@event4u/agent-config 15.0.0 → 16.1.0

package/src/scripts/_lib/standing_bound_ratchet.ts

@@ -3,38 +3,63 @@
  *
  * WHY THIS EXISTS
  * ---------------
- * `src/config/preamble-payload-budget.json` says of its grace ceiling: *"It may
- * never move UP."* `grace_ceiling_history` in the same file records it moving up
- * twice — 138,212 → 138,273 on 2026-09-02 and 138,273 → 138,490 on 2026-09-08 —
- * each with a careful prose justification. ADR-264 resolved that contradiction
- * against the practice: the sentence stands, the two raises are violations caused
- * by contradictory wording, and standing-rule growth needs a compensating
- * reduction elsewhere.
+ * `src/config/preamble-payload-budget.json` said of its grace ceiling: *"It may
+ * never move UP."* `grace_ceiling_history` in the same file recorded it moving
+ * up twice — 138,212 → 138,273 on 2026-09-02 and 138,273 → 138,490 on
+ * 2026-09-08 — each with a careful prose justification. ADR-264 resolved that
+ * contradiction against the practice: the sentence stands, the two raises are
+ * violations caused by contradictory wording, and standing-rule growth needs a
+ * compensating reduction elsewhere.
  *
  * That decision then had no enforcement. A sentence in a JSON string is not a
- * gate, and the file's own history is the evidence: nothing objected either time.
- * This module is the enforcement — and it is the ONLY thing
- * `road-to-a-standing-budget-with-headroom` step 1.3 ships, because the 128-token
- * Iron Law reserve that step designed was refused by an AI council 2/2 on
- * 2026-09-08. See ADR-265.
+ * gate, and the file's own history was the evidence: nothing objected either
+ * time. This module is the enforcement.
+ *
+ * WHAT IT BOUNDS NOW — AND WHY THE SUBJECT CHANGED
+ * -------------------------------------------------
+ * It used to bound one number, `ci_delivery.grace_ceiling`. That key is GONE
+ * (`road-to-delivery-for-every-host` 4.4): the ceiling is no longer stored, it
+ * is MEASURED at the base ref as `max(design_ceiling, base + active grants)`.
+ * A measured ceiling captures every merged reduction automatically, which a
+ * stored one never did.
+ *
+ * Moving the ceiling out of the config did not remove the need for a
+ * shrink-only bound — it moved the attack surface. Three numbers in the tree
+ * can still widen the effective ceiling without adding a single token of
+ * payload, and all three are now bounded:
+ *
+ *   · `design_ceiling`, derived from `baseline_tokens` × `headroom_pct`. It is
+ *     the FLOOR of the measured ceiling, so raising it raises the ceiling
+ *     directly. ADR-264's sentence applies to it verbatim.
+ *   · every existing exception's `granted_tokens` — enlarging a live grant is
+ *     a raise wearing a break-glass label.
+ *   · every existing exception's `watermark` — the watermark is what pins the
+ *     base while a grant is live, so raising it launders the grant into the
+ *     next base, which is precisely the failure the watermark exists to stop.
+ *
+ * A NEW exception id is deliberately NOT a violation: recording a fresh,
+ * approved, dated grant is the break-glass path working. Editing one that
+ * already existed is not.
  *
  * WHAT IT CANNOT DO, STATED PLAINLY
  * ---------------------------------
  * The change under review can edit this file. Both council seats named that as
- * the defect fatal to the reserve — "the checker, its imports, token census,
- * workflow, and status context are all part of the trusted computing base", so a
- * protected record read by an unprotected verifier grants nothing. It is fatal to
- * a mechanism that GRANTS budget and it is not fatal to one that only REFUSES,
- * which is the whole reason the reserve stayed unshipped and this ratchet did
- * not: disabling this check requires visibly editing it, and every gate in this
- * repository already rests on that same review. A ratchet whose only failure mode
- * is "someone deleted the ratchet" is strictly better than the sentence it
- * replaces, which had no failure mode because it did nothing.
+ * the defect fatal to a mechanism that GRANTS budget, and it is not fatal to
+ * one that only REFUSES: disabling this check requires visibly editing it, and
+ * every gate in this repository already rests on that same review. A ratchet
+ * whose only failure mode is "someone deleted the ratchet" is strictly better
+ * than the sentence it replaces, which had no failure mode because it did
+ * nothing. The 2026-09-10 verdict added one mitigation on top and named its
+ * limit in the same breath: CI runs this code AS IT EXISTS AT THE BASE REF, so
+ * a same-PR weakening cannot measure its own change — *"the mechanism does not
+ * prevent the exploit; it makes the exploit auditable."*
  */
 import { spawnSync } from 'node:child_process';
 
-/** Repo-relative path of the budget config the bound lives in. */
+/** Repo-relative path of the budget config the bounds live in. */
 export const BUDGET_CONFIG_PATH = 'src/config/preamble-payload-budget.json';
+/** Repo-relative path of the break-glass ledger the grant bounds live in. */
+export const EXCEPTIONS_CONFIG_PATH = 'src/config/preamble-payload-exceptions.json';
 
 /** Injection seam: run git, capture output, never throw on a non-zero exit. */
 export type GitRunner = (args: readonly string[], cwd: string) => {
@@ -48,28 +73,68 @@ export const realGit: GitRunner = (args, cwd) => {
     return { ok: r.status === 0, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
 };
 
+/** Named shrink-only numbers, keyed by a stable bound id. */
+export type BoundSet = Record<string, number>;
+
 export interface BoundsRatchetVerdict {
     ok: boolean;
     violations: string[];
-    /** The bound read at the base ref, or `null` when it could not be read. */
-    baseGraceCeiling: number | null;
+    /** The bounds read at the base ref, or `null` when they could not be read. */
+    baseBounds: BoundSet | null;
     /** The ref compared against, or `null` when none resolved. */
     baseRef: string | null;
     /** Why the comparison was skipped, when it was. Printed, never silent. */
     note: string | null;
     /**
-     * `false` means the bound could not be READ, not that it rose.
+     * `false` means the bounds could not be READ, not that one rose.
      *
      * Two refusals reach a caller with `ok: false` and they need opposite
-     * actions: a risen ceiling is fixed by lowering the addition, an
-     * unverifiable one by repairing the checkout. A completion review caught
-     * both being rendered as "ROSE", which would send an operator to shrink a
-     * rule over what was a fetch problem. Absent means verified — the only
-     * `ok: false` that predates this field is a genuine rise.
+     * actions: a risen bound is fixed by lowering the addition, an unverifiable
+     * one by repairing the checkout. A completion review caught both being
+     * rendered as "ROSE", which would send an operator to shrink a rule over
+     * what was a fetch problem.
      */
     verified: boolean;
 }
 
+/**
+ * The bound map, derived identically from head and base configs.
+ *
+ * ONE function for both sides, on purpose: two derivations of one boundary is
+ * the drift shape that let the grace ceiling rise twice under a sentence
+ * forbidding it. `budget` and `exceptions` are parsed JSON, or `null` when the
+ * file is absent — an absent exceptions ledger contributes no bounds, which is
+ * correct: there are no grants to protect.
+ */
+export function boundsFrom(budget: unknown, exceptions: unknown): BoundSet | null {
+    const b = (budget ?? null) as Record<string, unknown> | null;
+    if (b === null) return null;
+    const baseline = Number(b['baseline_tokens']);
+    const headroom = Number(b['headroom_pct']);
+    if (!Number.isFinite(baseline) || !Number.isFinite(headroom)) return null;
+    // `design_ceiling` is the whole config-side bound now. The retained stored
+    // allowance stage 1 kept beside it was deleted in stage 2 (ADR-276), so a
+    // tree at or below design is bounded by this number and a tree above it is
+    // bounded by its own base measurement — neither of which lives in a field
+    // anyone can edit upward.
