space-architect 5.5.1 → 7.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71935f28a32069832af5b4d25f368d33c7efc505267a98c4f4b49f75a0084861
-  data.tar.gz: 2b067fdbdd5a950b204ef9fb16a3484a634e0b6acd2f9ca467e8f47adec29902
+  metadata.gz: 1d521b0afec00484bfba5b35e26e9f0a603807fb75f3569fa61b0a0b5ff9b3ab
+  data.tar.gz: d21ecd2d8dd8458b0ec2e89d4cc2ee45a5a70eafc53955b8d2b3c365b55efe3b
 SHA512:
-  metadata.gz: 66a47fc8027809c4132ba9e5365694ab530d646be68b0cacec80d527e81dcb28f7d192afb4e76ea1e9b0489bada20013af2c32da066075e28f39bb407fc89243
-  data.tar.gz: f10a02847f4dafb408b98eb6a79f4b911bc0db7bf1856fbef18b751928f2e824ee5a5596db82ca94641f2fa5f55b037a671d9fed4daf0c8b54a374735b5d4baf
+  metadata.gz: e27a4154359d6f41370287eb86eeb2881d415dd0ce7e5d6c3c3f241ff338f168a7393456d63faa5e3970e3a72eb927ae4db13d4f407e50e320d90ed54c79dc7e
+  data.tar.gz: 024047dcd39a0de008284fc256c3f7fb08ea8585e0cd0cae53f0e990b70f9e47341325cf92668ef632bf76ef2e34e5d082ccd98eba94af52c4f659c251afd9f8

data/CHANGELOG.md

@@ -5,6 +5,199 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.0.0] - 2026-08-14
+
+Three iterations of the Architect Loop run against this repo's own tooling, each
+frozen before dispatch and judged by a separate session against criteria written
+before results existed. Major because three destructive verbs gain a refusal they
+did not have, and `provision`'s per-lane return changes shape — see the
+**BREAKING** items under Changed.
+
+Every defect closed here is the same animal: a **confident, wrong artifact**. An
+operation that destroys a completed builder run and exits 0 reporting success. A
+value the tool resolves correctly and then declines to use. A lane denied the tool
+it needed, which does not crash and instead files a well-formatted, dataless
+report. The through-line is that none of them announced itself — which is why the
+fixes are as much about making the resolved value *visible* as about resolving it.
+Suite: 1297 → 1344 runs, 5148 → 5373 assertions, green throughout.
+
+### Added
+
+- **`--allowed-tools` / `--append-allowed-tools` on `architect dispatch`, and
+  `allowed_tools:` / `append_allowed_tools:` on the frozen lane declaration
+  (#89).** `ClaudeCodeHarness::ALLOWED_TOOLS` was a defaulted keyword that
+  `Harness.for` never accepted and no caller could pass, so no dispatched lane
+  could be granted an MCP tool. Because `claude -p` **denies** an unlisted tool
+  rather than prompting, the lane did not fail — it reasoned its way to "I was
+  unable to query the datasource" and wrote a plausible empty report. Replace and
+  append compose as one rule regardless of which surface supplied them
+  (`ClaudeCodeHarness.resolve_tools`); the CLI flag wins over the lane key **on
+  the same axis**, so a lane's `allowed_tools:` still supplies the base a
+  `--append-allowed-tools` flag appends to. The yaml half lives in the frozen lane
+  declaration so a grant is reviewable and judged like every other lane boundary
+  rather than buried in a shell invocation, and it survives worktree
+  re-materialization by the same mechanism `touch_set` already uses.
+- **The resolved grant is recorded and surfaced.** Stamped onto the lane beside
+  `harness`/`model`/`effort`, printed at dispatch with its provenance (which
+  surface won), and shown in `architect status`'s lane line when it diverges from
+  the default. A denial now traces back to a grant a human can read. An MCP
+  *reachability* probe is deliberately not in this release: there is no MCP
+  modelling anywhere in the codebase, and a prober is a subsystem, not a rider on
+  a plumbing fix.
+
+### Changed
+
+- **BREAKING — `architect worktree remove`, `architect integrate --teardown`, and
+  `architect provision --base` refuse to discard a lane worktree's uncommitted
+  work.** The existing safety checks asked whether work had been *committed*, in a
+  system whose hard rule 7 guarantees lane work is **never** committed — so all
+  three destroyed completed builder runs and exited 0 reporting success. One
+  predicate (`dirty_file_count`, untracked files included) now guards all three
+  sites. `--force` overrides and discards, restoring the old behavior exactly. A
+  script that tore down dirty lanes will now exit non-zero.
+- **BREAKING — the multi-lane verbs decide their refusal before mutating
+  anything.** `integrate --teardown` and `provision --base` pre-flight the whole
+  declared lane set (`refuse_teardown_if_dirty!`, `refuse_repoint_if_dirty!`), so a
+  dirty lane discovered late no longer leaves earlier lanes already destroyed. The
+  refusal names every offending lane at once instead of failing on the first.
+- **BREAKING — `provision`'s per-lane return is now `outcome:`**
+  (`:created` / `:unchanged` / `:repointed`) plus `discarded:`, replacing the
+  boolean `created:`. The boolean could not express the re-point path that #88's
+  fix introduces.
+- **`worktree add`, `worktree list`, and `worktree remove` accept an optional
+  trailing `SPACE` argument**, like every other space-scoped verb. `worktree
+  remove` previously had no way to name its space and resolved from `$PWD` — a
+  destructive verb that could fire against the wrong space entirely.
+- **Long-running lane guidance in `skill/architect/dispatch.md` (#85).** The lane
+  template's no-busy-wait clause beat every attempt to hold a 30–70 minute detached
+  process open, killing exactly the lanes it was least safe to kill.
+
+### Fixed
+
+- **`architect provision --base` was resolved and then discarded on the re-attach
+  path (#88).** `worktree_add` computed `base_sha` from `--base`, ignored it when
+  the lane branch already existed, and recorded it anyway — so `space.yaml` claimed
+  a base the worktree was never pointed at. An operator-supplied `--base` is now
+  enforced (re-point, or refuse when that would discard work); an internal
+  re-materialization still reattaches at whatever is there, never refusing and never
+  moving a branch nobody asked to move.
+- **`architect rehearse` refused every cross-repo iteration (#90).** It resolved one
+  repo for the whole iteration and raised when the drafted lanes named more than
+  one, even though `execute_gates` could already resolve a run dir per gate. Gates
+  carrying their own `cwd` now rehearse in their own declared directory regardless
+  of how many repos the iteration spans; the refusal survives only for gates that
+  genuinely need a default, and it names them.
+
+## [6.0.0] - 2026-08-03
+
+Twelve iterations of the Architect Loop run against this repo's own tooling, each
+frozen before dispatch and judged by a separate session against criteria written
+before results existed. Major because `architect freeze` gains two hard
+preconditions it did not have — see the **BREAKING** items under Changed.
+
+Roughly half the release is machinery that stops the next papercut being written:
+gates you can execute *before* freezing them, lane boundaries that cannot silently
+disagree with themselves, and an escape valve for the case where the frozen
+contract is the thing that is wrong. Suite: 1212 → 1297 runs, 4811 → 5148
+assertions, green throughout, with the last known flake causally explained rather
+than retried away.
+
+### Added
+
+- **`architect rehearse ITERATION`** — the phase between authoring and freeze
+  (#81, consolidating #73, #39, #34). Runs the *drafted* (unfrozen, working-tree)
+  gates through the identical execution path `architect gate` uses — `execute_gates`
+  is extracted byte-for-byte, so the two can never diverge — and classifies each
+  RED / GREEN / BROKEN / EMPTY. Prints the resolved `dir` that was always in the
+  result hash and never rendered. `--record` emits a paste-able provenance block
+  for the iteration's AC preamble.
+- **Scope-asymmetry reporting in `rehearse`** — for each gate whose command is a
+  recognizable file-scoped grep invocation, the gate's own pattern is re-run across
+  the whole repo via `git grep` and anything matching outside the gate's declared
+  paths is named, loudest when it also falls outside every declared lane's touch
+  set. Catches the failure mode where a boundary is stated consistently in three
+  places and is wrong in all three because all three were drawn from one too-narrow
+  grep. Reports only: it never touches `rehearse`'s exit code, its RED/GREEN/BROKEN
+  classification, or the rehearsal stamp. An invocation carrying a flag `git grep`
+  has no equivalent for (`-x`) is declined by name and counted as not-analyzed
+  rather than answered wrong.
+- **`architect integrate --accept-bounds REASON`** — merges a lane that wrote
+  outside its declared touch set when the *declaration* is the defect and the freeze
+  rules correctly forbid widening it after the fact. Recorded per-lane in
+  `space.yaml` against the lane that was actually out of bounds, never silently, and
+  never able to override the no-builder-commits check.
+- **`architect freeze --skip-rehearse REASON`** — the deliberate escape from the new
+  rehearsal precondition, with the reason recorded in `space.yaml`. An empty REASON
+  is refused.
+- **`Space::Core::Paths` glob helpers** — one documented decision about when a
+  content-tree glob includes dotfiles, guarded by `test/paths_guard_test.rb` so the
+  flags cannot drift apart again across call sites.
+
+### Changed
+
+- **BREAKING — `architect freeze` requires a fresh rehearsal stamp.** The stamp is
+  digest-keyed to the gates block, so editing one byte of a gate after rehearsing
+  invalidates it; it records that the architect *looked*, never that the gates
+  passed. An iteration that froze cleanly on 5.x now errors with
+  `has not been rehearsed against its current gates`. Run `architect rehearse
+  ITERATION` first, or `architect freeze ITERATION --skip-rehearse REASON` to skip
+  deliberately.
+- **BREAKING — `architect freeze` refuses an untouched scaffold placeholder.** An
+  Acceptance Criteria section still carrying the template's placeholder AC1 with no
+  active gate is now an error rather than a successful freeze (#73). Narrow by
+  design: a hand-authored prose-only AC without the placeholder still freezes, so
+  the spike path the skill sanctions is untouched.
+- **`architect integrate` commits its own `space.yaml` mutation.** It previously
+  wrote `integration_branch`/`integrate_sha` to disk and deferred the commit to
+  whatever committing command ran next, leaving a window in which a dying session
+  lost the record of which lanes had merged — which happened, and cost a full
+  judging session. The commit is made by pathspec so unrelated dirty files are not
+  swept in, once per call rather than once per lane, and from an `ensure` so a merge
+  conflict partway through the lane set still preserves what already merged.
+- **`architect evidence` replaces a lane's subsection instead of appending.**
+  Re-transcribing a corrected report no longer leaves both copies in Builder Report.
+- **Gate commands are spawned through an explicit `/bin/sh -c`**, so the documented
+  shell is the actual shell regardless of the invoking environment.
+- **Skill prose (`skill/architect/`, `docs/DESIGN.md`).** The lane-prompt template
+  tells builders not to title their scratch report (the CLI supplies the `### <lane>`
+  heading) and to keep internal headings at `###` or deeper; `SKILL.md` §4 carries
+  the boundary-enumeration discipline and the content rule that a criterion renaming
+  an identifier must be drawn from a whole-repo grep, not `lib/` alone. These are
+  load-bearing: lane prompts are assembled from `dispatch.md`, and at least one
+  defect in this release was caused by prose and code disagreeing.
+
+### Fixed
+
+- **`architect research dispatch` silently launched only the first prompt (#83).**
+  Given five prompt paths it launched one, exited 0, and printed nothing on stderr —
+  destroying evidence the architect then writes research grounds from. dry-cli binds
+  only the first positional to a scalar `argument` and drops the rest into the
+  options hash; `Supervisor#dispatch` had always handled an array correctly. Fixed
+  with dry-cli's own `type: :array`, the established idiom at
+  `space_src/cli/clone.rb:19`. Net −1 line.
+- **`architect bug-report` buried the title in an HTML comment `gh` ignores (#41)**,
+  forcing a manual `--title` on every filing.
+- **The dispatch liveness check was a point-sample race in production**, not only in
+  tests. It now waits for a real stream-json init event and reports true elapsed
+  time, and scans the run log incrementally instead of re-parsing it from the top
+  every 50ms — 92.6MB → 615KB of reads over a 300-poll worst case.
+- **`Commands.wrap`'s quote scanner was not backslash-aware.** Verified at the
+  property level with `bash` as the oracle over an eight-command battery, rather than
+  by adding another example.
+- **`Dir.glob` calls silently skipped dotfiles** in `SkillInstaller.same_content?`
+  and its siblings; consolidated behind the new `Space::Core::Paths` decision.
+- **The last suite flake, explained rather than retried.** `FileUtils.cp_r` of the
+  git fixture templates raced `git maintenance --detach`, which outlived `system()`
+  and mutated `.git/objects/` mid-copy. Stress: 13/24 failures → 0/24, twice.
+- **A clone-concurrency test's fiber rendezvous was unbounded** — correct only by an
+  accident of `Async::Task#async`'s greedy dispatch, and would have hung `rake test`
+  forever with no message if scheduling ever shifted. Now bounded, failing legibly
+  while keeping the exact peak-concurrency assertion it was written for.
+- **The scope-asymmetry check overstated its own certainty.** It replayed a gate's
+  pattern but dropped the gate's `-w`, so the whole-repo re-run was *broader* than
+  the gate it stood in for and printed the surplus under its loudest line ("no lane
+  may legally fix these"). `-w` is now replayed and `-x` declined by name.
+
 ## [5.5.1] - 2026-07-25
 
 ### Fixed