checkGraphOptionalIncludeViolations, evaluateConsumerGateIntegrity, formatConsumerGateIntegrityFailure, gateLocalName, gateNamespace, includeTaskfileRel, parseTaskfileIncludes, requiredNamespacesForGates, taskDefinedInTaskfileYaml, } from "./consumer-gate-integrity.js";
 export { type CheckGateSpec, CONSUMER_CHECK_GATES, checkGateId, checkGateSpawnArgs, FRAMEWORK_CHECK_GATES, gatesForCheckTarget, isFastBeforeSlowOrder, isSuiteCheckGate, PRODUCT_FIRST_AC_GATE, SUITE_CHECK_GATE_IDS, } from "./gate-lists.js";
 export { extractGateCause, formatDegradedSkipReport, formatNamedCauseFailure, type NamedCauseMessage, remedyForGate, } from "./named-cause.js";

package/dist/check/index.js

@@ -1,4 +1,5 @@
 export { dispatchCachedTaskCheck } from "./cached-orchestrator.js";
+export { allGatesCliDispatchable, checkGateCliArgv, cliSpawnPlan, GLOBAL_CLI_REMEDY, isCliNativeGate, resolveGateDispatch, resolveGlobalCliBin, } from "./cli-native-gates.js";
 export { CHECK_GRAPH_REQUIRED_NAMESPACES, CONSUMER_GATE_INTEGRITY_RECOVERY, checkGraphOptionalIncludeViolations, evaluateConsumerGateIntegrity, formatConsumerGateIntegrityFailure, gateLocalName, gateNamespace, includeTaskfileRel, parseTaskfileIncludes, requiredNamespacesForGates, taskDefinedInTaskfileYaml, } from "./consumer-gate-integrity.js";
 export { CONSUMER_CHECK_GATES, checkGateId, checkGateSpawnArgs, FRAMEWORK_CHECK_GATES, gatesForCheckTarget, isFastBeforeSlowOrder, isSuiteCheckGate, PRODUCT_FIRST_AC_GATE, SUITE_CHECK_GATE_IDS, } from "./gate-lists.js";
 export { extractGateCause, formatDegradedSkipReport, formatNamedCauseFailure, remedyForGate, } from "./named-cause.js";

package/dist/check/named-cause.js

@@ -26,6 +26,7 @@ const GATE_REMEDIES = {
     "verify:agents-md-budget": "Trim AGENTS.md managed section or raise plan.policy.agentsMdBudget deliberately",
 };
 const SPAWN_ERROR_REMEDY = "Install go-task (https://taskfile.dev/installation/) and ensure `task` is on PATH; then re-run task check";
+const CLI_SPAWN_ERROR_REMEDY = "Install: npm i -g @deftai/directive@latest";
 /**
  * Extract a short cause from gate stdout/stderr without leaking env values.
  * Strips lines that look like KEY=value assignments.
@@ -34,6 +35,9 @@ export function extractGateCause(stdout, stderr, exitCode, spawnError) {
     if (spawnError !== undefined && spawnError.length > 0) {
         // Normalize common missing-binary messages without path dumps.
         if (/ENOENT|not found|not recognized/i.test(spawnError)) {
+            if (/\b(deft|directive)(\.cmd)?\b/i.test(spawnError)) {
+                return "global deft/directive CLI not found on PATH";
+            }
             return "task binary not found on PATH (cannot spawn go-task)";
         }
         return sanitizeCauseLine(spawnError);
@@ -68,7 +72,13 @@ function sanitizeCauseLine(line) {
     return out;
 }
 export function remedyForGate(gateId, cause) {
+    if (/global deft\/directive CLI not found/i.test(cause)) {
+        return CLI_SPAWN_ERROR_REMEDY;
+    }
     if (/task binary not found|cannot spawn go-task/i.test(cause)) {
+        if (gateId.startsWith("verify:") || gateId.startsWith("verify-") || gateId === "doctor") {
+            return CLI_SPAWN_ERROR_REMEDY;
+        }
         return SPAWN_ERROR_REMEDY;
     }
     if (/pnpm binary not found|pnpm: NOT FOUND/i.test(cause)) {

