truthmark 2.2.0 → 2.2.1

package/dist/main.js

@@ -618,14 +618,14 @@ var parseTruthDocumentsFromYaml = (sectionLines, areaName, options) => {
   const diagnostics = [];
   const truthDocumentEntries = [];
   for (const rawEntry of rawEntries) {
-    const path14 = rawEntry && typeof rawEntry === "object" && "path" in rawEntry ? rawEntry.path : null;
+    const path12 = rawEntry && typeof rawEntry === "object" && "path" in rawEntry ? rawEntry.path : null;
     const kind = rawEntry && typeof rawEntry === "object" && "kind" in rawEntry ? rawEntry.kind : null;
     const lane = rawEntry && typeof rawEntry === "object" && "lane" in rawEntry ? rawEntry.lane : null;
-    const inferredKind = typeof path14 === "string" ? inferTruthDocumentKindFromPath(path14, options) : null;
-    const inferredLane = typeof path14 === "string" ? inferTruthDocumentLaneFromPath(path14, options) : null;
+    const inferredKind = typeof path12 === "string" ? inferTruthDocumentKindFromPath(path12, options) : null;
+    const inferredLane = typeof path12 === "string" ? inferTruthDocumentLaneFromPath(path12, options) : null;
     const normalizedKind = isTruthDocumentKind(kind) ? kind : inferredKind;
     const normalizedLane = lane === "product" || lane === "engineering" ? lane : normalizedKind ? laneForTruthDocumentKind(normalizedKind) : inferredLane;
-    if (typeof path14 !== "string" || path14.trim().length === 0 || !normalizedKind || !normalizedLane) {
+    if (typeof path12 !== "string" || path12.trim().length === 0 || !normalizedKind || !normalizedLane) {
       diagnostics.push(
         createAreaDiagnostic(
           `Area ${areaName} truth_documents entries must include non-empty path plus valid lane and kind fields.`,
@@ -635,7 +635,7 @@ var parseTruthDocumentsFromYaml = (sectionLines, areaName, options) => {
       continue;
     }
     truthDocumentEntries.push({
-      path: path14.trim(),
+      path: path12.trim(),
       kind: normalizedKind,
       kindSource: isTruthDocumentKind(kind) ? "explicit" : "inferred",
       lane: normalizedLane,
@@ -2059,7 +2059,7 @@ var EVIDENCE_AUTHORITY_INSTRUCTIONS = [
   "Implementation code and canonical truth docs are inspected evidence for current behavior; they do not silently override workflow write boundaries."
 ].join("\n");
 var REPOSITORY_INTELLIGENCE_INSTRUCTIONS = [
-  "Repository intelligence artifacts are optional derived context: RepoIndex, RouteMap, ImpactSet, and ContextPack may guide routing, context selection, and verification planning when available.",
+  "Repository intelligence artifacts are optional derived context: RepoIndex, RouteMap, ImpactSet, and WorkflowState/action context may guide routing, write boundaries, and verification planning when available.",
   "They do not override checkout evidence, canonical truth docs, route files, or workflow write boundaries.",
   "If unavailable, inspect any present Truthmark config, route files, source files, truth docs, and tests directly, then report that repository-intelligence artifacts were not generated."
 ].join("\n");
@@ -3275,7 +3275,7 @@ ${renderTruthDocOwnershipGateSection(
 ${TRUTH_DOC_DECISION_RATIONALE_PRESERVATION_INSTRUCTIONS}
 ${FEATURE_DOC_TEMPLATE_INSTRUCTIONS}
 ${renderTruthDocRestructureGateSection(
-    "Truth Sync may restructure only truth docs impacted by the current functional-code change."
+    "Truth Sync may restructure leased canonical truth docs when the current sync evidence shows repository truth is stale, even when the doc is outside the initially affected route focus."
   )}
 ${ARCHITECTURE_DOC_BOUNDARY_INSTRUCTIONS}
 ${renderRouteFirstEvidenceGateSection(
@@ -3302,7 +3302,7 @@ Parent post-sync verification:
 - block if functional code changed during sync
 - for each write lease, validate the worker report against the actual worker diff, allowedWrites, forbiddenWrites, identity fields, filesChanged, offLeaseChanges, blockers, and required report fields before accepting it
 - validate the final report against the structured Truth Sync report contract, including Claim, indented Evidence, and Result values supported, narrowed, removed, or blocked under Evidence checked
-- verify the updated docs correspond to the reviewed changed-code surface
+- verify the updated docs correspond to reviewed checkout evidence, changed-code impact, or a recorded stale-truth correction made within the sync write lease
 - verify the final report records ownership review, structure requirement, split, restructure, or blocked reason when the ownership gate fired
 - blocked outcomes must preserve the working tree as-is: no rollback, no post-block cleanup edits, and manual-review reporting of any remaining files`;
 };
@@ -3865,8 +3865,8 @@ var renderTruthmarkSkillPackage = ({
   }
   return files;
 };
-var normalizeOpenCodePermissionPath = (path14) => {
-  const normalized = path14.replace(/\\/gu, "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
+var normalizeOpenCodePermissionPath = (path12) => {
+  const normalized = path12.replace(/\\/gu, "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
   return normalized === "" ? "." : normalized;
 };
 var appendOpenCodePermissionGlob = (root, glob) => {
@@ -4994,8 +4994,8 @@ var geminiFiles = (config, block) => {
   return files;
 };
 var instructionBlockFiles = (paths, block) => {
-  return paths.map((path14) => ({
-    path: path14,
+  return paths.map((path12) => ({
+    path: path12,
     content: block,
     managedBlock: true
   }));
@@ -5119,16 +5119,16 @@ var upsertManagedBlock = (existingContent, block) => {
 
