@agentsfleet/orly 0.10.13 → 0.11.0

package/src/criteria_spec.ts

@@ -3,6 +3,7 @@ import { resolve } from "node:path";
 import { readConfigSync } from "./config";
 import { Criterion, CriterionContext, criterion, gitOutput, runCommand, Verdict } from "./criteria_support";
 import { branchDiff, classifyBranch, defaultMergeBase } from "./surfaces";
+import { specDimensionsOf, unacknowledgedObligations } from "./spec_obligations";
 
 const BASELINE_HEADER = "Test Baseline";
 const REVISION_HEADER = "Baseline revision";
@@ -14,8 +15,8 @@ const NOT_APPLICABLE = /^n\/a\s+[—-]\s+\S/i;
 
 const OPEN_QUESTION = "[?]";
 const PRODUCT_CLARITY_HEADING = "## Product Clarity";
-const DIMENSION_PREFIX = "- **Dimension ";
 const DONE_MARKER = "DONE";
+const ITEM_SEPARATOR = ", ";
 const SPEC_GATE_SCRIPT = "audits/spec-template.sh";
 const NO_SPEC_SKIP = "skipped — no active spec (quality gates still apply)";
 
@@ -27,10 +28,6 @@ const SPEC_MOVED = "spec.moved";
 const SPEC_BASELINE = "spec.baseline";
 const SPEC_ORDERING = "spec.ordering";
 const SPEC_DEFERRALS = "spec.deferrals";
-const STATUS_DONE = "Status: DONE";
-const INDY_ACK = "> Indy (";
-// deferred/deferral(s) only — never Zig's defer/errdefer keywords.
-const DEFERRAL_CLAIM = /\bdeferr(ed|al|als)\b/i;
 const SPEC_TREE_FILE = /^docs\/v[^/]+\/.+\.md$/;
 
 // Wrap a spec-reading criterion: no active spec → skip-pass with the reason
@@ -43,7 +40,7 @@ function specCriterion(name: string, evaluate: (context: CriterionContext) => Ve
 }
 
 export function specGate(): Criterion {
-  return specCriterion(SPEC_GATE, (context) => runCommand(context.root, ["bash", SPEC_GATE_SCRIPT, "--file", context.specPath ?? ""]));
+  return specCriterion(SPEC_GATE, (context) => runCommand(context.root, ["bash", context.root === context.model.root ? SPEC_GATE_SCRIPT : `.orly/${SPEC_GATE_SCRIPT}`, "--file", context.specPath ?? ""]));
 }
 
 export function openQuestions(): Criterion {
@@ -62,13 +59,14 @@ export function productClarity(): Criterion {
 
 export function specDimensions(): Criterion {
   return specCriterion(SPEC_DIMENSIONS, (context) => {
-    const dimensions = specLines(context).filter((line) => line.trimStart().startsWith(DIMENSION_PREFIX));
-    const open = dimensions.filter((line) => !line.includes(DONE_MARKER));
+    const dimensions = specDimensionsOf(context.specText ?? "");
+    if (!dimensions.length) return { ok: false, detail: "no Dimensions declared in Sections" };
+    const open = dimensions.filter((dimension) => !dimension.done);
     return {
       ok: open.length === 0,
       detail: open.length === 0
         ? `${dimensions.length} dimension(s) marked ${DONE_MARKER}`
-        : `${open.length} of ${dimensions.length} not ${DONE_MARKER}: ${dimensionLabels(open)}`,
+        : `${open.length} of ${dimensions.length} not ${DONE_MARKER}: ${open.map((dimension) => dimension.id).join(ITEM_SEPARATOR)}`,
     };
   });
 }
@@ -134,27 +132,21 @@ export function specOrdering(): Criterion {
 // the spec; agent-unilateral deferral is incomplete scope, not deferral.
 export function specDeferrals(): Criterion {
   return specCriterion(SPEC_DEFERRALS, (context) => {
-    const claims = specLines(context).filter((line) => DEFERRAL_CLAIM.test(line) && !line.includes(INDY_ACK));
-    if (claims.length === 0) return { ok: true, detail: "no deferral claims" };
-    const acked = specLines(context).some((line) => line.includes(INDY_ACK));
-    return acked
-      ? { ok: true, detail: `${claims.length} deferral line(s), Indy ack quote present` }
-      : { ok: false, detail: `${claims.length} deferral line(s) with no "${INDY_ACK}" ack quote — agent-unilateral deferral is incomplete scope` };
+    const missing = unacknowledgedObligations(context.specText ?? "");
+    return missing.length === 0
+      ? { ok: true, detail: "named deferrals and transfers have item-bound owner quotes in Discovery; quote provenance and scope require review" }
+      : { ok: false, detail: `${missing.join(ITEM_SEPARATOR)} has no item-bound Indy acknowledgement in Discovery — agent-unilateral deferral is incomplete scope` };
   });
 }
 
 function statusDone(context: CriterionContext): boolean {
-  return specLines(context).some((line) => line.replaceAll("*", "").replace(/\s+/g, " ").includes(STATUS_DONE));
+  return header(context.specText ?? "", "Status") === DONE_MARKER;
 }
 
 function specLines(context: CriterionContext): string[] {
   return (context.specText ?? "").split(/\r?\n/);
 }
 
-function dimensionLabels(lines: string[]): string {
-  return lines.map((line) => line.trim().slice(DIMENSION_PREFIX.length).split("*")[0]?.trim() ?? "?").join(", ");
-}
-
 function baselineEvidence(context: CriterionContext): Verdict {
   const text = context.specText ?? "";
   const revision = header(text, REVISION_HEADER);

package/src/criteria_support.ts

@@ -2,8 +2,9 @@ import { UNSCOPED_ENVIRONMENT } from "./git_env";
 import { RulesModel } from "./model";
 import { SurfaceReport } from "./surfaces";
 
+export { runCommand } from "./command_runner";
+
 const PIPE_OUTPUT = "pipe";
-const NO_OUTPUT = "no output";
 
 export type Verdict = { ok: boolean; detail: string };
 export type CriterionResult = Verdict & { name: string };
@@ -30,24 +31,6 @@ export function criterion(name: string, evaluate: (context: CriterionContext) =>
   return { name, evaluate: (context) => ({ name, ...evaluate(context) }) };
 }
 
-export function runCommand(root: string, command: string[]): Verdict {
-  // Profile command surfaces are repository-declared, so a named binary may
-  // simply not be installed here. Bun.spawnSync THROWS in that case; a gate
-  // must report every criterion as a verdict, never abort the run, so the
-  // missing binary becomes a red line naming the command.
-  let result;
-  try {
-    result = Bun.spawnSync(command, { cwd: root, env: UNSCOPED_ENVIRONMENT, stdout: PIPE_OUTPUT, stderr: PIPE_OUTPUT });
-  } catch (error) {
-    return { ok: false, detail: `${command[0] ?? "command"} could not be run: ${error instanceof Error ? error.message : String(error)}` };
-  }
-  const output = [result.stdout.toString(), result.stderr.toString()].filter(Boolean).join("\n").trim();
-  if (output) return { ok: result.exitCode === 0, detail: `exit ${result.exitCode}:\n${output}` };
-  return result.exitCode === 0
-    ? { ok: true, detail: "exit 0" }
-    : { ok: false, detail: `exit ${result.exitCode}: ${NO_OUTPUT}` };
-}
-
 export function gitOutput(root: string, command: string[]): string {
   const result = Bun.spawnSync(["git", ...command], { cwd: root, env: UNSCOPED_ENVIRONMENT, stdout: PIPE_OUTPUT, stderr: PIPE_OUTPUT });
   return result.exitCode === 0 ? result.stdout.toString().trim() : "";

package/src/doc_reads.test.ts

@@ -0,0 +1,42 @@
+import { afterEach, expect, test } from "bun:test";
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { cleanupTemporaryDirectories, newRepository, ROOT } from "./gates_test_support";
+import { UNSCOPED_ENVIRONMENT } from "./git_env";
+
+const READ_LOG = ".git/orly/doc-reads.jsonl";
+const CITATION = 'Quoted "section", tab\tline\nnext\rline and control\u0001 with \\ slash.';
+const AUDIT_SCRIPT = "audits/doc-read.sh";
+const READ_HELPER = "audits/doc-reads.ts";
+
+afterEach(cleanupTemporaryDirectories);
+
+for (const filename of ['we"ird.md', "tab\tpage.md", "line\npage.md", "control\u0001page.md"]) {
+  test(`a document read round-trips the path ${JSON.stringify(filename)} and complete citation`, () => {
+    const root = newRepository();
+    writeFileSync(join(root, filename), "Read this rule.\n");
+    const result = Bun.spawnSync(["bash", join(ROOT, AUDIT_SCRIPT), "log", filename, CITATION], { cwd: root, env: { ...UNSCOPED_ENVIRONMENT, ORLY_ROOT: root } });
+    expect(result.exitCode).toBe(0);
+    const rows = readFileSync(join(root, READ_LOG), "utf8").trimEnd().split("\n").map((line) => JSON.parse(line));
+    expect(rows).toHaveLength(1);
+    expect(rows[0].path).toBe(filename);
+    expect(rows[0].section).toBe(CITATION);
+    const current = Bun.spawnSync([process.execPath, join(ROOT, READ_HELPER), "current", join(root, READ_LOG), root]);
+    expect(current.exitCode).toBe(0);
+    const fields = current.stdout.toString().trimEnd().split("\t");
+    expect(fields).toHaveLength(3);
+    expect(JSON.parse(`"${fields[0]}"`)).toBe(filename);
+    expect(JSON.parse(`"${fields[2]}"`)).toBe(CITATION);
+  });
+}
+
+test("malformed saved rows cannot invent a current document read", () => {
+  const root = newRepository();
+  mkdirSync(join(root, ".git/orly"));
+  writeFileSync(join(root, READ_LOG), 'broken JSON\n{"path":"README.md","blob":"bad","ts":"not a time","section":null}\n');
+  appendFileSync(join(root, READ_LOG), JSON.stringify({ path: "../../outside", blob: "abc", ts: 1, section: "invented" }) + "\n");
+  const result = Bun.spawnSync([process.execPath, join(ROOT, READ_HELPER), "current", join(root, READ_LOG), root]);
+  expect(result.exitCode).toBe(0);
+  expect(result.stdout.toString()).toBe("");
+});

package/src/doc_rules.ts

@@ -53,7 +53,7 @@ function isRulePage(file: string): boolean {
   return RULE_PAGE_FILES.includes(name);
 }
 const README = "README.md";
-const CONFIG_RELATIVE_PATH = ".oracle/orly.json";
+const CONFIG_RELATIVE_PATH = ".orly/orly.json";
 const REGISTRY_FILE = "registry.json";
 const CODE_PLACEHOLDER = "Code";
 const EMPTY = "";
@@ -130,7 +130,7 @@ const RULE_NAMES: Record<string, string> = {
 };
 
 // The pages orly renders into a repository, plus its readme. The materialised
-// set is authoritative and it is recorded, not guessed: `.oracle/orly.json`
+// set is authoritative and it is recorded, not guessed: `.orly/orly.json`
 // names every file orly wrote here. In the engine's own checkout the registry
 // names the sources those files are rendered from, which is the same set one
 // step earlier. README.md joins either list by the scope rule in

package/src/evaluation_resources.test.ts

@@ -0,0 +1,64 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { cleanupTemporaryDirectories, ROOT, temporaryDirectory } from "./gates_test_support";
+import { UNSCOPED_ENVIRONMENT } from "./git_env";
+
+const BASH = "bash";
+const PIPE = "pipe";
+const OWNER_FILE = "owner.txt";
+const OWNER_CONTENT = "caller-owned bytes\n";
+const LEDGER_LIBRARY = "evals/ledger/lib.sh";
+const TEST_TIMEOUT_MS = 20_000;
+const INTERRUPTED_EXIT = 143;
+const FAILURE_EXIT = 7;
+
+afterEach(cleanupTemporaryDirectories);
+
+function environment(root: string) {
+  writeFileSync(join(root, OWNER_FILE), OWNER_CONTENT);
+  return { ...UNSCOPED_ENVIRONMENT, TMPDIR: root, LEDGER_LIBRARY: join(ROOT, LEDGER_LIBRARY) };
+}
+
+function expectClean(root: string) {
+  expect(readdirSync(root)).toEqual([OWNER_FILE]);
+  expect(readFileSync(join(root, OWNER_FILE), "utf8")).toBe(OWNER_CONTENT);
+}
+
+for (const script of ["evals/ledger/run.sh", "evals/dispatch/parity.sh"]) {
+  test(`evaluation cleanup preserves caller state after ${script}`, () => {
+    const root = temporaryDirectory();
+    const result = Bun.spawnSync([BASH, join(ROOT, script)], { cwd: ROOT, env: environment(root), stdout: PIPE, stderr: PIPE, timeout: TEST_TIMEOUT_MS });
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.toString()).toContain("passed, 0 failed");
+    expectClean(root);
+  }, TEST_TIMEOUT_MS);
+}
+
+test("ledger command-substitution fixtures are removed after a failing caller", () => {
+  const root = temporaryDirectory();
+  const result = Bun.spawnSync([BASH, "-c", 'source "$LEDGER_LIBRARY"; sb="$(mk_root)"; [[ -d "$sb" ]] || exit 1; exit 7'], { env: environment(root), stdout: PIPE, stderr: PIPE });
+  expect(result.exitCode).toBe(FAILURE_EXIT);
+  expectClean(root);
+});
+
+test("ledger command-substitution fixtures are removed after termination", async () => {
+  const root = temporaryDirectory();
+  const child = Bun.spawn([BASH, "-c", 'source "$LEDGER_LIBRARY"; sb="$(mk_root)"; printf "%s\\n" "$sb"; read -r pending'], { env: environment(root), stdin: PIPE, stdout: PIPE, stderr: PIPE });
+  try {
+    const reader = child.stdout.getReader();
+    const ready = await reader.read();
+    expect(ready.done).toBeFalse();
+    const fixture = new TextDecoder().decode(ready.value).trim();
+    expect(existsSync(fixture)).toBeTrue();
+    expect(fixture.startsWith(root)).toBeTrue();
+    child.kill("SIGTERM");
+    expect(await child.exited).toBe(INTERRUPTED_EXIT);
+    expectClean(root);
+  } finally {
+    child.stdin.end();
+    child.kill();
+    await child.exited;
+  }
+}, TEST_TIMEOUT_MS);

package/src/execution/config.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { OrlyError } from "../model";
+
+export const DISABLED_MODE = "disabled";
+const MAX_ARGUMENTS = 32;
+const MAX_ARGUMENT_LENGTH = 1024;
+const argument = z.string().min(1).max(MAX_ARGUMENT_LENGTH).refine((value) => !value.includes("\0"));
+const executionSchema = z.object({
+  remote: z.object({
+    mode: z.literal(DISABLED_MODE),
+    launcher: z.array(argument).min(1).max(MAX_ARGUMENTS).optional(),
+  }).strict(),
+}).strict();
+
+export type ExecutionConfig = z.infer<typeof executionSchema>;
+
+export function readExecution(value: unknown): ExecutionConfig | undefined {
+  if (value === undefined) return undefined;
+  const parsed = executionSchema.safeParse(value);
+  if (!parsed.success) throw new OrlyError("execution.remote requires mode=disabled and an optional nonempty launcher argument array; remote activation is unsupported");
+  return parsed.data;
+}

package/src/execution/plan.test.ts

@@ -0,0 +1,65 @@
+import { afterEach, expect, test } from "bun:test";
+import { join } from "node:path";
+import { readConfig, seedConfig, writeConfig } from "../config";
+import { cleanupTemporaryDirectories, newRepository, ROOT } from "../gates_test_support";
+import { runGate } from "../gates";
+import { RulesModel } from "../model";
+import { readExecution } from "./config";
+import { lifecyclePlan } from "./plan";
+
+afterEach(cleanupTemporaryDirectories);
+
+test("lifecycle_plan_names_actual_commands", async () => {
+  const repo = newRepository();
+  const config = await seedConfig(repo);
+  config.commands = { conform: [["true"]], "verify.lint": [["true"]], "verify.unit": [["false"]], "verify.integration": [["false"]] };
+  await writeConfig(repo, config);
+  const plan = lifecyclePlan(repo);
+  const verify = plan.stages.find((stage) => stage.name === "VERIFY")!;
+  expect("pushCommands" in verify && verify.pushCommands?.map((command) => command.lane)).toEqual(["verify.lint"]);
+  expect("boundaryCommands" in verify && verify.boundaryCommands?.map((command) => command.lane)).toEqual(["verify.integration", "verify.lint", "verify.unit"]);
+  expect(plan.remote.evidence).toBeNull();
+});
+
+test("disabled_adapter_has_no_side_effects", async () => {
+  const repo = newRepository();
+  const config = await seedConfig(repo);
+  const sentinel = join(repo, "worker-ran");
+  config.execution = { remote: { mode: "disabled", launcher: ["touch", sentinel] } };
+  config.commands = { conform: [["false"]], "verify.unit": [["true"]] };
+  await writeConfig(repo, config);
+  expect(lifecyclePlan(repo).remote.launches).toBe(0);
+  const result = runGate(await RulesModel.load(ROOT), repo, "work", true);
+  expect(result.ok).toBe(false);
+  expect(result.results.find((row) => row.name === "cmd.conform")?.ok).toBe(false);
+  expect(await Bun.file(sentinel).exists()).toBe(false);
+  expect((await readConfig(repo))?.execution).toEqual(config.execution);
+});
+
+test.each([
+  null, {}, { remote: {} }, { remote: { mode: "enabled" } },
+  { remote: { mode: "disabled", launcher: "agentsfleet run" } },
+  { remote: { mode: "disabled", launcher: [] } },
+  { remote: { mode: "disabled", launcher: [""] } },
+  { remote: { mode: "disabled", launcher: ["x\0y"] } },
+  { remote: { mode: "disabled", activate: true } },
+])("remote_adapter_is_disabled rejects malformed or active configuration: %j", (input) => {
+  expect(() => readExecution(input)).toThrow("remote activation is unsupported");
+});
+
+test("disabled_adapter_never_becomes_pass", async () => {
+  const repo = newRepository();
+  const { configPath } = await import("../config");
+  const config = await seedConfig(repo);
+  await Bun.write(configPath(repo), JSON.stringify({ ...config, execution: { remote: { mode: "enabled" } } }));
+  expect(() => lifecyclePlan(repo)).toThrow("remote activation is unsupported");
+  const result = runGate(await RulesModel.load(ROOT), repo, "work", true);
+  expect(result.ok).toBe(false);
+  expect(result.results.find((row) => row.name === "repo.config")?.detail).toContain("remote activation is unsupported");
+});
+
+test("missing adapter defaults to disabled and missing repository fails", () => {
+  expect(readExecution(undefined)).toBeUndefined();
+  expect(readExecution({ remote: { mode: "disabled" } })).toEqual({ remote: { mode: "disabled" } });
+  expect(() => lifecyclePlan(join(newRepository(), "uninstalled"))).toThrow("run orly init");
+});

package/src/execution/plan.ts

@@ -0,0 +1,51 @@
+import { readConfigSync, type RepoConfig } from "../config";
+import { OrlyError } from "../model";
+import { DISABLED_MODE } from "./config";
+
+export const CONFORM_TIER = "conform";
+export const FAST_TIER = "fast";
+export const ALL_TIER = "all";
+const COMMANDER = "commander";
+const LOCAL = "local";
+const VERIFY_PREFIX = "verify.";
+const UNIT = "verify.unit";
+export const CONDITIONAL_LANES = ["verify.integration", "verify.memory"];
+export type CommandTier = typeof CONFORM_TIER | typeof FAST_TIER | typeof ALL_TIER;
+
+// Used by both inspection and the actual gates so their command sets agree.
+export function selectedCommands(commands: RepoConfig["commands"], tier: CommandTier): string[] {
+  return Object.keys(commands).filter((key) => {
+    if (tier === CONFORM_TIER) return key === CONFORM_TIER;
+    if (!key.startsWith(VERIFY_PREFIX)) return false;
+    return tier === ALL_TIER || (key !== UNIT && !CONDITIONAL_LANES.includes(key));
+  }).sort();
+}
+
+export function lifecyclePlan(root: string) {
+  const config = readConfigSync(root);
+  if (!config) throw new OrlyError("lifecycle inspection requires repository configuration; run orly init");
+  const commands = (tier: CommandTier) => selectedCommands(config.commands, tier).map((lane) => ({
+    lane, argv: config.commands[lane], location: LOCAL, conditionalOnCode: CONDITIONAL_LANES.includes(lane),
+  }));
+  return {
+    schema_version: 1,
+    remote: { mode: DISABLED_MODE, launcher: config.execution?.remote.launcher ?? null, evidence: null, launches: 0 },
+    stages: [
+      stage("CHORE(open)", COMMANDER, "Create the scoped stream and record the comparison revision.", "Spec, branch and workspace; commander removes the owned workspace after landing."),
+      stage("PLAN", COMMANDER, "Read requirements and triggered rules; resolve scope and required evidence.", "Spec and agent context; no build prescribed."),
+      stage("EXECUTE", COMMANDER, "Implement and test the current Section.", "Source and tool-owned outputs; declared tools own their cleanup."),
+      { ...stage("CONFORM", "orly gate work", "Run declared conformity commands.", "Command-owned caches and outputs."), commands: commands(CONFORM_TIER) },
+      { ...stage("VERIFY", "orly gate verify / orly gate pr", "Push runs fast checks; the pull-request boundary runs every verification lane.", "Test outputs and comparison workspace; commander removes its baseline workspace."), pushCommands: commands(FAST_TIER), boundaryCommands: commands(ALL_TIER) },
+      stage("REVIEW", COMMANDER, "Run required adversarial review and resolve findings.", "Review receipts and bounded optional judgment replay."),
+      stage("DOCUMENT", COMMANDER, "Update affected user instructions and evidence.", "Tracked documentation."),
+      stage("COMMIT", "Git hooks", "Run installed work hook; push runs installed verify hook.", "Git objects; repository hooks may declare additional checks."),
+      stage("CHORE(close)", "commander / orly gate pr", "Close the spec only when scope and required evidence are complete.", "Committed spec and pull-request evidence."),
+      stage("LAND", COMMANDER, "After authorized merge, update the default branch and remove owned stream resources.", "Repository-specific shutdown and worktree cleanup."),
+    ],
+    limits: "Inspection executes no commands. Command disk usage is tool-owned and is not measured or bounded by this plan. Remote delegation is disabled and supplies no check result.",
+  };
+}
+
+function stage(name: string, executor: string, work: string, resources: string) {
+  return { name, executor, work, resources, location: LOCAL };
+}

package/src/gates.ts

@@ -11,6 +11,7 @@ export type GateName = (typeof GATE_ORDER)[number];
 
 const PIPE_OUTPUT = "pipe";
 const GIT = "git";
+const CURRENT_BRANCH_ARGUMENTS = ["rev-parse", "--abbrev-ref", "HEAD"];
 const DOCS_DIRECTORY = "docs";
 const ACTIVE_DIRECTORY = "active";
 const DONE_DIRECTORY = "done";
@@ -23,7 +24,7 @@ const UTF8 = "utf8";
 const PROTOTYPE_PATTERN = /^v\d+(\.\d+)*$/;
 const MARKDOWN_EXTENSION = ".md";
 const NEWLINE = "\n";
-const MARKDOWN_HEADER_TOKEN_PATTERN = /^\s*\*\*([^*]+):\*\*\s*`([^`]+)`/;
+const MARKDOWN_HEADER_TOKEN_PATTERN = /^\s*\*\*([^*]+):\*\*\s*(?:`([^`]+)`|([^\s`]+))\s*$/;
 const SPEC_IDENTIFIER_PATTERN = /^(M\d+_\d+)(?:_|\.md$)/;
 // Strict trailer shape: "Orly-Override: <criterion> (<reason>)". A trailer
 // that does not parse is not an override — the gate stays red rather than
@@ -39,7 +40,7 @@ export type GateReport = {
 };
 
 export type Override = { criterion: string; reason: string };
-type ClosedSpec = {
+type SpecMetadata = {
   path: string;
   identifier: string | undefined;
   branch: string | undefined;
@@ -105,11 +106,36 @@ export function branchOverrides(root: string): Override[] {
   return overrides;
 }
 
+// One stream per worktree, and a fold is not a second stream. Extra specs in
+// active/ are allowed only when each names the one non-folded owner through
+// Folded-into — the same relation closedSpecPath enforces in done/. Without
+// this, folding a workstream into an open stream was impossible during the
+// work and legal only after the close, which is the wrong way round: the fold
+// is decided when the scope is, not when the spec moves. Specs explicitly
+// owned by another branch are excluded; undeclared ownership stays visible.
 export function activeSpecPath(root: string): string | undefined {
-  const specs = specPathsUnder(root, ACTIVE_DIRECTORY);
+  const branch = gitOutput(root, CURRENT_BRANCH_ARGUMENTS);
+  const specs = specPathsUnder(root, ACTIVE_DIRECTORY).map(specMetadata)
+    .filter((spec): spec is SpecMetadata => spec !== undefined && (spec.branch === undefined || spec.branch === branch));
   if (specs.length === 0) return undefined;
-  if (specs.length > 1) throw new OrlyError(`more than one active spec — one stream per worktree:${NEWLINE}${specs.join(NEWLINE)}`);
-  return specs[0];
+  return owningSpec(specs, "active spec", "active specs").path;
+}
+
+// The fold relation, shared by both discovery paths: exactly one non-folded
+// owner, every other spec naming it, and no spec naming itself.
+function owningSpec(specs: SpecMetadata[], one: string, many: string): SpecMetadata {
+  const owners = specs.filter((spec) => spec.foldedInto === undefined);
+  if (owners.length === 0) throw new OrlyError(`every ${one} is folded — one owning stream is required:${NEWLINE}${specs.map((spec) => spec.path).join(NEWLINE)}`);
+  if (owners.length > 1) throw new OrlyError(`more than one ${one} — one stream per worktree:${NEWLINE}${owners.map((spec) => spec.path).join(NEWLINE)}`);
+  const owner = owners[0];
+  if (!owner) throw new OrlyError(`${one} ownership could not be resolved`);
+  const folded = specs.filter((spec) => spec.foldedInto !== undefined);
+  if (folded.length > 0 && !owner.identifier) throw new OrlyError(`the owning ${one} has no milestone and workstream identifier: ${owner.path}`);
+  const selfFolds = folded.filter((spec) => spec.identifier === spec.foldedInto);
+  if (selfFolds.length > 0) throw new OrlyError(`folded ${many} cannot fold into themselves:${NEWLINE}${selfFolds.map((spec) => spec.path).join(NEWLINE)}`);
+  const invalidFolds = folded.filter((spec) => spec.foldedInto !== owner.identifier);
+  if (invalidFolds.length > 0) throw new OrlyError(`folded ${many} must name their owner ${owner.identifier}:${NEWLINE}${invalidFolds.map((spec) => spec.path).join(NEWLINE)}`);
+  return owner;
 }
 
 // Closed-spec follow-through: CHORE(close) moves the spec to done/, and the
@@ -117,24 +143,13 @@ export function activeSpecPath(root: string): string | undefined {
 // be end-state theater. Discovery matches done/ specs whose Branch: header
 // names the current branch; default branches never match a stream's spec.
 export function closedSpecPath(root: string): string | undefined {
-  const branch = gitOutput(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const branch = gitOutput(root, CURRENT_BRANCH_ARGUMENTS);
   if (!branch || DEFAULT_BRANCHES.includes(branch)) return undefined;
   const specs = specPathsUnder(root, DONE_DIRECTORY)
-    .map(closedSpec)
-    .filter((spec): spec is ClosedSpec => spec !== undefined && spec.branch === branch);
+    .map(specMetadata)
+    .filter((spec): spec is SpecMetadata => spec !== undefined && spec.branch === branch);
   if (specs.length === 0) return undefined;
-  const owners = specs.filter((spec) => spec.foldedInto === undefined);
-  if (owners.length === 0) throw new OrlyError(`every done/ spec naming branch ${branch} is folded — one owning stream is required:${NEWLINE}${specs.map((spec) => spec.path).join(NEWLINE)}`);
-  if (owners.length > 1) throw new OrlyError(`more than one done/ spec names branch ${branch} — one stream per worktree:${NEWLINE}${owners.map((spec) => spec.path).join(NEWLINE)}`);
-  const owner = owners[0];
-  if (!owner) throw new OrlyError(`done/ spec ownership could not be resolved for branch ${branch}`);
-  const folded = specs.filter((spec) => spec.foldedInto !== undefined);
-  if (folded.length > 0 && !owner.identifier) throw new OrlyError(`the owning done/ spec for branch ${branch} has no milestone and workstream identifier: ${owner.path}`);
-  const selfFolds = folded.filter((spec) => spec.identifier === spec.foldedInto);
-  if (selfFolds.length > 0) throw new OrlyError(`folded done/ specs naming branch ${branch} cannot fold into themselves:${NEWLINE}${selfFolds.map((spec) => spec.path).join(NEWLINE)}`);
-  const invalidFolds = folded.filter((spec) => spec.foldedInto !== owner.identifier);
-  if (invalidFolds.length > 0) throw new OrlyError(`folded done/ specs naming branch ${branch} must name their owner ${owner.identifier}:${NEWLINE}${invalidFolds.map((spec) => spec.path).join(NEWLINE)}`);
-  return owner.path;
+  return owningSpec(specs, `done/ spec naming branch ${branch}`, `done/ specs naming branch ${branch}`).path;
 }
 
 // An in-flight (active/) spec wins; otherwise the branch's closed spec gates.
@@ -145,9 +160,9 @@ export function specPathFor(root: string): { path: string; closed: boolean } | u
   return closed ? { path: closed, closed: true } : undefined;
 }
 
-function closedSpec(path: string): ClosedSpec | undefined {
+function specMetadata(path: string): SpecMetadata | undefined {
   try {
-    const metadata: ClosedSpec = {
+    const metadata: SpecMetadata = {
       path,
       identifier: basename(path).match(SPEC_IDENTIFIER_PATTERN)?.[1],
       branch: undefined,
@@ -156,8 +171,8 @@ function closedSpec(path: string): ClosedSpec | undefined {
     for (const line of readFileSync(path, UTF8).split(/\r?\n/)) {
       if (line.startsWith("## ")) break;
       const match = line.match(MARKDOWN_HEADER_TOKEN_PATTERN);
-      if (match?.[1] === BRANCH_HEADER) metadata.branch = match[2];
-      if (match?.[1] === FOLDED_INTO_HEADER) metadata.foldedInto = match[2];
+      if (match?.[1] === BRANCH_HEADER) metadata.branch = match[2] ?? match[3];
+      if (match?.[1] === FOLDED_INTO_HEADER) metadata.foldedInto = match[2] ?? match[3];
     }
     return metadata;
   } catch {