dorfl 0.8.0 → 0.10.0

package/src/config.ts

@@ -44,21 +44,23 @@ export type TasksLandIn = 'backlog' | 'ready';
  * `pre-prd-staging-pool-split-and-untrusted-prd-placement`, governing ADR
  * `placement-is-runner-deterministic-humanonly-is-agent-judgement`). Which
  * folder the runner lands `intake`-authored spec files in BY DEFAULT —
- * `'pre-proposed'` (staging — durable + readable but NOT in the auto-tasking
+ * `'proposed'` (staging — durable + readable but NOT in the auto-tasking
  * POOL; a runner/human promotion is needed to make the spec auto-taskable; the
  * on-disk folder for this value is `work/specs/proposed/`) or `'ready'` (the
  * auto-tasking POOL — the trusted fast-path landing, on-disk
  * `work/specs/ready/`). The same runner-deterministic placement RESOLVER
  * (`src/placement.ts`) layers on top:
- * `explicit operator flag > untrusted-origin ⇒ pre-proposed > specsLandIn
- * default > built-in (pre-proposed)`. An untrusted-origin intake spec is FORCED
- * to staging even in a `'ready'` repo (the positional analogue of the existing
- * `untrusted-origin-forces-build-propose` rule). The SPEC twin of
+ * `explicit operator flag > configured default > built-in (proposed)`.
+ * Author-trust is NO LONGER a rung in the resolver (ADR
+ * `untrusted-origin-carries-via-stamp-not-forced-staging`): the CALLER reads the
+ * `originTrust:` stamp and selects the untrusted twin `untrustedSpecsLandIn`
+ * (default `'proposed'`; opt-in `'ready'`) as the configured default for an
+ * untrusted intake spec. The SPEC twin of
  * {@link TasksLandIn}; the SAME shape, the SAME precedence chain. The value
  * spellings mirror the live spec folders (`specs/proposed/` staging,
  * `specs/ready/` pool), exactly as {@link TasksLandIn} mirrors the task folders.
  */
-export type SpecsLandIn = 'pre-proposed' | 'ready';
+export type SpecsLandIn = 'proposed' | 'ready';
 
 /**
  * The observation-triage gate (ADR `ci-config-policy-and-gate-family` §2): a
@@ -357,6 +359,37 @@ export interface Config {
 	 * per-LIFECYCLE-TRANSITION knob, inside the trust boundary, operator/config-only.
 	 */
 	taskingIntegration?: IntegrationMode;
+	/**
+	 * **Per-TRANSITION override for the INTAKE DOCUMENT emit only** — the twin of
+	 * {@link taskingIntegration} for the intake front door. When set, an
+	 * `intake`-emitted DOCUMENT (a task file `work/tasks/*` OR a spec file
+	 * `work/specs/*`) integrates with THIS mode instead of the flat
+	 * {@link integration}; the task-BUILD transition is unaffected (it always reads
+	 * {@link integration}), and neither is the tasking transition (it reads
+	 * {@link taskingIntegration}). UNSET (the default) ⇒ intake falls back to
+	 * {@link integration} — byte-for-byte today's behaviour for any repo that does
+	 * not set it, so a single `integration: 'merge'` merges documents across BOTH
+	 * the tasking and intake transitions with no extra key.
+	 *
+	 * A SINGLE value applies to both the task AND the spec document (spec
+	 * `intake-integration-knob-and-specs-land-in-proposed-rename` US #1 chose a
+	 * single knob, NOT a per-type `{task, spec}` split). Decoupled from the
+	 * AUTONOMY GATES (`autoBuild`/`autoTask`): the intake document PR-mode is now an
+	 * operator/config choice, NOT a function of "may an agent act autonomously" —
+	 * so a repo can have `autoBuild: true`/`autoTask: true` (autonomy) AND intake
+	 * documents merging to `main` at the same time (ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). Untrusted safety is
+	 * unchanged: it rests entirely on placement (`untrusted*LandIn`) + the
+	 * build-time `originTrust: untrusted` stamp (the code PR), never a forced
+	 * document PR. Resolved per-repo like {@link taskingIntegration}: flag
+	 * (`--merge`/`--propose`) > env (`DORFL_INTAKE_INTEGRATION`) > per-repo >
+	 * global > (fall back to) `integration` > default `propose`. The intake CLI's
+	 * explicit `--merge-task`/`--merge-spec`/`--merge`/`--propose` flags still win
+	 * (operator-present, top of precedence). DISTINCT from `taskingIntegration` (a
+	 * DIFFERENT lifecycle transition) — each is its own `merge|propose` mode that
+	 * falls back to `integration`, none tied to an autonomy gate.
+	 */
+	intakeIntegration?: IntegrationMode;
 	/**
 	 * **Per-repo DEFAULT landing for the TASKER's emitted tasks** (spec
 	 * `staging-pool-position-gate-and-trust-model` US #5, task
@@ -377,7 +410,7 @@ export interface Config {
 	 * `staging-pool-position-gate-and-trust-model` US #2/#5/#6/#12). The SPEC twin
 	 * of {@link tasksLandIn}: resolved per-repo EXACTLY like it (flag
 	 * `--specs-land-in` > env `DORFL_SPECS_LAND_IN` > per-repo > global >
-	 * built-in `'pre-proposed'`). `intake`'s spec dispatch reads it and passes it as
+	 * built-in `'proposed'`). `intake`'s spec dispatch reads it and passes it as
 	 * the CONFIGURED-DEFAULT rung into the shared placement resolver
 	 * (`src/placement.ts`); the resolver overlays an EXPLICIT operator flag
 	 * (top) and the UNTRUSTED-ORIGIN force (staging) on top, in that order.
@@ -391,6 +424,48 @@ export interface Config {
 	 * `prdsLandIn` config key + `--prds-land-in` flag are GONE (clean break).
 	 */
 	specsLandIn: SpecsLandIn;
+	/**
+	 * **Per-repo DEFAULT landing for an UNTRUSTED-origin TASK** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	 * US #5/#6, governing ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). The exact TWIN of
+	 * {@link tasksLandIn} for items whose `originTrust` stamp is `untrusted`:
+	 * SAME value shape ({@link TasksLandIn}), SAME resolution chain (flag
+	 * `--untrusted-tasks-land-in` > env `DORFL_UNTRUSTED_TASKS_LAND_IN` >
+	 * per-repo > global > built-in `'backlog'`). The ADR removes the
+	 * untrusted-forces-staging RUNG from the placement resolver; instead the
+	 * CALLER reads the stamp and selects THIS key (vs the trusted
+	 * {@link tasksLandIn}) as the configured-default rung. Governs EVERY
+	 * untrusted-stamped task — intake-authored directly from an issue OR emitted
+	 * by the tasker from an untrusted-origin spec (decision X: one policy, both
+	 * call sites; no third knob). DEFAULTS to STAGING (`'backlog'`), the
+	 * conservative human-admission landing: safety for an untrusted item that
+	 * opts into the pool (`'ready'`) is then the carried build STAMP (a code PR),
+	 * not the folder. CONSUMED at both task call sites: the tasker
+	 * (`performTask`) selects it for an untrusted-origin spec's emitted tasks, and
+	 * intake's direct task emit (`dispatchTask`, a sibling task) selects it for a
+	 * task born straight from an issue.
+	 */
+	untrustedTasksLandIn: TasksLandIn;
+	/**
+	 * **Per-repo DEFAULT landing for an UNTRUSTED-origin intake SPEC** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	 * US #7, governing ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). The exact TWIN of
+	 * {@link specsLandIn} for untrusted-stamped intake specs: SAME value shape
+	 * ({@link SpecsLandIn} — `proposed` staging vs `ready` pool), SAME
+	 * resolution chain (flag `--untrusted-specs-land-in` > env
+	 * `DORFL_UNTRUSTED_SPECS_LAND_IN` > per-repo > global > built-in
+	 * `'proposed'`). The caller reads the `originTrust` stamp and selects THIS
+	 * key (vs the trusted {@link specsLandIn}) as the placement resolver's
+	 * configured-default rung. DEFAULTS to STAGING (`'proposed'`) — the
+	 * conservative human-admission landing, preserving today's effective
+	 * behaviour for a repo that configures nothing; a repo opts an untrusted spec
+	 * into the pool (`'ready'`) explicitly, safety then via the carried stamp.
+	 * CONSUMED at the intake SPEC call site (`dispatchSpec`), which selects it
+	 * over {@link specsLandIn} when the intake stamp is `originTrust: untrusted`.
+	 */
+	untrustedSpecsLandIn: SpecsLandIn;
 	/**
 	 * **The PR-INTENT axis** (ADR §6): on the `propose` path, do NOT open a review
 	 * request even on a GitHub arbiter with auth — push the branch (the
@@ -825,14 +900,26 @@ export const DEFAULT_CONFIG: Config = {
 	// The runner-deterministic resolver overlays explicit-flag + untrusted-origin
 	// force on top of this default (`src/placement.ts`).
 	tasksLandIn: 'backlog',
-	// `intake`-authored specs land STAGED (`pre-proposed/`) by default — the
+	// `intake`-authored specs land STAGED (`proposed/`) by default — the
 	// conservative landing that mirrors `tasksLandIn`'s built-in floor: a spec is
 	// durable + readable but NOT in the auto-tasking POOL until a human/runner
 	// promotes it. A repo opts into the trusted fast-path with `specsLandIn: 'ready'`
 	// (or `--specs-land-in ready` / `DORFL_SPECS_LAND_IN=ready`). The same
 	// runner-deterministic resolver overlays explicit-flag + untrusted-origin
 	// force on top of this default (`src/placement.ts`).
-	specsLandIn: 'pre-proposed',
+	specsLandIn: 'proposed',
+	// The untrusted-side placement TWINS default to STAGING (`backlog` /
+	// `proposed`) — the conservative human-admission landing (ADR
+	// `untrusted-origin-carries-via-stamp-not-forced-staging`). A repo that trusts
+	// its stamp-based pipeline opts an untrusted item into the pool (`ready`)
+	// explicitly; safety is then the carried build STAMP (a code PR), not the
+	// folder. Unset ⇒ both resolve to staging, so a repo configuring nothing keeps
+	// today's effective behaviour. NO call site consumes these yet (resolver +
+	// intake/tasker wiring are later tasks); resolved flag > env
+	// (`DORFL_UNTRUSTED_TASKS_LAND_IN` / `DORFL_UNTRUSTED_SPECS_LAND_IN`) > per-repo
+	// > global > built-in, exactly like their trusted twins.
+	untrustedTasksLandIn: 'backlog',
+	untrustedSpecsLandIn: 'proposed',
 	agentCmd: '',
 	// Gate 2 (PR/code review) defaults OFF — it puts a model on the merge path, so
 	// it is opt-in (ADR §8). On an `approve` a resolved `merge` lands automatically

package/src/do.ts

@@ -416,11 +416,21 @@ export interface DoOptions {
 	 * lifecycle concern).
 	 */
 	tasksLandIn?: 'backlog' | 'ready';
+	/**
+	 * **The per-repo UNTRUSTED-side TASK-PLACEMENT default** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`,
+	 * ADR `untrusted-origin-carries-via-stamp-not-forced-staging`). Threaded into
+	 * {@link performTask}, which selects it (over {@link tasksLandIn}) as the
+	 * configured-default rung when the tasked spec carries an
+	 * `originTrust: untrusted` stamp. See {@link performTask}'s
+	 * `untrustedTasksLandIn`.
+	 */
+	untrustedTasksLandIn?: 'backlog' | 'ready';
 	/**
 	 * **The OPERATOR's EXPLICIT task-placement override** (the TOP precedence
 	 * rung in the placement resolver). Set ONLY when the operator typed
 	 * `--tasks-land-in <where>` on this invocation; never when the value came
-	 * from config. Wins over `originTrust: untrusted` (the operator is present;
+	 * from config. Wins over the configured default (the operator is present;
 	 * CLI always wins, no special force-key) — the positional analogue of
 	 * `explicitMerge` overriding the untrusted-origin build-propose rule.
 	 */
@@ -704,6 +714,11 @@ export interface DoRemoteOptions extends DoAgentLaunchOptions {
 	 * configured-default rung. See {@link DoOptions.tasksLandIn}.
 	 */
 	tasksLandIn?: 'backlog' | 'ready';
+	/**
+	 * **The per-repo UNTRUSTED-side TASK-PLACEMENT default** on the `do --remote
+	 * spec:` path. See {@link DoOptions.untrustedTasksLandIn}.
+	 */
+	untrustedTasksLandIn?: 'backlog' | 'ready';
 	/**
 	 * **The OPERATOR's EXPLICIT task-placement override** on the `do --remote
 	 * spec:` path. See {@link DoOptions.explicitTasksLandIn}.
@@ -942,13 +957,16 @@ export async function performDo(options: DoOptions): Promise<DoResult> {
 			// same per-repo cap the build path uses (task
 			// `thread-merge-retries-cross-task-and-ratify-default`).
 			mergeRetries: options.mergeRetries,
-			// The per-repo TASK-PLACEMENT default + the operator's explicit
-			// override (task `runner-deterministic-slice-placement-policy-and-
-			// precedence`). The tasker reads them as the configured-default + the
-			// top rung of the runner-deterministic placement resolver; the
-			// `originTrust: untrusted` force is read inside the tasker from the
-			// spec's stamped frontmatter.
+			// The per-repo TASK-PLACEMENT defaults (trusted + untrusted twin) + the
+			// operator's explicit override (task `runner-deterministic-slice-
+			// placement-policy-and-precedence`; ADR `untrusted-origin-carries-via-
+			// stamp-not-forced-staging`). The tasker reads the spec's stamped
+			// `originTrust:` to SELECT the trusted-vs-untrusted configured default,
+			// then feeds it (with the explicit override on top) into the
+			// runner-deterministic placement resolver (which no longer has a trust
+			// rung).
 			tasksLandIn: options.tasksLandIn,
+			untrustedTasksLandIn: options.untrustedTasksLandIn,
 			explicitTasksLandIn: options.explicitTasksLandIn,
 			noPR: options.noPR,
 			providerInstance: options.providerInstance,
@@ -2372,10 +2390,12 @@ export async function performDoRemote(
 				// threaded on the no-checkout `do --remote spec:` tasking path too,
 				// mirroring the in-place site above.
 				mergeRetries: options.mergeRetries,
-				// The per-repo TASK-PLACEMENT default + the operator's explicit
-				// override (task `runner-deterministic-slice-placement-policy-and-
-				// precedence`). Same threading as the in-place `do spec:` path.
+				// The per-repo TASK-PLACEMENT defaults (trusted + untrusted twin) + the
+				// operator's explicit override. Same stamp-selected threading as the
+				// in-place `do spec:` path (ADR `untrusted-origin-carries-via-stamp-
+				// not-forced-staging`).
 				tasksLandIn: options.tasksLandIn,
+				untrustedTasksLandIn: options.untrustedTasksLandIn,
 				explicitTasksLandIn: options.explicitTasksLandIn,
 				noPR: options.noPR,
 				providerInstance: options.providerInstance,

package/src/env-config.ts

@@ -98,6 +98,14 @@ const KEY_COERCIONS: {[K in keyof Config]?: Coercion} = {
 	// works and a typo FAILS LOUDLY. Unset ⇒ the tasking transition falls back to
 	// `integration` (the flat value). It NEVER touches the build transition or intake.
 	taskingIntegration: {enum: ['propose', 'merge']},
+	// `intakeIntegration` (the per-TRANSITION INTAKE-DOCUMENT override — the twin of
+	// `taskingIntegration` for the intake front door) coerces as the SAME
+	// `propose`/`merge` enum as `integration`, so `DORFL_INTAKE_INTEGRATION`
+	// works and a typo FAILS LOUDLY. Unset ⇒ the intake document emit falls back to
+	// `integration` (the flat value). Decoupled from the autonomy gates
+	// (`autoBuild`/`autoTask`) — the intake document PR-mode is operator/config, not
+	// a function of autonomy (ADR untrusted-origin-carries-via-stamp-not-forced-staging).
+	intakeIntegration: {enum: ['propose', 'merge']},
 	// `tasksLandIn` (the per-repo TASK-PLACEMENT default — spec
 	// `staging-pool-position-gate-and-trust-model` US #5) coerces as the
 	// `backlog`/`ready` enum, so `DORFL_TASKS_LAND_IN=ready` works and a
@@ -108,13 +116,27 @@ const KEY_COERCIONS: {[K in keyof Config]?: Coercion} = {
 	tasksLandIn: {enum: ['backlog', 'ready']},
 	// `specsLandIn` (the per-repo SPEC-PLACEMENT default — spec
 	// `staging-pool-position-gate-and-trust-model` US #2/#5) coerces as the
-	// `pre-proposed`/`ready` enum, so `DORFL_SPECS_LAND_IN=ready` works and a typo
+	// `proposed`/`ready` enum, so `DORFL_SPECS_LAND_IN=ready` works and a typo
 	// FAILS LOUDLY. Same precedence chain as `tasksLandIn` (flag > env > per-repo
-	// > global > built-in `pre-proposed`); fed into the shared placement resolver
+	// > global > built-in `proposed`); fed into the shared placement resolver
 	// (`src/placement.ts`) as the configured-default rung for the spec lifecycle.
 	// The legacy `prdsLandIn` key / `DORFL_PRDS_LAND_IN` env are GONE after the
 	// ''prd'' → `spec` hard cutover (clean break).
-	specsLandIn: {enum: ['pre-proposed', 'ready']},
+	specsLandIn: {enum: ['proposed', 'ready']},
+	// `untrustedTasksLandIn` (the UNTRUSTED-side TWIN of `tasksLandIn` — spec
+	// `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	// US #5/#6, ADR `untrusted-origin-carries-via-stamp-not-forced-staging`)
+	// coerces as the SAME `backlog`/`ready` enum as `tasksLandIn`, so
+	// `DORFL_UNTRUSTED_TASKS_LAND_IN=ready` works and a typo FAILS LOUDLY. Same
+	// precedence chain (flag > env > per-repo > global > built-in `backlog`); the
+	// caller selects it (over the trusted `tasksLandIn`) by reading the
+	// `originTrust` stamp before feeding the placement resolver.
+	untrustedTasksLandIn: {enum: ['backlog', 'ready']},
+	// `untrustedSpecsLandIn` (the UNTRUSTED-side TWIN of `specsLandIn` — same spec
+	// US #7) coerces as the SAME `proposed`/`ready` enum as `specsLandIn`, so
+	// `DORFL_UNTRUSTED_SPECS_LAND_IN=ready` works and a typo FAILS LOUDLY. Same
+	// precedence chain (flag > env > per-repo > global > built-in `proposed`).
+	untrustedSpecsLandIn: {enum: ['proposed', 'ready']},
 	// `noPR` (the PR-INTENT axis) is a BOOLEAN coercion (like `review`), so
 	// `DORFL_NO_PR=true|false` works and a typo FAILS LOUDLY. The removed
 	// `provider` override has NO env var (a stale `DORFL_PROVIDER` is ignored