@patronage/software-factory 1.0.0-alpha.15 → 1.0.0-alpha.16

package/README.md

@@ -64,6 +64,8 @@ The repository profile declares its admission policy. Operator-local settings an
 
 Generated production workflows may call `psf production:impact --before <sha> --after <sha> --github-output <path>`. The command recomputes the profile's opt-in impact subscriptions from those exact real commits and emits stable demanded/withdrawn target outputs, the changed-file decision basis, and unsubscribed paths. It only withdraws work: missing, zero, malformed, unreachable, non-ancestral, or otherwise unclassifiable identities leave every known target demanded. The factory owns this decision seam; each consumer owns its deploy jobs, commands, credentials, topology, and post-deploy convergence/no-op proof. Merge-target Verify remains full and does not consult this command.
 
+Generated pull-request workflows may call `psf candidate:impact --base <sha> --head <sha> --github-output <path>` to route Candidate verification surfaces. The command evaluates the same profile impact declarations and pnpm dependency graph from the exact base/head identity, diffed from their merge base; it is the candidate-named sibling of `production:impact` and replaces repository-owned path filters, never adds a second matcher. The `head` commit must be the checked-out `HEAD`, and both commits must be reachable (`fetch-depth: 0`). Every doubt path — unreadable identity, malformed or unsupported graph data, an unowned profile change, a working-tree profile that differs from the head commit, or classifier refusal — fails closed and leaves every declared target demanded. `production:impact` keeps its merge-push `before`/`after` contract unchanged.
+
 For factory workflow, install the four canonical skills from the repository:
 
 ```bash

package/dist/index.d.ts

@@ -16,8 +16,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -35,8 +35,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -45,8 +45,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -64,8 +64,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -126,8 +126,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
     mergedSha: z.ZodOptional<z.ZodString>;
     pr: z.ZodNumber;
     state: z.ZodEnum<{
-      open: "open";
       merged: "merged";
+      open: "open";
     }>;
     wave: z.ZodOptional<z.ZodString>;
   }, z.core.$loose>>;
@@ -150,8 +150,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -170,8 +170,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
     mergedSha: z.ZodOptional<z.ZodString>;
     pr: z.ZodNumber;
     state: z.ZodEnum<{
-      open: "open";
       merged: "merged";
+      open: "open";
     }>;
     wave: z.ZodOptional<z.ZodString>;
   }, z.core.$loose>>;
@@ -194,8 +194,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -285,6 +285,15 @@ interface HqSpoolEntryOutcome {
   detail?: string;
   eventId: string;
   kind: string;
+  /**
+   * `true` when HQ refused the content as schema-invalid (HTTP 422, #739).
+   * The same bytes get the same verdict on every retry under the current
+   * ingest schema, so retrying without a schema change cannot succeed.
+   * Distinct from `undeliverable`: an HQ schema fix can still admit these
+   * bytes, so eviction is an operator decision (`hq:flush --evict-permanent`),
+   * never automatic.
+   */
+  permanent?: boolean;
   spool: string;
   /**
    * `undeliverable` is the one terminal verdict (#445). Every other status
@@ -302,6 +311,13 @@ interface HqSpoolFlushInput {
   clientSecret: string;
   /** The profile's HQ origin; entries recorded against another are refused. */
   endpoint: string;
+  /**
+   * Disposition schema-permanent rejections (HTTP 422) in place with the
+   * `.undeliverable` suffix instead of retaining them (#739). Operator
+   * opt-in: a later HQ schema fix can still admit the same bytes, so the
+   * drain never evicts on its own.
+   */
+  evictPermanentRejections?: boolean;
   /** Operator-named spool directories; replaces the default two locations. */
   explicitDirectories?: string[];
   repository: HqSpoolRepository;
@@ -617,10 +633,81 @@ declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
 declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
 type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
 //#endregion
+//#region src/impact-stamp.d.ts
+/**
+ * The recorded stamp. `targets` satisfies the completeness invariant: every
+ * target the profile declares is present, each with its exact basis — never
+ * silently absent. `basis: "conservative"` means an unmodelled or unprovable
+ * input widened every target to full impact.
+ */
+declare const impactStampSchema: z.ZodObject<{
+  basis: z.ZodEnum<{
+    "target-scoped": "target-scoped";
+    conservative: "conservative";
+  }>;
+  reasons: z.ZodArray<z.ZodString>;
+  stampVersion: z.ZodLiteral<3>;
+  targets: z.ZodArray<z.ZodObject<{
+    basis: z.ZodString;
+    impact: z.ZodEnum<{
+      affected: "affected";
+      "not-affected": "not-affected";
+    }>;
+    name: z.ZodString;
+  }, z.core.$strip>>;
+  unsubscribedPaths: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+type ImpactStamp = z.infer<typeof impactStampSchema>;
+/**
+ * The surfaces that consume the stamp. One classification, consumed
+ * everywhere (#430): every surface routes through
+ * {@link impactStampScopeDecision}, so no surface can be more trusting than
+ * another, and no surface re-derives path rules of its own. The value only
+ * selects the wording of the conservative floor a refusal falls back to.
+ */
+declare const IMPACT_SCOPE_SURFACES: {
+  readonly demand: "full demand floor";
+  readonly "preview-lifecycle": "full preview-lifecycle floor";
+  readonly "verification-battery": "full verification-battery floor";
+};
+type ImpactScopeSurface = keyof typeof IMPACT_SCOPE_SURFACES;
+interface ImpactScopeDecision {
+  reason: string;
+  /** True ⇒ this target's work is provably unreachable and may be released. */
+  scoped: boolean;
+}
+/**
+ * Whether a trusted stamp RELEASES one target-scoped unit of work — an
+ * external proof demand (#542 wave 2), a verification-battery command, or a
+ * preview (Alchemy) lifecycle stack (#430 wave 3).
+ *
+ * The only release path is a `target-scoped` stamp of exactly this build's
+ * stamp version whose target entry for exactly this name is provably
+ * `not-affected`. Every other input — no trusted stamp, an unknown stamp
+ * version, a conservative stamp, a name the stamp does not classify, or an
+ * `affected` verdict — keeps today's full-work floor. Work only ever gets
+ * released, never added or satisfied: this function can withdraw a demand, it
+ * can never certify one.
+ *
+ * Identity binding is the CALLER's precondition: pass only a stamp computed
+ * for, or read from a pr:verify proof bound to, the current candidate (see
+ * `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
+ * `undefined` otherwise.
