@lannguyensi/harness 0.48.0 → 0.50.0

package/dist/cli/remove/index.js

@@ -6,6 +6,8 @@ import { resolveHomeDir } from "../../runtime/home-dir.js";
 import { withFileLock } from "../../io/lock.js";
 import { unifiedDiff } from "../../io/patch.js";
 import { formatValidationErrors, validateBeforeWrite, } from "../../io/validate-before-write.js";
+import { ManifestParseError, parseManifest } from "../../schema/index.js";
+import { deriveWorkflowGatePolicies, REVIEW_EVIDENCE_HOOK_BASH, REVIEW_EVIDENCE_HOOK_MCP, } from "../../runtime/workflow-policies.js";
 import { EX_FAIL, EX_NOINPUT, HarnessExitError } from "../exit-codes.js";
 import { applyRemove, planRemove } from "./mutate.js";
 const DEFAULT_BASENAME = "harness.yaml";
@@ -20,6 +22,66 @@ function formatNameList(names) {
         return "(none declared)";
     return names.map((n) => `  - ${n}`).join("\n");
 }
+/**
+ * F8 (review round 2, 99f47307 Slice 1): `planRemove`'s
+ * `referencingPolicies` only ever sees HAND-authored `policies:` entries
+ * (it walks the raw YAML document). A `require-review-evidence[-bash]`
+ * hook referenced ONLY by a `workflows[]`-derived merge gate (no
+ * hand-authored policy names it) passed that check silently — `harness
+ * remove hook require-review-evidence` would delete the hook and the
+ * next `harness apply`/`policy intercept` would derive nothing for it
+ * (hasWiredMergeGateHooks requires BOTH hooks), a silent regression from
+ * "enforced" to "not enforced" for every workflow with `spawn:
+ * "required"`. This consults the SAME derivation `withDerivedPolicies`
+ * uses (`deriveWorkflowGatePolicies`) against the manifest as it stands
+ * BEFORE the removal, and returns the names of workflows whose derived
+ * gate references `hookName` — empty for any type/name that isn't one of
+ * the two evidence hooks, or when the manifest fails to parse (the
+ * existing schema-gate checks further down handle a malformed manifest;
+ * this is a best-effort pre-check, not the safety net).
+ */
+function derivedGateReferencingWorkflows(yamlText, type, hookName) {
+    if (type !== "hook")
+        return [];
+    if (hookName !== REVIEW_EVIDENCE_HOOK_MCP && hookName !== REVIEW_EVIDENCE_HOOK_BASH)
+        return [];
+    let manifest;
+    try {
+        manifest = parseManifest(parseYaml(yamlText));
+    }
+    catch (err) {
+        if (err instanceof ManifestParseError)
+            return [];
+        throw err;
+    }
+    // Non-empty only when BOTH evidence hooks are currently wired (see
+    // `hasWiredMergeGateHooks`) — if only one is present already, no
+    // workflow has an enforced gate to lose from removing the other.
+    const derivedPolicies = deriveWorkflowGatePolicies(manifest);
+    if (derivedPolicies.length === 0)
+        return [];
+    // F5 (review round 3 follow-up, 99f47307 Slice 1): this used to return
+    // every workflow matching `workflowRequiresMergeGate` (the SHAPE test),
+    // not the workflows the derivation actually produced a policy for (the
+    // dedupe an equivalent hand-authored policy already covers on the same
+    // surface derives NOTHING for; see `deriveWorkflowGates`'s `seen` set).
+    // A manifest with two qualifying workflows where only one is actually
+    // derived would name both here even though only one's gate is really
+    // lost. Project the workflow name back out of each derived policy's
+    // name instead (`workflow:<name>:review-before-merge[-bash]`), filtered
+    // to the hook being removed so a `require-review-evidence`-only removal
+    // does not also name workflows whose gate only depends on the bash hook.
+    const affected = new Set();
+    for (const policy of derivedPolicies) {
+        if (policy.hook !== hookName)
+            continue;
+        const match = /^workflow:(.+):review-before-merge(?:-bash)?$/.exec(policy.name);
+        const workflowName = match?.[1];
+        if (workflowName !== undefined)
+            affected.add(workflowName);
+    }
+    return manifest.workflows.filter((wf) => affected.has(wf.name)).map((wf) => wf.name);
+}
 export async function remove(type, name, opts = {}) {
     const target = resolveTargetPath(opts);
     if (!fs.existsSync(target)) {
@@ -35,6 +97,23 @@ export async function remove(type, name, opts = {}) {
         const verb = plan.referencingPolicies.length === 1 ? "policy" : "policies";
         throw new HarnessExitError(`${verb} ${refList} reference${plan.referencingPolicies.length === 1 ? "s" : ""} this hook; remove the ${verb} first or pass --force`, EX_FAIL);
     }
+    // F8 (review round 2, 99f47307 Slice 1): the check above only sees
+    // hand-authored `policies:` entries; a hook referenced ONLY by a
+    // workflows[]-derived merge gate must get the same protection, or
+    // `harness remove hook require-review-evidence` silently disables the
+    // gate for every workflow with `spawn: "required"` (no dangling
+    // schema reference to catch it afterwards — see
+    // `derivedGateReferencingWorkflows`'s header for why there is no
+    // schema-level safety net here the way there is for hand policies).
