dorfl 0.8.1 → 0.10.1

package/src/cli.ts

@@ -400,11 +400,13 @@ function buildRegistrySetAdvanceTick(options: {
 				// The per-TRANSITION TASKING override: the `do spec:` tasking path threads
 				// `taskingIntegration ?? integration`; the build path stays on `integration`.
 				taskingIntegration: config.taskingIntegration,
-				// The TASK-PLACEMENT configured default (`do spec:` tasking output:
+				// The TASK-PLACEMENT configured defaults (`do spec:` tasking output:
 				// `backlog` staged vs `ready` pool). No operator flag on this
-				// registry-driven advance context, so only the configured default rung is
-				// threaded (the resolver still layers untrusted-origin force + built-in floor).
+				// registry-driven advance context, so only the configured default rungs
+				// are threaded (trusted + the untrusted twin the tasker selects from the
+				// spec's stamp; the resolver layers the built-in floor).
 				tasksLandIn: config.tasksLandIn,
+				untrustedTasksLandIn: config.untrustedTasksLandIn,
 				prepare: config.prepare,
 				verify: config.verify,
 				// Single-job build path: gate the REBASED tip (the default) unconditionally.
@@ -719,13 +721,13 @@ function explicitTasksLandInFromFlag(
 function explicitSpecsLandInFromFlag(
 	raw: string | undefined,
 	flagName = '--specs-land-in',
-): 'pre-proposed' | 'ready' | undefined {
+): 'proposed' | 'ready' | undefined {
 	if (raw === undefined) {
 		return undefined;
 	}
-	if (raw !== 'pre-proposed' && raw !== 'ready') {
+	if (raw !== 'proposed' && raw !== 'ready') {
 		throw new Error(
-			`${flagName} must be 'pre-proposed' or 'ready' (got '${raw}').`,
+			`${flagName} must be 'proposed' or 'ready' (got '${raw}').`,
 		);
 	}
 	return raw;
@@ -800,8 +802,10 @@ interface IntakeFlags {
 	 * flags. UNSET (a local intake) ⇒ emit unstamped ⇒ human/trusted.
 	 */
 	originTrust?: string;
-	/** `--specs-land-in <pre-proposed|ready>`: the explicit operator spec-placement override (top of the precedence). Resolves into the `specsLandIn` config key. */
+	/** `--specs-land-in <proposed|ready>`: the explicit operator spec-placement override (top of the precedence). Resolves into the `specsLandIn` config key. */
 	specsLandIn?: string;
+	/** `--tasks-land-in <backlog|ready>`: the explicit operator TASK-placement override for a DIRECT-from-issue task emit (top of the precedence). The task twin of `--specs-land-in`. Resolves into the `tasksLandIn` config key. */
+	tasksLandIn?: string;
 	agentCmd?: string;
 	model?: string;
 	harness?: string;
@@ -2592,10 +2596,12 @@ export function buildProgram(): Command {
 					explicitMerge: flagMode === 'merge',
 					// Per-TRANSITION TASKING override (the `do --remote spec:` tasking path).
 					taskingIntegration: remoteConfig.taskingIntegration,
-					// TASK-PLACEMENT: the configured default + the EXPLICIT operator override
-					// (`--tasks-land-in`), the top of the placement precedence — mirrors
-					// `explicitMerge` (set only when the flag was typed).
+					// TASK-PLACEMENT: the configured defaults (trusted + the untrusted twin
+					// the tasker selects from the spec's stamp) + the EXPLICIT operator
+					// override (`--tasks-land-in`), the top of the placement precedence —
+					// mirrors `explicitMerge` (set only when the flag was typed).
 					tasksLandIn: remoteConfig.tasksLandIn,
+					untrustedTasksLandIn: remoteConfig.untrustedTasksLandIn,
 					explicitTasksLandIn: explicitTasksLandInFromFlag(flags.tasksLandIn),
 					prepare: remoteConfig.prepare,
 					verify: remoteConfig.verify,
@@ -2766,12 +2772,13 @@ export function buildProgram(): Command {
 				// `taskingIntegration ?? integration`; the task-build path stays on
 				// `integration`. Unset ⇒ tasking falls back to `integration` (today's behaviour).
 				taskingIntegration: config.taskingIntegration,
-				// TASK-PLACEMENT (`do spec:` tasking output): the configured default rung +
+				// TASK-PLACEMENT (`do spec:` tasking output): the configured default rungs
+				// (trusted + the untrusted twin the tasker selects from the spec's stamp) +
 				// the EXPLICIT operator override `--tasks-land-in` (top of the precedence).
 				// `explicitTasksLandIn` is set ONLY when the flag was typed (mirrors
-				// `explicitMerge`), so an untrusted-origin staging force still wins under a
-				// config default.
+				// `explicitMerge`).
 				tasksLandIn: config.tasksLandIn,
+				untrustedTasksLandIn: config.untrustedTasksLandIn,
 				explicitTasksLandIn: explicitTasksLandInFromFlag(flags.tasksLandIn),
 				// In-place divergence guard override (mirrors --ignore-not-ready).
 				ignoreDivergedMain: flags.ignoreDivergedMain === true,
@@ -3104,9 +3111,10 @@ export function buildProgram(): Command {
 					explicitMerge: flagMode === 'merge',
 					// Per-TRANSITION TASKING override (the isolated `do --remote spec:` path).
 					taskingIntegration: remoteConfig.taskingIntegration,
-					// TASK-PLACEMENT: configured default + EXPLICIT `--tasks-land-in` override
-					// (set only when typed, mirroring `explicitMerge`).
+					// TASK-PLACEMENT: configured defaults (trusted + untrusted twin) + EXPLICIT
+					// `--tasks-land-in` override (set only when typed, mirroring `explicitMerge`).
 					tasksLandIn: remoteConfig.tasksLandIn,
+					untrustedTasksLandIn: remoteConfig.untrustedTasksLandIn,
 					explicitTasksLandIn: explicitTasksLandInFromFlag(flags.tasksLandIn),
 					prepare: remoteConfig.prepare,
 					verify: remoteConfig.verify,
@@ -3247,9 +3255,10 @@ export function buildProgram(): Command {
 				// Per-TRANSITION TASKING override (the `do spec:` tasking path threads
 				// `taskingIntegration ?? integration`; the build path stays on `integration`).
 				taskingIntegration: config.taskingIntegration,
-				// TASK-PLACEMENT: configured default + EXPLICIT `--tasks-land-in` override
-				// (set only when typed, mirroring `explicitMerge`).
+				// TASK-PLACEMENT: configured defaults (trusted + untrusted twin) + EXPLICIT
+				// `--tasks-land-in` override (set only when typed, mirroring `explicitMerge`).
 				tasksLandIn: config.tasksLandIn,
+				untrustedTasksLandIn: config.untrustedTasksLandIn,
 				explicitTasksLandIn: explicitTasksLandInFromFlag(flags.tasksLandIn),
 				prepare: config.prepare,
 				verify: config.verify,
@@ -3643,8 +3652,15 @@ export function buildProgram(): Command {
 					`  [retained] ${retained.slug} \u2014 ${RETAIN_REASON_TEXT[retained.reason]}`,
 				);
 			}
+			for (const orphan of result.sweptOrphans) {
+				console.log(`  [swept]    ${orphan.dir} \u2014 ${orphan.kind}`);
+			}
+			const orphanNote =
+				result.sweptOrphans.length > 0
+					? `, ${result.sweptOrphans.length} orphan(s) swept`
+					: '';
 			console.log(
-				`Summary: ${result.reaped.length} reaped, ${result.retained.length} retained.`,
+				`Summary: ${result.reaped.length} reaped, ${result.retained.length} retained${orphanNote}.`,
 			);
 		});
 
