Conversation
* feat(meta-orch): route bg-helper call-sites through run-helper.sh + Layer-1 read-rule (stage 2) Wire the two background-helper !-fences in meta-orchestrator/SKILL.md through the already-merged run-helper.sh completion-barrier wrapper: - §2 Step 1 priority-score.sh - §2.5 Step 2 dup-detect.sh + inflight-check.sh Add the Layer-1 read-rule prose after both fences: parse a slow helper's output only after its task-notification or the `=== <helper>: END rc=<n> ===` trailer; a header-only read means "still running", not "zero results". Origin: incident 2026-06-01 (priority-score.sh read at header-only state → false "zero candidates"). Helper code untouched; the 5 helper tests show identical baseline (18 failed / 34 passed both with and without this edit — failures are environmental, `gh` absent). Wrapped fences valid bash; classify-each-candidate.sh:52 still strips the `=== `-prefixed trailer. Prior-art: skipped — SKILL.md call-site wiring only, no new capability (routes existing helpers through the already-merged run-helper.sh wrapper from PR #344). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(meta-orch): SKILL.md back to 600 lines — fold read-rule into §2 Step 1 (DRY) aif's Stage 2 added two verbatim read-rule blockquotes (+4 lines), tipping SKILL.md from 598 to 604 over the 600-line mechanical-check cap (real CI fail on #345). Phase -1 reviewer fix: fold the read-rule once into the §2 Step 1 intro with 'applies to every background-helper fence below', drop the §2.5 duplicate. Both run-helper.sh wraps intact; read-rule discipline preserved, now DRY. Not a capability commit (markdown edit). Prior-art: skipped — markdown CI-fix (line-cap trim + DRY), no new capability. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…) (#346) Build scripts/link-coordination.sh (per-file symlinks, adopt-then-link, conflict-loud, seed on empty CANON), wire it into both worktree helpers replacing the J5 rsync block, add link-coordination.test.ts (7 tests: symlink, git-clean, conflict, write-back, paired-negative, adopt, seed), reconcile worktree-setup-hydration.test.ts (drop rsync NON-DESTRUCTIVE, retarget paired-negative regex to link-coordination.sh call, assert symlinks), append SSOT row #110. Umbrella count confirmed: 124 (kickoff said 123 — stale). Prior-art: prior-art-evaluations.md#110 (cross-worktree gitignored-SSOT sync via symlink-to-canonical, verdict ADAPT) + research-patch 2026-05-17-cross-worktree-coord-doc-sync.md §5 — I-phase implementation of the settled verdict.
Operator-facing reference manual for the six runtime-bridge CLI commands (answer, await, dispatch, harvest, park, questions), one section each with Usage / Flags / Example, derived from each cli/<cmd>.ts header docblock. Resolves the parked README-structure fork → Option B (per-command reference). Markdown only, 285 lines (< 600-line cap), no code changes. Prior-art: skipped — documentation only, no new capability (operator-facing CLI reference derived from existing docblocks) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…us-default, human-gate on ambiguous only) (#349) Operating model (maintainer decision 2026-06-01): autonomous by default; the human-gate fires ONLY on a genuine ambiguous fork. A clear call is decided and reported, not routed through a question. - recommendation-laziness-discipline.md §3: fork-surfacing companion to the evidence rule — ambiguous forks MUST be surfaced via AskUserQuestion, never decided by a silent direct action; ask-question-reminder.sh is the discriminator; reworded 'default=surface' -> 'autonomous-default, surface only genuine forks'. - recommendation-laziness-discipline.md §5: new anti-pattern #fork-decided-by-silent-action (incident: PR #348 battle-test, an explicitly-50/50 README fork auto-decided by running answer.ts directly). Judgment rule -> injection-only enforcement, never a gate (#gate-where-judgment-needed). - end-of-turn-reminder.sh Branch-A: backstop reminder for the 'decided a fork silently' path (the inverse of the existing offload check). Hook tests 20/20 green. Origin: 2026-06-01 question-loop battle-test dialogue. §1.7: forward — complies with rule-enforcement-channel-selection (judgment->injection), no-paid-llm-in-ci (deterministic .sh + prose), doc-authority (no new heading); backward — new anti-pattern scope = any-session fork behaviour, no existing rule superseded (reviewer-discipline §2 is reviewer-scoped), enforced by two already-shipped hooks.
…p items 2+6) (#350) * docs(spec): hook-nudge orchestration-mode design (brainstorm item 2+6) Design for orchestration-mode-aware behaviour of the two reminder hooks: marker-gated Bug A fix (drop low-precision fork-regex in-mode) + recap threshold lowering (b) + brainstorm nudge in ask-question-reminder.sh. Normal mode stays byte-for-byte. Origin: 2026-06-01 qloop battle-test brainstorm. Prior-art: skipped — design doc only, no new capability (markdown spec under docs/superpowers/specs/, no dependency/code-module). * docs(plan): hook-nudge orchestration-mode implementation plan (item 2+6, TDD) Prior-art: skipped — planning doc only, no new capability. * docs(spec): add §3.4 aif-pull-channel brainstorm nudge (formatHuman footer) Recursive-self-application gap from maintainer dialogue: ALL aif-parked questions (not just I-ask-via-AUQ) must get the brainstorm-first nudge. Footer ships in item 4's questions.ts PR (file-locality). Prior-art: skipped — design doc only, no new capability. * feat(hook): orchestration-mode gating — drop fork-regex (Bug A) + lower recap threshold (recap-b) Marker .claude/orchestration-mode (mtime TTL); normal mode byte-for-byte. Bug A: decision-MENTIONS stop false-firing the fork-challenge in-mode (regex gated on orch_mode=false); real Qs (?/AUQ) still caught. recap-b: recap fires on short structured status in-mode (threshold 500->200) keeping the markdown gate so chatter stays silent. 7 new tests + 13 pre-existing green (20/20). Spec: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md. Prior-art: skipped — internal CC hook tuning, no new capability or dependency. * feat(hook): brainstorm cue in ask-question-reminder (item 6) Design/strategy forks -> superpowers:brainstorming, not a bare AUQ card. Always-on prose nudge (judgment -> injection, never a gate). 1 new test (8/8). Prior-art: skipped — internal CC hook tuning, no new capability or dependency.
…torm footer (qloop item 4) (#351) isParked gains the mid-flight-park case: a task whose blockedReason was wiped by implementing→review still surfaces via the durable conjunction (paused===true AND the plan carries the OPEN_QUESTION_ANCHOR). New shared constant openQuestion.ts is the single SSOT for that anchor (writer park.ts, reader questions.ts) so the wording cannot drift (dual-implementation-discipline #two-prompts-drift). formatHuman appends the §3.4 brainstorm-first footer on a non-empty parked list (aif-pull-channel companion to ask-question-reminder.sh §3.3); empty case unchanged. Reproduced from the verified container fix (branch feature/qloop-realfix-d7585d), host-side, per handoff item 4. Design SSOT: docs/superpowers/specs/2026-06-01-hook-nudge-orchestration-mode-design.md (§3.4). Prior-art: skipped — bug fix on existing CLI + 17-LOC shared constant, no new capability/dependency.
…#352) aif commits only on its approve_done && commitOnApprove path; the request_changes→implementing→done rework path leaves the work uncommitted (dirty tree, branch == base HEAD), so harvest had nothing to push. Extend the egress: hasUncommittedChanges → commitAll (templated message, ZERO LLM) before push. No-op on the normal path (tree already clean). Commit failure is fail-fast — nothing pushed, operator gets the printed fallback. Real dep guards that the container checkout is on the task branch before committing. aif-handoff source untouched (foreign runtime, SSOT #27) — fix lives entirely on our egress leg, matching harvest's graceful-degradation design. Prior-art: skipped — extends existing harvest CLI, deterministic git only, no new capability/dependency.
…+ exempt qloop-ux-probe probe (p12) (#353) Two local pre-push false-blocks found by qloop-ux-probe (neither is a real violation): F1 — principle 13 wrote its synthetic + c3-decoration fixtures into the REAL docs/meta-factory/research-patches/ dir, then unlinked them. Under vitest's parallel file run, principle 10's readdirSync globbed the transient file and ENOENT'd when 13 deleted it → a cross-file race (10 alone = 5/5 pass; full run = flaky ENOENT). Fix: write the fixtures to os.tmpdir() — checkSection reads content only, PATCHES_DIR membership was never required. Verified race-free across 3 consecutive full-trio runs. F2 — principle 12 flagged the gitignored qloop-ux-probe kickoff (a 2-question resume *test fixture*, not a work-delegating orchestration kickoff) for no AI-traps citation, failing every local push. It already skips in CI (KICKOFFS_AVAILABLE false). Added to EXEMPT_LIST with documented rationale. Full principle suite: 157/157.
…from inside aif container (#354) park.ts is the only CLI run from inside the aif agent container, which exposes the service as API_BASE_URL=http://api:3009 and does NOT set RUNTIME_BRIDGE_AIF_URL. The old localhost-only default was unreachable there (connection refused) -> park() got 'fetch failed' -> the agent could not park itself, so park-don't-guess (SSOT #109, meta-orchestrator §4c) was non-functional on the real autonomous path. New precedence: RUNTIME_BRIDGE_AIF_URL ?? API_BASE_URL ?? http://localhost:3009. Host orchestrator (sets neither) still gets localhost; container gets api:3009. Found by qloop-ux-probe Часть 2 live dispatch (taskId 5e32fcb9): agent correctly surfaced-not-hacked the park failure, but the task slid implement->review->done at $3.17 having parked nothing. resolveAifBaseUrl() extracted + unit-tested incl. a negative guard proven to go red on regression.
…dd --force (Finding B) (#355) dispatch.ts recorded a dedup entry unconditionally after Step 4 — even when the real backend threw (e.g. dirty_worktree 409) and it fell back to ManualBackend. That manual entry (which created no autonomous task) then blocked a legitimate real retry for the full 24h TTL, with no escape. qloop-ux-probe hit exactly this: after fixing the dirty worktree, the re-dispatch was refused as "already dispatched (backend=manual)". Fix: - shouldRecordDedup(backendName): record only for a real backend success, never 'manual'. - --force: skip the dedup check to re-dispatch the same kickoff deliberately. - kickoff path resolved as the first non-flag arg, so --force may sit anywhere. Three pure helpers, unit-tested incl. a negative guard. Full runtime-bridge suite 102 pass.
…rom plan anchor (Finding E) (#356) A mid-flight park (paused:true + OPEN_QUESTION_ANCHOR in plan, blockedReason wiped by implementing→review) surfaced in the list — but parkedReason() rendered "(no reason recorded)" because it only read blockedReason + reviewComments, never the question text park.ts appended under the plan anchor. So the chat channel showed "there is a question" with no idea WHAT it asks (qloop-ux-probe Finding E, task ccebe39a). Fix: extractOpenQuestion(plan) pulls the text after the last OPEN_QUESTION_ANCHOR line; parkedReason precedence is now blockedReason → plan OPEN QUESTION → reviewComments → "(no reason recorded)". Unit-tested incl. multi-anchor (last wins) + a negative guard. Full runtime-bridge suite 100 pass.
…rubs API_BASE_URL (Finding C-2) (#357) Finding C (#354) made park.ts READ API_BASE_URL, but the qloop-ux-probe live re-run proved that insufficient: the aif agent runs park.ts in a Bash-tool subprocess whose env is SCRUBBED of API_BASE_URL (the container's PID-1 env has it; the agent's exec env does not). So resolveAifBaseUrl() still fell back to localhost:3009 → unreachable inside the container → "fetch failed" → the task slid to done at $3.45 without parking, exactly as before. Fix: resolveReachableBaseUrl() probes candidate URLs and uses the first reachable one — [RUNTIME_BRIDGE_AIF_URL?, API_BASE_URL?, http://api:3009 (docker service), http://localhost:3009 (host)], de-duplicated. Works from BOTH the agent container (api:3009) and the host orchestrator (localhost) even when no env survives. main() now awaits the probe. candidateBaseUrls + resolveReachableBaseUrl unit-tested (injected fetch) incl. a negative guard proving it skips an unreachable first candidate. Full runtime-bridge suite 117 pass.
…+ bridge-cleanup.sh (junk sweep) (#358) Operator pain: "каждую сессию приходится чинить" + "мусор постоянно остаётся". Both are structural — the recurring bugs live on the host↔container↔aif boundary that unit/CI can't cover (a full agent run costs LLM tokens, no-paid-llm-in-ci), so they were only found live MID-TASK; and probe/smoke runs leave orphan tasks + /tmp files behind. bridge-health.sh — $0 deterministic CONTAINER-side preflight (docker+curl+grep, no task, no tokens). Each check maps to a real qloop-ux-probe finding: container checkout clean (A), park.ts carries the resolveReachableBaseUrl probe (C-2), a park candidate URL is reachable from inside the container (C/C-2), dedup store has no stale manual entries (B). Run at session start → "bridge red, fix first" instead of discovering breakage live. Complements verify-bridge.sh (host-side dispatch smoke). Live-dogfooded — caught + fixed a false-positive in its own reachability check (000 connection-fail vs real HTTP status). bridge-cleanup.sh — one-command sweep of test/probe junk: aif tasks matching a test-title allowlist (UXPROBE/smoke/probe — real work never matched), old /tmp ManualBackend kickoffs + dedup backups. Reports a container stash, never drops it (operator's git). --dry-run. Prior-art: extends own verify-bridge.sh operator-smoke pattern (packages/runtime-bridge/scripts) — no external prior art applies; project-specific aif-bridge container diagnostic + test-task sweep, not a general capability with an upstream analog.
…cumulates (no manual/AI sweep) (#359) Operator: "придумать как быть с мусором — его не должен чистить каждый раз ИИ". A manual cleanup script is still "someone cleans each time". The real fix is that each producer cleans up after itself, automatically, with zero AI/manual involvement. idempotency.ts — recordDispatch was append-only (file grew forever; a stale manual-fallback entry blocked retries for the full TTL). Now it PRUNES-ON-WRITE: rewrites the log keeping only within-TTL entries + the new one. Self-bounding, and stale entries (incl. Finding B's manual fallback) auto-expire by age — no --force needed after TTL, no sweep. ManualBackend.ts — dispatch wrote /tmp/runtime-bridge-<id>.md on every fallback and never cleaned them (days of accumulation). Now each dispatch first prunes its OWN stale artefacts (runtime-bridge-*.md older than 7d). Scope-guarded: only matches our files, only when stale, best-effort (never throws into the dispatch path). Pure cores (pruneStaleEntries / parseEntries / isStaleArtifact) unit-tested incl. negative guards (stale entry must not survive; unrelated old .md must not be pruned). Full suite 126 pass. This complements (does not replace) bridge-health.sh; bridge-cleanup.sh stays as a rare manual "nuke everything" escape hatch, not the routine mechanism.
…g F guard) (#361) A park that happens AFTER the implement→review transition left the task status=review, paused=true. On resume, aif runs the review pipeline straight to `done` WITHOUT re-implementing the injected answer — and the next chain question is never parked (live: task ba3b4bf6 answered c1 → done, c2 silently lost). Root cause is upstream-intentional: aif's HUMAN_ACTIONS_BY_STATUS.review = [] (stateMachine.ts) — there is no human re-entry from `review` into implement. Option B (per 2026-06-01-aif-task-isolation.md §4, maintainer-selected): a cheap our-side guard. parkTask already GETs the task, so the status is in hand — refuse the park at status=review and throw a clear message (park before review, or wait for done and use answer.ts request_changes). Turns the silent loss into a loud, actionable error. Does NOT add mid-flight re-implement (Option C, deferred). Paired-negative test: GUARD refuses + issues NO PUT at status=review; CONTROL still parks normally at a pre-review status (plan_ready). 19→21 tests green. Prior-art: skipped — bug-fix guard on existing park capability, no new dependency or capability commit.
) * docs(runtime-bridge): R-phase research-patch — aif task-isolation Findings A + F Finding A (dirty_worktree recurs): verdict config-fix. Per-task worktrees are gated by a 3-condition AND in planner.ts:191-195 — env AIF_TASK_WORKTREES_ENABLED=true is only gate 1; gate 2 project.parallelEnabled (DB parallel_enabled, web-UI toggle) is 0 and was never set, so worktrees are never created and the shared checkout is reused in-place → dirties → next dispatch 409s. Fix: flip parallel_enabled (no restart). Finding F (mid-flight park resumes review->done, never re-implements): verdict aif-upstream-issue (intentional design) + our-side-guard. stateMachine.ts:106 HUMAN_ACTIONS_BY_STATUS.review=[] -> no human re-entry into implement; request_changes only from done. DECISION-NEEDED for I-phase: Option B (park.ts guard rejecting parks at status=review) vs Option C (auto request_changes loop, ~4h). R-phase only — no production code changed. Evidence: parallel_enabled=0 (live DB query), worktree_path null across 10 tasks, reflog >=6 in-place checkout cycles, planner 3-gate + stateMachine review:[] source-verified. Scope annotation (principle 10) + §1.7 (principle 13). * docs(runtime-bridge): record Finding F resolution — Option B selected + shipped (#361) §4.1 + §7.3: DECISION-NEEDED-F resolved 2026-06-01. Maintainer selected the hard-guard path (surfaced as "Option B"). Records the exact shipped behavior honestly: park rejects only at status=review (the §4.1 Option-A semantics, NOT the stricter implementing-only Option B) — pre-implement parks (plan_ready) stay legitimate. Cross-refs PR #361. Option C deferred.
…any instance (#362) aif creates a per-task git worktree only when project.parallelEnabled=1 (gate 2 of 3 in planner.ts). That flag is a DB field with NO env/config.yaml knob — only the web UI or raw DB sets it — so a freshly-provisioned instance has it 0, every task runs in-place on the shared checkout, and the next dispatch 409s on dirty_worktree (research-patch 2026-06-01-aif-task-isolation.md §1-§2; the live config-fix applied to this instance does not propagate to other instances). ensureParallelEnabled(baseUrl, projectId): GET /projects → if parallelEnabled is already true, no-op; else PUT /projects/:id with parallelEnabled=true. Wired best-effort into AifHandoffBackend.dispatch() Step 0 (warns + proceeds on failure, never blocks dispatch) and shipped as a standalone CLI (--project / env). Anti-clobber (load-bearing): aif has no targeted parallelEnabled write (only PATCH /:id/auto-queue-mode), and the full PUT NULLs any omitted *MaxBudgetUsd (@aif/data updateProject: `x ?? null`). So the guard round-trips the FULL field set read back from GET — flipping ONLY parallelEnabled — to preserve a UI-set budget. Paired-negative test pins this: a set budget MUST survive the PUT. Cleaner long-term fix = an upstream PATCH /projects/:id/parallel-enabled mirroring the existing auto-queue-mode PATCH (file against lee-to/aif-handoff); this guard is the our-side stopgap. 6 new tests green; runtime-bridge typecheck clean. Prior-art: prior-art-evaluations.md#109 (park.ts BUILD — same class: thin our-side runtime-bridge consumer CLI over aif REST where no upstream targeted primitive exists; here parallelEnabled-reconcile, no upstream PATCH beyond auto-queue-mode; cleaner fix REFERENCEd to upstream, this is the stopgap).
* feat(coordination): link-coordination.sh --on-conflict=canon|worktree|skip (default skip) Adds --on-conflict flag with three modes resolving the real-file-in-both conflict deterministically: skip (default, exit 1, never clobber), canon (canonical wins, relink), worktree (worktree wins, adopt into CANON). Invalid values exit 2. TDD: 4 tests in link-coordination.test.ts. Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; arg-parse + branch logic only, no new file/dep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(coordination): link-coordination.sh shares root _plan-cache.md + _master-backlog-delta.json (Part-2, SSOT #110) Adds a ROOT-FILE adopt-then-link + link pair so the two root-level gitignored coordination files (_plan-cache.md, _master-backlog-delta.json) are shared across worktrees — previously unmatched because the loops only iterated umbrella subdirs */. Tracked root README.md untouched. TDD: 3 tests in link-coordination.test.ts. Prior-art: skipped — extends existing scripts/link-coordination.sh (SSOT #110), no new capability/dependency; mirrors existing umbrella adopt/link loops for root files. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…inciple-12 exempt hygiene) (#364) * feat(hooks): i18n — split reminder payload into lang packs (en canonical / ru operator) The two reminder hooks (ask-question-reminder, end-of-turn-reminder) emitted Russian payload prose inline. Splits logic from payload: hooks keep all logic and source a language pack (.claude/hooks/lang/{en,ru}.sh) selected by AIF_HOOK_LANG (default en — canonical, for the public repo). Operator sets AIF_HOOK_LANG=ru once globally in ~/.claude/settings.json. - lang/en.sh + lang/ru.sh: aif_msg_* functions (${anchor} resolved at call time via dynamic scope) + AIF_RECAP_MARKER (recap heading; guard and message read the same var so they stay language-consistent). - lang/check-parity.sh: deterministic, no-LLM guard against #two-prompts-drift — asserts both packs expose the same key set. Local/reviewer step, not a blocking gate (hooks are @CC-Only, not shipped). - Tests run the existing cases under AIF_HOOK_LANG=ru (RU-pack contract; Russian transcripts + assertions unchanged) + add an en-pack smoke per hook. - RU payload byte-identical to before; EN is a faithful translation. Behaviour preserved (30/30 hook tests green). Out of scope (surfaced): Russian code comments in the two hooks; other 11 hooks; questions.ts strings. Spec: docs/superpowers/specs/2026-06-01-hook-lang-i18n-design.md Prior-art: skipped — i18n refactor of existing internal hooks, no new capability (string externalization to lang packs, no dependency, no packages/ code module) * test(principle-12): drop stale 'qloop-ux-probe' from EXEMPT_LIST The qloop-ux-probe question-loop fixture dir (gitignored, added to EXEMPT_LIST 2026-06-01 by Finding F2) is gone — the positive-guard test correctly flagged it as a stale exempt entry ("exempted but now absent"). Remove it per the test's own instruction; 'aif-ssot-corrections' remains the sole exempt entry. Surfaced while unblocking the hook-i18n PR's local pre-push (principle 12 runs on gitignored kickoffs locally, skips in CI). Maintainer-invited in-session. Prior-art: skipped — principle-test allowlist hygiene, no new capability (one stale entry removed from EXEMPT_LIST + doc comment)
…nk (#365) Enabling per-task worktrees (parallel_enabled, #362) makes aif RETAIN worktrees post-terminal (research-patch 2026-06-01-aif-task-isolation.md §2.1), and the old in-place task checkouts had already left 14 stale feature/* branches on the shared checkout. The session janitor (#358/#359) deliberately did NOT touch container git. §4 extends it to prune ONLY container git merged into origin/staging: git worktree prune + remove retained non-main worktrees on merged branches + delete merged feature/* branches. SAFE BY CONSTRUCTION — `git branch --merged` filtering AND `git branch -d` (refuses unmerged) double-guard; unmerged in-flight work is never touched. Also fixes the docker-exec stdin bug (needs -i for `sh -s` heredoc). Completes the #359 "no manual/AI sweep" principle for container git state. This is operator/co-located tooling (docker exec); the portable fix is upstream auto-removal of retained worktrees (worth filing against lee-to/aif-handoff). Live-verified on the real container: dry-run + real run deleted 7 merged branches and preserved all 6 unmerged (+ the checked-out one). No unit test — matches the 4 untested sibling janitor scripts; safety is by-construction + live paired-evidence. Prior-art: skipped — extends an existing janitor script (no new dependency, no new >=80 LOC file, not a capability commit); the parallel-worktree capability it cleans up after is #362/#109.
…mutation.sh (universalmutator ADAPT, local/on-demand) (#366) Stage 2 B.2 of mutation-discipline-umbrella. ADAPTs universalmutator (MIT, deterministic regexp engine + analyze_mutants harness — no LLM) to mutation-test .claude/hooks/*.sh against their paired-negative vitest tests. The only project-authored artefacts are bash.rules (operators), a thin wrapper, and the wrapper's own paired-negative test. Delivery = session-bound / local on-demand (NOT CI), mirroring Stryker-as-devDep; the original kickoff B.3 CI job is dropped. universalmutator is a dev-time tool, never consumer-shipped. Dogfood gate (mandatory) surfaced real, undocumented test gaps: end-of-turn-reminder 52% / validate-prompt 56% (both below the 60% floor) — the &&/|| mutation of their suppress/skip conditions survives uncaught. Recursive bootstrap: the wrapper mutated by its own operators is killed 13/13 by its own test. Found + fixed a /*-in-comment regexp-engine limitation (bash globs in comments falsely trigger C-block-comment mode) via a line-count-preserving sanitiser. Evidence: docs/meta-factory/research-patches/2026-06-02-bash-mutator-b2-shipped.md Prior-art: prior-art-evaluations.md#91 (universalmutator ADAPT — engine ADOPTed verbatim, only bash.rules operators authored; problem-class ~85% match per B.1 §B.1.5; mutahunter REJECTed on no-paid-llm-in-ci §1).
… + G/B/C installer (#368) * docs(coordination): design — cross-worktree persistence fix (4-channel: git-hook agnostic floor + CC + Superset + skill) Brainstorm output for coordination-persistence-fix umbrella. T16 corrections: - channel C substrate = Superset projects/<uuid>/config.json setup-array (rsync = root cause), NOT ~/.superset/hooks/ - adds git post-checkout (.husky) as the harness-agnostic floor per maintainer 'works everywhere' requirement - Q3 atomicity already satisfied (mktemp+mv verified); SSOT #110 same anchor Prior-art: skipped — design doc only, no new capability (extends link-coordination.sh SSOT #110). * docs(coordination): correct §2.4 — helpers atomic but NOT symlink-preserving (mv replaces symlink) Planning-phase finding (verified empirically): mv tmp <symlink> replaces the symlink with a real file → Part-2 cross-worktree share lost on first cache write. SW-B upgraded from 'confirm test' to 'make 3 helpers symlink-aware (write-through resolved target)'. Atomicity preserved (temp+mv in target dir), symlink preserved. Prior-art: skipped — design doc correction only, no new capability. * docs(coordination): implementation plan — 4 sub-waves (A linker / B symlink-aware helpers / C wiring / D self-apply) Prior-art: skipped — plan doc only, no new capability (implements SSOT #110 extension). * feat(coordination): one-click install-coordination-wiring.sh (G+B+C, idempotent, self-test) Applies all 3 wiring channels in one terminal command (maintainer runs from central repo): G .husky/post-checkout (agnostic floor) B .claude/settings.json SessionStart C ~/.superset/projects/*/config.json setup (replaces rsync root-cause) --self-test (sandbox) + --dry-run modes; idempotent re-runs. Replaces the manual runbook. Prior-art: skipped — scripts/ helper, not a capability commit (no dep, not under packages/); wires existing link-coordination.sh SSOT #110. * fix(coordination): 3 cache/delta helpers symlink-aware (SW-B) resolve_target() follows a symlink to its real $CANON target so the atomic temp-then-mv write writes THROUGH the link instead of replacing it. Without this, the first cache/delta write breaks the cross-worktree share (mv tmp <symlink> → real file). +3 paired-negative tests (symlink preserved + canon written through); 18/18 green. Done locally (not via aif — container serialized on doc-audit task). Prior-art: skipped — symlink-preservation fix to existing helpers, no new capability; extends link-coordination.sh SSOT #110 share semantics. * docs(coordination): drop channel A (skill self-heal) — redundant after G git-hook B (CC SessionStart) fires at every session start ⊇ 'when meta-orchestrator runs', and G (git post-checkout) is the real agnostic floor A was standing in for. Final channel set = G + B + C, wired via install-coordination-wiring.sh. Prior-art: skipped — design doc scope-reduction, no new capability.
… (no ref-lock contention) (#367) §4 (container git prune, #365) runs git fetch / worktree prune / branch -d in the SHARED .git. A task running concurrently touches the same ref + packed-refs locks (amplified by parallel_enabled keeping multiple tasks active) → a collision yields "cannot lock ref" and can fail the live task's git step. Guard: GET /tasks, count non-terminal (not done/verified/cancelled); if >0, skip §4 with a clear note ("re-run when idle"). Deterministic, no AI. Fail-open (count unknown → 0 → proceed) — §4 is already merged-only safe-by-construction, so this is defence-in- depth; worst case of a false 0 is a transient lock retry, never corruption or data loss. Live-verified: with 2 non-terminal tasks running, `--dry-run` §4 printed "skipped — 2 live". Prior-art: skipped — edits an existing janitor script (no new dependency, no new file, not a capability commit); guards the #365 sweep against the #362 parallel_enabled concurrency window.
…Start) (#369) Makes the two machine-agnostic wiring channels durable + shared (were applied locally by install-coordination-wiring.sh). Both call link-coordination.sh (SSOT #110): G .husky/post-checkout — agnostic floor, fires on git worktree add B .claude/settings.json — CC SessionStart re-heal Channel C (Superset setup-array, per-UUID) stays installer-only. SW-D liveness: G verified live — fresh worktree auto-linked 287 files. Prior-art: skipped — wiring of existing link-coordination.sh SSOT #110 into hook channels, no new capability.
…tignore stryker sandbox (#371) Autonomous aif audit (task bcb2c6c2): full doc-vs-reality + vs-goal reconciliation, Stage 2.0 mutation-run fuel, DECISION-NEEDED batch (DN-1..4), §A self-classification. Audit-only — no maintainer-owned edits landed. Also gitignore packages/core/.stryker-tmp/ so mutation runs never pollute the tree (root cause of PR #370 contamination).
…rompt (B.2 dogfood follow-up) (#373) The Stage 2 B.2 bash mutator (#366) surfaced two hook tests below the 60% kill floor: end-of-turn-reminder (52%) and validate-prompt (56%). Add targeted cases that kill every NON-equivalent surviving mutant: - end-of-turn-reminder 52% → 69%: cover the previously-untested idle-suppress re-ping guard (hook:135-156) — suppress-on-reping, fire-on-new-question, long-answer-overrides-suppress, the B2 "an AskUserQuestion turn is never idle-suppressed" contract — and the bare non-question tool-call early exit (hook:53-54). The 10 residual survivors are equivalent mutants: 7× `|| true` → `&& true` inside `$(…)` command-substitutions (stdout unchanged, exit ignored under set -uo, no -e), the transcript-validity guard (both paths exit 0/empty for the only diverging input), `set -e`→`set +e` (hook never relies on errexit aborting), and the inner re-ping AND→OR (divergence requires prev==last+recap, which trips the self-recap guard first). All 22 killable mutants are killed. - validate-prompt 56% → 78%: deterministically exercise the tsx-unavailable graceful-skip (hook:26-27, isolated-root copy) and the jq-unavailable graceful-skip (hook:14-16, fake-bin PATH without jq). The 2 residual survivors are gh+validator-coupled (hook:21 off-path-proceeds-to-validator, hook:33 validator-result) — killable only with a live-gh 404 test, which is non-hermetic; left per T-MUT-B rather than shipping a flaky test. Test-only; no production hook modified. Follow-up to #366 (mutation-discipline-umbrella Stage 2 B.2).
…tooling (#374) doc-audit-ship-boundary Stage 2 — maintainer decisions 2026-06-02, applied. Applied (maintainer-directed, DN-1/2/4): - .claude/rules/rule-enforcement-channel-selection.md: 'Activation pending' → 'Activation confirmed — settings.json:114' (Class header + §4 prose); the PostToolUse Edit|Write hook is wired (verified settings.json:114). - README.md badges: ?branch=main → ?branch=staging (main=prod, CI runs on staging). - README.md enforcement chain: drop false 'Stryker' from the CI channel — mutation tests are local/session-bound, NOT a CI gate (no workflow runs Stryker). Tooling shipped alongside: - scripts/apply-doc-fixes.sh: idempotent, terminal-runnable fixer (re-applies the above; --check dry-run). packages/core/hooks/apply-doc-fixes.test.ts: 5 green. - docs/meta-factory/mutation-run-placement.md: DN-4 placement note (mutation local; ps/jq/universalmutator reqs). Prior-art: skipped — maintainer-directed doc-staleness fixes + their fixer tool + a placement note; no new runtime capability, no dependency, no packages/ code module.
…00 (#375) The principle-12 population sentinel capped local kickoff dirs at 100. The project legitimately accumulated >100 umbrellas of history, mirrored locally by the coordination-persistence channel (G, .husky/post-checkout → link-coordination.sh), so the ≤100 guess tripped the pre-push on every worktree. Raise to ≤300 (still catches a runaway glob) and ≥100 (doubles as a 'mirror present' guard). The sentinel is skipped in CI (KICKOFFS_AVAILABLE) — it only gates local pre-push. Maintainer-directed 2026-06-02. Does NOT resolve the separate citation-check vs symlink-mirror interaction (the broader principle-12-vs-G item) — bound only. Prior-art: skipped — adjusts a sentinel bound in an existing principle test to match reality; no new capability, no dependency, no new module.
…fs (#376) Citation check re-ran on every umbrella mirrored in by channel G (post-checkout → link-coordination.sh symlinks gitignored kickoff.md into $CANON), failing on historical umbrellas this worktree never authored (principle-12-vs-G). Fix: check only REAL (non-symlink) kickoff.md = locally authored. Population sentinel still counts the FULL set as a mirror-present guard. Pairs with #375 (bound→100..300). Prior-art: skipped — narrows an existing principle-test filter to exclude symlink mirrors; no new capability, no dependency.
…la + meta-launch) (#547 P1) (#606) Consolidated clean commit off staging (supersedes conflicted #603, which carried bfe19ae across a squash boundary). Adds the §4c park-don't-guess contract to both the umbrella kickoff (aif dispatch target, taskId c22b89e0) and the meta-launch orchestration kickoff. Markdown-only; not a capability commit.
…124/#125 (#551 residual) (#607) Design-first R-phase for an idempotent consumer refresh path that updates framework-owned shipped artefacts without clobbering consumer-owned files. Output (doc only, no implementation code — T2/T5): - research-patch 2026-06-17-consumer-upgrade-path.md: WebSearch prior-art sweep (copier/cruft = Python, no Node-consumable analog), recommended BFR verdict ADAPT-no-dependency, framework-owned-vs-consumer-owned boundary derived from SHIPPED_DOCS + three-layer model + .override.md, conditioned implementation plan. - prior-art-evaluations.md: SSOT #124 (cruft, ADAPT) + #125 (Copier update for refresh, ADAPT) — both cross-reference #22, append-only. Two genuine forks PARKED for the maintainer per kickoff §9 + reviewer-discipline §2: (1) ADOPT-dep vs ADAPT-no-dep vs BUILD; (2) stateless refresh vs shipped-version stamp. DeepWiki MCP unreachable in env (per #121/#123 precedent) → WebSearch + SSOT substituted; recorded as a §0 methodology caveat. No code shipped. Prior-art: skipped — docs only (R-phase research-patch + SSOT register rows), no new capability commit (no dep, no code under packages/). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ateless (maintainer 2026-06-17) (#609) Maintainer resolved the two parked R-phase forks (both = the R-phase recommendation): 1. Refresh mechanism → ADAPT, no new dependency (reuse copy_safe + merge_prettierignore marker-block pattern; reject copier/cruft Python dep + bespoke 3-way merger). 2. Version awareness → stateless v1 (no shipped-hash stamp; .override.md is the divergence seam). Replaces the umbrella kickoff's open design questions with the decided design; the active implementation plan is research-patch 2026-06-17-consumer-upgrade-path.md §5 (T1-T4 + T15), which was conditioned on exactly this Option-A/Option-A choice. Unblocks the implementation /pipeline (design->impl gate cleared). Prior-art: skipped — docs only (kickoff decision-record edit, no new capability / dep / code under packages/).
…#547 P1) (#610) * docs(aif-init-passport-gen): R-phase prior-art consult + parked design forks (#547 P1) Design-first task dispatched under the LIVE park-don't-guess contract. Did the deterministic work the contract authorizes — prior-art consult (own-stack-first CC /init + tool-bootstrapping; WebSearch/WebFetch x3 phrasings; DeepWiki MCP unavailable in container, substituted per #121/#123) — and PARKED the 4 genuine design forks (delivery channel / run-timing / det-vs-LLM split / review gate) as DECISION-NEEDED rather than guessing them. No generator code (T5, R-phase). - SSOT #124 ADAPT (CC /init, own-stack — reuse mechanism, build schema residue) - SSOT #125 DEFER (ai-doc-gen + human-curation research finding) - SSOT #126 DEFER (Repomix/gitingest/StackSync — own detector covers detection) - SSOT #127 DEFER (Cursor generators — parallel-evolution, harness-specific) - SSOT #128 REJECT (Aider repo-map — T16 name-trap, in-context ranking != gen) - Plan: design/R-phase output, status blocked_external/manualReviewRequired. Prior-art: prior-art-evaluations.md#124 (CC /init ADAPT, own-stack-first), #125 (ai-doc-gen DEFER), #126 (Repomix family DEFER), #127 (Cursor generators DEFER), #128 (Aider repo-map REJECT, T16 problem-class mismatch). New SSOT entries landed in this commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(aif-init-passport-gen): implement AI-driven passport generation (I-phase, GH #547 P1) Deliver the aif-init I-phase: portable agents/aif-init.md agent + deterministic detector/passport.ts + principle 23 (2-fixture acceptance test). Design forks resolved with evidence-backed defaults (park-don't-guess R-phase evidence → sensible-defaults in HANDOFF_MODE=1): - Delivery channel: agents/aif-init.md (portable markdown, ships to consumer .claude/agents/ via install.sh glob — same path as existing review-sidecar.md) - Run-timing: explicit post-install AI-session step (install has no AI; #548 seam) - Det-vs-LLM split: thin deterministic detectPassportFields() core (all null-safe, tested on 2+ fixtures) + agent instructs LLM to fill prose (SSOT #125 empirical: deterministic-inspect-first then ground LLM in that evidence) - Review gate: explicit DRAFT banner + required human edit before removing Files: - agents/aif-init.md: 5-step portable agent (detect → generate DESCRIPTION.md → generate ARCHITECTURE.md → write DRAFT → review gate). Ships to consumers. - packages/core/detector/passport.ts: detectPassportFields() reads root + workspace package.jsons, maps deps to passport fields (framework/db/orm/ observability/testRunner/mobile/uiLayer/dbSchemaPath). All-null on unknown. - packages/core/detector/fixtures/hono-drizzle-monorepo/: Fixture A (apps/api workspace: Hono + Drizzle + pg + Honeycomb + Vitest) - packages/core/detector/fixtures/nextjs-prisma-flat/: Fixture B (Next.js + Prisma + Vitest flat repo) - packages/core/principles/23-aif-init-passport-gen.test.ts: principle 23, 13 tests - no-placeholder assertion on both fixtures + T-Passport-A counter (different fixtures yield different stacks, proves detection is not hardcoded) - install.sh: add agents/aif-init.md to SHIPPED_DOCS (count 18 to 19) - 09-doc-authority-hierarchy.ts/.test.ts: add agents/aif-init.md to REQUIRED_HEADER_DOCS; update install count sentinel 18 to 19 Acceptance criteria met: 1. detectPassportFields on each fixture produces zero <...> placeholders, stack-correct 2. 2 differently-shaped fixtures proved (Hono+Drizzle monorepo vs Next.js+Prisma flat) 3. AI-agnostic: agents/aif-init.md runs on operator session only; degrades to template copy when no AI present (see Degradation section in agent) Prior-art: prior-art-evaluations.md#124 (CC /init ADAPT - mechanism reused: AI session reads repo, drafts, human curates; AIF passport schema is the only build residue), prior-art-evaluations.md#126 (Repomix/StackSync DEFER - own-stack detectPassportFields reuses readPkgDeps pattern from read-manifest.ts, no new dep). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(aif-init): remove Bash-tool mkdir from agent — Write creates parent dir automatically (rework) The agent prompt at agents/aif-init.md:183 previously instructed the AI to run `Bash: mkdir -p .ai-factory` before writing output files. The Write tool creates parent directories automatically, so this Bash invocation is incorrect and inconsistent with the declared tool list (Read, Glob, Write only). Prior-art: skipped — refactor only, no new capability Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…eline-completion-scan-skip-closed) (#613) * perf(pipeline): skip already-closed umbrellas in the dup-detect completion scan /pipeline priority/completion scoring ran the expensive per-umbrella dup-detect jaccard pass over the FULL umbrella set, including umbrellas already provably closed by a cheap signal (done.md / branch-match). Measured 2026-06-17: ~85% of the 164-umbrella backlog is already closed (139 done.md), yet still paid the full per-umbrella scan. Fix (shape a, orchestration-side): priority-score.sh computes the cheap closed-set first (C3 done.md file-existence + C1 merged-branch match, both already in hand) and feeds dup-detect ONLY the open survivors via a new opt-in MO_UMBRELLA_SUBSET seam. dup-detect stays closure-agnostic (it scans the names it is handed); its two existing callers are unaffected — the standalone dedup caller (SKILL §2.5 Step 2) never sets the subset, so its --all / single-name behaviour is unchanged. AC-0 (measure-first gate): dup-detect --all full=446.3s (164) vs open-only=76.3s (27) vs umbrella-invariant gh+precompute=3.0s → per-umbrella jaccard IS the dominant cost (~2.70s/umbrella; invariant is 0.67%). Skip-closed saves 370s (83%). AC-5: priority-score.sh end-to-end WITH the fix = 78.65s (vs the >15 min baseline). AC-2 (paired-negative, correctness invariant): an umbrella closed ONLY by C2 jaccard (no done.md, no branch) stays in the subset and is STILL classified DONE — proven by unit test + real data (7 live basis=jaccard closures preserved; all 27 open survivors' C2 verdicts byte-identical between full and open-only runs). Tests: packages/core/hooks/priority-score-skip-closed.test.ts (AC-1 subset-excludes-cheap-closed via probe-file + AC-2 C2-only-still-DONE + edge cases); packages/core/skills/dup-detect.test.ts Test 11 (MO_UMBRELLA_SUBSET seam, paired-negative — default --all unchanged). principle 12 green. Prior-art: REUSE — skip-closed pre-filter reuses the already-shipped C1 branch-match + C3 done.md completion signals (prior-art-evaluations.md#77 Cline committed-markdown, ADAPT) to gate the existing dup-detect C2 pass; perf reorder + paired-negative test, no new capability. * docs(done): close pipeline-completion-scan-skip-closed umbrella — PR #613
…n C) (#611) * fix(hooks): hook-test-suite-rot F1-F4 + gate the hooks suite in CI (option C) Resolves the packages/core/hooks/ vitest failures classified in the hook-test-suite-rot investigation (research-patch + PR #608) and closes the structural gap that let them accumulate: the hooks suite was never gated in CI (only principles/ was). F4 (real cross-platform regression): priority-score-synthetic.sh surface (b) used find|xargs grep under 'set -euo pipefail'. On GNU/Linux an empty find or a no-match 'grep -l' makes xargs exit 123, which pipefail+set -e turn fatal, aborting the whole script — 15 failures across 3 hook test files on Linux/CI, invisible on BSD/macOS. Rewritten to the process-substitution + per-file 'grep -q' shape already used by surface (c). Stale assertions updated to current behaviour: - F1 pre-push.test.ts: audit-ai-docs.test.sh -> .ts (Wave 10.4); hook-stub-completeness.test.sh -> principles/16. - F2 link-coordination.test.ts (7) + F3 worktree-setup-hydration.test.ts (3): managed-file fixture kickoff.md -> state.md (SSOT #116: kickoff.md is now a tracked durable doc the helper skips; state.md is the gitignored runtime). - end-of-turn-reminder.test.ts: normal-mode bare decision-mention is now silent (claim-scan removed) — guard flipped to the paired-negative. CI-gap option C (maintainer decision): - New 'test:hooks' script + a gate step in the principles-meta-tests job (part of required ci-success). Root 'npm install' hoists tsx so the check-doc-authority hook runs rather than graceful-skipping. - check-doc-authority.test.ts skips when root tsx is absent (dev-machine env-dependent marking); runs + gates in full CI. No new deps; not a capability commit. * fix(hooks): GNU-first stat for marker freshness (orchestration-mode broke on Linux) Second cross-platform bug surfaced by the new hooks-suite CI gate (option C). end-of-turn-reminder.sh + ask-question-reminder.sh read a marker file's mtime via `stat -f %m || stat -c %Y` (BSD-first). On GNU/Linux `stat -f` is --file-system, so `stat -f %m` EXITS 0 with a garbage value — the || fallback never fires, the marker reads as expired, and orchestration-mode / ask-question freshness silently never activate on Linux/CI (5 end-of-turn in-mode tests failed once the suite was gated). Reversed to GNU-first: `stat -c %Y || stat -f %m`. BSD `stat -c` fails cleanly (illegal option), so macOS still resolves via the fallback (verified diff=0). 621/621 hooks green on macOS; the gate validates the Linux side.
…@3.8.3 (GH #531 dogfood) (#614) agents/aif-init.md was introduced by #610 (aif-init passport gen) and landed not Prettier-clean — likely via a push path that skipped the PR-only format-shipped gate. As a result audit-self.yml's "Shipped artifacts are Prettier-clean" step (npm run format:check → scripts/format-shipped.sh) went red on EVERY PR to staging, even PRs that don't touch the file. Fix: `npm run format` (scripts/format-shipped.sh --write, prettier@3.8.3) over the shipped surface. Only agents/aif-init.md changed. The diff is whitespace-only — blank lines inserted before lists/code-fences and GFM table column re-alignment; no prose or semantic token altered (verified line-by-line against prettier dry-run output). Whole shipped surface now reports "All matched files use Prettier code style!". No new capability (whitespace normalization of an existing shipped artifact).
…rk upgrade (#615) Adds `install.sh --refresh` — an opt-in, stateless re-sync that overwrites the framework-owned artefact set (agents, skills, hooks, scripts, skill-context overrides) while preserving all consumer-authored files. Design: ADAPT, no new dependency (SSOT #124/#125). Reuses `copy_safe` machinery and the `merge_prettierignore` marker-block pattern. Boundary derived from `SHIPPED_DOCS` ∪ other `copy_safe`'d framework artefacts; consumer-ownership signal = sibling `<file>.override.md` (Layer-3 per INSTALL-FOR-AI.md). Changes: - `install.sh`: `refresh_safe()`, `refresh_skill_with_transform()`, `do_refresh()`, `--refresh` flag + auto stack-detection, `--refresh --dry-run` preview support - `tests/install-sh/consumer-upgrade-path.test.sh`: paired acceptance gate (stale-refreshed + customise-survives, each with a non-vacuity arm); PASS=10/10 - `INSTALL-FOR-AI.md`: "Refreshing framework artefacts" section wired to the three-layer model (§override → skip; stateless v1 note; dry-run workflow) - `INSTALL.md`: "Updating the package" section — Path A is now `--refresh` (safe selective update), Path C/D are the old --force / manual paths - `.github/workflows/audit-self.yml`: consumer-upgrade-path.test.sh wired into CI Prior-art: prior-art-evaluations.md#124/#125 (cruft + Copier update — ADAPT, no dependency; concepts reused into copy_safe per the decided design). Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…ettier CI gate) (#616) agents/aif-init.md landed Prettier-dirty via PR #610 (aif-init-passport-gen); the shipped-prettier gate runs on pull_request and tests the merge-with-staging, so it was failing ci-success on every open PR. Pure 'prettier --write' reflow (blank-line normalization + markdown table alignment) — no content change. Maintainer-authorized fix to a maintainer-owned agents/ artifact.
…ier gate) (#617) agents/aif-init.md (landed via #610) was not Prettier-clean, reddening the audit-self "Shipped artifacts are Prettier-clean" gate on every staging PR. Formatting-only (npm run format / prettier@3.8.3): blank lines before lists and code fences, zero content change. Restores green out-of-box `npm run validate`.
…ous, task 6434ae2f) (#608) Classified root-cause report for the packages/core/hooks/ vitest failures. Headline: a real cross-platform regression in .claude/skills/pipeline/helpers/priority-score-synthetic.sh:49 (unguarded xargs grep -> exit 123 on GNU/Linux) accounts for 15 failures across 3 hook test files, in committed code, CI-invisible because the hooks suite is ungated. CI-gap (gate the hooks suite?) parked as DECISION-NEEDED. Report only; no fixes applied (investigation scope). Env caveat: ran in the aif Linux container (no jq) so check-doc-authority + end-of-turn-reminder (skipIf(!jq)) were not executed there; they need a macOS re-run.
…_DIR-immune for worktree pushes) (#620) run-audit.sh + all 5 probes + harness-self.test.sh resolved REPO_ROOT via `git -C <dir> rev-parse --show-toplevel`. During a `git push` from a worktree, git exports GIT_DIR/GIT_COMMON_DIR into the pre-push hook env, so that command misresolves: run-audit writes conformance-record.tsv to the wrong path, and the probes it spawns fail to source _cc-absent-lib.sh (record() undefined → 0 rows). The vitest companion (packages/core/principles/21-agnosticism-conformance.test.ts) resolves its path purely from file location, reads the correct path, and fails with ENOENT / a vacuous record — so principle 21 fails ONLY on worktree pushes, while passing from the primary checkout and in CI. Fix: resolve REPO_ROOT by pure path arithmetic relative to each script's own location (no `git` invocation), matching the vitest companion. The hook's GIT_DIR env can no longer pollute it. Prior-art: skipped — bug fix to existing agnosticism test harness, no new capability or dependency.
P1) (#622) Closure-debt: the session that merged #610 (AI-driven passport generator) did not write the done.md the CLAUDE.md umbrella-closure convention mandates at last-stage merge, so /pipeline + priority-score still surfaced the umbrella as not-DONE (no done.md = C3 layer empty; branch/jaccard did not match #610 to the slug). This done.md is the missing closure marker. Prior-art: skipped — closure done.md only (markdown under .claude/orchestrator-prompts/), no new capability per CLAUDE.md capability-commit definition.
… gate #576 + M2 probe #580) (#623) Umbrella fully shipped: framework now liveness-tests its own shipped agents. - R-phase #566 — survey + Option C verdict (form-gate + behavioural-probe, phased) - M1 #576 — principle 21 tools:-name allow-list gate; paired-negative arm catches the exact #551 zero-tool frontmatter (read_file/list_files/run_command) at pre-push - M2 #580 — agents/shipped-agent-liveness-prober.md, dormant operator-run RED->GREEN probe - SSOT #121 landed; agnostic agents migrated to canonical CC tool-names (#551 meta-irony resolved) Closes the umbrella per CLAUDE.md 'Umbrella closure convention'; restores priority-score completion-detection (Layer C3 done.md basis) — the umbrella was shipped but unclosed. Prior-art: skipped — umbrella-closure done.md marker under .claude/orchestrator-prompts/, no new capability (refs SSOT #121 already landed with the M1 capability commit #576).
…OT existence vs commit tree (#621) * fix(pre-push): derive range from pushed ref's local_sha, not HEAD; SSOT existence vs commit tree The TS pre-push hook (and its bash fallback) scoped every base-relative section to <base>..HEAD. resolveBase() reads the pushed ref's remote_sha from git stdin as the base but discarded local_sha, so pushing a feature branch from a checkout sitting on another branch (e.g. on staging) validated the checkout's HEAD commits — unrelated to the push. Compounding it, the section 7 C1 SSOT-existence arm read the register from the working tree (possibly dirty / a different branch), so a commit citing an entry present in its OWN tree was flagged broken (the 2026-06-17 #124 incident). Fix: getCommits/getChangedFiles take a head endpoint (default HEAD); ResolvedBase carries head = pushed local_sha for the stdin paths (HEAD for env/default), threaded into sections 6/7/1.7/8; runPriorArtCheck accepts a per-commit (sha)=>ids resolver so each citation is checked against that commit's own tree (git show <sha>:...); pre-push.fallback.sh gets the same r_sha..local_sha parity fix (dual-pair). Tests: new tests/hooks/prepush-cross-checkout-range.test.sh (HEAD != local_sha, the case the existing harness never exercised) + FB6/FB7 in the fallback harness + git.test.ts head-endpoint + prior-art.test.ts per-commit resolver. Prior-art: skipped — bug fix to existing pre-push range logic, no new capability or dependency. * style(pre-push): prettier-format pre-push.ts (shipped-artifact gate) The new multi-field return in resolveBase exceeded print-width; Prettier wraps it. Formatting only, no behaviour change. Prior-art: skipped — prettier formatting only, no capability or dependency.
…-gap (#624) The umbrella's done.md (PR #623, merged 16:05Z) was premature. Issue #550 — the parent acceptance tracker — states 16 min earlier (comment 2026-06-17T15:49:43Z): 'the broader post-install smoke is its remaining scope ... No new umbrella required — both follow-ups are already homed [under shipped-artifact-liveness-gap].' R-phase #566 + M1 gate #576 + M2 dormant probe #580 landed, but the post-install liveness-smoke (the #550 meta-proposal: actually RUN each shipped capability post- install, fail if silently dead) is committed scope of THIS umbrella, not a deferred out-of-scope item. Removing done.md re-opens it so priority-score detects it live. Prior-art: skipped — reverts a closure marker under .claude/orchestrator-prompts/, no capability change (corrects a premature DONE per parent tracker #550).
…tifact-liveness-gap remaining scope, #550) (#625) Design-only R-phase brief for the post-install liveness smoke — the unbuilt #550 meta-proposal (actually RUN each shipped capability post-install, surface silently-dead). Homed under the shipped-artifact-liveness-gap umbrella per #550 (no new umbrella). To be dispatched to aif-handoff. Records the operator's binding steer (2026-06-17): CI is dispreferred as a channel (aligns with README 'CI = last-resort gate'); design must prefer earlier channels (install --verify / operator doctor / pre-push). Channels left OPEN for the R-phase to resolve. Carries §5 AI-traps (principle 12) + §4c park-don't-guess contract for autonomous aif dispatch. Prior-art: skipped — orchestrator-prompts kickoff (planning artifact), no capability change; BFR/SSOT consult is the dispatched R-phase's own deliverable.
… smoke (#550) (#626) PR #625 wrote an aif-dispatch DESIGN kickoff prematurely. Operator-corrected flow (2026-06-17): the design must first be determined in a fresh interactive BRAINSTORM session (discuss all facets), THEN a plan, and ONLY THEN an aif-dispatch kickoff authored from the brainstorm results. The #625 kickoff jumped to the final phase and delegated design-determination to aif — out of order. Removing it; the brainstorm-plan precursor replaces it. Prior-art: skipped — removes a premature planning artifact under .claude/orchestrator-prompts/, no capability change.
…onfig wiring, #547 Layer 2) (#627) Design-first R-phase brief for a FRESH brainstorm session: AST-based per-package eslint config wiring at install (closes the deferred #547 Point 2 Layer 2), 'AST where they're better'. Captures verified context (ts-morph already a dep, install.sh node-optional/runs-before-deps/--full runtime model, astro/magicast industry UX) + operator design inputs (--full = assumeYes variant of one wire flow; thin bash probe -> TS-core ts-morph). §4 lists the open forks (scope A/B/C, ts-morph vs magicast, fold-into-migration-ast) for the brainstorm to resolve. NOT implementation.
… Layer 2) (#628) Design-only (T5) deliverable of the install-ast-wiring brainstorm. Resolves all seven §4 open questions with evidence (DeepWiki ×5 + WebSearch ×5): - Q3 Tool: ts-morph (REUSE, already in stack); magicast REJECT-as-engine — it structurally fails on the #535 target shape (SpreadElement / imported-base re-export unsupported). cargo add/toml_edit = cross-language REFERENCE. - Q1/Q4/Q7: Scope B under the operator's "ensure-then-use" model — bash ensures the AST engine then calls it; grep classifier kept as the node-absent degrade. - Q5 --full=assumeYes; Q6 skip git-clean (astro precedent); Q2 reuse migration-ast. - UX modeled on cargo/shadcn/astro (diff preview + confirm + idempotent), with a positioning note for tool promotion. Implementation is a separate later dispatch. Prior-art: skipped — design spec only, no new capability (T5 design-phase deliverable, ≥20-char rationale per CLAUDE.md escape hatch).
… (design spec + aif kickoff, #550) (#629) Lands the post-install liveness smoke design spec onto staging and adds the Phase-1 aif-dispatch kickoff, so /pipeline + aif (which read kickoffs from staging) can see them (per .claude/rules/kickoff-staging-placement.md). Scope: Phase 1 of design §8 only (framework-side live-signal assertions in the existing tests/install-sh harness; catches #548 + #549 before release; no new CI surface). Phases 2-3 (consumer 'aif doctor', behavioural --probe) are follow-on stages, not in this kickoff. Phase -1 cold-review: 1x Opus adversarial reviewer, 1 REVISE round (BLOCKER meta-all-wired CI wiring + 2 MAJOR + 2 MINOR), then GO; principle-12 7/7. Prior-art: skipped — design spec + dispatch kickoff under docs/ and .claude/orchestrator-prompts/; no new dependency, no code module, no capability change.
… impl kickoff (#547 Layer 2) (#630) Authors the IMPLEMENTATION dispatch input for the FROZEN design spec (docs/superpowers/specs/2026-06-17-install-ast-wiring-design.md, #628): the ts-morph AST wirer that injects R2 into a consumer-authored per-package eslint config (the #535 case), with diff+confirm+idempotency, ensure-then-use, and a node/engine-absent degrade. - New stage under the existing migration-ast umbrella (spec Q2 — reuse + close its done.md on ship). Tracked via a narrow .gitignore negation so it reaches staging for aif dispatch (kickoff-staging-placement.md §1). - Carries ai-laziness-traps §3 obligations (cite + active impl traps T3/T13/T16/T19 + new T-ASTwire-B) and park-don't-guess levers for autonomous dispatch (AGENT_MAX_REVIEW_ITERATIONS=1, park genuine forks). - §3 records a VERIFIED premise correction: the spec's "ts-morph already bundled in packages/core (zero new dep)" is false — ts-morph is the consumer dev-dep (setup.sh:336, ^24), not a framework dep; the engine-absent path must degrade, not crash. Encoded as verify-first + a parkable engine-availability fork (does NOT re-open frozen §4 verdicts). - Phase -1 adversarial cold-review run; 2 MAJOR citation/version defects fixed. Prior-art: skipped — docs-only dispatch kickoff + gitignore negation, no new capability (under .claude/orchestrator-prompts/, not packages/)
…e live-signals (#550) (#631) Harvested from autonomous aif task 314ff326. Adds four live-signal assertions to the tests/install-sh harness (each paired-negative), per design §8 Phase 1, catching #548 + #549 before release: - f16-stryker-live-mutants.test.sh — Stryker >=1 mutant across npm+pnpm (#549) - f17-lint-rules-planted-violation.test.sh — shipped lint rule flags a planted violation via the consumer toolchain (Check 3 Arm ii) - c1-wiring.test.sh — deps-hash hook emits no false-warn on fresh install (#548) - f8-agents-scripts-shipped.test.sh — shipped scripts exit 0 with non-empty output (Check 4) - audit-self.yml — wire f16/f17 into the principles-meta-tests job (satisfies meta-all-wired) Excluded from harvest: stale-container-base reversions the aif worktree carried (deps-hash-check #548 fix, GNU-stat hook fix, pipeline skip-closed perf) — NOT in scope; only the 5 in-scope paths were taken. Prior-art: skipped — Phase-1 test-harness extension under tests/install-sh/; no new dependency or packages/ module. SSOT #131 lands with the Phase-2 aif doctor capability per design §9.1.
… Stage 4, #547 Layer 2) (#632) * feat(install): AST-wire R2 into consumer eslint config (ts-morph; #547 Layer 2) GH #547 Point 2 Layer 2 — migration-ast Stage 4. Install-time AST config wiring: when a consumer has a per-package eslint.config.mjs that re-exports a base lacking R2, wire `rules-as-tests/no-unsafe-zod-parse: error` into it. Architecture (Option A — decided): Layer-2 runs AFTER §8 dep-install so ts-morph is resolvable; gated on --full; ensure-then-use pattern with degrade on node or ts-morph absent (rc=0 on every branch, lesson GH #531/#544). Files: - packages/core/install/wire-eslint-r2.ts: AST wirer (ts-morph; Fixtures A–E) - packages/core/install/wire-eslint-r2.test.ts: unit tests (Fixtures A–F) - tests/install-sh/wire-eslint-r2.test.sh: bash tests (D, F, L2-arm) - install.sh: ts-morph added to CORE_DEVDEPS; §6b-bis-L2 block after dep-install - packages/core/vitest.config.ts: add install/** include glob (was missing) - docs/meta-factory/prior-art-evaluations.md: SSOT entries #131–#135 T16 problem-class (audit-r4 vs wirer): audit-r4 reads+analyses .ts files; wirer edits+writes-back .mjs configs with format preservation — same engine, broader op; write-back is new (Fixture E is the acceptance gate). Premise correction from plan §3: ts-morph is a consumer dev-dep (setup.sh:336) NOT a framework dep — ensure-check tests node_modules/ts-morph/package.json; adding ts-morph to CORE_DEVDEPS makes it available after --full dep-install. Prior-art: prior-art-evaluations.md#131 (ts-morph REUSE — consumer dev-dep), prior-art-evaluations.md#132 (cargo toml_edit format-preservation REFERENCE), prior-art-evaluations.md#133 (astro/shadcn UX ADOPT VOCABULARY), prior-art-evaluations.md#134 (magicast REJECT as engine), prior-art-evaluations.md#135 (this wirer BUILD), prior-art-evaluations.md#117 (--wire-ci posture ADOPT), prior-art-evaluations.md#118 (check:enforced oracle ADOPT) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * ci: wire wire-eslint-r2.test.sh into audit-self.yml (#547 Layer 2) The meta-all-wired.test.sh gate asserts every tests/install-sh/*.test.sh appears as a run: step; the new harness test was missing → CI would fail. Inserting the step before the meta-gate so Fixtures D+F run in CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(ci): exclude install/ from tsc + run Fixture F wirer via tsx (#547 Layer 2) Two CI failures the worker env masked (newer Node + ts-morph present) that CI (Node 20, clean packages/core) surfaced: - typecheck: install/wire-eslint-r2.ts(86) `await import('ts-morph')` → TS2307; tsc resolves the module specifier even for a dynamic import. Exclude install/ from tsc, matching the existing probes/ exclusion for the ts-morph-using audit-r4.ts (same established pattern; do NOT add ts-morph to packages/core deps — that would let the wirer resolve the engine from the framework and break Fixture F's degrade premise). - Fixture F: the harness invoked the wirer via `node --experimental-strip-types`, a bad option on Node <22 (CI runs Node 20) → rc=9, no degrade message. Run via the framework's bundled tsx (how install.sh actually invokes the wirer) so the test is node-version-agnostic. Verified locally: `tsc --noEmit` clean after a fresh packages/core install; wire-eslint-r2.test.sh = 6 PASS / 0 FAIL. Prior-art: skipped — CI fix (tsc exclude + test invocation), no new capability --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…2 shipped via #632) (#633) Last-stage closure per CLAUDE.md «Umbrella closure convention» + install-ast-wiring design Q2 («two birds» — reuse migration-ast, close on Stage-4 ship). Stages 1-3 (probes→AST rules) + Stage 4 (install-time AST config wiring) all shipped. Prior-art: skipped — umbrella closure marker (done.md), no new capability
artyhoo
enabled auto-merge (squash)
June 18, 2026 05:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promote
staging→mainRoutine promotion of accumulated
stagingwork tomain. Last promote: main tipbd3d3e6(2026-06-14, via #504 API tree-push; last PR-object promote #488).Delta
main.docs(done)markers) in this range.Headline work landing
install.sh --refreshsafe in-place upgrade (feat(consumer-upgrade-path): install.sh --refresh — safe in-place framework upgrade (#551 residual) #615), AST-wire R2 into consumer eslint (feat(install): AST-wire R2 into consumer eslint config (migration-ast Stage 4, #547 Layer 2) #632), AI-driven project passport generation (feat(aif-init-passport-gen): AI-driven project passport generation (GH #547 P1) #610). Closes UX-2026: install should auto-configure by reading the repo (auto-wire rule enforcement + AI-generate project passport) — not ship placeholders + an inert/red gate for the human to reconcile #547 (both points), format:check fails out-of-the-box on ~50 installer-shipped files (npm run validate) — framework doesn't dogfood Prettier #531–Local 'npm run validate' does not actually enforce R2/R7/R8 on per-package-config monorepos — check:globs verifies glob-match, not violation-catching #535, Install is not 'one-button': copies files but leaves an 8-step manual checklist; no branch/MCP/plugin/dep setup #483, R2 (no-unsafe-zod-parse) guards zero files on flat / inline-router servers #507.tools:-name gate (feat(principles): shipped-agent tools:-name allow-list gate (M1, #551 regression-prevention) #576), dormant behavioural probe (feat(agents): dormant shipped-agent liveness probe (M2, Phase 2 of #551) #580), Phase-1 post-install liveness smoke (test(install-sh): Phase-1 post-install liveness smoke — framework-side live-signals (#550) #631). Closes Shipped sub-agents declare non–Claude-Code tool names (read_file/list_files/run_command) → empty toolset → they fabricate when dispatched #551, manual-rule-liveness-prober is shipped to consumers but DOA: reads framework-internal paths (rules-manifest.json/preset RULES/integration-rules) not in the install, and lacks the Task tool to dispatch #552, Tracking: functional acceptance of installed machinery on a consumer (timeliner) — most works; 2 silent breakages (#549 Stryker, #548 deps-hash hook) that install-correctness checks miss #550.<pending…>not recognized as unpopulated; message claims 'deps changed' when nothing changed #548), pre-push base-ref (pre-push.fallback.sh defaults base-ref to hardcoded origin/staging — no-ops on default-main consumers without git stdin (manual/CI runs) #568) — all via fix(consumer): #549 stryker plugins + #548 deps-hash wording + #568 pre-push base-ref (under #550) #598.Issues closed in this range
All previously-open issues are now closed: #547, #550, #551 (+ #531–#535, #548, #549, #552). Repo open-issue count: 0.
Merge note
base=mainPRs are maintainer-merged manually — the agent harness blocksgh pr mergeonbase=mainby policy.ghGit Data API tree-push somain's tree ==staging's tree; theguard-liveness-fullsweepcheck ispull_request-only and runs on this PR as the last-resort gate.🤖 Generated with Claude Code