@agentsfleet/orly 0.10.14 → 0.12.0

package/src/config_validation.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+
+import { commandLimitsSchema } from "./command_limits";
+import { OrlyError, type JsonObject } from "./model";
+
+const SCHEMA_VERSION = 1;
+const DIGEST_PATTERN = /^(?:sha256:)?[a-f0-9]{64}$/;
+const VERSION_PATTERN = /^$|^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/;
+const nonempty = z.string().min(1).refine((value) => !value.includes("\0"));
+const configurationSchema = z.object({
+  schema_version: z.literal(SCHEMA_VERSION),
+  orly_version: z.string().regex(VERSION_PATTERN).optional(),
+  packs: z.array(nonempty).optional(),
+  commands: z.unknown().optional(),
+  surfaces: z.unknown().optional(),
+  managed: z.array(nonempty).optional(),
+  digests: z.record(nonempty, z.string().regex(DIGEST_PATTERN)).optional(),
+  execution: z.unknown().optional(),
+  limits: z.record(nonempty, commandLimitsSchema).optional(),
+}).strict();
+
+export function validateConfiguration(value: JsonObject): void {
+  const parsed = configurationSchema.safeParse(value);
+  if (!parsed.success) throw new OrlyError(`.orly/orly.json invalid repository configuration: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "root"}: ${issue.message}`).join("; ")}`);
+}

package/src/criteria.test.ts

@@ -159,7 +159,7 @@ describe("repo.config", () => {
   test("a repository with no config names the install command", async () => {
     const project = newSpecRepository();
     const context = { root: project, model: await modelFor(project), acceptDirty: false };
-    rmSync(join(project, ".oracle/orly.json"));
+    rmSync(join(project, ".orly/orly.json"));
     const criterion = criteriaFor(WORK, context).find((entry) => entry.name === REPO_CONFIG);
     const verdict = criterion?.evaluate(context);
     expect(verdict?.ok).toBeFalse();

package/src/criteria.ts

@@ -12,16 +12,16 @@ import { documentationSurfaces, scanSurfaces } from "./doc_rules";
 import { isObject, JsonObject, objectValue, OrlyError, RulesModel } from "./model";
 import { readConfigSync, RepoConfig } from "./config";
 import { classifyBranch, SurfaceReport } from "./surfaces";
+import { selectedCommands, CONDITIONAL_LANES, CONFORM_TIER, FAST_TIER, ALL_TIER, type CommandTier } from "./execution/plan";
 import { commandSetupErrors } from "./validation";
+import { limitsFor, type CommandLimits } from "./command_limits";
 
 export type { Criterion, CriterionContext, CriterionResult, Verdict };
 export { runCommand };
 
 const DEFAULT_BRANCHES = ["master", "main"];
-const CONFORM_COMMAND = "conform";
-const VERIFY_PREFIX = "verify.";
 const REPOSITORIES_LABEL = "repositories";
-const UNINSTALLED = "no .oracle/orly.json here — run `orly init` first";
+const UNINSTALLED = "no .orly/orly.json here — run `orly init` first";
 const REV_PARSE = "rev-parse";
 const HEAD = "HEAD";
 const UPSTREAM = "@{upstream}";
@@ -45,15 +45,6 @@ const NAMED_FINDINGS = 3;
 // rule audit could only run beside the lint and unit suites, so a repository
 // paid minutes to learn something its seconds-long conform command already
 // knew, and `orly gate` ran it twice on the way to `pr`.
-const CONFORM_TIER = "conform";
-const FAST_TIER = "fast";
-const SLOW_TIER = "slow";
-// The slow tier is a fixed name set, not a prefix rule: lint and version
-// checks are verify.* too, and demoting them to skip-on-prose would be wrong.
-const SLOW_COMMANDS = ["verify.integration", "verify.memory"];
-const UNIT_COMMAND = "verify.unit";
-const ALL_TIER = "all";
-
 // Commit checks read the index. Push checks permit in-flight Sections and omit
 // the boundary test suites. The final gate runs all declared verification
 // itself, including checks a custom repository hook may not have invoked.
@@ -115,30 +106,23 @@ function repositoryConfig(): Criterion {
 
 // Commands and source paths are repository-owned. Only integration and memory
 // checks are conditional on code; every other declared lane always runs.
-function commandCriteria(context: CriterionContext, tier: string): Criterion[] {
+function commandCriteria(context: CriterionContext, tier: CommandTier): Criterion[] {
   const config = resolvedConfig(context);
   if (!config) return [];
   const commands = config.commands;
-  const selected = Object.keys(commands).filter((key) => tier === ALL_TIER ? key.startsWith(VERIFY_PREFIX) : tierOf(key) === tier).sort();
+  const selected = selectedCommands(commands, tier);
   return selected.map((key) => criterion(`cmd.${key}`, (inner) => {
-    if (SLOW_COMMANDS.includes(key) && report(inner, config.surfaces).code.length === 0) {
+    if (CONDITIONAL_LANES.includes(key) && report(inner, config.surfaces).code.length === 0) {
       return { ok: true, detail: "skipped — no code files on this branch" };
     }
-    return runInvocations(inner.root, commands[key]);
+    return runInvocations(inner.root, commands[key], limitsFor(config.limits, key));
   }));
 }
 
-function tierOf(key: string): string {
-  if (key === CONFORM_COMMAND) return CONFORM_TIER;
-  if (key === UNIT_COMMAND || SLOW_COMMANDS.includes(key)) return SLOW_TIER;
-  if (key.startsWith(VERIFY_PREFIX)) return FAST_TIER;
-  return "";
-}
-
 function docsUpdated(): Criterion {
   return criterion(DOCS_UPDATED, (context) => {
     const config = resolvedConfig(context);
-    if (!config?.surfaces) return { ok: true, detail: "no user surface declared in .oracle/orly.json" };
+    if (!config?.surfaces) return { ok: true, detail: "no user surface declared in .orly/orly.json" };
     const surfaces = report(context, config.surfaces);
     if (surfaces.userSurface.length === 0) return { ok: true, detail: "no user-surface files on this branch" };
     if (surfaces.docs.length > 0) return { ok: true, detail: `${surfaces.userSurface.length} user-surface file(s), ${surfaces.docs.length} docs file(s) updated` };
@@ -191,13 +175,13 @@ function resolvedConfig(context: CriterionContext): RepoConfig | undefined {
   }
 }
 
-function runInvocations(root: string, invocations: unknown): Verdict {
+function runInvocations(root: string, invocations: unknown, limits: CommandLimits): Verdict {
   if (!Array.isArray(invocations) || invocations.length === 0) return { ok: false, detail: "command group is empty" };
   const evidence: string[] = [];
   for (const invocation of invocations) {
     if (!Array.isArray(invocation) || invocation.length === 0) return { ok: false, detail: "command invocation is empty" };
     const argv = invocation.map((argument) => String(argument));
-    const result = runCommand(root, argv);
+    const result = runCommand(root, argv, limits);
     evidence.push(`${argv.join(" ")} -> ${result.detail}`);
     if (!result.ok) return { ok: false, detail: evidence.join(NEWLINE) };
   }

package/src/criteria_spec.ts

@@ -3,6 +3,7 @@ import { resolve } from "node:path";
 import { readConfigSync } from "./config";
 import { Criterion, CriterionContext, criterion, gitOutput, runCommand, Verdict } from "./criteria_support";
 import { branchDiff, classifyBranch, defaultMergeBase } from "./surfaces";
+import { specDimensionsOf, unacknowledgedObligations } from "./spec_obligations";
 
 const BASELINE_HEADER = "Test Baseline";
 const REVISION_HEADER = "Baseline revision";
@@ -14,8 +15,8 @@ const NOT_APPLICABLE = /^n\/a\s+[—-]\s+\S/i;
 
 const OPEN_QUESTION = "[?]";
 const PRODUCT_CLARITY_HEADING = "## Product Clarity";
-const DIMENSION_PREFIX = "- **Dimension ";
 const DONE_MARKER = "DONE";
+const ITEM_SEPARATOR = ", ";
 const SPEC_GATE_SCRIPT = "audits/spec-template.sh";
 const NO_SPEC_SKIP = "skipped — no active spec (quality gates still apply)";
 
@@ -27,10 +28,6 @@ const SPEC_MOVED = "spec.moved";
 const SPEC_BASELINE = "spec.baseline";
 const SPEC_ORDERING = "spec.ordering";
 const SPEC_DEFERRALS = "spec.deferrals";
-const STATUS_DONE = "Status: DONE";
-const INDY_ACK = "> Indy (";
-// deferred/deferral(s) only — never Zig's defer/errdefer keywords.
-const DEFERRAL_CLAIM = /\bdeferr(ed|al|als)\b/i;
 const SPEC_TREE_FILE = /^docs\/v[^/]+\/.+\.md$/;
 
 // Wrap a spec-reading criterion: no active spec → skip-pass with the reason
@@ -43,7 +40,7 @@ function specCriterion(name: string, evaluate: (context: CriterionContext) => Ve
 }
 
 export function specGate(): Criterion {
-  return specCriterion(SPEC_GATE, (context) => runCommand(context.root, ["bash", SPEC_GATE_SCRIPT, "--file", context.specPath ?? ""]));
+  return specCriterion(SPEC_GATE, (context) => runCommand(context.root, ["bash", context.root === context.model.root ? SPEC_GATE_SCRIPT : `.orly/${SPEC_GATE_SCRIPT}`, "--file", context.specPath ?? ""]));
 }
 
 export function openQuestions(): Criterion {
@@ -62,13 +59,14 @@ export function productClarity(): Criterion {
 
 export function specDimensions(): Criterion {
   return specCriterion(SPEC_DIMENSIONS, (context) => {
-    const dimensions = specLines(context).filter((line) => line.trimStart().startsWith(DIMENSION_PREFIX));
-    const open = dimensions.filter((line) => !line.includes(DONE_MARKER));
+    const dimensions = specDimensionsOf(context.specText ?? "");
+    if (!dimensions.length) return { ok: false, detail: "no Dimensions declared in Sections" };
+    const open = dimensions.filter((dimension) => !dimension.done);
     return {
       ok: open.length === 0,
       detail: open.length === 0
         ? `${dimensions.length} dimension(s) marked ${DONE_MARKER}`
-        : `${open.length} of ${dimensions.length} not ${DONE_MARKER}: ${dimensionLabels(open)}`,
+        : `${open.length} of ${dimensions.length} not ${DONE_MARKER}: ${open.map((dimension) => dimension.id).join(ITEM_SEPARATOR)}`,
     };
   });
 }
@@ -134,27 +132,21 @@ export function specOrdering(): Criterion {
 // the spec; agent-unilateral deferral is incomplete scope, not deferral.
 export function specDeferrals(): Criterion {
   return specCriterion(SPEC_DEFERRALS, (context) => {
-    const claims = specLines(context).filter((line) => DEFERRAL_CLAIM.test(line) && !line.includes(INDY_ACK));
-    if (claims.length === 0) return { ok: true, detail: "no deferral claims" };
-    const acked = specLines(context).some((line) => line.includes(INDY_ACK));
-    return acked
-      ? { ok: true, detail: `${claims.length} deferral line(s), Indy ack quote present` }
-      : { ok: false, detail: `${claims.length} deferral line(s) with no "${INDY_ACK}" ack quote — agent-unilateral deferral is incomplete scope` };
+    const missing = unacknowledgedObligations(context.specText ?? "");
+    return missing.length === 0
+      ? { ok: true, detail: "named deferrals and transfers have item-bound owner quotes in Discovery; quote provenance and scope require review" }
+      : { ok: false, detail: `${missing.join(ITEM_SEPARATOR)} has no item-bound Indy acknowledgement in Discovery — agent-unilateral deferral is incomplete scope` };
   });
 }
 
 function statusDone(context: CriterionContext): boolean {
-  return specLines(context).some((line) => line.replaceAll("*", "").replace(/\s+/g, " ").includes(STATUS_DONE));
+  return header(context.specText ?? "", "Status") === DONE_MARKER;
 }
 
 function specLines(context: CriterionContext): string[] {
   return (context.specText ?? "").split(/\r?\n/);
 }
 
-function dimensionLabels(lines: string[]): string {
-  return lines.map((line) => line.trim().slice(DIMENSION_PREFIX.length).split("*")[0]?.trim() ?? "?").join(", ");
-}
-
 function baselineEvidence(context: CriterionContext): Verdict {
   const text = context.specText ?? "";
   const revision = header(text, REVISION_HEADER);

package/src/criteria_support.ts

@@ -2,8 +2,9 @@ import { UNSCOPED_ENVIRONMENT } from "./git_env";
 import { RulesModel } from "./model";
 import { SurfaceReport } from "./surfaces";
 
+export { runCommand } from "./command_runner";
+
 const PIPE_OUTPUT = "pipe";
-const NO_OUTPUT = "no output";
 
 export type Verdict = { ok: boolean; detail: string };
 export type CriterionResult = Verdict & { name: string };
@@ -30,24 +31,6 @@ export function criterion(name: string, evaluate: (context: CriterionContext) =>
   return { name, evaluate: (context) => ({ name, ...evaluate(context) }) };
 }
 
-export function runCommand(root: string, command: string[]): Verdict {
-  // Profile command surfaces are repository-declared, so a named binary may
-  // simply not be installed here. Bun.spawnSync THROWS in that case; a gate
-  // must report every criterion as a verdict, never abort the run, so the
-  // missing binary becomes a red line naming the command.
-  let result;
-  try {
-    result = Bun.spawnSync(command, { cwd: root, env: UNSCOPED_ENVIRONMENT, stdout: PIPE_OUTPUT, stderr: PIPE_OUTPUT });
-  } catch (error) {
-    return { ok: false, detail: `${command[0] ?? "command"} could not be run: ${error instanceof Error ? error.message : String(error)}` };
-  }
-  const output = [result.stdout.toString(), result.stderr.toString()].filter(Boolean).join("\n").trim();
-  if (output) return { ok: result.exitCode === 0, detail: `exit ${result.exitCode}:\n${output}` };
-  return result.exitCode === 0
-    ? { ok: true, detail: "exit 0" }
-    : { ok: false, detail: `exit ${result.exitCode}: ${NO_OUTPUT}` };
-}
-
 export function gitOutput(root: string, command: string[]): string {
   const result = Bun.spawnSync(["git", ...command], { cwd: root, env: UNSCOPED_ENVIRONMENT, stdout: PIPE_OUTPUT, stderr: PIPE_OUTPUT });
   return result.exitCode === 0 ? result.stdout.toString().trim() : "";

package/src/doc_reads.test.ts

@@ -0,0 +1,42 @@
+import { afterEach, expect, test } from "bun:test";
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { cleanupTemporaryDirectories, newRepository, ROOT } from "./gates_test_support";
+import { UNSCOPED_ENVIRONMENT } from "./git_env";
+
+const READ_LOG = ".git/orly/doc-reads.jsonl";
+const CITATION = 'Quoted "section", tab\tline\nnext\rline and control\u0001 with \\ slash.';
+const AUDIT_SCRIPT = "audits/doc-read.sh";
+const READ_HELPER = "audits/doc-reads.ts";
+
+afterEach(cleanupTemporaryDirectories);
+
+for (const filename of ['we"ird.md', "tab\tpage.md", "line\npage.md", "control\u0001page.md"]) {
+  test(`a document read round-trips the path ${JSON.stringify(filename)} and complete citation`, () => {
+    const root = newRepository();
+    writeFileSync(join(root, filename), "Read this rule.\n");
+    const result = Bun.spawnSync(["bash", join(ROOT, AUDIT_SCRIPT), "log", filename, CITATION], { cwd: root, env: { ...UNSCOPED_ENVIRONMENT, ORLY_ROOT: root } });
+    expect(result.exitCode).toBe(0);
+    const rows = readFileSync(join(root, READ_LOG), "utf8").trimEnd().split("\n").map((line) => JSON.parse(line));
+    expect(rows).toHaveLength(1);
+    expect(rows[0].path).toBe(filename);
+    expect(rows[0].section).toBe(CITATION);
+    const current = Bun.spawnSync([process.execPath, join(ROOT, READ_HELPER), "current", join(root, READ_LOG), root]);
+    expect(current.exitCode).toBe(0);
+    const fields = current.stdout.toString().trimEnd().split("\t");
+    expect(fields).toHaveLength(3);
+    expect(JSON.parse(`"${fields[0]}"`)).toBe(filename);
+    expect(JSON.parse(`"${fields[2]}"`)).toBe(CITATION);
+  });
+}
+
+test("malformed saved rows cannot invent a current document read", () => {
+  const root = newRepository();
+  mkdirSync(join(root, ".git/orly"));
+  writeFileSync(join(root, READ_LOG), 'broken JSON\n{"path":"README.md","blob":"bad","ts":"not a time","section":null}\n');
+  appendFileSync(join(root, READ_LOG), JSON.stringify({ path: "../../outside", blob: "abc", ts: 1, section: "invented" }) + "\n");
+  const result = Bun.spawnSync([process.execPath, join(ROOT, READ_HELPER), "current", join(root, READ_LOG), root]);
+  expect(result.exitCode).toBe(0);
+  expect(result.stdout.toString()).toBe("");
+});

package/src/doc_rules.ts

@@ -53,7 +53,7 @@ function isRulePage(file: string): boolean {
   return RULE_PAGE_FILES.includes(name);
 }
 const README = "README.md";
-const CONFIG_RELATIVE_PATH = ".oracle/orly.json";
+const CONFIG_RELATIVE_PATH = ".orly/orly.json";
 const REGISTRY_FILE = "registry.json";
 const CODE_PLACEHOLDER = "Code";
 const EMPTY = "";
@@ -130,7 +130,7 @@ const RULE_NAMES: Record<string, string> = {
 };
 
 // The pages orly renders into a repository, plus its readme. The materialised
-// set is authoritative and it is recorded, not guessed: `.oracle/orly.json`
+// set is authoritative and it is recorded, not guessed: `.orly/orly.json`
 // names every file orly wrote here. In the engine's own checkout the registry
 // names the sources those files are rendered from, which is the same set one
 // step earlier. README.md joins either list by the scope rule in

package/src/evaluation_resources.test.ts

@@ -0,0 +1,64 @@
+import { afterEach, expect, test } from "bun:test";
+import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { cleanupTemporaryDirectories, ROOT, temporaryDirectory } from "./gates_test_support";
+import { UNSCOPED_ENVIRONMENT } from "./git_env";
+
+const BASH = "bash";
+const PIPE = "pipe";
+const OWNER_FILE = "owner.txt";
+const OWNER_CONTENT = "caller-owned bytes\n";
+const LEDGER_LIBRARY = "evals/ledger/lib.sh";
+const TEST_TIMEOUT_MS = 20_000;
+const INTERRUPTED_EXIT = 143;
+const FAILURE_EXIT = 7;
+
+afterEach(cleanupTemporaryDirectories);
+
+function environment(root: string) {
+  writeFileSync(join(root, OWNER_FILE), OWNER_CONTENT);
+  return { ...UNSCOPED_ENVIRONMENT, TMPDIR: root, LEDGER_LIBRARY: join(ROOT, LEDGER_LIBRARY) };
+}
+
+function expectClean(root: string) {
+  expect(readdirSync(root)).toEqual([OWNER_FILE]);
+  expect(readFileSync(join(root, OWNER_FILE), "utf8")).toBe(OWNER_CONTENT);
+}
+
+for (const script of ["evals/ledger/run.sh", "evals/dispatch/parity.sh"]) {
+  test(`evaluation cleanup preserves caller state after ${script}`, () => {
+    const root = temporaryDirectory();
+    const result = Bun.spawnSync([BASH, join(ROOT, script)], { cwd: ROOT, env: environment(root), stdout: PIPE, stderr: PIPE, timeout: TEST_TIMEOUT_MS });
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.toString()).toContain("passed, 0 failed");
+    expectClean(root);
+  }, TEST_TIMEOUT_MS);
+}
+
+test("ledger command-substitution fixtures are removed after a failing caller", () => {
+  const root = temporaryDirectory();
+  const result = Bun.spawnSync([BASH, "-c", 'source "$LEDGER_LIBRARY"; sb="$(mk_root)"; [[ -d "$sb" ]] || exit 1; exit 7'], { env: environment(root), stdout: PIPE, stderr: PIPE });
+  expect(result.exitCode).toBe(FAILURE_EXIT);
+  expectClean(root);
+});
+
+test("ledger command-substitution fixtures are removed after termination", async () => {
+  const root = temporaryDirectory();
+  const child = Bun.spawn([BASH, "-c", 'source "$LEDGER_LIBRARY"; sb="$(mk_root)"; printf "%s\\n" "$sb"; read -r pending'], { env: environment(root), stdin: PIPE, stdout: PIPE, stderr: PIPE });
+  try {
+    const reader = child.stdout.getReader();
+    const ready = await reader.read();
+    expect(ready.done).toBeFalse();
+    const fixture = new TextDecoder().decode(ready.value).trim();
+    expect(existsSync(fixture)).toBeTrue();
+    expect(fixture.startsWith(root)).toBeTrue();
+    child.kill("SIGTERM");
+    expect(await child.exited).toBe(INTERRUPTED_EXIT);
+    expectClean(root);
+  } finally {
+    child.stdin.end();
+    child.kill();
+    await child.exited;
+  }
+}, TEST_TIMEOUT_MS);

package/src/execution/config.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { OrlyError } from "../model";
+
+export const DISABLED_MODE = "disabled";
+const MAX_ARGUMENTS = 32;
+const MAX_ARGUMENT_LENGTH = 1024;
+const argument = z.string().min(1).max(MAX_ARGUMENT_LENGTH).refine((value) => !value.includes("\0"));
+const executionSchema = z.object({
+  remote: z.object({
+    mode: z.literal(DISABLED_MODE),
+    launcher: z.array(argument).min(1).max(MAX_ARGUMENTS).optional(),
+  }).strict(),
+}).strict();
+
+export type ExecutionConfig = z.infer<typeof executionSchema>;
+
+export function readExecution(value: unknown): ExecutionConfig | undefined {
+  if (value === undefined) return undefined;
+  const parsed = executionSchema.safeParse(value);
+  if (!parsed.success) throw new OrlyError("execution.remote requires mode=disabled and an optional nonempty launcher argument array; remote activation is unsupported");
+  return parsed.data;
+}

package/src/execution/plan.test.ts

@@ -0,0 +1,65 @@
+import { afterEach, expect, test } from "bun:test";
+import { join } from "node:path";
+import { readConfig, seedConfig, writeConfig } from "../config";
+import { cleanupTemporaryDirectories, newRepository, ROOT } from "../gates_test_support";
+import { runGate } from "../gates";
+import { RulesModel } from "../model";
+import { readExecution } from "./config";
+import { lifecyclePlan } from "./plan";
+
+afterEach(cleanupTemporaryDirectories);
+
+test("lifecycle_plan_names_actual_commands", async () => {
+  const repo = newRepository();
+  const config = await seedConfig(repo);
+  config.commands = { conform: [["true"]], "verify.lint": [["true"]], "verify.unit": [["false"]], "verify.integration": [["false"]] };
+  await writeConfig(repo, config);
+  const plan = lifecyclePlan(repo);
+  const verify = plan.stages.find((stage) => stage.name === "VERIFY")!;
+  expect("pushCommands" in verify && verify.pushCommands?.map((command) => command.lane)).toEqual(["verify.lint"]);
+  expect("boundaryCommands" in verify && verify.boundaryCommands?.map((command) => command.lane)).toEqual(["verify.integration", "verify.lint", "verify.unit"]);
+  expect(plan.remote.evidence).toBeNull();
+});
+
+test("disabled_adapter_has_no_side_effects", async () => {
+  const repo = newRepository();
+  const config = await seedConfig(repo);
+  const sentinel = join(repo, "worker-ran");
+  config.execution = { remote: { mode: "disabled", launcher: ["touch", sentinel] } };
+  config.commands = { conform: [["false"]], "verify.unit": [["true"]] };
+  await writeConfig(repo, config);
+  expect(lifecyclePlan(repo).remote.launches).toBe(0);
+  const result = runGate(await RulesModel.load(ROOT), repo, "work", true);
+  expect(result.ok).toBe(false);
+  expect(result.results.find((row) => row.name === "cmd.conform")?.ok).toBe(false);
+  expect(await Bun.file(sentinel).exists()).toBe(false);
+  expect((await readConfig(repo))?.execution).toEqual(config.execution);
+});
+
+test.each([
+  null, {}, { remote: {} }, { remote: { mode: "enabled" } },
+  { remote: { mode: "disabled", launcher: "agentsfleet run" } },
+  { remote: { mode: "disabled", launcher: [] } },
+  { remote: { mode: "disabled", launcher: [""] } },
+  { remote: { mode: "disabled", launcher: ["x\0y"] } },
+  { remote: { mode: "disabled", activate: true } },
+])("remote_adapter_is_disabled rejects malformed or active configuration: %j", (input) => {
+  expect(() => readExecution(input)).toThrow("remote activation is unsupported");
+});
+
+test("disabled_adapter_never_becomes_pass", async () => {
+  const repo = newRepository();
+  const { configPath } = await import("../config");
+  const config = await seedConfig(repo);
+  await Bun.write(configPath(repo), JSON.stringify({ ...config, execution: { remote: { mode: "enabled" } } }));
+  expect(() => lifecyclePlan(repo)).toThrow("remote activation is unsupported");
+  const result = runGate(await RulesModel.load(ROOT), repo, "work", true);
+  expect(result.ok).toBe(false);
+  expect(result.results.find((row) => row.name === "repo.config")?.detail).toContain("remote activation is unsupported");
+});
+
+test("missing adapter defaults to disabled and missing repository fails", () => {
+  expect(readExecution(undefined)).toBeUndefined();
+  expect(readExecution({ remote: { mode: "disabled" } })).toEqual({ remote: { mode: "disabled" } });
+  expect(() => lifecyclePlan(join(newRepository(), "uninstalled"))).toThrow("run orly init");
+});

package/src/execution/plan.ts

@@ -0,0 +1,51 @@
+import { readConfigSync, type RepoConfig } from "../config";
+import { OrlyError } from "../model";
+import { DISABLED_MODE } from "./config";
+
+export const CONFORM_TIER = "conform";
+export const FAST_TIER = "fast";
+export const ALL_TIER = "all";
+const COMMANDER = "commander";
+const LOCAL = "local";
+const VERIFY_PREFIX = "verify.";
+const UNIT = "verify.unit";
+export const CONDITIONAL_LANES = ["verify.integration", "verify.memory"];
+export type CommandTier = typeof CONFORM_TIER | typeof FAST_TIER | typeof ALL_TIER;
+
+// Used by both inspection and the actual gates so their command sets agree.
+export function selectedCommands(commands: RepoConfig["commands"], tier: CommandTier): string[] {
+  return Object.keys(commands).filter((key) => {
+    if (tier === CONFORM_TIER) return key === CONFORM_TIER;
+    if (!key.startsWith(VERIFY_PREFIX)) return false;
+    return tier === ALL_TIER || (key !== UNIT && !CONDITIONAL_LANES.includes(key));
+  }).sort();
+}
+
+export function lifecyclePlan(root: string) {
+  const config = readConfigSync(root);
+  if (!config) throw new OrlyError("lifecycle inspection requires repository configuration; run orly init");
+  const commands = (tier: CommandTier) => selectedCommands(config.commands, tier).map((lane) => ({
+    lane, argv: config.commands[lane], location: LOCAL, conditionalOnCode: CONDITIONAL_LANES.includes(lane),
+  }));
+  return {
+    schema_version: 1,
+    remote: { mode: DISABLED_MODE, launcher: config.execution?.remote.launcher ?? null, evidence: null, launches: 0 },
+    stages: [
+      stage("CHORE(open)", COMMANDER, "Create the scoped stream and record the comparison revision.", "Spec, branch and workspace; commander removes the owned workspace after landing."),
+      stage("PLAN", COMMANDER, "Read requirements and triggered rules; resolve scope and required evidence.", "Spec and agent context; no build prescribed."),
+      stage("EXECUTE", COMMANDER, "Implement and test the current Section.", "Source and tool-owned outputs; declared tools own their cleanup."),
+      { ...stage("CONFORM", "orly gate work", "Run declared conformity commands.", "Command-owned caches and outputs."), commands: commands(CONFORM_TIER) },
+      { ...stage("VERIFY", "orly gate verify / orly gate pr", "Push runs fast checks; the pull-request boundary runs every verification lane.", "Test outputs and comparison workspace; commander removes its baseline workspace."), pushCommands: commands(FAST_TIER), boundaryCommands: commands(ALL_TIER) },
+      stage("REVIEW", COMMANDER, "Run required adversarial review and resolve findings.", "Review receipts and bounded optional judgment replay."),
+      stage("DOCUMENT", COMMANDER, "Update affected user instructions and evidence.", "Tracked documentation."),
+      stage("COMMIT", "Git hooks", "Run installed work hook; push runs installed verify hook.", "Git objects; repository hooks may declare additional checks."),
+      stage("CHORE(close)", "commander / orly gate pr", "Close the spec only when scope and required evidence are complete.", "Committed spec and pull-request evidence."),
+      stage("LAND", COMMANDER, "After authorized merge, update the default branch and remove owned stream resources.", "Repository-specific shutdown and worktree cleanup."),
+    ],
+    limits: "Inspection executes no commands. Command disk usage is tool-owned and is not measured or bounded by this plan. Remote delegation is disabled and supplies no check result.",
+  };
+}
+
+function stage(name: string, executor: string, work: string, resources: string) {
+  return { name, executor, work, resources, location: LOCAL };
+}

package/src/gates.ts

@@ -11,6 +11,7 @@ export type GateName = (typeof GATE_ORDER)[number];
 
 const PIPE_OUTPUT = "pipe";
 const GIT = "git";
+const CURRENT_BRANCH_ARGUMENTS = ["rev-parse", "--abbrev-ref", "HEAD"];
 const DOCS_DIRECTORY = "docs";
 const ACTIVE_DIRECTORY = "active";
 const DONE_DIRECTORY = "done";
@@ -23,7 +24,7 @@ const UTF8 = "utf8";
 const PROTOTYPE_PATTERN = /^v\d+(\.\d+)*$/;
 const MARKDOWN_EXTENSION = ".md";
 const NEWLINE = "\n";
-const MARKDOWN_HEADER_TOKEN_PATTERN = /^\s*\*\*([^*]+):\*\*\s*`([^`]+)`/;
+const MARKDOWN_HEADER_TOKEN_PATTERN = /^\s*\*\*([^*]+):\*\*\s*(?:`([^`]+)`|([^\s`]+))\s*$/;
 const SPEC_IDENTIFIER_PATTERN = /^(M\d+_\d+)(?:_|\.md$)/;
 // Strict trailer shape: "Orly-Override: <criterion> (<reason>)". A trailer
 // that does not parse is not an override — the gate stays red rather than
@@ -110,10 +111,12 @@ export function branchOverrides(root: string): Override[] {
 // Folded-into — the same relation closedSpecPath enforces in done/. Without
 // this, folding a workstream into an open stream was impossible during the
 // work and legal only after the close, which is the wrong way round: the fold
-// is decided when the scope is, not when the spec moves.
+// is decided when the scope is, not when the spec moves. Specs explicitly
+// owned by another branch are excluded; undeclared ownership stays visible.
 export function activeSpecPath(root: string): string | undefined {
+  const branch = gitOutput(root, CURRENT_BRANCH_ARGUMENTS);
   const specs = specPathsUnder(root, ACTIVE_DIRECTORY).map(specMetadata)
-    .filter((spec): spec is SpecMetadata => spec !== undefined);
+    .filter((spec): spec is SpecMetadata => spec !== undefined && (spec.branch === undefined || spec.branch === branch));
   if (specs.length === 0) return undefined;
   return owningSpec(specs, "active spec", "active specs").path;
 }
@@ -140,7 +143,7 @@ function owningSpec(specs: SpecMetadata[], one: string, many: string): SpecMetad
 // be end-state theater. Discovery matches done/ specs whose Branch: header
 // names the current branch; default branches never match a stream's spec.
 export function closedSpecPath(root: string): string | undefined {
-  const branch = gitOutput(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const branch = gitOutput(root, CURRENT_BRANCH_ARGUMENTS);
   if (!branch || DEFAULT_BRANCHES.includes(branch)) return undefined;
   const specs = specPathsUnder(root, DONE_DIRECTORY)
     .map(specMetadata)
@@ -168,8 +171,8 @@ function specMetadata(path: string): SpecMetadata | undefined {
     for (const line of readFileSync(path, UTF8).split(/\r?\n/)) {
       if (line.startsWith("## ")) break;
       const match = line.match(MARKDOWN_HEADER_TOKEN_PATTERN);
-      if (match?.[1] === BRANCH_HEADER) metadata.branch = match[2];
-      if (match?.[1] === FOLDED_INTO_HEADER) metadata.foldedInto = match[2];
+      if (match?.[1] === BRANCH_HEADER) metadata.branch = match[2] ?? match[3];
+      if (match?.[1] === FOLDED_INTO_HEADER) metadata.foldedInto = match[2] ?? match[3];
     }
     return metadata;
   } catch {