@lannguyensi/harness 0.43.0 → 0.45.0

package/dist/policy-packs/builtin/post-merge-gate-runtime.js

@@ -29,10 +29,24 @@
 //     scope" section). Read-only git (status/log/diff/branch) and
 //     unrelated shell are never touched.
 //
-//   - The escape allowlist is checked FIRST in the blocker, unconditionally,
-//     before manifest load or any ledger query — see hook-post-merge-gate.ts.
-//     This module only supplies the matcher; the ordering guarantee lives
-//     in the hook, not here.
+//   - DENY WINS over the escape allowlist (task 19356be7, REVERSES the
+//     original escape-first decision): the blocker classifies a command as
+//     gate-eligible iff the curated mutation matcher fires
+//     (`isGateEligibleCommand` below). The escape allowlist no longer
+//     short-circuits the whole command — under escape-first, any chained
+//     command containing an escape verb anywhere (`harness preflight &&
+//     git push origin master`, the documented normal workflow) skipped the
+//     gate entirely. Measured before changing, over a 66-row corpus with
+//     bash ground truth: per-segment evaluation and deny-wins are
+//     0-divergent — a consequence of the pinned verb disjointness between
+//     the escape and deny lists — so the simplest (deny-wins) is
+//     implemented. The third candidate, escape-at-start-only, was measured
+//     and REJECTED: it diverges on 26 rows and still exempts three of the
+//     four lines this task exists to close (`git switch master && git push
+//     origin master` and friends). The recovery-never-starved property is preserved
+//     structurally: a non-eligible command is allowed before any manifest
+//     load or ledger query, exactly where the escape short-circuit used to
+//     sit (see hook-post-merge-gate.ts for the ordering).
 //
 //   - Fails OPEN (allows) when the ledger is unreachable, unlike
 //     branch-protection's fail-closed posture: without the ledger,
@@ -70,33 +84,80 @@ export function buildMergedTagContent(args) {
  * indirection defeats this match before the producer ever runs — not
  * attempted to close here (the MCP merge path, `pull_requests_merge`, is
  * the other documented gap; see the pack's instructions.md).
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation (`&&` kept to
+ * its left only to mirror `src/runtime/command-normalize.ts`'s alternation
+ * order for readability — NOT because order is load-bearing here, unlike
+ * that module). Same fix as `d834a065` applied to every policy trigger —
+ * bash starts a new command after a single `&`, so `A=x&gh pr merge` used
+ * to miss this trigger entirely and the producer silently never recorded
+ * the merged-tip fact for that spelling. Broadening a TRIGGER only widens
+ * when the producer fires (a strictly safer direction, mirrors the
+ * deny-side reasoning below), unlike the escape allowlist further down.
+ * Measured: swapping to `&|&&` produces a byte-identical match set for this
+ * matcher (a `RegExp.test` existential check over every start offset, not a
+ * segmenter — the reasoning that makes order matter in
+ * `command-normalize.ts`'s `BOUNDARY_RE`/`AMP_BOUNDARY_RE` does not transfer
+ * to a plain `.test()` matcher like this one).
  */
-export const GH_PR_MERGE_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*gh\s+pr\s+merge\b/;
+export const GH_PR_MERGE_BASH_RE = /(?:^|\n|;|\||&&|&|\()\s*(?:\w+=\S+\s+)*gh\s+pr\s+merge\b/;
 /**
  * Blocker deny-scope v1 (03-decisions.md): the curated mutation command
  * list. Deliberately NOT "every Bash command" — read-only git
  * (status/log/diff/branch) and unrelated shell stay unaffected. Same
  * anchoring convention as `GH_PR_MERGE_BASH_RE`.
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation, same reasoning
+ * as `GH_PR_MERGE_BASH_RE` above — this is a DENY-scope matcher, so
+ * broadening it is the STRICTER direction (more commands recognized as
+ * curated mutations, none dropped). Verified disjoint from the escape
+ * allowlist below on a single-command corpus (no verb overlap), so this
+ * broadening cannot lock out the documented recovery path.
  */
-export const CURATED_MUTATION_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*(?:git(?:\s+-C\s+\S+)?\s+(?:commit|add|push|merge|rebase|cherry-pick|revert|reset|stash\s+(?:pop|apply))\b|gh\s+pr\s+(?:create|merge)\b)/;
+export const CURATED_MUTATION_BASH_RE = /(?:^|\n|;|\||&&|&|\()\s*(?:\w+=\S+\s+)*(?:git(?:\s+-C\s+\S+)?\s+(?:commit|add|push|merge|rebase|cherry-pick|revert|reset|stash\s+(?:pop|apply))\b|gh\s+pr\s+(?:create|merge)\b)/;
 /**
  * Escape allowlist, git verbs (03-decisions.md): the exact recovery path
- * the deny message recommends, plus read-only stash inspection. Checked
- * BEFORE the curated-mutation match and before any manifest/ledger access
- * — see hook-post-merge-gate.ts for the ordering guarantee.
+ * the deny message recommends, plus read-only stash inspection. Since task
+ * 19356be7 this list no longer short-circuits the blocker — the deny
+ * match decides gate-eligibility, and every one of these verbs stays free
+ * simply because it is not a curated mutation (verb disjointness, pinned).
+ * The list remains the deny message's recovery vocabulary and a
+ * diagnostics aid.
+ *
+ * Task 76671e5a, DELIBERATELY LEFT on the old (no bare-`&`) boundary
+ * alphabet: this is an ALLOW-side matcher, so broadening it is the LOOSER
+ * direction. Its remaining consumers (diagnostics, docs interpolation)
+ * still must not silently widen what reads as "recovery". Pinned by a
+ * regression test asserting this regex's source never gains the `&|`
+ * boundary token.
  */
 export const ESCAPE_GIT_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*git(?:\s+-C\s+\S+)?\s+(?:switch\b|checkout\b|pull\b|fetch\b|branch\s+-(?:d|D)\b|stash\s+(?:list|show)\b)/;
 /**
- * Escape allowlist, harness verbs (03-decisions.md): any invocation of
- * harness's own CLI (recovery commands like `harness session-start
- * branch-check`, diagnostics, a future self-check) always passes,
- * regardless of spelling — mirrors the `npx` / absolute-path /
- * `./node_modules/.bin` robustness the `deny-kill-switch-bash` regex in
+ * Escape allowlist, harness verbs (03-decisions.md): names any invocation
+ * of harness's own CLI (recovery commands like `harness session-start
+ * branch-check`, diagnostics, a future self-check), regardless of
+ * spelling — mirrors the `npx` / absolute-path / `./node_modules/.bin`
+ * robustness the `deny-kill-switch-bash` regex in
  * `src/cli/init/templates.ts` already established for the same class of
- * bypass concern.
+ * bypass concern. Since task 19356be7 its only job is the deny message's
+ * / diagnostics' vocabulary: a bare harness command stays free through
+ * verb disjointness with the curated deny list, not through a
+ * short-circuit.
+ *
+ * Task 76671e5a: DELIBERATELY LEFT narrow, same reasoning as
+ * `ESCAPE_GIT_BASH_RE` immediately above — an allow-side matcher, so
+ * broadening its boundary alphabet is the loosening direction.
  */
 export const ESCAPE_HARNESS_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*(?:npx\s+|\S*\/)?harness\b/;
-/** True when `command` matches any escape pattern. Checked first, unconditionally. */
+/**
+ * True when `command` matches any escape pattern. Since task 19356be7
+ * this is DIAGNOSTICS ONLY — the blocker's decision is
+ * `isGateEligibleCommand` below; when escape and deny both match, deny
+ * wins. (Under the original escape-first ordering this function was the
+ * blocker's first, unconditional check, which let `harness preflight &&
+ * git push origin master` — the documented normal workflow — skip the
+ * gate entirely.)
+ */
 export function isEscapeCommand(command) {
     return ESCAPE_GIT_BASH_RE.test(command) || ESCAPE_HARNESS_BASH_RE.test(command);
 }
@@ -104,6 +165,41 @@ export function isEscapeCommand(command) {
 export function isCuratedMutationCommand(command) {
     return CURATED_MUTATION_BASH_RE.test(command);
 }
+/**
+ * The blocker's single classification entry point (task 19356be7): a
+ * command is gate-eligible iff the curated mutation matcher fires.
+ * Everything else — the whole recovery vocabulary, read-only git,
+ * unrelated shell — is allowed by the hook BEFORE any manifest load or
+ * ledger query, preserving the recovery-never-starved property the
+ * escape-first ordering used to provide.
+ *
+ * A thin wrapper over `isCuratedMutationCommand` by DELIBERATE choice,
+ * not by accident. An earlier iteration of this task pre-processed the
+ * command here, stripping the bodies of quoted-delimiter heredocs fed to
+ * a harness invocation, so that an `harness approve understanding <<'…'`
+ * report body mentioning a mutation verb would not become gate-eligible.
+ * Two review rounds found two successive families of UNDER-blocks in that
+ * pre-processing (bodies consumed that bash really executes), both rooted
+ * in the same cause: deciding where a heredoc body BEGINS requires
+ * re-implementing bash's quote and word grammar on the permissive side of
+ * a security boundary. Tasks `dbc6d303` and `5b1b24fb` had already been
+ * halted for that same reason. It was therefore removed rather than
+ * patched a third time; see
+ * `.ai/runs/2026-08-02-post-merge-gate-escape-precedence/03-decisions.md`
+ * D5/D6 for the measurement history, and task `5b1b24fb` for the real
+ * fix, which belongs at the `bash_match` layer for every surface at once.
+ *
+ * Accepted consequence, OVER-block direction: a harness report heredoc
+ * whose body carries a boundary-anchored mutation verb IS gate-eligible.
+ * It only denies while the branch tip equals a recorded merged tip, and
+ * `git switch <default>` — the gate's own recommended recovery — stays
+ * free. Same residual class as the quoted-text false positives this
+ * change already accepts. Do NOT reintroduce a strip here without a
+ * design that does not re-derive bash's grammar.
+ */
+export function isGateEligibleCommand(command) {
+    return isCuratedMutationCommand(command);
+}
 /**
  * Defensive `tool_output.exit_code` reader for the PostToolUse Bash
  * payload — Contract A. Returns `null` on ANY shape other than a plain

