@mmnto/totem 1.102.0 → 1.103.0

package/dist/autoclose/matcher.test.js

@@ -0,0 +1,133 @@
+import { describe, expect, it } from 'vitest';
+import { AUTO_CLOSE_KEYWORDS, AUTO_CLOSE_REGEX_SOURCE, autoCloseKeyForms, findAutoCloseRefs, } from './matcher.js';
+/** Verbatim body of commit b8aa74a2 on main — the real #2471→#2466 specimen. */
+const B8AA74A2_BODY = 'fix(review): deterministic skip paths no longer stamp the push gate (#2466) (#2471)\n' +
+    '\n' +
+    'Three deterministic skip paths (all-generated, all-non-code, filtered-empty) no longer ' +
+    'mint the reviewed-content stamp; they log a shared NON-REVIEW notice instead. Adds coverage ' +
+    'for the .gitattributes-marked .ts bypass and the filtered-empty path. ' +
+    'Does not close #2466 (live exit-0 half deferred to #2473).';
+const refs = (t) => findAutoCloseRefs(t).map((m) => m.ref);
+describe('AUTO_CLOSE_REGEX_SOURCE / findAutoCloseRefs', () => {
+    it('exports the nine GitHub close keywords', () => {
+        expect([...AUTO_CLOSE_KEYWORDS].sort()).toEqual([
+            'close',
+            'closed',
+            'closes',
+            'fix',
+            'fixed',
+            'fixes',
+            'resolve',
+            'resolved',
+            'resolves',
+        ].sort());
+    });
+    it('compiles to a valid regex', () => {
+        expect(() => new RegExp(AUTO_CLOSE_REGEX_SOURCE, 'gi')).not.toThrow();
+    });
+    // ─── presence invariant: negated / emphasized / quoted all match ──────────
+    it('matches under NEGATION (the confirmed #2471 specimen)', () => {
+        expect(refs('Does not close #2466')).toEqual(['#2466']);
+    });
+    it('matches inside EMPHASIS', () => {
+        expect(refs('**Fixes #700**')).toEqual(['#700']);
+    });
+    it('matches inside a block QUOTE', () => {
+        expect(refs('> quoted: closes #12')).toEqual(['#12']);
+    });
+    it('matches a QUALIFIED cross-repo ref (still auto-closes)', () => {
+        expect(refs('This resolves mmnto-ai/totem#2466 upstream')).toEqual(['mmnto-ai/totem#2466']);
+    });
+    // ─── issue/PR URL form (kimi BLOCKING-1) ──────────────────────────────────
+    // GitHub's docs list only `#N` and `owner/repo#N` as closing syntaxes
+    // (docs.github.com/.../linking-a-pull-request-to-an-issue, verified: no URL
+    // form documented). The URL form is UNDOCUMENTED but EMPIRICALLY closes —
+    // isaacs/github#1731 (comment-permalink over-fire) + SAP/spartacus CONTRIBUTING
+    // (`Fixes https://github.com/SAP/spartacus/issues/<n>`). Matched
+    // presence-invariantly, normalized to the same `owner/repo#N` key.
+    it('matches the issue-URL form, normalized to owner/repo#N', () => {
+        expect(refs('Fixes https://github.com/mmnto-ai/totem/issues/2466')).toEqual([
+            'mmnto-ai/totem#2466',
+        ]);
+    });
+    it('tolerates a trailing #issuecomment- permalink fragment on the URL', () => {
+        expect(refs('Fix https://github.com/o/r/issues/123#issuecomment-999')).toEqual(['o/r#123']);
+    });
+    it('matches the /pull/ URL form too', () => {
+        expect(refs('closes https://github.com/o/r/pull/45')).toEqual(['o/r#45']);
+    });
+    it('matches MULTIPLE refs including a colon separator', () => {
+        expect(refs('Fixes: #55 and also Resolved #56')).toEqual(['#55', '#56']);
+    });
+    it('matches every keyword inflection', () => {
+        for (const kw of AUTO_CLOSE_KEYWORDS) {
+            expect(refs(`${kw} #1`)).toEqual(['#1']);
+            expect(refs(`${kw.toUpperCase()} #2`)).toEqual(['#2']);
+        }
+    });
+    it('preserves the keyword casing and records a match index', () => {
+        const [m] = findAutoCloseRefs('xx Closes #9');
+        expect(m?.keyword).toBe('Closes');
+        expect(m?.issue).toBe(9);
+        expect(m?.index).toBe(3);
+    });
+    // ─── non-matches ──────────────────────────────────────────────────────────
+    it('does NOT match subject-line parentheticals (no adjacent keyword)', () => {
+        expect(refs('fix(review): stamp the push gate (#2466) (#2471)')).toEqual([]);
+    });
+    it('does NOT match keyword substrings (prefix / affixes / fixup)', () => {
+        expect(refs('prefix #99, affixes #98, fixup #97')).toEqual([]);
+    });
+    it('does NOT match with no separator (closed#88 — GitHub declines it too)', () => {
+        expect(refs('closed#88')).toEqual([]);
+    });
+    it('does NOT match a bare ref with no keyword', () => {
+        expect(refs('See #247 above')).toEqual([]);
+    });
+    it('returns [] for empty / non-string input', () => {
+        expect(findAutoCloseRefs('')).toEqual([]);
+        expect(findAutoCloseRefs(undefined)).toEqual([]);
+    });
+    // ─── DELIBERATE pinned behavior (kimi Q1/Q2/NB-2/NB-3) ────────────────────
+    // These pin CURRENT behavior; the empirical GitHub questions are routed to the
+    // arming-phase sandbox matrix (spec §arming "open empirical questions").
