@open-agent-toolkit/cli 0.3.19 → 0.3.21

package/dist/commands/project/closeout-check/index.js

@@ -1,14 +1,27 @@
-import { readFile as defaultReadFile } from 'node:fs/promises';
-import { isAbsolute, join } from 'node:path';
+import { readFile as defaultReadFile, readdir } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join } from 'node:path';
 import { buildCommandContext } from '../../../app/command-context.js';
+import { loadGoalDeliveryProject } from '../../project/delivery/check.js';
+import { deliveryEvidenceScope, evaluateDeliveryReview, evaluateGateCarrier, } from '../../project/delivery/evidence.js';
+import { observeMember } from '../../project/delivery/refresh.js';
+import { defaultGhRunner, } from '../../project/links/refresh.js';
+import { defaultGitRunner } from '../../project/sync/git.js';
 import { readGlobalOptions } from '../../shared/shared.utils.js';
 import { resolveEffectiveConfig } from '../../../config/resolve.js';
 import { CliError } from '../../../errors/cli-error.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { resolveProjectRoot } from '../../../fs/paths.js';
+import { getProjectState, parsePhaseMarkers, } from '@open-agent-toolkit/control-plane';
 import { Command } from 'commander';
-import { evaluateCloseout, formatCloseoutRefusal, } from './closeout-invariant.js';
-export { evaluateCloseout, formatCloseoutRefusal, } from './closeout-invariant.js';
+import YAML from 'yaml';
+import { evaluateCloseout, formatCloseoutRefusal, readStateWorkflowMode, resolveDeliveryGraph, } from './closeout-invariant.js';
+export { evaluateCloseout, evaluateGoalBoundary, evaluateGoalCoverage, formatCloseoutRefusal, resolveDeliveryGraph, } from './closeout-invariant.js';
+async function listDirectories(path) {
+    const entries = await readdir(path, { withFileTypes: true });
+    return entries
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name);
+}
 export const DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES = {
     buildCommandContext,
     resolveProjectRoot,
@@ -17,7 +30,176 @@ export const DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES = {
     dirExists,
     fileExists,
     env: process.env,
+    gh: defaultGhRunner,
+    git: defaultGitRunner,
+    getProjectState,
+    listDirectories,
 };
+async function readOptional(dependencies, path) {
+    try {
+        return await dependencies.readFile(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function frontmatterRecord(content) {
+    const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!match)
+        return null;
+    try {
+        const parsed = YAML.parse(match[1] ?? '');
+        return parsed !== null &&
+            typeof parsed === 'object' &&
+            !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Find an extracted phase's child project by slug under any scope of the
+ * projects root, and read its lifecycle and `oat_extracted_from` backlink.
+ */
+async function observeChild(projectsRoot, slug, dependencies) {
+    const unresolved = (status) => ({
+        slug,
+        status,
+        lifecycle: null,
+        extractedFrom: null,
+    });
+    let scopes;
+    try {
+        scopes = await dependencies.listDirectories(projectsRoot);
+    }
+    catch {
+        return unresolved('unreadable');
+    }
+    const candidates = [];
+    for (const scope of scopes) {
+        const statePath = join(projectsRoot, scope, slug, 'state.md');
+        if (await dependencies.fileExists(statePath)) {
+            candidates.push(statePath);
+        }
+    }
+    if (candidates.length === 0)
+        return unresolved('missing');
+    if (candidates.length > 1)
+        return unresolved('ambiguous');
+    const content = await readOptional(dependencies, candidates[0]);
+    const frontmatter = content === null ? null : frontmatterRecord(content);
+    if (frontmatter === null)
+        return unresolved('unreadable');
+    const read = (key) => typeof frontmatter[key] === 'string' ? frontmatter[key] : null;
+    return {
+        slug,
+        status: 'found',
+        lifecycle: read('oat_lifecycle'),
+        extractedFrom: read('oat_extracted_from'),
+    };
+}
+/**
+ * Load the goal boundary inputs read-only (A3): the brief, the journal, the
+ * registry with fresh member observations merged in (never persisted; that is
+ * `delivery refresh`'s job), each extracted child's facts, and the shared
+ * evaluator's verdict for every terminal delivery's effective scope.
+ */
+export async function loadGoalCloseoutInputs(repoRoot, targetProjectPath, dependencies) {
+    const planContent = await readOptional(dependencies, join(targetProjectPath, 'plan.md'));
+    const implementationContent = await readOptional(dependencies, join(targetProjectPath, 'implementation.md'));
+    const inputs = {
+        goalSlug: basename(targetProjectPath),
+        planContent,
+        implementationContent,
+        deliveries: null,
+        observationFailures: [],
+        children: [],
+        evidence: {},
+    };
+    if (implementationContent !== null) {
+        const projectsRoot = dirname(dirname(targetProjectPath));
+        const slugs = new Set();
+        for (const markers of parsePhaseMarkers(implementationContent).values()) {
+            if (markers.status === 'extracted' && markers.extractedTo !== null) {
+                slugs.add(markers.extractedTo);
+            }
+        }
+        for (const slug of slugs) {
+            inputs.children.push(await observeChild(projectsRoot, slug, dependencies));
+        }
+    }
+    let project;
+    try {
+        project = await loadGoalDeliveryProject(targetProjectPath, repoRoot, {
+            resolveProjectRoot: async () => repoRoot,
+            readFile: (path, encoding) => dependencies.readFile(path, encoding),
+            getProjectState: dependencies.getProjectState,
+        });
+    }
+    catch {
+        return inputs;
+    }
+    const registered = project.state.deliveries ?? [];
+    // Observe every member of every non-superseded delivery read-only.
+    const observed = [];
+    for (const delivery of registered) {
+        if (delivery.status === 'superseded' || delivery.status === 'registering') {
+            observed.push(delivery);
+            continue;
+        }
+        const members = [];
+        for (const member of delivery.members) {
+            const observation = member.url === null
+                ? 'a member has no URL to observe'
+                : await observeMember(dependencies.gh, member.url);
+            if (typeof observation === 'string') {
+                inputs.observationFailures.push(`${delivery.delivery_id} ${member.url ?? '(no url)'}: ${observation}`);
+                members.push(member);
+            }
+            else {
+                members.push({
+                    ...member,
+                    observed_head: observation.head,
+                    observed_base: observation.base,
+                    status: observation.status,
+                });
+            }
+        }
+        observed.push({ ...delivery, members });
+    }
+    inputs.deliveries = observed;
+    if (inputs.observationFailures.length > 0) {
+        return inputs;
+    }
+    // Evaluate evidence for every terminal delivery over its effective scope.
+    const graph = resolveDeliveryGraph(observed, project.state.progress.phases.map((phase) => phase.phaseId));
+    for (const terminal of graph.terminals) {
+        const { delivery, effectiveScope } = terminal;
+        if (delivery.status === 'registering')
+            continue;
+        const evidenceScope = deliveryEvidenceScope(project, observed, delivery);
+        const fact = {
+            scope: effectiveScope,
+            review: await evaluateDeliveryReview(dependencies.git, evidenceScope, delivery, effectiveScope),
+            // The accepted exit-gate binding persisted with the delivery's evidence,
+            // never the milestone's current working carrier.
+            exit: await evaluateGateCarrier(delivery.exit_gate, {
+                kind: 'code',
+                scope: effectiveScope,
+                match: 'covers',
+                overrideDisabled: project.exitGateDisabled,
+            }, {
+                git: dependencies.git,
+                scope: evidenceScope,
+                publishedHeads: delivery.members.map((member) => member.observed_head),
+            }),
+        };
+        inputs.evidence[delivery.delivery_id] = fact;
+    }
+    return inputs;
+}
 /**
  * Resolve a project, read its `state.md` from disk, and evaluate the closeout
  * invariant. Shared by `closeout-check` and `complete-state` so both read the
@@ -36,8 +218,12 @@ export async function checkProjectCloseout(projectPath, options, context, depend
         throw new CliError(`Project state.md not found: ${statePath}`, 1);
     }
     const stateContent = await dependencies.readFile(statePath, 'utf8');
+    const goal = readStateWorkflowMode(stateContent) === 'goal'
+        ? await loadGoalCloseoutInputs(repoRoot, targetProjectPath, dependencies)
+        : undefined;
     const result = await evaluateCloseout({
         stateContent,
+        ...(goal === undefined ? {} : { goal }),
         autonomousFlag: options.autonomous,
         env: dependencies.env,
         resolveConfigured: async () => {

package/dist/commands/project/complete-state/index.d.ts

@@ -1,9 +1,10 @@
 import { readFile as defaultReadFile, writeFile as defaultWriteFile } from 'node:fs/promises';
 import { buildCommandContext, type CommandContext } from '../../../app/command-context.js';
+import { type CloseoutInputDependencies } from '../../project/closeout-check/index.js';
 import { resolveEffectiveConfig } from '../../../config/resolve.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { Command } from 'commander';
-interface ProjectCompleteStateDependencies {
+interface ProjectCompleteStateDependencies extends CloseoutInputDependencies {
     buildCommandContext: (options: Parameters<typeof buildCommandContext>[0]) => CommandContext;
     resolveProjectRoot: (cwd: string) => Promise<string>;
     readFile: typeof defaultReadFile;

package/dist/commands/project/complete-state/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/complete-state/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,IAAI,eAAe,EAC3B,SAAS,IAAI,gBAAgB,EAC9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAMhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAG/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,UAAU,gCAAgC;IACxC,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,EAAE,OAAO,eAAe,CAAC;IACjC,SAAS,EAAE,OAAO,gBAAgB,CAAC;IACnC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IACtD,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AA4ED,wBAAgB,iCAAiC,CAC/C,SAAS,GAAE,OAAO,CAAC,gCAAgC,CAAM,GACxD,OAAO,CA+BT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/complete-state/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,IAAI,eAAe,EAC3B,SAAS,IAAI,gBAAgB,EAC9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAG/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,UAAU,gCAAiC,SAAQ,yBAAyB;IAC1E,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,EAAE,OAAO,eAAe,CAAC;IACjC,SAAS,EAAE,OAAO,gBAAgB,CAAC;IACnC,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IACtD,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAkFD,wBAAgB,iCAAiC,CAC/C,SAAS,GAAE,OAAO,CAAC,gCAAgC,CAAM,GACxD,OAAO,CA+BT"}

package/dist/commands/project/complete-state/index.js

@@ -1,6 +1,6 @@
 import { readFile as defaultReadFile, writeFile as defaultWriteFile, } from 'node:fs/promises';
 import { buildCommandContext } from '../../../app/command-context.js';
-import { checkProjectCloseout, formatCloseoutRefusal, } from '../../project/closeout-check/index.js';
+import { checkProjectCloseout, DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES, formatCloseoutRefusal, } from '../../project/closeout-check/index.js';
 import { readGlobalOptions } from '../../shared/shared.utils.js';
 import { resolveEffectiveConfig } from '../../../config/resolve.js';
 import { CliError } from '../../../errors/cli-error.js';
@@ -10,6 +10,12 @@ import { assertValidProjectStateFilesystemContent } from '../../../validation/pr
 import { Command } from 'commander';
 import { renderCompletedProjectState } from './state-utils.js';
 const DEFAULT_DEPENDENCIES = {
+    // Goal boundary observation (gh, git, project reader, child lookup) is
+    // read-only and shared with closeout-check.
+    gh: DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES.gh,
+    git: DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES.git,
+    getProjectState: DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES.getProjectState,
+    listDirectories: DEFAULT_CLOSEOUT_CHECK_DEPENDENCIES.listDirectories,
     buildCommandContext,
     resolveProjectRoot,
     readFile: defaultReadFile,

package/dist/commands/project/delivery/check.d.ts

@@ -0,0 +1,66 @@
+import { type CommandContext, type GlobalOptions } from '../../../app/command-context.js';
+import { type GitRunner } from '../../project/sync/git.js';
+import { type GoalDelivery, type ProjectState } from '@open-agent-toolkit/control-plane';
+import { Command } from 'commander';
+import { type CarrierEvaluation, type ReviewEvaluation } from './evidence.js';
+export interface GoalDeliveryProject {
+    repoRoot: string;
+    projectPath: string;
+    projectDir: string;
+    statePath: string;
+    stateContent: string;
+    state: ProjectState;
+    /** Whether the project override currently disables the exit gate. */
+    exitGateDisabled: boolean;
+}
+export interface DeliveryProjectDependencies {
+    resolveProjectRoot: (cwd: string) => Promise<string>;
+    readFile: (path: string, encoding: 'utf8') => Promise<string>;
+    getProjectState: (projectPath: string) => Promise<ProjectState>;
+}
+export declare const DEFAULT_DELIVERY_PROJECT_DEPENDENCIES: DeliveryProjectDependencies;
+/**
+ * Load a goal project for the delivery commands through the control-plane
+ * reader, so the registry, carriers, membership and Reviews rows are read
+ * exactly as the router reads them. Fails closed for any other mode.
+ */
+export declare function loadGoalDeliveryProject(project: string, cwd: string, dependencies: DeliveryProjectDependencies): Promise<GoalDeliveryProject>;
+/**
+ * A delivery's effective scope: its frozen scope plus every predecessor it
+ * replaces through `covers_scope_of`. A cycle or missing link stops the
+ * walk; the closeout coverage predicate reports those.
+ */
+export declare function deliveryEffectiveScope(deliveries: readonly GoalDelivery[], delivery: GoalDelivery): string[];
+export { reviewRowsFor } from './evidence.js';
+export interface SubjectEvidenceReport {
+    subject: string;
+    kind: 'milestone' | 'delivery';
+    milestone: string | null;
+    scope: string[];
+    publishedHeads: (string | null)[];
+    review: ReviewEvaluation;
+    /**
+     * `source` names the carrier evaluated: `delivery check` judges the
+     * milestone's working carrier (`oat_milestone_gates[mNN].exit`), while the
+     * closeout boundary judges the delivery's persisted `exit_gate` binding.
+     */
+    exit: CarrierEvaluation & {
+        source: ExitCarrierSource;
+    };
+    /** Passed, fresh integrated review and an allowed, fresh exit carrier. */
+    deliverable: boolean;
+}
+/** Which exit carrier an evaluation judged. */
+export type ExitCarrierSource = 'milestone-carrier' | 'delivery-binding';
+/**
+ * Evaluate the delivery evidence for one subject. A registered delivery is
+ * judged against its persisted member observations; a milestone (before
+ * registration) against the project branch head.
+ */
+export declare function evaluateSubjectEvidence(project: GoalDeliveryProject, subject: string, git: GitRunner): Promise<SubjectEvidenceReport>;
+export interface DeliveryCheckDependencies extends DeliveryProjectDependencies {
+    buildCommandContext: (options: GlobalOptions) => CommandContext;
+    git: GitRunner;
+}
+export declare function createProjectDeliveryCheckCommand(overrides?: Partial<DeliveryCheckDependencies>): Command;
+//# sourceMappingURL=check.d.ts.map

package/dist/commands/project/delivery/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/delivery/check.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAS9E,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAML,KAAK,iBAAiB,EAEtB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAKpB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA2B;IAC1C,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CACjE;AAED,eAAO,MAAM,qCAAqC,EAAE,2BAKjD,CAAC;AAEJ;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,2BAA2B,GACxC,OAAO,CAAC,mBAAmB,CAAC,CA+B9B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,SAAS,YAAY,EAAE,EACnC,QAAQ,EAAE,YAAY,GACrB,MAAM,EAAE,CAgBV;AAED,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,IAAI,EAAE,iBAAiB,GAAG;QAAE,MAAM,EAAE,iBAAiB,CAAA;KAAE,CAAC;IACxD,0EAA0E;IAC1E,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,qBAAqB,CAAC,CA4HhC;AAED,MAAM,WAAW,yBAA0B,SAAQ,2BAA2B;IAC5E,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,GAAG,EAAE,SAAS,CAAC;CAChB;AAwBD,wBAAgB,iCAAiC,CAC/C,SAAS,GAAE,OAAO,CAAC,yBAAyB,CAAM,GACjD,OAAO,CAsDT"}

package/dist/commands/project/delivery/check.js

@@ -0,0 +1,232 @@
+import { readFile } from 'node:fs/promises';
+import { isAbsolute, join, relative, sep } from 'node:path';
+import { buildCommandContext, } from '../../../app/command-context.js';
+import { defaultGitRunner } from '../../project/sync/git.js';
+import { getFrontmatterBlock, parseSkillGateOverrides, SKILL_GATE_OVERRIDE_DISABLED, } from '../../shared/frontmatter.js';
+import { readGlobalOptions } from '../../shared/shared.utils.js';
+import { CliError } from '../../../errors/cli-error.js';
+import { resolveProjectRoot } from '../../../fs/paths.js';
+import { getProjectState, milestonePhaseScope, normalizeMilestoneId, } from '@open-agent-toolkit/control-plane';
+import { Command } from 'commander';
+import { deliveryEvidenceScope, reviewRowsFor, evaluateDeliveryReview, evaluateGateCarrier, evaluateSuccessor, } from './evidence.js';
+/** The skill whose gate the milestone exit carrier records. */
+const EXIT_GATE_SKILL = 'oat-project-implement';
+export const DEFAULT_DELIVERY_PROJECT_DEPENDENCIES = {
+    resolveProjectRoot,
+    readFile: (path, encoding) => readFile(path, encoding),
+    getProjectState,
+};
+/**
+ * Load a goal project for the delivery commands through the control-plane
+ * reader, so the registry, carriers, membership and Reviews rows are read
+ * exactly as the router reads them. Fails closed for any other mode.
+ */
+export async function loadGoalDeliveryProject(project, cwd, dependencies) {
+    const repoRoot = await dependencies.resolveProjectRoot(cwd);
+    const projectPath = isAbsolute(project) ? project : join(repoRoot, project);
+    const statePath = join(projectPath, 'state.md');
+    let stateContent;
+    try {
+        stateContent = await dependencies.readFile(statePath, 'utf8');
+    }
+    catch {
+        throw new CliError(`Project state.md not found: ${statePath}`, 1);
+    }
+    const state = await dependencies.getProjectState(projectPath);
+    if (state.workflowMode !== 'goal') {
+        throw new CliError(`Delivery evidence applies to goal projects; ${project} is in ${state.workflowMode} mode.`, 1);
+    }
+    const overrides = parseSkillGateOverrides(getFrontmatterBlock(stateContent) ?? '', statePath);
+    return {
+        repoRoot,
+        projectPath,
+        projectDir: relative(repoRoot, projectPath).split(sep).join('/'),
+        statePath,
+        stateContent,
+        state,
+        exitGateDisabled: overrides.overrides[EXIT_GATE_SKILL] === SKILL_GATE_OVERRIDE_DISABLED,
+    };
+}
+/**
+ * A delivery's effective scope: its frozen scope plus every predecessor it
+ * replaces through `covers_scope_of`. A cycle or missing link stops the
+ * walk; the closeout coverage predicate reports those.
+ */
+export function deliveryEffectiveScope(deliveries, delivery) {
+    const scope = [];
+    const seen = new Set();
+    let current = delivery;
+    while (current !== undefined && !seen.has(current.delivery_id)) {
+        seen.add(current.delivery_id);
+        for (const phaseId of current.scope) {
+            if (!scope.includes(phaseId))
+                scope.push(phaseId);
+        }
+        const predecessor = current.covers_scope_of;
+        current =
+            predecessor === null
+                ? undefined
+                : deliveries.find((entry) => entry.delivery_id === predecessor);
+    }
+    return scope;
+}
+export { reviewRowsFor } from './evidence.js';
+/**
+ * Evaluate the delivery evidence for one subject. A registered delivery is
+ * judged against its persisted member observations; a milestone (before
+ * registration) against the project branch head.
+ */
+export async function evaluateSubjectEvidence(project, subject, git) {
+    const deliveries = project.state.deliveries ?? [];
+    const delivery = deliveries.find((entry) => entry.delivery_id === subject);
+    if (delivery) {
+        const milestoneId = delivery.milestone;
+        const scope = deliveryEffectiveScope(deliveries, delivery);
+        const evidence = deliveryEvidenceScope(project, deliveries, delivery);
+        const publishedHeads = delivery.members.map((member) => member.observed_head);
+        const review = await evaluateDeliveryReview(git, evidence, delivery, scope);
+        const exitEvaluation = await evaluateGateCarrier(milestoneId === null
+            ? null
+            : (project.state.milestoneGates?.[milestoneId]?.exit ?? null), {
+            kind: 'code',
+            scope,
+            match: 'covers',
+            overrideDisabled: project.exitGateDisabled,
+        }, { git, scope: evidence, publishedHeads });
+        const exit = { ...exitEvaluation, source: 'milestone-carrier' };
+        return {
+            subject,
+            kind: 'delivery',
+            milestone: milestoneId,
+            scope,
+            publishedHeads,
+            review,
+            exit,
+            deliverable: review.fresh &&
+                review.disposition === 'passed' &&
+                exit.outcome === 'allowed' &&
+                exit.freshness === 'fresh',
+        };
+    }
+    const milestoneId = normalizeMilestoneId(subject);
+    if (milestoneId === null) {
+        throw new CliError(`Unknown delivery subject "${subject}": name a milestone (mNN) or a registered delivery (dNN).`, 1);
+    }
+    const membership = project.state.milestoneMembership;
+    const scope = membership
+        ? milestonePhaseScope(membership, milestoneId)
+        : null;
+    if (scope === null) {
+        const [firstError] = membership?.errors ?? [];
+        throw new CliError(firstError
+            ? `Milestone membership is invalid (${firstError.code}: ${firstError.message}); repair it with oat-project-goal.`
+            : `No ## Milestones row for ${milestoneId}.`, 1);
+    }
+    const head = await git.run(['rev-parse', '--verify', 'HEAD'], {
+        cwd: project.repoRoot,
+        allowFailure: true,
+    });
+    const publishedHead = head.code === 0 ? head.stdout.trim() : null;
+    const rows = reviewRowsFor(project.state.reviews, [milestoneId]);
+    const row = rows.at(-1) ?? null;
+    const evidence = {
+        repoRoot: project.repoRoot,
+        projectDir: project.projectDir,
+        evidenceArtifacts: rows
+            .map((entry) => entry.artifact)
+            .filter((artifact) => artifact !== '' && artifact !== '-'),
+    };
+    let review;
+    if (row === null || row.artifact === '' || row.artifact === '-') {
+        review = {
+            artifact: null,
+            disposition: row?.status ?? null,
+            fresh: false,
+            reason: `review-missing: no ${milestoneId} code review row names an artifact`,
+            members: [],
+        };
+    }
+    else {
+        const successor = await evaluateSuccessor(git, evidence, row.reviewedHead ?? null, publishedHead);
+        review = {
+            artifact: row.artifact,
+            disposition: row.status,
+            fresh: successor.fresh,
+            reason: successor.fresh ? null : `${successor.code}: ${successor.reason}`,
+            members: [],
+        };
+    }
+    const exit = {
+        ...(await evaluateGateCarrier(project.state.milestoneGates?.[milestoneId]?.exit ?? null, { kind: 'code', scope, overrideDisabled: project.exitGateDisabled }, { git, scope: evidence, publishedHeads: [publishedHead] })),
+        source: 'milestone-carrier',
+    };
+    return {
+        subject,
+        kind: 'milestone',
+        milestone: milestoneId,
+        scope,
+        publishedHeads: [publishedHead],
+        review,
+        exit,
+        deliverable: review.fresh &&
+            review.disposition?.toLowerCase() === 'passed' &&
+            exit.outcome === 'allowed' &&
+            exit.freshness === 'fresh',
+    };
+}
+const DEFAULT_CHECK_DEPENDENCIES = {
+    ...DEFAULT_DELIVERY_PROJECT_DEPENDENCIES,
+    buildCommandContext,
+    git: defaultGitRunner,
+};
+function formatEvidenceReport(report) {
+    const review = report.review.fresh
+        ? `fresh (${report.review.disposition ?? 'no disposition'})`
+        : `stale: ${report.review.reason ?? 'unknown'}`;
+    const exit = report.exit.freshness === 'fresh'
+        ? `${report.exit.outcome}, fresh`
+        : `${report.exit.outcome}, stale: ${report.exit.reason ?? 'unknown'}`;
+    return [
+        `Delivery evidence for ${report.subject} (${report.kind}; scope ${report.scope.join(', ')}):`,
+        `  integrated review: ${review}`,
+        `  exit carrier (${report.exit.source}): ${exit}`,
+        `  deliverable: ${report.deliverable ? 'yes' : 'no'}`,
+    ].join('\n');
+}
+export function createProjectDeliveryCheckCommand(overrides = {}) {
+    const dependencies = { ...DEFAULT_CHECK_DEPENDENCIES, ...overrides };
+    return new Command('check')
+        .description('Report integrated-review and milestone exit-carrier freshness for a goal milestone or delivery under the bookkeeping-successor contract (read-only; status undeliverable and exit 1 when not deliverable)')
+        .requiredOption('--project <path>', 'Goal project path')
+        .requiredOption('--subject <id>', 'Milestone (mNN) or registered delivery (dNN) to evaluate')
+        .action(async (options, command) => {
+        const context = dependencies.buildCommandContext(readGlobalOptions(command));
+        try {
+            const project = await loadGoalDeliveryProject(options.project, context.cwd, dependencies);
+            const report = await evaluateSubjectEvidence(project, options.subject, dependencies.git);
+            if (context.json) {
+                // `ok` means deliverable; an evaluated but refusing subject is
+                // `undeliverable`, with the full report and exit 1.
+                context.logger.json({
+                    status: report.deliverable ? 'ok' : 'undeliverable',
+                    ...report,
+                });
+            }
+            else {
+                context.logger.info(formatEvidenceReport(report));
+            }
+            // Fail closed: a caller that ignores the report still stops.
+            process.exitCode = report.deliverable ? 0 : 1;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (context.json) {
+                context.logger.json({ status: 'error', message });
+            }
+            else {
+                context.logger.error(message);
+            }
+            process.exitCode = error instanceof CliError ? error.exitCode : 1;
+        }
+    });
+}