@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/bin/lib/config-loader.cjs

@@ -43,9 +43,6 @@ const model_catalog_cjs_1 = require("./model-catalog.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const federatedConfigModule = require("./federated-config.cjs");
 const { mergeFederatedConfig } = federatedConfigModule;
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const capabilityActivationModule = require("./capability-activation.cjs");
-const { activationConfigFilesFor } = capabilityActivationModule;
 // The capability-registry.cjs is generated and lives in the same gsd-core/bin/lib/ output dir.
 // Both config-loader.cjs and capability-registry.cjs land in gsd-core/bin/lib/ at build time.
 // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
@@ -373,16 +370,16 @@ function _readsGlobalDefaults(cwd, ws) {
 }
 /**
  * Every config file `loadConfig(cwd, options)` reads, as absolute paths in read
- * order. ONE owner of "which config files does the loader read": `loadConfig`
- * takes its paths from the same `_configPathsFor`, so a reader that must refuse
- * an unreadable config (`unreadableConfigFiles` below) parses exactly these
- * files without restating the workstream ladder.
+ * order (16-04, D-28). ONE owner of "which config files does the gate read":
+ * `loadConfig` takes its paths from the same `_configPathsFor`, so a reader that
+ * must refuse an unreadable config (`vaultAdmissionVerdict` in src/vault.cts)
+ * can parse exactly these files without restating the workstream ladder.
  *
  * Why a caller needs it: `loadConfig` swallows a parse failure in every one of
  * these files (root → "workstream config stands alone", active → the defaults),
- * so its RESULT cannot say whether it read the project's config or read
- * nothing. Files that do not exist are still listed; absence is not a failure
- * for `loadConfig`, and the caller decides what it means.
+ * so its RESULT cannot say whether the gate read the project's config or read
+ * nothing (research C-4). Files that do not exist are still listed; absence is
+ * not a failure for `loadConfig`, and the caller decides what it means.
  */
 function configFilesFor(cwd, options = {}) {
     const ws = _activeWorkstreamFor(options);
@@ -395,97 +392,6 @@ function configFilesFor(cwd, options = {}) {
         files.push(_globalDefaultsPath());
     return files;
 }
-/** The error text is bounded; composed text never reaches the cap, but it holds anyway. */
-const UNREADABLE_ERROR_CAP = 200;
-/**
- * Describe why a config file could not be used WITHOUT echoing it. V8's
- * `JSON.parse` messages sometimes quote the input (`Unexpected token '}',
- * "{"a":tru}" is not valid JSON`), so only the position is carried over.
- */
-function _describeConfigReadFailure(err) {
-    const e = err;
-    if (e && typeof e.code === 'string' && /^[A-Z][A-Z0-9_]*$/.test(e.code))
-        return `cannot be read (${e.code})`;
-    const message = e && typeof e.message === 'string' ? e.message : '';
-    const lineCol = /\(line (\d+) column (\d+)\)/.exec(message);
-    if (lineCol)
-        return `not valid JSON (line ${lineCol[1]}, column ${lineCol[2]})`;
-    const position = /at position (\d+)/.exec(message);
-    if (position)
-        return `not valid JSON (at position ${position[1]})`;
-    if (/Unexpected end of JSON input/.test(message))
-        return 'not valid JSON (the text ends before the JSON does)';
-    return 'not valid JSON';
-}
-/** How a refusal names a config file: never an absolute user path. */
-function _configDisplayPath(cwd, abs) {
-    const under = (base) => {
-        const rel = node_path_1.default.relative(base, abs);
-        return rel !== '' && !rel.startsWith('..') && !node_path_1.default.isAbsolute(rel) ? rel.split(node_path_1.default.sep).join('/') : null;
-    };
-    const inProject = under(cwd);
-    if (inProject !== null)
-        return inProject;
-    const homeOverride = process.env['GSD_HOME'];
-    const inHomeOverride = homeOverride ? under(homeOverride) : null;
-    if (inHomeOverride !== null)
-        return `$GSD_HOME/${inHomeOverride}`;
-    const inHome = under(node_os_1.default.homedir());
-    if (inHome !== null)
-        return `~/${inHome}`;
-    return node_path_1.default.basename(abs);
-}
-/**
- * Every config file the hook resolver would read that EXISTS but cannot be
- * used: unreadable, not JSON, or JSON that is not an object (`loadConfig`
- * reads none of an array's or a null's keys and answers the defaults, the same
- * silent fallback as a parse failure). Empty when every file is usable or
- * absent: a MISSING config is a fresh project and reads as the defaults.
- *
- * The files are the union, in first-seen order, of the loader's list
- * (`configFilesFor`) and the activation resolver's raw levels
- * (`activationConfigFilesFor`, which can name a root config the loader never
- * opens under `GSD_PROJECT`). Reads go through `platformReadSync`, the reader
- * `loadConfig` uses, so a file the loader can read is never called unreadable.
- *
- * This is the ONE owner of "can the project's config be read". Both swallowing
- * readers (`loadConfig`, `resolveConfigKey`) stay tolerant for their many
- * callers; a caller whose answer governs a gate (`loop render-hooks`, the vault
- * load verdict) asks this first and refuses. Never throws.
- */
-function unreadableConfigFiles(cwd, options = {}) {
-    const out = [];
-    let files;
-    try {
-        files = [...new Set([...configFilesFor(cwd, options), ...activationConfigFilesFor(cwd)])];
-    }
-    catch (err) {
-        // An invalid GSD_WORKSTREAM / GSD_PROJECT segment: the config cannot be located, so it cannot be read.
-        return [{ file: '.planning/config.json', error: `cannot be located (${err instanceof Error ? err.message : String(err)})`.slice(0, UNREADABLE_ERROR_CAP) }];
-    }
-    for (const file of files) {
-        let error = null;
-        try {
-            const raw = (0, shell_command_projection_cjs_1.platformReadSync)(file);
-            if (raw === null)
-                continue;
-            const parsed = JSON.parse(raw);
-            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-                error = 'valid JSON but not an object, so none of its settings can be read';
-            }
-        }
-        catch (err) {
-            error = _describeConfigReadFailure(err);
-        }
-        if (error !== null)
-            out.push({ file: _configDisplayPath(cwd, file), error: error.slice(0, UNREADABLE_ERROR_CAP) });
-    }
-    return out;
-}
-/** One line per unreadable file, `<file>: <error>`, for a refusal message. */
-function describeUnreadableConfig(unreadable) {
-    return unreadable.map((u) => `${u.file}: ${u.error}`).join('; ');
-}
 function loadConfig(cwd, options = {}) {
     // When GSD_WORKSTREAM is set, load root config first so workstream config
     // can inherit from it. This prevents users from duplicating model_overrides,
@@ -839,8 +745,6 @@ function loadConfig(cwd, options = {}) {
 module.exports = {
     loadConfig,
     configFilesFor,
-    unreadableConfigFiles,
-    describeUnreadableConfig,
     isGitIgnored,
     CONFIG_DEFAULTS,
     _getConfigDefault,

package/pp-core/bin/lib/config-schema.cjs

@@ -29,7 +29,7 @@ function isCapabilityConfigKey(keyPath) {
 /**
  * The declared `values` of a capability `type: "enum"` config key, or `null`
  * when the key is not a capability key, is not an enum, or carries no value
- * list. 13-05 / D-07: this is the ONE lookup of enum values —
+ * list. Vault Assurance 13-05 / D-07: this is the ONE lookup of enum values —
  * `config-set` asks it rather than restating any list, so the registry stays
  * the single source of what an enum key may hold.
  */

package/pp-core/bin/lib/config.cjs

@@ -29,9 +29,14 @@ const { VALID_PROFILES, getAgentToModelMapForProfile, formatAgentToModelMapAsTab
 const configSchema = require("./config-schema.cjs");
 const { VALID_CONFIG_KEYS, isValidConfigKey, capabilityEnumValues } = configSchema;
 const secrets_cjs_1 = require("./secrets.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const capabilityActivation = require("./capability-activation.cjs");
+// GATE-05: reuse the activation resolver's flat-form lookup rather than growing
+// a second copy of the rule here. capability-activation.cjs depends only on
+// planning-workspace.cjs and node builtins, so this import adds no cycle.
+const { _getFlatConfigValue } = capabilityActivation;
 const review_reviewer_selection_cjs_1 = require("./review-reviewer-selection.cjs");
 const configuration_cjs_1 = require("./configuration.cjs");
-const phase_tier_cjs_1 = require("./phase-tier.cjs");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const CONFIG_KEY_SUGGESTIONS = {
     'workflow.nyquist_validation_enabled': 'workflow.nyquist_validation',
@@ -465,6 +470,20 @@ function setConfigValues(cwd, entries) {
         }
     });
 }
+/**
+ * The complete `init.probe_status` vocabulary, as `pp-tools config-set`
+ * enforces it (07-11 / WR-04).
+ *
+ * The vocabulary's OWNER is `INIT_PROBE_STATUS` in `init-contract.cts`, which
+ * is where the record writers (`--record-probe` / `--defer-probe`) take it
+ * from. This is a deliberate copy, not a re-export: `config.cts` is a leaf and
+ * `init-contract.cjs` pulls in capability-activation, compose-bindings and
+ * org-profile, so importing it here would introduce a leaf-to-adapter edge.
+ * What keeps the copy honest is the two-direction parity test in
+ * `tests/config.test.cjs` — widening either vocabulary without the other
+ * reddens it.
+ */
+const VALID_INIT_PROBE_STATUSES = Object.freeze(['passed', 'failed', 'deferred']);
 /**
  * The ONE membership test every enum guard in `cmdConfigSet` asks (13-REVIEW
  * CR-01). The raw value is parsed before the guards — `true`/`false`/numbers
@@ -485,14 +504,21 @@ function isStringMember(list, value) {
  * (`"FALSE"`, `"no"`, `"off"`) or a number. `capability-activation`'s
  * `_resolveActivationValue` ends in `Boolean(r.value)`, so those strings read as
  * ON — an operator typing `config-set vault.enabled FALSE` to switch the vault
- * off instead ARMED every step `capabilities/vault` hangs on that key, against
- * the constraint that a `vault.enabled=false` project stays completely inert.
+ * off instead ARMED the two `blocking: true` / `onError: halt` gates
+ * `capabilities/vault` hangs on that key, against CLAUDE.md's constraint that a
+ * `vault.enabled=false` project stays completely inert.
  *
- * The list, not ten copies of the same `if`: the first seven are capability
- * activation keys read through that `Boolean()` (the vault switches plus every
- * key that gates a blocking hook in the shipped registry). The last three were already guarded individually and are folded in here
- * unchanged, message included, so there is one mechanism in this file rather
- * than two.
+ * The list, not eleven copies of the same `if`: the first eight are every key
+ * that gates a blocking hook through that `Boolean()` read, and
+ * `tests/config.test.cjs` DERIVES that requirement from the shipped capability
+ * registry, so a future blocking gate on a new key reddens until it joins.
+ * `vault.required` is the recorded 02-SECURITY UF-01 instance of the same
+ * defect: its READ path already refuses a non-boolean (`booleanPolicyValue` in
+ * `src/org-profile.cts`), but the CLI door still answered `{"updated": true}` for a
+ * value the reader would then discard — the exact "reports success, changes
+ * nothing" shape UF-01 was opened for. The last three were already guarded
+ * individually and are folded in here unchanged, message included, so there is
+ * one mechanism in this file rather than two.
  *
  * REFUSE, do not normalise: `FALSE` plainly means false, but `1`, `enabled` and
  * `on` are guesses, and a config-set that silently rewrites the operator's word
@@ -501,8 +527,8 @@ function isStringMember(list, value) {
  */
 const BOOLEAN_ONLY_CONFIG_KEYS = Object.freeze([
     'vault.enabled',
-    'vault.required',
     'vault.practices_enabled',
+    'vault.required',
     'workflow.schema_drift_gate',
     'workflow.nyquist_validation',
     'workflow.security_enforcement',
@@ -578,10 +604,6 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     if (kp === 'ship.pr_body_sections') {
         validateShipPrBodySections(parsedValue);
     }
-    // Phase ceremony tier (pack 9) — enum, src/phase-tier.cts owns the list
-    if (kp === 'phase.tier' && !isStringMember(phase_tier_cjs_1.PHASE_TIERS, parsedValue)) {
-        error(`Invalid phase.tier '${val}'. Valid values: ${phase_tier_cjs_1.PHASE_TIERS.join(', ')}`, ERROR_REASON.CONFIG_INVALID_VALUE);
-    }
     // Human verification checkpoint mode (#3309)
     const VALID_HUMAN_VERIFY_MODES = ['mid-flight', 'end-of-phase'];
     if (kp === 'workflow.human_verify_mode' && !isStringMember(VALID_HUMAN_VERIFY_MODES, parsedValue)) {
@@ -601,14 +623,27 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     if (kp === 'code_quality.fallow.profile' && !isStringMember(VALID_FALLOW_PROFILES, parsedValue)) {
         error(`Invalid code_quality.fallow.profile '${val}'. Valid values: ${VALID_FALLOW_PROFILES.join(', ')}`);
     }
+    // init.probe_status enum validation (07-11 / WR-04). 07-02 registered the
+    // four `init.probe_*` keys so config-set would not reject them as unknown;
+    // two shipped descriptions then claimed an out-of-vocabulary value "is
+    // refused at write time", which was true only of the record writers. This
+    // guard makes the claim true on this path too. Membership is tested on the
+    // parsed value's TYPE as well (13-REVIEW CR-01): `true`/`false`/numbers are
+    // coerced above and a `[`/`{` value is JSON-parsed, so only a plain string
+    // can be a member. A VALID value set here is still accepted — that is T-07-09's disclosed
+    // accepted residual, not an oversight.
+    if (kp === 'init.probe_status' && !isStringMember(VALID_INIT_PROBE_STATUSES, parsedValue)) {
+        error(`Invalid init.probe_status '${val}'. Valid values: ${VALID_INIT_PROBE_STATUSES.join(', ')}`, ERROR_REASON.USAGE);
+    }
     // plan_review.source_grounding_authority (#22) — enum
     const VALID_SOURCE_GROUNDING_AUTHORITIES = ['grep', 'intel', 'treesitter', 'lsp', 'scip'];
     if (kp === 'plan_review.source_grounding_authority' && !isStringMember(VALID_SOURCE_GROUNDING_AUTHORITIES, parsedValue)) {
         error(`Invalid plan_review.source_grounding_authority '${val}'. Valid values: ${VALID_SOURCE_GROUNDING_AUTHORITIES.join(', ')}`);
     }
-    // Capability enum keys, in ONE place (13-05, D-07). Measured 2026-10-09:
-    // `config-set workflow.code_review_depth bogus` wrote at exit 0, as did every
-    // other enum key, because no guard consulted the registry's declared `values`. This runs AFTER every
+    // Capability enum keys, in ONE place (Vault Assurance 13-05, D-07). Measured
+    // 2026-10-09: `config-set workflow.code_review_depth bogus` and
+    // `config-set vault.mode whatever` both wrote at exit 0, because no guard
+    // consulted the registry's declared `values`. This runs AFTER every
     // hand-coded guard above, so a key that already has its own guard
     // (`workflow.drift_action`) keeps its message byte-identical; the
     // registry, through `capabilityEnumValues`, is the only list consulted
@@ -618,8 +653,9 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     // The TYPE is checked before membership (13-REVIEW CR-01): a value starting
     // with `[` is JSON-parsed above, and `String(['standards']) === 'standards'`,
     // so a membership-only test let a one-element array through and wrote it —
-    // which `federated-config` silently reads back as the default for an enum
-    // key. Every declared capability enum value is a string, so a non-string
+    // which `resolveVaultMode` then refused on every vault command, and which
+    // `federated-config` silently reads back as the default for the other enum
+    // keys. Every declared capability enum value is a string, so a non-string
     // parse (array, object, number, boolean) can never be a member.