package/dist/doctor/checks.d.ts

@@ -87,12 +87,6 @@ export declare function checkTypescript7SideBySide(projectRoot: string, seams?:
  * `directive init` or `directive update`).
  */
 export declare function checkGitignoreCoverage(projectRoot: string, seams?: CheckSeams): CheckResult;
-/**
- * Surface undecided / invalid coverageDebt + checkResume policy (#3189).
- * Advisory skip when undecided; never hard-fails doctor / check:consumer.
- * Decided-off is quiet; dismiss-with-reason is pass with reason in detail.
- * Invalid typed blocks resolve fail-closed and surface via source=default-on-error.
- */
 /**
  * Fail closed when completed/ plan.status disagrees with the folder (#3242 AC1 / epic #3237 Q4).
  * Open plan.items under completed/ are reported by `checkCompletedOpenItems` (exit-exempt
@@ -104,6 +98,11 @@ export declare function checkCompletedLifecycleConsistency(projectRoot: string):
  * historical pre-#2862 corpora do not red-light doctor; scope:complete fails closed.
  */
 export declare function checkCompletedOpenItems(projectRoot: string): CheckResult;
+/**
+ * Surface invalid coverageDebt + checkResume typed blocks (#3314).
+ * Absent / default / valid typed values pass. Invalid blocks skip (advisory,
+ * fail-closed resolution). Doctor no longer reports "undecided".
+ */
 export declare function checkCoverageCheckResumePolicy(projectRoot: string): CheckResult;
 export declare function deriveExitCode(checks: readonly CheckResult[], errors: readonly string[]): number;
 export declare function runChecksImpl(projectRoot: string, seams?: CheckSeams & {

package/dist/doctor/checks.js

@@ -8,7 +8,6 @@ import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { scanCompletedLifecycleConsistency } from "../lifecycle/completed-consistency.js";
 import { resolveCheckResume } from "../policy/check-resume.js";
 import { resolveCoverageDebt } from "../policy/coverage-debt.js";
-import { policyColonInvocation } from "../policy/policy-invocation.js";
 import { classifyXbriefSchemaDistance } from "../staleness-tickler/probe-xbrief.js";
 import { findSkillPathsInText } from "../text/redos-safe.js";
 import { stripGitignoreInlineComment } from "../triage/bootstrap/gitignore.js";
@@ -1070,12 +1069,6 @@ export function checkGitignoreCoverage(projectRoot, seams = {}) {
         },
     };
 }
-/**
- * Surface undecided / invalid coverageDebt + checkResume policy (#3189).
- * Advisory skip when undecided; never hard-fails doctor / check:consumer.
- * Decided-off is quiet; dismiss-with-reason is pass with reason in detail.
- * Invalid typed blocks resolve fail-closed and surface via source=default-on-error.
- */
 /**
  * Fail closed when completed/ plan.status disagrees with the folder (#3242 AC1 / epic #3237 Q4).
  * Open plan.items under completed/ are reported by `checkCompletedOpenItems` (exit-exempt
@@ -1152,6 +1145,11 @@ export function checkCompletedOpenItems(projectRoot) {
         },
     };
 }
+/**
+ * Surface invalid coverageDebt + checkResume typed blocks (#3314).
+ * Absent / default / valid typed values pass. Invalid blocks skip (advisory,
+ * fail-closed resolution). Doctor no longer reports "undecided".
+ */
 export function checkCoverageCheckResumePolicy(projectRoot) {
     const debt = resolveCoverageDebt(projectRoot);
     const resume = resolveCheckResume(projectRoot);
@@ -1160,66 +1158,25 @@ export function checkCoverageCheckResumePolicy(projectRoot) {
             name: "coverage-check-resume-policy",
             status: "skip",
             detail: "advisory: coverageDebt and/or checkResume block is invalid; " +
-                "resolution is fail-closed (mode off, localStamp off, CI never trusts stamps). " +
+                "resolution is fail-closed (mode off, localStamp off). " +
                 `coverageDebt.error=${JSON.stringify(debt.error)}; ` +
                 `checkResume.error=${JSON.stringify(resume.error)}. ` +
-                "Fix the typed block or re-apply Strict / Hatch-aware / dismiss-with-reason.",
+                "Fix the typed block in PROJECT-DEFINITION.",
             data: {
-                coverageDebt: { status: debt.status, source: debt.source, error: debt.error },
-                checkResume: { status: resume.status, source: resume.source, error: resume.error },
+                coverageDebt: { mode: debt.mode, source: debt.source, error: debt.error },
+                checkResume: { localStamp: resume.localStamp, source: resume.source, error: resume.error },
                 advisory: true,
                 invalid: true,
             },
         };
     }
-    const undecided = debt.status === "unset" || resume.status === "unset";
-    if (!undecided) {
-        const dismissParts = [];
-        if (debt.dismissReason) {
-            dismissParts.push(`coverageDebt.dismissReason=${JSON.stringify(debt.dismissReason)}`);
-        }
-        if (resume.dismissReason) {
-            dismissParts.push(`checkResume.dismissReason=${JSON.stringify(resume.dismissReason)}`);
-        }
-        const dismissNote = dismissParts.length > 0 ? ` Dismissed: ${dismissParts.join("; ")}.` : "";
-        return {
-            name: "coverage-check-resume-policy",
-            status: "pass",
-            detail: `coverageDebt status=${debt.status} mode=${debt.mode}; ` +
-                `checkResume status=${resume.status} localStamp=${resume.localStamp}; ` +
-                `ciTrustsLocalStamp=false (fixed v1).${dismissNote}`,
-            data: {
-                coverageDebt: {
-                    status: debt.status,
-                    mode: debt.mode,
-                    autoFile: debt.autoFile,
-                    dismissReason: debt.dismissReason,
-                },
-                checkResume: {
-                    status: resume.status,
-                    localStamp: resume.localStamp,
-                    ciTrustsLocalStamp: false,
-                    dismissReason: resume.dismissReason,
-                },
-            },
-        };
-    }
-    // Advisory only (status=skip): never hard-fails doctor / check:consumer (#3189).
-    // Behavior remains fail-closed while unset; session-start nudge carries the ask.
     return {
         name: "coverage-check-resume-policy",
-        status: "skip",
-        detail: "advisory: coverageDebt and/or checkResume policy is undecided (status=unset). " +
-            "Behavior stays fail-closed (no hatch soft-pass, no local suite stamp, CI never trusts stamps). " +
-            "Choose Strict / Hatch-aware on the next interactive session-start nudge, or record " +
-            "dismiss-with-reason. Inspect: " +
-            `\`${policyColonInvocation("show", " --field=coverageDebt")}\` / ` +
-            `\`${policyColonInvocation("show", " --field=checkResume")}\`.`,
+        status: "pass",
+        detail: `coverageDebt.mode=${debt.mode}; checkResume.localStamp=${resume.localStamp}.`,
         data: {
-            coverageDebt: { status: debt.status, mode: debt.mode },
-            checkResume: { status: resume.status, localStamp: resume.localStamp },
-            suggested_fix: policyColonInvocation("show", " --field=coverageDebt"),
-            advisory: true,
+            coverageDebt: { mode: debt.mode, autoFile: debt.autoFile, source: debt.source },
+            checkResume: { localStamp: resume.localStamp, source: resume.source },
         },
     };
 }

