@deftai/directive-core 0.98.1 → 0.100.0

package/dist/authz/store.js

@@ -4,7 +4,7 @@
 import { randomBytes } from "node:crypto";
 import { existsSync, readdirSync, readFileSync, renameSync, rmSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
-import { containedWrite } from "../fs/contained-write.js";
+import { ContainedWriteError, containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { isHumanOrigin } from "./origin.js";
 import { authzAuditPath, authzGrantPath, authzGrantsDir, authzStatePath } from "./paths.js";
@@ -105,6 +105,13 @@ function parseScope(raw) {
         storyIds: readStringArray(rec.storyIds ?? rec.story_ids),
         issueIds: readNumberArray(rec.issueIds ?? rec.issue_ids),
         cohortId: readString(rec, "cohortId") ?? readString(rec, "cohort_id"),
+        // #3239 structural decompose apply bindings (snake_case accepted on load).
+        contentDigest: readString(rec, "contentDigest") ??
+            readString(rec, "content_digest") ??
+            readString(rec, "draftDigest") ??
+            readString(rec, "draft_digest"),
+        parentPath: readString(rec, "parentPath") ?? readString(rec, "parent_path"),
+        targetPath: readString(rec, "targetPath") ?? readString(rec, "target_path"),
     };
 }
 function parseSemantics(raw) {
@@ -233,6 +240,217 @@ export function markGrantUsed(projectRoot, grantId, now = new Date()) {
     saveGrant(projectRoot, used);
     return used;
 }
+function isProcessAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err.code;
+        // ESRCH → dead. EPERM → exists but unsignalable — treat as alive (never reclaim).
+        if (code === "EPERM")
+            return true;
+        return false;
+    }
+}
+/**
+ * Whether a claim lock may be reclaimed after a crashed holder (#3239).
+ * Live owner PIDs are never reclaimed (no mtime-only steal of a live critical section).
+ * Corrupt / unreadable records are reclaimable; PID-reuse residual needs manual delete.
+ */
+export function isGrantClaimLockReclaimable(rec) {
+    if (rec === null)
+        return true;
+    return !isProcessAlive(rec.pid);
+}
+function readGrantClaimLockRecord(lockPath) {
+    try {
+        const raw = readFileSync(lockPath, "utf8").trim();
+        // JSON form (current). Legacy: "pid\niso\n" lines from earlier #3239 revisions.
+        if (raw.startsWith("{")) {
+            const parsed = JSON.parse(raw);
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+                return null;
+            const o = parsed;
+            const pid = typeof o.pid === "number" ? o.pid : Number(o.pid);
+            const startedAt = typeof o.startedAt === "string" ? o.startedAt : "";
+            const token = typeof o.token === "string" ? o.token : "";
+            if (!Number.isFinite(pid) || token.length === 0)
+                return null;
+            return { pid, startedAt, token };
+        }
+        const lines = raw.split(/\r?\n/);
+        const pid = Number(lines[0]);
+        if (!Number.isFinite(pid))
+            return null;
+        return {
+            pid,
+            startedAt: typeof lines[1] === "string" ? lines[1] : "",
+            token: "legacy",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Claim a single-use grant for structural apply (#3239).
+ *
+ * Concurrent-safe + failure-safe order when `apply` is provided:
+ *   exclusive lock → re-load → revalidate → mark single-use usedAt → apply (writes)
+ *   → on apply throw: rollback usedAt + release lock (grant reusable for retry).
+ * Multi-use grants run apply (if any) without mutating usedAt.
+ * Without `apply`, single-use is marked under the lock (claim-only / test path).
+ *
+ * Crash after mark + before rollback: grant stays spent (no double-apply); operator remints.
+ * Dead-PID / corrupt locks reclaim via **rename-away** of the old lock path (only one
+ * renamer wins) then exclusive create — never blind rmSync of a live winner's lock.
+ * Live PIDs are never reclaimed. PID-reuse residual: operator deletes the lock file.
+ */
+export function claimSingleUseGrantForApply(projectRoot, grantId, options = {}) {
+    // Back-compat: second arg was `now: Date` in the first #3239 revision.
+    const opts = options instanceof Date ? { now: options } : options;
+    const now = opts.now ?? new Date();
+    const usedAtIso = utcIso(now);
+    const safe = grantId.replace(/[^a-zA-Z0-9._-]/g, "_");
+    const root = resolve(projectRoot);
+    const lockRel = join(".deft", "authz", "locks", `${safe}.lock`);
+    const lockPath = join(root, lockRel);
+    const lockToken = randomBytes(8).toString("hex");
+    const lockBody = `${JSON.stringify({
+        pid: process.pid,
+        startedAt: usedAtIso,
+        token: lockToken,
+    })}\n`;
+    const tryCreateLock = () => {
+        try {
+            containedWrite({
+                root,
+                target: lockPath,
+                data: lockBody,
+                mode: "create",
+            });
+            return true;
+        }
+        catch (err) {
+            if (err instanceof ContainedWriteError && err.code === "CONTAINED_WRITE_EXISTS") {
+                return false;
+            }
+            // Other containment/IO failures fail closed as reservation denial.
+            return false;
+        }
+    };
+    /** True when the on-disk lock still carries our token (not stolen mid-section). */
+    const stillOwnLock = () => {
+        const rec = readGrantClaimLockRecord(lockPath);
+        return rec !== null && rec.token === lockToken && rec.pid === process.pid;
+    };
+    let locked = tryCreateLock();
+    if (!locked) {
+        // Dead-PID / corrupt reclaim: rename the old lock aside (atomic contention) then create.
+        // Blind rmSync is forbidden — a second reclaimer must not delete a winner's new lock.
+        const existing = readGrantClaimLockRecord(lockPath);
+        if (isGrantClaimLockReclaimable(existing)) {
+            const side = `${lockPath}.reclaim.${randomBytes(6).toString("hex")}`;
+            try {
+                renameSync(lockPath, side);
+                try {
+                    rmSync(side, { force: true });
+                }
+                catch {
+                    /* best-effort side cleanup */
+                }
+            }
+            catch {
+                // Lost rename race or lock already gone — fall through to exclusive create.
+            }
+            locked = tryCreateLock();
+        }
+    }
+    if (!locked) {
+        return {
+            ok: false,
+            reason: `Directive denied scope:decompose apply: grant ${grantId} is already reserved ` +
+                "or spent by a concurrent apply. Human action required: remint if the prior apply failed " +
+                "(or remove a leftover `.deft/authz/locks/<id>.lock` after a dead-holder crash if reclaim fails).",
+        };
+    }
+    let markedUsedAt = null;
+    try {
+        const grant = loadGrant(projectRoot, grantId);
+        if (grant === null) {
+            return {
+                ok: false,
+                reason: `Directive denied scope:decompose apply: grant ${grantId} missing.`,
+            };
+        }
+        if (opts.revalidate !== undefined) {
+            const check = opts.revalidate(grant);
+            if (!check.ok) {
+                return { ok: false, reason: check.reason };
+            }
+        }
+        if (!grant.semantics.singleUse) {
+            if (opts.apply !== undefined) {
+                opts.apply(grant);
+            }
+            return { ok: true, grant };
+        }
+        if (grant.semantics.usedAt !== null) {
+            return {
+                ok: false,
+                reason: `Directive denied scope:decompose apply: single-use grant ${grantId} already spent at ` +
+                    `${grant.semantics.usedAt}.`,
+            };
+        }
+        // Spend under lock before protected writes so a post-write mark failure cannot
+        // leave completed mutations behind an unspent single-use grant (#3239 Greptile).
+        // Apply throw rolls usedAt back while the lock is still held (retry-safe).
+        const used = {
+            ...grant,
+            semantics: {
+                ...grant.semantics,
+                usedAt: usedAtIso,
+            },
+        };
+        saveGrant(projectRoot, used);
+        markedUsedAt = usedAtIso;
+        if (opts.apply !== undefined) {
+            try {
+                opts.apply(used);
+            }
+            catch (applyErr) {
+                // Rollback spend so a failed multi-file apply does not strand the approval.
+                const current = loadGrant(projectRoot, grantId);
+                if (current?.semantics.singleUse && current.semantics.usedAt === markedUsedAt) {
+                    const restored = {
+                        ...current,
+                        semantics: { ...current.semantics, usedAt: null },
+                    };
+                    saveGrant(projectRoot, restored);
+                    markedUsedAt = null;
+                }
+                throw applyErr;
+            }
+        }
+        if (!stillOwnLock()) {
+            return {
+                ok: false,
+                reason: `Directive denied scope:decompose apply: grant ${grantId} lock ownership lost mid-claim. ` +
+                    "Human action required: inspect partial outputs and remint if needed.",
+            };
+        }
+        return { ok: true, grant: used };
+    }
+    finally {
+        // Only remove the lock when we still own it — never delete a successor's claim.
+        if (stillOwnLock()) {
+            rmSync(lockPath, { force: true });
+        }
+    }
+}
 export function saveAuthzState(projectRoot, state) {
     writeJsonContained(projectRoot, authzStatePath(projectRoot), state);
 }

package/dist/authz/types.d.ts

@@ -5,8 +5,10 @@
  * agent authors must not independently satisfy implementation-approval gates.
  * Local-file forgery by a credential-compromised agent remains #983-class OOS.
  */
-/** Operation classes bound on a grant (Wave 1 structural binding + Wave 4 closed verbs). */
-export declare const AUTHZ_OPERATIONS: readonly ["edit", "push", "pr", "merge", "settings", "deployment", "issue_mutation", "release-cut", "release-publish", "release-rollback"];
+/** Structural apply op for scope:decompose (#3239 / epic #3237 Q2). Always gated. */
+export declare const SCOPE_DECOMPOSE_APPLY_STRUCTURAL: "scope.decompose.apply.structural";
+/** Operation classes bound on a grant (Wave 1 structural binding + Wave 4 closed verbs + #3239). */
+export declare const AUTHZ_OPERATIONS: readonly ["edit", "push", "pr", "merge", "settings", "deployment", "issue_mutation", "release-cut", "release-publish", "release-rollback", "scope.decompose.apply.structural"];
 export type AuthzOperation = (typeof AUTHZ_OPERATIONS)[number];
 /**
  * Human-origin kinds accepted as approval provenance.
@@ -41,6 +43,21 @@ export interface GrantScope {
      * for product mutations; approving one cohort does not clear UAT.
      */
     readonly cohortId: string | null;
+    /**
+     * SHA-256 hex of exact bound artifact bytes (decompose draft for #3239).
+     * Unset/null = unbound (cannot satisfy structural decompose apply).
+     */
+    readonly contentDigest?: string | null;
+    /**
+     * Project-relative parent artifact path for structural decompose apply (#3239).
+     * Unset/null = unbound.
+     */
+    readonly parentPath?: string | null;
+    /**
+     * Project-relative draft/target path for structural decompose apply (#3239).
+     * Unset/null = unbound.
+     */
+    readonly targetPath?: string | null;
 }
 export interface GrantSemantics {
     readonly expiresAt: string | null;

package/dist/authz/types.js

@@ -5,7 +5,9 @@
  * agent authors must not independently satisfy implementation-approval gates.
  * Local-file forgery by a credential-compromised agent remains #983-class OOS.
  */
-/** Operation classes bound on a grant (Wave 1 structural binding + Wave 4 closed verbs). */
+/** Structural apply op for scope:decompose (#3239 / epic #3237 Q2). Always gated. */
+export const SCOPE_DECOMPOSE_APPLY_STRUCTURAL = "scope.decompose.apply.structural";
+/** Operation classes bound on a grant (Wave 1 structural binding + Wave 4 closed verbs + #3239). */
 export const AUTHZ_OPERATIONS = [
     "edit",
     "push",
@@ -18,6 +20,8 @@ export const AUTHZ_OPERATIONS = [
     "release-cut",
     "release-publish",
     "release-rollback",
+    /** Human-origin exact-draft-digest gate for scope:decompose apply (#3239). */
+    SCOPE_DECOMPOSE_APPLY_STRUCTURAL,
 ];
 /**
  * Human-origin kinds accepted as approval provenance.

package/dist/consumer-check-contract/evaluate.d.ts

@@ -38,7 +38,47 @@ export interface ConsumerCheckContractOptions {
     /** When true, missing CI references warn only (default true for migration). */
     readonly ciWarnOnly?: boolean;
     readonly enforce?: boolean;
+    /**
+     * Inject included framework Taskfile text (canonical `.deft/core/Taskfile.yml`).
+     * When undefined, resolve from disk via {@link resolveCanonicalDeftTaskfileInclude}.
+     * #3218 greenfield include-only consumers.
+     */
+    readonly includedFrameworkTaskfileText?: string | null;
+    /**
+     * Inject included framework `tasks/verify.yml` text next to the canonical include.
+     * When undefined, resolve from disk beside the included Taskfile.
+     */
+    readonly includedVerifyTaskfileText?: string | null;
 }
+/**
+ * Relative path forms accepted for the deft-install canonical Taskfile include
+ * (init-deposit `MINIMAL_TASKFILE` / `CANONICAL_TASKFILE_INCLUDE`).
+ * Use only as a path-value matcher — never as a whole-file text search (Greptile P1 #3218).
+ */
+export declare const CANONICAL_DEFT_TASKFILE_PATH_RE: RegExp;
+/** @deprecated Prefer path/line parsers; kept for export stability. */
+export declare const CANONICAL_DEFT_TASKFILE_INCLUDE_RE: RegExp;
+/**
+ * Return the relative path of the canonical `.deft/core/Taskfile.yml` include when
+ * present as an **active, direct** go-task `includes:` entry; otherwise null.
+ *
+ * Greenfield `directive init` deposits an include-only Taskfile (#3218); composition
+ * lives in the included framework graph, not in root `check` deps.
+ *
+ * Greptile P1 (#3218):
+ * - Path text in comments / cmds / vars / non-include keys must not match.
+ * - Only **direct** include entries count: short form `deft: path` or object form
+ *   `deft: { taskfile: path }` (immediate property). Nested
+ *   `includes.some.nested.taskfile` is not an executable go-task include.
+ * - Namespace must be `deft` so the documented `task deft:check` entrypoint exists.
+ */
+export declare function resolveCanonicalDeftTaskfileInclude(rootTaskfileText: string): string | null;
+/**
+ * True when a framework (included) Taskfile composes every required gate via
+ * `check` / `check:consumer` / `check:framework-source` deps or an orchestrator body,
+ * and `tasks/verify.yml` defines the local task keys.
+ */
+export declare function frameworkTaskfileComposesRequiredGates(frameworkTaskfileText: string, verifyTaskfileText: string | null, required?: readonly string[]): boolean;
 /** True if `text` mentions the gate as a task dep, script, or CLI invocation. */
 export declare function textReferencesGate(text: string, gateId: string): boolean;
 /**

package/dist/consumer-check-contract/evaluate.js

@@ -17,6 +17,157 @@ export const REQUIRED_CONSUMER_ENFORCEMENT_GATES = [
     "verify:scope-provenance",
     "verify:consumer-check-contract",
 ];
+/**
+ * Relative path forms accepted for the deft-install canonical Taskfile include
+ * (init-deposit `MINIMAL_TASKFILE` / `CANONICAL_TASKFILE_INCLUDE`).
+ * Use only as a path-value matcher — never as a whole-file text search (Greptile P1 #3218).
+ */
+export const CANONICAL_DEFT_TASKFILE_PATH_RE = /^(?:\.\.?\/)?\.deft\/core\/Taskfile\.yml$/i;
+/** `taskfile: ./.deft/core/Taskfile.yml` under an includes: child (object form). */
+const INCLUDE_TASKFILE_KEY_RE = /^taskfile:\s*['"]?((?:\.\.?\/)?\.deft\/core\/Taskfile\.yml)['"]?\s*(?:#.*)?$/i;
+/**
+ * Short form under includes: — **must** be namespace `deft` so `task deft:check`
+ * remains the documented greenfield entrypoint (Greptile conf residual #3218).
+ */
+const INCLUDE_DEFT_SHORT_FORM_RE = /^deft:\s*['"]?((?:\.\.?\/)?\.deft\/core\/Taskfile\.yml)['"]?\s*(?:#.*)?$/i;
+/** Object-form entry start for the `deft` namespace only. */
+const INCLUDE_DEFT_ENTRY_START_RE = /^deft\s*:\s*(?:#.*)?$/i;
+/** @deprecated Prefer path/line parsers; kept for export stability. */
+export const CANONICAL_DEFT_TASKFILE_INCLUDE_RE = INCLUDE_TASKFILE_KEY_RE;
+/**
+ * Return the relative path of the canonical `.deft/core/Taskfile.yml` include when
+ * present as an **active, direct** go-task `includes:` entry; otherwise null.
+ *
+ * Greenfield `directive init` deposits an include-only Taskfile (#3218); composition
+ * lives in the included framework graph, not in root `check` deps.
+ *
+ * Greptile P1 (#3218):
+ * - Path text in comments / cmds / vars / non-include keys must not match.
+ * - Only **direct** include entries count: short form `deft: path` or object form
+ *   `deft: { taskfile: path }` (immediate property). Nested
+ *   `includes.some.nested.taskfile` is not an executable go-task include.
+ * - Namespace must be `deft` so the documented `task deft:check` entrypoint exists.
+ */
+export function resolveCanonicalDeftTaskfileInclude(rootTaskfileText) {
+    const lines = rootTaskfileText.replace(/\r\n/g, "\n").split("\n");
+    let inIncludes = false;
+    let includesIndent = 0;
+    /** Indent of direct children under `includes:` (include entry keys). */
+    let directChildIndent = null;
+    /** Indent of immediate properties under the current object-form include entry. */
+    let entryBodyIndent = null;
+    /** True while inside the body of the `deft:` include entry. */
+    let inDeftEntryBody = false;
+    for (const raw of lines) {
+        const stripped = raw.trim();
+        if (!stripped || stripped.startsWith("#"))
+            continue;
+        // Full-line list comment: - # ...
+        if (/^-\s+#/.test(stripped))
+            continue;
+        const indent = raw.length - raw.trimStart().length;
+        if (!inIncludes) {
+            // Top-level includes: only (indent 0 or document-level).
+            if (/^includes\s*:/.test(stripped) && indent <= 1) {
+                inIncludes = true;
+                includesIndent = indent;
+                directChildIndent = null;
+                entryBodyIndent = null;
+                inDeftEntryBody = false;
+            }
+            continue;
+        }
+        // Left the includes block: another key at the same or shallower indent.
+        if (indent <= includesIndent && /^[\w.-]+\s*:/.test(stripped)) {
+            if (/^includes\s*:/.test(stripped)) {
+                includesIndent = indent;
+                directChildIndent = null;
+                entryBodyIndent = null;
+                inDeftEntryBody = false;
+                continue;
+            }
+            inIncludes = false;
+            directChildIndent = null;
+            entryBodyIndent = null;
+            inDeftEntryBody = false;
+            continue;
+        }
+        if (indent <= includesIndent)
+            continue;
+        if (directChildIndent === null) {
+            directChildIndent = indent;
+        }
+        // Direct include entry line (namespace key under includes:).
+        if (indent === directChildIndent) {
+            entryBodyIndent = null;
+            inDeftEntryBody = false;
+            const short = INCLUDE_DEFT_SHORT_FORM_RE.exec(stripped);
+            if (short?.[1] !== undefined && CANONICAL_DEFT_TASKFILE_PATH_RE.test(short[1])) {
+                return short[1].replace(/\\/g, "/");
+            }
+            // Object-form `deft:` entry — only this namespace exposes task deft:check.
+            if (INCLUDE_DEFT_ENTRY_START_RE.test(stripped)) {
+                inDeftEntryBody = true;
+            }
+            continue;
+        }
+        // Nested under a direct include entry: only immediate props of `deft:` count.
+        if (indent > directChildIndent && inDeftEntryBody) {
+            if (entryBodyIndent === null) {
+                entryBodyIndent = indent;
+            }
+            // Deeper than one property level → not an executable include taskfile key.
+            if (indent !== entryBodyIndent)
+                continue;
+            const m = INCLUDE_TASKFILE_KEY_RE.exec(stripped);
+            if (m?.[1] !== undefined && CANONICAL_DEFT_TASKFILE_PATH_RE.test(m[1])) {
+                return m[1].replace(/\\/g, "/");
+            }
+        }
+    }
+    return null;
+}
+/**
+ * True when a framework (included) Taskfile composes every required gate via
+ * `check` / `check:consumer` / `check:framework-source` deps or an orchestrator body,
+ * and `tasks/verify.yml` defines the local task keys.
+ */
+export function frameworkTaskfileComposesRequiredGates(frameworkTaskfileText, verifyTaskfileText, required = REQUIRED_CONSUMER_ENFORCEMENT_GATES) {
+    if (verifyTaskfileText === null || frameworkTaskfileText.trim().length === 0) {
+        return false;
+    }
+    for (const gateId of required) {
+        if (!gateId.startsWith("verify:"))
+            continue;
+        if (!taskDefinedInTaskfileYaml(verifyTaskfileText, gateId.slice("verify:".length))) {
+            return false;
+        }
+    }
+    const checkTargets = ["check", "check:consumer", "check:framework-source"];
+    for (const target of checkTargets) {
+        const deps = extractCheckDeps(frameworkTaskfileText, target);
+        const body = extractTaskBody(frameworkTaskfileText, target);
+        const defined = deps.length > 0 || body.trim().length > 0;
+        if (!defined)
+            continue;
+        if (taskBodyInvokesCheckOrchestrator(body)) {
+            return true;
+        }
+        const allListed = required.every((gateId) => {
+            for (const d of deps) {
+                const name = d.trim();
+                if (name === gateId)
+                    return true;
+                if (name === `task ${gateId}` || name === `task:${gateId}`)
+                    return true;
+            }
+            return false;
+        });
+        if (allListed)
+            return true;
+    }
+    return false;
+}
 function readText(path) {
     try {
         if (!existsSync(path))
@@ -583,12 +734,46 @@ export function evaluateConsumerCheckContract(projectRoot, options = {}) {
             }
         }
     }
+    // Include-only greenfield (#3218): root Taskfile from `directive init` only wires
+    // `includes.deft → ./.deft/core/Taskfile.yml`. Composition lives in the included
+    // framework Taskfile + tasks/verify.yml. Trust that graph when no local check
+    // aggregates are defined. A partial local check aggregate still fails closed —
+    // the include must not conceal incomplete root deps.
+    let includeComposes = false;
+    const includeRel = resolveCanonicalDeftTaskfileInclude(rootTaskfile);
+    if (includeRel !== null) {
+        let includedTf;
+        if (options.includedFrameworkTaskfileText !== undefined) {
+            includedTf = options.includedFrameworkTaskfileText;
+        }
+        else {
+            const absInclude = join(root, includeRel.replace(/^\.\//, ""));
+            includedTf = readText(absInclude);
+        }
+        let includedVerify;
+        if (options.includedVerifyTaskfileText !== undefined) {
+            includedVerify = options.includedVerifyTaskfileText;
+        }
+        else if (includedTf !== null) {
+            const includeDir = join(root, includeRel.replace(/^\.\//, "").replace(/[/\\]Taskfile\.yml$/i, ""));
+            includedVerify = readText(join(includeDir, "tasks", "verify.yml"));
+        }
+        else {
+            includedVerify = null;
+        }
+        if (includedTf !== null) {
+            includeComposes = frameworkTaskfileComposesRequiredGates(includedTf, includedVerify, required);
+        }
+    }
     // No check aggregates defined at all — still a composition gap when enforce
-    // (unless trust via whole-file orchestrator is impossible without a body).
+    // (unless trust via whole-file orchestrator, or canonical deft include composition).
     if (!anyAggregateDefined) {
-        // Preserve prior behavior for empty/missing check tasks: fail each required gate.
         const invokesAny = taskfileInvokesCheckOrchestrator(rootTaskfile);
-        if (!(invokesAny && verifyDefinesRequired)) {
+        if (includeComposes || (invokesAny && verifyDefinesRequired)) {
+            // Include-only greenfield or root orchestrator body — clean for check-task.
+        }
+        else {
+            // Preserve prior behavior for empty/missing check tasks: fail each required gate.
             for (const gateId of required) {
                 findings.push({
                     gateId,

package/dist/consumer-check-contract/index.d.ts

@@ -1,5 +1,5 @@
 /**
  * consumer-check-contract package surface (#3145).
  */
-export { type ConsumerCheckContractFinding, type ConsumerCheckContractOptions, type ConsumerCheckContractResult, evaluateConsumerCheckContract, extractCheckDeps, REQUIRED_CONSUMER_ENFORCEMENT_GATES, requiredGatesFromConsumerList, taskfileInvokesCheckOrchestrator, textReferencesGate, workflowExecutesCheck, } from "./evaluate.js";
+export { CANONICAL_DEFT_TASKFILE_INCLUDE_RE, CANONICAL_DEFT_TASKFILE_PATH_RE, type ConsumerCheckContractFinding, type ConsumerCheckContractOptions, type ConsumerCheckContractResult, evaluateConsumerCheckContract, extractCheckDeps, frameworkTaskfileComposesRequiredGates, REQUIRED_CONSUMER_ENFORCEMENT_GATES, requiredGatesFromConsumerList, resolveCanonicalDeftTaskfileInclude, taskfileInvokesCheckOrchestrator, textReferencesGate, workflowExecutesCheck, } from "./evaluate.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/consumer-check-contract/index.js

@@ -1,5 +1,5 @@
 /**
  * consumer-check-contract package surface (#3145).
  */
-export { evaluateConsumerCheckContract, extractCheckDeps, REQUIRED_CONSUMER_ENFORCEMENT_GATES, requiredGatesFromConsumerList, taskfileInvokesCheckOrchestrator, textReferencesGate, workflowExecutesCheck, } from "./evaluate.js";
+export { CANONICAL_DEFT_TASKFILE_INCLUDE_RE, CANONICAL_DEFT_TASKFILE_PATH_RE, evaluateConsumerCheckContract, extractCheckDeps, frameworkTaskfileComposesRequiredGates, REQUIRED_CONSUMER_ENFORCEMENT_GATES, requiredGatesFromConsumerList, resolveCanonicalDeftTaskfileInclude, taskfileInvokesCheckOrchestrator, textReferencesGate, workflowExecutesCheck, } from "./evaluate.js";
 //# sourceMappingURL=index.js.map

package/dist/content-contracts/skills/greptile-detector.d.ts

@@ -12,11 +12,53 @@ interface DetectResult {
     has_blocking: boolean;
 }
 export declare function parseConfidence(body: string): number | null;
+/**
+ * Extract verdict-bearing text windows from a bot rolling-summary body (#3225).
+ * Prefers Confidence Score sections and Summary:/Decision: lines over whole-body
+ * Overview tables that may *describe* advisory phrases without issuing them.
+ */
+export declare function extractAdvisoryVerdictRegions(body: string): string;
+/**
+ * True when comment body prose records an advisory should-not-merge / not-safe
+ * verdict (#3225). Code-fence regions are stripped first so detector docs do
+ * not self-trigger (#1004).
+ *
+ * Line-anchored hybrid scan (PR #3227 residuals):
+ * 1. Soft + high-signal **line-anchored** phrases in Confidence / Summary /
+ *    Decision regions (and whole body)
+ * 2. Same line-anchored high-signal set on whole body (standalone warnings)
+ * Mid-sentence residual discussion does not hard-block; conf floor still does (#3095).
+ */
+export declare function hasShouldNotMergeProse(body: string): boolean;
+/**
+ * Structured advisory verdict from bot comment body (#3225 / #1282 style).
+ * Confidence is independent of formal GitHub review state; compose with
+ * `minGreptileConfidence` (#3095) at the clean gate.
+ */
+export interface AdvisoryReviewerVerdict {
+    readonly confidence: number | null;
+    readonly shouldNotMerge: boolean;
+    readonly hasBlocking: boolean;
+}
+export declare function parseAdvisoryReviewerVerdict(body: string): AdvisoryReviewerVerdict;
 export declare function detect(body: string): DetectResult;
 export declare function parseLastReviewedShaMarkdownLink(body: string): string | null;
 export declare function parseLastReviewedShaNaiveInline(body: string): string | null;
 export declare const BODY_TIER2_P1_ONLY = "Greptile review of head 1234567\n\nConfidence Score: 4/5\n\nLast reviewed commit: [fix: foo bar](https://github.com/deftai/directive/commit/abcdef1234567)\n\nComments:\n\n- **P1 -- wrong exception type for state/limit validation in populate()**\n  The current code raises ValueError but the contract calls for InvalidRepoError.\n- **P2 -- minor wording in error message**\n  Consider `--repo` instead of `the repo flag`.\n";
 export declare const BODY_TIER3_NOT_SAFE_ONLY = "Greptile review of head 7654321\n\nConfidence Score: 3/5\n\nLast reviewed commit: [refactor: thing](https://github.com/deftai/directive/commit/0011223344556)\n\nSummary: Not safe to merge until the mocked-import test defect and the two\npreviously filed P1s are resolved.\n";
+/** #3225 live-case shape: conf 3/5 + should-not-merge prose, zero badges. */
+export declare const BODY_ADVISORY_SHOULD_NOT_MERGE_CONF3 = "Greptile review of head advisory01\n\n## Confidence Score: 3/5\n\nSummary: should-not-merge \u2014 residual risk on the auth path is too high for\nthis change set. Formal review state is still Comment (not Changes Requested).\n\nLast reviewed commit: [feat: advisory](https://github.com/deftai/directive/commit/advisory01abcdef12)\n";
+/** Green mechanical path trap: high conf but explicit do-not-merge prose. */
+export declare const BODY_ADVISORY_DO_NOT_MERGE_HIGH_CONF = "Greptile review of head advisory02\n\nConfidence Score: 5/5\n\nNo P0 or P1 issues found via badges.\n\nSummary: Do not merge until the operator documents residual risk.\n\nLast reviewed commit: [docs: note](https://github.com/deftai/directive/commit/advisory02abcdef12)\n";
+/**
+ * Overview prose names the detector phrase without issuing a verdict (#3225 residual).
+ * Confidence section is clean — must NOT set shouldNotMerge.
+ */
+export declare const BODY_ADVISORY_DESCRIPTIVE_ONLY = "Greptile review of head advisory03\n\n<details><summary><h3>Greptile Summary</h3></summary>\n\nThis PR adds should-not-merge prose detection and Not safe to merge matching to\nmerge-ready. Descriptive overview only \u2014 no blocking residual on the product path.\n\n</details>\n\n<details open><summary><h3>Confidence Score: 5/5</h3></summary>\n\nNo P0 or P1 issues found. The change looks clean and well-tested.\n\n</details>\n\nLast reviewed commit: [feat: detector](https://github.com/deftai/directive/commit/advisory03abcdef12)\n";
+/** Standalone high-signal warning outside Confidence section must still block. */
+export declare const BODY_ADVISORY_STANDALONE_NOT_SAFE = "Greptile review of head advisory04\n\n<details open><summary><h3>Confidence Score: 5/5</h3></summary>\n\nLooks solid from a findings perspective.\n\n</details>\n\nNot safe to merge until the operator confirms residual risk handling.\n\nLast reviewed commit: [feat: residual](https://github.com/deftai/directive/commit/advisory04abcdef12)\n";
+/** Subject-prefixed verdict Greptile commonly emits (#3225 residual). */
+export declare const BODY_ADVISORY_SUBJECT_PREFIXED = "Greptile review of head advisory05\n\n## Confidence Score: 4/5\n\nThe PR is not safe to merge until residual risk is documented on the auth path.\n\nLast reviewed commit: [feat: subject](https://github.com/deftai/directive/commit/advisory05abcdef12)\n";
 export declare const BODY_TIER3_COUNT_PROSE_ONLY = "Greptile review of head deadbeef\n\nConfidence Score: 4/5\n\nLast reviewed commit: [chore: bump](https://github.com/deftai/directive/commit/deadbeefcafe123)\n\nThree P1 findings (two from prior review, one new): wrong exception type for\nstate/limit validation in populate(), misleading skip message, and an\nunguarded import that will fail on Windows.\n";
 export declare const BODY_NEGATION_GUARDED = "Greptile review of head ffffffff\n\nConfidence Score: 5/5\n\nLast reviewed commit: [feat: clean](https://github.com/deftai/directive/commit/ffffffffabc1234)\n\nSummary: No P0 findings. Zero P1 findings. The PR is ready for merge.\n";
 export declare const BODY_CLEAN = "Greptile review of head 1111111\n\nConfidence Score: 5/5\n\nLast reviewed commit: [docs: tweak](https://github.com/deftai/directive/commit/1111111aaa2222b)\n\nNo P0 or P1 issues found. The change looks clean and well-tested.\n";