@webpieces/ai-hook-rules 0.4.737 → 0.4.738

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/ai-hook-rules",
-  "version": "0.4.737",
+  "version": "0.4.738",
   "description": "Pluggable write-time validation framework for AI coding agents (@webpieces/ai-hook-rules). Claude Code PreToolUse + openclaw before_tool_call adapters share one rule engine.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -25,7 +25,7 @@
     "directory": "packages/tooling/ai-hook-rules"
   },
   "dependencies": {
-    "@webpieces/rules-config": "0.4.737",
+    "@webpieces/rules-config": "0.4.738",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"
   },

package/src/core/excluded-paths.d.ts

@@ -0,0 +1,23 @@
+import { ExcludePaths } from '@webpieces/rules-config';
+import { EffectiveTree } from './effective-tree';
+import { GovernedPath } from './target-tree';
+import type { Rule } from './types';
+/**
+ * L1's FILTER — which rules have jurisdiction over one path — and the one helper that builds its
+ * argument for the bash surface.
+ *
+ * Lifted out of runner.ts, which the file-size rule had outgrown. It is a natural seam rather than a
+ * page-count fix: this is the only place `excludePaths` and the hard-coded `.webpieces/` skip are
+ * consulted, and runner.ts is otherwise the four tool ENTRY POINTS and their L0/L1 preamble.
+ */
+export declare function filterByExcludedPaths(rules: readonly Rule[], governed: GovernedPath, ex: ExcludePaths): readonly Rule[];
+/**
+ * The bash surface's GovernedPath, built from the tree EffectiveTreeResolver has already classified —
+ * so it costs no extra git call on the hook's blocking path.
+ *
+ * Both spellings of the command's effective cwd: relative to the governed root for the excludePaths
+ * globs, and relative to the OWNING tree for the `.webpieces/` skip — which for
+ * `cd <worktree>/.webpieces && …` is the worktree's state dir, not the primary's. Both are '' for a
+ * command with no leading `cd`, which matches no glob and is not the state dir.
+ */
+export declare function bashGovernedPath(tree: EffectiveTree, workspaceRoot: string): GovernedPath;

package/src/core/excluded-paths.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filterByExcludedPaths = filterByExcludedPaths;
+exports.bashGovernedPath = bashGovernedPath;
+const tslib_1 = require("tslib");
+const path = tslib_1.__importStar(require("path"));
+const rules_config_1 = require("@webpieces/rules-config");
+const load_rules_1 = require("./load-rules");
+const target_tree_1 = require("./target-tree");
+/**
+ * L1's FILTER — which rules have jurisdiction over one path — and the one helper that builds its
+ * argument for the bash surface.
+ *
+ * Lifted out of runner.ts, which the file-size rule had outgrown. It is a natural seam rather than a
+ * page-count fix: this is the only place `excludePaths` and the hard-coded `.webpieces/` skip are
+ * consulted, and runner.ts is otherwise the four tool ENTRY POINTS and their L0/L1 preamble.
+ */
+// Drop every rule excluded for this path (webpieces.config.json → excludePaths). ONE glob list: a path
+// listed there is hands-off for code-style rules and file-scoped guards alike, because webpieces either
+// governs a path or it does not. Per-rule carve-outs live in the rule's own `excludePaths`.
+// This is L1's FILTER (not a table row) — see guards/L1-location.md.
+//
+// It takes a GovernedPath and not a bare string because the two questions below are asked against
+// DIFFERENT roots, and answering both from the governed-root spelling is issue #851's secondary defect:
+// the excludePaths globs are authored against the governed root, while `.webpieces/` is the state dir OF
+// A TREE and a linked worktree has its own. One argument carrying both spellings is what stops a caller
+// picking the wrong one; see GovernedPath.
+// webpieces-disable no-function-outside-class -- L1's filter, a pure predicate over one path and one glob list; it is called from four module-scope entry points in runner.ts and a class here would be a namespace with no state
+function filterByExcludedPaths(rules, governed, ex) {
+    // webpieces' OWN gitignored state dir is never governed, config or no config. Ahead of the list on
+    // purpose — see isWebpiecesStateDir for why it is code and not a seeded glob. Asked about the
+    // OWNING tree's spelling, so `<primary>/.claude/worktrees/agent-X/.webpieces/...` is exempt for the
+    // identical reason `<primary>/.webpieces/...` is: nothing under it is tracked, reviewable or
+    // revertable in the tree it belongs to.
+    if ((0, rules_config_1.isWebpiecesStateDir)(governed.treeRelativePath))
+        return [];
+    if (ex.paths.some((p) => (0, load_rules_1.globMatches)(p, governed.relativePath)))
+        return [];
+    return rules;
+}
+/**
+ * The bash surface's GovernedPath, built from the tree EffectiveTreeResolver has already classified —
+ * so it costs no extra git call on the hook's blocking path.
+ *
+ * Both spellings of the command's effective cwd: relative to the governed root for the excludePaths
+ * globs, and relative to the OWNING tree for the `.webpieces/` skip — which for
+ * `cd <worktree>/.webpieces && …` is the worktree's state dir, not the primary's. Both are '' for a
+ * command with no leading `cd`, which matches no glob and is not the state dir.
+ */
+// webpieces-disable no-function-outside-class -- the bash-side constructor for the value above, beside it
+function bashGovernedPath(tree, workspaceRoot) {
+    return new target_tree_1.GovernedPath(path.relative(workspaceRoot, tree.effectiveCwd), path.relative(tree.root, tree.effectiveCwd));
+}
+//# sourceMappingURL=excluded-paths.js.map

package/src/core/excluded-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"excluded-paths.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/excluded-paths.ts"],"names":[],"mappings":";;AA6BA,sDASC;AAYD,4CAKC;;AAvDD,mDAA6B;AAE7B,0DAA4E;AAG5E,6CAA2C;AAC3C,+CAA6C;AAG7C;;;;;;;GAOG;AAEH,uGAAuG;AACvG,wGAAwG;AACxG,4FAA4F;AAC5F,qEAAqE;AACrE,EAAE;AACF,kGAAkG;AAClG,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AACxG,2CAA2C;AAC3C,kOAAkO;AAClO,SAAgB,qBAAqB,CAAC,KAAsB,EAAE,QAAsB,EAAE,EAAgB;IAClG,mGAAmG;IACnG,8FAA8F;IAC9F,oGAAoG;IACpG,6FAA6F;IAC7F,wCAAwC;IACxC,IAAI,IAAA,kCAAmB,EAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9D,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAW,EAAE,CAAC,IAAA,wBAAW,EAAC,CAAC,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5F,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,0GAA0G;AAC1G,SAAgB,gBAAgB,CAAC,IAAmB,EAAE,aAAqB;IACvE,OAAO,IAAI,0BAAY,CACnB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,EAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAC9C,CAAC;AACN,CAAC","sourcesContent":["import * as path from 'path';\n\nimport { ExcludePaths, isWebpiecesStateDir } from '@webpieces/rules-config';\n\nimport { EffectiveTree } from './effective-tree';\nimport { globMatches } from './load-rules';\nimport { GovernedPath } from './target-tree';\nimport type { Rule } from './types';\n\n/**\n * L1's FILTER — which rules have jurisdiction over one path — and the one helper that builds its\n * argument for the bash surface.\n *\n * Lifted out of runner.ts, which the file-size rule had outgrown. It is a natural seam rather than a\n * page-count fix: this is the only place `excludePaths` and the hard-coded `.webpieces/` skip are\n * consulted, and runner.ts is otherwise the four tool ENTRY POINTS and their L0/L1 preamble.\n */\n\n// Drop every rule excluded for this path (webpieces.config.json → excludePaths). ONE glob list: a path\n// listed there is hands-off for code-style rules and file-scoped guards alike, because webpieces either\n// governs a path or it does not. Per-rule carve-outs live in the rule's own `excludePaths`.\n// This is L1's FILTER (not a table row) — see guards/L1-location.md.\n//\n// It takes a GovernedPath and not a bare string because the two questions below are asked against\n// DIFFERENT roots, and answering both from the governed-root spelling is issue #851's secondary defect:\n// the excludePaths globs are authored against the governed root, while `.webpieces/` is the state dir OF\n// A TREE and a linked worktree has its own. One argument carrying both spellings is what stops a caller\n// picking the wrong one; see GovernedPath.\n// webpieces-disable no-function-outside-class -- L1's filter, a pure predicate over one path and one glob list; it is called from four module-scope entry points in runner.ts and a class here would be a namespace with no state\nexport function filterByExcludedPaths(rules: readonly Rule[], governed: GovernedPath, ex: ExcludePaths): readonly Rule[] {\n    // webpieces' OWN gitignored state dir is never governed, config or no config. Ahead of the list on\n    // purpose — see isWebpiecesStateDir for why it is code and not a seeded glob. Asked about the\n    // OWNING tree's spelling, so `<primary>/.claude/worktrees/agent-X/.webpieces/...` is exempt for the\n    // identical reason `<primary>/.webpieces/...` is: nothing under it is tracked, reviewable or\n    // revertable in the tree it belongs to.\n    if (isWebpiecesStateDir(governed.treeRelativePath)) return [];\n    if (ex.paths.some((p: string): boolean => globMatches(p, governed.relativePath))) return [];\n    return rules;\n}\n\n/**\n * The bash surface's GovernedPath, built from the tree EffectiveTreeResolver has already classified —\n * so it costs no extra git call on the hook's blocking path.\n *\n * Both spellings of the command's effective cwd: relative to the governed root for the excludePaths\n * globs, and relative to the OWNING tree for the `.webpieces/` skip — which for\n * `cd <worktree>/.webpieces && …` is the worktree's state dir, not the primary's. Both are '' for a\n * command with no leading `cd`, which matches no glob and is not the state dir.\n */\n// webpieces-disable no-function-outside-class -- the bash-side constructor for the value above, beside it\nexport function bashGovernedPath(tree: EffectiveTree, workspaceRoot: string): GovernedPath {\n    return new GovernedPath(\n        path.relative(workspaceRoot, tree.effectiveCwd),\n        path.relative(tree.root, tree.effectiveCwd),\n    );\n}\n"]}

package/src/core/l1-doc.js

@@ -93,8 +93,11 @@ function renderHead() {
         '',
         '',
         '**Code:** `packages/tooling/ai-hook-rules/src/core/effective-tree.ts` (`EffectiveTreeResolver`,',
-        '`TreeKind`) · `packages/tooling/ai-hook-rules/src/core/runner.ts` (`l1LocationBlock`,',
-        '`filterByExcludedPaths`, the `foreign` check) · `.../force-to-root.ts` (`ForceToRootGuard`) ·',
+        '`TreeKind`) · `packages/tooling/ai-hook-rules/src/core/target-tree.ts` (`TargetTreeResolver`,',
+        '`GovernedPath` — the same question asked about a FILE) ·',
+        '`packages/tooling/ai-hook-rules/src/core/runner.ts` (`l1LocationBlock`, the `foreign` check) ·',
+        '`packages/tooling/ai-hook-rules/src/core/excluded-paths.ts` (`filterByExcludedPaths`) ·',
+        '`.../force-to-root.ts` (`ForceToRootGuard`) ·',
         '`packages/tooling/ai-hook-rules/src/core/missing-directory.ts` (`MissingDirectoryGuard`) ·',
         '`packages/tooling/ai-hook-rules/src/core/version-sync.ts` (`VersionSyncGuard`,',
         '`WebpiecesVersions`).',
@@ -165,6 +168,19 @@ function renderFilterSection() {
         'nothing is a second and WEAKER spelling — the matcher below misses the bare directory that the',
         'predicate matches — and it invites a consumer to delete it and believe the exemption went too.',
         '',
+        // The SUBJECT of this paragraph is which SPELLING of the state dir is exempt, so the two
+        // spellings have to appear literally — computing them from a resolver would print one path and
+        // destroy the contrast that is the whole point. This is exactly the case the rule's own escape
+        // is for, and it is scoped to the three lines below rather than the file.
+        '<!-- webpieces-disable no-state-paths-in-templates -- this paragraph\'s subject IS the two spellings of the state dir; a computed path would print one of them and lose the contrast -->',
+        'The skip is asked about the path relative to the tree that **OWNS** the file, not to the governed',
+        'root, and the two differ in exactly one place: a linked worktree. `<primary>/.webpieces/…` was',
+        'exempt while `<primary>/.claude/worktrees/agent-＜id＞/.webpieces/pr-review/…/review.json` — the same',
+        'kind of file, in a worktree\'s own state dir — was not, because governed-root-relative it begins',
+        '`.claude`. That is the file `wp-review-upsert-pr` REQUIRES before `wp-finish-upsert-pr` will open a',
+        'PR, so the guard could forbid a file the gate demands (issue #851). `GovernedPath` carries both',
+        'spellings together so a caller cannot reach for the wrong one.',
+        '',
         '`excludePaths` is **ONE glob list** (canonical: `"excludePaths": ["repositories/**"]`). The',
         '`{ rules: [...], guards: [...] }` object is **retired and rejected**, with the union it must become',
         'named in the error. `wp-install-ai-hooks` migrates it in place.',
@@ -314,7 +330,8 @@ function renderTail() {
         '| trinary-version-skew (row 8), V, R | `ai-hook-rules/src/core/version-sync.ts` | `VersionSyncGuard`, `WebpiecesVersions` |',
         '| force-to-root (row 5) | `ai-hook-rules/src/core/force-to-root.ts` | `ForceToRootGuard` |',
         '| the directory is gone (row 7) | `ai-hook-rules/src/core/missing-directory.ts` | `MissingDirectoryGuard` |',
-        '| the filter | `ai-hook-rules/src/core/runner.ts` | `filterByExcludedPaths` |',
+        '| the filter | `ai-hook-rules/src/core/excluded-paths.ts` | `filterByExcludedPaths` |',
+        '| which tree owns a TARGET PATH | `ai-hook-rules/src/core/target-tree.ts` | `TargetTreeResolver`, `GovernedPath` |',
         '| `excludePaths` shape | `rules-config/src/exclude-hook-paths.ts`, `validate-config.ts`, `retired-config-keys.ts` | `ExcludePaths`, `validateExcludePaths` |',
         '| the `.webpieces/` skip | `rules-config/src/exclude-hook-paths.ts` | `isWebpiecesStateDir` |',
         '',

package/src/core/l1-doc.js.map

@@ -1 +1 @@
-{"version":3,"file":"l1-doc.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/l1-doc.ts"],"names":[],"mappings":";;AA8CA,kCAQC;AAtDD,uCAAsF;AAEtF,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,2FAA2F;AAC3F,EAAE;AACF,mGAAmG;AACnG,uGAAuG;AACvG,uGAAuG;AACvG,oDAAoD;AACpD,8EAA8E;AAE9E,gFAAgF;AAChF,kHAAkH;AAClH,SAAS,IAAI,CAAC,KAAa;IACvB,OAAO,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,iHAAiH;AACjH,SAAS,QAAQ,CAAC,GAAU;IACxB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,iGAAiG;IACjG,kGAAkG;IAClG,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC;IAClD,oGAAoG;IACpG,oGAAoG;IACpG,6FAA6F;IAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;IACxE,OAAO,KAAK,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC;AAC7E,CAAC;AAED,iHAAiH;AACjH,SAAS,UAAU,CAAC,OAAkB;IAClC,OAAO,KAAK,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,KAAK,MAAM,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,6GAA6G;AAC7G,SAAgB,WAAW;IACvB,OAAO;QACH,GAAG,UAAU,EAAE;QACf,GAAG,WAAW,EAAE;QAChB,GAAG,aAAa,EAAE;QAClB,GAAG,cAAc,EAAE;QACnB,GAAG,UAAU,EAAE;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,wGAAwG;AACxG,wGAAwG;AACxG,iHAAiH;AACjH,SAAS,aAAa;IAClB,OAAO;QACH,kCAAkC;QAClC,EAAE;QACF,gGAAgG;QAChG,qGAAqG;QACrG,gHAAgH;QAChH,4DAA4D;QAC5D,EAAE;QACF,qGAAqG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,oGAAoG;QACpG,yFAAyF;QACzF,EAAE;QACF,qGAAqG;QACrG,mGAAmG;QACnG,2BAA2B;QAC3B,EAAE;KACL,CAAC;AACN,CAAC;AAGD,gGAAgG;AAChG,iHAAiH;AACjH,SAAS,UAAU;IACf,OAAO;QACH,iBAAiB;QACjB,EAAE;QACF,6HAA6H;QAC7H,EAAE;QACF,qGAAqG;QACrG,gGAAgG;QAChG,qGAAqG;QACrG,sGAAsG;QACtG,sGAAsG;QACtG,uGAAuG;QACvG,EAAE;QACF,EAAE;QACF,iGAAiG;QACjG,uFAAuF;QACvF,+FAA+F;QAC/F,4FAA4F;QAC5F,gFAAgF;QAChF,uBAAuB;QACvB,EAAE;QACF,6DAA6D;QAC7D,EAAE;QACF,gGAAgG;QAChG,iGAAiG;QACjG,sGAAsG;QACtG,iGAAiG;QACjG,gGAAgG;QAChG,oGAAoG;QACpG,sGAAsG;QACtG,uGAAuG;QACvG,sGAAsG;QACtG,oGAAoG;QACpG,wFAAwF;QACxF,uGAAuG;QACvG,8EAA8E;QAC9E,oGAAoG;QACpG,sGAAsG;QACtG,mGAAmG;QACnG,sGAAsG;QACtG,sGAAsG;QACtG,gEAAgE;QAChE,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,wGAAwG;QACxG,+FAA+F;QAC/F,uGAAuG;QACvG,qCAAqC;QACrC,EAAE;QACF,sGAAsG;QACtG,qGAAqG;QACrG,mGAAmG;QACnG,kGAAkG;QAClG,wEAAwE;QACxE,EAAE;QACF,4FAA4F;QAC5F,iGAAiG;QACjG,gGAAgG;QAChG,iDAAiD;QACjD,EAAE;QACF,GAAG,mBAAmB,EAAE;KAC3B,CAAC;AACN,CAAC;AAED,uGAAuG;AACvG,oGAAoG;AACpG,iHAAiH;AACjH,SAAS,mBAAmB;IACxB,OAAO;QACH,yCAAyC;QACzC,EAAE;QACF,0FAA0F;QAC1F,wGAAwG;QACxG,iDAAiD;QACjD,EAAE;QACF,kGAAkG;QAClG,sGAAsG;QACtG,iGAAiG;QACjG,oGAAoG;QACpG,yFAAyF;QACzF,kGAAkG;QAClG,iGAAiG;QACjG,kGAAkG;QAClG,6FAA6F;QAC7F,gGAAgG;QAChG,gGAAgG;QAChG,EAAE;QACF,6FAA6F;QAC7F,qGAAqG;QACrG,iEAAiE;QACjE,EAAE;QACF,mGAAmG;QACnG,qGAAqG;QACrG,uGAAuG;QACvG,8FAA8F;QAC9F,qGAAqG;QACrG,mGAAmG;QACnG,2BAA2B;QAC3B,EAAE;KACL,CAAC;AACN,CAAC;AAED,sFAAsF;AACtF,kHAAkH;AAClH,SAAS,WAAW;IAChB,OAAO;QACH,WAAW;QACX,EAAE;QACF,8BAA8B;QAC9B,eAAe;QACf,qTAAqT;QACrT,mHAAmH;QACnH,kEAAkE;QAClE,gDAAgD;QAChD,8DAA8D;QAC9D,EAAE;QACF,wGAAwG;QACxG,gGAAgG;QAChG,EAAE;QACF,sGAAsG;QACtG,0GAA0G;QAC1G,iGAAiG;QACjG,EAAE;QACF,4GAA4G;QAC5G,4GAA4G;QAC5G,+FAA+F;QAC/F,2GAA2G;QAC3G,2GAA2G;QAC3G,gGAAgG;QAChG,2EAA2E;QAC3E,EAAE;QACF,qGAAqG;QACrG,yGAAyG;QACzG,iGAAiG;QACjG,qGAAqG;QACrG,mGAAmG;QACnG,sGAAsG;QACtG,kEAAkE;QAClE,EAAE;QACF,wGAAwG;QACxG,6EAA6E;QAC7E,EAAE;QACF,UAAU;QACV,EAAE;QACF,8CAA8C;QAC9C,uCAAuC;QACvC,6FAA6F;QAC7F,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,qEAAqE;QACrE,KAAK,yBAAe,0LAA0L;QAC9M,GAAG,iBAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,EAAE;QACF,wGAAwG;QACxG,oGAAoG;QACpG,oGAAoG;QACpG,sGAAsG;QACtG,uDAAuD;QACvD,qGAAqG;QACrG,wGAAwG;QACxG,gBAAgB;QAChB,EAAE;KACL,CAAC;AACN,CAAC;AAED,8FAA8F;AAC9F,iHAAiH;AACjH,SAAS,cAAc;IACnB,OAAO;QACH,iBAAiB;QACjB,EAAE;QACF,qGAAqG;QACrG,qGAAqG;QACrG,mFAAmF;QACnF,EAAE;QACF,8DAA8D;QAC9D,uBAAuB;QACvB,GAAG,IAAA,uBAAa,GAAE,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,EAAE;QACF,iFAAiF;QACjF,iGAAiG;QACjG,kGAAkG;QAClG,EAAE;QACF,oGAAoG;QACpG,4FAA4F;QAC5F,iCAAiC;QACjC,8FAA8F;QAC9F,iGAAiG;QACjG,yGAAyG;QACzG,sGAAsG;QACtG,kGAAkG;QAClG,mGAAmG;QACnG,EAAE;KACL,CAAC;AACN,CAAC;AAED,sGAAsG;AACtG,mCAAmC;AACnC,gHAAgH;AAChH,SAAS,UAAU;IACf,OAAO;QACH,qCAAqC;QACrC,EAAE;QACF,6FAA6F;QAC7F,yHAAyH;QACzH,qGAAqG;QACrG,kDAAkD;QAClD,EAAE;QACF,uGAAuG;QACvG,0EAA0E;QAC1E,EAAE;QACF,+CAA+C;QAC/C,eAAe;QACf,sEAAsE;QACtE,8FAA8F;QAC9F,mFAAmF;QACnF,EAAE;QACF,mGAAmG;QACnG,uGAAuG;QACvG,wGAAwG;QACxG,EAAE;QACF,mGAAmG;QACnG,4GAA4G;QAC5G,yGAAyG;QACzG,+CAA+C;QAC/C,EAAE;QACF,KAAK;QACL,EAAE;QACF,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,6BAA6B;QAC7B,eAAe;QACf,oGAAoG;QACpG,kGAAkG;QAClG,6HAA6H;QAC7H,4FAA4F;QAC5F,6GAA6G;QAC7G,+EAA+E;QAC/E,8JAA8J;QAC9J,+FAA+F;QAC/F,EAAE;KACL,CAAC;AACN,CAAC","sourcesContent":["import { L1Row, L1UseCase, L1_ROWS, L1_PRESTAGE_ROW, allL1UseCases } from './l1-rows';\n\n// ---------------------------------------------------------------------------\n// guards/L1-location.md, rendered from L1_ROWS.\n//\n// Same arrangement as l0-matrix.renderGuardMatrixDoc(): one join('\\n') of literal markdown lines with\n// the ROW DATA interpolated from the array the guard consults. Everything that is not row data — every\n// prose section — is a literal line here, because that is the half a generator cannot own.\n//\n// A unit test (l1-matrix.spec.ts) locks guards/L1-location.md byte-identical to renderL1Doc(), and\n// `pnpm guards:generate` rewrites the file. So the table in the doc IS the array, not a description of\n// it. This module, like l1-rows.ts, has no runtime imports outside this pair so the generator can load\n// it without the package's transitive dependencies.\n// ---------------------------------------------------------------------------\n\n/** A dimension cell: the wildcard renders bare, every value renders as code. */\n// webpieces-disable no-function-outside-class -- pure cell formatter for renderL1Doc below, in this render module\nfunction cell(value: string): string {\n    return value === '-' ? '-' : `\\`${value}\\``;\n}\n\n// webpieces-disable no-function-outside-class -- pure row formatter for renderL1Doc below, in this render module\nfunction tableRow(row: L1Row): string {\n    const dims = [row.k, row.a, row.r, row.g, row.p].map(cell).join(' | ');\n    // Row 6 has no `why` — an EMPTY cell is `| |`, not `|  |`. Two spaces would render the same in a\n    // browser and fail the byte-lock, which is the whole point of locking bytes rather than markdown.\n    const why = row.why === '' ? ' ' : ` ${row.why} `;\n    // The CURE column exists so a reader who arrived here from a `row=` in a log gets the remedy on the\n    // same line as the verdict, the way L2's matrix does. Only blocking rows have one; a row that hands\n    // down to L2 or exempts has nothing to cure, and says so rather than leaving the cell blank.\n    const cure = row.cure === null ? 'n/a — not a block' : row.cure.summary;\n    return `| ${row.num} | ${dims} | ${row.action.label} |${why}| ${cure} |`;\n}\n\n// webpieces-disable no-function-outside-class -- pure row formatter for renderL1Doc below, in this render module\nfunction useCaseRow(useCase: L1UseCase): string {\n    return `| ${useCase.num} | ${useCase.symptom} | ${useCase.state} | ${useCase.verdict} | ${useCase.fix} |`;\n}\n\n/**\n * Render guards/L1-location.md.\n *\n * Split into three consecutive halves purely to stay inside the method-line budget — the join order is\n * what makes them one file, so keep them adjacent and keep the byte-lock test as the arbiter.\n */\n// webpieces-disable no-function-outside-class -- pure string builder over L1_ROWS, beside the array it reads\nexport function renderL1Doc(): string {\n    return [\n        ...renderHead(),\n        ...renderTable(),\n        ...renderLogJoin(),\n        ...renderUseCases(),\n        ...renderTail(),\n    ].join('\\n');\n}\n\n// How a `row=` in the L1 log joins back to the table above — the section this doc existed without for\n// 1,457 logged decisions across nine repos, none of which an agent could look up, because the DELIVERED\n// copy of this page did not exist either. L2's doc has carried the same section since its own delivery.\n// webpieces-disable no-function-outside-class -- prose section of renderL1Doc's string, beside it in this module\nfunction renderLogJoin(): string[] {\n    return [\n        '## How a log line joins to a row',\n        '',\n        'Every L1 decision is written to `.webpieces/logs/L1-location/<writer>.log` with `layer=L1` and',\n        '`row=<n>`, where `<n>` is a row number from the table above. So `row=6` means \"this call was judged',\n        'by row 6\" and you read the dimensions, the verdict, the reason and the cure straight off that line. Row `0` is',\n        'the pre-stage; it is in the table for exactly this reason.',\n        '',\n        '**The join is by DISPATCH, and that is the difference from L2.** L1 takes the FIRST matching row in',\n        '`L1_ROWS` and switches on it, so a row and a behaviour are the same object — delete the row and you',\n        'delete the block. L2\\'s four guard classes each own their own ladder and join to their rows by REASON',\n        'instead (see `webpieces.branch-state-matrix.md`). A totality test walks all 80 classifications and',\n        'asserts each lands on exactly one row, so there is no verdict this page cannot explain.',\n        '',\n        'Row numbers are IDENTITY and are never reused: row 3 is retired (coordinator-in-worktree) and row 8',\n        'was added in its place rather than renumbering 4-7, because every `row=` already written to a log',\n        'would otherwise re-point.',\n        '',\n    ];\n}\n\n\n// The three questions L1 answers, the preamble and the filter — all prose, none of it row data.\n// webpieces-disable no-function-outside-class -- first section of renderL1Doc's string, beside it in this module\nfunction renderHead(): string[] {\n    return [\n        '# L1 — location',\n        '',\n        '**Goal: is this call ours to judge, is this tree governed by the release it asks for, and is git being run from the root?**',\n        '',\n        '**Config key: none, and none is proposed.** Force-to-root and trinary-version-skew have **no config',\n        'key** and cannot be disabled; `excludePaths` is a top-level block, not a `hookGuards` entry. A',\n        '`location-guard` key was once proposed here — it never existed, and `hookGuards` has just gone from',\n        'nine keys to three, so adding a tenth-turned-fourth for a layer nobody has asked to switch off would',\n        'run against the whole point. L0 has no key for the stronger version of the same reason: a layer that',\n        'decides whether the tooling can be trusted cannot be configured by the file it has not validated yet.',\n        '',\n        '',\n        '**Code:** `packages/tooling/ai-hook-rules/src/core/effective-tree.ts` (`EffectiveTreeResolver`,',\n        '`TreeKind`) · `packages/tooling/ai-hook-rules/src/core/runner.ts` (`l1LocationBlock`,',\n        '`filterByExcludedPaths`, the `foreign` check) · `.../force-to-root.ts` (`ForceToRootGuard`) ·',\n        '`packages/tooling/ai-hook-rules/src/core/missing-directory.ts` (`MissingDirectoryGuard`) ·',\n        '`packages/tooling/ai-hook-rules/src/core/version-sync.ts` (`VersionSyncGuard`,',\n        '`WebpiecesVersions`).',\n        '',\n        'L1 answers four questions, and they are genuinely separate:',\n        '',\n        '1. **Do we govern this at all?** — the escape hatches, for other repos and non-governed paths.',\n        '   Answered by asking GIT (`--git-common-dir`), never by path math: see the legend under **K**.',\n        '2. **Does the directory still EXIST?** — row 7. A worktree reaped out from under a live shell leaves',\n        '   a cwd that names nothing, and that state needs its own name and its own message, because the',\n        '   remedy for \"you are in a subdirectory\" is a `cd` back into the very directory that is gone.',\n        '3. **Is this tree governed by a release it did not ask for?** — row 8. A worktree MAY have its own',\n        '   `node_modules` (nx, vitest and the eslint plugin all execute there and load from it), and when it',\n        '   has none the shim\\'s upward walk runs the main tree\\'s binary. Either way the rule is the same and',\n        '   holds whichever registration form — absolute or relative — is live in the consumer: the two trees',\n        '   must PIN the same `@webpieces`, or the worktree is linted, validated and built by a release its',\n        '   own manifest does not ask for. Asked of the PATH acted on, never of who is asking —',\n        '   agent identity was measured untrustworthy for tree detection (a worktree-isolated agent whose tree',\n        '   is auto-reaped at a turn boundary silently resumes on the primary clone).',\n        '4. **Is the agent stranded away from the root?** — force-to-root, git/gh only. Agents forget where',\n        '   they are constantly, and `cd` gives them two different ways to be wrong: a `cd` that stays INSIDE',\n        '   the workspace PERSISTS to later calls (so the shell can be parked in a subdirectory left by an',\n        '   unrelated command turns earlier), while a `cd` that LEAVES it is reset by the harness, which says',\n        '   so — `Shell cwd was reset to <root>`. Neither can be assumed, which is why every remedy names the',\n        '   root explicitly instead of telling the agent to `cd` first.',\n        '',\n        '## Preamble — resolve the target first (Bash only)',\n        '',\n        '`EffectiveTreeResolver.resolve()` computes `effectiveCwd`: the directory the command actually runs in,',\n        'which is the shell\\'s cwd unless the command leads with `cd <dir> &&`. **K is classified from',\n        '`effectiveCwd`, not from the shell\\'s cwd** — so \"a foreign repo that `cd`s into ours\" is not a cell,',\n        'it is simply `pw` after resolution.',\n        '',\n        'That holds because K is resolved by ASKING GIT about `effectiveCwd`, not by testing whether the path',\n        'is lexically under the governed root. It has to be said that way round: the resolver used to do the',\n        'path test, and a linked worktree under `.claude/worktrees/**` therefore resolved `f` — every bash',\n        'guard exempt in the one sandbox agents are told to work in. A sentence in this file asserted the',\n        'opposite as fact for several releases, which is how it went unnoticed.',\n        '',\n        'Only a LEADING run of `cd`/`pushd` counts. A *trailing* `… && cd <exempt-tree>` must never',\n        'retroactively pull a command out of scope — that would smuggle a root-level `git push` past the',\n        'guards. Quoting is handled by `ShellSegmentScan`, so `echo \"cd sub && git push\"` is one opaque',\n        'segment and its quoted `cd` is never picked up.',\n        '',\n        ...renderFilterSection(),\n    ];\n}\n\n// `excludePaths` — a FILTER over the rule list, not a dimension of the table. Its own function because\n// renderHead is at the 70-line method cap, and because this section is one self-contained argument.\n// webpieces-disable no-function-outside-class -- prose section of renderL1Doc's string, beside it in this module\nfunction renderFilterSection(): string[] {\n    return [\n        '## Filter — not a dimension (all tools)',\n        '',\n        '`filterByExcludedPaths` drops every rule excluded for this path: the **target path** for',\n        'Read/Write/Edit, `effectiveCwd` for Bash. An empty rule list means allow. This is a filter, not a row:',\n        '\"exempt\" is what emerges when the list empties.',\n        '',\n        'ONE path is filtered out BEFORE the list is consulted and cannot be put back: **`.webpieces/`**,',\n        'the tooling\\'s own state dir (`isWebpiecesStateDir`). It is gitignored in every consumer, so nothing',\n        'under it can reach a branch, be reviewed or be reverted — every reason L2 prints for protecting',\n        '`main` is vacuous there. It was config-only once, which made the exemption optional on exactly the',\n        'directory webpieces itself writes to: `wp-review-upsert-pr` hands a reviewer subagent a',\n        '`<primary>/.webpieces/worktrees/agent-＜id＞/pr-review/…` path, that write resolves to the PRIMARY',\n        'clone, and L2 judged the primary\\'s live branch — so the reviewer was denied \"You should not be',\n        'working on main\" whenever an unrelated session had left the primary there. There is deliberately',\n        'NO companion `\".webpieces/**\"` glob seeded into `excludePaths`: a config entry that changes',\n        'nothing is a second and WEAKER spelling — the matcher below misses the bare directory that the',\n        'predicate matches — and it invites a consumer to delete it and believe the exemption went too.',\n        '',\n        '`excludePaths` is **ONE glob list** (canonical: `\"excludePaths\": [\"repositories/**\"]`). The',\n        '`{ rules: [...], guards: [...] }` object is **retired and rejected**, with the union it must become',\n        'named in the error. `wp-install-ai-hooks` migrates it in place.',\n        '',\n        'This used to be a tolerated fallback, justified here by \"rejecting it would block every Bash/Edit',\n        'including the edit that would fix it.\" **That was never true**, and the fallback it licensed is why',\n        'consumer configs — this repo\\'s own included — sat on the dead shape for releases. A Write/Edit whose',\n        'target is `webpieces.config.json` is an unconditional **PASS** (see the L0 table above), and',\n        '`pnpm install` has an installer bypass, so an invalid config can always be repaired from inside the',\n        'block. Config rejection is self-recoverable by construction; see `retired-config-keys.ts` for the',\n        'policy and the reasoning.',\n        '',\n    ];\n}\n\n// The legend, the table itself (ROW DATA), and the note on the two structural blocks.\n// webpieces-disable no-function-outside-class -- second section of renderL1Doc's string, beside it in this module\nfunction renderTable(): string[] {\n    return [\n        '## Legend',\n        '',\n        '| col | dimension | values |',\n        '|---|---|---|',\n        '| **K** | tree kind of the resolved target, from git\\'s own dirs | `f` foreign repo (a DIFFERENT `--git-common-dir`) · `m` the directory does not exist · `o` outside any repo · `w` a LINKED worktree of ours (`--git-dir` ≠ `--git-common-dir`), wherever it sits on disk · `pw` ours (primary **or** worktree) |',\n        '| **V** | do the `@webpieces` versions agree between this worktree and the MAIN tree | `n` skewed · `y` in sync |',\n        '| **R** | command is provably read-only inspection | `n` · `y` |',\n        '| **G** | command invokes git/gh | `n` · `y` |',\n        '| **P** | position of the resolved target | `root` · `sub` |',\n        '',\n        'All of them are **Bash only**. Read/Write/Edit resolve their own target (`input.filePath`) and have no',\n        'dimensions — the filter is all that applies to them. **The Read tool is never blocked by L1.**',\n        '',\n        'A linked worktree is deliberately **not** foreign: it is the same project, so the guards run against',\n        'THAT tree\\'s branch and cache. Every rule-scoped guard treats `p` and `w` alike, hence `pw`; row 8 below',\n        'is the ONE place they separate, and it turns on **V** — the versions, read off the tree itself.',\n        '',\n        'PLACEMENT IS NOT IDENTITY. A worktree checked out INSIDE the repo — `<repo>/.claude/worktrees/agent-XXXX`,',\n        'which is where Claude Code puts every agent worktree — is `w` exactly like a sibling `../feature-dir` one.',\n        'K comes from git\\'s own dirs (`--git-common-dir` is identical for every checkout of one repo,',\n        '`--git-dir` differs only in a linked worktree), never from whether the path sits under the governed root.',\n        'It used to short-circuit on that path test, so an in-repo worktree read as `f` — every bash guard exempt,',\n        'and row 8 unreachable, for the only layout the harness actually produces. A nested clone under',\n        '`repositories/**` still reads `f`, because its shared git dir is its own.',\n        '',\n        '`V` comes from reading manifests off disk — the MAIN tree\\'s `pnpm-workspace.yaml` catalog pin, its',\n        'installed `node_modules` version, this worktree\\'s pin, and this worktree\\'s own installed version when',\n        'it has one (which it does the moment anyone runs `pnpm add` there). Three always, a fourth when',\n        'present. Anything unreadable is NO OPINION, never skew: a guard that cannot measure must not block.',\n        'It is deliberately NOT read from `agent_id`/`agent_type` — the dimension this replaced was, and a',\n        'worktree-isolated agent was measured resuming on the primary clone after its tree was reaped, so who',\n        'is asking cannot be trusted to say which tree is being acted on.',\n        '',\n        '`R` is `ReadOnlyInspectionScan` — the same paranoid \"provably inert\" test the unloadable-config escape',\n        'hatch uses (allowlisted viewers/searchers only, no redirects, no `sed -i`).',\n        '',\n        '## Table',\n        '',\n        '| # | K | V | R | G | P | act | why | cure |',\n        '|---|---|---|---|---|---|---|---|---|',\n        // Row 0 is the PRE-STAGE (`misplacedCdBlock`). It decides from command TEXT before a tree is\n        // resolved, so it cannot be classified over the five dimensions rows 1-6 share — but it IS an\n        // L1 block, and an L1 block the table did not describe is exactly the drift this table exists\n        // to prevent. It is numbered 0, not 7, because it does not sit in the first-match scan; and it\n        // is PRINTED because `row=0` in the L1 log has to join to something.\n        `| ${L1_PRESTAGE_ROW} | – | – | – | – | – | 4 block | a \\`cd\\` that is not leading + literal, judged before any tree is resolved | \\`cd <literal abs path> && <the rest>\\` — ONE leading \\`cd\\`, or drop it |`,\n        ...L1_ROWS.map(tableRow),\n        '',\n        'Rows 3, 5 and 7 are the structural blocks, and they run as ONE step (`l1LocationBlock` in `runner.ts`)',\n        'so they can never be reordered by accident — row 7 (the directory is gone) first, then row 8, then',\n        'force-to-root. Row 7 is printed LAST above only because row numbers are stable across releases and',\n        'renumbering 1-6 would invalidate every `row=` in the logs; `m` matches no other row, so its position',\n        'in the scan is immaterial. All three sit after the L0',\n        'allowlist, after the `f` check, and after the `excludePaths` filter and the config-sync check. So a',\n        'cure (`cd <worktree> && pnpm install`) still reaches any tree: that is L0\\'s invariant, and row 8 does',\n        'not weaken it.',\n        '',\n    ];\n}\n\n// The use-case table (ROW DATA, in the doc's own numbering) and the two notes that follow it.\n// webpieces-disable no-function-outside-class -- third section of renderL1Doc's string, beside it in this module\nfunction renderUseCases(): string[] {\n    return [\n        '## L1 use cases',\n        '',\n        'Same row shape as L0: the **Fix** is literal or it is not a fix. `<root>` is the absolute workspace',\n        'root — the messages name it explicitly rather than telling you to `cd` first, for the reason in the',\n        'section head (neither the shell\\'s cwd nor a `cd`\\'s persistence can be assumed).',\n        '',\n        '| # | what you SEE (exact symptom) | state | verdict | Fix |',\n        '|---|---|---|---|---|',\n        ...allL1UseCases().map(useCaseRow),\n        '',\n        'Row 8 is the one that changed. It used to be ALLOWED, because the predicate was',\n        '`shellAtRoot || cdsToRoot` — two variables OR\\'d, so the same destination got opposite verdicts',\n        'depending on where the shell happened to start. It is now one variable, `effectiveCwd === root`.',\n        '',\n        'Row 12 is the incident that produced table row 8, and it is a VERSION SKEW incident — which is why',\n        'the row that replaced it measures versions rather than agent identity. The coordinator ran',\n        '`git worktree add`, `cd`\\'d in,',\n        'and worked there. An L0 version-drift fault then fired against the PRIMARY (pin `0.4.545` vs',\n        '`node_modules` `0.4.526`) and prescribed `pnpm install` — which ran in the WORKTREE, internally',\n        'consistent at `0.4.526`/`0.4.526`, so it succeeded, changed nothing in the measured tree, and the guard',\n        're-denied. Five identical installs later the agent had invented a theory about the harness stripping',\n        'its `cd` and handed the problem to the human. Note what row 15 says: the fix is NOT to deny that',\n        'install. It is to make the split state unreachable, so the wrong-tree install is never plausible.',\n        '',\n    ];\n}\n\n// The known gap and the code anchors — prose, and the one section that must never be summarised away:\n// three code comments point at it.\n// webpieces-disable no-function-outside-class -- last section of renderL1Doc's string, beside it in this module\nfunction renderTail(): string[] {\n    return [\n        '## Not done — `o` is not exempt yet',\n        '',\n        'Row 2 hands `\\'outside\\'` down to L2 rather than exempting it. `\\'outside\\'` is produced at',\n        '`effective-tree.ts` (git has no answer for the directory) carrying `governedRoot`, and **no code branches on it**, so a',\n        'command in no git repo is judged against the governed repo\\'s branch and staleness state. That is a',\n        'wrong verdict, and `exempt` is the right action.',\n        '',\n        '**It must not ship alone.** Jurisdiction comes from the shell cwd, not from what the command touches,',\n        'so exempting `o` opens a bypass an agent reaches by typing `cd /tmp &&`:',\n        '',\n        '| command | today | with `o → exempt` alone |',\n        '|---|---|---|',\n        '| `cd /tmp && ls` | judged against the repo | exempt — **correct** |',\n        '| `cd /tmp && git -C $REPO commit` | L2 guards fire | exempt — **every L2 guard bypassed** |',\n        '| `cd /tmp && rm -rf $REPO/packages/http/src` | judged | exempt — **unguarded** |',\n        '',\n        'The two cases only separate once jurisdiction is judged on **what the command touches** (explicit',\n        '`git -C` / `--work-tree`, then path arguments, then the `cd`, then the shell cwd), with the fail-safe',\n        'rule that **any** resolved target inside `governedRoot` means `pw`. Ship the two together, or neither.',\n        '',\n        'Tracked in `backlog/bug-bash-guards-judge-the-shell-cwd-not-the-paths-the-command-touches.md` and',\n        '`backlog/bug-outside-tree-kind-is-never-consumed-so-a-non-git-dir-is-judged-against-the-governed-repo.md`.',\n        'That resolver has three consumers — L1\\'s K, L2\\'s scope dimension, and `excludePaths` on the Bash path',\n        '— which is why the backlog says **fix once**.',\n        '',\n        '---',\n        '',\n        '',\n        '## Code anchors',\n        '',\n        '| section | file | symbol |',\n        '|---|---|---|',\n        '| resolver, K | `ai-hook-rules/src/core/effective-tree.ts` | `EffectiveTreeResolver`, `TreeKind` |',\n        '| the two structural blocks, in order | `ai-hook-rules/src/core/runner.ts` | `l1LocationBlock` |',\n        '| trinary-version-skew (row 8), V, R | `ai-hook-rules/src/core/version-sync.ts` | `VersionSyncGuard`, `WebpiecesVersions` |',\n        '| force-to-root (row 5) | `ai-hook-rules/src/core/force-to-root.ts` | `ForceToRootGuard` |',\n        '| the directory is gone (row 7) | `ai-hook-rules/src/core/missing-directory.ts` | `MissingDirectoryGuard` |',\n        '| the filter | `ai-hook-rules/src/core/runner.ts` | `filterByExcludedPaths` |',\n        '| `excludePaths` shape | `rules-config/src/exclude-hook-paths.ts`, `validate-config.ts`, `retired-config-keys.ts` | `ExcludePaths`, `validateExcludePaths` |',\n        '| the `.webpieces/` skip | `rules-config/src/exclude-hook-paths.ts` | `isWebpiecesStateDir` |',\n        '',\n    ];\n}\n"]}
+{"version":3,"file":"l1-doc.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/l1-doc.ts"],"names":[],"mappings":";;AA8CA,kCAQC;AAtDD,uCAAsF;AAEtF,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,2FAA2F;AAC3F,EAAE;AACF,mGAAmG;AACnG,uGAAuG;AACvG,uGAAuG;AACvG,oDAAoD;AACpD,8EAA8E;AAE9E,gFAAgF;AAChF,kHAAkH;AAClH,SAAS,IAAI,CAAC,KAAa;IACvB,OAAO,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,iHAAiH;AACjH,SAAS,QAAQ,CAAC,GAAU;IACxB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,iGAAiG;IACjG,kGAAkG;IAClG,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC;IAClD,oGAAoG;IACpG,oGAAoG;IACpG,6FAA6F;IAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;IACxE,OAAO,KAAK,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC;AAC7E,CAAC;AAED,iHAAiH;AACjH,SAAS,UAAU,CAAC,OAAkB;IAClC,OAAO,KAAK,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,KAAK,MAAM,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,6GAA6G;AAC7G,SAAgB,WAAW;IACvB,OAAO;QACH,GAAG,UAAU,EAAE;QACf,GAAG,WAAW,EAAE;QAChB,GAAG,aAAa,EAAE;QAClB,GAAG,cAAc,EAAE;QACnB,GAAG,UAAU,EAAE;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,wGAAwG;AACxG,wGAAwG;AACxG,iHAAiH;AACjH,SAAS,aAAa;IAClB,OAAO;QACH,kCAAkC;QAClC,EAAE;QACF,gGAAgG;QAChG,qGAAqG;QACrG,gHAAgH;QAChH,4DAA4D;QAC5D,EAAE;QACF,qGAAqG;QACrG,qGAAqG;QACrG,uGAAuG;QACvG,oGAAoG;QACpG,yFAAyF;QACzF,EAAE;QACF,qGAAqG;QACrG,mGAAmG;QACnG,2BAA2B;QAC3B,EAAE;KACL,CAAC;AACN,CAAC;AAGD,gGAAgG;AAChG,iHAAiH;AACjH,SAAS,UAAU;IACf,OAAO;QACH,iBAAiB;QACjB,EAAE;QACF,6HAA6H;QAC7H,EAAE;QACF,qGAAqG;QACrG,gGAAgG;QAChG,qGAAqG;QACrG,sGAAsG;QACtG,sGAAsG;QACtG,uGAAuG;QACvG,EAAE;QACF,EAAE;QACF,iGAAiG;QACjG,+FAA+F;QAC/F,0DAA0D;QAC1D,gGAAgG;QAChG,yFAAyF;QACzF,+CAA+C;QAC/C,4FAA4F;QAC5F,gFAAgF;QAChF,uBAAuB;QACvB,EAAE;QACF,6DAA6D;QAC7D,EAAE;QACF,gGAAgG;QAChG,iGAAiG;QACjG,sGAAsG;QACtG,iGAAiG;QACjG,gGAAgG;QAChG,oGAAoG;QACpG,sGAAsG;QACtG,uGAAuG;QACvG,sGAAsG;QACtG,oGAAoG;QACpG,wFAAwF;QACxF,uGAAuG;QACvG,8EAA8E;QAC9E,oGAAoG;QACpG,sGAAsG;QACtG,mGAAmG;QACnG,sGAAsG;QACtG,sGAAsG;QACtG,gEAAgE;QAChE,EAAE;QACF,oDAAoD;QACpD,EAAE;QACF,wGAAwG;QACxG,+FAA+F;QAC/F,uGAAuG;QACvG,qCAAqC;QACrC,EAAE;QACF,sGAAsG;QACtG,qGAAqG;QACrG,mGAAmG;QACnG,kGAAkG;QAClG,wEAAwE;QACxE,EAAE;QACF,4FAA4F;QAC5F,iGAAiG;QACjG,gGAAgG;QAChG,iDAAiD;QACjD,EAAE;QACF,GAAG,mBAAmB,EAAE;KAC3B,CAAC;AACN,CAAC;AAED,uGAAuG;AACvG,oGAAoG;AACpG,iHAAiH;AACjH,SAAS,mBAAmB;IACxB,OAAO;QACH,yCAAyC;QACzC,EAAE;QACF,0FAA0F;QAC1F,wGAAwG;QACxG,iDAAiD;QACjD,EAAE;QACF,kGAAkG;QAClG,sGAAsG;QACtG,iGAAiG;QACjG,oGAAoG;QACpG,yFAAyF;QACzF,kGAAkG;QAClG,iGAAiG;QACjG,kGAAkG;QAClG,6FAA6F;QAC7F,gGAAgG;QAChG,gGAAgG;QAChG,EAAE;QACF,yFAAyF;QACzF,+FAA+F;QAC/F,+FAA+F;QAC/F,0EAA0E;QAC1E,0LAA0L;QAC1L,mGAAmG;QACnG,gGAAgG;QAChG,qGAAqG;QACrG,kGAAkG;QAClG,qGAAqG;QACrG,iGAAiG;QACjG,gEAAgE;QAChE,EAAE;QACF,6FAA6F;QAC7F,qGAAqG;QACrG,iEAAiE;QACjE,EAAE;QACF,mGAAmG;QACnG,qGAAqG;QACrG,uGAAuG;QACvG,8FAA8F;QAC9F,qGAAqG;QACrG,mGAAmG;QACnG,2BAA2B;QAC3B,EAAE;KACL,CAAC;AACN,CAAC;AAED,sFAAsF;AACtF,kHAAkH;AAClH,SAAS,WAAW;IAChB,OAAO;QACH,WAAW;QACX,EAAE;QACF,8BAA8B;QAC9B,eAAe;QACf,qTAAqT;QACrT,mHAAmH;QACnH,kEAAkE;QAClE,gDAAgD;QAChD,8DAA8D;QAC9D,EAAE;QACF,wGAAwG;QACxG,gGAAgG;QAChG,EAAE;QACF,sGAAsG;QACtG,0GAA0G;QAC1G,iGAAiG;QACjG,EAAE;QACF,4GAA4G;QAC5G,4GAA4G;QAC5G,+FAA+F;QAC/F,2GAA2G;QAC3G,2GAA2G;QAC3G,gGAAgG;QAChG,2EAA2E;QAC3E,EAAE;QACF,qGAAqG;QACrG,yGAAyG;QACzG,iGAAiG;QACjG,qGAAqG;QACrG,mGAAmG;QACnG,sGAAsG;QACtG,kEAAkE;QAClE,EAAE;QACF,wGAAwG;QACxG,6EAA6E;QAC7E,EAAE;QACF,UAAU;QACV,EAAE;QACF,8CAA8C;QAC9C,uCAAuC;QACvC,6FAA6F;QAC7F,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,qEAAqE;QACrE,KAAK,yBAAe,0LAA0L;QAC9M,GAAG,iBAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,EAAE;QACF,wGAAwG;QACxG,oGAAoG;QACpG,oGAAoG;QACpG,sGAAsG;QACtG,uDAAuD;QACvD,qGAAqG;QACrG,wGAAwG;QACxG,gBAAgB;QAChB,EAAE;KACL,CAAC;AACN,CAAC;AAED,8FAA8F;AAC9F,iHAAiH;AACjH,SAAS,cAAc;IACnB,OAAO;QACH,iBAAiB;QACjB,EAAE;QACF,qGAAqG;QACrG,qGAAqG;QACrG,mFAAmF;QACnF,EAAE;QACF,8DAA8D;QAC9D,uBAAuB;QACvB,GAAG,IAAA,uBAAa,GAAE,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,EAAE;QACF,iFAAiF;QACjF,iGAAiG;QACjG,kGAAkG;QAClG,EAAE;QACF,oGAAoG;QACpG,4FAA4F;QAC5F,iCAAiC;QACjC,8FAA8F;QAC9F,iGAAiG;QACjG,yGAAyG;QACzG,sGAAsG;QACtG,kGAAkG;QAClG,mGAAmG;QACnG,EAAE;KACL,CAAC;AACN,CAAC;AAED,sGAAsG;AACtG,mCAAmC;AACnC,gHAAgH;AAChH,SAAS,UAAU;IACf,OAAO;QACH,qCAAqC;QACrC,EAAE;QACF,6FAA6F;QAC7F,yHAAyH;QACzH,qGAAqG;QACrG,kDAAkD;QAClD,EAAE;QACF,uGAAuG;QACvG,0EAA0E;QAC1E,EAAE;QACF,+CAA+C;QAC/C,eAAe;QACf,sEAAsE;QACtE,8FAA8F;QAC9F,mFAAmF;QACnF,EAAE;QACF,mGAAmG;QACnG,uGAAuG;QACvG,wGAAwG;QACxG,EAAE;QACF,mGAAmG;QACnG,4GAA4G;QAC5G,yGAAyG;QACzG,+CAA+C;QAC/C,EAAE;QACF,KAAK;QACL,EAAE;QACF,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,6BAA6B;QAC7B,eAAe;QACf,oGAAoG;QACpG,kGAAkG;QAClG,6HAA6H;QAC7H,4FAA4F;QAC5F,6GAA6G;QAC7G,uFAAuF;QACvF,oHAAoH;QACpH,8JAA8J;QAC9J,+FAA+F;QAC/F,EAAE;KACL,CAAC;AACN,CAAC","sourcesContent":["import { L1Row, L1UseCase, L1_ROWS, L1_PRESTAGE_ROW, allL1UseCases } from './l1-rows';\n\n// ---------------------------------------------------------------------------\n// guards/L1-location.md, rendered from L1_ROWS.\n//\n// Same arrangement as l0-matrix.renderGuardMatrixDoc(): one join('\\n') of literal markdown lines with\n// the ROW DATA interpolated from the array the guard consults. Everything that is not row data — every\n// prose section — is a literal line here, because that is the half a generator cannot own.\n//\n// A unit test (l1-matrix.spec.ts) locks guards/L1-location.md byte-identical to renderL1Doc(), and\n// `pnpm guards:generate` rewrites the file. So the table in the doc IS the array, not a description of\n// it. This module, like l1-rows.ts, has no runtime imports outside this pair so the generator can load\n// it without the package's transitive dependencies.\n// ---------------------------------------------------------------------------\n\n/** A dimension cell: the wildcard renders bare, every value renders as code. */\n// webpieces-disable no-function-outside-class -- pure cell formatter for renderL1Doc below, in this render module\nfunction cell(value: string): string {\n    return value === '-' ? '-' : `\\`${value}\\``;\n}\n\n// webpieces-disable no-function-outside-class -- pure row formatter for renderL1Doc below, in this render module\nfunction tableRow(row: L1Row): string {\n    const dims = [row.k, row.a, row.r, row.g, row.p].map(cell).join(' | ');\n    // Row 6 has no `why` — an EMPTY cell is `| |`, not `|  |`. Two spaces would render the same in a\n    // browser and fail the byte-lock, which is the whole point of locking bytes rather than markdown.\n    const why = row.why === '' ? ' ' : ` ${row.why} `;\n    // The CURE column exists so a reader who arrived here from a `row=` in a log gets the remedy on the\n    // same line as the verdict, the way L2's matrix does. Only blocking rows have one; a row that hands\n    // down to L2 or exempts has nothing to cure, and says so rather than leaving the cell blank.\n    const cure = row.cure === null ? 'n/a — not a block' : row.cure.summary;\n    return `| ${row.num} | ${dims} | ${row.action.label} |${why}| ${cure} |`;\n}\n\n// webpieces-disable no-function-outside-class -- pure row formatter for renderL1Doc below, in this render module\nfunction useCaseRow(useCase: L1UseCase): string {\n    return `| ${useCase.num} | ${useCase.symptom} | ${useCase.state} | ${useCase.verdict} | ${useCase.fix} |`;\n}\n\n/**\n * Render guards/L1-location.md.\n *\n * Split into three consecutive halves purely to stay inside the method-line budget — the join order is\n * what makes them one file, so keep them adjacent and keep the byte-lock test as the arbiter.\n */\n// webpieces-disable no-function-outside-class -- pure string builder over L1_ROWS, beside the array it reads\nexport function renderL1Doc(): string {\n    return [\n        ...renderHead(),\n        ...renderTable(),\n        ...renderLogJoin(),\n        ...renderUseCases(),\n        ...renderTail(),\n    ].join('\\n');\n}\n\n// How a `row=` in the L1 log joins back to the table above — the section this doc existed without for\n// 1,457 logged decisions across nine repos, none of which an agent could look up, because the DELIVERED\n// copy of this page did not exist either. L2's doc has carried the same section since its own delivery.\n// webpieces-disable no-function-outside-class -- prose section of renderL1Doc's string, beside it in this module\nfunction renderLogJoin(): string[] {\n    return [\n        '## How a log line joins to a row',\n        '',\n        'Every L1 decision is written to `.webpieces/logs/L1-location/<writer>.log` with `layer=L1` and',\n        '`row=<n>`, where `<n>` is a row number from the table above. So `row=6` means \"this call was judged',\n        'by row 6\" and you read the dimensions, the verdict, the reason and the cure straight off that line. Row `0` is',\n        'the pre-stage; it is in the table for exactly this reason.',\n        '',\n        '**The join is by DISPATCH, and that is the difference from L2.** L1 takes the FIRST matching row in',\n        '`L1_ROWS` and switches on it, so a row and a behaviour are the same object — delete the row and you',\n        'delete the block. L2\\'s four guard classes each own their own ladder and join to their rows by REASON',\n        'instead (see `webpieces.branch-state-matrix.md`). A totality test walks all 80 classifications and',\n        'asserts each lands on exactly one row, so there is no verdict this page cannot explain.',\n        '',\n        'Row numbers are IDENTITY and are never reused: row 3 is retired (coordinator-in-worktree) and row 8',\n        'was added in its place rather than renumbering 4-7, because every `row=` already written to a log',\n        'would otherwise re-point.',\n        '',\n    ];\n}\n\n\n// The three questions L1 answers, the preamble and the filter — all prose, none of it row data.\n// webpieces-disable no-function-outside-class -- first section of renderL1Doc's string, beside it in this module\nfunction renderHead(): string[] {\n    return [\n        '# L1 — location',\n        '',\n        '**Goal: is this call ours to judge, is this tree governed by the release it asks for, and is git being run from the root?**',\n        '',\n        '**Config key: none, and none is proposed.** Force-to-root and trinary-version-skew have **no config',\n        'key** and cannot be disabled; `excludePaths` is a top-level block, not a `hookGuards` entry. A',\n        '`location-guard` key was once proposed here — it never existed, and `hookGuards` has just gone from',\n        'nine keys to three, so adding a tenth-turned-fourth for a layer nobody has asked to switch off would',\n        'run against the whole point. L0 has no key for the stronger version of the same reason: a layer that',\n        'decides whether the tooling can be trusted cannot be configured by the file it has not validated yet.',\n        '',\n        '',\n        '**Code:** `packages/tooling/ai-hook-rules/src/core/effective-tree.ts` (`EffectiveTreeResolver`,',\n        '`TreeKind`) · `packages/tooling/ai-hook-rules/src/core/target-tree.ts` (`TargetTreeResolver`,',\n        '`GovernedPath` — the same question asked about a FILE) ·',\n        '`packages/tooling/ai-hook-rules/src/core/runner.ts` (`l1LocationBlock`, the `foreign` check) ·',\n        '`packages/tooling/ai-hook-rules/src/core/excluded-paths.ts` (`filterByExcludedPaths`) ·',\n        '`.../force-to-root.ts` (`ForceToRootGuard`) ·',\n        '`packages/tooling/ai-hook-rules/src/core/missing-directory.ts` (`MissingDirectoryGuard`) ·',\n        '`packages/tooling/ai-hook-rules/src/core/version-sync.ts` (`VersionSyncGuard`,',\n        '`WebpiecesVersions`).',\n        '',\n        'L1 answers four questions, and they are genuinely separate:',\n        '',\n        '1. **Do we govern this at all?** — the escape hatches, for other repos and non-governed paths.',\n        '   Answered by asking GIT (`--git-common-dir`), never by path math: see the legend under **K**.',\n        '2. **Does the directory still EXIST?** — row 7. A worktree reaped out from under a live shell leaves',\n        '   a cwd that names nothing, and that state needs its own name and its own message, because the',\n        '   remedy for \"you are in a subdirectory\" is a `cd` back into the very directory that is gone.',\n        '3. **Is this tree governed by a release it did not ask for?** — row 8. A worktree MAY have its own',\n        '   `node_modules` (nx, vitest and the eslint plugin all execute there and load from it), and when it',\n        '   has none the shim\\'s upward walk runs the main tree\\'s binary. Either way the rule is the same and',\n        '   holds whichever registration form — absolute or relative — is live in the consumer: the two trees',\n        '   must PIN the same `@webpieces`, or the worktree is linted, validated and built by a release its',\n        '   own manifest does not ask for. Asked of the PATH acted on, never of who is asking —',\n        '   agent identity was measured untrustworthy for tree detection (a worktree-isolated agent whose tree',\n        '   is auto-reaped at a turn boundary silently resumes on the primary clone).',\n        '4. **Is the agent stranded away from the root?** — force-to-root, git/gh only. Agents forget where',\n        '   they are constantly, and `cd` gives them two different ways to be wrong: a `cd` that stays INSIDE',\n        '   the workspace PERSISTS to later calls (so the shell can be parked in a subdirectory left by an',\n        '   unrelated command turns earlier), while a `cd` that LEAVES it is reset by the harness, which says',\n        '   so — `Shell cwd was reset to <root>`. Neither can be assumed, which is why every remedy names the',\n        '   root explicitly instead of telling the agent to `cd` first.',\n        '',\n        '## Preamble — resolve the target first (Bash only)',\n        '',\n        '`EffectiveTreeResolver.resolve()` computes `effectiveCwd`: the directory the command actually runs in,',\n        'which is the shell\\'s cwd unless the command leads with `cd <dir> &&`. **K is classified from',\n        '`effectiveCwd`, not from the shell\\'s cwd** — so \"a foreign repo that `cd`s into ours\" is not a cell,',\n        'it is simply `pw` after resolution.',\n        '',\n        'That holds because K is resolved by ASKING GIT about `effectiveCwd`, not by testing whether the path',\n        'is lexically under the governed root. It has to be said that way round: the resolver used to do the',\n        'path test, and a linked worktree under `.claude/worktrees/**` therefore resolved `f` — every bash',\n        'guard exempt in the one sandbox agents are told to work in. A sentence in this file asserted the',\n        'opposite as fact for several releases, which is how it went unnoticed.',\n        '',\n        'Only a LEADING run of `cd`/`pushd` counts. A *trailing* `… && cd <exempt-tree>` must never',\n        'retroactively pull a command out of scope — that would smuggle a root-level `git push` past the',\n        'guards. Quoting is handled by `ShellSegmentScan`, so `echo \"cd sub && git push\"` is one opaque',\n        'segment and its quoted `cd` is never picked up.',\n        '',\n        ...renderFilterSection(),\n    ];\n}\n\n// `excludePaths` — a FILTER over the rule list, not a dimension of the table. Its own function because\n// renderHead is at the 70-line method cap, and because this section is one self-contained argument.\n// webpieces-disable no-function-outside-class -- prose section of renderL1Doc's string, beside it in this module\nfunction renderFilterSection(): string[] {\n    return [\n        '## Filter — not a dimension (all tools)',\n        '',\n        '`filterByExcludedPaths` drops every rule excluded for this path: the **target path** for',\n        'Read/Write/Edit, `effectiveCwd` for Bash. An empty rule list means allow. This is a filter, not a row:',\n        '\"exempt\" is what emerges when the list empties.',\n        '',\n        'ONE path is filtered out BEFORE the list is consulted and cannot be put back: **`.webpieces/`**,',\n        'the tooling\\'s own state dir (`isWebpiecesStateDir`). It is gitignored in every consumer, so nothing',\n        'under it can reach a branch, be reviewed or be reverted — every reason L2 prints for protecting',\n        '`main` is vacuous there. It was config-only once, which made the exemption optional on exactly the',\n        'directory webpieces itself writes to: `wp-review-upsert-pr` hands a reviewer subagent a',\n        '`<primary>/.webpieces/worktrees/agent-＜id＞/pr-review/…` path, that write resolves to the PRIMARY',\n        'clone, and L2 judged the primary\\'s live branch — so the reviewer was denied \"You should not be',\n        'working on main\" whenever an unrelated session had left the primary there. There is deliberately',\n        'NO companion `\".webpieces/**\"` glob seeded into `excludePaths`: a config entry that changes',\n        'nothing is a second and WEAKER spelling — the matcher below misses the bare directory that the',\n        'predicate matches — and it invites a consumer to delete it and believe the exemption went too.',\n        '',\n        // The SUBJECT of this paragraph is which SPELLING of the state dir is exempt, so the two\n        // spellings have to appear literally — computing them from a resolver would print one path and\n        // destroy the contrast that is the whole point. This is exactly the case the rule's own escape\n        // is for, and it is scoped to the three lines below rather than the file.\n        '<!-- webpieces-disable no-state-paths-in-templates -- this paragraph\\'s subject IS the two spellings of the state dir; a computed path would print one of them and lose the contrast -->',\n        'The skip is asked about the path relative to the tree that **OWNS** the file, not to the governed',\n        'root, and the two differ in exactly one place: a linked worktree. `<primary>/.webpieces/…` was',\n        'exempt while `<primary>/.claude/worktrees/agent-＜id＞/.webpieces/pr-review/…/review.json` — the same',\n        'kind of file, in a worktree\\'s own state dir — was not, because governed-root-relative it begins',\n        '`.claude`. That is the file `wp-review-upsert-pr` REQUIRES before `wp-finish-upsert-pr` will open a',\n        'PR, so the guard could forbid a file the gate demands (issue #851). `GovernedPath` carries both',\n        'spellings together so a caller cannot reach for the wrong one.',\n        '',\n        '`excludePaths` is **ONE glob list** (canonical: `\"excludePaths\": [\"repositories/**\"]`). The',\n        '`{ rules: [...], guards: [...] }` object is **retired and rejected**, with the union it must become',\n        'named in the error. `wp-install-ai-hooks` migrates it in place.',\n        '',\n        'This used to be a tolerated fallback, justified here by \"rejecting it would block every Bash/Edit',\n        'including the edit that would fix it.\" **That was never true**, and the fallback it licensed is why',\n        'consumer configs — this repo\\'s own included — sat on the dead shape for releases. A Write/Edit whose',\n        'target is `webpieces.config.json` is an unconditional **PASS** (see the L0 table above), and',\n        '`pnpm install` has an installer bypass, so an invalid config can always be repaired from inside the',\n        'block. Config rejection is self-recoverable by construction; see `retired-config-keys.ts` for the',\n        'policy and the reasoning.',\n        '',\n    ];\n}\n\n// The legend, the table itself (ROW DATA), and the note on the two structural blocks.\n// webpieces-disable no-function-outside-class -- second section of renderL1Doc's string, beside it in this module\nfunction renderTable(): string[] {\n    return [\n        '## Legend',\n        '',\n        '| col | dimension | values |',\n        '|---|---|---|',\n        '| **K** | tree kind of the resolved target, from git\\'s own dirs | `f` foreign repo (a DIFFERENT `--git-common-dir`) · `m` the directory does not exist · `o` outside any repo · `w` a LINKED worktree of ours (`--git-dir` ≠ `--git-common-dir`), wherever it sits on disk · `pw` ours (primary **or** worktree) |',\n        '| **V** | do the `@webpieces` versions agree between this worktree and the MAIN tree | `n` skewed · `y` in sync |',\n        '| **R** | command is provably read-only inspection | `n` · `y` |',\n        '| **G** | command invokes git/gh | `n` · `y` |',\n        '| **P** | position of the resolved target | `root` · `sub` |',\n        '',\n        'All of them are **Bash only**. Read/Write/Edit resolve their own target (`input.filePath`) and have no',\n        'dimensions — the filter is all that applies to them. **The Read tool is never blocked by L1.**',\n        '',\n        'A linked worktree is deliberately **not** foreign: it is the same project, so the guards run against',\n        'THAT tree\\'s branch and cache. Every rule-scoped guard treats `p` and `w` alike, hence `pw`; row 8 below',\n        'is the ONE place they separate, and it turns on **V** — the versions, read off the tree itself.',\n        '',\n        'PLACEMENT IS NOT IDENTITY. A worktree checked out INSIDE the repo — `<repo>/.claude/worktrees/agent-XXXX`,',\n        'which is where Claude Code puts every agent worktree — is `w` exactly like a sibling `../feature-dir` one.',\n        'K comes from git\\'s own dirs (`--git-common-dir` is identical for every checkout of one repo,',\n        '`--git-dir` differs only in a linked worktree), never from whether the path sits under the governed root.',\n        'It used to short-circuit on that path test, so an in-repo worktree read as `f` — every bash guard exempt,',\n        'and row 8 unreachable, for the only layout the harness actually produces. A nested clone under',\n        '`repositories/**` still reads `f`, because its shared git dir is its own.',\n        '',\n        '`V` comes from reading manifests off disk — the MAIN tree\\'s `pnpm-workspace.yaml` catalog pin, its',\n        'installed `node_modules` version, this worktree\\'s pin, and this worktree\\'s own installed version when',\n        'it has one (which it does the moment anyone runs `pnpm add` there). Three always, a fourth when',\n        'present. Anything unreadable is NO OPINION, never skew: a guard that cannot measure must not block.',\n        'It is deliberately NOT read from `agent_id`/`agent_type` — the dimension this replaced was, and a',\n        'worktree-isolated agent was measured resuming on the primary clone after its tree was reaped, so who',\n        'is asking cannot be trusted to say which tree is being acted on.',\n        '',\n        '`R` is `ReadOnlyInspectionScan` — the same paranoid \"provably inert\" test the unloadable-config escape',\n        'hatch uses (allowlisted viewers/searchers only, no redirects, no `sed -i`).',\n        '',\n        '## Table',\n        '',\n        '| # | K | V | R | G | P | act | why | cure |',\n        '|---|---|---|---|---|---|---|---|---|',\n        // Row 0 is the PRE-STAGE (`misplacedCdBlock`). It decides from command TEXT before a tree is\n        // resolved, so it cannot be classified over the five dimensions rows 1-6 share — but it IS an\n        // L1 block, and an L1 block the table did not describe is exactly the drift this table exists\n        // to prevent. It is numbered 0, not 7, because it does not sit in the first-match scan; and it\n        // is PRINTED because `row=0` in the L1 log has to join to something.\n        `| ${L1_PRESTAGE_ROW} | – | – | – | – | – | 4 block | a \\`cd\\` that is not leading + literal, judged before any tree is resolved | \\`cd <literal abs path> && <the rest>\\` — ONE leading \\`cd\\`, or drop it |`,\n        ...L1_ROWS.map(tableRow),\n        '',\n        'Rows 3, 5 and 7 are the structural blocks, and they run as ONE step (`l1LocationBlock` in `runner.ts`)',\n        'so they can never be reordered by accident — row 7 (the directory is gone) first, then row 8, then',\n        'force-to-root. Row 7 is printed LAST above only because row numbers are stable across releases and',\n        'renumbering 1-6 would invalidate every `row=` in the logs; `m` matches no other row, so its position',\n        'in the scan is immaterial. All three sit after the L0',\n        'allowlist, after the `f` check, and after the `excludePaths` filter and the config-sync check. So a',\n        'cure (`cd <worktree> && pnpm install`) still reaches any tree: that is L0\\'s invariant, and row 8 does',\n        'not weaken it.',\n        '',\n    ];\n}\n\n// The use-case table (ROW DATA, in the doc's own numbering) and the two notes that follow it.\n// webpieces-disable no-function-outside-class -- third section of renderL1Doc's string, beside it in this module\nfunction renderUseCases(): string[] {\n    return [\n        '## L1 use cases',\n        '',\n        'Same row shape as L0: the **Fix** is literal or it is not a fix. `<root>` is the absolute workspace',\n        'root — the messages name it explicitly rather than telling you to `cd` first, for the reason in the',\n        'section head (neither the shell\\'s cwd nor a `cd`\\'s persistence can be assumed).',\n        '',\n        '| # | what you SEE (exact symptom) | state | verdict | Fix |',\n        '|---|---|---|---|---|',\n        ...allL1UseCases().map(useCaseRow),\n        '',\n        'Row 8 is the one that changed. It used to be ALLOWED, because the predicate was',\n        '`shellAtRoot || cdsToRoot` — two variables OR\\'d, so the same destination got opposite verdicts',\n        'depending on where the shell happened to start. It is now one variable, `effectiveCwd === root`.',\n        '',\n        'Row 12 is the incident that produced table row 8, and it is a VERSION SKEW incident — which is why',\n        'the row that replaced it measures versions rather than agent identity. The coordinator ran',\n        '`git worktree add`, `cd`\\'d in,',\n        'and worked there. An L0 version-drift fault then fired against the PRIMARY (pin `0.4.545` vs',\n        '`node_modules` `0.4.526`) and prescribed `pnpm install` — which ran in the WORKTREE, internally',\n        'consistent at `0.4.526`/`0.4.526`, so it succeeded, changed nothing in the measured tree, and the guard',\n        're-denied. Five identical installs later the agent had invented a theory about the harness stripping',\n        'its `cd` and handed the problem to the human. Note what row 15 says: the fix is NOT to deny that',\n        'install. It is to make the split state unreachable, so the wrong-tree install is never plausible.',\n        '',\n    ];\n}\n\n// The known gap and the code anchors — prose, and the one section that must never be summarised away:\n// three code comments point at it.\n// webpieces-disable no-function-outside-class -- last section of renderL1Doc's string, beside it in this module\nfunction renderTail(): string[] {\n    return [\n        '## Not done — `o` is not exempt yet',\n        '',\n        'Row 2 hands `\\'outside\\'` down to L2 rather than exempting it. `\\'outside\\'` is produced at',\n        '`effective-tree.ts` (git has no answer for the directory) carrying `governedRoot`, and **no code branches on it**, so a',\n        'command in no git repo is judged against the governed repo\\'s branch and staleness state. That is a',\n        'wrong verdict, and `exempt` is the right action.',\n        '',\n        '**It must not ship alone.** Jurisdiction comes from the shell cwd, not from what the command touches,',\n        'so exempting `o` opens a bypass an agent reaches by typing `cd /tmp &&`:',\n        '',\n        '| command | today | with `o → exempt` alone |',\n        '|---|---|---|',\n        '| `cd /tmp && ls` | judged against the repo | exempt — **correct** |',\n        '| `cd /tmp && git -C $REPO commit` | L2 guards fire | exempt — **every L2 guard bypassed** |',\n        '| `cd /tmp && rm -rf $REPO/packages/http/src` | judged | exempt — **unguarded** |',\n        '',\n        'The two cases only separate once jurisdiction is judged on **what the command touches** (explicit',\n        '`git -C` / `--work-tree`, then path arguments, then the `cd`, then the shell cwd), with the fail-safe',\n        'rule that **any** resolved target inside `governedRoot` means `pw`. Ship the two together, or neither.',\n        '',\n        'Tracked in `backlog/bug-bash-guards-judge-the-shell-cwd-not-the-paths-the-command-touches.md` and',\n        '`backlog/bug-outside-tree-kind-is-never-consumed-so-a-non-git-dir-is-judged-against-the-governed-repo.md`.',\n        'That resolver has three consumers — L1\\'s K, L2\\'s scope dimension, and `excludePaths` on the Bash path',\n        '— which is why the backlog says **fix once**.',\n        '',\n        '---',\n        '',\n        '',\n        '## Code anchors',\n        '',\n        '| section | file | symbol |',\n        '|---|---|---|',\n        '| resolver, K | `ai-hook-rules/src/core/effective-tree.ts` | `EffectiveTreeResolver`, `TreeKind` |',\n        '| the two structural blocks, in order | `ai-hook-rules/src/core/runner.ts` | `l1LocationBlock` |',\n        '| trinary-version-skew (row 8), V, R | `ai-hook-rules/src/core/version-sync.ts` | `VersionSyncGuard`, `WebpiecesVersions` |',\n        '| force-to-root (row 5) | `ai-hook-rules/src/core/force-to-root.ts` | `ForceToRootGuard` |',\n        '| the directory is gone (row 7) | `ai-hook-rules/src/core/missing-directory.ts` | `MissingDirectoryGuard` |',\n        '| the filter | `ai-hook-rules/src/core/excluded-paths.ts` | `filterByExcludedPaths` |',\n        '| which tree owns a TARGET PATH | `ai-hook-rules/src/core/target-tree.ts` | `TargetTreeResolver`, `GovernedPath` |',\n        '| `excludePaths` shape | `rules-config/src/exclude-hook-paths.ts`, `validate-config.ts`, `retired-config-keys.ts` | `ExcludePaths`, `validateExcludePaths` |',\n        '| the `.webpieces/` skip | `rules-config/src/exclude-hook-paths.ts` | `isWebpiecesStateDir` |',\n        '',\n    ];\n}\n"]}

package/src/core/l1-rows.js

@@ -236,6 +236,7 @@ exports.L1_UNROWED_USE_CASES = [
     new L1UseCase(3, 'Edit `packages/http/foo.ts` blocked on stale main', 'filter keeps the rules → L2 fires', 'BLOCK (at L2)', 'that is L2\'s write-on-main verdict, not L1\'s — follow the L2 message'),
     new L1UseCase(4, 'Edit `packages/http/foo.ts` judged even though the shell is in `/tmp`', 'filter, on the TARGET path', '→ L2', 'none — for file tools the cwd is irrelevant; do NOT `cd` anywhere to "fix" it'),
     new L1UseCase(20, 'Write `.webpieces/worktrees/agent-＊/pr-review/…/review-＊.json` allowed on main, with `excludePaths` empty', 'filter — `.webpieces/` is HARD-CODED exempt (`isWebpiecesStateDir`), ahead of the config list', 'ALLOW_EXEMPT', 'none needed — the dir is gitignored, so no config can put it back under governance'),
+    new L1UseCase(21, 'Write a reviewer verdict into a WORKTREE\'s own state dir — the `.webpieces` under `.claude/worktrees/agent-＊`, not the primary\'s', 'filter — the state-dir skip is asked about the path relative to the tree that OWNS it, not the governed root', 'ALLOW_EXEMPT', 'none — it was NOT exempt before (governed-root-relative that path begins `.claude`), and `wp-review-upsert-pr` requires the file before a PR can be opened'),
     new L1UseCase(15, '`cd <worktree> && pnpm install` still runs while row 8 is live — it is the CURE', 'L0 allowlist, ahead of L1', 'ALLOW', 'none — a cure must stay reachable from every tree'),
 ];
 /** Every use case, in the doc's numbering — the order the table is rendered and read in. */

package/src/core/l1-rows.js.map

@@ -1 +1 @@
-{"version":3,"file":"l1-rows.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/l1-rows.ts"],"names":[],"mappings":";;;AAgXA,sCAGC;AAUD,gDAIC;AA5UD;;;;;;;;;;;GAWG;AACU,QAAA,eAAe,GAAG,GAAG,CAAC;AAEnC;;;;;GAKG;AACH,MAAa,gBAAgB;IAGZ;IACA;IACA;IACA;IACA;IANb,kGAAkG;IAClG,YACa,IAAY,EACZ,cAAuB,EACvB,QAAiB,EACjB,GAAY,EACZ,MAAe;QAJf,SAAI,GAAJ,IAAI,CAAQ;QACZ,mBAAc,GAAd,cAAc,CAAS;QACvB,aAAQ,GAAR,QAAQ,CAAS;QACjB,QAAG,GAAH,GAAG,CAAS;QACZ,WAAM,GAAN,MAAM,CAAS;IACzB,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,oGAAoG;IACpG,kMAAkM;IAClM,MAAM,CAAC,cAAc,CACjB,QAAkB,EAClB,cAAuB,EACvB,QAAiB,EACjB,GAAY,EACZ,MAAe;QAEf,MAAM,IAAI,GAAW,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG;YAC7C,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG;gBAC9B,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1C,OAAO,IAAI,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;CACJ;AAnCD,4CAmCC;AAED,kGAAkG;AAClG,MAAa,QAAQ;IACI;IAAwB;IAA7C,YAAqB,KAAa,EAAW,IAAkB;QAA1C,UAAK,GAAL,KAAK,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAc;IAAG,CAAC;CACtE;AAFD,4BAEC;AAEY,QAAA,UAAU,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAChD,QAAA,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,QAAA,SAAS,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAa,MAAM;IAGF;IAEA;IACA;IALb;IACI,4CAA4C;IACnC,OAAe;IACxB,kFAAkF;IACzE,WAAmB,EACnB,QAAiB;QAHjB,YAAO,GAAP,OAAO,CAAQ;QAEf,gBAAW,GAAX,WAAW,CAAQ;QACnB,aAAQ,GAAR,QAAQ,CAAS;IAC3B,CAAC;CACP;AARD,wBAQC;AAED;;;;;;;GAOG;AACH,MAAa,SAAS;IAGL;IACA;IACA;IACA;IACA;IACA;IAPb,wHAAwH;IACxH,YACa,GAAW,EACX,OAAe,EACf,KAAa,EACb,OAAe,EACf,GAAW,EACX,iBAA0C,IAAI;QAL9C,QAAG,GAAH,GAAG,CAAQ;QACX,YAAO,GAAP,OAAO,CAAQ;QACf,UAAK,GAAL,KAAK,CAAQ;QACb,YAAO,GAAP,OAAO,CAAQ;QACf,QAAG,GAAH,GAAG,CAAQ;QACX,mBAAc,GAAd,cAAc,CAAgC;IACxD,CAAC;CACP;AAVD,8BAUC;AAED,0EAA0E;AAC1E,MAAa,KAAK;IAGD;IACA;IACA;IACA;IACA;IACA;IACA;IAEA;IACA;IACA;IACA;IAbb,oHAAoH;IACpH,YACa,GAAW,EACX,CAAc,EACd,CAAgB,EAChB,CAAS,EACT,CAAS,EACT,CAAuB,EACvB,MAAgB;IACzB,gCAAgC;IACvB,GAAW,EACX,IAAmB,EACnB,OAAyB,EACzB,QAA8B;QAX9B,QAAG,GAAH,GAAG,CAAQ;QACX,MAAC,GAAD,CAAC,CAAa;QACd,MAAC,GAAD,CAAC,CAAe;QAChB,MAAC,GAAD,CAAC,CAAQ;QACT,MAAC,GAAD,CAAC,CAAQ;QACT,MAAC,GAAD,CAAC,CAAsB;QACvB,WAAM,GAAN,MAAM,CAAU;QAEhB,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAe;QACnB,YAAO,GAAP,OAAO,CAAkB;QACzB,aAAQ,GAAR,QAAQ,CAAsB;IACxC,CAAC;IAEJ,OAAO,CAAC,CAAmB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAC1E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IAEO,WAAW,CAAC,IAAY;QAC5B,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QACzD,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;IAC3B,CAAC;CACJ;AA9BD,sBA8BC;AAED,oGAAoG;AACpG,sGAAsG;AACtG,6GAA6G;AAC7G,SAAS,WAAW,CAAC,IAAY,EAAE,KAAc;IAC7C,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,KAAK,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACU,QAAA,OAAO,GAAqB;IACrC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,kBAAU,EAAE,gCAAgC,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5F,IAAI,SAAS,CAAC,CAAC,EACX,iEAAiE,EACjE,uBAAuB,EACvB,cAAc,EACd,gHAAgH,EAChH,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC5D,CAAC;IACF,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IACvF,oGAAoG;IACpG,gGAAgG;IAChG,oGAAoG;IACpG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAS,EAC3C,8EAA8E,EAC9E,IAAI,MAAM,CAAC,4HAA4H,EACnI,yBAAyB,EAAE,KAAK,CAAC,EACrC,sBAAsB,EAAE;QACpB,IAAI,SAAS,CAAC,EAAE,EACZ,yHAAyH,EACzH,yBAAyB,EACzB,eAAe,EACf,mgCAAmgC,EACngC,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,sEAAsE,EACtE,yDAAyD,EACzD,eAAe,EACf,wtBAAwtB,EACxtB,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAC5D,CAAC;IACN,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAQ,EAAE,mCAAmC,EAAE,IAAI,EAAE,IAAI,EAAE;QAC9F,IAAI,SAAS,CAAC,CAAC,EACX,0CAA0C,EAC1C,wBAAwB,EACxB,sBAAsB,EACtB,gEAAgE,EAChE,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,CAAC,EACX,iDAAiD,EACjD,wBAAwB,EACxB,sBAAsB,EACtB,wEAAwE,EACxE,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,SAAS,CAAC,EAAE,EACZ,oCAAoC,EACpC,6BAA6B,EAC7B,sBAAsB,EACtB,2FAA2F,EAC3F,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,oDAAoD,EACpD,kCAAkC,EAClC,sBAAsB,EACtB,+DAA+D,EAC/D,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,SAAS,CAAC,EAAE,EACZ,qFAAqF,EACrF,wCAAwC,EACxC,sBAAsB,EACtB,uTAAuT,EACvT,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAS,EAAE,2BAA2B,EAC3E,IAAI,MAAM,CAAC,2BAA2B,EAAE,wCAAwC,EAAE,IAAI,CAAC,EACvF,eAAe,EAAE;QACb,IAAI,SAAS,CAAC,CAAC,EACX,+CAA+C,EAC/C,4BAA4B,EAC5B,eAAe,EACf,iDAAiD,EACjD,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,CAAC,EACX,qEAAqE,EACrE,4BAA4B,EAC5B,eAAe,EACf,kLAAkL,EAClL,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,0FAA0F,EAC1F,sDAAsD,EACtD,eAAe,EACf,8IAA8I,EAC9I,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,uEAAuE,EACvE,gDAAgD,EAChD,eAAe,EACf,qSAAqS,EACrS,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC5D,CAAC;IACN,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QAChE,IAAI,SAAS,CAAC,CAAC,EACX,gDAAgD,EAChD,6BAA6B,EAC7B,sBAAsB,EACtB,oCAAoC,EACpC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAS,EAAE,+CAA+C,EAC5F,IAAI,MAAM,CAAC,6DAA6D,EACpE,kBAAkB,EAAE,IAAI,CAAC,EAC7B,mBAAmB,EAAE;QACjB,IAAI,SAAS,CAAC,EAAE,EACZ,2EAA2E,EAC3E,aAAa,EACb,eAAe,EACf,4OAA4O,EAC5O,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,wEAAwE,EACxE,iCAAiC,EACjC,eAAe,EACf,+IAA+I,EAC/I,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAC7D,CAAC;CACT,CAAC;AAEF;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAyB;IACtD,IAAI,SAAS,CAAC,CAAC,EACX,gEAAgE,EAChE,wCAAwC,EACxC,cAAc,EACd,aAAa,CAAC;IAClB,IAAI,SAAS,CAAC,CAAC,EACX,mDAAmD,EACnD,mCAAmC,EACnC,eAAe,EACf,wEAAwE,CAAC;IAC7E,IAAI,SAAS,CAAC,CAAC,EACX,uEAAuE,EACvE,4BAA4B,EAC5B,MAAM,EACN,+EAA+E,CAAC;IACpF,IAAI,SAAS,CAAC,EAAE,EACZ,2GAA2G,EAC3G,+FAA+F,EAC/F,cAAc,EACd,oFAAoF,CAAC;IACzF,IAAI,SAAS,CAAC,EAAE,EACZ,iFAAiF,EACjF,2BAA2B,EAC3B,OAAO,EACP,mDAAmD,CAAC;CAC3D,CAAC;AAEF,4FAA4F;AAC5F,0HAA0H;AAC1H,SAAgB,aAAa;IACzB,MAAM,GAAG,GAAG,CAAC,GAAG,eAAO,CAAC,OAAO,CAAC,CAAC,GAAU,EAAwB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,4BAAoB,CAAC,CAAC;IAC9G,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,EAAE,CAAY,EAAU,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,qGAAqG;AACrG,SAAgB,kBAAkB,CAAC,CAAmB;IAClD,MAAM,GAAG,GAAG,eAAO,CAAC,IAAI,CAAC,CAAC,CAAQ,EAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,OAAO,GAAG,CAAC;AACf,CAAC","sourcesContent":["import type { TreeKind } from './effective-tree';\n\n// ---------------------------------------------------------------------------\n// L1 — the LOCATION layer, as data.\n//\n// L1 answers four questions: do we govern this call at all, does the directory still EXIST, is the\n// WRONG AGENT standing here, and is the agent stranded away from the root? Drawn as a decision matrix\n// that is SEVEN ordered rows over five dimensions (K/A/R/G/P), first match wins.\n//\n// This module holds those rows, and l1-doc.ts renders them into guards/L1-location.md — the doc a human\n// reads on GitHub. A unit test locks that file byte-identical to the renderer, and the guard itself\n// CONSULTS L1_ROWS to decide which structural block fires (see runner.l1LocationBlock). Doc and code\n// come from the SAME array, so they cannot drift.\n//\n// This module is deliberately import-free at runtime (only a type-only import above), so\n// `pnpm guards:generate` can load it without the package's transitive dependencies.\n// ---------------------------------------------------------------------------\n\n/**\n * The K dimension as a CLASSIFICATION carries — one concrete tree, never the `pw` union.\n *\n * `p` and `w` are the same PROJECT and every rule-scoped guard treats them alike; the doc writes the\n * pair as `pw` in the row's MATCHER (below), which is a different vocabulary on purpose.\n */\nexport type L1Kind = 'f' | 'm' | 'o' | 'p' | 'w';\n\n/** The K value a ROW matches on. `pw` matches both `p` and `w`; `-` is the wildcard. */\nexport type L1KindMatch = 'f' | 'm' | 'o' | 'w' | 'pw' | '-';\n\n/** R and G are yes/no, written `y`/`n` in the doc, with `-` for \"does not matter\". */\nexport type L1Flag = 'y' | 'n' | '-';\n\n/**\n * V is the same one boolean wearing the doc's own letters: `n` the webpieces versions do NOT agree\n * between this worktree and the main tree, `y` they do.\n *\n * This dimension used to be A (`c` coordinator / `s` subagent). It was replaced rather than removed\n * because agent identity was measured untrustworthy as a proxy for \"which tree am I in\" — a\n * worktree-isolated agent auto-reaped at a turn boundary silently resumes on the primary clone. A\n * version read off the PATH being acted on cannot lie in that way.\n */\nexport type L1VersionSync = 'y' | 'n' | '-';\n\n/** What L1 does with a row. The labels are the doc's own action codebook (see GUARD_MATRIX.md). */\nexport type L1ActionKind = 'exempt' | 'down' | 'block';\n\n/**\n * WHICH structural block a blocking row dispatches to. This is the field that makes the array\n * load-bearing rather than decorative: runner.l1LocationBlock looks the row up and switches on it,\n * so deleting a row from the array removes the block.\n */\nexport type L1BlockId = 'trinary-version-skew' | 'force-to-root' | 'missing-directory';\n\n/**\n * The row number for L1's PRE-STAGE — `misplacedCdBlock`, which decides from command TEXT before a\n * tree has been resolved, and therefore cannot be classified over the five dimensions rows 1-6 use\n * (asking L1_ROWS to classify it would need the very resolution its answer determines).\n *\n * ZERO rather than a seventh row, deliberately. It has to appear in the table — an L1 block the\n * generated doc did not describe is precisely the drift the table exists to prevent, and it was\n * carrying a `KNOWN GAP` comment saying so. But numbering it 7 would assert it sits in the same\n * first-match scan as the others, which is the one thing that is not true about it. Row 0 says\n * \"decided before the scan\" in the number itself. `renderL1Doc()` PRINTS this row above the six, so\n * `row=0` in the L1 log joins to a line the reader can actually find.\n */\nexport const L1_PRESTAGE_ROW = '0';\n\n/**\n * One point in the five-dimensional space L1 classifies over. Data-only → a class, per CLAUDE.md.\n *\n * The dimensions are exactly the doc's legend: K (tree kind of the resolved target), V (webpieces versions in sync or\n * subagent), R (provably read-only inspection), G (invokes git/gh), P (root or subdirectory).\n */\nexport class L1Classification {\n    // eslint-disable-next-line @typescript-eslint/max-params -- five dimensions is the matrix's shape\n    constructor(\n        readonly kind: L1Kind,\n        readonly versionsSkewed: boolean,\n        readonly readOnly: boolean,\n        readonly git: boolean,\n        readonly atRoot: boolean,\n    ) {}\n\n    /**\n     * The classification the RUNNER enforces on, built from the resolved tree and the caller.\n     *\n     * `'outside'` maps to `p`, and that is not a typo. TreeKind `'outside'` is produced by\n     * effective-tree.ts (git has no answer for the directory) and consumed NOWHERE, so a command in no git repo is\n     * judged against the governed repo exactly as if it stood in it. Row 2 (`o` → L2) describes what\n     * SHOULD happen and is deliberately unreachable from here until the \"Not done\" fix in\n     * guards/L1-location.md lands — exempting `o` alone opens a `cd /tmp &&` bypass of every L2 guard,\n     * so the two ship together or neither does. Mapping it to `p` here is what preserves today's\n     * behaviour (a `git` command from /tmp is still force-to-root blocked); it is not an endorsement.\n     */\n    // eslint-disable-next-line @typescript-eslint/max-params -- mirrors the constructor it delegates to\n    // webpieces-disable no-function-outside-class -- a named constructor for this data class, not a service: it takes the runner's TreeKind and returns the same class, so there is nothing to inject\n    static forEnforcement(\n        treeKind: TreeKind,\n        versionsSkewed: boolean,\n        readOnly: boolean,\n        git: boolean,\n        atRoot: boolean,\n    ): L1Classification {\n        const kind: L1Kind = treeKind === 'foreign' ? 'f'\n            : treeKind === 'missing' ? 'm'\n            : treeKind === 'worktree' ? 'w' : 'p';\n        return new L1Classification(kind, versionsSkewed, readOnly, git, atRoot);\n    }\n}\n\n/** The `act` cell of a row: the doc's literal label, plus the machine-readable kind behind it. */\nexport class L1Action {\n    constructor(readonly label: string, readonly kind: L1ActionKind) {}\n}\n\nexport const ACT_EXEMPT = new L1Action('2 exempt', 'exempt');\nexport const ACT_DOWN = new L1Action('→ L2', 'down');\nexport const ACT_BLOCK = new L1Action('4 block', 'block');\n\n/**\n * The CURE a blocking row prescribes.\n *\n * `runnable` is the axis that matters to the tests: a cure that is a command must, once applied,\n * actually stop the row from matching (cure reachability). Row 3's cure is an INSTRUCTION — \"spawn a\n * subagent bound to the worktree\" — which no allowlist can accept and no reclassification can model,\n * so it declares `runnable: false` and is asserted only on the deny text.\n */\nexport class L1Cure {\n    constructor(\n        /** How the doc's `why` column spells it. */\n        readonly summary: string,\n        /** A substring that MUST appear in the deny text the guard emits for this row. */\n        readonly denyMention: string,\n        readonly runnable: boolean,\n    ) {}\n}\n\n/**\n * One row of the \"L1 use cases\" table: what you SEE, the state it puts you in, the verdict, the fix.\n *\n * The four text fields are rendered VERBATIM into the doc. `classification` is the same case expressed\n * in the matrix's own vocabulary so the tests can run it through the matcher — it is test/enforcement\n * data, never rendered, which is why a use case that exercises the FILTER or the L0 allowlist (neither\n * of which is a row) can carry `null` there.\n */\nexport class L1UseCase {\n    // eslint-disable-next-line @typescript-eslint/max-params -- four verbatim doc cells plus the classification behind them\n    constructor(\n        readonly num: number,\n        readonly symptom: string,\n        readonly state: string,\n        readonly verdict: string,\n        readonly fix: string,\n        readonly classification: L1Classification | null = null,\n    ) {}\n}\n\n/** One row of L1's decision table. Data-only → a class, per CLAUDE.md. */\nexport class L1Row {\n    // eslint-disable-next-line @typescript-eslint/max-params -- five dimension cells plus act/why/cure/blockId/useCases\n    constructor(\n        readonly num: number,\n        readonly k: L1KindMatch,\n        readonly a: L1VersionSync,\n        readonly r: L1Flag,\n        readonly g: L1Flag,\n        readonly p: 'root' | 'sub' | '-',\n        readonly action: L1Action,\n        /** The `why` cell, verbatim. */\n        readonly why: string,\n        readonly cure: L1Cure | null,\n        readonly blockId: L1BlockId | null,\n        readonly useCases: readonly L1UseCase[],\n    ) {}\n\n    matches(c: L1Classification): boolean {\n        if (!this.kindMatches(c.kind)) return false;\n        if (this.a !== '-' && (this.a === 'n') !== c.versionsSkewed) return false;\n        if (!flagMatches(this.r, c.readOnly)) return false;\n        if (!flagMatches(this.g, c.git)) return false;\n        return this.p === '-' || this.p === (c.atRoot ? 'root' : 'sub');\n    }\n\n    private kindMatches(kind: L1Kind): boolean {\n        if (this.k === '-') return true;\n        if (this.k === 'pw') return kind === 'p' || kind === 'w';\n        return this.k === kind;\n    }\n}\n\n// R and G are one boolean each behind a `y`/`n`/`-` cell, so one helper answers for both. (A is the\n// same shape but spelled `c`/`s`, and is matched inline above so the row literals read like the doc.)\n// webpieces-disable no-function-outside-class -- pure predicate for L1Row.matches above, in this data module\nfunction flagMatches(cell: L1Flag, value: boolean): boolean {\n    if (cell === '-') return true;\n    return (cell === 'y') === value;\n}\n\n/**\n * THE seven L1 rows, in first-match-wins order.\n *\n * Rows 3, 5 and 7 are the structural blocks and they run as ONE step (runner.l1LocationBlock) so they\n * can never be reordered by accident. Every other row is a hand-down or an exemption, i.e. \"L1 has no\n * objection\" — which is why only those three carry a blockId.\n *\n * Row 7 (`m`, the vanished directory) sits LAST only because row numbers are stable across releases —\n * they are printed in the doc and logged as `row=`, so renumbering rows 1-6 to slot it in front would\n * silently invalidate every existing reference. Position costs nothing here: `m` is matched by no other\n * row, so first-match reaches it wherever it sits.\n */\nexport const L1_ROWS: readonly L1Row[] = [\n    new L1Row(1, 'f', '-', '-', '-', '-', ACT_EXEMPT, 'different git repo — hands off', null, null, [\n        new L1UseCase(1,\n            '`cd repositories/vendored && git commit` goes through untouched',\n            '`f` / `y` / - — row 1',\n            'ALLOW_EXEMPT',\n            'none needed — jurisdiction is judged on the RESOLVED target, after the `cd`; a different git repo is hands-off',\n            new L1Classification('f', false, false, true, false)),\n    ]),\n    new L1Row(2, 'o', '-', '-', '-', '-', ACT_DOWN, 'see \"Not done\" below', null, null, []),\n    // ROW 3 IS RETIRED — it was coordinator-in-worktree, deleted with CoordinatorWorktreeGuard when the\n    // guard hooks went ABSOLUTE (one governor, so the filesystem/governance split it policed became\n    // unconstructible). The NUMBER is never reused: row numbers are identity here — they are printed in\n    // denies, logged as `row=`, and cited in guards/L1-location.md — so renumbering would silently\n    // re-point every historical reference. Its replacement is row 8.\n    new L1Row(8, 'w', 'n', 'n', '-', '-', ACT_BLOCK,\n        'this worktree pins a DIFFERENT @webpieces than the main tree that governs it',\n        new L1Cure('align the pins (same git hash -> same tracked pin -> install in each tree), work in the main tree, or use a separate clone',\n            '@webpieces version SKEW', false),\n        'trinary-version-skew', [\n            new L1UseCase(12,\n                'a worktree on an older branch pins `0.4.612` while the main tree runs `0.4.616`, and `cd <wt> && pnpm build` is blocked',\n                '`w` / `n` / `n` — row 8',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): the MAIN tree is AHEAD, so this is YOURS and it is a one-line edit — raise THIS tree\\'s catalog pin in `pnpm-workspace.yaml` to what main already runs, then `pnpm install` here if this tree has a node_modules. That edit is on the L0 allowlist, so it is typable while the block is up, and nothing has to move in the main tree<br>Option 2: do the work in the main tree, which this guard never blocks<br>Option 3: if the tree genuinely needs a DIFFERENT version, use a separate CLONE — a clone gets its own governance. That is the answer to \"I need a different version\", never to \"I need to install here\": a worktree MAY have its own node_modules (nx, vitest and the eslint plugin all load from it), it just may not hold a different @webpieces version<br>Do NOT: lower the MAIN tree\\'s pin to match — that downgrades every tree, including this session\\'s own governor. And do NOT reach for `pnpm install` BEFORE the edit: this tree\\'s pin is the stale side, so installing first materializes the OLD release',\n                new L1Classification('w', true, false, false, false)),\n            new L1UseCase(16,\n                'a SUBAGENT hits the same block inside `.claude/worktrees/agent-XXXX`',\n                '`w` / `n` / `n` — row 8; in-repo placement is still `w`',\n                'BLOCK_AI_CURE',\n                'READ THE DIRECTION FIRST — the deny prints it. If the MAIN tree is AHEAD (the common case) a subagent fixes this ITSELF, here, by raising this tree\\'s pin to what main already runs; there is nothing to escalate and the deny prints no escalation. Only when main is BEHIND, or when this branch bumped the pin on purpose, is the subagent stuck — the main tree is outside its tree, and a worktree-isolated agent may not even still be in the tree it was launched in (measured: auto-reaped at a turn boundary, resumed on the primary). Then, and only then, forward the deny\\'s verbatim ask to the coordinator and STOP<br>Do NOT: expect exemption because it sits under the repo — K is git\\'s `--git-common-dir` answer, not a path test',\n                new L1Classification('w', true, false, false, false)),\n        ]),\n    new L1Row(4, 'pw', '-', '-', 'n', '-', ACT_DOWN, 'force-to-root has no jurisdiction', null, null, [\n        new L1UseCase(5,\n            '`ls` from `packages/http/` runs normally',\n            '`pw` / `n` / - — row 4',\n            'ALLOW (handed to L2)',\n            'none — force-to-root has no jurisdiction over non-git commands',\n            new L1Classification('p', false, true, false, false)),\n        new L1UseCase(6,\n            '`pnpm test` from `packages/http/` runs normally',\n            '`pw` / `n` / - — row 4',\n            'ALLOW (handed to L2)',\n            'none — deliberately untouched, so package-local test runs stay natural',\n            new L1Classification('p', false, false, false, false)),\n        new L1UseCase(10,\n            '`echo \"cd sub && git push\"` passes',\n            '`pw` / `n` / `root` — row 4',\n            'ALLOW (handed to L2)',\n            'none — the `cd` is inside quotes, so `ShellSegmentScan` never treats it as a scope escape',\n            new L1Classification('p', false, false, false, true)),\n        new L1UseCase(13,\n            'the same command from a **subagent** runs normally',\n            '`w` / `y` — row 8 does not match',\n            'ALLOW (handed to L2)',\n            'none — a subagent pinned to a worktree is the correct pattern',\n            new L1Classification('w', false, false, false, false)),\n        new L1UseCase(14,\n            'inspection inside a SKEWED worktree still runs — `cd <worktree> && ls`/`cat`/`grep`',\n            '`w` / `n` / `y` — row 8 does not match',\n            'ALLOW (handed to L2)',\n            'none — inspection is always open; so are the `Read` tool, `git -C <dir INSIDE this tree> …` and `git show <branch>:<file>`, none of which move you. `git -C <ANOTHER tree>` is a different matter: the harness refuses cross-tree git to a subagent, so it is never the cure for a skew — tell the MAIN agent instead',\n            new L1Classification('w', true, true, false, false)),\n    ]),\n    new L1Row(5, 'pw', '-', '-', 'y', 'sub', ACT_BLOCK, '`cd <root> && <original>`',\n        new L1Cure('`cd <root> && <original>`', 'Run git/gh commands from the repo root', true),\n        'force-to-root', [\n            new L1UseCase(7,\n                '`git status` from `packages/http/` is blocked',\n                '`pw` / `y` / `sub` — row 5',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): `cd <root> && git status`',\n                new L1Classification('p', false, false, true, false)),\n            new L1UseCase(8,\n                '`cd packages/http && git status` **typed from the root** is blocked',\n                '`pw` / `y` / `sub` — row 5',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): `cd <root> && git status`<br>Do NOT: assume it is allowed because you started at the root — the predicate is `effectiveCwd === root`, i.e. the DESTINATION',\n                new L1Classification('p', false, false, true, false)),\n            new L1UseCase(11,\n                '`cd <subdir> && git push` blocked with the force-to-root message, NOT the gated-flow one',\n                '`pw` / `y` / `sub` — row 5; force-to-root runs first',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): `cd <root> && git push`, which then gets the push guard\\'s real answer ← costs one extra turn by design; still blocked',\n                new L1Classification('p', false, false, true, false)),\n            new L1UseCase(17,\n                'the printed cure REPLACES your `cd`, it does not stack in front of it',\n                '`pw` / `y` / `sub` — row 5, on the cure itself',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): run the printed line VERBATIM — `cd <root> && <the work>`, with your own leading `cd` dropped<br>Do NOT: paste `cd <root> && cd <subdir> && <work>`; `effectiveCwd` resolves the leading `cd`s left to right, so that lands in `<subdir>` again and re-fires this exact block',\n                new L1Classification('p', false, false, true, false)),\n        ]),\n    new L1Row(6, 'pw', '-', '-', 'y', 'root', ACT_DOWN, '', null, null, [\n        new L1UseCase(9,\n            '`cd <root> && git status` passes from anywhere',\n            '`pw` / `y` / `root` — row 6',\n            'ALLOW (handed to L2)',\n            'none — this IS the prescribed cure',\n            new L1Classification('p', false, false, true, true)),\n    ]),\n    new L1Row(7, 'm', '-', '-', '-', '-', ACT_BLOCK, 'the directory is GONE — nothing can run there',\n        new L1Cure('`cd <root> && <the work>`, never back through the dead path',\n            'no longer exists', true),\n        'missing-directory', [\n            new L1UseCase(18,\n                'every command from a worktree another agent REAPED mid-session is blocked',\n                '`m` — row 7',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): run the printed `cd <root> && <the work>` line — it does NOT route back through the dead path<br>Do NOT: re-`cd` into the worktree, or `git worktree add` it back expecting your uncommitted work; that work is gone',\n                new L1Classification('m', false, false, true, false)),\n            new L1UseCase(19,\n                'the same block for a NON-git command there — `m` does not care about G',\n                '`m` — row 7; K alone decides it',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): the same printed line. A vanished cwd is not a git question — nothing at all can run in a directory that does not exist',\n                new L1Classification('m', false, false, false, false)),\n        ]),\n];\n\n/**\n * The use cases that exercise something that is NOT a row: the excludePaths FILTER (2, 3, 4, 20) and the\n * L0 allowlist that runs ahead of L1 (15).\n *\n * They are use cases of L1 all the same — \"exempt\" is what emerges when the filter empties the rule\n * list, and case 15 is the invariant that a cure stays reachable from every tree — so they stay in the\n * doc's one numbered table. They carry no classification because no row classifies them.\n */\nexport const L1_UNROWED_USE_CASES: readonly L1UseCase[] = [\n    new L1UseCase(2,\n        'Edit `repositories/vendored/foo.ts` allowed even on stale main',\n        'filter — the path is in `excludePaths`',\n        'ALLOW_EXEMPT',\n        'none needed'),\n    new L1UseCase(3,\n        'Edit `packages/http/foo.ts` blocked on stale main',\n        'filter keeps the rules → L2 fires',\n        'BLOCK (at L2)',\n        'that is L2\\'s write-on-main verdict, not L1\\'s — follow the L2 message'),\n    new L1UseCase(4,\n        'Edit `packages/http/foo.ts` judged even though the shell is in `/tmp`',\n        'filter, on the TARGET path',\n        '→ L2',\n        'none — for file tools the cwd is irrelevant; do NOT `cd` anywhere to \"fix\" it'),\n    new L1UseCase(20,\n        'Write `.webpieces/worktrees/agent-＊/pr-review/…/review-＊.json` allowed on main, with `excludePaths` empty',\n        'filter — `.webpieces/` is HARD-CODED exempt (`isWebpiecesStateDir`), ahead of the config list',\n        'ALLOW_EXEMPT',\n        'none needed — the dir is gitignored, so no config can put it back under governance'),\n    new L1UseCase(15,\n        '`cd <worktree> && pnpm install` still runs while row 8 is live — it is the CURE',\n        'L0 allowlist, ahead of L1',\n        'ALLOW',\n        'none — a cure must stay reachable from every tree'),\n];\n\n/** Every use case, in the doc's numbering — the order the table is rendered and read in. */\n// webpieces-disable no-function-outside-class -- pure accessor over the two arrays above, beside them in this data module\nexport function allL1UseCases(): readonly L1UseCase[] {\n    const all = [...L1_ROWS.flatMap((row: L1Row): readonly L1UseCase[] => row.useCases), ...L1_UNROWED_USE_CASES];\n    return all.sort((a: L1UseCase, b: L1UseCase): number => a.num - b.num);\n}\n\n/**\n * FIRST MATCH WINS — the one lookup the guard and the tests share.\n *\n * Never null: rows 1, 2 and 4/5/6 between them cover every kind, and rows 4/5/6 partition G × P, so a\n * classification that matched nothing would be a hole in the matrix. The totality test asserts exactly\n * that, which is why this returns L1Row rather than L1Row | null.\n */\n// webpieces-disable no-function-outside-class -- the matcher over L1_ROWS, beside the array it reads\nexport function firstMatchingL1Row(c: L1Classification): L1Row {\n    const row = L1_ROWS.find((r: L1Row): boolean => r.matches(c));\n    if (row === undefined) throw new Error(`L1 matrix has a hole: no row matches ${JSON.stringify(c)}`);\n    return row;\n}\n"]}
+{"version":3,"file":"l1-rows.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/l1-rows.ts"],"names":[],"mappings":";;;AAqXA,sCAGC;AAUD,gDAIC;AAjVD;;;;;;;;;;;GAWG;AACU,QAAA,eAAe,GAAG,GAAG,CAAC;AAEnC;;;;;GAKG;AACH,MAAa,gBAAgB;IAGZ;IACA;IACA;IACA;IACA;IANb,kGAAkG;IAClG,YACa,IAAY,EACZ,cAAuB,EACvB,QAAiB,EACjB,GAAY,EACZ,MAAe;QAJf,SAAI,GAAJ,IAAI,CAAQ;QACZ,mBAAc,GAAd,cAAc,CAAS;QACvB,aAAQ,GAAR,QAAQ,CAAS;QACjB,QAAG,GAAH,GAAG,CAAS;QACZ,WAAM,GAAN,MAAM,CAAS;IACzB,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,oGAAoG;IACpG,kMAAkM;IAClM,MAAM,CAAC,cAAc,CACjB,QAAkB,EAClB,cAAuB,EACvB,QAAiB,EACjB,GAAY,EACZ,MAAe;QAEf,MAAM,IAAI,GAAW,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG;YAC7C,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG;gBAC9B,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1C,OAAO,IAAI,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;CACJ;AAnCD,4CAmCC;AAED,kGAAkG;AAClG,MAAa,QAAQ;IACI;IAAwB;IAA7C,YAAqB,KAAa,EAAW,IAAkB;QAA1C,UAAK,GAAL,KAAK,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAc;IAAG,CAAC;CACtE;AAFD,4BAEC;AAEY,QAAA,UAAU,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAChD,QAAA,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,QAAA,SAAS,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAa,MAAM;IAGF;IAEA;IACA;IALb;IACI,4CAA4C;IACnC,OAAe;IACxB,kFAAkF;IACzE,WAAmB,EACnB,QAAiB;QAHjB,YAAO,GAAP,OAAO,CAAQ;QAEf,gBAAW,GAAX,WAAW,CAAQ;QACnB,aAAQ,GAAR,QAAQ,CAAS;IAC3B,CAAC;CACP;AARD,wBAQC;AAED;;;;;;;GAOG;AACH,MAAa,SAAS;IAGL;IACA;IACA;IACA;IACA;IACA;IAPb,wHAAwH;IACxH,YACa,GAAW,EACX,OAAe,EACf,KAAa,EACb,OAAe,EACf,GAAW,EACX,iBAA0C,IAAI;QAL9C,QAAG,GAAH,GAAG,CAAQ;QACX,YAAO,GAAP,OAAO,CAAQ;QACf,UAAK,GAAL,KAAK,CAAQ;QACb,YAAO,GAAP,OAAO,CAAQ;QACf,QAAG,GAAH,GAAG,CAAQ;QACX,mBAAc,GAAd,cAAc,CAAgC;IACxD,CAAC;CACP;AAVD,8BAUC;AAED,0EAA0E;AAC1E,MAAa,KAAK;IAGD;IACA;IACA;IACA;IACA;IACA;IACA;IAEA;IACA;IACA;IACA;IAbb,oHAAoH;IACpH,YACa,GAAW,EACX,CAAc,EACd,CAAgB,EAChB,CAAS,EACT,CAAS,EACT,CAAuB,EACvB,MAAgB;IACzB,gCAAgC;IACvB,GAAW,EACX,IAAmB,EACnB,OAAyB,EACzB,QAA8B;QAX9B,QAAG,GAAH,GAAG,CAAQ;QACX,MAAC,GAAD,CAAC,CAAa;QACd,MAAC,GAAD,CAAC,CAAe;QAChB,MAAC,GAAD,CAAC,CAAQ;QACT,MAAC,GAAD,CAAC,CAAQ;QACT,MAAC,GAAD,CAAC,CAAsB;QACvB,WAAM,GAAN,MAAM,CAAU;QAEhB,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAe;QACnB,YAAO,GAAP,OAAO,CAAkB;QACzB,aAAQ,GAAR,QAAQ,CAAsB;IACxC,CAAC;IAEJ,OAAO,CAAC,CAAmB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAC1E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IAEO,WAAW,CAAC,IAAY;QAC5B,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QACzD,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;IAC3B,CAAC;CACJ;AA9BD,sBA8BC;AAED,oGAAoG;AACpG,sGAAsG;AACtG,6GAA6G;AAC7G,SAAS,WAAW,CAAC,IAAY,EAAE,KAAc;IAC7C,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,KAAK,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACU,QAAA,OAAO,GAAqB;IACrC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,kBAAU,EAAE,gCAAgC,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5F,IAAI,SAAS,CAAC,CAAC,EACX,iEAAiE,EACjE,uBAAuB,EACvB,cAAc,EACd,gHAAgH,EAChH,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC5D,CAAC;IACF,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IACvF,oGAAoG;IACpG,gGAAgG;IAChG,oGAAoG;IACpG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAS,EAC3C,8EAA8E,EAC9E,IAAI,MAAM,CAAC,4HAA4H,EACnI,yBAAyB,EAAE,KAAK,CAAC,EACrC,sBAAsB,EAAE;QACpB,IAAI,SAAS,CAAC,EAAE,EACZ,yHAAyH,EACzH,yBAAyB,EACzB,eAAe,EACf,mgCAAmgC,EACngC,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,sEAAsE,EACtE,yDAAyD,EACzD,eAAe,EACf,wtBAAwtB,EACxtB,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAC5D,CAAC;IACN,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAQ,EAAE,mCAAmC,EAAE,IAAI,EAAE,IAAI,EAAE;QAC9F,IAAI,SAAS,CAAC,CAAC,EACX,0CAA0C,EAC1C,wBAAwB,EACxB,sBAAsB,EACtB,gEAAgE,EAChE,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,CAAC,EACX,iDAAiD,EACjD,wBAAwB,EACxB,sBAAsB,EACtB,wEAAwE,EACxE,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,SAAS,CAAC,EAAE,EACZ,oCAAoC,EACpC,6BAA6B,EAC7B,sBAAsB,EACtB,2FAA2F,EAC3F,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,oDAAoD,EACpD,kCAAkC,EAClC,sBAAsB,EACtB,+DAA+D,EAC/D,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,SAAS,CAAC,EAAE,EACZ,qFAAqF,EACrF,wCAAwC,EACxC,sBAAsB,EACtB,uTAAuT,EACvT,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAS,EAAE,2BAA2B,EAC3E,IAAI,MAAM,CAAC,2BAA2B,EAAE,wCAAwC,EAAE,IAAI,CAAC,EACvF,eAAe,EAAE;QACb,IAAI,SAAS,CAAC,CAAC,EACX,+CAA+C,EAC/C,4BAA4B,EAC5B,eAAe,EACf,iDAAiD,EACjD,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,CAAC,EACX,qEAAqE,EACrE,4BAA4B,EAC5B,eAAe,EACf,kLAAkL,EAClL,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,0FAA0F,EAC1F,sDAAsD,EACtD,eAAe,EACf,8IAA8I,EAC9I,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,uEAAuE,EACvE,gDAAgD,EAChD,eAAe,EACf,qSAAqS,EACrS,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC5D,CAAC;IACN,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QAChE,IAAI,SAAS,CAAC,CAAC,EACX,gDAAgD,EAChD,6BAA6B,EAC7B,sBAAsB,EACtB,oCAAoC,EACpC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;KAC3D,CAAC;IACF,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAS,EAAE,+CAA+C,EAC5F,IAAI,MAAM,CAAC,6DAA6D,EACpE,kBAAkB,EAAE,IAAI,CAAC,EAC7B,mBAAmB,EAAE;QACjB,IAAI,SAAS,CAAC,EAAE,EACZ,2EAA2E,EAC3E,aAAa,EACb,eAAe,EACf,4OAA4O,EAC5O,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,EAAE,EACZ,wEAAwE,EACxE,iCAAiC,EACjC,eAAe,EACf,+IAA+I,EAC/I,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAC7D,CAAC;CACT,CAAC;AAEF;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAyB;IACtD,IAAI,SAAS,CAAC,CAAC,EACX,gEAAgE,EAChE,wCAAwC,EACxC,cAAc,EACd,aAAa,CAAC;IAClB,IAAI,SAAS,CAAC,CAAC,EACX,mDAAmD,EACnD,mCAAmC,EACnC,eAAe,EACf,wEAAwE,CAAC;IAC7E,IAAI,SAAS,CAAC,CAAC,EACX,uEAAuE,EACvE,4BAA4B,EAC5B,MAAM,EACN,+EAA+E,CAAC;IACpF,IAAI,SAAS,CAAC,EAAE,EACZ,2GAA2G,EAC3G,+FAA+F,EAC/F,cAAc,EACd,oFAAoF,CAAC;IACzF,IAAI,SAAS,CAAC,EAAE,EACZ,oIAAoI,EACpI,8GAA8G,EAC9G,cAAc,EACd,4JAA4J,CAAC;IACjK,IAAI,SAAS,CAAC,EAAE,EACZ,iFAAiF,EACjF,2BAA2B,EAC3B,OAAO,EACP,mDAAmD,CAAC;CAC3D,CAAC;AAEF,4FAA4F;AAC5F,0HAA0H;AAC1H,SAAgB,aAAa;IACzB,MAAM,GAAG,GAAG,CAAC,GAAG,eAAO,CAAC,OAAO,CAAC,CAAC,GAAU,EAAwB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,4BAAoB,CAAC,CAAC;IAC9G,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,EAAE,CAAY,EAAU,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,qGAAqG;AACrG,SAAgB,kBAAkB,CAAC,CAAmB;IAClD,MAAM,GAAG,GAAG,eAAO,CAAC,IAAI,CAAC,CAAC,CAAQ,EAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,OAAO,GAAG,CAAC;AACf,CAAC","sourcesContent":["import type { TreeKind } from './effective-tree';\n\n// ---------------------------------------------------------------------------\n// L1 — the LOCATION layer, as data.\n//\n// L1 answers four questions: do we govern this call at all, does the directory still EXIST, is the\n// WRONG AGENT standing here, and is the agent stranded away from the root? Drawn as a decision matrix\n// that is SEVEN ordered rows over five dimensions (K/A/R/G/P), first match wins.\n//\n// This module holds those rows, and l1-doc.ts renders them into guards/L1-location.md — the doc a human\n// reads on GitHub. A unit test locks that file byte-identical to the renderer, and the guard itself\n// CONSULTS L1_ROWS to decide which structural block fires (see runner.l1LocationBlock). Doc and code\n// come from the SAME array, so they cannot drift.\n//\n// This module is deliberately import-free at runtime (only a type-only import above), so\n// `pnpm guards:generate` can load it without the package's transitive dependencies.\n// ---------------------------------------------------------------------------\n\n/**\n * The K dimension as a CLASSIFICATION carries — one concrete tree, never the `pw` union.\n *\n * `p` and `w` are the same PROJECT and every rule-scoped guard treats them alike; the doc writes the\n * pair as `pw` in the row's MATCHER (below), which is a different vocabulary on purpose.\n */\nexport type L1Kind = 'f' | 'm' | 'o' | 'p' | 'w';\n\n/** The K value a ROW matches on. `pw` matches both `p` and `w`; `-` is the wildcard. */\nexport type L1KindMatch = 'f' | 'm' | 'o' | 'w' | 'pw' | '-';\n\n/** R and G are yes/no, written `y`/`n` in the doc, with `-` for \"does not matter\". */\nexport type L1Flag = 'y' | 'n' | '-';\n\n/**\n * V is the same one boolean wearing the doc's own letters: `n` the webpieces versions do NOT agree\n * between this worktree and the main tree, `y` they do.\n *\n * This dimension used to be A (`c` coordinator / `s` subagent). It was replaced rather than removed\n * because agent identity was measured untrustworthy as a proxy for \"which tree am I in\" — a\n * worktree-isolated agent auto-reaped at a turn boundary silently resumes on the primary clone. A\n * version read off the PATH being acted on cannot lie in that way.\n */\nexport type L1VersionSync = 'y' | 'n' | '-';\n\n/** What L1 does with a row. The labels are the doc's own action codebook (see GUARD_MATRIX.md). */\nexport type L1ActionKind = 'exempt' | 'down' | 'block';\n\n/**\n * WHICH structural block a blocking row dispatches to. This is the field that makes the array\n * load-bearing rather than decorative: runner.l1LocationBlock looks the row up and switches on it,\n * so deleting a row from the array removes the block.\n */\nexport type L1BlockId = 'trinary-version-skew' | 'force-to-root' | 'missing-directory';\n\n/**\n * The row number for L1's PRE-STAGE — `misplacedCdBlock`, which decides from command TEXT before a\n * tree has been resolved, and therefore cannot be classified over the five dimensions rows 1-6 use\n * (asking L1_ROWS to classify it would need the very resolution its answer determines).\n *\n * ZERO rather than a seventh row, deliberately. It has to appear in the table — an L1 block the\n * generated doc did not describe is precisely the drift the table exists to prevent, and it was\n * carrying a `KNOWN GAP` comment saying so. But numbering it 7 would assert it sits in the same\n * first-match scan as the others, which is the one thing that is not true about it. Row 0 says\n * \"decided before the scan\" in the number itself. `renderL1Doc()` PRINTS this row above the six, so\n * `row=0` in the L1 log joins to a line the reader can actually find.\n */\nexport const L1_PRESTAGE_ROW = '0';\n\n/**\n * One point in the five-dimensional space L1 classifies over. Data-only → a class, per CLAUDE.md.\n *\n * The dimensions are exactly the doc's legend: K (tree kind of the resolved target), V (webpieces versions in sync or\n * subagent), R (provably read-only inspection), G (invokes git/gh), P (root or subdirectory).\n */\nexport class L1Classification {\n    // eslint-disable-next-line @typescript-eslint/max-params -- five dimensions is the matrix's shape\n    constructor(\n        readonly kind: L1Kind,\n        readonly versionsSkewed: boolean,\n        readonly readOnly: boolean,\n        readonly git: boolean,\n        readonly atRoot: boolean,\n    ) {}\n\n    /**\n     * The classification the RUNNER enforces on, built from the resolved tree and the caller.\n     *\n     * `'outside'` maps to `p`, and that is not a typo. TreeKind `'outside'` is produced by\n     * effective-tree.ts (git has no answer for the directory) and consumed NOWHERE, so a command in no git repo is\n     * judged against the governed repo exactly as if it stood in it. Row 2 (`o` → L2) describes what\n     * SHOULD happen and is deliberately unreachable from here until the \"Not done\" fix in\n     * guards/L1-location.md lands — exempting `o` alone opens a `cd /tmp &&` bypass of every L2 guard,\n     * so the two ship together or neither does. Mapping it to `p` here is what preserves today's\n     * behaviour (a `git` command from /tmp is still force-to-root blocked); it is not an endorsement.\n     */\n    // eslint-disable-next-line @typescript-eslint/max-params -- mirrors the constructor it delegates to\n    // webpieces-disable no-function-outside-class -- a named constructor for this data class, not a service: it takes the runner's TreeKind and returns the same class, so there is nothing to inject\n    static forEnforcement(\n        treeKind: TreeKind,\n        versionsSkewed: boolean,\n        readOnly: boolean,\n        git: boolean,\n        atRoot: boolean,\n    ): L1Classification {\n        const kind: L1Kind = treeKind === 'foreign' ? 'f'\n            : treeKind === 'missing' ? 'm'\n            : treeKind === 'worktree' ? 'w' : 'p';\n        return new L1Classification(kind, versionsSkewed, readOnly, git, atRoot);\n    }\n}\n\n/** The `act` cell of a row: the doc's literal label, plus the machine-readable kind behind it. */\nexport class L1Action {\n    constructor(readonly label: string, readonly kind: L1ActionKind) {}\n}\n\nexport const ACT_EXEMPT = new L1Action('2 exempt', 'exempt');\nexport const ACT_DOWN = new L1Action('→ L2', 'down');\nexport const ACT_BLOCK = new L1Action('4 block', 'block');\n\n/**\n * The CURE a blocking row prescribes.\n *\n * `runnable` is the axis that matters to the tests: a cure that is a command must, once applied,\n * actually stop the row from matching (cure reachability). Row 3's cure is an INSTRUCTION — \"spawn a\n * subagent bound to the worktree\" — which no allowlist can accept and no reclassification can model,\n * so it declares `runnable: false` and is asserted only on the deny text.\n */\nexport class L1Cure {\n    constructor(\n        /** How the doc's `why` column spells it. */\n        readonly summary: string,\n        /** A substring that MUST appear in the deny text the guard emits for this row. */\n        readonly denyMention: string,\n        readonly runnable: boolean,\n    ) {}\n}\n\n/**\n * One row of the \"L1 use cases\" table: what you SEE, the state it puts you in, the verdict, the fix.\n *\n * The four text fields are rendered VERBATIM into the doc. `classification` is the same case expressed\n * in the matrix's own vocabulary so the tests can run it through the matcher — it is test/enforcement\n * data, never rendered, which is why a use case that exercises the FILTER or the L0 allowlist (neither\n * of which is a row) can carry `null` there.\n */\nexport class L1UseCase {\n    // eslint-disable-next-line @typescript-eslint/max-params -- four verbatim doc cells plus the classification behind them\n    constructor(\n        readonly num: number,\n        readonly symptom: string,\n        readonly state: string,\n        readonly verdict: string,\n        readonly fix: string,\n        readonly classification: L1Classification | null = null,\n    ) {}\n}\n\n/** One row of L1's decision table. Data-only → a class, per CLAUDE.md. */\nexport class L1Row {\n    // eslint-disable-next-line @typescript-eslint/max-params -- five dimension cells plus act/why/cure/blockId/useCases\n    constructor(\n        readonly num: number,\n        readonly k: L1KindMatch,\n        readonly a: L1VersionSync,\n        readonly r: L1Flag,\n        readonly g: L1Flag,\n        readonly p: 'root' | 'sub' | '-',\n        readonly action: L1Action,\n        /** The `why` cell, verbatim. */\n        readonly why: string,\n        readonly cure: L1Cure | null,\n        readonly blockId: L1BlockId | null,\n        readonly useCases: readonly L1UseCase[],\n    ) {}\n\n    matches(c: L1Classification): boolean {\n        if (!this.kindMatches(c.kind)) return false;\n        if (this.a !== '-' && (this.a === 'n') !== c.versionsSkewed) return false;\n        if (!flagMatches(this.r, c.readOnly)) return false;\n        if (!flagMatches(this.g, c.git)) return false;\n        return this.p === '-' || this.p === (c.atRoot ? 'root' : 'sub');\n    }\n\n    private kindMatches(kind: L1Kind): boolean {\n        if (this.k === '-') return true;\n        if (this.k === 'pw') return kind === 'p' || kind === 'w';\n        return this.k === kind;\n    }\n}\n\n// R and G are one boolean each behind a `y`/`n`/`-` cell, so one helper answers for both. (A is the\n// same shape but spelled `c`/`s`, and is matched inline above so the row literals read like the doc.)\n// webpieces-disable no-function-outside-class -- pure predicate for L1Row.matches above, in this data module\nfunction flagMatches(cell: L1Flag, value: boolean): boolean {\n    if (cell === '-') return true;\n    return (cell === 'y') === value;\n}\n\n/**\n * THE seven L1 rows, in first-match-wins order.\n *\n * Rows 3, 5 and 7 are the structural blocks and they run as ONE step (runner.l1LocationBlock) so they\n * can never be reordered by accident. Every other row is a hand-down or an exemption, i.e. \"L1 has no\n * objection\" — which is why only those three carry a blockId.\n *\n * Row 7 (`m`, the vanished directory) sits LAST only because row numbers are stable across releases —\n * they are printed in the doc and logged as `row=`, so renumbering rows 1-6 to slot it in front would\n * silently invalidate every existing reference. Position costs nothing here: `m` is matched by no other\n * row, so first-match reaches it wherever it sits.\n */\nexport const L1_ROWS: readonly L1Row[] = [\n    new L1Row(1, 'f', '-', '-', '-', '-', ACT_EXEMPT, 'different git repo — hands off', null, null, [\n        new L1UseCase(1,\n            '`cd repositories/vendored && git commit` goes through untouched',\n            '`f` / `y` / - — row 1',\n            'ALLOW_EXEMPT',\n            'none needed — jurisdiction is judged on the RESOLVED target, after the `cd`; a different git repo is hands-off',\n            new L1Classification('f', false, false, true, false)),\n    ]),\n    new L1Row(2, 'o', '-', '-', '-', '-', ACT_DOWN, 'see \"Not done\" below', null, null, []),\n    // ROW 3 IS RETIRED — it was coordinator-in-worktree, deleted with CoordinatorWorktreeGuard when the\n    // guard hooks went ABSOLUTE (one governor, so the filesystem/governance split it policed became\n    // unconstructible). The NUMBER is never reused: row numbers are identity here — they are printed in\n    // denies, logged as `row=`, and cited in guards/L1-location.md — so renumbering would silently\n    // re-point every historical reference. Its replacement is row 8.\n    new L1Row(8, 'w', 'n', 'n', '-', '-', ACT_BLOCK,\n        'this worktree pins a DIFFERENT @webpieces than the main tree that governs it',\n        new L1Cure('align the pins (same git hash -> same tracked pin -> install in each tree), work in the main tree, or use a separate clone',\n            '@webpieces version SKEW', false),\n        'trinary-version-skew', [\n            new L1UseCase(12,\n                'a worktree on an older branch pins `0.4.612` while the main tree runs `0.4.616`, and `cd <wt> && pnpm build` is blocked',\n                '`w` / `n` / `n` — row 8',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): the MAIN tree is AHEAD, so this is YOURS and it is a one-line edit — raise THIS tree\\'s catalog pin in `pnpm-workspace.yaml` to what main already runs, then `pnpm install` here if this tree has a node_modules. That edit is on the L0 allowlist, so it is typable while the block is up, and nothing has to move in the main tree<br>Option 2: do the work in the main tree, which this guard never blocks<br>Option 3: if the tree genuinely needs a DIFFERENT version, use a separate CLONE — a clone gets its own governance. That is the answer to \"I need a different version\", never to \"I need to install here\": a worktree MAY have its own node_modules (nx, vitest and the eslint plugin all load from it), it just may not hold a different @webpieces version<br>Do NOT: lower the MAIN tree\\'s pin to match — that downgrades every tree, including this session\\'s own governor. And do NOT reach for `pnpm install` BEFORE the edit: this tree\\'s pin is the stale side, so installing first materializes the OLD release',\n                new L1Classification('w', true, false, false, false)),\n            new L1UseCase(16,\n                'a SUBAGENT hits the same block inside `.claude/worktrees/agent-XXXX`',\n                '`w` / `n` / `n` — row 8; in-repo placement is still `w`',\n                'BLOCK_AI_CURE',\n                'READ THE DIRECTION FIRST — the deny prints it. If the MAIN tree is AHEAD (the common case) a subagent fixes this ITSELF, here, by raising this tree\\'s pin to what main already runs; there is nothing to escalate and the deny prints no escalation. Only when main is BEHIND, or when this branch bumped the pin on purpose, is the subagent stuck — the main tree is outside its tree, and a worktree-isolated agent may not even still be in the tree it was launched in (measured: auto-reaped at a turn boundary, resumed on the primary). Then, and only then, forward the deny\\'s verbatim ask to the coordinator and STOP<br>Do NOT: expect exemption because it sits under the repo — K is git\\'s `--git-common-dir` answer, not a path test',\n                new L1Classification('w', true, false, false, false)),\n        ]),\n    new L1Row(4, 'pw', '-', '-', 'n', '-', ACT_DOWN, 'force-to-root has no jurisdiction', null, null, [\n        new L1UseCase(5,\n            '`ls` from `packages/http/` runs normally',\n            '`pw` / `n` / - — row 4',\n            'ALLOW (handed to L2)',\n            'none — force-to-root has no jurisdiction over non-git commands',\n            new L1Classification('p', false, true, false, false)),\n        new L1UseCase(6,\n            '`pnpm test` from `packages/http/` runs normally',\n            '`pw` / `n` / - — row 4',\n            'ALLOW (handed to L2)',\n            'none — deliberately untouched, so package-local test runs stay natural',\n            new L1Classification('p', false, false, false, false)),\n        new L1UseCase(10,\n            '`echo \"cd sub && git push\"` passes',\n            '`pw` / `n` / `root` — row 4',\n            'ALLOW (handed to L2)',\n            'none — the `cd` is inside quotes, so `ShellSegmentScan` never treats it as a scope escape',\n            new L1Classification('p', false, false, false, true)),\n        new L1UseCase(13,\n            'the same command from a **subagent** runs normally',\n            '`w` / `y` — row 8 does not match',\n            'ALLOW (handed to L2)',\n            'none — a subagent pinned to a worktree is the correct pattern',\n            new L1Classification('w', false, false, false, false)),\n        new L1UseCase(14,\n            'inspection inside a SKEWED worktree still runs — `cd <worktree> && ls`/`cat`/`grep`',\n            '`w` / `n` / `y` — row 8 does not match',\n            'ALLOW (handed to L2)',\n            'none — inspection is always open; so are the `Read` tool, `git -C <dir INSIDE this tree> …` and `git show <branch>:<file>`, none of which move you. `git -C <ANOTHER tree>` is a different matter: the harness refuses cross-tree git to a subagent, so it is never the cure for a skew — tell the MAIN agent instead',\n            new L1Classification('w', true, true, false, false)),\n    ]),\n    new L1Row(5, 'pw', '-', '-', 'y', 'sub', ACT_BLOCK, '`cd <root> && <original>`',\n        new L1Cure('`cd <root> && <original>`', 'Run git/gh commands from the repo root', true),\n        'force-to-root', [\n            new L1UseCase(7,\n                '`git status` from `packages/http/` is blocked',\n                '`pw` / `y` / `sub` — row 5',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): `cd <root> && git status`',\n                new L1Classification('p', false, false, true, false)),\n            new L1UseCase(8,\n                '`cd packages/http && git status` **typed from the root** is blocked',\n                '`pw` / `y` / `sub` — row 5',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): `cd <root> && git status`<br>Do NOT: assume it is allowed because you started at the root — the predicate is `effectiveCwd === root`, i.e. the DESTINATION',\n                new L1Classification('p', false, false, true, false)),\n            new L1UseCase(11,\n                '`cd <subdir> && git push` blocked with the force-to-root message, NOT the gated-flow one',\n                '`pw` / `y` / `sub` — row 5; force-to-root runs first',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): `cd <root> && git push`, which then gets the push guard\\'s real answer ← costs one extra turn by design; still blocked',\n                new L1Classification('p', false, false, true, false)),\n            new L1UseCase(17,\n                'the printed cure REPLACES your `cd`, it does not stack in front of it',\n                '`pw` / `y` / `sub` — row 5, on the cure itself',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): run the printed line VERBATIM — `cd <root> && <the work>`, with your own leading `cd` dropped<br>Do NOT: paste `cd <root> && cd <subdir> && <work>`; `effectiveCwd` resolves the leading `cd`s left to right, so that lands in `<subdir>` again and re-fires this exact block',\n                new L1Classification('p', false, false, true, false)),\n        ]),\n    new L1Row(6, 'pw', '-', '-', 'y', 'root', ACT_DOWN, '', null, null, [\n        new L1UseCase(9,\n            '`cd <root> && git status` passes from anywhere',\n            '`pw` / `y` / `root` — row 6',\n            'ALLOW (handed to L2)',\n            'none — this IS the prescribed cure',\n            new L1Classification('p', false, false, true, true)),\n    ]),\n    new L1Row(7, 'm', '-', '-', '-', '-', ACT_BLOCK, 'the directory is GONE — nothing can run there',\n        new L1Cure('`cd <root> && <the work>`, never back through the dead path',\n            'no longer exists', true),\n        'missing-directory', [\n            new L1UseCase(18,\n                'every command from a worktree another agent REAPED mid-session is blocked',\n                '`m` — row 7',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): run the printed `cd <root> && <the work>` line — it does NOT route back through the dead path<br>Do NOT: re-`cd` into the worktree, or `git worktree add` it back expecting your uncommitted work; that work is gone',\n                new L1Classification('m', false, false, true, false)),\n            new L1UseCase(19,\n                'the same block for a NON-git command there — `m` does not care about G',\n                '`m` — row 7; K alone decides it',\n                'BLOCK_AI_CURE',\n                'Option 1 (preferred): the same printed line. A vanished cwd is not a git question — nothing at all can run in a directory that does not exist',\n                new L1Classification('m', false, false, false, false)),\n        ]),\n];\n\n/**\n * The use cases that exercise something that is NOT a row: the excludePaths FILTER (2, 3, 4, 20) and the\n * L0 allowlist that runs ahead of L1 (15).\n *\n * They are use cases of L1 all the same — \"exempt\" is what emerges when the filter empties the rule\n * list, and case 15 is the invariant that a cure stays reachable from every tree — so they stay in the\n * doc's one numbered table. They carry no classification because no row classifies them.\n */\nexport const L1_UNROWED_USE_CASES: readonly L1UseCase[] = [\n    new L1UseCase(2,\n        'Edit `repositories/vendored/foo.ts` allowed even on stale main',\n        'filter — the path is in `excludePaths`',\n        'ALLOW_EXEMPT',\n        'none needed'),\n    new L1UseCase(3,\n        'Edit `packages/http/foo.ts` blocked on stale main',\n        'filter keeps the rules → L2 fires',\n        'BLOCK (at L2)',\n        'that is L2\\'s write-on-main verdict, not L1\\'s — follow the L2 message'),\n    new L1UseCase(4,\n        'Edit `packages/http/foo.ts` judged even though the shell is in `/tmp`',\n        'filter, on the TARGET path',\n        '→ L2',\n        'none — for file tools the cwd is irrelevant; do NOT `cd` anywhere to \"fix\" it'),\n    new L1UseCase(20,\n        'Write `.webpieces/worktrees/agent-＊/pr-review/…/review-＊.json` allowed on main, with `excludePaths` empty',\n        'filter — `.webpieces/` is HARD-CODED exempt (`isWebpiecesStateDir`), ahead of the config list',\n        'ALLOW_EXEMPT',\n        'none needed — the dir is gitignored, so no config can put it back under governance'),\n    new L1UseCase(21,\n        'Write a reviewer verdict into a WORKTREE\\'s own state dir — the `.webpieces` under `.claude/worktrees/agent-＊`, not the primary\\'s',\n        'filter — the state-dir skip is asked about the path relative to the tree that OWNS it, not the governed root',\n        'ALLOW_EXEMPT',\n        'none — it was NOT exempt before (governed-root-relative that path begins `.claude`), and `wp-review-upsert-pr` requires the file before a PR can be opened'),\n    new L1UseCase(15,\n        '`cd <worktree> && pnpm install` still runs while row 8 is live — it is the CURE',\n        'L0 allowlist, ahead of L1',\n        'ALLOW',\n        'none — a cure must stay reachable from every tree'),\n];\n\n/** Every use case, in the doc's numbering — the order the table is rendered and read in. */\n// webpieces-disable no-function-outside-class -- pure accessor over the two arrays above, beside them in this data module\nexport function allL1UseCases(): readonly L1UseCase[] {\n    const all = [...L1_ROWS.flatMap((row: L1Row): readonly L1UseCase[] => row.useCases), ...L1_UNROWED_USE_CASES];\n    return all.sort((a: L1UseCase, b: L1UseCase): number => a.num - b.num);\n}\n\n/**\n * FIRST MATCH WINS — the one lookup the guard and the tests share.\n *\n * Never null: rows 1, 2 and 4/5/6 between them cover every kind, and rows 4/5/6 partition G × P, so a\n * classification that matched nothing would be a hole in the matrix. The totality test asserts exactly\n * that, which is why this returns L1Row rather than L1Row | null.\n */\n// webpieces-disable no-function-outside-class -- the matcher over L1_ROWS, beside the array it reads\nexport function firstMatchingL1Row(c: L1Classification): L1Row {\n    const row = L1_ROWS.find((r: L1Row): boolean => r.matches(c));\n    if (row === undefined) throw new Error(`L1 matrix has a hole: no row matches ${JSON.stringify(c)}`);\n    return row;\n}\n"]}

package/src/core/l2-rows.js

@@ -285,6 +285,15 @@ const EXACT_REASON_ROWS = {
     // Row 11 — every "could not establish", including the two dirty-tree valves the code still opens
     // (see NOT_DONE) and the unreachable forge.
     'branch-undeterminable': exports.L2_FAIL_OPEN_ROW,
+    // The target tree HAS no branch name (mid-rebase / mid-bisect), so there is no key into the
+    // branch-keyed cache — use case 14, which the row already describes. It used to arrive here as the
+    // literal branch `HEAD`, miss in the cache and log `no-sync-cache`: the right verdict recorded under
+    // a reason that names a different cause, and therefore uncountable.
+    'detached-head': exports.L2_FAIL_OPEN_ROW,
+    // The file being judged lives in a NESTED CLONE (`repositories/**`) — another repo's branch is not
+    // this policy's to judge. The bash path calls the same state ALLOW_EXEMPT at L1; on the file path it
+    // is an abstention, because nothing about the target tree's state was established.
+    'target-tree-foreign': exports.L2_FAIL_OPEN_ROW,
     'no-sync-cache': exports.L2_FAIL_OPEN_ROW,
     'stale-cross-branch-cache': exports.L2_FAIL_OPEN_ROW,
     'origin-main-unknown': exports.L2_FAIL_OPEN_ROW,