etymd 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # etymd
 
+## 0.8.0
+
+### Minor Changes
+
+- f2c1bfd: `etymd gates` no longer writes a gate that cannot fail. It derives whether any risk-tier finding is
+  reachable in the repo (a package manifest to contradict, a state document to fall behind); where
+  none is, the generated hook drops to `--fail-on gap` and the output says so and why. A `failOn`
+  recorded in `.etymd/config.json` is never adjusted, and `gates` now states which tier it wrote and
+  where that tier came from — the config key was previously unmentioned anywhere in its output.
+- 743ad44: Declared-field checks are forward-only from the marker's position, not from the file. A decisions
+  file that declares required entry fields mid-life no longer demands them from the entries appended
+  above the marker — an append-only record cannot backfill them. The built-in `Scope:` check shares
+  the same gate; `Revisit:` keeps whole-file reach, since it fires only where the entry already wrote
+  a date down. Entries exempt by position are counted and named in the lens disclosures.
+
 ## 0.7.0
 
 ### Minor Changes

package/dist/{approve-TXF3MA3G.js → approve-MYOIDCAM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-XJMN2HMH.js';
-import { VERSION } from './chunk-OGIHOTLP.js';
+import { scanProject } from './chunk-CIRNG736.js';
+import { VERSION } from './chunk-72Y2V7VF.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-C7LBUFNU.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/audit-HO56CZNV.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+export { run } from './chunk-KBYEWHYX.js';
+import './chunk-PRIH2NZF.js';
+import './chunk-JSUYV26K.js';
+import './chunk-OAFYLBVG.js';
+import './chunk-D2RI3CCT.js';
+import './chunk-5BVKFJWM.js';
+import './chunk-CIRNG736.js';
+import './chunk-72Y2V7VF.js';
+import './chunk-C7LBUFNU.js';
+import './chunk-6DUDIVIC.js';
+import './chunk-IV3FYVTS.js';

package/dist/{brief-QUYHRWH6.js → brief-XI4RCNYS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-XJMN2HMH.js';
-import './chunk-OGIHOTLP.js';
+import { scanProject } from './chunk-CIRNG736.js';
+import './chunk-72Y2V7VF.js';
 import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/{chunk-OGIHOTLP.js → chunk-72Y2V7VF.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.7.0"};
+  version: "0.8.0"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-XJMN2HMH.js → chunk-CIRNG736.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-OGIHOTLP.js';
+import { VERSION } from './chunk-72Y2V7VF.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-IV3FYVTS.js';
 import path from 'node:path';

package/dist/{chunk-K7QBTANO.js → chunk-D2RI3CCT.js}

@@ -33,7 +33,7 @@ async function readConfig(root) {
   const target = configPath(root);
   const problems = [];
   if (!await pathExists(target)) {
-    return { config: DEFAULT_CONFIG, present: false, problems };
+    return { config: DEFAULT_CONFIG, present: false, problems, explicit: { gatesFailOn: false } };
   }
   const raw = await readText(target);
   let parsed;
@@ -43,11 +43,11 @@ async function readConfig(root) {
     problems.push(
       `${CONFIG_FILE} exists but is not valid JSON (${err instanceof Error ? err.message : String(err)}) \u2014 defaults used.`
     );
-    return { config: DEFAULT_CONFIG, present: true, problems };
+    return { config: DEFAULT_CONFIG, present: true, problems, explicit: { gatesFailOn: false } };
   }
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
     problems.push(`${CONFIG_FILE} must contain a JSON object \u2014 defaults used.`);
-    return { config: DEFAULT_CONFIG, present: true, problems };
+    return { config: DEFAULT_CONFIG, present: true, problems, explicit: { gatesFailOn: false } };
   }
   const obj = parsed;
   const instructions = obj.instructions ?? {};
@@ -73,6 +73,7 @@ async function readConfig(root) {
   return {
     present: true,
     problems,
+    explicit: { gatesFailOn: failOn !== void 0 },
     config: {
       instructions: {
         include: readGlobList(instructions.include, "instructions.include", problems) ?? DEFAULT_CONFIG.instructions.include,

package/dist/{chunk-OKU3HXIH.js → chunk-JSUYV26K.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-K7QBTANO.js';
+import { DEFAULT_CONFIG } from './chunk-D2RI3CCT.js';
 import { readText, wordCount, approxTokens, pathExists } from './chunk-IV3FYVTS.js';
 import { promises } from 'node:fs';
 import path from 'node:path';

package/dist/{chunk-7LVCGCHB.js → chunk-KBYEWHYX.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-LXEYYITD.js';
+import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-PRIH2NZF.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-5BVKFJWM.js';
 
