@pareto4/pp-core 1.17.1 → 1.18.0

package/pp-core/bin/lib/capability-state.cjs

@@ -62,52 +62,6 @@ function _isSafePropKey(key) {
         return false;
     return true;
 }
-// ─── Vault mode filter (Phase 15 D-02 / D-28) ──────────────────────────────────
-/**
- * Does a hook's declared `vaultMode` filter let it through under the resolved
- * mode? THE ONE statement of the rule (Phase 15 D-02, amended by D-28). Both
- * `resolveLoopHooks` (what renders) and `resolveCapabilityState` (what
- * `capability state` reports) call it, so they cannot drift. It lives here, not
- * in loop-resolver, because loop-resolver already requires this module and the
- * reverse require would be a cycle.
- *
- *   - no `vaultMode` on the hook → passes (a hook without the field behaves
- *     exactly as before Phase 15);
- *   - the input mode is `practices` or `standards` → passes iff the hook's
- *     `vaultMode` equals it;
- *   - any other input (`null`, absent, an unknown string) is an undefined mode:
- *     a filtered GATE passes and a filtered contribution or step drops (D-28).
- *     The trace points then still dispatch a gate that fails closed, and no
- *     contract renders for a mode nobody defined. The mode is never defaulted
- *     to `practices` here.
- *
- * Pure: no I/O, no config read. The mode arrives as a value.
- */
-function vaultModeFilterVerdict(hookMode, kind, inputMode) {
-    if (hookMode === undefined)
-        return true;
-    const resolved = (inputMode === 'practices' || inputMode === 'standards') ? inputMode : null;
-    if (resolved !== null)
-        return hookMode === resolved;
-    return kind === 'gate';
-}
-/**
- * Call an injected `resolveVaultMode` (pp-tools builds it on `vaultModeVerdict`)
- * and normalise its answer to `'practices' | 'standards' | null`. A missing
- * resolver, a throw or any other answer is `null`, the undefined mode that
- * `vaultModeFilterVerdict` treats fail-closed (D-28). Shared by both I/O entry
- * points (`cmdLoopRenderHooks`, `cmdCapabilityState`) so the two read the
- * injected mode identically.
- */
-function resolveInjectedVaultMode(resolveVaultMode) {
-    try {
-        const m = typeof resolveVaultMode === 'function' ? resolveVaultMode() : null;
-        return (m === 'practices' || m === 'standards') ? m : null;
-    }
-    catch {
-        return null;
-    }
-}
 // ─── Seal gates over recorded artifacts (Phase 16 D-18 / D-19 / D-26) ──────────
 /**
  * The per-hook seal field's name (Phase 16 D-19). One statement of it: the
@@ -118,15 +72,13 @@ const SEAL_FIELD = 'onRecordedArtifacts';
 /**
  * How the resolver treats one GATE, given its seal field, its capability's
  * state and the injected recorded-artifacts predicate. THE ONE statement of
- * the seal rule (Phase 16 D-19), owned here for the same reason as
- * `vaultModeFilterVerdict`: loop-resolver requires this module, never the
- * reverse.
+ * the seal rule (Phase 16 D-19), owned here because loop-resolver requires
+ * this module, never the reverse.
  *
  * Why a field and not a widened `when` (D-18, measured): the resolver drops a
  * hook whose capability is not `active` BEFORE `when` is read, and `active`
- * ANDs the capability's `activationKey`. With `vault.enabled` or
- * `vault.practices_enabled` false no vault-practices hook can render, whatever
- * its `when` says. So a seal gate bypasses the active check and the `when`,
+ * ANDs the capability's `activationKey`. With `vault.enabled` false no vault
+ * hook can render, whatever its `when` says. So a seal gate bypasses the active check and the `when`,
  * under this closed rule only:
  *
  *   - no seal field (anything but literal `true`) → `'normal'` when the
@@ -140,10 +92,7 @@ const SEAL_FIELD = 'onRecordedArtifacts';
  *     answers literal `true`, else `'drop'`. The predicate is called on this
  *     arm ONLY, so no other hook pays its planning-tree read.
  *
- * Mode filtering (`vaultModeFilterVerdict`) runs BEFORE this rule in the
- * resolver, so a mode-filtered seal never consults the predicate (research
- * C-1). Seals are declared on vault-practices only (D-26). Pure apart from the
- * injected thunk.
+ * Pure apart from the injected thunk.
  */
 function sealRenderVerdict(sealField, state, recordedArtifacts) {
     const active = state !== undefined && state !== null && state.active === true;
@@ -216,12 +165,9 @@ function resolveInjectedPlatformBindingsPresent(resolvePlatformBindingsPresent)
  * @param input.cwd              Optional; when provided, enables raw .planning/config.json
  *                               fallback reads (levels 2+3 of _resolveActivationValue
  *                               precedence). Omit for a pure in-memory resolution.
- * @param input.vaultMode        Optional resolved vault mode VALUE; a hook carrying
- *                               `vaultMode` is configured only when
- *                               `vaultModeFilterVerdict` passes it (Phase 15 D-02/D-28).
  */
 function resolveCapabilityState(input) {
-    const { registry, installedSkills, surfacedSkills, config, cwd, vaultMode } = input;
+    const { registry, installedSkills, surfacedSkills, config, cwd } = input;
     // Guard: registry missing capabilities
     if (!registry || typeof registry !== 'object' || Array.isArray(registry)) {
         return { capabilities: [] };
@@ -351,16 +297,17 @@ function resolveCapabilityState(input) {
                     // (mirrors loop-resolver.isActive: `typeof when !== 'string' || when.length === 0` → false)
                     configured = false;
                 }
-                // Phase 15 D-02/D-28: the mode filter folds into `configured`, through the
-                // same rule resolveLoopHooks applies. `vaultMode` is read, never emitted:
-                // HookEntry has no such field.
-                configured = configured && vaultModeFilterVerdict(h['vaultMode'], kind, vaultMode);
                 // Hook active = capability-level active AND hook's own config gate.
                 // The capability's `active` constant (= enabled && configActivation) is
                 // used here so that a config-disabled capability (active=false) cannot
                 // produce active hooks even when the hook's own `when` is unconditional
                 // (configured=true). The capability gate cascades to all its hooks.
-                hooks.push({ point, kind, when: whenRaw, configured, active: active && configured });
+                // A seal gate (`SEAL_FIELD`, Phase 16 D-19) never renders for an ACTIVE
+                // capability — `sealRenderVerdict` drops it, because the normal gates
+                // cover it — so it is reported inactive here, keeping this report in
+                // agreement with what `loop render-hooks` renders.
+                const seal = kind === 'gate' && h[SEAL_FIELD] === true;
+                hooks.push({ point, kind, when: whenRaw, configured, active: active && configured && !seal });
             }
         }
         const stepsRaw = capObj['steps'];
@@ -519,12 +466,8 @@ function _resolveManifest(commandsGsdDir, configDir) {
  *                         caught by the caller before invoking this function.
  * @param raw              Whether to emit raw JSON (io.output raw mode)
  * @param _options         Reserved for future use
- * @param resolveOptions   `{ vaultMode }`, the resolved vault mode VALUE passed
- *                         through to resolveCapabilityState (Phase 15 D-02).
- *                         Omitted by the loop resolver, which reads only the
- *                         capability-level `active` and filters hooks itself.
  */
-function resolveCapabilityRuntimeState(cwd, runtimeConfigDir, configOverride, resolveOptions = {}) {
+function resolveCapabilityRuntimeState(cwd, runtimeConfigDir, configOverride) {
     const warnings = [];
     // Resolve runtimeConfigDir using the canonical runtime-homes resolver.
     // When not provided, the active runtime is detected via the canonical
@@ -630,7 +573,6 @@ function resolveCapabilityRuntimeState(cwd, runtimeConfigDir, configOverride, re
         surfacedSkills,
         config,
         cwd,
-        vaultMode: resolveOptions.vaultMode,
     });
     return {
         runtimeConfigDir: resolvedConfigDir,
@@ -638,11 +580,8 @@ function resolveCapabilityRuntimeState(cwd, runtimeConfigDir, configOverride, re
         capabilities: result.capabilities,
     };
 }
-function cmdCapabilityState(cwd, runtimeConfigDir, raw, options = {}) {
-    // Phase 15 D-02: the same injected mode render-hooks uses, so a mode-filtered
-    // hook's `active` here agrees with whether it renders.
-    const vaultMode = resolveInjectedVaultMode(options['resolveVaultMode']);
-    const result = resolveCapabilityRuntimeState(cwd, runtimeConfigDir, undefined, { vaultMode });
+function cmdCapabilityState(cwd, runtimeConfigDir, raw, _options = {}) {
+    const result = resolveCapabilityRuntimeState(cwd, runtimeConfigDir);
     for (const warning of result.warnings) {
         coreError(`capability state: ${warning}`);
     }
@@ -679,9 +618,6 @@ module.exports = {
     resolveCapabilityRuntimeState,
     isCapabilityActive,
     cmdCapabilityState,
-    // Phase 15 D-02/D-28: the one mode-filter rule (loop-resolver imports it)
-    vaultModeFilterVerdict,
-    resolveInjectedVaultMode,
     // Phase 16 D-19: the one seal rule, its injected-predicate normaliser and the
     // field name the resolver and the registry generator both read.
     SEAL_FIELD,

package/pp-core/bin/lib/capability-writer.cjs

@@ -28,8 +28,6 @@ const { output: coreOutput, error: coreError } = ioMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityStateMod = require("./capability-state.cjs");
 const { resolveCapabilityRuntimeState, _resolveManifest, _resolveCommandsGsdDir } = capabilityStateMod;
-// On its own line: the line above is baselined verbatim by scripts/verify-rename-guard.cjs.
-const { resolveInjectedVaultMode } = capabilityStateMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const surfaceMod = require("./surface.cjs");
 const { readSurface, writeSurface, applySurface } = surfaceMod;
@@ -69,15 +67,8 @@ const nodepath = require("path");
 function setCapabilityState(cwd, runtimeConfigDir, desired, opts) {
     const warnings = [];
     const errors = [];
-    // Phase 15 D-02 / 15-REVIEW WR-07: the mode every hook-level reader uses, so
-    // the hooks this command reports and warns about are the hooks that render.
-    // 15-REVIEW iter-2 WR-01: the mode is resolved PER READ, never once per
-    // command — `vaultModeVerdict` answers "no mode" while `vault.enabled` is off,
-    // so a command that itself turns the vault on must re-ask after its write.
     // ── Step 1: Resolve BEFORE state once ────────────────────────────────────
-    const before = resolveCapabilityRuntimeState(cwd, runtimeConfigDir, undefined, {
-        vaultMode: resolveInjectedVaultMode(opts?.resolveVaultMode),
-    });
+    const before = resolveCapabilityRuntimeState(cwd, runtimeConfigDir);
     const resolvedConfigDir = before.runtimeConfigDir;
     // ── Load registry ─────────────────────────────────────────────────────────
     // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -264,11 +255,7 @@ function setCapabilityState(cwd, runtimeConfigDir, desired, opts) {
         }
     }
     // ── Step 5: RE-RESOLVE ────────────────────────────────────────────────────
-    // Re-resolve the mode AFTER the writes above (iter-2 WR-01): the after-state
-    // must be judged under the mode `capability state` / render-hooks now see.
-    const after = resolveCapabilityRuntimeState(cwd, resolvedConfigDir, undefined, {
-        vaultMode: resolveInjectedVaultMode(opts?.resolveVaultMode),
-    });
+    const after = resolveCapabilityRuntimeState(cwd, resolvedConfigDir);
     // ── Step 6: POST CHECKS ───────────────────────────────────────────────────
     // Check: desired enabled=true but not actually enabled after write
     // (catches the not-in-profile / not-surfaced silent no-op case).
@@ -328,7 +315,6 @@ function cmdCapabilitySet(cwd, runtimeConfigDir, capId, options, raw) {
     ];
     const opts = {
         ...(options.runtime ? { materialize: { runtime: options.runtime, scope: options.scope ?? 'global' } } : {}),
-        resolveVaultMode: options.resolveVaultMode,
     };
     const result = setCapabilityState(cwd, runtimeConfigDir, desired, opts);
     if (raw) {