@patronage/software-factory 1.0.0-alpha.17 → 1.0.0-alpha.19

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { Command } from "commander";
 import { z } from "zod";
+import { PreviewProofRegistration } from "@patronage/factory-ci";
 
 //#region src/review-rungs.d.ts
 declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
@@ -724,6 +725,10 @@ declare const factoryProjectProfileSchema: z.ZodObject<{
       paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
   }, z.core.$strict>>;
+  lifecycleContract: z.ZodOptional<z.ZodObject<{
+    command: z.ZodString;
+    jobName: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>>;
   repository: z.ZodObject<{
     name: z.ZodString;
     owner: z.ZodString;
@@ -1505,6 +1510,490 @@ declare const isHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
 declare const hostedVerifyCheckState: (rollup: StatusCheckRollup[] | undefined) => CheckState;
 declare const statusCheckState: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => CheckState;
 //#endregion
+//#region src/github-app-client.d.ts
+interface FactoryAppRequest {
+  body?: unknown;
+  headers?: Readonly<Record<string, string>>;
+  method: "DELETE" | "GET" | "PATCH" | "POST";
+  owner: string;
+  path: string;
+  repo: string;
+}
+interface FactoryAppExchange<T = unknown> {
+  readonly etag?: string;
+  readonly json: T;
+  readonly status: number;
+}
+//#endregion
+//#region src/github-pr-status-comment.d.ts
+interface UpsertFactoryPrStatusCommentInput {
+  body: string;
+  /** ISO instant at which this presentation was observed. */
+  observedAt?: string;
+  owner: string;
+  pr: number;
+  repo: string;
+}
+interface UpsertFactoryPrStatusCommentDependencies {
+  request?: (input: FactoryAppRequest) => Promise<FactoryAppExchange>;
+  requestJson?: (input: FactoryAppRequest) => Promise<unknown>;
+}
+interface UpsertFactoryPrStatusCommentResult {
+  action: "created" | "updated";
+  commentId: number;
+  url: string;
+}
+declare function upsertFactoryPrStatusComment(input: UpsertFactoryPrStatusCommentInput, dependencies?: UpsertFactoryPrStatusCommentDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
+//#endregion
+//#region src/pr-verify-proof-contract.d.ts
+declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
+type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
+interface PrVerifyCommandResult {
+  command: string;
+  description: string;
+  /**
+   * Epic #550 wave 3 (#430): the profile's declared impact target for this
+   * command, recorded from v4 on. It is the proof's own command→target
+   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
+   * for the same command, so a withholding cannot point at whichever released
+   * target happens to be convenient. Absent for a command the profile does
+   * not scope, and for v1–v3 proofs, which predate the field.
+   */
+  impactTarget?: string;
+  name: string;
+  scope: "always" | "docs-only" | "trivial" | "full";
+}
+interface PrVerifyExecutedCommand {
+  command: string;
+  counts?: {
+    testFiles?: number;
+    tests?: number;
+  };
+  durationMs: number;
+  exitCode: number;
+  name: string;
+  scope: "always" | "docs-only" | "trivial" | "full";
+}
+/**
+ * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
+ * candidate cannot reach, so the battery did not run it.
+ *
+ * The completeness invariant lives in the pairing: `verificationCommands`
+ * records every command the resolved mode selected, `executedCommands` records
+ * what ran, and this list records the rest WITH the stamp's own basis. A
+ * withheld stack is therefore never silently absent from the proof — it is
+ * present, named, and explained.
+ */
+interface PrVerifyNotRequiredCommand {
+  basis: string;
+  impactTarget: string;
+  name: string;
+}
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — the field is v4-only (the same
+ * window that can carry `impactStamp`) and refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
+}
+interface PrVerifyProof {
+  schemaVersion: PrVerifySchemaVersion;
+  authoringSession?: string;
+  base: string;
+  baselineFullProofs?: {
+    base: string;
+    changedFiles: string[];
+    headSha: string;
+    profilePath: string;
+    projectKey: string;
+    repository: string;
+  }[];
+  changedFiles: string[];
+  classification: DiffClassification;
+  classificationReasons: string[];
+  command: "patronage-factory pr:verify";
+  durationMs: number;
+  endedAt: string;
+  executedCommands?: PrVerifyExecutedCommand[];
+  headSha: string;
+  impactStamp?: ImpactStamp;
+  mode: ResolvedPrVerifyMode;
+  mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
+  notRequiredCommands?: PrVerifyNotRequiredCommand[];
+  outcome?: "aborted" | "passed";
+  patchId?: string;
+  profilePath: string;
+  projectKey: string;
+  repository: string;
+  startedAt: string;
+  verificationCommands: PrVerifyCommandResult[];
+}
+type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
+declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
+declare namespace verification_proof_d_exports {
+  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
+}
+interface VerifiedHeadShas {
+  docsOnlyVerifiedHeadShas: string[];
+  trivialVerifiedHeadShas: string[];
+  verifiedHeadShas: string[];
+}
+type VerificationHeadShas = {
+  explicitFailure: true;
+} | VerifiedHeadShas;
+declare function readPrVerifyProof(filePath: string): PrVerifyProof;
+declare const verifyProofPassed: (proof: PrVerifyProof) => boolean;
+declare const prVerifyProofHeadShas: (proof: PrVerifyProof | undefined, creditedHeadSha?: string) => VerifiedHeadShas;
+declare const verifyProofIdentityMatches: ({
+  currentIdentity,
+  proof
+}: {
+  currentIdentity?: {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  proof?: PrVerifyProof;
+}) => boolean;
+/**
+ * Wave-2 consumption (#542): the recorded impact stamp, released for demand
+ * resolution ONLY when it is identity-bound to the current candidate — the
+ * proof passed, and its recorded headSha AND patchId both name exactly this
+ * candidate (the same identities the proof already binds). Everything else —
+ * no proof, an aborted run, a stale head, a moved patch id, a pre-stamp proof
+ * — returns `undefined`, and the consumer keeps today's full-demand floor.
