@event4u/agent-config 14.18.0 → 14.19.0

package/src/scripts/check_gate_coverage.ts

@@ -113,6 +113,21 @@ export interface GateSpec {
    * `pending` is reported instead of hidden.
    */
   unavailable_exit?: number;
+  /**
+   * Repo-relative workflow file this row's `argv` is pinned to.
+   *
+   * Rule 2 of this manifest — CI-IDENTICAL INVOCATION — was an instruction to
+   * the author and nothing else: the guard runs whatever `argv` says and never
+   * looked at how CI calls the gate, so a row could drift from its workflow, or
+   * the workflow step could be deleted outright, and this file would keep
+   * reporting healthy coverage for a gate CI no longer runs.
+   *
+   * Opt-in per row, because most gates here have several CI invocations with
+   * different arguments and one `argv` cannot be identical to all of them. Where
+   * a row DOES name a workflow, that workflow must contain an invocation of the
+   * gate whose argument list equals `argv` exactly.
+   */
+  ci_invocation?: string;
   note?: string;
 }
 
@@ -191,6 +206,9 @@ export function load_manifest(file = MANIFEST): GateSpec[] {
       ...(e['unavailable_exit'] === undefined
         ? {}
         : { unavailable_exit: _require_int(e['unavailable_exit'], id, i) }),
+      ...(e['ci_invocation'] === undefined
+        ? {}
+        : { ci_invocation: _require_str(e['ci_invocation'], 'ci_invocation', id, i) }),
       ...(e['note'] === undefined ? {} : { note: String(e['note']) }),
       ...(e['canary'] === undefined ? {} : { canary: _require_canary(e['canary'], id, i) }),
       ...(e['no_canary_reason'] === undefined
@@ -405,6 +423,73 @@ function report_negative_control_inventory(specs: readonly GateSpec[]): void {
   }
 }
 
+/**
+ * Invocations of `src/scripts/<id>` in a workflow, each as its argument list.
+ *
+ * Deliberately a text scan rather than a YAML walk: an invocation lives inside a
+ * `run:` block scalar, so parsing the workflow buys nothing and costs the ability
+ * to see a call split across a line continuation, which is how the release job
+ * writes this very gate. Backslash-newline joins are folded before matching for
+ * that reason.
+ */
+export function ci_invocations(workflowText: string, id: string): string[][] {
+  const folded = workflowText.replace(/\\\n\s*/gu, ' ');
+  const out: string[][] = [];
+  const re = new RegExp(String.raw`src/scripts/${id}(?![A-Za-z0-9_])([^\n]*)`, 'gu');
+  for (const m of folded.matchAll(re)) {
+    out.push(
+      (m[1] ?? '')
+        .trim()
+        .split(/\s+/u)
+        .filter((t) => t !== ''),
+    );
+  }
+  return out;
+}
+
+/**
+ * The row's `argv` must be reproducible from the workflow it pins.
+ *
+ * Both directions are failures and they are different defects: no matching
+ * invocation means the manifest probes the gate in a way CI does not (or CI
+ * stopped calling it at all), which is the drift rule 2 asks for and nothing
+ * enforced.
+ */
+export function ci_invocation_problem(
+  workflowText: string,
+  id: string,
+  argv: readonly string[],
+): string | null {
+  const found = ci_invocations(workflowText, id);
+  if (found.length === 0) {
+    return `no invocation of src/scripts/${id} — the workflow does not call this gate`;
+  }
+  const want = argv.join(' ');
+  if (found.some((a) => a.join(' ') === want)) {
+    return null;
+  }
+  return (
+    `argv [${want}] matches no invocation there; the workflow calls it as ` +
+    found.map((a) => `[${a.join(' ')}]`).join(', ')
+  );
+}
+
+/** Rows whose `ci_invocation` no longer describes their workflow. */
+export function ci_invocation_drift(specs: readonly GateSpec[], repoRoot = REPO_ROOT): string[] {
+  const problems: string[] = [];
+  for (const s of specs) {
+    if (s.ci_invocation === undefined) continue;
+    const file = path.join(repoRoot, s.ci_invocation);
+    if (!fs.existsSync(file)) {
+      problems.push(`${s.id}: ci_invocation ${s.ci_invocation} does not exist`);
+      continue;
+    }
+    const problem = ci_invocation_problem(fs.readFileSync(file, 'utf-8'), s.id, s.argv);
+    if (problem !== null) problems.push(`${s.id}: ${s.ci_invocation} — ${problem}`);
+  }
+  return problems;
+}
+
 export function main(argv: readonly string[]): number {
   const wantJson = argv.includes('--format') && argv[argv.indexOf('--format') + 1] === 'json';
   const listOnly = argv.includes('--list');
@@ -523,12 +608,23 @@ export function main(argv: readonly string[]): number {
     );
   }
   report_negative_control_inventory(specs);
+  const drift = ci_invocation_drift(specs);
+  for (const d of drift) {
+    process.stdout.write(`  ❌ ${d}\n`);
+  }
   const hardening = report_hardening_ratchet();
   const selfTest = report_self_test_ratchet();
   if (failed.length > 0) {
     process.stdout.write(`❌  ${String(failed.length)} gate(s) failed the coverage floor.\n`);
     return 1;
   }
+  if (drift.length > 0) {
+    process.stdout.write(
+      `❌  ${String(drift.length)} row(s) declare a ci_invocation their workflow no longer matches — ` +
+        `the manifest probes the gate differently from CI, or CI stopped calling it.\n`,
+    );
+    return 1;
+  }
   if (hardening !== 0) {
     return hardening;
   }

