@patronage/software-factory 1.0.0-alpha.13 → 1.0.0-alpha.15

package/dist/index.d.ts

@@ -1,8 +1,97 @@
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { Command } from "commander";
 import { z } from "zod";
-import { readFile } from "node:fs/promises";
 
+//#region src/review-rungs.d.ts
+declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
+type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
+declare namespace boundary_manifest_d_exports {
+  export { BOUNDARY_CLOSEOUT_DEFAULT_RUNG, BOUNDARY_MANIFEST_SCHEMA_VERSION, BoundaryManifest, BoundaryManifestExtraction, BoundaryManifestParse, FACTORY_BOUNDARY_FENCE_LANG, boundaryManifestSchema, closeoutRungFor, extractBoundaryManifestBlock, manifestContentHash, parseBoundaryManifest, rungMeetsMinimum, specContentHash };
+}
+declare const FACTORY_BOUNDARY_FENCE_LANG = "factory-boundary";
+declare const BOUNDARY_MANIFEST_SCHEMA_VERSION = 1;
+declare const BOUNDARY_CLOSEOUT_DEFAULT_RUNG: EvidenceReviewRung;
+declare const rungMeetsMinimum: (rung: EvidenceReviewRung, minimum: EvidenceReviewRung) => boolean;
+declare const boundaryManifestBaseSchema: z.ZodObject<{
+  boundary: z.ZodString;
+  closeout: z.ZodOptional<z.ZodObject<{
+    review: z.ZodEnum<{
+      oracle: "oracle";
+      "independent-model": "independent-model";
+      human: "human";
+    }>;
+  }, z.core.$loose>>;
+  declaredBy: z.ZodString;
+  integrationBranch: z.ZodOptional<z.ZodString>;
+  schemaVersion: z.ZodLiteral<1>;
+  topology: z.ZodEnum<{
+    flagged: "flagged";
+    "each-to-main": "each-to-main";
+    stacked: "stacked";
+    "each-to-epic": "each-to-epic";
+  }>;
+  waves: z.ZodArray<z.ZodObject<{
+    autoMerge: z.ZodOptional<z.ZodBoolean>;
+    issues: z.ZodArray<z.ZodNumber>;
+    name: z.ZodString;
+    review: z.ZodEnum<{
+      oracle: "oracle";
+      "independent-model": "independent-model";
+      human: "human";
+    }>;
+  }, z.core.$loose>>;
+}, z.core.$loose>;
+declare const boundaryManifestSchema: z.ZodObject<{
+  boundary: z.ZodString;
+  closeout: z.ZodOptional<z.ZodObject<{
+    review: z.ZodEnum<{
+      oracle: "oracle";
+      "independent-model": "independent-model";
+      human: "human";
+    }>;
+  }, z.core.$loose>>;
+  declaredBy: z.ZodString;
+  integrationBranch: z.ZodOptional<z.ZodString>;
+  schemaVersion: z.ZodLiteral<1>;
+  topology: z.ZodEnum<{
+    flagged: "flagged";
+    "each-to-main": "each-to-main";
+    stacked: "stacked";
+    "each-to-epic": "each-to-epic";
+  }>;
+  waves: z.ZodArray<z.ZodObject<{
+    autoMerge: z.ZodOptional<z.ZodBoolean>;
+    issues: z.ZodArray<z.ZodNumber>;
+    name: z.ZodString;
+    review: z.ZodEnum<{
+      oracle: "oracle";
+      "independent-model": "independent-model";
+      human: "human";
+    }>;
+  }, z.core.$loose>>;
+}, z.core.$loose>;
+type BoundaryManifest = z.infer<typeof boundaryManifestBaseSchema>;
+type BoundaryManifestExtraction = {
+  ok: true;
+  blockText: string;
+} | {
+  ok: false;
+  error: string;
+};
+declare const extractBoundaryManifestBlock: (issueBody: string) => BoundaryManifestExtraction;
+declare const manifestContentHash: (blockText: string) => string;
+declare const specContentHash: (issueBody: string) => string;
+type BoundaryManifestParse = {
+  ok: true;
+  manifest: BoundaryManifest;
+  manifestHash: string;
+} | {
+  ok: false;
+  error: string;
+};
+declare const parseBoundaryManifest: (issueBody: string) => BoundaryManifestParse;
+declare const closeoutRungFor: (manifest: BoundaryManifest) => EvidenceReviewRung;
+//#endregion
 //#region src/github-issue-comments.d.ts
 interface GithubIssueCommentApi {
   body: string;
@@ -127,6 +216,22 @@ declare const selectBoundaryReviewProof: (comments: GithubIssueComment[], bounda
 declare const boundaryReviewProofAuthorsSeen: (comments: GithubIssueComment[], boundary: string) => string[];
 declare const undispositionedBlockingFindings: (proof: BoundaryReviewProof) => string[];
 //#endregion
+//#region src/boundary-membership-graph.d.ts
+/** The boundary-manifest wave demand that applies to one pull request. */
+interface WaveReviewDemand {
+  autoMerge: boolean;
+  review: EvidenceReviewRung;
+  wave: string;
+}
+interface BoundaryPullRequestRef {
+  baseRefName?: string;
+  headRefOid?: string;
+  headRefName?: string;
+  mergeCommitOid?: string;
+  number: number;
+  state: "OPEN" | "CLOSED" | "MERGED";
+}
+//#endregion
 //#region src/hq-ingest-sink.d.ts
 interface HqIngestDependencies {
   /**
@@ -648,9 +753,7 @@ interface LoadUserConfigResult {
 //#endregion
 //#region src/github-check-runs.d.ts
 declare const FACTORY_CHECK_NAMES: {
-  readonly boundary: "patronage-factory/boundary";
   readonly "pr-ready": "patronage-factory/pr-ready";
-  readonly "pr-review": "patronage-factory/pr-review";
   readonly "pr-verify": "patronage-factory/pr-verify";
 };
 type FactoryCheckGate = keyof typeof FACTORY_CHECK_NAMES;
@@ -665,12 +768,6 @@ interface PublishFactoryCheckInput {
    * `hqLaneRefBaseUrlFromProfile` — the same source as the HQ gate sink.