+    it('DELIBERATE: emphasis/backtick wrapping ONLY the keyword => MISS', () => {
+        // `**`/backtick severs keyword→ref adjacency in the raw text.
+        expect(refs('**closes** #123')).toEqual([]);
+        expect(refs('`closes` #123')).toEqual([]);
+    });
+    it('DELIBERATE: the GH-123 autolink form => MISS (undocumented for closing)', () => {
+        expect(refs('fix GH-123')).toEqual([]);
+    });
+    it('DELIBERATE: a cross-paragraph span => MATCH (over-fires, invariant-consistent)', () => {
+        expect(refs('closes\n\n#123')).toEqual(['#123']);
+    });
+    it('DELIBERATE: a fenced code block => MATCH (over-fires; totem-context is the escape)', () => {
+        expect(refs('```\ncloses #123\n```')).toEqual(['#123']);
+    });
+    // ─── perf sanity (kimi NON-BLOCKING-1: the O(n²) is dead) ──────────────────
+    it('completes a pathological long-whitespace probe in well under 50ms', () => {
+        const probe = `fix${' '.repeat(65000)}x`; // keyword + ~64KB whitespace + non-ref
+        const t0 = performance.now();
+        findAutoCloseRefs(probe);
+        expect(performance.now() - t0).toBeLessThan(50);
+    });
+    // ─── the b8aa74a2 positive control ────────────────────────────────────────
+    it('finds exactly #2466 in the verbatim b8aa74a2 body (and NOT the parentheticals)', () => {
+        expect(refs(B8AA74A2_BODY)).toEqual(['#2466']);
+    });
+});
+describe('autoCloseKeyForms', () => {
+    it('expands a bare ref to include the self-repo qualified form', () => {
+        expect(autoCloseKeyForms({ issue: 2466 }, 'mmnto-ai/totem').sort()).toEqual(['#2466', 'mmnto-ai/totem#2466'].sort());
+    });
+    it('expands a self-qualified ref to include the bare form', () => {
+        expect(autoCloseKeyForms({ qualifier: 'mmnto-ai/totem', issue: 2466 }, 'mmnto-ai/totem').sort()).toEqual(['#2466', 'mmnto-ai/totem#2466'].sort());
+    });
+    it('keeps a cross-repo qualified ref distinct from the bare form', () => {
+        expect(autoCloseKeyForms({ qualifier: 'mmnto-ai/other', issue: 5 }, 'mmnto-ai/totem')).toEqual([
+            'mmnto-ai/other#5',
+        ]);
+    });
+});
+//# sourceMappingURL=matcher.test.js.map

package/dist/autoclose/matcher.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.test.js","sourceRoot":"","sources":["../../src/autoclose/matcher.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,gFAAgF;AAChF,MAAM,aAAa,GACjB,uFAAuF;IACvF,IAAI;IACJ,yFAAyF;IACzF,8FAA8F;IAC9F,wEAAwE;IACxE,4DAA4D,CAAC;AAE/D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEnE,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAC7C;YACE,OAAO;YACP,QAAQ;YACR,QAAQ;YACR,KAAK;YACL,OAAO;YACP,OAAO;YACP,SAAS;YACT,UAAU;YACV,UAAU;SACX,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAE7E,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,gFAAgF;IAChF,iEAAiE;IACjE,mEAAmE;IAEnE,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1E,qBAAqB;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAE7E,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,iBAAiB,CAAC,SAA8B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IAEzE,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,8DAA8D;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAE9E,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,uCAAuC;QACjF,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC7B,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAE7E,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CACzE,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,IAAI,EAAE,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CACJ,iBAAiB,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,CACzF,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7F,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/autoclose/merge-config.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Repo merge-config posture assertion for the auto-close enforcement seam
+ * (mmnto-ai/totem#1762, E-lever addendum — strategy-claude 2026-07-21T0235Z; the
+ * squash-only extension — codex supplement 2026-07-21T0356Z).
+ *
+ * The operator flipped all four governed repos to
+ * `squash_merge_commit_title: PR_TITLE` + `squash_merge_commit_message: BLANK`
+ * (executed 2026-07-21T02:30Z). BLANK stops GitHub composing a squash body from
+ * COMMIT_MESSAGES, so the server-composed close-keyword channel is gone; PR_TITLE
+ * makes the squash subject deterministically the PR title (a surface D1 already
+ * scans pre-merge).
+ *
+ * D1 also asserts SQUASH-ONLY (`allow_squash_merge` on, `allow_merge_commit` and
+ * `allow_rebase_merge` off). This is what LICENSES D2's single-HEAD, `(#N)`-subject
+ * assumption: a rebase merge pushes several commits (an earlier close-keyword
+ * commit would never be scanned when only the final SHA is read), and a regular
+ * merge commit need not carry the squash-subject form (breaking receipt
+ * correlation). Enabling squash-only is an OPERATOR settings action (routed
+ * separately, like the E lever); until flipped, D1 reds loudly by design.
+ *
+ * A repo setting is one careless settings-page click from silently reverting — so
+ * D1 ASSERTS the whole posture at workflow start and fails loud on drift (Tenet 4
+ * parity-test rule applied to repo config; a "keep it set" intention is not a
+ * coupling mechanism). Candidate standing row for the mmnto-ai/totem-strategy#482
+ * parity manifest.
+ *
+ * Pure evaluator — thin GraphQL glue lives in the D1 script. The source is
+ * GraphQL (`squashMergeAllowed` / `mergeCommitAllowed` / `rebaseMergeAllowed` /
+ * `squashMergeCommitTitle` / `squashMergeCommitMessage`), NOT the REST repos
+ * endpoint: REST omits the merge-policy fields for callers without admin
+ * visibility, and the Actions `GITHUB_TOKEN` is such a caller — discovered on
+ * D1's first live run, where a healthy posture read as all-absent. That failure
+ * class gets its own verdict (`unverifiable`) so a token-visibility problem is
+ * never misreported as settings drift.
+ */
+/** The required squash-merge posture (the E lever). */
+export declare const REQUIRED_SQUASH_MERGE_TITLE = "PR_TITLE";
+export declare const REQUIRED_SQUASH_MERGE_MESSAGE = "BLANK";
+/** The repo-config fields the posture assertion reads (absent/null = not visible). */
+export interface MergeConfigPosture {
+    squash_merge_commit_title?: string | null;
+    squash_merge_commit_message?: string | null;
+    allow_squash_merge?: boolean | null;
+    allow_merge_commit?: boolean | null;
+    allow_rebase_merge?: boolean | null;
+}
+/**
+ * Verdict class: `drift` = a field is PRESENT and wrong (settings action needed);
+ * `unverifiable` = no field is wrong but at least one is absent from the config
+ * source (token-visibility failure — do NOT touch settings on this verdict).
+ */
+export type MergeConfigStatus = 'conforms' | 'drift' | 'unverifiable';
+/** Verdict of {@link evaluateMergeConfigPosture}. */
+export interface MergeConfigVerdict {
+    /** True iff every field is present AND matches the required posture. */
+    conforms: boolean;
+    status: MergeConfigStatus;
+    /** Human-readable descriptions of each present-and-wrong field. */
+    drift: string[];
+    /** Field names the config source did not carry (token-visibility class). */
+    absent: string[];
+    /** Precise operator-facing message for the job log. */
+    message: string;
+}
+/**
+ * Evaluate whether a repo's merge config matches the required posture: the
+ * E-lever squash-body shape (`PR_TITLE` + `BLANK`) AND squash-only (`allow_squash_
+ * merge` on, merge-commit and rebase off). Returns the drift set (one entry per
+ * off-posture field) and a precise message; the caller fails the check when
+ * `!conforms`.
+ */
+export declare function evaluateMergeConfigPosture(config: MergeConfigPosture): MergeConfigVerdict;
+//# sourceMappingURL=merge-config.d.ts.map

package/dist/autoclose/merge-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-config.d.ts","sourceRoot":"","sources":["../../src/autoclose/merge-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,uDAAuD;AACvD,eAAO,MAAM,2BAA2B,aAAa,CAAC;AACtD,eAAO,MAAM,6BAA6B,UAAU,CAAC;AAErD,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,kBAAkB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,kBAAkB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,kBAAkB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;AAEtE,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,mEAAmE;IACnE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAiDzF"}

package/dist/autoclose/merge-config.js

@@ -0,0 +1,81 @@
+/**
+ * Repo merge-config posture assertion for the auto-close enforcement seam
+ * (mmnto-ai/totem#1762, E-lever addendum — strategy-claude 2026-07-21T0235Z; the
+ * squash-only extension — codex supplement 2026-07-21T0356Z).
+ *
+ * The operator flipped all four governed repos to
+ * `squash_merge_commit_title: PR_TITLE` + `squash_merge_commit_message: BLANK`
+ * (executed 2026-07-21T02:30Z). BLANK stops GitHub composing a squash body from
+ * COMMIT_MESSAGES, so the server-composed close-keyword channel is gone; PR_TITLE
+ * makes the squash subject deterministically the PR title (a surface D1 already
+ * scans pre-merge).
+ *
+ * D1 also asserts SQUASH-ONLY (`allow_squash_merge` on, `allow_merge_commit` and
+ * `allow_rebase_merge` off). This is what LICENSES D2's single-HEAD, `(#N)`-subject
+ * assumption: a rebase merge pushes several commits (an earlier close-keyword
+ * commit would never be scanned when only the final SHA is read), and a regular
+ * merge commit need not carry the squash-subject form (breaking receipt
+ * correlation). Enabling squash-only is an OPERATOR settings action (routed
+ * separately, like the E lever); until flipped, D1 reds loudly by design.
+ *
+ * A repo setting is one careless settings-page click from silently reverting — so
+ * D1 ASSERTS the whole posture at workflow start and fails loud on drift (Tenet 4
+ * parity-test rule applied to repo config; a "keep it set" intention is not a
+ * coupling mechanism). Candidate standing row for the mmnto-ai/totem-strategy#482
+ * parity manifest.
+ *
+ * Pure evaluator — thin GraphQL glue lives in the D1 script. The source is
+ * GraphQL (`squashMergeAllowed` / `mergeCommitAllowed` / `rebaseMergeAllowed` /
+ * `squashMergeCommitTitle` / `squashMergeCommitMessage`), NOT the REST repos
+ * endpoint: REST omits the merge-policy fields for callers without admin
+ * visibility, and the Actions `GITHUB_TOKEN` is such a caller — discovered on
+ * D1's first live run, where a healthy posture read as all-absent. That failure
+ * class gets its own verdict (`unverifiable`) so a token-visibility problem is
+ * never misreported as settings drift.
+ */
+/** The required squash-merge posture (the E lever). */
+export const REQUIRED_SQUASH_MERGE_TITLE = 'PR_TITLE';
+export const REQUIRED_SQUASH_MERGE_MESSAGE = 'BLANK';
+/**
+ * Evaluate whether a repo's merge config matches the required posture: the
+ * E-lever squash-body shape (`PR_TITLE` + `BLANK`) AND squash-only (`allow_squash_
+ * merge` on, merge-commit and rebase off). Returns the drift set (one entry per
+ * off-posture field) and a precise message; the caller fails the check when
+ * `!conforms`.
+ */
+export function evaluateMergeConfigPosture(config) {
+    const drift = [];
+    const absent = [];
+    const check = (name, value, required) => {
+        if (value === null || value === undefined) {
+            absent.push(name);
+        }
+        else if (value !== required) {
+            drift.push(`${name} is ${typeof value === 'string' ? `"${value}"` : String(value)}, expected ${typeof required === 'string' ? `"${required}"` : String(required)}`);
+        }
+    };
+    check('squash_merge_commit_title', config.squash_merge_commit_title, REQUIRED_SQUASH_MERGE_TITLE);
+    check('squash_merge_commit_message', config.squash_merge_commit_message, REQUIRED_SQUASH_MERGE_MESSAGE);
+    // Squash-only: squash on, merge-commit + rebase off (codex supplement — this
+    // licenses D2's single-HEAD `(#N)`-subject assumption).
+    check('allow_squash_merge', config.allow_squash_merge, true);
+    check('allow_merge_commit', config.allow_merge_commit, false);
+    check('allow_rebase_merge', config.allow_rebase_merge, false);
+    const status = drift.length > 0 ? 'drift' : absent.length > 0 ? 'unverifiable' : 'conforms';
+    const message = status === 'conforms'
+        ? `Merge-config posture conforms: E lever (${REQUIRED_SQUASH_MERGE_TITLE} + ${REQUIRED_SQUASH_MERGE_MESSAGE}) + squash-only.`
+        : status === 'drift'
+            ? `Merge-config posture DRIFTED from the required E-lever + squash-only posture: ` +
+                `${drift.join('; ')}${absent.length > 0 ? ` (also not visible to this token: ${absent.join(', ')})` : ''}. ` +
+                'Re-set it in repo Settings > General > Pull Requests before ' +
+                'merging — a reverted posture re-opens the server-composed close-keyword channel or ' +
+                'defeats D2 single-HEAD receipt correlation. mmnto-ai/totem#1762.'
+            : `Merge-config posture UNVERIFIABLE — the config source did not carry: ${absent.join(', ')}. ` +
+                'This is a token-visibility failure, NOT settings drift — do not touch repo settings on this ' +
+                'message. The REST repos endpoint omits merge-policy fields for non-admin callers (the Actions ' +
+                'GITHUB_TOKEN is one); the D1 glue must read the posture via GraphQL (squashMergeAllowed / ' +
+                'mergeCommitAllowed / rebaseMergeAllowed / squashMergeCommitTitle / squashMergeCommitMessage), ' +
+                'which a plain read token can see. mmnto-ai/totem#1762.';
+    return { conforms: status === 'conforms', status, drift, absent, message };
+}
+//# sourceMappingURL=merge-config.js.map

package/dist/autoclose/merge-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-config.js","sourceRoot":"","sources":["../../src/autoclose/merge-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,uDAAuD;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC;AACtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,OAAO,CAAC;AA+BrD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,KAAK,GAAG,CACZ,IAAY,EACZ,KAA0C,EAC1C,QAA0B,EACpB,EAAE;QACR,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CACxJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,2BAA2B,EAAE,MAAM,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;IAClG,KAAK,CACH,6BAA6B,EAC7B,MAAM,CAAC,2BAA2B,EAClC,6BAA6B,CAC9B,CAAC;IACF,6EAA6E;IAC7E,wDAAwD;IACxD,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IAC7D,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAC9D,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAE9D,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/E,MAAM,OAAO,GACX,MAAM,KAAK,UAAU;QACnB,CAAC,CAAC,2CAA2C,2BAA2B,MAAM,6BAA6B,kBAAkB;QAC7H,CAAC,CAAC,MAAM,KAAK,OAAO;YAClB,CAAC,CAAC,gFAAgF;gBAChF,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;gBAC5G,8DAA8D;gBAC9D,qFAAqF;gBACrF,kEAAkE;YACpE,CAAC,CAAC,wEAAwE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC7F,8FAA8F;gBAC9F,gGAAgG;gBAChG,4FAA4F;gBAC5F,gGAAgG;gBAChG,wDAAwD,CAAC;IAEjE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7E,CAAC"}

package/dist/autoclose/merge-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=merge-config.test.d.ts.map

package/dist/autoclose/merge-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-config.test.d.ts","sourceRoot":"","sources":["../../src/autoclose/merge-config.test.ts"],"names":[],"mappings":""}

package/dist/autoclose/merge-config.test.js

@@ -0,0 +1,108 @@
+import { describe, expect, it } from 'vitest';
+import { evaluateMergeConfigPosture } from './merge-config.js';
+/** A fully-conforming posture: E lever (PR_TITLE + BLANK) + squash-only. */
+const CONFORMING = {
+    squash_merge_commit_title: 'PR_TITLE',
+    squash_merge_commit_message: 'BLANK',
+    allow_squash_merge: true,
+    allow_merge_commit: false,
+    allow_rebase_merge: false,
+};
+describe('evaluateMergeConfigPosture (D1 posture assertion, #1762 E-lever + squash-only)', () => {
+    it('conforms when all five fields match the required posture', () => {
+        const v = evaluateMergeConfigPosture(CONFORMING);
+        expect(v.conforms).toBe(true);
+        expect(v.drift).toEqual([]);
+        expect(v.message).toMatch(/conforms/i);
+    });
+    it('flags title drift', () => {
+        const v = evaluateMergeConfigPosture({
+            ...CONFORMING,
+            squash_merge_commit_title: 'COMMIT_OR_PR_TITLE',
+        });
+        expect(v.conforms).toBe(false);
+        expect(v.drift).toHaveLength(1);
+        expect(v.drift[0]).toMatch(/squash_merge_commit_title/);
+        expect(v.message).toMatch(/DRIFTED/);
+    });
+    it('flags message drift', () => {
+        const v = evaluateMergeConfigPosture({
+            ...CONFORMING,
+            squash_merge_commit_message: 'COMMIT_MESSAGES',
+        });
+        expect(v.conforms).toBe(false);
+        expect(v.drift).toHaveLength(1);
+        expect(v.drift[0]).toMatch(/squash_merge_commit_message/);
+    });
+    it('flags allow_squash_merge drift (must be on)', () => {
+        const v = evaluateMergeConfigPosture({ ...CONFORMING, allow_squash_merge: false });
+        expect(v.conforms).toBe(false);
+        expect(v.drift[0]).toMatch(/allow_squash_merge/);
+    });
+    it('flags allow_merge_commit drift (must be off — codex supplement)', () => {
+        const v = evaluateMergeConfigPosture({ ...CONFORMING, allow_merge_commit: true });
+        expect(v.conforms).toBe(false);
+        expect(v.drift[0]).toMatch(/allow_merge_commit/);
+    });
+    it('flags allow_rebase_merge drift (must be off — codex supplement)', () => {
+        const v = evaluateMergeConfigPosture({ ...CONFORMING, allow_rebase_merge: true });
+        expect(v.conforms).toBe(false);
+        expect(v.drift[0]).toMatch(/allow_rebase_merge/);
+    });
+    it('flags EVERY axis when all five drift', () => {
+        const v = evaluateMergeConfigPosture({
+            squash_merge_commit_title: 'COMMIT_OR_PR_TITLE',
+            squash_merge_commit_message: 'COMMIT_MESSAGES',
+            allow_squash_merge: false,
+            allow_merge_commit: true,
+            allow_rebase_merge: true,
+        });
+        expect(v.conforms).toBe(false);
+        expect(v.drift).toHaveLength(5);
+    });
+    it('all fields absent → UNVERIFIABLE, never reported as drift (token-visibility class)', () => {
+        // D1's first live run: the Actions GITHUB_TOKEN cannot see REST merge-policy
+        // fields, so a HEALTHY posture read as all-absent and was misreported as
+        // drift. Absent must be its own verdict with its own remedy (fix the read
+        // source, not the settings).
+        const v = evaluateMergeConfigPosture({});
+        expect(v.conforms).toBe(false);
+        expect(v.status).toBe('unverifiable');
+        expect(v.drift).toEqual([]);
+        expect(v.absent).toHaveLength(5);
+        expect(v.message).toMatch(/UNVERIFIABLE/);
+        expect(v.message).toMatch(/token-visibility/);
+        expect(v.message).not.toMatch(/DRIFTED/);
+    });
+    it('null fields (GraphQL null) behave as absent, not as drift', () => {
+        const v = evaluateMergeConfigPosture({
+            ...CONFORMING,
+            squash_merge_commit_title: null,
+        });
+        expect(v.status).toBe('unverifiable');
+        expect(v.absent).toEqual(['squash_merge_commit_title']);
+    });
+    it('a present-and-wrong field wins over absent fields: status=drift, absentees named', () => {
+        const v = evaluateMergeConfigPosture({
+            allow_merge_commit: true,
+        });
+        expect(v.status).toBe('drift');
+        expect(v.drift).toHaveLength(1);
+        expect(v.absent).toHaveLength(4);
+        expect(v.message).toMatch(/DRIFTED/);
+        expect(v.message).toMatch(/not visible to this token/);
+    });
+    it('the current live totem posture (all three methods on) drifts on the two off-axes', () => {
+        // codex supplement: live gh api reported allow_merge_commit=true,
+        // allow_rebase_merge=true, allow_squash_merge=true — so squash-only fails
+        // until the operator flips it (D1 reds loudly by design until then).
+        const v = evaluateMergeConfigPosture({
+            ...CONFORMING,
+            allow_merge_commit: true,
+            allow_rebase_merge: true,
+        });
+        expect(v.conforms).toBe(false);
+        expect(v.drift).toHaveLength(2);
+    });
+});
+//# sourceMappingURL=merge-config.test.js.map

package/dist/autoclose/merge-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-config.test.js","sourceRoot":"","sources":["../../src/autoclose/merge-config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAA2B,MAAM,mBAAmB,CAAC;AAExF,4EAA4E;AAC5E,MAAM,UAAU,GAAuB;IACrC,yBAAyB,EAAE,UAAU;IACrC,2BAA2B,EAAE,OAAO;IACpC,kBAAkB,EAAE,IAAI;IACxB,kBAAkB,EAAE,KAAK;IACzB,kBAAkB,EAAE,KAAK;CAC1B,CAAC;AAEF,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,GAAG,0BAA0B,CAAC;YACnC,GAAG,UAAU;YACb,yBAAyB,EAAE,oBAAoB;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,GAAG,0BAA0B,CAAC;YACnC,GAAG,UAAU;YACb,2BAA2B,EAAE,iBAAiB;SAC/C,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAG,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAG,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,0BAA0B,CAAC;YACnC,yBAAyB,EAAE,oBAAoB;YAC/C,2BAA2B,EAAE,iBAAiB;YAC9C,kBAAkB,EAAE,KAAK;YACzB,kBAAkB,EAAE,IAAI;YACxB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,6EAA6E;QAC7E,yEAAyE;QACzE,0EAA0E;QAC1E,6BAA6B;QAC7B,MAAM,CAAC,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,0BAA0B,CAAC;YACnC,GAAG,UAAU;YACb,yBAAyB,EAAE,IAAI;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,CAAC,GAAG,0BAA0B,CAAC;YACnC,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,kEAAkE;QAClE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,CAAC,GAAG,0BAA0B,CAAC;YACnC,GAAG,UAAU;YACb,kBAAkB,EAAE,IAAI;YACxB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/autoclose/receipt.d.ts

@@ -0,0 +1,160 @@
+/**
+ * Declared-intent receipt + reconciliation for the auto-close enforcement seam
+ * (mmnto-ai/totem#1762).
+ *
+ * D1 (PR-time required check) scans the PR corpus — title, description, and ALL
+ * branch commit messages (config-verified: the governed repos compose squash
+ * bodies from `COMMIT_MESSAGES`, so every branch commit is a squash-seed input)
+ * — for close-keyword-adjacent refs via {@link findAutoCloseRefs}, and fails on
+ * any ref that is not AUTHORIZED.
+ *
+ * AUTHORIZATION IS PROVENANCE-DISTINCT (codex #3 — the circularity fix). GitHub
+ * DERIVES `closingIssuesReferences` FROM the PR body's own close keywords, so a
+ * body keyword would self-whitelist against it. The ONLY authorizing channel is
+ * therefore the provenance-distinct `totem-close` marker (an HTML comment or a
+ * `Totem-Close:` trailer the author writes — see {@link parseDeclaredCloseIntent}).
+ * `closingIssuesReferences` is recorded on the receipt as OBSERVED GitHub state
+ * (informational), never as an authorization. Author workflow: declare every
+ * intended close with the marker.
+ *
+ * D2 (post-merge reconciliation, OBSERVATION MODE) compares the merged HEAD
+ * commit message against the receipt via {@link reconcile}. It alerts loud —
+ * never auto-reopens — until positive+negative controls arm enforcement (the
+ * Tenet 9 sense→enforce gate).
+ *
+ * Never scan issue/PR COMMENT bodies anywhere — comments never auto-close.
+ */
+export declare const AUTO_CLOSE_RECEIPT_SCHEMA_VERSION = 2;
+/**
+ * A GitHub `closingIssuesReferences` node (from the PR GraphQL/REST API): the
+ * issue GitHub itself recognizes as a linked closing reference for the PR.
+ * OBSERVED state — informational only, NEVER authorizing (GitHub derives it from
+ * body keywords).
+ */
+export interface ClosingIssueRef {
+    number: number;
+    /** `owner/repo` the issue lives in, when cross-repo; omitted for same-repo. */
+    repoWithOwner?: string;
+}
+/**
+ * The durable D1→D2 receipt. `declaredByMarker` is the AUTHORIZING set (marker
+ * provenance only); `closingIssuesReferences` is OBSERVED GitHub state recorded
+ * for the audit trail but not used to authorize. Persisted as a GitHub Actions
+ * artifact keyed to the PR (see the D1 workflow script).
+ */
+export interface AutoCloseReceipt {
+    schemaVersion: number;
+    /** `owner/repo` the PR targets. */
+    repo: string;
+    prNumber: number;
+    /** PR head SHA at D1 time (lets D2 correlate the artifact to the merge). */
+    headSha: string;
+    /**
+     * AUTHORIZING set: normalized keys declared via the provenance-distinct
+     * `totem-close` marker/trailer ONLY. reconcile authorizes against THIS set.
+     */
+    declaredByMarker: string[];
+    /**
+     * INFORMATIONAL: GitHub's derived `closingIssuesReferences` (normalized keys).
+     * Recorded for the audit trail; NOT authorizing (breaks the self-whitelist
+     * circularity — codex #3).
+     */
+    closingIssuesReferences: string[];
+    /** Normalized keys the D1 corpus scan found (audit only). */
+    corpusFindings: string[];
+    generatedAt: string;
+    note: string;
+}
+/** A structured-intent reference the author explicitly declared. */
+export interface DeclaredIntentRef {
+    qualifier?: string;
+    issue: number;
+}
+/**
+ * Parse the structured-intent declarations out of `text`. Returns the refs the
+ * author explicitly whitelisted for closure. Does NOT interpret close keywords —
+ * a marker carries bare/qualified refs only.
+ */
+export declare function parseDeclaredCloseIntent(text: string): DeclaredIntentRef[];
+/** The D1 corpus surfaces (never includes comment bodies). */
+export interface PrCorpus {
+    title: string;
+    body: string;
+    commitMessages: string[];
+    closingIssuesReferences: ClosingIssueRef[];
+    repo: string;
+}
+/** Result of the D1 corpus scan. `ok` iff nothing unauthorized was found. */
+export interface PrScanResult {
+    ok: boolean;
+    /** Normalized keys found across the corpus. */
+    findings: string[];
+    /** AUTHORIZING set (marker-declared only) — the receipt payload. */
+    declaredByMarker: string[];
+    /** INFORMATIONAL: GitHub's derived closingIssuesReferences (normalized keys). */
+    closingIssuesReferences: string[];
+    /** Findings not authorized by the marker set — these fail the check. */
+    undeclared: string[];
+}
+/**
+ * D1: scan the PR corpus (title + body + every branch commit message) for
+ * close-keyword-adjacent refs and split them into authorized vs undeclared. A
+ * finding is authorized ONLY by the provenance-distinct `totem-close` marker —
+ * NOT by GitHub's `closingIssuesReferences` (which GitHub derives from the same
+ * body keywords, so it would self-whitelist; codex #3). Comment bodies are NEVER
+ * part of the corpus.
+ */
+export declare function scanPrCorpus(corpus: PrCorpus): PrScanResult;
+/** Assemble the durable D1 receipt from a corpus scan. */
+export declare function buildReceipt(corpus: Pick<PrCorpus, 'repo'>, prNumber: number, headSha: string, scan: PrScanResult, now?: Date): AutoCloseReceipt;
+export type ReconcileStatus = 'clean' | 'anomaly' | 'missing-receipt' | 'ambiguous-receipt' | 'unexpected-body';
+export interface ReconcileResult {
+    status: ReconcileStatus;
+    /** Normalized keys found in the merged commit message. */
+    findings: string[];
+    /** Findings not covered by the receipt's authorizing set (the anomaly set). */
+    undeclared: string[];
+    /**
+     * OBSERVATION MODE: the issues an armed enforcer WOULD reopen. Reported for the
+     * audit trail; D2 never acts on it (no auto-reopen until controls pass).
+     */
+    reopenCandidates: string[];
+    /**
+     * Whether the merged commit carried a non-empty BODY after RFC-822 trailer
+     * lines are stripped (mmnto-ai/totem#1762 addendum + the 0330Z trailer-strip
+     * fold-in). Under the E lever (squash message = BLANK) the body should be
+     * empty; a non-empty non-trailer body is the posture signal (`unexpected-body`).
+     */
+    bodyPresent: boolean;
+    /** Precise operator-facing message for the job log. */
+    message: string;
+}
+/** Options for {@link reconcile}. */
+export interface ReconcileOptions {
+    /** `owner/repo` the merge landed on (enables same-repo key equivalence). */
+    repo?: string;
+    /** Expected PR number — a receipt for a different PR is ambiguous. */
+    expectedPrNumber?: number;
+}
+/**
+ * D2: reconcile the merged HEAD commit message against the D1 receipt.
+ * OBSERVATION MODE — every non-clean outcome ALERTS (the caller decides exit
+ * code); NONE reopens.
+ *
+ *   - `clean`            — no close-keyword-adjacent ref, or every ref is
+ *                          authorized. Quiet path (empty / trailer-only body).
+ *   - `anomaly`          — a closure-capable message with ≥1 UNAUTHORIZED ref.
+ *                          The zero-allowed-set (`declaredByMarker: []`) + a
+ *                          closure-capable message is the #2471 specimen.
+ *   - `missing-receipt`  — a closure-capable message but NO receipt (PR merged
+ *                          before D1 existed, or the artifact expired /
+ *                          could not be downloaded). Alert, never guess.
+ *   - `ambiguous-receipt`— a closure-capable message but the receipt is malformed
+ *                          or is for a different PR. Alert, never guess.
+ *   - `unexpected-body`  — a non-empty non-trailer body under BLANK with NO
+ *                          unauthorized ref: posture-drift / `--body`-override
+ *                          evidence (no closure harm). The caller surfaces it as
+ *                          a non-failing signal (interpretation call).
+ */
+export declare function reconcile(receipt: AutoCloseReceipt | null, mergedBody: string, opts?: ReconcileOptions): ReconcileResult;
+//# sourceMappingURL=receipt.d.ts.map

package/dist/autoclose/receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../src/autoclose/receipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAQH,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,6DAA6D;IAC7D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAUD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAY1E;AAgCD,8DAA8D;AAC9D,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB,EAAE,eAAe,EAAE,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iFAAiF;IACjF,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAOD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,CAsB3D;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAC1B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAClB,GAAG,GAAE,IAAiB,GACrB,gBAAgB,CAgBlB;AAED,MAAM,MAAM,eAAe,GACvB,OAAO,GACP,SAAS,GACT,iBAAiB,GACjB,mBAAmB,GACnB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAYD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,gBAAqB,GAC1B,eAAe,CAwCjB"}