 ${block}`;
 };
-var writeManagedAgentsFile = async (rootDir, path14 = "AGENTS.md", block) => {
+var writeManagedAgentsFile = async (rootDir, path12 = "AGENTS.md", block) => {
   let existingContent = null;
   try {
-    existingContent = await fs7.readFile(resolveRepoPath(rootDir, path14), "utf8");
+    existingContent = await fs7.readFile(resolveRepoPath(rootDir, path12), "utf8");
   } catch (error) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
       throw error;
     }
   }
-  return writeRepoFile(rootDir, path14, upsertManagedBlock(existingContent, block));
+  return writeRepoFile(rootDir, path12, upsertManagedBlock(existingContent, block));
 };
 var diagnosticCategoryForPath = (filePath, config) => {
   if (filePath === "AGENTS.md") {
@@ -5394,8 +5394,53 @@ var checkAuthority = async (rootDir, config) => {
 // src/checks/frontmatter.ts
 import fs10 from "fs/promises";
 
+// src/markdown/frontmatter.ts
+import { parse as parse3 } from "yaml";
+var openingDelimiterPattern = /^(?:\uFEFF)?---[ \t]*(?:\r?\n|$)/u;
+var closingDelimiterPattern = /^---[ \t]*(?:\r?\n|$)/mu;
+var asRecord = (value) => {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return value;
+  }
+  return {};
+};
+var parseFrontmatter = (source, options = {}) => {
+  const openingMatch = openingDelimiterPattern.exec(source);
+  if (!openingMatch) {
+    return {
+      data: {},
+      content: source.replace(/^\uFEFF/u, "")
+    };
+  }
+  const bodyStart = openingMatch[0].length;
+  const bodyAndContent = source.slice(bodyStart);
+  const closingMatch = closingDelimiterPattern.exec(bodyAndContent);
+  if (!closingMatch || typeof closingMatch.index !== "number") {
+    return {
+      data: {},
+      content: source.replace(/^\uFEFF/u, "")
+    };
+  }
+  const yamlSource = bodyAndContent.slice(0, closingMatch.index);
+  const content = bodyAndContent.slice(closingMatch.index + closingMatch[0].length);
+  let data = {};
+  if (yamlSource.trim().length > 0) {
+    try {
+      data = asRecord(parse3(yamlSource));
+    } catch (error) {
+      if (options.throwOnInvalid) {
+        throw error;
+      }
+      data = {};
+    }
+  }
+  return {
+    data,
+    content
+  };
+};
+
 // src/markdown/parse.ts
-import matter from "gray-matter";
 import { unified } from "unified";
 import remarkParse from "remark-parse";
 import { visit } from "unist-util-visit";
@@ -5409,7 +5454,7 @@ var isInternalLink = (url) => {
   return url.startsWith("#") || !url.includes("://") && !url.startsWith("mailto:");
 };
 var parseMarkdownDocument = (source) => {
-  const parsed = matter(source);
+  const parsed = parseFrontmatter(source);
   const tree = unified().use(remarkParse).parse(parsed.content);
   const headings = [];
   const internalLinks = [];
@@ -5452,6 +5497,7 @@ var checkFrontmatter = async (rootDir, config, markdownPaths, truthDocumentEntri
     const source = await fs10.readFile(absolutePath, "utf8");
     let document;
     try {
+      parseFrontmatter(source, { throwOnInvalid: true });
       document = parseMarkdownDocument(source);
     } catch (error) {
       diagnostics.push({
@@ -6646,24 +6692,18 @@ var checkGeneratedSurfaces = async (rootDir, config) => {
 };
 
 // src/impact/build.ts
-import path11 from "path";
+import path10 from "path";
 import micromatch7 from "micromatch";
 
-// src/repo-index/build.ts
-import fs18 from "fs/promises";
-import path9 from "path";
-
 // src/repo-index/file-tree.ts
 import fs16 from "fs/promises";
 import path7 from "path";
 import { execa as execa2 } from "execa";
 import fg5 from "fast-glob";
-import matter3 from "gray-matter";
 import micromatch6 from "micromatch";
 
 // src/truth/source-references.ts
 import path6 from "path";
-import matter2 from "gray-matter";
 var repoRootPrefixes = [
   ".codex/",
   ".github/",
@@ -6724,7 +6764,7 @@ var parseSourceReferencesSection = (content) => {
   return references;
 };
 var parseSourceReferences = (source, truthDocPath) => {
-  const parsed = matter2(source);
+  const parsed = parseFrontmatter(source);
   const references = /* @__PURE__ */ new Set();
   const frontmatterSourceOfTruth = Array.isArray(parsed.data.source_of_truth) ? parsed.data.source_of_truth : [];
   for (const entry of frontmatterSourceOfTruth) {
@@ -6752,17 +6792,6 @@ var languageByExtension = /* @__PURE__ */ new Map([
   [".yaml", "yaml"],
   [".toml", "toml"]
 ]);
-var sourceExtensions = /* @__PURE__ */ new Set([
-  ".ts",
-  ".tsx",
-  ".js",
-  ".jsx",
-  ".mjs",
-  ".cjs"
-]);
-var isJavaScriptLikePath = (filePath) => {
-  return sourceExtensions.has(path7.posix.extname(filePath));
-};
 var isTestPath = (filePath) => {
   return filePath.startsWith("tests/") || filePath.includes("/__tests__/") || /(?:^|[./-])(test|spec)\.[cm]?[jt]sx?$/u.test(path7.posix.basename(filePath));
 };
@@ -6868,7 +6897,7 @@ var discoverRepoFiles = async (rootDir, ignore) => {
     }
     if (kind === "doc") {
       const source = await fs16.readFile(path7.join(rootDir, filePath), "utf8");
-      const parsed = matter3(source);
+      const parsed = parseFrontmatter(source);
       const markdown = parseMarkdownDocument(parsed.content);
       const title = markdown.headings.find((heading) => heading.depth === 1)?.text ?? null;
       const sourceOfTruth = parseSourceReferences(source, filePath);
@@ -6998,96 +7027,6 @@ var buildRouteMap = async (rootDir) => {
   };
 };
 
