@mmnto/cli 1.101.2 → 1.103.0

package/dist/commands/shield-nonreview.test.js

@@ -0,0 +1,175 @@
+/**
+ * CLI-level deterministic-skip NON-REVIEW tests (mmnto-ai/totem#2466).
+ *
+ * `totem review` has three deterministic skip paths that drop the ENTIRE diff
+ * without examining it: all-non-code, no-code-after-filtering, and all-generated.
+ * Each used to call `writeReviewedContentHash(...)` before returning, minting the
+ * `.reviewed-content-hash` push-gate stamp for content nothing reviewed.
+ *
+ * The danger is not uniform, which is why all three are pinned here rather than
+ * only the reported one:
+ *
+ *   - all-non-code / filtered-empty fire only when no code file is in the diff,
+ *     so the hash is unchanged and the stamp was a no-op. The defect is the
+ *     dishonest clean-pass surface (Tenets 4/13).
+ *   - all-generated can drop a TRACKED, HASHED source file, because
+ *     `.gitattributes linguist-generated` can mark a `.ts` as generated. There the
+ *     stamp genuinely authorized never-reviewed code — a push-gate bypass.
+ *
+ * Mirrors `shield-covariate.test.ts`: its own file to avoid mock contamination,
+ * mocking the heavy seams (config, engine bootstrap, hook installer, git diff) so
+ * the skip branches are exercised without a real repo, config, or network invoke.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { cleanTmpDir } from '../test-utils.js';
+// ── Seams that MUST NOT run once a skip path is taken ──
+const bootstrapEngineSpy = vi.fn(async (..._args) => { });
+const upgradePrePushHookSpy = vi.fn((..._args) => false);
+const getDiffForReviewSpy = vi.fn(async (..._args) => null);
+const TEST_CONFIG = {
+    totemDir: '.totem',
+    review: { sourceExtensions: ['.ts'] },
+};
+vi.mock('../utils/bootstrap-engine.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual, bootstrapEngine: bootstrapEngineSpy };
+});
+vi.mock('./install-hooks.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual, upgradePrePushHookIfNeeded: upgradePrePushHookSpy };
+});
+vi.mock('../utils.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        loadEnv: vi.fn(),
+        resolveConfigPath: (cwd) => path.join(cwd, 'totem.config.ts'),
+        loadConfig: vi.fn(async () => TEST_CONFIG),
+    };
+});
+vi.mock('../git.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual, getDiffForReview: getDiffForReviewSpy };
+});
+/** A minimal single-file diff section for `file`. */
+function diffFor(file) {
+    return [
+        `diff --git a/${file} b/${file}`,
+        'index 1111111..2222222 100644',
+        `--- a/${file}`,
+        `+++ b/${file}`,
+        '@@ -1 +1 @@',
+        '-old',
+        '+new',
+    ].join('\n');
+}
+describe('deterministic skip paths are NON-REVIEWS and never stamp (#2466)', () => {
+    let tmpDir;
+    let warnings;
+    const stampPath = () => path.join(tmpDir, '.totem', 'cache', '.reviewed-content-hash');
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'shield-nonreview-'));
+        warnings = [];
+        vi.spyOn(process, 'cwd').mockReturnValue(tmpDir);
+        vi.spyOn(console, 'error').mockImplementation((...args) => {
+            warnings.push(args.map(String).join(' '));
+        });
+        vi.spyOn(console, 'log').mockImplementation((...args) => {
+            warnings.push(args.map(String).join(' '));
+        });
+        bootstrapEngineSpy.mockClear();
+        getDiffForReviewSpy.mockClear();
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        // The non-skip case (mixed diff) runs into the LLM path and aborts on the
+        // unmocked embedding config, which can leave a handle open under the temp
+        // dir — Windows then EPERMs the recursive remove. That is a harness artifact
+        // of driving the real command, not a product behavior, and it must not fail
+        // a suite whose assertions are all about the stamp and the emitted output.
+        try {
+            cleanTmpDir(tmpDir);
+        }
+        catch {
+            // Best-effort cleanup; the OS reclaims the temp dir.
+        }
+    });
+    /**
+     * Drive the real command with a diff whose files are all `files`.
+     *
+     * A run that does NOT take a skip path continues into the LLM review path and
+     * throws on the unmocked embedding config. That throw is expected and is itself
+     * evidence the skip did not fire, so it is swallowed here — every assertion
+     * below is made on the stamp and the emitted output, never on resolution.
+     */
+    async function runWithDiff(files) {
+        await runWithDiffRaw(files.map(diffFor).join('\n'), files);
+    }
+    /**
+     * Lower-level driver for cases where the diff BODY and the changed-file LIST
+     * must differ — the filtered-empty path needs a code file present in the list
+     * whose hunks are absent from the diff (a mode-only change has this shape).
+     */
+    async function runWithDiffRaw(diff, changedFiles) {
+        getDiffForReviewSpy.mockResolvedValueOnce({ diff, changedFiles });
+        const { shieldCommand } = await import('./shield.js');
+        try {
+            await shieldCommand({});
+        }
+        catch {
+            // See doc comment — a non-skip run is expected to fail downstream.
+        }
+    }
+    it('all-non-code: does not stamp, and says so', async () => {
+        await runWithDiff(['docs/plan.md', 'README.md']);
+        // The load-bearing assertion: no push authorization was minted.
+        expect(fs.existsSync(stampPath())).toBe(false);
+        // And the skip is LOUD — a caller cannot read it as a clean review.
+        expect(warnings.join('\n')).toMatch(/NON-REVIEW/);
+        expect(warnings.join('\n')).toMatch(/does not authorize a push/);
+    });
+    it('all-generated: does not stamp — the path that could authorize real code', async () => {
+        // A lockfile is generated by default glob, so the whole diff drops.
+        await runWithDiff(['pnpm-lock.yaml']);
+        expect(fs.existsSync(stampPath())).toBe(false);
+        expect(warnings.join('\n')).toMatch(/NON-REVIEW/);
+        expect(warnings.join('\n')).toMatch(/does not authorize a push/);
+    });
+    it('all-generated via .gitattributes on a TRACKED .ts: does not stamp (the bypass case)', async () => {
+        // The scenario the default-glob lockfile test does NOT reach, and the only
+        // one where the old stamp could authorize genuinely-changed, hashed source:
+        // `linguist-generated` marks a real `.ts`, so the file is dropped from review
+        // while still counting toward the content hash the push gate compares.
+        fs.writeFileSync(path.join(tmpDir, '.gitattributes'), 'src/generated-client.ts linguist-generated\n');
+        await runWithDiff(['src/generated-client.ts']);
+        expect(fs.existsSync(stampPath())).toBe(false);
+        // Assert the GENERATED-path wording specifically. A bare /NON-REVIEW/ match
+        // would also pass if this fell through to the all-non-code branch, which
+        // would mean the test proves nothing about the bypass it exists to cover.
+        expect(warnings.join('\n')).toMatch(/every changed file is a generated artifact/);
+        expect(warnings.join('\n')).toMatch(/does not authorize a push/);
+    });
+    it('filtered-empty: does not stamp when no code hunks survive filtering', async () => {
+        // Stage 2 fires when the diff is neither all-code nor all-non-code and the
+        // code side contributes no hunks — a mode-only change on a tracked source
+        // file has exactly this shape: listed as changed, absent from the diff body.
+        await runWithDiffRaw(diffFor('docs/plan.md'), ['docs/plan.md', 'src/index.ts']);
+        expect(fs.existsSync(stampPath())).toBe(false);
+        // Stage-2 wording specifically — distinguishes this from the Stage-1
+        // all-non-code branch, which a generic NON-REVIEW match would not.
+        expect(warnings.join('\n')).toMatch(/no code changes remain after filtering/);
+        expect(warnings.join('\n')).toMatch(/does not authorize a push/);
+    });
+    it('mixed code + prose does NOT take a skip path (the skip must not over-fire)', async () => {
+        // Guards the inverse error: tightening the skip must not start skipping real
+        // code. A surviving `.ts` file means this is a review, not a non-review.
