@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/bin/lib/verify.cjs

@@ -52,7 +52,6 @@ const { getDeclaredMilestoneInfo, stripShippedMilestones, extractCurrentMileston
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const worktreeSafetyMod = require("./worktree-safety.cjs");
 const { inspectWorktreeHealth } = worktreeSafetyMod;
-const plan_graph_cjs_1 = require("./plan-graph.cjs");
 const { planningDir, milestonePathsFor, resolveProjectFile } = planningWorkspace;
 const { extractFrontmatter, parseMustHavesBlock } = frontmatterMod;
 const { writeStateMd } = stateMod;
@@ -541,16 +540,6 @@ function cmdVerifyPlanStructure(cwd, filePath, raw) {
         if (fm[field] === undefined)
             errors.push(`Missing required frontmatter field: ${field}`);
     }
-    // `title:` is required on every plan not yet executed. A plan that already has a
-    // SUMMARY predates the rule (or ran without it): its missing title only warns.
-    const titleProblem = (0, plan_graph_cjs_1.planTitleProblem)(fm['title']);
-    if (titleProblem) {
-        const summaryPath = fullPath.replace(/PLAN\.md$/, 'SUMMARY.md');
-        if (summaryPath !== fullPath && node_fs_1.default.existsSync(summaryPath))
-            warnings.push(`${titleProblem} (executed plan: warning only)`);
-        else
-            errors.push(titleProblem);
-    }
     const taskPattern = /<task[^>]*>([\s\S]*?)<\/task>/g;
     const tasks = [];
     let taskMatch;

package/pp-core/bin/portable-timeout.sh

@@ -22,7 +22,7 @@
 #
 # MEASURED exit-code matrix (macOS 26.5, bash 3.2.57, no timeout and no
 # gtimeout on PATH, perl at /usr/bin/perl; re-measured 2026-09-19 and pinned by
-# tests/gate-shell-owners.test.cjs):
+# tests/feat-73988-gate-shell-owners.test.cjs):
 #
 #   run_with_timeout 1 sleep 5                      -> 142 (perl) / 124 (GNU)
 #   run_with_timeout 5 bash -c '<missing command>'  -> 127 under every backend

package/pp-core/bin/pp-tools.cjs

@@ -178,7 +178,6 @@
  *
  * Loop Extension Point Queries (ADR-857 phase 3c):
  *   loop render-hooks <point>            Resolve + render active Capability hooks at a loop point
- *   loop run-gates <point>               Run the active gates at a loop point (exit 1 on a halt)
  *                                        Returns JSON envelope { point, activeHooks, rendered }
  *                                        Valid points: discuss:pre/post, plan:pre/post,
  *                                        execute:pre/wave:pre/wave:post/post, verify:pre/post, ship:pre/post
@@ -530,7 +529,7 @@ async function main() {
     'current-timestamp, detect-custom-files, discovery, docs-init, drift-guard, effort, extract-messages, find-phase, ' +
     'from-gsd2, frontmatter, gap-analysis, generate-claude-md, generate-claude-profile, ' +
     'generate-client-context, generate-dev-preferences, generate-slug, graphify, history-digest, init, init-contract, intel, ' +
-    'capability, classify-confidence, git, learnings, list-todos, loop, milestone, package-legitimacy, phase, phase-plan-index, phases, platform-bindings, profile-questionnaire, ' +
+    'capability, classify-confidence, git, learnings, list-todos, loop, milestone, package-legitimacy, phase, phase-plan-index, phases, platform-bindings, platform-latest-tag, profile-questionnaire, ' +
     'profile-sample, progress, prompt-budget, requirements, research-plan, research-store, resolve-granularity, resolve-model, roadmap, scaffold, state, ' +
     'task, template, user-story, validate, validate-bindings, verify, verify-path-exists, verify-summary, workstream, worktree\n\n' +
     'Global flags:\n' +
@@ -728,15 +727,13 @@ function createReadlinePrompter({ input = process.stdin, output = process.stdout
           .join(' / ');
         rendered += `\n  Options: ${optionsRendered}`;
       }
-      if (question.optionalAnswer) {
-        // A detected org profile is a hint inside the prompt text, so no
-        // option-less question carries a default and Enter always skips an
-        // optional question. The question text may already carry the hint
-        // (both org profile prompts do), so it is added only when absent (I-1).
-        const skipHint = 'press Enter to skip';
-        if (!String(question.prompt).toLowerCase().includes(skipHint.toLowerCase())) {
-          rendered += `\n  (${skipHint})`;
-        }
+      if (question.optionalAnswer && !/press Enter to skip/i.test(question.prompt)) {
+        // UAT-13-F2: a detected org profile is a HINT inside the prompt text
+        // itself, so Enter always skips an optional question. The question
+        // text may already carry the skip hint (the org profile prompts do),
+        // so it is added only for an optional question whose text lacks it
+        // (I-1).
+        rendered += '\n  (press Enter to skip)';
       }
       return new Promise((resolve) => {
         rl.question(`${rendered}\n> `, (answer) => resolve(answer));
@@ -751,6 +748,68 @@ function createReadlinePrompter({ input = process.stdin, output = process.stdout
   };
 }
 
