@pareto4/pp-core 1.17.1 → 1.19.0

package/pp-core/bin/lib/init-contract.cjs

@@ -7,11 +7,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.INIT_SESSION_WRITE_FAILED = exports.INIT_SESSION_MALFORMED = exports.INIT_CONTRACT_FLAGS = exports.INIT_PROBE_STATUS = exports.INIT_PROBE_NOTE_KEY = exports.INIT_PROBE_WHO_KEY = exports.INIT_PROBE_WHEN_KEY = exports.INIT_PROBE_STATUS_KEY = exports.INIT_ORG_PROFILE_DECLINED_KEY = exports.INIT_COMPOSE_DECLINED_KEY = void 0;
 exports.resolveVaultEnabledState = resolveVaultEnabledState;
-exports.resolveVaultPracticesEnabledState = resolveVaultPracticesEnabledState;
 exports.resolveVaultRequiredState = resolveVaultRequiredState;
 exports.readVaultEnabledState = readVaultEnabledState;
-exports.readVaultPracticesEnabledState = readVaultPracticesEnabledState;
-exports.readVaultStandardsModeActive = readVaultStandardsModeActive;
 exports.readVaultRequiredState = readVaultRequiredState;
 exports.buildInitQuestions = buildInitQuestions;
 exports.deriveSlug = deriveSlug;
@@ -116,18 +113,12 @@ function getDotted(obj, dottedPath) {
 }
 /** Arms the vault capability; written by the session machine, never by an org profile. */
 const VAULT_ENABLED_CONFIG_KEY = 'vault.enabled';
-/** Arms vault-practices; set beside `vault.enabled` under the same absent-only rule, inert without it. */
-const VAULT_PRACTICES_ENABLED_CONFIG_KEY = 'vault.practices_enabled';
 /** The single reading of `vault.enabled` in this module, in the form the gate honours
  * (`resolveGateHonouredKeyState`, Phase 15 D-32). `value` is the observed value, never a
  * coercion, so reports name what is really in the file. */
 function resolveVaultEnabledState(parsed) {
     return resolveGateHonouredKeyState(parsed, VAULT_ENABLED_CONFIG_KEY);
 }
-/** Four-state reading of `vault.practices_enabled`, like `resolveVaultEnabledState`. */
-function resolveVaultPracticesEnabledState(parsed) {
-    return resolveGateHonouredKeyState(parsed, VAULT_PRACTICES_ENABLED_CONFIG_KEY);
-}
 /** Four-state reading of the project's OWN `vault.required` (not the profile-layered gate value),
  * so the arming guard respects an explicit per-project `false`. */
 function resolveVaultRequiredState(parsed) {
@@ -151,12 +142,11 @@ function resolveBooleanKeyState(parsed, key) {
 }
 /**
  * Four-state reading of a vault switch whose gates read ONLY the nested form (Phase 15
- * D-32): `vault.enabled` and `vault.practices_enabled`. `loadConfig` materialises their
- * nested defaults, so the gates' evaluator answers at its first level and never reaches a
+ * D-32): `vault.enabled`. `loadConfig` materialises its nested default, so the gates' evaluator answers at its first level and never reaches a
  * hand-written FLAT key (it warns that the key is ignored). Reading the flat form as
  * `armed` therefore told /pp-init that a switch was on while no gate rendered. The
  * absent-only arming then skipped it, and the done line promised governance nobody
- * enforced (todo init-practices-reader-reads-flat-form-as-armed).
+ * enforced.
  *
  *   - nested present: its value decides, exactly as before;
  *   - flat-only `true`: `absent`, because the gate sees nothing. The arming writes the
@@ -222,21 +212,6 @@ function readRootKeyState(cwd, resolve) {
 function readVaultEnabledState(cwd) {
     return agreeWithGate(readRootKeyState(cwd, resolveVaultEnabledState), gateReadsOn((v) => v.isVaultGateActive(cwd)));
 }
-/** `vault.practices_enabled` for the project at `cwd`: `armed` exactly when
- * `isPracticesGateActive`, the one practices-switch reader (15-02), is ON. Never throws. */
-function readVaultPracticesEnabledState(cwd) {
-    return agreeWithGate(readRootKeyState(cwd, resolveVaultPracticesEnabledState), gateReadsOn((v) => v.isPracticesGateActive(cwd)));
-}
-/**
- * Whether the project at `cwd` is in standards mode, asked of the one mode owner
- * (`isStandardsModeActive`, which honours the org-profile ladder). The /pp-init done line
- * uses it so that, in standards mode, it names the standards record the `vault.trace`
- * gate checks instead of practice recording, which standards mode does not do
- * (15-REVIEW WR-09). Any throw reads as not standards. Never throws.
- */
-function readVaultStandardsModeActive(cwd) {
-    return gateReadsOn((v) => v.isStandardsModeActive(cwd));
-}
 /** `vault.required` for the project at `cwd`: `armed` exactly when the load gate's own
  * answer (`resolveVaultRequiredFlag`) is true. Never throws. */
 function readVaultRequiredState(cwd) {
@@ -250,7 +225,7 @@ function isVaultEnabledInConfig(parsed) {
 // ─── buildInitQuestions ────────────────────────────────────────────────────
 /** The canonical /pp-init question set, as data; the session may answer some itself (see "Automatic answers").
  * No org-profile question in this fork (PBI 74316); provider options come from `PROVIDERS`, preselected via `resolveProvider`. */
-function buildInitQuestions(cwd) {
+function buildInitQuestions(cwd, opts = {}) {
     let preselected = git_provider_cjs_1.DEFAULT_PROVIDER;
     try {
         preselected = (0, git_provider_cjs_1.resolveProvider)(cwd).provider;
@@ -272,6 +247,7 @@ function buildInitQuestions(cwd) {
             prompt: 'Client slug (kebab-case, e.g. "acme") — type "internal" if none',
             optionalAnswer: false,
         },
+        ...clientVaultQuestion(cwd, opts),
         { id: 'description', prompt: 'One-line description (what this project does)', optionalAnswer: false },
         {
             id: 'provider',
@@ -284,6 +260,23 @@ function buildInitQuestions(cwd) {
         { id: 'visibility', prompt: 'Visibility (private / public / internal)', optionalAnswer: false },
     ];
 }
+/** The client-vault question, asked while no vault is bound and a binding can be composed (`clientVaultChoice`).
+ * Blank or "none" keeps the org profile's seeded vault, if any; an answer replaces it in the binding.
+ * An internal project is answered "none" automatically (see `autoAnswerFor`). */
+function clientVaultQuestion(cwd, opts) {
+    const choice = (0, compose_bindings_cjs_1.clientVaultChoice)(cwd, opts);
+    if (!choice.offered)
+        return [];
+    return [
+        {
+            id: 'client_vault',
+            prompt: choice.defaultRepo === null
+                ? 'Client vault repo ("owner/name" or a full clone URL) — type "none" to bind no client vault'
+                : `Client vault repo ("owner/name" or a full clone URL) — type "none" to use the default vault (${choice.defaultRepo})`,
+            optionalAnswer: true,
+        },
+    ];
+}
 // ─── Automatic answers (PBI 74299): an org profile init section fixes answers and can derive slugs ───
 /** The visibility answers the question accepts. */
 const VISIBILITY_OPTIONS = Object.freeze(['private', 'public', 'internal']);
@@ -345,6 +338,9 @@ function autoAnswerFor(id, answers, init) {
         const value = init.fixed[id];
         return value === undefined ? null : { value, source: 'org-profile' };
     }
+    if (id === 'client_vault' && answers.client_slug === 'internal') {
+        return { value: 'none', source: 'derived' };
+    }
     if (init.deriveSlugs && (id === 'project_slug' || id === 'client_slug')) {
         const name = answers[id === 'project_slug' ? 'project_name' : 'client_name'];
         const slug = typeof name === 'string' ? deriveSlug(name) : null;
@@ -353,10 +349,10 @@ function autoAnswerFor(id, answers, init) {
     return null;
 }
 /** The session's automatic answers, in question order. */
-function listAutoAnswers(cwd, session) {
+function listAutoAnswers(cwd, session, opts) {
     const sources = session.autoAnswers ?? {};
     const out = [];
-    for (const q of buildInitQuestions(cwd)) {
+    for (const q of buildInitQuestions(cwd, { _globalRoot: opts._globalRoot })) {
         const source = sources[q.id];
         const value = session.answers[q.id];
         if (source !== undefined && typeof value === 'string')
@@ -662,27 +658,24 @@ function writeIdentityAndProvider(cwd, answers) {
     writeConfigMerge(cwd, patch);
 }
 /** The ONE owner of the arm-where-absent rule (quick 261003-kmd): arms `vault.enabled`,
- * `vault.practices_enabled` and `vault.required` only where ABSENT, from one read in one write.
+ * and `vault.required` only where ABSENT, from one read in one write.
  *
- * A successful composition means a client vault exists, so the three keys are armed (OD-1,
+ * A successful composition means a client vault exists, so the two keys are armed (OD-1,
  * 260915-lmc, 260916-s5n). An explicit `false` or a malformed value is kept — that is the
  * operator's decision, never overwritten (07-09 WR-07). The write happens only when there is
  * something to arm: the nested- and flat-form byte-identity pins depend on a no-op writing
  * nothing. Callers: the session's `'unchanged'` decision (how existing projects get armed by a
  * plain re-run), the approved `compose_confirm`, and `armVaultFromProfile` (`/pp-new-project`).
- * It exists because the two session copies had already drifted once — the practices key was
- * added to both by hand in 260915-lmc — and a third route would have been a third copy.
+ * It exists because the two session copies had already drifted once, and a third route would
+ * have been a third copy.
  *
- * @returns the armed key names, in the fixed order enabled, practices_enabled, required. */
+ * @returns the armed key names, in the fixed order enabled, required. */
 function armVaultKeysWhereAbsent(cwd) {
     const { parsed } = readConfigFile(cwd);
     const vaultPatch = {};
     if (resolveVaultEnabledState(parsed).state === 'absent') {
         vaultPatch.enabled = true;
     }
-    if (resolveVaultPracticesEnabledState(parsed).state === 'absent') {
-        vaultPatch.practices_enabled = true;
-    }
     if (resolveVaultRequiredState(parsed).state === 'absent') {
         vaultPatch.required = true;
     }
@@ -786,10 +779,15 @@ function normalizeYesNo(value) {
 }
 /** Decide the current step, performing its idempotent side effects once: automatic answers, the identity write,
  * the compose decision and `doneAt`. Recomputes the question set on every call. */
+/** The client vault the operator named, or `undefined` to keep the seeded one. */
+function answeredClientVault(session) {
+    const checked = (0, compose_bindings_cjs_1.validateClientVaultAnswer)(session.answers.client_vault);
+    return checked.ok && checked.value !== null ? checked.value : undefined;
+}
 function computeCurrentStep(cwd, session, opts) {
     // Any failure degrades to a `write_failed` step instead of throwing.
     try {
-        const questions = buildInitQuestions(cwd);
+        const questions = buildInitQuestions(cwd, { _globalRoot: opts._globalRoot });
         // PBI 74299: read once per call; only consulted for an unanswered question.
         let profileInit = null;
         for (const q of questions) {
@@ -812,7 +810,11 @@ function computeCurrentStep(cwd, session, opts) {
             persistSession(cwd, session);
         }
         if (session.composeDecision === null) {
-            const dryRun = (0, compose_bindings_cjs_1.composeBindings)(cwd, { offline: opts.offline === true, _globalRoot: opts._globalRoot });
+            const dryRun = (0, compose_bindings_cjs_1.composeBindings)(cwd, {
+                offline: opts.offline === true,
+                _globalRoot: opts._globalRoot,
+                clientVaultRepo: answeredClientVault(session),
+            });
             // Offer compose_confirm only when approving would change something; 'unchanged' and 'skipped' are distinct end states.
             if (dryRun.composable === true && dryRun.action !== 'unchanged') {
                 // VAULT-EGRESS-1: `info` is display-only (the CLI and the TTY renderer print it); approval
@@ -917,7 +919,7 @@ function initSessionNext(cwd, opts = {}) {
     }
     const session = loaded.session;
     const state = currentStepToState(computeCurrentStep(cwd, session, opts));
-    const autoAnswered = listAutoAnswers(cwd, session);
+    const autoAnswered = listAutoAnswers(cwd, session, opts);
     return autoAnswered.length > 0 ? { ...state, autoAnswered } : state;
 }
 /** Record one answer for the current step only; out-of-order, blank required, unparseable or post-done answers are rejected. */
@@ -957,6 +959,12 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
                 return { ok: false, reason: 'answer_required', message: `Question "${stepId}" requires a non-blank answer.` };
             }
             const answerValue = typeof value === 'string' ? value : '';
+            if (stepId === 'client_vault') {
+                const checked = (0, compose_bindings_cjs_1.validateClientVaultAnswer)(answerValue);
+                if (!checked.ok) {
+                    return { ok: false, reason: 'invalid_answer', message: `Question "client_vault": ${checked.reason}` };
+                }
+            }
             session.answers[stepId] = answerValue;
             persistSession(cwd, session);
             return { ok: true };
@@ -979,7 +987,12 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
             }
             if (normalized === true) {
                 // Check the write result before recording "approved": the file can change between the dry run and this write.