-// src/repo-index/typescript-symbols.ts
-import ts from "typescript";
-var sortStrings = (values) => [...new Set(values)].sort();
-var hasExportModifier = (node) => {
-  return Boolean(
-    ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword)
-  );
-};
-var declarationName = (node) => {
-  if (!node.name || !ts.isIdentifier(node.name)) {
-    return null;
-  }
-  return node.name.text;
-};
-var addExport = (exports, publicSymbols, path14, name, kind) => {
-  if (!name) {
-    return;
-  }
-  const entry = { path: path14, name, kind };
-  exports.push(entry);
-  publicSymbols.push(entry);
-};
-var analyzeTypeScriptSource = (path14, source) => {
-  const sourceFile = ts.createSourceFile(path14, source, ts.ScriptTarget.Latest, true);
-  const imports = [];
-  const exports = [];
-  const publicSymbols = [];
-  for (const statement of sourceFile.statements) {
-    if (ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier)) {
-      const imported = [];
-      const clause = statement.importClause;
-      if (clause?.name) {
-        imported.push("default");
-      }
-      if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings)) {
-        imported.push("*");
-      }
-      if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
-        for (const element of clause.namedBindings.elements) {
-          imported.push(element.propertyName?.text ?? element.name.text);
-        }
-      }
-      imports.push({
-        from: path14,
-        specifier: statement.moduleSpecifier.text,
-        imported: sortStrings(imported)
-      });
-      continue;
-    }
-    if (ts.isExportDeclaration(statement)) {
-      if (statement.exportClause && ts.isNamedExports(statement.exportClause)) {
-        for (const element of statement.exportClause.elements) {
-          addExport(exports, publicSymbols, path14, element.name.text, "re-export");
-        }
-      }
-      continue;
-    }
-    if (ts.isFunctionDeclaration(statement) && hasExportModifier(statement)) {
-      addExport(exports, publicSymbols, path14, declarationName(statement), "function");
-      continue;
-    }
-    if (ts.isClassDeclaration(statement) && hasExportModifier(statement)) {
-      addExport(exports, publicSymbols, path14, declarationName(statement), "class");
-      continue;
-    }
-    if (ts.isInterfaceDeclaration(statement) && hasExportModifier(statement)) {
-      addExport(exports, publicSymbols, path14, declarationName(statement), "interface");
-      continue;
-    }
-    if (ts.isTypeAliasDeclaration(statement) && hasExportModifier(statement)) {
-      addExport(exports, publicSymbols, path14, declarationName(statement), "type");
-      continue;
-    }
-    if (ts.isEnumDeclaration(statement) && hasExportModifier(statement)) {
-      addExport(exports, publicSymbols, path14, declarationName(statement), "enum");
-      continue;
-    }
-    if (ts.isVariableStatement(statement) && hasExportModifier(statement)) {
-      for (const declaration of statement.declarationList.declarations) {
-        addExport(exports, publicSymbols, path14, declarationName(declaration), "const");
-      }
-    }
-  }
-  return {
-    imports: imports.sort((left, right) => left.specifier.localeCompare(right.specifier)),
-    exports: exports.sort((left, right) => left.name.localeCompare(right.name)),
-    publicSymbols: publicSymbols.sort((left, right) => left.name.localeCompare(right.name))
-  };
-};
-
 // src/repo-index/build.ts
 var buildRepoIndex = async (cwd) => {
   const repository = await getGitRepository(cwd);
@@ -7100,20 +7039,7 @@ var buildRepoIndex = async (cwd) => {
     discoverRepoFiles(rootDir, ignore),
     buildRouteMap(rootDir)
   ]);
-  const imports = [];
-  const exports = [];
-  const publicSymbols = [];
   diagnostics.push(...routeMap.diagnostics);
-  for (const file of fileTree.files) {
-    if (!isJavaScriptLikePath(file.path)) {
-      continue;
-    }
-    const source = await fs18.readFile(path9.join(rootDir, file.path), "utf8");
-    const analysis = analyzeTypeScriptSource(file.path, source);
-    imports.push(...analysis.imports);
-    exports.push(...analysis.exports);
-    publicSymbols.push(...analysis.publicSymbols);
-  }
   return {
     schemaVersion: "repo-index/v0",
     repository: {
@@ -7125,11 +7051,6 @@ var buildRepoIndex = async (cwd) => {
     files: fileTree.files,
     docs: fileTree.docs,
     tests: fileTree.tests,
-    imports: imports.sort((left, right) => `${left.from}:${left.specifier}`.localeCompare(`${right.from}:${right.specifier}`)),
-    exports: exports.sort((left, right) => `${left.path}:${left.name}`.localeCompare(`${right.path}:${right.name}`)),
-    publicSymbols: publicSymbols.sort(
-      (left, right) => `${left.path}:${left.name}`.localeCompare(`${right.path}:${right.name}`)
-    ),
     routeMap,
     diagnostics
   };
@@ -7139,8 +7060,8 @@ var buildRepoIndex = async (cwd) => {
 import { execa as execa4 } from "execa";
 
 // src/git/changes.ts
-import fs19 from "fs/promises";
-import path10 from "path";
+import fs18 from "fs/promises";
+import path9 from "path";
 import { execa as execa3 } from "execa";
 var normalizePath3 = (filePath) => {
   return filePath.replaceAll("\\", "/").replace(/^\.\//u, "");
@@ -7151,7 +7072,7 @@ var listChangedPaths = async (cwd, args) => {
 };
 var pathExists4 = async (filePath) => {
   try {
-    await fs19.access(filePath);
+    await fs18.access(filePath);
     return true;
   } catch {
     return false;
@@ -7195,7 +7116,7 @@ var getUncommittedChanges = async (cwd) => {
   const deletedPathCandidates = /* @__PURE__ */ new Set([...stagedDeletedPaths, ...unstagedDeletedPaths]);
   for (const deletedPath of deletedPathCandidates) {
     const change = getOrCreateChange(changesByPath, deletedPath);
-    change.deleted = !await pathExists4(path10.join(rootDir, deletedPath));
+    change.deleted = !await pathExists4(path9.join(rootDir, deletedPath));
   }
   return Array.from(changesByPath.values()).sort((left, right) => {
     return left.path.localeCompare(right.path);
@@ -7279,14 +7200,6 @@ var getChangedFiles = async (cwd, base) => {
     diagnostics
   };
 };
-var readBaseFile = async (cwd, base, filePath) => {
-  const repository = await getGitRepository(cwd);
-  const result = await execa4("git", ["show", `${base}:${filePath}`], {
-    cwd: repository.worktreePath,
-    reject: false
-  });
-  return (result.exitCode ?? 1) === 0 ? result.stdout : null;
-};
 
 // src/impact/build.ts
 var uniqueSorted2 = (values) => [...new Set(values)].sort();
@@ -7304,65 +7217,15 @@ var toImpactRoute = (route) => ({
   truthDocs: [...route.truthDocs].sort(),
   codeSurface: [...route.codeSurface].sort()
 });
-var changedPathSet = (changedFiles) => {
-  return new Set(
-    changedFiles.flatMap((file) => [file.path, ...file.previousPath ? [file.previousPath] : []])
-  );
-};
 var changedFilePaths = (changedFile) => {
   return [changedFile.path, ...changedFile.previousPath ? [changedFile.previousPath] : []];
 };
-var resolveImportPath = (importEdge) => {
-  if (!importEdge.specifier.startsWith(".")) {
-    return null;
-  }
-  const basePath = path11.posix.normalize(path11.posix.join(path11.posix.dirname(importEdge.from), importEdge.specifier));
-  const withoutExtension = basePath.replace(/\.[cm]?[jt]sx?$/u, "");
-  return withoutExtension;
-};
-var importTargetsChangedFile = (importEdge, changedPath) => {
-  const resolved = resolveImportPath(importEdge);
-  if (!resolved) {
-    return false;
-  }
-  return changedPath.replace(/\.[cm]?[jt]sx?$/u, "") === resolved;
-};
 var pathSegments = (filePath) => filePath.split("/").filter(Boolean);
 var testHintMatchesChangedFile = (hints, changedPath) => {
-  const changedBaseName = path11.posix.basename(changedPath);
+  const changedBaseName = path10.posix.basename(changedPath);
   const changedSegments = pathSegments(changedPath);
   return hints.some((hint) => changedBaseName.startsWith(hint) || changedSegments.includes(hint));
 };
-var changedSymbolsFor = async (cwd, base, basePath, currentPath, currentExports) => {
-  if (!isJavaScriptLikePath(basePath) && !isJavaScriptLikePath(currentPath)) {
-    return [];
-  }
-  const baseSource = await readBaseFile(cwd, base, basePath);
-  const baseExports = baseSource ? analyzeTypeScriptSource(basePath, baseSource).exports : [];
-  const currentByName = new Map(currentExports.map((entry) => [entry.name, entry]));
-  const baseByName = new Map(baseExports.map((entry) => [entry.name, entry]));
-  const changes = [];
-  if (basePath !== currentPath) {
-    for (const entry of currentExports) {
-      changes.push({ path: currentPath, name: entry.name, kind: entry.kind, change: "added" });
-    }
-    for (const entry of baseExports) {
-      changes.push({ path: basePath, name: entry.name, kind: entry.kind, change: "removed" });
-    }
-    return changes;
-  }
-  for (const [name, entry] of currentByName) {
-    if (!baseByName.has(name)) {
-      changes.push({ path: currentPath, name, kind: entry.kind, change: "added" });
-    }
-  }
-  for (const [name, entry] of baseByName) {
-    if (!currentByName.has(name)) {
-      changes.push({ path: basePath, name, kind: entry.kind, change: "removed" });
-    }
-  }
-  return changes;
-};
 var buildImpactSet = async (cwd, options) => {
   const repository = await getGitRepository(cwd);
   const rootDir = repository.worktreePath;
@@ -7377,7 +7240,6 @@ var buildImpactSet = async (cwd, options) => {
   const affectedRoutes = /* @__PURE__ */ new Map();
   const affectedTruthDocs = [];
   const affectedTests = [];
-  const changedPublicSymbols = [];
   const knownTestPaths = new Set(repoIndex.tests.map((test) => test.path));
   for (const changedFile of changedFiles) {
     const routeCandidatePaths = changedFilePaths(changedFile);
@@ -7410,60 +7272,15 @@ var buildImpactSet = async (cwd, options) => {
         file: changedFile.path
       });
     }
-    const currentExports = repoIndex.exports.filter((entry) => entry.path === changedFile.path);
-    changedPublicSymbols.push(
-      ...await changedSymbolsFor(
-        rootDir,
-        options.base,
-        changedFile.previousPath ?? changedFile.path,
-        changedFile.path,
-        currentExports
-      )
-    );
   }
   const uniqueAffectedTruthDocs = uniqueSorted2(affectedTruthDocs);
-  const changedPaths = changedPathSet(changedFiles);
-  for (const symbol of changedPublicSymbols) {
-    if (uniqueAffectedTruthDocs.length === 0) {
-      diagnostics.push({
-        category: "impact",
-        severity: "review",
-        message: `Changed public symbol ${symbol.name} in ${symbol.path} has no affected truth document.`,
-        file: symbol.path,
-        data: {
-          symbol: symbol.name,
-          change: symbol.change
-        }
-      });
-      continue;
-    }
-    if (!uniqueAffectedTruthDocs.some((truthDoc) => changedPaths.has(truthDoc))) {
-      diagnostics.push({
-        category: "impact",
-        severity: "review",
-        message: `Changed public symbol ${symbol.name} in ${symbol.path} has affected truth docs but none were changed in this impact set.`,
-        file: symbol.path,
-        data: {
-          symbol: symbol.name,
-          change: symbol.change,
-          affectedTruthDocs: uniqueAffectedTruthDocs
-        }
-      });
-    }
-  }
   for (const test of repoIndex.tests) {
-    const testImports = repoIndex.imports.filter((edge) => edge.from === test.path);
-    const importsChangedFile = changedFiles.some(
-      (changedFile) => changedFilePaths(changedFile).some(
-        (filePath) => testImports.some((importEdge) => importTargetsChangedFile(importEdge, filePath))
-      )
-    );
     const hintMatchesChangedFile = changedFiles.some(
       (changedFile) => changedFilePaths(changedFile).some(
         (filePath) => testHintMatchesChangedFile(test.targetHints, filePath)
       )
     );
-    if (importsChangedFile || hintMatchesChangedFile) {
+    if (hintMatchesChangedFile) {
       affectedTests.push(test.path);
     }
   }
@@ -7477,9 +7294,6 @@ var buildImpactSet = async (cwd, options) => {
     ),
     affectedTruthDocs: uniqueAffectedTruthDocs,
     affectedTests: uniqueSorted2(affectedTests),
-    changedPublicSymbols: changedPublicSymbols.sort(
-      (left, right) => `${left.path}:${left.name}:${left.change}`.localeCompare(`${right.path}:${right.name}:${right.change}`)
-    ),
     diagnostics
   };
 };
@@ -7505,14 +7319,13 @@ var checkFreshness = async (rootDir, _config, _truthDocumentPaths, base) => {
 };
 
 // src/evidence/validate.ts
-import fs21 from "fs/promises";
+import fs20 from "fs/promises";
 import fg7 from "fast-glob";
 
 // src/evidence/parse.ts
-import fs20 from "fs/promises";
-import path12 from "path";
-import matter4 from "gray-matter";
-import { parse as parse3 } from "yaml";
+import fs19 from "fs/promises";
+import path11 from "path";
+import { parse as parse4 } from "yaml";
 var yamlFencePattern = /```ya?ml\s*\n([\s\S]*?)```/giu;
 var topLevelEvidenceMarkerPattern = /^evidence\s*:/imu;
 var toEvidenceReference = (truthDocPath, raw) => {
@@ -7530,8 +7343,8 @@ var toEvidenceReference = (truthDocPath, raw) => {
   };
 };
 var parseEvidenceReferences = async (rootDir, truthDocPath) => {
-  const source = await fs20.readFile(path12.join(rootDir, truthDocPath), "utf8");
-  const parsed = matter4(source);
+  const source = await fs19.readFile(path11.join(rootDir, truthDocPath), "utf8");
+  const parsed = parseFrontmatter(source);
   const references = [];
   for (const entry of parseSourceReferences(source, truthDocPath)) {
     references.push({
@@ -7545,7 +7358,7 @@ var parseEvidenceReferences = async (rootDir, truthDocPath) => {
     if (!topLevelEvidenceMarkerPattern.test(yamlBlock)) {
       continue;
     }
-    const block = parse3(yamlBlock);
+    const block = parse4(yamlBlock);
     const rawEvidence = block && typeof block === "object" && "evidence" in block ? block.evidence : null;
     if (!Array.isArray(rawEvidence)) {
       continue;
@@ -7563,7 +7376,7 @@ var parseEvidenceReferences = async (rootDir, truthDocPath) => {
 // src/evidence/validate.ts
 var pathExists5 = async (filePath) => {
   try {
-    await fs21.access(filePath);
+    await fs20.access(filePath);
     return true;
   } catch {
     return false;
@@ -7601,15 +7414,6 @@ var validateGlob = async (rootDir, reference) => {
   });
   return matches.length > 0 ? null : diagnosticFor(reference, `Referenced file pattern ${reference.path} does not match any file.`);
 };
-var validateSymbol = async (rootDir, reference) => {
-  if (!reference.symbol || !isJavaScriptLikePath(reference.path)) {
-    return null;
-  }
-  const source = await fs21.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
-  const analysis = analyzeTypeScriptSource(reference.path, source);
-  const hasSymbol = analysis.publicSymbols.some((symbol) => symbol.name === reference.symbol);
-  return hasSymbol ? null : diagnosticFor(reference, `Evidence symbol ${reference.symbol} was not found in ${reference.path}.`);
-};
 var validateHash = async (rootDir, reference) => {
   if (!reference.contentHash) {
     return null;
@@ -7617,7 +7421,7 @@ var validateHash = async (rootDir, reference) => {
   if (!reference.contentHash.startsWith("sha256:")) {
     return diagnosticFor(reference, `Evidence hash for ${reference.path} must use sha256:.`);
   }
-  const source = await fs21.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
+  const source = await fs20.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
   const lines = source.split("\n");
   const startLine = reference.startLine ?? 1;
   const endLine = reference.endLine ?? lines.length;
@@ -7631,7 +7435,7 @@ var validateLineSpan = async (rootDir, reference) => {
   if (reference.startLine === void 0 && reference.endLine === void 0) {
     return null;
   }
-  const source = await fs21.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
+  const source = await fs20.readFile(resolveRepoPath(rootDir, reference.path), "utf8");
   const lines = source.split("\n");
   const startLine = reference.startLine ?? 1;
   const endLine = reference.endLine ?? lines.length;
@@ -7650,10 +7454,6 @@ var validateReference = async (rootDir, reference) => {
       diagnostics.push(diagnosticFor(reference, `Referenced file ${reference.path} does not exist.`));
       return diagnostics;
     }
-    const symbolDiagnostic = await validateSymbol(rootDir, reference);
-    if (symbolDiagnostic) {
-      diagnostics.push(symbolDiagnostic);
-    }
     const lineSpanDiagnostic = await validateLineSpan(rootDir, reference);
     if (lineSpanDiagnostic) {
       diagnostics.push(lineSpanDiagnostic);
@@ -7910,195 +7710,11 @@ var runCheck = async (cwd, options = {}) => {
   };
 };
 
