@pareto4/pp-core 1.13.0 → 1.18.0

package/scripts/dev-env.cjs

@@ -2,16 +2,16 @@
 'use strict';
 
 /**
- * dev-env.cjs — keep a stable pp-core install and a development build apart.
+ * dev-env.cjs — keep the global pp-core install and a development build apart.
+ * FORK-ONLY (PBI 74336)
  *
- *   stable [<tag>] [--dir <dir>] [--runtime <id>]  worktree on the latest release tag, installed --global
+ *   setup [--runtime <id>]                      build this checkout on its current branch, installed --global
  *   dev-setup [--config-dir <dir>] [--no-shell] npm ci, install the dev profile, put claude-dev on PATH
  *   install [--config-dir <dir>] [--no-build]   build, install into a separate Claude profile
  *   install --local [<dir>] [--no-build]        build, install into a sandbox project
  *   claude [--config-dir <dir>] [-- <args>]     start the Claude CLI on the dev profile
  *
- * Defaults: the worktree is pp-core-stable next to the main checkout; the profile is
- * PP_DEV_CONFIG_DIR, else ~/.claude-dev; the sandbox is ../pp-sandbox.
+ * Defaults: the profile is PP_DEV_CONFIG_DIR, else ~/.claude-dev; the sandbox is ../pp-sandbox.
  */
 
 const fs = require('node:fs');
@@ -25,27 +25,21 @@ const INSTALLER = path.join(ROOT, 'bin', 'install.js');
 
 const USAGE = [
   'Usage:',
-  '  npm run setup [-- [<tag>] [--dir <dir>] [--runtime <id>]]',
+  '  npm run setup [-- --runtime <id>]',
   '  npm run dev:setup [-- [--config-dir <dir>] [--no-shell]]',
   '  npm run dev:install [-- [--config-dir <dir>] [--no-build]]',
   '  npm run dev:install -- --local [<dir>] [--no-build]',
   '  npm run dev:claude [-- <claude args>]',
 ].join('\n');
 
-function parseStableArgs(rest) {
-  const opts = { command: 'stable', tag: null, dir: null, runtime: 'claude' };
+function parseSetupArgs(rest) {
+  const opts = { command: 'setup', runtime: 'claude' };
   for (let i = 0; i < rest.length; i++) {
     const arg = rest[i];
-    if (arg === '--dir') {
-      const value = rest[++i];
-      if (!value) return { error: '--dir requires a path' };
-      opts.dir = value;
-    } else if (arg === '--runtime') {
+    if (arg === '--runtime') {
       const value = rest[++i];
       if (!value) return { error: '--runtime requires a runtime id' };
       opts.runtime = value;
-    } else if (!arg.startsWith('-') && opts.tag === null) {
-      opts.tag = arg;
     } else {
       return { error: `unknown option: ${arg}` };
     }
@@ -72,7 +66,7 @@ function parseDevSetupArgs(rest) {
 
 function parseArgs(argv) {
   const [command, ...rest] = argv;
-  if (command === 'stable') return parseStableArgs(rest);
+  if (command === 'setup') return parseSetupArgs(rest);
   if (command === 'dev-setup') return parseDevSetupArgs(rest);
   if (command !== 'install' && command !== 'claude') {
     return { error: `unknown command: ${command === undefined ? '(none)' : command}` };
@@ -133,7 +127,7 @@ function resolveLocalDir(opts, root = ROOT) {
   return path.resolve(opts.localDir || path.join(root, '..', 'pp-sandbox'));
 }
 
-// The stable profile is ~/.claude; overwriting it with a dev build is what this script exists to avoid.
+// ~/.claude holds the global install from npm run setup; the dev routes never write there.
 function assertNotStableProfile(dir, home = os.homedir()) {
   if (samePath(dir, path.join(home, '.claude'))) {
     throw new ExitError(1, `Refusing to install a dev build into the stable profile ${dir}.`);
@@ -167,23 +161,6 @@ function git(args, cwd) {
   return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
 }
 
-// Highest vX.Y.Z (or X.Y.Z) tag; pre-release tags are skipped.
-function pickLatestTag(tags) {
-  const parsed = tags
-    .map((tag) => ({ tag, m: /^v?(\d+)\.(\d+)\.(\d+)$/.exec(tag) }))
-    .filter((t) => t.m)
-    .map((t) => ({ tag: t.tag, v: t.m.slice(1).map(Number) }));
-  parsed.sort((a, b) => b.v[0] - a.v[0] || b.v[1] - a.v[1] || b.v[2] - a.v[2]);
-  return parsed.length ? parsed[0].tag : null;
-}
-
-// Next to the main checkout, so running this from any worktree finds the same directory.
-function resolveStableDir(opts, repo = ROOT) {
-  if (opts.dir) return path.resolve(opts.dir);
-  const commonDir = path.resolve(repo, git(['rev-parse', '--git-common-dir'], repo));
-  return path.join(path.dirname(commonDir), '..', 'pp-core-stable');
-}
-
 // The runtimes install.js takes as --<id>, read from the capability manifests so no build is needed.
 function listRuntimes(root = ROOT) {
   const capDir = path.join(root, 'capabilities');
@@ -206,57 +183,22 @@ function resolveRuntime(id, root = ROOT) {
   return found;
 }
 
-function listWorktrees(repo) {
-  return git(['worktree', 'list', '--porcelain'], repo)
-    .split(/\r?\n/)
-    .filter((line) => line.startsWith('worktree '))
-    .map((line) => path.resolve(line.slice('worktree '.length)));
-}
-
-// Adds the worktree at the tag, or moves an existing clean one to it; never touches your own checkout.
-function prepareStableWorktree({ repo, dir, tag }) {
-  try {
-    git(['rev-parse', '--verify', '--quiet', `refs/tags/${tag}`], repo);
-  } catch {
-    throw new ExitError(1, `Tag ${tag} does not exist in ${repo}.`);
-  }
-  let known = listWorktrees(repo).some((w) => samePath(w, dir));
-  // A worktree folder deleted by hand stays registered; prune it so it is added again.
-  if (known && !fs.existsSync(dir)) {
-    git(['worktree', 'prune'], repo);
-    known = false;
-  }
-  if (!known) {
-    if (fs.existsSync(dir)) {
-      throw new ExitError(1, `${dir} exists but is not a worktree of ${repo}; pass --dir <other dir>.`);
-    }
-    git(['worktree', 'add', '--detach', dir, tag], repo);
-    return;
-  }
-  if (git(['status', '--porcelain'], dir) !== '') {
-    throw new ExitError(1, `The stable worktree ${dir} has local changes; commit or discard them first.`);
-  }
-  git(['checkout', '--quiet', '--detach', tag], dir);
-}
-
-function installStable(opts) {
+// Installs the checkout this runs from, so the global install follows its current branch.
+function installSetup(opts) {
   const runtime = resolveRuntime(opts.runtime);
   npmCliPath();
-  const dir = resolveStableDir(opts);
-  try {
-    git(['fetch', '--tags', '--quiet', 'origin'], ROOT);
-  } catch {
-    process.stderr.write('Could not fetch tags from origin; using the tags already in this clone.\n');
-  }
-  const tag = opts.tag || pickLatestTag(git(['tag', '--list'], ROOT).split(/\r?\n/));
-  if (!tag) throw new ExitError(1, 'No release tag found; pass one: npm run setup -- <tag>.');
-  prepareStableWorktree({ repo: ROOT, dir, tag });
-  process.stdout.write(`Stable worktree ${dir} is on ${tag}.\n`);
-  runNpm(['ci'], dir);
-  runNpm(['run', 'build'], dir);
-  execFileSync(process.execPath, [path.join(dir, 'bin', 'install.js'), `--${runtime.id}`, '--global'], { cwd: dir, stdio: 'inherit' });
+  runNpm(['ci'], ROOT);
+  runBuild();
+  execFileSync(process.execPath, [INSTALLER, `--${runtime.id}`, '--global'], { cwd: ROOT, stdio: 'inherit' });
   const again = runtime.id === 'claude' ? 'npm run setup' : `npm run setup -- --runtime ${runtime.id}`;
-  process.stdout.write(`\npp-core ${tag} is installed as the global pp-core for ${runtime.title}. Update later with: ${again}\n`);
+  process.stdout.write(`
+pp-core from ${describeCheckout(devBuildInfo())} is installed as the global pp-core for ${runtime.title}. Update later with: ${again}
+`);
+}
+
+function describeCheckout(info) {
+  const ref = info.commit ? `${info.branch || 'detached HEAD'}@${info.commit}` : info.checkout;
+  return info.dirty ? `${ref} (with uncommitted changes)` : ref;
 }
 
 // The statusline shows a DEV badge with this build's branch and commit when this file is present.
@@ -429,7 +371,7 @@ function main(argv = process.argv.slice(2)) {
   if (opts.error) throw new ExitError(2, `${opts.error}\n${USAGE}`);
   if (opts.command === 'claude') return launchClaude(opts);
   if (opts.command === 'dev-setup') devSetup(opts);
-  else if (opts.command === 'stable') installStable(opts);
+  else if (opts.command === 'setup') installSetup(opts);
   else if (opts.local) installSandbox(opts);
   else installProfile(opts);
   return 0;
@@ -441,9 +383,9 @@ module.exports = {
   parseArgs,
   resolveConfigDir,
   resolveLocalDir,
-  resolveStableDir,
   resolveLaunchDir,
   devBuildInfo,
+  describeCheckout,
   renderRcLauncher,
   upsertLauncher,
   windowsLauncherDir,
@@ -452,10 +394,8 @@ module.exports = {
   writeWindowsLaunchers,
   pathHasEntry,
   appendPathEntry,
-  pickLatestTag,
   listRuntimes,
   resolveRuntime,
-  prepareStableWorktree,
   assertNotStableProfile,
   assertOutsideRepo,
   samePath,

package/scripts/gen-capability-registry.cjs

@@ -568,6 +568,18 @@ function validateFeatureBody(cap) {
     }
   }
 
+  // Quick 261015-ect (QD-13): requiresPlatformBindings, optional. When present it
+  // must be a boolean; the loop resolver drops every hook of a capability that
+  // declares `true` on a project with no .platform-bindings.json. Which
+  // capabilities MUST declare it is a cross-capability rule
+  // (validatePlatformBindingsField).
+  if (cap.requiresPlatformBindings !== undefined && typeof cap.requiresPlatformBindings !== 'boolean') {
+    errors.push(
+      'capability "' + (cap.id || '(unknown)') + '" requiresPlatformBindings must be a boolean (got: ' +
+      JSON.stringify(cap.requiresPlatformBindings) + ')',
+    );
+  }
+
   return errors;
 }
 
@@ -1204,17 +1216,6 @@ function validateGate(gate, prefix) {
     if (count !== 1) {
       errors.push(prefix + '.check must have exactly one of: query, predicate, agentVerdict');
     }
-    // check.args: literal tokens `loop run-gates` appends after the phase — query gates only,
-    // at most 8, each a flag or a plain word (the runner refuses anything else at run time too).
-    if (Object.prototype.hasOwnProperty.call(gate.check, 'args')) {
-      const a = gate.check.args;
-      if (!hasQuery) {
-        errors.push(prefix + '.check.args is only valid beside check.query');
-      } else if (!Array.isArray(a) || a.length > 8
-        || !a.every((t) => typeof t === 'string' && /^(?:--[a-z][a-z0-9-]*|[a-z0-9][a-z0-9._-]*)$/i.test(t))) {
-        errors.push(prefix + '.check.args must be an array of at most 8 flags (--name) or plain words');
-      }
-    }
     // agentVerdict forces blocking: false (advisory only)
     if (hasAgentVerdict && gate.blocking === true) {
       errors.push(
@@ -1246,8 +1247,7 @@ function validateGate(gate, prefix) {
  *   - contribution.into ∈ step's agentRoles, OR contribution.into names an agent
  *     already registered by some capability's own `agents` array (a non-pipeline
  *     consumer of the same loop point, e.g. code-review.md reading execute:post
- *     alongside execute-phase.md — see capabilities/vault-practices's
- *     execute:post -> pp-code-reviewer contribution)
+ *     alongside execute-phase.md)
  *   - when references a config key in cap.config
  *
  * NOTE: step.consumes satisfiability is NOT checked here — it requires the full
@@ -1330,6 +1330,102 @@ function validateAgainstContract(cap, capId, knownAgentIds) {
   return errors;
 }
 
+/**
+ * Quick 261015-ect (QD-13): the vault-family rule for `requiresPlatformBindings`,
+ * A capability that is `vault` or
+ * lists `vault` in `requires` MUST declare the field, so a vault-family
+ * capability added later cannot render hooks on a project the vault does not
+ * govern by forgetting it. A capability outside the family may declare it too.
+ *
+ * @param {Map<string, object>} capMap
+ * @returns {string[]} error strings; empty = all pass
+ */
+function validatePlatformBindingsField(capMap) {
+  const errors = [];
+  for (const [capId, cap] of capMap) {
+    if (!cap || typeof cap !== 'object') continue;
+    const requiresVault = Array.isArray(cap.requires) && cap.requires.includes('vault');
+    if (capId !== 'vault' && !requiresVault) continue;
+    if (!Object.prototype.hasOwnProperty.call(cap, 'requiresPlatformBindings')) {
+      errors.push(
+        'capability "' + capId + '" is vault or requires vault and must declare requiresPlatformBindings, ' +
+        'so a vault-family capability cannot render hooks on a project the vault does not govern',
+      );
+    }
+  }
+  return errors;
+}
+
+/**
+ * Phase 16 D-19: the per-hook seal field's name. The resolver reads it as
+ * `SEAL_FIELD` from capability-state; this generator cannot require that module
+ * (its load graph reaches surface.cjs and config-loader.cjs, which read the
+ * very registry this script regenerates), so the literal is restated here and
+ * pinned equal to `SEAL_FIELD` by tests/capability-registry.test.cjs.
+ */
+const SEAL_FIELD_NAME = 'onRecordedArtifacts';
+
+/**
+ * Phase 16 D-19 / D-25 / D-26: validate the per-hook seal field.
+ *
+ * A gate carrying the field renders for an enabled, config-inactive capability
+ * over recorded vault artifacts, bypassing the capability's active check and
+ * its `when` (D-18). That is a widening of render behaviour, so the field is
+ * closed HERE, at generation, to exactly the shape the shipped seal gate has.
+ * Five rules, each reported on its own:
+ *   (a) gates only (a step or contribution carrying it is refused);
+ *   (b) the value is literal `true` (`"true"`, `1`, `null`, `false` refused);
+ *   (c) the declaring capability is `vault` or lists `vault` in `requires`.
+ *       A seal gate never dispatches twice: the resolver drops it whenever its
+ *       capability is active, so it renders only with the vault switched off;
+ *   (d) the gate is `blocking: true`;
+ *   (e) the point is `ship:pre` (D-21: the requirement's block point; a seal at
+ *       verify:post would halt execute-phase on a switch set on purpose).
+ *
+ * Presence is own-property presence.
+ *
+ * @param {Map<string, object>} capMap
+ * @returns {string[]} error strings; empty = all pass
+ */
+function validateSealField(capMap) {
+  const errors = [];
+  const KINDS = [['steps', 'step'], ['contributions', 'contribution'], ['gates', 'gate']];
+  for (const [capId, cap] of capMap) {
+    if (!cap || typeof cap !== 'object') continue;
+    const prefix = 'capability "' + capId + '"';
+    const requiresVault = Array.isArray(cap.requires) && cap.requires.includes('vault');
+    for (const [arrKey, kind] of KINDS) {
+      const arr = Array.isArray(cap[arrKey]) ? cap[arrKey] : [];
+      for (const hook of arr) {
+        if (!hook || typeof hook !== 'object') continue;
+        if (!Object.prototype.hasOwnProperty.call(hook, SEAL_FIELD_NAME)) continue;
+        const where = prefix + ' ' + kind + ' at point "' + String(hook.point) + '"';
+        const value = hook[SEAL_FIELD_NAME];
+        if (kind !== 'gate') {
+          errors.push(where + ': ' + SEAL_FIELD_NAME + ' is allowed on gates only');
+          continue;
+        }
+        if (value !== true) {
+          errors.push(where + ': ' + SEAL_FIELD_NAME + ' must be literal true (got ' + JSON.stringify(value) + ')');
+        }
+        if (capId !== 'vault' && !requiresVault) {
+          errors.push(
+            where + ': ' + SEAL_FIELD_NAME + ' is allowed only on the "vault" capability or a capability that ' +
+            'lists "vault" in requires',
+          );
+        }
+        if (hook.blocking !== true) {
+          errors.push(where + ': a gate carrying ' + SEAL_FIELD_NAME + ' must be blocking: true');
+        }
+        if (hook.point !== 'ship:pre') {
+          errors.push(where + ': ' + SEAL_FIELD_NAME + ' is allowed only at point "ship:pre"');
+        }
+      }
+    }
+  }
+  return errors;
+}
+
 /**
  * C1+C2: Global consumes-satisfiability validation.
  *
@@ -1490,6 +1586,14 @@ const TIER_RANK = { core: 0, standard: 1, full: 2 };
 function validateCrossCapability(capMap, centralKeys) {
   const errors = [];
 
+  // Phase 16 D-19: the per-hook seal field (needs capMap for every capability's
+  // `requires`).
+  errors.push(...validateSealField(capMap));
+
+  // Quick 261015-ect (QD-13): every vault-family capability declares
+  // requiresPlatformBindings (needs capMap for every capability's `requires`).
+  errors.push(...validatePlatformBindingsField(capMap));
+
   // Ownership: one owner per skill stem + agent name
   const skillOwner = new Map(); // skill → capId
   const agentOwner = new Map(); // agent → capId
@@ -2657,6 +2761,9 @@ module.exports = {
   validateAgainstContract,
   validateConsumesGlobal,
   validateCrossCapability,
+  validateSealField,
+  validatePlatformBindingsField,
+  SEAL_FIELD_NAME,
   classifyCrossErrors,
   loadCentralConfigKeys,
   loadAndValidate,

package/scripts/lib/allowlist-ratchet.cjs

@@ -233,106 +233,4 @@ function assertFileBaseline({ label, current, baseline, fail, updateHint }) {
   return { grown, shrunk, added, removed };
 }
 
-/**
- * Assert that each artifact's measured size stays within a per-change DELTA
- * BUDGET of its committed baseline (workflow size budget policy, 2026-10-11).
- *
- * Unlike `assertFileBaseline` (exact-byte pins), small growth is absorbed by a
- * slack so routine edits need no baseline commit, while large or cumulative
- * growth still fails by name:
- *
- * - A file may exceed its baseline by at most `perFileSlack` bytes.
- * - The SUM of all positive overages may not exceed `totalSlack` bytes, so many
- *   small growths cannot add up to a large one unseen.
- * - Shrinking always passes and never needs a baseline commit.
- * - A file with no baseline entry (ADDED) or a baseline entry with no file
- *   (REMOVED) fails: the baseline must name exactly the files on disk.
- *   Recording either needs no reason.
- * - An EMPTY baseline fails: with no entries every file is "added", but an
- *   explicit message makes the vacuous-pass case impossible to misread.
- *
- * Overage is measured against the committed baseline, not the previous commit,
- * so the slack is a budget that a re-baseline resets — not a per-commit
- * allowance that can be spent again on every commit.
- *
- * @param {object} opts
- * @param {string} opts.label - Guard name (used in messages).
- * @param {Object<string, number>} opts.current  - Measured sizes by name.
- * @param {Object<string, number>} opts.baseline - Committed sizes by name
- *                                  (numbers only; strip metadata keys first).
- * @param {number} opts.perFileSlack - Max bytes one file may exceed its baseline.
- * @param {number} opts.totalSlack   - Max sum of all positive overages.
- * @param {function(string): void} opts.fail - Invoked once per violation category.
- * @param {string} [opts.updateHint] - Remediation hint appended to growth failures.
- * @returns {{ overages: Array<{name:string,from:number,to:number,delta:number}>,
- *             totalOverage: number,
- *             shrunk: Array<{name:string,from:number,to:number,delta:number}>,
- *             added: string[], removed: string[] }}
- */
-function assertDeltaBudget({ label, current, baseline, perFileSlack, totalSlack, fail, updateHint }) {
-  const currentNames = new Set(Object.keys(current));
-  const baselineNames = new Set(Object.keys(baseline));
-  const hint = updateHint ? `\n${updateHint}` : '';
-
-  if (baselineNames.size === 0) {
-    fail(
-      `[${label}] the committed baseline has no size entries — an empty baseline would make ` +
-        `every growth check pass vacuously. Regenerate it with \`npm run size:baseline\`.`
-    );
-  }
-
-  const added = [...currentNames].filter((n) => !baselineNames.has(n)).sort();
-  const removed = [...baselineNames].filter((n) => !currentNames.has(n)).sort();
-
-  const overages = [];
-  const shrunk = [];
-  for (const name of [...currentNames].filter((n) => baselineNames.has(n)).sort()) {
-    const from = baseline[name];
-    const to = current[name];
-    if (!Number.isInteger(from) || from < 0) {
-      fail(`[${label}] baseline entry ${name} is not a non-negative integer byte size: ${JSON.stringify(from)}`);
-      continue;
-    }
-    if (to > from) overages.push({ name, from, to, delta: to - from });
-    else if (to < from) shrunk.push({ name, from, to, delta: from - to });
-  }
-  const totalOverage = overages.reduce((sum, o) => sum + o.delta, 0);
-  const fmt = (o) => `  - ${o.name}: ${o.from} → ${o.to} (+${o.delta})`;
-
-  const overFile = overages.filter((o) => o.delta > perFileSlack);
-  if (overFile.length > 0) {
-    fail(
-      `[${label}] ${overFile.length} file(s) grew more than the per-file slack of ${perFileSlack} bytes ` +
-        `past the committed baseline. Shrink them (extract content lazily), or re-baseline with a ` +
-        `reason: npm run size:baseline -- --reason "<why this growth is needed>"\n` +
-        `${overFile.map(fmt).join('\n')}${hint}`
-    );
-  }
-
-  if (totalOverage > totalSlack) {
-    fail(
-      `[${label}] total growth past the committed baseline is ${totalOverage} bytes, over the total ` +
-        `slack of ${totalSlack} bytes (each file may be under its own slack — the sum is what failed). ` +
-        `Shrink, or re-baseline with a reason: npm run size:baseline -- --reason "<why>"\n` +
-        `${overages.map(fmt).join('\n')}${hint}`
-    );
-  }
-
-  if (added.length > 0) {
-    fail(
-      `[${label}] ${added.length} file(s) are not in the baseline — run \`npm run size:baseline\` ` +
-        `to record them (no --reason needed for new files).\n${added.map((n) => `  - ${n}`).join('\n')}`
-    );
-  }
-
-  if (removed.length > 0) {
-    fail(
-      `[${label}] ${removed.length} baseline entry(ies) no longer exist — run \`npm run size:baseline\` ` +
-        `to drop them (no --reason needed).\n${removed.map((n) => `  - ${n}`).join('\n')}`
-    );
-  }
-
-  return { overages, totalOverage, shrunk, added, removed };
-}
-
-module.exports = { assertWithinAllowlist, assertTightCeiling, assertFileBaseline, assertDeltaBudget };
+module.exports = { assertWithinAllowlist, assertTightCeiling, assertFileBaseline };

package/scripts/lint-allow-test-rule-refs.allowlist.json

@@ -288,7 +288,6 @@
   "tests/read-guard.test.cjs :: source-text-is-the-product",
   "tests/reapply-patches.test.cjs :: source-text-is-the-product",
   "tests/reapply-verify-hunks.test.cjs :: source-text-is-the-product",
-  "tests/release-coverage-scope.test.cjs :: source-text-is-the-product",
   "tests/release-tarball-smoke-workflow.test.cjs :: source-text-is-the-product",
   "tests/release-tarball-smoke.install.test.cjs :: integration-test-input",
   "tests/research-agent-profiles.test.cjs :: <runtime-contract-is-the-product> research agent .md content is the governed surface",
@@ -321,7 +320,6 @@
   "tests/windows-test-parity-guard.test.cjs :: structural-regression-guard",
   "tests/workflow-compat.test.cjs :: source-text-is-the-product",
   "tests/workflow-guard-registration.test.cjs :: structural-regression-guard",
-  "tests/workflow-maintainer-skip.test.cjs :: source-text-is-the-product",
   "tests/workflow-shell-pinning.test.cjs :: file-scope prefilter, not a test assertion — we need to",
   "tests/workflow-size-budget.test.cjs :: source-text-is-the-product",
   "tests/workspace.test.cjs :: source-text-is-the-product",

package/scripts/lint-pr-check-project-dir.cjs

@@ -9,9 +9,7 @@ const { runMain } = require('./lib/cli-exit.cjs');
 const ROOT = path.join(__dirname, '..');
 
 const DEFAULT_RELATIVE_FILES = [
-  '.github/workflows/test.yml',
-  '.github/workflows/pr-template-format.yml',
-  '.github/workflows/changeset-required.yml',
+  '.github/workflows/ci.yml',
   'scripts/lint-command-contract.cjs',
   'scripts/lint-skill-deps.cjs',
   'scripts/lint-descriptions.cjs',

package/scripts/lint-test-file-count.allowlist.json

@@ -179,30 +179,14 @@
     },
     "vault": {
       "files": [
-        "vault-practices.property.test.cjs",
+        "feat-71924-vault-required-gate.test.cjs",
+        "vault-doors.integration.test.cjs",
         "vault-read-path.test.cjs",
         "vault-security.test.cjs",
         "vault-status-check.test.cjs",
         "vault.test.cjs"
       ],
-      "issue": "v1.7.0 Client Vault Load — four distinct concerns: vault.test (fetch/status/summary unit), vault-security (VSEC-02/03 write-guard + secret/fence), vault-read-path (VGATE-03 SUMMARY pointer), vault-status-check (VGATE-02 gate-query handler). Phase 24-02 added vault-practices.property.test.cjs (fast-check fuzz of the practices glob-fallback compiler + a practices-frontmatter round-trip, PRAC-02) — it is grouped under this bucket rather than \"vault-practices\" because the test-file-count lint's hyphen-prefix matcher treats \"vault-practices.property\" (period before \"property\") as starting with \"vault-\" before it can match the more specific \"vault-practices-\" prefix; the module it actually tests is pp-core/bin/lib/vault-practices.cjs, not vault.cjs."
-    },
-    "vault-review": {
-      "files": [
-        "vault-review.integration.test.cjs",
-        "vault-review.security.test.cjs",
-        "vault-review.test.cjs"
-      ],
-      "issue": "Agent practice review (vault assurance R5) — three distinct concerns for pp-core/bin/lib/vault-review.cjs: vault-review.test (the pure derivations — vocabularies, both derived-N-A arms, the counts, the range, the clean-render refusal, the scaffold renderer and the line stamper — plus the require-graph barrier), vault-review.integration.test (the seams: the artifact validator and the check vault-review / vault review scaffold|finalize arms driven through the real pp-tools.cjs, where the exit-0 / no-block-key contract is proved), and vault-review.security.test (adversarial practice bodies: a spoofed fence marker, directive-shaped text, a client table inside the fence, an option-shaped base branch). The .security marker is what identifies the adversarial lane to scripts/run-tests.cjs; consolidating would blur three different questions into one file."
-    },
-    "vault-practices": {
-      "files": [
-        "vault-practices-examples.test.cjs",
-        "vault-practices-matcher.test.cjs",
-        "vault-practices.slow.test.cjs",
-        "vault-practices.test.cjs"
-      ],
-      "issue": "Phase 24 (24-01/24-02/24-04) — three distinct concerns for pp-core/bin/lib/vault-practices.cjs: vault-practices.test (24-01 parser/validation/discovery unit tests), vault-practices-matcher.test (24-02 glob matcher + two-bucket result + report unit tests), vault-practices-examples.test (24-04 shipped-example drift guard + minimal-comments global-bucket smoke case, PRAC-03 Success Criterion 3). All three test the same production module and are each independently load-bearing; consolidating would blur distinct plan-level verification gates. The practice-file contract extensions added vault-practices.slow.test.cjs — the >5 s worst-case matcher corpus behind the matching cost bound, split out per the .slow suffix convention so the default suite stays fast."
+      "issue": "v1.7.0 Client Vault Load — four distinct concerns: vault.test (fetch/status/summary unit), vault-security (VSEC-02/03 write-guard + secret/fence), vault-read-path (VGATE-03 SUMMARY pointer), vault-status-check (VGATE-02 gate-query handler). Vault Assurance phase 02 (#71924) added feat-71924-vault-required-gate.test.cjs as the phase's ONE consolidated source-grep feature file — it owns the source-text assertions for GATE-02, GATE-03, GATE-06, GATE-08, GATE-09 and GATE-10 together, deliberately in a single file so the phase's six requirements do not each spawn a sibling; later plans in the phase extend it rather than adding files. Vault Assurance phase 16 plan 10 added vault-doors.integration.test.cjs as the phase's ONE door fence-proof owner (DOOR-01..05, D-09): every door's shipped fence (execute-plan, quick, fast, debug, the secondary doors) composed by tests/helpers/gate-fence-composer.cjs and run in bash and zsh, one describe per door plan, so 16-12..16-15 extend it rather than each adding a sibling. The hyphen-prefix matcher attributes it here because no vault-doors module exists; it tests workflow fences, not vault.cjs."
     }
   }
 }

package/scripts/lint-test-file-count.cjs

@@ -80,12 +80,11 @@ function prodPrefix(filename) {
 // stamps. Five forms are stripped: `.integration`, `.slow`, `.security`,
 // `.install` and the bare `.test`.
 //
-// `.property` is DELIBERATELY NOT stripped. The `vault` entry in
-// scripts/lint-test-file-count.allowlist.json documents
-// vault-practices.property.test.cjs as parked in that bucket precisely because
-// this function leaves the suffix on — stripping it would re-cluster the file
-// into `vault-practices` and turn that entry's own explanation into a false
-// statement. Changing it is a deliberate allowlist migration, not a tidy-up.
+// `.property` is DELIBERATELY NOT stripped: a `<name>.property.test.cjs` keeps
+// the suffix in its prefix, so the hyphen-prefix matcher clusters it under the
+// shortest matching module rather than under `<name>`. Stripping it would
+// re-cluster every property test the allowlist has already counted. Changing
+// it is a deliberate allowlist migration, not a tidy-up.
 function testEffectivePrefix(testName) {
   const bare = testName
     .replace(/\.(integration|slow|security|install)\.test\.(ts|cjs)$/, '')

package/scripts/prompt-injection-scan.sh

@@ -82,23 +82,25 @@ PATTERNS=(
 # THIS file and reads the array bash actually expands — adding, removing or
 # un-reasoning an entry here without editing the test turns the suite red.
 ALLOWLIST=(
-  'scripts/prompt-injection-scan.sh::the PATTERNS array above is the literal source of every phrase this scanner looks for, so the file matches itself by construction; measured 4 pattern hits at HEAD on 2026-10-11'
-  'scripts/base64-scan.sh::decodes base64 blobs and re-scans the recovered plaintext against the same injection vocabulary, so it names those phrases inline; measured 2 pattern hits at HEAD on 2026-10-11'
-  'scripts/secret-scan.sh::third of the three diff-mode scan scripts CI runs together in the security-scan job of .gitlab-ci.yml; measured 0 pattern hits at HEAD on 2026-10-11, retained because its own exemption list at line 223 already names security-prompt-injection.security.test.cjs and grows with that vocabulary'
-  'tests/security-scan.security.test.cjs::the behavioural suite for this very scanner, so every positive case embeds a real injection phrase as fixture input; measured 28 pattern hits at HEAD on 2026-10-11'
-  'tests/security.test.cjs::the adversarial suite for the library sanitisers, whose fixtures are real override and role-manipulation strings asserted to be neutralised; measured 54 pattern hits at HEAD on 2026-10-11'
-  'tests/prompt-injection-scan.security.test.cjs::drives scanForInjection in the compiled security library with crafted payloads, and carries a second allowlist of its own for that separate scanner; measured 11 pattern hits at HEAD on 2026-10-11'
-  'tests/vault-security.test.cjs::the vault fencing suite plants an instruction-override heading in a fixture vault file and asserts SUMMARY.md fences and defangs it rather than passing it to the agent as instructions; measured 1 pattern hit at HEAD on 2026-10-11'
-  'tests/vault-practices-matcher.test.cjs::the vault practices matcher suite plants an instruction-override line inside a fixture practice body and a spoofed fence end, and asserts the matcher keeps both inside the untrusted fenced region, so the fixtures must carry a real injection phrase'
-  'tests/vault-review.security.test.cjs::the adversarial suite of the agent practice review seeds a practice body with directive-shaped text aimed at the practice judge (the DIRECTIVE_TEXT constant) and asserts the rendered review entry carries it only between the fence markers, after the reference-data preamble, so the judge reads it as data; the text must be a literal for that assertion to mean anything; measured 1 pattern hit at HEAD on 2026-10-12'
-  'tests/verify.test.cjs::the verification suite plants an instruction-override line in a phase artifact and asserts it is rejected, so the line is present as a negative fixture; measured 1 pattern hit at HEAD on 2026-10-11'
-  'pp-core/bin/lib/security.cjs::gitignored build output compiled from src/security.cts per .gitignore line 117, so it is unreachable in diff mode and matters only to a local dir-mode run; it carries the library injection patterns inline; measured 8 pattern hits at HEAD on 2026-10-11'
-  'tests/read-injection-scanner.security.test.cjs::exercises the read-time injection scanner hook with the payloads a hostile file would carry, each asserted to be blocked rather than obeyed; measured 14 pattern hits at HEAD on 2026-10-11'
-  'tests/security-prompt-injection.security.test.cjs::carries two deliberate NUL bytes at lines 631 and 881 so grep classifies it as binary and reports whole-file matches with no line numbers; 10 binary pattern matches measured at HEAD on 2026-10-11'
-  'tests/fixtures/adversarial/security/::a directory of adversarial corpus files whose entire purpose is to BE injection payloads for the suites above; measured 20 pattern hits across its 7 tracked files at HEAD on 2026-10-11'
-  'SECURITY.md::the substring rule makes this exempt every path ending in SECURITY.md, including pp-core/templates/SECURITY.md and every per-phase threat register generated from that template; the breadth is accepted because a security policy is exactly where injection phrasing is legitimately quoted; measured 1 pattern hit across all 13 such files on disk at HEAD on 2026-10-11, a quoted attack shape in a phase threat register'
-  'TEST-EXAMPLES.md::documentation that demonstrates injection examples in order to explain what these scanners catch, so the example text is the point of the file rather than an attack; measured 1 pattern hit at HEAD on 2026-10-11'
-  'explanation/security-model.md::matches docs/explanation/security-model.md through the substring rule; it is the prose that explains the injection threat model and quotes the attack shapes pp-core defends against; measured 2 pattern hits at HEAD on 2026-10-11'
+  'scripts/prompt-injection-scan.sh::the PATTERNS array above is the literal source of every phrase this scanner looks for, so the file matches itself by construction; measured 4 pattern hits at HEAD on 2026-09-19'
+  'scripts/base64-scan.sh::decodes base64 blobs and re-scans the recovered plaintext against the same injection vocabulary, so it names those phrases inline; measured 2 pattern hits at HEAD on 2026-09-19'
+  'scripts/secret-scan.sh::third of the three diff-mode scan scripts CI runs together in the security_scan job of .github/workflows/ci.yml; measured 0 pattern hits at HEAD on 2026-09-19, retained because its own exemption list at line 223 already names security-prompt-injection.security.test.cjs and grows with that vocabulary'
+  'tests/security-scan.security.test.cjs::the behavioural suite for this very scanner, so every positive case embeds a real injection phrase as fixture input; measured 28 pattern hits at HEAD on 2026-09-19'
+  'tests/security.test.cjs::the adversarial suite for the library sanitisers, whose fixtures are real override and role-manipulation strings asserted to be neutralised; measured 54 pattern hits at HEAD on 2026-09-19'
+  'tests/prompt-injection-scan.security.test.cjs::drives scanForInjection in the compiled security library with crafted payloads, and carries a second allowlist of its own for that separate scanner; measured 11 pattern hits at HEAD on 2026-09-19'
+  'tests/verify.test.cjs::the verification suite plants an instruction-override line in a phase artifact and asserts it is rejected, so the line is present as a negative fixture; measured 1 pattern hit at HEAD on 2026-09-19'
+  'pp-core/bin/lib/security.cjs::gitignored build output compiled from src/security.cts per .gitignore line 117, so it is unreachable in diff mode and matters only to a local dir-mode run; it carries the library injection patterns inline; measured 8 pattern hits at HEAD on 2026-09-19'
+  'tests/read-injection-scanner.security.test.cjs::exercises the read-time injection scanner hook with the payloads a hostile file would carry, each asserted to be blocked rather than obeyed; measured 14 pattern hits at HEAD on 2026-09-19'
+  'tests/security-prompt-injection.security.test.cjs::carries two deliberate NUL bytes at lines 631 and 881 so grep classifies it as binary and reports whole-file matches with no line numbers; 10 binary pattern matches measured at HEAD on 2026-09-19'
+  'tests/fixtures/adversarial/security/::a directory of adversarial corpus files whose entire purpose is to BE injection payloads for the suites above; measured 20 pattern hits across its 7 tracked files at HEAD on 2026-09-19'
+  'tests/discovery-vault-context.test.cjs::the DISCO-03/SC4 suite plants a real role-manipulation line (the PLANTED constant) into a fixture vault document and asserts the shipped scanner FINDS it, which is the non-vacuity partner for the assertion that the subflow itself scans clean; the payload has to be a literal for that half to mean anything, so the file matches the vocabulary it exists to prove is caught'
+  'tests/vault-status-check.test.cjs::sanitisation seeds for the vault status message carry a real instruction and a real control character on purpose, each paired with a non-vacuity assertion that the RENDERED message does not carry it intact; measured 5 pattern hits at HEAD on 2026-09-19'
+  'tests/vault-index.integration.test.cjs::the fence-spoof suite seeds a vault document heading and an INDEX description that carry a forged end-fence marker followed by an instruction-override phrase, and asserts the rendered SUMMARY keeps exactly one live end marker with the planted line defanged inside the fence, so the phrase must be a literal for the defang proof to mean anything; measured 4 pattern hits at HEAD 5ddb0b3 on 2026-10-12'
+  'tests/vault-seal.integration.test.cjs::the uncovered-commit suite builds a commit whose subject is an instruction-override phrase padded past the cap, modelling a hostile commit message, and asserts the subject leaving the seal leaf is controls-collapsed and bounded to SEAL_SUBJECT_CAP before it can reach a record; measured 1 pattern hit at HEAD 5ddb0b3 on 2026-10-12'
+  'tests/vault-standards.integration.test.cjs::the D-14 suites plant instruction-override lines in a standards document and in its INDEX description, each tagged with a random token, and assert that neither the token nor the phrase appears in any output of vault standards block or consulted, so the phrase must be a literal for the absence proof to mean anything; measured 6 pattern hits at HEAD 5ddb0b3 on 2026-10-12'
+  'SECURITY.md::the substring rule makes this exempt every path ending in SECURITY.md, including pp-core/templates/SECURITY.md and every per-phase threat register generated from that template; the breadth is accepted because a security policy is exactly where injection phrasing is legitimately quoted; measured 0 pattern hits across all 16 such files on disk at HEAD on 2026-09-19'
+  'TEST-EXAMPLES.md::documentation that demonstrates injection examples in order to explain what these scanners catch, so the example text is the point of the file rather than an attack; measured 1 pattern hit at HEAD on 2026-09-19'
+  'explanation/security-model.md::matches docs/explanation/security-model.md through the substring rule; it is the prose that explains the injection threat model and quotes the attack shapes pp-core defends against; measured 2 pattern hits at HEAD on 2026-09-19'
 )
 
 is_allowlisted() {