Every completion now says whether anything checked it independently - #248
Merged
Conversation
The AI mirrors the terminology it reads in the surfaces it consumes while serving a user — the persona prompts and the managed AGENTS.md / CLAUDE.md blocks cladding writes into a project. 0.9.1 kept "shard" there and relied on the AI translating it to "spec entry" at relay time; in practice the AI echoes "shard" verbatim. Use the plain term at the source instead: the managed blocks and persona prompts now say "spec entry" / "per-feature spec files", and the translate-by-meaning guidance drops the "shard = spec entry" example that re-exposed the word. A guard test (tests/shard-term-guard.test.ts) scans the rendered managed blocks + persona sources and fails on any "shard", so it can't creep back. "shard" stays in code, identifiers, --json machine messages, and maintainer docs. Reconciles the interpreter-rule test (no longer requires the removed example) and the repo's own CLAUDE.md (dogfood byte-parity). Adds F-876b6f48. Live: `clad init` generates an AGENTS.md with 0 "shard". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…f590) Role-contract architecture, feature 1: make silent self-certification visible. A feature is 'independent' iff >=1 of its evidence entries is human-authored or blind-authored (blind: true); 'self-certified' otherwise, including zero evidence. - src/hitl/independence.ts: pure computeIndependence + independenceSummary - clad done: label on DoneResult + done_attempted event (kept and reverted paths); opt-in project.independence_policy: 'require' refuses a self-certified completion (spec entry reverted, human-review ask); default 'label' only annotates - existing behavior unchanged - clad verdict: per-done-feature labels in --json, human-line tail when any done feature is self-certified; computeVerdict stays IO-free - 31 new tests (independence/done/verdict); full battery green, strict pre-push gate GREEN, done earned via clad done Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ct card (F-600272d7) Role-contract architecture, feature 2: cladding declares WHAT must hold and judges evidence; the host owns execution (agent count, models, parallelism, progress UI). Drops the choreography layer our adoption data showed hosts ignore. - src/agents/orchestrator.md: routing table, invocation-principles list and host-mode WIP table removed; replaced by per-feature outcome conditions (spec-first, ACs satisfied, independence judged from recorded evidence via the independent|self-certified label, completion earned via clad done). Hand-off data contract, ai_hints policy, MCP init/clarify protocol and Soft Shell section kept. - docs/feature-cycle.md: headless clad run positioned as the CI/SDK lane; interactive host-engine execution is the default path. - tests/choreography-guard.test.ts: 13-case guard — banned needles (routing table / concurrent dispatch / invocation principles) on the persona and its codex/claude mirrors, pinned contract literals. - plugin mirrors regenerated; full battery + strict pre-push gate GREEN, done earned via clad done Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…93141b) Role-contract architecture, feature 3: planner/developer/reviewer/ observability/blind-author now present themselves as role briefs - scope, outcome conditions, and evidence obligations the host may embody with any agent shape - instead of agents cladding mandates spawning. - choreography residue cleaned (orchestrator "Principle 5" reference, dispatch-mechanics phrasing, multi-agent fan-out recipe framing); anti-self-cert sections now cite the evidence-based independent|self-certified label from F-c566f590 - blind-author's tool-config enforcement named as the architecture's structural exemplar; all pinned invariants preserved (Soft Shell, budgets, frontmatter, glossary rows) - tests/choreography-guard.test.ts extended by 40 cases: role-brief literal + banned-needle scan per persona and per claude-code mirror - mirrors regenerated via full build; 2689 tests green, strict pre-push gate GREEN, done earned via clad done Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ture Packed-tarball verification of the independence label, contract card and role briefs in an isolated external environment: 6 scenarios, all PASS, zero implementation defects. Records the confirmed design gaps - 'independent' is reachable only via the clad_author_oracle MCP tool (CLI-only users are locked out of it, hard-blocked under independence_policy: require), and no first-party surface anywhere writes human-authored evidence - plus two minor prose/UX observations, deliberately left unfixed pending a product decision. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Role-contract architecture, feature 4: the README's multi-agent story
catches up with the shipped behavior. Separation of duties is now framed
as a declared outcome condition cladding judges from recorded evidence -
every completion labeled independent|self-certified on clad done/verdict
(visibility, not a correctness claim), independence_policy: require for
teams that want refusal - and execution form (agent count, models,
parallelism) is explicitly the host's decision, with personas presented
as role briefs.
- all 6 README variants rewritten natively (en/ko/ja/zh + 2 html);
choreographic SVG labels ("orchestrator dispatches", "Dispatch -
routing") replaced with contract framing in the 4 localized diagrams,
text labels only
- pins preserved: Multi-Agent heading/order, hedged EU AI Act sentence
x4, detector/stage count literals
- tests/choreography-guard.test.ts extended by 14 cases (per-variant
dispatch needle, EN/KO label literals, comment-stripped SVG scan)
- 2703 tests green, strict pre-push gate GREEN, done earned via clad done
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Role-contract architecture, feature 5: the diagram geometry catches up with the prose. The hub is no longer an orchestrator dispatching workers - it is the host, which runs the role briefs (count, models, parallelism); the work converges into cladding's judgment card (gates - done is earned; label - independent | self-certified) instead of an "observability watches" framing. Text/label edits only across the four locale SVGs (en/ko/ja/zh), palette and card geometry conventions kept; all four renders visually inspected for overlap/clipping. - choreography-guard SVG cases tightened: raw whole-file cleanliness (no dispatch/orchestrat anywhere, comments included) + label literals per locale, obsolete comment-strip exception removed - 2712 tests green, strict pre-push gate GREEN, done earned via clad done Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ogfood-only commands (F-9d8ece66)
Role-contract architecture, feature 6. The managed AGENTS.md persona
map now states the briefs' standing explicitly: touchpoint manuals, not
a roster of permitted agents - any host agent may take up any brief,
none is needed off cladding surfaces, and the only identity-tied
judgment is the independence label (verifier independent of author,
never brief membership).
The sentence is behavior-validated, not just reviewed: a live A/B/C
experiment against fresh agents in the E2E clean-room showed the draft
wording ("any agent may do any work, the gates judge only the result")
was cited by 2/2 agents to discount the independence label, while this
final wording steered 2/2 agents to honest labeling and an explicit
refusal to route around the gate. Wording is pinned verbatim by test.
Also repairs E2E gap G3: planner.md sent external users to cladding's
repo-only npm scripts (spec:validate / stage:drift); it now directs
them to clad sync / clad check --strict. Mirrors regenerated.
2715 tests green, strict pre-push gate GREEN, done earned via clad done
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…-8476ccb1)
Role-contract architecture, feature 7. After four diagram drafts the
section now carries the inversion in prose alone - user's call: every
drawing of roles kept reading as a fixed cast.
- all 6 README variants: the section opens by denying the old identity
("not a multi-agent framework" - cladding neither prescribes nor sees
the host's agent topology), then a three-bullet contrast (one agent
does everything -> self-certified; a blind test author -> independent;
a human sign-off -> independent), then label/policy/briefs and the
hedged EU AI Act sentence. Native ko/ja/zh rewrites.
- docs/img/{en,ko,ja,zh}/multi-agent.svg removed; F-4498eb3d archived
(modules: [], superseded_by: F-8476ccb1) per the archive convention
- tests/choreography-guard.test.ts: 13 obsolete SVG cases removed, 8
prose-only pins added (identity-denial literal, no multi-agent.svg
reference in any variant, three-shape list present)
- 2710 tests green, strict pre-push gate GREEN, done earned via clad done
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…F-8476ccb1 follow-up) Paragraph 1 across all 6 variants now opens with what cladding is FOR - "one job: make every done trustworthy," judging verifier independence from recorded evidence - and demotes the not-a-multi-agent-framework denial to a subordinate clause. All guard pins unchanged and green; strict pre-push gate GREEN. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…cision (F-3fd220d8) The section explained what the independence label is and how it is earned, but never why a reader should care, so it read as "a word gets attached to my feature — so what". It now opens with the stake: one AI writing both the code and its tests produces a green run that proves nothing. The three examples move to problem → problem → way out, so the list closes on `independent`, and each carries its own reason instead of deferring to a paragraph below. The two `self-certified` cases sit adjacent with the second marked as sharing the label, which is what stops three examples against two labels from reading as a contradiction. A locale diagram returns at docs/img/<lang>/independence.svg. It draws the label decision — host band, one question, two outcomes, and the refusal a require policy adds — never a roster of agents; that is why the four earlier multi-agent.svg drafts were retired, and the invariant against restoring them is untouched. AC-7d433517 of F-8476ccb1 is reworded to state that invariant rather than a blanket no-diagram rule. Also corrects stale counts the version-bump script does not cover: 255/252 → 270/266 features, 236 → 248 test files. Guards test the intent, not the wording: the stake precedes the list, the two self-certified items are adjacent and marked, and the list ends on independent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…nefit