@agentsfleet/orly 0.11.0 → 0.12.1

package/README.md

@@ -42,22 +42,29 @@ Works with Claude Code, Codex, OpenCode, and Amp.
 
 ---
 
-## 0.11.0 experiment: explicit Jev advice
+## 0.12: migration verification
 
-The Bun command line adds `orly judge` for selected planning, test, review and
-documentation questions.
+0.12.0 shipped migration verification and setup guidance. The `.orly/` layout
+and six existing `orly judge` questions originally shipped in 0.11.0.
+This release focuses on package verification, migration evidence and clearer setup guidance; it adds no new runtime judgment question.
 
-- **Judgments** — selected evidence produces a fixed next action; existing checks retain control of gate results.
-- **Installation** — `bunx` runs the source package through Bun, continuing the `0.10.x` setup on macOS and Linux.
+The `agentsfleet` trial upgraded a dedicated worktree from 0.10.14 using the packed candidate.
+Owner files, hooks and verification commands survived; a second update wrote nothing.
+See the [release report](evals/release/release-report.md) for exact proof and remaining release checks.
 
-Use `orly judge --help` and the [judgment reference](docs/JUDGMENTS.md) for the
-manifest, atomic criteria and explicit source upload. This page describes the
-0.11.0 source package, which is not yet published. The commands below fetch the
-published package; use them for this behavior after 0.11.0 is published.
+Jev, TypeSafe's bounded judgment model, supplies advice only when requested.
+Existing deterministic checks retain control of gate results.
+The comparison evaluator is parked for proposed 0.13 work; model accuracy and candidate benefits remain unmeasured.
+See the [judgment reference](docs/JUDGMENTS.md) for evidence selection, offline replay and explicit source upload.
+
+0.12.1 avoids copying repository files for staged audits with no matching files
+and makes hosted-check monitoring show job states and links before reporting a failure.
+See [releases](https://github.com/agentsfleet/orly/releases) for published versions.
+The install commands below fetch the published package.
 
 ---
 
-## Prerequisites for 0.11.0
+## Prerequisites
 
 | You need | Why | Version |
 |---|---|---|
@@ -71,7 +78,7 @@ published package; use them for this behavior after 0.11.0 is published.
 
 ---
 
-## Install 0.11.0 after publication
+## Install the published package
 
 Run this inside the repository you want governed.
 
@@ -120,6 +127,32 @@ Unknown settings and malformed values are refused; `schemas/profile.schema.json`
 
