@deftai/directive-core 0.103.0 → 0.105.0

package/dist/preflight/intended-placement.js

@@ -0,0 +1,275 @@
+/**
+ * xBRIEF intended-placement field + preflight check (#3424).
+ *
+ * Preflight keys on declared files vs FILE_SIZE_REVIEW_TRIGGER_LINES.
+ * Size alone is not a hard cap (#1488).
+ *
+ * ## Error policy
+ * Every anomaly on a declared file fails closed (exit 1 + remediation hint).
+ * Never throw. Never silent-skip. The only skip is first-touch `lstat` ENOENT
+ * (planned-new file — nothing to measure). If `lstat` succeeded and a later
+ * operation fails, that is an inconsistency → exit 1.
+ *
+ * ## Threat model
+ * Preflight is a quality gate the agent runs against its own declared plan
+ * in its own worktree. A concurrent local process that can swap symlinks
+ * mid-check can trivially edit the vBRIEF itself. Adversarial-local-attacker
+ * TOCTOU is a **non-goal** beyond the fd discipline below. Windows symlink
+ * creation requires elevation.
+ *
+ * ## fd discipline
+ * `lstat` rejects symlink entries outright. Resolve + containment-check once.
+ * `openSync(abs, O_RDONLY | O_NOFOLLOW)` (plain `O_RDONLY` where `O_NOFOLLOW`
+ * is undefined, i.e. Windows). `fstatSync(fd)` confirms a regular file; read
+ * from that same fd.
+ */
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { FILE_SIZE_REVIEW_TRIGGER_LINES } from "../policy/file-size-thresholds.js";
+import { findLifecycleRootFromArtifact } from "../scope/parent-lineage.js";
+export const INTENDED_PLACEMENT_SCHEMA = "deft.scope.intended_placement.v1";
+export const INTENDED_PLACEMENT_MISSING_HINT = "Record plan.metadata.intended_placement with files[] and module_boundary before implementation.";
+export const INTENDED_PLACEMENT_OVER_TRIGGER_HINT = "Record plan.metadata.intended_placement.split_plan or cohesion_exemption. Size alone is not a fail-closed cap (#1488 / #3424).";
+export const INTENDED_PLACEMENT_GRANDFATHER_HINT = "Pre-#3424 brief: intended_placement is missing (warning). Ingest now stamps the field; record files[] before new work.";
+function asRecord(value) {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+export function emptyIntendedPlacement() {
+    return {
+        schema: INTENDED_PLACEMENT_SCHEMA,
+        files: [],
+        module_boundary: "",
+    };
+}
+/** Stamp a skeleton intended_placement onto plan.metadata when absent (#3424). */
+export function stampIntendedPlacement(plan) {
+    const existing = asRecord(plan.metadata) ?? {};
+    if (asRecord(existing.intended_placement) !== null) {
+        plan.metadata = existing;
+        return;
+    }
+    plan.metadata = {
+        ...existing,
+        intended_placement: emptyIntendedPlacement(),
+    };
+}
+export function parseIntendedPlacement(plan) {
+    const metadata = asRecord(plan.metadata);
+    if (metadata === null)
+        return { kind: "missing" };
+    if (!("intended_placement" in metadata) || metadata.intended_placement === undefined) {
+        return { kind: "missing" };
+    }
+    const raw = asRecord(metadata.intended_placement);
+    if (raw === null) {
+        return {
+            kind: "malformed",
+            message: `intended_placement is not an object. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+        };
+    }
+    if (!Array.isArray(raw.files)) {
+        return {
+            kind: "malformed",
+            message: `intended_placement.files is not an array. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+        };
+    }
+    const files = [];
+    for (let i = 0; i < raw.files.length; i++) {
+        const entry = raw.files[i];
+        if (typeof entry !== "string" || entry.trim().length === 0) {
+            return {
+                kind: "malformed",
+                message: `intended_placement.files[${i}] is not a non-empty string. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+            };
+        }
+        files.push(entry.trim());
+    }
+    return {
+        kind: "ok",
+        placement: {
+            schema: typeof raw.schema === "string" ? raw.schema : undefined,
+            files,
+            module_boundary: isNonEmptyString(raw.module_boundary)
+                ? raw.module_boundary.trim()
+                : undefined,
+            split_plan: isNonEmptyString(raw.split_plan) ? raw.split_plan.trim() : undefined,
