docs(ssot): correct AIF Handoff attribution + add aif-handoff monorepo entries (#27-#30 + #42-#46) - #54
Merged
Merged
Conversation
…3.4/§13.5/§13.9 Post-Wave-9 prioritisation session D8 outcome on the 5 «wishful trigger» entries flagged by Wave 9 R-phase category C7 «Process-and-prose artifacts»: §13.1 «Granularity research, детально» — CLOSED (empirically validated). Phase 5/6 shipped at the hypothesized 1-pattern-per-file granularity: 9 production research files at packages/core/research/store/ (next/15.x: 1, next/16.x: 3, next/any: 3, shared: 2). No Server-Actions-style 7-sub-pattern split occurred. Trigger-sweep report 2026-05-08 already evidenced this (research-patches/2026-05-08-trigger-sweep-report.md:22); entry lagged in tracking. Moved to closed-questions.md preserving §13.1 anchor. §13.2 «Маркетинг и наименование» — ARCHIVED (wishful, pre-launch). 0 consumers; positioning concern with no formal trigger condition. Surfaces cognitive overhead for AI sessions reading the registry. Re-opens naturally when consumer-facing material is drafted, project rename proposed, or third-party material surfaces naming friction. §13.4 «Обработка legacy кодовой базы» — FORMALIZED. Trigger: first consumer onboarding reports adoption friction with ≥100 pre-existing violations on initial setup.sh run. §13.5 «Multi-stack monorepos» — FORMALIZED. Trigger: first multi-stack monorepo consumer (apps/web + apps/api + packages/shared shape), OR Phase 11 AIF integration entry research kicks off. §13.9 «Bypass через --no-verify» — FORMALIZED. Trigger: Wave 10 hook architecture closure (bash → TS-core migration) — natural fit since Wave 10 already touches hook architecture; OR first observed bypass incident in maintainer or consumer repo. TOC rows in open-questions.md: §13.1+§13.2 removed; §13.4/§13.5/§13.9 status flipped from «open, deferred» → «open, armed». TOC rows in closed-questions.md: §13.1+§13.2 inserted in numerical position before §13.3. Archive entries appended in numerical position. Bodies of armed entries gained explicit **Trigger:** lines per the kickoff's formalize clause. Distribution check (T-NS-A counter-bias): 3 formalize + 1 archive + 1 empirically-validated closure. Not all-archive; passes the archive-by- default bias counter-prompt from .claude/rules/ai-laziness-traps.md. §1.7 not triggered: this commit touches docs/meta-factory/open-questions.md + closed-questions.md only — neither path is in the pre-push hook s17 predicate (.husky/pre-push:319-320 limits to .claude/rules/, principles/, SKILL.md) nor in the discipline-self-check.yml CI path filter (.github/workflows/discipline-self-check.yml:14-21, which lists specific EXECUTION-PLAN.md + prior-art-evaluations.md files but not the registry files). Mechanical archive/formalize maintenance, no rule/principle/skill introduction. Prior-art: skipped — non-capability mechanical doc maintenance (archive/formalize 5 wishful triggers per D8 resolution; zero new dependencies, zero new files, zero new ≥50-LOC content; only existing-entry moves + Trigger-line additions in registry docs).
…o entries (#27-#30 + #42-#46) Corrects 4 wrong-repo attribution errors in SSOT entries #27-#30 (AIF Handoff family), all produced by the 2026-05-11 context7 sweep that queried only `/lee-to/ai-factory` without distinguishing `lee-to/aif-handoff` as a separate repository. Adds 5 new entries #42-#46 for DeepWiki MCP and 4 aif-handoff package primitives, all verified via fresh DeepWiki ask_question queries on 2026-05-16. ### §1.7 Forward-check applied This commit edits `docs/meta-factory/prior-art-evaluations.md` only — attribution corrections to existing SSOT rows + 5 new rows appended. No code, no capability commit. - **Layer 1 (rule self-consistency):** SSOT §3 entry-trigger criteria unchanged; §1 schema unchanged; §2 verdict semantics unchanged; §5 staleness policy unchanged. Corrections only update `Candidate` name field (now includes package path) and `Last reviewed` date from 2026-05-11 → 2026-05-16. — prior-art-evaluations.md:14-30 (schema), :47-60 (entry-add procedure), :113-135 (staleness policy) - **Layer 2 (cited-file existence):** each corrected entry's new citation verified via fresh DeepWiki ask_question 2026-05-16: - #27 `docs/mcp-sync.md`: context7 `/lee-to/aif-handoff` returned snippet from `github.com/lee-to/aif-handoff/blob/main/docs/mcp-sync.md` confirming HANDOFF_MODE env var at load time - #28 `packages/shared/src/stateMachine.ts`: DeepWiki confirmed paused field in @aif/shared, state machine in stateMachine.ts — https://deepwiki.com/search/where-is-the-pausedtrue-field_5b694046-a22b-45d7-a9ff-8d520cdb6ce1 - #29 `packages/shared/src/sync.ts` (insertPlanAnnotation/parsePlanAnnotations) + `packages/agent/src/subagents/planner.ts`: DeepWiki confirmed PAIR-attribution — https://deepwiki.com/search/is-there-a-handofftask-annotat_7de90b12-5d36-4f6a-952f-5145f2245d78 - #30 `packages/agent/src/subagents/planner.ts` + `implementer.ts` + `reviewer.ts` + `coordinator.ts`: DeepWiki confirmed 3 subagents not one implement-coordinator file — https://deepwiki.com/search/describe-the-planner-implement_3216df38-d6a3-42ea-935b-58abc696b2ce - #43 `packages/runtime/`: DeepWiki confirmed RuntimeAdapter interface + registry — https://deepwiki.com/search/describe-the-aifruntime-packag_ef408848-368e-4d4a-870e-af9d51c1567f - #44 `packages/mcp/`: DeepWiki confirmed MCP tools + handoff_sync_status bidirectional sync — https://deepwiki.com/search/describe-the-aifmcp-package-wh_3bda4062-8f45-4055-a316-0f371ed311a2 - #45 `packages/agent/src/taskWatchdog.ts` + `stageErrorHandler.ts`: DeepWiki confirmed three watchdog layers + error classifier — https://deepwiki.com/search/describe-the-watchdogs-error-c_11b95c86-96e3-4879-980b-85a882d538a3 - #46 Subagents/Skills dichotomy: DeepWiki confirmed AGENT_USE_SUBAGENTS env var + executionMode native_subagents/standard — https://deepwiki.com/search/what-are-the-two-execution-mod_6ac0cfd0-3e83-4db7-8152-c67c9a7af074 - #42 DeepWiki MCP: verified in research-tooling-evaluation session 2026-05-16 via experimental comparison §3 Q1-Q3 in docs/meta-factory/research-patches/2026-05-16-research-tooling-evaluation.md:84-200 - **Layer 3 (cross-doc consistency):** aif-comparison.md checked — no SSOT #27-#30 citations found (grep returned empty on aif-comparison.md for #27/#28/#29/#30). No contradicting attribution in that doc. - **Layer 4 (consumer-facing impact):** no shipped artefacts changed — no AGENTS.md, no template changes, no packages/ edits. Internal SSOT only. - **Layer 5 (trigger sweep):** #42 entry satisfies DeepWiki ADOPT-CONDITIONAL; #43-#46 add aif-handoff package entries with ADOPT VOCABULARY / DEFER / ADAPT verdicts. No §13.x open-question entries opened (per kickoff §7 anti-deliverable). No capability commit (no new dep in package.json, no new file ≥80 LOC under packages/). Prior-art: skipped — SSOT corrections + new SSOT entries only, no new capability artifact; this commit IS the SSOT registration act, not a capability that needs Prior-art citation. ### §1.7 Backward-check applied Backward sweep of all artefacts that cited old (wrong) attribution paths from #27-#30: - **research-patches/2026-05-11-aif-handoff-overlap-analysis.md** — cites old paths (`skills/aif-implement/SKILL.md`, `handoff_sync_status`, `skills/aif-plan/SKILL.md`, `subagents/implement-coordinator.md`) as context7 2026-05-11 evidence. These citations are VALID AS HISTORICAL RECORD — they document what context7 returned at that time, which is the root-cause evidence for the attribution errors corrected here. No edit needed; citations remain accurate as evidence of the original wrong-repo sweep output. File: docs/meta-factory/research-patches/2026-05-11-aif-handoff-overlap-analysis.md:35-36,48,54-57,66-68,225-227 - **research-patches/2026-05-11-aif-primitives-deep-dive.md** — cites SSOT #28 and #29 IDs correctly (by ID, not by wrong path). Citations to «SSOT #28 trigger» and «SSOT #29 annotation» remain valid post-correction because the IDs are stable and verdicts are unchanged. File: docs/meta-factory/research-patches/2026-05-11-aif-primitives-deep-dive.md:10,28,50,56,73,86,91,227,247 - **research-patches/2026-05-16-research-tooling-evaluation.md** — cites SSOT #27-#30 as a group requiring correction; documents #43-#46 as proposed entries. Attribution corrections in this commit fulfill that research-patch's proposals. Valid post-correction. File: docs/meta-factory/research-patches/2026-05-16-research-tooling-evaluation.md:3,242 - **research-patches/2026-05-16-§17-think-time-gate.md** — cites SSOT #28 and #29 by ID for ORT analysis. ID-based citations remain valid; verdicts (DEFER/ADAPT) unchanged. File: docs/meta-factory/research-patches/2026-05-16-§17-think-time-gate.md:197,387,405 - **aif-comparison.md** — grep found zero #27/#28/#29/#30 citations. No update needed. File: docs/meta-factory/aif-comparison.md (verified 2026-05-16, zero hits) - **Wave 8.x / 9.x retros** — not searched individually; retros live under docs/meta-factory/retros/ (closed historical artifacts per CLAUDE.md Artifact Ownership Contract; read-only post-merge). Any citations there are historical and pre-date corrections; no update warranted by retro ownership policy. **Verdict:** no backward-breaking citation changes. All existing docs citing #27-#30 do so either by ID (stable, unaffected by attribution correction) or as historical evidence of the original context7 sweep output (valid as-is). New entries #42-#46 introduce no backward references to update.
This was referenced May 16, 2026
artyhoo
added a commit
that referenced
this pull request
May 21, 2026
…ollow-up) (#110) Closes the build-vs-reuse discipline gap from PR #107: run-check.ts is a capability artifact (91 LOC) whose ADAPT verdict lived only in research patch §4.8.X.1, never in the canonical append-only register. Cold-review (2026-05-21) flagged it MAJOR — substantive prior-art analysis done, SSOT registration missing. Row #54 records the verdict from that evidence; no behaviour change.
5 tasks
artyhoo
added a commit
that referenced
this pull request
May 21, 2026
…ommit B) (#112) Ships the executable test for principle 15 per its design sketch (Commit A, #105). Each in-scope SKILL.md not in the EXEMPT_SKILLS allowlist must carry a body-section paired-negative block (`## Without this skill` + `## With this skill`, both non-trivial and differing — anti-tautology, mirroring principle 02). Grandfather = explicit EXEMPT_SKILLS allowlist (mirrors principle 09's EXEMPT_PATTERNS mechanism, NOT a date — the design's "date cutoff" wording is corrected to "allowlist" in §3/§5/§6/§7/§10). Self-test: positive + mutation 1a (no Without) + 1b (no With) + 2 (tautology) + 3 (exemption load-bearing). All 5 current skills grandfathered → CI stays green. ADAPT of Superpowers' «NO SKILL WITHOUT A FAILING TEST» (idea, no dependency; substrate-pure). SSOT #55 registered in this commit (#54 taken by Aider run_cmd via #110). §1.7 forward-check: principle 15 complies with build-first-reuse-default (ADAPT verdict, SSOT #55, zero Superpowers dep — substrate-pure per DECISION=C); no-paid-llm-in-ci (pure structural parse, no LLM); doc-authority-hierarchy (companion design.md carries header at packages/core/principles/15-skill-paired-negative.design.md:4); reviewer-discipline (marker form was maintainer-decided, not executor-picked). Mirrors principle 02's anti-tautology at packages/core/principles/02-paired-negative-test.test.ts:80. §1.7 backward-check: new rule scope = in-repo SKILL.md (.claude/skills/* + skills/*). Complete sweep satisfied by grandfather — all 5 current skills in EXEMPT_SKILLS at packages/core/principles/15-skill-paired-negative.test.ts:34; the exemption itself carries the load-bearing mutation-3 self-test at packages/core/principles/15-skill-paired-negative.test.ts:197 (proves the allowlist is load-bearing — same headerless skill passes IFF its path is in EXEMPT_SKILLS). No skill forced to change. Prior-art: prior-art-evaluations.md#55 (Superpowers TDD-for-Skills, verdict ADAPT — idea re-expressed for the SKILL.md artifact as principle 15; no dependency, substrate-pure).
artyhoo
added a commit
that referenced
this pull request
Jun 1, 2026
… 1) (#344) Build .claude/skills/meta-orchestrator/helpers/run-helper.sh — a trivial bash exec-wrapper that runs a target helper as a child and ALWAYS appends a terminal END-trailer to stdout: === <helper-name>: END rc=<exit-code> (lines=<stdout-line-count>) === so a session reading a slow helper's stdout in the background can distinguish "finished (rc=N)" from "still running / crashed". The trailer is appended by the parent wrapper, so it fires even when the child exits non-zero or dies mid-output (a child-side `echo END` would be skipped on `set -e` abort / SIGKILL / timeout). Fixes the orchestrator reading a header-only partial file as "zero results". HARD CONSTRAINTS satisfied (§2): exit-propagation (capture rc first, exit rc last — trailer echo never clobbers child status); trailer-on-crash; stdout verbatim pass-through; `=== `-prefix kept so classify-each-candidate.sh:52 `awk '... && !/^=== /'` strips it (never a spurious candidate). TDD: paired-negative test at packages/core/skills/run-helper.test.ts (positive clean-exit + negative exit-1 + SIGKILL crash-mid-output + parse-safety) — 4/4 green. No regression: `git stash -u` A/B shows the 5 neighbouring helper tests produce an identical pre-existing 18-fail set (env-dependent gh/git harnesses) with and without this file. T-BGB-A: the END trailer proves the child FINISHED + its exit code, NOT semantic content-completeness — kept in test names/comments. Prior-art: prior-art-evaluations.md — escape hatch: trivial bash exec-wrapper, no upstream analog worth a dependency (BFR BUILD, pre-reasoned). Nearest SSOT neighbour #54 (Aider run_cmd runner) is a different problem-class — exit-code routing in a TS pre-push gate vs. appending a structural completion trailer for a background reader (T16: similar "runner" name, distinct capability). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 tasks
artyhoo
added a commit
that referenced
this pull request
Jun 13, 2026
…+ runtime-bridge (134 commits) (#488) * feat(hooks): SubagentStop REPORT-schema WARN (non-blocking, #108 candidate-3) (#339) Ship .claude/hooks/warn-subagent-report.sh — scans the finishing subagent's output for canonical REPORT sections (VERIFY, Confidence, ATTN); emits a ⚠ stderr warning + exit 0 (non-blocking) when any are missing. Maintainer chose WARN over block (exit 2) — judgment target, not gateable (#gate-where-judgment-needed, rule-enforcement-channel-selection.md §1). Contract verified DUAL-CHANNEL 2026-06-01: Channel 1 — WebFetch code.claude.com/docs/en/hooks: SubagentStop fields include agent_type; exit 0 = non-blocking; stderr shown to user. Channel 2 — DeepWiki anthropics/claude-code: agent_transcript_path + last_assistant_message (since CC 2.1.47) confirmed by name + quoted. Two read paths (B1 — scan-nothing trap avoidance): 1. last_assistant_message if non-empty. 2. agent_transcript_path JSONL, reusing end-of-turn-reminder.sh:30-41. Noise guard: skip Explore agent_type + require standalone REPORT-cue label. Paired test: 6 cases (positive-A/B + negative + negative-2 Explore + non-report prose + exit-code invariant). All 6 green. Pre-existing staging failures (pre-push.test.ts + plan-currency-check.test.ts) unaffected. settings.json wiring snippet in PR body (maintainer lands, not committed). Prior-art: prior-art-evaluations.md#108 (SubagentStop REPORT-schema gate — candidate-3 of #108, shipped as WARN per maintainer decision 2026-06-01; block dropped — judgment target, #gate-where-judgment-needed). * docs(research-patches): satellite-feature-harvest — own-stack-first harvest + reverse-sweep (form B) (#328) Own-stack-first sweep: Claude Code natively ships the remote/scheduled/parallel-session cluster (Remote Control, Routines, Channels, agent-view, Slack) that prior SSOT rows credited to companions. 15 capability clusters triaged → 4 adopt-now (Remote Control, Routines via /schedule, Channels(Telegram), background agent-view) + 3 defer + 8 skip. Reverse sweep: 4 criterion-zero relationships, no shipped artefact retired (T-SFH-D — runtime-bridge questions.ts kept; Channels is session-open-only). +1 SSOT row #100. Prior-art: skipped — research-patch only, no new capability (the BFR own-stack-first survey is the patch content itself). * chore(hooks): wire pending CC hooks in settings.json (SubagentStart/Stop + runtime-bridge) (#340) Activates three already-merged, already-committed hook scripts that were running locally but never wired in the shared config: - PostToolUse Write|Edit|MultiEdit -> runtime-bridge-dispatch.sh (#313) - SubagentStart -> inject-subagent-digest.sh (#108 companion-adoption-iphase) - SubagentStop -> warn-subagent-report.sh (#108 candidate-3, #339) All hook scripts already exist in staging; this only activates them. Config-only wiring, not a capability commit. * docs(book): SubagentStop block-vs-warn — flip open-node DECISION-NEEDED → решён=WARN (#339) (#341) #339 (SubagentStop REPORT-schema WARN, non-blocking) merged to staging as 0596a64 — the block-vs-warn decision is resolved in favour of WARN. Hook remains INERT (no SubagentStop in settings.json) until the maintainer lands the snippet, so the node stays half-open: decided, not yet wired. - v1 (technical): chapter XXII + epilogue June-1 open-nodes list — cite #339 - v2/v3 (literary): keep allegory, no PR number — «нрав выбрали, в строй не поставили» Prior-art: skipped — doc edit only, no new capability (book open-node status sync after #339 merge). * refactor(hooks): remove end-of-turn factual-claim detector — net-negative sentry, dropped by evidence (#342) The claim-scan (numeric / file:line / negative-existence → re-verify nudge) in end-of-turn-reminder.sh measured recall ≈0.43 + precision ≈0.20-0.25 (cry-wolf) in the instruction-compliance pilot (2026-05-21). A sentry that misses most real claims and false-fires on ~75% of what it catches is the #discipline-theatre the project hunts. Maintainer decision 2026-06-01: «не нужен раз не работает». Same class + outcome as the recommendation-laziness narrow-B stop-scan dropped at FP 84% (#210): drop on FP evidence, keep the always-on H1 reminder. Surfaces: - hook: remove claim-scan block + has_claims/claim_count refs in idle-guard, trigger, glance-line, Branch D, append block. Trigger = long_text||asked; branches A/B/C only. Recap + question-check survive. bash -n + shellcheck clean. - tests/hooks/eot-claim-scan.test.sh: deleted (185 LOC, all claim-scan) + CI step. - packages/core/hooks/end-of-turn-reminder.test.ts: drop Branch-D + code-fence precision cases, add paired-negative «short claim turn now silent». 