 ---
 
+## Upgrade from 0.10.x
+
+Run the update from the consumer repository. If the repository owns its hooks, preserve them explicitly:
+
+```bash
+bunx --bun @agentsfleet/orly update --no-hooks
+```
+
+Expected: managed files move under `.orly/`; owner hooks remain unchanged. Conflicting owner edits stop the update and name the affected path.
+Use the installed candidate executable for an unpublished release trial; the command above fetches the published version.
+
+Update repository-owned callers that still read `.oracle/orly.json`, root `dispatch/`, or managed root audit paths.
+Their replacements are `.orly/orly.json`, `.orly/dispatch/`, and `.orly/audits/`.
+Repository-owned audit scripts and project documents retain their existing locations.
+Review existing hooks before choosing an update without `--no-hooks`.
+
+```bash
+bunx --bun @agentsfleet/orly doctor
+```
+
+Expected: installed rules match `.orly/orly.json` and work and verification commands are declared.
+Then run the repository's declared checks; `doctor` alone does not run them.
+An empty old directory can remain after its files move. Git does not track empty directories; remove one only after checking it is empty.
+
+---
+
 ## What lands in your repository
 
 ```text

package/audits/deinit-pairs.sh

@@ -48,7 +48,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.zig'
 
 MODE="${1:-${SCOPE:-all}}"
 ROOT="$(git rev-parse --show-toplevel)"

package/audits/design-tokens.sh

@@ -39,7 +39,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.tsx' '*.jsx' 'ui/packages/app/*' 'ui/packages/website/*' 'ui/packages/design-system/*'
 
 MODE="$AUDIT_MODE"
 ROOT="$(git rev-parse --show-toplevel)"

package/audits/error-codes.sh

@@ -51,7 +51,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot
 
 MODE="$AUDIT_MODE"
 ROOT="$(git rev-parse --show-toplevel)"

package/audits/logging.sh

@@ -43,7 +43,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.zig' '*.rs' 'agentsfleet/src/*.js' 'agentsfleet/src/*.jsx' 'agentsfleet/src/*.ts' 'agentsfleet/src/*.tsx'
 
 MODE="--all"
 STRICT=0

package/audits/rust-error.sh

@@ -44,7 +44,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.rs'
 
 MODE_STAGED="--staged"
 MODE_ALL="--all"

package/audits/scope.sh

@@ -37,7 +37,7 @@ audit_scope_init() {
 # the index copy and checked-out files belong to this invocation alone.
 audit_index_snapshot() {
   [ "$AUDIT_MODE" = --staged ] || return 0
-  local gitdir index
+  local gitdir index changed=0
   AUDIT_SNAPSHOT_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/orly-index.XXXXXX")" || return 1
   trap 'rm -rf -- "$AUDIT_SNAPSHOT_ROOT"' EXIT
   trap 'exit 130' INT
@@ -46,6 +46,14 @@ audit_index_snapshot() {
   index="$(git rev-parse --git-path index)" || exit 1
   cp "$index" "$AUDIT_SNAPSHOT_ROOT/index" || exit 1
   export GIT_DIR="$gitdir" GIT_INDEX_FILE="$AUDIT_SNAPSHOT_ROOT/index" GIT_OPTIONAL_LOCKS=0
+  if [ "$#" -gt 0 ]; then
+    git diff --cached --quiet --diff-filter=ACMRT -- "$@" || changed=$?
+    case "$changed" in
+      0) return 0 ;;
+      1) ;;
+      *) printf 'cannot select staged audit files (git exit %s)\n' "$changed" >&2; exit 2 ;;
+    esac
+  fi
   export GIT_WORK_TREE="$AUDIT_SNAPSHOT_ROOT/tree"
   mkdir "$GIT_WORK_TREE" || exit 1
   git checkout-index --all --prefix="$GIT_WORK_TREE/" || exit 1

package/audits/sql-mod.sh

@@ -25,7 +25,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.zig'
 
 MODE="${1:-${SCOPE:---all}}"
 ROOT="$(git rev-parse --show-toplevel)"

package/audits/ufs.sh

@@ -55,7 +55,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.zig' '*.ts' '*.tsx' '*.js' '*.jsx' '*.rs' '*.go'
 
 # Default: full-codebase scan (`--all` is an explicit alias). `--staged` is the
 # pre-commit lens — it narrows the per-file checks to `git diff --cached`. The

package/dispatch/lib.sh

@@ -125,7 +125,7 @@ dispatch_managed_paths() {
 dispatch_resolve_files() {
   DISPATCH_FILES=()
   audit_scope_init --all "$@"
-  audit_index_snapshot "$@"
+  audit_index_snapshot
   DISPATCH_STAGED=0
   if [ "${1:-}" = "--staged" ]; then
     DISPATCH_STAGED=1

package/docs/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+## 0.12.1
+
+Staged audits avoid copying repository files when their filename scope is empty.
+
+- **Audit preflight** — selects filenames from a copied index before materialising repository files; relevant audits retain coherent staged reads.
+- **Check diagnostics** — prints hosted job or pipeline states and links before reporting pending or failed checks.
+- **Release status** — corrects documentation that still described published 0.12.0 as an unpublished candidate.
+
+## 0.12.0 — 2026-10-07
+
+Setup guidance now distinguishes the published package from the local release candidate.
+
+- **Migration guidance** — names `.orly/` destinations and explains preserving repository-owned hooks with `--no-hooks`.
+- **Release scope** — retains the six existing judgment questions and records the comparison evaluator as parked for proposed 0.13 work.
+
+The `.orly/` layout and judgment commands already shipped in 0.11.0; this entry claims no new runtime behavior.

package/docs/JUDGMENTS.md

@@ -1,8 +1,8 @@
 ---
 type: reference
 audience: contributor
-verified: 2026-10-04
-product_version: 0.11.0
+verified: 2026-10-07
+product_version: 0.12.0
 executable: false
 ---
 
@@ -10,6 +10,9 @@ executable: false
 
 ## Synopsis
 
+The 0.12.0 candidate retains the six questions shipped in 0.11.0.
+The comparison evaluator is parked for proposed 0.13 work; this release makes no new model-quality claim.
+
 `orly judge` asks one bounded question about evidence you select.
 It accompanies planning, verification, review and documentation.
 Its answer suggests an inspection or a fixed next action.

package/docs/ORLY_ARCHITECTURE.md

@@ -84,6 +84,13 @@ Every criterion is mechanical — it reads an exit code or a file. Claims that
 cannot be proven that way stay prose and are graded by the spec's rubric; they
 never become fake criteria.
 
+Filename-scoped staged audits copy Git's index before selecting relevant paths.
+An empty selection skips the repository checkout; matching paths still trigger
+a private checkout, dependency reads and indexed-link checks. Each audit owns
+its temporary files and cleanup. Audits with unconditional registry checks
+retain a complete checkout. Separate relevant audits retain separate snapshots;
+this optimization does not introduce a shared snapshot cache.
+
 Four behaviours worth knowing:
 
 - **No spec, no problem — but closing is not escaping.** Spec criteria skip

package/llms.txt

@@ -12,9 +12,13 @@ Package: `@agentsfleet/orly` (npm)
 Source: https://github.com/agentsfleet/orly
 License: Massachusetts Institute of Technology (MIT)
 
-This guide describes the unpublished 0.11.0 source package. The `bunx` commands
-below fetch the published package, not this source checkout. Use this install
-sequence for the described behavior after 0.11.0 is published.
+0.12.0 shipped migration verification; the runtime commands and `.orly/` layout
+originally shipped in 0.11.0. The 0.12.1 patch avoids irrelevant staged audit
+snapshots and preserves hosted-check diagnostics. The `bunx` commands below
+fetch the published package; available versions are listed at
+https://github.com/agentsfleet/orly/releases. Use an installed local tarball for candidate checks.
+The comparison evaluator is parked for proposed 0.13 work; do not claim measured
+judgment improvement or enable new questions from its unfinished results.
 
 ---
 
@@ -79,6 +83,13 @@ suites. `init` reports missing configuration; `doctor` rejects it.
 
 ---
 
+For a 0.10.x consumer with repository-owned hooks, run `orly update --no-hooks`
+using the intended installed version. Change repository callers from
+`.oracle/orly.json` to `.orly/orly.json` and shared rule/audit paths to `.orly/`.
+Keep repository-owned scripts and documents in place. Run `orly doctor` and the
+declared checks before accepting the migration; doctor alone does not run checks.
+Empty old directories may remain, but contain no tracked managed files.
+
 ## 4. Read order before you edit anything
 
 1. `AGENTS.md` — the user's own rules. **These win on any conflict.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/skills/orly-babysit-prs/SKILL.md

@@ -93,8 +93,17 @@ Each cycle, after the review-thread walk, poll CI and act by cause:
 
 ```bash
 set -euo pipefail
-CHECKS=$(gh pr checks "$PR_NUMBER" --json name,state,bucket,link) \
-  || { echo "BABYSIT: check fetch incomplete; reset quiet polls" >&2; exit 1; }
+CHECK_STATUS=0
+CHECKS=$(gh pr checks "$PR_NUMBER" --json name,state,bucket,link) || CHECK_STATUS=$?
+printf '%s' "$CHECKS" | jq -e 'type == "array" and length > 0 and all(.[];
+  (.name | type == "string") and (.state | type == "string") and
+  (.link | type == "string") and (.bucket | IN("pass", "fail", "pending", "skipping", "cancel")))' >/dev/null \
+  || { printf 'BABYSIT: invalid check response (exit %s); reset quiet polls\n%s\n' "$CHECK_STATUS" "$CHECKS" >&2; exit 1; }
+printf '%s' "$CHECKS" | jq -r '.[] | "\(.name) | \(.state) | \(.bucket) | \(.link)"'
+case "$CHECK_STATUS" in
+  0|1|8) ;; # GitHub reports failed and pending checks with nonzero statuses.
+  *) printf 'BABYSIT: check fetch incomplete (exit %s); reset quiet polls\n' "$CHECK_STATUS" >&2; exit 1 ;;
+esac
 printf '%s' "$CHECKS" | jq -e 'type == "array" and length > 0 and all(.[]; .bucket == "pass" or .bucket == "skipping")' >/dev/null \
   || { echo "BABYSIT: checks empty or not green; reset quiet polls" >&2; exit 1; }
 CHECK_HEAD=$(gh pr view "$PR_NUMBER" --json headRefOid --jq '.headRefOid')
@@ -107,8 +116,14 @@ echo "BABYSIT: ci=green revision=$CHECK_HEAD"
 
 ```bash
 set -euo pipefail
-PIPELINES=$(glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/pipelines" --paginate | jq -sc 'add') \
-  || { echo "BABYSIT: pipeline fetch incomplete; reset quiet polls" >&2; exit 1; }
+PIPELINE_STATUS=0
+PIPELINES=$(glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/pipelines" --paginate | jq -sc 'add') || PIPELINE_STATUS=$?
+printf '%s' "$PIPELINES" | jq -e 'type == "array" and length > 0 and all(.[];
+  (.id | type == "number") and (.sha | type == "string") and (.status | type == "string"))' >/dev/null \
+  || { printf 'BABYSIT: invalid pipeline response (exit %s); reset quiet polls\n%s\n' "$PIPELINE_STATUS" "$PIPELINES" >&2; exit 1; }
+printf '%s' "$PIPELINES" | jq -r '.[] | "pipeline \(.id) | \(.status) | \(.web_url // "URL not reported")"'
+[ "$PIPELINE_STATUS" -eq 0 ] \
+  || { printf 'BABYSIT: pipeline fetch incomplete (exit %s); reset quiet polls\n' "$PIPELINE_STATUS" >&2; exit 1; }
 printf '%s' "$PIPELINES" | jq -e --arg revision "$POLL_HEAD" \
   '[.[] | select(.sha == $revision)] | sort_by(.id) | last | .status == "success"' >/dev/null \
   || { echo "BABYSIT: current revision has no successful pipeline; reset quiet polls" >&2; exit 1; }

package/src/review_poll.test.ts

@@ -30,7 +30,11 @@ else if(args[0]==="pr" && args[1]==="view") {
   else { const prior=(await Bun.file(process.env.POLL_CALLS).text()).split("\\n").filter(x=>x.includes("headRefOid")).length; console.log((process.env.POLL_MODE==="changed" && prior>1) || (process.env.POLL_MODE==="changed-check" && prior>2) ? "changed-revision" : process.env.POLL_HEAD); }
 } else if(args[0]==="pr" && args[1]==="checks") {
   if(process.env.POLL_STATE==="fetch-failed"){console.error("temporary fetch refusal");process.exit(2);}
-  console.log(JSON.stringify(process.env.POLL_STATE==="empty" ? [] : [{name:"tests",state:"SUCCESS",bucket:process.env.POLL_STATE==="failed" ? "fail" : "pass",link:"https://example.invalid/check"}]));
+  const state=process.env.POLL_STATE;
+  const bucket=state==="failed" ? "fail" : state==="pending" ? "pending" : "pass";
+  console.log(JSON.stringify(state==="empty" ? [] : state==="malformed-check" ? [{name:"tests"}] : [{name:"tests",state:bucket==="pass" ? "SUCCESS" : bucket==="fail" ? "FAILURE" : "IN_PROGRESS",bucket,link:"https://example.invalid/check"}]));
+  if(state==="failed") process.exit(1);
+  if(state==="pending") process.exit(8);