+            cohesion_exemption: isNonEmptyString(raw.cohesion_exemption)
+                ? raw.cohesion_exemption.trim()
+                : undefined,
+        },
+    };
+}
+export function readIntendedPlacement(plan) {
+    const parsed = parseIntendedPlacement(plan);
+    return parsed.kind === "ok" ? parsed.placement : null;
+}
+export function countFileLines(text) {
+    if (text.length === 0)
+        return 0;
+    const parts = text.split(/\r\n|\n|\r/);
+    return parts[parts.length - 1] === "" ? parts.length - 1 : parts.length;
+}
+export function resolveProjectRootFromBrief(briefPath, explicitRoot) {
+    if (explicitRoot !== undefined && explicitRoot.length > 0) {
+        return resolve(explicitRoot);
+    }
+    const lifecycle = findLifecycleRootFromArtifact(briefPath);
+    if (lifecycle !== null) {
+        return resolve(lifecycle, "..");
+    }
+    return resolve(briefPath, "..", "..");
+}
+function resolveDeclaredFile(projectRoot, declared) {
+    const trimmed = declared.trim();
+    if (trimmed.length === 0)
+        return null;
+    const abs = isAbsolute(trimmed) ? resolve(trimmed) : resolve(projectRoot, trimmed);
+    const rel = relative(projectRoot, abs);
+    if (rel.startsWith("..") || rel === "" || rel.split(sep).includes("..")) {
+        return null;
+    }
+    return abs;
+}
+function rejectInspect(declared, reason) {
+    return {
+        kind: "reject",
+        message: `Could not inspect intended file '${declared}': ${reason}. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+    };
+}
+function errnoCode(err) {
+    return err.code;
+}
+function errReason(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * lstat (first-touch ENOENT = planned-new skip) → reject symlink →
+ * open+fstat+read the same fd. Later ENOENT is inconsistency, not skip.
+ */
+function inspectDeclaredFile(declared, abs) {
+    let info;
+    try {
+        info = lstatSync(abs);
+    }
+    catch (err) {
+        if (errnoCode(err) === "ENOENT") {
+            return { kind: "missing" };
+        }
+        return rejectInspect(declared, errReason(err));
+    }
+    if (info.isSymbolicLink()) {
+        return {
+            kind: "reject",
+            message: `Intended path '${declared}' is a symlink. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+        };
+    }
+    if (!info.isFile()) {
+        return {
+            kind: "reject",
+            message: `Intended path '${declared}' is not a regular file. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+        };
+    }
+    const nofollow = constants.O_NOFOLLOW;
+    const flags = constants.O_RDONLY | (typeof nofollow === "number" ? nofollow : 0);
+    let fd;
+    try {
+        fd = openSync(abs, flags);
+    }
+    catch (err) {
+        const code = errnoCode(err);
+        if (code === "ELOOP" || code === "EMLINK") {
+            return {
+                kind: "reject",
+                message: `Intended path '${declared}' is a symlink. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+            };
+        }
+        return rejectInspect(declared, errReason(err));
+    }
+    try {
+        const st = fstatSync(fd);
+        if (!st.isFile()) {
+            return {
+                kind: "reject",
+                message: `Intended path '${declared}' is not a regular file. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+            };
+        }
+        return { kind: "file", text: readFileSync(fd, "utf8") };
+    }
+    catch (err) {
+        return rejectInspect(declared, errReason(err));
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch {
+            // already closed or invalid
+        }
+    }
+}
+function hasRemediation(placement) {
+    return ((placement.split_plan !== undefined && placement.split_plan.length > 0) ||
+        (placement.cohesion_exemption !== undefined && placement.cohesion_exemption.length > 0));
+}
+export function evaluateIntendedPlacement(plan, options) {
+    const parsed = parseIntendedPlacement(plan);
+    if (parsed.kind === "missing") {
+        return {
+            ok: true,
+            warning: true,
+            message: INTENDED_PLACEMENT_GRANDFATHER_HINT,
+        };
+    }
+    if (parsed.kind === "malformed") {
+        return { ok: false, message: parsed.message };
+    }
+    const placement = parsed.placement;
