@deftai/directive-core 0.93.0 → 0.95.0

package/dist/pr-wait-mergeable/cascade.js

@@ -1,5 +1,6 @@
 import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
 import { evaluateAgentMerge, } from "../policy/require-human-merge.js";
+import { reconcileUmbrellas, renderUmbrellasReport } from "../vbrief-reconcile/umbrellas.js";
 import { classifyMonitorOutcome, parseMonitorPayload } from "./classify.js";
 import { EXIT_CONFIG_ERROR, EXIT_MERGED, EXIT_TIMEOUT_OR_ESCALATION } from "./constants.js";
 import { makeResult } from "./result.js";
@@ -12,6 +13,12 @@ function isProtectedCheckConfigFailure(stderr) {
         tail.includes("Cannot find module") ||
         tail.includes("protected-check script not found:"));
 }
+function defaultPostMergeUmbrellaReconcile(projectRoot, repo) {
+    const [, umOutcome] = reconcileUmbrellas(projectRoot, { repo });
+    if (umOutcome.changed.length > 0 || umOutcome.errors.length > 0) {
+        process.stderr.write(`${renderUmbrellasReport(umOutcome)}\n`);
+    }
+}
 /** Run protected-check -> wait -> merge cascade (#1369). */
 export function waitMergeableAndMerge(prNumber, repo, options) {
     const protectedFn = options.protectedFn ?? runProtectedCheck;
@@ -93,7 +100,9 @@ export function waitMergeableAndMerge(prNumber, repo, options) {
             error: semanticGreen.error,
         });
     }
-    const [monRc, monStdout, monStderr] = monitorFn(prNumber, repo, options.capMinutes);
+    const [monRc, monStdout, monStderr] = monitorFn(prNumber, repo, options.capMinutes, {
+        projectRoot,
+    });
     const monitorPayload = parseMonitorPayload(monStdout);
     const [outcome, monitorExit] = classifyMonitorOutcome(monRc, monitorPayload);
     if (outcome !== "clean") {
@@ -114,6 +123,24 @@ export function waitMergeableAndMerge(prNumber, repo, options) {
     }
     const [mergeRc, mergeStdout, mergeStderr] = mergeFn(prNumber, repo);
     if (mergeRc === 0) {
+        // Best-effort umbrella checklist + current-shape refresh after child merge (#1649).
+        // Failures must not flip a successful merge into an error exit.
+        // null = skip; undefined = live default (skipped under VITEST unless injected).
+        const umbrellaFn = options.umbrellaReconcileFn === null
+            ? null
+            : options.umbrellaReconcileFn !== undefined
+                ? options.umbrellaReconcileFn
+                : process.env.VITEST === "true"
+                    ? null
+                    : defaultPostMergeUmbrellaReconcile;
+        if (umbrellaFn !== null) {
+            try {
+                umbrellaFn(projectRoot, repo);
+            }
+            catch {
+                /* best-effort; merge remains authoritative */
+            }
+        }
         return makeResult({
             prNumber,
             repo,

package/dist/pr-wait-mergeable/main.d.ts

@@ -8,6 +8,8 @@ export interface ParsedWaitMergeableArgs {
     readonly cascadeMode: boolean;
     readonly requireMasterCiGreen: boolean;
     readonly baseBranch: string | null;
+    /** Project root for minGreptileConfidence (#3095 / #3102). Null = cwd at run. */
+    readonly projectRoot: string | null;
     readonly error?: string;
 }
 export declare function parseWaitMergeableArgs(argv: readonly string[]): ParsedWaitMergeableArgs;

