@paths.design/caws-cli 10.1.0 → 11.0.0

package/dist/shell/commands/scope.js

@@ -0,0 +1,92 @@
+"use strict";
+// `caws scope show <path>` and `caws scope check <path>` — share one
+// decision path; differ only in exit-code policy.
+//
+//   show:  always exits 0 after rendering, even for reject / no_authority
+//          / invalid_path. It is explanatory.
+//   check: exits 0 only on `admit`. reject / no_authority / invalid_path
+//          exit 1. Used by hooks.
+//
+// Both:
+//   1. resolveRepoRoot(cwd)
+//   2. composeStoreSnapshot (we want load diagnostics if anything is
+//      malformed; we do NOT use composeDoctorSnapshot because we don't
+//      run the doctor here)
+//   3. resolveBinding(cwd, registry, specs)
+//   4. require a loaded policy. If absent, exit 2 with a clear message.
+//   5. kernel evaluatePath(path, binding, policy)
+//   6. renderDecision(decision, {boundContext})
+//   7. exit per mode.
+//
+// The command does NOT compute its own scope rules. The kernel decides;
+// the command only renders and picks the exit.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runScopeCommand = runScopeCommand;
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const store_1 = require("../../store");
+const resolve_binding_1 = require("../binding/resolve-binding");
+const decision_1 = require("../render/decision");
+const diagnostic_1 = require("../render/diagnostic");
+function runScopeCommand(opts) {
+    const cwd = opts.cwd ?? process.cwd();
+    const out = opts.out ?? ((s) => process.stdout.write(s + '\n'));
+    const err = opts.err ?? ((s) => process.stderr.write(s + '\n'));
+    const showData = opts.showData === true;
+    const mode = opts.mode;
+    // 1. Repo root
+    const repoRootResult = (0, store_1.resolveRepoRoot)(cwd);
+    if (!repoRootResult.ok) {
+        err(`caws scope ${mode}: failed to resolve repo root.`);
+        err((0, diagnostic_1.renderDiagnostics)(repoRootResult.errors, { showData }));
+        return 2;
+    }
+    const { repoRoot, cawsDir } = repoRootResult.value;
+    // 2. Snapshot
+    let snapshot;
+    try {
+        snapshot = (0, store_1.composeStoreSnapshot)({ repoRoot, cawsDir });
+    }
+    catch (e) {
+        err(`caws scope ${mode}: store composition failed: ${e.message}`);
+        return 2;
+    }
+    // 3. Binding from cwd
+    const bound = (0, resolve_binding_1.resolveBinding)({
+        repoRoot,
+        cwd,
+        registry: snapshot.worktrees,
+        specs: snapshot.specs,
+    });
+    // 4. Require a loaded policy. Without it, the kernel can't evaluate
+    //    non_governed_zones / root_passthrough / infra exemptions, and the
+    //    rewrite plan requires policy.yaml for any vNext project. This is
+    //    exit-2 (program/composition) territory, not no_authority.
+    const policy = snapshot.policy;
+    if (policy === undefined) {
+        err(`caws scope ${mode}: no policy.yaml loaded. Run \`caws doctor\` for details.`);
+        if (snapshot.policyErrors.length > 0) {
+            err((0, diagnostic_1.renderDiagnostics)(snapshot.policyErrors, { showData }));
+        }
+        return 2;
+    }
+    // 5. Kernel decision
+    let decision;
+    try {
+        decision = (0, caws_kernel_1.evaluatePath)(opts.path, bound.binding, policy);
+    }
+    catch (e) {
+        err(`caws scope ${mode}: kernel evaluation failed: ${e.message}`);
+        return 2;
+    }
+    // 6. Render — both modes use the same renderer with the same
+    //    boundContext hint so the human-readable nuance for unbound is
+    //    consistent.
+    out((0, decision_1.renderDecision)(decision, { boundContext: bound, showData }));
+    // 7. Exit per mode
+    if (mode === 'show') {
+        return 0;
+    }
+    // mode === 'check'
+    return decision.kind === 'admit' ? 0 : 1;
+}
+//# sourceMappingURL=scope.js.map

package/dist/shell/commands/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../src/shell/commands/scope.ts"],"names":[],"mappings":";AAAA,qEAAqE;AACrE,kDAAkD;AAClD,EAAE;AACF,0EAA0E;AAC1E,8CAA8C;AAC9C,yEAAyE;AACzE,kCAAkC;AAClC,EAAE;AACF,QAAQ;AACR,4BAA4B;AAC5B,qEAAqE;AACrE,uEAAuE;AACvE,4BAA4B;AAC5B,4CAA4C;AAC5C,wEAAwE;AACxE,kDAAkD;AAClD,gDAAgD;AAChD,sBAAsB;AACtB,EAAE;AACF,wEAAwE;AACxE,+CAA+C;;AAwB/C,0CAkEC;AAxFD,2DAImC;AAEnC,uCAAoE;AACpE,gEAA4D;AAC5D,iDAAoD;AACpD,qDAAyD;AAazD,SAAgB,eAAe,CAAC,IAAyB;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAEvB,eAAe;IACf,MAAM,cAAc,GAAG,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,GAAG,CAAC,cAAc,IAAI,gCAAgC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAA,8BAAiB,EAAC,cAAc,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC;IAEnD,cAAc;IACd,IAAI,QAAiD,CAAC;IACtD,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,4BAAoB,EAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,cAAc,IAAI,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sBAAsB;IACtB,MAAM,KAAK,GAAG,IAAA,gCAAc,EAAC;QAC3B,QAAQ;QACR,GAAG;QACH,QAAQ,EAAE,QAAQ,CAAC,SAAS;QAC5B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;IAEH,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,+DAA+D;IAC/D,MAAM,MAAM,GAAuB,QAAQ,CAAC,MAAM,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,GAAG,CAAC,cAAc,IAAI,2DAA2D,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,IAAA,8BAAiB,EAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,qBAAqB;IACrB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,0BAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,cAAc,IAAI,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6DAA6D;IAC7D,mEAAmE;IACnE,iBAAiB;IACjB,GAAG,CAAC,IAAA,yBAAc,EAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAEjE,mBAAmB;IACnB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,mBAAmB;IACnB,OAAO,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/shell/commands/status.d.ts

@@ -0,0 +1,15 @@
+export interface StatusCommandOptions {
+    readonly cwd?: string;
+    readonly now?: () => Date;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly out?: (line: string) => void;
+    readonly err?: (line: string) => void;
+    /** Stale heartbeat TTL in ms; display only. Default 24h. */
+    readonly staleTtlMs?: number;
+    /** Cap on rendered top findings. Default 5. */
+    readonly findingCap?: number;
+    /** Show structured data blocks on rendered diagnostics. */
+    readonly showData?: boolean;
+}
+export declare function runStatusCommand(opts?: StatusCommandOptions): number;
+//# sourceMappingURL=status.d.ts.map

package/dist/shell/commands/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/shell/commands/status.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,oBAAyB,GAAG,MAAM,CAoFxE"}

package/dist/shell/commands/status.js

@@ -0,0 +1,106 @@
+"use strict";
+// `caws status` — vNext read-only dashboard.
+//
+// Hard constraint: status MUST NOT mutate anything. It loads state,
+// runs the kernel diagnoser, and renders. It does NOT mint capsules,
+// refresh heartbeats, write events, mutate worktrees.json, or alter
+// agents.json. Ownership mutation belongs to `caws claim`; spec
+// lifecycle belongs to `caws spec *`; event emission belongs to
+// `caws evidence record`.
+//
+// Pipeline:
+//   1. resolveRepoRoot(cwd)
+//   2. composeDoctorSnapshot(...)        → snapshot + doctorInput
+//   3. inspectProjectState(doctorInput)  → DoctorReport
+//   4. resolveBinding(cwd, registry, specs)
+//   5. resolveSession({ allowMint: false }) — read-only; never mints
+//   6. renderStatus(...)                  → stdout
+//   7. exit 0 (regardless of doctor findings) or 2 on composition error
+//
+// Doctor findings drive PROMINENT DISPLAY in the dashboard. They do
+// NOT change the exit code. `caws doctor` is the diagnostic command
+// with 0/1/2 semantics; status is observability.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runStatusCommand = runStatusCommand;
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const store_1 = require("../../store");
+const resolve_binding_1 = require("../binding/resolve-binding");
+const diagnostic_1 = require("../render/diagnostic");
+const status_1 = require("../render/status");
+const resolve_session_1 = require("../session/resolve-session");
+function runStatusCommand(opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
+    const nowFn = opts.now ?? (() => new Date());
+    const env = opts.env ?? process.env;
+    const out = opts.out ?? ((s) => process.stdout.write(s + '\n'));
+    const err = opts.err ?? ((s) => process.stderr.write(s + '\n'));
+    const showData = opts.showData === true;
+    // 1. Repo root
+    const repoRootResult = (0, store_1.resolveRepoRoot)(cwd);
+    if (!repoRootResult.ok) {
+        err('caws status: failed to resolve repo root.');
+        err((0, diagnostic_1.renderDiagnostics)(repoRootResult.errors, { showData }));
+        return 2;
+    }
+    const { repoRoot, cawsDir } = repoRootResult.value;
+    const now = nowFn();
+    // 2. Snapshot + doctor input
+    let composition;
+    try {
+        composition = (0, store_1.composeDoctorSnapshot)({ repoRoot, cawsDir, now });
+    }
+    catch (e) {
+        err(`caws status: store composition failed: ${e.message}`);
+        return 2;
+    }
+    const { snapshot, doctorInput } = composition;
+    // 3. Run the kernel diagnoser
+    let report;
+    try {
+        report = (0, caws_kernel_1.inspectProjectState)(doctorInput);
+    }
+    catch (e) {
+        err(`caws status: kernel inspect failed: ${e.message}`);
+        return 2;
+    }
+    // 4. Binding from cwd
+    const binding = (0, resolve_binding_1.resolveBinding)({
+        repoRoot,
+        cwd,
+        registry: snapshot.worktrees,
+        specs: snapshot.specs,
+    });
+    // 5. Session — READ-ONLY. Never pass allowMint: true here.
+    const sessionResult = (0, resolve_session_1.resolveSession)({
+        cawsDir,
+        worktreeRoot: cwd,
+        env,
+        now: nowFn,
+        // allowMint: false — read-only; status MUST NOT mint capsules.
+    });
+    // 6. Render
+    // Event-chain validity is captured in the doctor findings (via
+    // doctor.event.chain_invalid); the status dashboard surfaces a
+    // chain-broken note only when the kernel actually emitted that finding.
+    const chainBroken = report.findings.some((f) => f.rule === 'doctor.event.chain_invalid' && f.severity === 'error');
+    out((0, status_1.renderStatus)({
+        repoRoot,
+        cawsDir,
+        policyLoaded: snapshot.policy !== undefined,
+        specs: snapshot.specs,
+        worktrees: snapshot.worktrees,
+        agents: snapshot.agents,
+        eventCount: snapshot.events.length,
+        // Only emit a chain-OK/broken label when there are events to chain.
+        ...(snapshot.events.length > 0 ? { eventChainOk: !chainBroken } : {}),
+        binding,
+        session: sessionResult.ok ? sessionResult.value : null,
+        doctorFindings: report.findings,
+        now,
+        ...(opts.staleTtlMs !== undefined ? { staleTtlMs: opts.staleTtlMs } : {}),
+        ...(opts.findingCap !== undefined ? { findingCap: opts.findingCap } : {}),
+    }));
+    // 7. Exit. Status is observability, never a gate.
+    return 0;
+}
+//# sourceMappingURL=status.js.map

package/dist/shell/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/shell/commands/status.ts"],"names":[],"mappings":";AAAA,6CAA6C;AAC7C,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,gEAAgE;AAChE,gEAAgE;AAChE,0BAA0B;AAC1B,EAAE;AACF,YAAY;AACZ,4BAA4B;AAC5B,kEAAkE;AAClE,wDAAwD;AACxD,4CAA4C;AAC5C,qEAAqE;AACrE,mDAAmD;AACnD,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,iDAAiD;;AAwBjD,4CAoFC;AA1GD,2DAAgE;AAEhE,uCAAqE;AACrE,gEAA4D;AAC5D,qDAAyD;AACzD,6CAAgD;AAChD,gEAA4D;AAgB5D,SAAgB,gBAAgB,CAAC,OAA6B,EAAE;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAExC,eAAe;IACf,MAAM,cAAc,GAAG,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACjD,GAAG,CAAC,IAAA,8BAAiB,EAAC,cAAc,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC;IACnD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IAEpB,6BAA6B;IAC7B,IAAI,WAAqD,CAAC;IAC1D,IAAI,CAAC;QACH,WAAW,GAAG,IAAA,6BAAqB,EAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,0CAA2C,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;IAE9C,8BAA8B;IAC9B,IAAI,MAA8C,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,iCAAmB,EAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,uCAAwC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sBAAsB;IACtB,MAAM,OAAO,GAAG,IAAA,gCAAc,EAAC;QAC7B,QAAQ;QACR,GAAG;QACH,QAAQ,EAAE,QAAQ,CAAC,SAAS;QAC5B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;IAEH,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAA,gCAAc,EAAC;QACnC,OAAO;QACP,YAAY,EAAE,GAAG;QACjB,GAAG;QACH,GAAG,EAAE,KAAK;QACV,+DAA+D;KAChE,CAAC,CAAC;IAEH,YAAY;IACZ,+DAA+D;IAC/D,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,4BAA4B,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CACzE,CAAC;IAEF,GAAG,CACD,IAAA,qBAAY,EAAC;QACX,QAAQ;QACR,OAAO;QACP,YAAY,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS;QAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;QAClC,oEAAoE;QACpE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO;QACP,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACtD,cAAc,EAAE,MAAM,CAAC,QAAQ;QAC/B,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,CACH,CAAC;IAEF,kDAAkD;IAClD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/shell/commands/waiver.d.ts

@@ -0,0 +1,38 @@
+export interface WaiverCommandBase {
+    readonly cwd?: string;
+    readonly now?: () => Date;
+    readonly out?: (line: string) => void;
+    readonly err?: (line: string) => void;
+    readonly showData?: boolean;
+}
+export interface WaiverCreateOptions extends WaiverCommandBase {
+    readonly id: string;
+    readonly title: string;
+    readonly gates: readonly string[];
+    readonly reason: string;
+    readonly approvedBy: string;
+    readonly expiresAt: string;
+    /** Optional. When supplied, scopes the waiver to a single spec id. */
+    readonly specId?: string;
+}
+export declare function runWaiverCreateCommand(opts: WaiverCreateOptions): number;
+export interface WaiverListOptions extends WaiverCommandBase {
+    /** Include waivers whose stored status is 'revoked'. Default false. */
+    readonly includeRevoked?: boolean;
+    /** Include waivers whose expires_at is in the past. Default false. */
+    readonly includeExpired?: boolean;
+}
+export declare function runWaiverListCommand(opts?: WaiverListOptions): number;
+export interface WaiverShowOptions extends WaiverCommandBase {
+    readonly id: string;
+}
+export declare function runWaiverShowCommand(opts: WaiverShowOptions): number;
+export interface WaiverRevokeOptions extends WaiverCommandBase {
+    readonly id: string;
+    /** Optional revoker identity recorded in revocation.revoked_by. */
+    readonly revokedBy?: string;
+    /** Optional reason recorded in revocation.reason. */
+    readonly reason?: string;
+}
+export declare function runWaiverRevokeCommand(opts: WaiverRevokeOptions): number;
+//# sourceMappingURL=waiver.d.ts.map

package/dist/shell/commands/waiver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiver.d.ts","sourceRoot":"","sources":["../../../src/shell/commands/waiver.ts"],"names":[],"mappings":"AA6DA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAiDD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAuDxE;AAMD,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAoDzE;AAMD,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAkCpE;AAMD,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CA0CxE"}

package/dist/shell/commands/waiver.js

@@ -0,0 +1,240 @@
+"use strict";
+// `caws waiver` — vNext singular command surface.
+//
+// Four subcommands, each a thin shell over the kernel + waivers-store:
+//
+//   create  — validateWaiver → writeWaiver (refuses duplicates).
+//   list    — loadWaivers → render summaries; filters by effectiveness.
+//   show    — loadWaivers → render detail; missing id is a domain error.
+//   revoke  — markRevoked (refuses double-revoke and missing files).
+//
+// Discipline:
+//   - Explicit waiver id on `create` (no auto-generation in 7a). Auto-id
+//     would force naming and collision policy decisions that don't
+//     belong on the authority surface.
+//   - `status: active` is the only status `create` writes. Callers
+//     cannot manufacture `expired` (expiry is derived) or `revoked`
+//     (use `revoke` for that, which carries an audit record).
+//   - Effectiveness is computed by the kernel (`waiverEffectiveness`).
+//     The shell never re-derives it — that would risk diverging from
+//     gates filtering. `list` defaults to "effective only" so an
+//     operator surveying the waiver surface sees what actually applies
+//     to gates right now.
+//   - All writes go through `writeWaiver` / `markRevoked`. Those are
+//     atomic and refuse silent overwrite, so even concurrent invocations
+//     can't corrupt a waiver.
+//
+// Exit codes:
+//   0 = command succeeds (including: list with zero results, show with
+//       a valid id, revoke that succeeds).
+//   1 = validation/domain failure: duplicate id, missing waiver,
+//       invalid id/gate/expiry, already-revoked.
+//   2 = repo-root or store composition failure.
+//
+// Event emission for waiver lifecycle is OUT OF SCOPE for 7a.4 — the
+// existing `waiver_applied` event records *use*, not *creation*. A
+// `waiver_created` / `waiver_revoked` event family belongs with 7b
+// or later and is not gated by this slice.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWaiverCreateCommand = runWaiverCreateCommand;
+exports.runWaiverListCommand = runWaiverListCommand;
+exports.runWaiverShowCommand = runWaiverShowCommand;
+exports.runWaiverRevokeCommand = runWaiverRevokeCommand;
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const store_1 = require("../../store");
+const diagnostic_1 = require("../render/diagnostic");
+const waiver_1 = require("../render/waiver");
+const rules_1 = require("../rules");
+function shellDiag(rule, message, subject) {
+    // Shell-side ad-hoc diagnostics borrow the kernel/diagnostics authority
+    // — the kernel's Authority enum is closed, and the rule prefix
+    // `shell.*` is what distinguishes shell-owned diagnostics from kernel-
+    // owned ones. Existing shell modules (resolve-session, gates contract)
+    // follow the same convention.
+    return {
+        rule,
+        authority: 'kernel/diagnostics',
+        severity: 'error',
+        message,
+        ...(subject !== undefined ? { subject } : {}),
+    };
+}
+function setupIO(opts) {
+    const cwd = opts.cwd ?? process.cwd();
+    const nowFn = opts.now ?? (() => new Date());
+    const out = opts.out ?? ((s) => process.stdout.write(s + '\n'));
+    const err = opts.err ?? ((s) => process.stderr.write(s + '\n'));
+    const showData = opts.showData === true;
+    return { cwd, nowFn, out, err, showData };
+}
+function resolveCaws(cwd, err, showData, cmd) {
+    const r = (0, store_1.resolveRepoRoot)(cwd);
+    if (!r.ok) {
+        err(`caws ${cmd}: failed to resolve repo root.`);
+        err((0, diagnostic_1.renderDiagnostics)(r.errors, { showData }));
+        return null;
+    }
+    return { cawsDir: r.value.cawsDir };
+}
+function runWaiverCreateCommand(opts) {
+    const { cwd, nowFn, out, err, showData } = setupIO(opts);
+    const now = nowFn();
+    const ctx = resolveCaws(cwd, err, showData, 'waiver create');
+    if (ctx === null)
+        return 2;
+    // Build the candidate waiver document. Validation is delegated to the
+    // kernel — no parallel field-shape checks here.
+    const candidate = {
+        id: opts.id,
+        title: opts.title,
+        status: 'active',
+        gates: opts.gates,
+        reason: opts.reason,
+        approved_by: opts.approvedBy,
+        created_at: now.toISOString(),
+        expires_at: opts.expiresAt,
+    };
+    if (opts.specId !== undefined) {
+        candidate['scope'] = { spec_id: opts.specId };
+    }
+    const validated = (0, caws_kernel_1.validateWaiver)(candidate);
+    if (!(0, caws_kernel_1.isOk)(validated)) {
+        err('caws waiver create: invalid waiver shape.');
+        err((0, diagnostic_1.renderDiagnostics)(validated.errors, { showData }));
+        return 1;
+    }
+    const write = (0, store_1.writeWaiver)(ctx.cawsDir, validated.value);
+    if (!(0, caws_kernel_1.isOk)(write)) {
+        // The store distinguishes duplicate id (already_exists) from generic
+        // I/O failure (write_io_failed). Exit code reflects the difference:
+        // duplicate is a user-correctable domain error (1), I/O is a hard
+        // store failure (2).
+        const isDuplicate = write.errors.some((d) => d.rule === store_1.STORE_RULES.WAIVERS_ALREADY_EXISTS);
+        err(isDuplicate
+            ? `caws waiver create: waiver ${validated.value.id} already exists.`
+            : 'caws waiver create: failed to write waiver.');
+        err((0, diagnostic_1.renderDiagnostics)(write.errors, { showData }));
+        return isDuplicate ? 1 : 2;
+    }
+    out((0, waiver_1.renderWaiverDetail)({
+        waiver: validated.value,
+        effectiveness: (0, caws_kernel_1.waiverEffectiveness)(validated.value, now),
+        now,
+    }));
+    return 0;
+}
+function runWaiverListCommand(opts = {}) {
+    const { cwd, nowFn, out, err, showData } = setupIO(opts);
+    const ctx = resolveCaws(cwd, err, showData, 'waiver list');
+    if (ctx === null)
+        return 2;
+    const load = (0, store_1.loadWaivers)(ctx.cawsDir);
+    // Surface load diagnostics on stderr but do NOT discard valid waivers.
+    if (load.diagnostics.length > 0) {
+        err((0, diagnostic_1.renderDiagnostics)(load.diagnostics, { showData }));
+    }
+    const now = nowFn();
+    const includeRevoked = opts.includeRevoked === true;
+    const includeExpired = opts.includeExpired === true;
+    const rows = [];
+    for (const w of load.waivers) {
+        const eff = (0, caws_kernel_1.waiverEffectiveness)(w, now);
+        if (eff === 'revoked' && !includeRevoked)
+            continue;
+        if (eff === 'expired' && !includeExpired)
+            continue;
+        rows.push({ waiver: w, effectiveness: eff });
+    }
+    if (rows.length === 0) {
+        // Distinguish "no waivers at all" from "no waivers match the filter".
+        const msg = load.waivers.length === 0
+            ? 'No waivers in .caws/waivers/.'
+            : 'No waivers match the current filter (use --include-revoked / --include-expired to widen).';
+        out(msg);
+        return 0;
+    }
+    // Stable ordering: effective first, then revoked, then expired; within
+    // each group sort by id ascending. Predictable list output is much
+    // easier to scan and to assert against in tests.
+    const order = {
+        active: 0,
+        not_applicable: 1,
+        revoked: 2,
+        expired: 3,
+    };
+    rows.sort((a, b) => {
+        const o = order[a.effectiveness] - order[b.effectiveness];
+        if (o !== 0)
+            return o;
+        return a.waiver.id.localeCompare(b.waiver.id);
+    });
+    out(`Waivers (${rows.length} shown of ${load.waivers.length} total):`);
+    for (const r of rows)
+        out((0, waiver_1.renderWaiverSummary)(r));
+    return 0;
+}
+function runWaiverShowCommand(opts) {
+    const { cwd, nowFn, out, err, showData } = setupIO(opts);
+    const now = nowFn();
+    if (typeof opts.id !== 'string' || opts.id.length === 0) {
+        err('caws waiver show: id is required.');
+        err(`(rule: ${rules_1.SHELL_RULES.WAIVER_MISSING_ID})`);
+        return 1;
+    }
+    const ctx = resolveCaws(cwd, err, showData, 'waiver show');
+    if (ctx === null)
+        return 2;
+    const load = (0, store_1.loadWaivers)(ctx.cawsDir);
+    if (load.diagnostics.length > 0) {
+        err((0, diagnostic_1.renderDiagnostics)(load.diagnostics, { showData }));
+    }
+    const found = load.waivers.find((w) => w.id === opts.id);
+    if (found === undefined) {
+        err(`caws waiver show: waiver ${opts.id} not found.`);
+        err((0, diagnostic_1.renderDiagnostics)([shellDiag(rules_1.SHELL_RULES.WAIVER_NOT_FOUND, `Waiver ${opts.id} not found.`, opts.id)], { showData }));
+        return 1;
+    }
+    out((0, waiver_1.renderWaiverDetail)({
+        waiver: found,
+        effectiveness: (0, caws_kernel_1.waiverEffectiveness)(found, now),
+        now,
+    }));
+    return 0;
+}
+function runWaiverRevokeCommand(opts) {
+    const { cwd, nowFn, out, err, showData } = setupIO(opts);
+    const now = nowFn();
+    if (typeof opts.id !== 'string' || opts.id.length === 0) {
+        err('caws waiver revoke: id is required.');
+        err(`(rule: ${rules_1.SHELL_RULES.WAIVER_MISSING_ID})`);
+        return 1;
+    }
+    const ctx = resolveCaws(cwd, err, showData, 'waiver revoke');
+    if (ctx === null)
+        return 2;
+    const result = (0, store_1.markRevoked)(ctx.cawsDir, opts.id, {
+        now,
+        ...(opts.revokedBy !== undefined ? { revoked_by: opts.revokedBy } : {}),
+        ...(opts.reason !== undefined ? { reason: opts.reason } : {}),
+    });
+    if (!(0, caws_kernel_1.isOk)(result)) {
+        // markRevoked uses STORE_RULES.WAIVERS_NOT_FOUND for missing files and
+        // STORE_RULES.WAIVERS_ALREADY_EXISTS for "already revoked" (semantics
+        // overload acknowledged in the store comment). Both are domain
+        // errors → exit 1. Other failures (I/O, validation) are exit 2.
+        const isDomain = result.errors.some((d) => d.rule === store_1.STORE_RULES.WAIVERS_NOT_FOUND ||
+            d.rule === store_1.STORE_RULES.WAIVERS_ALREADY_EXISTS);
+        err(isDomain
+            ? `caws waiver revoke: cannot revoke ${opts.id}.`
+            : 'caws waiver revoke: failed to revoke waiver.');
+        err((0, diagnostic_1.renderDiagnostics)(result.errors, { showData }));
+        return isDomain ? 1 : 2;
+    }
+    out((0, waiver_1.renderWaiverDetail)({
+        waiver: result.value,
+        effectiveness: (0, caws_kernel_1.waiverEffectiveness)(result.value, now),
+        now,
+    }));
+    return 0;
+}
+//# sourceMappingURL=waiver.js.map

package/dist/shell/commands/waiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiver.js","sourceRoot":"","sources":["../../../src/shell/commands/waiver.ts"],"names":[],"mappings":";AAAA,kDAAkD;AAClD,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,iEAAiE;AACjE,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,EAAE;AACF,cAAc;AACd,yEAAyE;AACzE,mEAAmE;AACnE,uCAAuC;AACvC,mEAAmE;AACnE,oEAAoE;AACpE,8DAA8D;AAC9D,uEAAuE;AACvE,qEAAqE;AACrE,iEAAiE;AACjE,uEAAuE;AACvE,0BAA0B;AAC1B,qEAAqE;AACrE,yEAAyE;AACzE,8BAA8B;AAC9B,EAAE;AACF,cAAc;AACd,uEAAuE;AACvE,2CAA2C;AAC3C,iEAAiE;AACjE,iDAAiD;AACjD,gDAAgD;AAChD,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,mEAAmE;AACnE,2CAA2C;;AA4F3C,wDAuDC;AAaD,oDAoDC;AAUD,oDAkCC;AAcD,wDA0CC;AAtTD,2DAOmC;AAEnC,uCAMqB;AACrB,qDAAyD;AACzD,6CAA2E;AAC3E,oCAAuC;AAcvC,SAAS,SAAS,CAChB,IAAY,EACZ,OAAe,EACf,OAAgB;IAEhB,wEAAwE;IACxE,+DAA+D;IAC/D,uEAAuE;IACvE,uEAAuE;IACvE,8BAA8B;IAC9B,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,OAAO;QACjB,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAuB;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IACxC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAClB,GAAW,EACX,GAA2B,EAC3B,QAAiB,EACjB,GAAW;IAEX,MAAM,CAAC,GAAG,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,GAAG,CAAC,QAAQ,GAAG,gCAAgC,CAAC,CAAC;QACjD,GAAG,CAAC,IAAA,8BAAiB,EAAC,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AACtC,CAAC;AAiBD,SAAgB,sBAAsB,CAAC,IAAyB;IAC9D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAE3B,sEAAsE;IACtE,gDAAgD;IAChD,MAAM,SAAS,GAA4B;QACzC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7B,UAAU,EAAE,IAAI,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,4BAAc,EAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAA,kBAAI,EAAC,SAAS,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACjD,GAAG,CAAC,IAAA,8BAAiB,EAAC,SAAS,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,mBAAW,EAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,IAAA,kBAAI,EAAC,KAAK,CAAC,EAAE,CAAC;QACjB,qEAAqE;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,qBAAqB;QACrB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAW,CAAC,sBAAsB,CACrD,CAAC;QACF,GAAG,CACD,WAAW;YACT,CAAC,CAAC,8BAA8B,SAAS,CAAC,KAAK,CAAC,EAAE,kBAAkB;YACpE,CAAC,CAAC,6CAA6C,CAClD,CAAC;QACF,GAAG,CAAC,IAAA,8BAAiB,EAAC,KAAK,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,GAAG,CACD,IAAA,2BAAkB,EAAC;QACjB,MAAM,EAAE,SAAS,CAAC,KAAK;QACvB,aAAa,EAAE,IAAA,iCAAmB,EAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC;QACxD,GAAG;KACJ,CAAC,CACH,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAaD,SAAgB,oBAAoB,CAAC,OAA0B,EAAE;IAC/D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAE3B,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,uEAAuE;IACvE,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,IAAA,8BAAiB,EAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;IAGpD,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,iCAAmB,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc;YAAE,SAAS;QACnD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc;YAAE,SAAS;QACnD,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,sEAAsE;QACtE,MAAM,GAAG,GACP,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACvB,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,2FAA2F,CAAC;QAClG,GAAG,CAAC,GAAG,CAAC,CAAC;QACT,OAAO,CAAC,CAAC;IACX,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,iDAAiD;IACjD,MAAM,KAAK,GAAwC;QACjD,MAAM,EAAE,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;KACX,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACtB,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAA,4BAAmB,EAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC;AACX,CAAC;AAUD,SAAgB,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACzC,GAAG,CAAC,UAAU,mBAAW,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAE3B,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,IAAA,8BAAiB,EAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,GAAG,CAAC,4BAA4B,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QACtD,GAAG,CACD,IAAA,8BAAiB,EACf,CAAC,SAAS,CAAC,mBAAW,CAAC,gBAAgB,EAAE,UAAU,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAClF,EAAE,QAAQ,EAAE,CACb,CACF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CACD,IAAA,2BAAkB,EAAC;QACjB,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAA,iCAAmB,EAAC,KAAK,EAAE,GAAG,CAAC;QAC9C,GAAG;KACJ,CAAC,CACH,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAcD,SAAgB,sBAAsB,CAAC,IAAyB;IAC9D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,qCAAqC,CAAC,CAAC;QAC3C,GAAG,CAAC,UAAU,mBAAW,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE;QAC/C,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,IAAI,CAAC,IAAA,kBAAI,EAAC,MAAM,CAAC,EAAE,CAAC;QAClB,uEAAuE;QACvE,sEAAsE;QACtE,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,mBAAW,CAAC,iBAAiB;YACxC,CAAC,CAAC,IAAI,KAAK,mBAAW,CAAC,sBAAsB,CAChD,CAAC;QACF,GAAG,CACD,QAAQ;YACN,CAAC,CAAC,qCAAqC,IAAI,CAAC,EAAE,GAAG;YACjD,CAAC,CAAC,8CAA8C,CACnD,CAAC;QACF,GAAG,CAAC,IAAA,8BAAiB,EAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,GAAG,CACD,IAAA,2BAAkB,EAAC;QACjB,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,aAAa,EAAE,IAAA,iCAAmB,EAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;QACrD,GAAG;KACJ,CAAC,CACH,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/shell/gates/disposition.d.ts

@@ -0,0 +1,23 @@
+import type { Policy } from '@paths.design/caws-kernel';
+import type { GatesReport, GatesViolation } from './gate-result-contract';
+export type GateMode = 'block' | 'warn' | 'skip';
+export type GateOutcome = 'pass' | 'fail' | 'skipped';
+export interface GateDisposition {
+    readonly gate_id: string;
+    readonly mode: GateMode;
+    readonly outcome: GateOutcome;
+    /** True iff this gate's outcome contributes to a final exit 1. */
+    readonly blocks: boolean;
+    /** Violations whose `gate` field equals `gate_id`. */
+    readonly violations: readonly GatesViolation[];
+}
+export interface DispositionResult {
+    /** One disposition per policy-declared gate. */
+    readonly dispositions: readonly GateDisposition[];
+    /** Violations from the subprocess whose gate name was NOT a policy gate. */
+    readonly unmatchedViolations: readonly GatesViolation[];
+    /** True iff any disposition blocks. */
+    readonly anyBlocks: boolean;
+}
+export declare function deriveDispositions(report: GatesReport, policy: Policy): DispositionResult;
+//# sourceMappingURL=disposition.d.ts.map

package/dist/shell/gates/disposition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disposition.d.ts","sourceRoot":"","sources":["../../../src/shell/gates/disposition.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE1E,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AACjD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;IAClD,4EAA4E;IAC5E,QAAQ,CAAC,mBAAmB,EAAE,SAAS,cAAc,EAAE,CAAC;IACxD,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAmBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,GACb,iBAAiB,CAgDnB"}

package/dist/shell/gates/disposition.js

@@ -0,0 +1,87 @@
+"use strict";
+// Policy-derived gate disposition.
+//
+// Given (parsed quality-gates report, parsed policy), produce one
+// `GateDisposition` per policy-declared gate. This is the SOLE place
+// where final block/warn/skip semantics are decided. The subprocess
+// reports violations; this module decides what they mean.
+//
+// Rules:
+//
+//   policy.gates[gate].mode === 'skip'      → result: 'skipped',  blocks=false
+//   policy.gates[gate].enabled === false    → result: 'skipped',  blocks=false
+//   any matched violation + mode==='block'  → result: 'fail',     blocks=true
+//   any matched violation + mode==='warn'   → result: 'fail',     blocks=false
+//   no matched violation                    → result: 'pass',     blocks=false
+//
+// A violation is "matched" to a policy gate iff the violation's `gate`
+// field equals the policy gate id. Violations targeting unknown gate
+// names (subprocess-specific checks like 'naming') are surfaced
+// separately as `unmatchedViolations` so the renderer can show them,
+// but they do NOT drive policy disposition.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveDispositions = deriveDispositions;
+const KNOWN_GATE_IDS = [
+    'budget_limit',
+    'spec_completeness',
+    'scope_boundary',
+    'god_object',
+    'todo_detection',
+];
+function gateConfigFor(policy, gateId) {
+    const cfg = policy.gates[gateId];
+    if (cfg === undefined)
+        return undefined;
+    return { enabled: cfg.enabled, mode: cfg.mode };
+}
+function deriveDispositions(report, policy) {
+    // Group violations by gate name.
+    const byGate = new Map();
+    for (const v of report.violations) {
+        const list = byGate.get(v.gate);
+        if (list === undefined)
+            byGate.set(v.gate, [v]);
+        else
+            list.push(v);
+    }
+    const dispositions = [];
+    for (const gateId of KNOWN_GATE_IDS) {
+        const cfg = gateConfigFor(policy, gateId);
+        if (cfg === undefined)
+            continue; // gate not declared in policy
+        const violations = byGate.get(gateId) ?? [];
+        byGate.delete(gateId);
+        let outcome;
+        let blocks;
+        if (cfg.enabled === false || cfg.mode === 'skip') {
+            outcome = 'skipped';
+            blocks = false;
+        }
+        else if (violations.length === 0) {
+            outcome = 'pass';
+            blocks = false;
+        }
+        else {
+            outcome = 'fail';
+            blocks = cfg.mode === 'block';
+        }
+        dispositions.push({
+            gate_id: gateId,
+            mode: cfg.mode,
+            outcome,
+            blocks,
+            violations,
+        });
+    }
+    // Whatever remains in byGate are unmatched violations (gates the
+    // subprocess reported but policy doesn't declare).
+    const unmatchedViolations = [];
+    for (const list of byGate.values())
+        unmatchedViolations.push(...list);
+    return {
+        dispositions,
+        unmatchedViolations,
+        anyBlocks: dispositions.some((d) => d.blocks),
+    };
+}
+//# sourceMappingURL=disposition.js.map