@deftai/directive-core 0.95.0 → 0.97.0

package/dist/triage/actions/index.js

@@ -4,6 +4,8 @@ import { cacheGet } from "../../cache/operations.js";
 import { ingestSingleForAccept as ingestSingleForAcceptTs } from "../../intake/issue-ingest.js";
 import { call } from "../../scm/call.js";
 import { ScmStubError } from "../../scm/errors.js";
+import { findLifecycleArtifactsForIssue, findProposedArtifactsForIssue, promoteFromIssue, } from "../../scope/promote-from-issue.js";
+import { promotePath } from "../../scope/promote-path.js";
 import { createCandidatesLog, findByIssue, resolveAuditLogPath, rollbackAuditEntry, } from "./candidates-log.js";
 import { TriageError, UpstreamCloseError } from "./errors.js";
 import { parseResumeOn } from "./resume-on.js";
@@ -62,7 +64,8 @@ function defaultIssueIngest() {
             // Delegate to the native TS intake path (#2350). The legacy Python
             // `scripts/issue_ingest.py` shell-out was orphaned when #1933 removed the
             // Python surface, leaving `triage:accept` raising ModuleNotFoundError.
-            ingestSingleForAcceptTs(issueNumber, repo, { projectRoot });
+            const [, path] = ingestSingleForAcceptTs(issueNumber, repo, { projectRoot });
+            return path;
         },
     };
 }
@@ -207,24 +210,81 @@ function ensureRejectedLabelApplied(deps, issueNumber, repo) {
         writeErr(`triage_actions: reject #${issueNumber} (${repo}) closed successfully but the '${REJECTED_LABEL}' label is missing and auto-create/re-add failed: ${healExc instanceof Error ? healExc.message : String(healExc)}`);
     }
 }
+/**
+ * After a successful accept (or idempotent re-accept), promote proposed → pending (#1136).
+ * Surfaces WIP-cap refusals with the same messaging as scope:promote.
+ */
+function runAutoPromote(issueNumber, repo, projectRoot, decisionId, ingestedPath, force) {
+    // Already pending for this issue → idempotent success (repeat accept --auto-promote).
+    const pending = findLifecycleArtifactsForIssue(projectRoot, issueNumber, {
+        folder: "pending",
+        repo,
+    });
+    if (pending.length >= 1) {
+        return;
+    }
+    let path = typeof ingestedPath === "string" && ingestedPath.length > 0 ? ingestedPath : null;
+    if (path === null) {
+        const matches = findProposedArtifactsForIssue(projectRoot, issueNumber, repo);
+        if (matches.length === 1) {
+            path = matches[0] ?? null;
+        }
+        else if (matches.length > 1) {
+            throw new TriageError(`accept #${issueNumber} (${repo}): --auto-promote found multiple proposed artifacts:\n` +
+                matches.map((p) => `  - ${p}`).join("\n") +
+                `\nPromote one with: task scope:promote -- <path>`);
+        }
+    }
+    if (path === null) {
+        // Fall back to full from-issue resolution (may still fail on missing artifact).
+        const fromIssue = promoteFromIssue({
+            issueNumber,
+            repo,
+            projectRoot,
+            force: force === true,
+        });
+        if (!fromIssue.ok) {
+            throw new TriageError(`accept #${issueNumber} (${repo}): accept recorded but --auto-promote failed: ${fromIssue.message}`);
+        }
+        return;
+    }
+    const result = promotePath(path, {
+        projectRoot,
+        force: force === true,
+        fromIssue: issueNumber,
+        cacheDecisionId: decisionId,
+        cacheStateAtPromote: "accept",
+        requireAudit: true,
+    });
+    if (!result.ok) {
+        throw new TriageError(`accept #${issueNumber} (${repo}): accept recorded but --auto-promote failed: ${result.message}`);
+    }
+}
 /** Record an accept audit entry and delegate vBRIEF authoring to issue_ingest. */
 export function accept(issueNumber, repo, deps, options = {}) {
     const projectRoot = options.projectRoot ?? process.cwd();
     const actor = resolveActor(options.actor);
     const prior = isIdempotentRepeat(deps, issueNumber, repo, "accept", projectRoot);
     if (prior !== null) {
+        if (options.autoPromote === true) {
+            runAutoPromote(issueNumber, repo, projectRoot, prior.decision_id, null, options.force);
+        }
         return prior.decision_id;
     }
     const entry = buildEntry(deps, "accept", issueNumber, repo, actor);
     const logPath = logPathFor(projectRoot);
     const decisionId = deps.candidatesLog.append(entry, { path: logPath });
+    let ingestedPath = null;
     try {
-        deps.issueIngest.ingestSingleForAccept(issueNumber, repo, { projectRoot });
+        ingestedPath = deps.issueIngest.ingestSingleForAccept(issueNumber, repo, { projectRoot });
     }
     catch (exc) {
         rollbackAuditEntry(decisionId, projectRoot, logPath);
         throw new TriageError(`accept #${issueNumber} (${repo}): issue:ingest delegation failed; audit entry rolled back. Cause: ${exc instanceof Error ? exc.message : String(exc)}`);
     }
+    if (options.autoPromote === true) {
+        runAutoPromote(issueNumber, repo, projectRoot, decisionId, typeof ingestedPath === "string" ? ingestedPath : null, options.force);
+    }
     return decisionId;
 }
 /** Close upstream, best-effort label, record reject audit entry. */

package/dist/triage/actions/types.d.ts

@@ -21,9 +21,12 @@ export interface CandidatesLog {
     newDecisionId(): string;
 }
 export interface IssueIngest {
+    /**
+     * Ingest issue into proposed/; return absolute path when known (#1136 auto-promote).
+     */
     ingestSingleForAccept(issueNumber: number, repo: string, options?: {
         projectRoot?: string;
-    }): void;
+    }): string | null | undefined;
 }
 export interface ScmRunner {
     call(source: string, verb: string, args: readonly string[], options?: {
@@ -44,6 +47,10 @@ export interface TriageActionsDeps {
 export interface AcceptOptions {
     actor?: string | null;
     projectRoot?: string;
+    /** After accept+ingest, promote proposed → pending (#1136). */
+    autoPromote?: boolean;
+    /** WIP-cap override for the auto-promote leg. */
+    force?: boolean;
 }
 export interface RejectOptions {
     actor?: string | null;

package/dist/triage/author-filter.d.ts

@@ -0,0 +1,51 @@
+/** Injectable authenticated-login resolver (tests inject; production uses gh). */
+export type ResolveAuthenticatedLogin = () => string | null;
+export interface AuthorFilter {
+    /** Raw CLI value before resolution (e.g. `@me` or `alice,bob`). */
+    readonly raw: string;
+    /** Resolved allow-list logins (exact match; case-sensitive like bulk). */
+    readonly allowLogins: readonly string[];
+    /** True when any token was `@me` / `--author-mine`. */
+    readonly usedMe: boolean;
+    /** Header/digest display string. */
+    readonly display: string;
+}
+export interface AuthorFilterResolveResult {
+    readonly filter?: AuthorFilter;
+    readonly error?: string;
+}
+export interface AuthorPartitionResult<T> {
+    readonly matched: readonly T[];
+    readonly unknownCount: number;
+    readonly nonMatchingCount: number;
+}
+/** Split comma allow-list; trim; drop empties. */
+export declare function parseAuthorTokens(raw: string): string[];
+/**
+ * Resolve `@me` (and bare tokens) into an AuthorFilter.
+ * Returns error when raw is empty/whitespace-only or `@me` cannot be resolved.
+ */
+export declare function resolveAuthorFilter(raw: string, resolveMe?: ResolveAuthenticatedLogin | null): AuthorFilterResolveResult;
+/**
+ * Default `@me` resolution via live `gh` (not ghx — multi-arg api --jq; #2275 / #954).
+ */
+export declare function defaultResolveAuthenticatedLogin(): string | null;
+/** Login from a CachedIssue.author string (empty = unknown). */
+export declare function normalizeAuthorLogin(login: string | null | undefined): string | null;
+/**
+ * Login from a raw cache payload (author.login / user.login / string author).
+ * Empty / missing → null (unknown).
+ */
+export declare function authorLoginFromRawIssue(issue: Record<string, unknown> | null | undefined): string | null;
+/** Exact allow-list match (bulk parity). Unknown/missing never matches. */
+export declare function matchesAuthorFilter(login: string | null | undefined, filter: AuthorFilter): boolean;
+/**
+ * Partition items by author filter. Unknown (missing login) counted separately
+ * and excluded from matched — callers disclose unknownCount in headers.
+ */
+export declare function partitionByAuthorFilter<T>(items: readonly T[], getLogin: (item: T) => string | null | undefined, filter: AuthorFilter): AuthorPartitionResult<T>;
+/** Single-line header fragment for queue / classify digest. */
+export declare function formatAuthorFilterLine(filter: AuthorFilter, options?: {
+    readonly unknownCount?: number;
+}): string;
+//# sourceMappingURL=author-filter.d.ts.map

package/dist/triage/author-filter.js

@@ -0,0 +1,152 @@
+/**
+ * Shared `--author` filter for triage:queue and triage:classify (#3129 / #1318 Layer 1).
+ *
+ * Matches existing bulk/bootstrap semantics: exact login match on cached author.login
+ * (or user.login). `@me` resolves via authenticated `gh api user --jq .login`.
+ * Comma allow-lists are accepted. Missing author on cache rows is "unknown" — not a match,
+ * and callers should disclose the unknown count rather than silent-drop.
+ */
+import { spawnSync } from "node:child_process";
+import { extractAuthor } from "./scope-drift/cache-walker.js";
+/** Split comma allow-list; trim; drop empties. */
+export function parseAuthorTokens(raw) {
+    return raw
+        .split(",")
+        .map((t) => t.trim())
+        .filter((t) => t.length > 0);
+}
+/**
+ * Resolve `@me` (and bare tokens) into an AuthorFilter.
+ * Returns error when raw is empty/whitespace-only or `@me` cannot be resolved.
+ */
+export function resolveAuthorFilter(raw, resolveMe) {
+    const resolveAuthenticated = resolveMe ?? defaultResolveAuthenticatedLogin;
+    const tokens = parseAuthorTokens(raw);
+    if (tokens.length === 0) {
+        return { error: "argument --author: expected a non-empty login (or @me)" };
+    }
+    let usedMe = false;
+    let meLogin;
+    const allow = [];
+    const displayParts = [];
+    for (const token of tokens) {
+        if (token === "@me" || token.toLowerCase() === "@me") {
+            usedMe = true;
+            if (meLogin === undefined) {
+                meLogin = resolveAuthenticated();
+            }
+            if (meLogin === null || meLogin.length === 0) {
+                return {
+                    error: "argument --author: @me could not be resolved (gh api user --jq .login failed; authenticate gh or pass an explicit login)",
+                };
+            }
+            allow.push(meLogin);
+            displayParts.push(`@me (resolved -> ${meLogin})`);
+        }
+        else {
+            allow.push(token);
+            displayParts.push(token);
+        }
+    }
+    // Dedup while preserving order
+    const seen = new Set();
+    const allowLogins = [];
+    for (const login of allow) {
+        if (!seen.has(login)) {
+            seen.add(login);
+            allowLogins.push(login);
+        }
+    }
+    return {
+        filter: {
+            raw,
+            allowLogins,
+            usedMe,
+            display: displayParts.join(", "),
+        },
+    };
+}
+/**
+ * Default `@me` resolution via live `gh` (not ghx — multi-arg api --jq; #2275 / #954).
+ */
+export function defaultResolveAuthenticatedLogin() {
+    try {
+        const result = spawnSync("gh", ["api", "user", "--jq", ".login"], {
+            encoding: "utf8",
+            env: process.env,
+            windowsHide: true,
+        });
+        if (result.status !== 0) {
+            return null;
+        }
+        const text = String(result.stdout ?? "").trim();
+        if (text.length === 0) {
+            return null;
+        }
+        // jq may emit a JSON string with quotes; strip surrounding quotes when present
+        if ((text.startsWith('"') && text.endsWith('"')) ||
+            (text.startsWith("'") && text.endsWith("'"))) {
+            return text.slice(1, -1);
+        }
+        return text;
+    }
+    catch {
+        return null;
+    }
+}
+/** Login from a CachedIssue.author string (empty = unknown). */
+export function normalizeAuthorLogin(login) {
+    if (login === null || login === undefined) {
+        return null;
+    }
+    const trimmed = login.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+/**
+ * Login from a raw cache payload (author.login / user.login / string author).
+ * Empty / missing → null (unknown).
+ */
+export function authorLoginFromRawIssue(issue) {
+    if (issue === null || issue === undefined) {
+        return null;
+    }
+    return normalizeAuthorLogin(extractAuthor(issue));
+}
+/** Exact allow-list match (bulk parity). Unknown/missing never matches. */
+export function matchesAuthorFilter(login, filter) {
+    const normalized = normalizeAuthorLogin(login);
+    if (normalized === null) {
+        return false;
+    }
+    return filter.allowLogins.includes(normalized);
+}
+/**
+ * Partition items by author filter. Unknown (missing login) counted separately
+ * and excluded from matched — callers disclose unknownCount in headers.
+ */
+export function partitionByAuthorFilter(items, getLogin, filter) {
+    const matched = [];
+    let unknownCount = 0;
+    let nonMatchingCount = 0;
+    for (const item of items) {
+        const login = normalizeAuthorLogin(getLogin(item));
+        if (login === null) {
+            unknownCount += 1;
+            continue;
+        }
+        if (filter.allowLogins.includes(login)) {
+            matched.push(item);
+        }
+        else {
+            nonMatchingCount += 1;
+        }
+    }
+    return { matched, unknownCount, nonMatchingCount };
+}
+/** Single-line header fragment for queue / classify digest. */
+export function formatAuthorFilterLine(filter, options = {}) {
+    const unknown = options.unknownCount ?? 0;
+    const unknownPart = unknown > 0 ? `; ${unknown} cached issue(s) missing author (unknown — excluded)` : "";
+    return `author filter: ${filter.display}${unknownPart}`;
+}
+//# sourceMappingURL=author-filter.js.map

package/dist/triage/bootstrap/gitignore.d.ts

@@ -8,7 +8,7 @@ export declare function gitignoreTriageCacheEntries(projectRoot: string): readon
 export declare function gitattributesTriageCacheGlob(projectRoot: string): string;
 export declare const GITATTRIBUTES_EVAL_RULE = "vbrief/.triage-cache/*.jsonl  merge=union";
 export declare const FORBIDDEN_BLANKET_EVAL_LINES: readonly string[];
-export declare const EVAL_README_BODY = "# `vbrief/.triage-cache/` \u2014 triage working-set files\n\nThis directory holds JSON-lines logs and scratch files that Deft triage and\nslicing workflows emit. Deft configures your repo's `.gitignore` and\n`.gitattributes` so some files stay local while team-shared records can be\ncommitted.\n\n## What lives here\n\n| File | Committed? | Notes |\n| --- | --- | --- |\n| `slices.jsonl` | Yes | Team-shared cohort records from slicing skills. New teammates use prior cohort outputs to spot orphans and avoid re-slicing the same scope. |\n| `candidates.jsonl` | No | Your local triage accept / defer / reject stream. Re-create on a fresh clone with `deft triage:bootstrap`. |\n| `summary-history.jsonl` | No | Local history of `deft triage:summary` output; not required for day-to-day work. |\n| `scope-lifecycle.jsonl` | No | Local audit trail for scope demotions (`deft scope:demote`). Each operator's stream stays on their machine. |\n| `decompositions/` | No | Draft story-decomposition scratch. Produced child story xBRIEFs live in lifecycle folders via `deft scope:decompose`. |\n| `doctor-state.json` | No | Per-clone throttle state for `deft doctor` re-probe timing. |\n\nPaths listed as \"No\" above are added to `.gitignore` during bootstrap; anything\nnot listed remains committable by default. The selective ignore entries live in\nthe repo-root `.gitignore` (`vbrief/.triage-cache/candidates.jsonl`,\n`vbrief/.triage-cache/summary-history.jsonl`, `vbrief/.triage-cache/scope-lifecycle.jsonl`,\n`vbrief/.triage-cache/decompositions/`, and `vbrief/.triage-cache/doctor-state.json`).\n\n## Fresh clone\n\nIf `candidates.jsonl` is missing, run:\n\n```\ndeft triage:bootstrap\n```\n\nBootstrap rebuilds the local candidates log without altering committed\n`slices.jsonl`.\n\n## Merge behavior for `*.jsonl`\n\nThe repo-root `.gitattributes` may declare:\n\n```\nvbrief/.triage-cache/*.jsonl  merge=union\n```\n\nThe `union` merge driver concatenates both sides' appended lines on auto-merge,\nso parallel append-only edits to the same JSON-lines file rebase without manual\nconflict surgery. It does not dedupe semantically similar records \u2014 downstream\nreaders should tolerate duplicate-looking entries.\n\n## See also\n\n- `.gitignore` \u2014 selective ignore rules for operator-private files\n- `.gitattributes` \u2014 merge driver for committed JSON-lines logs\n";
+export declare const EVAL_README_BODY = "# `vbrief/.triage-cache/` \u2014 triage working-set files\n\nThis directory holds JSON-lines logs and scratch files that Deft triage and\nslicing workflows emit. Deft configures your repo's `.gitignore` and\n`.gitattributes` so some files stay local while team-shared records can be\ncommitted.\n\n## What lives here\n\n| File | Committed? | Notes |\n| --- | --- | --- |\n| `slices.jsonl` | Yes | Team-shared cohort records from slicing skills. New teammates use prior cohort outputs to spot orphans and avoid re-slicing the same scope. |\n| `candidates.jsonl` | No | Your local triage accept / defer / reject stream. Re-create on a fresh clone with `deft triage:bootstrap`. |\n| `summary-history.jsonl` | No | Local history of `deft triage:summary` output; not required for day-to-day work. |\n| `scope-lifecycle.jsonl` | No | Local audit trail for scope demotions (`deft scope:demote`). Each operator's stream stays on their machine. |\n| `decompositions/` | No | Draft story-decomposition scratch. Produced child story xBRIEFs live in lifecycle folders via `deft scope:decompose`. |\n| `doctor-state.json` | No | Per-clone throttle state for `deft doctor` re-probe timing. |\n| `staleness-tickler-state.json` | No | Per-clone upgrade-tickler throttle state. |\n| `release-availability-state.json` | No | Per-clone release-availability probe throttle state. |\n\nPaths listed as \"No\" above are added to `.gitignore` during bootstrap; anything\nnot listed remains committable by default. The selective ignore entries live in\nthe repo-root `.gitignore` (`vbrief/.triage-cache/candidates.jsonl`,\n`vbrief/.triage-cache/summary-history.jsonl`, `vbrief/.triage-cache/scope-lifecycle.jsonl`,\n`vbrief/.triage-cache/decompositions/`, `vbrief/.triage-cache/doctor-state.json`,\n`vbrief/.triage-cache/staleness-tickler-state.json`, and\n`vbrief/.triage-cache/release-availability-state.json`).\n\n## Fresh clone\n\nIf `candidates.jsonl` is missing, run:\n\n```\ndeft triage:bootstrap\n```\n\nBootstrap rebuilds the local candidates log without altering committed\n`slices.jsonl`.\n\n## Merge behavior for `*.jsonl`\n\nThe repo-root `.gitattributes` may declare:\n\n```\nvbrief/.triage-cache/*.jsonl  merge=union\n```\n\nThe `union` merge driver concatenates both sides' appended lines on auto-merge,\nso parallel append-only edits to the same JSON-lines file rebase without manual\nconflict surgery. It does not dedupe semantically similar records \u2014 downstream\nreaders should tolerate duplicate-looking entries.\n\n## See also\n\n- `.gitignore` \u2014 selective ignore rules for operator-private files\n- `.gitattributes` \u2014 merge driver for committed JSON-lines logs\n";
 /** Layout-aware triage-cache README body for the active lifecycle tree (#2344 / #2349). */
 export declare function generateTriageCacheReadmeBody(projectRoot: string): string;
 /** Strip an inline `# ...` comment from a gitignore line. */

package/dist/triage/bootstrap/gitignore.js

@@ -20,6 +20,9 @@ export const GITIGNORE_EVAL_ENTRIES = [
     "xbrief/.triage-cache/scope-lifecycle.jsonl",
     "xbrief/.triage-cache/decompositions/",
     "xbrief/.triage-cache/doctor-state.json",
+    // Per-clone session state (#3146); selective only — hybrid policy preserved.
+    "xbrief/.triage-cache/staleness-tickler-state.json",
+    "xbrief/.triage-cache/release-availability-state.json",
 ];
 /** Layout-aware gitignore lines for triage working-set files (#1703). */
 export function gitignoreTriageCacheEntries(projectRoot) {
@@ -30,6 +33,9 @@ export function gitignoreTriageCacheEntries(projectRoot) {
         triageCacheRelPath(projectRoot, "scope-lifecycle.jsonl"),
         decomp.endsWith("/") ? decomp : `${decomp}/`,
         triageCacheRelPath(projectRoot, "doctor-state.json"),
+        // Per-clone session state (#3146); selective only — hybrid policy preserved.
+        triageCacheRelPath(projectRoot, "staleness-tickler-state.json"),
+        triageCacheRelPath(projectRoot, "release-availability-state.json"),
     ];
 }
 export function gitattributesTriageCacheGlob(projectRoot) {
@@ -76,6 +82,10 @@ const EVAL_ENTRIES_RATIONALE = "\n# vbrief/.triage-cache/ tracking governance (#
     "#                               throttle state gating the 24h/4h\n" +
     "#                               re-probe window; #1308 / #1464). Local\n" +
     "#                               to each clone; never committed.\n" +
+    "#   - staleness-tickler-state.json -> gitignored (per-clone upgrade\n" +
+    "#                               tickler throttle; #2488 / #3146).\n" +
+    "#   - release-availability-state.json -> gitignored (per-clone npm\n" +
+    "#                               release-availability throttle; #1692 / #3146).\n" +
     "#   - slices.jsonl           -> TRACKED (team-shared cohort records\n" +
     "#                               produced by slicing skills; see\n" +
     "#                               #1132 / D13).\n" +
@@ -104,12 +114,16 @@ committed.
 | \`scope-lifecycle.jsonl\` | No | Local audit trail for scope demotions (\`deft scope:demote\`). Each operator's stream stays on their machine. |
 | \`decompositions/\` | No | Draft story-decomposition scratch. Produced child story xBRIEFs live in lifecycle folders via \`deft scope:decompose\`. |
 | \`doctor-state.json\` | No | Per-clone throttle state for \`deft doctor\` re-probe timing. |
+| \`staleness-tickler-state.json\` | No | Per-clone upgrade-tickler throttle state. |
+| \`release-availability-state.json\` | No | Per-clone release-availability probe throttle state. |
 
 Paths listed as "No" above are added to \`.gitignore\` during bootstrap; anything
 not listed remains committable by default. The selective ignore entries live in
 the repo-root \`.gitignore\` (\`vbrief/.triage-cache/candidates.jsonl\`,
 \`vbrief/.triage-cache/summary-history.jsonl\`, \`vbrief/.triage-cache/scope-lifecycle.jsonl\`,
-\`vbrief/.triage-cache/decompositions/\`, and \`vbrief/.triage-cache/doctor-state.json\`).
+\`vbrief/.triage-cache/decompositions/\`, \`vbrief/.triage-cache/doctor-state.json\`,
+\`vbrief/.triage-cache/staleness-tickler-state.json\`, and
+\`vbrief/.triage-cache/release-availability-state.json\`).
 
