@deftai/directive-core 0.105.0 → 0.106.0

package/dist/check/named-cause.js

@@ -20,7 +20,7 @@ const GATE_REMEDIES = {
     "verify:test-boundary": "Move tests to the allowed placement or update plan.policy test-boundary allowlist",
     "verify:scope-provenance": "Record approved scope provenance for the failing paths",
     "verify:consumer-check-contract": "Align consumer Taskfile includes with the required gate graph",
-    "verify:forward-coverage": "Add tests covering new source files (task verify:forward-coverage)",
+    "verify:forward-coverage": "Add tests for new source files and uncovered changed branches (task verify:forward-coverage)",
     "verify:scm-boundary": "Move SCM mutations off GraphQL-heavy paths or wait for rate-limit reset",
     "verify:license-sync": "Sync LICENSE / package license fields",
     "verify:agents-md-budget": "Trim AGENTS.md managed section or raise plan.policy.agentsMdBudget deliberately",

package/dist/forward-coverage/diff-coverage.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Intersect an Istanbul coverage-final.json report with changed lines (#3514).
+ *
+ * The 90% default is per-change coverage of added/modified branches.
+ * The project vitest floor (75) is a collapse detector for the aggregate.
+ * They are not interchangeable.
+ */
+/** Per-commit coverage of added/modified branches. Not the 75 global floor. */
+export declare const DEFAULT_DIFF_COVERAGE_THRESHOLD = 90;
+export interface UncoveredChangedBranch {
+    readonly path: string;
+    readonly line: number;
+    readonly branchId: string;
+    readonly pathIndex: number;
+    readonly type: string;
+}
+export interface DiffCoverageReport {
+    readonly reportPresent: boolean;
+    readonly skippedReason: string | null;
+    readonly changedBranchTotal: number;
+    readonly changedBranchCovered: number;
+    readonly percent: number;
+    readonly threshold: number;
+    readonly uncovered: readonly UncoveredChangedBranch[];
+    readonly belowThreshold: boolean;
+}
+export interface DiffCoverageOptions {
+    readonly projectRoot: string;
+    readonly coverageReportPath: string;
+    readonly changedLinesByFile: ReadonlyMap<string, ReadonlySet<number>>;
+    readonly threshold?: number;
+}
+/**
+ * Measure coverage of Istanbul branch paths whose line is in the diff.
+ * Missing or unreadable reports skip (warn-first); they are not a config error.
+ */
+export declare function evaluateDiffCoverage(options: DiffCoverageOptions): DiffCoverageReport;
+export declare function hasDiffCoverageFindings(report: DiffCoverageReport): boolean;
+//# sourceMappingURL=diff-coverage.d.ts.map