+    if (placement.files.length === 0) {
+        return {
+            ok: true,
+            message: "intended placement pending (ingest scaffold; no declared files)",
+        };
+    }
+    if (!isNonEmptyString(placement.module_boundary)) {
+        return {
+            ok: false,
+            message: `xBRIEF intended_placement lacks module_boundary. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+        };
+    }
+    const root = resolve(options.projectRoot);
+    const over = [];
+    for (const declared of placement.files) {
+        const abs = resolveDeclaredFile(root, declared);
+        if (abs === null) {
+            return {
+                ok: false,
+                message: `Intended file '${declared}' escapes the project root. ${INTENDED_PLACEMENT_MISSING_HINT}`,
+            };
+        }
+        const inspected = inspectDeclaredFile(declared, abs);
+        if (inspected.kind === "missing") {
+            continue;
+        }
+        if (inspected.kind === "reject") {
+            return { ok: false, message: inspected.message };
+        }
+        const lines = countFileLines(inspected.text);
+        if (lines >= FILE_SIZE_REVIEW_TRIGGER_LINES) {
+            over.push(`${declared} (${lines} lines >= ${FILE_SIZE_REVIEW_TRIGGER_LINES})`);
+        }
+    }
+    if (over.length > 0 && !hasRemediation(placement)) {
+        return {
+            ok: false,
+            message: `Declared file already over the review-trigger threshold: ${over.join("; ")}. ${INTENDED_PLACEMENT_OVER_TRIGGER_HINT}`,
+        };
+    }
+    return { ok: true, message: "intended placement OK" };
+}
+//# sourceMappingURL=intended-placement.js.map

package/dist/preflight/project-invariants-gate.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Preflight / story-ready fail-closed check for applicable project invariants (#3425 Story B).
+ *
+ * Evaluates the PROJECT-DEFINITION list as of check time (list-drift).
+ * Completeness only — does not prove a declared `covered` is true.
+ */
+export declare const PROJECT_INVARIANT_REMEDIATION: string;
+export interface ProjectInvariantsGateResult {
+    readonly ok: boolean;
+    readonly message: string;
+    readonly applicableIds: readonly string[];
+    readonly missingIds: readonly string[];
+}
+export interface ProjectInvariantsGateOptions {
+    readonly projectRoot?: string;
+    readonly skip?: boolean;
+}
+/**
+ * Prefer an explicit project root. Otherwise walk up from the story path to
+ * the xbrief/vbrief lifecycle folder and take its parent (the repo root).
+ * Lets `xbrief:preflight` fire without a CLI `--project-root`.
+ */
+export declare function resolveProjectRootForInvariants(artifactPath: string, explicit?: string): string | undefined;
+/**
+ * Fail closed when an applicable project invariant ID has no coverage disposition.
+ * Empty or absent list is a no-op. Slice- and worktree-scoped stories share this check.
+ */
+export declare function evaluateProjectInvariantsGate(story: unknown, options?: ProjectInvariantsGateOptions): ProjectInvariantsGateResult;
+//# sourceMappingURL=project-invariants-gate.d.ts.map

package/dist/preflight/project-invariants-gate.js

@@ -0,0 +1,82 @@
+/**
+ * Preflight / story-ready fail-closed check for applicable project invariants (#3425 Story B).
+ *
+ * Evaluates the PROJECT-DEFINITION list as of check time (list-drift).
+ * Completeness only — does not prove a declared `covered` is true.
+ */
+import { dirname } from "node:path";
+import { extractModulePathGlobs, resolveProjectInvariants } from "../policy/project-invariants.js";
+import { loadProjectDefinition } from "../policy/resolve.js";
+import { extractStoryFileScope } from "../policy/write-fence.js";
+import { extractChildCoverageDraft, findLifecycleRootFromArtifact, } from "../scope/parent-lineage.js";
+import { applicableProjectInvariants, PROJECT_INVARIANT_DISPOSITIONS, validateProjectInvariantCoverage, } from "../scope/project-invariant-coverage.js";
+export const PROJECT_INVARIANT_REMEDIATION = "Declare coverage_map[<id>].disposition as " +
+    `${PROJECT_INVARIANT_DISPOSITIONS.join("|")} ` +
+    "(split is excluded at project level).";
+/**
+ * Prefer an explicit project root. Otherwise walk up from the story path to
+ * the xbrief/vbrief lifecycle folder and take its parent (the repo root).
