@pareto4/pp-core 1.17.1 → 1.18.0

package/pp-core/bin/lib/clusters.cjs

@@ -45,8 +45,8 @@ exports.CLUSTERS = Object.freeze({
         'add-tests',
         'secure-phase',
         // Retroactive, non-gating review of a completed phase against the client
-        // vault's practices (Vault Assurance #71924, 06-07) — the same family as
-        // secure-phase / ui-review / validate-phase.
+        // vault's standards documents (`check vault-review`, a report) — the same
+        // family as secure-phase / ui-review / validate-phase.
         'vault-review',
     ]),
     milestone: Object.freeze([

package/pp-core/bin/lib/compose-bindings.cjs

@@ -31,8 +31,8 @@
  * `JSON.stringify`/object literals — never by `.md` shell string
  * concatenation.
  *
- * Its importers today are `src/vault-update.cts`, `src/init-contract.cts`,
- * `src/vault-practices.cts` and (quick 261003-lqi) `src/check-command-router.cts`
+ * Its importers today are `src/vault-update.cts`, `src/init-contract.cts`
+ * and (quick 261003-lqi) `src/check-command-router.cts`
  * — and this module imports none of them, so its top-level imports of `./org-profile.cjs`, `./platform-bindings.cjs`,
  * `./git-provider.cjs`, `./vault-coordinates.cjs`, `./io.cjs`,
  * `./project-root.cjs`, `./package-identity.cjs` and

package/pp-core/bin/lib/config.cjs

@@ -527,7 +527,6 @@ function isStringMember(list, value) {
  */
 const BOOLEAN_ONLY_CONFIG_KEYS = Object.freeze([
     'vault.enabled',
-    'vault.practices_enabled',
     'vault.required',
     'workflow.schema_drift_gate',
     'workflow.nyquist_validation',
@@ -641,8 +640,8 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         error(`Invalid plan_review.source_grounding_authority '${val}'. Valid values: ${VALID_SOURCE_GROUNDING_AUTHORITIES.join(', ')}`);
     }
     // Capability enum keys, in ONE place (Vault Assurance 13-05, D-07). Measured
-    // 2026-10-09: `config-set workflow.code_review_depth bogus` and
-    // `config-set vault.mode whatever` both wrote at exit 0, because no guard
+    // 2026-10-09: `config-set workflow.code_review_depth bogus` wrote at exit 0,
+    // because no guard
     // consulted the registry's declared `values`. This runs AFTER every
     // hand-coded guard above, so a key that already has its own guard
     // (`workflow.drift_action`) keeps its message byte-identical; the
@@ -653,9 +652,7 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     // The TYPE is checked before membership (13-REVIEW CR-01): a value starting
     // with `[` is JSON-parsed above, and `String(['standards']) === 'standards'`,
     // so a membership-only test let a one-element array through and wrote it —
-    // which `resolveVaultMode` then refused on every vault command, and which
-    // `federated-config` silently reads back as the default for the other enum
-    // keys. Every declared capability enum value is a string, so a non-string
+    // which `federated-config` silently reads back as the default. Every declared capability enum value is a string, so a non-string
     // parse (array, object, number, boolean) can never be a member.
     const enumValues = capabilityEnumValues(kp);
     if (enumValues && !isStringMember(enumValues, parsedValue)) {

package/pp-core/bin/lib/git-base-branch.cjs

@@ -118,12 +118,11 @@ function isPlausibleBranchRef(value) {
 }
 /**
  * WHAT A CALLER SAYS WHEN THE OVERRIDE IS REFUSED. One sentence, exported, for
- * every channel — three call sites state it and none of them spells it.
+ * every channel — a caller states it and never spells it.
  *
  * A second spelling of this sentence would be a second definition of what the
- * mechanism did, and this phase has already paid for that twice. The
- * `check vault-review` payload, the `check vault.audit` notes and the
- * `check ship.practices` message all carry these exact bytes.
+ * mechanism did, so every channel that states the refusal carries these exact
+ * bytes.
  *
  * The reason carries NO copy of the refused value: the value is client-supplied
  * and one of its shapes is an absolute filesystem path, so echoing it back onto
@@ -296,15 +295,13 @@ function resolveBaseBranchResult(cwd, deps) {
  * Consults the full precedence ladder and always returns a non-empty string.
  * Never throws.
  *
- * The bare-string form. EVERY consumer that computes a range now takes
- * `resolveBaseBranchResult` instead and states the refusal (W16): the two that
- * took this wrapper — `vault-audit.cts`, which is the shipped BLOCKING command,
- * and `cmdShipPractices`, a declared ship:pre gate — refused in silence, so a
- * gate ran over a range the project never configured and reported success on
- * it. What remains here is `cmdGitBaseBranch`, whose entire contract is one
- * branch name on stdout and which therefore genuinely has nowhere to put a
- * sentence. A new caller reaching for this form should ask whether that is true
- * of it as well; if it has a channel, it owes the operator the reason.
+ * The bare-string form. A consumer that computes a range takes
+ * `resolveBaseBranchResult` instead and states the refusal (W16): a gate that
+ * refused in silence would run over a range the project never configured and
+ * report success on it. What remains here is `cmdGitBaseBranch`, whose entire
+ * contract is one branch name on stdout and which therefore genuinely has
+ * nowhere to put a sentence. A new caller reaching for this form should ask
+ * whether that is true of it as well; if it has a channel, it owes the operator the reason.
  */
 function resolveBaseBranch(cwd, deps) {
     return resolveBaseBranchResult(cwd, deps).branch;

