@deftai/directive-core 0.108.0 → 0.109.0

package/dist/orphan-active/evaluate.js

@@ -3,6 +3,7 @@ import { join, relative, resolve } from "node:path";
 import { hasArtifactSuffix, resolveLifecycleRoot } from "../layout/resolve.js";
 import { ScmStubError } from "../scm/errors.js";
 import { resolveRepo } from "../triage/queue/repo.js";
+import { normalizeScopePath, resolveCandidateScope, } from "./candidate-scope.js";
 import { AGGREGATE_LATENCY_BUDGET_MS, formatAge, makeGateRunner, OpenIssueInventory, resolveIssueStateAggregate, resolveIssueStateScoped, SCOPED_LATENCY_BUDGET_MS, } from "./issue-state.js";
 import { collectGithubRefs } from "./refs.js";
 function readJson(path) {
@@ -220,7 +221,34 @@ function basisLines(tally, basis) {
     }
     return lines;
 }
-function formatRefusal(orphans, projectRoot, issueFilter, tally, basis) {
+/** Keep an operator-supplied ref (or a reason quoting one) on a single line. */
+function oneLine(text) {
+    return text.replace(/\r?\n/g, " ");
+}
+/** One operator-visible line naming what this run was allowed to look at (#3893). */
+function scopeLines(scope, skipped) {
+    if (scope === null) {
+        return [];
+    }
+    if (scope.kind === "sweep") {
+        return [`  Scope: repo-wide sweep -- ${oneLine(scope.reason)} (#3893).`];
+    }
+    const noun = skipped === 1 ? "brief" : "briefs";
+    const verb = skipped === 1 ? "was" : "were";
+    return [
+        `  Scope: candidate diff against ${oneLine(scope.baseRef)}; ${skipped} running ${noun} outside ` +
+            `this branch's diff ${verb} not evaluated (#3893).`,
+    ];
+}
+function summarizeScope(scope, skipped) {
+    if (scope === null) {
+        return null;
+    }
+    return scope.kind === "sweep"
+        ? { kind: "sweep", baseRef: null, reason: scope.reason, skipped }
+        : { kind: "diff", baseRef: scope.baseRef, reason: null, skipped };
+}
+function formatRefusal(orphans, projectRoot, issueFilter, tally, basis, scope, skipped) {
     const shippedOrphans = orphans.filter((orphan) => orphan.kind === "shipped");
     const unresolvedOrphans = orphans.filter((orphan) => orphan.kind === "unresolved");
     const noun = orphans.length === 1 ? "" : "s";
@@ -243,6 +271,8 @@ function formatRefusal(orphans, projectRoot, issueFilter, tally, basis) {
         lines.push("    task scope:cancel -- xbrief/active/<file>.xbrief.json   # when abandoning", "  For stop-at:pr-open workers the orchestrator owns post-merge complete/cancel;", "  for drive-to:merge-ready workers scope:complete is part of the worker unit (#2321 / #3429).", "  Or run task swarm:finalize-cohort / task swarm:complete-cohort after cohort merge.");
     }
     if (unresolvedOrphans.length > 0) {
+        // Only the scoped `--issue N` arm can report unresolved, so the retry never
+        // needs a --changed-only form (the sweep arm fails open on unknown).
         const retry = issueFilter === null
             ? "task verify:orphan-active"
             : `task verify:orphan-active -- --issue ${issueFilter}`;
@@ -252,7 +282,7 @@ function formatRefusal(orphans, projectRoot, issueFilter, tally, basis) {
     for (const orphan of orphans) {
         lines.push(`    - ${orphan.path} (${orphan.reason})`);
     }
-    lines.push(...basisLines(tally, basis));
+    lines.push(...basisLines(tally, basis), ...scopeLines(scope, skipped));
     return lines.join("\n");
 }
 function emptyBasis(budgetMs) {
@@ -279,6 +309,11 @@ function emptyBasis(budgetMs) {
  * one complete, fail-closed open-issue inventory and stays fail-open on
  * unknown so offline work is not network-authorized. A cache hit is honoured
  * only inside `ISSUE_CACHE_MAX_AGE_MS`, and every verdict reports its basis.
+ *
+ * `changedOnly` is the merge-chokepoint form (#3893): only briefs the
+ * candidate's own diff touches are evaluated, so a brief stranded by another
+ * merge cannot fail this candidate. It falls back to the repo-wide sweep at
+ * the delivery tip and whenever the base ref is unresolvable.
  */
 export function evaluate(projectRoot, options = {}) {
     const root = resolve(projectRoot);
