@mmnto/cli 1.116.0 → 1.118.0

package/dist/commands/pre-push-gate-matrix.test.js

@@ -0,0 +1,135 @@
+/**
+ * Pre-push hook gate-mapped review invocation tests (mmnto-ai/totem#2473).
+ *
+ * The managed pre-push hook's strict arm consumes the gate-mapped review form:
+ * probe `review --help` for `--gate` support, invoke `review --gate` when
+ * present, fall back to the bare sensor form with a VISIBLE compat line when
+ * absent (the `--scope-to-diff` defensive-degrade precedent). Structural
+ * assertions cover every platform; the behavioral matrix executes the real
+ * generated hook under `sh` with a stub CLI and is POSIX-only (the stub is a
+ * shell script on PATH, which Windows CreateProcess cannot resolve — the
+ * ubuntu/macos CI legs carry this coverage, the string assertions carry win32).
+ *
+ * Byte-parity between this template and `tools/pre-push` is enforced by
+ * `tools-hook-parity.test.ts` — not duplicated here.
+ */
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { cleanTmpDir } from '../test-utils.js';
+import { buildPrePushHook } from './install-hooks.js';
+describe('buildPrePushHook — gate-mapped strict arm (structural, all platforms)', () => {
+    const hook = buildPrePushHook('pnpm dlx @mmnto/cli', 'standard');
+    it('probes review --help for --gate before invoking it', () => {
+        expect(hook).toContain(`if $TOTEM_CMD review --help 2>/dev/null | grep -q -- '--gate'; then`);
+    });
+    it('carries the gate-mapped invocation, the visible compat fallback, and the bare form — in that order', () => {
+        const gateIdx = hook.indexOf('$TOTEM_CMD review --gate || exit 1');
+        const compatIdx = hook.indexOf('Hook running review in compat mode');
+        const bareIdx = hook.indexOf('$TOTEM_CMD review || exit 1');
+        expect(gateIdx).toBeGreaterThan(-1);
+        expect(compatIdx).toBeGreaterThan(gateIdx);
+        expect(bareIdx).toBeGreaterThan(compatIdx);
+        // The compat disclosure is stderr-routed (a hook's stdout can be swallowed).
+        expect(hook).toMatch(/Hook running review in compat mode[^\n]*" >&2/);
+    });
+});
+// Behavioral coverage of the probe/fallback/blocking branches (string
+// assertions alone are satisfiable without the behavior). POSIX-only — see the
+// file doc comment; win32 carries the structural suite above (#2473).
+describe.skipIf(process.platform === 'win32')('pre-push gate matrix (POSIX behavior)', () => {
+    let tmpDir;
+    let repoDir;
+    let binDir;
+    let logPath;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'prepush-gate-'));
+        repoDir = path.join(tmpDir, 'repo');
+        binDir = path.join(tmpDir, 'stub-bin');
+        fs.mkdirSync(repoDir, { recursive: true });
+        fs.mkdirSync(binDir);
+        logPath = path.join(tmpDir, 'totem-invocations.log');
+        fs.writeFileSync(path.join(repoDir, 'pre-push'), buildPrePushHook('pnpm dlx @mmnto/cli'), {
+            mode: 0o755,
+        });
+    });
+    afterEach(() => {
+        cleanTmpDir(tmpDir);
+    });
+    /**
+     * A stub `totem` on PATH: records every invocation, serves `review --help`
+     * from a canned help text, and exits per-branch with the configured codes.
+     * The bare repo dir skips every earlier hook gate (no manifest, no compiled
+     * rules, no lockfile, no package.json), so the strict arm under
+     * CLAUDE_CODE_AGENT=1 is the only live block.
+     */
+    function writeStub(params) {
+        const stub = `#!/bin/sh
+printf '%s\\n' "$*" >> "${logPath}"
+if [ "$1" = "doctor" ]; then exit 0; fi
+if [ "$1" = "review" ] && [ "$2" = "--help" ]; then
+  cat <<'TOTEM_STUB_HELP'
+${params.helpText}
+TOTEM_STUB_HELP
+  exit ${params.helpExit}
+fi
+if [ "$1" = "review" ]; then exit ${params.reviewExit}; fi
+exit 0
+`;
+        fs.writeFileSync(path.join(binDir, 'totem'), stub, { mode: 0o755 });
+    }
+    function runHook() {
+        const result = spawnSync('sh', ['./pre-push'], {
+            cwd: repoDir,
+            env: {
+                ...process.env,
+                PATH: `${binDir}:${process.env.PATH ?? ''}`,
+                CLAUDE_CODE_AGENT: '1',
+            },
+            encoding: 'utf-8',
+        });
+        return { status: result.status, stderr: result.stderr ?? '' };
+    }
+    const invocations = () => fs.existsSync(logPath) ? fs.readFileSync(logPath, 'utf-8').trim().split('\n') : [];
+    it('supported --gate: invokes the gate-mapped form and passes', () => {
+        writeStub({
+            helpText: 'Usage: totem review\n  --gate  declared mapping',
+            helpExit: 0,
+            reviewExit: 0,
+        });
+        const result = runHook();
+        expect(result.status).toBe(0);
+        expect(invocations()).toContain('review --gate');
+        expect(invocations()).toContain('doctor --strict');
+        expect(result.stderr).not.toContain('compat mode');
+    });
+    it('unsupported CLI: falls back to the bare form with a VISIBLE compat line', () => {
+        writeStub({
+            helpText: 'Usage: totem review\n  --covariate  transport',
+            helpExit: 0,
+            reviewExit: 0,
+        });
+        const result = runHook();
+        expect(result.status).toBe(0);
+        expect(invocations()).toContain('review');
+        expect(invocations()).not.toContain('review --gate');
+        expect(result.stderr).toContain('compat mode');
+    });
+    it('probe failure (help errors, no output): falls back to the bare form', () => {
+        writeStub({ helpText: '', helpExit: 1, reviewExit: 0 });
+        const result = runHook();
+        expect(result.status).toBe(0);
+        expect(invocations()).toContain('review');
+        expect(invocations()).not.toContain('review --gate');
+        expect(result.stderr).toContain('compat mode');
+    });
+    it('hard failure under --gate blocks the push (any nonzero — the unknown-disposition fail-closed exit rides this same arm)', () => {
+        writeStub({ helpText: '  --gate', helpExit: 0, reviewExit: 3 });
+        const result = runHook();
+        expect(result.status).toBe(1);
+        expect(invocations()).toContain('review --gate');
+    });
+});
+//# sourceMappingURL=pre-push-gate-matrix.test.js.map

package/dist/commands/pre-push-gate-matrix.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-push-gate-matrix.test.js","sourceRoot":"","sources":["../../src/commands/pre-push-gate-matrix.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACrF,MAAM,IAAI,GAAG,gBAAgB,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IAEjE,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qEAAqE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,GAAG,EAAE;QAC5G,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,6EAA6E;QAC7E,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,sEAAsE;AACtE,+EAA+E;AAC/E,sEAAsE;AACtE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,uCAAuC,EAAE,GAAG,EAAE;IAC1F,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACjE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACrD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,EAAE;YACxF,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,SAAS,SAAS,CAAC,MAAkE;QACnF,MAAM,IAAI,GAAG;0BACS,OAAO;;;;EAI/B,MAAM,CAAC,QAAQ;;SAER,MAAM,CAAC,QAAQ;;oCAEY,MAAM,CAAC,UAAU;;CAEpD,CAAC;QACE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,SAAS,OAAO;QACd,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE;YAC7C,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,IAAI,EAAE,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE;gBAC3C,iBAAiB,EAAE,GAAG;aACvB;YACD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,EAAE,CACvB,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,SAAS,CAAC;YACR,QAAQ,EAAE,iDAAiD;YAC3D,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,SAAS,CAAC;YACR,QAAQ,EAAE,+CAA+C;YACzD,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wHAAwH,EAAE,GAAG,EAAE;QAChI,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/shield-admission.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Admission-evaluator unit tests (mmnto-ai/totem#2473).
+ *
+ * `evaluateAdmission` is the ONE closed evaluator behind the ruled admission
+ * phase: it receives the resolved full-scope diff and returns either the exact
+ * fan inputs (`admitted`) or the exact record inputs (`not-applicable` with a
+ * deterministic reason). These tests lock the identity semantics — two
+ * different diffs on one branch are two different observations, a policy
+ * change re-keys equal bytes, and the no-diff arm carries the REQUESTED
+ * selector (no global null identity) — plus the disposition→exit mapping's
+ * fail-closed unknown arm under `--gate`.
+ */
+export {};
+//# sourceMappingURL=shield-admission.test.d.ts.map

package/dist/commands/shield-admission.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-admission.test.d.ts","sourceRoot":"","sources":["../../src/commands/shield-admission.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/commands/shield-admission.test.js

@@ -0,0 +1,301 @@
+/**
+ * Admission-evaluator unit tests (mmnto-ai/totem#2473).
+ *
+ * `evaluateAdmission` is the ONE closed evaluator behind the ruled admission
+ * phase: it receives the resolved full-scope diff and returns either the exact
+ * fan inputs (`admitted`) or the exact record inputs (`not-applicable` with a
+ * deterministic reason). These tests lock the identity semantics — two
+ * different diffs on one branch are two different observations, a policy
+ * change re-keys equal bytes, and the no-diff arm carries the REQUESTED
+ * selector (no global null identity) — plus the disposition→exit mapping's
+ * fail-closed unknown arm under `--gate`.
+ */
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { NOT_APPLICABLE_REASONS } from '@mmnto/totem';
+import { cleanTmpDir } from '../test-utils.js';
+import { buildProjectionPolicy, evaluateAdmission, requestedSelectorForm, resolveNotApplicableExit, selectExecutionPayload, } from './shield.js';
+import { CLASSIFIER_POLICY_TABLES } from './shield-classify.js';
+const SHA_EMPTY = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';
+const TEST_CONFIG = {
+    totemDir: '.totem',
+    review: { sourceExtensions: ['.ts'] },
+};
+/** A minimal single-file diff section for `file`. */
+function diffFor(file) {
+    return [
+        `diff --git a/${file} b/${file}`,
+        'index 1111111..2222222 100644',
+        `--- a/${file}`,
+        `+++ b/${file}`,
+        '@@ -1 +1 @@',
+        '-old',
+        '+new',
+    ].join('\n');
+}
+function diffResultFor(files) {
+    return {
+        diff: files.map(diffFor).join('\n'),
+        changedFiles: files,
+        source: 'uncommitted',
+    };
+}
+describe('evaluateAdmission — the closed admission evaluator', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'shield-admission-'));
+    });
+    afterEach(() => {
+        cleanTmpDir(tmpDir);
+    });
+    async function evaluate(files, config = TEST_CONFIG) {
+        return evaluateAdmission({
+            diffResult: files === null ? null : diffResultFor(files),
+            requestedSelector: '(default-chain)',
+            cwd: tmpDir,
+            config,
+            quiet: true,
+        });
+    }
+    it('no-diff (legacy scope-less arm): records source none + the REQUESTED selector', async () => {
+        const outcome = await evaluate(null);
+        expect(outcome.status).toBe('not-applicable');
+        if (outcome.status !== 'not-applicable')
+            return;
+        expect(outcome.reason).toBe('no-diff');
+        expect(outcome.scope).toEqual({
+            source: 'none',
+            base: null,
+            head: null,
+            selectorForm: '(default-chain)',
+        });
+        expect(outcome.inputHash).toBe(SHA_EMPTY);
+        expect(outcome.skippedFileCount).toBe(0);
+    });
+    it('no-diff binds the RESOLVED empty scope from the discriminated resolver result (conformance note 1)', async () => {
+        const resolved = await evaluateAdmission({
+            diffResult: { empty: true, source: 'branch-vs-base', base: 'main' },
+            requestedSelector: '(default-chain)',
+            cwd: tmpDir,
+            config: TEST_CONFIG,
+            quiet: true,
+        });
+        if (resolved.status !== 'not-applicable')
+            throw new Error('expected not-applicable');
+        expect(resolved.scope).toEqual({
+            source: 'branch-vs-base',
+            base: 'main',
+            head: null,
+            selectorForm: '(default-chain)',
+        });
+        // The resolver's OWN selectorForm wins where it supplies one (explicit range).
+        const explicit = await evaluateAdmission({
+            diffResult: {
+                empty: true,
+                source: 'explicit-range',
+                base: 'main',
+                head: 'HEAD',
+                selectorForm: 'main..HEAD',
+            },
+            requestedSelector: '--diff main..HEAD',
+            cwd: tmpDir,
+            config: TEST_CONFIG,
+            quiet: true,
+        });
+        if (explicit.status !== 'not-applicable')
+            throw new Error('expected not-applicable');
+        expect(explicit.scope.selectorForm).toBe('main..HEAD');
+        expect(explicit.scope.source).toBe('explicit-range');
+        // Empty runs under different scopes never collapse: forced-branch,
+        // explicit-range, and an empty --staged run (same terminal branch fallback,
+        // different requested selector) are three distinct observations.
+        const staged = await evaluateAdmission({
+            diffResult: { empty: true, source: 'branch-vs-base', base: 'main' },
+            requestedSelector: '--staged',
+            cwd: tmpDir,
+            config: TEST_CONFIG,
+            quiet: true,
+        });
+        if (staged.status !== 'not-applicable')
+            throw new Error('expected not-applicable');
+        expect(staged.scope.selectorForm).toBe('--staged');
+        const scopes = [resolved.scope, explicit.scope, staged.scope].map((s) => JSON.stringify(s));
+        expect(new Set(scopes).size).toBe(3);
+    });
+    it('classifies each deterministic reason from the full scope', async () => {
+        const nonCode = await evaluate(['docs/plan.md', 'README.md']);
+        expect(nonCode.status === 'not-applicable' && nonCode.reason).toBe('all-non-code');
+        const generated = await evaluate(['pnpm-lock.yaml']);
+        expect(generated.status === 'not-applicable' && generated.reason).toBe('all-generated');
+        // filtered-empty: a code file in the LIST whose hunks are absent from the
+        // diff body (a mode-only change has this shape).
+        const filteredEmpty = await evaluateAdmission({
+            diffResult: {
+                diff: diffFor('docs/plan.md'),
+                changedFiles: ['docs/plan.md', 'src/index.ts'],
+                source: 'uncommitted',
+            },
+            requestedSelector: '(default-chain)',
+            cwd: tmpDir,
+            config: TEST_CONFIG,
+            quiet: true,
+        });
+        expect(filteredEmpty.status === 'not-applicable' && filteredEmpty.reason).toBe('filtered-empty');
+        const admitted = await evaluate(['docs/plan.md', 'src/index.ts']);
+        expect(admitted.status).toBe('admitted');
+        if (admitted.status !== 'admitted')
+            return;
+        expect(admitted.filteredFiles).toEqual(['src/index.ts']);
+    });
+    it('two different diffs on one branch are two different observations (inputHash)', async () => {
+        const a = await evaluate(['docs/a.md']);
+        const b = await evaluate(['docs/b.md']);
+        if (a.status !== 'not-applicable' || b.status !== 'not-applicable') {
+            throw new Error('both fixtures must be not-applicable');
+        }
+        expect(a.reason).toBe(b.reason);
+        expect(a.scope).toEqual(b.scope);
+        expect(a.inputHash).not.toBe(b.inputHash);
+    });
+    it('a policy change re-keys equal bytes (projectionPolicyHash)', async () => {
+        const a = await evaluate(['docs/a.md']);
+        const b = await evaluate(['docs/a.md'], {
+            ...TEST_CONFIG,
+            review: { sourceExtensions: ['.ts', '.py'] },
+        });
+        if (a.status !== 'not-applicable' || b.status !== 'not-applicable') {
+            throw new Error('both fixtures must be not-applicable');
+        }
+        expect(a.inputHash).toBe(b.inputHash);
+        expect(a.projectionPolicyHash).not.toBe(b.projectionPolicyHash);
+    });
+    it('a .gitattributes change re-keys equal bytes (generated globs are policy)', async () => {
+        const before = await evaluate(['docs/a.md']);
+        fs.writeFileSync(path.join(tmpDir, '.gitattributes'), 'src/gen.ts linguist-generated\n');
+        const after = await evaluate(['docs/a.md']);
+        if (before.status !== 'not-applicable' || after.status !== 'not-applicable') {
+            throw new Error('both fixtures must be not-applicable');
+        }
+        expect(after.projectionPolicyHash).not.toBe(before.projectionPolicyHash);
+    });
+});
+/**
+ * PINNED classifier-table digest + entry count (CR on #2641): a live-vs-live
+ * recompute moves with any edit and can never observe the re-key property the
+ * mechanical binding exists for. Editing ANY classifier table fails here and
+ * states the new address key — update BOTH literals in the SAME commit as the
+ * table edit; that update IS the re-key signal made reviewable.
+ */
+const EXPECTED_TABLES_DIGEST = '7641cc478a33';
+const EXPECTED_TABLES_SIZE = 80;
+describe('buildProjectionPolicy — classifier tables bound mechanically (leg MATERIAL 2)', () => {
+    it('classifierId embeds the PINNED digest of the exported classifier tables — a table edit fails here with the new key', async () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'shield-policy-'));
+        try {
+            const policy = await buildProjectionPolicy(TEST_CONFIG, tmpDir);
+            // The pin makes the re-key observable; the cross-check proves the pin is
+            // the digest of the LIVE constant (wiring), so the two cannot drift apart.
+            expect(policy.classifierId).toBe(`classifyChangedFiles@1:${EXPECTED_TABLES_DIGEST}`);
+            expect(createHash('sha256')
+                .update(JSON.stringify(CLASSIFIER_POLICY_TABLES), 'utf-8')
+                .digest('hex')
+                .slice(0, 12)).toBe(EXPECTED_TABLES_DIGEST);
+            // Exact size — a deleted table fails here, never a range check.
+            expect(CLASSIFIER_POLICY_TABLES.length).toBe(EXPECTED_TABLES_SIZE);
+            expect([...CLASSIFIER_POLICY_TABLES]).toEqual([...CLASSIFIER_POLICY_TABLES].sort());
+        }
+        finally {
+            cleanTmpDir(tmpDir);
+        }
+    });
+});
+describe('selectExecutionPayload — payload selection never changes admission (conformance note 3)', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'shield-selection-'));
+    });
+    afterEach(() => {
+        cleanTmpDir(tmpDir);
+    });
+    async function admitted() {
+        const outcome = await evaluateAdmission({
+            diffResult: diffResultFor(['src/full-a.ts', 'src/full-b.ts']),
+            requestedSelector: '(default-chain)',
+            cwd: tmpDir,
+            config: TEST_CONFIG,
+            quiet: true,
+        });
+        if (outcome.status !== 'admitted')
+            throw new Error('fixture must admit');
+        return outcome;
+    }
+    it('ineligible incremental → the admitted full-scope payload, un-narrowed', async () => {
+        const selection = await selectExecutionPayload(await admitted(), { eligible: false, reason: 'multi-lane fan requires full diff scope' }, tmpDir, true);
+        expect(selection.narrowed).toBe(false);
+        expect(selection.deltaFallbackReason).toBeUndefined();
+        expect(selection.payload.filteredFiles).toEqual(['src/full-a.ts', 'src/full-b.ts']);
+    });
+    it('a reviewable delta narrows the execution payload', async () => {
+        const selection = await selectExecutionPayload(await admitted(), {
+            eligible: true,
+            deltaDiff: diffFor('src/full-a.ts'),
+            changedFiles: ['src/full-a.ts'],
+            linesChanged: 2,
+        }, tmpDir, true);
+        expect(selection.narrowed).toBe(true);
+        expect(selection.payload.filteredFiles).toEqual(['src/full-a.ts']);
+    });
+    it('a non-reviewable delta falls back to the full-scope payload — never a demotion to skip', async () => {
+        const selection = await selectExecutionPayload(await admitted(), {
+            eligible: true,
+            deltaDiff: diffFor('docs/notes.md'),
+            changedFiles: ['docs/notes.md'],
+            linesChanged: 2,
+        }, tmpDir, true);
+        expect(selection.narrowed).toBe(false);
+        expect(selection.deltaFallbackReason).toBe('all-non-code');
+        expect(selection.payload.filteredFiles).toEqual(['src/full-a.ts', 'src/full-b.ts']);
+    });
+});
+describe('requestedSelectorForm', () => {
+    const form = (options) => requestedSelectorForm(options);
+    it('records the requested selector expression per flag shape', () => {
+        expect(form({ diff: 'main..HEAD' })).toBe('--diff main..HEAD');
+        expect(form({ staged: true })).toBe('--staged');
+        expect(form({ base: 'develop' })).toBe('--branch --base develop');
+        expect(form({ branch: true })).toBe('--branch');
+        expect(form({})).toBe('(default-chain)');
+    });
+});
+describe('resolveNotApplicableExit — declared mapping, fail-closed unknown under --gate', () => {
+    class FakeGateError extends Error {
+        code;
+        hint;
+        constructor(code, message, hint) {
+            super(message);
+            this.code = code;
+            this.hint = hint;
+        }
+    }
+    it('every KNOWN reason maps to exit 0 under both bare and --gate (the ruled no-nonzero-by-default shape)', () => {
+        // Iterate the core's OWN closed reason set (CR on #2641, strengthened
+        // beyond the suggested typed literal — a subset would still typecheck):
+        // a NEW union member is exercised automatically and would fail CLOSED
+        // under --gate right here, forcing the mapping switch to grow with the
+        // union in the same change.
+        const known = NOT_APPLICABLE_REASONS;
+        expect(known).toHaveLength(4);
+        for (const reason of known) {
+            expect(resolveNotApplicableExit(reason, false, FakeGateError)).toBe(0);
+            expect(resolveNotApplicableExit(reason, true, FakeGateError)).toBe(0);
+        }
+    });
+    it('an UNKNOWN disposition fails CLOSED under --gate and stays sensor-0 bare', () => {
+        expect(() => resolveNotApplicableExit('mystery-disposition', true, FakeGateError)).toThrow(/unknown admission disposition/);
+        expect(resolveNotApplicableExit('mystery-disposition', false, FakeGateError)).toBe(0);
+    });
+});
+//# sourceMappingURL=shield-admission.test.js.map

package/dist/commands/shield-admission.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-admission.test.js","sourceRoot":"","sources":["../../src/commands/shield-admission.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GAEvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAErF,MAAM,WAAW,GAAG;IAClB,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE;CACZ,CAAC;AAE5B,qDAAqD;AACrD,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO;QACL,gBAAgB,IAAI,MAAM,IAAI,EAAE;QAChC,+BAA+B;QAC/B,SAAS,IAAI,EAAE;QACf,SAAS,IAAI,EAAE;QACf,aAAa;QACb,MAAM;QACN,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAe;IACpC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,aAAsB;KAC/B,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,QAAQ,CAAC,KAAsB,EAAE,SAAsB,WAAW;QAC/E,OAAO,iBAAiB,CAAC;YACvB,UAAU,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;YACxD,iBAAiB,EAAE,iBAAiB;YACpC,GAAG,EAAE,MAAM;YACX,MAAM;YACN,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB;YAAE,OAAO;QAChD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,iBAAiB;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;YACvC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;YACnE,iBAAiB,EAAE,iBAAiB;YACpC,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACrF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,iBAAiB;SAChC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;YACvC,UAAU,EAAE;gBACV,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,MAAM;gBACZ,YAAY,EAAE,YAAY;aAC3B;YACD,iBAAiB,EAAE,mBAAmB;YACtC,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACrF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAErD,mEAAmE;QACnE,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;YACnE,iBAAiB,EAAE,UAAU;YAC7B,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACnF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEnF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAExF,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC;YAC5C,UAAU,EAAE;gBACV,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC;gBAC7B,YAAY,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;gBAC9C,MAAM,EAAE,aAAa;aACtB;YACD,iBAAiB,EAAE,iBAAiB;YACpC,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,gBAAgB,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5E,gBAAgB,CACjB,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO;QAC3C,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE;YACtC,GAAG,WAAW;YACd,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE;SACnB,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC7C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,iCAAiC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAC9C,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,QAAQ,CAAC,+EAA+E,EAAE,GAAG,EAAE;IAC7F,EAAE,CAAC,oHAAoH,EAAE,KAAK,IAAI,EAAE;QAClI,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAChE,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,0BAA0B,sBAAsB,EAAE,CAAC,CAAC;YACrF,MAAM,CACJ,UAAU,CAAC,QAAQ,CAAC;iBACjB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;iBACzD,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAChB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAC/B,gEAAgE;YAChE,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACnE,MAAM,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yFAAyF,EAAE,GAAG,EAAE;IACvG,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,QAAQ;QACrB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,UAAU,EAAE,aAAa,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;YAC7D,iBAAiB,EAAE,iBAAiB;YACpC,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC5C,MAAM,QAAQ,EAAE,EAChB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,EACtE,MAAM,EACN,IAAI,CACL,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,aAAa,EAAE,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC5C,MAAM,QAAQ,EAAE,EAChB;YACE,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC;YACnC,YAAY,EAAE,CAAC,eAAe,CAAC;YAC/B,YAAY,EAAE,CAAC;SAChB,EACD,MAAM,EACN,IAAI,CACL,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC5C,MAAM,QAAQ,EAAE,EAChB;YACE,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC;YACnC,YAAY,EAAE,CAAC,eAAe,CAAC;YAC/B,YAAY,EAAE,CAAC;SAChB,EACD,MAAM,EACN,IAAI,CACL,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,IAAI,GAAG,CAAC,OAA+B,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAwB,CAAC,CAAC;IAElG,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+EAA+E,EAAE,GAAG,EAAE;IAC7F,MAAM,aAAc,SAAQ,KAAK;QAEtB;QAEA;QAHT,YACS,IAAqB,EAC5B,OAAe,EACR,IAAY;YAEnB,KAAK,CAAC,OAAO,CAAC,CAAC;YAJR,SAAI,GAAJ,IAAI,CAAiB;YAErB,SAAI,GAAJ,IAAI,CAAQ;QAGrB,CAAC;KACF;IAED,EAAE,CAAC,sGAAsG,EAAE,GAAG,EAAE;QAC9G,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,4BAA4B;QAC5B,MAAM,KAAK,GAAmC,sBAAsB,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,qBAAqB,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CACxF,+BAA+B,CAChC,CAAC;QACF,MAAM,CAAC,wBAAwB,CAAC,qBAAqB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/shield-classify.d.ts

@@ -5,6 +5,16 @@ export interface ClassificationResult {
     allNonCode: boolean;
     allCode: boolean;
 }
+/**
+ * Canonical, namespaced flattening of EVERY classification table above — the
+ * classifier's entire behavioral policy surface. Exported so the #2473
+ * admission `projectionPolicyHash` binds the actual tables MECHANICALLY
+ * (falsification-leg MATERIAL 2 on the #2473 round): editing any set re-keys
+ * every admission address without anyone remembering to bump a version
+ * string. Namespace prefixes keep the flattening collision-free; the sort
+ * makes the digest deterministic.
+ */
+export declare const CLASSIFIER_POLICY_TABLES: readonly string[];
 export declare function classifyFile(filePath: string): FileClass;
 export declare function classifyChangedFiles(changedFiles: string[]): ClassificationResult;
 //# sourceMappingURL=shield-classify.d.ts.map

package/dist/commands/shield-classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield-classify.d.ts","sourceRoot":"","sources":["../../src/commands/shield-classify.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC;AAE5C,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AA8GD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAsBxD;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAgBjF"}
+{"version":3,"file":"shield-classify.d.ts","sourceRoot":"","sources":["../../src/commands/shield-classify.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC;AAE5C,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AA+GD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAM9C,CAAC;AAIT,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAsBxD;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAgBjF"}

package/dist/commands/shield-classify.js

@@ -89,14 +89,32 @@ const NON_CODE_FILENAMES = new Set([
     '.eslintignore',
 ]);
 // ─── Compound extension check ───────────────────────
+/** Compound suffixes `path.extname` cannot see (it returns only the last segment). */
+const COMPOUND_NON_CODE_SUFFIXES = ['.d.ts.map'];
 /**
  * Check for compound extensions like `.d.ts.map` that path.extname
  * won't catch (it only returns `.map`).
  */
 function hasCompoundNonCodeExtension(filePath) {
     const base = path.basename(filePath);
-    return base.endsWith('.d.ts.map');
+    return COMPOUND_NON_CODE_SUFFIXES.some((suffix) => base.endsWith(suffix));
 }
+/**
+ * Canonical, namespaced flattening of EVERY classification table above — the
+ * classifier's entire behavioral policy surface. Exported so the #2473
+ * admission `projectionPolicyHash` binds the actual tables MECHANICALLY
+ * (falsification-leg MATERIAL 2 on the #2473 round): editing any set re-keys
+ * every admission address without anyone remembering to bump a version
+ * string. Namespace prefixes keep the flattening collision-free; the sort
+ * makes the digest deterministic.
+ */
+export const CLASSIFIER_POLICY_TABLES = [
+    ...[...CODE_EXTENSIONS].map((ext) => `code-ext:${ext}`),
+    ...[...NON_CODE_EXTENSIONS].map((ext) => `non-code-ext:${ext}`),
+    ...[...CODE_FILENAMES].map((name) => `code-name:${name}`),
+    ...[...NON_CODE_FILENAMES].map((name) => `non-code-name:${name}`),
+    ...COMPOUND_NON_CODE_SUFFIXES.map((suffix) => `compound-non-code:${suffix}`),
+].sort();
 // ─── Public API ─────────────────────────────────────
 export function classifyFile(filePath) {
     const basename = path.basename(filePath);

package/dist/commands/shield-classify.js.map

@@ -1 +1 @@
-{"version":3,"file":"shield-classify.js","sourceRoot":"","sources":["../../src/commands/shield-classify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,wDAAwD;AAExD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IACtC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,KAAK;IACL,IAAI;IACJ,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC1C,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,cAAc;CACf,CAAC,CAAC;AAEH,uDAAuD;AAEvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,YAAY;IACZ,UAAU;IACV,UAAU;IACV,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACzC,SAAS;IACT,WAAW;IACX,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,eAAe;CAChB,CAAC,CAAC;AAEH,uDAAuD;AAEvD;;;GAGG;AACH,SAAS,2BAA2B,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,uDAAuD;AAEvD,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEzC,2DAA2D;IAC3D,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACxD,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAEhD,qDAAqD;IACrD,IAAI,2BAA2B,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IAE7D,4BAA4B;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,2DAA2D;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAE5C,6CAA6C;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAsB;IACzD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAErE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"shield-classify.js","sourceRoot":"","sources":["../../src/commands/shield-classify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,wDAAwD;AAExD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IACtC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,KAAK;IACL,IAAI;IACJ,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC1C,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,cAAc;CACf,CAAC,CAAC;AAEH,uDAAuD;AAEvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,YAAY;IACZ,UAAU;IACV,UAAU;IACV,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACzC,SAAS;IACT,WAAW;IACX,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,eAAe;CAChB,CAAC,CAAC;AAEH,uDAAuD;AAEvD,sFAAsF;AACtF,MAAM,0BAA0B,GAAsB,CAAC,WAAW,CAAC,CAAC;AAEpE;;;GAGG;AACH,SAAS,2BAA2B,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,GAAG,EAAE,CAAC;IACvD,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAC/D,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC;IACzD,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACjE,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,MAAM,EAAE,CAAC;CAC7E,CAAC,IAAI,EAAE,CAAC;AAET,uDAAuD;AAEvD,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEzC,2DAA2D;IAC3D,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACxD,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAEhD,qDAAqD;IACrD,IAAI,2BAA2B,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IAE7D,4BAA4B;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,2DAA2D;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAE5C,6CAA6C;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAsB;IACzD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAErE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC1D,CAAC"}

package/dist/commands/shield-covariate.test.js

@@ -77,6 +77,9 @@ describe('shieldCommand --covariate short-circuit (rev-6 item 7)', () => {
         expect(fs.existsSync(path.join(tmpDir, '.totem', 'cache', '.reviewed-content-hash'))).toBe(false);
         // No verdict artifacts were written (no fan ran).
         expect(fs.existsSync(path.join(tmpDir, '.totem', 'artifacts', 'verdicts'))).toBe(false);
+        // No admission records either (mmnto-ai/totem#2473): the admission-aware
+        // resolution is read-only — exact-identity lookup, never a write.
+        expect(fs.existsSync(path.join(tmpDir, '.totem', 'artifacts', 'admissions'))).toBe(false);
         // No pre-push hook file was created.
         expect(fs.existsSync(path.join(tmpDir, '.git', 'hooks', 'pre-push'))).toBe(false);
     });

package/dist/commands/shield-covariate.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"shield-covariate.test.js","sourceRoot":"","sources":["../../src/commands/shield-covariate.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAIzE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAgB,EAAiB,EAAE,GAAE,CAAC,CAAC,CAAC;AACnF,MAAM,qBAAqB,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAW,EAAE,CAAC,KAAK,CAAC,CAAC;AAC7E,MAAM,mBAAmB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAEvE,MAAM,WAAW,GAAG;IAClB,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE;CACZ,CAAC;AAE5B,kFAAkF;AAClF,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,EAAiD,CAAC;IACrF,OAAO,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,qFAAqF;AACrF,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuC,CAAC;IAC3E,OAAO,EAAE,GAAG,MAAM,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,0FAA0F;AAC1F,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAgC,CAAC;IACpE,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;QAChB,iBAAiB,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC;QACrE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC;KAC3C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,uFAAuF;AACvF,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC5C,MAAM,MAAM,GAAG,MAAM,cAAc,EAA8B,CAAC;IAClE,OAAO,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACjD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtD,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAC/B,qBAAqB,CAAC,SAAS,EAAE,CAAC;QAClC,mBAAmB,CAAC,SAAS,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,sFAAsF;QACtF,MAAM,MAAM,CACV,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAyC,CAAC,CAC1E,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAE3B,oFAAoF;QACpF,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACrD,4EAA4E;QAC5E,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAClD,+EAA+E;QAC/E,MAAM,CAAC,mBAAmB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAErD,sDAAsD;QACtD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,CACxF,KAAK,CACN,CAAC;QACF,kDAAkD;QAClD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxF,qCAAqC;QACrC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"shield-covariate.test.js","sourceRoot":"","sources":["../../src/commands/shield-covariate.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAIzE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAgB,EAAiB,EAAE,GAAE,CAAC,CAAC,CAAC;AACnF,MAAM,qBAAqB,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAW,EAAE,CAAC,KAAK,CAAC,CAAC;AAC7E,MAAM,mBAAmB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAEvE,MAAM,WAAW,GAAG;IAClB,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,KAAK,CAAC,EAAE;CACZ,CAAC;AAE5B,kFAAkF;AAClF,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,EAAiD,CAAC;IACrF,OAAO,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,qFAAqF;AACrF,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuC,CAAC;IAC3E,OAAO,EAAE,GAAG,MAAM,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,0FAA0F;AAC1F,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAgC,CAAC;IACpE,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;QAChB,iBAAiB,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC;QACrE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC;KAC3C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,uFAAuF;AACvF,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC5C,MAAM,MAAM,GAAG,MAAM,cAAc,EAA8B,CAAC;IAClE,OAAO,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACjD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtD,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAC/B,qBAAqB,CAAC,SAAS,EAAE,CAAC;QAClC,mBAAmB,CAAC,SAAS,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,sFAAsF;QACtF,MAAM,MAAM,CACV,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAyC,CAAC,CAC1E,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAE3B,oFAAoF;QACpF,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACrD,4EAA4E;QAC5E,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAClD,+EAA+E;QAC/E,MAAM,CAAC,mBAAmB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAErD,sDAAsD;QACtD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,CACxF,KAAK,CACN,CAAC;QACF,kDAAkD;QAClD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxF,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1F,qCAAqC;QACrC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/shield-estimate.js

@@ -51,11 +51,11 @@ export async function runEstimate(options, config, cwd, configRoot) {
     const { runCompiledRules } = await import('./run-compiled-rules.js');
     log.info(ESTIMATE_DISPLAY_TAG, 'Pre-flight prediction (deterministic, zero-LLM):');
     const diffResult = await getDiffForReview(options, config, cwd, ESTIMATE_DISPLAY_TAG);
-    if (!diffResult) {
-        // Distinct from the `totem review` no-diff branch: the LLM path
-        // stamps the push-gate content hash because an empty diff is a
-        // trivial pass; an estimate is a forecast and explicitly does NOT
-        // stamp the cache. (Q2 in `.totem/specs/1714.md`.)
+    if ('empty' in diffResult) {
+        // An estimate is a forecast and does not stamp the cache. (Since
+        // mmnto-ai/totem#2473 the LLM path's no-diff branch does not stamp
+        // either — it records a not-applicable admission; the estimator stays
+        // record-free, matching Q2 in `.totem/specs/1714.md`.)
         log.info(ESTIMATE_DISPLAY_TAG, 'No changes detected. Nothing to estimate.');
         return;
     }