dev-loops 0.6.0 → 0.7.2

package/scripts/github/detect-checkpoint-evidence.mjs

@@ -9,15 +9,19 @@ import {
   summarizeGateReviewCommentMarkers,
   summarizeGateReviewComments,
 } from "../_core-helpers.mjs";
-import { access } from "node:fs/promises";
+import { access, readFile } from "node:fs/promises";
 import path from "node:path";
 import { parsePrNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
 import { fetchGithubReviewThreadsPayload } from "./capture-review-threads.mjs";
 import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
-import { loadDevLoopConfig, resolveGateConfig, resolveRequireFanoutEvidence } from "@dev-loops/core/config";
+import { FANOUT_PROVENANCE_MIN_REVIEWERS, GATE_FULL_LABEL, loadDevLoopConfig, resolveGateAngleContract, resolveGateConfig, resolveLightMode, resolveRejectForeignAngles, resolveRequireFanoutEvidence, resolveRequireFanoutProvenance } from "@dev-loops/core/config";
+import { FANOUT_UNAVAILABLE_MESSAGE, checkFanoutAngleCoverage, provenanceConsistencyError } from "@dev-loops/core/loop/gate-fanin";
+import { detectMergeBaseScope, isEligibleForLightMode } from "../loop/detect-change-scope.mjs";
 import { buildLogPath } from "./write-gate-findings-log.mjs";
 import { ensureAsyncRunnerOwnership } from "../loop/_pr-runner-coordination.mjs";
 import { detectStaleRunner } from "../loop/_stale-runner-detection.mjs";
+import { resolveLedgerCheckouts, resolveRepoRoot } from "../loop/_repo-root-resolver.mjs";
+import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
 const USAGE = `Usage: detect-checkpoint-evidence.mjs --repo <owner/name> --pr <number>
 Fetch the live PR head SHA and visible PR issue comments, then summarize the
 latest valid draft-gate and pre-approval checkpoint verdict comments. Always fail
@@ -84,9 +88,11 @@ Output (stdout, JSON; always includes preMergeGateCheck):
 Error output (stderr, JSON):
   { "ok": false, "error": "...", "usage": "..." }
   { "ok": false, "error": "..." }
+${JQ_OUTPUT_USAGE}
 Exit codes:
   0  Success (gate evidence is valid)
-  1  Argument error, gh failure, malformed gh JSON, or missing required pre-merge gate evidence.`.trim();
+  1  Argument error, gh failure, malformed gh JSON, or missing required pre-merge gate evidence.
+  2  Invalid --jq filter.`.trim();
 const parseError = buildParseError(USAGE);
 export function parseDetectCheckpointEvidenceCliArgs(argv) {
   const { tokens } = parseArgs({
@@ -96,6 +102,7 @@ export function parseDetectCheckpointEvidenceCliArgs(argv) {
       repo: { type: "string" },
       pr: { type: "string" },
       "require-before-merge": { type: "boolean" },
+      ...JQ_OUTPUT_PARSE_OPTIONS,
     },
     allowPositionals: true,
     strict: false,
@@ -125,6 +132,7 @@ export function parseDetectCheckpointEvidenceCliArgs(argv) {
       options.pr = parsePrNumber(requireTokenValue(token, parseError), parseError);
       continue;
     }
+    if (matchJqOutputToken(token, options, (t) => requireTokenValue(t, parseError))) continue;
     if (token.name === "require-before-merge") {
       throw parseError(`--require-before-merge has been removed: gate evidence enforcement is now always-on by default. Omit the flag.`);
     }
@@ -232,6 +240,7 @@ function normalizeGateMarkerSummary(summary) {
 }
 export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, staleRunnerCheck = null, fanoutEnforcement = null) {
   const failures = [];
+  const warnings = [];
   if (!(evidence.draftGate.visible && evidence.draftGate.verdict === "clean")) {
     failures.push("missing visible clean draft_gate comment");
   }
@@ -249,7 +258,24 @@ export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, s
   // { required: false, gates: [] } so the `.required` guard skips this block.
   if (fanoutEnforcement && fanoutEnforcement.required) {
     for (const gate of fanoutEnforcement.gates) {
-      if (gate.executionMode !== "fanout_fanin") {
+      // Light-mode acceptance (#1174): a genuinely under-threshold micro-PR
+      // collapses the gate fan-out to a single inline check (#1043). Accept that
+      // inline verdict ONLY when ALL hold, fail CLOSED otherwise:
+      //   - lightMode is enabled in config, AND
+      //   - the reviewed head's merge-base scope was RE-DERIVED under threshold
+      //     (scopeUnderThreshold; false whenever scope could not be derived), AND
+      //   - the PR carries no gate:full label (which always forces fan-out), AND
+      //   - the verdict records a non-empty inline reason.
+      // Any non-light inline verdict (over threshold / label / lightMode off /
+      // scope underivable) falls through to the byte-identical rejection below.
+      const lightAccepted =
+        gate.executionMode === "inline_single_agent"
+        && fanoutEnforcement.lightMode === true
+        && fanoutEnforcement.hasFullLabel !== true
+        && gate.scopeUnderThreshold === true
+        && typeof gate.inlineReason === "string"
+        && gate.inlineReason.trim().length > 0;
+      if (gate.executionMode !== "fanout_fanin" && !lightAccepted) {
         failures.push(
           `${gate.name}: requireFanoutEvidence is enabled but executionMode is "${gate.executionMode ?? "unset"}" (expected "fanout_fanin"); inline gate verdicts are not accepted`,
         );
@@ -259,6 +285,67 @@ export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, s
         failures.push(
           `${gate.name}: requireFanoutEvidence is enabled but no findings-log ledger exists for the reviewed head (${gate.ledgerPath})`,
         );
+        continue;
+      }
+      // Opt-in provenance enforcement (gates.requireFanoutProvenance), layered on
+      // top of fan-out evidence. When off (default) requireProvenance is falsy so
+      // NO new failure is added — behavior is byte-identical to today. When on, a
+      // fanout_fanin ledger must record INTERNALLY-CONSISTENT provenance (checked
+      // the same way the write path validates it — a hand-edited or shadow ledger
+      // is re-validated here, not trusted) with distinctReviewers >= the floor.
+      // Provenance is enforced ONLY for fanout_fanin verdicts (#1174): a
+      // light-accepted inline verdict is already scope-bounded and has no
+      // multi-reviewer provenance to record, so requiring it would make the
+      // light path unmergeable — the inverse of this issue's fix.
+      if (fanoutEnforcement.requireProvenance && gate.executionMode === "fanout_fanin") {
+        const prov = gate.provenance;
+        const consistencyErr = provenanceConsistencyError(prov);
+        const reviewers = prov && Number.isInteger(prov.distinctReviewers) ? prov.distinctReviewers : null;
+        if (consistencyErr) {
+          failures.push(
+            `${gate.name}: requireFanoutProvenance is enabled but the findings-log ledger lacks valid fan-out provenance (${consistencyErr}); ${FANOUT_UNAVAILABLE_MESSAGE}`,
+          );
+        } else if (reviewers === null || reviewers < FANOUT_PROVENANCE_MIN_REVIEWERS) {
+          failures.push(
+            `${gate.name}: requireFanoutProvenance is enabled but the findings-log ledger lacks valid fan-out provenance (need provenance.distinctReviewers >= ${FANOUT_PROVENANCE_MIN_REVIEWERS}, got ${reviewers === null ? "none" : reviewers}); ${FANOUT_UNAVAILABLE_MESSAGE}`,
+          );
+        }
+      }
+      // Angle-coverage enforcement: independent of requireFanoutProvenance.
+      // When the gate configures mandatory angles, a fanout_fanin ledger MUST
+      // record internally-consistent provenance — otherwise a shadow ledger
+      // that simply omits provenance would bypass mandatory-angle coverage.
+      // Recorded provenance is then re-validated: perAngle must cover every
+      // mandatory angle and (default) stay within the configured pool. Gates
+      // without mandatory angles keep today's behavior (absent provenance adds
+      // no failure; that stricter gap is requireFanoutProvenance's opt-in).
+      if (gate.executionMode === "fanout_fanin") {
+        const mandatoryAngles = gate.mandatoryAngles ?? [];
+        const provValid = gate.provenance != null && provenanceConsistencyError(gate.provenance) === null;
+        if (mandatoryAngles.length > 0 && !provValid) {
+          failures.push(
+            `${gate.name}: mandatory angle coverage is configured (${mandatoryAngles.join(", ")}) but the findings-log ledger records no valid fan-out provenance to verify it against; write the ledger with --provenance covering the mandatory angles; ${FANOUT_UNAVAILABLE_MESSAGE}`,
+          );
+        } else if (provValid) {
+          const { missingMandatory, foreignAngles } = checkFanoutAngleCoverage(gate.provenance.perAngle, {
+            mandatoryAngles,
+            pool: gate.anglePool ?? null,
+          });
+          if (missingMandatory.length > 0) {
+            failures.push(
+              `${gate.name}: fan-out provenance is missing mandatory angle(s): ${missingMandatory.join(", ")}; ${FANOUT_UNAVAILABLE_MESSAGE}`,
+            );
+          }
+          if (foreignAngles.length > 0) {
+            const message = `${gate.name}: fan-out provenance names angle(s) outside the configured pool: ${foreignAngles.join(", ")}`;
+            if (fanoutEnforcement.rejectForeignAngles ?? true) {
+              failures.push(`${message}; ${FANOUT_UNAVAILABLE_MESSAGE}`);
+            } else {
+              // rejectForeignAngles: false is WARNING mode, not silence.
+              warnings.push(`${message} (gates.rejectForeignAngles is false; recorded as a warning)`);
+            }
+          }
+        }
       }
     }
   }
@@ -277,6 +364,8 @@ export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, s
   return {
     ok: failures.length === 0,
     failures,
+    // Additive: only present when non-empty, preserving the existing {ok, failures} shape.
+    ...(warnings.length > 0 ? { warnings } : {}),
   };
 }
 async function ledgerExists(fullPath) {
@@ -287,43 +376,163 @@ async function ledgerExists(fullPath) {
     return false;
   }
 }
+/**
+ * True if the ledger (relative path) exists under ANY enumerated checkout
+ * (main + every worktree). Fixes #1050: a ledger written in the PR worktree is
+ * found even when the check runs from a different checkout's git-toplevel.
+ */
+async function ledgerExistsInAny(checkouts, ledgerPath) {
+  for (const root of checkouts) {
+    if (await ledgerExists(path.resolve(root, ledgerPath))) {
+      return true;
+    }
+  }
+  return false;
+}
+/**
+ * Read the recorded fan-out `provenance` object from a ledger across the
+ * enumerated checkouts. Mirrors ledgerExistsInAny's "ANY checkout satisfies"
+ * semantics: prefers the FIRST checkout whose ledger provenance actually
+ * SATISFIES the FULL active enforcement — internally consistent, meeting the
+ * distinctReviewers floor when requireFanoutProvenance is on, AND passing the
+ * gate's angle contract (mandatory-angle coverage; pool membership when
+ * foreign angles are rejected) — so a stale checkout's below-floor,
+ * provenance-less, or angle-contract-failing ledger cannot SHADOW a valid one
+ * in the PR worktree (which would falsely fail closed). Falls back to the
+ * first non-null provenance (for a useful diagnostic message) only when NO
+ * checkout satisfies, and null only when none is present. Called whenever
+ * requireFanoutProvenance is enabled OR the gate's verdict is fanout_fanin —
+ * inline verdicts never trigger this read.
+ */
+async function readLedgerProvenanceInAny(checkouts, ledgerPath, criteria = {}) {
+  const { requireProvenance = false, mandatoryAngles = [], anglePool = null, rejectForeignAngles = true } = criteria;
+  const satisfies = (prov) => {
+    if (provenanceConsistencyError(prov) !== null) return false;
+    if (requireProvenance && prov.distinctReviewers < FANOUT_PROVENANCE_MIN_REVIEWERS) return false;
+    const { missingMandatory, foreignAngles } = checkFanoutAngleCoverage(prov.perAngle, { mandatoryAngles, pool: anglePool });
+    if (missingMandatory.length > 0) return false;
+    if (foreignAngles.length > 0 && rejectForeignAngles) return false;
+    return true;
+  };
+  let firstNonNull = null;
+  for (const root of checkouts) {
+    const full = path.resolve(root, ledgerPath);
+    try {
+      const parsed = JSON.parse(await readFile(full, "utf8"));
+      const prov = parsed && typeof parsed === "object" ? parsed.provenance : null;
+      if (prov == null) continue; // ledger present but no provenance — keep scanning.
+      if (satisfies(prov)) {
+        return prov; // satisfying ledger — prefer it over any earlier failing one.
+      }
+      if (firstNonNull === null) firstNonNull = prov; // remember for diagnostics.
+    } catch {
+      // Missing/unreadable/malformed ledger in this checkout — try the next.
+    }
+  }
+  return firstNonNull;
+}
 /**
  * Build the fan-out evidence enforcement descriptor.
  *
  * Enforcement is ON by default (opt-out via gates.requireFanoutEvidence: false).
  * Returns { required: false } when enforcement is disabled OR when config is
  * unavailable (config == null — null or undefined — after a failed load) — config-unavailable must
- * fail open and never enable enforcement. When enabled, records per-required-gate
- * executionMode and whether the deterministic findings-log ledger exists for the
- * reviewed head SHA so the pre-merge check can fail closed on inline verdicts or
- * missing ledgers.
+ * fail open and never enable enforcement. When enabled, returns
+ * { required: true, requireProvenance, lightMode, hasFullLabel, gates } where
+ * each per-required-gate entry records executionMode, inlineReason,
+ * scopeUnderThreshold, and whether the deterministic findings-log ledger exists
+ * for the reviewed head SHA, so the pre-merge check can fail closed on inline
+ * verdicts or missing ledgers.
+ *
+ * Light mode (#1174): when gates.lightMode is configured, `hasFullLabel`
+ * (gate:full PR label) and `baseRef` feed a fail-closed merge-base scope
+ * re-derivation for inline verdicts. A gate's scopeUnderThreshold is true only
+ * when light mode is on, the PR has no gate:full label, a base ref is known,
+ * and the reviewed head's merge-base diff is genuinely under threshold — which
+ * lets the pre-merge check accept an inline single-agent verdict for a
+ * small-scope PR instead of always rejecting inline evidence.
  */
-async function buildFanoutEnforcement({ repo, pr, currentHeadSha, draftGateMarker, preApprovalGateMarker, config, cwd }) {
+export async function buildFanoutEnforcement({ repo, pr, currentHeadSha, draftGateMarker, preApprovalGateMarker, config, cwd, hasFullLabel = false, baseRef = null }) {
   // Fail open when config could not be loaded/validated. `== null` covers both
   // null and undefined; the loader only ever yields null on failure, but the
   // loose check defensively treats an absent config as unavailable.
   if (config == null || !resolveRequireFanoutEvidence(config)) {
+    // Disabled/unavailable return is intentionally byte-identical to before
+    // (no requireProvenance key): buildPreMergeGateCheck only reads it inside
+    // the `required` block, so this preserves the exact existing shape.
     return { required: false, gates: [] };
   }
-  const draftRequired = resolveGateConfig(config, "draft").required;
-  const preApprovalRequired = resolveGateConfig(config, "preApproval").required;
+  // Provenance enforcement is opt-in and layered ON TOP of fan-out evidence: it
+  // only takes effect while evidence enforcement (above) is active.
+  const requireProvenance = resolveRequireFanoutProvenance(config);
+  // Angle-coverage enforcement (mandatory angles + pool membership) is layered
+  // independently of requireProvenance: it re-validates whatever provenance a
+  // fanout_fanin ledger actually recorded, regardless of that opt-in flag.
+  const rejectForeignAngles = resolveRejectForeignAngles(config);
+  // Light-mode facts (#1174): the threshold that a re-derived merge-base scope
+  // must fall under for an inline verdict to be accepted. null when lightMode is
+  // disabled → no inline verdict can ever be accepted (scopeUnderThreshold stays
+  // false), preserving today's rejection.
+  const lightThreshold = resolveLightMode(config);
+  const lightMode = lightThreshold != null;
+  const draftGateConfig = resolveGateConfig(config, "draft");
+  const preApprovalGateConfig = resolveGateConfig(config, "preApproval");
+  // Shared angle-contract resolver (exclude-filtered mandatory angles +
+  // additive-aware pool) — the same contract the write paths enforce. The
+  // field names here (`mandatoryAngles`/`anglePool`) are exactly what
+  // buildPreMergeGateCheck reads off each gate entry.
+  const buildAngleFields = (gateKey) => {
+    const { mandatoryAngles, pool } = resolveGateAngleContract(config, gateKey);
+    return { mandatoryAngles, anglePool: pool };
+  };
+  const GATE_ANGLE_CONFIG = {
+    draft_gate: buildAngleFields("draft"),
+    pre_approval_gate: buildAngleFields("preApproval"),
+  };
   const gateSpecs = [
-    { name: "draft_gate", marker: draftGateMarker, required: draftRequired },
-    { name: "pre_approval_gate", marker: preApprovalGateMarker, required: preApprovalRequired },
+    { name: "draft_gate", marker: draftGateMarker, required: draftGateConfig.required },
+    { name: "pre_approval_gate", marker: preApprovalGateMarker, required: preApprovalGateConfig.required },
   ].filter((spec) => spec.required && spec.marker.visible);
   const gates = [];
+  const checkouts = resolveLedgerCheckouts(cwd);
+  // checkouts[0] is always resolveRepoRoot(cwd) (resolveLedgerCheckouts adds it
+  // first, unconditionally, and never throws — it falls back to cwd on git
+  // failure) — reuse it instead of a second `git rev-parse --show-toplevel`.
+  const repoRoot = checkouts[0];
   for (const spec of gateSpecs) {
     const headSha = spec.marker.headSha ?? currentHeadSha;
     const ledgerPath = buildLogPath({ repo, pr, gate: spec.name, headSha, tmpRoot: "tmp" });
-    const fullPath = path.resolve(cwd, ledgerPath);
+    // Re-derive scope FAIL-CLOSED for inline verdicts only (the fan-out default
+    // path pays no git I/O). scopeUnderThreshold is true ONLY when lightMode is
+    // on, the PR has no gate:full label, a base ref is known, and the merge-base
+    // diff for the reviewed head is genuinely under threshold. Any git/scope
+    // failure leaves it false, so the inline verdict is rejected exactly as today.
+    let scopeUnderThreshold = false;
+    if (lightMode && !hasFullLabel && baseRef && spec.marker.executionMode === "inline_single_agent") {
+      const scope = detectMergeBaseScope({ base: baseRef, head: headSha, cwd: repoRoot });
+      scopeUnderThreshold = scope.ok === true && isEligibleForLightMode(scope, lightThreshold);
+    }
+    // Read ledger provenance for ANY fanout_fanin gate (not just when
+    // requireProvenance is on): angle-coverage enforcement re-validates
+    // whatever provenance is recorded independently of that opt-in flag.
+    // The selection criteria mirror the full active enforcement so a stale
+    // checkout's contract-failing ledger cannot shadow a passing one.
+    const readProvenance = requireProvenance || spec.marker.executionMode === "fanout_fanin";
+    const angleFields = GATE_ANGLE_CONFIG[spec.name];
     gates.push({
       name: spec.name,
       executionMode: spec.marker.executionMode ?? null,
+      inlineReason: spec.marker.inlineReason ?? null,
+      scopeUnderThreshold,
       ledgerPath,
-      ledgerExists: await ledgerExists(fullPath),
+      ledgerExists: await ledgerExistsInAny(checkouts, ledgerPath),
+      provenance: readProvenance
+        ? await readLedgerProvenanceInAny(checkouts, ledgerPath, { requireProvenance, rejectForeignAngles, ...angleFields })
+        : null,
+      ...angleFields,
     });
   }
-  return { required: true, gates };
+  return { required: true, requireProvenance, rejectForeignAngles, lightMode, hasFullLabel, gates };
 }
 export async function detectCheckpointEvidence(options, { env = process.env, ghCommand = "gh", cwd = process.cwd() } = {}) {
   const runnerOwnership = await ensureAsyncRunnerOwnership({
@@ -378,8 +587,31 @@ export async function detectCheckpointEvidence(options, { env = process.env, ghC
   // treat it as config-unavailable and leave fan-out enforcement disabled
   // (preserves default behavior). Other gate checks remain unaffected.
   let config = null;
-  const { config: loadedConfig, errors: configErrors } = await loadDevLoopConfig({ repoRoot: cwd });
+  const { config: loadedConfig, errors: configErrors } = await loadDevLoopConfig({ repoRoot: resolveRepoRoot(cwd) });
   config = Array.isArray(configErrors) && configErrors.length > 0 ? null : loadedConfig;
+  // Light-mode pre-merge facts (#1174): the base commit for the merge-base scope
+  // re-derivation and whether the PR forces full fan-out via the gate:full label.
+  // Fetched LAZILY — only when fan-out enforcement is active AND lightMode is on
+  // AND a gate actually recorded an inline verdict — so the common fan-out path
+  // (and every existing caller/test) makes NO extra gh call and stays unchanged.
+  let baseRef = null;
+  let hasFullLabel = false;
+  const anyInlineVerdict = [draftGateMarker, preApprovalGateMarker].some(
+    (marker) => marker.visible && marker.executionMode === "inline_single_agent",
+  );
+  if (config != null && resolveRequireFanoutEvidence(config) && resolveLightMode(config) != null && anyInlineVerdict) {
+    try {
+      const lightFacts = await runGhJson(["pr", "view", String(options.pr), "--repo", options.repo, "--json", "baseRefOid,labels"], { env, ghCommand });
+      baseRef = typeof lightFacts?.baseRefOid === "string" && lightFacts.baseRefOid.trim().length > 0
+        ? lightFacts.baseRefOid.trim()
+        : null;
+      hasFullLabel = Array.isArray(lightFacts?.labels)
+        && lightFacts.labels.some((label) => (typeof label === "string" ? label : label?.name) === GATE_FULL_LABEL);
+    } catch {
+      // Fail CLOSED: without the label/base facts we cannot safely accept an
+      // inline verdict, so leave baseRef null (scope underivable → rejected).
+    }
+  }
   const fanoutEnforcement = await buildFanoutEnforcement({
     repo: options.repo,
     pr: options.pr,
@@ -388,6 +620,8 @@ export async function detectCheckpointEvidence(options, { env = process.env, ghC
     preApprovalGateMarker,
     config,
     cwd,
+    hasFullLabel,
+    baseRef,
   });
   return {
     ok: true,
@@ -458,7 +692,14 @@ async function main() {
       process.exitCode = 1;
       return;
     }
-    process.stdout.write(`${JSON.stringify(output)}\n`);
+    // Warnings (e.g. foreign angles under gates.rejectForeignAngles: false) do
+    // not fail the check but must not pass silently. Suppressed under --silent.
+    if (Array.isArray(preMergeGateCheck.warnings) && !options.silent) {
+      for (const warning of preMergeGateCheck.warnings) {
+        process.stderr.write(`WARNING: ${warning}\n`);
+      }
+    }
+    process.exitCode = emitResult(output, { jq: options.jq, silent: options.silent });
   } catch (error) {
     if (error && typeof error === "object" && "staleRunner" in error && error.staleRunner) {
       const staleRunnerCheck = {

package/scripts/github/detect-linked-issue-pr.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
 import { buildParseError, formatCliError, isDirectCliRun, parseJsonText } from "../_core-helpers.mjs";
-import { parseIssueNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
+import { parseIssueNumber, requireTokenValue, runChild as defaultRunChild } from "../_cli-primitives.mjs";
 import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
+import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
 export const LINKED_ISSUE_PR_QUERY = [
   "query($owner:String!, $name:String!, $issue:Int!, $after:String) {",
   "  repository(owner:$owner, name:$name) {",
@@ -28,6 +29,7 @@ export const LINKED_ISSUE_PR_QUERY = [
   "          }",
   "          ... on CrossReferencedEvent {",
   "            createdAt",
+  "            willCloseTarget",
   "            source {",
   "              __typename",
   "              ... on PullRequest {",
@@ -73,12 +75,18 @@ Error output (stderr, JSON):
   Argument/usage errors:
     { "ok": false, "error": "...", "usage": "..." }
   gh/runtime failures:
-    { "ok": false, "error": "..." }`.trim();
+    { "ok": false, "error": "..." }
+${JQ_OUTPUT_USAGE}`.trim();
 const parseError = buildParseError(USAGE);
 export function parseDetectLinkedIssuePrCliArgs(argv) {
   const { tokens } = parseArgs({
     args: [...argv],
-    options: { help: { type: "boolean", short: "h" }, repo: { type: "string" }, issue: { type: "string" } },
+    options: {
+      help: { type: "boolean", short: "h" },
+      repo: { type: "string" },
+      issue: { type: "string" },
+      ...JQ_OUTPUT_PARSE_OPTIONS,
+    },
     allowPositionals: true,
     strict: false,
     tokens: true,
@@ -107,6 +115,7 @@ export function parseDetectLinkedIssuePrCliArgs(argv) {
       options.issue = parseIssueNumber(requireTokenValue(token, parseError), parseError);
       continue;
     }
+    if (matchJqOutputToken(token, options, (t) => requireTokenValue(t, parseError))) continue;
     throw parseError(`Unknown argument: ${token.rawName}`);
   }
   if (options.repo === undefined || options.issue === undefined) {
@@ -162,6 +171,13 @@ function normalizeLinkedPrNode(node) {
     };
   }
   if (node.__typename === "CrossReferencedEvent") {
+    // Only a cross-reference that will CLOSE this issue owns its board status.
+    // A bare body-mention (willCloseTarget:false, e.g. "part of #X") must not
+    // create board-ownership linkage — otherwise every sibling a PR mentions
+    // gets dragged to In Progress and the resolver fails closed (#1130).
+    if (node.willCloseTarget !== true) {
+      return null;
+    }
     return {
       eventType: "CROSS_REFERENCED_EVENT",
       eventCreatedAt: node.createdAt,
@@ -253,7 +269,7 @@ export function selectLinkedIssuePr(candidates) {
   });
   return sorted[0] ?? null;
 }
-export async function detectLinkedIssuePr({ repo, issue }, { env = process.env, ghCommand = "gh" } = {}) {
+export async function detectLinkedIssuePr({ repo, issue }, { env = process.env, ghCommand = "gh", runChild = defaultRunChild } = {}) {
   const { owner, name } = parseRepoSlug(repo);
   const candidates = [];
   const closedUnmergedCandidates = [];
@@ -322,7 +338,7 @@ export async function detectLinkedIssuePr({ repo, issue }, { env = process.env,
 }
 export async function runCli(
   argv = process.argv.slice(2),
-  { stdout = process.stdout, env = process.env, ghCommand = "gh" } = {},
+  { stdout = process.stdout, stderr = process.stderr, env = process.env, ghCommand = "gh" } = {},
 ) {
   const options = parseDetectLinkedIssuePrCliArgs(argv);
   if (options.help) {
@@ -333,7 +349,7 @@ export async function runCli(
     { repo: options.repo, issue: options.issue },
     { env, ghCommand },
   );
-  stdout.write(`${JSON.stringify(result)}\n`);
+  process.exitCode = emitResult(result, { jq: options.jq, silent: options.silent, stdout, stderr });
 }
 if (isDirectCliRun(import.meta.url)) {
   runCli().catch((error) => {