dorfl 0.8.0 → 0.10.0

package/src/intake.ts

@@ -1,7 +1,7 @@
 import {existsSync, mkdirSync, readFileSync, writeFileSync} from 'node:fs';
 import {dirname, join} from 'node:path';
 import {runAsync, type RunResult} from './git.js';
-import {workFolderRel, workFolderPrefix, workItemRel} from './work-layout.js';
+import {workFolderRel, workFolderPrefix} from './work-layout.js';
 import {paramCase} from './brand.js';
 import {
 	performIntegration,
@@ -9,8 +9,9 @@ import {
 } from './integration-core.js';
 import type {IntegrateResult, ReviewProvider} from './integrator.js';
 import {integrationFromFlags} from './complete.js';
-import type {IntegrationMode, SpecsLandIn} from './config.js';
+import type {IntegrationMode, SpecsLandIn, TasksLandIn} from './config.js';
 import type {OriginTrust} from './frontmatter.js';
+import {TASK_PLACEMENT_SLOTS, landingToSide} from './tasking.js';
 import {
 	placementFolder,
 	resolvePlacement,
@@ -284,11 +285,47 @@ export interface PerformIntakeOptions {
 	 * the PR opens normally.
 	 */
 	noPR?: boolean;
+	/**
+	 * **The per-repo TASK-PLACEMENT default, passed IN** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	 * US #2, governing ADR `untrusted-origin-carries-via-stamp-not-forced-staging`).
+	 * The resolved per-repo default landing for `intake`-authored TASKS emitted
+	 * DIRECTLY from an issue (`backlog` = staging; `ready` = the agent pool), fed
+	 * as the CONFIGURED-DEFAULT rung into the shared placement resolver
+	 * (`src/placement.ts`) via the SAME task slots + `landingToSide` mapping the
+	 * tasker (`tasking.ts`) uses — so the intake TASK emit reaches PARITY with the
+	 * intake SPEC emit (both route through the resolver, both stamp origin-trust).
+	 * Unset ⇒ the resolver's built-in floor applies (`staging` = `tasks/backlog/`,
+	 * the conservative landing). The TASK twin of {@link specsLandIn}.
+	 */
+	tasksLandIn?: TasksLandIn;
+	/**
+	 * **The per-repo UNTRUSTED-side TASK-PLACEMENT default, passed IN** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	 * US #5, governing ADR `untrusted-origin-carries-via-stamp-not-forced-staging`).
+	 * The TWIN of {@link tasksLandIn} selected when the intake stamp is
+	 * `originTrust: untrusted`: {@link dispatchTask} reads the stamp and feeds THIS
+	 * default (rather than {@link tasksLandIn}) as the configured-default rung of
+	 * the shared placement resolver. The resolver no longer has an
+	 * untrusted-forces-staging rung; DEFAULTS to staging (`backlog`), opt-in
+	 * `ready` (safety then via the task's carried stamp, not the folder). The TASK
+	 * twin of {@link untrustedSpecsLandIn}; the SAME knob the tasker consults for
+	 * an untrusted-origin spec's downstream tasks (one policy, both call sites).
+	 */
+	untrustedTasksLandIn?: TasksLandIn;
+	/**
+	 * **The OPERATOR's EXPLICIT task-placement override** (the TOP precedence
+	 * rung). When set, the runner-deterministic resolver lands the emitted task
+	 * HERE regardless of {@link tasksLandIn} / {@link untrustedTasksLandIn} — the
+	 * TASK twin of {@link explicitSpecsLandIn}. Set ONLY when the operator typed
+	 * the explicit placement flag; never when the value came from config.
+	 */
+	explicitTasksLandIn?: TasksLandIn;
 	/**
 	 * **The per-repo SPEC-PLACEMENT default, passed IN** (spec
 	 * `staging-pool-position-gate-and-trust-model` US #2/#5, task
 	 * `pre-prd-staging-pool-split-and-untrusted-prd-placement`). The resolved
-	 * per-repo default landing for `intake`-authored prds (`pre-proposed` =
+	 * per-repo default landing for `intake`-authored prds (`proposed` =
 	 * staging; `ready` = the auto-tasking pool), fed as the CONFIGURED-DEFAULT rung
 	 * into the shared placement resolver (`src/placement.ts`). The resolver
 	 * overlays an EXPLICIT operator flag ({@link explicitSpecsLandIn}, top) and
@@ -298,11 +335,24 @@ export interface PerformIntakeOptions {
 	 * path — one resolver, two lifecycles.
 	 */
 	specsLandIn?: SpecsLandIn;
+	/**
+	 * **The per-repo UNTRUSTED-side SPEC-PLACEMENT default, passed IN** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	 * US #7, governing ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). The TWIN of
+	 * {@link specsLandIn} selected when the intake stamp is
+	 * `originTrust: untrusted`: the spec dispatch reads the stamp and feeds THIS
+	 * default (rather than {@link specsLandIn}) as the configured-default rung of
+	 * the shared placement resolver. The resolver no longer has an
+	 * untrusted-forces-staging rung; DEFAULTS to staging (`proposed`), opt-in
+	 * `ready` (safety then via the tasks' carried stamp, not the folder).
+	 */
+	untrustedSpecsLandIn?: SpecsLandIn;
 	/**
 	 * **The OPERATOR's EXPLICIT spec-placement override** (the TOP precedence
 	 * rung). When set, the runner-deterministic resolver lands the spec HERE
-	 * regardless of `originTrust` or {@link specsLandIn} — the positional
-	 * analogue of `explicitMerge` overriding the untrusted-origin
+	 * regardless of {@link specsLandIn} / {@link untrustedSpecsLandIn} — the
+	 * positional analogue of `explicitMerge` overriding the untrusted-origin
 	 * build-propose rule ("the operator is present; CLI always wins, no
 	 * special force-key"). Set ONLY when the operator typed
 	 * `--specs-land-in <where>`; never when the value came from config.
@@ -374,7 +424,7 @@ const SPEC_PLACEMENT_SLOTS: PlacementSlots = {
 };
 
 /**
- * Map the `specsLandIn` value spelling (`pre-proposed` | `ready`) onto the
+ * Map the `specsLandIn` value spelling (`proposed` | `ready`) onto the
  * resolver's lifecycle-generic side enum (`staging` | `pool`). Returns
  * `undefined` when no value is set, so the resolver's next precedence rung
  * applies (the built-in floor). The spec twin of `landingToSide` on the
@@ -383,7 +433,7 @@ const SPEC_PLACEMENT_SLOTS: PlacementSlots = {
 function specLandingToSide(
 	landing: SpecsLandIn | undefined,
 ): 'staging' | 'pool' | undefined {
-	if (landing === 'pre-proposed') return 'staging';
+	if (landing === 'proposed') return 'staging';
 	if (landing === 'ready') return 'pool';
 	return undefined;
 }
@@ -858,6 +908,17 @@ async function decideAndDispatch(
 				// not laundered. Unset ⇒ unstamped (a local intake ⇒ human/trusted).
 				originTrust: options.originTrust,
 				noPR: options.noPR,
+				// RUNNER-DETERMINISTIC PLACEMENT for the DIRECT-from-issue task (ADR
+				// `untrusted-origin-carries-via-stamp-not-forced-staging`): the
+				// configured-default + explicit-flag rungs, fed into the SHARED placement
+				// resolver alongside the `originTrust` stamp above — the TASK twin of the
+				// spec dispatch below. `dispatchTask` selects the untrusted-side default
+				// (`untrustedTasksLandIn`) when the stamp is `untrusted`, else
+				// `tasksLandIn`; the resolver decides `tasks/backlog/` (staging) vs
+				// `tasks/ready/` (the pool). `intake` never places itself.
+				tasksLandIn: options.tasksLandIn,
+				untrustedTasksLandIn: options.untrustedTasksLandIn,
+				explicitTasksLandIn: options.explicitTasksLandIn,
 				providerInstance: options.providerInstance,
 				issueProvider,
 				// The bounded lone-task review seam (tests inject a canned verdict;
@@ -893,6 +954,10 @@ async function decideAndDispatch(
 				// `specs/proposed/` (staging) vs `specs/ready/` (the tasking pool); `intake` never
 				// places itself.
 				specsLandIn: options.specsLandIn,
+				// The UNTRUSTED-side default, selected in `dispatchSpec` when the
+				// `originTrust` stamp is `untrusted` (ADR
+				// `untrusted-origin-carries-via-stamp-not-forced-staging`).
+				untrustedSpecsLandIn: options.untrustedSpecsLandIn,
 				explicitSpecsLandIn: options.explicitSpecsLandIn,
 				providerInstance: options.providerInstance,
 				issueProvider,
@@ -1065,6 +1130,16 @@ async function dispatchTask(params: {
 	/** The origin-trust stamp passed IN (unset ⇒ emit unstamped ⇒ human/trusted). */
 	originTrust: OriginTrust | undefined;
 	noPR: boolean | undefined;
+	/** The per-repo TRUSTED-side TASK-PLACEMENT default (configured-default rung when the task is trusted/unset). */
+	tasksLandIn: TasksLandIn | undefined;
+	/**
+	 * The per-repo UNTRUSTED-side TASK-PLACEMENT default, selected as the
+	 * configured-default rung when `originTrust` is `untrusted` (ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`).
+	 */
+	untrustedTasksLandIn: TasksLandIn | undefined;
+	/** The OPERATOR's EXPLICIT task-placement override (the TOP rung). */
+	explicitTasksLandIn: TasksLandIn | undefined;
 	providerInstance: ReviewProvider | undefined;
 	/** The issue seam the completion comment is posted back through (runner-owned). */
 	issueProvider: IssueProvider;
@@ -1087,6 +1162,9 @@ async function dispatchTask(params: {
 		mergeRetries,
 		originTrust,
 		noPR,
+		tasksLandIn,
+		untrustedTasksLandIn,
+		explicitTasksLandIn,
 		providerInstance,
 		issueProvider,
 		reviewTask,
@@ -1107,7 +1185,33 @@ async function dispatchTask(params: {
 		note(message);
 		return {exitCode: 1, outcome: 'usage-error', issueNumber, message};
 	}
-	const relPath = workItemRel('tasks-ready', `${slug}.md`);
+	// RUNNER-DETERMINISTIC PLACEMENT (task `intake-task-placement-symmetry`; the
+	// untrusted-forces-staging rung RETIRED by ADR
+	// `untrusted-origin-carries-via-stamp-not-forced-staging`). Resolve which
+	// folder the runner writes the intake-authored task into BEFORE handing it to
+	// the shared integrate band — the SAME precedence chain, the SAME shared
+	// resolver, and (via `TASK_PLACEMENT_SLOTS` + `landingToSide` reused from
+	// `tasking.ts`) the SAME task slots the tasker uses; only the intake dispatch
+	// differs from the spec twin (`dispatchSpec`) in its lifecycle SLOTS. THIS
+	// caller selects the trusted-vs-untrusted configured default by reading the
+	// `originTrust` stamp: an untrusted task selects `untrustedTasksLandIn`
+	// (default staging; `ready` when configured), a trusted/unset task selects
+	// `tasksLandIn`. The agent (the intake decider) never influences placement.
+	// Net vs the old hardcoded `tasks-ready`: an untrusted-author task now MERGES
+	// a document to `main` in `backlog` (by default) carrying the stamp instead of
+	// opening a document PR; safety for a `ready`-landed untrusted task flows
+	// through its carried stamp at BUILD time (forces a code PR), not the folder.
+	const configuredTasksLanding =
+		originTrust === 'untrusted' ? untrustedTasksLandIn : tasksLandIn;
+	const placementDecision = resolvePlacement({
+		explicit: landingToSide(explicitTasksLandIn),
+		configuredDefault: landingToSide(configuredTasksLanding),
+	});
+	const placementDir = placementFolder(
+		TASK_PLACEMENT_SLOTS,
+		placementDecision.choice,
+	);
+	const relPath = `${placementDir}/${slug}.md`;
 
 	// BOUNDED INTERNAL REVIEW (observation
 	// `intake-lone-task-skips-adversarial-review-the-prd-path-gets`, rulings A/B/C):
@@ -1267,8 +1371,14 @@ async function dispatchSpec(params: {
 	/** The origin-trust stamp passed IN (unset ⇒ emit unstamped ⇒ human/trusted). */
 	originTrust: OriginTrust | undefined;
 	noPR: boolean | undefined;
-	/** The per-repo SPEC-PLACEMENT default (configured-default rung of the placement chain). */
+	/** The per-repo TRUSTED-side SPEC-PLACEMENT default (configured-default rung when the spec is trusted/unset). */
 	specsLandIn: SpecsLandIn | undefined;
+	/**
+	 * The per-repo UNTRUSTED-side SPEC-PLACEMENT default, selected as the
+	 * configured-default rung when `originTrust` is `untrusted` (ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`).
+	 */
+	untrustedSpecsLandIn: SpecsLandIn | undefined;
 	/** The OPERATOR's EXPLICIT spec-placement override (the TOP rung). */
 	explicitSpecsLandIn: SpecsLandIn | undefined;
 	providerInstance: ReviewProvider | undefined;
@@ -1289,6 +1399,7 @@ async function dispatchSpec(params: {
 		originTrust,
 		noPR,
 		specsLandIn,
+		untrustedSpecsLandIn,
 		explicitSpecsLandIn,
 		providerInstance,
 		issueProvider,
@@ -1308,18 +1419,25 @@ async function dispatchSpec(params: {
 		return {exitCode: 1, outcome: 'usage-error', issueNumber, message};
 	}
 	// RUNNER-DETERMINISTIC PLACEMENT (task
-	// `pre-prd-staging-pool-split-and-untrusted-prd-placement`, governing ADR
-	// `placement-is-runner-deterministic-humanonly-is-agent-judgement`). Resolve
-	// which folder the runner writes the intake-authored spec into BEFORE handing
-	// it to the shared integrate band: the SAME precedence chain the tasker uses
-	// (`explicit > untrusted-origin ⇒ staging > specsLandIn > built-in (staging)`),
-	// the SAME shared resolver — only the lifecycle SLOTS differ. The agent
+	// `pre-prd-staging-pool-split-and-untrusted-prd-placement`; the
+	// untrusted-forces-staging rung RETIRED by ADR
+	// `untrusted-origin-carries-via-stamp-not-forced-staging`). Resolve which
+	// folder the runner writes the intake-authored spec into BEFORE handing it to
+	// the shared integrate band: the SAME precedence chain the tasker uses
+	// (`explicit > configured default > built-in (staging)`), the SAME shared
+	// resolver — only the lifecycle SLOTS differ. THIS caller selects the
+	// trusted-vs-untrusted configured default by reading the `originTrust` stamp:
+	// an untrusted spec selects `untrustedSpecsLandIn` (default staging; `ready`
+	// when configured), a trusted/unset spec selects `specsLandIn`. The agent
 	// (the intake decider) never influences placement; it returns the verdict and
-	// the runner computes the destination from unforgeable inputs.
+	// the runner computes the destination from unforgeable inputs. Safety for an
+	// untrusted spec landing in `ready` flows through its tasks' carried stamp,
+	// not the folder.
+	const configuredSpecsLanding =
+		originTrust === 'untrusted' ? untrustedSpecsLandIn : specsLandIn;
 	const placementDecision = resolvePlacement({
 		explicit: specLandingToSide(explicitSpecsLandIn),
-		originTrust,
-		configuredDefault: specLandingToSide(specsLandIn),
+		configuredDefault: specLandingToSide(configuredSpecsLanding),
 	});
 	const placementDir = placementFolder(
 		SPEC_PLACEMENT_SLOTS,

package/src/placement.ts

@@ -6,23 +6,28 @@
  *
  * Pure function from UNFORGEABLE inputs to a staging-vs-pool destination:
  *
- *   explicit operator flag  >  untrusted-origin forces STAGING  >
- *     configured default  >  built-in
+ *   explicit operator flag  >  configured default  >  built-in
  *
- * It is the POSITIONAL twin of the untrusted-origin BUILD-propose rule in
- * `integration-core.ts` (which decides MODE: `propose` vs `merge`): the same
- * `originTrust:` stamp + the same "explicit operator override beats the trust
- * force" shape, reused here to decide POSITION (which folder the runner lands
- * the emitted ledger files in). The agent cannot influence either — both
- * resolve runner-side from the stamped frontmatter + the resolved policy + the
- * operator's explicit flag.
+ * Author-trust is NO LONGER a rung here (ADR
+ * `untrusted-origin-carries-via-stamp-not-forced-staging`). This resolver was
+ * once the POSITIONAL twin of the untrusted-origin BUILD-propose rule in
+ * `integration-core.ts` (an `originTrust: untrusted ⇒ staging` rung sitting
+ * above the configured default). That rung is REMOVED: it made "untrusted
+ * lands in `ready`" inexpressible, and its safety was redundant with the
+ * build-time propose rule (an untrusted item in the pool still cannot become
+ * merged CODE without human review). The trusted-vs-untrusted destination is
+ * now selected BY THE CALLER, which reads the stamp and picks the matching
+ * configured default (`untrusted*LandIn` vs `*LandIn`) BEFORE calling — so
+ * this resolver stays a pure precedence over caller-supplied inputs. The
+ * agent cannot influence placement — it resolves runner-side from the resolved
+ * policy + the operator's explicit flag.
  *
  * LIFECYCLE-GENERIC. The folder names + the configured-default value are
  * PARAMETERS (`slots`, `configuredDefault`), so the same resolver serves the
  * TASK lifecycle (`tasksLandIn`: `backlog`/`ready` — the POOL value was
  * renamed `'backlog'` → `'todo'` → `'ready'`, ADR
  * `rename-task-pool-folder-todo-to-ready`) AND the SPEC-
- * placement lifecycle (`specsLandIn`: `pre-proposed`/`ready`) without forking. A future
+ * placement lifecycle (`specsLandIn`: `proposed`/`ready`) without forking. A future
  * lifecycle (e.g. intake's lone-task) plugs its own `slots` in and reuses the
  * exact precedence — no second implementation.
  */
@@ -54,34 +59,37 @@ export interface PlacementSlots {
 export interface ResolvePlacementInput {
 	/**
 	 * The operator's EXPLICIT override (the TOP of the chain) — when set, it
-	 * wins over the untrusted-origin force AND the configured default. Mirrors
-	 * `integration-core.ts`'s `explicitMerge` "operator is present; CLI always
-	 * wins, no special force-key" shape (the untrusted-origin trust signal
-	 * gates pool entry, not the mode in this case). Unset (`undefined`) ⇒ this
-	 * rung is skipped and the next one applies.
+	 * wins over the configured default. Mirrors `integration-core.ts`'s
+	 * `explicitMerge` "operator is present; CLI always wins, no special
+	 * force-key" shape. Unset (`undefined`) ⇒ this rung is skipped and the next
+	 * one applies.
 	 */
 	explicit?: PlacementSide;
 	/**
-	 * The source's stamped `originTrust:` frontmatter (`trusted` | `untrusted` |
-	 * absent ⇒ trusted by default). When `untrusted`, the resolver FORCES
-	 * `staging` even on a "land in pool" repo — the positional analogue of the
-	 * existing `untrusted-origin-forces-build-propose` rule. Unset / `trusted`
-	 * ⇒ this rung is skipped (zero behaviour change for the normal path).
-	 */
-	originTrust?: 'trusted' | 'untrusted';
-	/**
-	 * The repo's resolved configured DEFAULT landing (`tasksLandIn` /
-	 * `specsLandIn`). Caller resolves it like the existing `taskingIntegration`
-	 * (flag > env > per-repo > global > built-in) and passes the result; this
-	 * resolver just consumes it.
+	 * The repo's resolved configured DEFAULT landing, ALREADY selected by the
+	 * caller for the item's author-trust: the caller reads the `originTrust:`
+	 * stamp and passes the `untrusted*LandIn` default for an untrusted item, or
+	 * the trusted `*LandIn` default otherwise (ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). Resolved like the
+	 * existing `taskingIntegration` (flag > env > per-repo > global > built-in)
+	 * and mapped to a {@link PlacementSide}; this resolver just consumes it. Unset
+	 * ⇒ the built-in floor applies.
 	 */
 	configuredDefault?: PlacementSide;
 }
 
-/** The resolved choice + which precedence rung won (for honest reporting). */
+/**
+ * The resolved choice + which precedence rung won (for honest reporting).
+ *
+ * The `'untrusted-origin'` reason is RETIRED (ADR
+ * `untrusted-origin-carries-via-stamp-not-forced-staging`): author-trust no
+ * longer decides POSITION inside this resolver, so an untrusted item that lands
+ * in staging now does so via `'configured-default'` (its caller selected the
+ * `untrusted*LandIn` default), not via a distinct trust rung.
+ */
 export interface PlacementResult {
 	choice: PlacementSide;
-	reason: 'explicit' | 'untrusted-origin' | 'configured-default' | 'built-in';
+	reason: 'explicit' | 'configured-default' | 'built-in';
 }
 
 /**
@@ -97,11 +105,12 @@ const BUILT_IN_FLOOR: PlacementSide = 'staging';
  * Resolve the staging-vs-pool placement from unforgeable inputs, via the fixed
  * precedence chain:
  *
- *   explicit  >  untrusted-origin ⇒ staging  >  configured default  >  built-in
+ *   explicit  >  configured default  >  built-in
  *
- * Pure: no I/O, no env reads — the caller resolves config + reads the
- * frontmatter and passes both in. Reused by every lifecycle (task + spec
- * placement + future intake variants) so a precedence change touches ONE place.
+ * Pure: no I/O, no env reads, NO trust rung — the caller resolves config
+ * (INCLUDING selecting the trusted-vs-untrusted default from the stamp) and
+ * passes the result in. Reused by every lifecycle (task + spec placement +
+ * future intake variants) so a precedence change touches ONE place.
  */
 export function resolvePlacement(
 	input: ResolvePlacementInput,
@@ -109,9 +118,6 @@ export function resolvePlacement(
 	if (input.explicit !== undefined) {
 		return {choice: input.explicit, reason: 'explicit'};
 	}
-	if (input.originTrust === 'untrusted') {
-		return {choice: 'staging', reason: 'untrusted-origin'};
-	}
 	if (input.configuredDefault !== undefined) {
 		return {choice: input.configuredDefault, reason: 'configured-default'};
 	}

package/src/repo-config.ts

@@ -72,6 +72,22 @@ export const REPO_ALLOWED_KEYS = [
 	// intake's per-EMITTED-TYPE `{task, spec}` resolver (front door, author-trust):
 	// this is a per-lifecycle-transition knob, inside the boundary, config-resolved.
 	'taskingIntegration',
+	// `intakeIntegration` (the per-TRANSITION INTAKE-DOCUMENT override — the twin of
+	// `taskingIntegration` for the intake front door) is a genuine repo property
+	// exactly like `taskingIntegration`/`integration`: whether THIS repo's intake
+	// front door emits a task/spec DOCUMENT straight onto `main` (merge, no PR) or
+	// as a reviewable PR is agreed by all collaborators + travels with the repo.
+	// Resolved per-repo through the SAME chain as `taskingIntegration` (flag > env
+	// `DORFL_INTAKE_INTEGRATION` > per-repo > global), then falls back to
+	// `integration` when unset. DECOUPLED from the autonomy gates
+	// (`autoBuild`/`autoTask`): the document PR-mode is operator/config, not a
+	// function of autonomy (ADR untrusted-origin-carries-via-stamp-not-forced-staging).
+	// A SINGLE value applies to both the task AND the spec document (US #1 chose one
+	// knob, not a per-type split). DISTINCT from `taskingIntegration` (a DIFFERENT
+	// lifecycle transition) — the third member of the per-transition integration
+	// family (`integration` build / `taskingIntegration` tasking / `intakeIntegration`
+	// intake), each falling back to `integration`, none tied to a gate.
+	'intakeIntegration',
 	// `tasksLandIn` (the per-repo TASK-PLACEMENT default — staging vs pool, spec
 	// `staging-pool-position-gate-and-trust-model` US #5) is a genuine repo property
 	// exactly like `taskingIntegration`/`integration`: whether THIS repo's tasker
@@ -96,6 +112,25 @@ export const REPO_ALLOWED_KEYS = [
 	// (`src/placement.ts`). The sole spec-placement key after the ''prd'' → `spec` HARD
 	// CUTOVER (the legacy `prdsLandIn` key is GONE — clean break, no accepted alias).
 	'specsLandIn',
+	// `untrustedTasksLandIn` (the UNTRUSTED-side TWIN of `tasksLandIn` — spec
+	// `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	// US #5/#6, ADR `untrusted-origin-carries-via-stamp-not-forced-staging`) is a
+	// genuine repo property exactly like `tasksLandIn`: whether THIS repo's
+	// untrusted-origin tasks land STAGED (`tasks/backlog/`, human promotion) or in
+	// the agent POOL (`tasks/ready/`, claimable — safety then via the carried build
+	// STAMP) is a repo-wide policy agreed by all collaborators + travels with the
+	// repo. Resolved per-repo through the SAME chain as `tasksLandIn` (flag
+	// `--untrusted-tasks-land-in` > env `DORFL_UNTRUSTED_TASKS_LAND_IN` > per-repo >
+	// global > built-in `backlog`). The caller selects it over the trusted twin by
+	// reading the `originTrust` stamp before the placement resolver.
+	'untrustedTasksLandIn',
+	// `untrustedSpecsLandIn` (the UNTRUSTED-side TWIN of `specsLandIn` — same spec
+	// US #7) is a genuine repo property exactly like `specsLandIn`: whether THIS
+	// repo's untrusted intake specs land STAGED (`specs/proposed/`) or in the
+	// auto-tasking POOL (`specs/ready/`) is a repo-wide policy. Resolved per-repo
+	// through the SAME chain (flag `--untrusted-specs-land-in` > env
+	// `DORFL_UNTRUSTED_SPECS_LAND_IN` > per-repo > global > built-in `proposed`).
+	'untrustedSpecsLandIn',
 	// `noPR` (the PR-INTENT axis — push the branch but deliberately skip the PR) is
 	// a genuine repo property exactly like `integration`/`review`: whether this
 	// repo's propose runs open a PR is agreed by all collaborators + travels with

package/src/tasking.ts

@@ -271,6 +271,25 @@ export interface PerformTaskOptions {
 	 * landing that preserves zero behaviour change for the normal path).
 	 */
 	tasksLandIn?: 'backlog' | 'ready';
+	/**
+	 * **The per-repo UNTRUSTED-side TASK-PLACEMENT default** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	 * US #6/#10, governing ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). The TWIN of
+	 * {@link tasksLandIn} selected when the SPEC being tasked carries an
+	 * `originTrust: untrusted` stamp: `performTask` reads the stamp and feeds
+	 * THIS default (rather than {@link tasksLandIn}) as the configured-default
+	 * rung of the placement resolver. This is the same knob intake uses for a
+	 * task emitted directly from an issue (decision X: one policy governs an
+	 * untrusted task's destination regardless of birth path). Resolved per-repo
+	 * like {@link tasksLandIn} (flag `--untrusted-tasks-land-in` > env
+	 * `DORFL_UNTRUSTED_TASKS_LAND_IN` > per-repo > global > built-in `backlog`).
+	 * Unset ⇒ the resolver's built-in floor (`staging`) applies. The resolver no
+	 * longer has an untrusted-forces-staging rung; safety for an untrusted task
+	 * that lands in `ready` here is the carried stamp (its BUILD is forced to a
+	 * code PR), NOT the folder.
+	 */
+	untrustedTasksLandIn?: 'backlog' | 'ready';
 	/**
 	 * **The OPERATOR's EXPLICIT task-placement override** (the TOP precedence
 	 * rung). When set, the runner-deterministic resolver lands the tasks HERE
@@ -353,8 +372,14 @@ export const STAGED_TASKS_DIR = workFolderRel('tasks-backlog');
  */
 const POOL_TASKS_DIR = workFolderRel('tasks-ready');
 
-/** The placement slots for the TASK lifecycle (folder names). */
-const TASK_PLACEMENT_SLOTS = {
+/**
+ * The placement slots for the TASK lifecycle (folder names). EXPORTED so the
+ * intake TASK emit (`intake.ts` `dispatchTask`) reuses the SAME slots + resolver
+ * the tasker uses, reaching parity with the intake SPEC emit (ADR
+ * `untrusted-origin-carries-via-stamp-not-forced-staging`) WITHOUT forking a
+ * second copy of the task folder names.
+ */
+export const TASK_PLACEMENT_SLOTS = {
 	staging: STAGED_TASKS_DIR,
 	pool: POOL_TASKS_DIR,
 } as const;
@@ -367,9 +392,11 @@ const TASK_PLACEMENT_SLOTS = {
  * are NOT accepted (clean break — the staging value was renamed
  * `'pre-backlog'` → `'backlog'`, and the pool value was renamed
  * `'backlog'` → `'todo'` → `'ready'`, ADR
- * `rename-task-pool-folder-todo-to-ready`).
+ * `rename-task-pool-folder-todo-to-ready`). EXPORTED alongside
+ * {@link TASK_PLACEMENT_SLOTS} so the intake TASK emit reuses this exact mapping
+ * (the task twin of `specLandingToSide` on the intake spec path).
  */
-function landingToSide(
+export function landingToSide(
 	landing: 'backlog' | 'ready' | undefined,
 ): 'staging' | 'pool' | undefined {
 	if (landing === 'backlog') return 'staging';
@@ -593,17 +620,28 @@ export async function performTask(
 	const stagedEmitted = newOrChangedStagedTasks(cwd, before);
 	const emitTasks = collectEmittedTasks(cwd, stagedEmitted);
 	// RUNNER-DETERMINISTIC PLACEMENT (task
-	// `runner-deterministic-slice-placement-policy-and-precedence`). Resolve which
+	// `runner-deterministic-slice-placement-policy-and-precedence`; the
+	// untrusted-forces-staging rung was RETIRED by ADR
+	// `untrusted-origin-carries-via-stamp-not-forced-staging`). Resolve which
 	// folder the runner lands the emitted tasks in BEFORE handing them to the
-	// shared integrate band: precedence `explicit > untrusted-origin ⇒ staging >
-	// tasksLandIn > built-in (staging)`, all from unforgeable inputs (the spec's
-	// stamped `originTrust:` + the resolved per-repo default + the operator's
-	// explicit flag). The agent NEVER influences this; it always writes to
-	// `work/tasks/backlog/`, and the runner redirects at `stage()` time.
+	// shared integrate band: precedence `explicit > configured default >
+	// built-in (staging)`. THIS caller selects the trusted-vs-untrusted
+	// configured default by reading the spec's propagated `originTrust:` stamp:
+	// an untrusted-origin spec selects `untrustedTasksLandIn` (default staging;
+	// `ready` when configured), a trusted/unset spec selects `tasksLandIn`. One
+	// knob (`untrustedTasksLandIn`) governs an untrusted task's destination
+	// whether born from an issue directly (intake) or from an untrusted spec
+	// here. The agent NEVER influences this; it always writes to
+	// `work/tasks/backlog/`, and the runner redirects at `stage()` time. Safety
+	// for an untrusted task landing in `ready` is the carried stamp (its BUILD is
+	// forced to a code PR), not the folder.
+	const configuredTasksLanding =
+		specFm.originTrust === 'untrusted'
+			? options.untrustedTasksLandIn
+			: options.tasksLandIn;
 	const placementDecision = resolvePlacement({
 		explicit: landingToSide(options.explicitTasksLandIn),
-		originTrust: specFm.originTrust,
-		configuredDefault: landingToSide(options.tasksLandIn),
+		configuredDefault: landingToSide(configuredTasksLanding),
 	});
 	const placementDir = placementFolder(
 		TASK_PLACEMENT_SLOTS,
@@ -721,7 +759,6 @@ export async function performTask(
 						emitTasks,
 						poolBefore,
 						placementDir,
-						placementReason: placementDecision.reason,
 						note,
 						env,
 					}),
@@ -1033,32 +1070,19 @@ async function stageTaskingLifecycle(params: {
 	/**
 	 * The runner-resolved destination folder (task
 	 * `runner-deterministic-slice-placement-policy-and-precedence`). Computed
-	 * ONCE in `performTask` via the shared {@link resolvePlacement} from the
-	 * spec's `originTrust:` stamp + the configured `tasksLandIn` default + the
-	 * operator's explicit override, then passed in here — so the call site sees
-	 * exactly where the emitted tasks landed (the placement decision is not
-	 * buried in the stage closure).
+	 * ONCE in `performTask` via the shared {@link resolvePlacement}. The caller
+	 * selects the configured default from the spec's `originTrust:` stamp
+	 * (`untrustedTasksLandIn` when untrusted, else `tasksLandIn`; ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`) and overlays the
+	 * operator's explicit override, then passes the result in here — so the call
+	 * site sees exactly where the emitted tasks landed (the placement decision is
+	 * not buried in the stage closure).
 	 */
 	placementDir: string;
-	/** Which precedence rung the resolver took (for honest reporting). */
-	placementReason:
-		| 'explicit'
-		| 'untrusted-origin'
-		| 'configured-default'
-		| 'built-in';
 	note: (message: string) => void;
 	env: NodeJS.ProcessEnv | undefined;
 }): Promise<void> {
-	const {
-		cwd,
-		slug,
-		emitTasks,
-		poolBefore,
-		placementDir,
-		placementReason,
-		note,
-		env,
-	} = params;
+	const {cwd, slug, emitTasks, poolBefore, placementDir, note, env} = params;
 	const spec = workItemRel('specs-ready', `${slug}.md`);
 	const specTasked = workItemRel('specs-tasked', `${slug}.md`);
 	// PROPAGATE the origin-trust PROVENANCE (task
@@ -1072,13 +1096,14 @@ async function stageTaskingLifecycle(params: {
 	const specProvenance = existsSync(specAbs)
 		? parseFrontmatter(readFileSync(specAbs, 'utf8'))
 		: {origin: undefined, originTrust: undefined};
-	if (placementReason === 'untrusted-origin') {
-		note(
-			`Untrusted-origin spec '${slug}': forcing the emitted tasks STAGED ` +
-				`(${placementDir}/) regardless of tasksLandIn (a human promotes ` +
-				'them into work/tasks/ready/). Pass --tasks-land-in <where> to override.',
-		);
-	}
+	// NOTE: author-trust no longer FORCES staging here (ADR
+	// `untrusted-origin-carries-via-stamp-not-forced-staging`). An untrusted spec's
+	// emitted tasks land per `untrustedTasksLandIn` (default staging; `ready` when
+	// configured), selected by the caller from the stamp before `resolvePlacement`;
+	// safety for a `ready` landing is the propagated `originTrust: untrusted` stamp
+	// below (its BUILD is forced to a code PR), not the folder. The placement
+	// decision itself is fully computed in `performTask`; this stage just writes to
+	// the resolved `placementDir`.
 	// Move the held spec specs/ready/ -> specs/tasked/ (the TASKED resting state — folder =
 	// source of truth, like done/ for tasks). This is the DURABLE `specs/ready → specs/tasked`
 	// success move, owned by THIS transition's commit (the lock no longer moved the
@@ -1603,7 +1628,9 @@ function collectEmittedTasks(
  * Sections (all suppressed when empty, so the body stays honest):
  *   1. A lead line naming the source spec + emitted task count.
  *   2. **Tasks** — one bullet per task: `slug — title`, plus `covers:` (which
- *      spec user stories it maps to), `blockedBy:`, and `needsAnswers` if set.
+ *      spec user stories it maps to, as `US-<n>` so GitHub does not autolink
+ *      the index as an issue/PR reference), `blockedBy:`, and `needsAnswers`
+ *      if set.
  *   3. **Dependency graph** — the KEYSTONE(S) (tasks whose `blockedBy` names no
  *      other task in this set, so they land first) and the `blockedBy` edges.
  *   4. **Needs answers** — any open questions the tasker review→edit loop
@@ -1637,7 +1664,12 @@ export function composeTaskingProposeBody(
 	for (const t of tasks) {
 		lines.push(`- **${t.slug}** — ${t.title}`);
 		if (t.covers.length > 0) {
-			lines.push(`  - covers: ${t.covers.map((c) => `US #${c}`).join(', ')}`);
+			// User-story ids are rendered as `US-<n>` (NOT `US #<n>`): a bare
+			// `#<n>` in a GitHub PR body autolinks to issue/PR #<n>, which is a
+			// confusing false reference (the number is a spec user-story index,
+			// not an issue). The hyphenated form carries the same meaning without
+			// tripping GitHub's autolinker.
+			lines.push(`  - covers: ${t.covers.map((c) => `US-${c}`).join(', ')}`);
 		}
 		if (t.blockedBy.length > 0) {
 			lines.push(`  - blockedBy: ${t.blockedBy.join(', ')}`);