dsh-themis 1.0.0

package/cordis.patch.yml

@@ -0,0 +1,6 @@
+# tech-lead bundle: one insert row over the profile root. The plugin is
+# strictly read-only (no fs writes, no subprocesses, no network); see
+# packages/dsh-tech-lead-plugin/src/tools.js for the full surface.
+- insert:
+    - id: tech-lead-tools
+      name: 'dsh-themis'

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "dsh-themis",
+  "version": "1.0.0",
+  "description": "Themis — tech-lead lifecycle governance for DeepSeek Harness: 21 read-only tools (classify/state/plan/evidence/gates/release/install audits, context/evidence/progress analysis, mutation preview). No writes, no subprocesses, no network.",
+  "license": "MIT",
+  "type": "module",
+  "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js"
+  },
+  "files": [
+    "src/",
+    "cordis.patch.yml"
+  ],
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "cordis",
+    "tech-lead",
+    "plugin",
+    "governance",
+    "themis"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/240xu/tech-lead-skill.git",
+    "directory": "packages/dsh-tech-lead"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.7"
+  },
+  "engines": {
+    "node": ">=16"
+  }
+}

package/src/core/capabilities.js

@@ -0,0 +1,34 @@
+const CAPABILITIES = Object.freeze([
+  ['tech_lead_classify', 'classification', 'primitive+csv', 'medium'],
+  ['tech_lead_state_validate', 'state', 'json-string', 'medium'],
+  ['tech_lead_transition_check', 'state', 'json-string+primitive', 'high'],
+  ['tech_lead_plan_lint', 'planning', 'json-string', 'medium'],
+  ['tech_lead_evidence_lint', 'evidence', 'json-string+primitive', 'high'],
+  ['tech_lead_gate_precheck', 'gates', 'json-string', 'high'],
+  ['tech_lead_release_audit', 'release', 'json-string+csv', 'high'],
+  ['tech_lead_install_audit', 'installation', 'json-string+csv', 'high'],
+  ['tech_lead_resume_card', 'reconcile', 'json-string+primitive', 'medium'],
+  ['tech_lead_context_validate', 'context', 'json-string', 'medium'],
+  ['tech_lead_evidence_graph_lint', 'evidence', 'json-string', 'high'],
+  ['tech_lead_evidence_freshness', 'evidence', 'json-string', 'high'],
+  ['tech_lead_assumption_register', 'context', 'json-string', 'medium'],
+  ['tech_lead_progress_decide', 'progress', 'json-string', 'high'],
+  ['tech_lead_critical_path', 'progress', 'json-string', 'high'],
+  ['tech_lead_change_impact', 'impact', 'json-string', 'high'],
+  ['tech_lead_resume_reconcile', 'reconcile', 'json-string', 'high'],
+  ['tech_lead_gate_plan', 'gates', 'json-string', 'high'],
+  ['tech_lead_gate_aggregate', 'gates', 'json-string', 'high'],
+  ['tech_lead_gate_reopen', 'gates', 'json-string', 'high'],
+  ['tech_lead_mutation_preview', 'mutation', 'json-string', 'high'],
+].map(([name, domain, inputMode, risk]) => Object.freeze({
+  name,
+  version: '1',
+  domain,
+  sideEffects: false,
+  inputMode,
+  risk,
+})));
+
+export function getCapabilities() {
+  return CAPABILITIES.map((capability) => ({ ...capability }));
+}

