@mmnto/cli 1.88.0 → 1.90.0

package/dist/commands/rule-author.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule-author.js","sourceRoot":"","sources":["../../src/commands/rule-author.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,kFAAkF;AAClF,4EAA4E;AAC5E,6EAA6E;AAC7E,uFAAuF;AAEvF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA2B;IACjE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,yBAAyB,CAAC;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAErD,OAAO,CAAC,GAAG,CACT,gBAAgB,MAAM,CAAC,OAAO,CAAC,MAAM,qBAAqB;QACxD,GAAG,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,SAAS,aAAa,CACvF,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CACV,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,uCAAuC;YACtF,+CAA+C,CAClD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,2FAA2F;QAC3F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"rule-author.js","sourceRoot":"","sources":["../../src/commands/rule-author.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,kFAAkF;AAClF,4EAA4E;AAC5E,6EAA6E;AAC7E,uFAAuF;AAEvF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAGvC;IACC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACzF,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAE5F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEjD,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,IAAI,aAAmF,CAAC;IACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACzD,IAAI,gBAAoC,CAAC;IACzC,IAAI,QAA4B,CAAC;IACjC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,gFAAgF;QAChF,2EAA2E;QAC3E,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,gBAAgB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,yBAAyB,CAAC;IACpE,IAAI,gBAAgB,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,iKAAiK,EACjK,kKAAkK,CACnK,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,GACxD,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC5C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC/E,uBAAuB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,aAAa,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CACT,yCAAyC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,GAAG;YACpE,eAAe,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAClG,CAAC;QACF,wEAAwE;QACxE,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,2BAA2B,GAAwB,IAAI,GAAG,EAAU,CAAC;QACzE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,QAAQ,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ;YACnC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU;SACtC,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACnF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YACjD,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,GACpE,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YAC/B,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;gBAClF,aAAa;gBACb,cAAc;gBACd,aAAa;aACd,CAAC,CAAC;YACH,2BAA2B,GAAG,yBAAyB,CAAC;gBACtD,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBAC1C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU;gBAC9C,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC;gBACtC,uBAAuB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;aACzF,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,0CAA0C,2BAA2B,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,GAAG;gBACjG,+DAA+D,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CACnH,CAAC;QACJ,CAAC;QACD,8EAA8E;QAC9E,2EAA2E;QAC3E,iFAAiF;QACjF,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,KAAK;YACL,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ;SACT,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CACT,+DAA+D,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,CAC5I,CAAC;QACF,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE;gBACrC,QAAQ;gBACR,aAAa;gBACb,2BAA2B;aAC5B,CAAC,CAAC;YACH,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,GAAG,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,mBAAmB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,uEAAuE;gBACvE,sEAAsE;gBACtE,IAAI,UAAU,KAAK,SAAS;oBAAE,MAAM,WAAW,CAAC;gBAChD,OAAO,CAAC,IAAI,CACV,qFAAqF,OAAO,CAAC,IAAI,MAAM,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAClL,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IACpE,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,QAAgB,EAAE,KAA6B;IAChF,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,mKAAmK;IACrK,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAI,GAAkC,EAAE,KAAK,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAI,CAA2C,EAAE,gBAAgB,CAAC;QAChF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,EAAE,GAAI,CAA6B,EAAE,EAAE,CAAC;YAC9C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA6D;IACrF,OAAO,CAAC,GAAG,CACT,gBAAgB,MAAM,CAAC,OAAO,CAAC,MAAM,qBAAqB;QACxD,GAAG,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,SAAS,aAAa,CACvF,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CACV,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,uCAAuC;YACtF,+CAA+C,CAClD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,2FAA2F;QAC3F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/commands/spine-authored-cert-corpus.d.ts

@@ -1,4 +1,5 @@
 import type { AuthoredControlsDeps, GroundTruthLabel, ResolvedPrDiff, SplitArtifact, Stage4VerifierDeps } from '@mmnto/totem';
+import type { FreezeBinding } from '../spine-freeze-proof.js';
 import type { CertifyingCorpus } from './spine-windtunnel.js';
 export interface BuildAuthoredCertifyingCorpusDeps {
     /** `.totem` dir holding `spine/authored-rules.yaml` + the authoring-ledger. */
@@ -23,6 +24,20 @@ export interface BuildAuthoredCertifyingCorpusDeps {
     now: string;
     /** Optional §4 differential-evaluator injection for `deriveAuthoredControls` (defaults to the real one). */
     authoredControlsDeps?: AuthoredControlsDeps;
+    /**
+     * R1: the PROVEN freeze binding for a content-addressed `expectedSplitRef`
+     * (constructed ONLY by `resolveProvenFreezeBinding` at the cert-run boundary —
+     * this builder is git-free and never proves). Absent on a legacy free-text run;
+     * absent on a content-addressed run ⇒ the intake's total partition fails loud.
+     */
+    freezeBinding?: FreezeBinding;
+    /**
+     * §5.2 leakage semantics (#2294 couple, option (a)): fixture PRs the git-holding
+     * run boundary PROVED strictly pre-window by ancestry to the artifact's
+     * cutBoundarySha (`verifyPreWindowFixturePrs`). Threaded to the intake gate and
+     * the §6 deriver; absent/empty ⇒ strict train-only, byte-unchanged.
+     */
+    verifiedPreWindowFixturePrs?: ReadonlySet<number>;
 }
 /**
  * Assemble an AUTHORED `CertifyingCorpus` from `.totem/spine/authored-rules.yaml`.

