@agentsfleet/orly 0.12.0 → 0.12.1

package/README.md

@@ -42,10 +42,10 @@ Works with Claude Code, Codex, OpenCode, and Amp.
 
 ---
 
-## 0.12.0: migration verification
+## 0.12: migration verification
 
-0.12.0 is a local release candidate. Published 0.11.0 already provides the
-`.orly/` layout and the six existing `orly judge` questions.
+0.12.0 shipped migration verification and setup guidance. The `.orly/` layout
+and six existing `orly judge` questions originally shipped in 0.11.0.
 This release focuses on package verification, migration evidence and clearer setup guidance; it adds no new runtime judgment question.
 
 The `agentsfleet` trial upgraded a dedicated worktree from 0.10.14 using the packed candidate.
@@ -57,7 +57,10 @@ Existing deterministic checks retain control of gate results.
 The comparison evaluator is parked for proposed 0.13 work; model accuracy and candidate benefits remain unmeasured.
 See the [judgment reference](docs/JUDGMENTS.md) for evidence selection, offline replay and explicit source upload.
 
-The install commands below fetch the published package. They do not select this unpublished candidate.
+0.12.1 avoids copying repository files for staged audits with no matching files
+and makes hosted-check monitoring show job states and links before reporting a failure.
+See [releases](https://github.com/agentsfleet/orly/releases) for published versions.
+The install commands below fetch the published package.
 
 ---
 

package/audits/deinit-pairs.sh

@@ -48,7 +48,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.zig'
 
 MODE="${1:-${SCOPE:-all}}"
 ROOT="$(git rev-parse --show-toplevel)"

package/audits/design-tokens.sh

@@ -39,7 +39,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.tsx' '*.jsx' 'ui/packages/app/*' 'ui/packages/website/*' 'ui/packages/design-system/*'
 
 MODE="$AUDIT_MODE"
 ROOT="$(git rev-parse --show-toplevel)"

package/audits/error-codes.sh

@@ -51,7 +51,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot
 
 MODE="$AUDIT_MODE"
 ROOT="$(git rev-parse --show-toplevel)"

package/audits/logging.sh

@@ -43,7 +43,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.zig' '*.rs' 'agentsfleet/src/*.js' 'agentsfleet/src/*.jsx' 'agentsfleet/src/*.ts' 'agentsfleet/src/*.tsx'
 
 MODE="--all"
 STRICT=0

package/audits/rust-error.sh

@@ -44,7 +44,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.rs'
 
 MODE_STAGED="--staged"
 MODE_ALL="--all"

package/audits/scope.sh

@@ -37,7 +37,7 @@ audit_scope_init() {
 # the index copy and checked-out files belong to this invocation alone.
 audit_index_snapshot() {
   [ "$AUDIT_MODE" = --staged ] || return 0
-  local gitdir index
+  local gitdir index changed=0
   AUDIT_SNAPSHOT_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/orly-index.XXXXXX")" || return 1
   trap 'rm -rf -- "$AUDIT_SNAPSHOT_ROOT"' EXIT
   trap 'exit 130' INT
@@ -46,6 +46,14 @@ audit_index_snapshot() {
   index="$(git rev-parse --git-path index)" || exit 1
   cp "$index" "$AUDIT_SNAPSHOT_ROOT/index" || exit 1
   export GIT_DIR="$gitdir" GIT_INDEX_FILE="$AUDIT_SNAPSHOT_ROOT/index" GIT_OPTIONAL_LOCKS=0
+  if [ "$#" -gt 0 ]; then
+    git diff --cached --quiet --diff-filter=ACMRT -- "$@" || changed=$?
+    case "$changed" in
+      0) return 0 ;;
+      1) ;;
+      *) printf 'cannot select staged audit files (git exit %s)\n' "$changed" >&2; exit 2 ;;
+    esac
+  fi
   export GIT_WORK_TREE="$AUDIT_SNAPSHOT_ROOT/tree"
   mkdir "$GIT_WORK_TREE" || exit 1
   git checkout-index --all --prefix="$GIT_WORK_TREE/" || exit 1

package/audits/sql-mod.sh

@@ -25,7 +25,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.zig'
 
 MODE="${1:-${SCOPE:---all}}"
 ROOT="$(git rev-parse --show-toplevel)"

package/audits/ufs.sh

@@ -55,7 +55,7 @@ set -euo pipefail
 
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scope.sh"
 audit_scope_init --all "$@"
-audit_index_snapshot "$@"
+audit_index_snapshot '*.zig' '*.ts' '*.tsx' '*.js' '*.jsx' '*.rs' '*.go'
 
