mustflow 1.18.16 → 1.31.0

package/dist/core/run-write-drift.js

@@ -0,0 +1,196 @@
+import { spawnSync } from 'node:child_process';
+import { lstatSync, readlinkSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { normalizeCommandEffects } from './command-effects.js';
+const MAX_SNAPSHOT_FILES = 20_000;
+const MAX_REPORTED_PATHS = 200;
+const RECURSIVE_SNAPSHOT_ENV = 'MUSTFLOW_WRITE_DRIFT_SNAPSHOT';
+const EXCLUDED_DIRECTORY_NAMES = new Set(['.git', 'node_modules']);
+const EXCLUDED_RELATIVE_DIRECTORY_PATHS = new Set(['.mustflow/state/runs']);
+function isRecursiveSnapshotEnabled() {
+    const value = process.env[RECURSIVE_SNAPSHOT_ENV];
+    return value === '1' || value?.toLowerCase() === 'true';
+}
+function toPosixPath(value) {
+    return value.split(path.sep).join('/');
+}
+function normalizeRelativePath(value) {
+    return toPosixPath(value).replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function pathKey(value) {
+    const normalized = normalizeRelativePath(value);
+    return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+function isExcludedDirectory(relativePath, basename) {
+    const normalized = normalizeRelativePath(relativePath);
+    return EXCLUDED_DIRECTORY_NAMES.has(basename) || EXCLUDED_RELATIVE_DIRECTORY_PATHS.has(normalized);
+}
+function signatureForPath(fullPath) {
+    const stat = lstatSync(fullPath);
+    if (stat.isSymbolicLink()) {
+        return `symlink:${readlinkSync(fullPath)}`;
+    }
+    const type = stat.isDirectory() ? 'directory' : stat.isFile() ? 'file' : 'other';
+    return `${type}:${stat.size}:${stat.mtimeMs}`;
+}
+function collectSnapshotEntries(projectRoot, currentPath, entries) {
+    const names = readdirSync(currentPath).sort((left, right) => left.localeCompare(right));
+    for (const name of names) {
+        const fullPath = path.join(currentPath, name);
+        const relativePath = normalizeRelativePath(path.relative(projectRoot, fullPath));
+        const stat = lstatSync(fullPath);
+        if (stat.isDirectory()) {
+            if (isExcludedDirectory(relativePath, name)) {
+                continue;
+            }
+            collectSnapshotEntries(projectRoot, fullPath, entries);
+            continue;
+        }
+        if (entries.size >= MAX_SNAPSHOT_FILES) {
+            throw new Error('snapshot_file_limit_exceeded');
+        }
+        entries.set(relativePath, signatureForPath(fullPath));
+    }
+}
+function captureSnapshot(projectRoot) {
+    const gitSnapshot = captureGitStatusSnapshot(projectRoot);
+    if (gitSnapshot) {
+        return gitSnapshot;
+    }
+    if (!isRecursiveSnapshotEnabled()) {
+        return {
+            ok: false,
+            entries: new Map(),
+            reason: 'git_status_unavailable_recursive_snapshot_disabled',
+            source: 'unavailable',
+        };
+    }
+    try {
+        const entries = new Map();
+        collectSnapshotEntries(projectRoot, projectRoot, entries);
+        return { ok: true, entries, reason: null, source: 'recursive_snapshot' };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            entries: new Map(),
+            reason: error instanceof Error && error.message.length > 0 ? error.message : 'snapshot_unavailable',
+            source: 'unavailable',
+        };
+    }
+}
+function captureGitStatusSnapshot(projectRoot) {
+    const result = spawnSync('git', ['-C', projectRoot, 'status', '--porcelain=v1', '-z', '--untracked-files=all'], {
+        encoding: 'utf8',
+        input: '',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+    });
+    if (result.error || result.status !== 0) {
+        return null;
+    }
+    const entries = new Map();
+    const parts = result.stdout.split('\0').filter((part) => part.length > 0);
+    for (let index = 0; index < parts.length; index += 1) {
