@patronage/software-factory 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/schemas.js

@@ -228,6 +228,16 @@ const waivedDemandSchema = z.object({
 	session: z.string().trim().min(1).optional(),
 	unmetReasons: z.array(z.string().min(1)).min(1)
 });
+//#endregion
+//#region src/catch-up-recognition-record.ts
+const objectShaSchema = z.string().regex(/^[0-9a-f]{40}$/u);
+const catchUpRecognitionSchema = z.object({
+	baseRef: z.string().min(1),
+	baseTipSha: objectShaSchema,
+	mergedParentSha: objectShaSchema,
+	mergedTreeSha: objectShaSchema,
+	upstreamRef: z.string().min(1)
+}).strict();
 const impactStampTargetSchema = z.object({
 	basis: z.string().min(1),
 	impact: z.enum(["affected", "not-affected"]),
@@ -241,15 +251,17 @@ const impactStampTargetSchema = z.object({
 */
 const impactStampSchema = z.object({
 	basis: z.enum(["target-scoped", "conservative"]),
+	inertPaths: z.array(z.string()).default([]),
 	reasons: z.array(z.string()),
-	stampVersion: z.literal(2),
+	stampVersion: z.literal(3),
 	targets: z.array(impactStampTargetSchema).superRefine((targets, context) => {
 		const names = targets.map((target) => target.name);
 		if (new Set(names).size !== names.length) context.addIssue({
 			code: "custom",
 			message: "impact stamp targets must have distinct names."
 		});
-	})
+	}),
+	unsubscribedPaths: z.array(z.string())
 });
 /**
 * The surfaces that consume the stamp. One classification, consumed
@@ -287,8 +299,8 @@ const impactStampScopeDecision = ({ stamp, surface, targetName }) => {
 		reason: `no trusted identity-bound impact stamp covers this candidate; ${floor}`,
 		scoped: false
 	};
-	if (stamp.stampVersion !== 2) return {
-		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 2; ${floor}`,
+	if (stamp.stampVersion !== 3) return {
+		reason: `impact stamp version ${String(stamp.stampVersion)} is not this build's version 3; ${floor}`,
 		scoped: false
 	};
 	if (stamp.basis !== "target-scoped") return {
@@ -513,85 +525,135 @@ const assertPrVerifyProofRules = (proof, context) => {
 		message: "notRequiredCommands is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
 		path: ["notRequiredCommands"]
 	});
+	if (proof.schemaVersion < 4 && proof.catchUpRecognition !== void 0) context.addIssue({
+		code: "custom",
+		message: "catchUpRecognition is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["catchUpRecognition"]
+	});
+	if (proof.schemaVersion < 4 && proof.notDemandedRecords !== void 0) context.addIssue({
+		code: "custom",
+		message: "notDemandedRecords is a schemaVersion>=4 field; a v1–v3 pr:verify proof must not carry it.",
+		path: ["notDemandedRecords"]
+	});
+	if (proof.notDemandedRecords !== void 0 && proof.impactStamp === void 0) context.addIssue({
+		code: "custom",
+		message: "notDemandedRecords requires impactStamp; package-level not-demanded records are bound to the stamp identity.",
+		path: ["notDemandedRecords"]
+	});
 	assertBatteryCompleteness(proof, context);
 	assertNotRequiredStampAuthorization(proof, context);
 };
-const LEGACY_CLOSEOUT_SCHEMA_VERSION = 3;
-/** Current writer plus retained reader versions accepted at ingest. */
-const SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS = [LEGACY_CLOSEOUT_SCHEMA_VERSION, 4];
+//#endregion
+//#region src/pr-verify-proof-contract.ts
+const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS = [
+	1,
+	2,
+	3,
+	4
+];
+const executedCommandSchema = z.object({
+	command: z.string().min(1),
+	counts: z.object({
+		testFiles: z.number().nonnegative().optional(),
+		tests: z.number().nonnegative().optional()
+	}).optional(),
+	durationMs: z.number().nonnegative(),
+	exitCode: z.number(),
+	name: z.string().min(1),
+	scope: z.enum([
+		"always",
+		"docs-only",
+		"trivial",
+		"full"
+	])
+});
+const notRequiredCommandSchema = z.object({
+	basis: z.string().min(1),
+	impactTarget: z.string().min(1),
+	name: z.string().min(1)
+});
+const notDemandedRecordSchema = z.object({
+	basis: z.string().min(1),
+	name: z.string().min(1)
+});
+const prVerifySchemaVersionSchema = z.number().refine((value) => SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.includes(value), { message: `schemaVersion must be one of: ${SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.join(", ")}` });
+const prVerifyProofSchema = z.object({
+	authoringSession: z.string().trim().min(1).optional(),
+	base: z.string().min(1),
+	baselineFullProofs: z.array(z.object({
+		base: z.string().min(1),
+		changedFiles: z.array(z.string()),
+		headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+		profilePath: z.string().min(1),
+		projectKey: z.string().min(1),
+		repository: z.string().min(1)
+	})).optional(),
+	catchUpRecognition: catchUpRecognitionSchema.optional(),
+	changedFiles: z.array(z.string()),
+	classification: z.enum([
+		"docs/process-only",
+		"trivial",
+		"non-trivial"
+	]),
+	classificationReasons: z.array(z.string()),
+	command: z.literal("patronage-factory pr:verify"),
+	durationMs: z.number().nonnegative(),
+	endedAt: z.iso.datetime(),
+	executedCommands: z.array(executedCommandSchema).optional(),
+	headSha: z.string().regex(/^[0-9a-f]{40}$/u),
+	impactStamp: impactStampSchema.optional(),
+	mergeBaseSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
+	mode: z.enum([
+		"docs-only",
+		"trivial",
+		"full"
+	]),
+	notDemandedRecords: z.array(notDemandedRecordSchema).min(1).optional(),
+	notRequiredCommands: z.array(notRequiredCommandSchema).min(1).optional(),
+	outcome: z.enum(["aborted", "passed"]).optional(),
+	patchId: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
+	profilePath: z.string().min(1),
+	projectKey: z.string().min(1),
+	repository: z.string().min(1),
+	schemaVersion: prVerifySchemaVersionSchema,
+	startedAt: z.iso.datetime(),
+	verificationCommands: z.array(z.object({
+		command: z.string().min(1),
+		description: z.string().min(1),
+		impactTarget: z.string().min(1).optional(),
+		name: z.string().min(1),
+		scope: z.enum([
+			"always",
+			"docs-only",
+			"trivial",
+			"full"
+		])
+	}))
+}).superRefine(assertPrVerifyProofRules);
+/** Artifact versions accepted at ingest. */
+const SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS = [5];
 const MAX_CLOSEOUT_ROWS = 1e3;
 const IdentifierSchema = z.string().min(1).max(500);
 const NarrativeSchema = z.string().min(1).max(1e4);
 const RepoSchema = z.string().min(1).max(200);
-const IsoDateSchema = z.string().regex(/^\d{4}-\d{2}-\d{2}$/u);
-const CloseoutLandingSpotSchema = z.enum([
-	"CLI",
-	"profile",
-	"skill",
-	"ADR"
-]);
-const CurrentCloseoutSourceSchema = z.object({
-	detail: NarrativeSchema,
-	kind: z.literal("boundary-thermo-attestation")
-}).strict();
-const LegacyCloseoutSourceSchema = z.object({
+const CloseoutSourceSchema = z.object({
 	detail: NarrativeSchema,
-	kind: z.enum(["interior-telemetry", "boundary-thermo-attestation"])
-}).strict();
-const LegacyCloseoutScopingSchema = z.object({
-	epic: IdentifierSchema,
-	issueFilter: z.number().int().positive().optional(),
-	prFilter: z.number().int().positive().optional(),
-	repo: RepoSchema,
-	scopedByEpicIssueSet: z.boolean(),
-	window: z.object({
-		from: IsoDateSchema,
-		to: IsoDateSchema
-	}).strict()
+	kind: z.literal("token-harvest")
 }).strict();
 const CloseoutBudgetSchema = z.object({
 	note: NarrativeSchema,
 	tier: z.literal("overseer")
 }).strict();
-const LegacyCloseoutBudgetSchema = z.object({
-	interiorSourcesConsumed: z.number().int().nonnegative(),
-	note: NarrativeSchema,
-	scoping: LegacyCloseoutScopingSchema.optional(),
-	tier: z.literal("overseer")
-}).strict();
-const BoundaryThermoAttestationSchema = z.object({
-	owner: z.string().min(1).max(200),
-	runs: z.number().int().nonnegative(),
-	waived: z.boolean(),
-	waiverRationale: NarrativeSchema.optional()
-}).strict();
 const CloseoutMetricRowSchema = z.object({
 	label: IdentifierSchema,
 	metric: IdentifierSchema,
-	source: CurrentCloseoutSourceSchema,
+	source: CloseoutSourceSchema,
 	unit: z.enum([
-		"count",
 		"boolean",
-		"text"
-	]),
-	value: z.union([
-		z.number(),
-		NarrativeSchema,
-		z.boolean(),
-		z.null()
-	])
-}).strict();
-const LegacyCloseoutMetricRowSchema = z.object({
-	label: IdentifierSchema,
-	metric: IdentifierSchema,
-	source: LegacyCloseoutSourceSchema,
-	unit: z.enum([
-		"tokens",
-		"usd",
 		"count",
-		"ratio",
-		"boolean",
-		"text"
+		"text",
+		"tokens",
+		"usd"
 	]),
 	value: z.union([
 		z.number(),
@@ -600,306 +662,21 @@ const LegacyCloseoutMetricRowSchema = z.object({
 		z.null()
 	])
 }).strict();
-const CloseoutLessonSchema = z.object({
-	id: IdentifierSchema,
-	landingSpot: CloseoutLandingSpotSchema,
-	lesson: NarrativeSchema,
-	rationale: NarrativeSchema.optional(),
-	source: CurrentCloseoutSourceSchema.optional()
-}).strict();
-const LegacyCloseoutLessonSchema = z.object({
-	id: IdentifierSchema,
-	landingSpot: CloseoutLandingSpotSchema,
-	lesson: NarrativeSchema,
-	rationale: NarrativeSchema.optional(),
-	source: LegacyCloseoutSourceSchema.optional()
-}).strict();
 const CloseoutBlindspotSchema = z.object({
 	id: IdentifierSchema,
 	note: NarrativeSchema,
 	reason: NarrativeSchema.optional()
 }).strict();
-const closeoutLedgerRowSchema = (schemaVersion) => z.object({
-	detail: NarrativeSchema.optional(),
-	epic: IdentifierSchema,
-	generatedAt: z.iso.datetime(),
-	key: IdentifierSchema,
-	landingSpot: CloseoutLandingSpotSchema.optional(),
-	repo: RepoSchema,
-	rowType: z.enum([
-		"metric",
-		"lesson",
-		"blindspot"
-	]),
-	schemaVersion: z.literal(schemaVersion),
-	source: NarrativeSchema,
-	unit: IdentifierSchema.optional(),
-	value: z.union([
-		NarrativeSchema,
-		z.number(),
-		z.null()
-	])
-}).strict();
-const CloseoutLedgerRowSchema = closeoutLedgerRowSchema(4);
-const LegacyCloseoutLedgerRowSchema = closeoutLedgerRowSchema(LEGACY_CLOSEOUT_SCHEMA_VERSION);
-const closeoutArtifactShape = (input) => z.object({
-	boundaryThermo: BoundaryThermoAttestationSchema,
-	budget: input.budget,
+/** Strict, bounded runtime transport contract emitted by factory:closeout. */
+const closeoutArtifactSchema = z.object({
+	budget: CloseoutBudgetSchema,
 	couldNotSee: z.array(CloseoutBlindspotSchema).min(1).max(MAX_CLOSEOUT_ROWS),
 	epic: IdentifierSchema,
 	generatedAt: z.iso.datetime(),
-	ledgerRows: z.array(input.ledgerRows).max(MAX_CLOSEOUT_ROWS),
-	lessons: z.array(input.lessons).max(MAX_CLOSEOUT_ROWS),
-	metrics: z.array(input.metrics).max(MAX_CLOSEOUT_ROWS),
+	metrics: z.array(CloseoutMetricRowSchema).max(MAX_CLOSEOUT_ROWS),
 	repo: RepoSchema,
-	schemaVersion: z.literal(input.schemaVersion)
+	schemaVersion: z.literal(5)
 }).strict();
-/** Strict, bounded runtime transport contract emitted by factory:closeout. */
-const closeoutArtifactSchema = closeoutArtifactShape({
-	budget: CloseoutBudgetSchema,
-	ledgerRows: CloseoutLedgerRowSchema,
-	lessons: CloseoutLessonSchema,
-	metrics: CloseoutMetricRowSchema,
-	schemaVersion: 4
-});
-/** Reader-only compatibility for closeout artifacts written before #554. */
-const legacyCloseoutArtifactSchema = closeoutArtifactShape({
-	budget: LegacyCloseoutBudgetSchema,
-	ledgerRows: LegacyCloseoutLedgerRowSchema,
-	lessons: LegacyCloseoutLessonSchema,
-	metrics: LegacyCloseoutMetricRowSchema,
-	schemaVersion: LEGACY_CLOSEOUT_SCHEMA_VERSION
-});
-/** Accept current output and retained v3 artifacts when reading or replaying. */
-const closeoutArtifactReadSchema = z.union([closeoutArtifactSchema, legacyCloseoutArtifactSchema]);
-//#endregion
-//#region src/retro-envelope.ts
-/**
-* Versioned retro envelope schema (epic #27 wave 2, issue #34).
-*
-* One envelope per lane, built at `factory:closeout` and delivered through the
-* typed gate-sink as the `retro-envelope` ingest kind. Re-derived in TypeScript
-* from the `spike/telemetry-layer2` S5 scratch schema (reference-only, never
-* merged). This module is the single source of truth for the v1 wire shape
-* and its bounds ({@link RETRO_ENVELOPE_WIRE_BOUNDS}) — producer and consumer
-* alike. HQ imports these exports directly from the Worker-safe
-* `@patronage/software-factory/schemas` subpath
-* (`software-factory-hq/src/contracts/retro-schemas.ts`) instead of
-* maintaining a parallel hand-written copy, so there is exactly one wire
-* contract and no drift-detection machinery is needed (issue #350; formerly
-* a hand-written twin plus a 767-line parity test, #46).
-*
-* DESIGN INVARIANT: cross-family token sums must be UNREPRESENTABLE.
-*
-* The two model families use different tokenizers, prices, and accounting
-* conventions, so any token total that spans Claude and GPT is a lie:
-*
-* 1. There is no combined/total token field anywhere in the envelope.
-* 2. `tokenFamilies` is strict — its only keys are `claude` and `gpt`; data
-*    cannot smuggle in a third "all"/"combined" slot.
-* 3. The family BLOCKS are structurally different shapes with DIFFERENT keys
-*    (claude is a single flat block keyed on freshInput/cacheReadInput/
-*    cacheCreationInput; gpt is `{ roles: [...] }`). The exclusive input-tier
-*    COUNTS share no key name across families. The residual names shared
-*    between the claude block and a gpt ROLE entry are pinned to exactly
-*    {costUsd, model, output} (PR #32 advisory): `costUsd` is deliberate —
-*    USD is the one cross-family summable unit (rule 4); `model` is an
-*    unsummable label; `output` is the same name at DIFFERENT depths (lane
-*    block vs per-role entry), frozen by a tripwire test in
-*    `retro-envelope.test.ts` so the overlap cannot grow. Renaming `output`
-*    is a schemaVersion-2 wire change, deliberately not spent in v1.
-* 4. Cost is per-family USD and nullable. Combined totals are allowed in USD
-*    only, and only as a projection-time sum of per-family USD.
-*
-* Field names also encode the S2/S3 reader lessons: Claude `freshInput` alone
-* is not prompt size (true input context = freshInput + cacheReadInput +
-* cacheCreationInput, requestId-deduped), and codex `inputInclusiveOfCache`
-* already includes `cachedInput`, so `freshInputDerived` (inclusive − cached)
-* is the only value safe to feed a per-token pricer.
-*
-* COMPLETENESS POSTURE: harvest may have no usable native log for a lane, so
-* `tokenFamilies` may legitimately be absent. The closeout build gate demands
-* a valid envelope, not available telemetry. A families-absent envelope keeps
-* its operator-visible data gaps and is a replayable advisory HQ event, so it
-* never substitutes unavailable usage with zero. The wire shape (field names,
-* types, structure) stays byte-parity with HQ v1.
-*/
-const RETRO_ENVELOPE_SCHEMA_VERSION = 1;
-/**
-* v1 wire bounds — the single source the schemas below are built from and the
-* builder's sanitization seam clamps to (`retro-envelope-builder.ts` imports
-* these; it keeps no bound constants of its own). HQ imports this module
-* directly (issue #350), so there is one set of bounds, not a second copy to
-* keep in sync.
-*/
-const RETRO_ENVELOPE_WIRE_BOUNDS = {
-	/** archiveRef pointer (key/URL) max characters. */
-	archiveRefMaxChars: 2048,
-	/** refs.branch max characters (git ref length ceiling). */
-	branchMaxChars: 255,
-	/** gates[] wire cap — the builder keeps the most recent records. */
-	gatesMax: 500,
-	/** gpt roles[] cap (delegated roles per lane). */
-	gptRolesMax: 20,
-	/** Cap for list fields: joinKeys id arrays, phases, dataGaps. */
-	listMax: 100,
-	/** Bounded name fields: agentRunId, gate, phase name, refs, join-key ids. */
-	nameMaxChars: 200,
-	/** Short identifier fields: repo name/owner, model, role. */
-	shortMaxChars: 100,
-	/** Free-text fields: dataGaps entries, outcome.verdict. */
-	textMaxChars: 500
-};
-const nonNegInt = z.number().int().nonnegative();
-const isoTimestamp = z.iso.datetime();
-const boundedName = z.string().min(1).max(RETRO_ENVELOPE_WIRE_BOUNDS.nameMaxChars);
-const boundedShortName = z.string().min(1).max(RETRO_ENVELOPE_WIRE_BOUNDS.shortMaxChars);
-const boundedText = z.string().min(1).max(RETRO_ENVELOPE_WIRE_BOUNDS.textMaxChars);
-const RetroRepoSchema = z.object({
-	name: boundedShortName,
-	owner: boundedShortName
-}).strict();
-const RetroRefsSchema = z.object({
-	branch: z.string().min(1).max(RETRO_ENVELOPE_WIRE_BOUNDS.branchMaxChars).optional(),
-	epic: boundedName.optional(),
-	headSha: z.string().regex(/^[0-9a-f]{7,40}$/u).optional(),
-	issue: boundedName.optional(),
-	prNumber: z.number().int().positive().optional()
-}).strict();
-/**
-* Per-lane join keys: how the envelope re-joins raw per-session sources.
-* `agentRunId` lives at the envelope root; these carry the per-family session
-* identities (Claude `session.id`, codex `threadId`).
-*/
-const RetroJoinKeysSchema = z.object({
-	claudeSessionIds: z.array(boundedName).max(RETRO_ENVELOPE_WIRE_BOUNDS.listMax).default([]),
-	codexThreadIds: z.array(boundedName).max(RETRO_ENVELOPE_WIRE_BOUNDS.listMax).default([])
-}).strict();
-const RetroWallClockSchema = z.object({
-	endTs: isoTimestamp,
-	startTs: isoTimestamp,
-	totalSec: z.number().nonnegative()
-}).strict();
-const RetroPhaseMarkSchema = z.object({
-	at: isoTimestamp,
-	deltaSec: z.number().nonnegative().optional(),
-	name: boundedName
-}).strict();
-/** Gate-timing ledger entry: `{gate, startedAt, duration, outcome, cycle}`. */
-const RetroGateLedgerEntrySchema = z.object({
-	cycle: nonNegInt,
-	duration: z.number().nonnegative(),
-	gate: boundedName,
-	outcome: z.enum([
-		"pass",
-		"fail",
-		"skip"
-	]),
-	startedAt: isoTimestamp
-}).strict();
-/**
-* Claude family: Anthropic-style EXCLUSIVE input tiers. True input context is
-* freshInput + cacheReadInput + cacheCreationInput; values are
-* requestId-deduped (S2: naive row sums overcount input ~1.94x).
-*/
-const claudeTokenBlockSchema = z.object({
-	cacheCreationInput: nonNegInt,
-	cacheReadInput: nonNegInt,
-	costUsd: z.number().nonnegative().nullable(),
-	family: z.literal("claude"),
-	freshInput: nonNegInt,
-	model: boundedShortName,
-	output: nonNegInt,
-	requests: nonNegInt
-}).strict();
-/**
-* GPT/codex family, per delegated role. codex reports `input_tokens`
-* INCLUSIVE of cached tokens; `freshInputDerived` = inclusive − cached is the
-* only value safe for a per-token pricer (S3: skipping this overprices ~3.9x).
-*/
-const gptRoleUsageSchema = z.object({
-	cachedInput: nonNegInt,
-	costUsd: z.number().nonnegative().nullable(),
-	freshInputDerived: nonNegInt,
-	inputInclusiveOfCache: nonNegInt,
-	model: boundedShortName,
-	output: nonNegInt,
-	reasoningOutput: nonNegInt,
-	role: boundedShortName,
-	threadId: boundedName.optional()
-}).strict().refine((usage) => usage.freshInputDerived === usage.inputInclusiveOfCache - usage.cachedInput, { message: "freshInputDerived must equal inputInclusiveOfCache - cachedInput (S3 accounting rule)" });
-const gptTokenBlockSchema = z.object({
-	family: z.literal("gpt"),
-	roles: z.array(gptRoleUsageSchema).min(1).max(RETRO_ENVELOPE_WIRE_BOUNDS.gptRolesMax)
-}).strict();
-/**
-* Strict: only `claude` and `gpt`, both optional, no third slot.
-*
-* A lane may have no usable native session data. The build gate accepts that
-* state and the advisory sink journals the valid envelope with its recorded
-* gaps, without inventing usage.
-*/
-const retroTokenFamiliesSchema = z.object({
-	claude: claudeTokenBlockSchema.optional(),
-	gpt: gptTokenBlockSchema.optional()
-}).strict();
-const RetroCycleCountersSchema = z.object({
-	gateRunsToFirstGreen: nonNegInt,
-	reviewerFixRounds: nonNegInt,
-	thermoFixRounds: nonNegInt
-}).strict();
-const RetroOutcomeSchema = z.object({
-	status: z.enum([
-		"success",
-		"blocked",
-		"fail",
-		"ship-with-followups"
-	]),
-	verdict: boundedText.optional()
-}).strict();
-const retroEnvelopeV1Schema = z.object({
-	agentRunId: boundedName,
-	/** Pointer (key/URL) to #8's durable proof archive — never the payload. */
-	archiveRef: z.string().min(1).max(RETRO_ENVELOPE_WIRE_BOUNDS.archiveRefMaxChars).optional(),
-	cycles: RetroCycleCountersSchema,
-	dataGaps: z.array(boundedText).max(RETRO_ENVELOPE_WIRE_BOUNDS.listMax).default([]),
-	gates: z.array(RetroGateLedgerEntrySchema).max(RETRO_ENVELOPE_WIRE_BOUNDS.gatesMax),
-	generatedAt: isoTimestamp,
-	interventions: z.object({ count: nonNegInt }).strict(),
-	joinKeys: RetroJoinKeysSchema,
-	kind: z.literal("retro-envelope"),
-	outcome: RetroOutcomeSchema.optional(),
-	phases: z.array(RetroPhaseMarkSchema).max(RETRO_ENVELOPE_WIRE_BOUNDS.listMax),
-	refs: RetroRefsSchema,
-	repo: RetroRepoSchema,
-	schemaVersion: z.literal(1),
-	tokenFamilies: retroTokenFamiliesSchema,
-	wallClock: RetroWallClockSchema
-}).strict().refine((envelope) => envelope.refs.epic !== void 0 || envelope.refs.issue !== void 0 || envelope.refs.prNumber !== void 0, { message: "refs must anchor to an epic, issue, or PR" });
-/**
-* Version 1 envelopes written before #170 carried an inert `harness` label.
-* Accept that exact historical field and normalize it away. The current strict
-* schema above neither emits nor exposes it, and all other unknown fields still
-* fail validation.
-*/
-const retroEnvelopeV1ReaderSchema = z.preprocess((candidate) => {
-	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate) || !("harness" in candidate)) return candidate;
-	const record = candidate;
-	if (!boundedShortName.safeParse(record.harness).success) return candidate;
-	const { harness: _historicalHarness, ...current } = record;
-	return current;
-}, retroEnvelopeV1Schema);
-/**
-* Versioned payload validators, keyed by schema major. Unknown majors never
-* reach these — {@link parseRetroEnvelope} returns them raw and marked
-* degraded, mirroring HQ's ingest skew posture (stored raw, never dropped).
-*/
-const RETRO_ENVELOPE_VALIDATORS = { [1]: retroEnvelopeV1ReaderSchema };
-const SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS = Object.keys(RETRO_ENVELOPE_VALIDATORS).map(Number);
-/** Epic anchor for an envelope: refs.epic, else refs.issue, else the PR. */
-const retroEpicReference = (refs) => {
-	return (refs.epic ?? refs.issue ?? (refs.prNumber === void 0 ? void 0 : `pr#${refs.prNumber}`))?.replace(/^#/u, "");
-};
 //#endregion
 //#region src/schemas.ts
 const EVIDENCE_CHECK_TYPES = ["review", "verify"];
@@ -970,81 +747,6 @@ const evidenceEnvelopeSchema = z.object({
 		});
 	}
 });
-const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS = [
-	1,
-	2,
-	3,
-	4
-];
-const executedCommandSchema = z.object({
-	command: z.string().min(1),
-	counts: z.object({
-		testFiles: z.number().nonnegative().optional(),
-		tests: z.number().nonnegative().optional()
-	}).optional(),
-	durationMs: z.number().nonnegative(),
-	exitCode: z.number(),
-	name: z.string().min(1),
-	scope: z.enum([
-		"always",
-		"docs-only",
-		"trivial",
-		"full"
-	])
-});
-const notRequiredCommandSchema = z.object({
-	basis: z.string().min(1),
-	impactTarget: z.string().min(1),
-	name: z.string().min(1)
-});
-const prVerifySchemaVersionSchema = z.number().refine((value) => SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.includes(value), { message: `schemaVersion must be one of: ${SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS.join(", ")}` });
-const prVerifyProofSchema = z.object({
-	authoringSession: z.string().trim().min(1).optional(),
-	base: z.string().min(1),
-	baselineFullProofs: z.array(z.object({
-		base: z.string().min(1),
-		changedFiles: z.array(z.string()),
-		headSha: z.string().regex(/^[0-9a-f]{40}$/u),
-		profilePath: z.string().min(1),
-		projectKey: z.string().min(1),
-		repository: z.string().min(1)
-	})).optional(),
-	changedFiles: z.array(z.string()),
-	classification: z.enum(DIFF_CLASSIFICATIONS),
-	classificationReasons: z.array(z.string()),
-	command: z.literal("patronage-factory pr:verify"),
-	durationMs: z.number().nonnegative(),
-	endedAt: z.iso.datetime(),
-	executedCommands: z.array(executedCommandSchema).optional(),
-	headSha: z.string().regex(/^[0-9a-f]{40}$/u),
-	impactStamp: impactStampSchema.optional(),
-	mergeBaseSha: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
-	mode: z.enum([
-		"docs-only",
-		"trivial",
-		"full"
-	]),
-	notRequiredCommands: z.array(notRequiredCommandSchema).min(1).optional(),
-	outcome: z.enum(["aborted", "passed"]).optional(),
-	patchId: z.string().regex(/^[0-9a-f]{40}$/u).optional(),
-	profilePath: z.string().min(1),
-	projectKey: z.string().min(1),
-	repository: z.string().min(1),
-	schemaVersion: prVerifySchemaVersionSchema,
-	startedAt: z.iso.datetime(),
-	verificationCommands: z.array(z.object({
-		command: z.string().min(1),
-		description: z.string().min(1),
-		impactTarget: z.string().min(1).optional(),
-		name: z.string().min(1),
-		scope: z.enum([
-			"always",
-			"docs-only",
-			"trivial",
-			"full"
-		])
-	}))
-}).superRefine(assertPrVerifyProofRules);
 const PR_REVIEW_SCHEMA_VERSION = 2;
 const PR_REVIEW_FINDING_PROVENANCE_VERSION = 1;
 const nonBlankString = z.string().refine((value) => value.trim().length > 0, { message: "must not be blank" });
@@ -1202,7 +904,7 @@ const prReviewProofSchema = z.object({
 	patchId: z.string().regex(/^[0-9a-f]{40,64}$/u),
 	reviewCycle: z.number().int().positive().optional(),
 	reviewRequirement: z.object({
-		reason: z.enum(["no-applicable-mode"]),
+		reason: z.enum(["no-applicable-mode", "faithful-merge"]),
 		status: z.literal("not-required")
 	}).strict().optional(),
 	reviews: z.array(prReviewResultSchema),
@@ -1518,4 +1220,4 @@ const prReadyProofSchema = z.object({
 	for (const issue of blockedReasonIssues({ ...proof })) context.addIssue(issue);
 });
 //#endregion
-export { BLOCKED_REASONS_MAX, BLOCKED_REASON_DETAIL_MAX, BOUNDARY_CHECK_SCHEMA_VERSION, BOUNDARY_REVIEW_PROOF_KIND, EVIDENCE_ENVELOPE_SCHEMA_VERSION, PR_READY_SCHEMA_VERSION, PR_REVIEW_SCHEMA_VERSION, RETRO_ENVELOPE_SCHEMA_VERSION, RETRO_ENVELOPE_VALIDATORS, RETRO_ENVELOPE_WIRE_BOUNDS, SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS, SUPPORTED_PR_READY_SCHEMA_VERSIONS, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, SUPPORTED_RETRO_ENVELOPE_SCHEMA_VERSIONS, blockedReasonSchema, blockedReasonsSchema, boundaryCheckProofSchema, boundaryReviewProofSchema, closeoutArtifactReadSchema, closeoutArtifactSchema, evidenceEnvelopeSchema, legacyCloseoutArtifactSchema, prReadyProofSchema, prReviewProofSchema, prVerifyProofSchema, retroEnvelopeV1Schema, retroEpicReference, waivedDemandSchema };
+export { BLOCKED_REASONS_MAX, BLOCKED_REASON_DETAIL_MAX, BOUNDARY_CHECK_SCHEMA_VERSION, BOUNDARY_REVIEW_PROOF_KIND, EVIDENCE_ENVELOPE_SCHEMA_VERSION, PR_READY_SCHEMA_VERSION, PR_REVIEW_SCHEMA_VERSION, SUPPORTED_CLOSEOUT_SCHEMA_VERSIONS, SUPPORTED_PR_READY_SCHEMA_VERSIONS, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, blockedReasonSchema, blockedReasonsSchema, boundaryCheckProofSchema, boundaryReviewProofSchema, closeoutArtifactSchema, evidenceEnvelopeSchema, prReadyProofSchema, prReviewProofSchema, prVerifyProofSchema, waivedDemandSchema };