+ * Lets `xbrief:preflight` fire without a CLI `--project-root`.
+ */
+export function resolveProjectRootForInvariants(artifactPath, explicit) {
+    if (explicit !== undefined && explicit.length > 0)
+        return explicit;
+    const lifecycle = findLifecycleRootFromArtifact(artifactPath);
+    return lifecycle === null ? undefined : dirname(lifecycle);
+}
+/**
+ * Fail closed when an applicable project invariant ID has no coverage disposition.
+ * Empty or absent list is a no-op. Slice- and worktree-scoped stories share this check.
+ */
+export function evaluateProjectInvariantsGate(story, options = {}) {
+    if (options.skip === true) {
+        return { ok: true, message: "project invariants skipped", applicableIds: [], missingIds: [] };
+    }
+    const projectRoot = options.projectRoot;
+    if (projectRoot === undefined || projectRoot.length === 0) {
+        return {
+            ok: true,
+            message: "project invariants N/A (no project root)",
+            applicableIds: [],
+            missingIds: [],
+        };
+    }
+    const resolved = resolveProjectInvariants(projectRoot);
+    if (resolved.invariants.length === 0) {
+        return {
+            ok: true,
+            message: "project invariants empty (no-op)",
+            applicableIds: [],
+            missingIds: [],
+        };
+    }
+    const [data] = loadProjectDefinition(projectRoot);
+    const modulePathGlobs = extractModulePathGlobs(data);
+    const { fileScope } = extractStoryFileScope(story);
+    const applicable = applicableProjectInvariants(resolved.invariants, fileScope, modulePathGlobs);
+    const applicableIds = applicable.map((a) => a.id);
+    const extracted = extractChildCoverageDraft(story);
+    const coverage = validateProjectInvariantCoverage({
+        applicableIds,
+        draft: extracted.draft ?? {},
+    });
+    if (coverage.ok) {
+        return {
+            ok: true,
+            message: applicableIds.length === 0
+                ? "project invariants: none applicable"
+                : `project invariants OK (${applicableIds.length} applicable)`,
+            applicableIds,
+            missingIds: [],
+        };
+    }
+    const omitted = coverage.missingIds.length > 0 ? coverage.missingIds.join(", ") : "(see errors)";
+    return {
+        ok: false,
+        applicableIds,
+        missingIds: coverage.missingIds,
+        message: `applicable project invariant ID omitted: ${omitted}. ${PROJECT_INVARIANT_REMEDIATION} ` +
+            coverage.errors.join("; "),
+    };
+}
+//# sourceMappingURL=project-invariants-gate.js.map

package/dist/product-first-done-gate/acceptance-resolver.d.ts

@@ -0,0 +1,128 @@
+/**
+ * One resolver for "does this artifact carry executable acceptance that passed?" (#3497).
+ *
+ * Before this module `verify:ac` and `scope:complete` read the same artifact through
+ * two different lenses and reported two different things:
+ *
+ * - verify:ac composed a message from the sub-gates (`verify:ac passed`, `Literal
+ *   acceptance-command gate passed`) and then flipped `ok` in a later stage
+ *   (clause walk / no-op ledger / oracle integrity) without relabelling the message.
+ * - scope:complete took that `ok=false` and asserted "empty or failing acceptance"
+ *   even when acceptance was neither empty nor failing.
+ *
+ * Both now read the verdict here. One predicate name, one observed value, printed
+ * identically by both consumers.
+ *
+ * This module is intentionally structural (no import of `VerifyAcResult`) so the
+ * done-gate evaluator and the scope gate can both depend on it without a cycle.
