@open-agent-toolkit/cli 0.3.10 → 0.3.12

package/dist/commands/project/closeout-check/closeout-invariant.js

@@ -0,0 +1,301 @@
+import YAML, { isMap } from 'yaml';
+/**
+ * The closeout invariant shared by `oat project closeout-check` and
+ * `oat project complete-state` (BL-260806-fail-closed-when-configured).
+ *
+ * A closeout that the implement skill must snapshot (configured
+ * `workflow.postImplementSequence`, autonomous, or lite) cannot reach terminal
+ * completion until its durable `oat_post_implement_sequence` snapshot exists,
+ * every stored step is recorded complete, approval is recorded, and the
+ * snapshot reached `status: complete`. The snapshot schema is the one
+ * `oat-project-implement/references/completion-and-closeout.md` Step 15
+ * persists. Once a snapshot exists it is authoritative: current configuration
+ * is never consulted, so a later config change cannot invalidate a persisted
+ * run.
+ */
+export const SEQUENCE_FIELD = 'oat_post_implement_sequence';
+export const RECOVERY_SKILL = 'oat-project-implement';
+const APPROVAL_WRITES = [
+    'approval: approved',
+    'approval: not_required',
+];
+const PRE_APPROVAL_STEPS = ['summary', 'document', 'pr'];
+const POST_APPROVAL_STEPS = ['summary', 'document', 'pr', 'retro'];
+const SEQUENCE_STATUSES = [
+    'pre_approval',
+    'awaiting_approval',
+    'post_approval',
+    'failed',
+    'complete',
+];
+const APPROVALS = ['pending', 'approved', 'not_required'];
+const SOURCES = ['configured', 'autonomous-default'];
+const APPROVAL_SOURCES = ['user', 'oat-autonomous'];
+export const STEP_SKILLS = {
+    summary: 'oat-project-summary',
+    document: 'oat-project-document',
+    pr: 'oat-project-pr-final',
+    retro: 'oat-project-retro',
+};
+class MalformedSnapshotError extends Error {
+}
+function malformed(detail) {
+    throw new MalformedSnapshotError(detail);
+}
+function readFrontmatter(content) {
+    const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!match) {
+        throw new Error('state.md is missing frontmatter');
+    }
+    const document = YAML.parseDocument(match[1], { uniqueKeys: true });
+    if (document.errors.length > 0) {
+        throw new Error(`state.md frontmatter is malformed (${document.errors[0]?.message ?? 'YAML parse error'})`);
+    }
+    if (!isMap(document.contents)) {
+        throw new Error('state.md frontmatter root is not a YAML map');
+    }
+    const value = document.toJS();
+    return value;
+}
+function readEnum(record, key, allowed, options = {}) {
+    if (!(key in record)) {
+        if (options.optional)
+            return null;
+        malformed(`\`${key}\` is missing`);
+    }
+    const value = record[key];
+    if (value === null && options.nullable)
+        return null;
+    if (typeof value !== 'string' || !allowed.includes(value)) {
+        malformed(`\`${key}\` must be one of ${allowed.join(', ')}${options.nullable ? ', or null' : ''}`);
+    }
+    return value;
+}
+function readSteps(record, key, allowed) {
+    const value = record[key];
+    if (!Array.isArray(value)) {
+        malformed(`\`${key}\` must be an array`);
+    }
+    const steps = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string' || !allowed.includes(entry)) {
+            malformed(`\`${key}\` contains \`${String(entry)}\`; allowed steps are ${allowed.join(', ')}`);
+        }
+        if (steps.includes(entry)) {
+            malformed(`\`${key}\` lists \`${entry}\` more than once`);
+        }
+        steps.push(entry);
+    }
+    return steps;
+}
+/**
+ * Completed steps must be exactly the first N stored steps: the implement
+ * skill dispatches in stored order, so a gap or a foreign step is a
+ * contradiction, not progress.
+ */
+function assertCompletedPrefix(stored, completed, storedKey, completedKey) {
+    for (const step of completed) {
+        if (!stored.includes(step)) {
+            malformed(`\`${completedKey}\` lists \`${step}\`, which \`${storedKey}\` does not`);
+        }
+    }
+    const prefix = stored.slice(0, completed.length);
+    if (!prefix.every((step) => completed.includes(step))) {
+        malformed(`\`${completedKey}\` is not a prefix of the stored \`${storedKey}\` order`);
+    }
+}
+export function parseCloseoutSnapshot(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        malformed('the snapshot must be a map');
+    }
+    const record = value;
+    const status = readEnum(record, 'status', SEQUENCE_STATUSES);
+    // `source` and `approval_source` are additive provenance; an older snapshot
+    // without them stays valid.
+    const source = readEnum(record, 'source', SOURCES, {
+        optional: true,
+        nullable: true,
+    });
+    readEnum(record, 'approval_source', APPROVAL_SOURCES, {
+        optional: true,
+        nullable: true,
+    });
+    if ('final_phase' in record &&
+        record.final_phase !== null &&
+        typeof record.final_phase !== 'string') {
+        malformed('`final_phase` must be a phase ID string');
+    }
+    const preApproval = readSteps(record, 'pre_approval', PRE_APPROVAL_STEPS);
+    const postApproval = readSteps(record, 'post_approval', POST_APPROVAL_STEPS);
+    for (const step of postApproval) {
+        if (preApproval.includes(step)) {
+            malformed(`\`${step}\` appears in both pre_approval and post_approval`);
+        }
+    }
+    const preApprovalCompleted = readSteps(record, 'pre_approval_completed', PRE_APPROVAL_STEPS);
+    const postApprovalCompleted = readSteps(record, 'post_approval_completed', POST_APPROVAL_STEPS);
+    assertCompletedPrefix(preApproval, preApprovalCompleted, 'pre_approval', 'pre_approval_completed');
+    assertCompletedPrefix(postApproval, postApprovalCompleted, 'post_approval', 'post_approval_completed');
+    const approval = readEnum(record, 'approval', APPROVALS);
+    if (postApprovalCompleted.length > 0 && approval === 'pending') {
+        malformed('`post_approval_completed` records work while `approval` is still pending');
+    }
+    const snapshot = {
+        status,
+        source,
+        preApproval,
+        preApprovalCompleted,
+        approval,
+        postApproval,
+        postApprovalCompleted,
+        failure: record.failure ?? null,
+    };
+    if (status === 'complete') {
+        const pending = firstPending(preApproval, preApprovalCompleted) ??
+            firstPending(postApproval, postApprovalCompleted);
+        if (pending || approval === 'pending') {
+            malformed('`status: complete` contradicts pending steps or a pending approval');
+        }
+    }
+    return snapshot;
+}
+function firstPending(stored, completed) {
+    return stored.find((step) => !completed.includes(step));
+}
+function stepOwner(phase, step) {
+    return { kind: 'step', phase, step, skill: STEP_SKILLS[step] };
+}
+function approvalOwner() {
+    return { kind: 'approval', skill: RECOVERY_SKILL, writes: APPROVAL_WRITES };
+}
+function evaluateSnapshot(snapshot, inputs) {
+    const prePending = firstPending(snapshot.preApproval, snapshot.preApprovalCompleted);
+    const postPending = firstPending(snapshot.postApproval, snapshot.postApprovalCompleted);
+    const incomplete = (invariant, detail, nextOwner) => ({
+        status: 'incomplete',
+        invariant,
+        detail,
+        route: RECOVERY_SKILL,
+        nextOwner,
+        inputs,
+    });
+    if (snapshot.status === 'failed') {
+        // Approval-aware order: pending pre-approval work, then the pending
+        // approval boundary, then post-approval work, then status repair. A
+        // post-approval step is never named while approval is pending.