+ *
+ * Deliberately stricter than verify-once applicability (which tolerates a
+ * head-only or patch-id-only match): a stamp narrows external demands, so it
+ * is trusted only on an exact double binding, fail closed.
+ */
+declare const trustedImpactStamp: ({
+  candidate,
+  proof
+}: {
+  candidate: {
+    headSha: string;
+    patchId: string;
+  };
+  proof: PrVerifyProof | undefined;
+}) => ImpactStamp | undefined;
+declare const prVerifyFullHeadShasForDiff: ({
+  docsOnlyDeltaAcceptedSince,
+  files,
+  proof
+}: {
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  files: string[];
+  proof: PrVerifyProof;
+}) => string[];
+type VerificationProofState = {
+  kind: "typed-aborted";
+  proof: PrVerifyProof;
+} | {
+  kind: "typed-missing";
+  path: string;
+  reason: "enoent" | "invalid";
+  message?: string;
+} | {
+  kind: "typed";
+  headShas: VerifiedHeadShas;
+  proof: PrVerifyProof;
+} | {
+  kind: "typed-diff-mismatch";
+  mode: ResolvedPrVerifyMode;
+};
+declare const verificationProofStateFor: ({
+  proof,
+  proofMatchesCurrentDiff,
+  proofPath
+}: {
+  proof?: PrVerifyProof;
+  proofMatchesCurrentDiff?: boolean;
+  proofPath?: string;
+}) => VerificationProofState;
+declare const verificationProofApplicabilityFor: ({
+  docsOnlyDeltaAcceptedSince,
+  explicitProof,
+  files,
+  headSha,
+  currentIdentity,
+  proof,
+  proofPath,
+  proofReadError
+}: {
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  explicitProof: boolean;
+  files: string[];
+  headSha: string;
+  currentIdentity?: {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  proof?: PrVerifyProof;
+  proofPath?: string;
+  proofReadError?: unknown;
+}) => {
+  fullVerifiedHeadShas: never[];
+  verificationProof: VerificationProofState;
+} | {
+  fullVerifiedHeadShas: string[];
+  verificationProof: {
+    headShas: VerifiedHeadShas;
+    kind: "typed";
+    proof: PrVerifyProof;
+  };
+};
+declare const resolveVerifyProofApplicability: ({
+  proofPath,
+  explicitProof,
+  docsOnlyDeltaAcceptedSince,
+  files,
+  headSha,
+  currentVerifyIdentityForBase,
+  preread
+}: {
+  proofPath: string;
+  explicitProof: boolean;
+  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
+  files: string[];
+  headSha: string;
+  currentVerifyIdentityForBase?: (base: string) => {
+    patchId: string;
+    mergeBaseSha?: string;
+  };
+  preread?: {
+    proof?: PrVerifyProof;
+    error?: unknown;
+  };
+}) => {
+  fullVerifiedHeadShas: never[];
+  verificationProof: VerificationProofState;
+} | {
+  fullVerifiedHeadShas: string[];
+  verificationProof: {
+    headShas: VerifiedHeadShas;
+    kind: "typed";
+    proof: PrVerifyProof;
+  };
+};
+declare const verificationProofForReadiness: (state: VerificationProofState) => VerificationHeadShas;
+declare const verificationProofBlockingReason: (state: VerificationProofState) => string | undefined;
+//#endregion
+//#region src/preview-lifecycle.d.ts
+type PreviewDisposition = "deploy" | "not-required";
+interface PreviewTargetPlan {
+  basis: string;
+  disposition: PreviewDisposition;
+  name: string;
+}
+interface PreviewLifecyclePlan {
+  /** The declared preview stacks to deploy, in declaration order. */
+  deploy: string[];
+  /** The withheld stacks, in declaration order. */
+  notRequired: PreviewTargetPlan[];
+  /** Whether a trusted, identity-bound stamp was available at all. */
+  stampTrusted: boolean;
+  /** Every declared preview target with its disposition, in declaration order. */
+  targets: PreviewTargetPlan[];
+}
+/** Validate a serialized plan without deriving or changing its dispositions. */
+declare const validatePreviewLifecyclePlan: (value: unknown) => PreviewLifecyclePlan;
+/**
+ * Structural subset of the profile: the impact declarations plus the external
+ * demand list. Structural rather than a `Pick` so this module does not import
+ * `profile.ts`.
