@mmnto/cli 2.2.1 → 2.3.0

package/dist/commands/init-templates.d.ts

@@ -81,7 +81,7 @@ export declare const CLAUDE_SESSION_START_ENTRY: {
         timeout: number;
     }[];
 };
-export declare const CLAUDE_GATE_WRAPPER = "// [totem] auto-generated \u2014 Claude Code action-gate wrapper\n// ONE parameterized PreToolUse wrapper for the Totem gate engine (PR-C,\n// mmnto-ai/totem#2048). Reads --event <name> from argv (baked per-entry into\n// the installed command), reads the PreToolUse stdin envelope, shells to\n// `totem gate check`, and maps the GateVerdict disposition \u2192 host exit code.\n// `.cjs` extension because package.json may have \"type\": \"module\" \u2014 Claude\n// Code execs hooks via plain `node`, which would otherwise treat `.js` as ESM.\n//\n// Exit-code contract (LOAD-BEARING \u2014 ADR-109 \u00A72; branch ONLY on disposition):\n//   0 = allow | warn | --pilot deny | NOT-APPLICABLE fail-soft\n//       (unparseable/non-object envelope; freeze-check with no declared\n//        subsystem; transport-shield on a tool other than Bash/PowerShell or\n//        with no non-empty string command)\n//   2 = deny (--strict, Claude block convention)\n//       | APPLICABLE-gate-not-evaluable fail-closed (no CLI resolvable\n//         (repo-local, then PATH), non-zero `gate check`, unparseable verdict,\n//         or unknown disposition)\n//       | an --event this wrapper has no payload projection for (a baked event\n//         it cannot project is an applicable gate it cannot evaluate)\n'use strict';\n\nconst { spawnSync } = require('child_process');\nconst { existsSync, realpathSync } = require('fs');\nconst { basename, delimiter, dirname, join } = require('path');\n\n// \u2500\u2500\u2500 PATH FALLBACK for the Totem CLI (mmnto-ai/totem#2822) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// A `Bash|PowerShell`-matched gate applies to the very commands that CREATE\n// the repo-local CLI on a fresh clone (`pnpm install`, then `pnpm build` in\n// this monorepo), so with a repo-local-only resolution the gate blocks its own\n// bootstrap \u2014 and blocks the cure it prints. This is a RESOLUTION arm, not an\n// exemption: an applicable gate that cannot be evaluated by EITHER arm still\n// fails closed (mmnto-ai/totem#2799 ruling, Tenet 4).\n//\n// A session started in a fresh worktree has no node_modules at its cwd and\n// takes this arm; with no global CLI it fails closed \u2014 the ruling, not a bug.\n//\n// The repo-local pinned dist stays FIRST \u2014 the pinned-beats-ambient ordering of\n// ADR-072 \u00A7 2; tiers 1, 3 and 5 are out of scope for a hook that must not shell\n// out. This runs only when the pinned dist is absent. Two npm-global layouts\n// are probed per PATH dir, first hit wins:\n//   (a) <dir>/node_modules/@mmnto/cli/dist/index.js \u2014 the win32 layout, where\n//       the `totem.cmd` shim sits beside `node_modules`;\n//   (b) <dir>/totem realpath'd \u2014 the POSIX npm-global symlink, taken only when\n//       it resolves to an existing `.js` file (a shell shim resolves to an\n//       extensionless script and is correctly skipped).\n// A dir that yields neither is skipped; nothing here throws.\n//\n// PATH is trusted here at exactly the level `node` itself already is: the\n// settings.json entry invokes this hook as a bare `node`, so whoever controls\n// PATH controls the interpreter before this line ever runs.\n//\n// Returns { entry, display }: `entry` is the absolute path to spawn, `display`\n// a NON-resolvable rendering (basenames only) for the stderr provenance line \u2014\n// hook stderr lands in transcripts that get pasted into issues, so it never\n// carries a user-profile path.\nfunction resolveCliFromPath() {\n  const raw = typeof process.env.PATH === 'string' ? process.env.PATH : '';\n  const dirs = raw.split(delimiter);\n  for (let i = 0; i < dirs.length; i++) {\n    const dir = dirs[i];\n    if (!dir) continue;\n    const packaged = join(dir, 'node_modules', '@mmnto', 'cli', 'dist', 'index.js');\n    if (existsSync(packaged)) {\n      return {\n        entry: packaged,\n        display: basename(dir) + '/node_modules/@mmnto/cli/dist/index.js',\n      };\n    }\n    const shim = join(dir, 'totem');\n    if (existsSync(shim)) {\n      try {\n        const real = realpathSync(shim);\n        if (typeof real === 'string' && real.endsWith('.js') && existsSync(real)) {\n          return {\n            entry: real,\n            display:\n              basename(dir) + '/totem -> ' + basename(dirname(real)) + '/' + basename(real),\n          };\n        }\n      } catch (err) {\n        // An unreadable link is not a resolution \u2014 keep scanning the PATH.\n      }\n    }\n  }\n  return null;\n}\n\n// \u2500\u2500\u2500 Parse baked args (--event <name>, optional --pilot / --strict) \u2500\u2500\u2500\u2500\u2500\n// The tier is read ONLY from argv (baked into the installed command at\n// install time). There is NO env-var override: env sourcing would be a\n// fail-open (any shell with TOTEM_GATE_TIER=pilot could silently downgrade\n// enforcement). Default (no flag) = strict, so a default install is\n// environment-immune; --pilot is an explicit install-time opt-in.\nconst argv = process.argv.slice(2);\nlet event = '';\nlet tier = 'strict';\nfor (let i = 0; i < argv.length; i++) {\n  if (argv[i] === '--event') {\n    event = argv[i + 1] || '';\n    i++;\n  } else if (argv[i] === '--pilot') {\n    tier = 'pilot';\n  } else if (argv[i] === '--strict') {\n    tier = 'strict';\n  }\n}\n\n// Read the PreToolUse stdin envelope.\nlet stdin = '';\nprocess.stdin.setEncoding('utf-8');\nprocess.stdin.on('data', (chunk) => {\n  stdin += chunk;\n});\nprocess.stdin.on('end', () => {\n  let parsed;\n  try {\n    parsed = stdin ? JSON.parse(stdin) : {};\n  } catch (err) {\n    // Fail-soft on a malformed envelope (mirror PreWriteShield): a broken\n    // host envelope is not an applicable gate, so it must NOT block.\n    process.stderr.write('[totem gate-wrapper] could not parse stdin JSON; allowing\\n');\n    process.exit(0);\n  }\n\n  // Valid JSON can still be a non-object (the bytes `null`, `123`, or a bare\n  // quoted string). Such an envelope carries no `tool_input` to dereference and\n  // is NOT an applicable gate \u2192 fail-soft (exit 0). Guarding here also prevents\n  // a TypeError-on-deref from leaking as exit 1.\n  if (parsed === null || typeof parsed !== 'object') {\n    process.stderr.write('[totem gate-wrapper] stdin JSON is not an object; allowing\\n');\n    process.exit(0);\n  }\n\n  const input =\n    typeof parsed.tool_input === 'object' && parsed.tool_input !== null ? parsed.tool_input : {};\n\n  // \u2500\u2500\u2500 PER-EVENT PAYLOAD PROJECTION \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // Each gate reads a DIFFERENT slice of the PreToolUse envelope, so the\n  // projection branches on the baked --event. Every branch owns its own\n  // NOT-APPLICABLE test \u2014 the point past which a gate genuinely applies and\n  // any evaluation failure must fail CLOSED.\n  //\n  //   event            | applies when                     | payload\n  //   -----------------|----------------------------------|---------------------------\n  //   freeze-check     | tool_input.subsystem is a         | { subsystem }\n  //                    | non-empty string                  |\n  //   transport-shield | tool_name is Bash or PowerShell   | { tool, command, platform }\n  //                    | AND tool_input.command is a       |\n  //                    | non-empty string                  |\n  //   (anything else)  | \u2014 no projection \u2192 fail closed     | \u2014\n  let payload = '';\n\n  if (event === 'freeze-check') {\n    // THE EMPTY-SUBSYSTEM GUARDRAIL: freeze-check's predicate is on a DECLARED\n    // subsystem. A normal Edit/Write carries tool_input.file_path (a path), NOT\n    // a subsystem. With no declared subsystem, NO GATE APPLIES \u2192 pass through\n    // (exit 0). Do NOT shell out \u2014 a blanket fail-closed here would block every\n    // ordinary edit.\n    const declaredSubsystem =\n      typeof input.subsystem === 'string' && input.subsystem.trim() !== ''\n        ? input.subsystem.trim()\n        : '';\n    if (declaredSubsystem === '') {\n      process.exit(0);\n    }\n    payload = JSON.stringify({ subsystem: declaredSubsystem });\n  } else if (event === 'transport-shield') {\n    // transport-shield's predicate is on a SHELL COMMAND. Anything that is not\n    // a Bash/PowerShell invocation carrying a command string is NOT an\n    // applicable gate \u2192 pass through (exit 0), mirroring the guardrail above.\n    // The installed matcher is the CLI's own, so a foreign tool_name here means\n    // a hand-edited settings entry, not a shape to judge.\n    const tool = parsed.tool_name;\n    if (tool !== 'Bash' && tool !== 'PowerShell') {\n      process.exit(0);\n    }\n    if (typeof input.command !== 'string' || input.command.trim() === '') {\n      process.exit(0);\n    }\n    payload = JSON.stringify({\n      tool: tool,\n      command: input.command,\n      platform: process.platform,\n    });\n  } else {\n    // A baked --event this wrapper cannot project is an APPLICABLE gate it\n    // cannot evaluate \u2192 fail closed (ADR-109). Reinstalling refreshes the\n    // wrapper (`totem gate install` drift-repairs the bounded region).\n    process.stderr.write(\n      '[totem gate-wrapper] no payload projection for event \"' + event + '\"; failing closed.\\n',\n    );\n    process.exit(2);\n  }\n\n  // Resolve the Totem CLI: the repo-local pinned dist FIRST (a global `totem`\n  // may be stale and missing deps \u2014 the known repo gotcha; the\n  // pinned-beats-ambient ordering of ADR-072 \u00A7 2, Tenet 14), then a `totem` on\n  // PATH as a FALLBACK (mmnto-ai/totem#2822 \u2014 the bootstrap self-block above).\n  // Invoke node on whichever dist entry resolved.\n  //\n  // FAIL-CLOSED when NEITHER arm resolves: we are PAST the per-event\n  // applicability guardrail (freeze-check: a declared subsystem;\n  // transport-shield: a Bash or PowerShell command), so a gate genuinely\n  // APPLIES here. Neither gate has a commit-time hard floor (unlike\n  // PreWriteShield, whose fail-soft is backed by `totem-lint` at commit), so an\n  // APPLICABLE gate that cannot be evaluated for ANY reason (no CLI anywhere OR\n  // a broken source) must fail closed \u2014 not silently allow (guardrail rule +\n  // Tenet 4 fail-closed). Fail-SOFT (exit 0) is reserved for genuinely\n  // NOT-APPLICABLE inputs (unparseable/non-object envelope, no declared\n  // subsystem, no shell command), all of which already returned above.\n  const localCliPath = join(process.cwd(), 'node_modules', '@mmnto', 'cli', 'dist', 'index.js');\n  let cliPath = '';\n  // Which arm resolved \u2014 'repo-local' or 'PATH' \u2014 for the provenance line the\n  // fail-closed arms below disclose. Empty until one resolves.\n  let arm = '';\n  // The PATH arm's non-resolvable rendering of what it found (basenames only).\n  let cliDisplay = '';\n  if (existsSync(localCliPath)) {\n    cliPath = localCliPath;\n    arm = 'repo-local';\n  } else {\n    const fromPath = resolveCliFromPath();\n    if (fromPath) {\n      cliPath = fromPath.entry;\n      cliDisplay = fromPath.display;\n      arm = 'PATH';\n    }\n  }\n\n  if (!cliPath) {\n    // The exits named here must be exits the gate does NOT block: \"reinstall\n    // totem\" and `totem eject` are Bash commands a Bash|PowerShell gate blocks\n    // with this very message (mmnto-ai/totem#2822). They are ORDERED: the\n    // editor path still needs the bootstrap before the gate can be reinstalled.\n    process.stderr.write(\n      '[totem gate] ' +\n        event +\n        ' applies but no totem CLI is resolvable ' +\n        '(repo-local node_modules/@mmnto/cli/dist/index.js absent; no totem on PATH); ' +\n        'failing closed. Exits: bootstrap from a terminal OUTSIDE the harness ' +\n        '(pnpm install and pnpm build, or npm i -g @mmnto/cli); or remove this ' +\n        \"gate's entry from .claude/settings.json with the editor, bootstrap, \" +\n        'then re-run totem gate install ' +\n        event +\n        '.\\n',\n    );\n    process.exit(2);\n  }\n\n  // The payload rides on the child's STDIN (`--payload -`), never argv: a Bash\n  // command can run to tens of kilobytes and win32 caps a command line at\n  // 32,767 characters \u2014 an argv payload past it fails the spawn with\n  // ENAMETOOLONG and would land in the fail-closed arm below with nothing\n  // broken (mmnto-ai/totem#2799, pass 3).\n  const result = spawnSync(\n    process.execPath,\n    [cliPath, 'gate', 'check', '--event', event, '--payload', '-'],\n    { encoding: 'utf-8', timeout: 30000, input: payload },\n  );\n\n  // Provenance for the PATH fallback arm (mmnto-ai/totem#2822): a CLI older\n  // than 2.2.0 has no `gate check --payload -` and lands in the fail-closed\n  // arms below (unknown option \u2192 non-zero exit, or nothing on stdout). The\n  // BEHAVIOUR is unchanged \u2014 exit 2 either way \u2014 the line only names WHICH CLI\n  // evaluated and how to update it. Empty on the repo-local arm. It prints the\n  // basename rendering, never the absolute entry: this is transcript-bound text.\n  const armNote =\n    arm === 'PATH'\n      ? 'evaluated by the PATH CLI at ' +\n        cliDisplay +\n        \"; a CLI older than 2.2.0 lacks 'gate check --payload -' \u2014 \" +\n        'update it: npm i -g @mmnto/cli@latest\\n'\n      : '';\n\n  // \u2500\u2500\u2500 FAIL-CLOSED \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // A gate genuinely applies (the per-event projection above found its input:\n  // a declared subsystem, or a Bash/PowerShell command) and the evaluation\n  // itself failed (non-zero exit: corrupt freeze.json, an invalid payload,\n  // spawn error, etc.). Never silently allow when an applicable gate's source\n  // is broken \u2192 exit 2. (Not-applicable envelopes already returned exit 0\n  // above, so this only blocks when the gate's input was actually present.)\n  if (result.error || typeof result.status !== 'number' || result.status !== 0) {\n    process.stderr.write(\n      '[totem gate-wrapper] gate \"' +\n        event +\n        '\" evaluation failed (source broken or unavailable) \u2014 blocking (fail-closed).\\n' +\n        (result.stderr || (result.error ? String(result.error.message || result.error) : '')) +\n        '\\n' +\n        armNote,\n    );\n    process.exit(2);\n  }\n\n  let verdict;\n  try {\n    verdict = JSON.parse(result.stdout || '');\n  } catch (err) {\n    // The command emitted unparseable stdout despite a 0 exit \u2014 an applicable\n    // gate whose verdict we cannot read is a broken source \u2192 fail-closed.\n    process.stderr.write(\n      '[totem gate-wrapper] gate \"' + event + '\" emitted unparseable verdict \u2014 blocking (fail-closed).\\n' + armNote,\n    );\n    process.exit(2);\n  }\n\n  // \u2500\u2500\u2500 Disposition \u2192 host exit code (branch ONLY on disposition) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const disposition = verdict && typeof verdict.disposition === 'string' ? verdict.disposition : '';\n  // reason/provenance are OPAQUE stderr passthrough \u2014 never parsed for control flow.\n  const detail =\n    (verdict && verdict.reason ? verdict.reason : '') +\n    (verdict && verdict.provenance ? ' [' + JSON.stringify(verdict.provenance) + ']' : '');\n\n  if (disposition === 'allow') {\n    // Deliberately SILENT on the PATH arm too: a provenance line on every\n    // allowed Bash command would be transcript noise on the common path, and\n    // the operator already learned the property at install time (the\n    // `gate install` disclosure) \u2014 stderr here is reserved for what blocks.\n    process.exit(0);\n  }\n  if (disposition === 'warn') {\n    process.stderr.write('[totem gate-wrapper] ' + event + ' (warn): ' + detail + '\\n');\n    process.exit(0);\n  }\n  if (disposition === 'deny') {\n    process.stderr.write('[totem gate-wrapper] ' + event + ' (deny): ' + detail + '\\n');\n    process.exit(tier === 'pilot' ? 0 : 2);\n  }\n\n  // Unknown disposition from an applicable gate \u2014 fail-closed. The provenance\n  // note rides here too, so all four not-evaluable causes in the exit-code\n  // contract above disclose which arm evaluated.\n  process.stderr.write(\n    '[totem gate-wrapper] gate \"' + event + '\" returned unknown disposition \"' + disposition + '\" \u2014 blocking (fail-closed).\\n' + armNote,\n  );\n  process.exit(2);\n});\n// [totem] end auto-generated\n";
+export declare const CLAUDE_GATE_WRAPPER = "// [totem] auto-generated \u2014 Claude Code action-gate wrapper\n// ONE parameterized PreToolUse wrapper for the Totem gate engine (PR-C,\n// mmnto-ai/totem#2048). Reads --event <name> from argv (baked per-entry into\n// the installed command), reads the PreToolUse stdin envelope, shells to\n// `totem gate check`, and maps the GateVerdict disposition \u2192 host exit code.\n// `.cjs` extension because package.json may have \"type\": \"module\" \u2014 Claude\n// Code execs hooks via plain `node`, which would otherwise treat `.js` as ESM.\n//\n// Exit-code contract (LOAD-BEARING \u2014 ADR-109 \u00A72; branch ONLY on disposition):\n//   0 = allow | warn | --pilot deny | NOT-APPLICABLE fail-soft\n//       (unparseable/non-object envelope; freeze-check with no declared\n//        subsystem; transport-shield on a tool other than Bash/PowerShell or\n//        with no non-empty string command; merge-ready on any command that is\n//        not `gh pr merge` at command position)\n//   2 = deny (--strict, Claude block convention)\n//       | APPLICABLE-gate-not-evaluable fail-closed (no CLI resolvable\n//         (repo-local, then PATH), non-zero `gate check`, unparseable verdict,\n//         or unknown disposition)\n//       | an --event this wrapper has no payload projection for (a baked event\n//         it cannot project is an applicable gate it cannot evaluate)\n'use strict';\n\nconst { spawnSync } = require('child_process');\nconst { existsSync, realpathSync } = require('fs');\nconst { basename, delimiter, dirname, join } = require('path');\n\n// \u2500\u2500\u2500 PATH FALLBACK for the Totem CLI (mmnto-ai/totem#2822) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// A `Bash|PowerShell`-matched gate applies to the very commands that CREATE\n// the repo-local CLI on a fresh clone (`pnpm install`, then `pnpm build` in\n// this monorepo), so with a repo-local-only resolution the gate blocks its own\n// bootstrap \u2014 and blocks the cure it prints. This is a RESOLUTION arm, not an\n// exemption: an applicable gate that cannot be evaluated by EITHER arm still\n// fails closed (mmnto-ai/totem#2799 ruling, Tenet 4).\n//\n// A session started in a fresh worktree has no node_modules at its cwd and\n// takes this arm; with no global CLI it fails closed \u2014 the ruling, not a bug.\n//\n// The repo-local pinned dist stays FIRST \u2014 the pinned-beats-ambient ordering of\n// ADR-072 \u00A7 2; tiers 1, 3 and 5 are out of scope for a hook that must not shell\n// out. This runs only when the pinned dist is absent. Two npm-global layouts\n// are probed per PATH dir, first hit wins:\n//   (a) <dir>/node_modules/@mmnto/cli/dist/index.js \u2014 the win32 layout, where\n//       the `totem.cmd` shim sits beside `node_modules`;\n//   (b) <dir>/totem realpath'd \u2014 the POSIX npm-global symlink, taken only when\n//       it resolves to an existing `.js` file (a shell shim resolves to an\n//       extensionless script and is correctly skipped).\n// A dir that yields neither is skipped; nothing here throws.\n//\n// PATH is trusted here at exactly the level `node` itself already is: the\n// settings.json entry invokes this hook as a bare `node`, so whoever controls\n// PATH controls the interpreter before this line ever runs.\n//\n// Returns { entry, display }: `entry` is the absolute path to spawn, `display`\n// a NON-resolvable rendering (basenames only) for the stderr provenance line \u2014\n// hook stderr lands in transcripts that get pasted into issues, so it never\n// carries a user-profile path.\nfunction resolveCliFromPath() {\n  const raw = typeof process.env.PATH === 'string' ? process.env.PATH : '';\n  const dirs = raw.split(delimiter);\n  for (let i = 0; i < dirs.length; i++) {\n    const dir = dirs[i];\n    if (!dir) continue;\n    const packaged = join(dir, 'node_modules', '@mmnto', 'cli', 'dist', 'index.js');\n    if (existsSync(packaged)) {\n      return {\n        entry: packaged,\n        display: basename(dir) + '/node_modules/@mmnto/cli/dist/index.js',\n      };\n    }\n    const shim = join(dir, 'totem');\n    if (existsSync(shim)) {\n      try {\n        const real = realpathSync(shim);\n        if (typeof real === 'string' && real.endsWith('.js') && existsSync(real)) {\n          return {\n            entry: real,\n            display:\n              basename(dir) + '/totem -> ' + basename(dirname(real)) + '/' + basename(real),\n          };\n        }\n      } catch (err) {\n        // An unreadable link is not a resolution \u2014 keep scanning the PATH.\n      }\n    }\n  }\n  return null;\n}\n\n// \u2500\u2500\u2500 Parse baked args (--event <name>, optional --pilot / --strict) \u2500\u2500\u2500\u2500\u2500\n// The tier is read ONLY from argv (baked into the installed command at\n// install time). There is NO env-var override: env sourcing would be a\n// fail-open (any shell with TOTEM_GATE_TIER=pilot could silently downgrade\n// enforcement). Default (no flag) = strict, so a default install is\n// environment-immune; --pilot is an explicit install-time opt-in.\nconst argv = process.argv.slice(2);\nlet event = '';\nlet tier = 'strict';\nfor (let i = 0; i < argv.length; i++) {\n  if (argv[i] === '--event') {\n    event = argv[i + 1] || '';\n    i++;\n  } else if (argv[i] === '--pilot') {\n    tier = 'pilot';\n  } else if (argv[i] === '--strict') {\n    tier = 'strict';\n  }\n}\n\n// \u2500\u2500\u2500 merge-ready: `gh pr merge` at COMMAND POSITION + its payload \u2500\u2500\u2500\u2500\u2500\u2500\n//\n// One walk over the command text does BOTH jobs, so recognition and argv\n// extraction can never disagree: it tracks quoting, splits on the unquoted\n// command separators (`;`, `&`, `|`, a newline, `(`/`)`, `{`/`}`) and\n// tokenizes each segment. A segment whose FIRST token is `gh`, followed by\n// `pr` and `merge`, is a merge at command position; a quoted\n// \"gh pr merge\" is a single token and never matches, so\n// `echo \"gh pr merge\"` does not fire. The shell's own COMMAND-POSITION words\n// are skipped before the anchor is read \u2014 the reserved words `do`, `then`,\n// `else`, `if`, `elif`, `while`, `until` and `!`, the builtins `exec` and\n// `command` (which run their operand as the command), and any run of\n// `NAME=value` assignment prefixes \u2014 so `for \u2026 ; do gh pr merge; done`,\n// `if gh pr merge 5; then \u2026` and `GH_TOKEN=x gh pr merge 5` all fire. Before\n// the PR's review round only `do`/`then`/`else`/`!` were skipped, so a merge\n// used AS an `if` condition, or behind an assignment prefix, went unjudged\n// (mmnto-ai/totem#2844 round 1, greptile). EVERY matching segment is\n// collected, not the first: `gh pr merge 7; gh pr merge 8` yields two argv\n// lists and the wrapper judges each PR on its own facts (same round).\n//\n// HEREDOC BODIES ARE BLANKED FIRST (mmnto-ai/totem#2800 fold F4). A heredoc\n// body is DATA, not commands: `cat <<EOF` \u2026 `gh pr merge 5` \u2026 `EOF` writes a\n// line of text and merges nothing, and firing there was a false deny \u2014 the one\n// direction this projection must not have. The blanker is the shape core's\n// transport-shield scanner uses, in a self-contained form because a distributed\n// hook cannot import core: quoted (`<<'EOF'`, `<<\"EOF\"`, `<<\\EOF`) and bare\n// delimiters, `<<` and `<<-` (whose terminator may be tab-indented), an\n// unterminated body read to the end of the command, and `<<<` left alone (a\n// here-string is not a heredoc). Round 2 added the two guards that keep the\n// blanker from EATING commands: `$(( \u2026 ))` / `(( \u2026 ))` is skipped whole, so a\n// shift (`$((1<<2))`) opens nothing, and a `#` that begins a word is a comment\n// discarded to end-of-line, so neither its text nor a `<<note` inside it is\n// read \u2014 before them, either one swallowed the rest of the command and a real\n// merge after it went unjudged. Every `<<` on the operator line is queued and\n// its body consumed in order, as bash does for `cat <<A <<B`.\n//\n// Disclosed misses, same posture as transport-shield's scanner \u2014 the gate does\n// NOT fire, which is the safe direction, never a false deny:\n//   - a wrapper PROGRAM that takes operands before `gh` (`sudo`, `timeout 30`,\n//     `npx`, `env`, `nohup`): the program is the segment's first token, so the\n//     position anchor does not see `gh` (the shell's reserved words and the\n//     `exec`/`command`/`eval` builtins are skipped; an arbitrary program is\n//     not, since the walk cannot know which of its operands is the command);\n//   - a skipped word carrying a FLAG (`command -p gh pr merge 5`,\n//     `exec -a x gh pr merge 5`, and the reserved word's own `time -p` /\n//     `time --`): the flag is a token before `gh`, and bash runs the merge\n//     all the same (round 3, F1);\n//   - a merge handed over as ONE quoted word (`eval \"gh pr merge 5\"`,\n//     `bash -c \"gh pr merge 5\"`): a quoted string is data to this walk;\n//   - a backtick command substitution (`echo \\`gh pr merge 5\\``): the walk\n//     splits on `$( \u2026 )` parens but treats a backtick as an ordinary character,\n//     so the merge inside it stays part of `echo`'s segment;\n//   - a leading redirection (`> out.txt gh pr merge 5`): the redirection word\n//     is the segment's first token;\n//   - PowerShell's own quoting (backtick escapes, here-strings) is not\n//     modelled \u2014 the walk reads POSIX quoting for both tools.\n// Disclosed FALSE FIRES, the deny direction, all contrived \u2014 text the shell\n// does not execute as a merge but that sits at a segment's front here: a bash\n// array assignment whose elements spell a merge (`A=(gh pr merge 8)`) is judged\n// as a merge of 8, because `(` is a separator and the segment inside it starts\n// with `gh`; a `case` pattern `gh pr merge)` yields an EMPTY argv, which\n// projects to the current branch's PR (both surfaced when every segment began\n// to be collected, round 2 F6); and a function DEFINITION whose body is a\n// merge (`f() { gh pr merge 5; }`) fires at definition time, because `{` is a\n// separator and the body is its own segment (round 3, F4; it fired before this\n// PR's rounds too). `TOTEM_MERGE_GATE_OVERRIDE=1` is the audited way past any\n// of them.\n// Which characters END a word, so the scanner can say whether the next one\n// BEGINS one. Same set core's scanner uses (mmnto-ai/totem#2800 round 2, F1).\nfunction isWordBoundary(ch) {\n  return (\n    ch === ' ' ||\n    ch === '\\t' ||\n    ch === '\\r' ||\n    ch === '\\n' ||\n    ch === ';' ||\n    ch === '|' ||\n    ch === '&'\n  );\n}\n\n// The index just past the `))` that closes an arithmetic expansion whose\n// opening `$((` / `((` ends at `from`; the end of the command when it is\n// unterminated. A `<<` inside is a SHIFT, never a heredoc operator \u2014 without\n// this guard `echo $((1<<2))` opened a heredoc and swallowed every command\n// after it, so a real `gh pr merge` went unjudged (F1).\nfunction skipArithmetic(command, from) {\n  let depth = 2;\n  let i = from;\n  while (i < command.length) {\n    const ch = command[i];\n    if (ch === '(') depth += 1;\n    else if (ch === ')') {\n      depth -= 1;\n      if (depth === 0) return i + 1;\n    }\n    i += 1;\n  }\n  return command.length;\n}\n\nfunction blankHeredocBodies(command, powershell) {\n  let out = '';\n  let i = 0;\n  let quote = '';\n  let boundary = true;\n  let pending = [];\n\n  // Consume EVERY body queued on the operator line, in order, starting just\n  // past that line's newline \u2014 bash reads `cat <<A <<B` as two bodies, so a\n  // command sitting in B's body is data too (F2). Terminator lines are kept;\n  // body lines are dropped with their newlines, so the segments around them\n  // stay separated exactly as the shell separates them. An unterminated body\n  // runs to the end and is dropped whole.\n  const consumeBodies = (from) => {\n    let cursor = from;\n    for (let p = 0; p < pending.length; p++) {\n      const h = pending[p];\n      let at = cursor;\n      cursor = command.length;\n      while (at <= command.length) {\n        const nl = command.indexOf('\\n', at);\n        const stop = nl === -1 ? command.length : nl;\n        let line = command.slice(at, stop);\n        if (h.stripTabs) line = line.replace(/^\\t+/, '');\n        line = line.replace(/\\r$/, '');\n        const next = nl === -1 ? command.length : nl + 1;\n        if (line === h.delimiter) {\n          out += command.slice(at, next);\n          cursor = next;\n          break;\n        }\n        if (nl === -1) break;\n        out += '\\n';\n        at = next;\n      }\n    }\n    pending = [];\n    return cursor;\n  };\n\n  while (i < command.length) {\n    const ch = command[i];\n    if (quote !== '') {\n      out += ch;\n      if (ch === '\\\\' && quote === '\"' && i + 1 < command.length) {\n        out += command[i + 1];\n        i += 2;\n        continue;\n      }\n      if (ch === quote) quote = '';\n      i++;\n      boundary = false;\n      continue;\n    }\n    if (ch === \"'\" || ch === '\"') {\n      quote = ch;\n      out += ch;\n      i++;\n      boundary = false;\n      continue;\n    }\n    // A backslash before a NEWLINE is a line continuation: the shell removes\n    // both characters and the command carries on, so the scanner must too\n    // (mmnto-ai/totem#2800 round 3, F6). Absorbing the newline into a token is\n    // what hid `gh \\<LF>pr merge 5` from the position anchor.\n    if (ch === '\\\\' && (command[i + 1] === '\\n' || (command[i + 1] === '\\r' && command[i + 2] === '\\n'))) {\n      i += command[i + 1] === '\\r' ? 3 : 2;\n      continue;\n    }\n    if (ch === '\\\\' && i + 1 < command.length) {\n      out += ch + command[i + 1];\n      i += 2;\n      boundary = false;\n      continue;\n    }\n    // A `#` that BEGINS a word is a comment: discarded to the end of the line\n    // WITHOUT quote processing, so neither its text nor a `<<note` inside it\n    // reaches the tokenizer (F1). The newline stays \u2014 it may end an operator\n    // line whose bodies are still queued.\n    if (ch === '#' && boundary) {\n      const nl = command.indexOf('\\n', i);\n      i = nl === -1 ? command.length : nl;\n      continue;\n    }\n    // PowerShell's `<# \u2026 #>` block comment is data, not commands: blank it\n    // whole, the way a heredoc body is blanked (round 3, F8). Applied ONLY when\n    // the TOOL is PowerShell (round 4, F8): bash has no such comment, and there\n    // `sort <#tmp` is a redirect from a file named `#tmp` \u2014 blanking from it\n    // to a later `#>` would swallow real commands. A `<#` inside a quoted\n    // string never reaches here, because the quote arms run first.\n    if (powershell && ch === '<' && command[i + 1] === '#') {\n      const close = command.indexOf('#>', i + 2);\n      i = close === -1 ? command.length : close + 2;\n      boundary = true;\n      continue;\n    }\n    if (ch === '$' && command.slice(i, i + 3) === '$((') {\n      const end = skipArithmetic(command, i + 3);\n      out += command.slice(i, end);\n      i = end;\n      boundary = false;\n      continue;\n    }\n    if (ch === '(' && command[i + 1] === '(' && boundary) {\n      const end = skipArithmetic(command, i + 2);\n      out += command.slice(i, end);\n      i = end;\n      boundary = false;\n      continue;\n    }\n    // `<<` opens a heredoc; `<<<` is a here-string and is left alone.\n    if (ch === '<' && command[i + 1] === '<' && command[i + 2] !== '<') {\n      let j = i + 2;\n      let head = '<<';\n      let dash = false;\n      if (command[j] === '-') {\n        dash = true;\n        head += '-';\n        j++;\n      }\n      while (j < command.length && (command[j] === ' ' || command[j] === '\\t')) {\n        head += command[j];\n        j++;\n      }\n      // The delimiter word, quoted (`<<'EOF'`, `<<\"EOF\"`) or bare, with a\n      // backslash-quoted form (`<<\\EOF`) read as bash reads it.\n      let delim = '';\n      const q = command[j] === \"'\" || command[j] === '\"' ? command[j] : '';\n      if (q !== '') {\n        head += q;\n        j++;\n      }\n      while (j < command.length) {\n        const c = command[j];\n        if (q !== '') {\n          head += c;\n          j++;\n          if (c === q) break;\n          delim += c;\n          continue;\n        }\n        if (c === '\\\\' && j + 1 < command.length) {\n          head += c + command[j + 1];\n          delim += command[j + 1];\n          j += 2;\n          continue;\n        }\n        if (/[A-Za-z0-9_.\\-\\/]/.test(c)) {\n          head += c;\n          delim += c;\n          j++;\n          continue;\n        }\n        break;\n      }\n      out += head;\n      i = j;\n      boundary = false;\n      if (delim !== '') pending.push({ delimiter: delim, stripTabs: dash });\n      continue;\n    }\n    if (ch === '\\n') {\n      out += '\\n';\n      i += 1;\n      if (pending.length > 0) i = consumeBodies(i);\n      boundary = true;\n      continue;\n    }\n    out += ch;\n    boundary = isWordBoundary(ch);\n    i++;\n  }\n  return out;\n}\n\n// The words the shell reads at command position that are NOT the command:\n// reserved words that introduce a compound command (`time` and `coproc` are\n// reserved words too \u2014 the round-2 leg found them missing), the negation, and\n// the builtins that execute their operand as the command (`exec`, `command`,\n// and `eval` on an UNQUOTED operand \u2014 `eval \"gh pr merge 5\"` hands the shell a\n// single quoted word, which this walk reads as data, a disclosed miss below).\n// Stripped from a segment's front, in any run, before the `gh pr merge`\n// anchor is read.\nconst COMMAND_POSITION_WORDS = [\n  'do',\n  'then',\n  'else',\n  'if',\n  'elif',\n  'while',\n  'until',\n  'time',\n  'coproc',\n  '!',\n  'exec',\n  'command',\n  'eval',\n];\n\n// A `NAME=value` word at a segment's front is an assignment PREFIX to the\n// command that follows it (`GH_TOKEN=x gh pr merge 5`), never the command.\nfunction isAssignmentPrefix(token) {\n  return /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);\n}\n\n/**\n * The argv after EVERY `gh pr merge` at command position in the command \u2014\n * one array per merge, in command order \u2014 or an empty array when there is\n * none. A compound command that merges twice yields two, and the wrapper\n * judges each (mmnto-ai/totem#2844 round 1).\n */\nfunction ghPrMergeArgvs(rawCommand, powershell) {\n  const command = blankHeredocBodies(rawCommand, powershell === true);\n  const segments = [];\n  let current = [];\n  let token = '';\n  let hasToken = false;\n  let i = 0;\n  const endToken = () => {\n    if (hasToken) {\n      current.push(token);\n      token = '';\n      hasToken = false;\n    }\n  };\n  const endSegment = () => {\n    endToken();\n    segments.push(current);\n    current = [];\n  };\n  while (i < command.length) {\n    const ch = command[i];\n    if (ch === \"'\") {\n      hasToken = true;\n      i++;\n      while (i < command.length && command[i] !== \"'\") {\n        token += command[i];\n        i++;\n      }\n      i++;\n      continue;\n    }\n    if (ch === '\"') {\n      hasToken = true;\n      i++;\n      while (i < command.length && command[i] !== '\"') {\n        if (command[i] === '\\\\' && i + 1 < command.length) {\n          token += command[i + 1];\n          i += 2;\n          continue;\n        }\n        token += command[i];\n        i++;\n      }\n      i++;\n      continue;\n    }\n    // A parameter expansion is ONE word: without this, `${PR}` splits on its\n    // braces and the unresolved-target evidence line reads just \"$\"\n    // (mmnto-ai/totem#2800 round 2, F10). A `$( \u2026 )` is deliberately NOT\n    // swallowed the same way \u2014 a real `gh pr merge` inside a command\n    // substitution has to keep firing, so its parens stay separators.\n    if (ch === '$' && command[i + 1] === '{') {\n      const close = command.indexOf('}', i + 2);\n      const end = close === -1 ? command.length : close + 1;\n      token += command.slice(i, end);\n      hasToken = true;\n      i = end;\n      continue;\n    }\n    if (ch === ' ' || ch === '\\t' || ch === '\\r') {\n      endToken();\n      i++;\n      continue;\n    }\n    if (\n      ch === ';' ||\n      ch === '&' ||\n      ch === '|' ||\n      ch === '\\n' ||\n      ch === '(' ||\n      ch === ')' ||\n      ch === '{' ||\n      ch === '}'\n    ) {\n      endSegment();\n      i++;\n      continue;\n    }\n    // A line continuation joins the two halves of ONE word (`gh \\<LF>pr` is\n    // `ghpr` to the shell, and `gh \\<LF>pr merge` keeps `gh` at the front of\n    // the segment): drop both characters and keep tokenizing (round 3, F6).\n    if (ch === '\\\\' && (command[i + 1] === '\\n' || (command[i + 1] === '\\r' && command[i + 2] === '\\n'))) {\n      i += command[i + 1] === '\\r' ? 3 : 2;\n      continue;\n    }\n    if (ch === '\\\\' && i + 1 < command.length) {\n      token += command[i + 1];\n      hasToken = true;\n      i += 2;\n      continue;\n    }\n    token += ch;\n    hasToken = true;\n    i++;\n  }\n  endSegment();\n\n  const found = [];\n  for (const segment of segments) {\n    let tokens = segment;\n    while (\n      tokens.length > 0 &&\n      (COMMAND_POSITION_WORDS.indexOf(tokens[0]) !== -1 || isAssignmentPrefix(tokens[0]))\n    ) {\n      tokens = tokens.slice(1);\n    }\n    if (tokens.length >= 3 && tokens[0] === 'gh' && tokens[1] === 'pr' && tokens[2] === 'merge') {\n      found.push(tokens.slice(3));\n    }\n  }\n  return found;\n}\n\n/** Run git read-only and return trimmed stdout, or '' when it did not answer. */\nfunction gitRead(args) {\n  const res = spawnSync('git', args, { encoding: 'utf-8', timeout: 10000 });\n  if (res.error || typeof res.status !== 'number' || res.status !== 0) return '';\n  return (res.stdout || '').trim();\n}\n\n/** `owner/name` out of any git remote URL shape (ssh, https, with or without .git). */\nfunction repoFromRemote(url) {\n  const m = /[:/]([^/:]+)\\/([^/]+?)(?:\\.git)?$/.exec(url.trim());\n  return m ? m[1] + '/' + m[2] : '';\n}\n\n// The flags of `gh pr merge` that CONSUME the next argv element \u2014 without this\n// list, `gh pr merge -b \"some branch\"` would read the body as the PR target.\nconst GH_MERGE_VALUE_FLAGS = [\n  '-R',\n  '--repo',\n  '-b',\n  '--body',\n  '-F',\n  '--body-file',\n  '-t',\n  '--subject',\n  '--match-head-commit',\n  '--author-email',\n];\n\n/**\n * Project { repo, pr, branch?, headSha? } from the argv after `gh pr merge`:\n * a number, a PR URL, a branch, `-R/--repo`. With no argument at all, gh\n * merges the PR for the CURRENT branch \u2014 so the payload carries pr: null plus\n * that branch, exactly as the gate's payload contract allows.\n */\nfunction projectMergeReady(argv) {\n  let repo = '';\n  let pr = null;\n  let branch = '';\n  let positional = null;\n\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    const eq = arg.indexOf('=');\n    if (arg.slice(0, 2) === '--' && eq > 2) {\n      if (arg.slice(0, eq) === '--repo') repo = arg.slice(eq + 1);\n      continue;\n    }\n    if (GH_MERGE_VALUE_FLAGS.indexOf(arg) !== -1) {\n      if (arg === '-R' || arg === '--repo') repo = argv[i + 1] || '';\n      i++;\n      continue;\n    }\n    if (arg.charAt(0) === '-') continue;\n    if (positional === null) positional = arg;\n  }\n\n  // An UNEXPANDED shell variable (`gh pr merge $PR`) is not a target this\n  // projection can know (mmnto-ai/totem#2800 fold F13): the shell expands it\n  // after the hook has already decided. Reading it as a branch name would judge\n  // the wrong PR \u2014 or none \u2014 so it rides as `unresolvedTarget`, which the\n  // engine treats as unevaluable (strict denies, pilot warns).\n  let unresolvedTarget = '';\n  if (positional !== null && /[$`]/.test(positional)) {\n    unresolvedTarget = positional;\n    positional = null;\n  }\n\n  if (positional !== null) {\n    const url = /^https?:\\/\\/[^/]+\\/([^/]+)\\/([^/]+)\\/pull\\/(\\d+)/.exec(positional);\n    if (url) {\n      if (repo === '') repo = url[1] + '/' + url[2];\n      pr = parseInt(url[3], 10);\n    } else if (/^\\d+$/.test(positional)) {\n      pr = parseInt(positional, 10);\n    } else {\n      branch = positional;\n    }\n  }\n\n  // gh itself honours GH_REPO before the git remote; mirror that order so the\n  // gate reads the SAME pull request the command would merge.\n  if (repo === '') repo = (process.env.GH_REPO || '').trim();\n  if (repo === '') repo = repoFromRemote(gitRead(['config', '--get', 'remote.origin.url']));\n  // The current-branch fallback is for a command that named NO target. An\n  // unresolved one named a target we could not read, so it must not fall back.\n  if (pr === null && branch === '' && unresolvedTarget === '') {\n    branch = gitRead(['rev-parse', '--abbrev-ref', 'HEAD']);\n  }\n\n  const headSha = gitRead(['rev-parse', 'HEAD']);\n  const out = { repo: repo, pr: pr };\n  if (branch !== '') out.branch = branch;\n  if (unresolvedTarget !== '') out.unresolvedTarget = unresolvedTarget;\n  if (/^[0-9a-f]{40}$/i.test(headSha)) out.headSha = headSha;\n  return out;\n}\n\n// Read the PreToolUse stdin envelope.\nlet stdin = '';\nprocess.stdin.setEncoding('utf-8');\nprocess.stdin.on('data', (chunk) => {\n  stdin += chunk;\n});\nprocess.stdin.on('end', () => {\n  let parsed;\n  try {\n    parsed = stdin ? JSON.parse(stdin) : {};\n  } catch (err) {\n    // Fail-soft on a malformed envelope (mirror PreWriteShield): a broken\n    // host envelope is not an applicable gate, so it must NOT block.\n    process.stderr.write('[totem gate-wrapper] could not parse stdin JSON; allowing\\n');\n    process.exit(0);\n  }\n\n  // Valid JSON can still be a non-object (the bytes `null`, `123`, or a bare\n  // quoted string). Such an envelope carries no `tool_input` to dereference and\n  // is NOT an applicable gate \u2192 fail-soft (exit 0). Guarding here also prevents\n  // a TypeError-on-deref from leaking as exit 1.\n  if (parsed === null || typeof parsed !== 'object') {\n    process.stderr.write('[totem gate-wrapper] stdin JSON is not an object; allowing\\n');\n    process.exit(0);\n  }\n\n  const input =\n    typeof parsed.tool_input === 'object' && parsed.tool_input !== null ? parsed.tool_input : {};\n\n  // \u2500\u2500\u2500 PER-EVENT PAYLOAD PROJECTION \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // Each gate reads a DIFFERENT slice of the PreToolUse envelope, so the\n  // projection branches on the baked --event. Every branch owns its own\n  // NOT-APPLICABLE test \u2014 the point past which a gate genuinely applies and\n  // any evaluation failure must fail CLOSED.\n  //\n  //   event            | applies when                     | payload\n  //   -----------------|----------------------------------|---------------------------\n  //   freeze-check     | tool_input.subsystem is a         | { subsystem }\n  //                    | non-empty string                  |\n  //   transport-shield | tool_name is Bash or PowerShell   | { tool, command, platform }\n  //                    | AND tool_input.command is a       |\n  //                    | non-empty string                  |\n  //   merge-ready      | tool_name is Bash or PowerShell   | { repo, pr, branch?, headSha? }\n  //                    | AND the command runs `gh pr merge`|\n  //                    | at COMMAND POSITION               |\n  //   (anything else)  | \u2014 no projection \u2192 fail closed     | \u2014\n  //\n  // A projection yields ONE payload per gate evaluation \u2014 and merge-ready can\n  // yield several for one envelope (one per `gh pr merge` at command\n  // position), each judged on its own below.\n  let payloads = [];\n\n  if (event === 'freeze-check') {\n    // THE EMPTY-SUBSYSTEM GUARDRAIL: freeze-check's predicate is on a DECLARED\n    // subsystem. A normal Edit/Write carries tool_input.file_path (a path), NOT\n    // a subsystem. With no declared subsystem, NO GATE APPLIES \u2192 pass through\n    // (exit 0). Do NOT shell out \u2014 a blanket fail-closed here would block every\n    // ordinary edit.\n    const declaredSubsystem =\n      typeof input.subsystem === 'string' && input.subsystem.trim() !== ''\n        ? input.subsystem.trim()\n        : '';\n    if (declaredSubsystem === '') {\n      process.exit(0);\n    }\n    payloads = [JSON.stringify({ subsystem: declaredSubsystem })];\n  } else if (event === 'transport-shield') {\n    // transport-shield's predicate is on a SHELL COMMAND. Anything that is not\n    // a Bash/PowerShell invocation carrying a command string is NOT an\n    // applicable gate \u2192 pass through (exit 0), mirroring the guardrail above.\n    // The installed matcher is the CLI's own, so a foreign tool_name here means\n    // a hand-edited settings entry, not a shape to judge.\n    const tool = parsed.tool_name;\n    if (tool !== 'Bash' && tool !== 'PowerShell') {\n      process.exit(0);\n    }\n    if (typeof input.command !== 'string' || input.command.trim() === '') {\n      process.exit(0);\n    }\n    payloads = [\n      JSON.stringify({\n        tool: tool,\n        command: input.command,\n        platform: process.platform,\n      }),\n    ];\n  } else if (event === 'merge-ready') {\n    // merge-ready's predicate is on a PULL REQUEST about to be merged. The gate\n    // installs under Bash|PowerShell, so this branch sees every shell command:\n    // anything that is not `gh pr merge` at COMMAND POSITION is NOT an\n    // applicable gate \u2192 pass through (exit 0) WITHOUT spawning.\n    const tool = parsed.tool_name;\n    if (tool !== 'Bash' && tool !== 'PowerShell') {\n      process.exit(0);\n    }\n    if (typeof input.command !== 'string' || input.command.trim() === '') {\n      process.exit(0);\n    }\n    const merges = ghPrMergeArgvs(input.command, tool === 'PowerShell');\n    if (merges.length === 0) {\n      process.exit(0);\n    }\n    // One payload per merge: `gh pr merge 7; gh pr merge 8` is judged twice,\n    // each PR against its own facts (mmnto-ai/totem#2844 round 1).\n    for (let m = 0; m < merges.length; m++) {\n      payloads.push(JSON.stringify(projectMergeReady(merges[m])));\n    }\n  } else {\n    // A baked --event this wrapper cannot project is an APPLICABLE gate it\n    // cannot evaluate \u2192 fail closed (ADR-109). Reinstalling refreshes the\n    // wrapper (`totem gate install` drift-repairs the bounded region).\n    process.stderr.write(\n      '[totem gate-wrapper] no payload projection for event \"' + event + '\"; failing closed.\\n',\n    );\n    process.exit(2);\n  }\n\n  // No payload past the projection is not an applicable gate that passed \u2014 it\n  // is a branch above that forgot to project, and before the loop that shape\n  // fail-closed through the child's non-zero exit. Keep the default closed\n  // (round 2, F7).\n  if (payloads.length === 0) {\n    process.stderr.write(\n      '[totem gate-wrapper] event \"' + event + '\" projected no payload; failing closed.\\n',\n    );\n    process.exit(2);\n  }\n\n  // Resolve the Totem CLI: the repo-local pinned dist FIRST (a global `totem`\n  // may be stale and missing deps \u2014 the known repo gotcha; the\n  // pinned-beats-ambient ordering of ADR-072 \u00A7 2, Tenet 14), then a `totem` on\n  // PATH as a FALLBACK (mmnto-ai/totem#2822 \u2014 the bootstrap self-block above).\n  // Invoke node on whichever dist entry resolved.\n  //\n  // FAIL-CLOSED when NEITHER arm resolves: we are PAST the per-event\n  // applicability guardrail (freeze-check: a declared subsystem;\n  // transport-shield: a Bash or PowerShell command), so a gate genuinely\n  // APPLIES here. Neither gate has a commit-time hard floor (unlike\n  // PreWriteShield, whose fail-soft is backed by `totem-lint` at commit), so an\n  // APPLICABLE gate that cannot be evaluated for ANY reason (no CLI anywhere OR\n  // a broken source) must fail closed \u2014 not silently allow (guardrail rule +\n  // Tenet 4 fail-closed). Fail-SOFT (exit 0) is reserved for genuinely\n  // NOT-APPLICABLE inputs (unparseable/non-object envelope, no declared\n  // subsystem, no shell command), all of which already returned above.\n  const localCliPath = join(process.cwd(), 'node_modules', '@mmnto', 'cli', 'dist', 'index.js');\n  let cliPath = '';\n  // Which arm resolved \u2014 'repo-local' or 'PATH' \u2014 for the provenance line the\n  // fail-closed arms below disclose. Empty until one resolves.\n  let arm = '';\n  // The PATH arm's non-resolvable rendering of what it found (basenames only).\n  let cliDisplay = '';\n  if (existsSync(localCliPath)) {\n    cliPath = localCliPath;\n    arm = 'repo-local';\n  } else {\n    const fromPath = resolveCliFromPath();\n    if (fromPath) {\n      cliPath = fromPath.entry;\n      cliDisplay = fromPath.display;\n      arm = 'PATH';\n    }\n  }\n\n  if (!cliPath) {\n    // The exits named here must be exits the gate does NOT block: \"reinstall\n    // totem\" and `totem eject` are Bash commands a Bash|PowerShell gate blocks\n    // with this very message (mmnto-ai/totem#2822). They are ORDERED: the\n    // editor path still needs the bootstrap before the gate can be reinstalled.\n    process.stderr.write(\n      '[totem gate] ' +\n        event +\n        ' applies but no totem CLI is resolvable ' +\n        '(repo-local node_modules/@mmnto/cli/dist/index.js absent; no totem on PATH); ' +\n        'failing closed. Exits: bootstrap from a terminal OUTSIDE the harness ' +\n        '(pnpm install and pnpm build, or npm i -g @mmnto/cli); or remove this ' +\n        \"gate's entry from .claude/settings.json with the editor, bootstrap, \" +\n        'then re-run totem gate install ' +\n        event +\n        '.\\n',\n    );\n    process.exit(2);\n  }\n\n  // The payload rides on the child's STDIN (`--payload -`), never argv: a Bash\n  // command can run to tens of kilobytes and win32 caps a command line at\n  // 32,767 characters \u2014 an argv payload past it fails the spawn with\n  // ENAMETOOLONG and would land in the fail-closed arm below with nothing\n  // broken (mmnto-ai/totem#2799, pass 3).\n  // The baked tier rides along (mmnto-ai/totem#2800 R1): the ENGINE owns the\n  // strict/pilot split for a gate's UNEVALUABLE class (a read that could not\n  // derive), while the disposition \u2192 exit map below stays the wrapper's. A gate\n  // that ignores the tier \u2014 freeze-check \u2014 still fails closed at both.\n  //\n  // `--tier` is forwarded ONLY when it is NOT the default (fold F3): a CLI at\n  // or below 2.2.1 has no such option and would exit non-zero with\n  // \"unknown option\", which is the fail-closed arm \u2014 and on a\n  // `Bash|PowerShell` gate that re-creates the mmnto-ai/totem#2822 bootstrap\n  // self-block through the PATH arm. `strict` IS the engine's default, so a\n  // strict wrapper stays runnable against a 2.2.x CLI; a `--pilot` install\n  // passes the flag and needs a CLI at 2.3.0 or newer (the install-time\n  // disclosure says so).\n  const checkArgs = [cliPath, 'gate', 'check', '--event', event];\n  if (tier !== 'strict') {\n    checkArgs.push('--tier', tier);\n  }\n  checkArgs.push('--payload', '-');\n\n  // Provenance for the PATH fallback arm (mmnto-ai/totem#2822): a CLI older\n  // than 2.2.0 has no `gate check --payload -` and lands in the fail-closed\n  // arms below (unknown option \u2192 non-zero exit, or nothing on stdout). The\n  // BEHAVIOUR is unchanged \u2014 exit 2 either way \u2014 the line only names WHICH CLI\n  // evaluated and how to update it. Empty on the repo-local arm. It prints the\n  // basename rendering, never the absolute entry: this is transcript-bound text.\n  // The floor NAMED here is the floor this wrapper actually needs: a strict\n  // wrapper sends no `--tier`, so 2.2.0 (the `--payload -` cut) still answers\n  // it; a pilot wrapper sends `--tier pilot`, which only 2.3.0 and newer parse\n  // (mmnto-ai/totem#2800 fold F3).\n  const armNote =\n    arm === 'PATH'\n      ? 'evaluated by the PATH CLI at ' +\n        cliDisplay +\n        (tier === 'strict'\n          ? \"; a CLI older than 2.2.0 lacks 'gate check --payload -' \u2014 \"\n          : \"; a CLI older than 2.3.0 lacks 'gate check --tier' (this entry is baked --pilot) \u2014 \") +\n        'update it: npm i -g @mmnto/cli@latest\\n'\n      : '';\n\n  // \u2500\u2500\u2500 One evaluation per projected payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // freeze-check and transport-shield project exactly one. merge-ready projects\n  // one per `gh pr merge` at command position, so `gh pr merge 7; gh pr merge 8`\n  // is judged TWICE, each PR on its own facts \u2014 judging only the first let the\n  // shell run the second unjudged (mmnto-ai/totem#2844 round 1). The first\n  // strict deny, and every fail-closed arm, EXITS at once; a warn, and a deny\n  // under --pilot, print their line and let the NEXT payload be judged, so every\n  // merge in the envelope gets its stderr line; exit 0 only once every payload\n  // has allowed or warned.\n  //\n  // ONE 30-second budget across every payload, not 30 seconds each (round 2,\n  // F5): the hook host kills a PreToolUse hook at its own default budget (60 s\n  // on both Claude Code and Gemini, the same figure the session-hook templates\n  // above cut their legs against) and a killed hook's exit code is never\n  // applied \u2014 a fail-OPEN on a gate whose posture is fail-closed. With the\n  // budget shared, the loop's wall time is bounded at 30 s plus the one-second\n  // floor each payload past the budget still gets (round 3, F2), and a merge\n  // that cannot be judged inside it lands in the fail-closed arm below (the\n  // spawn times out \u2192 `result.error`) rather than in the host's kill. What the\n  // budget does NOT cover, disclosed (round 3, F3): the projection above runs\n  // up to three `gitRead`s per merge, each on its own 10 s timeout, before this\n  // deadline exists \u2014 a hung git on a multi-merge envelope can still reach the\n  // host's budget through them.\n  const deadline = Date.now() + 30000;\n  for (let p = 0; p < payloads.length; p++) {\n    const result = spawnSync(process.execPath, checkArgs, {\n      encoding: 'utf-8',\n      timeout: Math.max(1000, deadline - Date.now()),\n      input: payloads[p],\n    });\n\n    // \u2500\u2500\u2500 The child's stderr IS a gate surface (fold F1) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // merge-ready's audited-override line, its zero-checks fact and every\n    // \"could not derive\" line are written by the ENGINE to stderr. Passing them\n    // through verbatim in EVERY arm \u2014 allow included \u2014 is what puts them in the\n    // transcript; printing them only on failure hid the override's audit trail,\n    // the one line that must never be silent.\n    if (typeof result.stderr === 'string' && result.stderr !== '') {\n      process.stderr.write(result.stderr);\n    }\n\n    // \u2500\u2500\u2500 FAIL-CLOSED \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // A gate genuinely applies (the per-event projection above found its input:\n    // a declared subsystem, or a Bash/PowerShell command) and the evaluation\n    // itself failed (non-zero exit: corrupt freeze.json, an invalid payload,\n    // spawn error, etc.). Never silently allow when an applicable gate's source\n    // is broken \u2192 exit 2. (Not-applicable envelopes already returned exit 0\n    // above, so this only blocks when the gate's input was actually present.)\n    if (result.error || typeof result.status !== 'number' || result.status !== 0) {\n      process.stderr.write(\n        '[totem gate-wrapper] gate \"' +\n          event +\n          '\" evaluation failed (source broken or unavailable) \u2014 blocking (fail-closed).\\n' +\n          // The child's stderr already went through verbatim above (fold F1);\n          // only a spawn-level error (no child, so no stderr) is added here.\n          (result.error ? String(result.error.message || result.error) + '\\n' : '') +\n          armNote,\n      );\n      process.exit(2);\n    }\n\n    let verdict;\n    try {\n      verdict = JSON.parse(result.stdout || '');\n    } catch (err) {\n      // The command emitted unparseable stdout despite a 0 exit \u2014 an applicable\n      // gate whose verdict we cannot read is a broken source \u2192 fail-closed.\n      process.stderr.write(\n        '[totem gate-wrapper] gate \"' + event + '\" emitted unparseable verdict \u2014 blocking (fail-closed).\\n' + armNote,\n      );\n      process.exit(2);\n    }\n\n    // \u2500\u2500\u2500 Disposition \u2192 host exit code (branch ONLY on disposition) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    const disposition = verdict && typeof verdict.disposition === 'string' ? verdict.disposition : '';\n    // reason/provenance are OPAQUE stderr passthrough \u2014 never parsed for control flow.\n    const detail =\n      (verdict && verdict.reason ? verdict.reason : '') +\n      (verdict && verdict.provenance ? ' [' + JSON.stringify(verdict.provenance) + ']' : '');\n\n    if (disposition === 'allow') {\n      // Deliberately SILENT on the PATH arm too: a provenance line on every\n      // allowed Bash command would be transcript noise on the common path, and\n      // the operator already learned the property at install time (the\n      // `gate install` disclosure) \u2014 stderr here is reserved for what blocks.\n      continue;\n    }\n    if (disposition === 'warn') {\n      process.stderr.write('[totem gate-wrapper] ' + event + ' (warn): ' + detail + '\\n');\n      continue;\n    }\n    if (disposition === 'deny') {\n      process.stderr.write('[totem gate-wrapper] ' + event + ' (deny): ' + detail + '\\n');\n      if (tier !== 'pilot') {\n        process.exit(2);\n      }\n      continue;\n    }\n\n    // Unknown disposition from an applicable gate \u2014 fail-closed. The provenance\n    // note rides here too, so all four not-evaluable causes in the exit-code\n    // contract above disclose which arm evaluated.\n    process.stderr.write(\n      '[totem gate-wrapper] gate \"' + event + '\" returned unknown disposition \"' + disposition + '\" \u2014 blocking (fail-closed).\\n' + armNote,\n    );\n    process.exit(2);\n  }\n  process.exit(0);\n});\n// [totem] end auto-generated\n";
 export declare const CLAUDE_GATE_WRAPPER_ENTRY: {
     matcher: string;
     hooks: {
@@ -123,18 +123,18 @@ export declare const LEGACY_MANAGED_SESSION_HOOKS: ReadonlyArray<LegacyManagedHo
 export declare const SKILL_MARKER_START = "<!-- totem:skill-start -->";
 export declare const SKILL_MARKER_END = "<!-- totem:skill-end -->";
 export declare const SIGNOFF_SKILL_CONTENT: string;
-export declare const SIGNON_SKILL_CONTENT = "---\nname: signon\ndescription: Session-start \u2014 consume/derive orientation, poll mail since last signoff, re-derive carryforward gates, present next-steps for operator ruling\n---\n\n<!-- totem:skill-start -->\n\nSession-start bring-up. **Read-only** \u2014 no mutations, no dispatches, no board edits until the operator rules on next steps (Proposal 295 d2: read-only orient + grounded next-work). Solo \u2014 no agent fleet (`feedback_session_start_derive_cheaply`: cheap derivation IS the validation dogfood).\n\n1. **Consume the injected orientation.** On Claude Code seats a SessionStart hook may inject a journal + carryforward, inbound mail, branch/ticket-matched context, and a bounded session-orientation slice (parked/freeze state, open PRs, board\u2194issue coherence drift, and an open-issue-count pointer) \u2014 the hook serves the seat it is CONFIGURED for, not a derived identity, so confirm the injected journal is YOURS: a visiting session receives the HOST seat's, and your carryforward derives from `.totem/orchestration/<your-seat>/journal/` (step 3), never from a foreign journal. On a hook-seat MISMATCH (the injected journal or mail banner names another seat), consume NONE of the injected material \u2014 treat the session as hook-less: derive it all via `totem orient` plus your own seat-anchored poll (step 2). Do not re-run what the hook injected. Everything else the bring-up needs (the full board in-flight set, corpus freshness, doctrine currency) is derived on demand via `totem orient`. On a hook-less seat (other vendors, cold starts), derive it all: `totem orient`.\n\n2. **Poll mail since last signoff \u2014 seat-anchored.** Poll AS YOUR SEAT: per-shell `TOTEM_SELF_AGENT=<your-seat>` (the mmnto-ai/totem#2629 scope ruling \u2014 never user/machine scope; prefer the inline form `TOTEM_SELF_AGENT=<seat> totem mail` where shell state does not persist between tool calls) or `totem mail --as <your-seat>`. **S0 identity check:** the banner's `Self agents:` line must name exactly your seat. Since @mmnto/cli 1.117.0 an identity-less multi-seat poll gates itself (broadcast-only serve, directed mail withheld as a count, exit 2 \u2014 the mmnto-ai/totem#2204 deterministic floor), so the residual S0 catches is the WRONG-single-identity class: a mis-scoped or inherited env naming a foreign seat resolves single-seat, ungated, and serves that seat's directed mail. A banner naming a FOREIGN seat = STOP: act on nothing served, propagate nothing from it, fix the identity, re-poll. A GATED poll's LISTING is broadcast-only by construction \u2014 but warning lines can still name an unclassifiable or unresolvable file (an ECL basename is recipient + compressed subject \u2014 the CLI's named limit), so propagate nothing from a gated poll's warnings either: fix the identity and re-poll for your directed mail. An `Error:` line is the same surface: since the mmnto-ai/totem#2685 fix a poll whose OWN outbox (one this repo hosts for a resolved seat) carries a dispatch with an unresolvable `to:` exits 4 (SENDER FAULT) \u2014 the verdict IS derived, read it, but the `to:` is yours to fix first (one recipient per dispatch, or broadcast; a comma list is never a recipient), and propagate nothing from the fault line; exit 2 stays NOT-DERIVED and wins when both hold. Unread = inbound \u2212 handled: consumption is tracked by `processed/` marks (`feedback_check_outbox_before_replying`), so the CLI path needs no cutoff stamp. Read every hit before proceeding \u2014 new mail can reprioritize everything below. (Fallback \u2014 a seat that must stamp-poll instead derives the cutoff from the newest journal's CONTENT date, the filename stamp or frontmatter, **never file mtime**, which git resets on clone/worktree and silently reports \"inbox clean\" over waiting mail; mmnto-ai/totem-strategy#813.)\n\n3. **Re-derive the carryforward gates \u2014 don't trust the journal's framing** (Tenet 20 read-side twin). For each carryforward item in YOUR SEAT's latest journal (`.totem/orchestration/<your-seat>/journal/` \u2014 on a multi-seat repo another seat's newer journal is not your carryforward), freshly derive its gate state (the PR it waits on, the issue, the date, the release train) via `gh` / `git` reads. Cross-repo gates resolve through the frozen cohort roster \u2014 `totem` / `strategy` / `status` / `lc` \u2192 `mmnto-ai/{totem, totem-strategy, totem-status, liquid-city}` (mmnto-ai/totem-strategy#611 gates any change). An item whose gate fired leads the next-steps list; an item still gated is reported as waiting, not worked.\n\n4. **Surface owed-now sensors.** Anything the injected/derived orientation flags as owed (corpus `\u26A0 stale`, strategy-doctrine `\u26A0 publish owed`, board drift) goes on the list as a candidate \u2014 sensors report, they don't gate (Tenet 13).\n\n5. **Present and stop.** One message: state summary (inbox, gate states, owed-now items) + ranked next-steps with a recommendation. Then wait for the operator's ruling \u2014 signon ends at the judgment handoff; mutations belong to the ruled work, not the bring-up.\n\n<!-- totem:skill-end -->\n";
-export declare const REVIEW_REPLY_SKILL_CONTENT = "---\nname: review-reply\ndescription: Unified PR review triage \u2014 fetch, normalize, and batch-action bot comments\n---\n\n<!-- totem:skill-start -->\n\nTriage PR review comments from all bots for PR $ARGUMENTS.\n\n## Phase 1: Fetch & Categorize (Deterministic)\n\nRun the triage command to fetch, normalize, deduplicate, and categorize all bot comments:\n\n```bash\npnpm totem triage-pr $ARGUMENTS\n```\n\nThis outputs a categorized inbox grouped by blast radius (Security \u2192 Architecture \u2192 Convention \u2192 Nits) with cross-bot deduplication already applied. The heavy lifting is done in TypeScript \u2014 no LLM math needed.\n\n**STOP HERE.** Present the output to the user and wait for them to specify actions. Do NOT proceed to Phase 2 until the user replies.\n\n## Phase 2: Execute Actions (Bulk Support)\n\nThe user may type individual IDs (e.g., `fix 4, 11`) OR use bulk actions:\n\n- `fix all security`\n- `defer all nits`\n- `extract all architecture`\n\n### `fix <numbers | category>`\n\nMark items as will-fix. No API calls \u2014 just acknowledge. The user will make code changes next.\n\n### `defer <numbers | category> [ticket]`\n\nAuto-reply on the PR acknowledging the deferral:\n\n- **CodeRabbit items:** Reply inline to each thread with \"Tracked in #NNN\" or \"Deferred \u2014 not blocking for this PR.\"\n- **GCA items:** DO NOT reply inline. Batch ALL GCA responses into ONE issue comment: `@gemini-code-assist` followed by a numbered list addressing each finding. Use `gh pr comment $ARGUMENTS --body-file -` and pipe the comment body via stdin.\n- **ghcq items:** `github-code-quality[bot]` has no known @-listener (attested: no in-org tag attempt has drawn a response and none is documented \u2014 mmnto-ai/totem#2626) \u2014 do not tag it; treat its dispositions as audit-trail-only.\n- **SARIF items:** No reply needed (our own tool).\n\n### `nit <numbers | category>`\n\nSame as defer but reply text is \"Acknowledged \u2014 nit / by design.\"\n\n### `extract <numbers | category>`\n\nFor each selected finding, generate a lesson and call `mcp__totem-dev__add_lesson` (or equivalent):\n\n- Use the bot's finding as the lesson body\n- Add relevant tags from the file path and finding category\n- The lesson will automatically get `lifecycle: nursery` treatment\n\n### `done`\n\nPrint a summary of actions taken, then \u2014 when the round is being dispositioned \u2014 assemble and post the single consolidated round-disposition comment (see the section below), which EXECUTES `totem review --covariate` to carry the `local-lane:` line, on the operator's explicit go. Then exit.\n\n## CRITICAL: GCA Reply Protocol\n\n**NEVER reply individually to GCA bot comments.** GCA has a quota and will NOT respond to replies unless they contain `@gemini-code-assist`. Always batch ALL GCA responses into a single PR-level comment using the issue comments API endpoint (`/issues/{pr}/comments`), not the review comments reply endpoint.\n\n## Consolidated round-disposition comment (a concrete step, operator-gated)\n\nDisposing the round is ONE consolidated comment (single-comment ownership per bot-protocols) \u2014 a real, numbered step of the flow, NOT an optional aside. Like every GitHub mutation in this skill it is operator-gated: assemble the body, show it, and post ONLY on an explicit human go. Run this as part of `done` (or whenever the operator asks to post the round disposition):\n\n1. **Obtain the covariate line \u2014 execute the verb, never hand-author it.** Run the read-only, zero-LLM command and capture its stdout:\n\n```bash\ntotem review --covariate\n```\n\nIt resolves the current branch lineage exactly as the review fan does and prints the canonical `local-lane:` line from the core-owned renderers \u2014 the LATEST verdict artifact's line (`.totem/artifacts/verdicts/`) when the current diff is admitted, or the exact-identity admission record's `not-applicable` form (`.totem/artifacts/admissions/`, format v1.1, mmnto-ai/totem#2473) when the current diff is a deterministic skip \u2014 never trust a pasted or hand-copied value. Under format v1.2 (mmnto-ai/totem#2698) every shape carries the appended `leg: <sha8> blocking=<n> material=<n> folded=<n>` field (or `leg: none`), and a lineage with no artifact of either family but a leg deposit for HEAD prints the `local-lane: none` head shape \u2014 carry whatever the verb prints, verbatim. If it reports no line at all, there is none to carry (note that in the body and continue).\n\n2. **Assemble the single body.** One comment: @-tag EVERY bot addressed in the round \u2014 exactly ONE tag each (e.g. `@gemini-code-assist`, `@coderabbitai`, `@greptileai`) so each bot registers the disposition, and tags must be present when the comment is POSTED, never edited in (GCA's listener fires on comment-created only). One notification per bot per round: a bot with nothing addressed gets no tag, and a bot already @-tagged in this round's batch comment (the GCA defer/nit batch above) is NOT re-tagged here. ghcq (`github-code-quality[bot]`) has no known listener \u2014 it is never tagged; its items are dispositioned in the body for the audit trail only (mmnto-ai/totem#2626). Never combine a tag with ANY bot's review trigger \u2014 triggers are standalone comments, one trigger and no prose (a trigger embedded in a content-rich comment chat-routes the bot). Then the per-item dispositions (fixed / deferred / nit / extracted) followed by the non-empty `local-lane:` line from step 1, verbatim. The local `review-loop` holds this line but never posts it, so `/review-reply` is the SOLE path that carries it to GitHub.\n\n3. **Post on an explicit go.** Show the assembled body and wait for the operator; on their go, post the ONE comment with `gh pr comment $ARGUMENTS --body-file -` (pipe the body via stdin). Never mutate the PR autonomously.\n\n<!-- totem:skill-end -->\n";
+export declare const SIGNON_SKILL_CONTENT = "---\nname: signon\ndescription: Session-start \u2014 consume/derive orientation, poll mail since last signoff, re-derive carryforward gates, present next-steps for operator ruling\n---\n\n<!-- totem:skill-start -->\n\nSession-start bring-up. **Read-only** \u2014 no mutations, no dispatches, no board edits until the operator rules on next steps (Proposal 295 d2: read-only orient + grounded next-work). Solo \u2014 no agent fleet (`feedback_session_start_derive_cheaply`: cheap derivation IS the validation dogfood).\n\n0. **Derive the seat FIRST \u2014 before orient, before any journal read, before any knowledge search** (mmnto-ai/totem#2801). Read the INHERITED `TOTEM_SELF_AGENT` this session was launched with; `totem mail --derive-seat` is the probe \u2014 one stdout line `seat=<id> source=env` and exit 0 when the inherited env names exactly one seat this repo hosts, otherwise a stderr refusal (exit 2) naming the supplied value (or `unset`) and every seat this repo hosts. **Hosts** means one thing everywhere: config.json `host_agents`, else the seat dirs, else the cohort map keyed on the origin repository \u2014 never the env you supplied, which is the thing being checked. **Set \u2192 that is your seat: use it, and never write a different one.** An inline `TOTEM_SELF_AGENT=<seat>` on any later command may only RESTATE the inherited value; writing a different seat over it silently re-points every step below at a seat that is not yours, and once overridden the tool can no longer see what you inherited \u2014 the operator's account is the only witness left. **Set but REFUSED** (the probe exits 2 while the env names a seat): your declaration and this repo disagree, so act as if you have no seat \u2014 put the refusal line itself in front of the operator, verbatim, and change nothing to make it pass; signon is read-only, so `totem seat add` is never run here. On a repo with no seat registration at all the refusal says the repo cannot CORROBORATE you, not that your seat is wrong: `totem mail --as <your-seat>` and a per-shell poll still serve your declaration, because a declaration on the command line is yours to make and this probe only checks one. **Empty \u2192 STOP and ask the operator.** Do not guess, do not fall back to the crown, do not derive a seat from the repo basename, the branch, or the only seat in sight; a bring-up on an unknown identity is worse than no bring-up. Report exactly one line and wait: `Failure Mode: Hook-less session launched without TOTEM_SELF_AGENT set.`\n\n1. **Assignment mail before orient \u2014 poll since last signoff, seat-anchored.** On a hook-less seat the order is fixed: assignment mail before orient, before any journal read, and before any knowledge search \u2014 an assignment can turn every one of those into a disclosure (step 2), and the managed hook derives neither the poll nor the journal for you (step 3). Poll AS YOUR SEAT: per-shell `TOTEM_SELF_AGENT=<your-seat>` (the mmnto-ai/totem#2629 scope ruling \u2014 never user/machine scope; prefer the inline form `TOTEM_SELF_AGENT=<seat> totem mail` where shell state does not persist between tool calls, and on a session whose step-0 env is already set that inline form RESTATES that seat and never another) or `totem mail --as <your-seat>`. **S0 identity check:** the banner's `Self agents:` line must name exactly your seat. Since @mmnto/cli 1.117.0 an identity-less multi-seat poll gates itself (broadcast-only serve, directed mail withheld as a count, exit 2 \u2014 the mmnto-ai/totem#2204 deterministic floor), so the residual S0 catches is the WRONG-single-identity class: a mis-scoped or inherited env naming a foreign seat resolves single-seat, ungated, and serves that seat's directed mail. A banner naming a FOREIGN seat = STOP: act on nothing served, propagate nothing from it, fix the identity, re-poll. A GATED poll's LISTING is broadcast-only by construction \u2014 but warning lines can still name an unclassifiable or unresolvable file (an ECL basename is recipient + compressed subject \u2014 the CLI's named limit), so propagate nothing from a gated poll's warnings either: fix the identity and re-poll for your directed mail. An `Error:` line is the same surface: since the mmnto-ai/totem#2685 fix a poll whose OWN outbox (one this repo hosts for a resolved seat) carries a dispatch with an unresolvable `to:` exits 4 (SENDER FAULT) \u2014 the verdict IS derived, read it, but the `to:` is yours to fix first (one recipient per dispatch, or broadcast; a comma list is never a recipient), and propagate nothing from the fault line; exit 2 stays NOT-DERIVED and wins when both hold. Unread = inbound \u2212 handled: consumption is tracked by `processed/` marks (`feedback_check_outbox_before_replying`), so the CLI path needs no cutoff stamp. Read every hit before proceeding \u2014 new mail can reprioritize everything below. (Fallback \u2014 a seat that must stamp-poll instead derives the cutoff from the newest journal's CONTENT date, the filename stamp or frontmatter, **never file mtime**, which git resets on clone/worktree and silently reports \"inbox clean\" over waiting mail; mmnto-ai/totem-strategy#813.)\n\n2. **Kit-first \u2014 while a BLIND round is in flight, read the kit and nothing else.** The BLIND-kit marker is the dispatch SUBJECT's literal prefix `BLIND round: `, followed by the round's name and, in the same subject, the deposit clause `\u2014 deposit to <orchestrator-seat> by <ISO-8601 deadline>`; no frontmatter key carries it, so the subject line is what you read. **A round is in flight while such a dispatch has an unpassed deadline and no deposit received.** In flight, signon ENDS here: read the kit and the artifact the kit names, and nothing else \u2014 no `totem orient`, no journal, no knowledge search, no board or PR read \u2014 because live repository detail is precisely what a blind classification must not carry. The kit-first rule has no partial arm: if any step ran before you reached the kit, report the exposure to the round's orchestrator seat by directed mail and do not classify; a disclosed round is re-armed in a fresh session, never repaired in place.\n\n3. **Consume the injected orientation \u2014 the managed hook injects exactly two blocks.** The managed SessionStart hook injects exactly two briefing blocks \u2014 `totem describe` and `totem orient --session` \u2014 and injects nothing else: no journal and no mail (it does other work at boot, none of which reaches your context), so your latest journal (step 4) and your seat-anchored mail (step 1) are derived BY HAND on every seat, hook or not \u2014 never assumed present. Do not re-run the two blocks it did inject. A repo may also run its own session hook; whatever such a hook injects serves the seat it is CONFIGURED for, not a derived identity, so confirm the injected material is YOURS: a visiting session receives the HOST seat's, and your carryforward derives from `.totem/orchestration/<your-seat>/journal/` (step 4), never from a foreign journal. On a hook-seat MISMATCH (an injected journal or mail banner naming another seat), consume NONE of the injected material \u2014 treat the session as hook-less and derive it all: `totem orient` plus your own seat-anchored poll (step 1). Everything else the bring-up needs (the full board in-flight set, corpus freshness, doctrine currency) is derived on demand via `totem orient`. On a hook-less seat (other vendors, cold starts), derive it all: `totem orient`.\n\n4. **Re-derive the carryforward gates \u2014 don't trust the journal's framing** (Tenet 20 read-side twin). For each carryforward item in YOUR SEAT's latest journal (`.totem/orchestration/<your-seat>/journal/` \u2014 on a multi-seat repo another seat's newer journal is not your carryforward), freshly derive its gate state (the PR it waits on, the issue, the date, the release train) via `gh` / `git` reads. Cross-repo gates resolve through the frozen cohort roster \u2014 `totem` / `strategy` / `status` / `lc` \u2192 `mmnto-ai/{totem, totem-strategy, totem-status, liquid-city}` (mmnto-ai/totem-strategy#611 gates any change). An item whose gate fired leads the next-steps list; an item still gated is reported as waiting, not worked.\n\n5. **Surface owed-now sensors.** Anything the injected/derived orientation flags as owed (corpus `\u26A0 stale`, strategy-doctrine `\u26A0 publish owed`, board drift) goes on the list as a candidate \u2014 sensors report, they don't gate (Tenet 13).\n\n6. **Present and stop.** One message: state summary (seat, inbox, gate states, owed-now items) + ranked next-steps with a recommendation. Then wait for the operator's ruling \u2014 signon ends at the judgment handoff; mutations belong to the ruled work, not the bring-up.\n\n<!-- totem:skill-end -->\n";
+export declare const REVIEW_REPLY_SKILL_CONTENT = "---\nname: review-reply\ndescription: Unified PR review triage \u2014 fetch, normalize, and batch-action bot comments\n---\n\n<!-- totem:skill-start -->\n\nTriage PR review comments from all bots for PR $ARGUMENTS.\n\n## Phase 1: Fetch & Categorize (Deterministic)\n\nRun the triage command to fetch, normalize, deduplicate, and categorize all bot comments:\n\n```bash\npnpm totem triage-pr $ARGUMENTS\n```\n\nThis outputs a categorized inbox grouped by blast radius (Security \u2192 Architecture \u2192 Convention \u2192 Nits) with cross-bot deduplication already applied. The heavy lifting is done in TypeScript \u2014 no LLM math needed.\n\n**STOP HERE.** Present the output to the user and wait for them to specify actions. Do NOT proceed to Phase 2 until the user replies.\n\n## Phase 2: Execute Actions (Bulk Support)\n\nThe user may type individual IDs (e.g., `fix 4, 11`) OR use bulk actions:\n\n- `fix all security`\n- `defer all nits`\n- `extract all architecture`\n\n### `fix <numbers | category>`\n\nMark items as will-fix. No API calls \u2014 just acknowledge. The user will make code changes next.\n\n### `defer <numbers | category> [ticket]`\n\nAuto-reply on the PR acknowledging the deferral:\n\n- **CodeRabbit items:** Reply inline to each thread with \"Tracked in #NNN\" or \"Deferred \u2014 not blocking for this PR.\"\n- **GCA items:** DO NOT reply inline. Batch ALL GCA responses into ONE issue comment: `@gemini-code-assist` followed by a numbered list addressing each finding. Use `gh pr comment $ARGUMENTS --body-file -` and pipe the comment body via stdin.\n- **ghcq items:** `github-code-quality[bot]` has no known @-listener (attested: no in-org tag attempt has drawn a response and none is documented \u2014 mmnto-ai/totem#2626) \u2014 do not tag it; treat its dispositions as audit-trail-only.\n- **SARIF items:** No reply needed (our own tool).\n\n### `nit <numbers | category>`\n\nSame as defer but reply text is \"Acknowledged \u2014 nit / by design.\"\n\n### `extract <numbers | category>`\n\nFor each selected finding, generate a lesson and call `mcp__totem-dev__add_lesson` (or equivalent):\n\n- Use the bot's finding as the lesson body\n- Add relevant tags from the file path and finding category\n- The lesson will automatically get `lifecycle: nursery` treatment\n\n### `done`\n\nPrint a summary of actions taken, then \u2014 when the round is being dispositioned \u2014 assemble and post the single consolidated round-disposition comment (see the section below), which EXECUTES `totem review --covariate` to carry the `local-lane:` line, on the operator's explicit go. Then, as the LAST action of the round, run `totem resolve-threads` (step 4 of that section) \u2014 dry first, `--apply` only on the operator's explicit go. Then exit.\n\n## CRITICAL: GCA Reply Protocol\n\n**NEVER reply individually to GCA bot comments.** GCA has a quota and will NOT respond to replies unless they contain `@gemini-code-assist`. Always batch ALL GCA responses into a single PR-level comment using the issue comments API endpoint (`/issues/{pr}/comments`), not the review comments reply endpoint.\n\n## Consolidated round-disposition comment (a concrete step, operator-gated)\n\nDisposing the round is ONE consolidated comment (single-comment ownership per bot-protocols) \u2014 a real, numbered step of the flow, NOT an optional aside. Like every GitHub mutation in this skill it is operator-gated: assemble the body, show it, and post ONLY on an explicit human go. Run this as part of `done` (or whenever the operator asks to post the round disposition):\n\n1. **Obtain the covariate line \u2014 execute the verb, never hand-author it.** Run the read-only, zero-LLM command and capture its stdout:\n\n```bash\ntotem review --covariate\n```\n\nIt resolves the current branch lineage exactly as the review fan does and prints the canonical `local-lane:` line from the core-owned renderers \u2014 the LATEST verdict artifact's line (`.totem/artifacts/verdicts/`) when the current diff is admitted, or the exact-identity admission record's `not-applicable` form (`.totem/artifacts/admissions/`, format v1.1, mmnto-ai/totem#2473) when the current diff is a deterministic skip \u2014 never trust a pasted or hand-copied value. Under format v1.2 (mmnto-ai/totem#2698) every shape carries the appended `leg: <sha8> blocking=<n> material=<n> folded=<n>` field (or `leg: none`), and a lineage with no artifact of either family but a leg deposit for HEAD prints the `local-lane: none` head shape \u2014 carry whatever the verb prints, verbatim. If it reports no line at all, there is none to carry (note that in the body and continue).\n\n2. **Assemble the single body.** One comment: @-tag EVERY bot addressed in the round \u2014 exactly ONE tag each (e.g. `@gemini-code-assist`, `@coderabbitai`, `@greptileai`) so each bot registers the disposition, and tags must be present when the comment is POSTED, never edited in (GCA's listener fires on comment-created only). One notification per bot per round: a bot with nothing addressed gets no tag, and a bot already @-tagged in this round's batch comment (the GCA defer/nit batch above) is NOT re-tagged here. ghcq (`github-code-quality[bot]`) has no known listener \u2014 it is never tagged; its items are dispositioned in the body for the audit trail only (mmnto-ai/totem#2626). Never combine a tag with ANY bot's review trigger \u2014 triggers are standalone comments, one trigger and no prose (a trigger embedded in a content-rich comment chat-routes the bot). Then the per-item dispositions (fixed / deferred / nit / extracted) followed by the non-empty `local-lane:` line from step 1, verbatim. The local `review-loop` holds this line but never posts it, so `/review-reply` is the SOLE path that carries it to GitHub.\n\n3. **Post on an explicit go.** Show the assembled body and wait for the operator; on their go, post the ONE comment with `gh pr comment $ARGUMENTS --body-file -` (pipe the body via stdin). Never mutate the PR autonomously.\n\n4. **Resolve the threads this round dispositioned \u2014 dry first, `--apply` on the operator's explicit go.** The comment you just posted IS the evidence the verb reads, so this step runs AFTER it, and it is the LAST action of the round. Print the plan (this never mutates):\n\n```bash\ntotem resolve-threads $ARGUMENTS\n```\n\nEvery bot-rooted thread prints one row carrying its REST root comment id and a verdict: `resolve`, `skip:already-resolved`, `skip:outdated`, `skip:no-evidence`, `skip:not-selected`. A `skip:no-evidence` row is a thread this round has not answered \u2014 neither an in-thread reply from a human nor a PR-level comment created after that thread's root \u2014 and the verb will NEVER resolve it under any flag; give it evidence and re-run rather than working around it. Show the plan and wait. Only on the operator's explicit go, run the mutating half (add `--ids <comma-separated REST root comment ids>` to narrow it to named rows; an unmatched id aborts before anything is resolved):\n\n```bash\ntotem resolve-threads $ARGUMENTS --apply\n```\n\nThe verb never posts a comment, a reply or a review \u2014 the only mutation it can issue is `resolveReviewThread`, which is what the merge-ready gate's unresolved-bot-threads predicate reads. Exit `2` means it did not do everything asked (an unmatched id, a failed mutation, or a selected thread with no evidence); exit `1` means the read did not complete and NOTHING was resolved. Report what it printed, verbatim.\n\n<!-- totem:skill-end -->\n";
 export declare const REVIEW_LOOP_SKILL_CONTENT = "---\nname: review-loop\ndescription: Drive the local pre-push review loop to settle \u2014 absorb findings locally before any external bot pass\n---\n\n<!-- totem:skill-start -->\n\nDrive the LOCAL pre-push review loop to convergence: run the review, absorb its findings, re-run, and repeat until the CLI reports the round **settled** \u2014 before any external bot pass. The loop state (round chaining, the settle computation, lane coverage) is entirely CLI-owned; this skill is a thin driver. Do not reimplement settle logic or count rounds yourself \u2014 read what the CLI reports.\n\nThis is NOT the external-bot triage skill. `/review-reply` handles bot comments on a PR; do NOT invoke external review bots (CodeRabbit, Gemini Code Assist, Greptile) from here. This loop settles local findings first.\n\n## The loop\n\n1. **Run the review.** `totem review` runs the repo's configured lanes. Do NOT pass `--model` unless the user explicitly asked for a one-lane run \u2014 an explicit `--model` selects a single-lane invocation and never joins the configured fan. If `review.lanes` is not configured, `totem review` runs the legacy single-lane path and emits NO verdict artifact or `local-lane:` line \u2014 this loop's contract requires the verdict artifact, so configure `review.lanes` first (a single entry suffices).\n\n2. **Read the reported outcome.** The CLI reports the findings, the lane coverage (completed / attempted), the settled state, and the round number. Take them as reported \u2014 do not derive `settled` yourself.\n\n3. **If not settled: apply fixes, then re-run.** Fix the actionable findings \u2014 **WARN and CRITICAL are actionable; INFO is cosmetic** and can be skipped. Then re-run `totem review`; the CLI chains the next round automatically from the prior verdict. An explicit `--continues <verdict-hash>` override exists for the rare case where the CLI reports a lineage fork you know is wrong (e.g. a rebase it mis-linked) \u2014 otherwise let it chain on its own.\n\n4. **Repeat until settled \u2014 or stop honestly.** Loop until the CLI reports the round **settled**. Stop and report if the CLI's max-rounds advisory fires, or a finding is disputed. Never loop forever, and never silently override a disputed finding \u2014 a dispute goes to the human.\n\n## Honesty rules\n\n- **Never use `--override` without an explicit human go.** It is trap-ledgered.\n- **A degraded round is never settled.** If completed < attempted (a lane failed), the round did not settle \u2014 say so; a dropped lane is not a pass.\n- **Report the outcome faithfully** \u2014 the findings, the counts, and the settled state exactly as the CLI reports them.\n\n## At settle: hold the covariate line locally (never post a PR comment)\n\n`review-loop` NEVER creates or posts a PR comment. The local loop runs BEFORE any external bot pass, and the round-disposition comment is ONE consolidated comment owned by the operator-invoked `/review-reply` workflow. At settle the CLI already prints the covariate line \u2014 hold and report it locally, in exactly this format:\n\n<!-- covariate line format v1.2 \u2014 do not alter without a spec amendment (v1.1 added the additive admission form; v1.2 appends the leg field to both shapes and adds the `local-lane: none` head for a deposit-only lineage: mmnto-ai/totem#2698 design \u00A7 Implementation Design, the .totem/specs/2473.md v1.2 clause) -->\n\n```text\nlocal-lane: <verdictHash8> round=<n> settled=<true|false> lanes=<completed>/<attempted> leg: <sha8> blocking=<n> material=<n> folded=<n>\nlocal-lane: not-applicable (<reason>) recorded=<recordHash8> at=<createdAt> leg: <sha8> blocking=<n> material=<n> folded=<n>\nlocal-lane: none leg: <sha8> blocking=<n> material=<n> folded=<n>\n```\n\n`<verdictHash8>` is the first 8 hex characters of the verdict artifact hash the CLI reports. The second shape is the ADMISSION form (format v1.1, mmnto-ai/totem#2473): rendered when the current diff resolves to a deterministic not-applicable admission \u2014 `<recordHash8>` addresses the admission record in `.totem/artifacts/admissions/`, and it is discriminated on the literal second token `not-applicable`. The third shape is the DEPOSIT-ONLY head: rendered when no verdict and no admission record exists for the lineage but a leg deposit resolves for HEAD, so a diff is never presented with no evidence line at all. `leg: none` replaces the field on the FIRST TWO shapes when no deposit resolves for HEAD; the third shape never carries it, because a deposit resolving is the only reason that shape renders. Consumers discriminate on the second token (`<hash8>` \u00B7 `not-applicable` \u00B7 `none`); `<sha8>` is the first 8 hex of the deposit's `diffSha`; a folded finding counts in both its severity bucket and `folded`. This line is a versioned contract consumed by a measurement pilot \u2014 do not change any shape without a spec amendment. The CLI renders every shape from its canonical artifacts via single core-owned renderers, so the line is re-derivable and never hand-authored \u2014 on demand, the read-only `totem review --covariate` (zero-LLM) resolves the current state and prints the verdict's line (admitted diff), the admission record's line (deterministic skip), or the deposit-only head (neither artifact exists for the lineage, but a leg read HEAD). Inclusion of any pending `local-lane:` line in the single consolidated round-disposition comment belongs to `/review-reply` (which obtains it by running `totem review --covariate`), not to this loop \u2014 never post it to GitHub yourself.\n\n<!-- totem:skill-end -->\n";
 export declare const DISTRIBUTED_CLAUDE_SKILLS: readonly [{
     readonly name: "signoff";
     readonly content: string;
 }, {
     readonly name: "signon";
-    readonly content: "---\nname: signon\ndescription: Session-start — consume/derive orientation, poll mail since last signoff, re-derive carryforward gates, present next-steps for operator ruling\n---\n\n<!-- totem:skill-start -->\n\nSession-start bring-up. **Read-only** — no mutations, no dispatches, no board edits until the operator rules on next steps (Proposal 295 d2: read-only orient + grounded next-work). Solo — no agent fleet (`feedback_session_start_derive_cheaply`: cheap derivation IS the validation dogfood).\n\n1. **Consume the injected orientation.** On Claude Code seats a SessionStart hook may inject a journal + carryforward, inbound mail, branch/ticket-matched context, and a bounded session-orientation slice (parked/freeze state, open PRs, board↔issue coherence drift, and an open-issue-count pointer) — the hook serves the seat it is CONFIGURED for, not a derived identity, so confirm the injected journal is YOURS: a visiting session receives the HOST seat's, and your carryforward derives from `.totem/orchestration/<your-seat>/journal/` (step 3), never from a foreign journal. On a hook-seat MISMATCH (the injected journal or mail banner names another seat), consume NONE of the injected material — treat the session as hook-less: derive it all via `totem orient` plus your own seat-anchored poll (step 2). Do not re-run what the hook injected. Everything else the bring-up needs (the full board in-flight set, corpus freshness, doctrine currency) is derived on demand via `totem orient`. On a hook-less seat (other vendors, cold starts), derive it all: `totem orient`.\n\n2. **Poll mail since last signoff — seat-anchored.** Poll AS YOUR SEAT: per-shell `TOTEM_SELF_AGENT=<your-seat>` (the mmnto-ai/totem#2629 scope ruling — never user/machine scope; prefer the inline form `TOTEM_SELF_AGENT=<seat> totem mail` where shell state does not persist between tool calls) or `totem mail --as <your-seat>`. **S0 identity check:** the banner's `Self agents:` line must name exactly your seat. Since @mmnto/cli 1.117.0 an identity-less multi-seat poll gates itself (broadcast-only serve, directed mail withheld as a count, exit 2 — the mmnto-ai/totem#2204 deterministic floor), so the residual S0 catches is the WRONG-single-identity class: a mis-scoped or inherited env naming a foreign seat resolves single-seat, ungated, and serves that seat's directed mail. A banner naming a FOREIGN seat = STOP: act on nothing served, propagate nothing from it, fix the identity, re-poll. A GATED poll's LISTING is broadcast-only by construction — but warning lines can still name an unclassifiable or unresolvable file (an ECL basename is recipient + compressed subject — the CLI's named limit), so propagate nothing from a gated poll's warnings either: fix the identity and re-poll for your directed mail. An `Error:` line is the same surface: since the mmnto-ai/totem#2685 fix a poll whose OWN outbox (one this repo hosts for a resolved seat) carries a dispatch with an unresolvable `to:` exits 4 (SENDER FAULT) — the verdict IS derived, read it, but the `to:` is yours to fix first (one recipient per dispatch, or broadcast; a comma list is never a recipient), and propagate nothing from the fault line; exit 2 stays NOT-DERIVED and wins when both hold. Unread = inbound − handled: consumption is tracked by `processed/` marks (`feedback_check_outbox_before_replying`), so the CLI path needs no cutoff stamp. Read every hit before proceeding — new mail can reprioritize everything below. (Fallback — a seat that must stamp-poll instead derives the cutoff from the newest journal's CONTENT date, the filename stamp or frontmatter, **never file mtime**, which git resets on clone/worktree and silently reports \"inbox clean\" over waiting mail; mmnto-ai/totem-strategy#813.)\n\n3. **Re-derive the carryforward gates — don't trust the journal's framing** (Tenet 20 read-side twin). For each carryforward item in YOUR SEAT's latest journal (`.totem/orchestration/<your-seat>/journal/` — on a multi-seat repo another seat's newer journal is not your carryforward), freshly derive its gate state (the PR it waits on, the issue, the date, the release train) via `gh` / `git` reads. Cross-repo gates resolve through the frozen cohort roster — `totem` / `strategy` / `status` / `lc` → `mmnto-ai/{totem, totem-strategy, totem-status, liquid-city}` (mmnto-ai/totem-strategy#611 gates any change). An item whose gate fired leads the next-steps list; an item still gated is reported as waiting, not worked.\n\n4. **Surface owed-now sensors.** Anything the injected/derived orientation flags as owed (corpus `⚠ stale`, strategy-doctrine `⚠ publish owed`, board drift) goes on the list as a candidate — sensors report, they don't gate (Tenet 13).\n\n5. **Present and stop.** One message: state summary (inbox, gate states, owed-now items) + ranked next-steps with a recommendation. Then wait for the operator's ruling — signon ends at the judgment handoff; mutations belong to the ruled work, not the bring-up.\n\n<!-- totem:skill-end -->\n";
+    readonly content: "---\nname: signon\ndescription: Session-start — consume/derive orientation, poll mail since last signoff, re-derive carryforward gates, present next-steps for operator ruling\n---\n\n<!-- totem:skill-start -->\n\nSession-start bring-up. **Read-only** — no mutations, no dispatches, no board edits until the operator rules on next steps (Proposal 295 d2: read-only orient + grounded next-work). Solo — no agent fleet (`feedback_session_start_derive_cheaply`: cheap derivation IS the validation dogfood).\n\n0. **Derive the seat FIRST — before orient, before any journal read, before any knowledge search** (mmnto-ai/totem#2801). Read the INHERITED `TOTEM_SELF_AGENT` this session was launched with; `totem mail --derive-seat` is the probe — one stdout line `seat=<id> source=env` and exit 0 when the inherited env names exactly one seat this repo hosts, otherwise a stderr refusal (exit 2) naming the supplied value (or `unset`) and every seat this repo hosts. **Hosts** means one thing everywhere: config.json `host_agents`, else the seat dirs, else the cohort map keyed on the origin repository — never the env you supplied, which is the thing being checked. **Set → that is your seat: use it, and never write a different one.** An inline `TOTEM_SELF_AGENT=<seat>` on any later command may only RESTATE the inherited value; writing a different seat over it silently re-points every step below at a seat that is not yours, and once overridden the tool can no longer see what you inherited — the operator's account is the only witness left. **Set but REFUSED** (the probe exits 2 while the env names a seat): your declaration and this repo disagree, so act as if you have no seat — put the refusal line itself in front of the operator, verbatim, and change nothing to make it pass; signon is read-only, so `totem seat add` is never run here. On a repo with no seat registration at all the refusal says the repo cannot CORROBORATE you, not that your seat is wrong: `totem mail --as <your-seat>` and a per-shell poll still serve your declaration, because a declaration on the command line is yours to make and this probe only checks one. **Empty → STOP and ask the operator.** Do not guess, do not fall back to the crown, do not derive a seat from the repo basename, the branch, or the only seat in sight; a bring-up on an unknown identity is worse than no bring-up. Report exactly one line and wait: `Failure Mode: Hook-less session launched without TOTEM_SELF_AGENT set.`\n\n1. **Assignment mail before orient — poll since last signoff, seat-anchored.** On a hook-less seat the order is fixed: assignment mail before orient, before any journal read, and before any knowledge search — an assignment can turn every one of those into a disclosure (step 2), and the managed hook derives neither the poll nor the journal for you (step 3). Poll AS YOUR SEAT: per-shell `TOTEM_SELF_AGENT=<your-seat>` (the mmnto-ai/totem#2629 scope ruling — never user/machine scope; prefer the inline form `TOTEM_SELF_AGENT=<seat> totem mail` where shell state does not persist between tool calls, and on a session whose step-0 env is already set that inline form RESTATES that seat and never another) or `totem mail --as <your-seat>`. **S0 identity check:** the banner's `Self agents:` line must name exactly your seat. Since @mmnto/cli 1.117.0 an identity-less multi-seat poll gates itself (broadcast-only serve, directed mail withheld as a count, exit 2 — the mmnto-ai/totem#2204 deterministic floor), so the residual S0 catches is the WRONG-single-identity class: a mis-scoped or inherited env naming a foreign seat resolves single-seat, ungated, and serves that seat's directed mail. A banner naming a FOREIGN seat = STOP: act on nothing served, propagate nothing from it, fix the identity, re-poll. A GATED poll's LISTING is broadcast-only by construction — but warning lines can still name an unclassifiable or unresolvable file (an ECL basename is recipient + compressed subject — the CLI's named limit), so propagate nothing from a gated poll's warnings either: fix the identity and re-poll for your directed mail. An `Error:` line is the same surface: since the mmnto-ai/totem#2685 fix a poll whose OWN outbox (one this repo hosts for a resolved seat) carries a dispatch with an unresolvable `to:` exits 4 (SENDER FAULT) — the verdict IS derived, read it, but the `to:` is yours to fix first (one recipient per dispatch, or broadcast; a comma list is never a recipient), and propagate nothing from the fault line; exit 2 stays NOT-DERIVED and wins when both hold. Unread = inbound − handled: consumption is tracked by `processed/` marks (`feedback_check_outbox_before_replying`), so the CLI path needs no cutoff stamp. Read every hit before proceeding — new mail can reprioritize everything below. (Fallback — a seat that must stamp-poll instead derives the cutoff from the newest journal's CONTENT date, the filename stamp or frontmatter, **never file mtime**, which git resets on clone/worktree and silently reports \"inbox clean\" over waiting mail; mmnto-ai/totem-strategy#813.)\n\n2. **Kit-first — while a BLIND round is in flight, read the kit and nothing else.** The BLIND-kit marker is the dispatch SUBJECT's literal prefix `BLIND round: `, followed by the round's name and, in the same subject, the deposit clause `— deposit to <orchestrator-seat> by <ISO-8601 deadline>`; no frontmatter key carries it, so the subject line is what you read. **A round is in flight while such a dispatch has an unpassed deadline and no deposit received.** In flight, signon ENDS here: read the kit and the artifact the kit names, and nothing else — no `totem orient`, no journal, no knowledge search, no board or PR read — because live repository detail is precisely what a blind classification must not carry. The kit-first rule has no partial arm: if any step ran before you reached the kit, report the exposure to the round's orchestrator seat by directed mail and do not classify; a disclosed round is re-armed in a fresh session, never repaired in place.\n\n3. **Consume the injected orientation — the managed hook injects exactly two blocks.** The managed SessionStart hook injects exactly two briefing blocks — `totem describe` and `totem orient --session` — and injects nothing else: no journal and no mail (it does other work at boot, none of which reaches your context), so your latest journal (step 4) and your seat-anchored mail (step 1) are derived BY HAND on every seat, hook or not — never assumed present. Do not re-run the two blocks it did inject. A repo may also run its own session hook; whatever such a hook injects serves the seat it is CONFIGURED for, not a derived identity, so confirm the injected material is YOURS: a visiting session receives the HOST seat's, and your carryforward derives from `.totem/orchestration/<your-seat>/journal/` (step 4), never from a foreign journal. On a hook-seat MISMATCH (an injected journal or mail banner naming another seat), consume NONE of the injected material — treat the session as hook-less and derive it all: `totem orient` plus your own seat-anchored poll (step 1). Everything else the bring-up needs (the full board in-flight set, corpus freshness, doctrine currency) is derived on demand via `totem orient`. On a hook-less seat (other vendors, cold starts), derive it all: `totem orient`.\n\n4. **Re-derive the carryforward gates — don't trust the journal's framing** (Tenet 20 read-side twin). For each carryforward item in YOUR SEAT's latest journal (`.totem/orchestration/<your-seat>/journal/` — on a multi-seat repo another seat's newer journal is not your carryforward), freshly derive its gate state (the PR it waits on, the issue, the date, the release train) via `gh` / `git` reads. Cross-repo gates resolve through the frozen cohort roster — `totem` / `strategy` / `status` / `lc` → `mmnto-ai/{totem, totem-strategy, totem-status, liquid-city}` (mmnto-ai/totem-strategy#611 gates any change). An item whose gate fired leads the next-steps list; an item still gated is reported as waiting, not worked.\n\n5. **Surface owed-now sensors.** Anything the injected/derived orientation flags as owed (corpus `⚠ stale`, strategy-doctrine `⚠ publish owed`, board drift) goes on the list as a candidate — sensors report, they don't gate (Tenet 13).\n\n6. **Present and stop.** One message: state summary (seat, inbox, gate states, owed-now items) + ranked next-steps with a recommendation. Then wait for the operator's ruling — signon ends at the judgment handoff; mutations belong to the ruled work, not the bring-up.\n\n<!-- totem:skill-end -->\n";
 }, {
     readonly name: "review-reply";
-    readonly content: "---\nname: review-reply\ndescription: Unified PR review triage — fetch, normalize, and batch-action bot comments\n---\n\n<!-- totem:skill-start -->\n\nTriage PR review comments from all bots for PR $ARGUMENTS.\n\n## Phase 1: Fetch & Categorize (Deterministic)\n\nRun the triage command to fetch, normalize, deduplicate, and categorize all bot comments:\n\n```bash\npnpm totem triage-pr $ARGUMENTS\n```\n\nThis outputs a categorized inbox grouped by blast radius (Security → Architecture → Convention → Nits) with cross-bot deduplication already applied. The heavy lifting is done in TypeScript — no LLM math needed.\n\n**STOP HERE.** Present the output to the user and wait for them to specify actions. Do NOT proceed to Phase 2 until the user replies.\n\n## Phase 2: Execute Actions (Bulk Support)\n\nThe user may type individual IDs (e.g., `fix 4, 11`) OR use bulk actions:\n\n- `fix all security`\n- `defer all nits`\n- `extract all architecture`\n\n### `fix <numbers | category>`\n\nMark items as will-fix. No API calls — just acknowledge. The user will make code changes next.\n\n### `defer <numbers | category> [ticket]`\n\nAuto-reply on the PR acknowledging the deferral:\n\n- **CodeRabbit items:** Reply inline to each thread with \"Tracked in #NNN\" or \"Deferred — not blocking for this PR.\"\n- **GCA items:** DO NOT reply inline. Batch ALL GCA responses into ONE issue comment: `@gemini-code-assist` followed by a numbered list addressing each finding. Use `gh pr comment $ARGUMENTS --body-file -` and pipe the comment body via stdin.\n- **ghcq items:** `github-code-quality[bot]` has no known @-listener (attested: no in-org tag attempt has drawn a response and none is documented — mmnto-ai/totem#2626) — do not tag it; treat its dispositions as audit-trail-only.\n- **SARIF items:** No reply needed (our own tool).\n\n### `nit <numbers | category>`\n\nSame as defer but reply text is \"Acknowledged — nit / by design.\"\n\n### `extract <numbers | category>`\n\nFor each selected finding, generate a lesson and call `mcp__totem-dev__add_lesson` (or equivalent):\n\n- Use the bot's finding as the lesson body\n- Add relevant tags from the file path and finding category\n- The lesson will automatically get `lifecycle: nursery` treatment\n\n### `done`\n\nPrint a summary of actions taken, then — when the round is being dispositioned — assemble and post the single consolidated round-disposition comment (see the section below), which EXECUTES `totem review --covariate` to carry the `local-lane:` line, on the operator's explicit go. Then exit.\n\n## CRITICAL: GCA Reply Protocol\n\n**NEVER reply individually to GCA bot comments.** GCA has a quota and will NOT respond to replies unless they contain `@gemini-code-assist`. Always batch ALL GCA responses into a single PR-level comment using the issue comments API endpoint (`/issues/{pr}/comments`), not the review comments reply endpoint.\n\n## Consolidated round-disposition comment (a concrete step, operator-gated)\n\nDisposing the round is ONE consolidated comment (single-comment ownership per bot-protocols) — a real, numbered step of the flow, NOT an optional aside. Like every GitHub mutation in this skill it is operator-gated: assemble the body, show it, and post ONLY on an explicit human go. Run this as part of `done` (or whenever the operator asks to post the round disposition):\n\n1. **Obtain the covariate line — execute the verb, never hand-author it.** Run the read-only, zero-LLM command and capture its stdout:\n\n```bash\ntotem review --covariate\n```\n\nIt resolves the current branch lineage exactly as the review fan does and prints the canonical `local-lane:` line from the core-owned renderers — the LATEST verdict artifact's line (`.totem/artifacts/verdicts/`) when the current diff is admitted, or the exact-identity admission record's `not-applicable` form (`.totem/artifacts/admissions/`, format v1.1, mmnto-ai/totem#2473) when the current diff is a deterministic skip — never trust a pasted or hand-copied value. Under format v1.2 (mmnto-ai/totem#2698) every shape carries the appended `leg: <sha8> blocking=<n> material=<n> folded=<n>` field (or `leg: none`), and a lineage with no artifact of either family but a leg deposit for HEAD prints the `local-lane: none` head shape — carry whatever the verb prints, verbatim. If it reports no line at all, there is none to carry (note that in the body and continue).\n\n2. **Assemble the single body.** One comment: @-tag EVERY bot addressed in the round — exactly ONE tag each (e.g. `@gemini-code-assist`, `@coderabbitai`, `@greptileai`) so each bot registers the disposition, and tags must be present when the comment is POSTED, never edited in (GCA's listener fires on comment-created only). One notification per bot per round: a bot with nothing addressed gets no tag, and a bot already @-tagged in this round's batch comment (the GCA defer/nit batch above) is NOT re-tagged here. ghcq (`github-code-quality[bot]`) has no known listener — it is never tagged; its items are dispositioned in the body for the audit trail only (mmnto-ai/totem#2626). Never combine a tag with ANY bot's review trigger — triggers are standalone comments, one trigger and no prose (a trigger embedded in a content-rich comment chat-routes the bot). Then the per-item dispositions (fixed / deferred / nit / extracted) followed by the non-empty `local-lane:` line from step 1, verbatim. The local `review-loop` holds this line but never posts it, so `/review-reply` is the SOLE path that carries it to GitHub.\n\n3. **Post on an explicit go.** Show the assembled body and wait for the operator; on their go, post the ONE comment with `gh pr comment $ARGUMENTS --body-file -` (pipe the body via stdin). Never mutate the PR autonomously.\n\n<!-- totem:skill-end -->\n";
+    readonly content: "---\nname: review-reply\ndescription: Unified PR review triage — fetch, normalize, and batch-action bot comments\n---\n\n<!-- totem:skill-start -->\n\nTriage PR review comments from all bots for PR $ARGUMENTS.\n\n## Phase 1: Fetch & Categorize (Deterministic)\n\nRun the triage command to fetch, normalize, deduplicate, and categorize all bot comments:\n\n```bash\npnpm totem triage-pr $ARGUMENTS\n```\n\nThis outputs a categorized inbox grouped by blast radius (Security → Architecture → Convention → Nits) with cross-bot deduplication already applied. The heavy lifting is done in TypeScript — no LLM math needed.\n\n**STOP HERE.** Present the output to the user and wait for them to specify actions. Do NOT proceed to Phase 2 until the user replies.\n\n## Phase 2: Execute Actions (Bulk Support)\n\nThe user may type individual IDs (e.g., `fix 4, 11`) OR use bulk actions:\n\n- `fix all security`\n- `defer all nits`\n- `extract all architecture`\n\n### `fix <numbers | category>`\n\nMark items as will-fix. No API calls — just acknowledge. The user will make code changes next.\n\n### `defer <numbers | category> [ticket]`\n\nAuto-reply on the PR acknowledging the deferral:\n\n- **CodeRabbit items:** Reply inline to each thread with \"Tracked in #NNN\" or \"Deferred — not blocking for this PR.\"\n- **GCA items:** DO NOT reply inline. Batch ALL GCA responses into ONE issue comment: `@gemini-code-assist` followed by a numbered list addressing each finding. Use `gh pr comment $ARGUMENTS --body-file -` and pipe the comment body via stdin.\n- **ghcq items:** `github-code-quality[bot]` has no known @-listener (attested: no in-org tag attempt has drawn a response and none is documented — mmnto-ai/totem#2626) — do not tag it; treat its dispositions as audit-trail-only.\n- **SARIF items:** No reply needed (our own tool).\n\n### `nit <numbers | category>`\n\nSame as defer but reply text is \"Acknowledged — nit / by design.\"\n\n### `extract <numbers | category>`\n\nFor each selected finding, generate a lesson and call `mcp__totem-dev__add_lesson` (or equivalent):\n\n- Use the bot's finding as the lesson body\n- Add relevant tags from the file path and finding category\n- The lesson will automatically get `lifecycle: nursery` treatment\n\n### `done`\n\nPrint a summary of actions taken, then — when the round is being dispositioned — assemble and post the single consolidated round-disposition comment (see the section below), which EXECUTES `totem review --covariate` to carry the `local-lane:` line, on the operator's explicit go. Then, as the LAST action of the round, run `totem resolve-threads` (step 4 of that section) — dry first, `--apply` only on the operator's explicit go. Then exit.\n\n## CRITICAL: GCA Reply Protocol\n\n**NEVER reply individually to GCA bot comments.** GCA has a quota and will NOT respond to replies unless they contain `@gemini-code-assist`. Always batch ALL GCA responses into a single PR-level comment using the issue comments API endpoint (`/issues/{pr}/comments`), not the review comments reply endpoint.\n\n## Consolidated round-disposition comment (a concrete step, operator-gated)\n\nDisposing the round is ONE consolidated comment (single-comment ownership per bot-protocols) — a real, numbered step of the flow, NOT an optional aside. Like every GitHub mutation in this skill it is operator-gated: assemble the body, show it, and post ONLY on an explicit human go. Run this as part of `done` (or whenever the operator asks to post the round disposition):\n\n1. **Obtain the covariate line — execute the verb, never hand-author it.** Run the read-only, zero-LLM command and capture its stdout:\n\n```bash\ntotem review --covariate\n```\n\nIt resolves the current branch lineage exactly as the review fan does and prints the canonical `local-lane:` line from the core-owned renderers — the LATEST verdict artifact's line (`.totem/artifacts/verdicts/`) when the current diff is admitted, or the exact-identity admission record's `not-applicable` form (`.totem/artifacts/admissions/`, format v1.1, mmnto-ai/totem#2473) when the current diff is a deterministic skip — never trust a pasted or hand-copied value. Under format v1.2 (mmnto-ai/totem#2698) every shape carries the appended `leg: <sha8> blocking=<n> material=<n> folded=<n>` field (or `leg: none`), and a lineage with no artifact of either family but a leg deposit for HEAD prints the `local-lane: none` head shape — carry whatever the verb prints, verbatim. If it reports no line at all, there is none to carry (note that in the body and continue).\n\n2. **Assemble the single body.** One comment: @-tag EVERY bot addressed in the round — exactly ONE tag each (e.g. `@gemini-code-assist`, `@coderabbitai`, `@greptileai`) so each bot registers the disposition, and tags must be present when the comment is POSTED, never edited in (GCA's listener fires on comment-created only). One notification per bot per round: a bot with nothing addressed gets no tag, and a bot already @-tagged in this round's batch comment (the GCA defer/nit batch above) is NOT re-tagged here. ghcq (`github-code-quality[bot]`) has no known listener — it is never tagged; its items are dispositioned in the body for the audit trail only (mmnto-ai/totem#2626). Never combine a tag with ANY bot's review trigger — triggers are standalone comments, one trigger and no prose (a trigger embedded in a content-rich comment chat-routes the bot). Then the per-item dispositions (fixed / deferred / nit / extracted) followed by the non-empty `local-lane:` line from step 1, verbatim. The local `review-loop` holds this line but never posts it, so `/review-reply` is the SOLE path that carries it to GitHub.\n\n3. **Post on an explicit go.** Show the assembled body and wait for the operator; on their go, post the ONE comment with `gh pr comment $ARGUMENTS --body-file -` (pipe the body via stdin). Never mutate the PR autonomously.\n\n4. **Resolve the threads this round dispositioned — dry first, `--apply` on the operator's explicit go.** The comment you just posted IS the evidence the verb reads, so this step runs AFTER it, and it is the LAST action of the round. Print the plan (this never mutates):\n\n```bash\ntotem resolve-threads $ARGUMENTS\n```\n\nEvery bot-rooted thread prints one row carrying its REST root comment id and a verdict: `resolve`, `skip:already-resolved`, `skip:outdated`, `skip:no-evidence`, `skip:not-selected`. A `skip:no-evidence` row is a thread this round has not answered — neither an in-thread reply from a human nor a PR-level comment created after that thread's root — and the verb will NEVER resolve it under any flag; give it evidence and re-run rather than working around it. Show the plan and wait. Only on the operator's explicit go, run the mutating half (add `--ids <comma-separated REST root comment ids>` to narrow it to named rows; an unmatched id aborts before anything is resolved):\n\n```bash\ntotem resolve-threads $ARGUMENTS --apply\n```\n\nThe verb never posts a comment, a reply or a review — the only mutation it can issue is `resolveReviewThread`, which is what the merge-ready gate's unresolved-bot-threads predicate reads. Exit `2` means it did not do everything asked (an unmatched id, a failed mutation, or a selected thread with no evidence); exit `1` means the read did not complete and NOTHING was resolved. Report what it printed, verbatim.\n\n<!-- totem:skill-end -->\n";
 }, {
     readonly name: "review-loop";
     readonly content: "---\nname: review-loop\ndescription: Drive the local pre-push review loop to settle — absorb findings locally before any external bot pass\n---\n\n<!-- totem:skill-start -->\n\nDrive the LOCAL pre-push review loop to convergence: run the review, absorb its findings, re-run, and repeat until the CLI reports the round **settled** — before any external bot pass. The loop state (round chaining, the settle computation, lane coverage) is entirely CLI-owned; this skill is a thin driver. Do not reimplement settle logic or count rounds yourself — read what the CLI reports.\n\nThis is NOT the external-bot triage skill. `/review-reply` handles bot comments on a PR; do NOT invoke external review bots (CodeRabbit, Gemini Code Assist, Greptile) from here. This loop settles local findings first.\n\n## The loop\n\n1. **Run the review.** `totem review` runs the repo's configured lanes. Do NOT pass `--model` unless the user explicitly asked for a one-lane run — an explicit `--model` selects a single-lane invocation and never joins the configured fan. If `review.lanes` is not configured, `totem review` runs the legacy single-lane path and emits NO verdict artifact or `local-lane:` line — this loop's contract requires the verdict artifact, so configure `review.lanes` first (a single entry suffices).\n\n2. **Read the reported outcome.** The CLI reports the findings, the lane coverage (completed / attempted), the settled state, and the round number. Take them as reported — do not derive `settled` yourself.\n\n3. **If not settled: apply fixes, then re-run.** Fix the actionable findings — **WARN and CRITICAL are actionable; INFO is cosmetic** and can be skipped. Then re-run `totem review`; the CLI chains the next round automatically from the prior verdict. An explicit `--continues <verdict-hash>` override exists for the rare case where the CLI reports a lineage fork you know is wrong (e.g. a rebase it mis-linked) — otherwise let it chain on its own.\n\n4. **Repeat until settled — or stop honestly.** Loop until the CLI reports the round **settled**. Stop and report if the CLI's max-rounds advisory fires, or a finding is disputed. Never loop forever, and never silently override a disputed finding — a dispute goes to the human.\n\n## Honesty rules\n\n- **Never use `--override` without an explicit human go.** It is trap-ledgered.\n- **A degraded round is never settled.** If completed < attempted (a lane failed), the round did not settle — say so; a dropped lane is not a pass.\n- **Report the outcome faithfully** — the findings, the counts, and the settled state exactly as the CLI reports them.\n\n## At settle: hold the covariate line locally (never post a PR comment)\n\n`review-loop` NEVER creates or posts a PR comment. The local loop runs BEFORE any external bot pass, and the round-disposition comment is ONE consolidated comment owned by the operator-invoked `/review-reply` workflow. At settle the CLI already prints the covariate line — hold and report it locally, in exactly this format:\n\n<!-- covariate line format v1.2 — do not alter without a spec amendment (v1.1 added the additive admission form; v1.2 appends the leg field to both shapes and adds the `local-lane: none` head for a deposit-only lineage: mmnto-ai/totem#2698 design § Implementation Design, the .totem/specs/2473.md v1.2 clause) -->\n\n```text\nlocal-lane: <verdictHash8> round=<n> settled=<true|false> lanes=<completed>/<attempted> leg: <sha8> blocking=<n> material=<n> folded=<n>\nlocal-lane: not-applicable (<reason>) recorded=<recordHash8> at=<createdAt> leg: <sha8> blocking=<n> material=<n> folded=<n>\nlocal-lane: none leg: <sha8> blocking=<n> material=<n> folded=<n>\n```\n\n`<verdictHash8>` is the first 8 hex characters of the verdict artifact hash the CLI reports. The second shape is the ADMISSION form (format v1.1, mmnto-ai/totem#2473): rendered when the current diff resolves to a deterministic not-applicable admission — `<recordHash8>` addresses the admission record in `.totem/artifacts/admissions/`, and it is discriminated on the literal second token `not-applicable`. The third shape is the DEPOSIT-ONLY head: rendered when no verdict and no admission record exists for the lineage but a leg deposit resolves for HEAD, so a diff is never presented with no evidence line at all. `leg: none` replaces the field on the FIRST TWO shapes when no deposit resolves for HEAD; the third shape never carries it, because a deposit resolving is the only reason that shape renders. Consumers discriminate on the second token (`<hash8>` · `not-applicable` · `none`); `<sha8>` is the first 8 hex of the deposit's `diffSha`; a folded finding counts in both its severity bucket and `folded`. This line is a versioned contract consumed by a measurement pilot — do not change any shape without a spec amendment. The CLI renders every shape from its canonical artifacts via single core-owned renderers, so the line is re-derivable and never hand-authored — on demand, the read-only `totem review --covariate` (zero-LLM) resolves the current state and prints the verdict's line (admitted diff), the admission record's line (deterministic skip), or the deposit-only head (neither artifact exists for the lineage, but a leg read HEAD). Inclusion of any pending `local-lane:` line in the single consolidated round-disposition comment belongs to `/review-reply` (which obtains it by running `totem review --covariate`), not to this loop — never post it to GitHub yourself.\n\n<!-- totem:skill-end -->\n";

package/dist/commands/init-templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-templates.d.ts","sourceRoot":"","sources":["../../src/commands/init-templates.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMpE,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC,eAAO,MAAM,YAAY,kCAAkC,CAAC;AAC5D,eAAO,MAAM,UAAU,gCAAgC,CAAC;AACxD,eAAO,MAAM,iBAAiB,QAA0C,CAAC;AACzE,eAAO,MAAM,eAAe,6CAA6C,CAAC;AAE1E,eAAO,MAAM,eAAe,m+QA8C3B,CAAC;AAEF,eAAO,MAAM,iBAAiB,8BAA8B,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,kCAAkC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIxE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ9F;AAgBD,eAAO,MAAM,qBAAqB,6CAA6C,CAAC;AAwBhF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE,eAAO,MAAM,oBAAoB,8thBA8ThC,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAoO9B,CAAC;AAEF,eAAO,MAAM,YAAY,4hBAUxB,CAAC;AAIF,eAAO,MAAM,kBAAkB,waAY9B,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;CAQnC,CAAC;AA8BF,eAAO,MAAM,qBAAqB,QAyLjC,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;CAQvC,CAAC;AA4BF,eAAO,MAAM,oBAAoB,ijiBAkUhC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;CAQtC,CAAC;AAgDF,eAAO,MAAM,mBAAmB,+ghBAiV/B,CAAC;AAwBF,eAAO,MAAM,yBAAyB;;;;;;CAQrC,CAAC;AAaF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAoBhE,eAAO,MAAM,eAAe,w/GAsF3B,CAAC;AAqBF,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;CACnB;AASD,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AAMrE,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAa3E,eAAO,MAAM,wBAAwB,mCAAmC,CAAC;AAIzE,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAE/E,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,kBAAkB,CAyCnE,CAAC;AAeF,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,4BAA4B,EAAE,aAAa,CAAC,iBAAiB,CAgBzE,CAAC;AAwBF,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAC/D,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D,eAAO,MAAM,qBAAqB,QA0DjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,ghKAoBhC,CAAC;AAEF,eAAO,MAAM,0BAA0B,owLA+EtC,CAAC;AAEF,eAAO,MAAM,yBAAyB,w+KA0CrC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;EAK5B,CAAC;AAIX,wBAAsB,cAAc,CAClC,OAAO,EAAE,YAAY,EAAE,EACvB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAyCjB;AAoDD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,YAAY,EAAE,EACvB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,YAAY,EAAE,EACvB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,YAAY,EAAE,EACvB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBhD"}
+{"version":3,"file":"init-templates.d.ts","sourceRoot":"","sources":["../../src/commands/init-templates.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMpE,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC,eAAO,MAAM,YAAY,kCAAkC,CAAC;AAC5D,eAAO,MAAM,UAAU,gCAAgC,CAAC;AACxD,eAAO,MAAM,iBAAiB,QAA0C,CAAC;AACzE,eAAO,MAAM,eAAe,6CAA6C,CAAC;AAE1E,eAAO,MAAM,eAAe,m+QA8C3B,CAAC;AAEF,eAAO,MAAM,iBAAiB,8BAA8B,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,kCAAkC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIxE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ9F;AAgBD,eAAO,MAAM,qBAAqB,6CAA6C,CAAC;AAwBhF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE,eAAO,MAAM,oBAAoB,8thBA8ThC,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAoO9B,CAAC;AAEF,eAAO,MAAM,YAAY,4hBAUxB,CAAC;AAIF,eAAO,MAAM,kBAAkB,waAY9B,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;CAQnC,CAAC;AA8BF,eAAO,MAAM,qBAAqB,QAyLjC,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;CAQvC,CAAC;AA4BF,eAAO,MAAM,oBAAoB,ijiBAkUhC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;CAQtC,CAAC;AAmDF,eAAO,MAAM,mBAAmB,qi0CAu8B/B,CAAC;AAwBF,eAAO,MAAM,yBAAyB;;;;;;CAQrC,CAAC;AAaF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAoBhE,eAAO,MAAM,eAAe,w/GAsF3B,CAAC;AAqBF,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;CACnB;AASD,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AAMrE,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAa3E,eAAO,MAAM,wBAAwB,mCAAmC,CAAC;AAIzE,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAE/E,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,kBAAkB,CAyCnE,CAAC;AAeF,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,4BAA4B,EAAE,aAAa,CAAC,iBAAiB,CAgBzE,CAAC;AAwBF,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAC/D,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D,eAAO,MAAM,qBAAqB,QA0DjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,mlRAwBhC,CAAC;AAEF,eAAO,MAAM,0BAA0B,q3OA6FtC,CAAC;AAEF,eAAO,MAAM,yBAAyB,w+KA0CrC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;EAK5B,CAAC;AAIX,wBAAsB,cAAc,CAClC,OAAO,EAAE,YAAY,EAAE,EACvB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAyCjB;AAoDD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,YAAY,EAAE,EACvB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,YAAY,EAAE,EACvB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,YAAY,EAAE,EACvB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBhD"}