@patronage/software-factory 1.0.0-alpha.15 → 1.0.0-alpha.17

package/CONTEXT.md

@@ -20,7 +20,7 @@ The shared Patronage software factory: typed lifecycle state, proof gates, and o
 
 ### Impact
 
-**Impact**: The candidate-bound classification of which declared product targets a changed path or lockfile graph can reach. Path impact is opt-in: a target is affected if and only if a valid changed path matches one of its declared globs. A valid path matched by no target is **unsubscribed** and demands no target-scoped work, while remaining explicit in the stamp basis and human summary. Shared paths affect every target that subscribes to them. Invalid paths and unreadable or malformed required inputs still fail closed. Impact may withdraw target-scoped work; it never certifies a merge target, whose push-triggered verification stays full. Defined by ADR 0027. _Avoid_: affectedness; ownership (the declaration is a subscription, not an implicit filesystem owner).
+**Impact**: The candidate-bound classification of which declared product targets a changed path or lockfile graph can reach. Path impact is opt-in: a target is affected if and only if a valid changed path matches one of its declared globs. A valid path matched by no target is **unsubscribed** and demands no target-scoped work, while remaining explicit in the stamp basis and human summary. A valid path that matches `impact.inert` and no target is **inert-owned**: the stamp records it in `inertPaths`, distinct from `unsubscribedPaths`. A path matching both a target subscription and an inert glob is product-owned and appears in neither list. `pnpm-lock.yaml` is a graph input and is never inert. Shared paths affect every target that subscribes to them. Invalid paths and unreadable or malformed required inputs still fail closed. Impact may withdraw target-scoped work; it never certifies a merge target, whose push-triggered verification stays full. Defined by ADR 0027. _Avoid_: affectedness; implicit filesystem ownership (target `paths` are subscriptions; inert-owned is the explicit `impact.inert` declaration).
 
 ### Planning intake
 

package/README.md

@@ -64,6 +64,8 @@ The repository profile declares its admission policy. Operator-local settings an
 
 Generated production workflows may call `psf production:impact --before <sha> --after <sha> --github-output <path>`. The command recomputes the profile's opt-in impact subscriptions from those exact real commits and emits stable demanded/withdrawn target outputs, the changed-file decision basis, and unsubscribed paths. It only withdraws work: missing, zero, malformed, unreachable, non-ancestral, or otherwise unclassifiable identities leave every known target demanded. The factory owns this decision seam; each consumer owns its deploy jobs, commands, credentials, topology, and post-deploy convergence/no-op proof. Merge-target Verify remains full and does not consult this command.
 
