@momentiq/dark-factory-cli 1.0.0 → 2.0.0

package/dist/report.d.ts

@@ -1,5 +1,63 @@
 import type { LoadedConfig } from "./policy/config.js";
-import { type CriticResult, type ReviewArtifact, type ReviewSeverity, type ReviewVerdict } from "@momentiq/dark-factory-schemas";
+import { type CriticResult, type ReviewArtifact, type ReviewFinding, type ReviewSeverity, type ReviewVerdict, type UnilateralVetoRules } from "@momentiq/dark-factory-schemas";
+/**
+ * True when the finding carries any of the flags listed in
+ * `requireCorroborationFor`. Flags not present in `FLAG_TO_FINDING_KEY`
+ * are ignored — an unknown flag in config is a no-op rather than a
+ * runtime error so operators can pin policy without first deploying a
+ * CLI that knows the flag (forward-compat).
+ *
+ * Exported so `gate.ts` shares the canonical translation table and
+ * cannot drift.
+ */
+export declare function findingCarriesCorroborationFlag(finding: ReviewFinding, flagNames: readonly string[]): boolean;
+/**
+ * True when at least one OTHER completed critic has a blocking-severity
+ * finding on the SAME file within `radius` lines of `target`.
+ *
+ * Exported so `gate.ts` shares the canonical corroboration predicate
+ * and cannot drift.
+ *
+ * "Other" = different `criticId`. Critics never corroborate themselves.
+ * "Blocking-severity" = `blockingSeverities.includes(f.severity)`. The
+ * corroborator is checked WITHOUT recursing into the corroboration
+ * rule — a corroborator that itself carries `selfInconsistent: true`
+ * still corroborates (the spec's safety net is "another critic saw a
+ * blocker here too", not "another critic's blocker survived
+ * corroboration"). This intentional asymmetry prevents an N-way
+ * corroboration-cycle.
+ *
+ * `target.file === undefined` → returns false (corroboration is
+ * file-scoped; a finding without a file cannot be corroborated).
+ * `target.line === undefined` → treats the target line as `0` (matches
+ * any line in the same file within the radius window — the safety
+ * net errs toward "yes, this is corroborated" when the target's
+ * location is imprecise).
+ */
+export declare function isCorroboratedByOtherCritic(target: ReviewFinding, targetCriticId: string, allResults: readonly CriticResult[], blockingSeverities: readonly ReviewSeverity[], radius: number): boolean;
+/**
+ * A finding the aggregator demoted from a unilateral veto to an
+ * informational `critic_disagreement` note because the
+ * `unilateralVetoRules.requireCorroborationFor` policy fired AND no
+ * other critic corroborated within the radius. Surfaced on
+ * `QuorumAggregateOutcome` so the runner can emit
+ * `critic_disagreement` telemetry and the artifact writer can render
+ * the note in the per-run markdown.
+ */
+export interface CriticDisagreementNote {
+    criticId: string;
+    file: string;
+    line?: number;
+    severity: ReviewSeverity;
+    /**
+     * The corroboration-flag name from the policy that triggered the
+     * demotion (currently always `"self_inconsistent"`). Future flags
+     * surface here without a new field.
+     */
+    flag: string;
+    /** Short summary cut from the finding's `evidence` for the note. */
+    evidence: string;
+}
 export interface AggregateInputs {
     loaded: LoadedConfig;
     commit: string;
@@ -19,6 +77,26 @@ export declare function buildAggregate(inputs: AggregateInputs): ReviewArtifact;
  * computation see the same definition of "completed".
  */
 export declare function isCriticCompleted(r: CriticResult): boolean;
+/**
+ * Optional context for the corroboration check
+ * (issue dark-factory-platform#112). When omitted, `criticVetoesGate`
+ * behaves exactly as the pre-#112 implementation (back-compat for the
+ * many callers that don't know about the policy).
+ */
+export interface VetoCorroborationContext {
+    /** All critic results in this review run — used to look for
+     *  cross-critic corroboration on the same file within radius. */
+    allResults: readonly CriticResult[];
+    rules: UnilateralVetoRules;
+    /**
+     * Optional sink for findings the aggregator demoted to a
+     * `critic_disagreement` note. The caller pre-allocates the array;
+     * this function pushes one entry per demotion. Surfaced as
+     * `QuorumAggregateOutcome.disagreements` so the runner can emit
+     * telemetry without re-walking the results.