 // src/commands/audit.ts

package/dist/{chunk-LXEYYITD.js → chunk-PRIH2NZF.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { measureContext } from './chunk-OKU3HXIH.js';
+import { measureContext } from './chunk-JSUYV26K.js';
 import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-OAFYLBVG.js';
-import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-K7QBTANO.js';
-import { scanProject, expandFileGlobs } from './chunk-XJMN2HMH.js';
+import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-D2RI3CCT.js';
+import { scanProject, expandFileGlobs } from './chunk-CIRNG736.js';
 import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-C7LBUFNU.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath, isExecutable } from './chunk-IV3FYVTS.js';
@@ -1187,6 +1187,7 @@ function parseDecisionsFormat(text) {
   if (!m) return null;
   const problems = [];
   const fields = [];
+  const offset = m.index ?? 0;
   const version = Number(m[1]);
   if (version !== KNOWN_FORMAT_VERSION) {
     problems.push(
@@ -1194,11 +1195,11 @@ function parseDecisionsFormat(text) {
     );
   }
   const attrs = (m[2] ?? "").trim();
-  if (!attrs) return { fields, problems };
+  if (!attrs) return { fields, offset, problems };
   const declared = /^fields=(.*)$/.exec(attrs);
   if (!declared) {
     problems.push(`marker attribute \`${attrs}\` is not understood \u2014 ignored (only \`fields=\`).`);
-    return { fields, problems };
+    return { fields, offset, problems };
   }
   const seen = new Set(BUILT_IN_FIELDS);
   for (const raw of declared[1].split(",")) {
@@ -1218,7 +1219,7 @@ function parseDecisionsFormat(text) {
   if (fields.length === 0 && problems.length === 0) {
     problems.push("marker declares `fields=` with no field names \u2014 no extra fields checked.");
   }
-  return { fields, problems };
+  return { fields, offset, problems };
 }
 function hasField(block, name) {
   return new RegExp(`${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s*]*:`).test(block);
@@ -1230,9 +1231,10 @@ function parseDecisionEntries(text) {
     const h = headings[i];
     const m = /^## (D-(\d+))\b/.exec(h[0]);
     if (!m) continue;
-    const start = (h.index ?? 0) + h[0].length;
+    const offset = h.index ?? 0;
+    const start = offset + h[0].length;
     const end = i + 1 < headings.length ? headings[i + 1].index : void 0;
-    entries.push({ id: m[1], num: Number(m[2]), block: text.slice(start, end) });
+    entries.push({ id: m[1], num: Number(m[2]), block: text.slice(start, end), offset });
   }
   return entries;
 }
@@ -1278,10 +1280,11 @@ function checkIdSequence(file, entries) {
   }
   return findings;
 }
-function checkFormatFields(file, entries, today, declaredFields) {
+function checkFormatFields(file, entries, today, declaredFields, markerOffset) {
   const findings = [];
   for (const entry of entries) {
-    for (const field of declaredFields) {
+    const bound = entry.offset >= markerOffset;
+    for (const field of bound ? declaredFields : []) {
       if (hasField(entry.block, field)) continue;
       findings.push({
         id: `${LENS_ID4}/field-missing:${file}:${entry.id}:${field}`,
@@ -1295,7 +1298,7 @@ function checkFormatFields(file, entries, today, declaredFields) {
         confidence: "high"
       });
     }
-    if (!/Scope[\s*]*:/.test(entry.block)) {
+    if (bound && !/Scope[\s*]*:/.test(entry.block)) {
       findings.push({
         id: `${LENS_ID4}/scope-missing:${file}:${entry.id}`,
         lens: LENS_ID4,
@@ -1419,12 +1422,18 @@ var stateFreshnessLens = {
         continue;
       }
       for (const problem of format.problems) disclosures.push(`${a.path}: ${problem}`);
+      const exempt = entries.filter((e) => e.offset < format.offset);
       if (format.fields.length > 0) {
         disclosures.push(
-          `${a.path} declares required entry fields: ${format.fields.join(", ")} \u2014 checked on every entry (etymd attaches no meaning to the names).`
+          `${a.path} declares required entry fields: ${format.fields.join(", ")} \u2014 checked on every entry at or after the marker (etymd attaches no meaning to the names).`
         );
       }
-      findings.push(...checkFormatFields(a.path, entries, today, format.fields));
+      if (exempt.length > 0) {
+        disclosures.push(
+          `${a.path}: ${exempt.length} entr${exempt.length === 1 ? "y" : "ies"} precede the format marker (${exempt[0]?.id}\u2026${exempt[exempt.length - 1]?.id}) \u2014 field presence not checked there (forward-only from the marker's position).`
+        );
+      }
+      findings.push(...checkFormatFields(a.path, entries, today, format.fields, format.offset));
     }
     disclosures.push(
       `Thresholds: staleAfterDays ${budgets.staleAfterDays} (3x escalates to risk), state budget ${budgets.maxChars} chars (${budgets.staleAfterDays === DEFAULT_CONFIG.state.staleAfterDays && budgets.maxChars === DEFAULT_CONFIG.state.maxChars ? `defaults \u2014 override under \`state\` in ${CONFIG_FILE}` : `set in ${CONFIG_FILE}`}). Decisions artifacts are exempt from age \u2014 old decisions are history, not defects.`