 ## Fresh clone
 

package/dist/triage/classify/index.d.ts

@@ -85,8 +85,8 @@ export declare function validateProject(projectRoot: string): {
 };
 /** Render --list output for a project root. */
 export declare function listProject(projectRoot: string): string;
-import { type ClassifyAction, DEFAULT_IDEMPOTENCY_LABEL, defaultLabelMirrorPolicy, desiredLabelsForClassification, type LabelMirrorEngine, type LabelMirrorItem, type LabelMirrorOptions as LabelMirrorOptionsCore, type LabelMirrorOutcome, type LabelMirrorPolicy, type LabelMirrorStatus, labelMirrorOutcomeToJson, type ResolvedLabelMirrorPolicy, renderLabelMirrorReport, resolveLabelMirrorPolicy, validateLabelMirrorPolicy, validateTriageLabelMirrorOnPlan as validateTriageLabelMirrorOnPlanFromModule } from "./label-mirror.js";
-export { type ClassifyAction, DEFAULT_IDEMPOTENCY_LABEL, defaultLabelMirrorPolicy, desiredLabelsForClassification, type LabelMirrorEngine, type LabelMirrorItem, type LabelMirrorOutcome, type LabelMirrorPolicy, type LabelMirrorStatus, labelMirrorOutcomeToJson, type ResolvedLabelMirrorPolicy, renderLabelMirrorReport, resolveLabelMirrorPolicy, validateLabelMirrorPolicy, validateTriageLabelMirrorOnPlanFromModule as validateTriageLabelMirrorOnPlan, };
+import { buildLabelMirrorDigest, type ClassifyAction, DEFAULT_APPLY_BATCH_SIZE, DEFAULT_APPLY_DELAY_MS, DEFAULT_DIGEST_SAMPLE_LIMIT, DEFAULT_IDEMPOTENCY_LABEL, defaultLabelMirrorPolicy, desiredLabelsForClassification, type LabelMirrorDigest, type LabelMirrorEngine, type LabelMirrorFilters, type LabelMirrorItem, type LabelMirrorOptions as LabelMirrorOptionsCore, type LabelMirrorOutcome, type LabelMirrorPolicy, type LabelMirrorSleepFn, type LabelMirrorStatus, labelMirrorOutcomeToJson, type ResolvedLabelMirrorPolicy, renderLabelMirrorReport, resolveLabelMirrorPolicy, validateLabelMirrorPolicy, validateTriageLabelMirrorOnPlan as validateTriageLabelMirrorOnPlanFromModule } from "./label-mirror.js";
+export { buildLabelMirrorDigest, type ClassifyAction, DEFAULT_APPLY_BATCH_SIZE, DEFAULT_APPLY_DELAY_MS, DEFAULT_DIGEST_SAMPLE_LIMIT, DEFAULT_IDEMPOTENCY_LABEL, defaultLabelMirrorPolicy, desiredLabelsForClassification, type LabelMirrorDigest, type LabelMirrorEngine, type LabelMirrorFilters, type LabelMirrorItem, type LabelMirrorOutcome, type LabelMirrorPolicy, type LabelMirrorSleepFn, type LabelMirrorStatus, labelMirrorOutcomeToJson, type ResolvedLabelMirrorPolicy, renderLabelMirrorReport, resolveLabelMirrorPolicy, validateLabelMirrorPolicy, validateTriageLabelMirrorOnPlanFromModule as validateTriageLabelMirrorOnPlan, };
 /** Public options: engine is optional (defaults to this module's classify API). */
 export type LabelMirrorOptions = Omit<LabelMirrorOptionsCore, "engine"> & {
     readonly engine?: LabelMirrorEngine;

package/dist/triage/classify/index.js

@@ -751,8 +751,8 @@ export function listProject(projectRoot) {
 // label-mirror.ts does not import this module (avoids ESM/SLizard cycle).
 // Public mirrorLabels injects the classify engine into the pure implementation.
 // ---------------------------------------------------------------------------
-import { DEFAULT_IDEMPOTENCY_LABEL, defaultLabelMirrorPolicy, desiredLabelsForClassification, labelMirrorOutcomeToJson, mirrorLabels as mirrorLabelsCore, renderLabelMirrorReport, resolveLabelMirrorPolicy, validateLabelMirrorPolicy, validateTriageLabelMirrorOnPlan as validateTriageLabelMirrorOnPlanFromModule, } from "./label-mirror.js";
-export { DEFAULT_IDEMPOTENCY_LABEL, defaultLabelMirrorPolicy, desiredLabelsForClassification, labelMirrorOutcomeToJson, renderLabelMirrorReport, resolveLabelMirrorPolicy, validateLabelMirrorPolicy, validateTriageLabelMirrorOnPlanFromModule as validateTriageLabelMirrorOnPlan, };
+import { buildLabelMirrorDigest, DEFAULT_APPLY_BATCH_SIZE, DEFAULT_APPLY_DELAY_MS, DEFAULT_DIGEST_SAMPLE_LIMIT, DEFAULT_IDEMPOTENCY_LABEL, defaultLabelMirrorPolicy, desiredLabelsForClassification, labelMirrorOutcomeToJson, mirrorLabels as mirrorLabelsCore, renderLabelMirrorReport, resolveLabelMirrorPolicy, validateLabelMirrorPolicy, validateTriageLabelMirrorOnPlan as validateTriageLabelMirrorOnPlanFromModule, } from "./label-mirror.js";
+export { buildLabelMirrorDigest, DEFAULT_APPLY_BATCH_SIZE, DEFAULT_APPLY_DELAY_MS, DEFAULT_DIGEST_SAMPLE_LIMIT, DEFAULT_IDEMPOTENCY_LABEL, defaultLabelMirrorPolicy, desiredLabelsForClassification, labelMirrorOutcomeToJson, renderLabelMirrorReport, resolveLabelMirrorPolicy, validateLabelMirrorPolicy, validateTriageLabelMirrorOnPlanFromModule as validateTriageLabelMirrorOnPlan, };
 function defaultLabelMirrorEngine() {
     return {
         classifyIssue: (issue, options) => classifyIssue(issue, {

