@nextcommerce/campaigns-os 1.41.2 → 1.43.2

package/skills/campaign-run-evidence/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: campaign-run-evidence
-version: 1.0.3
+version: 1.0.9
 description: Interpret existing Campaigns OS doctor, QA and proof-depth evidence without claiming more proof than the artifacts contain.
 ---
 
-Bundle revision: 1.41.2+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.41.2+skills.1`
+Bundle revision: 1.43.2+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.43.2+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -59,9 +59,11 @@ nothing about ordering — it records a policy and an unmet one.
 
 ## Interpret the verdict exactly
 
-Only a JSON QA verdict is a verdict. The runner writes its full verdict and
-attempts to publish it to the QA portal; a publication failure does not erase
-the local one. The readback projects `.campaign-runtime/qa-verdict.json` when
+Only a JSON QA verdict is a verdict. The runner writes its full verdict locally.
+Saved-Map QA may publish it under the existing consent and flag controls; a
+publication failure does not erase the local one. Local-spec packet verdicts
+stay local even with `--post-verdict`, and `qa publish` refuses those packets.
+The readback projects `.campaign-runtime/qa-verdict.json` when
 that sidecar has been copied into the campaign repository. A markdown QA
 report, a ledger or a gate script is not a verdict and must not be scanned for
 a disposition, a run id or a blocker. Where two JSON verdicts exist, interpret

package/skills/contribution-intake/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: contribution-intake
-version: 1.0.3
+version: 1.0.9
 description: Turn a suggestion about the agent surface into a classified, evidence-checked proposal and, only with attended approval, one issue on this repository's tracker.
 ---
 
-Bundle revision: 1.41.2+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.41.2+skills.1`
+Bundle revision: 1.43.2+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.43.2+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-build/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-build
-version: 1.0.8
+version: 1.0.14
 description: Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts.
 ---
 
-Bundle revision: 1.41.2+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.41.2+skills.1`
+Bundle revision: 1.43.2+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.43.2+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -84,7 +84,7 @@ Build rules:
 - Replace values named by `frontmatter.replaceFromSpecOrApi`.
 - Remove unsupported surfaces named by `frontmatter.removeWhenUnsupported`.
 - Preserve SDK-owned checkout/cart/upsell/receipt/payment/address/totals/submit surfaces.
-- If `doctor` (tier `none`: read-only inspection; `--write`/`--built` are tier `B`) reports `derived.scope.mode = "partial"`, build the pages listed in `derived.scope.built_pages` from their prepared source. A page in `derived.scope.out_of_scope_pages` whose assembly-report decision `dec_page_scope_<page>` carries `template_stock: true` is template stock: materialise it from the locked family's own page for that role (`decision.template_family`; the `next build` prompt lists them), copied atomically with its dependent `_includes/`, `_layouts/`, and assets, and wired from CampaignSpec — a pre-checkout `select` step first, because it seeds the cart the runtime pages read. Do not look for prepared source HTML for it, and do not attest a screenshot of it as a design source. Once its built HTML exists at the page's route, doctor lists it among the previewable routes and lifts the runtime-QA block for it. An out-of-scope page without that marker stays unbuilt: carry its `skip_reason` into the assembly report and label the preview as route/visual-testable rather than full-funnel launch-ready.
+- If `doctor` (tier `none`: read-only inspection; `--write`/`--built` are tier `B`) reports `derived.scope.mode = "partial"`, build the pages listed in `derived.scope.built_pages` from their prepared source. Keep every out-of-scope route unbuilt by default, including pages marked `template_stock: true`; never publish placeholder presell/landing pages that remain on another host. Materialize a stock page only with explicit per-page operator opt-in (including a required pre-checkout `select` stand-in). For opted-in pages use the locked family's own page for that role with its dependent `_includes/`, `_layouts/`, and assets, wire it from CampaignSpec, and build a required select step first. Do not attest stock screenshots as design source. Built stock pages rejoin preview QA once their HTML exists. Carry remaining `skip_reason` declarations into the report and label the preview route/visual-testable rather than full-funnel launch-ready.
 - For `landing` and `presell` pages, prefer the prepared source HTML when `source_html.pages[].path` points at a real standalone page. Preserve the design/content through a passthrough page-kit layout, inject the SDK loader/config as needed, and repoint CTAs into the CampaignSpec flow. Treat `source_html.pages[].path` and `context.page_map[].source_path` as source provenance. Treat `source_html.pages[].page_kit`, `context.page_map[].page_kit`, and `context.page_map[].output_path` as the Page Kit target file, route, CPK `page_type`, and frontmatter projection.
 - Prepared source HTML means page-kit-ready markup, not a wholesale Liquid rewrite. Standalone AI/exported HTML should keep page-owned body markup, remove document wrappers, add YAML frontmatter, move shared CSS/assets into the campaign structure, and use Liquid helpers only where page-kit needs campaign-rooted links/assets/includes.
 - For `checkout`, `upsell`, `downsell`, and `receipt` pages, treat the selected starter-template commerce surface as the SDK contract reference: preserve required `data-next-*` controls, hidden fields, payment/address/totals/submit wiring, and `next_dont_touch` regions. The surrounding HTML wrapper, page composition, imagery, copy hierarchy, and brand layer are campaign/source-owned. Do not carry starter visual chrome forward when prepared source design should own that surface.

package/skills/next-campaigns-os/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-os
-version: 1.0.23
+version: 1.0.29
 description: Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth.
 ---
 
-Bundle revision: 1.41.2+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.41.2+skills.1`
+Bundle revision: 1.43.2+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.43.2+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -60,7 +60,20 @@ but those wrappers should not redefine the public contract.
 
 Workflow:
 
-1. Confirm the campaign was configured in Campaigns App and exported from Campaign Map Builder as current CampaignSpec JSON. Current authoring is v4.3+ while preserving the v4.2 `funnels[]` topology as the compatibility shape.
+Local-spec runs use packet-based QA and repository evidence. They never post QA
+to the Map portal or claim saved-Map revision alignment. Existing lifecycle
+gates remain in force; use `local-serve` for the first localhost proof.
+
+1. Confirm the selected campaign is configured in Campaigns App. Use its current
+saved Map export when available. For HTML-and-brief intake without a Map, author
+a normal CampaignSpec from the source design, operator's brief and verified
+Campaigns API commerce values. Follow `docs/build-packet.md` "Local-spec entry":
+create one `spec_identity.local_spec_id` (UUID), preserve it through revisions,
+set `public_route_slug`, and omit saved-Map identity/URLs. Do not ask the operator
+to author a spec or fabricate a Map ID. Verify store/campaign binding and real
+package/offer references. Store contact and policy details can come from the
+brief; gateway access is optional. Current authoring is v4.3+ while preserving
+the v4.2 `funnels[]` topology as the compatibility shape.
 2. Run `campaigns-os start` or `campaigns-os prepare-build` (tier `A`: they write the
 Build Packet, Build Context, assembly report, run session and `.gitignore` under
 the target plus a Run Record under the working directory, and they contact the

package/skills/next-campaigns-os/references/session-intake.md

@@ -40,7 +40,7 @@ end-to-end campaign.
 
 Required before build:
 
-- Map ID or CampaignSpec path/URL.
+- Saved Map ID/export, or the configured store/campaign details, public key, prepared HTML/assets and brief from which the agent authors a local CampaignSpec. Do not make a saved Map a prerequisite; follow `docs/build-packet.md` "Local-spec entry".
 - Public route slug and target repo/output directory.
 - Source type and source files: Figma, exported HTML, prepared HTML, existing campaign, or other.
 - Pages in scope and any pages to preserve.
@@ -101,10 +101,10 @@ Use when the user wants evidence on a deployed campaign and no source edit.
 
 Collect:
 
-- Map ID and deployed base URL.
-- Build Packet path if local; otherwise enough info to resolve topology.
+- Saved Map ID or local-spec Build Packet, plus the tested base URL.
+- Build Packet path; required for a local spec, otherwise enough info to resolve topology.
 - Whether browser QA should run.
-- Whether verdict should use the default QA portal publish path or stay local-only.
+- For a saved Map, whether the verdict should use the QA portal publish path or stay local-only. Local-spec packet QA always keeps verdicts and progress local, even with `--post-verdict`; `qa publish` refuses it. Run Telemetry retains its consent controls.
 - Typed-card test-order depth (`common`/explicit/`full`).
 
 Route to QA. Do not patch campaign code from the QA-only path.

package/skills/next-campaigns-os-setup/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-os-setup
-version: 2.0.6
+version: 2.0.12
 description: Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly installed as next-campaigns-setup; renamed 2026-08 to stop colliding with the published NextCommerceCo/skills scaffolder of that name.
 ---
 
-Bundle revision: 1.41.2+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.41.2+skills.1`
+Bundle revision: 1.43.2+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.43.2+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-polish/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-polish
-version: 1.1.7
+version: 1.1.13
 description: Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign.
 ---
 
-Bundle revision: 1.41.2+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.41.2+skills.1`
+Bundle revision: 1.43.2+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.43.2+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-qa/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-qa
-version: 1.3.7
-description: Run spec-aware QA from a Campaign Map ID and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof.
+version: 1.3.13
+description: Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof.
 ---
 
-Bundle revision: 1.41.2+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.41.2+skills.1`
+Bundle revision: 1.43.2+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.43.2+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -45,7 +45,7 @@ The effect class in each parenthetical below is the declared row of
 Read that file, not this text, when an exact path or endpoint matters.
 
 
-Use this after the campaign has a preview or production URL and the assembly report records build and polish status. The public v0 runner is Node/npm-based, with an owned Playwright browser pass. `qa resolve` is tier `A` (it fetches `--base-url`; `--no-probe` is tier `B` and local); every `qa run` form is tier `C` — it overwrites the stored verdict and the assembly report, places real typed-card test orders against the campaign, and posts the verdict and the progress observation; `qa parity` is tier `A` (it drives the fixture's scenario through the candidate funnel with real typed-card orders and publishes the verdict, but takes no packet, so it writes only under `qa-output/` — never the packet, the assembly report or the verdict sidecar; `--no-post-verdict` drops the publish and stays tier `A`):
+Use this after the campaign has a tested localhost, preview or production URL and the assembly report records build and polish status. The public v0 runner is Node/npm-based, with an owned Playwright browser pass. `qa resolve` is tier `A` (it fetches `--base-url`; `--no-probe` is tier `B` and local); every `qa run` form is tier `C` — it overwrites the stored verdict and the assembly report, places requested typed-card test orders against the campaign, and can post saved-Map verdicts and progress under their existing controls. Local-spec packet verdicts and progress stay local; `qa parity` is tier `A` (it drives the fixture's scenario through the candidate funnel with real typed-card orders and publishes the verdict, but takes no packet, so it writes only under `qa-output/` — never the packet, the assembly report or the verdict sidecar; `--no-post-verdict` drops the publish and stays tier `A`):
 
 ```bash
 npx --no-install campaigns-os qa install-browser
@@ -53,9 +53,9 @@ npx --no-install campaigns-os qa resolve --packet campaign-runtime.build.json
 npx --no-install campaigns-os qa run --packet campaign-runtime.build.json --base-url <preview-url>
 # Fixture-driven migration parity proof. Publishes to the QA portal by default.
 npx --no-install campaigns-os qa parity --fixture <parity-fixture.json> --scenario <scenario-id> --base-url <preview-url>
-# Browser QA + typed-card proof. Publishes to the QA portal by default and prints the portal link.
+# Browser QA + typed-card proof. Saved-Map publishing follows consent; local-spec QA stays local.
 npx --no-install campaigns-os qa run --packet campaign-runtime.build.json --base-url <preview-url> --browser --test-order common
-# Offline / dev / CI only: keep the verdict local
+# Keep a saved-Map verdict local (local-spec verdicts are always local).
 npx --no-install campaigns-os qa run --packet campaign-runtime.build.json --base-url <preview-url> --browser --test-order common --no-post-verdict
 ```
 
@@ -66,7 +66,7 @@ already installed.
 
 Inputs:
 
-- Campaign Map ID from the Build Packet
+- Build Packet with a saved Map ID or `local_spec_id`; local-spec QA requires `--packet`
 - tested base URL (localhost dev URL, preview URL, or production URL)
 - assembly report
 - Test-order coverage choice (`common` default vs explicit paths vs topology-complete `full`) and SDK origin state (localhost is a Development domain; non-localhost origins need allowlist confirmation so the SDK loads)
@@ -89,7 +89,8 @@ Rules:
 - A missing or topology-unrecognized receipt is `MANUAL_REVIEW`/`WARN`; a recognized receipt with no dataLayer, outbound Meta, or outbound GA4 Purchase is `FAIL`/`BLOCKER`. Capture, unreadable-page, and settle-deadline errors on a recognized receipt are explicit non-waivable blockers. The `analytics-correctness:purchase-fires` waiver applies only to a genuine recognized-receipt/no-signal failure, and is recorded with `campaigns-os qa waive --assertion analytics-correctness:purchase-fires --reason "<why>"` (tier `C`: it overwrites the assembly report and doctor output; the lane is scoped to that one assertion and every other is refused).
 - Keep QA in a tight sequence: install the Playwright browser, resolve topology, run browser QA plus typed-card proof with `--test-order common` by default. Test orders need no permission step. Pause only for missing inputs, out-of-scope runtime pages that block checkout proof, or merchant-specific uncertainty.
 - Use `--browser` for rendered browser evidence. Browser QA must use the package-owned Playwright flow, not external agent/browser skills.
-- QA runs publish to the QA portal by default, so the QA tab/dashboard carries the full audit log and the run prints its portal link — report that link as the run reference. Pass `--no-post-verdict` (or `--local-only`) only for offline / dev / CI runs; `qa run --no-post-verdict` drops the verdict POST but stays tier `C` and still contacts `--base-url`, the run endpoint and the progress endpoint; those stay local-only under `qa-output/` and must not be reported as dashboard-visible.
+- Saved-Map QA publishes to the QA portal under the existing consent and flag controls; report the portal link only when publication succeeds. Pass `--no-post-verdict` (or `--local-only`) to keep that verdict local. This stays tier `C`: served-page probes, requested orders, Run Telemetry and progress retain their own controls. See `docs/qa-and-test-orders.md` for the saved-Map publication policy.
+- Local-spec QA always keeps verdicts and progress local. `qa run` suppresses portal publication even with `--post-verdict`; `qa publish` refuses local-spec packets with `local_spec`. Report the local verdict/sidecar as evidence, never a dashboard link. A matching route cannot replace a matching `local_spec_id`, and QA refuses a foreign or stale local Assembly Report. Run Telemetry still follows its consent controls.
 - Browser QA must include checkout commerce geometry evidence, not just mount counts: express-wallet buttons rendered in the current browser, card/CVV hosted iframe host dimensions, iframe text-path height, and center alignment. Apple Pay is browser/device eligible, so record mounted wallet kinds instead of requiring Apple Pay in Chrome-only QA.
 - `qa resolve` accepts either the deploy host or the campaign-root URL; when a Build Packet carries `campaign.public_route_slug`, the runner resolves page URLs under that slug.
 - Routing meta tags must be checked in runtime form. `next-success-url`, `next-upsell-accept-url`, and `next-upsell-decline-url` should point at campaign-root paths such as `/campaign-slug/upsell/`, not source filenames or unrooted spec literals.

package/skills.json

@@ -1,7 +1,7 @@
 {
   "name": "campaigns-os-skills",
   "description": "Skills bundled with Campaigns OS. `skills.sh` installs these into the shared agent skill directories (~/.claude/skills, ~/.codex/skills), so each one is a versioned package: bump the version whenever a package changes. `bundle_revision` identifies the bundle as a whole — `<package version>+skills.<n>`, where the prefix is this package's version and `<n>` counts the skill-text revisions published against it. It advances whenever ANY bundled skill changes, every SKILL.md states it on its first body line, and `campaigns-os tooling status --skills-revision <value>` compares the value an agent read from a skill against the bundle on disk. See docs/skills-revision.md.",
-  "bundle_revision": "1.41.2+skills.1",
+  "bundle_revision": "1.43.2+skills.1",
   "homepage": "https://github.com/NextCommerceCo/campaigns-os",
   "retired_skills": [
     {
@@ -16,7 +16,7 @@
     {
       "id": "next-campaigns-os",
       "name": "Campaigns OS Lifecycle",
-      "version": "1.0.23",
+      "version": "1.0.29",
       "path": "skills/next-campaigns-os/SKILL.md",
       "domain": "campaigns",
       "description": "Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth."
@@ -24,7 +24,7 @@
     {
       "id": "next-campaigns-os-setup",
       "name": "Campaigns OS Setup",
-      "version": "2.0.6",
+      "version": "2.0.12",
       "path": "skills/next-campaigns-os-setup/SKILL.md",
       "domain": "campaigns",
       "description": "Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly next-campaigns-setup; renamed to release that name to the published NextCommerceCo/skills scaffolder."
@@ -32,7 +32,7 @@
     {
       "id": "next-campaigns-build",
       "name": "Campaign Build",
-      "version": "1.0.8",
+      "version": "1.0.14",
       "path": "skills/next-campaigns-build/SKILL.md",
       "domain": "campaigns",
       "description": "Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts."
@@ -40,7 +40,7 @@
     {
       "id": "next-campaigns-polish",
       "name": "Campaign Polish",
-      "version": "1.1.7",
+      "version": "1.1.13",
       "path": "skills/next-campaigns-polish/SKILL.md",
       "domain": "campaigns",
       "description": "Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign."
@@ -48,15 +48,15 @@
     {
       "id": "next-campaigns-qa",
       "name": "Campaign QA",
-      "version": "1.3.7",
+      "version": "1.3.13",
       "path": "skills/next-campaigns-qa/SKILL.md",
       "domain": "campaigns",
-      "description": "Run spec-aware QA from a Campaign Map ID and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof."
+      "description": "Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof."
     },
     {
       "id": "campaign-lifecycle-orientation",
       "name": "Campaign Lifecycle Orientation",
-      "version": "1.0.3",
+      "version": "1.0.9",
       "path": "skills/campaign-lifecycle-orientation/SKILL.md",
       "domain": "campaigns",
       "description": "Orient a reader to the Campaigns OS lifecycle artifacts a run has already emitted, without advancing their state: the shared vocabulary, doctor as a gate, the stage record, and the store-theme/Page Kit two-worlds trap."
@@ -64,7 +64,7 @@
     {
       "id": "campaign-run-evidence",
       "name": "Campaign Run Evidence",
-      "version": "1.0.3",
+      "version": "1.0.9",
       "path": "skills/campaign-run-evidence/SKILL.md",
       "domain": "campaigns",
       "description": "Interpret existing doctor, QA verdict and proof-depth evidence without claiming more proof than the artifacts contain, and keep funnel proof apart from merchant launch readiness."
@@ -72,7 +72,7 @@
     {
       "id": "campaign-readback-classification",
       "name": "Campaign Readback Classification",
-      "version": "1.0.3",
+      "version": "1.0.9",
       "path": "skills/campaign-readback-classification/SKILL.md",
       "domain": "campaigns",
       "description": "Classify a selected campaign from the campaigns-os-readback/v2 fields (artifacts, staleness.stale_keys, clean, doctor, divergences, skip_cascades) and write a read-only handoff without turning diagnosis into permission."
@@ -80,7 +80,7 @@
     {
       "id": "contribution-intake",
       "name": "Contribution Intake",
-      "version": "1.0.3",
+      "version": "1.0.9",
       "path": "skills/contribution-intake/SKILL.md",
       "domain": "campaigns",
       "description": "Turn a suggestion about the agent surface into a classified, evidence-checked and redacted proposal, filed on this repository tracker only with attended approval."

package/src/build-brief.mjs

@@ -170,7 +170,7 @@ export function createCampaignBuildBriefArtifact({
   const loaded = inputPath ? loadCampaignBuildBriefFile(inputPath) : null;
   const mode = loaded ? "prepared" : "guided_draft";
   const baseBrief = loaded
-    ? cloneJson(loaded.value)
+    ? cloneJsonOrEmpty(loaded.value)
     : draftCampaignBuildBrief({ spec, activePages, pageMappings, templateFamily, sourceAssetCrawl });
 
   const errors = [];
@@ -306,7 +306,7 @@ export function validateCampaignBuildBriefArtifact(brief, { spec = null } = {})
 }
 
 function normalizeCampaignBuildBrief(value, meta, errors) {
-  const brief = isObject(value) ? cloneJson(value) : {};
+  const brief = isObject(value) ? cloneJsonOrEmpty(value) : {};
   if (!isObject(value)) {
     errors.push({ code: "build_brief.type", field: null, message: "Campaign Build Brief must be a YAML/JSON object." });
   }
@@ -596,7 +596,7 @@ function normalizeQaPolicy(policy = {}) {
   const value = objectOrEmpty(policy);
   return {
     ...value,
-    enforcement: cloneJson(QA_POLICY_ENFORCEMENT),
+    enforcement: cloneJsonOrEmpty(QA_POLICY_ENFORCEMENT),
     require_desktop_mobile_screenshots: value.require_desktop_mobile_screenshots !== false,
     require_checkout_flow: value.require_checkout_flow !== false,
     require_post_purchase_flow: value.require_post_purchase_flow !== false,
@@ -753,7 +753,9 @@ function objectOrEmpty(value) {
   return isObject(value) ? value : {};
 }
 
-function cloneJson(value) {
+// Unlike cli-helpers' cloneJson, a nullish input clones to {}: an empty brief
+// file parses to null and is normalized as an empty object.
+function cloneJsonOrEmpty(value) {
   return JSON.parse(JSON.stringify(value ?? {}));
 }