package/src/scripts/check_release_highlights.ts

@@ -72,13 +72,17 @@ import {
     derive_categories,
     parse_git_log,
     mix_response_blockers,
+    previous_promise,
     previous_release_tag,
+    promise_readback_blockers,
     stale_draft_labels,
 } from './_lib/release_highlights.js';
 import { loadTaxonomy, measureRange } from './measure_release_mix.js';
 import {
     CURATED_HEAD_INSTRUCTION,
+    PROMISE_READBACK_MARKER,
     extract_changelog_section,
+    previous_changelog_version,
 } from './_lib/release_material.js';
 import { assertScanned, assertWatchlistResolves, DeadScopeError } from './_lib/scan_scope.js';
 
@@ -207,7 +211,8 @@ export function main(argv: readonly string[]): number {
         }
         throw err;
     }
-    const section = extract_changelog_section(fs.readFileSync(changelogPath, 'utf-8'), version);
+    const changelogText = fs.readFileSync(changelogPath, 'utf-8');
+    const section = extract_changelog_section(changelogText, version);
     if (!section) {
         process.stderr.write(`CHANGELOG carries no section for ${version}\n`);
         return 2;
@@ -251,6 +256,11 @@ export function main(argv: readonly string[]): number {
         return mix;
     }
 
+    const readback = check_previous_promise_readback(changelogText, section.body, version);
+    if (readback !== 0) {
+        return readback;
+    }
+
     const curated = parse_curated_head(section.body);
     if (!curated) {
         process.stdout.write(`ℹ️  no curated head in the ${version} section — nothing to check\n`);
@@ -417,6 +427,69 @@ export function check_governance_mix_response(
     return 1;
 }
 
+/**
+ * The previous release's promise, read back at the next release.
+ *
+ * `_lib/release_material.ts` generates `Next cycle ships …` and, until this
+ * check existed, nothing ever asked what became of it: 14.18.0 promised the MCP
+ * bridge repair, and no gate in the tree would have noticed the same promise
+ * being reprinted in 14.19.0 and 14.20.0. A commitment nothing reads back is
+ * free to restate, and one that is free to restate is not a commitment.
+ *
+ * Only the section under release is read, and only the previous section's
+ * governance-response block — the same scope every other check here uses, so a
+ * historical section cannot red a future release.
+ *
+ * The check is about ANSWERING, never about having kept the promise. A gate
+ * that refused an unkept promise would price honesty above silence and teach
+ * the next author to promise nothing.
+ */
+export function check_previous_promise_readback(
+    changelogText: string,
+    body: string,
+    version: string,
+): number {
+    const previousVersion = previous_changelog_version(changelogText, version);
+    if (previousVersion === null) {
+        process.stdout.write(`✅  no previous CHANGELOG section before ${version} — no promise to read back\n`);
+        return 0;
+    }
+    const promise = previous_promise(changelogText, previousVersion);
+    if (promise === null) {
+        process.stdout.write(
+            `✅  the ${previousVersion} section made no next-cycle promise — nothing owed by ${version}\n`,
+        );
+        return 0;
+    }
+    const blockers = promise_readback_blockers(
+        body,
+        version,
+        previousVersion,
+        promise,
+        `\`release/${version}\``,
+    );
+    if (blockers.length === 0) {
+        process.stdout.write(`✅  ${version} answers the ${previousVersion} next-cycle promise\n`);
+        return 0;
+    }
+    process.stderr.write(
+        `❌  the ${version} section owes an answer to the ${previousVersion} next-cycle promise.\n` +
+            blockers.map((b) => `    - ${b}\n`).join('') +
+            `    The ${previousVersion} promise reads:\n` +
+            promise
+                .split('\n')
+                .map((l) => `        ${l}\n`)
+                .join('') +
+            `    Answering it is one blockquote line under the curated head, e.g.\n` +
+            `        > ${PROMISE_READBACK_MARKER} the <promise> did not ship; <what happened>.\n` +
+            '    Shipped, did not ship, or withdrawn with a reason — the check refuses a MISSING\n' +
+            '    answer, never a particular outcome. An unkept promise answered honestly passes.\n' +
+            '    Reproduce locally, before any push:\n' +
+            `        ./scripts-run src/scripts/check_release_highlights --version ${version}\n`,
+    );
+    return 1;
+}
+
 const _isMain = (() => {
     const entry = process.argv[1];
     if (!entry) return false;