+ */
+interface PreviewLifecycleProfile {
+  impact?: {
+    targets: {
+      name: string;
+    }[];
+  };
+  requiredChecks?: {
+    name: string;
+  }[];
+}
+/**
+ * The declared preview stacks: impact targets that are ALSO declared required
+ * checks — i.e. targets whose proof is produced externally, which is exactly
+ * what a preview producer is.
+ *
+ * Deriving the list from the two existing declarations rather than adding a
+ * third is what makes lifecycle and demand unable to disagree: the stacks this
+ * plan can withhold are precisely the demands wave 2 can release, so a stack
+ * can never be skipped while its proof stays demanded.
+ */
+declare const previewLifecycleTargets: (profile: PreviewLifecycleProfile) => string[];
+/**
+ * Plan the preview lifecycle for one candidate.
+ *
+ * Trust is resolved here through the SAME identity gate demand release uses
+ * (`trustedImpactStamp`): the proof must have passed and must bind both the
+ * candidate's headSha and its patchId. A stale, aborted, absent, or
+ * differently-bound proof yields no stamp, and every declared stack is planned
+ * for deploy. Total over its INPUTS — no proof, stamp, or profile can make it
+ * throw. A malformed CALL is the deliberate exception: omitting
+ * `vetoedTargets` is API misuse, not data doubt, and throws.
+ */
+declare const planPreviewLifecycle: ({
+  candidate,
+  profile,
+  proof,
+  vetoedTargets
+}: {
+  candidate: {
+    headSha: string;
+    patchId: string;
+  };
+  profile: PreviewLifecycleProfile;
+  proof: PrVerifyProof | undefined;
+  /**
+   * Stack names with a current, candidate-bound FAILING envelope. Scoping is
+   * withheld for these whatever the stamp says — the same veto demand release
+   * applies, and for the same reason: a withheld stack is a stack that can
+   * never re-emit the envelope its standing demand needs. Callers hold the
+   * checkout context, so they resolve the set with `boundFailingCheckNames`
+   * and pass it in; this module stays pure.
+   *
+   * REQUIRED, with no default, on purpose: a defaulted `[]` reads the same
+   * whether the caller inspected the envelopes or never looked, and this seam
+   * exists precisely for EXTERNAL preview producers — the callers most likely
+   * to skip the lookup. Pass the result of `boundFailingCheckNames`; pass `[]`
+   * only to mean "inspected the envelopes and found no bound failure".
+   *
+   * Deliberately visible to `api:check` as a breaking signature change
+   * (pre-1.0, no external callers yet).
+   */
+  vetoedTargets: readonly string[];
+}) => PreviewLifecyclePlan;
+//#endregion
+//#region src/pr-status-hud.d.ts
+type FactoryPrStatusCheckName = "patronage-factory/merge-freeze" | "patronage-factory/pr-ready" | "patronage-factory/pr-verify";
+interface CompletedFactoryCheckSnapshot {
+  readonly completedAt: string;
+  readonly conclusion: string;
+  readonly detailsUrl?: string;
+  readonly headSha: string;
+  readonly name: FactoryPrStatusCheckName;
+}
+interface FailedPreviewSnapshot {
+  readonly completedAt: string;
+  readonly conclusion: string;
+  readonly detailsUrl?: string;
+  readonly headSha: string;
+  readonly name: string;
+}
+interface FactoryPrStatusSources {
+  readonly baseSha: string;
+  readonly checks: Readonly<Partial<Record<FactoryPrStatusCheckName, CompletedFactoryCheckSnapshot>>>;
+  readonly previewFailures?: Readonly<Partial<Record<string, FailedPreviewSnapshot>>>;
+  readonly previewRegistrations: readonly PreviewProofRegistration[];
+}
+interface RenderFactoryPrStatusHudInput extends FactoryPrStatusSources {
+  readonly headSha: string;
+  readonly plan: PreviewLifecyclePlan;
+  readonly planHeadSha: string;
+  readonly pr: number;
+  /** ISO instant at which the presentation sources were observed. */
+  readonly renderedAt: string;
+}
+interface PresentFactoryPrStatusHudInput {
+  readonly headSha: string;
+  readonly owner: string;
+  readonly plan: PreviewLifecyclePlan;
+  readonly planHeadSha: string;
+  readonly pr: number;
+  readonly renderedAt?: string;
+  readonly repo: string;
+}
+interface PresentFactoryPrStatusHudDependencies {
+  /**
+   * Read only `previewProofInventory.list` registrations and completed,
+   * Factory-App-owned check snapshots. PR comment bodies are not an evidence
+   * source and are deliberately absent from this contract.
+   */
+  readonly readSources: (input: {
+    headSha: string;
+    owner: string;
+    pr: number;
+    previewTargets?: readonly string[];
+    repo: string;
+  }) => Promise<FactoryPrStatusSources>;
+  /** Recheck both PR endpoints immediately before mutating the sticky HUD. */
+  readonly assertCurrentIdentity: (input: {
+    baseSha: string;
+    headSha: string;
+    owner: string;
+    pr: number;
+    repo: string;
+  }) => Promise<void>;
+  readonly upsert?: typeof upsertFactoryPrStatusComment;
+}
+interface ReadFactoryPrStatusSourcesInput {
+  readonly headSha: string;
+  readonly owner: string;
+  readonly pr: number;
+  /**
+   * Demanded preview stack names from the lifecycle plan. Used only to look up
+   * a completed unsuccessful check run when inventory has no registration.
+   */
+  readonly previewTargets?: readonly string[];
+  readonly repo: string;
+  /** Factory App installation token, normally minted by the presentation job. */
+  readonly token: string;
+}
+interface ReadFactoryPrStatusSourcesDependencies {
+  readonly fetch?: typeof fetch;
+  readonly listPreviewRegistrations?: (input: {
+    owner: string;
+    pr: number;
+    repo: string;
+    token: string;
+  }) => Promise<readonly PreviewProofRegistration[]>;
+  readonly timeoutMs?: number;
+}
+declare function renderFactoryPrStatusHud(input: RenderFactoryPrStatusHudInput): string;
+declare function presentFactoryPrStatusHud(input: PresentFactoryPrStatusHudInput, dependencies: PresentFactoryPrStatusHudDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
+declare function assertFactoryPrStatusIdentity(input: ReadFactoryPrStatusSourcesInput & {
+  readonly baseSha: string;
+}, dependencies?: ReadFactoryPrStatusSourcesDependencies): Promise<void>;
+declare function readFactoryPrStatusSources(input: ReadFactoryPrStatusSourcesInput, dependencies?: ReadFactoryPrStatusSourcesDependencies): Promise<FactoryPrStatusSources>;
+interface PlanFactoryPrStatusHudInput {
+  readonly cwd: string;
+  readonly headSha: string;
+  readonly mergeBaseSha?: string;
+  readonly patchId?: string;
+  readonly profilePath?: string;
+}
+/**
+ * Consume `planPreviewLifecycle` for the current checkout. No second plan is
+ * invented: dispositions are Ready/Skipped from `deploy` vs `not-required`.
+ * Candidate identity is never copied from the proof. Absent independent
+ * identity or an unbound verify proof is the planner's conservative path.
+ */
+declare function planFactoryPrStatusHud(input: PlanFactoryPrStatusHudInput): PreviewLifecyclePlan;
+interface RefreshFactoryPrStatusHudInput {
+  readonly cwd: string;
+  readonly headSha: string;
+  readonly mergeBaseSha?: string;
+  readonly owner: string;
+  readonly patchId?: string;
+  readonly pr: number;
+  readonly profilePath?: string;
+  readonly repo: string;
+  readonly token?: string;
+}
+/** Plan from the checkout and present the App-owned HUD. */
+declare function refreshFactoryPrStatusHud(input: RefreshFactoryPrStatusHudInput): Promise<UpsertFactoryPrStatusCommentResult>;
+/**
+ * Presentation must not fail an admission gate. Used after pr:ready publishes
+ * its check so the table is not stuck at first-write.
+ */
+declare function refreshFactoryPrStatusHudSafely(input: RefreshFactoryPrStatusHudInput, onNotice?: (message: string) => void): Promise<void>;
+//#endregion
 //#region src/pr-ready.d.ts
 interface PrReadyArgs extends LoadProjectProfileInput {
   authoringSessionIds?: string[];
@@ -1662,6 +2151,12 @@ interface PrReadyDependencies {
   publishFinalCheckRun?: (input: Omit<PublishFactoryCheckInput, "status"> & {
     conclusion: "failure" | "success";
   }) => Promise<boolean> | boolean;
+  /**
+   * Re-present the App-owned HUD after this run's ready check is published
+   * so the table is not stuck at first-write. Defaults to a safe refresh
+   * that never fails the gate.
+   */
+  presentStatusHud?: (input: RefreshFactoryPrStatusHudInput) => Promise<void> | void;
   /** Injectable delay for the UNKNOWN-mergeable brief poll (tests). */
   sleep?: (ms: number) => Promise<void>;
 }
@@ -1963,108 +2458,18 @@ declare const reviewProofFor: (proof: PrReviewProof | undefined, kind: PrReviewK
 declare namespace review_proof_d_exports {
   export { DEFAULT_PR_REVIEW_MAX_CYCLES, DEFAULT_PR_REVIEW_PROOF_PATH, PR_REVIEW_FINAL_READINESS_NOTICE, PR_REVIEW_FINDING_PROVENANCE_VERSION, PR_REVIEW_PROOF_DESCRIPTOR, PR_REVIEW_SCHEMA_VERSION, PrReviewFinding, PrReviewKind, PrReviewLadderState, PrReviewMode, PrReviewOutcome, PrReviewProof, PrReviewResult, PrReviewStageResolution, REVIEW_SEVERITIES, ReviewAcceptance, ReviewCycleState, ReviewFindingCategory, ReviewFindingSeverity, ReviewTerminalState, prReviewFindingSchema, prReviewProofSchema, prReviewResultSchema, readPrReviewProof, resolveReviewAcceptance, resolveReviewTerminalState, resolveReviewTerminalStateAcrossReviews, resolveReviewTerminalStateAcrossReviewsForPolicy, resolveReviewTerminalStateForEpoch, reviewCycleStateFor, reviewProofFor, validatePrReviewProof, validatePrReviewResult };
 }
-declare const PR_REVIEW_SCHEMA_VERSION = 2;
-declare const PR_REVIEW_FINDING_PROVENANCE_VERSION = 1;
-declare const DEFAULT_PR_REVIEW_PROOF_PATH = ".factory-memory/pr-review.json";
-declare const DEFAULT_PR_REVIEW_MAX_CYCLES = 5;
-declare const PR_REVIEW_FINAL_READINESS_NOTICE = "pr:review is a final readiness proof gate. Run it after local verification and avoid repeated full runs unless the review proof records actionable findings. Default review window: 5 cycles.";
-declare const prReviewFindingSchema: z.ZodType<PrReviewFinding>;
-declare const prReviewResultSchema: z.ZodType<PrReviewResult>;
-declare const prReviewProofSchema: z.ZodType<PrReviewProof>;
-declare const validatePrReviewResult: (value: unknown) => PrReviewResult;
-declare const validatePrReviewProof: (value: unknown) => PrReviewProof;
-declare const readPrReviewProof: (filePath: string) => PrReviewProof;
-declare const PR_REVIEW_PROOF_DESCRIPTOR: ProofDescriptor<PrReviewProof>;
-//#endregion
-//#region src/pr-verify-proof-contract.d.ts
-declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
-type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
-interface PrVerifyCommandResult {
-  command: string;
-  description: string;
-  /**
-   * Epic #550 wave 3 (#430): the profile's declared impact target for this
-   * command, recorded from v4 on. It is the proof's own command→target
-   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
-   * for the same command, so a withholding cannot point at whichever released
-   * target happens to be convenient. Absent for a command the profile does
-   * not scope, and for v1–v3 proofs, which predate the field.
-   */
-  impactTarget?: string;
-  name: string;
-  scope: "always" | "docs-only" | "trivial" | "full";
-}
-interface PrVerifyExecutedCommand {
-  command: string;
-  counts?: {
-    testFiles?: number;
-    tests?: number;
-  };
-  durationMs: number;
-  exitCode: number;
-  name: string;
-  scope: "always" | "docs-only" | "trivial" | "full";
-}
-/**
- * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
- * candidate cannot reach, so the battery did not run it.
- *
- * The completeness invariant lives in the pairing: `verificationCommands`
- * records every command the resolved mode selected, `executedCommands` records
- * what ran, and this list records the rest WITH the stamp's own basis. A
- * withheld stack is therefore never silently absent from the proof — it is
- * present, named, and explained.
- */
-interface PrVerifyNotRequiredCommand {
-  basis: string;
-  impactTarget: string;
-  name: string;
-}
-/**
- * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
- * why. Bound to the proof's stamp identity — the field is v4-only (the same
- * window that can carry `impactStamp`) and refused when the proof records no
- * stamp. The factory does not write this list; consumers do.
- */
-interface PrVerifyNotDemandedRecord {
-  basis: string;
-  name: string;
-}
-interface PrVerifyProof {
-  schemaVersion: PrVerifySchemaVersion;
-  authoringSession?: string;
-  base: string;
-  baselineFullProofs?: {
-    base: string;
-    changedFiles: string[];
-    headSha: string;
-    profilePath: string;
-    projectKey: string;
-    repository: string;
-  }[];
-  changedFiles: string[];
-  classification: DiffClassification;
-  classificationReasons: string[];
-  command: "patronage-factory pr:verify";
-  durationMs: number;
-  endedAt: string;
-  executedCommands?: PrVerifyExecutedCommand[];
-  headSha: string;
-  impactStamp?: ImpactStamp;
-  mode: ResolvedPrVerifyMode;
-  mergeBaseSha?: string;
-  notDemandedRecords?: PrVerifyNotDemandedRecord[];
-  notRequiredCommands?: PrVerifyNotRequiredCommand[];
-  outcome?: "aborted" | "passed";
-  patchId?: string;
-  profilePath: string;
-  projectKey: string;
-  repository: string;
-  startedAt: string;
-  verificationCommands: PrVerifyCommandResult[];
-}
-type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
-declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
+declare const PR_REVIEW_SCHEMA_VERSION = 2;
+declare const PR_REVIEW_FINDING_PROVENANCE_VERSION = 1;
+declare const DEFAULT_PR_REVIEW_PROOF_PATH = ".factory-memory/pr-review.json";
+declare const DEFAULT_PR_REVIEW_MAX_CYCLES = 5;
+declare const PR_REVIEW_FINAL_READINESS_NOTICE = "pr:review is a final readiness proof gate. Run it after local verification and avoid repeated full runs unless the review proof records actionable findings. Default review window: 5 cycles.";
+declare const prReviewFindingSchema: z.ZodType<PrReviewFinding>;
+declare const prReviewResultSchema: z.ZodType<PrReviewResult>;
+declare const prReviewProofSchema: z.ZodType<PrReviewProof>;
+declare const validatePrReviewResult: (value: unknown) => PrReviewResult;
+declare const validatePrReviewProof: (value: unknown) => PrReviewProof;
+declare const readPrReviewProof: (filePath: string) => PrReviewProof;
+declare const PR_REVIEW_PROOF_DESCRIPTOR: ProofDescriptor<PrReviewProof>;
 //#endregion
 //#region src/schemas.d.ts
 declare const boundaryCheckProofSchema: z.ZodObject<{
@@ -2143,7 +2548,7 @@ interface BoundaryCheckDependencies {
 declare function runBoundaryCheck(args: BoundaryCheckArgs, dependencies?: BoundaryCheckDependencies): BoundaryCheckProofRecord;
 declare function validateBoundaryCheckProof(value: unknown): BoundaryCheckProofRecord;
 //#endregion
-//#region src/commands/doctor.d.ts
+//#region src/cli-output.d.ts
 interface CliOutput {
   stderr: Pick<NodeJS.WriteStream, "write">;
   stdout: Pick<NodeJS.WriteStream, "write">;
@@ -2237,153 +2642,6 @@ interface PrReviewDependencies {
   hq?: HqIngestDependencies;
 }
 declare function runPrReview(args: PrReviewArgs, dependencies?: PrReviewDependencies): Promise<PrReviewProof>;
-declare namespace verification_proof_d_exports {
-  export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
-}
-interface VerifiedHeadShas {
-  docsOnlyVerifiedHeadShas: string[];
-  trivialVerifiedHeadShas: string[];
-  verifiedHeadShas: string[];
-}
-type VerificationHeadShas = {
-  explicitFailure: true;
-} | VerifiedHeadShas;
-declare function readPrVerifyProof(filePath: string): PrVerifyProof;
-declare const verifyProofPassed: (proof: PrVerifyProof) => boolean;
-declare const prVerifyProofHeadShas: (proof: PrVerifyProof | undefined, creditedHeadSha?: string) => VerifiedHeadShas;
-declare const verifyProofIdentityMatches: ({
-  currentIdentity,
-  proof
-}: {
-  currentIdentity?: {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  proof?: PrVerifyProof;
-}) => boolean;
-/**
- * Wave-2 consumption (#542): the recorded impact stamp, released for demand
- * resolution ONLY when it is identity-bound to the current candidate — the
- * proof passed, and its recorded headSha AND patchId both name exactly this
- * candidate (the same identities the proof already binds). Everything else —
- * no proof, an aborted run, a stale head, a moved patch id, a pre-stamp proof
- * — returns `undefined`, and the consumer keeps today's full-demand floor.
- *
- * Deliberately stricter than verify-once applicability (which tolerates a
- * head-only or patch-id-only match): a stamp narrows external demands, so it
- * is trusted only on an exact double binding, fail closed.
- */
-declare const trustedImpactStamp: ({
-  candidate,
-  proof
-}: {
-  candidate: {
-    headSha: string;
-    patchId: string;
-  };
-  proof: PrVerifyProof | undefined;
-}) => ImpactStamp | undefined;
-declare const prVerifyFullHeadShasForDiff: ({
-  docsOnlyDeltaAcceptedSince,
-  files,
-  proof
-}: {
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  files: string[];
-  proof: PrVerifyProof;
-}) => string[];
-type VerificationProofState = {
-  kind: "typed-aborted";
-  proof: PrVerifyProof;
-} | {
-  kind: "typed-missing";
-  path: string;
-  reason: "enoent" | "invalid";
-  message?: string;
-} | {
-  kind: "typed";
-  headShas: VerifiedHeadShas;
-  proof: PrVerifyProof;
-} | {
-  kind: "typed-diff-mismatch";
-  mode: ResolvedPrVerifyMode;
-};
-declare const verificationProofStateFor: ({
-  proof,
-  proofMatchesCurrentDiff,
-  proofPath
-}: {
-  proof?: PrVerifyProof;
-  proofMatchesCurrentDiff?: boolean;
-  proofPath?: string;
-}) => VerificationProofState;
-declare const verificationProofApplicabilityFor: ({
-  docsOnlyDeltaAcceptedSince,
-  explicitProof,
-  files,
-  headSha,
-  currentIdentity,
-  proof,
-  proofPath,
-  proofReadError
-}: {
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  explicitProof: boolean;
-  files: string[];
-  headSha: string;
-  currentIdentity?: {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  proof?: PrVerifyProof;
-  proofPath?: string;
-  proofReadError?: unknown;
-}) => {
-  fullVerifiedHeadShas: never[];
-  verificationProof: VerificationProofState;
-} | {
-  fullVerifiedHeadShas: string[];
-  verificationProof: {
-    headShas: VerifiedHeadShas;
-    kind: "typed";
-    proof: PrVerifyProof;
-  };
-};
-declare const resolveVerifyProofApplicability: ({
-  proofPath,
-  explicitProof,
-  docsOnlyDeltaAcceptedSince,
-  files,
-  headSha,
-  currentVerifyIdentityForBase,
-  preread
-}: {
-  proofPath: string;
-  explicitProof: boolean;
-  docsOnlyDeltaAcceptedSince?: (baselineHeadSha: string) => boolean;
-  files: string[];
-  headSha: string;
-  currentVerifyIdentityForBase?: (base: string) => {
-    patchId: string;
-    mergeBaseSha?: string;
-  };
-  preread?: {
-    proof?: PrVerifyProof;
-    error?: unknown;
-  };
-}) => {
-  fullVerifiedHeadShas: never[];
-  verificationProof: VerificationProofState;
-} | {
-  fullVerifiedHeadShas: string[];
-  verificationProof: {
-    headShas: VerifiedHeadShas;
-    kind: "typed";
-    proof: PrVerifyProof;
-  };
-};
-declare const verificationProofForReadiness: (state: VerificationProofState) => VerificationHeadShas;
-declare const verificationProofBlockingReason: (state: VerificationProofState) => string | undefined;
 //#endregion
 //#region src/workspace-install-resolution.d.ts
 interface CleanInstallResolutionDependencies {
@@ -2603,6 +2861,22 @@ type PrReadyAction = (args: PrReadyArgs) => Promise<unknown>;
 //#region src/commands/pr-review.d.ts
 type PrReviewAction = (args: PrReviewArgs) => Promise<unknown>;
 //#endregion
+//#region src/pr-status-hud-command.d.ts
+interface PrStatusHudArgs {
+  readonly cwd: string;
+  readonly headSha: string;
+  readonly owner: string;
+  readonly planPath?: string;
+  readonly pr: number;
+  readonly repo: string;
+  readonly token: string;
+}
+type PrStatusHudAction = (args: PrStatusHudArgs) => Promise<{
+  action: string;
+  commentId: number;
+  url: string;
+}>;
+//#endregion
 //#region src/packages/trace/implementation/core.d.ts
 declare const FactoryTraceEnvelopeCoreSchema: z.ZodObject<{
   createdAt: z.ZodString;
@@ -3234,8 +3508,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    review: "review";
     code: "code";
+    review: "review";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
@@ -3313,8 +3587,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    review: "review";
     code: "code";
+    review: "review";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
@@ -3383,8 +3657,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     interiorCycle: z.ZodOptional<z.ZodNumber>;
     observedAt: z.ZodString;
     purpose: z.ZodEnum<{
-      review: "review";
       code: "code";
+      review: "review";
     }>;
     slotResolution: z.ZodObject<{
       effort: z.ZodEnum<{
@@ -3456,7 +3730,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   exitCode: number | null;
   harness: string;
   observedAt: string;
-  purpose: "review" | "code";
+  purpose: "code" | "review";
   slotResolution: {
     effort: "high" | "low" | "medium" | "xhigh";
     engine: string;
@@ -3739,7 +4013,7 @@ declare const CORRECTNESS_UNTYPED_REVIEW_BLOCKER_REASON = "Correctness review pr
 declare const SECURITY_UNTYPED_REVIEW_BLOCKER_REASON = "Security review proof is not a head-bound typed findings verdict; re-run pr:review with a valid findings file.";
 declare const DRAFT_BLOCKER_REASON = "PR is still marked draft.";
 declare const PENDING_CHECKS_BLOCKER_REASON_PREFIX = "Required/current checks are";
-declare const readinessExitCode: (status: ReadinessStatus) => 1 | 0;
+declare const readinessExitCode: (status: ReadinessStatus) => 0 | 1;
 interface EvaluationInput {
   pr: number;
   prTitle?: string;
@@ -4290,92 +4564,6 @@ declare const planVerificationBattery: <Command extends BatteryCandidateCommand>
 /** Console lines naming every withheld command and why. Never silent. */
 declare const batteryScopeSummaryLines: (plan: VerificationBatteryPlan<BatteryCandidateCommand>) => string[];
 //#endregion
-//#region src/preview-lifecycle.d.ts
-type PreviewDisposition = "deploy" | "not-required";
-interface PreviewTargetPlan {
-  basis: string;
-  disposition: PreviewDisposition;
-  name: string;
-}
-interface PreviewLifecyclePlan {
-  /** The declared preview stacks to deploy, in declaration order. */
-  deploy: string[];
-  /** The withheld stacks, in declaration order. */
-  notRequired: PreviewTargetPlan[];
-  /** Whether a trusted, identity-bound stamp was available at all. */
-  stampTrusted: boolean;
-  /** Every declared preview target with its disposition, in declaration order. */
-  targets: PreviewTargetPlan[];
-}
-/**
- * Structural subset of the profile: the impact declarations plus the external
- * demand list. Structural rather than a `Pick` so this module does not import
- * `profile.ts`.
- */
-interface PreviewLifecycleProfile {
-  impact?: {
-    targets: {
-      name: string;
-    }[];
-  };
-  requiredChecks?: {
-    name: string;
-  }[];
-}
-/**
- * The declared preview stacks: impact targets that are ALSO declared required
- * checks — i.e. targets whose proof is produced externally, which is exactly
- * what a preview producer is.
- *
- * Deriving the list from the two existing declarations rather than adding a
- * third is what makes lifecycle and demand unable to disagree: the stacks this
- * plan can withhold are precisely the demands wave 2 can release, so a stack
- * can never be skipped while its proof stays demanded.
- */
-declare const previewLifecycleTargets: (profile: PreviewLifecycleProfile) => string[];
-/**
- * Plan the preview lifecycle for one candidate.
- *
- * Trust is resolved here through the SAME identity gate demand release uses
- * (`trustedImpactStamp`): the proof must have passed and must bind both the
- * candidate's headSha and its patchId. A stale, aborted, absent, or
- * differently-bound proof yields no stamp, and every declared stack is planned
- * for deploy. Total over its INPUTS — no proof, stamp, or profile can make it
- * throw. A malformed CALL is the deliberate exception: omitting
- * `vetoedTargets` is API misuse, not data doubt, and throws.
- */
-declare const planPreviewLifecycle: ({
-  candidate,
-  profile,
-  proof,
-  vetoedTargets
-}: {
-  candidate: {
-    headSha: string;
-    patchId: string;
-  };
-  profile: PreviewLifecycleProfile;
-  proof: PrVerifyProof | undefined;
-  /**
-   * Stack names with a current, candidate-bound FAILING envelope. Scoping is
-   * withheld for these whatever the stamp says — the same veto demand release
-   * applies, and for the same reason: a withheld stack is a stack that can
-   * never re-emit the envelope its standing demand needs. Callers hold the
-   * checkout context, so they resolve the set with `boundFailingCheckNames`
-   * and pass it in; this module stays pure.
-   *
-   * REQUIRED, with no default, on purpose: a defaulted `[]` reads the same
-   * whether the caller inspected the envelopes or never looked, and this seam
-   * exists precisely for EXTERNAL preview producers — the callers most likely
-   * to skip the lookup. Pass the result of `boundFailingCheckNames`; pass `[]`
-   * only to mean "inspected the envelopes and found no bound failure".
-   *
-   * Deliberately visible to `api:check` as a breaking signature change
-   * (pre-1.0, no external callers yet).
-   */
-  vetoedTargets: readonly string[];
-}) => PreviewLifecyclePlan;
-//#endregion
 //#region src/worker-checkout-guard.d.ts
 type CheckoutDirsProbe = (cwd: string) => {
   gitCommonDir: string;
@@ -4402,6 +4590,7 @@ interface CreateProgramOptions {
     prPublish?: PrPublishAction;
     prReady?: PrReadyAction;
     prReview?: PrReviewAction;
+    prStatusHud?: PrStatusHudAction;
   };
   factoryCliInvocation?: FactoryCliInvocation;
   output?: CliOutput;
@@ -4409,4 +4598,4 @@ interface CreateProgramOptions {
 declare function createProgram(options?: CreateProgramOptions): Command;
 declare function run(argv?: string[]): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readPrReadyProof, readPrReviewProof, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, type CompletedFactoryCheckSnapshot, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryPrStatusCheckName, type FactoryPrStatusSources, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FindingDisposition, type FindingLedgerEntry, type FollowUpAction, FollowUpActionSchema, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type LadderDispositionDeclaration, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeState, type PlanFactoryPrStatusHudInput, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PresentFactoryPrStatusHudDependencies, type PresentFactoryPrStatusHudInput, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReadFactoryPrStatusSourcesDependencies, type ReadFactoryPrStatusSourcesInput, type RefreshFactoryPrStatusHudInput, type RenderFactoryPrStatusHudInput, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewLadderCycle, type ReviewLadderEvaluation, type ReviewLadderPolicy, type ReviewLadderStageEvent, type ReviewLadderTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendReviewLadderStageTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertFactoryPrStatusIdentity, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, blockingLadderFindings, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, buildReviewLadderStageTraceEvent, comment_provenance_d_exports as commentProvenance, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evaluateReviewLadder, evidenceEnvelopeFilename, findingKey, followUpFromArgv, impactStampScopeDecision, inferFixedInThreadDispositions, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, openLadderFindings, planFactoryPrStatusHud, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, presentFactoryPrStatusHud, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readFactoryPrStatusSources, readPrReadyProof, readPrReviewProof, refreshFactoryPrStatusHud, refreshFactoryPrStatusHudSafely, renderFactoryPrStatusHud, resolveFactoryRepository, resolveFindingBlocking, resolveReviewFindingCategory, resolveReviewFindingSeverity, resolveReviewLadderPolicy, resolveTraceWriteSinks, reviewCycleStateFor, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, staleRepeatLadderFindings, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, tryAppendReviewLadderStageTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrReviewProof, validatePrVerifyProof, validatePreviewLifecyclePlan, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };