@patronage/software-factory 1.0.0-alpha.34 → 1.0.0-alpha.35

package/dist/index.d.ts

@@ -17,8 +17,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -26,8 +26,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   integrationBranch: z.ZodOptional<z.ZodString>;
   schemaVersion: z.ZodLiteral<1>;
   topology: z.ZodEnum<{
-    "each-to-main": "each-to-main";
     flagged: "flagged";
+    "each-to-main": "each-to-main";
     stacked: "stacked";
     "each-to-epic": "each-to-epic";
   }>;
@@ -36,8 +36,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -46,8 +46,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -55,8 +55,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   integrationBranch: z.ZodOptional<z.ZodString>;
   schemaVersion: z.ZodLiteral<1>;
   topology: z.ZodEnum<{
-    "each-to-main": "each-to-main";
     flagged: "flagged";
+    "each-to-main": "each-to-main";
     stacked: "stacked";
     "each-to-epic": "each-to-epic";
   }>;
@@ -65,8 +65,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -151,8 +151,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -195,8 +195,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -1303,6 +1303,212 @@ interface FactoryAppAccessDependencies {
  */
 type ResolvedPrVerifyMode = "docs-only" | "trivial" | "full";
 //#endregion
+//#region src/pr-verify-proof-contract.d.ts
+/**
+ * The pr:verify proof versions a reader accepts: the current one only (#920
+ * item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
+ * is per-candidate and short-lived — it is rewritten on every head — so no
+ * stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
+ * applies: one current contract, no compat reader. A consumer on an older
+ * factory must adopt this release before HQ ingests its pr:verify proofs.
+ */
+declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [4];
+type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
+interface PrVerifyCommandResult {
+  command: string;
+  description: string;
+  /**
+   * Epic #550 wave 3 (#430): the profile's declared impact target for this
+   * command, recorded from v4 on. It is the proof's own command→target
+   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
+   * for the same command, so a withholding cannot point at whichever released
+   * target happens to be convenient. Absent for a command the profile does
+   * not scope.
+   */
+  impactTarget?: string;
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
+}
+/**
+ * One failing test a verification command reported (#1035).
+ *
+ * The proof keeps the failing test's IDENTITY and its failure CLASS, and
+ * nothing else. That is enough to decide retry-or-fix — a `timeout` under
+ * machine load is a flake, an `assertion` is a real break — without rerunning
+ * the aggregate to read a title off the console.
+ *
+ * It deliberately keeps no raw output tail and no error message body. This
+ * payload is transmitted to HQ ingest, and arbitrary command output can carry
+ * secrets (an echoed environment, a connection string inside a stack frame). A
+ * file path, a test title, and a closed `kind` enum cannot. The cost is the
+ * assertion diff and the stack frames: they help you FIX a failure, and the
+ * operator still reads them from the run's own console output.
+ */
+interface PrVerifyTestFailure {
+  /** The test file the reporter named, as the reporter wrote it. */
+  file: string;
+  /**
+   * The failure class. `timeout` is the test-timeout error vitest raises at
+   * its own ceiling; `assertion` is a failed expectation; `error` is every
+   * other thrown failure.
+   */
+  kind: "assertion" | "error" | "timeout";
+  /** The full test title, suite names included, as the reporter wrote it. */
+  title: string;
+}
+interface PrVerifyExecutedCommand {
+  command: string;
+  counts?: {
+    testFiles?: number;
+    tests?: number;
+  };
+  durationMs: number;
+  exitCode: number;
+  /**
+   * The failing tests this command reported (#1035). Present only when the
+   * command produced parseable failures, so a passing command's record is
+   * byte-identical to the one it wrote before this field existed.
+   */
+  failures?: PrVerifyTestFailure[];
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
+}
+/**
+ * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
+ * candidate cannot reach, so the battery did not run it.
+ *
+ * The completeness invariant lives in the pairing: `verificationCommands`
+ * records every command the resolved mode selected, `executedCommands` records
+ * what ran, and this list records the rest WITH the stamp's own basis. A
+ * withheld stack is therefore never silently absent from the proof — it is
+ * present, named, and explained.
+ */
+interface PrVerifyNotRequiredCommand {
+  basis: string;
+  impactTarget: string;
+  name: string;
+}
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
+}
+interface PrVerifyProof {
+  schemaVersion: PrVerifySchemaVersion;
+  authoringSession: string;
+  base: string;
+  /**
+   * The commit `base` resolved to when this proof was written (#1132): the
+   * live pull request base tip, or the freshly fetched ref. Optional and
+   * additive; a proof written before it existed parses unchanged.
+   */
+  baseSha?: string;
+  baselineFullProofs?: {
+    base: string;
+    changedFiles: string[];
+    headSha: string;
+    profilePath: string;
+    projectKey: string;
+    repository: string;
+  }[];
+  catchUpRecognition?: CatchUpRecognition;
+  changedFiles: string[];
+  classification: DiffClassification;
+  classificationReasons: string[];
+  command: "patronage-factory pr:verify";
+  durationMs: number;
+  endedAt: string;
+  executedCommands?: PrVerifyExecutedCommand[];
+  headSha: string;
+  impactStamp?: ImpactStamp;
+  mode: ResolvedPrVerifyMode;
+  mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
+  notRequiredCommands?: PrVerifyNotRequiredCommand[];
+  outcome?: "aborted" | "passed";
+  patchId?: string;
+  /**
+   * The review policy identity this verification run resolved (#922 Slice B).
+   *
+   * Verification demands no review mode of its own. It records the identity so
+   * `pr:ready` can see whether the stage that produced this proof judged the
+   * candidate under the same policy readiness resolves. Optional, and normally
+   * `unresolved` on the first run of a branch: a candidate is verified before
+   * it has a pull request, and there is no authority to read without one.
+   */
+  policyResolution?: PolicyResolution;
+  profilePath: string;
+  projectKey: string;
+  repository: string;
+  startedAt: string;
+  verificationCommands: PrVerifyCommandResult[];
+}
+type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
+declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
+//#endregion
+//#region src/pr-verify-check-payload.d.ts
+/**
+ * Machine-readable binding carried on the `patronage-factory/pr-verify` check
+ * run (#247), alongside the human-readable prose summary.
+ *
+ * It records *what was verified*, for the head SHA it was written for. It
+ * grants nothing and gates nothing on its own: a consumer still has to verify
+ * the producing App, the conclusion, and its own freshness rule. The payload
+ * is a fenced JSON document in `output.text`.
+ */
+declare const PR_VERIFY_CHECK_PAYLOAD_KIND: "pr-verify-proof-binding";
+declare const PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION = 1;
+/**
+ * `unknown` covers a proof written by a schema version that did not record a
+ * classification. A consumer must treat it as "not stated", never as trivial.
+ */
+type PrVerifyPayloadClassification = DiffClassification | "unknown";
+interface PrVerifyCheckPayload {
+  /**
+   * Factory diff classification. Deliberately distinct from `mode`: the
+   * workflow path filter and the factory classifier use different rules, so a
+   * consumer must be able to see both.
+   */
+  classification: PrVerifyPayloadClassification;
+  /** Names of the verification commands that actually ran, in run order. */
+  executedCommands: string[];
+  /** The commit this verification describes. Binding is by tree, not patch. */
+  headSha: string;
+  /**
+   * The proof's own identity-bound impact stamp. Kept opaque here: the hosted
+   * proof-reuse gate validates the complete release tuple before subtracting
+   * any command, and malformed data must remain visible to that fail-closed
+   * reader rather than being normalized away during publication.
+   */
+  impactStamp?: unknown;
+  kind: typeof PR_VERIFY_CHECK_PAYLOAD_KIND;
+  /**
+   * Resolved verification mode. `docs-only` and `trivial` run reduced command
+   * suites and publish the same successful check run as `full`, so this field
+   * is what keeps them from being confusable after the fact.
+   */
+  mode: ResolvedPrVerifyMode;
+  /** Commands the proof withheld, including their claimed target and prose basis. */
+  notRequiredCommands?: unknown;
+  outcome: "aborted" | "passed";
+  /** Stable patch id, when the proof recorded one. Informational only. */
+  patchId?: string;
+  /** `schemaVersion` of the local pr:verify proof this was rendered from. */
+  proofSchemaVersion: number;
+  /** `<owner>/<name>` the proof was produced for. */
+  repository?: string;
+  /** Version of *this* payload shape. */
+  schemaVersion: typeof PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION;
+  /** The proof's command-to-impact-target bindings used to validate releases. */
+  verificationCommands?: unknown;
+  /** Original validated proof. Absence requires normal verification on a fresh runner. */
+  verificationProof?: PrVerifyProof;
+}
+//#endregion
 //#region src/pr-verify-status.d.ts
 type CommitStatusState = "failure" | "pending" | "success";
 interface PostCommitStatusInput {
@@ -1408,6 +1614,42 @@ interface CheckRunDependencies extends FactoryAppAccessDependencies {
 declare function ensureFactoryCheckRunPublished(input: PublishFactoryCheckInput, dependencies?: CheckRunDependencies & {
   onDiagnostic?: (message: string) => void;
 }): Promise<boolean>;
+type GhJsonRunner = <T>(args: string[]) => T;
+interface FactoryCheckRunProducer {
+  identity: string;
+  mode: "app";
+}
+interface PrVerifyProofBinding {
+  completedAtMs: number;
+  conclusion: string;
+  payload: PrVerifyCheckPayload;
+  producer: FactoryCheckRunProducer;
+}
+/**
+ * Read the machine-readable `pr:verify` binding for one commit (#247).
+ *
+ * Deliberately narrow: it reads check runs only, and only those whose `app`
+ * identity matches the configured factory App. It never consults commit
+ * statuses. `patronage-factory/pr-verify` is postable as a commit status by any
+ * token with write access, so that surface stays a human-readable mirror and
+ * can never satisfy a consumer that wants proof. Absent, foreign, or
+ * unparseable ⇒ `undefined` (fail closed).
+ */
+declare function fetchPrVerifyProofBinding({
+  expectedAppId,
+  githubApp,
+  owner,
+  repo,
+  sha,
+  runJson
+}: {
+  /** Overrides the configured App id — CI has no user config (#247 part 3). */expectedAppId?: string;
+  githubApp?: GithubAppConfig;
+  owner: string;
+  repo: string;
+  sha: string;
+  runJson?: GhJsonRunner;
+}): PrVerifyProofBinding | undefined;
 //#endregion
 //#region src/merge-freeze.d.ts
 declare const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
@@ -1479,18 +1721,30 @@ interface RunningMergeFreezeWitness {
   /** The running `patronage-factory/merge-freeze` check-run id. */
   runId: number;
 }
+/** A push workflow run's status while it still owes a generation. */
+type PendingWorkflowRunStatus = "in_progress" | "pending" | "queued" | "requested" | "waiting";
 /**
  * The evidence that a generation is settling because it is still owed (#521).
+ *
+ * The witness is the freeze-writing workflow's push run on the tip, identified
+ * through lineage (#1276): the immediate parent's settled generation records
+ * the workflow run that wrote it, that run names its workflow, and the same
+ * workflow's pending push run on the tip owes the tip's generation. It is the
+ * workflow run rather than the `verify` job's check run because GitHub creates
+ * a job's check run only when the job is dispatched, which for the `verify`
+ * summary job is near the end of the push Verify.
  */
 interface AwaitedMergeFreezeWitness {
   /** The base tip whose generation is awaited. */
   headSha: string;
   /** The immediate parent whose settled generation proves the writer runs. */
   parentSha: string;
-  /** The source-pinned hosted verify run that owes the generation. */
-  verifyRunId: number;
+  /** The workflow whose run wrote the parent's settled generation. */
+  workflowId: number;
+  /** That workflow's push run on the tip, which owes the generation. */
+  workflowRunId: number;
   /** That run's status. A completed run owes nothing, so it is not settling. */
-  verifyStatus: "in_progress" | "queued";
+  workflowRunStatus: PendingWorkflowRunStatus;
 }
 /**
  * The two settling phases, each with the witness that proves it (#890).
@@ -1537,6 +1791,14 @@ interface GitHubCheckRunMergeFreezeApi {
     name: string;
   }) => unknown;
   parent?: (input: MergeFreezeStoreInput) => unknown;
+  /** One GitHub Actions workflow run, by id (`headSha` is not consulted). */
+  workflowRun?: (input: MergeFreezeStoreInput & {
+    runId: number;
+  }) => unknown;
+  /** A workflow's push runs on `headSha`, as `{ workflow_runs }`. */
+  workflowRuns?: (input: MergeFreezeStoreInput & {
+    workflowId: number;
+  }) => unknown;
 }
 declare function createGitHubCheckRunMergeFreezeStore(api: GitHubCheckRunMergeFreezeApi): MergeFreezeAuthority;
 //#endregion
@@ -1888,153 +2150,6 @@ interface UpsertFactoryPrStatusCommentResult {
   url: string;
 }
 declare function upsertFactoryPrStatusComment(input: UpsertFactoryPrStatusCommentInput, dependencies?: UpsertFactoryPrStatusCommentDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
-//#endregion
-//#region src/pr-verify-proof-contract.d.ts
-/**
- * The pr:verify proof versions a reader accepts: the current one only (#920
- * item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
- * is per-candidate and short-lived — it is rewritten on every head — so no
- * stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
- * applies: one current contract, no compat reader. A consumer on an older
- * factory must adopt this release before HQ ingests its pr:verify proofs.
- */
-declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [4];
-type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
-interface PrVerifyCommandResult {
-  command: string;
-  description: string;
-  /**
-   * Epic #550 wave 3 (#430): the profile's declared impact target for this
-   * command, recorded from v4 on. It is the proof's own command→target
-   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
-   * for the same command, so a withholding cannot point at whichever released
-   * target happens to be convenient. Absent for a command the profile does
-   * not scope.
-   */
-  impactTarget?: string;
-  name: string;
-  scope: "docs-only" | "trivial" | "full";
-}
-/**
- * One failing test a verification command reported (#1035).
- *
- * The proof keeps the failing test's IDENTITY and its failure CLASS, and
- * nothing else. That is enough to decide retry-or-fix — a `timeout` under
- * machine load is a flake, an `assertion` is a real break — without rerunning
- * the aggregate to read a title off the console.
- *
- * It deliberately keeps no raw output tail and no error message body. This
- * payload is transmitted to HQ ingest, and arbitrary command output can carry
- * secrets (an echoed environment, a connection string inside a stack frame). A
- * file path, a test title, and a closed `kind` enum cannot. The cost is the
- * assertion diff and the stack frames: they help you FIX a failure, and the
- * operator still reads them from the run's own console output.
- */
-interface PrVerifyTestFailure {
-  /** The test file the reporter named, as the reporter wrote it. */
-  file: string;
-  /**
-   * The failure class. `timeout` is the test-timeout error vitest raises at
-   * its own ceiling; `assertion` is a failed expectation; `error` is every
-   * other thrown failure.
-   */
-  kind: "assertion" | "error" | "timeout";
-  /** The full test title, suite names included, as the reporter wrote it. */
-  title: string;
-}
-interface PrVerifyExecutedCommand {
-  command: string;
-  counts?: {
-    testFiles?: number;
-    tests?: number;
-  };
-  durationMs: number;
-  exitCode: number;
-  /**
-   * The failing tests this command reported (#1035). Present only when the
-   * command produced parseable failures, so a passing command's record is
-   * byte-identical to the one it wrote before this field existed.
-   */
-  failures?: PrVerifyTestFailure[];
-  name: string;
-  scope: "docs-only" | "trivial" | "full";
-}
-/**
- * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
- * candidate cannot reach, so the battery did not run it.
- *
- * The completeness invariant lives in the pairing: `verificationCommands`
- * records every command the resolved mode selected, `executedCommands` records
- * what ran, and this list records the rest WITH the stamp's own basis. A
- * withheld stack is therefore never silently absent from the proof — it is
- * present, named, and explained.
- */
-interface PrVerifyNotRequiredCommand {
-  basis: string;
-  impactTarget: string;
-  name: string;
-}
-/**
- * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
- * why. Bound to the proof's stamp identity — refused when the proof records no
- * stamp. The factory does not write this list; consumers do.
- */
-interface PrVerifyNotDemandedRecord {
-  basis: string;
-  name: string;
-}
-interface PrVerifyProof {
-  schemaVersion: PrVerifySchemaVersion;
-  authoringSession: string;
-  base: string;
-  /**
-   * The commit `base` resolved to when this proof was written (#1132): the
-   * live pull request base tip, or the freshly fetched ref. Optional and
-   * additive; a proof written before it existed parses unchanged.
-   */
-  baseSha?: string;
-  baselineFullProofs?: {
-    base: string;
-    changedFiles: string[];
-    headSha: string;
-    profilePath: string;
-    projectKey: string;
-    repository: string;
-  }[];
-  catchUpRecognition?: CatchUpRecognition;
-  changedFiles: string[];
-  classification: DiffClassification;
-  classificationReasons: string[];
-  command: "patronage-factory pr:verify";
-  durationMs: number;
-  endedAt: string;
-  executedCommands?: PrVerifyExecutedCommand[];
-  headSha: string;
-  impactStamp?: ImpactStamp;
-  mode: ResolvedPrVerifyMode;
-  mergeBaseSha?: string;
-  notDemandedRecords?: PrVerifyNotDemandedRecord[];
-  notRequiredCommands?: PrVerifyNotRequiredCommand[];
-  outcome?: "aborted" | "passed";
-  patchId?: string;
-  /**
-   * The review policy identity this verification run resolved (#922 Slice B).
-   *
-   * Verification demands no review mode of its own. It records the identity so
-   * `pr:ready` can see whether the stage that produced this proof judged the
-   * candidate under the same policy readiness resolves. Optional, and normally
-   * `unresolved` on the first run of a branch: a candidate is verified before
-   * it has a pull request, and there is no authority to read without one.
-   */
-  policyResolution?: PolicyResolution;
-  profilePath: string;
-  projectKey: string;
-  repository: string;
-  startedAt: string;
-  verificationCommands: PrVerifyCommandResult[];
-}
-type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
-declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
 declare namespace verification_proof_d_exports {
   export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, PrVerifyTestFailure, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedCatchUpRecognition, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
 }
@@ -2688,8 +2803,8 @@ declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2715,8 +2830,8 @@ declare const evidenceEnvelopeSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2936,8 +3051,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     wave: z.ZodString;
   }, z.core.$strip>>;
   demandedRung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   epicIssue: z.ZodNumber;
@@ -2952,8 +3067,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     commentUrl: z.ZodOptional<z.ZodString>;
     producer: z.ZodString;
     rung: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
     sessionId: z.ZodOptional<z.ZodString>;
@@ -3264,6 +3379,8 @@ interface PrVerifyArgs extends LoadProjectProfileInput {
   mode: PrVerifyMode;
   output?: string;
   requireKnownAuthoringSession?: boolean;
+  /** Recover the original proof from the accepted exact-head App binding. */
+  reuseAccepted?: boolean;
 }
 interface PrVerifyGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
@@ -3282,6 +3399,7 @@ interface PrVerifyGitDependencies {
   stablePatchId: (cwd: string, base: string) => string;
 }
 interface PrVerifyDependencies {
+  fetchVerifyBinding?: typeof fetchPrVerifyProofBinding;
   /**
    * The authoritative base-policy reader (#922). Injectable for the same
    * reason `pr:ready` injects it: an unstated authority must be a refusal a
@@ -4177,18 +4295,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
   }, z.core.$strict>;
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
-    oracle: "oracle";
     review: "review";
     delegate: "delegate";
+    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -4256,18 +4374,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
   }, z.core.$strict>;
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
-    oracle: "oracle";
     review: "review";
     delegate: "delegate";
+    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -4326,18 +4444,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       }>;
       model: z.ZodString;
       tier: z.ZodEnum<{
-        oracle: "oracle";
         review: "review";
         delegate: "delegate";
+        oracle: "oracle";
         workhorse: "workhorse";
         scout: "scout";
       }>;
     }, z.core.$strict>;
     startedAt: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -4386,11 +4504,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
-    tier: "oracle" | "review" | "delegate" | "workhorse" | "scout";
+    tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
     fallbackTier?: "delegate" | undefined;
   };
   startedAt: string;
-  tier: "oracle" | "review" | "delegate" | "workhorse" | "scout";
+  tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
   tokenUsage: {
     source: "cursor-csv" | "codex-json" | "cursor-json" | "claude-json";
     status: "available";