+ */
+import type { VerifyAcResolution } from "./empty-resolution.js";
+import type { AcSourceRung } from "./types.js";
+/**
+ * Which check decided the acceptance verdict. Named in operator output so the
+ * message can never again assert a predicate that did not fire (#3497).
+ */
+export type AcceptancePredicate = 
+/** Executable acceptance commands ran and every one exited as expected. */
+"executable-pass"
+/** Nothing executable to run and the project floor allows it. */
+ | "empty-pass"
+/** plan.acceptance schema / brief could not be read. */
+ | "config-error"
+/** A stated command cannot fail (#3396 no-op denylist). */
+ | "noop-refused"
+/** Safety-rejected shell-shaped stated command(s) block completion (#3267). */
+ | "safety-rejected"
+/** At least one executable command exited other than expected. */
+ | "commands-failed"
+/** No executable acceptance stamped and no suite floor to stand on (#3334). */
+ | "empty-acceptance"
+/** Derived clause walk contradicted the shipped artifact (#3323). */
+ | "clause-walk-failed"
+/** Unresolved pass-after-fail-with-method-change (#3322). */
+ | "integrity-discrepancy"
+/** Fell through every named predicate — carries the message lead verbatim. */
+ | "unclassified";
+export interface AcceptanceVerdict {
+    readonly ok: boolean;
+    readonly predicate: AcceptancePredicate;
+    /** The value the deciding check actually read. Never a restatement of the rule. */
+    readonly observed: string;
+    /** What to change so the predicate stops firing. */
+    readonly remedy: string;
+}
+/**
+ * Structural view of a verify:ac result. `VerifyAcResult` satisfies this shape;
+ * keeping it structural avoids an import cycle with `evaluate.ts`.
+ */
+export interface AcceptanceReading {
+    readonly ok: boolean;
+    readonly code: number;
+    readonly message: string;
+    readonly resolution: VerifyAcResolution;
+    readonly sourceRung: AcSourceRung;
+    readonly runs: readonly {
+        readonly ok: boolean;
+        readonly command: string;
+    }[];
+    readonly commands: readonly unknown[];
+    readonly rejected?: readonly {
+        readonly command: string;
+        readonly reason: string;
+    }[];
+    readonly advisoryRejected?: readonly {
+        readonly command: string;
+    }[];
+    readonly clauseOutcomes?: readonly {
+        readonly id: number;
+        readonly outcome: string;
+    }[];
+    readonly acceptance: {
+        readonly commands: readonly unknown[];
+    };
+}
+/** Executable command count this reading resolved (stamped or ledger). */
+export declare function resolvedAcceptanceCommandCount(reading: AcceptanceReading): number;
+/**
+ * Name the predicate that decided this verify:ac result, and the value it read.
+ *
+ * Order matters: the earliest fail-closed stage wins so the operator is pointed at
+ * the check that actually refused rather than a downstream symptom.
+ */
+export declare function resolveAcceptanceVerdict(reading: AcceptanceReading): AcceptanceVerdict;
+/** One line naming the predicate and the value it read (#3497). */
+export declare function formatAcceptanceVerdict(verdictResult: AcceptanceVerdict): string;
+/**
+ * Clause-walk composition (#3323 / #3497).
+ *
+ * A clause the shipped artifact contradicts (`failed`) always blocks. A clause the
+ * static walk cannot decide (`unverifiable`) is evidence of nothing — it blocks only
+ * when nothing else verified the product. A green executable acceptance run IS that
+ * something: the product-first oracle already ran. Before #3497 an all-unverifiable
+ * clause set refused an artifact whose stated command had just exited 0.
+ */
+export declare function clauseWalkBlocks(input: {
+    readonly failed: number;
+    readonly verified: number;
+    readonly walked: number;
+    readonly hasGreenExecutableRun: boolean;
+}): boolean;
+/** Which consumer is reading acceptance. Selects one shared option profile (#3497). */
+export type AcceptanceReaderProfile = 
+/** `task verify:ac -- <xbrief>` standalone done-gate run. */
+"standalone"
+/** `task check` composition (`--soft-missing-xbrief`). */
+ | "check"
+/** `scope:complete` hard precondition walk (#3357). */
+ | "complete";
+export interface AcceptanceGateProfileOptions {
+    readonly captureFromNarratives: boolean | undefined;
+    readonly checkIntegrated: boolean;
+    readonly reuseMode: "auto" | "bank" | "never";
+}
+/**
+ * The single option set each reader uses. Previously verify:ac and scope:complete
+ * hand-assembled divergent option objects at their call sites (#3497).
+ */
+export declare function resolveAcceptanceGateProfile(profile: AcceptanceReaderProfile): AcceptanceGateProfileOptions;
+//# sourceMappingURL=acceptance-resolver.d.ts.map

package/dist/product-first-done-gate/acceptance-resolver.js

@@ -0,0 +1,144 @@
+/**
+ * One resolver for "does this artifact carry executable acceptance that passed?" (#3497).
+ *
+ * Before this module `verify:ac` and `scope:complete` read the same artifact through
+ * two different lenses and reported two different things:
+ *
+ * - verify:ac composed a message from the sub-gates (`verify:ac passed`, `Literal
+ *   acceptance-command gate passed`) and then flipped `ok` in a later stage
+ *   (clause walk / no-op ledger / oracle integrity) without relabelling the message.
+ * - scope:complete took that `ok=false` and asserted "empty or failing acceptance"
+ *   even when acceptance was neither empty nor failing.
+ *
+ * Both now read the verdict here. One predicate name, one observed value, printed
+ * identically by both consumers.
+ *
+ * This module is intentionally structural (no import of `VerifyAcResult`) so the
+ * done-gate evaluator and the scope gate can both depend on it without a cycle.
+ */
+import { NOOP_ACCEPTANCE_REMEDIATION } from "../literal-acceptance/index.js";
+const REMEDY = {
+    "executable-pass": "",
+    "empty-pass": "",
+    "config-error": "fix plan.acceptance so it matches the #3284 schema, then re-run task verify:ac",
+    "noop-refused": NOOP_ACCEPTANCE_REMEDIATION,
+    "safety-rejected": "promote a safe alternative into plan.metadata.swarm.verify_commands or remove the stated command from the task statement (#3267)",
+    "commands-failed": "fix the product until the stated acceptance command exits as expected — the command, not the gate, is the oracle (#3284)",
+    "empty-acceptance": "stamp executable commands on plan.acceptance.commands (or plan.metadata.swarm.verify_commands) with source_rung derived|project_floor (#3334)",
+    "clause-walk-failed": "ship the artifact each failed clause names, or bind the clause to the path it actually landed at (#3323)",
+    "integrity-discrepancy": "resolve by a product change under the same method, or independently re-derive both sides and record independent_rederivation=true (#3322)",
+    unclassified: "read the verify:ac message below; the deciding check did not name itself",
+};
+function countClauses(reading, outcome) {
+    return (reading.clauseOutcomes ?? []).filter((row) => row.outcome === outcome).length;
+}
+function firstLine(message) {
+    const line = message.split("\n").find((row) => row.trim().length > 0);
+    return line === undefined ? "(no detail)" : line.trim();
+}
+function verdict(ok, predicate, observed) {
+    return { ok, predicate, observed, remedy: REMEDY[predicate] };
+}
+/** Executable command count this reading resolved (stamped or ledger). */
+export function resolvedAcceptanceCommandCount(reading) {
+    return Math.max(reading.commands.length, reading.acceptance.commands.length);
+}
+/**
+ * Name the predicate that decided this verify:ac result, and the value it read.
+ *
+ * Order matters: the earliest fail-closed stage wins so the operator is pointed at
+ * the check that actually refused rather than a downstream symptom.
