@patronage/software-factory 1.0.0-alpha.0 → 1.0.0-alpha.2

package/README.md

@@ -4,7 +4,7 @@
 
 The factory admits a pull request from evidence bound to its candidate. It validates policy and proof; it does not schedule workers, choose models, or run reviews. Those are jobs for the harness or operator.
 
-Admission is fail closed. A clean-session review and required verification produce typed proof, then readiness decides whether the candidate may proceed. Evidence stays current when the candidate patch is unchanged; the push-triggered Verify workflow covers integration risk on every factory merge target and freezes further merges into a target when that target goes red. Epic policy, including review minimums and auto-merge authority, lives in the boundary manifest. HQ observes this work; it never blocks a gate.
+Admission is fail closed. A clean-session review and required verification produce typed proof, then readiness decides whether the candidate may proceed. Evidence stays current when the candidate patch is unchanged; the push-triggered Verify workflow covers integration risk on every factory merge target — `main` and the `epic/**` integration branches. When a target goes red, the factory refuses new readiness decisions and authorized arming against that target; candidates armed before the target went red can still land. Epic policy, including review minimums and auto-merge authority, lives in the boundary manifest. HQ observes this work; it never blocks a gate.
 
 ## Develop the package
 
@@ -30,18 +30,24 @@ This is the release checklist. It lives here and nowhere else; the repository ru
 
 Releases are attended and hand-cut. Nothing in the factory publishes, tags, or releases on its own, and no step below may be automated as a drive-by.
 
+The factory family has one version posture (ADR 0026, `docs/adr/0026-factory-family-version-lines-move-in-lockstep.md` in the source repository): `@patronage/factory-ci` moves in lockstep majors with this CLI. From factory-ci's first release in the CLI's current series onward, majors and prerelease series move together while patch and prerelease increments stay independent per package. A consumer pins a factory-ci from the same major/prerelease series as its CLI; there is no compatibility matrix. Until that first lockstep release, factory-ci's published 0.x line is the named pre-adoption state and pairs with any CLI version. `@patronage/alchemy-d1-state` keeps independent SemVer. Lockstep is a rule the maintainer follows when cutting releases, never automation.
+
+A stacked release train has one terminal release-owning slice. Interior slices do not bump `package.json` or cut a checkpoint unless the boundary explicitly intends a separately published release at that slice: a lower-slice bump consumes the release window before the terminal slice lands, and the train must then advance the version and re-earn its terminal evidence.
+
+A stable cut has two phases. Phase 1 is the verified package candidate: steps 1 through 4 below, ending in the attended npm publish, tag, and GitHub release. Phase 2 is post-publication stable-doc convergence: steps 5 and 6, a normal admitted docs PR followed by the read-only convergence assertion from a clean `main`. Stable docs must never claim an unpublished version, so they cannot land in the phase-1 change. Prerelease behavior is unchanged: prerelease notes may land before publish while stable docs keep naming the prior stable version.
+
 1. Bump `package.json` to valid SemVer. The assertion derives its expected stable or prerelease channel from the version; it accepts no channel flag.
 2. Publish to npm per the [repository operations runbook](../docs/repository-operations.md#publishing) (attended, hand-cut, `pnpm publish` only). A stable version uses `pnpm --filter @patronage/software-factory publish`, which assigns npm `latest`. A prerelease must use `pnpm --filter @patronage/software-factory publish --tag next`; bare `pnpm publish` defaults to `latest` and would move it before the post-hoc assertion can reject the release.
 3. Cut the `software-factory-vX.Y.Z` tag and push it.
 4. Cut the GitHub release for that tag, with notes covering features, deletions, breaking changes, and closed issues. Mark it as a prerelease exactly when its SemVer version has a prerelease component. When the release changes the profile `schemaVersion`, state it in the notes — the profile schema version is a separate axis from the package version.
-5. Update affected `software-factory-docs/` pages. Stable docs must state the current stable version. Prerelease docs may record the candidate and its migration notes, but must not represent it as the current stable release.
-6. Confirm the five facts converge:
+5. Converge the stable docs after publication. Update affected `software-factory-docs/` pages through a normal admitted docs PR. Stable docs must state the current stable version. Prerelease docs may record the candidate and its migration notes, but must not represent it as the current stable release.
+6. After the docs PR merges, confirm the six facts converge from a clean checkout of `main`:
 
