@patronage/software-factory 0.25.0 → 0.30.0-alpha.1

package/dist/index.d.ts

@@ -26,7 +26,7 @@ interface GithubIssueComment {
 }
 declare const normalizeIssueComments: (value: GithubIssueCommentApi[] | GithubIssueCommentApi[][]) => GithubIssueComment[];
 declare namespace boundary_review_proof_d_exports {
-  export { BOUNDARY_REVIEW_PROOF_KIND, BoundaryReviewProof, BoundaryReviewProofComment, boundaryReviewProofSchema, selectBoundaryReviewProof, undispositionedBlockingFindings };
+  export { BOUNDARY_REVIEW_PROOF_KIND, BoundaryReviewProof, BoundaryReviewProofComment, boundaryReviewProofAuthorsSeen, boundaryReviewProofSchema, selectBoundaryReviewProof, undispositionedBlockingFindings };
 }
 declare const BOUNDARY_REVIEW_PROOF_KIND = "boundary-review-proof";
 declare const boundaryReviewProofBaseSchema: z.ZodObject<{
@@ -124,6 +124,7 @@ interface BoundaryReviewProofComment {
   commentUrl?: string;
 }
 declare const selectBoundaryReviewProof: (comments: GithubIssueComment[], boundary: string, declaredBy: string) => BoundaryReviewProofComment | undefined;
+declare const boundaryReviewProofAuthorsSeen: (comments: GithubIssueComment[], boundary: string) => string[];
 declare const undispositionedBlockingFindings: (proof: BoundaryReviewProof) => string[];
 //#endregion
 //#region src/hq-ingest-sink.d.ts
@@ -461,6 +462,27 @@ declare const blockedReasonSchema: z.ZodObject<{
 }, z.core.$strip>;
 type BlockedReason = z.infer<typeof blockedReasonSchema>;
 //#endregion
+//#region src/arm-auto-merge.d.ts
+interface ArmAutoMergeInput {
+  cwd: string;
+  /** The validated PR head this arming is a compare-and-set against. */
+  headSha: string;
+  owner: string;
+  pr: number;
+  repo: string;
+}
+/**
+ * What the PR actually did, read back after the call — never inferred from the
+ * exit code. `not-armed` is a failure: the candidate is admitted but nothing
+ * will merge it, so it carries the detail and `pr:ready` emits a re-dispatch.
+ */
+interface ArmAutoMergeOutcome {
+  /** Why the arming did not take effect, or what the invocation reported. */
+  detail?: string;
+  headSha: string;
+  outcome: "armed" | "merged" | "not-armed";
+}
+//#endregion
 //#region src/checkout-repository.d.ts
 interface CheckoutRepository {
   name: string;
@@ -497,235 +519,30 @@ declare const followUpFromArgv: (argv: string[]) => FollowUpAction;
 /** Canonical zod schema for the optional follow-up field on JSON outputs. */
 declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
 //#endregion
-//#region src/github-client.d.ts
-interface GithubPullRequestReview {
-  author: {
-    login?: string;
-  };
-  body: string;
-  /** GraphQL `PullRequestReview.lastEditedAt` — REST's `/pulls/reviews` has no equivalent (#843). */
-  lastEditedAt?: string;
-  state: string;
-  submittedAt?: string;
-  url: string;
-}
-//#endregion
-//#region src/merge-freeze.d.ts
-declare const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
-declare const MERGE_FREEZE_APP_SLUG = "patronage-factory";
-declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-  active: z.ZodLiteral<true>;
-  generationId: z.ZodNumber;
-  headSha: z.ZodString;
-  outcome: z.ZodEnum<{
-    active: "active";
-    stale: "stale";
-  }>;
-  reason: z.ZodString;
-  recordedAt: z.ZodISODateTime;
-  schemaVersion: z.ZodLiteral<1>;
-}, z.core.$strip>, z.ZodObject<{
-  active: z.ZodLiteral<false>;
-  clearRationale: z.ZodOptional<z.ZodString>;
-  generationId: z.ZodNumber;
-  headSha: z.ZodString;
-  outcome: z.ZodLiteral<"inactive">;
-  reason: z.ZodString;
-  recordedAt: z.ZodISODateTime;
-  schemaVersion: z.ZodLiteral<1>;
-}, z.core.$strip>], "active">;
-type MergeFreezeState = z.infer<typeof mergeFreezeStateSchema>;
-/**
- * The write side of this contract lives in the generated main-push verify
- * workflow (#356, ADR 0016 as amended): it is the ONLY producer of
- * `patronage-factory/merge-freeze` generations. Its emitted `output.text`
- * payload must parse under this exact reader schema, which is what the
- * workflow's own tests assert through this export.
- */
-declare function validateMergeFreezeState(value: unknown): MergeFreezeState;
-interface MergeFreezeStoreInput {
-  cwd: string;
-  headSha: string;
-  repository: CheckoutRepository;
-}
-interface MergeFreezeStore {
-  read: (input: MergeFreezeStoreInput) => unknown;
-}
-declare namespace worktree_held_branch_d_exports {
-  export { MergeOperationalNotices, WorktreeHeldBranch, WorktreeHeldBranchCheck, WorktreeListEntry, checkWorktreeHeldBranch, findWorktreeHeldBranch, formatHeldBranchCloseoutSummary, listWorktreesPorcelain, parseGitWorktreeList, resolveMergeOperationalNotices, worktreeHeldBranchNotice };
-}
-/**
- * Detects when a PR head branch is checked out in a local git worktree.
- *
- * `gh pr merge --delete-branch` fails when the local branch is held by a
- * worktree (git refuses to delete a checked-out branch), which previously
- * broke the auto-merge lane mid-merge (patronage/internal#284). The merge
- * preflight surfaces this as an actionable notice — not a hard fail — so the
- * operator merges without `--delete-branch` (or prunes the worktree first)
- * and defers local branch cleanup to closeout.
- */
-interface WorktreeHeldBranch {
-  branch: string;
-  worktreePath: string;
-}
-interface WorktreeListEntry {
-  branch?: string;
-  path: string;
-}
-/**
- * Parses `git worktree list --porcelain` output. Entries are separated by
- * blank lines; each starts with `worktree <path>` and carries an optional
- * `branch refs/heads/<name>` attribute (detached worktrees have none).
- */
-declare function parseGitWorktreeList(porcelain: string): WorktreeListEntry[];
-/**
- * Returns the worktree holding `branch`, or undefined when no local worktree
- * has it checked out (or the porcelain listing was unavailable).
- */
-declare function findWorktreeHeldBranch({
-  branch,
-  worktreeListPorcelain
-}: {
-  branch: string;
-  worktreeListPorcelain: string | undefined;
-}): undefined | WorktreeHeldBranch;
-declare function worktreeHeldBranchNotice(held: WorktreeHeldBranch): string;
-interface MergeOperationalNotices {
-  notices: string[];
-  worktreeHeldBranch?: WorktreeHeldBranch;
-  worktreeHeldBranches?: WorktreeHeldBranch[];
-}
-/**
- * Single entry point for non-blocking merge preflight notices, mirroring
- * `resolveMergeGuardIdentity`/`mergeGuardBlockingReasons` in
- * merge-identity.ts: adding a notice kind never requires coordinated edits
- * in the command runner, and persisted notice strings cannot drift from the
- * structured detection result.
- */
-declare function resolveMergeOperationalNotices({
-  headRefName,
-  worktreeListPorcelain
-}: {
-  headRefName: string | undefined;
-  worktreeListPorcelain: string | undefined;
-}): MergeOperationalNotices;
-/**
- * Shared `git worktree list --porcelain` reader for merge preflight and
- * closeout. Returns undefined when the directory is missing, not a git
- * repository, or git is unavailable — detection is best-effort and callers
- * report "skipped" rather than fabricating a result.
- */
-declare function listWorktreesPorcelain(cwd: string): string | undefined;
-interface WorktreeHeldBranchCheck {
-  held?: WorktreeHeldBranch;
-  /** "skipped" means no branch was recorded or worktrees were unlistable. */
-  status: "clean" | "held" | "skipped";
-}
-/**
- * Closeout-side counterpart to the merge-preflight notice: the merge step
- * defers local branch cleanup to closeout, so closeout planning checks
- * whether the worker branch is still held by a worktree (#284).
- */
-declare function checkWorktreeHeldBranch({
-  branch,
-  worktreeListPorcelain
-}: {
-  branch: string | undefined;
-  worktreeListPorcelain: string | undefined;
-}): WorktreeHeldBranchCheck;
-/** One-line closeout summary, owned beside the detection logic. */
-declare function formatHeldBranchCloseoutSummary(check: WorktreeHeldBranchCheck): string;
-declare namespace merge_identity_d_exports {
-  export { LiveHeadInput, MergeGuardIdentity, MergeIdentityResult, PostProofCommit, ReadyProofForMergeIdentity, evaluateMergeIdentity, mergeGuardBlockingReasons, mergeGuardIdentitySchema, resolveMergeGuardIdentity };
-}
-interface PostProofCommit {
-  sha: string;
-  subject: string;
-}
+//#region src/pr-readiness/handled-human-comments.d.ts
+declare const HANDLED_COMMENTS_PAYLOAD_KIND: "handled-human-comments";
 /**
- * The slice of the pr:ready proof the merge guard actually consumes, so this
- * module does not depend on the parent proof envelope. `PrReadyProof` is
- * structurally assignable to this type.
+ * Authenticated producer of the durable handled set. Recorded on the readiness
+ * ledger; unverifiable producers are ignored on read (fail closed).
  */
-interface ReadyProofForMergeIdentity {
-  blockingReasons: string[];
-  ledger: {
-    /**
-     * The evaluated head SHA recorded by pr:ready: `pr.headRefOid` captured
-     * at evaluation time. The merge guard compares it to the live pushed
-     * HEAD with exact equality.
-     */
-    headSha: string;
-    pr: number;
-  };
-  status: string;
+type HandledCommentsProducerMode = "app" | "commit-status";
+interface HandledCommentsProducer {
+  /** App id (stringified) or GitHub login, depending on mode. */
+  identity: string;
+  mode: HandledCommentsProducerMode;
 }
-type MergeIdentityResult = {
-  kind: "match";
-  headSha: string;
-} | {
-  kind: "diverged";
-  liveHeadSha: string;
-  postProofCommits?: PostProofCommit[];
-  proofHeadSha: string;
-};
-type MergeGuardIdentity = MergeIdentityResult | {
-  kind: "live-head-invalid";
-  pr: number;
-  received: string;
-} | {
-  kind: "ready-proof-missing";
-  errorDetail?: string;
-  readyProofPath: string;
-} | {
-  kind: "ready-proof-pr-mismatch";
-  proofPr: number;
-  requestedPr: number;
-} | {
-  kind: "ready-proof-not-ready";
-  blockingReasons: string[];
-  status: string;
-};
-declare const evaluateMergeIdentity: ({
-  liveHeadSha,
-  postProofCommits,
-  proofHeadSha
-}: {
-  liveHeadSha: string;
-  postProofCommits?: PostProofCommit[];
-  proofHeadSha: string;
-}) => MergeIdentityResult;
-/**
- * The live PR head as fetched from GitHub: either a validated 40-hex SHA or
- * the raw (stringified) response that failed validation.
- */
-type LiveHeadInput = {
-  headSha: string;
-} | {
-  invalidResponse: string;
-};
-/**
- * Single entry point that owns construction of every MergeGuardIdentity
- * kind, so adding or changing a kind never requires coordinated edits in the
- * command runner.
- */
-declare const resolveMergeGuardIdentity: ({
-  commitsBetween,
-  liveHead,
-  pr,
-  readyProof,
-  readyProofError,
-  readyProofPath
-}: {
-  commitsBetween?: (fromSha: string, toSha: string) => PostProofCommit[] | undefined;
-  liveHead: LiveHeadInput;
+interface HandledCommentsCheckPayload {
+  clearedAt?: string;
+  handledCommentUrls: string[];
+  kind: typeof HANDLED_COMMENTS_PAYLOAD_KIND;
   pr: number;
-  readyProof: ReadyProofForMergeIdentity | undefined;
-  readyProofError?: unknown;
-  readyProofPath: string;
-}) => MergeGuardIdentity;
-declare const mergeGuardIdentitySchema: z.ZodType<MergeGuardIdentity>;
-declare const mergeGuardBlockingReasons: (identity: MergeGuardIdentity) => string[];
+  schemaVersion: 1;
+  sessionId?: string;
+}
+//#endregion
+//#region src/diff-classification.d.ts
+declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
+type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
 //#endregion
 //#region src/profile.d.ts
 declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
@@ -762,12 +579,11 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     }>;
     name: z.ZodString;
     scope: z.ZodOptional<z.ZodObject<{
-      classifications: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+      classifications: z.ZodArray<z.ZodEnum<{
         trivial: "trivial";
         "docs/process-only": "docs/process-only";
         "non-trivial": "non-trivial";
-      }>>>;
-      labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }>>;
     }, z.core.$strict>>;
   }, z.core.$strict>>>;
   review: z.ZodObject<{
@@ -817,138 +633,6 @@ interface LoadProjectProfileResult {
 }
 declare function loadProjectProfile(input?: LoadProjectProfileInput): LoadProjectProfileResult;
 //#endregion
-//#region src/review-rungs.d.ts
-declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
-type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
-//#endregion
-//#region src/pr-merge-check.d.ts
-interface PrMergeCheckArgs extends LoadProjectProfileInput {
-  epic?: number;
-  json?: boolean;
-  output?: string;
-  pr: number;
-  readyProof?: string;
-}
-interface PrMergeCheckProof {
-  schemaVersion: 1;
-  blockingReasons: string[];
-  boundary?: {
-    autoMerge: boolean;
-    epic: number;
-    review: EvidenceReviewRung;
-    wave: string;
-  };
-  command: "patronage-factory pr:merge-check";
-  /**
-   * Machine-safe arg array for the obvious next action (#523): on `pass`, the
-   * remote-only GitHub merge API invocation for this PR; on `fail`, the re-run that clears the
-   * block (`pr:ready`, or `pr:verify` then `pr:ready` after a head
-   * divergence). Same `argv` shape `factory:delegate --print` emits. Optional
-   * and purely additive — existing consumers ignore it.
-   */
-  followUp?: FollowUpAction;
-  identity: MergeGuardIdentity;
-  /**
-   * The pushed PR head SHA fetched from GitHub at check time. Absent only
-   * when GitHub returned no usable 40-hex head (identity kind
-   * "live-head-invalid"), which is itself a fail-closed blocking state.
-   */
-  liveHeadSha?: string;
-  /**
-   * Actionable operational notices that do not block the merge, e.g. a PR
-   * head branch held by a local worktree, which makes
-   * `gh pr merge --delete-branch` fail (patronage/internal#284).
-   */
-  notices?: string[];
-  pr: number;
-  status: "pass" | "fail";
-  /**
-   * Demands that were in force, were NOT met, and were waived by the operator
-   * (#354). Each entry carries the demand's refusals verbatim, so a waived
-   * demand can never read as a met one; the merge proceeds on the recorded
-   * operator act, not on evidence.
-   */
-  waivedDemands?: WaivedDemand[];
-  /** Present when the PR head branch is checked out in a local worktree. */
-  worktreeHeldBranch?: WorktreeHeldBranch;
-  /** All merge-relevant branches held by local worktrees (head and default). */
-  worktreeHeldBranches?: WorktreeHeldBranch[];
-}
-interface PrMergeCheckGitDependencies {
-  checkoutRepository: (cwd: string) => CheckoutRepository;
-  commitsBetween: (cwd: string, fromSha: string, toSha: string) => PostProofCommit[] | undefined;
-  worktreeListPorcelain: (cwd: string) => string | undefined;
-  showFileAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
-  objectIdAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
-}
-interface PrMergeCheckDependencies {
-  git?: Partial<PrMergeCheckGitDependencies>;
-  github?: {
-    fetchClosingPullRequests?: (input: {
-      issue: number;
-      owner: string;
-      repo: string;
-    }) => {
-      number: number;
-    }[];
-    fetchIssueBody?: (input: {
-      issue: number;
-      owner: string;
-      repo: string;
-    }) => string;
-    fetchPullRequestHead: (input: {
-      cwd: string;
-      owner: string;
-      pr: number;
-      repo: string;
-    }) => {
-      headRefName?: string;
-      headRefOid: string;
-      baseRefName?: string;
-      baseRefOid?: string;
-      mergedAt?: string | null;
-      remoteHeadRefExists?: boolean;
-      labels?: {
-        name: string;
-      }[];
-    };
-    fetchPullRequestReviews?: (input: {
-      owner: string;
-      pr: number;
-      repo: string;
-    }) => GithubPullRequestReview[];
-  };
-  mergeFreeze?: MergeFreezeStore;
-}
-declare function validatePrMergeCheckProof(value: unknown): PrMergeCheckProof;
-declare function readPrMergeCheckProof(filePath: string): PrMergeCheckProof;
-declare function runPrMergeCheck(args: PrMergeCheckArgs, dependencies?: PrMergeCheckDependencies): PrMergeCheckProof;
-//#endregion
-//#region src/pr-readiness/handled-human-comments.d.ts
-declare const HANDLED_COMMENTS_PAYLOAD_KIND: "handled-human-comments";
-/**
- * Authenticated producer of the durable handled set. Recorded on the readiness
- * ledger; unverifiable producers are ignored on read (fail closed).
- */
-type HandledCommentsProducerMode = "app" | "commit-status";
-interface HandledCommentsProducer {
-  /** App id (stringified) or GitHub login, depending on mode. */
-  identity: string;
-  mode: HandledCommentsProducerMode;
-}
-interface HandledCommentsCheckPayload {
-  clearedAt?: string;
-  handledCommentUrls: string[];
-  kind: typeof HANDLED_COMMENTS_PAYLOAD_KIND;
-  pr: number;
-  schemaVersion: 1;
-  sessionId?: string;
-}
-//#endregion
-//#region src/diff-classification.d.ts
-declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
-type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
-//#endregion
 //#region src/pr-verify-mode.d.ts
 /**
  * The verification mode `pr:verify` resolved for a run.
@@ -1074,6 +758,28 @@ interface CheckRunDependencies {
  * human-readable mirror, not a proof surface, so a caller that needs an
  * App-verified check run must be told plainly whether it got one. Returns
  * `true` only when the App-owned check run landed.
+ *
+ * "Landed" means GitHub serves it, not that the POST was accepted (#520). On
+ * PR #519 the POST was accepted, `pr:ready` reported ready and armed, and the
+ * source-pinned required check read `in_progress` across three runs — so GitHub
+ * never scheduled the merge and emitted no rollup row saying why. Arming
+ * already refuses to infer its outcome from the invocation and reads the pull
+ * request back (`arm-auto-merge.ts`); publication now does the same.
+ *
+ * "Landed" is judged against every run of the name from the pinned App, not
+ * against the one GitHub collapses to (#524): the newest must be *this* run, in
+ * the status and conclusion that were published, and no run of the name may
+ * still be unfinished. A surviving `in_progress` run blocks the required check
+ * on its own, so confirming past it would report success on a pull request
+ * GitHub will never merge. One read, no polling: an unconfirmed publication
+ * returns `false`, which `pr:ready` already turns into a notice and an
+ * idempotent re-dispatch.
+ *
+ * Confirmation is a point-in-time read, deliberately: a later publication for
+ * the same name changes the answer — a completed one by becoming the newest, an
+ * unfinished one by holding the check open beside this verdict rather than
+ * replacing it — and every remaining writer publishes once, as the last thing
+ * its invocation does. No retry, no poll, no re-confirm.
  */
 declare function ensureFactoryCheckRunPublished(input: PublishFactoryCheckInput, dependencies?: CheckRunDependencies & {
   onDiagnostic?: (message: string) => void;
@@ -1087,6 +793,79 @@ interface PublishHandledCommentsCheckInput {
   sha: string;
 }
 //#endregion
+//#region src/merge-freeze.d.ts
+declare const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
+declare const MERGE_FREEZE_APP_SLUG = "patronage-factory";
+declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  active: z.ZodLiteral<true>;
+  generationId: z.ZodNumber;
+  headSha: z.ZodString;
+  outcome: z.ZodEnum<{
+    active: "active";
+    stale: "stale";
+  }>;
+  reason: z.ZodString;
+  recordedAt: z.ZodISODateTime;
+  schemaVersion: z.ZodLiteral<1>;
+}, z.core.$strip>, z.ZodObject<{
+  active: z.ZodLiteral<false>;
+  clearRationale: z.ZodOptional<z.ZodString>;
+  generationId: z.ZodNumber;
+  headSha: z.ZodString;
+  outcome: z.ZodLiteral<"inactive">;
+  reason: z.ZodString;
+  recordedAt: z.ZodISODateTime;
+  schemaVersion: z.ZodLiteral<1>;
+}, z.core.$strip>], "active">;
+type MergeFreezeState = z.infer<typeof mergeFreezeStateSchema>;
+/**
+ * The write side of this contract lives in the generated main-push verify
+ * workflow (#356, ADR 0016 as amended): it is the ONLY producer of
+ * `patronage-factory/merge-freeze` generations. Its emitted `output.text`
+ * payload must parse under this exact reader schema, which is what the
+ * workflow's own tests assert through this export.
+ */
+declare function validateMergeFreezeState(value: unknown): MergeFreezeState;
+interface MergeFreezeStoreInput {
+  cwd: string;
+  headSha: string;
+  repository: CheckoutRepository;
+}
+interface MergeFreezeStore {
+  read: (input: MergeFreezeStoreInput) => unknown;
+}
+/**
+ * The freeze generation as an arming decision needs to see it (#477).
+ *
+ * `read` above collapses three different situations into one refusal, because
+ * merge time treated all of them as "do not merge". Arming time distinguishes
+ * them: a settled generation is the writer's verdict, a **settling** one is the
+ * window between a merge landing and its main-push verify completing (a
+ * running generation, or a missing generation proven by the immediately prior
+ * settled tip plus a current source-pinned verify run), and an **unreadable**
+ * one is ambiguous, malformed, foreign-App, or unavailable state. Same
+ * selection, same pinned App, same `started_at` ordering — only the reporting
+ * is finer.
+ */
+type MergeFreezeGeneration = {
+  kind: "settled";
+  state: MergeFreezeState;
+} | {
+  kind: "settling";
+  reason: string;
+  running?: {
+    headSha: string;
+    id: number;
+  };
+} | {
+  kind: "unreadable";
+  reason: string;
+};
+/** A merge-freeze reader that can also report the settle window (#477). */
+interface MergeFreezeAuthority extends MergeFreezeStore {
+  readGeneration: (input: MergeFreezeStoreInput) => MergeFreezeGeneration;
+}
+//#endregion
 //#region src/pr-proof-io.d.ts
 interface ProofDescriptor<T> {
   label: string;
@@ -1150,6 +929,10 @@ interface ReviewLadderPolicy {
 }
 declare const resolveReviewLadderPolicy: (profile: Pick<FactoryProjectProfile, "review">) => ReviewLadderPolicy;
 //#endregion
+//#region src/review-rungs.d.ts
+declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
+type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
+//#endregion
 //#region src/review-ladder-ledger.d.ts
 type LadderCycleStage = "interior" | "gate";
 interface LadderCycleRef {
@@ -1436,12 +1219,11 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     name: z.ZodString;
     reason: z.ZodOptional<z.ZodString>;
     scope: z.ZodOptional<z.ZodObject<{
-      classifications: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+      classifications: z.ZodArray<z.ZodEnum<{
         trivial: "trivial";
         "docs/process-only": "docs/process-only";
         "non-trivial": "non-trivial";
-      }>>>;
-      labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }>>;
     }, z.core.$strict>>;
     scopeReason: z.ZodString;
     status: z.ZodEnum<{
@@ -1643,7 +1425,7 @@ type ReadinessStatus = "ready" | "blocked" | "slice-ready/not-final";
 type ManagedReadinessLedger = z.infer<typeof managedReadinessLedgerSchema>;
 declare function validateManagedReadinessLedger(value: unknown): ManagedReadinessLedger;
 declare namespace status_check_rollup_d_exports {
-  export { CheckState, StatusCheckRollup, isFactoryReadyCheck, statusCheckState };
+  export { CheckState, HOSTED_VERIFY_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isFactoryReadyCheck, isHostedVerifyCheck, statusCheckState };
 }
 type CheckState = "passed" | "failed" | "pending" | "none" | "unknown";
 interface StatusCheckRollup {
@@ -1658,6 +1440,38 @@ interface StatusCheckRollup {
   workflowName?: string;
 }
 declare const isFactoryReadyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The hosted verification gate's context name — the branch ruleset's other
+ * source-pinned required check, alongside `patronage-factory/pr-ready`. One
+ * name across the fleet because one generator emits the workflow that posts
+ * it (ADR 0016, 2026-07-31 amendment).
+ */
+declare const HOSTED_VERIFY_CHECK_NAME = "verify";
+/**
+ * Is this rollup entry the hosted `verify` gate, from the producer the
+ * ruleset pins it to?
+ *
+ * `workflowName` is the producer signal the rollup actually carries: GitHub
+ * Actions check runs name their workflow, App-posted check runs come back with
+ * an empty one, and a user-token commit status arrives as a `context` with no
+ * `name` at all. Epic #473 wave 2 measured that a same-named check from the
+ * wrong writer is as inert as no check at all, so matching the name alone
+ * would accept exactly the thing the pin rejects.
+ */
+declare const isHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
+/**
+ * The hosted `verify` gate's state on this head, read by presence (#477).
+ *
+ * This is the one rollup question the rollup can answer honestly. Wave 2
+ * measured that GitHub omits an *unsatisfied pinned requirement* from
+ * `statusCheckRollup` entirely — there is no "expected" or "missing" row — so
+ * a green rollup is not evidence of mergeability. What the rollup does report
+ * faithfully is the checks that ran. Asking whether this specific check ran,
+ * and passed, on this head turns the rollup's silence from a false green into
+ * a named refusal: `"none"` means the pinned requirement is unsatisfied and
+ * nothing else in the rollup would have said so.
+ */
+declare const hostedVerifyCheckState: (rollup: StatusCheckRollup[] | undefined) => CheckState;
 declare const statusCheckState: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => CheckState;
 //#endregion
 //#region src/pr-ready.d.ts
@@ -1676,6 +1490,21 @@ interface PrReadyArgs extends LoadProjectProfileInput {
   verifyProof?: string;
 }
 interface GitHubPullRequest {
+  /**
+   * GitHub's live auto-merge enablement, or `null` when nothing is scheduled.
+   *
+   * Required, not optional (#515 review). `gh pr view --json autoMergeRequest`
+   * always returns the key — explicitly `null` when nothing is scheduled — and
+   * errors loudly on a field name it does not know, so there is no shape where
+   * the real CLI omits it. But `fetchPullRequest` is injectable, and an
+   * implementation that left the field out would silently disable the
+   * `boundary-wave` refusal that stops an epicless run from greening a
+   * candidate GitHub is already scheduled to merge. Requiring it makes the
+   * compiler enforce what `gh` already promises.
+   */
+  autoMergeRequest: {
+    enabledAt?: string;
+  } | null;
   baseRefName: string;
   baseRefOid: string;
   body: string;
@@ -1691,9 +1520,6 @@ interface GitHubPullRequest {
   }[];
   headRefOid: string;
   isDraft: boolean;
-  labels?: {
-    name: string;
-  }[];
   mergeStateStatus: string;
   mergeable: string;
   number: number;
@@ -1713,7 +1539,20 @@ interface GitHubPullRequest {
   url: string;
 }
 interface PrReadyProof {
-  schemaVersion: 2;
+  schemaVersion: 3;
+  /**
+   * What GitHub actually did when this run armed native auto-merge (#477).
+   * Present exactly when readiness passed and the arming ran; read back from
+   * the PR rather than inferred from the invocation, because `gh pr merge
+   * --auto` arms, merges, or does nothing with the same exit code and the same
+   * empty output. `not-armed` means the candidate is admitted but nothing will
+   * merge it, and `followUp` carries the re-dispatch.
+   */
+  arming?: {
+    detail?: string;
+    headSha: string;
+    outcome: "armed" | "merged" | "not-armed";
+  };
   /**
    * Why this run blocked, one entry per refusing demand (#391): `code` is the
    * demand key from the resolver's vocabulary, `detail` the one-sentence
@@ -1726,11 +1565,12 @@ interface PrReadyProof {
   humanBlockingReasons: string[];
   command: "patronage-factory pr:ready";
   /**
-   * Machine-safe arg array for the obvious next action (#523): when `ready`,
-   * the `pr:merge-check` that must precede a merge; otherwise the `pr:verify`
-   * re-run that the blocking reasons name (re-verify the head, then re-run
-   * pr:ready). Same `argv` shape `factory:delegate --print` emits. Optional
-   * and purely additive.
+   * Machine-safe arg array for the obvious next action (#523): when `ready`
+   * but arming did not take effect, a `pr:ready` re-dispatch (idempotent on
+   * an unchanged head); otherwise the `gh pr ready` undraft repair or the
+   * `pr:verify` re-run that the blocking reasons name (re-verify the head,
+   * then re-run pr:ready). Same `argv` shape `factory:delegate --print`
+   * emits. Optional and purely additive.
    */
   followUp?: FollowUpAction;
   /**
@@ -1740,6 +1580,12 @@ interface PrReadyProof {
    * pushed HEAD, not a re-derivation. See the ledger schema.
    */
   ledger: ManagedReadinessLedger;
+  /**
+   * Actionable facts that did not block (#477): a settling merge-freeze
+   * generation that armed with a notice, and how each waived demand reads to a
+   * human. Absent when there are none.
+   */
+  notices?: string[];
   /** Committed profile blob evaluated by readiness. Required for merge. */
   profileBlobSha?: string;
   /** Checkout-relative committed profile path evaluated by readiness. */
@@ -1748,9 +1594,22 @@ interface PrReadyProof {
   /** Trusted checkout repository used for all GitHub reads and writes. */
   repository?: string;
   status: ReadinessStatus;
+  /**
+   * Demands that were in force, were NOT met, and were waived by the operator
+   * (#354, moved here from the merge-time proof by #477). Each entry carries
+   * the demand's refusals verbatim, so a waived demand can never read as a met
+   * one; the arming proceeds on the recorded operator act, not on evidence.
+   */
+  waivedDemands?: WaivedDemand[];
 }
 type PublishHandledCommentsResult = HandledCommentsProducer | Promise<HandledCommentsProducer | undefined> | undefined;
 interface PrReadyDependencies {
+  /**
+   * Arms GitHub native auto-merge for a passing candidate (#477). Defaults to
+   * the real `gh pr merge --auto` call plus the read-back that says what
+   * actually happened.
+   */
+  armAutoMerge?: (input: ArmAutoMergeInput) => ArmAutoMergeOutcome;
   github?: {
     fetchClosingPullRequests?: (input: {
       issue: number;
@@ -1786,7 +1645,26 @@ interface PrReadyDependencies {
   };
   git?: PrReadyGitDependencies;
   hq?: HqIngestDependencies;
-  publishCheckRun?: (input: PublishFactoryCheckInput) => void;
+  /**
+   * The authoritative merge-freeze reader (#477). Defaults to the pinned-App
+   * GitHub check-run authority — readiness is a control, so an absent
+   * dependency must not mean an unread freeze.
+   */
+  mergeFreeze?: Pick<MergeFreezeAuthority, "readGeneration">;
+  /**
+   * Awaited publication of the branded check, which is a source-pinned
+   * required check rather than a mirror (#477). Returns true only when the
+   * App-owned run landed. Defaults to `ensureFactoryCheckRunPublished`.
+   *
+   * `pr:ready` has no other publication seam, and this one cannot express a
+   * non-terminal run (#526): `status` is omitted from the input, so every run
+   * readiness creates is completed with a conclusion. A `pr:ready` invocation
+   * therefore cannot leave a run holding the source-pinned required check
+   * open, which is a permanent block on the pull request (#524).
+   */
+  publishFinalCheckRun?: (input: Omit<PublishFactoryCheckInput, "status"> & {
+    conclusion: "failure" | "success";
+  }) => Promise<boolean> | boolean;
   /** Injectable delay for the UNKNOWN-mergeable brief poll (tests). */
   sleep?: (ms: number) => Promise<void>;
   /** Injectable clock for CLI handled-comment provenance (tests). */
@@ -1811,16 +1689,14 @@ declare function runPrReady(args: PrReadyArgs, dependencies?: PrReadyDependencie
 declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
 type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
 declare const requiredCheckScopeSchema: z.ZodObject<{
-  classifications: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+  classifications: z.ZodArray<z.ZodEnum<{
     trivial: "trivial";
     "docs/process-only": "docs/process-only";
     "non-trivial": "non-trivial";
-  }>>>;
-  labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  }>>;
 }, z.core.$strict>;
 type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
 interface RequiredCheckScopeContext {
-  labels: string[] | undefined;
   classification: DiffClassification | undefined;
 }
 interface ScopeDecision {
@@ -2571,9 +2447,6 @@ declare const runDemandWaive: (args: DemandWaiveArgs, dependencies?: DemandWaive
 //#region src/commands/demand-waive.d.ts
 type DemandWaiveAction = (args: DemandWaiveArgs) => DemandWaiver;
 //#endregion
-//#region src/commands/pr-merge-check.d.ts
-type PrMergeCheckAction = (args: PrMergeCheckArgs) => PrMergeCheckProof;
-//#endregion
 //#region src/hq-credentials.d.ts
 /**
  * Why a reference did not resolve. Each value names a different remedy, and
@@ -2703,6 +2576,14 @@ type FollowUpRunner = (followUp: FollowUpAction, cwd: string) => Promise<void> |
 interface PrPublishHandoff {
   humanActions: string[];
   routeOwnedRepairs: ReadinessRepair[];
+  /**
+   * Whether the merge is actually on GitHub's schedule (#477, #515 review).
+   * An admitted candidate is not a handed-off one: `pr:ready` arms only when a
+   * boundary wave authorized it, and the arming can fail to take effect. A
+   * readiness status of `ready` says the candidate passed, never that anything
+   * will merge it — so publish reads this before claiming nothing is owed.
+   */
+  scheduled: boolean;
   status: PrReadyProof["status"];
 }
 type PrPublishFollowUpOutcome = {
@@ -3857,7 +3738,7 @@ declare const scanFactoryTraceDiagnostics: ({
 //#endregion
 //#region src/interior-telemetry/gate-timing.d.ts
 declare const GATE_TIMING_SCHEMA_VERSION = 1;
-type FactoryGateName = "boundary:check" | "factory:closeout" | "pr:merge-check" | "pr:ready" | "pr:review" | "pr:verify";
+type FactoryGateName = "boundary:check" | "factory:closeout" | "pr:ready" | "pr:review" | "pr:verify";
 type GateTimingOutcome = "fail" | "pass";
 interface GateTimingRecord {
   agentRunId: string;
@@ -4042,8 +3923,8 @@ type WorktreeRootLister = (worktreePath: string) => string[] | undefined;
 declare function checkWorktreeScratchFiles(worktreePath?: string, listRootEntries?: WorktreeRootLister): WorktreeScratchFileCheck;
 /**
  * Human-readable one-line summary of a scratch-file check, owned beside the
- * detection logic (mirroring worktreeHeldBranchNotice) so planner output,
- * docs, and future surfaces cannot drift apart.
+ * detection logic so planner output, docs, and future surfaces cannot drift
+ * apart.
  */
 declare function formatScratchFileCheckSummary(check: WorktreeScratchFileCheck): string;
 declare namespace pr_body_metadata_d_exports {
@@ -4292,6 +4173,8 @@ interface EvaluationInput {
   reviews?: PrReadinessReview[];
   unresolvedReviewThreads: number;
   requiredChecks: CheckState;
+  hostedVerifyCheck?: CheckState;
+  autoMergeEnabled?: boolean;
   draft: boolean;
   currentWithBase: boolean;
   mergeable: string;
@@ -4306,7 +4189,6 @@ interface EvaluationInput {
   evidenceEnvelopes?: LoadedEvidenceEnvelope[];
   mergeBaseSha?: string;
   authoringSessionIds?: string[];
-  prLabels?: string[];
   priorLedger?: Pick<ManagedReadinessLedger, "reviewRuns">;
   handledCommentUrls?: string[];
   checkRunHandledCommentUrls?: string[];
@@ -4316,7 +4198,12 @@ interface EvaluationInput {
   };
   handledCommentSessionId?: string;
   handledCommentClearedAt?: string;
-  waveReviewDemand?: Pick<WaveReviewDemand, "review" | "wave">;
+  waveReviewDemand?: Pick<WaveReviewDemand, "autoMerge" | "review" | "wave">;
+  mergeFreeze?: {
+    blockingReasons: string[];
+    notices: string[];
+  };
+  waivers?: DemandWaiver[];
 }
 declare const evaluateReadiness: (input: EvaluationInput) => {
   blockedReasons: {
@@ -4382,8 +4269,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       status: "satisfied" | "unmet" | "out-of-scope";
       reason?: string | undefined;
       scope?: {
-        classifications?: ("trivial" | "docs/process-only" | "non-trivial")[] | undefined;
-        labels?: string[] | undefined;
+        classifications: ("trivial" | "docs/process-only" | "non-trivial")[];
       } | undefined;
     }[] | undefined;
     handledCommentsProducer?: {
@@ -4452,12 +4338,19 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviewRuns?: PrReviewResult[] | undefined;
     reviewTerminalState?: "blocked" | "accepted-with-findings" | "clean" | undefined;
   };
+  /**
+   * Facts a reader needs that are not refusals (#477): the settle-window
+   * arming notice, and every waived demand rendered so it can never read as
+   * a met one.
+   */
+  notices: string[];
   repairs: {
     action: string;
     code: "undraft-pr" | "render-pr-body-sections" | "await-post-undraft-checks";
     command: string;
   }[];
-  status: ReadinessStatus;
+  status: ReadinessStatus; /** Demands that were in force, were NOT met, and the operator waived. */
+  waivedDemands: WaivedDemand[];
 };
 //#endregion
 //#region src/evidence-emit.d.ts
@@ -4798,7 +4691,6 @@ interface CreateProgramOptions {
   actions?: {
     boundaryCheck?: BoundaryCheckAction;
     demandWaive?: DemandWaiveAction;
-    prMergeCheck?: PrMergeCheckAction;
     prPublish?: PrPublishAction;
     prReady?: PrReadyAction;
     prReview?: PrReviewAction;
@@ -4809,4 +4701,4 @@ interface CreateProgramOptions {
 declare function createProgram(options?: CreateProgramOptions): Command;
 declare function run(argv?: string[]): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type BuildRetroEnvelopeInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type ParsedRetroEnvelope, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, type RetroEnvelope, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPublishFollowUp, worktree_held_branch_d_exports as prMergePreflight, pr_body_metadata_d_exports as prReadinessBodyMetadata, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, merge_identity_d_exports as prReadinessMergeIdentity, post_readiness_comments_d_exports as prReadinessPostComments, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, publishEpicStructure, readDemandWaivers, readPrMergeCheckProof, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrMergeCheck, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrMergeCheckProof, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type BuildRetroEnvelopeInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type ParsedRetroEnvelope, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, type RetroEnvelope, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPublishFollowUp, pr_body_metadata_d_exports as prReadinessBodyMetadata, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, post_readiness_comments_d_exports as prReadinessPostComments, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };