@mmnto/totem 1.77.0 → 1.79.0

package/dist/spine/authored-rule.d.ts

@@ -0,0 +1,360 @@
+import { z } from 'zod';
+import type { CompileInputCandidate } from './candidate-rule.js';
+import type { ClassifierLedger } from './ledgers.js';
+/** The matcher engines an authored rule may declare (mirrors `CompiledRule.engine`). */
+export declare const DeclaredEngineSchema: z.ZodEnum<["regex", "ast", "ast-grep"]>;
+export type DeclaredEngine = z.infer<typeof DeclaredEngineSchema>;
+/**
+ * ADR-112 §3 — the result of the INDEPENDENT structural-eligibility check.
+ * Produced by `evaluateStructuralEligibility` (NOT by the author): only
+ * `decidable: true` reaches the compiler, mapping to the compiler's
+ * `classifierDisposition: 'structural'`. `judgedBy` records who/what judged it
+ * (ledger-recorded, never the author), so a human cannot smuggle a behavioral
+ * policy past ADR-091's gate by hand-asserting "structural" (FM(d)).
+ */
+export declare const StructEligResultSchema: z.ZodObject<{
+    decidable: z.ZodBoolean;
+    /**
+     * `whitelist:<class>` for the cert-#1 static-whitelist basis; the
+     * `capability-check` / `draft-classifier+stage4` bases are contract-legal but
+     * deferred (slice-A uses the deterministic whitelist only). On a `decidable:
+     * false` verdict the basis still names the attempted whitelist class — the
+     * diagnostic is "no/ambiguous whitelist match", carried in `judgedBy`'s log.
+     * Constrained to the §3 forms (strategy item 2, #2259) so a typo'd/free-form
+     * basis can't validate — non-mutating (no `.trim()`), matching the hash-stability
+     * discipline on the other reference fields.
+     */
+    basis: z.ZodEffects<z.ZodString, string, string>;
+    judgedBy: z.ZodEffects<z.ZodString, string, string>;
+}, "strip", z.ZodTypeAny, {
+    decidable: boolean;
+    basis: string;
+    judgedBy: string;
+}, {
+    decidable: boolean;
+    basis: string;
+    judgedBy: string;
+}>;
+export type StructEligResult = z.infer<typeof StructEligResultSchema>;
+/** ADR-112 §3/§7 — accelerant-lineage marker. A mined hint that informed a human is recorded, never erased. */
+export declare const AuthoredOriginSchema: z.ZodUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"from-scratch">;
+}, "strip", z.ZodTypeAny, {
+    kind: "from-scratch";
+}, {
+    kind: "from-scratch";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"mined-accelerant">;
+    sourceRunId: z.ZodEffects<z.ZodString, string, string>;
+    suggestionHash: z.ZodEffects<z.ZodString, string, string>;
+}, "strip", z.ZodTypeAny, {
+    kind: "mined-accelerant";
+    sourceRunId: string;
+    suggestionHash: string;
+}, {
+    kind: "mined-accelerant";
+    sourceRunId: string;
+    suggestionHash: string;
+}>]>;
+export type AuthoredOrigin = z.infer<typeof AuthoredOriginSchema>;
+/**
+ * ADR-112 §3 — the authored producer's sole output envelope. Parallel to
+ * ADR-111's `CandidateRuleRecord` but carrying the AUTHORED provenance variant,
+ * the INDEPENDENTLY-judged eligibility result, and the accelerant lineage.
+ * Minted `unverified: true` (ADR-089) — zero enforcement blast radius.
+ */
+export declare const AuthoredRuleRecordSchema: z.ZodObject<{
+    /**
+     * ADR-112 §3/§8 — the stable, minted rule identity (`mintAuthoredRuleId`),
+     * assigned ONCE at authoring time and PERSISTED on the record; NEVER re-derived
+     * from content at read time. `firingLabelId` + the §5.3
+     * `controls.positive[].targetRuleId` ground-truth labels embed it, so a
+     * content-re-derived id would orphan them (§8). Slice A reserves the field (this
+     * IS the schema spine); the authoring flow (slice B) mints it, and threading it
+     * into the compiled artifact's identity (`firingLabelId ← ruleId`, replacing the
+     * `dslSource`-derived `lessonHash`) is slice C/D. The RESOLVED id (with any `-N`
+     * collision suffix) is what is stored.
