@tiphys/kernel 0.0.0 → 0.1.0

package/schemas/gate-registry.schema.json

@@ -0,0 +1,260 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/gate-registry.schema.json",
+  "title": "Tiphys canonical gate registry",
+  "$comment": "R-094: the canonical list of gates per assurance mode, intended as the single source consumed by CI and by the role briefs. As delivered by M3-P2 the BRIEFS half is real (CLAUDE.md's gate section is rendered from the registry) and the CI half is not (CI invokes the runner with --manifest gates.manifest.json); gate-registry.yaml's own header states the divergence and test/gate-registry.test.ts asserts it in both directions. Kernel plan M3, M3-P2 step 2. A SUPERSET of the M2-P1 gate manifest (src/gates/schemas/gate-manifest.schema.json): every field that schema defines is defined here with the same meaning, and this document adds four, `modes` (made live from the field M2 reserved), `events`, `verified-by` and `probe`, plus the top-level `preflight` list. SC-011 is carried over unchanged: a gate whose precondition is unmet reports not-applicable and NEVER green.",
+  "description": "One registry per repository. Which gates exist, how each is invoked, which assurance modes select it, which CI events evaluate it, whether a script or a clean-room checklist probe verifies it, and which commands can destroy work.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["kind", "version", "preflight", "gates", "destructiveCommands"],
+  "properties": {
+    "kind": {
+      "description": "The artifact type, so `tiphys validate --type auto` resolves this document without being told. Every M3-P1 artifact type carries one and this mirrors them.",
+      "type": "string",
+      "const": "gate-registry"
+    },
+    "note": {
+      "description": "Free prose for the registry's own readers.",
+      "type": "string"
+    },
+    "version": {
+      "$comment": "A closed set rather than a minimum, because the authoring vocabulary of schemas/README.md has no `minimum` keyword and a bare `type: integer` would admit 0 and negatives.",
+      "type": "integer",
+      "enum": [1]
+    },
+    "preflight": {
+      "$comment": "R-094. The ordered local commands every change must pass before any registry gate means anything. They live IN the registry rather than beside it because CLAUDE.md's gate section is rendered from this document IN FULL (M3-P2 criterion 6, scripts/render-agent-rules-gates.mjs), and a step left outside the registry would be exactly the hand-maintained gate list criterion 6 forbids.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/preflightStep"
+      }
+    },
+    "gates": {
+      "description": "Append-only registry keyed by id. No minItems, matching the M2 manifest: a registry with zero gates must reach the runner and be reported as no applicable gate, not rejected at load.",
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/gate"
+      }
+    },
+    "destructiveCommands": {
+      "description": "CLI commands and module paths whose operations can destroy work. Carried over from the M2 manifest unchanged; M2-P2 rule (e) DERIVES a witness class from it rather than trusting an implementer's declaration.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "$defs": {
+    "commandArray": {
+      "description": "argv array. The runner appends --result and --evidence, plus one flag per declared parameter. Defined once in $defs because strict mode requires every `required` name to be declared in `properties` at the SAME level, so the conditional rules below must restate it and a second copy of the constraint would be a second thing to keep in sync.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string"
+      }
+    },
+    "probeId": {
+      "description": "The checklist probe id M3-P7 must supply. Required exactly when verified-by is clean-room-checklist.",
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$"
+    },
+    "preflightStep": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["command", "note"],
+      "properties": {
+        "command": {
+          "description": "argv array, run in the repository root.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "note": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "gate": {
+      "$comment": "THREE conditional rules, chained through $ref rather than stacked in one object, because JSON Schema allows one `if`/`then` pair per schema object and `allOf` is outside the authoring vocabulary of schemas/README.md. Each link adds exactly one rule and each rule has its own acceptance criterion. This link: M3-P2 criterion 4. A gate declared `conditional` is one that MAY report not-applicable, and SC-011 says not-applicable ASSERTS an evaluated, unmet precondition; a conditional gate with no precondition can therefore report not-applicable with nothing evaluated, which is the vacuous pass this registry exists to make impossible. `deploy` and `migrations` are the two conditional entries this rule binds.",
+      "$ref": "#/$defs/gateProbeRule",
+      "if": {
+        "type": "object",
+        "required": ["applicability"],
+        "properties": {
+          "applicability": {
+            "const": "conditional"
+          }
+        }
+      },
+      "then": {
+        "type": "object",
+        "required": ["precondition"],
+        "properties": {
+          "precondition": {
+            "$ref": "#/$defs/precondition"
+          }
+        }
+      }
+    },
+    "gateProbeRule": {
+      "$comment": "M3-P2 criterion 2. A clean-room-checklist entry with no probe names no question, so nothing can ever verify it and the entry is a gate id with nothing behind it. D-11 settles that R-043 and R-044 are verified this way.",
+      "$ref": "#/$defs/gateCommandRule",
+      "if": {
+        "type": "object",
+        "required": ["verified-by"],
+        "properties": {
+          "verified-by": {
+            "const": "clean-room-checklist"
+          }
+        }
+      },
+      "then": {
+        "type": "object",
+        "required": ["probe"],
+        "properties": {
+          "probe": {
+            "$ref": "#/$defs/probeId"
+          }
+        }
+      }
+    },
+    "gateCommandRule": {
+      "$comment": "A `script` gate is verified by running a process, so it must say which one. A `clean-room-checklist` gate has no process and carries no command, which is why `command` is not in the base required list.",
+      "$ref": "#/$defs/gateShape",
+      "if": {
+        "type": "object",
+        "required": ["verified-by"],
+        "properties": {
+          "verified-by": {
+            "const": "script"
+          }
+        }
+      },
+      "then": {
+        "type": "object",
+        "required": ["command"],
+        "properties": {
+          "command": {
+            "$ref": "#/$defs/commandArray"
+          }
+        }
+      }
+    },
+    "gateShape": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "unitLabel", "applicability", "verified-by", "modes", "events"],
+      "properties": {
+        "$comment": {
+          "description": "Clause ids this entry discharges, per schemas/README.md.",
+          "type": "string"
+        },
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        },
+        "command": {
+          "$ref": "#/$defs/commandArray"
+        },
+        "unitLabel": {
+          "type": "string",
+          "minLength": 1
+        },
+        "applicability": {
+          "description": "required: an unmet precondition fails the run. conditional: an unmet precondition does not.",
+          "type": "string",
+          "enum": ["required", "conditional"]
+        },
+        "verified-by": {
+          "$comment": "D-11. R-043 and R-044 are not reliably computable from a diff, so their gate is a clean-room checklist probe rather than a script, and the registry SAYS which of the two a reader is looking at instead of leaving it to be inferred from whether a command happens to be present.",
+          "type": "string",
+          "enum": ["script", "clean-room-checklist"]
+        },
+        "probe": {
+          "$ref": "#/$defs/probeId"
+        },
+        "modes": {
+          "$comment": "The field the M2 manifest schema RESERVED (src/gates/schemas/gate-manifest.schema.json line 70, validated if present and ignored by the M2 runner), made LIVE here. Blueprint section 5: the canonical list of gates PER ASSURANCE MODE. The item enum is the three mode ids M3-P3 defines.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": ["full", "direct-pr", "local-only"]
+          }
+        },
+        "events": {
+          "$comment": "T-009, D-M3-34. A gate result is evidence only for the configuration that produced it, and this repository's workflow runs DIFFERENT bundles on `pull_request` and on `push` to `main`. An entry that does not say which events evaluate it carries a claim nobody can check. For every entry PROMOTED from gates.manifest.json the value is derived from the two bundle definitions in scripts/m2-exit-test.sh and never assigned by judgment; for an entry that is not in that manifest it is derived from whatever mechanism does evaluate it, which for agent-rules-drift is a workflow step carrying no `if:`. Both derivations are asserted in test/gate-registry.test.ts.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": ["pull_request", "push"]
+          }
+        },
+        "parameters": {
+          "description": "Run parameters this gate's command REQUIRES. Declared rather than inferred. An absent declared parameter makes the gate error, never not-applicable (M2-C-3).",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["base", "head", "phase"]
+          }
+        },
+        "precondition": {
+          "$ref": "#/$defs/precondition"
+        }
+      }
+    },
+    "precondition": {
+      "$comment": "SC-011, carried over from the M2-P1 manifest schema UNCHANGED, field for field. A gate whose precondition is unmet reports not-applicable and never green; not-applicable ASSERTS that a precondition was evaluated and found unmet.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "kind"],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "kind": {
+          "description": "The closed set. Kind-specific required fields are checked by src/gates/manifest.ts, which emits the same INVALID <pointer> <message> diagnostics.",
+          "type": "string",
+          "enum": [
+            "file-exists",
+            "file-absent",
+            "branch-matches",
+            "diff-touches",
+            "command-exit-zero"
+          ]
+        },
+        "path": {
+          "description": "file-exists and file-absent.",
+          "type": "string"
+        },
+        "pattern": {
+          "description": "branch-matches. A JavaScript regular expression source that is ANCHORED: it is compiled as ^(?:<pattern>)$ and must match the WHOLE branch name. The token {phase} is replaced by the --phase value, REGEX-ESCAPED.",
+          "type": "string"
+        },
+        "paths": {
+          "description": "diff-touches. Path prefixes; the precondition is met when the diff changes a path under any of them.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "command": {
+          "description": "command-exit-zero. argv array, run in the runner's working directory.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/mechanism-index.schema.json

@@ -0,0 +1,94 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/mechanism-index.schema.json",
+  "title": "Tiphys mechanism index",
+  "$comment": "Kernel plan M3, M3-P6 criterion 8 and D-M3-23. T-005's structural consequence: a rule M1-P3 paid for in a multi-hour investigation did not reach M1-P5, which reimplemented the same claim-file mechanism silently and produced the most severe defect found in M1. The implementer there had read the plan, the agent-rules file, the constraint list, the environment warnings and three work histories, and NONE of them carried the rule, because a rule about a MECHANISM has no home in a document organised by phase. This document is that home. THE SCHEMA SHIPS HERE AND THE GENERATOR SHIPS AT M3-P8, which is the only forward reference in M3-P6 and is why D-M3-23 exists: M3-P8 EDITS this document to add `machine-readable-form` and does not create it. WHAT THIS SCHEMA CANNOT DO. It cannot tell a rule from a platitude: `rule` is a string, and whether its text is something an implementer can obey or a sentiment they can agree with is judgment. It cannot check that `evidence[]` resolves; entries are prose citations of artifacts that may live in delivery/, which the kernel does not ship, so resolution is not computable from an installed package. And it cannot tell whether the index is COMPLETE, which is the property M3-P6's registered superset test and M3-P8 criterion 4c cover from the two ends.",
+  "description": "One document per project. Every mechanism this project has already learned something about, the rule that learning established, the sibling implementations that share the mechanism, and the artifacts that paid for it. Read the row before you use the mechanism.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["kind", "version", "mechanisms"],
+  "properties": {
+    "kind": {
+      "type": "string",
+      "const": "mechanism-index"
+    },
+    "version": {
+      "$comment": "Document format version, not a project version. A closed set rather than a minimum, for the reason schemas/gate-registry.schema.json:21 already records: the authoring vocabulary has no `minimum` keyword, so a bare `type: integer` would admit 0 and negatives.",
+      "type": "integer",
+      "enum": [1]
+    },
+    "supersedes": {
+      "$comment": "The interim artifact this index replaces, by path, when there is one. Carried so a reader of the index can find what it was converted FROM, and so M3-P8's generated projection can be checked against the same source rather than against a memory of it. Optional: a project with no interim file omits it.",
+      "type": "string",
+      "minLength": 1,
+      "pattern": "\\S"
+    },
+    "mechanisms": {
+      "$comment": "minItems 1, because an index with no mechanisms is a file that satisfies every lookup obligation by having nothing to look up. That is the third row of M3-P6's own hazard table ('the index it names is the stub nobody replaced'), and the schema closes the degenerate end of it; the other end is the registered superset test, which no schema can express.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["key", "name", "rule", "evidence"],
+        "properties": {
+          "key": {
+            "$comment": "The stable id, and the thing a citation elsewhere names. DERIVED FROM `name` rather than invented: lowercase, every run of characters outside [a-z0-9] replaced by a single hyphen, leading and trailing hyphens removed. M3-P6's registered test applies that derivation to `name` and compares, so a key that drifts from its name is red rather than merely odd. Ids are never renumbered and a retired key is never reused, which is the rule CLAUDE.md's identifier-schemes section states for every scheme in this project.",
+            "type": "string",
+            "minLength": 1,
+            "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
+          },
+          "name": {
+            "$comment": "The mechanism in the words a reader would search for. For a row converted from an interim index, this is the interim table's own first column VERBATIM, which is what makes the conversion checkable against the file it came from instead of against a paraphrase of it.",
+            "type": "string",
+            "minLength": 1,
+            "pattern": "\\S"
+          },
+          "rule": {
+            "$comment": "What this project learned, stated as something to DO or NOT DO. Not a description of the mechanism: an implementer who reads this row and changes nothing has read a description, and the row has failed.",
+            "type": "string",
+            "minLength": 1,
+            "pattern": "\\S"
+          },
+          "siblings": {
+            "$comment": "The other implementations that share this mechanism, by path. The `mechanism-sibling` clause in roles/implementer.md is the instruction that keeps this list current: a phase establishing a rule about a mechanism records it here AND names the siblings, because the recorded cost of not doing so is one silent reimplementation two phases later. Optional, and an EMPTY list is meaningful: it says the mechanism has exactly one implementation today.",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "\\S"
+            }
+          },
+          "machine-readable-form": {
+            "$comment": "ADDED BY M3-P8 (D-M3-23's forward reference, step 2). Where the SAME rule exists as data: a path plus the key inside it. The `destructive-git-operation` row is the worked example and the reason the field exists: its prose rule and the `destructiveCommands` list in `gates.manifest.json` are two views of one thing (M2 plan section 2 item 10), and a citation is what stops them drifting apart silently. PROJECTED, NEVER AUTHORED HERE: this document is generated from the tuition feed's `mechanisms[]` by `tiphys tuition index`, so the field is written in the entry that established the rule. The derived check mechanism-rule-evidence-resolves resolves both halves against the real document, so a key M2 renames reddens rather than rotting. Optional: most rules exist only as prose, which is a fact about the rule and not a defect.",
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["path", "key"],
+            "properties": {
+              "path": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "\\S"
+              },
+              "key": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "\\S"
+              }
+            }
+          },
+          "evidence": {
+            "$comment": "What paid for the rule: a defect, a fix round, an investigation, a review finding, a tuition entry. minItems 1 is the load-bearing constraint of this whole document. The interim index states it in prose ('a rule with no citation is not a rule'), and prose is what this project has recorded three times as not surviving; here it is a validation failure.",
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "\\S"
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/plan.schema.json

@@ -0,0 +1,300 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tiphys.dev/schemas/plan.schema.json",
+  "title": "Tiphys delivery plan",
+  "description": "The plan artifact of the orchestrated delivery process, section 1c. Kernel plan M3, M3-P1 step 2. Every object level sets additionalProperties: false, so a misspelled property is a failure and never a silently ignored field (criterion 5).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "kind",
+    "status",
+    "baseline-commit",
+    "binding-rule",
+    "process-summary",
+    "standing-context",
+    "report-code-disagreement",
+    "phases",
+    "decisions",
+    "open-questions",
+    "parked"
+  ],
+  "properties": {
+    "kind": {
+      "$comment": "R-016. The discriminator tiphys validate --type auto reads.",
+      "type": "string",
+      "const": "plan"
+    },
+    "status": {
+      "type": "string",
+      "enum": ["draft", "approved", "superseded"]
+    },
+    "baseline-commit": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{7,40}$"
+    },
+    "binding-rule": {
+      "$comment": "R-017. A required const carrying the process document's exact sentence (delivery/intake/orchestrated-delivery-process.md section 1c), so a plan cannot ship a softened paraphrase of the rule that keeps ten agents from improvising.",
+      "type": "string",
+      "const": "If it is not written here, it is not being made. Unanswered questions go to the orchestrator."
+    },
+    "process-summary": {
+      "type": "string",
+      "minLength": 1
+    },
+    "standing-context": {
+      "$comment": "R-018. What previous runs bought, what is already fixed, what the deploy state is.",
+      "type": "string",
+      "minLength": 1
+    },
+    "report-code-disagreement": {
+      "$comment": "R-011, and the input to the derived check plan-verification-first-present. An entry with verified: false whose owning phase has no verification-first step makes the plan invalid; that is a foreign-key lookup across two arrays and is Kind B, in src/checks.ts.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["phase", "claim", "verified"],
+        "properties": {
+          "phase": {
+            "type": "string",
+            "pattern": "^M[0-9]+-P[0-9]+$"
+          },
+          "claim": {
+            "type": "string",
+            "minLength": 1
+          },
+          "verified": {
+            "type": "boolean"
+          }
+        }
+      }
+    },
+    "phases": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/phase"
+      }
+    },
+    "decisions": {
+      "$comment": "R-021. Every non-obvious call, numbered, so disagreement targets a number instead of re-litigating prose.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "statement"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^D-[0-9]+$"
+          },
+          "statement": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "open-questions": {
+      "$comment": "D-7 and SC-009: an open question IS a decision record with status open, so the plan carries references and never a second parallel register.",
+      "type": "array",
+      "items": {
+        "type": "string",
+        "pattern": "^DR-[0-9]{4}$"
+      }
+    },
+    "parked": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["item", "reason"],
+        "properties": {
+          "item": {
+            "type": "string",
+            "minLength": 1
+          },
+          "reason": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "phase": {
+      "$comment": "R-019 plus the blueprint section 5 superset (conflicts-with, parallelizable). A strict SUPERSET of the M2-P4 scope auditor's phase-declaration projection, which tiphys plan project emits (D-M3-18).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "branch",
+        "intent",
+        "grounding",
+        "severity",
+        "verified-root-cause",
+        "steps",
+        "files-to-touch",
+        "extras",
+        "acceptance",
+        "hazard-classes",
+        "migrations",
+        "conflicts-with",
+        "parallelizable",
+        "citations"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^M[0-9]+-P[0-9]+$"
+        },
+        "branch": {
+          "type": "string",
+          "pattern": "^claude/m[0-9]+-p[0-9]+-.+$"
+        },
+        "intent": {
+          "type": "string",
+          "minLength": 1
+        },
+        "grounding": {
+          "type": "string",
+          "minLength": 1
+        },
+        "severity": {
+          "type": "string",
+          "enum": ["low", "medium", "high", "critical"]
+        },
+        "verified-root-cause": {
+          "type": "string",
+          "minLength": 1
+        },
+        "steps": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["text"],
+            "properties": {
+              "text": {
+                "type": "string",
+                "minLength": 1
+              },
+              "kind": {
+                "$comment": "R-012. A step that confirms a claim before building on it. The derived check plan-verification-first-present requires one in any phase named by an unverified report-code-disagreement entry.",
+                "type": "string",
+                "const": "verification-first"
+              }
+            }
+          }
+        },
+        "files-to-touch": {
+          "$comment": "M2R-016. Literal paths, or literal directories with a trailing slash. A parenthetical gloss is permitted HERE, because this document is authored for humans; tiphys plan project strips it, and that stripping is the one place the plan's vocabulary and the auditor's meet.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "extras": {
+          "$comment": "Projected as declaredExtras. Required rather than optional because the scope auditor treats declaredExtras as required; the standing pre-authorized extras (test/behaviors.json and the phase work history) are added by the auditor itself and are never listed here.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "acceptance": {
+          "$comment": "R-019: falsifiable statements. minItems 1 because a phase with no acceptance criterion has declared nothing to walk.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "criterion"],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "criterion": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        },
+        "hazard-classes": {
+          "$comment": "T-007, D-M3-32 and D-M3-35. minItems 1 and NOT optional: an optional field is the version of this rule that did not survive. T-007 records a phase meeting fifteen of fifteen executed criteria while live-locking every supervision command, and the reviewer who found it differed in its BRIEF, not in its model. addressed-by is resolved by the derived check plan-hazard-classes-addressed-by-resolves (section 2.6).",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "statement", "addressed-by"],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "statement": {
+                "type": "string",
+                "minLength": 1
+              },
+              "addressed-by": {
+                "$comment": "Either `criterion <id>` naming a criterion in the SAME phase's acceptance list, or one of section 2.6's three admissible reasons with its named target. The pattern is the Kind A half; resolving the target is Kind B.",
+                "type": "string",
+                "pattern": "^(criterion .+|judgment-property-of-prose: .+|state-not-entered: .+|later-phase: M[0-9]+-P[0-9]+)$"
+              }
+            }
+          }
+        },
+        "migrations": {
+          "type": "string",
+          "minLength": 1
+        },
+        "conflicts-with": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "parallelizable": {
+          "type": "boolean"
+        },
+        "citations": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "fill-in": {
+          "$comment": "R-014. Present and unfilled means the phase is valid for REVIEW and invalid for DISPATCH. That is a computed property of the slots rather than of one field, so it is Kind B: the derived check plan-dispatchable reports it.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["filled", "root-cause", "fix-shape", "files"],
+          "properties": {
+            "filled": {
+              "type": "boolean"
+            },
+            "root-cause": {
+              "type": "string"
+            },
+            "fix-shape": {
+              "type": "string"
+            },
+            "files": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}