dorfl 0.8.0 → 0.10.0

package/src/intake-trigger-template.ts

@@ -6,9 +6,11 @@
  * STRUCTURALLY VALIDATES it, mirroring the snapshot-assertion style of
  * `advance-lifecycle-template.ts` / `advance-ci-template.ts` (the package depends on
  * NO YAML lib, so the checks are presence/shape assertions over the raw text). It
- * ALSO carries the PURE author-trust → per-outcome-flags DERIVATION
- * ({@link deriveIntakeFlags}) — CI's merge-vs-propose POLICY, the load-bearing
- * testable logic the workflow encodes at runtime.
+ * ALSO carries the PURE intake-flags DERIVATION ({@link deriveIntakeFlags}) —
+ * CI's merge-vs-propose POLICY, the load-bearing testable logic the workflow
+ * encodes at runtime. The DOCUMENT mode is the resolved `intakeIntegration`
+ * (operator/config); author-trust drives ONLY the `--origin-trust` stamp +
+ * placement, never the mode.
  *
  * SCOPE FENCE (spec Out-of-Scope): the issue→artifact TRANSFORM engine is
  * `issue-intake`'s (`intake <N>` + its four-outcome dispatch + the per-outcome
@@ -27,14 +29,23 @@
  *     (re-)evaluation; an EDITED comment is NOT a trigger (the ID-based
  *     `seen=<ids>` watermark suffices). The "post a NEW comment to signal an edit"
  *     convention is documented in the workflow so a human knows to re-trigger.
- *   - AUTHOR-TRUST → per-outcome FLAGS (Decision 1, {@link deriveIntakeFlags}): an
- *     UNTRUSTED author (`author_association` not in OWNER/MEMBER/COLLABORATOR)
- *     forces `--propose-task` REGARDLESS of the `autoBuild` gate, while
- *     `--merge-spec` stays allowed (a human still tasks a spec before anything
- *     autonomous acts — the checkpoint is intact). A TRUSTED author gets the plain
- *     gate-derived mode for both. The fully-gateless "all gates on + merge
- *     everywhere" path is a LOUD, NON-DEFAULT opt-in — the default is conservative
- *     (propose / human-in-the-loop).
+ *   - INTAKE-INTEGRATION → the file-emit MODE; AUTHOR-TRUST → PLACEMENT + the
+ *     STAMP (ADR `untrusted-origin-carries-via-stamp-not-forced-staging`; spec
+ *     `intake-integration-knob-and-specs-land-in-proposed-rename`; {@link
+ *     deriveIntakeFlags}): the intake DOCUMENT mode (merge-vs-propose for a
+ *     task/spec FILE) is the resolved `intakeIntegration ?? integration` — an
+ *     operator/config choice, a SINGLE value applied to BOTH the task and the spec
+ *     document, DECOUPLED from the autonomy gates. `autoBuild`/`autoTask` no
+ *     longer feed the document mode (they mean ONLY "may an agent act
+ *     autonomously"). Author-trust feeds exactly (1) the `--origin-trust` STAMP
+ *     (`author_association` not in OWNER/MEMBER/COLLABORATOR ⇒ `untrusted`) and
+ *     (2) — via that stamp, read by `intake`'s dispatch — which PLACEMENT default
+ *     (`untrusted*LandIn` vs `*LandIn`) the emitted document lands in. Untrusted
+ *     safety is the CARRIED stamp (it forces the BUILD transition to a code PR)
+ *     plus the placement default, NOT a forced document PR. A document therefore
+ *     merges to `main` regardless of who filed the issue OR whether the gates are
+ *     on; whether it is reviewed-as-a-PR is purely the `intakeIntegration`
+ *     operator config, not a trust or autonomy consequence.
  *   - INSERTION POINT E (the issue-thread review surface): the review verdict over
  *     intake's generated specs/tasks is surfaced into the ISSUE THREAD via the
  *     `IssueProvider.postIssueComment` seam (issue thread, by NUMBER — NOT the PR
@@ -98,77 +109,101 @@ export const TRUSTED_AUTHOR_ASSOCIATIONS = [
  * The per-outcome integration flags CI passes to `intake <N>` — the GRANULAR
  * per-type pair (the aggregates `--merge`/`--propose` are not needed because CI
  * always resolves BOTH types explicitly). Each is `'merge'` or `'propose'`.
+ *
+ * Both {@link spec} and {@link task} are the SAME resolved `intakeIntegration`
+ * value (spec `intake-integration-knob-and-specs-land-in-proposed-rename` US #1
+ * chose a SINGLE intake-document knob, NOT a per-type split): the pair is kept
+ * only because `intake`'s CLI consumes `--merge-task`/`--merge-spec` on two flag
+ * axes, not because task and spec can differ. Both are DECOUPLED from the autonomy
+ * gates and trust-INDEPENDENT (ADR
+ * `untrusted-origin-carries-via-stamp-not-forced-staging`): `autoBuild`/`autoTask`
+ * no longer compose into the document mode, and author-trust never did. The trust
+ * signal rides only {@link originTrust} (the stamp), which `intake`'s dispatch
+ * reads to select the untrusted-side PLACEMENT default. So `spec`/`task` here
+ * answer "does the DOCUMENT merge or open a PR", derived purely from the resolved
+ * `intakeIntegration` operator config — never from who filed the issue nor whether
+ * an agent may act autonomously.
  */
 export interface IntakeIntegrationFlags {
-	/** The spec outcome's mode → `--merge-spec` / `--propose-spec`. */
+	/**
+	 * The spec outcome's mode → `--merge-spec` / `--propose-spec`. The resolved
+	 * `intakeIntegration ?? integration` (operator/config), IDENTICAL to
+	 * {@link task} — the single intake-document knob applied to the spec axis.
+	 */
 	spec: 'merge' | 'propose';
-	/** The task outcome's mode → `--merge-task` / `--propose-task`. */
+	/**
+	 * The task outcome's mode → `--merge-task` / `--propose-task`. The resolved
+	 * `intakeIntegration ?? integration` (operator/config), IDENTICAL to
+	 * {@link spec} — the single intake-document knob applied to the task axis.
+	 * Neither the autonomy gates nor author-trust force this: an untrusted author's
+	 * task DOCUMENT merges to `main` exactly like a trusted one when
+	 * `intakeIntegration` is `merge` (the untrusted safety is the carried
+	 * {@link originTrust} stamp — which forces the BUILD to a code PR — plus the
+	 * placement default, NOT a forced document PR).
+	 */
 	task: 'merge' | 'propose';
 	/**
 	 * The ORIGIN-TRUST verdict CI passes to `intake <N>` via `--origin-trust`
 	 * (task `untrusted-origin-forces-build-propose`) so the emitted spec/task is
-	 * STAMPED with how it was born. Derived from the SAME `author_association` case
-	 * as the integration flags (it IS `authorTrusted` collapsed to the wire value),
-	 * so the stamp and the integration mode CANNOT desync. `intake.ts` writes it
-	 * verbatim onto the frontmatter — it never re-resolves trust (the `intake.ts`
-	 * ~L296 boundary: author-trust is CI's POLICY, passed IN, not resolved here).
+	 * STAMPED with how it was born. This is now the SOLE thing author-trust drives
+	 * on the wire: `intake`'s dispatch reads this stamp to (1) select the
+	 * untrusted-side PLACEMENT default (`untrusted*LandIn`) and (2) force the later
+	 * BUILD transition of an untrusted task to a code PR. Derived from the SAME
+	 * `author_association` case the (gate-derived) modes above see, so it cannot
+	 * desync. `intake.ts` writes it verbatim onto the frontmatter — it never
+	 * re-resolves trust (the `intake.ts` ~L296 boundary: author-trust is CI's
+	 * POLICY, passed IN, not resolved here).
 	 */
 	originTrust: 'trusted' | 'untrusted';
 }
 
-/** The gate state CI composes with author-trust to derive the per-outcome flags. */
-export interface IntakeGateState {
-	/**
-	 * `autoBuild` — whether an agent will AUTO-BUILD an undeclared task next. ON ⇒
-	 * a task needs a human PR checkpoint NOW (`--propose-task`); OFF ⇒ a human
-	 * must build it, so it may `--merge-task` (when the author is also trusted).
-	 */
-	autoBuild: boolean;
-	/**
-	 * `autoTask` — whether an agent will AUTO-TASK an undeclared spec next. ON ⇒ a
-	 * spec needs a human PR checkpoint NOW (`--propose-spec`); OFF ⇒ a human must
-	 * task it, so it may `--merge-spec`.
-	 */
-	autoTask: boolean;
-}
-
 /**
- * DERIVE the per-outcome merge-vs-propose flags from the gate state COMPOSED with
- * author-trust — CI's merge-vs-propose POLICY (spec "merge-vs-propose POLICY" +
- * "Composed with AUTHOR-TRUST"; task Decision 1). This is the load-bearing pure
- * logic the workflow encodes at runtime (it reads `author_association` off the
- * event payload and sets the flags accordingly):
+ * DERIVE the per-outcome file-emit modes + the origin-trust stamp — CI's intake
+ * POLICY (ADR `untrusted-origin-carries-via-stamp-not-forced-staging`; spec
+ * `intake-integration-knob-and-specs-land-in-proposed-rename` US #1/#2). This is
+ * the load-bearing pure logic the workflow encodes at runtime (it reads the
+ * resolved `intakeIntegration ?? integration` via `dorfl config --json` for the
+ * MODE, and `author_association` off the event payload for the STAMP):
  *
- *   - **SPEC** — gate-derived ONLY (author-trust does NOT bite): `--merge-spec` iff
- *     `autoTask` is OFF (a human must task the spec before anything autonomous
- *     acts on it — the human checkpoint stays AHEAD even for an untrusted author),
- *     else `--propose-spec`.
- *   - **TASK** — `--propose-task` iff (`autoBuild` ON) OR (author UNTRUSTED);
- *     `--merge-task` ONLY iff (`autoBuild` OFF AND author TRUSTED). An untrusted
- *     author can never auto-merge a task from a public-front-door issue.
+ *   - **DOCUMENT mode (spec = task)** — the resolved `intakeIntegration` value, a
+ *     SINGLE mode applied to BOTH the spec and task document: `merge` ⇒
+ *     `--merge-spec` + `--merge-task`, `propose` ⇒ `--propose-spec` +
+ *     `--propose-task`. DECOUPLED from the autonomy gates: `autoBuild`/`autoTask`
+ *     no longer bite the document mode (they mean ONLY "may an agent act
+ *     autonomously"). So a repo with `autoBuild: true`/`autoTask: true` +
+ *     `intakeIntegration` (or `integration`) `merge` MERGES intake documents to
+ *     `main` — previously impossible (the gates forced a document PR).
+ *   - **ORIGIN-TRUST stamp** — the ONLY thing author-trust drives: `untrusted`
+ *     iff the author is not trusted, else `trusted`. `intake`'s dispatch reads
+ *     this stamp to select the untrusted-side PLACEMENT default and to force the
+ *     later BUILD transition of an untrusted task to a code PR.
  *
- * So the only way to `--merge-task` is a TRUSTED author with `autoBuild` OFF —
- * and the fully-gateless "merge everything" path additionally needs `autoTask`
- * OFF; both gates off + a trusted author is the LOUD, NON-DEFAULT opt-in. The
- * conservative case (untrusted author, or any gate on) keeps a human in the loop.
+ * So author-trust changes ONLY (a) which folder the document lands in (via the
+ * stamp → `untrusted*LandIn`) and (b) the carried stamp — NEVER whether the
+ * DOCUMENT is a PR. Whether a document merges or is proposed is now purely the
+ * `intakeIntegration` operator config, independent of the gates AND of who filed
+ * the issue. The untrusted safety is the stamp (the build-time code PR) plus the
+ * placement default, not a forced document PR (the ADR's core move).
  */
 export function deriveIntakeFlags(options: {
-	gate: IntakeGateState;
+	intakeIntegration: 'merge' | 'propose';
 	authorTrusted: boolean;
 }): IntakeIntegrationFlags {
-	const {gate, authorTrusted} = options;
-	// SPEC: gate-derived only — a human-tasks-it checkpoint stays ahead regardless
-	// of author-trust, so an untrusted author may still --merge-spec.
-	const spec: 'merge' | 'propose' = gate.autoTask ? 'propose' : 'merge';
-	// TASK: propose if the agent will auto-build it (gate ON) OR the author is
-	// untrusted; merge ONLY when both are safe (gate OFF AND author trusted).
-	const task: 'merge' | 'propose' =
-		gate.autoBuild || !authorTrusted ? 'propose' : 'merge';
-	// ORIGIN-TRUST stamp (task `untrusted-origin-forces-build-propose`): the SAME
-	// author-trust verdict, collapsed to the wire value `intake` stamps onto the
-	// emitted artifact. Derived HERE — next to the integration flags, off the SAME
-	// `authorTrusted` input — so the stamp and the task/spec modes cannot desync.
-	// It is NOT a re-resolution of trust (CI already resolved it); it is the verdict
+	const {intakeIntegration, authorTrusted} = options;
+	// DOCUMENT mode: the resolved `intakeIntegration ?? integration` (operator/config),
+	// a SINGLE value applied to BOTH the spec and the task document. Decoupled from
+	// the autonomy gates (ADR untrusted-origin-carries-via-stamp-not-forced-staging;
+	// spec intake-integration-knob-and-specs-land-in-proposed-rename): autoBuild/
+	// autoTask no longer bite the mode, and author-trust never did. The two axes are
+	// kept only because intake's CLI takes --merge-spec/--merge-task separately.
+	const spec: 'merge' | 'propose' = intakeIntegration;
+	const task: 'merge' | 'propose' = intakeIntegration;
+	// ORIGIN-TRUST stamp — the SOLE thing author-trust drives on the wire (task
+	// `untrusted-origin-forces-build-propose`): the author-trust verdict collapsed
+	// to the value `intake` stamps onto the emitted artifact. `intake`'s dispatch
+	// reads it to (1) select the untrusted-side placement default (`untrusted*LandIn`)
+	// and (2) force the later BUILD transition of an untrusted task to a code PR. It
+	// is NOT a re-resolution of trust (CI already resolved it); it is the verdict
 	// being CARRIED so it survives the spec/task merge boundary (the becomes-code
 	// checkpoint is not laundered when the file lands on main).
 	const originTrust: 'trusted' | 'untrusted' = authorTrusted
@@ -204,9 +239,13 @@ export function isAuthorTrusted(
  * shape itself is config-independent.
  *
  * The per-outcome FLAGS are DERIVED AT RUNTIME by a `bash` step that mirrors
- * {@link deriveIntakeFlags}: it reads the gate env block + the event's
- * `author_association` and sets `--merge-spec`/`--propose-spec` +
- * `--merge-task`/`--propose-task` accordingly. The same rule that
+ * {@link deriveIntakeFlags}: it reads the resolved `intakeIntegration ??
+ * integration` via `dorfl config --json` to set the (config-derived) DOCUMENT
+ * mode `--merge-spec`/`--propose-spec` + `--merge-task`/`--propose-task` (a SINGLE
+ * mode applied to both), and the event's `author_association` to set ONLY the
+ * `--origin-trust` STAMP (which carries the placement + build-PR consequence). The
+ * autonomy gates (`autoBuild`/`autoTask`) are NOT read for the document mode (they
+ * mean only "may an agent act autonomously"). The same rule that
  * {@link deriveIntakeFlags} unit-tests is what the workflow executes — they cannot
  * desync because the test asserts the SHELL derivation matches the function.
  */
@@ -237,15 +276,22 @@ export function generateIntakeWorkflow(config: ResolvedCIConfig): string {
 # re-evaluation (a fresh id the watermark catches). There is NO edit-detection /
 # \`updated_at\` / body-hash tracking.
 #
-# AUTHOR-TRUST → per-outcome FLAGS (the merge-vs-propose POLICY): because ANYBODY
-# can file an issue, the merge decision composes with WHO authored it. An UNTRUSTED
-# author (\`author_association\` not OWNER/MEMBER/COLLABORATOR) forces
-# \`--propose-task\` REGARDLESS of the \`autoBuild\` gate — a task from a public
-# front-door issue can never auto-merge — while \`--merge-spec\` stays allowed (a
-# human must still task a spec before anything autonomous acts on it, so the human
-# checkpoint is intact). A TRUSTED author gets the plain gate-derived mode. The
-# fully-gateless "merge everything" path (both gates off + a trusted author) is a
-# LOUD, NON-DEFAULT opt-in; the default is conservative (propose).
+# THE DOCUMENT MODE is \`intakeIntegration\`; AUTHOR-TRUST → PLACEMENT + the STAMP:
+# the intake DOCUMENT merge-vs-propose mode is the resolved \`intakeIntegration ??
+# integration\` (an operator/config choice, a SINGLE value applied to BOTH the task
+# and spec document), DECOUPLED from the autonomy gates (spec
+# intake-integration-knob-and-specs-land-in-proposed-rename; ADR
+# untrusted-origin-carries-via-stamp-not-forced-staging). \`autoBuild\`/\`autoTask\`
+# no longer decide the document mode (they mean only "may an agent act
+# autonomously"). Because ANYBODY can file an issue, WHO authored it still matters —
+# but author-trust drives only (1) the \`--origin-trust\` STAMP on the emitted
+# document and (2), via that stamp read by \`intake\`'s dispatch, which PLACEMENT
+# default the document lands in. So an untrusted author's task DOCUMENT MERGES to
+# \`main\` just like a trusted one when \`intakeIntegration\` is \`merge\`; the
+# untrusted safety is the CARRIED stamp (it forces the later BUILD to a code PR)
+# plus the placement default, not a forced document PR. "Merge everything" is
+# \`intakeIntegration: merge\` (or \`integration: merge\`), independent of the gates
+# AND of who filed the issue — so a repo can have autonomy AND merged documents.
 #
 # CI runs IN-PLACE (the CI container IS the isolation): NO --isolated/--remote/
 # registry (laptop-only affordances). The PER-ISSUE concurrency group below
@@ -291,23 +337,25 @@ permissions:
   pull-requests: write
   issues: write
 
-env:
-  # ── The engine GATE FAMILY, surfaced as the DORFL_* env block ─────────
-  # CI is NOT a special policy surface (ADR ci-config-policy-and-gate-family §5):
-  # it runs the SAME engine gates, resolved through flag > env > per-repo > global
-  # > default. The SAME dorfl.json the laptop uses applies here; this env
-  # block is the optional CI-only override. Change behaviour by editing these
-  # values (or a GitHub repo variable / dorfl.json key) — NOT by re-running
-  # install-ci (ADR §6: install-ci is one-time).
-  #
-  # \`intake\` itself is GATE-FREE (the explicit invocation is its own
-  # authorization), so these gates do NOT block it — CI READS them to DERIVE the
-  # per-outcome merge-vs-propose flags below (the merge-vs-propose POLICY). CALM
-  # DEFAULTS: both off ⇒ the next step is a HUMAN, so the gate-derived mode is the
-  # permissive merge side; author-trust then forces propose for a task from an
-  # untrusted author.
-  DORFL_AUTO_BUILD: 'false' # gate: will an agent auto-build the emitted task next?
-  DORFL_AUTO_TASK: 'false' # gate: will an agent auto-task the emitted spec next?
+# ── The intake DOCUMENT mode is resolved FROM CONFIG, not carried here ───────
+# CI is NOT a special policy surface (ADR ci-config-policy-and-gate-family §5):
+# it runs the SAME engine config, resolved through flag > env > per-repo > global
+# > default. The SAME dorfl.json the laptop uses applies here. This workflow emits
+# NO DORFL_AUTO_BUILD / DORFL_AUTO_TASK line (ADR
+# untrusted-origin-carries-via-stamp-not-forced-staging: hardcoding them here made
+# the env layer OUTRANK the committed dorfl.json — the shadowing bug). So the env
+# layer carries NO config default; the policy step below READS the resolved intake
+# DOCUMENT mode \`intakeIntegration ?? integration\` via \`dorfl config --json\` (the
+# mechanism \`advance\` already uses), so your committed dorfl.json wins (then the
+# global config, then the built-in default \`propose\`). To land intake documents on
+# main, set \`intakeIntegration: merge\` (or \`integration: merge\`) in dorfl.json
+# (applies everywhere) — NOT by re-running install-ci (ADR §6: install-ci is
+# one-time). The autonomy gates \`autoBuild\`/\`autoTask\` are DECOUPLED from the
+# document mode (spec intake-integration-knob-and-specs-land-in-proposed-rename):
+# they gate autonomy only and are NOT read here. \`intake\` itself is GATE-FREE (the
+# explicit invocation is its own authorization); CI READS only the resolved
+# \`intakeIntegration\`/\`integration\` to DERIVE the merge-vs-propose document flags
+# below (the merge-vs-propose POLICY).
 
 jobs:
   intake:
@@ -322,16 +370,23 @@ jobs:
           fetch-depth: 0
       - uses: ./.github/actions/dorfl-setup${setupWith}
 
-      - name: derive the per-outcome merge-vs-propose flags (gate × author-trust)
+      - name: derive the intake DOCUMENT mode (intakeIntegration) + the origin-trust stamp (author-trust)
         id: policy
-        # The merge-vs-propose POLICY, executed at runtime — the SAME rule
+        # The intake POLICY, executed at runtime — the SAME rule
         # \`deriveIntakeFlags\` unit-tests (they cannot desync; the test asserts this
-        # shell matches the function):
-        #   * SPEC — gate-derived ONLY: --merge-spec iff autoTask OFF (a human
-        #            tasks it before anything autonomous acts — the checkpoint
-        #            stays ahead even for an UNTRUSTED author), else --propose-spec.
-        #   * TASK  — --propose-task iff (autoBuild ON) OR (author UNTRUSTED);
-        #            --merge-task ONLY iff (autoBuild OFF AND author TRUSTED).
+        # shell matches the function). The DOCUMENT mode is the resolved
+        # \`intakeIntegration ?? integration\` (operator/config), DECOUPLED from the
+        # autonomy gates; author-trust drives ONLY the stamp + placement (ADR
+        # untrusted-origin-carries-via-stamp-not-forced-staging; spec
+        # intake-integration-knob-and-specs-land-in-proposed-rename):
+        #   * DOCUMENT mode (spec = task) — config-derived: --merge-* iff the
+        #            resolved intakeIntegration is merge, else --propose-*. A SINGLE
+        #            value applied to BOTH the spec and task document. autoBuild/
+        #            autoTask are NOT read (they gate autonomy only).
+        #   * ORIGIN-TRUST stamp — the ONLY thing author-trust drives: --origin-trust
+        #            untrusted iff the author is not OWNER/MEMBER/COLLABORATOR, which
+        #            \`intake\`'s dispatch reads to select the untrusted PLACEMENT
+        #            default and to force the later BUILD to a code PR.
         # author_association comes from the COMMENT on an \`issue_comment\` event,
         # else the ISSUE on an \`issues\` event — read straight off the payload, no
         # extra API call.
@@ -340,37 +395,53 @@ jobs:
         run: |
           set -euo pipefail
 
-          # SPEC flag: gate-derived only (author-trust does NOT bite a spec).
-          if [ "\${DORFL_AUTO_TASK}" = "true" ]; then
-            spec_flag="--propose-spec"
-          else
+          # Read the RESOLVED intake DOCUMENT mode from the committed config via
+          # \`dorfl config --json\` (the mechanism \`advance\` already uses), NOT a
+          # hardcoded DORFL_* env (ADR
+          # untrusted-origin-carries-via-stamp-not-forced-staging: an env default
+          # would OUTRANK dorfl.json — the shadowing bug). In-place, so the
+          # resolution chain reads THIS repo's dorfl.json exactly like the laptop.
+          # \`intakeIntegration\` is OPTIONAL (unset ⇒ falls back to \`integration\`),
+          # so read \`.intakeIntegration // .integration\` in ONE jq expression — the
+          # shell twin of the \`intakeIntegration ?? integration\` the CLI applies.
+          # The autonomy gates (autoBuild/autoTask) are DECOUPLED from the document
+          # mode (spec intake-integration-knob-and-specs-land-in-proposed-rename):
+          # they gate autonomy only and are NOT read here.
+          config_json="$(dorfl config --json)"
+          intake_integration="$(echo "\${config_json}" | jq -r '.intakeIntegration // .integration')"
+
+          # DOCUMENT mode: config-derived from the single \`intakeIntegration ??
+          # integration\` value, applied to BOTH the spec and task document (US #1
+          # chose one intake knob, not a per-type split). merge ⇒ --merge-*,
+          # else --propose-*. Author-trust does NOT bite the mode (ADR
+          # untrusted-origin-carries-via-stamp-not-forced-staging): an untrusted
+          # author's DOCUMENT merges just like a trusted one; the untrusted safety
+          # is the stamp + placement below, not a document PR.
+          if [ "\${intake_integration}" = "merge" ]; then
             spec_flag="--merge-spec"
+            task_flag="--merge-task"
+          else
+            spec_flag="--propose-spec"
+            task_flag="--propose-task"
           fi
 
           # Author-trust: TRUSTED iff OWNER/MEMBER/COLLABORATOR (admin / write-
           # collaborator — the whole signal). Anything else (incl. empty) is
-          # UNTRUSTED → the conservative, human-in-the-loop path.
+          # UNTRUSTED. It drives ONLY the origin-trust stamp below (NOT the modes).
           trusted="false"
           case "\${AUTHOR_ASSOCIATION:-}" in
             OWNER|MEMBER|COLLABORATOR) trusted="true" ;;
           esac
 
-          # TASK flag: propose if the agent will auto-build it (gate ON) OR the
-          # author is untrusted; merge ONLY when both are safe.
-          if [ "\${DORFL_AUTO_BUILD}" = "true" ] || [ "\${trusted}" != "true" ]; then
-            task_flag="--propose-task"
-          else
-            task_flag="--merge-task"
-          fi
-
-          # ORIGIN-TRUST stamp (task untrusted-origin-forces-build-propose):
-          # derived from the SAME \${trusted} case above (one author-trust read,
-          # two consumers — the task/spec modes AND the stamp — so they cannot
-          # desync). \`intake\` STAMPS this onto the emitted spec/task frontmatter
-          # (origin: issue + originTrust: <value>); it does NOT re-resolve trust
-          # (that is CI's policy, passed IN). The stamp SURVIVES the merge boundary
-          # so a later auto-task/auto-build of an untrusted-origin artifact still
-          # forces a human becomes-code checkpoint (the laundering gap is closed).
+          # ORIGIN-TRUST stamp — the SOLE thing author-trust drives on the wire
+          # (task untrusted-origin-forces-build-propose). \`intake\` STAMPS this
+          # onto the emitted spec/task frontmatter (origin: issue + originTrust:
+          # <value>); its dispatch reads the stamp to (1) select the untrusted-side
+          # PLACEMENT default (\`untrusted*LandIn\`) and (2) force the later BUILD of
+          # an untrusted task to a code PR. It does NOT re-resolve trust (that is
+          # CI's policy, passed IN). The stamp SURVIVES the merge boundary so a
+          # later auto-task/auto-build of an untrusted-origin artifact still forces
+          # a human becomes-code checkpoint (the laundering gap is closed).
           if [ "\${trusted}" = "true" ]; then
             origin_trust_flag="--origin-trust=trusted"
           else
@@ -380,12 +451,15 @@ jobs:
           echo "spec_flag=\${spec_flag}" >> "\$GITHUB_OUTPUT"
           echo "task_flag=\${task_flag}" >> "\$GITHUB_OUTPUT"
           echo "origin_trust_flag=\${origin_trust_flag}" >> "\$GITHUB_OUTPUT"
-          echo "intake policy: author_association='\${AUTHOR_ASSOCIATION:-}' trusted=\${trusted} → \${spec_flag} \${task_flag} \${origin_trust_flag}"
+          echo "intake policy: intakeIntegration='\${intake_integration}' author_association='\${AUTHOR_ASSOCIATION:-}' trusted=\${trusted} → \${spec_flag} \${task_flag} \${origin_trust_flag}"
 
       - name: intake the issue (four-outcome dispatch; surfaces the review verdict into the thread)
         # In-place in this checkout (no --isolated/--remote): the CI container IS
         # the isolation. EXPLICIT \`intake <N>\`, never a bare slug. The per-outcome
-        # flags carry the merge-vs-propose POLICY derived above. \`intake\` runs the
+        # flags carry the (intakeIntegration-derived) document modes + the
+        # origin-trust stamp derived above (author-trust drives only the stamp +
+        # placement, not the document merge-vs-propose; the autonomy gates drive
+        # neither). \`intake\` runs the
         # lone-task review/edit loop and posts its findings as questions back into
         # THIS issue thread (insertion point E) through the issue-comment seam —
         # CI surfaces E by invoking intake; it adds no new review mechanism.
@@ -498,29 +572,33 @@ export function validateIntakeWorkflow(text: string): IntakeTriggerValidation {
 		text,
 	), 'author-trust must be OWNER/MEMBER/COLLABORATOR (admin / write-collaborator ' +
 		'— the whole signal; Decision 1).');
-	// An untrusted author forces --propose-task; the derivation must emit both
-	// task modes (so the untrusted path can reach propose and the trusted-safe
-	// path can reach merge).
+	// The DOCUMENT mode is intakeIntegration-DERIVED (spec
+	// intake-integration-knob-and-specs-land-in-proposed-rename; the autonomy gates
+	// no longer bite it): the derivation must be able to emit both task modes
+	// (merge iff the resolved intakeIntegration is merge, else propose).
 	require('derives-propose-task', /--propose-task\b/.test(
 		operative,
 	), 'the policy derivation must be able to emit `--propose-task` (the ' +
-		'untrusted-author / autoBuild-on fallback).');
+		'intakeIntegration-propose path).');
 	require('derives-merge-task', /--merge-task\b/.test(
 		operative,
 	), 'the policy derivation must be able to emit `--merge-task` (the ' +
-		'trusted-author + autoBuild-off path).');
-	// --merge-spec stays allowed even for an untrusted author (spec checkpoint ahead).
+		'intakeIntegration-merge path; a task DOCUMENT merges regardless of the ' +
+		'autonomy gates or author-trust).');
+	// --merge-spec is emitted when the resolved intakeIntegration is merge (the
+	// SAME single value as the task; the gates do not bite it).
 	require('derives-merge-spec', /--merge-spec\b/.test(
 		operative,
-	), 'the policy derivation must be able to emit `--merge-spec` (a spec stays ' +
-		'mergeable even for an untrusted author — the human-tasks-it checkpoint).');
+	), 'the policy derivation must be able to emit `--merge-spec` (the ' +
+		'intakeIntegration-merge path).');
 	require('derives-propose-spec', /--propose-spec\b/.test(
 		operative,
-	), 'the policy derivation must be able to emit `--propose-spec` (autoTask on).');
+	), 'the policy derivation must be able to emit `--propose-spec` (the ' +
+		'intakeIntegration-propose path).');
 	// ORIGIN-TRUST stamp (task untrusted-origin-forces-build-propose): the shell
-	// must derive `--origin-trust <trusted|untrusted>` from the SAME author-trust
-	// case it uses for the task/SPEC modes, and pass it to `intake` so the emitted
-	// artifact is stamped (the stamp + the modes cannot desync).
+	// must derive `--origin-trust <trusted|untrusted>` from the author-trust case
+	// (independent of the document mode) and pass it to `intake` so the emitted
+	// artifact is stamped (the stamp is the SOLE thing author-trust drives).
 	require('derives-origin-trust-untrusted', /--origin-trust=untrusted\b/.test(
 		operative,
 	), 'the policy derivation must emit `--origin-trust=untrusted` for a non-trusted ' +
@@ -533,13 +611,55 @@ export function validateIntakeWorkflow(text: string): IntakeTriggerValidation {
 		operative,
 	), 'the intake invocation must pass the derived `--origin-trust` flag (the ' +
 		'stamp must reach `dorfl intake`).');
-	// The derivation must compose the gate env block (it READS the gates to derive).
-	require('reads-auto-build-gate', /DORFL_AUTO_BUILD\b/.test(
-		text,
-	), 'the policy derivation must read the `DORFL_AUTO_BUILD` gate.');
-	require('reads-auto-task-gate', /DORFL_AUTO_TASK\b/.test(
-		text,
-	), 'the policy derivation must read the `DORFL_AUTO_TASK` gate.');
+	// The derivation must read the RESOLVED intake DOCUMENT mode via `dorfl config
+	// --json` (the mechanism `advance` uses), NOT a hardcoded DORFL_* env (ADR
+	// untrusted-origin-carries-via-stamp-not-forced-staging — the shadowing bug).
+	require('reads-config-json', /dorfl config --json/.test(
+		operative,
+	), 'the policy derivation must read the resolved config via ' +
+		'`dorfl config --json` (as `advance` does), so a committed `dorfl.json` ' +
+		'mode is honored in CI (not shadowed by a hardcoded env).');
+	// The DOCUMENT mode is the resolved `intakeIntegration ?? integration` (spec
+	// intake-integration-knob-and-specs-land-in-proposed-rename): the derivation
+	// must read `.intakeIntegration` with a `.integration` FALLBACK (the shell twin
+	// of `intakeIntegration ?? integration`), NOT the autonomy gates. Pin BOTH the
+	// key and the fallback so a regression to a gate-derived mode is caught.
+	require('reads-intake-integration', /\.intakeIntegration\b/.test(
+		operative,
+	), 'the policy derivation must read the resolved `intakeIntegration` mode (jq ' +
+		'`.intakeIntegration` off `dorfl config --json`) for the document mode.');
+	require('intake-integration-falls-back-to-integration', /\.intakeIntegration\s*\/\/\s*\.integration/.test(
+		operative,
+	), 'the policy derivation must fall back to `.integration` when ' +
+		'`intakeIntegration` is unset (jq `.intakeIntegration // .integration`, the ' +
+		'shell twin of `intakeIntegration ?? integration`).');
+	// The DOCUMENT mode must NOT be derived from the autonomy gates (spec
+	// intake-integration-knob-and-specs-land-in-proposed-rename: autoBuild/autoTask
+	// gate autonomy ONLY, never the document PR-mode). The mode branch must not read
+	// `.autoBuild` / `.autoTask` off the config json.
+	require('mode-not-gate-derived', !/\.auto(?:Build|Task)\b/.test(
+		operative,
+	), 'the intake DOCUMENT mode must be derived from `intakeIntegration ?? ' +
+		'integration`, NOT the autonomy gates — the derivation must not read ' +
+		'`.autoBuild` / `.autoTask` (they gate autonomy only; spec ' +
+		'intake-integration-knob-and-specs-land-in-proposed-rename).');
+	// ANTI-REGRESSION (ADR untrusted-origin-carries-via-stamp-not-forced-staging;
+	// spec US #12): the workflow must NOT emit a `DORFL_AUTO_BUILD:` /
+	// `DORFL_AUTO_TASK:` env ASSIGNMENT. The env layer OUTRANKS per-repo config, so
+	// a hardcoded default here SHADOWS the committed `dorfl.json` gates (the bug this
+	// task fixes). Mirrors `advance-lifecycle-template.ts`'s `no-gate-env-auto-build`
+	// / `no-gate-env-auto-task`. Checked over the OPERATIVE (non-comment) lines so
+	// the header comment that NAMES these keys is not a false positive.
+	require('no-gate-env-auto-build', !/DORFL_AUTO_BUILD\s*:/.test(
+		operative,
+	), 'the workflow must NOT emit a `DORFL_AUTO_BUILD:` env assignment (env ' +
+		'carries no defaults; the gate is resolved from per-repo config / built-in ' +
+		'default — else the env SHADOWS the committed dorfl.json).');
+	require('no-gate-env-auto-task', !/DORFL_AUTO_TASK\s*:/.test(
+		operative,
+	), 'the workflow must NOT emit a `DORFL_AUTO_TASK:` env assignment (env ' +
+		'carries no defaults; the gate is resolved from per-repo config / built-in ' +
+		'default — else the env SHADOWS the committed dorfl.json).');
 
 	// --- Insertion point E: the issue-thread review surface ---------------------
 	// E is REUSED via `intake` (which runs the lone-task review and posts to the