+ */
+declare const impactStampScopeDecision: ({
+  stamp,
+  surface,
+  targetName
+}: {
+  stamp: ImpactStamp | undefined;
+  surface: ImpactScopeSurface;
+  targetName: string;
+}) => ImpactScopeDecision;
+//#endregion
 //#region src/profile.d.ts
 declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
-/** The one profile shape this build accepts (ADR 0023, #318, #351). */
-declare const PROFILE_SCHEMA_VERSION = 5;
+/** The one profile shape this build accepts (ADR 0023, #318, #351, #742). */
+declare const PROFILE_SCHEMA_VERSION = 6;
 declare const factoryProjectProfileSchema: z.ZodObject<{
   $schema: z.ZodOptional<z.ZodString>;
   extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -629,18 +716,13 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     endpoint: z.ZodIntersection<z.ZodString, z.ZodString>;
   }, z.core.$strict>>;
   impact: z.ZodOptional<z.ZodObject<{
+    inert: z.ZodOptional<z.ZodArray<z.ZodString>>;
     targets: z.ZodArray<z.ZodObject<{
       importers: z.ZodArray<z.ZodString>;
       name: z.ZodString;
       paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
   }, z.core.$strict>>;
-  proof: z.ZodObject<{
-    classificationPolicy: z.ZodObject<{
-      docsOnly: z.ZodDefault<z.ZodArray<z.ZodString>>;
-      trivial: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>;
-  }, z.core.$strict>;
   repository: z.ZodObject<{
     name: z.ZodString;
     owner: z.ZodString;
@@ -649,8 +731,8 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     name: z.ZodString;
     scope: z.ZodOptional<z.ZodObject<{
       classifications: z.ZodArray<z.ZodEnum<{
-        trivial: "trivial";
         "docs/process-only": "docs/process-only";
+        trivial: "trivial";
         "non-trivial": "non-trivial";
       }>>;
     }, z.core.$strict>>;
@@ -660,7 +742,7 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
       paths: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
   }, z.core.$strict>>;
-  schemaVersion: z.ZodLiteral<5>;
+  schemaVersion: z.ZodLiteral<6>;
   verification: z.ZodObject<{
     commands: z.ZodArray<z.ZodObject<{
       command: z.ZodString;
@@ -1217,8 +1299,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
   baseSha: z.ZodString;
   blockingReasons: z.ZodArray<z.ZodString>;
   classification: z.ZodEnum<{
-    trivial: "trivial";
     "docs/process-only": "docs/process-only";
+    trivial: "trivial";
     "non-trivial": "non-trivial";
   }>;
   externalChecks: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -1231,8 +1313,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     reason: z.ZodOptional<z.ZodString>;
     scope: z.ZodOptional<z.ZodObject<{
       classifications: z.ZodArray<z.ZodEnum<{
-        trivial: "trivial";
         "docs/process-only": "docs/process-only";
+        trivial: "trivial";
         "non-trivial": "non-trivial";
       }>>;
     }, z.core.$strict>>;
@@ -1282,15 +1364,15 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       unknown: "unknown";
       critical: "critical";
       high: "high";
-      medium: "medium";
       low: "low";
+      medium: "medium";
     }>>;
     highestOpenSeverity: z.ZodOptional<z.ZodEnum<{
       unknown: "unknown";
       critical: "critical";
       high: "high";
-      medium: "medium";
       low: "low";
+      medium: "medium";
     }>>;
     maxReviewCycles: z.ZodOptional<z.ZodNumber>;
     nonBlockingFindings: z.ZodNumber;
@@ -1318,8 +1400,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     }>;
     stage: z.ZodEnum<{
       gate: "gate";
-      "interior-complete": "interior-complete";
       interior: "interior";
+      "interior-complete": "interior-complete";
     }>;
   }, z.core.$strip>>;
   reviewRuns: z.ZodOptional<z.ZodArray<z.ZodType<PrReviewResult, unknown, z.core.$ZodTypeInternals<PrReviewResult, unknown>>>>;
@@ -1598,84 +1680,13 @@ declare function validatePrReadyProof(value: unknown): PrReadyProof;
 declare function readPrReadyProof(filePath: string): PrReadyProof;
 declare function runPrReady(args: PrReadyArgs, dependencies?: PrReadyDependencies): Promise<PrReadyProof>;
 //#endregion
-//#region src/impact-stamp.d.ts
-/**
- * The recorded stamp. `targets` satisfies the completeness invariant: every
- * target the profile declares is present, each with its exact basis — never
- * silently absent. `basis: "conservative"` means an unmodelled or unprovable
- * input widened every target to full impact.
- */
-declare const impactStampSchema: z.ZodObject<{
-  basis: z.ZodEnum<{
-    "target-scoped": "target-scoped";
-    conservative: "conservative";
-  }>;
-  reasons: z.ZodArray<z.ZodString>;
-  stampVersion: z.ZodLiteral<3>;
-  targets: z.ZodArray<z.ZodObject<{
-    basis: z.ZodString;
-    impact: z.ZodEnum<{
-      affected: "affected";
-      "not-affected": "not-affected";
-    }>;
-    name: z.ZodString;
-  }, z.core.$strip>>;
-  unsubscribedPaths: z.ZodArray<z.ZodString>;
-}, z.core.$strip>;
-type ImpactStamp = z.infer<typeof impactStampSchema>;
-/**
- * The surfaces that consume the stamp. One classification, consumed
- * everywhere (#430): every surface routes through
- * {@link impactStampScopeDecision}, so no surface can be more trusting than
- * another, and no surface re-derives path rules of its own. The value only
- * selects the wording of the conservative floor a refusal falls back to.
- */
-declare const IMPACT_SCOPE_SURFACES: {
-  readonly demand: "full demand floor";
-  readonly "preview-lifecycle": "full preview-lifecycle floor";
-  readonly "verification-battery": "full verification-battery floor";
-};
-type ImpactScopeSurface = keyof typeof IMPACT_SCOPE_SURFACES;
-interface ImpactScopeDecision {
-  reason: string;
-  /** True ⇒ this target's work is provably unreachable and may be released. */
-  scoped: boolean;
-}
-/**
- * Whether a trusted stamp RELEASES one target-scoped unit of work — an
- * external proof demand (#542 wave 2), a verification-battery command, or a
- * preview (Alchemy) lifecycle stack (#430 wave 3).
- *
- * The only release path is a `target-scoped` stamp of exactly this build's
- * stamp version whose target entry for exactly this name is provably
- * `not-affected`. Every other input — no trusted stamp, an unknown stamp
- * version, a conservative stamp, a name the stamp does not classify, or an
- * `affected` verdict — keeps today's full-work floor. Work only ever gets
- * released, never added or satisfied: this function can withdraw a demand, it
- * can never certify one.
- *
- * Identity binding is the CALLER's precondition: pass only a stamp computed
- * for, or read from a pr:verify proof bound to, the current candidate (see
- * `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
- * `undefined` otherwise.
