@afokapu/atdd-bun 0.10.30 → 0.10.32

package/conventions/delivery/delivery.evidence-schema.convention.yaml

@@ -1,34 +0,0 @@
-schema_version: 1.1.0
-rule_id: delivery.evidence-schema
-kind: rule
-status: active
-name: Every tranche folder holds a well-formed evidence record
-statement: >-
-  Every folder under the delivery root holds an evidence.yaml that validates against delivery-evidence.schema.json, whose tranche matches the folder name, whose work entries each name a writer and a stage the policy lets someone write, whose reviews each name a stage the policy reviews, and whose reports are data files (json, jsonl, yaml, yml, txt, md, log) inside the tranche's own folder, one per review; a ready record names one for every review (delivery.stages-complete); and the records folder holds nothing else: a data file belongs only as a report a record in its tranche names, and every other file, including a loose file directly under the root, is a finding (REQUIRED).
-terms:
-- term_id: tranche
-  text: >-
-    one independently mergeable piece of a program, delivered on its own branch by one persistent driver through PLAN, RED, GREEN, SMOKE, REFACTOR and TRACE, with its reviews.
-- term_id: evidence
-  text: >-
-    the tranche's record at `<root>/<tranche>/evidence.yaml`: status (open or ready), base and approved SHAs, the work (who wrote each stage, at which SHA, with fallbacks) and the chronological list of reviews, each with stage, reviewed SHA, reviewer, fallbacks, verdict, the checklist it went through and its findings.
-content:
-  summary: >-
-    The record is what CI can check. A review that is not written down, or written down in a shape the validator cannot read, did not happen as far as the merge gate is concerned.
-  normative_text: |
-    The profile judges the record a tranche leaves, not the agents while they work. Each review is appended, never edited, so a repair loop shows as a request-changes entry followed by a fresh review of the same stage. A review answers for the work written since the previous reviewed stage; independence is judged against those writers, so a review with no recorded writer cannot be judged. A 0.9 record names the writer as the review's author.
-  fix_hint: |
-    Create or repair `<root>/<tranche>/evidence.yaml`; the finding names the schema path at fault. A request-changes review carries at least one finding; every review carries its `checked` list.
-  exceptions:
-  - >-
-    The default root, docs/delivery/tranches, sits in the docs profile's delivery area beside the program's reasoning (docs/delivery/index.adoc); the docs profile leaves the folder's record and data files to this profile, and AsciiDoc there stays documentation.
-metadata:
-  aliases:
-  - DELIVERY-EVIDENCE-SCHEMA-001
-  severity: 3
-  # strict: atdd-bun fails on every finding; it has no advisory mode and no ratchet baseline.
-  disposition: strict
-  introduced_in: 0.8.0
-implementation:
-  type: validator
-  ref: delivery_evidence

package/conventions/delivery/delivery.findings-resolved.convention.yaml

@@ -1,42 +0,0 @@
-schema_version: 1.1.0
-rule_id: delivery.findings-resolved
-kind: rule
-status: active
-name: Every finding is fixed, withdrawn after one dispute, or ruled on by a human
-statement: >-
-  Once a stage has a later review, or the record is ready, every finding of a request-changes review records its outcome: fixed (confirmed by a later review of the stage), withdrawn (after a written rebuttal, by a later review that does not raise it again) or human (with the decision). A finding disputed more than once goes to a human. An approving review carries no critical or high finding (REQUIRED).
-terms:
-- term_id: rebuttal
-  text: >-
-    the author's written dispute of a finding, with evidence: a test result, a rule id, a file and line. The next fresh reviewer upholds or withdraws the finding.
-- term_id: outcome
-  text: >-
-    fixed, withdrawn or human, recorded on the finding where it was raised.
-content:
-  summary: >-
-    A reviewer can be wrong and an author can be wrong. One written round, judged by a fresh reviewer, settles most disagreements; the rest go to a human instead of looping.
-  normative_text: |
-    No conversation between author and reviewer: a reviewer is stateless, and a long exchange turns it into a co-author. The author fixes a finding or disputes it once in writing; the next fresh reviewer decides. If that reviewer upholds a disputed finding, the tranche emits BLOCKED disputed-finding and a human rules.
-  fix_hint: |
-    On each finding of the request-changes review, record the outcome:
-
-      outcome: fixed
-
-      rebuttal: "handler.test.ts:31 proves the loop stops on abort"
-      outcome: withdrawn
-
-      outcome: human
-      decision: "Keep the retry; the caller owns the bound."
-  exceptions:
-  - >-
-    While a stage has no later review and the record is open, a finding without an outcome is work in progress, not a finding.
-metadata:
-  aliases:
-  - DELIVERY-FINDINGS-RESOLVED-001
-  severity: 2
-  # strict: atdd-bun fails on every finding; it has no advisory mode and no ratchet baseline.
-  disposition: strict
-  introduced_in: 0.8.0
-implementation:
-  type: validator
-  ref: delivery_evidence

