@pareto4/pp-core 1.12.1 → 1.17.1

package/pp-core/bin/lib/package-identity.cjs

@@ -5,9 +5,9 @@
 
 const packageName = "@pareto4/pp-core";
 const binName = "pp-core";
-const repoSlug = "pareto4/pp-core";
-const repoUrl = "https://gitlab.com/pareto4/pp-core";
-const changelogRawUrl = "https://gitlab.com/pareto4/pp-core/-/raw/main/CHANGELOG.md";
+const repoSlug = "pareto000/pp-core";
+const repoUrl = "https://github.com/pareto000/pp-core";
+const changelogRawUrl = "https://raw.githubusercontent.com/pareto000/pp-core/main/CHANGELOG.md";
 const cacheSlug = "pareto4-pp-core";
 const updateCacheFileName = "pp-update-check-pareto4-pp-core.json";
 

package/pp-core/bin/lib/phase-command-router.cjs

@@ -6,7 +6,7 @@
  * Unsupported in this router:
  * - scaffold: routed through top-level scaffold command.
  *
- * CJS-only subcommands: mvp-mode, dispatch-plan, install-run, tier, tier-propose (dispatched directly, before hub).
+ * CJS-only subcommands: mvp-mode (dispatched directly, before hub).
  *
  * #3788: dispatch is mediated by CommandRoutingHub. The public entry point
  * and observable CLI behaviour are unchanged.
@@ -51,28 +51,6 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
         phase.cmdPhaseMvpMode(cwd, args.slice(2), raw);
         return;
     }
-    // `dispatch-plan` (pack 9): read-only; the executor spawns, suite runs and
-    // tracking commits execute-phase obeys (src/dispatch-plan.cts).
-    if (subcommand === 'dispatch-plan') {
-        phase.cmdPhaseDispatchPlan(cwd, args.slice(2), raw);
-        return;
-    }
-    // `install-run` (pack 9): heavy-tier verification of the installed product —
-    // pack, install, init, run the phase's install checks (src/install-run.cts).
-    if (subcommand === 'install-run') {
-        phase.cmdPhaseInstallRun(cwd, args.slice(2), raw);
-        return;
-    }
-    // `tier` / `tier-propose` (pack 9): the phase's ceremony tier and its
-    // proposal (src/phase-tier.cts); `tier-propose --record` writes ROADMAP.
-    if (subcommand === 'tier') {
-        phase.cmdPhaseTier(cwd, args.slice(2), raw);
-        return;
-    }
-    if (subcommand === 'tier-propose') {
-        phase.cmdPhaseTierPropose(cwd, args.slice(2), raw);
-        return;
-    }
     // ── Build the CJS registry ──────────────────────────────────────────────────
     // Each handler receives a ctx object from the hub and must return a HubResult.
     const cjsRegistry = {

package/pp-core/bin/lib/phase-scope.cjs

@@ -4,7 +4,7 @@
  * this caller use it?
  *
  * THE owner of that decision for every consumer of the raw phase locator
- *. The raw locator in phase-locator.cts answers a
+ * (PBI 75323, quick 261009-gvf). The raw locator in phase-locator.cts answers a
  * phase token from the live `phases/` tree first and then falls through to the
  * closed milestones' `milestones/<v>-phases/` archives, marking such a match
  * with the archive's version. It applies no milestone compare, and it must not:

package/pp-core/bin/lib/phase.cjs

@@ -56,10 +56,6 @@ const clock_cjs_1 = require("./clock.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- uat-predicate.cjs is an export= CommonJS module
 const uatPredicate = require("./uat-predicate.cjs");
 const { evaluateUatPassed } = uatPredicate;
-const plan_graph_cjs_1 = require("./plan-graph.cjs");
-const dispatch_plan_cjs_1 = require("./dispatch-plan.cjs");
-const phase_tier_cjs_1 = require("./phase-tier.cjs");
-const install_run_cjs_1 = require("./install-run.cjs");
 const { planningDir, withPlanningLock, milestonePathsFor } = planningWorkspace;
 const { extractFrontmatter } = frontmatterMod;
 const { readModifyWriteStateMd, stateExtractField, stateReplaceField, stateReplaceFieldWithFallback, syncStateFrontmatter, withStateLock, updatePerformanceMetricsSection, } = stateMod;
@@ -408,140 +404,6 @@ function cmdPhasePlanIndex(cwd, phase, raw) {
     if (!phase) {
         error('phase required for phase-plan-index');
     }
-    const built = buildPhasePlanIndex(cwd, phase);
-    if (built.fatal !== undefined) {
-        error(built.fatal);
-        return;
-    }
-    output(built.result, raw);
-}
-/**
- * `phase.dispatch-plan <phase> [--wave N] [--gaps-only] [--use-worktrees true|false]`:
- * the executor spawns, builds, suite runs and tracking commits for the phase's
- * incomplete plans (computed by src/dispatch-plan.cts from the plan inventory).
- */
-function cmdPhaseDispatchPlan(cwd, args, raw) {
-    const parsed = (0, dispatch_plan_cjs_1.parseDispatchPlanArgs)(args);
-    if ('error' in parsed) {
-        error(parsed.error);
-        return;
-    }
-    const built = buildPhasePlanIndex(cwd, parsed.phase);
-    if (built.fatal !== undefined) {
-        error(built.fatal);
-        return;
-    }
-    if (built.phaseDir === null) {
-        output({ phase: built.result['phase'], error: 'Phase not found' }, raw);
-        return;
-    }
-    const policy = (0, dispatch_plan_cjs_1.resolveDispatchPolicy)(cwd, parsed);
-    const plans = built.result['plans'].map((p) => {
-        const extra = built.extras.get(p['id']);
-        return {
-            id: p['id'],
-            title: p['title'] ?? null,
-            wave: p['wave'],
-            serial_group: p['serial_group'] ?? null,
-            files_modified: p['files_modified'],
-            autonomous: p['autonomous'],
-            has_summary: p['has_summary'],
-            requirements: extra?.requirements ?? [],
-            gap_closure: extra?.gapClosure ?? false,
-        };
-    });
-    const phaseDirRel = node_path_1.default.relative(cwd, built.phaseDir).split(node_path_1.default.sep).join('/');
-    const tier = (0, phase_tier_cjs_1.resolvePhaseTierForProject)(cwd, parsed.phase, parsed.tier);
-    output((0, dispatch_plan_cjs_1.computeDispatchPlan)(built.result['phase'], phaseDirRel, plans, policy, tier, { planBounceScript: tier.plan_bounce_script }), raw);
-}
-/**
- * `phase.install-run <phase> [--tarball <tgz>] [--package-dir <dir>] [--no-build]`:
- * pack, install into a temp project, init and run the phase's install checks
- * against the installed copy; writes `<NN>-INSTALL-RUN.json` (src/install-run.cts).
- */
-function cmdPhaseInstallRun(cwd, args, raw) {
-    const parsed = (0, install_run_cjs_1.parseInstallRunArgs)(args);
-    if ('error' in parsed) {
-        error(parsed.error, ERROR_REASON.USAGE);
-        return;
-    }
-    let out;
-    try {
-        out = (0, install_run_cjs_1.runInstallRun)({ cwd, phase: parsed.phase, tarball: parsed.tarball, packageDir: parsed.packageDir, build: parsed.build });
-    }
-    catch (e) {
-        error(e.message);
-        return;
-    }
-    output(out, raw);
-}
-/**
- * `phase.tier <phase> [--tier light|standard|heavy]`: the phase's resolved
- * ceremony tier — tier, source, gate set, suppressed gates (src/phase-tier.cts).
- */
-function cmdPhaseTier(cwd, args, raw) {
-    const usage = 'Usage: phase tier <phase> [--tier light|standard|heavy]';
-    const parsed = (0, phase_tier_cjs_1.parseTierFlag)(args.filter((a) => a !== '--raw'));
-    if ('error' in parsed) {
-        error(`${parsed.error}. ${usage}`, ERROR_REASON.USAGE);
-        return;
-    }
-    if (parsed.rest.length !== 1 || parsed.rest[0].startsWith('--')) {
-        error(parsed.rest.length === 0 ? `phase required for phase tier. ${usage}` : `phase tier takes one phase and --tier. ${usage}`, ERROR_REASON.USAGE);
-        return;
-    }
-    const phaseArg = parsed.rest[0];
-    output({ phase: phaseArg, ...(0, phase_tier_cjs_1.resolvePhaseTierForProject)(cwd, phaseArg, parsed.tier) }, raw);
-}
-/**
- * `phase.tier-propose <phase> [--record] [--tier X]`: propose a tier from the
- * phase's plans (`files_modified`) or, before planning, its requirement tags
- * and ROADMAP text. `--record` writes it to the phase's ROADMAP `**Tier:**`
- * field, marked `(proposed: …)`, unless the operator already chose one;
- * `--record --tier X` records X as the operator's choice.
- */
-function cmdPhaseTierPropose(cwd, args, raw) {
-    const usage = 'Usage: phase tier-propose <phase> [--record] [--tier light|standard|heavy]';
-    const parsed = (0, phase_tier_cjs_1.parseTierFlag)(args.filter((a) => a !== '--raw'));
-    if ('error' in parsed) {
-        error(`${parsed.error}. ${usage}`, ERROR_REASON.USAGE);
-        return;
-    }
-    const doRecord = parsed.rest.includes('--record');
-    const positional = parsed.rest.filter((a) => a !== '--record');
-    if (positional.length !== 1 || positional[0].startsWith('--')) {
-        error(positional.length === 0 ? `phase required for phase tier-propose. ${usage}` : `phase tier-propose does not support ${positional.find((a) => a.startsWith('--')) ?? positional.join(' ')}. ${usage}`, ERROR_REASON.USAGE);
-        return;
-    }
-    const phaseArg = positional[0];
-    const record = (0, phase_tier_cjs_1.readPhaseRecord)(cwd, phaseArg);
-    if (record.section === null) {
-        output({ phase: phaseArg, error: 'Phase not found in ROADMAP.md' }, raw);
-        return;
-    }
-    const built = buildPhasePlanIndex(cwd, phaseArg);
-    const planRows = built.fatal === undefined && built.phaseDir !== null
-        ? built.result['plans'].map((p) => ({ id: p['id'], files_modified: p['files_modified'] ?? [] }))
-        : [];
-    const reqMatch = record.section.match(/^\*\*Requirements:?\*\*[^\S\n]*:?[^\S\n]*([^\n]*)$/m);
-    const requirements = reqMatch ? reqMatch[1].replace(/[[\]]/g, '').split(',').map((s) => s.trim()).filter((s) => s !== '' && s !== 'TBD') : [];
-    const proposal = (0, phase_tier_cjs_1.proposePhaseTier)({ plans: planRows, requirements, roadmapText: record.section });
-    let recorded = null;
-    if (doRecord) {
-        recorded = parsed.tier !== null
-            ? (0, phase_tier_cjs_1.recordPhaseTier)(cwd, phaseArg, parsed.tier, { proposed: false })
-            : (0, phase_tier_cjs_1.recordPhaseTier)(cwd, phaseArg, proposal.tier, { proposed: true, reason: proposal.reason });
-    }
-    const after = (0, phase_tier_cjs_1.resolvePhaseTierForProject)(cwd, phaseArg, parsed.tier);
-    output({
-        phase: phaseArg,
-        proposal,
-        phase_record: record.tier !== null ? { tier: record.tier, proposed: record.proposed } : null,
-        recorded,
-        effective: { tier: after.tier, source: after.source, suppressed: after.suppressed },
-    }, raw);
-}
-function buildPhasePlanIndex(cwd, phase) {
     const phasesDir = node_path_1.default.join(planningDir(cwd), 'phases');
     const normalized = normalizePhaseName(phase);
     let phaseDir = null;
@@ -562,11 +424,8 @@ function buildPhasePlanIndex(cwd, phase) {
         // phases dir doesn't exist
     }
     if (!phaseDir) {
-        return {
-            result: { phase: normalized, error: 'Phase not found', plans: [], waves: {}, incomplete: [], has_checkpoints: false },
-            phaseDir: null,
-            extras: new Map(),
-        };
+        output({ phase: normalized, error: 'Phase not found', plans: [], waves: {}, incomplete: [], has_checkpoints: false }, raw);
+        return;
     }
     void phaseDirName; // used only to set phaseDir above
     const phaseFiles = node_fs_1.default.readdirSync(phaseDir);
@@ -588,13 +447,6 @@ function buildPhasePlanIndex(cwd, phase) {
         const xmlTasks = content.match(/<task[\s>]/gi) || [];
         const mdTasks = content.match(/##\s*Task\s*\d+/gi) || [];
         const taskCount = xmlTasks.length || mdTasks.length;
-        const taskTypes = xmlTasks.length > 0
-            ? [...content.matchAll(/<task(\s[^>]*)?>/gi)].map((m) => /type=["']?([\w:-]+)/i.exec(m[1] ?? '')?.[1] ?? 'auto')
-            : mdTasks.map(() => 'auto');
-        const fmString = (key) => {
-            const value = fm[key];
-            return typeof value === 'string' && value.trim() !== '' ? value.trim() : null;
-        };
         const parsedWave = parseInt(fm['wave'], 10);
         const declaredWave = Number.isNaN(parsedWave) ? null : parsedWave;
         let dependsOn = [];
@@ -617,10 +469,6 @@ function buildPhasePlanIndex(cwd, phase) {
             filesModified = Array.isArray(fmFiles) ? fmFiles.map(String) : [String(fmFiles)];
         }
         const hasSummary = completedPlanIds.has(planId) || completedPlanIds.has(extractCanonicalPlanId(planFile));
-        const fmReqs = fm['requirements'];
-        const requirements = (Array.isArray(fmReqs) ? fmReqs.map(String) : typeof fmReqs === 'string' && fmReqs.trim() !== '' ? fmReqs.split(/[\s,]+/) : [])
-            .map((r) => r.trim())
-            .filter((r) => r !== '' && r !== '[]');
         rawPlans.push({
             id: planId,
             declaredWave,
@@ -630,13 +478,6 @@ function buildPhasePlanIndex(cwd, phase) {
             filesModified,
             taskCount,
             hasSummary,
-            title: (0, plan_graph_cjs_1.readPlanTitle)(fm['title']),
-            serialGroup: fmString('serial_group'),
-            chainReason: fmString('chain_reason'),
-            taskTypes,
-            requirements,
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string -- FrontmatterValue scalar-to-string
-            gapClosure: String(fm['gap_closure'] ?? '').trim() === 'true',
         });
     }
     // ── Pass 2: topological level assignment via depends_on DAG ──────────────
@@ -645,31 +486,18 @@ function buildPhasePlanIndex(cwd, phase) {
         const lower = p.id.toLowerCase();
         const existing = seenLower.get(lower);
         if (existing !== undefined) {
-            return {
-                fatal: `depends_on index collision in phase ${normalized}: plan IDs '${existing}' and '${p.id}' are identical when case-folded. Rename one file to avoid ambiguous dependency resolution.`,
-            };
+            error(`depends_on index collision in phase ${normalized}: plan IDs '${existing}' and '${p.id}' are identical when case-folded. Rename one file to avoid ambiguous dependency resolution.`);
+            return;
         }
         seenLower.set(lower, p.id);
     }
     const planMap = new Map(rawPlans.map((p) => [p.id.toLowerCase(), p]));
     const canonicalToId = new Map(rawPlans.map((p) => [extractCanonicalPlanId(p.id).toLowerCase(), p.id]));
-    // Wave + serial-group assignment and chain metrics: single owner is plan-graph.cts.
-    const resolveDep = (dep) => {
-        const lower = String(dep).toLowerCase();
-        return planMap.has(lower) ? planMap.get(lower).id : canonicalToId.get(lower);
-    };
-    const graph = (0, plan_graph_cjs_1.computePlanGraph)(rawPlans.map((p) => ({
-        id: p.id,
-        title: p.title,
-        dependsOn: p.dependsOn.map(resolveDep).filter((d) => d !== undefined),
-        filesModified: p.filesModified,
-        serialGroup: p.serialGroup,
-        chainReason: p.chainReason,
-        taskTypes: p.taskTypes,
-    })));
-    if (graph.cycle) {
-        const cycleNodes = graph.cycle;
-        return { fatal: `depends_on cycle detected in phase ${normalized} — cycle involves: ${cycleNodes.join(', ')}` };
+    const { level, visited } = computeDependencyLevels(rawPlans, planMap, canonicalToId);
+    if (visited < rawPlans.length) {
+        const cycleNodes = rawPlans.filter((p) => !level.has(p.id)).map((p) => p.id);
+        error(`depends_on cycle detected in phase ${normalized} — cycle involves: ${cycleNodes.join(', ')}`);
+        return;
     }
     // ── Pass 3: determine lowest bucket key and build output ─────────────────
     const anyWaveZero = rawPlans.some((p) => p.declaredWave === 0);
@@ -686,16 +514,14 @@ function buildPhasePlanIndex(cwd, phase) {
         if (!rawPlan.hasSummary) {
             incomplete.push(rawPlan.id);
         }
-        const computedWave = (graph.level[rawPlan.id] ?? 0) + levelOffset;
+        const computedWave = (level.get(rawPlan.id) ?? 0) + levelOffset;
         const effectiveWave = computedWave;
         if (rawPlan.declaredWave !== null && rawPlan.declaredWave !== computedWave) {
             warnings.push(`Plan ${rawPlan.id}: declared wave: ${rawPlan.declaredWave} but depends_on DAG places it in wave ${computedWave}`);
         }
         const plan = {
             id: rawPlan.id,
-            title: rawPlan.title,
             wave: effectiveWave,
-            serial_group: graph.serialGroupOf[rawPlan.id] ?? null,
             depends_on: rawPlan.dependsOn.map((dep) => {
                 const lower = String(dep).toLowerCase();
                 return planMap.has(lower) ? planMap.get(lower).id : dep;
@@ -717,28 +543,14 @@ function buildPhasePlanIndex(cwd, phase) {
         phase: normalized,
         plans,
         waves,
-        serial_groups: Object.fromEntries(graph.serialGroups.map((g) => [g.name, { wave: g.level + levelOffset, plans: g.plans, shared_files: g.shared_files }])),
-        graph: {
-            plan_count: graph.plan_count,
-            wave_count: graph.wave_count,
-            longest_chain: graph.longest_chain,
-            chain_check: graph.chain_check,
-            implicit_edges: graph.implicitEdges,
-            merge_candidates: graph.merge_candidates,
-        },
         incomplete,
         has_checkpoints: hasCheckpoints,
     };
-    warnings.push(...graph.warnings);
     if (planNamingWarning)
         result['warning'] = planNamingWarning;
     if (warnings.length > 0)
         result['warnings'] = warnings;
-    return {
-        result,
-        phaseDir,
-        extras: new Map(rawPlans.map((p) => [p.id, { requirements: p.requirements, gapClosure: p.gapClosure }])),
-    };
+    output(result, raw);
 }
 function cmdPhaseAdd(cwd, description, raw, customId) {
     if (!description) {
@@ -1657,10 +1469,6 @@ module.exports = {
     cmdPhaseNextDecimal,
     cmdFindPhase,
     cmdPhasePlanIndex,
-    cmdPhaseDispatchPlan,
-    cmdPhaseInstallRun,
-    cmdPhaseTier,
-    cmdPhaseTierPropose,
     cmdPhaseAdd,
     cmdPhaseAddBatch,
     cmdPhaseMvpMode,

package/pp-core/bin/lib/platform-bindings.cjs

@@ -34,8 +34,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BINDINGS_COORDINATE_FIELDS = exports.MACHINE_SPECIFIC_CLONE_TARGET_PATTERNS = exports.VAULT_REPO_PATTERN_SOURCE = exports.PLATFORM_REPO_PATTERN_SOURCE = exports.CONTRACT_SCHEMA_VERSION = void 0;
+exports.BINDINGS_COORDINATE_FIELDS = exports.MACHINE_SPECIFIC_CLONE_TARGET_PATTERNS = exports.VAULT_REPO_PATTERN_SOURCE = exports.PLATFORM_REPO_PATTERN_SOURCE = exports.SLUG_RE = exports.CONTRACT_SCHEMA_VERSION = void 0;
 exports.validateBindings = validateBindings;
+exports.redactCoordinateForEmission = redactCoordinateForEmission;
+exports.redactBindingsField = redactBindingsField;
 exports.redactBindingsForEmission = redactBindingsForEmission;
 exports.cmdPlatformBindings = cmdPlatformBindings;
 exports.cmdValidateBindings = cmdValidateBindings;
@@ -65,7 +67,7 @@ const SCHEMA_VERSION_RE = /^\d+\.\d+\.\d+$/;
 exports.CONTRACT_SCHEMA_VERSION = '1.1.0';
 const PLATFORM_TAG_RE = /^v\d+\.\d+\.\d+/;
 // Provisional namespace pattern (lenient): only enforced if client.slug is present.
-const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+exports.SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 // A host-relative path of two or more slash-separated segments built from
 // word/dot/hyphen characters — e.g. `pareto4/pareto-platform-gcp` or Azure's
 // four-segment `org/project/_git/repo`. This is the pre-v1.1.0 vault-repo
@@ -77,8 +79,8 @@ const HOST_RELATIVE_SLUG_SOURCE = '^[\\w.-]+(?:\\/[\\w.-]+)+$';
  * A host-relative path of two or more segments. Compiled into
  * `platform.repo.pattern` by `scripts/gen-platform-bindings-schema.cjs` so
  * the runtime regex and the schema pattern cannot drift (D-06). Deliberately
- * accepts no URL and no SSH form: `resolveLatestTagViaGitRemote` composes the
- * host from `platform.host` itself (Phase 31 D-09), so a full URL here would
+ * accepts no URL and no SSH form: `resolveLatestPlatformTag` (compose-bindings)
+ * composes the host from `platform.host` itself (Phase 31 D-09), so a full URL here would
  * give the host two competing encodings — `platform.host` is authoritative.
  */
 exports.PLATFORM_REPO_PATTERN_SOURCE = HOST_RELATIVE_SLUG_SOURCE;
@@ -183,7 +185,7 @@ function validateBindings(o) {
     // Provisional namespaces — lenient. A missing/unknown namespace is fine; only
     // a PRESENT slug field that is malformed is flagged (it never gates on absence).
     if (isObject(o.client) && o.client.slug !== undefined) {
-        if (typeof o.client.slug !== 'string' || !SLUG_RE.test(o.client.slug)) {
+        if (typeof o.client.slug !== 'string' || !exports.SLUG_RE.test(o.client.slug)) {
             errors.push('client.slug: present but not a url-safe lowercase slug');
         }
     }
@@ -203,35 +205,53 @@ function validateBindings(o) {
     // IN-03: project.slug — symmetric lenient check matching client.slug behaviour.
     // The schema defines the same ^[a-z0-9][a-z0-9-]*$ pattern for both fields.
     if (isObject(o.project) && o.project.slug !== undefined) {
-        if (typeof o.project.slug !== 'string' || !SLUG_RE.test(o.project.slug)) {
+        if (typeof o.project.slug !== 'string' || !exports.SLUG_RE.test(o.project.slug)) {
             errors.push('project.slug: present but not a url-safe lowercase slug');
         }
     }
     return { valid: errors.length === 0, errors, warnings };
 }
 /**
- * Pack 6 D-07: the `.platform-bindings.json` fields that carry a remote repo
- * coordinate (and so the fields a credential can ride in). Hosts are not
- * listed: a host is a bare host by contract and is read for real use.
+ * VAULT-EGRESS-1 (quick 261005-8py gap closure): the `.platform-bindings.json`
+ * fields that carry a remote repo coordinate, and therefore the fields a
+ * credential (`https://user:TOKEN@host/…`, `user:TOKEN@host:path`) can ride in.
+ * Hosts are deliberately NOT listed: `platform.host` is read for real use by
+ * /pp-init's provisioning step (`--pick platform.host`), and a host is a bare
+ * host by contract.
  */
 exports.BINDINGS_COORDINATE_FIELDS = Object.freeze(['platform.repo', 'client.vaultRepo']);
 /**
- * Emission-only: a copy of a bindings-shaped object with every coordinate field
- * routed through the one owner (`redactCloneTarget`, src/vault.cts — lazily
- * required so this module's load graph is unchanged). Never use the result for
- * a write, a comparison, or a clone.
+ * Emission-only: the display-safe form of one coordinate, through the ONE
+ * owner (`redactCloneTarget` in `src/vault.cts`) — never a second redactor.
+ * Lazily required, the idiom `src/vault-command-router.cts` uses, so this
+ * module's load graph is unchanged. Never call this on a value that is written
+ * to disk or handed to git: those keep the RAW coordinate.
+ */
+function redactCoordinateForEmission(value) {
+    if (typeof value !== 'string' || value === '')
+        return value;
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { redactCloneTarget } = require('./vault.cjs');
+    return redactCloneTarget(value) ?? value;
+}
+/** Emission-only: `value` redacted when `field` (dotted) is a coordinate field. */
+function redactBindingsField(field, value) {
+    return exports.BINDINGS_COORDINATE_FIELDS.includes(field) ? redactCoordinateForEmission(value) : value;
+}
+/**
+ * Emission-only: a copy of a bindings-shaped object with every coordinate
+ * field routed through the owner. The input is never mutated — callers that
+ * compare (drift, `action`) or write keep the raw object.
  */
 function redactBindingsForEmission(obj) {
     if (!isObject(obj))
         return obj;
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { redactCloneTarget } = require('./vault.cjs');
     const copy = JSON.parse(JSON.stringify(obj));
     for (const field of exports.BINDINGS_COORDINATE_FIELDS) {
         const [ns, key] = field.split('.');
         const parent = copy[ns];
         if (isObject(parent) && typeof parent[key] === 'string') {
-            parent[key] = redactCloneTarget(parent[key]);
+            parent[key] = redactCoordinateForEmission(parent[key]);
         }
     }
     return copy;
@@ -281,9 +301,10 @@ function cmdPlatformBindings(cwd, args, raw) {
         output(validateBindings(parsed), raw);
         return;
     }
-    // present + valid → echo the bindings under a present flag.
-    // Pack 6 D-07: the remote coordinate fields are emitted display-safe; every
-    // other field is verbatim. The file on disk keeps the raw value.
+    // present + valid → echo the bindings under a present flag. The coordinate
+    // fields are display-safe (VAULT-EGRESS-1); every other field is verbatim,
+    // and the one consumer of the whole dump (vault-load-gate.md) reads only
+    // `client.vaultRepo`'s presence and the raw `client.vaultRef`.
     output(Object.assign({ present: true }, redactBindingsForEmission(parsed)), raw);
 }
 // Anchored regex for `?ref=` values in module source lines (T-07-04: untrusted text,

package/pp-core/bin/lib/practices-review-check.cjs

@@ -46,9 +46,9 @@
  *
  * Every function here treats its input as UNTRUSTED TEXT. The review file
  * this module parses is authored partly by an untrusted client vault
- * (`REFERENCE_DATA_PREAMBLE`, `FENCE_START_MARKER`/`FENCE_END_MARKER` and
- * heading-shaped lines can all legitimately appear inside client body
- * content) and partly by an LLM reviewer whose output is not guaranteed
+ * (`REFERENCE_DATA_PREAMBLE`, `FENCE_START_MARKER`/`FENCE_END_MARKER` — read
+ * from the vault-index leaf, their one owner — and heading-shaped lines can
+ * all legitimately appear inside client body content) and partly by an LLM reviewer whose output is not guaranteed
  * well-formed. The module performs zero I/O: no environment-variable read, no
  * stdout write, no early process termination, no filesystem access, no
  * dynamic `require`, no `eval`. It is pure text in, structure out — the CLI arm
@@ -163,15 +163,19 @@
  *
  * ## Reuses (no new runtime dependency)
  *
- * None. This module needs no imports at all — it is pure string processing
- * over already-materialized text, mirroring `src/vault-practices.cts`'s
- * `defangFenceMarkers`/`boundedFencedExcerpt` marker literals and the
- * zero-width-space defanged form, but reimplementing no logic from that file.
+ * One import, and no runtime dependency: the dependency-free vault-index leaf
+ * (`src/vault-index.cts`), the single owner of the external-content marker
+ * literals (D-17/D-26, 14-04). Everything else is pure string processing over
+ * already-materialized text, recognising the markers and the zero-width-space
+ * defanged form `defangFenceMarkers` produces, but reimplementing no logic
+ * from `src/vault-practices.cts`.
  *
  * ADR-457 build-at-publish: this TypeScript file is the SOURCE OF TRUTH. It
  * compiles to the git-ignored `pp-core/bin/lib/practices-review-check.cjs`;
  * do NOT hand-edit the compiled output.
  */
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const vaultIndexLeaf = require("./vault-index.cjs");
 // ─── Literals ────────────────────────────────────────────────────────────────
 //
 // Copied character-for-character from pp-core/workflows/code-review.md's
@@ -182,8 +186,10 @@ const SECTION_HEADING = '## Practices Findings (client vault)';
 const FINDING_HEADING = '### PR-';
 const ASKS_LABEL = '**Asks:**';
 const FILE_LABEL = '**File:**';
-const FENCE_START_MARKER = '<!-- vault:external-content-start -->';
-const FENCE_END_MARKER = '<!-- vault:external-content-end -->';
+// D-17/D-26 (14-04): the marker values come from the vault-index leaf, their
+// one owner; the local names stay so every call site below reads unchanged.
+const FENCE_START_MARKER = vaultIndexLeaf.EXTERNAL_CONTENT_FENCE_START;
+const FENCE_END_MARKER = vaultIndexLeaf.EXTERNAL_CONTENT_FENCE_END;
 // The fixed reference-data disclaimer sentences `boundedFencedExcerpt`
 // (src/vault-practices.cts) prepends to EVERY excerpt. `clientBodyOf` strips
 // these before an excerpt enters the unfenced-quote comparison corpus, so a

package/pp-core/bin/lib/profile-output.cjs

@@ -28,7 +28,7 @@ const { loadConfig } = configLoader;
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
-// The start-command fallback uses the pp-named alias (same function).
+// PBI 75232: the start-command fallback uses the pp-named alias (same function).
 const runtime_slash_cjs_2 = require("./runtime-slash.cjs");
 const runtime_name_policy_cjs_1 = require("./runtime-name-policy.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- planning-workspace.cjs is an export= CommonJS module