wingfoil 0.2.2 → 0.3.0

package/dist/core/workflow-status.d.ts

@@ -0,0 +1,83 @@
+/**
+ * `wingfoil workflow status [<ref>]` (task-225; `spec-017` §5.1–§5.4, §7.4, §8 `StatusResult` /
+ * `PendingApproval`, §10, §11; BDD P4.5, P4.14, P4.15, X1.1, X1.2).
+ *
+ * **Baseline: `HEAD`, declared** (`spec-017` §1.1, approver ruling R15): the same snapshot and deduction
+ * `workflow next` answers from (`readDeductionSnapshotAtHead`, `deduceWorkflowState`), so the two never disagree;
+ * the working tree only explains (`W_UNCOMMITTED_INPUTS`, §1.2).
+ *
+ * **What it reports** (§7.4): every open instance, or the one `<ref>` selects — active first and marked — with its
+ * top-level phase progress, its frontier (each step built by `workflow next`'s `buildStep`), and its `late`
+ * candidates (§4.7); the **pending approvals** of those steps (§5.1), each routed to `dna.yaml` members; then the
+ * **ungated elements**: Memory elements sitting in a `gates` state of their type that no pending approval of **any**
+ * open instance carries. Nothing is recorded: a pending approval changes nothing in Memory (§5.1).
+ *
+ * **The v0.3 notification channel** (§5.3, ruling R13): the console view prints one "human needed" line per pending
+ * approval and per ungated element, naming the action (`approve or reject`, or `finalize` for an approval record),
+ * the element id(s) or the step key, and the routed members. An ungated element has no workflow to route it, so its
+ * line names the holders of the `approver` role, the one role that may decide it (REQ-SEC-03).
+ */
+import type { Diagnostic } from '../validation';
+import { type Baseline, type Deduction, type ElementRef, type Instance, type PhaseProgress, type TrailEntry } from '../workflow/deduce';
+import { type CoreResult } from './types';
+import { type Awaiting, type Member, type NextInputs, type Step } from './workflow-next';
+/** One pending approval (`spec-017` §5.1, §8 `PendingApproval`): a frontier step whose approval awaits. */
+export interface PendingApproval {
+    /** The step's key (§4.9). */
+    readonly step: string | null;
+    /** The instance the step belongs to. */
+    readonly instance: string | null;
+    readonly trail: readonly TrailEntry[];
+    readonly awaiting: Extract<Awaiting, {
+        readonly kind: 'approval';
+    }>;
+}
+/** One open instance as `status` reports it (`spec-017` §7.4, §8). */
+export interface StatusEntry {
+    readonly instance: Instance;
+    readonly complete: boolean;
+    /** Its top-level phases (`complete` | `current` | `pending` | `skipped`). */
+    readonly phases: readonly PhaseProgress[];
+    /** Its frontier, in frontier order (§1.3). */
+    readonly frontier: readonly Step[];
+    /** The candidates a live query matched after a later phase closed it (§4.7). */
+    readonly late: readonly ElementRef[];
+}
+/** `workflow status`'s payload (`spec-017` §8). */
+export interface StatusResult {
+    readonly baseline: Baseline;
+    /** The active instance's id (the most recently started open one), or `null`. */
+    readonly active: string | null;
+    readonly open: readonly StatusEntry[];
+    /** The pending approvals of the listed instances, in frontier order. */
+    readonly pendingApprovals: readonly PendingApproval[];
+    /** The elements in a gate state that no pending approval of an open instance carries, ascending `(type, id)`. */
+    readonly ungated: readonly ElementRef[];
+    /**
+     * Whom an ungated element's "human needed" line names (§5.3): no workflow routes it, so the holders of the
+     * `approver` role, the one role that may decide it (REQ-SEC-03), ascending `(name, email)`; `[]` when none does.
+     */
+    readonly ungatedRoutedTo: readonly Member[];
+    /** `no open workflows` when no instance is open (BDD P4.5 sc. 3), whatever is ungated. */
+    readonly message?: string;
+    readonly diagnostics: readonly Diagnostic[];
+}
+/**
+ * `workflow status`'s answer from one deduction (`spec-017` §7.4, §10). Pure. Exit `0` in every deduced case;
+ * `NOT_FOUND` for a `ref` naming no open instance — `workflow is not open: <ref>` for a loaded workflow or an
+ * instance plan, `unknown workflow: <ref>` otherwise, as `workflow next` (`unresolvedRef`).
+ */
+export declare function statusWorkflow(inputs: NextInputs, deduction: Deduction, ref?: string): CoreResult<StatusResult>;
+/**
+ * `workflow status [<ref>]` at `HEAD` (`spec-017` §7.4): the deduction snapshot (with `bindings.yaml` and
+ * `dna.yaml`), then `roles.yaml` and the directive files at the snapshot's commit, read only when a step is
+ * reported.
+ *
+ * @throws `DiagnosticsError` (`VALIDATION`) when the registry at `HEAD` has a `spec-003` error; a
+ *   `ValidationError` for an invalid `roles.yaml` or directive file at `HEAD`; `StorageError` when git
+ *   cannot answer.
+ */
+export declare function workflowStatusAtHead(root: string, ref?: string): CoreResult<StatusResult>;
+/** `workflow status`'s `--format console` rendering (`spec-017` §5.3, §8). Pure. */
+export declare function renderStatusConsole(result: StatusResult): string;
+//# sourceMappingURL=workflow-status.d.ts.map

package/dist/core/workflow-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-status.d.ts","sourceRoot":"","sources":["../../src/core/workflow-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAA2C,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGjL,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAWL,KAAK,QAAQ,EACb,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,IAAI,EACV,MAAM,iBAAiB,CAAC;AAGzB,2GAA2G;AAC3G,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC;IACnC,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;CACtC;AAED,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IACtD,iHAAiH;IACjH,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;CAC7C;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAoC/G;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAIzF;AAmCD,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAkBhE"}

package/dist/core/workflow-status.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statusWorkflow = statusWorkflow;
+exports.workflowStatusAtHead = workflowStatusAtHead;
+exports.renderStatusConsole = renderStatusConsole;
+const deduce_1 = require("../workflow/deduce");
+const approval_authority_1 = require("./approval-authority");
+const types_1 = require("./types");
+const workflow_next_1 = require("./workflow-next");
+const workflow_deduction_1 = require("./workflow-deduction");
+/** `<type>:<id>`. */
+function keyOf(element) {
+    return `${element.type}:${element.id}`;
+}
+/**
+ * `workflow status`'s answer from one deduction (`spec-017` §7.4, §10). Pure. Exit `0` in every deduced case;
+ * `NOT_FOUND` for a `ref` naming no open instance — `workflow is not open: <ref>` for a loaded workflow or an
+ * instance plan, `unknown workflow: <ref>` otherwise, as `workflow next` (`unresolvedRef`).
+ */
+function statusWorkflow(inputs, deduction, ref) {
+    let shown = deduction.instances;
+    if (ref !== undefined) {
+        const selected = (0, deduce_1.resolveInstanceRef)(deduction, ref);
+        if (selected === null)
+            return (0, workflow_next_1.unresolvedRef)(inputs, ref);
+        shown = [selected];
+    }
+    const open = shown.map((entry) => ({
+        instance: entry.instance,
+        complete: entry.complete,
+        phases: entry.phases,
+        frontier: entry.frontier.map((step) => (0, workflow_next_1.buildStep)(step, inputs)),
+        late: entry.late,
+    }));
+    const steps = open.flatMap((entry) => entry.frontier);
+    const pendingApprovals = steps.flatMap((step) => step.awaiting?.kind === 'approval' ? [{ step: step.key, instance: step.instance, trail: step.trail, awaiting: step.awaiting }] : []);
+    // Carried by a pending approval of any open instance, `<ref>` or not (§5.1): its awaiting elements.
+    const carried = new Set(deduction.instances.flatMap((entry) => entry.frontier.flatMap((step) => (step.approval?.elements ?? []).map(keyOf))));
+    const ungated = deduction.gated.filter((element) => !carried.has(keyOf(element)));
+    // BDD P4.5 sc. 3: the message says no instance is open; the ungated elements are listed after it.
+    const nothing = deduction.instances.length === 0;
+    return (0, types_1.coreOk)({
+        baseline: deduction.baseline,
+        active: deduction.active,
+        open,
+        pendingApprovals,
+        ungated,
+        ungatedRoutedTo: (0, workflow_next_1.membersHoldingRole)(inputs.dnaYaml, approval_authority_1.APPROVER_ROLE),
+        ...(nothing ? { message: workflow_next_1.NO_OPEN_WORKFLOWS } : {}),
+        diagnostics: [...deduction.diagnostics, ...(0, workflow_next_1.approvalDiagnostics)(steps, inputs.dnaYaml)],
+    });
+}
+/**
+ * `workflow status [<ref>]` at `HEAD` (`spec-017` §7.4): the deduction snapshot (with `bindings.yaml` and
+ * `dna.yaml`), then `roles.yaml` and the directive files at the snapshot's commit, read only when a step is
+ * reported.
+ *
+ * @throws `DiagnosticsError` (`VALIDATION`) when the registry at `HEAD` has a `spec-003` error; a
+ *   `ValidationError` for an invalid `roles.yaml` or directive file at `HEAD`; `StorageError` when git
+ *   cannot answer.
+ */
+function workflowStatusAtHead(root, ref) {
+    const snapshot = (0, workflow_deduction_1.readDeductionSnapshotAtHead)(root);
+    const deduction = (0, deduce_1.deduceWorkflowState)(snapshot);
+    return statusWorkflow((0, workflow_next_1.readNextInputs)(root, snapshot, deduction), deduction, ref);
+}
+// --- console --------------------------------------------------------------------------------------
+/** One phase as `<name> <state>`, with its iteration counts or `(vacuous)`. */
+function describePhase(progress) {
+    const counts = progress.iterations;
+    const parts = counts === undefined
+        ? []
+        : ['eligible', 'entered', 'complete', 'late'].filter((name) => counts[name] > 0).map((name) => `${name} ${counts[name]}`);
+    const note = counts?.note !== undefined ? [counts.note] : progress.vacuous === true ? ['vacuous'] : [];
+    const detail = [...parts, ...note];
+    return `${progress.phase} ${progress.state}${detail.length === 0 ? '' : ` (${detail.join(', ')})`}`;
+}
+/** The console lines of one open instance. */
+function instanceLines(entry) {
+    const { instance } = entry;
+    const flags = [instance.active ? 'active' : null, entry.complete ? 'complete' : null, instance.abandoned ? 'abandoned' : null].filter((flag) => flag !== null);
+    const lines = [`${instance.active ? '*' : ' '} ${instance.id} (${instance.workflow})${flags.length === 0 ? '' : ` — ${flags.join(', ')}`}`];
+    const element = instance.element;
+    lines.push(`    element: ${element === null ? '(none)' : `${element.type}:${element.id} (${element.status})`}`);
+    if (entry.phases.length > 0)
+        lines.push(`    phases: ${entry.phases.map(describePhase).join(', ')}`);
+    if (entry.frontier.length > 0)
+        lines.push('    frontier:');
+    for (const step of entry.frontier) {
+        const missing = step.evidence.missing.length === 0 ? '' : `; missing: ${step.evidence.missing.join(', ')}`;
+        lines.push(`      - ${step.key} (${step.role ?? 'no role'}${missing})${step.reentered ? ` re-entered after ${step.reentryCommit}` : ''}`);
+        // A third party's line is the step's own; approvals are listed once, below.
+        if (step.awaiting?.kind === 'party')
+            lines.push(`        ${(0, workflow_next_1.humanNeededLine)(step)}`);
+    }
+    if (entry.late.length > 0)
+        lines.push(`    late: ${entry.late.map((late) => `${late.type}:${late.id} (${late.status})`).join(', ')}`);
+    return lines;
+}
+/** `workflow status`'s `--format console` rendering (`spec-017` §5.3, §8). Pure. */
+function renderStatusConsole(result) {
+    const lines = [];
+    if (result.message !== undefined)
+        lines.push(result.message);
+    else
+        lines.push(`open workflows: ${result.open.length}`); // no message: some instance is open
+    for (const entry of result.open)
+        lines.push(...instanceLines(entry));
+    if (result.pendingApprovals.length > 0) {
+        lines.push(`pending approvals: ${result.pendingApprovals.length}`);
+        for (const approval of result.pendingApprovals)
+            lines.push(`  ${(0, workflow_next_1.approvalLine)(approval.awaiting, approval.step)} (${approval.instance}, ${approval.step})`);
+    }
+    if (result.ungated.length > 0) {
+        lines.push(`ungated elements: ${result.ungated.length}`);
+        for (const element of result.ungated) {
+            const routed = (0, workflow_next_1.describeMembers)(result.ungatedRoutedTo, (0, workflow_next_1.noApproverMessage)(approval_authority_1.APPROVER_ROLE));
+            lines.push(`  human needed: approve or reject ${element.id} (${element.type}, ${element.status}; no open workflow carries it) — routed to ${routed}`);
+        }
+    }
+    if (result.diagnostics.length > 0)
+        lines.push(`${result.diagnostics.length} diagnostic(s): --format json lists them`);
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=workflow-status.js.map

package/dist/core/workflow-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-status.js","sourceRoot":"","sources":["../../src/core/workflow-status.ts"],"names":[],"mappings":";;AA8FA,wCAoCC;AAWD,oDAIC;AAoCD,kDAkBC;AAnLD,+CAAiL;AAEjL,6DAAqD;AACrD,mCAAkD;AAClD,mDAeyB;AACzB,6DAAmE;AA4CnE,qBAAqB;AACrB,SAAS,KAAK,CAAC,OAAmB;IAChC,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAAkB,EAAE,SAAoB,EAAE,GAAY;IACnF,IAAI,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAA,2BAAkB,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAA,6BAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACzD,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAkB,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,yBAAS,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAsB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACjE,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACpI,CAAC;IAEF,oGAAoG;IACpG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9I,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAElF,kGAAkG;IAClG,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IACjD,OAAO,IAAA,cAAM,EAAC;QACZ,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,IAAI;QACJ,gBAAgB;QAChB,OAAO;QACP,eAAe,EAAE,IAAA,kCAAkB,EAAC,MAAM,CAAC,OAAO,EAAE,kCAAa,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,GAAG,IAAA,mCAAmB,EAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;KACvF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,IAAY,EAAE,GAAY;IAC7D,MAAM,QAAQ,GAAG,IAAA,gDAA2B,EAAC,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAA,4BAAmB,EAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,cAAc,CAAC,IAAA,8BAAc,EAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,qGAAqG;AAErG,+EAA+E;AAC/E,SAAS,aAAa,CAAC,QAAuB;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC;IACnC,MAAM,KAAK,GACT,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAE,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzI,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACnC,OAAO,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AACtG,CAAC;AAED,8CAA8C;AAC9C,SAAS,aAAa,CAAC,KAAkB;IACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/K,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5I,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChH,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3G,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1I,4EAA4E;QAC5E,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAA,+BAAe,EAAC,IAAI,CAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtI,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,SAAgB,mBAAmB,CAAC,MAAoB;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;;QACxD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,oCAAoC;IAC9F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,gBAAgB;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAA,4BAAY,EAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAK,CAAC,KAAK,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9J,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAA,+BAAe,EAAC,MAAM,CAAC,eAAe,EAAE,IAAA,iCAAiB,EAAC,kCAAa,CAAC,CAAC,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,8CAA8C,MAAM,EAAE,CAAC,CAAC;QACxJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,0CAA0C,CAAC,CAAC;IACtH,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/core/write-guard.d.ts

@@ -10,6 +10,34 @@ export interface WriteTargetContract {
 }
 /** The contract every non-transition write verb refuses under (`dna set`, the `directive` verbs, `init`). */
 export declare const CONFIG_WRITE_CONTRACT: WriteTargetContract;
+/**
+ * Refuse, before anything is written, a target git **cannot report on** because a directory on the
+ * way to it is a symbolic link (task-131, `bug-118`, `bug-124`) — or cannot be read at all.
+ *
+ * For a path behind a symlink `git status --porcelain` is empty whether the file is modified or not,
+ * and the `git add` that `commitPaths` runs afterwards fails ("beyond a symbolic link") — after the
+ * write or the unlink has already happened. "I have nothing to report about this path" is not "this
+ * path is clean"; this is the check that keeps the two apart, so the guards below never read silence
+ * as consent. Exit `1` (`VALIDATION`), naming the path and the reason.
+ */
+export declare function requireInspectableTarget(root: string, path: string, contract?: WriteTargetContract): CoreResult<undefined>;
+/**
+ * Refuse, before anything is written, a target whose **index** holds a version that differs from both
+ * `HEAD` and the working tree (task-131, `bug-182`) — the one loss a content-carrying verb can still
+ * cause.
+ *
+ * `memory submit` and `memory amend` own the whole document: its working-tree bytes are the content of
+ * record, so {@link requireUnmodifiedTarget} cannot apply to them. But `commitPaths` runs
+ * `git add -- <path>` before committing, and that silently overwrites a staged version the user
+ * prepared separately. When the staged version equals `HEAD` (nothing staged) or the working tree
+ * (the user staged what is about to be committed) nothing is lost and the verb proceeds; only the
+ * three-way divergence — git's own `XY` with both columns set — is refused. The answer is git's
+ * (`pathPorcelainStatus`), for the reason the module header gives. Also asks
+ * {@link requireInspectableTarget} first, since an empty porcelain is not an answer behind a symlink.
+ *
+ * @param path - Root-relative POSIX path of the document the verb is about to commit.
+ */
+export declare function requireNoDivergentStage(root: string, path: string, contract?: WriteTargetContract): CoreResult<undefined>;
 /**
  * Refuse, before anything is written, a target that already carries modifications this operation
  * does not own — `dl-080`'s ratified write rule for a command that **edits a file in place**.
@@ -41,12 +69,14 @@ export declare function requireUnmodifiedTargets(root: string, paths: readonly s
  * absent path and for a clean, tracked one — so each of the three places a file can live is checked
  * explicitly.
  *
- * Reachable because `memory add` derives its id's sequence number from `readdirSync` of the working
- * tree (`nextSequenceNumber`, `../memory/add.ts`), so a working tree that disagrees with `HEAD` about
- * how many elements exist can generate an id that lands on an occupied path; the write that follows
- * is unconditional, and the commit's diff then becomes `HEAD` → scaffold rather than absent →
- * scaffold. A commit whose subject says "add" and whose diff removes lines is `bug-078` at its
- * sharpest.
+ * Reachable because an id can land on an occupied path. A slug-only `id_pattern` (`note-{slug}`)
+ * does whenever a title repeats. A `{n}` id does when the occupant is a **git-ignored** file: since
+ * task-128 `nextSequenceNumber` takes the highest number every ref and the working tree hold, but
+ * the working tree as git sees it, so an ignored file reserves no number. (Before task-128 it counted
+ * the working tree's files, so a gap reissued a taken number, `bug-087`.) The guard refuses; it never
+ * overwrites. The write that follows is unconditional, and the
+ * commit's diff would then be `HEAD` → scaffold rather than absent → scaffold. A commit whose subject
+ * says "add" and whose diff removes lines is `bug-078` at its sharpest.
  *
  * @param path - Root-relative POSIX path of the file about to be created.
  */
@@ -71,8 +101,11 @@ export declare function undeclaredCommittedPaths(root: string, sha: string, decl
  *
  * `verifyCommittedScope` delegates its content half to `verifyDocumentEdit`, which compares *owned
  * frontmatter fields* and a body. `dna.yaml` and `roles.yaml` have no frontmatter block at all, so
- * for them the right — and strictly stronger — question is byte equality: the commit must carry, for
- * each declared path, exactly the text this operation wrote, and nothing else.
+ * for them the right — and strictly stronger — question is content equality: the commit must carry, for
+ * each declared path, exactly the text this operation wrote, and nothing else. "Exactly" is judged as
+ * git stores it: when the bytes differ from `git show`'s, the written text is hashed through git's
+ * filters for that path and compared with the committed blob (`committedBlobMatches`), so a CRLF file
+ * that `core.autocrlf=true` stores LF is not reported as a foreign change (task-193 review).
  *
  * Same shape as `task-080`'s lockfile guard and `task-088`'s post-condition: assert the diff, not the
  * end state. Reading the file back from disk answers "does `dna.yaml` now say `Renamed`?" — true no
@@ -96,4 +129,14 @@ export declare function verifyCommittedPaths(root: string, sha: string, expected
  * @param content - The text the operation wrote, or `null` when it removed the path.
  */
 export declare function committedScopeError(root: string, sha: string, path: string, content: string | null): CoreResult<never> | undefined;
+/**
+ * Refuse an empty commit while the index holds staged changes (task-226, `dl-106`): `workflow finalize`'s
+ * phase record changes no file, so a staged change has no place in it. `commitEmpty`
+ * (`src/storage/commit.ts`) commits with `--only` and would leave it staged anyway; refusing first is the
+ * predictable answer `dl-106` asks for — the operator learns the record was not written beside their
+ * change, rather than finding the two interleaved. A read, so a dry run refuses too.
+ *
+ * @param subject - The subject of the commit about to be made, named in the refusal.
+ */
+export declare function requireCleanIndex(root: string, subject: string): CoreResult<undefined>;
 //# sourceMappingURL=write-guard.d.ts.map

package/dist/core/write-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-guard.d.ts","sourceRoot":"","sources":["../../src/core/write-guard.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAE3D,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,6GAA6G;AAC7G,eAAO,MAAM,qBAAqB,EAAE,mBAInC,CAAC;AA2BF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,mBAA2C,EACrD,QAAQ,CAAC,EAAE,MAAM,GAChB,UAAU,CAAC,SAAS,CAAC,CAwBvB;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,GAAE,mBAA2C,GACpD,UAAU,CAAC,SAAS,CAAC,CAMvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAcrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAMxC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC3C,MAAM,EAAE,CAaV;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,CAO/B"}
+{"version":3,"file":"write-guard.d.ts","sourceRoot":"","sources":["../../src/core/write-guard.ts"],"names":[],"mappings":"AA+DA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAE3D,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,6GAA6G;AAC7G,eAAO,MAAM,qBAAqB,EAAE,mBAInC,CAAC;AAqDF;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,mBAA2C,GACpD,UAAU,CAAC,SAAS,CAAC,CAWvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,mBAA2C,GACpD,UAAU,CAAC,SAAS,CAAC,CAgBvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,mBAA2C,EACrD,QAAQ,CAAC,EAAE,MAAM,GAChB,UAAU,CAAC,SAAS,CAAC,CA2BvB;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,GAAE,mBAA2C,GACpD,UAAU,CAAC,SAAS,CAAC,CAMvB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAkBrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAMxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC3C,MAAM,EAAE,CAgBV;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,CAO/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAUtF"}

package/dist/core/write-guard.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CONFIG_WRITE_CONTRACT = void 0;
+exports.requireInspectableTarget = requireInspectableTarget;
+exports.requireNoDivergentStage = requireNoDivergentStage;
 exports.requireUnmodifiedTarget = requireUnmodifiedTarget;
 exports.requireUnmodifiedTargets = requireUnmodifiedTargets;
 exports.requireAbsentTarget = requireAbsentTarget;
 exports.undeclaredCommittedPaths = undeclaredCommittedPaths;
 exports.verifyCommittedPaths = verifyCommittedPaths;
 exports.committedScopeError = committedScopeError;
+exports.requireCleanIndex = requireCleanIndex;
 /**
  * The write-side half of `dl-080-which-baseline-each-command-reads`, ratified as option **(B)**:
  * *a write refuses while its target carries modifications the command does not own*
@@ -43,6 +46,13 @@ exports.committedScopeError = committedScopeError;
  * rejected: "an unrelated uncommitted edit blocks a verb, so designing a new type in `memory.yaml`
  * would prevent approving an element that has nothing to do with it".
  *
+ * **What git cannot see, the guard refuses** (task-131, `bug-118`). `git status --porcelain` prints
+ * nothing for a path that lies beyond a symbolic link — `git ls-files` carries the link blob and never
+ * what it points at — so "no output" there means *invisible*, not *clean*. Every guard here therefore
+ * asks {@link requireInspectableTarget} first, on the filesystem (`dl-086`: a guard over an imminent
+ * syscall resolves where the syscall will land), and refuses a target git cannot report on, whether
+ * the link points inside the project (`bug-124`) or out of it.
+ *
  * **Exit code.** Every refusal here is a `CoreResult.error` with `code: 'VALIDATION'`, which
  * `exitCodeForError` maps to **1**. `spec-005-cli-command-contract` § "1. Exit-code contract
  * (REQ-INT-04)" reserves `2` for a malformed *invocation*; a dirty target is a repository-state
@@ -84,6 +94,89 @@ function readWorktree(root, path) {
     const absolute = (0, node_path_1.join)(root, path);
     return (0, node_fs_1.existsSync)(absolute) ? (0, storage_1.readDocument)(absolute) : null;
 }
+/**
+ * Why git cannot report on `path`, or `null` when it can: the first proper ancestor of `path` — a
+ * directory on the way to it, never `path` itself — that is a symbolic link, or that the filesystem
+ * refuses to `lstat` (a directory without search permission). Stops at the first missing segment: a
+ * path whose parent does not exist yet is not beyond anything (the creating verbs `mkdir` it).
+ *
+ * The leaf is deliberately excluded. A target that is ITSELF a symlink is one git does track (as a
+ * mode-120000 blob) and reports on, which is what keeps `directive remove` of a symlinked directive
+ * file working (`bug-044`'s benign case); whether a *write* may follow such a leaf is the confinement
+ * module's question (`requireConfinedWriteTarget`, `bug-120`), not this guard's.
+ */
+function uninspectableAncestor(root, path) {
+    const segments = path.split('/').filter((segment) => segment.length > 0);
+    for (let end = 1; end < segments.length; end += 1) {
+        const ancestor = segments.slice(0, end).join('/');
+        try {
+            if ((0, node_fs_1.lstatSync)((0, node_path_1.join)(root, ancestor)).isSymbolicLink())
+                return `'${ancestor}' is a symbolic link`;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR')
+                return null;
+            return `'${ancestor}' cannot be read (${String(code)})`;
+        }
+    }
+    return null;
+}
+/**
+ * Refuse, before anything is written, a target git **cannot report on** because a directory on the
+ * way to it is a symbolic link (task-131, `bug-118`, `bug-124`) — or cannot be read at all.
+ *
+ * For a path behind a symlink `git status --porcelain` is empty whether the file is modified or not,
+ * and the `git add` that `commitPaths` runs afterwards fails ("beyond a symbolic link") — after the
+ * write or the unlink has already happened. "I have nothing to report about this path" is not "this
+ * path is clean"; this is the check that keeps the two apart, so the guards below never read silence
+ * as consent. Exit `1` (`VALIDATION`), naming the path and the reason.
+ */
+function requireInspectableTarget(root, path, contract = exports.CONFIG_WRITE_CONTRACT) {
+    const reason = uninspectableAncestor(root, path);
+    if (reason === null)
+        return (0, types_1.coreOk)(undefined);
+    return (0, types_1.coreErr)({
+        code: 'VALIDATION',
+        message: `refusing to commit ${path}: ${reason}, and git cannot stage or inspect a path beyond a symbolic link or an ` +
+            `unreadable directory, so whether this ${contract.noun} carries modifications this ${contract.owner} does not ` +
+            'own cannot be inspected. Nothing has been written; replace a symbolic link with the directory it points ' +
+            'to, then retry.',
+    });
+}
+/**
+ * Refuse, before anything is written, a target whose **index** holds a version that differs from both
+ * `HEAD` and the working tree (task-131, `bug-182`) — the one loss a content-carrying verb can still
+ * cause.
+ *
+ * `memory submit` and `memory amend` own the whole document: its working-tree bytes are the content of
+ * record, so {@link requireUnmodifiedTarget} cannot apply to them. But `commitPaths` runs
+ * `git add -- <path>` before committing, and that silently overwrites a staged version the user
+ * prepared separately. When the staged version equals `HEAD` (nothing staged) or the working tree
+ * (the user staged what is about to be committed) nothing is lost and the verb proceeds; only the
+ * three-way divergence — git's own `XY` with both columns set — is refused. The answer is git's
+ * (`pathPorcelainStatus`), for the reason the module header gives. Also asks
+ * {@link requireInspectableTarget} first, since an empty porcelain is not an answer behind a symlink.
+ *
+ * @param path - Root-relative POSIX path of the document the verb is about to commit.
+ */
+function requireNoDivergentStage(root, path, contract = exports.CONFIG_WRITE_CONTRACT) {
+    const inspectable = requireInspectableTarget(root, path, contract);
+    if (!inspectable.ok)
+        return inspectable;
+    // Porcelain `XY`: X is index vs HEAD, Y is working tree vs index. Both set (and X not the
+    // untracked/ignored marker) is the three-way divergence; '' (clean) has neither.
+    const porcelain = (0, storage_1.pathPorcelainStatus)(root, path);
+    if (' ?!'.includes(porcelain.charAt(0)) || porcelain.charAt(1) === ' ')
+        return (0, types_1.coreOk)(undefined);
+    return (0, types_1.coreErr)({
+        code: 'VALIDATION',
+        message: `refusing to commit ${path}: the index holds a staged version that differs from both HEAD and the working ` +
+            `tree [git status '${porcelain}']. This ${contract.owner} commits the working-tree ${contract.noun}, so staging ` +
+            `it would silently discard the staged version; run 'git restore --staged -- ${path}' to drop it, or ` +
+            `'git add -- ${path}' to keep the working tree, then retry.`,
+    });
+}
 /**
  * Refuse, before anything is written, a target that already carries modifications this operation
  * does not own — `dl-080`'s ratified write rule for a command that **edits a file in place**.
@@ -103,6 +196,10 @@ function readWorktree(root, path) {
  *   have); omitted, it is read here.
  */
 function requireUnmodifiedTarget(root, path, contract = exports.CONFIG_WRITE_CONTRACT, worktree) {
+    const inspectable = requireInspectableTarget(root, path, contract);
+    if (!inspectable.ok)
+        return inspectable;
+    // Empty porcelain means clean only for a path git can see — guaranteed by the check above.
     const porcelain = (0, storage_1.pathPorcelainStatus)(root, path);
     if (porcelain === '')
         return (0, types_1.coreOk)(undefined);
@@ -146,16 +243,23 @@ function requireUnmodifiedTargets(root, paths, contract = exports.CONFIG_WRITE_C
  * absent path and for a clean, tracked one — so each of the three places a file can live is checked
  * explicitly.
  *
- * Reachable because `memory add` derives its id's sequence number from `readdirSync` of the working
- * tree (`nextSequenceNumber`, `../memory/add.ts`), so a working tree that disagrees with `HEAD` about
- * how many elements exist can generate an id that lands on an occupied path; the write that follows
- * is unconditional, and the commit's diff then becomes `HEAD` → scaffold rather than absent →
- * scaffold. A commit whose subject says "add" and whose diff removes lines is `bug-078` at its
- * sharpest.
+ * Reachable because an id can land on an occupied path. A slug-only `id_pattern` (`note-{slug}`)
+ * does whenever a title repeats. A `{n}` id does when the occupant is a **git-ignored** file: since
+ * task-128 `nextSequenceNumber` takes the highest number every ref and the working tree hold, but
+ * the working tree as git sees it, so an ignored file reserves no number. (Before task-128 it counted
+ * the working tree's files, so a gap reissued a taken number, `bug-087`.) The guard refuses; it never
+ * overwrites. The write that follows is unconditional, and the
+ * commit's diff would then be `HEAD` → scaffold rather than absent → scaffold. A commit whose subject
+ * says "add" and whose diff removes lines is `bug-078` at its sharpest.
  *
  * @param path - Root-relative POSIX path of the file about to be created.
  */
 function requireAbsentTarget(root, path) {
+    // Beyond a symlink, `HEAD` and the index report nothing and `git add` refuses after the write
+    // (task-131, the `bug-124` order in `memory add`'s shape).
+    const inspectable = requireInspectableTarget(root, path);
+    if (!inspectable.ok)
+        return inspectable;
     const occupied = [];
     if ((0, storage_1.readPathAtRev)(root, 'HEAD', path) !== null)
         occupied.push('at HEAD');
@@ -195,8 +299,11 @@ function undeclaredCommittedPaths(root, sha, declared) {
  *
  * `verifyCommittedScope` delegates its content half to `verifyDocumentEdit`, which compares *owned
  * frontmatter fields* and a body. `dna.yaml` and `roles.yaml` have no frontmatter block at all, so
- * for them the right — and strictly stronger — question is byte equality: the commit must carry, for
- * each declared path, exactly the text this operation wrote, and nothing else.
+ * for them the right — and strictly stronger — question is content equality: the commit must carry, for
+ * each declared path, exactly the text this operation wrote, and nothing else. "Exactly" is judged as
+ * git stores it: when the bytes differ from `git show`'s, the written text is hashed through git's
+ * filters for that path and compared with the committed blob (`committedBlobMatches`), so a CRLF file
+ * that `core.autocrlf=true` stores LF is not reported as a foreign change (task-193 review).
  *
  * Same shape as `task-080`'s lockfile guard and `task-088`'s post-condition: assert the diff, not the
  * end state. Reading the file back from disk answers "does `dna.yaml` now say `Renamed`?" — true no
@@ -223,7 +330,10 @@ function verifyCommittedPaths(root, sha, expected) {
         else if (after === null) {
             problems.push(`it does not contain '${path}'`);
         }
-        else if (after !== content) {
+        else if (after !== content && !(0, storage_1.committedBlobMatches)(root, sha, path, content)) {
+            // A byte difference alone is not a foreign change: git may have stored the written text through
+            // its filters (`core.autocrlf=true` keeps a CRLF file LF in the blob, task-193 review). Only a
+            // blob that the written bytes do not hash to, under those same filters, is one.
             problems.push(`'${path}' at the commit differs from what this operation wrote`);
         }
     }
@@ -244,4 +354,24 @@ function committedScopeError(root, sha, path, content) {
         message: `commit ${sha} carries more than the change it declares: ${leaked.join('; ')}`,
     });
 }
+/**
+ * Refuse an empty commit while the index holds staged changes (task-226, `dl-106`): `workflow finalize`'s
+ * phase record changes no file, so a staged change has no place in it. `commitEmpty`
+ * (`src/storage/commit.ts`) commits with `--only` and would leave it staged anyway; refusing first is the
+ * predictable answer `dl-106` asks for — the operator learns the record was not written beside their
+ * change, rather than finding the two interleaved. A read, so a dry run refuses too.
+ *
+ * @param subject - The subject of the commit about to be made, named in the refusal.
+ */
+function requireCleanIndex(root, subject) {
+    const staged = (0, storage_1.stagedPaths)(root);
+    if (staged.length === 0)
+        return (0, types_1.coreOk)(undefined);
+    return (0, types_1.coreErr)({
+        code: 'VALIDATION',
+        message: `refusing to commit '${subject}': the index holds staged changes (${staged.join(', ')}), and this commit records ` +
+            'no file change; commit or unstage them first, then retry.',
+        details: { staged },
+    });
+}
 //# sourceMappingURL=write-guard.js.map

package/dist/core/write-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-guard.js","sourceRoot":"","sources":["../../src/core/write-guard.ts"],"names":[],"mappings":";;;AAoHA,0DA6BC;AAGD,4DAUC;AAqBD,kDAcC;AAWD,4DAUC;AA0BD,oDAiBC;AAQD,kDAYC;AArRD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,qCAAqC;AACrC,yCAAiC;AAEjC,sCAAoD;AACpD,wCAOoB;AAEpB,mCAA2D;AAY3D,6GAA6G;AAChG,QAAA,qBAAqB,GAAwB;IACxD,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,6EAA6E;CACvF,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,MAAqB,EAAE,KAAa,EAAE,IAAY;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,IAAA,0BAAgB,EAAC,KAAK,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAClG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAA,gCAAuB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,WAAgC,6BAAqB,EACrD,QAAiB;IAEjB,MAAM,SAAS,GAAG,IAAA,6BAAmB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,UAAU,GAAkD;QAChE,CAAC,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC,IAAI,sBAAsB,CAAC;QAC7E,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC,IAAI,6BAA6B,CAAC;KAC1F,CAAC;IACF,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,sBAAsB,IAAI,+CAA+C,QAAQ,CAAC,KAAK,gBAAgB;YACvG,gBAAgB,SAAS,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,OAAO,oBAAoB;YACtG,kCAAkC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,SAAgB,wBAAwB,CACtC,IAAY,EACZ,KAAwB,EACxB,WAAgC,6BAAqB;IAErD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,IAAA,uBAAa,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;IAEpD,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,sBAAsB,IAAI,qCAAqC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACtG,wGAAwG;YACxG,4FAA4F;KAC/F,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,IAAY,EACZ,GAAW,EACX,QAA2B;IAE3B,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAA,6BAAmB,EAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;SACpD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,OAAO,GAAG,CAAC,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,oBAAoB,CAClC,IAAY,EACZ,GAAW,EACX,QAA4C;IAE5C,MAAM,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,IAAI,iCAAiC,CAAC,CAAC;QACjG,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,wDAAwD,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,IAAY,EACZ,GAAW,EACX,IAAY,EACZ,OAAsB;IAEtB,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,UAAU,GAAG,8CAA8C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACxF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"write-guard.js","sourceRoot":"","sources":["../../src/core/write-guard.ts"],"names":[],"mappings":";;;AA+IA,4DAeC;AAkBD,0DAoBC;AAoBD,0DAgCC;AAGD,4DAUC;AAuBD,kDAkBC;AAWD,4DAUC;AA6BD,oDAoBC;AAQD,kDAYC;AAWD,8CAUC;AA7ZD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,qCAAgD;AAChD,yCAAiC;AAEjC,sCAAoD;AACpD,wCASoB;AAEpB,mCAA2D;AAY3D,6GAA6G;AAChG,QAAA,qBAAqB,GAAwB;IACxD,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,6EAA6E;CACvF,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,MAAqB,EAAE,KAAa,EAAE,IAAY;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,IAAA,0BAAgB,EAAC,KAAK,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAClG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAA,gCAAuB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzE,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,EAAE;gBAAE,OAAO,IAAI,QAAQ,sBAAsB,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACzD,OAAO,IAAI,QAAQ,qBAAqB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,wBAAwB,CACtC,IAAY,EACZ,IAAY,EACZ,WAAgC,6BAAqB;IAErD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,sBAAsB,IAAI,KAAK,MAAM,wEAAwE;YAC7G,yCAAyC,QAAQ,CAAC,IAAI,+BAA+B,QAAQ,CAAC,KAAK,YAAY;YAC/G,0GAA0G;YAC1G,iBAAiB;KACpB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,WAAgC,6BAAqB;IAErD,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IAExC,0FAA0F;IAC1F,iFAAiF;IACjF,MAAM,SAAS,GAAG,IAAA,6BAAmB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;IACjG,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,sBAAsB,IAAI,iFAAiF;YAC3G,qBAAqB,SAAS,YAAY,QAAQ,CAAC,KAAK,6BAA6B,QAAQ,CAAC,IAAI,eAAe;YACjH,8EAA8E,IAAI,mBAAmB;YACrG,eAAe,IAAI,yCAAyC;KAC/D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,WAAgC,6BAAqB,EACrD,QAAiB;IAEjB,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IACxC,2FAA2F;IAC3F,MAAM,SAAS,GAAG,IAAA,6BAAmB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,UAAU,GAAkD;QAChE,CAAC,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC,IAAI,sBAAsB,CAAC;QAC7E,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,QAAQ,CAAC,IAAI,6BAA6B,CAAC;KAC1F,CAAC;IACF,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,sBAAsB,IAAI,+CAA+C,QAAQ,CAAC,KAAK,gBAAgB;YACvG,gBAAgB,SAAS,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,OAAO,oBAAoB;YACtG,kCAAkC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,SAAgB,wBAAwB,CACtC,IAAY,EACZ,KAAwB,EACxB,WAAgC,6BAAqB;IAErD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC5D,8FAA8F;IAC9F,2DAA2D;IAC3D,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,IAAA,uBAAa,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;IAEpD,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,sBAAsB,IAAI,qCAAqC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACtG,wGAAwG;YACxG,4FAA4F;KAC/F,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,IAAY,EACZ,GAAW,EACX,QAA2B;IAE3B,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAA,6BAAmB,EAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;SACpD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,OAAO,GAAG,CAAC,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,oBAAoB,CAClC,IAAY,EACZ,GAAW,EACX,QAA4C;IAE5C,MAAM,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,IAAI,iCAAiC,CAAC,CAAC;QACjG,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,IAAA,8BAAoB,EAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAChF,gGAAgG;YAChG,+FAA+F;YAC/F,gFAAgF;YAChF,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,wDAAwD,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,IAAY,EACZ,GAAW,EACX,IAAY,EACZ,OAAsB;IAEtB,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,UAAU,GAAG,8CAA8C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,IAAY,EAAE,OAAe;IAC7D,MAAM,MAAM,GAAG,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAA,cAAM,EAAC,SAAS,CAAC,CAAC;IAClD,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,uBAAuB,OAAO,sCAAsC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;YAClH,2DAA2D;QAC7D,OAAO,EAAE,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/directives/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * `directives` module — Project Directives pillar; role-based rules (built-in + custom) (P3.5/P3.8).
- * `DirectiveFrontmatter` (an [AUTHORING]-level minimal schema — see `./schema` for why there is no
- * dedicated tech-spec yet) lives here — the pillar owns its own independent schema (REQ-SYS-02);
+ * `DirectiveFrontmatter` (the frontmatter shape `spec-013-directive-frontmatter-schema` specifies, with
+ * `./version`'s check of its `version` key) lives here — the pillar owns its own independent schema (REQ-SYS-02);
  * `src/core`'s loader wires it through the shared validation pipeline. `./create`
  * (task-050-directive-create, P3.1) adds the pillar's first *authoring* helpers — the kebab-case
  * name rule and the generated file's content — which `src/core`'s `directiveCreate` operation
@@ -15,6 +15,7 @@
  */
 export declare const MODULE_NAME: "directives";
 export { DirectiveFrontmatter, RolesYaml } from './schema';
+export { checkDirectiveVersion, type DirectiveVersionCheck } from './version';
 export { INVALID_DIRECTIVE_NAME_MESSAGE, directiveTitleFromName, isValidDirectiveName, renderCustomDirective, } from './create';
 export { parseDirectiveIds, setRoleAssignmentsInText, withAssignedDirectives } from './roles-edit';
 //# sourceMappingURL=index.d.ts.map

package/dist/directives/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/directives/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,EAAG,YAAqB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/directives/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,EAAG,YAAqB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE9E,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}

package/dist/directives/index.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.withAssignedDirectives = exports.setRoleAssignmentsInText = exports.parseDirectiveIds = exports.renderCustomDirective = exports.isValidDirectiveName = exports.directiveTitleFromName = exports.INVALID_DIRECTIVE_NAME_MESSAGE = exports.RolesYaml = exports.DirectiveFrontmatter = exports.MODULE_NAME = void 0;
+exports.withAssignedDirectives = exports.setRoleAssignmentsInText = exports.parseDirectiveIds = exports.renderCustomDirective = exports.isValidDirectiveName = exports.directiveTitleFromName = exports.INVALID_DIRECTIVE_NAME_MESSAGE = exports.checkDirectiveVersion = exports.RolesYaml = exports.DirectiveFrontmatter = exports.MODULE_NAME = void 0;
 /**
  * `directives` module — Project Directives pillar; role-based rules (built-in + custom) (P3.5/P3.8).
- * `DirectiveFrontmatter` (an [AUTHORING]-level minimal schema — see `./schema` for why there is no
- * dedicated tech-spec yet) lives here — the pillar owns its own independent schema (REQ-SYS-02);
+ * `DirectiveFrontmatter` (the frontmatter shape `spec-013-directive-frontmatter-schema` specifies, with
+ * `./version`'s check of its `version` key) lives here — the pillar owns its own independent schema (REQ-SYS-02);
  * `src/core`'s loader wires it through the shared validation pipeline. `./create`
  * (task-050-directive-create, P3.1) adds the pillar's first *authoring* helpers — the kebab-case
  * name rule and the generated file's content — which `src/core`'s `directiveCreate` operation
@@ -20,6 +20,8 @@ exports.MODULE_NAME = 'directives';
 var schema_1 = require("./schema");
 Object.defineProperty(exports, "DirectiveFrontmatter", { enumerable: true, get: function () { return schema_1.DirectiveFrontmatter; } });
 Object.defineProperty(exports, "RolesYaml", { enumerable: true, get: function () { return schema_1.RolesYaml; } });
+var version_1 = require("./version");
+Object.defineProperty(exports, "checkDirectiveVersion", { enumerable: true, get: function () { return version_1.checkDirectiveVersion; } });
 var create_1 = require("./create");
 Object.defineProperty(exports, "INVALID_DIRECTIVE_NAME_MESSAGE", { enumerable: true, get: function () { return create_1.INVALID_DIRECTIVE_NAME_MESSAGE; } });
 Object.defineProperty(exports, "directiveTitleFromName", { enumerable: true, get: function () { return create_1.directiveTitleFromName; } });

package/dist/directives/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/directives/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;GAcG;AACU,QAAA,WAAW,GAAG,YAAqB,CAAC;AAEjD,mCAA2D;AAAlD,8GAAA,oBAAoB,OAAA;AAAE,mGAAA,SAAS,OAAA;AAExC,mCAKkB;AAJhB,wHAAA,8BAA8B,OAAA;AAC9B,gHAAA,sBAAsB,OAAA;AACtB,8GAAA,oBAAoB,OAAA;AACpB,+GAAA,qBAAqB,OAAA;AAGvB,2CAAmG;AAA1F,+GAAA,iBAAiB,OAAA;AAAE,sHAAA,wBAAwB,OAAA;AAAE,oHAAA,sBAAsB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/directives/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;GAcG;AACU,QAAA,WAAW,GAAG,YAAqB,CAAC;AAEjD,mCAA2D;AAAlD,8GAAA,oBAAoB,OAAA;AAAE,mGAAA,SAAS,OAAA;AAExC,qCAA8E;AAArE,gHAAA,qBAAqB,OAAA;AAE9B,mCAKkB;AAJhB,wHAAA,8BAA8B,OAAA;AAC9B,gHAAA,sBAAsB,OAAA;AACtB,8GAAA,oBAAoB,OAAA;AACpB,+GAAA,qBAAqB,OAAA;AAGvB,2CAAmG;AAA1F,+GAAA,iBAAiB,OAAA;AAAE,sHAAA,wBAAwB,OAAA;AAAE,oHAAA,sBAAsB,OAAA"}