+Generated pull-request workflows may call `psf candidate:impact --base <sha> --head <sha> --github-output <path>` to route Candidate verification surfaces. The command evaluates the same profile impact declarations and pnpm dependency graph from the exact base/head identity, diffed from their merge base; it is the candidate-named sibling of `production:impact` and replaces repository-owned path filters, never adds a second matcher. The `head` commit must be the checked-out `HEAD`, and both commits must be reachable (`fetch-depth: 0`). Every doubt path — unreadable identity, malformed or unsupported graph data, an unowned profile change, a working-tree profile that differs from the head commit, or classifier refusal — fails closed and leaves every declared target demanded. `production:impact` keeps its merge-push `before`/`after` contract unchanged.
+
 For factory workflow, install the four canonical skills from the repository:
 
 ```bash

package/dist/index.d.ts

@@ -285,6 +285,15 @@ interface HqSpoolEntryOutcome {
   detail?: string;
   eventId: string;
   kind: string;
+  /**
+   * `true` when HQ refused the content as schema-invalid (HTTP 422, #739).
+   * The same bytes get the same verdict on every retry under the current
+   * ingest schema, so retrying without a schema change cannot succeed.
+   * Distinct from `undeliverable`: an HQ schema fix can still admit these
+   * bytes, so eviction is an operator decision (`hq:flush --evict-permanent`),
+   * never automatic.
+   */
+  permanent?: boolean;
   spool: string;
   /**
    * `undeliverable` is the one terminal verdict (#445). Every other status
@@ -302,6 +311,13 @@ interface HqSpoolFlushInput {
   clientSecret: string;
   /** The profile's HQ origin; entries recorded against another are refused. */
   endpoint: string;
+  /**
+   * Disposition schema-permanent rejections (HTTP 422) in place with the
+   * `.undeliverable` suffix instead of retaining them (#739). Operator
+   * opt-in: a later HQ schema fix can still admit the same bytes, so the
+   * drain never evicts on its own.
+   */
+  evictPermanentRejections?: boolean;
   /** Operator-named spool directories; replaces the default two locations. */
   explicitDirectories?: string[];
   repository: HqSpoolRepository;
@@ -617,10 +633,82 @@ declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
 declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
 type DiffClassification = (typeof DIFF_CLASSIFICATIONS)[number];
 //#endregion
+//#region src/impact-stamp.d.ts
+/**
+ * The recorded stamp. `targets` satisfies the completeness invariant: every
+ * target the profile declares is present, each with its exact basis — never
+ * silently absent. `basis: "conservative"` means an unmodelled or unprovable
+ * input widened every target to full impact.
+ */
+declare const impactStampSchema: z.ZodObject<{
+  basis: z.ZodEnum<{
+    "target-scoped": "target-scoped";
+    conservative: "conservative";
+  }>;
+  inertPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  reasons: z.ZodArray<z.ZodString>;
+  stampVersion: z.ZodLiteral<3>;
+  targets: z.ZodArray<z.ZodObject<{
+    basis: z.ZodString;
+    impact: z.ZodEnum<{
+      affected: "affected";
+      "not-affected": "not-affected";
+    }>;
+    name: z.ZodString;
+  }, z.core.$strip>>;
+  unsubscribedPaths: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+type ImpactStamp = z.infer<typeof impactStampSchema>;
+/**
+ * The surfaces that consume the stamp. One classification, consumed
+ * everywhere (#430): every surface routes through
+ * {@link impactStampScopeDecision}, so no surface can be more trusting than
+ * another, and no surface re-derives path rules of its own. The value only
+ * selects the wording of the conservative floor a refusal falls back to.
+ */
+declare const IMPACT_SCOPE_SURFACES: {
+  readonly demand: "full demand floor";
+  readonly "preview-lifecycle": "full preview-lifecycle floor";
+  readonly "verification-battery": "full verification-battery floor";
+};
+type ImpactScopeSurface = keyof typeof IMPACT_SCOPE_SURFACES;
+interface ImpactScopeDecision {
+  reason: string;
+  /** True ⇒ this target's work is provably unreachable and may be released. */
+  scoped: boolean;
+}
+/**
+ * Whether a trusted stamp RELEASES one target-scoped unit of work — an
+ * external proof demand (#542 wave 2), a verification-battery command, or a
+ * preview (Alchemy) lifecycle stack (#430 wave 3).
+ *
+ * The only release path is a `target-scoped` stamp of exactly this build's
+ * stamp version whose target entry for exactly this name is provably
+ * `not-affected`. Every other input — no trusted stamp, an unknown stamp
+ * version, a conservative stamp, a name the stamp does not classify, or an
+ * `affected` verdict — keeps today's full-work floor. Work only ever gets
+ * released, never added or satisfied: this function can withdraw a demand, it
+ * can never certify one.
+ *
+ * Identity binding is the CALLER's precondition: pass only a stamp computed
+ * for, or read from a pr:verify proof bound to, the current candidate (see
+ * `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
+ * `undefined` otherwise.
+ */
+declare const impactStampScopeDecision: ({
+  stamp,
+  surface,
+  targetName
+}: {
+  stamp: ImpactStamp | undefined;
+  surface: ImpactScopeSurface;
+  targetName: string;
+}) => ImpactScopeDecision;
+//#endregion
 //#region src/profile.d.ts
 declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
-/** The one profile shape this build accepts (ADR 0023, #318, #351). */
-declare const PROFILE_SCHEMA_VERSION = 5;
+/** The one profile shape this build accepts (ADR 0023, #318, #351, #742). */
+declare const PROFILE_SCHEMA_VERSION = 6;
 declare const factoryProjectProfileSchema: z.ZodObject<{
   $schema: z.ZodOptional<z.ZodString>;
   extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -629,18 +717,13 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     endpoint: z.ZodIntersection<z.ZodString, z.ZodString>;
   }, z.core.$strict>>;
   impact: z.ZodOptional<z.ZodObject<{
+    inert: z.ZodOptional<z.ZodArray<z.ZodString>>;
     targets: z.ZodArray<z.ZodObject<{
       importers: z.ZodArray<z.ZodString>;
       name: z.ZodString;
       paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
   }, z.core.$strict>>;
-  proof: z.ZodObject<{
-    classificationPolicy: z.ZodObject<{
-      docsOnly: z.ZodDefault<z.ZodArray<z.ZodString>>;
-      trivial: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>;
-  }, z.core.$strict>;
   repository: z.ZodObject<{
     name: z.ZodString;
     owner: z.ZodString;
@@ -649,7 +732,6 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     name: z.ZodString;
     scope: z.ZodOptional<z.ZodObject<{
       classifications: z.ZodArray<z.ZodEnum<{
-        trivial: "trivial";
         "docs/process-only": "docs/process-only";
         "non-trivial": "non-trivial";
       }>>;
@@ -660,7 +742,7 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
       paths: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
   }, z.core.$strict>>;
-  schemaVersion: z.ZodLiteral<5>;
+  schemaVersion: z.ZodLiteral<6>;
   verification: z.ZodObject<{
     commands: z.ZodArray<z.ZodObject<{
       command: z.ZodString;
@@ -840,8 +922,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    active: "active";
     stale: "stale";
+    active: "active";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -1217,8 +1299,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
   baseSha: z.ZodString;
   blockingReasons: z.ZodArray<z.ZodString>;
   classification: z.ZodEnum<{
-    trivial: "trivial";
     "docs/process-only": "docs/process-only";
+    trivial: "trivial";
     "non-trivial": "non-trivial";
   }>;
   externalChecks: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -1231,8 +1313,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     reason: z.ZodOptional<z.ZodString>;
     scope: z.ZodOptional<z.ZodObject<{
       classifications: z.ZodArray<z.ZodEnum<{
-        trivial: "trivial";
         "docs/process-only": "docs/process-only";
+        trivial: "trivial";
         "non-trivial": "non-trivial";
       }>>;
     }, z.core.$strict>>;
@@ -1282,15 +1364,15 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       unknown: "unknown";
       critical: "critical";
       high: "high";
-      medium: "medium";
       low: "low";
+      medium: "medium";
     }>>;
     highestOpenSeverity: z.ZodOptional<z.ZodEnum<{
       unknown: "unknown";
       critical: "critical";
       high: "high";
-      medium: "medium";
       low: "low";
+      medium: "medium";
     }>>;
     maxReviewCycles: z.ZodOptional<z.ZodNumber>;
     nonBlockingFindings: z.ZodNumber;
@@ -1318,8 +1400,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     }>;
     stage: z.ZodEnum<{
       gate: "gate";
-      "interior-complete": "interior-complete";
       interior: "interior";
+      "interior-complete": "interior-complete";
     }>;
   }, z.core.$strip>>;
   reviewRuns: z.ZodOptional<z.ZodArray<z.ZodType<PrReviewResult, unknown, z.core.$ZodTypeInternals<PrReviewResult, unknown>>>>;
@@ -1334,10 +1416,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        stale: "stale";
         blocked: "blocked";
         "not-required": "not-required";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1346,10 +1428,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        stale: "stale";
         blocked: "blocked";
         "not-required": "not-required";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -1360,8 +1442,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
     docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
     prVerify: z.ZodEnum<{
-      stale: "stale";
       passed: "passed";
+      stale: "stale";
       missing: "missing";
     }>;
     trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
@@ -1598,84 +1680,13 @@ declare function validatePrReadyProof(value: unknown): PrReadyProof;
 declare function readPrReadyProof(filePath: string): PrReadyProof;
 declare function runPrReady(args: PrReadyArgs, dependencies?: PrReadyDependencies): Promise<PrReadyProof>;
 //#endregion
-//#region src/impact-stamp.d.ts
-/**
- * The recorded stamp. `targets` satisfies the completeness invariant: every
- * target the profile declares is present, each with its exact basis — never
- * silently absent. `basis: "conservative"` means an unmodelled or unprovable
- * input widened every target to full impact.
- */
-declare const impactStampSchema: z.ZodObject<{
-  basis: z.ZodEnum<{
-    "target-scoped": "target-scoped";
-    conservative: "conservative";
-  }>;
-  reasons: z.ZodArray<z.ZodString>;
-  stampVersion: z.ZodLiteral<3>;
-  targets: z.ZodArray<z.ZodObject<{
-    basis: z.ZodString;
-    impact: z.ZodEnum<{
-      affected: "affected";
-      "not-affected": "not-affected";
-    }>;
-    name: z.ZodString;
-  }, z.core.$strip>>;
-  unsubscribedPaths: z.ZodArray<z.ZodString>;
-}, z.core.$strip>;
-type ImpactStamp = z.infer<typeof impactStampSchema>;
-/**
- * The surfaces that consume the stamp. One classification, consumed
- * everywhere (#430): every surface routes through
- * {@link impactStampScopeDecision}, so no surface can be more trusting than
- * another, and no surface re-derives path rules of its own. The value only
- * selects the wording of the conservative floor a refusal falls back to.
- */
-declare const IMPACT_SCOPE_SURFACES: {
-  readonly demand: "full demand floor";
-  readonly "preview-lifecycle": "full preview-lifecycle floor";
-  readonly "verification-battery": "full verification-battery floor";
-};
-type ImpactScopeSurface = keyof typeof IMPACT_SCOPE_SURFACES;
-interface ImpactScopeDecision {
-  reason: string;
-  /** True ⇒ this target's work is provably unreachable and may be released. */
-  scoped: boolean;
-}
-/**
- * Whether a trusted stamp RELEASES one target-scoped unit of work — an
- * external proof demand (#542 wave 2), a verification-battery command, or a
- * preview (Alchemy) lifecycle stack (#430 wave 3).
- *
- * The only release path is a `target-scoped` stamp of exactly this build's
- * stamp version whose target entry for exactly this name is provably
- * `not-affected`. Every other input — no trusted stamp, an unknown stamp
- * version, a conservative stamp, a name the stamp does not classify, or an
- * `affected` verdict — keeps today's full-work floor. Work only ever gets
- * released, never added or satisfied: this function can withdraw a demand, it
- * can never certify one.
- *
- * Identity binding is the CALLER's precondition: pass only a stamp computed
- * for, or read from a pr:verify proof bound to, the current candidate (see
- * `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
- * `undefined` otherwise.
- */
-declare const impactStampScopeDecision: ({
-  stamp,
-  surface,
-  targetName
-}: {
-  stamp: ImpactStamp | undefined;
-  surface: ImpactScopeSurface;
-  targetName: string;
-}) => ImpactScopeDecision;
-//#endregion
 //#region src/required-check-policy.d.ts
 declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
 type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
 declare const requiredCheckScopeSchema: z.ZodObject<{
   classifications: z.ZodArray<z.ZodEnum<{
-    trivial: "trivial";
     "docs/process-only": "docs/process-only";
+    trivial: "trivial";
     "non-trivial": "non-trivial";
   }>>;
 }, z.core.$strict>;
@@ -1863,10 +1874,10 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  stale: "stale";
   blocked: "blocked";
   "not-required": "not-required";
   current: "current";
+  stale: "stale";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -2009,6 +2020,16 @@ interface PrVerifyNotRequiredCommand {
   impactTarget: string;
   name: string;
 }
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — the field is v4-only (the same
+ * window that can carry `impactStamp`) and refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
+}
 interface PrVerifyProof {
   schemaVersion: PrVerifySchemaVersion;
   authoringSession?: string;
@@ -2032,6 +2053,7 @@ interface PrVerifyProof {
   impactStamp?: ImpactStamp;
   mode: ResolvedPrVerifyMode;
   mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
   notRequiredCommands?: PrVerifyNotRequiredCommand[];
   outcome?: "aborted" | "passed";
   patchId?: string;
@@ -2050,7 +2072,7 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
   boundary: z.ZodOptional<z.ZodString>;
   command: z.ZodLiteral<"patronage-factory boundary:check">;
   coveredSet: z.ZodArray<z.ZodObject<{
-    issue: z.ZodNumber;
+    issue: z.ZodOptional<z.ZodNumber>;
     pr: z.ZodNumber;
     sha: z.ZodString;
     state: z.ZodEnum<{
@@ -2093,8 +2115,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     value: z.ZodString;
   }, z.core.$strip>>;
   status: z.ZodEnum<{
-    blocked: "blocked";
     ready: "ready";
+    blocked: "blocked";
   }>;
 }, z.core.$strip>;
 type BoundaryCheckProofRecord = z.infer<typeof boundaryCheckProofSchema>;
@@ -2216,7 +2238,7 @@ interface PrReviewDependencies {
 }
 declare function runPrReview(args: PrReviewArgs, dependencies?: PrReviewDependencies): Promise<PrReviewProof>;
 declare namespace verification_proof_d_exports {
-  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
+  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
 }
 interface VerifiedHeadShas {
   docsOnlyVerifiedHeadShas: string[];
@@ -2372,7 +2394,7 @@ interface CleanInstallResolutionDependencies {
 }
 //#endregion
 //#region src/pr-verify.d.ts
-type PrVerifyMode = "auto" | "docs-only" | "trivial" | "full";
+type PrVerifyMode = "auto" | "docs-only" | "full";
 interface VerificationCommandOutcome {
   counts?: {
     testFiles?: number;
@@ -3218,8 +3240,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
       high: "high";
-      medium: "medium";
       low: "low";
+      medium: "medium";
       xhigh: "xhigh";
     }>;
     engine: z.ZodString;
@@ -3297,8 +3319,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
       high: "high";
-      medium: "medium";
       low: "low";
+      medium: "medium";
       xhigh: "xhigh";
     }>;
     engine: z.ZodString;
@@ -3367,8 +3389,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     slotResolution: z.ZodObject<{
       effort: z.ZodEnum<{
         high: "high";
-        medium: "medium";
         low: "low";
+        medium: "medium";
         xhigh: "xhigh";
       }>;
       engine: z.ZodString;
@@ -3436,7 +3458,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   observedAt: string;
   purpose: "review" | "code";
   slotResolution: {
-    effort: "high" | "medium" | "low" | "xhigh";
+    effort: "high" | "low" | "medium" | "xhigh";
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
@@ -3761,7 +3783,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
   ledger: {
     baseSha: string;
     blockingReasons: string[];
-    classification: "trivial" | "docs/process-only" | "non-trivial";
+    classification: "docs/process-only" | "trivial" | "non-trivial";
     github: {
       draft: boolean;
       mergeStateStatus: string;
@@ -3781,13 +3803,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "stale" | "blocked" | "not-required" | "current" | "missing";
+        status: "blocked" | "not-required" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "stale" | "blocked" | "not-required" | "current" | "missing";
+        status: "blocked" | "not-required" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -3795,7 +3817,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     schemaVersion: 1;
     verification: {
       command: "patronage-factory pr:verify";
-      prVerify: "stale" | "passed" | "missing";
+      prVerify: "passed" | "stale" | "missing";
       docsOnlyDeltaAccepted?: boolean | undefined;
       docsOnlyVerifiedHeadSha?: string | undefined;
       trivialDeltaAccepted?: boolean | undefined;
@@ -3810,7 +3832,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       status: "satisfied" | "unmet" | "out-of-scope";
       reason?: string | undefined;
       scope?: {
-        classifications: ("trivial" | "docs/process-only" | "non-trivial")[];
+        classifications: ("docs/process-only" | "trivial" | "non-trivial")[];
       } | undefined;
     }[] | undefined;
     mergeBaseSha?: string | undefined;
@@ -3826,8 +3848,8 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       nonBlockingFindings: number;
       openFindings: number;
       windowExhausted: boolean;
-      highestBlockingSeverity?: "unknown" | "critical" | "high" | "medium" | "low" | undefined;
-      highestOpenSeverity?: "unknown" | "critical" | "high" | "medium" | "low" | undefined;
+      highestBlockingSeverity?: "unknown" | "critical" | "high" | "low" | "medium" | undefined;
+      highestOpenSeverity?: "unknown" | "critical" | "high" | "low" | "medium" | undefined;
       maxReviewCycles?: number | undefined;
       reviewCycle?: number | undefined;
       staleRepeatFindings?: number | undefined;
@@ -3838,7 +3860,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "gate" | "interior-complete" | "interior";
+      stage: "gate" | "interior" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;
@@ -4163,6 +4185,34 @@ declare const appendReviewLadderStageTraceEvent: ({
 }) => AppendFactoryTraceEventResult;
 declare const tryAppendReviewLadderStageTraceEvent: (input: Parameters<typeof appendReviewLadderStageTraceEvent>[0]) => ReviewLadderStageTraceWriteResult;
 //#endregion
+//#region src/verification-run-context.d.ts
+declare const FACTORY_BASE_REF_ENV = "FACTORY_BASE_REF";
+declare const FACTORY_CHANGED_FILES_ENV = "FACTORY_CHANGED_FILES";
+declare const FACTORY_CHANGED_FILES_FILE_ENV = "FACTORY_CHANGED_FILES_FILE";
+declare const EMPTY_TREE_OBJECT_HASH = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+declare const DEFAULT_ROOT_SHARED_GLOBS: string[];
+interface VerificationRunContextInput {
+  baseRef: string;
+  changedFiles: string[];
+  fullSuiteBaseRef?: string;
+  rootSharedGlobs?: string[];
+  inlineLimitBytes?: number;
+  tmpDir?: string;
+}
+interface VerificationEnv {
+  env: Record<string, string>;
+  cleanup: () => void;
+}
+interface VerificationRunContext {
+  readonly baseRef: string;
+  readonly changedFiles: string[];
+  readonly forcesFullSuite: boolean;
+  readonly fullSuiteReasons: string[];
+  buildEnv: () => VerificationEnv;
+  runSummaryLines: () => string[];
+}
+declare function createVerificationRunContext(input: VerificationRunContextInput): VerificationRunContext;
+//#endregion
 //#region src/verification-battery.d.ts
 type BatteryDisposition = "executed" | "not-required";
 /**
@@ -4359,4 +4409,4 @@ interface CreateProgramOptions {
 declare function createProgram(options?: CreateProgramOptions): Command;
 declare function run(argv?: string[]): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };