@pareto4/pp-core 1.12.0 → 1.13.0

package/pp-core/bin/lib/git-base-branch.cjs

@@ -27,10 +27,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASE_BRANCH_REFUSED_REASON = void 0;
+exports.isPlausibleBranchRef = isPlausibleBranchRef;
 exports.readConfigBaseBranch = readConfigBaseBranch;
 exports.trySymbolicRef = trySymbolicRef;
 exports.tryRemoteShow = tryRemoteShow;
 exports.tryLocalBranch = tryLocalBranch;
+exports.resolveBaseBranchResult = resolveBaseBranchResult;
 exports.resolveBaseBranch = resolveBaseBranch;
 exports.gitWorktreeInfoInternal = gitWorktreeInfoInternal;
 exports.cmdGitBaseBranch = cmdGitBaseBranch;
@@ -38,6 +41,99 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // ─── Helpers ──────────────────────────────────────────────────────────────────
+/**
+ * The one thing that makes a base branch dangerous, and the only rule here that
+ * is OURS rather than git's.
+ *
+ * `execGit` uses argv, so a configured base branch is not shell injection. It is
+ * something narrower and worse: a value beginning with `-` is not a revision to
+ * git, it is an OPTION. `git log "--output=<path>..HEAD"` exits 0 and creates
+ * that file; so does `git diff`. A `.planning/config.json` shipped inside a
+ * cloned repository was therefore an arbitrary-file-creation-and-truncation
+ * primitive running as the developer or the CI runner (T-6-49).
+ *
+ * A dash INSIDE a name is an ordinary branch: `feature/-x` is a name git creates
+ * and resolves. Only the leading position turns a value into an option, so only
+ * the leading position is refused.
+ */
+const OPTION_SHAPED = /^-/;
+/**
+ * The characters git itself forbids in a ref name: ASCII control characters and
+ * space (`\x00`-`\x20`), DEL, and `~ ^ : ? * [ \`.
+ *
+ * REFUSING MORE THAN THIS IS ITS OWN DEFECT (W16). The first form of this
+ * validator was an allowlist of `[A-Za-z0-9._/-]`, which reads as prudent and is
+ * not: `feature/a+b`, `feature/a@b` and `café` are all names
+ * `git check-ref-format --branch` accepts and `git branch` creates, and all
+ * three were silently discarded in favour of whatever the ladder found next — a
+ * review computed over a range the project never asked for, which is the exact
+ * failure the ladder exists to end. None of `+ @ % = ( ) ; | $ !` can make git
+ * do anything, because nothing here reaches a shell. So the rule is git's rule,
+ * plus the leading dash, and nothing else.
+ */
+const FORBIDDEN_REF_CHARS = /[\x00-\x20\x7f~^:?*[\\]/;
+/** Sequences git forbids anywhere inside a ref name. */
+const FORBIDDEN_REF_SEQUENCES = ['..', '@{', '//'];
+/** A bound, so a pathological value cannot become a pathological command line. */
+const MAX_REF_LENGTH = 255;
+/**
+ * Is this a name git could actually resolve as a branch?
+ *
+ * The predicate is `git check-ref-format --branch` re-implemented, with a
+ * leading `-` refused on top. Re-implemented rather than shelled out to: this
+ * function is pure, total and called on a path that must never spawn a
+ * subprocess to decide whether it is safe to spawn a subprocess. The equivalence
+ * is not asserted here in prose — `tests/git-base-branch.test.cjs` drives
+ * the admit half from `git check-ref-format --branch` AS THE ORACLE, so git
+ * decides what must be admitted and this comment cannot quietly stop being true.
+ *
+ * Total over any input; never throws. Answering `false` is not an error — it is
+ * the resolver's cue to fall THROUGH to the next tier of the ladder, which is
+ * the behaviour a project with no override already gets.
+ */
+function isPlausibleBranchRef(value) {
+    if (typeof value !== 'string')
+        return false;
+    if (value === '' || value.length > MAX_REF_LENGTH)
+        return false;
+    if (OPTION_SHAPED.test(value))
+        return false;
+    if (FORBIDDEN_REF_CHARS.test(value))
+        return false;
+    for (const bad of FORBIDDEN_REF_SEQUENCES) {
+        if (value.includes(bad))
+            return false;
+    }
+    if (value.startsWith('/') || value.endsWith('/') || value.endsWith('.'))
+        return false;
+    // No path component may be empty, begin with `.`, or end with `.lock`.
+    for (const part of value.split('/')) {
+        if (part === '' || part.startsWith('.') || part.endsWith('.lock'))
+            return false;
+    }
+    // git's branch shorthand refuses this one by name, so this resolver does too.
+    if (value === 'HEAD')
+        return false;
+    return true;
+}
+/**
+ * WHAT A CALLER SAYS WHEN THE OVERRIDE IS REFUSED. One sentence, exported, for
+ * every channel — three call sites state it and none of them spells it.
+ *
+ * A second spelling of this sentence would be a second definition of what the
+ * mechanism did. The `check vault.audit` notes and the `check ship.practices`
+ * message carry these exact bytes.
+ *
+ * The reason carries NO copy of the refused value: the value is client-supplied
+ * and one of its shapes is an absolute filesystem path, so echoing it back onto
+ * an agent-readable surface would trade an injection for a disclosure (CR-03).
+ */
+exports.BASE_BRANCH_REFUSED_REASON = 'the configured git.base_branch is not a name git could resolve as a branch, so it was REJECTED ' +
+    'and the base-branch ladder continued without it. A value beginning with "-" is an option to git ' +
+    'rather than a revision, and options such as --output= make git create and truncate the file they ' +
+    'name; every other rule applied here is git\'s own ref-name grammar, so a name git itself would ' +
+    'refuse is refused too. The refused value is deliberately not repeated: it is client-supplied, ' +
+    'and one of its shapes is a filesystem path.';
 /**
  * Safely look up `git.base_branch` from the project's config.json.
  * Returns the configured value (a non-empty, non-null string) or null.
@@ -153,33 +249,63 @@ function tryLocalBranch(cwd, execGit) {
     }
 }
 /**
- * Resolve the default/base branch for the repository at `cwd`.
+ * Resolve the default/base branch for the repository at `cwd`, and REPORT a
+ * refused config override rather than swallowing it.
  *
- * Consults the full precedence ladder and always returns a non-empty string.
+ * Consults the full precedence ladder and always returns a non-empty branch.
  * Never throws.
+ *
+ * ONLY TIER 1 IS SHAPE-CHECKED, and that is the whole point. Tier 1 is the one
+ * value that comes from a file a cloned repository can carry; tiers 2-4 are
+ * git's own answers about its own refs, and putting them through the same
+ * allowlist would silently demote a legitimate branch whose name this pattern
+ * happens not to describe — trading a closed threat for a new silent failure in
+ * the one function whose job is to stop guessing.
  */
-function resolveBaseBranch(cwd, deps) {
+function resolveBaseBranchResult(cwd, deps) {
     const execGit = deps?.execGit ?? shell_command_projection_cjs_1.execGit;
     // Derive .planning dir relative to cwd (mirrors planningDir() in planning-workspace.cjs)
     const planningDir = node_path_1.default.join(cwd, '.planning');
-    // 1. Config override
+    // 1. Config override — the only untrusted tier, so the only checked one.
     const configured = readConfigBaseBranch(planningDir, deps);
-    if (configured)
-        return configured;
+    let configRejected = null;
+    if (configured) {
+        if (isPlausibleBranchRef(configured))
+            return { branch: configured, configRejected: null };
+        configRejected = { reason: exports.BASE_BRANCH_REFUSED_REASON };
+    }
     // 2. symbolic-ref (fast, no network)
     const symref = trySymbolicRef(cwd, execGit);
     if (symref)
-        return symref;
+        return { branch: symref, configRejected };
     // 3. git remote show origin (authoritative when origin/HEAD unset)
     const remoteShow = tryRemoteShow(cwd, execGit);
     if (remoteShow)
-        return remoteShow;
+        return { branch: remoteShow, configRejected };
     // 4. Local branch existence
     const local = tryLocalBranch(cwd, execGit);
     if (local)
-        return local;
+        return { branch: local, configRejected };
     // 5. Last-resort default
-    return 'main';
+    return { branch: 'main', configRejected };
+}
+/**
+ * Resolve the default/base branch for the repository at `cwd`.
+ *
+ * Consults the full precedence ladder and always returns a non-empty string.
+ * Never throws.
+ *
+ * The bare-string form. A consumer that computes a range and has a channel to
+ * speak on takes `resolveBaseBranchResult` instead and states the refusal
+ * (`vault-audit.cts`, the blocking audit gate, and `cmdShipPractices`, the
+ * ship:pre check): a gate that ran over a range the project never configured
+ * and said nothing would report success on the wrong input. This form stays
+ * for callers with nowhere to put a sentence, such as `cmdGitBaseBranch`,
+ * whose contract is one branch name on stdout. Either form refuses an
+ * option-shaped override.
+ */
+function resolveBaseBranch(cwd, deps) {
+    return resolveBaseBranchResult(cwd, deps).branch;
 }
 /**
  * Detect whether `cwd` sits inside a git worktree, and if so, return the

package/pp-core/bin/lib/init-contract.cjs

@@ -44,7 +44,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INIT_SESSION_WRITE_FAILED = exports.INIT_SESSION_MALFORMED = exports.INIT_CONTRACT_FLAGS = exports.INIT_COMPOSE_DECLINED_KEY = void 0;
+exports.INIT_SESSION_WRITE_FAILED = exports.INIT_SESSION_MALFORMED = exports.INIT_CONTRACT_FLAGS = exports.INIT_ORG_PROFILE_DECLINED_KEY = exports.INIT_COMPOSE_DECLINED_KEY = void 0;
 exports.buildInitQuestions = buildInitQuestions;
 exports.verifyInitInvariants = verifyInitInvariants;
 exports.initSessionNext = initSessionNext;
@@ -74,6 +74,21 @@ const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs")
  * a bare unregistered top-level namespace would trip.
  */
 exports.INIT_COMPOSE_DECLINED_KEY = 'init.compose_declined';
+/**
+ * The dotted `.planning/config.json` key `pp-tools init` sets when the
+ * operator is offered a detected org profile and SKIPS it — a blank answer or
+ * `none` in any letter case. It is the only signal that tells "offered a
+ * detected profile and skipped it" from "the question never ran": both leave
+ * `org.profile` unset, and without it `verifyInitInvariants` reported every
+ * deliberate skip as `INIT_QUESTIONS_ORG_PROFILE_UNASKED`. Written by
+ * `initSessionAnswer` only when a profile was detectable (the predicate the
+ * violation reads), read back with strict boolean identity, and written back
+ * to `false` when a later run selects a profile. Registered under the
+ * `vault` capability so `config-set` accepts it. Kept OFF
+ * `ORG_PROFILE_ALLOWLIST`: a profile package must never answer the question
+ * about itself.
+ */
+exports.INIT_ORG_PROFILE_DECLINED_KEY = 'init.org_profile_declined';
 /** The identity-only choices appended after the provider seam's own
  * `PROVIDERS` list — never retyped ahead of `PROVIDERS` itself (T-34-50). */
 const IDENTITY_ONLY_PROVIDER_OPTIONS = Object.freeze(['github', 'other', 'none']);
@@ -167,10 +182,12 @@ function getDotted(obj, dottedPath) {
  * `optionalAnswer: true` — that flag describes the ANSWER (pressing Enter
  * is a complete, valid response), never whether the question is asked.
  *
- * Question 6 (`org_profile`)'s `preselected` is resolved via
- * `resolveDetectedOrgProfile` — set only when exactly one org-profile-shaped
- * package is installed (INIT-PATCH-C); the prompt text is built from that
- * detected value rather than kept as two hard-coded strings that can drift.
+ * Question 6 (`org_profile`) names a HINT, never a default: when
+ * `resolveDetectedOrgProfile` finds exactly one org-profile-shaped package
+ * installed (INIT-PATCH-C), the prompt names it, Enter skips, and typing its
+ * name (or any other) selects it — the question carries no `preselected`.
+ * The prompt text is built from that detected value rather than kept as two
+ * hard-coded strings that can drift.
  * `opts._globalRoot` is forwarded to it unchanged, the same test-seam
  * convention `verifyInitInvariants`'s own `_globalRoot` already follows —
  * production callers omit it.
@@ -201,14 +218,16 @@ function buildInitQuestions(cwd, opts = {}) {
     // stays maximally strict, no allowlist entry was added for it. The detected
     // value itself is never a literal in this file — it is a runtime string
     // read from an installed package, interpolated into the prompt below.
+    // A detected profile is a HINT, never a default: no `preselected`, so a
+    // profile installed on the operator's machine (perhaps another client's)
+    // never becomes a project's binding by pressing Enter. Enter skips (and
+    // `initSessionAnswer` records the skip); typing the name selects it.
     const orgProfileQuestion = isUsableString(detectedOrgProfile)
         ? {
             id: 'org_profile',
-            prompt: `Org profile package (optional — a single installed org profile was detected: "${detectedOrgProfile}". ` +
-                'Press Enter to use it, type "none" to skip it, or type a different package name.)',
+            prompt: `Org profile package (optional — "${detectedOrgProfile}" is installed: type its name to use it, ` +
+                'or press Enter to skip)',
             optionalAnswer: true,
-            preselected: detectedOrgProfile,
-            preselectedLabel: `${detectedOrgProfile} (detected installed profile)`,
         }
         : {
             id: 'org_profile',
@@ -242,36 +261,6 @@ function buildInitQuestions(cwd, opts = {}) {
     ];
 }
 // ─── verifyInitInvariants ───────────────────────────────────────────────────
-/**
- * Byte-for-byte the same heuristic `src/org-profile.cts`'s own (private,
- * unexported) `resolveGlobalPackageRoot` uses. Duplicated here because it
- * is not part of that module's public surface — the same per-module
- * duplication convention every sibling seam module in this repo follows
- * for helpers it cannot import without either widening an unrelated
- * module's exports or risking a require cycle.
- */
-function resolveGlobalNodeModulesRoot() {
-    try {
-        const prefixEnv = process.env.NPM_CONFIG_PREFIX ?? process.env.npm_config_prefix;
-        let candidate;
-        if (typeof prefixEnv === 'string' && prefixEnv.trim() !== '') {
-            const prefix = prefixEnv.trim();
-            candidate =
-                process.platform === 'win32' ? node_path_1.default.join(prefix, 'node_modules') : node_path_1.default.join(prefix, 'lib', 'node_modules');
-        }
-        else {
-            const execDir = node_path_1.default.dirname(process.execPath);
-            candidate =
-                process.platform === 'win32'
-                    ? node_path_1.default.join(execDir, 'node_modules')
-                    : node_path_1.default.resolve(execDir, '..', 'lib', 'node_modules');
-        }
-        return node_fs_1.default.existsSync(candidate) ? candidate : null;
-    }
-    catch {
-        return null;
-    }
-}
 /** Conservative npm-package-name shape check (bare `name` or scoped
  * `@scope/name`; lowercase, digits, `.`/`_`/`-`, never leading `.`/`_` in
  * either segment). A directory name that does not match is never offered as
@@ -367,15 +356,27 @@ function collectOrgProfileShapedPackages(nodeModulesDir, opts = {}) {
 function containsOrgProfileShapedPackage(nodeModulesDir) {
     return collectOrgProfileShapedPackages(nodeModulesDir, { limit: 1 }).names.length > 0;
 }
+/**
+ * The global roots DETECTION scans — the org-profile hint and the UNASKED
+ * check — from the one candidate builder in `src/org-profile.cts`, never a
+ * private copy (the single-root duplicate that lived here missed every
+ * Homebrew layout). `explicitPrefixOnly`: an explicit npm prefix is
+ * authoritative, so a hint or a violation never comes from a tree the
+ * operator did not point at. The `_globalRoot` seam still wins.
+ */
+function detectionGlobalRoots(opts) {
+    return (0, org_profile_cjs_1.globalRootCandidatesFor)({ _globalRoot: opts._globalRoot, explicitPrefixOnly: true });
+}
 function orgProfilePackageResolvable(cwd, opts) {
     try {
         const projectNodeModules = node_path_1.default.join(cwd, 'node_modules');
         if (node_fs_1.default.existsSync(projectNodeModules) && containsOrgProfileShapedPackage(projectNodeModules)) {
             return true;
         }
-        const globalRoot = opts._globalRoot !== undefined ? opts._globalRoot : resolveGlobalNodeModulesRoot();
-        if (globalRoot && containsOrgProfileShapedPackage(globalRoot)) {
-            return true;
+        for (const globalRoot of detectionGlobalRoots(opts)) {
+            if (containsOrgProfileShapedPackage(globalRoot)) {
+                return true;
+            }
         }
         return false;
     }
@@ -405,8 +406,7 @@ function resolveDetectedOrgProfile(cwd, opts) {
             for (const name of projectResult.names)
                 names.add(name);
         }
-        const globalRoot = opts._globalRoot !== undefined ? opts._globalRoot : resolveGlobalNodeModulesRoot();
-        if (globalRoot) {
+        for (const globalRoot of detectionGlobalRoots(opts)) {
             const globalResult = collectOrgProfileShapedPackages(globalRoot);
             if (globalResult.capped)
                 anyCapped = true;
@@ -421,6 +421,14 @@ function resolveDetectedOrgProfile(cwd, opts) {
         return null;
     }
 }
+/** The one owner of the org-profile decline rule: a blank answer, or `none`
+ * in any letter case with surrounding whitespace, skips the question. Enter
+ * in the TTY driver and `--session-answer org_profile=none` / `org_profile=`
+ * all end here. */
+function isOrgProfileDecline(value) {
+    const trimmed = value.trim();
+    return trimmed === '' || trimmed.toLowerCase() === 'none';
+}
 /** Read `.planning/config.json` at `cwd`, distinguishing "file absent" from
  * "file present but empty/malformed" — `INIT_IDENTITY_MISSING` only fires
  * on the latter (see `verifyInitInvariants`'s own doc comment for why an
@@ -504,12 +512,17 @@ function verifyInitInvariants(cwd, opts = {}) {
     // installed (project node_modules or the machine's global root) but
     // org.profile was never set, i.e. Question 6 appears to have been
     // skipped rather than answered blank.
+    // A recorded skip (init.org_profile_declined, the JSON boolean true and
+    // nothing else) is an answer. A set pointer is checked first; the marker is
+    // checked before the node_modules scan.
     try {
         const orgProfilePointer = getDotted(parsed, org_profile_cjs_1.ORG_PROFILE_CONFIG_KEY);
-        if (!isUsableString(orgProfilePointer) && orgProfilePackageResolvable(cwd, opts)) {
+        const orgProfileDeclined = getDotted(parsed, exports.INIT_ORG_PROFILE_DECLINED_KEY) === true;
+        if (!isUsableString(orgProfilePointer) && !orgProfileDeclined && orgProfilePackageResolvable(cwd, opts)) {
             violations.push({
                 code: INVARIANT_CODE.ORG_PROFILE_UNASKED,
-                message: 'An org-profile-shaped package is installed but org.profile is unset — the pointer question (Question 6) appears to have been skipped rather than answered.',
+                message: 'An org-profile-shaped package is installed but org.profile is unset and no skip was recorded — the pointer question (Question 6) appears not to have been answered. ' +
+                    'Re-run "pp-tools init --reset" and either type the package name to use it, or press Enter (or type "none") to record a skip.',
             });
         }
     }
@@ -890,10 +903,13 @@ function initSessionNext(cwd, opts = {}) {
  * any answer once the session is already `done`.
  *
  * The `org_profile` answer is written to `.planning/config.json` (`org.profile`)
- * IMMEDIATELY when non-blank — the one exception to the "batch write after
- * the last answer" rule in `computeCurrentStep`'s own doc comment — because
- * the very next question (`provider`) must see it to re-resolve its
- * `preselected` (the walk-3 regression Task 1's acceptance names).
+ * IMMEDIATELY when it selects a package — the one exception to the "batch
+ * write after the last answer" rule in `computeCurrentStep`'s own doc
+ * comment — because the very next question (`provider`) must see it to
+ * re-resolve its `preselected` (the walk-3 regression Task 1's acceptance
+ * names). A decline (`isOrgProfileDecline`: blank, or `none` in any case) is
+ * recorded instead as `init.org_profile_declined: true` when a profile was
+ * detectable.
  */
 function initSessionAnswer(cwd, stepId, value, opts = {}) {
     const loaded = loadSession(cwd);
@@ -937,13 +953,34 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
             if (!step.question.optionalAnswer && (typeof value !== 'string' || value.trim() === '')) {
                 return { ok: false, reason: 'answer_required', message: `Question "${stepId}" requires a non-blank answer.` };
             }
-            session.answers[stepId] = typeof value === 'string' ? value : '';
+            const answerValue = typeof value === 'string' ? value : '';
             if (stepId === 'org_profile') {
-                const trimmed = session.answers[stepId].trim();
-                if (trimmed !== '') {
-                    writeConfigMerge(cwd, { org: { profile: trimmed } });
+                if (isOrgProfileDecline(answerValue)) {
+                    // Enter and `none` leave the same session record. The marker is
+                    // written exactly when the UNASKED violation would otherwise fire
+                    // (the same predicate); with no profile detectable nothing was
+                    // offered, so nothing is recorded.
+                    session.answers[stepId] = '';
+                    if (orgProfilePackageResolvable(cwd, { _globalRoot: opts._globalRoot })) {
+                        writeConfigMerge(cwd, { init: { org_profile_declined: true } });
+                    }
+                    persistSession(cwd, session);
+                    return { ok: true };
+                }
+                const trimmed = answerValue.trim();
+                session.answers[stepId] = answerValue;
+                const orgPatch = { org: { profile: trimmed } };
+                // A selection after an earlier recorded skip writes the marker back to
+                // false in the same merge, so a stale decline never sits beside a set
+                // pointer. No write when the marker is absent.
+                if (getDotted(readConfigFile(cwd).parsed, exports.INIT_ORG_PROFILE_DECLINED_KEY) === true) {
+                    orgPatch.init = { org_profile_declined: false };
                 }
+                writeConfigMerge(cwd, orgPatch);
+                persistSession(cwd, session);
+                return { ok: true };
             }
+            session.answers[stepId] = answerValue;
             persistSession(cwd, session);
             return { ok: true };
         }
@@ -1028,7 +1065,16 @@ function initSessionReset(cwd) {
  * `init-contract --arm-vault`: turn the client vault on for a project whose
  * client vault is bound. Writes `vault.enabled: true` ONLY when the key is
  * absent — an explicit `false` (or any other explicit value) is the
- * operator's decision and is kept. With no client vault bound (no or
+ * operator's decision and is kept. When the vault ends up enabled it also
+ * writes `vault.required: true` where that key is absent: a project with a
+ * bound client vault should stop when that vault stops loading, instead of
+ * building without it after a confirmation. An explicit `vault.required`
+ * (including `false`) is kept, and so is an org profile's value: when the
+ * profile sets `vault.required` nothing is written, because the gate already
+ * reads it (project > profile > default). It also writes
+ * `vault.practices_enabled: true` where that key is absent, so the project
+ * records which client practices each phase applied from its first phase on;
+ * an explicit value is kept. All keys go in one write. With no client vault bound (no or
  * malformed `.platform-bindings.json`, or `client.vaultRepo` /
  * `client.vaultRef` missing — the same "bound" the gate's verdict uses) it
  * writes nothing and returns `ok: false` naming /pp-init. A present but
@@ -1063,6 +1109,8 @@ function armVault(cwd) {
             ok: false,
             armed: false,
             enabled: undefined,
+            required: undefined,
+            practicesEnabled: undefined,
             client,
             message: '.planning/config.json is not valid JSON — fix it (or re-run /pp-init), then arm the vault again. Nothing was written.',
         };
@@ -1071,33 +1119,99 @@ function armVault(cwd) {
     const nested = vaultSection && Object.prototype.hasOwnProperty.call(vaultSection, 'enabled');
     const flat = Object.prototype.hasOwnProperty.call(cfg, 'vault.enabled');
     const current = nested && vaultSection ? vaultSection.enabled : flat ? cfg['vault.enabled'] : undefined;
+    const requiredNested = vaultSection && Object.prototype.hasOwnProperty.call(vaultSection, 'required');
+    const requiredFlat = Object.prototype.hasOwnProperty.call(cfg, 'vault.required');
+    const currentRequired = requiredNested && vaultSection ? vaultSection.required : requiredFlat ? cfg['vault.required'] : undefined;
+    const practicesNested = vaultSection && Object.prototype.hasOwnProperty.call(vaultSection, 'practices_enabled');
+    const practicesFlat = Object.prototype.hasOwnProperty.call(cfg, 'vault.practices_enabled');
+    const currentPractices = practicesNested && vaultSection
+        ? vaultSection.practices_enabled
+        : practicesFlat
+            ? cfg['vault.practices_enabled']
+            : undefined;
+    const practicesAbsent = !(practicesNested || practicesFlat);
     if (!binding.bound) {
         return {
             ok: false,
             armed: false,
             enabled: current,
+            required: currentRequired,
+            practicesEnabled: currentPractices,
             client,
             message: 'No client vault is bound — .platform-bindings.json needs client.vaultRepo and client.vaultRef. Run /pp-init to bind it; vault.enabled was not changed.',
         };
     }
-    if (nested || flat) {
+    const enabledAbsent = !(nested || flat);
+    const enabledAfter = enabledAbsent ? true : current;
+    const requiredAbsent = !(requiredNested || requiredFlat);
+    // An org profile that sets vault.required already decides it for this project (the gate
+    // reads project > profile > default); arming must not override it with a project value.
+    let profileRequired = null;
+    if (requiredAbsent) {
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const orgProfile = require('./org-profile.cjs');
+            const r = orgProfile.resolveVaultRequired(cwd);
+            if (r.source === 'profile')
+                profileRequired = r.required;
+        }
+        catch {
+            /* no profile: arm as before */
+        }
+    }
+    const patch = {};
+    if (enabledAbsent)
+        patch.enabled = true;
+    if (enabledAfter === true && requiredAbsent && profileRequired === null)
+        patch.required = true;
+    // A bound client vault also records which of its practices each phase applied,
+    // from the first phase on. An explicit value is the operator's choice and is kept.
+    if (enabledAfter === true && practicesAbsent)
+        patch.practices_enabled = true;
+    const clauses = [
+        enabledAbsent
+            ? 'vault.enabled set to true (it was absent)'
+            : current === true
+                ? 'vault.enabled is already true'
+                : `vault.enabled is explicitly set to ${JSON.stringify(current)} — kept as the operator's choice`,
+    ];
+    if (enabledAfter === true) {
+        clauses.push(!requiredAbsent
+            ? `vault.required is set to ${JSON.stringify(currentRequired)} — kept as the operator's choice`
+            : profileRequired !== null
+                ? `vault.required comes from the org profile (${profileRequired}) — not written to the project`
+                : 'vault.required set to true (it was absent): planning and the build now stop when the client vault does not load');
+        clauses.push(practicesAbsent
+            ? "vault.practices_enabled set to true (it was absent): each plan now carries the client vault's practices and a record of which applied"
+            : `vault.practices_enabled is set to ${JSON.stringify(currentPractices)} — kept as the operator's choice`);
+    }
+    const requiredAfter = Object.prototype.hasOwnProperty.call(patch, 'required')
+        ? true
+        : profileRequired !== null
+            ? profileRequired
+            : currentRequired;
+    const practicesAfter = Object.prototype.hasOwnProperty.call(patch, 'practices_enabled')
+        ? true
+        : currentPractices;
+    if (Object.keys(patch).length === 0) {
         return {
-            ok: true,
-            armed: false,
-            enabled: current,
-            client,
-            message: current === true
-                ? 'vault.enabled is already true — nothing to do.'
-                : `vault.enabled is explicitly set to ${JSON.stringify(current)} — kept as the operator's choice.`,
+            ok: true, armed: false, enabled: current, required: requiredAfter, practicesEnabled: practicesAfter, client,
+            message: `${clauses.join('; ')} — nothing to do.`,
         };
     }
     try {
-        writeConfigMerge(cwd, { vault: { enabled: true } });
+        writeConfigMerge(cwd, { vault: patch });
     }
     catch (err) {
-        return { ok: false, armed: false, enabled: undefined, client, message: writeFailedMessage(err) };
+        return {
+            ok: false, armed: false, enabled: current, required: currentRequired, practicesEnabled: currentPractices, client,
+            message: writeFailedMessage(err),
+        };
     }
-    return { ok: true, armed: true, enabled: true, client, message: 'vault.enabled set to true (it was absent).' };
+    return {
+        ok: true, armed: true, enabled: enabledAfter, required: requiredAfter, practicesEnabled: practicesAfter, client,
+        message: `${clauses.join('; ')}.`,
+    };
 }
 // ─── cmdInitContract ────────────────────────────────────────────────────────
 /**

package/pp-core/bin/lib/init-interactive.cjs

@@ -168,26 +168,10 @@ async function runInitInteractive(cwd, prompter, opts = {}) {
                 preselectedLabel: state.preselectedLabel,
                 optionalAnswer: state.optionalAnswer,
             });
-            // INIT-PATCH-C: Enter accepts a carried default, "none" clears it.
-            // Scoped to an OPTIONAL step carrying a usable `preselected` — today
-            // that is only `org_profile` when exactly one org-profile-shaped
-            // package was detected. `provider` also carries a `preselected` but is
-            // NOT `optionalAnswer`, so the `state.optionalAnswer === true` guard
-            // below leaves it untouched: a blank answer there still falls through
-            // to `initSessionAnswer` verbatim, which still rejects it and re-asks
-            // exactly as today.
-            const hasUsableDefault = state.optionalAnswer === true && typeof state.preselected === 'string' && state.preselected.trim() !== '';
-            let submittedAnswer = answer;
-            if (hasUsableDefault) {
-                const trimmedLower = answer.trim().toLowerCase();
-                if (answer.trim() === '') {
-                    submittedAnswer = state.preselected;
-                }
-                else if (trimmedLower === 'none') {
-                    submittedAnswer = '';
-                }
-            }
-            const result = (0, init_contract_cjs_1.initSessionAnswer)(cwd, stepId, submittedAnswer, sessionOpts);
+            // A detected org profile is a hint, never a default: the driver has no
+            // default-acceptance path, and the answer goes to initSessionAnswer
+            // verbatim, which owns the none/blank decline.
+            const result = (0, init_contract_cjs_1.initSessionAnswer)(cwd, stepId, answer, sessionOpts);
             if (result.ok) {
                 if (stepId === 'compose_confirm') {
                     wroteBinding = readBindingsContent(cwd) !== preBindings;