@patronage/software-factory 1.0.0-alpha.23 → 1.0.0-alpha.25

package/dist/index.d.ts

@@ -17,8 +17,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -36,8 +36,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -46,8 +46,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -65,8 +65,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -151,8 +151,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -195,8 +195,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -235,6 +235,102 @@ interface BoundaryPullRequestRef {
   state: "OPEN" | "CLOSED" | "MERGED";
 }
 //#endregion
+//#region src/demand-waiver.d.ts
+declare const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
+/** One recorded operator act: this demand, on this candidate, waived. */
+interface DemandWaiver {
+  candidate: {
+    headSha: string;
+    pr: number;
+  };
+  demand: string;
+  /** The authenticated GitHub account that recorded the waiver. */
+  operator: string;
+  rationale: string;
+  recordedAt: string;
+  /** Optional audit metadata; never waiver authority. */
+  session?: string;
+}
+interface DemandWaiverStore {
+  command: "patronage-factory demand:waive";
+  schemaVersion: 1;
+  waivers: DemandWaiver[];
+}
+declare const validateDemandWaiverStore: (value: unknown) => DemandWaiverStore;
+/**
+ * A demand that was in force, was NOT met, and was waived by the operator.
+ *
+ * `unmetReasons` is required and non-empty: every reason the demand refused is
+ * carried through verbatim. There is no field on this record that could say
+ * "satisfied", and no code path constructs one without a refusal to carry.
+ */
+interface WaivedDemand {
+  demand: string;
+  operator: string;
+  rationale: string;
+  recordedAt: string;
+  session?: string;
+  /** The demand's refusals at evaluation time, preserved verbatim. */
+  unmetReasons: string[];
+}
+declare const waivedDemandSchema: z.ZodType<WaivedDemand>;
+/** The waivers that bind one candidate: same PR, same head. */
+declare const selectWaiversForCandidate: ({
+  headSha,
+  pr,
+  waivers
+}: {
+  headSha: string | undefined;
+  pr: number;
+  waivers: readonly DemandWaiver[];
+}) => DemandWaiver[];
+interface DemandOutcome {
+  blockingReasons: string[];
+  waived?: WaivedDemand;
+}
+/**
+ * Fold one resolved demand's refusals through the operator's waivers.
+ *
+ * A satisfied demand (no refusals) stays satisfied and the waiver stays inert
+ * — a waiver can only ever move a demand from *unmet-and-blocking* to
+ * *unmet-and-waived*, never to met.
+ */
+declare const applyDemandWaiver: ({
+  demand,
+  reasons,
+  waivers
+}: {
+  demand: string;
+  reasons: readonly string[];
+  waivers: readonly DemandWaiver[];
+}) => DemandOutcome;
+/** How a waived demand reads to a human. Never the word "satisfied". */
+declare const waivedDemandNotice: (waived: WaivedDemand) => string;
+interface DemandWaiverAuthorization {
+  operator: string;
+  session?: string;
+}
+type AuthorizeDemandWaiverResult = {
+  authorization: DemandWaiverAuthorization;
+  refusals?: undefined;
+} | {
+  authorization?: undefined;
+  refusals: string[];
+};
+/**
+ * Operator identity, `declaredBy`-style: a named human account, recorded on
+ * the waiver and enforced here. Session is optional audit metadata only: it is
+ * not credential-backed, so its absence or equality never authorizes or
+ * refuses an operator act.
+ */
+declare const authorizeDemandWaiver: ({
+  authenticatedLogin,
+  session
+}: {
+  authenticatedLogin: string | undefined;
+  session: string | undefined;
+}) => AuthorizeDemandWaiverResult;
+//#endregion
 //#region src/hq-ingest-sink.d.ts
 interface HqIngestDependencies {
   /**
@@ -475,6 +571,7 @@ declare function sweepHqSpoolOrphans(input: {
 //#region src/packages/review-prompt-sections/schema.d.ts
 declare const reviewPromptSectionSchema: z.ZodObject<{
   provenance: z.ZodEnum<{
+    "coding-standards": "coding-standards";
     "prior-review-ledger": "prior-review-ledger";
     "issue-review-focus": "issue-review-focus";
   }>;
@@ -485,6 +582,7 @@ type ReviewPromptSection = z.infer<typeof reviewPromptSectionSchema>;
 type ReviewPromptSectionProvenance = ReviewPromptSection["provenance"];
 declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
   provenance: z.ZodEnum<{
+    "coding-standards": "coding-standards";
     "prior-review-ledger": "prior-review-ledger";
     "issue-review-focus": "issue-review-focus";
   }>;
@@ -492,6 +590,23 @@ declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
   text: z.ZodString;
 }, z.core.$strict>>;
 //#endregion
+//#region src/policy-resolution.d.ts
+/** How a gate resolved the review policy it evaluated a candidate under. */
+declare const policyResolutionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  basePolicyDigest: z.ZodString;
+  baseRefName: z.ZodString;
+  candidatePolicyDigest: z.ZodString;
+  effectiveDigest: z.ZodString;
+  policyBaseSha: z.ZodString;
+  reviewPolicyChanged: z.ZodBoolean;
+  status: z.ZodLiteral<"authoritative">;
+}, z.core.$strict>, z.ZodObject<{
+  baseRefName: z.ZodString;
+  reason: z.ZodString;
+  status: z.ZodLiteral<"unresolved">;
+}, z.core.$strict>], "status">;
+type PolicyResolution = z.infer<typeof policyResolutionSchema>;
+//#endregion
 //#region src/review-ladder-policy.d.ts
 type ReviewFindingSeverity = "critical" | "high" | "medium" | "low" | "unknown";
 type ReviewFindingCategory = "correctness" | "safety" | "coordination" | "maintainability" | "unknown";
@@ -587,6 +702,7 @@ interface ReviewLadderCycle {
     headSha: string;
     patchId: string;
   };
+  historical?: true;
   model?: string;
   correlatedRerun?: boolean;
   session?: LadderSessionAttribution;
@@ -754,6 +870,13 @@ interface PrReviewProof {
   changedFiles: string[];
   cleanedPaths: string[];
   ladder?: PrReviewLadderState;
+  /**
+   * The policy identity this review run resolved its demanded kinds under
+   * (#922 Slice B). Optional: a run that could not reach the authority records
+   * the refusal instead, and `pr:ready` decides what an unresolved or
+   * disagreeing identity means for admission.
+   */
+  policyResolution?: PolicyResolution;
   reviewRequirement?: {
     reason: "no-applicable-mode" | "faithful-merge";
     status: "not-required";
@@ -761,102 +884,6 @@ interface PrReviewProof {
   reviews: PrReviewResult[];
 }
 //#endregion
-//#region src/demand-waiver.d.ts
-declare const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
-/** One recorded operator act: this demand, on this candidate, waived. */
-interface DemandWaiver {
-  candidate: {
-    headSha: string;
-    pr: number;
-  };
-  demand: string;
-  /** The authenticated GitHub account that recorded the waiver. */
-  operator: string;
-  rationale: string;
-  recordedAt: string;
-  /** Optional audit metadata; never waiver authority. */
-  session?: string;
-}
-interface DemandWaiverStore {
-  command: "patronage-factory demand:waive";
-  schemaVersion: 1;
-  waivers: DemandWaiver[];
-}
-declare const validateDemandWaiverStore: (value: unknown) => DemandWaiverStore;
-/**
- * A demand that was in force, was NOT met, and was waived by the operator.
- *
- * `unmetReasons` is required and non-empty: every reason the demand refused is
- * carried through verbatim. There is no field on this record that could say
- * "satisfied", and no code path constructs one without a refusal to carry.
- */
-interface WaivedDemand {
-  demand: string;
-  operator: string;
-  rationale: string;
-  recordedAt: string;
-  session?: string;
-  /** The demand's refusals at evaluation time, preserved verbatim. */
-  unmetReasons: string[];
-}
-declare const waivedDemandSchema: z.ZodType<WaivedDemand>;
-/** The waivers that bind one candidate: same PR, same head. */
-declare const selectWaiversForCandidate: ({
-  headSha,
-  pr,
-  waivers
-}: {
-  headSha: string | undefined;
-  pr: number;
-  waivers: readonly DemandWaiver[];
-}) => DemandWaiver[];
-interface DemandOutcome {
-  blockingReasons: string[];
-  waived?: WaivedDemand;
-}
-/**
- * Fold one resolved demand's refusals through the operator's waivers.
- *
- * A satisfied demand (no refusals) stays satisfied and the waiver stays inert
- * — a waiver can only ever move a demand from *unmet-and-blocking* to
- * *unmet-and-waived*, never to met.
- */
-declare const applyDemandWaiver: ({
-  demand,
-  reasons,
-  waivers
-}: {
-  demand: string;
-  reasons: readonly string[];
-  waivers: readonly DemandWaiver[];
-}) => DemandOutcome;
-/** How a waived demand reads to a human. Never the word "satisfied". */
-declare const waivedDemandNotice: (waived: WaivedDemand) => string;
-interface DemandWaiverAuthorization {
-  operator: string;
-  session?: string;
-}
-type AuthorizeDemandWaiverResult = {
-  authorization: DemandWaiverAuthorization;
-  refusals?: undefined;
-} | {
-  authorization?: undefined;
-  refusals: string[];
-};
-/**
- * Operator identity, `declaredBy`-style: a named human account, recorded on
- * the waiver and enforced here. Session is optional audit metadata only: it is
- * not credential-backed, so its absence or equality never authorizes or
- * refuses an operator act.
- */
-declare const authorizeDemandWaiver: ({
-  authenticatedLogin,
-  session
-}: {
-  authenticatedLogin: string | undefined;
-  session: string | undefined;
-}) => AuthorizeDemandWaiverResult;
-//#endregion
 //#region src/blocked-reasons.d.ts
 declare const blockedReasonSchema: z.ZodObject<{
   code: z.ZodString;
@@ -891,35 +918,91 @@ interface CheckoutRepository {
   owner: string;
 }
 //#endregion
-//#region src/follow-up.d.ts
-interface FactoryCliInvocation {
-  /** Runtime arguments ending with the factory CLI entry module. */
-  argvPrefix: string[];
-  executable: string;
+//#region src/profile.d.ts
+declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
+/** The one profile shape this build accepts (ADR 0023, #318, #351, #742). */
+declare const PROFILE_SCHEMA_VERSION = 6;
+declare const factoryProjectProfileSchema: z.ZodObject<{
+  $schema: z.ZodOptional<z.ZodString>;
+  extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+  hq: z.ZodOptional<z.ZodObject<{
+    enabled: z.ZodBoolean;
+    endpoint: z.ZodIntersection<z.ZodString, z.ZodString>;
+  }, z.core.$strict>>;
+  impact: z.ZodOptional<z.ZodObject<{
+    inert: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    targets: z.ZodArray<z.ZodObject<{
+      importers: z.ZodArray<z.ZodString>;
+      name: z.ZodString;
+      paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+  lifecycleContract: z.ZodOptional<z.ZodObject<{
+    command: z.ZodString;
+    jobName: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>>;
+  repository: z.ZodObject<{
+    name: z.ZodString;
+    owner: z.ZodString;
+  }, z.core.$strict>;
+  requiredChecks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    scope: z.ZodOptional<z.ZodObject<{
+      classifications: z.ZodArray<z.ZodEnum<{
+        "docs/process-only": "docs/process-only";
+        "non-trivial": "non-trivial";
+      }>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>>;
+  review: z.ZodOptional<z.ZodObject<{
+    conditional: z.ZodArray<z.ZodObject<{
+      paths: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+  schemaVersion: z.ZodLiteral<6>;
+  verification: z.ZodObject<{
+    commands: z.ZodArray<z.ZodObject<{
+      command: z.ZodString;
+      description: z.ZodString;
+      impactTarget: z.ZodOptional<z.ZodString>;
+      name: z.ZodString;
+      requiredCheck: z.ZodOptional<z.ZodString>;
+      scope: z.ZodDefault<z.ZodEnum<{
+        trivial: "trivial";
+        "docs-only": "docs-only";
+        full: "full";
+      }>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+}, z.core.$strict>;
+type FactoryProjectProfile = z.infer<typeof factoryProjectProfileSchema>;
+declare const resolveFactoryRepository: (profile?: Pick<FactoryProjectProfile, "repository"> | undefined) => string;
+interface LoadProjectProfileInput {
+  cwd?: string;
+  profilePath?: string;
 }
-declare const FactoryCliInvocationSchema: z.ZodType<FactoryCliInvocation>;
-interface FollowUpAction {
-  /**
-   * Machine-safe argv-style array for the obvious next action, e.g.
-   * ["gh","pr","merge","513","--squash"]. Same shape and field name that
-   * `factory:delegate --print` emits, so an orchestrating agent can spawn the
-   * next command without reconstructing a shell string. argv[0] is the
-   * executable; the rest are literal, already-split arguments.
-   */
-  argv: string[];
+interface LoadProjectProfileResult {
+  path: string;
+  profile: FactoryProjectProfile;
+}
+declare function loadProjectProfile(input?: LoadProjectProfileInput): LoadProjectProfileResult;
+//#endregion
+//#region src/catch-up-recognition-record.d.ts
+interface CatchUpRecognition {
+  /** The ref the candidate targets, as the recognizing command resolved it. */
+  baseRef: string;
+  /** The live target tip at recognition time; the head's first parent. */
+  baseTipSha: string;
+  /** The head's second parent: the admitted base-side content merged in. */
+  mergedParentSha: string;
   /**
-   * Human-readable rendering of {@link argv} for logs and operators. Additive
-   * to argv, never a substitute for it — argv is the source of truth.
+   * The tree `git merge-tree --write-tree` produced for the two parents. It
+   * equals the head's own tree; that equality is the faithfulness proof.
    */
-  command: string;
+  mergedTreeSha: string;
+  /** The ref that proves the second parent is admitted content. */
+  upstreamRef: string;
 }
-/**
- * Build a {@link FollowUpAction} from a literal argv array. The `command`
- * string is derived from argv so the two never drift.
- */
-declare const followUpFromArgv: (argv: string[]) => FollowUpAction;
-/** Canonical zod schema for the optional follow-up field on JSON outputs. */
-declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
 //#endregion
 //#region src/diff-classification.d.ts
 declare const DIFF_CLASSIFICATIONS: readonly ["docs/process-only", "trivial", "non-trivial"];
@@ -971,101 +1054,137 @@ interface ImpactScopeDecision {
   scoped: boolean;
 }
 /**
- * Whether a trusted stamp RELEASES one target-scoped unit of work — an
- * external proof demand (#542 wave 2), a verification-battery command, or a
- * preview (Alchemy) lifecycle stack (#430 wave 3).
- *
- * The only release path is a `target-scoped` stamp of exactly this build's
- * stamp version whose target entry for exactly this name is provably
- * `not-affected`. Every other input — no trusted stamp, an unknown stamp
- * version, a conservative stamp, a name the stamp does not classify, or an
- * `affected` verdict — keeps today's full-work floor. Work only ever gets
- * released, never added or satisfied: this function can withdraw a demand, it
- * can never certify one.
+ * Whether a trusted stamp RELEASES one target-scoped unit of work — an
+ * external proof demand (#542 wave 2), a verification-battery command, or a
+ * preview (Alchemy) lifecycle stack (#430 wave 3).
+ *
+ * The only release path is a `target-scoped` stamp of exactly this build's
+ * stamp version whose target entry for exactly this name is provably
+ * `not-affected`. Every other input — no trusted stamp, an unknown stamp
+ * version, a conservative stamp, a name the stamp does not classify, or an
+ * `affected` verdict — keeps today's full-work floor. Work only ever gets
+ * released, never added or satisfied: this function can withdraw a demand, it
+ * can never certify one.
+ *
+ * Identity binding is the CALLER's precondition: pass only a stamp computed
+ * for, or read from a pr:verify proof bound to, the current candidate (see
+ * `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
+ * `undefined` otherwise.
+ */
+declare const impactStampScopeDecision: ({
+  stamp,
+  surface,
+  targetName
+}: {
+  stamp: ImpactStamp | undefined;
+  surface: ImpactScopeSurface;
+  targetName: string;
+}) => ImpactScopeDecision;
+//#endregion
+//#region src/required-check-policy.d.ts
+declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
+type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
+declare const requiredCheckScopeSchema: z.ZodObject<{
+  classifications: z.ZodArray<z.ZodEnum<{
+    "docs/process-only": "docs/process-only";
+    trivial: "trivial";
+    "non-trivial": "non-trivial";
+  }>>;
+}, z.core.$strict>;
+type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
+interface RequiredCheckScopeContext {
+  catchUpRecognition?: CatchUpRecognition;
+  classification: DiffClassification | undefined;
+  impactStamp?: ImpactStamp;
+}
+interface ScopeDecision {
+  inScope: boolean;
+  reason: string;
+}
+declare const requiredCheckInScope: ({
+  context,
+  scope
+}: {
+  context: RequiredCheckScopeContext;
+  scope?: RequiredCheckScope;
+}) => ScopeDecision;
+interface RequiredCheck {
+  name: string;
+  checkType: EvidenceCheckType;
+  scope?: RequiredCheckScope;
+}
+//#endregion
+//#region src/demand-resolution.d.ts
+/**
+ * The two GitHub reads that make the base policy authoritative: the live tip of
+ * a branch, and one file's content at an exact commit. Injectable so tests can
+ * state what the authority says; an absent implementation is the real read, so
+ * an unstated authority is a refusal rather than a silent pass.
+ */
+interface BaseReviewPolicyAuthority {
+  branchTipSha: (input: {
+    branch: string;
+    cwd: string;
+    repository: CheckoutRepository;
+  }) => string;
+  profileContentAtRef: (input: {
+    cwd: string;
+    profilePath: string;
+    ref: string;
+    repository: CheckoutRepository;
+  }) => string;
+}
+/**
+ * The pull request whose base ref is the authority, as the resolving stage
+ * knows it (#922 Slice B).
  *
- * Identity binding is the CALLER's precondition: pass only a stamp computed
- * for, or read from a pr:verify proof bound to, the current candidate (see
- * `trustedImpactStamp` in `pr-readiness/verification-proof.ts`); pass
- * `undefined` otherwise.
+ * `pr:ready` is handed a PR number and reads the record; `pr:verify` and
+ * `pr:review` run in the authoring checkout and look the PR up from the branch,
+ * which can legitimately find nothing. `isCrossRepository` stays `unknown` for
+ * the reason the reader below states: an unstated fork answer is not a "no".
  */
-declare const impactStampScopeDecision: ({
-  stamp,
-  surface,
-  targetName
-}: {
-  stamp: ImpactStamp | undefined;
-  surface: ImpactScopeSurface;
-  targetName: string;
-}) => ImpactScopeDecision;
+interface CandidatePullRequestPolicyContext {
+  baseRefName: string;
+  isCrossRepository: unknown;
+}
+/** What a stage found when it looked for the pull request that owns this branch. */
+type CandidatePullRequestLookup = {
+  pullRequest: CandidatePullRequestPolicyContext;
+  status: "found";
+} | {
+  reason: string;
+  status: "unavailable";
+};
 //#endregion
-//#region src/profile.d.ts
-declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
-/** The one profile shape this build accepts (ADR 0023, #318, #351, #742). */
-declare const PROFILE_SCHEMA_VERSION = 6;
-declare const factoryProjectProfileSchema: z.ZodObject<{
-  $schema: z.ZodOptional<z.ZodString>;
-  extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-  hq: z.ZodOptional<z.ZodObject<{
-    enabled: z.ZodBoolean;
-    endpoint: z.ZodIntersection<z.ZodString, z.ZodString>;
-  }, z.core.$strict>>;
-  impact: z.ZodOptional<z.ZodObject<{
-    inert: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    targets: z.ZodArray<z.ZodObject<{
-      importers: z.ZodArray<z.ZodString>;
-      name: z.ZodString;
-      paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>;
-  lifecycleContract: z.ZodOptional<z.ZodObject<{
-    command: z.ZodString;
-    jobName: z.ZodOptional<z.ZodString>;
-  }, z.core.$strict>>;
-  repository: z.ZodObject<{
-    name: z.ZodString;
-    owner: z.ZodString;
-  }, z.core.$strict>;
-  requiredChecks: z.ZodOptional<z.ZodArray<z.ZodObject<{
-    name: z.ZodString;
-    scope: z.ZodOptional<z.ZodObject<{
-      classifications: z.ZodArray<z.ZodEnum<{
-        "docs/process-only": "docs/process-only";
-        "non-trivial": "non-trivial";
-      }>>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>>;
-  review: z.ZodOptional<z.ZodObject<{
-    conditional: z.ZodArray<z.ZodObject<{
-      paths: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>>;
-  }, z.core.$strict>>;
-  schemaVersion: z.ZodLiteral<6>;
-  verification: z.ZodObject<{
-    commands: z.ZodArray<z.ZodObject<{
-      command: z.ZodString;
-      description: z.ZodString;
-      impactTarget: z.ZodOptional<z.ZodString>;
-      name: z.ZodString;
-      requiredCheck: z.ZodOptional<z.ZodString>;
-      scope: z.ZodDefault<z.ZodEnum<{
-        trivial: "trivial";
-        "docs-only": "docs-only";
-        full: "full";
-      }>>;
-    }, z.core.$strip>>;
-  }, z.core.$strip>;
-}, z.core.$strict>;
-type FactoryProjectProfile = z.infer<typeof factoryProjectProfileSchema>;
-declare const resolveFactoryRepository: (profile?: Pick<FactoryProjectProfile, "repository"> | undefined) => string;
-interface LoadProjectProfileInput {
-  cwd?: string;
-  profilePath?: string;
+//#region src/follow-up.d.ts
+interface FactoryCliInvocation {
+  /** Runtime arguments ending with the factory CLI entry module. */
+  argvPrefix: string[];
+  executable: string;
 }
-interface LoadProjectProfileResult {
-  path: string;
-  profile: FactoryProjectProfile;
+declare const FactoryCliInvocationSchema: z.ZodType<FactoryCliInvocation>;
+interface FollowUpAction {
+  /**
+   * Machine-safe argv-style array for the obvious next action, e.g.
+   * ["gh","pr","merge","513","--squash"]. Same shape and field name that
+   * `factory:delegate --print` emits, so an orchestrating agent can spawn the
+   * next command without reconstructing a shell string. argv[0] is the
+   * executable; the rest are literal, already-split arguments.
+   */
+  argv: string[];
+  /**
+   * Human-readable rendering of {@link argv} for logs and operators. Additive
+   * to argv, never a substitute for it — argv is the source of truth.
+   */
+  command: string;
 }
-declare function loadProjectProfile(input?: LoadProjectProfileInput): LoadProjectProfileResult;
+/**
+ * Build a {@link FollowUpAction} from a literal argv array. The `command`
+ * string is derived from argv so the two never drift.
+ */
+declare const followUpFromArgv: (argv: string[]) => FollowUpAction;
+/** Canonical zod schema for the optional follow-up field on JSON outputs. */
+declare const FollowUpActionSchema: z.ZodType<FollowUpAction>;
 //#endregion
 //#region src/pr-verify-mode.d.ts
 /**
@@ -1467,8 +1586,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        "not-required": "not-required";
         stale: "stale";
+        "not-required": "not-required";
         blocked: "blocked";
         current: "current";
         missing: "missing";
@@ -1479,8 +1598,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        "not-required": "not-required";
         stale: "stale";
+        "not-required": "not-required";
         blocked: "blocked";
         current: "current";
         missing: "missing";
@@ -1516,7 +1635,7 @@ type ReadinessStatus = "ready" | "blocked";
 type ManagedReadinessLedger = z.infer<typeof managedReadinessLedgerSchema>;
 declare function validateManagedReadinessLedger(value: unknown): ManagedReadinessLedger;
 declare namespace status_check_rollup_d_exports {
-  export { CheckState, HOSTED_VERIFY_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isFactoryReadyCheck, isHostedVerifyCheck, statusCheckState };
+  export { CheckState, HOSTED_VERIFY_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isFactoryReadyCheck, isHostedVerifyCheck, pendingCheckNames, statusCheckState };
 }
 type CheckState = "passed" | "failed" | "pending" | "none" | "unknown";
 interface StatusCheckRollup {
@@ -1563,8 +1682,23 @@ declare const isHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
  * nothing else in the rollup would have said so.
  */
 declare const hostedVerifyCheckState: (rollup: StatusCheckRollup[] | undefined) => CheckState;
+/**
+ * The names of the runs `statusCheckState` would count as pending, in the
+ * order the rollup reports them.
+ *
+ * Same reader, same collapsing of superseded generations — this only says
+ * *which* runs hold the head open, so a caller that waits on them can name
+ * them. A run with no context and no name is reported as `unnamed check`
+ * rather than dropped: a wait must not look settled because one row was
+ * unprintable.
+ */
+declare const pendingCheckNames: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => string[];
 declare const statusCheckState: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => CheckState;
 //#endregion
+//#region src/github-client.d.ts
+/** Read a branch tip from GitHub rather than a checkout's cached remote ref. */
+declare const fetchGitHubBranchTipSha: (repository: CheckoutRepository, branch: string, cwd: string) => string;
+//#endregion
 //#region src/github-app-client.d.ts
 interface FactoryAppRequest {
   body?: unknown;
@@ -1600,23 +1734,6 @@ interface UpsertFactoryPrStatusCommentResult {
 }
 declare function upsertFactoryPrStatusComment(input: UpsertFactoryPrStatusCommentInput, dependencies?: UpsertFactoryPrStatusCommentDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
 //#endregion
-//#region src/catch-up-recognition-record.d.ts
-interface CatchUpRecognition {
-  /** The ref the candidate targets, as the recognizing command resolved it. */
-  baseRef: string;
-  /** The live target tip at recognition time; the head's first parent. */
-  baseTipSha: string;
-  /** The head's second parent: the admitted base-side content merged in. */
-  mergedParentSha: string;
-  /**
-   * The tree `git merge-tree --write-tree` produced for the two parents. It
-   * equals the head's own tree; that equality is the faithfulness proof.
-   */
-  mergedTreeSha: string;
-  /** The ref that proves the second parent is admitted content. */
-  upstreamRef: string;
-}
-//#endregion
 //#region src/pr-verify-proof-contract.d.ts
 declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [1, 2, 3, 4];
 type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
@@ -1699,6 +1816,16 @@ interface PrVerifyProof {
   notRequiredCommands?: PrVerifyNotRequiredCommand[];
   outcome?: "aborted" | "passed";
   patchId?: string;
+  /**
+   * The review policy identity this verification run resolved (#922 Slice B).
+   *
+   * Verification demands no review mode of its own. It records the identity so
+   * `pr:ready` can see whether the stage that produced this proof judged the
+   * candidate under the same policy readiness resolves. Optional, and normally
+   * `unresolved` on the first run of a branch: a candidate is verified before
+   * it has a pull request, and there is no authority to read without one.
+   */
+  policyResolution?: PolicyResolution;
   profilePath: string;
   projectKey: string;
   repository: string;
@@ -1978,6 +2105,8 @@ interface FailedPreviewSnapshot {
   readonly name: string;
 }
 interface FactoryPrStatusSources {
+  /** Live PR base ref name observed with the sources. Identity, not a SHA. */
+  readonly baseRefName?: string;
   readonly baseSha: string;
   readonly checks: Readonly<Partial<Record<FactoryPrStatusCheckName, CompletedFactoryCheckSnapshot>>>;
   readonly previewFailures?: Readonly<Partial<Record<string, FailedPreviewSnapshot>>>;
@@ -2013,9 +2142,14 @@ interface PresentFactoryPrStatusHudDependencies {
     previewTargets?: readonly string[];
     repo: string;
   }) => Promise<FactoryPrStatusSources>;
-  /** Recheck both PR endpoints immediately before mutating the sticky HUD. */
+  /**
+   * Recheck the pulls identity immediately before mutating the sticky HUD.
+   * Happy path reads `/pulls/:n` only; git-ref is fetched to decorate a
+   * head-moved error, not as a second identity endpoint.
+   */
   readonly assertCurrentIdentity: (input: {
-    baseSha: string;
+    baseRefName?: string; /** Retained for rendering/callers; identity compares base ref name. */
+    baseSha?: string;
     headSha: string;
     owner: string;
     pr: number;
@@ -2026,10 +2160,11 @@ interface PresentFactoryPrStatusHudDependencies {
 interface ReadFactoryPrStatusSourcesInput {
   readonly headSha: string;
   /**
-   * Read token for `previewProofInventory.list`. The list walks the
-   * force-push timeline, which needs commit (contents) read; the Factory App
-   * token has no contents permission, so pass a workflow `GITHUB_TOKEN`
-   * (#825). Falls back to `token`.
+   * Contents-read token for `previewProofInventory.list` and the live
+   * `git/ref/heads/<base>` tip. Both need `contents: read`; the Factory App
+   * token has none, so pass a workflow `GITHUB_TOKEN` (#825, #908). The
+   * inventory list falls back to `token`. The base tip has no HTTP fallback:
+   * without this token it is read through `gh`.
    */
   readonly inventoryToken?: string;
   readonly owner: string;
@@ -2045,6 +2180,11 @@ interface ReadFactoryPrStatusSourcesInput {
 }
 interface ReadFactoryPrStatusSourcesDependencies {
   readonly fetch?: typeof fetch;
+  /**
+   * Local base-tip reader used when no `inventoryToken` exists. Defaults to
+   * the `gh`-backed reader `pr:ready` already uses.
+   */
+  readonly fetchBranchTipSha?: typeof fetchGitHubBranchTipSha;
   readonly listPreviewRegistrations?: (input: {
     owner: string;
     pr: number;
@@ -2056,7 +2196,8 @@ interface ReadFactoryPrStatusSourcesDependencies {
 declare function renderFactoryPrStatusHud(input: RenderFactoryPrStatusHudInput): string;
 declare function presentFactoryPrStatusHud(input: PresentFactoryPrStatusHudInput, dependencies: PresentFactoryPrStatusHudDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
 declare function assertFactoryPrStatusIdentity(input: ReadFactoryPrStatusSourcesInput & {
-  readonly baseSha: string;
+  readonly baseRefName?: string; /** Retained for rendering/callers; identity compares base ref name. */
+  readonly baseSha?: string;
 }, dependencies?: ReadFactoryPrStatusSourcesDependencies): Promise<void>;
 declare function readFactoryPrStatusSources(input: ReadFactoryPrStatusSourcesInput, dependencies?: ReadFactoryPrStatusSourcesDependencies): Promise<FactoryPrStatusSources>;
 interface PlanFactoryPrStatusHudInput {
@@ -2076,6 +2217,11 @@ declare function planFactoryPrStatusHud(input: PlanFactoryPrStatusHudInput): Pre
 interface RefreshFactoryPrStatusHudInput {
   readonly cwd: string;
   readonly headSha: string;
+  /**
+   * Workflow `GITHUB_TOKEN` with `contents: read` for the live git-ref and
+   * preview inventory. The Factory App token cannot read those (#825, #908).
+   */
+  readonly inventoryToken?: string;
   readonly mergeBaseSha?: string;
   readonly owner: string;
   readonly patchId?: string;
@@ -2126,6 +2272,14 @@ interface GitHubPullRequest {
   body: string;
   headRefName?: string;
   headRefOid: string;
+  /**
+   * Whether the head branch lives in a different repository from the base
+   * (#922). Required, not optional, for the reason `autoMergeRequest` is: the
+   * trusted checkout names ONE repository, and for a fork PR that is not the
+   * base repository. An implementation that omitted the field would silently
+   * resolve base policy from whichever repository the checkout points at.
+   */
+  isCrossRepository: boolean;
   isDraft: boolean;
   mergeStateStatus: string;
   mergeable: string;
@@ -2185,6 +2339,13 @@ interface PrReadyProof {
    * waived demand reads to a human. Absent when there are none.
    */
   notices?: string[];
+  /**
+   * The policy identity readiness resolved review demand under (#922): the
+   * base ref, its live tip, and the digests of the base, candidate, and merged
+   * review policies. Optional on the wire and additive — this is a new record
+   * on an unchanged contract, so no schema version moves.
+   */
+  policyResolution?: PolicyResolution;
   /** Committed profile blob evaluated by readiness. Required for merge. */
   profileBlobSha?: string;
   /** Checkout-relative committed profile path evaluated by readiness. */
@@ -2208,6 +2369,13 @@ interface PrReadyDependencies {
    * call plus the read-back that says what actually happened.
    */
   armAutoMerge?: (input: ArmAutoMergeInput) => ArmAutoMergeOutcome;
+  /**
+   * Reads the authoritative base review policy (#922): the profile committed at
+   * the live tip of the PR's own base ref. Defaults to the real GitHub reads,
+   * so an unstated authority refuses rather than falling back to candidate
+   * policy — unreadable authority is never absent authority.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
   github?: {
     fetchClosingPullRequests?: (input: {
       issue: number;
@@ -2262,6 +2430,12 @@ interface PrReadyGitDependencies {
   canResolveCommit: (cwd: string, sha: string) => boolean;
   changedFiles: (cwd: string, base: string, headSha?: string) => string[];
   checkoutRepository: (cwd: string) => CheckoutRepository;
+  /**
+   * Bring `refs/heads/<baseRefName>` into the checkout so the live tip
+   * `pr.baseRefOid` can resolve. Optional so fixtures that already resolve
+   * every SHA can omit it.
+   */
+  fetchOriginRef?: (cwd: string, refName: string) => void;
   currentHeadSha: (cwd: string) => string;
   mergeBaseSha: (cwd: string, base: string) => string;
   objectIdAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
@@ -2273,39 +2447,6 @@ declare function validatePrReadyProof(value: unknown): PrReadyProof;
 declare function readPrReadyProof(filePath: string): PrReadyProof;
 declare function runPrReady(args: PrReadyArgs, dependencies?: PrReadyDependencies): Promise<PrReadyProof>;
 //#endregion
-//#region src/required-check-policy.d.ts
-declare const EVIDENCE_CHECK_TYPES: readonly ["review", "verify"];
-type EvidenceCheckType = (typeof EVIDENCE_CHECK_TYPES)[number];
-declare const requiredCheckScopeSchema: z.ZodObject<{
-  classifications: z.ZodArray<z.ZodEnum<{
-    "docs/process-only": "docs/process-only";
-    trivial: "trivial";
-    "non-trivial": "non-trivial";
-  }>>;
-}, z.core.$strict>;
-type RequiredCheckScope = z.infer<typeof requiredCheckScopeSchema>;
-interface RequiredCheckScopeContext {
-  catchUpRecognition?: CatchUpRecognition;
-  classification: DiffClassification | undefined;
-  impactStamp?: ImpactStamp;
-}
-interface ScopeDecision {
-  inScope: boolean;
-  reason: string;
-}
-declare const requiredCheckInScope: ({
-  context,
-  scope
-}: {
-  context: RequiredCheckScopeContext;
-  scope?: RequiredCheckScope;
-}) => ScopeDecision;
-interface RequiredCheck {
-  name: string;
-  checkType: EvidenceCheckType;
-  scope?: RequiredCheckScope;
-}
-//#endregion
 //#region src/factory-session.d.ts
 declare const resolveAuthoringSessionIds: ({
   override,
@@ -2337,8 +2478,8 @@ declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2364,8 +2505,8 @@ declare const evidenceEnvelopeSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2467,8 +2608,8 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  "not-required": "not-required";
   stale: "stale";
+  "not-required": "not-required";
   blocked: "blocked";
   current: "current";
   missing: "missing";
@@ -2585,8 +2726,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     wave: z.ZodString;
   }, z.core.$strip>>;
   demandedRung: z.ZodOptional<z.ZodEnum<{
-    oracle: "oracle";
     "independent-model": "independent-model";
+    oracle: "oracle";
     human: "human";
   }>>;
   epicIssue: z.ZodNumber;
@@ -2601,8 +2742,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     commentUrl: z.ZodOptional<z.ZodString>;
     producer: z.ZodString;
     rung: z.ZodEnum<{
-      oracle: "oracle";
       "independent-model": "independent-model";
+      oracle: "oracle";
       human: "human";
     }>;
     sessionId: z.ZodOptional<z.ZodString>;
@@ -2630,6 +2771,22 @@ interface BoundaryCheckGithub {
   fetchIssueComments: (repo: string, issue: number) => GithubIssueComment[];
   fetchClosingPullRequests: (repo: string, issue: number) => BoundaryPullRequestRef[];
   fetchPullRequest?: (repo: string, pr: number) => BoundaryPullRequestRef;
+  /**
+   * Child issue state for the close-gate (#901). Required so a stub cannot
+   * skip the gate and look like a pass.
+   */
+  fetchIssueState: (repo: string, issue: number) => "OPEN" | "CLOSED";
+  /**
+   * PRs whose bodies may contribute closing-keyword membership (#901). For
+   * `each-to-epic`, production lists PRs targeting the integration branch.
+   * Branch targeting never joins; only a keyword naming a declared child does.
+   * Required so omitting the channel cannot silently drop it.
+   */
+  listCandidatePullRequests: (repo: string, input: {
+    integrationBranch?: string;
+  }) => (BoundaryPullRequestRef & {
+    body?: string;
+  })[];
 }
 interface BoundaryCheckArgs {
   cwd?: string;
@@ -2649,6 +2806,7 @@ interface BoundaryCheckArgs {
 interface BoundaryCheckDependencies {
   github?: BoundaryCheckGithub;
   hq?: HqIngestDependencies;
+  readWaivers?: (cwd: string) => DemandWaiver[];
   resolveRepo?: (cwd: string) => string;
 }
 declare function runBoundaryCheck(args: BoundaryCheckArgs, dependencies?: BoundaryCheckDependencies): BoundaryCheckProofRecord;
@@ -2740,10 +2898,12 @@ type CatchUpRecognizer = (input: {
 //#endregion
 //#region src/pr-review.d.ts
 interface PrReviewArgs extends LoadProjectProfileInput {
+  assemble?: boolean;
   base: string;
   cycle: number;
   dispositions?: string;
   findings?: string;
+  historical?: boolean;
   issue?: number;
   mode: PrReviewMode;
   output?: string;
@@ -2751,15 +2911,37 @@ interface PrReviewArgs extends LoadProjectProfileInput {
 }
 interface PrReviewGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
+  checkoutRepository?: (cwd: string) => CheckoutRepository;
   currentHeadSha: (cwd: string) => string;
+  firstParentCommits?: (cwd: string, base: string) => string[];
   isAncestor: (cwd: string, ancestor: string, descendant: string) => boolean;
   recognizeCatchUp?: CatchUpRecognizer;
+  repositoryRoot?: (cwd: string) => string;
+  showFileAtRef?: (cwd: string, ref: string, absolutePath: string) => string | undefined;
   stablePatchId: (cwd: string, base: string) => string;
+  stablePatchIdAtRef?: (cwd: string, base: string, ref: string) => string;
   statusPorcelain: (cwd: string) => string;
 }
+interface PrReviewIssueBodyInput {
+  issue: number;
+  owner: string;
+  repo: string;
+}
 interface PrReviewDependencies {
+  /**
+   * The authoritative base-policy reader (#922). Injectable for the same
+   * reason `pr:ready` injects it: an unstated authority must be a refusal a
+   * test can state, never a silent pass.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
+  fetchIssueBody?: (input: PrReviewIssueBodyInput) => string;
   git?: PrReviewGitDependencies;
   hq?: HqIngestDependencies;
+  /**
+   * How this run finds the pull request whose base ref is the policy authority
+   * (#922 Slice B). Defaults to the GitHub lookup.
+   */
+  lookupPullRequest?: (cwd: string) => CandidatePullRequestLookup;
 }
 declare function runPrReview(args: PrReviewArgs, dependencies?: PrReviewDependencies): Promise<PrReviewProof>;
 //#endregion
@@ -2790,6 +2972,7 @@ interface PrVerifyArgs extends LoadProjectProfileInput {
 }
 interface PrVerifyGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
+  checkoutRepository?: (cwd: string) => CheckoutRepository;
   currentHeadSha: (cwd: string) => string;
   emptyTreeHash: (cwd: string) => string;
   mergeBaseSha: (cwd: string, base: string) => string;
@@ -2800,7 +2983,19 @@ interface PrVerifyGitDependencies {
   stablePatchId: (cwd: string, base: string) => string;
 }
 interface PrVerifyDependencies {
+  /**
+   * The authoritative base-policy reader (#922). Injectable for the same
+   * reason `pr:ready` injects it: an unstated authority must be a refusal a
+   * test can state, never a silent pass.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
   cleanInstall?: CleanInstallResolutionDependencies | false;
+  /**
+   * How this run finds the pull request whose base ref is the policy authority
+   * (#922 Slice B). Defaults to the GitHub lookup; a checkout with no pull
+   * request resolves `unavailable`, which is normal before publication.
+   */
+  lookupPullRequest?: (cwd: string) => CandidatePullRequestLookup;
   env?: NodeJS.ProcessEnv;
   git?: PrVerifyGitDependencies;
   hq?: HqIngestDependencies;
@@ -2987,9 +3182,9 @@ interface PrStatusHudArgs {
   readonly cwd: string;
   readonly headSha: string;
   /**
-   * Read token for the preview-proof inventory list. The App token cannot
-   * read the force-push timeline (no contents permission), so the workflow
-   * `GITHUB_TOKEN` serves that read (#825).
+   * Contents-read token for the preview-proof inventory list and the live
+   * git-ref tip. The App token has no contents permission, so the workflow
+   * `GITHUB_TOKEN` serves those reads (#825, #908).
    */
   readonly inventoryToken?: string;
   readonly owner: string;
@@ -3658,8 +3853,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     model: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      delegate: "delegate";
       oracle: "oracle";
+      delegate: "delegate";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3667,8 +3862,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
     review: "review";
-    delegate: "delegate";
     oracle: "oracle";
+    delegate: "delegate";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3737,8 +3932,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     model: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      delegate: "delegate";
       oracle: "oracle";
+      delegate: "delegate";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3746,8 +3941,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
     review: "review";
-    delegate: "delegate";
     oracle: "oracle";
+    delegate: "delegate";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3807,8 +4002,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       model: z.ZodString;
       tier: z.ZodEnum<{
         review: "review";
-        delegate: "delegate";
         oracle: "oracle";
+        delegate: "delegate";
         workhorse: "workhorse";
         scout: "scout";
       }>;
@@ -3816,8 +4011,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     startedAt: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      delegate: "delegate";
       oracle: "oracle";
+      delegate: "delegate";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3866,11 +4061,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
-    tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
+    tier: "review" | "oracle" | "delegate" | "workhorse" | "scout";
     fallbackTier?: "delegate" | undefined;
   };
   startedAt: string;
-  tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
+  tier: "review" | "oracle" | "delegate" | "workhorse" | "scout";
   tokenUsage: {
     source: "cursor-csv" | "codex-json" | "cursor-json" | "claude-json";
     status: "available";
@@ -4162,6 +4357,13 @@ interface EvaluationInput {
   mergeStateStatus: string;
   ladderPolicy?: ReviewLadderPolicy;
   reviewModes?: PrReviewKind[];
+  /**
+   * Cross-stage policy-identity refusals resolved at the command boundary
+   * (#922 Slice B), already worded. Evaluation only decides whether they are
+   * in force: a recognized catch-up withdraws every review demand, so it
+   * withdraws these with them.
+   */
+  policyIdentityRefusals?: string[];
   reviewProof?: PrReviewProof;
   verificationProof?: VerificationProofState;
   docsOnlyVerifyBaselineHeadShas?: string[];
@@ -4207,13 +4409,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "not-required" | "stale" | "blocked" | "current" | "missing";
+        status: "stale" | "not-required" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "not-required" | "stale" | "blocked" | "current" | "missing";
+        status: "stale" | "not-required" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -4533,6 +4735,7 @@ declare const reviewFocusFromIssueBody: (body: string) => string | undefined;
 interface AssembleReviewPromptInput {
   base: string;
   changedFiles: string[];
+  cwd?: string;
   headSha: string;
   issueFocus?: IssueReviewFocus;
   kind: PrReviewKind;
@@ -4540,6 +4743,13 @@ interface AssembleReviewPromptInput {
   priorLedgerEntries?: FindingLedgerEntry[];
   profile: FactoryProjectProfile;
 }
+interface AssembleReviewPromptGitDependencies {
+  repositoryRoot: (cwd: string) => string;
+  showFileAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
+}
+interface AssembleReviewPromptDependencies {
+  git?: AssembleReviewPromptGitDependencies;
+}
 interface AssembledReviewPrompt {
   prompt: string;
   sections: ReviewPromptSection[];
@@ -4547,13 +4757,14 @@ interface AssembledReviewPrompt {
 declare const assembleReviewPrompt: ({
   base,
   changedFiles,
+  cwd,
   headSha,
   issueFocus,
   kind,
   patchId,
   priorLedgerEntries,
   profile
-}: AssembleReviewPromptInput) => AssembledReviewPrompt;
+}: AssembleReviewPromptInput, dependencies?: AssembleReviewPromptDependencies) => AssembledReviewPrompt;
 //#endregion
 //#region src/review-ladder-trace.d.ts
 interface ReviewLadderTraceIdentity {