claimable The only prior evidence for removing the orchestrator's choreography was the 0.9.1 dogfood S5, which says of itself that it is n=1, single-arm and "not a comparison". This runs the missing control. Single-variable ablation: the current build with only src/agents/orchestrator.md swapped for its pre-change version, so the engine, detectors and specialist briefs are held constant. Six Sonnet 5 agents, n=3/arm, identical isolated fixtures, scored by a hidden oracle against each arm's final implementation — never from transcripts. Result: the planted boundary bug was caught 3/3 in both arms. H1 confirmed — removing the choreography did not weaken real separation. Per the decision rule fixed before the data was read, the H1 NULL branch binds the framing: no benefit may be claimed for the removal in README, CHANGELOG or release notes. Effort favours the contract card (0.85x tokens, 0.68x tool calls at the median) but the ranges overlap, so it is reported as not resolvable at n=3, not as a win. Recorded honestly: a mid-campaign "more separation process" pattern was withdrawn as noise (2/3 vs 1/3) and failed the artifact-only scoring bar anyway; M2 was vacuous by design because the task assigned one feature; Phase 3 was cancelled before spending budget and is marked not measured, never answered. The durable finding is not about the orchestrator: three runs performed genuine blind separation and none could record it, corroborating G1 from outside the dogfood campaign. Backlog entry added for the independence surface — the policy switch has no first-party writer, no persona brief names it, and human-authored evidence has no writer anywhere. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ADMEs Accumulates the unreleased role-contract work onto a patch bump. Run through `npm run version-bump -- 0.9.2` so no site is missed — including the marketplace catalog the host reads to detect "update available", which HARNESS_INTEGRITY guards. The READMEs are not in the script's site list, so their Status tables are moved by hand in all four published variants. Not a release: no tag, no publish, no gh release. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every completion now says whether anything checked it independently
2026-07-26·feature/role-contract-architectureWhen one AI writes both the code and its tests, the tests get shaped around the code it just wrote — the bug is there and everything still passes. This adds a plain record of that: every finished feature is marked according to whether the building and the checking were done by different hands. It also stops cladding from telling you how to arrange your agents, and rewrites the Multi-Agent section of the README around why any of this matters.
Added
▸ A mark on every finished feature — independent when something checked the work without being able to see the code, self-certified otherwise. It describes the evidence, never which agents did the work or how many.
▸ An optional stricter setting — teams that want it can refuse to count unchecked work as finished, in which case a self-certified feature is put back to unfinished exactly like a failed check.
▸ A diagram in all four languages showing how a finished feature gets its mark — one question, two outcomes, and the refusal the stricter setting adds.
Changed
▸ cladding no longer tells you how to arrange your agents. The coordinator prompt dropped its routing table, numbered principles, named agent chain and work-in-progress table, and now states only the conditions a feature must satisfy. How many agents run, which models, and in what order is the host's call.
▸ The specialist prompts are selectable briefs, not a fixed cast — any agent may take up any of them, and one that never touches cladding needs none.
▸ The README's Multi-Agent section leads with the stake rather than the vocabulary: it explains the self-testing problem first, then the three ways a feature can end up marked, each with its own reason.
▸ Version moves to 0.9.2 across every version site and all four published READMEs.
Fixed
▸ Numbers that had drifted — the feature and test-file counts on the front page and in the status table were months out of date.
▸ A broken layout in the HTML READMEs — the "before / after" pair rendered as a single narrow card with two-thirds of the row empty, because one card sat alone in a three-column grid.
▸ A false claim about human sign-off. The section said a person approving a review earns independent. No code path records that, so the claim was removed rather than softened.
What we measured, and what we didn't
▸ The choreography removal was tested against a control — six agents, three per arm, differing only in the coordinator prompt, scored by a hidden check against each arm's final code. The planted bug was caught 3/3 in both arms: removing it did not weaken anything.
▸ No benefit is claimed. Effort favoured the new prompt but the ranges overlapped at this sample size, so the decision rule written before the run forbids calling it a win. The change is recorded as safe and neutral.
▸ Not measured: discipline across a long run of consecutive features. That phase was cancelled once it was clear the risk it targeted is already enforced by the gate, and it is recorded as not measured rather than answered.
Gate green, 2736 tests passing.
🤖 Generated with Claude Code