package/dist/forward-coverage/diff-coverage.js

@@ -0,0 +1,112 @@
+/**
+ * Intersect an Istanbul coverage-final.json report with changed lines (#3514).
+ *
+ * The 90% default is per-change coverage of added/modified branches.
+ * The project vitest floor (75) is a collapse detector for the aggregate.
+ * They are not interchangeable.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, relative } from "node:path";
+/** Per-commit coverage of added/modified branches. Not the 75 global floor. */
+export const DEFAULT_DIFF_COVERAGE_THRESHOLD = 90;
+function toPosix(p) {
+    return p.replace(/\\/g, "/");
+}
+function normalizeReportPath(projectRoot, rawKey, file) {
+    const candidate = file.path && file.path.length > 0 ? file.path : rawKey;
+    const rel = isAbsolute(candidate) ? relative(projectRoot, candidate) : candidate;
+    return toPosix(rel);
+}
+function emptyReport(threshold, skippedReason, reportPresent) {
+    return {
+        reportPresent,
+        skippedReason,
+        changedBranchTotal: 0,
+        changedBranchCovered: 0,
+        percent: 100,
+        threshold,
+        uncovered: [],
+        belowThreshold: false,
+    };
+}
+function branchLine(meta, pathIndex) {
+    const loc = meta?.locations?.[pathIndex];
+    return loc?.start?.line ?? meta?.loc?.start?.line ?? meta?.line ?? 0;
+}
+/**
+ * Measure coverage of Istanbul branch paths whose line is in the diff.
+ * Missing or unreadable reports skip (warn-first); they are not a config error.
+ */
+export function evaluateDiffCoverage(options) {
+    const threshold = options.threshold ?? DEFAULT_DIFF_COVERAGE_THRESHOLD;
+    const reportPath = options.coverageReportPath;
+    if (!existsSync(reportPath)) {
+        return emptyReport(threshold, `coverage report missing at ${reportPath}`, false);
+    }
+    let rawReport;
+    try {
+        rawReport = JSON.parse(readFileSync(reportPath, "utf8"));
+    }
+    catch (err) {
+        return emptyReport(threshold, `unreadable coverage report at ${reportPath}: ${String(err.message)}`, false);
+    }
+    const changedByPosix = new Map();
+    for (const [path, lines] of options.changedLinesByFile) {
+        changedByPosix.set(toPosix(path), lines);
+    }
+    const uncovered = [];
+    let total = 0;
+    let covered = 0;
+    for (const [rawKey, file] of Object.entries(rawReport)) {
+        const relPath = normalizeReportPath(options.projectRoot, rawKey, file);
+        const changedLines = changedByPosix.get(relPath);
+        if (changedLines === undefined || changedLines.size === 0) {
+            continue;
+        }
+        if (!file.b) {
+            continue;
+        }
+        for (const [branchId, hits] of Object.entries(file.b)) {
+            const meta = file.branchMap?.[branchId];
+            for (let pathIndex = 0; pathIndex < hits.length; pathIndex += 1) {
+                const count = hits[pathIndex] ?? 0;
+                const line = branchLine(meta, pathIndex);
+                if (!changedLines.has(line)) {
+                    continue;
+                }
+                total += 1;
+                if (count > 0) {
+                    covered += 1;
+                    continue;
+                }
+                uncovered.push({
+                    path: relPath,
+                    line,
+                    branchId,
+                    pathIndex,
+                    type: meta?.type ?? "branch",
+                });
+            }
+        }
+    }
+    uncovered.sort((a, b) => a.path.localeCompare(b.path) ||
+        a.line - b.line ||
+        a.branchId.localeCompare(b.branchId) ||
+        a.pathIndex - b.pathIndex);
+    const percent = total === 0 ? 100 : (covered / total) * 100;
+    const belowThreshold = total > 0 && percent + 1e-9 < threshold;
+    return {
+        reportPresent: true,
+        skippedReason: null,
+        changedBranchTotal: total,
+        changedBranchCovered: covered,
+        percent,
+        threshold,
+        uncovered,
+        belowThreshold,
+    };
+}
+export function hasDiffCoverageFindings(report) {
+    return report.uncovered.length > 0 || report.belowThreshold;
+}
+//# sourceMappingURL=diff-coverage.js.map

package/dist/forward-coverage/diff-lines.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Parse unified diffs into added/modified new-file line numbers (#3514).
+ */
+/** Repo-relative path -> 1-indexed new-file line numbers introduced by the diff. */
+export type ChangedLineMap = Map<string, Set<number>>;
+/** Decode a Git C-quoted path (`"foo\\tbar"` → `foo\tbar`). */
+export declare function unescapeGitQuotedPath(raw: string): string;
+/** Strip git `a/` `b/` prefixes and quotes from a `+++` path. */
+export declare function stripGitDiffPath(raw: string): string;
+/**
+ * Collect 1-indexed lines added on the new side of a unified diff (`-U0` ok).
+ * Deletions-only hunks contribute nothing. `/dev/null` destinations are skipped.
+ */
+export declare function parseUnifiedDiffAddedLines(diffText: string): ChangedLineMap;
+/** Count physical lines in file content (no trailing empty split artifact). */
+export declare function countFileLines(content: string): number;
+/** Treat every line of an untracked file as added. */
+export declare function allLinesChanged(lineCount: number): Set<number>;
+//# sourceMappingURL=diff-lines.d.ts.map

package/dist/forward-coverage/diff-lines.js

@@ -0,0 +1,173 @@
+/**
+ * Parse unified diffs into added/modified new-file line numbers (#3514).
+ */
+const HUNK_RE = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/;
+/** Git `core.quotePath` C-style escapes (quote.c). */
+const GIT_C_ESCAPES = {
+    a: "\u0007",
+    b: "\b",
+    t: "\t",
+    n: "\n",
+    v: "\v",
+    f: "\f",
+    r: "\r",
+    '"': '"',
+    "\\": "\\",
+};
+function isOctalDigit(ch) {
+    return ch !== undefined && ch >= "0" && ch <= "7";
+}
+/** Read one 1-3 digit octal byte at `index` (first digit). */
+function readOctalByte(inner, index) {
+    if (!isOctalDigit(inner[index])) {
+        return null;
+    }
+    let oct = inner[index] ?? "";
+    let next = index + 1;
+    if (isOctalDigit(inner[next])) {
+        oct += inner[next] ?? "";
+        next += 1;
+        if (isOctalDigit(inner[next])) {
+            oct += inner[next] ?? "";
+            next += 1;
+        }
+    }
+    return { value: Number.parseInt(oct, 8), next };
+}
+/** Decode a Git C-quoted path (`"foo\\tbar"` → `foo\tbar`). */
+export function unescapeGitQuotedPath(raw) {
+    const s = raw.trim();
+    if (!(s.startsWith('"') && s.endsWith('"') && s.length >= 2)) {
+        return s;
+    }
+    const inner = s.slice(1, -1);
+    let out = "";
+    const utf8 = new TextDecoder("utf-8");
+    for (let i = 0; i < inner.length; i += 1) {
+        const ch = inner[i];
+        if (ch !== "\\") {
+            out += ch;
+            continue;
+        }
+        const next = inner[i + 1];
+        if (next === undefined) {
+            out += "\\";
+            break;
+        }
+        i += 1;
+        const simple = GIT_C_ESCAPES[next];
+        if (simple !== undefined) {
+            out += simple;
+            continue;
+        }
+        const first = readOctalByte(inner, i);
+        if (first !== null) {
+            const bytes = [first.value];
+            i = first.next;
+            while (inner[i] === "\\" && isOctalDigit(inner[i + 1])) {
+                const more = readOctalByte(inner, i + 1);
+                if (more === null) {
+                    break;
+                }
+                bytes.push(more.value);
+                i = more.next;
+            }
+            i -= 1;
+            out += utf8.decode(Uint8Array.from(bytes));
+            continue;
+        }
+        out += next;
+    }
+    return out;
+}
+/** Strip git `a/` `b/` prefixes and quotes from a `+++` path. */
+export function stripGitDiffPath(raw) {
+    let s = unescapeGitQuotedPath(raw.trim());
+    if (s.startsWith("'") && s.endsWith("'") && s.length >= 2) {
+        s = s.slice(1, -1);
+    }
+    const prefixed = /^[abiwc]\/(.*)$/.exec(s);
+    if (prefixed?.[1] !== undefined) {
+        return prefixed[1].replace(/\\/g, "/");
+    }
+    return s.replace(/\\/g, "/");
+}
+/**
+ * Collect 1-indexed lines added on the new side of a unified diff (`-U0` ok).
+ * Deletions-only hunks contribute nothing. `/dev/null` destinations are skipped.
+ */
+export function parseUnifiedDiffAddedLines(diffText) {
+    const result = new Map();
+    let current = null;
+    let newLine = 0;
+    let inHunk = false;
+    for (const raw of diffText.split("\n")) {
+        const line = raw.replace(/\r$/, "");
+        if (line.startsWith("diff --git ")) {
+            current = null;
+            inHunk = false;
+            continue;
+        }
+        if (line.startsWith("+++ ")) {
+            const rest = line.slice(4).trim();
+            if (rest === "/dev/null") {
+                current = null;
+                inHunk = false;
+                continue;
+            }
+            current = stripGitDiffPath(rest);
+            if (!result.has(current)) {
+                result.set(current, new Set());
+            }
+            inHunk = false;
+            continue;
+        }
+        const hunk = HUNK_RE.exec(line);
+        if (hunk) {
+            newLine = Number(hunk[1]);
+            inHunk = current !== null;
+            continue;
+        }
+        if (!inHunk || current === null) {
+            continue;
+        }
+        if (line.startsWith("\\")) {
+            continue;
+        }
+        const lines = result.get(current);
+        if (lines === undefined) {
+            continue;
+        }
+        if (line.startsWith("+")) {
+            lines.add(newLine);
+            newLine += 1;
+        }
+        else if (line.startsWith("-")) {
+            // old-file deletion; new-file cursor stays
+        }
+        else {
+            newLine += 1;
+        }
+    }
+    return result;
+}
+/** Count physical lines in file content (no trailing empty split artifact). */
+export function countFileLines(content) {
+    if (content.length === 0) {
+        return 0;
+    }
+    const parts = content.split(/\r\n|\n/);
+    if (parts[parts.length - 1] === "") {
+        parts.pop();
+    }
+    return parts.length;
+}
+/** Treat every line of an untracked file as added. */
+export function allLinesChanged(lineCount) {
+    const lines = new Set();
+    for (let i = 1; i <= lineCount; i += 1) {
+        lines.add(i);
+    }
+    return lines;
+}
+//# sourceMappingURL=diff-lines.js.map