    */
   hqLaneBaseUrl?: string;
-  /**
-   * Explicit issue/PR number for the HQ lane ref, used when the check run is not
-   * PR-scoped (e.g. an epic boundary check keyed by its epic issue). Falls back
-   * to `pr`, then to the checkout's PR, when omitted.
-   */
-  laneRefNumber?: number;
   owner: string;
   pr?: number;
   proof: unknown;
@@ -869,10 +966,6 @@ interface ReviewLadderPolicy {
 }
 declare const resolveReviewLadderPolicy: () => ReviewLadderPolicy;
 //#endregion
-//#region src/review-rungs.d.ts
-declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
-type EvidenceReviewRung = (typeof EVIDENCE_REVIEW_RUNGS)[number];
-//#endregion
 //#region src/review-ladder-ledger.d.ts
 type LadderCycleStage = "interior" | "gate";
 interface LadderCycleRef {
@@ -1156,9 +1249,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     mergeable: z.ZodString;
     requiredChecks: z.ZodEnum<{
       unknown: "unknown";
-      pending: "pending";
       passed: "passed";
       failed: "failed";
+      pending: "pending";
       none: "none";
     }>;
     reviewDecision: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -1189,15 +1282,15 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       unknown: "unknown";
       critical: "critical";
       high: "high";
-      low: "low";
       medium: "medium";
+      low: "low";
     }>>;
     highestOpenSeverity: z.ZodOptional<z.ZodEnum<{
       unknown: "unknown";
       critical: "critical";
       high: "high";
-      low: "low";
       medium: "medium";
+      low: "low";
     }>>;
     maxReviewCycles: z.ZodOptional<z.ZodNumber>;
     nonBlockingFindings: z.ZodNumber;
@@ -1225,8 +1318,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     }>;
     stage: z.ZodEnum<{
       gate: "gate";
-      interior: "interior";
       "interior-complete": "interior-complete";
+      interior: "interior";
     }>;
   }, z.core.$strip>>;
   reviewRuns: z.ZodOptional<z.ZodArray<z.ZodType<PrReviewResult, unknown, z.core.$ZodTypeInternals<PrReviewResult, unknown>>>>;
@@ -1241,9 +1334,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
+        stale: "stale";
         blocked: "blocked";
         "not-required": "not-required";
-        stale: "stale";
         current: "current";
         missing: "missing";
       }>;
@@ -1253,9 +1346,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
+        stale: "stale";
         blocked: "blocked";
         "not-required": "not-required";
-        stale: "stale";
         current: "current";
         missing: "missing";
       }>;
@@ -1770,9 +1863,9 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
+  stale: "stale";
   blocked: "blocked";
   "not-required": "not-required";
-  stale: "stale";
   current: "current";
   missing: "missing";
 }>;
@@ -1871,17 +1964,8 @@ declare const validatePrReviewResult: (value: unknown) => PrReviewResult;
 declare const validatePrReviewProof: (value: unknown) => PrReviewProof;
 declare const readPrReviewProof: (filePath: string) => PrReviewProof;
 declare const PR_REVIEW_PROOF_DESCRIPTOR: ProofDescriptor<PrReviewProof>;
-declare namespace verification_proof_d_exports {
-  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
-}
-interface VerifiedHeadShas {
-  docsOnlyVerifiedHeadShas: string[];
-  trivialVerifiedHeadShas: string[];
-  verifiedHeadShas: string[];
-}
-type VerificationHeadShas = {
-  explicitFailure: true;
-} | VerifiedHeadShas;
+//#endregion
+//#region src/pr-verify-proof-contract.d.ts
 declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
 type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
 interface PrVerifyCommandResult {
@@ -1959,317 +2043,6 @@ interface PrVerifyProof {
 }
 type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
 declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
-declare function readPrVerifyProof(filePath: string): PrVerifyProof;
-declare const verifyProofPassed: (proof: PrVerifyProof) => boolean;
-declare const prVerifyProofHeadShas: (proof: PrVerifyProof | undefined, creditedHeadSha?: string) => VerifiedHeadShas;
-declare const verifyProofIdentityMatches: ({
-  currentIdentity,
-  proof
-}: {
-  currentIdentity?: {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  proof?: PrVerifyProof;
-}) => boolean;
-/**
- * Wave-2 consumption (#542): the recorded impact stamp, released for demand
- * resolution ONLY when it is identity-bound to the current candidate — the
- * proof passed, and its recorded headSha AND patchId both name exactly this
- * candidate (the same identities the proof already binds). Everything else —
- * no proof, an aborted run, a stale head, a moved patch id, a pre-stamp proof
- * — returns `undefined`, and the consumer keeps today's full-demand floor.
- *
- * Deliberately stricter than verify-once applicability (which tolerates a
- * head-only or patch-id-only match): a stamp narrows external demands, so it
- * is trusted only on an exact double binding, fail closed.