+    const out: BoundSet = { design_ceiling: Math.round(baseline * (1 + headroom / 100)) };
+
+    const ex = (exceptions ?? null) as Record<string, unknown> | null;
+    const list = ex === null ? null : ex['exceptions'];
+    if (Array.isArray(list)) {
+        for (const item of list) {
+            const e = (item ?? {}) as Record<string, unknown>;
+            const id = e['id'];
+            if (typeof id !== 'string' || id.trim() === '') continue;
+            const granted = Number(e['granted_tokens']);
+            const watermark = Number(e['watermark']);
+            if (Number.isFinite(granted)) out[`exception:${id}:granted_tokens`] = granted;
+            if (Number.isFinite(watermark)) out[`exception:${id}:watermark`] = watermark;
+        }
+    }
+    return out;
+}
+
 function showAtRef(git: GitRunner, repoRoot: string, ref: string, relPath: string): string | null {
     const r = git(['show', `${ref}:${relPath}`], repoRoot);
     return r.ok ? r.stdout : null;
@@ -78,29 +143,24 @@ function showAtRef(git: GitRunner, repoRoot: string, ref: string, relPath: strin
 /**
  * A condition that stops the comparison: skip when advisory, refuse when not.
  *
- * One helper for all four causes rather than four inline branches, so the
- * posture cannot drift between them — the failure this closes was four
- * independent `ok: true` returns that all had to be found before any of them
- * could be trusted.
+ * One helper for all causes rather than an inline branch each, so the posture
+ * cannot drift between them — the failure this closes was four independent
+ * `ok: true` returns that all had to be found before any of them could be
+ * trusted.
  */
-function unverified(
-    reason: string,
-    requireBase: boolean,
-    baseGraceCeiling: number | null,
-    baseRef: string | null,
-): BoundsRatchetVerdict {
+function unverified(reason: string, requireBase: boolean, baseRef: string | null): BoundsRatchetVerdict {
     if (requireBase) {
         return {
             ok: false,
             verified: false,
-            baseGraceCeiling,
+            baseBounds: null,
             baseRef,
-            note: `${reason}, so the shrink-only bound was NOT verified in this run`,
+            note: `${reason}, so the shrink-only bounds were NOT verified in this run`,
             violations: [
-                `the shrink-only bound could not be verified: ${reason}. This run is `
+                `the shrink-only bounds could not be verified: ${reason}. This run is `
                     + 'ENFORCING, so an unverifiable bound refuses rather than skips — an '
                     + 'unreadable base would otherwise grant budget on an infrastructure '
-                    + 'failure. This is NOT a ceiling rise: fix the checkout (a full fetch '
+                    + 'failure. This is NOT a bound rise: fix the checkout (a full fetch '
                     + 'of the base ref) rather than lowering the addition.',
             ],
         };
@@ -109,33 +169,29 @@ function unverified(
         ok: true,
         verified: false,
         violations: [],
-        baseGraceCeiling,
+        baseBounds: null,
         baseRef,
-        note: `${reason}, so the shrink-only bound was NOT verified in this run`,
+        note: `${reason}, so the shrink-only bounds were NOT verified in this run`,
     };
 }
 
 /**
- * Compare the grace ceiling in this tree against the one at the base ref.
+ * Compare every shrink-only bound in this tree against the one at the base ref.
  *
  * TWO POSTURES, AND WHICH ONE APPLIES IS THE CALLER'S TO DECLARE.
  *
- * Advisory (the default, and what every caller got before `requireBase`): a
- * base ref or base config that cannot be read SKIPS, reported in both the human
- * and JSON output so it cannot pass for a check. That default is not laziness
- * and the original reasoning still holds — a shallow clone, a first commit and
- * a detached build all legitimately have no base, and a gate that reds on them
- * gets switched off, which is how a repository loses the enforcement it just
- * built.
+ * Advisory (the default): a base ref or base config that cannot be read SKIPS,
+ * reported in both the human and JSON output so it cannot pass for a check.
+ * That default is not laziness and the original reasoning still holds — a
+ * shallow clone, a first commit and a detached build all legitimately have no
+ * base, and a gate that reds on them gets switched off, which is how a
+ * repository loses the enforcement it just built.
  *
  * Enforcing (`requireBase: true`): the same conditions REFUSE. An AI council
  * (2/2, 2026-09-10) made this blocking for the move to a base-measured ceiling,
- * and the reason is that the asymmetry above inverts once the base ref stops
- * being a cross-check and becomes the ceiling itself. Today an unreadable base
- * costs a comparison; there it would grant an unbounded budget on an
- * infrastructure failure — the exact fail-open the reserve decision refused.
- * anthropic's wording was "replaced or mode-gated"; this is the mode gate, so
- * that no existing caller silently changes behaviour.
+ * because the asymmetry inverts once the base ref stops being a cross-check and
+ * becomes the ceiling itself. Today an unreadable base costs a comparison;
+ * there it would grant an unbounded budget on an infrastructure failure.
  *
  * The flag is the caller's rather than derived from `GITHUB_ACTIONS` here: this
  * module cannot tell an enforcing CI run from a diagnostic one on the same
@@ -154,67 +210,124 @@ export function assertBoundsDidNotRise(opts: {
      */
     requireBase?: boolean;
     /**
-     * The ceiling this run actually compares the payload against.
+     * The shrink-only numbers as they stand in THIS tree.
      *
-     * The CI step passes `--ceiling <grace_ceiling>`, so the effective bound can
-     * be raised either by editing the config or by passing a bigger number. Both
-     * arrive here as one value, which closes the second path without a second
-     * check.
+     * Passed in rather than re-read here so head and base go through
+     * `boundsFrom` from the caller's own configuration objects — including an
+     * effective value the caller may have taken from a flag rather than the
+     * file, which is the second path a bound could otherwise be widened by.
      */
-    headGraceCeiling: number;
+    headBounds: BoundSet;
 }): BoundsRatchetVerdict {
     const git = opts.git ?? realGit;
     const requireBase = opts.requireBase === true;
     if (opts.baseRef === null || opts.baseRef.trim() === '') {
-        return unverified('no base ref resolved', requireBase, null, null);
+        return unverified('no base ref resolved', requireBase, null);
     }
     const cfg = showAtRef(git, opts.repoRoot, opts.baseRef, BUDGET_CONFIG_PATH);
     if (cfg === null) {
-        return unverified(
-            `${BUDGET_CONFIG_PATH} could not be read at ${opts.baseRef}`,
-            requireBase,
-            null,
-            opts.baseRef,
-        );
+        return unverified(`${BUDGET_CONFIG_PATH} could not be read at ${opts.baseRef}`, requireBase, opts.baseRef);
     }
-    let baseGrace: number | null = null;
+    let baseBudget: unknown;
     try {
-        const parsed = JSON.parse(cfg) as Record<string, unknown>;
-        const delivery = (parsed['ci_delivery'] ?? {}) as Record<string, unknown>;
-        const n = Number(delivery['grace_ceiling']);
-        baseGrace = Number.isFinite(n) ? n : null;
+        baseBudget = JSON.parse(cfg);
     } catch {
+        return unverified(`${BUDGET_CONFIG_PATH} at ${opts.baseRef} is not parseable`, requireBase, opts.baseRef);
+    }
+    // An absent exceptions ledger at the base ref is normal — it did not exist
+    // before this mechanism landed, and a ref predating it has no grants to
+    // protect. An unparseable one is not, and refuses like a bad budget.
+    const exRaw = showAtRef(git, opts.repoRoot, opts.baseRef, EXCEPTIONS_CONFIG_PATH);
+    let baseExceptions: unknown = null;
+    if (exRaw !== null) {
+        try {
+            baseExceptions = JSON.parse(exRaw);
+        } catch {
+            return unverified(
+                `${EXCEPTIONS_CONFIG_PATH} at ${opts.baseRef} is not parseable`,
+                requireBase,
+                opts.baseRef,
+            );
+        }
+    }
+
+    const baseBounds = boundsFrom(baseBudget, baseExceptions);
+    if (baseBounds === null) {
         return unverified(
-            `${BUDGET_CONFIG_PATH} at ${opts.baseRef} is not parseable`,
+            `there are no shrink-only bounds at ${opts.baseRef} to ratchet against`,
             requireBase,
-            null,
             opts.baseRef,
         );
     }
-    if (baseGrace === null) {
-        return unverified(
-            `there is no ci_delivery.grace_ceiling at ${opts.baseRef} to ratchet against`,
-            requireBase,
-            null,
-            opts.baseRef,
+
+    const violations: string[] = [];
+    for (const [name, head] of Object.entries(opts.headBounds)) {
+        const base = baseBounds[name];
+        // A bound absent at the base is a NEW one — a freshly recorded grant,
+        // which is the break-glass path working rather than a rise.
+        if (base === undefined) continue;
+        if (head > base) violations.push(explain(name, base, head, opts.baseRef));
+    }
+
+    // DELETION CANNOT DISCHARGE DEBT. A grant that existed at the base and is
+    // gone at head was not repaid, it was erased — the 2026-09-11 council's
+    // blocking finding #3, and the one failure a shrink-only comparison misses
+    // by construction, because a removed number is not a smaller number.
+    // Only `exception:` bounds are checked for deletion: `design_ceiling` is
+    // always present, and the stored allowance that used to need an exemption
+    // here no longer exists.
+    const reportedDeletions = new Set<string>();
+    for (const name of Object.keys(baseBounds)) {
+        if (!name.startsWith('exception:')) continue;
+        if (opts.headBounds[name] !== undefined) continue;
+        const m = /^exception:(.+):(?:granted_tokens|watermark)$/.exec(name);
+        const id = m === null ? name : String(m[1]);
+        // One record carries two bounds; report the record once.
+        if (reportedDeletions.has(id)) continue;
+        reportedDeletions.add(id);
+        violations.push(
+            `standing-payload exception '${id}' existed at ${opts.baseRef} and is gone at head. A deleted ` +
+                'record is not a repaid one: repayment is established by the payload returning to the ' +
+                'watermark, and erasing the entry erases the debt along with the evidence of it. Mark it ' +
+                'repaid once the measurement supports that, or leave it in place.',
         );
     }
-    if (opts.headGraceCeiling > baseGrace) {
-        return {
-            ok: false,
-            verified: true,
-            baseGraceCeiling: baseGrace,
-            baseRef: opts.baseRef,
-            note: null,
-            violations: [
-                `the standing-payload grace ceiling rose from ${String(baseGrace)} to ` +
-                    `${String(opts.headGraceCeiling)} against ${opts.baseRef}. ` +
-                    `${BUDGET_CONFIG_PATH} says it may not move upward and ADR-264 decided that ` +
-                    'the sentence stands: standing-rule growth needs a compensating reduction ' +
-                    'elsewhere, not a bigger ceiling. Lower the addition, migrate the prose out of ' +
-                    'the standing rule, or reduce another standing asset by the same amount.',
-            ],
-        };
+
+    if (violations.length > 0) {
+        return { ok: false, verified: true, baseBounds, baseRef: opts.baseRef, note: null, violations };
+    }
+    return { ok: true, verified: true, violations: [], baseBounds, baseRef: opts.baseRef, note: null };
+}
+
+/** One refusal message per bound kind — a generic "a bound rose" sends the
+ *  reader nowhere, and the three kinds have three different fixes. */
+function explain(name: string, base: number, head: number, baseRef: string): string {
+    const rose = `rose from ${String(base)} to ${String(head)} against ${baseRef}`;
+    if (name === 'design_ceiling') {
+        return (
+            `the standing-payload design ceiling ${rose}. It derives from baseline_tokens × ` +
+            `headroom_pct in ${BUDGET_CONFIG_PATH}, and it is the FLOOR of the measured ceiling, so ` +
+            'raising it widens every future budget without adding a token of payload. ADR-264 decided ' +
+            'that standing-rule growth needs a compensating reduction elsewhere, not a bigger ceiling. ' +
+            'Lower the addition, migrate the prose out of the standing rule, or reduce another standing ' +
+            'asset by the same amount.'
+        );
+    }
+    const m = /^exception:(.+):(granted_tokens|watermark)$/.exec(name);
+    if (m !== null && m[2] === 'granted_tokens') {
+        return (
+            `standing-payload exception '${String(m[1])}' had its grant ${rose}. Enlarging a grant that ` +
+            'already exists is a ceiling raise wearing a break-glass label. Record a NEW approved, dated ' +
+            'exception instead, so the enlargement carries its own approver, reason and expiry.'