package/dist/policy-packs/builtin/post-merge-gate-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-merge-gate-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate-runtime.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,iDAAiD;AACjD,EAAE;AACF,6CAA6C;AAC7C,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,kEAAkE;AAClE,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,0DAA0D;AAC1D,sEAAsE;AACtE,kEAAkE;AAClE,yCAAyC;AACzC,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,6BAA6B;AAC7B,EAAE;AACF,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,kDAAkD;AAClD,oDAAoD;AAEpD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErG,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IACzE,OAAO,GAAG,iBAAiB,IAAI,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wDAAwD,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,+KAA+K,CAAC;AAElL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,+IAA+I,CAAC;AAElJ;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AAExG,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,eAAe,CAAC,UAAmB;IACjD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,EAAE,GAAI,UAAsC,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,iEAAiE;AACjE,mEAAmE;AACnE,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,sFAAsF,CAAC;AAIzF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAqB;IAC3D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzF,MAAM,EAAE,GAAG,YAAuC,CAAC;IACnD,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAYD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAmB,EACnB,YAAqB,EACrB,OAAe;IAEf,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,WAAW;YACrB,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,4BAA4B,QAAQ,gEAAgE;SAC7G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,iBAAiB;YAC3B,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,EAAE;YAC5C,MAAM,EAAE,0EAA0E;SACnF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,IAAI;QACR,MAAM,EACJ,sHAAsH;KACzH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"post-merge-gate-runtime.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate-runtime.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,iDAAiD;AACjD,EAAE;AACF,6CAA6C;AAC7C,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,kEAAkE;AAClE,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,0DAA0D;AAC1D,sEAAsE;AACtE,kEAAkE;AAClE,yCAAyC;AACzC,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,2DAA2D;AAC3D,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAClE,0EAA0E;AAC1E,iEAAiE;AACjE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,oFAAoF;AACpF,0EAA0E;AAC1E,2EAA2E;AAC3E,0DAA0D;AAC1D,EAAE;AACF,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,kDAAkD;AAClD,oDAAoD;AAEpD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErG,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IACzE,OAAO,GAAG,iBAAiB,IAAI,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,0DAA0D,CAAC;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,iLAAiL,CAAC;AAEpL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,+IAA+I,CAAC;AAElJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AAExG;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,eAAe,CAAC,UAAmB;IACjD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,EAAE,GAAI,UAAsC,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,iEAAiE;AACjE,mEAAmE;AACnE,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,sFAAsF,CAAC;AAIzF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAqB;IAC3D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzF,MAAM,EAAE,GAAG,YAAuC,CAAC;IACnD,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAYD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAmB,EACnB,YAAqB,EACrB,OAAe;IAEf,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,WAAW;YACrB,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,4BAA4B,QAAQ,gEAAgE;SAC7G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,iBAAiB;YAC3B,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,EAAE;YAC5C,MAAM,EAAE,0EAA0E;SACnF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,IAAI;QACR,MAAM,EACJ,sHAAsH;KACzH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/policy-packs/builtin/post-merge-gate.js

@@ -38,11 +38,14 @@
 //      when the CURRENT branch tip still equals a recorded merged tip
 //      for this repo+branch — an exact sha match, not ancestry, so a new
 //      commit (moving the tip) or a recycled branch name (a different
-//      tip) both fall silently outside the gate. An ESCAPE ALLOWLIST
-//      (git switch/checkout/pull/fetch, git branch -d/-D, git stash
-//      list/show, any `harness ...` command) is checked FIRST, before
-//      any manifest load or ledger query, so the recovery path can never
-//      be starved by an unrelated failure.
+//      tip) both fall silently outside the gate. GATE-ELIGIBILITY is
+//      classified FIRST, before any manifest load or ledger query, so
+//      the recovery vocabulary (git switch/checkout/pull/fetch, git
+//      branch -d/-D, git stash list/show, any `harness ...` command) can
+//      never be starved by an unrelated failure — none of those verbs is
+//      a curated mutation. Task 19356be7: DENY WINS when one command
+//      chains recovery vocabulary with a curated mutation; the escape
+//      list no longer short-circuits the whole command string.
 //
 // Fails OPEN when the ledger is unreachable (unlike branch-protection's
 // fail-closed posture): without the ledger, "merged" and "not merged"
@@ -60,11 +63,14 @@
 // higher-risk gate; see templates.ts for the rationale), unlike
 // branch-protection's default-enabled precedent.
 //
-// Claude Code only in v1 (no Codex adapter): both hooks match on the
-// `Bash` tool name and classify by command text, a mechanism that has
-// no established Codex-adapter parity yet (mirrors `solution-acceptance`,
-// which ships with no Codex variant either). `resolve()` warns if wired
-// under `runtime: "codex"`.
+// Claude Code only in v1 (no Codex or opencode adapter): both hooks
+// match on the `Bash` tool name and classify by command text, a
+// mechanism that has no established Codex-adapter parity yet (mirrors
+// `solution-acceptance`, which ships with no Codex variant either) and
+// no meaning at all under opencode (no declarative hook/event field to
+// match against). `resolve()` warns whenever `runtime !== "claude-code"`
+// (batch18 fix-round, task f34eb233 — widened from a codex-only check
+// so opencode gets the same warning).
 import { z } from "zod";
 import { PolicyUxSchema } from "../../schema/policies.js";
 import { DEFAULT_RUNTIME } from "../runtime.js";
@@ -126,8 +132,19 @@ function buildHooks() {
             match: "Bash",
             command: BLOCKER_COMMAND,
             blocking: "hard",
-            budget_ms: 5000,
-            description: "Blocker: deny curated history-mutating Bash commands (git commit/add/push/merge/rebase/cherry-pick/revert/reset/stash pop|apply, gh pr create/merge) when the current branch tip matches a recorded merged tip. An escape allowlist (git switch/checkout/pull/fetch, git branch -d/-D, git stash list/show, any `harness ...` command) is checked first, unconditionally. Fails open when the ledger is unreachable.",
+            // 15000 (task 7bf47554): the blocker's own ledger query
+            // (queryLedgerByTag, src/cli/pack/hook-post-merge-gate.ts) is bounded
+            // by the grounding-mcp server's own `health.timeout_ms` (default
+            // 5000ms) — the same number the old budget_ms=5000 used for the
+            // outer Claude Code kill-timeout, leaving no margin. This gate
+            // already fails OPEN by design on a genuinely unreachable ledger
+            // (unlike branch-protection); raising the outer timeout does not
+            // change that posture, it only gives a merely-SLOW (not dead) ledger
+            // room to answer before the outer timeout could fire first and kill
+            // the subprocess mid-query, consistent with the other ledger-backed
+            // pack blockers.
+            budget_ms: 15000,
+            description: "Blocker: deny curated history-mutating Bash commands (git commit/add/push/merge/rebase/cherry-pick/revert/reset/stash pop|apply, gh pr create/merge) when the current branch tip matches a recorded merged tip. The recovery vocabulary (git switch/checkout/pull/fetch, git branch -d/-D, git stash list/show, any `harness ...` command) always passes as its own command, classified before any manifest or ledger access; chaining one of those with a curated mutation does NOT exempt the mutation. Fails open when the ledger is unreachable.",
         },
     ];
 }
@@ -142,7 +159,11 @@ function buildInstructions(pack, runtime) {
 