+        const entry = parts[index] ?? '';
+        const status = entry.slice(0, 2);
+        const filePath = normalizeRelativePath(entry.slice(3));
+        if (filePath.length === 0) {
+            continue;
+        }
+        entries.set(filePath, `git:${status}`);
+        if (status.includes('R') || status.includes('C')) {
+            index += 1;
+        }
+    }
+    return {
+        ok: true,
+        entries,
+        reason: null,
+        source: 'git_status',
+    };
+}
+function listDeclaredWritePaths(projectRoot, contract, intentName) {
+    const paths = normalizeCommandEffects(projectRoot, contract, intentName)
+        .filter((effect) => effect.access === 'write')
+        .map((effect) => effect.path)
+        .filter((effectPath) => typeof effectPath === 'string');
+    return [...new Set(paths.map(normalizeRelativePath))].sort((left, right) => left.localeCompare(right));
+}
+function listObservedChangedPaths(before, after) {
+    const paths = new Set([...before.keys(), ...after.keys()]);
+    const changed = [];
+    for (const filePath of paths) {
+        if (before.get(filePath) !== after.get(filePath)) {
+            changed.push(filePath);
+        }
+    }
+    return changed.sort((left, right) => left.localeCompare(right));
+}
+function declaredPathCoversObservedPath(declaredPath, observedPath) {
+    const declaredKey = pathKey(declaredPath);
+    const observedKey = pathKey(observedPath);
+    return declaredKey === '.' || observedKey === declaredKey || observedKey.startsWith(`${declaredKey}/`);
+}
+function truncatePaths(paths) {
+    if (paths.length <= MAX_REPORTED_PATHS) {
+        return { paths, truncated: false };
+    }
+    return { paths: paths.slice(0, MAX_REPORTED_PATHS), truncated: true };
+}
+export function startRunWriteTracking(projectRoot, contract, intentName) {
+    return {
+        projectRoot,
+        declaredPaths: listDeclaredWritePaths(projectRoot, contract, intentName),
+        before: captureSnapshot(projectRoot),
+    };
+}
+export function finishRunWriteTracking(tracker) {
+    if (!tracker.before.ok) {
+        return {
+            status: 'unavailable',
+            declared_paths: tracker.declaredPaths,
+            observed_paths: [],
+            declared_observed_paths: [],
+            undeclared_paths: [],
+            observed_count: 0,
+            undeclared_count: 0,
+            has_undeclared_changes: false,
+            truncated: false,
+            reason: tracker.before.reason,
+        };
+    }
+    const after = captureSnapshot(tracker.projectRoot);
+    if (!after.ok) {
+        return {
+            status: 'unavailable',
+            declared_paths: tracker.declaredPaths,
+            observed_paths: [],
+            declared_observed_paths: [],
+            undeclared_paths: [],
+            observed_count: 0,
+            undeclared_count: 0,
+            has_undeclared_changes: false,
+            truncated: false,
+            reason: after.reason,
+        };
+    }
+    const observedPaths = listObservedChangedPaths(tracker.before.entries, after.entries);
+    const declaredObservedPaths = observedPaths.filter((observedPath) => tracker.declaredPaths.some((declaredPath) => declaredPathCoversObservedPath(declaredPath, observedPath)));
+    const undeclaredPaths = observedPaths.filter((observedPath) => !tracker.declaredPaths.some((declaredPath) => declaredPathCoversObservedPath(declaredPath, observedPath)));
+    const observed = truncatePaths(observedPaths);
+    const declaredObserved = truncatePaths(declaredObservedPaths);
+    const undeclared = truncatePaths(undeclaredPaths);
+    return {
+        status: 'checked',
+        declared_paths: tracker.declaredPaths,
+        observed_paths: observed.paths,
+        declared_observed_paths: declaredObserved.paths,
