@event4u/agent-config 16.5.0 → 17.1.0

package/src/scripts/lint_example_fences.ts

@@ -71,6 +71,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { assignmentPattern } from './_lib/egress_rules.js';
 import { GateLedger } from './_lib/gate_ledger.js';
 import { runGateCli, runSelfTest } from './_lib/gate_self_test.js';
 import { reportScanned } from './_lib/scan_scope.js';
@@ -159,8 +160,16 @@ export const PATTERNS: readonly FencePattern[] = [
         source: 'tool-safety',
         langs: 'any',
         label: 'Credential assigned a literal value in an example',
-        pattern:
-            /\b(api[_-]?key|apikey|password|passwd|secret|access[_-]?token|client[_-]?secret)\b\s*[:=]\s*["'][^"']{8,}["']/i,
+        pattern: assignmentPattern(
+            {
+                keywords: ['apiKey', 'apikey', 'password', 'passwd', 'secret', 'accessToken', 'clientSecret'],
+                before: '\\b',
+                after: '\\b',
+                capture: true,
+                value: `["'][^"']{8,}["']`,
+            },
+            'i',
+        ),
         // Placeholders are the correct way to show the shape and must not fire.
         // `secret-vcs-guard` owns real credentials; this pattern owns the
         // *teaching* of an inline literal, so anything self-evidently fake is out.

package/src/scripts/lint_ghostwriter_source.ts

@@ -36,7 +36,12 @@ const QUIET = process.argv.slice(2).includes('--quiet');
 const REPO = path.resolve(path.dirname(_HERE), '..', '..');
 // 6.0.x (ADR-051): ghostwriter fixtures live at src/agent-src/ghostwriter/.
 const PACKAGE_DIR = path.join(REPO, 'src', 'agent-src', 'ghostwriter');
-const CONSUMER_DIR = path.join(REPO, 'agents', 'ghostwriter');
+// Every ghostwriter command writes profiles to `agents/reference/ghostwriter/`
+// (docs/contracts/ghostwriter-schema.md); `agents/ghostwriter/` is the legacy
+// path. Both are linted, canonical first, so a profile at either is checked.
+const CONSUMER_DIR = path.join(REPO, 'agents', 'reference', 'ghostwriter');
+const LEGACY_CONSUMER_DIR = path.join(REPO, 'agents', 'ghostwriter');
+const CONSUMER_DIRS: readonly string[] = [CONSUMER_DIR, LEGACY_CONSUMER_DIR];
 const ALLOWLIST = path.join(REPO, 'src', 'scripts', 'ghostwriter_fixture_allowlist.txt');
 const EXEMPT_STEMS: ReadonlySet<string> = new Set(['README']);
 
@@ -86,6 +91,35 @@ function _globMdSorted(dir: string): string[] {
     return out.sort();
 }
 
+/** Sorted `*.md` files anywhere under `dir`, nested directories included. */
+function _globMdRecursiveSorted(dir: string): string[] {
+    let entries: fs.Dirent[];
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+        return [];
+    }
+    const out: string[] = [];
+    for (const entry of entries) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(..._globMdRecursiveSorted(full));
+        } else if (entry.isFile() && entry.name.endsWith('.md')) {
+            out.push(full);
+        }
+    }
+    return out.sort();
+}
+
+/** Every consumer-side profile file, canonical path first, then legacy. */
+function consumer_profile_files(dirs: readonly string[] = CONSUMER_DIRS): string[] {
+    const out: string[] = [];
+    for (const dir of dirs) {
+        out.push(..._globMdRecursiveSorted(dir));
+    }
+    return out;
+}
+
 function _stem(p: string): string {
     const base = path.basename(p);
     const dot = base.lastIndexOf('.');
@@ -213,14 +247,11 @@ function lint_package_side(allowlist: Set<string>): string[] {
     return errors;
 }
 