 ## Runtime
 
-${runtime}${runtime === "codex" ? " (UNSUPPORTED — see \"Known gaps\" below; both hooks assume the Claude Code Bash tool surface)" : ""}
+${runtime}${runtime === "codex"
+        ? " (UNSUPPORTED — see \"Known gaps\" below; both hooks assume the Claude Code Bash tool surface)"
+        : runtime === "opencode"
+            ? " (UNSUPPORTED — see \"Known gaps\" below; opencode has no declarative hook/event wiring, so neither hook is projected into any opencode artefact)"
+            : ""}
 
 ## Trigger + signals
 
@@ -185,12 +206,17 @@ ${runtime}${runtime === "codex" ? " (UNSUPPORTED — see \"Known gaps\" below; b
 
 2. \`PreToolUse\` blocker (\`${BLOCKER_COMMAND}\`, blocking: hard) on
    \`Bash\`: checked in this order —
-   a. **Escape allowlist first, unconditionally** (before any manifest
-      load or ledger query): \`${ESCAPE_GIT_BASH_RE.source}\` OR
-      \`${ESCAPE_HARNESS_BASH_RE.source}\` — always allowed.
-   b. **Curated mutation match**: \`${CURATED_MUTATION_BASH_RE.source}\`
-      — commands that don't match this pass through untouched.
-   c. **Ledger check**: denies only when the current branch tip exactly
+   a. **Gate-eligibility classification first, unconditionally** (before
+      any manifest load or ledger query): the curated mutation matcher
+      \`${CURATED_MUTATION_BASH_RE.source}\`. Commands it
+      does not match pass through untouched — that unconditionally covers the whole recovery
+      vocabulary (\`${ESCAPE_GIT_BASH_RE.source}\` and
+      \`${ESCAPE_HARNESS_BASH_RE.source}\`), since none of those verbs are
+      curated mutations. **Deny wins over the recovery vocabulary** when
+      one command chains both (task 19356be7): \`harness preflight &&
+      git push\` is judged by its push half, not exempted by its
+      preflight half.
+   b. **Ledger check**: denies only when the current branch tip exactly
       equals a recorded \`${MERGED_TAG_PREFIX}:<repo>:<branch>:<sha>\` fact
       for this repo+branch. A new commit moves the tip (gate falls
       silent — that's legitimate continued work); a recycled branch name
@@ -204,9 +230,12 @@ ${runtime}${runtime === "codex" ? " (UNSUPPORTED — see \"Known gaps\" below; b
   \`git branch -d <branch>\` to clean up the merged local branch.
 - **Read-only / inspection commands** (\`git switch\`/\`checkout\`,
   \`pull\`/\`fetch\`, \`branch -d\`/\`-D\`, \`stash list\`/\`show\`, and any
-  \`harness ...\` invocation) always pass, independent of ledger
-  reachability — the gate can never itself become the reason the
-  recovery path is unavailable.
+  \`harness ...\` invocation) always pass **as their own commands**,
+  independent of ledger reachability — the gate can never itself become
+  the reason the recovery path is unavailable. Chaining one of them with
+  a curated mutation does NOT exempt the mutation (the pre-19356be7
+  escape-first ordering did, which let the documented
+  preflight-then-push workflow skip the gate entirely).
 