- */
-declare const trustedImpactStamp: ({
-  candidate,
-  proof
-}: {
-  candidate: {
-    headSha: string;
-    patchId: string;
-  };
-  proof: PrVerifyProof | undefined;
-}) => ImpactStamp | undefined;
-declare const prVerifyFullHeadShasForDiff: ({
-  docsOnlyDeltaAcceptedSince,
-  files,
-  proof
-}: {
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  files: string[];
-  proof: PrVerifyProof;
-}) => string[];
-type VerificationProofState = {
-  kind: "typed-aborted";
-  proof: PrVerifyProof;
-} | {
-  kind: "typed-missing";
-  path: string;
-  reason: "enoent" | "invalid";
-  message?: string;
-} | {
-  kind: "typed";
-  headShas: VerifiedHeadShas;
-  proof: PrVerifyProof;
-} | {
-  kind: "typed-diff-mismatch";
-  mode: ResolvedPrVerifyMode;
-};
-declare const verificationProofStateFor: ({
-  proof,
-  proofMatchesCurrentDiff,
-  proofPath
-}: {
-  proof?: PrVerifyProof;
-  proofMatchesCurrentDiff?: boolean;
-  proofPath?: string;
-}) => VerificationProofState;
-declare const verificationProofApplicabilityFor: ({
-  docsOnlyDeltaAcceptedSince,
-  explicitProof,
-  files,
-  headSha,
-  currentIdentity,
-  proof,
-  proofPath,
-  proofReadError
-}: {
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  explicitProof: boolean;
-  files: string[];
-  headSha: string;
-  currentIdentity?: {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  proof?: PrVerifyProof;
-  proofPath?: string;
-  proofReadError?: unknown;
-}) => {
-  fullVerifiedHeadShas: never[];
-  verificationProof: VerificationProofState;
-} | {
-  fullVerifiedHeadShas: string[];
-  verificationProof: {
-    headShas: VerifiedHeadShas;
-    kind: "typed";
-    proof: PrVerifyProof;
-  };
-};
-declare const resolveVerifyProofApplicability: ({
-  proofPath,
-  explicitProof,
-  docsOnlyDeltaAcceptedSince,
-  files,
-  headSha,
-  currentVerifyIdentityForBase,
-  preread
-}: {
-  proofPath: string;
-  explicitProof: boolean;
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  files: string[];
-  headSha: string;
-  currentVerifyIdentityForBase?: (base: string) => {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  preread?: {
-    proof?: PrVerifyProof;
-    error?: unknown;
-  };
-}) => {
-  fullVerifiedHeadShas: never[];
-  verificationProof: VerificationProofState;
-} | {
-  fullVerifiedHeadShas: string[];
-  verificationProof: {
-    headShas: VerifiedHeadShas;
-    kind: "typed";
-    proof: PrVerifyProof;
-  };
-};
-declare const verificationProofForReadiness: (state: VerificationProofState) => VerificationHeadShas;
-declare const verificationProofBlockingReason: (state: VerificationProofState) => string | undefined;
-//#endregion
-//#region src/retro-envelope.d.ts
-/**
- * Versioned retro envelope schema (epic #27 wave 2, issue #34).
- *
- * One envelope per lane, built at `factory:closeout` and delivered through the
- * typed gate-sink as the `retro-envelope` ingest kind. Re-derived in TypeScript
- * from the `spike/telemetry-layer2` S5 scratch schema (reference-only, never
- * merged). This module is the single source of truth for the v1 wire shape
- * and its bounds ({@link RETRO_ENVELOPE_WIRE_BOUNDS}) — producer and consumer
- * alike. HQ imports these exports directly from the Worker-safe
- * `@patronage/software-factory/schemas` subpath
- * (`software-factory-hq/src/contracts/retro-schemas.ts`) instead of
- * maintaining a parallel hand-written copy, so there is exactly one wire
- * contract and no drift-detection machinery is needed (issue #350; formerly
- * a hand-written twin plus a 767-line parity test, #46).
- *
- * DESIGN INVARIANT: cross-family token sums must be UNREPRESENTABLE.
- *
- * The two model families use different tokenizers, prices, and accounting
- * conventions, so any token total that spans Claude and GPT is a lie:
- *
- * 1. There is no combined/total token field anywhere in the envelope.
- * 2. `tokenFamilies` is strict — its only keys are `claude` and `gpt`; data
- *    cannot smuggle in a third "all"/"combined" slot.
- * 3. The family BLOCKS are structurally different shapes with DIFFERENT keys
- *    (claude is a single flat block keyed on freshInput/cacheReadInput/
- *    cacheCreationInput; gpt is `{ roles: [...] }`). The exclusive input-tier
- *    COUNTS share no key name across families. The residual names shared
- *    between the claude block and a gpt ROLE entry are pinned to exactly
- *    {costUsd, model, output} (PR #32 advisory): `costUsd` is deliberate —
- *    USD is the one cross-family summable unit (rule 4); `model` is an
- *    unsummable label; `output` is the same name at DIFFERENT depths (lane
- *    block vs per-role entry), frozen by a tripwire test in
- *    `retro-envelope.test.ts` so the overlap cannot grow. Renaming `output`
- *    is a schemaVersion-2 wire change, deliberately not spent in v1.
- * 4. Cost is per-family USD and nullable. Combined totals are allowed in USD
- *    only, and only as a projection-time sum of per-family USD.
- *
- * Field names also encode the S2/S3 reader lessons: Claude `freshInput` alone
- * is not prompt size (true input context = freshInput + cacheReadInput +
- * cacheCreationInput, requestId-deduped), and codex `inputInclusiveOfCache`
- * already includes `cachedInput`, so `freshInputDerived` (inclusive − cached)
- * is the only value safe to feed a per-token pricer.
- *
- * COMPLETENESS POSTURE: harvest may have no usable native log for a lane, so
- * `tokenFamilies` may legitimately be absent. The closeout build gate demands
- * a valid envelope, not available telemetry. A families-absent envelope keeps
- * its operator-visible data gaps and is a replayable advisory HQ event, so it
- * never substitutes unavailable usage with zero. The wire shape (field names,
- * types, structure) stays byte-parity with HQ v1.
- */
-declare const RETRO_ENVELOPE_SCHEMA_VERSION = 1;
-declare const retroEnvelopeV1Schema: z.ZodObject<{
-  agentRunId: z.ZodString;
-  archiveRef: z.ZodOptional<z.ZodString>;
-  cycles: z.ZodObject<{
-    gateRunsToFirstGreen: z.ZodNumber;
-    reviewerFixRounds: z.ZodNumber;
-    thermoFixRounds: z.ZodNumber;
-  }, z.core.$strict>;
-  dataGaps: z.ZodDefault<z.ZodArray<z.ZodString>>;
-  gates: z.ZodArray<z.ZodObject<{
-    cycle: z.ZodNumber;
-    duration: z.ZodNumber;
-    gate: z.ZodString;
-    outcome: z.ZodEnum<{
-      pass: "pass";
-      fail: "fail";
-      skip: "skip";
-    }>;
-    startedAt: z.ZodISODateTime;
-  }, z.core.$strict>>;
-  generatedAt: z.ZodISODateTime;
-  interventions: z.ZodObject<{
-    count: z.ZodNumber;
-  }, z.core.$strict>;
-  joinKeys: z.ZodObject<{
-    claudeSessionIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    codexThreadIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
-  }, z.core.$strict>;
-  kind: z.ZodLiteral<"retro-envelope">;
-  outcome: z.ZodOptional<z.ZodObject<{
-    status: z.ZodEnum<{
-      success: "success";
-      fail: "fail";
-      blocked: "blocked";
-      "ship-with-followups": "ship-with-followups";
-    }>;
-    verdict: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>>;
-  phases: z.ZodArray<z.ZodObject<{
-    at: z.ZodISODateTime;
-    deltaSec: z.ZodOptional<z.ZodNumber>;
-    name: z.ZodString;
-  }, z.core.$strict>>;
-  refs: z.ZodObject<{
-    branch: z.ZodOptional<z.ZodString>;
-    epic: z.ZodOptional<z.ZodString>;
-    headSha: z.ZodOptional<z.ZodString>;
-    issue: z.ZodOptional<z.ZodString>;
-    prNumber: z.ZodOptional<z.ZodNumber>;
-  }, z.core.$strict>;
-  repo: z.ZodObject<{
-    name: z.ZodString;
-    owner: z.ZodString;
-  }, z.core.$strict>;
-  schemaVersion: z.ZodLiteral<1>;
-  tokenFamilies: z.ZodObject<{
-    claude: z.ZodOptional<z.ZodObject<{
-      cacheCreationInput: z.ZodNumber;
-      cacheReadInput: z.ZodNumber;
-      costUsd: z.ZodNullable<z.ZodNumber>;
-      family: z.ZodLiteral<"claude">;
-      freshInput: z.ZodNumber;
-      model: z.ZodString;
-      output: z.ZodNumber;
-      requests: z.ZodNumber;
-    }, z.core.$strict>>;
-    gpt: z.ZodOptional<z.ZodObject<{
-      family: z.ZodLiteral<"gpt">;
-      roles: z.ZodArray<z.ZodObject<{
-        cachedInput: z.ZodNumber;
-        costUsd: z.ZodNullable<z.ZodNumber>;
-        freshInputDerived: z.ZodNumber;
-        inputInclusiveOfCache: z.ZodNumber;
-        model: z.ZodString;
-        output: z.ZodNumber;
-        reasoningOutput: z.ZodNumber;
-        role: z.ZodString;
-        threadId: z.ZodOptional<z.ZodString>;
-      }, z.core.$strict>>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>;
-  wallClock: z.ZodObject<{
-    endTs: z.ZodISODateTime;
-    startTs: z.ZodISODateTime;
-    totalSec: z.ZodNumber;
-  }, z.core.$strict>;
-}, z.core.$strict>;
-type RetroEnvelope = z.infer<typeof retroEnvelopeV1Schema>;
-/**
- * Versioned payload validators, keyed by schema major. Unknown majors never
- * reach these — {@link parseRetroEnvelope} returns them raw and marked
- * degraded, mirroring HQ's ingest skew posture (stored raw, never dropped).
- */
-declare const RETRO_ENVELOPE_VALIDATORS: Record<number, z.ZodType<RetroEnvelope, unknown>>;
-declare const SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS: readonly number[];
-/** The `schemaVersion` a candidate declares, or undefined when unreadable. */
-declare const retroEnvelopeSchemaVersionOf: (candidate: unknown) => number | undefined;
-type ParsedRetroEnvelope = {
-  disposition: "trusted";
-  envelope: RetroEnvelope;
-  schemaVersion: number;
-} | {
-  disposition: "degraded";
-  raw: unknown;
-  schemaVersion: number | undefined;
-};
-/**
- * Parses a candidate against the versioned validators. A recognized major is
- * validated typed-only (throws on an invalid known-version payload); an unknown
- * major is round-tripped RAW and marked degraded — the retained payload is the
- * exact input object, never a coerced projection. Mirrors the HQ ingest seam so
- * the two sides agree on the skew posture.
- */
-declare const parseRetroEnvelope: (candidate: unknown) => ParsedRetroEnvelope;
-/**
- * Whether harvest recorded at least one token family. This is an operator
- * summary predicate, not a delivery gate: a families-absent envelope remains
- * valid and replayable when its data gaps explain why telemetry is unavailable.