    ```bash
    pnpm --filter @patronage/software-factory exec tsx scripts/assert-publish-manifest.ts --release .
    ```
 
-   It reads what you just did and derives the channel from the manifest version. A stable release must converge exactly among manifest, npm `latest`, non-prerelease GitHub release, tag, and stable docs. A prerelease must exist on npm, own npm `next`, leave npm `latest` at the stable docs version, and have its prerelease GitHub release and tag. It publishes nothing. Step 6 is the only step a machine performs, and it performs it after you.
+   It reads what you just did and derives the channel from the manifest version. A stable release must converge exactly among manifest, npm `latest`, non-prerelease GitHub release, tag, and stable docs. A prerelease must exist on npm, own npm `next`, leave npm `latest` at the stable docs version, and have its prerelease GitHub release and tag. The sixth fact is the factory-ci pairing above: the assertion passes while every observed published `@patronage/factory-ci` version is pre-adoption 0.x and names that state, fails once a lockstep factory-ci release exists whose newest published version is outside the CLI's major/prerelease series, and fails when the registry read yields no readable factory-ci versions or contains an entry that does not parse — missing or unreadable data is an unsatisfied fact, not pre-adoption. It publishes nothing. Step 6 is the only step a machine performs, and it performs it after you.
 
 ## Use it in a project
 

package/dist/index.d.ts

@@ -537,6 +537,7 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     targets: z.ZodArray<z.ZodObject<{
       importers: z.ZodArray<z.ZodString>;
       name: z.ZodString;
+      paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
   }, z.core.$strict>>;
   proof: z.ZodObject<{
@@ -752,8 +753,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    active: "active";
     stale: "stale";
+    active: "active";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -1233,8 +1234,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       "run-interior-cycle": "run-interior-cycle";
     }>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
       "interior-complete": "interior-complete";
     }>;
   }, z.core.$strip>>;
@@ -1250,10 +1251,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        blocked: "blocked";
         "not-required": "not-required";
-        stale: "stale";
+        blocked: "blocked";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1262,10 +1263,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        blocked: "blocked";
         "not-required": "not-required";
-        stale: "stale";
+        blocked: "blocked";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -1276,8 +1277,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
     docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
     prVerify: z.ZodEnum<{
-      stale: "stale";
       passed: "passed";
+      stale: "stale";
       missing: "missing";
     }>;
     trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
@@ -1522,11 +1523,11 @@ declare function runPrReady(args: PrReadyArgs, dependencies?: PrReadyDependencie
  */
 declare const impactStampSchema: z.ZodObject<{
   basis: z.ZodEnum<{
-    "lockfile-scoped": "lockfile-scoped";
+    "target-scoped": "target-scoped";
     conservative: "conservative";
   }>;
   reasons: z.ZodArray<z.ZodString>;
-  stampVersion: z.ZodLiteral<1>;
+  stampVersion: z.ZodLiteral<2>;
   targets: z.ZodArray<z.ZodObject<{
     basis: z.ZodString;
     impact: z.ZodEnum<{
@@ -1560,7 +1561,7 @@ interface ImpactScopeDecision {
  * external proof demand (#542 wave 2), a verification-battery command, or a
  * preview (Alchemy) lifecycle stack (#430 wave 3).
  *
- * The only release path is a `lockfile-scoped` stamp of exactly this build's
+ * The only release path is a `target-scoped` stamp of exactly this build's
  * stamp version whose target entry for exactly this name is provably
  * `not-affected`. Every other input — no trusted stamp, an unknown stamp
  * version, a conservative stamp, a name the stamp does not classify, or an
@@ -1777,10 +1778,10 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  blocked: "blocked";
   "not-required": "not-required";
-  stale: "stale";
+  blocked: "blocked";
   current: "current";
+  stale: "stale";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -2186,9 +2187,9 @@ declare const retroEnvelopeV1Schema: z.ZodObject<{
   kind: z.ZodLiteral<"retro-envelope">;
   outcome: z.ZodOptional<z.ZodObject<{
     status: z.ZodEnum<{
-      blocked: "blocked";
       success: "success";
       fail: "fail";
+      blocked: "blocked";
       "ship-with-followups": "ship-with-followups";
     }>;
     verdict: z.ZodOptional<z.ZodString>;
@@ -2948,8 +2949,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3001,8 +3002,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3045,8 +3046,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
     }>;
     usage: z.ZodOptional<z.ZodObject<{
       estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3076,7 +3077,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     staleRepeats: number;
   };
   observedAt: string;
-  stage: "gate" | "interior";
+  stage: "interior" | "gate";
   issue?: number | undefined;
   pr?: number | undefined;
   threadId?: string | undefined;
@@ -4075,13 +4076,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
+        status: "not-required" | "blocked" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
+        status: "not-required" | "blocked" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -4089,7 +4090,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     schemaVersion: 1;
     verification: {
       command: "patronage-factory pr:verify";
-      prVerify: "stale" | "passed" | "missing";
+      prVerify: "passed" | "stale" | "missing";
       docsOnlyDeltaAccepted?: boolean | undefined;
       docsOnlyVerifiedHeadSha?: string | undefined;
       trivialDeltaAccepted?: boolean | undefined;
@@ -4132,7 +4133,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "gate" | "interior" | "interior-complete";
+      stage: "interior" | "gate" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;

package/dist/index.js

@@ -17,7 +17,7 @@ import picomatch from "picomatch";
 import { parse } from "yaml";
 import { promisify } from "node:util";
 //#region package.json
-var version = "1.0.0-alpha.0";
+var version = "1.0.0-alpha.2";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -894,8 +894,15 @@ function isValidGlob(pattern) {
 		return false;
 	}
 }
+function isRepoRelativePath(value) {
+	const segments = value.split("/");
+	return value.length > 0 && !value.startsWith("/") && !/^[A-Za-z]:\//u.test(value) && !value.includes("\\") && !segments.some((segment) => segment === "" || segment === "." || segment === "..");
+}
+function isValidRepoRelativeGlob(pattern) {
+	return isRepoRelativePath(pattern) && !(pattern.startsWith("!") && !pattern.startsWith("!(")) && isValidGlob(pattern);
+}
 function matchesAnyGlob(patterns, file) {
-	return patterns.length > 0 && picomatch.isMatch(file, patterns);
+	return patterns.length > 0 && picomatch.isMatch(file, [...patterns]);
 }
 //#endregion
 //#region src/diff-classification.ts
@@ -939,8 +946,9 @@ const LEGACY_PROFILE_SCHEMA_VERSIONS = [
 	3,
 	4
 ];
-const PROFILE_JSON_SCHEMA_DESCRIPTION = "Editor validation covers the profile input shape and straightforward cross-field constraints. Zod remains the load-time enforcement authority: verification command names must be distinct and requiredChecks entries must have distinct names; these invariants are enforced at load time, not by this schema.";
+const PROFILE_JSON_SCHEMA_DESCRIPTION = "Editor validation covers the profile input shape and straightforward cross-field constraints. Zod remains the load-time enforcement authority: verification command names must be distinct and requiredChecks entries must have distinct names; these invariants are enforced at load time, not by this schema. Impact target path patterns encode repo-relative safety in JSON Schema, while complete picomatch syntax validity remains a runtime-only refinement.";
 const globSchema = z.string().min(1).refine(isValidGlob, "must be a valid glob");
+const repoRelativeGlobSchema = z.string().min(1).regex(/^(?!(?:\/[\s\S]*|[A-Za-z]:\/[\s\S]*|!(?!\()[\s\S]*|[\s\S]*\\[\s\S]*|[\s\S]*\/\/[\s\S]*|[\s\S]*\/$|\.{1,2}(?:\/|$)[\s\S]*|[\s\S]*\/\.{1,2}(?:\/|$)[\s\S]*)).+$/u, "must be a repo-relative positive glob").refine(isValidRepoRelativeGlob, "must be a valid repo-relative glob");
 const commandSchema = z.object({
 	command: z.string().min(1),
 	description: z.string().min(1),
@@ -972,7 +980,8 @@ const requiredCheckSchema = z.object({
 }).strict();
 const impactTargetSchema = z.object({
 	importers: z.array(z.string().min(1)).min(1),
-	name: z.string().min(1)
+	name: z.string().min(1),
+	paths: z.array(repoRelativeGlobSchema).min(1).optional()
 }).strict();
 const impactConfigSchema = z.object({ targets: z.array(impactTargetSchema).min(1).superRefine((targets, context) => {
 	const names = targets.map((target) => target.name);
@@ -3845,9 +3854,9 @@ const impactStampTargetSchema = z.object({
 * input widened every target to full impact.
 */
 const impactStampSchema = z.object({
-	basis: z.enum(["lockfile-scoped", "conservative"]),
+	basis: z.enum(["target-scoped", "conservative"]),
 	reasons: z.array(z.string()),
-	stampVersion: z.literal(1),
+	stampVersion: z.literal(2),
 	targets: z.array(impactStampTargetSchema).superRefine((targets, context) => {
 		const names = targets.map((target) => target.name);
 		if (new Set(names).size !== names.length) context.addIssue({