package/dist/commands/spine-authored-cert-corpus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine-authored-cert-corpus.d.ts","sourceRoot":"","sources":["../../src/commands/spine-authored-cert-corpus.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,oBAAoB,EAEpB,gBAAgB,EAEhB,cAAc,EACd,aAAa,EACb,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,WAAW,iCAAiC;IAChD,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IAKjB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,KAAK,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,wEAAwE;IACxE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,4GAA4G;IAC5G,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,iCAAiC,GACtC,OAAO,CAAC,gBAAgB,CAAC,CAqN3B"}
+{"version":3,"file":"spine-authored-cert-corpus.d.ts","sourceRoot":"","sources":["../../src/commands/spine-authored-cert-corpus.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,oBAAoB,EAEpB,gBAAgB,EAEhB,cAAc,EACd,aAAa,EACb,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,WAAW,iCAAiC;IAChD,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IAKjB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,KAAK,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,wEAAwE;IACxE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,4GAA4G;IAC5G,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,iCAAiC,GACtC,OAAO,CAAC,gBAAgB,CAAC,CAqO3B"}

package/dist/commands/spine-authored-cert-corpus.js

@@ -66,7 +66,20 @@ export async function buildAuthoredCertifyingCorpus(deps) {
     //    cover (non-empty-but-stale): step-0 empty → no-mint stale → step-3 verdict/binding (Q3 layered).
     //    The producer establishes eligibility/identity; NEVER construct AuthoredRuleRecord[] ad hoc or
     //    read YAML→record here.
-    const authorResult = runRuleAuthor(deps.totemDir, { judgedBy, verifyOnly: true });
+    //    R1: a content-addressed expectedSplitRef binds the run to a FROZEN artifact — the caller
+    //    resolves + PROVES the binding at the cert-run boundary (`resolveProvenFreezeBinding`) and
+    //    threads it here, or the intake's own content-ref gate voids the verifyOnly re-derive
+    //    (CR #2293 round 1: the cert re-derive ran bindingless). This builder stays git-free:
+    //    it CONSUMES a proven binding, never constructs one (the never-unverified-binding
+    //    invariant — proof lives with the boundary that has git).
+    const authorResult = runRuleAuthor(deps.totemDir, {
+        judgedBy,
+        verifyOnly: true,
+        ...(deps.freezeBinding !== undefined ? { freezeBinding: deps.freezeBinding } : {}),
+        ...(deps.verifiedPreWindowFixturePrs !== undefined
+            ? { verifiedPreWindowFixturePrs: deps.verifiedPreWindowFixturePrs }
+            : {}),
+    });
     // 2. rejected.length === 0 precondition: a partially-invalid authored file is broken
     //    cert input — never certify the eligible subset (fail loud, not a partial corpus).
     if (authorResult.rejected.length > 0) {
@@ -165,6 +178,9 @@ export async function buildAuthoredCertifyingCorpus(deps) {
         split: deps.split,
         provenanceByRule,
         ...(deps.authoredControlsDeps ? { deps: deps.authoredControlsDeps } : {}),
+        ...(deps.verifiedPreWindowFixturePrs !== undefined
+            ? { verifiedPreWindowFixturePrs: deps.verifiedPreWindowFixturePrs }
+            : {}),
     });
     return {
         rules,

package/dist/commands/spine-authored-cert-corpus.js.map

@@ -1 +1 @@
-{"version":3,"file":"spine-authored-cert-corpus.js","sourceRoot":"","sources":["../../src/commands/spine-authored-cert-corpus.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,qFAAqF;AACrF,gFAAgF;AAChF,qFAAqF;AACrF,oFAAoF;AACpF,6EAA6E;AAC7E,EAAE;AACF,iFAAiF;AACjF,qFAAqF;AACrF,iFAAiF;AA2CjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAAuC;IAEvC,MAAM,EACJ,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,GACX,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAErE,sFAAsF;IACtF,uFAAuF;IACvF,yFAAyF;IACzF,uFAAuF;IACvF,2FAA2F;IAC3F,MAAM,IAAI,GAAG,mBAAmB,CAAC;IAEjC,sFAAsF;IACtF,yFAAyF;IACzF,yFAAyF;IACzF,6FAA6F;IAC7F,6FAA6F;IAC7F,6FAA6F;IAC7F,4FAA4F;IAC5F,2FAA2F;IAC3F,oGAAoG;IACpG,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,+FAA+F,EAC/F,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAwC,CAAC;IACvE,KAAK,MAAM,KAAK,IAAI,WAAW;QAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAC1E,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,sDAAsD,SAAS,CAAC,IAAI,4BAA4B;YAC9F,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,uDAAuD,EAC5F,oHAAoH,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAE,CAAC;IAEpC,yFAAyF;IACzF,4FAA4F;IAC5F,gGAAgG;IAChG,mGAAmG;IACnG,mGAAmG;IACnG,sGAAsG;IACtG,mGAAmG;IACnG,4BAA4B;IAC5B,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAElF,qFAAqF;IACrF,uFAAuF;IACvF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC9E,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,yBAAyB,YAAY,CAAC,QAAQ,CAAC,MAAM,yCAAyC;YAC5F,kCAAkC,OAAO,EAAE,EAC7C,+FAA+F;YAC7F,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,8EAA8E,EAC9E,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,uFAAuF;IACvF,mFAAmF;IACnF,gFAAgF;IAChF,mEAAmE;IACnE,2FAA2F;IAC3F,uFAAuF;IACvF,qFAAqF;IACrF,0FAA0F;IAC1F,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,6DAA6D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;gBAC3F,iDAAiD,EACnD,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,+BAA+B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,+BAA+B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS;gBAC5G,oCAAoC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC;gBACrG,6CAA6C,EAC/C,8GAA8G,CAC/G,CAAC;QACJ,CAAC;QACD,4FAA4F;QAC5F,sFAAsF;QACtF,6FAA6F;QAC7F,0FAA0F;QAC1F,0FAA0F;QAC1F,IAAI,KAAK,CAAC,qBAAqB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,+BAA+B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB;gBACrE,IAAI,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,gDAAgD;gBAC9F,aAAa,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EACvF,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,wEAAwE;IACxE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,MAAM,eAAe,CACzC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,EACxE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CACvC,CAAC;IAEF,qFAAqF;IACrF,oFAAoF;IACpF,2DAA2D;IAC3D,MAAM,YAAY,GAAG,aAAa,CAAC,gBAAgB,CAAC,OAAO;SACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,kBAAkB,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC9B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,yBAAyB,YAAY,CAAC,MAAM,kDAAkD;YAC5F,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,2DAA2D,EAC9F,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,oFAAoF;IACpF,0FAA0F;IAC1F,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,8FAA8F;YAC5F,wBAAwB,EAC1B,wGAAwG,CACzG,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,0EAA0E;IAC1E,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,mFAAmF;QACnF,oFAAoF;QACpF,6EAA6E;QAC7E,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,+BAA+B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI;gBAClG,yFAAyF,EAC3F,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,kDAAkD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B;gBAClG,4DAA4D,EAC9D,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC;IAED,iFAAiF;IACjF,wFAAwF;IACxF,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC;QACpD,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,gBAAgB;QAChB,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gBAAgB;QAChB,gBAAgB;KACjB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"spine-authored-cert-corpus.js","sourceRoot":"","sources":["../../src/commands/spine-authored-cert-corpus.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,qFAAqF;AACrF,gFAAgF;AAChF,qFAAqF;AACrF,oFAAoF;AACpF,6EAA6E;AAC7E,EAAE;AACF,iFAAiF;AACjF,qFAAqF;AACrF,iFAAiF;AA0DjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAAuC;IAEvC,MAAM,EACJ,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,GACX,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAErE,sFAAsF;IACtF,uFAAuF;IACvF,yFAAyF;IACzF,uFAAuF;IACvF,2FAA2F;IAC3F,MAAM,IAAI,GAAG,mBAAmB,CAAC;IAEjC,sFAAsF;IACtF,yFAAyF;IACzF,yFAAyF;IACzF,6FAA6F;IAC7F,6FAA6F;IAC7F,6FAA6F;IAC7F,4FAA4F;IAC5F,2FAA2F;IAC3F,oGAAoG;IACpG,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,+FAA+F,EAC/F,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAwC,CAAC;IACvE,KAAK,MAAM,KAAK,IAAI,WAAW;QAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAC1E,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,sDAAsD,SAAS,CAAC,IAAI,4BAA4B;YAC9F,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,uDAAuD,EAC5F,oHAAoH,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAE,CAAC;IAEpC,yFAAyF;IACzF,4FAA4F;IAC5F,gGAAgG;IAChG,mGAAmG;IACnG,mGAAmG;IACnG,sGAAsG;IACtG,mGAAmG;IACnG,4BAA4B;IAC5B,8FAA8F;IAC9F,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,sFAAsF;IACtF,8DAA8D;IAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE;QAChD,QAAQ;QACR,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,qFAAqF;IACrF,uFAAuF;IACvF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC9E,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,yBAAyB,YAAY,CAAC,QAAQ,CAAC,MAAM,yCAAyC;YAC5F,kCAAkC,OAAO,EAAE,EAC7C,+FAA+F;YAC7F,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,8EAA8E,EAC9E,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,uFAAuF;IACvF,mFAAmF;IACnF,gFAAgF;IAChF,mEAAmE;IACnE,2FAA2F;IAC3F,uFAAuF;IACvF,qFAAqF;IACrF,0FAA0F;IAC1F,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,6DAA6D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;gBAC3F,iDAAiD,EACnD,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,+BAA+B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,+BAA+B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS;gBAC5G,oCAAoC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC;gBACrG,6CAA6C,EAC/C,8GAA8G,CAC/G,CAAC;QACJ,CAAC;QACD,4FAA4F;QAC5F,sFAAsF;QACtF,6FAA6F;QAC7F,0FAA0F;QAC1F,0FAA0F;QAC1F,IAAI,KAAK,CAAC,qBAAqB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,+BAA+B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB;gBACrE,IAAI,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,gDAAgD;gBAC9F,aAAa,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EACvF,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,wEAAwE;IACxE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,MAAM,eAAe,CACzC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,EACxE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CACvC,CAAC;IAEF,qFAAqF;IACrF,oFAAoF;IACpF,2DAA2D;IAC3D,MAAM,YAAY,GAAG,aAAa,CAAC,gBAAgB,CAAC,OAAO;SACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,kBAAkB,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC9B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,yBAAyB,YAAY,CAAC,MAAM,kDAAkD;YAC5F,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,2DAA2D,EAC9F,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,oFAAoF;IACpF,0FAA0F;IAC1F,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,8FAA8F;YAC5F,wBAAwB,EAC1B,wGAAwG,CACzG,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,0EAA0E;IAC1E,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,mFAAmF;QACnF,oFAAoF;QACpF,6EAA6E;QAC7E,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,+BAA+B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI;gBAClG,yFAAyF,EAC3F,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,kDAAkD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B;gBAClG,4DAA4D,EAC9D,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC;IAED,iFAAiF;IACjF,wFAAwF;IACxF,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC;QACpD,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,gBAAgB;QAChB,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gBAAgB;QAChB,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/commands/spine-authored-cert-corpus.test.js

@@ -4,8 +4,10 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { stringify } from 'yaml';
+import { CertCorpusSeedSchema, firingLabelId, scoreWindtunnel, WindtunnelLockSchema, } from '@mmnto/totem';
 import { runRuleAuthor } from '../authored-rule-intake.js';
 import { buildAuthoredCertifyingCorpus, } from './spine-authored-cert-corpus.js';
+import { materializeAuthored } from './spine-authored-materialize.js';
 import { assembleAuthoredCertifyingCorpus, resolveCertifyingCorpusProvider, } from './spine-cert-run-corpus.js';
 // ─── Fixtures (mirror the slice-2/3/4 + authored-controls tests) ──────────────
 const sha = (n) => String(n).padStart(40, '0');
@@ -242,9 +244,12 @@ describe('resolveCertifyingCorpusProvider — producerKind dispatch (D2 async si
     });