- */
-declare const isRetroEnvelopeWireComplete: (envelope: Pick<RetroEnvelope, "tokenFamilies">) => boolean;
-/** Epic anchor for an envelope: refs.epic, else refs.issue, else the PR. */
-declare const retroEpicReference: (refs: RetroEnvelope["refs"]) => string | undefined;
 //#endregion
 //#region src/schemas.d.ts
 declare const boundaryCheckProofSchema: z.ZodObject<{
@@ -2277,7 +2050,7 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
   boundary: z.ZodOptional<z.ZodString>;
   command: z.ZodLiteral<"patronage-factory boundary:check">;
   coveredSet: z.ZodArray<z.ZodObject<{
-    issue: z.ZodOptional<z.ZodNumber>;
+    issue: z.ZodNumber;
     pr: z.ZodNumber;
     sha: z.ZodString;
     state: z.ZodEnum<{
@@ -2327,19 +2100,11 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
 type BoundaryCheckProofRecord = z.infer<typeof boundaryCheckProofSchema>;
 //#endregion
 //#region src/boundary-check.d.ts
-interface BoundaryPullRequestRef {
-  baseRefName?: string;
-  headRefOid?: string;
-  headRefName?: string;
-  mergeCommitOid?: string;
-  number: number;
-  state: "OPEN" | "CLOSED" | "MERGED";
-}
 interface BoundaryCheckGithub {
   fetchIssueBody: (repo: string, issue: number) => string;
   fetchIssueComments: (repo: string, issue: number) => GithubIssueComment[];
   fetchClosingPullRequests: (repo: string, issue: number) => BoundaryPullRequestRef[];
-  fetchPullRequest: (repo: string, pr: number) => BoundaryPullRequestRef;
+  fetchPullRequest?: (repo: string, pr: number) => BoundaryPullRequestRef;
 }
 interface BoundaryCheckArgs {
   cwd?: string;
@@ -2404,32 +2169,6 @@ declare const runDemandWaive: (args: DemandWaiveArgs, dependencies?: DemandWaive
 //#region src/commands/demand-waive.d.ts
 type DemandWaiveAction = (args: DemandWaiveArgs) => DemandWaiver;
 //#endregion
-//#region src/hq-credentials.d.ts
-/**
- * Why a reference did not resolve. Each value names a different remedy, and
- * none of them can be inferred from a value-or-nothing result:
- *
- * - `resolver-missing` — no secret-manager binary on PATH.
- * - `resolver-blocked` — a binary exists but this session may not execute it
- *   (a sandbox denying exec). The command belongs outside the sandbox.
- * - `resolver-timeout` — the probe expired: a desktop agent waiting on an
- *   approval nobody can give here.
- * - `resolver-refused` — the binary ran and produced no value. Its store is
- *   unreachable from this session (a sandbox with no keychain access) or the
- *   reference is not readable. These two stay one status on purpose: telling
- *   them apart would mean reading resolver output.
- */
-type SecretResolutionFailure = "resolver-blocked" | "resolver-missing" | "resolver-refused" | "resolver-timeout";
-/** A structured resolution outcome. The value travels only when resolved. */
-type SecretResolution = {
-  status: "resolved";
-  value: string;
-} | {
-  status: SecretResolutionFailure;
-};
-/** Resolves a secret reference. Injected so tests stay offline. */
-type SecretReferenceResolver = (reference: string) => SecretResolution;
-//#endregion
 //#region src/hq-flush.d.ts
 /**
  * Spool locations this run did not drain because they sit under an earlier
@@ -2474,9 +2213,155 @@ interface PrReviewGitDependencies {
 interface PrReviewDependencies {
   git?: PrReviewGitDependencies;
   hq?: HqIngestDependencies;
-  publishCheckRun?: (input: PublishFactoryCheckInput) => void;
 }
 declare function runPrReview(args: PrReviewArgs, dependencies?: PrReviewDependencies): Promise<PrReviewProof>;
+declare namespace verification_proof_d_exports {
+  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
+}
+interface VerifiedHeadShas {
+  docsOnlyVerifiedHeadShas: string[];
+  trivialVerifiedHeadShas: string[];
+  verifiedHeadShas: string[];
+}
+type VerificationHeadShas = {
+  explicitFailure: true;
+} | VerifiedHeadShas;
+declare function readPrVerifyProof(filePath: string): PrVerifyProof;
+declare const verifyProofPassed: (proof: PrVerifyProof) => boolean;
+declare const prVerifyProofHeadShas: (proof: PrVerifyProof | undefined, creditedHeadSha?: string) => VerifiedHeadShas;
+declare const verifyProofIdentityMatches: ({
+  currentIdentity,
+  proof
+}: {
+  currentIdentity?: {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  proof?: PrVerifyProof;
+}) => boolean;
+/**
+ * Wave-2 consumption (#542): the recorded impact stamp, released for demand
+ * resolution ONLY when it is identity-bound to the current candidate — the
+ * proof passed, and its recorded headSha AND patchId both name exactly this
+ * candidate (the same identities the proof already binds). Everything else —
+ * no proof, an aborted run, a stale head, a moved patch id, a pre-stamp proof
+ * — returns `undefined`, and the consumer keeps today's full-demand floor.
+ *
+ * Deliberately stricter than verify-once applicability (which tolerates a
+ * head-only or patch-id-only match): a stamp narrows external demands, so it
+ * is trusted only on an exact double binding, fail closed.
+ */
+declare const trustedImpactStamp: ({
+  candidate,
+  proof
+}: {
+  candidate: {
+    headSha: string;
+    patchId: string;
+  };
+  proof: PrVerifyProof | undefined;
+}) => ImpactStamp | undefined;
+declare const prVerifyFullHeadShasForDiff: ({
+  docsOnlyDeltaAcceptedSince,
+  files,
+  proof
+}: {
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  files: string[];
+  proof: PrVerifyProof;
+}) => string[];
+type VerificationProofState = {
+  kind: "typed-aborted";
+  proof: PrVerifyProof;
+} | {
+  kind: "typed-missing";
+  path: string;
+  reason: "enoent" | "invalid";
+  message?: string;
+} | {
+  kind: "typed";
+  headShas: VerifiedHeadShas;
+  proof: PrVerifyProof;
+} | {
+  kind: "typed-diff-mismatch";
+  mode: ResolvedPrVerifyMode;
+};
+declare const verificationProofStateFor: ({
+  proof,
+  proofMatchesCurrentDiff,
+  proofPath
+}: {
+  proof?: PrVerifyProof;
+  proofMatchesCurrentDiff?: boolean;
+  proofPath?: string;
+}) => VerificationProofState;
+declare const verificationProofApplicabilityFor: ({
+  docsOnlyDeltaAcceptedSince,
+  explicitProof,
+  files,
+  headSha,
+  currentIdentity,
+  proof,
+  proofPath,
+  proofReadError
+}: {
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  explicitProof: boolean;
+  files: string[];
+  headSha: string;
+  currentIdentity?: {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  proof?: PrVerifyProof;
+  proofPath?: string;
+  proofReadError?: unknown;
+}) => {
+  fullVerifiedHeadShas: never[];
+  verificationProof: VerificationProofState;
+} | {
+  fullVerifiedHeadShas: string[];
+  verificationProof: {
+    headShas: VerifiedHeadShas;
+    kind: "typed";
+    proof: PrVerifyProof;
+  };
+};
+declare const resolveVerifyProofApplicability: ({
+  proofPath,
+  explicitProof,
+  docsOnlyDeltaAcceptedSince,
+  files,
+  headSha,
+  currentVerifyIdentityForBase,
+  preread
+}: {
+  proofPath: string;
+  explicitProof: boolean;
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  files: string[];
+  headSha: string;
+  currentVerifyIdentityForBase?: (base: string) => {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  preread?: {
+    proof?: PrVerifyProof;
+    error?: unknown;
+  };
+}) => {
+  fullVerifiedHeadShas: never[];
+  verificationProof: VerificationProofState;
+} | {
+  fullVerifiedHeadShas: string[];
+  verificationProof: {
+    headShas: VerifiedHeadShas;
+    kind: "typed";
+    proof: PrVerifyProof;
+  };
+};
+declare const verificationProofForReadiness: (state: VerificationProofState) => VerificationHeadShas;
+declare const verificationProofBlockingReason: (state: VerificationProofState) => string | undefined;
 //#endregion
 //#region src/workspace-install-resolution.d.ts
 interface CleanInstallResolutionDependencies {
@@ -2769,11 +2654,11 @@ declare const LegacyWorkerCloseoutStatusTraceEventSchema: z.ZodObject<{
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
+    pending: "pending";
     unavailable: "unavailable";
     archived: "archived";
     skipped: "skipped";
     "not-applicable": "not-applicable";
-    pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
@@ -3164,11 +3049,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
+    pending: "pending";
     unavailable: "unavailable";
     archived: "archived";
     skipped: "skipped";
     "not-applicable": "not-applicable";
-    pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
@@ -3205,11 +3090,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   }, z.core.$strict>], "lessonStatus">;
   readonly 2: z.ZodObject<{
     archiveStatus: z.ZodOptional<z.ZodEnum<{
+      pending: "pending";
       unavailable: "unavailable";
       archived: "archived";
       skipped: "skipped";
       "not-applicable": "not-applicable";
-      pending: "pending";
     }>>;
     closeoutReason: z.ZodOptional<z.ZodString>;
     lessonStatus: z.ZodOptional<z.ZodEnum<{
@@ -3333,8 +3218,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
       high: "high";
-      low: "low";
       medium: "medium";
+      low: "low";
       xhigh: "xhigh";
     }>;
     engine: z.ZodString;
@@ -3412,8 +3297,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
       high: "high";
-      low: "low";
       medium: "medium";
+      low: "low";
       xhigh: "xhigh";
     }>;
     engine: z.ZodString;
@@ -3482,8 +3367,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     slotResolution: z.ZodObject<{
       effort: z.ZodEnum<{
         high: "high";
-        low: "low";
         medium: "medium";
+        low: "low";
         xhigh: "xhigh";
       }>;
       engine: z.ZodString;
@@ -3551,7 +3436,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   observedAt: string;
   purpose: "review" | "code";
   slotResolution: {
-    effort: "high" | "low" | "medium" | "xhigh";
+    effort: "high" | "medium" | "low" | "xhigh";
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
@@ -3693,74 +3578,6 @@ declare const scanFactoryTraceDiagnostics: ({
   repoRoot,
   to
 }: ScanFactoryTraceDiagnosticsOptions) => FactoryTraceDiagnostic[];
-//#endregion
-//#region src/interior-telemetry/gate-timing.d.ts
-declare const GATE_TIMING_SCHEMA_VERSION = 1;
-type FactoryGateName = "boundary:check" | "factory:closeout" | "pr:ready" | "pr:review" | "pr:verify";
-type GateTimingOutcome = "fail" | "pass";
-interface GateTimingRecord {
-  agentRunId: string;
-  cycle: number;
-  durationMs: number;
-  gate: FactoryGateName;
-  outcome: GateTimingOutcome;
-  schemaVersion: typeof GATE_TIMING_SCHEMA_VERSION;
-  startedAt: string;
-  startOffsetMs: number;
-}
-//#endregion
-//#region src/retro-envelope-builder.d.ts
-/**
- * Folds a lane's gate-timing ledger (`.factory-memory/gate-timing/<id>.jsonl`,
- * wave-1 PR #33) into a versioned retro envelope at `factory:closeout`.
- *
- * STRUCTURAL INVARIANT (#677 repeat-class rule; PR #35 review cycles 1-2):
- * telemetry CONTENT can never fail the closeout build gate. Every value that
- * reaches the envelope passes through one sanitization seam that makes the
- * output valid BY CONSTRUCTION:
- *
- * - strings are clamped to their wire bounds (truncated, with a data gap when
- *   truncation lost information);
- * - numbers must be finite and within plausibility bounds BEFORE any derived
- *   arithmetic; an absurd value (1e16 ms duration, year-9999 timestamp) SKIPS
- *   its record with a data gap rather than clamping, because clamping would
- *   assert a measurement that never happened;
- * - arrays are bounded to their schema maxima (gates[] keeps the most recent);
- * - derived computations (wall clock, cycles) consume only sanitized inputs,
- *   so no ledger content can push them outside Date/Number safe ranges.
- *
- * Terminal backstop: the assembled candidate goes through a final schema
- * parse; if that still fails, a minimal-valid envelope (clamped identity,
- * empty gates, a data gap naming the failure) is built and returned instead.
- * `buildRetroEnvelope` therefore never throws for content — the closeout gate
- * can only fail on filesystem errors when persisting.
- */
-interface BuildRetroEnvelopeInput {
-  agentRunId: string;
-  /** Optional pointer (key/URL) to #8's durable proof archive — never payload. */
-  archiveRef?: string;
-  dataGaps?: string[];
-  generatedAt: Date;
-  interventions?: number;
-  /** Per-family session identities the lane already records. */
-  joinKeys?: {
-    claudeSessionIds?: string[];
-    codexThreadIds?: string[];
-  };
-  /** The lane's gate-timing ledger records, in append order. */
-  ledger: GateTimingRecord[];
-  outcome?: RetroEnvelope["outcome"];
-  phases?: RetroEnvelope["phases"];
-  refs: RetroEnvelope["refs"];
-  repo: RetroEnvelope["repo"];
-  /**
-   * Token families. They may be absent when native session data is unavailable
-   * (valid does not imply available telemetry). When present they satisfy the
-   * family invariants.
-   */
-  tokenFamilies?: RetroEnvelope["tokenFamilies"];
-}
-declare const buildRetroEnvelope: (input: BuildRetroEnvelopeInput) => RetroEnvelope;
 declare namespace comment_provenance_d_exports {
   export { SHA_MATCH_MIN_LENGTH, isBotLogin, sameHeadSha };
 }
@@ -3770,18 +3587,12 @@ declare const sameHeadSha: (left: string, right: string) => boolean;
 //#endregion
 //#region src/doctor-hq-checks.d.ts
 /**
- * Two `doctor` checks that make silent HQ delivery failure loud (#394,
- * epic #389 wave 2).
- *
- * Both consume #414's structured credential resolution rather than inventing
- * a second classification: a sandboxed session that cannot reach the
- * keychain is reported as "cannot resolve credentials here", never as
- * "credentials are wrong" or a silent pass. Both name `psf hq:flush` and
- * `psf pr:publish` as the commands that need a trusted local session.
+ * The `doctor` check that makes silent HQ delivery failure loud (#394,
+ * epic #389 wave 2): the local spool is empty, and no stranded evidence is
+ * waiting under the spool root.
  *
- * Advisory stays advisory: neither check can block anything but doctor's own
- * exit status (epic #389 design decision 4). Absent credentials make the
- * remote check a skip with a printed reason, never a silent pass.
+ * Advisory stays advisory: this check can block nothing but doctor's own exit
+ * status (epic #389 design decision 4).
  */
 type DoctorCheckStatus = "error" | "ok" | "warning";
 interface DoctorCheck {
@@ -3793,12 +3604,6 @@ interface HqSpoolCheckDependencies {
   countSpool?: typeof countHqSpoolWork;
   sweepOrphans?: typeof sweepHqSpoolOrphans;
 }
-interface HqRetroReadbackCheckDependencies {
-  fetch?: typeof fetch;
-  readFile?: typeof readFile;
-  resolve?: SecretReferenceResolver;
-  timeoutMs?: number;
-}
 //#endregion
 //#region src/doctor.d.ts
 interface DoctorReport {
@@ -3817,8 +3622,6 @@ interface DoctorProjectProfileInput extends LoadProjectProfileInput {
   base?: string;
   env?: NodeJS.ProcessEnv;
   /** Test seam for the local HQ spool check (#394); production never sets this. */
-  hqRetroReadbackDependencies?: HqRetroReadbackCheckDependencies;
-  /** Test seam for the remote HQ retro-envelope read-back check (#394). */
   hqSpoolDependencies?: HqSpoolCheckDependencies;
   /**
    * Append the read-only admission checklist (#292): every requirement this
@@ -3907,102 +3710,6 @@ declare const renderPrBodySections: ({
   reviewProof?: PrReviewProof;
   verifyProof?: PrVerifyProof;
 }) => string;
-declare namespace boundary_manifest_d_exports {
-  export { BOUNDARY_CLOSEOUT_DEFAULT_RUNG, BOUNDARY_MANIFEST_SCHEMA_VERSION, BoundaryManifest, BoundaryManifestExtraction, BoundaryManifestParse, FACTORY_BOUNDARY_FENCE_LANG, boundaryManifestSchema, closeoutRungFor, extractBoundaryManifestBlock, manifestContentHash, parseBoundaryManifest, rungMeetsMinimum, specContentHash };
-}
-declare const FACTORY_BOUNDARY_FENCE_LANG = "factory-boundary";
-declare const BOUNDARY_MANIFEST_SCHEMA_VERSION = 1;
-declare const BOUNDARY_CLOSEOUT_DEFAULT_RUNG: EvidenceReviewRung;
-declare const rungMeetsMinimum: (rung: EvidenceReviewRung, minimum: EvidenceReviewRung) => boolean;
-declare const boundaryManifestBaseSchema: z.ZodObject<{
-  boundary: z.ZodString;
-  closeout: z.ZodOptional<z.ZodObject<{
-    review: z.ZodEnum<{
-      oracle: "oracle";
-      "independent-model": "independent-model";
-      human: "human";
-    }>;
-  }, z.core.$loose>>;
-  declaredBy: z.ZodString;
-  integrationBranch: z.ZodOptional<z.ZodString>;
-  prs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  schemaVersion: z.ZodLiteral<1>;
-  topology: z.ZodEnum<{
-    flagged: "flagged";
-    "each-to-main": "each-to-main";
-    stacked: "stacked";
-    "each-to-epic": "each-to-epic";
-  }>;
-  waves: z.ZodArray<z.ZodObject<{
-    autoMerge: z.ZodOptional<z.ZodBoolean>;
-    issues: z.ZodArray<z.ZodNumber>;
-    name: z.ZodString;
-    review: z.ZodEnum<{
-      oracle: "oracle";
-      "independent-model": "independent-model";
-      human: "human";
-    }>;
-  }, z.core.$loose>>;
-}, z.core.$loose>;
-declare const boundaryManifestSchema: z.ZodObject<{
-  boundary: z.ZodString;
-  closeout: z.ZodOptional<z.ZodObject<{
-    review: z.ZodEnum<{
-      oracle: "oracle";
-      "independent-model": "independent-model";
-      human: "human";
-    }>;
-  }, z.core.$loose>>;
-  declaredBy: z.ZodString;
-  integrationBranch: z.ZodOptional<z.ZodString>;
-  prs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  schemaVersion: z.ZodLiteral<1>;
-  topology: z.ZodEnum<{
-    flagged: "flagged";
-    "each-to-main": "each-to-main";
-    stacked: "stacked";
-    "each-to-epic": "each-to-epic";
-  }>;
-  waves: z.ZodArray<z.ZodObject<{
-    autoMerge: z.ZodOptional<z.ZodBoolean>;
-    issues: z.ZodArray<z.ZodNumber>;
-    name: z.ZodString;
-    review: z.ZodEnum<{
-      oracle: "oracle";
-      "independent-model": "independent-model";
-      human: "human";
-    }>;
-  }, z.core.$loose>>;
-}, z.core.$loose>;
-type BoundaryManifest = z.infer<typeof boundaryManifestBaseSchema>;
-type BoundaryManifestExtraction = {
-  ok: true;
-  blockText: string;
-} | {
-  ok: false;
-  error: string;
-};
-declare const extractBoundaryManifestBlock: (issueBody: string) => BoundaryManifestExtraction;
-declare const manifestContentHash: (blockText: string) => string;
-declare const specContentHash: (issueBody: string) => string;
-type BoundaryManifestParse = {
-  ok: true;
-  manifest: BoundaryManifest;
-  manifestHash: string;
-} | {
-  ok: false;
-  error: string;
-};
-declare const parseBoundaryManifest: (issueBody: string) => BoundaryManifestParse;
-declare const closeoutRungFor: (manifest: BoundaryManifest) => EvidenceReviewRung;
-//#endregion
-//#region src/demand-resolution.d.ts
-/** The boundary-manifest wave demand that applies to one pull request. */
-interface WaveReviewDemand {
-  autoMerge: boolean;
-  review: EvidenceReviewRung;
-  wave: string;
-}
 declare namespace readiness_evaluation_d_exports {
   export { CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON, DRAFT_BLOCKER_REASON, EvaluationInput, ManagedReadinessLedger, PENDING_CHECKS_BLOCKER_REASON_PREFIX, READINESS_REPAIR_CODES, ReadinessRepair, ReadinessStatus, SCHEMA_VERSION, SECURITY_UNTYPED_REVIEW_BLOCKER_REASON, evaluateReadiness, managedReadinessLedgerSchema, readinessExitCode, readinessRepairSchema, validateManagedReadinessLedger };
 }
@@ -4059,7 +3766,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       draft: boolean;
       mergeStateStatus: string;
       mergeable: string;
-      requiredChecks: "unknown" | "pending" | "passed" | "failed" | "none";
+      requiredChecks: "unknown" | "passed" | "failed" | "pending" | "none";
       unresolvedReviewThreads: number;
       reviewDecision?: string | null | undefined;
     };
@@ -4074,13 +3781,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
+        status: "stale" | "blocked" | "not-required" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "not-required" | "stale" | "current" | "missing";
+        status: "stale" | "blocked" | "not-required" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -4119,8 +3826,8 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       nonBlockingFindings: number;
       openFindings: number;
       windowExhausted: boolean;
-      highestBlockingSeverity?: "unknown" | "critical" | "high" | "low" | "medium" | undefined;
-      highestOpenSeverity?: "unknown" | "critical" | "high" | "low" | "medium" | undefined;
+      highestBlockingSeverity?: "unknown" | "critical" | "high" | "medium" | "low" | undefined;
+      highestOpenSeverity?: "unknown" | "critical" | "high" | "medium" | "low" | undefined;
       maxReviewCycles?: number | undefined;
       reviewCycle?: number | undefined;
       staleRepeatFindings?: number | undefined;
@@ -4131,7 +3838,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "gate" | "interior" | "interior-complete";
+      stage: "gate" | "interior-complete" | "interior";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;
@@ -4652,4 +4359,4 @@ interface CreateProgramOptions {
 declare function createProgram(options?: CreateProgramOptions): Command;
 declare function run(argv?: string[]): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type BuildRetroEnvelopeInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type ParsedRetroEnvelope, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, REVIEW_FOCUS_SECTION, type RetroEnvelope, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildRetroEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, isRetroEnvelopeWireComplete, loadProjectProfile, normalizeIssueComments, openLadderFindings, parseRetroEnvelope, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, retroEnvelopeSchemaVersionOf, retroEnvelopeV1Schema, retroEpicReference, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };