etymd 0.15.0 → 0.17.0

package/dist/index.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.15.0",
+      version: "0.17.0",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules, skills, and the task you hand an agent against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",
@@ -49,11 +49,11 @@ var init_package = __esm({
       author: "Alkis Yuv",
       repository: {
         type: "git",
-        url: "git+https://github.com/triartleet/etymd.git"
+        url: "git+https://github.com/fleetorders/etymd.git"
       },
-      homepage: "https://github.com/triartleet/etymd#readme",
+      homepage: "https://github.com/fleetorders/etymd#readme",
       bugs: {
-        url: "https://github.com/triartleet/etymd/issues"
+        url: "https://github.com/fleetorders/etymd/issues"
       },
       type: "module",
       bin: {
@@ -1171,7 +1171,7 @@ function generatePreCommitHook(selfBuild = false) {
 
 ${localHookCall("pre-commit")}
 
-# Content screen \u2014 staged file bytes. Refuses to commit environment, employer or identity
+# Content screen \u2014 staged file bytes. Refuses to commit environment, guarded-side or identity
 # detail into a repo whose history is (or could become) public. The checker and its patterns
 # are machine-local by design, so this is a NO-OP wherever no checker is installed: safe to
 # commit anywhere, active only where you opted in.
@@ -1449,9 +1449,13 @@ async function planWorkflow(root, facts, opts) {
       commitFormat: opts.gateConfig?.commitFormat,
       allowWriting: opts.gateConfig?.allowWriting ?? []
     };
+    const tier = deriveFailOn(facts, {
+      failOn: gateConfig.failOn,
+      explicit: opts.gateFailOnPinned ?? false
+    });
     await add(
       ".githooks/pre-push",
-      generatePrePushHook(facts, gateConfig, selfBuild),
+      generatePrePushHook(facts, { ...gateConfig, failOn: tier.failOn }, selfBuild),
       "Correctness gate (pre-push)",
       true
     );
@@ -2762,6 +2766,13 @@ var PLACEHOLDER_PREFIX_RE = /^(?:my|your)-/i;
 function isPlaceholderClaim(token) {
   return token.split("/").some((seg) => PLACEHOLDER_PREFIX_RE.test(seg) || PLACEHOLDER_SEGMENTS.has(seg.toLowerCase()));
 }
+var NAMESPACE_IDENT = "[A-Za-z][A-Za-z0-9-]{0,15}";
+var NAMESPACE_STOP = new Set(
+  "note notes see warning caution caveat caveats example examples ex eg ie nb ps re per file files path paths hint tip tips todo fixme step steps rule rules ref refs fact facts output outputs input inputs result results summary status overview next prev then thus hence plus goal goals spec specs context".split(" ")
+);
+function isNamespace(ident) {
+  return Boolean(ident) && !NAMESPACE_STOP.has(ident.toLowerCase());
+}
 function claimContext(text, index) {
   const start = text.lastIndexOf("\n", index) + 1;
   const endRaw = text.indexOf("\n", index);
@@ -2781,8 +2792,9 @@ ${line}`;
   }
   return line;
 }
-function extractPathClaims(text) {
+function extractPathClaims(text, opts = {}) {
   const prospectiveOnly = /* @__PURE__ */ new Map();
+  const namespacedOnly = /* @__PURE__ */ new Map();
   const placeholder = /* @__PURE__ */ new Set();
   for (const m of text.matchAll(/`([^`\n]+)`/g)) {
     const token = m[1].trim();
@@ -2804,14 +2816,21 @@ function extractPathClaims(text) {
     }
     const prospective2 = CREATION_CONTEXT_RE.test(claimContext(text, m.index ?? 0));
     prospectiveOnly.set(claim, (prospectiveOnly.get(claim) ?? true) && prospective2);
+    if (opts.namespaces) {
+      const nsLead = new RegExp(`(${NAMESPACE_IDENT}):[ \\t]*$`).exec(text.slice(0, m.index ?? 0));
+      const prefixed = isNamespace(nsLead?.[1]);
+      namespacedOnly.set(claim, (namespacedOnly.get(claim) ?? true) && prefixed);
+    }
   }
   const paths = [];
   const prospective = [];
+  const namespaced = [];
   for (const [claim, only] of prospectiveOnly) {
     if (only) prospective.push(claim);
+    else if (namespacedOnly.get(claim)) namespaced.push(claim);
     else paths.push(claim);
   }
-  return { paths, prospective, placeholder: [...placeholder] };
+  return { paths, prospective, namespaced, placeholder: [...placeholder] };
 }
 var LOCAL_REF_LEADINS = new Set(
   "decision decisions entry entries ruling rulings record records ledger id ids item items see per in of on at by to as is was are were the a an and or but not with under over from via vs than after before since between through against latest newest earliest only also still now supersedes superseded superseding amends amended extends extended cites cited citing adds added adding wrote written writes locked locks closed closes opened opens resolves resolved reopened recorded number numbers".split(" ")
@@ -2920,7 +2939,9 @@ function emptyCounters() {
     prospectiveSkipped: 0,
     placeholderSkipped: 0,
     qualifiedRefsSkipped: 0,
-    unresolvableRefs: 0
+    unresolvableRefs: 0,
+    namespacedSkipped: 0,
+    outsideRepoSkipped: 0
   };
 }
 async function checkTextClaims(env, file, opts, counters) {
@@ -2958,9 +2979,12 @@ async function checkTextClaims(env, file, opts, counters) {
       confidence: "high"
     });
   }
-  const { paths, prospective, placeholder } = extractPathClaims(file.text);
+  const { paths, prospective, placeholder, namespaced } = extractPathClaims(file.text, {
+    namespaces: opts.treatNamespacedPrefixes
+  });
   counters.prospectiveSkipped += prospective.length;
   counters.placeholderSkipped += placeholder.length;
+  counters.namespacedSkipped += namespaced.length;
   const missing = [];
   for (const claim of paths) {
     if (await env.pathResolves(claim)) examined.push({ kind: "path", value: claim, exists: true });
@@ -2970,6 +2994,11 @@ async function checkTextClaims(env, file, opts, counters) {
   const gitignored = new Set((ignoredOut ?? "").split("\n").filter(Boolean));
   let pathFindings = 0;
   for (const claim of missing) {
+    if (opts.rootedFirstSegments && !opts.rootedFirstSegments.has(claim.split("/")[0] ?? claim)) {
+      counters.outsideRepoSkipped += 1;
+      examined.push({ kind: "path", value: claim, exists: null });
+      continue;
+    }
     if (gitignored.has(claim)) {
       counters.gitignoredSkipped += 1;
       examined.push({ kind: "path", value: claim, exists: null });
@@ -3469,14 +3498,14 @@ function expandTilde(p) {
   if (p.startsWith("~/")) return path2.join(os.homedir(), p.slice(2));
   return p;
 }
-var REBUILD_RECIPE = 'rebuild it beside the manifest: {"machineProfile":"corp","dirs":{"<name>":"~/path/to/worktree"}}';
+var REBUILD_RECIPE = 'rebuild it beside the manifest: {"machineProfile":"guarded","dirs":{"<name>":"~/path/to/worktree"}}';
 var SAFE_NAME = /^[^\s/\\:.][^\s/\\:]*$/;
 function rejectUnsafeName(name, where, manifest, manifestFile) {
   if (SAFE_NAME.test(name)) return false;
   manifest.problems.push({
     kind: "bad-shape",
     file: manifestFile,
-    detail: `${where} name ${JSON.stringify(name)} is not a single path-safe segment \u2014 entry skipped (names build finding ids and corp/<name>/ persistence paths)`
+    detail: `${where} name ${JSON.stringify(name)} is not a single path-safe segment \u2014 entry skipped (names build finding ids and guarded/<name>/ persistence paths)`
   });
   return true;
 }
@@ -3517,7 +3546,7 @@ async function readLocal(localPath, problems) {
   }
 }
 function loadRegistryEntries(projects, manifest, manifestFile) {
-  const corpNames = [];
+  const guardedNames = [];
   for (const [i, rawEntry] of projects.entries()) {
     const rec = asRecord(rawEntry);
     const name = rec ? asString(rec.name) : void 0;
@@ -3530,8 +3559,8 @@ function loadRegistryEntries(projects, manifest, manifestFile) {
       continue;
     }
     if (rejectUnsafeName(name, `projects[${i}]`, manifest, manifestFile)) continue;
-    const profile = rec.profile === "corp" ? "corp" : "personal";
-    if (rec.profile !== void 0 && rec.profile !== "corp" && rec.profile !== "personal") {
+    const profile = rec.profile === "guarded" ? "guarded" : "personal";
+    if (rec.profile !== void 0 && rec.profile !== "guarded" && rec.profile !== "personal") {
       manifest.problems.push({
         kind: "bad-shape",
         file: manifestFile,
@@ -3569,12 +3598,12 @@ function loadRegistryEntries(projects, manifest, manifestFile) {
       contract,
       links: asStringMap(rec.links)
     };
-    if (entry.profile === "corp" || entry.private) {
-      corpNames.push(name);
+    if (entry.profile === "guarded" || entry.private) {
+      guardedNames.push(name);
       if (!manifest.localPresent) {
         entry.unresolved = `registry.local.json is absent \u2014 ${REBUILD_RECIPE}`;
       } else if (manifest.machineProfile === "personal") {
-        entry.unresolved = 'corp entries do not resolve under machineProfile "personal" \u2014 absent on this machine by design';
+        entry.unresolved = 'guarded entries do not resolve under machineProfile "personal" \u2014 absent on this machine by design';
       } else {
         const dir = manifest.localDirs[name];
         if (!dir) {
@@ -3590,11 +3619,11 @@ function loadRegistryEntries(projects, manifest, manifestFile) {
     }
     manifest.entries.push(entry);
   }
-  if (corpNames.length && !manifest.localPresent) {
+  if (guardedNames.length && !manifest.localPresent) {
     manifest.problems.push({
       kind: "local-missing",
       file: path2.basename(manifest.localPath),
-      detail: `${corpNames.length} corp/private entr${corpNames.length === 1 ? "y" : "ies"} (${corpNames.join(", ")}) cannot resolve without it \u2014 ${REBUILD_RECIPE}`
+      detail: `${guardedNames.length} guarded/private entr${guardedNames.length === 1 ? "y" : "ies"} (${guardedNames.join(", ")}) cannot resolve without it \u2014 ${REBUILD_RECIPE}`
     });
   }
 }
@@ -3643,7 +3672,7 @@ async function loadFleetManifest(manifestPath) {
     shape: "registry",
     manifestPath: abs,
     dir,
-    corpHosts: [],
+    guardedHosts: [],
     labels: {},
     localDirs: {},
     localPath: path2.join(dir, "registry.local.json"),
@@ -3676,8 +3705,8 @@ async function loadFleetManifest(manifestPath) {
     manifest.localPresent = local.present;
     manifest.localDirs = asStringMap(local.data.dirs);
     manifest.labels = asStringMap(local.data.labels);
-    manifest.corpHosts = Array.isArray(local.data.corpHosts) ? local.data.corpHosts.filter((h) => typeof h === "string") : [];
-    manifest.machineProfile = local.data.machineProfile === "corp" || local.data.machineProfile === "personal" ? local.data.machineProfile : void 0;
+    manifest.guardedHosts = Array.isArray(local.data.guardedHosts) ? local.data.guardedHosts.filter((h) => typeof h === "string") : [];
+    manifest.machineProfile = local.data.machineProfile === "guarded" || local.data.machineProfile === "personal" ? local.data.machineProfile : void 0;
     const rootRaw = asString(local.data.root) ?? asString(parsed.root);
     if (rootRaw) manifest.root = path2.resolve(dir, expandTilde(rootRaw));
     const orientationRec = asRecord(parsed.orientation);
@@ -3720,10 +3749,136 @@ async function loadFleetManifest(manifestPath) {
 init_config();
 init_facts();
 init_util();
+
+// src/engine/milestones.ts
+var MILESTONE_COLUMNS = [
+  "id",
+  "milestone",
+  "goal",
+  "status",
+  "next",
+  "effort",
+  "depends-on"
+];
+var MILESTONE_GOALS = ["1", "2", "3"];
+var MILESTONE_STATUSES = ["planned", "active", "blocked", "done"];
+var MILESTONE_EFFORTS = ["S", "M", "L"];
+var NONE_MARKERS = /* @__PURE__ */ new Set(["", "\u2014", "-", "\u2013", "none"]);
+function splitRow(line) {
+  const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
+  return trimmed.split("|").map((c) => c.trim());
+}
+function isSeparatorRow(line) {
+  const cells = splitRow(line);
+  return cells.length > 0 && cells.every((c) => /^:?-{1,}:?$/.test(c));
+}
+function firstTable(lines, startLine) {
+  for (let i = startLine; i < lines.length - 1; i++) {
+    const line = lines[i] ?? "";
+    const next = lines[i + 1] ?? "";
+    if (!line.trim().startsWith("|") || !isSeparatorRow(next)) continue;
+    const header = splitRow(line).map((h) => h.toLowerCase());
+    const rows = [];
+    for (let j = i + 2; j < lines.length; j++) {
+      const body = lines[j] ?? "";
+      if (!body.trim().startsWith("|")) break;
+      rows.push({ line: j + 1, cells: splitRow(body) });
+    }
+    return { header, rows, headerLine: i + 1 };
+  }
+  return null;
+}
+function parseList(cell) {
+  if (NONE_MARKERS.has(cell.trim().toLowerCase())) return [];
+  return cell.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function checkColumns(table, expected, problems) {
+  const got = table.header.join(" | ");
+  const want = expected.join(" | ");
+  if (got !== want) {
+    problems.push(
+      `line ${table.headerLine}: table columns are \`${got}\`; the standard is \`${want}\``
+    );
+    return false;
+  }
+  return true;
+}
+function checkVocabulary(line, field, value, allowed, problems) {
+  if (allowed.includes(value)) return true;
+  problems.push(
+    `line ${line}: ${field} is \`${value}\`; allowed: ${allowed.map((a) => `\`${a}\``).join(", ")}`
+  );
+  return false;
+}
+function parseMilestones(text) {
+  const problems = [];
+  const lines = text.split(/\r?\n/);
+  const headingIdx = lines.findIndex((l) => /^#\s/.test(l));
+  if (headingIdx === -1 || lines[headingIdx]?.trim() !== "# Milestones") {
+    problems.push(
+      headingIdx === -1 ? "no heading: the file must start with `# Milestones`" : `line ${headingIdx + 1}: first heading is \`${lines[headingIdx]?.trim()}\`; it must be \`# Milestones\``
+    );
+  }
+  const table = firstTable(lines, headingIdx === -1 ? 0 : headingIdx + 1);
+  if (!table) {
+    problems.push(
+      `no milestones table: expected \`| ${MILESTONE_COLUMNS.join(" | ")} |\` after the heading`
+    );
+    return { rows: [], problems };
+  }
+  if (!checkColumns(table, MILESTONE_COLUMNS, problems)) return { rows: [], problems };
+  const rows = [];
+  const ids = /* @__PURE__ */ new Set();
+  for (const { line, cells } of table.rows) {
+    if (cells.length !== MILESTONE_COLUMNS.length) {
+      problems.push(`line ${line}: ${cells.length} cells, expected ${MILESTONE_COLUMNS.length}`);
+      continue;
+    }
+    const [id, milestone, goal, status, next, effort, deps] = cells;
+    let ok = true;
+    if (!/^M\d+$/.test(id)) {
+      problems.push(`line ${line}: id \`${id}\` is not \`M<number>\``);
+      ok = false;
+    } else if (ids.has(id)) {
+      problems.push(`line ${line}: id \`${id}\` is used twice`);
+      ok = false;
+    }
+    if (!milestone) {
+      problems.push(`line ${line}: milestone title is empty`);
+      ok = false;
+    }
+    if (!next) {
+      problems.push(`line ${line}: next step is empty \u2014 a milestone without a next step is a wish`);
+      ok = false;
+    }
+    ok = checkVocabulary(line, "goal", goal, MILESTONE_GOALS, problems) && ok;
+    ok = checkVocabulary(line, "status", status, MILESTONE_STATUSES, problems) && ok;
+    ok = checkVocabulary(line, "effort", effort, MILESTONE_EFFORTS, problems) && ok;
+    if (!ok) continue;
+    ids.add(id);
+    rows.push({
+      id,
+      milestone,
+      goal,
+      status,
+      next,
+      effort,
+      dependsOn: parseList(deps)
+    });
+  }
+  for (const r of rows) {
+    for (const d of r.dependsOn) {
+      if (!ids.has(d)) problems.push(`${r.id} depends on \`${d}\`, which is not in the table`);
+    }
+  }
+  return { rows, problems };
+}
+
+// src/engine/fleet.ts
 var pExecFile3 = promisify(execFile);
 var FLEET_LENS = "fleet-manifest";
 var FLEET_JSON_SCHEMA = "fleet-experimental-0.2";
-var CORP_WALL_ARTIFACTS = ["PROJECT_CONTEXT.md", "DECISIONS.md"];
+var GUARDED_WALL_ARTIFACTS = ["PROJECT_CONTEXT.md", "DECISIONS.md"];
 function recurringClasses(projects) {
   const byClass = /* @__PURE__ */ new Map();
   for (const p of projects) {
@@ -3756,12 +3911,12 @@ function finding3(id, tier, claim, evidence, why, action) {
     confidence: "high"
   };
 }
-function corpPersistenceRoot(manifest, name) {
-  const corpDir = path2.join(manifest.dir, "corp");
-  const root = path2.resolve(corpDir, name);
-  if (path2.dirname(root) !== corpDir || root === corpDir) {
+function guardedPersistenceRoot(manifest, name) {
+  const guardedDir = path2.join(manifest.dir, "guarded");
+  const root = path2.resolve(guardedDir, name);
+  if (path2.dirname(root) !== guardedDir || root === guardedDir) {
     throw new Error(
-      `entry name ${JSON.stringify(name)} escapes the corp persistence zone \u2014 refusing to resolve a ledger root for it`
+      `entry name ${JSON.stringify(name)} escapes the guarded persistence zone \u2014 refusing to resolve a ledger root for it`
     );
   }
   return root;
@@ -3794,7 +3949,7 @@ async function realpathOr(p) {
     return path2.resolve(p);
   }
 }
-function emailMatchesCorpHosts(email, hosts) {
+function emailMatchesGuardedHosts(email, hosts) {
   const domain = email.split("@")[1]?.toLowerCase();
   if (!domain) return false;
   return hosts.some((h) => {
@@ -3845,7 +4000,7 @@ async function checkManifest(manifest) {
       );
     }
     seen.add(entry.name);
-    if (entry.profile !== "corp" && !entry.private && !entry.trust) {
+    if (entry.profile !== "guarded" && !entry.private && !entry.trust) {
       const bad = entry.trustRaw;
       findings.push(
         finding3(
@@ -3883,14 +4038,14 @@ async function checkManifest(manifest) {
         )
       );
     }
-    if (entry.unresolved && manifest.localPresent && manifest.machineProfile !== "personal" && (entry.profile === "corp" || entry.private)) {
+    if (entry.unresolved && manifest.localPresent && manifest.machineProfile !== "personal" && (entry.profile === "guarded" || entry.private)) {
       findings.push(
         finding3(
           `${FLEET_LENS}/dangling-dir:${entry.name}`,
           "gap",
           `\`${entry.name}\` has no usable directory mapping`,
           [`${localFile}: ${entry.unresolved}`],
-          "An unmapped corp entry silently drops out of every sweep on the machine that most needs it.",
+          "An unmapped guarded entry silently drops out of every sweep on the machine that most needs it.",
           `Add a \`dirs\` mapping for \`${entry.name}\` in ${localFile}.`
         )
       );
@@ -3954,28 +4109,28 @@ async function checkManifest(manifest) {
     );
   }
   if (manifest.machineProfile === "personal") {
-    const corpCount = manifest.entries.filter((e) => e.profile === "corp" || e.private).length;
-    if (corpCount) {
+    const guardedCount = manifest.entries.filter((e) => e.profile === "guarded" || e.private).length;
+    if (guardedCount) {
       disclosures.push(
-        `machineProfile "personal": ${corpCount} corp entr${corpCount === 1 ? "y" : "ies"} deliberately absent on this machine \u2014 disclosed, not dangling.`
+        `machineProfile "personal": ${guardedCount} guarded entr${guardedCount === 1 ? "y" : "ies"} deliberately absent on this machine \u2014 disclosed, not dangling.`
       );
     }
   }
   return { findings, disclosures };
 }
-async function checkCorpWallArtifacts(entries, findings) {
+async function checkGuardedWallArtifacts(entries, findings) {
   for (const entry of entries) {
-    if (entry.profile !== "corp" || !entry.resolvedRoot) continue;
-    for (const artifact of CORP_WALL_ARTIFACTS) {
+    if (entry.profile !== "guarded" || !entry.resolvedRoot) continue;
+    for (const artifact of GUARDED_WALL_ARTIFACTS) {
       if (await pathExists(path2.join(entry.resolvedRoot, artifact))) {
         findings.push(
           finding3(
-            `${FLEET_LENS}/corp-artifact-in-repo:${entry.name}:${artifact}`,
+            `${FLEET_LENS}/guarded-artifact-in-repo:${entry.name}:${artifact}`,
             "risk",
-            `corp entry \`${entry.name}\` carries ${artifact} inside its worktree`,
+            `guarded entry \`${entry.name}\` carries ${artifact} inside its worktree`,
             [`${entry.resolvedRoot}/${artifact}`],
-            "Agent artifacts for corp repos live outside the repo by policy \u2014 an in-repo copy is one push away from colleagues' eyes and will diverge from the manifest-side truth.",
-            `Move it to the fleet's corp/${entry.name}/ zone and leave a pointer if the harness needs one.`
+            "Agent artifacts for guarded repos live outside the repo by policy \u2014 an in-repo copy is one push away from colleagues' eyes and will diverge from the manifest-side truth.",
+            `Move it to the fleet's guarded/${entry.name}/ zone and leave a pointer if the harness needs one.`
           )
         );
       }
@@ -3983,9 +4138,9 @@ async function checkCorpWallArtifacts(entries, findings) {
   }
 }
 async function checkCoverage(manifest, findings, disclosures) {
-  if (!manifest.corpHosts.length) {
+  if (!manifest.guardedHosts.length) {
     disclosures.push(
-      "Coverage check skipped \u2014 no corpHosts in the local manifest, so a corp remote cannot be recognized."
+      "Coverage check skipped \u2014 no guardedHosts in the local manifest, so a guarded remote cannot be recognized."
     );
     return;
   }
@@ -4006,16 +4161,16 @@ async function checkCoverage(manifest, findings, disclosures) {
     if (!await pathExists(path2.join(dir, ".git"))) continue;
     const remotes = await git(dir, ["config", "--get-regexp", "^remote\\..*\\.url"]);
     if (!remotes) continue;
-    const corpRemote = manifest.corpHosts.find((h) => remotes.includes(h));
-    if (corpRemote) {
+    const guardedRemote = manifest.guardedHosts.find((h) => remotes.includes(h));
+    if (guardedRemote) {
       findings.push(
         finding3(
-          `${FLEET_LENS}/unregistered-corp-remote:${d.name}`,
+          `${FLEET_LENS}/unregistered-guarded-remote:${d.name}`,
           "risk",
-          `\`${d.name}\` under the fleet root has a corp remote but is not registered`,
-          [`${dir}: remote matches ${corpRemote}`],
-          "The wall is only as good as its census \u2014 an unregistered employer checkout is corp material no sweep, wall check, or transfer plan knows exists.",
-          "Register it as a corp entry (opaque alias + local dirs mapping) or move it out of the fleet root."
+          `\`${d.name}\` under the fleet root has a guarded remote but is not registered`,
+          [`${dir}: remote matches ${guardedRemote}`],
+          "The wall is only as good as its census \u2014 an unregistered guarded checkout is guarded material no sweep, wall check, or transfer plan knows exists.",
+          "Register it as a guarded entry (opaque alias + local dirs mapping) or move it out of the fleet root."
         )
       );
     }
@@ -4063,7 +4218,7 @@ async function checkHygieneNeedles(manifest, findings, disclosures) {
       [
         ...Object.values(manifest.labels),
         ...Object.values(manifest.localDirs).map((d) => path2.basename(expandNeedleDir(d))),
-        ...manifest.corpHosts
+        ...manifest.guardedHosts
       ].filter((n) => n.length >= 3)
     )
   ];
@@ -4090,7 +4245,7 @@ async function checkHygieneNeedles(manifest, findings, disclosures) {
             "risk",
             `${file} in public-repo \`${entry.name}\` carries a needle from the fleet's private local manifest`,
             [`${file}: contains "${needle}"`],
-            "A public repo that names a private label, corp directory, or corp host joins the public and employer identities for anyone who greps.",
+            "A public repo that names a private label, guarded directory, or guarded host joins the public and guarded identities for anyone who greps.",
             "Scrub the needle from the tracked file (rewrite history if it already shipped)."
           )
         );
@@ -4101,10 +4256,10 @@ async function checkHygieneNeedles(manifest, findings, disclosures) {
 function expandNeedleDir(dir) {
   return dir.replace(/\/+$/, "");
 }
-async function checkCorpEmails(manifest, findings, disclosures) {
-  if (!manifest.corpHosts.length) {
+async function checkGuardedEmails(manifest, findings, disclosures) {
+  if (!manifest.guardedHosts.length) {
     disclosures.push(
-      "Corp-email check skipped \u2014 no corpHosts in the local manifest, so a corp domain cannot be recognized."
+      "Guarded-email check skipped \u2014 no guardedHosts in the local manifest, so a guarded domain cannot be recognized."
     );
     return;
   }
@@ -4113,21 +4268,23 @@ async function checkCorpEmails(manifest, findings, disclosures) {
     const emails = await git(entry.resolvedRoot, ["log", "-30", "--format=%ae"]);
     if (emails === null) {
       disclosures.push(
-        `Corp-email check could not run in \`${entry.name}\` (no readable commit history) \u2014 undetermined, not clean.`
+        `Guarded-email check could not run in \`${entry.name}\` (no readable commit history) \u2014 undetermined, not clean.`
       );
       continue;
     }
     const lines = emails.split("\n").filter(Boolean);
-    const matched = [...new Set(lines.filter((e) => emailMatchesCorpHosts(e, manifest.corpHosts)))];
+    const matched = [
+      ...new Set(lines.filter((e) => emailMatchesGuardedHosts(e, manifest.guardedHosts)))
+    ];
     if (matched.length) {
       const count = lines.filter((e) => matched.includes(e)).length;
       findings.push(
         finding3(
-          `${FLEET_LENS}/corp-email:${entry.name}`,
+          `${FLEET_LENS}/guarded-email:${entry.name}`,
           "risk",
-          `recent commits on personal entry \`${entry.name}\` are authored with a corp-host email`,
+          `recent commits on personal entry \`${entry.name}\` are authored with a guarded-host email`,
           [`${count} of the last ${lines.length} commits: ${matched.join(", ")}`],
-          "A corp email in a personal repo's history ties the two identities together permanently \u2014 and silently, since the machine's global git identity is usually the corp one.",
+          "A guarded email in a personal repo's history ties the two identities together permanently \u2014 and silently, since the machine's global git identity is usually the guarded one.",
           "Set the repo-local identity to the personal one and amend the unpushed commits."
         )
       );
@@ -4141,7 +4298,7 @@ async function checkGateDrift(manifest, findings, disclosures) {
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
     if (!root || !await isDirectory(root)) continue;
-    if (entry.profile === "corp" || entry.private) continue;
+    if (entry.profile === "guarded" || entry.private) continue;
     if (entry.gates === "none") {
       disclosures.push(`${entry.name}: gates declared \`none\` \u2014 deliberately absent, not missing`);
       continue;
@@ -4154,8 +4311,13 @@ async function checkGateDrift(manifest, findings, disclosures) {
       );
       continue;
     }
-    const { config } = await readConfig2(root);
-    const planned = (await planWorkflow2(root, facts, { agents: false, gates: true, gateConfig: config.gates })).filter((f) => f.executable);
+    const { config, explicit } = await readConfig2(root);
+    const planned = (await planWorkflow2(root, facts, {
+      agents: false,
+      gates: true,
+      gateConfig: config.gates,
+      gateFailOnPinned: explicit.gatesFailOn
+    })).filter((f) => f.executable);
     const missing = planned.filter((f) => !f.exists).map((f) => f.path);
     const differing = planned.filter((f) => f.exists && f.differs);
     const stale = differing.filter((f) => f.drift !== "edited").map((f) => f.path);
@@ -4194,11 +4356,11 @@ async function checkGateDrift(manifest, findings, disclosures) {
 async function collectWallFindings(manifest) {
   const findings = [];
   const disclosures = [];
-  await checkCorpWallArtifacts(manifest.entries, findings);
+  await checkGuardedWallArtifacts(manifest.entries, findings);
   await checkCoverage(manifest, findings, disclosures);
   await checkManifestRepoMachinePaths(manifest, findings, disclosures);
   await checkHygieneNeedles(manifest, findings, disclosures);
-  await checkCorpEmails(manifest, findings, disclosures);
+  await checkGuardedEmails(manifest, findings, disclosures);
   await checkGateDrift(manifest, findings, disclosures);
   return { findings, disclosures };
 }
@@ -4264,13 +4426,13 @@ async function sweepEntry(manifest, entry, opts) {
       );
     }
   }
-  const corp = entry.profile === "corp";
-  const optedIn = !corp && await pathExists(path2.join(root, ETYMD_DIR));
+  const guarded = entry.profile === "guarded";
+  const optedIn = !guarded && await pathExists(path2.join(root, ETYMD_DIR));
   const result = await runAudit(root, {
     kind: opts.kind,
-    persistLedger: !corp && opts.persistLedgers === true && optedIn,
-    readOnlyRoot: corp,
-    ledgerRoot: corp ? corpPersistenceRoot(manifest, entry.name) : void 0,
+    persistLedger: !guarded && opts.persistLedgers === true && optedIn,
+    readOnlyRoot: guarded,
+    ledgerRoot: guarded ? guardedPersistenceRoot(manifest, entry.name) : void 0,
     stateBudgets: stateBudgetsFor(entry),
     upstreamRemote
   });
@@ -4278,11 +4440,43 @@ async function sweepEntry(manifest, entry, opts) {
   if (entry.contract.placement === "none") {
     project.findings = project.findings.filter((f) => !f.id.endsWith("/no-contract"));
   }
+  const milestonesFile = entry.contract.milestones;
+  if (milestonesFile && milestonesFile !== "none") {
+    const text = await readText(path2.join(root, milestonesFile));
+    if (text === null) {
+      project.findings.push(
+        finding3(
+          `${FLEET_LENS}/milestones-missing:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` declares milestones at \`${milestonesFile}\` and the file is absent`,
+          [
+            `${path2.basename(manifest.manifestPath)}: ${entry.name}.contract.milestones = ${milestonesFile}`
+          ],
+          "The fleet board rolls every project's plan up from this file; a declared file that is absent is a row the board cannot fill.",
+          'Create it (heading `# Milestones`, then the standard table), or declare `milestones: "none"` if this project deliberately carries no plan.'
+        )
+      );
+    } else {
+      const doc = parseMilestones(text);
+      doc.problems.forEach((problem, i) => {
+        project.findings.push(
+          finding3(
+            `${FLEET_LENS}/milestones-shape:${entry.name}:${i + 1}`,
+            "gap",
+            `\`${entry.name}\` ${milestonesFile}: ${problem}`,
+            [`${milestonesFile}`],
+            "A milestones file the board cannot parse is a plan the fleet cannot see.",
+            `Fix the table to the standard shape: \`| ${MILESTONE_COLUMNS.join(" | ")} |\`.`
+          )
+        );
+      });
+    }
+  }
   for (const f of project.findings) project.counts[f.tier] += 1;
   project.stateAgeDays = stateAgeDays(result.facts);
   project.staleAfterDays = result.config.config.state.staleAfterDays;
   for (const [key, value] of Object.entries(entry.contract)) {
-    if (key === "placement" || !value) continue;
+    if (key === "placement" || key === "milestones" || !value) continue;
     const exists = await pathExists(path2.join(root, value.replace(/#.*$/, "")));
     project.disclosures.push(
       `contract override \`${key}: ${value}\` \u2014 registered, existence-checked only (${exists ? "present" : "MISSING"})`
@@ -4325,6 +4519,179 @@ async function sweepFleet(manifest, opts = {}) {
   };
 }
 
+// src/engine/propose.ts
+var PROPOSAL_SCHEMA = "proposal/1";
+var RUBRIC_CRITERIA = ["severity", "economy", "confidence", "breadth"];
+function parseRubric(text, file) {
+  const lines = [];
+  const seen = /* @__PURE__ */ new Map();
+  const rows = text.split(/\r?\n/);
+  for (const [i, raw] of rows.entries()) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const at = i + 1;
+    const refuse = (why) => new Error(
+      `${file}:${at} \`${raw.trim()}\` \u2014 ${why} (criteria: ${RUBRIC_CRITERIA.join(", ")})`
+    );
+    const sep = line.indexOf(":");
+    if (sep < 0) throw refuse("expected `criterion: <weight>`");
+    const criterion = line.slice(0, sep).trim();
+    const weightRaw = line.slice(sep + 1).trim();
+    if (!RUBRIC_CRITERIA.includes(criterion)) {
+      throw refuse(`unknown criterion \`${criterion}\``);
+    }
+    if (!/^\d+$/.test(weightRaw) || Number(weightRaw) < 1) {
+      throw refuse(`weight \`${weightRaw}\` is not a positive integer`);
+    }
+    const known = criterion;
+    if (seen.has(known)) {
+      throw new Error(
+        `${file}:${at} \`${raw.trim()}\` \u2014 criterion \`${criterion}\` is already weighted on line ${seen.get(known)}; one line per criterion`
+      );
+    }
+    seen.set(known, at);
+    lines.push({ criterion: known, weight: Number(weightRaw) });
+  }
+  if (!lines.length) {
+    throw new Error(`${file} carries no criterion lines \u2014 a rubric with no criteria scores nothing`);
+  }
+  return { lines };
+}
+var TIER_VALUE = { risk: 3, gap: 2, polish: 1 };
+var EFFORT_VALUE = { S: 3, M: 2, L: 1 };
+var CONFIDENCE_VALUE = { high: 3, medium: 2, low: 1 };
+function findingSubject(project, f) {
+  return {
+    id: `${project.name}:${f.id}`,
+    kind: "finding",
+    classId: f.id.split(":")[0] ?? f.id,
+    tier: f.tier,
+    effort: f.effort,
+    confidence: f.confidence,
+    projects: [project.name],
+    action: f.action ?? "",
+    evidence: f.evidence
+  };
+}
+function classSubject(classId, members) {
+  const pick = (order, at, dir) => {
+    const values = members.map((m) => order[at(m.finding)]);
+    const value = dir === 1 ? Math.max(...values) : Math.min(...values);
+    return Object.entries(order).find(([, v]) => v === value)[0];
+  };
+  const actions = [...new Set(members.map((m) => m.finding.action).filter(Boolean))].sort();
+  return {
+    id: `class:${classId}`,
+    kind: "class",
+    classId,
+    tier: pick(TIER_VALUE, (f) => f.tier, 1),
+    effort: pick(EFFORT_VALUE, (f) => f.effort, -1),
+    confidence: pick(CONFIDENCE_VALUE, (f) => f.confidence, -1),
+    projects: [...new Set(members.map((m) => m.project.name))].sort(),
+    action: actions.join("; "),
+    evidence: members.flatMap((m) => m.finding.evidence)
+  };
+}
+var CRITERION_VALUE = {
+  severity: (s) => TIER_VALUE[s.tier],
+  economy: (s) => EFFORT_VALUE[s.effort],
+  confidence: (s) => CONFIDENCE_VALUE[s.confidence],
+  breadth: (s) => Math.min(3, s.projects.length)
+};
+var FILENAME_RE = /^[^\s:]+\.[A-Za-z0-9]+$/;
+function extractFiles(evidence) {
+  const files = /* @__PURE__ */ new Set();
+  for (const line of evidence) {
+    const token = line.split(/[\s:]/)[0];
+    if (token && (token.includes("/") || FILENAME_RE.test(token))) files.add(token);
+  }
+  return [...files].sort();
+}
+function extractGates(files) {
+  return files.filter((f) => f.startsWith(".githooks/") || f.startsWith(".github/workflows/"));
+}
+function reversibility(files) {
+  if (!files.length) return "undetermined";
+  const generated = (f) => f.startsWith(".etymd/") || f.startsWith(".githooks/");
+  return files.every(generated) ? "regenerable" : "git-reversible";
+}
+function toProposal(s, rubric) {
+  const matched = [];
+  let score = 0;
+  for (const line of rubric.lines) {
+    const value = CRITERION_VALUE[line.criterion](s);
+    score += line.weight * value;
+    if (value >= 2) matched.push({ criterion: line.criterion, weight: line.weight, value });
+  }
+  const files = extractFiles(s.evidence);
+  return {
+    id: s.id,
+    schema: PROPOSAL_SCHEMA,
+    class: s.classId,
+    kind: s.kind,
+    projects: s.projects,
+    action: s.action,
+    effort: s.effort,
+    confidence: s.confidence,
+    score,
+    matched,
+    implications: {
+      projects: s.projects,
+      files,
+      gates: extractGates(files),
+      reversibility: reversibility(files)
+    }
+  };
+}
+function buildProposals(sweep, rubricName, rubric) {
+  const disclosures = [];
+  const personal = sweep.projects.filter((p) => p.profile === "personal");
+  const guarded = sweep.projects.filter((p) => p.profile !== "personal");
+  if (guarded.length) {
+    disclosures.push(
+      `guarded entries excluded from proposals: ${guarded.map((p) => p.name).sort().join(", ")}`
+    );
+  }
+  const notAudited = personal.filter((p) => !p.resolvedRoot || p.unresolved);
+  if (notAudited.length) {
+    disclosures.push(
+      `not audited, so not proposed: ${notAudited.map((p) => p.name).sort().join(", ")}`
+    );
+  }
+  const subjects = [];
+  for (const project of personal) {
+    for (const f of project.findings) {
+      if (f.kind === "improvement") subjects.push(findingSubject(project, f));
+    }
+  }
+  const byClass = /* @__PURE__ */ new Map();
+  for (const project of personal) {
+    for (const f of project.findings) {
+      const classId = f.id.split(":")[0] ?? f.id;
+      const entry = byClass.get(classId) ?? [];
+      entry.push({ project, finding: f });
+      byClass.set(classId, entry);
+    }
+  }
+  for (const [classId, members] of byClass) {
+    if (new Set(members.map((m) => m.project.name)).size >= 2) {
+      subjects.push(classSubject(classId, members));
+    }
+  }
+  const proposals = subjects.map((s) => toProposal(s, rubric)).sort((a, b) => b.score - a.score || a.id.localeCompare(b.id));
+  return {
+    schema: PROPOSAL_SCHEMA,
+    manifest: sweep.manifest,
+    rubric: rubricName,
+    criteria: rubric.lines,
+    proposals,
+    disclosures: [
+      ...disclosures,
+      "implications.files are path-shaped tokens extracted from finding evidence \u2014 evidence lines carrying no path are not represented there"
+    ]
+  };
+}
+
 // src/engine/premise.ts
 init_facts();
 init_scan();
@@ -4347,7 +4714,8 @@ function promoteBareTokens(text, ctx) {
     bareInvocations: 0,
     proseScripts: 0,
     hostnameLike: 0,
-    unrootedDirs: 0
+    unrootedDirs: 0,
+    namespaced: 0
   };
   const promoted = text.split(CODE_SPAN_RE).map((segment, i) => i % 2 === 1 ? segment : promoteProse(segment, ctx, skips)).join("");
   return { text: promoted, skips };
@@ -4366,28 +4734,44 @@ function promoteProse(segment, ctx, skips) {
     }
     return `\`${core}\`${trail}`;
   });
-  return withCommands.replace(/[^\s`]+/g, (token) => {
-    const m = WRAP_RE.exec(token);
-    if (!m) return token;
-    const [, lead = "", core = "", trail = ""] = m;
-    if (!core || core.includes("://") || !PATH_TOKEN_RE.test(core)) return token;
-    const first = core.slice(0, core.indexOf("/"));
-    const hostSuffix = HOSTNAME_RE.exec(first)?.[1]?.toLowerCase();
-    if (hostSuffix && !KNOWN_EXTENSIONS.has(hostSuffix)) {
-      skips.hostnameLike += 1;
+  const parts = withCommands.split(/(\s+)/);
+  for (let i = 0; i < parts.length; i += 2) {
+    parts[i] = promoteToken(parts[i], i >= 2 ? parts[i - 2] : "", ctx, skips);
+  }
+  return parts.join("");
+}
+function namespaceOf(core, prev) {
+  const ns = new RegExp(`^(${NAMESPACE_IDENT}):`).exec(core)?.[1] ?? new RegExp(`^(${NAMESPACE_IDENT}):$`).exec(prev)?.[1];
+  return ns && !NAMESPACE_STOP.has(ns.toLowerCase()) ? ns : null;
+}
+function promoteToken(token, prev, ctx, skips) {
+  const m = WRAP_RE.exec(token);
+  if (!m) return token;
+  const [, lead = "", core = "", trail = ""] = m;
+  if (!core || core.includes("://")) return token;
+  const namespace = namespaceOf(core, prev);
+  const body = namespace && core.startsWith(`${namespace}:`) ? core.slice(namespace.length + 1) : core;
+  if (!PATH_TOKEN_RE.test(body)) return token;
+  const first = body.slice(0, body.indexOf("/"));
+  const hostSuffix = HOSTNAME_RE.exec(first)?.[1]?.toLowerCase();
+  if (hostSuffix && !KNOWN_EXTENSIONS.has(hostSuffix)) {
+    skips.hostnameLike += 1;
+    return token;
+  }
+  if (body.endsWith("/")) {
+    if (!ctx.rootedDirs.has(first)) {
+      skips.unrootedDirs += 1;
       return token;
     }
-    if (core.endsWith("/")) {
-      if (!ctx.rootedDirs.has(first)) {
-        skips.unrootedDirs += 1;
-        return token;
-      }
-      return `${lead}\`${core}\`${trail}`;
-    }
-    const ext = core.toLowerCase().match(/\.([a-z0-9]{1,8})$/)?.[1];
+  } else {
+    const ext = body.toLowerCase().match(/\.([a-z0-9]{1,8})$/)?.[1];
     if (!ext || !KNOWN_EXTENSIONS.has(ext)) return token;
-    return `${lead}\`${core}\`${trail}`;
-  });
+  }
+  if (namespace) {
+    skips.namespaced += 1;
+    return token;
+  }
+  return `${lead}\`${body}\`${trail}`;
 }
 async function listRootedDirs(env) {
   const dirs = /* @__PURE__ */ new Set();
@@ -4405,7 +4789,8 @@ async function runPremise(opts) {
   const facts = await scanProject(root);
   const env = await buildTruthEnv(root, facts);
   const counters = emptyCounters();
-  const promoted = promoteBareTokens(task, { rootedDirs: await listRootedDirs(env) });
+  const rootedDirs = await listRootedDirs(env);
+  const promoted = promoteBareTokens(task, { rootedDirs });
   const text = { path: TASK_LABEL, text: promoted.text };
   const findings = [];
   const disclosures = [];
@@ -4418,6 +4803,8 @@ async function runPremise(opts) {
       subject: "The task",
       missingPathTier: "risk",
       maxPathFindings: MAX_PATH_FINDINGS,
+      rootedFirstSegments: rootedDirs,
+      treatNamespacedPrefixes: true,
       whyCommand: "The task is built on a command that does not exist \u2014 an agent will run it and fail, or quietly substitute something else and report success.",
       actionCommand: "Fix the task before handing it over: name the real script, or restore it.",
       whyPath: "The task is ABOUT this path. Acting on it means editing, testing, or reasoning about something that is not there \u2014 the wrong problem, solved precisely.",
@@ -4474,6 +4861,21 @@ async function runPremise(opts) {
       `${skips.unrootedDirs} slash-joined phrase(s) ending in \`/\` start with no directory that exists here (e.g. \`input/output/\`) \u2014 read as prose; skipped, not flagged. Backtick one to have it checked.`
     );
   }
+  if (skips.namespaced) {
+    disclosures.push(
+      `${skips.namespaced} path mention(s) in prose carry a namespace prefix (\`pc:src/x.ts\`, \`lk: src/x.ts\`) \u2014 another repo's tree, never this one; skipped, not flagged.`
+    );
+  }
+  if (counters.namespacedSkipped) {
+    disclosures.push(
+      `${counters.namespacedSkipped} backticked path mention(s) sit directly after a namespace prefix (\`pc: \`src/x.ts\`\`) \u2014 another repo's tree, not this one; skipped, not flagged.`
+    );
+  }
+  if (counters.outsideRepoSkipped) {
+    disclosures.push(
+      `${counters.outsideRepoSkipped} path(s) the task names start at no directory of this repo \u2014 typical of a path quoted from another repository or a scratchpad clone; outside this repo, not missing here. Skipped, not flagged.`
+    );
+  }
   if (counters.unverifiableCommands) {
     disclosures.push(
       `node_modules is not installed \u2014 ${counters.unverifiableCommands} command(s) matching no package script could not be checked against installed binaries; skipped, not flagged.`
@@ -4594,4 +4996,4 @@ wrong problem.
 init_version();
 init_version2();
 
-export { CONFIG_FILE, DECISIONS_FORMAT_MARKER, DEFAULT_CONFIG, EXTRACTION_THRESHOLD, FLEET_JSON_SCHEMA, FLEET_LENS, LENSES, NAME, PACK_VERSION, PREMISE_BRIEF_FILE, PREMISE_LENS, TOTAL_BUDGET_WORDS, VERSION, applyFiles, baselineCarriesMachinePath, baselinePath, buildGateInventory, buildTruthEnv, cacheFactsPath, checkDecisionRefs, checkDocRefs, checkManifest, checkTextClaims, collectWallFindings, configPath, contextEconomyLens, corpPersistenceRoot, deriveProfile, emptyCounters, expandTilde, extractCommandClaims, extractPathClaims, gateIntegrityLens, instructionTruthLens, isAlwaysAppliedCursorRule, listInstructionFiles, loadDecisionLedger, loadFleetManifest, measureContext, planWorkflow, promoteBareTokens, rankFindings, readBaseline, readCachedFacts, readConfig, readLedger, reconcileLedger, renderBrief, runAudit, runPremise, scanProject, stateFreshnessLens, sweepFleet, withoutMachinePath, writeBaseline, writeCachedFacts, writeLedger };
+export { CONFIG_FILE, DECISIONS_FORMAT_MARKER, DEFAULT_CONFIG, EXTRACTION_THRESHOLD, FLEET_JSON_SCHEMA, FLEET_LENS, LENSES, NAME, PACK_VERSION, PREMISE_BRIEF_FILE, PREMISE_LENS, PROPOSAL_SCHEMA, RUBRIC_CRITERIA, TOTAL_BUDGET_WORDS, VERSION, applyFiles, baselineCarriesMachinePath, baselinePath, buildGateInventory, buildProposals, buildTruthEnv, cacheFactsPath, checkDecisionRefs, checkDocRefs, checkManifest, checkTextClaims, collectWallFindings, configPath, contextEconomyLens, deriveProfile, emptyCounters, expandTilde, extractCommandClaims, extractPathClaims, gateIntegrityLens, guardedPersistenceRoot, instructionTruthLens, isAlwaysAppliedCursorRule, listInstructionFiles, loadDecisionLedger, loadFleetManifest, measureContext, parseRubric, planWorkflow, promoteBareTokens, rankFindings, readBaseline, readCachedFacts, readConfig, readLedger, reconcileLedger, renderBrief, runAudit, runPremise, scanProject, stateFreshnessLens, sweepFleet, withoutMachinePath, writeBaseline, writeCachedFacts, writeLedger };