dev-loops 0.7.1 → 0.8.0

package/scripts/github/_gate-names.mjs

@@ -0,0 +1,5 @@
+// Canonical gate vocabulary — the single source of truth for gate names shared
+// across the gate-review tooling. Imported by write-gate-context.mjs (artifact
+// gate validation) and verify-briefing-prefixes.mjs (wrong-gate scope check) so
+// the two can never drift.
+export const GATE_NAMES = ["draft_gate", "pre_approval_gate"];

package/scripts/github/_review-thread-mutations.mjs

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { isCopilotLogin, parseReviewThreads } from "../_core-helpers.mjs";
+import { isCopilotLogin, parseReviewThreads, sanitizeCopilotSummonTokens } from "../_core-helpers.mjs";
 import { fetchGithubReviewThreadsPayload } from "./capture-review-threads.mjs";
 export const MIN_DISMISSAL_REASON_LENGTH = 30;
 export function hasCommitShaReference(text) {
@@ -175,12 +175,15 @@ export async function replyAndMaybeResolve(
   } else {
     await validateReplyTarget({ repo, pr, commentId, threadId }, { env, ghCommand });
   }
+  // Neutralize any bare @copilot/`/copilot`* tokens the reply text quotes (e.g.
+  // a dismissal reason citing the anti-summon rule) so posting this reply can
+  // never arm request-copilot-review.mjs's anti-summon guard.
   const reply = parseReplyPayload(await postReply(
     {
       repo,
       pr,
       commentId,
-      body,
+      body: sanitizeCopilotSummonTokens(body),
     },
     { env, ghCommand },
   ));

package/scripts/github/capture-review-threads.mjs

@@ -9,7 +9,7 @@ import {
   readInput,
 } from "../_core-helpers.mjs";
 import { parseArgs } from "node:util";
-import { parsePrNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
+import { parsePrNumber, requireTokenValue, runChild as defaultRunChild } from "../_cli-primitives.mjs";
 import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
 import { JQ_OUTPUT_PARSE_OPTIONS, JQ_OUTPUT_USAGE, emitResult, matchJqOutputToken } from "../lib/jq-output.mjs";
 export const REVIEW_THREADS_QUERY = [
@@ -118,7 +118,7 @@ export function parseCaptureCliArgs(argv) {
 }
 export async function fetchGithubReviewThreadsPayload(
   { repo, pr },
-  { env = process.env, ghCommand = "gh" } = {},
+  { env = process.env, ghCommand = "gh", runChild = defaultRunChild } = {},
 ) {
   const { owner, name } = parseRepoSlug(repo);
   const result = await runChild(

package/scripts/github/create-pr.mjs

@@ -2,6 +2,10 @@
 import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { buildParseError, formatCliError, isDirectCliRun } from "../_core-helpers.mjs";
+import { runChild as _runChild } from "../_cli-primitives.mjs";
+import { resolveSettings, applyDevloopsBoard } from "../projects/_resolve-project.mjs";
+import { main as addQueueItemMain } from "../projects/add-queue-item.mjs";
+import { loadStateColumnMap, LOGICAL_COLUMN } from "@dev-loops/core/loop/queue-board-sync";
 const USAGE = `Usage: create-pr.mjs [gh pr create args...]
 Canonical PR-creation wrapper around \`gh pr create\`. Every PR opened through this
 tool is ALWAYS a draft and is self-assigned by default. Never call raw \`gh pr create\`.
@@ -11,6 +15,16 @@ Behavior:
   - honors an explicit \`--assignee <login>\` / \`-a <login>\` when supplied (no default injected)
   - rejects \`--ready\` before invoking \`gh\`
   - detects missing \`Closes #N\` / \`Fixes #N\` in \`--body\` or \`--body-file\` content (non-fatal stderr warning)
+  - \`--lightweight\` (consumed here in every form — bare or \`=true/1/false/0\`, last
+    occurrence wins — never forwarded to \`gh\`): when an explicit \`--body\`/
+    \`--body-file\` also carries no \`Closes #N\`/\`Fixes #N\`, the new PR is issue-less
+    lightweight and is auto-enqueued as a board PR item in the configured In Progress column
+    (reuses \`queue.projectNumber\` / \`queue.boardTitle\` from \`.devloops\`, same as the queue
+    scripts). Requires an explicit \`--repo owner/name\` (space or = form). A trailing stdout
+    line reports the outcome: \`{"board":{"enqueued":bool,...}}\`. No board configured, no
+    \`--repo\`, no explicit body source, or an enqueue error is a non-fatal no-op (noted in
+    that line; exit code unaffected). Omitting \`--lightweight\`, or a body that already
+    carries a closing keyword (tracker-backed), never calls the board.
   - forwards every other argument to \`gh pr create\` unchanged
   - preserves the underlying \`gh pr create\` stdout, stderr, and exit code
 Examples:
@@ -26,8 +40,17 @@ Exit codes:
   N  same non-zero exit code returned by \`gh pr create\``.trim();
 const parseError = buildParseError(USAGE);
 const READY_FLAG_PATTERN = /^--ready(?:$|=)/u;
+// Bare and inline-boolean forms, mirroring DRAFT_FLAG_PATTERN below: every
+// matching token is consumed (never forwarded to gh, which rejects unknown
+// flags), and the LAST occurrence decides — bare or =true/=1 enables,
+// anything else (=false, =0, ...) disables.
+const LIGHTWEIGHT_FLAG_PATTERN = /^--lightweight(?:=(.*))?$/iu;
+// Both `--repo owner/name` and `--repo=owner/name` — gh accepts either form.
+const REPO_FLAG_PATTERN = /^--repo(?:$|=)/u;
+const PR_URL_NUMBER_PATTERN = /\/pull\/(\d+)(?:\D|$)/u;
 const DRAFT_FLAG_PATTERN = /^--draft(?:=(.*))?$/iu;
-const DRAFT_TRUE_VALUE_PATTERN = /^(?:true|1)$/iu;
+// Shared inline-boolean truthiness for --draft= and --lightweight= values.
+const TRUE_FLAG_VALUE_PATTERN = /^(?:true|1)$/iu;
 // Detect both the long `--assignee`/`--assignee=<login>` forms and the `-a`
 // short flag that `gh pr create` documents, so an explicit assignee in either
 // form suppresses the `--assignee @me` default (otherwise a caller passing
@@ -56,8 +79,7 @@ async function resolveBody(args) {
   }
   return null; // unreadable → warn
 }
-async function warnMissingClosingKeyword(args) {
-  const body = await resolveBody(args);
+function warnMissingClosingKeyword(body) {
   if (body === null) return; // no --body or --body-file, skip
   if (!detectClosingKeyword(body)) {
     process.stderr.write(
@@ -66,6 +88,48 @@ async function warnMissingClosingKeyword(args) {
     );
   }
 }
+// A plain string value for a single-value flag, in both the space form
+// (`--repo owner/name`) and the inline form (`--repo=owner/name`); unlike
+// resolveBody, never reads a file. Returns null when the flag is absent.
+function getFlagValue(args, flagPattern) {
+  const idx = args.findIndex((token) => flagPattern.test(token));
+  if (idx === -1) return null;
+  const eq = args[idx].indexOf("=");
+  if (eq !== -1) return args[idx].slice(eq + 1);
+  return idx + 1 < args.length ? args[idx + 1] : null;
+}
+function parsePrNumberFromOutput(stdout) {
+  const match = PR_URL_NUMBER_PATTERN.exec(stdout ?? "");
+  return match ? Number(match[1]) : null;
+}
+// Auto-enqueue an issue-less lightweight PR as a board PR item in the configured
+// In Progress column. Reuses the same .devloops queue.projectNumber /
+// queue.boardTitle resolution and add-queue-item's idempotent add — never
+// reimplements the board API calls. Never throws: an unconfigured board, a
+// missing --repo, an unparsed PR number, or an enqueue failure are all
+// non-fatal no-ops reported in the returned shape.