+    const derivedGateWorkflows = derivedGateReferencingWorkflows(original, type, name);
+    if (derivedGateWorkflows.length > 0 && !opts.force) {
+        const wfList = derivedGateWorkflows.map((n) => `"${n}"`).join(", ");
+        const verb = derivedGateWorkflows.length === 1 ? "workflow" : "workflows";
+        throw new HarnessExitError(`${verb} ${wfList} derive${derivedGateWorkflows.length === 1 ? "s" : ""} a runtime merge gate ` +
+            `from this hook (a review_subagent step with spawn: "required" followed by a merge step); ` +
+            `removing it would silently disable that gate. Drop spawn: "required" on the workflow step ` +
+            "first, or pass --force.", EX_FAIL);
+    }
     const proposed = applyRemove(original, type, name);
     const diff = unifiedDiff({
         fileName: path.basename(target),
@@ -52,6 +131,14 @@ export async function remove(type, name, opts = {}) {
     if (!schemaResult.ok) {
         throw new HarnessExitError(`proposed manifest fails schema validation:\n${formatValidationErrors(schemaResult.errors)}`, EX_FAIL);
     }
+    // derivedGateWorkflows is non-empty here only under --force (the
+    // pre-check above threw otherwise), on BOTH paths: unlike a dangling
+    // policy.hook reference, nothing downstream refuses a --force'd
+    // derived-gate removal (see `derivedGateReferencingWorkflows`), so the
+    // write path must report it too, not only the dry-run (F3, review
+    // round 3; the round-2 code hard-coded `[]` on the write path and the
+    // CLI never printed either).
+    const derivedGateReferences = derivedGateWorkflows;
     if (opts.dryRun) {
         // forcedReferences is informational on dry-run: it shows the user which
         // policies would have been overridden if the schema gate did not refuse.
@@ -64,6 +151,7 @@ export async function remove(type, name, opts = {}) {
             diff,
             applied: false,
             forcedReferences: opts.force ? plan.referencingPolicies : [],
+            derivedGateReferences,
         };
     }
     const lockPath = path.join(path.dirname(target), LOCK_BASENAME);
@@ -86,6 +174,7 @@ export async function remove(type, name, opts = {}) {
         // hook, so the only way to reach here with --force is when there are no
         // referencing policies to begin with.
         forcedReferences: [],
+        derivedGateReferences,
     };
 }
 export const KNOWN_REMOVE_TYPES = ["mcp", "cli", "skill", "hook"];

package/dist/cli/remove/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/remove/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AAkBvE,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CACd,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EACzF,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAe;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACjD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAgB,EAChB,IAAY,EACZ,OAAsB,EAAE;IAExB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,MAAM,8BAA8B,EACrE,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,WAAW,IAAI,0BAA0B,IAAI,cAAc,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EACvG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3E,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,IAAI,OAAO,aAAa,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,IAAI,wBAAwB,EACrI,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAC5F,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE;SAC7D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAC9G,OAAO,CACR,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,4EAA4E;QAC5E,wEAAwE;QACxE,sCAAsC;QACtC,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEhF,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAQ,kBAA+B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/remove/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AA8BvE,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CACd,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EACzF,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAe;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACjD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,+BAA+B,CAAC,QAAgB,EAAE,IAAgB,EAAE,QAAgB;IAC3F,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,QAAQ,KAAK,wBAAwB,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO,EAAE,CAAC;IAC/F,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB;YAAE,OAAO,EAAE,CAAC;QACjD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,mEAAmE;IACnE,iEAAiE;IACjE,iEAAiE;IACjE,MAAM,eAAe,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,+CAA+C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,YAAY,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,YAAY,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAgB,EAChB,IAAY,EACZ,OAAsB,EAAE;IAExB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,MAAM,8BAA8B,EACrE,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,WAAW,IAAI,0BAA0B,IAAI,cAAc,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EACvG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3E,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,IAAI,OAAO,aAAa,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0BAA0B,IAAI,wBAAwB,EACrI,OAAO,CACR,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,sEAAsE;IACtE,gEAAgE;IAChE,gDAAgD;IAChD,iEAAiE;IACjE,oEAAoE;IACpE,MAAM,oBAAoB,GAAG,+BAA+B,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1E,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,IAAI,MAAM,UAAU,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB;YAC7F,2FAA2F;YAC3F,4FAA4F;YAC5F,yBAAyB,EAC3B,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAC5F,OAAO,CACR,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,qEAAqE;IACrE,gEAAgE;IAChE,uEAAuE;IACvE,kEAAkE;IAClE,sEAAsE;IACtE,6BAA6B;IAC7B,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;IAEnD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE;YAC5D,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAC9G,OAAO,CACR,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,4EAA4E;QAC5E,wEAAwE;QACxE,sCAAsC;QACtC,gBAAgB,EAAE,EAAE;QACpB,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEhF,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAQ,kBAA+B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/cli/validate/checks.d.ts

@@ -20,6 +20,53 @@ declare function resolveOnPath(binary: string, pathEnv: string): string | null;
 declare function compareVersions(actual: string, required: string): number;
 export declare function checkPolicyGroundingMcp(manifest: Manifest): Diagnostic[];
 export declare function checkSolutionAcceptanceProducer(manifest: Manifest): Diagnostic[];
+export declare function checkWorkflowGateWiring(manifest: Manifest): Diagnostic[];
+/**
+ * F1 (review round 2): a hand-authored policy on the identical trigger
+ * surface + ledger_tag as a derived block gate, but weaker than it
+ * (`enforcement: "warn"`/`"require_approval"`, or `when:`-scoped), no
+ * longer suppresses the derived gate (see `isAtLeastAsStrongAsDerivedGate`
+ * in workflow-policies.ts) — both apply. This check surfaces that overlap
+ * as a warning so an operator reading the weaker policy does not mistake
+ * it for the ONLY gate on the surface.