package/src/scripts/check_skill_activation_claim.ts

@@ -0,0 +1,179 @@
+#!/usr/bin/env tsx
+/**
+ * The published skill-activation figure agrees with the record it came from.
+ *
+ * WHY THIS IS A SEPARATE SCRIPT FROM THE CENSUS
+ * ---------------------------------------------
+ * `report_skill_activation` is a REPORT: it gates on nothing, has no threshold,
+ * and its own docstring says it must never acquire one. This is a GATE, and the
+ * two must not share an entry point — `src/config/gate-coverage.yml` is a
+ * manifest of gates, and `_lib/gate_population.ts` classifies a script by its
+ * prefix precisely so that "is this a gate" is answered structurally rather
+ * than by whoever last edited a config. Registering a `report_*` id there forks
+ * that population, which `tests/scripts/gate_population.test.ts` refuses.
+ *
+ * So the split is not cosmetic. The report keeps its exit-0 contract; the
+ * assertion that CAN fail lives here, where a floor and a self-test belong.
+ *
+ * WHAT IT CANNOT DO, STATED SO NOBODY READS IT AS COVERED
+ * ------------------------------------------------------
+ * It compares two COMMITTED files — the census record against the sentence
+ * `docs/CLAIMS.md` publishes. It cannot tell whether the record still describes
+ * the world: the transcript store it was taken from is one machine's, keyed on
+ * the directory the census ran in, and absent from CI. Re-taking the
+ * measurement is `report_skill_activation --emit`, which refuses to write from
+ * an empty store. This gate only forbids the published sentence and the record
+ * from telling two different stories.
+ *
+ * Exit: 0 agree · 1 disagree or a file is missing.
+ */
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { runGateCli, runSelfTest } from './_lib/gate_self_test.js';
+import { reportScanned } from './_lib/scan_scope.js';
+import {
+  CLAIMS_PATH,
+  CLAIM_ID,
+  RECORD_PATH,
+  claimBlock,
+  claimProblems,
+  parseClaimFigures,
+  readRecord,
+} from './report_skill_activation.js';
+
+const _HERE = fileURLToPath(import.meta.url);
+const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
+
+export function check(root: string): number {
+  const rec = readRecord(root);
+  if (rec === null) {
+    process.stderr.write(`❌  ${RECORD_PATH} is missing — the published figure has no record behind it.\n`);
+    return 1;
+  }
+  const claimsFile = path.join(root, CLAIMS_PATH);
+  if (!fs.existsSync(claimsFile)) {
+    process.stderr.write(`❌  ${CLAIMS_PATH} is missing.\n`);
+    return 1;
+  }
+  const block = claimBlock(fs.readFileSync(claimsFile, 'utf8'), CLAIM_ID);
+  // Emitted before the verdict on both paths: a gate that reports what it
+  // inspected only when it passes leaves the coverage census blind exactly when
+  // it matters.
+  reportScanned({
+    gate: 'check_skill_activation_claim',
+    scanned: block === null ? 0 : 1,
+    units: 'published claim block(s)',
+    roots: [CLAIMS_PATH],
+  });
+  if (block === null) {
+    process.stderr.write(`❌  claim \`${CLAIM_ID}\` is not in ${CLAIMS_PATH}.\n`);
+    return 1;
+  }
+  const problems = claimProblems(rec, parseClaimFigures(block));
+  if (problems.length > 0) {
+    process.stderr.write('❌  the published census claim and its record disagree:\n');
+    for (const p of problems) {
+      process.stderr.write(`  · ${p}\n`);
+    }
+    process.stderr.write(
+      `\nRe-take the measurement (report_skill_activation --emit) and update the claim from ${RECORD_PATH}.\n`,
+    );
+    return 1;
+  }
+  process.stdout.write(`✅  census claim matches ${RECORD_PATH} (measured ${rec.measured_at}).\n`);
+  return 0;
+}
+
+/**
+ * The gate proving it still discriminates.
+ *
+ * The third case is the one a value comparison alone would miss: a claim that
+ * silently stops stating a figure would otherwise pass every equality test it
+ * no longer participates in.
+ */
+function selfTest(): number {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'activation-claim-selftest-'));
+  const record = {
+    schema_version: 1,
+    measured_at: '2026-01-02',
+    skills_shipped: 300,
+    with_trigger_key: 10,
+    with_trigger_corpus: 100,
+    trigger_key_and_corpus: 5,
+    human_named_only: 195,
+    sessions: 7,
+    assistant_turns: 1234,
+    invocations: 0,
+    distinct_skills_invoked: 0,
+    stores: ['fixture'],
+  };
+  const agreeing =
+    '`report_skill_activation` over 7 sessions and 1,234 assistant turns records 0 Skill ' +
+    'invocations and 0 of 300 distinct skills (measured 2026-01-02). 10 declare a ' +
+    'machine-matchable trigger key in frontmatter, 100 carry an `evals/triggers.json` corpus, ' +
+    '5 do both, and the remaining 195 are reachable only by a human naming them.';
+  const write = (name: string, body: string): string => {
+    const root = path.join(tmp, name);
+    fs.mkdirSync(path.join(root, path.dirname(RECORD_PATH)), { recursive: true });
+    fs.mkdirSync(path.join(root, path.dirname(CLAIMS_PATH)), { recursive: true });
+    fs.writeFileSync(path.join(root, RECORD_PATH), JSON.stringify(record));
+    fs.writeFileSync(
+      path.join(root, CLAIMS_PATH),
+      `# Claims\n\n### claim: ${CLAIM_ID}\n- claim: ${body}\n- kind: quant\n- status: backed\n- last_verified: 2026-01-02\n\n### claim: unrelated\n- claim: x\n`,
+    );
+    return root;
+  };
+  const run = (root: string): number =>
+    runGateCli(REPO_ROOT, 'src/scripts/check_skill_activation_claim.ts', ['--root', root], root);
+  try {
+    return runSelfTest({
+      gate: 'check_skill_activation_claim',
+      minCases: 4,
+      minRejectCases: 3,
+      cases: [
+        {
+          name: 'a turn count that moved away from the record is rejected',
+          expect: 'reject',
+          run: () => run(write('turns', agreeing.replace('1,234 assistant', '9,999 assistant'))),
+        },
+        {
+          name: 'a population redrawn to enlarge the human-named remainder is rejected',
+          expect: 'reject',
+          run: () => run(write('population', agreeing.replace('remaining 195 are', 'remaining 290 are'))),
+        },
+        {
+          name: 'a claim that stops stating the population split is rejected',
+          expect: 'reject',
+          run: () => run(write('dropped', agreeing.slice(0, agreeing.indexOf('. 10 declare') + 1))),
+        },
+        {
+          name: 'a claim reproducing every recorded figure passes',
+          expect: 'accept',
+          run: () => run(write('agreeing', agreeing)),
+        },
+      ],
+    });
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+export function main(argv: readonly string[]): number {
+  if (argv.includes('--help') || argv.includes('-h')) {
+    process.stdout.write('usage: check_skill_activation_claim [--root DIR] [--self-test]\n');
+    return 0;
+  }
+  if (argv.includes('--self-test')) {
+    return selfTest();
+  }
+  const i = argv.indexOf('--root');
+  return check(i === -1 ? REPO_ROOT : (argv[i + 1] ?? REPO_ROOT));
+}
+
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/check_trigger_evals.ts

@@ -150,7 +150,7 @@ function _check_one(p: string, today: PyDate): string[] {
         if (age > MAX_AGE_DAYS) {
             errors.push(
                 `${rel}: \`last_eval\` ${raw as string} is ${age}d old (> ${MAX_AGE_DAYS}d) ` +
-                    '— re-run skill_trigger_eval.py and bump it',
+                    '— re-run skill_trigger_eval and bump it',
             );
         }
     }

package/src/scripts/conformance_scan.ts

@@ -53,8 +53,13 @@ import { entryText, isSidechain } from "./_lib/transcript_entry.js";
 
 import { classify } from "./language_mirror_hook.js";
 import { isSyntheticPrompt } from "./_lib/prompt_shape.js";
-import { classifyAuthorization, type GitOp } from "./git_authorization_hook.js";
-import { BLOCK_OPS, commandOp } from "./hooks/git_command_classifier.js";
+import {
+  classifyAuthorization,
+  extractObjects,
+  OBJECT_REQUIRED_OPS,
+  type GitOp,
+} from "./git_authorization_hook.js";
+import { BLOCK_OPS, commandObject, commandOp } from "./hooks/git_command_classifier.js";
 import { isVacuousOutput, isCiPoll, pendingCount } from "./before_complete_hook.js";
 // Round 7 § 1.5 — the SAME predicate `turn-end-gate` refuses on, imported rather
 // than reimplemented, so the measured rate and the gate cannot disagree.
@@ -579,6 +584,8 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
   let pinned: "de" | "en" | null = null;
   let pendingPoll: { at: string; cmd: string } | null = null;
   let authorized = new Set<GitOp>();
+  // Per-op objects the current turn's prompt named. Reset with `authorized`.
+  let authorizedObjects = new Map<GitOp, Set<string>>();
   let sawPending = false;
   let evaluationsThisTurn = 0;
   // Round-5 provenance for language violations. The round-5 audit could only
@@ -723,7 +730,15 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
       if (c.language !== "und") {
         pinned = c.language;
       }
-      authorized = new Set(classifyAuthorization(ut).authorized);
+      const classified = classifyAuthorization(ut);
+      authorized = new Set(classified.authorized);
+      // Step 2.2 — the objects the turn NAMED, per operation. Rebuilt on every
+      // counted user turn for the same reason `authorized` is: an authorization
+      // for one table does not carry into the next prompt any more than the
+      // operation does.
+      authorizedObjects = new Map(
+        classified.authorized.map((op) => [op, new Set(extractObjects(op, ut))]),
+      );
       sawPending = false;
       evaluationsThisTurn = 0;
       pendingPoll = null;
@@ -811,6 +826,32 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
             at,
             detail: `irreversible \`${op}\` with no authorization in the turn's prompt: ${cmd.slice(0, 110)}`,
           });
+        } else if (op !== null && authorized.has(op) && OBJECT_REQUIRED_OPS.has(op)) {
+          // Step 2.2 — the operation WAS authorized and ran against something
+          // the turn never named. An authorization for one table is not an
+          // authorization for another, and until the ledger could carry an
+          // object this was indistinguishable from a clean turn.
+          //
+          // This REPORTS and refuses nothing — ADR-254 removed the enforcing
+          // reader, and the shape it preserved is a count after the fact.
+          //
+          // A command naming NO object produces no finding: `commandObject`
+          // returns null there, and a guessed object would manufacture a
+          // violation out of a parse failure. Under-reporting is the safe
+          // direction for a measurement.
+          const object = commandObject(op, cmd);
+          const named = authorizedObjects.get(op);
+          if (object !== null && !(named?.has(object) ?? false)) {
+            report.violations.push({
+              check: "git-authorization",
+              session: sessionId,
+              at,
+              detail:
+                `\`${op}\` authorized, but its object \`${object}\` is not one the ` +
+                `turn's prompt named (${named && named.size > 0 ? [...named].join(", ") : "no object named"}): ` +
+                cmd.slice(0, 110),
+            });
+          }
         }
         if (isCiPoll(cmd)) {
           // The RESULT of this call arrives on the NEXT entry, and that entry is