@@ -3886,7 +3895,7 @@ const IMPACT_SCOPE_SURFACES = {
 * external proof demand (#542 wave 2), a verification-battery command, or a
 * preview (Alchemy) lifecycle stack (#430 wave 3).
 *
-* The only release path is a `lockfile-scoped` stamp of exactly this build's
+* The only release path is a `target-scoped` stamp of exactly this build's
 * stamp version whose target entry for exactly this name is provably
 * `not-affected`. Every other input — no trusted stamp, an unknown stamp
 * version, a conservative stamp, a name the stamp does not classify, or an
@@ -3905,11 +3914,11 @@ const impactStampScopeDecision = ({ stamp, surface, targetName }) => {
 		reason: `no trusted identity-bound impact stamp covers this candidate; ${floor}`,
 		scoped: false
 	};
-	if (stamp.stampVersion !== 1) return {
-		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 1; ${floor}`,
+	if (stamp.stampVersion !== 2) return {
+		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 2; ${floor}`,
 		scoped: false
 	};
-	if (stamp.basis !== "lockfile-scoped") return {
+	if (stamp.basis !== "target-scoped") return {
 		reason: `impact stamp is conservative (full impact assumed); ${floor}`,
 		scoped: false
 	};
@@ -3951,7 +3960,7 @@ const impactStampDemandRelease = ({ checkName, stamp }) => {
 const conservativeImpactStamp = (targets, reasons) => ({
 	basis: "conservative",
 	reasons,
-	stampVersion: 1,
+	stampVersion: 2,
 	targets: targets.map((target) => ({
 		basis: CONSERVATIVE_TARGET_BASIS,
 		impact: "affected",
@@ -4087,11 +4096,10 @@ const targetImpactForLockfileDelta = (target, delta) => {
 /**
 * Compute the impact stamp for one candidate: every declared target recorded
 * as affected/not-affected with its exact basis. `not-affected` is only ever
-* returned for a provably-scoped pnpm-lock.yaml (v9) delta; every other input
-* — non-lockfile changed files, an empty diff, a missing, unparseable, or
-* structurally malformed lockfile side, an unsupported lockfile version, or a
-* delta outside the importers/packages/snapshots graph sections — widens to
-* full impact.
+* returned only when every changed input is owned by a declared source glob or
+* is an analyzable pnpm-lock.yaml (v9) delta. Source and lockfile reachability
+* are unioned per target. Any invalid, unmatched, unreadable, unsupported, or
+* otherwise doubtful input widens the whole stamp to full impact.
 *
 * Total by contract: this function never throws. Any unexpected failure in
 * reading, parsing, or traversal is itself a doubt path and returns the
@@ -4154,22 +4162,73 @@ const readLockfileSides = (readLockfile) => {
 const assertDeclaredImporterRoots = (targets, sides) => {
 	for (const target of targets) for (const root of target.importers) if (!sides.some((lockfile) => Object.keys(lockfile.importers).some((importerPath) => importerMatchesTarget(importerPath, [root])))) throw new ImpactStampConfigError(`impact target "${target.name}" declares importer root "${root}", but no importer under that root exists in pnpm-lock.yaml on either side of the delta; fix the profile's impact.targets declaration`);
 };
-const computeImpactStampOrThrow = ({ changedFiles, readLockfile }, targets) => {
+const assertDeclaredPathGlobs = (targets) => {
+	for (const target of targets) for (const pattern of target.paths ?? []) if (!isValidRepoRelativeGlob(pattern)) throw new ImpactStampConfigError(`impact target "${target.name}" declares invalid repo-relative path glob "${pattern}"; fix the profile's impact.targets declaration`);
+};
+const analyzeSourcePaths = (sourceFiles, targets, profilePath) => {
+	for (const file of sourceFiles) {
+		if (!isRepoRelativePath(file)) return {
+			kind: "conservative",
+			reason: `changed source path "${file}" is not a valid repo-relative path; fail closed to full impact`
+		};
+		if (file === profilePath) return {
+			kind: "conservative",
+			reason: `changed source path "${file}" is the impact profile being evaluated; fail closed to full impact`
+		};
+		if (!targets.some((target) => matchesAnyGlob(target.paths ?? [], file))) return {
+			kind: "conservative",
+			reason: `changed source path "${file}" has no declared impact target owner; fail closed to full impact`
+		};
+	}
+	return {
+		kind: "ok",
+		targets: targets.map((target) => {
+			const matched = sourceFiles.find((file) => matchesAnyGlob(target.paths ?? [], file));
+			return matched === void 0 ? {
+				basis: "no changed source path matches this target's declared paths",
+				impact: "not-affected",
+				name: target.name
+			} : {
+				basis: `changed source path "${matched}" matches this target's declared paths`,
+				impact: "affected",
+				name: target.name
+			};
+		})
+	};
+};
+const unionTargetImpact = (source, lockfile) => {
+	if (source.impact === "affected") return source;
+	if (lockfile.impact === "affected") return lockfile;
+	return {
+		basis: `${source.basis}; ${lockfile.basis}`,
+		impact: "not-affected",
+		name: source.name
+	};
+};
+const computeImpactStampOrThrow = ({ changedFiles, profilePath = "software-factory.profile.json", readLockfile }, targets) => {
 	if (targets.length === 0) return {
 		basis: "conservative",
 		reasons: ["no impact targets declared in the profile; every surface keeps full demand"],
-		stampVersion: 1,
+		stampVersion: 2,
 		targets: []
 	};
+	assertDeclaredPathGlobs(targets);
 	const sides = readLockfileSides(readLockfile);
 	if (sides.kind === "ok") assertDeclaredImporterRoots(targets, sides.parsed);
 	if (changedFiles.length === 0) return conservativeStamp(targets, ["no changed files detected; full impact assumed"]);
-	const unmodelledFiles = changedFiles.filter((file) => file !== LOCKFILE_PATH);
-	if (unmodelledFiles.length > 0) return conservativeStamp(targets, [`changed files outside the lockfile classifier's model (${unmodelledFiles.toSorted().join(", ")}); full impact assumed`]);
+	const sourceFiles = changedFiles.filter((file) => file !== LOCKFILE_PATH);
+	const source = analyzeSourcePaths(sourceFiles, targets, profilePath);
+	if (source.kind === "conservative") return conservativeStamp(targets, [source.reason]);
 	if (sides.kind === "threw") throw sides.error;
 	if (sides.kind === "unreadable") return conservativeStamp(targets, [`pnpm-lock.yaml is unreadable at the ${sides.side} side; fail closed to full impact`]);
 	if (sides.kind === "unparseable") return conservativeStamp(targets, [`pnpm-lock.yaml is unparseable or structurally malformed at the ${sides.side} side; fail closed to full impact`]);
 	if (sides.kind === "unsupported-version") return conservativeStamp(targets, [`pnpm-lock.yaml is not lockfileVersion ${SUPPORTED_LOCKFILE_VERSION}; only pnpm v9 lockfiles are modelled; fail closed to full impact`]);
+	if (!changedFiles.includes("pnpm-lock.yaml")) return {
+		basis: "target-scoped",
+		reasons: ["all changed source paths have declared target ownership; impact scoped by repo-relative path globs"],
+		stampVersion: 2,
+		targets: source.targets
+	};
 	const [baseLock, headLock] = sides.parsed;
 	if (stableStringify$1(nonGraphSections(baseLock)) !== stableStringify$1(nonGraphSections(headLock))) return conservativeStamp(targets, ["pnpm-lock.yaml delta touches sections outside importers/packages/snapshots (e.g. settings, overrides, patchedDependencies); fail closed to full impact"]);
 	const delta = {
@@ -4178,11 +4237,13 @@ const computeImpactStampOrThrow = ({ changedFiles, readLockfile }, targets) => {
 		changedSnapshots: changedSectionKeys(baseLock.snapshots, headLock.snapshots),
 		sides: [baseLock, headLock]
 	};
+	const lockfileTargets = targets.map((target) => targetImpactForLockfileDelta(target, delta));
+	const mixed = sourceFiles.length > 0;
 	return {
-		basis: "lockfile-scoped",
-		reasons: ["pnpm-lock.yaml is the only changed file; impact scoped by importer/snapshot graph analysis"],
-		stampVersion: 1,
-		targets: targets.map((target) => targetImpactForLockfileDelta(target, delta))
+		basis: "target-scoped",
+		reasons: mixed ? ["all changed source paths have declared target ownership and pnpm-lock.yaml is analyzable; impact is the union of path ownership and importer/snapshot graph analysis"] : ["pnpm-lock.yaml is the only changed file; impact scoped by importer/snapshot graph analysis"],
+		stampVersion: 2,
+		targets: mixed ? source.targets.map((sourceTarget, index) => unionTargetImpact(sourceTarget, lockfileTargets[index])) : lockfileTargets
 	};
 };
 //#endregion
@@ -4361,7 +4422,7 @@ const assertBatteryCompleteness = (proof, context) => {
 * so authorization is bound to the same identities the proof binds. The
 * predicate is the shared {@link impactStampScopeDecision}, not a second
 * reading of the stamp: an entry is authorized exactly when the stamp would
-* have released that target's command in the first place (lockfile-scoped
+* have released that target's command in the first place (target-scoped
 * basis, this build's stamp version, exactly one row for the target,
 * `not-affected`). A conservative stamp, an unknown version, a
 * self-contradictory stamp, an unclassified name, or an `affected` verdict all
@@ -8844,7 +8905,7 @@ const renderReport = (record) => {
 	return `${lines.join("\n")}\n`;
 };
 function createBoundaryCheckCommand(output, action) {
-	return new Command("boundary:check").description("Boundary readiness gate (T8): require a membership-fresh boundary-review proof at the declared closeout rung. Blocks closeout/enablement, never merge.").requiredOption("--epic <number>", "epic issue number carrying the factory-boundary manifest", positiveInteger("--epic")).option("--repo <owner/name>", "GitHub repository (default: resolved from --cwd)").option("--cwd <path>", "repository working directory", ".").option("--output <path>", "write an additional proof copy to this path").option("--json", "print the full proof record as JSON").action(withGateTiming({
+	return new Command("boundary:check").description("Boundary readiness gate (T8): require a membership-fresh boundary-review proof at the declared closeout rung. Blocks closeout/enablement, never merge.").requiredOption("--epic <number>", "epic issue number carrying the factory-boundary manifest", positiveInteger("--epic")).option("--repo <owner/name>", "GitHub repository (default: resolved from --cwd)").option("--cwd <path>", "repository working directory", ".").option("--output <path>", "write an additional proof copy to this path").option("--profile <path>", "path to the project profile JSON file").option("--json", "print the full proof record as JSON").action(withGateTiming({
