etymd 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # etymd
 
+## 0.17.0
+
+### Minor Changes
+
+- The content screen's allow file accepts a `generated <path-regex>` record: a path declared
+  as regenerated data is still read and still screened, but vocabulary-class patterns drop
+  for it — secret-class patterns and the machine-path check stay — and the exempted paths
+  are named in the output, so a clean run never reads as fully screened. Provenance
+  (reason, date, author) is required.
+
+### Patch Changes
+
+- 2bceef1: The fleet's gate-drift check now derives the pre-push audit tier the same way `etymd gates`
+  does. In a repo where no risk-tier rule can fire (no package manifest, no state doc) the
+  generator lowers the audit line to `--fail-on gap`; the drift comparison planned with the raw
+  config tier (`risk`), so its expectation permanently differed from the hook the generator
+  itself writes — a `gate-stale` finding on every repo of that shape, unclearable by the action
+  it names. The derivation now lives in `planWorkflow` itself, where the hook is built, so every
+  caller (the drift check, `etymd init`, the programmatic surface) generates identical bytes; a
+  tier the repo pinned in config is still never lowered.
+- 7221fea: The content screen's machine-path rule now fires only at a path boundary (line start,
+  whitespace, a quote, `=`, `(`, `[` or `:`). A home path inside a longer token or a URL —
+  a test fixture's temp root (`$ROOT/home/‹x›/`), a docs URL with a home segment — is not a
+  machine path, and no longer prints the same advisory line on every push. A bare
+  `/Users/<name>/…` or `/home/<name>/…` still hits.
+
 ## 0.16.0
 
 ### Minor Changes

package/README.md

@@ -375,6 +375,24 @@ missing a field is reported and does not apply: an exemption is a hole in the ga
 nobody signed cannot be audited later. The file is read from the repo being screened, never a
 shared location, and it screens itself out (it necessarily contains every string it exempts).
 
+The file carries a second record kind, for paths rather than lines:
+
+```
+generated ^src/data/corpus\.json$
+reason public-domain corpus, regenerated by scripts/corpus each January
+date 2026-09-04
+author someone
+```
+
+A `generated` path is data a pipeline rebuilds — a public-domain corpus, generated fixtures —
+and period English trips credential vocabulary (`passkey`, `secret`) on a schedule, training
+exactly the `--no-verify` habit the screen exists to prevent. The file is still read and still
+screened: only vocabulary-class patterns drop for it, while secret-class patterns and the
+machine-path check stay — a generated file is precisely where a real credential would be least
+visible. Provenance is unconditional (a path is never the repo naming itself), and the paths
+that took the exemption are named in the output, so a clean run never reads as fully screened
+where it was screened narrower.
+
 ### The commit subject, if you ask for it
 
 Off unless you turn it on:

package/dist/{approve-K5FFTPA4.js → approve-VN4EDBR5.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import { VERSION } from './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import { VERSION } from './chunk-BUMOGHQA.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-P6ATKV2R.js';
 import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{audit-HBNXNGD6.js → audit-PHAK5HEW.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-export { run } from './chunk-FKDT4RBP.js';
-import './chunk-UV3YIBDW.js';
-import './chunk-Y4E6ERCM.js';
+export { run } from './chunk-ANFNXFRI.js';
+import './chunk-WKP7M2B3.js';
+import './chunk-FNA4R5KT.js';
 import './chunk-3E2IPCRY.js';
 import './chunk-HI7NWPRA.js';
-import './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{brief-DOQ2DQEG.js → brief-7MWP35UI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{chunk-EJM47PIF.js → chunk-446EZNAQ.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-UYCGP5BS.js';
+import { VERSION } from './chunk-BUMOGHQA.js';
 import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-4VPBP6K6.js';
 import path from 'path';

package/dist/{chunk-FKDT4RBP.js → chunk-ANFNXFRI.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-UV3YIBDW.js';
-import { parseFailOnTier, meetsFailOn } from './chunk-Y4E6ERCM.js';
+import { runAudit } from './chunk-WKP7M2B3.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-FNA4R5KT.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-HI7NWPRA.js';
 