package/dist/triage/classify/label-mirror.d.ts

@@ -1,17 +1,28 @@
 /**
- * Tier-1 deterministic SCM label mirror (#1423 Wave 1).
+ * Tier-1 deterministic SCM label mirror (#1423 Wave 1 + Wave 2 bootstrap).
  *
  * Classifies cached issues with the existing #1129 engine, then mirrors the
  * outcome as SCM labels (dry-run default, --apply to write). Never accepts into
  * the xBRIEF lifecycle and never writes proposed/ scopes.
  *
+ * Wave 2 (#3125): open-only default, operator digest (totals + by state/rule/action
+ * + samples), batched rate-limit-aware apply. Bootstrap mass-triage entrypoint is
+ * `triage:classify -- --mirror` with these filters (not triage:accept).
+ *
  * Intentionally does NOT import from ./index.js (SLizard P1 cycle). The classify
  * engine is injected via LabelMirrorEngine / mirrorLabels() wrapper in index.ts.
  */
 import type { LabelClient } from "../../vbrief-reconcile/types.js";
+import { type AuthorFilter } from "../author-filter.js";
 export declare const DEFAULT_IDEMPOTENCY_LABEL = "triaged";
 export declare const CACHE_DIR_NAME = ".deft-cache";
 export declare const CACHE_SOURCE = "github-issue";
+/** Default apply batch size for rate-limit awareness (#3125). */
+export declare const DEFAULT_APPLY_BATCH_SIZE = 10;
+/** Default delay between apply batches in ms (#3125). */
+export declare const DEFAULT_APPLY_DELAY_MS = 1000;
+/** Default sample count in human digest (#3125). */
+export declare const DEFAULT_DIGEST_SAMPLE_LIMIT = 15;
 export type ClassifyAction = "defer" | "archive" | "escalate" | "accept";
 /** Minimal issue shape used by the mirror (matches classify GitHubIssue). */
 export interface MirrorGitHubIssue {
@@ -73,10 +84,12 @@ export interface ResolvedLabelMirrorPolicy {
     readonly alwaysLabels: readonly string[];
     readonly actionLabels: Readonly<Partial<Record<ClassifyAction, readonly string[]>>>;
 }
-export type LabelMirrorStatus = "planned" | "applied" | "unchanged" | "skipped_already_triaged" | "skipped_no_match" | "skipped_unreadable" | "skipped_disabled" | "error";
+export type LabelMirrorStatus = "planned" | "applied" | "unchanged" | "skipped_already_triaged" | "skipped_no_match" | "skipped_unreadable" | "skipped_closed" | "skipped_author" | "skipped_disabled" | "error";
 export interface LabelMirrorItem {
     readonly repo: string;
     readonly issue_number: number;
+    /** Issue state from cache (open/closed/unknown). */
+    readonly state: string | null;
     readonly action: string | null;
     readonly reason: string | null;
     readonly ruleKind: string | null;
@@ -86,6 +99,24 @@ export interface LabelMirrorItem {
     readonly status: LabelMirrorStatus;
     readonly message?: string;
 }
+/** Operator digest aggregates for bootstrap mass-triage (#3125 / #1423 Wave 2). */
+export interface LabelMirrorDigest {
+    readonly by_state: Readonly<Record<string, number>>;
+    readonly by_rule: Readonly<Record<string, number>>;
+    readonly by_action: Readonly<Record<string, number>>;
+    readonly samples: readonly LabelMirrorItem[];
+    readonly sample_limit: number;
+    readonly sample_truncated: boolean;
+}
+export interface LabelMirrorFilters {
+    /** When false (default), closed issues are skipped before classify. */
+    readonly include_closed: boolean;
+    readonly repo: string | null;
+    /** Active author allow-list display (#3129); null when no author filter. */
+    readonly author: string | null;
+    /** Resolved author logins for machine consumers. */
+    readonly author_logins: readonly string[] | null;
+}
 export interface LabelMirrorOutcome {
     readonly project_root: string;
     readonly dry_run: boolean;
@@ -96,10 +127,20 @@ export interface LabelMirrorOutcome {
     readonly skipped_already_triaged: number;
     readonly skipped_no_match: number;
     readonly skipped_unreadable: number;
+    /** Closed issues skipped by open-only default (#3125). */
+    readonly skipped_closed: number;
+    /** Issues skipped by --author filter (#3129). */
+    readonly skipped_author: number;
     readonly errors: number;
+    readonly filters: LabelMirrorFilters;
+    readonly digest: LabelMirrorDigest;
     readonly items: readonly LabelMirrorItem[];
     readonly policy: ResolvedLabelMirrorPolicy;
+    /** Apply path: successful writes in this run (same as applied). */
+    readonly batch_size?: number;
+    readonly delay_ms?: number;
 }
+export type LabelMirrorSleepFn = (ms: number) => void;
 export interface LabelMirrorOptions {
     readonly dryRun?: boolean;
     readonly repo?: string | null;
@@ -110,6 +151,24 @@ export interface LabelMirrorOptions {
     /** Prefer live SCM labels when true (default: !dryRun). Cache labels used for dry-run. */
     readonly useLiveLabels?: boolean;
     readonly now?: Date;
+    /**
+     * Include closed issues in classify+mirror. Default false (open-only) for safe
+     * bootstrap mass-triage (#3125). Opt in with CLI `--include-closed`.
+     */
+    readonly includeClosed?: boolean;
+    /**
+     * Resolved author filter applied before plan/apply walk (#3129).
+     * Composes with open-only (AND). CLI resolves `@me` before passing this.
+     */
+    readonly authorFilter?: AuthorFilter | null;
+    /** Max planned/applied samples in human digest (default 15). */
+    readonly sampleLimit?: number;
+    /** SCM writes per batch before delay (default 10; apply path only). */
+    readonly batchSize?: number;
+    /** Delay in ms between apply batches (default 1000; apply path only). */
+    readonly delayMs?: number;
+    /** Injectable sleep for tests (receives ms). Default busy-wait when delayMs > 0. */
+    readonly sleepMs?: LabelMirrorSleepFn;
     /** Required: classify engine (provided by classify/index mirrorLabels wrapper). */
     readonly engine: LabelMirrorEngine;
 }
@@ -128,15 +187,19 @@ export declare function resolveLabelMirrorPolicy(options?: {
 }): ResolvedLabelMirrorPolicy;
 /** Labels to apply for a classified action (always + action-mapped). */
 export declare function desiredLabelsForClassification(action: string, policy: ResolvedLabelMirrorPolicy): string[];
+/** Build digest aggregates + samples from mirror items (#3125). */
+export declare function buildLabelMirrorDigest(items: readonly LabelMirrorItem[], sampleLimit?: number): LabelMirrorDigest;
 /**
- * Run Tier-1 label mirror over the github-issue cache.
+ * Run Tier-1 label mirror over the github-issue cache (bootstrap mass-triage surface).
  * Dry-run by default (no SCM writes). Pass dryRun: false to apply.
+ * Default state filter is open-only (#3125); pass includeClosed: true for archive stamps.
  * Requires options.engine (classify/index wrapper injects it).
+ * Never calls triage:accept / never writes proposed/ xBRIEFs.
  */
 export declare function mirrorLabels(projectRoot: string, options: LabelMirrorOptions): [number, LabelMirrorOutcome];
-/** Human-readable digest for dry-run / apply reports. */
+/** Human-readable digest for dry-run / apply reports (bootstrap mass-triage UX). */
 export declare function renderLabelMirrorReport(outcome: LabelMirrorOutcome): string;
-/** JSON-serializable outcome (stable key order not required). */
+/** JSON-serializable outcome including Wave 2 digest aggregates. */
 export declare function labelMirrorOutcomeToJson(outcome: LabelMirrorOutcome): Record<string, unknown>;
 /** Validate triageLabelMirror on a plan object (vbrief_validate hook). */
 export declare function validateTriageLabelMirrorOnPlan(plan: unknown, filepath: string): string[];