 		gate: "boundary:check",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
 		stderr: output.stderr
@@ -8860,7 +8921,10 @@ function createBoundaryCheckCommand(output, action) {
 		if (!action) {
 			const [owner, name] = record.repo.split("/");
 			if (owner && name) {
-				const hqLaneBaseUrl = hqLaneRefBaseUrlFromProfile(tryLoadProjectProfile({ cwd: args.cwd })?.profile);
+				const hqLaneBaseUrl = hqLaneRefBaseUrlFromProfile(tryLoadProjectProfile({
+					cwd: args.cwd,
+					profilePath: options.profile
+				})?.profile);
 				try {
 					publishFactoryCheckSafely(createFactoryCheckPublisher(output), {
 						conclusion: record.status === "ready" ? "success" : "failure",
@@ -9547,6 +9611,8 @@ const buildRetroEnvelope = (input) => {
 const RETRO_ENVELOPE_LEDGER_DIR = ".factory-memory/retro-envelope";
 const safeEnvelopeName = (agentRunId) => agentRunId.replaceAll(/[^\w.-]/gu, "-").slice(0, 120);
 const retroEnvelopePath = (root, agentRunId) => path.join(root, RETRO_ENVELOPE_LEDGER_DIR, `${safeEnvelopeName(agentRunId)}.json`);
+const CLAUDE_CODE_SESSION_ID_ENV = "CLAUDE_CODE_SESSION_ID";
+const resolveNativeSessionId = (env) => normalizeSessionId(env[CLAUDE_CODE_SESSION_ID_ENV]);
 const splitRepo = (repo) => {
 	const [owner, name] = repo.split("/");
 	return {
@@ -9572,11 +9638,11 @@ const otherLedgersExist = (repoRoot) => {
 const buildAndPersistRetroEnvelope = (input) => {
 	const env = input.env ?? process.env;
 	const now = input.now ?? (() => /* @__PURE__ */ new Date());
-	const laneIdentity = resolveGateTimingAgentRunId(env);
+	const laneIdentity = resolveGateTimingAgentRunId(env) ?? resolveNativeSessionId(env);
 	const agentRunId = laneIdentity ?? `closeout-${safeEnvelopeName(input.epic)}`;
 	const ledgerPath = gateTimingLedgerPath(input.repoRoot, agentRunId);
 	const ledger = laneIdentity === void 0 ? [] : readGateTimingLedger(ledgerPath);
-	const claudeSessionId = discoverFactorySessionId(env);
+	const claudeSessionId = discoverFactorySessionId(env) ?? resolveNativeSessionId(env);
 	const dataGaps = [];
 	if (laneIdentity === void 0) dataGaps.push("agentRunId is synthetic (no lane run identity exported): keyed to the epic, ledger not folded.");
 	else if (!existsSync(ledgerPath) && otherLedgersExist(input.repoRoot)) dataGaps.push(`gates[] empty: no gate-timing ledger for agentRunId "${agentRunId}" although other lane ledgers exist under ${GATE_TIMING_LEDGER_DIR} — possible identity drift between ledger writes and closeout.`);
@@ -9855,6 +9921,7 @@ function createCloseoutCommand(output, dependencies = {}) {
 		});
 		const retro = buildRetroGate({
 			codexThreadIds: codexThreadIdsForCloseout(dependencies.env),
+			...dependencies.env === void 0 ? {} : { env: dependencies.env },
 			epic: options.epic,
 			...options.issue === void 0 ? {} : { issue: options.issue },
 			...options.pr === void 0 ? {} : { pr: options.pr },
@@ -11167,6 +11234,7 @@ function runPrVerify(args, dependencies = {}) {
 		impactStamp = computeImpactStamp({
 			changedFiles: files,
 			profile,
+			profilePath: relativeProfile,
 			readLockfile: (side) => readLockfileAtRef(cwd, side === "base" ? proofMergeBaseSha : headSha, path.resolve(cwd, LOCKFILE_PATH))
 		});
 	} catch (error) {

package/dist/schemas.d.ts

@@ -493,11 +493,11 @@ interface PrReadyProof {
  */
 declare const impactStampSchema: z.ZodObject<{
   basis: z.ZodEnum<{
-    "lockfile-scoped": "lockfile-scoped";
+    "target-scoped": "target-scoped";
     conservative: "conservative";
   }>;
   reasons: z.ZodArray<z.ZodString>;
-  stampVersion: z.ZodLiteral<1>;
+  stampVersion: z.ZodLiteral<2>;
   targets: z.ZodArray<z.ZodObject<{
     basis: z.ZodString;
     impact: z.ZodEnum<{
@@ -1362,11 +1362,11 @@ declare const prVerifyProofSchema: z.ZodObject<{
   headSha: z.ZodString;
   impactStamp: z.ZodOptional<z.ZodObject<{
     basis: z.ZodEnum<{
-      "lockfile-scoped": "lockfile-scoped";
+      "target-scoped": "target-scoped";
       conservative: "conservative";
     }>;
     reasons: z.ZodArray<z.ZodString>;
-    stampVersion: z.ZodLiteral<1>;
+    stampVersion: z.ZodLiteral<2>;
     targets: z.ZodArray<z.ZodObject<{
       basis: z.ZodString;
       impact: z.ZodEnum<{

package/dist/schemas.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import "yaml";
+import "picomatch";
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
 	"independent-model",
@@ -239,9 +240,9 @@ const impactStampTargetSchema = z.object({
 * input widened every target to full impact.
 */
 const impactStampSchema = z.object({
-	basis: z.enum(["lockfile-scoped", "conservative"]),
+	basis: z.enum(["target-scoped", "conservative"]),
 	reasons: z.array(z.string()),
-	stampVersion: z.literal(1),
+	stampVersion: z.literal(2),
 	targets: z.array(impactStampTargetSchema).superRefine((targets, context) => {
 		const names = targets.map((target) => target.name);
 		if (new Set(names).size !== names.length) context.addIssue({
@@ -267,7 +268,7 @@ const IMPACT_SCOPE_SURFACES = {
 * external proof demand (#542 wave 2), a verification-battery command, or a
 * preview (Alchemy) lifecycle stack (#430 wave 3).
 *
-* The only release path is a `lockfile-scoped` stamp of exactly this build's
+* The only release path is a `target-scoped` stamp of exactly this build's
 * stamp version whose target entry for exactly this name is provably
 * `not-affected`. Every other input — no trusted stamp, an unknown stamp
 * version, a conservative stamp, a name the stamp does not classify, or an
@@ -286,11 +287,11 @@ const impactStampScopeDecision = ({ stamp, surface, targetName }) => {
 		reason: `no trusted identity-bound impact stamp covers this candidate; ${floor}`,
 		scoped: false
 	};
-	if (stamp.stampVersion !== 1) return {
-		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 1; ${floor}`,
+	if (stamp.stampVersion !== 2) return {
+		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 2; ${floor}`,
 		scoped: false
 	};
-	if (stamp.basis !== "lockfile-scoped") return {
+	if (stamp.basis !== "target-scoped") return {
 		reason: `impact stamp is conservative (full impact assumed); ${floor}`,
 		scoped: false
 	};
@@ -435,7 +436,7 @@ const assertBatteryCompleteness = (proof, context) => {
 * so authorization is bound to the same identities the proof binds. The
 * predicate is the shared {@link impactStampScopeDecision}, not a second
 * reading of the stamp: an entry is authorized exactly when the stamp would
-* have released that target's command in the first place (lockfile-scoped
+* have released that target's command in the first place (target-scoped
 * basis, this build's stamp version, exactly one row for the target,
 * `not-affected`). A conservative stamp, an unknown version, a
 * self-contradictory stamp, an unclassified name, or an `affected` verdict all

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.0",
+  "version": "1.0.0-alpha.2",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {