@patronage/software-factory 1.0.0-alpha.33 → 1.0.0-alpha.35

package/dist/index.d.ts

@@ -1303,6 +1303,212 @@ interface FactoryAppAccessDependencies {
  */
 type ResolvedPrVerifyMode = "docs-only" | "trivial" | "full";
 //#endregion
+//#region src/pr-verify-proof-contract.d.ts
+/**
+ * The pr:verify proof versions a reader accepts: the current one only (#920
+ * item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
+ * is per-candidate and short-lived — it is rewritten on every head — so no
+ * stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
+ * applies: one current contract, no compat reader. A consumer on an older
+ * factory must adopt this release before HQ ingests its pr:verify proofs.
+ */
+declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [4];
+type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
+interface PrVerifyCommandResult {
+  command: string;
+  description: string;
+  /**
+   * Epic #550 wave 3 (#430): the profile's declared impact target for this
+   * command, recorded from v4 on. It is the proof's own command→target
+   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
+   * for the same command, so a withholding cannot point at whichever released
+   * target happens to be convenient. Absent for a command the profile does
+   * not scope.
+   */
+  impactTarget?: string;
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
+}
+/**
+ * One failing test a verification command reported (#1035).
+ *
+ * The proof keeps the failing test's IDENTITY and its failure CLASS, and
+ * nothing else. That is enough to decide retry-or-fix — a `timeout` under
+ * machine load is a flake, an `assertion` is a real break — without rerunning
+ * the aggregate to read a title off the console.
+ *
+ * It deliberately keeps no raw output tail and no error message body. This
+ * payload is transmitted to HQ ingest, and arbitrary command output can carry
+ * secrets (an echoed environment, a connection string inside a stack frame). A
+ * file path, a test title, and a closed `kind` enum cannot. The cost is the
+ * assertion diff and the stack frames: they help you FIX a failure, and the
+ * operator still reads them from the run's own console output.
+ */
+interface PrVerifyTestFailure {
+  /** The test file the reporter named, as the reporter wrote it. */
+  file: string;
+  /**
+   * The failure class. `timeout` is the test-timeout error vitest raises at
+   * its own ceiling; `assertion` is a failed expectation; `error` is every
+   * other thrown failure.
+   */
+  kind: "assertion" | "error" | "timeout";
+  /** The full test title, suite names included, as the reporter wrote it. */
+  title: string;
+}
+interface PrVerifyExecutedCommand {
+  command: string;
+  counts?: {
+    testFiles?: number;
+    tests?: number;
+  };
+  durationMs: number;
+  exitCode: number;
+  /**
+   * The failing tests this command reported (#1035). Present only when the
+   * command produced parseable failures, so a passing command's record is
+   * byte-identical to the one it wrote before this field existed.
+   */
+  failures?: PrVerifyTestFailure[];
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
+}
+/**
+ * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
+ * candidate cannot reach, so the battery did not run it.
+ *
+ * The completeness invariant lives in the pairing: `verificationCommands`
+ * records every command the resolved mode selected, `executedCommands` records
+ * what ran, and this list records the rest WITH the stamp's own basis. A
+ * withheld stack is therefore never silently absent from the proof — it is
+ * present, named, and explained.
+ */
+interface PrVerifyNotRequiredCommand {
+  basis: string;
+  impactTarget: string;
+  name: string;
+}
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
+}
+interface PrVerifyProof {
+  schemaVersion: PrVerifySchemaVersion;
+  authoringSession: string;
+  base: string;
+  /**
+   * The commit `base` resolved to when this proof was written (#1132): the
+   * live pull request base tip, or the freshly fetched ref. Optional and
+   * additive; a proof written before it existed parses unchanged.
+   */
+  baseSha?: string;
+  baselineFullProofs?: {
+    base: string;
+    changedFiles: string[];
+    headSha: string;
+    profilePath: string;
+    projectKey: string;
+    repository: string;
+  }[];
+  catchUpRecognition?: CatchUpRecognition;
+  changedFiles: string[];
+  classification: DiffClassification;
+  classificationReasons: string[];
+  command: "patronage-factory pr:verify";
+  durationMs: number;
+  endedAt: string;
+  executedCommands?: PrVerifyExecutedCommand[];
+  headSha: string;
+  impactStamp?: ImpactStamp;
+  mode: ResolvedPrVerifyMode;
+  mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
+  notRequiredCommands?: PrVerifyNotRequiredCommand[];
+  outcome?: "aborted" | "passed";
+  patchId?: string;
+  /**
+   * The review policy identity this verification run resolved (#922 Slice B).
+   *
+   * Verification demands no review mode of its own. It records the identity so
+   * `pr:ready` can see whether the stage that produced this proof judged the
+   * candidate under the same policy readiness resolves. Optional, and normally
+   * `unresolved` on the first run of a branch: a candidate is verified before
+   * it has a pull request, and there is no authority to read without one.
+   */
+  policyResolution?: PolicyResolution;
+  profilePath: string;
+  projectKey: string;
+  repository: string;
+  startedAt: string;
+  verificationCommands: PrVerifyCommandResult[];
+}
+type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
+declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
+//#endregion
+//#region src/pr-verify-check-payload.d.ts
+/**
+ * Machine-readable binding carried on the `patronage-factory/pr-verify` check
+ * run (#247), alongside the human-readable prose summary.
+ *
+ * It records *what was verified*, for the head SHA it was written for. It
+ * grants nothing and gates nothing on its own: a consumer still has to verify
+ * the producing App, the conclusion, and its own freshness rule. The payload
+ * is a fenced JSON document in `output.text`.
+ */
+declare const PR_VERIFY_CHECK_PAYLOAD_KIND: "pr-verify-proof-binding";
+declare const PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION = 1;
+/**
+ * `unknown` covers a proof written by a schema version that did not record a
+ * classification. A consumer must treat it as "not stated", never as trivial.
+ */
+type PrVerifyPayloadClassification = DiffClassification | "unknown";
+interface PrVerifyCheckPayload {
+  /**
+   * Factory diff classification. Deliberately distinct from `mode`: the
+   * workflow path filter and the factory classifier use different rules, so a
+   * consumer must be able to see both.
+   */
+  classification: PrVerifyPayloadClassification;
+  /** Names of the verification commands that actually ran, in run order. */
+  executedCommands: string[];
+  /** The commit this verification describes. Binding is by tree, not patch. */
+  headSha: string;
+  /**
+   * The proof's own identity-bound impact stamp. Kept opaque here: the hosted
+   * proof-reuse gate validates the complete release tuple before subtracting
+   * any command, and malformed data must remain visible to that fail-closed
+   * reader rather than being normalized away during publication.
+   */
+  impactStamp?: unknown;
+  kind: typeof PR_VERIFY_CHECK_PAYLOAD_KIND;
+  /**
+   * Resolved verification mode. `docs-only` and `trivial` run reduced command
+   * suites and publish the same successful check run as `full`, so this field
+   * is what keeps them from being confusable after the fact.
+   */
+  mode: ResolvedPrVerifyMode;
+  /** Commands the proof withheld, including their claimed target and prose basis. */
+  notRequiredCommands?: unknown;
+  outcome: "aborted" | "passed";
+  /** Stable patch id, when the proof recorded one. Informational only. */
+  patchId?: string;
+  /** `schemaVersion` of the local pr:verify proof this was rendered from. */
+  proofSchemaVersion: number;
+  /** `<owner>/<name>` the proof was produced for. */
+  repository?: string;
+  /** Version of *this* payload shape. */
+  schemaVersion: typeof PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION;
+  /** The proof's command-to-impact-target bindings used to validate releases. */
+  verificationCommands?: unknown;
+  /** Original validated proof. Absence requires normal verification on a fresh runner. */
+  verificationProof?: PrVerifyProof;
+}
+//#endregion
 //#region src/pr-verify-status.d.ts
 type CommitStatusState = "failure" | "pending" | "success";
 interface PostCommitStatusInput {
@@ -1408,6 +1614,42 @@ interface CheckRunDependencies extends FactoryAppAccessDependencies {
 declare function ensureFactoryCheckRunPublished(input: PublishFactoryCheckInput, dependencies?: CheckRunDependencies & {
   onDiagnostic?: (message: string) => void;
 }): Promise<boolean>;
+type GhJsonRunner = <T>(args: string[]) => T;
+interface FactoryCheckRunProducer {
+  identity: string;
+  mode: "app";
+}
+interface PrVerifyProofBinding {
+  completedAtMs: number;
+  conclusion: string;
+  payload: PrVerifyCheckPayload;
+  producer: FactoryCheckRunProducer;
+}
+/**
+ * Read the machine-readable `pr:verify` binding for one commit (#247).
+ *
+ * Deliberately narrow: it reads check runs only, and only those whose `app`
+ * identity matches the configured factory App. It never consults commit
+ * statuses. `patronage-factory/pr-verify` is postable as a commit status by any
+ * token with write access, so that surface stays a human-readable mirror and
+ * can never satisfy a consumer that wants proof. Absent, foreign, or
+ * unparseable ⇒ `undefined` (fail closed).
+ */
+declare function fetchPrVerifyProofBinding({
+  expectedAppId,
+  githubApp,
+  owner,
+  repo,
+  sha,
+  runJson
+}: {
+  /** Overrides the configured App id — CI has no user config (#247 part 3). */expectedAppId?: string;
+  githubApp?: GithubAppConfig;
+  owner: string;
+  repo: string;
+  sha: string;
+  runJson?: GhJsonRunner;
+}): PrVerifyProofBinding | undefined;
 //#endregion
 //#region src/merge-freeze.d.ts
 declare const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
@@ -1423,6 +1665,16 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
   schemaVersion: z.ZodLiteral<1>;
+  verification: z.ZodOptional<z.ZodObject<{
+    jobs: z.ZodRecord<z.ZodString, z.ZodEnum<{
+      success: "success";
+      failure: "failure";
+      cancelled: "cancelled";
+      skipped: "skipped";
+    }>>;
+    runAttempt: z.ZodNumber;
+    runId: z.ZodNumber;
+  }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
   active: z.ZodLiteral<false>;
   clearRationale: z.ZodOptional<z.ZodString>;
@@ -1432,6 +1684,16 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
   schemaVersion: z.ZodLiteral<1>;
+  verification: z.ZodOptional<z.ZodObject<{
+    jobs: z.ZodRecord<z.ZodString, z.ZodEnum<{
+      success: "success";
+      failure: "failure";
+      cancelled: "cancelled";
+      skipped: "skipped";
+    }>>;
+    runAttempt: z.ZodNumber;
+    runId: z.ZodNumber;
+  }, z.core.$strip>>;
 }, z.core.$strip>], "active">;
 type MergeFreezeState = z.infer<typeof mergeFreezeStateSchema>;
 /**
@@ -1459,18 +1721,30 @@ interface RunningMergeFreezeWitness {
   /** The running `patronage-factory/merge-freeze` check-run id. */
   runId: number;
 }
+/** A push workflow run's status while it still owes a generation. */
+type PendingWorkflowRunStatus = "in_progress" | "pending" | "queued" | "requested" | "waiting";
 /**
  * The evidence that a generation is settling because it is still owed (#521).
+ *
+ * The witness is the freeze-writing workflow's push run on the tip, identified
+ * through lineage (#1276): the immediate parent's settled generation records
+ * the workflow run that wrote it, that run names its workflow, and the same
+ * workflow's pending push run on the tip owes the tip's generation. It is the
+ * workflow run rather than the `verify` job's check run because GitHub creates
+ * a job's check run only when the job is dispatched, which for the `verify`
+ * summary job is near the end of the push Verify.
  */
 interface AwaitedMergeFreezeWitness {
   /** The base tip whose generation is awaited. */
   headSha: string;
   /** The immediate parent whose settled generation proves the writer runs. */
   parentSha: string;
-  /** The source-pinned hosted verify run that owes the generation. */
-  verifyRunId: number;
+  /** The workflow whose run wrote the parent's settled generation. */
+  workflowId: number;
+  /** That workflow's push run on the tip, which owes the generation. */
+  workflowRunId: number;
   /** That run's status. A completed run owes nothing, so it is not settling. */
-  verifyStatus: "in_progress" | "queued";
+  workflowRunStatus: PendingWorkflowRunStatus;
 }
 /**
  * The two settling phases, each with the witness that proves it (#890).
@@ -1517,6 +1791,14 @@ interface GitHubCheckRunMergeFreezeApi {
     name: string;
   }) => unknown;
   parent?: (input: MergeFreezeStoreInput) => unknown;
+  /** One GitHub Actions workflow run, by id (`headSha` is not consulted). */
+  workflowRun?: (input: MergeFreezeStoreInput & {
+    runId: number;
+  }) => unknown;
+  /** A workflow's push runs on `headSha`, as `{ workflow_runs }`. */
+  workflowRuns?: (input: MergeFreezeStoreInput & {
+    workflowId: number;
+  }) => unknown;
 }
 declare function createGitHubCheckRunMergeFreezeStore(api: GitHubCheckRunMergeFreezeApi): MergeFreezeAuthority;
 //#endregion
@@ -1666,8 +1948,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        "not-required": "not-required";
         stale: "stale";
+        "not-required": "not-required";
         blocked: "blocked";
         current: "current";
         missing: "missing";
@@ -1678,8 +1960,8 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        "not-required": "not-required";
         stale: "stale";
+        "not-required": "not-required";
         blocked: "blocked";
         current: "current";
         missing: "missing";
@@ -1868,153 +2150,6 @@ interface UpsertFactoryPrStatusCommentResult {
   url: string;
 }
 declare function upsertFactoryPrStatusComment(input: UpsertFactoryPrStatusCommentInput, dependencies?: UpsertFactoryPrStatusCommentDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
-//#endregion
-//#region src/pr-verify-proof-contract.d.ts
-/**
- * The pr:verify proof versions a reader accepts: the current one only (#920
- * item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
- * is per-candidate and short-lived — it is rewritten on every head — so no
- * stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
- * applies: one current contract, no compat reader. A consumer on an older
- * factory must adopt this release before HQ ingests its pr:verify proofs.
- */
-declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [4];
-type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
-interface PrVerifyCommandResult {
-  command: string;
-  description: string;
-  /**
-   * Epic #550 wave 3 (#430): the profile's declared impact target for this
-   * command, recorded from v4 on. It is the proof's own command→target
-   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
-   * for the same command, so a withholding cannot point at whichever released
-   * target happens to be convenient. Absent for a command the profile does
-   * not scope.
-   */
-  impactTarget?: string;
-  name: string;
-  scope: "docs-only" | "trivial" | "full";
-}
-/**
- * One failing test a verification command reported (#1035).
- *
- * The proof keeps the failing test's IDENTITY and its failure CLASS, and
- * nothing else. That is enough to decide retry-or-fix — a `timeout` under
- * machine load is a flake, an `assertion` is a real break — without rerunning
- * the aggregate to read a title off the console.
- *
- * It deliberately keeps no raw output tail and no error message body. This
- * payload is transmitted to HQ ingest, and arbitrary command output can carry
- * secrets (an echoed environment, a connection string inside a stack frame). A
- * file path, a test title, and a closed `kind` enum cannot. The cost is the
- * assertion diff and the stack frames: they help you FIX a failure, and the
- * operator still reads them from the run's own console output.
- */
-interface PrVerifyTestFailure {
-  /** The test file the reporter named, as the reporter wrote it. */
-  file: string;
-  /**
-   * The failure class. `timeout` is the test-timeout error vitest raises at
-   * its own ceiling; `assertion` is a failed expectation; `error` is every
-   * other thrown failure.
-   */
-  kind: "assertion" | "error" | "timeout";
-  /** The full test title, suite names included, as the reporter wrote it. */
-  title: string;
-}
-interface PrVerifyExecutedCommand {
-  command: string;
-  counts?: {
-    testFiles?: number;
-    tests?: number;
-  };
-  durationMs: number;
-  exitCode: number;
-  /**
-   * The failing tests this command reported (#1035). Present only when the
-   * command produced parseable failures, so a passing command's record is
-   * byte-identical to the one it wrote before this field existed.
-   */
-  failures?: PrVerifyTestFailure[];
-  name: string;
-  scope: "docs-only" | "trivial" | "full";
-}
-/**
- * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
- * candidate cannot reach, so the battery did not run it.
- *
- * The completeness invariant lives in the pairing: `verificationCommands`
- * records every command the resolved mode selected, `executedCommands` records
- * what ran, and this list records the rest WITH the stamp's own basis. A
- * withheld stack is therefore never silently absent from the proof — it is
- * present, named, and explained.
- */
-interface PrVerifyNotRequiredCommand {
-  basis: string;
-  impactTarget: string;
-  name: string;
-}
-/**
- * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
- * why. Bound to the proof's stamp identity — refused when the proof records no
- * stamp. The factory does not write this list; consumers do.
- */
-interface PrVerifyNotDemandedRecord {
-  basis: string;
-  name: string;
-}
-interface PrVerifyProof {
-  schemaVersion: PrVerifySchemaVersion;
-  authoringSession: string;
-  base: string;
-  /**
-   * The commit `base` resolved to when this proof was written (#1132): the
-   * live pull request base tip, or the freshly fetched ref. Optional and
-   * additive; a proof written before it existed parses unchanged.
-   */
-  baseSha?: string;
-  baselineFullProofs?: {
-    base: string;
-    changedFiles: string[];
-    headSha: string;
-    profilePath: string;
-    projectKey: string;
-    repository: string;
-  }[];
-  catchUpRecognition?: CatchUpRecognition;
-  changedFiles: string[];
-  classification: DiffClassification;
-  classificationReasons: string[];
-  command: "patronage-factory pr:verify";
-  durationMs: number;
-  endedAt: string;
-  executedCommands?: PrVerifyExecutedCommand[];
-  headSha: string;
-  impactStamp?: ImpactStamp;
-  mode: ResolvedPrVerifyMode;
-  mergeBaseSha?: string;
-  notDemandedRecords?: PrVerifyNotDemandedRecord[];
-  notRequiredCommands?: PrVerifyNotRequiredCommand[];
-  outcome?: "aborted" | "passed";
-  patchId?: string;
-  /**
-   * The review policy identity this verification run resolved (#922 Slice B).
-   *
-   * Verification demands no review mode of its own. It records the identity so
-   * `pr:ready` can see whether the stage that produced this proof judged the
-   * candidate under the same policy readiness resolves. Optional, and normally
-   * `unresolved` on the first run of a branch: a candidate is verified before
-   * it has a pull request, and there is no authority to read without one.
-   */
-  policyResolution?: PolicyResolution;
-  profilePath: string;
-  projectKey: string;
-  repository: string;
-  startedAt: string;
-  verificationCommands: PrVerifyCommandResult[];
-}
-type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
-declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
 declare namespace verification_proof_d_exports {
   export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, PrVerifyTestFailure, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedCatchUpRecognition, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
 }
@@ -2798,8 +2933,8 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  "not-required": "not-required";
   stale: "stale";
+  "not-required": "not-required";
   blocked: "blocked";
   current: "current";
   missing: "missing";
@@ -3244,6 +3379,8 @@ interface PrVerifyArgs extends LoadProjectProfileInput {
   mode: PrVerifyMode;
   output?: string;
   requireKnownAuthoringSession?: boolean;
+  /** Recover the original proof from the accepted exact-head App binding. */
+  reuseAccepted?: boolean;
 }
 interface PrVerifyGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
@@ -3262,6 +3399,7 @@ interface PrVerifyGitDependencies {
   stablePatchId: (cwd: string, base: string) => string;
 }
 interface PrVerifyDependencies {
+  fetchVerifyBinding?: typeof fetchPrVerifyProofBinding;
   /**
    * The authoritative base-policy reader (#922). Injectable for the same
    * reason `pr:ready` injects it: an unstated authority must be a refusal a
@@ -3577,18 +3715,18 @@ declare const LegacyWorkerCloseoutStatusTraceEventSchema: z.ZodObject<{
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
+    skipped: "skipped";
     unavailable: "unavailable";
     archived: "archived";
-    skipped: "skipped";
     "not-applicable": "not-applicable";
     pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
   lessonStatus: z.ZodOptional<z.ZodEnum<{
+    skipped: "skipped";
     captured: "captured";
     unavailable: "unavailable";
-    skipped: "skipped";
   }>>;
   lessonSummary: z.ZodOptional<z.ZodString>;
   typeVersion: z.ZodLiteral<2>;
@@ -3975,18 +4113,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
+    skipped: "skipped";
     unavailable: "unavailable";
     archived: "archived";
-    skipped: "skipped";
     "not-applicable": "not-applicable";
     pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
   lessonStatus: z.ZodOptional<z.ZodEnum<{
+    skipped: "skipped";
     captured: "captured";
     unavailable: "unavailable";
-    skipped: "skipped";
   }>>;
   lessonSummary: z.ZodOptional<z.ZodString>;
   typeVersion: z.ZodLiteral<2>;
@@ -4016,17 +4154,17 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   }, z.core.$strict>], "lessonStatus">;
   readonly 2: z.ZodObject<{
     archiveStatus: z.ZodOptional<z.ZodEnum<{
+      skipped: "skipped";
       unavailable: "unavailable";
       archived: "archived";
-      skipped: "skipped";
       "not-applicable": "not-applicable";
       pending: "pending";
     }>>;
     closeoutReason: z.ZodOptional<z.ZodString>;
     lessonStatus: z.ZodOptional<z.ZodEnum<{
+      skipped: "skipped";
       captured: "captured";
       unavailable: "unavailable";
-      skipped: "skipped";
     }>>;
     lessonSummary: z.ZodOptional<z.ZodString>;
     observedAt: z.ZodString;
@@ -4138,8 +4276,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    code: "code";
     review: "review";
+    code: "code";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
@@ -4217,8 +4355,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   interiorCycle: z.ZodOptional<z.ZodNumber>;
   observedAt: z.ZodString;
   purpose: z.ZodEnum<{
-    code: "code";
     review: "review";
+    code: "code";
   }>;
   slotResolution: z.ZodObject<{
     effort: z.ZodEnum<{
@@ -4287,8 +4425,8 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     interiorCycle: z.ZodOptional<z.ZodNumber>;
     observedAt: z.ZodString;
     purpose: z.ZodEnum<{
-      code: "code";
       review: "review";
+      code: "code";
     }>;
     slotResolution: z.ZodObject<{
       effort: z.ZodEnum<{
@@ -4360,7 +4498,7 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   exitCode: number | null;
   harness: string;
   observedAt: string;
-  purpose: "code" | "review";
+  purpose: "review" | "code";
   slotResolution: {
     effort: "high" | "low" | "medium" | "xhigh";
     engine: string;
@@ -4714,13 +4852,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "not-required" | "stale" | "blocked" | "current" | "missing";
+        status: "stale" | "not-required" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "not-required" | "stale" | "blocked" | "current" | "missing";
+        status: "stale" | "not-required" | "blocked" | "current" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;