+/**
+ * The vault mode a mode-filtered hook is judged against (Phase 15 D-02). Built
+ * here, at the CLI entry, so the pure resolvers (`loop-resolver`,
+ * `capability-state`) never import the vault adapter. It asks
+ * `vaultModeVerdict`, the single mode owner that honours the org-profile
+ * ladder, and answers the mode only for an active gate with a cleanly
+ * resolved mode. Anything else, including a throw, is `null`: the undefined
+ * mode, fail-closed per D-28. `vault.cjs` is required lazily so commands that
+ * never render hooks do not load it.
+ */
+function makeVaultModeResolver(cwd) {
+  return () => {
+    try {
+      const v = require('./lib/vault.cjs').vaultModeVerdict(cwd);
+      return v.active && v.ok ? v.mode : null;
+    } catch {
+      return null;
+    }
+  };
+}
+
+/**
+ * Does this project hold engine-written vault records? (Phase 16 D-19.) The
+ * predicate a seal gate (`onRecordedArtifacts: true`) is rendered under, built
+ * here at the CLI entry for the same reason as `makeVaultModeResolver`: the
+ * pure resolver never imports vault code. It asks the seal leaf's
+ * `hasRecordedVaultArtifacts`, which is bindings-first (D-42) and answers true
+ * when it cannot prove absence (D-44). A throw is `false`, the inert answer.
+ * Injected ONLY into `loop render-hooks`: `capability state` / `set` report
+ * activation, not render, so they never take it. Required lazily so commands
+ * that never render hooks do not load the leaf; the resolver memoises it per
+ * render and asks it only for an enabled, config-inactive seal gate.
+ */
+function makeRecordedArtifactsResolver(cwd) {
+  return () => {
+    try {
+      return require('./lib/vault-seal.cjs').hasRecordedVaultArtifacts(cwd) === true;
+    } catch {
+      return false;
+    }
+  };
+}
+
+/**
+ * Quick 261015-ect (QD-13): the `.platform-bindings.json` measurement
+ * `loop render-hooks` injects, built here at the CLI entry for the same reason
+ * as `makeVaultModeResolver`: the resolver imports no vault code (D-02). The
+ * reader is EXISTENCE, admission's own step 1 (`hasPlatformBindings`), so a
+ * malformed file counts as present and the fence's `vault admission` decides
+ * (D-47 b). A throw answers `null`, "could not measure", which the resolver
+ * renders through.
+ */
+function makePlatformBindingsPresentResolver(cwd) {
+  return () => {
+    try {
+      return require('./lib/vault.cjs').hasPlatformBindings(cwd) === true;
+    } catch {
+      return null;
+    }
+  };
+}
+
 async function runCommand(command, args, cwd, raw, defaultValue, originalCommand, workstreamContext = null) {
   switch (command) {
     case 'agent': {
@@ -784,6 +843,14 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       break;
     }
 
+    case 'platform-latest-tag': {
+      // quick 261003-my0: the init.md / new-project.md preflights read
+      // `--pick latest` from here instead of composing the platform URL in
+      // shell — one owner (compose-bindings resolveLatestPlatformTag).
+      composeBindings.cmdPlatformLatestTag(cwd, args.slice(1), raw);
+      break;
+    }
+
     case 'validate-bindings': {
       platformBindings.cmdValidateBindings(cwd, args.slice(1), raw);
       break;
@@ -820,7 +887,6 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
     case 'init-contract': {
       // init-contract [--questions] [--verify] [--session-next]
       //   [--session-answer <stepId>=<value>] [--session-reset] [--offline]
-      //   [--arm-vault]
       // --questions (also the no-flag default, D-05): read-only, always
       // exits 0, prints the canonical /pp-init question set as data.
       // --verify: runs the end-state invariant check (Phase 34-07 gap
@@ -835,6 +901,20 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       // BEFORE the unrecognized-flag scan below since the payload itself
       // is not a flag. --offline forwards to every composeBindings call
       // the session makes (parity with compose-bindings --offline).
+      // --record-probe <passed|failed>=<note> / --defer-probe <reason>
+      // (Phase 7, plan 07-01 — D-07-03, OD-2): the WRITE side of /pp-init
+      // Step 2.6's reachability proof. Both take their payload as the NEXT
+      // argv token for the same reason --session-answer does — the payload
+      // is operator prose and would otherwise be read as a flag — and both
+      // are extracted BEFORE the unrecognized-flag scan below. The record is
+      // written by recordProbeOutcome/recordProbeDeferral in
+      // src/init-contract.cts; --verify reads it back from plan 07-07 on
+      // (D-07-04), which is what stops a committed deferral from passing
+      // silently forever.
+      // --arm-vault (quick 261003-kmd): non-interactive — composes the
+      // client-vault binding from the resolved org profile and arms the three
+      // vault keys where absent; /pp-new-project calls it. Inert (exit 0,
+      // armed:false) when no profile resolves; ok:false means run /pp-init.
       const icArgs = args.slice(1);
       let sessionAnswerRaw;
       const saIdx = icArgs.indexOf('--session-answer');
@@ -849,12 +929,38 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
         }
         icArgs.splice(saIdx, 2);
       }
+      let recordProbeRaw;
+      const rpIdx = icArgs.indexOf('--record-probe');
+      if (rpIdx !== -1) {
+        recordProbeRaw = icArgs[rpIdx + 1];
+        if (!recordProbeRaw || recordProbeRaw.startsWith('--')) {
+          error(
+            'Missing value for --record-probe. Usage: --record-probe <passed|failed>=<note>',
+            ERROR_REASON.SDK_MISSING_ARG,
+          );
+          break;
+        }
+        icArgs.splice(rpIdx, 2);
+      }
+      let deferProbeRaw;
+      const dpIdx = icArgs.indexOf('--defer-probe');
+      if (dpIdx !== -1) {
+        deferProbeRaw = icArgs[dpIdx + 1];
+        if (!deferProbeRaw || deferProbeRaw.startsWith('--')) {
+          error(
+            'Missing value for --defer-probe. Usage: --defer-probe "<reason>"',
+            ERROR_REASON.SDK_MISSING_ARG,
+          );
+          break;
+        }
+        icArgs.splice(dpIdx, 2);
+      }
       const unrecognizedIcFlag = icArgs.find(
         (a) => a.startsWith('--') && !initContract.INIT_CONTRACT_FLAGS.includes(a),
       );
       if (unrecognizedIcFlag !== undefined) {
         error(
-          `Unrecognized flag "${unrecognizedIcFlag}" for init-contract. Supported: --questions, --verify, --session-next, --session-answer, --session-reset, --offline, --arm-vault.`,
+          `Unrecognized flag "${unrecognizedIcFlag}" for init-contract. Supported: --questions, --verify, --session-next, --session-answer, --session-reset, --offline, --record-probe, --defer-probe, --arm-vault.`,
           ERROR_REASON.SDK_FAIL_FAST,
         );
         break;
@@ -873,7 +979,6 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
         } else if (a === '--offline') {
           icOptions.offline = true;
         } else if (a === '--arm-vault') {
-          // Pack 6 D-09: set vault.enabled true only where absent.
           icOptions.armVault = true;
         }
       }
@@ -891,6 +996,25 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
           value: sessionAnswerRaw.slice(eqIdx + 1),
         };
       }
+      if (recordProbeRaw !== undefined) {
+        // Split at the FIRST "=" only: the status is a closed vocabulary with
+        // no "=" in it, and the note is free prose that may well contain one.
+        const rpEq = recordProbeRaw.indexOf('=');
+        if (rpEq === -1) {
+          error(
+            `Invalid --record-probe value "${recordProbeRaw}" — expected <passed|failed>=<note>.`,
+            ERROR_REASON.USAGE,
+          );
+          break;
+        }
+        icOptions.recordProbe = {
+          status: recordProbeRaw.slice(0, rpEq),
+          note: recordProbeRaw.slice(rpEq + 1),
+        };
+      }
+      if (deferProbeRaw !== undefined) {
+        icOptions.deferProbe = deferProbeRaw;
+      }
       initContract.cmdInitContract(cwd, icOptions, raw);
       break;
     }
@@ -1547,7 +1671,7 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
     }
 
     case 'loop': {
-      // loop render-hooks <point> [--config-dir <dir>] [--active-cap <capId>] [--into <role>] [--phase <N>] [--tier <t>]
+      // loop render-hooks <point> [--config-dir <dir>] [--active-cap <capId>] [--into <role>]
       const loopSubcommand = args[1];
       if (loopSubcommand === 'render-hooks') {
         let loopConfigDir = null;
@@ -1579,50 +1703,33 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
           }
           loopActiveCap = value;
         }
-        // --phase <N> / --tier <light|standard|heavy>: resolve the phase's
-        // ceremony tier and read the gate booleans from it (pack 9).
-        const loopValue = (flag) => {
-          const eq = args.find(arg => arg.startsWith(`--${flag}=`));
-          if (eq) return eq.slice(flag.length + 3).trim();
-          const idx = args.indexOf(`--${flag}`);
-          if (idx === -1) return undefined;
-          const value = args[idx + 1];
+        // --into <role>: print the fragment text of active contributions into <role>
+        // (Phase 15 D-12/D-30; execute-phase interpolates it into the spawn prompt)
+        let loopInto = undefined;
+        const intoEqArg = args.find(arg => arg.startsWith('--into='));
+        const intoIdx = args.indexOf('--into');
+        if (intoEqArg) {
+          const value = intoEqArg.slice('--into='.length).trim();
+          if (!value) error('Missing value for --into (e.g. --into executor)', ERROR_REASON ? ERROR_REASON.USAGE : undefined);
+          loopInto = value;
+        } else if (intoIdx !== -1) {
+          const value = args[intoIdx + 1];
           if (!value || value.startsWith('--')) {
-            error(`Missing value for --${flag}`, ERROR_REASON ? ERROR_REASON.USAGE : undefined);
+            error('Missing value for --into (e.g. --into executor)', ERROR_REASON ? ERROR_REASON.USAGE : undefined);
           }
-          return value;
-        };
+          loopInto = value;
+        }
         loopResolver.cmdLoopRenderHooks(cwd, args[2], raw, {
           configDir: loopConfigDir ? path.resolve(loopConfigDir) : undefined,
           activeCap: loopActiveCap,
-          phase: loopValue('phase'),
-          tier: loopValue('tier'),
-          // --into <role>: print the fragment text of active contributions into <role>
-          into: loopValue('into'),
-        });
-      } else if (loopSubcommand === 'run-gates') {
-        // loop run-gates <point> [--phase <N>] [--tier <t>] [--query <q>]: run the point's
-        // active gates (only those whose check.query is <q>, when given) under the
-        // two-step gate contract; exit 1 on a halt.
-        const gateValue = (flag) => {
-          const eq = args.find(arg => arg.startsWith(`--${flag}=`));
-          if (eq) return eq.slice(flag.length + 3).trim();
-          const idx = args.indexOf(`--${flag}`);
-          if (idx === -1) return undefined;
-          const value = args[idx + 1];
-          if (!value || value.startsWith('--')) {
-            error(`Missing value for --${flag}`, ERROR_REASON ? ERROR_REASON.USAGE : undefined);
-          }
-          return value;
-        };
-        require('./lib/loop-gates.cjs').cmdLoopRunGates(cwd, args[2], raw, {
-          phase: gateValue('phase'),
-          tier: gateValue('tier'),
-          query: gateValue('query'),
+          into: loopInto,
+          resolveVaultMode: makeVaultModeResolver(cwd),
+          resolveRecordedArtifacts: makeRecordedArtifactsResolver(cwd),
+          resolvePlatformBindingsPresent: makePlatformBindingsPresentResolver(cwd),
         });
       } else {
         error(
-          `Unknown loop subcommand: ${loopSubcommand}. Available: render-hooks, run-gates`,
+          `Unknown loop subcommand: ${loopSubcommand}. Available: render-hooks`,
           ERROR_REASON ? ERROR_REASON.SDK_UNKNOWN_COMMAND : undefined,
         );
       }
@@ -1649,7 +1756,9 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
           configDir = configDirVal;
         }
         const resolvedConfigDir = configDir ? path.resolve(configDir) : null;
-        capabilityState.cmdCapabilityState(cwd, resolvedConfigDir, raw, {});
+        capabilityState.cmdCapabilityState(cwd, resolvedConfigDir, raw, {
+          resolveVaultMode: makeVaultModeResolver(cwd),
+        });
       } else if (capSubcommand === 'set') {
         // capability set <id> [--on|--off|--enable|--disable] [--gate <key>=<bool>]... [--config-dir <dir>] [--runtime <r>] [--scope <s>]
         const capId = args[2];
@@ -1723,7 +1832,14 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
           cwd,
           resolvedSetConfigDir,
           capId,
-          { enabled: setEnabled, gates: Object.keys(setGates).length > 0 ? setGates : undefined, runtime: setRuntime, scope: setScope },
+          {
+            enabled: setEnabled,
+            gates: Object.keys(setGates).length > 0 ? setGates : undefined,
+            runtime: setRuntime,
+            scope: setScope,
+            // 15-REVIEW WR-07: the same mode `capability state` and render-hooks use.
+            resolveVaultMode: makeVaultModeResolver(cwd),
+          },
           raw,
         );
       } else {
@@ -2410,6 +2526,13 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
     // Lists every functional element of the prototype under
     // .planning/discovery/prototype/ so each is decided once in _sweep.md;
     // --check fails (discovery_element_sweep_failed) while one is undecided.
+    //
+    // discovery vault-check <session>
+    //
+    // Checks the `## Vault Context` record of .planning/discovery/session-NN.md:
+    // the index the selection used, one well-formed line per selected vault
+    // document, and that each was cited [vault: <path>] in the notes or marked
+    // not used with a reason. Any gap fails (discovery_vault_check_failed).
 
     case 'discovery': {
       const subcommand = args[1];
@@ -2455,13 +2578,20 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
         } catch (rebaselineCheckErr) {
           error(`discovery rebaseline-check: ${rebaselineCheckErr && rebaselineCheckErr.message ? rebaselineCheckErr.message : String(rebaselineCheckErr)}`, ERROR_REASON.UNKNOWN);
         }
+      } else if (subcommand === 'vault-check') {
+        const vaultCheck = require('./lib/discovery-vault-check.cjs');
+        try {
+          vaultCheck.cmdDiscoveryVaultCheck(cwd, args, raw);
+        } catch (vaultCheckErr) {
+          error(`discovery vault-check: ${vaultCheckErr && vaultCheckErr.message ? vaultCheckErr.message : String(vaultCheckErr)}`, ERROR_REASON.UNKNOWN);
+        }
       } else {
         // WIRING, NOT HELP TEXT: tests/discovery-artifacts.test.cjs derives each
         // subcommand spelling by regexing `<namespace>_<subcommand>_failed` out of
         // the engine's exported exit identity, splits this string on commas and
         // asserts membership. A spelling missing here is a command the engine
         // claims to be and the router does not dispatch.
-        error('Unknown discovery subcommand. Available: rollup, input-check, research-check, screen-check, element-sweep, rebaseline-check', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        error('Unknown discovery subcommand. Available: rollup, input-check, research-check, screen-check, element-sweep, rebaseline-check, vault-check', ERROR_REASON.SDK_UNKNOWN_COMMAND);
       }
       break;
     }

package/pp-core/bin/shared/config-defaults.manifest.json

@@ -93,12 +93,5 @@
   "plan_review": {
     "source_grounding": true,
     "source_grounding_authority": "grep"
-  },
-  "size_budget": {
-    "per_file_bytes": 1024,
-    "per_commit_bytes": 4096
-  },
-  "phase": {
-    "tier": "standard"
   }
 }

package/pp-core/bin/shared/config-schema.manifest.json

@@ -31,9 +31,6 @@
     "workflow.plan_bounce",
     "workflow.plan_bounce_script",
     "workflow.plan_bounce_passes",
-    "size_budget.per_file_bytes",
-    "size_budget.per_commit_bytes",
-    "phase.tier",
     "workflow.plan_chunked",
     "workflow.plan_review_convergence",
     "code_quality.fallow.enabled",

package/pp-core/bin/shared/model-catalog.json

@@ -155,7 +155,7 @@
     "pp-intel-updater":          { "golden": "opus",   "balanced": "sonnet", "budget": "haiku",  "phaseType": "research",     "routingTier": "light" },
     "pp-mempalace-curator":      { "golden": "sonnet", "balanced": "sonnet", "budget": "haiku",  "phaseType": "research",     "routingTier": "light" },
     "pp-security-auditor":       { "golden": "opus",   "balanced": "sonnet", "budget": "sonnet", "phaseType": "verification", "routingTier": "heavy" },
-    "pp-user-profiler":          { "golden": "opus",   "balanced": "sonnet", "budget": "sonnet", "phaseType": "research",     "routingTier": "heavy" },
-    "pp-vault-reviewer":         { "golden": "opus",   "balanced": "sonnet", "budget": "sonnet", "phaseType": "verification", "routingTier": "heavy" }
+    "pp-vault-reviewer":         { "golden": "opus",   "balanced": "sonnet", "budget": "sonnet", "phaseType": "verification", "routingTier": "heavy" },
+    "pp-user-profiler":          { "golden": "opus",   "balanced": "sonnet", "budget": "sonnet", "phaseType": "research",     "routingTier": "heavy" }
   }
 }

package/pp-core/org-profile.json

@@ -0,0 +1,26 @@
+{
+  "vault": {
+    "provider": "github",
+    "fallback_repo": ""
+  },
+  "platform": {
+    "host": "github.com"
+  },
+  "bindings": {
+    "platform": {
+      "repo": "pareto000/Pareto-Platform"
+    },
+    "client": {
+      "vaultRepo": "pareto000/Pareto-Vault",
+      "vaultHost": "github.com"
+    },
+    "provisioning": {
+      "group": "pareto000"
+    }
+  },
+  "init": {
+    "provider": "github",
+    "visibility": "private",
+    "derive_slugs": true
+  }
+}

package/pp-core/references/autonomous-best-effort.md

@@ -1,8 +1,9 @@
 # Autonomous — Best-Effort Rules
 
 This file is Read at the start of EVERY phase (`autonomous.md` §3, first line) and again at §6, so
-context compaction cannot erode the rules below. It contains bare `pp_run` calls and relies on the
-caller's launcher — it carries no preamble of its own.
+context compaction cannot erode the rules below. It contains bare `pp_run` calls and, like
+`pp-core/workflows/execute-phase/steps/check-query-gate.md`, relies on the caller's launcher — it
+carries no preamble of its own.
 
 Mode model:
 
@@ -21,8 +22,8 @@ auto-advance into a second execute-phase.
 
 These stop the run in every mode. Best-effort never answers them.
 
-- Blocking capability `check.query` gates (`blocking: true` and `block: true`) — the host workflow
-  HALTs, which ends the run like an `exit 1`; unchanged.
+- Blocking `check.query` gates (vault `plan:pre`, security) — the enforcer prints its token and runs
+  `exit 1`; unchanged.
 - `human-action` checkpoints (auth/credentials) in execute-phase.
 - Any checkpoint with `gate="blocking-human"` — package legitimacy (`agents/pp-executor.md`,
   `agents/pp-planner.md`: never auto-approvable). Presented to the user under `UNATTENDED` and
@@ -297,13 +298,13 @@ calls (`pp-ui-phase`, `pp-code-review`, `pp-ui-review`) and the agents on the pa
 | execute-phase checkpoint_handling (`human-action`, `gate="blocking-human"`) | hard stop — U-E1 |
 | execute-phase/steps/cross-ai-delegation.md failure | converted — U-E8 |
 | execute-phase/steps/vault-load-gate.md, client-context-gate.md `confirmed` | hard stop (governance) |
-| execute-phase / plan-phase blocking capability `check.query` gates (`blocking: true`, `block: true`) | hard stop (HALT) |
+| execute-phase/steps/check-query-gate.md, vault-fetch.md halt | hard stop (`exit 1`) |
 | execute-phase/steps/worktree-recovery-policy.md exit 42; execute-phase partial-execution recovery | hard stop (fail closed) |
 | execute-phase `state_exists` false; `--interactive` per-plan menu | unreachable — autonomous requires STATE.md and never passes `--interactive` to execute-phase |
 | post-merge-gate | build-failure "Fix now / Continue" (step 5.8) — this is the U-E2 site: fix once, then continue and record |
-| codebase-drift-gate, serial-group-dispatch, vault-fetch | no prompt (non-blocking) |
+| codebase-drift-gate, per-plan-worktree-gate, execute-pre-dispatch, verify-post-gate, verifier-practice-payload | no prompt (non-blocking or gate-enforcer only) |
 | `pp-code-review --fix --auto` (3c.5) | no prompt |
-| **`pp-ui-phase`** (§3a.5): step 9 max-revision choice, and its `pp-ui-researcher` design questions | **remaining stop** — ui-phase has no non-interactive flag; filed as deferred |
+| **`pp-ui-phase`** (§3a.5-ii): step 9 max-revision choice, and its `pp-ui-researcher` design questions | **remaining stop** — ui-phase has no non-interactive flag; filed as deferred |
 | **`pp-ui-review`** (§3d.5): "UI-REVIEW.md already exists" | **remaining stop** (only on a re-run) — no non-interactive flag; filed as deferred |
 | agents: `pp-planner` / `pp-phase-researcher` / `pp-executor` / `pp-verifier` returns | routed through the host sites above; `pp-executor`'s own auto-approve under `workflow.auto_advance` is filed as deferred (not reached — autonomous sets neither auto flag) |
 

package/pp-core/references/loop-hook-dispatch.md

@@ -5,14 +5,6 @@ in any host-loop workflow. This document is point-agnostic — it applies to eve
 extension point (discuss:pre, discuss:post, plan:pre, plan:post, execute:pre, execute:wave:pre,
 execute:wave:post, execute:post, verify:pre, verify:post, ship:pre, ship:post).
 
-Phase workflows pass `--phase <N> [--tier light|standard|heavy]`: the phase's ceremony tier
-(`pp_run query phase.tier <N>`) then decides the nine gate booleans (`workflow.research`,
-`workflow.pattern_mapper`, `workflow.plan_check`, `workflow.verifier`, `workflow.nyquist_validation`,
-`workflow.code_review`, `workflow.post_planning_gaps`, `workflow.security_enforcement`,
-`workflow.vault_review`) that hook
-`when` keys read, and the envelope carries `phase_tier`. Without `--phase` the project's own
-booleans are read.
-
 ## Envelope shape
 
 ```json
@@ -30,22 +22,12 @@ booleans are read.
 `activeHooks` is an array of enabled hook entries for the named point. It is empty (or absent)
 when no capability has registered an active hook at this point — treat that as a no-op.
 
-## Refusal
-
-`render-hooks` refuses — exit 1, empty stdout, one stderr line naming each config file and its
-parse error — when a project config file exists but cannot be read (not JSON, or not a JSON
-object). A missing config is not refused. Every host writes `X=$(pp_run loop render-hooks …) || exit 1`,
-so a refusal stops the workflow: relay the stderr line and stop. Never read a refusal as "no hooks".
-
 ## Dispatch rules by `kind`
 
 ### `contribution`
 
 Inject `fragment.inline` verbatim into the context for the role named in `into`
 (e.g. `orchestrator`, `planner`). Do not paraphrase — the text is the product.
-`pp_run loop render-hooks <point> --into <role>` prints just those fragments, blank-line separated.
-An `execute:pre` contribution `into: executor` reaches every executor through `phase.dispatch-plan`:
-each spawn's `contributions[]` carries it, and the spawn prompt injects each `fragment` verbatim.
 
 ### `step`
 
@@ -73,13 +55,6 @@ Evaluate `check` (one of `query`, `predicate`, or `agentVerdict`). Then honor `b
 Honor `onError` if the check itself errors: `skip` means treat as non-blocking and continue;
 `fail` means surface the error and stop.
 
-`pp_run loop run-gates <point> --phase <N> [--query <q>]` applies this contract in code for every
-active `check.query` gate at the point (only those whose query is `<q>` with `--query`), appending
-the gate's declared `check.args` after the phase: exit 1 with a `⛔` line on a halt, `⚠` lines for
-advisories and skipped command errors, an `ℹ` line for a passing blocking gate's note, the verdict
-JSON on stdout. It runs every `verify:post` gate, and the `vault.trace` gate at `plan:post`,
-`execute:post` and `ship:pre` (`--query vault.trace`); the hosts' own gate loops skip that query.
-
 ## Empty / absent `activeHooks`
 
 If `activeHooks` is absent, null, or an empty array, skip silently and continue to the next

package/pp-core/references/planner-gap-closure.md

@@ -52,7 +52,6 @@ grep -l "status: diagnosed" "$phase_dir"/*-UAT.md 2>/dev/null
 ---
 phase: XX-name
 plan: NN              # Sequential after existing
-title: "..."          # REQUIRED one line
 type: execute
 wave: N               # Computed from depends_on (see assign_waves)
 depends_on: [...]     # Other plans this depends on (gap or existing)

package/pp-core/references/planner-tdd.md

@@ -18,7 +18,6 @@ TDD candidates identified in task_breakdown get dedicated plans (type: tdd). One
 ---
 phase: XX-name
 plan: NN
-title: "..."
 type: tdd
 ---