-function lint_consumer_side(): string[] {
+function lint_consumer_side(dirs: readonly string[] = CONSUMER_DIRS): string[] {
     const errors: string[] = [];
-    if (!_exists(CONSUMER_DIR)) {
-        return errors;
-    }
     // (alias_ci → [source_path, source_value, source_kind])
     const seen = new Map<string, [string, string, string]>();
-    for (const p of _globMdSorted(CONSUMER_DIR)) {
+    for (const p of consumer_profile_files(dirs)) {
         if (EXEMPT_STEMS.has(_stem(p))) {
             continue;
         }
@@ -302,15 +333,13 @@ function main(): number {
     const pkg_count = _exists(PACKAGE_DIR)
         ? _globMdSorted(PACKAGE_DIR).filter((p) => !EXEMPT_STEMS.has(_stem(p))).length
         : 0;
-    const cons_count = _exists(CONSUMER_DIR)
-        ? _globMdSorted(CONSUMER_DIR).filter((p) => !EXEMPT_STEMS.has(_stem(p))).length
-        : 0;
+    const cons_count = consumer_profile_files().filter((p) => !EXEMPT_STEMS.has(_stem(p))).length;
     try {
         assertScanned({
             gate: 'lint_ghostwriter_source',
             scanned: pkg_count + cons_count,
             units: 'profile(s)',
-            roots: ['src/agent-src/ghostwriter', 'agents/ghostwriter'],
+            roots: ['src/agent-src/ghostwriter', 'agents/reference/ghostwriter', 'agents/ghostwriter'],
         });
     } catch (exc) {
         if (exc instanceof DeadScopeError) {
@@ -414,6 +443,9 @@ export {
     REPO,
     PACKAGE_DIR,
     CONSUMER_DIR,
+    LEGACY_CONSUMER_DIR,
+    CONSUMER_DIRS,
+    consumer_profile_files,
     ALLOWLIST,
     EXEMPT_STEMS,
     ALIAS_MIN_LEN,

package/src/scripts/lint_hook_manifest.ts

@@ -36,6 +36,7 @@ import { assertScanned, DeadScopeError } from "./_lib/scan_scope.js";
 import { asOf } from "./_lib/as_of.js";
 import { parseHostLowering, type HostLowering } from "./hooks/host_lowering.js";
 import { RE_ARM_EVENTS } from "./_lib/prefix_stable_surfaces.js";
+import { EXECUTION_VIEW_GRANTS } from "./hooks/egress_stage.js";
 
 // src/scripts/lint_hook_manifest.ts → two levels up is the repo root.
 const REPO_ROOT = path.resolve(
@@ -275,6 +276,30 @@ function _check_concerns(manifest: YamlObject, errors: string[]): Set<string> {
         }
       }
     }
+    // `payload_fields:` — field-level projection of the declared bodies. A
+    // non-list is ignored at run time, which would silently hand the concern
+    // whole bodies; a projection on a guard is ignored by design, so declaring
+    // one there states a narrowing that never happens.
+    if ("payload_fields" in spec) {
+      const raw = spec["payload_fields"];
+      if (!Array.isArray(raw) || raw.length === 0 || raw.some((f) => typeof f !== "string" || f === "")) {
+        errors.push(
+          `concerns.${name}: 'payload_fields' must be a non-empty list of key names`,
+        );
+      }
+      if (!("needs_payload_bodies" in spec)) {
+        errors.push(
+          `concerns.${name}: 'payload_fields' without 'needs_payload_bodies' ` +
+            `narrows bodies the concern never receives — declare the body classes`,
+        );
+      }
+      if (spec["fail_closed"] === true || spec["severity"] === "blocking") {
+        errors.push(
+          `concerns.${name}: 'payload_fields' has no effect on a blocking or ` +
+            `fail-closed concern, which always receives whole bodies — remove it`,
+        );
+      }
+    }
     // `re_arm:` — the named boundary at which a rebuilt prompt prefix is
     // expected and paid for once (`road-to-runtime-context-floors` step 1.2).
     // `check_prefix_stable_mutation` reads this key to decide whether a
@@ -826,6 +851,97 @@ export function _check_slot_answers(table: HostLowering, errors: string[]): void
   }
 }
 