package/dist/{chunk-KTIEYKFK.js → chunk-WENIJMVV.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-K7QBTANO.js';
+import { DEFAULT_CONFIG } from './chunk-D2RI3CCT.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import { readText, pathExists } from './chunk-IV3FYVTS.js';
 import path from 'node:path';
@@ -292,6 +292,24 @@ function derivedCommands(facts, existingHook) {
   }
   return base;
 }
+function riskReachability(facts) {
+  const reasons = [];
+  if (facts.publishRoute !== "none") {
+    reasons.push("an instruction file can name a package script that no longer exists");
+  }
+  if (facts.artifacts.some((a) => a.kind === "state" && a.exists)) {
+    reasons.push("a state doc can fall far enough behind the repo to escalate");
+  }
+  return reasons;
+}
+function deriveFailOn(facts, recorded) {
+  const reachable = riskReachability(facts);
+  if (recorded.explicit) return { failOn: recorded.failOn, source: "config", reachable };
+  if (recorded.failOn === "risk" && reachable.length === 0) {
+    return { failOn: "gap", source: "derived", reachable };
+  }
+  return { failOn: recorded.failOn, source: "default", reachable };
+}
 async function planWorkflow(root, facts, opts) {
   const out = [];
   const add = async (rel, contents, label, executable = false) => {
@@ -346,4 +364,4 @@ async function planWorkflow(root, facts, opts) {
   return out;
 }
 
-export { derivedCommands, isSafeGateCommand, planWorkflow, runPrefix };
+export { deriveFailOn, derivedCommands, isSafeGateCommand, planWorkflow, riskReachability, runPrefix };

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-OGIHOTLP.js';
+import { VERSION } from './chunk-72Y2V7VF.js';
 import path from 'node:path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-354X7QN6.js');
+    const { run } = await import('./audit-HO56CZNV.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-52PR24Q4.js');
+    const { run } = await import('./init-SSAJVX52.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes });
   })
 );
@@ -52,31 +52,31 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-TXF3MA3G.js');
+    const { run } = await import('./approve-MYOIDCAM.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-GSDICQCX.js');
+    const { run } = await import('./scan-H2IPH4C3.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-2BU6WCI6.js');
+    const { run } = await import('./doctor-ZAAEVVB4.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("context").description("Measure the always-loaded context footprint and flag extraction candidates").option("--json", "print the budget as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./context-ZEUI5ESZ.js');
+    const { run } = await import('./context-5ANOP2IJ.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-QUYHRWH6.js');
+    const { run } = await import('./brief-XI4RCNYS.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
@@ -111,7 +111,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-3UQ65X4Y.js');
+    const { sweep } = await import('./fleet-6U6XW72I.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,7 +126,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-3UQ65X4Y.js');
+    const { check } = await import('./fleet-6U6XW72I.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -136,7 +136,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-3UQ65X4Y.js');
+    const { add } = await import('./fleet-6U6XW72I.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -159,7 +159,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-3UQ65X4Y.js');
+    const { dismiss } = await import('./fleet-6U6XW72I.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -174,7 +174,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-3UQ65X4Y.js');
+    const { accept } = await import('./fleet-6U6XW72I.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -196,7 +196,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-MYNOZCON.js');
+    const { run } = await import('./gates-N25LGIR2.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/{config-UJRSCDMD.js → config-7WCVZCM6.js}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-K7QBTANO.js';
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-D2RI3CCT.js';
 import './chunk-C7LBUFNU.js';
 import './chunk-IV3FYVTS.js';

package/dist/{context-ZEUI5ESZ.js → context-5ANOP2IJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { measureContext } from './chunk-OKU3HXIH.js';
-import { readConfig } from './chunk-K7QBTANO.js';
+import { measureContext } from './chunk-JSUYV26K.js';
+import { readConfig } from './chunk-D2RI3CCT.js';
 import { print, renderContext } from './chunk-5BVKFJWM.js';
 import './chunk-C7LBUFNU.js';
 import './chunk-IV3FYVTS.js';

package/dist/{doctor-2BU6WCI6.js → doctor-ZAAEVVB4.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { run } from './chunk-7LVCGCHB.js';
-import './chunk-LXEYYITD.js';
-import './chunk-OKU3HXIH.js';
+import { run } from './chunk-KBYEWHYX.js';
+import './chunk-PRIH2NZF.js';
+import './chunk-JSUYV26K.js';
 import './chunk-OAFYLBVG.js';
-import './chunk-K7QBTANO.js';
+import './chunk-D2RI3CCT.js';
 import './chunk-5BVKFJWM.js';
-import './chunk-XJMN2HMH.js';
-import './chunk-OGIHOTLP.js';
+import './chunk-CIRNG736.js';
+import './chunk-72Y2V7VF.js';
 import './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/{fleet-3UQ65X4Y.js → fleet-6U6XW72I.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { dismiss, accept } from './chunk-V2SOHPXF.js';
-import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-LXEYYITD.js';
-import './chunk-OKU3HXIH.js';
+import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-PRIH2NZF.js';
+import './chunk-JSUYV26K.js';
 import { readLedger } from './chunk-OAFYLBVG.js';
-import { DEFAULT_CONFIG } from './chunk-K7QBTANO.js';
+import { DEFAULT_CONFIG } from './chunk-D2RI3CCT.js';
 import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-XJMN2HMH.js';
-import './chunk-OGIHOTLP.js';
+import { scanProject } from './chunk-CIRNG736.js';
+import './chunk-72Y2V7VF.js';
 import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import { readText, pathExists, git, isDirectory } from './chunk-IV3FYVTS.js';
@@ -687,9 +687,9 @@ async function checkCorpEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-UTKQ4GE6.js');
-  const { scanProject: scanProject2 } = await import('./scan-M6RKDNYR.js');
-  const { readConfig } = await import('./config-UJRSCDMD.js');
+  const { planWorkflow } = await import('./generate-IPY5QIR5.js');
+  const { scanProject: scanProject2 } = await import('./scan-LVJOAOUJ.js');
+  const { readConfig } = await import('./config-7WCVZCM6.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
     if (!root || !await isDirectory(root)) continue;

package/dist/{gates-MYNOZCON.js → gates-N25LGIR2.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-EF6BPBG6.js';
-import { derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-KTIEYKFK.js';
-import { readConfig, CONFIG_FILE, configPath } from './chunk-K7QBTANO.js';
+import { deriveFailOn, derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-WENIJMVV.js';
+import { readConfig, CONFIG_FILE, configPath } from './chunk-D2RI3CCT.js';
 import { section, print, glyph, theme, renderPlan } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-XJMN2HMH.js';
-import './chunk-OGIHOTLP.js';
+import { scanProject } from './chunk-CIRNG736.js';
+import './chunk-72Y2V7VF.js';
 import './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import { readText, git } from './chunk-IV3FYVTS.js';
@@ -55,13 +55,30 @@ var PUBLISH_GATE_VALUE = `./${PUBLISH_GATE_SCRIPT}`;
 function publishGateKey(route) {
   return route === "vscode" ? "vscode:prepublish" : "prepublishOnly";
 }
-function printGateSummary(gates, facts, source) {
+function printGateSummary(gates, facts, source, tier) {
   const run2 = runPrefix(facts.packageManager);
   const shellStep = facts.shell?.scripts ? `shellcheck (${facts.shell.scripts} script${facts.shell.scripts === 1 ? "" : "s"})` : "";
   const listed = [...gates.commands.map((c) => `${run2} ${c}`), ...shellStep ? [shellStep] : []];
   const cmds = listed.length ? listed.join(", ") : "none detected";
   print(`  ${glyph.bullet} ${theme.dim("pre-push runs")} ${theme.info(cmds)}`);
-  print(`  ${glyph.bullet} ${theme.dim("audit fails on")} ${theme.info(gates.failOn)}`);
+  const origin = tier.source === "config" ? `set in ${CONFIG_FILE}` : tier.source === "derived" ? "derived \u2014 see below" : "default";
+  print(
+    `  ${glyph.bullet} ${theme.dim("audit fails on")} ${theme.info(gates.failOn)} ${theme.dim(`(${origin})`)}`
+  );
+  if (tier.reachable.length === 0) {
+    print(
+      `    ${theme.warn("no risk-tier finding can fire in this repo")} ${theme.dim("(no package manifest to contradict, no state doc to fall behind)")}`
+    );
+    print(
+      `    ${theme.dim(
+        gates.failOn === "risk" ? `\`--fail-on risk\` would be a gate that always passes \u2014 change it in ${CONFIG_FILE} under \`gates.failOn\`` : `so the tier was lowered to \`${gates.failOn}\`, which this repo can reach \u2014 pin or override it in ${CONFIG_FILE} under \`gates.failOn\``
+      )}`
+    );
+  } else if (gates.failOn === "risk") {
+    print(
+      `    ${theme.dim(`reachable at risk here: ${tier.reachable.join("; ")} \u2014 lower the tier in ${CONFIG_FILE} under \`gates.failOn\` to catch more`)}`
+    );
+  }
   print(
     `  ${glyph.bullet} ${theme.dim("publish screen")} ${theme.info(gates.publishGate ? "yes" : "no")}${gates.publishGate && !facts.publishable ? theme.dim(" (overridden)") : ""}`
   );
@@ -169,10 +186,16 @@ async function run(opts) {
     }
   }
   const existingPrePush = await readText(path.join(opts.cwd, ".githooks", "pre-push"));
-  const { config, present: hasConfig } = await readConfig(opts.cwd);
+  const { config, present: hasConfig, explicit } = await readConfig(opts.cwd);
   const configSource = { recorded: hasConfig, willRecord: !opts.yes };
+  const derivedTier = deriveFailOn(facts, {
+    failOn: config.gates.failOn,
+    explicit: explicit.gatesFailOn
+  });
+  let tier = { source: derivedTier.source, reachable: derivedTier.reachable };
   let gateConfig = {
     ...config.gates,
+    failOn: derivedTier.failOn,
     commands: config.gates.commands.length ? config.gates.commands : derivedCommands(facts, existingPrePush ?? void 0),
     publishGate: config.gates.publishGate ?? facts.publishable
   };
@@ -186,7 +209,7 @@ async function run(opts) {
   };
   let gateFiles = await plan();
   renderPlan(gateFiles, { regeneratesStale: true });
-  printGateSummary(gateConfig, facts, configSource);
+  printGateSummary(gateConfig, facts, configSource, tier);
   if (!opts.yes) {
     const choice = await select({
       message: "Install these gates?",
@@ -208,9 +231,10 @@ async function run(opts) {
         return;
       }
       gateConfig = customized;
+      tier = { source: "config", reachable: derivedTier.reachable };
       gateFiles = await plan();
       renderPlan(gateFiles);
-      printGateSummary(gateConfig, facts, configSource);
+      printGateSummary(gateConfig, facts, configSource, tier);
     }
     await writeGateConfig(opts.cwd, gateConfig);
   }
@@ -247,6 +271,11 @@ async function run(opts) {
     }
   }
   print(`  ${glyph.ok} ${theme.dim("set")} ${theme.code("core.hooksPath = .githooks")}`);
+  print(
+    `  ${glyph.ok} ${theme.dim("pre-push audit fails on")} ${theme.info(gateConfig.failOn)} ${theme.dim(
+      tier.source === "config" ? `(from ${CONFIG_FILE})` : tier.source === "derived" ? `(derived \u2014 no risk-tier finding can fire here; set \`gates.failOn\` in ${CONFIG_FILE} to pin a tier)` : `(default \u2014 set \`gates.failOn\` in ${CONFIG_FILE} to change it)`
+    )}`
+  );
   const wrotePublishGate = result.written.includes(PUBLISH_GATE_SCRIPT);
   if (wrotePublishGate) {
     const pkgPath = path.join(opts.cwd, "package.json");

package/dist/generate-IPY5QIR5.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-WENIJMVV.js';
+import './chunk-D2RI3CCT.js';
+import './chunk-C7LBUFNU.js';
+import './chunk-6DUDIVIC.js';
+import './chunk-IV3FYVTS.js';

package/dist/index.d.ts

@@ -241,6 +241,15 @@ interface LoadedConfig {
     present: boolean;
     /** Malformed or ignored input — surfaced as disclosures, never silently dropped. */
     problems: string[];
+    /**
+     * Keys the file actually set, as opposed to keys that collapsed to a default. `gates.failOn`
+     * defaults to the same word a user might write deliberately, so the resolved value cannot say
+     * which happened — and a derivation may adjust a default it chose while never touching a tier
+     * someone decided on.
+     */
+    explicit: {
+        gatesFailOn: boolean;
+    };
 }
 declare const DEFAULT_CONFIG: EtymdConfig;
 declare function configPath(root: string): string;
@@ -722,7 +731,9 @@ declare const contextEconomyLens: Lens;
  * mandatory-field checks apply to files that declared the format, never retroactively to
  * pre-existing records — old decisions are history, not defects.
  *
- * A file may append `fields=A,B` to require field names of its own choosing on every entry.
+ * A file may append `fields=A,B` to require field names of its own choosing on every entry at or
+ * after the marker — position is the gate, so a marker moved down the file exempts the history
+ * above it and one left at the top governs the whole file.
  * Etymd ships no vocabulary for those names and attaches no meaning to them: it checks only that
  * a field the file itself declared is present. A marker with no `fields=` behaves as it always
  * has, so the attribute is an extension rather than a new format version.

