@deftai/directive-core 0.95.0 → 0.97.0

package/dist/cache/main.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { latestDecisions, readAuditLog } from "../triage/actions/candidates-log.js";
+import { resolveCandidatesLogPath } from "../triage/cache-path.js";
+import { archiveClosedEntries, DEFAULT_ARCHIVE_OLDER_THAN_DAYS, listArchivedEntries, restoreFromArchive, } from "./archive.js";
 import { ALLOWED_SOURCES, DEFAULT_BATCH_SIZE, DEFAULT_DELAY_MS, DEFAULT_PRUNE_OLDER_THAN_DAYS, } from "./constants.js";
 import { CacheCapBreachedError, CacheError, CacheFetchError, CacheNotFoundError, CacheValidationError, } from "./errors.js";
 import { cacheFetchAll, cacheRefreshClosed } from "./fetch.js";
@@ -8,7 +11,7 @@ import { cacheGet, cacheInvalidate, cachePrune, cachePruneToCap, cachePut } from
 import { resolveCaps } from "./quota.js";
 import { clearTaskCache } from "./task-cache/store.js";
 function usage() {
-    process.stderr.write("usage: cache [-h] {put,get,invalidate,fetch-all,prune,clear} ...\n");
+    process.stderr.write("usage: cache [-h] {put,get,invalidate,fetch-all,prune,clear,archive-closed,archive-list,restore-from-archive} ...\n");
 }
 function normaliseLabelFilter(raw) {
     if (!raw || raw.length === 0)
@@ -309,6 +312,293 @@ function cmdPrune(args) {
     process.stdout.write(`${pythonJsonPretty(payload)}\n`);
     return 0;
 }
+/**
+ * Reversible closed-entry archive (#1137). Operator-only; not TTL prune.
+ * Distinct from `cache prune` (hard-delete by expires_at).
+ */
+function cmdArchiveClosed(args) {
+    let olderThanDays = DEFAULT_ARCHIVE_OLDER_THAN_DAYS;
+    let source = "github-issue";
+    let repo;
+    let dryRun = false;
+    let json = false;
+    let terminalDecisionOnly = false;
+    let projectRoot;
+    let cacheRoot;
+    let reason;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--older-than-days") {
+            olderThanDays = Number.parseInt(args[i + 1] ?? "", 10);
+            i += 1;
+        }
+        else if (arg === "--source") {
+            source = args[i + 1] ?? "github-issue";
+            i += 1;
+        }
+        else if (arg === "--repo") {
+            repo = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--dry-run") {
+            dryRun = true;
+        }
+        else if (arg === "--json") {
+            json = true;
+        }
+        else if (arg === "--terminal-decision-only") {
+            terminalDecisionOnly = true;
+        }
+        else if (arg === "--project-root") {
+            projectRoot = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--cache-root") {
+            cacheRoot = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--reason") {
+            reason = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "-h" || arg === "--help") {
+            process.stdout.write("usage: cache archive-closed [--dry-run] [--older-than-days 30] [--repo OWNER/NAME]\n" +
+                "       [--source github-issue] [--json] [--terminal-decision-only]\n" +
+                "       [--project-root PATH] [--cache-root PATH] [--reason TEXT]\n" +
+                "\n" +
+                "Reversible archive of closed github-issue cache entries (not TTL cache:prune).\n" +
+                "Skips issues still referenced by xbrief/{proposed,pending,active}.\n" +
+                "Also available as: task triage:cache-archive\n");
+            return 0;
+        }
+        else {
+            throw new CacheError(`unexpected argument: ${arg}`);
+        }
+    }
+    const resolvedProjectRoot = projectRoot ?? process.cwd();
+    const resolvedCacheRoot = cacheRoot ?? (projectRoot !== undefined ? resolve(projectRoot, ".deft-cache") : undefined);
+    let latestDecisionMap = null;
+    if (terminalDecisionOnly) {
+        try {
+            const logPath = resolveCandidatesLogPath(resolvedProjectRoot);
+            latestDecisionMap = latestDecisions(readAuditLog(logPath, repo ?? null));
+        }
+        catch {
+            latestDecisionMap = new Map();
+        }
+    }
+    const result = archiveClosedEntries({
+        olderThanDays,
+        source,
+        repo: repo ?? null,
+        dryRun,
+        terminalDecisionOnly,
+        latestDecisions: latestDecisionMap,
+        projectRoot: resolvedProjectRoot,
+        cacheRoot: resolvedCacheRoot,
+        reason,
+    });
+    const payload = {
+        mode: "archive-closed",
+        note: "Reversible closed-entry archive; distinct from cache:prune (TTL hard-delete).",
+        dry_run: result.dryRun,
+        older_than_days: result.olderThanDays,
+        source: result.source,
+        repo: result.repo,
+        terminal_decision_only: terminalDecisionOnly,
+        archived_count: result.archivedCount,