package/dist/pr-wait-mergeable/main.js

@@ -19,6 +19,7 @@ export function parseWaitMergeableArgs(argv) {
     let cascadeMode = false;
     let requireMasterCiGreen = false;
     let baseBranch = null;
+    let projectRoot = null;
     const baseReturn = () => ({
         prNumber,
         repo,
@@ -28,6 +29,7 @@ export function parseWaitMergeableArgs(argv) {
         cascadeMode,
         requireMasterCiGreen,
         baseBranch,
+        projectRoot,
     });
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
@@ -51,6 +53,17 @@ export function parseWaitMergeableArgs(argv) {
         else if (arg?.startsWith("--base-branch=")) {
             baseBranch = arg.slice("--base-branch=".length);
         }
+        else if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...baseReturn(), error: "argument --project-root: expected one argument" };
+            }
+            projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            projectRoot = arg.slice("--project-root=".length);
+        }
         else if (arg === "--repo") {
             const value = argv[i + 1];
             if (value === undefined) {
@@ -154,6 +167,9 @@ export function runWaitMergeable(argv, options = {}) {
         cascadeMode: args.cascadeMode,
         requireMasterCiGreen: args.requireMasterCiGreen,
         baseBranch: args.baseBranch,
+        // Explicit CLI root (or cwd) so remote-target cascade does not resolve
+        // minGreptileConfidence from an unrelated directory (#3102).
+        projectRoot: args.projectRoot ?? process.cwd(),
     });
     const summaryLabel = summaryLabelForExit(result.exitCode);
     process.stderr.write(`[pr_wait_mergeable] PR #${result.prNumber} repo=${result.repo} ` +

package/dist/pr-wait-mergeable/types.d.ts

@@ -12,6 +12,8 @@ export interface WaitMergeableResult {
 }
 export type SubprocessTriple = readonly [number, string, string];
 export type ProtectedCheckFn = (prNumber: number, repo: string | null, protectedIssues: readonly number[]) => SubprocessTriple;
-export type MonitorFn = (prNumber: number, repo: string, capMinutes: number) => SubprocessTriple;
+export type MonitorFn = (prNumber: number, repo: string, capMinutes: number, options?: {
+    readonly projectRoot?: string;
+}) => SubprocessTriple;
 export type MergeFn = (prNumber: number, repo: string | null) => SubprocessTriple;
 //# sourceMappingURL=types.d.ts.map

package/dist/pr-wait-mergeable/wrappers.d.ts

@@ -35,6 +35,12 @@ export declare function runProtectedCheck(prNumber: number, repo: string | null,
 export interface RunMonitorOptions {
     readonly nodeExecutable?: string;
     readonly timeout?: number;
+    /**
+     * Project root for plan.policy.review.minGreptileConfidence when the
+     * cascade cwd is not the monitored project (#3095 residual / #3102).
+     * Defaults to process.cwd() when omitted.
+     */
+    readonly projectRoot?: string;
 }
 /** Invoke pr-monitor CLI with --json and return (returncode, stdout, stderr). */
 export declare function runMonitor(prNumber: number, repo: string, capMinutes: number, options?: RunMonitorOptions): SubprocessTriple;

package/dist/pr-wait-mergeable/wrappers.js

@@ -105,6 +105,7 @@ export function runMonitor(prNumber, repo, capMinutes, options = {}) {
     }
     const node = options.nodeExecutable ?? process.execPath;
     const timeoutSec = options.timeout ?? capMinutes * 60 + 60;
+    const projectRoot = options.projectRoot ?? process.cwd();
     const cmd = [
         scriptPath,
         String(prNumber),
@@ -112,6 +113,8 @@ export function runMonitor(prNumber, repo, capMinutes, options = {}) {
         repo,
         "--cap-minutes",
         String(capMinutes),
+        "--project-root",
+        projectRoot,
         "--json",
     ];
     // Stream the monitor's per-poll heartbeat live (a buffered poll looks like a

package/dist/pr-watch/constants.d.ts

@@ -6,7 +6,10 @@
  * cannot promise to poll and then silently forget (2026-05-11 three-strikes on
  * #1051 / #1054).
  */
-/** CLEAN: SHA-matched, non-errored, no P0/P1, confidence > 3, CI green. */
+/**
+ * CLEAN: SHA-matched, non-errored, no P0/P1, confidence >= resolved min, CI green.
+ * Min defaults to consumer 4 (legacy > 3); dogfood/policy may raise to 5 (#3095).
+ */
 export declare const EXIT_CLEAN = 0;
 /** NEW_P0_P1: blocking findings on the CURRENT (SHA-matched) review. */
 export declare const EXIT_NEW_P0_P1 = 1;

package/dist/pr-watch/constants.js

@@ -6,7 +6,10 @@
  * cannot promise to poll and then silently forget (2026-05-11 three-strikes on
  * #1051 / #1054).
  */
-/** CLEAN: SHA-matched, non-errored, no P0/P1, confidence > 3, CI green. */
+/**
+ * CLEAN: SHA-matched, non-errored, no P0/P1, confidence >= resolved min, CI green.
+ * Min defaults to consumer 4 (legacy > 3); dogfood/policy may raise to 5 (#3095).
+ */
 export const EXIT_CLEAN = 0;
 /** NEW_P0_P1: blocking findings on the CURRENT (SHA-matched) review. */
 export const EXIT_NEW_P0_P1 = 1;
@@ -57,7 +60,7 @@ export const WATCH_HELP = "usage: task pr:watch -- <pr_number> [options]\n" +
     "  --project-root PATH   Chdir before probing (optional)\n" +
     "\n" +
     "exit codes:\n" +
-    "  0  CLEAN       SHA-matched review, confidence > 3, no P0/P1, CI green\n" +
+    "  0  CLEAN       SHA-matched review, confidence >= policy min (default 4; dogfood 5), no P0/P1, CI green\n" +
     "  1  NEW_P0_P1   Blocking findings on the current (SHA-matched) review\n" +
     "  2  ERRORED | STALL | TIMEOUT | CI_BLOCKED | RUNNER_CAPACITY_STALL | config / usage error\n";
 /**

package/dist/pr-watch/main.js

@@ -223,6 +223,7 @@ export function runWatch(argv, options = {}) {
             clockFn: options.clockFn,
             probeFn: options.probeFn,
             stallThreshold: options.stallThreshold,
+            projectRoot: args.projectRoot ?? process.cwd(),
         });
         if (args.emitJson) {
             process.stdout.write(emitWatchJson(result));

package/dist/pr-watch/probe.d.ts

@@ -9,5 +9,5 @@ import type { WatchProbe } from "./types.js";
  * detector (#1056 AC-2). All gh access routes through the injectable RunGhFn
  * seam, which defaults to the UTF-8-safe execFile capture (#1366).
  */
-export declare function probeOnce(prNumber: number, repoArg: string | null, runGh?: RunGhFn): WatchProbe;
+export declare function probeOnce(prNumber: number, repoArg: string | null, runGh?: RunGhFn, projectRoot?: string | null): WatchProbe;
 //# sourceMappingURL=probe.d.ts.map

package/dist/pr-watch/probe.js

@@ -1,4 +1,5 @@
 import { detect, evaluateCleanGate, parseConfidence, parseLastReviewedShaMarkdownLink, parseLastReviewedShaNaiveInline, } from "../content-contracts/skills/greptile-detector.js";
+import { resolveMinGreptileConfidence } from "../policy/min-greptile-confidence.js";
 import { evaluateCiGate } from "../pr-merge-readiness/ci-gate.js";
 import { GREPTILE_ERRORED_SENTINEL } from "../pr-merge-readiness/constants.js";
 import { defaultRunGh, fetchCheckRunsRest, fetchGreptileBodyRest, fetchGreptileCommentBody, fetchPrHeadSha, fetchPrHeadShaRest, resolveRepo, } from "../pr-merge-readiness/gh.js";
@@ -32,9 +33,10 @@ function errorProbe(headSha, message) {
  * detector (#1056 AC-2). All gh access routes through the injectable RunGhFn
  * seam, which defaults to the UTF-8-safe execFile capture (#1366).
  */
-export function probeOnce(prNumber, repoArg, runGh = defaultRunGh) {
+export function probeOnce(prNumber, repoArg, runGh = defaultRunGh, projectRoot = null) {
     const resolved = resolveRepo(repoArg, runGh);
     const repo = resolved.repo;
+    const minConfidence = resolveMinGreptileConfidence(projectRoot ?? process.cwd()).min;
     // 1. HEAD SHA -- primary `gh pr view`, then REST fallback when a repo resolved.
     let headSha = fetchPrHeadSha(prNumber, repo, runGh);
     if (headSha === null && repo !== null) {
@@ -88,6 +90,7 @@ export function probeOnce(prNumber, repoArg, runGh = defaultRunGh) {
         ciFailures,
         errored,
         terminalCheckRun,
+        minConfidence,
     });
     return {
         found,