     const enumValues = capabilityEnumValues(kp);
     if (enumValues && !isStringMember(enumValues, parsedValue)) {
@@ -651,8 +687,7 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         output(maskedResult, raw, `${kp}=${masked}`);
         return;
     }
-    // Pack 6 D-07: the WRITTEN value stays raw; its echo (and the value it
-    // replaced) is display-safe.
+    // VAULT-EGRESS-1: the written value stays raw; the echo of it (and of the value it replaced) is display-safe.
     const shownValue = redactConfigCoordinates(kp, parsedValue);
     const shownResult = {
         ...setConfigValueResult,
@@ -662,15 +697,16 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     output(shownResult, raw, `${kp}=${String(shownValue)}`);
 }
 /**
- * Pack 6 D-07: the display-safe form of a config value about to be EMITTED,
- * for the config keys that hold a remote repo coordinate (the shared-tier repo,
- * `SHARED_REPO_CONFIG_KEY`). `keyPath` is the dotted path the value was read
- * at (`''` for the whole config): the key itself, or any ancestor object that
- * carries it, is projected through the one owner (`redactCloneTarget` in
- * src/vault.cts); every other value is returned untouched (and a
- * credential-free coordinate is unchanged by the owner). The file on disk and
- * every in-process reader keep the raw value. Lazily required, so this
- * module's load graph is unchanged.
+ * VAULT-EGRESS-1 (quick 261005-8py gap closure): the display-safe form of a
+ * config value about to be EMITTED, for the one config key that is a remote
+ * repo coordinate (the shared-tier repo, `SHARED_REPO_CONFIG_KEY`). `keyPath`
+ * is the dotted path the value was read at (`''` for the whole config): the
+ * key itself, or any ancestor whose object carries it, is projected through
+ * the ONE owner (`redactCloneTarget`, `src/vault.cts`); every other value is
+ * returned untouched. The file on disk and every in-process reader keep the
+ * raw value — this runs at emission only, the same posture `isSecretKey`
+ * masking already takes on this surface. The key is read from its owner
+ * module rather than written here (this file names no allowlisted key).
  */
 function redactConfigCoordinates(keyPath, value) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -688,7 +724,7 @@ function redactConfigCoordinates(keyPath, value) {
     if (value === null || typeof value !== 'object' || Array.isArray(value))
         return value;
     const copy = JSON.parse(JSON.stringify(value));
-    // The flat form: the whole dotted key written as one top-level property.
+    // GATE-05's flat form: the whole dotted key written as one top-level property.
     if (at.length === 0 && typeof copy[SHARED_REPO_CONFIG_KEY] === 'string') {
         copy[SHARED_REPO_CONFIG_KEY] = safe(copy[SHARED_REPO_CONFIG_KEY]);
     }
@@ -712,23 +748,77 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     }
     // After the error() guard, keyPath is narrowed to string.
     const kp = keyPath;
-    let config = {};
-    try {
-        if (node_fs_1.default.existsSync(configPath)) {
-            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+    /**
+     * 02-04: the fall-back tail shared by every `config-get` miss.
+     *
+     * PRECEDENCE — project config > org profile > `--default` > SCHEMA_DEFAULTS >
+     * error. This helper is only ever reached AFTER both dotted forms of the
+     * project read have missed, so project config outranking the profile is
+     * structural here rather than a comparison someone has to keep correct. That
+     * ordering is T-02-17's mitigation and is load-bearing: a fleet-wide profile
+     * must never be able to overrule what the project itself configured.
+     *
+     * Wiring this closes the gap `resolveVaultRequired` documents — the vault
+     * policy key's workflow line reads it through `config-get`, so before this
+     * existed a profile-seeded value reached that resolver's callers but never
+     * that workflow. (The key is named in `org-profile.cts`, not here: this file
+     * stays free of any allowlisted key literal so the "resolution is generic"
+     * check stays a meaningful grep.)
+     *
+     * NO KEY IS NAMED HERE, deliberately. `readProfileValue` self-gates on
+     * ORG_PROFILE_ALLOWLIST and does zero filesystem access for a key that is not
+     * on it, so consulting it on every miss is free for the overwhelmingly common
+     * non-allowlisted key and the wiring stays generic — adding a key to that
+     * allowlist is sufficient to make it readable here.
+     *
+     * Warnings go to fd 2 only; stdout stays byte-clean so `--raw` still emits a
+     * bare scalar (UIBR-02).
+     */
+    const missFallback = (missMessage, missReason) => {
+        // Call-time lazy require, matching org-profile.cts's own use of the pattern
+        // for git-provider.cjs. org-profile.cjs does not import config.cjs, so this
+        // adds no cycle — keep it that way.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const orgProfile = require('./org-profile.cjs');
+        let profileValue;
+        try {
+            const profile = orgProfile.readProfileValue(cwd, kp);
+            profileValue = profile.value;
+            for (const w of profile.warnings)
+                console.error('Warning: ' + w);
+        }
+        catch {
+            // A malformed or unreadable profile must never take down a config read
+            // that would otherwise have resolved a default. Degrade to "no profile".
+            profileValue = undefined;
+        }
+        if (profileValue !== undefined) {
+            const shownProfileValue = redactConfigCoordinates(kp, profileValue);
+            output(shownProfileValue, raw, String(shownProfileValue));
+            return;
         }
-        else if (hasDefault) {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
+        // eslint-disable-next-line @typescript-eslint/no-base-to-string
+        if (hasDefault) {
             output(defaultValue, raw, String(defaultValue));
             return;
         }
-        else if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
+        if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
             const def = SCHEMA_DEFAULTS[kp];
             output(def, raw, String(def));
             return;
         }
+        error(missMessage, missReason);
+    };
+    let config = {};
+    try {
+        if (node_fs_1.default.existsSync(configPath)) {
+            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        }
         else {
-            error('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
+            // No config.json at all: the profile still gets its turn before the
+            // defaults, or a config-less project could never see a profile value.
+            missFallback('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
+            return;
         }
     }
     catch (err) {
@@ -736,37 +826,35 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
             throw err;
         error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
     }
+    // GATE-05: the same dotted key may be written flat — one top-level property
+    // whose name contains dots — which the nested walk below cannot see. Resolved
+    // here as a FALLBACK only: the walk runs first and, when it finds a value,
+    // this is never consulted. Nested therefore wins whenever both forms are
+    // present, matching capability-activation.cjs's getConfigValueEitherForm so
+    // the two read paths a gate uses answer identically. The rejected-segment and
+    // hasOwnProperty guards live in that shared helper.
+    const flatFallback = _getFlatConfigValue(config, kp);
     // Traverse dot-notation path (e.g., "workflow.auto_advance")
     const keys = kp.split('.');
     let current = config;
     for (const key of keys) {
         if (current === undefined || current === null || typeof current !== 'object') {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
-            if (hasDefault) {
-                output(defaultValue, raw, String(defaultValue));
-                return;
-            }
-            if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-                const def = SCHEMA_DEFAULTS[kp];
-                output(def, raw, String(def));
-                return;
+            if (flatFallback.found) {
+                current = flatFallback.value;
+                break;
             }
-            error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+            missFallback(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+            return;
         }
         current = current[key];
     }
+    // GATE-05: the walk completed but resolved nothing — flat form gets its turn.
+    if (current === undefined && flatFallback.found) {
+        current = flatFallback.value;
+    }
     if (current === undefined) {
-        // eslint-disable-next-line @typescript-eslint/no-base-to-string
-        if (hasDefault) {
-            output(defaultValue, raw, String(defaultValue));
-            return;
-        }
-        if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-            const def = SCHEMA_DEFAULTS[kp];
-            output(def, raw, String(def));
-            return;
-        }
-        error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+        missFallback(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+        return;
     }
     // Never echo plaintext for sensitive keys via config-get. Plaintext lives
     // in config.json on disk; the CLI surface always shows the masked form.
@@ -775,7 +863,10 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
         output(masked, raw, masked);
         return;
     }
-    // Pack 6 D-07: a remote coordinate (or a section carrying one) is emitted display-safe.
+    // Pre-existing behaviour, now explicit: an object-valued key under --raw
+    // stringifies to '[object Object]'. Replacing the trailing `error()` (typed
+    // `never`) with the shared miss-tail cost TypeScript the narrowing that used
+    // to keep this quiet; the emitted bytes are unchanged.
     const shown = redactConfigCoordinates(kp, current);
     output(shown, raw, String(shown));
 }
@@ -880,6 +971,7 @@ function cmdMigrateConfig(cwd, raw) {
 }
 module.exports = {
     VALID_CONFIG_KEYS,
+    VALID_INIT_PROBE_STATUSES,
     BOOLEAN_ONLY_CONFIG_KEYS,
     cmdConfigEnsureSection,
     cmdConfigSet,
@@ -890,7 +982,7 @@ module.exports = {
     cmdMigrateConfig,
     // Exported for programmatic use by capability-writer and tests
     setConfigValue,
-    // Pack 6 D-07: `state load` emits the whole config through the same projection.
-    redactConfigCoordinates,
     setConfigValues,
+    // VAULT-EGRESS-1: `state load` emits the whole config through the same projection.
+    redactConfigCoordinates,
 };

package/pp-core/bin/lib/decisions.cjs

@@ -18,10 +18,10 @@ const DISCRETION_HEADINGS = new Set([
     'claude discretion',
 ]);
 const NON_TRACKABLE_TAGS = new Set(['informational', 'folded', 'deferred']);
-// ── The decision-bullet grammar ────────────────────────────────────────────────────────────────────────────
+// ── The decision-bullet grammar (260910-8ea) ────────────────────────────────
 //
 // Why a grammar rather than one regex: this repository writes THREE bullet
-// forms, and originally only the first was readable. The two others were
+// forms, and until 260910-8ea only the first was readable. The two others were
 // not exotic — they are what `discuss-phase` emits and what hand-authored
 // CONTEXT.md files use — so a parser that reads only form A hands a blocking
 // coverage gate an empty decision set and lets it report a clean pass. That is
@@ -111,7 +111,7 @@ function extractDecisionsBlock(content) {
  *
  * The second channel exists because "the block was empty" and "the parser
  * could not read any of it" are opposite situations that a coverage gate used
- * to report identically — as a clean pass on a total of zero.
+ * to report identically — as a clean pass on a total of zero (260910-8ea).
  */
 function parseDecisionsReport(content) {
     if (!content || typeof content !== 'string')
@@ -170,7 +170,7 @@ function parseDecisionsReport(content) {
         // be silently dropped — a narrowed trackable set lets a blocking coverage gate
         // report a false pass. Surface it loudly instead.
         //
-        // The miss is now recorded as DATA as well, so a gate can fail
+        // 260910-8ea: the miss is now recorded as DATA as well, so a gate can fail
         // on it rather than warning past it. The `console.warn` stays: the stderr
         // signal is what a human running the command by hand sees, and it is pinned
         // by the #1343 regression tests.