package/dist/forward-coverage/evaluate.d.ts

@@ -1,16 +1,24 @@
 /**
- * forward-coverage/evaluate.ts -- deterministic forward-coverage gate (#1310).
+ * forward-coverage/evaluate.ts -- deterministic forward-coverage gate
+ * (#1310 / #3514).
  *
- * Migrates the prose-tier "new source files MUST include corresponding test
- * files in the same PR" rule (AGENTS.md) to deterministic enforcement,
- * mirroring `verify:encoding` (#798) and `verify:branch` (#747).
+ * Two halves:
+ *  1. Fail-closed new-file existence (#1310): each NEW source file
+ *     (`*.py` / `*.go` / `*.ts` / `*.tsx`, excluding tests and `*.d.ts`)
+ *     must ship a corresponding test file in the same diff.
+ *  2. Warn-first diff coverage (#3514): intersect `coverage-final.json`
+ *     with added/modified lines and report uncovered changed branches.
+ *     Default threshold is 90% of those branches. That 90% is per-change
+ *     coverage of new code; the project vitest floor (75) is a collapse
+ *     detector for the aggregate -- they are not interchangeable.
  *
- * Behaviour (v1 = NEW-file granularity only, to keep false positives near
- * zero): read the staged (`--staged`) or HEAD-relative diff; for each NEW
- * source file (`*.py` / `*.go` / `*.ts` / `*.tsx`, excluding test files and
- * `*.d.ts`), assert a corresponding test file was added in the SAME diff.
- * Three-state exit: 0 clean / 1 missing forward coverage / 2 config error.
+ * Missing coverage reports skip the diff half (existence still runs).
+ * Pass `enforceDiffCoverage` / `--enforce` to fail closed on uncovered
+ * changed branches. Three-state exit: 0 clean or warn / 1 missing
+ * existence (or enforced diff findings) / 2 config error.
  */
+import { type DiffCoverageReport } from "./diff-coverage.js";
+export { DEFAULT_DIFF_COVERAGE_THRESHOLD, type DiffCoverageReport, type UncoveredChangedBranch, } from "./diff-coverage.js";
 /** Diff scope: `staged` = index vs HEAD; `head` = working tree + index vs HEAD. */
 export type ForwardCoverageMode = "head" | "staged";
 /** A new source file that has no corresponding test file in the same diff. */
@@ -25,10 +33,17 @@ export interface ForwardCoverageResult {
     readonly exitCode: 0 | 1 | 2;
     readonly missing: MissingCoverage[];
     readonly message: string;
+    readonly diffCoverage: DiffCoverageReport | null;
 }
 export interface ForwardCoverageOptions {
     readonly mode?: ForwardCoverageMode;
     readonly allowListPath?: string | null;
+    /** Fail closed on uncovered changed branches. Default warn-only. */
+    readonly enforceDiffCoverage?: boolean;
+    /** Override coverage-final.json path. Default `<root>/coverage/coverage-final.json`. */
+    readonly coverageReportPath?: string | null;
+    /** Per-diff branch threshold. Default 90 -- not the 75 global floor. */
+    readonly diffThreshold?: number;
 }
 /**
  * True when `relPath` is a test file (excluded from the "needs coverage" set

package/dist/forward-coverage/evaluate.js

@@ -1,21 +1,31 @@
 /**
- * forward-coverage/evaluate.ts -- deterministic forward-coverage gate (#1310).
+ * forward-coverage/evaluate.ts -- deterministic forward-coverage gate
+ * (#1310 / #3514).
  *
- * Migrates the prose-tier "new source files MUST include corresponding test
- * files in the same PR" rule (AGENTS.md) to deterministic enforcement,
- * mirroring `verify:encoding` (#798) and `verify:branch` (#747).
+ * Two halves:
+ *  1. Fail-closed new-file existence (#1310): each NEW source file
+ *     (`*.py` / `*.go` / `*.ts` / `*.tsx`, excluding tests and `*.d.ts`)
+ *     must ship a corresponding test file in the same diff.
+ *  2. Warn-first diff coverage (#3514): intersect `coverage-final.json`
+ *     with added/modified lines and report uncovered changed branches.
+ *     Default threshold is 90% of those branches. That 90% is per-change
+ *     coverage of new code; the project vitest floor (75) is a collapse
+ *     detector for the aggregate -- they are not interchangeable.
  *
- * Behaviour (v1 = NEW-file granularity only, to keep false positives near
- * zero): read the staged (`--staged`) or HEAD-relative diff; for each NEW
- * source file (`*.py` / `*.go` / `*.ts` / `*.tsx`, excluding test files and
- * `*.d.ts`), assert a corresponding test file was added in the SAME diff.
- * Three-state exit: 0 clean / 1 missing forward coverage / 2 config error.
+ * Missing coverage reports skip the diff half (existence still runs).
+ * Pass `enforceDiffCoverage` / `--enforce` to fail closed on uncovered
+ * changed branches. Three-state exit: 0 clean or warn / 1 missing
+ * existence (or enforced diff findings) / 2 config error.
  */
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
-import { basename } from "node:path";
+import { basename, join } from "node:path";
 import { GitCommandError, GitNotFoundError } from "../encoding/git.js";
 import { fnmatchCase } from "../encoding/text.js";
+import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
+import { evaluateDiffCoverage, hasDiffCoverageFindings, } from "./diff-coverage.js";
+import { allLinesChanged, countFileLines, parseUnifiedDiffAddedLines, } from "./diff-lines.js";
+export { DEFAULT_DIFF_COVERAGE_THRESHOLD, } from "./diff-coverage.js";
 /** Source-file extensions in scope for v1. */
 const SOURCE_EXTENSIONS = new Set([".py", ".go", ".ts", ".tsx"]);
 /** Raised by `loadAllowList` when the path does not exist. */
@@ -117,6 +127,7 @@ function git(args, projectRoot) {
         cwd: projectRoot,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
+        maxBuffer: SUBPROCESS_MAX_BUFFER,
     });
     if (result.error !== undefined) {
         const e = result.error;
@@ -176,7 +187,83 @@ function addedFiles(projectRoot, mode) {
     return [...added];
 }
 function configError(message) {
-    return { exitCode: 2, missing: [], message };
+    return { exitCode: 2, missing: [], message, diffCoverage: null };
+}
+function mergeChangedLines(into, from) {
+    for (const [path, lines] of from) {
+        const posix = path.replace(/\\/g, "/");
+        const set = into.get(posix) ?? new Set();
+        for (const n of lines) {
+            set.add(n);
+        }
+        into.set(posix, set);
+    }
+}
+/**
+ * Added, modified, and renamed new-file line numbers in the diff scope.
+ * Untracked files in head mode count as fully added. Rename-classified
+ * edits (`--diff-filter=AMR`) still contribute their added lines.
+ */
+function changedLinesByFile(projectRoot, mode) {
+    const maps = new Map();
+    if (mode === "staged") {
+        const diff = git(["diff", "--cached", "-U0", "--diff-filter=AMR", "--no-color"], projectRoot);
+        if (diff.status === 0) {
+            mergeChangedLines(maps, parseUnifiedDiffAddedLines(diff.stdout));
+        }
+        return maps;
+    }
+    const hasHead = git(["rev-parse", "--verify", "-q", "HEAD"], projectRoot).status === 0;
+    if (hasHead) {
+        const diff = git(["diff", "-U0", "--diff-filter=AMR", "--no-color", "HEAD"], projectRoot);
+        if (diff.status === 0) {
+            mergeChangedLines(maps, parseUnifiedDiffAddedLines(diff.stdout));
+        }
+    }
+    for (const rel of toLines(gitOrThrow(["ls-files", "--others", "--exclude-standard"], projectRoot))) {
+        const posix = rel.replace(/\\/g, "/");
+        let content;
+        try {
+            content = readFileSync(join(projectRoot, posix), "utf8");
+        }
+        catch {
+            continue;
+        }
+        const set = maps.get(posix) ?? new Set();
+        for (const n of allLinesChanged(countFileLines(content))) {
+            set.add(n);
+        }
+        maps.set(posix, set);
+    }
+    return maps;
+}
+function formatDiffCoverage(report, enforce) {
+    if (!report.reportPresent) {
+        return "";
+    }
+    const findings = hasDiffCoverageFindings(report);
+    if (!findings && report.changedBranchTotal === 0) {
+        return "";
+    }
+    const pct = report.percent.toFixed(2);
+    const roles = `  The ${report.threshold}% per-diff threshold covers added/modified branches; the 75 global ` +
+        "floor is a collapse detector for the aggregate -- they are not interchangeable (#3514 / #3512).";
+    if (!findings) {
+        return (`verify_forward_coverage: diff coverage ${pct}% of ${report.changedBranchTotal} ` +
+            `changed branch(es) (threshold ${report.threshold}%).\n${roles}`);
+    }
+    const header = `verify_forward_coverage: ${report.uncovered.length} uncovered changed branch(es) ` +
+        `(diff ${pct}% vs ${report.threshold}% threshold).\n${roles}`;
+    const body = report.uncovered
+        .slice(0, 20)
+        .map((u) => `  ${u.path}:${u.line} (${u.type} #${u.branchId}[${u.pathIndex}])`)
+        .join("\n");
+    const more = report.uncovered.length > 20 ? `\n  ... ${report.uncovered.length - 20} more` : "";
+    const posture = enforce
+        ? "FAIL: --enforce is set; cover the changed branches or raise the tests (#3514)."
+        : "ADVISORY (warn-only): exit 0 for the diff half. Pass --enforce to fail closed (#3514). " +
+            "New-file existence remains fail-closed.";
+    return `${header}\n${body}${more}\n${posture}`;
 }
 /**
  * Pure evaluation returning `{ exitCode, missing, message }`. Three-state exit
@@ -201,8 +288,10 @@ export function evaluateForwardCoverage(projectRoot, options = {}) {
             "  Recovery: check file permissions.");
     }
     let added;
+    let changedLines;
     try {
         added = addedFiles(projectRoot, mode);
+        changedLines = changedLinesByFile(projectRoot, mode);
     }
     catch (err) {
         if (err instanceof GitNotFoundError) {
@@ -233,6 +322,22 @@ export function evaluateForwardCoverage(projectRoot, options = {}) {
             missing.push({ path: rel, expectedTests: expected });
         }
     }
+    const sourceChanged = new Map();
+    for (const [rel, lines] of changedLines) {
+        if (!isSourceFile(rel) || isAllowListed(rel, allowGlobs)) {
+            continue;
+        }
+        sourceChanged.set(rel, lines);
+    }
+    const coverageReportPath = options.coverageReportPath ?? join(projectRoot, "coverage", "coverage-final.json");
+    const enforce = options.enforceDiffCoverage === true;
+    const diffCoverage = evaluateDiffCoverage({
+        projectRoot,
+        coverageReportPath,
+        changedLinesByFile: sourceChanged,
+        threshold: options.diffThreshold,
+    });
+    const diffSection = formatDiffCoverage(diffCoverage, enforce);
     if (missing.length > 0) {
         const header = `verify_forward_coverage: ${missing.length} new source file(s) added without a ` +
             "corresponding test in the same diff (#1310).\n" +
@@ -242,13 +347,14 @@ export function evaluateForwardCoverage(projectRoot, options = {}) {
         const body = missing
             .map((m) => `  ${m.path}\n    expected one of: ${m.expectedTests.join(", ")}`)
             .join("\n");
-        return { exitCode: 1, missing, message: `${header}\n${body}` };
-    }
-    return {
-        exitCode: 0,
-        missing,
-        message: `verify_forward_coverage: ${checked} new source file(s) checked -- ` +
-            "all have forward coverage in the diff (#1310).",
-    };
+        const message = diffSection === "" ? `${header}\n${body}` : `${header}\n${body}\n${diffSection}`;
+        return { exitCode: 1, missing, message, diffCoverage };
+    }
+    const existence = `verify_forward_coverage: ${checked} new source file(s) checked -- ` +
+        "all have forward coverage in the diff (#1310).";
+    const findings = hasDiffCoverageFindings(diffCoverage);
+    const exitCode = enforce && findings ? 1 : 0;
+    const message = diffSection === "" ? existence : `${existence}\n${diffSection}`;
+    return { exitCode, missing, message, diffCoverage };
 }
 //# sourceMappingURL=evaluate.js.map

package/dist/init-deposit/agent-hooks.d.ts

@@ -16,7 +16,7 @@ export declare const CURSOR_SESSION_HOOK_TIMEOUT_SECONDS = 5;
  * Mutation tool.before runs `inspectMutationGates` → gated
  * `verifySessionRitual`, which re-runs non-cacheable agent-hook readiness on
  * every boundary. Live readiness alone has a multi-host fixture ceiling of
- * ~12s (`content/contracts/agent-hook-readiness.md`); the historical deposit
+ * ~24s (`content/contracts/agent-hook-readiness.md`); the historical deposit
  * default of 5s was below that budget. Under Cursor `failClosed: true`, a
  * host timeout kill surfaces as opaque exit-1 with no Directive decision
  * code (#3246 / related #2864). Keep this above the readiness ceiling plus

package/dist/init-deposit/agent-hooks.js

@@ -24,7 +24,7 @@ export const CURSOR_SESSION_HOOK_TIMEOUT_SECONDS = 5;
  * Mutation tool.before runs `inspectMutationGates` → gated
  * `verifySessionRitual`, which re-runs non-cacheable agent-hook readiness on
  * every boundary. Live readiness alone has a multi-host fixture ceiling of
- * ~12s (`content/contracts/agent-hook-readiness.md`); the historical deposit
+ * ~24s (`content/contracts/agent-hook-readiness.md`); the historical deposit
  * default of 5s was below that budget. Under Cursor `failClosed: true`, a
  * host timeout kill surfaces as opaque exit-1 with no Directive decision
  * code (#3246 / related #2864). Keep this above the readiness ceiling plus

package/dist/intake/clause-derivation.d.ts

@@ -23,11 +23,15 @@ export interface ClauseStampPreparation {
     readonly ambiguity_attestation?: "none_found";
     readonly remediation?: string;
 }
+export declare const MISSING_AMBIGUITY_ATTESTATION_CAUSE: "missing_ambiguity_attestation";
+export declare const AMBIGUITY_ATTESTATION_REMEDIATION = "record ambiguity readings or attest none_found";
 export interface AmbiguityAttestationCheck {
     readonly ok: boolean;
     readonly attested: boolean;
     readonly kind: "ambiguous-clause" | "none_found" | "missing";
     readonly message: string;
+    readonly cause?: typeof MISSING_AMBIGUITY_ATTESTATION_CAUSE;
+    readonly remediation?: string;
 }
 /** True when activate/promote must run #3323 (absent, empty none_stated, or command-only). */
 export declare function needsClauseDerivation(acceptance: unknown): boolean;
@@ -45,6 +49,11 @@ export declare function countClauseProvenance(clauses: readonly TracedAcceptance
 export declare function prepareClauseStamp(clauses: readonly AcceptanceClause[], statement: string): ClauseStampPreparation;
 /** Config-error surface for verify:ac: attestation or an ambiguous clause with readings. */
 export declare function evaluateAmbiguityAttestation(acceptance: unknown): AmbiguityAttestationCheck;
+/**
+ * Fail-closed check for a *stamped* plan.acceptance (#3559).
+ * Command-only / empty floor blocks are not stamps; they keep the empty-resolution path.
+ */
+export declare function stampedAmbiguityAttestationError(acceptance: unknown): AmbiguityAttestationCheck | null;
 /**
  * Annotate stamped clauses with provenance and an ambiguity attestation.
  * An all-implementation stamp is stripped (never sufficient alone).