package/conventions/delivery/delivery.merge-gate.convention.yaml

@@ -1,46 +0,0 @@
-schema_version: 1.1.0
-rule_id: delivery.merge-gate
-kind: rule
-status: active
-name: A tranche merges only its approved SHA
-statement: >-
-  At the gate (ATDD_DELIVERY_GATE, which the generated CI sets to merge on pull requests and the merge queue and to post-merge on pushes to the protected branches), every evidence record the change touches is ready and approves a commit the head contains; before the merge the head differs from that commit only by the record and the reports it names; no record is deleted, and no record or report already on the base branch is modified (records 0.8.0 kept under delivery/ included, after the root moves); under the delivery root only records and the reports a changed record names change; and, with require_record (the default), a change outside the delivery root comes with a tranche record, unless atdd-bun.yaml is the only such file (REQUIRED).
-terms:
-- term_id: merge_gate
-  text: >-
-    the CI run that decides whether a pull request may merge. It compares the branch against the base it merges into; for a merge checkout, the base is the first parent and the head the second.
-content:
-  summary: >-
-    Any commit after approval, a code change, a regenerated file, a conflict resolution or a rebase, invalidates it. The evidence commit itself is the one change allowed, since it cannot be in the SHA it records. A change with no record at all was never reviewed.
-  normative_text: |
-    This is where the profile becomes a merge rule rather than an instruction. Records that the change does not touch, earlier tranches already on the base branch, are not judged again; their approved SHAs may no longer be the head of anything.
-    After the merge, a push is judged from its previous tip (the generated CI passes it as ATDD_BASE_REF; a first push falls back to the parent): every record it brings in must approve a commit it contains. A deleted record never counts as the record that covers a change. A squash or rebase merge writes a new commit no reviewer saw and fails here, visibly, on the base branch; merge tranches with a merge commit. Drift is judged after the merge too, at the tranche's side of a merge commit or at the head of a direct push, over the files the push brings in. Only <root>/<tranche>/evidence.yaml is a record; an evidence.yaml at any other depth covers nothing. A rename is a deletion. When several tranches land in one change, a file another changed ready record approved with exactly that content is not drift.
-  fix_hint: |
-    Run the final review on the current head and record its SHA as approved_sha, or remove the change made after approval. Locally, reproduce the gate with ATDD_DELIVERY_GATE=merge ATDD_BASE_REF=origin/main bun run atdd-bun delivery.
-  exceptions:
-  - >-
-    Outside the gate (hooks, local runs) this rule emits nothing, so a tranche can push work in progress.
-  - >-
-    Before the merge, a pull request is judged at its head (the second parent of the test merge GitHub computes), not at
-    that merge commit; content only a merge commit introduces is judged after the merge, where a push is judged whole.
-    Judging GitHub's merge result instead would report the base branch's own changes to the same files as drift.
-  - >-
-    The policy governs the tree it sits in. With atdd-bun.yaml in a subfolder (a monorepo package run with --root),
-    require_record covers that subfolder, not the rest of the repository, which another policy or none governs; the
-    generated workflow runs from the repository root, and drift from an approved commit is judged repository-wide.
-  - >-
-    require_record false exempts changes with no record; turning it off is a loosening the integrity check reports.
-  - >-
-    A change to atdd-bun.yaml alone needs no record: which models may write and review is a human's decision, and
-    the integrity check already reports any loosening for a human to approve; a tightening needs no review. A policy
-    change that comes with any other file outside the delivery root is reviewed with it.
-metadata:
-  aliases:
-  - DELIVERY-MERGE-GATE-001
-  severity: 3
-  # strict: atdd-bun fails on every finding; it has no advisory mode and no ratchet baseline.
-  disposition: strict
-  introduced_in: 0.8.0
-implementation:
-  type: validator
-  ref: delivery_evidence

package/conventions/delivery/delivery.model-allowed.convention.yaml

@@ -1,29 +0,0 @@
-schema_version: 1.1.0
-rule_id: delivery.model-allowed
-kind: rule
-status: active
-name: Authors and reviewers are allowed models, and every fallback says why
-statement: >-
-  Each work entry's writer is a model its stage allows for writers, and each review's reviewer a model it allows for reviewers. A stage's list is the set of allowed models, in no order; "*" allows any model. Which allowed model does the work is the operator's choice at any moment, so no fallback has to explain it; the record names the model that actually ran (REQUIRED).
-terms:
-- term_id: fallback
-  text: >-
-    a recorded switch from a preferred model to a later one in the stage's list, with role (writer or reviewer) and a reason: an outage, a rate limit, or no auditable report, counted by failures; or the operator's order, referenced by its ruling. A REQUEST CHANGES verdict is never a reason.
-content:
-  summary: >-
-    The lists are the operator's choice of which models may do the work. Switching between allowed models needs no policy edit and no paperwork, so a rate limit or a preference change is handled on the spot; a model outside the list is still reported.
-  normative_text: |
-    The record must name the model that ran. Reviewer independence (a reviewer is never the model that wrote the work it reviews, under different-model) is judged by delivery.reviewer-independent, and a disputed finding upheld on a fresh review blocks the tranche, so switching reviewers cannot buy an approval.
-    A fallback entry (kind outage, rate_limit, no_report, timeout or operator) may still record why a model was used; it is optional and, when present, must be well formed.
-  fix_hint: |
-    Use a model the stage lists, or have the operator add it (or "*") to the stage's list in atdd-bun.yaml; the integrity check reports an added model once for the operator to approve.
-metadata:
-  aliases:
-  - DELIVERY-MODEL-ALLOWED-001
-  severity: 2
-  # strict: atdd-bun fails on every finding; it has no advisory mode and no ratchet baseline.
-  disposition: strict
-  introduced_in: 0.8.0
-implementation:
-  type: validator
-  ref: delivery_evidence

package/conventions/delivery/delivery.operating-model.convention.yaml

@@ -1,97 +0,0 @@
-schema_version: 1.1.0
-rule_id: delivery.operating-model
-kind: policy
-status: active
-name: How a program is delivered in tranches, and who does what
-statement: >-
-  A coordinator splits the program into tranches and keeps every slot busy; one persistent driver per tranche runs its lifecycle stages in order (plan, red, green, refactor, final), dispatching each stage's writer and reviewer from the delivery policy in atdd-bun.yaml as fresh headless processes, and records who wrote each stage and every review in the tranche's evidence.yaml.
-terms:
-- term_id: coordinator
-  text: >-
-    Owns throughput, never the work. It splits the program into tranches with explicit dependencies and writes why, the scope and the split in docs/delivery/index.adoc; activates a tranche once its own dependencies have merged (one still waiting may run plan and its review, nothing after); starts one driver per tranche in its own worktree; keeps provider health for the program, telling every driver to skip a model that is down; intervenes when a tranche is idle without being blocked, or has deliverables and no commit after two hours; and hands BLOCKED disputed-finding to a human with both sides. It never writes, reviews or merges.
-- term_id: driver
-  text: >-
-    Owns one tranche end to end. For each stage of delivery.stages, in order, it starts the stage's writer (any model in its writer list, as the operator chooses) in the tranche worktree, commits red on its own before green starts, passes the stage's gate, and appends a work entry; for each stage with a reviewer it starts a review. It never reviews.
-- term_id: review_run
-  text: >-
-    Every review is a fresh process in its own detached worktree at the exact SHA (git worktree add --detach), launched with a prompt that gives it the delivery.review convention, the stage, the base SHA, the SHA and the RED commit. Afterwards git status --porcelain must be empty and HEAD still the SHA, or the review is a REVIEWER_FAILURE and does not count. The raw output is kept in the tranche folder and named in the review's report.
-- term_id: fallback
-  text: >-
-    Any model a stage lists may be used, so a switch needs no fallback: when a model is down or rate-limited, the driver moves to another listed model and records the one that ran. A fallback entry may still say why (outage, rate limit, no auditable report, timeout, or the operator's order); it is optional. A request-changes verdict is never a reason to switch reviewers: a disputed finding upheld on a fresh review blocks the tranche. When no listed model is available, when_exhausted block emits BLOCKED provider-unavailable.
-- term_id: repair
-  text: >-
-    For each finding of a request-changes review the writer either fixes it or writes one rebuttal with evidence; a fresh review of the same stage follows. If that reviewer upholds a disputed finding, the driver emits BLOCKED disputed-finding and never disputes it again. Any commit, regenerated file, conflict fix or rebase after an approval cancels it and the change goes back to that stage's review.
-- term_id: ready
-  text: >-
-    When the last reviewed stage approves, the driver sets status ready and approved_sha to that SHA, commits the evidence and its reports alone, pushes, and merges with a merge commit once CI is green. A squash or rebase merge writes a commit no reviewer saw, and CI fails it after the merge.
-- term_id: events
-  text: >-
-    One line each, for the coordinator to wait on: PROGRAM_EVENT <tranche> <STAGE <stage> <sha> | WORKER_START <role> <model> <sha> | WORKER_END <role> <model> <verdict> | FALLBACK <role> <from>→<to> <reason> | PR_OPENED <url> | MERGED <sha> | BLOCKED <reason> | HEARTBEAT>.
-- term_id: commands
-  text: >-
-    The default headless command per model, overridden per model under delivery.commands.<model>.author (the writer's command) and .review. {prompt} and {worktree} are substituted. Claude runs take project settings only, so a user's own allowances cannot widen a reviewer. glm, kimi (Moonshot kimi-k3, a replacement for codex and claude-opus) and deepseek-flash (a smaller coding model beside claude-sonnet) run through Pi, which has no permission system; kimi and deepseek-flash take their keys from MOONSHOT_API_KEY and DEEPSEEK_API_KEY, or point delivery.commands at a wrapper that provides them. Through Pi, as a reviewer it gets the read tool alone (the driver puts the diff in its prompt and records its output), and as a writer it runs only inside a container or sandbox limited to the worktree.
-  values:
-    codex:
-      author: codex exec --cd {worktree} --sandbox workspace-write "{prompt}"
-      review: codex exec --cd {worktree} --sandbox read-only "{prompt}"
-    claude-opus:
-      author: cd {worktree} && claude --model opus --setting-sources project --permission-mode acceptEdits --allowedTools Read Grep Glob Edit Write "Bash(bun:*)" "Bash(git:*)" --output-format json -p "{prompt}"
-      review: cd {worktree} && claude --model opus --setting-sources project --allowedTools Read Grep Glob "Bash(git show:*)" "Bash(git diff:*)" "Bash(git log:*)" --disallowedTools Edit Write NotebookEdit --output-format json -p "{prompt}"
-    claude-sonnet:
-      author: cd {worktree} && claude --model sonnet --setting-sources project --permission-mode acceptEdits --allowedTools Read Grep Glob Edit Write "Bash(bun:*)" "Bash(git:*)" --output-format json -p "{prompt}"
-      review: cd {worktree} && claude --model sonnet --setting-sources project --allowedTools Read Grep Glob "Bash(git show:*)" "Bash(git diff:*)" "Bash(git log:*)" --disallowedTools Edit Write NotebookEdit --output-format json -p "{prompt}"
-    glm:
-      author: cd {worktree} && pi -p --no-session --no-extensions --no-skills --no-context-files --tools read,bash,edit,write "{prompt}"
-      review: cd {worktree} && pi -p --no-session --no-extensions --no-skills --no-context-files --tools read "{prompt}"
-    kimi:
-      author: cd {worktree} && pi --provider moonshotai --model kimi-k3 -p --no-session --no-extensions --no-skills --no-context-files --tools read,bash,edit,write "{prompt}"
-      review: cd {worktree} && pi --provider moonshotai --model kimi-k3 -p --no-session --no-extensions --no-skills --no-context-files --tools read "{prompt}"
-    deepseek-flash:
-      author: cd {worktree} && pi --provider deepseek --model deepseek-flash -p --no-session --no-extensions --no-skills --no-context-files --tools read,bash,edit,write "{prompt}"
-      review: cd {worktree} && pi --provider deepseek --model deepseek-flash -p --no-session --no-extensions --no-skills --no-context-files --tools read "{prompt}"
-- term_id: example_record
-  text: >-
-    A tranche in progress: the plan written by codex and approved by glm; red, green and refactor written by glm; the final review requesting changes. Only the finding's outcome is ever added to an earlier entry.
-  values:
-    tranche: api
-    status: open
-    base_sha: 3f2a91c
-    work:
-    - { stage: plan, sha: 8b10e44, writer: { model: codex, run: codex-plan-1 } }
-    - { stage: red, sha: 91aa0b2, writer: { model: glm, run: glm-red-1 } }
-    - { stage: green, sha: a4c0f11, writer: { model: glm, run: glm-green-1 } }
-    - { stage: refactor, sha: a4c0f11, writer: { model: glm, run: glm-refactor-1 } }
-    reviews:
-    - stage: plan
-      sha: 8b10e44
-      reviewer: { model: glm, run: glm-plan-review-1 }
-      verdict: approve
-      checked: [ACC-API-001, planner.decomposition]
-      report: docs/delivery/tranches/api/plan-1.json
-    - stage: final
-      sha: a4c0f11
-      reviewer: { model: codex, run: codex-final-1 }
-      verdict: request_changes
-      checked: [ACC-API-001, src/wagons/api, coder.bun.error-response-*]
-      findings:
-      - { id: F1, severity: high, evidence: "src/wagons/api/handler.ts:42", invariant: "coded error bodies", affects: [ui], proposed_fix: "return { code: 'API_NOT_FOUND' }" }
-      report: docs/delivery/tranches/api/final-1.json
-content:
-  summary: >-
-    The policy says who may write and review each stage; this convention says how the coordinator and drivers carry it out. The record they leave is what the delivery rules judge.
-  normative_text: |
-    With delivery.board set, the coordinator and drivers talk on the board (delivery.board), and each driver posts its workers' tasks, results, review requests and verdicts there; workers never use the board. Without it, a task is the prompt an agent is launched with and its result is the run's output, which the driver keeps. Agents run in panes of the multiplexer named in delivery.multiplexer (default herdr) only for humans to watch; learn its commands from its own help before the first dispatch. Never deliver work to an agent by typing into its pane.
-    Before a hosted model receives private repository content, confirm the user or organization authorized it.
-    Never edit the delivery skill, these conventions, or loosen the delivery policy to get a tranche through. If the policy must change, stop and ask the human.
-  fix_hint: |
-    Follow the driver's order: writer, gate, work entry; review, repair, fresh review; ready and merge commit. The example_record term shows a record the profile accepts.
-  exceptions:
-  - >-
-    A stage the policy does not name has no writer and no review; a stage with a writer but no reviewer is held by its gate alone.
-metadata:
-  aliases:
-  - DELIVERY-OPERATING-MODEL-001
-  introduced_in: 0.10.0
-# A policy, not a rule: how agents carry out the delivery policy cannot be validated. The record they leave is.
-implementation:
-  type: none

package/conventions/delivery/delivery.review.convention.yaml

@@ -1,42 +0,0 @@
-schema_version: 1.1.0
-rule_id: delivery.review
-kind: policy
-status: active
-name: What each review establishes, and how a reviewer works
-statement: >-
-  A reviewer is a fresh, read-only process for one stage of one tranche, given the stage, the base SHA, the SHA and the RED commit. It reviews the change between the base and the SHA, working through its stage's checklist systematically, systemically, adversarially and economically, and returns one review entry with verdict, checked and findings.
-terms:
-- term_id: plan
-  text: >-
-    Are we building the right thing? The plan files the change adds or modifies: the decomposition (wagon, WMBT, acceptance, train, journey, contract) covers the intent; every acceptance is testable with one observable outcome and every WMBT has a SMOKE acceptance; edge cases, migrations, security and architecture constraints are represented; the acceptances can prove the feature; the plan builds on the wagons, contracts and components that already exist wherever they fit, and plans no machinery outside the tranche's scope; it follows the accepted architecture decisions (docs/architecture/decisions/index.adoc), and a new technology choice comes with its own ADR; owned files do not overlap other tranches.
-- term_id: final
-  text: >-
-    Does the change satisfy the approved plan? The tests, implementation and refactoring the change brings are read together. Every acceptance the plan names has a test bound by URN that asserts the behaviour, not a mock; each acceptance test differs from its RED commit only by the removed RED marker and Phase header, and any other change is justified; behaviour is correct on edge and error paths; the changed code keeps layering, composition, DTO, error-response and security sound; SMOKE runs through the real entry point; the change reuses what the codebase already has, duplicates nothing, and adds no machinery beyond what the plan needs; it uses what the accepted ADRs chose and brings in no alternative to them; nothing drifts from the plan.
-- term_id: red
-  text: >-
-    Where the policy gives red a reviewer. Every acceptance has a RED test bound by URN that fails for the missing behaviour and would still fail for a wrong implementation, asserting observable output rather than mocks.
-- term_id: green_refactor
-  text: >-
-    Where the policy gives green or refactor a reviewer. Every behaviour is correct against its acceptance on edge and error paths; the changed code keeps layering, composition, DTO, error-response and security sound, reuses what exists and duplicates nothing; SMOKE runs through the real entry point.
-- term_id: method
-  text: >-
-    Systematic, the whole checklist, with everything checked listed in checked, not only what failed. Systemic, from the change to what it affects (callers, contracts, other tranches, downstream owners), named in affects; code the change does not touch or affect is out of scope. Adversarial, assuming the change is wrong and proving it; a finding needs a file and line, a failing command or a counter-example. Economical, the change does its job with the least new machinery: it reuses what exists, duplicates nothing, and adds no framework, abstraction, configuration, tooling or meta machinery (machinery for building or checking machinery) beyond the tranche's scope; such a finding names the existing piece to reuse or the part to remove. Economy never trades away effectiveness: a smaller change that no longer satisfies an acceptance is not an improvement. A small change gets a short review.
-content:
-  summary: >-
-    The two default reviews carry the judgement no gate can: the plan before RED, and the whole change at its head. The gates between them are deterministic.
-  normative_text: |
-    The reviewer runs in a detached worktree at the SHA and reads the change with git diff base..SHA. The gates are CI's, not the reviewer's: it does not re-run them, and judges what they cannot. It may read, search and use git show, git diff and git log. It never edits, commits or writes, including output-file options such as git diff --output=; the driver checks the worktree afterwards, and a review that wrote does not count (delivery.reviewer-independent). It judges and proposes; the author applies.
-    A finding carrying the author's rebuttal is withdrawn, left out, when the rebuttal holds, or upheld, repeated with the same id; there is no second round (delivery.findings-resolved).
-    The reviewer returns exactly one JSON object (valid YAML, so it goes into evidence.yaml unchanged, and a # inside a string is never read as a comment), the review entry of delivery-evidence.schema.json without fallback or report, which the driver adds: stage, sha, verdict (approve only with no critical or high finding), checked, and findings, each with id, severity (critical, high, medium, low), evidence, invariant, affects and proposed_fix, a precise description or short snippet, never a rewrite.
-  fix_hint: |
-    Give the reviewer this convention, the stage, the base SHA, the SHA and the RED commit. A review that skipped part of its checklist shows it in checked; run the stage again with a fresh reviewer.
-  exceptions:
-  - >-
-    A stage the policy does not name has no review; its checklist applies only where the policy names it.
-metadata:
-  aliases:
-  - DELIVERY-REVIEW-001
-  introduced_in: 0.10.0
-# A policy, not a rule: what a reviewer judges cannot be validated. The record it leaves is, by the delivery rules.
-implementation:
-  type: none

package/conventions/delivery/delivery.reviewer-independent.convention.yaml

@@ -1,34 +0,0 @@
-schema_version: 1.1.0
-rule_id: delivery.reviewer-independent
-kind: rule
-status: active
-name: Every reviewer is a fresh process independent of the writers
-statement: >-
-  A reviewer's run never wrote anything in the tranche and never reviewed another entry; where the stage requires different-model independence (the default), the reviewer's model wrote none of the work the review answers for: its own stage and every stage since the previous reviewed one (REQUIRED).
-terms:
-- term_id: run
-  text: >-
-    the identity of one process: a session id, a pane id with its start time, or the retained report. Two entries with the same run were produced by the same process.
-- term_id: independence
-  text: >-
-    fresh-process: the reviewer is a new process that wrote nothing. different-model: additionally, its model wrote none of the work it reviews; the final review answers for red, green and refactor when none of them is reviewed, and a review whose range recorded no work answers for the latest recorded work before it.
-content:
-  summary: >-
-    A reviewer that edits becomes a writer, and a reviewer that already saw an earlier round is anchored to it. Independence is what makes an approval evidence.
-  normative_text: |
-    Every review is a new process. The run identifiers make that checkable: a reviewer run that appears as a writer anywhere in the tranche, or on a second review, is not independent. The stricter mode is chosen per stage in the policy.
-  fix_hint: |
-    Re-run the review in a fresh process and record its own run; under different-model, use the next reviewer model in the list that wrote none of the reviewed work.
-  exceptions:
-  - >-
-    The persistent driver dispatches the work and opens the PR; its run may never review.
-metadata:
-  aliases:
-  - DELIVERY-REVIEWER-INDEPENDENT-001
-  severity: 3
-  # strict: atdd-bun fails on every finding; it has no advisory mode and no ratchet baseline.
-  disposition: strict
-  introduced_in: 0.8.0
-implementation:
-  type: validator
-  ref: delivery_evidence

package/conventions/delivery/delivery.stages-complete.convention.yaml

@@ -1,33 +0,0 @@
-schema_version: 1.1.0
-rule_id: delivery.stages-complete
-kind: rule
-status: active
-name: A ready record has every configured stage approved
-statement: >-
-  A record with status ready has, for every stage the policy gives a reviewer, a last review that approves (a stage with nothing written records no work); its approved_sha is the SHA the last review of the closing stage approved; and every review names its retained raw report, which exists (REQUIRED).
-terms:
-- term_id: closing_stage
-  text: >-
-    the last reviewed stage in lifecycle order (plan, red, green, refactor, final); by default final, the review of the PR head, which answers for everything written since the plan review.
-content:
-  summary: >-
-    Ready is the driver's claim that the tranche can merge. It is only true when no stage is missing and the approval covers the commit being merged.
-  normative_text: |
-    Each stage may take several rounds; only its last review counts. The closing stage's approval names the SHA the whole tranche stands on, and approved_sha must be that SHA: the merge gate compares the branch head against it.
-  fix_hint: |
-    Run the missing review, or set status back to open until it has run. Set approved_sha to the SHA the final review approved.
-  exceptions:
-  - >-
-    A ready record is judged by the policy in atdd-bun.yaml at its approved_sha, the policy it was approved under; a later policy change does not re-judge it. A record in progress is judged by the current policy.
-  - >-
-    A stage the policy omits is not required. Omitting one loosens the policy and is reported by the integrity check until a human approves it.
-metadata:
-  aliases:
-  - DELIVERY-STAGES-COMPLETE-001
-  severity: 3
-  # strict: atdd-bun fails on every finding; it has no advisory mode and no ratchet baseline.
-  disposition: strict
-  introduced_in: 0.8.0
-implementation:
-  type: validator
-  ref: delivery_evidence

package/detectors/delivery_evidence/atdd.implementation.yaml

@@ -1,33 +0,0 @@
-schema_version: "1.0.0"
-kind: implementation
-subtype: validator
-implementation_id: delivery.evidence.impl
-targets_workspace: atdd.workspace.bun
-contract_version: "1.0.0"
-# The delivery record: one <root>/<tranche>/evidence.yaml per tranche, judged against the `delivery:` policy
-# in atdd-bun.yaml. Runs only under the delivery profile and is inert until the repository adopts it
-# (a `delivery:` block, or `delivery` named in `profiles:`).
-emits_rule_ids:
-  - delivery.config-schema
-  - delivery.evidence-schema
-  - delivery.model-allowed
-  - delivery.reviewer-independent
-  - delivery.findings-resolved
-  - delivery.stages-complete
-  - delivery.approved-sha-resolves
-# Emitted only at the merge gate (ATDD_DELIVERY_GATE=merge, set by the generated CI on pull requests and the
-# merge queue): it needs a change set against the base branch. tests/delivery.test.ts triggers it in a real
-# repository.
-api_emits_rule_ids:
-  - delivery.merge-gate
-realizes_convention:
-  - delivery.config-schema
-  - delivery.evidence-schema
-  - delivery.model-allowed
-  - delivery.reviewer-independent
-  - delivery.findings-resolved
-  - delivery.stages-complete
-  - delivery.approved-sha-resolves
-  - delivery.merge-gate
-entrypoint: detect.mjs
-report: detect.mjs

package/detectors/delivery_evidence/detect.mjs

@@ -1,9 +0,0 @@
-import { mkdir, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { validateDelivery } from "../../src/delivery.ts";
-
-const roots = JSON.parse(process.env.ATDD_SCAN_ROOTS ?? "[]"), report = process.env.ATDD_VIOLATIONS_REPORT;
-if (!report) throw new Error("ATDD_VIOLATIONS_REPORT is required");
-const violations = (await Promise.all(roots.map(root => validateDelivery(root)))).flat().map(item => ({ ...item, line: 1, col: 1, source_line: "" }));
-await mkdir(dirname(report), { recursive: true });
-await writeFile(report, JSON.stringify({ violations }, null, 2));

package/detectors/delivery_evidence/fixtures/clean/atdd-bun.yaml

@@ -1,8 +0,0 @@
-profiles: [delivery]
-delivery:
-  independence: fresh-process
-  stages:
-    plan_review: { authors: [codex], reviewers: [glm, claude] }
-    test_review: { authors: [glm, claude], reviewers: [codex, claude] }
-    code_review: { authors: [glm, claude], reviewers: [glm, claude], independence: different-model }
-    final_review: { authors: [codex], reviewers: [codex, claude] }

package/detectors/delivery_evidence/fixtures/clean/docs/delivery/tranches/api/evidence.yaml

@@ -1,54 +0,0 @@
-# In progress: every stage reviewed, the code-review dispute settled, the PR not yet marked ready.
-tranche: api
-status: open
-base_sha: 3f2a91c
-reviews:
-  - stage: plan_review
-    sha: 8b10e44
-    author: { model: codex, run: driver-api }
-    reviewer: { model: glm, run: glm-plan-1 }
-    verdict: approve
-    checked: [ACC-API-001, ACC-API-002, planner.decomposition]
-  - stage: test_review
-    sha: 91aa0b2
-    author: { model: glm, run: glm-red-1 }
-    reviewer: { model: codex, run: codex-test-1 }
-    verdict: approve
-    checked: [ACC-API-001, ACC-API-002, tester.bun.red]
-  - stage: code_review
-    sha: a4c0f11
-    author: { model: glm, run: glm-green-1 }
-    reviewer: { model: claude, run: claude-code-1 }
-    fallback:
-      - { from: glm, kind: rate_limit, failures: 3, window: { from: "2026-09-25T09:00:00Z", to: "2026-09-25T09:08:00Z" }, reason: "rate limit: 3 failures in 10 minutes" }
-    verdict: request_changes
-    checked: [ACC-API-001, ACC-API-002, src/wagons/api, coder.bun.error-response]
-    findings:
-      - id: F1
-        severity: high
-        evidence: src/wagons/api/handler.ts:42 returns a bare string
-        invariant: every error response carries a coded body
-        affects: [ui]
-        proposed_fix: return { code "API_NOT_FOUND" } instead of the bare string
-        outcome: fixed
-      - id: F2
-        severity: medium
-        evidence: src/wagons/api/handler.ts:57 retries without a bound
-        invariant: outbound calls are bounded
-        proposed_fix: cap the retry loop at three attempts
-        rebuttal: "The loop is bounded by the caller's AbortSignal; see handler.test.ts:31 which proves it stops."
-        outcome: withdrawn
-  - stage: code_review
-    sha: c77d0a2
-    author: { model: glm, run: glm-green-2 }
-    reviewer: { model: claude, run: claude-code-2 }
-    fallback:
-      - { from: glm, kind: rate_limit, failures: 3, window: { from: "2026-09-25T09:00:00Z", to: "2026-09-25T09:08:00Z" }, reason: "rate limit: 3 failures in 10 minutes" }
-    verdict: approve
-    checked: [ACC-API-001, ACC-API-002, src/wagons/api, F1, F2]
-  - stage: final_review
-    sha: c77d0a2
-    author: { model: codex, run: driver-api }
-    reviewer: { model: codex, run: codex-final-1 }
-    verdict: approve
-    checked: [src/wagons/api, contracts, ui]

package/detectors/delivery_evidence/fixtures/dirty/atdd-bun.yaml

@@ -1,3 +0,0 @@
-profiles: [delivery]
-delivery:
-  independence: loose

package/detectors/delivery_evidence/fixtures/dirty/docs/delivery/tranches/api/evidence.yaml

@@ -1,31 +0,0 @@
-# Ready, but the approved SHA is not what final_review approved and exists nowhere, a reviewer is off-list,
-# one reviewer also authored, and a finding was never resolved.
-tranche: api
-status: ready
-base_sha: 3f2a91c
-approved_sha: "0000000"
-reviews:
-  - stage: plan_review
-    sha: 8b10e44
-    author: { model: codex, run: driver-api }
-    reviewer: { model: gpt, run: gpt-plan-1 }
-    verdict: approve
-    checked: [ACC-API-001]
-  - stage: final_review
-    sha: 91aa0b2
-    author: { model: codex, run: codex-green-1 }
-    reviewer: { model: codex, run: driver-api }
-    verdict: request_changes
-    checked: [ACC-API-001]
-    findings:
-      - id: F1
-        severity: high
-        evidence: src/wagons/api/handler.ts:42 returns a bare string
-        invariant: every error response carries a coded body
-        proposed_fix: return a coded error body
-  - stage: final_review
-    sha: a4c0f11
-    author: { model: codex, run: codex-green-2 }
-    reviewer: { model: codex, run: codex-final-2 }
-    verdict: approve
-    checked: [ACC-API-001, F1]

package/detectors/delivery_evidence/fixtures/dirty/docs/delivery/tranches/data/evidence.yaml

@@ -1,8 +0,0 @@
-# A reviewer without a verdict or a checklist.
-tranche: data
-status: open
-base_sha: 3f2a91c
-reviews:
-  - stage: plan_review
-    sha: 8b10e44
-    reviewer: { model: glm, run: glm-plan-1 }

package/detectors/delivery_evidence/fixtures/dirty/docs/delivery/tranches/orphan/README.md

@@ -1 +0,0 @@
-The orphan tranche has a folder and no evidence.yaml.

package/detectors/delivery_evidence/fixtures/dirty/docs/delivery/tranches/ui/evidence.yaml

@@ -1,5 +0,0 @@
-# The folder says ui, the record says web.
-tranche: web
-status: open
-base_sha: 3f2a91c
-reviews: []

package/detectors/planner_docs_capability/fixtures/dirty_missing_index/docs/delivery/release.adoc

@@ -1,10 +0,0 @@
-= Release
-:doc-id: delivery.release
-:status: current
-
-The delivery area exists and holds this document — but carries no index.adoc.
-
-This file is what makes the fixture REAL. Expressing "the area exists with no
-index" as an empty directory made the defect invisible to git, so the fixture
-arrived empty on a fresh clone and the rule it proves never fired. A fixture that
-only works on the machine that authored it proves nothing.

package/detectors/planner_docs_capability/fixtures/dirty_missing_index/docs/purpose/index.adoc

@@ -1,5 +0,0 @@
-= Purpose
-:doc-id: purpose.index
-:status: current
-
-WHY and WHAT.