@@ -4277,7 +4293,11 @@ export function buildProgram(): Command {
 		)
 		.option(
 			'--specs-land-in <where>',
-			'where an intake-authored spec lands: `pre-proposed` (staged, not auto-taskable) or `ready` (the auto-tasking pool). The EXPLICIT operator override at the top of the placement precedence (explicit flag > untrusted-origin forces staging > specsLandIn default > built-in). Resolved flag > env (DORFL_SPECS_LAND_IN) > per-repo > global > built-in.',
+			'where an intake-authored spec lands: `proposed` (staged, not auto-taskable) or `ready` (the auto-tasking pool). The EXPLICIT operator override at the top of the placement precedence (explicit flag > untrusted-origin forces staging > specsLandIn default > built-in). Resolved flag > env (DORFL_SPECS_LAND_IN) > per-repo > global > built-in.',
+		)
+		.option(
+			'--tasks-land-in <where>',
+			'where an intake-authored TASK (emitted DIRECTLY from an issue) lands: `backlog` (staged, not agent-eligible) or `ready` (the agent POOL). The task twin of --specs-land-in: the EXPLICIT operator override at the top of the placement precedence (explicit flag > configured default > built-in staging; the caller selects the trusted-vs-untrusted default from the origin-trust stamp). Resolved flag > env (DORFL_TASKS_LAND_IN) > per-repo > global > built-in.',
 		)
 		.option('--agent-cmd <cmd>', 'command to run the decision agent')
 		.option(
@@ -4327,14 +4347,21 @@ export function buildProgram(): Command {
 			// Resolve the PER-OUTCOME integration modes (spec US #9): `intake` decides
 			// the artifact TYPE at runtime, so a single --merge/--propose can't express
 			// a type-conditional policy. The granular flags override the aggregate; an
-			// UNSET type falls back to the per-repo/global `integration` (the SAME chain
-			// `do`/`complete` use — flag > per-repo > global > default propose). `intake`
-			// is GATE-FREE, so autoTask/autoBuild are NOT consulted (the explicit
-			// invocation is its own authorization). `intake` owns only these KNOBS; WHICH
-			// knobs CI sets is CI's POLICY (`runner-in-ci`), NOT here.
+			// UNSET type falls back to the per-repo/global `intakeIntegration ??
+			// integration` (the INTAKE-DOCUMENT knob, twin of the tasking path's
+			// `taskingIntegration ?? integration`; spec
+			// `intake-integration-knob-and-specs-land-in-proposed-rename`). DECOUPLED
+			// from the autonomy gates: `intake` is GATE-FREE, so autoTask/autoBuild are
+			// NOT consulted for the document mode (the explicit invocation is its own
+			// authorization; ADR untrusted-origin-carries-via-stamp-not-forced-staging).
+			// `intake` owns only these KNOBS; WHICH knobs CI sets is CI's POLICY
+			// (`runner-in-ci`), NOT here.
 			let modes;
 			try {
-				modes = resolveIntakeIntegrationModes(flags, config.integration);
+				modes = resolveIntakeIntegrationModes(
+					flags,
+					config.intakeIntegration ?? config.integration,
+				);
 			} catch (err) {
 				console.error(
 					`error: ${err instanceof Error ? err.message : String(err)}`,
@@ -4367,7 +4394,7 @@ export function buildProgram(): Command {
 			// The OPERATOR's EXPLICIT spec-placement override (`--specs-land-in`), the
 			// TOP of the placement precedence — mirrors `explicitTasksLandInFromFlag` on
 			// the `do spec:` path. Fails loudly on a bad value.
-			let explicitSpecsLandIn: 'pre-proposed' | 'ready' | undefined;
+			let explicitSpecsLandIn: 'proposed' | 'ready' | undefined;
 			try {
 				explicitSpecsLandIn = explicitSpecsLandInFromFlag(flags.specsLandIn);
 			} catch (err) {
@@ -4376,6 +4403,19 @@ export function buildProgram(): Command {
 				);
 				process.exit(1);
 			}
+			// The OPERATOR's EXPLICIT task-placement override (`--tasks-land-in`), the
+			// TOP of the placement precedence for a DIRECT-from-issue task emit — the
+			// task twin of `explicitSpecsLandIn` above (reuses the same `do`-path
+			// helper). Fails loudly on a bad value.
+			let explicitTasksLandIn: 'backlog' | 'ready' | undefined;
+			try {
+				explicitTasksLandIn = explicitTasksLandInFromFlag(flags.tasksLandIn);
+			} catch (err) {
+				console.error(
+					`error: ${err instanceof Error ? err.message : String(err)}`,
+				);
+				process.exit(1);
+			}
 			const result = await performIntake({
 				issueNumber,
 				cwd,
@@ -4391,11 +4431,25 @@ export function buildProgram(): Command {
 				// The origin-trust stamp the CI shell passes IN (unset ⇒ unstamped).
 				originTrust,
 				noPR: config.noPR,
-				// SPEC-PLACEMENT: the configured-default `specsLandIn` rung + the EXPLICIT
-				// `--specs-land-in` override (top of the precedence). The shared placement
-				// resolver in `intake.ts` overlays the untrusted-origin staging force.
+				// SPEC-PLACEMENT: the TRUSTED-side configured default (`specsLandIn`) +
+				// the UNTRUSTED-side twin (`untrustedSpecsLandIn`, selected in
+				// `dispatchSpec` when the stamp is untrusted) + the EXPLICIT
+				// `--specs-land-in` override (top of the precedence). The placement
+				// resolver no longer has an untrusted-forces-staging rung (ADR
+				// `untrusted-origin-carries-via-stamp-not-forced-staging`); the caller
+				// selects the trusted-vs-untrusted default from the stamp.
 				specsLandIn: config.specsLandIn,
+				untrustedSpecsLandIn: config.untrustedSpecsLandIn,
 				explicitSpecsLandIn,
+				// TASK-PLACEMENT (parity with the spec-placement block above; ADR
+				// `untrusted-origin-carries-via-stamp-not-forced-staging`): the
+				// TRUSTED-side default (`tasksLandIn`) + the UNTRUSTED-side twin
+				// (`untrustedTasksLandIn`, selected in `dispatchTask` when the stamp is
+				// untrusted) + the EXPLICIT `--tasks-land-in` override. Replaces the old
+				// hardcoded `tasks-ready` path; the resolver picks backlog vs ready.
+				tasksLandIn: config.tasksLandIn,
+				untrustedTasksLandIn: config.untrustedTasksLandIn,
+				explicitTasksLandIn,
 				harness,
 				agentCmd: config.agentCmd,
 				model: config.model,