+        const approvalPending = snapshot.approval === 'pending';
+        const owner = prePending
+            ? stepOwner('pre_approval', prePending)
+            : approvalPending
+                ? approvalOwner()
+                : postPending
+                    ? stepOwner('post_approval', postPending)
+                    : { kind: 'sequence-status', skill: RECOVERY_SKILL };
+        const at = owner.kind === 'step'
+            ? ` at \`${owner.step}\``
+            : owner.kind === 'approval'
+                ? ' at the approval boundary'
+                : '';
+        return incomplete('sequence_failed', `the post-implementation sequence recorded a failure${at}`, owner);
+    }
+    if (prePending) {
+        return incomplete('pre_approval_step_pending', `pre-approval step \`${prePending}\` is not recorded complete (stored order: ${snapshot.preApproval.join(', ')})`, stepOwner('pre_approval', prePending));
+    }
+    if (snapshot.approval === 'pending') {
+        return incomplete('approval_pending', 'final approval is not recorded', approvalOwner());
+    }
+    if (postPending) {
+        return incomplete('post_approval_step_pending', `post-approval step \`${postPending}\` is not recorded complete (stored order: ${snapshot.postApproval.join(', ')})`, stepOwner('post_approval', postPending));
+    }
+    if (snapshot.status !== 'complete') {
+        return incomplete('sequence_not_complete', `every step and approval is recorded but the snapshot status is \`${snapshot.status}\`, not \`complete\``, { kind: 'sequence-status', skill: RECOVERY_SKILL });
+    }
+    return { status: 'complete', inputs };
+}
+export async function evaluateCloseout(options) {
+    const frontmatter = readFrontmatter(options.stateContent);
+    const workflowMode = typeof frontmatter.oat_workflow_mode === 'string'
+        ? frontmatter.oat_workflow_mode
+        : 'spec-driven';
+    const autonomousSource = options.autonomousFlag
+        ? 'flag'
+        : options.env.OAT_AUTONOMOUS === '1'
+            ? 'env'
+            : null;
+    const rawSnapshot = frontmatter[SEQUENCE_FIELD];
+    // An explicit null carries no snapshot, exactly like an absent key.
+    const snapshotPresent = SEQUENCE_FIELD in frontmatter && rawSnapshot !== null;
+    const inputs = {
+        workflowMode,
+        lite: workflowMode === 'lite',
+        autonomous: autonomousSource !== null,
+        autonomousSource,
+        configured: null,
+        snapshot: snapshotPresent ? 'present' : 'absent',
+        snapshotSource: null,
+    };
+    if (snapshotPresent) {
+        let snapshot;
+        try {
+            snapshot = parseCloseoutSnapshot(rawSnapshot);
+        }
+        catch (error) {
+            if (!(error instanceof MalformedSnapshotError))
+                throw error;
+            return {
+                status: 'incomplete',
+                invariant: 'snapshot_malformed',
+                detail: `\`${SEQUENCE_FIELD}\` is malformed: ${error.message}`,
+                route: RECOVERY_SKILL,
+                nextOwner: { kind: 'snapshot', skill: RECOVERY_SKILL },
+                inputs,
+            };
+        }
+        inputs.snapshotSource = snapshot.source;
+        return evaluateSnapshot(snapshot, inputs);
+    }
+    let reason = null;
+    if (inputs.lite) {
+        reason = 'lite';
+    }
+    else if (inputs.autonomous) {
+        reason = 'autonomous';
+    }
+    else {
+        inputs.configured = await options.resolveConfigured();
+        if (inputs.configured)
+            reason = 'configured';
+    }
+    if (!reason) {
+        return { status: 'not_required', inputs };
+    }
+    const why = {
+        lite: '`oat_workflow_mode: lite` always snapshots its closeout',
+        autonomous: 'an autonomous closeout (`--autonomous` or `OAT_AUTONOMOUS=1`) always snapshots its closeout',
+        configured: 'the effective `workflow.postImplementSequence` is configured',
+    }[reason];
+    return {
+        status: 'incomplete',
+        invariant: 'snapshot_missing',
+        detail: `\`${SEQUENCE_FIELD}\` is absent, but ${why}`,
+        route: RECOVERY_SKILL,
+        nextOwner: { kind: 'snapshot', skill: RECOVERY_SKILL },
+        inputs,
+    };
+}
+/**
+ * The one refusal message both commands print, so a skill or operator sees the
+ * same invariant and recovery route from either.