 ## Known gaps (documented, not attempted in v1)
 
@@ -225,13 +254,19 @@ ${runtime}${runtime === "codex" ? " (UNSUPPORTED — see \"Known gaps\" below; b
   commands on a just-merged branch (e.g. hand-editing files outside
   git's own history primitives) are out of v1 scope, mirroring
   branch-protection's documented scope-cut.
-- **Chained-escape bypass**: escape-first is checked against the WHOLE
-  command string, not per-clause, so a curated mutation chained with an
-  escape verb (e.g. \`git commit -am x && git switch main\`) is fully
-  ALLOWED — the escape match wins for the entire compound command. Same
-  accepted class as the regex-vs-shell-eval residual above (\`eval\`,
-  heredoc, \`sh -c\`); not attempted to close here, and deliberate: the
-  alternative (per-clause splitting) would need a real shell parser.
+- **Chained-escape bypass — CLOSED (task 19356be7)**: the original
+  escape-first ordering matched the escape list against the WHOLE
+  command string, so a curated mutation chained with an escape verb
+  (\`harness preflight && git push\`, \`git commit -am x && git switch
+  main\`) skipped the gate entirely. The blocker now classifies by the
+  curated mutation match alone (deny wins; measured 0-divergent from
+  per-clause evaluation thanks to the escape/deny verb disjointness —
+  escape-at-start-only was measured and rejected, it still exempts three
+  of the four lines this closed).
+  Residual, measured and accepted: a deny verb as quoted TEXT in a
+  chain (\`git pull && echo 'a && git push'\`) is gate-eligible even
+  though bash never runs it — the existing accepted false-positive
+  class, no longer rescued by a chained escape verb.
 - **Inverted trust-boundary residual**: a merged fact written by any
   means OTHER than the producer (e.g. directly via
   \`mcp__grounding-mcp__ledger_add\`) that happens to exactly match the
@@ -255,6 +290,11 @@ ${runtime}${runtime === "codex" ? " (UNSUPPORTED — see \"Known gaps\" below; b
   throwaway PR and check for a fresh \`${MERGED_TAG_PREFIX}\` fact in the
   evidence ledger.
 - **No Codex adapter**: see "Runtime" above.
+- **No opencode adapter**: see "Runtime" above; opencode has no
+  declarative hook/event field (only a JS/TS plugin API), so neither
+  the producer nor the blocker hook above is ever projected into the
+  generated opencode artefact (\`harness.generated/opencode/opencode.json\`)
+  — this pack has no effect at all under \`--runtime opencode\`.
 
 ## Fail posture
 
@@ -283,8 +323,21 @@ export function resolve(pack, runtime = DEFAULT_RUNTIME) {
         },
     ];
     const warnings = [];
-    if (runtime === "codex") {
-        warnings.push(`policy_packs[${pack.name}]: post-merge-gate has no Codex adapter in v1; hooks are wired assuming the Claude Code Bash tool surface and will not fire correctly under a Codex runtime.`);
+    // HIGH-F1 (batch18 fix-round, task f34eb233): widened from
+    // `runtime === "codex"` to `runtime !== "claude-code"` so opencode
+    // gets the same pack-level warning codex already got — before this,
+    // opencode silently fell through this check (it is neither
+    // "claude-code" nor, before the widening, matched by
+    // `runtime === "codex"`), losing both the UNSUPPORTED marker above
+    // AND this warning even though opencode has no hook wiring at all
+    // (strictly worse than codex, whose hooks are at least PROJECTED,
+    // just against the wrong tool-name surface).
+    if (runtime !== "claude-code") {
+        const detail = runtime === "codex"
+            ? "hooks are wired assuming the Claude Code Bash tool surface and will not fire correctly under a Codex runtime"
+            : "opencode has no declarative hook/event wiring, so neither hook is projected into any opencode artefact and this pack has no effect";
+        const adapterName = runtime === "codex" ? "Codex" : "opencode";
+        warnings.push(`policy_packs[${pack.name}]: post-merge-gate has no ${adapterName} adapter in v1; ${detail}.`);
     }
     return { contribution: { hooks, files }, warnings };
 }

package/dist/policy-packs/builtin/post-merge-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-merge-gate.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,gEAAgE;AAChE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,uEAAuE;AACvE,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,0DAA0D;AAC1D,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,2EAA2E;AAC3E,oEAAoE;AACpE,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,2EAA2E;AAC3E,uEAAuE;AACvE,2DAA2D;AAC3D,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAChB,EAAE;AACF,yEAAyE;AACzE,sDAAsD;AACtD,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,sEAAsE;AACtE,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,2CAA2C;AAC3C,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,+DAA+D;AAC/D,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,gEAAgE;AAChE,iDAAiD;AACjD,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,4BAA4B;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,MAAM,EACJ,2FAA2F;QAC7F,QAAQ,EAAE;YACR,0HAA0H;SAC3H;QACD,GAAG,EAAE;YACH,8BAA8B;YAC9B,oBAAoB;YACpB,6CAA6C;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AACpE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,SAAS,UAAU;IACjB,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,0MAA0M;SAC7M;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI;YACf,WAAW,EACT,sZAAsZ;SACzZ;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,OAAgB;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,kBAAkB,SAAS;;;;;;;;;EASlC,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,gGAAgG,CAAC,CAAC,CAAC,EAAE;;;;iCAItG,gBAAgB;yBACxB,mBAAmB,CAAC,MAAM;;;;;;;oDAOC,mBAAmB,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;OAsBvE,iBAAiB;;;;;;;+BAOO,eAAe;;;iCAGb,kBAAkB,CAAC,MAAM;UAChD,sBAAsB,CAAC,MAAM;sCACD,wBAAwB,CAAC,MAAM;;;4BAGzC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;MAsBvC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DA4BsC,mBAAmB,CAAC,MAAM;;;;;;;;;;;yCAW9C,iBAAiB;;;;;;;;;;;;;;;;EAgBxD,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;CACrB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC;SAC1C;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,gBAAgB,IAAI,CAAC,IAAI,8JAA8J,CACxL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"post-merge-gate.js","sourceRoot":"","sources":["../../../src/policy-packs/builtin/post-merge-gate.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,gEAAgE;AAChE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,uEAAuE;AACvE,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,0DAA0D;AAC1D,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,2EAA2E;AAC3E,oEAAoE;AACpE,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,2EAA2E;AAC3E,uEAAuE;AACvE,2DAA2D;AAC3D,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,gBAAgB;AAChB,EAAE;AACF,yEAAyE;AACzE,sDAAsD;AACtD,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,+DAA+D;AAC/D,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,gEAAgE;AAChE,iDAAiD;AACjD,EAAE;AACF,oEAAoE;AACpE,gEAAgE;AAChE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,sCAAsC;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAgB,MAAM,eAAe,CAAC;AAE9D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,MAAM,EACJ,2FAA2F;QAC7F,QAAQ,EAAE;YACR,0HAA0H;SAC3H;QACD,GAAG,EAAE;YACH,8BAA8B;YAC9B,oBAAoB;YACpB,6CAA6C;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,SAAS,EAAE,CAAC;AAEpD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AACpE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,SAAS,UAAU;IACjB,OAAO;QACL;YACE,IAAI,EAAE,GAAG,gBAAgB,gBAAgB;YACzC,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI;YACf,WAAW,EACT,0MAA0M;SAC7M;QACD;YACE,IAAI,EAAE,GAAG,gBAAgB,eAAe;YACxC,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,MAAM;YAChB,wDAAwD;YACxD,sEAAsE;YACtE,iEAAiE;YACjE,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,iEAAiE;YACjE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,iBAAiB;YACjB,SAAS,EAAE,KAAK;YAChB,WAAW,EACT,shBAAshB;SACzhB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB,EAAE,OAAgB;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,kBAAkB,SAAS;;;;;;;;;EASlC,OAAO,GACL,OAAO,KAAK,OAAO;QACjB,CAAC,CAAC,gGAAgG;QAClG,CAAC,CAAC,OAAO,KAAK,UAAU;YACtB,CAAC,CAAC,mJAAmJ;YACrJ,CAAC,CAAC,EACR;;;;iCAI+B,gBAAgB;yBACxB,mBAAmB,CAAC,MAAM;;;;;;;oDAOC,mBAAmB,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;OAsBvE,iBAAiB;;;;;;;+BAOO,eAAe;;;;UAIpC,wBAAwB,CAAC,MAAM;;sBAEnB,kBAAkB,CAAC,MAAM;UACrC,sBAAsB,CAAC,MAAM;;;;;;4BAMX,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;MAyBvC,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DAkCsC,mBAAmB,CAAC,MAAM;;;;;;;;;;;yCAW9C,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAqBxD,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;YAEtD,SAAS;eACN,OAAO;CACrB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAgB,EAChB,UAAmB,eAAe;IAElC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAA2B;QACpC;YACE,YAAY,EAAE,gBAAgB,SAAS,kBAAkB;YACzD,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC;SAC1C;KACF,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,2DAA2D;IAC3D,mEAAmE;IACnE,oEAAoE;IACpE,2DAA2D;IAC3D,qDAAqD;IACrD,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,6CAA6C;IAC7C,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GACV,OAAO,KAAK,OAAO;YACjB,CAAC,CAAC,8GAA8G;YAChH,CAAC,CAAC,oIAAoI,CAAC;QAC3I,MAAM,WAAW,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/D,QAAQ,CAAC,IAAI,CACX,gBAAgB,IAAI,CAAC,IAAI,6BAA6B,WAAW,mBAAmB,MAAM,GAAG,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC"}

package/dist/policy-packs/builtin/solution-acceptance-runtime.d.ts

@@ -1,3 +1,4 @@
+import { type SignatureVerification } from "../../runtime/approval-signing.js";
 import type { PolicyPack } from "../../schema/index.js";
 export declare const PACK_NAME = "solution-acceptance";
 /**
@@ -14,6 +15,19 @@ export declare const DEFAULT_PROTECTED_COMPLETION_TOOLS: readonly ["task_finish"
  * load-bearing choke points; hardening this is follow-up `7207d8f9`.
  * Tolerates a leading `cd … &&`, inline `VAR=val` assignments, and `git -C
  * <path> push`.
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation (`&&` kept to
+ * its left only to mirror `src/runtime/command-normalize.ts`'s alternation
+ * order for readability — NOT because order is load-bearing here, unlike
+ * that module). Same fix as `d834a065` applied to every policy trigger —
+ * bash starts a new command after a single `&`, so `A=x&git push` used to
+ * slip past this DENY matcher entirely. Broadening is the stricter direction
+ * here (this gates completion actions, it is not an allow-list). Measured:
+ * swapping to `&|&&` produces a byte-identical match set for this matcher
+ * (a `RegExp.test` existential check over every start offset, not a
+ * segmenter — the reasoning that makes order matter in
+ * `command-normalize.ts`'s `BOUNDARY_RE`/`AMP_BOUNDARY_RE` does not transfer
+ * to a plain `.test()` matcher like this one).
  */
 export declare const DEFAULT_PUSH_BASH_RE: RegExp;
 /**
@@ -24,7 +38,18 @@ export declare const DEFAULT_PUSH_BASH_RE: RegExp;
  * surface (mirrors `resolveProtectedBranches` in branch-protection-runtime).
  */
 export declare function resolveProtectedCompletionTools(pack: PolicyPack): string[];
-/** The verdict marker the producer writes. Keep field-for-field with grounding-mcp. */
+/**
+ * The verdict marker the producer writes. Keep field-for-field with
+ * grounding-mcp for the first 7 keys (golden-fixture-pinned below).
+ *
+ * `alg` / `signature` (harness/c7c3f606) are ADDITIVE and OPTIONAL: a
+ * legacy / not-yet-updated producer omits them entirely (parsed as
+ * `undefined`, never `null` — mirrors how `ApprovalMarker.reportContentHash`
+ * distinguishes "absent" from an explicit empty value), and such a verdict
+ * is REJECTED by `evaluateGate` (missing signature = forged/unsigned, fail
+ * closed) rather than silently accepted. See the module doc for the
+ * consumer-only / cross-repo-follow-up honesty.
+ */
 export interface Verdict {
     id: string;
     head: string;
@@ -33,7 +58,73 @@ export interface Verdict {
     blockers: string[];
     timestamp: string;
     source: string;
+    /** Signature algorithm tag; only `SIGNING_ALG` (`src/runtime/approval-signing.ts`) verifies. */
+    alg?: string;
+    /** HMAC-SHA256 hex signature over the canonical identifying tuple (see `verifyVerdictSignature`). */
+    signature?: string;
 }
+/**
+ * Marker-id namespace the verdict's HMAC signature is bound to (mirrors
+ * `BRANCH_PROTECTION_MARKER_PREFIX` in branch-protection-runtime.ts): a
+ * validly-signed verdict for one id can never be replayed as a validly-
+ * signed verdict — or a validly-signed understanding-gate / branch-
+ * protection marker — for a different id, because `markerId` is bound into
+ * the signed payload (`approval-signing.ts` `canonicalPayload`) and this
+ * prefix keeps the three id spaces disjoint even where the raw ids
+ * (task ids, session ids) could otherwise collide.
+ */
+export declare const VERDICT_MARKER_ID_PREFIX = "solution-verdict-";
+/** The HMAC markerId for verdict `id` (NOT a filesystem path — see `verdictPathFor` for that). */
+export declare function verdictMarkerId(id: string): string;
+/**
+ * Sign `verdict`, reusing `signMarker` (`src/runtime/approval-signing.ts`)
+ * unmodified — same crypto as the understanding-gate / branch-protection
+ * markers (harness/f9485cc7). Payload mapping mirrors the approval
+ * marker's shape (`approvedAt`/`approvedBy`/`reportContentHash`) onto the
+ * verdict's own fields:
+ *   - `approvedAt` <- `verdict.timestamp` (when the attestation was made)
+ *   - `approvedBy` <- `verdict.source` (what attests it, e.g. "preflight")
+ *   - `reportContentHash` <- `verdictContentHash(verdict)` (binds
+ *     head/ready/confidence/blockers, the fields signMarker's fixed shape
+ *     has no dedicated slot for)
+ *
+ * NOT wired to any production write path in harness (harness is a pure
+ * CONSUMER of this marker, see module doc) — exported as the pattern +
+ * exemplar a grounding-mcp-side producer change reuses, and used directly
+ * by this module's own tests to construct validly-signed fixtures.
+ *
+ * Load-bearing on the producer side: `signMarker` is called with
+ * `verdictMarkerId(verdict.id)`, while the consumer (`verifyVerdictSignature`
+ * below) verifies with `verdictMarkerId(id)` where `id` is the CALLER's id,
+ * not `verdict.id`. Those two only agree when a mirroring producer sets
+ * `verdict.id` to the EXACT id string the consumer looks the marker up by —
+ * byte-identical, no trimming or case normalization on either side — and the
+ * consumer additionally rejects outright when `verdict.id !== id` even if
+ * the signature itself still verifies (belt-and-braces, see `evaluateGate`).
+ */
+export declare function signVerdict(generatedDir: string, verdict: Verdict): Verdict;
+/**
+ * Verify `verdict`'s signature, reusing `verifyMarkerSignature` unmodified.
+ * Recomputes `verdictContentHash` from the (possibly tampered) verdict
+ * being checked — the SAME name-mapping `signVerdict` uses — so any
+ * post-signing edit to `head` / `ready` / `confidence` / `blockers` /
+ * `timestamp` / `source` fails verification, not just an edit to
+ * `signature` itself.
+ *
+ * `id` is the CALLER's id — the one `evaluateGate` is actually checking
+ * (`readVerdict`'s lookup key) — NOT `verdict.id` (a field read back out of
+ * the marker BODY, which is exactly the bytes an attacker controls when
+ * copying a validly-signed marker verbatim onto a different id's path).
+ * This mirrors the load-bearing invariant `approval-signing.ts`'s
+ * `signMarker` doc states explicitly: "verification always recomputes the
+ * HMAC using the id the caller is checking, NOT one read back out of the
+ * marker body." Trusting `verdict.id` here would let a byte-for-byte copy
+ * of one id's signed verdict pass verification under a DIFFERENT id's
+ * request, because the copy's `signature` and its own (also-copied)
+ * `verdict.id` field would always agree with each other regardless of which
+ * id actually asked.
+ */
+export declare function verifyVerdictSignature(generatedDir: string, id: string, verdict: Verdict): SignatureVerification;
 /** Env knob that overrides the verdict directory (mirrors the producer). */
 export declare const VERDICT_DIR_ENV = "SOLUTION_VERDICT_DIR";
 /**
@@ -91,16 +182,69 @@ export interface GateResult {
     allowed: boolean;
     reason: string;
     verdict: Verdict | null;
+    /**
+     * True when `allowed` is false SPECIFICALLY because a verdict file
+     * existed and parsed (the 7 producer keys), but carried a missing or
+     * invalid HMAC signature (harness/c7c3f606), or a body that identifies a
+     * different id than the one being checked (cross-id replay, see the
+     * `verdict.id !== id` check below) — a legacy/not-yet-signing producer, a
+     * marker planted through some write primitive the write-guard doesn't
+     * enumerate, or content tampered/copied post-signing. Distinct from
+     * `verdict === null` (no marker at all, `forged: false`), from a
+     * signing-key I/O failure (fail-closed but NOT classified as forged,
+     * mirroring `SignatureVerification`'s `kind: "key-unavailable"` — a
+     * broken key file must not read as an active forgery attempt in audit
+     * output), and from a verdict with NO `alg`/`signature` fields at all
+     * whose `timestamp` / `source` also reads blank (fail-closed but NOT
+     * classified as forged either — a legitimately malformed, never-signed
+     * marker, not evidence of an attack; see the `MISSING_*_REASON` carve-out
+     * below). That last carve-out is scoped tightly: a verdict that DOES carry
+     * `alg`/`signature` but still hits the same blank-field reason IS
+     * classified `forged: true` — a signed field reading blank only happens
+     * via post-signing tampering, so it does not get the "legitimately
+     * malformed" benefit of the doubt (review R2, closes an audit-fidelity
+     * gap where a forger could blank a real signed verdict's `timestamp` to
+     * suppress this tag while the block itself still held). `allowed` is
+     * always false when `forged` is true.
+     */
+    forged: boolean;
 }
 /**
- * Evaluate the gate for `id` at `currentHead`. Mirrors grounding-mcp
- * `evaluateGate` EXACTLY: allow iff `verdict.ready === true` AND
- * `verdict.head === currentHead`. `confidence` is INFORMATIONAL ONLY and
- * never gates — a `ready:true confidence:0` verdict at HEAD passes — so the
- * harness consumer stays byte-parity with the producer's `solution_gate`
- * (an operator running `solution_gate` and the harness gate must agree).
+ * Evaluate the gate for `id` at `currentHead`. First verifies the verdict's
+ * HMAC signature (harness/c7c3f606, fail-closed — see `verifyVerdictSignature`);
+ * a verdict that fails this is REJECTED before its `ready` / `head` fields
+ * are ever trusted, with a distinct forged/unsigned reason so an
+ * operator/auditor can tell that apart from the routine "not ready yet" or
+ * "no verdict" cases. Signature verification needs `generatedDir` (the
+ * harness `.generated/` dir holding the shared signing key, NOT the verdict
+ * dir) — `undefined` when it could not be resolved, which fails closed with
+ * its own distinct (non-forged) reason.
+ *
+ * `verifyVerdictSignature` is called with `id` — the CALLER's id, i.e. the
+ * one this function is asked to check — not `verdict.id`. A SECOND,
+ * belt-and-braces check below independently rejects `verdict.id !== id`:
+ * even though the signature check alone already closes the cross-id-replay
+ * hole (a byte-for-byte copy of a validly-signed verdict onto a different
+ * id's path fails signature verification, because the markerId the
+ * signature is bound to no longer matches `id`), the verdict body's `id`
+ * field itself is NOT part of the signed payload (only `timestamp` /
+ * `source` / the head-ready-confidence-blockers content hash are), so it
+ * can drift from the id that was actually verified without invalidating an
+ * otherwise-valid signature. This check makes that drift fail loudly too,
+ * rather than silently ignoring an inconsistency in the body of a verdict
+ * that otherwise passed.
+ *
+ * Once signed and identity-checked, mirrors grounding-mcp `evaluateGate`:
+ * allow iff `verdict.ready === true` AND `verdict.head === currentHead`.
+ * `confidence` is INFORMATIONAL ONLY and never gates — a `ready:true
+ * confidence:0` verdict at HEAD passes — so the harness consumer stays
+ * byte-parity with the producer's `solution_gate` for THAT decision.
+ * Signature verification itself is NOT (yet) mirrored on the producer side
+ * — see module doc, "HONEST RESIDUAL": grounding-mcp's own `solution_gate`
+ * does not enforce this signature, only this harness consumer does, until a
+ * matching producer release ships.
  */
-export declare function evaluateGate(verdict: Verdict | null, currentHead: string | null, id: string): GateResult;
+export declare function evaluateGate(verdict: Verdict | null, currentHead: string | null, id: string, generatedDir: string | undefined): GateResult;
 /**
  * Is `target` inside `dir` after resolution? Used for the path-tool arm
  * (Write/Edit/MultiEdit/NotebookEdit `file_path`) and for a Bash shell whose