+export async function enqueueIssuelessLightweightPr({ repo, prNumber, cwd, env, runChild }) {
+  if (!repo) return { enqueued: false, reason: "repo-not-specified" };
+  if (!Number.isInteger(prNumber) || prNumber < 1) return { enqueued: false, reason: "pr-number-not-parsed" };
+  const settings = resolveSettings(cwd);
+  if (!settings?.project && !settings?.title) {
+    return { enqueued: false, reason: "no-board-configured" };
+  }
+  const { columnNames, error: columnError } = loadStateColumnMap(cwd);
+  if (columnError) {
+    return { enqueued: false, reason: `config-error: ${columnError}` };
+  }
+  const args = { repo, item: prNumber };
+  applyDevloopsBoard(args, cwd);
+  args.column = columnNames[LOGICAL_COLUMN.IN_PROGRESS];
+  try {
+    const result = await addQueueItemMain(args, { env, runChild, cwd });
+    const { itemId, prNumber: itemPrNumber, status, alreadyPresent } = result.item;
+    return { enqueued: true, itemId, prNumber: itemPrNumber, status, alreadyPresent };
+  } catch (err) {
+    return { enqueued: false, reason: `enqueue-error: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
 export function buildCreatePrArgs(argv) {
   const args = [...argv];
   if (args.includes("--help") || args.includes("-h")) {
@@ -79,7 +143,7 @@ export function buildCreatePrArgs(argv) {
   }
   const draftTokens = args.filter((token) => DRAFT_FLAG_PATTERN.test(token));
   const lastDraftToken = draftTokens.length > 0 ? draftTokens.at(-1) : null;
-  const lastDraftSuppliesDraft = lastDraftToken === "--draft" || (typeof lastDraftToken === "string" && DRAFT_TRUE_VALUE_PATTERN.test(lastDraftToken.slice("--draft=".length)));
+  const lastDraftSuppliesDraft = lastDraftToken === "--draft" || (typeof lastDraftToken === "string" && TRUE_FLAG_VALUE_PATTERN.test(lastDraftToken.slice("--draft=".length)));
   const hasAssignee = args.some((token) => ASSIGNEE_FLAG_PATTERN.test(token));
   return {
     help: false,
@@ -92,26 +156,71 @@ export function buildCreatePrArgs(argv) {
     ],
   };
 }
-export function spawnCreatePr(ghArgs, { ghCommand = "gh", env = process.env } = {}) {
+// captureStdout tees gh's stdout to a buffer (still writing it straight through to
+// process.stdout, unbuffered) so the PR URL can be parsed once gh exits, without
+// changing what a caller/terminal sees. Only enabled for the issue-less lightweight
+// path; every other caller keeps the plain "inherit" byte-identical behavior.
+export function spawnCreatePr(ghArgs, { ghCommand = "gh", env = process.env } = {}, { captureStdout = false } = {}) {
   return new Promise((resolve, reject) => {
+    // `gh pr create` never reads stdin (body comes from --body/--body-file), so
+    // the captured path ignores it rather than inheriting: inheriting a
+    // never-closing stdin (e.g. an in-process test runner) would hang any child
+    // that waits for stdin to end.
     const child = spawn(ghCommand, ghArgs, {
       env,
-      stdio: "inherit",
+      stdio: captureStdout ? ["ignore", "pipe", "inherit"] : "inherit",
     });
+    let stdout = "";
+    if (captureStdout) {
+      child.stdout.on("data", (chunk) => {
+        stdout += chunk;
+        process.stdout.write(chunk);
+      });
+    }
     child.on("error", reject);
     child.on("close", (code) => {
-      resolve(typeof code === "number" ? code : 1);
+      resolve({ code: typeof code === "number" ? code : 1, stdout });
     });
   });
 }
 export async function main(argv = process.argv.slice(2), runtime = {}) {
-  const { help, ghArgs } = buildCreatePrArgs(argv);
+  // Last occurrence wins, same as the --draft handling in buildCreatePrArgs.
+  const lastLightweightToken = argv.filter((token) => LIGHTWEIGHT_FLAG_PATTERN.test(token)).at(-1) ?? null;
+  const lightweight = lastLightweightToken === "--lightweight" ||
+    (typeof lastLightweightToken === "string" && TRUE_FLAG_VALUE_PATTERN.test(lastLightweightToken.slice("--lightweight=".length)));
+  const forwardedArgv = argv.filter((token) => !LIGHTWEIGHT_FLAG_PATTERN.test(token));
+  const { help, ghArgs } = buildCreatePrArgs(forwardedArgv);
   if (help) {
     process.stdout.write(`${USAGE}\n`);
     return 0;
   }
-  await warnMissingClosingKeyword(argv);
-  return spawnCreatePr(ghArgs, runtime);
+  const body = await resolveBody(forwardedArgv);
+  warnMissingClosingKeyword(body);
+  // Issue-less lightweight: caller signals lightweight AND an explicit body
+  // source (--body/--body-file) carries no closing keyword. A tracker-backed
+  // lightweight PR (closing keyword present) never reaches the board — its
+  // issue already owns the board entry. A null body (no explicit source) is
+  // NOT classified issue-less: the body may come from elsewhere (editor,
+  // template) and could carry a closing keyword this wrapper never saw, so it
+  // fails toward not enqueuing and reports body-not-provided instead.
+  const issueLess = lightweight && body !== null && !detectClosingKeyword(body);
+  const { code, stdout } = await spawnCreatePr(ghArgs, runtime, { captureStdout: issueLess });
+  if (lightweight && code === 0 && (issueLess || body === null)) {
+    const board = issueLess
+      ? await enqueueIssuelessLightweightPr({
+          repo: getFlagValue(forwardedArgv, REPO_FLAG_PATTERN),
+          prNumber: parsePrNumberFromOutput(stdout),
+          cwd: runtime.cwd ?? process.cwd(),
+          env: runtime.env ?? process.env,
+          runChild: runtime.runChild ?? _runChild,
+        })
+      : { enqueued: false, reason: "body-not-provided" };
+    if (!board.enqueued) {
+      process.stderr.write(`[create-pr] Board note: PR not enqueued (${board.reason}).\n`);
+    }
+    process.stdout.write(`${JSON.stringify({ board })}\n`);
+  }
+  return code;
 }
 if (isDirectCliRun(import.meta.url)) {
   try {

package/scripts/github/detect-checkpoint-evidence.mjs

@@ -11,11 +11,11 @@ import {
 } from "../_core-helpers.mjs";
 import { access, readFile } from "node:fs/promises";
 import path from "node:path";
-import { parsePrNumber, requireTokenValue, runChild } from "../_cli-primitives.mjs";
+import { parsePrNumber, requireTokenValue, runChild as defaultRunChild } from "../_cli-primitives.mjs";
 import { fetchGithubReviewThreadsPayload } from "./capture-review-threads.mjs";
 import { parseRepoSlug } from "@dev-loops/core/github/repo-slug";
-import { FANOUT_PROVENANCE_MIN_REVIEWERS, GATE_FULL_LABEL, loadDevLoopConfig, resolveGateConfig, resolveLightMode, resolveRequireFanoutEvidence, resolveRequireFanoutProvenance } from "@dev-loops/core/config";
-import { FANOUT_UNAVAILABLE_MESSAGE, provenanceConsistencyError } from "@dev-loops/core/loop/gate-fanin";
+import { FANOUT_PROVENANCE_MIN_REVIEWERS, GATE_FULL_LABEL, loadDevLoopConfig, resolveGateAngleContract, resolveGateConfig, resolveLightMode, resolveRejectForeignAngles, resolveRequireFanoutEvidence, resolveRequireFanoutProvenance } from "@dev-loops/core/config";