- */
-declare const impactStampScopeDecision: ({
-  stamp,
-  surface,
-  targetName
-}: {
-  stamp: ImpactStamp | undefined;
-  surface: ImpactScopeSurface;
-  targetName: string;
-}) => ImpactScopeDecision;
-//#endregion
 //#region src/required-check-policy.d.ts
 declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
 type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
 declare const requiredCheckScopeSchema: z.ZodObject<{
   classifications: z.ZodArray<z.ZodEnum<{
-    trivial: "trivial";
     "docs/process-only": "docs/process-only";
+    trivial: "trivial";
     "non-trivial": "non-trivial";
   }>>;
 }, z.core.$strict>;
@@ -1732,8 +1743,8 @@ declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -1759,8 +1770,8 @@ declare const evidenceEnvelopeSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2050,18 +2061,18 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
   boundary: z.ZodOptional<z.ZodString>;
   command: z.ZodLiteral<"patronage-factory boundary:check">;
   coveredSet: z.ZodArray<z.ZodObject<{
-    issue: z.ZodNumber;
+    issue: z.ZodOptional<z.ZodNumber>;
     pr: z.ZodNumber;
     sha: z.ZodString;
     state: z.ZodEnum<{
-      open: "open";
       merged: "merged";
+      open: "open";
     }>;
     wave: z.ZodString;
   }, z.core.$strip>>;
   demandedRung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   epicIssue: z.ZodNumber;
@@ -2076,8 +2087,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     commentUrl: z.ZodOptional<z.ZodString>;
     producer: z.ZodString;
     rung: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
     sessionId: z.ZodOptional<z.ZodString>;
@@ -2093,8 +2104,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     value: z.ZodString;
   }, z.core.$strip>>;
   status: z.ZodEnum<{
-    blocked: "blocked";
     ready: "ready";
+    blocked: "blocked";
   }>;
 }, z.core.$strip>;
 type BoundaryCheckProofRecord = z.infer<typeof boundaryCheckProofSchema>;
@@ -3212,14 +3223,14 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    review: "review";
     code: "code";
+    review: "review";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
       high: "high";
-      medium: "medium";
       low: "low";
+      medium: "medium";
       xhigh: "xhigh";
     }>;
     engine: z.ZodString;
@@ -3231,18 +3242,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
+      oracle: "oracle";
       review: "review";
       delegate: "delegate";
-      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
   }, z.core.$strict>;
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
+    oracle: "oracle";
     review: "review";
     delegate: "delegate";
-    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3291,14 +3302,14 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    review: "review";
     code: "code";
+    review: "review";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
       high: "high";
-      medium: "medium";
       low: "low";
+      medium: "medium";
       xhigh: "xhigh";
     }>;
     engine: z.ZodString;
@@ -3310,18 +3321,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
+      oracle: "oracle";
       review: "review";
       delegate: "delegate";
-      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
   }, z.core.$strict>;
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
+    oracle: "oracle";
     review: "review";
     delegate: "delegate";
-    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3361,14 +3372,14 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     interiorCycle: z.ZodOptional<z.ZodNumber>;
     observedAt: z.ZodString;
     purpose: z.ZodEnum<{
-      review: "review";
       code: "code";
+      review: "review";
     }>;
     slotResolution: z.ZodObject<{
       effort: z.ZodEnum<{
         high: "high";
-        medium: "medium";
         low: "low";
+        medium: "medium";
         xhigh: "xhigh";
       }>;
       engine: z.ZodString;
@@ -3380,18 +3391,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       }>;
       model: z.ZodString;
       tier: z.ZodEnum<{
+        oracle: "oracle";
         review: "review";
         delegate: "delegate";
-        oracle: "oracle";
         workhorse: "workhorse";
         scout: "scout";
       }>;
     }, z.core.$strict>;
     startedAt: z.ZodString;
     tier: z.ZodEnum<{
+      oracle: "oracle";
       review: "review";
       delegate: "delegate";
-      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3434,17 +3445,17 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   exitCode: number | null;
   harness: string;
   observedAt: string;
-  purpose: "review" | "code";
+  purpose: "code" | "review";
   slotResolution: {
-    effort: "high" | "medium" | "low" | "xhigh";
+    effort: "high" | "low" | "medium" | "xhigh";
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
-    tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
+    tier: "oracle" | "review" | "delegate" | "workhorse" | "scout";
     fallbackTier?: "delegate" | undefined;
   };
   startedAt: string;
-  tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
+  tier: "oracle" | "review" | "delegate" | "workhorse" | "scout";
   tokenUsage: {
     source: "cursor-csv" | "codex-json" | "cursor-json" | "claude-json";
     status: "available";
@@ -3761,7 +3772,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
   ledger: {
     baseSha: string;
     blockingReasons: string[];
-    classification: "trivial" | "docs/process-only" | "non-trivial";
+    classification: "docs/process-only" | "trivial" | "non-trivial";
     github: {
       draft: boolean;
       mergeStateStatus: string;
@@ -3810,7 +3821,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       status: "satisfied" | "unmet" | "out-of-scope";
       reason?: string | undefined;
       scope?: {
-        classifications: ("trivial" | "docs/process-only" | "non-trivial")[];
+        classifications: ("docs/process-only" | "trivial" | "non-trivial")[];
       } | undefined;
     }[] | undefined;
     mergeBaseSha?: string | undefined;
@@ -3826,8 +3837,8 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       nonBlockingFindings: number;
       openFindings: number;
       windowExhausted: boolean;
-      highestBlockingSeverity?: "unknown" | "critical" | "high" | "medium" | "low" | undefined;
-      highestOpenSeverity?: "unknown" | "critical" | "high" | "medium" | "low" | undefined;
+      highestBlockingSeverity?: "unknown" | "critical" | "high" | "low" | "medium" | undefined;
+      highestOpenSeverity?: "unknown" | "critical" | "high" | "low" | "medium" | undefined;
       maxReviewCycles?: number | undefined;
       reviewCycle?: number | undefined;
       staleRepeatFindings?: number | undefined;
@@ -3838,7 +3849,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "gate" | "interior-complete" | "interior";
+      stage: "gate" | "interior" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;

package/dist/index.js

@@ -17,7 +17,7 @@ import { parse } from "yaml";
 import { FACTORY_PROOF_GATE_STEP_NAME, GitHubApiError, mintInstallationToken, productionImpactTargetOutput, readVitestProfileDocument } from "@patronage/factory-ci";
 import { promisify } from "node:util";
 //#region package.json
-var version = "1.0.0-alpha.15";
+var version = "1.0.0-alpha.16";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -1141,17 +1141,17 @@ const requiredCheckInScope = ({ context, scope }) => {
 //#region src/profile.ts
 const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
 /**
-* The shapes v5 replaced. Not loadable — {@link legacyProfileMigration} turns
+* The shapes v6 replaced. Not loadable — {@link legacyProfileMigration} turns
 * an encounter with one into a per-field migration error rather than a
 * schema complaint about a shape the profile was never written in.
 */
 const LEGACY_PROFILE_SCHEMA_VERSIONS = [
 	2,
 	3,
-	4
+	4,
+	5
 ];
 const PROFILE_JSON_SCHEMA_DESCRIPTION = "Editor validation covers the profile input shape and straightforward cross-field constraints. Zod remains the load-time enforcement authority: verification command names must be distinct and requiredChecks entries must have distinct names; these invariants are enforced at load time, not by this schema. Impact target path patterns encode repo-relative safety in JSON Schema, while complete picomatch syntax validity remains a runtime-only refinement.";
-const globSchema = z.string().min(1).refine(isValidGlob, "must be a valid glob");
 const repoRelativeGlobSchema = z.string().min(1).regex(/^(?!(?:\/[\s\S]*|[A-Za-z]:\/[\s\S]*|!(?!\()[\s\S]*|[\s\S]*\\[\s\S]*|[\s\S]*\/\/[\s\S]*|[\s\S]*\/$|\.{1,2}(?:\/|$)[\s\S]*|[\s\S]*\/\.{1,2}(?:\/|$)[\s\S]*)).+$/u, "must be a repo-relative positive glob").refine(isValidRepoRelativeGlob, "must be a valid repo-relative glob");
 const commandSchema = z.object({
 	command: z.string().min(1),
@@ -1187,22 +1187,21 @@ const impactTargetSchema = z.object({
 	name: z.string().min(1),
 	paths: z.array(repoRelativeGlobSchema).min(1).optional().describe("Opt-in repo-relative path subscriptions. A target is affected only when a valid changed path matches one of its globs; valid unmatched paths affect no target and are recorded as unsubscribed. Shared files must be listed by every subscribing target.")
