@polydeukes/core 0.3.0 → 0.5.0

package/dist/config.js

@@ -1,19 +1,16 @@
 /**
- * Config schema v2 + `defineConfig()` validator — config as data (CONFIG-04).
+ * Config schema and the `defineConfig()` validator — config as data.
  *
- * This is the single settings surface the three areas share (covenant's `protectedPaths`,
- * ledger's `testCmd`, memory's ticket pattern all reference this shape). Since schema v2 the
- * input is pure JSON-representable data: `testCmd` is a `{scope}` template string, and
- * `defineConfig` is the runtime validator for parsed unknown data (the CONFIG-03 loader feeds
- * it values the compiler never saw). It stays a pure function — zero file I/O, zero runtime
- * dependencies (hand-rolled validation; the published JSON Schema is a sibling artifact the
- * source never reads).
+ * The single settings surface the areas share. The input is pure JSON-representable data,
+ * and `defineConfig` is the runtime validator for parsed unknown values the compiler never
+ * saw. It stays a pure function — no file I/O and no runtime dependencies: validation is
+ * hand-rolled, and the published JSON Schema is a sibling artifact this source never reads.
  */
 import { isPlainObject } from './is-plain-object.js';
-/** Conventional default telemetry log path (PRD §4.3) — local-only observation data. */
+/** Conventional default telemetry log path — local-only observation data. */
 export const DEFAULT_TELEMETRY_LOG_PATH = '.polydeukes/roi.log';
 /**
- * `ConfigValidationError` — raised when a config fails structural validation (PRD §4.3).
+ * `ConfigValidationError` — raised when a config fails structural validation.
  *
  * The message names the offending field path so the developer sees exactly what is wrong.
  * This throw is a developer-time error (config authoring), a different axis from the
@@ -25,7 +22,8 @@ export class ConfigValidationError extends Error {
         this.name = 'ConfigValidationError';
     }
 }
-/** The exact key vocabulary of each object level — anything else is a typo, rejected loudly. */
+/** Labels the assembly reserves for the judging chain's own registrations. */
+const META_COVENANT_LABELS = ['self-mod', 'shell-mod', 'transcript-mod'];
 const TOP_LEVEL_KEYS = new Set([
     '$schema',
     'languages',
@@ -41,6 +39,7 @@ const WITNESS_KEYS = new Set(['token', 'ttlMinutes']);
 const DISCIPLINE_KEYS = new Set([
     'id',
     'why',
+    'enforce',
     'in',
     'except',
     'forbid',
@@ -49,8 +48,10 @@ const DISCIPLINE_KEYS = new Set([
     'when',
     'requirePrecedent',
 ]);
+const DRAFT_KEYS = new Set(['id', 'why', 'draft']);
+const ENFORCE_LEVELS = new Set(['block', 'advise']);
 const PREDICATE_KEYS = ['forbid', 'immutable', 'forbidCommand', 'requirePrecedent'];
-/** Predicate families that `in`/`except` may scope — delta and context (COVENANT-13 §4.1). */
+/** Predicate families that `in`/`except` may scope — delta and context. */
 const SCOPED_PREDICATE_KEYS = new Set(['forbid', 'requirePrecedent']);
 /** Throw on the first key outside the allowed vocabulary, naming the key and its location. */
 function rejectUnknownKeys(record, allowed, location) {
@@ -75,7 +76,7 @@ function isValidGlob(glob) {
     return false;
 }
 /**
- * Compile a `{scope}` template into the callable consumers use (PRD §4.2).
+ * Compile a `{scope}` template into the callable consumers use.
  *
  * Exactly the literal token `{scope}` is substituted, at every occurrence (`replaceAll`
  * semantics). Other braces (`${VAR}`, `{a,b}`, `awk '{print}'`) are the shell's own
@@ -96,14 +97,13 @@ function rejectUncompilableRegex(pattern, location) {
     }
 }
 /**
- * Validate a context-family `requirePrecedent` value (COVENANT-13 §4.1).
+ * Validate a context-family `requirePrecedent` value.
  *
  * Evidence vocabulary is layered: the container (a flat object holding exactly one
  * evidence key) is the core's, and so is the `command` key — a shell command is the
  * agent-crossing surface, fully validated here. Every other key belongs to an adapter,
  * whose own validator judges the value; the core passes it through verbatim and never
- * inspects it (CONFIG-07 layering). An unrecognized evidence key fails closed at
- * assembly time, not here.
+ * inspects it. An unrecognized evidence key fails closed at assembly time, not here.
  */
 function validateRequirePrecedent(evidence, location) {
     if (!isPlainObject(evidence)) {
@@ -121,14 +121,128 @@ function validateRequirePrecedent(evidence, location) {
         rejectUncompilableRegex(command, `${location} requirePrecedent.command`);
     }
 }
+/** Validate a draft entry and return it as data. */
+function validateDraft(entry, id, location) {
+    for (const key of Object.keys(entry)) {
+        if (!DRAFT_KEYS.has(key)) {
+            // Named as the draft rule, not as an unknown key: `forbid` et al. are legal
+            // discipline keys, just not on a draft.
+            throw new ConfigValidationError(`${location} allows only id, why, draft on a draft entry (found '${key}')`);
+        }
+    }
+    if (entry.draft !== true) {
+        throw new ConfigValidationError(`${location} draft must be the literal true`);
+    }
+    if (typeof entry.why !== 'string' || entry.why.length === 0) {
+        throw new ConfigValidationError(`${location} why must be a non-empty string on a draft entry — the prose is its whole body`);
+    }
+    return { id, why: entry.why, draft: true };
+}
+/** Validate the family-independent rules of a judged entry and return its predicate key. */
+function validateJudgedHead(entry, location) {
+    rejectUnknownKeys(entry, DISCIPLINE_KEYS, location);
+    if (entry.why !== undefined && typeof entry.why !== 'string') {
+        throw new ConfigValidationError(`${location} why must be a string`);
+    }
+    if (entry.enforce !== undefined &&
+        (typeof entry.enforce !== 'string' || !ENFORCE_LEVELS.has(entry.enforce))) {
+        throw new ConfigValidationError(`${location} enforce must be 'block' or 'advise'`);
+    }
+    const predicates = PREDICATE_KEYS.filter((key) => entry[key] !== undefined);
+    if (predicates.length !== 1) {
+        throw new ConfigValidationError(`${location} must have exactly one predicate key ` +
+            `(forbid | immutable | forbidCommand | requirePrecedent)`);
+    }
+    const predicate = predicates[0];
+    if (!SCOPED_PREDICATE_KEYS.has(predicate) &&
+        (entry.in !== undefined || entry.except !== undefined)) {
+        throw new ConfigValidationError(`${location} allows in/except only on a forbid or requirePrecedent entry`);
+    }
+    // `when` is the context family's trigger; on any other family it would be dead data
+    // implying a trigger that is never applied.
+    if (entry.when !== undefined && predicate !== 'requirePrecedent') {
+        throw new ConfigValidationError(`${location} allows when only on a requirePrecedent entry`);
+    }
+    if (entry.in !== undefined && !isValidGlob(entry.in)) {
+        throw new ConfigValidationError(`${location} in must be a non-empty glob or glob array`);
+    }
+    if (entry.except !== undefined && !isValidGlob(entry.except)) {
+        throw new ConfigValidationError(`${location} except must be a non-empty glob or glob array`);
+    }
+    return predicate;
+}
+function validateForbid(entry, location) {
+    const forbid = entry.forbid;
+    if (typeof forbid === 'string') {
+        // An empty pattern matches at every position, so the entry would break every
+        // in-scope change — rejected like every sibling pattern field.
+        if (forbid.length === 0) {
+            throw new ConfigValidationError(`${location} forbid must be a non-empty string pattern`);
+        }
+        rejectUncompilableRegex(forbid, `${location} forbid`);
+    }
+    else if (isPlainObject(forbid)) {
+        const keys = Object.keys(forbid);
+        if (keys.length !== 1 || keys[0] !== 'added' || typeof forbid.added !== 'string') {
+            throw new ConfigValidationError(`${location} forbid object must have exactly one key 'added' with a string pattern`);
+        }
+        if (forbid.added.length === 0) {
+            throw new ConfigValidationError(`${location} forbid.added must be a non-empty string pattern`);
+        }
+        rejectUncompilableRegex(forbid.added, `${location} forbid.added`);
+    }
+    else {
+        throw new ConfigValidationError(`${location} forbid must be a string pattern or an { added } object`);
+    }
+}
+function validateImmutable(entry, location) {
+    if (!isValidGlob(entry.immutable)) {
+        throw new ConfigValidationError(`${location} immutable must be a non-empty glob or glob array`);
+    }
+}
+function validateForbidCommand(entry, location) {
+    if (typeof entry.forbidCommand !== 'string') {
+        throw new ConfigValidationError(`${location} forbidCommand must be a string pattern`);
+    }
+    if (entry.forbidCommand.length === 0) {
+        // An empty pattern matches every command line — one typo would block every
+        // shell call the entry sees.
+        throw new ConfigValidationError(`${location} forbidCommand must be a non-empty string pattern`);
+    }
+    rejectUncompilableRegex(entry.forbidCommand, `${location} forbidCommand`);
+}
+function validateContextEntry(entry, location) {
+    if (entry.when !== undefined) {
+        if (typeof entry.when !== 'string') {
+            throw new ConfigValidationError(`${location} when must be a string pattern`);
+        }
+        if (entry.when.length === 0) {
+            // An empty pattern matches at every position, so the trigger would fire on any
+            // file that merely grows — reject it like every sibling pattern field.
+            throw new ConfigValidationError(`${location} when must be a non-empty string pattern`);
+        }
+        rejectUncompilableRegex(entry.when, `${location} when`);
+    }
+    validateRequirePrecedent(entry.requirePrecedent, location);
+}
+/** One validator per family, keyed by the predicate that selects the family. */
+const PREDICATE_VALIDATORS = {
+    forbid: validateForbid,
+    immutable: validateImmutable,
+    forbidCommand: validateForbidCommand,
+    requirePrecedent: validateContextEntry,
+};
 /**
- * Validate the `disciplines` array (COVENANT-10 §4.1). Throws {@link ConfigValidationError}
- * naming the offending entry/key; the validated data passes through verbatim.
+ * Validate the `disciplines` array and split judged entries from drafts. Throws
+ * {@link ConfigValidationError} naming the offending entry/key; the validated data passes
+ * through verbatim, in declaration order.
  */
 function validateDisciplines(disciplines) {
     if (!Array.isArray(disciplines)) {
         throw new ConfigValidationError('disciplines must be an array');
     }
+    const judged = [];
+    const drafts = [];
     const seenIds = new Set();
     disciplines.forEach((entry, index) => {
         if (!isPlainObject(entry)) {
@@ -141,99 +255,27 @@ function validateDisciplines(disciplines) {
         if (seenIds.has(entry.id)) {
             throw new ConfigValidationError(`${location} duplicates the id of an earlier entry`);
         }
-        seenIds.add(entry.id);
-        rejectUnknownKeys(entry, DISCIPLINE_KEYS, location);
-        if (entry.why !== undefined && typeof entry.why !== 'string') {
-            throw new ConfigValidationError(`${location} why must be a string`);
-        }
-        const predicates = PREDICATE_KEYS.filter((key) => entry[key] !== undefined);
-        if (predicates.length !== 1) {
-            throw new ConfigValidationError(`${location} must have exactly one predicate key ` +
-                `(forbid | immutable | forbidCommand | requirePrecedent)`);
-        }
-        const predicate = predicates[0];
-        if (!SCOPED_PREDICATE_KEYS.has(predicate) &&
-            (entry.in !== undefined || entry.except !== undefined)) {
-            throw new ConfigValidationError(`${location} allows in/except only on a forbid or requirePrecedent entry`);
-        }
-        // `when` is the context family's trigger; on any other family it would be dead data
-        // implying a trigger that is never applied.
-        if (entry.when !== undefined && predicate !== 'requirePrecedent') {
-            throw new ConfigValidationError(`${location} allows when only on a requirePrecedent entry`);
-        }
-        if (entry.in !== undefined && !isValidGlob(entry.in)) {
-            throw new ConfigValidationError(`${location} in must be a non-empty glob or glob array`);
+        // The three meta-covenant registrations share the telemetry label space with
+        // discipline ids; a colliding id would make gain aggregation and any label-keyed
+        // reader (pdks explain) ambiguous.
+        if (META_COVENANT_LABELS.includes(entry.id)) {
+            throw new ConfigValidationError(`${location} id collides with a meta-covenant label`);
         }
-        if (entry.except !== undefined && !isValidGlob(entry.except)) {
-            throw new ConfigValidationError(`${location} except must be a non-empty glob or glob array`);
-        }
-        if (predicate === 'forbid') {
-            const forbid = entry.forbid;
-            if (typeof forbid === 'string') {
-                rejectUncompilableRegex(forbid, `${location} forbid`);
-            }
-            else if (isPlainObject(forbid)) {
-                // Only the { added } direction exists before COVENANT-12.
-                const keys = Object.keys(forbid);
-                if (keys.length !== 1 || keys[0] !== 'added' || typeof forbid.added !== 'string') {
-                    throw new ConfigValidationError(`${location} forbid object must have exactly one key 'added' with a string pattern`);
-                }
-                rejectUncompilableRegex(forbid.added, `${location} forbid.added`);
-            }
-            else {
-                throw new ConfigValidationError(`${location} forbid must be a string pattern or an { added } object`);
-            }
-        }
-        else if (predicate === 'immutable') {
-            if (!isValidGlob(entry.immutable)) {
-                throw new ConfigValidationError(`${location} immutable must be a non-empty glob or glob array`);
-            }
-        }
-        else if (predicate === 'forbidCommand') {
-            if (typeof entry.forbidCommand !== 'string') {
-                throw new ConfigValidationError(`${location} forbidCommand must be a string pattern`);
-            }
-            rejectUncompilableRegex(entry.forbidCommand, `${location} forbidCommand`);
-        }
-        else {
-            if (entry.when !== undefined) {
-                if (typeof entry.when !== 'string') {
-                    throw new ConfigValidationError(`${location} when must be a string pattern`);
-                }
-                if (entry.when.length === 0) {
-                    // An empty pattern matches at every position, so the trigger would fire on any
-                    // file that merely grows — reject it like every sibling pattern field.
-                    throw new ConfigValidationError(`${location} when must be a non-empty string pattern`);
-                }
-                rejectUncompilableRegex(entry.when, `${location} when`);
-            }
-            validateRequirePrecedent(entry.requirePrecedent, location);
+        seenIds.add(entry.id);
+        // Selected by the marker's value, so an explicit `draft: undefined` is absence,
+        // like every other optional key in this validator.
+        if (entry.draft !== undefined) {
+            drafts.push(validateDraft(entry, entry.id, location));
+            return;
         }
+        const predicate = validateJudgedHead(entry, location);
+        PREDICATE_VALIDATORS[predicate](entry, location);
+        judged.push(entry);
     });
-    return disciplines;
+    return { judged, drafts };
 }
-/**
- * Validate parsed unknown data as a {@link PolydeukesConfig} and return a
- * {@link ResolvedConfig} with defaults filled and templates compiled (PRD §4.3).
- * Pure — no file I/O.
- *
- * Throws {@link ConfigValidationError} (naming the offending field path) when the top level
- * is not a plain object, any object level carries an unknown key, `languages` is
- * missing/empty, any language's `productionGlob` is missing/empty, any `testCmd` is not a
- * non-empty string template, `telemetry.logPath` is not a string, `protectedPaths` carries a
- * non-string element, or `adapters` is not a map of plain-object namespaces.
- */
-export function defineConfig(config) {
-    if (!isPlainObject(config)) {
-        throw new ConfigValidationError('config must be a plain object');
-    }
-    rejectUnknownKeys(config, TOP_LEVEL_KEYS, 'config');
-    // `$schema` is an IDE schema reference (CONFIG-03): accepted, type-checked, and
-    // ignored — it never appears in the resolution output.
-    if (config.$schema !== undefined && typeof config.$schema !== 'string') {
-        throw new ConfigValidationError('$schema must be a string');
-    }
-    const languages = config.languages;
+/** Validate the `languages` map and compile each profile's `{scope}` template. */
+function validateLanguages(languages) {
     if (!isPlainObject(languages) || Object.keys(languages).length === 0) {
         throw new ConfigValidationError('languages must be a non-empty object');
     }
@@ -258,61 +300,108 @@ export function defineConfig(config) {
             testCmd: compileTestCmd(profile.testCmd),
         };
     }
-    if (config.protectedPaths !== undefined && !isStringArray(config.protectedPaths)) {
+    return resolvedLanguages;
+}
+/** Validate `protectedPaths` — an array of non-empty strings; the data passes through verbatim. */
+function validateProtectedPaths(protectedPaths) {
+    if (!isStringArray(protectedPaths)) {
         throw new ConfigValidationError('protectedPaths must be an array of strings');
     }
-    let adapters;
-    if (config.adapters !== undefined) {
-        // Array first: the removed directory-list form deserves a migration hint, not a
-        // generic type error — and an EMPTY array must land here too, never pass as a map.
-        if (Array.isArray(config.adapters) || !isPlainObject(config.adapters)) {
-            throw new ConfigValidationError('adapters must be an object map of adapter namespaces — the directory-list form ' +
-                'was removed; move directories to protectedPaths');
-        }
-        for (const [name, namespace] of Object.entries(config.adapters)) {
-            if (!isPlainObject(namespace)) {
-                throw new ConfigValidationError(`adapters.${name} must be an object`);
-            }
-        }
-        adapters = config.adapters;
+    // An empty element carries no path meaning and would ride along unnoticed next to
+    // valid siblings.
+    if (protectedPaths.some((path) => path.length === 0)) {
+        throw new ConfigValidationError('protectedPaths must not contain an empty string');
     }
-    const disciplines = config.disciplines !== undefined ? validateDisciplines(config.disciplines) : undefined;
-    let logPath;
-    if (config.telemetry !== undefined) {
-        if (!isPlainObject(config.telemetry)) {
-            throw new ConfigValidationError('telemetry must be an object');
-        }
-        rejectUnknownKeys(config.telemetry, TELEMETRY_KEYS, 'telemetry');
-        if (config.telemetry.logPath !== undefined) {
-            if (typeof config.telemetry.logPath !== 'string') {
-                throw new ConfigValidationError('telemetry.logPath must be a string');
-            }
-            logPath = config.telemetry.logPath;
-        }
+    return protectedPaths;
+}
+/**
+ * Validate the `adapters` map — each namespace is a plain object whose contents belong to
+ * that adapter's own validator, so they pass through verbatim.
+ */
+function validateAdapters(adapters) {
+    // Array first: the removed directory-list form deserves a migration hint, not a
+    // generic type error — and an EMPTY array must land here too, never pass as a map.
+    if (Array.isArray(adapters) || !isPlainObject(adapters)) {
+        throw new ConfigValidationError('adapters must be an object map of adapter namespaces — the directory-list form ' +
+            'was removed; move directories to protectedPaths');
     }
-    let witness;
-    if (config.witness !== undefined) {
-        if (!isPlainObject(config.witness)) {
-            throw new ConfigValidationError('witness must be an object');
+    for (const [name, namespace] of Object.entries(adapters)) {
+        if (!isPlainObject(namespace)) {
+            throw new ConfigValidationError(`adapters.${name} must be an object`);
         }
-        rejectUnknownKeys(config.witness, WITNESS_KEYS, 'witness');
-        const { token, ttlMinutes } = config.witness;
-        if (typeof token !== 'string' || token.trim().length === 0) {
-            throw new ConfigValidationError('witness.token must be a non-empty string after trimming');
-        }
-        if (typeof ttlMinutes !== 'number' || !(Number.isFinite(ttlMinutes) && ttlMinutes > 0)) {
-            throw new ConfigValidationError('witness.ttlMinutes must be a finite number greater than 0');
-        }
-        witness = { token, ttlMinutes };
     }
+    return adapters;
+}
+/** Validate the `telemetry` section and return its `logPath` (absent stays undefined). */
+function validateTelemetry(telemetry) {
+    if (!isPlainObject(telemetry)) {
+        throw new ConfigValidationError('telemetry must be an object');
+    }
+    rejectUnknownKeys(telemetry, TELEMETRY_KEYS, 'telemetry');
+    if (telemetry.logPath === undefined) {
+        return undefined;
+    }
+    if (typeof telemetry.logPath !== 'string') {
+        throw new ConfigValidationError('telemetry.logPath must be a string');
+    }
+    if (telemetry.logPath.trim().length === 0) {
+        throw new ConfigValidationError('telemetry.logPath must be a non-empty string after trimming');
+    }
+    return telemetry.logPath;
+}
+/** Validate the `witness` section — both values are consumed at assembly time. */
+function validateWitness(witness) {
+    if (!isPlainObject(witness)) {
+        throw new ConfigValidationError('witness must be an object');
+    }
+    rejectUnknownKeys(witness, WITNESS_KEYS, 'witness');
+    const { token, ttlMinutes } = witness;
+    if (typeof token !== 'string' || token.trim().length === 0) {
+        throw new ConfigValidationError('witness.token must be a non-empty string after trimming');
+    }
+    if (typeof ttlMinutes !== 'number' || !(Number.isFinite(ttlMinutes) && ttlMinutes > 0)) {
+        throw new ConfigValidationError('witness.ttlMinutes must be a finite number greater than 0');
+    }
+    return { token, ttlMinutes };
+}
+/**
+ * Validate parsed unknown data as a {@link PolydeukesConfig} and return a
+ * {@link ResolvedConfig} with defaults filled and templates compiled. Pure — no file I/O.
+ *
+ * Throws {@link ConfigValidationError} (naming the offending field path) when the top level
+ * is not a plain object, any object level carries an unknown key, `languages` is
+ * missing/empty, any language's `productionGlob` is missing/empty, any `testCmd` is not a
+ * non-empty string template, `telemetry.logPath` is not a non-empty string after trimming,
+ * `protectedPaths` carries a non-string or empty element, or `adapters` is not a map of
+ * plain-object namespaces.
+ */
+export function defineConfig(config) {
+    if (!isPlainObject(config)) {
+        throw new ConfigValidationError('config must be a plain object');
+    }
+    rejectUnknownKeys(config, TOP_LEVEL_KEYS, 'config');
+    // `$schema` is an IDE schema reference: accepted, type-checked, and ignored — it never
+    // appears in the resolution output.
+    if (config.$schema !== undefined && typeof config.$schema !== 'string') {
+        throw new ConfigValidationError('$schema must be a string');
+    }
+    const resolvedLanguages = validateLanguages(config.languages);
+    const protectedPaths = config.protectedPaths !== undefined ? validateProtectedPaths(config.protectedPaths) : undefined;
+    const adapters = config.adapters !== undefined ? validateAdapters(config.adapters) : undefined;
+    const split = config.disciplines !== undefined ? validateDisciplines(config.disciplines) : undefined;
+    const disciplines = split?.judged;
+    const drafts = split !== undefined && split.drafts.length > 0 ? split.drafts : undefined;
+    const logPath = config.telemetry !== undefined ? validateTelemetry(config.telemetry) : undefined;
+    const witness = config.witness !== undefined ? validateWitness(config.witness) : undefined;
     return {
         languages: resolvedLanguages,
-        ...(config.protectedPaths !== undefined && { protectedPaths: config.protectedPaths }),
+        ...(protectedPaths !== undefined && { protectedPaths }),
         ...(adapters !== undefined && { adapters }),
         telemetry: {
             logPath: logPath ?? DEFAULT_TELEMETRY_LOG_PATH,
         },
         ...(disciplines !== undefined && { disciplines }),
+        ...(drafts !== undefined && { drafts }),
         ...(witness !== undefined && { witness }),
     };
 }

package/dist/exit-codes.d.ts

@@ -0,0 +1,20 @@
+/**
+ * exit-codes — the covenant protocol's exit-code vocabulary.
+ *
+ * The three codes are distinct and ordered by severity. The covenant *body* only ever
+ * emits `0` (uphold) or `1` (break, non-blocking); translating a break into the blocking
+ * `2` is the wrapper's job, never the core's. The sole place the core itself reaches for
+ * `2` is the fail-closed parse path in the barrel.
+ *
+ * These live in their own module rather than the barrel because `fail-policy.ts` needs
+ * them: importing them from the barrel, which re-exports fail-policy, is an initialization
+ * cycle — the constants read as `undefined` depending on which module the runtime evaluates
+ * first. The barrel re-exports them, so every consumer outside core still reaches them at
+ * the same path.
+ */
+/** Promise upheld — no violation, the edit/push passes. */
+export declare const EXIT_UPHOLD = 0;
+/** Violation reported as a non-blocking signal. The covenant body's break code. */
+export declare const EXIT_BREAK_NON_BLOCKING = 1;
+/** Violation blocked — the edit/push is refused. Reserved for the wrapper / fail-closed. */
+export declare const EXIT_BREAK_BLOCKING = 2;

package/dist/exit-codes.js

@@ -0,0 +1,20 @@
+/**
+ * exit-codes — the covenant protocol's exit-code vocabulary.
+ *
+ * The three codes are distinct and ordered by severity. The covenant *body* only ever
+ * emits `0` (uphold) or `1` (break, non-blocking); translating a break into the blocking
+ * `2` is the wrapper's job, never the core's. The sole place the core itself reaches for
+ * `2` is the fail-closed parse path in the barrel.
+ *
+ * These live in their own module rather than the barrel because `fail-policy.ts` needs
+ * them: importing them from the barrel, which re-exports fail-policy, is an initialization
+ * cycle — the constants read as `undefined` depending on which module the runtime evaluates
+ * first. The barrel re-exports them, so every consumer outside core still reaches them at
+ * the same path.
+ */
+/** Promise upheld — no violation, the edit/push passes. */
+export const EXIT_UPHOLD = 0;
+/** Violation reported as a non-blocking signal. The covenant body's break code. */
+export const EXIT_BREAK_NON_BLOCKING = 1;
+/** Violation blocked — the edit/push is refused. Reserved for the wrapper / fail-closed. */
+export const EXIT_BREAK_BLOCKING = 2;

package/dist/fail-policy.d.ts

@@ -1,5 +1,5 @@
 /**
- * fail-policy — the failure-kind → fail-mode policy table (CORE-03).
+ * fail-policy — the failure-kind → fail-mode policy table.
  *
  * Pure and total: classifying a failure and mapping it to an exit code never
  * performs I/O and never throws. The single source of truth for "which failures
@@ -8,7 +8,7 @@
 /** How a failure resolves: 'open' passes the call through, 'closed' blocks it. */
 export type FailMode = 'open' | 'closed';
 /**
- * The registered failure kinds (PRD §4.1). Gate-integrity failures
+ * The registered failure kinds. Gate-integrity failures
  * (evidence-absence / input-parse / undecidable-structure) fail closed;
  * observability failures fail open so measurement loss never holds work hostage.
  */
@@ -16,14 +16,14 @@ export type FailureKind = 'evidence-absence' | 'input-parse' | 'undecidable-stru
 /**
  * Resolve a failure kind to its {@link FailMode} via the policy table.
  *
- * fail-closed default (PRD §5.2): any unregistered kind — including '' and
- * prototype-pollution keys — resolves to 'closed'. "Cannot classify" means
- * block. Pure and total (PRD §7): never throws, no I/O, no logging.
+ * fail-closed default: any unregistered kind — including '' and prototype-pollution
+ * keys — resolves to 'closed'. "Cannot classify" means block. Pure and total: never
+ * throws, no I/O, no logging.
  */
 export declare function resolveFailMode(kind: string): FailMode;
 /**
- * Map a {@link FailMode} to the covenant protocol's exit code (PRD §4.2):
+ * Map a {@link FailMode} to the covenant protocol's exit code:
  * 'open' → {@link EXIT_UPHOLD}, 'closed' → {@link EXIT_BREAK_BLOCKING}.
- * Reuses CORE-01's constants — no independent numeric literals here.
+ * Reuses the protocol's constants — no independent numeric literals here.
  */
 export declare function failModeToExitCode(mode: FailMode): 0 | 2;

package/dist/fail-policy.js

@@ -1,13 +1,13 @@
 /**
- * fail-policy — the failure-kind → fail-mode policy table (CORE-03).
+ * fail-policy — the failure-kind → fail-mode policy table.
  *
  * Pure and total: classifying a failure and mapping it to an exit code never
  * performs I/O and never throws. The single source of truth for "which failures
  * block and which pass through" lives here, not scattered across call sites.
  */
-import { EXIT_BREAK_BLOCKING, EXIT_UPHOLD } from './index.js';
+import { EXIT_BREAK_BLOCKING, EXIT_UPHOLD } from './exit-codes.js';
 /**
- * Policy table (PRD §4.1). Null-prototype so lookups can never reach
+ * Policy table. Null-prototype so lookups can never reach
  * Object.prototype members ('__proto__', 'toString', …) — those must resolve
  * to the fail-closed default, not to an inherited function.
  */
@@ -20,17 +20,17 @@ const FAIL_POLICY = Object.assign(Object.create(null), {
 /**
  * Resolve a failure kind to its {@link FailMode} via the policy table.
  *
- * fail-closed default (PRD §5.2): any unregistered kind — including '' and
- * prototype-pollution keys — resolves to 'closed'. "Cannot classify" means
- * block. Pure and total (PRD §7): never throws, no I/O, no logging.
+ * fail-closed default: any unregistered kind — including '' and prototype-pollution
+ * keys — resolves to 'closed'. "Cannot classify" means block. Pure and total: never
+ * throws, no I/O, no logging.
  */
 export function resolveFailMode(kind) {
     return FAIL_POLICY[kind] ?? 'closed';
 }
 /**
- * Map a {@link FailMode} to the covenant protocol's exit code (PRD §4.2):
+ * Map a {@link FailMode} to the covenant protocol's exit code:
  * 'open' → {@link EXIT_UPHOLD}, 'closed' → {@link EXIT_BREAK_BLOCKING}.
- * Reuses CORE-01's constants — no independent numeric literals here.
+ * Reuses the protocol's constants — no independent numeric literals here.
  */
 export function failModeToExitCode(mode) {
     return mode === 'open' ? EXIT_UPHOLD : EXIT_BREAK_BLOCKING;