schema_version: work-registration-advisory-entrypoint-adjudication-v1
chunk: "000299"
generated_at: "2026-05-22T08:57:27Z"
source: runtime-work-registration-entrypoint-coverage
status: passed
input_reports:
  - ai/reports/report-000298-work-registration-entrypoint-coverage.md
  - ai/reports/report-000298-work-registration-entrypoint-coverage.yaml
output_reports:
  - ai/reports/report-000299-work-registration-entrypoint-coverage.md
  - ai/reports/report-000299-work-registration-entrypoint-coverage.yaml
before:
  entrypoint_count: 747
  missing_high_confidence_count: 0
  exemption_issue_count: 0
  advisory_count: 68
after:
  entrypoint_count: 747
  missing_high_confidence_count: 0
  exemption_issue_count: 0
  advisory_count: 0
  classification_counts:
    pure_inspection: 413
    work_producing: 236
    authority_sensitive: 68
    emergency_only: 26
    test_fixture_only: 4
    unknown: 0
  coverage_counts:
    direct_runtime_work_wrapper: 23
    role_preflight: 6
    socket_request_wrapper: 179
    test_runner_work_contract: 7
    supervisor_work_contract: 1
    explicit_exemption: 533
    none: 0
adjudication:
  ai_command_facade:
    action: explicit_exemptions_added
    result: covered
    examples:
      - entrypoint: approve-requirements.sh
        classification: authority_sensitive
        owner: Requirements lifecycle shell facade
        reason: legacy requirements mover guarded by requirements review verdict
      - entrypoint: backend-architecture-report.sh
        classification: pure_inspection
        owner: Architecture report tooling
        reason: read-only report facade must not create false active work
      - entrypoint: close-commit-approved.sh
        classification: authority_sensitive
        owner: Approved-action dispatcher compatibility facade
        reason: compatibility facade delegates close authority to accepted approval/dispatcher paths
  runtime_api_export:
    action: reviewed_runtime_owned_exports_exempted
    result: covered
    rule: Runtime API exports are owned by typed Runtime procedures or read-model/state APIs; hosted shell workflows must invoke the corresponding Runtime CLI/socket/dispatcher wrapper.
  runtime_cli_branch:
    action: existing_runtime_wrappers_and_authority_paths_classified
    result: covered
    direct_runtime_work_wrapper:
      - architecture
      - command
      - validate-governance
    role_preflight_or_authority_sensitive:
      - executor-activate-chunk
      - executor-archive-chunk
      - telegram-run-summary
policy_effect:
  high_confidence_missing_is_enforced: true
  malformed_explicit_exemptions_are_enforced: true
  pure_inspection_creates_false_active_work: false
  uncertain_static_findings_hardened_to_blockers: false
  direct_runtime_cli_work_contracts_preserved: true
cfd_updates:
  cfd_0034:
    updated: true
    narrowed_to: entrypoint coverage validator maintenance plus hosted-tool bypass enforcement follow-up
    no_remaining_advisory_entries: true
remaining_scope:
  - Hosted tool command enforcement is still tracked separately by cfd-0036.
  - True parallel role execution remains out of scope; current supported model remains single parent context plus foreground child and task/process fan-out.
  - New Runtime CLI/API/shell surfaces must keep the coverage report at zero high-confidence missing entries and zero advisory entries.
validation:
  work_registration_entrypoint_coverage:
    command: node ai/runtime/dist/cli.js work-registration entrypoint-coverage --write --report ai/reports/report-000299-work-registration-entrypoint-coverage.md --yaml-report ai/reports/report-000299-work-registration-entrypoint-coverage.yaml --json
    result: passed
    advisory_count: 0
    missing_high_confidence_count: 0
    exemption_issue_count: 0
