docs(research-patches): Wave 6 AI-doc cold audit (§13.26) by artyhoo · Pull Request #27 · artyhoo/getff

artyhoo · 2026-05-10T18:26:42Z

Summary

Recursive self-audit of the framework's own AI-doc layer in cold-context (harness-baseline → post-exposure). 6 probes, 3 direct + 3 extension.
Strongest finding: Probe 2 FAIL (Step 0 instruction is descriptive, not actionable) + Probe 6 FAIL (CLAUDE.md auto-load alone misses README's 5-layer taxonomy and produces a synthesised structure that maps to nothing canonical) — a harness-baseline AI working only from auto-loaded CLAUDE.md systematically reaches incomplete or distorted views of project structure.
Pure observation; no shipped-artefact edits, no implementation. §4 surfaces 6 ranked improvement proposals (P-1 UserPromptSubmit hook + P-2 CLAUDE.md→README 5-layer link top-ranked); §5 lists 5 deterministic + 3 LLM-judge probes; §6 routes ship/defer/out-of-scope decisions to a separate orchestrator session.
§4 P-1 carries an explicit cross-reference to open-questions.md §13.28 (harness-level hook category) per source-prompt CLOSEOUT pointer — overlap noted, not absorbed; Wave 7 (.claude/orchestrator-prompts/wave-7-hot-checks-joint-closure/) handles joint closure under §13.8.

Test plan

REPORT block (per source-prompt CONSTRAINTS)

File: docs/meta-factory/research-patches/2026-05-10-ai-doc-effectiveness-cold-audit.md
Lines: 497
Sections present: §1-§8 (all)
Probe scores: P1:PARTIAL (revised from PASS post-Phase-2) P2:FAIL P3:PARTIAL P4:PASS P5:PARTIAL P6:FAIL
Mechanisms evaluated: 8 (CLAUDE.md auto-load, AGENTS.md template content, README defensive language, session-bootstrap.md Step 0, Authoritative-for headers, auto-memory, self-reflection auto-trigger, doc-authority §4 anti-patterns)
Improvements proposed (§4): 6 (P-1..P-6); ranked by cost-vs-benefit?: yes (HIGH/MEDIUM/LOW benefit × LOW cost)
Test-coverage opportunities (§5): 5 deterministic (D3-D7) / 3 LLM-judge (L-1..L-3)
Branch: wave-6/ai-doc-cold-audit
Commits: 64d87d1 docs(research-patches): §13.26 Wave 6 AI-doc cold audit findings
         3422b2e fixup(research-patches): re-stage trimmed Wave 6 audit (495 lines)
         c711745 docs(research-patches): §4 P-1 cross-ref to §13.28 (review fix)
Confidence: high (direct probes P1/P2/P4/P6 observation-grounded; extension probes P3/P5 acknowledged as weaker evidence in §8)
ATTN: none — overlap with §13.28 surfaced as cross-reference, deferred to Wave 7 joint closure per source-prompt CLOSEOUT pointer

Notes for reviewer

Local git status may show 3 unrelated working-tree files (.husky/pre-push, EXECUTION-PLAN.md, open-questions.md) — residue from wave-5 sibling sessions, not part of this PR's commits. Confirm via git diff origin/main..HEAD --stat (1 file, +497 lines after followup).
§6 is intentionally a decision register, not a ship plan. Wave 6 mandate is observation-only; subsequent orchestrator session decides which §4 proposals (if any) to implement.
§8 honest meta-assessment: D2 (taxonomy conflation) actually occurred in this audit's own Phase 1 work; was caught only because Probe 6 spec forced README cross-check. This is the strongest single piece of evidence the audit produced — passive mechanisms (Authoritative-for headers, Step 0, self-reflection auto-trigger) did not catch the drift autonomously.

Followup: Wave 5 implementation gated on §6 D-1/D-2 outcomes (P-1 hook + P-2 CLAUDE.md link could feed Wave 5 §11 layering decision per source prompt §«Relation to Wave 5»)
Trigger followup: §6 D-5 proposes consumer-side audit as Wave 7 candidate
Joint closure: §13.27 + §13.28 + §13.8 handled in pre-staged Wave 7 prompts (.claude/orchestrator-prompts/wave-7-hot-checks-joint-closure/); P-1 noted as overlap per CLOSEOUT pointer

Recursive self-audit of the framework's own AI-doc layer in cold-context. 6 probes (3 direct, 3 extension) run in two phases (harness-baseline -> post-exposure). Findings: Probe 2 FAIL (Step 0 instruction descriptive, not actionable), Probe 6 FAIL (CLAUDE.md auto-load alone yields a distorted "framework structure" view that misses README's 5-layer taxonomy), Probe 1 revised PARTIAL (operational docs hold a "canonical" goal-phrase synthesis that does not appear verbatim in README — silent drift surface). 5 deterministic probes (D3-D7) + 3 LLM-judge advisory probes proposed for §4 follow-up; ship/defer/out-of-scope decisions in §6. Pure observation; no shipped-artefact edits, no implementation. Decisions deferred to orchestrator review session. Prior-art: skipped — research-patch documenting audit findings, no new capability artefact in this commit. §4 proposals that could become capability commits are explicitly flagged for Prior-art consult at their own ship time (§7 forward-check).

Commit 64d87d1 staged the 547-line draft before §3/§4/§6 trim Edits. Pre-commit hook checks working tree (which was 495 lines after Edit), but commit packaged stale index. This commit re-adds the trimmed working-tree version so HEAD matches the deliverable's reported 495 lines and the 500-line cap holds. Prior-art: skipped — fix-up for stale staged content, no capability artefact added or removed.

Add Cross-reference line to §4 P-1 (`UserPromptSubmit` hook proposal) per source-prompt CLOSEOUT pointer: «If §4 improvements propose mechanism upgrades that overlap with §13.28 / §13.8 — note the overlap; do not absorb into Wave 6 scope». P-1 falls under harness-level hook category (5th enforcement layer per open-questions.md §13.28); now explicitly deferred to Wave 7 joint closure rather than silently absorbed. Reviewer-surfaced fix; deliverable still 497 lines (cap holds). Prior-art: skipped — review-driven doc edit (one-line cross-reference), no capability artefact added.

…verlap analysis Adds three entries from the aif-handoff-overlap-analysis mandate (Stage 3, Phase A). Entries reflect verdicts from Stage 1 research + Stage 2 review: - #27 DEFER: AIF Handoff HANDOFF_MODE env-var fork (C1×P4 ORT — different problem classes; DEFER pending non-interactive orchestration pipeline) - #28 DEFER: AIF Handoff paused:true/false semantic (S1×P5 ORT — different granularities; DEFER pending wave state machine formalisation Phase 11+) - #29 ADAPT: AIF first-line plan annotation pattern (A1×P6 OVL; ADAPT as  for research patches + automated trigger sweeps §1.6) Phase B (ADAPT implementation: annotations + CI gate) follows in separate commit, citing entry #29 as Prior-art trailer. Prior-art: skipped — adding SSOT entries to prior-art-evaluations.md; no new capability artifact, no new file under packages/, no new package.json dep.

fix: wave-5 readiness — AIF Handoff overlap analysis + scope annotations (SSOT #27-#29)

…32 → #31-#36 (AIF Handoff collision fix) 2026-05-11 readiness review on `fix/wave-5-readiness-revise` identified BLOCKER B-1: the branch's own AIF Handoff overlap analysis (commits `5d8cf1c`, `0f7f572`) landed SSOT entries #27-#30 in `prior-art-evaluations.md` for HANDOFF_MODE / paused-semantic / handoff:task / implement-coordinator — re-occupying the range previously remap'd to in `d7a6c87` for Wave 5 §13.25 candidates. Remap §10 table + all cross-references in §4 (Continue permissions SSOT ref), §10 narrative (Next ID / entries #1-#N), §12 Implementation outline, §13.1 Forward-check anti-pattern row, See also block. Added explicit §10 footnote logging the second remap for future readers. Mapping: 27 AIF /aif → 31 28 AIF skills.sh → 32 29 Continue permissions → 33 30 Cline marketplace → 34 31 Codex MCP CLI → 35 32 Roo Code installer → 36 Operator-side kickoff (`.claude/orchestrator-prompts/wave-5-tool-bootstrapping/orchestrator-kickoff.md`, gitignored) updated in lockstep: m2 Windsurf ID #33 → #37 (next-free after new range); SCOPE block acknowledges «#27-#30 AIF Handoff occupied»; ATTN STOP rule baseline updated to existing entries #1-#30. Closes readiness-review M-1 (research §10 not yet edited for the new collision) and addresses root cause of BLOCKER B-1. Push + CI-green on HEAD is the remaining operator action before B-1 is fully closed. Non-touched: existing SSOT entries #1-#30 (Wave 7 #16-#26 + AIF Handoff #27-#30); AIF /aif row's «entry #8 cadence» reference unchanged. Doc errata only — not a capability commit per CLAUDE.md gate; not a §1.7 rule extension. Prior-art: skipped — doc errata only (second SSOT-ID remap parallel to d7a6c87 precedent), no new capability per CLAUDE.md gate; resolves readiness-review BLOCKER B-1 + MAJOR M-1 (2026-05-11) on `fix/wave-5-readiness-revise` umbrella.

fix: wave-5 readiness — second SSOT ID remap #27-#32 → #31-#36 (AIF Handoff overlap closure)

docs(ssot): correct AIF Handoff attribution + add aif-handoff monorepo entries (#27-#30 + #42-#46)

…APT (symlink-to-canonical) (#77) R-phase deliverable for the gitignored-coordination-doc drift problem (.claude/orchestrator-prompts/** per-worktree copies diverge on edit). Search-coverage executed: SSOT consult (no match; near-neighbours #27/#28/#44 rejected on problem-class), DeepWiki x3 (git/git, superpowers, git-worktree.nvim), WebSearch x3, internal sweep. 8 candidates enumerated across copy/symlink/hardlink/ relocate/un-gitignore semantics; per-candidate verdict via build-first-reuse-default §2 typology. Recommendation: ADAPT symlink-to-canonical (b)+(e) — proven by worktree-env-sync + worktree.linkFiles proposal; copy-at-creation tools (git-worktreeinclude/ git-worktree-runner) REFERENCE'd only (T-coord-A: name-match, wrong problem class — they copy, we need live sync). <=30 LOC harness-agnostic helper sketch. Zero LLM, no daemon, no CI surface. §1.7 forward+backward checks applied; T15 self-application surfaced the recursion that this R-phase's own kickoff was gitignored-absent from its fresh worktree. Prior-art: skipped — research-patch only, no new capability shipped (deliverable is one tracked markdown analysis file under docs/meta-factory/research-patches/).

…APT (symlink-to-canonical) (#78) R-phase deliverable for the gitignored-coordination-doc drift problem (.claude/orchestrator-prompts/** per-worktree copies diverge on edit). Search-coverage executed: SSOT consult (no match; near-neighbours #27/#28/#44 rejected on problem-class), DeepWiki x3 (git/git, superpowers, git-worktree.nvim), WebSearch x3, internal sweep. 8 candidates enumerated across copy/symlink/hardlink/ relocate/un-gitignore semantics; per-candidate verdict via build-first-reuse-default §2 typology. Recommendation: ADAPT symlink-to-canonical (b)+(e) — proven by worktree-env-sync + worktree.linkFiles proposal; copy-at-creation tools (git-worktreeinclude/ git-worktree-runner) REFERENCE'd only (T-coord-A: name-match, wrong problem class — they copy, we need live sync). <=30 LOC harness-agnostic helper sketch. Zero LLM, no daemon, no CI surface. §1.7 forward+backward checks applied; T15 self-application surfaced the recursion that this R-phase's own kickoff was gitignored-absent from its fresh worktree. Prior-art: skipped — research-patch only, no new capability shipped (deliverable is one tracked markdown analysis file under docs/meta-factory/research-patches/).

…cation (#161) Codifies 5 stage-0 memory conventions (DN-4 gaps #20/#23/#25/#26/#27): - phase-research-coverage.md §1.12 — lead with reasoned recommendation (#27); act when best path clear, reserve questions for genuine forks (#20) - ai-laziness-traps.md T17/T18/T19 — preserve-before-destructive (#25), preserve-unique-residue (#26), own-cold-QA-before-handoff (#23) - tracker rows → CODIFIED (#27 prose-only; mechanization deferred per #97/#98) Channel-selection: judgment rules → reuse 2 already-always-on rules, not new files (#always-on-bloat). §1.7 self-review at research-patches/2026-05-22-dn4-round2-codification.md. Prior-art: skipped — prose discipline codification of existing memory conventions, no new capability or dependency

…E Superpowers + SSOT #64/#65 + retention=A coexist (#166) N7 (DECISION=C) repo-side application. Source-verified the Superpowers adoption against shipped SKILL.md (dual-channel DeepWiki + raw WebFetch, 2026-05-22) instead of assuming from name. - .claude/rules/parallel-subwave-isolation.md §4: drop the homegrown AST-detection build-target; REFERENCE Superpowers `using-git-worktrees` (Step 0 GIT_DIR!=GIT_COMMON skip → compatible with isolation:"worktree"). Stays Class C; new §5 §1.7 forward/backward note. - prior-art-evaluations.md: append SSOT #64 (SDD, ADOPT process-layer) + #65 (using-git-worktrees, ADOPT + REFERENCE). NOT #60/#61 — those were taken by the parallel channel-selection wave (the exact ID-collision §6 warned about). "#27 = Git-Isolation" was a misattribution (#27 is HANDOFF_MODE) — corrected, void #27-update skipped. - N7 patch §9 closure: source-verification findings, retention verdict A (coexist), ID corrections, classifier-blocked items. - roadmap banner reconciled (DECISION=C set, original framing preserved append-only); sequencing-plan N7 status updated. Retention=A: SDD review is post-implementation, orchestrator Phase -1 is pre-dispatch + owns quota/Mode/bootstrap meta-layer SDD lacks → coexist. Blocked (maintainer-applied): global Superpowers install + orchestrator- skill annotation — both denied by the auto-mode classifier (untrusted external code / self-modification). Live-dogfood trial pending those. §1.7: Forward — demotion complies with build-first-reuse-default.md (REFERENCE-over-BUILD) + no-paid-llm-in-ci.md (using-git-worktrees pure-git); Backward — scope-reducing, only edited bullet is parallel-subwave-isolation.md:37 (§4), SSOT cross-ref at prior-art-evaluations.md row #65, full self-reflexive note at parallel-subwave-isolation.md:46 Prior-art: skipped — N7 process-layer dogfood adoption; SSOT #64/#65 appended documenting ADOPT verdicts, no new dependency or capability code added

…eep evaluation (#268) Variant scored: MCP-consumer bridge (handoff_create_task + accept_existing_plan + WebSocket tail + handoff_sync_status). 7 DeepWiki probes + 2 WebSearch queries + SSOT #27/#28/#30/#43/#44/#46/#67/#80 consult + SKILL.md:404/429 disambiguation. Verdict: REFERENCE (not ADOPT). Body-format falsifier PASSES — description field accepts arbitrary markdown (z.string().optional(), no .max()). Minimum call = {projectId, title}. BUT full pipeline bridge blocked by three structural issues: (1) accept_existing_plan requires physical PLAN.md on disk in .ai-factory/ — filesystem coupling beyond MCP boundary; (2) WebSocket broadcast channel has no topic filter — client must filter by taskId; (3) aif-handoff Reviewer (autoMode) conflicts with reviewer-discipline.md §2 strategy-fork-surface gate. Admission gate §2.4: PR #127/#128 touch packages/runtime/ only — no packages/mcp/ or apps/coordinator/ changes. Gate CLEAR. SKILL.md:404 vs :429 inconsistency resolved analytically (both consistent — BFR verdict = REFERENCE for SP skill; operational action = ADOPT SP dispatch template). Prior-art: prior-art-evaluations.md#44 (DEFER, body-format now confirmed compatible); prior-art-evaluations.md#30 (DEFER, accept_existing_plan bypass documented); prior-art-evaluations.md#67 (REJECT unchanged — Variant A is optional layer, not replacement). Sub-wave D proposes new SSOT row for Variant A bridge vocabulary.

…k + aif-handoff MCP) REFERENCE (#275) Verdict per BFR-default §1: REFERENCE — design-vocabulary for dispatch-trigger optimisation of Variant A; not actionable standalone. Key findings (2026-05-29 evidence): - CC PostToolUse hooks expose a purpose-built `mcp_tool` hook type for already-connected MCP servers (code.claude.com/docs/en/hooks.md fetched 2026-05-29) — T-AIF-BRIDGE-B'-1 evades via different shape than originally framed. - aif-handoff MCP server runs standalone without coordinator daemon for task creation (DeepWiki ×2 phrasings: «MCP server can be invoked statelessly from an arbitrary process» + «MCP HTTP daemon runs independently») — T-AIF-BRIDGE-B'-3 evades. - 4 sub-options each fit <100 LOC bridge target: Option (a') = 0 LOC bash (mcp_tool hook config), Option (a) = ~25 LOC bash (command hook + curl), Option (b) = ~15 LOC chokidar Node, Option (c) = ~10 LOC fswatch bash. BUT: B' inherits all 3 of SW-A's ADOPT-blockers verbatim (PLAN.md disk coupling, WebSocket-broadcast no-topic-filter, autoMode Reviewer vs reviewer-discipline.md §2 conflict — DN-1=B-constrained applies). B' optimises only the dispatch trigger; the load-bearing blockers persist. Comparison table vs A and B in §6. §4 5-criteria: PASS-PASS-PARTIAL-PASS-INHERITED. Match ~35%. Atomicity INCONCLUSIVE/MITIGABLE (chokidar awaitWriteFinish for Option b; empirical for hooks). Falsifier: B' upgrades to ADOPT VOCABULARY iff Sub-wave D greenlights A AND DN-1=B-constrained adopted. T-discipline applied per kickoff §6 SW-B2: T1 / T3 / T7 / T11 / T12 / T13 / T15 / T16 / T17 / T19 (own cold-QA before push) / T20 + T-AIF-BRIDGE-B'-1..5. Prior-art: SSOT #20 (CC hooks API, ADOPT) + SSOT #27/#28/#30/#43/#44/#46/#67/#80 (aif-handoff rows). Additive note to SSOT #44 proposed (no verdict change). Proposed new SSOT row at next-available slot #85.

… Implementer-equivalent only) value-add audit (#276) R-phase patch for Sub-wave C of the aif-handoff-as-runtime-bridge umbrella. Evaluates Variant C (kickoff §3 lines 124-145): aif-handoff as Implementer- equivalent only, bypass Planner+Reviewer cycle, thin CLI wrapper for kickoff dispatch + kanban status tracking. Verdict: REJECT (BFR-default §1 ladder). Rationale: - The kickoff-framed "aif-handoff exec --kickoff <path>" CLI does not exist in lee-to/aif-handoff (DeepWiki probes 1+5, 2026-05-29). - No first-class Implementer-only mode; skipReview:true bypasses Reviewer but Planner is mandatory unless accept_existing_plan with on-disk PLAN.md (same disk coupling SW-A flagged for Variant A). - BEFORE/AFTER maintainer-action count: 25% literal / 0% cognitive reduction (T-AIF-BRIDGE-C table §4) — below kickoff §8 STOP 30% threshold → verdict "Variant C value-add insufficient". - Pure-tracker pattern (paused:true + autoMode:false + manual state-machine transitions) IS shipped but adds zero automation beyond UI tracking; Docker+SQLite infra unjustified. Cites: - SW-A merged PR #268 (Variant A REFERENCE, 28% match, 3 ADOPT-blockers) - SW-B merged PR #267 (Variant B REJECT, ~5% match, no dir-watch capability) - PR #269 follow-up (mechanical corrections, no verdict changes) - DN-1=B-constrained input consumed in criterion 5 (mooted for Variant C which bypasses aif-handoff Reviewer entirely) - Gate-4 admission re-sweep: PR #127+#128 touch packages/runtime/ only (no MCP/coordinator drift in 30-day window) 5 distinct DeepWiki probes + 2 WebSearches + cross-ref to SW-A/SW-B/PR #269 = 19+ evidence channels (T1 floor exceeded 3.8x). §1.7 forward+backward + §self-application + T-trap walk per ai-laziness-traps.md §3. Single output file under docs/meta-factory/research-patches/. No code, skill, agent, install.sh, or .claude/rules/ modifications. ### §1.7 Forward-check applied build-first-reuse-default.md §1 verdict ladder applied; BFR §3 6-layer search performed (SSOT rows #27/#28/#29/#30/#43/#44/#46/#67/#80 reviewed at prior-art-evaluations.md:95-148; DeepWiki >=5 probes; WebSearch >=2 phrasings; own-stack sweep at .claude/skills/meta-orchestrator/SKILL.md:441 anti-scope + :404+:429 SP requesting-code-review). no-paid-llm-in-ci.md §1 enforced (all evidence via subscription-bundled DeepWiki/WebSearch + free gh CLI + bash). reviewer-discipline.md §2 respected (DN-1=B-constrained consumed as fact, not re-litigated; verdict is research finding against §8 STOP, not strategy choice). ai-laziness-traps.md §3 active T-traps applied (T1, T3, T7, T11, T12, T13, T15, T16, T17, T19, T20, T-AIF-BRIDGE-C MANDATORY BEFORE/AFTER table at patch §4). Evidence: see patch §8 file:line citations. ### §1.7 Backward-check applied SSOT #27/#28/#67 receive additive notes (additive-only; no verdict changes). Original DEFER/DEFER/REJECT rationales reviewed at prior-art-evaluations.md: 95, 96, 135 — consistent with Sub-wave C findings (reinforce existing classifications, do not re-litigate). No .claude/rules/* modified; no .claude/skills/* modified; no agents/* modified; no packages/* modified; no install.sh modified; no kickoff.md modified. Single output file in docs/meta-factory/research-patches/. Scope strictly bounded to Variant C; SW-A/SW-B/SW-B2/SW-D out of scope. T15 self-application confirmed in patch §10. Memory not written (Sub-wave D synthesis is the natural codification surface). Evidence: see patch §9 file:line citations.

…verdict (DEFER-all-with-updated-triggers) (#281) Cross-variant synthesis consolidating Sub-waves A/B/B'/C (merged PRs #267/#268/#275/#276). Per-variant verdicts re-derived independently per T15: A=REFERENCE (28%), B=REJECT (~5%), B'=REFERENCE conditional ADOPT VOCABULARY (~35%), C=REJECT (~22%). Cross-variant recommendation per kickoff §6.5: DEFER all variants with updated SSOT «Trigger to revisit» fields. Includes 20-cell comparison table (4 variants × 5 criteria, file:line citation per cell), 4-row T16 problem-class match table, DN-1 (B-constrained) + DN-2 (B' is operative B-path) reflections, hook-discipline (Decision 10) analysis (no equipoise → recommend on clearly-better evidence; DECISION-NEEDED NOT warranted), consolidated SSOT additive notes for #27/#28/#30/#44/#67/#80, proposed new SSOT row #85 (next-after-#84 verified). Prior-art: prior-art-evaluations.md#27, #28, #30, #44, #67, #80 (existing aif-handoff entries, additive-note-only — no verdict changes); SSOT row #85 PROPOSED, not landed.

…#352) aif commits only on its approve_done && commitOnApprove path; the request_changes→implementing→done rework path leaves the work uncommitted (dirty tree, branch == base HEAD), so harvest had nothing to push. Extend the egress: hasUncommittedChanges → commitAll (templated message, ZERO LLM) before push. No-op on the normal path (tree already clean). Commit failure is fail-fast — nothing pushed, operator gets the printed fallback. Real dep guards that the container checkout is on the task branch before committing. aif-handoff source untouched (foreign runtime, SSOT #27) — fix lives entirely on our egress leg, matching harvest's graceful-degradation design. Prior-art: skipped — extends existing harvest CLI, deterministic git only, no new capability/dependency.

…+ runtime-bridge (134 commits) (#488) * feat(hooks): SubagentStop REPORT-schema WARN (non-blocking, #108 candidate-3) (#339) Ship .claude/hooks/warn-subagent-report.sh — scans the finishing subagent's output for canonical REPORT sections (VERIFY, Confidence, ATTN); emits a ⚠ stderr warning + exit 0 (non-blocking) when any are missing. Maintainer chose WARN over block (exit 2) — judgment target, not gateable (#gate-where-judgment-needed, rule-enforcement-channel-selection.md §1). Contract verified DUAL-CHANNEL 2026-06-01: Channel 1 — WebFetch code.claude.com/docs/en/hooks: SubagentStop fields include agent_type; exit 0 = non-blocking; stderr shown to user. Channel 2 — DeepWiki anthropics/claude-code: agent_transcript_path + last_assistant_message (since CC 2.1.47) confirmed by name + quoted. Two read paths (B1 — scan-nothing trap avoidance): 1. last_assistant_message if non-empty. 2. agent_transcript_path JSONL, reusing end-of-turn-reminder.sh:30-41. Noise guard: skip Explore agent_type + require standalone REPORT-cue label. Paired test: 6 cases (positive-A/B + negative + negative-2 Explore + non-report prose + exit-code invariant). All 6 green. Pre-existing staging failures (pre-push.test.ts + plan-currency-check.test.ts) unaffected. settings.json wiring snippet in PR body (maintainer lands, not committed). Prior-art: prior-art-evaluations.md#108 (SubagentStop REPORT-schema gate — candidate-3 of #108, shipped as WARN per maintainer decision 2026-06-01; block dropped — judgment target, #gate-where-judgment-needed). * docs(research-patches): satellite-feature-harvest — own-stack-first harvest + reverse-sweep (form B) (#328) Own-stack-first sweep: Claude Code natively ships the remote/scheduled/parallel-session cluster (Remote Control, Routines, Channels, agent-view, Slack) that prior SSOT rows credited to companions. 15 capability clusters triaged → 4 adopt-now (Remote Control, Routines via /schedule, Channels(Telegram), background agent-view) + 3 defer + 8 skip. Reverse sweep: 4 criterion-zero relationships, no shipped artefact retired (T-SFH-D — runtime-bridge questions.ts kept; Channels is session-open-only). +1 SSOT row #100. Prior-art: skipped — research-patch only, no new capability (the BFR own-stack-first survey is the patch content itself). * chore(hooks): wire pending CC hooks in settings.json (SubagentStart/Stop + runtime-bridge) (#340) Activates three already-merged, already-committed hook scripts that were running locally but never wired in the shared config: - PostToolUse Write|Edit|MultiEdit -> runtime-bridge-dispatch.sh (#313) - SubagentStart -> inject-subagent-digest.sh (#108 companion-adoption-iphase) - SubagentStop -> warn-subagent-report.sh (#108 candidate-3, #339) All hook scripts already exist in staging; this only activates them. Config-only wiring, not a capability commit. * docs(book): SubagentStop block-vs-warn — flip open-node DECISION-NEEDED → решён=WARN (#339) (#341) #339 (SubagentStop REPORT-schema WARN, non-blocking) merged to staging as 0596a64 — the block-vs-warn decision is resolved in favour of WARN. Hook remains INERT (no SubagentStop in settings.json) until the maintainer lands the snippet, so the node stays half-open: decided, not yet wired. - v1 (technical): chapter XXII + epilogue June-1 open-nodes list — cite #339 - v2/v3 (literary): keep allegory, no PR number — «нрав выбрали, в строй не поставили» Prior-art: skipped — doc edit only, no new capability (book open-node status sync after #339 merge). * refactor(hooks): remove end-of-turn factual-claim detector — net-negative sentry, dropped by evidence (#342) The claim-scan (numeric / file:line / negative-existence → re-verify nudge) in end-of-turn-reminder.sh measured recall ≈0.43 + precision ≈0.20-0.25 (cry-wolf) in the instruction-compliance pilot (2026-05-21). A sentry that misses most real claims and false-fires on ~75% of what it catches is the #discipline-theatre the project hunts. Maintainer decision 2026-06-01: «не нужен раз не работает». Same class + outcome as the recommendation-laziness narrow-B stop-scan dropped at FP 84% (#210): drop on FP evidence, keep the always-on H1 reminder. Surfaces: - hook: remove claim-scan block + has_claims/claim_count refs in idle-guard, trigger, glance-line, Branch D, append block. Trigger = long_text||asked; branches A/B/C only. Recap + question-check survive. bash -n + shellcheck clean. - tests/hooks/eot-claim-scan.test.sh: deleted (185 LOC, all claim-scan) + CI step. - packages/core/hooks/end-of-turn-reminder.test.ts: drop Branch-D + code-fence precision cases, add paired-negative «short claim turn now silent». 13/13 green. - research-patch documenting the evidence-based removal (scope annotation, §1.7). - book epilogue ×3: the «искатель утверждений» debt closed by removal, not fix. A short factual-report turn with no question now stays silent (was Branch D) — the intended consequence; that nudge was the cry-wolf. Prior-art: skipped — removal of an own-built net-negative mechanism, no new capability (cites instruction-compliance-empirical pilot + narrow-b-benchmark #210 precedent in the research-patch). * feat(runtime-bridge): harvest — deterministic aif-task to PR egress leg (#343) aif-handoff ends a task at "committed on a local feature branch" with NO push and NO PR-creation in its autonomous (HANDOFF) path — verified 2026-06-01 against the running containers (zero PR-create / branch-push anywhere in its autonomous flow; its commit/push lives only in an LLM-driven /aif-commit runtime). So committed work strands inside aif's checkout, never reaching a reviewable PR on the trunk. harvest is the missing return leg. - src/harvest.ts: pure DI'd core harvestTask — guards (terminal status, branchName present) BEFORE any side-effect; ordered push then createPr then auto-merge, fail-fast (PR error never arms auto-merge). - src/cli/harvest.ts: real wiring — docker-exec push from aif's container (holds the commit + working creds), host PR-create against staging, native auto-merge; graceful printed manual-fallback if docker absent. - test/harvest.test.ts: paired-negative (non-terminal / no-branchName must NOT push or PR; PR-fail must NOT arm auto-merge). - aifHttp.ts: expose branchName on AifTaskFull (read back by harvest). Zero LLM by construction (plain git+gh+docker) — unlike aif's own commit flow which spends a paid claude -p query just to run git. Complies with no-paid-llm-in-ci.md. Prior-art: prior-art-evaluations.md#27/#28/#30/#67 — aif-handoff's own runtime (HANDOFF_MODE / paused / Planner-Implementer-Reviewer / Kanban) is the from-side this leg bridges, NOT an egress tool: verified it has zero push/PR in its autonomous path, which is exactly why harvest exists. No upstream harvest-autonomous-agent-branch-to-PR analog; thin deterministic glue over gh/git/docker, no PR-creation reimplemented. BFR verdict: BUILD (bridge egress leg). * feat(meta-orch): run-helper.sh completion-barrier wrapper (TDD, stage 1) (#344) Build .claude/skills/meta-orchestrator/helpers/run-helper.sh — a trivial bash exec-wrapper that runs a target helper as a child and ALWAYS appends a terminal END-trailer to stdout: === <helper-name>: END rc=<exit-code> (lines=<stdout-line-count>) === so a session reading a slow helper's stdout in the background can distinguish "finished (rc=N)" from "still running / crashed". The trailer is appended by the parent wrapper, so it fires even when the child exits non-zero or dies mid-output (a child-side `echo END` would be skipped on `set -e` abort / SIGKILL / timeout). Fixes the orchestrator reading a header-only partial file as "zero results". HARD CONSTRAINTS satisfied (§2): exit-propagation (capture rc first, exit rc last — trailer echo never clobbers child status); trailer-on-crash; stdout verbatim pass-through; `=== `-prefix kept so classify-each-candidate.sh:52 `awk '... && !/^=== /'` strips it (never a spurious candidate). TDD: paired-negative test at packages/core/skills/run-helper.test.ts (positive clean-exit + negative exit-1 + SIGKILL crash-mid-output + parse-safety) — 4/4 green. No regression: `git stash -u` A/B shows the 5 neighbouring helper tests produce an identical pre-existing 18-fail set (env-dependent gh/git harnesses) with and without this file. T-BGB-A: the END trailer proves the child FINISHED + its exit code, NOT semantic content-completeness — kept in test names/comments. Prior-art: prior-art-evaluations.md — escape hatch: trivial bash exec-wrapper, no upstream analog worth a dependency (BFR BUILD, pre-reasoned). Nearest SSOT neighbour #54 (Aider run_cmd runner) is a different problem-class — exit-code routing in a TS pre-push gate vs. appending a structural completion trailer for a background reader (T16: similar "runner" name, distinct capability). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bg-helper-completion-barrier-stage2-aif (#345) * feat(meta-orch): route bg-helper call-sites through run-helper.sh + Layer-1 read-rule (stage 2) Wire the two background-helper !-fences in meta-orchestrator/SKILL.md through the already-merged run-helper.sh completion-barrier wrapper: - §2 Step 1 priority-score.sh - §2.5 Step 2 dup-detect.sh + inflight-check.sh Add the Layer-1 read-rule prose after both fences: parse a slow helper's output only after its task-notification or the `=== <helper>: END rc=<n> ===` trailer; a header-only read means "still running", not "zero results". Origin: incident 2026-06-01 (priority-score.sh read at header-only state → false "zero candidates"). Helper code untouched; the 5 helper tests show identical baseline (18 failed / 34 passed both with and without this edit — failures are environmental, `gh` absent). Wrapped fences valid bash; classify-each-candidate.sh:52 still strips the `=== `-prefixed trailer. Prior-art: skipped — SKILL.md call-site wiring only, no new capability (routes existing helpers through the already-merged run-helper.sh wrapper from PR #344). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(meta-orch): SKILL.md back to 600 lines — fold read-rule into §2 Step 1 (DRY) aif's Stage 2 added two verbatim read-rule blockquotes (+4 lines), tipping SKILL.md from 598 to 604 over the 600-line mechanical-check cap (real CI fail on #345). Phase -1 reviewer fix: fold the read-rule once into the §2 Step 1 intro with 'applies to every background-helper fence below', drop the §2.5 duplicate. Both run-helper.sh wraps intact; read-rule discipline preserved, now DRY. Not a capability commit (markdown edit). Prior-art: skipped — markdown CI-fix (line-cap trim + DRY), no new capability. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(closure): bg-helper-completion-barrier done.md (final PR #345) (#347) Last-stage merge marker per CLAUDE.md umbrella-closure convention — priority-score.sh Layer C3 reads this for DONE detection. Prior-art: skipped — closure marker file, no new capability (convention bookkeeping). * feat(coordination): symlink-to-canonical cross-worktree sync (SSOT #110) (#346) Build scripts/link-coordination.sh (per-file symlinks, adopt-then-link, conflict-loud, seed on empty CANON), wire it into both worktree helpers replacing the J5 rsync block, add link-coordination.test.ts (7 tests: symlink, git-clean, conflict, write-back, paired-negative, adopt, seed), reconcile worktree-setup-hydration.test.ts (drop rsync NON-DESTRUCTIVE, retarget paired-negative regex to link-coordination.sh call, assert symlinks), append SSOT row #110. Umbrella count confirmed: 124 (kickoff said 123 — stale). Prior-art: prior-art-evaluations.md#110 (cross-worktree gitignored-SSOT sync via symlink-to-canonical, verdict ADAPT) + research-patch 2026-05-17-cross-worktree-coord-doc-sync.md §5 — I-phase implementation of the settled verdict. * docs(runtime-bridge): per-command CLI reference README (Option B) (#348) Operator-facing reference manual for the six runtime-bridge CLI commands (answer, await, dispatch, harvest, park, questions), one section each with Usage / Flags / Example, derived from each cli/<cmd>.ts header docblock. Resolves the parked README-structure fork → Option B (per-command reference). Markdown only, 285 lines (< 600-line cap), no code changes. Prior-art: skipped — documentation only, no new capability (operator-facing CLI reference derived from existing docblocks) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(discipline): surface genuine forks via AskUserQuestion (autonomous-default, human-gate on ambiguous only) (#349) Operating model (maintainer decision 2026-06-01): autonomous by default; the human-gate fires ONLY on a genuine ambiguous fork. A clear call is decided and reported, not routed through a question. - recommendation-laziness-discipline.md §3: fork-surfacing companion to the evidence rule — ambiguous forks MUST be surfaced via AskUserQuestion, never decided by a silent direct action; ask-question-reminder.sh is the discriminator; reworded 'default=surface' -> 'autonomous-default, surface only genuine forks'. - recommendation-laziness-discipline.md §5: new anti-pattern #fork-decided-by-silent-action (incident: PR #348 battle-test, an explicitly-50/50 README fork auto-decided by running answer.ts directly). Judgment rule -> injection-only enforcement, never a gate (#gate-where-judgment-needed). - end-of-turn-reminder.sh Branch-A: backstop reminder for the 'decided a fork silently' path (the inverse of the existing offload check). Hook tests 20/20 green. Origin: 2026-06-01 question-loop battle-test dialogue. §1.7: forward — complies with rule-enforcement-channel-selection (judgment->injection), no-paid-llm-in-ci (deterministic .sh + prose), doc-authority (no new heading); backward — new anti-pattern scope = any-session fork behaviour, no existing rule superseded (reviewer-discipline §2 is reviewer-scoped), enforced by two already-shipped hooks. * feat(hook): orchestration-mode aware reminders + brainstorm cue (qloop items 2+6) (#350) * docs(spec): hook-nudge orchestration-mode design (brainstorm item 2+6) Design for orchestration-mode-aware behaviour of the two reminder hooks: marker-gated Bug A fix (drop low-precision fork-regex in-mode) + recap threshold lowering (b) + brainstorm nudge in ask-question-reminder.sh. Normal mode stays byte-for-byte. Origin: 2026-06-01 qloop battle-test brainstorm. Prior-art: skipped — design doc only, no new capability (markdown spec under docs/superpowers/specs/, no dependency/code-module). * docs(plan): hook-nudge orchestration-mode implementation plan (item 2+6, TDD) Prior-art: skipped — planning doc only, no new capability. * docs(spec): add §3.4 aif-pull-channel brainstorm nudge (formatHuman footer) Recursive-self-application gap from maintainer dialogue: ALL aif-parked questions (not just I-ask-via-AUQ) must get the brainstorm-first nudge. Footer ships in item 4's questions.ts PR (file-locality). Prior-art: skipped — design doc only, no new capability. * feat(hook): orchestration-mode gating — drop fork-regex (Bug A) + lower recap threshold (recap-b) Marker .claude/orchestration-mode (mtime TTL); normal mode byte-for-byte. Bug A: decision-MENTIONS stop false-firing the fork-challenge in-mode (regex gated on orch_mode=false); real Qs (?/AUQ) still caught. recap-b: recap fires on short structured status in-mode (threshold 500->200) keeping the markdown gate so chatter stays silent. 7 new tests + 13 pre-existing green (20/20). Spec: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md. Prior-art: skipped — internal CC hook tuning, no new capability or dependency. * feat(hook): brainstorm cue in ask-question-reminder (item 6) Design/strategy forks -> superpowers:brainstorming, not a bare AUQ card. Always-on prose nudge (judgment -> injection, never a gate). 1 new test (8/8). Prior-art: skipped — internal CC hook tuning, no new capability or dependency. * fix(runtime-bridge): surface mid-flight park in questions.ts + brainstorm footer (qloop item 4) (#351) isParked gains the mid-flight-park case: a task whose blockedReason was wiped by implementing→review still surfaces via the durable conjunction (paused===true AND the plan carries the OPEN_QUESTION_ANCHOR). New shared constant openQuestion.ts is the single SSOT for that anchor (writer park.ts, reader questions.ts) so the wording cannot drift (dual-implementation-discipline #two-prompts-drift). formatHuman appends the §3.4 brainstorm-first footer on a non-empty parked list (aif-pull-channel companion to ask-question-reminder.sh §3.3); empty case unchanged. Reproduced from the verified container fix (branch feature/qloop-realfix-d7585d), host-side, per handoff item 4. Design SSOT: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md (§3.4). Prior-art: skipped — bug fix on existing CLI + 17-LOC shared constant, no new capability/dependency. * feat(runtime-bridge): commit aif rework leg in harvest (qloop item 3) (#352) aif commits only on its approve_done && commitOnApprove path; the request_changes→implementing→done rework path leaves the work uncommitted (dirty tree, branch == base HEAD), so harvest had nothing to push. Extend the egress: hasUncommittedChanges → commitAll (templated message, ZERO LLM) before push. No-op on the normal path (tree already clean). Commit failure is fail-fast — nothing pushed, operator gets the printed fallback. Real dep guards that the container checkout is on the task branch before committing. aif-handoff source untouched (foreign runtime, SSOT #27) — fix lives entirely on our egress leg, matching harvest's graceful-degradation design. Prior-art: skipped — extends existing harvest CLI, deterministic git only, no new capability/dependency. * fix(principles): isolate p13 fixtures to tmpdir (kills p10↔p13 race) + exempt qloop-ux-probe probe (p12) (#353) Two local pre-push false-blocks found by qloop-ux-probe (neither is a real violation): F1 — principle 13 wrote its synthetic + c3-decoration fixtures into the REAL docs/meta-factory/research-patches/ dir, then unlinked them. Under vitest's parallel file run, principle 10's readdirSync globbed the transient file and ENOENT'd when 13 deleted it → a cross-file race (10 alone = 5/5 pass; full run = flaky ENOENT). Fix: write the fixtures to os.tmpdir() — checkSection reads content only, PATCHES_DIR membership was never required. Verified race-free across 3 consecutive full-trio runs. F2 — principle 12 flagged the gitignored qloop-ux-probe kickoff (a 2-question resume *test fixture*, not a work-delegating orchestration kickoff) for no AI-traps citation, failing every local push. It already skips in CI (KICKOFFS_AVAILABLE false). Added to EXEMPT_LIST with documented rationale. Full principle suite: 157/157. * fix(runtime-bridge): park.ts resolves API_BASE_URL so agent can park from inside aif container (#354) park.ts is the only CLI run from inside the aif agent container, which exposes the service as API_BASE_URL=http://api:3009 and does NOT set RUNTIME_BRIDGE_AIF_URL. The old localhost-only default was unreachable there (connection refused) -> park() got 'fetch failed' -> the agent could not park itself, so park-don't-guess (SSOT #109, meta-orchestrator §4c) was non-functional on the real autonomous path. New precedence: RUNTIME_BRIDGE_AIF_URL ?? API_BASE_URL ?? http://localhost:3009. Host orchestrator (sets neither) still gets localhost; container gets api:3009. Found by qloop-ux-probe Часть 2 live dispatch (taskId 5e32fcb9): agent correctly surfaced-not-hacked the park failure, but the task slid implement->review->done at $3.17 having parked nothing. resolveAifBaseUrl() extracted + unit-tested incl. a negative guard proven to go red on regression. * fix(runtime-bridge): don't record dedup on ManualBackend fallback + add --force (Finding B) (#355) dispatch.ts recorded a dedup entry unconditionally after Step 4 — even when the real backend threw (e.g. dirty_worktree 409) and it fell back to ManualBackend. That manual entry (which created no autonomous task) then blocked a legitimate real retry for the full 24h TTL, with no escape. qloop-ux-probe hit exactly this: after fixing the dirty worktree, the re-dispatch was refused as "already dispatched (backend=manual)". Fix: - shouldRecordDedup(backendName): record only for a real backend success, never 'manual'. - --force: skip the dedup check to re-dispatch the same kickoff deliberately. - kickoff path resolved as the first non-flag arg, so --force may sit anywhere. Three pure helpers, unit-tested incl. a negative guard. Full runtime-bridge suite 102 pass. * fix(runtime-bridge): questions.ts recovers mid-flight-park question from plan anchor (Finding E) (#356) A mid-flight park (paused:true + OPEN_QUESTION_ANCHOR in plan, blockedReason wiped by implementing→review) surfaced in the list — but parkedReason() rendered "(no reason recorded)" because it only read blockedReason + reviewComments, never the question text park.ts appended under the plan anchor. So the chat channel showed "there is a question" with no idea WHAT it asks (qloop-ux-probe Finding E, task ccebe39a). Fix: extractOpenQuestion(plan) pulls the text after the last OPEN_QUESTION_ANCHOR line; parkedReason precedence is now blockedReason → plan OPEN QUESTION → reviewComments → "(no reason recorded)". Unit-tested incl. multi-anchor (last wins) + a negative guard. Full runtime-bridge suite 100 pass. * fix(runtime-bridge): park.ts probes reachable base URL — agent env scrubs API_BASE_URL (Finding C-2) (#357) Finding C (#354) made park.ts READ API_BASE_URL, but the qloop-ux-probe live re-run proved that insufficient: the aif agent runs park.ts in a Bash-tool subprocess whose env is SCRUBBED of API_BASE_URL (the container's PID-1 env has it; the agent's exec env does not). So resolveAifBaseUrl() still fell back to localhost:3009 → unreachable inside the container → "fetch failed" → the task slid to done at $3.45 without parking, exactly as before. Fix: resolveReachableBaseUrl() probes candidate URLs and uses the first reachable one — [RUNTIME_BRIDGE_AIF_URL?, API_BASE_URL?, http://api:3009 (docker service), http://localhost:3009 (host)], de-duplicated. Works from BOTH the agent container (api:3009) and the host orchestrator (localhost) even when no env survives. main() now awaits the probe. candidateBaseUrls + resolveReachableBaseUrl unit-tested (injected fetch) incl. a negative guard proving it skips an unreachable first candidate. Full runtime-bridge suite 117 pass. * feat(runtime-bridge): bridge-health.sh ($0 container-side preflight) + bridge-cleanup.sh (junk sweep) (#358) Operator pain: "каждую сессию приходится чинить" + "мусор постоянно остаётся". Both are structural — the recurring bugs live on the host↔container↔aif boundary that unit/CI can't cover (a full agent run costs LLM tokens, no-paid-llm-in-ci), so they were only found live MID-TASK; and probe/smoke runs leave orphan tasks + /tmp files behind. bridge-health.sh — $0 deterministic CONTAINER-side preflight (docker+curl+grep, no task, no tokens). Each check maps to a real qloop-ux-probe finding: container checkout clean (A), park.ts carries the resolveReachableBaseUrl probe (C-2), a park candidate URL is reachable from inside the container (C/C-2), dedup store has no stale manual entries (B). Run at session start → "bridge red, fix first" instead of discovering breakage live. Complements verify-bridge.sh (host-side dispatch smoke). Live-dogfooded — caught + fixed a false-positive in its own reachability check (000 connection-fail vs real HTTP status). bridge-cleanup.sh — one-command sweep of test/probe junk: aif tasks matching a test-title allowlist (UXPROBE/smoke/probe — real work never matched), old /tmp ManualBackend kickoffs + dedup backups. Reports a container stash, never drops it (operator's git). --dry-run. Prior-art: extends own verify-bridge.sh operator-smoke pattern (packages/runtime-bridge/scripts) — no external prior art applies; project-specific aif-bridge container diagnostic + test-task sweep, not a general capability with an upstream analog. * fix(runtime-bridge): self-cleaning junk producers — junk no longer accumulates (no manual/AI sweep) (#359) Operator: "придумать как быть с мусором — его не должен чистить каждый раз ИИ". A manual cleanup script is still "someone cleans each time". The real fix is that each producer cleans up after itself, automatically, with zero AI/manual involvement. idempotency.ts — recordDispatch was append-only (file grew forever; a stale manual-fallback entry blocked retries for the full TTL). Now it PRUNES-ON-WRITE: rewrites the log keeping only within-TTL entries + the new one. Self-bounding, and stale entries (incl. Finding B's manual fallback) auto-expire by age — no --force needed after TTL, no sweep. ManualBackend.ts — dispatch wrote /tmp/runtime-bridge-<id>.md on every fallback and never cleaned them (days of accumulation). Now each dispatch first prunes its OWN stale artefacts (runtime-bridge-*.md older than 7d). Scope-guarded: only matches our files, only when stale, best-effort (never throws into the dispatch path). Pure cores (pruneStaleEntries / parseEntries / isStaleArtifact) unit-tested incl. negative guards (stale entry must not survive; unrelated old .md must not be pruned). Full suite 126 pass. This complements (does not replace) bridge-health.sh; bridge-cleanup.sh stays as a rare manual "nuke everything" escape hatch, not the routine mechanism. * fix(runtime-bridge): park.ts refuses to park at status=review (Finding F guard) (#361) A park that happens AFTER the implement→review transition left the task status=review, paused=true. On resume, aif runs the review pipeline straight to `done` WITHOUT re-implementing the injected answer — and the next chain question is never parked (live: task ba3b4bf6 answered c1 → done, c2 silently lost). Root cause is upstream-intentional: aif's HUMAN_ACTIONS_BY_STATUS.review = [] (stateMachine.ts) — there is no human re-entry from `review` into implement. Option B (per 2026-06-01-aif-task-isolation.md §4, maintainer-selected): a cheap our-side guard. parkTask already GETs the task, so the status is in hand — refuse the park at status=review and throw a clear message (park before review, or wait for done and use answer.ts request_changes). Turns the silent loss into a loud, actionable error. Does NOT add mid-flight re-implement (Option C, deferred). Paired-negative test: GUARD refuses + issues NO PUT at status=review; CONTROL still parks normally at a pre-review status (plan_ready). 19→21 tests green. Prior-art: skipped — bug-fix guard on existing park capability, no new dependency or capability commit. * docs: R-phase research-patch — aif task-isolation (Findings A + F) (#360) * docs(runtime-bridge): R-phase research-patch — aif task-isolation Findings A + F Finding A (dirty_worktree recurs): verdict config-fix. Per-task worktrees are gated by a 3-condition AND in planner.ts:191-195 — env AIF_TASK_WORKTREES_ENABLED=true is only gate 1; gate 2 project.parallelEnabled (DB parallel_enabled, web-UI toggle) is 0 and was never set, so worktrees are never created and the shared checkout is reused in-place → dirties → next dispatch 409s. Fix: flip parallel_enabled (no restart). Finding F (mid-flight park resumes review->done, never re-implements): verdict aif-upstream-issue (intentional design) + our-side-guard. stateMachine.ts:106 HUMAN_ACTIONS_BY_STATUS.review=[] -> no human re-entry into implement; request_changes only from done. DECISION-NEEDED for I-phase: Option B (park.ts guard rejecting parks at status=review) vs Option C (auto request_changes loop, ~4h). R-phase only — no production code changed. Evidence: parallel_enabled=0 (live DB query), worktree_path null across 10 tasks, reflog >=6 in-place checkout cycles, planner 3-gate + stateMachine review:[] source-verified. Scope annotation (principle 10) + §1.7 (principle 13). * docs(runtime-bridge): record Finding F resolution — Option B selected + shipped (#361) §4.1 + §7.3: DECISION-NEEDED-F resolved 2026-06-01. Maintainer selected the hard-guard path (surfaced as "Option B"). Records the exact shipped behavior honestly: park rejects only at status=review (the §4.1 Option-A semantics, NOT the stricter implementing-only Option B) — pre-implement parks (plan_ready) stay legitimate. Cross-refs PR #361. Option C deferred. * feat(runtime-bridge): ensure-parallel guard — self-heal Finding A on any instance (#362) aif creates a per-task git worktree only when project.parallelEnabled=1 (gate 2 of 3 in planner.ts). That flag is a DB field with NO env/config.yaml knob — only the web UI or raw DB sets it — so a freshly-provisioned instance has it 0, every task runs in-place on the shared checkout, and the next dispatch 409s on dirty_worktree (research-patch 2026-06-01-aif-task-isolation.md §1-§2; the live config-fix applied to this instance does not propagate to other instances). ensureParallelEnabled(baseUrl, projectId): GET /projects → if parallelEnabled is already true, no-op; else PUT /projects/:id with parallelEnabled=true. Wired best-effort into AifHandoffBackend.dispatch() Step 0 (warns + proceeds on failure, never blocks dispatch) and shipped as a standalone CLI (--project / env). Anti-clobber (load-bearing): aif has no targeted parallelEnabled write (only PATCH /:id/auto-queue-mode), and the full PUT NULLs any omitted *MaxBudgetUsd (@aif/data updateProject: `x ?? null`). So the guard round-trips the FULL field set read back from GET — flipping ONLY parallelEnabled — to preserve a UI-set budget. Paired-negative test pins this: a set budget MUST survive the PUT. Cleaner long-term fix = an upstream PATCH /projects/:id/parallel-enabled mirroring the existing auto-queue-mode PATCH (file against lee-to/aif-handoff); this guard is the our-side stopgap. 6 new tests green; runtime-bridge typecheck clean. Prior-art: prior-art-evaluations.md#109 (park.ts BUILD — same class: thin our-side runtime-bridge consumer CLI over aif REST where no upstream targeted primitive exists; here parallelEnabled-reconcile, no upstream PATCH beyond auto-queue-mode; cleaner fix REFERENCEd to upstream, this is the stopgap). * coordination-persistence-fix (#363) * feat(coordination): link-coordination.sh --on-conflict=canon|worktree|skip (default skip) Adds --on-conflict flag with three modes resolving the real-file-in-both conflict deterministically: skip (default, exit 1, never clobber), canon (canonical wins, relink), worktree (worktree wins, adopt into CANON). Invalid values exit 2. TDD: 4 tests in link-coordination.test.ts. Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; arg-parse + branch logic only, no new file/dep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(coordination): link-coordination.sh shares root _plan-cache.md + _master-backlog-delta.json (Part-2, SSOT #110) Adds a ROOT-FILE adopt-then-link + link pair so the two root-level gitignored coordination files (_plan-cache.md, _master-backlog-delta.json) are shared across worktrees — previously unmatched because the loops only iterated umbrella subdirs */. Tracked root README.md untouched. TDD: 3 tests in link-coordination.test.ts. Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; mirrors existing umbrella adopt/link loops for root files. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(hooks): i18n reminder payload — en canonical / ru operator (+ principle-12 exempt hygiene) (#364) * feat(hooks): i18n — split reminder payload into lang packs (en canonical / ru operator) The two reminder hooks (ask-question-reminder, end-of-turn-reminder) emitted Russian payload prose inline. Splits logic from payload: hooks keep all logic and source a language pack (.claude/hooks/lang/{en,ru}.sh) selected by AIF_HOOK_LANG (default en — canonical, for the public repo). Operator sets AIF_HOOK_LANG=ru once globally in ~/.claude/settings.json. - lang/en.sh + lang/ru.sh: aif_msg_* functions (${anchor} resolved at call time via dynamic scope) + AIF_RECAP_MARKER (recap heading; guard and message read the same var so they stay language-consistent). - lang/check-parity.sh: deterministic, no-LLM guard against #two-prompts-drift — asserts both packs expose the same key set. Local/reviewer step, not a blocking gate (hooks are @cc-only, not shipped). - Tests run the existing cases under AIF_HOOK_LANG=ru (RU-pack contract; Russian transcripts + assertions unchanged) + add an en-pack smoke per hook. - RU payload byte-identical to before; EN is a faithful translation. Behaviour preserved (30/30 hook tests green). Out of scope (surfaced): Russian code comments in the two hooks; other 11 hooks; questions.ts strings. Spec: docs/superpowers/specs/2026-06-01-hook-lang-i18n-design.md Prior-art: skipped — i18n refactor of existing internal hooks, no new capability (string externalization to lang packs, no dependency, no packages/ code module) * test(principle-12): drop stale 'qloop-ux-probe' from EXEMPT_LIST The qloop-ux-probe question-loop fixture dir (gitignored, added to EXEMPT_LIST 2026-06-01 by Finding F2) is gone — the positive-guard test correctly flagged it as a stale exempt entry ("exempted but now absent"). Remove it per the test's own instruction; 'aif-ssot-corrections' remains the sole exempt entry. Surfaced while unblocking the hook-i18n PR's local pre-push (principle 12 runs on gitignored kickoffs locally, skips in CI). Maintainer-invited in-session. Prior-art: skipped — principle-test allowlist hygiene, no new capability (one stale entry removed from EXEMPT_LIST + doc comment) * fix(runtime-bridge): bridge-cleanup §4 prunes MERGED container git junk (#365) Enabling per-task worktrees (parallel_enabled, #362) makes aif RETAIN worktrees post-terminal (research-patch 2026-06-01-aif-task-isolation.md §2.1), and the old in-place task checkouts had already left 14 stale feature/* branches on the shared checkout. The session janitor (#358/#359) deliberately did NOT touch container git. §4 extends it to prune ONLY container git merged into origin/staging: git worktree prune + remove retained non-main worktrees on merged branches + delete merged feature/* branches. SAFE BY CONSTRUCTION — `git branch --merged` filtering AND `git branch -d` (refuses unmerged) double-guard; unmerged in-flight work is never touched. Also fixes the docker-exec stdin bug (needs -i for `sh -s` heredoc). Completes the #359 "no manual/AI sweep" principle for container git state. This is operator/co-located tooling (docker exec); the portable fix is upstream auto-removal of retained worktrees (worth filing against lee-to/aif-handoff). Live-verified on the real container: dry-run + real run deleted 7 merged branches and preserved all 6 unmerged (+ the checked-out one). No unit test — matches the 4 untested sibling janitor scripts; safety is by-construction + live paired-evidence. Prior-art: skipped — extends an existing janitor script (no new dependency, no new >=80 LOC file, not a capability commit); the parallel-worktree capability it cleans up after is #362/#109. * feat(audit-self): bash-hook mutation testing — bash.rules + run-bash-mutation.sh (universalmutator ADAPT, local/on-demand) (#366) Stage 2 B.2 of mutation-discipline-umbrella. ADAPTs universalmutator (MIT, deterministic regexp engine + analyze_mutants harness — no LLM) to mutation-test .claude/hooks/*.sh against their paired-negative vitest tests. The only project-authored artefacts are bash.rules (operators), a thin wrapper, and the wrapper's own paired-negative test. Delivery = session-bound / local on-demand (NOT CI), mirroring Stryker-as-devDep; the original kickoff B.3 CI job is dropped. universalmutator is a dev-time tool, never consumer-shipped. Dogfood gate (mandatory) surfaced real, undocumented test gaps: end-of-turn-reminder 52% / validate-prompt 56% (both below the 60% floor) — the &&/|| mutation of their suppress/skip conditions survives uncaught. Recursive bootstrap: the wrapper mutated by its own operators is killed 13/13 by its own test. Found + fixed a /*-in-comment regexp-engine limitation (bash globs in comments falsely trigger C-block-comment mode) via a line-count-preserving sanitiser. Evidence: docs/meta-factory/research-patches/2026-06-02-bash-mutator-b2-shipped.md Prior-art: prior-art-evaluations.md#91 (universalmutator ADAPT — engine ADOPTed verbatim, only bash.rules operators authored; problem-class ~85% match per B.1 §B.1.5; mutahunter REJECTed on no-paid-llm-in-ci §1). * feat(coordination): persistence-fix tail — SW-B symlink-aware helpers + G/B/C installer (#368) * docs(coordination): design — cross-worktree persistence fix (4-channel: git-hook agnostic floor + CC + Superset + skill) Brainstorm output for coordination-persistence-fix umbrella. T16 corrections: - channel C substrate = Superset projects/<uuid>/config.json setup-array (rsync = root cause), NOT ~/.superset/hooks/ - adds git post-checkout (.husky) as the harness-agnostic floor per maintainer 'works everywhere' requirement - Q3 atomicity already satisfied (mktemp+mv verified); SSOT #110 same anchor Prior-art: skipped — design doc only, no new capability (extends link-coordination.sh SSOT #110). * docs(coordination): correct §2.4 — helpers atomic but NOT symlink-preserving (mv replaces symlink) Planning-phase finding (verified empirically): mv tmp <symlink> replaces the symlink with a real file → Part-2 cross-worktree share lost on first cache write. SW-B upgraded from 'confirm test' to 'make 3 helpers symlink-aware (write-through resolved target)'. Atomicity preserved (temp+mv in target dir), symlink preserved. Prior-art: skipped — design doc correction only, no new capability. * docs(coordination): implementation plan — 4 sub-waves (A linker / B symlink-aware helpers / C wiring / D self-apply) Prior-art: skipped — plan doc only, no new capability (implements SSOT #110 extension). * feat(coordination): one-click install-coordination-wiring.sh (G+B+C, idempotent, self-test) Applies all 3 wiring channels in one terminal command (maintainer runs from central repo): G .husky/post-checkout (agnostic floor) B .claude/settings.json SessionStart C ~/.superset/projects/*/config.json setup (replaces rsync root-cause) --self-test (sandbox) + --dry-run modes; idempotent re-runs. Replaces the manual runbook. Prior-art: skipped — scripts/ helper, not a capability commit (no dep, not under packages/); wires existing link-coordination.sh SSOT #110. * fix(coordination): 3 cache/delta helpers symlink-aware (SW-B) resolve_target() follows a symlink to its real $CANON target so the atomic temp-then-mv write writes THROUGH the link instead of replacing it. Without this, the first cache/delta write breaks the cross-worktree share (mv tmp <symlink> → real file). +3 paired-negative tests (symlink preserved + canon written through); 18/18 green. Done locally (not via aif — container serialized on doc-audit task). Prior-art: skipped — symlink-preservation fix to existing helpers, no new capability; extends link-coordination.sh SSOT #110 share semantics. * docs(coordination): drop channel A (skill self-heal) — redundant after G git-hook B (CC SessionStart) fires at every session start ⊇ 'when meta-orchestrator runs', and G (git post-checkout) is the real agnostic floor A was standing in for. Final channel set = G + B + C, wired via install-coordination-wiring.sh. Prior-art: skipped — design doc scope-reduction, no new capability. * fix(runtime-bridge): bridge-cleanup §4 skips while aif has live tasks (no ref-lock contention) (#367) §4 (container git prune, #365) runs git fetch / worktree prune / branch -d in the SHARED .git. A task running concurrently touches the same ref + packed-refs locks (amplified by parallel_enabled keeping multiple tasks active) → a collision yields "cannot lock ref" and can fail the live task's git step. Guard: GET /tasks, count non-terminal (not done/verified/cancelled); if >0, skip §4 with a clear note ("re-run when idle"). Deterministic, no AI. Fail-open (count unknown → 0 → proceed) — §4 is already merged-only safe-by-construction, so this is defence-in- depth; worst case of a false 0 is a transient lock retry, never corruption or data loss. Live-verified: with 2 non-terminal tasks running, `--dry-run` §4 printed "skipped — 2 live". Prior-art: skipped — edits an existing janitor script (no new dependency, no new file, not a capability commit); guards the #365 sweep against the #362 parallel_enabled concurrency window. * feat(coordination): commit channels G + B (post-checkout + CC SessionStart) (#369) Makes the two machine-agnostic wiring channels durable + shared (were applied locally by install-coordination-wiring.sh). Both call link-coordination.sh (SSOT #110): G .husky/post-checkout — agnostic floor, fires on git worktree add B .claude/settings.json — CC SessionStart re-heal Channel C (Superset setup-array, per-UUID) stays installer-only. SW-D liveness: G verified live — fresh worktree auto-linked 287 files. Prior-art: skipped — wiring of existing link-coordination.sh SSOT #110 into hook channels, no new capability. * docs(research-patches): doc-audit-ship-boundary Stage 2 findings + gitignore stryker sandbox (#371) Autonomous aif audit (task bcb2c6c2): full doc-vs-reality + vs-goal reconciliation, Stage 2.0 mutation-run fuel, DECISION-NEEDED batch (DN-1..4), §A self-classification. Audit-only — no maintainer-owned edits landed. Also gitignore packages/core/.stryker-tmp/ so mutation runs never pollute the tree (root cause of PR #370 contamination). * test(hooks): close mutation gaps in end-of-turn-reminder + validate-prompt (B.2 dogfood follow-up) (#373) The Stage 2 B.2 bash mutator (#366) surfaced two hook tests below the 60% kill floor: end-of-turn-reminder (52%) and validate-prompt (56%). Add targeted cases that kill every NON-equivalent surviving mutant: - end-of-turn-reminder 52% → 69%: cover the previously-untested idle-suppress re-ping guard (hook:135-156) — suppress-on-reping, fire-on-new-question, long-answer-overrides-suppress, the B2 "an AskUserQuestion turn is never idle-suppressed" contract — and the bare non-question tool-call early exit (hook:53-54). The 10 residual survivors are equivalent mutants: 7× `|| true` → `&& true` inside `$(…)` command-substitutions (stdout unchanged, exit ignored under set -uo, no -e), the transcript-validity guard (both paths exit 0/empty for the only diverging input), `set -e`→`set +e` (hook never relies on errexit aborting), and the inner re-ping AND→OR (divergence requires prev==last+recap, which trips the self-recap guard first). All 22 killable mutants are killed. - validate-prompt 56% → 78%: deterministically exercise the tsx-unavailable graceful-skip (hook:26-27, isolated-root copy) and the jq-unavailable graceful-skip (hook:14-16, fake-bin PATH without jq). The 2 residual survivors are gh+validator-coupled (hook:21 off-path-proceeds-to-validator, hook:33 validator-result) — killable only with a live-gh 404 test, which is non-hermetic; left per T-MUT-B rather than shipping a flaky test. Test-only; no production hook modified. Follow-up to #366 (mutation-discipline-umbrella Stage 2 B.2). * docs(doc-audit): apply DN-1/2/4 doc-staleness fixes + ship the fixer tooling (#374) doc-audit-ship-boundary Stage 2 — maintainer decisions 2026-06-02, applied. Applied (maintainer-directed, DN-1/2/4): - .claude/rules/rule-enforcement-channel-selection.md: 'Activation pending' → 'Activation confirmed — settings.json:114' (Class header + §4 prose); the PostToolUse Edit|Write hook is wired (verified settings.json:114). - README.md badges: ?branch=main → ?branch=staging (main=prod, CI runs on staging). - README.md enforcement chain: drop false 'Stryker' from the CI channel — mutation tests are local/session-bound, NOT a CI gate (no workflow runs Stryker). Tooling shipped alongside: - scripts/apply-doc-fixes.sh: idempotent, terminal-runnable fixer (re-applies the above; --check dry-run). packages/core/hooks/apply-doc-fixes.test.ts: 5 green. - docs/meta-factory/mutation-run-placement.md: DN-4 placement note (mutation local; ps/jq/universalmutator reqs). Prior-art: skipped — maintainer-directed doc-staleness fixes + their fixer tool + a placement note; no new runtime capability, no dependency, no packages/ code module. * test(principle-12): raise population-sentinel bounds 10..100 → 100..300 (#375) The principle-12 population sentinel capped local kickoff dirs at 100. The project legitimately accumulated >100 umbrellas of history, mirrored locally by the coordination-persistence channel (G, .husky/post-checkout → link-coordination.sh), so the ≤100 guess tripped the pre-push on every worktree. Raise to ≤300 (still catches a runaway glob) and ≥100 (doubles as a 'mirror present' guard). The sentinel is skipped in CI (KICKOFFS_AVAILABLE) — it only gates local pre-push. Maintainer-directed 2026-06-02. Does NOT resolve the separate citation-check vs symlink-mirror interaction (the broader principle-12-vs-G item) — bound only. Prior-art: skipped — adjusts a sentinel bound in an existing principle test to match reality; no new capability, no dependency, no new module. * test(principle-12): citation check ignores coordination-mirror kickoffs (#376) Citation check re-ran on every umbrella mirrored in by channel G (post-checkout → link-coordination.sh symlinks gitignored kickoff.md into $CANON), failing on historical umbrellas this worktree never authored (principle-12-vs-G). Fix: check only REAL (non-symlink) kickoff.md = locally authored. Population sentinel still counts the FULL set as a mirror-present guard. Pairs with #375 (bound→100..300). Prior-art: skipped — narrows an existing principle-test filter to exclude symlink mirrors; no new capability, no dependency. * docs(spec): aif parallel autonomous dispatch — verified model + open test (brainstorm 2026-06-02) (#377) Captures the full session conclusions so they survive: the depth-2 architecture insight (subagents don't spawn subagents → quality parallel needs separate top-level sessions, meta- orchestrator decides), the verified aif model (1 kickoff/meta-launch → 1 task; each task = top- level session; flat task model; two parallelism layers L1 cross-task worktrees / L2 within-task use_subagents→implement-coordinator; use_subagents=0 everywhere = why never parallelized; worktree-skip is documented per docs/configuration.md), the observable test signal (agent_activity_log 'Subagent: <name> started', subagentQuery.ts:793), the decision tree, the OPEN question gated on one live test (use_subagents top-level launch), an honest flip-flop corrections log, and decisions (planner-owns-plan, COORDINATOR_MAX knob, park preserved). NOT a final spec — gated on the §5 live test on a genuinely-parallel task (D.1-D.5). * chore(harvest): commit reworked aif task 5767f7df-7425-4a78-a76f-98402c1647d0 — mutation-discipline-stage-c-meta-launch (#378) * docs(spec): aif parallel dispatch §5 RESOLVED — YES via use_subagents (live proof) + M3-bash timeout fix (#380) * docs(spec): aif parallel dispatch §5 RESOLVED — YES, self-parallelizes via use_subagents (live 2026-06-02) Live test (task a37ee2f5): use_subagents=true on a real 5-task plan (mutation Stage 4 D.1-D.5) → implement-coordinator launched top-level (--agent) → fanned out 5 concurrent implement-worker subagents, each worktree-isolated. Proof: 5x `Tool: Agent {subagent_type:implement-worker}` spawns + git worktree list 1→6 (5 locked worker worktrees coexisting, ~2min all-5 overlap) + 5 distinct real test files written simultaneously. Also corrects §3.7 observable: `Subagent:` log line is SDK-transport-only (onSubagentStart wired only via SDK SubagentStart hook); on transport=cli it stays 0 even under full parallelism — a false-negative trap. Valid CLI-transport observables = git worktree growth + `Tool: Agent` activity entries. Design consequence = the tiny change: bridge sets use_subagents=true at dispatch for depth-2-sufficient umbrellas + meta-orchestrator emits plan-structured kickoffs (independent numbered Task items, no Phase headings). Prior-art: skipped — design-doc update only, no new capability/dependency/code-module. * test(principle-02): give M3-bash mutation gate a 60s timeout (was default 5000ms) The [M3-bash] local/on-demand gate (describe.skipIf(!HAS_UM)) calls runBashMutator → spawns `npx vitest` once per mutant, ~9.5s on a loaded host. The default 5000ms vitest timeout false-fails it at pre-push (blocking unrelated pushes; observed this session). Add an explicit 60_000ms timeout — mirrors the Stryker precedent (principle 11 testTimeout 5s→30s). No assertion/semantics change; CI still skips it (no universalmutator). Prior-art: skipped — test-timeout fix for an existing gate, no new capability/dependency. * test(mutation-discipline-stage-d): paired-negative tests for 5 remaining .sh helpers (#381) Stage 4 D of the mutation-discipline umbrella — content-level paired-negative vitest tests (M.4 pattern) for the .sh files that lacked them: - priority-score.sh → priority-score-synthetic.test.ts (20 it, 53 expect) - plan-currency-check.sh → plan-currency-check-kickoff.test.ts ( 6 it, kickoff-existence angle; non-redundant w/ existing) - launch-table-generator.sh→ launch-table-generator.test.ts (11 it) - check-skill-drift.sh → check-skill-drift.test.ts ( 6 it) - pre-push.fallback.sh → pre-push.fallback.test.ts (20 it) Produced by the aif self-parallel-dispatch live test (5 concurrent implement-workers, use_subagents=true) and verified by an independent 5-way adversarial cold-review (T19): all real-script-invoked (spawnSync bash on the actual .sh), content-level assertions (exit code + stdout/stderr, no shape-only .toBeDefined), anti-tautology confirmed. Fixed one over-reaching T12-compliance comment in priority-score (claimed 8 surfaces verified; only 5 are — now honest + deferred-gap note). Known deferred coverage gaps (honestly disclosed, follow-up): launch-table fallback+no-keyword path; pre-push 2 of 3 discipline-file patterns; priority-score surfaces (c)/(d)/(h). 52/52 tests green. Prior-art: skipped — test additions for existing .sh capabilities, no new runtime capability/dependency. * research(mutation-discipline-d6): verdict on deps-hash-check.sh duplication (#382) D.6 R-phase (mutation-discipline umbrella). Investigates the two byte-identical deps-hash-check.sh copies. Verified roles (T3, file:line): packages/core/hooks/ = shipped SOURCE (install.sh:261), .claude/hooks/ = this repo's DOGFOOD copy (settings.json:74). Key finding: deps-hash-check.test.ts:34 tests the DOGFOOD copy, not source → silent drift possible (test stays green if source diverges). Verdict (b) keep-both + drift-check: add @dual-pair markers + a byte-identity assertion test — REUSE the existing dual-implementation @dual-pair convention (SSOT #87) rather than BUILD. Symlink (a) rejected (install.sh --force regression + Windows). Concrete I-phase fix path + falsifiers included. R-phase only — no edits to the .sh files / settings.json / install.sh. Produced autonomously by aif (use_subagents=0, single R-phase task) + cold-reviewed. Prior-art: skipped — research-patch (markdown), no new capability/dependency/code. * fix(hooks): drift-check for deps-hash-check.sh source/dogfood pair (D.6 I-phase) (#383) Implements #382 §6 verdict (b) keep-both + drift-check. Adds @dual-pair: deps-hash-check-dogfood markers (identical block, preserving byte-identity) to both the shipped SOURCE (packages/core/hooks/) and this repo's DOGFOOD copy (.claude/hooks/), plus a byte-identity assertion in deps-hash-check.test.ts. Closes the silent-drift hole the D.6 R-phase confirmed: the functional tests exercise only the dogfood copy (HOOK), so they stayed green even if the source diverged. Falsifier verified — breaking one copy turns the new test red. Corrected #382 §6's asymmetric-marker spec (4-line block to dogfood vs 1-line to source), which would itself have broken the byte-identity the test asserts; both copies carry the identical block. Last residual of the mutation-discipline umbrella; closure (done.md + memory) follows on merge. Prior-art: prior-art-evaluations.md#87 (worktree-create-setup dual-pair, SSOT BUILD — this commit extends the @dual-pair pattern with a second pair; no new mechanism introduced). * docs: R-phase — why per-task worktrees never materialize (corrects #360 Finding A) (#372) * docs(runtime-bridge): R-phase — why per-task worktrees never materialize (corrects #360 Finding A) Live falsifier of #360 Finding A: 0 tasks ever got a worktree despite parallel_enabled=1. Root cause (verified source, correct containers): the bridge dispatches via a planner-SKIP — POST /tasks/:id/events {event:'accept_existing_plan'} — which transitions backlog→plan_ready SKIPPING the `planning` status (stateMachine.ts case accept_existing_plan, api container). The coordinator runs runPlanner ONLY for the planning stage (coordinator.ts PIPELINE from:["planning"], agent container). The ONLY worktree-creation code lives in runPlanner (planner.ts:191-213). ⇒ bridge tasks never run the planner → never create a worktree, regardless of parallel_enabled / AIF_TASK_WORKTREES_ENABLED / plannerMode. Secondary: handleAcceptExistingPlan also persists branchName (taskEvents.ts:236+) so even if the planner ran, planner branch-2 (in-place restore) would pre-empt branch-3 (worktree). Verdict: parallel_enabled=1 (#360/#362) is NECESSARY BUT NOT SUFFICIENT. Fix options: B = drop accept_existing_plan from bridge dispatch + let the coordinator run the planner; C = accept serial in-place as the operating mode with the existing rollback guard. Both deferred to a follow-up I-phase (DECISION-NEEDED). gate-3 passes; mode-change is NOT the fix (server already forces full). Effort + falsifier per finding in the patch. R-phase only — no production code changed. DeepWiki x3 (converged) + verified file:line in both aif containers. Scope annotation (principle 10) + §1.7 (principle 13). * docs(runtime-bridge): §0.1 — worktree-skip is DOCUMENTED aif behaviour (docs/configuration.md), not a trap; no upstream issue DeepWiki x3 (converged): docs/configuration.md ties worktree creation to full-mode planning by design; docs/architecture.md documents the serial-forcing. So planner-skip forgoing the worktree is a documented consequence, not a defect — no upstream issue. Records the search-coverage lesson: the #360 verdict was avoidable by reading aif's own config docs. The corrected fix (run the planner) is the documented isolation+parallel path. * docs(wave-plan): reconcile §0 → 2026-06-02 (#298→#382) + codify how §0 stays current (#384) Manual status reconciliation per the design loop (detect via /meta-orchestrator, write by human-directed session — Direction A auto-write rejected at R-phase). - §0 + Status dates 2026-05-29 → 2026-06-02 - correct misleading aif-handoff DEFER-ALL row: add `runtime-bridge BUILD` row (minimal-REST bridge shipped #312/#313 + ecosystem; supersedes-in-practice) - +8 umbrella rows for work merged since last reconcile (runtime-bridge, aif task-isolation, companion adoption, coordination-persistence, qloop, mutation-discipline, worktree dual-channel, doc-audit-ship-boundary) - add "Open frontier" block (live: #372 open, inject-layer-extension, one-click-installer, f2-aif-fire-backend) — distinct from ~80 closed candidates - add "How §0 stays current (by design)" note to Status block so future sessions don't try to automate the deliberately-manual reconciliation Prior-art: skipped — doc-only status reconciliation of an existing planning doc, no new capability or dependency introduced. * chore(orchestrator): mark mutation-discipline-umbrella DONE (#385) Umbrella closure per CLAUDE.md "Umbrella closure convention" — Final PR #383 (D.6 drift-check, last residual) merged to staging. All stages shipped: A audit #219 / B bash-mutator #366+#373 (dogfood gate fired) / C tests-of-tests #378 / D #381 + D.6 dup R-phase #382 + D.6 drift-check I-phase #383. done.md is the priority-score.sh Layer C3 completion marker (gitignore:14 un-ignores */done.md). Prior-art: skipped — completion marker (done.md), no new capability/dependency/code. * fix(principle-12): skip anti-tautology mutation test when no real (non-mirror) kickoffs exist (#386) The anti-tautology sub-test mutates a REAL compliant kickoff to verify the compound-citation detector actually catches absence. After the coordination symlink migration (#346 + post-checkout link-coordination.sh), every local kickoff.md is a SYMLINK into $CANON — a coordination mirror that getNonExemptEntries() deliberately excludes (isCoordinationMirror). With all kickoffs mirrored, getNonExemptEntries() is empty → `compliant` is undefined → `expect(compliant).toBeDefined()` failed on every host push (reproduced on staging HEAD, independent of any feature branch). The #376 mirror-exclusion fix updated the main check + population sentinel but missed this meta-test. Guard it with HAS_REAL_NONEXEMPT_KICKOFF: when there is no real kickoff to mutate, skip — detector correctness is already covered by the pure-logic anti-tautology tests (blank file / each pattern), which need no files. Unblocks all host pushes (pre-push runs the principle suite). No behaviour change to the citation enforcement itself. * fix(runtime-bridge): dispatch via planner-run so each task gets its own worktree (parallel) (#387) The bridge dispatched tasks with `accept_existing_plan`, which transitions backlog -> plan_ready SKIPPING the `planning` stage. runPlanner (planner.ts, the ONLY code that creates a per-task git worktree) runs only at `planning`, so 0 tasks ever got a worktree -> all dispatched tasks forced serial. Verified + live-proven in #372 (research-patches/2026-06-02-aif-worktree-gap.md). Fix (Option B, live-verified 2026-06-03): - Drop the `accept_existing_plan` event. The task stays at `backlog`; the auto-queue advances it through `planning` -> runPlanner -> per-task worktree. - Carry the kickoff in `description` (the planner INPUT spec, planner.ts:246), NOT in `plan` (the planner OUTPUT slot @planPath, which it overwrites). The planner plans the *how* from our kickoff *what*. Live acceptance: two tasks dispatched concurrently each got a DISTINCT worktree and both ran in `planning` simultaneously (N agents x N workspaces, not within-task subagents). Throwaway probe tasks + worktrees cleaned up. Tests: rewrote the dispatch sequence test for the 2-step flow (asserts description=kickoff, no accept_existing_plan, no plan push) and moved the rollback test's failure point to the unpause step. 8/8 green. Prior-art: skipped — modifies existing bridge file, no new capability/dependency/module. * research(aif-operator-asset-access): R-phase — gap verification + A-E verdict + recommended composition (#388) Five gap rows re-confirmed with file:line evidence. Existing skill-context/ and agents/*.md mechanisms audited (T16 problem-class check) — none cover orchestrator/reviewer discipline. Recommended composition: B+D (in-repo agnostic worker discipline, primary) + A (operator bind-mount, immediate) + C (buildKickoffSpec sibling inlining, follow-on). E rejected. DN-1/2/3 surfaced; DN-1/2 resolved inline (B scope = minimum viable worker discipline; reviewer-discipline = separate concern covered by review-sidecar.md). Prior-art: prior-art-evaluations.md#67 (aif-handoff, ADOPT — this umbrella extends it with operator-asset bridging); prior-art-evaluations.md#50 (skill-context/aif-review SSOT, ADOPT channel — D reuses this delivery pattern). * fix(meta-orchestrator): Stage 2 correctness — C1.1/C1.2/C1.3/M4/F2/F7 (#389) Six confirmed bugs fixed in the meta-orchestrator skill: C1.3 — SKILL.md:449: stale repo-root mirror claim removed; replaced with "Ships directly from .claude/skills/meta-orchestrator/ via install.sh (single source of truth; no repo-root mirror — Item 12 closure 2026-05-25). Install pattern at install.sh:236-255." C1.2 — SKILL.md:508: state.md section names corrected from stale "§2 Launch-table / §3 Dispatch log" to actual template names "§2 Decisions / §3 Phase -1 verdict" (state.md.template:26,35). C1.1 — master-backlog-delta.md:49-52: "Body owns arrays — inline-jq" claim removed (inline jq was removed in F.3 PR #261 2026-05-28); delta-write-from-state.sh correctly attributed as array owner. M4 — SKILL.md:521-525: delta two-helper ordering fixed. update-delta.sh (bootstraps schema) now listed first, matching delta-write-from-state.sh:19. F2 — SKILL.md:71: head -200 raised to head -400; wave-sequencing-plan.md is 293 lines so head -200 dropped 93 lines incl. §6 dependency-matrix. F7 — run-helper.sh:26: timeout wrapped (MO_HELPER_TIMEOUT env, default 120s); END trailer still fires on expiry (rc=124). failures.md: F9 added. Prior-art: skipped — correctness fixes to existing prose/helper, no new capability Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(aif-worker-discipline): portable worker discipline agent + AIF skill-context delivery (#390) * feat(aif-worker-discipline): portable worker discipline agent + AIF skill-context delivery Artifacts 1 (B) and 2 (D) from aif-operator-asset-access I-phase. - agents/orchestrator-worker-discipline.md: portable AI-agnostic worker discipline (REPORT schema, park-vs-proceed, stage-gate, §1.7 PR body) for aif-dispatched workers. Class B. @dual-pair: aif-orchestrator-discipline. - packages/core/templates/shared/skill-context/aif-orchestrator-discipline/SKILL.md: AIF-native delivery of the same content. YAML from aif-review/SKILL.md (SSOT #50). @dual-pair + spec: per dual-implementation-discipline.md §5. - packages/core/principles/09-doc-authority-hierarchy.ts: added aif-orchestrator-discipline/SKILL.md to REQUIRED_HEADER_DOCS (shippedSubset 16→17). Upper sentinel 60→65; Wave-4 length sentinel 16→17. - install.sh: aif-orchestrator-discipline/SKILL.md added to SHIPPED_DOCS. §1.7: forward — agents/orchestrator-worker-discipline.md:9 authority header per doc-authority-hierarchy.md §3; install.sh:103 in sync with REQUIRED_HEADER_DOCS per 09-doc-authority-hierarchy.test.ts:164 Wave 4 invariant. backward — SKILL.md:10-11 carries @dual-pair + spec: per dual-implementation-discipline.md §7. Prior-art: prior-art-evaluations.md#50 (skill-context/aif-review, ADOPT channel pattern). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(runtime-bridge): add operator convenience bind-mount section for global skills Adds '## Operator convenience: mount global skills' section at the end of docs/runtime-bridge-setup.md documenting how to bind-mount operator-side global skills (~/.claude/skills/orchestrator/, Superpowers plugins) into the aif container via docker-compose.override.yml. Operator-axis only — consumers of the shipped framework are NOT required to have these paths. The shipped in-repo discipline works without the mount. Artifact 3 (A-docs) from aif-operator-asset-access I-phase. Prior-art: skipped — doc addition, no new capability Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(meta-orchestrator): add harvest egress step to autonomous dispatch loop (#391) aif does NOT push or open PRs by design (documented in harvest.ts:11-14). Nothing in the dispatch loop said "after status=done → call harvest" — this was the gap that caused the aif-operator-asset-access I-phase to sit stuck in the container with work done but no PR opened (incident 2026-06-03). Fix: add egress gate to SKILL.md §5 autonomous dispatch row and to meta-kickoff.template.md §4c so every generated kickoff carries the harvest call as a mandatory post-done step. Anti-pattern #autonomous-done-no-harvest added to SKILL.md §5. Prior-art: skipped — doc-only change to .claude/skills/ and templates/, no new capability (refactor only, harvest.ts already shipped). * chore(orchestrator): mark aif-operator-asset-access DONE (#392) * docs(meta-orchestrato…

* Promote staging → main — consumer-install-hardening + guard-liveness + runtime-bridge (134 commits) (#488) * feat(hooks): SubagentStop REPORT-schema WARN (non-blocking, #108 candidate-3) (#339) Ship .claude/hooks/warn-subagent-report.sh — scans the finishing subagent's output for canonical REPORT sections (VERIFY, Confidence, ATTN); emits a ⚠ stderr warning + exit 0 (non-blocking) when any are missing. Maintainer chose WARN over block (exit 2) — judgment target, not gateable (#gate-where-judgment-needed, rule-enforcement-channel-selection.md §1). Contract verified DUAL-CHANNEL 2026-06-01: Channel 1 — WebFetch code.claude.com/docs/en/hooks: SubagentStop fields include agent_type; exit 0 = non-blocking; stderr shown to user. Channel 2 — DeepWiki anthropics/claude-code: agent_transcript_path + last_assistant_message (since CC 2.1.47) confirmed by name + quoted. Two read paths (B1 — scan-nothing trap avoidance): 1. last_assistant_message if non-empty. 2. agent_transcript_path JSONL, reusing end-of-turn-reminder.sh:30-41. Noise guard: skip Explore agent_type + require standalone REPORT-cue label. Paired test: 6 cases (positive-A/B + negative + negative-2 Explore + non-report prose + exit-code invariant). All 6 green. Pre-existing staging failures (pre-push.test.ts + plan-currency-check.test.ts) unaffected. settings.json wiring snippet in PR body (maintainer lands, not committed). Prior-art: prior-art-evaluations.md#108 (SubagentStop REPORT-schema gate — candidate-3 of #108, shipped as WARN per maintainer decision 2026-06-01; block dropped — judgment target, #gate-where-judgment-needed). * docs(research-patches): satellite-feature-harvest — own-stack-first harvest + reverse-sweep (form B) (#328) Own-stack-first sweep: Claude Code natively ships the remote/scheduled/parallel-session cluster (Remote Control, Routines, Channels, agent-view, Slack) that prior SSOT rows credited to companions. 15 capability clusters triaged → 4 adopt-now (Remote Control, Routines via /schedule, Channels(Telegram), background agent-view) + 3 defer + 8 skip. Reverse sweep: 4 criterion-zero relationships, no shipped artefact retired (T-SFH-D — runtime-bridge questions.ts kept; Channels is session-open-only). +1 SSOT row #100. Prior-art: skipped — research-patch only, no new capability (the BFR own-stack-first survey is the patch content itself). * chore(hooks): wire pending CC hooks in settings.json (SubagentStart/Stop + runtime-bridge) (#340) Activates three already-merged, already-committed hook scripts that were running locally but never wired in the shared config: - PostToolUse Write|Edit|MultiEdit -> runtime-bridge-dispatch.sh (#313) - SubagentStart -> inject-subagent-digest.sh (#108 companion-adoption-iphase) - SubagentStop -> warn-subagent-report.sh (#108 candidate-3, #339) All hook scripts already exist in staging; this only activates them. Config-only wiring, not a capability commit. * docs(book): SubagentStop block-vs-warn — flip open-node DECISION-NEEDED → решён=WARN (#339) (#341) #339 (SubagentStop REPORT-schema WARN, non-blocking) merged to staging as 0596a64 — the block-vs-warn decision is resolved in favour of WARN. Hook remains INERT (no SubagentStop in settings.json) until the maintainer lands the snippet, so the node stays half-open: decided, not yet wired. - v1 (technical): chapter XXII + epilogue June-1 open-nodes list — cite #339 - v2/v3 (literary): keep allegory, no PR number — «нрав выбрали, в строй не поставили» Prior-art: skipped — doc edit only, no new capability (book open-node status sync after #339 merge). * refactor(hooks): remove end-of-turn factual-claim detector — net-negative sentry, dropped by evidence (#342) The claim-scan (numeric / file:line / negative-existence → re-verify nudge) in end-of-turn-reminder.sh measured recall ≈0.43 + precision ≈0.20-0.25 (cry-wolf) in the instruction-compliance pilot (2026-05-21). A sentry that misses most real claims and false-fires on ~75% of what it catches is the #discipline-theatre the project hunts. Maintainer decision 2026-06-01: «не нужен раз не работает». Same class + outcome as the recommendation-laziness narrow-B stop-scan dropped at FP 84% (#210): drop on FP evidence, keep the always-on H1 reminder. Surfaces: - hook: remove claim-scan block + has_claims/claim_count refs in idle-guard, trigger, glance-line, Branch D, append block. Trigger = long_text||asked; branches A/B/C only. Recap + question-check survive. bash -n + shellcheck clean. - tests/hooks/eot-claim-scan.test.sh: deleted (185 LOC, all claim-scan) + CI step. - packages/core/hooks/end-of-turn-reminder.test.ts: drop Branch-D + code-fence precision cases, add paired-negative «short claim turn now silent». 13/13 green. - research-patch documenting the evidence-based removal (scope annotation, §1.7). - book epilogue ×3: the «искатель утверждений» debt closed by removal, not fix. A short factual-report turn with no question now stays silent (was Branch D) — the intended consequence; that nudge was the cry-wolf. Prior-art: skipped — removal of an own-built net-negative mechanism, no new capability (cites instruction-compliance-empirical pilot + narrow-b-benchmark #210 precedent in the research-patch). * feat(runtime-bridge): harvest — deterministic aif-task to PR egress leg (#343) aif-handoff ends a task at "committed on a local feature branch" with NO push and NO PR-creation in its autonomous (HANDOFF) path — verified 2026-06-01 against the running containers (zero PR-create / branch-push anywhere in its autonomous flow; its commit/push lives only in an LLM-driven /aif-commit runtime). So committed work strands inside aif's checkout, never reaching a reviewable PR on the trunk. harvest is the missing return leg. - src/harvest.ts: pure DI'd core harvestTask — guards (terminal status, branchName present) BEFORE any side-effect; ordered push then createPr then auto-merge, fail-fast (PR error never arms auto-merge). - src/cli/harvest.ts: real wiring — docker-exec push from aif's container (holds the commit + working creds), host PR-create against staging, native auto-merge; graceful printed manual-fallback if docker absent. - test/harvest.test.ts: paired-negative (non-terminal / no-branchName must NOT push or PR; PR-fail must NOT arm auto-merge). - aifHttp.ts: expose branchName on AifTaskFull (read back by harvest). Zero LLM by construction (plain git+gh+docker) — unlike aif's own commit flow which spends a paid claude -p query just to run git. Complies with no-paid-llm-in-ci.md. Prior-art: prior-art-evaluations.md#27/#28/#30/#67 — aif-handoff's own runtime (HANDOFF_MODE / paused / Planner-Implementer-Reviewer / Kanban) is the from-side this leg bridges, NOT an egress tool: verified it has zero push/PR in its autonomous path, which is exactly why harvest exists. No upstream harvest-autonomous-agent-branch-to-PR analog; thin deterministic glue over gh/git/docker, no PR-creation reimplemented. BFR verdict: BUILD (bridge egress leg). * feat(meta-orch): run-helper.sh completion-barrier wrapper (TDD, stage 1) (#344) Build .claude/skills/meta-orchestrator/helpers/run-helper.sh — a trivial bash exec-wrapper that runs a target helper as a child and ALWAYS appends a terminal END-trailer to stdout: === <helper-name>: END rc=<exit-code> (lines=<stdout-line-count>) === so a session reading a slow helper's stdout in the background can distinguish "finished (rc=N)" from "still running / crashed". The trailer is appended by the parent wrapper, so it fires even when the child exits non-zero or dies mid-output (a child-side `echo END` would be skipped on `set -e` abort / SIGKILL / timeout). Fixes the orchestrator reading a header-only partial file as "zero results". HARD CONSTRAINTS satisfied (§2): exit-propagation (capture rc first, exit rc last — trailer echo never clobbers child status); trailer-on-crash; stdout verbatim pass-through; `=== `-prefix kept so classify-each-candidate.sh:52 `awk '... && !/^=== /'` strips it (never a spurious candidate). TDD: paired-negative test at packages/core/skills/run-helper.test.ts (positive clean-exit + negative exit-1 + SIGKILL crash-mid-output + parse-safety) — 4/4 green. No regression: `git stash -u` A/B shows the 5 neighbouring helper tests produce an identical pre-existing 18-fail set (env-dependent gh/git harnesses) with and without this file. T-BGB-A: the END trailer proves the child FINISHED + its exit code, NOT semantic content-completeness — kept in test names/comments. Prior-art: prior-art-evaluations.md — escape hatch: trivial bash exec-wrapper, no upstream analog worth a dependency (BFR BUILD, pre-reasoned). Nearest SSOT neighbour #54 (Aider run_cmd runner) is a different problem-class — exit-code routing in a TS pre-push gate vs. appending a structural completion trailer for a background reader (T16: similar "runner" name, distinct capability). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bg-helper-completion-barrier-stage2-aif (#345) * feat(meta-orch): route bg-helper call-sites through run-helper.sh + Layer-1 read-rule (stage 2) Wire the two background-helper !-fences in meta-orchestrator/SKILL.md through the already-merged run-helper.sh completion-barrier wrapper: - §2 Step 1 priority-score.sh - §2.5 Step 2 dup-detect.sh + inflight-check.sh Add the Layer-1 read-rule prose after both fences: parse a slow helper's output only after its task-notification or the `=== <helper>: END rc=<n> ===` trailer; a header-only read means "still running", not "zero results". Origin: incident 2026-06-01 (priority-score.sh read at header-only state → false "zero candidates"). Helper code untouched; the 5 helper tests show identical baseline (18 failed / 34 passed both with and without this edit — failures are environmental, `gh` absent). Wrapped fences valid bash; classify-each-candidate.sh:52 still strips the `=== `-prefixed trailer. Prior-art: skipped — SKILL.md call-site wiring only, no new capability (routes existing helpers through the already-merged run-helper.sh wrapper from PR #344). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(meta-orch): SKILL.md back to 600 lines — fold read-rule into §2 Step 1 (DRY) aif's Stage 2 added two verbatim read-rule blockquotes (+4 lines), tipping SKILL.md from 598 to 604 over the 600-line mechanical-check cap (real CI fail on #345). Phase -1 reviewer fix: fold the read-rule once into the §2 Step 1 intro with 'applies to every background-helper fence below', drop the §2.5 duplicate. Both run-helper.sh wraps intact; read-rule discipline preserved, now DRY. Not a capability commit (markdown edit). Prior-art: skipped — markdown CI-fix (line-cap trim + DRY), no new capability. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(closure): bg-helper-completion-barrier done.md (final PR #345) (#347) Last-stage merge marker per CLAUDE.md umbrella-closure convention — priority-score.sh Layer C3 reads this for DONE detection. Prior-art: skipped — closure marker file, no new capability (convention bookkeeping). * feat(coordination): symlink-to-canonical cross-worktree sync (SSOT #110) (#346) Build scripts/link-coordination.sh (per-file symlinks, adopt-then-link, conflict-loud, seed on empty CANON), wire it into both worktree helpers replacing the J5 rsync block, add link-coordination.test.ts (7 tests: symlink, git-clean, conflict, write-back, paired-negative, adopt, seed), reconcile worktree-setup-hydration.test.ts (drop rsync NON-DESTRUCTIVE, retarget paired-negative regex to link-coordination.sh call, assert symlinks), append SSOT row #110. Umbrella count confirmed: 124 (kickoff said 123 — stale). Prior-art: prior-art-evaluations.md#110 (cross-worktree gitignored-SSOT sync via symlink-to-canonical, verdict ADAPT) + research-patch 2026-05-17-cross-worktree-coord-doc-sync.md §5 — I-phase implementation of the settled verdict. * docs(runtime-bridge): per-command CLI reference README (Option B) (#348) Operator-facing reference manual for the six runtime-bridge CLI commands (answer, await, dispatch, harvest, park, questions), one section each with Usage / Flags / Example, derived from each cli/<cmd>.ts header docblock. Resolves the parked README-structure fork → Option B (per-command reference). Markdown only, 285 lines (< 600-line cap), no code changes. Prior-art: skipped — documentation only, no new capability (operator-facing CLI reference derived from existing docblocks) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(discipline): surface genuine forks via AskUserQuestion (autonomous-default, human-gate on ambiguous only) (#349) Operating model (maintainer decision 2026-06-01): autonomous by default; the human-gate fires ONLY on a genuine ambiguous fork. A clear call is decided and reported, not routed through a question. - recommendation-laziness-discipline.md §3: fork-surfacing companion to the evidence rule — ambiguous forks MUST be surfaced via AskUserQuestion, never decided by a silent direct action; ask-question-reminder.sh is the discriminator; reworded 'default=surface' -> 'autonomous-default, surface only genuine forks'. - recommendation-laziness-discipline.md §5: new anti-pattern #fork-decided-by-silent-action (incident: PR #348 battle-test, an explicitly-50/50 README fork auto-decided by running answer.ts directly). Judgment rule -> injection-only enforcement, never a gate (#gate-where-judgment-needed). - end-of-turn-reminder.sh Branch-A: backstop reminder for the 'decided a fork silently' path (the inverse of the existing offload check). Hook tests 20/20 green. Origin: 2026-06-01 question-loop battle-test dialogue. §1.7: forward — complies with rule-enforcement-channel-selection (judgment->injection), no-paid-llm-in-ci (deterministic .sh + prose), doc-authority (no new heading); backward — new anti-pattern scope = any-session fork behaviour, no existing rule superseded (reviewer-discipline §2 is reviewer-scoped), enforced by two already-shipped hooks. * feat(hook): orchestration-mode aware reminders + brainstorm cue (qloop items 2+6) (#350) * docs(spec): hook-nudge orchestration-mode design (brainstorm item 2+6) Design for orchestration-mode-aware behaviour of the two reminder hooks: marker-gated Bug A fix (drop low-precision fork-regex in-mode) + recap threshold lowering (b) + brainstorm nudge in ask-question-reminder.sh. Normal mode stays byte-for-byte. Origin: 2026-06-01 qloop battle-test brainstorm. Prior-art: skipped — design doc only, no new capability (markdown spec under docs/superpowers/specs/, no dependency/code-module). * docs(plan): hook-nudge orchestration-mode implementation plan (item 2+6, TDD) Prior-art: skipped — planning doc only, no new capability. * docs(spec): add §3.4 aif-pull-channel brainstorm nudge (formatHuman footer) Recursive-self-application gap from maintainer dialogue: ALL aif-parked questions (not just I-ask-via-AUQ) must get the brainstorm-first nudge. Footer ships in item 4's questions.ts PR (file-locality). Prior-art: skipped — design doc only, no new capability. * feat(hook): orchestration-mode gating — drop fork-regex (Bug A) + lower recap threshold (recap-b) Marker .claude/orchestration-mode (mtime TTL); normal mode byte-for-byte. Bug A: decision-MENTIONS stop false-firing the fork-challenge in-mode (regex gated on orch_mode=false); real Qs (?/AUQ) still caught. recap-b: recap fires on short structured status in-mode (threshold 500->200) keeping the markdown gate so chatter stays silent. 7 new tests + 13 pre-existing green (20/20). Spec: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md. Prior-art: skipped — internal CC hook tuning, no new capability or dependency. * feat(hook): brainstorm cue in ask-question-reminder (item 6) Design/strategy forks -> superpowers:brainstorming, not a bare AUQ card. Always-on prose nudge (judgment -> injection, never a gate). 1 new test (8/8). Prior-art: skipped — internal CC hook tuning, no new capability or dependency. * fix(runtime-bridge): surface mid-flight park in questions.ts + brainstorm footer (qloop item 4) (#351) isParked gains the mid-flight-park case: a task whose blockedReason was wiped by implementing→review still surfaces via the durable conjunction (paused===true AND the plan carries the OPEN_QUESTION_ANCHOR). New shared constant openQuestion.ts is the single SSOT for that anchor (writer park.ts, reader questions.ts) so the wording cannot drift (dual-implementation-discipline #two-prompts-drift). formatHuman appends the §3.4 brainstorm-first footer on a non-empty parked list (aif-pull-channel companion to ask-question-reminder.sh §3.3); empty case unchanged. Reproduced from the verified container fix (branch feature/qloop-realfix-d7585d), host-side, per handoff item 4. Design SSOT: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md (§3.4). Prior-art: skipped — bug fix on existing CLI + 17-LOC shared constant, no new capability/dependency. * feat(runtime-bridge): commit aif rework leg in harvest (qloop item 3) (#352) aif commits only on its approve_done && commitOnApprove path; the request_changes→implementing→done rework path leaves the work uncommitted (dirty tree, branch == base HEAD), so harvest had nothing to push. Extend the egress: hasUncommittedChanges → commitAll (templated message, ZERO LLM) before push. No-op on the normal path (tree already clean). Commit failure is fail-fast — nothing pushed, operator gets the printed fallback. Real dep guards that the container checkout is on the task branch before committing. aif-handoff source untouched (foreign runtime, SSOT #27) — fix lives entirely on our egress leg, matching harvest's graceful-degradation design. Prior-art: skipped — extends existing harvest CLI, deterministic git only, no new capability/dependency. * fix(principles): isolate p13 fixtures to tmpdir (kills p10↔p13 race) + exempt qloop-ux-probe probe (p12) (#353) Two local pre-push false-blocks found by qloop-ux-probe (neither is a real violation): F1 — principle 13 wrote its synthetic + c3-decoration fixtures into the REAL docs/meta-factory/research-patches/ dir, then unlinked them. Under vitest's parallel file run, principle 10's readdirSync globbed the transient file and ENOENT'd when 13 deleted it → a cross-file race (10 alone = 5/5 pass; full run = flaky ENOENT). Fix: write the fixtures to os.tmpdir() — checkSection reads content only, PATCHES_DIR membership was never required. Verified race-free across 3 consecutive full-trio runs. F2 — principle 12 flagged the gitignored qloop-ux-probe kickoff (a 2-question resume *test fixture*, not a work-delegating orchestration kickoff) for no AI-traps citation, failing every local push. It already skips in CI (KICKOFFS_AVAILABLE false). Added to EXEMPT_LIST with documented rationale. Full principle suite: 157/157. * fix(runtime-bridge): park.ts resolves API_BASE_URL so agent can park from inside aif container (#354) park.ts is the only CLI run from inside the aif agent container, which exposes the service as API_BASE_URL=http://api:3009 and does NOT set RUNTIME_BRIDGE_AIF_URL. The old localhost-only default was unreachable there (connection refused) -> park() got 'fetch failed' -> the agent could not park itself, so park-don't-guess (SSOT #109, meta-orchestrator §4c) was non-functional on the real autonomous path. New precedence: RUNTIME_BRIDGE_AIF_URL ?? API_BASE_URL ?? http://localhost:3009. Host orchestrator (sets neither) still gets localhost; container gets api:3009. Found by qloop-ux-probe Часть 2 live dispatch (taskId 5e32fcb9): agent correctly surfaced-not-hacked the park failure, but the task slid implement->review->done at $3.17 having parked nothing. resolveAifBaseUrl() extracted + unit-tested incl. a negative guard proven to go red on regression. * fix(runtime-bridge): don't record dedup on ManualBackend fallback + add --force (Finding B) (#355) dispatch.ts recorded a dedup entry unconditionally after Step 4 — even when the real backend threw (e.g. dirty_worktree 409) and it fell back to ManualBackend. That manual entry (which created no autonomous task) then blocked a legitimate real retry for the full 24h TTL, with no escape. qloop-ux-probe hit exactly this: after fixing the dirty worktree, the re-dispatch was refused as "already dispatched (backend=manual)". Fix: - shouldRecordDedup(backendName): record only for a real backend success, never 'manual'. - --force: skip the dedup check to re-dispatch the same kickoff deliberately. - kickoff path resolved as the first non-flag arg, so --force may sit anywhere. Three pure helpers, unit-tested incl. a negative guard. Full runtime-bridge suite 102 pass. * fix(runtime-bridge): questions.ts recovers mid-flight-park question from plan anchor (Finding E) (#356) A mid-flight park (paused:true + OPEN_QUESTION_ANCHOR in plan, blockedReason wiped by implementing→review) surfaced in the list — but parkedReason() rendered "(no reason recorded)" because it only read blockedReason + reviewComments, never the question text park.ts appended under the plan anchor. So the chat channel showed "there is a question" with no idea WHAT it asks (qloop-ux-probe Finding E, task ccebe39a). Fix: extractOpenQuestion(plan) pulls the text after the last OPEN_QUESTION_ANCHOR line; parkedReason precedence is now blockedReason → plan OPEN QUESTION → reviewComments → "(no reason recorded)". Unit-tested incl. multi-anchor (last wins) + a negative guard. Full runtime-bridge suite 100 pass. * fix(runtime-bridge): park.ts probes reachable base URL — agent env scrubs API_BASE_URL (Finding C-2) (#357) Finding C (#354) made park.ts READ API_BASE_URL, but the qloop-ux-probe live re-run proved that insufficient: the aif agent runs park.ts in a Bash-tool subprocess whose env is SCRUBBED of API_BASE_URL (the container's PID-1 env has it; the agent's exec env does not). So resolveAifBaseUrl() still fell back to localhost:3009 → unreachable inside the container → "fetch failed" → the task slid to done at $3.45 without parking, exactly as before. Fix: resolveReachableBaseUrl() probes candidate URLs and uses the first reachable one — [RUNTIME_BRIDGE_AIF_URL?, API_BASE_URL?, http://api:3009 (docker service), http://localhost:3009 (host)], de-duplicated. Works from BOTH the agent container (api:3009) and the host orchestrator (localhost) even when no env survives. main() now awaits the probe. candidateBaseUrls + resolveReachableBaseUrl unit-tested (injected fetch) incl. a negative guard proving it skips an unreachable first candidate. Full runtime-bridge suite 117 pass. * feat(runtime-bridge): bridge-health.sh ($0 container-side preflight) + bridge-cleanup.sh (junk sweep) (#358) Operator pain: "каждую сессию приходится чинить" + "мусор постоянно остаётся". Both are structural — the recurring bugs live on the host↔container↔aif boundary that unit/CI can't cover (a full agent run costs LLM tokens, no-paid-llm-in-ci), so they were only found live MID-TASK; and probe/smoke runs leave orphan tasks + /tmp files behind. bridge-health.sh — $0 deterministic CONTAINER-side preflight (docker+curl+grep, no task, no tokens). Each check maps to a real qloop-ux-probe finding: container checkout clean (A), park.ts carries the resolveReachableBaseUrl probe (C-2), a park candidate URL is reachable from inside the container (C/C-2), dedup store has no stale manual entries (B). Run at session start → "bridge red, fix first" instead of discovering breakage live. Complements verify-bridge.sh (host-side dispatch smoke). Live-dogfooded — caught + fixed a false-positive in its own reachability check (000 connection-fail vs real HTTP status). bridge-cleanup.sh — one-command sweep of test/probe junk: aif tasks matching a test-title allowlist (UXPROBE/smoke/probe — real work never matched), old /tmp ManualBackend kickoffs + dedup backups. Reports a container stash, never drops it (operator's git). --dry-run. Prior-art: extends own verify-bridge.sh operator-smoke pattern (packages/runtime-bridge/scripts) — no external prior art applies; project-specific aif-bridge container diagnostic + test-task sweep, not a general capability with an upstream analog. * fix(runtime-bridge): self-cleaning junk producers — junk no longer accumulates (no manual/AI sweep) (#359) Operator: "придумать как быть с мусором — его не должен чистить каждый раз ИИ". A manual cleanup script is still "someone cleans each time". The real fix is that each producer cleans up after itself, automatically, with zero AI/manual involvement. idempotency.ts — recordDispatch was append-only (file grew forever; a stale manual-fallback entry blocked retries for the full TTL). Now it PRUNES-ON-WRITE: rewrites the log keeping only within-TTL entries + the new one. Self-bounding, and stale entries (incl. Finding B's manual fallback) auto-expire by age — no --force needed after TTL, no sweep. ManualBackend.ts — dispatch wrote /tmp/runtime-bridge-<id>.md on every fallback and never cleaned them (days of accumulation). Now each dispatch first prunes its OWN stale artefacts (runtime-bridge-*.md older than 7d). Scope-guarded: only matches our files, only when stale, best-effort (never throws into the dispatch path). Pure cores (pruneStaleEntries / parseEntries / isStaleArtifact) unit-tested incl. negative guards (stale entry must not survive; unrelated old .md must not be pruned). Full suite 126 pass. This complements (does not replace) bridge-health.sh; bridge-cleanup.sh stays as a rare manual "nuke everything" escape hatch, not the routine mechanism. * fix(runtime-bridge): park.ts refuses to park at status=review (Finding F guard) (#361) A park that happens AFTER the implement→review transition left the task status=review, paused=true. On resume, aif runs the review pipeline straight to `done` WITHOUT re-implementing the injected answer — and the next chain question is never parked (live: task ba3b4bf6 answered c1 → done, c2 silently lost). Root cause is upstream-intentional: aif's HUMAN_ACTIONS_BY_STATUS.review = [] (stateMachine.ts) — there is no human re-entry from `review` into implement. Option B (per 2026-06-01-aif-task-isolation.md §4, maintainer-selected): a cheap our-side guard. parkTask already GETs the task, so the status is in hand — refuse the park at status=review and throw a clear message (park before review, or wait for done and use answer.ts request_changes). Turns the silent loss into a loud, actionable error. Does NOT add mid-flight re-implement (Option C, deferred). Paired-negative test: GUARD refuses + issues NO PUT at status=review; CONTROL still parks normally at a pre-review status (plan_ready). 19→21 tests green. Prior-art: skipped — bug-fix guard on existing park capability, no new dependency or capability commit. * docs: R-phase research-patch — aif task-isolation (Findings A + F) (#360) * docs(runtime-bridge): R-phase research-patch — aif task-isolation Findings A + F Finding A (dirty_worktree recurs): verdict config-fix. Per-task worktrees are gated by a 3-condition AND in planner.ts:191-195 — env AIF_TASK_WORKTREES_ENABLED=true is only gate 1; gate 2 project.parallelEnabled (DB parallel_enabled, web-UI toggle) is 0 and was never set, so worktrees are never created and the shared checkout is reused in-place → dirties → next dispatch 409s. Fix: flip parallel_enabled (no restart). Finding F (mid-flight park resumes review->done, never re-implements): verdict aif-upstream-issue (intentional design) + our-side-guard. stateMachine.ts:106 HUMAN_ACTIONS_BY_STATUS.review=[] -> no human re-entry into implement; request_changes only from done. DECISION-NEEDED for I-phase: Option B (park.ts guard rejecting parks at status=review) vs Option C (auto request_changes loop, ~4h). R-phase only — no production code changed. Evidence: parallel_enabled=0 (live DB query), worktree_path null across 10 tasks, reflog >=6 in-place checkout cycles, planner 3-gate + stateMachine review:[] source-verified. Scope annotation (principle 10) + §1.7 (principle 13). * docs(runtime-bridge): record Finding F resolution — Option B selected + shipped (#361) §4.1 + §7.3: DECISION-NEEDED-F resolved 2026-06-01. Maintainer selected the hard-guard path (surfaced as "Option B"). Records the exact shipped behavior honestly: park rejects only at status=review (the §4.1 Option-A semantics, NOT the stricter implementing-only Option B) — pre-implement parks (plan_ready) stay legitimate. Cross-refs PR #361. Option C deferred. * feat(runtime-bridge): ensure-parallel guard — self-heal Finding A on any instance (#362) aif creates a per-task git worktree only when project.parallelEnabled=1 (gate 2 of 3 in planner.ts). That flag is a DB field with NO env/config.yaml knob — only the web UI or raw DB sets it — so a freshly-provisioned instance has it 0, every task runs in-place on the shared checkout, and the next dispatch 409s on dirty_worktree (research-patch 2026-06-01-aif-task-isolation.md §1-§2; the live config-fix applied to this instance does not propagate to other instances). ensureParallelEnabled(baseUrl, projectId): GET /projects → if parallelEnabled is already true, no-op; else PUT /projects/:id with parallelEnabled=true. Wired best-effort into AifHandoffBackend.dispatch() Step 0 (warns + proceeds on failure, never blocks dispatch) and shipped as a standalone CLI (--project / env). Anti-clobber (load-bearing): aif has no targeted parallelEnabled write (only PATCH /:id/auto-queue-mode), and the full PUT NULLs any omitted *MaxBudgetUsd (@aif/data updateProject: `x ?? null`). So the guard round-trips the FULL field set read back from GET — flipping ONLY parallelEnabled — to preserve a UI-set budget. Paired-negative test pins this: a set budget MUST survive the PUT. Cleaner long-term fix = an upstream PATCH /projects/:id/parallel-enabled mirroring the existing auto-queue-mode PATCH (file against lee-to/aif-handoff); this guard is the our-side stopgap. 6 new tests green; runtime-bridge typecheck clean. Prior-art: prior-art-evaluations.md#109 (park.ts BUILD — same class: thin our-side runtime-bridge consumer CLI over aif REST where no upstream targeted primitive exists; here parallelEnabled-reconcile, no upstream PATCH beyond auto-queue-mode; cleaner fix REFERENCEd to upstream, this is the stopgap). * coordination-persistence-fix (#363) * feat(coordination): link-coordination.sh --on-conflict=canon|worktree|skip (default skip) Adds --on-conflict flag with three modes resolving the real-file-in-both conflict deterministically: skip (default, exit 1, never clobber), canon (canonical wins, relink), worktree (worktree wins, adopt into CANON). Invalid values exit 2. TDD: 4 tests in link-coordination.test.ts. Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; arg-parse + branch logic only, no new file/dep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(coordination): link-coordination.sh shares root _plan-cache.md + _master-backlog-delta.json (Part-2, SSOT #110) Adds a ROOT-FILE adopt-then-link + link pair so the two root-level gitignored coordination files (_plan-cache.md, _master-backlog-delta.json) are shared across worktrees — previously unmatched because the loops only iterated umbrella subdirs */. Tracked root README.md untouched. TDD: 3 tests in link-coordination.test.ts. Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; mirrors existing umbrella adopt/link loops for root files. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(hooks): i18n reminder payload — en canonical / ru operator (+ principle-12 exempt hygiene) (#364) * feat(hooks): i18n — split reminder payload into lang packs (en canonical / ru operator) The two reminder hooks (ask-question-reminder, end-of-turn-reminder) emitted Russian payload prose inline. Splits logic from payload: hooks keep all logic and source a language pack (.claude/hooks/lang/{en,ru}.sh) selected by AIF_HOOK_LANG (default en — canonical, for the public repo). Operator sets AIF_HOOK_LANG=ru once globally in ~/.claude/settings.json. - lang/en.sh + lang/ru.sh: aif_msg_* functions (${anchor} resolved at call time via dynamic scope) + AIF_RECAP_MARKER (recap heading; guard and message read the same var so they stay language-consistent). - lang/check-parity.sh: deterministic, no-LLM guard against #two-prompts-drift — asserts both packs expose the same key set. Local/reviewer step, not a blocking gate (hooks are @cc-only, not shipped). - Tests run the existing cases under AIF_HOOK_LANG=ru (RU-pack contract; Russian transcripts + assertions unchanged) + add an en-pack smoke per hook. - RU payload byte-identical to before; EN is a faithful translation. Behaviour preserved (30/30 hook tests green). Out of scope (surfaced): Russian code comments in the two hooks; other 11 hooks; questions.ts strings. Spec: docs/superpowers/specs/2026-06-01-hook-lang-i18n-design.md Prior-art: skipped — i18n refactor of existing internal hooks, no new capability (string externalization to lang packs, no dependency, no packages/ code module) * test(principle-12): drop stale 'qloop-ux-probe' from EXEMPT_LIST The qloop-ux-probe question-loop fixture dir (gitignored, added to EXEMPT_LIST 2026-06-01 by Finding F2) is gone — the positive-guard test correctly flagged it as a stale exempt entry ("exempted but now absent"). Remove it per the test's own instruction; 'aif-ssot-corrections' remains the sole exempt entry. Surfaced while unblocking the hook-i18n PR's local pre-push (principle 12 runs on gitignored kickoffs locally, skips in CI). Maintainer-invited in-session. Prior-art: skipped — principle-test allowlist hygiene, no new capability (one stale entry removed from EXEMPT_LIST + doc comment) * fix(runtime-bridge): bridge-cleanup §4 prunes MERGED container git junk (#365) Enabling per-task worktrees (parallel_enabled, #362) makes aif RETAIN worktrees post-terminal (research-patch 2026-06-01-aif-task-isolation.md §2.1), and the old in-place task checkouts had already left 14 stale feature/* branches on the shared checkout. The session janitor (#358/#359) deliberately did NOT touch container git. §4 extends it to prune ONLY container git merged into origin/staging: git worktree prune + remove retained non-main worktrees on merged branches + delete merged feature/* branches. SAFE BY CONSTRUCTION — `git branch --merged` filtering AND `git branch -d` (refuses unmerged) double-guard; unmerged in-flight work is never touched. Also fixes the docker-exec stdin bug (needs -i for `sh -s` heredoc). Completes the #359 "no manual/AI sweep" principle for container git state. This is operator/co-located tooling (docker exec); the portable fix is upstream auto-removal of retained worktrees (worth filing against lee-to/aif-handoff). Live-verified on the real container: dry-run + real run deleted 7 merged branches and preserved all 6 unmerged (+ the checked-out one). No unit test — matches the 4 untested sibling janitor scripts; safety is by-construction + live paired-evidence. Prior-art: skipped — extends an existing janitor script (no new dependency, no new >=80 LOC file, not a capability commit); the parallel-worktree capability it cleans up after is #362/#109. * feat(audit-self): bash-hook mutation testing — bash.rules + run-bash-mutation.sh (universalmutator ADAPT, local/on-demand) (#366) Stage 2 B.2 of mutation-discipline-umbrella. ADAPTs universalmutator (MIT, deterministic regexp engine + analyze_mutants harness — no LLM) to mutation-test .claude/hooks/*.sh against their paired-negative vitest tests. The only project-authored artefacts are bash.rules (operators), a thin wrapper, and the wrapper's own paired-negative test. Delivery = session-bound / local on-demand (NOT CI), mirroring Stryker-as-devDep; the original kickoff B.3 CI job is dropped. universalmutator is a dev-time tool, never consumer-shipped. Dogfood gate (mandatory) surfaced real, undocumented test gaps: end-of-turn-reminder 52% / validate-prompt 56% (both below the 60% floor) — the &&/|| mutation of their suppress/skip conditions survives uncaught. Recursive bootstrap: the wrapper mutated by its own operators is killed 13/13 by its own test. Found + fixed a /*-in-comment regexp-engine limitation (bash globs in comments falsely trigger C-block-comment mode) via a line-count-preserving sanitiser. Evidence: docs/meta-factory/research-patches/2026-06-02-bash-mutator-b2-shipped.md Prior-art: prior-art-evaluations.md#91 (universalmutator ADAPT — engine ADOPTed verbatim, only bash.rules operators authored; problem-class ~85% match per B.1 §B.1.5; mutahunter REJECTed on no-paid-llm-in-ci §1). * feat(coordination): persistence-fix tail — SW-B symlink-aware helpers + G/B/C installer (#368) * docs(coordination): design — cross-worktree persistence fix (4-channel: git-hook agnostic floor + CC + Superset + skill) Brainstorm output for coordination-persistence-fix umbrella. T16 corrections: - channel C substrate = Superset projects/<uuid>/config.json setup-array (rsync = root cause), NOT ~/.superset/hooks/ - adds git post-checkout (.husky) as the harness-agnostic floor per maintainer 'works everywhere' requirement - Q3 atomicity already satisfied (mktemp+mv verified); SSOT #110 same anchor Prior-art: skipped — design doc only, no new capability (extends link-coordination.sh SSOT #110). * docs(coordination): correct §2.4 — helpers atomic but NOT symlink-preserving (mv replaces symlink) Planning-phase finding (verified empirically): mv tmp <symlink> replaces the symlink with a real file → Part-2 cross-worktree share lost on first cache write. SW-B upgraded from 'confirm test' to 'make 3 helpers symlink-aware (write-through resolved target)'. Atomicity preserved (temp+mv in target dir), symlink preserved. Prior-art: skipped — design doc correction only, no new capability. * docs(coordination): implementation plan — 4 sub-waves (A linker / B symlink-aware helpers / C wiring / D self-apply) Prior-art: skipped — plan doc only, no new capability (implements SSOT #110 extension). * feat(coordination): one-click install-coordination-wiring.sh (G+B+C, idempotent, self-test) Applies all 3 wiring channels in one terminal command (maintainer runs from central repo): G .husky/post-checkout (agnostic floor) B .claude/settings.json SessionStart C ~/.superset/projects/*/config.json setup (replaces rsync root-cause) --self-test (sandbox) + --dry-run modes; idempotent re-runs. Replaces the manual runbook. Prior-art: skipped — scripts/ helper, not a capability commit (no dep, not under packages/); wires existing link-coordination.sh SSOT #110. * fix(coordination): 3 cache/delta helpers symlink-aware (SW-B) resolve_target() follows a symlink to its real $CANON target so the atomic temp-then-mv write writes THROUGH the link instead of replacing it. Without this, the first cache/delta write breaks the cross-worktree share (mv tmp <symlink> → real file). +3 paired-negative tests (symlink preserved + canon written through); 18/18 green. Done locally (not via aif — container serialized on doc-audit task). Prior-art: skipped — symlink-preservation fix to existing helpers, no new capability; extends link-coordination.sh SSOT #110 share semantics. * docs(coordination): drop channel A (skill self-heal) — redundant after G git-hook B (CC SessionStart) fires at every session start ⊇ 'when meta-orchestrator runs', and G (git post-checkout) is the real agnostic floor A was standing in for. Final channel set = G + B + C, wired via install-coordination-wiring.sh. Prior-art: skipped — design doc scope-reduction, no new capability. * fix(runtime-bridge): bridge-cleanup §4 skips while aif has live tasks (no ref-lock contention) (#367) §4 (container git prune, #365) runs git fetch / worktree prune / branch -d in the SHARED .git. A task running concurrently touches the same ref + packed-refs locks (amplified by parallel_enabled keeping multiple tasks active) → a collision yields "cannot lock ref" and can fail the live task's git step. Guard: GET /tasks, count non-terminal (not done/verified/cancelled); if >0, skip §4 with a clear note ("re-run when idle"). Deterministic, no AI. Fail-open (count unknown → 0 → proceed) — §4 is already merged-only safe-by-construction, so this is defence-in- depth; worst case of a false 0 is a transient lock retry, never corruption or data loss. Live-verified: with 2 non-terminal tasks running, `--dry-run` §4 printed "skipped — 2 live". Prior-art: skipped — edits an existing janitor script (no new dependency, no new file, not a capability commit); guards the #365 sweep against the #362 parallel_enabled concurrency window. * feat(coordination): commit channels G + B (post-checkout + CC SessionStart) (#369) Makes the two machine-agnostic wiring channels durable + shared (were applied locally by install-coordination-wiring.sh). Both call link-coordination.sh (SSOT #110): G .husky/post-checkout — agnostic floor, fires on git worktree add B .claude/settings.json — CC SessionStart re-heal Channel C (Superset setup-array, per-UUID) stays installer-only. SW-D liveness: G verified live — fresh worktree auto-linked 287 files. Prior-art: skipped — wiring of existing link-coordination.sh SSOT #110 into hook channels, no new capability. * docs(research-patches): doc-audit-ship-boundary Stage 2 findings + gitignore stryker sandbox (#371) Autonomous aif audit (task bcb2c6c2): full doc-vs-reality + vs-goal reconciliation, Stage 2.0 mutation-run fuel, DECISION-NEEDED batch (DN-1..4), §A self-classification. Audit-only — no maintainer-owned edits landed. Also gitignore packages/core/.stryker-tmp/ so mutation runs never pollute the tree (root cause of PR #370 contamination). * test(hooks): close mutation gaps in end-of-turn-reminder + validate-prompt (B.2 dogfood follow-up) (#373) The Stage 2 B.2 bash mutator (#366) surfaced two hook tests below the 60% kill floor: end-of-turn-reminder (52%) and validate-prompt (56%). Add targeted cases that kill every NON-equivalent surviving mutant: - end-of-turn-reminder 52% → 69%: cover the previously-untested idle-suppress re-ping guard (hook:135-156) — suppress-on-reping, fire-on-new-question, long-answer-overrides-suppress, the B2 "an AskUserQuestion turn is never idle-suppressed" contract — and the bare non-question tool-call early exit (hook:53-54). The 10 residual survivors are equivalent mutants: 7× `|| true` → `&& true` inside `$(…)` command-substitutions (stdout unchanged, exit ignored under set -uo, no -e), the transcript-validity guard (both paths exit 0/empty for the only diverging input), `set -e`→`set +e` (hook never relies on errexit aborting), and the inner re-ping AND→OR (divergence requires prev==last+recap, which trips the self-recap guard first). All 22 killable mutants are killed. - validate-prompt 56% → 78%: deterministically exercise the tsx-unavailable graceful-skip (hook:26-27, isolated-root copy) and the jq-unavailable graceful-skip (hook:14-16, fake-bin PATH without jq). The 2 residual survivors are gh+validator-coupled (hook:21 off-path-proceeds-to-validator, hook:33 validator-result) — killable only with a live-gh 404 test, which is non-hermetic; left per T-MUT-B rather than shipping a flaky test. Test-only; no production hook modified. Follow-up to #366 (mutation-discipline-umbrella Stage 2 B.2). * docs(doc-audit): apply DN-1/2/4 doc-staleness fixes + ship the fixer tooling (#374) doc-audit-ship-boundary Stage 2 — maintainer decisions 2026-06-02, applied. Applied (maintainer-directed, DN-1/2/4): - .claude/rules/rule-enforcement-channel-selection.md: 'Activation pending' → 'Activation confirmed — settings.json:114' (Class header + §4 prose); the PostToolUse Edit|Write hook is wired (verified settings.json:114). - README.md badges: ?branch=main → ?branch=staging (main=prod, CI runs on staging). - README.md enforcement chain: drop false 'Stryker' from the CI channel — mutation tests are local/session-bound, NOT a CI gate (no workflow runs Stryker). Tooling shipped alongside: - scripts/apply-doc-fixes.sh: idempotent, terminal-runnable fixer (re-applies the above; --check dry-run). packages/core/hooks/apply-doc-fixes.test.ts: 5 green. - docs/meta-factory/mutation-run-placement.md: DN-4 placement note (mutation local; ps/jq/universalmutator reqs). Prior-art: skipped — maintainer-directed doc-staleness fixes + their fixer tool + a placement note; no new runtime capability, no dependency, no packages/ code module. * test(principle-12): raise population-sentinel bounds 10..100 → 100..300 (#375) The principle-12 population sentinel capped local kickoff dirs at 100. The project legitimately accumulated >100 umbrellas of history, mirrored locally by the coordination-persistence channel (G, .husky/post-checkout → link-coordination.sh), so the ≤100 guess tripped the pre-push on every worktree. Raise to ≤300 (still catches a runaway glob) and ≥100 (doubles as a 'mirror present' guard). The sentinel is skipped in CI (KICKOFFS_AVAILABLE) — it only gates local pre-push. Maintainer-directed 2026-06-02. Does NOT resolve the separate citation-check vs symlink-mirror interaction (the broader principle-12-vs-G item) — bound only. Prior-art: skipped — adjusts a sentinel bound in an existing principle test to match reality; no new capability, no dependency, no new module. * test(principle-12): citation check ignores coordination-mirror kickoffs (#376) Citation check re-ran on every umbrella mirrored in by channel G (post-checkout → link-coordination.sh symlinks gitignored kickoff.md into $CANON), failing on historical umbrellas this worktree never authored (principle-12-vs-G). Fix: check only REAL (non-symlink) kickoff.md = locally authored. Population sentinel still counts the FULL set as a mirror-present guard. Pairs with #375 (bound→100..300). Prior-art: skipped — narrows an existing principle-test filter to exclude symlink mirrors; no new capability, no dependency. * docs(spec): aif parallel autonomous dispatch — verified model + open test (brainstorm 2026-06-02) (#377) Captures the full session conclusions so they survive: the depth-2 architecture insight (subagents don't spawn subagents → quality parallel needs separate top-level sessions, meta- orchestrator decides), the verified aif model (1 kickoff/meta-launch → 1 task; each task = top- level session; flat task model; two parallelism layers L1 cross-task worktrees / L2 within-task use_subagents→implement-coordinator; use_subagents=0 everywhere = why never parallelized; worktree-skip is documented per docs/configuration.md), the observable test signal (agent_activity_log 'Subagent: <name> started', subagentQuery.ts:793), the decision tree, the OPEN question gated on one live test (use_subagents top-level launch), an honest flip-flop corrections log, and decisions (planner-owns-plan, COORDINATOR_MAX knob, park preserved). NOT a final spec — gated on the §5 live test on a genuinely-parallel task (D.1-D.5). * chore(harvest): commit reworked aif task 5767f7df-7425-4a78-a76f-98402c1647d0 — mutation-discipline-stage-c-meta-launch (#378) * docs(spec): aif parallel dispatch §5 RESOLVED — YES via use_subagents (live proof) + M3-bash timeout fix (#380) * docs(spec): aif parallel dispatch §5 RESOLVED — YES, self-parallelizes via use_subagents (live 2026-06-02) Live test (task a37ee2f5): use_subagents=true on a real 5-task plan (mutation Stage 4 D.1-D.5) → implement-coordinator launched top-level (--agent) → fanned out 5 concurrent implement-worker subagents, each worktree-isolated. Proof: 5x `Tool: Agent {subagent_type:implement-worker}` spawns + git worktree list 1→6 (5 locked worker worktrees coexisting, ~2min all-5 overlap) + 5 distinct real test files written simultaneously. Also corrects §3.7 observable: `Subagent:` log line is SDK-transport-only (onSubagentStart wired only via SDK SubagentStart hook); on transport=cli it stays 0 even under full parallelism — a false-negative trap. Valid CLI-transport observables = git worktree growth + `Tool: Agent` activity entries. Design consequence = the tiny change: bridge sets use_subagents=true at dispatch for depth-2-sufficient umbrellas + meta-orchestrator emits plan-structured kickoffs (independent numbered Task items, no Phase headings). Prior-art: skipped — design-doc update only, no new capability/dependency/code-module. * test(principle-02): give M3-bash mutation gate a 60s timeout (was default 5000ms) The [M3-bash] local/on-demand gate (describe.skipIf(!HAS_UM)) calls runBashMutator → spawns `npx vitest` once per mutant, ~9.5s on a loaded host. The default 5000ms vitest timeout false-fails it at pre-push (blocking unrelated pushes; observed this session). Add an explicit 60_000ms timeout — mirrors the Stryker precedent (principle 11 testTimeout 5s→30s). No assertion/semantics change; CI still skips it (no universalmutator). Prior-art: skipped — test-timeout fix for an existing gate, no new capability/dependency. * test(mutation-discipline-stage-d): paired-negative tests for 5 remaining .sh helpers (#381) Stage 4 D of the mutation-discipline umbrella — content-level paired-negative vitest tests (M.4 pattern) for the .sh files that lacked them: - priority-score.sh → priority-score-synthetic.test.ts (20 it, 53 expect) - plan-currency-check.sh → plan-currency-check-kickoff.test.ts ( 6 it, kickoff-existence angle; non-redundant w/ existing) - launch-table-generator.sh→ launch-table-generator.test.ts (11 it) - check-skill-drift.sh → check-skill-drift.test.ts ( 6 it) - pre-push.fallback.sh → pre-push.fallback.test.ts (20 it) Produced by the aif self-parallel-dispatch live test (5 concurrent implement-workers, use_subagents=true) and verified by an independent 5-way adversarial cold-review (T19): all real-script-invoked (spawnSync bash on the actual .sh), content-level assertions (exit code + stdout/stderr, no shape-only .toBeDefined), anti-tautology confirmed. Fixed one over-reaching T12-compliance comment in priority-score (claimed 8 surfaces verified; only 5 are — now honest + deferred-gap note). Known deferred coverage gaps (honestly disclosed, follow-up): launch-table fallback+no-keyword path; pre-push 2 of 3 discipline-file patterns; priority-score surfaces (c)/(d)/(h). 52/52 tests green. Prior-art: skipped — test additions for existing .sh capabilities, no new runtime capability/dependency. * research(mutation-discipline-d6): verdict on deps-hash-check.sh duplication (#382) D.6 R-phase (mutation-discipline umbrella). Investigates the two byte-identical deps-hash-check.sh copies. Verified roles (T3, file:line): packages/core/hooks/ = shipped SOURCE (install.sh:261), .claude/hooks/ = this repo's DOGFOOD copy (settings.json:74). Key finding: deps-hash-check.test.ts:34 tests the DOGFOOD copy, not source → silent drift possible (test stays green if source diverges). Verdict (b) keep-both + drift-check: add @dual-pair markers + a byte-identity assertion test — REUSE the existing dual-implementation @dual-pair convention (SSOT #87) rather than BUILD. Symlink (a) rejected (install.sh --force regression + Windows). Concrete I-phase fix path + falsifiers included. R-phase only — no edits to the .sh files / settings.json / install.sh. Produced autonomously by aif (use_subagents=0, single R-phase task) + cold-reviewed. Prior-art: skipped — research-patch (markdown), no new capability/dependency/code. * fix(hooks): drift-check for deps-hash-check.sh source/dogfood pair (D.6 I-phase) (#383) Implements #382 §6 verdict (b) keep-both + drift-check. Adds @dual-pair: deps-hash-check-dogfood markers (identical block, preserving byte-identity) to both the shipped SOURCE (packages/core/hooks/) and this repo's DOGFOOD copy (.claude/hooks/), plus a byte-identity assertion in deps-hash-check.test.ts. Closes the silent-drift hole the D.6 R-phase confirmed: the functional tests exercise only the dogfood copy (HOOK), so they stayed green even if the source diverged. Falsifier verified — breaking one copy turns the new test red. Corrected #382 §6's asymmetric-marker spec (4-line block to dogfood vs 1-line to source), which would itself have broken the byte-identity the test asserts; both copies carry the identical block. Last residual of the mutation-discipline umbrella; closure (done.md + memory) follows on merge. Prior-art: prior-art-evaluations.md#87 (worktree-create-setup dual-pair, SSOT BUILD — this commit extends the @dual-pair pattern with a second pair; no new mechanism introduced). * docs: R-phase — why per-task worktrees never materialize (corrects #360 Finding A) (#372) * docs(runtime-bridge): R-phase — why per-task worktrees never materialize (corrects #360 Finding A) Live falsifier of #360 Finding A: 0 tasks ever got a worktree despite parallel_enabled=1. Root cause (verified source, correct containers): the bridge dispatches via a planner-SKIP — POST /tasks/:id/events {event:'accept_existing_plan'} — which transitions backlog→plan_ready SKIPPING the `planning` status (stateMachine.ts case accept_existing_plan, api container). The coordinator runs runPlanner ONLY for the planning stage (coordinator.ts PIPELINE from:["planning"], agent container). The ONLY worktree-creation code lives in runPlanner (planner.ts:191-213). ⇒ bridge tasks never run the planner → never create a worktree, regardless of parallel_enabled / AIF_TASK_WORKTREES_ENABLED / plannerMode. Secondary: handleAcceptExistingPlan also persists branchName (taskEvents.ts:236+) so even if the planner ran, planner branch-2 (in-place restore) would pre-empt branch-3 (worktree). Verdict: parallel_enabled=1 (#360/#362) is NECESSARY BUT NOT SUFFICIENT. Fix options: B = drop accept_existing_plan from bridge dispatch + let the coordinator run the planner; C = accept serial in-place as the operating mode with the existing rollback guard. Both deferred to a follow-up I-phase (DECISION-NEEDED). gate-3 passes; mode-change is NOT the fix (server already forces full). Effort + falsifier per finding in the patch. R-phase only — no production code changed. DeepWiki x3 (converged) + verified file:line in both aif containers. Scope annotation (principle 10) + §1.7 (principle 13). * docs(runtime-bridge): §0.1 — worktree-skip is DOCUMENTED aif behaviour (docs/configuration.md), not a trap; no upstream issue DeepWiki x3 (converged): docs/configuration.md ties worktree creation to full-mode planning by design; docs/architecture.md documents the serial-forcing. So planner-skip forgoing the worktree is a documented consequence, not a defect — no upstream issue. Records the search-coverage lesson: the #360 verdict was avoidable by reading aif's own config docs. The corrected fix (run the planner) is the documented isolation+parallel path. * docs(wave-plan): reconcile §0 → 2026-06-02 (#298→#382) + codify how §0 stays current (#384) Manual status reconciliation per the design loop (detect via /meta-orchestrator, write by human-directed session — Direction A auto-write rejected at R-phase). - §0 + Status dates 2026-05-29 → 2026-06-02 - correct misleading aif-handoff DEFER-ALL row: add `runtime-bridge BUILD` row (minimal-REST bridge shipped #312/#313 + ecosystem; supersedes-in-practice) - +8 umbrella rows for work merged since last reconcile (runtime-bridge, aif task-isolation, companion adoption, coordination-persistence, qloop, mutation-discipline, worktree dual-channel, doc-audit-ship-boundary) - add "Open frontier" block (live: #372 open, inject-layer-extension, one-click-installer, f2-aif-fire-backend) — distinct from ~80 closed candidates - add "How §0 stays current (by design)" note to Status block so future sessions don't try to automate the deliberately-manual reconciliation Prior-art: skipped — doc-only status reconciliation of an existing planning doc, no new capability or dependency introduced. * chore(orchestrator): mark mutation-discipline-umbrella DONE (#385) Umbrella closure per CLAUDE.md "Umbrella closure convention" — Final PR #383 (D.6 drift-check, last residual) merged to staging. All stages shipped: A audit #219 / B bash-mutator #366+#373 (dogfood gate fired) / C tests-of-tests #378 / D #381 + D.6 dup R-phase #382 + D.6 drift-check I-phase #383. done.md is the priority-score.sh Layer C3 completion marker (gitignore:14 un-ignores */done.md). Prior-art: skipped — completion marker (done.md), no new capability/dependency/code. * fix(principle-12): skip anti-tautology mutation test when no real (non-mirror) kickoffs exist (#386) The anti-tautology sub-test mutates a REAL compliant kickoff to verify the compound-citation detector actually catches absence. After the coordination symlink migration (#346 + post-checkout link-coordination.sh), every local kickoff.md is a SYMLINK into $CANON — a coordination mirror that getNonExemptEntries() deliberately excludes (isCoordinationMirror). With all kickoffs mirrored, getNonExemptEntries() is empty → `compliant` is undefined → `expect(compliant).toBeDefined()` failed on every host push (reproduced on staging HEAD, independent of any feature branch). The #376 mirror-exclusion fix updated the main check + population sentinel but missed this meta-test. Guard it with HAS_REAL_NONEXEMPT_KICKOFF: when there is no real kickoff to mutate, skip — detector correctness is already covered by the pure-logic anti-tautology tests (blank file / each pattern), which need no files. Unblocks all host pushes (pre-push runs the principle suite). No behaviour change to the citation enforcement itself. * fix(runtime-bridge): dispatch via planner-run so each task gets its own worktree (parallel) (#387) The bridge dispatched tasks with `accept_existing_plan`, which transitions backlog -> plan_ready SKIPPING the `planning` stage. runPlanner (planner.ts, the ONLY code that creates a per-task git worktree) runs only at `planning`, so 0 tasks ever got a worktree -> all dispatched tasks forced serial. Verified + live-proven in #372 (research-patches/2026-06-02-aif-worktree-gap.md). Fix (Option B, live-verified 2026-06-03): - Drop the `accept_existing_plan` event. The task stays at `backlog`; the auto-queue advances it through `planning` -> runPlanner -> per-task worktree. - Carry the kickoff in `description` (the planner INPUT spec, planner.ts:246), NOT in `plan` (the planner OUTPUT slot @planPath, which it overwrites). The planner plans the *how* from our kickoff *what*. Live acceptance: two tasks dispatched concurrently each got a DISTINCT worktree and both ran in `planning` simultaneously (N agents x N workspaces, not within-task subagents). Throwaway probe tasks + worktrees cleaned up. Tests: rewrote the dispatch sequence test for the 2-step flow (asserts description=kickoff, no accept_existing_plan, no plan push) and moved the rollback test's failure point to the unpause step. 8/8 green. Prior-art: skipped — modifies existing bridge file, no new capability/dependency/module. * research(aif-operator-asset-access): R-phase — gap verification + A-E verdict + recommended composition (#388) Five gap rows re-confirmed with file:line evidence. Existing skill-context/ and agents/*.md mechanisms audited (T16 problem-class check) — none cover orchestrator/reviewer discipline. Recommended composition: B+D (in-repo agnostic worker discipline, primary) + A (operator bind-mount, immediate) + C (buildKickoffSpec sibling inlining, follow-on). E rejected. DN-1/2/3 surfaced; DN-1/2 resolved inline (B scope = minimum viable worker discipline; reviewer-discipline = separate concern covered by review-sidecar.md). Prior-art: prior-art-evaluations.md#67 (aif-handoff, ADOPT — this umbrella extends it with operator-asset bridging); prior-art-evaluations.md#50 (skill-context/aif-review SSOT, ADOPT channel — D reuses this delivery pattern). * fix(meta-orchestrator): Stage 2 correctness — C1.1/C1.2/C1.3/M4/F2/F7 (#389) Six confirmed bugs fixed in the meta-orchestrator skill: C1.3 — SKILL.md:449: stale repo-root mirror claim removed; replaced with "Ships directly from .claude/skills/meta-orchestrator/ via install.sh (single source of truth; no repo-root mirror — Item 12 closure 2026-05-25). Install pattern at install.sh:236-255." C1.2 — SKILL.md:508: state.md section names corrected from stale "§2 Launch-table / §3 Dispatch log" to actual template names "§2 Decisions / §3 Phase -1 verdict" (state.md.template:26,35). C1.1 — master-backlog-delta.md:49-52: "Body owns arrays — inline-jq" claim removed (inline jq was removed in F.3 PR #261 2026-05-28); delta-write-from-state.sh correctly attributed as array owner. M4 — SKILL.md:521-525: delta two-helper ordering fixed. update-delta.sh (bootstraps schema) now listed first, matching delta-write-from-state.sh:19. F2 — SKILL.md:71: head -200 raised to head -400; wave-sequencing-plan.md is 293 lines so head -200 dropped 93 lines incl. §6 dependency-matrix. F7 — run-helper.sh:26: timeout wrapped (MO_HELPER_TIMEOUT env, default 120s); END trailer still fires on expiry (rc=124). failures.md: F9 added. Prior-art: skipped — correctness fixes to existing prose/helper, no new capability Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(aif-worker-discipline): portable worker discipline agent + AIF skill-context delivery (#390) * feat(aif-worker-discipline): portable worker discipline agent + AIF skill-context delivery Artifacts 1 (B) and 2 (D) from aif-operator-asset-access I-phase. - agents/orchestrator-worker-discipline.md: portable AI-agnostic worker discipline (REPORT schema, park-vs-proceed, stage-gate, §1.7 PR body) for aif-dispatched workers. Class B. @dual-pair: aif-orchestrator-discipline. - packages/core/templates/shared/skill-context/aif-orchestrator-discipline/SKILL.md: AIF-native delivery of the same content. YAML from aif-review/SKILL.md (SSOT #50). @dual-pair + spec: per dual-implementation-discipline.md §5. - packages/core/principles/09-doc-authority-hierarchy.ts: added aif-orchestrator-discipline/SKILL.md to REQUIRED_HEADER_DOCS (shippedSubset 16→17). Upper sentinel 60→65; Wave-4 length sentinel 16→17. - install.sh: aif-orchestrator-discipline/SKILL.md added to SHIPPED_DOCS. §1.7: forward — agents/orchestrator-worker-discipline.md:9 authority header per doc-authority-hierarchy.md §3; install.sh:103 in sync with REQUIRED_HEADER_DOCS per 09-doc-authority-hierarchy.test.ts:164 Wave 4 invariant. backward — SKILL.md:10-11 carries @dual-pair + spec: per dual-implementation-discipline.md §7. Prior-art: prior-art-evaluations.md#50 (skill-context/aif-review, ADOPT channel pattern). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(runtime-bridge): add operator convenience bind-mount section for global skills Adds '## Operator convenience: mount global skills' section at the end of docs/runtime-bridge-setup.md documenting how to bind-mount operator-side global skills (~/.claude/skills/orchestrator/, Superpowers plugins) into the aif container via docker-compose.override.yml. Operator-axis only — consumers of the shipped framework are NOT required to have these paths. The shipped in-repo discipline works without the mount. Artifact 3 (A-docs) from aif-operator-asset-access I-phase. Prior-art: skipped — doc addition, no new capability Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(meta-orchestrator): add harvest egress step to autonomous dispatch loop (#391) aif does NOT push or open PRs by design (documented in harvest.ts:11-14). Nothing in the dispatch loop said "after status=done → call harvest" — this was the gap that caused the aif-operator-asset-access I-phase to sit stuck in the container with work done but no PR opened (incident 2026-06-03). Fix: add egress gate to SKILL.md §5 autonomous dispatch row and to meta-kickoff.template.md §4c so every generated kickoff carries the harvest call as a mandatory post-done step. Anti-pattern #autonomous-done-no-harvest added to SKILL.md §5. Prior-art: skipped — doc-only change to .claude/skills/ and templates/, no new capability (refactor only, harvest.ts already shipped). * chore(orchestrator): mark aif-operator-asset-access DONE (#392) * docs(m…

…rrides where unavoidable (#980) Fixes all 16 open Dependabot alerts (triage-first, per-alert rationale below). Two atomic commits: lock/manifest bumps; drizzle fixture pins. No new dependencies — overrides entries and in-range bumps only; not a capability commit. ## Per-alert disposition | Alerts | Package | Fix | Mechanism | |---|---|---|---| | #17-#24 (7×, incl. **critical** CVE-2026-33937) | handlebars 4.7.8 → 4.7.9 | root lock | `eslint-plugin-boundaries ^5.0.0 → ^6.0.2` in `packages/preset-react-spa/package.json:26` — 6.0.2 pins `@boundaries/elements 2.0.1` → handlebars 4.7.9. Chosen over also-available ^7.0.2 as the smaller major jump with the same security outcome. The shipped template `packages/preset-react-spa/templates/eslint.config.react.mjs` is unchanged: v6 keeps the explicitly-configured legacy `element-types` rule + `boundaries/elements` settings working. | | #4, #5 (CVE-2026-8723) | qs 6.15.1 → 6.15.2 | both locks | `overrides` in root `package.json` + `packages/core/package.json` — **unavoidable**: latest typed-rest-client (3.0.0) still pins vulnerable qs 6.15.1 exactly (verified against the npm registry). | | #27 (CVE-2026-53550) | js-yaml 4.1.1 → 4.2.0 | root lock | `overrides "js-yaml": "4.2.0"` — parent markdownlint-cli2 pins exact 4.1.1; its fixed release 0.23.0 requires node>=22 while CI runs node 20, so the parent bump is blocked. Exact spec matches packages/core's direct-dep spec (npm direct-dep override rule). | | #12 (CVE-2026-48988) | markdown-it 14.1.1 → 14.3.0 | root lock | `overrides "markdown-it": "^14.2.0"` — same markdownlint-cli2 exact-pin reason. | | #10, #13 (CVE-2026-49356) | @babel/core 7.29.0 → 7.29.7 | both locks | in-range `npm update` (parents allow ^7.x / ~7.29.0). | | #7 | esbuild 0.28.0 → 0.28.1 | packages/core lock | in-range `npm update` (tsx ~0.28.0, vite ^0.28.0). Root esbuild was already 0.28.1. | | #16, #28 (CVE-2026-39356, high) | drizzle-orm ^0.40.0 → ^0.45.2 | 2 fixture manifests + stub | `packages/core/detector/fixtures/hono-drizzle-monorepo/apps/api/package.json:5`, `packages/core/research/fixtures/tier1-single-root/package.json:3`, stub `.../node_modules/drizzle-orm/package.json` bumped in lockstep. Consuming tests verified version-insensitive (name-based detection; `research-plan.json` has `version: null`) — fixed, not dismissed. | ## Notes - **Synth bundle deliberately NOT regenerated:** the bundle is built by ROOT esbuild (`scripts/build-synth-bundle.sh:17` uses `$ROOT/node_modules/.bin/esbuild`), which was already 0.28.1 and is unchanged; the packages/core esbuild bump is a non-feeding transitive. `NODE_ENV=development build-synth-bundle.sh --check` green after fresh `npm ci` of both locks. - **Consumer note (preset-react-spa):** boundaries v6 changes the `dependency-nodes` default from `["import"]` to `["import","export","require","dynamic-import"]`. Consumers may see new (legitimate) `boundaries/element-types` findings on `export … from` / `require()` / dynamic-import edges — stricter, not broken. - **Expected `npm ls` marker:** `invalid: qs@6.15.2` under typed-rest-client is the documented override-forced exact-pin violation (the point of the fix); no CI gate runs `npm ls`. ## Verification - Full local CI-equivalent gate set green: typecheck, full packages/core suite (2288 tests, 0 failed), `format:check`, `NODE_ENV=development build:synth-bundle:check`, `render-rules --check`, `render-rule-index --check`, install-sh `gh-534-arch-boundaries` + `f17-lint-rules-planted-violation` + `byte-identical` (fingerprints unchanged — no SNAPSHOT_MODE regen needed). - Lock integrity independently re-verified from clean state: `npm ci` (root) and `npm ci --prefix packages/core` both exit 0; every touched lock entry has version+resolved+integrity; zero unexpected version changes in either lock diff (only intended packages + their transitive helper chains). ## §1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files) ### §1.7 Forward-check applied This PR introduces no new rule; the forward obligation is that each fix lands at the earliest reachable channel and is executable, not prose: vulnerable versions are excluded structurally by manifest constraints — `package.json:6-10` (overrides block), `packages/core/package.json` overrides, `packages/preset-react-spa/package.json:26` (^6.0.2 floor) — so any future `npm install` cannot silently re-resolve a vulnerable version; regressions fail at install/lock level, before CI. ### §1.7 Backward-check applied Class of this change = dependency-version-constraint updates. Surfaces where the class occurs, each swept: root `package-lock.json` (all 6 target packages patched, no residual vulnerable entries — verified over the full lock, not the diff); `packages/core/package-lock.json` (qs/@babel/core/esbuild patched; contains NO handlebars/js-yaml/markdown-it entries → no overrides needed there); fixture manifests `packages/core/detector/fixtures/hono-drizzle-monorepo/apps/api/package.json:5` + `packages/core/research/fixtures/tier1-single-root/package.json:3` + its stub (bumped in lockstep, internally coherent); other fixture manifests under `packages/core/**/fixtures/` (swept — no other pinned occurrences of affected packages); shipped templates + `install.sh` (grep: zero version pins of affected packages); synth bundle `packages/core/synthesizer/synth-and-wire.bundle.mjs` (not fed by the core esbuild entry — `scripts/build-synth-bundle.sh:17`; `--check` green); install fingerprints/baselines (`tests/install-sh/byte-identical.test.sh` green — unshifted).

artyhoo added 3 commits May 10, 2026 21:04

artyhoo merged commit 95d45dc into main May 10, 2026
16 checks passed

artyhoo mentioned this pull request May 11, 2026

docs(wave-5): readiness REVISE fixes — SSOT ID remap + §13.25 status #30

Merged

4 tasks

artyhoo mentioned this pull request May 11, 2026

fix: wave-5 readiness — AIF Handoff overlap analysis + scope annotations (SSOT #27-#29) #31

Merged

5 tasks

artyhoo added a commit that referenced this pull request May 11, 2026

Merge pull request #31 from Yhooi2/fix/wave-5-readiness-revise

1fa4271

fix: wave-5 readiness — AIF Handoff overlap analysis + scope annotations (SSOT #27-#29)

artyhoo mentioned this pull request May 11, 2026

fix: wave-5 readiness — second SSOT ID remap #27-#32 → #31-#36 (AIF Handoff overlap closure) #32

Merged

4 tasks

artyhoo added a commit that referenced this pull request May 11, 2026

Merge pull request #32 from Yhooi2/fix/wave-5-readiness-revise

ea34be3

fix: wave-5 readiness — second SSOT ID remap #27-#32 → #31-#36 (AIF Handoff overlap closure)

artyhoo added a commit that referenced this pull request May 16, 2026

Merge pull request #54 from Yhooi2/docs/aif-ssot-corrections

998cb42

docs(ssot): correct AIF Handoff attribution + add aif-handoff monorepo entries (#27-#30 + #42-#46)

artyhoo mentioned this pull request May 20, 2026

docs(research): cross-worktree gitignored coord-doc sync — verdict ADAPT (symlink-to-canonical) #78

Merged

8 tasks

artyhoo mentioned this pull request May 22, 2026

docs(rules): DN-4 round 2 — recommendation + preserve + own-QA codification #161

Merged

5 tasks

artyhoo mentioned this pull request May 22, 2026

docs(n7): dogfood companions — parallel-subwave §4 demotion + SSOT #64/#65 + retention=A #166

Merged

6 tasks

This was referenced May 29, 2026

research(aif-handoff-bridge): Sub-wave B2 — Variant B' (hybrid CC-hook + aif-handoff MCP) REFERENCE #275

Merged

research(aif-handoff-bridge): Sub-wave C — Variant C (minimal bridge, Implementer-equivalent only) value-add audit #276

Merged

artyhoo mentioned this pull request May 29, 2026

research(aif-handoff-bridge): Sub-wave D — Synthesis + cross-variant verdict (DEFER-all-with-updated-triggers) #281

Merged

12 tasks

This was referenced Jun 3, 2026

research(aif-skills-delivery): industry survey + verdict for skills-in-container delivery #393

Merged

docs(dispatcher-skill): Stage 0 R-phase — loop design + primitive-reality + BFR=BUILD #402

Merged

artyhoo mentioned this pull request Jul 11, 2026

fix(deps): resolve all 16 open Dependabot alerts — triaged bumps, overrides where unavoidable #980

Merged

Navigation Menu

docs(research-patches): Wave 6 AI-doc cold audit (§13.26) - #27

docs(research-patches): Wave 6 AI-doc cold audit (§13.26)#27
artyhoo merged 3 commits into
mainfrom
wave-6/ai-doc-cold-audit

artyhoo commented May 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

artyhoo commented May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

REPORT block (per source-prompt CONSTRAINTS)

Notes for reviewer

Related

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

artyhoo commented May 10, 2026 •

edited

Loading