package/src/core/classify.js

@@ -0,0 +1,66 @@
+/**
+ * Task tier classifier (SKILL §1). Pure function.
+ *
+ * @param {{
+ *   touchesMultipleModules?: boolean,
+ *   estimatedDays?: number,
+ *   irreversibleOps?: string[],
+ *   protectedAssetTypes?: Array<'SOURCE'|'USER_DATA'|'CONFIG'|'SECRET'|'RUNTIME'|'GENERATED'>,
+ *   publicInterfaceChange?: boolean,
+ *   uncertainRisk?: boolean,
+ * }} [input]
+ * @returns {{ tier: 'T0'|'T1'|'T2', reasons: string[], escalated: boolean }}
+ */
+export function classify(maybeInput) {
+  const input = maybeInput !== null && typeof maybeInput === 'object' ? maybeInput : {};
+  const reasons = [];
+  let tier = 'T0';
+  const provided = ['touchesMultipleModules', 'estimatedDays', 'irreversibleOps', 'protectedAssetTypes', 'publicInterfaceChange', 'uncertainRisk'];
+  if (provided.every((key) => input[key] === undefined)) {
+    reasons.unshift('no classification inputs provided; defaulting to T0');
+  }
+
+  const t2 =
+    input.touchesMultipleModules === true ||
+    (Array.isArray(input.irreversibleOps) && input.irreversibleOps.length > 0) ||
+    (Array.isArray(input.protectedAssetTypes) &&
+      input.protectedAssetTypes.some((t) =>
+        ['USER_DATA', 'SECRET', 'RUNTIME'].includes(t)
+      )) ||
+    input.publicInterfaceChange === true;
+
+  if (input.touchesMultipleModules === true) reasons.push('multi-module change → T2');
+  if (Array.isArray(input.irreversibleOps) && input.irreversibleOps.length) {
+    reasons.push(`irreversible ops (${input.irreversibleOps.slice(0, 10).join(', ')}${input.irreversibleOps.length > 10 ? ' …' : ''}) → T2`);
+  }
+  if (Array.isArray(input.protectedAssetTypes)) {
+    for (const t of input.protectedAssetTypes) {
+      if (['USER_DATA', 'SECRET', 'RUNTIME'].includes(t)) {
+        reasons.push(`protected asset ${t} → T2`);
+      }
+    }
+  }
+  if (input.publicInterfaceChange === true) reasons.push('public interface change → T2');
+
+  const days = Number(input.estimatedDays) || 0;
+  if (t2) {
+    tier = 'T2';
+  } else if (days >= 7) {
+    tier = 'T2';
+    reasons.push(`estimated ${days}d crosses a week boundary → T2`);
+  } else if (days >= 1) {
+    tier = 'T1';
+    reasons.push(`estimated ${days}d single-module work → T1`);
+  } else {
+    reasons.push('trivial, single-file, discardable → T0');
+  }
+
+  let escalated = false;
+  if (input.uncertainRisk === true && tier !== 'T2') {
+    tier = tier === 'T0' ? 'T1' : 'T2';
+    reasons.push('risk uncertain: escalated one tier');
+    escalated = true;
+  }
+
+  return { tier, reasons, escalated };
+}

package/src/core/context.js

@@ -0,0 +1,68 @@
+const MODES = new Set(['PLAN', 'EXECUTE']);
+const TIERS = new Set(['T0', 'T1', 'T2']);
+const OUTCOMES = new Set(['', 'CONTINUE', 'PAUSE', 'SCOPE-DOWN', 'PIVOT', 'STOP']);
+const REPOSITORIES = new Set(['git', 'non-git', 'read-only']);
+const FIELDS = new Set([
+  'schema', 'project', 'goalLedger', 'nonGoals', 'constraints', 'assets',
+  'assumptions', 'decisions', 'risks', 'dependencies', 'evidence', 'gates',
+  'current', 'snapshot',
+]);
+
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const nonEmptyString = (value) => typeof value === 'string' && value.trim().length > 0;
+const field = (errors, path, message) => errors.push({ path, message });
+
+export function validateContext(raw) {
+  const errors = [];
+  const warnings = [];
+  const unknownFields = [];
+  if (!isObject(raw)) {
+    return { valid: false, errors: [{ path: '/', message: 'context must be an object' }], warnings, unknownFields };
+  }
+  for (const key of Object.keys(raw)) {
+    if (!FIELDS.has(key)) {
+      unknownFields.push(key);
+      warnings.push({ path: `/${key}`, message: 'unknown field preserved' });
+    }
+  }
+  if (raw.schema !== 'tech-lead.context.v1') field(errors, '/schema', 'must equal tech-lead.context.v1');
+  if (!isObject(raw.project)) field(errors, '/project', 'must be an object');
+  else {
+    for (const key of ['id', 'name']) if (!nonEmptyString(raw.project[key])) field(errors, `/project/${key}`, 'must be a non-empty string');
+    if (!REPOSITORIES.has(raw.project.repositoryMode)) field(errors, '/project/repositoryMode', 'invalid repository mode');
+  }
+  if (!Array.isArray(raw.goalLedger) || raw.goalLedger.length === 0) field(errors, '/goalLedger', 'must contain at least one goal');
+  else if (!raw.goalLedger.some((goal) => isObject(goal) && nonEmptyString(goal.id) && nonEmptyString(goal.goal))) field(errors, '/goalLedger', 'must contain a goal with string id and goal');
+  for (const key of ['nonGoals', 'constraints', 'assets', 'assumptions', 'decisions', 'risks', 'dependencies', 'evidence', 'gates']) {
+    if (!Array.isArray(raw[key])) field(errors, `/${key}`, 'must be an array');
+  }
+  if (!isObject(raw.current)) field(errors, '/current', 'must be an object');
+  else {
+    if (!MODES.has(raw.current.mode)) field(errors, '/current/mode', 'invalid mode');
+    if (!TIERS.has(raw.current.tier)) field(errors, '/current/tier', 'invalid tier');
+    if (!nonEmptyString(raw.current.phase)) field(errors, '/current/phase', 'must be a non-empty string');
+    if (!OUTCOMES.has(raw.current.lastOutcome ?? '')) field(errors, '/current/lastOutcome', 'invalid outcome');
+    if (!nonEmptyString(raw.current.nextStep)) field(errors, '/current/nextStep', 'must be a non-empty string');
+  }
+  if (!isObject(raw.snapshot)) field(errors, '/snapshot', 'must be an object');
+  else {
+    if (!nonEmptyString(raw.snapshot.at)) field(errors, '/snapshot/at', 'must be a non-empty string');
+    if (raw.snapshot.source !== 'inline') field(errors, '/snapshot/source', 'must be inline');
+    if (!nonEmptyString(raw.snapshot.fingerprint)) field(errors, '/snapshot/fingerprint', 'must be a non-empty string');
+  }
+  return { valid: errors.length === 0, errors, warnings, unknownFields };
+}
+
+export function normalizeContext(raw) {
+  if (!isObject(raw)) return { value: raw, warnings: [] };
+  let value;
+  try {
+    value = JSON.parse(JSON.stringify(raw));
+  } catch {
+    return { value: raw, warnings: [{ code: 'CLONE_FAILED', path: '/', message: 'input is not serializable; returning original reference without copy guarantees' }] };
+  }
+  const warnings = Object.keys(raw)
+    .filter((key) => !FIELDS.has(key))
+    .map((key) => ({ path: `/${key}`, message: 'unknown field preserved' }));
+  return { value, warnings };
+}

package/src/core/critical-path.js

@@ -0,0 +1,50 @@
+const items = (value) => Array.isArray(value) ? value : [];
+
+export function criticalPath(tasks, dependencies) {
+  const findings = [];
+  const nodes = new Map();
+  for (const [index, task] of items(tasks).entries()) {
+    const id = typeof task?.id === 'string' ? task.id : '';
+    if (!id) {
+      findings.push({ code: 'INVALID_TASK_ID', path: `/tasks/${index}/id` });
+      continue;
+    }
+    if (nodes.has(id)) {
+      findings.push({ code: 'DUPLICATE_TASK_ID', path: `/tasks/${index}/id`, id });
+      continue;
+    }
+    nodes.set(id, task);
+  }
+  const outgoing = new Map([...nodes.keys()].map((id) => [id, []]));
+  const incoming = new Map([...nodes.keys()].map((id) => [id, 0]));
+  for (const edge of items(dependencies)) {
+    const from = String(edge?.from);
+    const to = String(edge?.to);
+    if (!nodes.has(from) || !nodes.has(to)) {
+      findings.push({ code: 'UNKNOWN_DEPENDENCY', from, to });
+      continue;
+    }
+    outgoing.get(to).push(from);
+    incoming.set(from, incoming.get(from) + 1);
+  }
+  const originalIncoming = new Map(incoming);
+  const queue = [...incoming.entries()].filter(([, count]) => count === 0).map(([id]) => id);
+  const order = [];
+  for (let cursor = 0; cursor < queue.length; cursor += 1) {
+    const id = queue[cursor];
+    order.push(id);
+    for (const next of outgoing.get(id)) {
+      incoming.set(next, incoming.get(next) - 1);
+      if (incoming.get(next) === 0) queue.push(next);
+    }
+  }
+  if (order.length !== nodes.size) {
+    const orderedSet = new Set(order);
+    const cycleNodes = [...nodes.keys()].filter((id) => !orderedSet.has(id)).sort();
+    findings.push({ code: 'CYCLE', message: 'dependency graph contains a cycle', cycleNodes });
+  }
+  const active = (id) => nodes.get(id)?.status !== 'done';
+  const critical = order.filter((id) => active(id) && (outgoing.get(id).length > 0 || originalIncoming.get(id) > 0));
+  const parallelWindows = order.filter((id) => active(id) && originalIncoming.get(id) === 0 && outgoing.get(id).length === 0).map((id) => [id]);
+  return { blockers: order.filter((id) => nodes.get(id)?.blocker && active(id)), criticalPath: critical, parallelWindows, findings };
+}

package/src/core/envelope.js

@@ -0,0 +1,39 @@
+const SCHEMA = 'tech-lead.result.v1';
+
+const asArray = (value) => {
+  if (value == null) return [];
+  return Array.isArray(value) ? value.slice() : [value];
+};
+
+export function makeEnvelope({
+  ok = false,
+  code = ok ? 'OK' : 'UNKNOWN_ERROR',
+  data = null,
+  errors = [],
+  warnings = [],
+  operation = 'unknown',
+  meta = {},
+} = {}) {
+  return {
+    ok: Boolean(ok),
+    code,
+    data,
+    errors: asArray(errors),
+    warnings: asArray(warnings),
+    meta: {
+      ...meta,
+      schema: SCHEMA,
+      operation,
+      deterministic: true,
+      sideEffects: false,
+    },
+  };
+}
+
+export function okEnvelope(operation, data, warnings = [], meta = {}) {
+  return makeEnvelope({ ok: true, code: 'OK', data, warnings, operation, meta });
+}
+
+export function errorEnvelope(operation, code, errors = [], data = null) {
+  return makeEnvelope({ ok: false, code, data, errors, operation });
+}

package/src/core/evidence-graph.js

@@ -0,0 +1,99 @@
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const asArray = (value) => Array.isArray(value) ? value : [];
+const finding = (code, path, message) => ({ code, path, message });
+
+export function evidenceGraphLint(context) {
+  const findings = [];
+  const nodes = new Map();
+  const collections = ['goalLedger', 'risks', 'decisions', 'gates'];
+  for (const collection of collections) {
+    for (const [index, item] of asArray(context?.[collection]).entries()) {
+      if (!isObject(item) || !String(item.id ?? '').trim()) {
+        findings.push(finding('INVALID_LEDGER_ENTRY', `/${collection}/${index}`, 'ledger entry must be an object with a non-empty id'));
+        continue;
+      }
+      const id = String(item.id);
+      if (nodes.has(id)) findings.push(finding('DUPLICATE_ID', `/${collection}/${index}/id`, `duplicate id: ${id}`));
+      nodes.set(id, { type: collection, item });
+    }
+  }
+  const evidence = asArray(context?.evidence);
+  for (const [index, item] of evidence.entries()) {
+    if (!isObject(item) || !String(item.id ?? '').trim()) {
+      findings.push(finding('INVALID_EVIDENCE', `/evidence/${index}`, 'evidence must have an id'));
+      continue;
+    }
+    const evidenceId = String(item.id);
+    if (nodes.has(evidenceId)) findings.push(finding('DUPLICATE_ID', `/evidence/${index}/id`, `duplicate id: ${evidenceId}`));
+    nodes.set(evidenceId, { type: 'evidence', item });
+  }
+  const edges = [];
+  const evidenceEdges = new Map();
+  for (const [index, item] of evidence.entries()) {
+    if (!isObject(item) || !String(item.id ?? '').trim()) continue;
+    const evidenceId = String(item.id);
+    for (const target of asArray(item.supports)) {
+      if (!nodes.has(String(target))) findings.push(finding('UNKNOWN_REFERENCE', `/evidence/${index}/supports`, `unknown reference: ${target}`));
+      else {
+        const targetId = String(target);
+        edges.push({ from: evidenceId, to: targetId, relation: 'supports' });
+        if (nodes.get(targetId)?.type === 'evidence') {
+          if (!evidenceEdges.has(evidenceId)) evidenceEdges.set(evidenceId, []);
+          evidenceEdges.get(evidenceId).push(targetId);
+        }
+      }
+    }
+  }
+  const color = new Map();
+  let hasCycle = false;
+  const stack = [];
+  for (const start of evidenceEdges.keys()) {
+    if (color.get(start)) continue;
+    stack.push([start, false]);
+    while (stack.length) {
+      const [id, processed] = stack.pop();
+      if (processed) { color.set(id, 2); continue; }
+      const state = color.get(id);
+      if (state === 1) { hasCycle = true; continue; }
+      if (state === 2) continue;
+      color.set(id, 1);
+      stack.push([id, true]);
+      for (const next of evidenceEdges.get(id) ?? []) {
+        if (!color.get(next)) stack.push([next, false]);
+        else if (color.get(next) === 1) hasCycle = true;
+      }
+    }
+  }
+  if (hasCycle) findings.push(finding('CYCLE', '/evidence', 'evidence graph contains a cycle'));
+  return { valid: findings.length === 0, findings, graph: { nodes: [...nodes.keys()], edges } };
+}
+
+export function evidenceFreshness(context, options = {}) {
+  options = isObject(options) ? options : {};
+  const warnings = [];
+  const findings = [];
+  let ageDays = 7;
+  if (options.maxAgeDays !== undefined) {
+    const n = Number(options.maxAgeDays);
+    if (typeof options.maxAgeDays === 'number' && Number.isFinite(n) && n >= 0) ageDays = n;
+    else warnings.push({ code: 'INVALID_MAX_AGE', message: 'maxAgeDays must be a finite number >= 0; using default 7' });
+  }
+  let now = Date.parse(options.now ?? new Date().toISOString());
+  if (!Number.isFinite(now)) {
+    warnings.push({ code: 'INVALID_NOW', message: 'using current time because now is not parseable' });
+    now = Date.now();
+  }
+  for (const [index, item] of asArray(context?.evidence).entries()) {
+    const time = Date.parse(item?.time);
+    if (!Number.isFinite(time)) {
+      findings.push(finding('INVALID_EVIDENCE_TIME', `/evidence/${index}/time`, 'time is not parseable'));
+      continue;
+    }
+    if (time > now) findings.push(finding('FUTURE_EVIDENCE', `/evidence/${index}/time`, 'evidence time is in the future'));
+    if (now - time > ageDays * 86400000) findings.push(finding('STALE_EVIDENCE', `/evidence/${index}`, 'evidence exceeds freshness window'));
+    if (options.fingerprint != null && item.fingerprint != null && item.fingerprint !== options.fingerprint) {
+      findings.push(finding('FINGERPRINT_DRIFT', `/evidence/${index}/fingerprint`, 'evidence fingerprint differs from current snapshot'));
+    }
+  }
+  return { stale: findings.some((item) => item.code === 'STALE_EVIDENCE' || item.code === 'FINGERPRINT_DRIFT' || item.code === 'FUTURE_EVIDENCE'), findings, warnings, evidence: asArray(context?.evidence) };
+}

package/src/core/evidence.js

@@ -0,0 +1,50 @@
+const LEVELS = ['E0', 'E1', 'E2', 'E3', 'E4'];
+const REQUIRED = ['id', 'level', 'source', 'time', 'scope', 'repro'];
+
+/**
+ * Evidence provenance lint (SKILL §5). Pure function.
+ *
+ * @param {unknown} evidence expected array of evidence entries
+ * @param {{ highRiskChange?: boolean }} [opts]
+ * @returns {Array<{severity:'error'|'warning', path:string, message:string}>}
+ */
+export function evidenceLint(evidence, opts = {}) {
+  if (!Array.isArray(evidence)) {
+    return [{ severity: 'error', path: 'evidence', message: 'evidence must be an array' }];
+  }
+  /** @type {Array<{severity:'error'|'warning', path:string, message:string}>} */
+  const f = [];
+
+  evidence.forEach((entry, i) => {
+    if (entry === null || typeof entry !== 'object') {
+      f.push({ severity: 'error', path: `evidence[${i}]`, message: 'must be an object' });
+      return;
+    }
+    const e = /** @type {Record<string, unknown>} */ (entry);
+    for (const field of REQUIRED) {
+      const v = e[field];
+      if (typeof v !== 'string' || !v.trim()) {
+        f.push({ severity: 'error', path: `evidence[${i}].${field}`, message: 'required non-empty string' });
+      }
+    }
+    if (typeof e.level === 'string' && !LEVELS.includes(e.level)) {
+      f.push({ severity: 'error', path: `evidence[${i}].level`, message: 'must be one of E0,E1,E2,E3,E4' });
+    }
+  });
+
+  if (opts.highRiskChange) {
+    const maxLevel = evidence.reduce((max, entry) => {
+      const lvl = entry && typeof entry === 'object' ? entry.level : undefined;
+      return LEVELS.includes(lvl) ? Math.max(max, LEVELS.indexOf(lvl)) : max;
+    }, -1);
+    if (maxLevel < LEVELS.indexOf('E3')) {
+      f.push({
+        severity: 'error',
+        path: 'evidence',
+        message: 'high-risk change requires at least one E3+ evidence (integration/real-process)',
+      });
+    }
+  }
+
+  return f;
+}

package/src/core/gate.js

@@ -0,0 +1,79 @@
+const VERDICTS = new Set(['pass', 'conditional', 'reject']);
+
+/**
+ * Gate precheck (SKILL §5 referee separation + §6 blind protocol), mechanical
+ * subset. Pure function.
+ *
+ * @param {{
+ *   proposalAuthorId?: string,
+ *   executorId?: string,
+ *   reviewerIds?: string[],
+ *   solo?: boolean,
+ *   blindRequired?: boolean,
+ *   destructiveScope?: string[],
+ *   reports?: Array<{reviewerId?: string, verdict?: string, anchors?: unknown[]}>,
+ * }} input
+ * @returns {{ pass: boolean, violations: Array<{type:string, detail:string}> }}
+ */
+export function gatePrecheck(input = {}) {
+  if (input === null || typeof input !== 'object') {
+    return { pass: false, violations: [{ type: 'BAD_INPUT', detail: 'gate precheck input must be an object' }] };
+  }
+  const reviewerIds = Array.isArray(input.reviewerIds) ? input.reviewerIds : [];
+  const reports = Array.isArray(input.reports) ? input.reports : [];
+  if (input.reports !== undefined && !Array.isArray(input.reports)) {
+    // fall through with empty reports; violation recorded below for parity
+  }
+  /** @type {Array<{type:string, detail:string}>} */
+  const v = [];
+
+  if (input.proposalAuthorId && input.proposalAuthorId === input.executorId) {
+    v.push({ type: 'PROPOSER_IS_EXECUTOR', detail: 'referee separation requires proposalAuthorId != executorId' });
+  }
+
+  for (const who of ['proposalAuthorId', 'executorId']) {
+    const id = input[who];
+    if (id && reviewerIds.includes(id)) {
+      v.push({ type: 'IDENTITY_OVERLAP', detail: `${who} "${id}" may not also review` });
+    }
+  }
+
+  for (const [i, r] of reports.entries()) {
+    if (r === null || typeof r !== 'object') {
+      v.push({ type: 'BAD_REPORT', detail: `report[${i}] must be an object` });
+      continue;
+    }
+    if (!VERDICTS.has(r.verdict)) {
+      v.push({ type: 'BAD_VERDICT', detail: `report[${i}] verdict must be pass|conditional|reject` });
+    }
+    const anchors = Array.isArray(r.anchors) ? r.anchors.filter((a) => typeof a === 'string' && a.trim()) : [];
+    if (anchors.length === 0) {
+      v.push({ type: 'ANCHOR_MISSING', detail: `report[${i}] needs at least one file:line or command anchor` });
+    }
+  }
+
+  const destructiveScope = Array.isArray(input.destructiveScope) ? input.destructiveScope : [];
+  if (input.destructiveScope !== undefined && !Array.isArray(input.destructiveScope)) {
+    v.push({ type: 'BAD_DESTRUCTIVE_SCOPE', detail: 'destructiveScope must be an array of strings when provided' });
+  }
+  if (input.solo && destructiveScope.length > 0) {
+    v.push({
+      type: 'SOLO_FORBIDDEN',
+      detail: `solo:true cannot clear destructive scope (${destructiveScope.slice(0, 8).join(', ')}${destructiveScope.length > 8 ? ' …' : ''})`,
+    });
+  }
+
+  if (input.blindRequired) {
+    const distinctAnchored = new Set(
+      reports
+        .filter((r) => VERDICTS.has(r.verdict) &&
+          Array.isArray(r.anchors) && r.anchors.some((a) => typeof a === 'string' && a.trim()))
+        .map((r) => r.reviewerId)
+    ).size;
+    if (distinctAnchored < 3) {
+      v.push({ type: 'BLIND_QUORUM', detail: `blind gate needs ≥3 distinct anchored reviewers, got ${distinctAnchored}` });
+    }
+  }
+
+  return { pass: v.length === 0, violations: v };
+}

package/src/core/gates.js

@@ -0,0 +1,77 @@
+const roles = ['pm', 'arch', 'eng', 'ops'];
+const list = (value) => Array.isArray(value) ? value : [];
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+export function gatePlan(impact = {}, context = {}) {
+  impact = object(impact) ? impact : {};
+  context = object(context) ? context : {};
+  const high = impact.tier === 'T2' || impact.destructive === true || context.tier === 'T2';
+  const requiredRoles = high ? roles.slice() : ['eng'];
+  return {
+    requiredRoles,
+    minimumEvidence: high ? 'E3' : 'E2',
+    quorum: requiredRoles.length,
+    conditions: high ? ['all roles anchored', 'no reject', 'snapshot current'] : ['one anchored reviewer', 'no reject'],
+  };
+}
+
+export function gateAggregate(reports, plan = {}) {
+  plan = object(plan) ? plan : {};
+  const findings = [];
+  const seen = new Set();
+  const rolesSeen = new Set();
+  const validReports = [];
+  const rejects = [];
+  const conditionals = [];
+  list(reports).forEach((report, index) => {
+    const collect = () => {
+      for (const item of list(report.findings)) {
+        const id = String(item?.id ?? `${report.role}:${item?.message ?? ''}`);
+        if (!seen.has(id)) { seen.add(id); findings.push(item); }
+      }
+      if (report.verdict === 'reject') rejects.push(report);
+      if (report.verdict === 'conditional') conditionals.push(report);
+    };
+    if (!object(report) || typeof report.role !== 'string' || !report.role || !Array.isArray(report.anchors) || report.anchors.length === 0) {
+      findings.push({ code: 'INVALID_REPORT', path: `/reports/${index}`, message: 'report needs role and anchors' });
+      return;
+    }
+    if (report.verdict !== 'pass' && report.verdict !== 'reject' && report.verdict !== 'conditional') {
+      findings.push({ code: 'INVALID_VERDICT', path: `/reports/${index}/verdict`, message: 'invalid report verdict' });
+      collect();
+      return;
+    }
+    if (rolesSeen.has(report.role)) {
+      findings.push({ code: 'DUPLICATE_ROLE', path: `/reports/${index}/role`, message: `duplicate reviewer role: ${report.role}` });
+      collect();
+      return;
+    }
+    if (!report.anchors.every((anchor) => typeof anchor === 'string' && anchor.trim().length > 0)) {
+      findings.push({ code: 'INVALID_REPORT', path: `/reports/${index}/anchors`, message: 'anchors must be non-empty strings' });
+      collect();
+      return;
+    }
+    rolesSeen.add(report.role);
+    validReports.push(report);
+    collect();
+  });
+  const required = [...new Set(list(plan.requiredRoles).filter((role) => typeof role === 'string' && role))];
+  const quorum = Number.isInteger(plan.quorum) && plan.quorum > 0 ? plan.quorum : required.length;
+  if (!required.length || quorum > required.length) findings.push({ code: 'INVALID_PLAN', message: 'plan needs non-empty requiredRoles and a valid quorum' });
+  const satisfiedRoles = new Set(validReports.map((report) => report.role));
+  const missing = required.filter((role) => !satisfiedRoles.has(role));
+  const pass = findings.length === 0 && missing.length === 0 && validReports.length >= quorum && rejects.length === 0 && conditionals.length === 0;
+  const verdict = rejects.length ? 'reject' : pass ? 'pass' : 'conditional';
+  return { pass, verdict, findings, missingRoles: missing, unresolved: missing.length > 0 || rejects.length > 0 || conditionals.length > 0 || findings.length > 0 };
+}
+
+export function gateReopen(previous = {}, current = {}) {
+  previous = object(previous) ? previous : {};
+  current = object(current) ? current : {};
+  const changedInputs = [];
+  if (previous.contextFingerprint !== current.contextFingerprint) changedInputs.push('context');
+  if (previous.evidenceFingerprint !== current.evidenceFingerprint) changedInputs.push('evidence');
+  if (previous.dependencyFingerprint !== current.dependencyFingerprint) changedInputs.push('dependencies');
+  if (previous.impactFingerprint !== current.impactFingerprint) changedInputs.push('impact');
+  return { reopen: changedInputs.length > 0, changedInputs, reasons: changedInputs.map((item) => `${item} changed`) };
+}

package/src/core/impact.js

@@ -0,0 +1,15 @@
+const items = (value) => Array.isArray(value) ? value : [];
+
+export function changeImpact(change = {}, context = {}) {
+  change = change !== null && typeof change === 'object' && !Array.isArray(change) ? change : {};
+  context = context !== null && typeof context === 'object' && !Array.isArray(context) ? context : {};
+  const modules = items(change.modules);
+  const assets = items(change.assets);
+  const irreversible = Boolean(change.irreversible);
+  const high = irreversible || Boolean(change.publicInterface) || modules.length >= 2 || assets.some((item) => ['USER_DATA', 'SECRET', 'RUNTIME'].includes(item));
+  const medium = !high && assets.some((item) => ['CONFIG', 'GENERATED'].includes(item));
+  const tier = high ? 'T2' : medium ? 'T1' : 'T0';
+  const reversible = !irreversible;
+  const reopenGates = high ? items(context.gates).map((gate) => String(gate?.id)).filter(Boolean) : [];
+  return { tier, assets, reversible, blastRadius: high ? 'high' : medium ? 'medium' : 'low', reopenGates, reasons: [high ? 'high-impact trigger matched' : medium ? 'single-module or config change' : 'reversible source-only change'] };
+}

package/src/core/index.js

@@ -0,0 +1,18 @@
+export { validateState } from './state.js';
+export { classify } from './classify.js';
+export { transitionCheck } from './transition.js';
+export { evidenceLint } from './evidence.js';
+export { planLint } from './plan.js';
+export { gatePrecheck } from './gate.js';
+export { releaseAudit } from './release.js';
+export { installAudit } from './install.js';
+export { resumeCard } from './resume.js';
+export { makeEnvelope, okEnvelope, errorEnvelope } from './envelope.js';
+export { getCapabilities } from './capabilities.js';
+export { validateContext, normalizeContext } from './context.js';
+export { evidenceGraphLint, evidenceFreshness } from './evidence-graph.js';
+export { progressDecide } from './progress.js';
+export { criticalPath } from './critical-path.js';
+export { changeImpact } from './impact.js';
+export { gatePlan, gateAggregate, gateReopen } from './gates.js';
+export { validateMutationIntent, previewMutation } from './mutation.js';