+import { FANOUT_UNAVAILABLE_MESSAGE, checkFanoutAngleCoverage, provenanceConsistencyError } from "@dev-loops/core/loop/gate-fanin";
 import { detectMergeBaseScope, isEligibleForLightMode } from "../loop/detect-change-scope.mjs";
 import { buildLogPath } from "./write-gate-findings-log.mjs";
 import { ensureAsyncRunnerOwnership } from "../loop/_pr-runner-coordination.mjs";
@@ -148,7 +148,7 @@ export function parseDetectCheckpointEvidenceCliArgs(argv) {
   }
   return options;
 }
-async function runGhJson(args, { env, ghCommand }) {
+async function runGhJson(args, { env, ghCommand, runChild = defaultRunChild }) {
   const result = await runChild(ghCommand, args, env);
   if (result.code !== 0) {
     const detail = result.stderr.trim() || `exit code ${result.code}`;
@@ -240,6 +240,7 @@ function normalizeGateMarkerSummary(summary) {
 }
 export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, staleRunnerCheck = null, fanoutEnforcement = null) {
   const failures = [];
+  const warnings = [];
   if (!(evidence.draftGate.visible && evidence.draftGate.verdict === "clean")) {
     failures.push("missing visible clean draft_gate comment");
   }
@@ -310,6 +311,42 @@ export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, s
           );
         }
       }
+      // Angle-coverage enforcement: independent of requireFanoutProvenance.
+      // When the gate configures mandatory angles, a fanout_fanin ledger MUST
+      // record internally-consistent provenance — otherwise a shadow ledger
+      // that simply omits provenance would bypass mandatory-angle coverage.
+      // Recorded provenance is then re-validated: perAngle must cover every
+      // mandatory angle and (default) stay within the configured pool. Gates
+      // without mandatory angles keep today's behavior (absent provenance adds
+      // no failure; that stricter gap is requireFanoutProvenance's opt-in).
+      if (gate.executionMode === "fanout_fanin") {
+        const mandatoryAngles = gate.mandatoryAngles ?? [];
+        const provValid = gate.provenance != null && provenanceConsistencyError(gate.provenance) === null;
+        if (mandatoryAngles.length > 0 && !provValid) {
+          failures.push(
+            `${gate.name}: mandatory angle coverage is configured (${mandatoryAngles.join(", ")}) but the findings-log ledger records no valid fan-out provenance to verify it against; write the ledger with --provenance covering the mandatory angles; ${FANOUT_UNAVAILABLE_MESSAGE}`,
+          );
+        } else if (provValid) {
+          const { missingMandatory, foreignAngles } = checkFanoutAngleCoverage(gate.provenance.perAngle, {
+            mandatoryAngles,
+            pool: gate.anglePool ?? null,
+          });
+          if (missingMandatory.length > 0) {
+            failures.push(
+              `${gate.name}: fan-out provenance is missing mandatory angle(s): ${missingMandatory.join(", ")}; ${FANOUT_UNAVAILABLE_MESSAGE}`,
+            );
+          }
+          if (foreignAngles.length > 0) {
+            const message = `${gate.name}: fan-out provenance names angle(s) outside the configured pool: ${foreignAngles.join(", ")}`;
+            if (fanoutEnforcement.rejectForeignAngles ?? true) {
+              failures.push(`${message}; ${FANOUT_UNAVAILABLE_MESSAGE}`);
+            } else {
+              // rejectForeignAngles: false is WARNING mode, not silence.
+              warnings.push(`${message} (gates.rejectForeignAngles is false; recorded as a warning)`);
+            }
+          }
+        }
+      }
     }
   }
   if (typeof unresolvedThreadCount === "number" && unresolvedThreadCount !== 0) {
@@ -327,6 +364,8 @@ export function buildPreMergeGateCheck(evidence, unresolvedThreadCount = null, s
   return {
     ok: failures.length === 0,
     failures,
+    // Additive: only present when non-empty, preserving the existing {ok, failures} shape.
+    ...(warnings.length > 0 ? { warnings } : {}),
   };
 }
 async function ledgerExists(fullPath) {
@@ -354,14 +393,27 @@ async function ledgerExistsInAny(checkouts, ledgerPath) {
  * Read the recorded fan-out `provenance` object from a ledger across the
  * enumerated checkouts. Mirrors ledgerExistsInAny's "ANY checkout satisfies"
  * semantics: prefers the FIRST checkout whose ledger provenance actually
- * SATISFIES enforcement (internally consistent AND distinctReviewers >= floor),
- * so a below-floor or provenance-less ledger in an earlier-enumerated checkout
- * cannot SHADOW a valid one in the PR worktree (which would falsely fail closed).
- * Falls back to the first non-null provenance (for a useful diagnostic message)
- * only when NO checkout satisfies, and null only when none is present. Only
- * called when requireFanoutProvenance is enabled so the default path pays no I/O.
+ * SATISFIES the FULL active enforcement — internally consistent, meeting the
+ * distinctReviewers floor when requireFanoutProvenance is on, AND passing the
+ * gate's angle contract (mandatory-angle coverage; pool membership when
+ * foreign angles are rejected) — so a stale checkout's below-floor,
+ * provenance-less, or angle-contract-failing ledger cannot SHADOW a valid one
+ * in the PR worktree (which would falsely fail closed). Falls back to the
+ * first non-null provenance (for a useful diagnostic message) only when NO
+ * checkout satisfies, and null only when none is present. Called whenever
+ * requireFanoutProvenance is enabled OR the gate's verdict is fanout_fanin —
+ * inline verdicts never trigger this read.
  */
-async function readLedgerProvenanceInAny(checkouts, ledgerPath) {
+async function readLedgerProvenanceInAny(checkouts, ledgerPath, criteria = {}) {
+  const { requireProvenance = false, mandatoryAngles = [], anglePool = null, rejectForeignAngles = true } = criteria;
+  const satisfies = (prov) => {
+    if (provenanceConsistencyError(prov) !== null) return false;
+    if (requireProvenance && prov.distinctReviewers < FANOUT_PROVENANCE_MIN_REVIEWERS) return false;
+    const { missingMandatory, foreignAngles } = checkFanoutAngleCoverage(prov.perAngle, { mandatoryAngles, pool: anglePool });
+    if (missingMandatory.length > 0) return false;
+    if (foreignAngles.length > 0 && rejectForeignAngles) return false;
+    return true;
+  };
   let firstNonNull = null;
   for (const root of checkouts) {
     const full = path.resolve(root, ledgerPath);
@@ -369,8 +421,8 @@ async function readLedgerProvenanceInAny(checkouts, ledgerPath) {
       const parsed = JSON.parse(await readFile(full, "utf8"));
       const prov = parsed && typeof parsed === "object" ? parsed.provenance : null;
       if (prov == null) continue; // ledger present but no provenance — keep scanning.
-      if (provenanceConsistencyError(prov) === null && prov.distinctReviewers >= FANOUT_PROVENANCE_MIN_REVIEWERS) {
-        return prov; // satisfying ledger — prefer it over any earlier below-floor one.
+      if (satisfies(prov)) {
+        return prov; // satisfying ledger — prefer it over any earlier failing one.
       }
       if (firstNonNull === null) firstNonNull = prov; // remember for diagnostics.
     } catch {
@@ -413,17 +465,33 @@ export async function buildFanoutEnforcement({ repo, pr, currentHeadSha, draftGa
   // Provenance enforcement is opt-in and layered ON TOP of fan-out evidence: it
   // only takes effect while evidence enforcement (above) is active.
   const requireProvenance = resolveRequireFanoutProvenance(config);
+  // Angle-coverage enforcement (mandatory angles + pool membership) is layered
+  // independently of requireProvenance: it re-validates whatever provenance a
+  // fanout_fanin ledger actually recorded, regardless of that opt-in flag.
+  const rejectForeignAngles = resolveRejectForeignAngles(config);
   // Light-mode facts (#1174): the threshold that a re-derived merge-base scope
   // must fall under for an inline verdict to be accepted. null when lightMode is
   // disabled → no inline verdict can ever be accepted (scopeUnderThreshold stays
   // false), preserving today's rejection.
   const lightThreshold = resolveLightMode(config);
   const lightMode = lightThreshold != null;
-  const draftRequired = resolveGateConfig(config, "draft").required;
-  const preApprovalRequired = resolveGateConfig(config, "preApproval").required;
+  const draftGateConfig = resolveGateConfig(config, "draft");
+  const preApprovalGateConfig = resolveGateConfig(config, "preApproval");
+  // Shared angle-contract resolver (exclude-filtered mandatory angles +
+  // additive-aware pool) — the same contract the write paths enforce. The
+  // field names here (`mandatoryAngles`/`anglePool`) are exactly what
+  // buildPreMergeGateCheck reads off each gate entry.
+  const buildAngleFields = (gateKey) => {
+    const { mandatoryAngles, pool } = resolveGateAngleContract(config, gateKey);
+    return { mandatoryAngles, anglePool: pool };
+  };
+  const GATE_ANGLE_CONFIG = {
+    draft_gate: buildAngleFields("draft"),
+    pre_approval_gate: buildAngleFields("preApproval"),
+  };
   const gateSpecs = [
-    { name: "draft_gate", marker: draftGateMarker, required: draftRequired },
-    { name: "pre_approval_gate", marker: preApprovalGateMarker, required: preApprovalRequired },
+    { name: "draft_gate", marker: draftGateMarker, required: draftGateConfig.required },
+    { name: "pre_approval_gate", marker: preApprovalGateMarker, required: preApprovalGateConfig.required },
   ].filter((spec) => spec.required && spec.marker.visible);
   const gates = [];
   const checkouts = resolveLedgerCheckouts(cwd);
@@ -444,6 +512,13 @@ export async function buildFanoutEnforcement({ repo, pr, currentHeadSha, draftGa
       const scope = detectMergeBaseScope({ base: baseRef, head: headSha, cwd: repoRoot });
       scopeUnderThreshold = scope.ok === true && isEligibleForLightMode(scope, lightThreshold);
     }
+    // Read ledger provenance for ANY fanout_fanin gate (not just when
+    // requireProvenance is on): angle-coverage enforcement re-validates
+    // whatever provenance is recorded independently of that opt-in flag.
+    // The selection criteria mirror the full active enforcement so a stale
+    // checkout's contract-failing ledger cannot shadow a passing one.
+    const readProvenance = requireProvenance || spec.marker.executionMode === "fanout_fanin";
+    const angleFields = GATE_ANGLE_CONFIG[spec.name];
     gates.push({
       name: spec.name,
       executionMode: spec.marker.executionMode ?? null,
@@ -451,12 +526,15 @@ export async function buildFanoutEnforcement({ repo, pr, currentHeadSha, draftGa
       scopeUnderThreshold,
       ledgerPath,
       ledgerExists: await ledgerExistsInAny(checkouts, ledgerPath),
-      provenance: requireProvenance ? await readLedgerProvenanceInAny(checkouts, ledgerPath) : null,
+      provenance: readProvenance
+        ? await readLedgerProvenanceInAny(checkouts, ledgerPath, { requireProvenance, rejectForeignAngles, ...angleFields })
+        : null,
+      ...angleFields,
     });
   }
-  return { required: true, requireProvenance, lightMode, hasFullLabel, gates };
+  return { required: true, requireProvenance, rejectForeignAngles, lightMode, hasFullLabel, gates };
 }
-export async function detectCheckpointEvidence(options, { env = process.env, ghCommand = "gh", cwd = process.cwd() } = {}) {
+export async function detectCheckpointEvidence(options, { env = process.env, ghCommand = "gh", runChild = defaultRunChild, cwd = process.cwd() } = {}) {
   const runnerOwnership = await ensureAsyncRunnerOwnership({
     repo: options.repo,
     pr: options.pr,
@@ -480,8 +558,8 @@ export async function detectCheckpointEvidence(options, { env = process.env, ghC
     error.staleRunner = staleRunnerDetection;
     throw error;
   }
-  const prPayload = await runGhJson(["pr", "view", String(options.pr), "--repo", options.repo, "--json", "headRefOid"], { env, ghCommand });
-  const commentsPayload = normalizeIssueCommentsPayload(await runGhJson(["api", "--paginate", "--slurp", `repos/${options.repo}/issues/${options.pr}/comments?per_page=100`], { env, ghCommand }));
+  const prPayload = await runGhJson(["pr", "view", String(options.pr), "--repo", options.repo, "--json", "headRefOid"], { env, ghCommand, runChild });
+  const commentsPayload = normalizeIssueCommentsPayload(await runGhJson(["api", "--paginate", "--slurp", `repos/${options.repo}/issues/${options.pr}/comments?per_page=100`], { env, ghCommand, runChild }));
   const currentHeadSha = typeof prPayload?.headRefOid === "string" && prPayload.headRefOid.trim().length > 0
     ? prPayload.headRefOid.trim()
     : null;
@@ -493,7 +571,7 @@ export async function detectCheckpointEvidence(options, { env = process.env, ghC
   // as a PR review rather than an issue comment (root cause 3 from issue #692).
   let prReviews = [];
   try {
-    const reviewsRaw = await runGhJson(["api", "--paginate", "--slurp", `repos/${options.repo}/pulls/${options.pr}/reviews?per_page=100`], { env, ghCommand });
+    const reviewsRaw = await runGhJson(["api", "--paginate", "--slurp", `repos/${options.repo}/pulls/${options.pr}/reviews?per_page=100`], { env, ghCommand, runChild });
     prReviews = normalizePrReviewsPayload(reviewsRaw);
   } catch {
     // Graceful fallback: PR reviews fetch failure is non-fatal.
@@ -523,7 +601,7 @@ export async function detectCheckpointEvidence(options, { env = process.env, ghC
   );
   if (config != null && resolveRequireFanoutEvidence(config) && resolveLightMode(config) != null && anyInlineVerdict) {
     try {
-      const lightFacts = await runGhJson(["pr", "view", String(options.pr), "--repo", options.repo, "--json", "baseRefOid,labels"], { env, ghCommand });
+      const lightFacts = await runGhJson(["pr", "view", String(options.pr), "--repo", options.repo, "--json", "baseRefOid,labels"], { env, ghCommand, runChild });
       baseRef = typeof lightFacts?.baseRefOid === "string" && lightFacts.baseRefOid.trim().length > 0
         ? lightFacts.baseRefOid.trim()
         : null;
@@ -614,6 +692,13 @@ async function main() {
       process.exitCode = 1;
       return;
     }
+    // Warnings (e.g. foreign angles under gates.rejectForeignAngles: false) do
+    // not fail the check but must not pass silently. Suppressed under --silent.
+    if (Array.isArray(preMergeGateCheck.warnings) && !options.silent) {
+      for (const warning of preMergeGateCheck.warnings) {
+        process.stderr.write(`WARNING: ${warning}\n`);
+      }
+    }
     process.exitCode = emitResult(output, { jq: options.jq, silent: options.silent });
   } catch (error) {
     if (error && typeof error === "object" && "staleRunner" in error && error.staleRunner) {