-// src/context-pack/build.ts
-import fs22 from "fs/promises";
-import path13 from "path";
-import fg8 from "fast-glob";
-var uniqueSorted3 = (values) => [...new Set(values)].sort();
-var repoRootPrefixes2 = [".codex/", ".github/", ".truthmark/", "docs/", "src/", "tests/"];
-var isGlobReference2 = (referencePath) => /[*?[\]{}()]/u.test(referencePath);
-var normalizeDocReferencePath = (docPath, referencePath) => {
-  const strippedPath = referencePath.split("#")[0]?.trim() ?? "";
-  if (strippedPath.length === 0 || strippedPath.startsWith("/")) {
-    return null;
-  }
-  const isRepoRelative = repoRootPrefixes2.some((prefix) => strippedPath.startsWith(prefix));
-  const normalized = isRepoRelative ? path13.posix.normalize(strippedPath) : path13.posix.normalize(path13.posix.join(path13.posix.dirname(docPath), strippedPath));
-  return normalized === ".." || normalized.startsWith("../") ? null : normalized;
-};
-var readIfExists = async (rootDir, filePath) => {
-  try {
-    return await fs22.readFile(path13.join(rootDir, filePath), "utf8");
-  } catch {
-    return null;
-  }
-};
-var boundContent = (content) => {
-  const lines = content.split("\n");
-  if (lines.length <= 200) {
-    return { content, truncated: false };
-  }
-  return {
-    content: [...lines.slice(0, 80), "...", ...lines.slice(-40)].join("\n"),
-    truncated: true
-  };
-};
-var boundedContent = (filePath, content, warnings) => {
-  const bounded = boundContent(content);
-  if (!bounded.truncated) {
-    return { path: filePath, content, truncated: false };
-  }
-  warnings.push({
-    category: "context-pack",
-    severity: "review",
-    message: `Context source file ${filePath} was truncated to fit ContextPack v0 bounds.`,
-    file: filePath
-  });
-  return {
-    path: filePath,
-    content: bounded.content,
-    truncated: true
-  };
-};
-var documentsFor = async (rootDir, paths, warnings) => {
-  const documents = [];
-  for (const filePath of uniqueSorted3(paths)) {
-    const content = await readIfExists(rootDir, filePath);
-    if (content !== null) {
-      const bounded = boundContent(content);
-      if (bounded.truncated) {
-        warnings.push({
-          category: "context-pack",
-          severity: "review",
-          message: `Context truth doc ${filePath} was truncated to fit ContextPack v0 bounds.`,
-          file: filePath
-        });
-      }
-      documents.push({ path: filePath, content: bounded.content, truncated: bounded.truncated });
-    }
-  }
-  return documents;
-};
-var sourceFilesFor = async (rootDir, paths, warnings) => {
-  const sourceFiles = [];
-  for (const filePath of uniqueSorted3(paths)) {
-    const content = await readIfExists(rootDir, filePath);
-    if (content !== null) {
-      sourceFiles.push(boundedContent(filePath, content, warnings));
-    }
-  }
-  return sourceFiles;
-};
-var sourceOfTruthPathsFor = async (rootDir, docs, truthDocPaths) => {
-  const selectedTruthDocs = new Set(truthDocPaths);
-  const sourcePaths = [];
-  for (const doc of docs) {
-    if (!selectedTruthDocs.has(doc.path)) {
-      continue;
-    }
-    for (const referencePath of doc.sourceOfTruth) {
-      const normalizedPath = normalizeDocReferencePath(doc.path, referencePath);
-      if (!normalizedPath) {
-        continue;
-      }
-      if (isGlobReference2(normalizedPath)) {
-        sourcePaths.push(
-          ...await fg8(normalizedPath, {
-            cwd: rootDir,
-            dot: true,
-            onlyFiles: true,
-            followSymbolicLinks: false
-          })
-        );
-      } else {
-        sourcePaths.push(normalizedPath);
-      }
-    }
-  }
-  return uniqueSorted3(sourcePaths);
-};
-var writePathsFor = (workflow, routeIndexPath, truthDocs, routes) => {
-  if (workflow === "truth-sync") {
-    return uniqueSorted3([routeIndexPath, ...truthDocs]);
-  }
-  if (workflow === "truth-document") {
-    return uniqueSorted3([routeIndexPath, ...truthDocs]);
-  }
-  return uniqueSorted3(routes.flatMap((route) => route.codeSurface));
-};
-var testCommandsFor = (affectedTests) => {
-  return affectedTests.length === 0 ? ["npm test"] : [`npm test -- ${affectedTests.join(" ")}`];
-};
-var buildContextPack = async (cwd, options) => {
-  const repoIndex = await buildRepoIndex(cwd);
-  const rootDir = repoIndex.repository.root;
-  const loadResult = await loadConfig(rootDir);
-  const config = loadResult.config ?? (loadResult.status === "missing" ? createDefaultConfig() : null);
-  const impactSet = options.base ? await buildImpactSet(rootDir, { base: options.base }) : null;
-  const routeMap = impactSet ? repoIndex.routeMap : repoIndex.routeMap;
-  const warnings = loadResult.status === "invalid" ? [...loadResult.diagnostics] : [];
-  const truthDocPaths = impactSet?.affectedTruthDocs ?? (options.workflow === "truth-realize" ? [] : routeMap.routes.flatMap((route) => route.truthDocs));
-  const contextRoutes = impactSet?.affectedRoutes ?? (options.workflow === "truth-realize" ? [] : routeMap.routes);
-  if (options.workflow === "truth-realize" && !impactSet) {
-    warnings.push({
-      category: "context-pack",
-      severity: "review",
-      message: "truth-realize requires --base to derive bounded allowed write paths."
-    });
-  }
-  const sourceOfTruthPaths = await sourceOfTruthPathsFor(rootDir, repoIndex.docs, truthDocPaths);
-  const sourceFilePaths = uniqueSorted3([
-    ...impactSet?.changedFiles.filter((file) => !file.deleted).map((file) => file.path) ?? [],
-    ...sourceOfTruthPaths
-  ]);
-  return {
-    schemaVersion: "context-pack/v0",
-    workflow: options.workflow,
-    base: options.base ?? null,
-    impactSet,
-    routeMap,
-    allowedWritePaths: config === null ? [] : writePathsFor(
-      options.workflow,
-      config.truthmark.paths.routesIndex,
-      truthDocPaths,
-      contextRoutes
-    ),
-    truthDocs: await documentsFor(rootDir, truthDocPaths, warnings),
-    sourceFiles: await sourceFilesFor(rootDir, sourceFilePaths, warnings),
-    testCommands: testCommandsFor(impactSet?.affectedTests ?? []),
-    warnings
-  };
-};
-
-// src/context-pack/render.ts
-var renderContextPackMarkdown = (pack) => {
-  const lines = [
-    `# Truthmark ContextPack (${pack.workflow})`,
-    "",
-    `Schema: ${pack.schemaVersion}`,
-    `Base: ${pack.base ?? "none"}`,
-    "",
-    "## Allowed Write Paths",
-    ...pack.allowedWritePaths.map((filePath) => `- ${filePath}`),
-    "",
-    "## Truth Docs",
-    ...pack.truthDocs.map((doc) => `- ${doc.path}${doc.truncated ? " (truncated)" : ""}`),
-    "",
-    "## Source Files",
-    ...pack.sourceFiles.map((file) => `- ${file.path}${file.truncated ? " (truncated)" : ""}`),
-    "",
-    "## Test Commands",
-    ...pack.testCommands.map((command) => `- ${command}`)
-  ];
-  return `${lines.join("\n")}
-`;
-};
-
 // src/workflow-state/build.ts
 import { execa as execa5 } from "execa";
 
 // src/workflow-state/action-context.ts
-var uniqueSorted4 = (values) => [...new Set(values.filter((value) => value.length > 0))].sort();
+var uniqueSorted3 = (values) => [...new Set(values.filter((value) => value.length > 0))].sort();
 var helperCommandsFor = (manifestEntry) => (manifestEntry.helpers ?? []).map((helper) => ({
   id: helper.id,
   runner: helper.runner,
@@ -8108,8 +7724,8 @@ var helperCommandsFor = (manifestEntry) => (manifestEntry.helpers ?? []).map((he
 var evidenceFor = (manifestEntry) => manifestEntry.requiredGates.filter((gate) => /evidence|ownership|containment/iu.test(gate));
 var baseContext = (manifestEntry, mode, allowedWritePaths, forbiddenWritePaths, writeLeaseRequired) => ({
   mode,
-  allowedWritePaths: uniqueSorted4(allowedWritePaths),
-  forbiddenWritePaths: uniqueSorted4(forbiddenWritePaths),
+  allowedWritePaths: uniqueSorted3(allowedWritePaths),
+  forbiddenWritePaths: uniqueSorted3(forbiddenWritePaths),
   stopConditions: [...manifestEntry.negativeTriggers, ...manifestEntry.forbiddenAdjacency],
   requiredEvidence: evidenceFor(manifestEntry),
   helperValidationCommands: helperCommandsFor(manifestEntry),
@@ -8171,7 +7787,7 @@ var helperCommandsFor2 = (workflow) => (TRUTHMARK_WORKFLOW_MANIFEST[workflow].he
   argv: [...helper.command.argv],
   optional: helper.optional
 }));
-var uniqueSorted5 = (values) => [...new Set(values.filter((value) => value.length > 0))].sort();
+var uniqueSorted4 = (values) => [...new Set(values.filter((value) => value.length > 0))].sort();
 var isWriteCapable = (workflow) => !["truthmark-preview", "truthmark-check"].includes(workflow);
 var DEFAULT_BASE_CANDIDATES = ["@{upstream}", "origin/main", "main", "origin/master", "master"];
 var selectComparisonBase = async (rootDir, suppliedBase) => {
@@ -8189,7 +7805,7 @@ var selectComparisonBase = async (rootDir, suppliedBase) => {
   }
   return null;
 };
-var routeFilesFor = (repoIndex) => uniqueSorted5(repoIndex.routeMap.routes.map((route) => route.sourcePath));
+var routeFilesFor = (repoIndex) => uniqueSorted4(repoIndex.routeMap.routes.map((route) => route.sourcePath));
 var hasUnmappedFunctionalChange = (impactSet) => impactSet?.diagnostics.some(
   (diagnostic) => diagnostic.category === "impact" && /not mapped to a Truthmark route|no affected truth document/u.test(diagnostic.message)
 ) ?? false;
@@ -8200,7 +7816,7 @@ var applicabilityFor = (workflow, diagnostics, impactSet) => {
     return { state: isWriteCapable(workflow) ? "blocked" : "not_applicable", reasons };
   }
   if (workflow === "truthmark-sync" && !impactSet) {
-    reasons.push("truthmark-sync requires --base to derive bounded truth-doc write paths.");
+    reasons.push("truthmark-sync requires --base to derive changed-file impact before exposing sync write paths.");
     return { state: "blocked", reasons };
   }
   if (workflow === "truthmark-realize" && !impactSet) {
@@ -8222,16 +7838,15 @@ var contextDataFor = (workflow, repoIndex, config, impactSet) => {
     return {};
   }
   const routeFiles = routeFilesFor(repoIndex);
-  const truthDocs = uniqueSorted5(
-    impactSet?.affectedTruthDocs ?? repoIndex.routeMap.routes.flatMap((route) => route.truthDocs)
-  );
+  const indexedTruthDocs = uniqueSorted4(repoIndex.routeMap.routes.flatMap((route) => route.truthDocs));
+  const truthDocs = workflow === "truthmark-sync" ? indexedTruthDocs : uniqueSorted4(impactSet?.affectedTruthDocs ?? indexedTruthDocs);
   return {
     routeIndexPath: config.truthmark.paths.routesIndex,
     routeFiles,
     truthRoot: config.truthmark.paths.truthRoot,
     truthDocs,
     starterTruthDocs: workflow === "truthmark-structure" ? truthDocs : [],
-    codeWritePaths: workflow === "truthmark-realize" ? uniqueSorted5(impactSet?.affectedRoutes.flatMap((route) => route.codeSurface) ?? []) : [],
+    codeWritePaths: workflow === "truthmark-realize" ? uniqueSorted4(impactSet?.affectedRoutes.flatMap((route) => route.codeSurface) ?? []) : [],
     portalEnabled: config.truthmark.generated.portal.enabled,
     portalOutputPath: config.truthmark.paths.portalOutput,
     routes: repoIndex.routeMap.routes
@@ -8243,7 +7858,7 @@ var nextStepsFor = (workflow, applicability, comparisonBase) => {
   }
   if ((workflow === "truthmark-sync" || workflow === "truthmark-realize") && applicability.state === "blocked" && !comparisonBase) {
     return [
-      workflow === "truthmark-sync" ? "Rerun with --base <ref> so Truthmark can derive bounded truth-doc write paths." : "Rerun with --base <ref> so Truthmark can derive bounded allowed code-write paths."
+      workflow === "truthmark-sync" ? "Rerun with --base <ref> so Truthmark can derive changed-file impact before exposing sync write paths." : "Rerun with --base <ref> so Truthmark can derive bounded allowed code-write paths."
     ];
   }
   return [];
@@ -8279,7 +7894,8 @@ var buildWorkflowState = async (cwd, options) => {
     checks: {
       required: [...manifestEntry.requiredGates],
       recommended: [...manifestEntry.positiveTriggers],
-      helpers: helperCommandsFor2(options.workflow)
+      helpers: helperCommandsFor2(options.workflow),
+      affectedTests: impactSet?.affectedTests ?? []
     },
     nextSteps: nextStepsFor(options.workflow, applicability, comparisonBase),
     reportSections: [...manifestEntry.reportSections]
@@ -8287,7 +7903,7 @@ var buildWorkflowState = async (cwd, options) => {
 };
 
 // src/cli/handlers.ts
-import fs23 from "fs/promises";
+import fs21 from "fs/promises";
 
 // src/agents/workflow-helper-validation.ts
 import { parse as parseYaml2 } from "yaml";
@@ -8649,12 +8265,6 @@ var runImpact = async (options) => {
     }
   };
 };
-var isContextPackWorkflow = (value) => {
-  return value === "truth-sync" || value === "truth-document" || value === "truth-realize";
-};
-var isContextMarkdownFormat = (value) => {
-  return value === void 0 || value === "markdown";
-};
 var isTruthmarkWorkflowId = (value) => {
   return typeof value === "string" && TRUTHMARK_WORKFLOW_IDS.includes(value);
 };
@@ -8674,7 +8284,7 @@ var invalidWorkflowResult = (command, workflow) => ({
 });
 var readHelperFile = async (filePath, helper) => {
   try {
-    return await fs23.readFile(filePath, "utf8");
+    return await fs21.readFile(filePath, "utf8");
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     return { ok: false, helper, errors: [`could not read file: ${message}`] };
@@ -8699,63 +8309,6 @@ var runValidateWriteLease = async (leaseFile, changedFilesFile) => {
   }
   return validateWriteLeaseText(leaseText, changedText);
 };
-var runContext = async (options) => {
-  if (!isContextPackWorkflow(options.workflow)) {
-    return {
-      command: "context",
-      summary: "Truthmark context requires a supported --workflow value.",
-      diagnostics: [
-        {
-          category: "context-pack",
-          severity: "error",
-          message: "truthmark context requires --workflow truth-sync, truth-document, or truth-realize."
-        }
-      ]
-    };
-  }
-  if (options.format === "json") {
-    return {
-      command: "context",
-      summary: "Truthmark context no longer supports JSON ContextPack output.",
-      diagnostics: [
-        {
-          category: "context-pack",
-          severity: "error",
-          message: "JSON ContextPack output was removed in v2; use --format markdown."
-        }
-      ]
-    };
-  }
-  if (!isContextMarkdownFormat(options.format)) {
-    return {
-      command: "context",
-      summary: "Truthmark context requires a supported --format value.",
-      diagnostics: [
-        {
-          category: "context-pack",
-          severity: "error",
-          message: "truthmark context supports only --format markdown; JSON ContextPack output was removed in v2."
-        }
-      ]
-    };
-  }
-  const contextPack = await buildContextPack(process.cwd(), {
-    workflow: options.workflow,
-    base: options.base
-  });
-  const diagnostics = contextPack.warnings;
-  const summary = `Truthmark context generated ${contextPack.workflow} ContextPack with ${diagnostics.length} warnings.`;
-  const markdown = renderContextPackMarkdown(contextPack);
-  return {
-    command: "context",
-    summary,
-    diagnostics,
-    data: {
-      markdown,
-      summary
-    }
-  };
-};
 var runWorkflowStatus = async (options) => {
   if (!isTruthmarkWorkflowId(options.workflow)) {
     return invalidWorkflowResult("workflow status", options.workflow);
@@ -8790,14 +8343,6 @@ var writeResult = (result, options) => {
 `);
   markFailedWhenErrorDiagnosticsExist(result);
 };
-var writeContextResult = (result, options) => {
-  if (!options.json && typeof result.data?.markdown === "string") {
-    process.stdout.write(result.data.markdown);
-    markFailedWhenErrorDiagnosticsExist(result);
-    return;
-  }
-  writeResult(result, options);
-};
 var renderValidationHuman = (result) => {
   if (result.ok === true) {
     return [`${result.helper}: ok`, ...result.checks.map((check) => `- ${check}`)].join("\n");
@@ -8842,7 +8387,7 @@ var buildProgram = () => {
     writeResult(await runCheck2({ base: options.base }), options);
   });
   addJsonOption(
-    program.command("index").description("Build the deterministic Truthmark repository index.")
+    program.command("index").description("Inspect derived Truthmark workflow routing metadata for the current checkout.")
   ).action(async (options) => {
     writeResult(await runIndex(), options);
   });
@@ -8851,18 +8396,6 @@ var buildProgram = () => {
   ).action(async (options) => {
     writeResult(await runImpact({ base: options.base }), options);
   });
-  addJsonOption(
-    program.command("context").description("Generate a bounded workflow context pack.").requiredOption("--workflow <workflow>", "Workflow name: truth-sync, truth-document, or truth-realize").option("--base <ref>", "Base Git ref for impact-backed packs").option("--format <format>", "Output format: markdown", "markdown")
-  ).action(async (options) => {
-    writeContextResult(
-      await runContext({
-        workflow: options.workflow,
-        base: options.base,
-        format: options.format
-      }),
-      options
-    );
-  });
   const workflow = program.command("workflow").description("Inspect agent-facing Truthmark workflow state.");
   addJsonOption(
     workflow.command("status").description("Return schema-versioned workflow state for a canonical workflow ID.").option("--workflow <workflow>", "Canonical workflow ID, such as truthmark-sync").option("--base <ref>", "Base Git ref for impact-backed workflow state")