 // src/commands/audit.ts

package/dist/{chunk-UYCGP5BS.js → chunk-BUMOGHQA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.16.0"};
+  version: "0.17.0"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-Y4E6ERCM.js → chunk-FNA4R5KT.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { expandFileGlobs } from './chunk-EJM47PIF.js';
+import { expandFileGlobs } from './chunk-446EZNAQ.js';
 import { DEFAULT_CONFIG, CONFIG_FILE } from './chunk-P6ATKV2R.js';
 import { readText, isDirectory, matchesAnyGlob, normalizeRelPath, readJson, pathExists, git } from './chunk-4VPBP6K6.js';
 import path3 from 'path';

package/dist/{chunk-ANXGT7V3.js → chunk-LVR2DPR7.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-UV3YIBDW.js';
+import { runAudit } from './chunk-WKP7M2B3.js';
 import { readLedger } from './chunk-3E2IPCRY.js';
 import { DEFAULT_CONFIG, ETYMD_DIR } from './chunk-P6ATKV2R.js';
 import { readText, isDirectory, git, pathExists } from './chunk-4VPBP6K6.js';
@@ -1005,8 +1005,8 @@ async function checkGuardedEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-YEARCSHW.js');
-  const { scanProject } = await import('./scan-64Z6SNYF.js');
+  const { planWorkflow } = await import('./generate-FSJQFQPV.js');
+  const { scanProject } = await import('./scan-5SC47FSM.js');
   const { readConfig } = await import('./config-724Y3IOB.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
@@ -1024,8 +1024,13 @@ async function checkGateDrift(manifest, findings, disclosures) {
       );
       continue;
     }
-    const { config } = await readConfig(root);
-    const planned = (await planWorkflow(root, facts, { agents: false, gates: true, gateConfig: config.gates })).filter((f) => f.executable);
+    const { config, explicit } = await readConfig(root);
+    const planned = (await planWorkflow(root, facts, {
+      agents: false,
+      gates: true,
+      gateConfig: config.gates,
+      gateFailOnPinned: explicit.gatesFailOn
+    })).filter((f) => f.executable);
     const missing = planned.filter((f) => !f.exists).map((f) => f.path);
     const differing = planned.filter((f) => f.exists && f.differs);
     const stale = differing.filter((f) => f.drift !== "edited").map((f) => f.path);

package/dist/{chunk-OKJ3RGJB.js → chunk-PIJZUDDQ.js}

@@ -431,9 +431,13 @@ async function planWorkflow(root, facts, opts) {
       commitFormat: opts.gateConfig?.commitFormat,
       allowWriting: opts.gateConfig?.allowWriting ?? []
     };
+    const tier = deriveFailOn(facts, {
+      failOn: gateConfig.failOn,
+      explicit: opts.gateFailOnPinned ?? false
+    });
     await add(
       ".githooks/pre-push",
-      generatePrePushHook(facts, gateConfig, selfBuild),
+      generatePrePushHook(facts, { ...gateConfig, failOn: tier.failOn }, selfBuild),
       "Correctness gate (pre-push)",
       true
     );

package/dist/{chunk-UV3YIBDW.js → chunk-WKP7M2B3.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { stateFreshnessLens, rankFindings, listInstructionFiles, buildTruthEnv, emptyCounters, packageManagerUsage, checkDocRefs, listStateDocuments, loadDecisionLedger, checkDecisionRefs, checkTextClaims } from './chunk-Y4E6ERCM.js';
+import { stateFreshnessLens, rankFindings, listInstructionFiles, buildTruthEnv, emptyCounters, packageManagerUsage, checkDocRefs, listStateDocuments, loadDecisionLedger, checkDecisionRefs, checkTextClaims } from './chunk-FNA4R5KT.js';
 import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-3E2IPCRY.js';
 import { measureContext, contextFileLabel } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
+import { scanProject } from './chunk-446EZNAQ.js';
 import { DEFAULT_CONFIG, ETYMD_DIR, writeCachedFacts, readBaseline, readConfig, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE, CONFIG_FILE } from './chunk-P6ATKV2R.js';
 import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import { pathExists, readText, readJson, isCiEnvironment, isExecutable } from './chunk-4VPBP6K6.js';

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-UYCGP5BS.js';
+import { VERSION } from './chunk-BUMOGHQA.js';
 import path from 'path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-HBNXNGD6.js');
+    const { run } = await import('./audit-PHAK5HEW.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if asked").option("-y, --yes", "accept defaults without prompting (never overwrites)").option("--with-agents", "also scaffold a minimal AGENTS.md where none exists (off by default)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-Z5O2WVRJ.js');
+    const { run } = await import('./init-6RULX5JZ.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes, withAgents: opts.withAgents });
   })
 );
@@ -52,19 +52,19 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-K5FFTPA4.js');
+    const { run } = await import('./approve-VN4EDBR5.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-H3NF5IV5.js');
+    const { run } = await import('./scan-LLWW4YOU.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-X6XAGKV7.js');
+    const { run } = await import('./doctor-R4QDCAN5.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
@@ -76,7 +76,7 @@ program.command("context").description("Measure the always-loaded context footpr
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-DOQ2DQEG.js');
+    const { run } = await import('./brief-7MWP35UI.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
@@ -90,7 +90,7 @@ program.command("premise").argument("[task]", "the task you are about to hand an
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (task, opts, cmd) => action(async () => {
-    const { run } = await import('./premise-4QRU7LRI.js');
+    const { run } = await import('./premise-GFWHSR3K.js');
     await run({
       cwd: resolveCwd(cmd),
       task,
@@ -132,7 +132,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-UEFLKIRI.js');
+    const { sweep } = await import('./fleet-WPYEVHVL.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -147,7 +147,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-UEFLKIRI.js');
+    const { check } = await import('./fleet-WPYEVHVL.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -156,7 +156,7 @@ fleet.command("board").description(
   "Render the fleet board: every project's milestones (contract key `milestones`) plus a ranked initiatives table"
 ).option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--initiatives <file>", "the hand-edited initiatives table (rank | id | initiative | \u2026)").option("--out <file>", "write the Markdown board here instead of printing it").option("--json", "print the board as JSON (EXPERIMENTAL)").action(
   (opts, cmd) => action(async () => {
-    const { board } = await import('./fleet-UEFLKIRI.js');
+    const { board } = await import('./fleet-WPYEVHVL.js');
     const shared = cmd.optsWithGlobals();
     await board({
       cwd: resolveCwd(cmd),
@@ -172,7 +172,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-UEFLKIRI.js');
+    const { add } = await import('./fleet-WPYEVHVL.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -195,7 +195,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 guarded ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-UEFLKIRI.js');
+    const { dismiss } = await import('./fleet-WPYEVHVL.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -210,7 +210,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 guarded ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-UEFLKIRI.js');
+    const { accept } = await import('./fleet-WPYEVHVL.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -225,7 +225,7 @@ program.command("propose").description(
   "the fleet manifest \u2014 runs a read-only sweep now (no delta baseline move)"
 ).option("--from <file>", "read a stored `etymd fleet --json` output instead of sweeping").option("--json", "print the proposal/1 records as JSON (EXPERIMENTAL)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./propose-IKE4CUIM.js');
+    const { run } = await import('./propose-IYNOIWAO.js');
     await run({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -242,7 +242,7 @@ program.command("screen").description(
   "fork's upstream remote: files byte-identical to its refs skip vocabulary-class patterns (secret patterns stay absolute)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./screen-E4FC7W5N.js');
+    const { run } = await import('./screen-S736DXQ5.js');
     const scope = opts.message ? "message" : opts.dir ? "dir" : opts.tree ? "tree" : "staged";
     await run({
       cwd: resolveCwd(cmd),
@@ -256,7 +256,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-NVWWKMT2.js');
+    const { run } = await import('./gates-3HRGYCYY.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/{doctor-X6XAGKV7.js → doctor-R4QDCAN5.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { run } from './chunk-FKDT4RBP.js';
-import './chunk-UV3YIBDW.js';
-import './chunk-Y4E6ERCM.js';
+import { run } from './chunk-ANFNXFRI.js';
+import './chunk-WKP7M2B3.js';
+import './chunk-FNA4R5KT.js';
 import './chunk-3E2IPCRY.js';
 import './chunk-HI7NWPRA.js';
-import './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{fleet-UEFLKIRI.js → fleet-WPYEVHVL.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { dismiss, accept } from './chunk-HOR4M6EC.js';
-import { sweepFleet, FLEET_JSON_SCHEMA, checkManifest, FLEET_TRUST_VALUES, isFleetTrust, MILESTONES_FILE, parseMilestones, parseInitiatives, BOARD_JSON_SCHEMA, renderBoard, loadFleetManifest, fleetLedgerTarget, ensureFindingRecorded } from './chunk-ANXGT7V3.js';
-import './chunk-UV3YIBDW.js';
-import { parseFailOnTier, meetsFailOn } from './chunk-Y4E6ERCM.js';
+import { sweepFleet, FLEET_JSON_SCHEMA, checkManifest, FLEET_TRUST_VALUES, isFleetTrust, MILESTONES_FILE, parseMilestones, parseInitiatives, BOARD_JSON_SCHEMA, renderBoard, loadFleetManifest, fleetLedgerTarget, ensureFindingRecorded } from './chunk-LVR2DPR7.js';
+import './chunk-WKP7M2B3.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-FNA4R5KT.js';
 import './chunk-3E2IPCRY.js';
 import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import { readText, pathExists, git } from './chunk-4VPBP6K6.js';

package/dist/{gates-NVWWKMT2.js → gates-3HRGYCYY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { deriveFailOn, derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-OKJ3RGJB.js';
+import { deriveFailOn, derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-PIJZUDDQ.js';
 import { section, print, glyph, theme, renderPlan } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import { readConfig, CONFIG_FILE, configPath } from './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import { readText, git } from './chunk-4VPBP6K6.js';
@@ -202,7 +202,10 @@ async function run(opts) {
     const files = await planWorkflow(opts.cwd, facts, {
       agents: false,
       gates: true,
-      gateConfig
+      gateConfig,
+      // A pinned tier is a decision planWorkflow must not lower; an unpinned one it derives —
+      // the same flag the fleet's drift comparison passes, so both generate identical bytes.
+      gateFailOnPinned: explicit.gatesFailOn
     });
     return files.filter((f) => f.executable);
   };

package/dist/{generate-YEARCSHW.js → generate-FSJQFQPV.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-OKJ3RGJB.js';
+export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-PIJZUDDQ.js';
 import './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/index.d.ts

@@ -303,6 +303,14 @@ interface PlanOptions {
     publishGate?: boolean;
     /** Recorded gate choices; absent means derive everything from the scan. */
     gateConfig?: GateConfig;
+    /**
+     * Whether `gateConfig.failOn` was PINNED by the repo's committed config, versus a default the
+     * config loader filled in. The tier derivation may only choose between defaults — a recorded
+     * tier is a decision and is never lowered (see `deriveFailOn`). Callers that read the config
+     * pass `explicit.gatesFailOn` from `readConfig`; callers planning from a bare scan leave it
+     * unset, which is the same as unpinned.
+     */
+    gateFailOnPinned?: boolean;
 }
 /** Build the file set an onboarding would write, flagging which exist and which differ. */
 declare function planWorkflow(root: string, facts: ProjectFacts, opts: PlanOptions): Promise<GeneratedFile[]>;

package/dist/index.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.16.0",
+      version: "0.17.0",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules, skills, and the task you hand an agent against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",
@@ -1449,9 +1449,13 @@ async function planWorkflow(root, facts, opts) {
       commitFormat: opts.gateConfig?.commitFormat,
       allowWriting: opts.gateConfig?.allowWriting ?? []
     };
+    const tier = deriveFailOn(facts, {
+      failOn: gateConfig.failOn,
+      explicit: opts.gateFailOnPinned ?? false
+    });
     await add(
       ".githooks/pre-push",
-      generatePrePushHook(facts, gateConfig, selfBuild),
+      generatePrePushHook(facts, { ...gateConfig, failOn: tier.failOn }, selfBuild),
       "Correctness gate (pre-push)",
       true
     );
@@ -4307,8 +4311,13 @@ async function checkGateDrift(manifest, findings, disclosures) {
       );
       continue;
     }
-    const { config } = await readConfig2(root);
-    const planned = (await planWorkflow2(root, facts, { agents: false, gates: true, gateConfig: config.gates })).filter((f) => f.executable);
+    const { config, explicit } = await readConfig2(root);
+    const planned = (await planWorkflow2(root, facts, {
+      agents: false,
+      gates: true,
+      gateConfig: config.gates,
+      gateFailOnPinned: explicit.gatesFailOn
+    })).filter((f) => f.executable);
     const missing = planned.filter((f) => !f.exists).map((f) => f.path);
     const differing = planned.filter((f) => f.exists && f.differs);
     const stale = differing.filter((f) => f.drift !== "edited").map((f) => f.path);

package/dist/{init-Z5O2WVRJ.js → init-6RULX5JZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { planWorkflow } from './chunk-OKJ3RGJB.js';
+import { planWorkflow } from './chunk-PIJZUDDQ.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import { VERSION } from './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import { VERSION } from './chunk-BUMOGHQA.js';
 import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-P6ATKV2R.js';
 import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import { git, readText } from './chunk-4VPBP6K6.js';

package/dist/{premise-4QRU7LRI.js → premise-GFWHSR3K.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { parseFailOnTier, meetsFailOn, buildTruthEnv, emptyCounters, checkTextClaims, checkDocRefs, loadDecisionLedger, checkDecisionRefs, rankFindings, PATH_TOKEN_RE, KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP } from './chunk-Y4E6ERCM.js';
+import { parseFailOnTier, meetsFailOn, buildTruthEnv, emptyCounters, checkTextClaims, checkDocRefs, loadDecisionLedger, checkDecisionRefs, rankFindings, PATH_TOKEN_RE, KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP } from './chunk-FNA4R5KT.js';
 import { print, section, theme, renderFindings } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import { readText, pathExists } from './chunk-4VPBP6K6.js';

package/dist/{propose-IKE4CUIM.js → propose-IYNOIWAO.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { sweepFleet, loadFleetManifest, FLEET_JSON_SCHEMA } from './chunk-ANXGT7V3.js';
-import './chunk-UV3YIBDW.js';
-import './chunk-Y4E6ERCM.js';
+import { sweepFleet, loadFleetManifest, FLEET_JSON_SCHEMA } from './chunk-LVR2DPR7.js';
+import './chunk-WKP7M2B3.js';
+import './chunk-FNA4R5KT.js';
 import './chunk-3E2IPCRY.js';
 import { print, section, theme, renderFleetNotes } from './chunk-HI7NWPRA.js';
-import './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import { readText } from './chunk-4VPBP6K6.js';

package/dist/scan-5SC47FSM.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
+import './chunk-YQZDYDAK.js';
+import './chunk-4VPBP6K6.js';

package/dist/{scan-H3NF5IV5.js → scan-LLWW4YOU.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import { writeCachedFacts } from './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{screen-E4FC7W5N.js → screen-S736DXQ5.js}

@@ -6,17 +6,28 @@ import { promises } from 'fs';
 import path from 'path';
 
 var CLASS_DIRECTIVE = /^#[ \t]*class:[ \t]*(secret|vocabulary)\b/i;
-var MACHINE_PATH_RE = /\/(?:Users|home)\/[A-Za-z0-9._-]+\//;
+var MACHINE_PATH_RE = /(?:^|[\s"'=(\[:])\/(?:Users|home)\/[A-Za-z0-9._-]+\//;
 var ALLOW_MARKER = "allow-published-string";
 var ALLOW_FILE = ".etymd-screen-allow";
 var LEGACY_ALLOW_FILE = ".artifact-check-allow";
-var LABELED_LINE = /^(pattern|reason|date|author)[ \t]+(.*)$/;
+var LABELED_LINE = /^(pattern|generated|reason|date|author)[ \t]+(.*)$/;
+function compileLooseRegex(source) {
+  try {
+    return new RegExp(source, "i");
+  } catch {
+    return new RegExp(source.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+  }
+}
 function compileAllow(raw) {
-  const entries = [];
+  const lines = [];
+  const generated = [];
   let current = null;
+  let currentGen = null;
   const close = () => {
-    if (current) entries.push(current);
+    if (current) lines.push(current);
+    if (currentGen) generated.push(currentGen);
     current = null;
+    currentGen = null;
   };
   for (const rawLine of raw.split("\n")) {
     const l = rawLine.trim();
@@ -26,29 +37,26 @@ function compileAllow(raw) {
       const [, label = "", value = ""] = labeled;
       if (label === "pattern") {
         close();
-        current = makeAllowEntry(value);
+        current = { pattern: compileLooseRegex(value), isSelfName: false };
+      } else if (label === "generated") {
+        close();
+        currentGen = { path: compileLooseRegex(value) };
       } else if (current) {
         if (label === "reason") current.reason = value.trim();
         else if (label === "date") current.date = value.trim();
         else current.author = value.trim();
+      } else if (currentGen) {
+        if (label === "reason") currentGen.reason = value.trim();
+        else if (label === "date") currentGen.date = value.trim();
+        else currentGen.author = value.trim();
       }
     } else {
       close();
-      current = makeAllowEntry(l);
+      current = { pattern: compileLooseRegex(l), isSelfName: false };
     }
   }
   close();
-  return entries;
-}
-function makeAllowEntry(patternStr) {
-  try {
-    return { pattern: new RegExp(patternStr, "i"), isSelfName: false };
-  } catch {
-    return {
-      pattern: new RegExp(patternStr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i"),
-      isSelfName: false
-    };
-  }
+  return { lines, generated };
 }
 function compileOnePattern(l) {
   try {
@@ -117,11 +125,11 @@ async function selfIdentities(cwd) {
   names.delete("");
   return [...names];
 }
-function screenText(text, file, patterns, allow = [], upstreamOwned = false) {
+function screenText(text, file, patterns, allow = [], upstreamOwned = false, generatedData = false) {
   const classed = patterns.map(
     (p) => p instanceof RegExp ? { re: p, cls: "secret" } : p
   );
-  const active = upstreamOwned ? classed.filter((p) => p.cls === "secret") : classed;
+  const active = upstreamOwned || generatedData ? classed.filter((p) => p.cls === "secret") : classed;
   const hits = [];
   const lines = text.split("\n");
   for (const [i, line] of lines.entries()) {
@@ -213,9 +221,9 @@ async function run(opts) {
   }
   const usingLegacy = !await pathExists(path.join(opts.cwd, ALLOW_FILE)) && await pathExists(path.join(opts.cwd, LEGACY_ALLOW_FILE));
   const allowRaw = usingLegacy ? await readText(path.join(opts.cwd, LEGACY_ALLOW_FILE)) : await readText(path.join(opts.cwd, ALLOW_FILE));
-  const allowEntries = allowRaw ? compileAllow(allowRaw) : [];
+  const allowFile = allowRaw ? compileAllow(allowRaw) : { lines: [], generated: [] };
   const selves = await selfIdentities(opts.cwd);
-  const validatedEntries = allowEntries.filter((entry) => {
+  const validatedEntries = allowFile.lines.filter((entry) => {
     if (entry.isSelfName) return true;
     if (isSelfName(entry.pattern, selves)) {
       entry.isSelfName = true;
@@ -233,6 +241,17 @@ async function run(opts) {
     return true;
   });
   const allow = validatedEntries;
+  const generatedPaths = allowFile.generated.filter((entry) => {
+    if (entry.reason && entry.date && entry.author) return true;
+    print(
+      `  ${glyph.partial} ${theme.warn(`Missing provenance for generated-path exemption`)} ${theme.dim(String(entry.path))}`
+    );
+    print(
+      `    ${theme.dim("Format: a `generated` line, then `reason`, `date`, `author` lines \u2014 all four required")}`
+    );
+    return false;
+  });
+  const isGenerated = (rel) => generatedPaths.some((e) => e.path.test(rel));
   const active = selves.length ? patterns.filter((p) => !isSelfName(p.re, selves)) : patterns;
   const hasVocab = active.some((p) => p.cls === "vocabulary");
   const upstreamRemote = hasVocab && (opts.scope === "staged" || opts.scope === "tree") ? opts.upstream ?? await git(opts.cwd, ["config", "--get", "etymd.upstream"]) ?? void 0 : void 0;
@@ -263,6 +282,7 @@ async function run(opts) {
   const hits = [];
   let scanned = 0;
   let skippedBinary = 0;
+  const generatedExempted = [];
   if (opts.scope === "message") {
     const file = opts.target;
     if (!file) throw new Error("--message needs the message file path (the commit-msg hook's $1)");
@@ -284,7 +304,10 @@ async function run(opts) {
         continue;
       }
       scanned++;
-      hits.push(...screenText(raw, path.relative(dir, f), active, allow));
+      const rel = path.relative(dir, f);
+      const gen = isGenerated(rel);
+      if (gen) generatedExempted.push(rel);
+      hits.push(...screenText(raw, rel, active, allow, false, gen));
     }
   } else {
     const listing = opts.scope === "tree" ? await git(opts.cwd, ["ls-files"]) : await git(opts.cwd, ["diff", "--cached", "--name-only", "--diff-filter=ACM"]);
@@ -300,7 +323,9 @@ async function run(opts) {
         continue;
       }
       scanned++;
-      hits.push(...screenText(raw, rel, active, allow, isUpstreamOwned(rel)));
+      const gen = isGenerated(rel);
+      if (gen) generatedExempted.push(rel);
+      hits.push(...screenText(raw, rel, active, allow, isUpstreamOwned(rel), gen));
     }
   }
   if (upstreamNote) {
@@ -308,9 +333,16 @@ async function run(opts) {
   }
   section(
     `Content screen ${theme.dim(
-      `\xB7 ${opts.scope} \xB7 ${scanned} file(s)${skippedBinary ? ` \xB7 ${skippedBinary} binary skipped` : ""}`
+      `\xB7 ${opts.scope} \xB7 ${scanned} file(s)${skippedBinary ? ` \xB7 ${skippedBinary} binary skipped` : ""}${generatedExempted.length ? ` \xB7 ${generatedExempted.length} generated exempt` : ""}`
     )}`
   );
+  if (generatedExempted.length) {
+    print(
+      `  ${glyph.partial} ${theme.dim(
+        `generated data, vocabulary-class dropped (secret-class and machine paths still screened): ${generatedExempted.join(", ")}`
+      )}`
+    );
+  }
   if (!hits.length) {
     print(`  ${glyph.ok} ${theme.dim("clean")}`);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules, skills, and the task you hand an agent against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",

package/dist/scan-64Z6SNYF.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-EJM47PIF.js';
-import './chunk-UYCGP5BS.js';
-import './chunk-YQZDYDAK.js';
-import './chunk-4VPBP6K6.js';