+ */
+export function formatCloseoutRefusal(projectPath, result) {
+    const owner = result.nextOwner;
+    const next = owner.kind === 'step'
+        ? ` Next stored step: \`${owner.step}\` (${owner.skill}).`
+        : owner.kind === 'approval'
+            ? ' Next: record the final approval decision: `approval: approved` after final HiLL sign-off, or `approval: not_required` when no final checkpoint exists.'
+            : '';
+    return [
+        `Closeout invariant not satisfied for ${projectPath} (${result.invariant}): ${result.detail}.${next}`,
+        `Resume with ${RECOVERY_SKILL}; it persists the ${SEQUENCE_FIELD} snapshot (completion-and-closeout.md Step 15) and completes every stored step before completion.`,
+    ].join(' ');
+}

package/dist/commands/project/closeout-check/index.d.ts

@@ -0,0 +1,38 @@
+import { readFile as defaultReadFile } from 'node:fs/promises';
+import { buildCommandContext, type CommandContext } from '../../../app/command-context.js';
+import { resolveEffectiveConfig } from '../../../config/resolve.js';
+import { dirExists, fileExists } from '../../../fs/io.js';
+import { Command } from 'commander';
+import { type CloseoutResult } from './closeout-invariant.js';
+export { evaluateCloseout, formatCloseoutRefusal, type CloseoutResult, } from './closeout-invariant.js';
+export interface CloseoutCheckDependencies {
+    buildCommandContext: (options: Parameters<typeof buildCommandContext>[0]) => CommandContext;
+    resolveProjectRoot: (cwd: string) => Promise<string>;
+    resolveEffectiveConfig: typeof resolveEffectiveConfig;
+    readFile: typeof defaultReadFile;
+    dirExists: typeof dirExists;
+    fileExists: typeof fileExists;
+    /**
+     * Environment read for `OAT_AUTONOMOUS`. Injectable so a caller that forgets
+     * `--autonomous` under `OAT_AUTONOMOUS=1` still cannot fail open.
+     */
+    env: NodeJS.ProcessEnv;
+}
+export declare const DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES: CloseoutCheckDependencies;
+export interface ProjectCloseoutCheck {
+    repoRoot: string;
+    targetProjectPath: string;
+    statePath: string;
+    stateContent: string;
+    result: CloseoutResult;
+}
+/**
+ * Resolve a project, read its `state.md` from disk, and evaluate the closeout
+ * invariant. Shared by `closeout-check` and `complete-state` so both read the
+ * same inputs and print the same refusal.
+ */
+export declare function checkProjectCloseout(projectPath: string, options: {
+    autonomous: boolean;
+}, context: CommandContext, dependencies: Pick<CloseoutCheckDependencies, 'resolveProjectRoot' | 'resolveEffectiveConfig' | 'readFile' | 'dirExists' | 'fileExists' | 'env'>): Promise<ProjectCloseoutCheck>;
+export declare function createProjectCloseoutCheckCommand(overrides?: Partial<CloseoutCheckDependencies>): Command;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/project/closeout-check/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/closeout-check/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAG/D,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,yBAAyB;IACxC,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IACtD,QAAQ,EAAE,OAAO,eAAe,CAAC;IACjC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,eAAO,MAAM,mCAAmC,EAAE,yBAQjD,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IAAE,UAAU,EAAE,OAAO,CAAA;CAAE,EAChC,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,IAAI,CAChB,yBAAyB,EACvB,oBAAoB,GACpB,wBAAwB,GACxB,UAAU,GACV,WAAW,GACX,YAAY,GACZ,KAAK,CACR,GACA,OAAO,CAAC,oBAAoB,CAAC,CA+B/B;AAmED,wBAAgB,iCAAiC,CAC/C,SAAS,GAAE,OAAO,CAAC,yBAAyB,CAAM,GACjD,OAAO,CA2BT"}

package/dist/commands/project/closeout-check/index.js

@@ -0,0 +1,117 @@
+import { readFile as defaultReadFile } from 'node:fs/promises';
+import { isAbsolute, join } from 'node:path';
+import { buildCommandContext } from '../../../app/command-context.js';
+import { readGlobalOptions } from '../../shared/shared.utils.js';
+import { resolveEffectiveConfig } from '../../../config/resolve.js';
+import { CliError } from '../../../errors/cli-error.js';
+import { dirExists, fileExists } from '../../../fs/io.js';
+import { resolveProjectRoot } from '../../../fs/paths.js';
+import { Command } from 'commander';
+import { evaluateCloseout, formatCloseoutRefusal, } from './closeout-invariant.js';
+export { evaluateCloseout, formatCloseoutRefusal, } from './closeout-invariant.js';
+export const DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES = {
+    buildCommandContext,
+    resolveProjectRoot,
+    resolveEffectiveConfig,
+    readFile: defaultReadFile,
+    dirExists,
+    fileExists,
+    env: process.env,
+};
+/**
+ * Resolve a project, read its `state.md` from disk, and evaluate the closeout
+ * invariant. Shared by `closeout-check` and `complete-state` so both read the
+ * same inputs and print the same refusal.
+ */
+export async function checkProjectCloseout(projectPath, options, context, dependencies) {
+    const repoRoot = await dependencies.resolveProjectRoot(context.cwd);
+    const targetProjectPath = isAbsolute(projectPath)
+        ? projectPath
+        : join(repoRoot, projectPath);
+    if (!(await dependencies.dirExists(targetProjectPath))) {
+        throw new CliError(`Project not found: ${projectPath}`, 1);
+    }
+    const statePath = join(targetProjectPath, 'state.md');
+    if (!(await dependencies.fileExists(statePath))) {
+        throw new CliError(`Project state.md not found: ${statePath}`, 1);
+    }
+    const stateContent = await dependencies.readFile(statePath, 'utf8');
+    const result = await evaluateCloseout({
+        stateContent,
+        autonomousFlag: options.autonomous,
+        env: dependencies.env,
+        resolveConfigured: async () => {
+            const effective = await dependencies.resolveEffectiveConfig(repoRoot, join(context.home, '.oat'), dependencies.env);
+            const value = effective.resolved['workflow.postImplementSequence']?.value;
+            return value !== null && value !== undefined;
+        },
+    });
+    return { repoRoot, targetProjectPath, statePath, stateContent, result };
+}
+async function runCloseoutCheck(projectPath, options, context, dependencies) {
+    try {
+        const { result } = await checkProjectCloseout(projectPath, { autonomous: options.autonomous ?? false }, context, dependencies);
+        if (result.status === 'incomplete') {
+            const message = formatCloseoutRefusal(projectPath, result);
+            if (context.json) {
+                context.logger.json({
+                    status: 'incomplete',
+                    projectPath,
+                    invariant: result.invariant,
+                    detail: result.detail,
+                    route: result.route,
+                    nextOwner: result.nextOwner,
+                    inputs: result.inputs,
+                    message,
+                });
+            }
+            else {
+                context.logger.info(message);
+            }
+            // Fail closed: a caller that ignores the JSON still stops.
+            process.exitCode = 1;
+            return;
+        }
+        if (context.json) {
+            context.logger.json({
+                status: result.status,
+                projectPath,
+                invariant: null,
+                route: null,
+                nextOwner: null,
+                inputs: result.inputs,
+            });
+        }
+        else if (result.status === 'complete') {
+            context.logger.info(`Closeout invariant satisfied for ${projectPath}: every stored step and the approval are recorded complete.`);
+        }
+        else {
+            context.logger.info(`Closeout invariant not required for ${projectPath}: no snapshot, and the closeout is not configured, autonomous, or lite.`);
+        }
+        process.exitCode = 0;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (context.json) {
+            context.logger.json({ status: 'error', message });
+        }
+        else {
+            context.logger.error(message);
+        }
+        process.exitCode = error instanceof CliError ? error.exitCode : 1;
+    }
+}
+export function createProjectCloseoutCheckCommand(overrides = {}) {
+    const dependencies = {
+        ...DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES,
+        ...overrides,
+    };
+    return new Command('closeout-check')
+        .description('Report whether a project closeout snapshot permits terminal completion (read-only)')
+        .argument('<project-path>', 'Project path to check')
+        .option('--autonomous', 'Treat the closeout as autonomous (also implied by OAT_AUTONOMOUS=1)')
+        .action(async (projectPath, options, command) => {
+        const context = dependencies.buildCommandContext(readGlobalOptions(command));
+        await runCloseoutCheck(projectPath, options, context, dependencies);
+    });
+}

package/dist/commands/project/complete-state/index.d.ts

@@ -1,5 +1,6 @@
 import { readFile as defaultReadFile, writeFile as defaultWriteFile } from 'node:fs/promises';
 import { buildCommandContext, type CommandContext } from '../../../app/command-context.js';
+import { resolveEffectiveConfig } from '../../../config/resolve.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { Command } from 'commander';
 interface ProjectCompleteStateDependencies {
@@ -9,6 +10,9 @@ interface ProjectCompleteStateDependencies {
     writeFile: typeof defaultWriteFile;
     dirExists: typeof dirExists;
     fileExists: typeof fileExists;
+    resolveEffectiveConfig: typeof resolveEffectiveConfig;
+    /** Environment read for `OAT_AUTONOMOUS`; injectable for tests. */
+    env: NodeJS.ProcessEnv;
     now: () => Date;
 }
 export declare function createProjectCompleteStateCommand(overrides?: Partial<ProjectCompleteStateDependencies>): Command;

package/dist/commands/project/complete-state/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/complete-state/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,IAAI,eAAe,EAC3B,SAAS,IAAI,gBAAgB,EAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGhF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAG/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,UAAU,gCAAgC;IACxC,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,EAAE,OAAO,eAAe,CAAC;IACjC,SAAS,EAAE,OAAO,gBAAgB,CAAC;IACnC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AA4ED,wBAAgB,iCAAiC,CAC/C,SAAS,GAAE,OAAO,CAAC,gCAAgC,CAAM,GACxD,OAAO,CA2BT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/complete-state/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,IAAI,eAAe,EAC3B,SAAS,IAAI,gBAAgB,EAC9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAG/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,UAAU,gCAAgC;IACxC,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,EAAE,OAAO,eAAe,CAAC;IACjC,SAAS,EAAE,OAAO,gBAAgB,CAAC;IACnC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IACtD,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AA4ED,wBAAgB,iCAAiC,CAC/C,SAAS,GAAE,OAAO,CAAC,gCAAgC,CAAM,GACxD,OAAO,CA+BT"}

package/dist/commands/project/complete-state/index.js

@@ -1,7 +1,8 @@
 import { readFile as defaultReadFile, writeFile as defaultWriteFile, } from 'node:fs/promises';
-import { isAbsolute, join } from 'node:path';
 import { buildCommandContext } from '../../../app/command-context.js';
+import { checkProjectCloseout, formatCloseoutRefusal, } from '../../project/closeout-check/index.js';
 import { readGlobalOptions } from '../../shared/shared.utils.js';
+import { resolveEffectiveConfig } from '../../../config/resolve.js';
 import { CliError } from '../../../errors/cli-error.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { resolveProjectRoot } from '../../../fs/paths.js';
@@ -15,24 +16,20 @@ const DEFAULT_DEPENDENCIES = {
     writeFile: defaultWriteFile,
     dirExists,
     fileExists,
+    resolveEffectiveConfig,
+    env: process.env,
     now: () => new Date(),
 };
-function resolveTargetProjectPath(repoRoot, projectPath) {
-    return isAbsolute(projectPath) ? projectPath : join(repoRoot, projectPath);
-}
 async function runProjectCompleteState(projectPath, options, context, dependencies) {
     try {
-        const repoRoot = await dependencies.resolveProjectRoot(context.cwd);
-        const targetProjectPath = resolveTargetProjectPath(repoRoot, projectPath);
-        if (!(await dependencies.dirExists(targetProjectPath))) {
-            throw new CliError(`Project not found: ${projectPath}`, 1);
-        }
-        const statePath = join(targetProjectPath, 'state.md');
-        if (!(await dependencies.fileExists(statePath))) {
-            throw new CliError(`Project state.md not found: ${statePath}`, 1);
+        // Refuse the same closeout invariant `oat project closeout-check` reports,
+        // before any write: a configured, autonomous, or lite closeout cannot
+        // reach terminal completion without its complete durable snapshot.
+        const { targetProjectPath, statePath, stateContent: content, result, } = await checkProjectCloseout(projectPath, { autonomous: options.autonomous ?? false }, context, dependencies);
+        if (result.status === 'incomplete') {
+            throw new CliError(formatCloseoutRefusal(projectPath, result), 1);
         }
         const now = dependencies.now();
-        const content = await dependencies.readFile(statePath, 'utf8');
         const updatedContent = renderCompletedProjectState(content, {
             archived: options.archived ?? false,
             nowUtc: now.toISOString(),
@@ -78,6 +75,7 @@ export function createProjectCompleteStateCommand(overrides = {}) {
         .description('Update a project state.md to the completed lifecycle shape')
         .argument('<project-path>', 'Project path to update')
         .option('--archived', 'Mark the completed project as archived locally')
+        .option('--autonomous', 'Treat the closeout as autonomous (also implied by OAT_AUTONOMOUS=1)')
         .action(async (projectPath, options, command) => {
         const context = dependencies.buildCommandContext(readGlobalOptions(command));
         await runProjectCompleteState(projectPath, options, context, dependencies);

package/dist/commands/project/dispatch/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/dispatch/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,MAAM,WAAW,kCAAkC;IACjD,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AA0ID,wBAAgB,4BAA4B,CAC1C,SAAS,GAAE,OAAO,CAAC,kCAAkC,CAAM,GAC1D,OAAO,CA4BT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/dispatch/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,MAAM,WAAW,kCAAkC;IACjD,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAiHD,wBAAgB,4BAA4B,CAC1C,SAAS,GAAE,OAAO,CAAC,kCAAkC,CAAM,GAC1D,OAAO,CA0BT"}

package/dist/commands/project/dispatch/index.js

@@ -1,9 +1,7 @@
 import { readFile } from 'node:fs/promises';
-import { isAbsolute, join } from 'node:path';
 import { buildCommandContext, } from '../../../app/command-context.js';
 import { readGlobalOptions } from '../../shared/shared.utils.js';
-import { fileExists } from '../../../fs/io.js';
-import { resolveProjectRoot, validateRealPathWithinScope } from '../../../fs/paths.js';
+import { resolveProjectRoot } from '../../../fs/paths.js';
 import { Command } from 'commander';
 import { createCanonicalRoleCommand } from './canonical-role.js';
 import { recordProjectDispatch, redactDispatchMessage, } from './record.js';
@@ -19,16 +17,6 @@ const DEFAULT_DEPENDENCIES = {
         return Buffer.concat(chunks).toString('utf8');
     },
 };
-async function resolveProjectPath(repoRoot, project) {
-    if (!project)
-        return null;
-    const candidate = isAbsolute(project) ? project : join(repoRoot, project);
-    const validated = await validateRealPathWithinScope(candidate, repoRoot);
-    if (!(await fileExists(join(validated.realPath, 'state.md')))) {
-        throw new Error('Project path must contain a readable state.md.');
-    }
-    return validated.realPath;
-}
 function axes(values) {
     return values
         .map(([name, value]) => `${name}=${value ?? 'not-reported'}`)
@@ -65,19 +53,14 @@ function runtimeIdentityLines(identity) {
 }
 async function runRecordCommand(options, context, dependencies) {
     let repoRoot = null;
-    let projectPath = null;
     try {
         repoRoot = await dependencies.resolveProjectRoot(context.cwd);
-        projectPath = await resolveProjectPath(repoRoot, options.project);
         const content = options.eventFile === '-'
             ? await dependencies.readStdin()
             : await dependencies.readFile(options.eventFile);
         // Hand the raw event to the recorder; it owns the single authoritative
         // parse, and parsing twice would relabel the provenance of its own output.
-        const raw = await recordProjectDispatch({
-            projectPath,
-            input: JSON.parse(content),
-        });
+        const raw = await recordProjectDispatch({ input: JSON.parse(content) });
         // The degradation reason is caller-influenced text on the success path, so
         // it goes through the same single redaction boundary as every failure
         // message. Producing a message that skips this boundary is exactly the
@@ -89,7 +72,6 @@ async function runRecordCommand(options, context, dependencies) {
                 reason: raw.runtimeIdentity.reason === null
                     ? null
                     : redactDispatchMessage(raw.runtimeIdentity.reason, {
-                        project: projectPath,
                         repo: repoRoot,
                         home: context.home,
                     }),
@@ -99,12 +81,7 @@ async function runRecordCommand(options, context, dependencies) {
             context.logger.json(result);
         }
         else {
-            if (result.status === 'persisted') {
-                context.logger.success(`Recorded project dispatch: ${result.path}`);
-            }
-            else {
-                context.logger.info('Dispatch evidence is valid; no project path was supplied, so nothing was persisted.');
-            }
+            context.logger.info('Dispatch evidence is valid; nothing was written.');
             for (const line of runtimeIdentityLines(result.runtimeIdentity)) {
                 context.logger.info(line);
             }
@@ -113,7 +90,7 @@ async function runRecordCommand(options, context, dependencies) {
     }
     catch (error) {
         // Single redaction boundary for every failure this command can surface.
-        const message = redactDispatchMessage(error instanceof Error ? error.message : String(error), { project: projectPath, repo: repoRoot, home: context.home });
+        const message = redactDispatchMessage(error instanceof Error ? error.message : String(error), { repo: repoRoot, home: context.home });
         if (context.json) {
             context.logger.json({ status: 'error', message });
         }
@@ -126,10 +103,9 @@ async function runRecordCommand(options, context, dependencies) {
 export function createProjectDispatchCommand(overrides = {}) {
     const dependencies = { ...DEFAULT_DEPENDENCIES, ...overrides };
     return new Command('dispatch')
-        .description('Validate and persist project dispatch provenance')
+        .description('Validate project dispatch provenance')
         .addCommand(new Command('record')
-        .description('Record one generic dispatch plus namespaced OAT evidence')
-        .option('--project <project-path>', 'Project path; omit to validate without persistence')
+        .description('Validate one generic dispatch plus namespaced OAT evidence (writes nothing)')
         .requiredOption('--event-file <json-file-or-dash>', 'Complete record and event JSON file, or - for standard input')
         .action(async (options, command) => {
         const context = dependencies.buildCommandContext(readGlobalOptions(command));