+        skipped_count: result.skippedCount,
+        archived: result.archived.map((c) => ({
+            key: c.key,
+            live_dir: c.liveDir,
+            archive_dir: c.archiveDir,
+            age_basis: c.ageBasis,
+            closed_at: c.closedAt,
+            pre_archive_decision: c.preArchiveDecision,
+        })),
+        skipped: result.skipped.map((s) => ({
+            key: s.key,
+            reason: s.reason,
+            detail: s.detail ?? null,
+        })),
+    };
+    if (json) {
+        process.stdout.write(`${pythonJsonPretty(payload)}\n`);
+    }
+    else {
+        process.stdout.write(`cache:archive-closed dry_run=${pythonBool(result.dryRun)} archived=${result.archivedCount} skipped=${result.skippedCount} older_than_days=${result.olderThanDays}\n`);
+        for (const c of result.archived) {
+            process.stdout.write(`  archived ${c.key} -> ${c.archiveDir}\n`);
+        }
+        for (const s of result.skipped) {
+            process.stdout.write(`  skipped ${s.key} (${s.reason}${s.detail ? `: ${s.detail}` : ""})\n`);
+        }
+    }
+    return 0;
+}
+function cmdArchiveList(args) {
+    let source = "github-issue";
+    let repo;
+    let since;
+    let limit;
+    let format = "text";
+    let cacheRoot;
+    let projectRoot;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--source") {
+            source = args[i + 1] ?? "github-issue";
+            i += 1;
+        }
+        else if (arg === "--repo") {
+            repo = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--since") {
+            since = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--limit") {
+            limit = Number.parseInt(args[i + 1] ?? "", 10);
+            i += 1;
+        }
+        else if (arg === "--format") {
+            format = args[i + 1] ?? "text";
+            i += 1;
+        }
+        else if (arg === "--format=json" || arg === "--json") {
+            format = "json";
+        }
+        else if (arg?.startsWith("--format=")) {
+            format = arg.slice("--format=".length);
+        }
+        else if (arg === "--cache-root") {
+            cacheRoot = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--project-root") {
+            projectRoot = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "-h" || arg === "--help") {
+            process.stdout.write("usage: cache archive-list [--repo OWNER/NAME] [--since ISO] [--limit N]\n" +
+                "       [--format=json|text] [--source github-issue] [--cache-root PATH]\n" +
+                "Also available as: task triage:archive-list\n");
+            return 0;
+        }
+        else {
+            throw new CacheError(`unexpected argument: ${arg}`);
+        }
+    }
+    const resolvedCacheRoot = cacheRoot ?? (projectRoot !== undefined ? resolve(projectRoot, ".deft-cache") : undefined);
+    const result = listArchivedEntries({
+        source,
+        repo: repo ?? null,
+        since: since ?? null,
+        limit: limit ?? null,
+        cacheRoot: resolvedCacheRoot,
+    });
+    if (format === "json") {
+        process.stdout.write(`${pythonJsonPretty({
+            source: result.source,
+            repo: result.repo,
+            count: result.count,
+            entries: result.entries.map((e) => ({
+                key: e.key,
+                archived_at: e.archivedAt,
+                archive_dir: e.archiveDir,
+                meta: e.meta,
+            })),
+        })}\n`);
+    }
+    else {
+        process.stdout.write(`cache:archive-list count=${result.count}\n`);
+        for (const e of result.entries) {
+            process.stdout.write(`  ${e.key} archived_at=${e.archivedAt}\n`);
+        }
+    }
+    return 0;
+}
+function cmdRestoreFromArchive(args) {
+    let source = "github-issue";
+    let key;
+    let issue;
+    let repo;
+    let force = false;
+    let cacheRoot;
+    let projectRoot;
+    let json = false;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--source") {
+            source = args[i + 1] ?? "github-issue";
+            i += 1;
+        }
+        else if (arg === "--key") {
+            key = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--issue") {
+            const rawIssue = args[i + 1] ?? "";
+            if (!/^[1-9]\d*$/.test(rawIssue)) {
+                throw new CacheError(`--issue must be a positive integer (got ${JSON.stringify(rawIssue)})`);
+            }
+            issue = Number.parseInt(rawIssue, 10);
+            i += 1;
+        }
+        else if (arg === "--repo") {
+            repo = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--force") {
+            force = true;
+        }
+        else if (arg === "--json") {
