devflow-kit 2.5.0 → 3.0.0

package/src/assets/scripts/resolve-evidence-policy.cjs

@@ -3,14 +3,17 @@
 //
 // Resolves EVIDENCE_POLICY for a repository and prints it on ONE line together
 // with the three mechanism inputs that operations receive. Installed as a
-// top-level sibling of hud.sh and redact-secrets.cjs under ~/.devflow/scripts/.
+// top-level sibling of hud.sh and redact-secrets.cjs under ~/.devflow/scripts/,
+// with its parser beside it in lib/project-config.cjs.
 //
 // Usage: node resolve-evidence-policy.cjs [<dir>]      (<dir> defaults to cwd)
 //
 // The policy is plumbing, decided once by the caller: this script prints it plus
 // the mechanism inputs, and operations only ever see the inputs. It WRITES NOTHING
-// — no file, no git ref, no remote state — so `.devflow/policy.json` stays a
-// team-owned file that only the team commits.
+// — no file, no git ref, no remote state — so `.devflow/project.json` stays a
+// team-owned file that only the team commits (applies ADR-024). A committed
+// `.devflow/policy.json` is detected by presence and never parsed
+// (D-POLICY-JSON-RETIRED).
 //
 // stdout is exactly one line plus "\n", or empty (D-POLICY-LINE):
 //   EVIDENCE_POLICY=<required|standard> SOURCE=<file|worktree|default|invalid|error>
@@ -38,8 +41,8 @@
 //     exitCode assignment, so nothing is truncated and no cleanup is skipped
 //   - every subprocess is spawned with an argv array (never a shell), stdin
 //     ignored, a timeout and a maxBuffer; every loop has a fixed bound
-//   - a policy file that is not a regular file is never opened, and one over
-//     MAX_POLICY_BYTES is never read
+//   - a project.json that is not a regular file is never opened, and one over
+//     MAX_CONFIG_BYTES is never read; a working-tree policy.json is never opened
 //   - no index-refreshing git command runs (no `status`, no `diff`), so a
 //     repository's configured fsmonitor hook never fires; no fetch, no set-head
 
@@ -47,8 +50,11 @@
 
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
 const childProcess = require('child_process');
+const projectConfig = require('./lib/project-config.cjs');
+
+/** Largest project.json read, in bytes — the shared parser's bound. */
+const { MAX_CONFIG_BYTES } = projectConfig;
 
 // ---------------------------------------------------------------------------
 // Closed vocabularies
@@ -67,7 +73,8 @@ const SOURCES = Object.freeze(/** @type {Source[]} */ (['file', 'worktree', 'def
 /**
  * Every WARN token, in the order the line prints them.
  *   remote-unavailable    the default branch's file could not be consulted
- *   invalid-file          a folded policy file (remote, worktree or tracking copy) was invalid
+ *   invalid-file          a folded source (remote, worktree or tracking copy) was invalid —
+ *                         its project.json evidence, or the retired policy.json's presence
  *   raised-by-compliance  compliance raised a `standard` file or worktree policy
  *   pr-changes-policy     HEAD or the worktree differs from the default branch (advisory)
  */
@@ -116,19 +123,11 @@ const MECHANISM_INPUTS = Object.freeze({
 /** The mechanism-input keys, in line order. */
 const INPUT_KEYS = Object.freeze(['ISSUE_REQUIRED', 'APPLY_CONVENTIONS', 'REQUIRE_NON_AUTHOR_APPROVAL']);
 
-/** Largest policy file read, in bytes. A policy is two keys; nothing valid approaches this. */
-const MAX_POLICY_BYTES = 4096;
-
-/** Largest manifest read, in bytes. */
-const MAX_MANIFEST_BYTES = 1048576;
-
 /**
- * A branch name this script will put into argv or onto stdout: an alphanumeric
- * first character (so never an option and never a hidden path), then at most 254
- * of `[A-Za-z0-9._/-]`, and never `..`. The lookahead is bounded by the same
- * class, so the scan is linear (no unbounded `.*`).
+ * A branch name this script will put into argv or onto stdout — the shared gate
+ * (lib/project-config.cjs), so the settings resolver reads the same branch names.
  */
-const SAFE_REF_RE = /^(?![A-Za-z0-9._/-]{0,254}\.\.)[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/;
+const { SAFE_REF_RE } = projectConfig;
 
