@patronage/software-factory 1.0.0-alpha.24 → 1.0.0-alpha.26

package/dist/index.d.ts

@@ -17,8 +17,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -26,8 +26,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   integrationBranch: z.ZodOptional<z.ZodString>;
   schemaVersion: z.ZodLiteral<1>;
   topology: z.ZodEnum<{
-    "each-to-main": "each-to-main";
     flagged: "flagged";
+    "each-to-main": "each-to-main";
     stacked: "stacked";
     "each-to-epic": "each-to-epic";
   }>;
@@ -36,8 +36,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -46,8 +46,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -55,8 +55,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   integrationBranch: z.ZodOptional<z.ZodString>;
   schemaVersion: z.ZodLiteral<1>;
   topology: z.ZodEnum<{
-    "each-to-main": "each-to-main";
     flagged: "flagged";
+    "each-to-main": "each-to-main";
     stacked: "stacked";
     "each-to-epic": "each-to-epic";
   }>;
@@ -65,8 +65,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -151,8 +151,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -195,8 +195,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -235,6 +235,102 @@ interface BoundaryPullRequestRef {
   state: "OPEN" | "CLOSED" | "MERGED";
 }
 //#endregion
+//#region src/demand-waiver.d.ts
+declare const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
+/** One recorded operator act: this demand, on this candidate, waived. */
+interface DemandWaiver {
+  candidate: {
+    headSha: string;
+    pr: number;
+  };
+  demand: string;
+  /** The authenticated GitHub account that recorded the waiver. */
+  operator: string;
+  rationale: string;
+  recordedAt: string;
+  /** Optional audit metadata; never waiver authority. */
+  session?: string;
+}
+interface DemandWaiverStore {
+  command: "patronage-factory demand:waive";
+  schemaVersion: 1;
+  waivers: DemandWaiver[];
+}
+declare const validateDemandWaiverStore: (value: unknown) => DemandWaiverStore;
+/**
+ * A demand that was in force, was NOT met, and was waived by the operator.
+ *
+ * `unmetReasons` is required and non-empty: every reason the demand refused is
+ * carried through verbatim. There is no field on this record that could say
+ * "satisfied", and no code path constructs one without a refusal to carry.
+ */
+interface WaivedDemand {
+  demand: string;
+  operator: string;
+  rationale: string;
+  recordedAt: string;
+  session?: string;
+  /** The demand's refusals at evaluation time, preserved verbatim. */
+  unmetReasons: string[];
+}
+declare const waivedDemandSchema: z.ZodType<WaivedDemand>;
+/** The waivers that bind one candidate: same PR, same head. */
+declare const selectWaiversForCandidate: ({
+  headSha,
+  pr,
+  waivers
+}: {
+  headSha: string | undefined;
+  pr: number;
+  waivers: readonly DemandWaiver[];
+}) => DemandWaiver[];
+interface DemandOutcome {
+  blockingReasons: string[];
+  waived?: WaivedDemand;
+}
+/**
+ * Fold one resolved demand's refusals through the operator's waivers.
+ *
+ * A satisfied demand (no refusals) stays satisfied and the waiver stays inert
+ * — a waiver can only ever move a demand from *unmet-and-blocking* to
+ * *unmet-and-waived*, never to met.
+ */
+declare const applyDemandWaiver: ({
+  demand,
+  reasons,
+  waivers
+}: {
+  demand: string;
+  reasons: readonly string[];
+  waivers: readonly DemandWaiver[];
+}) => DemandOutcome;
+/** How a waived demand reads to a human. Never the word "satisfied". */
+declare const waivedDemandNotice: (waived: WaivedDemand) => string;
+interface DemandWaiverAuthorization {
+  operator: string;
+  session?: string;
+}
+type AuthorizeDemandWaiverResult = {
+  authorization: DemandWaiverAuthorization;
+  refusals?: undefined;
+} | {
+  authorization?: undefined;
+  refusals: string[];
+};
+/**
+ * Operator identity, `declaredBy`-style: a named human account, recorded on
+ * the waiver and enforced here. Session is optional audit metadata only: it is
+ * not credential-backed, so its absence or equality never authorizes or
+ * refuses an operator act.
+ */
+declare const authorizeDemandWaiver: ({
+  authenticatedLogin,
+  session
+}: {
+  authenticatedLogin: string | undefined;
+  session: string | undefined;
+}) => AuthorizeDemandWaiverResult;
+//#endregion
 //#region src/hq-ingest-sink.d.ts
 interface HqIngestDependencies {
   /**
@@ -494,6 +590,23 @@ declare const reviewPromptSectionsSchema: z.ZodArray<z.ZodObject<{
   text: z.ZodString;
 }, z.core.$strict>>;
 //#endregion
+//#region src/policy-resolution.d.ts
+/** How a gate resolved the review policy it evaluated a candidate under. */
+declare const policyResolutionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  basePolicyDigest: z.ZodString;
+  baseRefName: z.ZodString;
+  candidatePolicyDigest: z.ZodString;
+  effectiveDigest: z.ZodString;
+  policyBaseSha: z.ZodString;
+  reviewPolicyChanged: z.ZodBoolean;
+  status: z.ZodLiteral<"authoritative">;
+}, z.core.$strict>, z.ZodObject<{
+  baseRefName: z.ZodString;
+  reason: z.ZodString;
+  status: z.ZodLiteral<"unresolved">;
+}, z.core.$strict>], "status">;
+type PolicyResolution = z.infer<typeof policyResolutionSchema>;
+//#endregion
 //#region src/review-ladder-policy.d.ts
 type ReviewFindingSeverity = "critical" | "high" | "medium" | "low" | "unknown";
 type ReviewFindingCategory = "correctness" | "safety" | "coordination" | "maintainability" | "unknown";
@@ -589,6 +702,7 @@ interface ReviewLadderCycle {
     headSha: string;
     patchId: string;
   };
+  historical?: true;
   model?: string;
   correlatedRerun?: boolean;
   session?: LadderSessionAttribution;
@@ -756,6 +870,13 @@ interface PrReviewProof {
   changedFiles: string[];
   cleanedPaths: string[];
   ladder?: PrReviewLadderState;
+  /**
+   * The policy identity this review run resolved its demanded kinds under
+   * (#922 Slice B). Optional: a run that could not reach the authority records
+   * the refusal instead, and `pr:ready` decides what an unresolved or
+   * disagreeing identity means for admission.
+   */
+  policyResolution?: PolicyResolution;
   reviewRequirement?: {
     reason: "no-applicable-mode" | "faithful-merge";
     status: "not-required";
@@ -763,102 +884,6 @@ interface PrReviewProof {
   reviews: PrReviewResult[];
 }
 //#endregion
-//#region src/demand-waiver.d.ts
-declare const DEFAULT_DEMAND_WAIVER_PATH = ".factory-memory/demand-waivers.json";
-/** One recorded operator act: this demand, on this candidate, waived. */
-interface DemandWaiver {
-  candidate: {
-    headSha: string;
-    pr: number;
-  };
-  demand: string;
-  /** The authenticated GitHub account that recorded the waiver. */
-  operator: string;
-  rationale: string;
-  recordedAt: string;
-  /** Optional audit metadata; never waiver authority. */
-  session?: string;
-}
-interface DemandWaiverStore {
-  command: "patronage-factory demand:waive";
-  schemaVersion: 1;
-  waivers: DemandWaiver[];
-}
-declare const validateDemandWaiverStore: (value: unknown) => DemandWaiverStore;
-/**
- * A demand that was in force, was NOT met, and was waived by the operator.
- *
- * `unmetReasons` is required and non-empty: every reason the demand refused is
- * carried through verbatim. There is no field on this record that could say
- * "satisfied", and no code path constructs one without a refusal to carry.
- */
-interface WaivedDemand {
-  demand: string;
-  operator: string;
-  rationale: string;
-  recordedAt: string;
-  session?: string;
-  /** The demand's refusals at evaluation time, preserved verbatim. */
-  unmetReasons: string[];
-}
-declare const waivedDemandSchema: z.ZodType<WaivedDemand>;
-/** The waivers that bind one candidate: same PR, same head. */
-declare const selectWaiversForCandidate: ({
-  headSha,
-  pr,
-  waivers
-}: {
-  headSha: string | undefined;
-  pr: number;
-  waivers: readonly DemandWaiver[];
-}) => DemandWaiver[];
-interface DemandOutcome {
-  blockingReasons: string[];
-  waived?: WaivedDemand;
-}
-/**
- * Fold one resolved demand's refusals through the operator's waivers.
- *
- * A satisfied demand (no refusals) stays satisfied and the waiver stays inert
- * — a waiver can only ever move a demand from *unmet-and-blocking* to
- * *unmet-and-waived*, never to met.
- */
-declare const applyDemandWaiver: ({
-  demand,
-  reasons,
-  waivers
-}: {
-  demand: string;
-  reasons: readonly string[];
-  waivers: readonly DemandWaiver[];
-}) => DemandOutcome;
-/** How a waived demand reads to a human. Never the word "satisfied". */
-declare const waivedDemandNotice: (waived: WaivedDemand) => string;
-interface DemandWaiverAuthorization {
-  operator: string;
-  session?: string;
-}
-type AuthorizeDemandWaiverResult = {
-  authorization: DemandWaiverAuthorization;
-  refusals?: undefined;
-} | {
-  authorization?: undefined;
-  refusals: string[];
-};
-/**
- * Operator identity, `declaredBy`-style: a named human account, recorded on
- * the waiver and enforced here. Session is optional audit metadata only: it is
- * not credential-backed, so its absence or equality never authorizes or
- * refuses an operator act.
- */
-declare const authorizeDemandWaiver: ({
-  authenticatedLogin,
-  session
-}: {
-  authenticatedLogin: string | undefined;
-  session: string | undefined;
-}) => AuthorizeDemandWaiverResult;
-//#endregion
 //#region src/blocked-reasons.d.ts
 declare const blockedReasonSchema: z.ZodObject<{
   code: z.ZodString;
@@ -893,23 +918,6 @@ interface CheckoutRepository {
   owner: string;
 }
 //#endregion
-//#region src/policy-resolution.d.ts
-/** How a gate resolved the review policy it evaluated a candidate under. */
-declare const policyResolutionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-  basePolicyDigest: z.ZodString;
-  baseRefName: z.ZodString;
-  candidatePolicyDigest: z.ZodString;
-  effectiveDigest: z.ZodString;
-  policyBaseSha: z.ZodString;
-  reviewPolicyChanged: z.ZodBoolean;
-  status: z.ZodLiteral<"authoritative">;
-}, z.core.$strict>, z.ZodObject<{
-  baseRefName: z.ZodString;
-  reason: z.ZodString;
-  status: z.ZodLiteral<"unresolved">;
-}, z.core.$strict>], "status">;
-type PolicyResolution = z.infer<typeof policyResolutionSchema>;
-//#endregion
 //#region src/profile.d.ts
 declare const DEFAULT_FACTORY_REPOSITORY = "unknown/unknown";
 /** The one profile shape this build accepts (ADR 0023, #318, #351, #742). */
@@ -1126,6 +1134,27 @@ interface BaseReviewPolicyAuthority {
     repository: CheckoutRepository;
   }) => string;
 }
+/**
+ * The pull request whose base ref is the authority, as the resolving stage
+ * knows it (#922 Slice B).
+ *
+ * `pr:ready` is handed a PR number and reads the record; `pr:verify` and
+ * `pr:review` run in the authoring checkout and look the PR up from the branch,
+ * which can legitimately find nothing. `isCrossRepository` stays `unknown` for
+ * the reason the reader below states: an unstated fork answer is not a "no".
+ */
+interface CandidatePullRequestPolicyContext {
+  baseRefName: string;
+  isCrossRepository: unknown;
+}
+/** What a stage found when it looked for the pull request that owns this branch. */
+type CandidatePullRequestLookup = {
+  pullRequest: CandidatePullRequestPolicyContext;
+  status: "found";
+} | {
+  reason: string;
+  status: "unavailable";
+};
 //#endregion
 //#region src/follow-up.d.ts
 interface FactoryCliInvocation {
@@ -1309,8 +1338,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    stale: "stale";
     active: "active";
+    stale: "stale";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -1472,9 +1501,9 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
     mergeable: z.ZodString;
     requiredChecks: z.ZodEnum<{
       unknown: "unknown";
+      pending: "pending";
       passed: "passed";
       failed: "failed";
-      pending: "pending";
       none: "none";
     }>;
     reviewDecision: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -1540,8 +1569,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       "run-interior-cycle": "run-interior-cycle";
     }>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
       "interior-complete": "interior-complete";
     }>;
   }, z.core.$strip>>;
@@ -1557,10 +1586,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        blocked: "blocked";
+        stale: "stale";
         "not-required": "not-required";
+        blocked: "blocked";
         current: "current";
-        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1569,10 +1598,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        blocked: "blocked";
+        stale: "stale";
         "not-required": "not-required";
+        blocked: "blocked";
         current: "current";
-        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -1606,7 +1635,7 @@ type ReadinessStatus = "ready" | "blocked";
 type ManagedReadinessLedger = z.infer<typeof managedReadinessLedgerSchema>;
 declare function validateManagedReadinessLedger(value: unknown): ManagedReadinessLedger;
 declare namespace status_check_rollup_d_exports {
-  export { CheckState, HOSTED_VERIFY_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isFactoryReadyCheck, isHostedVerifyCheck, statusCheckState };
+  export { CheckState, HOSTED_VERIFY_CHECK_NAME, StatusCheckRollup, hostedVerifyCheckState, isFactoryReadyCheck, isHostedVerifyCheck, pendingCheckNames, statusCheckState };
 }
 type CheckState = "passed" | "failed" | "pending" | "none" | "unknown";
 interface StatusCheckRollup {
@@ -1653,8 +1682,23 @@ declare const isHostedVerifyCheck: (check: StatusCheckRollup) => boolean;
  * nothing else in the rollup would have said so.
  */
 declare const hostedVerifyCheckState: (rollup: StatusCheckRollup[] | undefined) => CheckState;
+/**
+ * The names of the runs `statusCheckState` would count as pending, in the
+ * order the rollup reports them.
+ *
+ * Same reader, same collapsing of superseded generations — this only says
+ * *which* runs hold the head open, so a caller that waits on them can name
+ * them. A run with no context and no name is reported as `unnamed check`
+ * rather than dropped: a wait must not look settled because one row was
+ * unprintable.
+ */
+declare const pendingCheckNames: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => string[];
 declare const statusCheckState: (rollup: StatusCheckRollup[] | undefined, exclude?: (check: StatusCheckRollup) => boolean) => CheckState;
 //#endregion
+//#region src/github-client.d.ts
+/** Read a branch tip from GitHub rather than a checkout's cached remote ref. */
+declare const fetchGitHubBranchTipSha: (repository: CheckoutRepository, branch: string, cwd: string) => string;
+//#endregion
 //#region src/github-app-client.d.ts
 interface FactoryAppRequest {
   body?: unknown;
@@ -1772,6 +1816,16 @@ interface PrVerifyProof {
   notRequiredCommands?: PrVerifyNotRequiredCommand[];
   outcome?: "aborted" | "passed";
   patchId?: string;
+  /**
+   * The review policy identity this verification run resolved (#922 Slice B).
+   *
+   * Verification demands no review mode of its own. It records the identity so
+   * `pr:ready` can see whether the stage that produced this proof judged the
+   * candidate under the same policy readiness resolves. Optional, and normally
+   * `unresolved` on the first run of a branch: a candidate is verified before
+   * it has a pull request, and there is no authority to read without one.
+   */
+  policyResolution?: PolicyResolution;
   profilePath: string;
   projectKey: string;
   repository: string;
@@ -2051,6 +2105,8 @@ interface FailedPreviewSnapshot {
   readonly name: string;
 }
 interface FactoryPrStatusSources {
+  /** Live PR base ref name observed with the sources. Identity, not a SHA. */
+  readonly baseRefName?: string;
   readonly baseSha: string;
   readonly checks: Readonly<Partial<Record<FactoryPrStatusCheckName, CompletedFactoryCheckSnapshot>>>;
   readonly previewFailures?: Readonly<Partial<Record<string, FailedPreviewSnapshot>>>;
@@ -2086,9 +2142,14 @@ interface PresentFactoryPrStatusHudDependencies {
     previewTargets?: readonly string[];
     repo: string;
   }) => Promise<FactoryPrStatusSources>;
-  /** Recheck both PR endpoints immediately before mutating the sticky HUD. */
+  /**
+   * Recheck the pulls identity immediately before mutating the sticky HUD.
+   * Happy path reads `/pulls/:n` only; git-ref is fetched to decorate a
+   * head-moved error, not as a second identity endpoint.
+   */
   readonly assertCurrentIdentity: (input: {
-    baseSha: string;
+    baseRefName?: string; /** Retained for rendering/callers; identity compares base ref name. */
+    baseSha?: string;
     headSha: string;
     owner: string;
     pr: number;
@@ -2099,10 +2160,11 @@ interface PresentFactoryPrStatusHudDependencies {
 interface ReadFactoryPrStatusSourcesInput {
   readonly headSha: string;
   /**
-   * Read token for `previewProofInventory.list`. The list walks the
-   * force-push timeline, which needs commit (contents) read; the Factory App
-   * token has no contents permission, so pass a workflow `GITHUB_TOKEN`
-   * (#825). Falls back to `token`.
+   * Contents-read token for `previewProofInventory.list` and the live
+   * `git/ref/heads/<base>` tip. Both need `contents: read`; the Factory App
+   * token has none, so pass a workflow `GITHUB_TOKEN` (#825, #908). The
+   * inventory list falls back to `token`. The base tip has no HTTP fallback:
+   * without this token it is read through `gh`.
    */
   readonly inventoryToken?: string;
   readonly owner: string;
@@ -2118,6 +2180,11 @@ interface ReadFactoryPrStatusSourcesInput {
 }
 interface ReadFactoryPrStatusSourcesDependencies {
   readonly fetch?: typeof fetch;
+  /**
+   * Local base-tip reader used when no `inventoryToken` exists. Defaults to
+   * the `gh`-backed reader `pr:ready` already uses.
+   */
+  readonly fetchBranchTipSha?: typeof fetchGitHubBranchTipSha;
   readonly listPreviewRegistrations?: (input: {
     owner: string;
     pr: number;
@@ -2129,7 +2196,8 @@ interface ReadFactoryPrStatusSourcesDependencies {
 declare function renderFactoryPrStatusHud(input: RenderFactoryPrStatusHudInput): string;
 declare function presentFactoryPrStatusHud(input: PresentFactoryPrStatusHudInput, dependencies: PresentFactoryPrStatusHudDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
 declare function assertFactoryPrStatusIdentity(input: ReadFactoryPrStatusSourcesInput & {
-  readonly baseSha: string;
+  readonly baseRefName?: string; /** Retained for rendering/callers; identity compares base ref name. */
+  readonly baseSha?: string;
 }, dependencies?: ReadFactoryPrStatusSourcesDependencies): Promise<void>;
 declare function readFactoryPrStatusSources(input: ReadFactoryPrStatusSourcesInput, dependencies?: ReadFactoryPrStatusSourcesDependencies): Promise<FactoryPrStatusSources>;
 interface PlanFactoryPrStatusHudInput {
@@ -2149,6 +2217,11 @@ declare function planFactoryPrStatusHud(input: PlanFactoryPrStatusHudInput): Pre
 interface RefreshFactoryPrStatusHudInput {
   readonly cwd: string;
   readonly headSha: string;
+  /**
+   * Workflow `GITHUB_TOKEN` with `contents: read` for the live git-ref and
+   * preview inventory. The Factory App token cannot read those (#825, #908).
+   */
+  readonly inventoryToken?: string;
   readonly mergeBaseSha?: string;
   readonly owner: string;
   readonly patchId?: string;
@@ -2357,6 +2430,12 @@ interface PrReadyGitDependencies {
   canResolveCommit: (cwd: string, sha: string) => boolean;
   changedFiles: (cwd: string, base: string, headSha?: string) => string[];
   checkoutRepository: (cwd: string) => CheckoutRepository;
+  /**
+   * Bring `refs/heads/<baseRefName>` into the checkout so the live tip
+   * `pr.baseRefOid` can resolve. Optional so fixtures that already resolve
+   * every SHA can omit it.
+   */
+  fetchOriginRef?: (cwd: string, refName: string) => void;
   currentHeadSha: (cwd: string) => string;
   mergeBaseSha: (cwd: string, base: string) => string;
   objectIdAtRef: (cwd: string, ref: string, absolutePath: string) => string | undefined;
@@ -2399,8 +2478,8 @@ declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2426,8 +2505,8 @@ declare const evidenceEnvelopeSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2529,10 +2608,10 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  blocked: "blocked";
+  stale: "stale";
   "not-required": "not-required";
+  blocked: "blocked";
   current: "current";
-  stale: "stale";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -2647,8 +2726,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     wave: z.ZodString;
   }, z.core.$strip>>;
   demandedRung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   epicIssue: z.ZodNumber;
@@ -2663,8 +2742,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     commentUrl: z.ZodOptional<z.ZodString>;
     producer: z.ZodString;
     rung: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
     sessionId: z.ZodOptional<z.ZodString>;
@@ -2692,6 +2771,22 @@ interface BoundaryCheckGithub {
   fetchIssueComments: (repo: string, issue: number) => GithubIssueComment[];
   fetchClosingPullRequests: (repo: string, issue: number) => BoundaryPullRequestRef[];
   fetchPullRequest?: (repo: string, pr: number) => BoundaryPullRequestRef;
+  /**
+   * Child issue state for the close-gate (#901). Required so a stub cannot
+   * skip the gate and look like a pass.
+   */
+  fetchIssueState: (repo: string, issue: number) => "OPEN" | "CLOSED";
+  /**
+   * PRs whose bodies may contribute closing-keyword membership (#901). For
+   * `each-to-epic`, production lists PRs targeting the integration branch.
+   * Branch targeting never joins; only a keyword naming a declared child does.
+   * Required so omitting the channel cannot silently drop it.
+   */
+  listCandidatePullRequests: (repo: string, input: {
+    integrationBranch?: string;
+  }) => (BoundaryPullRequestRef & {
+    body?: string;
+  })[];
 }
 interface BoundaryCheckArgs {
   cwd?: string;
@@ -2711,6 +2806,7 @@ interface BoundaryCheckArgs {
 interface BoundaryCheckDependencies {
   github?: BoundaryCheckGithub;
   hq?: HqIngestDependencies;
+  readWaivers?: (cwd: string) => DemandWaiver[];
   resolveRepo?: (cwd: string) => string;
 }
 declare function runBoundaryCheck(args: BoundaryCheckArgs, dependencies?: BoundaryCheckDependencies): BoundaryCheckProofRecord;
@@ -2807,6 +2903,7 @@ interface PrReviewArgs extends LoadProjectProfileInput {
   cycle: number;
   dispositions?: string;
   findings?: string;
+  historical?: boolean;
   issue?: number;
   mode: PrReviewMode;
   output?: string;
@@ -2814,12 +2911,15 @@ interface PrReviewArgs extends LoadProjectProfileInput {
 }
 interface PrReviewGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
+  checkoutRepository?: (cwd: string) => CheckoutRepository;
   currentHeadSha: (cwd: string) => string;
+  firstParentCommits?: (cwd: string, base: string) => string[];
   isAncestor: (cwd: string, ancestor: string, descendant: string) => boolean;
   recognizeCatchUp?: CatchUpRecognizer;
   repositoryRoot?: (cwd: string) => string;
   showFileAtRef?: (cwd: string, ref: string, absolutePath: string) => string | undefined;
   stablePatchId: (cwd: string, base: string) => string;
+  stablePatchIdAtRef?: (cwd: string, base: string, ref: string) => string;
   statusPorcelain: (cwd: string) => string;
 }
 interface PrReviewIssueBodyInput {
@@ -2828,9 +2928,20 @@ interface PrReviewIssueBodyInput {
   repo: string;
 }
 interface PrReviewDependencies {
+  /**
+   * The authoritative base-policy reader (#922). Injectable for the same
+   * reason `pr:ready` injects it: an unstated authority must be a refusal a
+   * test can state, never a silent pass.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
   fetchIssueBody?: (input: PrReviewIssueBodyInput) => string;
   git?: PrReviewGitDependencies;
   hq?: HqIngestDependencies;
+  /**
+   * How this run finds the pull request whose base ref is the policy authority
+   * (#922 Slice B). Defaults to the GitHub lookup.
+   */
+  lookupPullRequest?: (cwd: string) => CandidatePullRequestLookup;
 }
 declare function runPrReview(args: PrReviewArgs, dependencies?: PrReviewDependencies): Promise<PrReviewProof>;
 //#endregion
@@ -2861,6 +2972,7 @@ interface PrVerifyArgs extends LoadProjectProfileInput {
 }
 interface PrVerifyGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
+  checkoutRepository?: (cwd: string) => CheckoutRepository;
   currentHeadSha: (cwd: string) => string;
   emptyTreeHash: (cwd: string) => string;
   mergeBaseSha: (cwd: string, base: string) => string;
@@ -2871,7 +2983,19 @@ interface PrVerifyGitDependencies {
   stablePatchId: (cwd: string, base: string) => string;
 }
 interface PrVerifyDependencies {
+  /**
+   * The authoritative base-policy reader (#922). Injectable for the same
+   * reason `pr:ready` injects it: an unstated authority must be a refusal a
+   * test can state, never a silent pass.
+   */
+  basePolicy?: BaseReviewPolicyAuthority;
   cleanInstall?: CleanInstallResolutionDependencies | false;
+  /**
+   * How this run finds the pull request whose base ref is the policy authority
+   * (#922 Slice B). Defaults to the GitHub lookup; a checkout with no pull
+   * request resolves `unavailable`, which is normal before publication.
+   */
+  lookupPullRequest?: (cwd: string) => CandidatePullRequestLookup;
   env?: NodeJS.ProcessEnv;
   git?: PrVerifyGitDependencies;
   hq?: HqIngestDependencies;
@@ -3058,9 +3182,9 @@ interface PrStatusHudArgs {
   readonly cwd: string;
   readonly headSha: string;
   /**
-   * Read token for the preview-proof inventory list. The App token cannot
-   * read the force-push timeline (no contents permission), so the workflow
-   * `GITHUB_TOKEN` serves that read (#825).
+   * Contents-read token for the preview-proof inventory list and the live
+   * git-ref tip. The App token has no contents permission, so the workflow
+   * `GITHUB_TOKEN` serves those reads (#825, #908).
    */
   readonly inventoryToken?: string;
   readonly owner: string;
@@ -3148,11 +3272,11 @@ declare const LegacyWorkerCloseoutStatusTraceEventSchema: z.ZodObject<{
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
-    pending: "pending";
     unavailable: "unavailable";
     archived: "archived";
     skipped: "skipped";
     "not-applicable": "not-applicable";
+    pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
@@ -3325,8 +3449,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3378,8 +3502,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     sessionId: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
   stage: z.ZodEnum<{
-    gate: "gate";
     interior: "interior";
+    gate: "gate";
   }>;
   usage: z.ZodOptional<z.ZodObject<{
     estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3422,8 +3546,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     stage: z.ZodEnum<{
-      gate: "gate";
       interior: "interior";
+      gate: "gate";
     }>;
     usage: z.ZodOptional<z.ZodObject<{
       estimatedCostUsd: z.ZodOptional<z.ZodNumber>;
@@ -3453,7 +3577,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     staleRepeats: number;
   };
   observedAt: string;
-  stage: "gate" | "interior";
+  stage: "interior" | "gate";
   issue?: number | undefined;
   pr?: number | undefined;
   threadId?: string | undefined;
@@ -3546,11 +3670,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
-    pending: "pending";
     unavailable: "unavailable";
     archived: "archived";
     skipped: "skipped";
     "not-applicable": "not-applicable";
+    pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
@@ -3587,11 +3711,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   }, z.core.$strict>], "lessonStatus">;
   readonly 2: z.ZodObject<{
     archiveStatus: z.ZodOptional<z.ZodEnum<{
-      pending: "pending";
       unavailable: "unavailable";
       archived: "archived";
       skipped: "skipped";
       "not-applicable": "not-applicable";
+      pending: "pending";
     }>>;
     closeoutReason: z.ZodOptional<z.ZodString>;
     lessonStatus: z.ZodOptional<z.ZodEnum<{
@@ -3729,8 +3853,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     model: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      oracle: "oracle";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3738,8 +3862,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
     review: "review";
-    oracle: "oracle";
     delegate: "delegate";
+    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3808,8 +3932,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     model: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      oracle: "oracle";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3817,8 +3941,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
     review: "review";
-    oracle: "oracle";
     delegate: "delegate";
+    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -3878,8 +4002,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       model: z.ZodString;
       tier: z.ZodEnum<{
         review: "review";
-        oracle: "oracle";
         delegate: "delegate";
+        oracle: "oracle";
         workhorse: "workhorse";
         scout: "scout";
       }>;
@@ -3887,8 +4011,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     startedAt: z.ZodString;
     tier: z.ZodEnum<{
       review: "review";
-      oracle: "oracle";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -3937,11 +4061,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
-    tier: "review" | "oracle" | "delegate" | "workhorse" | "scout";
+    tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
     fallbackTier?: "delegate" | undefined;
   };
   startedAt: string;
-  tier: "review" | "oracle" | "delegate" | "workhorse" | "scout";
+  tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
   tokenUsage: {
     source: "cursor-csv" | "codex-json" | "cursor-json" | "claude-json";
     status: "available";
@@ -4233,6 +4357,13 @@ interface EvaluationInput {
   mergeStateStatus: string;
   ladderPolicy?: ReviewLadderPolicy;
   reviewModes?: PrReviewKind[];
+  /**
+   * Cross-stage policy-identity refusals resolved at the command boundary
+   * (#922 Slice B), already worded. Evaluation only decides whether they are
+   * in force: a recognized catch-up withdraws every review demand, so it
+   * withdraws these with them.
+   */
+  policyIdentityRefusals?: string[];
   reviewProof?: PrReviewProof;
   verificationProof?: VerificationProofState;
   docsOnlyVerifyBaselineHeadShas?: string[];
@@ -4263,7 +4394,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
       draft: boolean;
       mergeStateStatus: string;
       mergeable: string;
-      requiredChecks: "unknown" | "passed" | "failed" | "pending" | "none";
+      requiredChecks: "unknown" | "pending" | "passed" | "failed" | "none";
       unresolvedReviewThreads: number;
       reviewDecision?: string | null | undefined;
     };
@@ -4278,13 +4409,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "blocked" | "not-required" | "current" | "stale" | "missing";
+        status: "stale" | "not-required" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "blocked" | "not-required" | "current" | "stale" | "missing";
+        status: "stale" | "not-required" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -4347,7 +4478,7 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
         interior: number;
       };
       nextAction: "run-gate-cycle" | "accept-nonblocking-findings" | "escalate-to-triage" | "ready-for-human" | "advance-to-gate" | "run-interior-cycle";
-      stage: "gate" | "interior" | "interior-complete";
+      stage: "interior" | "gate" | "interior-complete";
       forcedTransition?: "gate-cap-exhausted" | "interior-cap-reached" | undefined;
     } | undefined;
     reviewRuns?: PrReviewResult[] | undefined;