+        await runWithDiff(['docs/plan.md', 'src/index.ts']);
+        expect(warnings.join('\n')).not.toMatch(/NON-REVIEW/);
+        // It also must not stamp here — this run never completed a review either.
+        expect(fs.existsSync(stampPath())).toBe(false);
+    });
+});
+//# sourceMappingURL=shield-nonreview.test.js.map

package/dist/commands/shield-nonreview.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-nonreview.test.js","sourceRoot":"","sources":["../../src/commands/shield-nonreview.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAIzE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,0DAA0D;AAC1D,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAgB,EAAiB,EAAE,GAAE,CAAC,CAAC,CAAC;AACnF,MAAM,qBAAqB,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAW,EAAE,CAAC,KAAK,CAAC,CAAC;AAC7E,MAAM,mBAAmB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAgB,EAAoB,EAAE,CAAC,IAAI,CAAC,CAAC;AAEzF,MAAM,WAAW,GAAG;IAClB,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE;CACZ,CAAC;AAE5B,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,EAAiD,CAAC;IACrF,OAAO,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuC,CAAC;IAC3E,OAAO,EAAE,GAAG,MAAM,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAgC,CAAC;IACpE,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;QAChB,iBAAiB,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC;QACrE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC;KAC3C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC5C,MAAM,MAAM,GAAG,MAAM,cAAc,EAA8B,CAAC;IAClE,OAAO,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,qDAAqD;AACrD,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO;QACL,gBAAgB,IAAI,MAAM,IAAI,EAAE;QAChC,+BAA+B;QAC/B,SAAS,IAAI,EAAE;QACf,SAAS,IAAI,EAAE;QACf,aAAa;QACb,MAAM;QACN,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,IAAI,MAAc,CAAC;IACnB,IAAI,QAAkB,CAAC;IAEvB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAEvF,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrE,QAAQ,GAAG,EAAE,CAAC;QACd,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACjD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;YACnE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;YACjE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAC/B,mBAAmB,CAAC,SAAS,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,CAAC;YACH,WAAW,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,KAAK,UAAU,WAAW,CAAC,KAAe;QACxC,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,YAAsB;QAChE,mBAAmB,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,EAAyC,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,WAAW,CAAC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;QAEjD,gEAAgE;QAChE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,oEAAoE;QACpE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,oEAAoE;QACpE,MAAM,WAAW,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEtC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,2EAA2E;QAC3E,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACnC,8CAA8C,CAC/C,CAAC;QAEF,MAAM,WAAW,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAE/C,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QAClF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QAEhF,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAC9E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,WAAW,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QAEpD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,0EAA0E;QAC1E,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/shield.d.ts

@@ -15,10 +15,32 @@ export declare function parseVerdict(content: string): {
     pass: boolean;
     reason: string;
 } | null;
+export type StructuredVerdictExtractionLayer = 'xml' | 'fence' | 'bare-json';
+export type StructuredVerdictExtractionFailureCause = 'empty-output' | 'no-candidate' | 'invalid-json' | 'schema-invalid';
+export interface StructuredVerdictExtractionAttempt {
+    layer: StructuredVerdictExtractionLayer;
+    cause: Extract<StructuredVerdictExtractionFailureCause, 'invalid-json' | 'schema-invalid'>;
+    /** Bounded validation summaries; candidate/output text is never retained here. */
+    issues?: string[];
+}
+export type StructuredVerdictExtractionResult = {
+    ok: true;
+    verdict: ShieldStructuredVerdict;
+    layer: StructuredVerdictExtractionLayer;
+} | {
+    ok: false;
+    cause: StructuredVerdictExtractionFailureCause;
+    attempts: StructuredVerdictExtractionAttempt[];
+};
 /**
- * Three-layer JSON extraction from LLM plain-text response.
- * Layer 1: XML tags, Layer 2: markdown code fences, Layer 3: bare JSON.
- * Returns null if all layers fail (caller falls back to V1 regex parseVerdict).
+ * Three-layer JSON extraction with bounded, candidate-free failure diagnostics.
+ * A schema-invalid candidate takes precedence over malformed candidates because
+ * it is the most semantically advanced failure reached by the cascade.
+ */
+export declare function extractStructuredVerdictDetailed(content: string): StructuredVerdictExtractionResult;
+/**
+ * Compatibility wrapper for callers that only need the parsed verdict.
+ * Returns null when all XML, fenced, and bare-JSON layers fail.
  */
 export declare function extractStructuredVerdict(content: string): ShieldStructuredVerdict | null;
 /**
@@ -74,10 +96,14 @@ export declare function writeReviewedContentHashValue(precomputedHash: string, c
  * survives commits, amends, and rebases. Only breaks when source files change.
  *
  * Now a thin compose of the pure computer + explicit writer (Prop 304 R2): it
- * hashes the CURRENT tree and stamps it. Retained at its original signature
- * for the trivial fast-path stamps (no-changes / all-non-code / filtered-empty
- * — none of which open a mid-run LLM window) and `recordShieldOverride`, where
- * there is no drift race to guard. The LLM review path does NOT use this — it
+ * hashes the CURRENT tree and stamps it. Retained at its original signature for
+ * the no-changes stamp (an empty diff opens no mid-run LLM window) and
+ * `recordShieldOverride`, where there is no drift race to guard.
+ *
+ * NO LONGER used by the deterministic skip paths (all-non-code / filtered-empty /
+ * all-generated). Those drop the entire diff without examining it, so they are
+ * non-reviews and must not stamp — see `NO_STAMP_NOTICE` (mmnto-ai/totem#2466).
+ * The LLM review path does NOT use this — it
  * captures the hash pre-fan and compare-and-stamps in `shieldCommand` /
  * `handleVerdictResult` so a mid-review edit can never be authorized.
  */

package/dist/commands/shield.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield.d.ts","sourceRoot":"","sources":["../../src/commands/shield.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA2B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAkBzE,OAAO,EAWL,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAO7B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAI/B,UAAU,gBAAgB;IACxB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,IAAI,EAAE,YAAY,EAAE,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AA0BD,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EAAE,EACtB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CA0CjB;AAID,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,gBAAgB,EACzB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,wBAAwB,CAAC,EAAE,MAAM,GAChC,MAAM,CA4DR;AAID,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,EACtB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,wBAAwB,CAAC,EAAE,MAAM,GAChC,MAAM,CA0CR;AAID,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAItF;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAuCxF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,uBAAuB,GAAG;IAChE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAuBA;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAkC/F;AA6CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,GAAE,SAAS,MAAM,EAAoC,GAC9D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2CxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,GAAE,SAAS,MAAM,EAAoC,GAC9D,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,GAAE,SAAS,MAAM,EAAoC,GAC9D,OAAO,CAAC,IAAI,CAAC,CAIf;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oCAAoC,CACxD,MAAM,EAAE,oCAAoC,GAC3C,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA8B/B;AAID,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACjC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD,wBAAsB,gBAAgB,CACpC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAsIf;AAID,uCAAuC;AACvC,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,aAAa,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC,CAwFf;AAID;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,iBAAiB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,yEAAyE;IACzE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAClC;;;OAGG;IACH,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAClC,+EAA+E;IAC/E,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,WAAW,CAAC,CActB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uCAAuC,CAC3D,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC,CAsBf;AAiMD,UAAU,iBAAiB;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAkE5B;AAID,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA6gBzE"}
+{"version":3,"file":"shield.d.ts","sourceRoot":"","sources":["../../src/commands/shield.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA2B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAkBzE,OAAO,EAWL,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAO7B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAI/B,UAAU,gBAAgB;IACxB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,IAAI,EAAE,YAAY,EAAE,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AA0BD,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EAAE,EACtB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CA0CjB;AAID,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,gBAAgB,EACzB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,wBAAwB,CAAC,EAAE,MAAM,GAChC,MAAM,CA4DR;AAID,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,EACtB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,wBAAwB,CAAC,EAAE,MAAM,GAChC,MAAM,CA0CR;AAID,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAItF;AAID,MAAM,MAAM,gCAAgC,GAAG,KAAK,GAAG,OAAO,GAAG,WAAW,CAAC;AAE7E,MAAM,MAAM,uCAAuC,GAC/C,cAAc,GACd,cAAc,GACd,cAAc,GACd,gBAAgB,CAAC;AAErB,MAAM,WAAW,kCAAkC;IACjD,KAAK,EAAE,gCAAgC,CAAC;IACxC,KAAK,EAAE,OAAO,CAAC,uCAAuC,EAAE,cAAc,GAAG,gBAAgB,CAAC,CAAC;IAC3F,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,iCAAiC,GACzC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,uBAAuB,CAAC;IACjC,KAAK,EAAE,gCAAgC,CAAC;CACzC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,uCAAuC,CAAC;IAC/C,QAAQ,EAAE,kCAAkC,EAAE,CAAC;CAChD,CAAC;AAyCN;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,GACd,iCAAiC,CAuCnC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAGxF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,uBAAuB,GAAG;IAChE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAuBA;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAkC/F;AA0DD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,GAAE,SAAS,MAAM,EAAoC,GAC9D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2CxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,GAAE,SAAS,MAAM,EAAoC,GAC9D,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,GAAE,SAAS,MAAM,EAAoC,GAC9D,OAAO,CAAC,IAAI,CAAC,CAIf;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oCAAoC,CACxD,MAAM,EAAE,oCAAoC,GAC3C,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA8B/B;AAID,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACjC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD,wBAAsB,gBAAgB,CACpC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAsIf;AAID,uCAAuC;AACvC,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,aAAa,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC,CAwFf;AAID;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,iBAAiB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,yEAAyE;IACzE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAClC;;;OAGG;IACH,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAClC,+EAA+E;IAC/E,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,WAAW,CAAC,CActB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uCAAuC,CAC3D,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC,CAsBf;AAiMD,UAAU,iBAAiB;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAkE5B;AAID,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqgBzE"}

package/dist/commands/shield.js

@@ -152,54 +152,84 @@ export function parseVerdict(content) {
         return null;
     return { pass: match[1] === 'PASS', reason: match[2].trim() };
 }
-// ─── V2 Structured verdict parsing ───────────────────
+const MAX_EXTRACTION_ISSUES = 4;
+const MAX_EXTRACTION_ISSUE_CHARS = 160;
+function summarizeValidationIssues(issues) {
+    return issues.slice(0, MAX_EXTRACTION_ISSUES).map((issue) => {
+        const path = issue.path.length > 0 ? issue.path.join('.') : '<root>';
+        return `${path}: ${issue.code}`.slice(0, MAX_EXTRACTION_ISSUE_CHARS);
+    });
+}
+function tryStructuredVerdictCandidate(layer, candidate) {
+    let parsed;
+    try {
+        parsed = JSON.parse(candidate);
+        // totem-context: malformed candidates are expected during the extraction cascade and are converted into the typed invalid-json result below.
+    }
+    catch {
+        return { ok: false, attempt: { layer, cause: 'invalid-json' } };
+    }
+    const result = ShieldStructuredVerdictSchema.safeParse(parsed);
+    if (result.success)
+        return { ok: true, verdict: result.data, layer };
+    return {
+        ok: false,
+        attempt: {
+            layer,
+            cause: 'schema-invalid',
+            issues: summarizeValidationIssues(result.error.issues),
+        },
+    };
+}
 /**
- * Three-layer JSON extraction from LLM plain-text response.
- * Layer 1: XML tags, Layer 2: markdown code fences, Layer 3: bare JSON.
- * Returns null if all layers fail (caller falls back to V1 regex parseVerdict).
+ * Three-layer JSON extraction with bounded, candidate-free failure diagnostics.
+ * A schema-invalid candidate takes precedence over malformed candidates because
+ * it is the most semantically advanced failure reached by the cascade.