+        undeclared_paths: undeclared.paths,
+        observed_count: observedPaths.length,
+        undeclared_count: undeclaredPaths.length,
+        has_undeclared_changes: undeclaredPaths.length > 0,
+        truncated: observed.truncated || declaredObserved.truncated || undeclared.truncated,
+        reason: null,
+    };
+}

package/dist/core/secret-redaction.js

@@ -0,0 +1,39 @@
+export const REDACTED_SECRET_MARKER = '[REDACTED_SECRET]';
+const SECRET_VALUE_PATTERN = '[A-Za-z0-9_./+=:-]{8,}';
+const SECRET_REDACTION_RULES = [
+    {
+        kind: 'secret_key_value',
+        pattern: new RegExp(`\\b((?:api[_-]?key|api[_-]?token|access[_-]?token|auth[_-]?token|secret|password|passwd|private[_-]?key)\\b\\s*[:=]\\s*["']?)(${SECRET_VALUE_PATTERN})`, 'giu'),
+        replace: (_match, prefix) => `${prefix}${REDACTED_SECRET_MARKER}`,
+    },
+    {
+        kind: 'secret_token',
+        pattern: /\b(?:sk-[A-Za-z0-9]{16,}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})\b/gu,
+        replace: () => REDACTED_SECRET_MARKER,
+    },
+];
+export const SECRET_LIKE_PATTERNS = SECRET_REDACTION_RULES.map((rule) => {
+    const flags = rule.pattern.flags.replace('g', '');
+    return new RegExp(rule.pattern.source, flags);
+});
+export function textContainsSecretLike(value) {
+    return SECRET_LIKE_PATTERNS.some((pattern) => pattern.test(value));
+}
+export function redactSecretLikeText(value) {
+    let text = value;
+    let redactionCount = 0;
+    const redactionKinds = new Set();
+    for (const rule of SECRET_REDACTION_RULES) {
+        text = text.replace(rule.pattern, (...match) => {
+            redactionCount += 1;
+            redactionKinds.add(rule.kind);
+            return rule.replace(...match.map(String));
+        });
+    }
+    return {
+        text,
+        redacted: redactionCount > 0,
+        redactionCount,
+        redactionKinds: [...redactionKinds].sort(),
+    };
+}

package/dist/core/skill-route-alignment.js

@@ -5,6 +5,17 @@ const SKILL_ROUTE_SOURCE_FILES = [
     '.mustflow/docs/agent-workflow.md',
 ];
 const MARKDOWN_TABLE_SEPARATOR_PATTERN = /^:?-{3,}:?$/u;
+const BROAD_CATCH_ALL_TRIGGERS = new Set([
+    'any request',
+    'any task',
+    'any change',
+    'all requests',
+    'all tasks',
+    'all changes',
+    'every request',
+    'every task',
+    'everything',
+]);
 export const SKILL_INDEX_ROUTE_COLUMN_COUNT = 7;
 export const SKILL_INDEX_SKILL_PATH_COLUMN_INDEX = 1;
 export const SKILL_INDEX_VERIFICATION_INTENTS_COLUMN_INDEX = 5;
@@ -56,11 +67,90 @@ export function parseSkillIndexRoutes(content) {
     }
     return routes;
 }
+function normalizeRouteText(value) {
+    return value
+        .toLowerCase()
+        .replace(/`[^`]+`/gu, ' ')
+        .replace(/<[^>]+>/gu, ' ')
+        .replace(/[^a-z0-9]+/gu, ' ')
+        .trim()
+        .replace(/\s+/gu, ' ');
+}
+function collectRoutePairs(routes) {
+    const pairs = [];
+    for (let leftIndex = 0; leftIndex < routes.length; leftIndex += 1) {
+        for (let rightIndex = leftIndex + 1; rightIndex < routes.length; rightIndex += 1) {
+            const left = routes[leftIndex];
+            const right = routes[rightIndex];
+            if (left.skillPath !== right.skillPath) {
+                pairs.push({ left, right });
+            }
+        }
+    }
+    return pairs;
+}
+function routePairLabel(pair) {
+    return `${pair.left.skillPath} and ${pair.right.skillPath}`;
+}
+/**
+ * mf:anchor core.skill-route-conflict-lint
+ * purpose: Keep skill routing warnings deterministic so broad or duplicate route rows are review candidates, not LLM guesses.
+ * search: skill route conflict, duplicate trigger, broad catch-all route
+ * invariant: Route conflict warnings are heuristic warnings only; missing routes and command-intent drift remain strict errors.