@@ -295,6 +330,7 @@ export function evaluate(projectRoot, options = {}) {
             stream: "stderr",
             orphans: [],
             basis: emptyBasis(budgetMs),
+            scope: null,
         };
     }
     let lifecycleRoot;
@@ -312,6 +348,7 @@ export function evaluate(projectRoot, options = {}) {
                 stream: quiet ? "none" : "stdout",
                 orphans: [],
                 basis: emptyBasis(budgetMs),
+                scope: null,
             };
         }
         return {
@@ -320,6 +357,7 @@ export function evaluate(projectRoot, options = {}) {
             stream: "stderr",
             orphans: [],
             basis: emptyBasis(budgetMs),
+            scope: null,
         };
     }
     if (!existsSync(lifecycleRoot)) {
@@ -329,6 +367,7 @@ export function evaluate(projectRoot, options = {}) {
             stream: quiet ? "none" : "stdout",
             orphans: [],
             basis: emptyBasis(budgetMs),
+            scope: null,
         };
     }
     const defaultRepo = resolveRepo(options.repo, root);
@@ -349,9 +388,23 @@ export function evaluate(projectRoot, options = {}) {
     };
     try {
         // #3774: missing gh/ghx is config (code 2), not an uncaught throw.
+        const briefs = listActiveRunningBriefs(root);
+        // Merge-chokepoint scoping (#3893). `--issue N` is already one origin, and
+        // an empty active/ has nothing to scope, so neither pays for the git reads.
+        const scope = options.changedOnly === true && issueFilter === null && briefs.length > 0
+            ? resolveCandidateScope(root, join(lifecycleRoot, "active"), {
+                baseRef: options.baseRef,
+                runGit: options.runGit,
+            })
+            : null;
         const orphans = [];
         let scanned = 0;
-        for (const brief of listActiveRunningBriefs(root)) {
+        let skipped = 0;
+        for (const brief of briefs) {
+            if (scope?.kind === "diff" && !scope.paths.has(normalizeScopePath(brief.path))) {
+                skipped += 1;
+                continue;
+            }
             scanned += 1;
             const { issues, prs } = collectGithubRefs(brief.plan, defaultRepo);
             // --issue N is one origin: briefs that name that issue. PR-only briefs stay on the unscoped scan (#3429).
@@ -380,27 +433,30 @@ export function evaluate(projectRoot, options = {}) {
             elapsedMs: Math.max(0, clock() - startedMs),
             budgetMs,
         };
+        const scopeSummary = summarizeScope(scope, skipped);
         if (orphans.length > 0) {
             return {
                 code: 1,
-                message: formatRefusal(orphans, root, issueFilter, tally, basis),
+                message: formatRefusal(orphans, root, issueFilter, tally, basis, scope, skipped),
                 stream: "stderr",
                 orphans,
                 basis,
+                scope: scopeSummary,
             };
         }
         if (quiet) {
-            return { code: 0, message: "", stream: "none", orphans: [], basis };
+            return { code: 0, message: "", stream: "none", orphans: [], basis, scope: scopeSummary };
         }
         const issueNote = issueFilter === null ? "" : ` for issue #${issueFilter}`;
         const headline = `verify:orphan-active: no orphaned active/running xBRIEFs${issueNote} ` +
             `(scanned ${scanned} running brief${scanned === 1 ? "" : "s"} in active/).`;
         return {
             code: 0,
-            message: [headline, ...basisLines(tally, basis)].join("\n"),
+            message: [headline, ...basisLines(tally, basis), ...scopeLines(scope, skipped)].join("\n"),
             stream: "stdout",
             orphans: [],
             basis,
+            scope: scopeSummary,
         };
     }
     catch (err) {
@@ -411,6 +467,7 @@ export function evaluate(projectRoot, options = {}) {
                 stream: "stderr",
                 orphans: [],
                 basis: emptyBasis(budgetMs),
+                scope: null,
             };
         }
         throw err;

package/dist/orphan-active/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./candidate-scope.js";
 export * from "./evaluate.js";
 export * from "./issue-state.js";
 export * from "./refs.js";

package/dist/orphan-active/index.js

@@ -1,3 +1,4 @@
+export * from "./candidate-scope.js";
 export * from "./evaluate.js";
 export * from "./issue-state.js";
 export * from "./refs.js";

package/dist/policy/merge-approval-head.js

@@ -13,7 +13,7 @@
 import { join } from "node:path";
 import { DEFAULT_EVENT_LOG, readEvents } from "../lifecycle/events.js";
 import { captureExec } from "../pr-wait-mergeable/wrappers.js";
-import { resolveBinary } from "../scm/binary.js";
+import { resolveBinaryForArgv } from "../scm/call-shape.js";
 import { resolveHumanMergePolicy } from "./require-human-merge.js";
 /** Event name recorded at Phase 5 → 6 approval. */
 export const PLAN_APPROVED_EVENT = "plan:approved";
@@ -358,14 +358,14 @@ export function evaluateMergeApprovalHead(input) {
 }
 /** Live `gh pr merge <N> --disable-auto` (best-effort). */
 export function disablePullRequestAutoMerge(prNumber, repo, options = {}) {
+    const args = ["pr", "merge", String(prNumber), "--disable-auto"];
     let binary;
     try {
-        binary = resolveBinary();
+        binary = resolveBinaryForArgv("pr", args.slice(1));
     }
     catch {
         return { ok: false, stderr: "gh CLI not found" };
     }
-    const args = ["pr", "merge", String(prNumber), "--disable-auto"];
     if (repo !== null && repo.length > 0) {
         args.push("--repo", repo);
     }
@@ -388,15 +388,16 @@ export function disablePullRequestAutoMerge(prNumber, repo, options = {}) {
 export function fetchPrHeadShaRest(prNumber, repo, options = {}) {
     if (repo === null || repo.length === 0)
         return null;
+    const endpoint = `repos/${repo}/pulls/${prNumber}`;
+    const apiArgs = ["api", endpoint, "--jq", ".head.sha"];
     let binary;
     try {
-        binary = resolveBinary();
+        binary = resolveBinaryForArgv(apiArgs[0] ?? "api", apiArgs.slice(1));
     }
     catch {
         return null;
     }
-    const endpoint = `repos/${repo}/pulls/${prNumber}`;
-    const result = captureExec(binary, ["api", endpoint, "--jq", ".head.sha"], (options.timeoutSec ?? 60) * 1000);
+    const result = captureExec(binary, apiArgs, (options.timeoutSec ?? 60) * 1000);
     if (result.returncode !== 0)
         return null;
     return normalizeSha(result.stdout.trim());

package/dist/pr-closing-keywords/gh.js

@@ -1,5 +1,7 @@
 import { execFileSync } from "node:child_process";
-import { resolveBinary } from "../scm/binary.js";
+import { defaultWhich } from "../scm/binary.js";
+import { classifyScmArgv, resolveBinaryForArgv } from "../scm/call-shape.js";
+import { ghxSpawnFallbackBinary } from "../scm/spawn-status.js";
 import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
 import { GH_TIMEOUT_S } from "./constants.js";
 /** UTF-8-safe gh capture via execFile (no shell) — mirrors _safe_subprocess.run_text (#1366). */
@@ -7,18 +9,39 @@ export function defaultRunGh(cmd) {
     if (cmd.length === 0 || cmd[0] !== "gh") {
         return { returncode: -1, stdout: "", stderr: "expected gh as first argv element" };
     }
-    const binary = resolveBinary();
     const args = cmd.slice(1);
+    const binary = resolveBinaryForArgv(args[0] ?? "", args.slice(1));
+    const execOpts = {
+        encoding: "utf8",
+        timeout: GH_TIMEOUT_S * 1000,
+        stdio: ["ignore", "pipe", "pipe"],
+        maxBuffer: SUBPROCESS_MAX_BUFFER,
+    };
+    const runOnce = (bin) => execFileSync(bin, args, execOpts);
     try {
-        const stdout = execFileSync(binary, args, {
-            encoding: "utf8",
-            timeout: GH_TIMEOUT_S * 1000,
-            stdio: ["ignore", "pipe", "pipe"],
-            maxBuffer: SUBPROCESS_MAX_BUFFER,
-        });
+        const stdout = runOnce(binary);
         return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
     }
-    catch (err) {
+    catch (caught) {
+        let err = caught;
+        const first = err;
+        const retry = ghxSpawnFallbackBinary(classifyScmArgv(args[0] ?? "", args.slice(1)), binary, defaultWhich, {
+            status: typeof first.status === "number" ? first.status : null,
+            error: first.code === "ENOENT" || first.code === "ETIMEDOUT" || typeof first.status !== "number"
+                ? { code: first.code, message: first.message }
+                : undefined,
+            stdout: typeof first.stdout === "string" ? first.stdout : "",
+            stderr: typeof first.stderr === "string" ? first.stderr : "",
+        });
+        if (retry !== null) {
+            try {
+                const stdout = runOnce(retry);
+                return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
+            }
+            catch (retryErr) {
+                err = retryErr;
+            }
+        }
         const e = err;
         if (e.code === "ENOENT") {
             return { returncode: -1, stdout: "", stderr: "gh CLI not found. Install GitHub CLI." };

package/dist/pr-closing-keywords/main.d.ts

@@ -3,6 +3,7 @@ export declare function parseAllowList(values: readonly string[]): Set<number>;
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;
 export interface RunOptions {
     readonly runGh?: RunGhFn;
+    readonly runGit?: RunGhFn;
 }
 export declare function run(argv: readonly string[], options?: RunOptions): number;
 export declare function cmdPrCheckClosingKeywords(argv: readonly string[], options?: RunOptions): number;