package/dist/index.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.7.0",
+      version: "0.8.0",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",
@@ -924,7 +924,7 @@ async function readConfig(root) {
   const target = configPath(root);
   const problems = [];
   if (!await pathExists(target)) {
-    return { config: DEFAULT_CONFIG, present: false, problems };
+    return { config: DEFAULT_CONFIG, present: false, problems, explicit: { gatesFailOn: false } };
   }
   const raw = await readText(target);
   let parsed;
@@ -934,11 +934,11 @@ async function readConfig(root) {
     problems.push(
       `${CONFIG_FILE} exists but is not valid JSON (${err instanceof Error ? err.message : String(err)}) \u2014 defaults used.`
     );
-    return { config: DEFAULT_CONFIG, present: true, problems };
+    return { config: DEFAULT_CONFIG, present: true, problems, explicit: { gatesFailOn: false } };
   }
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
     problems.push(`${CONFIG_FILE} must contain a JSON object \u2014 defaults used.`);
-    return { config: DEFAULT_CONFIG, present: true, problems };
+    return { config: DEFAULT_CONFIG, present: true, problems, explicit: { gatesFailOn: false } };
   }
   const obj = parsed;
   const instructions = obj.instructions ?? {};
@@ -964,6 +964,7 @@ async function readConfig(root) {
   return {
     present: true,
     problems,
+    explicit: { gatesFailOn: failOn !== void 0 },
     config: {
       instructions: {
         include: readGlobList(instructions.include, "instructions.include", problems) ?? DEFAULT_CONFIG.instructions.include,
@@ -1285,8 +1286,10 @@ var init_templates = __esm({
 // src/core/generate.ts
 var generate_exports = {};
 __export(generate_exports, {
+  deriveFailOn: () => deriveFailOn,
   derivedCommands: () => derivedCommands,
-  planWorkflow: () => planWorkflow
+  planWorkflow: () => planWorkflow,
+  riskReachability: () => riskReachability
 });
 function derivedCommands(facts, existingHook) {
   const c = facts.commands;
@@ -1298,6 +1301,24 @@ function derivedCommands(facts, existingHook) {
   }
   return base;
 }
+function riskReachability(facts) {
+  const reasons = [];
+  if (facts.publishRoute !== "none") {
+    reasons.push("an instruction file can name a package script that no longer exists");
+  }
+  if (facts.artifacts.some((a) => a.kind === "state" && a.exists)) {
+    reasons.push("a state doc can fall far enough behind the repo to escalate");
+  }
+  return reasons;
+}
+function deriveFailOn(facts, recorded) {
+  const reachable = riskReachability(facts);
+  if (recorded.explicit) return { failOn: recorded.failOn, source: "config", reachable };
+  if (recorded.failOn === "risk" && reachable.length === 0) {
+    return { failOn: "gap", source: "derived", reachable };
+  }
+  return { failOn: recorded.failOn, source: "default", reachable };
+}
 async function planWorkflow(root, facts, opts) {
   const out = [];
   const add = async (rel, contents, label, executable = false) => {
@@ -2627,6 +2648,7 @@ function parseDecisionsFormat(text) {
   if (!m) return null;
   const problems = [];
   const fields = [];
+  const offset = m.index ?? 0;
   const version = Number(m[1]);
   if (version !== KNOWN_FORMAT_VERSION) {
     problems.push(
@@ -2634,11 +2656,11 @@ function parseDecisionsFormat(text) {
     );
   }
   const attrs = (m[2] ?? "").trim();
-  if (!attrs) return { fields, problems };
+  if (!attrs) return { fields, offset, problems };
   const declared = /^fields=(.*)$/.exec(attrs);
   if (!declared) {
     problems.push(`marker attribute \`${attrs}\` is not understood \u2014 ignored (only \`fields=\`).`);
-    return { fields, problems };
+    return { fields, offset, problems };
   }
   const seen = new Set(BUILT_IN_FIELDS);
   for (const raw of declared[1].split(",")) {
@@ -2658,7 +2680,7 @@ function parseDecisionsFormat(text) {
   if (fields.length === 0 && problems.length === 0) {
     problems.push("marker declares `fields=` with no field names \u2014 no extra fields checked.");
   }
-  return { fields, problems };
+  return { fields, offset, problems };
 }
 function hasField(block, name) {
   return new RegExp(`${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s*]*:`).test(block);
@@ -2670,9 +2692,10 @@ function parseDecisionEntries(text) {
     const h = headings[i];
     const m = /^## (D-(\d+))\b/.exec(h[0]);
     if (!m) continue;
-    const start = (h.index ?? 0) + h[0].length;
+    const offset = h.index ?? 0;
+    const start = offset + h[0].length;
     const end = i + 1 < headings.length ? headings[i + 1].index : void 0;
-    entries.push({ id: m[1], num: Number(m[2]), block: text.slice(start, end) });
+    entries.push({ id: m[1], num: Number(m[2]), block: text.slice(start, end), offset });
   }
   return entries;
 }
@@ -2718,10 +2741,11 @@ function checkIdSequence(file, entries) {
   }
   return findings;
 }
-function checkFormatFields(file, entries, today, declaredFields) {
+function checkFormatFields(file, entries, today, declaredFields, markerOffset) {
   const findings = [];
   for (const entry of entries) {
-    for (const field of declaredFields) {
+    const bound = entry.offset >= markerOffset;
+    for (const field of bound ? declaredFields : []) {
       if (hasField(entry.block, field)) continue;
       findings.push({
         id: `${LENS_ID4}/field-missing:${file}:${entry.id}:${field}`,
@@ -2735,7 +2759,7 @@ function checkFormatFields(file, entries, today, declaredFields) {
         confidence: "high"
       });
     }
-    if (!/Scope[\s*]*:/.test(entry.block)) {
+    if (bound && !/Scope[\s*]*:/.test(entry.block)) {
       findings.push({
         id: `${LENS_ID4}/scope-missing:${file}:${entry.id}`,
         lens: LENS_ID4,
@@ -2859,12 +2883,18 @@ var stateFreshnessLens = {
         continue;
       }
       for (const problem of format.problems) disclosures.push(`${a.path}: ${problem}`);
+      const exempt = entries.filter((e) => e.offset < format.offset);
       if (format.fields.length > 0) {
         disclosures.push(
-          `${a.path} declares required entry fields: ${format.fields.join(", ")} \u2014 checked on every entry (etymd attaches no meaning to the names).`
+          `${a.path} declares required entry fields: ${format.fields.join(", ")} \u2014 checked on every entry at or after the marker (etymd attaches no meaning to the names).`
+        );
+      }
+      if (exempt.length > 0) {
+        disclosures.push(
+          `${a.path}: ${exempt.length} entr${exempt.length === 1 ? "y" : "ies"} precede the format marker (${exempt[0]?.id}\u2026${exempt[exempt.length - 1]?.id}) \u2014 field presence not checked there (forward-only from the marker's position).`
         );
       }
-      findings.push(...checkFormatFields(a.path, entries, today, format.fields));
+      findings.push(...checkFormatFields(a.path, entries, today, format.fields, format.offset));
     }
     disclosures.push(
       `Thresholds: staleAfterDays ${budgets.staleAfterDays} (3x escalates to risk), state budget ${budgets.maxChars} chars (${budgets.staleAfterDays === DEFAULT_CONFIG.state.staleAfterDays && budgets.maxChars === DEFAULT_CONFIG.state.maxChars ? `defaults \u2014 override under \`state\` in ${CONFIG_FILE}` : `set in ${CONFIG_FILE}`}). Decisions artifacts are exempt from age \u2014 old decisions are history, not defects.`

package/dist/{init-52PR24Q4.js → init-SSAJVX52.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-EF6BPBG6.js';
-import { planWorkflow } from './chunk-KTIEYKFK.js';
-import './chunk-K7QBTANO.js';
+import { planWorkflow } from './chunk-WENIJMVV.js';
+import './chunk-D2RI3CCT.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-XJMN2HMH.js';
-import { VERSION } from './chunk-OGIHOTLP.js';
+import { scanProject } from './chunk-CIRNG736.js';
+import { VERSION } from './chunk-72Y2V7VF.js';
 import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-C7LBUFNU.js';
 import { PACK_VERSION } from './chunk-6DUDIVIC.js';
 import { git, readText } from './chunk-IV3FYVTS.js';

package/dist/{scan-GSDICQCX.js → scan-H2IPH4C3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-XJMN2HMH.js';
-import './chunk-OGIHOTLP.js';
+import { scanProject } from './chunk-CIRNG736.js';
+import './chunk-72Y2V7VF.js';
 import { writeCachedFacts } from './chunk-C7LBUFNU.js';
 import './chunk-6DUDIVIC.js';
 import './chunk-IV3FYVTS.js';

package/dist/scan-LVJOAOUJ.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-CIRNG736.js';
+import './chunk-72Y2V7VF.js';
+import './chunk-6DUDIVIC.js';
+import './chunk-IV3FYVTS.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",

package/dist/audit-354X7QN6.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-export { run } from './chunk-7LVCGCHB.js';
-import './chunk-LXEYYITD.js';
-import './chunk-OKU3HXIH.js';
-import './chunk-OAFYLBVG.js';
-import './chunk-K7QBTANO.js';
-import './chunk-5BVKFJWM.js';
-import './chunk-XJMN2HMH.js';
-import './chunk-OGIHOTLP.js';
-import './chunk-C7LBUFNU.js';
-import './chunk-6DUDIVIC.js';
-import './chunk-IV3FYVTS.js';

package/dist/generate-UTKQ4GE6.js

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-export { derivedCommands, planWorkflow } from './chunk-KTIEYKFK.js';
-import './chunk-K7QBTANO.js';
-import './chunk-C7LBUFNU.js';
-import './chunk-6DUDIVIC.js';
-import './chunk-IV3FYVTS.js';

package/dist/scan-M6RKDNYR.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-XJMN2HMH.js';
-import './chunk-OGIHOTLP.js';
-import './chunk-6DUDIVIC.js';
-import './chunk-IV3FYVTS.js';