 /**
  * D-POLICY-LINE: the exported output grammar — anchored, closed alternations
@@ -153,14 +152,17 @@ const FAIL_CLOSED_LINE =
 const GH_TIMEOUT_MS = 10000;
 const GIT_REMOTE_TIMEOUT_MS = 10000;
 const GIT_LOCAL_TIMEOUT_MS = 5000;
-/** gh answers and blob reads: generous for a 4 KiB policy, and an overflow is ENOBUFS ⇒ invalid. */
+/** gh answers and blob reads: generous for a 4 KiB project.json, and an overflow is ENOBUFS ⇒ invalid. */
 const BLOB_MAX_BUFFER = 65536;
 /** rev-parse and ls-remote print one short line each. */
 const LINE_MAX_BUFFER = 4096;
 
-/** The repository-relative path of the policy file, in git and API spelling. */
+/** The repository-relative path of the retired policy file, in git and API spelling (D-POLICY-JSON-RETIRED). */
 const POLICY_REL = '.devflow/policy.json';
 
+/** The repository-relative path of the team config file, in git and API spelling. */
+const PROJECT_REL = '.devflow/project.json';
+
 /** `git ls-remote --symref origin HEAD`, first line. Bounded class, no backtracking. */
 const LS_REMOTE_SYMREF_RE = /^ref: refs\/heads\/([^\t\n]{1,255})\tHEAD$/;
 
@@ -241,76 +243,6 @@ function parseArgs(argv) {
   return { kind: 'resolve', dir: positionals.length === 1 ? positionals[0] : process.cwd() };
 }
 
-// ---------------------------------------------------------------------------
-// parsePolicyBytes (D-POLICY-STRICT-SCHEMA)
-// ---------------------------------------------------------------------------
-
-/**
- * D-POLICY-STRICT-SCHEMA: the grammar gate a policy file must pass BEFORE
- * JSON.parse sees it. Exactly two members, each key `version` or
- * `evidencePolicy`, each value `1`, `"required"` or `"standard"`, and JSON
- * whitespace only — `[ \t\r\n]`, never `\s`, which admits U+FEFF and U+00A0.
- * Each `*` run is separated by a literal, so matching is linear. What it keeps
- * out never reaches the parser: `__proto__`/`constructor` and every other key,
- * `\u`-escaped keys or values, `1.0`, `"1"`, arrays, `null`, trailing bytes.
- */
-const POLICY_GRAMMAR_RE =
-  /^[ \t\r\n]*\{[ \t\r\n]*"(?:version|evidencePolicy)"[ \t\r\n]*:[ \t\r\n]*(?:1|"required"|"standard")[ \t\r\n]*,[ \t\r\n]*"(?:version|evidencePolicy)"[ \t\r\n]*:[ \t\r\n]*(?:1|"required"|"standard")[ \t\r\n]*\}[ \t\r\n]*$/;
-
-/**
- * Classify policy-file bytes. `null`/`undefined` is "no file" (absent); everything
- * else is valid or invalid, never absent — an empty committed file is invalid.
- *
- * The byte checks run before decoding (size, then a UTF-8 BOM, which is invalid
- * rather than skipped), decoding is fatal on a malformed sequence, and after the
- * grammar gate the parsed object must hold exactly the own keys
- * {version, evidencePolicy} with version === 1. A duplicate key passes the
- * grammar but collapses in the parse, so the key-set check refuses it.
- *
- * @param {Uint8Array | null | undefined} buf
- * @returns {ParsedPolicy}
- */
-function parsePolicyBytes(buf) {
-  if (buf === null || buf === undefined) return ABSENT;
-  if (!(buf instanceof Uint8Array)) return INVALID;
-  if (buf.length > MAX_POLICY_BYTES) return INVALID;
-  if (buf.length >= 3 && buf[0] === 0xef && buf[1] === 0xbb && buf[2] === 0xbf) return INVALID;
-
-  let text;
-  try {
-    // TextDecoder would silently strip a leading BOM; the byte check above is
-    // what makes one invalid.
-    text = new TextDecoder('utf-8', { fatal: true }).decode(buf);
-  } catch (_) {
-    return INVALID;
-  }
-  if (!POLICY_GRAMMAR_RE.test(text)) return INVALID;
-
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (_) {
-    return INVALID;
-  }
-  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return INVALID;
-  const keys = Object.keys(parsed);
-  if (keys.length !== 2 || !keys.includes('version') || !keys.includes('evidencePolicy')) return INVALID;
-  if (parsed.version !== 1) return INVALID;
-  if (!POLICIES.includes(parsed.evidencePolicy)) return INVALID;
-  return Object.freeze({ kind: 'valid', policy: parsed.evidencePolicy });
-}
-
-/**
- * The canonical bytes of a policy file — what the CLI suggests a team commit.
- *
- * @param {unknown} policy
- * @returns {string | null}  `{"version":1,"evidencePolicy":"<p>"}\n`, or null outside POLICIES
- */
-function serializePolicy(policy) {
-  if (!POLICIES.includes(/** @type {Policy} */ (policy))) return null;
-  return JSON.stringify({ version: 1, evidencePolicy: policy }) + '\n';
-}
-
 // ---------------------------------------------------------------------------
 // Compliance default
 // ---------------------------------------------------------------------------
@@ -340,117 +272,148 @@ function complianceDefault(rawFeatureValue) {
 // Bounded file reads
 // ---------------------------------------------------------------------------
 
