etymd 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # etymd
 
+## 0.3.2
+
+### Patch Changes
+
+- A truth finding from any lens now reaches a `doctor` run.
+
+  `doctor` filters to truth-only, and it used to filter at the **lens** level — so `gate-integrity`
+  (an improvement lens) was skipped entirely, and its `hooks-not-wired` finding (tier: risk —
+  "tracked hooks exist but never run") was invisible in the one view meant to catch it. The lens
+  label was never the right granularity: a lens can emit both kinds, and "hooks exist and are
+  unwired" is as objective as anything the truth lens reports.
+
+  `kind` now lives on the Finding, defaulting to the lens kind when a finding does not set its
+  own, and the `--truth` filter operates at the finding level. Every lens still runs under
+  `--truth`; findings are filtered afterward, so nothing objective is invisible.
+
+  Also in this release: CI proves the publish tarball's exact manifest on every push (packagers
+  ignore `.gitignore`, so a stray local file can ship while every git-scoped check stays green),
+  and the generated hook companions (`.githooks/<hook>.local`) ship in this repo as a worked
+  example of the resolve-by-name convention.
+
+## 0.3.1
+
+### Patch Changes
+
+- Regeneration keeps what a repo already had, and a fleet can declare a repo has no gates.
+
+  **Preservation moved into the generator.** `etymd gates` read the existing hook and kept a test
+  step it already ran; every other caller of `planWorkflow` did not — including the fleet gate-drift
+  check, which therefore compared each repo against a hook missing checks the repo really runs.
+  That reported permanent false drift, and anyone acting on it would have silently lost a check. A
+  guarantee that holds only on the path someone remembered to wire it into is not a guarantee.
+
+  **`gates: "none"` in a fleet manifest** declares that generated gates are deliberately absent — a
+  prose repo with nothing mechanically checkable, or one that gates itself by hand. Gate drift sits
+  among the wall checks, which are deliberately not ledger-quietable because a leak or a partition
+  breach has no honest resolution except a fix; that reasoning does not transfer to a settled
+  choice, and an un-silenceable finding for a decision already made is how a report teaches people
+  to stop reading it. The absence is disclosed rather than hidden, and an _undeclared_ absence still
+  reports — silence has to be earned by declaring it.
+
+  **A hand-written `.etymd/config.json` no longer crashes the generator.** Setting only
+  `gates.failOn` threw: the type declares `commands` as required, describing the shape etymd writes
+  rather than the shape a user writes.
+
+  **The publish gate points at the committed script.** `prepublishOnly` resolving a bare
+  `artifact-check` from `PATH` meant the door guarding what actually ships was silently absent for
+  every clone but one.
+
 ## 0.3.0
 
 ### Minor Changes

package/dist/{approve-JEOEC2MV.js → approve-P255DGOI.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-TADKOW6P.js';
+import { scanProject } from './chunk-7MOBQ4N5.js';
+import { VERSION } from './chunk-B3SUTZVY.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-R74SJ7HS.js';
-import { scanProject } from './chunk-MKYPLNLH.js';
-import { VERSION } from './chunk-NFENQ3IK.js';
 import { PACK_VERSION } from './chunk-CRJHIXJH.js';
 import './chunk-YLNQQZ5F.js';
 

package/dist/{audit-GYZ5YZ7U.js → audit-IGIUGKSQ.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-export { run } from './chunk-XTAX4YNT.js';
-import './chunk-V3DPLOOM.js';
+export { run } from './chunk-WOBHQQ6H.js';
+import './chunk-WUGBAW6Z.js';
 import './chunk-LT67FU2Y.js';
 import './chunk-WWBF4Y7K.js';
 import './chunk-NMZ3RHWW.js';
 import './chunk-TADKOW6P.js';
+import './chunk-7MOBQ4N5.js';
+import './chunk-B3SUTZVY.js';
 import './chunk-R74SJ7HS.js';
-import './chunk-MKYPLNLH.js';
-import './chunk-NFENQ3IK.js';
 import './chunk-CRJHIXJH.js';
 import './chunk-YLNQQZ5F.js';

package/dist/{brief-ZK7TXAC4.js → brief-SFZ2DR65.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-TADKOW6P.js';
+import { scanProject } from './chunk-7MOBQ4N5.js';
+import './chunk-B3SUTZVY.js';
 import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
-import { scanProject } from './chunk-MKYPLNLH.js';
-import './chunk-NFENQ3IK.js';
 import './chunk-CRJHIXJH.js';
 import './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';

package/dist/{chunk-MKYPLNLH.js → chunk-7MOBQ4N5.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-NFENQ3IK.js';
+import { VERSION } from './chunk-B3SUTZVY.js';
 import { PACK_VERSION } from './chunk-CRJHIXJH.js';
 import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';

package/dist/{chunk-NFENQ3IK.js → chunk-B3SUTZVY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.3.0"};
+  version: "0.3.2"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-3NYDVB4Z.js → chunk-VFUYQLW7.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
+import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
 import { PACK_VERSION } from './chunk-CRJHIXJH.js';
-import { pathExists, readText } from './chunk-YLNQQZ5F.js';
+import { readText, pathExists } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
 
 // src/pack/templates.ts
@@ -160,7 +161,7 @@ exit 0
 function generatePrePushHook(facts, gates) {
   const run = runPrefix(facts.packageManager);
   const c = facts.commands;
-  const candidates = gates?.commands.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
+  const candidates = gates?.commands?.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
   const allowed = new Set(gates?.allowWriting ?? []);
   const steps = candidates.filter(
     (key) => Boolean(key) && (allowed.has(key) || isSafeGateCommand(c.raw[key]))
@@ -227,6 +228,16 @@ exit 0
 }
 
 // src/core/generate.ts
+function derivedCommands(facts, existingHook) {
+  const c = facts.commands;
+  const base = [c.formatCheck, c.typecheck, c.lint].filter(
+    (k) => Boolean(k) && isSafeGateCommand(c.raw[k])
+  );
+  if (c.test && existingHook && new RegExp(`\\b${c.test}\\b`).test(existingHook)) {
+    base.push(c.test);
+  }
+  return base;
+}
 async function planWorkflow(root, facts, opts) {
   const out = [];
   const add = async (rel, contents, label, executable = false) => {
@@ -246,6 +257,7 @@ async function planWorkflow(root, facts, opts) {
     await add("AGENTS.md", generateAgentsMd(facts), "Minimal operating contract (scaffold)");
   }
   if (opts.gates) {
+    const existingPrePush = await readText(path.join(root, ".githooks", "pre-push"));
     await add(".githooks/pre-commit", generatePreCommitHook(), "Process gate (pre-commit)", true);
     await add(
       ".githooks/commit-msg",
@@ -253,9 +265,15 @@ async function planWorkflow(root, facts, opts) {
       "Content screen (commit message)",
       true
     );
+    const gateConfig = opts.gateConfig?.commands?.length ? opts.gateConfig : {
+      commands: derivedCommands(facts, existingPrePush ?? void 0),
+      failOn: opts.gateConfig?.failOn ?? DEFAULT_CONFIG.gates.failOn,
+      publishGate: opts.gateConfig?.publishGate,
+      allowWriting: opts.gateConfig?.allowWriting ?? []
+    };
     await add(
       ".githooks/pre-push",
-      generatePrePushHook(facts, opts.gateConfig),
+      generatePrePushHook(facts, gateConfig),
       "Correctness gate (pre-push)",
       true
     );
@@ -271,4 +289,4 @@ async function planWorkflow(root, facts, opts) {
   return out;
 }
 
-export { isSafeGateCommand, planWorkflow, runPrefix };
+export { derivedCommands, isSafeGateCommand, planWorkflow, runPrefix };

package/dist/{chunk-XTAX4YNT.js → chunk-WOBHQQ6H.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-V3DPLOOM.js';
+import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-WUGBAW6Z.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-TADKOW6P.js';
 
 // src/commands/audit.ts

package/dist/{chunk-V3DPLOOM.js → chunk-WUGBAW6Z.js}

@@ -2,8 +2,8 @@
 import { measureContext } from './chunk-LT67FU2Y.js';
 import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-WWBF4Y7K.js';
 import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-NMZ3RHWW.js';
+import { scanProject, expandFileGlobs } from './chunk-7MOBQ4N5.js';
 import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-R74SJ7HS.js';
-import { scanProject, expandFileGlobs } from './chunk-MKYPLNLH.js';
 import { PACK_VERSION } from './chunk-CRJHIXJH.js';
 import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
@@ -474,6 +474,7 @@ function deriveGateFindings(inv, disclosures = []) {
         finding({
           id: `${LENS_ID2}/hooks-not-wired`,
           tier: "risk",
+          kind: "truth",
           claim: "Tracked .githooks/ exist but git core.hooksPath is unset \u2014 the hooks never run",
           evidence: [".githooks/"],
           why: "Every check in those hooks is silently skipped on this clone.",
@@ -1329,9 +1330,7 @@ async function runAudit(root, opts = {}) {
     };
   }
   const profile = baseline?.profile ?? deriveProfile(facts);
-  const selected = LENSES.filter(
-    (lens) => (!opts.kind || lens.kind === opts.kind) && (!opts.lensIds || opts.lensIds.includes(lens.id))
-  );
+  const selected = LENSES.filter((lens) => !opts.lensIds || opts.lensIds.includes(lens.id));
   const reports = [];
   for (const lens of selected) {
     try {
@@ -1349,11 +1348,12 @@ async function runAudit(root, opts = {}) {
       });
     }
   }
-  const all = reports.flatMap((r) => r.findings);
+  const all = reports.flatMap((r) => r.findings.map((f) => ({ ...f, kind: f.kind ?? r.kind })));
+  const visible = opts.kind ? all.filter((f) => f.kind === opts.kind) : all;
   const previous = await readLedger(ledgerRoot);
   const outOfScope = reports.flatMap((r) => r.outOfScope ?? []);
   const { ledger, diff } = reconcileLedger(previous, all, void 0, outOfScope);
-  const fullRun = selected.length === LENSES.length;
+  const fullRun = !opts.kind && !opts.lensIds;
   const ledgerWritable = !opts.readOnlyRoot || ledgerRoot !== root;
   if ((opts.persistLedger ?? true) && fullRun && ledgerWritable) {
     await writeLedger(ledgerRoot, ledger);
@@ -1364,7 +1364,7 @@ async function runAudit(root, opts = {}) {
     baseline,
     config,
     reports,
-    findings: rankFindings(visibleFindings(all, previous)),
+    findings: rankFindings(visibleFindings(visible, previous)),
     ledger,
     diff
   };

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-NFENQ3IK.js';
+import { VERSION } from './chunk-B3SUTZVY.js';
 import path from 'node:path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-GYZ5YZ7U.js');
+    const { run } = await import('./audit-IGIUGKSQ.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-OVLO4OBZ.js');
+    const { run } = await import('./init-WYVDRQ2J.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes });
   })
 );
@@ -52,19 +52,19 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-JEOEC2MV.js');
+    const { run } = await import('./approve-P255DGOI.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-RAJUFTQR.js');
+    const { run } = await import('./scan-PZFF6LDA.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-C2RTL2QV.js');
+    const { run } = await import('./doctor-4LBUZHVD.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
@@ -76,7 +76,7 @@ program.command("context").description("Measure the always-loaded context footpr
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-ZK7TXAC4.js');
+    const { run } = await import('./brief-SFZ2DR65.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
@@ -111,7 +111,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-YZGR4UC2.js');
+    const { sweep } = await import('./fleet-Q6J5XIHH.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,7 +126,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-YZGR4UC2.js');
+    const { check } = await import('./fleet-Q6J5XIHH.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -136,7 +136,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-YZGR4UC2.js');
+    const { add } = await import('./fleet-Q6J5XIHH.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -154,7 +154,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-YZGR4UC2.js');
+    const { dismiss } = await import('./fleet-Q6J5XIHH.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -169,7 +169,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-YZGR4UC2.js');
+    const { accept } = await import('./fleet-Q6J5XIHH.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -191,7 +191,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-ILE4PXDA.js');
+    const { run } = await import('./gates-T5J3H7WL.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/{doctor-C2RTL2QV.js → doctor-4LBUZHVD.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { run } from './chunk-XTAX4YNT.js';
-import './chunk-V3DPLOOM.js';
+import { run } from './chunk-WOBHQQ6H.js';
+import './chunk-WUGBAW6Z.js';
 import './chunk-LT67FU2Y.js';
 import './chunk-WWBF4Y7K.js';
 import './chunk-NMZ3RHWW.js';
 import './chunk-TADKOW6P.js';
+import './chunk-7MOBQ4N5.js';
+import './chunk-B3SUTZVY.js';
 import './chunk-R74SJ7HS.js';
-import './chunk-MKYPLNLH.js';
-import './chunk-NFENQ3IK.js';
 import './chunk-CRJHIXJH.js';
 import './chunk-YLNQQZ5F.js';
 

package/dist/{fleet-YZGR4UC2.js → fleet-Q6J5XIHH.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { dismiss, accept } from './chunk-MMPV67FW.js';
-import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-V3DPLOOM.js';
+import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-WUGBAW6Z.js';
 import './chunk-LT67FU2Y.js';
 import { readLedger } from './chunk-WWBF4Y7K.js';
 import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
 import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-TADKOW6P.js';
+import { scanProject } from './chunk-7MOBQ4N5.js';
+import './chunk-B3SUTZVY.js';
 import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
-import { scanProject } from './chunk-MKYPLNLH.js';
-import './chunk-NFENQ3IK.js';
 import './chunk-CRJHIXJH.js';
 import { readText, pathExists, git, isDirectory } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
@@ -119,6 +119,7 @@ function loadRegistryEntries(projects, manifest, manifestFile) {
       // An unknown value is NOT coerced to a default: trust gates content screening, so a typo
       // must surface as "undeclared" (a finding) rather than quietly picking an answer.
       trust: isFleetTrust(rec.trust) ? rec.trust : void 0,
+      gates: asString(rec.gates),
       trustRaw: asString(rec.trust),
       staleAfterDays: typeof rec.staleAfterDays === "number" ? rec.staleAfterDays : void 0,
       stateBudget: typeof rec.stateBudget === "number" ? rec.stateBudget : void 0,
@@ -686,13 +687,17 @@ async function checkCorpEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-IYCQETQB.js');
-  const { scanProject: scanProject2 } = await import('./scan-ZYZ7XDSJ.js');
+  const { planWorkflow } = await import('./generate-I75IEXXF.js');
+  const { scanProject: scanProject2 } = await import('./scan-IY3LCBJ6.js');
   const { readConfig } = await import('./config-MX7OYI7F.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
     if (!root || !await isDirectory(root)) continue;
     if (entry.profile === "corp" || entry.private) continue;
+    if (entry.gates === "none") {
+      disclosures.push(`${entry.name}: gates declared \`none\` \u2014 deliberately absent, not missing`);
+      continue;
+    }
     const facts = await scanProject2(root);
     if (!facts.git.isRepo) continue;
     if (facts.hooks.source === "husky" || facts.hooks.source === "husky-legacy") {

package/dist/{gates-ILE4PXDA.js → gates-T5J3H7WL.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { readConfig, CONFIG_FILE, configPath } from './chunk-NMZ3RHWW.js';
 import { applyFiles } from './chunk-EF6BPBG6.js';
-import { isSafeGateCommand, planWorkflow, runPrefix } from './chunk-3NYDVB4Z.js';
+import { derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-VFUYQLW7.js';
+import { readConfig, CONFIG_FILE, configPath } from './chunk-NMZ3RHWW.js';
 import { section, print, glyph, theme, renderPlan } from './chunk-TADKOW6P.js';
+import { scanProject } from './chunk-7MOBQ4N5.js';
+import './chunk-B3SUTZVY.js';
 import './chunk-R74SJ7HS.js';
-import { scanProject } from './chunk-MKYPLNLH.js';
-import './chunk-NFENQ3IK.js';
 import './chunk-CRJHIXJH.js';
 import { readText, git } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
@@ -55,16 +55,6 @@ var PUBLISH_GATE_VALUE = `./${PUBLISH_GATE_SCRIPT}`;
 function publishGateKey(route) {
   return route === "vscode" ? "vscode:prepublish" : "prepublishOnly";
 }
-function derivedCommands(facts, existingHook) {
-  const c = facts.commands;
-  const base = [c.formatCheck, c.typecheck, c.lint].filter(
-    (k) => Boolean(k) && isSafeGateCommand(c.raw[k])
-  );
-  if (c.test && existingHook && new RegExp(`\\b${c.test}\\b`).test(existingHook)) {
-    base.push(c.test);
-  }
-  return base;
-}
 function printGateSummary(gates, facts, source) {
   const run2 = runPrefix(facts.packageManager);
   const cmds = gates.commands.length ? gates.commands.map((c) => `${run2} ${c}`).join(", ") : "none detected";
@@ -269,4 +259,4 @@ async function run(opts) {
   }
 }
 
-export { derivedCommands, mergeGateSection, run };
+export { mergeGateSection, run };

package/dist/generate-I75IEXXF.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+export { derivedCommands, planWorkflow } from './chunk-VFUYQLW7.js';
+import './chunk-NMZ3RHWW.js';
+import './chunk-R74SJ7HS.js';
+import './chunk-CRJHIXJH.js';
+import './chunk-YLNQQZ5F.js';

package/dist/index.d.ts

@@ -279,6 +279,13 @@ interface Finding {
     id: string;
     lens: string;
     tier: FindingTier;
+    /**
+     * Whether this finding is an objective truth (the repo is lying) or an improvement opinion
+     * (something worth doing). Lives ON THE FINDING, not the lens: a lens can emit both kinds —
+     * gate-integrity is an improvement lens, but "hooks-not-wired" is an objective truth a `doctor`
+     * run must not skip. Defaulted from the lens kind when a finding does not set its own.
+     */
+    kind?: LensKind;
     /** One sentence: what is wrong / missing. */
     claim: string;
     /** File paths, job names, or metrics that ground the claim. Never empty. */
@@ -492,6 +499,15 @@ interface FleetEntry {
     /** A declared `trust` value outside the vocabulary — preserved verbatim so the check can name it. */
     trustRaw?: string;
     staleAfterDays?: number;
+    /**
+     * How this entry's git hooks are governed. `"none"` declares that generated gates are
+     * deliberately absent — a prose repo with nothing mechanically checkable, or one whose gate is
+     * hand-written on purpose. Wall findings cannot be quieted through the ledger (004: their only
+     * honest resolution is fixing them), which is right for leak and partition conditions but
+     * wrong for a state a fleet legitimately chooses; without this, a settled decision is
+     * re-reported on every sweep until the report is ignored.
+     */
+    gates?: string;
     /** Per-entry state char-budget override (ships unset — the schema slot exists). */
     stateBudget?: number;
     contract: FleetContract;

package/dist/index.js

@@ -29,7 +29,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.3.0",
+      version: "0.3.2",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",
@@ -87,7 +87,7 @@ var init_package = __esm({
         "format:check": "prettier --check . && npm run guard:md",
         "guard:md": "! grep -rnF --include=*.md --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=.git '\\*\\*' .",
         prepare: "npm run build",
-        prepublishOnly: "npm run build && artifact-check",
+        prepublishOnly: "npm run build && ./scripts/artifact-check.sh",
         changeset: "changeset",
         "version:packages": "changeset version",
         release: "npm run build && changeset publish"
@@ -1118,7 +1118,7 @@ exit 0
 function generatePrePushHook(facts, gates) {
   const run = runPrefix(facts.packageManager);
   const c = facts.commands;
-  const candidates = gates?.commands.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
+  const candidates = gates?.commands?.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
   const allowed = new Set(gates?.allowWriting ?? []);
   const steps = candidates.filter(
     (key) => Boolean(key) && (allowed.has(key) || isSafeGateCommand(c.raw[key]))
@@ -1194,8 +1194,19 @@ var init_templates = __esm({
 // src/core/generate.ts
 var generate_exports = {};
 __export(generate_exports, {
+  derivedCommands: () => derivedCommands,
   planWorkflow: () => planWorkflow
 });
+function derivedCommands(facts, existingHook) {
+  const c = facts.commands;
+  const base = [c.formatCheck, c.typecheck, c.lint].filter(
+    (k) => Boolean(k) && isSafeGateCommand(c.raw[k])
+  );
+  if (c.test && existingHook && new RegExp(`\\b${c.test}\\b`).test(existingHook)) {
+    base.push(c.test);
+  }
+  return base;
+}
 async function planWorkflow(root, facts, opts) {
   const out = [];
   const add = async (rel, contents, label, executable = false) => {
@@ -1215,6 +1226,7 @@ async function planWorkflow(root, facts, opts) {
     await add("AGENTS.md", generateAgentsMd(facts), "Minimal operating contract (scaffold)");
   }
   if (opts.gates) {
+    const existingPrePush = await readText(path.join(root, ".githooks", "pre-push"));
     await add(".githooks/pre-commit", generatePreCommitHook(), "Process gate (pre-commit)", true);
     await add(
       ".githooks/commit-msg",
@@ -1222,9 +1234,15 @@ async function planWorkflow(root, facts, opts) {
       "Content screen (commit message)",
       true
     );
+    const gateConfig = opts.gateConfig?.commands?.length ? opts.gateConfig : {
+      commands: derivedCommands(facts, existingPrePush ?? void 0),
+      failOn: opts.gateConfig?.failOn ?? DEFAULT_CONFIG.gates.failOn,
+      publishGate: opts.gateConfig?.publishGate,
+      allowWriting: opts.gateConfig?.allowWriting ?? []
+    };
     await add(
       ".githooks/pre-push",
-      generatePrePushHook(facts, opts.gateConfig),
+      generatePrePushHook(facts, gateConfig),
       "Correctness gate (pre-push)",
       true
     );
@@ -1242,6 +1260,7 @@ async function planWorkflow(root, facts, opts) {
 var init_generate = __esm({
   "src/core/generate.ts"() {
     init_templates();
+    init_config();
     init_util();
   }
 });
@@ -1787,6 +1806,7 @@ function deriveGateFindings(inv, disclosures = []) {
         finding({
           id: `${LENS_ID2}/hooks-not-wired`,
           tier: "risk",
+          kind: "truth",
           claim: "Tracked .githooks/ exist but git core.hooksPath is unset \u2014 the hooks never run",
           evidence: [".githooks/"],
           why: "Every check in those hooks is silently skipped on this clone.",
@@ -2750,9 +2770,7 @@ async function runAudit(root, opts = {}) {
     };
   }
   const profile = baseline?.profile ?? deriveProfile(facts);
-  const selected = LENSES.filter(
-    (lens) => (!opts.kind || lens.kind === opts.kind) && (!opts.lensIds || opts.lensIds.includes(lens.id))
-  );
+  const selected = LENSES.filter((lens) => !opts.lensIds || opts.lensIds.includes(lens.id));
   const reports = [];
   for (const lens of selected) {
     try {
@@ -2770,11 +2788,12 @@ async function runAudit(root, opts = {}) {
       });
     }
   }
-  const all = reports.flatMap((r) => r.findings);
+  const all = reports.flatMap((r) => r.findings.map((f) => ({ ...f, kind: f.kind ?? r.kind })));
+  const visible = opts.kind ? all.filter((f) => f.kind === opts.kind) : all;
   const previous = await readLedger(ledgerRoot);
   const outOfScope = reports.flatMap((r) => r.outOfScope ?? []);
   const { ledger, diff } = reconcileLedger(previous, all, void 0, outOfScope);
-  const fullRun = selected.length === LENSES.length;
+  const fullRun = !opts.kind && !opts.lensIds;
   const ledgerWritable = !opts.readOnlyRoot || ledgerRoot !== root;
   if ((opts.persistLedger ?? true) && fullRun && ledgerWritable) {
     await writeLedger(ledgerRoot, ledger);
@@ -2785,7 +2804,7 @@ async function runAudit(root, opts = {}) {
     baseline,
     config,
     reports,
-    findings: rankFindings(visibleFindings(all, previous)),
+    findings: rankFindings(visibleFindings(visible, previous)),
     ledger,
     diff
   };
@@ -2895,6 +2914,7 @@ function loadRegistryEntries(projects, manifest, manifestFile) {
       // An unknown value is NOT coerced to a default: trust gates content screening, so a typo
       // must surface as "undeclared" (a finding) rather than quietly picking an answer.
       trust: isFleetTrust(rec.trust) ? rec.trust : void 0,
+      gates: asString(rec.gates),
       trustRaw: asString(rec.trust),
       staleAfterDays: typeof rec.staleAfterDays === "number" ? rec.staleAfterDays : void 0,
       stateBudget: typeof rec.stateBudget === "number" ? rec.stateBudget : void 0,
@@ -3474,6 +3494,10 @@ async function checkGateDrift(manifest, findings, disclosures) {
     const root = entry.resolvedRoot;
     if (!root || !await isDirectory(root)) continue;
     if (entry.profile === "corp" || entry.private) continue;
+    if (entry.gates === "none") {
+      disclosures.push(`${entry.name}: gates declared \`none\` \u2014 deliberately absent, not missing`);
+      continue;
+    }
     const facts = await scanProject2(root);
     if (!facts.git.isRepo) continue;
     if (facts.hooks.source === "husky" || facts.hooks.source === "husky-legacy") {

package/dist/{init-OVLO4OBZ.js → init-WYVDRQ2J.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-EF6BPBG6.js';
-import { planWorkflow } from './chunk-3NYDVB4Z.js';
+import { planWorkflow } from './chunk-VFUYQLW7.js';
+import './chunk-NMZ3RHWW.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-TADKOW6P.js';
+import { scanProject } from './chunk-7MOBQ4N5.js';
+import { VERSION } from './chunk-B3SUTZVY.js';
 import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-R74SJ7HS.js';
-import { scanProject } from './chunk-MKYPLNLH.js';
-import { VERSION } from './chunk-NFENQ3IK.js';
 import { PACK_VERSION } from './chunk-CRJHIXJH.js';
 import { git, readText } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';

package/dist/scan-IY3LCBJ6.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-7MOBQ4N5.js';
+import './chunk-B3SUTZVY.js';
+import './chunk-CRJHIXJH.js';
+import './chunk-YLNQQZ5F.js';

package/dist/{scan-RAJUFTQR.js → scan-PZFF6LDA.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-TADKOW6P.js';
+import { scanProject } from './chunk-7MOBQ4N5.js';
+import './chunk-B3SUTZVY.js';
 import { writeCachedFacts } from './chunk-R74SJ7HS.js';
-import { scanProject } from './chunk-MKYPLNLH.js';
-import './chunk-NFENQ3IK.js';
 import './chunk-CRJHIXJH.js';
 import './chunk-YLNQQZ5F.js';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",
@@ -58,7 +58,7 @@
     "format:check": "prettier --check . && npm run guard:md",
     "guard:md": "! grep -rnF --include=*.md --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=.git '\\*\\*' .",
     "prepare": "npm run build",
-    "prepublishOnly": "npm run build && artifact-check",
+    "prepublishOnly": "npm run build && ./scripts/artifact-check.sh",
     "changeset": "changeset",
     "version:packages": "changeset version",
     "release": "npm run build && changeset publish"

package/dist/generate-IYCQETQB.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-export { planWorkflow } from './chunk-3NYDVB4Z.js';
-import './chunk-CRJHIXJH.js';
-import './chunk-YLNQQZ5F.js';

package/dist/scan-ZYZ7XDSJ.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-MKYPLNLH.js';
-import './chunk-NFENQ3IK.js';
-import './chunk-CRJHIXJH.js';
-import './chunk-YLNQQZ5F.js';