package/dist/pr-watch/types.d.ts

@@ -34,7 +34,7 @@ export type SleepFn = (seconds: number) => void;
 export interface MonotonicClock {
     now(): number;
 }
-export type ProbeFn = (prNumber: number, repo: string | null, runGh: RunGhFn) => WatchProbe;
+export type ProbeFn = (prNumber: number, repo: string | null, runGh: RunGhFn, projectRoot?: string | null) => WatchProbe;
 export interface WatchOptions {
     readonly maxWaitMinutes?: number;
     readonly pollSeconds?: number;
@@ -44,6 +44,12 @@ export interface WatchOptions {
     readonly sleepFn?: SleepFn;
     readonly clockFn?: MonotonicClock;
     readonly probeFn?: ProbeFn;
+    /**
+     * Project root for resolving plan.policy.review.minGreptileConfidence (#3095).
+     * When omitted, probeOnce uses process.cwd(). Finish-loop / pr:watch MUST pass
+     * the caller project-root so a chdir elsewhere cannot apply the wrong floor.
+     */
+    readonly projectRoot?: string | null;
 }
 export interface WatchResult {
     readonly verdict: string;

package/dist/pr-watch/watch.js

@@ -44,7 +44,8 @@ export function watch(prNumber, repo, options = {}) {
     const runGh = options.runGh ?? defaultRunGh;
     const clockFn = options.clockFn ?? systemMonotonicClock;
     const sleepFn = options.sleepFn ?? defaultSleep;
-    const probeFn = options.probeFn ?? probeOnce;
+    const projectRoot = options.projectRoot ?? null;
+    const probeFn = options.probeFn ?? ((n, r, gh, root) => probeOnce(n, r, gh, root ?? projectRoot));
     const capSeconds = Math.max(0, maxWaitMinutes * 60);
     // Bounded loop (time is still the authority via the cap check below) so no
     // unbounded `while (true)`; +1 covers the trailing poll after the final wait.
@@ -62,7 +63,7 @@ export function watch(prNumber, repo, options = {}) {
         pollCount: poll,
     });
     for (let poll = 1; poll <= maxPolls; poll += 1) {
-        const probe = probeFn(prNumber, repo, runGh);
+        const probe = probeFn(prNumber, repo, runGh, projectRoot);
         lastProbe = probe;
         const elapsed = Math.round(clockFn.now() - startedAt);
         process.stderr.write(`${formatWatchStatus(poll, maxPolls, probe, elapsed)}\n`);

package/dist/release-e2e/greenfield-python-free-smoke.js

@@ -152,9 +152,14 @@ export function rehearseGreenfieldPythonFreeSmoke(repoRoot, seams = {}, options
             return [false, `greenfield smoke: expected global deft at ${deft}`];
         }
         const pyFree = pythonFreePathEnv(envBase);
+        const installedBin = join(npmPrefix, "bin");
+        const installedEnv = {
+            ...pyFree,
+            PATH: `${installedBin}:${pyFree.PATH ?? ""}`,
+        };
         [ok, reason] = runStep(spawn, "directive init", deft, ["init", "--yes", "--repo-root", projectDir], {
             cwd: work,
-            env: pyFree,
+            env: installedEnv,
             timeoutMs: 120_000,
         }, onProgress);
         if (!ok)
@@ -173,8 +178,7 @@ export function rehearseGreenfieldPythonFreeSmoke(repoRoot, seams = {}, options
             return [false, "greenfield smoke: repo-root Python run shim present after init"];
         }
         const checkEnv = {
-            ...pyFree,
-            PATH: `${join(npmPrefix, "bin")}:${pyFree.PATH ?? ""}`,
+            ...installedEnv,
             DEFT_SESSION_RITUAL_SKIP: "1",
         };
         onProgress?.("greenfield smoke: running consumer task deft:check (engine-invoke path)");