package/src/scripts/explain_run.ts

@@ -690,7 +690,7 @@ function renderHygieneSection(hygiene: HygieneReadResult): string[] {
     out.push(`_Source: tried ${hygiene.checkedPaths.map((p) => `\`${p}\``).join(', then ')}_`);
     out.push('');
     if (hygiene.state === null) {
-        out.push('no data — none of the candidate paths exist yet (no PostToolUse hook has run this session, or this host has no hook surface for it)');
+        out.push('no data — none of the candidate paths exist yet (no PostToolUse hook has run this session, or no PostToolUse hook is bound on this host)');
         return out;
     }
     const s = hygiene.state;

package/src/scripts/generate_capability_matrix.ts

@@ -136,7 +136,7 @@ const _FN_SPEC: Record<string, FnSpec> = {
 // Surfaces the INSTALLER provides outside generate_tools() (so the derivation
 // guard stays pure). Marked with a † footnote in the rendered matrix.
 const _INSTALL_TIME_CELLS: Record<string, Record<string, string>> = {
-    rules: { copilot: 'adapter' }, // .github/copilot-instructions.md (aggregated, install.py)
+    rules: { copilot: 'adapter' }, // .github/copilot-instructions.md (aggregated, the installer)
 };
 
 // Python: re.compile(r"\b(generate_[A-Za-z0-9_]+)\s*\(").

package/src/scripts/git_authorization_hook.ts

@@ -61,6 +61,10 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { humanTypedThisTurn as _humanTypedThisTurn } from "./_lib/machine_wake.js";
 
+import {
+  CONSEQUENCE_PHRASES,
+  extractObjects,
+} from "./_lib/consequence_objects.js";
 import { atomic_write_json } from "./hooks/state_io.js";
 import { readHookStdin } from "./hooks/hook_stdin.js";
 
@@ -235,7 +239,36 @@ export type GitOp =
   /** Deleting a branch, locally or on the remote. */
   | "branch-delete"
   /** Closing a pull request or an issue. */
-  | "close";
+  | "close"
+
+  // ── Consequence operations, added 2026-09-06
+  // (`road-to-authorization-that-reaches-further` 2.1).
+  //
+  // The boundaries the owner named had NO vocabulary at all, so an
+  // authorization the user gave in plain words was invisible to the record and
+  // the matching operation was invisible to the count. These seven are NOT git
+  // operations, and the union's name is now narrower than its contents — a
+  // rename touches every consumer and buys nothing the doc comments do not.
+  //
+  // RECORDING AN AUTHORIZATION IS NOT GRANTING ONE. After ADR-254 there is no
+  // grantor left in this package: the ledger concern is advisory by manifest
+  // and the only consumer that acts on this vocabulary is the after-the-fact
+  // count in `conformance_scan`. Nothing here refuses, and nothing here may be
+  // read as a step toward refusing.
+  /** Deploying to a production environment. */
+  | "prod-deploy"
+  /** Destroying production data — a table, a bucket, a collection, rows. */
+  | "prod-data-destroy"
+  /** Changing production infrastructure — cluster, IAM, DNS, network. */
+  | "prod-infra-change"
+  /** Sending something outward that a third party receives. */
+  | "external-send"
+  /** Moving money — a charge, a refund, a payout, a transfer. */
+  | "money-movement"
+  /** Force-pushing a shared trunk, as distinct from a feature branch. */
+  | "trunk-force-push"
+  /** Destroying work outside the task's own scope. */
+  | "out-of-scope-destruction";
 
 export const ALL_OPS: readonly GitOp[] = [
   "commit",
@@ -264,6 +297,13 @@ export const ALL_OPS: readonly GitOp[] = [
   "stash-drop",
   "branch-delete",
   "close",
+  "prod-deploy",
+  "prod-data-destroy",
+  "prod-infra-change",
+  "external-send",
+  "money-movement",
+  "trunk-force-push",
+  "out-of-scope-destruction",
 ];
 
 /**
@@ -432,6 +472,8 @@ const PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
     op: "pr-merge-auto",
     re: /\bauto[-\s]?merge\b|\bmerge\b[^.\n]{0,20}\bautomatisch\b|\bautomatisch\b[^.\n]{0,20}\bmerg(e|en)\b/i,
   },
+
+  ...CONSEQUENCE_PHRASES,
 ];
 
 /**
@@ -615,6 +657,25 @@ export interface Ledger extends JsonObject {
    * as "no grants", which is the pre-ADR-252 behaviour exactly.
    */
   grants?: MergeGrant[];
+  /**
+   * The objects a consequence authorization named, per operation.
+   *
+   * An authorization for one table, one environment or one recipient class is
+   * not an authorization for another, and until now the record could not
+   * express the difference for anything but pull-request numbers
+   * (`MergeGrant.targets`). This is that distinction generalised to the
+   * consequence vocabulary.
+   *
+   * IT IS A RECORDED FIELD, NOT A MATCHING CONDITION. Nothing consults it to
+   * refuse anything; the one consumer is `conformance_scan`, which counts
+   * after the fact when an executed operation's object is absent here. Making
+   * it a matching condition is the ledger item ADR-254 left to the owner, and
+   * it is deliberately not taken here.
+   *
+   * Optional, so a ledger written by an older build still parses. Absent reads
+   * as "no objects named", which is exactly the pre-2.2 behaviour.
+   */
+  objects?: { [op: string]: string[] };
 }
 
 /**
@@ -1281,6 +1342,7 @@ export function takePending(
  * file for the discriminator and the captured evidence behind it.
  */
 export { humanTypedThisTurn } from "./_lib/machine_wake.js";
+export { extractObjects, OBJECT_REQUIRED_OPS } from "./_lib/consequence_objects.js";
 
 export function run(stdin_text: string, options: { consumer_root: string }): number {
   let envelope: JsonObject = {};
@@ -1332,6 +1394,17 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
       `"${prompt.trim().slice(0, 40)}"`;
   }
 
+  // The objects the prose named, per authorized operation. Recorded for every
+  // consequence op that names one; `OBJECT_REQUIRED_OPS` is the subset whose
+  // ABSENCE the conformance count reads as a finding, and that reading lives in
+  // the scan rather than here — this side records what was said, and never
+  // decides what it permits.
+  const objects: { [op: string]: string[] } = {};
+  for (const op of authorized) {
+    const named = extractObjects(op, prompt);
+    if (named.length > 0) objects[op] = named;
+  }
+
   const now = new Date();
   const ledger: Ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
@@ -1339,6 +1412,7 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
     authorized,
     evidence,
     prompt_chars: prompt.length,
+    objects,
     // Grants survive this write; `authorized` does not. That asymmetry IS the
     // decision. A bare operation name stays one-shot exactly as `commit-policy`
     // requires, and only an authorization that also froze its objects earns a