@deftai/directive-core 0.99.0 → 0.101.0

package/dist/authz/store.js

@@ -4,7 +4,7 @@
 import { randomBytes } from "node:crypto";
 import { existsSync, readdirSync, readFileSync, renameSync, rmSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
-import { containedWrite } from "../fs/contained-write.js";
+import { ContainedWriteError, containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { isHumanOrigin } from "./origin.js";
 import { authzAuditPath, authzGrantPath, authzGrantsDir, authzStatePath } from "./paths.js";
@@ -105,6 +105,13 @@ function parseScope(raw) {
         storyIds: readStringArray(rec.storyIds ?? rec.story_ids),
         issueIds: readNumberArray(rec.issueIds ?? rec.issue_ids),
         cohortId: readString(rec, "cohortId") ?? readString(rec, "cohort_id"),
+        // #3239 structural decompose apply bindings (snake_case accepted on load).
+        contentDigest: readString(rec, "contentDigest") ??
+            readString(rec, "content_digest") ??
+            readString(rec, "draftDigest") ??
+            readString(rec, "draft_digest"),
+        parentPath: readString(rec, "parentPath") ?? readString(rec, "parent_path"),
+        targetPath: readString(rec, "targetPath") ?? readString(rec, "target_path"),
     };
 }
 function parseSemantics(raw) {
@@ -233,6 +240,217 @@ export function markGrantUsed(projectRoot, grantId, now = new Date()) {
     saveGrant(projectRoot, used);
     return used;
 }
+function isProcessAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err.code;
+        // ESRCH → dead. EPERM → exists but unsignalable — treat as alive (never reclaim).
+        if (code === "EPERM")
+            return true;
+        return false;
+    }
+}
+/**
+ * Whether a claim lock may be reclaimed after a crashed holder (#3239).
+ * Live owner PIDs are never reclaimed (no mtime-only steal of a live critical section).
+ * Corrupt / unreadable records are reclaimable; PID-reuse residual needs manual delete.
+ */
+export function isGrantClaimLockReclaimable(rec) {
+    if (rec === null)
+        return true;
+    return !isProcessAlive(rec.pid);
+}
+function readGrantClaimLockRecord(lockPath) {
+    try {
+        const raw = readFileSync(lockPath, "utf8").trim();
+        // JSON form (current). Legacy: "pid\niso\n" lines from earlier #3239 revisions.
+        if (raw.startsWith("{")) {
+            const parsed = JSON.parse(raw);
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+                return null;
+            const o = parsed;
+            const pid = typeof o.pid === "number" ? o.pid : Number(o.pid);
+            const startedAt = typeof o.startedAt === "string" ? o.startedAt : "";
+            const token = typeof o.token === "string" ? o.token : "";
+            if (!Number.isFinite(pid) || token.length === 0)
+                return null;
+            return { pid, startedAt, token };
+        }
+        const lines = raw.split(/\r?\n/);
+        const pid = Number(lines[0]);
+        if (!Number.isFinite(pid))
+            return null;
+        return {
+            pid,
+            startedAt: typeof lines[1] === "string" ? lines[1] : "",
+            token: "legacy",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Claim a single-use grant for structural apply (#3239).
+ *
+ * Concurrent-safe + failure-safe order when `apply` is provided:
+ *   exclusive lock → re-load → revalidate → mark single-use usedAt → apply (writes)
+ *   → on apply throw: rollback usedAt + release lock (grant reusable for retry).
+ * Multi-use grants run apply (if any) without mutating usedAt.
+ * Without `apply`, single-use is marked under the lock (claim-only / test path).
+ *
+ * Crash after mark + before rollback: grant stays spent (no double-apply); operator remints.
+ * Dead-PID / corrupt locks reclaim via **rename-away** of the old lock path (only one
+ * renamer wins) then exclusive create — never blind rmSync of a live winner's lock.
+ * Live PIDs are never reclaimed. PID-reuse residual: operator deletes the lock file.
+ */
+export function claimSingleUseGrantForApply(projectRoot, grantId, options = {}) {
+    // Back-compat: second arg was `now: Date` in the first #3239 revision.
+    const opts = options instanceof Date ? { now: options } : options;
+    const now = opts.now ?? new Date();
+    const usedAtIso = utcIso(now);
+    const safe = grantId.replace(/[^a-zA-Z0-9._-]/g, "_");
+    const root = resolve(projectRoot);
+    const lockRel = join(".deft", "authz", "locks", `${safe}.lock`);
+    const lockPath = join(root, lockRel);
+    const lockToken = randomBytes(8).toString("hex");
+    const lockBody = `${JSON.stringify({
+        pid: process.pid,
+        startedAt: usedAtIso,
+        token: lockToken,
+    })}\n`;
+    const tryCreateLock = () => {
+        try {
+            containedWrite({
+                root,
+                target: lockPath,
+                data: lockBody,
+                mode: "create",
+            });
+            return true;
+        }
+        catch (err) {
+            if (err instanceof ContainedWriteError && err.code === "CONTAINED_WRITE_EXISTS") {
+                return false;
+            }
+            // Other containment/IO failures fail closed as reservation denial.
+            return false;
+        }
+    };
+    /** True when the on-disk lock still carries our token (not stolen mid-section). */
+    const stillOwnLock = () => {
+        const rec = readGrantClaimLockRecord(lockPath);
+        return rec !== null && rec.token === lockToken && rec.pid === process.pid;
+    };
+    let locked = tryCreateLock();
+    if (!locked) {
+        // Dead-PID / corrupt reclaim: rename the old lock aside (atomic contention) then create.
+        // Blind rmSync is forbidden — a second reclaimer must not delete a winner's new lock.
+        const existing = readGrantClaimLockRecord(lockPath);
+        if (isGrantClaimLockReclaimable(existing)) {
+            const side = `${lockPath}.reclaim.${randomBytes(6).toString("hex")}`;
+            try {
+                renameSync(lockPath, side);
+                try {
+                    rmSync(side, { force: true });
+                }
+                catch {
+                    /* best-effort side cleanup */
+                }
+            }
+            catch {
+                // Lost rename race or lock already gone — fall through to exclusive create.
+            }
+            locked = tryCreateLock();
+        }
+    }
+    if (!locked) {
+        return {
+            ok: false,
+            reason: `Directive denied scope:decompose apply: grant ${grantId} is already reserved ` +
+                "or spent by a concurrent apply. Human action required: remint if the prior apply failed " +
+                "(or remove a leftover `.deft/authz/locks/<id>.lock` after a dead-holder crash if reclaim fails).",
+        };
+    }
+    let markedUsedAt = null;
+    try {
+        const grant = loadGrant(projectRoot, grantId);
+        if (grant === null) {
+            return {
+                ok: false,
+                reason: `Directive denied scope:decompose apply: grant ${grantId} missing.`,
+            };
+        }
+        if (opts.revalidate !== undefined) {
+            const check = opts.revalidate(grant);
+            if (!check.ok) {
+                return { ok: false, reason: check.reason };
+            }
+        }
+        if (!grant.semantics.singleUse) {
+            if (opts.apply !== undefined) {
+                opts.apply(grant);
+            }
+            return { ok: true, grant };
+        }
+        if (grant.semantics.usedAt !== null) {
+            return {
+                ok: false,
+                reason: `Directive denied scope:decompose apply: single-use grant ${grantId} already spent at ` +
+                    `${grant.semantics.usedAt}.`,
+            };
+        }
+        // Spend under lock before protected writes so a post-write mark failure cannot
+        // leave completed mutations behind an unspent single-use grant (#3239 Greptile).
+        // Apply throw rolls usedAt back while the lock is still held (retry-safe).
+        const used = {
+            ...grant,
+            semantics: {
+                ...grant.semantics,
+                usedAt: usedAtIso,
+            },
+        };
+        saveGrant(projectRoot, used);
+        markedUsedAt = usedAtIso;
+        if (opts.apply !== undefined) {
+            try {
+                opts.apply(used);
+            }
+            catch (applyErr) {
+                // Rollback spend so a failed multi-file apply does not strand the approval.
+                const current = loadGrant(projectRoot, grantId);
+                if (current?.semantics.singleUse && current.semantics.usedAt === markedUsedAt) {
+                    const restored = {
+                        ...current,
+                        semantics: { ...current.semantics, usedAt: null },
+                    };
+                    saveGrant(projectRoot, restored);
+                    markedUsedAt = null;
+                }
+                throw applyErr;
+            }
+        }
+        if (!stillOwnLock()) {
+            return {
+                ok: false,
+                reason: `Directive denied scope:decompose apply: grant ${grantId} lock ownership lost mid-claim. ` +
+                    "Human action required: inspect partial outputs and remint if needed.",
+            };
+        }
+        return { ok: true, grant: used };
+    }
+    finally {
+        // Only remove the lock when we still own it — never delete a successor's claim.
+        if (stillOwnLock()) {
+            rmSync(lockPath, { force: true });
+        }
+    }
+}
 export function saveAuthzState(projectRoot, state) {
     writeJsonContained(projectRoot, authzStatePath(projectRoot), state);
 }

package/dist/authz/types.d.ts

@@ -5,8 +5,10 @@
  * agent authors must not independently satisfy implementation-approval gates.
  * Local-file forgery by a credential-compromised agent remains #983-class OOS.
  */
-/** Operation classes bound on a grant (Wave 1 structural binding + Wave 4 closed verbs). */
-export declare const AUTHZ_OPERATIONS: readonly ["edit", "push", "pr", "merge", "settings", "deployment", "issue_mutation", "release-cut", "release-publish", "release-rollback"];
+/** Structural apply op for scope:decompose (#3239 / epic #3237 Q2). Always gated. */
+export declare const SCOPE_DECOMPOSE_APPLY_STRUCTURAL: "scope.decompose.apply.structural";
+/** Operation classes bound on a grant (Wave 1 structural binding + Wave 4 closed verbs + #3239). */
+export declare const AUTHZ_OPERATIONS: readonly ["edit", "push", "pr", "merge", "settings", "deployment", "issue_mutation", "release-cut", "release-publish", "release-rollback", "scope.decompose.apply.structural"];
 export type AuthzOperation = (typeof AUTHZ_OPERATIONS)[number];
 /**
  * Human-origin kinds accepted as approval provenance.
@@ -41,6 +43,21 @@ export interface GrantScope {
      * for product mutations; approving one cohort does not clear UAT.
      */
     readonly cohortId: string | null;
+    /**
+     * SHA-256 hex of exact bound artifact bytes (decompose draft for #3239).
+     * Unset/null = unbound (cannot satisfy structural decompose apply).
+     */
+    readonly contentDigest?: string | null;
+    /**
+     * Project-relative parent artifact path for structural decompose apply (#3239).
+     * Unset/null = unbound.
+     */
+    readonly parentPath?: string | null;
+    /**
+     * Project-relative draft/target path for structural decompose apply (#3239).
+     * Unset/null = unbound.
+     */
+    readonly targetPath?: string | null;
 }
 export interface GrantSemantics {
     readonly expiresAt: string | null;

package/dist/authz/types.js

@@ -5,7 +5,9 @@
  * agent authors must not independently satisfy implementation-approval gates.
  * Local-file forgery by a credential-compromised agent remains #983-class OOS.
  */
-/** Operation classes bound on a grant (Wave 1 structural binding + Wave 4 closed verbs). */
+/** Structural apply op for scope:decompose (#3239 / epic #3237 Q2). Always gated. */
+export const SCOPE_DECOMPOSE_APPLY_STRUCTURAL = "scope.decompose.apply.structural";
+/** Operation classes bound on a grant (Wave 1 structural binding + Wave 4 closed verbs + #3239). */
 export const AUTHZ_OPERATIONS = [
     "edit",
     "push",
@@ -18,6 +20,8 @@ export const AUTHZ_OPERATIONS = [
     "release-cut",
     "release-publish",
     "release-rollback",
+    /** Human-origin exact-draft-digest gate for scope:decompose apply (#3239). */
+    SCOPE_DECOMPOSE_APPLY_STRUCTURAL,
 ];
 /**
  * Human-origin kinds accepted as approval provenance.

package/dist/check/cached-orchestrator.d.ts

@@ -1,4 +1,5 @@
 import type { TaskRunResult } from "../cache/task-cache/types.js";
+import { type ToolchainPreflightResult } from "../session/toolchain-preflight.js";
 import { type CheckOrchestratorSeams } from "./context.js";
 export interface CachedCheckOptions extends CheckOrchestratorSeams {
     readonly onGateStart?: (gateId: string) => void;
@@ -6,16 +7,36 @@ export interface CachedCheckOptions extends CheckOrchestratorSeams {
     readonly gateSpawnFn?: (gateId: string, taskBin: string, taskArgs: string[], opts: {
         cwd: string;
         env?: NodeJS.ProcessEnv;
-    }) => Pick<TaskRunResult, "exitCode" | "stdout" | "stderr">;
+    }) => Pick<TaskRunResult, "exitCode" | "stdout" | "stderr"> & {
+        spawnError?: string;
+    };
+    /**
+     * #3282: inject preflight (tests). When omitted, runs live toolchain preflight.
+     * Pass `null` to skip preflight entirely (legacy test paths).
+     */
+    readonly preflight?: ToolchainPreflightResult | null;
+    /** #3282: session id for run-summary lines (default: new UUID). */
+    readonly sessionId?: string;
+    /** #3282: disable run-summary emission (tests). */
+    readonly emitRunSummary?: boolean;
 }
 /**
  * Run check gates sequentially with content-hash caching (#1713).
  * Falls back to fail-open execution for undeclared / non-cacheable gates.
  *
- * Gate order is fast-before-slow (#3188): non-suite gates complete (or fail)
- * before any suite gate (`ts:check-lane` / vitest+coverage) is started. A
- * non-zero exit aborts the loop immediately — the suite never starts after a
- * fast-gate failure (observable via `onGateStart` / suite start log).
+ * Gate order (#3284 / #3188):
+ *  1. Product AC (`verify:ac`) first — fail-fast; never skippable when commands exist
+ *  2. Hygiene preflight (may be advisory under pressure / degraded)
+ *  3. Suite last (`ts:check-lane`)
+ *
+ * Modes (env / ceremony dial / hard budget — see resolveProductFirstCheckMode):
+ *  - full: AC hard → hygiene hard → suite
+ *  - pressure: AC hard → hygiene advisory → suite
+ *  - rapid: AC only (ceremony dial rapid/minimal positive content)
+ *
+ * #3282: toolchain preflight enables degraded skip report when go-task/pnpm
+ * are missing; gate failures print named cause + remedy; run-summary JSONL
+ * is appended when DEFT_RUN_SUMMARY_PATH is set (fail-open).
  */
 export declare function dispatchCachedTaskCheck(frameworkRoot: string, projectRoot: string, options?: CachedCheckOptions): number;
 //# sourceMappingURL=cached-orchestrator.d.ts.map

package/dist/check/cached-orchestrator.js

@@ -1,30 +1,60 @@
 import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { join, resolve } from "node:path";
 import { lintShippedRegistry, resolveTaskContract, runWithCache, } from "../cache/task-cache/index.js";
 import { readCorePackageVersion } from "../engine-version.js";
+import { applyProductFirstGateMode, isHygieneGate, isProductAcGate, resolveProductFirstCheckMode, } from "../product-first-done-gate/index.js";
+import { RunSummaryEmitter } from "../run-summary/emit.js";
+import { runToolchainPreflight, SKIP_ALL_GATES, } from "../session/toolchain-preflight.js";
 import { evaluateConsumerGateIntegrity, formatConsumerGateIntegrityFailure, } from "./consumer-gate-integrity.js";
 import { resolveCheckTarget } from "./context.js";
 import { checkGateId, checkGateSpawnArgs, gatesForCheckTarget, isSuiteCheckGate, } from "./gate-lists.js";
+import { formatDegradedSkipReport, formatNamedCauseFailure, remedyForGate } from "./named-cause.js";
 function captureSpawn(taskBin, args, opts) {
     const result = spawnSync(taskBin, args, {
         cwd: opts.cwd,
         encoding: "utf8",
         env: opts.env ?? process.env,
     });
+    if (result.error !== undefined) {
+        return {
+            exitCode: result.status ?? 1,
+            stdout: result.stdout ?? "",
+            stderr: result.stderr ?? "",
+            spawnError: result.error.message,
+        };
+    }
     return {
         exitCode: result.status ?? 1,
         stdout: result.stdout ?? "",
         stderr: result.stderr ?? "",
     };
 }
+function writeLines(lines, stream = "stderr") {
+    const write = stream === "stdout"
+        ? process.stdout.write.bind(process.stdout)
+        : process.stderr.write.bind(process.stderr);
+    for (const line of lines) {
+        write(`${line}\n`);
+    }
+}
 /**
  * Run check gates sequentially with content-hash caching (#1713).
  * Falls back to fail-open execution for undeclared / non-cacheable gates.
  *
- * Gate order is fast-before-slow (#3188): non-suite gates complete (or fail)
- * before any suite gate (`ts:check-lane` / vitest+coverage) is started. A
- * non-zero exit aborts the loop immediately — the suite never starts after a
- * fast-gate failure (observable via `onGateStart` / suite start log).
+ * Gate order (#3284 / #3188):
+ *  1. Product AC (`verify:ac`) first — fail-fast; never skippable when commands exist
+ *  2. Hygiene preflight (may be advisory under pressure / degraded)
+ *  3. Suite last (`ts:check-lane`)
+ *
+ * Modes (env / ceremony dial / hard budget — see resolveProductFirstCheckMode):
+ *  - full: AC hard → hygiene hard → suite
+ *  - pressure: AC hard → hygiene advisory → suite
+ *  - rapid: AC only (ceremony dial rapid/minimal positive content)
+ *
+ * #3282: toolchain preflight enables degraded skip report when go-task/pnpm
+ * are missing; gate failures print named cause + remedy; run-summary JSONL
+ * is appended when DEFT_RUN_SUMMARY_PATH is set (fail-open).
  */
 export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}) {
     const resolvedFramework = resolve(frameworkRoot);
@@ -33,8 +63,41 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
     const taskBin = options.taskBin ?? "task";
     const target = resolveCheckTarget(resolvedFramework, resolvedProject);
     const cwd = target === "check:framework-source" ? resolvedFramework : resolvedProject;
-    const gates = gatesForCheckTarget(target);
+    const modeResolution = resolveProductFirstCheckMode({
+        environ: options.env ?? process.env,
+        projectRoot: resolvedProject,
+    });
+    const baseGates = gatesForCheckTarget(target);
+    const gates = applyProductFirstGateMode(baseGates, modeResolution.mode, checkGateId);
     const codeVersion = readCorePackageVersion();
+    const sessionId = options.sessionId ?? randomUUID();
+    const gateOutcomes = [];
+    const emitSummary = (exitCode, degraded) => {
+        if (options.emitRunSummary === false)
+            return;
+        try {
+            const emitter = new RunSummaryEmitter({
+                projectRoot: resolvedProject,
+                sessionId,
+                frameworkVersion: codeVersion,
+                env: options.env,
+            });
+            emitter.emitCheckInvocation({
+                target,
+                exit_code: exitCode,
+                degraded,
+                gates: gateOutcomes,
+            });
+        }
+        catch {
+            // fail-open
+        }
+    };
+    if (modeResolution.mode !== "full") {
+        process.stderr.write(`check: product-first mode=${modeResolution.mode} ` +
+            `(sources=${modeResolution.sources.join(",")}; ` +
+            `hygieneAdvisory=${modeResolution.hygieneAdvisory}; acOnly=${modeResolution.acOnly}) (#3284)\n`);
+    }
     // #3070: fail loud with deposit-repair guidance when consumer check-graph
     // includes (e.g. tasks/verify.yml for verify:orphan-active) are missing,
     // instead of opaque go-task "Task does not exist" exit 200/201.
@@ -42,6 +105,7 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
         const integrity = evaluateConsumerGateIntegrity(resolvedFramework);
         if (!integrity.ok) {
             process.stderr.write(formatConsumerGateIntegrityFailure(integrity));
+            emitSummary(2, false);
             return 2;
         }
     }
@@ -50,22 +114,86 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
         for (const finding of registryLint.findings.filter((f) => f.kind === "under-declared-input")) {
             process.stderr.write(`check: task registry lint failed for ${finding.taskId}: ${finding.detail}\n`);
         }
+        emitSummary(2, false);
         return 2;
     }
     if (gates.length === 0) {
         process.stderr.write(`check: no gate list for target ${target}\n`);
+        emitSummary(2, false);
         return 2;
     }
+    // #3282: toolchain preflight — degraded skip when framework tools missing.
+    const preflight = options.preflight === undefined
+        ? runToolchainPreflight({
+            projectRoot: resolvedProject,
+            frameworkRoot: resolvedFramework,
+        })
+        : options.preflight;
+    // Expand SKIP_ALL_GATES sentinel to the live composition (avoids hardcode drift).
+    const skipSet = new Set();
+    for (const id of preflight?.skipGateIds ?? []) {
+        if (id === SKIP_ALL_GATES) {
+            for (const g of gates) {
+                skipSet.add(checkGateId(g));
+            }
+        }
+        else {
+            skipSet.add(id);
+        }
+    }
+    const degraded = preflight?.degraded === true;
+    if (preflight?.degraded) {
+        for (const line of preflight.lines) {
+            process.stderr.write(`${line}\n`);
+        }
+    }
+    // When task/node are missing, every gate is skipped — report named skips and
+    // exit 2 (config/environment), never exit 0 green (#3282 Greptile P1).
+    // Missing framework tooling must not look like a clean product pass.
+    if (degraded && skipSet.size > 0) {
+        const allSkipped = gates.every((g) => skipSet.has(checkGateId(g)));
+        if (allSkipped) {
+            const skipped = gates.map((g) => {
+                const id = checkGateId(g);
+                const cause = preflight?.findings.find((f) => !f.present)?.cause ?? "toolchain preflight degraded";
+                const remedy = preflight?.findings.find((f) => !f.present)?.remedy ?? remedyForGate(id, cause);
+                gateOutcomes.push({ id, status: "skipped", cause, remedy });
+                return { id, cause, remedy };
+            });
+            writeLines(formatDegradedSkipReport({
+                reason: "done-gate toolchain incomplete at check start",
+                skipped,
+                exitCode: 2,
+            }));
+            emitSummary(2, true);
+            return 2;
+        }
+    }
     for (const gateSpec of gates) {
         const gateId = checkGateId(gateSpec);
+        // #3282: skip gates that require missing tools (e.g. pnpm-only suite).
+        if (skipSet.has(gateId)) {
+            const missing = preflight?.findings.find((f) => !f.present);
+            const cause = missing?.cause ?? "toolchain preflight marked gate skippable";
+            const remedy = missing?.remedy ?? remedyForGate(gateId, cause);
+            process.stderr.write(`check: skipping gate ${gateId} (degraded) — cause: ${cause}; remedy: ${remedy}\n`);
+            gateOutcomes.push({ id: gateId, status: "skipped", cause, remedy });
+            options.onGateStart?.(gateId);
+            options.onGateComplete?.(gateId, 0, false);
+            continue;
+        }
         // #3188: log suite entry so operators/tests can prove fast failures never
         // reach vitest+coverage (suite gates are ordered last in gate-lists).
         if (isSuiteCheckGate(gateSpec)) {
             process.stderr.write(`check: starting suite gate ${gateId} after fast preflight (#3188)\n`);
         }
+        if (isProductAcGate(gateId)) {
+            process.stderr.write(`check: product AC gate ${gateId} first (#3284)\n`);
+        }
         options.onGateStart?.(gateId);
         const contract = resolveTaskContract(gateId);
         const taskArgs = checkGateSpawnArgs(gateSpec, taskfilePath);
+        let lastSpawn = { exitCode: 0, stdout: "", stderr: "" };
         const result = runWithCache({
             projectRoot: cwd,
             contract,
@@ -78,6 +206,12 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
                         env: options.env,
                     })
                     : captureSpawn(taskBin, taskArgs, { cwd, env: options.env });
+                lastSpawn = {
+                    exitCode: spawned.exitCode,
+                    stdout: spawned.stdout,
+                    stderr: spawned.stderr,
+                    spawnError: "spawnError" in spawned ? spawned.spawnError : undefined,
+                };
                 if (spawned.stdout.length > 0) {
                     process.stdout.write(spawned.stdout);
                 }
@@ -88,17 +222,105 @@ export function dispatchCachedTaskCheck(frameworkRoot, projectRoot, options = {}
             },
         });
         options.onGateComplete?.(gateId, result.exitCode, result.fromCache);
-        // Fail-fast: do not start later gates (including suite) after a failure.
+        // Fail-fast: do not start later gates (including suite) after a failure —
+        // unless this is a hygiene gate under pressure mode (advisory only, #3284).
         if (result.exitCode !== 0) {
+            if (modeResolution.hygieneAdvisory && isHygieneGate(gateId) && !isProductAcGate(gateId)) {
+                process.stderr.write(`check: hygiene gate ${gateId} failed (exit ${result.exitCode}) but is ADVISORY ` +
+                    `under ${modeResolution.mode} mode — continuing (#3284)\n`);
+                const named = formatNamedCauseFailure({
+                    gateId,
+                    exitCode: result.exitCode,
+                    stdout: lastSpawn.stdout,
+                    stderr: lastSpawn.stderr,
+                    spawnError: lastSpawn.spawnError,
+                });
+                writeLines(named.lines);
+                gateOutcomes.push({
+                    id: gateId,
+                    status: "run",
+                    exit_code: result.exitCode,
+                    cause: `advisory hygiene failure: ${named.cause}`,
+                    remedy: named.remedy,
+                    from_cache: result.fromCache,
+                });
+                continue;
+            }
+            const named = formatNamedCauseFailure({
+                gateId,
+                exitCode: result.exitCode,
+                stdout: lastSpawn.stdout,
+                stderr: lastSpawn.stderr,
+                spawnError: lastSpawn.spawnError,
+            });
+            writeLines(named.lines);
+            gateOutcomes.push({
+                id: gateId,
+                status: "failed",
+                exit_code: result.exitCode,
+                cause: named.cause,
+                remedy: named.remedy,
+                from_cache: result.fromCache,
+            });
+            // Mark remaining as skipped for the summary (not run).
+            let sawCurrent = false;
+            for (const later of gates) {
+                const id = checkGateId(later);
+                if (!sawCurrent) {
+                    if (id === gateId)
+                        sawCurrent = true;
+                    continue;
+                }
+                if (!gateOutcomes.some((o) => o.id === id)) {
+                    gateOutcomes.push({
+                        id,
+                        status: "skipped",
+                        cause: `skipped after ${gateId} failed`,
+                        remedy: "Fix the failed gate above, then re-run task check",
+                    });
+                }
+            }
+            if (isProductAcGate(gateId)) {
+                process.stderr.write(`check: product AC gate ${gateId} failed (exit ${result.exitCode}); ` +
+                    `failing closed before hygiene (#3284)\n`);
+                emitSummary(result.exitCode, degraded);
+                return result.exitCode;
+            }
             if (!isSuiteCheckGate(gateSpec)) {
                 const remaining = gates.some(isSuiteCheckGate)
                     ? "skipping remaining gates including suite"
                     : "skipping remaining gates";
                 process.stderr.write(`check: fast gate ${gateId} failed (exit ${result.exitCode}); ${remaining} (#3188)\n`);
             }
+            emitSummary(result.exitCode, degraded);
             return result.exitCode;
         }
+        gateOutcomes.push({
+            id: gateId,
+            status: "run",
+            exit_code: 0,
+            from_cache: result.fromCache,
+        });
+    }
+    // Partial degraded (some gates skipped for pnpm, others ran): never report a
+    // green pass when required suite/toolchain gates were skipped (#3282 Greptile P1).
+    const skippedOutcomes = gateOutcomes.filter((o) => o.status === "skipped");
+    if (degraded && skippedOutcomes.length > 0) {
+        const skipped = skippedOutcomes.map((o) => ({
+            id: o.id,
+            cause: o.cause ?? "degraded",
+            remedy: o.remedy ?? remedyForGate(o.id, o.cause ?? "degraded"),
+        }));
+        writeLines(formatDegradedSkipReport({
+            reason: "partial toolchain; skipped gates did not run",
+            skipped,
+            ran: gateOutcomes.filter((o) => o.status === "run").map((o) => o.id),
+            exitCode: 2,
+        }));
+        emitSummary(2, true);
+        return 2;
     }
+    emitSummary(0, degraded);
     return 0;
 }
 //# sourceMappingURL=cached-orchestrator.js.map