  */
-export function extractStructuredVerdict(content) {
-    // Layer 1 — XML tags (primary)
+export function extractStructuredVerdictDetailed(content) {
+    if (content.trim().length === 0)
+        return { ok: false, cause: 'empty-output', attempts: [] };
+    const attempts = [];
+    const tryCandidate = (layer, candidate) => {
+        const result = tryStructuredVerdictCandidate(layer, candidate);
+        if (result.ok)
+            return result.verdict;
+        attempts.push(result.attempt);
+        return null;
+    };
     const xmlMatch = content.match(/<shield_verdict>([\s\S]*?)<\/shield_verdict>/);
     if (xmlMatch) {
-        try {
-            const parsed = JSON.parse(xmlMatch[1]);
-            const result = ShieldStructuredVerdictSchema.safeParse(parsed);
-            if (result.success)
-                return result.data;
-        }
-        catch {
-            // Move to next layer
-        }
+        const verdict = tryCandidate('xml', xmlMatch[1]);
+        if (verdict)
+            return { ok: true, verdict, layer: 'xml' };
     }
-    // Layer 2 — Markdown code fences (fallback)
     const fenceMatch = content.match(/(?:```|~~~)(?:json)?\s*\n([\s\S]*?)\n\s*(?:```|~~~)/);
     if (fenceMatch) {
-        try {
-            const parsed = JSON.parse(fenceMatch[1]);
-            const result = ShieldStructuredVerdictSchema.safeParse(parsed);
-            if (result.success)
-                return result.data;
-        }
-        catch {
-            // Move to next layer
-        }
+        const verdict = tryCandidate('fence', fenceMatch[1]);
+        if (verdict)
+            return { ok: true, verdict, layer: 'fence' };
     }
-    // Layer 3 — Bare JSON (last resort, guarded by "findings" keyword)
     const firstBrace = content.indexOf('{');
     const lastBrace = content.lastIndexOf('}');
     if (firstBrace !== -1 && lastBrace > firstBrace && content.includes('"findings"')) {
-        try {
-            const parsed = JSON.parse(content.slice(firstBrace, lastBrace + 1));
-            const result = ShieldStructuredVerdictSchema.safeParse(parsed);
-            if (result.success)
-                return result.data;
-        }
-        catch {
-            // All layers exhausted
-        }
-    }
-    return null;
+        const verdict = tryCandidate('bare-json', content.slice(firstBrace, lastBrace + 1));
+        if (verdict)
+            return { ok: true, verdict, layer: 'bare-json' };
+    }
+    if (attempts.length === 0)
+        return { ok: false, cause: 'no-candidate', attempts };
+    const cause = attempts.some((attempt) => attempt.cause === 'schema-invalid')
+        ? 'schema-invalid'
+        : 'invalid-json';
+    return { ok: false, cause, attempts };
+}
+/**
+ * Compatibility wrapper for callers that only need the parsed verdict.
+ * Returns null when all XML, fenced, and bare-JSON layers fail.
+ */
+export function extractStructuredVerdict(content) {
+    const result = extractStructuredVerdictDetailed(content);
+    return result.ok ? result.verdict : null;
 }
 /**
  * Deterministic pass/fail based on findings.
@@ -268,6 +298,17 @@ export function formatVerdictForDisplay(verdict, pass) {
  * (callers on the pre-#1527 signature) so behavior is preserved.
  */
 const LEGACY_REVIEW_SOURCE_EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx'];
+/**
+ * Shared tail for every deterministic skip that drops the ENTIRE diff
+ * (mmnto-ai/totem#2466). Such a run is a NON-REVIEW, not a pass: no lane ran and
+ * nothing was examined, so it must not stamp `.reviewed-content-hash` and must not
+ * read as a clean review.
+ *
+ * Single-sourced deliberately — the three skip sites must never drift into
+ * describing the same guarantee three different ways. Voice matches the existing
+ * worktree-drift notices, which are the other "NOT stamped" surface.
+ */
+const NO_STAMP_NOTICE = 'Nothing was examined, so the reviewed-content-hash was NOT stamped — this run does not authorize a push.';
 /**
  * Refresh `<totemDir>/review-extensions.txt` if its contents do not match
  * the supplied extension set (or the file is missing). Closes the stale-
@@ -396,10 +437,14 @@ export async function writeReviewedContentHashValue(precomputedHash, cwd, totemD
  * survives commits, amends, and rebases. Only breaks when source files change.
  *
  * Now a thin compose of the pure computer + explicit writer (Prop 304 R2): it
- * hashes the CURRENT tree and stamps it. Retained at its original signature
- * for the trivial fast-path stamps (no-changes / all-non-code / filtered-empty
- * — none of which open a mid-run LLM window) and `recordShieldOverride`, where
- * there is no drift race to guard. The LLM review path does NOT use this — it
+ * hashes the CURRENT tree and stamps it. Retained at its original signature for
+ * the no-changes stamp (an empty diff opens no mid-run LLM window) and
+ * `recordShieldOverride`, where there is no drift race to guard.
+ *
+ * NO LONGER used by the deterministic skip paths (all-non-code / filtered-empty /
+ * all-generated). Those drop the entire diff without examining it, so they are
+ * non-reviews and must not stamp — see `NO_STAMP_NOTICE` (mmnto-ai/totem#2466).
+ * The LLM review path does NOT use this — it
  * captures the hash pre-fan and compare-and-stamps in `shieldCommand` /
  * `handleVerdictResult` so a mid-review edit can never be authorized.
  */
@@ -1083,11 +1128,14 @@ export async function shieldCommand(options) {
             changedFiles = generated.keptFiles;
             generatedArtifactSummary = buildGeneratedArtifactSection(generated.summaries);
             // All changed files were generated artifacts — nothing left to review.
-            // Deterministic PASS: the summary was already surfaced above (never a
-            // silent skip). The artifacts' correctness is a gate concern, not the LLM's.
+            // Not sending them to the LLM stays correct (their correctness is a gate
+            // concern, not the LLM's) but that does NOT extend to stamping the push
+            // gate on their behalf: this is the one skip path that can drop a TRACKED,
+            // HASHED source file, because `.gitattributes linguist-generated` can mark
+            // a `.ts` as generated. Stamping here would authorize code no reviewer saw
+            // (mmnto-ai/totem#2466).
             if (!diff.trim()) {
-                log.info(DISPLAY_TAG, 'Deterministic fast-path: all changed files are generated artifacts');
-                await writeReviewedContentHash(cwd, config.totemDir, configRoot, config.review.sourceExtensions);
+                log.warn(DISPLAY_TAG, `NON-REVIEW: every changed file is a generated artifact, so no lane ran. ${NO_STAMP_NOTICE}`);
                 return;
             }
         }
@@ -1095,9 +1143,8 @@ export async function shieldCommand(options) {
     // Stage 1: Classify files — fast-path for non-code-only diffs
     const classification = classifyChangedFiles(changedFiles);
     if (classification.allNonCode) {
-        log.info(DISPLAY_TAG, 'Deterministic fast-path: all changed files are non-code');
+        log.warn(DISPLAY_TAG, `NON-REVIEW: every changed file is non-code, so no lane ran. ${NO_STAMP_NOTICE}`);
         log.dim(DISPLAY_TAG, `Skipped: ${changedFiles.join(', ')}`);
-        await writeReviewedContentHash(cwd, config.totemDir, configRoot, config.review.sourceExtensions);
         return;
     }
     // Stage 2: Filter diff to code-only files for mixed diffs
@@ -1107,9 +1154,8 @@ export async function shieldCommand(options) {
         filteredDiff = await filterDiffByPatterns(diff, classification.nonCodeFiles);
         filteredFiles = classification.codeFiles;
         if (!filteredDiff.trim()) {
-            // After filtering, no code diff remains — fast-path PASS
-            log.info(DISPLAY_TAG, 'Deterministic fast-path: no code changes after filtering non-code files');
-            await writeReviewedContentHash(cwd, config.totemDir, configRoot, config.review.sourceExtensions);
+            // After filtering non-code files, no code diff remains — nothing was examined.
+            log.warn(DISPLAY_TAG, `NON-REVIEW: no code changes remain after filtering non-code files, so no lane ran. ${NO_STAMP_NOTICE}`);
             return;
         }
         log.dim(DISPLAY_TAG, `Filtered ${classification.nonCodeFiles.length} non-code file(s) from diff`);