+ */
+export function resolveAcceptanceVerdict(reading) {
+    const commandCount = resolvedAcceptanceCommandCount(reading);
+    const greenRuns = reading.runs.filter((run) => run.ok).length;
+    const failedRuns = reading.runs.filter((run) => !run.ok);
+    if (reading.ok) {
+        if (reading.runs.length > 0) {
+            return verdict(true, "executable-pass", `${greenRuns}/${reading.runs.length} command(s) exited as expected [rung=${reading.sourceRung}]`);
+        }
+        return verdict(true, "empty-pass", `no executable command resolved; project floor allows it [rung=${reading.sourceRung}]`);
+    }
+    if (reading.resolution === "config" || reading.code === 2) {
+        return verdict(false, "config-error", firstLine(reading.message));
+    }
+    if (reading.resolution === "rejected-noop") {
+        const noop = (reading.rejected ?? []).map((row) => row.command);
+        return verdict(false, "noop-refused", noop.length > 0
+            ? `blocking ledger command(s) that cannot fail: ${noop.join(", ")}`
+            : firstLine(reading.message));
+    }
+    const rejected = reading.rejected ?? [];
+    if (rejected.length > 0) {
+        return verdict(false, "safety-rejected", `${rejected.length} blocking safety-rejected command(s): ${rejected
+            .map((row) => row.command)
+            .join(", ")}`);
+    }
+    if (failedRuns.length > 0) {
+        return verdict(false, "commands-failed", `${failedRuns.length}/${reading.runs.length} command(s) did not exit as expected: ${failedRuns
+            .map((row) => row.command)
+            .join(", ")}`);
+    }
+    if (reading.resolution === "soft_empty") {
+        return verdict(false, "empty-acceptance", `plan.acceptance.commands=${commandCount}, runs=0 [rung=${reading.sourceRung}]`);
+    }
+    if ((reading.clauseOutcomes?.length ?? 0) > 0) {
+        const failed = countClauses(reading, "failed");
+        const unverifiable = countClauses(reading, "unverifiable");
+        const verified = countClauses(reading, "verified");
+        return verdict(false, "clause-walk-failed", `clause walk read ${verified} verified, ${unverifiable} unverifiable, ${failed} failed ` +
+            `against ${commandCount} stamped command(s) and ${reading.runs.length} run(s)`);
+    }
+    if (/#3322/.test(reading.message)) {
+        return verdict(false, "integrity-discrepancy", firstLine(reading.message));
+    }
+    if (commandCount === 0) {
+        return verdict(false, "empty-acceptance", `plan.acceptance.commands=0, runs=0 [rung=${reading.sourceRung}]`);
+    }
+    return verdict(false, "unclassified", firstLine(reading.message));
+}
+/** One line naming the predicate and the value it read (#3497). */
+export function formatAcceptanceVerdict(verdictResult) {
+    const lead = `acceptance verdict (#3497): ${verdictResult.predicate} — ${verdictResult.observed}`;
+    if (verdictResult.ok || verdictResult.remedy.length === 0) {
+        return lead;
+    }
+    return `${lead}\n  remedy: ${verdictResult.remedy}`;
+}
+/**
+ * Clause-walk composition (#3323 / #3497).
+ *
+ * A clause the shipped artifact contradicts (`failed`) always blocks. A clause the
+ * static walk cannot decide (`unverifiable`) is evidence of nothing — it blocks only
+ * when nothing else verified the product. A green executable acceptance run IS that
+ * something: the product-first oracle already ran. Before #3497 an all-unverifiable
+ * clause set refused an artifact whose stated command had just exited 0.
+ */
+export function clauseWalkBlocks(input) {
+    if (input.failed > 0) {
+        return true;
+    }
+    if (input.walked === 0 || input.verified > 0) {
+        return false;
+    }
+    return !input.hasGreenExecutableRun;
+}
+/**
+ * The single option set each reader uses. Previously verify:ac and scope:complete
+ * hand-assembled divergent option objects at their call sites (#3497).
+ */
+export function resolveAcceptanceGateProfile(profile) {
+    switch (profile) {
+        case "check":
+            // Re-scanning issue prose during `task check` re-captures backtick lines
+            // as rejected and deadlocks the graph (#3323).
+            return { captureFromNarratives: false, checkIntegrated: true, reuseMode: "auto" };
+        case "complete":
+            // Completion re-scans narratives so a narrative-only stated command fails
+            // closed rather than being skipped, and never serves from a same-session cache.
+            return { captureFromNarratives: true, checkIntegrated: false, reuseMode: "bank" };
+        default:
+            return { captureFromNarratives: undefined, checkIntegrated: false, reuseMode: "auto" };
+    }
+}
+//# sourceMappingURL=acceptance-resolver.js.map