V48 Gate 3 (specification-implementation): Rename to forcedInclusions and forcedExclusions

Replace sourcePathHints/protectedIpExclusions identifiers across deposit UI,
API, pipeline steering, anchors, analytics, fixtures, and notes. Keep legacy
POST/anchor key read fallbacks and leave option sourcePathRoots (covered paths)
unchanged.

Author: geraldarthurdavis

.bitcode/v39-depository-supply-indexing.json

@@ -59,7 +59,7 @@
       ],
       "requiredEvidence": [
         "sourceSafeTextRoot",
-        "sourcePathRoots",
+        "forcedInclusionRoots",
         "symbolRoots",
         "constraintRoots"
       ],

.bitcode/v43-deposit-route-options.json

@@ -30,7 +30,7 @@
     "repositoryFullName",
     "sourceBranch",
     "sourceCommit",
-    "sourcePathRoots",
+    "forcedInclusionRoots",
     "depositorInstructionRoot",
     "demandSignalRoots",
     "optionMeasurements",

BITCODE_V48_QA.md

@@ -474,7 +474,7 @@ Track 3-4 scripts (BTD ledger, settlement, pack journaling) get added when those
   Implementation plan step converged in ONE stitch cycle whose repair request carried
   the literal schema-validation error (vs the pre-fix five-cycles-to-death).
 - Defect: the selection model chose exactly the right context (deposit obfuscations/
-  inventory/protectedIpExclusions/demandContext + mode) but emitted `deposit#obfuscations`
+  inventory/forcedExclusions/demandContext + mode) but emitted `deposit#obfuscations`
   shorthand (`<namespace>#<key>`), while the resolver demanded the canonical
   `<execution-path>#<namespace>:<key>` — all five selected keys missed, `selectedContext`
   came back empty (fail-soft), and every downstream generation ran without its selected

packages/pipeline-hosts/src/__tests__/asset-pack-harness.test.ts

@@ -52,14 +52,14 @@ describe('asset-pack sandbox harness plan', () => {
       synthesizeMode: 'deposit',
       depositSteering: {
         obfuscations: 'hide internal names',
-        protectedIpExclusions: ['secret/'],
+        forcedExclusions: ['secret/'],
         demandContext: ['auth'],
       },
     });
     expect(plan.manifest.synthesizeMode).toBe('deposit');
     expect(plan.manifest.depositSteering).toEqual({
       obfuscations: 'hide internal names',
-      protectedIpExclusions: ['secret/'],
+      forcedExclusions: ['secret/'],
       demandContext: ['auth'],
     });
   });

packages/pipeline-hosts/src/asset-pack-harness.ts

@@ -67,7 +67,7 @@ export interface BuildAssetPackSandboxHarnessOptions {
   /** Deposit steering for the in-box deposit synthesis (source-safe). */
   depositSteering?: {
     obfuscations?: string | null;
-    protectedIpExclusions?: string[];
+    forcedExclusions?: string[];
     demandContext?: string[];
   };
   /**
@@ -1830,7 +1830,7 @@ try {
     harness: manifest,
     synthesizeMode: manifest.synthesizeMode || 'read',
     obfuscations: (manifest.depositSteering && manifest.depositSteering.obfuscations) || null,
-    protectedIpExclusions: (manifest.depositSteering && manifest.depositSteering.protectedIpExclusions) || [],
+    forcedExclusions: (manifest.depositSteering && manifest.depositSteering.forcedExclusions) || [],
     demandContext: (manifest.depositSteering && manifest.depositSteering.demandContext) || [],
   };
 

packages/pipeline-hosts/src/types.ts

@@ -107,7 +107,7 @@ export interface PipelineHarnessManifest {
   /** Deposit steering for the in-box deposit synthesis (source-safe). */
   depositSteering?: {
     obfuscations?: string | null;
-    protectedIpExclusions?: string[];
+    forcedExclusions?: string[];
     demandContext?: string[];
   };
   host: Pick<