+     */
+    disagreementSink?: CriticDisagreementNote[];
+}
 /**
  * Cycle 322.3 — does this completed critic veto the gate?
  *
@@ -27,8 +105,24 @@ export declare function isCriticCompleted(r: CriticResult): boolean;
  * CHANGES_REQUESTED verdict) blocks the gate regardless of how many
  * other critics approved. Returns `false` for non-completed critics
  * — only a completed critic can veto.
+ *
+ * Issue dark-factory-platform#112 — when `corroborationCtx` is
+ * supplied AND the critic's only veto trigger is a blocking finding
+ * carrying one of the configured corroboration-required flags (e.g.
+ * `selfInconsistent: true`), the function checks whether ANOTHER
+ * critic raises a blocking finding on the same file within
+ * `rules.requireCorroborationOnHunkRadius` lines. If not, the
+ * finding is demoted to a `critic_disagreement` note (pushed to
+ * `disagreementSink`) and DOES NOT contribute to a veto. Findings
+ * without a flag still veto unconditionally — the safety net is
+ * intact for findings the critic can defend.
+ *
+ * Note: a critic that vetoes via `CHANGES_REQUESTED` verdict OR
+ * `requiresHumanJudgment` is NOT subject to corroboration — those
+ * are coarser-grained signals than per-finding flags and the spec
+ * narrows the rule to per-finding flag triggers only.
  */
-export declare function criticVetoesGate(r: CriticResult, blockingSeverities: ReviewSeverity[]): boolean;
+export declare function criticVetoesGate(r: CriticResult, blockingSeverities: ReviewSeverity[], corroborationCtx?: VetoCorroborationContext): boolean;
 export interface QuorumAggregateOutcome {
     verdict: ReviewVerdict;
     /**
@@ -48,6 +142,15 @@ export interface QuorumAggregateOutcome {
     reason: "majority" | "veto" | "quorum_unmet";
     completedCount: number;
     totalCount: number;
+    /**
+     * Issue dark-factory-platform#112 — findings the aggregator demoted
+     * from a unilateral veto to an informational disagreement note
+     * because the `unilateralVetoRules.requireCorroborationFor` policy
+     * fired AND no other critic corroborated. Always present (empty
+     * array when no demotions occurred OR no policy was active) so
+     * callers can branch on `.length` without an undefined check.
+     */
+    disagreements: CriticDisagreementNote[];
 }
 /**
  * Cycle 322.3 — compute the aggregate verdict under
@@ -70,7 +173,7 @@ export interface QuorumAggregateOutcome {
  * property: an outage that knocks out two critics doesn't paralyze
  * the third critic's BLOCKER finding.
  */
-export declare function quorumAggregateVerdict(results: CriticResult[], blockingSeverities: ReviewSeverity[], quorum: number): QuorumAggregateOutcome;
+export declare function quorumAggregateVerdict(results: CriticResult[], blockingSeverities: ReviewSeverity[], quorum: number, unilateralVetoRules?: UnilateralVetoRules): QuorumAggregateOutcome;
 export interface CriticReport {
     /** Full multi-line block for stdout (CI log + local terminal). */
     stdout: string;
@@ -98,6 +201,30 @@ export interface CriticReport {
  * "X/Y critics errored" line agrees with the quorum aggregator's view.
  */
 export declare function buildCriticReport(artifact: ReviewArtifact, jsonPath: string): CriticReport;
+export interface ZeroEvidenceDiagnostic {
+    /**
+     * True when completedCount === 0 AND totalCount > 0. The caller writes
+     * `stderr` to process.stderr when this is true and skips otherwise.
+     */
+    isZeroEvidence: boolean;
+    /**
+     * The formatted stderr block, including the leading "df: review
+     * COMPLETED..." headline, per-critic remediation lines, and the
+     * "details:" footer. Empty string when `isZeroEvidence` is false.
+     */
+    stderr: string;
+}
+export interface ZeroEvidenceOptions {
+    /**
+     * Hint from the caller that the loaded config has no `profiles` block
+     * (or the requested profile name is missing from it). When false, the
+     * diagnostic surfaces a top-line remediation pointing the operator at
+     * `.agent-review/config.json`. When undefined, no top-line config hint
+     * is added — only per-critic hints are emitted.
+     */
+    configHasProfiles?: boolean;
+}
+export declare function buildZeroEvidenceDiagnostic(artifact: ReviewArtifact, jsonPath: string, options?: ZeroEvidenceOptions): ZeroEvidenceDiagnostic;
 export interface WriteResult {
     jsonPath: string;
     markdownPath: string | null;

package/dist/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOvD,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAOlB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAUD,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CA0BtE;AA6ED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAE1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,YAAY,EACf,kBAAkB,EAAE,cAAc,EAAE,GACnC,OAAO,CAMT;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,cAAc,CAAC;IAI7C,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,YAAY,EAAE,EACvB,kBAAkB,EAAE,cAAc,EAAE,EACpC,MAAM,EAAE,MAAM,GACb,sBAAsB,CAqCxB;AAsBD,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,YAAY,CAqFd;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IAEjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAeD,wBAAsB,cAAc,CAClC,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,WAAW,CAAC,CAkBtB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAWhC;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CA+F/D;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CAOtB;AAGD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQxD"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOvD,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAkBxC;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CAQT;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,SAAS,YAAY,EAAE,EACnC,kBAAkB,EAAE,SAAS,cAAc,EAAE,EAC7C,MAAM,EAAE,MAAM,GACb,OAAO,CAeT;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAOlB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAUD,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CAoCtE;AAuHD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAE1D;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC;qEACiE;IACjE,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IACpC,KAAK,EAAE,mBAAmB,CAAC;IAC3B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,EAAE,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,YAAY,EACf,kBAAkB,EAAE,cAAc,EAAE,EACpC,gBAAgB,CAAC,EAAE,wBAAwB,GAC1C,OAAO,CAgGT;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,cAAc,CAAC;IAI7C,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,aAAa,EAAE,sBAAsB,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,YAAY,EAAE,EACvB,kBAAkB,EAAE,cAAc,EAAE,EACpC,MAAM,EAAE,MAAM,EACd,mBAAmB,CAAC,EAAE,mBAAmB,GACxC,sBAAsB,CAgFxB;AAsBD,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,YAAY,CAqFd;AAiCD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAeD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,mBAAwB,GAChC,sBAAsB,CAwCxB;AAkED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IAEjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAeD,wBAAsB,cAAc,CAClC,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,WAAW,CAAC,CAkBtB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAWhC;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CA0H/D;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CAOtB;AAGD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQxD"}

package/dist/report.js

@@ -1,6 +1,87 @@
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { artifactJsonPath, artifactLockPath, artifactMarkdownPath, resolveArtifactDir, } from "./paths.js";
 import { parseReviewArtifact, REVIEW_SEVERITIES, } from "@momentiq/dark-factory-schemas";
+// ---------------------------------------------------------------------------
+// Issue dark-factory-platform#112 — flag-name → ReviewFinding-key mapping.
+//
+// The policy config (`AggregationConfig.unilateralVetoRules.requireCorroborationFor`)
+// uses snake_case opaque identifiers so the wire surface is stable
+// independent of the TypeScript field name. The aggregator translates
+// each identifier to the corresponding `ReviewFinding` boolean property
+// at evaluation time. Future flags (e.g. `requires_human_judgment`,
+// `low_confidence`) land here when they need the same
+// corroboration-or-disagreement-note treatment.
+// ---------------------------------------------------------------------------
+const FLAG_TO_FINDING_KEY = {
+    self_inconsistent: "selfInconsistent",
+};
+/**
+ * True when the finding carries any of the flags listed in
+ * `requireCorroborationFor`. Flags not present in `FLAG_TO_FINDING_KEY`
+ * are ignored — an unknown flag in config is a no-op rather than a
+ * runtime error so operators can pin policy without first deploying a
+ * CLI that knows the flag (forward-compat).
+ *
+ * Exported so `gate.ts` shares the canonical translation table and
+ * cannot drift.
+ */
+export function findingCarriesCorroborationFlag(finding, flagNames) {
+    for (const name of flagNames) {
+        const key = FLAG_TO_FINDING_KEY[name];
+        if (key === undefined)
+            continue;
+        const v = finding[key];
+        if (v === true)
+            return true;
+    }
+    return false;
+}
+/**
+ * True when at least one OTHER completed critic has a blocking-severity
+ * finding on the SAME file within `radius` lines of `target`.
+ *
+ * Exported so `gate.ts` shares the canonical corroboration predicate
+ * and cannot drift.
+ *
+ * "Other" = different `criticId`. Critics never corroborate themselves.
+ * "Blocking-severity" = `blockingSeverities.includes(f.severity)`. The
+ * corroborator is checked WITHOUT recursing into the corroboration
+ * rule — a corroborator that itself carries `selfInconsistent: true`
+ * still corroborates (the spec's safety net is "another critic saw a
+ * blocker here too", not "another critic's blocker survived
+ * corroboration"). This intentional asymmetry prevents an N-way
+ * corroboration-cycle.
+ *
+ * `target.file === undefined` → returns false (corroboration is
+ * file-scoped; a finding without a file cannot be corroborated).
+ * `target.line === undefined` → treats the target line as `0` (matches
+ * any line in the same file within the radius window — the safety
+ * net errs toward "yes, this is corroborated" when the target's
+ * location is imprecise).
+ */
+export function isCorroboratedByOtherCritic(target, targetCriticId, allResults, blockingSeverities, radius) {
+    if (!target.file)
+        return false;
+    const targetLine = target.line ?? 0;
+    for (const other of allResults) {
+        if (other.criticId === targetCriticId)
+            continue;
+        if (other.status !== "complete")
+            continue;
+        for (const f of other.findings) {
+            if (!blockingSeverities.includes(f.severity))
+                continue;
+            if (f.file !== target.file)
+                continue;
+            if (target.line === undefined || f.line === undefined)
+                return true;
+            const distance = Math.abs(f.line - targetLine);
+            if (distance <= radius)
+                return true;
+        }
+    }
+    return false;
+}
 const SEVERITY_RANK = {
     blocker: 0,
     high: 1,
@@ -14,9 +95,18 @@ export function buildAggregate(inputs) {
     const aggregationPolicy = loaded.config.aggregation.policy;
     const blockingSeverities = loaded.config.aggregation.blockingSeverities;
     let gateVerdict;
+    let disagreements = [];
     if (status === "complete") {
-        gateVerdict = aggregateVerdict(criticResults, blockingSeverities, loaded, quorumOverride);
+        const aggregate = aggregateOutcome(criticResults, blockingSeverities, loaded, quorumOverride);
+        gateVerdict = aggregate.verdict;
+        disagreements = aggregate.disagreements;
     }
+    // Cursor finding (report.ts:981) — persist the demoted findings on
+    // the artifact so operators auditing the on-disk JSON see the
+    // demotion without re-running the aggregator. Always emit `[]` on
+    // complete artifacts so consumers can branch on `.length` without
+    // an undefined check; omit on pending/error artifacts (no
+    // aggregation ran, no policy outcome to record).
     const artifact = {
         version: 2,
         status,
@@ -30,9 +120,21 @@ export function buildAggregate(inputs) {
         criticResults,
         createdAt,
         ...(gateVerdict !== undefined ? { gateVerdict } : {}),
+        ...(status === "complete" ? { disagreements } : {}),
     };
     return artifact;
 }
+function aggregateOutcome(results, blockingSeverities, loaded, quorumOverride) {
+    if (loaded.config.aggregation.policy === "min-complete-quorum") {
+        const quorum = quorumOverride ?? loaded.config.aggregation.quorum;
+        const outcome = quorumAggregateVerdict(results, blockingSeverities, quorum ?? 2, loaded.config.aggregation.unilateralVetoRules);
+        return { verdict: outcome.verdict, disagreements: outcome.disagreements };
+    }
+    return {
+        verdict: aggregateVerdict(results, blockingSeverities, loaded, quorumOverride),
+        disagreements: [],
+    };
+}
 function aggregateVerdict(results, blockingSeverities, loaded, quorumOverride) {
     // Cycle 322.3 — dispatch on policy. `min-complete-quorum` uses the
     // quorum aggregator below; everything else falls through to the
@@ -45,11 +147,14 @@ function aggregateVerdict(results, blockingSeverities, loaded, quorumOverride) {
         // report CHANGES_REQUESTED (uses root quorum=2). Codex P2 caught
         // this divergence on PR #1468.
         const quorum = quorumOverride ?? loaded.config.aggregation.quorum;
+        // Issue dark-factory-platform#112 — thread the optional
+        // `unilateralVetoRules` so the persisted artifact's verdict honors
+        // the same corroboration policy the runtime gate evaluator does.
         // Schema validation guarantees `quorum` is set when the policy
         // is `min-complete-quorum`; the defensive fallback to 2 is for
         // hand-constructed configs in tests (the parser would already
         // have rejected a real on-disk config without quorum).
-        return quorumAggregateVerdict(results, blockingSeverities, quorum ?? 2).verdict;
+        return quorumAggregateVerdict(results, blockingSeverities, quorum ?? 2, loaded.config.aggregation.unilateralVetoRules).verdict;
     }
     // Cycle 322.2 Component 4 — `required` flag threading.
     //
@@ -121,16 +226,115 @@ export function isCriticCompleted(r) {
  * CHANGES_REQUESTED verdict) blocks the gate regardless of how many
  * other critics approved. Returns `false` for non-completed critics
  * — only a completed critic can veto.
+ *
+ * Issue dark-factory-platform#112 — when `corroborationCtx` is
+ * supplied AND the critic's only veto trigger is a blocking finding
+ * carrying one of the configured corroboration-required flags (e.g.
+ * `selfInconsistent: true`), the function checks whether ANOTHER
+ * critic raises a blocking finding on the same file within
+ * `rules.requireCorroborationOnHunkRadius` lines. If not, the
+ * finding is demoted to a `critic_disagreement` note (pushed to
+ * `disagreementSink`) and DOES NOT contribute to a veto. Findings
+ * without a flag still veto unconditionally — the safety net is
+ * intact for findings the critic can defend.
+ *
+ * Note: a critic that vetoes via `CHANGES_REQUESTED` verdict OR
+ * `requiresHumanJudgment` is NOT subject to corroboration — those
+ * are coarser-grained signals than per-finding flags and the spec
+ * narrows the rule to per-finding flag triggers only.
  */
-export function criticVetoesGate(r, blockingSeverities) {
+export function criticVetoesGate(r, blockingSeverities, corroborationCtx) {
     if (!isCriticCompleted(r))
         return false;
-    if (r.verdict === "CHANGES_REQUESTED")
-        return true;
+    // requiresHumanJudgment is a coarser-grained signal than per-finding
+    // flags; the spec narrows corroboration to per-finding triggers
+    // only. A critic that flags requiresHumanJudgment vetoes
+    // unconditionally regardless of policy.
     if (r.requiresHumanJudgment)
         return true;
-    if (hasBlockingFinding(r.findings, blockingSeverities))
+    // Back-compat path: no policy → check verdict OR any blocking
+    // finding (the pre-#112 §11 semantic).
+    if (corroborationCtx === undefined) {
+        if (r.verdict === "CHANGES_REQUESTED")
+            return true;
+        return hasBlockingFinding(r.findings, blockingSeverities);
+    }
+    // Issue dark-factory-platform#112 — policy-aware veto evaluation.
+    // Walk every blocking finding and partition into:
+    //   - `anyUnflaggedBlocking`: the safety net — any finding the
+    //     critic can defend stands as a veto.
+    //   - `anyCorroboratedFlagged`: flagged AND another critic raised a
+    //     same-file blocker within radius → veto stands.
+    //   - `demotions`: flagged AND uncorroborated → recorded as
+    //     `critic_disagreement` notes; do NOT contribute to veto.
+    //
+    // A critic with `verdict === "CHANGES_REQUESTED"` is itself subject
+    // to demotion under policy WHEN every blocking finding is demoted
+    // AND the verdict is downstream of those findings (heuristic: if no
+    // unflagged or corroborated blocker remains, the CR verdict is the
+    // critic's downstream summary of the now-demoted finding(s)). This
+    // is the spec's "verdict flips from CHANGES_REQUESTED to APPROVED"
+    // case from the DoD. A critic with CR and NO blocking findings at
+    // all retains its veto unconditionally — the verdict in that case
+    // is verdict-only with no per-finding flag to demote.
+    const { allResults, rules, disagreementSink } = corroborationCtx;
+    let anyUnflaggedBlocking = false;
+    let anyCorroboratedFlagged = false;
+    let anyBlockingFinding = false;
+    const demotions = [];
+    for (const f of r.findings) {
+        if (!blockingSeverities.includes(f.severity))
+            continue;
+        anyBlockingFinding = true;
+        const flagged = findingCarriesCorroborationFlag(f, rules.requireCorroborationFor);
+        if (!flagged) {
+            anyUnflaggedBlocking = true;
+            continue;
+        }
+        const corroborated = isCorroboratedByOtherCritic(f, r.criticId, allResults, blockingSeverities, rules.requireCorroborationOnHunkRadius);
+        if (corroborated) {
+            anyCorroboratedFlagged = true;
+            continue;
+        }
+        // Flagged AND uncorroborated → demote to a disagreement note.
+        if (f.file) {
+            demotions.push({
+                criticId: r.criticId,
+                file: f.file,
+                ...(f.line !== undefined ? { line: f.line } : {}),
+                severity: f.severity,
+                // The first flag the finding actually carries wins for note
+                // attribution; in practice today only `self_inconsistent` is
+                // a registered key so this is a single-element search.
+                flag: rules.requireCorroborationFor.find((name) => {
+                    const key = FLAG_TO_FINDING_KEY[name];
+                    return key !== undefined && f[key] === true;
+                }) ?? rules.requireCorroborationFor[0],
+                evidence: f.evidence,
+            });
+        }
+    }
+    // Veto sustained when any defendable signal remains:
+    //   - An unflagged blocker (the safety net).
+    //   - A corroborated flagged blocker (another critic agrees).
+    //   - A CHANGES_REQUESTED verdict that's NOT downstream of the
+    //     now-demoted findings — i.e. the critic returned CR without any
+    //     blocking finding to attribute it to (verdict-only block, the
+    //     coarser §11 signal). That CR survives policy because there's
+    //     no per-finding flag to demote it through.
+    if (anyUnflaggedBlocking || anyCorroboratedFlagged) {
+        if (disagreementSink)
+            disagreementSink.push(...demotions);
+        return true;
+    }
+    if (r.verdict === "CHANGES_REQUESTED" && !anyBlockingFinding) {
+        // Verdict-only block, no blockers to demote → veto sustained.
         return true;
+    }
+    // All blockers demoted (and either APPROVED verdict OR
+    // CHANGES_REQUESTED-downstream-of-blockers) → no veto.
+    if (disagreementSink)
+        disagreementSink.push(...demotions);
     return false;
 }
 /**
@@ -154,15 +358,29 @@ export function criticVetoesGate(r, blockingSeverities) {
  * property: an outage that knocks out two critics doesn't paralyze
  * the third critic's BLOCKER finding.
  */
-export function quorumAggregateVerdict(results, blockingSeverities, quorum) {
+export function quorumAggregateVerdict(results, blockingSeverities, quorum, unilateralVetoRules) {
     const completed = results.filter(isCriticCompleted);
-    const vetoer = completed.find((r) => criticVetoesGate(r, blockingSeverities));
+    const disagreements = [];
+    // Issue dark-factory-platform#112 — when the policy is set, thread
+    // it through every `criticVetoesGate` call so a single uncorroborated
+    // flagged finding doesn't sweep a veto. The disagreement sink is
+    // shared across critics so the runner sees all demotions in one
+    // pass.
+    const ctx = unilateralVetoRules !== undefined
+        ? {
+            allResults: results,
+            rules: unilateralVetoRules,
+            disagreementSink: disagreements,
+        }
+        : undefined;
+    const vetoer = completed.find((r) => ctx ? criticVetoesGate(r, blockingSeverities, ctx) : criticVetoesGate(r, blockingSeverities));
     if (vetoer) {
         return {
             verdict: "CHANGES_REQUESTED",
             reason: "veto",
             completedCount: completed.length,
             totalCount: results.length,
+            disagreements,
         };
     }
     if (completed.length < quorum) {
@@ -171,12 +389,40 @@ export function quorumAggregateVerdict(results, blockingSeverities, quorum) {
             reason: "quorum_unmet",
             completedCount: completed.length,
             totalCount: results.length,
+            disagreements,
         };
     }
     // Quorum met and no veto — vote the majority of completed critics.
     // Without veto, every completed critic has APPROVED OR (no verdict
     // — schema impossible, but defensive). Count APPROVED vs other.
-    const approveCount = completed.filter((r) => r.verdict === "APPROVED").length;
+    //
+    // Issue dark-factory-platform#112 — when a corroboration policy is
+    // active and a critic's CHANGES_REQUESTED verdict is downstream of
+    // a now-demoted blocker (every blocking finding the critic produced
+    // was demoted under the policy), treat that critic as effectively
+    // APPROVED for majority counting. Without this, the critic that
+    // produced the demoted blocker would still flip the majority to
+    // CHANGES_REQUESTED via its CR verdict, which would undo the
+    // demotion the policy just performed. This is the spec's DoD case:
+    // "verdict flips from CHANGES_REQUESTED to APPROVED after the
+    // probe-tagged blocker is demoted, no other critic finds a
+    // corroborating blocker on the same file within radius."
+    const effectivelyApproved = (r) => {
+        if (r.verdict === "APPROVED")
+            return true;
+        if (ctx === undefined)
+            return false;
+        // If the critic returned CR with at least one blocker and every
+        // blocker was demoted to a disagreement note attributed to this
+        // critic, the CR verdict is downstream of the now-demoted
+        // finding(s).
+        const blockers = r.findings.filter((f) => blockingSeverities.includes(f.severity));
+        if (blockers.length === 0)
+            return false;
+        const demotedForThisCritic = disagreements.filter((d) => d.criticId === r.criticId).length;
+        return demotedForThisCritic >= blockers.length;
+    };
+    const approveCount = completed.filter(effectivelyApproved).length;
     const changesCount = completed.length - approveCount;
     // Ties favor CHANGES_REQUESTED (conservative). With 0 changes, all
     // approved → APPROVED. With any changes >= approveCount → CHANGES_REQUESTED.
@@ -190,6 +436,7 @@ export function quorumAggregateVerdict(results, blockingSeverities, quorum) {
         reason: "majority",
         completedCount: completed.length,
         totalCount: results.length,
+        disagreements,
     };
 }
 /**
@@ -279,6 +526,91 @@ export function buildCriticReport(artifact, jsonPath) {
         degraded,
     };
 }
+export function buildZeroEvidenceDiagnostic(artifact, jsonPath, options = {}) {
+    const results = artifact.criticResults;
+    const totalCount = results.length;
+    const completedCount = results.filter((r) => r.status === "complete").length;
+    const isZeroEvidence = totalCount > 0 && completedCount === 0;
+    if (!isZeroEvidence) {
+        return { isZeroEvidence, stderr: "" };
+    }
+    const classified = results.map((r) => classifyCritic(r));
+    const lines = [
+        `df: review COMPLETED with 0/${totalCount} critics producing evidence — gate will block at push time.`,
+        `df: fix one of:`,
+    ];
+    // Top-line config remediation when the caller signaled the profiles
+    // block is missing entirely (sage-blueprint seed bug shape).
+    if (options.configHasProfiles === false) {
+        lines.push(`df:   - add a 'profiles' block to .agent-review/config.json (mirror sage3c's pattern; see docs/CONSUMER-ADOPTION.md)`);
+    }
+    // Per-critic remediation hints. Use a Set to dedupe identical hints
+    // (e.g., two critics from the same family both missing the same env).
+    const emittedHints = new Set();
+    for (const c of classified) {
+        const hint = `df:   - ${c.criticId}: ${c.remediation}`;
+        if (emittedHints.has(hint))
+            continue;
+        emittedHints.add(hint);
+        lines.push(hint);
+    }
+    lines.push(`df: details: ${jsonPath}`);
+    return {
+        isZeroEvidence,
+        stderr: `${lines.join("\n")}\n`,
+    };
+}
+function classifyCritic(result) {
+    const message = result.error?.message ?? "";
+    const code = result.error?.code ?? "";
+    // Codex "no auth source pinned" — the documented failure when the
+    // profile lacks the per-critic `auth` entry. The codex-sdk adapter
+    // raises this with a stable message prefix.
+    if (/no auth source pinned/i.test(message)) {
+        return {
+            criticId: result.criticId,
+            classification: "no_auth_codex_unpinned",
+            remediation: `pin profiles.<name>.auth["${result.criticId}"] to "chatgpt" (and run \`codex login\`) or "api" (and set CODEX_API_KEY)`,
+        };
+    }
+    // Env-var-missing — the cursor/gemini/grok/codex API-key paths use a
+    // stable "<KEY> is not set" message in their auth probes.
+    const envMatch = message.match(/([A-Z][A-Z0-9_]*_API_KEY|[A-Z][A-Z0-9_]*_TOKEN)\s+is\s+not\s+set/);
+    if (envMatch && envMatch[1]) {
+        const envName = envMatch[1];
+        return {
+            criticId: result.criticId,
+            classification: "no_auth_env_missing",
+            remediation: `export ${envName}=... (or add it to your Doppler scope)`,
+        };
+    }
+    // Transport / capacity errors — these surface as SDK error codes
+    // (`rate_limited`, `capacity_exceeded`, `timeout`, `service_unavailable`).
+    if (/^(rate_limited|capacity_exceeded|timeout|service_unavailable|server_error|unavailable)$/i.test(code) ||
+        /capacity_exceeded|rate.?limit|service unavailable/i.test(message)) {
+        return {
+            criticId: result.criticId,
+            classification: "transport_error",
+            remediation: `transport/rate-limit error — retry the commit; if persistent, check vendor status`,
+        };
+    }
+    // Schema violations — adapter returned data that doesn't match the
+    // expected schema (typically after a vendor model bump).
+    if (/^(schema_violation|invalid_response|malformed_response)$/i.test(code) ||
+        /schema_violation|malformed verdict|malformed response/i.test(message)) {
+        return {
+            criticId: result.criticId,
+            classification: "schema_violation",
+            remediation: `schema violation — upgrade the @momentiq/dark-factory-cli adapter version`,
+        };
+    }
+    // Generic fallback — point the operator at `df doctor` for triage.
+    return {
+        criticId: result.criticId,
+        classification: "unknown",
+        remediation: `unclassified error — run \`df doctor --profile <name>\` for per-critic triage`,
+    };
+}
 // JSON is the authoritative gate-input; markdown is a presentation artifact.
 // The write order is JSON-first, markdown best-effort, so a broken markdown
 // path (e.g., a previously-created directory at the markdown filename) cannot
@@ -398,7 +730,14 @@ export function renderMarkdown(artifact) {
                 for (const f of subset) {
                     lines.push("");
                     const tag = f.manifestoSection ? ` ${f.manifestoSection}` : "";
-                    lines.push(`- **${f.category}${tag}** — \`${f.file ?? "(no file)"}\`${f.line !== undefined ? `:${f.line}` : ""}${f.symbol ? ` (\`${f.symbol}\`)` : ""}`);
+                    // Cursor finding (report.ts:981) — surface the
+                    // self-consistency-probe verdict alongside the location so a
+                    // reader scanning the markdown immediately sees which
+                    // blockers were probe-flagged. The aggregator may have
+                    // demoted these to disagreement notes — see the
+                    // "Demoted findings" section at the end of the artifact.
+                    const probeTag = f.selfInconsistent === true ? " [self-inconsistent]" : "";
+                    lines.push(`- **${f.category}${tag}** — \`${f.file ?? "(no file)"}\`${f.line !== undefined ? `:${f.line}` : ""}${f.symbol ? ` (\`${f.symbol}\`)` : ""}${probeTag}`);
                     lines.push(`  - Evidence: ${f.evidence}`);
                     lines.push(`  - Impact: ${f.impact}`);
                     lines.push(`  - Required fix: ${f.requiredFix}`);
@@ -425,6 +764,24 @@ export function renderMarkdown(artifact) {
         }
         lines.push("");
     }
+    // Cursor finding (report.ts:981) — surface the aggregator's
+    // demoted findings so a reader of the per-SHA markdown sees the
+    // policy outcome (which blockers became disagreement notes and
+    // why). Omitted entirely when no demotions occurred (the common
+    // case for runs without `unilateralVetoRules` set or for runs
+    // where every flagged blocker corroborated).
+    if (artifact.disagreements && artifact.disagreements.length > 0) {
+        lines.push("## Demoted findings");
+        lines.push("");
+        lines.push("Findings the aggregator demoted from a unilateral veto to an informational `critic_disagreement` note under `unilateralVetoRules.requireCorroborationFor`.");
+        lines.push("");
+        for (const d of artifact.disagreements) {
+            const loc = d.line !== undefined ? `${d.file}:${d.line}` : d.file;
+            lines.push(`- **${d.criticId}** — \`${loc}\` (${d.severity}, flag: \`${d.flag}\`)`);
+            lines.push(`  - Evidence: ${d.evidence}`);
+        }
+        lines.push("");
+    }
     return `${lines.join("\n")}\n`;
 }
 export async function writePending(loaded, inputs) {