@deftai/directive-core 0.96.0 → 0.98.0

package/dist/init-deposit/scaffold.js

@@ -501,18 +501,287 @@ export function mergeCoreGuardWorkflowRefresh(existing, desired) {
         return desired;
     return desired.slice(0, idx) + existingCheckout + desired.slice(idx + desiredCheckout.length);
 }
+/**
+ * Embedded python3 content check for package.json / lockfiles when co-travelling
+ * with .deft/core/** (#3193). Mirrors TS `isUpgradePinPathContentAllowed`.
+ * Uses a single-quoted heredoc so GHA does not interpolate shell variables
+ * inside the Python source (BASE/HEAD are argv).
+ */
+function coreGuardPinContentPython() {
+    // Keep this compact: deposited into every consumer workflow on init/update.
+    return [
+        '          python3 - "$BASE_SHA" "$HEAD_SHA" <<\'PY\'',
+        "import json, re, subprocess, sys",
+        "base_sha, head_sha = sys.argv[1], sys.argv[2]",
+        "def git_show(sha, path):",
+        "    try:",
+        "        return subprocess.check_output(['git','show',f'{sha}:{path}'], text=True, stderr=subprocess.DEVNULL)",
+        "    except subprocess.CalledProcessError:",
+        "        return ''",
+        "def changed_names():",
+        "    out = subprocess.check_output(['git','diff','--name-only',base_sha,head_sha], text=True)",
+        "    return [p for p in out.splitlines() if p]",
+        "def is_dir_key(n):",
+        "    return n.startswith('@deftai/directive')",
+        "DEP_FIELDS = ('dependencies','devDependencies','optionalDependencies','peerDependencies')",
+        "def deep_eq(a,b):",
+        "    if a is b: return True",
+        "    if type(a) is not type(b): return False",
+        "    if isinstance(a, dict):",
+        "        if set(a) != set(b): return False",
+        "        return all(deep_eq(a[k], b[k]) for k in a)",
+        "    if isinstance(a, list):",
+        "        return len(a)==len(b) and all(deep_eq(x,y) for x,y in zip(a,b))",
+        "    return a == b",
+        "def strip_pins(obj):",
+        "    if not isinstance(obj, dict): return obj",
+        "    out = {}",
+        "    for k,v in obj.items():",
+        "        if k in DEP_FIELDS and isinstance(v, dict):",
+        "            out[k] = {dk:dv for dk,dv in v.items() if not is_dir_key(dk)}",
+        "        else:",
+        "            out[k] = v",
+        "    return out",
+        "def pkg_pin_only(base, head):",
+        "    try:",
+        "        b, h = json.loads(base or '{}'), json.loads(head or '{}')",
+        "    except json.JSONDecodeError:",
+        "        return False",
+        "    return deep_eq(strip_pins(b), strip_pins(h))",
+        "def collect_deps(pkg):",
+        "    out = {}",
+        "    if not isinstance(pkg, dict): return out",
+        "    for f in DEP_FIELDS:",
+        "        block = pkg.get(f)",
+        "        if isinstance(block, dict):",
+        "            for k,v in block.items():",
+        "                if isinstance(v, str): out[k]=v",
+        "                elif isinstance(v, dict) and isinstance(v.get('version'), str): out[k]=v['version']",
+        "                elif v is not None: out[k]=str(v)",
+        "    return out",
+        "def only_dir_diff(bd, hd):",
+        "    keys = set(bd)|set(hd)",
+        "    for k in keys:",
+        "        if is_dir_key(k): continue",
+        "        if bd.get(k) != hd.get(k): return False",
+        "    return True",
+        "def npm_root_deps(lock):",
+        "    pkgs = lock.get('packages') if isinstance(lock, dict) else None",
+        "    if isinstance(pkgs, dict) and isinstance(pkgs.get(''), dict):",
+        "        return collect_deps(pkgs[''])",
+        "    deps = lock.get('dependencies') if isinstance(lock, dict) else None",
+        "    out = {}",
+        "    if isinstance(deps, dict):",
+        "        for k,v in deps.items():",
+        "            if isinstance(v, dict): out[k]=str(v.get('version', v))",
+        "            elif isinstance(v, str): out[k]=v",
+        "    return out",
+        "def npm_lock_ok(base, head):",
+        "    try:",
+        "        b, h = json.loads(base or '{}'), json.loads(head or '{}')",
+        "    except json.JSONDecodeError:",
+        "        return False",
+        "    br, hr = npm_root_deps(b), npm_root_deps(h)",
+        "    if not only_dir_diff(br, hr): return False",
+        "    bp, hp = b.get('packages') or {}, h.get('packages') or {}",
+        "    if not isinstance(bp, dict): bp = {}",
+        "    if not isinstance(hp, dict): hp = {}",
+        "    all_keys = set(bp)|set(hp)",
+        "    for key in all_keys:",
+        "        if key == '': continue",
+        "        if 'node_modules/@deftai/directive' in key or '/@deftai/directive/' in key: continue",
+        "        if not deep_eq(bp.get(key), hp.get(key)): return False",
+        "    if not bp and not hp:",
+        "        def strip_dir(v):",
+        "            if not isinstance(v, dict): return v",
+        "            out = {}",
+        "            for k, val in v.items():",
+        "                if is_dir_key(k): continue",
+        "                if isinstance(val, dict):",
+        "                    nxt = dict(val)",
+        "                    if 'dependencies' in val: nxt['dependencies'] = strip_dir(val['dependencies'])",
+        "                    out[k] = nxt",
+        "                else: out[k] = val",
+        "            return out",
+        "        if not deep_eq(strip_dir(b.get('dependencies')), strip_dir(h.get('dependencies'))): return False",
+        "    return True",
+        "def pnpm_root_deps(raw):",
+        "    out = {}",
+        "    in_imp = in_root = in_dep = False",
+        "    cur = None",
+        "    def unq(s):",
+        "        s=s.strip()",
+        '        if len(s)>=2 and s[0]==s[-1] and s[0] in "\'\\"": return s[1:-1]',
+        "        return s",
+        "    for line in raw.splitlines():",
+        "        if re.match(r'^importers:\\s*$', line):",
+        "            in_imp, in_root, in_dep, cur = True, False, False, None",
+        "            continue",
+        "        if not in_imp: continue",
+        "        if re.match(r'^[^\\s#]', line) and not line.startswith('importers'):",
+        "            break",
+        '        if re.match(r"^ {2}(?:\\.|\'\\.\'|\\"\\.\\"):\\s*$", line):',
+        "            in_root, in_dep, cur = True, False, None",
+        "            continue",
+        "        if in_root and re.match(r'^ {2}\\S', line) and not re.match(r'^ {2}\\.', line):",
+        "            in_root, in_dep, cur = False, False, None",
+        "            continue",
+        "        if not in_root: continue",
+        "        if re.match(r'^ {4}(?:dependencies|devDependencies|optionalDependencies|peerDependencies):\\s*$', line):",
+        "            in_dep, cur = True, None",
+        "            continue",
+        "        if in_dep and re.match(r'^ {4}\\S', line):",
+        "            in_dep, cur = False, None",
+        "            continue",
+        "        if not in_dep: continue",
+        "        m = re.match(r'^ {6}(.+?):\\s*$', line)",
+        "        if m:",
+        "            cur = unq(m.group(1)); continue",
+        "        if cur:",
+        "            vm = re.match(r'^ {8}version:\\s*(.+?)\\s*$', line)",
+        "            if vm:",
+        "                out[cur] = unq(vm.group(1)); cur = None",
+        "    return out",
+        "def pnpm_packages_by_name(raw):",
+        "    blocks, out = {}, {}",
+        "    in_pkg, cur, buf = False, None, []",
+        "    def flush():",
+        "        nonlocal cur, buf",
+        "        if cur is None: return",
+        "        blocks.setdefault(cur, []).append('\\n'.join(buf))",
+        "        cur, buf = None, []",
+        "    def unq(s):",
+        "        s=s.strip()",
+        '        if len(s)>=2 and s[0]==s[-1] and s[0] in "\'\\"": return s[1:-1]',
+        "        return s",
+        "    for line in raw.splitlines():",
+        "        if re.match(r'^packages:\\s*$', line):",
+        "            flush(); in_pkg = True; continue",
+        "        if not in_pkg: continue",
+        "        if re.match(r'^[^\\s#]', line) and not line.startswith('packages'):",
+        "            flush(); break",
+        "        m = re.match(r'^ {2}(.+?):\\s*$', line)",
+        "        if m:",
+        "            flush()",
+        "            key = unq(m.group(1))",
+        "            at = key.find('@', 1) if key.startswith('@') else key.find('@')",
+        "            cur = key[:at] if at > 0 else key",
+        "            buf = [line]; continue",
+        "        if cur is not None: buf.append(line)",
+        "    flush()",
+        "    for name, blist in blocks.items():",
+        "        out[name] = '\\n---\\n'.join(sorted(blist))",
+        "    return out",
+        "def pnpm_section_by_name(raw, section):",
+        "    blocks, out = {}, {}",
+        "    in_sec, cur, buf = False, None, []",
+        "    sec_re = re.compile(r'^' + re.escape(section) + r':\\s*$')",
+        "    def flush():",
+        "        nonlocal cur, buf",
+        "        if cur is None: return",
+        "        blocks.setdefault(cur, []).append('\\n'.join(buf))",
+        "        cur, buf = None, []",
+        "    def unq(s):",
+        "        s=s.strip()",
+        '        if len(s)>=2 and s[0]==s[-1] and s[0] in "\'\\"": return s[1:-1]',
+        "        return s",
+        "    for line in raw.splitlines():",
+        "        if sec_re.match(line):",
+        "            flush(); in_sec = True; continue",
+        "        if not in_sec: continue",
+        "        if re.match(r'^[^\\s#]', line) and not line.startswith(section):",
+        "            flush(); break",
+        "        m = re.match(r'^ {2}(.+?):\\s*$', line)",
+        "        if m:",
+        "            flush()",
+        "            key = unq(m.group(1))",
+        "            at = key.find('@', 1) if key.startswith('@') else key.find('@')",
+        "            cur = key[:at] if at > 0 else key",
+        "            buf = [line]; continue",
+        "        if cur is not None: buf.append(line)",
+        "    flush()",
+        "    for name, blist in blocks.items():",
+        "        out[name] = '\\n---\\n'.join(sorted(blist))",
+        "    return out",
+        "def pnpm_ok(base, head):",
+        "    br, hr = pnpm_root_deps(base), pnpm_root_deps(head)",
+        "    if not only_dir_diff(br, hr): return False",
+        "    for section in ('packages', 'snapshots'):",
+        "        bp, hp = pnpm_section_by_name(base, section), pnpm_section_by_name(head, section)",
+        "        for name in set(bp)|set(hp):",
+        "            if is_dir_key(name): continue",
+        "            if bp.get(name) != hp.get(name): return False",
+        "    return True",
+        "def yarn_blocks(raw):",
+        "    blocks = {}",
+        "    names, buf = [], []",
+        "    def flush():",
+        "        nonlocal names, buf",
+        "        if not names: return",
+        "        body = '\\n'.join(buf)",
+        "        for n in names: blocks[n] = body",
+        "        names, buf = [], []",
+        "    for line in raw.splitlines():",
+        "        if line == '' or line.startswith('#'):",
+        "            if names and line == '': flush()",
+        "            continue",
+        "        if not re.match(r'^\\s', line) and line.endswith(':'):",
+        "            flush()",
+        "            header = line[:-1]",
+        "            names = []",
+        "            for part in header.split(','):",
+        "                p = part.strip()",
+        '                if len(p)>=2 and p[0]==p[-1] and p[0] in "\'\\"": p = p[1:-1]',
+        "                at = p.find('@', 1) if p.startswith('@') else p.find('@')",
+        "                names.append(p[:at] if at > 0 else p)",
+        "            buf = [line]",
+        "            continue",
+        "        if names: buf.append(line)",
+        "    flush()",
+        "    return blocks",
+        "def yarn_ok(base, head):",
+        "    bb, hb = yarn_blocks(base), yarn_blocks(head)",
+        "    for name in set(bb)|set(hb):",
+        "        if is_dir_key(name): continue",
+        "        if bb.get(name) != hb.get(name): return False",
+        "    return True",
+        "paths = changed_names()",
+        "core = [p for p in paths if p == '.deft/core' or p.startswith('.deft/core/')]",
+        "if not core:",
+        "    sys.exit(0)",
+        "checks = {",
+        "    'package.json': pkg_pin_only,",
+        "    'package-lock.json': npm_lock_ok,",
+        "    'pnpm-lock.yaml': pnpm_ok,",
+        "    'yarn.lock': yarn_ok,",
+        "}",
+        "bad = []",
+        "for path, fn in checks.items():",
+        "    if path not in paths: continue",
+        "    if not fn(git_show(base_sha, path), git_show(head_sha, path)):",
+        "        bad.append(path)",
+        "if bad:",
+        "    print('::error title=deft-core guard (#3193)::package/lock co-travel with .deft/core/** must be @deftai/directive* pin-only + lock follow-through. Rejected: ' + ', '.join(bad))",
+        "    print('--- content-rejected pin/lock paths ---')",
+        "    print('\\n'.join(bad))",
+        "    sys.exit(1)",
+        "print('OK: package/lock content is Directive pin unit (#3193).')",
+        "PY",
+    ].join("\n");
+}
 function coreGuardWorkflowContent() {
     // Fail closed before emitting guard ERE if allowlist violates #1430 denylist (#3030).
     assertInstallerAllowlistHonors1430();
     const baseSha = githubActionsExpr("github.event.pull_request.base.sha");
     const headSha = githubActionsExpr("github.event.pull_request.head.sha");
     return ("name: deft-core-guard\n\n" +
-        "# Deft framework guard (#1430 / #3127): a single PR should not mix changes to the\n" +
+        "# Deft framework guard (#1430 / #3127 / #3193): a single PR should not mix changes to the\n" +
         "# vendored framework payload (.deft/core/**) with true application/product files.\n" +
         "# One upgrade PR MAY include deposit + installer-managed paths + package.json pin/lock\n" +
-        "# + .deft/GENERATION.json. Framework updates come from `deft update` / install and should\n" +
-        "# land without product feature work so reviewers treat the payload as machine-managed.\n" +
-        "# Delete this file if you do not want the guard.\n" +
+        "# + .deft/GENERATION.json when package.json is @deftai/directive* dependency-key pin-only\n" +
+        "# and lockfiles are pin follow-through (#3193). Framework updates come from `deft update`\n" +
+        "# / install and should land without product feature work so reviewers treat the payload\n" +
+        "# as machine-managed. Delete this file if you do not want the guard.\n" +
         "on:\n" +
         "  pull_request:\n\n" +
         "permissions:\n" +
@@ -543,6 +812,10 @@ function coreGuardWorkflowContent() {
         '            echo "--- non-framework changes ---"; printf \'%s\\n\' "$app"\n' +
         "            exit 1\n" +
         "          fi\n" +
+        "          # Content-aware pin unit (#3193): path allowlist is not enough for package/lock.\n" +
+        '          if [ -n "$core" ]; then\n' +
+        `${coreGuardPinContentPython()}\n` +
+        "          fi\n" +
         '          echo "OK: no mixed framework + app changes."\n');
 }
 export function ensureGitattributes(projectDir, io) {

package/dist/init-deposit/skill-discovery-deposit.js

@@ -108,6 +108,21 @@ description: >-
 ---
 
 Read and follow: .deft/core/skills/deft-directive-interview/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-portfolio-priority",
+        content: `---
+name: deft-directive-portfolio-priority
+description: >-
+  Pre-promotion portfolio prioritization: cluster competing open RFCs/issues
+  from the local github-issue cache, emit a propose-not-apply priority brief
+  (conflict matrix, shortlist, park), with epistemic citation gates, then hand
+  off for operator dispose. Use when the operator asks for portfolio priority,
+  a priority brief, competing RFCs, or to cluster open issues.
+---
+
+Read and follow: .deft/core/skills/deft-directive-portfolio-priority/SKILL.md
 `,
     },
     {

package/dist/policy/check-resume.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Check-resume / local suite-stamp policy (#3189).
+ *
+ * Consent / SoT surface for consumer expansion of local suite-stamp resume
+ * (#3188). Unset is fail-closed (localStamp off). CI never trusts a local
+ * stamp in v1 — `ciTrustsLocalStamp` is fixed false.
+ */
+/** Canonical registered policy field name. */
+export declare const FIELD_CHECK_RESUME = "plan.policy.checkResume";
+/** Short alias for `policy:show --field=checkResume`. */
+export declare const FIELD_CHECK_RESUME_CLI_ALIAS = "checkResume";
+export declare const CHECK_RESUME_STATUSES: readonly ["unset", "decided"];
+export type CheckResumeStatus = (typeof CHECK_RESUME_STATUSES)[number];
+export declare const CHECK_RESUME_LOCAL_STAMP: readonly ["off", "on"];
+export type CheckResumeLocalStamp = (typeof CHECK_RESUME_LOCAL_STAMP)[number];
+/** Fail-closed when unset / missing. */
+export declare const DEFAULT_CHECK_RESUME_LOCAL_STAMP: CheckResumeLocalStamp;
+/**
+ * FIXED false in v1 (#3189 non-goal). Separate RFC required to ever allow CI
+ * to trust a laptop suite stamp.
+ */
+export declare const CHECK_RESUME_CI_TRUSTS_LOCAL_STAMP_V1: false;
+export interface CheckResumeConfig {
+    readonly status: CheckResumeStatus;
+    readonly localStamp: CheckResumeLocalStamp;
+    /** Always false in v1; present for schema visibility. */
+    readonly ciTrustsLocalStamp: false;
+    /** Present when decided via dismiss-with-reason. */
+    readonly dismissReason: string | null;
+}
+export type CheckResumeSource = "typed" | "default" | "default-on-error";
+export interface CheckResumeResolved extends CheckResumeConfig {
+    readonly source: CheckResumeSource;
+    readonly error: string | null;
+}
+/** Validate a `plan.policy.checkResume` payload. */
+export declare function validateCheckResume(value: unknown): string[];
+/**
+ * Resolve a typed block. Missing/invalid → localStamp off, status unset.
+ * `ciTrustsLocalStamp` is always forced false regardless of input truthiness
+ * (malformed non-false is validation error → fail-closed default).
+ */
+export declare function resolveCheckResumeFromTypedBlock(raw: unknown): CheckResumeResolved;
+/** Resolve `plan.policy.checkResume` from PROJECT-DEFINITION (#3189). */
+export declare function resolveCheckResume(projectRoot: string): CheckResumeResolved;
+/** Local suite stamp resume only when decided localStamp=on. */
+export declare function isLocalStampResumeAllowed(policy: CheckResumeResolved): boolean;
+/** Always false in v1 — CI must re-run suite, never trust a laptop stamp. */
+export declare function isCiTrustsLocalStampAllowed(_policy?: CheckResumeResolved): false;
+export declare function formatCheckResumeStatusLine(policy: CheckResumeResolved): string;
+export interface CheckResumePolicyField {
+    readonly name: typeof FIELD_CHECK_RESUME;
+    readonly current: CheckResumeConfig;
+    readonly default: CheckResumeConfig;
+    readonly source: string;
+}
+/** Inspector row for `policy:show --field=checkResume`. */
+export declare function inspectCheckResume(data: Record<string, unknown> | null, projectRoot?: string): CheckResumePolicyField;
+export interface WriteCheckResumeOptions {
+    readonly localStamp: CheckResumeLocalStamp;
+    readonly dismissReason?: string | null;
+    readonly actor?: string;
+    readonly note?: string;
+}
+export interface WriteCheckResumeResult {
+    readonly exitCode: 0 | 2;
+    readonly stdout: string;
+    readonly changed: boolean;
+}
+/** Persist decided checkResume (preset or dismiss-with-reason). */
+export declare function writeCheckResume(projectRoot: string, options: WriteCheckResumeOptions): WriteCheckResumeResult;
+//# sourceMappingURL=check-resume.d.ts.map

package/dist/policy/check-resume.js

@@ -0,0 +1,253 @@
+/**
+ * Check-resume / local suite-stamp policy (#3189).
+ *
+ * Consent / SoT surface for consumer expansion of local suite-stamp resume
+ * (#3188). Unset is fail-closed (localStamp off). CI never trusts a local
+ * stamp in v1 — `ciTrustsLocalStamp` is fixed false.
+ */
+import { readFileSync } from "node:fs";
+import { atomicWriteProjectDefinition, projectDefinitionMutationLock, } from "../vbrief-build/project-definition-io.js";
+import { migrateLegacyPolicyKey, PLAN_POLICY_KEY, readPlanPolicy } from "./plan-extensions.js";
+import { policyColonInvocation } from "./policy-invocation.js";
+import { appendAuditLog, loadProjectDefinition, projectDefinitionPath } from "./resolve.js";
+/** Canonical registered policy field name. */
+export const FIELD_CHECK_RESUME = "plan.policy.checkResume";
+/** Short alias for `policy:show --field=checkResume`. */
+export const FIELD_CHECK_RESUME_CLI_ALIAS = "checkResume";
+export const CHECK_RESUME_STATUSES = ["unset", "decided"];
+export const CHECK_RESUME_LOCAL_STAMP = ["off", "on"];
+/** Fail-closed when unset / missing. */
+export const DEFAULT_CHECK_RESUME_LOCAL_STAMP = "off";
+/**
+ * FIXED false in v1 (#3189 non-goal). Separate RFC required to ever allow CI
+ * to trust a laptop suite stamp.
+ */
+export const CHECK_RESUME_CI_TRUSTS_LOCAL_STAMP_V1 = false;
+function defaultResolved(source, error = null) {
+    return {
+        status: "unset",
+        localStamp: DEFAULT_CHECK_RESUME_LOCAL_STAMP,
+        ciTrustsLocalStamp: CHECK_RESUME_CI_TRUSTS_LOCAL_STAMP_V1,
+        dismissReason: null,
+        source,
+        error,
+    };
+}
+function isStatus(value) {
+    return typeof value === "string" && CHECK_RESUME_STATUSES.includes(value);
+}
+function isLocalStamp(value) {
+    return (typeof value === "string" && CHECK_RESUME_LOCAL_STAMP.includes(value));
+}
+/** Validate a `plan.policy.checkResume` payload. */
+export function validateCheckResume(value) {
+    if (value === null || value === undefined) {
+        return [];
+    }
+    if (typeof value !== "object" || Array.isArray(value)) {
+        return [`${FIELD_CHECK_RESUME} must be an object; got ${typeof value}`];
+    }
+    const rec = value;
+    const errors = [];
+    if ("status" in rec && !isStatus(rec.status)) {
+        errors.push(`${FIELD_CHECK_RESUME}.status must be one of ${CHECK_RESUME_STATUSES.join("|")}`);
+    }
+    if ("localStamp" in rec && !isLocalStamp(rec.localStamp)) {
+        errors.push(`${FIELD_CHECK_RESUME}.localStamp must be one of ${CHECK_RESUME_LOCAL_STAMP.join("|")}`);
+    }
+    if ("ciTrustsLocalStamp" in rec && rec.ciTrustsLocalStamp !== false) {
+        errors.push(`${FIELD_CHECK_RESUME}.ciTrustsLocalStamp must be false in v1 (CI never trusts local stamps)`);
+    }
+    if ("dismissReason" in rec &&
+        rec.dismissReason !== null &&
+        typeof rec.dismissReason !== "string") {
+        errors.push(`${FIELD_CHECK_RESUME}.dismissReason must be a string or null`);
+    }
+    return errors;
+}
+/**
+ * Resolve a typed block. Missing/invalid → localStamp off, status unset.
+ * `ciTrustsLocalStamp` is always forced false regardless of input truthiness
+ * (malformed non-false is validation error → fail-closed default).
+ */
+export function resolveCheckResumeFromTypedBlock(raw) {
+    const errors = validateCheckResume(raw);
+    if (errors.length > 0) {
+        return defaultResolved("default-on-error", errors[0] ?? "invalid checkResume block");
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        return defaultResolved("default");
+    }
+    const block = raw;
+    const status = isStatus(block.status) ? block.status : "unset";
+    const localStampRaw = isLocalStamp(block.localStamp)
+        ? block.localStamp
+        : DEFAULT_CHECK_RESUME_LOCAL_STAMP;
+    // Fail-closed: local stamp only when decided.
+    const localStamp = status === "decided" ? localStampRaw : DEFAULT_CHECK_RESUME_LOCAL_STAMP;
+    const dismissReason = typeof block.dismissReason === "string" && block.dismissReason.trim().length > 0
+        ? block.dismissReason.trim()
+        : null;
+    return {
+        status,
+        localStamp,
+        ciTrustsLocalStamp: CHECK_RESUME_CI_TRUSTS_LOCAL_STAMP_V1,
+        dismissReason: status === "decided" ? dismissReason : null,
+        source: "typed",
+        error: null,
+    };
+}
+/** Resolve `plan.policy.checkResume` from PROJECT-DEFINITION (#3189). */
+export function resolveCheckResume(projectRoot) {
+    const [data, err] = loadProjectDefinition(projectRoot);
+    if (data === null) {
+        return defaultResolved("default-on-error", err);
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("checkResume" in policyBlock)) {
+        return defaultResolved("default");
+    }
+    return resolveCheckResumeFromTypedBlock(policyBlock.checkResume);
+}
+/** Local suite stamp resume only when decided localStamp=on. */
+export function isLocalStampResumeAllowed(policy) {
+    return policy.status === "decided" && policy.localStamp === "on";
+}
+/** Always false in v1 — CI must re-run suite, never trust a laptop stamp. */
+export function isCiTrustsLocalStampAllowed(_policy) {
+    return CHECK_RESUME_CI_TRUSTS_LOCAL_STAMP_V1;
+}
+export function formatCheckResumeStatusLine(policy) {
+    const dismiss = policy.dismissReason !== null ? ` dismissReason=${JSON.stringify(policy.dismissReason)}` : "";
+    return (`[deft policy] checkResume status=${policy.status} localStamp=${policy.localStamp} ` +
+        `ciTrustsLocalStamp=${String(policy.ciTrustsLocalStamp)}${dismiss} (source=${policy.source}).`);
+}
+function fieldFromResolved(resolved) {
+    return {
+        name: FIELD_CHECK_RESUME,
+        current: {
+            status: resolved.status,
+            localStamp: resolved.localStamp,
+            ciTrustsLocalStamp: CHECK_RESUME_CI_TRUSTS_LOCAL_STAMP_V1,
+            dismissReason: resolved.dismissReason,
+        },
+        default: {
+            status: "unset",
+            localStamp: DEFAULT_CHECK_RESUME_LOCAL_STAMP,
+            ciTrustsLocalStamp: CHECK_RESUME_CI_TRUSTS_LOCAL_STAMP_V1,
+            dismissReason: null,
+        },
+        source: resolved.source,
+    };
+}
+/** Inspector row for `policy:show --field=checkResume`. */
+export function inspectCheckResume(data, projectRoot) {
+    if (data === null) {
+        return fieldFromResolved(defaultResolved("default"));
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("checkResume" in policyBlock)) {
+        if (projectRoot !== undefined) {
+            return fieldFromResolved(resolveCheckResume(projectRoot));
+        }
+        return fieldFromResolved(defaultResolved("default"));
+    }
+    return fieldFromResolved(resolveCheckResumeFromTypedBlock(policyBlock.checkResume));
+}
+/** Persist decided checkResume (preset or dismiss-with-reason). */
+export function writeCheckResume(projectRoot, options) {
+    const path = projectDefinitionPath(projectRoot);
+    try {
+        const { changed } = projectDefinitionMutationLock(projectRoot, () => {
+            const parsed = JSON.parse(readFileSync(path, { encoding: "utf8" }));
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                throw new Error(`PROJECT-DEFINITION at ${path} top-level value is not a JSON object`);
+            }
+            const data = parsed;
+            if (typeof data.plan !== "object" || data.plan === null || Array.isArray(data.plan)) {
+                if (data.plan === undefined) {
+                    data.plan = {};
+                }
+                else {
+                    throw new Error("PROJECT-DEFINITION 'plan' is not an object");
+                }
+            }
+            const plan = data.plan;
+            migrateLegacyPolicyKey(plan);
+            const existingPolicy = plan[PLAN_POLICY_KEY];
+            if (typeof existingPolicy !== "object" ||
+                existingPolicy === null ||
+                Array.isArray(existingPolicy)) {
+                if (existingPolicy === undefined) {
+                    plan[PLAN_POLICY_KEY] = {};
+                }
+                else {
+                    throw new Error("plan.policy is not an object");
+                }
+            }
+            const policyBlock = plan[PLAN_POLICY_KEY];
+            const previous = policyBlock.checkResume;
+            const dismissReason = typeof options.dismissReason === "string" && options.dismissReason.trim().length > 0
+                ? options.dismissReason.trim()
+                : null;
+            const nextBlock = {
+                status: "decided",
+                localStamp: options.localStamp,
+                ciTrustsLocalStamp: CHECK_RESUME_CI_TRUSTS_LOCAL_STAMP_V1,
+                dismissReason,
+            };
+            const previousNormalized = resolveCheckResumeFromTypedBlock(previous);
+            const changedFlag = previousNormalized.status !== nextBlock.status ||
+                previousNormalized.localStamp !== nextBlock.localStamp ||
+                previousNormalized.dismissReason !== nextBlock.dismissReason;
+            policyBlock.checkResume = nextBlock;
+            if (changedFlag) {
+                atomicWriteProjectDefinition(path, data);
+            }
+            const actor = options.actor ?? policyColonInvocation("set-check-resume");
+            const note = options.note ?? "";
+            const parts = [
+                `actor=${actor}`,
+                "checkResume.status=decided",
+                `localStamp=${nextBlock.localStamp}`,
+                "ciTrustsLocalStamp=false",
+                `dismissReason=${JSON.stringify(nextBlock.dismissReason)}`,
+                `previous=${JSON.stringify(previous ?? null)}`,
+            ];
+            if (note) {
+                parts.push(`note=${note.replace(/\n/g, " ").replace(/\r/g, " ")}`);
+            }
+            appendAuditLog(projectRoot, parts.join(" "));
+            return { changed: changedFlag };
+        });
+        const resolved = resolveCheckResume(projectRoot);
+        const lines = [
+            `\u2713 ${FIELD_CHECK_RESUME} status=decided localStamp=${resolved.localStamp}.`,
+            changed
+                ? "  audit: meta/policy-changes.log updated."
+                : "  no-op: value already matched (audit entry still appended for trail).",
+            formatCheckResumeStatusLine(resolved),
+        ];
+        return { exitCode: 0, stdout: `${lines.join("\n")}\n`, changed };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("PROJECT-DEFINITION not found") ||
+            message.includes("ENOENT") ||
+            message.includes("no such file")) {
+            return {
+                exitCode: 2,
+                stdout: `\u274c PROJECT-DEFINITION not found under ${projectRoot}\n`,
+                changed: false,
+            };
+        }
+        return { exitCode: 2, stdout: `\u274c Config error: ${message}\n`, changed: false };
+    }
+}
+//# sourceMappingURL=check-resume.js.map