@windyroad/risk-scorer 0.18.5 → 0.18.6

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.18.5"
+  "version": "0.18.6"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.18.5",
+  "version": "0.18.6",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/agents/pipeline.md

@@ -49,7 +49,7 @@ The UNRELEASED CHANGES section emits TWO distinct changeset counts:
 - `Pending changesets (commits unpushed): N` — changesets whose introducing commit is in `origin/<base>..HEAD` (local) OR is untracked. These ARE pending consumer-facing changes at THIS commit's surface and count toward Layer 1 release risk as before.
 - `Queued changesets (commits already on origin): N` — changesets whose introducing commit is already on `origin/<base>`. The underlying code has already been pushed (and in the maintainer pipeline, reviewed); only the release-PR merge to npm is pending. These contribute **zero** release-risk at THIS commit's surface and MUST NOT count as pending consumer-facing changes in Layer 1.
 
-When computing Layer 1 release risk, score only the Pending count (plus any unreleased diff content). A Queued count > 0 with Pending = 0 and no other unreleased diff content is a within-appetite state — the queue is awaiting a release-PR merge, not a maintainer decision. Do NOT emit `RISK_REMEDIATIONS:` lines (such as `move-to-holding`) targeting queued-on-origin changesets; their commits have already shipped and `git mv`'ing them into `docs/changesets-holding/` would fragment the release without reducing actual risk.
+When computing Layer 1 release risk, score only the Pending count (plus any unreleased diff content). A Queued count > 0 with Pending = 0 and no other unreleased diff content is a within-appetite state — the queue is awaiting a release-PR merge, not a maintainer decision.
 
 ## Catalog Consumption Protocol (ADR-059)
 
@@ -270,82 +270,6 @@ The hint is consumed by the calling orchestrator **after** the ADR-042 auto-appl
 
 Do NOT emit `RISK_REGISTER_HINT:` when all cumulative scores are within appetite AND no confidentiality disclosure AND no user-stated-precondition fired. The hint is additive to the existing Below-Appetite Output Rule — a silent pass MUST remain silent. Do not emit an empty `RISK_REGISTER_HINT:` header with no bullets either — omit the block entirely.
 