+/** Bounded, never-writing file read — the shared one (lib/project-config.cjs). */
+const readBoundedRegularFile = projectConfig.readBoundedRegularFile;
+
 /**
- * Read a regular file of at most `maxBytes`, or say why not.
+ * D-POLICY-JSON-RETIRED: `.devflow/policy.json` is never parsed. At a source whose
+ * project.json does not decide the evidence (absent, or present without an
+ * `evidence` key), an existing policy.json makes that source `invalid` — whatever
+ * its bytes say, `standard` and unreadable alike — so the repository resolves
+ * `required` with `invalid-file` until the team states its value as `evidence` in
+ * project.json. With neither file the source is absent. Presence is the whole
+ * signal, and each source probes it with the call it already makes:
+ *   R  the default branch's contents call — exit 0 or an overflow is present, a
+ *      404 absent, anything else the remote unavailable (remoteSource)
+ *   T/H  `git cat-file blob` — exit 0 present, an answered non-zero exit absent,
+ *      an unanswered call invalid (catFilePolicyPresence)
+ *   W  an lstat that never opens the file — ENOENT or ENOTDIR absent, anything
+ *      else present, a symlink or FIFO included (worktreePolicyPresence)
+ * The bytes a call returns are discarded unread, so no value in the file can
+ * lower the policy or reach stdout.
  *
- * The stat runs first and decides without opening: a non-regular file (with
- * `followSymlinks` false this includes a symlink; always a directory, FIFO,
- * socket or device) is refused unopened, and an oversize one unread. The open
- * then adds O_NONBLOCK (a FIFO swapped in after the stat cannot block) and, when
- * not following, O_NOFOLLOW (a symlink swapped in fails the open); the fstat
- * re-checks the opened object. The read loop is bounded by the byte count.
+ * @param {boolean} present
+ * @returns {ParsedPolicy}
+ */
+function retiredPolicyReading(present) {
+  return present ? INVALID : ABSENT;
+}
+
+/**
+ * W — whether the working tree holds a policy.json. lstat only: the file is never
+ * opened, so a FIFO cannot block and a symlink is never followed. An lstat that
+ * fails for any reason but "no such path" cannot prove absence, so it reads as
+ * present (fail closed).
  *
- * @param {string} filePath
- * @param {number} maxBytes
- * @param {boolean} followSymlinks
- * @returns {{ kind: 'absent' } | { kind: 'refused' } | { kind: 'ok', bytes: Buffer }}
+ * @param {string} root
+ * @returns {ParsedPolicy}
  */
-function readBoundedRegularFile(filePath, maxBytes, followSymlinks) {
-  let st;
+function worktreePolicyPresence(root) {
   try {
-    st = followSymlinks ? fs.statSync(filePath) : fs.lstatSync(filePath);
+    fs.lstatSync(path.join(root, '.devflow', 'policy.json'));
+    return retiredPolicyReading(true);
   } catch (/** @type {any} */ err) {
-    return err && (err.code === 'ENOENT' || err.code === 'ENOTDIR') ? { kind: 'absent' } : { kind: 'refused' };
+    return retiredPolicyReading(!(err && (err.code === 'ENOENT' || err.code === 'ENOTDIR')));
   }
-  if (!st.isFile() || st.size > maxBytes) return { kind: 'refused' };
+}
 
