@patronage/software-factory 1.0.0-alpha.34 → 1.0.0-alpha.36

package/dist/index.d.ts

@@ -2,6 +2,7 @@ import { Command } from "commander";
 import { z } from "zod";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { PreviewProofRegistration } from "@patronage/factory-ci";
+import { JsonValue, Questions, SystemOneRequest, choice, noul, score } from "@typesafe-ai/sdk";
 
 //#region src/review-rungs.d.ts
 declare const EVIDENCE_REVIEW_RUNGS: readonly ["independent-model", "oracle", "human"];
@@ -17,8 +18,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -26,8 +27,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
   integrationBranch: z.ZodOptional<z.ZodString>;
   schemaVersion: z.ZodLiteral<1>;
   topology: z.ZodEnum<{
-    "each-to-main": "each-to-main";
     flagged: "flagged";
+    "each-to-main": "each-to-main";
     stacked: "stacked";
     "each-to-epic": "each-to-epic";
   }>;
@@ -36,8 +37,8 @@ declare const boundaryManifestBaseSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -46,8 +47,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   boundary: z.ZodString;
   closeout: z.ZodOptional<z.ZodObject<{
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -55,8 +56,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
   integrationBranch: z.ZodOptional<z.ZodString>;
   schemaVersion: z.ZodLiteral<1>;
   topology: z.ZodEnum<{
-    "each-to-main": "each-to-main";
     flagged: "flagged";
+    "each-to-main": "each-to-main";
     stacked: "stacked";
     "each-to-epic": "each-to-epic";
   }>;
@@ -65,8 +66,8 @@ declare const boundaryManifestSchema: z.ZodObject<{
     issues: z.ZodArray<z.ZodNumber>;
     name: z.ZodString;
     review: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
   }, z.core.$loose>>;
@@ -151,8 +152,8 @@ declare const boundaryReviewProofBaseSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -195,8 +196,8 @@ declare const boundaryReviewProofSchema: z.ZodObject<{
   }>;
   producer: z.ZodString;
   rung: z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>;
   schemaVersion: z.ZodLiteral<1>;
@@ -1303,6 +1304,212 @@ interface FactoryAppAccessDependencies {
  */
 type ResolvedPrVerifyMode = "docs-only" | "trivial" | "full";
 //#endregion
+//#region src/pr-verify-proof-contract.d.ts
+/**
+ * The pr:verify proof versions a reader accepts: the current one only (#920
+ * item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
+ * is per-candidate and short-lived — it is rewritten on every head — so no
+ * stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
+ * applies: one current contract, no compat reader. A consumer on an older
+ * factory must adopt this release before HQ ingests its pr:verify proofs.
+ */
+declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [4];
+type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
+interface PrVerifyCommandResult {
+  command: string;
+  description: string;
+  /**
+   * Epic #550 wave 3 (#430): the profile's declared impact target for this
+   * command, recorded from v4 on. It is the proof's own command→target
+   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
+   * for the same command, so a withholding cannot point at whichever released
+   * target happens to be convenient. Absent for a command the profile does
+   * not scope.
+   */
+  impactTarget?: string;
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
+}
+/**
+ * One failing test a verification command reported (#1035).
+ *
+ * The proof keeps the failing test's IDENTITY and its failure CLASS, and
+ * nothing else. That is enough to decide retry-or-fix — a `timeout` under
+ * machine load is a flake, an `assertion` is a real break — without rerunning
+ * the aggregate to read a title off the console.
+ *
+ * It deliberately keeps no raw output tail and no error message body. This
+ * payload is transmitted to HQ ingest, and arbitrary command output can carry
+ * secrets (an echoed environment, a connection string inside a stack frame). A
+ * file path, a test title, and a closed `kind` enum cannot. The cost is the
+ * assertion diff and the stack frames: they help you FIX a failure, and the
+ * operator still reads them from the run's own console output.
+ */
+interface PrVerifyTestFailure {
+  /** The test file the reporter named, as the reporter wrote it. */
+  file: string;
+  /**
+   * The failure class. `timeout` is the test-timeout error vitest raises at
+   * its own ceiling; `assertion` is a failed expectation; `error` is every
+   * other thrown failure.
+   */
+  kind: "assertion" | "error" | "timeout";
+  /** The full test title, suite names included, as the reporter wrote it. */
+  title: string;
+}
+interface PrVerifyExecutedCommand {
+  command: string;
+  counts?: {
+    testFiles?: number;
+    tests?: number;
+  };
+  durationMs: number;
+  exitCode: number;
+  /**
+   * The failing tests this command reported (#1035). Present only when the
+   * command produced parseable failures, so a passing command's record is
+   * byte-identical to the one it wrote before this field existed.
+   */
+  failures?: PrVerifyTestFailure[];
+  name: string;
+  scope: "docs-only" | "trivial" | "full";
+}
+/**
+ * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
+ * candidate cannot reach, so the battery did not run it.
+ *
+ * The completeness invariant lives in the pairing: `verificationCommands`
+ * records every command the resolved mode selected, `executedCommands` records
+ * what ran, and this list records the rest WITH the stamp's own basis. A
+ * withheld stack is therefore never silently absent from the proof — it is
+ * present, named, and explained.
+ */
+interface PrVerifyNotRequiredCommand {
+  basis: string;
+  impactTarget: string;
+  name: string;
+}
+/**
+ * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
+ * why. Bound to the proof's stamp identity — refused when the proof records no
+ * stamp. The factory does not write this list; consumers do.
+ */
+interface PrVerifyNotDemandedRecord {
+  basis: string;
+  name: string;
+}
+interface PrVerifyProof {
+  schemaVersion: PrVerifySchemaVersion;
+  authoringSession: string;
+  base: string;
+  /**
+   * The commit `base` resolved to when this proof was written (#1132): the
+   * live pull request base tip, or the freshly fetched ref. Optional and
+   * additive; a proof written before it existed parses unchanged.
+   */
+  baseSha?: string;
+  baselineFullProofs?: {
+    base: string;
+    changedFiles: string[];
+    headSha: string;
+    profilePath: string;
+    projectKey: string;
+    repository: string;
+  }[];
+  catchUpRecognition?: CatchUpRecognition;
+  changedFiles: string[];
+  classification: DiffClassification;
+  classificationReasons: string[];
+  command: "patronage-factory pr:verify";
+  durationMs: number;
+  endedAt: string;
+  executedCommands?: PrVerifyExecutedCommand[];
+  headSha: string;
+  impactStamp?: ImpactStamp;
+  mode: ResolvedPrVerifyMode;
+  mergeBaseSha?: string;
+  notDemandedRecords?: PrVerifyNotDemandedRecord[];
+  notRequiredCommands?: PrVerifyNotRequiredCommand[];
+  outcome?: "aborted" | "passed";
+  patchId?: string;
+  /**
+   * The review policy identity this verification run resolved (#922 Slice B).
+   *
+   * Verification demands no review mode of its own. It records the identity so
+   * `pr:ready` can see whether the stage that produced this proof judged the
+   * candidate under the same policy readiness resolves. Optional, and normally
+   * `unresolved` on the first run of a branch: a candidate is verified before
+   * it has a pull request, and there is no authority to read without one.
+   */
+  policyResolution?: PolicyResolution;
+  profilePath: string;
+  projectKey: string;
+  repository: string;
+  startedAt: string;
+  verificationCommands: PrVerifyCommandResult[];
+}
+type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
+declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
+//#endregion
+//#region src/pr-verify-check-payload.d.ts
+/**
+ * Machine-readable binding carried on the `patronage-factory/pr-verify` check
+ * run (#247), alongside the human-readable prose summary.
+ *
+ * It records *what was verified*, for the head SHA it was written for. It
+ * grants nothing and gates nothing on its own: a consumer still has to verify
+ * the producing App, the conclusion, and its own freshness rule. The payload
+ * is a fenced JSON document in `output.text`.
+ */
+declare const PR_VERIFY_CHECK_PAYLOAD_KIND: "pr-verify-proof-binding";
+declare const PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION = 1;
+/**
+ * `unknown` covers a proof written by a schema version that did not record a
+ * classification. A consumer must treat it as "not stated", never as trivial.
+ */
+type PrVerifyPayloadClassification = DiffClassification | "unknown";
+interface PrVerifyCheckPayload {
+  /**
+   * Factory diff classification. Deliberately distinct from `mode`: the
+   * workflow path filter and the factory classifier use different rules, so a
+   * consumer must be able to see both.
+   */
+  classification: PrVerifyPayloadClassification;
+  /** Names of the verification commands that actually ran, in run order. */
+  executedCommands: string[];
+  /** The commit this verification describes. Binding is by tree, not patch. */
+  headSha: string;
+  /**
+   * The proof's own identity-bound impact stamp. Kept opaque here: the hosted
+   * proof-reuse gate validates the complete release tuple before subtracting
+   * any command, and malformed data must remain visible to that fail-closed
+   * reader rather than being normalized away during publication.
+   */
+  impactStamp?: unknown;
+  kind: typeof PR_VERIFY_CHECK_PAYLOAD_KIND;
+  /**
+   * Resolved verification mode. `docs-only` and `trivial` run reduced command
+   * suites and publish the same successful check run as `full`, so this field
+   * is what keeps them from being confusable after the fact.
+   */
+  mode: ResolvedPrVerifyMode;
+  /** Commands the proof withheld, including their claimed target and prose basis. */
+  notRequiredCommands?: unknown;
+  outcome: "aborted" | "passed";
+  /** Stable patch id, when the proof recorded one. Informational only. */
+  patchId?: string;
+  /** `schemaVersion` of the local pr:verify proof this was rendered from. */
+  proofSchemaVersion: number;
+  /** `<owner>/<name>` the proof was produced for. */
+  repository?: string;
+  /** Version of *this* payload shape. */
+  schemaVersion: typeof PR_VERIFY_CHECK_PAYLOAD_SCHEMA_VERSION;
+  /** The proof's command-to-impact-target bindings used to validate releases. */
+  verificationCommands?: unknown;
+  /** Original validated proof. Absence requires normal verification on a fresh runner. */
+  verificationProof?: PrVerifyProof;
+}
+//#endregion
 //#region src/pr-verify-status.d.ts
 type CommitStatusState = "failure" | "pending" | "success";
 interface PostCommitStatusInput {
@@ -1408,6 +1615,42 @@ interface CheckRunDependencies extends FactoryAppAccessDependencies {
 declare function ensureFactoryCheckRunPublished(input: PublishFactoryCheckInput, dependencies?: CheckRunDependencies & {
   onDiagnostic?: (message: string) => void;
 }): Promise<boolean>;
+type GhJsonRunner = <T>(args: string[]) => T;
+interface FactoryCheckRunProducer {
+  identity: string;
+  mode: "app";
+}
+interface PrVerifyProofBinding {
+  completedAtMs: number;
+  conclusion: string;
+  payload: PrVerifyCheckPayload;
+  producer: FactoryCheckRunProducer;
+}
+/**
+ * Read the machine-readable `pr:verify` binding for one commit (#247).
+ *
+ * Deliberately narrow: it reads check runs only, and only those whose `app`
+ * identity matches the configured factory App. It never consults commit
+ * statuses. `patronage-factory/pr-verify` is postable as a commit status by any
+ * token with write access, so that surface stays a human-readable mirror and
+ * can never satisfy a consumer that wants proof. Absent, foreign, or
+ * unparseable ⇒ `undefined` (fail closed).
+ */
+declare function fetchPrVerifyProofBinding({
+  expectedAppId,
+  githubApp,
+  owner,
+  repo,
+  sha,
+  runJson
+}: {
+  /** Overrides the configured App id — CI has no user config (#247 part 3). */expectedAppId?: string;
+  githubApp?: GithubAppConfig;
+  owner: string;
+  repo: string;
+  sha: string;
+  runJson?: GhJsonRunner;
+}): PrVerifyProofBinding | undefined;
 //#endregion
 //#region src/merge-freeze.d.ts
 declare const MERGE_FREEZE_CHECK_NAME = "patronage-factory/merge-freeze";
@@ -1417,8 +1660,8 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   generationId: z.ZodNumber;
   headSha: z.ZodString;
   outcome: z.ZodEnum<{
-    active: "active";
     stale: "stale";
+    active: "active";
   }>;
   reason: z.ZodString;
   recordedAt: z.ZodISODateTime;
@@ -1426,9 +1669,9 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   verification: z.ZodOptional<z.ZodObject<{
     jobs: z.ZodRecord<z.ZodString, z.ZodEnum<{
       success: "success";
+      skipped: "skipped";
       failure: "failure";
       cancelled: "cancelled";
-      skipped: "skipped";
     }>>;
     runAttempt: z.ZodNumber;
     runId: z.ZodNumber;
@@ -1445,9 +1688,9 @@ declare const mergeFreezeStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   verification: z.ZodOptional<z.ZodObject<{
     jobs: z.ZodRecord<z.ZodString, z.ZodEnum<{
       success: "success";
+      skipped: "skipped";
       failure: "failure";
       cancelled: "cancelled";
-      skipped: "skipped";
     }>>;
     runAttempt: z.ZodNumber;
     runId: z.ZodNumber;
@@ -1479,18 +1722,30 @@ interface RunningMergeFreezeWitness {
   /** The running `patronage-factory/merge-freeze` check-run id. */
   runId: number;
 }
+/** A push workflow run's status while it still owes a generation. */
+type PendingWorkflowRunStatus = "in_progress" | "pending" | "queued" | "requested" | "waiting";
 /**
  * The evidence that a generation is settling because it is still owed (#521).
+ *
+ * The witness is the freeze-writing workflow's push run on the tip, identified
+ * through lineage (#1276): the immediate parent's settled generation records
+ * the workflow run that wrote it, that run names its workflow, and the same
+ * workflow's pending push run on the tip owes the tip's generation. It is the
+ * workflow run rather than the `verify` job's check run because GitHub creates
+ * a job's check run only when the job is dispatched, which for the `verify`
+ * summary job is near the end of the push Verify.
  */
 interface AwaitedMergeFreezeWitness {
   /** The base tip whose generation is awaited. */
   headSha: string;
   /** The immediate parent whose settled generation proves the writer runs. */
   parentSha: string;
-  /** The source-pinned hosted verify run that owes the generation. */
-  verifyRunId: number;
+  /** The workflow whose run wrote the parent's settled generation. */
+  workflowId: number;
+  /** That workflow's push run on the tip, which owes the generation. */
+  workflowRunId: number;
   /** That run's status. A completed run owes nothing, so it is not settling. */
-  verifyStatus: "in_progress" | "queued";
+  workflowRunStatus: PendingWorkflowRunStatus;
 }
 /**
  * The two settling phases, each with the witness that proves it (#890).
@@ -1537,6 +1792,14 @@ interface GitHubCheckRunMergeFreezeApi {
     name: string;
   }) => unknown;
   parent?: (input: MergeFreezeStoreInput) => unknown;
+  /** One GitHub Actions workflow run, by id (`headSha` is not consulted). */
+  workflowRun?: (input: MergeFreezeStoreInput & {
+    runId: number;
+  }) => unknown;
+  /** A workflow's push runs on `headSha`, as `{ workflow_runs }`. */
+  workflowRuns?: (input: MergeFreezeStoreInput & {
+    workflowId: number;
+  }) => unknown;
 }
 declare function createGitHubCheckRunMergeFreezeStore(api: GitHubCheckRunMergeFreezeApi): MergeFreezeAuthority;
 //#endregion
@@ -1686,10 +1949,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        stale: "stale";
         "not-required": "not-required";
         blocked: "blocked";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>;
@@ -1698,10 +1961,10 @@ declare const managedReadinessLedgerSchema: z.ZodObject<{
       reviewedHeadSha: z.ZodOptional<z.ZodString>;
       reviewedPatchId: z.ZodOptional<z.ZodString>;
       status: z.ZodEnum<{
-        stale: "stale";
         "not-required": "not-required";
         blocked: "blocked";
         current: "current";
+        stale: "stale";
         missing: "missing";
       }>;
     }, z.core.$strip>>;
@@ -1888,153 +2151,6 @@ interface UpsertFactoryPrStatusCommentResult {
   url: string;
 }
 declare function upsertFactoryPrStatusComment(input: UpsertFactoryPrStatusCommentInput, dependencies?: UpsertFactoryPrStatusCommentDependencies): Promise<UpsertFactoryPrStatusCommentResult>;
-//#endregion
-//#region src/pr-verify-proof-contract.d.ts
-/**
- * The pr:verify proof versions a reader accepts: the current one only (#920
- * item 1). #917 narrowed the pr:ready reader the same way. A pr:verify proof
- * is per-candidate and short-lived — it is rewritten on every head — so no
- * stored v1–v3 proof can outlive the release that drops it. Pre-1.0 posture
- * applies: one current contract, no compat reader. A consumer on an older
- * factory must adopt this release before HQ ingests its pr:verify proofs.
- */
-declare const SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS: readonly [4];
-type PrVerifySchemaVersion = (typeof SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS)[number];
-interface PrVerifyCommandResult {
-  command: string;
-  description: string;
-  /**
-   * Epic #550 wave 3 (#430): the profile's declared impact target for this
-   * command, recorded from v4 on. It is the proof's own command→target
-   * mapping: a `notRequiredCommands` entry must name the target recorded HERE
-   * for the same command, so a withholding cannot point at whichever released
-   * target happens to be convenient. Absent for a command the profile does
-   * not scope.
-   */
-  impactTarget?: string;
-  name: string;
-  scope: "docs-only" | "trivial" | "full";
-}
-/**
- * One failing test a verification command reported (#1035).
- *
- * The proof keeps the failing test's IDENTITY and its failure CLASS, and
- * nothing else. That is enough to decide retry-or-fix — a `timeout` under
- * machine load is a flake, an `assertion` is a real break — without rerunning
- * the aggregate to read a title off the console.
- *
- * It deliberately keeps no raw output tail and no error message body. This
- * payload is transmitted to HQ ingest, and arbitrary command output can carry
- * secrets (an echoed environment, a connection string inside a stack frame). A
- * file path, a test title, and a closed `kind` enum cannot. The cost is the
- * assertion diff and the stack frames: they help you FIX a failure, and the
- * operator still reads them from the run's own console output.
- */
-interface PrVerifyTestFailure {
-  /** The test file the reporter named, as the reporter wrote it. */
-  file: string;
-  /**
-   * The failure class. `timeout` is the test-timeout error vitest raises at
-   * its own ceiling; `assertion` is a failed expectation; `error` is every
-   * other thrown failure.
-   */
-  kind: "assertion" | "error" | "timeout";
-  /** The full test title, suite names included, as the reporter wrote it. */
-  title: string;
-}
-interface PrVerifyExecutedCommand {
-  command: string;
-  counts?: {
-    testFiles?: number;
-    tests?: number;
-  };
-  durationMs: number;
-  exitCode: number;
-  /**
-   * The failing tests this command reported (#1035). Present only when the
-   * command produced parseable failures, so a passing command's record is
-   * byte-identical to the one it wrote before this field existed.
-   */
-  failures?: PrVerifyTestFailure[];
-  name: string;
-  scope: "docs-only" | "trivial" | "full";
-}
-/**
- * Epic #550 wave 3 (#430): a verification command the impact stamp proved this
- * candidate cannot reach, so the battery did not run it.
- *
- * The completeness invariant lives in the pairing: `verificationCommands`
- * records every command the resolved mode selected, `executedCommands` records
- * what ran, and this list records the rest WITH the stamp's own basis. A
- * withheld stack is therefore never silently absent from the proof — it is
- * present, named, and explained.
- */
-interface PrVerifyNotRequiredCommand {
-  basis: string;
-  impactTarget: string;
-  name: string;
-}
-/**
- * Epic #758 (#762): a consumer package a stamp-scoped selection skipped, and
- * why. Bound to the proof's stamp identity — refused when the proof records no
- * stamp. The factory does not write this list; consumers do.
- */
-interface PrVerifyNotDemandedRecord {
-  basis: string;
-  name: string;
-}
-interface PrVerifyProof {
-  schemaVersion: PrVerifySchemaVersion;
-  authoringSession: string;
-  base: string;
-  /**
-   * The commit `base` resolved to when this proof was written (#1132): the
-   * live pull request base tip, or the freshly fetched ref. Optional and
-   * additive; a proof written before it existed parses unchanged.
-   */
-  baseSha?: string;
-  baselineFullProofs?: {
-    base: string;
-    changedFiles: string[];
-    headSha: string;
-    profilePath: string;
-    projectKey: string;
-    repository: string;
-  }[];
-  catchUpRecognition?: CatchUpRecognition;
-  changedFiles: string[];
-  classification: DiffClassification;
-  classificationReasons: string[];
-  command: "patronage-factory pr:verify";
-  durationMs: number;
-  endedAt: string;
-  executedCommands?: PrVerifyExecutedCommand[];
-  headSha: string;
-  impactStamp?: ImpactStamp;
-  mode: ResolvedPrVerifyMode;
-  mergeBaseSha?: string;
-  notDemandedRecords?: PrVerifyNotDemandedRecord[];
-  notRequiredCommands?: PrVerifyNotRequiredCommand[];
-  outcome?: "aborted" | "passed";
-  patchId?: string;
-  /**
-   * The review policy identity this verification run resolved (#922 Slice B).
-   *
-   * Verification demands no review mode of its own. It records the identity so
-   * `pr:ready` can see whether the stage that produced this proof judged the
-   * candidate under the same policy readiness resolves. Optional, and normally
-   * `unresolved` on the first run of a branch: a candidate is verified before
-   * it has a pull request, and there is no authority to read without one.
-   */
-  policyResolution?: PolicyResolution;
-  profilePath: string;
-  projectKey: string;
-  repository: string;
-  startedAt: string;
-  verificationCommands: PrVerifyCommandResult[];
-}
-type PrVerifyBaselineFullProof = NonNullable<PrVerifyProof["baselineFullProofs"]>[number];
-declare function validatePrVerifyProof(value: unknown): PrVerifyProof;
 declare namespace verification_proof_d_exports {
   export { PrVerifyBaselineFullProof, PrVerifyCommandResult, PrVerifyExecutedCommand, PrVerifyNotDemandedRecord, PrVerifyNotRequiredCommand, PrVerifyProof, PrVerifySchemaVersion, PrVerifyTestFailure, ResolvedPrVerifyMode, SUPPORTED_PR_VERIFY_SCHEMA_VERSIONS, VerificationHeadShas, VerificationProofState, VerifiedHeadShas, prVerifyFullHeadShasForDiff, prVerifyProofHeadShas, readPrVerifyProof, resolveVerifyProofApplicability, trustedCatchUpRecognition, trustedImpactStamp, validatePrVerifyProof, verificationProofApplicabilityFor, verificationProofBlockingReason, verificationProofForReadiness, verificationProofStateFor, verifyProofIdentityMatches, verifyProofPassed };
 }
@@ -2688,8 +2804,8 @@ declare const evidenceEnvelopeBaseSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2715,8 +2831,8 @@ declare const evidenceEnvelopeSchema: z.ZodObject<{
   producer: z.ZodString;
   requestId: z.ZodOptional<z.ZodString>;
   rung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   schemaVersion: z.ZodLiteral<1>;
@@ -2818,10 +2934,10 @@ declare const loadEvidenceEnvelopes: (cwd: string) => LoadedEvidenceEnvelope[];
 //#region src/review-proof-applicability.d.ts
 declare const REVIEW_STATUS_VALUES: readonly ["not-required", "current", "stale", "missing", "blocked"];
 declare const reviewStatusSchema: z.ZodEnum<{
-  stale: "stale";
   "not-required": "not-required";
   blocked: "blocked";
   current: "current";
+  stale: "stale";
   missing: "missing";
 }>;
 type ReviewStatus = z.infer<typeof reviewStatusSchema>;
@@ -2936,8 +3052,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     wave: z.ZodString;
   }, z.core.$strip>>;
   demandedRung: z.ZodOptional<z.ZodEnum<{
-    "independent-model": "independent-model";
     oracle: "oracle";
+    "independent-model": "independent-model";
     human: "human";
   }>>;
   epicIssue: z.ZodNumber;
@@ -2952,8 +3068,8 @@ declare const boundaryCheckProofSchema: z.ZodObject<{
     commentUrl: z.ZodOptional<z.ZodString>;
     producer: z.ZodString;
     rung: z.ZodEnum<{
-      "independent-model": "independent-model";
       oracle: "oracle";
+      "independent-model": "independent-model";
       human: "human";
     }>;
     sessionId: z.ZodOptional<z.ZodString>;
@@ -3264,6 +3380,8 @@ interface PrVerifyArgs extends LoadProjectProfileInput {
   mode: PrVerifyMode;
   output?: string;
   requireKnownAuthoringSession?: boolean;
+  /** Recover the original proof from the accepted exact-head App binding. */
+  reuseAccepted?: boolean;
 }
 interface PrVerifyGitDependencies {
   changedFiles: (cwd: string, base: string) => string[];
@@ -3282,6 +3400,7 @@ interface PrVerifyGitDependencies {
   stablePatchId: (cwd: string, base: string) => string;
 }
 interface PrVerifyDependencies {
+  fetchVerifyBinding?: typeof fetchPrVerifyProofBinding;
   /**
    * The authoritative base-policy reader (#922). Injectable for the same
    * reason `pr:ready` injects it: an unstated authority must be a refusal a
@@ -3597,18 +3716,18 @@ declare const LegacyWorkerCloseoutStatusTraceEventSchema: z.ZodObject<{
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
-    skipped: "skipped";
     unavailable: "unavailable";
     archived: "archived";
+    skipped: "skipped";
     "not-applicable": "not-applicable";
     pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
   lessonStatus: z.ZodOptional<z.ZodEnum<{
-    skipped: "skipped";
     captured: "captured";
     unavailable: "unavailable";
+    skipped: "skipped";
   }>>;
   lessonSummary: z.ZodOptional<z.ZodString>;
   typeVersion: z.ZodLiteral<2>;
@@ -3995,18 +4114,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   threadId: z.ZodOptional<z.ZodString>;
   workerId: z.ZodOptional<z.ZodString>;
   archiveStatus: z.ZodOptional<z.ZodEnum<{
-    skipped: "skipped";
     unavailable: "unavailable";
     archived: "archived";
+    skipped: "skipped";
     "not-applicable": "not-applicable";
     pending: "pending";
   }>>;
   closeoutReason: z.ZodOptional<z.ZodString>;
   eventType: z.ZodLiteral<"worker-closeout-lessons">;
   lessonStatus: z.ZodOptional<z.ZodEnum<{
-    skipped: "skipped";
     captured: "captured";
     unavailable: "unavailable";
+    skipped: "skipped";
   }>>;
   lessonSummary: z.ZodOptional<z.ZodString>;
   typeVersion: z.ZodLiteral<2>;
@@ -4036,17 +4155,17 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
   }, z.core.$strict>], "lessonStatus">;
   readonly 2: z.ZodObject<{
     archiveStatus: z.ZodOptional<z.ZodEnum<{
-      skipped: "skipped";
       unavailable: "unavailable";
       archived: "archived";
+      skipped: "skipped";
       "not-applicable": "not-applicable";
       pending: "pending";
     }>>;
     closeoutReason: z.ZodOptional<z.ZodString>;
     lessonStatus: z.ZodOptional<z.ZodEnum<{
-      skipped: "skipped";
       captured: "captured";
       unavailable: "unavailable";
+      skipped: "skipped";
     }>>;
     lessonSummary: z.ZodOptional<z.ZodString>;
     observedAt: z.ZodString;
@@ -4177,18 +4296,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
   }, z.core.$strict>;
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
-    oracle: "oracle";
     review: "review";
     delegate: "delegate";
+    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -4256,18 +4375,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
   }, z.core.$strict>;
   startedAt: z.ZodString;
   tier: z.ZodEnum<{
-    oracle: "oracle";
     review: "review";
     delegate: "delegate";
+    oracle: "oracle";
     workhorse: "workhorse";
     scout: "scout";
   }>;
@@ -4326,18 +4445,18 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
       }>;
       model: z.ZodString;
       tier: z.ZodEnum<{
-        oracle: "oracle";
         review: "review";
         delegate: "delegate";
+        oracle: "oracle";
         workhorse: "workhorse";
         scout: "scout";
       }>;
     }, z.core.$strict>;
     startedAt: z.ZodString;
     tier: z.ZodEnum<{
-      oracle: "oracle";
       review: "review";
       delegate: "delegate";
+      oracle: "oracle";
       workhorse: "workhorse";
       scout: "scout";
     }>;
@@ -4386,11 +4505,11 @@ declare const FACTORY_TRACE_EVENT_DEFINITIONS: readonly [DefinedTraceEvent<"revi
     engine: string;
     layerSource: "committedDefault" | "operatorSession" | "userConfig";
     model: string;
-    tier: "oracle" | "review" | "delegate" | "workhorse" | "scout";
+    tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
     fallbackTier?: "delegate" | undefined;
   };
   startedAt: string;
-  tier: "oracle" | "review" | "delegate" | "workhorse" | "scout";
+  tier: "review" | "delegate" | "oracle" | "workhorse" | "scout";
   tokenUsage: {
     source: "cursor-csv" | "codex-json" | "cursor-json" | "claude-json";
     status: "available";
@@ -4734,13 +4853,13 @@ declare const evaluateReadiness: (input: EvaluationInput) => {
     reviews: {
       correctness: {
         required: boolean;
-        status: "stale" | "not-required" | "blocked" | "current" | "missing";
+        status: "not-required" | "blocked" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       };
       security?: {
         required: boolean;
-        status: "stale" | "not-required" | "blocked" | "current" | "missing";
+        status: "not-required" | "blocked" | "current" | "stale" | "missing";
         reviewedHeadSha?: string | undefined;
         reviewedPatchId?: string | undefined;
       } | undefined;
@@ -5216,6 +5335,275 @@ declare function assertWorkerCheckoutAllowed({
   probe?: CheckoutDirsProbe;
 }): void;
 //#endregion
+//#region src/jev/schema.d.ts
+/** The request body this package sends. No `model` field, ever: HQ names it. */
+type JevRequestBody = Pick<SystemOneRequest, "state" | "questions">;
+/**
+ * One answer, discriminated exactly as Jev discriminates it.
+ *
+ * Every member is a *stripping* object: an unknown key inside one answer is
+ * dropped, not an error. Erroring would let a single surprising field sink a
+ * whole response, and keeping it would put an upstream-named field into a
+ * record. Dropping is the only behavior that is both safe and non-destructive.
+ */
+declare const jevAnswerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  noul: z.ZodNumber;
+  type: z.ZodLiteral<"noul">;
+}, z.core.$strip>, z.ZodObject<{
+  choice: z.ZodString;
+  confidence: z.ZodNumber;
+  probabilities: z.ZodRecord<z.ZodString, z.ZodNumber>;
+  type: z.ZodLiteral<"choice">;
+}, z.core.$strip>, z.ZodObject<{
+  confidence: z.ZodNumber;
+  probabilities: z.ZodRecord<z.ZodString, z.ZodNumber>;
+  score: z.ZodNumber;
+  type: z.ZodLiteral<"score">;
+}, z.core.$strip>], "type">;
+type JevAnswer = z.infer<typeof jevAnswerSchema>;
+interface JevUsage {
+  input_tokens?: number;
+  output_tokens?: number;
+}
+interface JevResponse {
+  answers: Record<string, JevAnswer>;
+  /** The model HQ ran, or `unknown` when what it returned is not an id. */
+  model: string;
+  usage?: JevUsage;
+}
+/** What a report says when HQ names its model in something other than an id. */
+declare const UNKNOWN_MODEL = "unknown";
+/**
+ * A question set keyed by the names its answers come back under. Re-stated as a
+ * value type so adapters can build one incrementally without importing the
+ * SDK.
+ */
+type JevQuestions = Questions;
+type JevJsonValue = JsonValue;
+//#endregion
+//#region src/jev/cache.d.ts
+/**
+ * The request-hash cache: the same request bytes against the same endpoint
+ * answer from disk instead of from HQ.
+ *
+ * The key is the endpoint plus the exact serialized request, and nothing else.
+ * That is the whole design: a changed snippet, a reworded question, a
+ * different reference file and a different HQ all move the bytes, so they all
+ * move the key. There is no key schema to keep in step with the request
+ * builder, and no way to grow one that forgets a field.
+ *
+ * It lives under `node_modules/.cache`, which is disposable by convention and
+ * already ignored everywhere — a Jev answer is a session diagnostic (ADR
+ * 0034), not a build input and not evidence.
+ *
+ * An entry that exists but cannot be used — unreadable, not JSON, not Jev's
+ * response shape — is an error, not a miss, and so is a write that fails. Only
+ * `ENOENT` means "nothing is stored". Repairing any of the others silently and
+ * calling HQ anyway would be a second behavior for one failure, and a paid
+ * one; the run names the entry and its cause, and the operator removes it.
+ */
+/** A cache entry that could not be used, or could not be written. */
+declare class JevCacheError extends Error {
+  readonly path: string;
+  constructor(entryPath: string, detail: string);
+}
+/** Where a repository's Jev answers are kept. */
+declare const defaultJevCacheDirectory: (cwd: string) => string;
+interface JevCache {
+  /** The entry key for these request bytes: endpoint plus the bytes, hashed. */
+  keyFor: (serialized: string) => string;
+  /** The stored answer, or `undefined` when nothing is stored. */
+  read: (serialized: string) => JevResponse | undefined;
+  write: (serialized: string, response: JevResponse) => void;
+}
+interface OpenJevCacheInput {
+  /** Defaults to `node_modules/.cache/patronage-jev` under `cwd`. */
+  directory?: string;
+  /** The HQ Jev endpoint these answers came from. Part of every key. */
+  endpoint: string;
+}
+/**
+ * Opens the cache, creating its directory now so a directory that cannot be
+ * written fails here — at the one place that names it — rather than midway
+ * through a run as an unexplained request failure.
+ */
+declare const openJevCache: ({
+  directory,
+  endpoint
+}: OpenJevCacheInput) => JevCache;
+//#endregion
+//#region src/jev/client.d.ts
+/** Sends one prepared packet and returns Jev's body, plus the model HQ ran. */
+type JevEvaluate = (serializedBody: string) => Promise<JevResponse>;
+/**
+ * Either a reachable HQ Jev route, or the one sentence saying why there is
+ * none. A run takes this union rather than a bare `evaluate`, so "there are no
+ * credentials" arrives at the caller in the same shape as "HQ refused": one
+ * typed unavailable result naming its cause, never a throw and never a
+ * silently skipped run.
+ */
+type JevGateway = {
+  evaluate: JevEvaluate;
+  endpoint: string;
+  status: "ready";
+} /** No call is possible. Every match is unavailable with this reason. */ | {
+  reason: string;
+  status: "unavailable";
+};
+/**
+ * An upstream refusal, carried with the code HQ passed through rather than
+ * flattened into prose. `max_tokens_exceeded` is the one a caller acts on: it
+ * means the packet was too large despite the local budget.
+ */
+declare class JevRequestError extends Error {
+  readonly code: string | undefined;
+  readonly httpStatus: number;
+  constructor(httpStatus: number, code: string | undefined, message: string);
+}
+interface ResolveJevGatewayInput {
+  env: NodeJS.ProcessEnv;
+  fetchImpl?: typeof fetch;
+}
+/**
+ * Resolves the gateway, or says why there isn't one. Every `unavailable`
+ * reason is an operator-facing sentence naming a remedy that applies to this
+ * command, and none of them can carry a credential: nothing here reads a
+ * resolved value into a message.
+ *
+ * The order is the policy. The origin is checked against HQ ingest's protocol
+ * rule and the operator's `hqAllowedOrigins` first, and only an authorized
+ * origin gets as far as reading credentials. An unauthorized origin never sees
+ * a request.
+ */
+declare const resolveJevGateway: ({
+  env,
+  fetchImpl
+}: ResolveJevGatewayInput) => Promise<JevGateway>;
+//#endregion
+//#region src/jev/request.d.ts
+interface JevMatch {
+  /**
+   * Stable across splitting. Question names must already namespace it, so
+   * moving a match into a later split never rewrites a question or an answer
+   * name.
+   */
+  key: string;
+  /** Answer-name-keyed questions about this match. */
+  questions: JevQuestions;
+  /** Match-local state, published at `matches.<key>` of the request. */
+  state: JevJsonValue;
+}
+interface JevFile {
+  matches: readonly JevMatch[];
+  /** Repository-relative path. Identity of the shared state, and sent with it. */
+  path: string;
+  /** State every match in this file is read against, sent once per request. */
+  shared: JevJsonValue;
+}
+interface JevRequest {
+  /** The parsed body, for a caller that records a request without sending it. */
+  body: JevRequestBody;
+  estimatedTokens: number;
+  /** SHA-256 of `serialized` — the exact bytes that would be sent. */
+  hash: string;
+  matchKeys: string[];
+  /** The file this request asks about. */
+  path: string;
+  /** The bytes to POST. Serialized once so the hash cannot drift from them. */
+  serialized: string;
+}
+interface JevUnavailableMatch {
+  key: string;
+  reason: string;
+}
+interface JevRequestPlan {
+  requests: JevRequest[];
+  unavailable: JevUnavailableMatch[];
+}
+interface BuildJevRequestsInput {
+  /** Per-request ceiling override, in tokens. Defaults to the budget above. */
+  budgetTokens?: number;
+  files: readonly JevFile[];
+}
+/**
+ * Turns files into the requests that will be sent, plus the matches that
+ * cannot be sent and why. Pure: it performs no I/O and decides nothing about
+ * transport.
+ */
+declare const buildJevRequests: ({
+  budgetTokens,
+  files
+}: BuildJevRequestsInput) => JevRequestPlan;
+//#endregion
+//#region src/jev/run.d.ts
+/**
+ * Sending a file's requests and recording exactly what happened.
+ *
+ * A Jev run is a session diagnostic (ADR 0034): it owns no gate and no demand,
+ * so a failed request is data, not a stop. One request failing never erases
+ * the answers a sibling request already returned, and every match that did not
+ * get an answer says why — including when the failure was that there was no
+ * gateway to call at all.
+ *
+ * Every failure has exactly one behavior: the affected matches become
+ * unavailable, named with their cause. Nothing is retried, nothing is
+ * truncated to fit, and no result is dropped to keep a run tidy.
+ */
+/** What one request did. Recorded whether it succeeded, failed, or was cached. */
+interface JevRequestRecord {
+  /** True when the answer came from the request-hash cache; no HQ call was made. */
+  cached: boolean;
+  elapsedMs: number;
+  /** Set when the request failed; the reason, in operator-facing prose. */
+  error?: string;
+  /** The upstream code, when HQ passed one through (`max_tokens_exceeded`). */
+  errorCode?: string;
+  estimatedTokens: number;
+  matchKeys: string[];
+  /** The model HQ reported actually running. Absent on a failed request. */
+  model?: string;
+  /** The file this request asked about. */
+  path: string;
+  /** SHA-256 of the exact request bytes. */
+  requestHash: string;
+  usage?: JevUsage;
+}
+/** Whether the run got answers for everything it set out to ask about. */
+type JevCompletion = "complete" | "partial" | "unavailable";
+interface JevRunResult {
+  /** Answers per match, keyed by that match's own question names. */
+  answersByMatchKey: Record<string, Record<string, JevAnswer>>;
+  completion: JevCompletion;
+  /** Wall-clock time spent on requests, including cache reads. */
+  elapsedMs: number;
+  /** Distinct models HQ reported, in first-seen order. */
+  models: string[];
+  requests: JevRequestRecord[];
+  /** Why a match has no answers. Every unanswered match appears here. */
+  unavailableByMatchKey: Record<string, string>;
+}
+interface RunJevFilesInput {
+  budgetTokens?: number;
+  /** Omitted means every request is sent live. */
+  cache?: JevCache;
+  files: readonly JevFile[];
+  gateway: JevGateway;
+}
+/**
+ * Builds the requests, sends the ones the cache does not already answer, and
+ * routes answers back to the matches that asked for them.
+ *
+ * Requests go one at a time. Bounded load is the point: a repository-wide run
+ * would otherwise open dozens of concurrent 32k-token requests against one HQ
+ * route for a diagnostic nothing is waiting on.
+ */
+declare const runJevFiles: ({
+  budgetTokens,
+  cache,
+  files,
+  gateway
+}: RunJevFilesInput) => Promise<JevRunResult>;
+//#endregion
 //#region src/index.d.ts
 interface CreateProgramOptions {
   actions?: {
@@ -5238,4 +5626,4 @@ declare function createProgram(options?: CreateProgramOptions): Command;
  */
 declare function run(argv?: string[], cliEntry?: string): Promise<void>;
 //#endregion
-export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, type CompletedFactoryCheckSnapshot, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryPrStatusCheckName, type FactoryPrStatusSources, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FollowUpAction, FollowUpActionSchema, type GitHubCheckRunMergeFreezeApi, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeAuthority, type MergeFreezeGeneration, type MergeFreezeState, type MergeFreezeStoreInput, type PlanFactoryPrStatusHudInput, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PrVerifyProof, type PresentFactoryPrStatusHudDependencies, type PresentFactoryPrStatusHudInput, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReadFactoryPrStatusSourcesDependencies, type ReadFactoryPrStatusSourcesInput, type RefreshFactoryPrStatusHudInput, type RenderFactoryPrStatusHudInput, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertFactoryPrStatusIdentity, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildReviewGateNotRequiredTraceEvent, comment_provenance_d_exports as commentProvenance, createGitHubCheckRunMergeFreezeStore, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, doctorProjectProfile, epicStructureEventId, evidenceEnvelopeFilename, followUpFromArgv, impactStampScopeDecision, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, planFactoryPrStatusHud, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, presentFactoryPrStatusHud, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readFactoryPrStatusSources, readPrReadyProof, refreshFactoryPrStatusHud, refreshFactoryPrStatusHudSafely, renderFactoryPrStatusHud, resolveFactoryRepository, resolveTraceWriteSinks, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, selectWaiversForCandidate, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrVerifyProof, validatePreviewLifecyclePlan, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };
+export { type AppendFactoryTraceEventResult, type AssembledReviewPrompt, type BatteryCommandDisposition, type BatteryDisposition, type BoundaryCheckArgs, type BoundaryCheckDependencies, type BoundaryCheckProofRecord, type BuildEpicStructureEventInput, type CloudflareAccessServiceToken, type CompletedFactoryCheckSnapshot, CreateProgramOptions, DEFAULT_DEMAND_WAIVER_PATH, DEFAULT_FACTORY_REPOSITORY, DEFAULT_ROOT_SHARED_GLOBS, type DagDocument, type DemandWaiveArgs, type DemandWaiveDependencies, DemandWaiveRefusalError, type DemandWaiver, type DemandWaiverStore, EMPTY_TREE_OBJECT_HASH, EPIC_STRUCTURE_NODE_STATUSES, EPIC_STRUCTURE_SCHEMA_VERSION, type EpicStructureEvent, type EpicStructureGraphPayload, type EpicStructureNodeStatus, EpicStructureValidationError, type EvidenceEmitArgs, type EvidenceEmitDependencies, type EvidenceEmitResult, FACTORY_BASE_REF_ENV, FACTORY_CHANGED_FILES_ENV, FACTORY_CHANGED_FILES_FILE_ENV, type FactoryCliInvocation, FactoryCliInvocationSchema, type FactoryPrStatusCheckName, type FactoryPrStatusSources, type FactoryProjectProfile, type FactoryTraceDiagnostic, type FactoryTraceEnvelope, type FactoryTraceEvent, type FollowUpAction, FollowUpActionSchema, type GitHubCheckRunMergeFreezeApi, type ImpactScopeDecision, type ImpactScopeSurface, type IssueReviewFocus, type JevAnswer, type JevCache, JevCacheError, type JevCompletion, type JevEvaluate, type JevFile, type JevGateway, type JevJsonValue, type JevMatch, type JevQuestions, type JevRequest, JevRequestError, type JevRequestPlan, type JevRequestRecord, type JevResponse, type JevRunResult, type JevUnavailableMatch, type JevUsage, MERGE_FREEZE_APP_SLUG, MERGE_FREEZE_CHECK_NAME, type MergeFreezeAuthority, type MergeFreezeGeneration, type MergeFreezeState, type MergeFreezeStoreInput, type PlanFactoryPrStatusHudInput, type PrPublishArgs, type PrPublishDependencies, PrPublishFollowUpError, type PrPublishFollowUpOutcome, type PrPublishHandoff, type PrPublishResult, type PrReadyArgs, type PrReadyProof, type PrVerifyProof, type PresentFactoryPrStatusHudDependencies, type PresentFactoryPrStatusHudInput, type PreviewDisposition, type PreviewLifecyclePlan, type PreviewTargetPlan, type PublishEpicStructureArgs, type PublishEpicStructureResult, type PublishFollowUpPlan, REVIEW_FOCUS_SECTION, type ReadFactoryPrStatusSourcesDependencies, type ReadFactoryPrStatusSourcesInput, type RefreshFactoryPrStatusHudInput, type RenderFactoryPrStatusHudInput, type ReviewGateNotRequiredProof, type ReviewGateTraceIdentity, type ReviewPromptSection, type ReviewPromptSectionProvenance, type ScanFactoryTraceDiagnosticsOptions, type ScanFactoryTraceOptions, type ScanFactoryTraceResult, type ScopedOutCommand, type TraceMirrorDiagnostic, type TraceSink, type TraceWriteResult, type TraceWriteSinks, UNKNOWN_MODEL, type VerificationBatteryPlan, type VerificationReuse, type VerificationRunContext, type VerificationRunContextInput, type WaivedDemand, WorkerCheckoutGuardError, type WorkerCloseoutLessonsTraceEvent, appendWithTraceSinks, applyDemandWaiver, assembleReviewPrompt, assertFactoryPrStatusIdentity, assertWorkerCheckoutAllowed, authorizeDemandWaiver, batteryScopeSummaryLines, boundary_manifest_d_exports as boundaryManifest, boundary_review_proof_d_exports as boundaryReviewProof, buildEpicStructureEvent, buildEpicStructurePayload, buildEvidenceEnvelope, buildJevRequests, buildReviewGateNotRequiredTraceEvent, choice, comment_provenance_d_exports as commentProvenance, createGitHubCheckRunMergeFreezeStore, createLocalJsonlTraceSink, createProgram, createVerificationRunContext, defaultJevCacheDirectory, doctorProjectProfile, epicStructureEventId, evidenceEnvelopeFilename, followUpFromArgv, impactStampScopeDecision, isProductionHqUrl, loadProjectProfile, normalizeIssueComments, noul, openJevCache, planFactoryPrStatusHud, planPreviewLifecycle, planPublishFollowUp, planVerificationBattery, readiness_evaluation_d_exports as prReadinessEvaluation, external_evidence_d_exports as prReadinessExternalEvidence, pr_body_renderer_d_exports as prReadinessPrBodyRenderer, proof_identity_d_exports as prReadinessProofIdentity, review_proof_d_exports as prReadinessReviewProof, status_check_rollup_d_exports as prReadinessStatusChecks, verification_proof_d_exports as prReadinessVerificationProof, presentFactoryPrStatusHud, previewLifecycleTargets, publishEpicStructure, readDemandWaivers, readFactoryPrStatusSources, readPrReadyProof, refreshFactoryPrStatusHud, refreshFactoryPrStatusHudSafely, renderFactoryPrStatusHud, resolveFactoryRepository, resolveJevGateway, resolveTraceWriteSinks, reviewFocusFromIssueBody, reviewPromptSectionSchema, reviewPromptSectionsSchema, run, runBoundaryCheck, runDemandWaive, runEvidenceEmit, runJevFiles, runPrPublish, runPrReady, runPrReview, runPrVerify, scanFactoryTraceDiagnostics, scanFactoryTraceEvents, score, selectWaiversForCandidate, toFactoryTraceEnvelope, tryAppendReviewGateNotRequiredTraceEvent, validateBoundaryCheckProof, validateDagDocument, validateDemandWaiverStore, validateFactoryTraceEvent, validateMergeFreezeState, validatePrReadyProof, validatePrVerifyProof, validatePreviewLifecyclePlan, waivedDemandNotice, waivedDemandSchema, worktree_scratch_files_d_exports as worktreeScratchFiles };