@pareto4/pp-core 1.20.0 → 1.21.0

package/pp-core/bin/lib/capability-activation.cjs

@@ -183,7 +183,84 @@ function _resolveActivationValue(dotKey, config, cwd, registry) {
     const r = resolveConfigKey(dotKey, { config, cwd, registry });
     return r.found ? Boolean(r.value) : false;
 }
+// ─── Hook `when` evaluation (Phase 37, D-14) ──────────────────────────────────
+// In .cts (CommonJS output) files `require` is a global; JSON candidates are
+// loaded through it, like src/model-catalog.cts and src/ceremony.cts do.
+const _require = require;
+const _gateCandidates = [
+    node_path_1.default.resolve(__dirname, '..', 'shared', 'ceremony-gates.json'),
+    node_path_1.default.resolve(__dirname, '..', '..', 'pp-core', 'bin', 'shared', 'ceremony-gates.json'),
+];
+/**
+ * The ceremony gate vocabulary (keys of pp-core/bin/shared/ceremony-gates.json),
+ * or null when the file cannot be read or parsed. A `ceremony.<gate>` conjunct
+ * is checked against this Set, never used to index an object (T-37-12), and a
+ * null vocabulary makes every such conjunct answer true (fail toward ceremony,
+ * T-37-13).
+ */
+const CEREMONY_GATE_KEYS = (() => {
+    for (const candidate of _gateCandidates) {
+        try {
+            const vocab = _require(candidate);
+            if (!vocab || !Array.isArray(vocab.gates))
+                continue;
+            const keys = vocab.gates.map((g) => g && g.key).filter((k) => typeof k === 'string');
+            if (keys.length > 0)
+                return new Set(keys);
+        }
+        catch { /* try the next candidate */ }
+    }
+    return null;
+})();
+/**
+ * The one evaluator for a hook's `when`, shared by the loop resolver and the
+ * capability-state report so the two cannot drift (D-14).
+ *
+ *   - undefined / null          -> true (unconditional hook)
+ *   - non-string or empty       -> false (malformed registry data, FIX 3)
+ *   - otherwise `when` is split on `&&`; every trimmed conjunct must hold and
+ *     an empty conjunct (`a &&`, `&& a`) makes the whole condition false.
+ *   - `ceremony.<gate>`         -> true when the vocabulary is null, lacks the
+ *     gate (also `__proto__`, `constructor`; the generator rejects those at
+ *     build time) or no thunk was given; else the thunk's answer, where a
+ *     throw answers true. Every doubt fails toward ceremony (T-37-13).
+ *   - any other conjunct        -> _resolveActivationValue (config precedence).
+ */
+function evaluateWhen(when, ctx) {
+    if (when === undefined || when === null)
+        return true;
+    if (typeof when !== 'string' || when.length === 0)
+        return false;
+    const conjuncts = when.split('&&').map((c) => c.trim());
+    for (const conjunct of conjuncts) {
+        if (conjunct.length === 0)
+            return false;
+        if (conjunct.startsWith('ceremony.')) {
+            const gate = conjunct.slice('ceremony.'.length);
+            // WR-03: a gate the vocabulary does not know (a registry newer than the
+            // vocabulary, a typo past the generator) stays open, so the hook renders;
+            // it never reaches the thunk, so a prototype name never indexes a verdict.
+            if (CEREMONY_GATE_KEYS === null || !CEREMONY_GATE_KEYS.has(gate) || typeof ctx.ceremony !== 'function')
+                continue;
+            let open;
+            try {
+                open = ctx.ceremony(gate) !== false;
+            }
+            catch {
+                open = true;
+            }
+            if (!open)
+                return false;
+            continue;
+        }
+        if (!_resolveActivationValue(conjunct, ctx.config, ctx.cwd, ctx.registry))
+            return false;
+    }
+    return true;
+}
 module.exports = {
+    evaluateWhen,
+    CEREMONY_GATE_KEYS,
     _getNestedConfigValue,
     // GATE-05: exported so src/config.cts's cmdConfigGet reuses this exact flat
     // lookup rather than growing a second, driftable copy of the rule.

package/pp-core/bin/lib/capability-registry.cjs

@@ -1234,7 +1234,7 @@ const capabilities = {
         "consumes": [
           "SUMMARY.md"
         ],
-        "when": "workflow.nyquist_validation",
+        "when": "workflow.nyquist_validation && ceremony.nyquist",
         "onError": "halt"
       }
     ],
@@ -1421,7 +1421,7 @@ const capabilities = {
         "consumes": [
           "RESEARCH.md"
         ],
-        "when": "workflow.pattern_mapper",
+        "when": "workflow.pattern_mapper && ceremony.pattern_mapper",
         "onError": "skip"
       }
     ],
@@ -1595,7 +1595,7 @@ const capabilities = {
         "consumes": [
           "CONTEXT.md"
         ],
-        "when": "workflow.research",
+        "when": "workflow.research && ceremony.research",
         "onError": "skip"
       }
     ],
@@ -1700,7 +1700,7 @@ const capabilities = {
         "consumes": [
           "SUMMARY.md"
         ],
-        "when": "workflow.security_enforcement",
+        "when": "workflow.security_enforcement && ceremony.security_review",
         "onError": "halt"
       }
     ],
@@ -1719,7 +1719,7 @@ const capabilities = {
         "consumes": [
           "CONTEXT.md"
         ],
-        "when": "workflow.security_enforcement"
+        "when": "workflow.security_enforcement && ceremony.threat_model"
       }
     ],
     "gates": [
@@ -1733,7 +1733,7 @@ const capabilities = {
             "equals": 0
           }
         },
-        "when": "workflow.security_enforcement",
+        "when": "workflow.security_enforcement && ceremony.security_review",
         "blocking": true,
         "onError": "halt"
       }
@@ -1901,7 +1901,7 @@ const capabilities = {
         "consumes": [
           "UI-SPEC.md"
         ],
-        "when": "workflow.ui_review",
+        "when": "workflow.ui_review && ceremony.ui_review",
         "onError": "skip"
       }
     ],
@@ -2370,7 +2370,7 @@ const byLoopPoint = {
         "consumes": [
           "CONTEXT.md"
         ],
-        "when": "workflow.research",
+        "when": "workflow.research && ceremony.research",
         "onError": "skip"
       },
       {
@@ -2417,7 +2417,7 @@ const byLoopPoint = {
         "consumes": [
           "RESEARCH.md"
         ],
-        "when": "workflow.pattern_mapper",
+        "when": "workflow.pattern_mapper && ceremony.pattern_mapper",
         "onError": "skip"
       }
     ],
@@ -2452,7 +2452,7 @@ const byLoopPoint = {
         "consumes": [
           "CONTEXT.md"
         ],
-        "when": "workflow.security_enforcement"
+        "when": "workflow.security_enforcement && ceremony.threat_model"
       },
       {
         "capId": "tdd",
@@ -2726,7 +2726,7 @@ const byLoopPoint = {
         "consumes": [
           "SUMMARY.md"
         ],
-        "when": "workflow.nyquist_validation",
+        "when": "workflow.nyquist_validation && ceremony.nyquist",
         "onError": "halt"
       },
       {
@@ -2741,7 +2741,7 @@ const byLoopPoint = {
         "consumes": [
           "SUMMARY.md"
         ],
-        "when": "workflow.security_enforcement",
+        "when": "workflow.security_enforcement && ceremony.security_review",
         "onError": "halt"
       },
       {
@@ -2756,7 +2756,7 @@ const byLoopPoint = {
         "consumes": [
           "UI-SPEC.md"
         ],
-        "when": "workflow.ui_review",
+        "when": "workflow.ui_review && ceremony.ui_review",
         "onError": "skip"
       }
     ],
@@ -2809,7 +2809,7 @@ const byLoopPoint = {
             "equals": 0
           }
         },
-        "when": "workflow.security_enforcement",
+        "when": "workflow.security_enforcement && ceremony.security_review",
         "blocking": true,
         "onError": "halt"
       },

package/pp-core/bin/lib/capability-state.cjs

@@ -21,7 +21,7 @@
  * Dependencies (leaf modules only — no circular risk):
  *   - node:path
  *   - ./io.cjs                 (output, error)
- *   - ./capability-activation.cjs (_resolveActivationValue)
+ *   - ./capability-activation.cjs (_resolveActivationValue, evaluateWhen)
  *   - ./install-profiles.cjs   (readActiveProfile, loadSkillsManifest, resolveProfile)
  *   - ./surface.cjs            (resolveSurface)
  *   - ./config-loader.cjs      (loadConfig)
@@ -39,7 +39,7 @@ const ioMod = require("./io.cjs");
 const { output: coreOutput, error: coreError } = ioMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const activationMod = require("./capability-activation.cjs");
-const { _resolveActivationValue } = activationMod;
+const { _resolveActivationValue, evaluateWhen } = activationMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderMod = require("./config-loader.cjs");
 const { loadConfig } = configLoaderMod;
@@ -269,9 +269,9 @@ function resolveCapabilityState(input) {
         const active = baseActive && requiresGateOpen;
         // ── hooks ──────────────────────────────────────────────────────────────────
         // Collect from steps, gates, contributions. Each may have a `when` key.
-        // Activation semantics (mirrors loop-resolver.isActive exactly):
+        // Activation semantics (shared with loop-resolver.isActive through evaluateWhen):
         //   - No `when` field present (undefined/null) → unconditional, active=true
-        //   - Non-empty string `when` → resolve via _resolveActivationValue
+        //   - Non-empty string `when` → every `&&` conjunct must hold
         //   - Present-but-empty-string or non-string `when` → malformed, active=false
         // The original `when` value is carried through to the output for visibility.
         const hooks = [];
@@ -283,20 +283,10 @@ function resolveCapabilityState(input) {
                 const point = typeof h['point'] === 'string' ? h['point'] : '';
                 // Carry the raw `when` value through for visibility
                 const whenRaw = h['when'];
-                let configured;
-                if (whenRaw === undefined || whenRaw === null) {
-                    // No `when` field → unconditional, always active
-                    configured = true;
-                }
-                else if (typeof whenRaw === 'string' && whenRaw.length > 0) {
-                    // Non-empty string `when` → resolve via _resolveActivationValue
-                    configured = _resolveActivationValue(whenRaw, config, cwd, registry);
-                }
-                else {
-                    // Present-but-empty-string or non-string `when` → malformed, inactive
-                    // (mirrors loop-resolver.isActive: `typeof when !== 'string' || when.length === 0` → false)
-                    configured = false;
-                }
+                // One shared evaluator (Phase 37 D-14), called WITHOUT a ceremony thunk so
+                // this report is unchanged: it answers for the config switch, never for a
+                // phase verdict, and a `ceremony.<gate>` conjunct counts as open here.
+                const configured = evaluateWhen(whenRaw, { config, cwd, registry });
                 // Hook active = capability-level active AND hook's own config gate.
                 // The capability's `active` constant (= enabled && configActivation) is
                 // used here so that a config-disabled capability (active=false) cannot