-  const flags = fs.constants.O_RDONLY
-    | (fs.constants.O_NONBLOCK || 0)
-    | (followSymlinks ? 0 : (fs.constants.O_NOFOLLOW || 0));
-  let fd;
-  try {
-    fd = fs.openSync(filePath, flags);
-  } catch (_) {
-    return { kind: 'refused' };
-  }
-  try {
-    const fst = fs.fstatSync(fd);
-    if (!fst.isFile() || fst.size > maxBytes) return { kind: 'refused' };
-    // One byte past the stat'd size: a file that grew between the stat and the
-    // read is refused rather than truncated into something that parses.
-    const buf = Buffer.alloc(fst.size + 1);
-    let total = 0;
-    for (let i = 0; i < buf.length; i++) {
-      const n = fs.readSync(fd, buf, total, buf.length - total, null);
-      if (n === 0) break;
-      total += n;
-      if (total === buf.length) break;
-    }
-    if (total > fst.size) return { kind: 'refused' };
-    return { kind: 'ok', bytes: buf.subarray(0, total) };
-  } catch (_) {
-    return { kind: 'refused' };
-  } finally {
-    try { fs.closeSync(fd); } catch (_) { /* the read already decided; a close error changes nothing */ }
+// ---------------------------------------------------------------------------
+// Source readings (D-POLICY-SOURCE-PRECEDENCE, D-COMPLIANCE-REPO-FLOOR)
+// ---------------------------------------------------------------------------
+
+/**
+ * @typedef {{ evidence: ParsedPolicy, compliance: boolean }} SourceReading
+ *   What one source (R, T, H or W) says: its evidence policy, and whether its
+ *   project.json declares repository compliance.
+ *
+ * @typedef {{ evidence: ParsedPolicy | null, compliance: boolean }} ProjectReading
+ *   `evidence` null ⇒ project.json does not decide it, so the presence of the
+ *   retired policy file at the same source does (D-POLICY-JSON-RETIRED).
+ *
+ * @typedef {{ kind: 'absent' } | { kind: 'invalid' } | { kind: 'parsed', evidence: { kind: string, value?: unknown }, compliance: { kind: string } }} ProjectConfigView
+ *   The part of lib/project-config.cjs ProjectConfig this script reads.
+ */
+
+/** @type {ProjectConfigView} */
+const PROJECT_ABSENT = Object.freeze({ kind: 'absent' });
+/** @type {ProjectConfigView} */
+const PROJECT_INVALID = Object.freeze({ kind: 'invalid' });
+
+/**
+ * D-POLICY-SOURCE-PRECEDENCE: at every source, the `evidence` key of
+ * `project.json` is the one authority on the evidence policy. A valid value
+ * decides it, and a present-but-malformed or duplicated `evidence` decides
+ * `invalid` (⇒ required); a project.json that is not a JSON object at all is
+ * invalid outright. Only where project.json is absent, or present without an
+ * `evidence` key, does the same source's retired `policy.json` count — by
+ * presence alone (D-POLICY-JSON-RETIRED). The precedence is per source, so each
+ * source says ONE thing and foldPolicy folds them unchanged.
+ *
+ * D-COMPLIANCE-REPO-FLOOR: a `compliance` key in project.json at R, T or W — any
+ * value, an empty list and a malformed one included — makes the repository's
+ * compliance default `required`, folded with the machine's as
+ * stricter(C_machine, C_repo). A machine with compliance on at zero frameworks is
+ * already `required`, and a repository that declares compliance is held to the
+ * same floor. A project.json that cannot be read counts as declaring it (fail
+ * closed).
+ *
+ * @param {ProjectConfigView} project
+ * @returns {ProjectReading}
+ */
+function projectReading(project) {
+  if (project.kind === 'absent') return { evidence: null, compliance: false };
+  if (project.kind === 'invalid') return { evidence: INVALID, compliance: true };
+  const compliance = project.compliance.kind !== 'absent';
+  const evidence = project.evidence;
+  if (evidence.kind === 'valid' && POLICIES.includes(/** @type {Policy} */ (evidence.value))) {
+    return { evidence: Object.freeze({ kind: 'valid', policy: /** @type {Policy} */ (evidence.value) }), compliance };
   }
+  if (evidence.kind === 'absent') return { evidence: null, compliance };
+  return { evidence: INVALID, compliance };
 }
 
 /**
- * W — the working tree's policy file. lstat-refused, never followed: a symlink,
- * directory, FIFO or device is invalid unopened, and an oversize file invalid
- * unread.
+ * Complete a project reading with the retired policy file's presence when
+ * project.json did not decide the evidence (D-POLICY-JSON-RETIRED).
  *
- * @param {string} root
- * @returns {ParsedPolicy}
+ * @param {ProjectReading} reading
+ * @param {() => ParsedPolicy} probePolicy  called only when needed
+ * @returns {SourceReading}
  */
-function readWorktreePolicy(root) {
-  const read = readBoundedRegularFile(path.join(root, '.devflow', 'policy.json'), MAX_POLICY_BYTES, false);
-  if (read.kind === 'absent') return ABSENT;
-  if (read.kind === 'refused') return INVALID;
-  return parsePolicyBytes(read.bytes);
+function withRetiredPolicy(reading, probePolicy) {
+  return { evidence: reading.evidence === null ? probePolicy() : reading.evidence, compliance: reading.compliance };
 }
 
 /**
- * The devflow directory: DEVFLOW_DIR when it is absolute, else ~/.devflow, else
- * null (a home directory that is not absolute would resolve against cwd).
+ * W — the working tree's project.json, then (only when it has no `evidence`)
+ * whether a policy.json is there. project.json is lstat-refused, never followed:
+ * a symlink, directory, FIFO or device is invalid unopened, and an oversize file
+ * invalid unread. policy.json is never opened at all.
  *
- * @returns {string | null}
+ * @param {string} root
+ * @returns {SourceReading}
  */
-function devflowDir() {
-  const fromEnv = process.env.DEVFLOW_DIR;
-  if (typeof fromEnv === 'string' && fromEnv !== '' && path.isAbsolute(fromEnv)) return fromEnv;
-  let home;
-  try {
-    home = os.homedir();
-  } catch (_) {
-    // No HOME and no passwd entry: there is no manifest to read, which is not an error.
-    return null;
-  }
-  return typeof home === 'string' && path.isAbsolute(home) ? path.join(home, '.devflow') : null;
+function readWorktreeSource(root) {
+  const read = readBoundedRegularFile(path.join(root, '.devflow', 'project.json'), MAX_CONFIG_BYTES, false);
+  const project = read.kind === 'ok' ? projectConfig.parseProjectBytes(read.bytes)
+    : read.kind === 'absent' ? PROJECT_ABSENT : PROJECT_INVALID;
+  return withRetiredPolicy(projectReading(project), () => worktreePolicyPresence(root));
 }
 
 /**
- * The raw `features.compliance` value from the manifest, or undefined. Read
- * directly — never through the CLI's manifest reader, which heal-writes — as a
- * regular file of at most 1 MiB. Anything unreadable or malformed is "no state",
- * which complianceDefault maps to disabled; since C only ever raises, a missing C
- * can never lower the result below the governing file.
+ * The raw `features.compliance` value from the machine manifest, or undefined.
+ * The manifest is read by the shared reader (lib/project-config.cjs
+ * readMachineManifest) — never through the CLI's manifest reader, which
+ * heal-writes. Anything unreadable or malformed is "no state", which
+ * complianceDefault maps to disabled; since C only ever raises, a missing C can
+ * never lower the result below the governing file.
  *
  * @returns {unknown}
  */
 function readManifestCompliance() {
-  const dir = devflowDir();
-  if (dir === null) return undefined;
-  const read = readBoundedRegularFile(path.join(dir, 'manifest.json'), MAX_MANIFEST_BYTES, true);
-  if (read.kind !== 'ok') return undefined;
-  let parsed;
-  try {
-    parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(read.bytes));
-  } catch (_) {
-    return undefined;
-  }
+  const parsed = projectConfig.readMachineManifest();
   if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined;
-  const features = parsed.features;
+  const features = /** @type {any} */ (parsed).features;
   if (features === null || typeof features !== 'object' || Array.isArray(features)) return undefined;
   return Object.prototype.hasOwnProperty.call(features, 'compliance') ? features.compliance : undefined;
 }
@@ -565,15 +528,20 @@ function probeDefaultBranch(ctx, root) {
 }
 
 /**
- * Step 3: R, the default branch's policy file — or null when the remote turned
- * out to be unavailable after all.
+ * @typedef {{ kind: 'bytes', bytes: Buffer } | { kind: 'absent' } | { kind: 'overflow' }} RemoteFile
+ */
+
+/**
+ * Step 3: one file on the default branch — or null when the remote turned out to
+ * be unavailable after all.
  *
  * `--method GET` is mandatory: gh sends POST whenever a field is added. stdout is
  * file content ONLY on exit 0 — a 404 prints gh's JSON error body on stdout, so
  * it is classified from stderr and the exit code and its stdout is never parsed.
- *   ENOBUFS                              ⇒ invalid (never unavailable, or a huge
- *                                          file would hand control to the worktree)
- *   exit 0                               ⇒ parse the bytes
+ *   ENOBUFS                              ⇒ overflow — invalid, never unavailable,
+ *                                          or a huge file would hand control to
+ *                                          the worktree
+ *   exit 0                               ⇒ the bytes
  *   exit ≠ 0 and stderr has `(HTTP 404)` ⇒ absent — the probe already succeeded,
  *                                          so 404 means "no file", not "no access"
  *   anything else (403/429, 5xx, timeout, spawn error) ⇒ unavailable
@@ -581,19 +549,42 @@ function probeDefaultBranch(ctx, root) {
  * @param {CallContext} ctx
  * @param {string} root
  * @param {string} ref
- * @returns {ParsedPolicy | null}
+ * @param {string} rel  PROJECT_REL or POLICY_REL — a constant, never input
+ * @returns {RemoteFile | null}
  */
-function fetchRemotePolicy(ctx, root, ref) {
+function fetchRemoteFile(ctx, root, ref, rel) {
   const r = runCall(ctx, 'gh', [
-    'api', '--method', 'GET', 'repos/{owner}/{repo}/contents/' + POLICY_REL,
+    'api', '--method', 'GET', 'repos/{owner}/{repo}/contents/' + rel,
     '-f', 'ref=' + ref, '-H', 'Accept: application/vnd.github.raw+json',
   ], root, GH_TIMEOUT_MS, BLOB_MAX_BUFFER);
-  if (r.errorCode === 'ENOBUFS') return INVALID;
-  if (r.ok) return parsePolicyBytes(r.stdout);
-  if (r.errorCode === null && r.status !== null && r.status !== 0 && r.stderr.includes('(HTTP 404)')) return ABSENT;
+  if (r.errorCode === 'ENOBUFS') return { kind: 'overflow' };
+  if (r.ok) return { kind: 'bytes', bytes: r.stdout };
+  if (r.errorCode === null && r.status !== null && r.status !== 0 && r.stderr.includes('(HTTP 404)')) return { kind: 'absent' };
   return null;
 }
 
+/**
+ * R — the default branch's project.json, then (only when it is a 404 or has no
+ * `evidence`) whether its policy.json exists — the contents call's bytes are
+ * discarded unread (D-POLICY-JSON-RETIRED). Null when either call finds the
+ * remote unavailable: a half-read default branch is not a default branch.
+ *
+ * @param {CallContext} ctx
+ * @param {string} root
+ * @param {string} ref
+ * @returns {SourceReading | null}
+ */
+function remoteSource(ctx, root, ref) {
+  const projectFile = fetchRemoteFile(ctx, root, ref, PROJECT_REL);
+  if (projectFile === null) return null;
+  const reading = projectReading(projectFile.kind === 'bytes' ? projectConfig.parseProjectBytes(projectFile.bytes)
+    : projectFile.kind === 'absent' ? PROJECT_ABSENT : PROJECT_INVALID);
+  if (reading.evidence !== null) return { evidence: reading.evidence, compliance: reading.compliance };
+  const policyFile = fetchRemoteFile(ctx, root, ref, POLICY_REL);
+  if (policyFile === null) return null;
+  return withRetiredPolicy(reading, () => retiredPolicyReading(policyFile.kind !== 'absent'));
+}
+
 /**
  * Step 5 (offline, D unknown): the default branch from `ls-remote --symref`.
  * Only line 1 is read, and its capture must still pass SAFE_REF_RE.
@@ -612,27 +603,94 @@ function lsRemoteDefaultBranch(ctx, root) {
 }
 
 /**
- * Steps 4 and 7: a policy blob at a revision (HEAD, or the tracking ref).
- * Exit 0 ⇒ parse; an answered non-zero exit (the path does not exist there, an
- * unborn HEAD) ⇒ absent; an unanswered call (ENOBUFS included) ⇒ invalid — never
- * absent, or a git that timed out would silently drop the default branch's copy
- * from the fold.
+ * @typedef {{ kind: 'ref', ref: string } | { kind: 'none' } | { kind: 'unreadable' }} OriginHead
+ */
+
+/**
+ * Step 5b (offline, D still unknown after ls-remote) — D-OFFLINE-ORIGIN-HEAD:
+ * the default branch this clone last recorded for origin, read LOCALLY with
+ * `git symbolic-ref --quiet refs/remotes/origin/HEAD` (no network, no index
+ * refresh). With D unnamed an unreachable origin leaves the worktree's own file
+ * governing, so a branch that sets `evidence:"standard"` would resolve standard
+ * while main says required; naming D here lets trackingSource fold main's
+ * tracking copy in, so the branch cannot lower it.
+ *   ref         exit 0 with one `refs/remotes/origin/<SAFE_REF_RE>` line
+ *   none        an answered non-zero exit: origin/HEAD is not recorded — the
+ *               residual case, where the worktree file governs with
+ *               WARN=remote-unavailable
+ *   unreadable  git did not answer, or origin/HEAD exists but its answer names
+ *               no safe branch (another remote, a hostile or unparseable name).
+ *               Either is a failure, never the residual case: gatherFacts reads
+ *               it as an invalid base, which resolves required (avoids PF-075).
+ *               resolve-settings' defaultBranchCompliance fails the same answer
+ *               closed, to `generic`.
+ *
+ * @param {CallContext} ctx
+ * @param {string} root
+ * @returns {OriginHead}
+ */
+function localOriginHead(ctx, root) {
+  const r = runCall(ctx, 'git', ['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD'], root,
+    GIT_LOCAL_TIMEOUT_MS, LINE_MAX_BUFFER);
+  if (!answered(r)) return { kind: 'unreadable' };
+  if (!r.ok) return { kind: 'none' };
+  const ref = projectConfig.parseOriginHeadRef(r.stdout.toString('utf8'));
+  return ref === null ? { kind: 'unreadable' } : { kind: 'ref', ref };
+}
+
+/**
+ * Steps 4 and 7: one blob at a revision (HEAD, or the tracking ref).
+ * Exit 0 ⇒ the bytes; an answered non-zero exit (the path does not exist there,
+ * an unborn HEAD) ⇒ absent; an unanswered call (ENOBUFS included) ⇒ unanswered,
+ * which every caller reads as invalid — never absent, or a git that timed out
+ * would silently drop the default branch's copy from the fold.
  *
  * @param {CallContext} ctx
  * @param {string} root
  * @param {string} revision
- * @returns {ParsedPolicy}
+ * @param {string} rel  PROJECT_REL or POLICY_REL — a constant, never input
+ * @returns {{ kind: 'bytes', bytes: Buffer } | { kind: 'absent' } | { kind: 'unanswered' }}
  */
-function catFilePolicy(ctx, root, revision) {
-  const r = runCall(ctx, 'git', ['cat-file', 'blob', revision + ':' + POLICY_REL], root,
+function catFileBlob(ctx, root, revision, rel) {
+  const r = runCall(ctx, 'git', ['cat-file', 'blob', revision + ':' + rel], root,
     GIT_LOCAL_TIMEOUT_MS, BLOB_MAX_BUFFER);
-  if (r.ok) return parsePolicyBytes(r.stdout);
-  return answered(r) ? ABSENT : INVALID;
+  if (r.ok) return { kind: 'bytes', bytes: r.stdout };
+  return answered(r) ? { kind: 'absent' } : { kind: 'unanswered' };
+}
+
+/**
+ * Whether a revision holds the retired policy blob (D-POLICY-JSON-RETIRED): its
+ * bytes are discarded unread, and an unanswered read cannot prove absence, so it
+ * reads as present.
+ *
+ * @param {CallContext} ctx
+ * @param {string} root
+ * @param {string} revision
+ * @returns {ParsedPolicy}
+ */
+function catFilePolicyPresence(ctx, root, revision) {
+  return retiredPolicyReading(catFileBlob(ctx, root, revision, POLICY_REL).kind !== 'absent');
+}
+
+/**
+ * T or H: a revision's project.json, then (only when it is absent or has no
+ * `evidence`) whether its policy.json exists.
+ *
+ * @param {CallContext} ctx
+ * @param {string} root
+ * @param {string} revision
+ * @returns {SourceReading}
+ */
+function revisionSource(ctx, root, revision) {
+  const blob = catFileBlob(ctx, root, revision, PROJECT_REL);
+  const project = blob.kind === 'bytes' ? projectConfig.parseProjectBytes(blob.bytes)
+    : blob.kind === 'absent' ? PROJECT_ABSENT : PROJECT_INVALID;
+  return withRetiredPolicy(projectReading(project), () => catFilePolicyPresence(ctx, root, revision));
 }
 
 /**
  * Steps 6 and 7 (offline, D known): T, the local tracking copy of the default
- * branch's file. The ref check decides whether T can stand for the default branch
+ * branch's files. The ref check decides whether T can stand for the default branch
  * at all — a ref git ANSWERS is missing is "B unknown" (null), which a failed blob
  * read could not tell apart from "file absent". A ref check git does not answer is
  * not knowing, so T is invalid (it raises) rather than unknown (it would not).
@@ -640,14 +698,14 @@ function catFilePolicy(ctx, root, revision) {
  * @param {CallContext} ctx
  * @param {string} root
  * @param {string} ref
- * @returns {ParsedPolicy | null}
+ * @returns {SourceReading | null}
  */
-function trackingPolicy(ctx, root, ref) {
+function trackingSource(ctx, root, ref) {
   const trackingRef = 'refs/remotes/origin/' + ref;
   const r = runCall(ctx, 'git', ['rev-parse', '--verify', '--quiet', trackingRef], root,
     GIT_LOCAL_TIMEOUT_MS, LINE_MAX_BUFFER);
-  if (r.ok) return catFilePolicy(ctx, root, trackingRef);
-  return answered(r) ? null : INVALID;
+  if (r.ok) return revisionSource(ctx, root, trackingRef);
+  return answered(r) ? null : { evidence: INVALID, compliance: false };
 }
 
 // ---------------------------------------------------------------------------
@@ -664,27 +722,35 @@ function trackingPolicy(ctx, root, ref) {
  *   head: ParsedPolicy | null,
  *   compliance: Policy,
  * }} Facts
- *   remote   R — set iff reachable
- *   tracking T — set iff offline and refs/remotes/origin/<D> exists (or git could
- *            not answer whether it does — then invalid)
- *   head     H — set iff B (R online, T offline) is known
+ *   remote     R — set iff reachable
+ *   tracking   T — set iff offline and refs/remotes/origin/<D> exists (or git
+ *              could not answer whether it does, or origin/HEAD is unreadable —
+ *              then invalid)
+ *   head       H — set iff B (R online, T offline) is known
+ *   compliance stricter(C_machine, C_repo) — D-COMPLIANCE-REPO-FLOOR
  */
 
 /**
- * Run the fixed call sequence. The only calls ever made, in order:
- *   git rev-parse --show-toplevel                         (cwd = <dir>)
+ * Run the fixed call sequence (D-POLICY-PROBE). The only calls ever made, in order:
+ *   git rev-parse --show-toplevel                           (cwd = <dir>)
  *   gh api repos/{owner}/{repo} --jq .default_branch
- *   gh api --method GET …/contents/.devflow/policy.json   (only if reachable)
- *   git ls-remote --symref origin HEAD                    (offline, D unknown)
- *   git rev-parse --verify --quiet refs/remotes/origin/D  (offline, D known)
- *   git cat-file blob refs/remotes/origin/D:…             (that ref exists)
- *   git cat-file blob HEAD:…                              (B known)
+ *   gh api --method GET …/contents/.devflow/project.json    (the probe named D)
+ *   gh api --method GET …/contents/.devflow/policy.json     (… and project.json is
+ *                                                            a 404 or has no evidence;
+ *                                                            presence only)
+ *   git ls-remote --symref origin HEAD                      (offline, D unknown)
+ *   git symbolic-ref --quiet refs/remotes/origin/HEAD       (… and ls-remote named none)
+ *   git rev-parse --verify --quiet refs/remotes/origin/D    (offline, D known)
+ *   git cat-file blob refs/remotes/origin/D:…/project.json  (that ref exists)
+ *   git cat-file blob refs/remotes/origin/D:…/policy.json   (… no evidence there; presence)
+ *   git cat-file blob HEAD:…/project.json                   (B known)
+ *   git cat-file blob HEAD:…/policy.json                    (… no evidence there; presence)
  *
  * Returns null when git cannot say whether <dir> is in a repository at all (see
  * gitToplevel): nothing below can be trusted then, and resolve() fails closed.
  *
  * @param {string} dir
- * @param {Policy} compliance
+ * @param {Policy} compliance  C_machine
  * @param {ExecFn} exec
  * @returns {Facts | null}
  */
@@ -702,20 +768,37 @@ function gatherFacts(dir, compliance, exec) {
   }
   const root = toplevel.root;
 
-  const worktree = readWorktreePolicy(root);
+  const worktree = readWorktreeSource(root);
   let ref = probeDefaultBranch(ctx, root);
-  const remote = ref === null ? null : fetchRemotePolicy(ctx, root, ref);
+  const remote = ref === null ? null : remoteSource(ctx, root, ref);
   const reachable = remote !== null;
 
+  /** @type {SourceReading | null} */
   let tracking = null;
   if (!reachable) {
     if (ref === null) ref = lsRemoteDefaultBranch(ctx, root);
-    if (ref !== null) tracking = trackingPolicy(ctx, root, ref);
+    if (ref === null) {
+      const originHead = localOriginHead(ctx, root);
+      if (originHead.kind === 'ref') ref = originHead.ref;
+      if (originHead.kind === 'unreadable') tracking = { evidence: INVALID, compliance: false };
+    }
+    if (ref !== null) tracking = trackingSource(ctx, root, ref);
   }
 
   const baseKnown = reachable || tracking !== null;
-  const head = baseKnown ? catFilePolicy(ctx, root, 'HEAD') : null;
-  return { reachable, ref, remote, worktree, tracking, head, compliance };
+  const head = baseKnown ? revisionSource(ctx, root, 'HEAD') : null;
+  const repoCompliance = worktree.compliance
+    || (remote !== null && remote.compliance)
+    || (tracking !== null && tracking.compliance);
+  return {
+    reachable,
+    ref,
+    remote: remote === null ? null : remote.evidence,
+    worktree: worktree.evidence,
+    tracking: tracking === null ? null : tracking.evidence,
+    head: head === null ? null : head.evidence,
+    compliance: stricter(compliance, repoCompliance ? 'required' : 'standard'),
+  };
 }
 
 // ---------------------------------------------------------------------------
@@ -1051,15 +1134,12 @@ module.exports = Object.freeze({
   WARNINGS,
   EXIT_CODES,
   MECHANISM_INPUTS,
-  MAX_POLICY_BYTES,
   SAFE_REF_RE,
   OUTPUT_LINE_RE,
   FAIL_CLOSED_LINE,
   parseArgs,
-  parsePolicyBytes,
   complianceDefault,
   resolve,
   formatLine,
-  serializePolicy,
   main,
 });