13/13 green. - research-patch documenting the evidence-based removal (scope annotation, §1.7). - book epilogue ×3: the «искатель утверждений» debt closed by removal, not fix. A short factual-report turn with no question now stays silent (was Branch D) — the intended consequence; that nudge was the cry-wolf. Prior-art: skipped — removal of an own-built net-negative mechanism, no new capability (cites instruction-compliance-empirical pilot + narrow-b-benchmark #210 precedent in the research-patch). * feat(runtime-bridge): harvest — deterministic aif-task to PR egress leg (#343) aif-handoff ends a task at "committed on a local feature branch" with NO push and NO PR-creation in its autonomous (HANDOFF) path — verified 2026-06-01 against the running containers (zero PR-create / branch-push anywhere in its autonomous flow; its commit/push lives only in an LLM-driven /aif-commit runtime). So committed work strands inside aif's checkout, never reaching a reviewable PR on the trunk. harvest is the missing return leg. - src/harvest.ts: pure DI'd core harvestTask — guards (terminal status, branchName present) BEFORE any side-effect; ordered push then createPr then auto-merge, fail-fast (PR error never arms auto-merge). - src/cli/harvest.ts: real wiring — docker-exec push from aif's container (holds the commit + working creds), host PR-create against staging, native auto-merge; graceful printed manual-fallback if docker absent. - test/harvest.test.ts: paired-negative (non-terminal / no-branchName must NOT push or PR; PR-fail must NOT arm auto-merge). - aifHttp.ts: expose branchName on AifTaskFull (read back by harvest). Zero LLM by construction (plain git+gh+docker) — unlike aif's own commit flow which spends a paid claude -p query just to run git. Complies with no-paid-llm-in-ci.md. Prior-art: prior-art-evaluations.md#27/#28/#30/#67 — aif-handoff's own runtime (HANDOFF_MODE / paused / Planner-Implementer-Reviewer / Kanban) is the from-side this leg bridges, NOT an egress tool: verified it has zero push/PR in its autonomous path, which is exactly why harvest exists. No upstream harvest-autonomous-agent-branch-to-PR analog; thin deterministic glue over gh/git/docker, no PR-creation reimplemented. BFR verdict: BUILD (bridge egress leg). * feat(meta-orch): run-helper.sh completion-barrier wrapper (TDD, stage 1) (#344) Build .claude/skills/meta-orchestrator/helpers/run-helper.sh — a trivial bash exec-wrapper that runs a target helper as a child and ALWAYS appends a terminal END-trailer to stdout: === <helper-name>: END rc=<exit-code> (lines=<stdout-line-count>) === so a session reading a slow helper's stdout in the background can distinguish "finished (rc=N)" from "still running / crashed". The trailer is appended by the parent wrapper, so it fires even when the child exits non-zero or dies mid-output (a child-side `echo END` would be skipped on `set -e` abort / SIGKILL / timeout). Fixes the orchestrator reading a header-only partial file as "zero results". HARD CONSTRAINTS satisfied (§2): exit-propagation (capture rc first, exit rc last — trailer echo never clobbers child status); trailer-on-crash; stdout verbatim pass-through; `=== `-prefix kept so classify-each-candidate.sh:52 `awk '... && !/^=== /'` strips it (never a spurious candidate). TDD: paired-negative test at packages/core/skills/run-helper.test.ts (positive clean-exit + negative exit-1 + SIGKILL crash-mid-output + parse-safety) — 4/4 green. No regression: `git stash -u` A/B shows the 5 neighbouring helper tests produce an identical pre-existing 18-fail set (env-dependent gh/git harnesses) with and without this file. T-BGB-A: the END trailer proves the child FINISHED + its exit code, NOT semantic content-completeness — kept in test names/comments. Prior-art: prior-art-evaluations.md — escape hatch: trivial bash exec-wrapper, no upstream analog worth a dependency (BFR BUILD, pre-reasoned). Nearest SSOT neighbour #54 (Aider run_cmd runner) is a different problem-class — exit-code routing in a TS pre-push gate vs. appending a structural completion trailer for a background reader (T16: similar "runner" name, distinct capability). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bg-helper-completion-barrier-stage2-aif (#345) * feat(meta-orch): route bg-helper call-sites through run-helper.sh + Layer-1 read-rule (stage 2) Wire the two background-helper !-fences in meta-orchestrator/SKILL.md through the already-merged run-helper.sh completion-barrier wrapper: - §2 Step 1 priority-score.sh - §2.5 Step 2 dup-detect.sh + inflight-check.sh Add the Layer-1 read-rule prose after both fences: parse a slow helper's output only after its task-notification or the `=== <helper>: END rc=<n> ===` trailer; a header-only read means "still running", not "zero results". Origin: incident 2026-06-01 (priority-score.sh read at header-only state → false "zero candidates"). Helper code untouched; the 5 helper tests show identical baseline (18 failed / 34 passed both with and without this edit — failures are environmental, `gh` absent). Wrapped fences valid bash; classify-each-candidate.sh:52 still strips the `=== `-prefixed trailer. Prior-art: skipped — SKILL.md call-site wiring only, no new capability (routes existing helpers through the already-merged run-helper.sh wrapper from PR #344). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(meta-orch): SKILL.md back to 600 lines — fold read-rule into §2 Step 1 (DRY) aif's Stage 2 added two verbatim read-rule blockquotes (+4 lines), tipping SKILL.md from 598 to 604 over the 600-line mechanical-check cap (real CI fail on #345). Phase -1 reviewer fix: fold the read-rule once into the §2 Step 1 intro with 'applies to every background-helper fence below', drop the §2.5 duplicate. Both run-helper.sh wraps intact; read-rule discipline preserved, now DRY. Not a capability commit (markdown edit). Prior-art: skipped — markdown CI-fix (line-cap trim + DRY), no new capability. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(closure): bg-helper-completion-barrier done.md (final PR #345) (#347) Last-stage merge marker per CLAUDE.md umbrella-closure convention — priority-score.sh Layer C3 reads this for DONE detection. Prior-art: skipped — closure marker file, no new capability (convention bookkeeping). * feat(coordination): symlink-to-canonical cross-worktree sync (SSOT #110) (#346) Build scripts/link-coordination.sh (per-file symlinks, adopt-then-link, conflict-loud, seed on empty CANON), wire it into both worktree helpers replacing the J5 rsync block, add link-coordination.test.ts (7 tests: symlink, git-clean, conflict, write-back, paired-negative, adopt, seed), reconcile worktree-setup-hydration.test.ts (drop rsync NON-DESTRUCTIVE, retarget paired-negative regex to link-coordination.sh call, assert symlinks), append SSOT row #110. Umbrella count confirmed: 124 (kickoff said 123 — stale). Prior-art: prior-art-evaluations.md#110 (cross-worktree gitignored-SSOT sync via symlink-to-canonical, verdict ADAPT) + research-patch 2026-05-17-cross-worktree-coord-doc-sync.md §5 — I-phase implementation of the settled verdict. * docs(runtime-bridge): per-command CLI reference README (Option B) (#348) Operator-facing reference manual for the six runtime-bridge CLI commands (answer, await, dispatch, harvest, park, questions), one section each with Usage / Flags / Example, derived from each cli/<cmd>.ts header docblock. Resolves the parked README-structure fork → Option B (per-command reference). Markdown only, 285 lines (< 600-line cap), no code changes. Prior-art: skipped — documentation only, no new capability (operator-facing CLI reference derived from existing docblocks) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(discipline): surface genuine forks via AskUserQuestion (autonomous-default, human-gate on ambiguous only) (#349) Operating model (maintainer decision 2026-06-01): autonomous by default; the human-gate fires ONLY on a genuine ambiguous fork. A clear call is decided and reported, not routed through a question. - recommendation-laziness-discipline.md §3: fork-surfacing companion to the evidence rule — ambiguous forks MUST be surfaced via AskUserQuestion, never decided by a silent direct action; ask-question-reminder.sh is the discriminator; reworded 'default=surface' -> 'autonomous-default, surface only genuine forks'. - recommendation-laziness-discipline.md §5: new anti-pattern #fork-decided-by-silent-action (incident: PR #348 battle-test, an explicitly-50/50 README fork auto-decided by running answer.ts directly). Judgment rule -> injection-only enforcement, never a gate (#gate-where-judgment-needed). - end-of-turn-reminder.sh Branch-A: backstop reminder for the 'decided a fork silently' path (the inverse of the existing offload check). Hook tests 20/20 green. Origin: 2026-06-01 question-loop battle-test dialogue. §1.7: forward — complies with rule-enforcement-channel-selection (judgment->injection), no-paid-llm-in-ci (deterministic .sh + prose), doc-authority (no new heading); backward — new anti-pattern scope = any-session fork behaviour, no existing rule superseded (reviewer-discipline §2 is reviewer-scoped), enforced by two already-shipped hooks. * feat(hook): orchestration-mode aware reminders + brainstorm cue (qloop items 2+6) (#350) * docs(spec): hook-nudge orchestration-mode design (brainstorm item 2+6) Design for orchestration-mode-aware behaviour of the two reminder hooks: marker-gated Bug A fix (drop low-precision fork-regex in-mode) + recap threshold lowering (b) + brainstorm nudge in ask-question-reminder.sh. Normal mode stays byte-for-byte. Origin: 2026-06-01 qloop battle-test brainstorm. Prior-art: skipped — design doc only, no new capability (markdown spec under docs/superpowers/specs/, no dependency/code-module). * docs(plan): hook-nudge orchestration-mode implementation plan (item 2+6, TDD) Prior-art: skipped — planning doc only, no new capability. * docs(spec): add §3.4 aif-pull-channel brainstorm nudge (formatHuman footer) Recursive-self-application gap from maintainer dialogue: ALL aif-parked questions (not just I-ask-via-AUQ) must get the brainstorm-first nudge. Footer ships in item 4's questions.ts PR (file-locality). Prior-art: skipped — design doc only, no new capability. * feat(hook): orchestration-mode gating — drop fork-regex (Bug A) + lower recap threshold (recap-b) Marker .claude/orchestration-mode (mtime TTL); normal mode byte-for-byte. Bug A: decision-MENTIONS stop false-firing the fork-challenge in-mode (regex gated on orch_mode=false); real Qs (?/AUQ) still caught. recap-b: recap fires on short structured status in-mode (threshold 500->200) keeping the markdown gate so chatter stays silent. 7 new tests + 13 pre-existing green (20/20). Spec: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md. Prior-art: skipped — internal CC hook tuning, no new capability or dependency. * feat(hook): brainstorm cue in ask-question-reminder (item 6) Design/strategy forks -> superpowers:brainstorming, not a bare AUQ card. Always-on prose nudge (judgment -> injection, never a gate). 1 new test (8/8). Prior-art: skipped — internal CC hook tuning, no new capability or dependency. * fix(runtime-bridge): surface mid-flight park in questions.ts + brainstorm footer (qloop item 4) (#351) isParked gains the mid-flight-park case: a task whose blockedReason was wiped by implementing→review still surfaces via the durable conjunction (paused===true AND the plan carries the OPEN_QUESTION_ANCHOR). New shared constant openQuestion.ts is the single SSOT for that anchor (writer park.ts, reader questions.ts) so the wording cannot drift (dual-implementation-discipline #two-prompts-drift). formatHuman appends the §3.4 brainstorm-first footer on a non-empty parked list (aif-pull-channel companion to ask-question-reminder.sh §3.3); empty case unchanged. Reproduced from the verified container fix (branch feature/qloop-realfix-d7585d), host-side, per handoff item 4. Design SSOT: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md (§3.4). Prior-art: skipped — bug fix on existing CLI + 17-LOC shared constant, no new capability/dependency. * feat(runtime-bridge): commit aif rework leg in harvest (qloop item 3) (#352) aif commits only on its approve_done && commitOnApprove path; the request_changes→implementing→done rework path leaves the work uncommitted (dirty tree, branch == base HEAD), so harvest had nothing to push. Extend the egress: hasUncommittedChanges → commitAll (templated message, ZERO LLM) before push. No-op on the normal path (tree already clean). Commit failure is fail-fast — nothing pushed, operator gets the printed fallback. Real dep guards that the container checkout is on the task branch before committing. aif-handoff source untouched (foreign runtime, SSOT #27) — fix lives entirely on our egress leg, matching harvest's graceful-degradation design. Prior-art: skipped — extends existing harvest CLI, deterministic git only, no new capability/dependency. * fix(principles): isolate p13 fixtures to tmpdir (kills p10↔p13 race) + exempt qloop-ux-probe probe (p12) (#353) Two local pre-push false-blocks found by qloop-ux-probe (neither is a real violation): F1 — principle 13 wrote its synthetic + c3-decoration fixtures into the REAL docs/meta-factory/research-patches/ dir, then unlinked them. Under vitest's parallel file run, principle 10's readdirSync globbed the transient file and ENOENT'd when 13 deleted it → a cross-file race (10 alone = 5/5 pass; full run = flaky ENOENT). Fix: write the fixtures to os.tmpdir() — checkSection reads content only, PATCHES_DIR membership was never required. Verified race-free across 3 consecutive full-trio runs. F2 — principle 12 flagged the gitignored qloop-ux-probe kickoff (a 2-question resume *test fixture*, not a work-delegating orchestration kickoff) for no AI-traps citation, failing every local push. It already skips in CI (KICKOFFS_AVAILABLE false). Added to EXEMPT_LIST with documented rationale. Full principle suite: 157/157. * fix(runtime-bridge): park.ts resolves API_BASE_URL so agent can park from inside aif container (#354) park.ts is the only CLI run from inside the aif agent container, which exposes the service as API_BASE_URL=http://api:3009 and does NOT set RUNTIME_BRIDGE_AIF_URL. The old localhost-only default was unreachable there (connection refused) -> park() got 'fetch failed' -> the agent could not park itself, so park-don't-guess (SSOT #109, meta-orchestrator §4c) was non-functional on the real autonomous path. New precedence: RUNTIME_BRIDGE_AIF_URL ?? API_BASE_URL ?? http://localhost:3009. Host orchestrator (sets neither) still gets localhost; container gets api:3009. Found by qloop-ux-probe Часть 2 live dispatch (taskId 5e32fcb9): agent correctly surfaced-not-hacked the park failure, but the task slid implement->review->done at $3.17 having parked nothing. resolveAifBaseUrl() extracted + unit-tested incl. a negative guard proven to go red on regression. * fix(runtime-bridge): don't record dedup on ManualBackend fallback + add --force (Finding B) (#355) dispatch.ts recorded a dedup entry unconditionally after Step 4 — even when the real backend threw (e.g. dirty_worktree 409) and it fell back to ManualBackend. That manual entry (which created no autonomous task) then blocked a legitimate real retry for the full 24h TTL, with no escape. qloop-ux-probe hit exactly this: after fixing the dirty worktree, the re-dispatch was refused as "already dispatched (backend=manual)". Fix: - shouldRecordDedup(backendName): record only for a real backend success, never 'manual'. - --force: skip the dedup check to re-dispatch the same kickoff deliberately. - kickoff path resolved as the first non-flag arg, so --force may sit anywhere. Three pure helpers, unit-tested incl. a negative guard. Full runtime-bridge suite 102 pass. * fix(runtime-bridge): questions.ts recovers mid-flight-park question from plan anchor (Finding E) (#356) A mid-flight park (paused:true + OPEN_QUESTION_ANCHOR in plan, blockedReason wiped by implementing→review) surfaced in the list — but parkedReason() rendered "(no reason recorded)" because it only read blockedReason + reviewComments, never the question text park.ts appended under the plan anchor. So the chat channel showed "there is a question" with no idea WHAT it asks (qloop-ux-probe Finding E, task ccebe39a). Fix: extractOpenQuestion(plan) pulls the text after the last OPEN_QUESTION_ANCHOR line; parkedReason precedence is now blockedReason → plan OPEN QUESTION → reviewComments → "(no reason recorded)". Unit-tested incl. multi-anchor (last wins) + a negative guard. Full runtime-bridge suite 100 pass. * fix(runtime-bridge): park.ts probes reachable base URL — agent env scrubs API_BASE_URL (Finding C-2) (#357) Finding C (#354) made park.ts READ API_BASE_URL, but the qloop-ux-probe live re-run proved that insufficient: the aif agent runs park.ts in a Bash-tool subprocess whose env is SCRUBBED of API_BASE_URL (the container's PID-1 env has it; the agent's exec env does not). So resolveAifBaseUrl() still fell back to localhost:3009 → unreachable inside the container → "fetch failed" → the task slid to done at $3.45 without parking, exactly as before. Fix: resolveReachableBaseUrl() probes candidate URLs and uses the first reachable one — [RUNTIME_BRIDGE_AIF_URL?, API_BASE_URL?, http://api:3009 (docker service), http://localhost:3009 (host)], de-duplicated. Works from BOTH the agent container (api:3009) and the host orchestrator (localhost) even when no env survives. main() now awaits the probe. candidateBaseUrls + resolveReachableBaseUrl unit-tested (injected fetch) incl. a negative guard proving it skips an unreachable first candidate. Full runtime-bridge suite 117 pass. * feat(runtime-bridge): bridge-health.sh ($0 container-side preflight) + bridge-cleanup.sh (junk sweep) (#358) Operator pain: "каждую сессию приходится чинить" + "мусор постоянно остаётся". Both are structural — the recurring bugs live on the host↔container↔aif boundary that unit/CI can't cover (a full agent run costs LLM tokens, no-paid-llm-in-ci), so they were only found live MID-TASK; and probe/smoke runs leave orphan tasks + /tmp files behind. bridge-health.sh — $0 deterministic CONTAINER-side preflight (docker+curl+grep, no task, no tokens). Each check maps to a real qloop-ux-probe finding: container checkout clean (A), park.ts carries the resolveReachableBaseUrl probe (C-2), a park candidate URL is reachable from inside the container (C/C-2), dedup store has no stale manual entries (B). Run at session start → "bridge red, fix first" instead of discovering breakage live. Complements verify-bridge.sh (host-side dispatch smoke). Live-dogfooded — caught + fixed a false-positive in its own reachability check (000 connection-fail vs real HTTP status). bridge-cleanup.sh — one-command sweep of test/probe junk: aif tasks matching a test-title allowlist (UXPROBE/smoke/probe — real work never matched), old /tmp ManualBackend kickoffs + dedup backups. Reports a container stash, never drops it (operator's git). --dry-run. Prior-art: extends own verify-bridge.sh operator-smoke pattern (packages/runtime-bridge/scripts) — no external prior art applies; project-specific aif-bridge container diagnostic + test-task sweep, not a general capability with an upstream analog. * fix(runtime-bridge): self-cleaning junk producers — junk no longer accumulates (no manual/AI sweep) (#359) Operator: "придумать как быть с мусором — его не должен чистить каждый раз ИИ". A manual cleanup script is still "someone cleans each time". The real fix is that each producer cleans up after itself, automatically, with zero AI/manual involvement. idempotency.ts — recordDispatch was append-only (file grew forever; a stale manual-fallback entry blocked retries for the full TTL). Now it PRUNES-ON-WRITE: rewrites the log keeping only within-TTL entries + the new one. Self-bounding, and stale entries (incl. Finding B's manual fallback) auto-expire by age — no --force needed after TTL, no sweep. ManualBackend.ts — dispatch wrote /tmp/runtime-bridge-<id>.md on every fallback and never cleaned them (days of accumulation). Now each dispatch first prunes its OWN stale artefacts (runtime-bridge-*.md older than 7d). Scope-guarded: only matches our files, only when stale, best-effort (never throws into the dispatch path). Pure cores (pruneStaleEntries / parseEntries / isStaleArtifact) unit-tested incl. negative guards (stale entry must not survive; unrelated old .md must not be pruned). Full suite 126 pass. This complements (does not replace) bridge-health.sh; bridge-cleanup.sh stays as a rare manual "nuke everything" escape hatch, not the routine mechanism. * fix(runtime-bridge): park.ts refuses to park at status=review (Finding F guard) (#361) A park that happens AFTER the implement→review transition left the task status=review, paused=true. On resume, aif runs the review pipeline straight to `done` WITHOUT re-implementing the injected answer — and the next chain question is never parked (live: task ba3b4bf6 answered c1 → done, c2 silently lost). Root cause is upstream-intentional: aif's HUMAN_ACTIONS_BY_STATUS.review = [] (stateMachine.ts) — there is no human re-entry from `review` into implement. Option B (per 2026-06-01-aif-task-isolation.md §4, maintainer-selected): a cheap our-side guard. parkTask already GETs the task, so the status is in hand — refuse the park at status=review and throw a clear message (park before review, or wait for done and use answer.ts request_changes). Turns the silent loss into a loud, actionable error. Does NOT add mid-flight re-implement (Option C, deferred). Paired-negative test: GUARD refuses + issues NO PUT at status=review; CONTROL still parks normally at a pre-review status (plan_ready). 19→21 tests green. Prior-art: skipped — bug-fix guard on existing park capability, no new dependency or capability commit. * docs: R-phase research-patch — aif task-isolation (Findings A + F) (#360) * docs(runtime-bridge): R-phase research-patch — aif task-isolation Findings A + F Finding A (dirty_worktree recurs): verdict config-fix. Per-task worktrees are gated by a 3-condition AND in planner.ts:191-195 — env AIF_TASK_WORKTREES_ENABLED=true is only gate 1; gate 2 project.parallelEnabled (DB parallel_enabled, web-UI toggle) is 0 and was never set, so worktrees are never created and the shared checkout is reused in-place → dirties → next dispatch 409s. Fix: flip parallel_enabled (no restart). Finding F (mid-flight park resumes review->done, never re-implements): verdict aif-upstream-issue (intentional design) + our-side-guard. stateMachine.ts:106 HUMAN_ACTIONS_BY_STATUS.review=[] -> no human re-entry into implement; request_changes only from done. DECISION-NEEDED for I-phase: Option B (park.ts guard rejecting parks at status=review) vs Option C (auto request_changes loop, ~4h). R-phase only — no production code changed. Evidence: parallel_enabled=0 (live DB query), worktree_path null across 10 tasks, reflog >=6 in-place checkout cycles, planner 3-gate + stateMachine review:[] source-verified. Scope annotation (principle 10) + §1.7 (principle 13). * docs(runtime-bridge): record Finding F resolution — Option B selected + shipped (#361) §4.1 + §7.3: DECISION-NEEDED-F resolved 2026-06-01. Maintainer selected the hard-guard path (surfaced as "Option B"). Records the exact shipped behavior honestly: park rejects only at status=review (the §4.1 Option-A semantics, NOT the stricter implementing-only Option B) — pre-implement parks (plan_ready) stay legitimate. Cross-refs PR #361. Option C deferred. * feat(runtime-bridge): ensure-parallel guard — self-heal Finding A on any instance (#362) aif creates a per-task git worktree only when project.parallelEnabled=1 (gate 2 of 3 in planner.ts). That flag is a DB field with NO env/config.yaml knob — only the web UI or raw DB sets it — so a freshly-provisioned instance has it 0, every task runs in-place on the shared checkout, and the next dispatch 409s on dirty_worktree (research-patch 2026-06-01-aif-task-isolation.md §1-§2; the live config-fix applied to this instance does not propagate to other instances). ensureParallelEnabled(baseUrl, projectId): GET /projects → if parallelEnabled is already true, no-op; else PUT /projects/:id with parallelEnabled=true. Wired best-effort into AifHandoffBackend.dispatch() Step 0 (warns + proceeds on failure, never blocks dispatch) and shipped as a standalone CLI (--project / env). Anti-clobber (load-bearing): aif has no targeted parallelEnabled write (only PATCH /:id/auto-queue-mode), and the full PUT NULLs any omitted *MaxBudgetUsd (@aif/data updateProject: `x ?? null`). So the guard round-trips the FULL field set read back from GET — flipping ONLY parallelEnabled — to preserve a UI-set budget. Paired-negative test pins this: a set budget MUST survive the PUT. Cleaner long-term fix = an upstream PATCH /projects/:id/parallel-enabled mirroring the existing auto-queue-mode PATCH (file against lee-to/aif-handoff); this guard is the our-side stopgap. 6 new tests green; runtime-bridge typecheck clean. Prior-art: prior-art-evaluations.md#109 (park.ts BUILD — same class: thin our-side runtime-bridge consumer CLI over aif REST where no upstream targeted primitive exists; here parallelEnabled-reconcile, no upstream PATCH beyond auto-queue-mode; cleaner fix REFERENCEd to upstream, this is the stopgap). * coordination-persistence-fix (#363) * feat(coordination): link-coordination.sh --on-conflict=canon|worktree|skip (default skip) Adds --on-conflict flag with three modes resolving the real-file-in-both conflict deterministically: skip (default, exit 1, never clobber), canon (canonical wins, relink), worktree (worktree wins, adopt into CANON). Invalid values exit 2. TDD: 4 tests in link-coordination.test.ts. Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; arg-parse + branch logic only, no new file/dep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(coordination): link-coordination.sh shares root _plan-cache.md + _master-backlog-delta.json (Part-2, SSOT #110) Adds a ROOT-FILE adopt-then-link + link pair so the two root-level gitignored coordination files (_plan-cache.md, _master-backlog-delta.json) are shared across worktrees — previously unmatched because the loops only iterated umbrella subdirs */. Tracked root README.md untouched. TDD: 3 tests in link-coordination.test.ts. Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; mirrors existing umbrella adopt/link loops for root files. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(hooks): i18n reminder payload — en canonical / ru operator (+ principle-12 exempt hygiene) (#364) * feat(hooks): i18n — split reminder payload into lang packs (en canonical / ru operator) The two reminder hooks (ask-question-reminder, end-of-turn-reminder) emitted Russian payload prose inline. Splits logic from payload: hooks keep all logic and source a language pack (.claude/hooks/lang/{en,ru}.sh) selected by AIF_HOOK_LANG (default en — canonical, for the public repo). Operator sets AIF_HOOK_LANG=ru once globally in ~/.claude/settings.json. - lang/en.sh + lang/ru.sh: aif_msg_* functions (${anchor} resolved at call time via dynamic scope) + AIF_RECAP_MARKER (recap heading; guard and message read the same var so they stay language-consistent). - lang/check-parity.sh: deterministic, no-LLM guard against #two-prompts-drift — asserts both packs expose the same key set. Local/reviewer step, not a blocking gate (hooks are @cc-only, not shipped). - Tests run the existing cases under AIF_HOOK_LANG=ru (RU-pack contract; Russian transcripts + assertions unchanged) + add an en-pack smoke per hook. - RU payload byte-identical to before; EN is a faithful translation. Behaviour preserved (30/30 hook tests green). Out of scope (surfaced): Russian code comments in the two hooks; other 11 hooks; questions.ts strings. Spec: docs/superpowers/specs/2026-06-01-hook-lang-i18n-design.md Prior-art: skipped — i18n refactor of existing internal hooks, no new capability (string externalization to lang packs, no dependency, no packages/ code module) * test(principle-12): drop stale 'qloop-ux-probe' from EXEMPT_LIST The qloop-ux-probe question-loop fixture dir (gitignored, added to EXEMPT_LIST 2026-06-01 by Finding F2) is gone — the positive-guard test correctly flagged it as a stale exempt entry ("exempted but now absent"). Remove it per the test's own instruction; 'aif-ssot-corrections' remains the sole exempt entry. Surfaced while unblocking the hook-i18n PR's local pre-push (principle 12 runs on gitignored kickoffs locally, skips in CI). Maintainer-invited in-session. Prior-art: skipped — principle-test allowlist hygiene, no new capability (one stale entry removed from EXEMPT_LIST + doc comment) * fix(runtime-bridge): bridge-cleanup §4 prunes MERGED container git junk (#365) Enabling per-task worktrees (parallel_enabled, #362) makes aif RETAIN worktrees post-terminal (research-patch 2026-06-01-aif-task-isolation.md §2.1), and the old in-place task checkouts had already left 14 stale feature/* branches on the shared checkout. The session janitor (#358/#359) deliberately did NOT touch container git. §4 extends it to prune ONLY container git merged into origin/staging: git worktree prune + remove retained non-main worktrees on merged branches + delete merged feature/* branches. SAFE BY CONSTRUCTION — `git branch --merged` filtering AND `git branch -d` (refuses unmerged) double-guard; unmerged in-flight work is never touched. Also fixes the docker-exec stdin bug (needs -i for `sh -s` heredoc). Completes the #359 "no manual/AI sweep" principle for container git state. This is operator/co-located tooling (docker exec); the portable fix is upstream auto-removal of retained worktrees (worth filing against lee-to/aif-handoff). Live-verified on the real container: dry-run + real run deleted 7 merged branches and preserved all 6 unmerged (+ the checked-out one). No unit test — matches the 4 untested sibling janitor scripts; safety is by-construction + live paired-evidence. Prior-art: skipped — extends an existing janitor script (no new dependency, no new >=80 LOC file, not a capability commit); the parallel-worktree capability it cleans up after is #362/#109. * feat(audit-self): bash-hook mutation testing — bash.rules + run-bash-mutation.sh (universalmutator ADAPT, local/on-demand) (#366) Stage 2 B.2 of mutation-discipline-umbrella. ADAPTs universalmutator (MIT, deterministic regexp engine + analyze_mutants harness — no LLM) to mutation-test .claude/hooks/*.sh against their paired-negative vitest tests. The only project-authored artefacts are bash.rules (operators), a thin wrapper, and the wrapper's own paired-negative test. Delivery = session-bound / local on-demand (NOT CI), mirroring Stryker-as-devDep; the original kickoff B.3 CI job is dropped. universalmutator is a dev-time tool, never consumer-shipped. Dogfood gate (mandatory) surfaced real, undocumented test gaps: end-of-turn-reminder 52% / validate-prompt 56% (both below the 60% floor) — the &&/|| mutation of their suppress/skip conditions survives uncaught. Recursive bootstrap: the wrapper mutated by its own operators is killed 13/13 by its own test. Found + fixed a /*-in-comment regexp-engine limitation (bash globs in comments falsely trigger C-block-comment mode) via a line-count-preserving sanitiser. Evidence: docs/meta-factory/research-patches/2026-06-02-bash-mutator-b2-shipped.md Prior-art: prior-art-evaluations.md#91 (universalmutator ADAPT — engine ADOPTed verbatim, only bash.rules operators authored; problem-class ~85% match per B.1 §B.1.5; mutahunter REJECTed on no-paid-llm-in-ci §1). * feat(coordination): persistence-fix tail — SW-B symlink-aware helpers + G/B/C installer (#368) * docs(coordination): design — cross-worktree persistence fix (4-channel: git-hook agnostic floor + CC + Superset + skill) Brainstorm output for coordination-persistence-fix umbrella. T16 corrections: - channel C substrate = Superset projects/<uuid>/config.json setup-array (rsync = root cause), NOT ~/.superset/hooks/ - adds git post-checkout (.husky) as the harness-agnostic floor per maintainer 'works everywhere' requirement - Q3 atomicity already satisfied (mktemp+mv verified); SSOT #110 same anchor Prior-art: skipped — design doc only, no new capability (extends link-coordination.sh SSOT #110). * docs(coordination): correct §2.4 — helpers atomic but NOT symlink-preserving (mv replaces symlink) Planning-phase finding (verified empirically): mv tmp <symlink> replaces the symlink with a real file → Part-2 cross-worktree share lost on first cache write. SW-B upgraded from 'confirm test' to 'make 3 helpers symlink-aware (write-through resolved target)'. Atomicity preserved (temp+mv in target dir), symlink preserved. Prior-art: skipped — design doc correction only, no new capability. * docs(coordination): implementation plan — 4 sub-waves (A linker / B symlink-aware helpers / C wiring / D self-apply) Prior-art: skipped — plan doc only, no new capability (implements SSOT #110 extension). * feat(coordination): one-click install-coordination-wiring.sh (G+B+C, idempotent, self-test) Applies all 3 wiring channels in one terminal command (maintainer runs from central repo): G .husky/post-checkout (agnostic floor) B .claude/settings.json SessionStart C ~/.superset/projects/*/config.json setup (replaces rsync root-cause) --self-test (sandbox) + --dry-run modes; idempotent re-runs. Replaces the manual runbook. Prior-art: skipped — scripts/ helper, not a capability commit (no dep, not under packages/); wires existing link-coordination.sh SSOT #110. * fix(coordination): 3 cache/delta helpers symlink-aware (SW-B) resolve_target() follows a symlink to its real $CANON target so the atomic temp-then-mv write writes THROUGH the link instead of replacing it. Without this, the first cache/delta write breaks the cross-worktree share (mv tmp <symlink> → real file). +3 paired-negative tests (symlink preserved + canon written through); 18/18 green. Done locally (not via aif — container serialized on doc-audit task). Prior-art: skipped — symlink-preservation fix to existing helpers, no new capability; extends link-coordination.sh SSOT #110 share semantics. * docs(coordination): drop channel A (skill self-heal) — redundant after G git-hook B (CC SessionStart) fires at every session start ⊇ 'when meta-orchestrator runs', and G (git post-checkout) is the real agnostic floor A was standing in for. Final channel set = G + B + C, wired via install-coordination-wiring.sh. Prior-art: skipped — design doc scope-reduction, no new capability. * fix(runtime-bridge): bridge-cleanup §4 skips while aif has live tasks (no ref-lock contention) (#367) §4 (container git prune, #365) runs git fetch / worktree prune / branch -d in the SHARED .git. A task running concurrently touches the same ref + packed-refs locks (amplified by parallel_enabled keeping multiple tasks active) → a collision yields "cannot lock ref" and can fail the live task's git step. Guard: GET /tasks, count non-terminal (not done/verified/cancelled); if >0, skip §4 with a clear note ("re-run when idle"). Deterministic, no AI. Fail-open (count unknown → 0 → proceed) — §4 is already merged-only safe-by-construction, so this is defence-in- depth; worst case of a false 0 is a transient lock retry, never corruption or data loss. Live-verified: with 2 non-terminal tasks running, `--dry-run` §4 printed "skipped — 2 live". Prior-art: skipped — edits an existing janitor script (no new dependency, no new file, not a capability commit); guards the #365 sweep against the #362 parallel_enabled concurrency window. * feat(coordination): commit channels G + B (post-checkout + CC SessionStart) (#369) Makes the two machine-agnostic wiring channels durable + shared (were applied locally by install-coordination-wiring.sh). Both call link-coordination.sh (SSOT #110): G .husky/post-checkout — agnostic floor, fires on git worktree add B .claude/settings.json — CC SessionStart re-heal Channel C (Superset setup-array, per-UUID) stays installer-only. SW-D liveness: G verified live — fresh worktree auto-linked 287 files. Prior-art: skipped — wiring of existing link-coordination.sh SSOT #110 into hook channels, no new capability. * docs(research-patches): doc-audit-ship-boundary Stage 2 findings + gitignore stryker sandbox (#371) Autonomous aif audit (task bcb2c6c2): full doc-vs-reality + vs-goal reconciliation, Stage 2.0 mutation-run fuel, DECISION-NEEDED batch (DN-1..4), §A self-classification. Audit-only — no maintainer-owned edits landed. Also gitignore packages/core/.stryker-tmp/ so mutation runs never pollute the tree (root cause of PR #370 contamination). * test(hooks): close mutation gaps in end-of-turn-reminder + validate-prompt (B.2 dogfood follow-up) (#373) The Stage 2 B.2 bash mutator (#366) surfaced two hook tests below the 60% kill floor: end-of-turn-reminder (52%) and validate-prompt (56%). Add targeted cases that kill every NON-equivalent surviving mutant: - end-of-turn-reminder 52% → 69%: cover the previously-untested idle-suppress re-ping guard (hook:135-156) — suppress-on-reping, fire-on-new-question, long-answer-overrides-suppress, the B2 "an AskUserQuestion turn is never idle-suppressed" contract — and the bare non-question tool-call early exit (hook:53-54). The 10 residual survivors are equivalent mutants: 7× `|| true` → `&& true` inside `$(…)` command-substitutions (stdout unchanged, exit ignored under set -uo, no -e), the transcript-validity guard (both paths exit 0/empty for the only diverging input), `set -e`→`set +e` (hook never relies on errexit aborting), and the inner re-ping AND→OR (divergence requires prev==last+recap, which trips the self-recap guard first). All 22 killable mutants are killed. - validate-prompt 56% → 78%: deterministically exercise the tsx-unavailable graceful-skip (hook:26-27, isolated-root copy) and the jq-unavailable graceful-skip (hook:14-16, fake-bin PATH without jq). The 2 residual survivors are gh+validator-coupled (hook:21 off-path-proceeds-to-validator, hook:33 validator-result) — killable only with a live-gh 404 test, which is non-hermetic; left per T-MUT-B rather than shipping a flaky test. Test-only; no production hook modified. Follow-up to #366 (mutation-discipline-umbrella Stage 2 B.2). * docs(doc-audit): apply DN-1/2/4 doc-staleness fixes + ship the fixer tooling (#374) doc-audit-ship-boundary Stage 2 — maintainer decisions 2026-06-02, applied. Applied (maintainer-directed, DN-1/2/4): - .claude/rules/rule-enforcement-channel-selection.md: 'Activation pending' → 'Activation confirmed — settings.json:114' (Class header + §4 prose); the PostToolUse Edit|Write hook is wired (verified settings.json:114). - README.md badges: ?branch=main → ?branch=staging (main=prod, CI runs on staging). - README.md enforcement chain: drop false 'Stryker' from the CI channel — mutation tests are local/session-bound, NOT a CI gate (no workflow runs Stryker). Tooling shipped alongside: - scripts/apply-doc-fixes.sh: idempotent, terminal-runnable fixer (re-applies the above; --check dry-run). packages/core/hooks/apply-doc-fixes.test.ts: 5 green. - docs/meta-factory/mutation-run-placement.md: DN-4 placement note (mutation local; ps/jq/universalmutator reqs). Prior-art: skipped — maintainer-directed doc-staleness fixes + their fixer tool + a placement note; no new runtime capability, no dependency, no packages/ code module. * test(principle-12): raise population-sentinel bounds 10..100 → 100..300 (#375) The principle-12 population sentinel capped local kickoff dirs at 100. The project legitimately accumulated >100 umbrellas of history, mirrored locally by the coordination-persistence channel (G, .husky/post-checkout → link-coordination.sh), so the ≤100 guess tripped the pre-push on every worktree. Raise to ≤300 (still catches a runaway glob) and ≥100 (doubles as a 'mirror present' guard). The sentinel is skipped in CI (KICKOFFS_AVAILABLE) — it only gates local pre-push. Maintainer-directed 2026-06-02. Does NOT resolve the separate citation-check vs symlink-mirror interaction (the broader principle-12-vs-G item) — bound only. Prior-art: skipped — adjusts a sentinel bound in an existing principle test to match reality; no new capability, no dependency, no new module. * test(principle-12): citation check ignores coordination-mirror kickoffs (#376) Citation check re-ran on every umbrella mirrored in by channel G (post-checkout → link-coordination.sh symlinks gitignored kickoff.md into $CANON), failing on historical umbrellas this worktree never authored (principle-12-vs-G). Fix: check only REAL (non-symlink) kickoff.md = locally authored. Population sentinel still counts the FULL set as a mirror-present guard. Pairs with #375 (bound→100..300). Prior-art: skipped — narrows an existing principle-test filter to exclude symlink mirrors; no new capability, no dependency. * docs(spec): aif parallel autonomous dispatch — verified model + open test (brainstorm 2026-06-02) (#377) Captures the full session conclusions so they survive: the depth-2 architecture insight (subagents don't spawn subagents → quality parallel needs separate top-level sessions, meta- orchestrator decides), the verified aif model (1 kickoff/meta-launch → 1 task; each task = top- level session; flat task model; two parallelism layers L1 cross-task worktrees / L2 within-task use_subagents→implement-coordinator; use_subagents=0 everywhere = why never parallelized; worktree-skip is documented per docs/configuration.md), the observable test signal (agent_activity_log 'Subagent: <name> started', subagentQuery.ts:793), the decision tree, the OPEN question gated on one live test (use_subagents top-level launch), an honest flip-flop corrections log, and decisions (planner-owns-plan, COORDINATOR_MAX knob, park preserved). NOT a final spec — gated on the §5 live test on a genuinely-parallel task (D.1-D.5). * chore(harvest): commit reworked aif task 5767f7df-7425-4a78-a76f-98402c1647d0 — mutation-discipline-stage-c-meta-launch (#378) * docs(spec): aif parallel dispatch §5 RESOLVED — YES via use_subagents (live proof) + M3-bash timeout fix (#380) * docs(spec): aif parallel dispatch §5 RESOLVED — YES, self-parallelizes via use_subagents (live 2026-06-02) Live test (task a37ee2f5): use_subagents=true on a real 5-task plan (mutation Stage 4 D.1-D.5) → implement-coordinator launched top-level (--agent) → fanned out 5 concurrent implement-worker subagents, each worktree-isolated. Proof: 5x `Tool: Agent {subagent_type:implement-worker}` spawns + git worktree list 1→6 (5 locked worker worktrees coexisting, ~2min all-5 overlap) + 5 distinct real test files written simultaneously. Also corrects §3.7 observable: `Subagent:` log line is SDK-transport-only (onSubagentStart wired only via SDK SubagentStart hook); on transport=cli it stays 0 even under full parallelism — a false-negative trap. Valid CLI-transport observables = git worktree growth + `Tool: Agent` activity entries. Design consequence = the tiny change: bridge sets use_subagents=true at dispatch for depth-2-sufficient umbrellas + meta-orchestrator emits plan-structured kickoffs (independent numbered Task items, no Phase headings). Prior-art: skipped — design-doc update only, no new capability/dependency/code-module. * test(principle-02): give M3-bash mutation gate a 60s timeout (was default 5000ms) The [M3-bash] local/on-demand gate (describe.skipIf(!HAS_UM)) calls runBashMutator → spawns `npx vitest` once per mutant, ~9.5s on a loaded host. The default 5000ms vitest timeout false-fails it at pre-push (blocking unrelated pushes; observed this session). Add an explicit 60_000ms timeout — mirrors the Stryker precedent (principle 11 testTimeout 5s→30s). No assertion/semantics change; CI still skips it (no universalmutator). Prior-art: skipped — test-timeout fix for an existing gate, no new capability/dependency. * test(mutation-discipline-stage-d): paired-negative tests for 5 remaining .sh helpers (#381) Stage 4 D of the mutation-discipline umbrella — content-level paired-negative vitest tests (M.4 pattern) for the .sh files that lacked them: - priority-score.sh → priority-score-synthetic.test.ts (20 it, 53 expect) - plan-currency-check.sh → plan-currency-check-kickoff.test.ts ( 6 it, kickoff-existence angle; non-redundant w/ existing) - launch-table-generator.sh→ launch-table-generator.test.ts (11 it) - check-skill-drift.sh → check-skill-drift.test.ts ( 6 it) - pre-push.fallback.sh → pre-push.fallback.test.ts (20 it) Produced by the aif self-parallel-dispatch live test (5 concurrent implement-workers, use_subagents=true) and verified by an independent 5-way adversarial cold-review (T19): all real-script-invoked (spawnSync bash on the actual .sh), content-level assertions (exit code + stdout/stderr, no shape-only .toBeDefined), anti-tautology confirmed. Fixed one over-reaching T12-compliance comment in priority-score (claimed 8 surfaces verified; only 5 are — now honest + deferred-gap note). Known deferred coverage gaps (honestly disclosed, follow-up): launch-table fallback+no-keyword path; pre-push 2 of 3 discipline-file patterns; priority-score surfaces (c)/(d)/(h). 52/52 tests green. Prior-art: skipped — test additions for existing .sh capabilities, no new runtime capability/dependency. * research(mutation-discipline-d6): verdict on deps-hash-check.sh duplication (#382) D.6 R-phase (mutation-discipline umbrella). Investigates the two byte-identical deps-hash-check.sh copies. Verified roles (T3, file:line): packages/core/hooks/ = shipped SOURCE (install.sh:261), .claude/hooks/ = this repo's DOGFOOD copy (settings.json:74). Key finding: deps-hash-check.test.ts:34 tests the DOGFOOD copy, not source → silent drift possible (test stays green if source diverges). Verdict (b) keep-both + drift-check: add @dual-pair markers + a byte-identity assertion test — REUSE the existing dual-implementation @dual-pair convention (SSOT #87) rather than BUILD. Symlink (a) rejected (install.sh --force regression + Windows). Concrete I-phase fix path + falsifiers included. R-phase only — no edits to the .sh files / settings.json / install.sh. Produced autonomously by aif (use_subagents=0, single R-phase task) + cold-reviewed. Prior-art: skipped — research-patch (markdown), no new capability/dependency/code. * fix(hooks): drift-check for deps-hash-check.sh source/dogfood pair (D.6 I-phase) (#383) Implements #382 §6 verdict (b) keep-both + drift-check. Adds @dual-pair: deps-hash-check-dogfood markers (identical block, preserving byte-identity) to both the shipped SOURCE (packages/core/hooks/) and this repo's DOGFOOD copy (.claude/hooks/), plus a byte-identity assertion in deps-hash-check.test.ts. Closes the silent-drift hole the D.6 R-phase confirmed: the functional tests exercise only the dogfood copy (HOOK), so they stayed green even if the source diverged. Falsifier verified — breaking one copy turns the new test red. Corrected #382 §6's asymmetric-marker spec (4-line block to dogfood vs 1-line to source), which would itself have broken the byte-identity the test asserts; both copies carry the identical block. Last residual of the mutation-discipline umbrella; closure (done.md + memory) follows on merge. Prior-art: prior-art-evaluations.md#87 (worktree-create-setup dual-pair, SSOT BUILD — this commit extends the @dual-pair pattern with a second pair; no new mechanism introduced). * docs: R-phase — why per-task worktrees never materialize (corrects #360 Finding A) (#372) * docs(runtime-bridge): R-phase — why per-task worktrees never materialize (corrects #360 Finding A) Live falsifier of #360 Finding A: 0 tasks ever got a worktree despite parallel_enabled=1. Root cause (verified source, correct containers): the bridge dispatches via a planner-SKIP — POST /tasks/:id/events {event:'accept_existing_plan'} — which transitions backlog→plan_ready SKIPPING the `planning` status (stateMachine.ts case accept_existing_plan, api container). The coordinator runs runPlanner ONLY for the planning stage (coordinator.ts PIPELINE from:["planning"], agent container). The ONLY worktree-creation code lives in runPlanner (planner.ts:191-213). ⇒ bridge tasks never run the planner → never create a worktree, regardless of parallel_enabled / AIF_TASK_WORKTREES_ENABLED / plannerMode. Secondary: handleAcceptExistingPlan also persists branchName (taskEvents.ts:236+) so even if the planner ran, planner branch-2 (in-place restore) would pre-empt branch-3 (worktree). Verdict: parallel_enabled=1 (#360/#362) is NECESSARY BUT NOT SUFFICIENT. Fix options: B = drop accept_existing_plan from bridge dispatch + let the coordinator run the planner; C = accept serial in-place as the operating mode with the existing rollback guard. Both deferred to a follow-up I-phase (DECISION-NEEDED). gate-3 passes; mode-change is NOT the fix (server already forces full). Effort + falsifier per finding in the patch. R-phase only — no production code changed. DeepWiki x3 (converged) + verified file:line in both aif containers. Scope annotation (principle 10) + §1.7 (principle 13). * docs(runtime-bridge): §0.1 — worktree-skip is DOCUMENTED aif behaviour (docs/configuration.md), not a trap; no upstream issue DeepWiki x3 (converged): docs/configuration.md ties worktree creation to full-mode planning by design; docs/architecture.md documents the serial-forcing. So planner-skip forgoing the worktree is a documented consequence, not a defect — no upstream issue. Records the search-coverage lesson: the #360 verdict was avoidable by reading aif's own config docs. The corrected fix (run the planner) is the documented isolation+parallel path. * docs(wave-plan): reconcile §0 → 2026-06-02 (#298→#382) + codify how §0 stays current (#384) Manual status reconciliation per the design loop (detect via /meta-orchestrator, write by human-directed session — Direction A auto-write rejected at R-phase). - §0 + Status dates 2026-05-29 → 2026-06-02 - correct misleading aif-handoff DEFER-ALL row: add `runtime-bridge BUILD` row (minimal-REST bridge shipped #312/#313 + ecosystem; supersedes-in-practice) - +8 umbrella rows for work merged since last reconcile (runtime-bridge, aif task-isolation, companion adoption, coordination-persistence, qloop, mutation-discipline, worktree dual-channel, doc-audit-ship-boundary) - add "Open frontier" block (live: #372 open, inject-layer-extension, one-click-installer, f2-aif-fire-backend) — distinct from ~80 closed candidates - add "How §0 stays current (by design)" note to Status block so future sessions don't try to automate the deliberately-manual reconciliation Prior-art: skipped — doc-only status reconciliation of an existing planning doc, no new capability or dependency introduced. * chore(orchestrator): mark mutation-discipline-umbrella DONE (#385) Umbrella closure per CLAUDE.md "Umbrella closure convention" — Final PR #383 (D.6 drift-check, last residual) merged to staging. All stages shipped: A audit #219 / B bash-mutator #366+#373 (dogfood gate fired) / C tests-of-tests #378 / D #381 + D.6 dup R-phase #382 + D.6 drift-check I-phase #383. done.md is the priority-score.sh Layer C3 completion marker (gitignore:14 un-ignores */done.md). Prior-art: skipped — completion marker (done.md), no new capability/dependency/code. * fix(principle-12): skip anti-tautology mutation test when no real (non-mirror) kickoffs exist (#386) The anti-tautology sub-test mutates a REAL compliant kickoff to verify the compound-citation detector actually catches absence. After the coordination symlink migration (#346 + post-checkout link-coordination.sh), every local kickoff.md is a SYMLINK into $CANON — a coordination mirror that getNonExemptEntries() deliberately excludes (isCoordinationMirror). With all kickoffs mirrored, getNonExemptEntries() is empty → `compliant` is undefined → `expect(compliant).toBeDefined()` failed on every host push (reproduced on staging HEAD, independent of any feature branch). The #376 mirror-exclusion fix updated the main check + population sentinel but missed this meta-test. Guard it with HAS_REAL_NONEXEMPT_KICKOFF: when there is no real kickoff to mutate, skip — detector correctness is already covered by the pure-logic anti-tautology tests (blank file / each pattern), which need no files. Unblocks all host pushes (pre-push runs the principle suite). No behaviour change to the citation enforcement itself. * fix(runtime-bridge): dispatch via planner-run so each task gets its own worktree (parallel) (#387) The bridge dispatched tasks with `accept_existing_plan`, which transitions backlog -> plan_ready SKIPPING the `planning` stage. runPlanner (planner.ts, the ONLY code that creates a per-task git worktree) runs only at `planning`, so 0 tasks ever got a worktree -> all dispatched tasks forced serial. Verified + live-proven in #372 (research-patches/2026-06-02-aif-worktree-gap.md). Fix (Option B, live-verified 2026-06-03): - Drop the `accept_existing_plan` event. The task stays at `backlog`; the auto-queue advances it through `planning` -> runPlanner -> per-task worktree. - Carry the kickoff in `description` (the planner INPUT spec, planner.ts:246), NOT in `plan` (the planner OUTPUT slot @planPath, which it overwrites). The planner plans the *how* from our kickoff *what*. Live acceptance: two tasks dispatched concurrently each got a DISTINCT worktree and both ran in `planning` simultaneously (N agents x N workspaces, not within-task subagents). Throwaway probe tasks + worktrees cleaned up. Tests: rewrote the dispatch sequence test for the 2-step flow (asserts description=kickoff, no accept_existing_plan, no plan push) and moved the rollback test's failure point to the unpause step. 8/8 green. Prior-art: skipped — modifies existing bridge file, no new capability/dependency/module. * research(aif-operator-asset-access): R-phase — gap verification + A-E verdict + recommended composition (#388) Five gap rows re-confirmed with file:line evidence. Existing skill-context/ and agents/*.md mechanisms audited (T16 problem-class check) — none cover orchestrator/reviewer discipline. Recommended composition: B+D (in-repo agnostic worker discipline, primary) + A (operator bind-mount, immediate) + C (buildKickoffSpec sibling inlining, follow-on). E rejected. DN-1/2/3 surfaced; DN-1/2 resolved inline (B scope = minimum viable worker discipline; reviewer-discipline = separate concern covered by review-sidecar.md). Prior-art: prior-art-evaluations.md#67 (aif-handoff, ADOPT — this umbrella extends it with operator-asset bridging); prior-art-evaluations.md#50 (skill-context/aif-review SSOT, ADOPT channel — D reuses this delivery pattern). * fix(meta-orchestrator): Stage 2 correctness — C1.1/C1.2/C1.3/M4/F2/F7 (#389) Six confirmed bugs fixed in the meta-orchestrator skill: C1.3 — SKILL.md:449: stale repo-root mirror claim removed; replaced with "Ships directly from .claude/skills/meta-orchestrator/ via install.sh (single source of truth; no repo-root mirror — Item 12 closure 2026-05-25). Install pattern at install.sh:236-255." C1.2 — SKILL.md:508: state.md section names corrected from stale "§2 Launch-table / §3 Dispatch log" to actual template names "§2 Decisions / §3 Phase -1 verdict" (state.md.template:26,35). C1.1 — master-backlog-delta.md:49-52: "Body owns arrays — inline-jq" claim removed (inline jq was removed in F.3 PR #261 2026-05-28); delta-write-from-state.sh correctly attributed as array owner. M4 — SKILL.md:521-525: delta two-helper ordering fixed. update-delta.sh (bootstraps schema) now listed first, matching delta-write-from-state.sh:19. F2 — SKILL.md:71: head -200 raised to head -400; wave-sequencing-plan.md is 293 lines so head -200 dropped 93 lines incl. §6 dependency-matrix. F7 — run-helper.sh:26: timeout wrapped (MO_HELPER_TIMEOUT env, default 120s); END trailer still fires on expiry (rc=124). failures.md: F9 added. Prior-art: skipped — correctness fixes to existing prose/helper, no new capability Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(aif-worker-discipline): portable worker discipline agent + AIF skill-context delivery (#390) * feat(aif-worker-discipline): portable worker discipline agent + AIF skill-context delivery Artifacts 1 (B) and 2 (D) from aif-operator-asset-access I-phase. - agents/orchestrator-worker-discipline.md: portable AI-agnostic worker discipline (REPORT schema, park-vs-proceed, stage-gate, §1.7 PR body) for aif-dispatched workers. Class B. @dual-pair: aif-orchestrator-discipline. - packages/core/templates/shared/skill-context/aif-orchestrator-discipline/SKILL.md: AIF-native delivery of the same content. YAML from aif-review/SKILL.md (SSOT #50). @dual-pair + spec: per dual-implementation-discipline.md §5. - packages/core/principles/09-doc-authority-hierarchy.ts: added aif-orchestrator-discipline/SKILL.md to REQUIRED_HEADER_DOCS (shippedSubset 16→17). Upper sentinel 60→65; Wave-4 length sentinel 16→17. - install.sh: aif-orchestrator-discipline/SKILL.md added to SHIPPED_DOCS. §1.7: forward — agents/orchestrator-worker-discipline.md:9 authority header per doc-authority-hierarchy.md §3; install.sh:103 in sync with REQUIRED_HEADER_DOCS per 09-doc-authority-hierarchy.test.ts:164 Wave 4 invariant. backward — SKILL.md:10-11 carries @dual-pair + spec: per dual-implementation-discipline.md §7. Prior-art: prior-art-evaluations.md#50 (skill-context/aif-review, ADOPT channel pattern). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(runtime-bridge): add operator convenience bind-mount section for global skills Adds '## Operator convenience: mount global skills' section at the end of docs/runtime-bridge-setup.md documenting how to bind-mount operator-side global skills (~/.claude/skills/orchestrator/, Superpowers plugins) into the aif container via docker-compose.override.yml. Operator-axis only — consumers of the shipped framework are NOT required to have these paths. The shipped in-repo discipline works without the mount. Artifact 3 (A-docs) from aif-operator-asset-access I-phase. Prior-art: skipped — doc addition, no new capability Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs(meta-orchestrator): add harvest egress step to autonomous dispatch loop (#391) aif does NOT push or open PRs by design (documented in harvest.ts:11-14). Nothing in the dispatch loop said "after status=done → call harvest" — this was the gap that caused the aif-operator-asset-access I-phase to sit stuck in the container with work done but no PR opened (incident 2026-06-03). Fix: add egress gate to SKILL.md §5 autonomous dispatch row and to meta-kickoff.template.md §4c so every generated kickoff carries the harvest call as a mandatory post-done step. Anti-pattern #autonomous-done-no-harvest added to SKILL.md §5. Prior-art: skipped — doc-only change to .claude/skills/ and templates/, no new capability (refactor only, harvest.ts already shipped). * chore(orchestrator): mark aif-operator-asset-access DONE (#392) * docs(meta-orchestrato…
artyhoo
added a commit
that referenced
this pull request
Jun 14, 2026
* Promote staging → main — consumer-install-hardening + guard-liveness + runtime-bridge (134 commits) (#488)
* feat(hooks): SubagentStop REPORT-schema WARN (non-blocking, #108 candidate-3) (#339)
Ship .claude/hooks/warn-subagent-report.sh — scans the finishing subagent's
output for canonical REPORT sections (VERIFY, Confidence, ATTN); emits a
⚠ stderr warning + exit 0 (non-blocking) when any are missing.
Maintainer chose WARN over block (exit 2) — judgment target, not gateable
(#gate-where-judgment-needed, rule-enforcement-channel-selection.md §1).
Contract verified DUAL-CHANNEL 2026-06-01:
Channel 1 — WebFetch code.claude.com/docs/en/hooks: SubagentStop fields
include agent_type; exit 0 = non-blocking; stderr shown to user.
Channel 2 — DeepWiki anthropics/claude-code: agent_transcript_path +
last_assistant_message (since CC 2.1.47) confirmed by name + quoted.
Two read paths (B1 — scan-nothing trap avoidance):
1. last_assistant_message if non-empty.
2. agent_transcript_path JSONL, reusing end-of-turn-reminder.sh:30-41.
Noise guard: skip Explore agent_type + require standalone REPORT-cue label.
Paired test: 6 cases (positive-A/B + negative + negative-2 Explore +
non-report prose + exit-code invariant). All 6 green. Pre-existing staging
failures (pre-push.test.ts + plan-currency-check.test.ts) unaffected.
settings.json wiring snippet in PR body (maintainer lands, not committed).
Prior-art: prior-art-evaluations.md#108 (SubagentStop REPORT-schema gate — candidate-3 of #108, shipped as WARN per maintainer decision 2026-06-01; block dropped — judgment target, #gate-where-judgment-needed).
* docs(research-patches): satellite-feature-harvest — own-stack-first harvest + reverse-sweep (form B) (#328)
Own-stack-first sweep: Claude Code natively ships the remote/scheduled/parallel-session
cluster (Remote Control, Routines, Channels, agent-view, Slack) that prior SSOT rows
credited to companions. 15 capability clusters triaged → 4 adopt-now (Remote Control,
Routines via /schedule, Channels(Telegram), background agent-view) + 3 defer + 8 skip.
Reverse sweep: 4 criterion-zero relationships, no shipped artefact retired (T-SFH-D —
runtime-bridge questions.ts kept; Channels is session-open-only). +1 SSOT row #100.
Prior-art: skipped — research-patch only, no new capability (the BFR own-stack-first survey is the patch content itself).
* chore(hooks): wire pending CC hooks in settings.json (SubagentStart/Stop + runtime-bridge) (#340)
Activates three already-merged, already-committed hook scripts that were
running locally but never wired in the shared config:
- PostToolUse Write|Edit|MultiEdit -> runtime-bridge-dispatch.sh (#313)
- SubagentStart -> inject-subagent-digest.sh (#108 companion-adoption-iphase)
- SubagentStop -> warn-subagent-report.sh (#108 candidate-3, #339)
All hook scripts already exist in staging; this only activates them.
Config-only wiring, not a capability commit.
* docs(book): SubagentStop block-vs-warn — flip open-node DECISION-NEEDED → решён=WARN (#339) (#341)
#339 (SubagentStop REPORT-schema WARN, non-blocking) merged to staging as
0596a64 — the block-vs-warn decision is resolved in favour of WARN. Hook
remains INERT (no SubagentStop in settings.json) until the maintainer lands
the snippet, so the node stays half-open: decided, not yet wired.
- v1 (technical): chapter XXII + epilogue June-1 open-nodes list — cite #339
- v2/v3 (literary): keep allegory, no PR number — «нрав выбрали, в строй не поставили»
Prior-art: skipped — doc edit only, no new capability (book open-node status sync after #339 merge).
* refactor(hooks): remove end-of-turn factual-claim detector — net-negative sentry, dropped by evidence (#342)
The claim-scan (numeric / file:line / negative-existence → re-verify nudge) in
end-of-turn-reminder.sh measured recall ≈0.43 + precision ≈0.20-0.25 (cry-wolf)
in the instruction-compliance pilot (2026-05-21). A sentry that misses most real
claims and false-fires on ~75% of what it catches is the #discipline-theatre the
project hunts. Maintainer decision 2026-06-01: «не нужен раз не работает».
Same class + outcome as the recommendation-laziness narrow-B stop-scan dropped at
FP 84% (#210): drop on FP evidence, keep the always-on H1 reminder.
Surfaces:
- hook: remove claim-scan block + has_claims/claim_count refs in idle-guard,
trigger, glance-line, Branch D, append block. Trigger = long_text||asked;
branches A/B/C only. Recap + question-check survive. bash -n + shellcheck clean.
- tests/hooks/eot-claim-scan.test.sh: deleted (185 LOC, all claim-scan) + CI step.
- packages/core/hooks/end-of-turn-reminder.test.ts: drop Branch-D + code-fence
precision cases, add paired-negative «short claim turn now silent». 13/13 green.
- research-patch documenting the evidence-based removal (scope annotation, §1.7).
- book epilogue ×3: the «искатель утверждений» debt closed by removal, not fix.
A short factual-report turn with no question now stays silent (was Branch D) —
the intended consequence; that nudge was the cry-wolf.
Prior-art: skipped — removal of an own-built net-negative mechanism, no new capability (cites instruction-compliance-empirical pilot + narrow-b-benchmark #210 precedent in the research-patch).
* feat(runtime-bridge): harvest — deterministic aif-task to PR egress leg (#343)
aif-handoff ends a task at "committed on a local feature branch" with NO push
and NO PR-creation in its autonomous (HANDOFF) path — verified 2026-06-01
against the running containers (zero PR-create / branch-push anywhere in its
autonomous flow; its commit/push lives only in an LLM-driven /aif-commit
runtime). So committed work strands inside aif's checkout, never reaching a
reviewable PR on the trunk. harvest is the missing return leg.
- src/harvest.ts: pure DI'd core harvestTask — guards (terminal status,
branchName present) BEFORE any side-effect; ordered push then createPr then
auto-merge, fail-fast (PR error never arms auto-merge).
- src/cli/harvest.ts: real wiring — docker-exec push from aif's container
(holds the commit + working creds), host PR-create against staging, native
auto-merge; graceful printed manual-fallback if docker absent.
- test/harvest.test.ts: paired-negative (non-terminal / no-branchName must NOT
push or PR; PR-fail must NOT arm auto-merge).
- aifHttp.ts: expose branchName on AifTaskFull (read back by harvest).
Zero LLM by construction (plain git+gh+docker) — unlike aif's own commit flow
which spends a paid claude -p query just to run git. Complies with
no-paid-llm-in-ci.md.
Prior-art: prior-art-evaluations.md#27/#28/#30/#67 — aif-handoff's own runtime
(HANDOFF_MODE / paused / Planner-Implementer-Reviewer / Kanban) is the from-side
this leg bridges, NOT an egress tool: verified it has zero push/PR in its
autonomous path, which is exactly why harvest exists. No upstream
harvest-autonomous-agent-branch-to-PR analog; thin deterministic glue over
gh/git/docker, no PR-creation reimplemented. BFR verdict: BUILD (bridge egress leg).
* feat(meta-orch): run-helper.sh completion-barrier wrapper (TDD, stage 1) (#344)
Build .claude/skills/meta-orchestrator/helpers/run-helper.sh — a trivial bash
exec-wrapper that runs a target helper as a child and ALWAYS appends a terminal
END-trailer to stdout:
=== <helper-name>: END rc=<exit-code> (lines=<stdout-line-count>) ===
so a session reading a slow helper's stdout in the background can distinguish
"finished (rc=N)" from "still running / crashed". The trailer is appended by the
parent wrapper, so it fires even when the child exits non-zero or dies
mid-output (a child-side `echo END` would be skipped on `set -e` abort / SIGKILL
/ timeout). Fixes the orchestrator reading a header-only partial file as
"zero results".
HARD CONSTRAINTS satisfied (§2): exit-propagation (capture rc first, exit rc
last — trailer echo never clobbers child status); trailer-on-crash; stdout
verbatim pass-through; `=== `-prefix kept so classify-each-candidate.sh:52
`awk '... && !/^=== /'` strips it (never a spurious candidate).
TDD: paired-negative test at packages/core/skills/run-helper.test.ts (positive
clean-exit + negative exit-1 + SIGKILL crash-mid-output + parse-safety) — 4/4
green. No regression: `git stash -u` A/B shows the 5 neighbouring helper tests
produce an identical pre-existing 18-fail set (env-dependent gh/git harnesses)
with and without this file.
T-BGB-A: the END trailer proves the child FINISHED + its exit code, NOT
semantic content-completeness — kept in test names/comments.
Prior-art: prior-art-evaluations.md — escape hatch: trivial bash exec-wrapper, no upstream analog worth a dependency (BFR BUILD, pre-reasoned). Nearest SSOT neighbour #54 (Aider run_cmd runner) is a different problem-class — exit-code routing in a TS pre-push gate vs. appending a structural completion trailer for a background reader (T16: similar "runner" name, distinct capability).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* bg-helper-completion-barrier-stage2-aif (#345)
* feat(meta-orch): route bg-helper call-sites through run-helper.sh + Layer-1 read-rule (stage 2)
Wire the two background-helper !-fences in meta-orchestrator/SKILL.md
through the already-merged run-helper.sh completion-barrier wrapper:
- §2 Step 1 priority-score.sh
- §2.5 Step 2 dup-detect.sh + inflight-check.sh
Add the Layer-1 read-rule prose after both fences: parse a slow helper's
output only after its task-notification or the `=== <helper>: END rc=<n> ===`
trailer; a header-only read means "still running", not "zero results".
Origin: incident 2026-06-01 (priority-score.sh read at header-only state →
false "zero candidates").
Helper code untouched; the 5 helper tests show identical baseline (18 failed
/ 34 passed both with and without this edit — failures are environmental,
`gh` absent). Wrapped fences valid bash; classify-each-candidate.sh:52 still
strips the `=== `-prefixed trailer.
Prior-art: skipped — SKILL.md call-site wiring only, no new capability (routes existing helpers through the already-merged run-helper.sh wrapper from PR #344).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(meta-orch): SKILL.md back to 600 lines — fold read-rule into §2 Step 1 (DRY)
aif's Stage 2 added two verbatim read-rule blockquotes (+4 lines), tipping
SKILL.md from 598 to 604 over the 600-line mechanical-check cap (real CI fail
on #345). Phase -1 reviewer fix: fold the read-rule once into the §2 Step 1
intro with 'applies to every background-helper fence below', drop the §2.5
duplicate. Both run-helper.sh wraps intact; read-rule discipline preserved, now
DRY. Not a capability commit (markdown edit).
Prior-art: skipped — markdown CI-fix (line-cap trim + DRY), no new capability.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(closure): bg-helper-completion-barrier done.md (final PR #345) (#347)
Last-stage merge marker per CLAUDE.md umbrella-closure convention — priority-score.sh
Layer C3 reads this for DONE detection.
Prior-art: skipped — closure marker file, no new capability (convention bookkeeping).
* feat(coordination): symlink-to-canonical cross-worktree sync (SSOT #110) (#346)
Build scripts/link-coordination.sh (per-file symlinks, adopt-then-link,
conflict-loud, seed on empty CANON), wire it into both worktree helpers
replacing the J5 rsync block, add link-coordination.test.ts (7 tests:
symlink, git-clean, conflict, write-back, paired-negative, adopt, seed),
reconcile worktree-setup-hydration.test.ts (drop rsync NON-DESTRUCTIVE,
retarget paired-negative regex to link-coordination.sh call, assert
symlinks), append SSOT row #110.
Umbrella count confirmed: 124 (kickoff said 123 — stale).
Prior-art: prior-art-evaluations.md#110 (cross-worktree gitignored-SSOT sync via symlink-to-canonical, verdict ADAPT) + research-patch 2026-05-17-cross-worktree-coord-doc-sync.md §5 — I-phase implementation of the settled verdict.
* docs(runtime-bridge): per-command CLI reference README (Option B) (#348)
Operator-facing reference manual for the six runtime-bridge CLI commands
(answer, await, dispatch, harvest, park, questions), one section each with
Usage / Flags / Example, derived from each cli/<cmd>.ts header docblock.
Resolves the parked README-structure fork → Option B (per-command reference).
Markdown only, 285 lines (< 600-line cap), no code changes.
Prior-art: skipped — documentation only, no new capability (operator-facing CLI reference derived from existing docblocks)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(discipline): surface genuine forks via AskUserQuestion (autonomous-default, human-gate on ambiguous only) (#349)
Operating model (maintainer decision 2026-06-01): autonomous by default;
the human-gate fires ONLY on a genuine ambiguous fork. A clear call is
decided and reported, not routed through a question.
- recommendation-laziness-discipline.md §3: fork-surfacing companion to the
evidence rule — ambiguous forks MUST be surfaced via AskUserQuestion, never
decided by a silent direct action; ask-question-reminder.sh is the
discriminator; reworded 'default=surface' -> 'autonomous-default, surface
only genuine forks'.
- recommendation-laziness-discipline.md §5: new anti-pattern
#fork-decided-by-silent-action (incident: PR #348 battle-test, an
explicitly-50/50 README fork auto-decided by running answer.ts directly).
Judgment rule -> injection-only enforcement, never a gate (#gate-where-judgment-needed).
- end-of-turn-reminder.sh Branch-A: backstop reminder for the
'decided a fork silently' path (the inverse of the existing offload check).
Hook tests 20/20 green. Origin: 2026-06-01 question-loop battle-test dialogue.
§1.7: forward — complies with rule-enforcement-channel-selection (judgment->injection),
no-paid-llm-in-ci (deterministic .sh + prose), doc-authority (no new heading); backward —
new anti-pattern scope = any-session fork behaviour, no existing rule superseded
(reviewer-discipline §2 is reviewer-scoped), enforced by two already-shipped hooks.
* feat(hook): orchestration-mode aware reminders + brainstorm cue (qloop items 2+6) (#350)
* docs(spec): hook-nudge orchestration-mode design (brainstorm item 2+6)
Design for orchestration-mode-aware behaviour of the two reminder hooks:
marker-gated Bug A fix (drop low-precision fork-regex in-mode) + recap
threshold lowering (b) + brainstorm nudge in ask-question-reminder.sh.
Normal mode stays byte-for-byte. Origin: 2026-06-01 qloop battle-test brainstorm.
Prior-art: skipped — design doc only, no new capability (markdown spec under docs/superpowers/specs/, no dependency/code-module).
* docs(plan): hook-nudge orchestration-mode implementation plan (item 2+6, TDD)
Prior-art: skipped — planning doc only, no new capability.
* docs(spec): add §3.4 aif-pull-channel brainstorm nudge (formatHuman footer)
Recursive-self-application gap from maintainer dialogue: ALL aif-parked
questions (not just I-ask-via-AUQ) must get the brainstorm-first nudge.
Footer ships in item 4's questions.ts PR (file-locality).
Prior-art: skipped — design doc only, no new capability.
* feat(hook): orchestration-mode gating — drop fork-regex (Bug A) + lower recap threshold (recap-b)
Marker .claude/orchestration-mode (mtime TTL); normal mode byte-for-byte.
Bug A: decision-MENTIONS stop false-firing the fork-challenge in-mode (regex
gated on orch_mode=false); real Qs (?/AUQ) still caught. recap-b: recap fires
on short structured status in-mode (threshold 500->200) keeping the markdown
gate so chatter stays silent. 7 new tests + 13 pre-existing green (20/20).
Spec: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md.
Prior-art: skipped — internal CC hook tuning, no new capability or dependency.
* feat(hook): brainstorm cue in ask-question-reminder (item 6)
Design/strategy forks -> superpowers:brainstorming, not a bare AUQ card.
Always-on prose nudge (judgment -> injection, never a gate). 1 new test (8/8).
Prior-art: skipped — internal CC hook tuning, no new capability or dependency.
* fix(runtime-bridge): surface mid-flight park in questions.ts + brainstorm footer (qloop item 4) (#351)
isParked gains the mid-flight-park case: a task whose blockedReason was wiped
by implementing→review still surfaces via the durable conjunction
(paused===true AND the plan carries the OPEN_QUESTION_ANCHOR). New shared
constant openQuestion.ts is the single SSOT for that anchor (writer park.ts,
reader questions.ts) so the wording cannot drift (dual-implementation-discipline
#two-prompts-drift).
formatHuman appends the §3.4 brainstorm-first footer on a non-empty parked list
(aif-pull-channel companion to ask-question-reminder.sh §3.3); empty case
unchanged. Reproduced from the verified container fix (branch
feature/qloop-realfix-d7585d), host-side, per handoff item 4.
Design SSOT: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md (§3.4).
Prior-art: skipped — bug fix on existing CLI + 17-LOC shared constant, no new capability/dependency.
* feat(runtime-bridge): commit aif rework leg in harvest (qloop item 3) (#352)
aif commits only on its approve_done && commitOnApprove path; the
request_changes→implementing→done rework path leaves the work uncommitted
(dirty tree, branch == base HEAD), so harvest had nothing to push. Extend the
egress: hasUncommittedChanges → commitAll (templated message, ZERO LLM) before
push. No-op on the normal path (tree already clean). Commit failure is fail-fast
— nothing pushed, operator gets the printed fallback. Real dep guards that the
container checkout is on the task branch before committing.
aif-handoff source untouched (foreign runtime, SSOT #27) — fix lives entirely
on our egress leg, matching harvest's graceful-degradation design.
Prior-art: skipped — extends existing harvest CLI, deterministic git only, no new capability/dependency.
* fix(principles): isolate p13 fixtures to tmpdir (kills p10↔p13 race) + exempt qloop-ux-probe probe (p12) (#353)
Two local pre-push false-blocks found by qloop-ux-probe (neither is a real violation):
F1 — principle 13 wrote its synthetic + c3-decoration fixtures into the REAL
docs/meta-factory/research-patches/ dir, then unlinked them. Under vitest's parallel
file run, principle 10's readdirSync globbed the transient file and ENOENT'd when 13
deleted it → a cross-file race (10 alone = 5/5 pass; full run = flaky ENOENT). Fix:
write the fixtures to os.tmpdir() — checkSection reads content only, PATCHES_DIR
membership was never required. Verified race-free across 3 consecutive full-trio runs.
F2 — principle 12 flagged the gitignored qloop-ux-probe kickoff (a 2-question resume
*test fixture*, not a work-delegating orchestration kickoff) for no AI-traps citation,
failing every local push. It already skips in CI (KICKOFFS_AVAILABLE false). Added to
EXEMPT_LIST with documented rationale.
Full principle suite: 157/157.
* fix(runtime-bridge): park.ts resolves API_BASE_URL so agent can park from inside aif container (#354)
park.ts is the only CLI run from inside the aif agent container, which exposes the
service as API_BASE_URL=http://api:3009 and does NOT set RUNTIME_BRIDGE_AIF_URL.
The old localhost-only default was unreachable there (connection refused) -> park()
got 'fetch failed' -> the agent could not park itself, so park-don't-guess (SSOT #109,
meta-orchestrator §4c) was non-functional on the real autonomous path.
New precedence: RUNTIME_BRIDGE_AIF_URL ?? API_BASE_URL ?? http://localhost:3009.
Host orchestrator (sets neither) still gets localhost; container gets api:3009.
Found by qloop-ux-probe Часть 2 live dispatch (taskId 5e32fcb9): agent correctly
surfaced-not-hacked the park failure, but the task slid implement->review->done at
$3.17 having parked nothing. resolveAifBaseUrl() extracted + unit-tested incl. a
negative guard proven to go red on regression.
* fix(runtime-bridge): don't record dedup on ManualBackend fallback + add --force (Finding B) (#355)
dispatch.ts recorded a dedup entry unconditionally after Step 4 — even when the real
backend threw (e.g. dirty_worktree 409) and it fell back to ManualBackend. That manual
entry (which created no autonomous task) then blocked a legitimate real retry for the
full 24h TTL, with no escape. qloop-ux-probe hit exactly this: after fixing the dirty
worktree, the re-dispatch was refused as "already dispatched (backend=manual)".
Fix:
- shouldRecordDedup(backendName): record only for a real backend success, never 'manual'.
- --force: skip the dedup check to re-dispatch the same kickoff deliberately.
- kickoff path resolved as the first non-flag arg, so --force may sit anywhere.
Three pure helpers, unit-tested incl. a negative guard. Full runtime-bridge suite 102 pass.
* fix(runtime-bridge): questions.ts recovers mid-flight-park question from plan anchor (Finding E) (#356)
A mid-flight park (paused:true + OPEN_QUESTION_ANCHOR in plan, blockedReason wiped by
implementing→review) surfaced in the list — but parkedReason() rendered "(no reason
recorded)" because it only read blockedReason + reviewComments, never the question text
park.ts appended under the plan anchor. So the chat channel showed "there is a question"
with no idea WHAT it asks (qloop-ux-probe Finding E, task ccebe39a).
Fix: extractOpenQuestion(plan) pulls the text after the last OPEN_QUESTION_ANCHOR line;
parkedReason precedence is now blockedReason → plan OPEN QUESTION → reviewComments →
"(no reason recorded)". Unit-tested incl. multi-anchor (last wins) + a negative guard.
Full runtime-bridge suite 100 pass.
* fix(runtime-bridge): park.ts probes reachable base URL — agent env scrubs API_BASE_URL (Finding C-2) (#357)
Finding C (#354) made park.ts READ API_BASE_URL, but the qloop-ux-probe live re-run proved
that insufficient: the aif agent runs park.ts in a Bash-tool subprocess whose env is
SCRUBBED of API_BASE_URL (the container's PID-1 env has it; the agent's exec env does not).
So resolveAifBaseUrl() still fell back to localhost:3009 → unreachable inside the container
→ "fetch failed" → the task slid to done at $3.45 without parking, exactly as before.
Fix: resolveReachableBaseUrl() probes candidate URLs and uses the first reachable one —
[RUNTIME_BRIDGE_AIF_URL?, API_BASE_URL?, http://api:3009 (docker service), http://localhost:3009
(host)], de-duplicated. Works from BOTH the agent container (api:3009) and the host
orchestrator (localhost) even when no env survives. main() now awaits the probe.
candidateBaseUrls + resolveReachableBaseUrl unit-tested (injected fetch) incl. a negative
guard proving it skips an unreachable first candidate. Full runtime-bridge suite 117 pass.
* feat(runtime-bridge): bridge-health.sh ($0 container-side preflight) + bridge-cleanup.sh (junk sweep) (#358)
Operator pain: "каждую сессию приходится чинить" + "мусор постоянно остаётся". Both are
structural — the recurring bugs live on the host↔container↔aif boundary that unit/CI
can't cover (a full agent run costs LLM tokens, no-paid-llm-in-ci), so they were only
found live MID-TASK; and probe/smoke runs leave orphan tasks + /tmp files behind.
bridge-health.sh — $0 deterministic CONTAINER-side preflight (docker+curl+grep, no task,
no tokens). Each check maps to a real qloop-ux-probe finding: container checkout clean
(A), park.ts carries the resolveReachableBaseUrl probe (C-2), a park candidate URL is
reachable from inside the container (C/C-2), dedup store has no stale manual entries (B).
Run at session start → "bridge red, fix first" instead of discovering breakage live.
Complements verify-bridge.sh (host-side dispatch smoke). Live-dogfooded — caught + fixed
a false-positive in its own reachability check (000 connection-fail vs real HTTP status).
bridge-cleanup.sh — one-command sweep of test/probe junk: aif tasks matching a test-title
allowlist (UXPROBE/smoke/probe — real work never matched), old /tmp ManualBackend kickoffs
+ dedup backups. Reports a container stash, never drops it (operator's git). --dry-run.
Prior-art: extends own verify-bridge.sh operator-smoke pattern (packages/runtime-bridge/scripts) — no external prior art applies; project-specific aif-bridge container diagnostic + test-task sweep, not a general capability with an upstream analog.
* fix(runtime-bridge): self-cleaning junk producers — junk no longer accumulates (no manual/AI sweep) (#359)
Operator: "придумать как быть с мусором — его не должен чистить каждый раз ИИ". A manual
cleanup script is still "someone cleans each time". The real fix is that each producer
cleans up after itself, automatically, with zero AI/manual involvement.
idempotency.ts — recordDispatch was append-only (file grew forever; a stale manual-fallback
entry blocked retries for the full TTL). Now it PRUNES-ON-WRITE: rewrites the log keeping
only within-TTL entries + the new one. Self-bounding, and stale entries (incl. Finding B's
manual fallback) auto-expire by age — no --force needed after TTL, no sweep.
ManualBackend.ts — dispatch wrote /tmp/runtime-bridge-<id>.md on every fallback and never
cleaned them (days of accumulation). Now each dispatch first prunes its OWN stale artefacts
(runtime-bridge-*.md older than 7d). Scope-guarded: only matches our files, only when stale,
best-effort (never throws into the dispatch path).
Pure cores (pruneStaleEntries / parseEntries / isStaleArtifact) unit-tested incl. negative
guards (stale entry must not survive; unrelated old .md must not be pruned). Full suite 126 pass.
This complements (does not replace) bridge-health.sh; bridge-cleanup.sh stays as a rare
manual "nuke everything" escape hatch, not the routine mechanism.
* fix(runtime-bridge): park.ts refuses to park at status=review (Finding F guard) (#361)
A park that happens AFTER the implement→review transition left the task
status=review, paused=true. On resume, aif runs the review pipeline straight to
`done` WITHOUT re-implementing the injected answer — and the next chain question
is never parked (live: task ba3b4bf6 answered c1 → done, c2 silently lost).
Root cause is upstream-intentional: aif's HUMAN_ACTIONS_BY_STATUS.review = []
(stateMachine.ts) — there is no human re-entry from `review` into implement.
Option B (per 2026-06-01-aif-task-isolation.md §4, maintainer-selected): a cheap
our-side guard. parkTask already GETs the task, so the status is in hand — refuse
the park at status=review and throw a clear message (park before review, or wait
for done and use answer.ts request_changes). Turns the silent loss into a loud,
actionable error. Does NOT add mid-flight re-implement (Option C, deferred).
Paired-negative test: GUARD refuses + issues NO PUT at status=review; CONTROL still
parks normally at a pre-review status (plan_ready). 19→21 tests green.
Prior-art: skipped — bug-fix guard on existing park capability, no new dependency or capability commit.
* docs: R-phase research-patch — aif task-isolation (Findings A + F) (#360)
* docs(runtime-bridge): R-phase research-patch — aif task-isolation Findings A + F
Finding A (dirty_worktree recurs): verdict config-fix. Per-task worktrees are gated by
a 3-condition AND in planner.ts:191-195 — env AIF_TASK_WORKTREES_ENABLED=true is only
gate 1; gate 2 project.parallelEnabled (DB parallel_enabled, web-UI toggle) is 0 and was
never set, so worktrees are never created and the shared checkout is reused in-place →
dirties → next dispatch 409s. Fix: flip parallel_enabled (no restart).
Finding F (mid-flight park resumes review->done, never re-implements): verdict
aif-upstream-issue (intentional design) + our-side-guard. stateMachine.ts:106
HUMAN_ACTIONS_BY_STATUS.review=[] -> no human re-entry into implement; request_changes
only from done. DECISION-NEEDED for I-phase: Option B (park.ts guard rejecting parks at
status=review) vs Option C (auto request_changes loop, ~4h).
R-phase only — no production code changed. Evidence: parallel_enabled=0 (live DB query),
worktree_path null across 10 tasks, reflog >=6 in-place checkout cycles, planner 3-gate +
stateMachine review:[] source-verified. Scope annotation (principle 10) + §1.7 (principle 13).
* docs(runtime-bridge): record Finding F resolution — Option B selected + shipped (#361)
§4.1 + §7.3: DECISION-NEEDED-F resolved 2026-06-01. Maintainer selected the
hard-guard path (surfaced as "Option B"). Records the exact shipped behavior
honestly: park rejects only at status=review (the §4.1 Option-A semantics, NOT
the stricter implementing-only Option B) — pre-implement parks (plan_ready) stay
legitimate. Cross-refs PR #361. Option C deferred.
* feat(runtime-bridge): ensure-parallel guard — self-heal Finding A on any instance (#362)
aif creates a per-task git worktree only when project.parallelEnabled=1 (gate 2
of 3 in planner.ts). That flag is a DB field with NO env/config.yaml knob — only
the web UI or raw DB sets it — so a freshly-provisioned instance has it 0, every
task runs in-place on the shared checkout, and the next dispatch 409s on
dirty_worktree (research-patch 2026-06-01-aif-task-isolation.md §1-§2; the live
config-fix applied to this instance does not propagate to other instances).
ensureParallelEnabled(baseUrl, projectId): GET /projects → if parallelEnabled is
already true, no-op; else PUT /projects/:id with parallelEnabled=true. Wired
best-effort into AifHandoffBackend.dispatch() Step 0 (warns + proceeds on failure,
never blocks dispatch) and shipped as a standalone CLI (--project / env).
Anti-clobber (load-bearing): aif has no targeted parallelEnabled write (only
PATCH /:id/auto-queue-mode), and the full PUT NULLs any omitted *MaxBudgetUsd
(@aif/data updateProject: `x ?? null`). So the guard round-trips the FULL field
set read back from GET — flipping ONLY parallelEnabled — to preserve a UI-set
budget. Paired-negative test pins this: a set budget MUST survive the PUT.
Cleaner long-term fix = an upstream PATCH /projects/:id/parallel-enabled mirroring
the existing auto-queue-mode PATCH (file against lee-to/aif-handoff); this guard
is the our-side stopgap. 6 new tests green; runtime-bridge typecheck clean.
Prior-art: prior-art-evaluations.md#109 (park.ts BUILD — same class: thin our-side runtime-bridge consumer CLI over aif REST where no upstream targeted primitive exists; here parallelEnabled-reconcile, no upstream PATCH beyond auto-queue-mode; cleaner fix REFERENCEd to upstream, this is the stopgap).
* coordination-persistence-fix (#363)
* feat(coordination): link-coordination.sh --on-conflict=canon|worktree|skip (default skip)
Adds --on-conflict flag with three modes resolving the real-file-in-both
conflict deterministically: skip (default, exit 1, never clobber), canon
(canonical wins, relink), worktree (worktree wins, adopt into CANON).
Invalid values exit 2. TDD: 4 tests in link-coordination.test.ts.
Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; arg-parse + branch logic only, no new file/dep.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(coordination): link-coordination.sh shares root _plan-cache.md + _master-backlog-delta.json (Part-2, SSOT #110)
Adds a ROOT-FILE adopt-then-link + link pair so the two root-level
gitignored coordination files (_plan-cache.md, _master-backlog-delta.json)
are shared across worktrees — previously unmatched because the loops only
iterated umbrella subdirs */. Tracked root README.md untouched.
TDD: 3 tests in link-coordination.test.ts.
Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; mirrors existing umbrella adopt/link loops for root files.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(hooks): i18n reminder payload — en canonical / ru operator (+ principle-12 exempt hygiene) (#364)
* feat(hooks): i18n — split reminder payload into lang packs (en canonical / ru operator)
The two reminder hooks (ask-question-reminder, end-of-turn-reminder) emitted
Russian payload prose inline. Splits logic from payload: hooks keep all logic
and source a language pack (.claude/hooks/lang/{en,ru}.sh) selected by
AIF_HOOK_LANG (default en — canonical, for the public repo). Operator sets
AIF_HOOK_LANG=ru once globally in ~/.claude/settings.json.
- lang/en.sh + lang/ru.sh: aif_msg_* functions (${anchor} resolved at call time
via dynamic scope) + AIF_RECAP_MARKER (recap heading; guard and message read
the same var so they stay language-consistent).
- lang/check-parity.sh: deterministic, no-LLM guard against #two-prompts-drift —
asserts both packs expose the same key set. Local/reviewer step, not a blocking
gate (hooks are @cc-only, not shipped).
- Tests run the existing cases under AIF_HOOK_LANG=ru (RU-pack contract; Russian
transcripts + assertions unchanged) + add an en-pack smoke per hook.
- RU payload byte-identical to before; EN is a faithful translation. Behaviour
preserved (30/30 hook tests green).
Out of scope (surfaced): Russian code comments in the two hooks; other 11 hooks;
questions.ts strings. Spec: docs/superpowers/specs/2026-06-01-hook-lang-i18n-design.md
Prior-art: skipped — i18n refactor of existing internal hooks, no new capability (string externalization to lang packs, no dependency, no packages/ code module)
* test(principle-12): drop stale 'qloop-ux-probe' from EXEMPT_LIST
The qloop-ux-probe question-loop fixture dir (gitignored, added to EXEMPT_LIST
2026-06-01 by Finding F2) is gone — the positive-guard test correctly flagged it
as a stale exempt entry ("exempted but now absent"). Remove it per the test's own
instruction; 'aif-ssot-corrections' remains the sole exempt entry.
Surfaced while unblocking the hook-i18n PR's local pre-push (principle 12 runs on
gitignored kickoffs locally, skips in CI). Maintainer-invited in-session.
Prior-art: skipped — principle-test allowlist hygiene, no new capability (one stale entry removed from EXEMPT_LIST + doc comment)
* fix(runtime-bridge): bridge-cleanup §4 prunes MERGED container git junk (#365)
Enabling per-task worktrees (parallel_enabled, #362) makes aif RETAIN worktrees
post-terminal (research-patch 2026-06-01-aif-task-isolation.md §2.1), and the old
in-place task checkouts had already left 14 stale feature/* branches on the shared
checkout. The session janitor (#358/#359) deliberately did NOT touch container git.
§4 extends it to prune ONLY container git merged into origin/staging: git worktree
prune + remove retained non-main worktrees on merged branches + delete merged
feature/* branches. SAFE BY CONSTRUCTION — `git branch --merged` filtering AND
`git branch -d` (refuses unmerged) double-guard; unmerged in-flight work is never
touched. Also fixes the docker-exec stdin bug (needs -i for `sh -s` heredoc).
Completes the #359 "no manual/AI sweep" principle for container git state. This is
operator/co-located tooling (docker exec); the portable fix is upstream auto-removal
of retained worktrees (worth filing against lee-to/aif-handoff).
Live-verified on the real container: dry-run + real run deleted 7 merged branches
and preserved all 6 unmerged (+ the checked-out one). No unit test — matches the 4
untested sibling janitor scripts; safety is by-construction + live paired-evidence.
Prior-art: skipped — extends an existing janitor script (no new dependency, no new >=80 LOC file, not a capability commit); the parallel-worktree capability it cleans up after is #362/#109.
* feat(audit-self): bash-hook mutation testing — bash.rules + run-bash-mutation.sh (universalmutator ADAPT, local/on-demand) (#366)
Stage 2 B.2 of mutation-discipline-umbrella. ADAPTs universalmutator (MIT,
deterministic regexp engine + analyze_mutants harness — no LLM) to
mutation-test .claude/hooks/*.sh against their paired-negative vitest
tests. The only project-authored artefacts are bash.rules (operators), a
thin wrapper, and the wrapper's own paired-negative test. Delivery =
session-bound / local on-demand (NOT CI), mirroring Stryker-as-devDep;
the original kickoff B.3 CI job is dropped. universalmutator is a dev-time
tool, never consumer-shipped.
Dogfood gate (mandatory) surfaced real, undocumented test gaps:
end-of-turn-reminder 52% / validate-prompt 56% (both below the 60% floor)
— the &&/|| mutation of their suppress/skip conditions survives uncaught.
Recursive bootstrap: the wrapper mutated by its own operators is killed
13/13 by its own test. Found + fixed a /*-in-comment regexp-engine
limitation (bash globs in comments falsely trigger C-block-comment mode)
via a line-count-preserving sanitiser.
Evidence: docs/meta-factory/research-patches/2026-06-02-bash-mutator-b2-shipped.md
Prior-art: prior-art-evaluations.md#91 (universalmutator ADAPT — engine ADOPTed verbatim, only bash.rules operators authored; problem-class ~85% match per B.1 §B.1.5; mutahunter REJECTed on no-paid-llm-in-ci §1).
* feat(coordination): persistence-fix tail — SW-B symlink-aware helpers + G/B/C installer (#368)
* docs(coordination): design — cross-worktree persistence fix (4-channel: git-hook agnostic floor + CC + Superset + skill)
Brainstorm output for coordination-persistence-fix umbrella. T16 corrections:
- channel C substrate = Superset projects/<uuid>/config.json setup-array (rsync = root cause), NOT ~/.superset/hooks/
- adds git post-checkout (.husky) as the harness-agnostic floor per maintainer 'works everywhere' requirement
- Q3 atomicity already satisfied (mktemp+mv verified); SSOT #110 same anchor
Prior-art: skipped — design doc only, no new capability (extends link-coordination.sh SSOT #110).
* docs(coordination): correct §2.4 — helpers atomic but NOT symlink-preserving (mv replaces symlink)
Planning-phase finding (verified empirically): mv tmp <symlink> replaces the
symlink with a real file → Part-2 cross-worktree share lost on first cache write.
SW-B upgraded from 'confirm test' to 'make 3 helpers symlink-aware (write-through
resolved target)'. Atomicity preserved (temp+mv in target dir), symlink preserved.
Prior-art: skipped — design doc correction only, no new capability.
* docs(coordination): implementation plan — 4 sub-waves (A linker / B symlink-aware helpers / C wiring / D self-apply)
Prior-art: skipped — plan doc only, no new capability (implements SSOT #110 extension).
* feat(coordination): one-click install-coordination-wiring.sh (G+B+C, idempotent, self-test)
Applies all 3 wiring channels in one terminal command (maintainer runs from central repo):
G .husky/post-checkout (agnostic floor)
B .claude/settings.json SessionStart
C ~/.superset/projects/*/config.json setup (replaces rsync root-cause)
--self-test (sandbox) + --dry-run modes; idempotent re-runs. Replaces the manual runbook.
Prior-art: skipped — scripts/ helper, not a capability commit (no dep, not under packages/); wires existing link-coordination.sh SSOT #110.
* fix(coordination): 3 cache/delta helpers symlink-aware (SW-B)
resolve_target() follows a symlink to its real $CANON target so the atomic
temp-then-mv write writes THROUGH the link instead of replacing it. Without this,
the first cache/delta write breaks the cross-worktree share (mv tmp <symlink> →
real file). +3 paired-negative tests (symlink preserved + canon written through);
18/18 green. Done locally (not via aif — container serialized on doc-audit task).
Prior-art: skipped — symlink-preservation fix to existing helpers, no new capability; extends link-coordination.sh SSOT #110 share semantics.
* docs(coordination): drop channel A (skill self-heal) — redundant after G git-hook
B (CC SessionStart) fires at every session start ⊇ 'when meta-orchestrator runs',
and G (git post-checkout) is the real agnostic floor A was standing in for.
Final channel set = G + B + C, wired via install-coordination-wiring.sh.
Prior-art: skipped — design doc scope-reduction, no new capability.
* fix(runtime-bridge): bridge-cleanup §4 skips while aif has live tasks (no ref-lock contention) (#367)
§4 (container git prune, #365) runs git fetch / worktree prune / branch -d in the
SHARED .git. A task running concurrently touches the same ref + packed-refs locks
(amplified by parallel_enabled keeping multiple tasks active) → a collision yields
"cannot lock ref" and can fail the live task's git step.
Guard: GET /tasks, count non-terminal (not done/verified/cancelled); if >0, skip §4
with a clear note ("re-run when idle"). Deterministic, no AI. Fail-open (count unknown
→ 0 → proceed) — §4 is already merged-only safe-by-construction, so this is defence-in-
depth; worst case of a false 0 is a transient lock retry, never corruption or data loss.
Live-verified: with 2 non-terminal tasks running, `--dry-run` §4 printed "skipped — 2 live".
Prior-art: skipped — edits an existing janitor script (no new dependency, no new file, not a capability commit); guards the #365 sweep against the #362 parallel_enabled concurrency window.
* feat(coordination): commit channels G + B (post-checkout + CC SessionStart) (#369)
Makes the two machine-agnostic wiring channels durable + shared (were applied
locally by install-coordination-wiring.sh). Both call link-coordination.sh (SSOT #110):
G .husky/post-checkout — agnostic floor, fires on git worktree add
B .claude/settings.json — CC SessionStart re-heal
Channel C (Superset setup-array, per-UUID) stays installer-only. SW-D liveness:
G verified live — fresh worktree auto-linked 287 files.
Prior-art: skipped — wiring of existing link-coordination.sh SSOT #110 into hook channels, no new capability.
* docs(research-patches): doc-audit-ship-boundary Stage 2 findings + gitignore stryker sandbox (#371)
Autonomous aif audit (task bcb2c6c2): full doc-vs-reality + vs-goal reconciliation,
Stage 2.0 mutation-run fuel, DECISION-NEEDED batch (DN-1..4), §A self-classification.
Audit-only — no maintainer-owned edits landed. Also gitignore packages/core/.stryker-tmp/
so mutation runs never pollute the tree (root cause of PR #370 contamination).
* test(hooks): close mutation gaps in end-of-turn-reminder + validate-prompt (B.2 dogfood follow-up) (#373)
The Stage 2 B.2 bash mutator (#366) surfaced two hook tests below the 60% kill
floor: end-of-turn-reminder (52%) and validate-prompt (56%). Add targeted cases
that kill every NON-equivalent surviving mutant:
- end-of-turn-reminder 52% → 69%: cover the previously-untested idle-suppress
re-ping guard (hook:135-156) — suppress-on-reping, fire-on-new-question,
long-answer-overrides-suppress, the B2 "an AskUserQuestion turn is never
idle-suppressed" contract — and the bare non-question tool-call early exit
(hook:53-54). The 10 residual survivors are equivalent mutants: 7× `|| true`
→ `&& true` inside `$(…)` command-substitutions (stdout unchanged, exit
ignored under set -uo, no -e), the transcript-validity guard (both paths exit
0/empty for the only diverging input), `set -e`→`set +e` (hook never relies on
errexit aborting), and the inner re-ping AND→OR (divergence requires
prev==last+recap, which trips the self-recap guard first). All 22 killable
mutants are killed.
- validate-prompt 56% → 78%: deterministically exercise the tsx-unavailable
graceful-skip (hook:26-27, isolated-root copy) and the jq-unavailable
graceful-skip (hook:14-16, fake-bin PATH without jq). The 2 residual survivors
are gh+validator-coupled (hook:21 off-path-proceeds-to-validator, hook:33
validator-result) — killable only with a live-gh 404 test, which is
non-hermetic; left per T-MUT-B rather than shipping a flaky test.
Test-only; no production hook modified. Follow-up to #366
(mutation-discipline-umbrella Stage 2 B.2).
* docs(doc-audit): apply DN-1/2/4 doc-staleness fixes + ship the fixer tooling (#374)
doc-audit-ship-boundary Stage 2 — maintainer decisions 2026-06-02, applied.
Applied (maintainer-directed, DN-1/2/4):
- .claude/rules/rule-enforcement-channel-selection.md: 'Activation pending' →
'Activation confirmed — settings.json:114' (Class header + §4 prose); the
PostToolUse Edit|Write hook is wired (verified settings.json:114).
- README.md badges: ?branch=main → ?branch=staging (main=prod, CI runs on staging).
- README.md enforcement chain: drop false 'Stryker' from the CI channel —
mutation tests are local/session-bound, NOT a CI gate (no workflow runs Stryker).
Tooling shipped alongside:
- scripts/apply-doc-fixes.sh: idempotent, terminal-runnable fixer (re-applies the
above; --check dry-run). packages/core/hooks/apply-doc-fixes.test.ts: 5 green.
- docs/meta-factory/mutation-run-placement.md: DN-4 placement note (mutation local;
ps/jq/universalmutator reqs).
Prior-art: skipped — maintainer-directed doc-staleness fixes + their fixer tool +
a placement note; no new runtime capability, no dependency, no packages/ code module.
* test(principle-12): raise population-sentinel bounds 10..100 → 100..300 (#375)
The principle-12 population sentinel capped local kickoff dirs at 100. The project
legitimately accumulated >100 umbrellas of history, mirrored locally by the
coordination-persistence channel (G, .husky/post-checkout → link-coordination.sh),
so the ≤100 guess tripped the pre-push on every worktree. Raise to ≤300 (still
catches a runaway glob) and ≥100 (doubles as a 'mirror present' guard). The
sentinel is skipped in CI (KICKOFFS_AVAILABLE) — it only gates local pre-push.
Maintainer-directed 2026-06-02. Does NOT resolve the separate citation-check vs
symlink-mirror interaction (the broader principle-12-vs-G item) — bound only.
Prior-art: skipped — adjusts a sentinel bound in an existing principle test to
match reality; no new capability, no dependency, no new module.
* test(principle-12): citation check ignores coordination-mirror kickoffs (#376)
Citation check re-ran on every umbrella mirrored in by channel G (post-checkout →
link-coordination.sh symlinks gitignored kickoff.md into $CANON), failing on
historical umbrellas this worktree never authored (principle-12-vs-G). Fix: check
only REAL (non-symlink) kickoff.md = locally authored. Population sentinel still
counts the FULL set as a mirror-present guard. Pairs with #375 (bound→100..300).
Prior-art: skipped — narrows an existing principle-test filter to exclude symlink
mirrors; no new capability, no dependency.
* docs(spec): aif parallel autonomous dispatch — verified model + open test (brainstorm 2026-06-02) (#377)
Captures the full session conclusions so they survive: the depth-2 architecture insight
(subagents don't spawn subagents → quality parallel needs separate top-level sessions, meta-
orchestrator decides), the verified aif model (1 kickoff/meta-launch → 1 task; each task = top-
level session; flat task model; two parallelism layers L1 cross-task worktrees / L2 within-task
use_subagents→implement-coordinator; use_subagents=0 everywhere = why never parallelized;
worktree-skip is documented per docs/configuration.md), the observable test signal
(agent_activity_log 'Subagent: <name> started', subagentQuery.ts:793), the decision tree, the
OPEN question gated on one live test (use_subagents top-level launch), an honest flip-flop
corrections log, and decisions (planner-owns-plan, COORDINATOR_MAX knob, park preserved).
NOT a final spec — gated on the §5 live test on a genuinely-parallel task (D.1-D.5).
* chore(harvest): commit reworked aif task 5767f7df-7425-4a78-a76f-98402c1647d0 — mutation-discipline-stage-c-meta-launch (#378)
* docs(spec): aif parallel dispatch §5 RESOLVED — YES via use_subagents (live proof) + M3-bash timeout fix (#380)
* docs(spec): aif parallel dispatch §5 RESOLVED — YES, self-parallelizes via use_subagents (live 2026-06-02)
Live test (task a37ee2f5): use_subagents=true on a real 5-task plan (mutation
Stage 4 D.1-D.5) → implement-coordinator launched top-level (--agent) → fanned
out 5 concurrent implement-worker subagents, each worktree-isolated. Proof:
5x `Tool: Agent {subagent_type:implement-worker}` spawns + git worktree list
1→6 (5 locked worker worktrees coexisting, ~2min all-5 overlap) + 5 distinct
real test files written simultaneously.
Also corrects §3.7 observable: `Subagent:` log line is SDK-transport-only
(onSubagentStart wired only via SDK SubagentStart hook); on transport=cli it
stays 0 even under full parallelism — a false-negative trap. Valid CLI-transport
observables = git worktree growth + `Tool: Agent` activity entries.
Design consequence = the tiny change: bridge sets use_subagents=true at dispatch
for depth-2-sufficient umbrellas + meta-orchestrator emits plan-structured
kickoffs (independent numbered Task items, no Phase headings).
Prior-art: skipped — design-doc update only, no new capability/dependency/code-module.
* test(principle-02): give M3-bash mutation gate a 60s timeout (was default 5000ms)
The [M3-bash] local/on-demand gate (describe.skipIf(!HAS_UM)) calls
runBashMutator → spawns `npx vitest` once per mutant, ~9.5s on a loaded host.
The default 5000ms vitest timeout false-fails it at pre-push (blocking unrelated
pushes; observed this session). Add an explicit 60_000ms timeout — mirrors the
Stryker precedent (principle 11 testTimeout 5s→30s). No assertion/semantics
change; CI still skips it (no universalmutator).
Prior-art: skipped — test-timeout fix for an existing gate, no new capability/dependency.
* test(mutation-discipline-stage-d): paired-negative tests for 5 remaining .sh helpers (#381)
Stage 4 D of the mutation-discipline umbrella — content-level paired-negative
vitest tests (M.4 pattern) for the .sh files that lacked them:
- priority-score.sh → priority-score-synthetic.test.ts (20 it, 53 expect)
- plan-currency-check.sh → plan-currency-check-kickoff.test.ts ( 6 it, kickoff-existence angle; non-redundant w/ existing)
- launch-table-generator.sh→ launch-table-generator.test.ts (11 it)
- check-skill-drift.sh → check-skill-drift.test.ts ( 6 it)
- pre-push.fallback.sh → pre-push.fallback.test.ts (20 it)
Produced by the aif self-parallel-dispatch live test (5 concurrent implement-workers,
use_subagents=true) and verified by an independent 5-way adversarial cold-review
(T19): all real-script-invoked (spawnSync bash on the actual .sh), content-level
assertions (exit code + stdout/stderr, no shape-only .toBeDefined), anti-tautology
confirmed. Fixed one over-reaching T12-compliance comment in priority-score
(claimed 8 surfaces verified; only 5 are — now honest + deferred-gap note).
Known deferred coverage gaps (honestly disclosed, follow-up): launch-table
fallback+no-keyword path; pre-push 2 of 3 discipline-file patterns;
priority-score surfaces (c)/(d)/(h). 52/52 tests green.
Prior-art: skipped — test additions for existing .sh capabilities, no new runtime capability/dependency.
* research(mutation-discipline-d6): verdict on deps-hash-check.sh duplication (#382)
D.6 R-phase (mutation-discipline umbrella). Investigates the two byte-identical
deps-hash-check.sh copies. Verified roles (T3, file:line): packages/core/hooks/
= shipped SOURCE (install.sh:261), .claude/hooks/ = this repo's DOGFOOD copy
(settings.json:74). Key finding: deps-hash-check.test.ts:34 tests the DOGFOOD
copy, not source → silent drift possible (test stays green if source diverges).
Verdict (b) keep-both + drift-check: add @dual-pair markers + a byte-identity
assertion test — REUSE the existing dual-implementation @dual-pair convention
(SSOT #87) rather than BUILD. Symlink (a) rejected (install.sh --force regression
+ Windows). Concrete I-phase fix path + falsifiers included. R-phase only — no
edits to the .sh files / settings.json / install.sh.
Produced autonomously by aif (use_subagents=0, single R-phase task) + cold-reviewed.
Prior-art: skipped — research-patch (markdown), no new capability/dependency/code.
* fix(hooks): drift-check for deps-hash-check.sh source/dogfood pair (D.6 I-phase) (#383)
Implements #382 §6 verdict (b) keep-both + drift-check. Adds
@dual-pair: deps-hash-check-dogfood markers (identical block, preserving
byte-identity) to both the shipped SOURCE (packages/core/hooks/) and this
repo's DOGFOOD copy (.claude/hooks/), plus a byte-identity assertion in
deps-hash-check.test.ts.
Closes the silent-drift hole the D.6 R-phase confirmed: the functional tests
exercise only the dogfood copy (HOOK), so they stayed green even if the source
diverged. Falsifier verified — breaking one copy turns the new test red.
Corrected #382 §6's asymmetric-marker spec (4-line block to dogfood vs 1-line
to source), which would itself have broken the byte-identity the test asserts;
both copies carry the identical block.
Last residual of the mutation-discipline umbrella; closure (done.md + memory)
follows on merge.
Prior-art: prior-art-evaluations.md#87 (worktree-create-setup dual-pair, SSOT BUILD — this commit extends the @dual-pair pattern with a second pair; no new mechanism introduced).
* docs: R-phase — why per-task worktrees never materialize (corrects #360 Finding A) (#372)
* docs(runtime-bridge): R-phase — why per-task worktrees never materialize (corrects #360 Finding A)
Live falsifier of #360 Finding A: 0 tasks ever got a worktree despite parallel_enabled=1.
Root cause (verified source, correct containers): the bridge dispatches via a planner-SKIP —
POST /tasks/:id/events {event:'accept_existing_plan'} — which transitions backlog→plan_ready
SKIPPING the `planning` status (stateMachine.ts case accept_existing_plan, api container).
The coordinator runs runPlanner ONLY for the planning stage (coordinator.ts PIPELINE
from:["planning"], agent container). The ONLY worktree-creation code lives in runPlanner
(planner.ts:191-213). ⇒ bridge tasks never run the planner → never create a worktree,
regardless of parallel_enabled / AIF_TASK_WORKTREES_ENABLED / plannerMode.
Secondary: handleAcceptExistingPlan also persists branchName (taskEvents.ts:236+) so even if
the planner ran, planner branch-2 (in-place restore) would pre-empt branch-3 (worktree).
Verdict: parallel_enabled=1 (#360/#362) is NECESSARY BUT NOT SUFFICIENT. Fix options:
B = drop accept_existing_plan from bridge dispatch + let the coordinator run the planner;
C = accept serial in-place as the operating mode with the existing rollback guard.
Both deferred to a follow-up I-phase (DECISION-NEEDED). gate-3 passes; mode-change is NOT
the fix (server already forces full). Effort + falsifier per finding in the patch.
R-phase only — no production code changed. DeepWiki x3 (converged) + verified file:line in
both aif containers. Scope annotation (principle 10) + §1.7 (principle 13).
* docs(runtime-bridge): §0.1 — worktree-skip is DOCUMENTED aif behaviour (docs/configuration.md), not a trap; no upstream issue
DeepWiki x3 (converged): docs/configuration.md ties worktree creation to full-mode
planning by design; docs/architecture.md documents the serial-forcing. So planner-skip
forgoing the worktree is a documented consequence, not a defect — no upstream issue.
Records the search-coverage lesson: the #360 verdict was avoidable by reading aif's own
config docs. The corrected fix (run the planner) is the documented isolation+parallel path.
* docs(wave-plan): reconcile §0 → 2026-06-02 (#298→#382) + codify how §0 stays current (#384)
Manual status reconciliation per the design loop (detect via /meta-orchestrator,
write by human-directed session — Direction A auto-write rejected at R-phase).
- §0 + Status dates 2026-05-29 → 2026-06-02
- correct misleading aif-handoff DEFER-ALL row: add `runtime-bridge BUILD` row
(minimal-REST bridge shipped #312/#313 + ecosystem; supersedes-in-practice)
- +8 umbrella rows for work merged since last reconcile (runtime-bridge,
aif task-isolation, companion adoption, coordination-persistence, qloop,
mutation-discipline, worktree dual-channel, doc-audit-ship-boundary)
- add "Open frontier" block (live: #372 open, inject-layer-extension,
one-click-installer, f2-aif-fire-backend) — distinct from ~80 closed candidates
- add "How §0 stays current (by design)" note to Status block so future
sessions don't try to automate the deliberately-manual reconciliation
Prior-art: skipped — doc-only status reconciliation of an existing planning doc, no new capability or dependency introduced.
* chore(orchestrator): mark mutation-discipline-umbrella DONE (#385)
Umbrella closure per CLAUDE.md "Umbrella closure convention" — Final PR #383
(D.6 drift-check, last residual) merged to staging. All stages shipped:
A audit #219 / B bash-mutator #366+#373 (dogfood gate fired) / C tests-of-tests
#378 / D #381 + D.6 dup R-phase #382 + D.6 drift-check I-phase #383.
done.md is the priority-score.sh Layer C3 completion marker (gitignore:14
un-ignores */done.md).
Prior-art: skipped — completion marker (done.md), no new capability/dependency/code.
* fix(principle-12): skip anti-tautology mutation test when no real (non-mirror) kickoffs exist (#386)
The anti-tautology sub-test mutates a REAL compliant kickoff to verify the
compound-citation detector actually catches absence. After the coordination
symlink migration (#346 + post-checkout link-coordination.sh), every local
kickoff.md is a SYMLINK into $CANON — a coordination mirror that
getNonExemptEntries() deliberately excludes (isCoordinationMirror). With all
kickoffs mirrored, getNonExemptEntries() is empty → `compliant` is undefined →
`expect(compliant).toBeDefined()` failed on every host push (reproduced on
staging HEAD, independent of any feature branch).
The #376 mirror-exclusion fix updated the main check + population sentinel but
missed this meta-test. Guard it with HAS_REAL_NONEXEMPT_KICKOFF: when there is
no real kickoff to mutate, skip — detector correctness is already covered by the
pure-logic anti-tautology tests (blank file / each pattern), which need no files.
Unblocks all host pushes (pre-push runs the principle suite). No behaviour change
to the citation enforcement itself.
* fix(runtime-bridge): dispatch via planner-run so each task gets its own worktree (parallel) (#387)
The bridge dispatched tasks with `accept_existing_plan`, which transitions
backlog -> plan_ready SKIPPING the `planning` stage. runPlanner (planner.ts,
the ONLY code that creates a per-task git worktree) runs only at `planning`,
so 0 tasks ever got a worktree -> all dispatched tasks forced serial. Verified
+ live-proven in #372 (research-patches/2026-06-02-aif-worktree-gap.md).
Fix (Option B, live-verified 2026-06-03):
- Drop the `accept_existing_plan` event. The task stays at `backlog`; the
auto-queue advances it through `planning` -> runPlanner -> per-task worktree.
- Carry the kickoff in `description` (the planner INPUT spec, planner.ts:246),
NOT in `plan` (the planner OUTPUT slot @planPath, which it overwrites). The
planner plans the *how* from our kickoff *what*.
Live acceptance: two tasks dispatched concurrently each got a DISTINCT
worktree and both ran in `planning` simultaneously (N agents x N workspaces,
not within-task subagents). Throwaway probe tasks + worktrees cleaned up.
Tests: rewrote the dispatch sequence test for the 2-step flow (asserts
description=kickoff, no accept_existing_plan, no plan push) and moved the
rollback test's failure point to the unpause step. 8/8 green.
Prior-art: skipped — modifies existing bridge file, no new capability/dependency/module.
* research(aif-operator-asset-access): R-phase — gap verification + A-E verdict + recommended composition (#388)
Five gap rows re-confirmed with file:line evidence. Existing skill-context/ and agents/*.md
mechanisms audited (T16 problem-class check) — none cover orchestrator/reviewer discipline.
Recommended composition: B+D (in-repo agnostic worker discipline, primary) + A (operator
bind-mount, immediate) + C (buildKickoffSpec sibling inlining, follow-on). E rejected.
DN-1/2/3 surfaced; DN-1/2 resolved inline (B scope = minimum viable worker discipline;
reviewer-discipline = separate concern covered by review-sidecar.md).
Prior-art: prior-art-evaluations.md#67 (aif-handoff, ADOPT — this umbrella extends it with
operator-asset bridging); prior-art-evaluations.md#50 (skill-context/aif-review SSOT,
ADOPT channel — D reuses this delivery pattern).
* fix(meta-orchestrator): Stage 2 correctness — C1.1/C1.2/C1.3/M4/F2/F7 (#389)
Six confirmed bugs fixed in the meta-orchestrator skill:
C1.3 — SKILL.md:449: stale repo-root mirror claim removed; replaced
with "Ships directly from .claude/skills/meta-orchestrator/ via
install.sh (single source of truth; no repo-root mirror — Item 12
closure 2026-05-25). Install pattern at install.sh:236-255."
C1.2 — SKILL.md:508: state.md section names corrected from stale
"§2 Launch-table / §3 Dispatch log" to actual template names
"§2 Decisions / §3 Phase -1 verdict" (state.md.template:26,35).
C1.1 — master-backlog-delta.md:49-52: "Body owns arrays — inline-jq"
claim removed (inline jq was removed in F.3 PR #261 2026-05-28);
delta-write-from-state.sh correctly attributed as array owner.
M4 — SKILL.md:521-525: delta two-helper ordering fixed. update-delta.sh
(bootstraps schema) now listed first, matching delta-write-from-state.sh:19.
F2 — SKILL.md:71: head -200 raised to head -400; wave-sequencing-plan.md
is 293 lines so head -200 dropped 93 lines incl. §6 dependency-matrix.
F7 — run-helper.sh:26: timeout wrapped (MO_HELPER_TIMEOUT env, default 120s);
END trailer still fires on expiry (rc=124). failures.md: F9 added.
Prior-art: skipped — correctness fixes to existing prose/helper, no new capability
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(aif-worker-discipline): portable worker discipline agent + AIF skill-context delivery (#390)
* feat(aif-worker-discipline): portable worker discipline agent + AIF skill-context delivery
Artifacts 1 (B) and 2 (D) from aif-operator-asset-access I-phase.
- agents/orchestrator-worker-discipline.md: portable AI-agnostic worker
discipline (REPORT schema, park-vs-proceed, stage-gate, §1.7 PR body)
for aif-dispatched workers. Class B. @dual-pair: aif-orchestrator-discipline.
- packages/core/templates/shared/skill-context/aif-orchestrator-discipline/SKILL.md:
AIF-native delivery of the same content. YAML from aif-review/SKILL.md (SSOT #50).
@dual-pair + spec: per dual-implementation-discipline.md §5.
- packages/core/principles/09-doc-authority-hierarchy.ts: added
aif-orchestrator-discipline/SKILL.md to REQUIRED_HEADER_DOCS (shippedSubset 16→17).
Upper sentinel 60→65; Wave-4 length sentinel 16→17.
- install.sh: aif-orchestrator-discipline/SKILL.md added to SHIPPED_DOCS.
§1.7: forward — agents/orchestrator-worker-discipline.md:9 authority header per
doc-authority-hierarchy.md §3; install.sh:103 in sync with REQUIRED_HEADER_DOCS
per 09-doc-authority-hierarchy.test.ts:164 Wave 4 invariant. backward —
SKILL.md:10-11 carries @dual-pair + spec: per dual-implementation-discipline.md §7.
Prior-art: prior-art-evaluations.md#50 (skill-context/aif-review, ADOPT channel pattern).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs(runtime-bridge): add operator convenience bind-mount section for global skills
Adds '## Operator convenience: mount global skills' section at the end of
docs/runtime-bridge-setup.md documenting how to bind-mount operator-side
global skills (~/.claude/skills/orchestrator/, Superpowers plugins) into
the aif container via docker-compose.override.yml.
Operator-axis only — consumers of the shipped framework are NOT required to
have these paths. The shipped in-repo discipline works without the mount.
Artifact 3 (A-docs) from aif-operator-asset-access I-phase.
Prior-art: skipped — doc addition, no new capability
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs(meta-orchestrator): add harvest egress step to autonomous dispatch loop (#391)
aif does NOT push or open PRs by design (documented in harvest.ts:11-14).
Nothing in the dispatch loop said "after status=done → call harvest" — this
was the gap that caused the aif-operator-asset-access I-phase to sit stuck
in the container with work done but no PR opened (incident 2026-06-03).
Fix: add egress gate to SKILL.md §5 autonomous dispatch row and to
meta-kickoff.template.md §4c so every generated kickoff carries the
harvest call as a mandatory post-done step.
Anti-pattern #autonomous-done-no-harvest added to SKILL.md §5.
Prior-art: skipped — doc-only change to .claude/skills/ and templates/,
no new capability (refactor only, harvest.ts already shipped).
* chore(orchestrator): mark aif-operator-asset-access DONE (#392)
* docs(m…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
lee-to/ai-factorywithout distinguishinglee-to/aif-handoffas a separate repositoryask_questionqueries and context7query-docson 2026-05-16; DeepWiki search URLs cited in each entry's Rationale fieldAttribution corrections (severity)
lee-to/ai-factory v2.x, skills/aif-implement/SKILL.mdlee-to/aif-handoff main, docs/mcp-sync.mdlee-to/ai-factory v2.x, handoff_sync_status toollee-to/aif-handoff main, @aif/shared packages/shared/src/stateMachine.tslee-to/ai-factory v2.x, skills/aif-plan/SKILL.md(single-side)lee-to/ai-factory v2.x, subagents/implement-coordinator.md(path DOESN'T EXIST)lee-to/aif-handoff main, @aif/agent packages/agent/src/subagents/(3 subagents: Planner/Implementer/Reviewer)Evidence base
All corrections and new entries verified 2026-05-16:
docs/meta-factory/research-patches/2026-05-16-research-tooling-evaluation.md§10.1-§10.3 — pre-session empirical findings (root cause of docs(research-patches): Wave 6 AI-doc cold audit (§13.26) #27-docs(wave-5): readiness REVISE fixes — SSOT ID remap + §13.25 status #30 attribution errors)ask_questionqueries onlee-to/aif-handoff(search URLs cited inline in each SSOT entry)query-docson/lee-to/aif-handofffor docs(research-patches): Wave 6 AI-doc cold audit (§13.26) #27 HANDOFF_MODE verificationScope
Single file edited:
docs/meta-factory/prior-art-evaluations.mdNo code, no capability commit, no package.json changes, no shipped-artefact changes.
§1.7 Forward-check applied
This PR introduces ATTRIBUTION CORRECTIONS to SSOT entries #27-#30 (wrong-repo attribution fixed) and 5 NEW entries #42-#46 (aif-handoff package primitives + DeepWiki MCP). Forward-checks per phase-research-coverage.md §1.7:
docs/meta-factory/prior-art-evaluations.md:14-30). Entry-trigger criteria unchanged (:47-60). Verdict semantics unchanged (:32-44). Staleness policy unchanged (:113-135). Corrections only updateCandidatefield andLast revieweddate. New entries feat(pre-push): §1.7 substance arm — file:line citation required + paired pre-push.test.sh (Wave 8.3) #42-docs(refactor): split open-questions.md into open + closed-questions archive #46 append after existing entry feat(discipline-self-check): §1.7 substance arm — Forward-check requires file:line citation + paired sanity (Wave 8.1) #41 (:109), preserving monotonic ID order.docs/mcp-sync.mdvia context7; docs(wave-6): close §13.26 — AI-doc effectiveness cold audit + review verdicts #28packages/shared/src/stateMachine.tsvia DeepWiki:96; feat: Wave 7 — hot-checks + harness-hooks + template test + §13.23 4th-layer #29 PAIR-paths via DeepWiki:97; docs(wave-5): readiness REVISE fixes — SSOT ID remap + §13.25 status #30packages/agent/src/subagents/via DeepWiki:98; Wave 8.4: pre-push §7 Prior-art escape-hatch substance arm #43packages/runtime/via DeepWiki:111; Arm Phase 10 (§13.32) + ai-laziness-traps project rule #44packages/mcp/via DeepWiki:112; feat(wave-8.5): retroactive sweep + HISTORICAL_CUTOFF + D5 dead-exemption cleanup #45packages/agent/src/taskWatchdog.tsvia DeepWiki:113; docs(refactor): split open-questions.md into open + closed-questions archive #46 Subagents/Skills modes via DeepWiki:114.docs/meta-factory/aif-comparison.mdchecked for contradicting attribution — grep returned zero hits on docs(research-patches): Wave 6 AI-doc cold audit (§13.26) #27/docs(wave-6): close §13.26 — AI-doc effectiveness cold audit + review verdicts #28/feat: Wave 7 — hot-checks + harness-hooks + template test + §13.23 4th-layer #29/docs(wave-5): readiness REVISE fixes — SSOT ID remap + §13.25 status #30 citations. No contradicting attribution found.packages/,agents/, templates untouched. Project-internal SSOT only. No AGENTS.md or template changes.§1.7 Backward-check applied
docs/meta-factory/research-patches/2026-05-11-aif-handoff-overlap-analysis.md:35-36,48,54-57,66-68,225-227— cites old paths as context7 2026-05-11 evidence. VALID AS HISTORICAL RECORD — these citations document what context7 returned at that time, which is the root-cause evidence for the attribution errors corrected here. No edit needed.docs/meta-factory/research-patches/2026-05-11-aif-primitives-deep-dive.md:10,28,50,56,73,86,91,227,247— cites SSOT docs(wave-6): close §13.26 — AI-doc effectiveness cold audit + review verdicts #28/feat: Wave 7 — hot-checks + harness-hooks + template test + §13.23 4th-layer #29 by ID (stable identifiers). ID-based citations remain valid post-correction; verdicts (DEFER/ADAPT) unchanged.docs/meta-factory/research-patches/2026-05-16-research-tooling-evaluation.md:3,242— cites docs(research-patches): Wave 6 AI-doc cold audit (§13.26) #27-docs(wave-5): readiness REVISE fixes — SSOT ID remap + §13.25 status #30 as a group requiring correction and proposes Wave 8.4: pre-push §7 Prior-art escape-hatch substance arm #43-docs(refactor): split open-questions.md into open + closed-questions archive #46 as new entries. This commit fulfills those proposals. Valid post-correction.docs/meta-factory/research-patches/2026-05-16-§17-think-time-gate.md:197,387,405— cites SSOT docs(wave-6): close §13.26 — AI-doc effectiveness cold audit + review verdicts #28/feat: Wave 7 — hot-checks + harness-hooks + template test + §13.23 4th-layer #29 by ID for ORT analysis. ID-based; verdicts unchanged; remains valid.docs/meta-factory/aif-comparison.md. No update needed.docs/meta-factory/retros/(closed historical artifacts, read-only post-merge per CLAUDE.md Artifact Ownership Contract). Any citations there are historical pre-dating corrections; no update warranted by retro ownership policy. Not individually searched — ownership constraint makes editing prohibited regardless.