v1.5.2

This release adds the audit handoff: scripts/audit reconstructs an archived run from its history folder, with every value naming its source and saying whether the evidence for it is present, missing, stale, conflicting or unavailable. Missing evidence is never shown as a pass.

Highlights

• scripts/audit RUN_FOLDER [--repo DIR] [--head REF] [--out DIR] [--json] writes audit.json and audit.md (UTF-8) to RUN_FOLDER/audit/ and prints a short summary.
  • Per task: the requirement and its version, placement, rulings and changes, commits, review coverage, and four status fields kept apart: committed, reviewed, verified and accepted. A review of an earlier head is stale, not reviewed.
  • Run level: launches, code outside every recorded task range, checks, acceptance, commits after the delivered revision, and open work.
  • Acceptance: the run's verdict, the check-verify gate and any acceptance the user recorded are shown separately. The audit re-applies the engine's acceptance rules to the verify evidence (revision, results, clean tree), so a match from check-verify alone is not taken as proof.
• Archive boundary: audit reads only files inside the run folder (symlinks and junctions resolved) and git objects, read-only. It never reads the live paths in the manifest. An input that resolves outside the folder exits 2 and nothing is written. An --out inside the run's ledger or launch dirs is refused, and writes never follow an existing file or link.
• Privacy: configured commands (every group, setup included, any length) are replaced by <check:<id>> in one pass. Other recorded text is quoted as written, and audit.md starts by saying it holds local paths and recorded text and is not meant to be shared as-is.
• check-verify --ledger DIR is an archive mode: it reads only the archive's own <wf>.json, needs a finite launch end time (otherwise the new status unavailable, reason verify_evidence_time_untrusted), and needs no cygpath outside Windows.
• tool-outcomes --audit-exit N: the hand-back's "Run tools" line now reports the audit and its gap count. It still never mentions acceptance.

Behaviour to know

• The hand-back runs audit after autopsy and before tool-outcomes. After the user accepts named reasons with ledger accept, the session reruns archive-run, audit and tool-outcomes, so the override reaches the archive.
• The audit is informational. It never changes acceptance, the gate or the exit codes of the run.
• On archives from older engines many values read unavailable (no acceptance object, no saved verify evidence, no review heads). That is reported, never filled in.

Testing

• node tests/run-tests.mjs: 1156 tests, 1142 pass, 14 skipped, 0 fail on Windows locally; CI passed on Ubuntu (Node 22 and 24), macOS and Windows.
• The new and changed test files also pass on Python 3.8.20 (122 tests).
• audit was run on temp copies of all 24 archived runs on the maintainer's machine. Every one exits 0, and none of their configured commands appears in either report. r151, r152 and r153 read accepted with no gaps; r150 reads accepted with one gap (15 commits after its delivered revision); r142 reads accepted (gate unavailable); l131 reads unverified, as its own result does.
• A Windows junction that points outside the run folder is refused, on Python 3.14 and 3.8.
• Built by parallel-lanes run r153 (1.5.1 engine, its first real launch): 8 tasks (2 prelude, 4 lanes, 2 join), 25 agents, 118 min, 1 ruling, every task approved in its first review, 23 of 26 final-review findings fixed, 3 declined (one commit-message slip), none open, accepted with check-verify match. CI then caught one test that copied a run folder without its file times on Linux and macOS; it was fixed before the release commit.

Compatibility

• Additive: no engine change and no ledger migration. check-verify's live mode, its statuses and exit codes are unchanged; --ledger and the unavailable status exist only in archive mode.
• tool-outcomes without --audit-exit now adds "audit not run" to the Run tools line; the other parts are unchanged.

Upgrade

In your clone:

git pull && bash install.sh

Then start a new session, or run /clear, so the skill and hooks reload. Do not install while a parallel-lanes run is in progress: its agents use the installed helper scripts.