-## Held-Changeset Graduation Evaluation (ADR-061)
-
-When the pipeline state indicates **within-appetite drain mode** (cumulative push and release residual both ≤ the threshold in `RISK-POLICY.md`, default 5) AND `docs/changesets-holding/` contains entries, evaluate each held changeset against ADR-061 Rule 1's symmetric graduation criterion: **reinstate when `release-risk(pipeline with held changeset hypothetically reinstated) ≤ problem-ticket Priority`**.
-
-This is the symmetric counterpart to ADR-042 Rule 2's move-to-holding contract. Material flows in when release-risk would exceed appetite; material flows out when release-risk falls at or below the originating problem-ticket Priority.
-
-### Mechanism — invoke the deterministic graduation evaluator
-
-The Rule 1a join (changeset → problem ID → ticket Priority), the Rule 2 VP carve-out detection, and the Rule 3b cohort grouping are deterministic lookups. Invoke the `wr-risk-scorer-evaluate-graduation` shim (ADR-049 `$PATH`-resolved) to read structured candidate lines for each held changeset:
-
-```
-GRADUATION_CANDIDATE: changeset=<filename> | ticket=P<NNN> | priority=<N> | class=3a | status=<resolved|vp-blocked|halt-no-resolution>
-GRADUATION_CANDIDATE: changeset=<filename> | ticket=P<NNN> | priority=<cohort-max-N> | class=3b | cohort=<id> | status=<resolved|vp-blocked|halt-no-resolution>
-GRADUATION_SUMMARY: total=<N> resolved=<N> vp_blocked=<N> halts=<N>
-```
-
-Class 3b lines insert a `cohort=<id>` column between `class` and `status`. The cohort id is derived from the normalised reinstate-trigger prose (first 8 tokens, kebab-sanitised) of the `docs/changesets-holding/README.md` "Currently held" entries that share an identical normalised trigger. Cohort `priority` is `max(Priority)` across all member tickets per ADR-061 Rule 3b; cohort `status` propagates atomically — any halt → cohort halts, any VP-blocked → cohort VP-blocked, otherwise cohort resolved. Single-member "cohorts" are emitted as class=3a (no Phase 2a regression).
-
-The script does NOT compute release-risk and does NOT apply Rule 4 evidence-floor judgement — those are LLM-judgement surfaces you own per ADR-015's pure-scorer contract. The script's job is to emit candidates with their joined Priority + cohort classification; your job is to decide whether each candidate's release-risk + evidence-floor profile justifies emitting a `reinstate-from-holding` remediation line.
-
-### Per-candidate evaluation rules
-
-For each `status=resolved` candidate:
-
-1. **Compute release-risk with hypothetical reinstate** (Rule 1) — re-score the current pipeline as if the held changeset were `git mv`'d back to `.changeset/`. Use the same scoring path as ADR-042 Rule 2's re-score; this is your existing pipeline-scoring competence applied to the symmetric hypothesis.
-2. **Compare** — `release-risk ≤ priority` from the candidate line. If false, the held entry stays held — no remediation emitted this cycle.
-3. **Verify Rule 4 evidence floor** — class-specific evidence shape per ADR-061 Rule 4:
-   - **PreToolUse:Bash gates**: ≥ 1 gate-fire log entry per intended trigger surface, with post-fire commit trail showing no false-block.
-   - **UserPromptSubmit detectors**: ≥ 1 detector firing logged to hook stderr or `.afk-run-state/<detector>.log`.
-   - **commit-hook-with-auto-fix**: ≥ 1 auto-fix commit log entry visible via `git log --grep=<hook-marker>` with the diff showing the correct fix shape.
-   - **SessionStart additionalContext hooks**: ≥ 1 session-trail entry showing the injection fired without regression in the immediate-next turn.
-
-   Per ADR-026 cite + persist + uncertainty: the evidence must ground in a re-readable artefact, not a bare count.
-4. **Emit `reinstate-from-holding` remediation** (Rule 5) when the comparison evaluates true AND the evidence floor is met:
-
-   ```
-   RISK_REMEDIATIONS:
-   - R<N> | reinstate-from-holding <changeset-name>: release-risk <release-score>/25 ≤ P<NNN> Priority <priority-value>; class 3a; evidence: <class-specific artefact citation> | S | -<release-score> | docs/changesets-holding/<changeset-name>, .changeset/<changeset-name>
-   ```
-
-   The `description` column (free-form prose per ADR-042 Rule 2a open vocabulary) carries the symmetric-balance verdict, the cited evidence artefact, and the class. The agent consuming this line applies it via `git mv docs/changesets-holding/<name>.md .changeset/<name>.md`.
-
-For each `status=vp-blocked` candidate (Rule 2 carve-out — originating ticket in Verification Pending):
-
-- **DO NOT emit a `reinstate-from-holding` line** for this changeset. ADR-022 establishes the user-owned verify-or-reject decision surface; auto-reinstating short-circuits that surface. The `.verifying.md` → `.closed.md` transition auto-clears the carve-out; the next Step 6.5 graduation pass evaluates the changeset normally.
-
-For each `status=halt-no-resolution` candidate (Rule 1a terminal — no ticket resolved):
-
-- **DO NOT auto-graduate**. Surface the unresolved candidate in your report body under an "Unresolvable graduation candidates" section so the caller (orchestrator) sees the join failure and can present it as a user-decision surface per ADR-013 + ADR-044 framework-resolution boundary. Per ADR-061 Rule 1a, join ambiguity is a user-decision surface, not an agent-decision surface.
-
-### Class 3b atomic-cohort evaluation (Phase 2b — ADR-061 Rule 3b)
-
-When candidate lines emit `class=3b` with a `cohort=<id>` column, ADR-061 Rule 3b applies: **the entire cohort ships atomically or none of it does**. Per-member graduation is not authorised. Evaluate the cohort as a single unit:
-
-1. **Group candidates by cohort id** — collect all `class=3b` candidates sharing the same `cohort=` column into a single evaluation set.
-2. **Compute cohort release-risk** — re-score the current pipeline as if the **full cohort** were `git mv`'d back to `.changeset/` together (not one at a time). The marginal release-risk delta is computed against the cohort's combined diff surface, not any single member's diff.
-3. **Compare against cohort priority** — the `priority=<cohort-max-N>` column on every cohort-member line already carries `max(Priority)` across all member tickets (deterministic join, Rule 3b math). Apply Rule 1: cohort graduates when `cohort-release-risk ≤ cohort-priority`.
-4. **Verify Rule 4 evidence floor per cohort** — every cohort member must independently satisfy its class-specific evidence shape (PreToolUse:Bash gate / UserPromptSubmit detector / commit-hook-with-auto-fix / SessionStart additionalContext). One floor failure in any member blocks the whole cohort. Per ADR-026 cite + persist + uncertainty: cite the artefact for each member in the audit trail.
-5. **Cohort-level VP carve-out** — if the deterministic evaluator already returned `status=vp-blocked` for the cohort (any member's ticket in Verification Pending), DO NOT emit a reinstate. The carve-out lifts when all member tickets transition out of `.verifying.md`.
-6. **Cohort-level halt-and-prompt** — if the deterministic evaluator returned `status=halt-no-resolution` for the cohort (any member fails Rule 1a join), DO NOT auto-graduate. Surface the cohort in the "Unresolvable graduation candidates" section. Per architect C1 (2026-05-17 P162 Phase 2b review), partial-cohort resolution is NOT authorised — the cohort is atomic.
-7. **Emit one `reinstate-from-holding` line per cohort member** when all six checks pass, all referencing the same cohort id so the consuming orchestrator can apply them as an atomic batch:
-
-   ```
-   RISK_REMEDIATIONS:
-   - R<N> | reinstate-from-holding <member-1>: cohort <id> release-risk <release-score>/25 ≤ cohort-priority <priority-value>; class 3b; evidence: <member-1 artefact citation> | S | -<release-score-share> | docs/changesets-holding/<member-1>, .changeset/<member-1>
-   - R<N+1> | reinstate-from-holding <member-2>: cohort <id> release-risk <release-score>/25 ≤ cohort-priority <priority-value>; class 3b; evidence: <member-2 artefact citation> | S | -<release-score-share> | docs/changesets-holding/<member-2>, .changeset/<member-2>
-   ```
-
-   The agent consuming these lines applies them as a single batch — either all members reinstate in one operation or none do. Partial application breaks ADR-061 Rule 3b atomicity.
-
-The cohort id-from-prose detection is the Phase 2b shape per the architect-approved 2026-05-17 design. If cohort grouping false-positives appear (e.g. two unrelated changesets coincidentally sharing trigger prose), ADR-061 Reassessment Triggers ("Manual graduations diverge from criterion verdicts") covers the upgrade to a structured cohort-declaration field.
-
-### Audit trail (Rule 6)
-
-Every emitted `reinstate-from-holding` line MUST cite the resolved problem-ticket ID and Priority value in the description column so the audit trail extends ADR-042 Rule 6. For Class 3b cohort reinstates, every member line MUST additionally cite the cohort id and the cohort-level priority + release-risk values so the per-member audit row reconstructs the atomic cohort decision. The consuming orchestrator additionally appends to `docs/changesets-holding/README.md` "Recently reinstated" per Rule 6 § 2 with the class (3a or 3b) and, for cohort members, the cohort id.
-
 ## Confidential Information Disclosure
 
 Check diffs for business metrics (revenue, user counts, pricing, traffic volumes). Flag as a standalone risk if found.
@@ -375,7 +299,7 @@ For diffs touching `packages/*/skills/*/SKILL.md`, `packages/*/skills/*/REFERENC
 
 - **Control name**: `Promptfoo Tier-A/B SKILL/agent-prose eval` at `packages/<pkg>/skills/<name>/eval/promptfooconfig.yaml` (or `packages/<pkg>/agents/<name>/eval/...` for agent prose).
 - **Failure scenario exercised**: the LLM-prose surface emits the documented step ordering / vocabulary / refusal / classifier verdict. Pre-RFC-012, no test exercised this; defects landed in published SKILLs and ran in adopter sessions. Post-RFC-012, the eval's Tier-A deterministic assertions (icontains/contains/regex/not-regex) or Tier-B llm-rubric pass^k repro the prose surface behaviourally.
-- **How it catches before reaching the user**: the eval runs the actual SKILL.md (via `run-skill-eval.sh` exec provider wrapping `claude -p --append-system-prompt`); a behavioural regression in the prose surface fails the assertion. The held-changeset / dogfood-window catches some prose defects, but promptfoo catches edge-case defects that dogfood replays miss (per R009 Watch-out clause).
+- **How it catches before reaching the user**: the eval runs the actual SKILL.md (via `run-skill-eval.sh` exec provider wrapping `claude -p --append-system-prompt`); a behavioural regression in the prose surface fails the assertion before release (per R009 Watch-out clause).
 - **Authority**: ADR-075 Amendment 2026-06-02 (scope extension to SKILL.md prose); RFC-012 (implementation); R009 standing-risk entry (`docs/risks/R009-*.active.md`) Controls table row 2 + per-action modulator + Residual risk Per-action quick path.
 
 **Crediting rule** (matches R009 modulator semantics):

package/hooks/lib/risk-gate.sh

@@ -273,7 +273,11 @@ except Exception:
           ;;
         failure|cancelled|timed_out|action_required|startup_failure)
           CI_GATE_CATEGORY="red"
-          CI_GATE_REASON="Latest CI run on branch '${BRANCH}' concluded ${CONCLUSION}: ${URL}. Fix CI before pushing/releasing — there is no override (P377/RFC-029; ci-bypass removed). A live-outage restore-service release uses the separate incident-release path."
+          if [ "$ACTION" = "push" ]; then
+            CI_GATE_REASON="Latest CI run on branch '${BRANCH}' concluded ${CONCLUSION}: ${URL}. Red CI is not itself a goal blocker. Inspect that run, verify the outgoing commits directly repair that exact failure, then delegate to wr-risk-scorer:pipeline with CI-recovery context. Retry \`npm run push:watch\` only after a net risk-reducing verdict creates the existing reducing-push marker. Unrelated outgoing commits remain blocked; there is no generic override (P377/RFC-029)."
+          else
+            CI_GATE_REASON="Latest CI run on branch '${BRANCH}' concluded ${CONCLUSION}: ${URL}. Release remains blocked. Fix and push the CI repair, wait for green CI, then retry \`npm run release:watch\`. A live-outage restore-service release uses the separate incident-release path; there is no generic override (P377/RFC-029)."
+          fi
           return 1
           ;;
         *)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.18.5",
+  "version": "0.18.6",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",

package/bin/wr-risk-scorer-evaluate-graduation

@@ -1,51 +0,0 @@
-#!/usr/bin/env bash
-# Generated by scripts/sync-shim-wrappers.sh from
-# packages/shared/lib/shim-wrapper-template.sh. DO NOT EDIT individual
-# shim files in packages/*/bin/wr-* directly; edit the template + run
-# `npm run sync:shim-wrappers` to regenerate.
-#
-# Resolution (ADR-080):
-#   1. If the wrapper's parent dir is semver-shaped, treat as installed-
-#      cache execution and resolve to the highest-version sibling's
-#      scripts/ entry below.
-#   2. Otherwise (parent dir is e.g. `architect`), treat as source-
-#      monorepo execution and dispatch to own scripts/. The source-repo-
-#      guard `exec` is the anchor parsed by
-#      packages/retrospective/scripts/check-tarball-shipped-shims.sh.
-#   3. If the cache parent contains zero semver-shaped siblings, exit
-#      127 with a stderr message naming the cache parent (per SQ-080-2).
-#
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
-
-set -euo pipefail
-
-SHIM_DIR="$(cd "$(dirname "$0")" && pwd)"
-OWN_VERSION_DIR="$(dirname "$SHIM_DIR")"
-OWN_VERSION_NAME="$(basename "$OWN_VERSION_DIR")"
-CACHE_PARENT="$(dirname "$OWN_VERSION_DIR")"
-
-SEMVER_RE='^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$'
-
-# Source-repo guard: own parent dir is NOT semver → dispatch to own scripts/.
-if ! [[ "$OWN_VERSION_NAME" =~ $SEMVER_RE ]]; then
-  exec "$SHIM_DIR/../scripts/evaluate-graduation.sh" "$@"
-fi
-
-# Cache execution: pick the highest-semver sibling under CACHE_PARENT.
-HIGHEST=""
-while IFS= read -r dir; do
-  name="$(basename "$dir")"
-  [[ "$name" =~ $SEMVER_RE ]] || continue
-  if [[ -z "$HIGHEST" ]] || [[ "$(printf '%s\n%s\n' "$HIGHEST" "$name" | sort -V | tail -1)" == "$name" ]]; then
-    HIGHEST="$name"
-  fi
-done < <(find "$CACHE_PARENT" -mindepth 1 -maxdepth 1 -type d 2>/dev/null)
-
-if [[ -z "$HIGHEST" ]]; then
-  printf 'wr-shim: no cached versions in %s\n' "$CACHE_PARENT" >&2
-  exit 127
-fi
-
-exec "$CACHE_PARENT/$HIGHEST/scripts/evaluate-graduation.sh" "$@"

package/scripts/evaluate-graduation.sh

@@ -1,493 +0,0 @@
-#!/usr/bin/env bash
-# packages/risk-scorer/scripts/evaluate-graduation.sh
-#
-# Evaluates held-changeset graduation candidates per ADR-061
-# (Dogfood graduation criteria for held changesets — symmetric risk balance).
-#
-# Phase 2a — orthogonal-gate class (Class 3a per ADR-061 Rule 3): deterministic
-# Rule 1a join + Rule 2 VP carve-out detection per changeset, independently.
-#
-# Phase 2b — atomic-cohort class (Class 3b per ADR-061 Rule 3b): parses
-# docs/changesets-holding/README.md "Currently held" section, groups entries
-# by shared reinstate-trigger prose (parenthetical elaborations stripped
-# before grouping), and emits cohort-aware candidates. Cohort priority is
-# max(Priority) across all member tickets; any VP-blocked or halt-no-resolution
-# member propagates atomically to the entire cohort ("entire cohort ships or
-# none does" — symmetric to Rule 2's per-changeset carve-out at cohort grain).
-# Single-member "cohorts" fall back to class=3a (no Phase 2a regression).
-#
-# This script implements deterministic Rule 1a join + Rule 2 VP carve-out
-# detection + Rule 3b cohort grouping. It does NOT compute release-risk and
-# does NOT apply Rule 4 evidence-floor judgement — those are LLM-judgement
-# surfaces owned by the wr-risk-scorer:pipeline agent (per ADR-015 pure-scorer
-# contract).
-#
-# Cohort-id-from-prose is the Phase 2b shape per architect approval 2026-05-17.
-# Reassessment Triggers in ADR-061 ("Manual graduations diverge from criterion
-# verdicts") cover the upgrade to a structured cohort-declaration field if
-# prose-shape brittleness appears in dogfood.
-#
-# Usage:
-#   evaluate-graduation.sh [<project-root>]
-#
-# Default <project-root> is $(pwd).
-#
-# Behaviour:
-#   - Globs docs/changesets-holding/*.md (excludes README.md).
-#   - For each held changeset, applies Rule 1a join:
-#       1. Filename convention (primary): <package>-p<NNN>-<slug>.md → P<NNN>
-#       2. Body grep fallback (secondary): grep '\bP[0-9]+\b' in changeset body
-#       3. Multi-ticket: max(Priority) across the referenced set
-#   - Resolves the ticket file via dual-tolerant glob (ADR-031 + RFC-002):
-#       docs/problems/<NNN>-*.md (flat) AND docs/problems/*/<NNN>-*.md (per-state)
-#   - Extracts the Priority value from the ticket's `**Priority**: N (...)` line.
-#   - Detects Rule 2 VP carve-out (ticket file ends in .verifying.md) — narrowed
-#     per P398: a verifying ticket graduates (resolved) when its `## Fix Released`
-#     section is populated (code already shipped, only the changelog is held);
-#     it stays vp-blocked only while the fix is not yet shipped.
-#   - Parses docs/changesets-holding/README.md "Currently held" section and
-#     groups entries by normalised reinstate-trigger prose (Phase 2b).
-#   - Multi-member groups emit class=3b + cohort=<id> with cohort-level
-#     priority/status. Single-member groups emit class=3a unchanged.
-#   - Emits one structured candidate line per held changeset to stdout.
-#
-# Stdout format — Class 3a (one candidate per held changeset, agent-parseable):
-#   GRADUATION_CANDIDATE: changeset=<filename> | ticket=P<NNN> | priority=<N> | class=3a | status=<resolved|vp-blocked|halt-no-resolution>
-#
-# Stdout format — Class 3b (cohort member; cohort= column added between class and status):
-#   GRADUATION_CANDIDATE: changeset=<filename> | ticket=P<NNN> | priority=<cohort-max-N> | class=3b | cohort=<id> | status=<resolved|vp-blocked|halt-no-resolution>
-#
-# Stdout summary line at end (member-level counts; cohorts count individually):
-#   GRADUATION_SUMMARY: total=<N> resolved=<N> vp_blocked=<N> halts=<N>
-#
-# Exit codes:
-#   0 — script ran to completion (any number of halts is still exit 0;
-#       halts surface via per-candidate status=halt-no-resolution lines so
-#       the agent can present them as Rule 1a halt-and-prompt candidates)
-#   1 — no holding-area or empty holding-area (no-op caller signal)
-#   2 — invalid project root (missing docs/)
-#
-# @adr ADR-061 (graduation criteria — Phase 2a Rule 1a join + Rule 2 VP carve-out;
-#               Phase 2b Rule 3b atomic-cohort grouping + cohort-level propagation)
-# @adr ADR-049 (resolved via bin/wr-risk-scorer-evaluate-graduation shim)
-# @adr ADR-052 (behavioural-fixture coverage at scripts/test/evaluate-graduation.bats)
-# @adr ADR-015 (pure-scorer contract — script does deterministic join + grouping;
-#               agent owns release-risk re-computation + evidence-floor judgement)
-# @adr ADR-031 (dual-tolerant problem-ticket layout per RFC-002 migration window)
-# @problem P162 (Phase 2a + Phase 2b)
-
-set -uo pipefail
-
-PROJECT_ROOT="${1:-$(pwd)}"
-HOLDING_DIR="${PROJECT_ROOT}/docs/changesets-holding"
-PROBLEMS_DIR="${PROJECT_ROOT}/docs/problems"
-
-if [ ! -d "${PROJECT_ROOT}/docs" ]; then
-  echo "GRADUATION_ERROR: invalid project root (missing docs/): ${PROJECT_ROOT}" >&2
-  exit 2
-fi
-
-if [ ! -d "$HOLDING_DIR" ]; then
-  echo "GRADUATION_SUMMARY: total=0 resolved=0 vp_blocked=0 halts=0"
-  exit 1
-fi
-
-# Enumerate held changesets (exclude README.md). Use null-delim shape so
-# filenames-with-spaces never break iteration (defensive even though our
-# convention is kebab-case).
-HELD_FILES=()
-while IFS= read -r -d '' f; do
-  base=$(basename "$f")
-  if [ "$base" = "README.md" ]; then
-    continue
-  fi
-  HELD_FILES+=("$f")
-done < <(find "$HOLDING_DIR" -maxdepth 1 -type f -name '*.md' -print0 2>/dev/null)
-
-if [ "${#HELD_FILES[@]}" -eq 0 ]; then
-  echo "GRADUATION_SUMMARY: total=0 resolved=0 vp_blocked=0 halts=0"
-  exit 1
-fi
-
-# Delegate the per-candidate join + VP-check + cohort grouping to python for
-# re-readable regex + dual-layout glob handling.
-EVAL_RESULT=$(python3 - "$HOLDING_DIR" "$PROBLEMS_DIR" "${HELD_FILES[@]}" <<'PYEOF'
-import os
-import re
-import sys
-import glob
-
-holding_dir = sys.argv[1]
-problems_dir = sys.argv[2]
-held_files = sys.argv[3:]
-
-FILENAME_TICKET_RE = re.compile(r'-p(\d+)-', re.IGNORECASE)
-BODY_TICKET_RE = re.compile(r'\bP(\d+)\b')
-PRIORITY_LINE_RE = re.compile(r'^\*\*Priority\*\*:\s*(\d+)\b')
-FIX_RELEASED_HEADING_RE = re.compile(r'^##\s+Fix Released\s*$', re.IGNORECASE)
-# Placeholder-only tokens that do NOT count as a populated `## Fix Released`
-# section (a fix that is scaffolded-but-not-shipped). Kept mechanical per
-# ADR-015 — this is deterministic detection, not prose judgement.
-FIX_RELEASED_PLACEHOLDERS = frozenset({'tbd', 'n/a', 'na', 'pending', '(pending)',
-                                       '(deferred)', 'deferred', '(none)', 'none'})
-
-# Phase 2b — README "Currently held" bullet parser.
-# Matches `- \`<filename>\` ... **Reinstate trigger**: <trigger-text>`.
-# Captures the filename (group 1) and the trigger text (group 2; rest of line).
-README_BULLET_RE = re.compile(
-    r'^-\s+`([^`]+\.md)`\s+.*?\*\*Reinstate trigger\*\*:\s*(.+?)\s*$'
-)
-# Strip parenthetical elaborations before grouping; nested parens are out of
-# scope for Phase 2b (no observed README entry uses them in the trigger).
-PAREN_RE = re.compile(r'\([^()]*\)')
-# Sanitise cohort-id from normalised trigger prose.
-NON_ID_CHAR_RE = re.compile(r'[^a-z0-9]+')
-
-
-def find_ticket_file(ticket_id_padded: str):
-    """Dual-tolerant glob per ADR-031 / RFC-002 migration window.
-
-    Returns (path, status_suffix) where status_suffix is one of
-    'open', 'known-error', 'verifying', 'closed', 'parked' or None
-    if no file resolves.
-    """
-    # Per-state subdir layout
-    for state in ('open', 'known-error', 'verifying', 'closed', 'parked'):
-        candidates = glob.glob(os.path.join(problems_dir, state, f'{ticket_id_padded}-*.md'))
-        if candidates:
-            return candidates[0], state
-    # Flat layout
-    for state in ('open', 'known-error', 'verifying', 'closed', 'parked'):
-        candidates = glob.glob(os.path.join(problems_dir, f'{ticket_id_padded}-*.{state}.md'))
-        if candidates:
-            return candidates[0], state
-    return None, None
-
-
-def extract_priority(ticket_path: str):
-    """Read the `**Priority**: N (...)` line and return integer N, or None."""
-    try:
-        with open(ticket_path, 'r', encoding='utf-8') as f:
-            for line in f:
-                m = PRIORITY_LINE_RE.match(line.strip())
-                if m:
-                    return int(m.group(1))
-    except (OSError, IOError):
-        return None
-    return None
-
-
-def fix_shipped(ticket_path: str) -> bool:
-    """True when the ticket carries a populated `## Fix Released` section.
-
-    A verifying ticket whose fix has shipped carries real prose under
-    `## Fix Released` (per ADR-022 / manage-problem closing contract); an
-    absent, empty, or placeholder-only section means the fix has not actually
-    shipped yet. Mechanical predicate per ADR-015 (ADR-061 Rule 2 amended,
-    P398): section present AND ≥1 non-blank line that is not a placeholder
-    token counts as shipped.
-    """
-    try:
-        with open(ticket_path, 'r', encoding='utf-8') as f:
-            lines = f.readlines()
-    except (OSError, IOError):
-        return False
-    in_section = False
-    for line in lines:
-        if FIX_RELEASED_HEADING_RE.match(line.strip()):
-            in_section = True
-            continue
-        if not in_section:
-            continue
-        stripped = line.strip()
-        if stripped.startswith('## '):
-            break  # next section reached with no real content
-        if not stripped:
-            continue
-        if stripped.lower() in FIX_RELEASED_PLACEHOLDERS:
-            continue
-        return True  # real content under the heading
-    return False
-
-
-def resolve_ticket_ids(changeset_path: str):
-    """Apply Rule 1a join: filename convention primary, body-grep fallback.
-
-    Returns a list of zero-padded ticket IDs (e.g. ['085']) referenced by
-    this changeset. Empty list means halt-no-resolution per Rule 1a terminal.
-    """
-    basename = os.path.basename(changeset_path)
-    # Primary: filename convention
-    filename_match = FILENAME_TICKET_RE.search(basename)
-    if filename_match:
-        return [f'{int(filename_match.group(1)):03d}']
-
-    # Fallback: body grep for P\d+ references
-    try:
-        with open(changeset_path, 'r', encoding='utf-8') as f:
-            body = f.read()
-    except (OSError, IOError):
-        return []
-
-    body_matches = BODY_TICKET_RE.findall(body)
-    if not body_matches:
-        return []
-
-    # De-duplicate while preserving order; zero-pad
-    seen = set()
-    ids = []
-    for raw_id in body_matches:
-        padded = f'{int(raw_id):03d}'
-        if padded not in seen:
-            seen.add(padded)
-            ids.append(padded)
-    return ids
-
-
-def normalise_trigger(trigger_text: str) -> str:
-    """Normalise reinstate-trigger prose for cohort-key comparison.
-
-    Strips parenthetical elaborations (Reassessment criterion citations,
-    inline notes), takes the prefix up to the first em-dash separator
-    (typical for "trigger description — review at ..." continuations),
-    strips trailing punctuation, lowercases, and collapses whitespace
-    LAST so paren-strip artefacts (stray spaces before punctuation) do
-    not break equality matching.
-    """
-    # Strip parentheticals; loop in case there are multiple non-nested groups.
-    prior = None
-    cleaned = trigger_text
-    while cleaned != prior:
-        prior = cleaned
-        cleaned = PAREN_RE.sub('', cleaned)
-    # Take prefix up to first em-dash separator (continuations begin here).
-    cleaned = cleaned.split('—', 1)[0]  # em-dash U+2014
-    # Lowercase, strip surrounding whitespace + trailing punctuation; collapse
-    # whitespace LAST so paren-strip leaves no orphaned single spaces before
-    # punctuation that would defeat equality comparison.
-    cleaned = cleaned.lower().strip().rstrip('.,;:').strip()
-    cleaned = ' '.join(cleaned.split())
-    # Strip any trailing punctuation that was previously space-separated.
-    cleaned = cleaned.rstrip('.,;:').strip()
-    return cleaned
-
-
-def cohort_id_from_trigger(normalised: str) -> str:
-    """Compute a filename-safe cohort id from normalised trigger prose.
-
-    Takes the first 8 tokens, replaces non-alphanumeric runs with single
-    dashes, trims surrounding dashes, caps at 60 chars.
-    """
-    tokens = normalised.split()[:8]
-    joined = ' '.join(tokens)
-    slug = NON_ID_CHAR_RE.sub('-', joined).strip('-')
-    return slug[:60] if slug else 'cohort'
-
-
-def parse_currently_held_cohorts(holding_dir: str):
-    """Parse docs/changesets-holding/README.md to build a filename→cohort-id map.
-
-    Reads only entries within the "## Currently held" section (case-insensitive),
-    extracts each bullet's filename + trigger text, normalises triggers, and
-    groups filenames sharing an identical normalised trigger. Cohorts with ≥ 2
-    members are returned as {filename: cohort_id}; single-member groups are
-    omitted so they fall back to class=3a per Phase 2a semantics.
-
-    Returns {} when README missing OR "Currently held" section absent OR no
-    multi-member groups present.
-    """
-    readme_path = os.path.join(holding_dir, 'README.md')
-    if not os.path.isfile(readme_path):
-        return {}
-    try:
-        with open(readme_path, 'r', encoding='utf-8') as f:
-            lines = f.readlines()
-    except (OSError, IOError):
-        return {}
-
-    # Walk lines; track whether we're inside the "Currently held" section.
-    in_section = False
-    bullets = []  # list of (filename, normalised_trigger)
-    for line in lines:
-        stripped = line.strip()
-        if stripped.startswith('## '):
-            heading = stripped[3:].strip().lower()
-            in_section = (heading == 'currently held')
-            continue
-        if not in_section:
-            continue
-        match = README_BULLET_RE.match(line.rstrip('\n'))
-        if not match:
-            continue
-        filename = match.group(1)
-        trigger = match.group(2)
-        normalised = normalise_trigger(trigger)
-        if not normalised:
-            continue
-        bullets.append((filename, normalised))
-
-    # Group bullets by normalised trigger.
-    groups = {}
-    for filename, normalised in bullets:
-        groups.setdefault(normalised, []).append(filename)
-
-    # Keep only multi-member groups; compute cohort id.
-    cohort_map = {}
-    for normalised, members in groups.items():
-        if len(members) < 2:
-            continue
-        cohort_id = cohort_id_from_trigger(normalised)
-        for filename in members:
-            cohort_map[filename] = cohort_id
-    return cohort_map
-
-
-# Per-changeset resolution structure:
-#   {basename: {ticket: 'P<NNN>'|'-', priority: <int>|None, status: <str>,
-#               ticket_ids: [<padded>], chosen_suffix: <str>|None}}
-per_changeset = {}
-
-for changeset_path in held_files:
-    basename = os.path.basename(changeset_path)
-    ticket_ids = resolve_ticket_ids(changeset_path)
-
-    if not ticket_ids:
-        per_changeset[basename] = {
-            'ticket_label': '-',
-            'priority': None,
-            'status': 'halt-no-resolution',
-        }
-        continue
-
-    resolutions = []
-    for tid in ticket_ids:
-        path, suffix = find_ticket_file(tid)
-        if path is None:
-            continue
-        priority = extract_priority(path)
-        if priority is None:
-            continue
-        resolutions.append((tid, priority, suffix, path))
-
-    if not resolutions:
-        per_changeset[basename] = {
-            'ticket_label': ','.join(f'P{i}' for i in ticket_ids),
-            'priority': None,
-            'status': 'halt-no-resolution',
-        }
-        continue
-
-    resolutions.sort(key=lambda r: r[1], reverse=True)
-    chosen_tid, chosen_priority, chosen_suffix, chosen_path = resolutions[0]
-    if chosen_suffix == 'verifying' and not fix_shipped(chosen_path):
-        # ADR-061 Rule 2 (narrowed per P398): the VP carve-out holds a changeset
-        # only while its fix is NOT yet shipped. A verifying ticket with no
-        # populated `## Fix Released` section is still mid-flight — hold it.
-        per_changeset[basename] = {
-            'ticket_label': f'P{chosen_tid}',
-            'priority': chosen_priority,
-            'status': 'vp-blocked',
-        }
-        continue
-    # A verifying ticket whose `## Fix Released` is populated means the code is
-    # already live on npm; only the changelog-attribution changeset is held, so
-    # it graduates as `resolved` rather than stranding indefinitely (P398).
-
-    per_changeset[basename] = {
-        'ticket_label': f'P{chosen_tid}',
-        'priority': chosen_priority,
-        'status': 'resolved',
-    }
-
-# Phase 2b — cohort detection.
-cohort_map = parse_currently_held_cohorts(holding_dir)
-# Build inverse: cohort_id → [member basenames].
-cohort_members = {}
-for filename, cohort_id in cohort_map.items():
-    cohort_members.setdefault(cohort_id, []).append(filename)
-
-# Compute cohort-level rollups (priority + status).
-# Atomic propagation: any halt → cohort halts; else any vp-blocked → cohort
-# vp-blocked; else cohort resolved. Cohort priority = max(member priority)
-# across resolved/vp-blocked members; '-' when all members halted.
-cohort_rollup = {}
-for cohort_id, members in cohort_members.items():
-    statuses = []
-    priorities = []
-    for filename in members:
-        # Only consider members that are actually in the holding-area glob;
-        # README may list entries that no longer exist on disk (stale README).
-        info = per_changeset.get(filename)
-        if info is None:
-            continue
-        statuses.append(info['status'])
-        if info['priority'] is not None:
-            priorities.append(info['priority'])
-
-    if not statuses:
-        # No cohort members are real held files; skip cohort treatment.
-        continue
-    if 'halt-no-resolution' in statuses:
-        cohort_status = 'halt-no-resolution'
-    elif 'vp-blocked' in statuses:
-        cohort_status = 'vp-blocked'
-    else:
-        cohort_status = 'resolved'
-    cohort_priority = max(priorities) if priorities else None
-    cohort_rollup[cohort_id] = {
-        'status': cohort_status,
-        'priority': cohort_priority,
-    }
-
-# Emit candidate lines in held_files order.
-total = 0
-resolved = 0
-vp_blocked = 0
-halts = 0
-
-for changeset_path in held_files:
-    total += 1
-    basename = os.path.basename(changeset_path)
-    info = per_changeset[basename]
-    cohort_id = cohort_map.get(basename)
-    is_cohort = cohort_id is not None and cohort_id in cohort_rollup
-
-    if is_cohort:
-        rollup = cohort_rollup[cohort_id]
-        # Use cohort-level priority + status; ticket_label remains member-local
-        # so audit trail still cites the specific resolved ticket.
-        priority_str = '-' if rollup['priority'] is None else str(rollup['priority'])
-        ticket_label = info['ticket_label']
-        status = rollup['status']
-        print(
-            f'GRADUATION_CANDIDATE: changeset={basename} | ticket={ticket_label} | '
-            f'priority={priority_str} | class=3b | cohort={cohort_id} | status={status}'
-        )
-    else:
-        priority_str = '-' if info['priority'] is None else str(info['priority'])
-        print(
-            f'GRADUATION_CANDIDATE: changeset={basename} | ticket={info["ticket_label"]} | '
-            f'priority={priority_str} | class=3a | status={info["status"]}'
-        )
-
-    # Tally member-level counts (cohorts count per-member for backward compat).
-    effective_status = cohort_rollup[cohort_id]['status'] if is_cohort else info['status']
-    if effective_status == 'resolved':
-        resolved += 1
-    elif effective_status == 'vp-blocked':
-        vp_blocked += 1
-    elif effective_status == 'halt-no-resolution':
-        halts += 1
-
-print(f'GRADUATION_SUMMARY: total={total} resolved={resolved} vp_blocked={vp_blocked} halts={halts}')
-PYEOF
-)
-PY_STATUS=$?
-
-echo "$EVAL_RESULT"
-
-if [ "$PY_STATUS" -ne 0 ]; then
-  exit "$PY_STATUS"
-fi
-
-exit 0