 }).strict();
-const impactConfigSchema = z.object({ targets: z.array(impactTargetSchema).min(1).superRefine((targets, context) => {
-	const names = targets.map((target) => target.name);
-	if (new Set(names).size !== names.length) context.addIssue({
-		code: "custom",
-		message: "impact.targets entries must have distinct names."
-	});
-}) }).strict();
+const impactConfigSchema = z.object({
+	inert: z.array(repoRelativeGlobSchema).min(1).optional().describe("Opt-in repo-relative globs declaring repository-inert ownership. A candidate qualifies for the docs/process-only verification rung only when no changed path affects a declared impact target and every changed path matches one of these globs. Paths without a declared owner stay non-trivial."),
+	targets: z.array(impactTargetSchema).min(1).superRefine((targets, context) => {
+		const names = targets.map((target) => target.name);
+		if (new Set(names).size !== names.length) context.addIssue({
+			code: "custom",
+			message: "impact.targets entries must have distinct names."
+		});
+	})
+}).strict();
 const factoryProjectProfileSchema = z.object({
 	$schema: z.string().min(1).optional(),
 	extensions: z.record(z.string(), z.unknown()).optional(),
 	hq: hqIngestConfigSchema.optional(),
 	impact: impactConfigSchema.optional(),
-	proof: z.object({ classificationPolicy: z.object({
-		docsOnly: z.array(globSchema).default([]),
-		trivial: z.array(globSchema).default([])
-	}).strict() }).strict(),
 	repository: z.object({
 		name: z.string().min(1),
 		owner: z.string().min(1)
@@ -1213,9 +1212,18 @@ const factoryProjectProfileSchema = z.object({
 			code: "custom",
 			message: "requiredChecks entries must have distinct names."
 		});
+		for (const [index, check] of checks.entries()) if (check.scope?.classifications.includes("trivial")) context.addIssue({
+			code: "custom",
+			message: `requiredChecks entry "${check.name}" scopes on classification "trivial", which the classifier no longer produces (#742); scope on "docs/process-only" or "non-trivial".`,
+			path: [
+				index,
+				"scope",
+				"classifications"
+			]
+		});
 	}).optional(),
 	review: z.object({ conditional: z.array(conditionalReviewSchema).min(1) }).strict().optional(),
-	schemaVersion: z.literal(5),
+	schemaVersion: z.literal(6),
 	verification: z.object({ commands: z.array(commandSchema).min(1) })
 }).strict().superRefine((profile, context) => {
 	const commandNames = /* @__PURE__ */ new Set();
@@ -1307,16 +1315,19 @@ const PREFIX_NARROWING_NOTE = "note: prefix matching becomes glob matching, so a
 const migratedPolicyLines = (policy, root) => {
 	const field = "proof.classificationPolicy";
 	const lines = [];
-	const rename = (from, to, translate) => {
+	const rename = (from, translate) => {
 		const entries = stringList(policy[from]);
-		if (from in policy) lines.push(`${field}.${from} ${quoteList(entries)} -> ${field}.${to} ${quoteList(entries.map(translate))}`);
-	};
-	rename("docsOnlyFiles", "docsOnly", unchanged);
-	rename("docsOnlyPrefixes", "docsOnly", migratedPrefixGlob(root));
-	rename("docsOnlyMarkdownPrefixes", "docsOnly", migratedMarkdownPrefixGlob);
-	rename("trivialFiles", "trivial", unchanged);
-	rename("trivialPrefixes", "trivial", migratedPrefixGlob(root));
-	if (["docsOnlyPrefixes", "trivialPrefixes"].some((from) => from in policy)) lines.push(PREFIX_NARROWING_NOTE);
+		if (from in policy) lines.push(`${field}.${from} ${quoteList(entries)} -> impact.inert ${quoteList(entries.map(translate))}`);
+	};
+	const dropTrivial = (from) => {
+		if (from in policy) lines.push(`${field}.${from} ${quoteList(stringList(policy[from]))} -> ${TRIVIAL_GLOBS_DROPPED}`);
+	};
+	rename("docsOnlyFiles", unchanged);
+	rename("docsOnlyPrefixes", migratedPrefixGlob(root));
+	rename("docsOnlyMarkdownPrefixes", migratedMarkdownPrefixGlob);
+	dropTrivial("trivialFiles");
+	dropTrivial("trivialPrefixes");
+	if ("docsOnlyPrefixes" in policy) lines.push(PREFIX_NARROWING_NOTE);
 	return lines;
 };
 /**
@@ -1351,6 +1362,17 @@ function hasCorrectnessOnlyReview(review) {
 	const { modes } = review;
 	return Object.keys(review).length > 0 && Object.keys(review).every((field) => field === "conditional" || field === "defaultMaxCycles" || field === "modes") && Array.isArray(modes) && modes.length > 0 && modes.every((mode) => mode === "correctness") && (review.conditional === void 0 || Array.isArray(review.conditional) && review.conditional.length === 0);
 }
+const TRIVIAL_GLOBS_DROPPED = "removed; unowned paths verify in full. Declare a glob in impact.inert only when the path is deliberately repository-inert (docs battery).";
+const classificationPolicyFoldLines = (input) => {
+	const proof = isRecord$2(input.proof) ? input.proof : void 0;
+	if (!proof) return [];
+	const lines = [];
+	const policy = isRecord$2(proof.classificationPolicy) ? proof.classificationPolicy : void 0;
+	if (policy && "docsOnly" in policy) lines.push(`proof.classificationPolicy.docsOnly ${quoteList(stringList(policy.docsOnly))} -> impact.inert (keep only globs for paths no impact target subscribes to)`);
+	if (policy && "trivial" in policy) lines.push(`proof.classificationPolicy.trivial ${quoteList(stringList(policy.trivial))} -> ${TRIVIAL_GLOBS_DROPPED}`);
+	lines.push("proof -> removed; the impact declarations own path classification. The docs/process-only rung now requires zero affected impact targets and every changed path matching impact.inert (#742).");
+	return lines;
+};
 const v4MigrationLines = (input) => {
 	const lines = [];
 	if (isRecord$2(input.project) && "key" in input.project) lines.push("project.key -> removed; current proof writers derive projectKey from repository.name");
@@ -1373,9 +1395,12 @@ const v4MigrationLines = (input) => {
 function legacyProfileMigration(input, root) {
 	if (!(isRecord$2(input) && typeof input.schemaVersion === "number" && LEGACY_PROFILE_SCHEMA_VERSIONS.includes(input.schemaVersion))) return;
 	const foundVersion = input.schemaVersion;
-	const lines = [`schemaVersion ${foundVersion} -> 5`];
+	const lines = [`schemaVersion ${foundVersion} -> 6`];
 	if (foundVersion === 2) lines.push(...v2MigrationLines(input, root));
-	lines.push(...v4MigrationLines(input));
+	lines.push(...classificationPolicyFoldLines(input), ...v4MigrationLines(input));
+	if (Array.isArray(input.requiredChecks)) {
+		for (const [index, check] of input.requiredChecks.entries()) if (isRecord$2(check) && isRecord$2(check.scope) && stringList(check.scope.classifications).includes("trivial")) lines.push(`requiredChecks[${index}].scope.classifications "trivial" -> removed; scope on "docs/process-only" or "non-trivial"`);
+	}
 	return {
 		foundVersion,
 		lines
@@ -1435,7 +1460,7 @@ function hqLaneRefBaseUrlFromProfile(profile) {
 	return hqLaneRefBaseUrl(profile.hq.endpoint);
 }
 function formatLegacyProfileError(profilePath, foundVersion, migration) {
-	return [`Profile is invalid: ${profilePath}: schemaVersion ${foundVersion} is not supported; migrate to schemaVersion 5 (ADR 0023).`, ...migration.map((line) => `  ${line}`)].join("\n");
+	return [`Profile is invalid: ${profilePath}: schemaVersion ${foundVersion} is not supported; migrate to schemaVersion 6 (ADR 0023).`, ...migration.map((line) => `  ${line}`)].join("\n");
 }
 function formatProfileError(profilePath, error) {
 	return `Profile is invalid: ${profilePath}: ${error.issues.map((issue) => {
@@ -2396,6 +2421,15 @@ const NON_CONTENT_CLIENT_STATUSES = new Set([
 	408,
 	429
 ]);
+/**
+* HTTP 422 is HQ's schema validator refusing the content
+* (`invalid_ingest_event`): the same bytes produce the same refusal on every
+* retry under the current ingest schema (#739). Other content rejections stay
+* unclassified — a 400 or 404 may describe the route or the moment, not the
+* bytes — so only the one status HQ documents as a validation verdict counts
+* as permanent.
+*/
+const isPermanentRejection = (reason) => reason === "http-status-422";
 const drainFailureStatus = (reason) => {
 	const status = Number(reason.replace("http-status-", ""));
 	return reason.startsWith("http-status-") && Number.isFinite(status) && status >= 400 && status < 500 && !NON_CONTENT_CLIENT_STATUSES.has(status) ? "rejected" : "unreachable";
@@ -2481,6 +2515,18 @@ const replayCloseoutSpool = async (layout, endpoint, clientId, clientSecret, req
 		}
 		attempted += 1;
 		const outcome = await attemptTransport(request, endpoint, clientId, clientSecret, body, Math.min(transportBudgetMs, remainingMs(replayDeadline)), report !== void 0);
+		const permanent = !outcome.ok && isPermanentRejection(outcome.reason);
+		if (permanent && options.evictPermanentRejections === true) {
+			if (!await mutateBoundDirectory(spool, spoolIdentity, performance.now() + flushBudgetMs, async () => rename(claimPath, `${eventPath}${UNDELIVERABLE_SUFFIX}`))) return;
+			report?.({
+				detail: `${outcome.detail === void 0 ? outcome.reason : `${outcome.reason}: ${outcome.detail}`}; HQ refuses these bytes on every retry under its current ingest schema; dispositioned as ${path.basename(eventPath)}${UNDELIVERABLE_SUFFIX}`,
+				eventId: entry.event.eventId,
+				kind: entry.event.kind,
+				spool,
+				status: "undeliverable"
+			});
+			continue;
+		}
 		if (report) {
 			const common = {
 				eventId: entry.event.eventId,
@@ -2493,6 +2539,7 @@ const replayCloseoutSpool = async (layout, endpoint, clientId, clientSecret, req
 			} : {
 				...common,
 				detail: outcome.detail === void 0 ? outcome.reason : `${outcome.reason}: ${outcome.detail}`,
+				...permanent ? { permanent: true } : {},
 				status: drainFailureStatus(outcome.reason)
 			});
 		}
@@ -2982,6 +3029,7 @@ async function flushHqSpool(input, dependencies = {}) {
 	const spools = [];
 	for (const layout of layouts) {
 		await replayCloseoutSpool(layout, endpoint, input.clientId, input.clientSecret, request, transportBudgetMs, deadline, deadline, flushBudgetMs, void 0, {
+			...input.evictPermanentRejections === true ? { evictPermanentRejections: true } : {},
 			maxEntries: Number.POSITIVE_INFINITY,
 			report: spoolReport
 		});
@@ -4834,7 +4882,7 @@ const boundaryCheckProofSchema = z.object({
 	boundary: z.string().min(1).optional(),
 	command: z.literal("patronage-factory boundary:check"),
 	coveredSet: z.array(z.object({
-		issue: z.number().int().positive(),
+		issue: z.number().int().positive().optional(),
 		pr: z.number().int().positive(),
 		sha: evidenceShaSchema,
 		state: z.enum(["merged", "open"]),
@@ -5956,6 +6004,167 @@ function createBoundaryCheckCommand(output, action) {
 		if (record.status !== "ready") throw new Error(`boundary:check refused: ${record.blockingReasons.join("; ")}`);
 	})));
 }
+const COMMIT_SHA_PATTERN$1 = /^[0-9a-f]{40}$/iu;
+const ZERO_SHA_PATTERN$1 = /^0{40}$/u;
+const demandedTargets$1 = (profile, reason) => (profile?.impact?.targets ?? []).map(({ name }) => ({
+	basis: reason,
+	name,
+	state: "demanded"
+}));
+const refusal$1 = ({ base, head, profile, reason }) => ({
+	...base ? { baseSha: base } : {},
+	basis: {
+		changedFiles: [],
+		classification: "refused",
+		reasons: [reason]
+	},
+	decision: "refused",
+	...head ? { headSha: head } : {},
+	schemaVersion: 1,
+	targets: demandedTargets$1(profile, reason),
+	unsubscribedPaths: []
+});
+const sortKeys = (value) => {
+	if (Array.isArray(value)) return value.map(sortKeys);
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.keys(value).toSorted().map((key) => [key, sortKeys(value[key])]));
+	return value;
+};
+/**
+* Canonical JSON for content comparison; `undefined` when unparseable. Keys
+* are sorted recursively so a pure representation change (EOL, whitespace,
+* key order) never refuses; only different values do.
+*/
+const canonicalJson = (content) => {
+	try {
+		return JSON.stringify(sortKeys(JSON.parse(content)));
+	} catch {
+		return;
+	}
+};
+const assertCommitIdentity$1 = (value, name) => {
+	if (value === void 0 || !COMMIT_SHA_PATTERN$1.test(value) || ZERO_SHA_PATTERN$1.test(value)) throw new Error(`${name} must be a non-zero 40-character commit SHA`);
+	return value.toLowerCase();
+};
+const assertReachableCommit$1 = (cwd, sha, name) => {
+	try {
+		runCapture("git", [
+			"cat-file",
+			"-e",
+			`${sha}^{commit}`
+		], cwd);
+	} catch {
+		throw new Error(`${name} commit ${sha} is not reachable in this checkout`);
+	}
+};
+const writeGithubOutputs$1 = (outputPath, decision) => {
+	appendFileSync(outputPath, `${[
+		`decision=${decision.decision}`,
+		`basis=${JSON.stringify(decision.basis)}`,
+		`unsubscribed_paths=${JSON.stringify(decision.unsubscribedPaths)}`,
+		...decision.targets.map((target) => `${productionImpactTargetOutput(target.name)}=${target.state}`)
+	].join("\n")}\n`, "utf-8");
+};
+/**
+* Classify candidate impact from one exact base/head identity. The delta is
+* the merge-base-to-head diff, and the lockfile sides are read at exactly the
+* merge base and head — the same inputs `pr:verify` gives the impact stamp
+* for the same candidate commits. The result may withdraw hosted routing
+* work only; every doubt path returns a refused decision whose known targets
+* remain demanded.
+*/
+const runCandidateImpact = (args) => {
+	const cwd = path.resolve(args.cwd ?? process.cwd());
+	let profile;
+	let profilePath;
+	let decision;
+	try {
+		const { path: loadedPath, profile: loadedProfile } = loadProjectProfile({
+			cwd,
+			profilePath: args.profilePath
+		});
+		profile = loadedProfile;
+		profilePath = loadedPath;
+		const base = assertCommitIdentity$1(args.base, "base");
+		const head = assertCommitIdentity$1(args.head, "head");
+		assertReachableCommit$1(cwd, base, "base");
+		assertReachableCommit$1(cwd, head, "head");
+		const checkedOutHead = runCapture("git", ["rev-parse", "HEAD"], cwd).stdout.trim().toLowerCase();
+		if (checkedOutHead !== head) throw new Error(`head commit ${head} is not the checked-out HEAD ${checkedOutHead}; refusing to mix commit identities with declarations from another tree`);
+		const relativeProfilePath = path.relative(cwd, profilePath);
+		const committedProfile = showFileAtRef(cwd, head, profilePath);
+		if (committedProfile === void 0) throw new Error(`profile ${relativeProfilePath} is not readable at head commit ${head}; refusing to classify from declarations the head does not carry`);
+		if (canonicalJson(committedProfile) === void 0 || canonicalJson(committedProfile) !== canonicalJson(readFileSync(profilePath, "utf-8"))) throw new Error(`profile ${relativeProfilePath} on disk differs from head commit ${head}; refusing to classify from declarations the head does not carry`);
+		const mergeBase = runCapture("git", [
+			"merge-base",
+			base,
+			head
+		], cwd).stdout.trim().toLowerCase();
+		if (!COMMIT_SHA_PATTERN$1.test(mergeBase)) throw new Error(`no merge base exists between base ${base} and head ${head}`);
+		const changedFiles = [...new Set(filesFromNameStatus(runCapture("git", [
+			"diff",
+			"--find-renames",
+			"--name-status",
+			mergeBase,
+			head
+		], cwd).stdout))].toSorted();
+		const stamp = computeImpactStamp({
+			changedFiles,
+			profile,
+			profilePath: path.relative(cwd, profilePath),
+			readLockfile: (side) => showFileAtRef(cwd, side === "base" ? mergeBase : head, path.join(cwd, LOCKFILE_PATH))
+		});
+		const usable = stamp.basis === "target-scoped";
+		decision = {
+			baseSha: base,
+			basis: {
+				changedFiles,
+				classification: stamp.basis,
+				reasons: stamp.reasons
+			},
+			decision: usable ? "usable" : "refused",
+			headSha: head,
+			mergeBaseSha: mergeBase,
+			schemaVersion: 1,
+			targets: stamp.targets.map((target) => ({
+				basis: target.basis,
+				name: target.name,
+				state: usable && target.impact === "not-affected" ? "withdrawn" : "demanded"
+			})),
+			unsubscribedPaths: stamp.unsubscribedPaths
+		};
+	} catch (error) {
+		decision = refusal$1({
+			base: args.base,
+			head: args.head,
+			profile,
+			reason: `candidate impact classification refused: ${error instanceof Error ? error.message : String(error)}`
+		});
+	}
+	if (args.githubOutput) writeGithubOutputs$1(path.resolve(cwd, args.githubOutput), decision);
+	if (args.githubSummary) appendFileSync(path.resolve(cwd, args.githubSummary), `### Candidate impact\n\n${candidateImpactSummaryLines(decision).join("\n")}\n`, "utf-8");
+	return decision;
+};
+const candidateImpactSummaryLines = (decision) => decision.basis.classification === "refused" ? [
+	"Candidate impact: refused; all routed work remains demanded.",
+	...decision.basis.reasons,
+	unsubscribedPathsLine(void 0, "classification was refused")
+] : [`Candidate impact: ${decision.basis.classification}; ${decision.targets.filter(({ state }) => state === "demanded").length}/${decision.targets.length} target(s) demanded.`, unsubscribedPathsLine(decision.unsubscribedPaths)];
+//#endregion
+//#region src/commands/candidate-impact.ts
+function createCandidateImpactCommand(output) {
+	return markCwdOptionDefault(new Command("candidate:impact").description("Classify candidate targets from an exact pull-request base/head identity").option("--base <sha>", "candidate base commit SHA").option("--head <sha>", "candidate head commit SHA").option("--cwd <path>", "repository working directory", collectCwdOption).option("--profile <path>", "path to the project profile JSON file").option("--github-output <path>", "append stable decision outputs to a GitHub Actions output file").option("--github-summary <path>", "append a human-readable decision to a GitHub Actions summary file").option("--json", "print the complete decision as JSON").action((options) => {
+		const decision = runCandidateImpact({
+			base: options.base,
+			cwd: resolveCwdOption(options.cwd),
+			githubOutput: options.githubOutput,
+			githubSummary: options.githubSummary,
+			head: options.head,
+			profilePath: options.profile
+		});
+		if (options.json) output.stdout.write(`${JSON.stringify(decision, null, 2)}\n`);
+		else output.stdout.write(`${candidateImpactSummaryLines(decision).join("\n")}\n`);
+	}));
+}
 /** `tool` discriminator every emitted report carries. */
 const CI_ANALYZE_TOOL = "psf-ci-analyze";
 /** Cohort label for runs the caller did not assign to a cohort. */
@@ -9364,26 +9573,37 @@ function createFactoryCheckPublisher(output, dependencies = {}) {
 }
 //#endregion
 //#region src/pr-classification.ts
-function isDocsOnlyFile(profile, file) {
-	return matchesAnyGlob(profile.proof.classificationPolicy.docsOnly, file);
+function ownershipForFile(profile, file) {
+	if (file === "pnpm-lock.yaml") return { kind: "graph-input" };
+	const subscribed = (profile.impact?.targets ?? []).find((target) => matchesAnyGlob(target.paths ?? [], file));
+	if (subscribed) return {
+		kind: "target",
+		target: subscribed.name
+	};
+	if (matchesAnyGlob(profile.impact?.inert ?? [], file)) return { kind: "inert" };
+	return { kind: "unowned" };
 }
-function isTrivialFile(profile, file) {
-	return isDocsOnlyFile(profile, file) || matchesAnyGlob(profile.proof.classificationPolicy.trivial, file);
-}
-function reasonForFile(profile, file) {
-	if (isDocsOnlyFile(profile, file)) return `${file}: docs/process file`;
-	if (isTrivialFile(profile, file)) return `${file}: trivial factory-support file`;
-	return `${file}: implementation-affecting file`;
+function reasonForOwnership(file, ownership) {
+	switch (ownership.kind) {
+		case "graph-input": return `${file}: dependency graph input; never inert`;
+		case "inert": return `${file}: repository-inert ownership (impact.inert)`;
+		case "target": return `${file}: affects product target "${ownership.target}"`;
+		default: return `${file}: no declared owner; fail closed to non-trivial`;
+	}
 }
 function classifyDiff(profile, files) {
 	const sortedFiles = [...files].toSorted();
-	const reasons = sortedFiles.length > 0 ? sortedFiles.map((file) => reasonForFile(profile, file)) : ["No changed files detected; defaulting to non-trivial verification."];
-	if (sortedFiles.length > 0 && sortedFiles.every((file) => isDocsOnlyFile(profile, file))) return {
-		classification: "docs/process-only",
-		reasons
+	if (sortedFiles.length === 0) return {
+		classification: "non-trivial",
+		reasons: ["No changed files detected; defaulting to non-trivial verification."]
 	};
-	if (sortedFiles.length > 0 && sortedFiles.every((file) => isTrivialFile(profile, file))) return {
-		classification: "trivial",
+	const ownerships = sortedFiles.map((file) => ({
+		file,
+		ownership: ownershipForFile(profile, file)
+	}));
+	const reasons = ownerships.map(({ file, ownership }) => reasonForOwnership(file, ownership));
+	if (ownerships.every(({ ownership }) => ownership.kind === "inert")) return {
+		classification: "docs/process-only",
 		reasons
 	};
 	return {
@@ -9391,13 +9611,41 @@ function classifyDiff(profile, files) {
 		reasons
 	};
 }
+/**
+* The candidate classification `pr:verify` records: path ownership gated by
+* the impact stamp's positive evidence. The docs/process-only rung requires a
+* `target-scoped` stamp with zero affected targets ON TOP of full inert
+* ownership — a conservative stamp (unreadable or unsupported lockfile sides,
+* no declared targets, computation doubt) refuses the reduced rung, so a
+* fail-closed stamp can never coexist with a reduced verification battery
+* (#742 review cycle 3).
+*
+* `classifyDiffForRun` below stays the pure path predicate. Its remaining
+* stamp-less consumer is pr-ready's docs-only DELTA check, where the delta
+* rides on an already fully verified baseline and a lockfile-bearing delta
+* already refuses through the graph-input rule.
+*/
+function classifyDiffForRunWithStamp(profile, files, stamp, options) {
+	const base = classifyDiffForRun(profile, files, options);
+	if (base.classification === "non-trivial") return base;
+	if (stamp.basis !== "target-scoped") return {
+		classification: "non-trivial",
+		reasons: [...base.reasons, "impact stamp is conservative; the docs/process-only rung needs a target-scoped stamp with zero affected targets"]
+	};
+	const affected = stamp.targets.filter((target) => target.impact === "affected");
+	if (affected.length > 0) return {
+		classification: "non-trivial",
+		reasons: [...base.reasons, `impact stamp records ${affected.length} affected target(s); forced non-trivial`]
+	};
+	return base;
+}
 function classifyDiffForRun(profile, files, options) {
 	const relativeProfile = path.relative(options.cwd, options.profilePath).split(path.sep).join("/");
 	const base = classifyDiff(profile, files);
 	if (base.classification === "non-trivial") return base;
 	if (files.some((file) => file === relativeProfile || file === options.profilePath)) return {
 		classification: "non-trivial",
-		reasons: [...base.reasons, `${relativeProfile}: edits the classification policy; forced non-trivial`]
+		reasons: [...base.reasons, `${relativeProfile}: edits the ownership declarations; forced non-trivial`]
 	};
 	return base;
 }
@@ -9957,11 +10205,29 @@ function runPrVerify(args, dependencies = {}) {
 		profilePath: args.profilePath
 	});
 	const files = git.changedFiles(cwd, args.base);
-	const classification = classifyDiffForRun(profile, files, {
+	const relativeProfile = path.relative(cwd, profilePath).split(path.sep).join("/");
+	const { headSha, mergeBaseSha: proofMergeBaseSha, patchId } = resolveCandidateIdentity({
+		base: args.base,
+		cwd,
+		git
+	});
+	const readLockfileAtRef = git.showFileAtRef ?? showFileAtRef;
+	let impactStamp;
+	try {
+		impactStamp = computeImpactStamp({
+			changedFiles: files,
+			profile,
+			profilePath: relativeProfile,
+			readLockfile: (side) => readLockfileAtRef(cwd, side === "base" ? proofMergeBaseSha : headSha, path.resolve(cwd, LOCKFILE_PATH))
+		});
+	} catch (error) {
+		if (error instanceof ImpactStampConfigError) throw error;
+		impactStamp = conservativeImpactStamp(profile.impact?.targets ?? [], [`impact stamp computation failed (${error instanceof Error ? error.message : String(error)}); fail closed to full impact`]);
+	}
+	const classification = classifyDiffForRunWithStamp(profile, files, impactStamp, {
 		cwd,
 		profilePath
 	});
-	const relativeProfile = path.relative(cwd, profilePath).split(path.sep).join("/");
 	const rootSharedGlobs = [...DEFAULT_ROOT_SHARED_GLOBS, relativeProfile];
 	const context = createVerificationRunContext({
 		baseRef: args.base,
@@ -9989,24 +10255,6 @@ function runPrVerify(args, dependencies = {}) {
 	console.log(`pr:verify mode: ${resolvedMode}${args.mode === "auto" ? " (auto)" : ""}`);
 	console.log(`classification: ${classification.classification}`);
 	for (const line of context.runSummaryLines()) console.log(line);
-	const { headSha, mergeBaseSha: proofMergeBaseSha, patchId } = resolveCandidateIdentity({
-		base: args.base,
-		cwd,
-		git
-	});
-	const readLockfileAtRef = git.showFileAtRef ?? showFileAtRef;
-	let impactStamp;
-	try {
-		impactStamp = computeImpactStamp({
-			changedFiles: files,
-			profile,
-			profilePath: relativeProfile,
-			readLockfile: (side) => readLockfileAtRef(cwd, side === "base" ? proofMergeBaseSha : headSha, path.resolve(cwd, LOCKFILE_PATH))
-		});
-	} catch (error) {
-		if (error instanceof ImpactStampConfigError) throw error;
-		impactStamp = conservativeImpactStamp(profile.impact?.targets ?? [], [`impact stamp computation failed (${error instanceof Error ? error.message : String(error)}); fail closed to full impact`]);
-	}
 	for (const line of impactStampSummaryLines(impactStamp)) console.log(line);
 	const vetoedTargets = boundFailingCheckNames({
 		candidate: {
@@ -12451,6 +12699,7 @@ async function runHqFlush(args, dependencies = {}) {
 			clientId: resolution.credentials.clientId,
 			clientSecret: resolution.credentials.clientSecret,
 			endpoint: profile.hq.endpoint,
+			...args.evictPermanent === true ? { evictPermanentRejections: true } : {},
 			...explicitDirectories,
 			repository
 		}, {
@@ -12462,7 +12711,7 @@ async function runHqFlush(args, dependencies = {}) {
 		status: "flushed"
 	};
 }
-const outcomeLine = (outcome) => `[${outcome.status}] ${outcome.kind} ${outcome.eventId}${outcome.detail === void 0 ? "" : ` — ${outcome.detail}`}`;
+const outcomeLine = (outcome) => `[${outcome.status}${outcome.permanent === true ? ", permanent" : ""}] ${outcome.kind} ${outcome.eventId}${outcome.detail === void 0 ? "" : ` — ${outcome.detail}`}`;
 const orphanLine = (orphan) => `ORPHAN SPOOL: ${orphan.directory} — ${orphan.unlistable > 0 && orphan.pending === 0 ? "could not be inspected" : `${orphan.pending} event(s)`}${orphan.oldestQueuedAt === void 0 ? "" : `, oldest ${orphan.oldestQueuedAt}`}`;
 /**
 * Orphan lines, plus the recovery instruction. This run did not drain these
@@ -12478,6 +12727,7 @@ function renderHqFlush(result) {
 		...result.outcomes.map(outcomeLine),
 		`delivered ${result.delivered}, duplicate ${result.duplicate}, rejected ${result.rejected}, undeliverable ${result.undeliverable}, unreachable ${result.unreachable}`,
 		...result.undeliverable > 0 ? [`${result.undeliverable} event(s) can never be delivered and were dispositioned in place, renamed with \`.undeliverable\` and left readable; they no longer count as work waiting.`] : [],