package/dist/pr-closing-keywords/main.js

@@ -1,3 +1,5 @@
+import { execFileSync } from "node:child_process";
+import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
 import { EXIT_CONFIG_ERROR, EXIT_HITS_FOUND, EXIT_OK } from "./constants.js";
 import { findAllClosingKeywordHits, findHits, renderHit } from "./detect.js";
 import { defaultRunGh, fetchPrBody, fetchPrCommitMessages } from "./gh.js";
@@ -23,6 +25,7 @@ function emptyParsed(error) {
         pr: null,
         bodyFile: null,
         commitsFile: null,
+        fromGitRange: null,
         repo: null,
         allowKnownFalsePositives: [],
         allowClose: [],
@@ -34,6 +37,7 @@ export function parseArgs(argv) {
     let pr = null;
     let bodyFile = null;
     let commitsFile = null;
+    let fromGitRange = null;
     let repo = null;
     let mode = "both";
     const allowKnownFalsePositives = [];
@@ -82,6 +86,17 @@ export function parseArgs(argv) {
         else if (arg?.startsWith("--commits-file=")) {
             commitsFile = arg.slice("--commits-file=".length);
         }
+        else if (arg === "--from-git-range") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return emptyParsed("argument --from-git-range: expected one argument");
+            }
+            fromGitRange = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--from-git-range=")) {
+            fromGitRange = arg.slice("--from-git-range=".length);
+        }
         else if (arg === "--repo") {
             const value = argv[i + 1];
             if (value === undefined) {
@@ -140,7 +155,50 @@ export function parseArgs(argv) {
             return emptyParsed(`unrecognized arguments: ${arg}`);
         }
     }
-    return { pr, bodyFile, commitsFile, repo, allowKnownFalsePositives, allowClose, mode };
+    return {
+        pr,
+        bodyFile,
+        commitsFile,
+        fromGitRange,
+        repo,
+        allowKnownFalsePositives,
+        allowClose,
+        mode,
+    };
+}
+function defaultRunGit(cmd) {
+    try {
+        const stdout = execFileSync("git", [...cmd], {
+            encoding: "utf8",
+            timeout: 30_000,
+            stdio: ["ignore", "pipe", "pipe"],
+            maxBuffer: SUBPROCESS_MAX_BUFFER,
+        });
+        return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
+    }
+    catch (err) {
+        const e = err;
+        return {
+            returncode: typeof e.status === "number" ? e.status : 1,
+            stdout: typeof e.stdout === "string" ? e.stdout : "",
+            stderr: typeof e.stderr === "string" ? e.stderr : String(e.message ?? ""),
+        };
+    }
+}
+function readGitRange(range, runGit) {
+    const result = runGit(["log", range, "--format=%B%n--END--"]);
+    if (result.returncode !== 0) {
+        process.stderr.write("Error: git log " +
+            range +
+            " failed: " +
+            result.stderr.trim() +
+            ". Recovery: git fetch origin master.\n");
+        return null;
+    }
+    return result.stdout
+        .split("\n--END--\n")
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
 }
 function filterHits(hits, allowList) {
     return hits.filter((h) => !allowList.has(h.issueNumber));
@@ -220,8 +278,8 @@ export function run(argv, options = {}) {
         commitMessages = msgs;
     }
     else {
-        if (args.bodyFile === null && args.commitsFile === null) {
-            process.stderr.write("Error: must specify --pr OR --body-file / --commits-file.\n");
+        if (args.bodyFile === null && args.commitsFile === null && args.fromGitRange === null) {
+            process.stderr.write("Error: must specify --pr OR --body-file / --commits-file / --from-git-range.\n");
             return EXIT_CONFIG_ERROR;
         }
         if (args.bodyFile !== null) {
@@ -238,6 +296,13 @@ export function run(argv, options = {}) {
             }
             commitMessages = msgs;
         }
+        if (args.fromGitRange !== null) {
+            const msgs = readGitRange(args.fromGitRange, options.runGit ?? defaultRunGit);
+            if (msgs === null) {
+                return EXIT_CONFIG_ERROR;
+            }
+            commitMessages = [...commitMessages, ...msgs];
+        }
     }
     const runFp = args.mode === "fp" || args.mode === "both";
     const runIntent = args.mode === "intent" || args.mode === "both";

package/dist/pr-closing-keywords/types.d.ts

@@ -18,6 +18,8 @@ export interface ParsedArgs {
     readonly pr: number | null;
     readonly bodyFile: string | null;
     readonly commitsFile: string | null;
+    /** Offline git range (e.g. origin/master..HEAD) for check-graph wiring (#3969). */
+    readonly fromGitRange: string | null;
     readonly repo: string | null;
     readonly allowKnownFalsePositives: readonly string[];
     /** Intent-mode allowlist of issue numbers permitted to use real closing keywords (#3015). */

package/dist/pr-merge-readiness/gh.js

@@ -1,5 +1,7 @@
 import { execFileSync } from "node:child_process";
-import { resolveBinary } from "../scm/binary.js";
+import { defaultWhich } from "../scm/binary.js";
+import { classifyScmArgv, resolveBinaryForArgv } from "../scm/call-shape.js";
+import { ghxSpawnFallbackBinary } from "../scm/spawn-status.js";
 import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
 import { GH_TIMEOUT_S, GREPTILE_LOGIN } from "./constants.js";
 /** Display / inventory key for a required context (includes app binding when set). */
@@ -47,18 +49,39 @@ export function defaultRunGh(cmd) {
     if (cmd.length === 0 || cmd[0] !== "gh") {
         return { returncode: -1, stdout: "", stderr: "expected gh as first argv element" };
     }
-    const binary = resolveBinary();
     const args = cmd.slice(1);
+    const binary = resolveBinaryForArgv(args[0] ?? "", args.slice(1));
+    const execOpts = {
+        encoding: "utf8",
+        timeout: GH_TIMEOUT_S * 1000,
+        stdio: ["ignore", "pipe", "pipe"],
+        maxBuffer: SUBPROCESS_MAX_BUFFER,
+    };
+    const runOnce = (bin) => execFileSync(bin, args, execOpts);
     try {
-        const stdout = execFileSync(binary, args, {
-            encoding: "utf8",
-            timeout: GH_TIMEOUT_S * 1000,
-            stdio: ["ignore", "pipe", "pipe"],
-            maxBuffer: SUBPROCESS_MAX_BUFFER,
-        });
+        const stdout = runOnce(binary);
         return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
     }
-    catch (err) {
+    catch (caught) {
+        let err = caught;
+        const first = err;
+        const retry = ghxSpawnFallbackBinary(classifyScmArgv(args[0] ?? "", args.slice(1)), binary, defaultWhich, {
+            status: typeof first.status === "number" ? first.status : null,
+            error: first.code === "ENOENT" || first.code === "ETIMEDOUT" || typeof first.status !== "number"
+                ? { code: first.code, message: first.message }
+                : undefined,
+            stdout: typeof first.stdout === "string" ? first.stdout : "",
+            stderr: typeof first.stderr === "string" ? first.stderr : "",
+        });
+        if (retry !== null) {
+            try {
+                const stdout = runOnce(retry);
+                return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
+            }
+            catch (retryErr) {
+                err = retryErr;
+            }
+        }
         const e = err;
         if (e.code === "ENOENT") {
             return { returncode: -1, stdout: "", stderr: "gh CLI not found. Install GitHub CLI." };

package/dist/pr-protected-issues/gh.js

@@ -1,5 +1,7 @@
 import { execFileSync } from "node:child_process";
-import { resolveBinary } from "../scm/binary.js";
+import { defaultWhich } from "../scm/binary.js";
+import { classifyScmArgv, resolveBinaryForArgv } from "../scm/call-shape.js";
+import { ghxSpawnFallbackBinary } from "../scm/spawn-status.js";
 import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
 import { GH_TIMEOUT_S } from "./constants.js";
 /**
@@ -11,18 +13,43 @@ export function defaultRunGh(cmd, binaryOverride) {
     if (cmd.length === 0 || cmd[0] !== "gh") {
         return { returncode: -1, stdout: "", stderr: "expected gh as first argv element" };
     }
-    const binary = binaryOverride ?? resolveBinary();
     const args = cmd.slice(1);
+    const binary = binaryOverride ?? resolveBinaryForArgv(args[0] ?? "", args.slice(1));
+    const execOpts = {
+        encoding: "utf8",
+        timeout: GH_TIMEOUT_S * 1000,
+        stdio: ["ignore", "pipe", "pipe"],
+        maxBuffer: SUBPROCESS_MAX_BUFFER,
+    };
+    const runOnce = (bin) => execFileSync(bin, args, execOpts);
     try {
-        const stdout = execFileSync(binary, args, {
-            encoding: "utf8",
-            timeout: GH_TIMEOUT_S * 1000,
-            stdio: ["ignore", "pipe", "pipe"],
-            maxBuffer: SUBPROCESS_MAX_BUFFER,
-        });
+        const stdout = runOnce(binary);
         return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
     }
-    catch (err) {
+    catch (caught) {
+        let err = caught;
+        const first = err;
+        const retry = binaryOverride === undefined
+            ? ghxSpawnFallbackBinary(classifyScmArgv(args[0] ?? "", args.slice(1)), binary, defaultWhich, {
+                status: typeof first.status === "number" ? first.status : null,
+                error: first.code === "ENOENT" ||
+                    first.code === "ETIMEDOUT" ||
+                    typeof first.status !== "number"
+                    ? { code: first.code, message: first.message }
+                    : undefined,
+                stdout: typeof first.stdout === "string" ? first.stdout : "",
+                stderr: typeof first.stderr === "string" ? first.stderr : "",
+            })
+            : null;
+        if (retry !== null) {
+            try {
+                const stdout = runOnce(retry);
+                return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
+            }
+            catch (retryErr) {
+                err = retryErr;
+            }
+        }
         const e = err;
         if (e.code === "ENOENT") {
             return { returncode: -1, stdout: "", stderr: "gh CLI not found. Install GitHub CLI." };

package/dist/pr-wait-mergeable/wrappers.js

@@ -4,7 +4,7 @@ import { createRequire } from "node:module";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { evaluate as evaluateCloseoutAttestable } from "../pr-closeout-attestable/evaluate.js";
-import { resolveBinary } from "../scm/binary.js";
+import { resolveBinaryForArgv } from "../scm/call-shape.js";
 import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
 /** UTF-8-safe subprocess capture via spawnSync (no shell) — mirrors #1366. */
 export function captureExec(executable, args, timeoutMs, options = {}) {
@@ -140,14 +140,14 @@ export function runMonitor(prNumber, repo, capMinutes, options = {}) {
 /** Invoke ``gh pr merge --squash --delete-branch --admin`` [``--match-head-commit``]. */
 export function runGhMerge(prNumber, repo, options = {}) {
     const timeoutSec = options.timeout ?? 120;
+    const args = ["pr", "merge", String(prNumber), "--squash", "--delete-branch", "--admin"];
     let binary;
     try {
-        binary = resolveBinary();
+        binary = resolveBinaryForArgv("pr", args.slice(1));
     }
     catch {
         return [-1, "", "gh CLI not found. Install GitHub CLI."];
     }
-    const args = ["pr", "merge", String(prNumber), "--squash", "--delete-branch", "--admin"];
     if (repo) {
         args.push("--repo", repo);
     }

package/dist/product-first-done-gate/evaluate.js

@@ -10,7 +10,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { basename, isAbsolute, relative, resolve } from "node:path";
 import { emitAcceptanceStampFromPlan, MISSING_AMBIGUITY_ATTESTATION_CAUSE, stampedAmbiguityAttestationError, } from "../intake/clause-derivation.js";
-import { appendLiteralAcceptanceAdvisory, evaluateLiteralAcceptanceFromPlan, isExecutableLiteralSource, isInlineProseMention, isNoopRefusalReason, readNotAcceptanceCommands, readStoredLiteralAcceptanceCommands, runLiteralAcceptanceCommands, stripLiteralAcceptanceAdvisory, } from "../literal-acceptance/index.js";
+import { appendLiteralAcceptanceAdvisory, evaluateLiteralAcceptanceFromPlan, isExecutableLiteralSource, isInlineProseMention, isNoopRefusalReason, isSafetyRefusalRun, readNotAcceptanceCommands, readStoredLiteralAcceptanceCommands, runLiteralAcceptanceCommands, stripLiteralAcceptanceAdvisory, } from "../literal-acceptance/index.js";
 import { ENV_RUN_SUMMARY_PATH, RunSummaryEmitter, } from "../run-summary/index.js";
 import { maybeBankOnAcPass } from "../session/ac-pass-banking.js";
 import { resolveAcReuse, resolveScopeIdForAcReuse, snapshotFromReuseFields, } from "../session/ac-pass-reuse.js";
@@ -634,6 +634,10 @@ function annotate(result, acceptance, quiet) {
         message = "";
     }
     const commandCount = Math.max(result.commands.length, acceptance.commands.length);
+    const executedRuns = result.runs.filter((run) => !isSafetyRefusalRun(run));
+    const refusedRuns = result.runs.filter(isSafetyRefusalRun);
+    const hasRefusal = refusedRuns.length > 0 || (result.rejected?.length ?? 0) > 0;
+    const servedFrom = executedRuns.length > 0 ? "executed" : hasRefusal ? "refused" : "executed";
     return {
         ...result,
         message,
@@ -648,7 +652,7 @@ function annotate(result, acceptance, quiet) {
             rejectedCount: result.rejected?.length ?? 0,
         }),
         resolvedCommandCount: result.runs.length > 0 ? result.runs.length : commandCount,
-        servedFrom: "executed",
+        servedFrom,
     };
 }
 /**

package/dist/product-first-done-gate/types.js

@@ -26,7 +26,9 @@ export const HYGIENE_GATE_ID_PREFIXES = [
     "verify:rule-ownership",
     "verify:biome-config",
     "verify:content-manifest",
+    "verify:deposit-closure",
     "verify:skill-external-fetch-gate",
+    "verify:semantic-single-source",
     "verify:cursor-tier1",
     "verify:openclaw-tier1",
     "verify:go-freeze",

package/dist/release/consumer-hard-stops.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Check 4 -- consumer hard-stop census (#3900 / #3713 / #3969).
+ *
+ * Enumerates open issues by privileged label only.
+ * BLOCKER is the sole permitted consumer title classification (inbound flare).
+ * The adoption-blocker label is never derived from a title.
+ * Issue bodies are not read into the verdict.
+ *
+ * parseClosesSet composes citation-grammar classifyPosition; do not add a
+ * third position classifier (#3969).
+ */
+export declare const CONSUMER_HARD_STOP_TITLE_RE: RegExp;
+export declare const ADOPTION_BLOCKER_LABEL = "adoption-blocker";
+export declare const BLOCKS_RELEASE_TAG_LABEL = "blocks-release-tag";
+/** Maintainer-applied labels that can block a cut. Titles cannot. */
+export declare const PRIVILEGED_HARD_STOP_LABELS: readonly string[];
+export interface HardStopIssue {
+    readonly number: number;
+    readonly title: string;
+    readonly labels: readonly string[];
+}
+export interface HardStopCensusEntry {
+    readonly number: number;
+    readonly title: string;
+    readonly viaTitle: boolean;
+    readonly viaLabel: boolean;
+}
+export interface HardStopCensusResult {
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+    readonly matches: readonly HardStopCensusEntry[];
+    readonly shipsPast: readonly HardStopCensusEntry[];
+}
+/** Privileged labels only. Title is recorded as a flare, never as a match. Never inspect a body field. */
+export declare function classifyHardStop(issue: HardStopIssue): HardStopCensusEntry | null;
+export declare function enumerateConsumerHardStops(issues: readonly HardStopIssue[]): HardStopCensusEntry[];
+/**
+ * Extract Closes/Fixes/Resolves #N from changelog Unreleased text.
+ * Never from issue bodies. Hits in refused markdown positions are not claims.
+ */
+export declare function parseClosesSet(changelogText: string): Set<number>;
+export declare function evaluateConsumerHardStopCensus(options: {
+    readonly issues: readonly HardStopIssue[];
+    readonly closesSet: ReadonlySet<number>;
+}): HardStopCensusResult;
+export declare function issueFromInventoryRow(row: Record<string, unknown>): HardStopIssue | null;
+//# sourceMappingURL=consumer-hard-stops.d.ts.map