     /** A minimal lock cast — the resolver only reads producerKind / authored / integrity shas. */
     const lock = (overrides) => ({ controls: { integrity: {} }, ...overrides });
-    it('a mined lock (explicit or absent) resolves to a provider with no authored block', async () => {
-        await expect(resolveCertifyingCorpusProvider(lock({ producerKind: 'mined' }), inputs())).resolves.toBeTypeOf('function');
-        await expect(resolveCertifyingCorpusProvider(lock({}), inputs())).resolves.toBeTypeOf('function');
+    it('a mined lock (explicit or absent) resolves to a { provider, score } bundle', async () => {
+        for (const overrides of [{ producerKind: 'mined' }, {}]) {
+            const resolved = await resolveCertifyingCorpusProvider(lock(overrides), inputs());
+            expect(resolved.provider).toBeTypeOf('function');
+            expect(resolved.score).toBeTypeOf('function');
+        }
     });
     it('an authored lock WITHOUT an `authored` block fails loud (require-when-authored)', async () => {
         await expect(resolveCertifyingCorpusProvider(lock({ producerKind: 'authored' }), inputs())).rejects.toThrow(/run-input block/);
@@ -266,7 +271,9 @@ describe('resolveCertifyingCorpusProvider — producerKind dispatch (D2 async si
             authored: { expectedSplitRef: SPLIT_REF },
             controls: { integrity: { prDiffsSha, groundTruthSha } },
         });
-        const provider = await resolveCertifyingCorpusProvider(authoredLock, inputs({ authoredControlsDeps: diffDeps('differential-holds') }));
+        const { provider, score } = await resolveCertifyingCorpusProvider(authoredLock, inputs({ authoredControlsDeps: diffDeps('differential-holds') }));
+        // D4: the §8 single home also binds the producer-kind scorer alongside the provider.
+        expect(score).toBeTypeOf('function');
         const corpus = await provider(authoredLock);
         expect(corpus.authoredControls).toBeDefined();
         expect(corpus.authoredControls.positive).toHaveLength(1);
@@ -343,4 +350,433 @@ describe('assembleAuthoredCertifyingCorpus (D2.6 derive-path sibling)', () => {
         await expect(assembleAuthoredCertifyingCorpus(opts(), authoredLock)).rejects.toThrow(/pr-diffs\.json integrity/);
     });
 });
+// ─── 6. Slice D4 — the reachable flip: resolved.score(base) end-to-end ─────────
+//
+// The whole-path couple strategy reviews (ruling 2318Z, Q4 — 4 seams): (1) authored
+// corpus resolution (§8 single-home), (2) the no-mint verifyOnly gate FIRING, (3)
+// scoreAuthoredWindtunnel invocation (Q1 threading guard), (4) the Gate-2 emit
+// (verdict-inert, §1(k)-guarded). These rows drive a REAL resolve → real scorer
+// (never a mock) → real deriveGate2Eligibility, reusing the D1–D3 fixtures.
+describe('ADR-112 D4 — reachable flip: resolved.score(base) end-to-end', () => {
+    let gate1Dir;
+    beforeEach(() => {
+        gate1Dir = fs.mkdtempSync(path.join(os.tmpdir(), 'totem-d4-gate1-'));
+    });
+    afterEach(() => {
+        fs.rmSync(gate1Dir, { recursive: true, force: true });
+    });
+    const inputs = (extra = {}) => ({
+        gate1Dir,
+        stage4: stage4(),
+        now: NOW,
+        totemDir,
+        ...extra,
+    });
+    const lock = (overrides) => ({ controls: { integrity: {} }, ...overrides });
+    /** An authored lock bound to a substrate's integrity shas. */
+    const authoredLock = (prDiffsSha, groundTruthSha) => lock({
+        producerKind: 'authored',
+        authored: { expectedSplitRef: SPLIT_REF },
+        controls: { integrity: { prDiffsSha, groundTruthSha } },
+    });
+    /** A ScorerInput `base` (exposure floors 0 so a clean run reaches PASS). The authored
+     *  closure strips `positiveControlTargets` (Q1 guard); the mined closure keeps it. */
+    const baseScorerInput = (over) => ({
+        firings: [],
+        groundTruth: new Map(),
+        positiveControlTargets: [],
+        mintedRuleIds: [],
+        cullRateThreshold: 0.5,
+        exposureFloors: {
+            activeRulesEvaluated: 0,
+            filesTouchedInWindow: 0,
+            positiveControlsExercised: 0,
+        },
+        actualExposure: {
+            activeRulesEvaluated: 1,
+            filesTouchedInWindow: 5,
+            positiveControlsExercised: 1,
+        },
+        ...over,
+    });
+    const firing = (ruleId, pr, controlKind, matchedLine = 'gen();', filePath = 'src/a.ts') => ({
+        ruleId,
+        pr,
+        filePath,
+        matchedLine,
+        controlKind,
+        labelId: firingLabelId(ruleId, pr, filePath, matchedLine),
+    });
+    /** Resolve an authored run over a split with held-out prs, then read the minted ruleId
+     *  the real corpus derived (the Gate-2 join-back key). */
+    const resolveAuthored = async (split) => {
+        writeAuthoredYaml(totemDir);
+        const { prDiffsSha, groundTruthSha } = writeSubstrate(gate1Dir, { split });
+        const alock = authoredLock(prDiffsSha, groundTruthSha);
+        const resolved = await resolveCertifyingCorpusProvider(alock, inputs({ authoredControlsDeps: diffDeps('differential-holds') }));
+        const corpus = await resolved.provider(alock);
+        const ruleId = corpus.authoredControls.positive[0].targetRuleId;
+        return { resolved, ruleId };
+    };
+    it('(i) authored happy path: resolve → real scoreAuthoredWindtunnel → PASS + Gate-2 eligible', async () => {
+        const split = { ...SPLIT, trainPrs: [1], heldOutPrs: [2] };
+        const { resolved, ruleId } = await resolveAuthored(split);
+        const ctrl = firing(ruleId, 1, 'positive', 'ctrl();'); // train-side positive control
+        const heldCorpus = firing(ruleId, 2, 'corpus', 'gen();'); // held-out generalization
+        const scored = resolved.score(baseScorerInput({
+            firings: [ctrl, heldCorpus],
+            groundTruth: new Map([
+                [ctrl.labelId, 'TP'],
+                [heldCorpus.labelId, 'TP'],
+            ]),
+            mintedRuleIds: [ruleId],
+            positiveControlTargets: [{ pr: 1, targetRuleId: ruleId }],
+        }));
+        expect(scored.kind).toBe('authored');
+        if (scored.kind !== 'authored')
+            throw new Error('unreachable');
+        expect(scored.verdict.verdict).toBe('PASS');
+        // O3 metric: the held-out corpus firing counts; the train-side control does not.