+/**
+ * Host fields that replace what a tool or the model receives. The tool-output
+ * name is assembled rather than spelled, because a test pins that no file under
+ * src/ names it until the egress stage emits it (road-to-placeholders-on-the-wire
+ * step 3.2); refusing the field is not emitting it.
+ */
+const HOST_REWRITE_FIELDS: readonly string[] = ["updatedInput", ["updated", "ToolOutput"].join("")];
+const REWRITE_DECLARATION_KEYS: readonly string[] = ["rewrite", "rewrites"];
+
+/**
+ * ADR-285 — one dispatcher stage is the only rewriter. A concern that declares
+ * a rewrite, or whose own script names a host rewrite field, is refused: two
+ * concerns rewriting one input have no composition answer, so none may try.
+ */
+function _check_no_concern_rewrites(manifest: YamlObject, errors: string[]): void {
+  const concernsRaw = manifest["concerns"];
+  if (!isObject(concernsRaw)) return;
+  for (const [name, spec] of Object.entries(concernsRaw)) {
+    if (!isObject(spec)) continue;
+    const declared = REWRITE_DECLARATION_KEYS.find((k) => spec[k] !== undefined);
+    if (declared !== undefined) {
+      errors.push(
+        `concerns.${name}: rewrite-concern-refused — declares '${declared}', but only the ` +
+          `dispatcher's egress stage may produce a rewrite (ADR-285)`,
+      );
+    }
+    const script = spec["script"];
+    if (typeof script !== "string") continue;
+    let source = "";
+    try {
+      source = fs.readFileSync(path.join(REPO_ROOT, script), "utf8");
+    } catch {
+      continue; // missing script is already reported by _check_concerns
+    }
+    // Code forms only — a key, a quoted name, a property read. A header that
+    // explains the field in backticks (rtk_wrap_hook does) produces nothing.
+    const field = HOST_REWRITE_FIELDS.find((f) =>
+      [`${f}:`, `'${f}'`, `"${f}"`, `.${f}`].some((form) => source.includes(form)),
+    );
+    if (field !== undefined) {
+      errors.push(
+        `concerns.${name}: rewrite-concern-refused — ${script} names the host rewrite ` +
+          `field '${field}'; only the dispatcher's egress stage may produce a rewrite (ADR-285)`,
+      );
+    }
+  }
+}
+
+/**
+ * The execution view is granted by the dispatcher's closed list, never
+ * requested. Refused: a concern declaring `payload_view: execution` off the
+ * list, a blocking concern the list omits (it would be served tokens instead
+ * of the value it guards), and a listed concern that is not blocking.
+ */
+function _check_execution_view_grants(manifest: YamlObject, errors: string[]): void {
+  const concernsRaw = manifest["concerns"];
+  if (!isObject(concernsRaw)) return;
+  for (const [name, spec] of Object.entries(concernsRaw)) {
+    if (!isObject(spec)) continue;
+    const view = spec["payload_view"];
+    const granted = EXECUTION_VIEW_GRANTS.has(name);
+    const blocking = spec["severity"] === "blocking";
+    if (view !== undefined && view !== "execution" && view !== "placeholder") {
+      errors.push(`concerns.${name}: 'payload_view' must be execution or placeholder, got ${JSON.stringify(view)}`);
+    } else if (view === "execution" && !granted) {
+      errors.push(
+        `concerns.${name}: execution-view-not-granted — declares 'payload_view: execution' but is not on ` +
+          `EXECUTION_VIEW_GRANTS in src/scripts/hooks/egress_stage.ts; a declaration grants nothing`,
+      );
+    }
+    if (blocking && !granted) {
+      errors.push(
+        `concerns.${name}: execution-view-not-granted — severity: blocking but missing from ` +
+          `EXECUTION_VIEW_GRANTS; under protect it would be served placeholder tokens instead of the values it guards`,
+      );
+    } else if (granted && !blocking) {
+      errors.push(
+        `concerns.${name}: execution-view-not-granted — on EXECUTION_VIEW_GRANTS but not severity: blocking; ` +
+          `the execution view is for concerns that decide whether a call runs`,
+      );
+    }
+    if (granted && spec["script"] !== EXECUTION_VIEW_GRANTS.get(name)) {
+      errors.push(
+        `concerns.${name}: execution-view-not-granted — the grant is bound to ` +
+          `${String(EXECUTION_VIEW_GRANTS.get(name))}, but the manifest runs ${JSON.stringify(spec["script"])}; ` +
+          `the dispatcher will serve it the placeholder view`,
+      );
+    }
+  }
+}
+
 export function lint(
   manifestPath: string,
   strict: boolean,
@@ -858,6 +974,8 @@ export function lint(
   const concernNames = _check_concerns(manifest, errors);
   const bound = _check_platforms(manifest, concernNames, errors, warnings);
   _check_guard_payload_bodies(manifest, errors);
+  _check_no_concern_rewrites(manifest, errors);
+  _check_execution_view_grants(manifest, errors);
   _check_roles(manifest, concernNames, errors);
   _check_aliases(manifest, errors);
   _check_orphan_trampolines(manifest, errors);