package/dist/eval/later-graduation.d.ts

@@ -0,0 +1,39 @@
+/**
+ * #3286 Later graduation trigger from a #3282 run summary (#3320).
+ *
+ * Named surface: eval:report prints graduate / do-not-graduate / unevaluable.
+ * A graduation or decline MUST cite an emitted share. Counts without a
+ * denominator are unevaluable — never invent a ratio.
+ */
+import { type RitualGateShare } from "../run-summary/share.js";
+/** #3286 Later trigger: graduate when ritual+gate share is at least this fraction. */
+export declare const LATER_GRADUATION_SHARE_THRESHOLD = 0.25;
+export type LaterGraduationVerdict = "graduate" | "do-not-graduate" | "unevaluable";
+export interface LaterGraduationTrigger {
+    readonly evaluable: boolean;
+    readonly verdict: LaterGraduationVerdict;
+    readonly summary: string;
+    readonly ritualGateCount: number;
+    readonly totalToolTurns: number | null;
+    readonly share: number | null;
+    readonly threshold: number;
+}
+export interface EvaluateLaterGraduationOptions {
+    readonly projectRoot: string;
+    readonly runSummaryPath?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly threshold?: number;
+}
+export declare function laterGraduationFromShare(share: RitualGateShare, threshold?: number): LaterGraduationTrigger;
+/**
+ * Resolve a readable run-summary path. Unset env + missing default file → null
+ * (fail-open / unevaluable). stdout dest (`-`) is not a file.
+ */
+export declare function resolveRunSummaryReadPath(projectRoot: string, options?: {
+    readonly runSummaryPath?: string;
+    readonly env?: NodeJS.ProcessEnv;
+}): string | null;
+/** Evaluate #3286 Later from the run-summary file (or unevaluable). */
+export declare function evaluateLaterGraduationTrigger(options: EvaluateLaterGraduationOptions): LaterGraduationTrigger;
+export declare function formatLaterGraduationLine(trigger: LaterGraduationTrigger): string;
+//# sourceMappingURL=later-graduation.d.ts.map