-                const writeResult = (0, compose_bindings_cjs_1.composeBindings)(cwd, { write: true, offline: opts.offline === true, _globalRoot: opts._globalRoot });
+                const writeResult = (0, compose_bindings_cjs_1.composeBindings)(cwd, {
+                    write: true,
+                    offline: opts.offline === true,
+                    _globalRoot: opts._globalRoot,
+                    clientVaultRepo: answeredClientVault(session),
+                });
                 if (writeResult.composable !== true || writeResult.wrote !== true) {
                     // Leave the decision unset so the next call re-evaluates and can re-offer compose_confirm.
                     return {

package/pp-core/bin/lib/init-interactive.cjs

@@ -161,36 +161,22 @@ async function runInitInteractive(cwd, prompter, opts = {}) {
                         'INIT_VAULT_ENABLED_MALFORMED; store the boolean with pp-tools config-set vault.enabled true.');
                 }
                 else if (vaultState === 'armed') {
-                    // Quick 260915-lmc: vault.practices_enabled is armed beside it under
-                    // the same absent-only rule, so the line names it only when the
-                    // READING says true — an explicit false is the project's choice and
-                    // is not contradicted here.
-                    const practicesArmed = (0, init_contract_cjs_1.readVaultPracticesEnabledState)(cwd).state === 'armed';
                     // Quick 260916-s5n: vault.required is named only when the READING
                     // says armed, by the same rule — an explicit false is the project's
                     // choice and the last line printed must not contradict it.
                     const requiredArmed = (0, init_contract_cjs_1.readVaultRequiredState)(cwd).state === 'armed';
-                    // Built as a head plus two OPTIONAL clauses carrying no terminator
-                    // of their own, with exactly one full stop appended at the end. The
-                    // stop used to live inside the practices branch, which made every
-                    // further clause a sentence continuing past its own period.
+                    // Built as a head plus clauses carrying no terminator of their own,
+                    // with exactly one full stop appended at the end.
                     const head = 'Done — .platform-bindings.json was composed and written; vault.enabled is now true ' +
                         '(the vault capability is armed — /pp-init Step 2.6 probes reachability next)';
-                    // 15-REVIEW WR-09: in standards mode no phase records practices (the
-                    // practices planner fragment and trace gates are filtered out), so the
-                    // clause names what IS recorded and checked there, whatever the
-                    // practices switch reads.
-                    const practicesClause = (0, init_contract_cjs_1.readVaultStandardsModeActive)(cwd)
-                        ? '; vault.mode is standards, so each plan records which client standards documents governed it ' +
-                            '(<vault_standards>), checked by the vault.trace gate'
-                        : practicesArmed
-                            ? '; vault.practices_enabled is true, so each phase records which client vault practices it applied'
-                            : '';
+                    // 15-REVIEW WR-09: the clause names what is recorded and checked.
+                    const standardsClause = '; each plan records which client standards documents governed it ' +
+                        '(<vault_standards>), checked by the vault.trace gate';
                     const requiredClause = requiredArmed
                         ? '; vault.required is true, so a client vault miss, a failed fetch or an unwritable vault summary ' +
                             'stops the build at plan:pre and execute:pre'
                         : '';
-                    prompter.print(head + practicesClause + requiredClause + '.');
+                    prompter.print(head + standardsClause + requiredClause + '.');
                 }
                 else {
                     // 'absent' — unreachable after an approved compose (the arming

package/pp-core/bin/lib/io.cjs

@@ -180,19 +180,13 @@ const ERROR_REASON = Object.freeze({
     PLATFORM_BINDINGS_PARSE_FAILED: 'platform_bindings_parse_failed',
     // init (Phase 34-09 gap closure: `pp-tools init` interactive command)
     INIT_NON_INTERACTIVE: 'init_non_interactive',
-    // vault write-back promote arm (Phase 29 WRB-01/03)
+    // vault promote (a standards document into the client vault)
     VAULT_PROMOTE_DISABLED: 'vault_promote_disabled',
-    VAULT_PROMOTE_INVALID_PRACTICE: 'vault_promote_invalid_practice',
+    VAULT_PROMOTE_INVALID_DOCUMENT: 'vault_promote_invalid_document',
     VAULT_PROMOTE_SECRET_DETECTED: 'vault_promote_secret_detected',
     VAULT_PROMOTE_TARGET_REFUSED: 'vault_promote_target_refused',
     VAULT_PROMOTE_CONCURRENT_EDIT: 'vault_promote_concurrent_edit',
     VAULT_PROMOTE_TRANSPORT_FAILED: 'vault_promote_transport_failed',
-    // vault.mode (Vault Assurance 13-03, D-08/D-14): an unrecognised mode value,
-    // and the standards-mode promote refusal
-    VAULT_MODE_INVALID: 'vault_mode_invalid',
-    // 13-REVIEW WR-01: the mode resolver failed; refused like an invalid value
-    VAULT_MODE_UNRESOLVED: 'vault_mode_unresolved',
-    VAULT_PROMOTE_NOT_APPLICABLE: 'vault_promote_not_applicable',
     // discovery rollup (discovery-v2 Phase 1: D-07/D-08 gate)
     DISCOVERY_ROLLUP_PARSE_FAILED: 'discovery_rollup_parse_failed',
     DISCOVERY_ROLLUP_MISMATCH: 'discovery_rollup_mismatch',

package/pp-core/bin/lib/loop-resolver.cjs

@@ -13,7 +13,7 @@
  * Command surface: pp-tools loop render-hooks <point>
  *
  * Exports (three things):
- *   resolveLoopHooks({ point, registry, config, vaultMode?, recordedArtifacts? }) → { point, activeHooks }
+ *   resolveLoopHooks({ point, registry, config, recordedArtifacts? }) → { point, activeHooks }
  *   renderLoopHooks(resolved) → markdown string
  *   cmdLoopRenderHooks(cwd, point, raw, options) — I/O entry point
  *
@@ -36,7 +36,7 @@ const configLoaderModule = require("./config-loader.cjs");
 const { loadConfig } = configLoaderModule;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityStateModule = require("./capability-state.cjs");
-const { resolveCapabilityRuntimeState, vaultModeFilterVerdict, resolveInjectedVaultMode, SEAL_FIELD, sealRenderVerdict, resolveInjectedRecordedArtifacts, resolveInjectedPlatformBindingsPresent, } = capabilityStateModule;
+const { resolveCapabilityRuntimeState, SEAL_FIELD, sealRenderVerdict, resolveInjectedRecordedArtifacts, resolveInjectedPlatformBindingsPresent, } = capabilityStateModule;
 // ─── Capability-activation engine (single owner for config-key precedence) ────
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityActivationModule = require("./capability-activation.cjs");
@@ -103,7 +103,7 @@ function _getCanonicalPoints(_registry) {
  * resolved against `config`; active iff truthy. Inactive hooks are filtered out.
  */
 function resolveLoopHooks(input) {
-    const { point, registry, config, cwd, capabilityStatesById, vaultMode, recordedArtifacts, platformBindingsPresent, } = input;
+    const { point, registry, config, cwd, capabilityStatesById, recordedArtifacts, platformBindingsPresent, } = input;
     // Validate point
     const canonicalPoints = _getCanonicalPoints(registry);
     if (!canonicalPoints.includes(point)) {
@@ -122,12 +122,6 @@ function resolveLoopHooks(input) {
     }
     const entryMap = entry;
     const activeHooks = [];
-    // Phase 15 D-02/D-28: the per-hook `vaultMode` filter, one rule owned by
-    // capability-state (`vaultModeFilterVerdict`), evaluated against the injected
-    // mode VALUE. The field is read here and never copied into an ActiveHook.
-    function modeOk(hook, kind) {
-        return vaultModeFilterVerdict(hook['vaultMode'], kind, vaultMode);
-    }
     // Helper: check activation using single-key precedence resolver (FIX 1 + FIX 3)
     function isActive(hook) {
         const when = hook['when'];
@@ -260,8 +254,6 @@ function resolveLoopHooks(input) {
             continue;
         if (droppedForBindings(capId))
             continue;
-        if (!modeOk(hook, 'step'))
-            continue;
         if (!isActive(hook))
             continue;
         const ref = (typeof hook['ref'] === 'object' && hook['ref'] !== null)
@@ -298,8 +290,6 @@ function resolveLoopHooks(input) {
             continue;
         if (droppedForBindings(capId))
             continue;
-        if (!modeOk(hook, 'contribution'))
-            continue;
         if (!isActive(hook))
             continue;
         const into = typeof hook['into'] === 'string' ? hook['into'] : undefined;
@@ -338,12 +328,6 @@ function resolveLoopHooks(input) {
         // vault gate already answers inert there, so nothing is left ungated.
         if (droppedForBindings(capId))
             continue;
-        // Phase 16 D-19 / research C-1: the mode filter runs FIRST, so a
-        // mode-filtered seal gate never consults the recorded-artifacts predicate
-        // (a default standards project pays no planning-tree read for a seal it
-        // cannot render). `modeOk` is pure, so the order changes no other result.
-        if (!modeOk(hook, 'gate'))
-            continue;
         const verdict = sealRenderVerdict(hook[SEAL_FIELD], gateStateOf(capId), recordedArtifactsOnce);
         if (verdict === 'drop')
             continue;
@@ -496,9 +480,7 @@ function renderLoopHooks(resolved) {
  * 0) when no contribution matches. No JSON envelope; `--raw` is ignored. This
  * is the text execute-phase interpolates verbatim into a spawn prompt (15-09).
  * `--active-cap` takes precedence: given both, `--into` is ignored.
- *
- * options.resolveVaultMode: an injected `() => mode | null` (pp-tools builds it
- * on vaultModeVerdict). This module never imports vault code (D-02).
+
  *
  * options.resolveRecordedArtifacts: an injected `() => boolean` (pp-tools builds
  * it on the seal leaf's hasRecordedVaultArtifacts); only literal `true` lets a
@@ -552,11 +534,8 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     for (const cap of state.capabilities || []) {
         capabilityStatesById.set(cap.id, cap);
     }
-    // Phase 15 D-02: the vault mode arrives through an injected resolver (pp-tools
-    // passes one built on vaultModeVerdict). A missing resolver, a throw or a
-    // non-mode answer is `null`, the fail-closed undefined mode (D-28).
-    const vaultMode = resolveInjectedVaultMode(options['resolveVaultMode']);
-    // Phase 16 D-19: the recorded-artifacts predicate arrives the same way (pp-tools
+    // Phase 16 D-19: the recorded-artifacts predicate arrives through an injected
+    // resolver (pp-tools
     // passes one built on the seal leaf's hasRecordedVaultArtifacts). The resolver
     // memoises it and asks it only for an enabled, config-inactive seal gate.
     const resolveRecordedArtifacts = options['resolveRecordedArtifacts'];
@@ -570,7 +549,7 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
         // --active-cap reads the UNFILTERED resolution (16-16 D-81, see above):
         // without the bindings thunk, so it keeps answering the config switch.
         resolved = resolveLoopHooks({
-            point, registry, config, cwd, capabilityStatesById, vaultMode, recordedArtifacts,
+            point, registry, config, cwd, capabilityStatesById, recordedArtifacts,
             ...(activeCapId === undefined ? { platformBindingsPresent } : {}),
         });
     }
@@ -583,7 +562,7 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     if (activeCapId !== undefined) {
         // Phase 16 D-27 (research C-3): a hook rendering is no longer enough — the
         // capability must itself be active. A seal gate renders for a config-
-        // inactive vault-practices, and the doors read `--active-cap` as their
+        // inactive vault, and the doors read `--active-cap` as their
         // switch, so a seal must never make an inactive capability answer `true`.
         // Equivalent to the old answer on every input without a seal: a normal
         // hook renders only for an active capability.
@@ -634,9 +613,6 @@ module.exports = {
     // Re-exported for identity parity guard (FIX 2: resolveConfigValues in this module
     // calls resolveConfigKey; exporting it here makes the single-owner contract testable).
     resolveConfigKey,
-    // Re-exported for the same identity pin: the mode-filter rule has one owner,
-    // capability-state.cjs (Phase 15 D-02/D-28).
-    vaultModeFilterVerdict,
     // Re-exported for the same identity pin: the seal rule has one owner,
     // capability-state.cjs (Phase 16 D-19).
     sealRenderVerdict,

package/pp-core/bin/lib/org-profile.cjs

@@ -18,7 +18,7 @@
  * explicit opt-out.
  *
  * It imports ONLY node builtins (`node:fs`, `node:path`) at the top level —
- * no `./vault.cjs`, `./vault-coordinates.cjs`, `./vault-write-back.cjs`,
+ * no `./vault.cjs`, `./vault-coordinates.cjs`,
  * `./io.cjs`, `./shell-command-projection.cjs`. This is load-bearing: in
  * 33-03 BOTH `src/git-provider.cts` and `src/vault-coordinates.cts` import
  * THIS module at their own top level. If this module imported either of
@@ -33,7 +33,7 @@
  * inside `profileValueDisposition`, executed only when a profile value is
  * actually being validated, never at module load. This is the same
  * lazy-require seam `src/vault-command-router.cts` already uses for
- * `./vault.cjs` and `./vault-write-back.cjs`, and it is safe here precisely
+ * `./vault.cjs`, and it is safe here precisely
  * because `git-provider.cjs` has no top-level dependency on this module —
  * by the time any value is being validated, that module is either already
  * in the require cache or loads cleanly on its own. D-10 requires reusing
@@ -41,13 +41,6 @@
  * than writing a second regex; the lazy seam is how a zero-import leaf can
  * still do that.
  *
- * The second exception (Vault Assurance 13-03, D-23) is a top-level import
- * of `./vault-mode.cjs`, the mode vocabulary leaf. That module imports
- * nothing at all, so it can never require this module back and cannot close
- * a cycle; it is imported so `resolveVaultMode` and the `vault.mode`
- * disposition quote the key and the two literals from their one owner rather
- * than spelling them here.
- *
  * This file's own prose and code deliberately never name a concrete org
  * profile package or any client — the pointer is described only as "the
  * npm package name an operator configures". `tests/org-profile.test.cjs`
@@ -68,12 +61,8 @@ exports.resolveOrgProfile = resolveOrgProfile;
 exports.readProfileValue = readProfileValue;
 exports.booleanPolicyValue = booleanPolicyValue;
 exports.resolveVaultRequired = resolveVaultRequired;
-exports.resolveVaultMode = resolveVaultMode;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const vaultMode = require("./vault-mode.cjs");
-const { VAULT_MODE_CONFIG_KEY, DEFAULT_VAULT_MODE, VAULT_MODE_REASON, isVaultMode } = vaultMode;
 // ─── Constants ───────────────────────────────────────────────────────────────
 /** The dotted `.planning/config.json` key naming the profile package. Deliberately
  * top-level, NOT nested under `vault.`, because the profile also supplies
@@ -98,7 +87,7 @@ exports.ORG_PROFILE_NONE = 'none';
  * separate package. It carries coordinates only — never a vault ref: the
  * vault version a project builds on is committed per project in its
  * `.platform-bindings.json` (`client.vaultRef`), so no pp-core release can
- * move it. Never offered upstream — see docs/PORT-BACK-DELTA.md.
+ * move it.
  */
 exports.EMBEDDED_ORG_PROFILE_NAME = 'embedded';
 /**
@@ -159,10 +148,10 @@ function readEmbeddedProfileVersion(dataPath) {
  * guard nor `resolveVaultRequired` hand-restates the string. */
 exports.VAULT_REQUIRED_CONFIG_KEY = 'vault.required';
 /**
- * D-06's fixed allowlist: a profile may contribute exactly these seven dotted
- * config keys (five coordinates and two policy keys; the seventh, vault.mode,
- * is documented at its entry). Entry order is not contractual; membership is. Anything else
- * present in a profile document is dropped with a bounded warning.
+ * D-06's fixed allowlist: a profile may contribute exactly these six dotted
+ * config keys (five coordinates and one policy key). Entry order is not
+ * contractual; membership is. Anything else present in a profile document is
+ * dropped with a bounded warning, except the retired keys below.
  *
  * FIVE COORDINATES AND ONE POLICY (02-04, D-VH-4 / STRICT-01). The first five
  * members answer *where to fetch from* — a provider, three shared-vault
@@ -197,15 +186,14 @@ exports.ORG_PROFILE_ALLOWLIST = Object.freeze([
     'vault.fallback_host',
     'platform.host',
     'vault.required',
-    // Vault Assurance 13-03 (D-06): the second POLICY key, after vault.required
-    // (02-04). Unlike vault.required, a profile value here can make a gate LESS
-    // strict — `standards` turns the blocking vault.audit gate into
-    // not_applicable — so the widening is accepted and bounded in 13-CONTEXT
-    // D-24 (threat T-13-01): project config outranks the profile, only the two
-    // literals pass the disposition below, and the embedded fork profile does
-    // not seed it. vault.enabled and init.* stay absent from this list.
-    VAULT_MODE_CONFIG_KEY,
 ]);
+/**
+ * Keys a profile written for an older pp-core may still carry, which this
+ * engine no longer reads (FORK-ONLY: the vault once had a second, practices
+ * mode). They are dropped without a warning: a profile that still says
+ * `vault.mode` needs no attention, because the standards vault is the only vault.
+ */
+const RETIRED_PROFILE_KEYS = new Set(['vault.mode', 'vault.practices_enabled']);
 /**
  * The single top-level key naming the Phase 34 init-only seed section.
  *
@@ -656,15 +644,6 @@ function profileValueDisposition(key, value) {
             }
             return { ok: false, reason: 'value must be the boolean true or false' };
         }
-        // 13-03 (D-06, D-09): the mode accepts only its two literals, trimmed.
-        // Anything else is dropped through the existing warning / rejected[]
-        // path, and the mode then resolves to the default. The reason names the
-        // allowed values and never echoes the rejected one.
-        if (key === VAULT_MODE_CONFIG_KEY) {
-            if (isVaultMode(value))
-                return { ok: true, value: value.trim() };
-            return { ok: false, reason: 'value must be practices or standards' };
-        }
         if (typeof value !== 'string') {
             return { ok: false, reason: 'value must be a string' };
         }
@@ -950,6 +929,8 @@ function resolveOrgProfile(cwd, opts) {
             if (leaf.key === exports.ORG_PROFILE_INIT_SECTION || leaf.key.startsWith(`${exports.ORG_PROFILE_INIT_SECTION}.`)) {
                 continue;
             }
+            if (RETIRED_PROFILE_KEYS.has(leaf.key))
+                continue;
             if (!exports.ORG_PROFILE_ALLOWLIST.includes(leaf.key)) {
                 ignored.push(leaf.key);
                 if (ignoredWarningCount < PROFILE_IGNORED_WARNING_CAP) {
@@ -1128,60 +1109,3 @@ function resolveVaultRequired(cwd, opts) {
     // Level 3 — the registered default from capabilities/vault/capability.json.
     return withIgnored({ required: false, source: 'default', warnings: profile.warnings });
 }
-/**
- * Resolve `vault.mode` for `cwd`: project config, then the org profile, then
- * the registered default `practices` — the same three levels as
- * `resolveVaultRequired` above.
- *
- * Like `resolveVaultRequired` (the one ladder both the load gate and the
- * report ask, since 13-REVIEW CR-02), this resolver is the ONE reader of the
- * mode for every mode-aware surface: the `vault
- * org-profile` report (13-05), the gate, refusals and status field (13-06)
- * and the parked practices surfaces (13-07). No surface re-reads the key
- * from config itself; the negative-grep anti-drift test in
- * `tests/vault-mode.test.cjs` is what keeps a second reader from appearing.
- *
- * Level 1 reads RAW config (D-21): `resolveConfigKey` with `config: {}` and
- * `registry: {}` reads the workstream config.json and then the root
- * config.json, each in either dotted form (nested first), with NO schema
- * default and no federated fallback. The merged config from
- * `config-loader.cts` is deliberately not used:
- * `federated-config`'s `_typeMatches` substitutes the schema default for an
- * out-of-enum value, and its warning is suppressed at load
- * (`config-loader.cts`), so `"whatever"` would silently read as `practices`.
- * A project value that is present but not one of the two literals returns
- * `ok: false` with `vault_mode_invalid` and NEVER falls back (D-08): an
- * unknown mode must be refused, not treated as practices.
- *
- * Level 2 is `readProfileValue`; `profileValueDisposition` has already
- * narrowed the profile value to one of the two literals or dropped it with a
- * warning (D-09), so an invalid profile value lands at level 3.
- *
- * KNOWN GAP (D-25), recorded rather than hidden: `config-get` reads only the
- * planning dir's config.json, while level 1 here reads the workstream config
- * and then the root config. In flat mode the two agree (pinned by the parity
- * test in `tests/vault-mode.test.cjs`); on a partitioned project a root-only
- * `vault.mode` can read differently. Filed as a todo; the same gap pre-exists
- * for `vault.required`.
- *
- * Never throws: both seams already degrade to a miss on any fault.
- */
-function resolveVaultMode(cwd, opts) {
-    // Level 1 — project config, raw (ws then root, either dotted form).
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const activation = require('./capability-activation.cjs');
-    const fromConfig = activation.resolveConfigKey(VAULT_MODE_CONFIG_KEY, { config: {}, cwd, registry: {} });
-    if (fromConfig.found) {
-        if (isVaultMode(fromConfig.value)) {
-            return { ok: true, mode: fromConfig.value.trim(), source: 'config', warnings: [] };
-        }
-        return { ok: false, source: 'config', reason: VAULT_MODE_REASON.INVALID, warnings: [] };
-    }
-    // Level 2 — the org profile, already narrowed by profileValueDisposition.
-    const profile = readProfileValue(cwd, VAULT_MODE_CONFIG_KEY, opts);
-    if (isVaultMode(profile.value)) {
-        return { ok: true, mode: profile.value.trim(), source: 'profile', warnings: profile.warnings };
-    }
-    // Level 3 — the registered default from capabilities/vault/capability.json.
-    return { ok: true, mode: DEFAULT_VAULT_MODE, source: 'default', warnings: profile.warnings };
-}