+            json = true;
+        }
+        else if (arg === "--cache-root") {
+            cacheRoot = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "--project-root") {
+            projectRoot = args[i + 1];
+            i += 1;
+        }
+        else if (arg === "-h" || arg === "--help") {
+            process.stdout.write("usage: cache restore-from-archive -- --issue N --repo OWNER/NAME [--force]\n" +
+                "       [--key owner/repo/N] [--source github-issue] [--json]\n" +
+                "Also available as: task triage:restore-from-archive\n");
+            return 0;
+        }
+        else if (!key && arg && !arg.startsWith("-") && arg.includes("/")) {
+            key = arg;
+        }
+        else {
+            throw new CacheError(`unexpected argument: ${arg}`);
+        }
+    }
+    const resolvedCacheRoot = cacheRoot ?? (projectRoot !== undefined ? resolve(projectRoot, ".deft-cache") : undefined);
+    const result = restoreFromArchive({
+        source,
+        key,
+        issue,
+        repo: repo ?? null,
+        force,
+        cacheRoot: resolvedCacheRoot,
+    });
+    if (json) {
+        process.stdout.write(`${pythonJsonPretty(result)}\n`);
+    }
+    else {
+        process.stdout.write(`cache:restore-from-archive status=${result.status} key=${result.key} live=${result.liveDir}\n`);
+        if (result.detail) {
+            process.stdout.write(`  detail: ${result.detail}\n`);
+        }
+    }
+    if (result.status === "missing" || result.status === "conflict")
+        return 1;
+    return 0;
+}
 /** CLI entry point (mirrors `scripts/cache.py::main`). */
 export function main(argv) {
     if (argv.length === 0) {
@@ -332,6 +622,13 @@ export function main(argv) {
                 return cmdPrune(rest);
             case "clear":
                 return cmdClear(rest);
+            case "archive-closed":
+            case "cache-archive":
+                return cmdArchiveClosed(rest);
+            case "archive-list":
+                return cmdArchiveList(rest);
+            case "restore-from-archive":
+                return cmdRestoreFromArchive(rest);
             default:
                 usage();
                 process.stderr.write(`cache: error: argument cmd: invalid choice: '${cmd}'\n`);

package/dist/check/gate-lists.js

@@ -29,6 +29,10 @@ export const FRAMEWORK_CHECK_GATES = [
     "verify:branch",
     "verify:encoding",
     "verify:forward-coverage",
+    // #3145: test/source boundary + approved-scope provenance + consumer gate composition
+    "verify:test-boundary",
+    "verify:scope-provenance",
+    "verify:consumer-check-contract",
     "verify:vbrief-conformance",
     "verify:destructive-gh-verbs",
     "verify:scm-boundary",
@@ -55,6 +59,10 @@ export const CONSUMER_CHECK_GATES = [
     "verify:cache-fresh",
     "verify:wip-cap",
     "verify:orphan-active",
+    // #3145 enforcement trio (test placement, scope provenance, gate composition)
+    "verify:test-boundary",
+    "verify:scope-provenance",
+    "verify:consumer-check-contract",
     "vbrief:validate",
     "verify-strategy-output",
 ];

package/dist/consumer-check-contract/evaluate.d.ts

@@ -0,0 +1,124 @@
+/**
+ * verify:consumer-check-contract evaluation (#3145).
+ *
+ * Fail closed when the consumer check task or required CI workflows omit
+ * configured Directive enforcement gates (test-boundary, scope-provenance,
+ * and other required surfaces). Emits a concrete repair path.
+ *
+ * Three-state exit: 0 clean / 1 missing gates / 2 config.
+ */
+import { type CheckGateSpec } from "../check/gate-lists.js";
+/** Gates that #3145 requires on consumer check composition (beyond baseline). */
+export declare const REQUIRED_CONSUMER_ENFORCEMENT_GATES: readonly string[];
+export interface ConsumerCheckContractFinding {
+    readonly gateId: string;
+    readonly surface: "check-task" | "ci-workflow" | "verify-taskfile";
+    readonly detail: string;
+    readonly remediation: string;
+}
+export interface ConsumerCheckContractResult {
+    readonly exitCode: 0 | 1 | 2;
+    readonly findings: readonly ConsumerCheckContractFinding[];
+    readonly message: string;
+}
+export interface ConsumerCheckContractOptions {
+    /** Override required gates under test. */
+    readonly requiredGates?: readonly string[];
+    /** Inject Taskfile text (root). */
+    readonly rootTaskfileText?: string | null;
+    /** Inject tasks/verify.yml text. */
+    readonly verifyTaskfileText?: string | null;
+    /** Inject CI workflow file contents: relPath -> text. */
+    readonly ciWorkflows?: ReadonlyMap<string, string>;
+    /**
+     * Framework-source self-check: gates live in FRAMEWORK_CHECK_GATES / check:framework-source.
+     * When true, also accept framework aggregate composition.
+     */
+    readonly frameworkSource?: boolean;
+    /** When true, missing CI references warn only (default true for migration). */
+    readonly ciWarnOnly?: boolean;
+    readonly enforce?: boolean;
+}
+/** True if `text` mentions the gate as a task dep, script, or CLI invocation. */
+export declare function textReferencesGate(text: string, gateId: string): boolean;
+/**
+ * True when a shell line is only assignment(s) (no executed command).
+ * `CHECK_CMD="task check"` is pure assignment; `FOO=1 task check` is not.
+ * Linear scan (no nested regex quantifiers — CodeQL js/redos).
+ */
+export declare function isPureAssignmentLine(cmd: string): boolean;
+/**
+ * True when a shell/task line does not execute gates (echo, comment, pure assign).
+ * Greptile conf gate: non-executing text must not satisfy composition (#3145).
+ */
+export declare function isNonExecutingCommandLine(line: string): boolean;
+/** Executable run/script command lines from a workflow (skips comments). */
+export declare function extractWorkflowRunCommands(text: string): string[];
+/**
+ * Strip simple single/double-quoted segments so runner phrases inside printf/args
+ * do not impersonate command-position invocations (Greptile conf=1).
+ */
+export declare function stripQuotedSegments(line: string): string;
+/**
+ * True when a shell line discards or defers the primary command's exit status
+ * via `||`, pipelines, `;` chains, or job-control backgrounding. Used for
+ * dispatcher tokens that do not match the check-specific mask predicate.
+ */
+export declare function lineMasksShellStatus(line: string): boolean;
+/**
+ * True when a shell line uses job-control backgrounding (`cmd &`, `cmd & next`)
+ * as opposed to fd redirection (`2>&1`, `&>file`). Backgrounded jobs return
+ * before completion and do not propagate exit status — must not satisfy
+ * composition (Greptile conf=3/4 residual, #3145).
+ */
+export declare function lineHasBackgroundJob(line: string): boolean;
+/**
+ * True when a shell line masks check failures (`|| true`, `| true`, `|| :`).
+ * Such lines must not satisfy composition (Greptile conf=3).
+ */
+export declare function lineMasksCheckFailure(line: string): boolean;
+/**
+ * True when `line` invokes a runner at command position (start / after chain),
+ * not merely mentions it inside an argument, and does not mask failures.
+ */
+export declare function lineHasCommandPositionRunner(line: string, runnerPattern: RegExp): boolean;
+/** True when a run command is a full check aggregate (not a single verify gate). */
+export declare function runCommandIsFullCheck(cmd: string): boolean;
+/**
+ * True when a run command invokes a specific verify gate id as an executable
+ * task/CLI form — not a bare substring in echo/docs/printf args.
+ */
+export declare function runCommandInvokesGate(cmd: string, gateId: string): boolean;
+/**
+ * True when CI/workflow text has an executable `run:` line that invokes the full
+ * check aggregate (not a single gate, not prose) — Greptile P1.
+ */
+export declare function workflowExecutesCheck(text: string): boolean;
+/** Extract the body of a top-level go-task task (indent=2 key). */
+export declare function extractTaskBody(taskfileText: string, taskName: string): string;
+/**
+ * Drop YAML/shell comment lines (and trailing `# ...` on otherwise empty marker
+ * lines) before orchestrator matching so commented markers cannot grant trust.
+ */
+export declare function stripTaskBodyComments(body: string): string;
+/**
+ * True when a Taskfile task body actually dispatches the check orchestrator.
+ * ENGINE_CMD alone is inert metadata — require engine:invoke / dispatchTaskCheck
+ * (or a command-position runner) so inert YAML cannot grant trust (Greptile).
+ * Comments are stripped first so commented markers cannot bypass (Greptile conf=3).
+ */
+export declare function taskBodyInvokesCheckOrchestrator(body: string): boolean;
+/** True when the check / check:consumer / check:framework-source task invokes orchestrator. */
+export declare function taskfileInvokesCheckOrchestrator(text: string): boolean;
+/**
+ * Extract dependency task names from a go-task task definition body snippet.
+ * Best-effort line parser for `deps:` list entries.
+ */
+export declare function extractCheckDeps(taskfileText: string, taskName: string): string[];
+/**
+ * Evaluate whether required enforcement gates are composed into consumer check/CI.
+ */
+export declare function evaluateConsumerCheckContract(projectRoot: string, options?: ConsumerCheckContractOptions): ConsumerCheckContractResult;
+/** Exported for tests — gate list helper. */
+export declare function requiredGatesFromConsumerList(gates?: readonly CheckGateSpec[]): string[];
+//# sourceMappingURL=evaluate.d.ts.map