@patronage/software-factory 1.0.0-alpha.16 → 1.0.0-alpha.17

package/CONTEXT.md

@@ -20,7 +20,7 @@ The shared Patronage software factory: typed lifecycle state, proof gates, and o
 
 ### Impact
 
-**Impact**: The candidate-bound classification of which declared product targets a changed path or lockfile graph can reach. Path impact is opt-in: a target is affected if and only if a valid changed path matches one of its declared globs. A valid path matched by no target is **unsubscribed** and demands no target-scoped work, while remaining explicit in the stamp basis and human summary. Shared paths affect every target that subscribes to them. Invalid paths and unreadable or malformed required inputs still fail closed. Impact may withdraw target-scoped work; it never certifies a merge target, whose push-triggered verification stays full. Defined by ADR 0027. _Avoid_: affectedness; ownership (the declaration is a subscription, not an implicit filesystem owner).
+**Impact**: The candidate-bound classification of which declared product targets a changed path or lockfile graph can reach. Path impact is opt-in: a target is affected if and only if a valid changed path matches one of its declared globs. A valid path matched by no target is **unsubscribed** and demands no target-scoped work, while remaining explicit in the stamp basis and human summary. A valid path that matches `impact.inert` and no target is **inert-owned**: the stamp records it in `inertPaths`, distinct from `unsubscribedPaths`. A path matching both a target subscription and an inert glob is product-owned and appears in neither list. `pnpm-lock.yaml` is a graph input and is never inert. Shared paths affect every target that subscribes to them. Invalid paths and unreadable or malformed required inputs still fail closed. Impact may withdraw target-scoped work; it never certifies a merge target, whose push-triggered verification stays full. Defined by ADR 0027. _Avoid_: affectedness; implicit filesystem ownership (target `paths` are subscriptions; inert-owned is the explicit `impact.inert` declaration).
 
 ### Planning intake
 

package/dist/index.d.ts

@@ -16,8 +16,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -35,8 +35,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -45,8 +45,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -64,8 +64,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -126,8 +126,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
     mergedSha: z.ZodOptional<z.ZodString>;
     pr: z.ZodNumber;
     state: z.ZodEnum<{
-      merged: "merged";
       open: "open";
+      merged: "merged";
     }>;
     wave: z.ZodOptional<z.ZodString>;
   }, z.core.$loose>>;
@@ -150,8 +150,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -170,8 +170,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
     mergedSha: z.ZodOptional<z.ZodString>;
     pr: z.ZodNumber;
     state: z.ZodEnum<{
-      merged: "merged";
       open: "open";
+      merged: "merged";
     }>;
     wave: z.ZodOptional<z.ZodString>;
   }, z.core.$loose>>;
@@ -194,8 +194,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -645,6 +645,7 @@ declare const impactStampSchema: z.ZodObject<{
     "target-scoped": "target-scoped";
     conservative: "conservative";
   }>;
+  inertPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
   reasons: z.ZodArray<z.ZodString>;
   stampVersion: z.ZodLiteral<3>;
   targets: z.ZodArray<z.ZodObject<{
@@ -732,7 +733,6 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
     scope: z.ZodOptional<z.ZodObject<{
       classifications: z.ZodArray<z.ZodEnum<{
         "docs/process-only": "docs/process-only";
-        trivial: "trivial";
         "non-trivial": "non-trivial";
       }>>;
     }, z.core.$strict>>;
@@ -922,8 +922,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    active: "active";
     stale: "stale";
+    active: "active";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -1416,10 +1416,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        stale: "stale";
         blocked: "blocked";
         "not-required": "not-required";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1428,10 +1428,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        stale: "stale";
         blocked: "blocked";
         "not-required": "not-required";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -1442,8 +1442,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     docsOnlyDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
     docsOnlyVerifiedHeadSha: z.ZodOptional<z.ZodString>;
     prVerify: z.ZodEnum<{
-      stale: "stale";
       passed: "passed";
+      stale: "stale";
       missing: "missing";
     }>;
     trivialDeltaAccepted: z.ZodOptional<z.ZodBoolean>;
@@ -1743,8 +1743,8 @@ declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -1770,8 +1770,8 @@ declare const evidenceEnvelopeSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -1874,10 +1874,10 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  stale: "stale";
   blocked: "blocked";
   "not-required": "not-required";
   current: "current";
+  stale: "stale";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -2020,6 +2020,16 @@ interface PrVerifyNotRequiredCommand {
   impactTarget: string;
   name: string;
 }
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — the field is v4-only (the same
+ * window that can carry `impactStamp`) and refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
+}
 interface PrVerifyProof {
   schemaVersion: PrVerifySchemaVersion;
   authoringSession?: string;
@@ -2043,6 +2053,7 @@ interface PrVerifyProof {
   impactStamp?: ImpactStamp;
   mode: ResolvedPrVerifyMode;
   mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
   notRequiredCommands?: PrVerifyNotRequiredCommand[];
   outcome?: "aborted" | "passed";
   patchId?: string;
@@ -2065,14 +2076,14 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     pr: z.ZodNumber;
     sha: z.ZodString;
     state: z.ZodEnum<{
-      merged: "merged";
       open: "open";
+      merged: "merged";
     }>;
     wave: z.ZodString;
   }, z.core.$strip>>;
   demandedRung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   epicIssue: z.ZodNumber;
@@ -2087,8 +2098,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     commentUrl: z.ZodOptional<z.ZodString>;
     producer: z.ZodString;
     rung: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
     sessionId: z.ZodOptional<z.ZodString>;
@@ -2227,7 +2238,7 @@ interface PrReviewDependencies {
 }
 declare function runPrReview(args: PrReviewArgs, dependencies?: PrReviewDependencies): Promise<PrReviewProof>;
 declare namespace verification_proof_d_exports {
-  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
+  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
 }
 interface VerifiedHeadShas {
   docsOnlyVerifiedHeadShas: string[];
@@ -2383,7 +2394,7 @@ interface CleanInstallResolutionDependencies {
 }
 //#endregion
 //#region src/pr-verify.d.ts
-type PrVerifyMode = "auto" | "docs-only" | "trivial" | "full";
+type PrVerifyMode = "auto" | "docs-only" | "full";
 interface VerificationCommandOutcome {
   counts?: {
     testFiles?: number;
@@ -3223,8 +3234,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    code: "code";
     review: "review";
+    code: "code";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
@@ -3242,18 +3253,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
   }, z.core.$strict>;
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
-    oracle: "oracle";
     review: "review";
     delegate: "delegate";
+    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3302,8 +3313,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    code: "code";
     review: "review";
+    code: "code";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
@@ -3321,18 +3332,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
   }, z.core.$strict>;
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
-    oracle: "oracle";
     review: "review";
     delegate: "delegate";
+    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3372,8 +3383,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     interiorCycle: z.ZodOptional<z.ZodNumber>;
     observedAt: z.ZodString;
     purpose: z.ZodEnum<{
-      code: "code";
       review: "review";
+      code: "code";
     }>;
     slotResolution: z.ZodObject<{
       effort: z.ZodEnum<{
@@ -3391,18 +3402,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       }>;
       model: z.ZodString;
       tier: z.ZodEnum<{
-        oracle: "oracle";
         review: "review";
         delegate: "delegate";
+        oracle: "oracle";
         workhorse: "workhorse";
         scout: "scout";
       }>;
     }, z.core.$strict>;
     startedAt: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3445,17 +3456,17 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   exitCode: number | null;
   harness: string;
   observedAt: string;
-  purpose: "code" | "review";
+  purpose: "review" | "code";
   slotResolution: {
     effort: "high" | "low" | "medium" | "xhigh";
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
-    tier: "oracle" | "review" | "delegate" | "workhorse" | "scout";
+    tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
     fallbackTier?: "delegate" | undefined;
   };
   startedAt: string;
-  tier: "oracle" | "review" | "delegate" | "workhorse" | "scout";
+  tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
   tokenUsage: {
     source: "cursor-csv" | "codex-json" | "cursor-json" | "claude-json";
     status: "available";
@@ -3792,13 +3803,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "stale" | "blocked" | "not-required" | "current" | "missing";
+        status: "blocked" | "not-required" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "stale" | "blocked" | "not-required" | "current" | "missing";
+        status: "blocked" | "not-required" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -3806,7 +3817,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     schemaVersion: 1;
     verification: {
       command: "patronage-factory pr:verify";
-      prVerify: "stale" | "passed" | "missing";
+      prVerify: "passed" | "stale" | "missing";
       docsOnlyDeltaAccepted?: boolean | undefined;
       docsOnlyVerifiedHeadSha?: string | undefined;
       trivialDeltaAccepted?: boolean | undefined;
@@ -4174,6 +4185,34 @@ declare const appendReviewLadderStageTraceEvent: ({
 }) => AppendFactoryTraceEventResult;
 declare const tryAppendReviewLadderStageTraceEvent: (input: Parameters<typeof appendReviewLadderStageTraceEvent>[0]) => ReviewLadderStageTraceWriteResult;
 //#endregion
+//#region src/verification-run-context.d.ts
+declare const FACTORY_BASE_REF_ENV = "FACTORY_BASE_REF";
+declare const FACTORY_CHANGED_FILES_ENV = "FACTORY_CHANGED_FILES";
+declare const FACTORY_CHANGED_FILES_FILE_ENV = "FACTORY_CHANGED_FILES_FILE";
+declare const EMPTY_TREE_OBJECT_HASH = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+declare const DEFAULT_ROOT_SHARED_GLOBS: string[];
+interface VerificationRunContextInput {
+  baseRef: string;
+  changedFiles: string[];
+  fullSuiteBaseRef?: string;
+  rootSharedGlobs?: string[];
+  inlineLimitBytes?: number;
+  tmpDir?: string;
+}
+interface VerificationEnv {
+  env: Record<string, string>;
+  cleanup: () => void;
+}
+interface VerificationRunContext {
+  readonly baseRef: string;
+  readonly changedFiles: string[];
+  readonly forcesFullSuite: boolean;
+  readonly fullSuiteReasons: string[];
+  buildEnv: () => VerificationEnv;
+  runSummaryLines: () => string[];
+}
+declare function createVerificationRunContext(input: VerificationRunContextInput): VerificationRunContext;
+//#endregion
 //#region src/verification-battery.d.ts
 type BatteryDisposition = "executed" | "not-required";
 /**
@@ -4370,4 +4409,4 @@ interface CreateProgramOptions {
 declare function createProgram(options?: CreateProgramOptions): Command;
 declare function run(argv?: string[]): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };

package/dist/index.js

@@ -4,7 +4,7 @@ import { appendFileSync, constants, cpSync, existsSync, mkdirSync, mkdtempSync,
 import { pathToFileURL } from "node:url";
 import { Command, InvalidArgumentError } from "commander";
 import path from "node:path";
-import crypto, { createHash, randomUUID } from "node:crypto";
+import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { execFileSync, spawnSync } from "node:child_process";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
@@ -17,7 +17,7 @@ import { parse } from "yaml";
 import { FACTORY_PROOF_GATE_STEP_NAME, GitHubApiError, mintInstallationToken, productionImpactTargetOutput, readVitestProfileDocument } from "@patronage/factory-ci";
 import { promisify } from "node:util";
 //#region package.json
-var version = "1.0.0-alpha.16";
+var version = "1.0.0-alpha.17";
 //#endregion
 //#region src/review-rungs.ts
 const EVIDENCE_REVIEW_RUNGS$1 = [
@@ -1178,9 +1178,10 @@ const hqIngestConfigSchema = z.object({
 		}
 	}, "Must be an HTTPS origin without a path, query, fragment, or embedded credentials").describe("Repository-declared HQ origin (scheme and host only; the factory composes the ingest path). Credential delivery additionally requires exact-origin authorization in the operator user config hqAllowedOrigins list.")
 }).strict();
+const profileRequiredCheckScopeSchema = requiredCheckScopeSchema$1.extend({ classifications: z.array(z.enum(["docs/process-only", "non-trivial"])).min(1) }).strict();
 const requiredCheckSchema = z.object({
 	name: z.string().min(1),
-	scope: requiredCheckScopeSchema$1.optional()
+	scope: profileRequiredCheckScopeSchema.optional()
 }).strict();
 const impactTargetSchema = z.object({
 	importers: z.array(z.string().min(1)).min(1),
@@ -1212,15 +1213,6 @@ const factoryProjectProfileSchema = z.object({
 			code: "custom",
 			message: "requiredChecks entries must have distinct names."
 		});
-		for (const [index, check] of checks.entries()) if (check.scope?.classifications.includes("trivial")) context.addIssue({
-			code: "custom",
-			message: `requiredChecks entry "${check.name}" scopes on classification "trivial", which the classifier no longer produces (#742); scope on "docs/process-only" or "non-trivial".`,
-			path: [
-				index,
-				"scope",
-				"classifications"
-			]
-		});
 	}).optional(),
 	review: z.object({ conditional: z.array(conditionalReviewSchema).min(1) }).strict().optional(),
 	schemaVersion: z.literal(6),
@@ -3797,6 +3789,7 @@ const impactStampTargetSchema = z.object({
 */
 const impactStampSchema = z.object({
 	basis: z.enum(["target-scoped", "conservative"]),
+	inertPaths: z.array(z.string()).default([]),
 	reasons: z.array(z.string()),
 	stampVersion: z.literal(3),
 	targets: z.array(impactStampTargetSchema).superRefine((targets, context) => {
@@ -3813,6 +3806,11 @@ const unsubscribedPathsLine = (paths, reason = "legacy or malformed stamp") => {
 	if (!Array.isArray(paths) || paths.some((one) => typeof one !== "string")) return `Unsubscribed changed paths: unavailable (${reason}).`;
 	return paths.length === 0 ? "Unsubscribed changed paths: none." : `Unsubscribed changed paths (demand no target): ${paths.join(", ")}.`;
 };
+/** The one inert-owned path line (#761): candidate-impact console and summary. */
+const inertPathsLine = (paths, reason = "legacy or malformed stamp") => {
+	if (!Array.isArray(paths) || paths.some((one) => typeof one !== "string")) return `Inert-owned changed paths: unavailable (${reason}).`;
+	return paths.length === 0 ? "Inert-owned changed paths: none." : `Inert-owned changed paths: ${paths.join(", ")}.`;
+};
 /** Human-readable lines for every impact decision, including quiet releases. */
 const impactStampSummaryLines = (stamp) => [`Impact stamp: ${stamp.basis}; ${stamp.targets.filter(({ impact }) => impact === "affected").length}/${stamp.targets.length} target(s) affected.`, unsubscribedPathsLine(stamp.unsubscribedPaths)];
 /**
@@ -3907,8 +3905,9 @@ const impactStampDemandRelease = ({ checkName, stamp }) => {
 * every doubt path lands on, and the stamp a producer must fall back to if
 * stamp computation itself fails for any reason.
 */
-const conservativeImpactStamp = (targets, reasons, unsubscribedPaths = []) => ({
+const conservativeImpactStamp = (targets, reasons, unsubscribedPaths = [], inertPaths = []) => ({
 	basis: "conservative",
+	inertPaths,
 	reasons,
 	stampVersion: 3,
 	targets: targets.map((target) => ({
@@ -4048,9 +4047,13 @@ const targetImpactForLockfileDelta = (target, delta) => {
 * as affected/not-affected with its exact basis. `not-affected` is only ever
 * returned only when every changed input is a valid source path or an
 * analyzable pnpm-lock.yaml (v9) delta. Source and lockfile reachability are
-* unioned per target. A valid source path matched by no target is recorded in
-* `unsubscribedPaths` and affects none. Invalid, unreadable, unsupported, or
-* otherwise doubtful input widens the whole stamp to full impact.
+* unioned per target. A valid source path matched by a target subscription is
+* product-owned and appears in neither path list. A valid source path matching
+* `impact.inert` and no target is recorded in `inertPaths`. A valid source
+* path with no declared owner is recorded in `unsubscribedPaths`.
+* `pnpm-lock.yaml` is a graph input and is never inert. Invalid, unreadable,
+* unsupported, or otherwise doubtful input widens the whole stamp to full
+* impact.
 *
 * Total by contract: this function never throws. Any unexpected failure in
 * reading, parsing, or traversal is itself a doubt path and returns the
@@ -4116,7 +4119,27 @@ const assertDeclaredImporterRoots = (targets, sides) => {
 const assertDeclaredPathGlobs = (targets) => {
 	for (const target of targets) for (const pattern of target.paths ?? []) if (!isValidRepoRelativeGlob(pattern)) throw new ImpactStampConfigError(`impact target "${target.name}" declares invalid repo-relative path glob "${pattern}"; fix the profile's impact.targets declaration`);
 };
-const analyzeSourcePaths = (sourceFiles, targets, profilePath) => {
+const assertDeclaredInertGlobs = (inert) => {
+	for (const pattern of inert) if (!isValidRepoRelativeGlob(pattern)) throw new ImpactStampConfigError(`impact.inert declares invalid repo-relative path glob "${pattern}"; fix the profile's impact.inert declaration`);
+};
+const matchesTargetSubscription = (targets, file) => targets.some((target) => matchesAnyGlob(target.paths ?? [], file));
+const partitionUnownedSourcePaths = (sourceFiles, targets, inertGlobs) => {
+	const inertPaths = [];
+	const unsubscribedPaths = [];
+	for (const file of sourceFiles) {
+		if (file === "pnpm-lock.yaml" || matchesTargetSubscription(targets, file)) continue;
+		if (matchesAnyGlob(inertGlobs, file)) {
+			inertPaths.push(file);
+			continue;
+		}
+		unsubscribedPaths.push(file);
+	}
+	return {
+		inertPaths,
+		unsubscribedPaths
+	};
+};
+const analyzeSourcePaths = (sourceFiles, targets, profilePath, inertGlobs) => {
 	for (const file of sourceFiles) {
 		if (!isRepoRelativePath(file)) return {
 			kind: "conservative",
@@ -4129,6 +4152,7 @@ const analyzeSourcePaths = (sourceFiles, targets, profilePath) => {
 	}
 	return {
 		kind: "ok",
+		...partitionUnownedSourcePaths(sourceFiles, targets, inertGlobs),
 		targets: targets.map((target) => {
 			const matched = sourceFiles.find((file) => matchesAnyGlob(target.paths ?? [], file));
 			return matched === void 0 ? {
@@ -4140,8 +4164,7 @@ const analyzeSourcePaths = (sourceFiles, targets, profilePath) => {
 				impact: "affected",
 				name: target.name
 			};
-		}),
-		unsubscribedPaths: sourceFiles.filter((file) => !targets.some((target) => matchesAnyGlob(target.paths ?? [], file)))
+		})
 	};
 };
 const unionTargetImpact = (source, lockfile) => {
@@ -4153,34 +4176,41 @@ const unionTargetImpact = (source, lockfile) => {
 		name: source.name
 	};
 };
-const computeImpactStampOrThrow = ({ changedFiles, profilePath = "software-factory.profile.json", readLockfile }, targets) => {
-	if (targets.length === 0) return {
-		basis: "conservative",
-		reasons: ["no impact targets declared in the profile; every surface keeps full demand"],
-		stampVersion: 3,
-		targets: [],
-		unsubscribedPaths: changedFiles.filter((file) => file !== "pnpm-lock.yaml" && isRepoRelativePath(file))
-	};
+const computeImpactStampOrThrow = ({ changedFiles, profile, profilePath = "software-factory.profile.json", readLockfile }, targets) => {
+	const inertGlobs = profile.impact?.inert ?? [];
+	assertDeclaredInertGlobs(inertGlobs);
+	if (targets.length === 0) {
+		const { inertPaths, unsubscribedPaths } = partitionUnownedSourcePaths(changedFiles.filter((file) => file !== "pnpm-lock.yaml" && isRepoRelativePath(file)), [], inertGlobs);
+		return {
+			basis: "conservative",
+			inertPaths,
+			reasons: ["no impact targets declared in the profile; every surface keeps full demand"],
+			stampVersion: 3,
+			targets: [],
+			unsubscribedPaths
+		};
+	}
 	assertDeclaredPathGlobs(targets);
 	const sides = readLockfileSides(readLockfile);
 	if (sides.kind === "ok") assertDeclaredImporterRoots(targets, sides.parsed);
 	if (changedFiles.length === 0) return conservativeImpactStamp(targets, ["no changed files detected; full impact assumed"]);
 	const sourceFiles = changedFiles.filter((file) => file !== LOCKFILE_PATH);
-	const source = analyzeSourcePaths(sourceFiles, targets, profilePath);
+	const source = analyzeSourcePaths(sourceFiles, targets, profilePath, inertGlobs);
 	if (source.kind === "conservative") return conservativeImpactStamp(targets, [source.reason]);
-	if (sides.kind === "threw") return conservativeImpactStamp(targets, [`impact stamp computation failed (${sides.error instanceof Error ? sides.error.message : String(sides.error)}); fail closed to full impact`], source.unsubscribedPaths);
-	if (sides.kind === "unreadable") return conservativeImpactStamp(targets, [`pnpm-lock.yaml is unreadable at the ${sides.side} side; fail closed to full impact`], source.unsubscribedPaths);
-	if (sides.kind === "unparseable") return conservativeImpactStamp(targets, [`pnpm-lock.yaml is unparseable or structurally malformed at the ${sides.side} side; fail closed to full impact`], source.unsubscribedPaths);
-	if (sides.kind === "unsupported-version") return conservativeImpactStamp(targets, [`pnpm-lock.yaml is not lockfileVersion ${SUPPORTED_LOCKFILE_VERSION}; only pnpm v9 lockfiles are modelled; fail closed to full impact`], source.unsubscribedPaths);
+	if (sides.kind === "threw") return conservativeImpactStamp(targets, [`impact stamp computation failed (${sides.error instanceof Error ? sides.error.message : String(sides.error)}); fail closed to full impact`], source.unsubscribedPaths, source.inertPaths);
+	if (sides.kind === "unreadable") return conservativeImpactStamp(targets, [`pnpm-lock.yaml is unreadable at the ${sides.side} side; fail closed to full impact`], source.unsubscribedPaths, source.inertPaths);
+	if (sides.kind === "unparseable") return conservativeImpactStamp(targets, [`pnpm-lock.yaml is unparseable or structurally malformed at the ${sides.side} side; fail closed to full impact`], source.unsubscribedPaths, source.inertPaths);
+	if (sides.kind === "unsupported-version") return conservativeImpactStamp(targets, [`pnpm-lock.yaml is not lockfileVersion ${SUPPORTED_LOCKFILE_VERSION}; only pnpm v9 lockfiles are modelled; fail closed to full impact`], source.unsubscribedPaths, source.inertPaths);
 	if (!changedFiles.includes("pnpm-lock.yaml")) return {
 		basis: "target-scoped",
-		reasons: [source.unsubscribedPaths.length === 0 ? "all changed source paths match at least one declared target subscription; impact scoped by repo-relative path globs" : `${source.unsubscribedPaths.length} changed source path(s) match no declared target subscription and affect no target`],
+		inertPaths: source.inertPaths,
+		reasons: [source.unsubscribedPaths.length === 0 ? "all changed source paths have a declared owner (target subscription or impact.inert); impact scoped by repo-relative path globs" : `${source.unsubscribedPaths.length} changed source path(s) match no declared target subscription and affect no target`],
 		stampVersion: 3,
 		targets: source.targets,
 		unsubscribedPaths: source.unsubscribedPaths
 	};
 	const [baseLock, headLock] = sides.parsed;
-	if (stableStringify$1(nonGraphSections(baseLock)) !== stableStringify$1(nonGraphSections(headLock))) return conservativeImpactStamp(targets, ["pnpm-lock.yaml delta touches sections outside importers/packages/snapshots (e.g. settings, overrides, patchedDependencies); fail closed to full impact"], source.unsubscribedPaths);
+	if (stableStringify$1(nonGraphSections(baseLock)) !== stableStringify$1(nonGraphSections(headLock))) return conservativeImpactStamp(targets, ["pnpm-lock.yaml delta touches sections outside importers/packages/snapshots (e.g. settings, overrides, patchedDependencies); fail closed to full impact"], source.unsubscribedPaths, source.inertPaths);
 	const delta = {
 		changedImporters: changedSectionKeys(baseLock.importers, headLock.importers),
 		changedPackages: changedSectionKeys(baseLock.packages, headLock.packages),
@@ -4191,7 +4221,8 @@ const computeImpactStampOrThrow = ({ changedFiles, profilePath = "software-facto
 	const mixed = sourceFiles.length > 0;
 	return {
 		basis: "target-scoped",
-		reasons: mixed ? [source.unsubscribedPaths.length === 0 ? "all changed source paths match at least one declared target subscription and pnpm-lock.yaml is analyzable; impact is the union of path subscriptions and importer/snapshot graph analysis" : `${source.unsubscribedPaths.length} changed source path(s) match no declared target subscription; subscribed path impact is unioned with importer/snapshot graph analysis`] : ["pnpm-lock.yaml is the only changed file; impact scoped by importer/snapshot graph analysis"],
+		inertPaths: source.inertPaths,
+		reasons: mixed ? [source.unsubscribedPaths.length === 0 ? "all changed source paths have a declared owner (target subscription or impact.inert) and pnpm-lock.yaml is analyzable; impact is the union of path subscriptions and importer/snapshot graph analysis" : `${source.unsubscribedPaths.length} changed source path(s) match no declared target subscription; subscribed path impact is unioned with importer/snapshot graph analysis`] : ["pnpm-lock.yaml is the only changed file; impact scoped by importer/snapshot graph analysis"],
 		stampVersion: 3,
 		targets: mixed ? source.targets.map((sourceTarget, index) => unionTargetImpact(sourceTarget, lockfileTargets[index])) : lockfileTargets,
 		unsubscribedPaths: source.unsubscribedPaths
@@ -4455,6 +4486,16 @@ const assertPrVerifyProofRules = (proof, context) => {
 		message: "notRequiredCommands is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
 		path: ["notRequiredCommands"]
 	});
+	if (proof.schemaVersion < 4 && proof.notDemandedRecords !== void 0) context.addIssue({
+		code: "custom",
+		message: "notDemandedRecords is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["notDemandedRecords"]
+	});
+	if (proof.notDemandedRecords !== void 0 && proof.impactStamp === void 0) context.addIssue({
+		code: "custom",
+		message: "notDemandedRecords requires impactStamp; package-level not-demanded records are bound to the stamp identity.",
+		path: ["notDemandedRecords"]
+	});
 	assertBatteryCompleteness(proof, context);
 	assertNotRequiredStampAuthorization(proof, context);
 };
@@ -4487,6 +4528,10 @@ const notRequiredCommandSchema = z.object({
 	impactTarget: z.string().min(1),
 	name: z.string().min(1)
 });
+const notDemandedRecordSchema = z.object({
+	basis: z.string().min(1),
+	name: z.string().min(1)
+});
 const prVerifySchemaVersionSchema = z.number().refine((value) => SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.includes(value), { message: `schemaVersion must be one of: ${SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.join(", ")}` });
 const prVerifyProofSchema = z.object({
 	authoringSession: z.string().trim().min(1).optional(),
@@ -4518,6 +4563,7 @@ const prVerifyProofSchema = z.object({
 		"trivial",
 		"full"
 	]),
+	notDemandedRecords: z.array(notDemandedRecordSchema).min(1).optional(),
 	notRequiredCommands: z.array(notRequiredCommandSchema).min(1).optional(),
 	outcome: z.enum(["aborted", "passed"]).optional(),
 	patchId: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
@@ -6004,6 +6050,84 @@ function createBoundaryCheckCommand(output, action) {
 		if (record.status !== "ready") throw new Error(`boundary:check refused: ${record.blockingReasons.join("; ")}`);
 	})));
 }
+//#endregion
+//#region src/verification-run-context.ts
+const FACTORY_BASE_REF_ENV = "FACTORY_BASE_REF";
+const FACTORY_CHANGED_FILES_ENV = "FACTORY_CHANGED_FILES";
+const FACTORY_CHANGED_FILES_FILE_ENV = "FACTORY_CHANGED_FILES_FILE";
+const DEFAULT_CHANGED_FILES_INLINE_LIMIT_BYTES = 1e5;
+const EMPTY_TREE_OBJECT_HASH = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+const DEFAULT_ROOT_SHARED_GLOBS = [
+	"pnpm-lock.yaml",
+	"package-lock.json",
+	"yarn.lock",
+	"bun.lockb",
+	"pnpm-workspace.yaml",
+	"package.json",
+	"tsconfig*.json",
+	"*.config.*",
+	".npmrc",
+	".nvmrc"
+];
+function fullSuiteReasonForFile(file) {
+	return `${file}: root/shared change forces full suite`;
+}
+function noopCleanup() {}
+function createVerificationRunContext(input) {
+	const rootSharedGlobs = input.rootSharedGlobs ?? DEFAULT_ROOT_SHARED_GLOBS;
+	const fullSuiteBaseRef = input.fullSuiteBaseRef ?? "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+	const inlineLimitBytes = input.inlineLimitBytes ?? DEFAULT_CHANGED_FILES_INLINE_LIMIT_BYTES;
+	const tmpDir = input.tmpDir ?? os.tmpdir();
+	const matchingFiles = input.changedFiles.filter((file) => matchesAnyGlob(rootSharedGlobs, file));
+	const forcesFullSuite = matchingFiles.length > 0 || input.changedFiles.length === 0;
+	const fullSuiteReasons = input.changedFiles.length === 0 ? ["no changed files detected; forcing full suite"] : matchingFiles.map(fullSuiteReasonForFile);
+	return {
+		baseRef: input.baseRef,
+		buildEnv: () => {
+			const payload = input.changedFiles.join("\n");
+			const env = {
+				[FACTORY_BASE_REF_ENV]: forcesFullSuite ? fullSuiteBaseRef : input.baseRef,
+				[FACTORY_CHANGED_FILES_ENV]: "",
+				[FACTORY_CHANGED_FILES_FILE_ENV]: ""
+			};
+			if (Buffer.byteLength(payload, "utf-8") > inlineLimitBytes) {
+				const dir = mkdtempSync(path.join(tmpDir, "factory-changed-files-"));
+				const filePath = path.join(dir, "changed-files.txt");
+				writeFileSync(filePath, `${payload}\n`, "utf-8");
+				env[FACTORY_CHANGED_FILES_FILE_ENV] = filePath;
+				return {
+					cleanup: () => {
+						rmSync(dir, {
+							force: true,
+							recursive: true
+						});
+					},
+					env
+				};
+			}
+			env[FACTORY_CHANGED_FILES_ENV] = payload;
+			return {
+				cleanup: noopCleanup,
+				env
+			};
+		},
+		changedFiles: input.changedFiles,
+		forcesFullSuite,
+		fullSuiteReasons,
+		runSummaryLines: () => {
+			const lines = [];
+			if (input.changedFiles.length > 0) {
+				lines.push("Changed files considered by pr:verify:");
+				for (const file of input.changedFiles) lines.push(`- ${file}`);
+			} else lines.push("No changed files detected.");
+			if (forcesFullSuite) {
+				lines.push("Forcing full verification suite:");
+				for (const reason of fullSuiteReasons) lines.push(`- ${reason}`);
+			}
+			return lines;
+		}
+	};
+}
 const COMMIT_SHA_PATTERN$1 = /^[0-9a-f]{40}$/iu;
 const ZERO_SHA_PATTERN$1 = /^0{40}$/u;
 const demandedTargets$1 = (profile, reason) => (profile?.impact?.targets ?? []).map(({ name }) => ({
@@ -6020,6 +6144,7 @@ const refusal$1 = ({ base, head, profile, reason }) => ({
 	},
 	decision: "refused",
 	...head ? { headSha: head } : {},
+	inertPaths: [],
 	schemaVersion: 1,
 	targets: demandedTargets$1(profile, reason),
 	unsubscribedPaths: []
@@ -6056,13 +6181,23 @@ const assertReachableCommit$1 = (cwd, sha, name) => {
 		throw new Error(`${name} commit ${sha} is not reachable in this checkout`);
 	}
 };
+const githubOutputAssignment = (name, value) => {
+	if (value.includes("\n") || value.includes("\r")) {
+		const delimiter = `ghadelim_${randomBytes(8).toString("hex")}`;
+		return `${name}<<${delimiter}\n${value}\n${delimiter}`;
+	}
+	return `${name}=${value}`;
+};
 const writeGithubOutputs$1 = (outputPath, decision) => {
-	appendFileSync(outputPath, `${[
+	const lines = [
 		`decision=${decision.decision}`,
 		`basis=${JSON.stringify(decision.basis)}`,
+		`inert_paths=${JSON.stringify(decision.inertPaths)}`,
 		`unsubscribed_paths=${JSON.stringify(decision.unsubscribedPaths)}`,
 		...decision.targets.map((target) => `${productionImpactTargetOutput(target.name)}=${target.state}`)
-	].join("\n")}\n`, "utf-8");
+	];
+	if (decision.runContext) lines.push(githubOutputAssignment("factory_base_ref", decision.runContext.FACTORY_BASE_REF), githubOutputAssignment("factory_changed_files", decision.runContext.FACTORY_CHANGED_FILES), githubOutputAssignment("factory_changed_files_file", decision.runContext.FACTORY_CHANGED_FILES_FILE), githubOutputAssignment("merge_base_sha", decision.runContext.mergeBaseSha ?? ""));
+	appendFileSync(outputPath, `${lines.join("\n")}\n`, "utf-8");
 };
 /**
 * Classify candidate impact from one exact base/head identity. The delta is
@@ -6076,6 +6211,7 @@ const runCandidateImpact = (args) => {
 	const cwd = path.resolve(args.cwd ?? process.cwd());
 	let profile;
 	let profilePath;
+	let relativeProfile;
 	let decision;
 	try {
 		const { path: loadedPath, profile: loadedProfile } = loadProjectProfile({
@@ -6084,6 +6220,7 @@ const runCandidateImpact = (args) => {
 		});
 		profile = loadedProfile;
 		profilePath = loadedPath;
+		relativeProfile = path.relative(cwd, profilePath).split(path.sep).join("/");
 		const base = assertCommitIdentity$1(args.base, "base");
 		const head = assertCommitIdentity$1(args.head, "head");
 		assertReachableCommit$1(cwd, base, "base");
@@ -6123,6 +6260,7 @@ const runCandidateImpact = (args) => {
 			},
 			decision: usable ? "usable" : "refused",
 			headSha: head,
+			inertPaths: stamp.inertPaths,
 			mergeBaseSha: mergeBase,
 			schemaVersion: 1,
 			targets: stamp.targets.map((target) => ({
@@ -6140,6 +6278,29 @@ const runCandidateImpact = (args) => {
 			reason: `candidate impact classification refused: ${error instanceof Error ? error.message : String(error)}`
 		});
 	}
+	if (args.emitRunContext) {
+		const fullSuiteBaseRef = emptyTreeHash(cwd);
+		const context = createVerificationRunContext({
+			baseRef: decision.mergeBaseSha ?? fullSuiteBaseRef,
+			changedFiles: decision.basis.changedFiles,
+			fullSuiteBaseRef,
+			rootSharedGlobs: relativeProfile ? [...DEFAULT_ROOT_SHARED_GLOBS, relativeProfile] : [...DEFAULT_ROOT_SHARED_GLOBS]
+		});
+		const { env } = context.buildEnv();
+		decision = {
+			...decision,
+			runContext: {
+				FACTORY_BASE_REF: env["FACTORY_BASE_REF"] ?? "",
+				FACTORY_CHANGED_FILES: env["FACTORY_CHANGED_FILES"] ?? "",
+				FACTORY_CHANGED_FILES_FILE: env["FACTORY_CHANGED_FILES_FILE"] ?? "",
+				baseRef: context.baseRef,
+				changedFiles: context.changedFiles,
+				forcesFullSuite: context.forcesFullSuite,
+				fullSuiteReasons: context.fullSuiteReasons,
+				...decision.mergeBaseSha ? { mergeBaseSha: decision.mergeBaseSha } : {}
+			}
+		};
+	}
 	if (args.githubOutput) writeGithubOutputs$1(path.resolve(cwd, args.githubOutput), decision);
 	if (args.githubSummary) appendFileSync(path.resolve(cwd, args.githubSummary), `### Candidate impact\n\n${candidateImpactSummaryLines(decision).join("\n")}\n`, "utf-8");
 	return decision;
@@ -6147,22 +6308,36 @@ const runCandidateImpact = (args) => {
 const candidateImpactSummaryLines = (decision) => decision.basis.classification === "refused" ? [
 	"Candidate impact: refused; all routed work remains demanded.",
 	...decision.basis.reasons,
+	inertPathsLine(void 0, "classification was refused"),
 	unsubscribedPathsLine(void 0, "classification was refused")
-] : [`Candidate impact: ${decision.basis.classification}; ${decision.targets.filter(({ state }) => state === "demanded").length}/${decision.targets.length} target(s) demanded.`, unsubscribedPathsLine(decision.unsubscribedPaths)];
+] : [
+	`Candidate impact: ${decision.basis.classification}; ${decision.targets.filter(({ state }) => state === "demanded").length}/${decision.targets.length} target(s) demanded.`,
+	inertPathsLine(decision.inertPaths),
+	unsubscribedPathsLine(decision.unsubscribedPaths)
+];
 //#endregion
 //#region src/commands/candidate-impact.ts
 function createCandidateImpactCommand(output) {
-	return markCwdOptionDefault(new Command("candidate:impact").description("Classify candidate targets from an exact pull-request base/head identity").option("--base <sha>", "candidate base commit SHA").option("--head <sha>", "candidate head commit SHA").option("--cwd <path>", "repository working directory", collectCwdOption).option("--profile <path>", "path to the project profile JSON file").option("--github-output <path>", "append stable decision outputs to a GitHub Actions output file").option("--github-summary <path>", "append a human-readable decision to a GitHub Actions summary file").option("--json", "print the complete decision as JSON").action((options) => {
+	return markCwdOptionDefault(new Command("candidate:impact").description("Classify candidate targets from an exact pull-request base/head identity").option("--base <sha>", "candidate base commit SHA").option("--head <sha>", "candidate head commit SHA").option("--cwd <path>", "repository working directory", collectCwdOption).option("--profile <path>", "path to the project profile JSON file").option("--github-output <path>", "append stable decision outputs to a GitHub Actions output file").option("--github-summary <path>", "append a human-readable decision to a GitHub Actions summary file").option("--json", "print the complete decision as JSON").option("--emit-run-context", "emit the FACTORY_BASE_REF / FACTORY_CHANGED_FILES run-context contract").action((options) => {
 		const decision = runCandidateImpact({
 			base: options.base,
 			cwd: resolveCwdOption(options.cwd),
+			emitRunContext: options.emitRunContext,
 			githubOutput: options.githubOutput,
 			githubSummary: options.githubSummary,
 			head: options.head,
 			profilePath: options.profile
 		});
 		if (options.json) output.stdout.write(`${JSON.stringify(decision, null, 2)}\n`);
-		else output.stdout.write(`${candidateImpactSummaryLines(decision).join("\n")}\n`);
+		else if (options.emitRunContext) {
+			const context = decision.runContext;
+			if (context === void 0) throw new Error("--emit-run-context produced no run context; refusing to print an empty contract");
+			output.stdout.write(`${[
+				`${FACTORY_BASE_REF_ENV}=${context.FACTORY_BASE_REF}`,
+				`${FACTORY_CHANGED_FILES_ENV}=${context.FACTORY_CHANGED_FILES}`,
+				`${FACTORY_CHANGED_FILES_FILE_ENV}=${context.FACTORY_CHANGED_FILES_FILE}`
+			].join("\n")}\n`);
+		} else output.stdout.write(`${candidateImpactSummaryLines(decision).join("\n")}\n`);
 	}));
 }
 /** `tool` discriminator every emitted report carries. */
@@ -9573,25 +9748,49 @@ function createFactoryCheckPublisher(output, dependencies = {}) {
 }
 //#endregion
 //#region src/pr-classification.ts
-function ownershipForFile(profile, file) {
-	if (file === "pnpm-lock.yaml") return { kind: "graph-input" };
-	const subscribed = (profile.impact?.targets ?? []).find((target) => matchesAnyGlob(target.paths ?? [], file));
-	if (subscribed) return {
+const MISSING_STAMP_REASON = "impact stamp is missing; fail closed to non-trivial";
+function ownershipFromStamp(stamp, file) {
+	if (stamp.inertPaths.includes(file)) return { kind: "inert" };
+	if (stamp.unsubscribedPaths.includes(file)) return { kind: "unowned" };
+	const named = stamp.targets.find((target) => target.impact === "affected" && target.basis.includes(`"${file}"`));
+	if (named) return {
+		kind: "target",
+		target: named.name
+	};
+	const affected = stamp.targets.find((target) => target.impact === "affected");
+	if (affected) return {
 		kind: "target",
-		target: subscribed.name
+		target: affected.name
 	};
-	if (matchesAnyGlob(profile.impact?.inert ?? [], file)) return { kind: "inert" };
 	return { kind: "unowned" };
 }
 function reasonForOwnership(file, ownership) {
 	switch (ownership.kind) {
-		case "graph-input": return `${file}: dependency graph input; never inert`;
-		case "inert": return `${file}: repository-inert ownership (impact.inert)`;
+		case "inert": return `${file}: repository-inert ownership (stamp.inertPaths)`;
 		case "target": return `${file}: affects product target "${ownership.target}"`;
 		default: return `${file}: no declared owner; fail closed to non-trivial`;
 	}
 }
-function classifyDiff(profile, files) {
+function relativeProfilePath(options) {
+	return path.relative(options.cwd, options.profilePath).split(path.sep).join("/");
+}
+function applyProfileEditGuard(files, relativeProfile, profilePath, base) {
+	if (!files.some((file) => file === relativeProfile || file === profilePath)) return base;
+	return {
+		classification: "non-trivial",
+		reasons: [...base.reasons, `${relativeProfile}: edits the ownership declarations; forced non-trivial`]
+	};
+}
+/**
+* Path ownership as the stamp recorded it. A missing stamp fails closed.
+* Does not glob, and does not refuse the docs rung on a conservative basis —
+* that gate belongs to {@link classifyDiffForRunWithStamp}.
+*/
+function classifyDiff(files, stamp) {
+	if (stamp === void 0) return {
+		classification: "non-trivial",
+		reasons: [MISSING_STAMP_REASON]
+	};
 	const sortedFiles = [...files].toSorted();
 	if (sortedFiles.length === 0) return {
 		classification: "non-trivial",
@@ -9599,7 +9798,7 @@ function classifyDiff(profile, files) {
 	};
 	const ownerships = sortedFiles.map((file) => ({
 		file,
-		ownership: ownershipForFile(profile, file)
+		ownership: ownershipFromStamp(stamp, file)
 	}));
 	const reasons = ownerships.map(({ file, ownership }) => reasonForOwnership(file, ownership));
 	if (ownerships.every(({ ownership }) => ownership.kind === "inert")) return {
@@ -9620,14 +9819,13 @@ function classifyDiff(profile, files) {
 * fail-closed stamp can never coexist with a reduced verification battery
 * (#742 review cycle 3).
 *
-* `classifyDiffForRun` below stays the pure path predicate. Its remaining
-* stamp-less consumer is pr-ready's docs-only DELTA check, where the delta
-* rides on an already fully verified baseline and a lockfile-bearing delta
-* already refuses through the graph-input rule.
+* Ownership and reasons come from `stamp.targets`, `stamp.inertPaths`, and
+* `stamp.unsubscribedPaths`. A missing stamp fails closed; this function
+* never evaluates profile globs.
 */
 function classifyDiffForRunWithStamp(profile, files, stamp, options) {
-	const base = classifyDiffForRun(profile, files, options);
-	if (base.classification === "non-trivial") return base;
+	const base = applyProfileEditGuard(files, relativeProfilePath(options), options.profilePath, classifyDiff(files, stamp));
+	if (stamp === void 0 || base.classification === "non-trivial") return base;
 	if (stamp.basis !== "target-scoped") return {
 		classification: "non-trivial",
 		reasons: [...base.reasons, "impact stamp is conservative; the docs/process-only rung needs a target-scoped stamp with zero affected targets"]
@@ -9639,15 +9837,20 @@ function classifyDiffForRunWithStamp(profile, files, stamp, options) {
 	};
 	return base;
 }
+/**
+* Path predicate for consumers that do not already hold a stamp (pr-ready's
+* docs-only delta). Computes one stamp through {@link computeImpactStamp} —
+* the only glob-evaluation site — then reads ownership from it.
+*/
 function classifyDiffForRun(profile, files, options) {
-	const relativeProfile = path.relative(options.cwd, options.profilePath).split(path.sep).join("/");
-	const base = classifyDiff(profile, files);
-	if (base.classification === "non-trivial") return base;
-	if (files.some((file) => file === relativeProfile || file === options.profilePath)) return {
-		classification: "non-trivial",
-		reasons: [...base.reasons, `${relativeProfile}: edits the ownership declarations; forced non-trivial`]
-	};
-	return base;
+	const relativeProfile = relativeProfilePath(options);
+	const stamp = computeImpactStamp({
+		changedFiles: files,
+		profile,
+		profilePath: relativeProfile,
+		readLockfile: () => void 0
+	});
+	return applyProfileEditGuard(files, relativeProfile, options.profilePath, classifyDiff(files, stamp));
 }
 //#endregion
 //#region src/pr-readiness/verification-proof.ts
@@ -9855,83 +10058,6 @@ const verificationProofBlockingReason = (state) => {
 	}
 };
 //#endregion
-//#region src/verification-run-context.ts
-const FACTORY_BASE_REF_ENV = "FACTORY_BASE_REF";
-const FACTORY_CHANGED_FILES_ENV = "FACTORY_CHANGED_FILES";
-const FACTORY_CHANGED_FILES_FILE_ENV = "FACTORY_CHANGED_FILES_FILE";
-const DEFAULT_CHANGED_FILES_INLINE_LIMIT_BYTES = 1e5;
-const DEFAULT_ROOT_SHARED_GLOBS = [
-	"pnpm-lock.yaml",
-	"package-lock.json",
-	"yarn.lock",
-	"bun.lockb",
-	"pnpm-workspace.yaml",
-	"package.json",
-	"tsconfig*.json",
-	"*.config.*",
-	".npmrc",
-	".nvmrc"
-];
-function fullSuiteReasonForFile(file) {
-	return `${file}: root/shared change forces full suite`;
-}
-function noopCleanup() {}
-function createVerificationRunContext(input) {
-	const rootSharedGlobs = input.rootSharedGlobs ?? DEFAULT_ROOT_SHARED_GLOBS;
-	const fullSuiteBaseRef = input.fullSuiteBaseRef ?? "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-	const inlineLimitBytes = input.inlineLimitBytes ?? DEFAULT_CHANGED_FILES_INLINE_LIMIT_BYTES;
-	const tmpDir = input.tmpDir ?? os.tmpdir();
-	const matchingFiles = input.changedFiles.filter((file) => matchesAnyGlob(rootSharedGlobs, file));
-	const forcesFullSuite = matchingFiles.length > 0 || input.changedFiles.length === 0;
-	const fullSuiteReasons = input.changedFiles.length === 0 ? ["no changed files detected; forcing full suite"] : matchingFiles.map(fullSuiteReasonForFile);
-	return {
-		baseRef: input.baseRef,
-		buildEnv: () => {
-			const payload = input.changedFiles.join("\n");
-			const env = {
-				[FACTORY_BASE_REF_ENV]: forcesFullSuite ? fullSuiteBaseRef : input.baseRef,
-				[FACTORY_CHANGED_FILES_ENV]: "",
-				[FACTORY_CHANGED_FILES_FILE_ENV]: ""
-			};
-			if (Buffer.byteLength(payload, "utf-8") > inlineLimitBytes) {
-				const dir = mkdtempSync(path.join(tmpDir, "factory-changed-files-"));
-				const filePath = path.join(dir, "changed-files.txt");
-				writeFileSync(filePath, `${payload}\n`, "utf-8");
-				env[FACTORY_CHANGED_FILES_FILE_ENV] = filePath;
-				return {
-					cleanup: () => {
-						rmSync(dir, {
-							force: true,
-							recursive: true
-						});
-					},
-					env
-				};
-			}
-			env[FACTORY_CHANGED_FILES_ENV] = payload;
-			return {
-				cleanup: noopCleanup,
-				env
-			};
-		},
-		changedFiles: input.changedFiles,
-		forcesFullSuite,
-		fullSuiteReasons,
-		runSummaryLines: () => {
-			const lines = [];
-			if (input.changedFiles.length > 0) {
-				lines.push("Changed files considered by pr:verify:");
-				for (const file of input.changedFiles) lines.push(`- ${file}`);
-			} else lines.push("No changed files detected.");
-			if (forcesFullSuite) {
-				lines.push("Forcing full verification suite:");
-				for (const reason of fullSuiteReasons) lines.push(`- ${reason}`);
-			}
-			return lines;
-		}
-	};
-}
-//#endregion
 //#region src/workspace-install-resolution.ts
 const readJson = (filePath, read) => {
 	if (!existsSync(filePath)) return null;
@@ -10178,7 +10304,6 @@ function formatVerifyTimingSummary(proof) {
 function resolveMode({ classification, mode }) {
 	if (mode === "auto") {
 		if (classification === "docs/process-only") return "docs-only";
-		if (classification === "trivial") return "trivial";
 		return "full";
 	}
 	return mode;
@@ -12938,7 +13063,6 @@ var pr_body_renderer_exports = /* @__PURE__ */ __exportAll({
 });
 const commandFor = (proof) => {
 	if (proof.mode === "docs-only") return "patronage-factory pr:verify --docs-only";
-	if (proof.mode === "trivial") return "patronage-factory pr:verify --trivial";
 	return "patronage-factory pr:verify";
 };
 const renderPrBodySectionParts = ({ reviewProof, verifyProof }) => {
@@ -15921,17 +16045,13 @@ function createPrReviewCommand(output, action) {
 //#endregion
 //#region src/commands/pr-verify.ts
 function createPrVerifyCommand(output, action = runPrVerify) {
-	return markCwdOptionDefault(new Command("pr:verify").description("Run project-profile verification commands and write typed proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to verify", collectCwdOption).option("--docs-only", "run the docs/process verification gate").option("--trivial", "run the trivial verification gate").option("--full", "run the full verification gate").option("--authoring-session <id>", "explicit authoring session identity (required for review evidence)").option("--json", "print the proof as JSON after verification").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--no-status", "skip posting the patronage-factory/pr-verify commit status").action(withGateTiming({
+	return markCwdOptionDefault(new Command("pr:verify").description("Run project-profile verification commands and write typed proof").option("--base <ref>", "base branch or ref", "origin/main").option("--cwd <path>", "working directory to verify", collectCwdOption).option("--docs-only", "run the docs/process verification gate").option("--full", "run the full verification gate").option("--authoring-session <id>", "explicit authoring session identity (required for review evidence)").option("--json", "print the proof as JSON after verification").option("--output <path>", "write proof JSON to a file").option("--profile <path>", "path to the project profile JSON file").option("--no-status", "skip posting the patronage-factory/pr-verify commit status").action(withGateTiming({
 		gate: "pr:verify",
 		resolveLedgerRoot: (options) => resolveCwdOption(options.cwd),
 		stderr: output.stderr
 	}, (options) => {
 		assertForegroundGate({ gate: "pr:verify" });
-		if ([
-			options.docsOnly,
-			options.trivial,
-			options.full
-		].filter(Boolean).length > 1) throw new Error("Use at most one of --docs-only, --trivial, or --full");
+		if ([options.docsOnly, options.full].filter(Boolean).length > 1) throw new Error("Use at most one of --docs-only or --full");
 		const dependencies = options.status === false ? {} : { publishCheckRun: createFactoryCheckPublisher(output) };
 		const proof = action({
 			authoringSession: options.authoringSession,
@@ -15947,7 +16067,6 @@ function createPrVerifyCommand(output, action = runPrVerify) {
 }
 function modeFor(options) {
 	if (options.docsOnly) return "docs-only";
-	if (options.trivial) return "trivial";
 	if (options.full) return "full";
 	return "auto";
 }
@@ -16412,4 +16531,4 @@ if (isDirectCliExecution()) try {
 	process.exit(1);
 }
 //#endregion
-export { DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DemandWaiveRefusalError, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, EpicStructureValidationError, FactoryCliInvocationSchema, FollowUpActionSchema, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, PrPublishFollowUpError, REVIEW_FOCUS_SECTION, WorkerCheckoutGuardError, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_exports as boundaryManifest, boundary_review_proof_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_exports as prReadinessEvaluation, external_evidence_exports as prReadinessExternalEvidence, pr_body_renderer_exports as prReadinessPrBodyRenderer, proof_identity_exports as prReadinessProofIdentity, review_proof_exports as prReadinessReviewProof, status_check_rollup_exports as prReadinessStatusChecks, verification_proof_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_exports as worktreeScratchFiles };
+export { DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, DemandWaiveRefusalError, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, EpicStructureValidationError, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, FactoryCliInvocationSchema, FollowUpActionSchema, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, PrPublishFollowUpError, REVIEW_FOCUS_SECTION, WorkerCheckoutGuardError, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_exports as boundaryManifest, boundary_review_proof_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_exports as prReadinessEvaluation, external_evidence_exports as prReadinessExternalEvidence, pr_body_renderer_exports as prReadinessPrBodyRenderer, proof_identity_exports as prReadinessProofIdentity, review_proof_exports as prReadinessReviewProof, status_check_rollup_exports as prReadinessStatusChecks, verification_proof_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_exports as worktreeScratchFiles };

package/dist/schemas.d.ts

@@ -125,6 +125,7 @@ declare const impactStampSchema: z.ZodObject<{
     "target-scoped": "target-scoped";
     conservative: "conservative";
   }>;
+  inertPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
   reasons: z.ZodArray<z.ZodString>;
   stampVersion: z.ZodLiteral<3>;
   targets: z.ZodArray<z.ZodObject<{
@@ -584,6 +585,16 @@ interface PrVerifyNotRequiredCommand {
   impactTarget: string;
   name: string;
 }
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — the field is v4-only (the same
+ * window that can carry `impactStamp`) and refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
+}
 interface PrVerifyProof {
   schemaVersion: PrVerifySchemaVersion;
   authoringSession?: string;
@@ -607,6 +618,7 @@ interface PrVerifyProof {
   impactStamp?: ImpactStamp;
   mode: ResolvedPrVerifyMode;
   mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
   notRequiredCommands?: PrVerifyNotRequiredCommand[];
   outcome?: "aborted" | "passed";
   patchId?: string;
@@ -659,6 +671,7 @@ declare const prVerifyProofSchema: z.ZodObject<{
       "target-scoped": "target-scoped";
       conservative: "conservative";
     }>;
+    inertPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
     reasons: z.ZodArray<z.ZodString>;
     stampVersion: z.ZodLiteral<3>;
     targets: z.ZodArray<z.ZodObject<{
@@ -677,6 +690,10 @@ declare const prVerifyProofSchema: z.ZodObject<{
     "docs-only": "docs-only";
     full: "full";
   }>;
+  notDemandedRecords: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    basis: z.ZodString;
+    name: z.ZodString;
+  }, z.core.$strip>>>;
   notRequiredCommands: z.ZodOptional<z.ZodArray<z.ZodObject<{
     basis: z.ZodString;
     impactTarget: z.ZodString;

package/dist/schemas.js

@@ -241,6 +241,7 @@ const impactStampTargetSchema = z.object({
 */
 const impactStampSchema = z.object({
 	basis: z.enum(["target-scoped", "conservative"]),
+	inertPaths: z.array(z.string()).default([]),
 	reasons: z.array(z.string()),
 	stampVersion: z.literal(3),
 	targets: z.array(impactStampTargetSchema).superRefine((targets, context) => {
@@ -514,6 +515,16 @@ const assertPrVerifyProofRules = (proof, context) => {
 		message: "notRequiredCommands is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
 		path: ["notRequiredCommands"]
 	});
+	if (proof.schemaVersion < 4 && proof.notDemandedRecords !== void 0) context.addIssue({
+		code: "custom",
+		message: "notDemandedRecords is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["notDemandedRecords"]
+	});
+	if (proof.notDemandedRecords !== void 0 && proof.impactStamp === void 0) context.addIssue({
+		code: "custom",
+		message: "notDemandedRecords requires impactStamp; package-level not-demanded records are bound to the stamp identity.",
+		path: ["notDemandedRecords"]
+	});
 	assertBatteryCompleteness(proof, context);
 	assertNotRequiredStampAuthorization(proof, context);
 };
@@ -546,6 +557,10 @@ const notRequiredCommandSchema = z.object({
 	impactTarget: z.string().min(1),
 	name: z.string().min(1)
 });
+const notDemandedRecordSchema = z.object({
+	basis: z.string().min(1),
+	name: z.string().min(1)
+});
 const prVerifySchemaVersionSchema = z.number().refine((value) => SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.includes(value), { message: `schemaVersion must be one of: ${SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.join(", ")}` });
 const prVerifyProofSchema = z.object({
 	authoringSession: z.string().trim().min(1).optional(),
@@ -577,6 +592,7 @@ const prVerifyProofSchema = z.object({
 		"trivial",
 		"full"
 	]),
+	notDemandedRecords: z.array(notDemandedRecordSchema).min(1).optional(),
 	notRequiredCommands: z.array(notRequiredCommandSchema).min(1).optional(),
 	outcome: z.enum(["aborted", "passed"]).optional(),
 	patchId: z.string().regex(/^[0-9a-f]{40}$/u).optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/software-factory",
-  "version": "1.0.0-alpha.16",
+  "version": "1.0.0-alpha.17",
   "description": "Shared Patronage software factory CLI and project-profile validation tools",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,7 @@
     "picomatch": "^4.0.5",
     "yaml": "^2.9.0",
     "zod": "4.4.3",
-    "@patronage/factory-ci": "1.0.0-alpha.16"
+    "@patronage/factory-ci": "1.0.0-alpha.17"
   },
   "devDependencies": {
     "@types/node": "24.13.3",