package/src/config.ts

@@ -44,21 +44,23 @@ export type TasksLandIn = 'backlog' | 'ready';
  * `pre-prd-staging-pool-split-and-untrusted-prd-placement`, governing ADR
  * `placement-is-runner-deterministic-humanonly-is-agent-judgement`). Which
  * folder the runner lands `intake`-authored spec files in BY DEFAULT —
- * `'pre-proposed'` (staging — durable + readable but NOT in the auto-tasking
+ * `'proposed'` (staging — durable + readable but NOT in the auto-tasking
  * POOL; a runner/human promotion is needed to make the spec auto-taskable; the
  * on-disk folder for this value is `work/specs/proposed/`) or `'ready'` (the
  * auto-tasking POOL — the trusted fast-path landing, on-disk
  * `work/specs/ready/`). The same runner-deterministic placement RESOLVER
  * (`src/placement.ts`) layers on top:
- * `explicit operator flag > untrusted-origin ⇒ pre-proposed > specsLandIn
- * default > built-in (pre-proposed)`. An untrusted-origin intake spec is FORCED
- * to staging even in a `'ready'` repo (the positional analogue of the existing
- * `untrusted-origin-forces-build-propose` rule). The SPEC twin of
+ * `explicit operator flag > configured default > built-in (proposed)`.
+ * Author-trust is NO LONGER a rung in the resolver (ADR
+ * `untrusted-origin-carries-via-stamp-not-forced-staging`): the CALLER reads the
+ * `originTrust:` stamp and selects the untrusted twin `untrustedSpecsLandIn`
+ * (default `'proposed'`; opt-in `'ready'`) as the configured default for an
+ * untrusted intake spec. The SPEC twin of
  * {@link TasksLandIn}; the SAME shape, the SAME precedence chain. The value
  * spellings mirror the live spec folders (`specs/proposed/` staging,
  * `specs/ready/` pool), exactly as {@link TasksLandIn} mirrors the task folders.
  */
-export type SpecsLandIn = 'pre-proposed' | 'ready';
+export type SpecsLandIn = 'proposed' | 'ready';
 
 /**
  * The observation-triage gate (ADR `ci-config-policy-and-gate-family` §2): a
@@ -357,6 +359,37 @@ export interface Config {
 	 * per-LIFECYCLE-TRANSITION knob, inside the trust boundary, operator/config-only.
 	 */
 	taskingIntegration?: IntegrationMode;
+	/**
+	 * **Per-TRANSITION override for the INTAKE DOCUMENT emit only** — the twin of
+	 * {@link taskingIntegration} for the intake front door. When set, an
+	 * `intake`-emitted DOCUMENT (a task file `work/tasks/*` OR a spec file
+	 * `work/specs/*`) integrates with THIS mode instead of the flat
+	 * {@link integration}; the task-BUILD transition is unaffected (it always reads
+	 * {@link integration}), and neither is the tasking transition (it reads
+	 * {@link taskingIntegration}). UNSET (the default) ⇒ intake falls back to
+	 * {@link integration} — byte-for-byte today's behaviour for any repo that does
+	 * not set it, so a single `integration: 'merge'` merges documents across BOTH
+	 * the tasking and intake transitions with no extra key.
+	 *
+	 * A SINGLE value applies to both the task AND the spec document (spec
+	 * `intake-integration-knob-and-specs-land-in-proposed-rename` US #1 chose a
+	 * single knob, NOT a per-type `{task, spec}` split). Decoupled from the
+	 * AUTONOMY GATES (`autoBuild`/`autoTask`): the intake document PR-mode is now an
+	 * operator/config choice, NOT a function of "may an agent act autonomously" —
+	 * so a repo can have `autoBuild: true`/`autoTask: true` (autonomy) AND intake
+	 * documents merging to `main` at the same time (ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). Untrusted safety is
+	 * unchanged: it rests entirely on placement (`untrusted*LandIn`) + the
+	 * build-time `originTrust: untrusted` stamp (the code PR), never a forced
+	 * document PR. Resolved per-repo like {@link taskingIntegration}: flag
+	 * (`--merge`/`--propose`) > env (`DORFL_INTAKE_INTEGRATION`) > per-repo >
+	 * global > (fall back to) `integration` > default `propose`. The intake CLI's
+	 * explicit `--merge-task`/`--merge-spec`/`--merge`/`--propose` flags still win
+	 * (operator-present, top of precedence). DISTINCT from `taskingIntegration` (a
+	 * DIFFERENT lifecycle transition) — each is its own `merge|propose` mode that
+	 * falls back to `integration`, none tied to an autonomy gate.
+	 */
+	intakeIntegration?: IntegrationMode;
 	/**
 	 * **Per-repo DEFAULT landing for the TASKER's emitted tasks** (spec
 	 * `staging-pool-position-gate-and-trust-model` US #5, task
@@ -377,7 +410,7 @@ export interface Config {
 	 * `staging-pool-position-gate-and-trust-model` US #2/#5/#6/#12). The SPEC twin
 	 * of {@link tasksLandIn}: resolved per-repo EXACTLY like it (flag
 	 * `--specs-land-in` > env `DORFL_SPECS_LAND_IN` > per-repo > global >
-	 * built-in `'pre-proposed'`). `intake`'s spec dispatch reads it and passes it as
+	 * built-in `'proposed'`). `intake`'s spec dispatch reads it and passes it as
 	 * the CONFIGURED-DEFAULT rung into the shared placement resolver
 	 * (`src/placement.ts`); the resolver overlays an EXPLICIT operator flag
 	 * (top) and the UNTRUSTED-ORIGIN force (staging) on top, in that order.
@@ -391,6 +424,48 @@ export interface Config {
 	 * `prdsLandIn` config key + `--prds-land-in` flag are GONE (clean break).
 	 */
 	specsLandIn: SpecsLandIn;
+	/**
+	 * **Per-repo DEFAULT landing for an UNTRUSTED-origin TASK** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	 * US #5/#6, governing ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). The exact TWIN of
+	 * {@link tasksLandIn} for items whose `originTrust` stamp is `untrusted`:
+	 * SAME value shape ({@link TasksLandIn}), SAME resolution chain (flag
+	 * `--untrusted-tasks-land-in` > env `DORFL_UNTRUSTED_TASKS_LAND_IN` >
+	 * per-repo > global > built-in `'backlog'`). The ADR removes the
+	 * untrusted-forces-staging RUNG from the placement resolver; instead the
+	 * CALLER reads the stamp and selects THIS key (vs the trusted
+	 * {@link tasksLandIn}) as the configured-default rung. Governs EVERY
+	 * untrusted-stamped task — intake-authored directly from an issue OR emitted
+	 * by the tasker from an untrusted-origin spec (decision X: one policy, both
+	 * call sites; no third knob). DEFAULTS to STAGING (`'backlog'`), the
+	 * conservative human-admission landing: safety for an untrusted item that
+	 * opts into the pool (`'ready'`) is then the carried build STAMP (a code PR),
+	 * not the folder. CONSUMED at both task call sites: the tasker
+	 * (`performTask`) selects it for an untrusted-origin spec's emitted tasks, and
+	 * intake's direct task emit (`dispatchTask`, a sibling task) selects it for a
+	 * task born straight from an issue.
+	 */
+	untrustedTasksLandIn: TasksLandIn;
+	/**
+	 * **Per-repo DEFAULT landing for an UNTRUSTED-origin intake SPEC** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	 * US #7, governing ADR
+	 * `untrusted-origin-carries-via-stamp-not-forced-staging`). The exact TWIN of
+	 * {@link specsLandIn} for untrusted-stamped intake specs: SAME value shape
+	 * ({@link SpecsLandIn} — `proposed` staging vs `ready` pool), SAME
+	 * resolution chain (flag `--untrusted-specs-land-in` > env
+	 * `DORFL_UNTRUSTED_SPECS_LAND_IN` > per-repo > global > built-in
+	 * `'proposed'`). The caller reads the `originTrust` stamp and selects THIS
+	 * key (vs the trusted {@link specsLandIn}) as the placement resolver's
+	 * configured-default rung. DEFAULTS to STAGING (`'proposed'`) — the
+	 * conservative human-admission landing, preserving today's effective
+	 * behaviour for a repo that configures nothing; a repo opts an untrusted spec
+	 * into the pool (`'ready'`) explicitly, safety then via the carried stamp.
+	 * CONSUMED at the intake SPEC call site (`dispatchSpec`), which selects it
+	 * over {@link specsLandIn} when the intake stamp is `originTrust: untrusted`.
+	 */
+	untrustedSpecsLandIn: SpecsLandIn;
 	/**
 	 * **The PR-INTENT axis** (ADR §6): on the `propose` path, do NOT open a review
 	 * request even on a GitHub arbiter with auth — push the branch (the
@@ -825,14 +900,26 @@ export const DEFAULT_CONFIG: Config = {
 	// The runner-deterministic resolver overlays explicit-flag + untrusted-origin
 	// force on top of this default (`src/placement.ts`).
 	tasksLandIn: 'backlog',
-	// `intake`-authored specs land STAGED (`pre-proposed/`) by default — the
+	// `intake`-authored specs land STAGED (`proposed/`) by default — the
 	// conservative landing that mirrors `tasksLandIn`'s built-in floor: a spec is
 	// durable + readable but NOT in the auto-tasking POOL until a human/runner
 	// promotes it. A repo opts into the trusted fast-path with `specsLandIn: 'ready'`
 	// (or `--specs-land-in ready` / `DORFL_SPECS_LAND_IN=ready`). The same
 	// runner-deterministic resolver overlays explicit-flag + untrusted-origin
 	// force on top of this default (`src/placement.ts`).
-	specsLandIn: 'pre-proposed',
+	specsLandIn: 'proposed',
+	// The untrusted-side placement TWINS default to STAGING (`backlog` /
+	// `proposed`) — the conservative human-admission landing (ADR
+	// `untrusted-origin-carries-via-stamp-not-forced-staging`). A repo that trusts
+	// its stamp-based pipeline opts an untrusted item into the pool (`ready`)
+	// explicitly; safety is then the carried build STAMP (a code PR), not the
+	// folder. Unset ⇒ both resolve to staging, so a repo configuring nothing keeps
+	// today's effective behaviour. NO call site consumes these yet (resolver +
+	// intake/tasker wiring are later tasks); resolved flag > env
+	// (`DORFL_UNTRUSTED_TASKS_LAND_IN` / `DORFL_UNTRUSTED_SPECS_LAND_IN`) > per-repo
+	// > global > built-in, exactly like their trusted twins.
+	untrustedTasksLandIn: 'backlog',
+	untrustedSpecsLandIn: 'proposed',
 	agentCmd: '',
 	// Gate 2 (PR/code review) defaults OFF — it puts a model on the merge path, so
 	// it is opt-in (ADR §8). On an `approve` a resolved `merge` lands automatically

package/src/do.ts

@@ -416,11 +416,21 @@ export interface DoOptions {
 	 * lifecycle concern).
 	 */
 	tasksLandIn?: 'backlog' | 'ready';
+	/**
+	 * **The per-repo UNTRUSTED-side TASK-PLACEMENT default** (spec
+	 * `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`,
+	 * ADR `untrusted-origin-carries-via-stamp-not-forced-staging`). Threaded into
+	 * {@link performTask}, which selects it (over {@link tasksLandIn}) as the
+	 * configured-default rung when the tasked spec carries an
+	 * `originTrust: untrusted` stamp. See {@link performTask}'s
+	 * `untrustedTasksLandIn`.
+	 */
+	untrustedTasksLandIn?: 'backlog' | 'ready';
 	/**
 	 * **The OPERATOR's EXPLICIT task-placement override** (the TOP precedence
 	 * rung in the placement resolver). Set ONLY when the operator typed
 	 * `--tasks-land-in <where>` on this invocation; never when the value came
-	 * from config. Wins over `originTrust: untrusted` (the operator is present;
+	 * from config. Wins over the configured default (the operator is present;
 	 * CLI always wins, no special force-key) — the positional analogue of
 	 * `explicitMerge` overriding the untrusted-origin build-propose rule.
 	 */
@@ -704,6 +714,11 @@ export interface DoRemoteOptions extends DoAgentLaunchOptions {
 	 * configured-default rung. See {@link DoOptions.tasksLandIn}.
 	 */
 	tasksLandIn?: 'backlog' | 'ready';
+	/**
+	 * **The per-repo UNTRUSTED-side TASK-PLACEMENT default** on the `do --remote
+	 * spec:` path. See {@link DoOptions.untrustedTasksLandIn}.
+	 */
+	untrustedTasksLandIn?: 'backlog' | 'ready';
 	/**
 	 * **The OPERATOR's EXPLICIT task-placement override** on the `do --remote
 	 * spec:` path. See {@link DoOptions.explicitTasksLandIn}.
@@ -942,13 +957,16 @@ export async function performDo(options: DoOptions): Promise<DoResult> {
 			// same per-repo cap the build path uses (task
 			// `thread-merge-retries-cross-task-and-ratify-default`).
 			mergeRetries: options.mergeRetries,
-			// The per-repo TASK-PLACEMENT default + the operator's explicit
-			// override (task `runner-deterministic-slice-placement-policy-and-
-			// precedence`). The tasker reads them as the configured-default + the
-			// top rung of the runner-deterministic placement resolver; the
-			// `originTrust: untrusted` force is read inside the tasker from the
-			// spec's stamped frontmatter.
+			// The per-repo TASK-PLACEMENT defaults (trusted + untrusted twin) + the
+			// operator's explicit override (task `runner-deterministic-slice-
+			// placement-policy-and-precedence`; ADR `untrusted-origin-carries-via-
+			// stamp-not-forced-staging`). The tasker reads the spec's stamped
+			// `originTrust:` to SELECT the trusted-vs-untrusted configured default,
+			// then feeds it (with the explicit override on top) into the
+			// runner-deterministic placement resolver (which no longer has a trust
+			// rung).
 			tasksLandIn: options.tasksLandIn,
+			untrustedTasksLandIn: options.untrustedTasksLandIn,
 			explicitTasksLandIn: options.explicitTasksLandIn,
 			noPR: options.noPR,
 			providerInstance: options.providerInstance,
@@ -2372,10 +2390,12 @@ export async function performDoRemote(
 				// threaded on the no-checkout `do --remote spec:` tasking path too,
 				// mirroring the in-place site above.
 				mergeRetries: options.mergeRetries,
-				// The per-repo TASK-PLACEMENT default + the operator's explicit
-				// override (task `runner-deterministic-slice-placement-policy-and-
-				// precedence`). Same threading as the in-place `do spec:` path.
+				// The per-repo TASK-PLACEMENT defaults (trusted + untrusted twin) + the
+				// operator's explicit override. Same stamp-selected threading as the
+				// in-place `do spec:` path (ADR `untrusted-origin-carries-via-stamp-
+				// not-forced-staging`).
 				tasksLandIn: options.tasksLandIn,
+				untrustedTasksLandIn: options.untrustedTasksLandIn,
 				explicitTasksLandIn: options.explicitTasksLandIn,
 				noPR: options.noPR,
 				providerInstance: options.providerInstance,

package/src/env-config.ts

@@ -98,6 +98,14 @@ const KEY_COERCIONS: {[K in keyof Config]?: Coercion} = {
 	// works and a typo FAILS LOUDLY. Unset ⇒ the tasking transition falls back to
 	// `integration` (the flat value). It NEVER touches the build transition or intake.
 	taskingIntegration: {enum: ['propose', 'merge']},
+	// `intakeIntegration` (the per-TRANSITION INTAKE-DOCUMENT override — the twin of
+	// `taskingIntegration` for the intake front door) coerces as the SAME
+	// `propose`/`merge` enum as `integration`, so `DORFL_INTAKE_INTEGRATION`
+	// works and a typo FAILS LOUDLY. Unset ⇒ the intake document emit falls back to
+	// `integration` (the flat value). Decoupled from the autonomy gates
+	// (`autoBuild`/`autoTask`) — the intake document PR-mode is operator/config, not
+	// a function of autonomy (ADR untrusted-origin-carries-via-stamp-not-forced-staging).
+	intakeIntegration: {enum: ['propose', 'merge']},
 	// `tasksLandIn` (the per-repo TASK-PLACEMENT default — spec
 	// `staging-pool-position-gate-and-trust-model` US #5) coerces as the
 	// `backlog`/`ready` enum, so `DORFL_TASKS_LAND_IN=ready` works and a
@@ -108,13 +116,27 @@ const KEY_COERCIONS: {[K in keyof Config]?: Coercion} = {
 	tasksLandIn: {enum: ['backlog', 'ready']},
 	// `specsLandIn` (the per-repo SPEC-PLACEMENT default — spec
 	// `staging-pool-position-gate-and-trust-model` US #2/#5) coerces as the
-	// `pre-proposed`/`ready` enum, so `DORFL_SPECS_LAND_IN=ready` works and a typo
+	// `proposed`/`ready` enum, so `DORFL_SPECS_LAND_IN=ready` works and a typo
 	// FAILS LOUDLY. Same precedence chain as `tasksLandIn` (flag > env > per-repo
-	// > global > built-in `pre-proposed`); fed into the shared placement resolver
+	// > global > built-in `proposed`); fed into the shared placement resolver
 	// (`src/placement.ts`) as the configured-default rung for the spec lifecycle.
 	// The legacy `prdsLandIn` key / `DORFL_PRDS_LAND_IN` env are GONE after the
 	// ''prd'' → `spec` hard cutover (clean break).
-	specsLandIn: {enum: ['pre-proposed', 'ready']},
+	specsLandIn: {enum: ['proposed', 'ready']},
+	// `untrustedTasksLandIn` (the UNTRUSTED-side TWIN of `tasksLandIn` — spec
+	// `untrusted-origin-carries-via-stamp-intake-placement-symmetry-and-ci-gate-resolution`
+	// US #5/#6, ADR `untrusted-origin-carries-via-stamp-not-forced-staging`)
+	// coerces as the SAME `backlog`/`ready` enum as `tasksLandIn`, so
+	// `DORFL_UNTRUSTED_TASKS_LAND_IN=ready` works and a typo FAILS LOUDLY. Same
+	// precedence chain (flag > env > per-repo > global > built-in `backlog`); the
+	// caller selects it (over the trusted `tasksLandIn`) by reading the
+	// `originTrust` stamp before feeding the placement resolver.
+	untrustedTasksLandIn: {enum: ['backlog', 'ready']},
+	// `untrustedSpecsLandIn` (the UNTRUSTED-side TWIN of `specsLandIn` — same spec
+	// US #7) coerces as the SAME `proposed`/`ready` enum as `specsLandIn`, so
+	// `DORFL_UNTRUSTED_SPECS_LAND_IN=ready` works and a typo FAILS LOUDLY. Same
+	// precedence chain (flag > env > per-repo > global > built-in `proposed`).
+	untrustedSpecsLandIn: {enum: ['proposed', 'ready']},
 	// `noPR` (the PR-INTENT axis) is a BOOLEAN coercion (like `review`), so
 	// `DORFL_NO_PR=true|false` works and a typo FAILS LOUDLY. The removed
 	// `provider` override has NO env var (a stale `DORFL_PROVIDER` is ignored

package/src/gc.ts

@@ -1,4 +1,4 @@
-import {existsSync, readdirSync, statSync} from 'node:fs';
+import {existsSync, lstatSync, readdirSync, rmSync, statSync} from 'node:fs';
 import {join} from 'node:path';
 import {git, run} from './git.js';
 import {
@@ -261,11 +261,29 @@ export interface GcOptions {
 	env?: NodeJS.ProcessEnv;
 }
 
+/**
+ * An ORPHAN `<workspacesDir>/work/*` entry `gc` swept: a path git never
+ * registered as a worktree and that carries NO job record — a dangling symlink,
+ * or a bare directory left by a run that crashed BEFORE `git worktree add`
+ * registered it (an early `spawn git ENOENT`). It holds no durable work, so it is
+ * always safe to remove; sweeping it self-heals a half-set-up claim instead of
+ * leaving it to wedge the next `worktree add` ("already exists") until a human
+ * `rm`s it. Reported SEPARATELY from reaped jobs (it was never a real job).
+ */
+export interface SweptOrphan {
+	/** Absolute path to the orphan entry that was removed. */
+	dir: string;
+	/** Whether the orphan was a dangling symlink or an un-registered directory. */
+	kind: 'dangling-symlink' | 'orphan-dir';
+}
+
 export interface GcResult {
 	/** The worktrees reaped this sweep (provably safe, or forced). */
 	reaped: ReapedJob[];
 	/** The worktrees retained, each with a clear reason. */
 	retained: RetainedJob[];
+	/** Record-less orphan `work/*` entries swept (dangling symlinks / orphan dirs). */
+	sweptOrphans: SweptOrphan[];
 }
 
 /**
@@ -284,6 +302,11 @@ export function gc(options: GcOptions): GcResult {
 	const reaped: ReapedJob[] = [];
 	const retained: RetainedJob[] = [];
 
+	// First, self-heal any record-less ORPHAN `work/*` entry (a dangling symlink
+	// or a dir git never registered) so a half-set-up claim does not linger unseen
+	// by the job loop below and wedge the next `worktree add`.
+	const sweptOrphans = sweepOrphans(options.workspacesDir, note);
+
 	for (const job of discoverJobs(options.workspacesDir)) {
 		const mirrorPath = resolveMirrorPath(options.workspacesDir, job);
 		const result = reapJob({
@@ -310,7 +333,77 @@ export function gc(options: GcOptions): GcResult {
 		note(`Retained ${job.slug}: ${reasonText}.`);
 	}
 
-	return {reaped, retained};
+	return {reaped, retained, sweptOrphans};
+}
+
+/**
+ * Sweep record-less ORPHAN entries under `<workspacesDir>/work/*`: a DANGLING
+ * SYMLINK (its target gone) or a directory with NO job record at either the
+ * sibling or legacy in-tree location. These are the residue of a run that
+ * crashed BETWEEN creating the `work/<id>` path and registering it as a git
+ * worktree (or writing its record) — e.g. an early `spawn git ENOENT`. They hold
+ * no durable work, are invisible to {@link discoverJobs} (which requires a
+ * record), and block the next same-id `worktree add`. Removing them is a bounded
+ * `rmSync` of ONE path each (never a registered worktree — those carry a record
+ * and go through the reap predicate). Best-effort per entry.
+ */
+function sweepOrphans(
+	workspacesDir: string,
+	note: (message: string) => void,
+): SweptOrphan[] {
+	const workDir = join(workspacesDir, 'work');
+	if (!existsSync(workDir)) {
+		return [];
+	}
+	const swept: SweptOrphan[] = [];
+	for (const entry of readdirSync(workDir)) {
+		if (entry.endsWith('.json')) {
+			continue; // a sibling record file, not a work-id entry
+		}
+		const dir = join(workDir, entry);
+		let link;
+		try {
+			link = lstatSync(dir);
+		} catch {
+			continue; // vanished under us
+		}
+		const isSymlink = link.isSymbolicLink();
+		const targetExists = existsSync(dir); // follows the link; false ⇒ dangling
+		const hasRecord =
+			existsSync(jobRecordPath(dir)) ||
+			(targetExists && existsSync(join(dir, JOB_RECORD_FILENAME)));
+		// Orphan iff: a dangling symlink (target gone), OR a record-less entry that
+		// is not a live directory git could own (a stray symlink-to-elsewhere, or a
+		// dir with no record). A record-bearing entry is a real job → leave it to the
+		// reap predicate above.
+		const danglingSymlink = isSymlink && !targetExists;
+		if (hasRecord) {
+			continue;
+		}
+		if (!danglingSymlink) {
+			// A record-less real directory: only sweep it if git does not track it as a
+			// worktree here. `discoverJobs` already skips it (no record), and a
+			// registered worktree always has our record, so a record-less dir is an
+			// orphan. But be conservative: skip a NON-symlink dir that is not empty of
+			// a `.git` pointer only when it looks like a crashed pre-register dir.
+			if (isSymlink && targetExists) {
+				// symlink to a live path but no record → still an orphan link
+			} else if (!link.isDirectory()) {
+				continue; // not a dir, not a dangling link — leave alone
+			} else if (existsSync(join(dir, '.git'))) {
+				continue; // has a git pointer but no record: leave for a human (rare)
+			}
+		}
+		try {
+			rmSync(dir, {recursive: true, force: true});
+			const kind = danglingSymlink ? 'dangling-symlink' : 'orphan-dir';
+			swept.push({dir, kind});
+			note(`Swept orphan work entry ${entry} (${kind}).`);
+		} catch {
+			// best-effort: a permission error surfaces on the next add attempt
+		}
+	}
+	return swept;
 }
 
 /**