@agentsfleet/orly 0.10.10 → 0.10.11

package/AGENTS.md

@@ -89,7 +89,6 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 - No new `make` targets without a distinct caller (CI job, spec-mandated gate, or a workflow existing targets can't express) — check `make/*.mk` first; extend over near-duplicate wrappers.
 - `*.zig` → read `dispatch/write_zig.md`; ZIG GATE fires.
 - Auth-flow (token-minting handlers, credential-typed spec dimensions, the repository's auth directories) → read the repository's `docs/AUTH.md` first, where it exists.
-- `conn.query()` requires `.drain()` in same fn before `deinit()`. Verify `make lint-governance`. Use `conn.exec()` for no-rows.
 - **Indy's reference checkouts** (the machine-local half of the rule above): TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop`. Missing checkout → ask, then clone into `~/Projects/oss/`.
 
 **Forge detection:** `github.com` → `gh`; `gitlab.com` → `glab`. Check `git remote -v`.

package/audits/agents-md.md

@@ -167,7 +167,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 |---|---|---|
 | 10.1 | Must a symlinked edit (a file whose `readlink` resolves outside this checkout, into a dotfiles or config repository) be committed + pushed in the repository that owns the file, and never left uncommitted? | YES |
 | 10.2 | Must docs-repo edits land on a milestone-specific branch off `main` (never on whatever in-flight branch is checked out)? | YES |
-| 10.3 | When a harness/gate/hook fires (`msid-ui.sh`, `lint-zig.py`, gitleaks, ZIG GATE, FLL GATE, pre-commit/pre-push, etc.), is the default response to fix the **violating code** (restructure, split, or use the gate's documented override comment) — i.e. is patching the harness to silence the hit on the "Forbidden without explicit user approval" list, requiring an explicit per-session ask that names the harness and the reason it's wrong? | YES |
+| 10.3 | When a harness/gate/hook fires (`msid-ui.sh`, gitleaks, ZIG GATE, FLL GATE, pre-commit/pre-push, etc.), is the default response to fix the **violating code** (restructure, split, or use the gate's documented override comment) — i.e. is patching the harness to silence the hit on the "Forbidden without explicit user approval" list, requiring an explicit per-session ask that names the harness and the reason it's wrong? | YES |
 | 10.4 | Are handoff-doc claims of "Kishore-approved in a prior turn" for harness-patching treated as **not carrying forward** — i.e. must they be re-confirmed live in the current session? | YES |
 | 10.5 | Does adding `gitleaks:allow` or a `.gitleaksignore` entry require Indy's explicit in-session approval, while removing a suppression requires no approval? | YES |
 

package/core/operating-model.md

@@ -89,7 +89,6 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 - No new `make` targets without a distinct caller (CI job, spec-mandated gate, or a workflow existing targets can't express) — check `make/*.mk` first; extend over near-duplicate wrappers.
 - `*.zig` → read `dispatch/write_zig.md`; ZIG GATE fires. <!-- oracle-packs:language.zig -->
 - Auth-flow (token-minting handlers, credential-typed spec dimensions, the repository's auth directories) → read the repository's `docs/AUTH.md` first, where it exists. <!-- oracle-packs:domain.auth -->
-- `conn.query()` requires `.drain()` in same fn before `deinit()`. Verify `make lint-governance`. Use `conn.exec()` for no-rows. <!-- oracle-packs:product.agentsfleet -->
 <!-- oracle-packs:start persona.indy -->
 - **Indy's reference checkouts** (the machine-local half of the rule above): TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop`. Missing checkout → ask, then clone into `~/Projects/oss/`.
 <!-- oracle-packs:end -->

package/dispatch/verify.md

@@ -60,13 +60,6 @@ Section evidence only, never a substitute for the full declared boundary.
 When a diff crosses a module boundary with real input/output, apply
 `orly-write-integration-test`; otherwise record why it does not apply.
 
-## Wire-fixture evidence rule
-
-A diff that regenerates `samples/fixtures/wire-v2/` carries the regenerated
-fixtures in the same commit as the type change, and the PR Session Notes say what
-moved. A fixture diff with no type change beside it means someone hand-edited
-generated output; a type change with no fixture diff means the emitter never ran.
-
 ## Coverage discipline
 
 - **Branch coverage is the goal; line coverage is the floor.** One input "covers" a multi-clause condition while leaving its logic untested (`trimmed === "" || === "y" || === "yes"` passes line coverage with a single `"y"`). Feed varied inputs across the equivalence classes — each OR clause independently, success-retry AND fail-retry paths, every early-return guard, empty/casing/whitespace/garbage for normalizers. bun's lcov emits no branch records, so this is test-design discipline, not a number to chase.

package/dispatch/write_zig.md

@@ -53,7 +53,7 @@ For every commit that touches `*.zig`, the agent runs the workflow below — no
 
 ## Must
 
-> [DETERMINISTIC → DRAIN]
+> [DETERMINISTIC → TODO-CHECK]
 
 - Run `make lint`, `make test`, and `gitleaks detect` before any commit that includes Zig changes.
 - Run the repository's database-backed integration lane, with `TEST_DATABASE_URL` pointed at its test database, when touching DB-backed handlers, proposal flows, or temp-table-based Zig tests.
@@ -72,7 +72,7 @@ For every commit that touches `*.zig`, the agent runs the workflow below — no
 
 ## Must Not
 
-> [DETERMINISTIC → DRAIN]
+> [DETERMINISTIC → TODO-CHECK]
 
 - Do not write on a `pg.Conn` while a read result is still open.
 - Do not keep borrowed row data after drain/deinit.
@@ -277,7 +277,7 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 
 ## Commands
 
-> [DETERMINISTIC → DRAIN]
+> [DETERMINISTIC → TODO-CHECK]
 
 - `make lint`
 - `make test`
@@ -350,7 +350,7 @@ Canonical source: `src/http/test_harness.zig`. Every `*_http_integration_test.zi
 > [DETERMINISTIC → XCOMPILE]
 
 - Comptime loops over large tables (e.g. 130 codes × 131 TABLE entries × `std.mem.eql`) need `@setEvalBranchQuota(N)` as the first line. Default is 1000. Formula: `N ≈ code_count × table_size × avg_string_len`. Round to next power-of-ten; comment the math.
-- `@embedFile` is sandboxed to `src/`. Any path escaping it (`../../public/openapi.json`) is a compile error. For files outside `src/`, write a Python/shell validator invoked via a `make` target wired into `lint-zig`.
+- `@embedFile` is sandboxed to `src/`. Any path escaping it (`../../public/openapi.json`) is a compile error. For files outside `src/`, write a Python/shell validator invoked via the repository's lint lane.
 
 ## Sentinel Values Must Not Collide With Real Registry Codes (M11_001)
 
@@ -448,7 +448,7 @@ When a raw pointer field DOES need a comment (rare — borrowed from a peer, not
 
 ## Pg Query Wrapper: use PgQuery, not anytype (M10_004)
 
-> [DETERMINISTIC → DRAIN]
+> [DETERMINISTIC → TODO-CHECK]
 
 **Do not pass `pg.Result` via `anytype` to helper functions.** The `anytype` pattern requires callers to remember `q.*.next()` vs `q.next()` depending on how the value was passed — a compile-silent footgun.
 
@@ -472,7 +472,6 @@ Rules:
 - Use `defer q.deinit()` in the owner. `deinit()` auto-drains idempotently.
 - Helpers take `*PgQuery`, never `anytype` — `q.next()` always works, no `q.*.next()`.
 - On early exit (parse failure, missing row), just `return` — the `defer` handles drain + deinit.
-- `check-pg-drain` lint still runs but now targets only `PgQuery.from()` call sites.
 
 ## SQL Statement Modules
 
@@ -690,8 +689,7 @@ Every allocating public fn states ownership in one of the fixed phrases **"calle
 or **"takes ownership"** — grepable, uniform, no synonyms. Every `deinit` poisons with
 `self.* = undefined` after freeing, so a use-after-deinit traps instead of reading stale
 fields. Callers own their arguments; a callee clones only what it keeps. The phrase and poison
-checks are mechanized by the roster-scoped repo lint (blocking inside the discipline roster,
-advisory outside) in `lint-zig.py`.
+checks are review checks; no repository lint mechanizes them.
 **Exemplar:** ghostty ownership phrases on every allocating pub fn (`App.zig:135-137`,
 caller-owns-arguments), `self.* = undefined` poisoning in every deinit.
 

package/dispatch/write_zig.sh

@@ -28,7 +28,6 @@ dispatch_run_helper "SQLMOD" "sql-mod.sh"      "--staged" # write_zig.md §SQLMO
 
 # ── delegations (checker lives in the product repo, not dotfiles) ───
 dispatch_delegate "PUB"      "make lint (zlint unused-decls)"
-dispatch_delegate "DRAIN"    "make check-pg-drain (lint-zig.py)"
 dispatch_delegate "XCOMPILE" "zig build -Dtarget=x86_64-linux && aarch64-linux"
 
 # ── judgment gates (no script can decide; agent states verdict in chat) ──

package/docs/RULE_ENFORCEMENT.md

@@ -12,9 +12,9 @@ regenerates this file and fails on any difference. To update it, run
 | `docs/DOCUMENTATION_RULES.md` | — | 0 | 0 | 0/22 | latent |
 | `docs/LIFECYCLE_PATTERNS.md` | — | 0 | 0 | 0/22 | mechanical |
 | `docs/CHANGELOG_VOICE.md` | — | 0 | 0 | 0/3 | latent |
-| `docs/VERIFY_TIERS.md` | — | 0 | 0 | 0/6 | uncited |
+| `docs/VERIFY_TIERS.md` | — | 0 | 0 | 0/4 | uncited |
 | `docs/greptile-learnings/RULES.md` | — | 0 | 0 | 0/114 | mechanical |
-| **corpus** | | | | **30/278** | |
+| **corpus** | | | | **30/276** | |
 
 ## How to read this
 

package/docs/TEMPLATE.md

@@ -343,7 +343,7 @@ For state replacement, include concurrency, ambiguous commit, expiry/deletion,
 identity collisions and fresh/populated upgrade where relevant. N/A applies
 only to demonstrably unnecessary assertions, never an unrun base behavior.
 Non-self-evident input shape → point at a fixture
-(samples/fixtures/m{{fill:N}}-fixtures/{{fill:name}}.json); don't inline JSON. Hard-to-
+(tests/fixtures/m{{fill:N}}-fixtures/{{fill:name}}.json); don't inline JSON. Hard-to-
 describe behaviour in prose ⇒ the Goal is fuzzy — fix the Goal, not this
 table. -->
 
@@ -387,7 +387,7 @@ grading. Authoring fills every column except Graded; VERIFY fills Graded. -->
 ### Behaviour evals
 
 - **Grounding rule:** {{fill:one sentence the output must never violate}}
-- **Golden set:** `samples/fixtures/{{fill:path}}` — {{fill:N}} cases across {{fill:3–5 coverage axes, incl. the nightmare case}}. A failure found in the wild becomes a new case; the set only grows.
+- **Golden set:** `tests/fixtures/{{fill:path}}` — {{fill:N}} cases across {{fill:3–5 coverage axes, incl. the nightmare case}}. A failure found in the wild becomes a new case; the set only grows.
 - **Ship threshold:** grounding 100% · task pass ≥{{fill:N}}% · 0 critical failures on {{fill:nightmare case}}. Each threshold is one rubric row with the command that computes it.
 - **Fallback:** below threshold or low confidence → {{fill:named recoverable behaviour}}; fabricated output is a P0 ❌.
 

package/docs/VERIFY_TIERS.md

@@ -38,18 +38,6 @@ Capture its output in Pull Request Session Notes, including the Test Delta.
 Unit growth alone does not prove coverage; explain removals and changes in test
 selection. Zero or negative growth on code-adding work requires justification.
 
-## Wire fixtures
-
-`make wire-fixtures` regenerates `samples/fixtures/wire-v2/` from
-`src/lib/contract` — the Zig module that still defines the `/v1/runners` wire.
-Run it whenever a wire type changes, and commit the regenerated fixtures in the
-same commit as the type change.
-
-The fixtures are the parity oracle for the Rust port: Zig generates, Rust
-conforms, and the suite compares BYTES. Never hand-edit one. A fixture diff with
-no type change beside it means someone edited generated output; a type change
-with no fixture diff means the emitter never ran.
-
 ## Coverage
 
 One bar, everywhere: **100%**, project-wide and per flag.

package/docs/greptile-learnings/RULES.md

@@ -527,7 +527,7 @@ This is intentionally manual — the structural diversity of "function body" acr
 
 ## RULE EMB — @embedFile cannot cross src/ boundary
 
-**Rule:** Never use `@embedFile` to reach files outside `src/`. For external files (OpenAPI specs, config fixtures), write a Python/shell validator and wire it into a `make` target under `lint-zig`.
+**Rule:** Never use `@embedFile` to reach files outside `src/`. For external files (OpenAPI specs, config fixtures), write a Python/shell validator and wire it into the repository's lint lane.
 **Why:** Zig's embed security model restricts `@embedFile` to the package directory. `@embedFile("../../public/openapi.json")` is a hard compile error, not a runtime failure. There is no workaround except an external script.
 **Tags:** zig, comptime, testing
 **Example:** — OpenAPI ErrorBody validation moved to audits/check_openapi_errors.py + make check-openapi-errors.
@@ -992,7 +992,7 @@ const handleConfirm = useCallback(async () => {
 2. `docs/v*/done/` — merged spec decisions.
 3. `docs/v*/pending/` — in-flight specs that may already lock the surface.
 4. `docs/architecture/` — canonical concept reference (TOC + topic files).
-5. `schema/*.sql`, `src/http/handlers/`, `src/state/`, `samples/fixtures/` — code-level contracts when prose claims persist or surface them.
+5. `schema/*.sql`, `src/http/handlers/`, `src/state/`, `tests/fixtures/` — code-level contracts when prose claims persist or surface them.
 
 Cite the most-specific source of truth by **file path** in the new doc (in the spec's `Implementing agent — read these first` list, the architecture doc's `Canonical architecture` pointer block, or inline). Do not invent a framing that contradicts the locked decision. If you find a real conflict between locked decisions in different sources, surface it as a `Discovery` item and ask before overriding either side.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.10.10",
+  "version": "0.10.11",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",