@lannguyensi/harness 0.42.0 → 0.44.0

package/dist/cli/validate/checks.js

@@ -329,7 +329,7 @@ export function checkSolutionAcceptanceKnobIgnored(manifest, probe) {
 // Self-attestation disclosure (task 43b107f2, harness-review-2026-07-01).
 // The generic `requires:`/`ledger_tag` engine matches substrings in ledger
 // content that the GATED AGENT can write directly via
-// `mcp__agent-grounding__ledger_add` — whoever can write the ledger can open
+// `mcp__grounding-mcp__ledger_add` — whoever can write the ledger can open
 // the gate. The two builtin packs were hardened to filesystem markers after
 // exactly this class of self-approval bug (docs/CLI.md, branch-protection),
 // but a custom block-policy is only as strong as its evidence producer.
@@ -371,7 +371,7 @@ export function checkPolicySelfAttestation(manifest) {
             message: `policy "${p.name}" blocks on requires.ledger_tag but declares no ` +
                 `producers: — the evidence source is undocumented, and the tag is ` +
                 `satisfied by ANY ledger writer, including the gated agent itself ` +
-                `via mcp__agent-grounding__ledger_add (advisory against the agent ` +
+                `via mcp__grounding-mcp__ledger_add (advisory against the agent ` +
                 `it gates). Declare a producers: entry naming the intended evidence ` +
                 `flow — an ask-kind producer for operator-in-the-loop approval ` +
                 `(alongside the mcp recovery producer the schema requires), or an ` +