+     */
+    ruleId: z.ZodString;
+    provenance: z.ZodObject<{
+        kind: z.ZodLiteral<"authored">;
+        author: z.ZodEffects<z.ZodString, string, string>;
+        authoredAt: z.ZodEffects<z.ZodString, string, string>;
+        targetDefect: z.ZodEffects<z.ZodString, string, string>;
+        positiveFixtures: z.ZodArray<z.ZodObject<{
+            pr: z.ZodNumber;
+            mergeCommitSha: z.ZodString;
+            preimageCommitSha: z.ZodString;
+            filePath: z.ZodEffects<z.ZodString, string, string>;
+            matchedSpan: z.ZodEffects<z.ZodString, string, string>;
+            contentHash: z.ZodEffects<z.ZodString, string, string>;
+        }, "strip", z.ZodTypeAny, {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }, {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }>, "many">;
+        negativeFixtures: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pr: z.ZodNumber;
+            mergeCommitSha: z.ZodString;
+            preimageCommitSha: z.ZodString;
+            filePath: z.ZodEffects<z.ZodString, string, string>;
+            matchedSpan: z.ZodEffects<z.ZodString, string, string>;
+            contentHash: z.ZodEffects<z.ZodString, string, string>;
+        }, "strip", z.ZodTypeAny, {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }, {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        kind: "authored";
+        author: string;
+        authoredAt: string;
+        targetDefect: string;
+        positiveFixtures: {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }[];
+        negativeFixtures?: {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }[] | undefined;
+    }, {
+        kind: "authored";
+        author: string;
+        authoredAt: string;
+        targetDefect: string;
+        positiveFixtures: {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }[];
+        negativeFixtures?: {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }[] | undefined;
+    }>;
+    /** INDEPENDENTLY established (§3) — the author never sets this; the check does. */
+    structuralEligibility: z.ZodObject<{
+        decidable: z.ZodBoolean;
+        /**
+         * `whitelist:<class>` for the cert-#1 static-whitelist basis; the
+         * `capability-check` / `draft-classifier+stage4` bases are contract-legal but
+         * deferred (slice-A uses the deterministic whitelist only). On a `decidable:
+         * false` verdict the basis still names the attempted whitelist class — the
+         * diagnostic is "no/ambiguous whitelist match", carried in `judgedBy`'s log.
+         * Constrained to the §3 forms (strategy item 2, #2259) so a typo'd/free-form
+         * basis can't validate — non-mutating (no `.trim()`), matching the hash-stability
+         * discipline on the other reference fields.
+         */
+        basis: z.ZodEffects<z.ZodString, string, string>;
+        judgedBy: z.ZodEffects<z.ZodString, string, string>;
+    }, "strip", z.ZodTypeAny, {
+        decidable: boolean;
+        basis: string;
+        judgedBy: string;
+    }, {
+        decidable: boolean;
+        basis: string;
+        judgedBy: string;
+    }>;
+    origin: z.ZodUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"from-scratch">;
+    }, "strip", z.ZodTypeAny, {
+        kind: "from-scratch";
+    }, {
+        kind: "from-scratch";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"mined-accelerant">;
+        sourceRunId: z.ZodEffects<z.ZodString, string, string>;
+        suggestionHash: z.ZodEffects<z.ZodString, string, string>;
+    }, "strip", z.ZodTypeAny, {
+        kind: "mined-accelerant";
+        sourceRunId: string;
+        suggestionHash: string;
+    }, {
+        kind: "mined-accelerant";
+        sourceRunId: string;
+        suggestionHash: string;
+    }>]>;
+    declaredEngine: z.ZodEnum<["regex", "ast", "ast-grep"]>;
+    /** Reference to the §8 authoring-ledger entry (author/date/engine/splitRef/attestations). */
+    authoringLedgerRef: z.ZodEffects<z.ZodString, string, string>;
+    /** The human-written matcher (same DSL the compiler accepts from the miner). */
+    dslSource: z.ZodEffects<z.ZodString, string, string>;
+    /** Zero-trust mint (ADR-089 / ADR-112 §1) — always literally `true`. */
+    unverified: z.ZodLiteral<true>;
+}, "strip", z.ZodTypeAny, {
+    provenance: {
+        kind: "authored";
+        author: string;
+        authoredAt: string;
+        targetDefect: string;
+        positiveFixtures: {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }[];
+        negativeFixtures?: {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }[] | undefined;
+    };
+    unverified: true;
+    ruleId: string;
+    origin: {
+        kind: "from-scratch";
+    } | {
+        kind: "mined-accelerant";
+        sourceRunId: string;
+        suggestionHash: string;
+    };
+    dslSource: string;
+    structuralEligibility: {
+        decidable: boolean;
+        basis: string;
+        judgedBy: string;
+    };
+    declaredEngine: "regex" | "ast" | "ast-grep";
+    authoringLedgerRef: string;
+}, {
+    provenance: {
+        kind: "authored";
+        author: string;
+        authoredAt: string;
+        targetDefect: string;
+        positiveFixtures: {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }[];
+        negativeFixtures?: {
+            pr: number;
+            mergeCommitSha: string;
+            preimageCommitSha: string;
+            filePath: string;
+            matchedSpan: string;
+            contentHash: string;
+        }[] | undefined;
+    };
+    unverified: true;
+    ruleId: string;
+    origin: {
+        kind: "from-scratch";
+    } | {
+        kind: "mined-accelerant";
+        sourceRunId: string;
+        suggestionHash: string;
+    };
+    dslSource: string;
+    structuralEligibility: {
+        decidable: boolean;
+        basis: string;
+        judgedBy: string;
+    };
+    declaredEngine: "regex" | "ast" | "ast-grep";
+    authoringLedgerRef: string;
+}>;
+export type AuthoredRuleRecord = z.infer<typeof AuthoredRuleRecordSchema>;
+/**
+ * One decidable `(engine, structuralClass)` pair. The whitelist of these lives
+ * in the CLI registry (slice B); the registry lists ONLY pairs the engine can
+ * actually represent, so "exactly one match" subsumes ADR-112 §3's "AND the
+ * engine can represent that class" condition.
+ */
+export interface WhitelistEntry {
+    engine: DeclaredEngine;
+    structuralClass: string;
+}
+/**
+ * ADR-112 §3 — the INDEPENDENT structural-eligibility check. A CLOSED registry
+ * predicate, NOT prose: `decidable` is true iff EXACTLY ONE whitelist entry
+ * matches `(declaredEngine, structuralClass)`. Unknown class, unsupported
+ * engine, or multiple matches → `decidable: false` (NO default-to-structural).
+ * The author supplies `declaredEngine` + `structuralClass`; this check OWNS the
+ * verdict — any author-supplied disposition is irrelevant here (FM(d)).
+ * Deterministic + pure (no IO, no LLM) — the same input always yields the same
+ * verdict (Tenet-15).
+ */
+export declare function evaluateStructuralEligibility(input: {
+    declaredEngine: DeclaredEngine;
+    structuralClass: string;
+}, whitelist: readonly WhitelistEntry[], judgedBy: string): StructEligResult;
+/**
+ * ADR-112 §8 — mint a stable, deterministic authored rule-id. The seed is
+ * `sha256(JSON.stringify([author, targetDefect]))[:16]` (an INJECTIVE encoding —
+ * see the inline note) — `dslSource` is DELIBERATELY EXCLUDED so an author can
+ * tighten/refactor the matcher without orphaning the rule's ledger history. On collision with an already-resolved id (two rules sharing the same
+ * `(author, targetDefect)`), a stable `-N` counter is appended. The RESOLVED id
+ * is what callers persist — never recompute the raw seed at read time, or a
+ * later sibling could shift the suffix (the gemini/agy break). The
+ * `never-remine` marker is keyed to `targetDefect`, handled by the accelerant
+ * miner, not here.
+ */
+export declare function mintAuthoredRuleId(author: string, targetDefect: string, existingIds: ReadonlySet<string>): string;
+/**
+ * The authored producer's compile-stage input — what `toCompileFeed` builds for
+ * `runCompileStage`. Deliberately NOT a `ClassifyStageResult`: an authored rule
+ * has no mining emission ledger, so faking one would be a provenance lie. The
+ * classifier ledger it carries records `dispositionSource: 'authored-whitelist'`.
+ */
+export interface AuthoredCompileFeed {
+    candidates: CompileInputCandidate[];
+    classifierLedger: ClassifierLedger;
+}
+/**
+ * ADR-112 §2/§8 — turn structurally-DECIDABLE authored rules into the input
+ * `runCompileStage` consumes, reusing the ONE G-series compiler (never a second).
+ * The disposition is set HERE to `'structural'` from the INDEPENDENT eligibility
+ * verdict (§3) — the author never sets it. A NON-decidable record is a contract
+ * violation → FAIL LOUD (the FM(d) backstop in code), never a silent skip.
+ * `classifierLedgerRef = authored:<authoringLedgerRef>` is unique per rule (the
+ * authoring ledger is 1:1 with the rule); a duplicate fails loud so the downstream
+ * 1:1 classifier-ledger join can't silently collapse.
+ */
+export declare function toCompileFeed(records: readonly AuthoredRuleRecord[]): AuthoredCompileFeed;
+//# sourceMappingURL=authored-rule.d.ts.map

package/dist/spine/authored-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authored-rule.d.ts","sourceRoot":"","sources":["../../src/spine/authored-rule.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,yCAAuC,CAAC;AACzE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAQlE;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;IAEjC;;;;;;;;;OASG;;;;;;;;;;;EAQH,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,+GAA+G;AAC/G,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;IAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAUlE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;;;;;;;;OAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMH,mFAAmF;;;QAhEnF;;;;;;;;;WASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2DH,6FAA6F;;IAI7F,gFAAgF;;IAIhF,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAExE,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE;IAAE,cAAc,EAAE,cAAc,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,EAClE,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,QAAQ,EAAE,MAAM,GACf,gBAAgB,CASlB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,GAC/B,MAAM,CAcR;AAID;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC,gBAAgB,EAAE,gBAAgB,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GAAG,mBAAmB,CAoCzF"}

package/dist/spine/authored-rule.js

@@ -0,0 +1,199 @@
+// ─── ADR-112 Gate-1 authored producer: the AuthoredRuleRecord envelope ───────
+//
+// The human-authored counterpart to ADR-111's mined `CandidateRuleRecord`. An
+// authored rule is anchored to a real historical DEFECT (its `provenance` is the
+// AUTHORED variant of the ADR-112 union — train-side preimage fixtures, §3/§4),
+// carries an INDEPENDENTLY-judged structural-eligibility result (NOT author-
+// asserted — §3), an accelerant-lineage marker (§7), and is minted
+// `unverified`/Yellow (ADR-089) with zero enforcement blast radius.
+//
+// SLICE A scope: the schema spine + the deterministic eligibility check + the
+// stable rule-id mint. The `totem rule author` CLI + the `.totem/spine/
+// authored-rules.yaml` reader are slice B; the compile-feed integration into
+// `runCompileStage` is gated on the `compileCandidate` param-widening flagged in
+// the slice-A report (a controller decision). The whitelist REGISTRY of
+// decidable classes lives in the CLI (slice B, mirroring `valueEqualityFieldsFor`);
+// this core check takes it injected (DI), staying network-free + LLM-free.
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { AuthoredProvenanceRecordSchema } from '../compiler-schema.js';
+/** The matcher engines an authored rule may declare (mirrors `CompiledRule.engine`). */
+export const DeclaredEngineSchema = z.enum(['regex', 'ast', 'ast-grep']);
+// The §3 eligibility-basis forms: `whitelist:<class>` (the cert-#1 deterministic basis,
+// a non-empty class after the colon), or the deferred `capability-check` /
+// `draft-classifier+stage4`. Pins `basis` to the contract so a free-form/typo'd value
+// can't validate (strategy item 2, #2259).
+const ELIGIBILITY_BASIS_RE = /^(?:whitelist:.+|capability-check|draft-classifier\+stage4)$/;
+/**
+ * ADR-112 §3 — the result of the INDEPENDENT structural-eligibility check.
+ * Produced by `evaluateStructuralEligibility` (NOT by the author): only
+ * `decidable: true` reaches the compiler, mapping to the compiler's
+ * `classifierDisposition: 'structural'`. `judgedBy` records who/what judged it
+ * (ledger-recorded, never the author), so a human cannot smuggle a behavioral
+ * policy past ADR-091's gate by hand-asserting "structural" (FM(d)).
+ */
+export const StructEligResultSchema = z.object({
+    decidable: z.boolean(),
+    /**
+     * `whitelist:<class>` for the cert-#1 static-whitelist basis; the
+     * `capability-check` / `draft-classifier+stage4` bases are contract-legal but
+     * deferred (slice-A uses the deterministic whitelist only). On a `decidable:
+     * false` verdict the basis still names the attempted whitelist class — the
+     * diagnostic is "no/ambiguous whitelist match", carried in `judgedBy`'s log.
+     * Constrained to the §3 forms (strategy item 2, #2259) so a typo'd/free-form
+     * basis can't validate — non-mutating (no `.trim()`), matching the hash-stability
+     * discipline on the other reference fields.
+     */
+    basis: z.string().refine((s) => ELIGIBILITY_BASIS_RE.test(s), {
+        message: 'basis must be a §3 eligibility basis: whitelist:<class> | capability-check | draft-classifier+stage4',
+    }),
+    judgedBy: z.string().refine((s) => s.trim().length > 0, {
+        message: 'judgedBy must name the check/agent that judged eligibility (never the author)',
+    }),
+});
+/** ADR-112 §3/§7 — accelerant-lineage marker. A mined hint that informed a human is recorded, never erased. */
+export const AuthoredOriginSchema = z.union([
+    z.object({ kind: z.literal('from-scratch') }),
+    z.object({
+        kind: z.literal('mined-accelerant'),
+        sourceRunId: z.string().refine((s) => s.trim().length > 0, { message: 'sourceRunId required' }),
+        suggestionHash: z.string().refine((s) => s.trim().length > 0, {
+            message: 'suggestionHash required',
+        }),
+    }),
+]);
+// The persisted minted-rule-id shape (ADR-112 §8): a 16-char lowercase-hex base from
+// `mintAuthoredRuleId`, with an optional collision suffix. The suffix is EXACTLY what the
+// mint emits — `-<n>` for n≥1, never `-0` and never zero-padded — so schema-valid ≡
+// mint-producible (#2259 CR: a looser `-\d+` admitted ids like `…-0`/`…-01` the mint can't
+// make). Pinned as a shared constant binding the SCHEMA boundary to the mint's codomain.
+const AUTHORED_RULE_ID_HEX_LEN = 16;
+const AUTHORED_RULE_ID_RE = new RegExp(`^[0-9a-f]{${AUTHORED_RULE_ID_HEX_LEN}}(?:-[1-9]\\d*)?$`);
+/**
+ * ADR-112 §3 — the authored producer's sole output envelope. Parallel to
+ * ADR-111's `CandidateRuleRecord` but carrying the AUTHORED provenance variant,
+ * the INDEPENDENTLY-judged eligibility result, and the accelerant lineage.
+ * Minted `unverified: true` (ADR-089) — zero enforcement blast radius.
+ */
+export const AuthoredRuleRecordSchema = z.object({
+    /**
+     * ADR-112 §3/§8 — the stable, minted rule identity (`mintAuthoredRuleId`),
+     * assigned ONCE at authoring time and PERSISTED on the record; NEVER re-derived
+     * from content at read time. `firingLabelId` + the §5.3
+     * `controls.positive[].targetRuleId` ground-truth labels embed it, so a
+     * content-re-derived id would orphan them (§8). Slice A reserves the field (this
+     * IS the schema spine); the authoring flow (slice B) mints it, and threading it
+     * into the compiled artifact's identity (`firingLabelId ← ruleId`, replacing the
+     * `dslSource`-derived `lessonHash`) is slice C/D. The RESOLVED id (with any `-N`
+     * collision suffix) is what is stored.
+     */
+    ruleId: z.string().regex(AUTHORED_RULE_ID_RE, {
+        message: 'ruleId must be a minted authored rule id — 16 hex chars + optional -<n> suffix (ADR-112 §3/§8)',
+    }),
+    provenance: AuthoredProvenanceRecordSchema,
+    /** INDEPENDENTLY established (§3) — the author never sets this; the check does. */
+    structuralEligibility: StructEligResultSchema,
+    origin: AuthoredOriginSchema,
+    declaredEngine: DeclaredEngineSchema,
+    /** Reference to the §8 authoring-ledger entry (author/date/engine/splitRef/attestations). */
+    authoringLedgerRef: z.string().refine((s) => s.trim().length > 0, {
+        message: 'authoringLedgerRef must be a non-empty ledger reference',
+    }),
+    /** The human-written matcher (same DSL the compiler accepts from the miner). */
+    dslSource: z.string().refine((s) => s.trim().length > 0, {
+        message: 'dslSource must be non-empty',
+    }),
+    /** Zero-trust mint (ADR-089 / ADR-112 §1) — always literally `true`. */
+    unverified: z.literal(true),
+});
+/**
+ * ADR-112 §3 — the INDEPENDENT structural-eligibility check. A CLOSED registry
+ * predicate, NOT prose: `decidable` is true iff EXACTLY ONE whitelist entry
+ * matches `(declaredEngine, structuralClass)`. Unknown class, unsupported
+ * engine, or multiple matches → `decidable: false` (NO default-to-structural).
+ * The author supplies `declaredEngine` + `structuralClass`; this check OWNS the
+ * verdict — any author-supplied disposition is irrelevant here (FM(d)).
+ * Deterministic + pure (no IO, no LLM) — the same input always yields the same
+ * verdict (Tenet-15).
+ */
+export function evaluateStructuralEligibility(input, whitelist, judgedBy) {
+    const matches = whitelist.filter((e) => e.engine === input.declaredEngine && e.structuralClass === input.structuralClass);
+    return {
+        decidable: matches.length === 1,
+        basis: `whitelist:${input.structuralClass}`,
+        judgedBy,
+    };
+}
+// ── Stable rule-id mint (ADR-112 §8) ──────────────────────────────────────────
+/**
+ * ADR-112 §8 — mint a stable, deterministic authored rule-id. The seed is
+ * `sha256(JSON.stringify([author, targetDefect]))[:16]` (an INJECTIVE encoding —
+ * see the inline note) — `dslSource` is DELIBERATELY EXCLUDED so an author can
+ * tighten/refactor the matcher without orphaning the rule's ledger history. On collision with an already-resolved id (two rules sharing the same
+ * `(author, targetDefect)`), a stable `-N` counter is appended. The RESOLVED id
+ * is what callers persist — never recompute the raw seed at read time, or a
+ * later sibling could shift the suffix (the gemini/agy break). The
+ * `never-remine` marker is keyed to `targetDefect`, handled by the accelerant
+ * miner, not here.
+ */
+export function mintAuthoredRuleId(author, targetDefect, existingIds) {
+    // Unambiguous seed encoding (GCA-high + CR-major, #2259): a bare `author·targetDefect`
+    // ALIASES distinct tuples — ('a·b','c') and ('a','b·c') collapse onto one seed. A JSON
+    // array of the two inputs is injective: distinct (author, targetDefect) pairs can never
+    // serialize to the same string, so a persisted id can't collide by encoding.
+    const seed = createHash('sha256')
+        .update(JSON.stringify([author, targetDefect]))
+        .digest('hex')
+        .slice(0, AUTHORED_RULE_ID_HEX_LEN);
+    if (!existingIds.has(seed))
+        return seed;
+    for (let n = 1;; n += 1) {
+        const candidate = `${seed}-${n}`;
+        if (!existingIds.has(candidate))
+            return candidate;
+    }
+}
+/**
+ * ADR-112 §2/§8 — turn structurally-DECIDABLE authored rules into the input
+ * `runCompileStage` consumes, reusing the ONE G-series compiler (never a second).
+ * The disposition is set HERE to `'structural'` from the INDEPENDENT eligibility
+ * verdict (§3) — the author never sets it. A NON-decidable record is a contract
+ * violation → FAIL LOUD (the FM(d) backstop in code), never a silent skip.
+ * `classifierLedgerRef = authored:<authoringLedgerRef>` is unique per rule (the
+ * authoring ledger is 1:1 with the rule); a duplicate fails loud so the downstream
+ * 1:1 classifier-ledger join can't silently collapse.
+ */
+export function toCompileFeed(records) {
+    const candidates = [];
+    const entries = [];
+    const seen = new Set();
+    for (const record of records) {
+        if (!record.structuralEligibility.decidable) {
+            throw new Error(`[Totem Error] toCompileFeed: authored rule '${record.authoringLedgerRef}' is not structurally decidable — a non-decidable rule must never reach the compiler (ADR-112 §3 / FM(d))`);
+        }
+        const classifierLedgerRef = `authored:${record.authoringLedgerRef}`;
+        if (seen.has(classifierLedgerRef)) {
+            throw new Error(`[Totem Error] toCompileFeed: duplicate authoringLedgerRef '${record.authoringLedgerRef}' — each authored rule needs a unique ledger ref for the 1:1 compile join`);
+        }
+        seen.add(classifierLedgerRef);
+        candidates.push({
+            provenance: record.provenance,
+            classifierDisposition: 'structural',
+            classifierLedgerRef,
+            dslSource: record.dslSource,
+            // §3 (#7): carry the whitelist-judged engine so the compiler can assert it
+            // compiled under THAT engine — a regex-whitelisted rule whose dslSource parses
+            // as ast-grep must fail loud, not silently re-route to a different engine.
+            declaredEngine: record.declaredEngine,
+            unverified: true,
+        });
+        entries.push({
+            candidateRef: classifierLedgerRef,
+            disposition: 'structural',
+            stage4Confirmed: false,
+            dispositionSource: 'authored-whitelist',
+        });
+    }
+    return { candidates, classifierLedger: { entries } };
+}
+//# sourceMappingURL=authored-rule.js.map

package/dist/spine/authored-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authored-rule.js","sourceRoot":"","sources":["../../src/spine/authored-rule.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,6EAA6E;AAC7E,mEAAmE;AACnE,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,iFAAiF;AACjF,wEAAwE;AACxE,oFAAoF;AACpF,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAIvE,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAGzE,wFAAwF;AACxF,2EAA2E;AAC3E,sFAAsF;AACtF,2CAA2C;AAC3C,MAAM,oBAAoB,GAAG,8DAA8D,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB;;;;;;;;;OASG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC5D,OAAO,EACL,sGAAsG;KACzG,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;QACtD,OAAO,EAAE,+EAA+E;KACzF,CAAC;CACH,CAAC,CAAC;AAGH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QAC/F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;YAC5D,OAAO,EAAE,yBAAyB;SACnC,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAGH,qFAAqF;AACrF,0FAA0F;AAC1F,oFAAoF;AACpF,2FAA2F;AAC3F,yFAAyF;AACzF,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAAC,aAAa,wBAAwB,mBAAmB,CAAC,CAAC;AAEjG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC5C,OAAO,EACL,gGAAgG;KACnG,CAAC;IACF,UAAU,EAAE,8BAA8B;IAC1C,mFAAmF;IACnF,qBAAqB,EAAE,sBAAsB;IAC7C,MAAM,EAAE,oBAAoB;IAC5B,cAAc,EAAE,oBAAoB;IACpC,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;QAChE,OAAO,EAAE,yDAAyD;KACnE,CAAC;IACF,gFAAgF;IAChF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;QACvD,OAAO,EAAE,6BAA6B;KACvC,CAAC;IACF,wEAAwE;IACxE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CAC5B,CAAC,CAAC;AAgBH;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAkE,EAClE,SAAoC,EACpC,QAAgB;IAEhB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,CACxF,CAAC;IACF,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC/B,KAAK,EAAE,aAAa,KAAK,CAAC,eAAe,EAAE;QAC3C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,YAAoB,EACpB,WAAgC;IAEhC,uFAAuF;IACvF,uFAAuF;IACvF,wFAAwF;IACxF,6EAA6E;IAC7E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;SAC9C,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACpD,CAAC;AACH,CAAC;AAeD;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,OAAsC;IAClE,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,+CAA+C,MAAM,CAAC,kBAAkB,2GAA2G,CACpL,CAAC;QACJ,CAAC;QACD,MAAM,mBAAmB,GAAG,YAAY,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,8DAA8D,MAAM,CAAC,kBAAkB,2EAA2E,CACnK,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,qBAAqB,EAAE,YAAY;YACnC,mBAAmB;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,2EAA2E;YAC3E,+EAA+E;YAC/E,2EAA2E;YAC3E,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC;YACX,YAAY,EAAE,mBAAmB;YACjC,WAAW,EAAE,YAAY;YACzB,eAAe,EAAE,KAAK;YACtB,iBAAiB,EAAE,oBAAoB;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC"}

package/dist/spine/authored-rule.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authored-rule.test.d.ts.map

package/dist/spine/authored-rule.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authored-rule.test.d.ts","sourceRoot":"","sources":["../../src/spine/authored-rule.test.ts"],"names":[],"mappings":""}