@pareto4/pp-core 1.13.0 → 1.17.1

package/scripts/lib/allowlist-ratchet.cjs

@@ -233,106 +233,4 @@ function assertFileBaseline({ label, current, baseline, fail, updateHint }) {
   return { grown, shrunk, added, removed };
 }
 
-/**
- * Assert that each artifact's measured size stays within a per-change DELTA
- * BUDGET of its committed baseline (workflow size budget policy, 2026-10-11).
- *
- * Unlike `assertFileBaseline` (exact-byte pins), small growth is absorbed by a
- * slack so routine edits need no baseline commit, while large or cumulative
- * growth still fails by name:
- *
- * - A file may exceed its baseline by at most `perFileSlack` bytes.
- * - The SUM of all positive overages may not exceed `totalSlack` bytes, so many
- *   small growths cannot add up to a large one unseen.
- * - Shrinking always passes and never needs a baseline commit.
- * - A file with no baseline entry (ADDED) or a baseline entry with no file
- *   (REMOVED) fails: the baseline must name exactly the files on disk.
- *   Recording either needs no reason.
- * - An EMPTY baseline fails: with no entries every file is "added", but an
- *   explicit message makes the vacuous-pass case impossible to misread.
- *
- * Overage is measured against the committed baseline, not the previous commit,
- * so the slack is a budget that a re-baseline resets — not a per-commit
- * allowance that can be spent again on every commit.
- *
- * @param {object} opts
- * @param {string} opts.label - Guard name (used in messages).
- * @param {Object<string, number>} opts.current  - Measured sizes by name.
- * @param {Object<string, number>} opts.baseline - Committed sizes by name
- *                                  (numbers only; strip metadata keys first).
- * @param {number} opts.perFileSlack - Max bytes one file may exceed its baseline.
- * @param {number} opts.totalSlack   - Max sum of all positive overages.
- * @param {function(string): void} opts.fail - Invoked once per violation category.
- * @param {string} [opts.updateHint] - Remediation hint appended to growth failures.
- * @returns {{ overages: Array<{name:string,from:number,to:number,delta:number}>,
- *             totalOverage: number,
- *             shrunk: Array<{name:string,from:number,to:number,delta:number}>,
- *             added: string[], removed: string[] }}
- */
-function assertDeltaBudget({ label, current, baseline, perFileSlack, totalSlack, fail, updateHint }) {
-  const currentNames = new Set(Object.keys(current));
-  const baselineNames = new Set(Object.keys(baseline));
-  const hint = updateHint ? `\n${updateHint}` : '';
-
-  if (baselineNames.size === 0) {
-    fail(
-      `[${label}] the committed baseline has no size entries — an empty baseline would make ` +
-        `every growth check pass vacuously. Regenerate it with \`npm run size:baseline\`.`
-    );
-  }
-
-  const added = [...currentNames].filter((n) => !baselineNames.has(n)).sort();
-  const removed = [...baselineNames].filter((n) => !currentNames.has(n)).sort();
-
-  const overages = [];
-  const shrunk = [];
-  for (const name of [...currentNames].filter((n) => baselineNames.has(n)).sort()) {
-    const from = baseline[name];
-    const to = current[name];
-    if (!Number.isInteger(from) || from < 0) {
-      fail(`[${label}] baseline entry ${name} is not a non-negative integer byte size: ${JSON.stringify(from)}`);
-      continue;
-    }
-    if (to > from) overages.push({ name, from, to, delta: to - from });
-    else if (to < from) shrunk.push({ name, from, to, delta: from - to });
-  }
-  const totalOverage = overages.reduce((sum, o) => sum + o.delta, 0);
-  const fmt = (o) => `  - ${o.name}: ${o.from} → ${o.to} (+${o.delta})`;
-
-  const overFile = overages.filter((o) => o.delta > perFileSlack);
-  if (overFile.length > 0) {
-    fail(
-      `[${label}] ${overFile.length} file(s) grew more than the per-file slack of ${perFileSlack} bytes ` +
-        `past the committed baseline. Shrink them (extract content lazily), or re-baseline with a ` +
-        `reason: npm run size:baseline -- --reason "<why this growth is needed>"\n` +
-        `${overFile.map(fmt).join('\n')}${hint}`
-    );
-  }
-
-  if (totalOverage > totalSlack) {
-    fail(
-      `[${label}] total growth past the committed baseline is ${totalOverage} bytes, over the total ` +
-        `slack of ${totalSlack} bytes (each file may be under its own slack — the sum is what failed). ` +
-        `Shrink, or re-baseline with a reason: npm run size:baseline -- --reason "<why>"\n` +
-        `${overages.map(fmt).join('\n')}${hint}`
-    );
-  }
-
-  if (added.length > 0) {
-    fail(
-      `[${label}] ${added.length} file(s) are not in the baseline — run \`npm run size:baseline\` ` +
-        `to record them (no --reason needed for new files).\n${added.map((n) => `  - ${n}`).join('\n')}`
-    );
-  }
-
-  if (removed.length > 0) {
-    fail(
-      `[${label}] ${removed.length} baseline entry(ies) no longer exist — run \`npm run size:baseline\` ` +
-        `to drop them (no --reason needed).\n${removed.map((n) => `  - ${n}`).join('\n')}`
-    );
-  }
-
-  return { overages, totalOverage, shrunk, added, removed };
-}
-
-module.exports = { assertWithinAllowlist, assertTightCeiling, assertFileBaseline, assertDeltaBudget };
+module.exports = { assertWithinAllowlist, assertTightCeiling, assertFileBaseline };

package/scripts/lint-allow-test-rule-refs.allowlist.json

@@ -288,7 +288,6 @@
   "tests/read-guard.test.cjs :: source-text-is-the-product",
   "tests/reapply-patches.test.cjs :: source-text-is-the-product",
   "tests/reapply-verify-hunks.test.cjs :: source-text-is-the-product",
-  "tests/release-coverage-scope.test.cjs :: source-text-is-the-product",
   "tests/release-tarball-smoke-workflow.test.cjs :: source-text-is-the-product",
   "tests/release-tarball-smoke.install.test.cjs :: integration-test-input",
   "tests/research-agent-profiles.test.cjs :: <runtime-contract-is-the-product> research agent .md content is the governed surface",
@@ -321,7 +320,6 @@
   "tests/windows-test-parity-guard.test.cjs :: structural-regression-guard",
   "tests/workflow-compat.test.cjs :: source-text-is-the-product",
   "tests/workflow-guard-registration.test.cjs :: structural-regression-guard",
-  "tests/workflow-maintainer-skip.test.cjs :: source-text-is-the-product",
   "tests/workflow-shell-pinning.test.cjs :: file-scope prefilter, not a test assertion — we need to",
   "tests/workflow-size-budget.test.cjs :: source-text-is-the-product",
   "tests/workspace.test.cjs :: source-text-is-the-product",

package/scripts/lint-pr-check-project-dir.cjs

@@ -9,9 +9,7 @@ const { runMain } = require('./lib/cli-exit.cjs');
 const ROOT = path.join(__dirname, '..');
 
 const DEFAULT_RELATIVE_FILES = [
-  '.github/workflows/test.yml',
-  '.github/workflows/pr-template-format.yml',
-  '.github/workflows/changeset-required.yml',
+  '.github/workflows/ci.yml',
   'scripts/lint-command-contract.cjs',
   'scripts/lint-skill-deps.cjs',
   'scripts/lint-descriptions.cjs',

package/scripts/lint-test-file-count.allowlist.json

@@ -114,6 +114,14 @@
       ],
       "issue": "180"
     },
+    "vault-review": {
+      "files": [
+        "vault-review.integration.test.cjs",
+        "vault-review.security.test.cjs",
+        "vault-review.test.cjs"
+      ],
+      "issue": "71924 — Vault Assurance phase 06 (06-03/06-04), three distinct concerns for pp-core/bin/lib/vault-review.cjs: vault-review.test (06-03 unit tests over every pure derivation — the verdict vocabularies, both derived-N-A arms, the counts arithmetic, the range resolver and the clean-render refusal predicate), vault-review.integration.test (06-04 SEAM tests — the deterministic validator of the agent-written artifact, plus the `check vault-review` arm driven through the real pp-core/bin/pp-tools.cjs, where the exit-0/no-block-key contract of D-06-01 and VERIFY-03 is proved at the boundary a gate enforcer actually reads, with RED control 2 proving that guard non-vacuous), and vault-review.security.test (06-04 ADVERSARIAL tests — a spoofed external-content fence-end marker, directive-shaped text and a forged tool-call block planted in real practice BODIES, proving 05-REVIEW's open Critical CR-02 is not repeated on this surface, plus the CR-03 class: no absolute filesystem path in any emitted byte). The split mirrors the `vault` cluster's own reasoning: the unit lane, the CLI seam and the security marker are independently load-bearing verification gates, and the `.security.test.cjs` marker is what makes the adversarial lane identifiable to a reader and to scripts/run-tests.cjs. Consolidating would blur three different questions into one file."
+    },
     "verify": {
       "files": [
         "bug-2969-verify-reapply-patches.test.cjs",
@@ -179,21 +187,15 @@
     },
     "vault": {
       "files": [
+        "feat-71924-vault-required-gate.test.cjs",
+        "vault-doors.integration.test.cjs",
         "vault-practices.property.test.cjs",
         "vault-read-path.test.cjs",
         "vault-security.test.cjs",
         "vault-status-check.test.cjs",
         "vault.test.cjs"
       ],
-      "issue": "v1.7.0 Client Vault Load — four distinct concerns: vault.test (fetch/status/summary unit), vault-security (VSEC-02/03 write-guard + secret/fence), vault-read-path (VGATE-03 SUMMARY pointer), vault-status-check (VGATE-02 gate-query handler). Phase 24-02 added vault-practices.property.test.cjs (fast-check fuzz of the practices glob-fallback compiler + a practices-frontmatter round-trip, PRAC-02) — it is grouped under this bucket rather than \"vault-practices\" because the test-file-count lint's hyphen-prefix matcher treats \"vault-practices.property\" (period before \"property\") as starting with \"vault-\" before it can match the more specific \"vault-practices-\" prefix; the module it actually tests is pp-core/bin/lib/vault-practices.cjs, not vault.cjs."
-    },
-    "vault-review": {
-      "files": [
-        "vault-review.integration.test.cjs",
-        "vault-review.security.test.cjs",
-        "vault-review.test.cjs"
-      ],
-      "issue": "Agent practice review (vault assurance R5) — three distinct concerns for pp-core/bin/lib/vault-review.cjs: vault-review.test (the pure derivations — vocabularies, both derived-N-A arms, the counts, the range, the clean-render refusal, the scaffold renderer and the line stamper — plus the require-graph barrier), vault-review.integration.test (the seams: the artifact validator and the check vault-review / vault review scaffold|finalize arms driven through the real pp-tools.cjs, where the exit-0 / no-block-key contract is proved), and vault-review.security.test (adversarial practice bodies: a spoofed fence marker, directive-shaped text, a client table inside the fence, an option-shaped base branch). The .security marker is what identifies the adversarial lane to scripts/run-tests.cjs; consolidating would blur three different questions into one file."
+      "issue": "v1.7.0 Client Vault Load — four distinct concerns: vault.test (fetch/status/summary unit), vault-security (VSEC-02/03 write-guard + secret/fence), vault-read-path (VGATE-03 SUMMARY pointer), vault-status-check (VGATE-02 gate-query handler). Phase 24-02 added vault-practices.property.test.cjs (fast-check fuzz of the practices glob-fallback compiler + a practices-frontmatter round-trip, PRAC-02) — it is grouped under this bucket rather than \"vault-practices\" because the test-file-count lint's hyphen-prefix matcher treats \"vault-practices.property\" (period before \"property\") as starting with \"vault-\" before it can match the more specific \"vault-practices-\" prefix; the module it actually tests is pp-core/bin/lib/vault-practices.cjs, not vault.cjs. Vault Assurance phase 02 (#71924) added feat-71924-vault-required-gate.test.cjs as the phase's ONE consolidated source-grep feature file — it owns the source-text assertions for GATE-02, GATE-03, GATE-06, GATE-08, GATE-09 and GATE-10 together, deliberately in a single file so the phase's six requirements do not each spawn a sibling; later plans in the phase extend it rather than adding files. Vault Assurance phase 16 plan 10 added vault-doors.integration.test.cjs as the phase's ONE door fence-proof owner (DOOR-01..05, D-09): every door's shipped fence (execute-plan, quick, fast, debug, the secondary doors) composed by tests/helpers/gate-fence-composer.cjs and run in bash and zsh, one describe per door plan, so 16-12..16-15 extend it rather than each adding a sibling. The hyphen-prefix matcher attributes it here because no vault-doors module exists; it tests workflow fences, not vault.cjs."
     },
     "vault-practices": {
       "files": [
@@ -202,7 +204,7 @@
         "vault-practices.slow.test.cjs",
         "vault-practices.test.cjs"
       ],
-      "issue": "Phase 24 (24-01/24-02/24-04) — three distinct concerns for pp-core/bin/lib/vault-practices.cjs: vault-practices.test (24-01 parser/validation/discovery unit tests), vault-practices-matcher.test (24-02 glob matcher + two-bucket result + report unit tests), vault-practices-examples.test (24-04 shipped-example drift guard + minimal-comments global-bucket smoke case, PRAC-03 Success Criterion 3). All three test the same production module and are each independently load-bearing; consolidating would blur distinct plan-level verification gates. The practice-file contract extensions added vault-practices.slow.test.cjs — the >5 s worst-case matcher corpus behind the matching cost bound, split out per the .slow suffix convention so the default suite stays fast."
+      "issue": "Phase 24 (24-01/24-02/24-04) — three distinct concerns for pp-core/bin/lib/vault-practices.cjs: vault-practices.test (24-01 parser/validation/discovery unit tests), vault-practices-matcher.test (24-02 glob matcher + two-bucket result + report unit tests), vault-practices-examples.test (24-04 shipped-example drift guard + minimal-comments global-bucket smoke case, PRAC-03 Success Criterion 3). All three test the same production module and are each independently load-bearing; consolidating would blur distinct plan-level verification gates. Vault Assurance phase 05 (#71924) added vault-practices.slow.test.cjs — the >5 s six-axis worst-case matcher corpus for the same production module (pp-core/bin/lib/vault-practices.cjs), split out per the .slow suffix convention so the default suite stays fast; attributed here once the count lint learned to strip the .slow suffix."
     }
   }
 }

package/scripts/practice-arithmetic-contract.allow.json

@@ -0,0 +1,35 @@
+{
+  "//": [
+    "Lines that carry a residue needle but restate NO fact the canonical block states.",
+    "Read by scripts/gen-practice-arithmetic-contract.cjs --check. Keys starting with // are comments.",
+    "sha256 is of the EXACT allowed line. Editing that line breaks its entry and forces re-justification;",
+    "an entry matching no line in its file fails as rotted. A reason is mandatory.",
+    "A WRAPPED finding — one visible only once adjacent lines are joined — is hashed over the joined,",
+    "whitespace-collapsed window text that --check prints beside it, not over any single line of the",
+    "file. That digest survives a reflow of the same words, because what an allowance justifies is the",
+    "sentence and not where its line breaks fell. All three entries below are per-LINE. 06-17, W13.",
+    "Every entry below is the same shape: a payload-KEY INVENTORY, where `derivedCounts` /",
+    "`derivedRateLine` are named as things the CLI hands the agent, and the very next clause points at",
+    "the generated contract block rather than saying what they mean. Naming a key is not restating a",
+    "contract. Keep this file as close to empty as the prose allows.",
+    "06-16, gap G10."
+  ],
+  "pp-core/workflows/vault-review.md": [
+    {
+      "sha256": "1766709dca03a214fb8fa5496fe6b2aef06fc1b02e67832a6048eeac78e29d6a",
+      "reason": "Section 4 is the inventory of what REVIEW_PAYLOAD carries; this line names the two keys and its own continuation says what they describe is stated once in the contract block carried into the spawn prompt below. It states nothing itself."
+    }
+  ],
+  "agents/pp-vault-reviewer.md": [
+    {
+      "sha256": "1fac53fb5988ab5278f2a262f1564b5dbef830531ec0a82f7200c9b940b45b8d",
+      "reason": "The left cell of the supplied-fact table, where the key name IS the row's subject. The right cell is a pointer to the contract block twelve lines below, in the same <derived_facts> element."
+    }
+  ],
+  "pp-core/references/verifier-practice-verdicts.md": [
+    {
+      "sha256": "52872e6f4b821944e026667c5bd48a3c2319f6876e805e8721865cbf6eb27816",
+      "reason": "Section 6's inventory of what the check vault-review arm hands the verifier. The sentence that follows it points at section 7 and says explicitly that the rule is not restated here."
+    }
+  ]
+}

package/scripts/prompt-injection-scan.sh

@@ -82,23 +82,28 @@ PATTERNS=(
 # THIS file and reads the array bash actually expands — adding, removing or
 # un-reasoning an entry here without editing the test turns the suite red.
 ALLOWLIST=(
-  'scripts/prompt-injection-scan.sh::the PATTERNS array above is the literal source of every phrase this scanner looks for, so the file matches itself by construction; measured 4 pattern hits at HEAD on 2026-10-11'
-  'scripts/base64-scan.sh::decodes base64 blobs and re-scans the recovered plaintext against the same injection vocabulary, so it names those phrases inline; measured 2 pattern hits at HEAD on 2026-10-11'
-  'scripts/secret-scan.sh::third of the three diff-mode scan scripts CI runs together in the security-scan job of .gitlab-ci.yml; measured 0 pattern hits at HEAD on 2026-10-11, retained because its own exemption list at line 223 already names security-prompt-injection.security.test.cjs and grows with that vocabulary'
-  'tests/security-scan.security.test.cjs::the behavioural suite for this very scanner, so every positive case embeds a real injection phrase as fixture input; measured 28 pattern hits at HEAD on 2026-10-11'
-  'tests/security.test.cjs::the adversarial suite for the library sanitisers, whose fixtures are real override and role-manipulation strings asserted to be neutralised; measured 54 pattern hits at HEAD on 2026-10-11'
-  'tests/prompt-injection-scan.security.test.cjs::drives scanForInjection in the compiled security library with crafted payloads, and carries a second allowlist of its own for that separate scanner; measured 11 pattern hits at HEAD on 2026-10-11'
-  'tests/vault-security.test.cjs::the vault fencing suite plants an instruction-override heading in a fixture vault file and asserts SUMMARY.md fences and defangs it rather than passing it to the agent as instructions; measured 1 pattern hit at HEAD on 2026-10-11'
-  'tests/vault-practices-matcher.test.cjs::the vault practices matcher suite plants an instruction-override line inside a fixture practice body and a spoofed fence end, and asserts the matcher keeps both inside the untrusted fenced region, so the fixtures must carry a real injection phrase'
-  'tests/vault-review.security.test.cjs::the adversarial suite of the agent practice review seeds a practice body with directive-shaped text aimed at the practice judge (the DIRECTIVE_TEXT constant) and asserts the rendered review entry carries it only between the fence markers, after the reference-data preamble, so the judge reads it as data; the text must be a literal for that assertion to mean anything; measured 1 pattern hit at HEAD on 2026-10-12'
-  'tests/verify.test.cjs::the verification suite plants an instruction-override line in a phase artifact and asserts it is rejected, so the line is present as a negative fixture; measured 1 pattern hit at HEAD on 2026-10-11'
-  'pp-core/bin/lib/security.cjs::gitignored build output compiled from src/security.cts per .gitignore line 117, so it is unreachable in diff mode and matters only to a local dir-mode run; it carries the library injection patterns inline; measured 8 pattern hits at HEAD on 2026-10-11'
-  'tests/read-injection-scanner.security.test.cjs::exercises the read-time injection scanner hook with the payloads a hostile file would carry, each asserted to be blocked rather than obeyed; measured 14 pattern hits at HEAD on 2026-10-11'
-  'tests/security-prompt-injection.security.test.cjs::carries two deliberate NUL bytes at lines 631 and 881 so grep classifies it as binary and reports whole-file matches with no line numbers; 10 binary pattern matches measured at HEAD on 2026-10-11'
-  'tests/fixtures/adversarial/security/::a directory of adversarial corpus files whose entire purpose is to BE injection payloads for the suites above; measured 20 pattern hits across its 7 tracked files at HEAD on 2026-10-11'
-  'SECURITY.md::the substring rule makes this exempt every path ending in SECURITY.md, including pp-core/templates/SECURITY.md and every per-phase threat register generated from that template; the breadth is accepted because a security policy is exactly where injection phrasing is legitimately quoted; measured 1 pattern hit across all 13 such files on disk at HEAD on 2026-10-11, a quoted attack shape in a phase threat register'
-  'TEST-EXAMPLES.md::documentation that demonstrates injection examples in order to explain what these scanners catch, so the example text is the point of the file rather than an attack; measured 1 pattern hit at HEAD on 2026-10-11'
-  'explanation/security-model.md::matches docs/explanation/security-model.md through the substring rule; it is the prose that explains the injection threat model and quotes the attack shapes pp-core defends against; measured 2 pattern hits at HEAD on 2026-10-11'
+  'scripts/prompt-injection-scan.sh::the PATTERNS array above is the literal source of every phrase this scanner looks for, so the file matches itself by construction; measured 4 pattern hits at HEAD on 2026-09-19'
+  'scripts/base64-scan.sh::decodes base64 blobs and re-scans the recovered plaintext against the same injection vocabulary, so it names those phrases inline; measured 2 pattern hits at HEAD on 2026-09-19'
+  'scripts/secret-scan.sh::third of the three diff-mode scan scripts CI runs together in the security_scan job of .github/workflows/ci.yml; measured 0 pattern hits at HEAD on 2026-09-19, retained because its own exemption list at line 223 already names security-prompt-injection.security.test.cjs and grows with that vocabulary'
+  'tests/security-scan.security.test.cjs::the behavioural suite for this very scanner, so every positive case embeds a real injection phrase as fixture input; measured 28 pattern hits at HEAD on 2026-09-19'
+  'tests/security.test.cjs::the adversarial suite for the library sanitisers, whose fixtures are real override and role-manipulation strings asserted to be neutralised; measured 54 pattern hits at HEAD on 2026-09-19'
+  'tests/prompt-injection-scan.security.test.cjs::drives scanForInjection in the compiled security library with crafted payloads, and carries a second allowlist of its own for that separate scanner; measured 11 pattern hits at HEAD on 2026-09-19'
+  'tests/verify.test.cjs::the verification suite plants an instruction-override line in a phase artifact and asserts it is rejected, so the line is present as a negative fixture; measured 1 pattern hit at HEAD on 2026-09-19'
+  'pp-core/bin/lib/security.cjs::gitignored build output compiled from src/security.cts per .gitignore line 117, so it is unreachable in diff mode and matters only to a local dir-mode run; it carries the library injection patterns inline; measured 8 pattern hits at HEAD on 2026-09-19'
+  'tests/read-injection-scanner.security.test.cjs::exercises the read-time injection scanner hook with the payloads a hostile file would carry, each asserted to be blocked rather than obeyed; measured 14 pattern hits at HEAD on 2026-09-19'
+  'tests/security-prompt-injection.security.test.cjs::carries two deliberate NUL bytes at lines 631 and 881 so grep classifies it as binary and reports whole-file matches with no line numbers; 10 binary pattern matches measured at HEAD on 2026-09-19'
+  'tests/fixtures/adversarial/security/::a directory of adversarial corpus files whose entire purpose is to BE injection payloads for the suites above; measured 20 pattern hits across its 7 tracked files at HEAD on 2026-09-19'
+  'tests/discovery-vault-context.test.cjs::the DISCO-03/SC4 suite plants a real role-manipulation line (the PLANTED constant) into a fixture vault document and asserts the shipped scanner FINDS it, which is the non-vacuity partner for the assertion that the subflow itself scans clean; the payload has to be a literal for that half to mean anything, so the file matches the vocabulary it exists to prove is caught'
+  'tests/vault-status-check.test.cjs::sanitisation seeds for the vault status message carry a real instruction and a real control character on purpose, each paired with a non-vacuity assertion that the RENDERED message does not carry it intact; measured 5 pattern hits at HEAD on 2026-09-19'
+  'tests/vault-practices-matcher.test.cjs::the CR-01 fence-spoof suite plants a real instruction-override line and a forged end-fence marker inside practice bodies on purpose, each paired with an assertion that the RENDERED practices block keeps the planted text inside the fence and leaves exactly one genuine closer, so the payload must be a literal for the defang proof to mean anything; measured 3 pattern hits at HEAD b4dd6b3 on 2026-10-04'
+  'tests/vault-review.security.test.cjs::the CR-02 suite seeds a practice body with directive-shaped text aimed at the practice judge (the DIRECTIVE_TEXT constant) and asserts the rendered review entry carries it only between the fence markers, after the reference-data preamble, so the judge reads it as data; the text must be a literal for that assertion to mean anything; measured 1 pattern hit at HEAD b4dd6b3 on 2026-10-04'
+  'tests/practices-review-check-property.test.cjs::a false positive rather than a payload, since the fence-parsing invariance property builds a never-closed fence whose second-opener line is ordinary English about whether the client line becomes a cut point, and one role-pattern regex matches that plain wording; the fixture text stays as written; measured 1 pattern hit at HEAD b4dd6b3 on 2026-10-04'
+  'tests/vault-index.integration.test.cjs::the fence-spoof suite seeds a vault document heading and an INDEX description that carry a forged end-fence marker followed by an instruction-override phrase, and asserts the rendered SUMMARY keeps exactly one live end marker with the planted line defanged inside the fence, so the phrase must be a literal for the defang proof to mean anything; measured 4 pattern hits at HEAD 5ddb0b3 on 2026-10-12'
+  'tests/vault-seal.integration.test.cjs::the uncovered-commit suite builds a commit whose subject is an instruction-override phrase padded past the cap, modelling a hostile commit message, and asserts the subject leaving the seal leaf is controls-collapsed and bounded to SEAL_SUBJECT_CAP before it can reach a record; measured 1 pattern hit at HEAD 5ddb0b3 on 2026-10-12'
+  'tests/vault-standards.integration.test.cjs::the D-14 suites plant instruction-override lines in a standards document and in its INDEX description, each tagged with a random token, and assert that neither the token nor the phrase appears in any output of vault standards block or consulted, so the phrase must be a literal for the absence proof to mean anything; measured 6 pattern hits at HEAD 5ddb0b3 on 2026-10-12'
+  'SECURITY.md::the substring rule makes this exempt every path ending in SECURITY.md, including pp-core/templates/SECURITY.md and every per-phase threat register generated from that template; the breadth is accepted because a security policy is exactly where injection phrasing is legitimately quoted; measured 0 pattern hits across all 16 such files on disk at HEAD on 2026-09-19'
+  'TEST-EXAMPLES.md::documentation that demonstrates injection examples in order to explain what these scanners catch, so the example text is the point of the file rather than an attack; measured 1 pattern hit at HEAD on 2026-09-19'
+  'explanation/security-model.md::matches docs/explanation/security-model.md through the substring rule; it is the prose that explains the injection threat model and quotes the attack shapes pp-core defends against; measured 2 pattern hits at HEAD on 2026-09-19'
 )
 
 is_allowlisted() {

package/scripts/record-vault-mode-golden.cjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * scripts/record-vault-mode-golden.cjs — the vault-mode golden recorder
+ * (Vault Assurance v1.2, phase 13; MODE-01, PARK-04; D-01).
+ *
+ *   --write   record every enablement cell (key absent — the canonical
+ *             recording), normalise, and write tests/fixtures/vault-mode-golden/<cell>.json
+ *   --check   record the same and compare against the committed files; print
+ *             every differing path and exit 1 on any difference
+ *
+ * Neither or both flags: usage, exit 2. No path argument: the golden directory
+ * is the harness's `GOLDEN_DIR`, so the recorder and the test cannot disagree
+ * about where the goldens live.
+ *
+ * A THIN CLI. Every fixture, capture, normalisation and comparison rule lives in
+ * the shared harness module required below, which the golden test requires too.
+ * This script is never run by the test suite: a re-record is a deliberate,
+ * reviewable re-baseline (D-01), and it must run on a tree whose practices-mode
+ * behaviour is the one being pinned.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const harness = require('../tests/helpers/vault-mode-golden-harness.cjs');
+
+const ROOT = path.resolve(__dirname, '..');
+const USAGE = 'usage: record-vault-mode-golden.cjs (--write | --check)';
+
+function describeDiff(d) {
+  const at = d.firstDiffAt === undefined ? '' : ` (first differing byte at ${d.firstDiffAt})`;
+  const show = (v) => (v === undefined ? '<absent>' : JSON.stringify(v).slice(0, 200));
+  return `  ${d.path}${at}\n    expected: ${show(d.expected)}\n    actual:   ${show(d.actual)}`;
+}
+
+function main() {
+  const write = process.argv.includes('--write');
+  const check = process.argv.includes('--check');
+  if (write === check) {
+    console.error(USAGE);
+    process.exitCode = 2;
+    return;
+  }
+
+  let failed = 0;
+  for (const cell of harness.ENABLEMENT_CELLS) {
+    const raw = harness.recordCell({ cell: cell.name, modeKey: harness.KEY_CONFIGS.absent });
+    const normalised = harness.normaliseRecording(raw);
+    const count = Object.keys(normalised.commands).length;
+    const dropped = Object.entries(raw.meta.droppedHookCounts)
+      .map(([id, n]) => `${id}=${n}`)
+      .join(' ');
+    const target = harness.goldenPathFor(cell.name);
+    const rel = path.relative(ROOT, target);
+    console.log(`${cell.name}: ${count} commands recorded (render-hooks projection dropped: ${dropped})`);
+
+    if (write) {
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.writeFileSync(target, harness.serialise(normalised), 'utf8');
+      console.log(`  wrote ${rel}`);
+      continue;
+    }
+
+    let expected;
+    try {
+      expected = JSON.parse(fs.readFileSync(target, 'utf8'));
+    } catch (e) {
+      console.error(`  FAIL: ${rel} could not be read as JSON (${e.message})`);
+      failed++;
+      continue;
+    }
+    const { equal, diffs } = harness.compareRecordings(expected, normalised);
+    if (equal) {
+      console.log(`  matches ${rel}`);
+    } else {
+      failed++;
+      console.error(`  FAIL: ${rel} differs at ${diffs.length} path(s):`);
+      for (const d of diffs) console.error(describeDiff(d));
+    }
+  }
+
+  if (check && failed > 0) {
+    console.error(`\nFAIL: ${failed} golden cell(s) differ from a fresh recording.`);
+    process.exitCode = 1;
+  }
+}
+
+main();

package/scripts/sync-manifest-versions.cjs

@@ -11,10 +11,11 @@
  *   - VERSIONED_MANIFESTS — JSON runtime-integration manifests whose top-level
  *     `version` field MUST track the package version.
  *   - VERSIONED_TEXT_FILES — plain-text manifests whose ENTIRE content is the
- *     version followed by one newline.  Root `VERSION` is the repo layout's
- *     version source for `resolveCreatedWith` (src/compose-bindings.cts), so a
- *     repo build stamps `createdWith` from it.  As a plain-text file it could not
- *     join the JSON loop, so nothing kept it in step with package.json.
+ *     version followed by one newline.  Root `VERSION` is the repo layout's only
+ *     version source for `resolveCreatedWithFrom` (src/compose-bindings.cts), so a
+ *     repo build stamps `createdWith` and the practices block from it.  It drifted
+ *     from 1.11.1 through three releases because a plain-text file could not join
+ *     the JSON loop (quick 261003-kmd closed the todo).
  *
  * Usage:
  *   node scripts/sync-manifest-versions.cjs           # stamp + report

package/scripts/sync-rulesets.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-REPO="${REPO:-open-gsd/gsd-core}"
+REPO="${REPO:-pareto000/pp-core}"
 ENFORCEMENT="${ENFORCEMENT:-evaluate}"
 
 case "$ENFORCEMENT" in