package/dist/review-monitor/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./constants.js";
 export * from "./github-lease.js";
+export * from "./l4-owner.js";
 export * from "./lease-comment.js";
 export * from "./record.js";
 export * from "./tier-detection.js";

package/dist/review-monitor/index.js

@@ -1,5 +1,6 @@
 export * from "./constants.js";
 export * from "./github-lease.js";
+export * from "./l4-owner.js";
 export * from "./lease-comment.js";
 export * from "./record.js";
 export * from "./tier-detection.js";

package/dist/review-monitor/l4-owner.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Owner Continuity / L4 owner gate (#3090).
+ *
+ * Exit 0 only when a fresh sticky review-owner lease exists on the PR,
+ * or the caller asserts `review_cycle: done` after Step 6.
+ * Freeform started/pending/initiated values are rejected.
+ * skipped / n/a / parent-retained are process evidence only — they do NOT
+ * satisfy this machine gate when --pr is required (lease-or-done).
+ */
+import { EXIT_CONFIG_ERROR, EXIT_NOT_READY, EXIT_READY } from "./constants.js";
+import type { ReviewOwnerGithubSeams } from "./github-lease.js";
+import { type ReviewMonitorRecord } from "./record.js";
+/** Allowed review_cycle evidence values (prefix form for in_progress/skipped). */
+export type ReviewCycleEvidence = "done" | "n/a" | `in_progress:${string}` | `skipped:${string}`;
+export declare const L4_OWNER_HELP: string;
+export declare function parseReviewCycleEvidence(raw: string | null | undefined): {
+    ok: true;
+    value: ReviewCycleEvidence | null;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Parse in_progress:<pr>#<ref> into parts; null if not that form. */
+export declare function parseInProgressEvidence(value: string): {
+    pr: number;
+    ref: string;
+} | null;
+export interface VerifyL4OwnerArgs {
+    readonly pr: number;
+    readonly projectRoot: string;
+    readonly repo?: string | null;
+    readonly headSha?: string | null;
+    readonly reviewCycle?: string | null;
+    readonly now?: Date;
+    readonly seams?: ReviewOwnerGithubSeams;
+}
+export interface VerifyL4OwnerResult {
+    readonly exitCode: typeof EXIT_READY | typeof EXIT_NOT_READY | typeof EXIT_CONFIG_ERROR;
+    readonly message: string;
+    readonly monitorRecord: ReviewMonitorRecord | null;
+    readonly reviewCycle: ReviewCycleEvidence | null;
+    readonly path: "lease" | "done" | "none" | "illegal" | "config";
+}
+export declare function evaluateL4OwnerGate(args: VerifyL4OwnerArgs): VerifyL4OwnerResult;
+export declare function l4OwnerResultToJson(result: VerifyL4OwnerResult): Record<string, unknown>;
+//# sourceMappingURL=l4-owner.d.ts.map

package/dist/review-monitor/l4-owner.js

@@ -0,0 +1,262 @@
+/**
+ * Owner Continuity / L4 owner gate (#3090).
+ *
+ * Exit 0 only when a fresh sticky review-owner lease exists on the PR,
+ * or the caller asserts `review_cycle: done` after Step 6.
+ * Freeform started/pending/initiated values are rejected.
+ * skipped / n/a / parent-retained are process evidence only — they do NOT
+ * satisfy this machine gate when --pr is required (lease-or-done).
+ */
+import { existsSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { resolveRepo } from "../triage/queue/repo.js";
+import { EXIT_CONFIG_ERROR, EXIT_NOT_READY, EXIT_READY } from "./constants.js";
+import { fetchActiveMonitorFromGithub } from "./record.js";
+export const L4_OWNER_HELP = "usage: task verify:l4-owner -- --pr <N> [options]\n" +
+    "\n" +
+    "Owner Continuity / L4 owner gate (#3090): after drive-to:merge-ready /\n" +
+    "babysit / shepherd claims, exit 0 only when a sticky GitHub review-owner\n" +
+    "lease is fresh on the PR, or the caller asserts --review-cycle done\n" +
+    "(Step 6 fail-closed all-of on HEAD). Freeform started/pending/initiated\n" +
+    "are rejected. skipped / n/a / parent-retained do NOT satisfy this machine\n" +
+    "gate (process A/B/C still applies). Silent hold exits 1.\n" +
+    "\n" +
+    "options:\n" +
+    "  -h, --help                 Show this help and exit 0\n" +
+    "  --pr N                     Pull request number (required unless --help)\n" +
+    "  --repo OWNER/REPO          Repository (optional; inferred from origin)\n" +
+    "  --head-sha SHA             Expected HEAD SHA (optional freshness check)\n" +
+    "  --project-root PATH        Project root (default: cwd)\n" +
+    "  --review-cycle VALUE       done | in_progress:<pr>#<ref> | skipped:<reason> | n/a\n" +
+    "  --json                     Emit structured JSON on stdout\n" +
+    "\n" +
+    "exit codes:\n" +
+    "  0  READY       Fresh sticky lease, or --review-cycle done\n" +
+    "  1  NOT READY   Silent hold / illegal evidence / lease missing\n" +
+    "  2  CONFIG      Usage / path / GitHub fetch error\n";
+const FORBIDDEN_FREEFORM = new Set(["started", "pending", "initiated", "start", "in_progress"]);
+export function parseReviewCycleEvidence(raw) {
+    if (raw === null || raw === undefined || raw.trim() === "") {
+        return { ok: true, value: null };
+    }
+    const value = raw.trim();
+    const lower = value.toLowerCase();
+    if (FORBIDDEN_FREEFORM.has(lower)) {
+        return {
+            ok: false,
+            reason: `illegal freeform review_cycle value '${value}' (#3090); ` +
+                "use done | in_progress:<pr>#<ref> | skipped:<reason> | n/a",
+        };
+    }
+    if (value === "done" || value === "n/a") {
+        return { ok: true, value };
+    }
+    if (value.startsWith("in_progress:")) {
+        const rest = value.slice("in_progress:".length);
+        if (!rest.includes("#") || rest.endsWith("#") || rest.startsWith("#")) {
+            return {
+                ok: false,
+                reason: "in_progress requires form in_progress:<pr>#<monitor_or_lease_ref> (#3090)",
+            };
+        }
+        const prPart = rest.slice(0, rest.indexOf("#"));
+        if (!/^\d+$/.test(prPart) || Number(prPart) <= 0) {
+            return {
+                ok: false,
+                reason: "in_progress:<pr> must be a positive integer PR number (#3090)",
+            };
+        }
+        return { ok: true, value: value };
+    }
+    if (value.startsWith("skipped:")) {
+        const rest = value.slice("skipped:".length).trim();
+        if (rest.length === 0) {
+            return { ok: false, reason: "skipped requires a non-empty reason (#3090)" };
+        }
+        return { ok: true, value: value };
+    }
+    return {
+        ok: false,
+        reason: `unknown review_cycle value '${value}' (#3090); ` +
+            "use done | in_progress:<pr>#<ref> | skipped:<reason> | n/a",
+    };
+}
+/** Parse in_progress:<pr>#<ref> into parts; null if not that form. */
+export function parseInProgressEvidence(value) {
+    if (!value.startsWith("in_progress:")) {
+        return null;
+    }
+    const rest = value.slice("in_progress:".length);
+    const hash = rest.indexOf("#");
+    if (hash <= 0) {
+        return null;
+    }
+    const prPart = rest.slice(0, hash);
+    const ref = rest.slice(hash + 1);
+    if (!/^\d+$/.test(prPart) || ref.length === 0) {
+        return null;
+    }
+    return { pr: Number(prPart), ref };
+}
+function oneLine(value) {
+    return value.replace(/\r?\n/g, " ");
+}
+export function evaluateL4OwnerGate(args) {
+    const projectRoot = resolve(args.projectRoot);
+    let isDir = false;
+    try {
+        isDir = existsSync(projectRoot) && statSync(projectRoot).isDirectory();
+    }
+    catch {
+        isDir = false;
+    }
+    if (!isDir) {
+        return {
+            exitCode: EXIT_CONFIG_ERROR,
+            message: `verify_l4_owner: --project-root is not a directory: ${oneLine(projectRoot)}`,
+            monitorRecord: null,
+            reviewCycle: null,
+            path: "config",
+        };
+    }
+    const parsed = parseReviewCycleEvidence(args.reviewCycle);
+    if (!parsed.ok) {
+        return {
+            exitCode: EXIT_NOT_READY,
+            message: `verify_l4_owner: ${oneLine(parsed.reason)}`,
+            monitorRecord: null,
+            reviewCycle: null,
+            path: "illegal",
+        };
+    }
+    // Machine gate is lease-or-done only (#3090). skipped/n/a are handoff enum values
+    // but must not green-light ownership of an open PR without lease or Step 6 done.
+    if (parsed.value === "n/a" || parsed.value?.startsWith("skipped:")) {
+        return {
+            exitCode: EXIT_NOT_READY,
+            message: `verify_l4_owner: review_cycle=${oneLine(parsed.value)} does not satisfy the machine ` +
+                `gate for PR #${args.pr} (#3090). Exit 0 requires a fresh sticky lease or --review-cycle done.`,
+            monitorRecord: null,
+            reviewCycle: parsed.value,
+            path: "none",
+        };
+    }
+    if (parsed.value === "done") {
+        return {
+            exitCode: EXIT_READY,
+            message: `verify_l4_owner: review_cycle=done asserted for PR #${args.pr} (#3090). ` +
+                "Caller MUST have satisfied Step 6 fail-closed all-of on HEAD before this claim.",
+            monitorRecord: null,
+            reviewCycle: "done",
+            path: "done",
+        };
+    }
+    // Validate in_progress PR binding when evidence is present (before lease fetch).
+    if (parsed.value?.startsWith("in_progress:")) {
+        const parts = parseInProgressEvidence(parsed.value);
+        if (parts === null) {
+            return {
+                exitCode: EXIT_NOT_READY,
+                message: `verify_l4_owner: malformed in_progress evidence ${oneLine(parsed.value)} (#3090).`,
+                monitorRecord: null,
+                reviewCycle: parsed.value,
+                path: "illegal",
+            };
+        }
+        if (parts.pr !== args.pr) {
+            return {
+                exitCode: EXIT_NOT_READY,
+                message: `verify_l4_owner: review_cycle PR #${parts.pr} does not match --pr ${args.pr} (#3090). ` +
+                    "Ownership evidence must bind to the target PR.",
+                monitorRecord: null,
+                reviewCycle: parsed.value,
+                path: "none",
+            };
+        }
+    }
+    const repo = resolveRepo(args.repo ?? null, projectRoot);
+    if (repo === null) {
+        return {
+            exitCode: EXIT_CONFIG_ERROR,
+            message: "verify_l4_owner: could not resolve owner/repo — pass --repo OWNER/REPO or run inside a git repo with origin",
+            monitorRecord: null,
+            reviewCycle: parsed.value,
+            path: "config",
+        };
+    }
+    const now = args.now ?? new Date();
+    const githubMonitor = fetchActiveMonitorFromGithub(repo, args.pr, {
+        now,
+        headSha: args.headSha ?? null,
+        seams: args.seams,
+    });
+    if (githubMonitor !== null && typeof githubMonitor === "object" && "error" in githubMonitor) {
+        return {
+            exitCode: EXIT_CONFIG_ERROR,
+            message: `verify_l4_owner: ${oneLine(githubMonitor.error)}`,
+            monitorRecord: null,
+            reviewCycle: parsed.value,
+            path: "config",
+        };
+    }
+    if (githubMonitor !== null) {
+        const ref = parsed.value ??
+            `in_progress:${args.pr}#${githubMonitor.monitor_agent_id}`;
+        return {
+            exitCode: EXIT_READY,
+            message: `verify_l4_owner: active GitHub review-owner lease for PR #${args.pr} ` +
+                `(monitor_agent_id=${oneLine(githubMonitor.monitor_agent_id)}, owner=${oneLine(githubMonitor.owner)}) ` +
+                "— review_cycle path=lease (#3090).",
+            monitorRecord: githubMonitor,
+            reviewCycle: ref,
+            path: "lease",
+        };
+    }
+    // parent-retained is process path B — machine gate cannot verify it (lease-or-done only).
+    if (parsed.value?.startsWith("in_progress:")) {
+        const parts = parseInProgressEvidence(parsed.value);
+        if (parts?.ref === "parent-retained") {
+            return {
+                exitCode: EXIT_NOT_READY,
+                message: `verify_l4_owner: parent-retained for PR #${args.pr} is process path B only (#3090). ` +
+                    "Machine gate requires a sticky <!-- deft:review-owner --> lease or --review-cycle done. " +
+                    "Keep parent dual-source poll/fix; do not emit L4 status:pass as terminal.",
+                monitorRecord: null,
+                reviewCycle: parsed.value,
+                path: "none",
+            };
+        }
+        return {
+            exitCode: EXIT_NOT_READY,
+            message: `verify_l4_owner: review_cycle=${oneLine(parsed.value)} claims in_progress but no sticky ` +
+                `<!-- deft:review-owner --> lease found for PR #${args.pr} (#3090 / #2797).\n` +
+                "  Register: deft review-monitor:register --pr <N> --monitor-agent-id <id> --platform-primitive …",
+            monitorRecord: null,
+            reviewCycle: parsed.value,
+            path: "none",
+        };
+    }
+    return {
+        exitCode: EXIT_NOT_READY,
+        message: `verify_l4_owner: silent hold on PR #${args.pr} — no fresh sticky lease and no ` +
+            "review_cycle=done (#3090 Owner Continuity Gate).\n" +
+            "  Same turn MUST end in A (monitor+lease), B (parent-retained + next dual-source action),\n" +
+            "  or C (explicit BLOCKED/FAILED finish). Check-run SUCCESS alone is not CLEAN.",
+        monitorRecord: null,
+        reviewCycle: null,
+        path: "none",
+    };
+}
+export function l4OwnerResultToJson(result) {
+    return {
+        exit_code: result.exitCode,
+        message: result.message,
+        monitor_agent_id: result.monitorRecord?.monitor_agent_id ?? null,
+        monitor_owner: result.monitorRecord?.owner ?? null,
+        monitor_record: result.monitorRecord,
+        path: result.path,
+        ready: result.exitCode === EXIT_READY,
+        review_cycle: result.reviewCycle,
+    };
+}
+//# sourceMappingURL=l4-owner.js.map

package/dist/session/ritual-entrypoint.d.ts

@@ -1,6 +1,10 @@
+import { type AgentHookReadinessResult } from "../verify-env/agent-hook-readiness.js";
 export declare const ENTRYPOINT_TIMEOUT_SECONDS = 300;
 export declare const ENTRYPOINT_TIMEOUT_EXIT_CODE = 124;
 export type RitualEntrypointFn = (argv: readonly string[]) => number;
+export interface DefaultRitualRunnerSeams {
+    readonly evaluateAgentHookReadiness?: (projectRoot: string) => AgentHookReadinessResult;
+}
 /** Run an in-process ritual entrypoint with stdout/stderr capture. */
 export declare function callMain(mainFn: RitualEntrypointFn, argv: readonly string[], _options?: {
     label?: string;
@@ -11,8 +15,8 @@ export declare function callMain(mainFn: RitualEntrypointFn, argv: readonly stri
 };
 /** CLI-shaped cache-fresh entrypoint (mirrors scripts/preflight_cache.py main). */
 export declare function runCacheFreshMain(argv: readonly string[]): number;
-/** Default gated-tier runner: in-process doctor + cache-fresh (mirrors verify_session_ritual.py). */
-export declare function defaultRitualRunner(command: readonly string[], projectRoot: string): {
+/** Default gated-tier runner: in-process hook readiness, doctor, and cache freshness. */
+export declare function defaultRitualRunner(command: readonly string[], projectRoot: string, seams?: DefaultRitualRunnerSeams): {
     code: number;
     stdout: string;
     stderr: string;