+        expect(scored.verdict.heldOutActivationsByRule).toEqual({ [ruleId]: 1 });
+        // Gate-2: a non-disqualified window's survivor with heldOut>0 is eligible (§1(k) satisfied).
+        expect(scored.gate2.windowDisqualified).toBe(false);
+        expect(scored.gate2.eligibleRuleIds).toEqual([ruleId]);
+    });
+    it('(ii) no-mint gate FIRES: a would-be-minted rule ⇒ GATE_INVALID at resolve, scorer unreachable, ledger byte-unchanged', async () => {
+        writeAuthoredYaml(totemDir); // seeds YAML + ledger (rule → `unchanged` on re-read)
+        const { prDiffsSha, groundTruthSha } = writeSubstrate(gate1Dir);
+        const ledgerPath = path.join(totemDir, 'spine', 'authoring-ledger.ndjson');
+        const ledgerBefore = fs.readFileSync(ledgerPath, 'utf-8');
+        // agy's dynamic in-memory mutate: rewrite ONLY the YAML to add a SECOND (unledgered)
+        // rule — the cert re-derive would MINT it. Do NOT re-seed the ledger (no runRuleAuthor).
+        fs.writeFileSync(path.join(totemDir, 'spine', 'authored-rules.yaml'), stringify({
+            splitRef: SPLIT_REF,
+            authoredAfterSplit: true,
+            heldOutNonInspectionAttestation: true,
+            rules: [
+                authoredRuleInput(),
+                authoredRuleInput({ targetDefect: 'a SECOND distinct defect' }),
+            ],
+        }), 'utf-8');
+        // The gate throws during the resolver's EAGER build — before `score` is returned (a
+        // stronger guarantee than a scorer spy: the closure never exists to be called).
+        await expect(resolveCertifyingCorpusProvider(authoredLock(prDiffsSha, groundTruthSha), inputs({ authoredControlsDeps: diffDeps('differential-holds') }))).rejects.toThrow(/would be authored \(minted\/revised\)/);
+        // §8 no-mint: the cert re-derive is read-only — the gate fired before Pass-2 append.
+        expect(fs.readFileSync(ledgerPath, 'utf-8')).toBe(ledgerBefore);
+    });
+    it('(v) mined path regression: producerKind absent ⇒ kind mined, NO gate2 key, verdict byte-identical to scoreWindtunnel', async () => {
+        const resolved = await resolveCertifyingCorpusProvider(lock({}), inputs());
+        const ctrl = firing('mined-rule', 1, 'positive', 'ctrl();');
+        const base = baseScorerInput({
+            firings: [ctrl],
+            groundTruth: new Map([[ctrl.labelId, 'TP']]),
+            mintedRuleIds: ['mined-rule'],
+            positiveControlTargets: [{ pr: 1, targetRuleId: 'mined-rule' }],
+        });
+        const scored = resolved.score(base);
+        expect(scored.kind).toBe('mined');
+        // The mined bundle carries NO Gate-2 surface at all (not an empty one).
+        expect('gate2' in scored).toBe(false);
+        // Byte-identity: the mined closure is a pass-through to the real scoreWindtunnel.
+        expect(scored.verdict).toEqual(scoreWindtunnel(base));
+    });
+    it('(vi) cross-partition leakage guard: a train-only-activating rule → zero held-out → excluded from Gate-2 despite PASS', async () => {
+        const split = { ...SPLIT, trainPrs: [1], heldOutPrs: [2] };
+        // Structural guard: the partitions the metric keys off are disjoint (heldOut ∩ train = ∅).
+        expect(split.heldOutPrs.some((pr) => split.trainPrs.includes(pr))).toBe(false);
+        const { resolved, ruleId } = await resolveAuthored(split);
+        const ctrl = firing(ruleId, 1, 'positive', 'ctrl();'); // train-side ONLY — no held-out corpus firing
+        const scored = resolved.score(baseScorerInput({
+            firings: [ctrl],
+            groundTruth: new Map([[ctrl.labelId, 'TP']]),
+            mintedRuleIds: [ruleId],
+            positiveControlTargets: [{ pr: 1, targetRuleId: ruleId }],
+        }));
+        expect(scored.kind).toBe('authored');
+        if (scored.kind !== 'authored')
+            throw new Error('unreachable');
+        // Clean rare-defect window: the verdict PASSES…
+        expect(scored.verdict.verdict).toBe('PASS');
+        expect(scored.verdict.heldOutActivationsByRule).toEqual({ [ruleId]: 0 });
+        // …yet Gate-2 excludes the rule (survivor recorded, ineligible at zero held-out).
+        expect(scored.gate2.survivors).toEqual([
+            { ruleId, heldOutActivations: 0, gate2Eligible: false },
+        ]);
+        expect(scored.gate2.eligibleRuleIds).toEqual([]);
+    });
+    it('(vii) unlabeled-demotion partition: held-out UNLABELED corpus firing ⇒ HONEST-NEGATIVE, no FP, metric verdict-inert', async () => {
+        const split = { ...SPLIT, trainPrs: [1], heldOutPrs: [2] };
+        const { resolved, ruleId } = await resolveAuthored(split);
+        const ctrl = firing(ruleId, 1, 'positive', 'ctrl();'); // train-side, TP-labeled
+        const unlabeled = firing(ruleId, 2, 'corpus', 'gen();'); // held-out, NO ground-truth entry
+        const scored = resolved.score(baseScorerInput({
+            firings: [ctrl, unlabeled],
+            groundTruth: new Map([[ctrl.labelId, 'TP']]),
+            mintedRuleIds: [ruleId],
+            positiveControlTargets: [{ pr: 1, targetRuleId: ruleId }],
+        }));
+        expect(scored.kind).toBe('authored');
+        if (scored.kind !== 'authored')
+            throw new Error('unreachable');
+        // Clean demotion — needs adjudication, NOT a FAIL/FP.
+        expect(scored.verdict.verdict).toBe('HONEST-NEGATIVE');
+        expect(scored.verdict.needsAdjudication).toContain(unlabeled.labelId);
+        expect(scored.gate2.windowDisqualified).toBe(false);
+        // The O3 metric is label-independent (verdict-inert): the unlabeled held-out firing still counts.
+        expect(scored.verdict.heldOutActivationsByRule).toEqual({ [ruleId]: 1 });
+    });
+    it('(viii) §6 cull-unbroken: a fix-shaped differential ⇒ positive:[] + illegitimate non-emission ⇒ FAIL, never a mined PASS via empty positives (codex assertion #1)', async () => {
+        writeAuthoredYaml(totemDir);
+        const split = { ...SPLIT, trainPrs: [1], heldOutPrs: [2] };
+        const { prDiffsSha, groundTruthSha } = writeSubstrate(gate1Dir, { split });
+        const alock = authoredLock(prDiffsSha, groundTruthSha);
+        // fix-shaped: the §4 differential culls every fixture to an illegitimate non-emission —
+        // NOTHING reaches positive[]. resolveAuthored is not reusable here (it reads positive[0]).
+        const resolved = await resolveCertifyingCorpusProvider(alock, inputs({ authoredControlsDeps: diffDeps('fix-shaped') }));
+        const corpus = await resolved.provider(alock);
+        // The §6 cull holds end-to-end: a fix-shaped fixture lands in nonEmissions, never positive[].
+        expect(corpus.authoredControls.positive).toEqual([]);
+        expect(corpus.authoredControls.nonEmissions).toHaveLength(1);
+        expect(corpus.authoredControls.nonEmissions[0].class).toBe('illegitimate');
+        const ruleId = corpus.rules[0].lessonHash;
+        // The hazard codex assertion #1 guards: an empty positive control MUST NOT let the run
+        // degenerate to a mined PASS via positiveControlTargets:[] — the illegitimate non-emission
+        // FAILs the whole window. (Core-altitude sibling: windtunnel-scorer-authored.test.ts codex-1.)
+        const scored = resolved.score(baseScorerInput({
+            firings: [],
+            groundTruth: new Map(),
+            mintedRuleIds: [ruleId],
+            positiveControlTargets: [],
+        }));
+        expect(scored.kind).toBe('authored');
+        if (scored.kind !== 'authored')
+            throw new Error('unreachable');
+        // NOT a silent mined PASS — a structural, no-claim FAIL (precision null, never 0).
+        expect(scored.verdict.verdict).toBe('FAIL');
+        expect(scored.verdict.precision).toBeNull();
+        expect(scored.verdict.authoredControlGate.illegitimate).toBe(1);
+        expect(scored.verdict.authoredControlGate.effect).toBe('fail-illegitimate');
+        // Gate-2: illegitimate > 0 ⇒ window disqualified ⇒ no survivor eligible (Q4).
+        expect(scored.gate2.windowDisqualified).toBe(true);
+        expect(scored.gate2.eligibleRuleIds).toEqual([]);
+    });
+});
+// ─── 7. Slice D5 — the authored materialize/freeze seam (producer → consumer) ──
+//
+// `materializeAuthored` is the sibling authored producer: it FREEZES the window-wide
+// substrate + a `frozenAt` split + the `producerKind:'authored'` lock, gated by the
+// §5.1/§5.3 freeze preconditions. Git is injected so the producer is exercised without
+// a real clone (the mined materializer has no unit test at all). Row (i) closes the
+// producer→consumer loop: the PRODUCED lock+substrate drives a real authored resolve.
+describe('ADR-112 D5 — materializeAuthored (authored producer)', () => {
+    const AUTHORED_AT = '2026-06-15T12:00:00.000Z';
+    const FROZEN_AT = '2026-06-01T00:00:00.000Z'; // strictly BEFORE authoring (Q3 temporal)
+    let repoRoot;
+    let gate1Dir;
+    beforeEach(() => {
+        repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'totem-d5-repo-'));
+        gate1Dir = path.join(repoRoot, 'gate-1');
+    });
+    afterEach(() => {
+        fs.rmSync(repoRoot, { recursive: true, force: true });
+    });
+    /** Newest-first metas for PRs 2,1 → corpus [1,2] (all code-touching non-bot). */
+    const metas = () => [2, 1].map((pr) => ({
+        pr,
+        mergeCommit: sha(pr),
+        author: 'Dev <dev@example.com>',
+        isBotAuthor: false,
+        changedFiles: ['src/a.ts'],
+    }));
+    /** An authored seed: producerKind authored, cutIndex 1 ⇒ train [1] / held-out [2] (floor 0.5). */
+    const authoredSeed = (over = {}) => CertCorpusSeedSchema.parse({
+        producerKind: 'authored',
+        gate: 'gate-1',
+        canonicalPath: 'gate-1/windtunnel.lock.json',
+        repo: 'mmnto-ai/liquid-city',
+        phase: 'certifying',
+        selectionRule: {
+            state: 'merged',
+            predicate: 'code-touching non-bot',
+            window: { type: 'all' },
+            asOfCommit: sha(999),
+            codePathClassifier: { includeGlobs: ['**'], excludeGlobs: [] },
+        },
+        split: { cutIndex: 1, excludedPrs: [], frozenAt: FROZEN_AT },
+        controls: {
+            positiveRef: 'gate-1/controls/positive',
+            negativeRef: 'gate-1/controls/negative',
+            mechanism: 'git-hash-object',
+            positive: [], // authored controls are train-side (derived at run), NOT seed-designated
+            negative: [],
+        },
+        fpDefinition: { rubricRef: 'r', groundTruthRef: 'g', adjudicator: 'disposition-derived' },
+        cullRateThreshold: 0.1,
+        exposureDenominator: {
+            activeRulesEvaluated: { floor: 2 },
+            filesTouchedInWindow: { floor: 0 },
+            positiveControlsExercised: { floor: 0 },
+        },
+        ...over,
+    });
+    const ctx = (seed) => ({
+        seed,
+        lcDir: '/unused-git-injected',
+        repoRoot,
+        cwd: repoRoot,
+        totemDir,
+        outDir: gate1Dir,
+        resolveWithinRepo: (input) => path.resolve(repoRoot, input),
+        safeExec: (() => {
+            throw new Error('git must be injected');
+        }),
+    });
+    /** Injected git: canned metas + non-empty diffs + a fixed fixtureSha. No `now` — `frozenAt` is
+     *  the seed's recorded pre-authoring instant (real chronology), never a materialize clock. */
+    const gitDeps = (over = {}) => ({
+        enumerateMetas: () => metas(),
+        resolvePrDiff: (mergeCommit) => ({
+            baseSha: sha(500),
+            headSha: sha(600),
+            diff: `diff ${mergeCommit}\n+forbiddenCall()\n`,
+        }),
+        computeControlFixtureSha: () => sha(7),
+        ...over,
+    });
+    it('(i) produces a valid authored lock + window-wide substrate + frozenAt split', async () => {
+        writeAuthoredYaml(totemDir, {
+            rules: [authoredRuleInput({ authoredAt: AUTHORED_AT, positiveFixtures: [posFixture(1)] })],
+        });
+        await materializeAuthored(ctx(authoredSeed()), gitDeps());
+        // Lock: parses, producerKind authored, expectedSplitRef = the ledger's splitRef, no groundTruthSha.
+        const lockRaw = JSON.parse(fs.readFileSync(path.join(gate1Dir, 'windtunnel.lock.json'), 'utf-8'));
+        const lock = WindtunnelLockSchema.parse(lockRaw);
+        expect(lock.producerKind).toBe('authored');
+        expect(lock.authored).toEqual({ expectedSplitRef: SPLIT_REF });
+        expect(lock.controls.integrity.groundTruthSha).toBeUndefined(); // derive-labels stamps it
+        // Split: carries the mechanical frozenAt; train [1] / held-out [2].
+        const split = JSON.parse(fs.readFileSync(path.join(gate1Dir, 'split.json'), 'utf-8'));
+        expect(split.frozenAt).toBe(FROZEN_AT);
+        expect(split.trainPrs).toEqual([1]);
+        expect(split.heldOutPrs).toEqual([2]);
+        // pr-diffs: WINDOW-WIDE (train ∪ held-out = [1,2]), not held-out-only.
+        const prDiffs = JSON.parse(fs.readFileSync(path.join(gate1Dir, 'pr-diffs.json'), 'utf-8'));
+        expect(prDiffs.map((d) => d.pr)).toEqual([1, 2]);
+        // The train-side positive-control fixture diff was written for the integrity gate.
+        expect(fs.existsSync(path.join(repoRoot, 'gate-1/controls/positive/1.diff'))).toBe(true);
+    });
+    it('(i-consumer) the PRODUCED lock+substrate drives a real authored resolve (producer→consumer)', async () => {
+        writeAuthoredYaml(totemDir, {
+            rules: [authoredRuleInput({ authoredAt: AUTHORED_AT, positiveFixtures: [posFixture(1)] })],
+        });
+        await materializeAuthored(ctx(authoredSeed()), gitDeps());
+        // Simulate the `derive-labels` seal: write the answer key + stamp groundTruthSha onto the lock.
+        const gtJson = JSON.stringify({});
+        fs.writeFileSync(path.join(gate1Dir, 'ground-truth-labels.json'), gtJson, 'utf-8');
+        const groundTruthSha = createHash('sha256')
+            .update(gtJson.replace(/\r\n/g, '\n'), 'utf-8')
+            .digest('hex');
+        const lock = WindtunnelLockSchema.parse(JSON.parse(fs.readFileSync(path.join(gate1Dir, 'windtunnel.lock.json'), 'utf-8')));
+        const sealedLock = {
+            ...lock,
+            controls: {
+                ...lock.controls,
+                integrity: { ...lock.controls.integrity, groundTruthSha },
+            },
+        };
+        const { provider, score } = await resolveCertifyingCorpusProvider(sealedLock, {
+            gate1Dir,
+            stage4: stage4(),
+            now: NOW,
+            totemDir,
+            authoredControlsDeps: diffDeps('differential-holds'),
+        });
+        const corpus = await provider(sealedLock);
+        // The authored channel resolved from the PRODUCED substrate (fixture #1 is train-side positive).
+        expect(corpus.authoredControls).toBeDefined();
+        expect(corpus.authoredControls.positive).toHaveLength(1);
+        expect(score).toBeTypeOf('function');
+    });
+    it('(ii) temporal violation: seed frozenAt AFTER authoring ⇒ GATE_INVALID, nothing written', async () => {
+        // A real (undoctored) run: the seed's recorded frozenAt post-dates the rule's authoredAt, so
+        // the split was NOT frozen before authoring — a §5.1 leakage event the gate must reject.
+        writeAuthoredYaml(totemDir, {
+            rules: [authoredRuleInput({ authoredAt: AUTHORED_AT, positiveFixtures: [posFixture(1)] })],
+        });
+        const lateSeed = authoredSeed({
+            split: { cutIndex: 1, excludedPrs: [], frozenAt: '2026-06-20T00:00:00.000Z' },
+        });
+        await expect(materializeAuthored(ctx(lateSeed), gitDeps())).rejects.toThrow(/Q3 temporal/);
+        // Nothing written: the freeze gate throws BEFORE gate1Dir is created (CR — no partial write).
+        expect(fs.existsSync(gate1Dir)).toBe(false);
+    });
+    it('(vii) absent seed frozenAt ⇒ fail-loud (materialize never stamps its own clock)', async () => {
+        // The production-honesty guard (#2287 couple HOLD): with no recorded pre-authoring freeze
+        // instant, materialize MUST fail loud — never fall back to a materialize-`now()` freeze.
+        writeAuthoredYaml(totemDir, {
+            rules: [authoredRuleInput({ authoredAt: AUTHORED_AT, positiveFixtures: [posFixture(1)] })],
+        });
+        // Hand-built (not schema-parsed): the parse-time presence guard (strategy#804
+        // layered clauses) now rejects this shape at parse, so the materialize-time
+        // defense must be proven on its own for programmatic callers. No cast: the
+        // absence is refinement-invalid but structurally legal (`frozenAt` is
+        // optional), so the fixture keeps full compile-time property checking.
+        const noFreezeSeed = {
+            ...authoredSeed(),
+            split: { cutIndex: 1, excludedPrs: [] },
+        };
+        await expect(materializeAuthored(ctx(noFreezeSeed), gitDeps())).rejects.toThrow(/frozen BEFORE authoring/);
+        expect(fs.existsSync(gate1Dir)).toBe(false);
+    });
+    it('(v) Q2 floor violation: held-out < 50% of the window ⇒ GATE_INVALID', async () => {
+        // corpus [1,2,3], cutIndex 2 ⇒ train [1,2] / held-out [3] ⇒ 1/3 < 0.5.
+        const threeMetas = [3, 2, 1].map((pr) => ({
+            pr,
+            mergeCommit: sha(pr),
+            author: 'Dev <dev@example.com>',
+            isBotAuthor: false,
+            changedFiles: ['src/a.ts'],
+        }));
+        writeAuthoredYaml(totemDir, {
+            rules: [authoredRuleInput({ authoredAt: AUTHORED_AT, positiveFixtures: [posFixture(1)] })],
+        });
+        await expect(materializeAuthored(ctx(authoredSeed({ split: { cutIndex: 2, excludedPrs: [], frozenAt: FROZEN_AT } })), gitDeps({ enumerateMetas: () => threeMetas }))).rejects.toThrow(/Q2 held-out floor/);
+        expect(fs.existsSync(gate1Dir)).toBe(false);
+    });
+    it('(iii) membership violation: a held-out positive fixture ⇒ GATE_INVALID naming the PR', async () => {
+        // fixture pr=2 is the HELD-OUT slice ⇒ §5(2) leakage.
+        writeAuthoredYaml(totemDir, {
+            rules: [authoredRuleInput({ authoredAt: AUTHORED_AT, positiveFixtures: [posFixture(2)] })],
+        });
+        await expect(materializeAuthored(ctx(authoredSeed()), gitDeps())).rejects.toThrow(/Q3 membership.*#2/s);
+        expect(fs.existsSync(gate1Dir)).toBe(false);
+    });
+    it('(iv) vacuous effective ledger: zero positive-fixture PRs ⇒ GATE_INVALID before any git work', async () => {
+        // `runRuleAuthor` intake enforces ≥1 positive fixture per rule, but the ledger reader
+        // (`.strict()`, no `.min`) still parses a legacy/hand-edited row with `positiveFixturePrs: []`
+        // — the ndjson file IS the boundary the materializer trusts. Degrade the row to that shape.
+        writeAuthoredYaml(totemDir, {
+            rules: [authoredRuleInput({ authoredAt: AUTHORED_AT, positiveFixtures: [posFixture(1)] })],
+        });
+        const ledgerFile = path.join(totemDir, 'spine', 'authoring-ledger.ndjson');
+        const degraded = fs
+            .readFileSync(ledgerFile, 'utf-8')
+            .trim()
+            .split('\n')
+            .map((row) => JSON.stringify({ ...JSON.parse(row), positiveFixturePrs: [] }))
+            .join('\n');
+        fs.writeFileSync(ledgerFile, `${degraded}\n`, 'utf-8');
+        // The non-vacuity gate precedes ALL per-PR git resolution (CR round-2 hoist): a vacuous
+        // ledger must cost zero `resolvePrDiff` shell-outs — and, as ever, zero bytes on disk.
+        let gitCalls = 0;
+        await expect(materializeAuthored(ctx(authoredSeed()), gitDeps({
+            resolvePrDiff: (mergeCommit) => {
+                gitCalls += 1;
+                return { baseSha: sha(500), headSha: sha(600), diff: `diff ${mergeCommit}\n` };
+            },
+        }))).rejects.toThrow(/no positive-control fixture PRs in the effective authoring-ledger/);
+        expect(gitCalls).toBe(0);
+        expect(fs.existsSync(gate1Dir)).toBe(false);
+    });
+});
 //# sourceMappingURL=spine-authored-cert-corpus.test.js.map