package/src/scripts/lint_marketplace_install_completeness.ts

@@ -97,6 +97,10 @@ function load_hook_commands(hooks_path: string): Array<[string, string]> {
 
 /** Pull the agent-config subcommand out of a hooks.json command line. */
 function extract_subcommand(command_line: string): string | null {
+    // What `echo` or `printf` prints is not what the line runs: the
+    // no-dispatcher branch echoes prose that names "agent-config hook". A
+    // quoted string a shell executes, as in `sh -c '…'`, is left to match.
+    command_line = command_line.replace(/\b(echo|printf)((?:\s+(?:-\w+|'[^']*'))+)/g, (_m, verb: string) => verb);
     const m = _CMD_RE.exec(command_line);
     if (m) {
         return m[1] as string;

package/src/scripts/lint_mcp_config_security.ts

@@ -23,6 +23,7 @@ import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
+import { detect } from './_lib/egress_rules.js';
 import * as sl from './_lib/security_lint.js';
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
 
@@ -31,16 +32,13 @@ export const CHECK = 'mcp-config-security';
 //   Python: re.compile(r"(^|/)(\.mcp\.json|mcp\.json|claude_desktop_config\.json)")
 const _NAME_HINTS = /(^|\/)(\.mcp\.json|mcp\.json|claude_desktop_config\.json)/;
 
-// Real secret VALUES (prefix + enough key chars to be a live credential).
-//   Python (no flags):
-const _SECRET = new RegExp(
-    'sk-ant-[A-Za-z0-9_\\-]{20,}' +
-        '|sk-proj-[A-Za-z0-9_\\-]{20,}' +
-        '|AKIA[0-9A-Z]{16}' +
-        '|AIza[0-9A-Za-z_\\-]{35}' +
-        '|ghp_[0-9A-Za-z]{36}' +
-        '|eyJ[A-Za-z0-9_\\-]{10,}\\.[A-Za-z0-9_\\-]{10,}\\.[A-Za-z0-9_\\-]{10,}',
-);
+// Real secret VALUES — detected by the one rule table, which owns every
+// credential pattern (road-to-one-detector-and-the-senders-we-own 2.2). The
+// heuristic keyword assignment is not a structural credential and never was HIGH
+// here; this lint's HIGH tier stays the structural rows.
+export function hasInlineSecret(text: string): boolean {
+    return detect(text).some((span) => span.class === 'credential' && span.rule !== 'generic-assignment');
+}
 
 // Line-level smells (match on a single line).
 const _MED: ReadonlyArray<[RegExp, string]> = [
@@ -135,7 +133,7 @@ export function _scan(sf: sl.ScannedFile): sl.Finding[] {
     const out: sl.Finding[] = [];
     for (const [start, numbered] of _candidate_chunks(sf)) {
         for (const [lineno, text] of numbered) {
-            if (_SECRET.test(text)) {
+            if (hasInlineSecret(text)) {
                 out.push(
                     new sl.Finding(
                         sf.rel,

package/src/scripts/lint_plan_risk_register.ts

@@ -42,6 +42,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parse as parseYaml } from 'yaml';
 
 import { isAcceptanceCriteriaHeading } from './_lib/ac_heading.js';
+import { asOfMs } from './_lib/as_of.js';
 import { workspaceIdentity } from './_lib/git_common_dir.js';
 import { gitEnv } from './_lib/git_env.js';
 import { splitMarkdownRow } from './_lib/md_table.js';
@@ -609,6 +610,12 @@ function _reviewedIn(text: string): string | null {
  * reviewed exactly as the contract asks — every author-today/merge-tomorrow PR
  * reproduces it.
  *
+ * Within the run, a commit dated on or before the stamp is preferred, newest
+ * first: the marker takes a bare date, so a plan changed again the same day it
+ * was reviewed has no later value to write, and the contract (§ 1, "Residual
+ * (accepted)") resolves that same-day pair in favour of passing. A run with no
+ * such commit falls back to the commit that introduced the stamp.
+ *
  * The oldest commit of the run is the honest baseline, and the age matters:
  * comparing against the NEWEST commit carrying the stamp would compare the
  * current content with itself, making every committed file trivially fresh and
@@ -620,12 +627,22 @@ function _stampIntroducedAt(
     reviewed: string,
 ): HistoryEntry | undefined {
     let introduced: HistoryEntry | undefined;
+    let sameDay: HistoryEntry | undefined;
     for (const entry of history) {
         const blob = _blobAt(absPath, entry.sha);
         if (blob === null || _reviewedIn(blob) !== reviewed) break;
         introduced = entry;
+        // History is newest-first, so the first run member dated on or before
+        // the stamp is the newest such commit: a change committed the day the
+        // stamp names is covered by it (contract § 1, accepted residual).
+        if (sameDay === undefined && entry.date <= reviewed) sameDay = entry;
     }
-    return introduced;
+    return sameDay ?? introduced;
+}
+
+/** The latest calendar day anywhere on earth at the as-of instant (UTC+14), so no author's real today reads as future. */
+function _latestToday(now: number = asOfMs()): string {
+    return new Date(now + 14 * 3_600_000).toISOString().slice(0, 10);
 }
 
 export type FileStatus = 'ok' | 'draft-exempt' | 'grandfathered' | 'fail';
@@ -689,6 +706,16 @@ export function checkFile(absPath: string): FileResult {
         };
     }
     const violations = [...content.violations];
+    // A stamp after today would cover every commit made until that date as
+    // "reviewed" — the same-day residual of contract § 1 holds for today only.
+    if (content.reviewed !== null && content.reviewed > _latestToday()) {
+        violations.push({
+            file: absPath,
+            line: 1,
+            kind: 'future_review',
+            detail: `\`reviewed: ${content.reviewed}\` is later than today — stamp the day the review happened`,
+        });
+    }
     // A file with uncommitted modifications has no committed baseline for the
     // current content, so staleness is not judgeable — see
     // hasUncommittedChanges. The committed-history case below is unchanged.

package/src/scripts/lint_positioning.ts

@@ -2,7 +2,7 @@
 /**
  * Positioning consistency lint for event4u/agent-config.
  *
- * Ported from the retired Python `src/scripts/lint_positioning.py` (ADR-200, Phase 4 /
+ * Ported from its retired Python twin (ADR-200, Phase 4 /
  * Wave 4b). Mirrors the CLI contract EXACTLY — the `--quiet` argparse flag,
  * exit codes (0 clean, 1 drift, 2 missing PyYAML — inert here since `yaml`
  * is always present), byte-identical stdout (success line) and stderr
@@ -134,8 +134,8 @@ interface ParsedArgs {
 }
 
 function _argparse_error(message: string): never {
-    process.stderr.write('usage: lint_positioning.py [-h] [--quiet]\n');
-    process.stderr.write(`lint_positioning.py: error: ${message}\n`);
+    process.stderr.write('usage: lint_positioning [-h] [--quiet]\n');
+    process.stderr.write(`lint_positioning: error: ${message}\n`);
     process.exit(2);
 }
 
