@deftai/directive-core 0.79.1 → 0.79.3

package/dist/lifecycle/event.js

@@ -0,0 +1,163 @@
+import { resolve } from "node:path";
+import { emit, main as eventsMain, readEvents } from "./events.js";
+const APPROVAL_PHRASES = new Set(["yes", "confirmed", "approve", "other"]);
+function parseBooleanFlag(value) {
+    return ["1", "true", "yes"].includes(value.toLowerCase());
+}
+function repositoryFromPlanRef(planRef) {
+    const match = /^https?:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/\d+/i.exec(planRef.trim());
+    return match?.[1];
+}
+function dedupeKey(payload) {
+    const planRef = payload.plan_ref;
+    const approver = payload.approver;
+    if (typeof planRef !== "string" || typeof approver !== "string") {
+        return null;
+    }
+    const parts = [planRef, approver];
+    if (typeof payload.pr_number === "number") {
+        parts.push(String(payload.pr_number));
+    }
+    if (typeof payload.head_sha === "string" && payload.head_sha.length > 0) {
+        parts.push(payload.head_sha);
+    }
+    return parts.join("|");
+}
+function findExistingPlanApproved(key, logPath) {
+    for (const record of readEvents(logPath)) {
+        if (record.event !== "plan:approved") {
+            continue;
+        }
+        if (dedupeKey(record.payload) === key) {
+            return record;
+        }
+    }
+    return null;
+}
+function validatePlanApprovedPayload(payload) {
+    const phrase = payload.approval_phrase;
+    if (phrase === undefined) {
+        return;
+    }
+    if (typeof phrase !== "string") {
+        throw new Error("approval_phrase must be a string");
+    }
+    const normalized = phrase.toLowerCase();
+    if (!APPROVAL_PHRASES.has(normalized)) {
+        throw new Error(`invalid approval_phrase '${phrase}'; expected one of yes, confirmed, approve, other`);
+    }
+}
+/** Parse `emit <event> ...` argv for lifecycle:event approval recording. */
+export function parseEmitInvocation(args) {
+    const payload = {};
+    let name;
+    let log;
+    let i = 0;
+    if (args.length > 0 && !args[0]?.startsWith("--")) {
+        name = args[0];
+        i = 1;
+    }
+    if (name === undefined) {
+        throw new Error("event name required");
+    }
+    while (i < args.length) {
+        const arg = args[i];
+        if (arg === "--payload") {
+            const raw = args[i + 1];
+            if (raw === undefined) {
+                throw new Error("--payload requires a value");
+            }
+            const data = JSON.parse(raw);
+            if (typeof data !== "object" || data === null || Array.isArray(data)) {
+                throw new Error("--payload must be a JSON object");
+            }
+            Object.assign(payload, data);
+            i += 2;
+            continue;
+        }
+        if (arg === "--log") {
+            log = args[i + 1];
+            i += 2;
+            continue;
+        }
+        const flagMap = {
+            "--plan-ref": "plan_ref",
+            "--approver": "approver",
+            "--approval-phrase": "approval_phrase",
+            "--head-sha": "head_sha",
+        };
+        if (arg === "--pr-number") {
+            payload.pr_number = Number.parseInt(args[i + 1] ?? "", 10);
+            i += 2;
+            continue;
+        }
+        const field = flagMap[arg ?? ""];
+        if (field !== undefined) {
+            payload[field] = args[i + 1];
+            i += 2;
+            continue;
+        }
+        if (arg === "--inline") {
+            payload.inline = parseBooleanFlag(args[i + 1] ?? "");
+            i += 2;
+            continue;
+        }
+        throw new Error(`unrecognized arguments: ${arg}`);
+    }
+    return { name, payload, log };
+}
+function enrichPlanApprovedPayload(payload) {
+    const next = { ...payload };
+    if (typeof next.plan_ref === "string" && next.repository === undefined) {
+        const repository = repositoryFromPlanRef(next.plan_ref);
+        if (repository !== undefined) {
+            next.repository = repository;
+        }
+    }
+    return next;
+}
+function emitPlanApprovedIdempotent(payload, options = {}) {
+    const enriched = enrichPlanApprovedPayload(payload);
+    validatePlanApprovedPayload(enriched);
+    const key = dedupeKey(enriched);
+    if (key !== null) {
+        const existing = findExistingPlanApproved(key, options.logPath ?? null);
+        if (existing !== null) {
+            return existing;
+        }
+    }
+    return emit("plan:approved", enriched, options);
+}
+/** CLI entry for `lifecycle:event` / review-cycle approval recorder (#2631). */
+export function runLifecycleEvent(argv, options = {}) {
+    if (options.projectRoot !== undefined) {
+        process.chdir(resolve(options.projectRoot));
+    }
+    if (argv.length === 0 || argv[0] === "-h" || argv[0] === "--help" || argv[0] === "help") {
+        process.stderr.write("usage: lifecycle:event emit plan:approved --plan-ref <url> --approver <login> " +
+            "[--approval-phrase yes|confirmed|approve] [--pr-number N] [--head-sha SHA]\n");
+        return argv.length === 0 ? 2 : 0;
+    }
+    if (argv[0] !== "emit") {
+        return eventsMain(argv);
+    }
+    if (argv[1] !== "plan:approved") {
+        return eventsMain(argv);
+    }
+    try {
+        const parsed = parseEmitInvocation(argv.slice(1));
+        const record = emitPlanApprovedIdempotent(parsed.payload, { logPath: parsed.log ?? null });
+        process.stdout.write(`${JSON.stringify(record)}\n`);
+        return 0;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`lifecycle:event failed: ${message}\n`);
+        return 2;
+    }
+}
+/** Process entrypoint mirroring other lifecycle CLI modules. */
+export function main(argv = process.argv.slice(2)) {
+    return runLifecycleEvent(argv);
+}
+//# sourceMappingURL=event.js.map

package/dist/lifecycle/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./event.js";
 export * as eventDetect from "./event-detect.js";
 export * as events from "./events.js";
 export * as lifecycleHygiene from "./lifecycle-hygiene.js";

package/dist/lifecycle/index.js

@@ -1,3 +1,4 @@
+export * from "./event.js";
 export * as eventDetect from "./event-detect.js";
 export * as events from "./events.js";
 export * as lifecycleHygiene from "./lifecycle-hygiene.js";

package/dist/orchestration/verify-judgment-gates.js

@@ -3,8 +3,9 @@
  */
 import { execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { assertProjectionContained, assertWriteTargetSafe, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { resolveAuditDir } from "../layout/resolve.js";
 import { resolveJudgmentGates } from "./judgment-policy.js";
 import { matchAny } from "./pathspec.js";
@@ -163,7 +164,22 @@ export function readClearances(projectRoot, logPath) {
 }
 export function recordClearance(projectRoot, options) {
     const path = options.log_path ?? clearanceLogPath(projectRoot);
-    mkdirSync(resolveAuditDir(projectRoot), { recursive: true });
+    const auditDir = resolveAuditDir(projectRoot);
+    assertProjectionContained(projectRoot, auditDir);
+    assertWriteTargetSafe(projectRoot, path);
+    try {
+        const info = lstatSync(auditDir);
+        if (info.isSymbolicLink()) {
+            throw new ProjectionContainmentError(`projection write refused: audit directory ${auditDir} must not be a symlink`, { projectDir: resolve(projectRoot), targetPath: auditDir, offendingPath: auditDir });
+        }
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            throw err;
+        }
+        // Audit dir does not exist yet; mkdirSync below will create it under containment.
+    }
+    mkdirSync(auditDir, { recursive: true });
     const entry = {
         clearance_id: randomUUID(),
         timestamp: utcNowIso(options.now),

package/dist/platform/resolve-version.d.ts

@@ -1,10 +1,6 @@
+import { isPublishable, NonPublishableVersionError, toPep440 } from "../release/version.js";
 import { DEV_FALLBACK, ENV_VAR } from "./constants.js";
-export { DEV_FALLBACK, ENV_VAR };
-export declare class NonPublishableVersionError extends Error {
-    constructor(message: string);
-}
-export declare function toPep440(version: string): string;
-export declare function isPublishable(version: string): boolean;
+export { DEV_FALLBACK, ENV_VAR, isPublishable, NonPublishableVersionError, toPep440 };
 export declare function tagNameFromRef(ref: string): string;
 export declare function latestPublishableTag(tags: Iterable<string>): string | null;
 export declare function payloadIsOwnGitRoot(payloadDir: string): boolean;

package/dist/platform/resolve-version.js

@@ -2,113 +2,15 @@ import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { comparePublishableVersions, isPublishable, NonPublishableVersionError, toPep440, } from "../release/version.js";
 import { DEV_FALLBACK, ENV_VAR } from "./constants.js";
-export { DEV_FALLBACK, ENV_VAR };
-export class NonPublishableVersionError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "NonPublishableVersionError";
-    }
-}
-const PRE_KIND_MAP = {
-    alpha: "a",
-    beta: "b",
-    rc: "rc",
-};
-const NON_PUBLISHABLE_KINDS = new Set(["test"]);
-const PRERELEASE_RANK = {
-    alpha: 0,
-    beta: 1,
-    rc: 2,
-    "": 3,
-};
+export { DEV_FALLBACK, ENV_VAR, isPublishable, NonPublishableVersionError, toPep440 };
 function frameworkRoot() {
     const envRoot = process.env.DEFT_ROOT?.trim();
     if (envRoot)
         return resolve(envRoot);
     return resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
 }
-/** Parse `[v]X.Y.Z[-(rc|alpha|beta|test).N]` via linear scan. */
-function parsePep440Tag(version) {
-    let i = 0;
-    if (version[i] === "v" || version[i] === "V")
-        i += 1;
-    const readInt = () => {
-        const ch = version[i] ?? "";
-        if (i >= version.length || ch < "0" || ch > "9")
-            return null;
-        let n = 0;
-        while (i < version.length) {
-            const digit = version[i] ?? "";
-            if (digit < "0" || digit > "9")
-                break;
-            n = n * 10 + Number(digit);
-            i += 1;
-        }
-        return n;
-    };
-    const major = readInt();
-    if (major === null || version[i] !== ".")
-        return null;
-    i += 1;
-    const minor = readInt();
-    if (minor === null || version[i] !== ".")
-        return null;
-    i += 1;
-    const patch = readInt();
-    if (patch === null)
-        return null;
-    if (i >= version.length)
-        return { major, minor, patch, kind: null, num: null };
-    if (version[i] !== "-")
-        return null;
-    i += 1;
-    const kindStart = i;
-    while (i < version.length && version[i] !== ".")
-        i += 1;
-    if (i >= version.length || version[i] !== ".")
-        return null;
-    const kind = version.slice(kindStart, i);
-    if (!["rc", "alpha", "beta", "test"].includes(kind))
-        return null;
-    i += 1;
-    const num = readInt();
-    if (num === null || i !== version.length)
-        return null;
-    return { major, minor, patch, kind, num };
-}
-export function toPep440(version) {
-    if (typeof version !== "string") {
-        throw new Error(`version must be a string, got ${typeof version}`);
-    }
-    const candidate = version.trim();
-    if (!candidate)
-        throw new Error("version must be a non-empty string");
-    const parsed = parsePep440Tag(candidate);
-    if (parsed === null) {
-        throw new Error(`Cannot normalize ${JSON.stringify(candidate)} to PEP 440: expected [v]X.Y.Z or [v]X.Y.Z-(rc|alpha|beta|test).N`);
-    }
-    const base = `${parsed.major}.${parsed.minor}.${parsed.patch}`;
-    if (parsed.kind === null)
-        return base;
-    if (NON_PUBLISHABLE_KINDS.has(parsed.kind)) {
-        throw new NonPublishableVersionError(`Version ${JSON.stringify(candidate)} carries non-publishable pre-release tag ${JSON.stringify(parsed.kind)}.${parsed.num} -- release pipeline MUST skip pyproject.toml [project].version sync for this tag.`);
-    }
-    const pepKind = PRE_KIND_MAP[parsed.kind];
-    if (pepKind === undefined) {
-        throw new Error(`Unmapped pre-release kind ${JSON.stringify(parsed.kind)} for version ${JSON.stringify(candidate)}; add it to PRE_KIND_MAP or NON_PUBLISHABLE_KINDS to keep parser in lockstep with the publishability classifier.`);
-    }
-    return `${base}${pepKind}${parsed.num}`;
-}
-export function isPublishable(version) {
-    try {
-        toPep440(version);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 export function tagNameFromRef(ref) {
     let candidate = ref.trim();
     if (!candidate)
@@ -123,49 +25,21 @@ export function tagNameFromRef(ref) {
         candidate = candidate.slice(prefix.length);
     return candidate.trim();
 }
-function publishableTagSortKey(version) {
-    const candidate = version.trim();
-    const parsed = parsePep440Tag(candidate);
-    if (parsed === null) {
-        throw new Error(`Cannot sort ${JSON.stringify(candidate)}: expected [v]X.Y.Z or [v]X.Y.Z-(rc|alpha|beta).N`);
-    }
-    if (parsed.kind !== null && NON_PUBLISHABLE_KINDS.has(parsed.kind)) {
-        throw new NonPublishableVersionError(`Version ${JSON.stringify(candidate)} carries non-publishable pre-release tag ${JSON.stringify(parsed.kind)}.`);
-    }
-    const kind = parsed.kind ?? "";
-    const prereleaseRank = PRERELEASE_RANK[kind];
-    if (prereleaseRank === undefined) {
-        throw new Error(`Unmapped pre-release kind ${JSON.stringify(parsed.kind)} for ${JSON.stringify(candidate)}`);
-    }
-    return [parsed.major, parsed.minor, parsed.patch, prereleaseRank, parsed.num ?? 0];
-}
 export function latestPublishableTag(tags) {
     let bestTag = null;
-    let bestKey = null;
     for (const raw of tags) {
         const tag = tagNameFromRef(raw);
         if (!tag || !isPublishable(tag))
             continue;
         try {
-            const key = publishableTagSortKey(tag);
-            if (bestKey === null || compareTuple(key, bestKey) > 0) {
+            if (bestTag === null || comparePublishableVersions(tag, bestTag) > 0) {
                 bestTag = tag;
-                bestKey = key;
             }
         }
         catch { }
     }
     return bestTag;
 }
-function compareTuple(a, b) {
-    for (let i = 0; i < a.length; i += 1) {
-        const av = a[i] ?? 0;
-        const bv = b[i] ?? 0;
-        if (av !== bv)
-            return av > bv ? 1 : -1;
-    }
-    return 0;
-}
 function readManifestTag(baseDir) {
     const manifest = join(baseDir, "VERSION");
     try {

package/dist/pr-merge-readiness/compute.d.ts

@@ -1,9 +1,10 @@
 import type { CiGateOptions } from "./ci-gate.js";
 import { isMergeReady } from "./evaluate.js";
+import { type InlineGreptileFindings } from "./greptile-inline.js";
 import { type MergeabilitySignal } from "./mergeability.js";
 import type { SlizardGateOptions } from "./slizard-gate.js";
 import type { GateResult, RunGhFn } from "./types.js";
-declare function buildGateResult(prNumber: number, repo: string | null, headSha: string | null, body: string, via: string, partialData?: Record<string, unknown>, error?: string | null): GateResult;
+declare function buildGateResult(prNumber: number, repo: string | null, headSha: string | null, body: string, via: string, partialData?: Record<string, unknown>, error?: string | null, inline?: InlineGreptileFindings | null): GateResult;
 /** Injectable GitHub-mergeability read seam (#2260) — keeps unit tests hermetic. */
 export type FetchMergeabilityFn = (prNumber: number, repo: string, runGh: RunGhFn) => MergeabilitySignal;
 export interface ComputeGateOptions extends CiGateOptions, SlizardGateOptions {

package/dist/pr-merge-readiness/compute.js

@@ -2,12 +2,13 @@ import { buildCiSummaryLine, evaluateCiGate } from "./ci-gate.js";
 import { FALLBACK2_NOT_CLEAN_MSG, VIA_ERROR, VIA_FALLBACK1, VIA_FALLBACK2, VIA_PRIMARY, } from "./constants.js";
 import { evaluateGates, isMergeReady } from "./evaluate.js";
 import { fetchCheckRunsRest, fetchGreptileBodyRest, fetchGreptileCommentBody, fetchPrHeadSha, fetchPrHeadShaRest, resolveRepo, } from "./gh.js";
+import { fetchUnresolvedGreptileInlineFindings, inlineFindingsToDict, } from "./greptile-inline.js";
 import { fetchMergeability, isGithubMergeableClean, mergeabilityToDict, verdictBlockIsSoftOnly, verdictShaIsStale, } from "./mergeability.js";
 import { emptyVerdict, parseGreptileBody } from "./parse.js";
 import { evaluateSlizardGate, isSlizardCheck } from "./slizard-gate.js";
-function buildGateResult(prNumber, repo, headSha, body, via, partialData = {}, error = null) {
+function buildGateResult(prNumber, repo, headSha, body, via, partialData = {}, error = null, inline = null) {
     const verdict = parseGreptileBody(body);
-    const failures = evaluateGates(prNumber, headSha, verdict);
+    const failures = evaluateGates(prNumber, headSha, verdict, inline);
     return {
         prNumber,
         repo,
@@ -92,10 +93,24 @@ function applyCiGateForHead(repo, headSha, runGh, options) {
  * is only soft-blocked -- absent or stale for the current head) reconcile
  * against GitHub's own mergeability (#2260). Shared by primary + fallback1.
  */
+function loadInlineGreptileFindings(prNumber, repo, headSha, runGh) {
+    const resolved = resolveRepo(repo, runGh);
+    if (resolved.repo === null) {
+        return {
+            p0Count: 0,
+            p1Count: 0,
+            unresolvedThreadCount: 0,
+            error: resolved.error || "repo unresolved for inline reviewThreads lookup; pass --repo OWNER/REPO",
+        };
+    }
+    return fetchUnresolvedGreptileInlineFindings(prNumber, resolved.repo, headSha, runGh);
+}
 function finalizeVerdictGate(prNumber, repo, headSha, verdict, runGh, options) {
-    const failures = evaluateGates(prNumber, headSha, verdict);
     const partialData = {};
     const resolved = resolveRepo(repo, runGh);
+    const inline = loadInlineGreptileFindings(prNumber, repo, headSha, runGh);
+    partialData.greptile_inline = inlineFindingsToDict(inline);
+    const failures = evaluateGates(prNumber, headSha, verdict, inline);
     if (failures.length === 0) {
         const ci = applyCiGateForHead(resolved.repo, headSha, runGh, options);
         failures.push(...ci.failures);
@@ -108,7 +123,7 @@ function finalizeVerdictGate(prNumber, repo, headSha, verdict, runGh, options) {
     // blocking. Only reconcile a SOFT block (verdict absent / stale head SHA).
     if (options.disableMergeabilityReconcile === true ||
         resolved.repo === null ||
-        !verdictBlockIsSoftOnly(verdict, headSha)) {
+        !verdictBlockIsSoftOnly(verdict, headSha, inline)) {
         return { failures, partialData };
     }
     const ci = applyCiGateForHead(resolved.repo, headSha, runGh, options);
@@ -143,17 +158,19 @@ function computePrimary(prNumber, repo, runGh, options) {
         return { result: null, partial };
     }
     partial.head_sha = headSha;
+    const resolved = resolveRepo(repo, runGh);
+    const effectiveRepo = resolved.repo ?? repo;
     const body = fetchGreptileCommentBody(prNumber, repo, runGh);
     if (body === null) {
         partial.primary_error = "gh api /issues/<N>/comments --jq returned non-zero";
         return { result: null, partial };
     }
     const verdict = parseGreptileBody(body);
-    const { failures, partialData } = finalizeVerdictGate(prNumber, repo, headSha, verdict, runGh, options);
+    const { failures, partialData } = finalizeVerdictGate(prNumber, effectiveRepo, headSha, verdict, runGh, options);
     return {
         result: {
             prNumber,
-            repo,
+            repo: effectiveRepo,
             headSha,
             verdict,
             failures,

package/dist/pr-merge-readiness/evaluate.d.ts

@@ -1,5 +1,6 @@
+import type { InlineGreptileFindings } from "./greptile-inline.js";
 import type { GreptileVerdict } from "./types.js";
 /** Return failure messages (empty list == merge-ready). */
-export declare function evaluateGates(_prNumber: number, headSha: string | null, verdict: GreptileVerdict): string[];
+export declare function evaluateGates(_prNumber: number, headSha: string | null, verdict: GreptileVerdict, inline?: InlineGreptileFindings | null): string[];
 export declare function isMergeReady(failures: readonly string[]): boolean;
 //# sourceMappingURL=evaluate.d.ts.map

package/dist/pr-merge-readiness/evaluate.js

@@ -1,6 +1,6 @@
 import { INFORMAL_CLEAN_DIAGNOSTIC } from "./constants.js";
 /** Return failure messages (empty list == merge-ready). */
-export function evaluateGates(_prNumber, headSha, verdict) {
+export function evaluateGates(_prNumber, headSha, verdict, inline = null) {
     const failures = [];
     if (!verdict.found) {
         failures.push("No Greptile rolling-summary comment found on the PR. " +
@@ -8,40 +8,55 @@ export function evaluateGates(_prNumber, headSha, verdict) {
             "Wait for the review to land before merging (see #796 late-bot-review re-check).");
         return failures;
     }
-    if (verdict.excludedAuthor) {
-        return failures;
-    }
-    if (verdict.errored) {
-        failures.push("Greptile review is in the ERRORED state on the current HEAD (#526). " +
-            "Retry via @greptileai or escalate per " +
-            "skills/deft-directive-swarm/SKILL.md Phase 6 Step 1.");
+    if (!verdict.excludedAuthor) {
+        if (verdict.errored) {
+            failures.push("Greptile review is in the ERRORED state on the current HEAD (#526). " +
+                "Retry via @greptileai or escalate per " +
+                "skills/deft-directive-swarm/SKILL.md Phase 6 Step 1.");
+        }
+        if (verdict.informalClean) {
+            failures.push(INFORMAL_CLEAN_DIAGNOSTIC);
+            return appendInlineFailures(failures, inline);
+        }
+        if (verdict.lastReviewedSha === null) {
+            failures.push("Could not parse `Last reviewed commit:` from Greptile body. " +
+                "The comment may be malformed or Greptile may still be writing it -- re-fetch.");
+        }
+        else if (headSha &&
+            !(headSha.startsWith(verdict.lastReviewedSha) || verdict.lastReviewedSha.startsWith(headSha))) {
+            failures.push(`Greptile last reviewed ${verdict.lastReviewedSha} but PR HEAD is ${headSha}. ` +
+                "Review is stale -- wait for Greptile to re-review the latest commit.");
+        }
+        if (verdict.confidence === null) {
+            failures.push("Could not parse `Confidence Score: X/5` from Greptile body. " +
+                "Confidence is a required exit-condition input per " +
+                "skills/deft-directive-review-cycle/SKILL.md Phase 2 Step 6.");
+        }
+        else if (verdict.confidence <= 3) {
+            failures.push(`Greptile confidence is ${verdict.confidence}/5; exit condition requires > 3. ` +
+                "Address remaining findings or push clarifying changes.");
+        }
+        if (verdict.p0Count > 0 || verdict.p1Count > 0) {
+            failures.push(`Greptile reports ${verdict.p0Count} P0 and ${verdict.p1Count} P1 findings ` +
+                "on the current HEAD. All P0 / P1 findings MUST be addressed before merge " +
+                "(P2 findings are non-blocking).");
+        }
     }
-    if (verdict.informalClean) {
-        failures.push(INFORMAL_CLEAN_DIAGNOSTIC);
+    return appendInlineFailures(failures, inline);
+}
+function appendInlineFailures(failures, inline) {
+    if (inline === null) {
         return failures;
     }
-    if (verdict.lastReviewedSha === null) {
-        failures.push("Could not parse `Last reviewed commit:` from Greptile body. " +
-            "The comment may be malformed or Greptile may still be writing it -- re-fetch.");
-    }
-    else if (headSha &&
-        !(headSha.startsWith(verdict.lastReviewedSha) || verdict.lastReviewedSha.startsWith(headSha))) {
-        failures.push(`Greptile last reviewed ${verdict.lastReviewedSha} but PR HEAD is ${headSha}. ` +
-            "Review is stale -- wait for Greptile to re-review the latest commit.");
-    }
-    if (verdict.confidence === null) {
-        failures.push("Could not parse `Confidence Score: X/5` from Greptile body. " +
-            "Confidence is a required exit-condition input per " +
-            "skills/deft-directive-review-cycle/SKILL.md Phase 2 Step 6.");
-    }
-    else if (verdict.confidence <= 3) {
-        failures.push(`Greptile confidence is ${verdict.confidence}/5; exit condition requires > 3. ` +
-            "Address remaining findings or push clarifying changes.");
+    if (inline.error !== null) {
+        failures.push("Could not verify Greptile inline review comments on the current HEAD (#2620). " +
+            `Root cause: ${inline.error}`);
     }
-    if (verdict.p0Count > 0 || verdict.p1Count > 0) {
-        failures.push(`Greptile reports ${verdict.p0Count} P0 and ${verdict.p1Count} P1 findings ` +
-            "on the current HEAD. All P0 / P1 findings MUST be addressed before merge " +
-            "(P2 findings are non-blocking).");
+    else if (inline.p0Count > 0 || inline.p1Count > 0) {
+        failures.push(`Greptile has ${inline.p0Count} unresolved inline P0 and ${inline.p1Count} unresolved inline P1 ` +
+            `review comment(s) on the current HEAD across ${inline.unresolvedThreadCount} open thread(s). ` +
+            "Resolve or address all blocking inline threads before merge -- rolling-summary badge counts alone " +
+            "are insufficient (#2620).");
     }
     return failures;
 }

package/dist/pr-merge-readiness/gh.js

@@ -66,7 +66,10 @@ export function fetchGreptileCommentBody(prNumber, repo, runGh) {
         `repos/${resolvedRepo}/issues/${prNumber}/comments`,
         "--paginate",
         "--jq",
-        `[.[] | select(.user.login == "${GREPTILE_LOGIN}")] | last | .body // ""`,
+        // Prefer most recently *updated* Greptile summary. Greptile edits the
+        // primary rolling summary in place; a later-created duplicate can stay
+        // SHA-stale and must not win over the refreshed primary (#1056 / #2658).
+        `[.[] | select(.user.login == "${GREPTILE_LOGIN}")] | sort_by(.updated_at) | last | .body // ""`,
     ];
     const { returncode, stdout, stderr } = runGh(cmd);
     if (returncode !== 0) {
@@ -123,7 +126,8 @@ function parsePaginatedComments(text) {
         }
         idx = end;
     }
-    const greptileBodies = [];
+    let bestBody = "";
+    let bestUpdatedAt = "";
     for (const c of comments) {
         if (c !== null &&
             typeof c === "object" &&
@@ -136,13 +140,17 @@ function parsePaginatedComments(text) {
             c.user.login === GREPTILE_LOGIN &&
             "body" in c &&
             typeof c.body === "string") {
-            greptileBodies.push(c.body);
+            const updatedAt = "updated_at" in c && typeof c.updated_at === "string" ? c.updated_at : "";
+            if (updatedAt >= bestUpdatedAt) {
+                bestUpdatedAt = updatedAt;
+                bestBody = c.body;
+            }
         }
     }
-    if (greptileBodies.length === 0) {
+    if (bestBody.length === 0 && bestUpdatedAt.length === 0) {
         return { body: "", error: "" };
     }
-    return { body: greptileBodies[greptileBodies.length - 1] ?? "", error: "" };
+    return { body: bestBody, error: "" };
 }
 /** Mirrors Python json.JSONDecoder.raw_decode for concatenated paginate arrays. */
 class PaginatedJsonDecoder {

package/dist/pr-merge-readiness/greptile-inline.d.ts

@@ -0,0 +1,27 @@
+import type { RunGhFn } from "./types.js";
+/** Unresolved Greptile inline P0/P1 on the current PR HEAD (#2620). */
+export interface InlineGreptileFindings {
+    readonly p0Count: number;
+    readonly p1Count: number;
+    readonly unresolvedThreadCount: number;
+    readonly error: string | null;
+}
+export interface InlineReviewComment {
+    readonly authorLogin: string;
+    readonly body: string;
+    readonly path: string | null;
+    readonly commitOid: string | null;
+}
+export interface InlineReviewThread {
+    readonly isResolved: boolean;
+    readonly isOutdated: boolean;
+    readonly comments: readonly InlineReviewComment[];
+}
+/** True when a review comment commit SHA matches the current PR head (#2620 AC-2). */
+export declare function headShaMatches(commentSha: string, headSha: string): boolean;
+export declare function inlineFindingsToDict(findings: InlineGreptileFindings): Record<string, unknown>;
+/** Score unresolved Greptile inline P0/P1 threads pinned to the current HEAD (#2620). */
+export declare function evaluateInlineReviewThreads(threads: readonly InlineReviewThread[], headSha: string): InlineGreptileFindings;
+/** Fetch unresolved Greptile inline P0/P1 on the current HEAD via reviewThreads GraphQL (#2620). */
+export declare function fetchUnresolvedGreptileInlineFindings(prNumber: number, repo: string, headSha: string, runGh: RunGhFn): InlineGreptileFindings;
+//# sourceMappingURL=greptile-inline.d.ts.map