@deftai/directive-runtime 0.129.3 → 0.129.5

package/vendor/directive-core/dist/pr-wait-mergeable/semantic-green.js

@@ -1,7 +1,12 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseSkippedTestsBlock } from "../check/gate-lists.js";
+import { readPlanPolicy } from "../policy/plan-extensions.js";
 import { resolveLifecycleDirty, shasMatch, } from "../pr-closeout-attestable/pr-head-assert.js";
 import { buildCiSummaryLine, evaluateCiGate } from "../pr-merge-readiness/ci-gate.js";
 import { defaultRunGh, fetchCheckRunsRest } from "../pr-merge-readiness/gh.js";
-import { EXIT_CONFIG_ERROR, EXIT_TIMEOUT_OR_ESCALATION } from "./constants.js";
+import { DEFAULT_MAX_WAIT_MINUTES } from "../pr-watch/constants.js";
+import { EXIT_CONFIG_ERROR, EXIT_TIMEOUT_OR_ESCALATION, FIRST_HOTFIX_BOOTSTRAP_RECOVERY, HOTFIX_LABEL, HOTFIX_SHAPE_A_RE, HOTFIX_SHAPE_B_ISSUE_REPO, HOTFIX_SHAPE_B_RE, MERGE_GATE_TASK_CHECK_NAME, OUTCOME_FIRST_HOTFIX_BOOTSTRAP, OUTCOME_HOTFIX_ACTOR_DENIED, OUTCOME_HOTFIX_SHAPE_INVALID, OUTCOME_MASTER_MERGE_GATE_RED, } from "./constants.js";
 /** Machine-checkable candidate validation attestation (#4888 Prefer-A Bound). */
 export const CANDIDATE_VALIDATION_SCHEMA = "deft.semantic-green.candidate-validation.v1";
 /** Named merge-chokepoint probes admitted for candidate attestation (#4888). */
@@ -63,6 +68,7 @@ function emptyPayload() {
         target_head_sha: null,
         master_ci: {},
         candidate_validation: null,
+        named_merge_gate: null,
     };
 }
 function fetchPrShas(prNumber, repo, runGh) {
@@ -427,15 +433,50 @@ function evaluateCandidateValidationLimb(prNumber, repo, options, runGh) {
 }
 /** Pre-merge semantic-green gate for merge cascades (#2385) and non-cascade candidate validation (#4888). */
 export function evaluateSemanticGreen(prNumber, repo, options = {}) {
+    const runGh = options.runGh ?? defaultRunGh;
+    // #6071 always-on named Merge gate — independent of cascadeMode / requireMasterCiGreen.
+    if (options.skipNamedMergeGate !== true) {
+        const named = evaluateAlwaysOnNamedMergeGate(prNumber, repo, {
+            runGh,
+            baseBranch: options.baseBranch,
+            pendingTimeoutMinutes: options.namedMergeGatePendingTimeoutMinutes,
+            nowMs: options.namedMergeGateNowMs,
+            tipSha: options.namedMergeGateTipSha,
+            checkRuns: options.namedMergeGateCheckRuns,
+            hotfixAdmission: options.hotfixAdmission,
+            projectRoot: options.projectRoot,
+            maintainerLogins: options.maintainerLogins,
+            env: options.env,
+            firstHotfixBootstrap: options.firstHotfixBootstrap,
+        });
+        if (!named.ok) {
+            return {
+                ok: false,
+                outcome: named.outcome,
+                exitCode: named.exitCode,
+                error: named.error,
+                payload: {
+                    ...emptyPayload(),
+                    target_head_sha: named.status.tipSha,
+                    named_merge_gate: {
+                        disposition: named.status.disposition,
+                        tip_sha: named.status.tipSha,
+                        check_name: named.status.checkName,
+                        status: named.status.status,
+                        conclusion: named.status.conclusion,
+                        hotfix: named.hotfix,
+                    },
+                },
+            };
+        }
+    }
     // Non-cascade candidate-validation limb (#4888). Does not replace cascade absolute refusal.
     if (options.cascadeMode !== true && options.requireCandidateValidation === true) {
-        const runGh = options.runGh ?? defaultRunGh;
         return evaluateCandidateValidationLimb(prNumber, repo, options, runGh);
     }
     if (options.cascadeMode !== true) {
         return { ok: true, outcome: null, exitCode: null, error: null, payload: emptyPayload() };
     }
-    const runGh = options.runGh ?? defaultRunGh;
     const prBase = fetchPrShas(prNumber, repo, runGh);
     if (prBase.error !== null) {
         return {
@@ -554,4 +595,647 @@ export function evaluateNonCascadeCandidateGreen(prNumber, repo, options = {}) {
         requireCandidateValidation: true,
     });
 }
+const PENDING_NAMED_STATUSES = new Set(["queued", "in_progress"]);
+const HOTFIX_MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER"]);
+function emptyNamedStatus(tipSha = null) {
+    return {
+        disposition: "api_fail",
+        tipSha,
+        checkName: MERGE_GATE_TASK_CHECK_NAME,
+        status: null,
+        conclusion: null,
+        error: null,
+        pendingAgeMs: null,
+    };
+}
+function isNoNetwork(env) {
+    return (env ?? process.env).DEFT_NO_NETWORK === "1";
+}
+/** Pick the latest check-run for the exact named gate (#6071). */
+export function selectNamedMergeGateRun(checkRuns) {
+    let best = null;
+    let bestTs = -1;
+    for (const run of checkRuns) {
+        if (run.name !== MERGE_GATE_TASK_CHECK_NAME) {
+            continue;
+        }
+        const tsRaw = run.started_at ?? run.created_at ?? null;
+        const ts = tsRaw !== null ? Date.parse(tsRaw) : 0;
+        const score = Number.isFinite(ts) ? ts : 0;
+        if (best === null || score >= bestTs) {
+            best = run;
+            bestTs = score;
+        }
+    }
+    return best;
+}
+export function evaluateNamedMergeGateFromRuns(tipSha, checkRuns, options = {}) {
+    const run = selectNamedMergeGateRun(checkRuns);
+    if (run === null) {
+        return {
+            disposition: "missing",
+            tipSha,
+            checkName: MERGE_GATE_TASK_CHECK_NAME,
+            status: null,
+            conclusion: null,
+            error: `Exact check name ${JSON.stringify(MERGE_GATE_TASK_CHECK_NAME)} absent on tip ${tipSha}; fail closed (#6071).`,
+            pendingAgeMs: null,
+        };
+    }
+    if (run.conclusion === "skipped" && run.status === "completed") {
+        return {
+            disposition: "skipped",
+            tipSha,
+            checkName: MERGE_GATE_TASK_CHECK_NAME,
+            status: run.status,
+            conclusion: run.conclusion,
+            error: `${MERGE_GATE_TASK_CHECK_NAME} concluded skipped on tip ${tipSha}; fail closed (#6071).`,
+            pendingAgeMs: null,
+        };
+    }
+    const pending = PENDING_NAMED_STATUSES.has(run.status) ||
+        (run.status !== "completed" && (run.conclusion === "none" || run.conclusion === ""));
+    if (pending) {
+        const startRaw = run.started_at ?? run.created_at ?? null;
+        const startMs = startRaw !== null ? Date.parse(startRaw) : NaN;
+        const nowMs = options.nowMs ?? Date.now();
+        const ageMs = Number.isFinite(startMs) ? Math.max(0, nowMs - startMs) : null;
+        const budgetMs = (options.pendingTimeoutMinutes ?? DEFAULT_MAX_WAIT_MINUTES) * 60_000;
+        if (ageMs === null || ageMs >= budgetMs) {
+            return {
+                disposition: "pending",
+                tipSha,
+                checkName: MERGE_GATE_TASK_CHECK_NAME,
+                status: run.status,
+                conclusion: run.conclusion,
+                error: `${MERGE_GATE_TASK_CHECK_NAME} still pending past timeout on tip ${tipSha}; fail closed (#6071).`,
+                pendingAgeMs: ageMs,
+            };
+        }
+        return {
+            disposition: "pending",
+            tipSha,
+            checkName: MERGE_GATE_TASK_CHECK_NAME,
+            status: run.status,
+            conclusion: run.conclusion,
+            error: `${MERGE_GATE_TASK_CHECK_NAME} still pending on tip ${tipSha}; fail closed until completed success (#6071).`,
+            pendingAgeMs: ageMs,
+        };
+    }
+    if (run.status === "completed" && run.conclusion === "success") {
+        return {
+            disposition: "green",
+            tipSha,
+            checkName: MERGE_GATE_TASK_CHECK_NAME,
+            status: run.status,
+            conclusion: run.conclusion,
+            error: null,
+            pendingAgeMs: null,
+        };
+    }
+    return {
+        disposition: "red",
+        tipSha,
+        checkName: MERGE_GATE_TASK_CHECK_NAME,
+        status: run.status,
+        conclusion: run.conclusion,
+        error: `${MERGE_GATE_TASK_CHECK_NAME} is ${run.status}/${run.conclusion} on tip ${tipSha}; ` +
+            "ordinary merges refused until green or an admitted hotfix A/B (#6071).",
+        pendingAgeMs: null,
+    };
+}
+export function parseHotfixShape(body) {
+    // Fresh global regexes — .test/.exec mutate lastIndex on shared constants (#6071).
+    const aMatches = body.match(new RegExp(HOTFIX_SHAPE_A_RE.source, "gm")) ?? [];
+    const bMatches = [...body.matchAll(new RegExp(HOTFIX_SHAPE_B_RE.source, "gm"))];
+    const total = aMatches.length + bMatches.length;
+    if (total === 0) {
+        return { shape: null, skipIssue: null, ambiguous: false };
+    }
+    if (total > 1) {
+        return { shape: null, skipIssue: null, ambiguous: true };
+    }
+    if (aMatches.length === 1) {
+        return { shape: "A", skipIssue: null, ambiguous: false };
+    }
+    const issue = bMatches[0]?.[1];
+    if (issue !== undefined) {
+        return { shape: "B", skipIssue: Number(issue), ambiguous: false };
+    }
+    return { shape: null, skipIssue: null, ambiguous: false };
+}
+function isBotActor(actor) {
+    const type = (actor.type ?? "").toLowerCase();
+    if (type === "bot") {
+        return true;
+    }
+    const login = actor.login ?? "";
+    return /\[bot\]$/i.test(login) || login.toLowerCase().endsWith("-bot");
+}
+export function loadMaintainerLogins(projectRoot) {
+    try {
+        const path = join(projectRoot, "xbrief", "PROJECT-DEFINITION.xbrief.json");
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            return [];
+        }
+        const plan = raw.plan;
+        const policy = readPlanPolicy(plan);
+        if (policy === null || typeof policy !== "object" || Array.isArray(policy)) {
+            return [];
+        }
+        const list = policy.maintainerLogins;
+        if (!Array.isArray(list)) {
+            return [];
+        }
+        return list
+            .filter((v) => typeof v === "string" && v.trim().length > 0)
+            .map((v) => v.trim());
+    }
+    catch {
+        return [];
+    }
+}
+function isMaintainerClassActor(association, login, maintainerLogins) {
+    const assoc = (association ?? "").toUpperCase();
+    if (HOTFIX_MAINTAINER_ASSOCIATIONS.has(assoc)) {
+        return true;
+    }
+    if (login === null || login === undefined || login.length === 0) {
+        return false;
+    }
+    const needle = login.toLowerCase();
+    return maintainerLogins.some((m) => m.toLowerCase() === needle);
+}
+function fetchCollaboratorAssociation(repo, login, runGh) {
+    const rc = runGh(["gh", "api", `repos/${repo}/collaborators/${login}/permission`]);
+    if (rc.returncode !== 0 || !rc.stdout.trim())
+        return null;
+    try {
+        const payload = JSON.parse(rc.stdout);
+        if (payload === null || typeof payload !== "object" || Array.isArray(payload))
+            return null;
+        const permission = payload.permission;
+        if (typeof permission !== "string")
+            return null;
+        const p = permission.toLowerCase();
+        if (p === "admin" || p === "maintain")
+            return "MEMBER";
+        if (p === "write")
+            return "COLLABORATOR";
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function fetchLatestHotfixLabelActor(prNumber, repo, runGh) {
+    // Paginate issue events — busy PRs can push the current hotfix label past page 1.
+    // Inline page cap — avoid new numeric-const FACT_KINDS (#4541 / AFK free rewrite).
+    const allEvents = [];
+    let page = 1;
+    while (page <= 20) {
+        const rc = runGh([
+            "gh",
+            "api",
+            `repos/${repo}/issues/${prNumber}/events?per_page=100&page=${page}`,
+        ]);
+        if (rc.returncode !== 0) {
+            return { actor: null, error: `could not read labeled-timeline events: ${rc.stderr.trim()}` };
+        }
+        if (!rc.stdout.trim()) {
+            if (page === 1)
+                return { actor: null, error: "empty body from issues/<N>/events" };
+            break;
+        }
+        let payload;
+        try {
+            payload = JSON.parse(rc.stdout);
+        }
+        catch (exc) {
+            const message = exc instanceof Error ? exc.message : String(exc);
+            return { actor: null, error: `could not parse events JSON: ${message}` };
+        }
+        if (!Array.isArray(payload)) {
+            return { actor: null, error: "unexpected events JSON shape (not a list)" };
+        }
+        allEvents.push(...payload);
+        if (payload.length < 100)
+            break;
+        page += 1;
+    }
+    let latest = null;
+    for (const event of allEvents) {
+        if (event === null || typeof event !== "object" || Array.isArray(event))
+            continue;
+        const rec = event;
+        if (rec.event !== "labeled")
+            continue;
+        const label = rec.label;
+        if (label === null || typeof label !== "object" || Array.isArray(label))
+            continue;
+        if (label.name !== HOTFIX_LABEL)
+            continue;
+        const actor = rec.actor;
+        if (actor === null || typeof actor !== "object" || Array.isArray(actor))
+            continue;
+        const a = actor;
+        const login = typeof a.login === "string" ? a.login : "";
+        if (login.length === 0)
+            continue;
+        // issues/<N>/events omits author_association; resolve via collaborators permission.
+        const association = typeof rec.author_association === "string"
+            ? rec.author_association
+            : fetchCollaboratorAssociation(repo, login, runGh);
+        latest = {
+            login,
+            type: typeof a.type === "string" ? a.type : null,
+            association,
+        };
+    }
+    return { actor: latest, error: null };
+}
+function fetchPrHotfixSurface(prNumber, repo, runGh) {
+    const rc = runGh(["gh", "api", `repos/${repo}/pulls/${prNumber}`]);
+    if (rc.returncode !== 0) {
+        return { labels: [], body: "", error: `gh api /pulls/${prNumber} failed: ${rc.stderr.trim()}` };
+    }
+    if (!rc.stdout.trim()) {
+        return { labels: [], body: "", error: "empty body from gh api /pulls/<N>" };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(rc.stdout);
+    }
+    catch (exc) {
+        const message = exc instanceof Error ? exc.message : String(exc);
+        return { labels: [], body: "", error: `could not parse PR JSON: ${message}` };
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+        return { labels: [], body: "", error: "unexpected PR JSON shape (not a dict)" };
+    }
+    const rec = payload;
+    const body = typeof rec.body === "string" ? rec.body : "";
+    const labels = [];
+    if (Array.isArray(rec.labels)) {
+        for (const lab of rec.labels) {
+            if (lab !== null && typeof lab === "object" && !Array.isArray(lab)) {
+                const name = lab.name;
+                if (typeof name === "string" && name.length > 0)
+                    labels.push(name);
+            }
+            else if (typeof lab === "string" && lab.length > 0) {
+                labels.push(lab);
+            }
+        }
+    }
+    return { labels, body, error: null };
+}
+/**
+ * Admit hotfix escape when label + maintainer-class labeler + exactly one shape.
+ * Does not require actor≠author (Recut-2).
+ */
+export function evaluateHotfixAdmission(prNumber, repo, options = {}) {
+    if (options.hotfixAdmission !== undefined && options.hotfixAdmission !== null) {
+        return options.hotfixAdmission;
+    }
+    if (options.firstHotfixBootstrap === true) {
+        return {
+            admitted: false,
+            shape: null,
+            skipIssue: null,
+            actorLogin: null,
+            reason: FIRST_HOTFIX_BOOTSTRAP_RECOVERY,
+            outcome: OUTCOME_FIRST_HOTFIX_BOOTSTRAP,
+        };
+    }
+    if (isNoNetwork(options.env)) {
+        return {
+            admitted: false,
+            shape: null,
+            skipIssue: null,
+            actorLogin: null,
+            reason: "Hotfix provenance unreadable under DEFT_NO_NETWORK=1; refuse (#6071).",
+            outcome: OUTCOME_HOTFIX_ACTOR_DENIED,
+        };
+    }
+    const runGh = options.runGh ?? defaultRunGh;
+    const surface = fetchPrHotfixSurface(prNumber, repo, runGh);
+    if (surface.error !== null) {
+        return {
+            admitted: false,
+            shape: null,
+            skipIssue: null,
+            actorLogin: null,
+            reason: `Hotfix provenance unreadable: ${surface.error}`,
+            outcome: OUTCOME_HOTFIX_ACTOR_DENIED,
+        };
+    }
+    if (!surface.labels.includes(HOTFIX_LABEL)) {
+        return {
+            admitted: false,
+            shape: null,
+            skipIssue: null,
+            actorLogin: null,
+            reason: null,
+            outcome: null,
+        };
+    }
+    const parsed = parseHotfixShape(surface.body);
+    if (parsed.ambiguous) {
+        return {
+            admitted: false,
+            shape: null,
+            skipIssue: null,
+            actorLogin: null,
+            reason: "Hotfix body matches both shape (A) and (B); refuse (#6071).",
+            outcome: OUTCOME_HOTFIX_SHAPE_INVALID,
+        };
+    }
+    if (parsed.shape === null) {
+        return {
+            admitted: false,
+            shape: null,
+            skipIssue: null,
+            actorLogin: null,
+            reason: "hotfix label present without a matching shape (A) or (B) body line; refuse (#6071).",
+            outcome: OUTCOME_HOTFIX_SHAPE_INVALID,
+        };
+    }
+    const labeled = fetchLatestHotfixLabelActor(prNumber, repo, runGh);
+    if (labeled.error !== null) {
+        return {
+            admitted: false,
+            shape: parsed.shape,
+            skipIssue: parsed.skipIssue,
+            actorLogin: null,
+            reason: `Hotfix labeled-timeline unreadable: ${labeled.error}`,
+            outcome: OUTCOME_HOTFIX_ACTOR_DENIED,
+        };
+    }
+    if (labeled.actor === null) {
+        return {
+            admitted: false,
+            shape: parsed.shape,
+            skipIssue: parsed.skipIssue,
+            actorLogin: null,
+            reason: "hotfix label present but labeled-timeline actor provenance missing; refuse (#6071).",
+            outcome: OUTCOME_HOTFIX_ACTOR_DENIED,
+        };
+    }
+    if (isBotActor(labeled.actor)) {
+        return {
+            admitted: false,
+            shape: parsed.shape,
+            skipIssue: parsed.skipIssue,
+            actorLogin: labeled.actor.login,
+            reason: `hotfix label actor ${labeled.actor.login} is a Bot; refuse (#6071).`,
+            outcome: OUTCOME_HOTFIX_ACTOR_DENIED,
+        };
+    }
+    const maintainerLogins = options.maintainerLogins ?? loadMaintainerLogins(options.projectRoot ?? process.cwd());
+    if (!isMaintainerClassActor(labeled.actor.association, labeled.actor.login, maintainerLogins)) {
+        return {
+            admitted: false,
+            shape: parsed.shape,
+            skipIssue: parsed.skipIssue,
+            actorLogin: labeled.actor.login,
+            reason: `hotfix label actor ${labeled.actor.login} is not maintainer-class ` +
+                "(OWNER/MEMBER or plan.policy.maintainerLogins); refuse (#6071).",
+            outcome: OUTCOME_HOTFIX_ACTOR_DENIED,
+        };
+    }
+    // #6071 Greptile: shape B must live-validate the cited issue (open + skipped-tests).
+    if (parsed.shape === "B") {
+        const skipIssue = parsed.skipIssue;
+        if (skipIssue === null || !Number.isFinite(skipIssue) || skipIssue <= 0) {
+            return {
+                admitted: false,
+                shape: "B",
+                skipIssue: null,
+                actorLogin: labeled.actor.login,
+                reason: "hotfix shape (B) missing deftai/directive#N citation; refuse (#6071).",
+                outcome: OUTCOME_HOTFIX_SHAPE_INVALID,
+            };
+        }
+        // Citations are always deftai/directive#N (HOTFIX_SHAPE_B_RE); do not look up N in the PR repo.
+        const issueRc = runGh([
+            "gh",
+            "api",
+            `repos/${HOTFIX_SHAPE_B_ISSUE_REPO}/issues/${skipIssue}`,
+            "--jq",
+            "{state:.state,body:.body,created_at:.created_at}",
+        ]);
+        if (issueRc.returncode !== 0 || !issueRc.stdout.trim()) {
+            return {
+                admitted: false,
+                shape: "B",
+                skipIssue,
+                actorLogin: labeled.actor.login,
+                reason: `hotfix shape (B) ${HOTFIX_SHAPE_B_ISSUE_REPO}#${skipIssue} unreadable; refuse (#6071).`,
+                outcome: OUTCOME_HOTFIX_SHAPE_INVALID,
+            };
+        }
+        let issue;
+        try {
+            issue = JSON.parse(issueRc.stdout);
+        }
+        catch {
+            return {
+                admitted: false,
+                shape: "B",
+                skipIssue,
+                actorLogin: labeled.actor.login,
+                reason: `hotfix shape (B) issue #${skipIssue} payload unreadable; refuse (#6071).`,
+                outcome: OUTCOME_HOTFIX_SHAPE_INVALID,
+            };
+        }
+        if (issue.state !== "open") {
+            return {
+                admitted: false,
+                shape: "B",
+                skipIssue,
+                actorLogin: labeled.actor.login,
+                reason: `hotfix shape (B) ${HOTFIX_SHAPE_B_ISSUE_REPO}#${skipIssue} is ${String(issue.state)}; refuse (#6071).`,
+                outcome: OUTCOME_HOTFIX_SHAPE_INVALID,
+            };
+        }
+        const titles = parseSkippedTestsBlock(typeof issue.body === "string" ? issue.body : "");
+        if (titles.length === 0) {
+            return {
+                admitted: false,
+                shape: "B",
+                skipIssue,
+                actorLogin: labeled.actor.login,
+                reason: `hotfix shape (B) ${HOTFIX_SHAPE_B_ISSUE_REPO}#${skipIssue} lacks skipped-tests block; refuse (#6071).`,
+                outcome: OUTCOME_HOTFIX_SHAPE_INVALID,
+            };
+        }
+    }
+    return {
+        admitted: true,
+        shape: parsed.shape,
+        skipIssue: parsed.skipIssue,
+        actorLogin: labeled.actor.login,
+        reason: null,
+        outcome: null,
+    };
+}
+/**
+ * Always-on named Merge gate evaluation for a PR (or tip-only release path).
+ * When the named check is not green, only an admitted hotfix A/B may proceed.
+ */
+export function evaluateAlwaysOnNamedMergeGate(prNumber, repo, options = {}) {
+    if (isNoNetwork(options.env)) {
+        const error = "Named Merge gate (task check) status unreadable under DEFT_NO_NETWORK=1; " +
+            "refuse (same closed outcome as API fail) (#6071).";
+        return {
+            ok: false,
+            outcome: OUTCOME_MASTER_MERGE_GATE_RED,
+            exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+            error,
+            status: { ...emptyNamedStatus(options.tipSha ?? null), disposition: "api_fail", error },
+            hotfix: null,
+        };
+    }
+    const runGh = options.runGh ?? defaultRunGh;
+    let tipSha = options.tipSha ?? null;
+    if (tipSha === null || tipSha.length === 0) {
+        const baseBranch = typeof options.baseBranch === "string" && options.baseBranch.length > 0
+            ? options.baseBranch
+            : null;
+        let branch = baseBranch;
+        if (branch === null && prNumber !== null) {
+            const pr = fetchPrShas(prNumber, repo, runGh);
+            if (pr.error !== null) {
+                return {
+                    ok: false,
+                    outcome: OUTCOME_MASTER_MERGE_GATE_RED,
+                    exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+                    error: pr.error,
+                    status: { ...emptyNamedStatus(null), error: pr.error },
+                    hotfix: null,
+                };
+            }
+            branch = pr.baseRef;
+        }
+        if (branch === null || branch.length === 0) {
+            branch = "master";
+        }
+        const head = fetchBranchHeadSha(repo, branch, runGh);
+        if (head.error !== null || head.sha === null) {
+            const error = head.error ?? "could not resolve tip SHA for named Merge gate";
+            return {
+                ok: false,
+                outcome: OUTCOME_MASTER_MERGE_GATE_RED,
+                exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+                error,
+                status: { ...emptyNamedStatus(null), error },
+                hotfix: null,
+            };
+        }
+        tipSha = head.sha;
+    }
+    let checkRuns = options.checkRuns ?? null;
+    if (checkRuns === null) {
+        const fetched = fetchCheckRunsRest(tipSha, repo, runGh);
+        if (fetched.error.length > 0) {
+            const error = `Named Merge gate check-runs read failed on tip ${tipSha}; fail closed (#6071). ` +
+                fetched.error;
+            return {
+                ok: false,
+                outcome: OUTCOME_MASTER_MERGE_GATE_RED,
+                exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+                error,
+                status: { ...emptyNamedStatus(tipSha), disposition: "api_fail", error },
+                hotfix: null,
+            };
+        }
+        checkRuns = fetched.checkRuns;
+    }
+    const status = evaluateNamedMergeGateFromRuns(tipSha, checkRuns, {
+        pendingTimeoutMinutes: options.pendingTimeoutMinutes,
+        nowMs: options.nowMs,
+    });
+    if (status.disposition === "green") {
+        return {
+            ok: true,
+            outcome: null,
+            exitCode: null,
+            error: null,
+            status,
+            hotfix: null,
+        };
+    }
+    // Consumer contract: Directive does not assume consumer CI workflows exist.
+    // Always-on named gate stays fail-closed on deftai/directive; other repos skip
+    // only when the exact check name is absent (red/pending/skipped still refuse).
+    if (status.disposition === "missing" && repo.toLowerCase() !== "deftai/directive") {
+        return {
+            ok: true,
+            outcome: null,
+            exitCode: null,
+            error: null,
+            status: {
+                ...status,
+                error: null,
+            },
+            hotfix: null,
+        };
+    }
+    if (prNumber === null) {
+        if (options.firstHotfixBootstrap === true) {
+            const hotfix = evaluateHotfixAdmission(0, repo, options);
+            return {
+                ok: false,
+                outcome: OUTCOME_FIRST_HOTFIX_BOOTSTRAP,
+                exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+                error: hotfix.reason ?? FIRST_HOTFIX_BOOTSTRAP_RECOVERY,
+                status,
+                hotfix,
+            };
+        }
+        return {
+            ok: false,
+            outcome: OUTCOME_MASTER_MERGE_GATE_RED,
+            exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+            error: status.error,
+            status,
+            hotfix: null,
+        };
+    }
+    const hotfix = evaluateHotfixAdmission(prNumber, repo, options);
+    if (hotfix.admitted) {
+        return { ok: true, outcome: null, exitCode: null, error: null, status, hotfix };
+    }
+    if (hotfix.outcome === OUTCOME_HOTFIX_SHAPE_INVALID) {
+        return {
+            ok: false,
+            outcome: OUTCOME_HOTFIX_SHAPE_INVALID,
+            exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+            error: hotfix.reason ?? status.error,
+            status,
+            hotfix,
+        };
+    }
+    if (hotfix.outcome === OUTCOME_HOTFIX_ACTOR_DENIED ||
+        hotfix.outcome === OUTCOME_FIRST_HOTFIX_BOOTSTRAP) {
+        return {
+            ok: false,
+            outcome: hotfix.outcome,
+            exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+            error: hotfix.reason ?? status.error,
+            status,
+            hotfix,
+        };
+    }
+    return {
+        ok: false,
+        outcome: OUTCOME_MASTER_MERGE_GATE_RED,
+        exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+        error: status.error,
+        status,
+        hotfix,
+    };
+}
 //# sourceMappingURL=semantic-green.js.map