@sun-asterisk/sungen 3.2.34 → 3.3.0-alpha.2

package/dist/harness/gates/in-run-decision-check.js

@@ -0,0 +1,138 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IN_RUN_RULE = exports.IN_RUN_KINDS = void 0;
+exports.committedDecisionPaths = committedDecisionPaths;
+exports.runStartOf = runStartOf;
+exports.inRunDecisions = inRunDecisions;
+exports.uncommittedReleaseDecisions = uncommittedReleaseDecisions;
+exports.hasInRunKindDecisions = hasInRunKindDecisions;
+/**
+ * `decision.in-run` (OES-11.5, red-team #3/#15) — a hard rule: a decision that relaxes or approves
+ * something (`gate-override`, `waiver`, `contract-approval`) must have been reviewed BEFORE the run
+ * being delivered. It is in-run when
+ *   - it is not in `git show HEAD:` (never committed, so never reviewed), or
+ *   - it was committed after the start of that run — judged by its git COMMIT time, not by the
+ *     `valid_from` it carries, which its author writes and can backdate (review H1).
+ * Without git only the second test is possible, on `valid_from`; the caller says so (lower confidence).
+ * Without git AND without a run, nothing can be judged — reported, not guessed. A commit time can be
+ * forged too (GIT_COMMITTER_DATE); it raises the bar, it is not a signature.
+ *
+ * A MIGRATED waiver (DOS-13.5) was reviewed when its legacy record was committed — the only record the
+ * import trusts — so it is judged by THAT commit (migrated-waiver-review.ts), never by its own decision
+ * file: in-run when the record was committed after the run started, or, with no run to compare,
+ * after the decision file appeared. Holding it to its decision file's commit would make every legacy
+ * project's waivers in-run the day they are imported (phase 09). An entry HEAD's legacy file does not
+ * vouch for — absent, uncommitted, different — is judged as any other.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const decision_file_1 = require("../../decisions/decision-file");
+const git_head_trust_1 = require("../../decisions/git-head-trust");
+const read_decisions_1 = require("../../decisions/read-decisions");
+const migrated_waiver_review_1 = require("./migrated-waiver-review");
+exports.IN_RUN_KINDS = ['gate-override', 'waiver', 'contract-approval'];
+exports.IN_RUN_RULE = 'decision.in-run';
+/** Paths (relative to the project, `/`-separated) of decision files in git HEAD; null outside git. */
+function committedDecisionPaths(projectRoot) {
+    if ((0, git_head_trust_1.gitOutput)(projectRoot, ['rev-parse', '--is-inside-work-tree'])?.trim() !== 'true')
+        return null;
+    const listed = (0, git_head_trust_1.gitOutput)(projectRoot, ['ls-tree', '-r', '-z', '--name-only', 'HEAD', '--', 'qa']) ?? ''; // no HEAD yet → nothing committed
+    return new Set(listed.split('\0').filter((p) => decision_file_1.DECISION_FILE_PATH.test(p)));
+}
+/** When a committed file was last committed (ISO), or null when git cannot say. */
+function commitTimeOf(projectRoot, rel) {
+    const t = (0, git_head_trust_1.gitOutput)(projectRoot, ['log', '-1', '--format=%cI', '--', rel])?.trim();
+    return t && !Number.isNaN(Date.parse(t)) ? t : null;
+}
+/** When the delivered run started: Playwright's `stats.startTime`; null when there is no readable run. */
+function runStartOf(resultsPath) {
+    if (!resultsPath)
+        return null;
+    try {
+        const json = JSON.parse(fs.readFileSync(resultsPath, 'utf8'));
+        const t = json?.stats?.startTime;
+        return typeof t === 'string' && !Number.isNaN(Date.parse(t)) ? t : null;
+    }
+    catch {
+        return null;
+    }
+}
+const isInRunKind = (kind) => exports.IN_RUN_KINDS.includes(kind);
+/** In-run decisions among `scopes`, judged against one run start (null: HEAD membership only) and the committed set. */
+function inRunDecisions(projectRoot, scopes, runStart, committed) {
+    const out = [];
+    const after = (t) => !!runStart && Date.parse(t) > Date.parse(runStart);
+    for (const scope of scopes) {
+        for (const e of (0, read_decisions_1.readDecisions)(projectRoot, scope).entries) {
+            if (!isInRunKind(e.kind))
+                continue;
+            const rel = path.relative(projectRoot, e.path).split(path.sep).join('/');
+            const why = [];
+            const legacyAt = committed ? (0, migrated_waiver_review_1.migratedWaiverReviewedAt)(projectRoot, scope, e) : null;
+            if (legacyAt) {
+                if (runStart ? after(legacyAt) : Date.parse(legacyAt) > (0, migrated_waiver_review_1.decisionFirstSeenMs)(projectRoot, rel, e.path)) {
+                    why.push(runStart
+                        ? `migrated: its legacy record was committed at ${legacyAt}, after the run started ${runStart}`
+                        : `migrated: its legacy record was committed at ${legacyAt}, after this decision first appeared`);
+                }
+            }
+            else if (committed && !committed.has(rel)) {
+                why.push('not in git HEAD (never committed through review)');
+            }
+            else if (committed && runStart) {
+                const at = commitTimeOf(projectRoot, rel);
+                if (at ? after(at) : after(e.valid_from)) {
+                    why.push(at ? `committed at ${at}, after the run started ${runStart}` : `recorded ${e.valid_from} (commit time unavailable), after the run started ${runStart}`);
+                }
+            }
+            else if (!committed && after(e.valid_from)) {
+                why.push(`recorded ${e.valid_from}, after the run started ${runStart}`);
+            }
+            if (why.length)
+                out.push({ id: e.id, kind: e.kind, path: rel, visibility: e.visibility, why });
+        }
+    }
+    return out;
+}
+/** Release decisions (override / waiver / approval) in reach that git HEAD does not hold — what `gate deliver` refuses. */
+function uncommittedReleaseDecisions(projectRoot, scopes) {
+    return inRunDecisions(projectRoot, scopes, null, committedDecisionPaths(projectRoot));
+}
+/** Whether any decision of an in-run kind is in reach at all — the no-git notes are printed only then. */
+function hasInRunKindDecisions(projectRoot, scopes) {
+    return scopes.some((s) => (0, read_decisions_1.readDecisions)(projectRoot, s).entries.some((e) => isInRunKind(e.kind)));
+}
+//# sourceMappingURL=in-run-decision-check.js.map

package/dist/harness/gates/in-run-decision-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-run-decision-check.js","sourceRoot":"","sources":["../../../src/harness/gates/in-run-decision-check.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,wDAIC;AASD,gCASC;AAKD,wCA6BC;AAGD,kEAEC;AAGD,sDAEC;AAlGD;;;;;;;;;;;;;;;;;GAiBG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,iEAAmE;AAEnE,mEAA2D;AAC3D,mEAA+D;AAC/D,qEAAyF;AAE5E,QAAA,YAAY,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,mBAAmB,CAAU,CAAC;AACzE,QAAA,WAAW,GAAG,iBAAiB,CAAC;AAI7C,sGAAsG;AACtG,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,IAAI,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnG,MAAM,MAAM,GAAG,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAG,kCAAkC;IAC7I,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,WAAmB,EAAE,GAAW;IACpD,MAAM,CAAC,GAAG,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,0GAA0G;AAC1G,SAAgB,UAAU,CAAC,WAA0B;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAwC,CAAC;QACrG,MAAM,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC;QACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAAE,oBAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAElG,wHAAwH;AACxH,SAAgB,cAAc,CAAC,WAAmB,EAAE,MAAgB,EAAE,QAAuB,EAAE,SAA6B;IAC1H,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,IAAA,8BAAa,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1D,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzE,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAA,iDAAwB,EAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpF,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAA,4CAAmB,EAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtG,GAAG,CAAC,IAAI,CAAC,QAAQ;wBACf,CAAC,CAAC,gDAAgD,QAAQ,2BAA2B,QAAQ,EAAE;wBAC/F,CAAC,CAAC,gDAAgD,QAAQ,sCAAsC,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;gBACjC,MAAM,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,2BAA2B,QAAQ,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,UAAU,qDAAqD,QAAQ,EAAE,CAAC,CAAC;gBACnK,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,2BAA2B,QAAQ,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2HAA2H;AAC3H,SAAgB,2BAA2B,CAAC,WAAmB,EAAE,MAAgB;IAC/E,OAAO,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,0GAA0G;AAC1G,SAAgB,qBAAqB,CAAC,WAAmB,EAAE,MAAgB;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,8BAAa,EAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC"}

package/dist/harness/gates/journey-gate-inputs.d.ts

@@ -0,0 +1,37 @@
+import { AuditVerification } from './audit-report-verification';
+import { GateOverrideReport } from './gate-override-report';
+import { ActiveOverride } from './resolve-rule';
+import { UnitGateOverrides } from './unit-gate-overrides';
+export interface JourneyAuditInput {
+    audit: Record<string, unknown> | null;
+    verification: AuditVerification;
+    /** Set when a report exists but does not count (stale / invalid). */
+    notCountedReason?: string;
+}
+export declare function readJourneyAudit(projectRoot: string, unit: string): JourneyAuditInput;
+/** The audit rule each design obligation stands for. */
+export declare const OBLIGATION_RULE: Readonly<Record<string, string>>;
+interface OverridableObligation {
+    id: string;
+    status: string;
+    detail: string;
+    overriddenBy?: string;
+}
+/**
+ * Mark needs-work obligations whose rule the audit recorded as overridden (applied). audit.json is
+ * output too: an `applied` entry counts only when the same override (decision id AND rule) is in
+ * force for the unit today (review M3); the others are ignored and returned for the board.
+ */
+export declare function applyAuditOverrides<T extends OverridableObligation>(obligations: T[], audit: Record<string, unknown>, inForce: ActiveOverride[]): GateOverrideReport[];
+export declare function ignoredOverrideText(g: GateOverrideReport): string;
+export interface DecisionGateFinding {
+    rule: 'decision.id-reuse' | 'decision.mutated' | 'gate.override-rejected';
+    path: string;
+    message: string;
+}
+export declare function unitOverrides(projectRoot: string, unit: string): UnitGateOverrides;
+/** Integrity of every decision in the unit's reach (project + unit dirs) plus its rejected overrides. */
+export declare function journeyDecisionFindings(projectRoot: string, overrides: UnitGateOverrides): DecisionGateFinding[];
+export declare function decisionFindingText(f: DecisionGateFinding): string;
+export {};
+//# sourceMappingURL=journey-gate-inputs.d.ts.map

package/dist/harness/gates/journey-gate-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journey-gate-inputs.d.ts","sourceRoot":"","sources":["../../../src/harness/gates/journey-gate-inputs.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsC,iBAAiB,EAAqB,MAAM,6BAA6B,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAyC,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEjG,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,YAAY,EAAE,iBAAiB,CAAC;IAChC,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAQrF;AAED,wDAAwD;AACxD,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK5D,CAAC;AAEF,UAAU,qBAAqB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AAErG;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,qBAAqB,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,kBAAkB,EAAE,CAatK;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAEjE;AAED,MAAM,WAAW,mBAAmB;IAAG,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAEjJ,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAGlF;AAED,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,EAAE,CAOhH;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAElE"}

package/dist/harness/gates/journey-gate-inputs.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OBLIGATION_RULE = void 0;
+exports.readJourneyAudit = readJourneyAudit;
+exports.applyAuditOverrides = applyAuditOverrides;
+exports.ignoredOverrideText = ignoredOverrideText;
+exports.unitOverrides = unitOverrides;
+exports.journeyDecisionFindings = journeyDecisionFindings;
+exports.decisionFindingText = decisionFindingText;
+/**
+ * What the journey board and `runGate` take from the gate registry (OES-11.2/11.4, phase-03 review).
+ *
+ *   readJourneyAudit       the audit report, read through the T3 checks — a stale or untrusted one
+ *                          counts as never audited
+ *   applyAuditOverrides    an OB-* whose rule the AUDIT recorded as overridden is accepted
+ *                          (`overridden`); journey never re-applies an override itself (red-team #12)
+ *   journeyDecisionFindings the decision files in the unit's reach that do not verify, edits/deletes
+ *                          of committed entries (checkDecisionIntegrity), and rejected overrides — each
+ *                          a finding the board shows and the gate blocks on, never a crash
+ */
+const decision_integrity_check_1 = require("../../decisions/decision-integrity-check");
+const resolve_unit_1 = require("../../cli/resolve-unit");
+const audit_report_verification_1 = require("./audit-report-verification");
+const unit_gate_overrides_1 = require("./unit-gate-overrides");
+function readJourneyAudit(projectRoot, unit) {
+    const verification = (0, audit_report_verification_1.verifyAuditReport)(projectRoot, unit);
+    if ((0, audit_report_verification_1.auditCounts)(verification))
+        return { audit: verification.report, verification };
+    return {
+        audit: null,
+        verification,
+        ...(verification.state !== 'absent' ? { notCountedReason: (0, audit_report_verification_1.auditNotCountedReason)(verification, unit) } : {}),
+    };
+}
+/** The audit rule each design obligation stands for. */
+exports.OBLIGATION_RULE = {
+    'OB-spec': 'audit.spec-coverage',
+    'OB-coverage': 'audit.viewpoint-coverage',
+    'OB-depth': 'audit.assertion-depth',
+    'OB-trace': 'audit.taxonomy-mismatch',
+};
+/**
+ * Mark needs-work obligations whose rule the audit recorded as overridden (applied). audit.json is
+ * output too: an `applied` entry counts only when the same override (decision id AND rule) is in
+ * force for the unit today (review M3); the others are ignored and returned for the board.
+ */
+function applyAuditOverrides(obligations, audit, inForce) {
+    const recorded = (Array.isArray(audit.gateOverrides) ? audit.gateOverrides : [])
+        .filter((g) => g && g.status === 'applied');
+    const real = (g) => inForce.some((o) => o.decisionId === g.decisionId && o.rule === g.rule);
+    const applied = recorded.filter(real);
+    for (const ob of obligations) {
+        const o = applied.find((g) => g.rule === exports.OBLIGATION_RULE[ob.id]);
+        if (!o || ob.status !== 'needs-work')
+            continue;
+        ob.status = 'overridden';
+        ob.overriddenBy = o.decisionId;
+        ob.detail = `overridden by ${o.decisionId} (${o.rule} → ${o.severity}) — ${o.reason}. Was: ${ob.detail}`;
+    }
+    return recorded.filter((g) => !real(g));
+}
+function ignoredOverrideText(g) {
+    return `⚠️ audit.json says override ${String(g.decisionId)} (${String(g.rule)}) applied, but it is not in force for this unit — ignored. Re-run the audit; never edit its report.`;
+}
+function unitOverrides(projectRoot, unit) {
+    const found = (0, resolve_unit_1.resolveUnitCandidates)(unit, projectRoot);
+    return (0, unit_gate_overrides_1.loadUnitGateOverrides)(projectRoot, found.length === 1 ? (0, unit_gate_overrides_1.unitScopeOfDir)(projectRoot, found[0].dir) : null);
+}
+/** Integrity of every decision in the unit's reach (project + unit dirs) plus its rejected overrides. */
+function journeyDecisionFindings(projectRoot, overrides) {
+    const reach = ['qa/decisions/', ...(overrides.unitScope ? [`qa/${overrides.unitScope}/decisions/`] : [])];
+    const integrity = (0, decision_integrity_check_1.checkDecisionIntegrity)(projectRoot)
+        .filter((f) => reach.some((r) => f.path.startsWith(r)))
+        .map((f) => ({ rule: f.rule, path: f.path, message: f.message }));
+    const rejected = overrides.rejected.map((r) => ({ rule: 'gate.override-rejected', path: r.path, message: `${r.decisionId}: ${r.reason}` }));
+    return [...integrity, ...rejected];
+}
+function decisionFindingText(f) {
+    return `⛔ ${f.rule}: ${f.path} — ${f.message}. Hard rule: restore the file from git, or record a superseding decision on a terminal.`;
+}
+//# sourceMappingURL=journey-gate-inputs.js.map

package/dist/harness/gates/journey-gate-inputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journey-gate-inputs.js","sourceRoot":"","sources":["../../../src/harness/gates/journey-gate-inputs.ts"],"names":[],"mappings":";;;AAyBA,4CAQC;AAiBD,kDAaC;AAED,kDAEC;AAID,sCAGC;AAGD,0DAOC;AAED,kDAEC;AAxFD;;;;;;;;;;GAUG;AACH,uFAAkF;AAClF,yDAA+D;AAC/D,2EAAuH;AAGvH,+DAAiG;AASjG,SAAgB,gBAAgB,CAAC,WAAmB,EAAE,IAAY;IAChE,MAAM,YAAY,GAAG,IAAA,6CAAiB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAA,uCAAW,EAAC,YAAY,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;IACnF,OAAO;QACL,KAAK,EAAE,IAAI;QACX,YAAY;QACZ,GAAG,CAAC,YAAY,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAA,iDAAqB,EAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5G,CAAC;AACJ,CAAC;AAED,wDAAwD;AAC3C,QAAA,eAAe,GAAqC;IAC/D,SAAS,EAAE,qBAAqB;IAChC,aAAa,EAAE,0BAA0B;IACzC,UAAU,EAAE,uBAAuB;IACnC,UAAU,EAAE,yBAAyB;CACtC,CAAC;AAIF;;;;GAIG;AACH,SAAgB,mBAAmB,CAAkC,WAAgB,EAAE,KAA8B,EAAE,OAAyB;IAC9I,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACzH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAe,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,YAAY;YAAE,SAAS;QAC/C,EAAE,CAAC,MAAM,GAAG,YAAY,CAAC;QACzB,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC;QAC/B,EAAE,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,MAAM,EAAE,CAAC;IAC3G,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,mBAAmB,CAAC,CAAqB;IACvD,OAAO,+BAA+B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,qGAAqG,CAAC;AACrL,CAAC;AAID,SAAgB,aAAa,CAAC,WAAmB,EAAE,IAAY;IAC7D,MAAM,KAAK,GAAG,IAAA,oCAAqB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,IAAA,2CAAqB,EAAC,WAAW,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,oCAAc,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnH,CAAC;AAED,yGAAyG;AACzG,SAAgB,uBAAuB,CAAC,WAAmB,EAAE,SAA4B;IACvF,MAAM,KAAK,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1G,MAAM,SAAS,GAA0B,IAAA,iDAAsB,EAAC,WAAW,CAAC;SACzE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,QAAQ,GAA0B,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACnK,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,mBAAmB,CAAC,CAAsB;IACxD,OAAO,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,yFAAyF,CAAC;AACxI,CAAC"}

package/dist/harness/gates/migrated-waiver-review.d.ts

@@ -0,0 +1,6 @@
+import type { ReadDecision } from '../../decisions/read-decisions';
+/** When a migrated waiver's legacy record was committed, or null when nothing in git HEAD vouches for it. */
+export declare function migratedWaiverReviewedAt(projectRoot: string, scope: string, e: ReadDecision): string | null;
+/** When a decision file first appeared: its first commit, else its creation (or last change) on disk. */
+export declare function decisionFirstSeenMs(projectRoot: string, rel: string, abs: string): number;
+//# sourceMappingURL=migrated-waiver-review.d.ts.map

package/dist/harness/gates/migrated-waiver-review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrated-waiver-review.d.ts","sourceRoot":"","sources":["../../../src/harness/gates/migrated-waiver-review.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AA6BnE,6GAA6G;AAC7G,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAY3G;AAED,yGAAyG;AACzG,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAIzF"}

package/dist/harness/gates/migrated-waiver-review.js

@@ -0,0 +1,116 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migratedWaiverReviewedAt = migratedWaiverReviewedAt;
+exports.decisionFirstSeenMs = decisionFirstSeenMs;
+/**
+ * When a MIGRATED waiver was reviewed (DOS-13.5, phase 09) — for `decision.in-run`.
+ *
+ * The import (legacy-waiver-migration.ts) trusts a legacy waiver only when git HEAD's
+ * `.sungen/journey/<slug>.state.json` holds that exact record; its review was the commit that put the
+ * record there. So a migrated decision is judged by THAT commit, not by its own file:
+ *
+ *   vouched   HEAD's state file holds the record (same reason, `at`, auditHashAtWaive) — reviewedAt is
+ *             the commit time of the oldest commit in the unbroken run, back from HEAD, that holds it
+ *   with a run start   in-run when reviewedAt is after it (the same test as any committed decision)
+ *   without one        in-run when reviewedAt is after the decision file first appeared (its first
+ *             commit, else its creation time): a genuine import always follows the commit it read
+ * Anything else — no git, no such record in HEAD, a record that differs — is not vouched for: the
+ * decision is judged as any other (`not in git HEAD`, or its own commit time).
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const git_head_trust_1 = require("../../decisions/git-head-trust");
+const waiver_decisions_1 = require("../../decisions/waiver-decisions");
+const unit_paths_1 = require("../unit-paths");
+/** Commits of one state file the walk reads at most (each is one `git show`). */
+const MAX_COMMITS = 200;
+const parse = (text) => {
+    if (text === null)
+        return null;
+    try {
+        return JSON.parse(text.replace(/^/, ''));
+    }
+    catch {
+        return null;
+    }
+};
+function holds(state, e, ob) {
+    const w = state?.waivers?.[ob];
+    return (0, waiver_decisions_1.isLegacyWaiver)(w) && w.at === e.valid_from && (0, waiver_decisions_1.sameWaiver)(w, (0, waiver_decisions_1.asLegacyWaiver)(e));
+}
+/** The commit time of the oldest commit, in the unbroken run back from HEAD, whose state file holds the record. */
+function introducedAt(projectRoot, rel, e, ob) {
+    const log = (0, git_head_trust_1.gitOutput)(projectRoot, ['log', `--max-count=${MAX_COMMITS}`, '--format=%H %cI', '--', rel]) ?? '';
+    let oldest = null;
+    for (const line of log.split('\n').filter(Boolean)) {
+        const [sha, at] = line.split(' ');
+        if (!holds(parse((0, git_head_trust_1.gitOutput)(projectRoot, ['show', `${sha}:./${rel}`])), e, ob))
+            break;
+        oldest = at;
+    }
+    return oldest && !Number.isNaN(Date.parse(oldest)) ? oldest : null;
+}
+/** When a migrated waiver's legacy record was committed, or null when nothing in git HEAD vouches for it. */
+function migratedWaiverReviewedAt(projectRoot, scope, e) {
+    const ob = e.payload?.obligation;
+    if (e.kind !== 'waiver' || e.source?.where !== 'migrated' || typeof ob !== 'string')
+        return null;
+    // The journey keys its state by the unit name it was given: `<name>`, or the catalog id for api units.
+    const slugs = new Set([scope.split('/').pop() ?? '', (0, unit_paths_1.reportSlug)(scope.replace(/^(screens|flows)\//, ''))]);
+    for (const slug of slugs) {
+        const file = path.join(projectRoot, '.sungen', 'journey', `${slug}.state.json`);
+        if (!holds(parse((0, git_head_trust_1.committedText)(projectRoot, file)), e, ob))
+            continue;
+        const at = introducedAt(projectRoot, path.relative(projectRoot, file).split(path.sep).join('/'), e, ob);
+        if (at)
+            return at;
+    }
+    return null;
+}
+/** When a decision file first appeared: its first commit, else its creation (or last change) on disk. */
+function decisionFirstSeenMs(projectRoot, rel, abs) {
+    const added = (0, git_head_trust_1.gitOutput)(projectRoot, ['log', '--diff-filter=A', '--format=%cI', '--', rel])?.trim().split('\n').filter(Boolean).pop();
+    if (added && !Number.isNaN(Date.parse(added)))
+        return Date.parse(added);
+    try {
+        const s = fs.statSync(abs);
+        return s.birthtimeMs || s.mtimeMs;
+    }
+    catch {
+        return Number.NEGATIVE_INFINITY;
+    }
+}
+//# sourceMappingURL=migrated-waiver-review.js.map

package/dist/harness/gates/migrated-waiver-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrated-waiver-review.js","sourceRoot":"","sources":["../../../src/harness/gates/migrated-waiver-review.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,4DAYC;AAGD,kDAIC;AAnED;;;;;;;;;;;;;;GAcG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,mEAA0E;AAE1E,uEAA8F;AAC9F,8CAA2C;AAE3C,iFAAiF;AACjF,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAgD,EAAE;IAClF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,SAAS,KAAK,CAAC,KAAmD,EAAE,CAAe,EAAE,EAAU;IAC7F,MAAM,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/B,OAAO,IAAA,iCAAc,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,IAAI,IAAA,6BAAU,EAAC,CAAC,EAAE,IAAA,iCAAc,EAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,mHAAmH;AACnH,SAAS,YAAY,CAAC,WAAmB,EAAE,GAAW,EAAE,CAAe,EAAE,EAAU;IACjF,MAAM,GAAG,GAAG,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,eAAe,WAAW,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9G,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAAE,MAAM;QACrF,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,6GAA6G;AAC7G,SAAgB,wBAAwB,CAAC,WAAmB,EAAE,KAAa,EAAE,CAAe;IAC1F,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC;IACjC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,UAAU,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjG,uGAAuG;IACvG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAA,uBAAU,EAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAA,8BAAa,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAAE,SAAS;QACrE,MAAM,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxG,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yGAAyG;AACzG,SAAgB,mBAAmB,CAAC,WAAmB,EAAE,GAAW,EAAE,GAAW;IAC/E,MAAM,KAAK,GAAG,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IACtI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAAC,CAAC;AACnH,CAAC"}

package/dist/harness/gates/resolve-rule.d.ts

@@ -0,0 +1,59 @@
+/**
+ * One `resolveRule` (OES-11.2). Code keeps computing a gate's CONDITION; what the condition costs —
+ * its severity, and whether that blocks — comes from here and nowhere else, so audit, sensors,
+ * script-check, matrix gates and journey cannot disagree about a rule (red-team #12).
+ *
+ * Two axes, never merged (takumi T5):
+ *   block vs advisory   follows severity — error|review block; warning|info|off never block
+ *   overridable or not  follows kind     — a hard rule ignores every override
+ * With no override in force the result IS the catalog row, which equals today's behavior.
+ */
+import { DecisionVisibility } from '../../decisions/decision-schema';
+import { GateKind, GateSeverity, listRules } from './gate-rule-catalog';
+export type OverrideSeverity = 'warning' | 'info' | 'off';
+export type ResolvedSeverity = GateSeverity | 'off';
+/** A gate-override decision that passed validation and is in force for one unit. */
+export interface ActiveOverride {
+    decisionId: string;
+    rule: string;
+    severity: OverrideSeverity;
+    scope: string;
+    reason: string;
+    visibility: DecisionVisibility;
+    by: string;
+    validFrom: string;
+    path: string;
+    /** In git HEAD? null outside git. An uncommitted override still counts here, but release refuses it (decision.in-run). */
+    committed: boolean | null;
+}
+export interface GateRuleContext {
+    /** rule id → the override in force for the unit being judged. */
+    overrides: ReadonlyMap<string, ActiveOverride>;
+}
+export declare const NO_OVERRIDES: GateRuleContext;
+export interface ResolvedRule {
+    id: string;
+    severity: ResolvedSeverity;
+    catalogSeverity: GateSeverity;
+    kind: GateKind;
+    blocking: boolean;
+    /** The decision id of the override that set `severity`, when one did. */
+    overriddenBy?: string;
+}
+export declare const isBlockingSeverity: (s: ResolvedSeverity) => boolean;
+export declare function resolveRule(id: string, ctx?: GateRuleContext): ResolvedRule;
+export { listRules };
+/** What a gate site holds: resolve a rule whose condition it found met. */
+export interface GateRules {
+    resolve(id: string): ResolvedRule;
+}
+/** The catalog alone — today's behavior; the default wherever no unit context is known. */
+export declare const CATALOG_GATE_RULES: GateRules;
+export interface TrackedGateRules extends GateRules {
+    readonly context: GateRuleContext;
+    /** Rules whose override changed an outcome during this evaluation. */
+    triggered(): ReadonlySet<string>;
+}
+/** Resolve against one unit's overrides and remember which of them actually changed something. */
+export declare function trackGateRules(context: GateRuleContext): TrackedGateRules;
+//# sourceMappingURL=resolve-rule.d.ts.map

package/dist/harness/gates/resolve-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-rule.d.ts","sourceRoot":"","sources":["../../../src/harness/gates/resolve-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAY,SAAS,EAAY,MAAM,qBAAqB,CAAC;AAE5F,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,KAAK,CAAC;AAEpD,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,kBAAkB,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,0HAA0H;IAC1H,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAChD;AAED,eAAO,MAAM,YAAY,EAAE,eAAiF,CAAC;AAE7G,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE,YAAY,CAAC;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB,GAAI,GAAG,gBAAgB,KAAG,OAA0C,CAAC;AAQpG,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,eAA8B,GAAG,YAAY,CAOzF;AAED,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,2EAA2E;AAC3E,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,CAAC;CACnC;AAED,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,EAAE,SAAqF,CAAC;AAEvH,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,sEAAsE;IACtE,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,gBAAgB,CAWzE"}

package/dist/harness/gates/resolve-rule.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CATALOG_GATE_RULES = exports.listRules = exports.isBlockingSeverity = exports.NO_OVERRIDES = void 0;
+exports.resolveRule = resolveRule;
+exports.trackGateRules = trackGateRules;
+const gate_rule_catalog_1 = require("./gate-rule-catalog");
+Object.defineProperty(exports, "listRules", { enumerable: true, get: function () { return gate_rule_catalog_1.listRules; } });
+exports.NO_OVERRIDES = Object.freeze({ overrides: new Map() });
+const isBlockingSeverity = (s) => s === 'error' || s === 'review';
+exports.isBlockingSeverity = isBlockingSeverity;
+/** Whether an override may apply to this rule at all (defense in depth behind validation). */
+function admissible(rule, o) {
+    if (!o || rule.kind === 'hard')
+        return false;
+    return o.severity !== 'off' || rule.offAllowed;
+}
+function resolveRule(id, ctx = exports.NO_OVERRIDES) {
+    const rule = (0, gate_rule_catalog_1.gateRule)(id);
+    const o = ctx.overrides.get(id);
+    if (!admissible(rule, o)) {
+        return { id, severity: rule.severity, catalogSeverity: rule.severity, kind: rule.kind, blocking: (0, exports.isBlockingSeverity)(rule.severity) };
+    }
+    return { id, severity: o.severity, catalogSeverity: rule.severity, kind: rule.kind, blocking: (0, exports.isBlockingSeverity)(o.severity), overriddenBy: o.decisionId };
+}
+/** The catalog alone — today's behavior; the default wherever no unit context is known. */
+exports.CATALOG_GATE_RULES = Object.freeze({ resolve: (id) => resolveRule(id, exports.NO_OVERRIDES) });
+/** Resolve against one unit's overrides and remember which of them actually changed something. */
+function trackGateRules(context) {
+    const fired = new Set();
+    return {
+        context,
+        resolve(id) {
+            const r = resolveRule(id, context);
+            if (r.overriddenBy)
+                fired.add(id);
+            return r;
+        },
+        triggered: () => fired,
+    };
+}
+//# sourceMappingURL=resolve-rule.js.map

package/dist/harness/gates/resolve-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-rule.js","sourceRoot":"","sources":["../../../src/harness/gates/resolve-rule.ts"],"names":[],"mappings":";;;AAwDA,kCAOC;AAmBD,wCAWC;AAlFD,2DAA4F;AAsDnF,0FAtDkC,6BAAS,OAsDlC;AA7BL,QAAA,YAAY,GAAoB,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,GAAG,EAA0B,EAAE,CAAC,CAAC;AAYtG,MAAM,kBAAkB,GAAG,CAAC,CAAmB,EAAW,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ,CAAC;AAAvF,QAAA,kBAAkB,sBAAqE;AAEpG,8FAA8F;AAC9F,SAAS,UAAU,CAAC,IAAc,EAAE,CAA6B;IAC/D,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC;AACjD,CAAC;AAED,SAAgB,WAAW,CAAC,EAAU,EAAE,MAAuB,oBAAY;IACzE,MAAM,IAAI,GAAG,IAAA,4BAAQ,EAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAA,0BAAkB,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvI,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAA,0BAAkB,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;AAC7J,CAAC;AASD,2FAA2F;AAC9E,QAAA,kBAAkB,GAAc,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,oBAAY,CAAC,EAAE,CAAC,CAAC;AAQvH,kGAAkG;AAClG,SAAgB,cAAc,CAAC,OAAwB;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO;QACL,OAAO;QACP,OAAO,CAAC,EAAU;YAChB,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,YAAY;gBAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC"}

package/dist/harness/gates/unit-gate-overrides.d.ts

@@ -0,0 +1,25 @@
+import { DecisionProblem } from '../../decisions/decision-file';
+import { ReadDecision } from '../../decisions/read-decisions';
+import { ActiveOverride, GateRuleContext } from './resolve-rule';
+export interface OverrideIssue {
+    decisionId: string;
+    path: string;
+    rule?: string;
+    reason: string;
+    entry: ReadDecision;
+    committed: boolean | null;
+}
+export interface UnitGateOverrides {
+    unitScope: string | null;
+    context: GateRuleContext;
+    inForce: ActiveOverride[];
+    rejected: OverrideIssue[];
+    ineffective: OverrideIssue[];
+    /** Files in the two directories that do not verify (DOS-13.3) — reported, never skipped. */
+    problems: DecisionProblem[];
+    decisionsHash: string;
+}
+/** The decision scope of a unit directory (`screens/login`, `api/flows/signup`), or null. */
+export declare function unitScopeOfDir(projectRoot: string, unitDir: string): string | null;
+export declare function loadUnitGateOverrides(projectRoot: string, unitScope: string | null): UnitGateOverrides;
+//# sourceMappingURL=unit-gate-overrides.d.ts.map

package/dist/harness/gates/unit-gate-overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-gate-overrides.d.ts","sourceRoot":"","sources":["../../../src/harness/gates/unit-gate-overrides.ts"],"names":[],"mappings":"AAWA,OAAO,EAA+B,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAiB,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAIjE,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,4FAA4F;IAC5F,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlF;AAYD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,CA4CtG"}