packages/pipelines/asset-pack/src/__tests__/agent-measure-absolutes.test.ts

@@ -124,7 +124,7 @@ describe('validateDepositSynthesisOptions absolutes wiring', () => {
   const context = {
     lens: 'deposit' as const,
     inventoryPaths: ['src/auth.ts'],
-    protectedIpExclusions: [],
+    forcedExclusions: [],
     candidateKinds: ['capability-slice', 'implementation-pattern', 'proof-operations-slice'],
   };
 

packages/pipelines/asset-pack/src/__tests__/asset-packs-synthesis.test.ts

@@ -11,7 +11,7 @@ import {
   applyInventoryScope,
   isPathExcluded,
   isPathForcedIncluded,
-  normalizeProtectedIpExclusions,
+  normalizeForcedPathList,
   projectInventoryForPrompt,
   synthesizeAssetPackCandidates,
   validateDepositSynthesisOptions,
@@ -64,7 +64,7 @@ describe('AssetPacksSynthesis core', () => {
   });
 
   it('normalizes exclusions and filters inventory fail-closed before inference', () => {
-    const exclusions = normalizeProtectedIpExclusions('secret/\n\n  secret/  ');
+    const exclusions = normalizeForcedPathList('secret/\n\n  secret/  ');
     expect(exclusions).toEqual(['secret/']);
 
     const filtered = applyExclusionsToInventory(INVENTORY, exclusions);
@@ -137,7 +137,7 @@ describe('AssetPacksSynthesis core', () => {
       repositoryFullName: 'engineeredsoftware/demo-python',
       sourceBranch: 'main',
       sourceCommit: 'abc123',
-      steering: { instructions: 'demo', protectedIpExclusions: [], demandContext: ['demand'] },
+      steering: { instructions: 'demo', forcedExclusions: [], demandContext: ['demand'] },
       inventory: { ...INVENTORY, totalPathCount: 4, excludedPathCount: 0 },
       candidateKinds: ['capability-slice', 'implementation-pattern', 'proof-operations-slice'],
     });
@@ -166,7 +166,7 @@ describe('AssetPacksSynthesis core', () => {
       repositoryFullName: 'engineeredsoftware/demo-python',
       sourceBranch: 'main',
       sourceCommit: 'abc123',
-      steering: { instructions: null, protectedIpExclusions: ['secret/'], demandContext: [] },
+      steering: { instructions: null, forcedExclusions: ['secret/'], demandContext: [] },
       inventory: { ...INVENTORY, totalPathCount: 4, excludedPathCount: 0 },
       candidateKinds: ['capability-slice'],
     });
@@ -187,7 +187,7 @@ describe('AssetPacksSynthesis core', () => {
         repositoryFullName: 'engineeredsoftware/demo-python',
         sourceBranch: 'main',
         sourceCommit: 'abc123',
-        steering: { instructions: null, protectedIpExclusions: ['secret/'], demandContext: [] },
+        steering: { instructions: null, forcedExclusions: ['secret/'], demandContext: [] },
         inventory: { ...INVENTORY, totalPathCount: 4, excludedPathCount: 0 },
         candidateKinds: ['capability-slice'],
       }),
@@ -208,7 +208,7 @@ describe('deposit lens adapter', () => {
       repositoryFullName: 'engineeredsoftware/demo-python',
       sourceBranch: 'main',
       sourceCommit: 'abc123',
-      steering: { instructions: 'demo', protectedIpExclusions: ['secret/'], demandContext: [] },
+      steering: { instructions: 'demo', forcedExclusions: ['secret/'], demandContext: [] },
       inventory,
       candidateKinds: ['capability-slice'],
     });
@@ -219,7 +219,7 @@ describe('deposit lens adapter', () => {
         sourceBranch: 'main',
         sourceCommit: 'abc123',
         obfuscations: 'demo',
-        protectedIpExclusions: ['secret/'],
+        forcedExclusions: ['secret/'],
         createdAt: '2026-06-12T22:00:00.000Z',
       },
       result,
@@ -233,7 +233,7 @@ describe('deposit lens adapter', () => {
     expect(synthesis.optionCount).toBe(1);
     expect(synthesis.options[0].measurements.map((m) => m.volume)).toEqual([0.6, 0.7, 0.5]);
     expect(synthesis.options[0].roots.optionRoot).toMatch(/^deposit-asset-pack-option:[0-9a-f]{8}$/);
-    expect(synthesis.exclusionPosture.protectedIpExclusionCount).toBe(1);
+    expect(synthesis.exclusionPosture.forcedExclusionCount).toBe(1);
     expect(synthesis.exclusionPosture.excludedPathCount).toBe(1);
     expect(reviewProjections[0].coveredSourcePaths).toEqual(['README.md', 'src/app.py']);
     // The deposit-decision payload: provenant source becomes available to Bitcode.
@@ -289,7 +289,7 @@ describe('deposit lens adapter', () => {
       {
         lens: 'deposit',
         inventoryPaths: ['README.md', 'src/app.py'],
-        protectedIpExclusions: [],
+        forcedExclusions: [],
         candidateKinds: ['capability-slice'],
       },
     );

packages/pipelines/asset-pack/src/__tests__/deposit-agent-prompt-contracts.test.ts

@@ -48,7 +48,7 @@ function seedDepositExecution(): Execution {
     sourceCommit: '31bbc0c5227b6b3aed5d107fd8507d35ec22970a',
   });
   exec.store('deposit', 'obfuscations', 'Withhold the payments engine internals.');
-  exec.store('deposit', 'protectedIpExclusions', ['packages/payments/']);
+  exec.store('deposit', 'forcedExclusions', ['packages/payments/']);
   exec.store('deposit', 'inventory', {
     paths: ['src/telemetry/index.ts', 'src/telemetry/stream.ts', 'src/index.ts'],
     samples: [{ path: 'src/telemetry/index.ts', excerpt: 'export const telemetry = {};' }],

packages/pipelines/asset-pack/src/__tests__/deposit-agent-store-contract.test.ts

@@ -251,7 +251,7 @@ describe('deposit agent context/store contract', () => {
         {
           repository: REPOSITORY,
           inventory: INVENTORY,
-          protectedIpExclusions: ['src/protected'],
+          forcedExclusions: ['src/protected'],
           demandContext: ['session auth reads'],
         },
         divExec,
@@ -288,7 +288,7 @@ describe('deposit agent context/store contract', () => {
       // parent so sibling phase children resolve them via the upward walk.
       shared.store('deposit', 'repository', REPOSITORY);
       shared.store('deposit', 'obfuscations', 'obfuscations-marker: hide the signing keys');
-      shared.store('deposit', 'protectedIpExclusions', ['src/protected/exclusion-marker.ts']);
+      shared.store('deposit', 'forcedExclusions', ['src/protected/exclusion-marker.ts']);
       shared.store('deposit', 'inventory', INVENTORY);
       shared.store('deposit', 'demandContext', ['demand-marker: session auth reads']);
       shared.store('setup', 'inputComprehension', {
@@ -324,7 +324,7 @@ describe('deposit agent context/store contract', () => {
       const validationExec = shared.child('seq-2');
       const packs = [measuredPatchOption()];
       const result = await runDepositValidationAgent(
-        { assetPacks: packs, inventory: INVENTORY, protectedIpExclusions: [] },
+        { assetPacks: packs, inventory: INVENTORY, forcedExclusions: [] },
         validationExec,
       );
 
@@ -380,7 +380,7 @@ describe('deposit agent context/store contract', () => {
           assetPacks: [violating],
           inventory: INVENTORY,
           obfuscationGuidance: { summary: 'withhold secrets', obfuscatedPaths: ['src/secret'] },
-          protectedIpExclusions: [],
+          forcedExclusions: [],
         },
         validationExec,
       );
@@ -402,7 +402,7 @@ describe('deposit agent context/store contract', () => {
       // on the SHARED parent, where every sibling phase child can findUp them.
       shared.store('implementation', 'options', packs);
       shared.store('deposit', 'inventory', INVENTORY);
-      shared.store('deposit', 'protectedIpExclusions', []);
+      shared.store('deposit', 'forcedExclusions', []);
       shared.store('setup', 'inputComprehension', { summary: 'no obfuscations', obfuscatedPaths: [] });
 
       const validationChild = shared.child('seq-2').child('seq-0');