package/dist/cli/validate/checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/cli/validate/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAkB1D,MAAM,wBAAwB,GAAG;IAC/B,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,YAAY;IACZ,MAAM;IACN,MAAM;CACP,CAAC;AAEF,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,OAAe;IACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC,SAAS,eAAe,CAAC,MAAc,EAAE,QAAgB;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC;QACnD,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;QACtB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB,EAAE,IAAY;IAChD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,WAAW;gBACtC,OAAO,EAAE,wBAAwB,QAAQ,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB,EAAE,IAAkB;IACtD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEvD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,IAAI,QAAuB,CAAC;QAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC5C,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,UAAU;gBACrC,OAAO,EAAE,GAAG,CAAC,QAAQ;oBACnB,CAAC,CAAC,8BAA8B,GAAG,CAAC,MAAM,EAAE;oBAC5C,CAAC,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE;aAC9C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO;QAC7B,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,eAAe;gBAC1C,OAAO,EAAE,4BAA4B,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;aAChE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,eAAe;gBAC1C,OAAO,EAAE,mCAAmC,MAAM,CAAC,IAAI,EAAE,GAAG;aAC7D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,eAAe;gBAC1C,OAAO,EAAE,qBAAqB,KAAK,CAAC,CAAC,CAAC,0BAA0B,GAAG,CAAC,WAAW,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB,EAAE,IAAY;IACnD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB,SAAS,GAAG;gBAC3C,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAY;IAClD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,WAAW;gBACnC,OAAO,EAAE,wBAAwB,QAAQ,EAAE;aAC5C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,WAAW;gBACnC,OAAO,EAAE,uBAAuB,QAAQ,EAAE;aAC3C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,WAAW;gBACnC,OAAO,EAAE,8BAA8B,QAAQ,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAkB,EAAE,IAAkB;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,gCAAgC,CAAC,qCAAqC;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAkB;IACxD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IACzE,IAAI,KAAK;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO;QACL;YACE,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,UAAU;YAChB,OAAO,EACL,qIAAqI;SACxI;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,+EAA+E;AAC/E,sEAAsE;AACtE,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,UAAU,+BAA+B,CAAC,QAAkB;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,cAAc;gBACpB,OAAO,EACL,kQAAkQ;aACrQ;SACF,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrF,OAAO;YACL;gBACE,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,WAAW;gBACjB,OAAO,EACL,6UAA6U;aAChV;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAClE,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACzB,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACxE,CAAC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,mEAAmE;AACnE,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,sEAAsE;AACtE,2EAA2E;AAC3E,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,MAAM,UAAU,kCAAkC,CAChD,QAAkB,EAClB,KAAqB;IAErB,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO;QACL;YACE,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,uDAAuD,gBAAgB,GAAG;gBAC1E,0EAA0E;gBAC1E,yEAAyE;gBACzE,oEAAoE;gBACpE,sEAAsE;gBACtE,2BAA2B,gBAAgB,QAAQ;gBACnD,wEAAwE;SAC3E;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,sDAAsD;AACtD,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,oEAAoE;AACpE,oEAAoE;AACpE,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,wDAAwD;AACxD,oEAAoE;AACpE,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO;YAAE,SAAS;QAC3D,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,4DAA4D;QAC5D,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI;YAAE,SAAS;QACvC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAClE,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,YAAY,CAAC,GAAG;YACtB,OAAO,EACL,WAAW,CAAC,CAAC,IAAI,kDAAkD;gBACnE,mEAAmE;gBACnE,mEAAmE;gBACnE,mEAAmE;gBACnE,qEAAqE;gBACrE,gEAAgE;gBAChE,mEAAmE;gBACnE,6DAA6D;gBAC7D,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,gFAAgF;AAChF,MAAM,UAAU,8BAA8B,CAAC,QAAkB;IAC/D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,EAAE,IAAI;YAAE,SAAS;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,yEAAyE;QACzE,sEAAsE;QACtE,0BAA0B;QAC1B,MAAM,6BAA6B,GACjC,IAAI,CAAC,wBAAwB,CAAC,KAAK,SAAS;YAC5C,IAAI,CAAC,kBAAkB,CAAC,KAAK,SAAS;YACtC,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;QAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAC;QAC/D,IAAI,6BAA6B,IAAI,CAAC,eAAe,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,YAAY,CAAC,GAAG;gBACtB,OAAO,EACL,WAAW,CAAC,CAAC,IAAI,gCAAgC;oBACjD,gEAAgE;oBAChE,8DAA8D;oBAC9D,kEAAkE;oBAClE,qDAAqD;oBACrD,mEAAmE;oBACnE,qCAAqC;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,iBAAiB;AACjB,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,gBAAgB,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,EAAE;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,qEAAqE;AACrE,gEAAgE;AAChE,mEAAmE;AACnE,oEAAoE;AACpE,mEAAmE;AACnE,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,SAAS,mCAAmC,CAAC,QAAkB;IAC7D,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GACR,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,UAAU,EAAE;YAC/D,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,UAAU,CAAC;QAChD,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,OAAqB,EAAE;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1C,OAAO;QACL,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC3B,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC3B,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC9B,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC7B,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC;QACpC,GAAG,uBAAuB,CAAC,QAAQ,CAAC;QACpC,GAAG,+BAA+B,CAAC,QAAQ,CAAC;QAC5C,GAAG,kCAAkC,CACnC,QAAQ,EACR,IAAI,CAAC,cAAc,IAAI,2BAA2B,EAAE,CACrD;QACD,GAAG,gBAAgB,CAAC,QAAQ,CAAC;QAC7B,GAAG,mCAAmC,CAAC,QAAQ,CAAC;QAChD,GAAG,8BAA8B,CAAC,QAAQ,CAAC;QAC3C,GAAG,0BAA0B,CAAC,QAAQ,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU;IACV,YAAY;IACZ,UAAU;IACV,eAAe;IACf,aAAa;IACb,wBAAwB;CACzB,CAAC"}
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/cli/validate/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAkB1D,MAAM,wBAAwB,GAAG;IAC/B,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,YAAY;IACZ,MAAM;IACN,MAAM;CACP,CAAC;AAEF,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,OAAe;IACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC,SAAS,eAAe,CAAC,MAAc,EAAE,QAAgB;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC;QACnD,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;QACtB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB,EAAE,IAAY;IAChD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,WAAW;gBACtC,OAAO,EAAE,wBAAwB,QAAQ,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB,EAAE,IAAkB;IACtD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEvD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,IAAI,QAAuB,CAAC;QAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC5C,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,UAAU;gBACrC,OAAO,EAAE,GAAG,CAAC,QAAQ;oBACnB,CAAC,CAAC,8BAA8B,GAAG,CAAC,MAAM,EAAE;oBAC5C,CAAC,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE;aAC9C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO;QAC7B,MAAM,cAAc,GAAG,GAAG,CAAC,eAAe,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,eAAe;gBAC1C,OAAO,EAAE,4BAA4B,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;aAChE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,eAAe;gBAC1C,OAAO,EAAE,mCAAmC,MAAM,CAAC,IAAI,EAAE,GAAG;aAC7D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,eAAe;gBAC1C,OAAO,EAAE,qBAAqB,KAAK,CAAC,CAAC,CAAC,0BAA0B,GAAG,CAAC,WAAW,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB,EAAE,IAAY;IACnD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB,SAAS,GAAG;gBAC3C,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAY;IAClD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,WAAW;gBACnC,OAAO,EAAE,wBAAwB,QAAQ,EAAE;aAC5C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,WAAW;gBACnC,OAAO,EAAE,uBAAuB,QAAQ,EAAE;aAC3C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,WAAW;gBACnC,OAAO,EAAE,8BAA8B,QAAQ,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAkB,EAAE,IAAkB;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,gCAAgC,CAAC,qCAAqC;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAkB;IACxD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IACzE,IAAI,KAAK;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO;QACL;YACE,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,UAAU;YAChB,OAAO,EACL,qIAAqI;SACxI;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,+EAA+E;AAC/E,sEAAsE;AACtE,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,UAAU,+BAA+B,CAAC,QAAkB;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,cAAc;gBACpB,OAAO,EACL,kQAAkQ;aACrQ;SACF,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrF,OAAO;YACL;gBACE,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,WAAW;gBACjB,OAAO,EACL,6UAA6U;aAChV;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAClE,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACzB,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACxE,CAAC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,mEAAmE;AACnE,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,sEAAsE;AACtE,2EAA2E;AAC3E,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,MAAM,UAAU,kCAAkC,CAChD,QAAkB,EAClB,KAAqB;IAErB,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO;QACL;YACE,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,uDAAuD,gBAAgB,GAAG;gBAC1E,0EAA0E;gBAC1E,yEAAyE;gBACzE,oEAAoE;gBACpE,sEAAsE;gBACtE,2BAA2B,gBAAgB,QAAQ;gBACnD,wEAAwE;SAC3E;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,sDAAsD;AACtD,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,oEAAoE;AACpE,oEAAoE;AACpE,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,wDAAwD;AACxD,oEAAoE;AACpE,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO;YAAE,SAAS;QAC3D,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,4DAA4D;QAC5D,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI;YAAE,SAAS;QACvC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAClE,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,YAAY,CAAC,GAAG;YACtB,OAAO,EACL,WAAW,CAAC,CAAC,IAAI,kDAAkD;gBACnE,mEAAmE;gBACnE,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,gEAAgE;gBAChE,mEAAmE;gBACnE,6DAA6D;gBAC7D,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,gFAAgF;AAChF,MAAM,UAAU,8BAA8B,CAAC,QAAkB;IAC/D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,EAAE,IAAI;YAAE,SAAS;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,yEAAyE;QACzE,sEAAsE;QACtE,0BAA0B;QAC1B,MAAM,6BAA6B,GACjC,IAAI,CAAC,wBAAwB,CAAC,KAAK,SAAS;YAC5C,IAAI,CAAC,kBAAkB,CAAC,KAAK,SAAS;YACtC,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;QAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAC;QAC/D,IAAI,6BAA6B,IAAI,CAAC,eAAe,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,YAAY,CAAC,GAAG;gBACtB,OAAO,EACL,WAAW,CAAC,CAAC,IAAI,gCAAgC;oBACjD,gEAAgE;oBAChE,8DAA8D;oBAC9D,kEAAkE;oBAClE,qDAAqD;oBACrD,mEAAmE;oBACnE,qCAAqC;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,iBAAiB;AACjB,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,gBAAgB,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,EAAE;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,qEAAqE;AACrE,gEAAgE;AAChE,mEAAmE;AACnE,oEAAoE;AACpE,mEAAmE;AACnE,mEAAmE;AACnE,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,SAAS,mCAAmC,CAAC,QAAkB;IAC7D,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GACR,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,UAAU,EAAE;YAC/D,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,UAAU,CAAC;QAChD,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,OAAqB,EAAE;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1C,OAAO;QACL,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC3B,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC3B,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC9B,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC7B,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC;QACpC,GAAG,uBAAuB,CAAC,QAAQ,CAAC;QACpC,GAAG,+BAA+B,CAAC,QAAQ,CAAC;QAC5C,GAAG,kCAAkC,CACnC,QAAQ,EACR,IAAI,CAAC,cAAc,IAAI,2BAA2B,EAAE,CACrD;QACD,GAAG,gBAAgB,CAAC,QAAQ,CAAC;QAC7B,GAAG,mCAAmC,CAAC,QAAQ,CAAC;QAChD,GAAG,8BAA8B,CAAC,QAAQ,CAAC;QAC3C,GAAG,0BAA0B,CAAC,QAAQ,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU;IACV,YAAY;IACZ,UAAU;IACV,eAAe;IACf,aAAa;IACb,wBAAwB;CACzB,CAAC"}

package/dist/policy-packs/builtin/branch-protection-runtime.d.ts

@@ -12,7 +12,7 @@ export declare const NON_PROTECTED_TAG_PREFIX = "branch:non-protected";
  * Operator escape-hatch tag, kept as a best-effort AUDIT echo only.
  *
  * SECURITY (audit finding #39): this tag is NO LONGER a trusted override
- * signal. The agent has direct `mcp__agent-grounding__ledger_add` access,
+ * signal. The agent has direct `mcp__grounding-mcp__ledger_add` access,
  * so it could self-write `branch-protection-ack:<anything>` and bless its
  * own protected-branch edit — exactly the self-approval backdoor the
  * understanding gate closed in agent-tasks/88ca4bb3 by moving the

package/dist/policy-packs/builtin/branch-protection-runtime.js

@@ -19,7 +19,7 @@ export const NON_PROTECTED_TAG_PREFIX = "branch:non-protected";
  * Operator escape-hatch tag, kept as a best-effort AUDIT echo only.
  *
  * SECURITY (audit finding #39): this tag is NO LONGER a trusted override
- * signal. The agent has direct `mcp__agent-grounding__ledger_add` access,
+ * signal. The agent has direct `mcp__grounding-mcp__ledger_add` access,
  * so it could self-write `branch-protection-ack:<anything>` and bless its
  * own protected-branch edit — exactly the self-approval backdoor the
  * understanding gate closed in agent-tasks/88ca4bb3 by moving the

package/dist/policy-packs/builtin/branch-protection.js

@@ -21,7 +21,7 @@
 //          written by `harness approve branch-protection`. The legacy
 //          `branch-protection-ack:` ledger tag is no longer trusted as an
 //          override (audit finding #39): it is agent-writable via
-//          `mcp__agent-grounding__ledger_add`, so it could self-bless an
+//          `mcp__grounding-mcp__ledger_add`, so it could self-bless an
 //          edit. The marker lives under `harness.generated/`, which Edit /
 //          Write / Bash are all gated from writing.
 //
@@ -151,7 +151,7 @@ While this pack is enabled, hooks are wired into the ${settingsArtefact}:
   a deliberate reason to edit a protected branch (version bumps, CI
   workflow patches, hotfixes). SECURITY (audit finding #39): a
   \`${ACK_TAG_PREFIX}:<reason>\` ledger tag is NO LONGER sufficient on its
-  own — it is agent-writable via \`mcp__agent-grounding__ledger_add\`, so
+  own — it is agent-writable via \`mcp__grounding-mcp__ledger_add\`, so
   the gate would otherwise be self-approvable. The approve verb still
   records that ledger tag for audit, but only the marker file (which the
   agent cannot write) opens the gate.

package/dist/policy-packs/builtin/branch-protection.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch-protection.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/branch-protection.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,EAAE;AACF,yDAAyD;AACzD,EAAE;AACF,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,uCAAuC;AACvC,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,wDAAwD;AACxD,+DAA+D;AAC/D,uDAAuD;AACvD,yEAAyE;AACzE,sEAAsE;AACtE,0EAA0E;AAC1E,kEAAkE;AAClE,yEAAyE;AACzE,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,iEAAiE;AACjE,WAAW;AACX,EAAE;AACF,qEAAqE;AACrE,8DAA8D;AAC9D,oEAAoE;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,SAAS,EACT,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,0DAA0D;IAC1D,sDAAsD;IACtD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,MAAM,EAAE,0DAA0D;QAClE,QAAQ,EAAE;YACR,yEAAyE;SAC1E;QACD,GAAG,EAAE,CAAC,kCAAkC,EAAE,oCAAoC,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAE/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAC9D,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACpF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,wKAAwK;SAC3K;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,iBAAiB,YAAY,0KAA0K;SACrN;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,QAA2B,EAAE,OAAgB;IACxF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACpF,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,iCAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC;IAC1D,OAAO,kBAAkB,SAAS;;;;;;;;EAQlC,OAAO;;;;EAIP,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;uDAMS,gBAAgB;;kCAErC,gBAAgB;;oBAE9B,wBAAwB;;;+BAGb,eAAe;OACvC,YAAY;WACR,wBAAwB;uBACZ,OAAO;;;;;;;oCAOM,gBAAgB;;;;;;;;;MAS9C,cAAc;;;;;;;;;;;;;;;;EAgBlB,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;cACR,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;CAClD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;SACpD;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"branch-protection.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/branch-protection.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,EAAE;AACF,yDAAyD;AACzD,EAAE;AACF,0EAA0E;AAC1E,oEAAoE;AACpE,qEAAqE;AACrE,uCAAuC;AACvC,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,wDAAwD;AACxD,+DAA+D;AAC/D,uDAAuD;AACvD,yEAAyE;AACzE,sEAAsE;AACtE,0EAA0E;AAC1E,kEAAkE;AAClE,uEAAuE;AACvE,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,iEAAiE;AACjE,WAAW;AACX,EAAE;AACF,qEAAqE;AACrE,8DAA8D;AAC9D,oEAAoE;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,SAAS,EACT,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,0DAA0D;IAC1D,sDAAsD;IACtD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,MAAM,EAAE,0DAA0D;QAClE,QAAQ,EAAE;YACR,yEAAyE;SAC1E;QACD,GAAG,EAAE,CAAC,kCAAkC,EAAE,oCAAoC,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAE/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAC9D,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACpF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,wKAAwK;SAC3K;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,iBAAiB,YAAY,0KAA0K;SACrN;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,QAA2B,EAAE,OAAgB;IACxF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACpF,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,iCAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,KAAK,CAAC,CAAC;IAC1D,OAAO,kBAAkB,SAAS;;;;;;;;EAQlC,OAAO;;;;EAIP,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;uDAMS,gBAAgB;;kCAErC,gBAAgB;;oBAE9B,wBAAwB;;;+BAGb,eAAe;OACvC,YAAY;WACR,wBAAwB;uBACZ,OAAO;;;;;;;oCAOM,gBAAgB;;;;;;;;;MAS9C,cAAc;;;;;;;;;;;;;;;;EAgBlB,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;cACR,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;CAClD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;SACpD;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}

package/dist/policy-packs/builtin/post-merge-gate-runtime.d.ts

@@ -27,6 +27,21 @@ export declare function buildMergedTagContent(args: {
  * indirection defeats this match before the producer ever runs — not
  * attempted to close here (the MCP merge path, `pull_requests_merge`, is
  * the other documented gap; see the pack's instructions.md).
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation (`&&` kept to
+ * its left only to mirror `src/runtime/command-normalize.ts`'s alternation
+ * order for readability — NOT because order is load-bearing here, unlike
+ * that module). Same fix as `d834a065` applied to every policy trigger —
+ * bash starts a new command after a single `&`, so `A=x&gh pr merge` used
+ * to miss this trigger entirely and the producer silently never recorded
+ * the merged-tip fact for that spelling. Broadening a TRIGGER only widens
+ * when the producer fires (a strictly safer direction, mirrors the
+ * deny-side reasoning below), unlike the escape allowlist further down.
+ * Measured: swapping to `&|&&` produces a byte-identical match set for this
+ * matcher (a `RegExp.test` existential check over every start offset, not a
+ * segmenter — the reasoning that makes order matter in
+ * `command-normalize.ts`'s `BOUNDARY_RE`/`AMP_BOUNDARY_RE` does not transfer
+ * to a plain `.test()` matcher like this one).
  */
 export declare const GH_PR_MERGE_BASH_RE: RegExp;
 /**
@@ -34,29 +49,94 @@ export declare const GH_PR_MERGE_BASH_RE: RegExp;
  * list. Deliberately NOT "every Bash command" — read-only git
  * (status/log/diff/branch) and unrelated shell stay unaffected. Same
  * anchoring convention as `GH_PR_MERGE_BASH_RE`.
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation, same reasoning
+ * as `GH_PR_MERGE_BASH_RE` above — this is a DENY-scope matcher, so
+ * broadening it is the STRICTER direction (more commands recognized as
+ * curated mutations, none dropped). Verified disjoint from the escape
+ * allowlist below on a single-command corpus (no verb overlap), so this
+ * broadening cannot lock out the documented recovery path.
  */
 export declare const CURATED_MUTATION_BASH_RE: RegExp;
 /**
  * Escape allowlist, git verbs (03-decisions.md): the exact recovery path
- * the deny message recommends, plus read-only stash inspection. Checked
- * BEFORE the curated-mutation match and before any manifest/ledger access
- * — see hook-post-merge-gate.ts for the ordering guarantee.
+ * the deny message recommends, plus read-only stash inspection. Since task
+ * 19356be7 this list no longer short-circuits the blocker — the deny
+ * match decides gate-eligibility, and every one of these verbs stays free
+ * simply because it is not a curated mutation (verb disjointness, pinned).
+ * The list remains the deny message's recovery vocabulary and a
+ * diagnostics aid.
+ *
+ * Task 76671e5a, DELIBERATELY LEFT on the old (no bare-`&`) boundary
+ * alphabet: this is an ALLOW-side matcher, so broadening it is the LOOSER
+ * direction. Its remaining consumers (diagnostics, docs interpolation)
+ * still must not silently widen what reads as "recovery". Pinned by a
+ * regression test asserting this regex's source never gains the `&|`
+ * boundary token.
  */
 export declare const ESCAPE_GIT_BASH_RE: RegExp;
 /**
- * Escape allowlist, harness verbs (03-decisions.md): any invocation of
- * harness's own CLI (recovery commands like `harness session-start
- * branch-check`, diagnostics, a future self-check) always passes,
- * regardless of spelling — mirrors the `npx` / absolute-path /
- * `./node_modules/.bin` robustness the `deny-kill-switch-bash` regex in
+ * Escape allowlist, harness verbs (03-decisions.md): names any invocation
+ * of harness's own CLI (recovery commands like `harness session-start
+ * branch-check`, diagnostics, a future self-check), regardless of
+ * spelling — mirrors the `npx` / absolute-path / `./node_modules/.bin`
+ * robustness the `deny-kill-switch-bash` regex in
  * `src/cli/init/templates.ts` already established for the same class of
- * bypass concern.
+ * bypass concern. Since task 19356be7 its only job is the deny message's
+ * / diagnostics' vocabulary: a bare harness command stays free through
+ * verb disjointness with the curated deny list, not through a
+ * short-circuit.
+ *
+ * Task 76671e5a: DELIBERATELY LEFT narrow, same reasoning as
+ * `ESCAPE_GIT_BASH_RE` immediately above — an allow-side matcher, so
+ * broadening its boundary alphabet is the loosening direction.
  */
 export declare const ESCAPE_HARNESS_BASH_RE: RegExp;
-/** True when `command` matches any escape pattern. Checked first, unconditionally. */
+/**
+ * True when `command` matches any escape pattern. Since task 19356be7
+ * this is DIAGNOSTICS ONLY — the blocker's decision is
+ * `isGateEligibleCommand` below; when escape and deny both match, deny
+ * wins. (Under the original escape-first ordering this function was the
+ * blocker's first, unconditional check, which let `harness preflight &&
+ * git push origin master` — the documented normal workflow — skip the
+ * gate entirely.)
+ */
 export declare function isEscapeCommand(command: string): boolean;
 /** True when `command` matches the curated v1 deny-scope. */
 export declare function isCuratedMutationCommand(command: string): boolean;
+/**
+ * The blocker's single classification entry point (task 19356be7): a
+ * command is gate-eligible iff the curated mutation matcher fires.
+ * Everything else — the whole recovery vocabulary, read-only git,
+ * unrelated shell — is allowed by the hook BEFORE any manifest load or
+ * ledger query, preserving the recovery-never-starved property the
+ * escape-first ordering used to provide.
+ *
+ * A thin wrapper over `isCuratedMutationCommand` by DELIBERATE choice,
+ * not by accident. An earlier iteration of this task pre-processed the
+ * command here, stripping the bodies of quoted-delimiter heredocs fed to
+ * a harness invocation, so that an `harness approve understanding <<'…'`
+ * report body mentioning a mutation verb would not become gate-eligible.
+ * Two review rounds found two successive families of UNDER-blocks in that
+ * pre-processing (bodies consumed that bash really executes), both rooted
+ * in the same cause: deciding where a heredoc body BEGINS requires
+ * re-implementing bash's quote and word grammar on the permissive side of
+ * a security boundary. Tasks `dbc6d303` and `5b1b24fb` had already been
+ * halted for that same reason. It was therefore removed rather than
+ * patched a third time; see
+ * `.ai/runs/2026-08-02-post-merge-gate-escape-precedence/03-decisions.md`
+ * D5/D6 for the measurement history, and task `5b1b24fb` for the real
+ * fix, which belongs at the `bash_match` layer for every surface at once.
+ *
+ * Accepted consequence, OVER-block direction: a harness report heredoc
+ * whose body carries a boundary-anchored mutation verb IS gate-eligible.
+ * It only denies while the branch tip equals a recorded merged tip, and
+ * `git switch <default>` — the gate's own recommended recovery — stays
+ * free. Same residual class as the quoted-text false positives this
+ * change already accepts. Do NOT reintroduce a strip here without a
+ * design that does not re-derive bash's grammar.
+ */
+export declare function isGateEligibleCommand(command: string): boolean;
 /**
  * Defensive `tool_output.exit_code` reader for the PostToolUse Bash
  * payload — Contract A. Returns `null` on ANY shape other than a plain

package/dist/policy-packs/builtin/post-merge-gate-runtime.js

@@ -29,10 +29,24 @@
 //     scope" section). Read-only git (status/log/diff/branch) and
 //     unrelated shell are never touched.
 //
-//   - The escape allowlist is checked FIRST in the blocker, unconditionally,
-//     before manifest load or any ledger query — see hook-post-merge-gate.ts.
-//     This module only supplies the matcher; the ordering guarantee lives
-//     in the hook, not here.
+//   - DENY WINS over the escape allowlist (task 19356be7, REVERSES the
+//     original escape-first decision): the blocker classifies a command as
+//     gate-eligible iff the curated mutation matcher fires
+//     (`isGateEligibleCommand` below). The escape allowlist no longer
+//     short-circuits the whole command — under escape-first, any chained
+//     command containing an escape verb anywhere (`harness preflight &&
+//     git push origin master`, the documented normal workflow) skipped the
+//     gate entirely. Measured before changing, over a 66-row corpus with
+//     bash ground truth: per-segment evaluation and deny-wins are
+//     0-divergent — a consequence of the pinned verb disjointness between
+//     the escape and deny lists — so the simplest (deny-wins) is
+//     implemented. The third candidate, escape-at-start-only, was measured
+//     and REJECTED: it diverges on 26 rows and still exempts three of the
+//     four lines this task exists to close (`git switch master && git push
+//     origin master` and friends). The recovery-never-starved property is preserved
+//     structurally: a non-eligible command is allowed before any manifest
+//     load or ledger query, exactly where the escape short-circuit used to
+//     sit (see hook-post-merge-gate.ts for the ordering).
 //
 //   - Fails OPEN (allows) when the ledger is unreachable, unlike
 //     branch-protection's fail-closed posture: without the ledger,
@@ -70,33 +84,80 @@ export function buildMergedTagContent(args) {
  * indirection defeats this match before the producer ever runs — not
  * attempted to close here (the MCP merge path, `pull_requests_merge`, is
  * the other documented gap; see the pack's instructions.md).
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation (`&&` kept to
+ * its left only to mirror `src/runtime/command-normalize.ts`'s alternation
+ * order for readability — NOT because order is load-bearing here, unlike
+ * that module). Same fix as `d834a065` applied to every policy trigger —
+ * bash starts a new command after a single `&`, so `A=x&gh pr merge` used
+ * to miss this trigger entirely and the producer silently never recorded
+ * the merged-tip fact for that spelling. Broadening a TRIGGER only widens
+ * when the producer fires (a strictly safer direction, mirrors the
+ * deny-side reasoning below), unlike the escape allowlist further down.
+ * Measured: swapping to `&|&&` produces a byte-identical match set for this
+ * matcher (a `RegExp.test` existential check over every start offset, not a
+ * segmenter — the reasoning that makes order matter in
+ * `command-normalize.ts`'s `BOUNDARY_RE`/`AMP_BOUNDARY_RE` does not transfer
+ * to a plain `.test()` matcher like this one).
  */
-export const GH_PR_MERGE_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*gh\s+pr\s+merge\b/;
+export const GH_PR_MERGE_BASH_RE = /(?:^|\n|;|\||&&|&|\()\s*(?:\w+=\S+\s+)*gh\s+pr\s+merge\b/;
 /**
  * Blocker deny-scope v1 (03-decisions.md): the curated mutation command
  * list. Deliberately NOT "every Bash command" — read-only git
  * (status/log/diff/branch) and unrelated shell stay unaffected. Same
  * anchoring convention as `GH_PR_MERGE_BASH_RE`.
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation, same reasoning
+ * as `GH_PR_MERGE_BASH_RE` above — this is a DENY-scope matcher, so
+ * broadening it is the STRICTER direction (more commands recognized as
+ * curated mutations, none dropped). Verified disjoint from the escape
+ * allowlist below on a single-command corpus (no verb overlap), so this
+ * broadening cannot lock out the documented recovery path.
  */
-export const CURATED_MUTATION_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*(?:git(?:\s+-C\s+\S+)?\s+(?:commit|add|push|merge|rebase|cherry-pick|revert|reset|stash\s+(?:pop|apply))\b|gh\s+pr\s+(?:create|merge)\b)/;
+export const CURATED_MUTATION_BASH_RE = /(?:^|\n|;|\||&&|&|\()\s*(?:\w+=\S+\s+)*(?:git(?:\s+-C\s+\S+)?\s+(?:commit|add|push|merge|rebase|cherry-pick|revert|reset|stash\s+(?:pop|apply))\b|gh\s+pr\s+(?:create|merge)\b)/;
 /**
  * Escape allowlist, git verbs (03-decisions.md): the exact recovery path
- * the deny message recommends, plus read-only stash inspection. Checked
- * BEFORE the curated-mutation match and before any manifest/ledger access
- * — see hook-post-merge-gate.ts for the ordering guarantee.
+ * the deny message recommends, plus read-only stash inspection. Since task
+ * 19356be7 this list no longer short-circuits the blocker — the deny
+ * match decides gate-eligibility, and every one of these verbs stays free
+ * simply because it is not a curated mutation (verb disjointness, pinned).
+ * The list remains the deny message's recovery vocabulary and a
+ * diagnostics aid.
+ *
+ * Task 76671e5a, DELIBERATELY LEFT on the old (no bare-`&`) boundary
+ * alphabet: this is an ALLOW-side matcher, so broadening it is the LOOSER
+ * direction. Its remaining consumers (diagnostics, docs interpolation)
+ * still must not silently widen what reads as "recovery". Pinned by a
+ * regression test asserting this regex's source never gains the `&|`
+ * boundary token.
  */
 export const ESCAPE_GIT_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*git(?:\s+-C\s+\S+)?\s+(?:switch\b|checkout\b|pull\b|fetch\b|branch\s+-(?:d|D)\b|stash\s+(?:list|show)\b)/;
 /**
- * Escape allowlist, harness verbs (03-decisions.md): any invocation of
- * harness's own CLI (recovery commands like `harness session-start
- * branch-check`, diagnostics, a future self-check) always passes,
- * regardless of spelling — mirrors the `npx` / absolute-path /
- * `./node_modules/.bin` robustness the `deny-kill-switch-bash` regex in
+ * Escape allowlist, harness verbs (03-decisions.md): names any invocation
+ * of harness's own CLI (recovery commands like `harness session-start
+ * branch-check`, diagnostics, a future self-check), regardless of
+ * spelling — mirrors the `npx` / absolute-path / `./node_modules/.bin`
+ * robustness the `deny-kill-switch-bash` regex in
  * `src/cli/init/templates.ts` already established for the same class of
- * bypass concern.
+ * bypass concern. Since task 19356be7 its only job is the deny message's
+ * / diagnostics' vocabulary: a bare harness command stays free through
+ * verb disjointness with the curated deny list, not through a
+ * short-circuit.
+ *
+ * Task 76671e5a: DELIBERATELY LEFT narrow, same reasoning as
+ * `ESCAPE_GIT_BASH_RE` immediately above — an allow-side matcher, so
+ * broadening its boundary alphabet is the loosening direction.
  */
 export const ESCAPE_HARNESS_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*(?:npx\s+|\S*\/)?harness\b/;
-/** True when `command` matches any escape pattern. Checked first, unconditionally. */
+/**
+ * True when `command` matches any escape pattern. Since task 19356be7
+ * this is DIAGNOSTICS ONLY — the blocker's decision is
+ * `isGateEligibleCommand` below; when escape and deny both match, deny
+ * wins. (Under the original escape-first ordering this function was the
+ * blocker's first, unconditional check, which let `harness preflight &&
+ * git push origin master` — the documented normal workflow — skip the
+ * gate entirely.)
+ */
 export function isEscapeCommand(command) {
     return ESCAPE_GIT_BASH_RE.test(command) || ESCAPE_HARNESS_BASH_RE.test(command);
 }
@@ -104,6 +165,41 @@ export function isEscapeCommand(command) {
 export function isCuratedMutationCommand(command) {
     return CURATED_MUTATION_BASH_RE.test(command);
 }
+/**
+ * The blocker's single classification entry point (task 19356be7): a
+ * command is gate-eligible iff the curated mutation matcher fires.
+ * Everything else — the whole recovery vocabulary, read-only git,
+ * unrelated shell — is allowed by the hook BEFORE any manifest load or
+ * ledger query, preserving the recovery-never-starved property the
+ * escape-first ordering used to provide.
+ *
+ * A thin wrapper over `isCuratedMutationCommand` by DELIBERATE choice,
+ * not by accident. An earlier iteration of this task pre-processed the
+ * command here, stripping the bodies of quoted-delimiter heredocs fed to
+ * a harness invocation, so that an `harness approve understanding <<'…'`
+ * report body mentioning a mutation verb would not become gate-eligible.
+ * Two review rounds found two successive families of UNDER-blocks in that
+ * pre-processing (bodies consumed that bash really executes), both rooted
+ * in the same cause: deciding where a heredoc body BEGINS requires
+ * re-implementing bash's quote and word grammar on the permissive side of
+ * a security boundary. Tasks `dbc6d303` and `5b1b24fb` had already been
+ * halted for that same reason. It was therefore removed rather than
+ * patched a third time; see
+ * `.ai/runs/2026-08-02-post-merge-gate-escape-precedence/03-decisions.md`
+ * D5/D6 for the measurement history, and task `5b1b24fb` for the real
+ * fix, which belongs at the `bash_match` layer for every surface at once.
+ *
+ * Accepted consequence, OVER-block direction: a harness report heredoc
+ * whose body carries a boundary-anchored mutation verb IS gate-eligible.
+ * It only denies while the branch tip equals a recorded merged tip, and
+ * `git switch <default>` — the gate's own recommended recovery — stays
+ * free. Same residual class as the quoted-text false positives this
+ * change already accepts. Do NOT reintroduce a strip here without a
+ * design that does not re-derive bash's grammar.
+ */
+export function isGateEligibleCommand(command) {
+    return isCuratedMutationCommand(command);
+}
 /**
  * Defensive `tool_output.exit_code` reader for the PostToolUse Bash
  * payload — Contract A. Returns `null` on ANY shape other than a plain

package/dist/policy-packs/builtin/post-merge-gate-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-merge-gate-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate-runtime.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,iDAAiD;AACjD,EAAE;AACF,6CAA6C;AAC7C,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,kEAAkE;AAClE,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,0DAA0D;AAC1D,sEAAsE;AACtE,kEAAkE;AAClE,yCAAyC;AACzC,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,6BAA6B;AAC7B,EAAE;AACF,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,kDAAkD;AAClD,oDAAoD;AAEpD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErG,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IACzE,OAAO,GAAG,iBAAiB,IAAI,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wDAAwD,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,+KAA+K,CAAC;AAElL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,+IAA+I,CAAC;AAElJ;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AAExG,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,eAAe,CAAC,UAAmB;IACjD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,EAAE,GAAI,UAAsC,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,iEAAiE;AACjE,mEAAmE;AACnE,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,sFAAsF,CAAC;AAIzF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAqB;IAC3D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzF,MAAM,EAAE,GAAG,YAAuC,CAAC;IACnD,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAYD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAmB,EACnB,YAAqB,EACrB,OAAe;IAEf,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,WAAW;YACrB,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,4BAA4B,QAAQ,gEAAgE;SAC7G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,iBAAiB;YAC3B,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,EAAE;YAC5C,MAAM,EAAE,0EAA0E;SACnF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,IAAI;QACR,MAAM,EACJ,sHAAsH;KACzH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"post-merge-gate-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate-runtime.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,iDAAiD;AACjD,EAAE;AACF,6CAA6C;AAC7C,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,kEAAkE;AAClE,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,0DAA0D;AAC1D,sEAAsE;AACtE,kEAAkE;AAClE,yCAAyC;AACzC,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAClE,0EAA0E;AAC1E,iEAAiE;AACjE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,oFAAoF;AACpF,0EAA0E;AAC1E,2EAA2E;AAC3E,0DAA0D;AAC1D,EAAE;AACF,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,kDAAkD;AAClD,oDAAoD;AAEpD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErG,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IACzE,OAAO,GAAG,iBAAiB,IAAI,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,0DAA0D,CAAC;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,iLAAiL,CAAC;AAEpL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,+IAA+I,CAAC;AAElJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AAExG;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,eAAe,CAAC,UAAmB;IACjD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,EAAE,GAAI,UAAsC,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,iEAAiE;AACjE,mEAAmE;AACnE,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,sFAAsF,CAAC;AAIzF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAqB;IAC3D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzF,MAAM,EAAE,GAAG,YAAuC,CAAC;IACnD,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAYD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAmB,EACnB,YAAqB,EACrB,OAAe;IAEf,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,WAAW;YACrB,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,4BAA4B,QAAQ,gEAAgE;SAC7G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,iBAAiB;YAC3B,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,EAAE;YAC5C,MAAM,EAAE,0EAA0E;SACnF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,IAAI;QACR,MAAM,EACJ,sHAAsH;KACzH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/policy-packs/builtin/post-merge-gate.js

@@ -38,11 +38,14 @@
 //      when the CURRENT branch tip still equals a recorded merged tip
 //      for this repo+branch — an exact sha match, not ancestry, so a new
 //      commit (moving the tip) or a recycled branch name (a different
-//      tip) both fall silently outside the gate. An ESCAPE ALLOWLIST
-//      (git switch/checkout/pull/fetch, git branch -d/-D, git stash
-//      list/show, any `harness ...` command) is checked FIRST, before
-//      any manifest load or ledger query, so the recovery path can never
-//      be starved by an unrelated failure.
+//      tip) both fall silently outside the gate. GATE-ELIGIBILITY is
+//      classified FIRST, before any manifest load or ledger query, so
+//      the recovery vocabulary (git switch/checkout/pull/fetch, git
+//      branch -d/-D, git stash list/show, any `harness ...` command) can
+//      never be starved by an unrelated failure — none of those verbs is
+//      a curated mutation. Task 19356be7: DENY WINS when one command
+//      chains recovery vocabulary with a curated mutation; the escape
+//      list no longer short-circuits the whole command string.
 //
 // Fails OPEN when the ledger is unreachable (unlike branch-protection's
 // fail-closed posture): without the ledger, "merged" and "not merged"
@@ -127,7 +130,7 @@ function buildHooks() {
             command: BLOCKER_COMMAND,
             blocking: "hard",
             budget_ms: 5000,
-            description: "Blocker: deny curated history-mutating Bash commands (git commit/add/push/merge/rebase/cherry-pick/revert/reset/stash pop|apply, gh pr create/merge) when the current branch tip matches a recorded merged tip. An escape allowlist (git switch/checkout/pull/fetch, git branch -d/-D, git stash list/show, any `harness ...` command) is checked first, unconditionally. Fails open when the ledger is unreachable.",
+            description: "Blocker: deny curated history-mutating Bash commands (git commit/add/push/merge/rebase/cherry-pick/revert/reset/stash pop|apply, gh pr create/merge) when the current branch tip matches a recorded merged tip. The recovery vocabulary (git switch/checkout/pull/fetch, git branch -d/-D, git stash list/show, any `harness ...` command) always passes as its own command, classified before any manifest or ledger access; chaining one of those with a curated mutation does NOT exempt the mutation. Fails open when the ledger is unreachable.",
         },
     ];
 }
@@ -185,12 +188,17 @@ ${runtime}${runtime === "codex" ? " (UNSUPPORTED — see \"Known gaps\" below; b
 
 2. \`PreToolUse\` blocker (\`${BLOCKER_COMMAND}\`, blocking: hard) on
    \`Bash\`: checked in this order —
-   a. **Escape allowlist first, unconditionally** (before any manifest
-      load or ledger query): \`${ESCAPE_GIT_BASH_RE.source}\` OR
-      \`${ESCAPE_HARNESS_BASH_RE.source}\` — always allowed.
-   b. **Curated mutation match**: \`${CURATED_MUTATION_BASH_RE.source}\`
-      — commands that don't match this pass through untouched.
-   c. **Ledger check**: denies only when the current branch tip exactly
+   a. **Gate-eligibility classification first, unconditionally** (before
+      any manifest load or ledger query): the curated mutation matcher
+      \`${CURATED_MUTATION_BASH_RE.source}\`. Commands it
+      does not match pass through untouched — that unconditionally covers the whole recovery
+      vocabulary (\`${ESCAPE_GIT_BASH_RE.source}\` and
+      \`${ESCAPE_HARNESS_BASH_RE.source}\`), since none of those verbs are
+      curated mutations. **Deny wins over the recovery vocabulary** when
+      one command chains both (task 19356be7): \`harness preflight &&
+      git push\` is judged by its push half, not exempted by its
+      preflight half.
+   b. **Ledger check**: denies only when the current branch tip exactly
       equals a recorded \`${MERGED_TAG_PREFIX}:<repo>:<branch>:<sha>\` fact
       for this repo+branch. A new commit moves the tip (gate falls
       silent — that's legitimate continued work); a recycled branch name
@@ -204,9 +212,12 @@ ${runtime}${runtime === "codex" ? " (UNSUPPORTED — see \"Known gaps\" below; b
   \`git branch -d <branch>\` to clean up the merged local branch.
 - **Read-only / inspection commands** (\`git switch\`/\`checkout\`,
   \`pull\`/\`fetch\`, \`branch -d\`/\`-D\`, \`stash list\`/\`show\`, and any
-  \`harness ...\` invocation) always pass, independent of ledger
-  reachability — the gate can never itself become the reason the
-  recovery path is unavailable.
+  \`harness ...\` invocation) always pass **as their own commands**,
+  independent of ledger reachability — the gate can never itself become
+  the reason the recovery path is unavailable. Chaining one of them with
+  a curated mutation does NOT exempt the mutation (the pre-19356be7
+  escape-first ordering did, which let the documented
+  preflight-then-push workflow skip the gate entirely).
 
 ## Known gaps (documented, not attempted in v1)
 
@@ -225,16 +236,22 @@ ${runtime}${runtime === "codex" ? " (UNSUPPORTED — see \"Known gaps\" below; b
   commands on a just-merged branch (e.g. hand-editing files outside
   git's own history primitives) are out of v1 scope, mirroring
   branch-protection's documented scope-cut.
-- **Chained-escape bypass**: escape-first is checked against the WHOLE
-  command string, not per-clause, so a curated mutation chained with an
-  escape verb (e.g. \`git commit -am x && git switch main\`) is fully
-  ALLOWED — the escape match wins for the entire compound command. Same
-  accepted class as the regex-vs-shell-eval residual above (\`eval\`,
-  heredoc, \`sh -c\`); not attempted to close here, and deliberate: the
-  alternative (per-clause splitting) would need a real shell parser.
+- **Chained-escape bypass — CLOSED (task 19356be7)**: the original
+  escape-first ordering matched the escape list against the WHOLE
+  command string, so a curated mutation chained with an escape verb
+  (\`harness preflight && git push\`, \`git commit -am x && git switch
+  main\`) skipped the gate entirely. The blocker now classifies by the
+  curated mutation match alone (deny wins; measured 0-divergent from
+  per-clause evaluation thanks to the escape/deny verb disjointness —
+  escape-at-start-only was measured and rejected, it still exempts three
+  of the four lines this closed).
+  Residual, measured and accepted: a deny verb as quoted TEXT in a
+  chain (\`git pull && echo 'a && git push'\`) is gate-eligible even
+  though bash never runs it — the existing accepted false-positive
+  class, no longer rescued by a chained escape verb.
 - **Inverted trust-boundary residual**: a merged fact written by any
   means OTHER than the producer (e.g. directly via
-  \`mcp__agent-grounding__ledger_add\`) that happens to exactly match the
+  \`mcp__grounding-mcp__ledger_add\`) that happens to exactly match the
   CURRENT \`repo:branch:sha\` triple denies curated mutations on that
   branch — recoverable via any escape command or by making a new commit
   (which moves the tip and the fact no longer matches). A fact for a

package/dist/policy-packs/builtin/post-merge-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-merge-gate.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,gEAAgE;AAChE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,uEAAuE;AACvE,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,0DAA0D;AAC1D,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,2EAA2E;AAC3E,oEAAoE;AACpE,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,2EAA2E;AAC3E,uEAAuE;AACvE,2DAA2D;AAC3D,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAChB,EAAE;AACF,yEAAyE;AACzE,sDAAsD;AACtD,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,sEAAsE;AACtE,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,+DAA+D;AAC/D,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,gEAAgE;AAChE,iDAAiD;AACjD,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,4BAA4B;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,MAAM,EACJ,2FAA2F;QAC7F,QAAQ,EAAE;YACR,0HAA0H;SAC3H;QACD,GAAG,EAAE;YACH,8BAA8B;YAC9B,oBAAoB;YACpB,6CAA6C;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AACpE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,SAAS,UAAU;IACjB,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,0MAA0M;SAC7M;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EACT,sZAAsZ;SACzZ;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,OAAgB;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,kBAAkB,SAAS;;;;;;;;;EASlC,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,gGAAgG,CAAC,CAAC,CAAC,EAAE;;;;iCAItG,gBAAgB;yBACxB,mBAAmB,CAAC,MAAM;;;;;;;oDAOC,mBAAmB,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;OAsBvE,iBAAiB;;;;;;;+BAOO,eAAe;;;iCAGb,kBAAkB,CAAC,MAAM;UAChD,sBAAsB,CAAC,MAAM;sCACD,wBAAwB,CAAC,MAAM;;;4BAGzC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;MAsBvC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DA4BsC,mBAAmB,CAAC,MAAM;;;;;;;;;;;yCAW9C,iBAAiB;;;;;;;;;;;;;;;;EAgBxD,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;CACrB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC;SAC1C;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,gBAAgB,IAAI,CAAC,IAAI,8JAA8J,CACxL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"post-merge-gate.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,gEAAgE;AAChE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,uEAAuE;AACvE,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,0DAA0D;AAC1D,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,2EAA2E;AAC3E,oEAAoE;AACpE,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,2EAA2E;AAC3E,uEAAuE;AACvE,2DAA2D;AAC3D,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAChB,EAAE;AACF,yEAAyE;AACzE,sDAAsD;AACtD,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,+DAA+D;AAC/D,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,gEAAgE;AAChE,iDAAiD;AACjD,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,4BAA4B;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,MAAM,EACJ,2FAA2F;QAC7F,QAAQ,EAAE;YACR,0HAA0H;SAC3H;QACD,GAAG,EAAE;YACH,8BAA8B;YAC9B,oBAAoB;YACpB,6CAA6C;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AACpE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,SAAS,UAAU;IACjB,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,0MAA0M;SAC7M;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EACT,shBAAshB;SACzhB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,OAAgB;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,kBAAkB,SAAS;;;;;;;;;EASlC,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,gGAAgG,CAAC,CAAC,CAAC,EAAE;;;;iCAItG,gBAAgB;yBACxB,mBAAmB,CAAC,MAAM;;;;;;;oDAOC,mBAAmB,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;OAsBvE,iBAAiB;;;;;;;+BAOO,eAAe;;;;UAIpC,wBAAwB,CAAC,MAAM;;sBAEnB,kBAAkB,CAAC,MAAM;UACrC,sBAAsB,CAAC,MAAM;;;;;;4BAMX,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;MAyBvC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DAkCsC,mBAAmB,CAAC,MAAM;;;;;;;;;;;yCAW9C,iBAAiB;;;;;;;;;;;;;;;;EAgBxD,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;CACrB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC;SAC1C;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,gBAAgB,IAAI,CAAC,IAAI,8JAA8J,CACxL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}

package/dist/policy-packs/builtin/solution-acceptance-runtime.d.ts

@@ -14,6 +14,19 @@ export declare const DEFAULT_PROTECTED_COMPLETION_TOOLS: readonly ["task_finish"
  * load-bearing choke points; hardening this is follow-up `7207d8f9`.
  * Tolerates a leading `cd … &&`, inline `VAR=val` assignments, and `git -C
  * <path> push`.
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation (`&&` kept to
+ * its left only to mirror `src/runtime/command-normalize.ts`'s alternation
+ * order for readability — NOT because order is load-bearing here, unlike
+ * that module). Same fix as `d834a065` applied to every policy trigger —
+ * bash starts a new command after a single `&`, so `A=x&git push` used to
+ * slip past this DENY matcher entirely. Broadening is the stricter direction
+ * here (this gates completion actions, it is not an allow-list). Measured:
+ * swapping to `&|&&` produces a byte-identical match set for this matcher
+ * (a `RegExp.test` existential check over every start offset, not a
+ * segmenter — the reasoning that makes order matter in
+ * `command-normalize.ts`'s `BOUNDARY_RE`/`AMP_BOUNDARY_RE` does not transfer
+ * to a plain `.test()` matcher like this one).
  */
 export declare const DEFAULT_PUSH_BASH_RE: RegExp;
 /**