+		...result.outcomes.some((outcome) => outcome.permanent === true && outcome.status === "rejected") ? ["Permanent rejection(s) above will fail identically on every retry; evict them with `psf hq:flush --evict-permanent`, or wait for an HQ ingest schema fix."] : [],
 		result.incomplete ? `INCOMPLETE: ${result.remaining} event(s) still spooled; the drain did not finish. Run hq:flush again.` : `spool drained: ${result.remaining} event(s) remain (rejections stay until HQ accepts them)`,
 		...orphanLines(result.orphans)
 	].join("\n")}\n`;
@@ -12503,10 +12753,11 @@ const hqFlushExitCode = (result) => {
 //#endregion
 //#region src/commands/hq-flush.ts
 function createHqFlushCommand(output, action = runHqFlush) {
-	return markCwdOptionDefault(new Command("hq:flush").description("Drain this repository's spooled HQ evidence and report every event; exits 1 when transport failed and 2 when the drain did not finish").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--dir <path>", "drain an explicit spool directory instead of the default locations; repeatable", (value, previous = []) => [...previous, value]).option("--json", "print the flush result as JSON").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
+	return markCwdOptionDefault(new Command("hq:flush").description("Drain this repository's spooled HQ evidence and report every event; exits 1 when transport failed and 2 when the drain did not finish").option("--cwd <path>", "working directory to evaluate", collectCwdOption).option("--dir <path>", "drain an explicit spool directory instead of the default locations; repeatable", (value, previous = []) => [...previous, value]).option("--evict-permanent", "disposition schema-permanent rejections (HTTP 422) in place with `.undeliverable` instead of retaining them").option("--json", "print the flush result as JSON").option("--profile <path>", "path to the project profile JSON file").action(async (options) => {
 		const result = await action({
 			cwd: resolveCwdOption(options.cwd),
 			...options.dir ? { dir: options.dir } : {},
+			...options.evictPermanent ? { evictPermanent: true } : {},
 			json: Boolean(options.json),
 			...options.profile ? { profilePath: options.profile } : {}
 		});
@@ -16132,6 +16383,7 @@ function createProgram(options = {}) {
 	program.addCommand(createBoundaryCheckCommand(output, options.actions?.boundaryCheck));
 	program.addCommand(createPrVerifyCommand(output));
 	program.addCommand(createProductionImpactCommand(output));
+	program.addCommand(createCandidateImpactCommand(output));
 	program.addCommand(createCloseoutCommand(output));
 	program.addCommand(createEpicPublishStructureCommand(output));
 	program.addCommand(createPrReviewCommand(output, options.actions?.prReview));

package/dist/schemas.d.ts

@@ -113,6 +113,32 @@ interface FollowUpAction {
 declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
 type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
 //#endregion
+//#region src/impact-stamp.d.ts
+/**
+ * The recorded stamp. `targets` satisfies the completeness invariant: every
+ * target the profile declares is present, each with its exact basis — never
+ * silently absent. `basis: "conservative"` means an unmodelled or unprovable
+ * input widened every target to full impact.
+ */
+declare const impactStampSchema: z.ZodObject<{
+  basis: z.ZodEnum<{
+    "target-scoped": "target-scoped";
+    conservative: "conservative";
+  }>;
+  reasons: z.ZodArray<z.ZodString>;
+  stampVersion: z.ZodLiteral<3>;
+  targets: z.ZodArray<z.ZodObject<{
+    basis: z.ZodString;
+    impact: z.ZodEnum<{
+      affected: "affected";
+      "not-affected": "not-affected";
+    }>;
+    name: z.ZodString;
+  }, z.core.$strip>>;
+  unsubscribedPaths: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+type ImpactStamp = z.infer<typeof impactStampSchema>;
+//#endregion
 //#region src/pr-verify-mode.d.ts
 /**
  * The verification mode `pr:verify` resolved for a run.
@@ -484,32 +510,6 @@ interface PrReadyProof {
   waivedDemands?: WaivedDemand[];
 }
 //#endregion
-//#region src/impact-stamp.d.ts
-/**
- * The recorded stamp. `targets` satisfies the completeness invariant: every
- * target the profile declares is present, each with its exact basis — never
- * silently absent. `basis: "conservative"` means an unmodelled or unprovable
- * input widened every target to full impact.
- */
-declare const impactStampSchema: z.ZodObject<{
-  basis: z.ZodEnum<{
-    "target-scoped": "target-scoped";
-    conservative: "conservative";
-  }>;
-  reasons: z.ZodArray<z.ZodString>;
-  stampVersion: z.ZodLiteral<3>;
-  targets: z.ZodArray<z.ZodObject<{
-    basis: z.ZodString;
-    impact: z.ZodEnum<{
-      affected: "affected";
-      "not-affected": "not-affected";
-    }>;
-    name: z.ZodString;
-  }, z.core.$strip>>;
-  unsubscribedPaths: z.ZodArray<z.ZodString>;
-}, z.core.$strip>;
-type ImpactStamp = z.infer<typeof impactStampSchema>;
-//#endregion
 //#region src/pr-readiness/external-evidence.d.ts
 declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   check: z.ZodString;
@@ -950,7 +950,7 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
   boundary: z.ZodOptional<z.ZodString>;
   command: z.ZodLiteral<"patronage-factory boundary:check">;
   coveredSet: z.ZodArray<z.ZodObject<{
-    issue: z.ZodNumber;
+    issue: z.ZodOptional<z.ZodNumber>;
     pr: z.ZodNumber;
     sha: z.ZodString;
     state: z.ZodEnum<{

package/dist/schemas.js

@@ -943,7 +943,7 @@ const boundaryCheckProofSchema = z.object({
 	boundary: z.string().min(1).optional(),
 	command: z.literal("patronage-factory boundary:check"),
 	coveredSet: z.array(z.object({
-		issue: z.number().int().positive(),
+		issue: z.number().int().positive().optional(),
 		pr: z.number().int().positive(),
 		sha: evidenceShaSchema,
 		state: z.enum(["merged", "open"]),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.15",
+  "version": "1.0.0-alpha.16",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,7 @@
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
     "zod": "4.4.3",
-    "@patronage/factory-ci": "1.0.0-alpha.15"
+    "@patronage/factory-ci": "1.0.0-alpha.16"
   },
   "devDependencies": {
     "@types/node": "24.13.3",
@@ -62,7 +62,8 @@
     "prebuild": "bash ../scripts/ensure-worktree-bootstrap.sh",
     "build": "tsdown",
     "boundaries": "node scripts/package-boundaries.mjs",
-    "api:check": "pnpm build && node scripts/public-api-surface.mjs",
+    "api:check": "pnpm build && pnpm api:check:prepared",
+    "api:check:prepared": "node scripts/public-api-surface.mjs",
     "precli": "bash ../scripts/ensure-worktree-bootstrap.sh",
     "cli": "tsx src/index.ts",
     "cleanup:check": "knip --files --dependencies",