@pareto4/pp-core 1.12.1 → 1.17.1

package/pp-core/bin/lib/clusters.cjs

@@ -44,6 +44,10 @@ exports.CLUSTERS = Object.freeze({
         'eval-review',
         'add-tests',
         'secure-phase',
+        // Retroactive, non-gating review of a completed phase against the client
+        // vault's practices (Vault Assurance #71924, 06-07) — the same family as
+        // secure-phase / ui-review / validate-phase.
+        'vault-review',
     ]),
     milestone: Object.freeze([
         'new-milestone',

package/pp-core/bin/lib/command-aliases.cjs

@@ -698,20 +698,6 @@ exports.NON_FAMILY_COMMAND_ALIASES = [
         ],
         "mutation": true
     },
-    {
-        "canonical": "phase.dispatch-plan",
-        "aliases": [
-            "phase dispatch-plan"
-        ],
-        "mutation": false
-    },
-    {
-        "canonical": "phase.install-run",
-        "aliases": [
-            "phase install-run"
-        ],
-        "mutation": true
-    },
     {
         "canonical": "phase.mvp-mode",
         "aliases": [
@@ -719,20 +705,6 @@ exports.NON_FAMILY_COMMAND_ALIASES = [
         ],
         "mutation": false
     },
-    {
-        "canonical": "phase.tier",
-        "aliases": [
-            "phase tier"
-        ],
-        "mutation": false
-    },
-    {
-        "canonical": "phase.tier-propose",
-        "aliases": [
-            "phase tier-propose"
-        ],
-        "mutation": true
-    },
     {
         "canonical": "progress.bar",
         "aliases": [

package/pp-core/bin/lib/commands.cjs

@@ -47,6 +47,10 @@ const { extractFrontmatter } = frontmatter;
 const modelProfiles = require("./model-profiles.cjs");
 const { MODEL_PROFILES, VALID_PHASE_TYPES } = modelProfiles;
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
+// 16-03: the one `.planning/` path test. The seal leaf's top level imports only
+// Node built-ins and it never requires this module, so the edge adds no cycle.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const vaultSeal = require("./vault-seal.cjs");
 // ─── Phase Status ─────────────────────────────────────────────────────────────
 /**
  * Determine phase status by checking plan/summary counts AND verification state.
@@ -458,7 +462,7 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify) {
             const phaseMatch = (files || []).join(' ').match(/(\d+(?:\.\d+)*)-/);
             if (phaseMatch) {
                 const phaseNum = phaseMatch[1];
-                // D-03: a prior milestone's archived phase whose number the current
+                // PBI 75323 D-03: a prior milestone's archived phase whose number the current
                 // ROADMAP reuses names no branch (the phase-scope owner drops it).
                 const phaseInfo = resolvePhaseForRead(cwd, phaseNum);
                 if (phaseInfo) {
@@ -907,7 +911,7 @@ function cmdTodoMatchPhase(cwd, phase, raw) {
     const phaseKeywords = new Set(phaseText.split(/[\s\-_/.,;:()\[\]{}|]+/)
         .map(w => w.replace(/[^a-z0-9]/g, ''))
         .filter(w => w.length > 2 && !stopWords.has(w)));
-    // Find phase directory to get expected file paths (D-03: through the
+    // Find phase directory to get expected file paths (PBI 75323 D-03: through the
     // phase-scope owner, so a prior milestone's archive never lends this phase its plans)
     const phaseInfoDisk = resolvePhaseForRead(cwd, phase);
     const phasePlans = [];
@@ -993,7 +997,7 @@ function cmdScaffold(cwd, type, options, raw) {
     const { phase, name } = options;
     const padded = phase ? normalizePhaseName(phase) : '00';
     const today = new Date().toISOString().split('T')[0];
-    // Find phase directory. D-02 (todo "template-fill-writes-
+    // Find phase directory. PBI 75323 / quick 261009-gvf D-02 (todo "template-fill-writes-
     // into-an-archived-phase-directory"): context / uat / verification never write into a
     // closed milestone's archive. The phase-scope owner hands back a live match only; an
     // archive this phase still names is refused naming it, and a prior milestone's archive
@@ -1223,7 +1227,8 @@ function cmdCheckCommit(cwd, raw) {
     // commit_docs is false — check if any .planning/ files are staged
     const stagedResult = (0, shell_command_projection_cjs_1.execGit)(['diff', '--cached', '--name-only'], { cwd });
     if (stagedResult.exitCode === 0) {
-        const planningFiles = stagedResult.stdout.split('\n').filter(f => f.startsWith('.planning/') || f.startsWith('.planning\\'));
+        // 16-03: the seal leaf owns the `.planning/` path test (both separators).
+        const planningFiles = stagedResult.stdout.split('\n').filter((f) => vaultSeal.isPlanningPath(f));
         if (planningFiles.length > 0) {
             error(`commit_docs is false but ${planningFiles.length} .planning/ file(s) are staged:\n` +
                 planningFiles.map(f => `  ${f}`).join('\n') +

package/pp-core/bin/lib/compose-bindings.cjs

@@ -31,8 +31,9 @@
  * `JSON.stringify`/object literals — never by `.md` shell string
  * concatenation.
  *
- * This module sits at the top of the CommonJS graph — nothing imports it —
- * so its top-level imports of `./org-profile.cjs`, `./platform-bindings.cjs`,
+ * Its importers today are `src/vault-update.cts`, `src/init-contract.cts`,
+ * `src/vault-practices.cts` and (quick 261003-lqi) `src/check-command-router.cts`
+ * — and this module imports none of them, so its top-level imports of `./org-profile.cjs`, `./platform-bindings.cjs`,
  * `./git-provider.cjs`, `./vault-coordinates.cjs`, `./io.cjs`,
  * `./project-root.cjs`, `./package-identity.cjs` and
  * `./shell-command-projection.cjs` create no require cycle: none of those
@@ -47,13 +48,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMPOSE_BINDINGS_FLAGS = exports.SEED_VALUE_MAX_LENGTH = void 0;
 exports._resetPlatformTagMemoForTests = _resetPlatformTagMemoForTests;
+exports.listStableTagsAt = listStableTagsAt;
+exports.pickLatestStableTag = pickLatestStableTag;
+exports.resolveLatestVaultTag = resolveLatestVaultTag;
+exports.resolvePlatformRepoUrl = resolvePlatformRepoUrl;
+exports.resolveLatestPlatformTag = resolveLatestPlatformTag;
 exports.resolveCreatedWithFrom = resolveCreatedWithFrom;
 exports.composeBindings = composeBindings;
 exports.redactComposeResultForEmission = redactComposeResultForEmission;
 exports.cmdComposeBindings = cmdComposeBindings;
+exports.cmdPlatformLatestTag = cmdPlatformLatestTag;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const node_child_process_1 = __importDefault(require("node:child_process"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
 const { output } = io;
@@ -354,17 +360,112 @@ const platformTagMemo = new Map();
  * `src/active-workstream-store.cts`'s controlling-TTY probe cache. */
 function _resetPlatformTagMemoForTests() {
     platformTagMemo.clear();
+    vaultTagMemo.clear();
+}
+/** Per-process memo for `resolveLatestVaultTag`, keyed by clone target. */
+const vaultTagMemo = new Map();
+/**
+ * List the stable `vX.Y.Z` tags at `url`, never shell-eval'd (T-34-25):
+ * `git ls-remote` is spawned with an argv array through `execGitLocal`, the
+ * owner of a vault git invocation's environment (D-116, D-117): the URL names
+ * the remote, but git still reads the config of the repository an inherited
+ * location variable selects, so the location is unset and transport is kept.
+ * Bounded by a 10 s `timeout`, `windowsHide` and spawnSync's default buffer
+ * (T-34-26), with the child's stderr piped and discarded — the owner prints
+ * nothing (`init-tag-lookup-raw-git-error`). `--` separates the target from
+ * the options so a flag-shaped value can never be read as one (T-29-26).
+ * Filtered with `isStableTripletSemver`, the single blessed predicate. THROWS
+ * on any git fault (a non-zero exit, which the owner also reports for a
+ * timeout or a missing git) — callers own the degrade-to-warning policy.
+ */
+function listStableTagsAt(url, opts = {}) {
+    const lsOutput = (() => {
+        if (typeof opts._lsRemote === 'function')
+            return opts._lsRemote(url);
+        const result = (0, shell_command_projection_cjs_1.execGitLocal)(['ls-remote', '--tags', '--refs', '--sort=-v:refname', '--', url, 'v*'], { timeout: 10_000 });
+        if (result.exitCode !== 0 || result.error)
+            throw new Error(`git ls-remote exited ${result.exitCode}`);
+        return result.stdout;
+    })();
+    return lsOutput
+        .split('\n')
+        .map((line) => {
+        const m = line.match(/\brefs\/tags\/([^\s^]+)$/);
+        return m ? m[1].trim() : '';
+    })
+        .filter((t) => t && (0, semver_compare_cjs_1.isStableTripletSemver)(t));
+}
+/** The highest tag by `compareSemverCore`, or `null` for an empty list. */
+function pickLatestStableTag(tags) {
+    if (tags.length === 0)
+        return null;
+    let latest = tags[0];
+    for (const t of tags) {
+        if ((0, semver_compare_cjs_1.compareSemverCore)(t, latest) > 0)
+            latest = t;
+    }
+    return latest;
+}
+/**
+ * FORK-ONLY (PBI 74316). Propose the vault version a NEW project builds on:
+ * the latest stable tag of the client vault repo. The embedded org profile
+ * seeds no vault ref on purpose — the version is a per-project choice,
+ * committed in `.platform-bindings.json`, so no pp-core release can move it.
+ * The proposal reaches the operator through the provenance table
+ * (`resolved-tag`) they confirm before anything is written.
+ *
+ * The clone target is composed by `composeCloneTarget`, so the scp-style SSH
+ * form passes through verbatim. Tagless, offline and unreachable all degrade
+ * to `{ tag: null }` plus one bounded warning naming the consequence: with no
+ * `client.vaultRef` the vault resolves `main`, i.e. the project is unpinned.
+ */
+function resolveLatestVaultTag(repo, host, provider, opts = {}) {
+    const unpinned = (why) => ({
+        tag: null,
+        warnings: [
+            bound(`client.vaultRef could not be proposed — ${why}; the vault resolves "main" until the project is pinned with "pp-tools vault update <tag>".`),
+        ],
+    });
+    const target = (0, git_provider_cjs_1.composeCloneTarget)(provider, repo, host);
+    const cached = vaultTagMemo.get(target.url);
+    if (cached)
+        return cached;
+    let result;
+    try {
+        const tag = pickLatestStableTag(listStableTagsAt(target.url, opts));
+        result = tag ? { tag, warnings: [] } : unpinned('the vault repo has no stable v* tag');
+    }
+    catch {
+        result = unpinned('the tag lookup failed or was unreachable');
+    }
+    vaultTagMemo.set(target.url, result);
+    return result;
+}
+/**
+ * The platform repo URL rule — the ONE place the platform URL string is
+ * composed (quick 261003-my0). The host is `resolvePlatformHost(cwd).host`
+ * when it resolves, else `defaultHostForProvider(provider)`; it is never
+ * derived from the repo string (Phase 31 D-09). `resolveLatestPlatformTag`
+ * and, through it, `pp-tools init`, `check ship.platform-drift` and
+ * `query platform-latest-tag` all read this rule, so a shell copy cannot
+ * drift from it. May throw when `resolvePlatformHost` throws; the owner's
+ * try/catch is the degrade policy.
+ */
+function resolvePlatformRepoUrl(cwd, repo, provider) {
+    const host = (0, vault_coordinates_cjs_1.resolvePlatformHost)(cwd).host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider);
+    return `https://${host}/${repo}`;
 }
 /**
  * Resolve the latest STABLE tag for `repo` over the resolved host, never
- * shell-eval'd (T-34-25): `git ls-remote` is spawned with an argv array via
- * `childProcess.execFileSync`, bounded by `timeout`/`maxBuffer`/`windowsHide`
- * (T-34-26). The host is `resolvePlatformHost(cwd).host` when it resolves,
- * else `defaultHostForProvider(provider)` — the host is authoritative and
- * never derived from the repo string (Phase 31 D-09).
+ * shell-eval'd (T-34-25): `git ls-remote` is spawned with an argv array
+ * through `execGitLocal` (D-116, D-117), bounded by `timeout`/`windowsHide`
+ * (T-34-26). The URL comes from `resolvePlatformRepoUrl`: the host is
+ * `resolvePlatformHost(cwd).host` when it resolves, else
+ * `defaultHostForProvider(provider)` — the host is authoritative and never
+ * derived from the repo string (Phase 31 D-09).
  *
  * The child's stderr is piped into the parent's buffer rather than inherited
- * — an explicit `stdio: ['ignore', 'pipe', 'pipe']` — and deliberately
+ * — the owner spawns with `stdio: 'pipe'` — and deliberately
  * discarded rather than logged: the bounded warning this function returns on
  * failure is the single user-visible surface for a lookup failure. Inheriting
  * the child's stream let a raw git `fatal:` line reach the terminal during an
@@ -372,22 +473,29 @@ function _resetPlatformTagMemoForTests() {
  *
  * Every candidate ref is filtered with `isStableTripletSemver` and ordered
  * with `compareSemverCore` — the single blessed comparison source, never
- * reimplemented. An empty result degrades to `{ tag: null, warnings: [] }`
- * (tagless is valid, D-01/D-02); any thrown fault (offline, unreachable,
- * DNS failure, non-zero git exit) degrades to `{ tag: null, warnings: [one
+ * reimplemented. An empty result degrades to `{ tag: null, outcome:
+ * 'tagless', warnings: [] }` (tagless is valid, D-01/D-02); any thrown fault
+ * (offline, unreachable, DNS failure, non-zero git exit, an unresolvable
+ * host) degrades to `{ tag: null, outcome: 'unreachable', warnings: [one
  * bounded warning] }` — offline, unreachable and tagless all resolve to the
- * platform being unpinned, never a compose failure.
+ * platform being unpinned, never a compose failure, and `outcome` says which
+ * one was measured (quick 261003-my0).
+ *
+ * Quick 261003-lqi: the ship-time drift check (`cmdShipPlatformDrift`) calls
+ * this same owner, so init and ship resolve one URL from one host rule.
+ * Quick 261003-my0: the init.md / new-project.md preflights reach it through
+ * `query platform-latest-tag` (`cmdPlatformLatestTag`).
  */
 function resolveLatestPlatformTag(cwd, repo, provider, opts) {
     let url;
     try {
-        const hostRes = (0, vault_coordinates_cjs_1.resolvePlatformHost)(cwd);
-        const host = hostRes.host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider);
-        url = `https://${host}/${repo}`;
+        url = resolvePlatformRepoUrl(cwd, repo, provider);
     }
     catch {
         return {
             tag: null,
+            url: null,
+            outcome: 'unreachable',
             warnings: [
                 bound('platform.tag could not be resolved — the tag lookup failed or was unreachable; the platform is unpinned.'),
             ],
@@ -398,37 +506,14 @@ function resolveLatestPlatformTag(cwd, repo, provider, opts) {
         return cached;
     let result;
     try {
-        const lsOutput = typeof opts._lsRemote === 'function'
-            ? opts._lsRemote(url)
-            : node_child_process_1.default.execFileSync('git', ['ls-remote', '--tags', '--refs', '--sort=-v:refname', url, 'v*'], {
-                encoding: 'utf-8',
-                timeout: 10_000,
-                maxBuffer: 512 * 1024,
-                windowsHide: true,
-                stdio: ['ignore', 'pipe', 'pipe'],
-            });
-        const tags = lsOutput
-            .split('\n')
-            .map((line) => {
-            const m = line.match(/\brefs\/tags\/([^\s^]+)$/);
-            return m ? m[1].trim() : '';
-        })
-            .filter((t) => t && (0, semver_compare_cjs_1.isStableTripletSemver)(t));
-        if (tags.length === 0) {
-            result = { tag: null, warnings: [] };
-        }
-        else {
-            let latest = tags[0];
-            for (const t of tags) {
-                if ((0, semver_compare_cjs_1.compareSemverCore)(t, latest) > 0)
-                    latest = t;
-            }
-            result = { tag: latest, warnings: [] };
-        }
+        const tag = pickLatestStableTag(listStableTagsAt(url, opts));
+        result = tag ? { tag, url, outcome: 'resolved', warnings: [] } : { tag: null, url, outcome: 'tagless', warnings: [] };
     }
     catch {
         result = {
             tag: null,
+            url,
+            outcome: 'unreachable',
             warnings: [
                 bound('platform.tag could not be resolved — the tag lookup failed or was unreachable; the platform is unpinned.'),
             ],
@@ -533,6 +618,25 @@ function composeCandidate(cwd, seed, provider, opts) {
     setField('client.vaultRepo', seed.clientVaultRepo, 'profile-seed');
     setField('client.vaultRef', seed.clientVaultRef, 'profile-seed');
     setField('client.vaultHost', seed.clientVaultHost, 'profile-seed');
+    // client.vaultRef (resolved-tag) — FORK-ONLY (PBI 74316). When the seed
+    // names a vault repo but no ref, propose the repo's latest stable tag.
+    if (isUsableString(seed.clientVaultRepo) && !isUsableString(seed.clientVaultRef)) {
+        if (opts.offline === true) {
+            pushDeduped(warnings, [
+                bound('client.vaultRef was not proposed (offline) — the vault resolves "main" until the project is pinned with "pp-tools vault update <tag>".'),
+            ]);
+        }
+        else {
+            const vaultHost = isUsableString(seed.clientVaultHost)
+                ? seed.clientVaultHost
+                : (hostRes.host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider));
+            const vaultTag = resolveLatestVaultTag(seed.clientVaultRepo, vaultHost, provider, opts);
+            pushDeduped(warnings, vaultTag.warnings);
+            if (vaultTag.tag) {
+                setField('client.vaultRef', vaultTag.tag, 'resolved-tag');
+            }
+        }
+    }
     // project.name / project.slug (project-answer)
     setField('project.name', cfgGet(cwd, 'project.name', undefined), 'project-answer');
     setField('project.slug', cfgGet(cwd, 'project.slug', undefined), 'project-answer');
@@ -796,6 +900,41 @@ function composeBindings(cwd, opts = {}) {
         };
     }
 }
+// ─── Emission projection (VAULT-EGRESS-1) ─────────────────────────────────────
+/** The seed short names whose bindings field is a coordinate — DERIVED from
+ * `SEED_KEY_SHORT_NAMES` and the coordinate field list, never retyped. */
+const SEED_COORDINATE_SHORT_NAMES = Object.freeze(Object.entries(SEED_KEY_SHORT_NAMES)
+    .filter(([seedKey]) => platform_bindings_cjs_1.BINDINGS_COORDINATE_FIELDS.includes(seedKey.slice(org_profile_cjs_1.ORG_PROFILE_SEED_SECTION.length + 1)))
+    .map(([, short]) => short));
+/**
+ * VAULT-EGRESS-1 (quick 261005-8py gap closure): the display-safe copy of a
+ * compose result, for EMISSION only. Every place a coordinate field can carry
+ * a value — `composed`, `seed`, each `provenance[].value` and each
+ * `drift[].profileValue/effectiveValue` — goes through the one owner. The
+ * comparisons that decided `drift` and `action` already ran on the RAW values
+ * inside `composeBindings`, and `composeBindings(..., { write: true })` writes
+ * the RAW composed object; neither path ever sees this projection.
+ */
+function redactComposeResultForEmission(result) {
+    const seed = result.seed === undefined ? undefined : { ...result.seed };
+    if (seed !== undefined) {
+        for (const short of SEED_COORDINATE_SHORT_NAMES) {
+            if (typeof seed[short] === 'string')
+                seed[short] = (0, platform_bindings_cjs_1.redactCoordinateForEmission)(seed[short]);
+        }
+    }
+    return {
+        ...result,
+        ...(seed === undefined ? {} : { seed }),
+        composed: result.composed === null ? null : (0, platform_bindings_cjs_1.redactBindingsForEmission)(result.composed),
+        provenance: result.provenance.map((e) => ({ ...e, value: (0, platform_bindings_cjs_1.redactBindingsField)(e.field, e.value) })),
+        drift: result.drift.map((d) => ({
+            ...d,
+            profileValue: (0, platform_bindings_cjs_1.redactBindingsField)(d.key, d.profileValue),
+            effectiveValue: (0, platform_bindings_cjs_1.redactBindingsField)(d.key, d.effectiveValue),
+        })),
+    };
+}
 // ─── cmdComposeBindings ───────────────────────────────────────────────────────
 /**
  * CLI adapter for `pp-tools query compose-bindings`. Resolves the project
@@ -803,39 +942,6 @@ function composeBindings(cwd, opts = {}) {
  * does, then calls `composeBindings` and emits the result as data — a
  * verdict is never a process error.
  */
-/**
- * Pack 6 D-07: the display-safe copy of a compose result, for EMISSION only.
- * Every remote coordinate field (`platform.repo`, `client.vaultRepo`) in
- * `composed`, `seed`, `provenance` and `drift` goes through the one owner
- * (`redactCloneTarget`, src/vault.cts); warnings go through the prose
- * redactor. `composeBindings` itself, its drift/action comparison and every
- * write keep the RAW values — never write or compare the result of this.
- */
-function redactComposeResultForEmission(result) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const v = require('./vault.cjs');
-    const COORD = new Set(['platform.repo', 'client.vaultRepo']);
-    const safe = (x) => (typeof x === 'string' ? v.redactCloneTarget(x) : x);
-    const out = JSON.parse(JSON.stringify(result));
-    if (out.composed && typeof out.composed === 'object') {
-        for (const field of COORD) {
-            const [ns, key] = field.split('.');
-            const parent = out.composed[ns];
-            if (parent && typeof parent === 'object' && typeof parent[key] === 'string')
-                parent[key] = safe(parent[key]);
-        }
-    }
-    if (out.seed) {
-        if (typeof out.seed.platformRepo === 'string')
-            out.seed.platformRepo = safe(out.seed.platformRepo);
-        if (typeof out.seed.clientVaultRepo === 'string')
-            out.seed.clientVaultRepo = safe(out.seed.clientVaultRepo);
-    }
-    out.provenance = (out.provenance ?? []).map((p) => (COORD.has(p.field) ? { ...p, value: safe(p.value) } : p));
-    out.drift = (out.drift ?? []).map((d) => COORD.has(d.key) ? { ...d, profileValue: safe(d.profileValue), effectiveValue: safe(d.effectiveValue) } : d);
-    out.warnings = (out.warnings ?? []).map((w) => (typeof w === 'string' ? v.redactRemoteText(w) : w));
-    return out;
-}
 function cmdComposeBindings(cwd, options, raw) {
     let root;
     try {
@@ -847,3 +953,74 @@ function cmdComposeBindings(cwd, options, raw) {
     const result = composeBindings(root, { write: options.write === true, offline: options.offline === true });
     output(redactComposeResultForEmission(result), raw);
 }
+// ─── cmdPlatformLatestTag ─────────────────────────────────────────────────────
+/**
+ * CLI adapter for `pp-tools query platform-latest-tag` (quick 261003-my0).
+ * Its whole job is to run the owner — `resolveLatestPlatformTag`, the same
+ * lookup `pp-tools init` and `check ship.platform-drift` use — and print
+ * `{ present, pinned, repo, provider, url, latest, outcome }`, so a shell
+ * preflight (init.md / new-project.md Step 0) reads `--pick latest` instead
+ * of composing a URL of its own.
+ *
+ * Absent bindings → `{ present: false }` with NO network call (the parity
+ * `--help` smoke runs from a repo root that has no bindings file). Malformed
+ * bindings → `outcome: 'malformed'` and no lookup — inert data, never
+ * `error()`, the same posture as the drift check's malformed arm. No
+ * `platform.repo` → `outcome: 'no-repo'`. `args` is accepted for the
+ * dispatcher's uniform shape; no flags are read (`--pick`/`--raw`/`--cwd`
+ * are stripped before dispatch, and `--pick` prints `''` for a null field —
+ * the shell contract). The owner's warnings are init-time prose and are not
+ * forwarded.
+ */
+function cmdPlatformLatestTag(cwd, args, raw) {
+    void args;
+    let root;
+    try {
+        root = (0, project_root_cjs_1.findProjectRoot)(cwd) || cwd;
+    }
+    catch {
+        root = cwd;
+    }
+    const bindingsPath = node_path_1.default.join(root, '.platform-bindings.json');
+    if (!node_fs_1.default.existsSync(bindingsPath)) {
+        output({ present: false }, raw);
+        return;
+    }
+    let provider;
+    try {
+        provider = (0, git_provider_cjs_1.resolveProvider)(root).provider;
+    }
+    catch {
+        provider = git_provider_cjs_1.DEFAULT_PROVIDER;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(node_fs_1.default.readFileSync(bindingsPath, 'utf-8'));
+    }
+    catch {
+        parsed = null;
+    }
+    if (!isObject(parsed)) {
+        output({ present: true, pinned: null, repo: null, provider, url: null, latest: null, outcome: 'malformed' }, raw);
+        return;
+    }
+    const platform = isObject(parsed.platform) ? parsed.platform : null;
+    const trimmedOrNull = (v) => typeof v === 'string' && v.trim() !== '' ? v.trim() : null;
+    const pinned = trimmedOrNull(platform?.tag);
+    const repo = trimmedOrNull(platform?.repo);
+    if (repo === null) {
+        output({ present: true, pinned, repo: null, provider, url: null, latest: null, outcome: 'no-repo' }, raw);
+        return;
+    }
+    const result = resolveLatestPlatformTag(root, repo, provider, {});
+    // VAULT-EGRESS-1: `repo` and `url` are display-safe; the lookup above used the raw repo.
+    output({
+        present: true,
+        pinned,
+        repo: (0, platform_bindings_cjs_1.redactCoordinateForEmission)(repo),
+        provider,
+        url: (0, platform_bindings_cjs_1.redactCoordinateForEmission)(result.url),
+        latest: result.tag,
+        outcome: result.outcome,
+    }, raw);
+}

package/pp-core/bin/lib/config-loader.cjs

@@ -43,9 +43,6 @@ const model_catalog_cjs_1 = require("./model-catalog.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const federatedConfigModule = require("./federated-config.cjs");
 const { mergeFederatedConfig } = federatedConfigModule;
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const capabilityActivationModule = require("./capability-activation.cjs");
-const { activationConfigFilesFor } = capabilityActivationModule;
 // The capability-registry.cjs is generated and lives in the same gsd-core/bin/lib/ output dir.
 // Both config-loader.cjs and capability-registry.cjs land in gsd-core/bin/lib/ at build time.
 // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
@@ -373,16 +370,16 @@ function _readsGlobalDefaults(cwd, ws) {
 }
 /**
  * Every config file `loadConfig(cwd, options)` reads, as absolute paths in read
- * order. ONE owner of "which config files does the loader read": `loadConfig`
- * takes its paths from the same `_configPathsFor`, so a reader that must refuse
- * an unreadable config (`unreadableConfigFiles` below) parses exactly these
- * files without restating the workstream ladder.
+ * order (16-04, D-28). ONE owner of "which config files does the gate read":
+ * `loadConfig` takes its paths from the same `_configPathsFor`, so a reader that
+ * must refuse an unreadable config (`vaultAdmissionVerdict` in src/vault.cts)
+ * can parse exactly these files without restating the workstream ladder.
  *
  * Why a caller needs it: `loadConfig` swallows a parse failure in every one of
  * these files (root → "workstream config stands alone", active → the defaults),
- * so its RESULT cannot say whether it read the project's config or read
- * nothing. Files that do not exist are still listed; absence is not a failure
- * for `loadConfig`, and the caller decides what it means.
+ * so its RESULT cannot say whether the gate read the project's config or read
+ * nothing (research C-4). Files that do not exist are still listed; absence is
+ * not a failure for `loadConfig`, and the caller decides what it means.
  */
 function configFilesFor(cwd, options = {}) {
     const ws = _activeWorkstreamFor(options);
@@ -395,97 +392,6 @@ function configFilesFor(cwd, options = {}) {
         files.push(_globalDefaultsPath());
     return files;
 }
-/** The error text is bounded; composed text never reaches the cap, but it holds anyway. */
-const UNREADABLE_ERROR_CAP = 200;
-/**
- * Describe why a config file could not be used WITHOUT echoing it. V8's
- * `JSON.parse` messages sometimes quote the input (`Unexpected token '}',
- * "{"a":tru}" is not valid JSON`), so only the position is carried over.
- */
-function _describeConfigReadFailure(err) {
-    const e = err;
-    if (e && typeof e.code === 'string' && /^[A-Z][A-Z0-9_]*$/.test(e.code))
-        return `cannot be read (${e.code})`;
-    const message = e && typeof e.message === 'string' ? e.message : '';
-    const lineCol = /\(line (\d+) column (\d+)\)/.exec(message);
-    if (lineCol)
-        return `not valid JSON (line ${lineCol[1]}, column ${lineCol[2]})`;
-    const position = /at position (\d+)/.exec(message);
-    if (position)
-        return `not valid JSON (at position ${position[1]})`;
-    if (/Unexpected end of JSON input/.test(message))
-        return 'not valid JSON (the text ends before the JSON does)';
-    return 'not valid JSON';
-}
-/** How a refusal names a config file: never an absolute user path. */
-function _configDisplayPath(cwd, abs) {
-    const under = (base) => {
-        const rel = node_path_1.default.relative(base, abs);
-        return rel !== '' && !rel.startsWith('..') && !node_path_1.default.isAbsolute(rel) ? rel.split(node_path_1.default.sep).join('/') : null;
-    };
-    const inProject = under(cwd);
-    if (inProject !== null)
-        return inProject;
-    const homeOverride = process.env['GSD_HOME'];
-    const inHomeOverride = homeOverride ? under(homeOverride) : null;
-    if (inHomeOverride !== null)
-        return `$GSD_HOME/${inHomeOverride}`;
-    const inHome = under(node_os_1.default.homedir());
-    if (inHome !== null)
-        return `~/${inHome}`;
-    return node_path_1.default.basename(abs);
-}
-/**
- * Every config file the hook resolver would read that EXISTS but cannot be
- * used: unreadable, not JSON, or JSON that is not an object (`loadConfig`
- * reads none of an array's or a null's keys and answers the defaults, the same
- * silent fallback as a parse failure). Empty when every file is usable or
- * absent: a MISSING config is a fresh project and reads as the defaults.
- *
- * The files are the union, in first-seen order, of the loader's list
- * (`configFilesFor`) and the activation resolver's raw levels
- * (`activationConfigFilesFor`, which can name a root config the loader never
- * opens under `GSD_PROJECT`). Reads go through `platformReadSync`, the reader
- * `loadConfig` uses, so a file the loader can read is never called unreadable.
- *
- * This is the ONE owner of "can the project's config be read". Both swallowing
- * readers (`loadConfig`, `resolveConfigKey`) stay tolerant for their many
- * callers; a caller whose answer governs a gate (`loop render-hooks`, the vault
- * load verdict) asks this first and refuses. Never throws.
- */
-function unreadableConfigFiles(cwd, options = {}) {
-    const out = [];
-    let files;
-    try {
-        files = [...new Set([...configFilesFor(cwd, options), ...activationConfigFilesFor(cwd)])];
-    }
-    catch (err) {
-        // An invalid GSD_WORKSTREAM / GSD_PROJECT segment: the config cannot be located, so it cannot be read.
-        return [{ file: '.planning/config.json', error: `cannot be located (${err instanceof Error ? err.message : String(err)})`.slice(0, UNREADABLE_ERROR_CAP) }];
-    }
-    for (const file of files) {
-        let error = null;
-        try {
-            const raw = (0, shell_command_projection_cjs_1.platformReadSync)(file);
-            if (raw === null)
-                continue;
-            const parsed = JSON.parse(raw);
-            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-                error = 'valid JSON but not an object, so none of its settings can be read';
-            }
-        }
-        catch (err) {
-            error = _describeConfigReadFailure(err);
-        }
-        if (error !== null)
-            out.push({ file: _configDisplayPath(cwd, file), error: error.slice(0, UNREADABLE_ERROR_CAP) });
-    }
-    return out;
-}
-/** One line per unreadable file, `<file>: <error>`, for a refusal message. */
-function describeUnreadableConfig(unreadable) {
-    return unreadable.map((u) => `${u.file}: ${u.error}`).join('; ');
-}
 function loadConfig(cwd, options = {}) {
     // When GSD_WORKSTREAM is set, load root config first so workstream config
     // can inherit from it. This prevents users from duplicating model_overrides,
@@ -839,8 +745,6 @@ function loadConfig(cwd, options = {}) {
 module.exports = {
     loadConfig,
     configFilesFor,
-    unreadableConfigFiles,
-    describeUnreadableConfig,
     isGitIgnored,
     CONFIG_DEFAULTS,
     _getConfigDefault,

package/pp-core/bin/lib/config-schema.cjs

@@ -29,7 +29,7 @@ function isCapabilityConfigKey(keyPath) {
 /**
  * The declared `values` of a capability `type: "enum"` config key, or `null`
  * when the key is not a capability key, is not an enum, or carries no value
- * list. 13-05 / D-07: this is the ONE lookup of enum values —
+ * list. Vault Assurance 13-05 / D-07: this is the ONE lookup of enum values —
  * `config-set` asks it rather than restating any list, so the registry stays
  * the single source of what an enum key may hold.
  */