+ * risk: config
+ */
+export function findSkillRouteConflictWarnings(routes) {
+    const warnings = [];
+    const triggerToRoutes = new Map();
+    const surfaceToRoutes = new Map();
+    for (const route of routes) {
+        const trigger = normalizeRouteText(route.trigger);
+        const editScope = normalizeRouteText(route.editScope);
+        const risk = normalizeRouteText(route.risk);
+        const expectedOutput = normalizeRouteText(route.expectedOutput);
+        if (BROAD_CATCH_ALL_TRIGGERS.has(trigger)) {
+            warnings.push(`${route.skillPath} route uses broad catch-all trigger "${route.trigger}" that can shadow narrower skills`);
+        }
+        if (trigger) {
+            triggerToRoutes.set(trigger, [...(triggerToRoutes.get(trigger) ?? []), route]);
+        }
+        if (editScope && risk && expectedOutput) {
+            const surfaceKey = `${editScope}\n${risk}\n${expectedOutput}`;
+            surfaceToRoutes.set(surfaceKey, [...(surfaceToRoutes.get(surfaceKey) ?? []), route]);
+        }
+    }
+    for (const pair of collectRoutePairs([...triggerToRoutes.values()].flatMap((matchingRoutes) => {
+        return matchingRoutes.length > 1 ? matchingRoutes : [];
+    }))) {
+        if (normalizeRouteText(pair.left.trigger) === normalizeRouteText(pair.right.trigger)) {
+            warnings.push(`${routePairLabel(pair)} have identical skill route trigger text`);
+        }
+    }
+    for (const pair of collectRoutePairs([...surfaceToRoutes.values()].flatMap((matchingRoutes) => {
+        return matchingRoutes.length > 1 ? matchingRoutes : [];
+    }))) {
+        const leftSurface = [
+            normalizeRouteText(pair.left.editScope),
+            normalizeRouteText(pair.left.risk),
+            normalizeRouteText(pair.left.expectedOutput),
+        ].join('\n');
+        const rightSurface = [
+            normalizeRouteText(pair.right.editScope),
+            normalizeRouteText(pair.right.risk),
+            normalizeRouteText(pair.right.expectedOutput),
+        ].join('\n');
+        if (leftSurface === rightSurface) {
+            warnings.push(`${routePairLabel(pair)} have duplicate edit scope, risk, and expected output route surface`);
+        }
+    }
+    return [...new Set(warnings)].sort((left, right) => left.localeCompare(right));
+}
 function pluralize(count, singular, plural) {
     return count === 1 ? singular : plural;
 }
 export function isSkillRouteAlignmentIssue(issue) {
     return (issue.includes('.mustflow/skills/INDEX.md route') ||
+        issue.includes('.mustflow/skills/INDEX.md .mustflow/skills/') ||
         issue.includes('.mustflow/skills/INDEX.md has duplicate route') ||
         issue.endsWith(' is not listed in .mustflow/skills/INDEX.md'));
 }

package/dist/core/source-anchors.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { SECRET_LIKE_PATTERNS, textContainsSecretLike } from './secret-redaction.js';
 export const SOURCE_ANCHOR_EXTENSIONS = new Set(['.cjs', '.go', '.js', '.jsx', '.mjs', '.py', '.rs', '.ts', '.tsx']);
 export const SOURCE_ANCHOR_DEFAULT_EXCLUDED_PATH_PARTS = new Set([
     '.git',
@@ -44,10 +45,7 @@ export const SOURCE_ANCHOR_ALLOWED_RISKS = new Set([
     'xss',
 ]);
 export const SOURCE_ANCHOR_ID_PATTERN = /^[a-z0-9][a-z0-9.-]{0,95}$/u;
-export const SOURCE_ANCHOR_SECRET_LIKE_PATTERNS = [
-    /\b(?:api[_-]?key|api[_-]?token|access[_-]?token|auth[_-]?token|secret|password|passwd|private[_-]?key)\b\s*[:=]\s*["']?[A-Za-z0-9_./+=:-]{8,}/iu,
-    /\b(?:sk-[A-Za-z0-9]{16,}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})\b/u,
-];
+export const SOURCE_ANCHOR_SECRET_LIKE_PATTERNS = SECRET_LIKE_PATTERNS;
 function toPosixPath(value) {
     return value.split(path.sep).join('/');
 }
@@ -189,7 +187,7 @@ export function sourceAnchorPathIsGeneratedOrVendor(relativePath) {
     return parts.some((part) => SOURCE_ANCHOR_GENERATED_PATH_PARTS.has(part));
 }
 export function sourceAnchorTextContainsSecretLike(value) {
-    return SOURCE_ANCHOR_SECRET_LIKE_PATTERNS.some((pattern) => pattern.test(value));
+    return textContainsSecretLike(value);
 }
 export function parseSourceAnchorsInContent(relativePath, content) {
     const lines = content.split(/\r?\n/);

package/dist/core/test-selection.js

@@ -0,0 +1,224 @@
+import { existsSync } from 'node:fs';
+import { isRecord, readStringArray, resolveMustflowConfigPath, } from './config-loading.js';
+import { readTomlFile } from './toml.js';
+import { classifyVerificationCandidate, } from './verification-plan.js';
+export const TEST_SELECTION_CONFIG_RELATIVE_PATH = '.mustflow/config/test-selection.toml';
+function uniqueSorted(values) {
+    return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
+function toPosixPath(value) {
+    return value.replace(/\\/g, '/');
+}
+function escapeRegExp(value) {
+    return value.replace(/[\\^$+?.()|[\]{}]/g, '\\$&');
+}
+function globToRegExp(pattern) {
+    const normalized = toPosixPath(pattern).replace(/^\/+/u, '');
+    let source = '^';
+    for (let index = 0; index < normalized.length;) {
+        if (normalized.startsWith('**', index)) {
+            source += '.*';
+            index += 2;
+            continue;
+        }
+        const char = normalized[index];
+        if (char === '*') {
+            source += '[^/]*';
+            index += 1;
+            continue;
+        }
+        source += escapeRegExp(char ?? '');
+        index += 1;
+    }
+    return new RegExp(`${source}$`, 'u');
+}
+function readStringField(table, key) {
+    const value = table[key];
+    return typeof value === 'string' && value.trim().length > 0 ? value : null;
+}
+function readRule(value) {
+    if (!isRecord(value) || !isRecord(value.match) || !isRecord(value.select)) {
+        return null;
+    }
+    const id = readStringField(value, 'id');
+    const risk = readStringField(value, 'risk');
+    const reason = readStringField(value, 'reason');
+    const paths = readStringArray(value.match, 'paths');
+    const surfaces = readStringArray(value.match, 'surfaces');
+    const intent = readStringField(value.select, 'intent');
+    const fallbackIntent = readStringField(value.select, 'fallback_intent');
+    const testTargets = readStringArray(value.select, 'test_targets') ?? [];
+    if (!id || !risk || !reason || !paths || paths.length === 0 || !surfaces || surfaces.length === 0 || !intent || !fallbackIntent) {
+        return null;
+    }
+    return {
+        id,
+        risk,
+        reason,
+        paths: uniqueSorted(paths),
+        surfaces: uniqueSorted(surfaces),
+        intent,
+        fallbackIntent,
+        testTargets: uniqueSorted(testTargets),
+    };
+}
+function readRules(projectRoot) {
+    const configPath = resolveMustflowConfigPath(projectRoot, TEST_SELECTION_CONFIG_RELATIVE_PATH);
+    if (!existsSync(configPath)) {
+        return {
+            status: 'missing',
+            rules: [],
+            note: 'No project-declared test selection manifest exists; mustflow will not infer a user-project test subset.',
+        };
+    }
+    try {
+        const parsed = readTomlFile(configPath);
+        if (!isRecord(parsed) || parsed.schema_version !== '1' || !Array.isArray(parsed.rules)) {
+            return {
+                status: 'invalid',
+                rules: [],
+                note: 'Project-declared test selection manifest is invalid; run mf check --strict before relying on it.',
+            };
+        }
+        const rules = parsed.rules.map(readRule);
+        if (!rules.every((rule) => rule !== null)) {
+            return {
+                status: 'invalid',
+                rules: [],
+                note: 'Project-declared test selection manifest has invalid rule shapes; run mf check --strict before relying on it.',
+            };
+        }
+        return { status: 'loaded', rules };
+    }
+    catch {
+        return {
+            status: 'invalid',
+            rules: [],
+            note: 'Project-declared test selection manifest cannot be read; run mf check --strict before relying on it.',
+        };
+    }
+}
+function ruleMatchesClassification(rule, classification) {
+    const pathMatches = rule.paths.some((pattern) => globToRegExp(pattern).test(toPosixPath(classification.path)));
+    const surfaceMatches = rule.surfaces.includes(classification.surface.kind);
+    return pathMatches && surfaceMatches;
+}
+function matchingClassifications(rule, report) {
+    return report.classifications.filter((classification) => ruleMatchesClassification(rule, classification));
+}
+function selectReason(classifications) {
+    return (classifications.flatMap((classification) => classification.surface.validationReasons)[0] ??
+        'unknown_change');
+}
+function withDetail(candidate, detail) {
+    return {
+        ...candidate,
+        detail: candidate.detail ?? detail,
+    };
+}
+function commandAcceptsTestTargets(commandContract, intent) {
+    const rawIntent = commandContract.intents[intent];
+    return isRecord(rawIntent) && isRecord(rawIntent.selection) && rawIntent.selection.accepts_test_targets === true;
+}
+function appliedTestTargetsForCandidate(rule, commandContract, candidate) {
+    return candidate.status === 'runnable' && commandAcceptsTestTargets(commandContract, candidate.intent)
+        ? rule.testTargets
+        : [];
+}
+function toReportCandidate(rule, reason, role, candidate, appliedTestTargets) {
+    return {
+        ruleId: rule.id,
+        reason,
+        intent: candidate.intent,
+        role,
+        status: candidate.status,
+        skipReason: candidate.reason,
+        detail: candidate.detail,
+        testTargets: rule.testTargets,
+        appliedTestTargets,
+        testTargetsApplied: appliedTestTargets.length > 0,
+    };
+}
+export function createProjectTestSelectionPlan(projectRoot, classificationReport, commandContract) {
+    const loaded = readRules(projectRoot);
+    if (loaded.status !== 'loaded') {
+        const status = loaded.status;
+        return {
+            report: {
+                source: 'test-selection.toml',
+                status,
+                configPath: TEST_SELECTION_CONFIG_RELATIVE_PATH,
+                authority: TEST_SELECTION_CONFIG_RELATIVE_PATH,
+                commandAuthority: '.mustflow/config/commands.toml',
+                grantsCommandAuthority: false,
+                matches: [],
+                selected: [],
+                notes: [loaded.note],
+            },
+            candidates: [],
+            selectedCandidates: [],
+        };
+    }
+    const matches = [];
+    const candidates = [];
+    const selectedCandidates = [];
+    const selectedReportCandidates = [];
+    for (const rule of loaded.rules) {
+        const classifications = matchingClassifications(rule, classificationReport);
+        if (classifications.length === 0) {
+            continue;
+        }
+        const reason = selectReason(classifications);
+        matches.push({
+            ruleId: rule.id,
+            risk: rule.risk,
+            reason: rule.reason,
+            files: uniqueSorted(classifications.map((classification) => classification.path)),
+            surfaces: uniqueSorted(classifications.map((classification) => classification.surface.kind)),
+            intent: rule.intent,
+            fallbackIntent: rule.fallbackIntent,
+            testTargets: rule.testTargets,
+        });
+        const primary = withDetail(classifyVerificationCandidate(rule.intent, commandContract.intents[rule.intent]), `Project-declared test selection rule "${rule.id}".`);
+        const primaryTestTargets = appliedTestTargetsForCandidate(rule, commandContract, primary);
+        const primaryCandidate = { reason, candidate: primary, testTargets: primaryTestTargets };
+        candidates.push(primaryCandidate);
+        if (primary.status === 'runnable') {
+            selectedCandidates.push(primaryCandidate);
+            selectedReportCandidates.push(toReportCandidate(rule, reason, 'primary', primary, primaryTestTargets));
+            continue;
+        }
+        selectedReportCandidates.push(toReportCandidate(rule, reason, 'primary', primary, primaryTestTargets));
+        const fallback = withDetail(classifyVerificationCandidate(rule.fallbackIntent, commandContract.intents[rule.fallbackIntent]), `Fallback for project-declared test selection rule "${rule.id}".`);
+        const fallbackTestTargets = appliedTestTargetsForCandidate(rule, commandContract, fallback);
+        const fallbackCandidate = { reason, candidate: fallback, testTargets: fallbackTestTargets };
+        candidates.push(fallbackCandidate);
+        if (fallback.status === 'runnable') {
+            selectedCandidates.push(fallbackCandidate);
+            selectedReportCandidates.push(toReportCandidate(rule, reason, 'fallback', fallback, fallbackTestTargets));
+        }
+    }
+    const status = matches.length > 0 ? 'matched' : 'unmatched';
+    const notes = [
+        matches.length > 0
+            ? 'Matched project-declared test selection rules are treated as a minimum selected set.'
+            : 'No project-declared test selection rules matched the current changed files.',
+        'Local index data and performance history may add suggestions later, but must not remove manifest-selected tests.',
+        'Test targets are passed only when the selected command intent declares selection.accepts_test_targets = true.',
+    ];
+    return {
+        report: {
+            source: 'test-selection.toml',
+            status,
+            configPath: TEST_SELECTION_CONFIG_RELATIVE_PATH,
+            authority: TEST_SELECTION_CONFIG_RELATIVE_PATH,
+            commandAuthority: '.mustflow/config/commands.toml',
+            grantsCommandAuthority: false,
+            matches,
+            selected: selectedReportCandidates,
+            notes,
+        },
+        candidates,
+        selectedCandidates,
+    };
+}