@agentsfleet/orly 0.10.4 → 0.10.6

package/src/cli.ts

@@ -9,6 +9,7 @@ import { isString, OrlyError, readJsonObject, RulesModel } from "./model";
 import { Renderer } from "./render";
 import { beginTelemetry, installedOrlyVersion, isTelemetrySkill, recordTelemetry } from "./telemetry";
 import { verifyRenders, writeEvidence } from "./verify";
+import { commandSetupErrors } from "./validation";
 
 type CliResult = { exitCode: number; gate?: string; failedCriterion?: string };
 
@@ -152,15 +153,18 @@ async function materialise(model: RulesModel, args: string[], isInit: boolean):
     installHooks: !args.includes(NO_HOOKS_FLAG),
     orlyVersion: await packageVersion(model),
   });
-  if (args.includes(JSON_FLAG)) console.log(JSON.stringify(result, undefined, JSON_INDENT));
-  else printInstall(result);
+  const setupErrors = result.ok ? commandSetupErrors((await readConfig(targetRoot))!.commands) : [];
+  if (args.includes(JSON_FLAG)) console.log(JSON.stringify({ ...result, setupErrors }, undefined, JSON_INDENT));
+  else printInstall(result, setupErrors);
   return result.ok ? 0 : 1;
 }
 
-function printInstall(result: InstallResult): void {
+function printInstall(result: InstallResult, setupErrors: string[]): void {
   for (const error of result.errors) console.log(`${FAIL_GLYPH} ${error.path}: ${error.message} — ${error.suggestion}`);
   if (!result.ok) return;
   console.log(`${PASS_GLYPH} ${result.written.length} written, ${result.skipped.length} already current (${result.packs.length} packs)`);
+  for (const error of setupErrors) console.log(`🟠 setup incomplete: ${error}`);
+  if (setupErrors.length > 0) console.log("Then run orly doctor to check the completed setup.");
 }
 
 function printGate(report: GateReport): void {
@@ -175,9 +179,6 @@ function projectRoot(): string {
 }
 
 async function doctorGlobal(model: RulesModel): Promise<number> {
-  // Every repository is the same case now: doctor reports on the ruleset
-  // installed where the caller is standing. There is no machine-level carrier
-  // to check — the rules ride in each repository's own commit.
   const errors = await doctorInstall(model);
   if (errors.length > 0) {
     for (const error of errors) console.log(`${FAIL_GLYPH} ${error}`);
@@ -188,7 +189,10 @@ async function doctorGlobal(model: RulesModel): Promise<number> {
     console.log(`${FAIL_GLYPH} no ${CONFIG_PATH} here — run \`orly init\` first`);
     return 1;
   }
-  console.log(`${PASS_GLYPH} this repository's installed ruleset matches ${CONFIG_PATH}`);
+  const setupErrors = commandSetupErrors(config.commands);
+  for (const error of setupErrors) console.log(`${FAIL_GLYPH} setup incomplete: ${error}`);
+  if (setupErrors.length > 0) return 1;
+  console.log(`${PASS_GLYPH} installed rules match ${CONFIG_PATH}; work and verification commands are declared`);
   return 0;
 }
 
@@ -266,12 +270,6 @@ function requireNoArguments(args: string[], usage: string): void {
   if (args.length > 0) throw new OrlyError(usage);
 }
 
-function optionValue(args: string[], name: string): string {
-  const value = optionalValue(args, name);
-  if (!value) throw new OrlyError(`${name} is required`);
-  return value;
-}
-
 function optionalValue(args: string[], name: string): string | undefined {
   const index = args.indexOf(name);
   return index < 0 ? undefined : args[index + 1];
@@ -301,10 +299,10 @@ Gates (read-only; no PR without every criterion green or a recorded override):
   orly gate <work|verify|pr>        run one gate
       work    does this commit conform? the declared conform command; no git
               state, so a commit hook's own dirty tree never blocks it
-      verify  does the work hold up? spec dimensions, docs language, and the
-              fast verify.* set
+      verify  does the work hold up? configuration, docs language, and the
+              non-test verify.* set; unfinished Sections may be pushed
       pr      can this ship? branch, tree, pushed, every spec criterion, and
-              the slow verify.* suites
+              every declared verify.* command
   orly override <CRITERION> --reason <REASON>
                                     empty commit with an Orly-Override trailer
 

package/src/criteria.test.ts

@@ -1,9 +1,10 @@
 import { afterEach, describe, expect, test } from "bun:test";
 import { rmSync } from "node:fs";
-import { join } from "node:path";
+import { join, relative } from "node:path";
 
 import { criteriaFor, runCommand } from "./criteria";
-import { cleanupTemporaryDirectories, modelFor, newRepository, newSpecRepository } from "./gates_test_support";
+import { activeSpecPath, closedSpecPath } from "./gates";
+import { cleanupTemporaryDirectories, closedSpecRepository, git, modelFor, newRepository, newSpecRepository } from "./gates_test_support";
 
 const WORK = "work";
 const VERIFY = "verify";
@@ -32,12 +33,12 @@ describe("criteriaFor", () => {
     expect(named(WORK, await contextFor(project))).toEqual(["cmd.conform", REPO_CONFIG]);
   });
 
-  test("verify pairs the spec dimensions with the fast command tier only", async () => {
+  test("verify permits unfinished Sections and excludes boundary test suites", async () => {
     const project = newSpecRepository();
     const names = named(VERIFY, await contextFor(project));
 
-    expect(names).toContain("spec.dimensions");
-    expect(names).toContain("cmd.verify.unit");
+    expect(names).not.toContain("spec.dimensions");
+    expect(names).not.toContain("cmd.verify.unit");
     // conform is the work gate's tier now, so the chain runs it once.
     expect(names).not.toContain("cmd.conform");
     // The slow tier belongs to the pr gate; leaking it here would make every
@@ -63,6 +64,20 @@ describe("criteriaFor", () => {
     expect(names).toContain("git.tree");
   });
 
+  test("final verification runs test lanes even when push verification never ran", async () => {
+    const root = newRepository();
+    const commands = Object.fromEntries(["unit", "integration", "memory", "lint"].map((lane) => [
+      `verify.${lane}`, [["sh", "-c", `echo ${lane} >> ran.txt`]],
+    ]));
+    const context = {
+      root, model: await modelFor(root, undefined, commands), acceptDirty: false,
+      surfaces: { changed: ["app.rs"], code: ["app.rs"], docs: [], userSurface: [] },
+    };
+    const checks = criteriaFor(PR, context).filter((entry) => entry.name.startsWith("cmd."));
+    expect(checks.map((entry) => entry.evaluate(context).ok)).toEqual([true, true, true, true]);
+    expect((await Bun.file(join(root, "ran.txt")).text()).trim().split("\n").sort()).toEqual(["integration", "lint", "memory", "unit"]);
+  });
+
   test("an unknown gate name yields no criteria rather than throwing", async () => {
     const project = newSpecRepository();
     expect(criteriaFor("nonsense", await contextFor(project))).toEqual([]);
@@ -108,14 +123,19 @@ describe("runCommand", () => {
     expect(runCommand(process.cwd(), ["true"])).toEqual({ ok: true, detail: "exit 0" });
   });
 
-  test("a non-zero exit carries the code and the last output line", () => {
+  test("a non-zero exit retains all output, including earlier findings", () => {
     const result = runCommand(process.cwd(), ["sh", "-c", "echo first; echo decisive >&2; exit 3"]);
 
     expect(result.ok).toBeFalse();
     expect(result.detail).toContain("exit 3");
+    expect(result.detail).toContain("first");
     expect(result.detail).toEndWith("decisive");
   });
 
+  test("a successful command retains its measured counts", () => {
+    expect(runCommand(process.cwd(), ["echo", "12 passed, 0 failed"]).detail).toContain("12 passed, 0 failed");
+  });
+
   test("a silent failure still reports a detail rather than an empty string", () => {
     const result = runCommand(process.cwd(), ["false"]);
 
@@ -146,3 +166,24 @@ describe("repo.config", () => {
     expect(verdict?.detail).toContain("orly init");
   });
 });
+
+describe("the final tree check", () => {
+  for (const stage of ["active", "done"]) {
+    test(`requires a ${stage} spec edit to be committed`, async () => {
+      const root = stage === "active" ? newSpecRepository() : closedSpecRepository("feat/spec");
+      const model = await modelFor(root);
+      const specPath = relative(root, activeSpecPath(root) ?? closedSpecPath(root)!);
+      const context = { root, model, specPath, acceptDirty: false };
+      const check = criteriaFor(PR, context).find((entry) => entry.name === "git.tree")!;
+      expect(check.evaluate(context).ok).toBe(true);
+
+      const path = join(root, specPath);
+      await Bun.write(path, `${await Bun.file(path).text()}\nUpdated evidence.\n`);
+      expect(check.evaluate(context).ok).toBe(false);
+      git(root, "add", specPath);
+      expect(check.evaluate(context).ok).toBe(false);
+      git(root, "commit", "-qm", "docs: record evidence");
+      expect(check.evaluate(context).ok).toBe(true);
+    });
+  }
+});

package/src/criteria.ts

@@ -12,6 +12,7 @@ import { documentationSurfaces, scanSurfaces } from "./doc_rules";
 import { isObject, JsonObject, objectValue, OrlyError, RulesModel } from "./model";
 import { readConfigSync, RepoConfig } from "./config";
 import { classifyBranch, SurfaceReport } from "./surfaces";
+import { commandSetupErrors } from "./validation";
 
 export type { Criterion, CriterionContext, CriterionResult, Verdict };
 export { runCommand };
@@ -22,6 +23,9 @@ const VERIFY_PREFIX = "verify.";
 const REPOSITORIES_LABEL = "repositories";
 const UNINSTALLED = "no .oracle/orly.json here — run `orly init` first";
 const REV_PARSE = "rev-parse";
+const HEAD = "HEAD";
+const UPSTREAM = "@{upstream}";
+const NEWLINE = "\n";
 const ABBREV_REF = "--abbrev-ref";
 const WORKTREE_LIST = ["worktree", "list", "--porcelain"];
 const WORKTREE_PREFIX = "worktree ";
@@ -47,37 +51,20 @@ const SLOW_TIER = "slow";
 // The slow tier is a fixed name set, not a prefix rule: lint and version
 // checks are verify.* too, and demoting them to skip-on-prose would be wrong.
 const SLOW_COMMANDS = ["verify.integration", "verify.memory"];
+const UNIT_COMMAND = "verify.unit";
+const ALL_TIER = "all";
 
-// Every criterion is mechanical: it reads an exit code or a file, never a
-// judgment. The anchor invariant promises the machine can PROVE the PR
-// boundary, so anything unprovable stays prose and never lands here.
-//
-// One gate per cadence, and each question asked at the only moment it can be
-// answered honestly:
-//
-//   work   — does this commit conform? Config plus the declared `conform`
-//            command. Nothing about branch or tree: inside a commit hook the
-//            tree is dirty BY CONSTRUCTION (that is what is being committed),
-//            and the operating model itself says a new spec is committed on the
-//            default branch. Judging either here made the generated pre-commit
-//            hook refuse every commit — including the one installing orly —
-//            with `--no-verify`, which Hard Safety forbids, as the only way out.
-//   verify — does the work hold up? Spec dimensions, documentation language,
-//            and the fast `verify.*` set. Runs before the work leaves the
-//            machine, not after every edit.
-//   pr     — can this ship? The whole-branch facts (branch shape, clean tree,
-//            pushed) plus every spec criterion and the slow suites. A tree is
-//            only required clean where a reviewer is about to read it, and a
-//            branch is only wrong for being `main` where a PR would open from
-//            it.
+// Commit checks read the index. Push checks permit in-flight Sections and omit
+// the boundary test suites. The final gate runs all declared verification
+// itself, including checks a custom repository hook may not have invoked.
 export function criteriaFor(gate: string, context: CriterionContext): Criterion[] {
   if (gate === "work") return [repositoryConfig(), ...commandCriteria(context, CONFORM_TIER)];
-  if (gate === "verify") return [specDimensions(), docsLanguage(), ...commandCriteria(context, FAST_TIER)];
+  if (gate === "verify") return [repositoryConfig(), docsLanguage(), ...commandCriteria(context, FAST_TIER)];
   if (gate === "pr") {
     return [
       gitBranch(), gitTree(), gitPushed(), specGate(), openQuestions(), productClarity(), specDimensions(),
       specMoved(), specBaseline(), specOrdering(), specDeferrals(),
-      docsUpdated(), ...commandCriteria(context, SLOW_TIER),
+      repositoryConfig(), docsLanguage(), docsUpdated(), ...commandCriteria(context, ALL_TIER),
     ];
   }
   return [];
@@ -93,14 +80,10 @@ function gitBranch(): Criterion {
 
 function gitTree(): Criterion {
   return criterion(GIT_TREE, (context) => {
-    // The active spec is excluded while work is in flight: Dimensions get
-    // marked DONE as the agent goes, and the tree check must not block on that
-    // bookkeeping. Committing the spec stays a CHORE(close) obligation.
     const dirty = gitOutput(context.root, ["status", "--porcelain=v1", "-uall"])
       .split(/\r?\n/)
-      .filter(Boolean)
-      .filter((line) => !context.specPath || !line.includes(context.specPath));
-    if (dirty.length === 0) return { ok: true, detail: "clean (active spec excluded)" };
+      .filter(Boolean);
+    if (dirty.length === 0) return { ok: true, detail: "clean" };
     if (context.acceptDirty) return { ok: true, detail: `${dirty.length} dirty path(s) accepted` };
     return { ok: false, detail: `${dirty.length} uncommitted path(s), first: ${dirty[0] ?? ""}` };
   });
@@ -108,11 +91,12 @@ function gitTree(): Criterion {
 
 function gitPushed(): Criterion {
   return criterion(GIT_PUSHED, (context) => {
-    const upstream = gitOutput(context.root, [REV_PARSE, ABBREV_REF, "--symbolic-full-name", "@{upstream}"]);
+    const upstream = gitOutput(context.root, [REV_PARSE, ABBREV_REF, "--symbolic-full-name", UPSTREAM]);
     if (upstream.length === 0) return { ok: false, detail: "branch has no upstream; push it first" };
-    const ahead = gitOutput(context.root, ["rev-list", "--count", "@{upstream}..HEAD"]);
-    const ok = ahead === "0";
-    return { ok, detail: ok ? `in sync with ${upstream}` : `${ahead} commit(s) not pushed to ${upstream}` };
+    const head = gitOutput(context.root, [REV_PARSE, HEAD]);
+    const remote = gitOutput(context.root, [REV_PARSE, UPSTREAM]);
+    const ok = head.length > 0 && head === remote;
+    return { ok, detail: ok ? `in sync with ${upstream}` : `HEAD differs from ${upstream}; push the reviewed revision` };
   });
 }
 
@@ -121,27 +105,23 @@ function repositoryConfig(): Criterion {
     try {
       const config = readConfigSync(context.root);
       if (!config) return { ok: false, detail: UNINSTALLED };
-      const commands = Object.keys(config.commands).length;
-      return { ok: commands > 0, detail: commands > 0 ? `${commands} command(s) declared` : "no commands declared in .oracle/orly.json — add conform and verify.* so the gate can run them" };
+      const errors = commandSetupErrors(config.commands);
+      return { ok: errors.length === 0, detail: errors.length > 0 ? errors.join("; ") : `${Object.keys(config.commands).length} command(s) declared` };
     } catch (error) {
       return { ok: false, detail: error instanceof Error ? error.message : String(error) };
     }
   });
 }
 
-// Model C: the repository's declared command surface. Orly owns policy and
-// invokes these; the repository owns what they actually do. Conform tier = the
-// `conform` command alone. Fast tier = every verify.* that is not slow. Slow
-// tier = verify.integration and verify.memory; those auto-pass with a printed
-// skip when the branch carries no code, so a prose-only branch never pays for
-// the slow suites.
+// Commands and source paths are repository-owned. Only integration and memory
+// checks are conditional on code; every other declared lane always runs.
 function commandCriteria(context: CriterionContext, tier: string): Criterion[] {
   const config = resolvedConfig(context);
-  if (!config) return tier === FAST_TIER ? [criterion(REPO_CONFIG, () => ({ ok: false, detail: UNINSTALLED }))] : [];
+  if (!config) return [];
   const commands = config.commands;
-  const selected = Object.keys(commands).filter((key) => tierOf(key) === tier).sort();
+  const selected = Object.keys(commands).filter((key) => tier === ALL_TIER ? key.startsWith(VERIFY_PREFIX) : tierOf(key) === tier).sort();
   return selected.map((key) => criterion(`cmd.${key}`, (inner) => {
-    if (tier === SLOW_TIER && report(inner, config.surfaces).code.length === 0) {
+    if (SLOW_COMMANDS.includes(key) && report(inner, config.surfaces).code.length === 0) {
       return { ok: true, detail: "skipped — no code files on this branch" };
     }
     return runInvocations(inner.root, commands[key]);
@@ -150,7 +130,7 @@ function commandCriteria(context: CriterionContext, tier: string): Criterion[] {
 
 function tierOf(key: string): string {
   if (key === CONFORM_COMMAND) return CONFORM_TIER;
-  if (SLOW_COMMANDS.includes(key)) return SLOW_TIER;
+  if (key === UNIT_COMMAND || SLOW_COMMANDS.includes(key)) return SLOW_TIER;
   if (key.startsWith(VERIFY_PREFIX)) return FAST_TIER;
   return "";
 }
@@ -213,12 +193,13 @@ function resolvedConfig(context: CriterionContext): RepoConfig | undefined {
 
 function runInvocations(root: string, invocations: unknown): Verdict {
   if (!Array.isArray(invocations) || invocations.length === 0) return { ok: false, detail: "command group is empty" };
+  const evidence: string[] = [];
   for (const invocation of invocations) {
     if (!Array.isArray(invocation) || invocation.length === 0) return { ok: false, detail: "command invocation is empty" };
     const argv = invocation.map((argument) => String(argument));
     const result = runCommand(root, argv);
-    if (!result.ok) return { ok: false, detail: `${argv.join(" ")} -> ${result.detail}` };
+    evidence.push(`${argv.join(" ")} -> ${result.detail}`);
+    if (!result.ok) return { ok: false, detail: evidence.join(NEWLINE) };
   }
-  return { ok: true, detail: `${invocations.length} invocation(s) exit 0` };
+  return { ok: true, detail: `${invocations.length} invocation(s) exit 0\n${evidence.join(NEWLINE)}` };
 }
-

package/src/criteria_spec.ts

@@ -1,5 +1,16 @@
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { readConfigSync } from "./config";
 import { Criterion, CriterionContext, criterion, gitOutput, runCommand, Verdict } from "./criteria_support";
-import { branchDiff, defaultMergeBase } from "./surfaces";
+import { branchDiff, classifyBranch, defaultMergeBase } from "./surfaces";
+
+const BASELINE_HEADER = "Test Baseline";
+const REVISION_HEADER = "Baseline revision";
+const EVIDENCE_HEADER = "Baseline evidence";
+const BASELINE_LANES = ["unit", "integration"];
+const FULL_REVISION = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const NOT_APPLICABLE = /^n\/a\s+[—-]\s+\S/i;
+
 
 const OPEN_QUESTION = "[?]";
 const PRODUCT_CLARITY_HEADING = "## Product Clarity";
@@ -17,7 +28,6 @@ const SPEC_BASELINE = "spec.baseline";
 const SPEC_ORDERING = "spec.ordering";
 const SPEC_DEFERRALS = "spec.deferrals";
 const STATUS_DONE = "Status: DONE";
-const BASELINE_HEADER = "Test Baseline:";
 const INDY_ACK = "> Indy (";
 // deferred/deferral(s) only — never Zig's defer/errdefer keywords.
 const DEFERRAL_CLAIM = /\bdeferr(ed|al|als)\b/i;
@@ -78,10 +88,29 @@ export function specMoved(): Criterion {
 
 export function specBaseline(): Criterion {
   return specCriterion(SPEC_BASELINE, (context) => {
-    const present = specLines(context).some((line) => line.includes(BASELINE_HEADER));
-    return present
-      ? { ok: true, detail: "Test Baseline recorded" }
-      : { ok: false, detail: `no \`${BASELINE_HEADER}\` line in the spec header — CHORE(open) records it before any code` };
+    const baseline = header(context.specText ?? "", BASELINE_HEADER);
+    if (!baseline) return { ok: false, detail: "no Test Baseline header — declare it at opening" };
+    let config;
+    try {
+      config = readConfigSync(context.root);
+    } catch (error) {
+      return { ok: false, detail: `cannot read baseline configuration: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    if (!config) return { ok: false, detail: "baseline needs the repository's declared commands" };
+    const lanes = BASELINE_LANES.filter((lane) => `verify.${lane}` in config.commands);
+    const surfaces = context.surfaces ?? classifyBranch(context.root, config.surfaces);
+    if (NOT_APPLICABLE.test(baseline)) {
+      const knownBase = defaultMergeBase(context.root).length > 0;
+      const allowed = lanes.length === 0 || (knownBase && surfaces.code.length === 0);
+      return { ok: allowed, detail: allowed ? "baseline not applicable: no code or no baseline lanes" : "n/a cannot replace a code branch's declared baseline lanes" };
+    }
+    for (const lane of lanes) {
+      if (!new RegExp(`(?:^|\\s)${lane}=\\d+(?=\\s|$)`).test(baseline)) {
+        return { ok: false, detail: `Test Baseline carries no count for ${lane} — measure before the Pull Request` };
+      }
+    }
+    if (lanes.length === 0) return { ok: false, detail: "no baseline lanes declared — record n/a with the reason" };
+    return baselineEvidence(context);
   });
 }
 
@@ -125,3 +154,21 @@ function specLines(context: CriterionContext): string[] {
 function dimensionLabels(lines: string[]): string {
   return lines.map((line) => line.trim().slice(DIMENSION_PREFIX.length).split("*")[0]?.trim() ?? "?").join(", ");
 }
+
+function baselineEvidence(context: CriterionContext): Verdict {
+  const text = context.specText ?? "";
+  const revision = header(text, REVISION_HEADER);
+  if (!FULL_REVISION.test(revision)) return { ok: false, detail: "Baseline revision must name a full comparison commit" };
+  const ancestor = gitOutput(context.root, ["merge-base", revision, "HEAD"]);
+  if (ancestor !== revision) return { ok: false, detail: "Baseline revision is missing or is not an ancestor of HEAD" };
+  const evidence = header(text, EVIDENCE_HEADER);
+  if (!evidence || (!/^https?:\/\/\S+$/.test(evidence) && !existsSync(resolve(context.root, evidence)))) {
+    return { ok: false, detail: "Baseline evidence must name an existing report or a run URL" };
+  }
+  return { ok: true, detail: "baseline counts, comparison revision, and evidence reference recorded; report contents require review" };
+}
+
+function header(text: string, name: string): string {
+  const prefix = `**${name}:**`;
+  return (text.split(/\r?\n/).find((line) => line.startsWith(prefix))?.slice(prefix.length).trim() ?? "").replaceAll("`", "");
+}

package/src/criteria_support.ts

@@ -41,10 +41,11 @@ export function runCommand(root: string, command: string[]): Verdict {
   } catch (error) {
     return { ok: false, detail: `${command[0] ?? "command"} could not be run: ${error instanceof Error ? error.message : String(error)}` };
   }
-  if (result.exitCode === 0) return { ok: true, detail: "exit 0" };
-  const merged = `${result.stdout.toString()}\n${result.stderr.toString()}`;
-  const lines = merged.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-  return { ok: false, detail: `exit ${result.exitCode}: ${lines[lines.length - 1] ?? NO_OUTPUT}` };
+  const output = [result.stdout.toString(), result.stderr.toString()].filter(Boolean).join("\n").trim();
+  if (output) return { ok: result.exitCode === 0, detail: `exit ${result.exitCode}:\n${output}` };
+  return result.exitCode === 0
+    ? { ok: true, detail: "exit 0" }
+    : { ok: false, detail: `exit ${result.exitCode}: ${NO_OUTPUT}` };
 }
 
 export function gitOutput(root: string, command: string[]): string {

package/src/gates.test.ts

@@ -35,9 +35,9 @@ describe("gate groups", () => {
     const model = await modelFor(project);
 
     expect(names(runGate(model, project, "work"))).toEqual(["cmd.conform", "repo.config"]);
-    expect(names(runGate(model, project, "verify"))).toEqual(["cmd.verify.unit", "docs.language", "spec.dimensions"]);
+    expect(names(runGate(model, project, "verify"))).toEqual(["docs.language", "repo.config"]);
     expect(names(runGate(model, project, "pr"))).toEqual([
-      "docs.updated", "git.branch", "git.pushed", "git.tree", "spec.baseline", "spec.deferrals", "spec.dimensions",
+      "cmd.verify.unit", "docs.language", "docs.updated", "git.branch", "git.pushed", "git.tree", "repo.config", "spec.baseline", "spec.deferrals", "spec.dimensions",
       "spec.gate", "spec.moved", "spec.open-questions", "spec.ordering", "spec.product-clarity",
     ]);
   });

package/src/gates_spec.test.ts

@@ -8,6 +8,8 @@ import {
   newRepository, newSpecRepository, orly, SPEC_RELATIVE, specFixture,
 } from "./gates_test_support";
 
+const BASELINE_FIXTURE = "**Test Baseline:** unit=0 integration=0";
+
 afterEach(cleanupTemporaryDirectories);
 
 describe("spec discovery", () => {
@@ -16,7 +18,7 @@ describe("spec discovery", () => {
     const model = await modelFor(project);
     git(project, "checkout", "-q", "-b", "fix/adhoc");
 
-    const verify = runGate(model, project, "verify");
+    const verify = runGate(model, project, "pr");
     expect(verify.results.find((result) => result.name === "spec.dimensions")?.detail).toContain("no active spec");
     expect(runGate(model, project, "work").results.find((result) => result.name === "cmd.conform")?.ok).toBeTrue();
   });
@@ -122,6 +124,43 @@ describe("closed-spec follow-through", () => {
     expect(pr.results.find((result) => result.name === "spec.baseline")?.ok).toBeTrue();
   });
 
+  // CHORE(open) declares the header and the boundary fills it. The gate that
+  // grades the boundary is `pr`, so `pending` surviving to here is the
+  // measurement skipped rather than the measurement not yet due.
+  test("a Test Baseline still reading `pending` is red at the Pull Request gate", async () => {
+    const project = newRepository();
+    const model = await modelFor(project);
+    git(project, "checkout", "-q", "-b", "feat/pending-baseline");
+    mkdirSync(join(project, "docs/v1/active"), { recursive: true });
+    await Bun.write(
+      join(project, SPEC_RELATIVE),
+      specFixture("IN_PROGRESS", "feat/pending-baseline").replace(BASELINE_FIXTURE, "**Test Baseline:** pending — measured before the Pull Request"),
+    );
+    git(project, "add", ".");
+    git(project, "commit", "-q", "-m", "chore(open): the spec declares its baseline");
+
+    const baseline = runGate(model, project, "pr").results.find((result) => result.name === "spec.baseline");
+    expect(baseline?.ok).toBeFalse();
+    expect(baseline?.detail).toContain("carries no count");
+  });
+
+  test("a branch carrying no code records n/a and spec.baseline is green", async () => {
+    const project = newRepository();
+    const model = await modelFor(project);
+    git(project, "checkout", "-q", "-b", "feat/no-code-baseline");
+    mkdirSync(join(project, "docs/v1/active"), { recursive: true });
+    await Bun.write(
+      join(project, SPEC_RELATIVE),
+      specFixture("IN_PROGRESS", "feat/no-code-baseline").replace(BASELINE_FIXTURE, "**Test Baseline:** n/a — no code on this branch"),
+    );
+    git(project, "add", ".");
+    git(project, "commit", "-q", "-m", "chore(open): a docs-only stream measures nothing");
+
+    const baseline = runGate(model, project, "pr").results.find((result) => result.name === "spec.baseline");
+    expect(baseline?.ok).toBeTrue();
+    expect(baseline?.detail).toContain("not applicable");
+  });
+
   test("Status: DONE while the spec still lives under active/ is red on spec.moved", async () => {
     const project = newRepository();
     const model = await modelFor(project);

package/src/gates_test_support.ts

@@ -10,6 +10,10 @@ import { CONFIG_PATH } from "./config";
 import { RulesModel } from "./model";
 
 const GIT = "git";
+const HEAD = "HEAD";
+const REV_PARSE = "rev-parse";
+const IN_PROGRESS = "IN_PROGRESS";
+const BASELINE_EVIDENCE = "**Baseline evidence:** README.md";
 const QUIET = "-q";
 const COMMIT = "commit";
 const CONFIG = "config";
@@ -21,6 +25,7 @@ const ACCEPTANCE_RUBRIC_HEADING = "Acceptance Rubric";
 const FIXTURE = "fixture";
 const AUDITS_DIR = "audits";
 const SPEC_GATE_SCRIPT = `${AUDITS_DIR}/spec-template.sh`;
+const SPEC_GATE_CONTENT = `${AUDITS_DIR}/spec-template.ts`;
 
 export const ROOT = resolve(import.meta.dir, "..");
 export const SPEC_RELATIVE = "docs/v1/active/M99_001_P2_CLI_FIXTURE.md";
@@ -105,7 +110,10 @@ export function closedSpecRepository(branch: string, extraLines: string[] = []):
   mkdirSync(join(project, "docs/v1/done"), { recursive: true });
   mkdirSync(join(project, AUDITS_DIR), { recursive: true });
   copyFileSync(join(ROOT, SPEC_GATE_SCRIPT), join(project, SPEC_GATE_SCRIPT));
-  Bun.write(join(project, "docs/v1/done/M99_001_P2_CLI_FIXTURE.md"), specFixture("DONE", branch, extraLines));
+  copyFileSync(join(ROOT, SPEC_GATE_CONTENT), join(project, SPEC_GATE_CONTENT));
+  Bun.write(join(project, "docs/v1/done/M99_001_P2_CLI_FIXTURE.md"), specFixture("DONE", branch, [
+    `**Baseline revision:** ${gitOutput(project, REV_PARSE, HEAD)}`, BASELINE_EVIDENCE, ...extraLines,
+  ]));
   git(project, ADD, ".");
   git(project, COMMIT, QUIET, MESSAGE, "chore: close the fixture spec");
   return project;
@@ -116,7 +124,10 @@ export function newSpecRepository(): string {
   mkdirSync(join(project, "docs/v1/active"), { recursive: true });
   mkdirSync(join(project, AUDITS_DIR), { recursive: true });
   copyFileSync(join(ROOT, SPEC_GATE_SCRIPT), join(project, SPEC_GATE_SCRIPT));
-  Bun.write(join(project, SPEC_RELATIVE), specFixture());
+  copyFileSync(join(ROOT, SPEC_GATE_CONTENT), join(project, SPEC_GATE_CONTENT));
+  Bun.write(join(project, SPEC_RELATIVE), specFixture(IN_PROGRESS, undefined, [
+    `**Baseline revision:** ${gitOutput(project, REV_PARSE, HEAD)}`, BASELINE_EVIDENCE,
+  ]));
   git(project, ADD, ".");
   git(project, COMMIT, QUIET, MESSAGE, "test: add fixture spec");
   return project;
@@ -124,7 +135,7 @@ export function newSpecRepository(): string {
 
 // A spec carrying every section audits/spec-template.sh requires, with all
 // Dimensions already DONE so the gates' own criteria are what is under test.
-export function specFixture(status = "IN_PROGRESS", branch?: string, extraLines: string[] = []): string {
+export function specFixture(status = IN_PROGRESS, branch?: string, extraLines: string[] = []): string {
   const sections = [
     "PR Intent & comprehension handshake",
     "Overview",
@@ -139,6 +150,7 @@ export function specFixture(status = "IN_PROGRESS", branch?: string, extraLines:
     "Metrics & Observability",
     "Test Specification (tiered)",
     ACCEPTANCE_RUBRIC_HEADING,
+    "Dead Code Sweep",
     "Out of Scope",
     "Product Clarity (authoring record)",
     "Decomposition & alternatives",
@@ -149,7 +161,9 @@ export function specFixture(status = "IN_PROGRESS", branch?: string, extraLines:
     // Family 2b) — the fixture models a compliant spec, so its rubric carries
     // them the way a real spec's S-rows do.
     heading === ACCEPTANCE_RUBRIC_HEADING
-      ? `## ${heading}\n\n| S1 | Conform gates green | \`${TRUE_COMMAND}\` | exit 0 | P0 | |\n| S2 | Unit tests pass | \`${TRUE_COMMAND}\` | exit 0 | P0 | |\n`
+      ? `## ${heading}\n\n| # | Criterion | Verify | Expected | Priority | Graded |\n|---|---|---|---|---|---|\n| S1 | Declared checks | \`${TRUE_COMMAND}\` | exit 0 | P0 | |\n`
+      : heading.startsWith("Implementing agent") ? `## ${heading}\n\n1. \`README.md\` — fixture reference.\n`
+      : heading.startsWith("Test Specification") ? `## ${heading}\n\n| Dimension | Tier | Test | Asserts |\n|---|---|---|---|\n| 1.1 | unit | \`fixture_test\` | Valid input is accepted. |\n`
       : `## ${heading}\n\nFixture content for ${heading}.\n`,
   );
   return [