@@ -145,7 +145,7 @@ function parse_args(argv: readonly string[]): ParsedArgs {
         if (arg === '--quiet') {
             quiet = true;
         } else if (arg === '-h' || arg === '--help') {
-            process.stdout.write('usage: lint_positioning.py [-h] [--quiet]\n');
+            process.stdout.write('usage: lint_positioning [-h] [--quiet]\n');
             process.exit(0);
         } else {
             _argparse_error(`unrecognized arguments: ${arg}`);

package/src/scripts/lint_provenance.ts

@@ -76,6 +76,7 @@ const WEAK_COPYLEFT_SPDX_IDS = [
     'LGPL-2.1-only', 'LGPL-2.1-or-later', 'LGPL-2.1',
     'LGPL-3.0-only', 'LGPL-3.0-or-later', 'LGPL-3.0',
     'EPL-1.0', 'EPL-2.0', 'CDDL-1.0', 'CDDL-1.1',
+    'OFL-1.1',
 ];
 // The conservative fallback deny set (GPL/AGPL/SSPL family) — see the header
 // comment. Also part of the known-SPDX-id catalog, so a real GPL/AGPL/SSPL

package/src/scripts/lint_roadmap_blockers.ts

@@ -201,6 +201,18 @@ interface TargetIndex {
  */
 const USER_DECISION_OWNER_RE = /^-[ \t]*\*\*Owner:\*\*[ \t]*(maintainer|user|owner)\b/im;
 
+/**
+ * Template rule 20 "Route before you file": a human-owned blocker records the
+ * council verdict that sent it to a human, or why no council could be asked.
+ * Absent is ratcheted (the backlog predates the field); present-but-malformed
+ * is hard, since no entry carried the field on the day it shipped. Counted over
+ * this lint's own scope, so a blocker filed straight into a parked roadmap is
+ * not seen — parking itself is held by check_estate_count's later_roadmaps floor.
+ */
+const ROUTED_FIELD_RE = /^-[ \t]*\*\*Routed:\*\*[ \t]*(.*)$/im;
+const ROUTED_VALUE_RE =
+    /^(?:council[ \t]+\d{4}-\d{2}-\d{2}[ \t]+ESCALATE[ \t]+[—-][ \t]*\S|pending[ \t]+[—-][ \t]*\S)/;
+
 const REQUIRED_FIELDS: ReadonlyArray<readonly [string, RegExp]> = [
     ['Status', /^-[ \t]*\*\*Status:\*\*/im],
     ['Owner', /^-[ \t]*\*\*Owner:\*\*/im],
@@ -269,6 +281,27 @@ const TECHNICAL_CLASSES: ReadonlySet<string> = new Set([
  * parses as `1`: the taxonomy name is documentation for the reader and must
  * not have to be spelled identically in every entry to stay valid.
  */
+/** A `## Decisions` row resolved by `owner`, dated, that names blocker `id`. */
+function _ownerDecisionNames(text: string, id: string): boolean {
+    const lines = text.split('\n');
+    const start = lines.findIndex((l) => /^##\s+Decisions\s*$/.test(l));
+    if (start < 0) return false;
+    let resolvedCol = -1;
+    for (let i = start + 1; i < lines.length && !/^##\s/.test(lines[i] as string); i += 1) {
+        const line = (lines[i] as string).trim();
+        if (!line.startsWith('|')) continue;
+        const cells = line.replace(/^\|/, '').replace(/\|$/, '').split('|').map((c) => c.trim());
+        if (resolvedCol < 0) {
+            resolvedCol = cells.findIndex((c) => /^resolved[ _]by$/i.test(c));
+            continue;
+        }
+        if (cells[resolvedCol]?.replace(/`/g, '') !== 'owner') continue;
+        if (!line.includes(id) || !/\b\d{4}-\d{2}-\d{2}\b/.test(line)) continue;
+        return true;
+    }
+    return false;
+}
+
 function _blockerClass(body: string): string {
     const m = CLASS_FIELD_RE.exec(body);
     if (!m) {
@@ -327,6 +360,10 @@ interface ScanResult {
     hard: Violation[];
     /** Open entries that are not yet decidable — counted against the ratchet. */
     decidability: Violation[];
+    /** Open human-owned entries with no `Routed:` field — counted against its own ratchet. */
+    routing: Violation[];
+    /** Resolved human-only entries no owner `## Decisions` row names — ratcheted (K1). */
+    ownerClose: Violation[];
 }
 
 /** What a scan needs to resolve a qualified reference: who it is, and where it may point. */
@@ -339,6 +376,8 @@ interface ScanContext {
 function _scanBoth(rawText: string, ctx: ScanContext = {}): ScanResult {
     const violations: Violation[] = [];
     const decidability: Violation[] = [];
+    const routing: Violation[] = [];
+    const ownerClose: Violation[] = [];
     const text = _stripFencedCode(rawText);
     const declaredIds = new Set<string>();
     const userDecisionIds = new Set<string>();
@@ -401,6 +440,15 @@ function _scanBoth(rawText: string, ctx: ScanContext = {}): ScanResult {
             // Resolved entries are history — re-litigating a decision already
             // made would be churn, and the ratchet would never reach zero.
             const isResolved = /^-[ \t]*\*\*Status:\*\*[ \t]*resolved/im.test(body);
+            if (isResolved && ['', '3'].includes(_blockerClass(body)) && !_ownerDecisionNames(text, cur.id)) {
+                ownerClose.push({
+                    line: _lineAt(text, sectionStart + cur.start),
+                    message:
+                        `blocker '${cur.id}' is human-only and resolved, but no \`## Decisions\` row ` +
+                        'resolved by `owner` names it with a date — a class-3 blocker closes only on an ' +
+                        'owner decision (road-to-a-tick-the-shipped-path-earns 2.3)',
+                });
+            }
             if (!isResolved) {
                 openIds.add(cur.id);
                 // The class/run contract is HARD rather than ratcheted, and it
@@ -452,6 +500,24 @@ function _scanBoth(rawText: string, ctx: ScanContext = {}): ScanResult {
                         });
                     }
                 }
+                if (USER_DECISION_OWNER_RE.test(body)) {
+                    const routed = ROUTED_FIELD_RE.exec(body);
+                    const at = _lineAt(text, sectionStart + cur.start);
+                    if (routed === null) {
+                        routing.push({
+                            line: at,
+                            message: `blocker '${cur.id}' has a human Owner but no **Routed:** field`,
+                        });
+                    } else if (!ROUTED_VALUE_RE.test((routed[1] as string).trim())) {
+                        violations.push({
+                            line: at,
+                            message:
+                                `blocker '${cur.id}' declares **Routed:** '${(routed[1] as string).trim()}' — ` +
+                                "expected 'council YYYY-MM-DD ESCALATE — <reserved row>' or " +
+                                "'pending — <why the council was unreachable>' (templates/roadmaps.md rule 20)",
+                        });
+                    }
+                }
                 const gaps = DECIDABILITY_FIELDS.filter(([, re]) => !re.test(body)).map(
                     ([name]) => name,
                 );
@@ -518,7 +584,8 @@ function _scanBoth(rawText: string, ctx: ScanContext = {}): ScanResult {
     }
     violations.sort((a, b) => a.line - b.line);
     decidability.sort((a, b) => a.line - b.line);
-    return { hard: violations, decidability };
+    routing.sort((a, b) => a.line - b.line);
+    return { hard: violations, decidability, routing, ownerClose };
 }
 
 interface LocalBlockers {
@@ -534,7 +601,7 @@ interface LocalBlockers {
  * `<roadmap-stem>#<id>` resolves against the in-scope target named — never
  * estate-wide, so an unrelated roadmap adding a same-named blocker cannot change
  * what an existing marker means. A target that is declared but resolved makes
- * the marker STALE: `run-continuation` treats every marker as blocked, so a
+ * the marker STALE: the withdrawn `run-continuation` treated every marker as blocked, so a
  * marker on a resolved blocker would hold a step nothing holds any more.
  * "Superseded" is not a state — the format has no replacement pointer, so a
  * moved blocker is a reference to update, reported here as missing.
@@ -885,13 +952,24 @@ function main(): number {
     const index = _targetIndex();
     let failed = 0;
     const undecidable: Array<{ rel: string; v: Violation }> = [];
+    const unrouted: Array<{ rel: string; v: Violation }> = [];
+    const unowned: Array<{ rel: string; v: Violation }> = [];
     for (const roadmap of roadmaps) {
         const rel = _relPosix(roadmap, REPO_ROOT);
         const text = fs.readFileSync(roadmap, 'utf-8');
-        const { hard, decidability } = _scanBoth(text, { selfStem: path.basename(roadmap, '.md'), index });
+        const { hard, decidability, routing, ownerClose } = _scanBoth(text, {
+            selfStem: path.basename(roadmap, '.md'),
+            index,
+        });
         for (const v of decidability) {
             undecidable.push({ rel, v });
         }
+        for (const v of routing) {
+            unrouted.push({ rel, v });
+        }
+        for (const v of ownerClose) {
+            unowned.push({ rel, v });
+        }
         if (hard.length) {
             failed += 1;
             process.stderr.write(`❌  ${rel}\n`);
@@ -962,10 +1040,42 @@ function main(): number {
                 '    **What to do:** carrying a command, a path or an enumerated option set.\n' +
                 '    See templates/roadmaps.md rule 20.\n',
         );
+    }
+    const routingVerdict = checkRatchet({
+        gate: 'lint_roadmap_blockers:routing',
+        actual: unrouted.length,
+        repoRoot: REPO_ROOT,
+    });
+    if (!routingVerdict.ok) {
+        process.stderr.write(`❌  ${routingVerdict.message}\n`);
+        for (const { rel, v } of unrouted) {
+            process.stderr.write(`    ${rel}:${v.line}: ${v.message}\n`);
+        }
+        process.stderr.write(
+            '\n    Route a human-owned blocker through the council before filing it, and record\n' +
+                "    **Routed:** council YYYY-MM-DD ESCALATE — <reserved row>, or 'pending — <reason>'\n" +
+                '    when no council could be reached. A DECIDE is a ## Decisions row, not a blocker.\n' +
+                '    See templates/roadmaps.md rule 20 "Route before you file".\n',
+        );
+    }
+    const ownerVerdict = checkRatchet({
+        gate: 'lint_roadmap_blockers:owner-close',
+        actual: unowned.length,
+        repoRoot: REPO_ROOT,
+    });
+    if (!ownerVerdict.ok) {
+        process.stderr.write(`❌  ${ownerVerdict.message}\n`);
+        for (const { rel, v } of unowned) {
+            process.stderr.write(`    ${rel}:${v.line}: ${v.message}\n`);
+        }
+    }
+    if (!verdict.ok || !routingVerdict.ok || !ownerVerdict.ok) {
         return 1;
     }
     if (!QUIET) {
         process.stdout.write(`\n✅  ${roadmaps.length} roadmap(s) blocker-contract-clean\n`);
+        process.stdout.write(`✅  ${routingVerdict.message}\n`);
+        process.stdout.write(`✅  ${ownerVerdict.message}\n`);
         process.stdout.write(
             `✅  0 blocker id(s) open in both an active and an archived roadmap ` +
                 `(${_globArchivedRoadmaps().length} archived file(s) read)\n`,
@@ -998,7 +1108,7 @@ function _isCliEntry(): boolean {
 }
 
 if (_isCliEntry() || process.argv[1] === _HERE) {
-    process.exit(main());
+    process.exitCode = main();
 }
 
 export {