package/pp-core/bin/lib/git-provider.cjs

@@ -14,9 +14,9 @@
  * provider, what environment a clone needs, and whether a host CLI (`glab`)
  * may be spawned at all. It imports node builtins plus `./org-profile.cjs` —
  * still never `./vault.cjs`, `./vault-coordinates.cjs`, `./io.cjs` or
- * `./shell-command-projection.cjs` — so that both `src/vault.cts` and
- * `src/vault-write-back.cts` can import it (since 30-02 and 30-03) without
- * forming a require cycle in the CommonJS graph `require()` loads.
+ * `./shell-command-projection.cjs` — so that `src/vault.cts`, the vault write
+ * path and the other vault modules can import it without forming a require
+ * cycle in the CommonJS graph `require()` loads.
  * `./org-profile.cjs` is the one exception: it is itself a zero-import leaf
  * (node builtins only, see its own header), so importing it here creates no
  * load-time cycle even though it lazily requires this module back at
@@ -176,9 +176,8 @@ const compiledLiteralCloneTargetPatterns = exports.LITERAL_CLONE_TARGET_PATTERNS
  * absolute path, a scheme-qualified URL, or scp-style `user@host:path` —
  * rather than a `group/project` slug that must be composed onto a host.
  *
- * This is now the SINGLE definition. `src/vault.cts` and
- * `src/vault-write-back.cts` import it from here (30-02, 30-03) rather than
- * each keeping a copy — a read/write divergence in this predicate was defect
+ * This is now the SINGLE definition. `src/vault.cts` imports it from here
+ * (30-02) rather than keeping a copy — a read/write divergence in this predicate was defect
  * P-1 in Phase 29 (the write path used the value verbatim while the read path
  * always composed a URL, so a slug broke writing and a path broke reading).
  *

package/pp-core/bin/lib/init-contract.cjs

@@ -7,11 +7,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.INIT_SESSION_WRITE_FAILED = exports.INIT_SESSION_MALFORMED = exports.INIT_CONTRACT_FLAGS = exports.INIT_PROBE_STATUS = exports.INIT_PROBE_NOTE_KEY = exports.INIT_PROBE_WHO_KEY = exports.INIT_PROBE_WHEN_KEY = exports.INIT_PROBE_STATUS_KEY = exports.INIT_ORG_PROFILE_DECLINED_KEY = exports.INIT_COMPOSE_DECLINED_KEY = void 0;
 exports.resolveVaultEnabledState = resolveVaultEnabledState;
-exports.resolveVaultPracticesEnabledState = resolveVaultPracticesEnabledState;
 exports.resolveVaultRequiredState = resolveVaultRequiredState;
 exports.readVaultEnabledState = readVaultEnabledState;
-exports.readVaultPracticesEnabledState = readVaultPracticesEnabledState;
-exports.readVaultStandardsModeActive = readVaultStandardsModeActive;
 exports.readVaultRequiredState = readVaultRequiredState;
 exports.buildInitQuestions = buildInitQuestions;
 exports.deriveSlug = deriveSlug;
@@ -116,18 +113,12 @@ function getDotted(obj, dottedPath) {
 }
 /** Arms the vault capability; written by the session machine, never by an org profile. */
 const VAULT_ENABLED_CONFIG_KEY = 'vault.enabled';
-/** Arms vault-practices; set beside `vault.enabled` under the same absent-only rule, inert without it. */
-const VAULT_PRACTICES_ENABLED_CONFIG_KEY = 'vault.practices_enabled';
 /** The single reading of `vault.enabled` in this module, in the form the gate honours
  * (`resolveGateHonouredKeyState`, Phase 15 D-32). `value` is the observed value, never a
  * coercion, so reports name what is really in the file. */
 function resolveVaultEnabledState(parsed) {
     return resolveGateHonouredKeyState(parsed, VAULT_ENABLED_CONFIG_KEY);
 }
-/** Four-state reading of `vault.practices_enabled`, like `resolveVaultEnabledState`. */
-function resolveVaultPracticesEnabledState(parsed) {
-    return resolveGateHonouredKeyState(parsed, VAULT_PRACTICES_ENABLED_CONFIG_KEY);
-}
 /** Four-state reading of the project's OWN `vault.required` (not the profile-layered gate value),
  * so the arming guard respects an explicit per-project `false`. */
 function resolveVaultRequiredState(parsed) {
@@ -151,12 +142,11 @@ function resolveBooleanKeyState(parsed, key) {
 }
 /**
  * Four-state reading of a vault switch whose gates read ONLY the nested form (Phase 15
- * D-32): `vault.enabled` and `vault.practices_enabled`. `loadConfig` materialises their
- * nested defaults, so the gates' evaluator answers at its first level and never reaches a
+ * D-32): `vault.enabled`. `loadConfig` materialises its nested default, so the gates' evaluator answers at its first level and never reaches a
  * hand-written FLAT key (it warns that the key is ignored). Reading the flat form as
  * `armed` therefore told /pp-init that a switch was on while no gate rendered. The
  * absent-only arming then skipped it, and the done line promised governance nobody
- * enforced (todo init-practices-reader-reads-flat-form-as-armed).
+ * enforced.
  *
  *   - nested present: its value decides, exactly as before;
  *   - flat-only `true`: `absent`, because the gate sees nothing. The arming writes the
@@ -222,21 +212,6 @@ function readRootKeyState(cwd, resolve) {
 function readVaultEnabledState(cwd) {
     return agreeWithGate(readRootKeyState(cwd, resolveVaultEnabledState), gateReadsOn((v) => v.isVaultGateActive(cwd)));
 }
-/** `vault.practices_enabled` for the project at `cwd`: `armed` exactly when
- * `isPracticesGateActive`, the one practices-switch reader (15-02), is ON. Never throws. */
-function readVaultPracticesEnabledState(cwd) {
-    return agreeWithGate(readRootKeyState(cwd, resolveVaultPracticesEnabledState), gateReadsOn((v) => v.isPracticesGateActive(cwd)));
-}
-/**
- * Whether the project at `cwd` is in standards mode, asked of the one mode owner
- * (`isStandardsModeActive`, which honours the org-profile ladder). The /pp-init done line
- * uses it so that, in standards mode, it names the standards record the `vault.trace`
- * gate checks instead of practice recording, which standards mode does not do
- * (15-REVIEW WR-09). Any throw reads as not standards. Never throws.
- */
-function readVaultStandardsModeActive(cwd) {
-    return gateReadsOn((v) => v.isStandardsModeActive(cwd));
-}
 /** `vault.required` for the project at `cwd`: `armed` exactly when the load gate's own
  * answer (`resolveVaultRequiredFlag`) is true. Never throws. */
 function readVaultRequiredState(cwd) {
@@ -662,27 +637,24 @@ function writeIdentityAndProvider(cwd, answers) {
     writeConfigMerge(cwd, patch);
 }
 /** The ONE owner of the arm-where-absent rule (quick 261003-kmd): arms `vault.enabled`,
- * `vault.practices_enabled` and `vault.required` only where ABSENT, from one read in one write.
+ * and `vault.required` only where ABSENT, from one read in one write.
  *
- * A successful composition means a client vault exists, so the three keys are armed (OD-1,
+ * A successful composition means a client vault exists, so the two keys are armed (OD-1,
  * 260915-lmc, 260916-s5n). An explicit `false` or a malformed value is kept — that is the
  * operator's decision, never overwritten (07-09 WR-07). The write happens only when there is
  * something to arm: the nested- and flat-form byte-identity pins depend on a no-op writing
  * nothing. Callers: the session's `'unchanged'` decision (how existing projects get armed by a
  * plain re-run), the approved `compose_confirm`, and `armVaultFromProfile` (`/pp-new-project`).
- * It exists because the two session copies had already drifted once — the practices key was
- * added to both by hand in 260915-lmc — and a third route would have been a third copy.
+ * It exists because the two session copies had already drifted once, and a third route would
+ * have been a third copy.
  *
- * @returns the armed key names, in the fixed order enabled, practices_enabled, required. */
+ * @returns the armed key names, in the fixed order enabled, required. */
 function armVaultKeysWhereAbsent(cwd) {
     const { parsed } = readConfigFile(cwd);
     const vaultPatch = {};
     if (resolveVaultEnabledState(parsed).state === 'absent') {
         vaultPatch.enabled = true;
     }
-    if (resolveVaultPracticesEnabledState(parsed).state === 'absent') {
-        vaultPatch.practices_enabled = true;
-    }
     if (resolveVaultRequiredState(parsed).state === 'absent') {
         vaultPatch.required = true;
     }

package/pp-core/bin/lib/init-interactive.cjs

@@ -161,36 +161,22 @@ async function runInitInteractive(cwd, prompter, opts = {}) {
                         'INIT_VAULT_ENABLED_MALFORMED; store the boolean with pp-tools config-set vault.enabled true.');
                 }
                 else if (vaultState === 'armed') {
-                    // Quick 260915-lmc: vault.practices_enabled is armed beside it under
-                    // the same absent-only rule, so the line names it only when the
-                    // READING says true — an explicit false is the project's choice and
-                    // is not contradicted here.
-                    const practicesArmed = (0, init_contract_cjs_1.readVaultPracticesEnabledState)(cwd).state === 'armed';
                     // Quick 260916-s5n: vault.required is named only when the READING
                     // says armed, by the same rule — an explicit false is the project's
                     // choice and the last line printed must not contradict it.
                     const requiredArmed = (0, init_contract_cjs_1.readVaultRequiredState)(cwd).state === 'armed';
-                    // Built as a head plus two OPTIONAL clauses carrying no terminator
-                    // of their own, with exactly one full stop appended at the end. The
-                    // stop used to live inside the practices branch, which made every
-                    // further clause a sentence continuing past its own period.
+                    // Built as a head plus clauses carrying no terminator of their own,
+                    // with exactly one full stop appended at the end.
                     const head = 'Done — .platform-bindings.json was composed and written; vault.enabled is now true ' +
                         '(the vault capability is armed — /pp-init Step 2.6 probes reachability next)';
-                    // 15-REVIEW WR-09: in standards mode no phase records practices (the
-                    // practices planner fragment and trace gates are filtered out), so the
-                    // clause names what IS recorded and checked there, whatever the
-                    // practices switch reads.
-                    const practicesClause = (0, init_contract_cjs_1.readVaultStandardsModeActive)(cwd)
-                        ? '; vault.mode is standards, so each plan records which client standards documents governed it ' +
-                            '(<vault_standards>), checked by the vault.trace gate'
-                        : practicesArmed
-                            ? '; vault.practices_enabled is true, so each phase records which client vault practices it applied'
-                            : '';
+                    // 15-REVIEW WR-09: the clause names what is recorded and checked.
+                    const standardsClause = '; each plan records which client standards documents governed it ' +
+                        '(<vault_standards>), checked by the vault.trace gate';
                     const requiredClause = requiredArmed
                         ? '; vault.required is true, so a client vault miss, a failed fetch or an unwritable vault summary ' +
                             'stops the build at plan:pre and execute:pre'
                         : '';
-                    prompter.print(head + practicesClause + requiredClause + '.');
+                    prompter.print(head + standardsClause + requiredClause + '.');
                 }
                 else {
                     // 'absent' — unreachable after an approved compose (the arming

package/pp-core/bin/lib/io.cjs

@@ -180,19 +180,13 @@ const ERROR_REASON = Object.freeze({
     PLATFORM_BINDINGS_PARSE_FAILED: 'platform_bindings_parse_failed',
     // init (Phase 34-09 gap closure: `pp-tools init` interactive command)
     INIT_NON_INTERACTIVE: 'init_non_interactive',
-    // vault write-back promote arm (Phase 29 WRB-01/03)
+    // vault promote (a standards document into the client vault)
     VAULT_PROMOTE_DISABLED: 'vault_promote_disabled',
-    VAULT_PROMOTE_INVALID_PRACTICE: 'vault_promote_invalid_practice',
+    VAULT_PROMOTE_INVALID_DOCUMENT: 'vault_promote_invalid_document',
     VAULT_PROMOTE_SECRET_DETECTED: 'vault_promote_secret_detected',
     VAULT_PROMOTE_TARGET_REFUSED: 'vault_promote_target_refused',
     VAULT_PROMOTE_CONCURRENT_EDIT: 'vault_promote_concurrent_edit',
     VAULT_PROMOTE_TRANSPORT_FAILED: 'vault_promote_transport_failed',
-    // vault.mode (Vault Assurance 13-03, D-08/D-14): an unrecognised mode value,
-    // and the standards-mode promote refusal
-    VAULT_MODE_INVALID: 'vault_mode_invalid',
-    // 13-REVIEW WR-01: the mode resolver failed; refused like an invalid value
-    VAULT_MODE_UNRESOLVED: 'vault_mode_unresolved',
-    VAULT_PROMOTE_NOT_APPLICABLE: 'vault_promote_not_applicable',
     // discovery rollup (discovery-v2 Phase 1: D-07/D-08 gate)
     DISCOVERY_ROLLUP_PARSE_FAILED: 'discovery_rollup_parse_failed',
     DISCOVERY_ROLLUP_MISMATCH: 'discovery_rollup_mismatch',

package/pp-core/bin/lib/loop-resolver.cjs

@@ -13,7 +13,7 @@
  * Command surface: pp-tools loop render-hooks <point>
  *
  * Exports (three things):
- *   resolveLoopHooks({ point, registry, config, vaultMode?, recordedArtifacts? }) → { point, activeHooks }
+ *   resolveLoopHooks({ point, registry, config, recordedArtifacts? }) → { point, activeHooks }
  *   renderLoopHooks(resolved) → markdown string
  *   cmdLoopRenderHooks(cwd, point, raw, options) — I/O entry point
  *
@@ -36,7 +36,7 @@ const configLoaderModule = require("./config-loader.cjs");
 const { loadConfig } = configLoaderModule;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityStateModule = require("./capability-state.cjs");
-const { resolveCapabilityRuntimeState, vaultModeFilterVerdict, resolveInjectedVaultMode, SEAL_FIELD, sealRenderVerdict, resolveInjectedRecordedArtifacts, resolveInjectedPlatformBindingsPresent, } = capabilityStateModule;
+const { resolveCapabilityRuntimeState, SEAL_FIELD, sealRenderVerdict, resolveInjectedRecordedArtifacts, resolveInjectedPlatformBindingsPresent, } = capabilityStateModule;
 // ─── Capability-activation engine (single owner for config-key precedence) ────
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityActivationModule = require("./capability-activation.cjs");
@@ -103,7 +103,7 @@ function _getCanonicalPoints(_registry) {
  * resolved against `config`; active iff truthy. Inactive hooks are filtered out.
  */
 function resolveLoopHooks(input) {
-    const { point, registry, config, cwd, capabilityStatesById, vaultMode, recordedArtifacts, platformBindingsPresent, } = input;
+    const { point, registry, config, cwd, capabilityStatesById, recordedArtifacts, platformBindingsPresent, } = input;
     // Validate point
     const canonicalPoints = _getCanonicalPoints(registry);
     if (!canonicalPoints.includes(point)) {
@@ -122,12 +122,6 @@ function resolveLoopHooks(input) {
     }
     const entryMap = entry;
     const activeHooks = [];
-    // Phase 15 D-02/D-28: the per-hook `vaultMode` filter, one rule owned by
-    // capability-state (`vaultModeFilterVerdict`), evaluated against the injected
-    // mode VALUE. The field is read here and never copied into an ActiveHook.
-    function modeOk(hook, kind) {
-        return vaultModeFilterVerdict(hook['vaultMode'], kind, vaultMode);
-    }
     // Helper: check activation using single-key precedence resolver (FIX 1 + FIX 3)
     function isActive(hook) {
         const when = hook['when'];
@@ -260,8 +254,6 @@ function resolveLoopHooks(input) {
             continue;
         if (droppedForBindings(capId))
             continue;
-        if (!modeOk(hook, 'step'))
-            continue;
         if (!isActive(hook))
             continue;
         const ref = (typeof hook['ref'] === 'object' && hook['ref'] !== null)
@@ -298,8 +290,6 @@ function resolveLoopHooks(input) {
             continue;
         if (droppedForBindings(capId))
             continue;
-        if (!modeOk(hook, 'contribution'))
-            continue;
         if (!isActive(hook))
             continue;
         const into = typeof hook['into'] === 'string' ? hook['into'] : undefined;
@@ -338,12 +328,6 @@ function resolveLoopHooks(input) {
         // vault gate already answers inert there, so nothing is left ungated.
         if (droppedForBindings(capId))
             continue;
-        // Phase 16 D-19 / research C-1: the mode filter runs FIRST, so a
-        // mode-filtered seal gate never consults the recorded-artifacts predicate
-        // (a default standards project pays no planning-tree read for a seal it
-        // cannot render). `modeOk` is pure, so the order changes no other result.
-        if (!modeOk(hook, 'gate'))
-            continue;
         const verdict = sealRenderVerdict(hook[SEAL_FIELD], gateStateOf(capId), recordedArtifactsOnce);
         if (verdict === 'drop')
             continue;
@@ -496,9 +480,7 @@ function renderLoopHooks(resolved) {
  * 0) when no contribution matches. No JSON envelope; `--raw` is ignored. This
  * is the text execute-phase interpolates verbatim into a spawn prompt (15-09).
  * `--active-cap` takes precedence: given both, `--into` is ignored.
- *
- * options.resolveVaultMode: an injected `() => mode | null` (pp-tools builds it
- * on vaultModeVerdict). This module never imports vault code (D-02).
+
  *
  * options.resolveRecordedArtifacts: an injected `() => boolean` (pp-tools builds
  * it on the seal leaf's hasRecordedVaultArtifacts); only literal `true` lets a
@@ -552,11 +534,8 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     for (const cap of state.capabilities || []) {
         capabilityStatesById.set(cap.id, cap);
     }
-    // Phase 15 D-02: the vault mode arrives through an injected resolver (pp-tools
-    // passes one built on vaultModeVerdict). A missing resolver, a throw or a
-    // non-mode answer is `null`, the fail-closed undefined mode (D-28).
-    const vaultMode = resolveInjectedVaultMode(options['resolveVaultMode']);
-    // Phase 16 D-19: the recorded-artifacts predicate arrives the same way (pp-tools
+    // Phase 16 D-19: the recorded-artifacts predicate arrives through an injected
+    // resolver (pp-tools
     // passes one built on the seal leaf's hasRecordedVaultArtifacts). The resolver
     // memoises it and asks it only for an enabled, config-inactive seal gate.
     const resolveRecordedArtifacts = options['resolveRecordedArtifacts'];
@@ -570,7 +549,7 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
         // --active-cap reads the UNFILTERED resolution (16-16 D-81, see above):
         // without the bindings thunk, so it keeps answering the config switch.
         resolved = resolveLoopHooks({
-            point, registry, config, cwd, capabilityStatesById, vaultMode, recordedArtifacts,
+            point, registry, config, cwd, capabilityStatesById, recordedArtifacts,
             ...(activeCapId === undefined ? { platformBindingsPresent } : {}),
         });
     }
@@ -583,7 +562,7 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     if (activeCapId !== undefined) {
         // Phase 16 D-27 (research C-3): a hook rendering is no longer enough — the
         // capability must itself be active. A seal gate renders for a config-
-        // inactive vault-practices, and the doors read `--active-cap` as their
+        // inactive vault, and the doors read `--active-cap` as their
         // switch, so a seal must never make an inactive capability answer `true`.
         // Equivalent to the old answer on every input without a seal: a normal
         // hook renders only for an active capability.
@@ -634,9 +613,6 @@ module.exports = {
     // Re-exported for identity parity guard (FIX 2: resolveConfigValues in this module
     // calls resolveConfigKey; exporting it here makes the single-owner contract testable).
     resolveConfigKey,
-    // Re-exported for the same identity pin: the mode-filter rule has one owner,
-    // capability-state.cjs (Phase 15 D-02/D-28).
-    vaultModeFilterVerdict,
     // Re-exported for the same identity pin: the seal rule has one owner,
     // capability-state.cjs (Phase 16 D-19).
     sealRenderVerdict,

package/pp-core/bin/lib/org-profile.cjs

@@ -18,7 +18,7 @@
  * explicit opt-out.
  *
  * It imports ONLY node builtins (`node:fs`, `node:path`) at the top level —
- * no `./vault.cjs`, `./vault-coordinates.cjs`, `./vault-write-back.cjs`,
+ * no `./vault.cjs`, `./vault-coordinates.cjs`,
  * `./io.cjs`, `./shell-command-projection.cjs`. This is load-bearing: in
  * 33-03 BOTH `src/git-provider.cts` and `src/vault-coordinates.cts` import
  * THIS module at their own top level. If this module imported either of
@@ -33,7 +33,7 @@
  * inside `profileValueDisposition`, executed only when a profile value is
  * actually being validated, never at module load. This is the same
  * lazy-require seam `src/vault-command-router.cts` already uses for
- * `./vault.cjs` and `./vault-write-back.cjs`, and it is safe here precisely
+ * `./vault.cjs`, and it is safe here precisely
  * because `git-provider.cjs` has no top-level dependency on this module —
  * by the time any value is being validated, that module is either already
  * in the require cache or loads cleanly on its own. D-10 requires reusing
@@ -41,13 +41,6 @@
  * than writing a second regex; the lazy seam is how a zero-import leaf can
  * still do that.
  *
- * The second exception (Vault Assurance 13-03, D-23) is a top-level import
- * of `./vault-mode.cjs`, the mode vocabulary leaf. That module imports
- * nothing at all, so it can never require this module back and cannot close
- * a cycle; it is imported so `resolveVaultMode` and the `vault.mode`
- * disposition quote the key and the two literals from their one owner rather
- * than spelling them here.
- *
  * This file's own prose and code deliberately never name a concrete org
  * profile package or any client — the pointer is described only as "the
  * npm package name an operator configures". `tests/org-profile.test.cjs`
@@ -68,12 +61,8 @@ exports.resolveOrgProfile = resolveOrgProfile;
 exports.readProfileValue = readProfileValue;
 exports.booleanPolicyValue = booleanPolicyValue;
 exports.resolveVaultRequired = resolveVaultRequired;
-exports.resolveVaultMode = resolveVaultMode;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const vaultMode = require("./vault-mode.cjs");
-const { VAULT_MODE_CONFIG_KEY, DEFAULT_VAULT_MODE, VAULT_MODE_REASON, isVaultMode } = vaultMode;
 // ─── Constants ───────────────────────────────────────────────────────────────
 /** The dotted `.planning/config.json` key naming the profile package. Deliberately
  * top-level, NOT nested under `vault.`, because the profile also supplies
@@ -98,7 +87,7 @@ exports.ORG_PROFILE_NONE = 'none';
  * separate package. It carries coordinates only — never a vault ref: the
  * vault version a project builds on is committed per project in its
  * `.platform-bindings.json` (`client.vaultRef`), so no pp-core release can
- * move it. Never offered upstream — see docs/PORT-BACK-DELTA.md.
+ * move it.
  */
 exports.EMBEDDED_ORG_PROFILE_NAME = 'embedded';
 /**
@@ -159,10 +148,10 @@ function readEmbeddedProfileVersion(dataPath) {
  * guard nor `resolveVaultRequired` hand-restates the string. */
 exports.VAULT_REQUIRED_CONFIG_KEY = 'vault.required';
 /**
- * D-06's fixed allowlist: a profile may contribute exactly these seven dotted
- * config keys (five coordinates and two policy keys; the seventh, vault.mode,
- * is documented at its entry). Entry order is not contractual; membership is. Anything else
- * present in a profile document is dropped with a bounded warning.
+ * D-06's fixed allowlist: a profile may contribute exactly these six dotted
+ * config keys (five coordinates and one policy key). Entry order is not
+ * contractual; membership is. Anything else present in a profile document is
+ * dropped with a bounded warning, except the retired keys below.
  *
  * FIVE COORDINATES AND ONE POLICY (02-04, D-VH-4 / STRICT-01). The first five
  * members answer *where to fetch from* — a provider, three shared-vault
@@ -197,15 +186,14 @@ exports.ORG_PROFILE_ALLOWLIST = Object.freeze([
     'vault.fallback_host',
     'platform.host',
     'vault.required',
-    // Vault Assurance 13-03 (D-06): the second POLICY key, after vault.required
-    // (02-04). Unlike vault.required, a profile value here can make a gate LESS
-    // strict — `standards` turns the blocking vault.audit gate into
-    // not_applicable — so the widening is accepted and bounded in 13-CONTEXT
-    // D-24 (threat T-13-01): project config outranks the profile, only the two
-    // literals pass the disposition below, and the embedded fork profile does
-    // not seed it. vault.enabled and init.* stay absent from this list.
-    VAULT_MODE_CONFIG_KEY,
 ]);
+/**
+ * Keys a profile written for an older pp-core may still carry, which this
+ * engine no longer reads (FORK-ONLY: the vault once had a second, practices
+ * mode). They are dropped without a warning: a profile that still says
+ * `vault.mode` needs no attention, because the standards vault is the only vault.
+ */
+const RETIRED_PROFILE_KEYS = new Set(['vault.mode', 'vault.practices_enabled']);
 /**
  * The single top-level key naming the Phase 34 init-only seed section.
  *
@@ -656,15 +644,6 @@ function profileValueDisposition(key, value) {
             }
             return { ok: false, reason: 'value must be the boolean true or false' };
         }
-        // 13-03 (D-06, D-09): the mode accepts only its two literals, trimmed.
-        // Anything else is dropped through the existing warning / rejected[]
-        // path, and the mode then resolves to the default. The reason names the
-        // allowed values and never echoes the rejected one.
-        if (key === VAULT_MODE_CONFIG_KEY) {
-            if (isVaultMode(value))
-                return { ok: true, value: value.trim() };
-            return { ok: false, reason: 'value must be practices or standards' };
-        }
         if (typeof value !== 'string') {
             return { ok: false, reason: 'value must be a string' };
         }
@@ -950,6 +929,8 @@ function resolveOrgProfile(cwd, opts) {
             if (leaf.key === exports.ORG_PROFILE_INIT_SECTION || leaf.key.startsWith(`${exports.ORG_PROFILE_INIT_SECTION}.`)) {
                 continue;
             }
+            if (RETIRED_PROFILE_KEYS.has(leaf.key))
+                continue;
             if (!exports.ORG_PROFILE_ALLOWLIST.includes(leaf.key)) {
                 ignored.push(leaf.key);
                 if (ignoredWarningCount < PROFILE_IGNORED_WARNING_CAP) {
@@ -1128,60 +1109,3 @@ function resolveVaultRequired(cwd, opts) {
     // Level 3 — the registered default from capabilities/vault/capability.json.
     return withIgnored({ required: false, source: 'default', warnings: profile.warnings });
 }
-/**
- * Resolve `vault.mode` for `cwd`: project config, then the org profile, then
- * the registered default `practices` — the same three levels as
- * `resolveVaultRequired` above.
- *
- * Like `resolveVaultRequired` (the one ladder both the load gate and the
- * report ask, since 13-REVIEW CR-02), this resolver is the ONE reader of the
- * mode for every mode-aware surface: the `vault
- * org-profile` report (13-05), the gate, refusals and status field (13-06)
- * and the parked practices surfaces (13-07). No surface re-reads the key
- * from config itself; the negative-grep anti-drift test in
- * `tests/vault-mode.test.cjs` is what keeps a second reader from appearing.
- *
- * Level 1 reads RAW config (D-21): `resolveConfigKey` with `config: {}` and
- * `registry: {}` reads the workstream config.json and then the root
- * config.json, each in either dotted form (nested first), with NO schema
- * default and no federated fallback. The merged config from
- * `config-loader.cts` is deliberately not used:
- * `federated-config`'s `_typeMatches` substitutes the schema default for an
- * out-of-enum value, and its warning is suppressed at load
- * (`config-loader.cts`), so `"whatever"` would silently read as `practices`.
- * A project value that is present but not one of the two literals returns
- * `ok: false` with `vault_mode_invalid` and NEVER falls back (D-08): an
- * unknown mode must be refused, not treated as practices.
- *
- * Level 2 is `readProfileValue`; `profileValueDisposition` has already
- * narrowed the profile value to one of the two literals or dropped it with a
- * warning (D-09), so an invalid profile value lands at level 3.
- *
- * KNOWN GAP (D-25), recorded rather than hidden: `config-get` reads only the
- * planning dir's config.json, while level 1 here reads the workstream config
- * and then the root config. In flat mode the two agree (pinned by the parity
- * test in `tests/vault-mode.test.cjs`); on a partitioned project a root-only
- * `vault.mode` can read differently. Filed as a todo; the same gap pre-exists
- * for `vault.required`.
- *
- * Never throws: both seams already degrade to a miss on any fault.
- */
-function resolveVaultMode(cwd, opts) {
-    // Level 1 — project config, raw (ws then root, either dotted form).
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const activation = require('./capability-activation.cjs');
-    const fromConfig = activation.resolveConfigKey(VAULT_MODE_CONFIG_KEY, { config: {}, cwd, registry: {} });
-    if (fromConfig.found) {
-        if (isVaultMode(fromConfig.value)) {
-            return { ok: true, mode: fromConfig.value.trim(), source: 'config', warnings: [] };
-        }
-        return { ok: false, source: 'config', reason: VAULT_MODE_REASON.INVALID, warnings: [] };
-    }
-    // Level 2 — the org profile, already narrowed by profileValueDisposition.
-    const profile = readProfileValue(cwd, VAULT_MODE_CONFIG_KEY, opts);
-    if (isVaultMode(profile.value)) {
-        return { ok: true, mode: profile.value.trim(), source: 'profile', warnings: profile.warnings };
-    }
-    // Level 3 — the registered default from capabilities/vault/capability.json.
-    return { ok: true, mode: DEFAULT_VAULT_MODE, source: 'default', warnings: profile.warnings };
-}