+ */
+export declare function checkWorkflowGateWeakOverlap(manifest: Manifest): Diagnostic[];
+/**
+ * F6 (review round 2): a workflow that declares BOTH a `merge` step and a
+ * `review_subagent` step with `spawn: "required"`, but with the review
+ * step coming AFTER the merge step, derives no gate at all
+ * (`workflowRequiresMergeGate` only looks for review-then-merge). That
+ * ordering is likely a mistake (a review that runs after the PR already
+ * merged cannot gate it), but step-ordering validation in general is out
+ * of scope for this slice (module doc, src/runtime/workflow-policies.ts).
+ * This warns instead of silently doing nothing.
+ */
+export declare function checkWorkflowMergeBeforeReview(manifest: Manifest): Diagnostic[];
+/**
+ * Review round 3 (99f47307 Slice 1): a hand-authored policy whose name
+ * equals a derived policy's name (`workflow:<name>:review-before-merge[-
+ * bash]`) is not deduped by name (dedupe keys on surface, not name), so
+ * the derived view carries two policies with one name. This fires both
+ * when the hand-authored policy sits on a DIFFERENT surface (dedupe never
+ * even compares them), and when it sits on the SAME surface but is not
+ * `isAtLeastAsStrongAsDerivedGate` (weaker enforcement or a `when:` scope
+ * — that case IS a surface match, so `findWeakGatePolicyOverlaps` also
+ * reports it as an overlap; the two checks are not mutually exclusive).
+ * Either way the runtime evaluates both policies (fail-safe), but every
+ * by-name reader (`explain`, `explain-policy`, `audit`, `diff`'s
+ * name-keyed policy list) resolves the name to the hand-authored one and
+ * silently hides the derived gate. The schema's duplicate-name refinement
+ * cannot see this (it runs on the hand-authored view), so it is an error
+ * here.
+ */
+export declare function checkWorkflowDerivedNameCollision(manifest: Manifest): Diagnostic[];
+/**
+ * Every `workflows[]` check in one list, so `harness validate`
+ * (`runAssetChecks`) and `harness doctor`'s Workflows section run the
+ * SAME set (review round 3, 99f47307 Slice 1: doctor previously picked
+ * two of the three by hand and was missing `checkWorkflowMergeBeforeReview`).
+ */
+export declare function checkWorkflows(manifest: Manifest): Diagnostic[];
 /**
  * Answers "is `relPath` git-ignored here?": `true` / `false`, or `null`
  * when the question has no answer (not a git repository, git not
@@ -37,7 +84,9 @@ export declare function createDefaultGitIgnoreProbe(cwd?: string): GitIgnoreProb
 export declare function checkSolutionAcceptanceKnobIgnored(manifest: Manifest, probe: GitIgnoreProbe): Diagnostic[];
 export declare function checkPolicySelfAttestation(manifest: Manifest): Diagnostic[];
 export declare function checkPolicyRiskWithoutEnvScope(manifest: Manifest): Diagnostic[];
+export declare function checkSafeDeletionRootsSyntax(manifest: Manifest): Diagnostic[];
 export declare function checkTemplatePolicyDrift(manifest: Manifest): Diagnostic[];
+export declare function checkTriggerBoundaryDrift(manifest: Manifest): Diagnostic[];
 export declare function checkHookBudgetLedgerMargin(manifest: Manifest): Diagnostic[];
 export declare function runAssetChecks(manifest: Manifest, opts?: CheckOptions): Diagnostic[];
 export declare const __testables: {