+        );
+    }
+    if (m !== null) {
+        return (
+            `standing-payload exception '${String(m[1])}' had its watermark ${rose}. The watermark pins the ` +
+            'base while the grant is live, and raising it launders the granted tokens into the next base — ' +
+            'which is exactly the failure the watermark exists to prevent. It is the payload measured ' +
+            'BEFORE the grant and does not change afterwards.'
+        );
     }
-    return { ok: true, verified: true, violations: [], baseGraceCeiling: baseGrace, baseRef: opts.baseRef, note: null };
+    return `the shrink-only bound '${name}' ${rose}, and ${BUDGET_CONFIG_PATH} says it may not move upward.`;
 }

package/src/scripts/_lib/test_delta.ts

@@ -0,0 +1,166 @@
+/**
+ * Shared classification for the two test gates —
+ * `road-to-adversarial-verification-and-long-runs` Phase 2.4.
+ *
+ * `check_test_delta` and `check_test_weakening` ask different questions about
+ * the same diff, and both need the same answer to "is this path code?" and "is
+ * this path a test?". Two copies of that answer is how one gate starts counting
+ * a file the other does not, so the predicates live here once.
+ *
+ * Pure, and `node:`-free, so either gate and their tests may import it.
+ */
+
+/** A changed path that is production code this repository ships or runs. */
+export function isCodePath(p: string): boolean {
+    const f = p.replace(/\\/g, '/');
+    if (isTestPath(f)) return false;
+    if (!/\.(ts|tsx|js|mjs|cjs)$/.test(f)) return false;
+    if (f.endsWith('.d.ts')) return false;
+    // Generated trees are projections of `src/`, never an independent change.
+    if (/^(dist|\.augment|\.claude|\.cursor|node_modules)\//.test(f)) return false;
+    return /^(src|scripts)\//.test(f);
+}
+
+/** A changed path that carries tests. */
+export function isTestPath(p: string): boolean {
+    const f = p.replace(/\\/g, '/');
+    if (/^tests\//.test(f)) return true;
+    return /\.(test|spec)\.(ts|tsx|js|mjs|cjs)$/.test(f);
+}
+
+/**
+ * An independent-verdict artefact — the thing that makes a weakening legitimate.
+ *
+ * Deliberately a PATH test and not a content test. Whether the artefact actually
+ * contains an independent verdict is exactly the judgement `evaluator-independence`
+ * says no gate can make, so this gate checks that one was COMMITTED and leaves
+ * its quality to the review. Claiming more would be the coverage inflation that
+ * rule was written over.
+ */
+export function isVerdictArtefact(p: string): boolean {
+    const f = p.replace(/\\/g, '/');
+    return /^agents\/evidence\/reviews\//.test(f) && f.endsWith('.md');
+}
+
+/** One file's hunks, as a unified diff splits them. */
+export interface FileDiff {
+    readonly path: string;
+    readonly added: readonly string[];
+    readonly removed: readonly string[];
+}
+
+/**
+ * Split a unified diff into per-file added/removed line lists.
+ *
+ * Tolerant by construction: an unparseable header is skipped rather than thrown
+ * on, because a gate that crashes on an unusual diff blocks the fix for the
+ * diff that produced it. `+++ b/<path>` is the authority for the path — a rename
+ * shows the destination, which is the file whose assertions now count.
+ */
+export function parseUnifiedDiff(diff: string): FileDiff[] {
+    const out: FileDiff[] = [];
+    let path: string | null = null;
+    let oldPath: string | null = null;
+    let added: string[] = [];
+    let removed: string[] = [];
+    const flush = (): void => {
+        if (path !== null) out.push({ path, added, removed });
+        added = [];
+        removed = [];
+    };
+    for (const line of diff.split('\n')) {
+        if (line.startsWith('diff --git ')) {
+            flush();
+            path = null;
+            oldPath = null;
+            continue;
+        }
+        if (line.startsWith('--- ')) {
+            const p = line.slice(4).trim();
+            oldPath = p === '/dev/null' ? null : p.replace(/^a\//, '');
+            continue;
+        }
+        if (line.startsWith('+++ ')) {
+            const p = line.slice(4).trim();
+            // A DELETION (`+++ /dev/null`) keeps the OLD path rather than
+            // dropping the file. Reported by an independent review of the change
+            // that introduced this parser: deleting a test file is the maximal
+            // form of the weakening this gate exists to see, and `git rm
+            // tests/x.test.ts` was the cheapest way past it — the deletion even
+            // counted as a `tests/` path for the sibling delta gate. A file whose
+            // every assertion is removed at once is not zero signal.
+            path = p === '/dev/null' ? oldPath : p.replace(/^b\//, '');
+            continue;
+        }
+        if (line.startsWith('@@')) continue;
+        if (path === null) continue;
+        if (line.startsWith('+')) added.push(line.slice(1));
+        else if (line.startsWith('-')) removed.push(line.slice(1));
+    }
+    flush();
+    return out;
+}
+
+/**
+ * Lines that assert something.
+ *
+ * Framework-spread on purpose — this suite runs vitest, and the rule it enforces
+ * ships to consumers running pytest, PHPUnit and Go. A gate that only recognises
+ * one framework reports every other project as assertion-free, which is a false
+ * green and worse than no gate.
+ */
+const ASSERTION = /\b(expect|assert|assertThat|self\.assert|should\.|\.toBe|\.toEqual|\.toMatch|assertEquals|assertTrue|require\.(New|Equal|NoError))/;
+
+/** Lines that disable a test rather than assert with it. */
+const SUPPRESSION =
+    /(\b(it|test|describe|context)\s*\.\s*(skip|todo|failing)\b|\bxit\b|\bxdescribe\b|@pytest\.mark\.(skip|xfail)|\bt\.Skip\(|->markTestSkipped\(|@group\s+skip)/;
+
+/**
+ * A line whose match is DATA, not code — a diff line held inside a string.
+ *
+ * Found by this gate reporting its own test file: a suite that tests a
+ * suppression detector necessarily contains suppression-shaped strings as
+ * fixtures (`'+@pytest.mark.skip\n'`), and counting those made the gate report
+ * the one file whose job is to prove it works. Generalised rather than
+ * special-cased to that path — every gate that reads diffs will have a test
+ * suite shaped exactly this way, and "the gate exempts its own tests" is the
+ * carve-out that makes a detector unfalsifiable.
+ *
+ * The discriminator is a quote immediately followed by a diff marker: a string
+ * literal whose content begins `+` or `-`. Real test code does not open a string
+ * with a diff marker; a diff fixture does nothing else.
+ */
+const DIFF_LINE_AS_DATA = /['"`][+-]/;
+
+/** Counted evidence about one test file's diff. */
+export interface WeakeningSignal {
+    readonly path: string;
+    /** Assertions removed minus assertions added. Positive means a net loss. */
+    readonly assertionsLost: number;
+    /** Suppressions added minus suppressions removed. Positive means new skips. */
+    readonly suppressionsGained: number;
+}
+
+/**
+ * Measure a test file's diff as NET counts, never as raw removals.
+ *
+ * This is the discriminator the gate lives or dies on. Editing an assertion
+ * removes one line and adds another, so a gate counting raw removals reds every
+ * legitimate test edit — and a gate that reds every PR gets its exemption widened
+ * until it finds nothing, which is Risk 4 of the roadmap that commissioned it.
+ * A NET loss is a different claim: the file asserts less than it did.
+ */
+export function weakeningSignal(file: FileDiff): WeakeningSignal {
+    const count = (lines: readonly string[], re: RegExp): number =>
+        lines.filter((l) => re.test(l) && !DIFF_LINE_AS_DATA.test(l)).length;
+    return {
+        path: file.path,
+        assertionsLost: count(file.removed, ASSERTION) - count(file.added, ASSERTION),
+        suppressionsGained: count(file.added, SUPPRESSION) - count(file.removed, SUPPRESSION),
+    };
+}
+
+/** True when a signal is worth reporting at all. */
+export function isWeakening(s: WeakeningSignal): boolean {
+    return s.assertionsLost > 0 || s.suppressionsGained > 0;
+}