 } else if(args[0]==="api") {
   if(process.env.POLL_MODE==="fetch-failed" && args[1].includes("/issues/")){console.error("temporary summary refusal");process.exit(2);}
   const revision=process.env.POLL_MODE==="stale" ? "old-revision" : process.env.POLL_HEAD;
@@ -75,7 +79,7 @@ for (const mode of ["fetch-failed", "malformed", "changed", "changed-check", "st
   });
 }
 
-for (const state of ["empty", "fetch-failed", "failed"]) {
+for (const state of ["empty", "fetch-failed", "failed", "pending", "malformed-check"]) {
   test(`${state} check discovery stays incomplete`, () => {
     const result = poll("complete", state);
     expect(result.code).not.toBe(0);
@@ -84,6 +88,17 @@ for (const state of ["empty", "fetch-failed", "failed"]) {
   });
 }
 
+for (const state of ["failed", "pending"]) {
+  test(`${state} GitHub checks retain job details despite nonzero status`, () => {
+    const result = poll("complete", state);
+    expect(result.code).not.toBe(0);
+    expect(result.output).toContain("tests |");
+    expect(result.output).toContain("https://example.invalid/check");
+    expect(result.output).toContain(state === "failed" ? "FAILURE | fail" : "IN_PROGRESS | pending");
+    expect(result.output).not.toContain("check fetch incomplete");
+  });
+}
+
 function gitlabPoll(mode = "complete", state = "green") {
   const root = newRepository();
   const tools = join(root, "tools");
@@ -105,7 +120,7 @@ else if(args[0]==="mr") {
   if(process.env.POLL_MODE==="fetch-failed" && endpoint.endsWith("/notes")){console.error("temporary summary refusal");process.exit(2);}
   if(endpoint.endsWith("/pipelines")) {
     if(process.env.POLL_STATE==="fetch-failed"){console.error("temporary pipeline refusal");process.exit(2);}
-    console.log(JSON.stringify(process.env.POLL_STATE==="empty" ? [] : [{id:3,sha:process.env.POLL_HEAD,status:process.env.POLL_STATE==="failed" ? "failed" : "success"}]));
+    console.log(JSON.stringify(process.env.POLL_STATE==="empty" ? [] : [{id:3,sha:process.env.POLL_HEAD,status:process.env.POLL_STATE==="failed" ? "failed" : process.env.POLL_STATE==="pending" ? "running" : "success",web_url:"https://example.invalid/pipeline"}]));
   } else if(process.env.POLL_MODE==="malformed") console.log(JSON.stringify({message:"not review evidence"}));
   else {
     const note=id=>({id,author:{username:"greptile"},body:id===1 ? "first-page finding" : "second-page finding",type:null});
@@ -148,7 +163,7 @@ for (const mode of ["fetch-failed", "malformed", "changed", "changed-check"]) {
   });
 }
 
-for (const state of ["empty", "fetch-failed", "failed"]) {
+for (const state of ["empty", "fetch-failed", "failed", "pending"]) {
   test(`GitLab ${state} pipeline discovery stays incomplete`, () => {
     const result = gitlabPoll("complete", state);
     expect(result.code).not.toBe(0);
@@ -156,3 +171,12 @@ for (const state of ["empty", "fetch-failed", "failed"]) {
     expect(result.output).not.toContain("ci=green");
   });
 }
+
+for (const state of ["failed", "pending"]) {
+  test(`GitLab ${state} pipeline retains its state and link`, () => {
+    const result = gitlabPoll("complete", state);
+    expect(result.code).not.toBe(0);
+    expect(result.output).toContain(`pipeline 3 | ${state === "failed" ? "failed" : "running"}`);
+    expect(result.output).toContain("https://example.invalid/pipeline");
+  });
+}

package/src/scanner_snapshot.test.ts

@@ -0,0 +1,82 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdirSync, readdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { cleanupTemporaryDirectories, git, newRepository, ROOT, temporaryDirectory } from "./gates_test_support";
+import { UNSCOPED_ENVIRONMENT } from "./git_env";
+
+const SCOPED_AUDITS = ["ufs.sh", "logging.sh", "rust-error.sh", "deinit-pairs.sh", "sql-mod.sh", "design-tokens.sh"];
+const SOURCE = "lib/odd 'quoted.ts";
+const CLEAN = "export const MESSAGE = 'staged';\n";
+const BAD = 'export function first() { return "duplicate value"; }\nexport function second() { return "duplicate value"; }\n';
+const CHECKOUT = "checkout-index";
+const TIMEOUT_MS = 30_000;
+const TOOL_MODE = 0o755;
+
+afterEach(cleanupTemporaryDirectories);
+
+async function runScan(project: string, leaf: string, failPreflight = false) {
+  const tools = temporaryDirectory();
+  const scratch = temporaryDirectory();
+  const calls = join(tools, "calls.jsonl");
+  const realGit = Bun.which("git")!;
+  mkdirSync(join(tools, "bin"));
+  writeFileSync(join(tools, "bin/git"), `#!${process.execPath}
+const args = Bun.argv.slice(2);
+const file = Bun.file(process.env.SNAPSHOT_CALLS);
+await Bun.write(file, (await file.exists() ? await file.text() : "") + JSON.stringify(args) + "\\n");
+if (process.env.FAIL_PREFLIGHT === "1" && args.includes("--quiet")) process.exit(2);
+const result = Bun.spawnSync([process.env.REAL_GIT, ...args], { stdin: "inherit", stdout: "inherit", stderr: "inherit" });
+process.exit(result.exitCode);
+`, { mode: TOOL_MODE });
+  const result = Bun.spawnSync(["/bin/bash", join(ROOT, "audits", leaf), "--staged"], {
+    cwd: project, env: { ...UNSCOPED_ENVIRONMENT, PATH: `${join(tools, "bin")}:${process.env.PATH}`, TMPDIR: scratch,
+      SNAPSHOT_CALLS: calls, REAL_GIT: realGit, FAIL_PREFLIGHT: failPreflight ? "1" : "0" },
+    stdout: "pipe", stderr: "pipe", timeout: TIMEOUT_MS,
+  });
+  const commands: string[][] = (await Bun.file(calls).text()).trim().split("\n").map((line) => JSON.parse(line));
+  return { code: result.exitCode, output: result.stdout.toString() + result.stderr.toString(),
+    checkouts: commands.filter((args) => args[0] === CHECKOUT).length, leftovers: readdirSync(scratch) };
+}
+
+test.each(SCOPED_AUDITS)("%s skips repository checkout for a documentation-only index", async (leaf) => {
+  const project = newRepository();
+  await Bun.write(join(project, "README.md"), "Changed documentation.\n");
+  git(project, "add", "README.md");
+  const result = await runScan(project, leaf);
+  expect(result.code, result.output).toBe(0);
+  expect(result.checkouts).toBe(0);
+  expect(result.leftovers).toEqual([]);
+});
+
+test.each([true, false])("relevant source snapshot checks staged bytes with violation %s", async (badIndex) => {
+  const project = newRepository();
+  await Bun.write(join(project, SOURCE), badIndex ? BAD : CLEAN);
+  git(project, "add", SOURCE);
+  await Bun.write(join(project, SOURCE), badIndex ? CLEAN : BAD);
+  const result = await runScan(project, "ufs.sh");
+  expect(result.code, result.output).toBe(badIndex ? 1 : 0);
+  expect(result.checkouts).toBe(1);
+  expect(result.leftovers).toEqual([]);
+});
+
+test("a failed staged filename query refuses instead of reporting an empty scope", async () => {
+  const project = newRepository();
+  const result = await runScan(project, "ufs.sh", true);
+  expect(result.code).toBe(2);
+  expect(result.output).toContain("cannot select staged audit files");
+  expect(result.checkouts).toBe(0);
+  expect(result.leftovers).toEqual([]);
+});
+
+test("a deleted source path needs no repository checkout", async () => {
+  const project = newRepository();
+  await Bun.write(join(project, SOURCE), CLEAN);
+  git(project, "add", SOURCE);
+  git(project, "commit", "-qm", "test: seed source");
+  git(project, "rm", SOURCE);
+  const result = await runScan(project, "ufs.sh");
+  expect(result.code, result.output).toBe(0);
+  expect(result.checkouts).toBe(0);
+  expect(result.leftovers).toEqual([]);
+});