 # Default: full-codebase scan (`--all` is an explicit alias). `--staged` is the
 # pre-commit lens — it narrows the per-file checks to `git diff --cached`. The

package/dispatch/lib.sh

@@ -125,7 +125,7 @@ dispatch_managed_paths() {
 dispatch_resolve_files() {
   DISPATCH_FILES=()
   audit_scope_init --all "$@"
-  audit_index_snapshot "$@"
+  audit_index_snapshot
   DISPATCH_STAGED=0
   if [ "${1:-}" = "--staged" ]; then
     DISPATCH_STAGED=1

package/docs/CHANGELOG.md

@@ -1,6 +1,14 @@
 # Changelog
 
-## 0.12.0 — unreleased
+## 0.12.1
+
+Staged audits avoid copying repository files when their filename scope is empty.
+
+- **Audit preflight** — selects filenames from a copied index before materialising repository files; relevant audits retain coherent staged reads.
+- **Check diagnostics** — prints hosted job or pipeline states and links before reporting pending or failed checks.
+- **Release status** — corrects documentation that still described published 0.12.0 as an unpublished candidate.
+
+## 0.12.0 — 2026-10-07
 
 Setup guidance now distinguishes the published package from the local release candidate.
 

package/docs/ORLY_ARCHITECTURE.md

@@ -84,6 +84,13 @@ Every criterion is mechanical — it reads an exit code or a file. Claims that
 cannot be proven that way stay prose and are graded by the spec's rubric; they
 never become fake criteria.
 
+Filename-scoped staged audits copy Git's index before selecting relevant paths.
+An empty selection skips the repository checkout; matching paths still trigger
+a private checkout, dependency reads and indexed-link checks. Each audit owns
+its temporary files and cleanup. Audits with unconditional registry checks
+retain a complete checkout. Separate relevant audits retain separate snapshots;
+this optimization does not introduce a shared snapshot cache.
+
 Four behaviours worth knowing:
 
 - **No spec, no problem — but closing is not escaping.** Spec criteria skip

package/llms.txt

@@ -12,9 +12,11 @@ Package: `@agentsfleet/orly` (npm)
 Source: https://github.com/agentsfleet/orly
 License: Massachusetts Institute of Technology (MIT)
 
-This checkout prepares the unpublished 0.12.0 candidate. Published 0.11.0 already
-contains the same runtime commands and `.orly/` layout. The `bunx` commands below
-fetch the published package. Use the installed local tarball for candidate checks.
+0.12.0 shipped migration verification; the runtime commands and `.orly/` layout
+originally shipped in 0.11.0. The 0.12.1 patch avoids irrelevant staged audit
+snapshots and preserves hosted-check diagnostics. The `bunx` commands below
+fetch the published package; available versions are listed at
+https://github.com/agentsfleet/orly/releases. Use an installed local tarball for candidate checks.
 The comparison evaluator is parked for proposed 0.13 work; do not claim measured
 judgment improvement or enable new questions from its unfinished results.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/skills/orly-babysit-prs/SKILL.md

@@ -93,8 +93,17 @@ Each cycle, after the review-thread walk, poll CI and act by cause:
 
 ```bash
 set -euo pipefail
-CHECKS=$(gh pr checks "$PR_NUMBER" --json name,state,bucket,link) \
-  || { echo "BABYSIT: check fetch incomplete; reset quiet polls" >&2; exit 1; }
+CHECK_STATUS=0
+CHECKS=$(gh pr checks "$PR_NUMBER" --json name,state,bucket,link) || CHECK_STATUS=$?
+printf '%s' "$CHECKS" | jq -e 'type == "array" and length > 0 and all(.[];
+  (.name | type == "string") and (.state | type == "string") and
+  (.link | type == "string") and (.bucket | IN("pass", "fail", "pending", "skipping", "cancel")))' >/dev/null \
+  || { printf 'BABYSIT: invalid check response (exit %s); reset quiet polls\n%s\n' "$CHECK_STATUS" "$CHECKS" >&2; exit 1; }
+printf '%s' "$CHECKS" | jq -r '.[] | "\(.name) | \(.state) | \(.bucket) | \(.link)"'
+case "$CHECK_STATUS" in
+  0|1|8) ;; # GitHub reports failed and pending checks with nonzero statuses.
+  *) printf 'BABYSIT: check fetch incomplete (exit %s); reset quiet polls\n' "$CHECK_STATUS" >&2; exit 1 ;;
+esac
 printf '%s' "$CHECKS" | jq -e 'type == "array" and length > 0 and all(.[]; .bucket == "pass" or .bucket == "skipping")' >/dev/null \
   || { echo "BABYSIT: checks empty or not green; reset quiet polls" >&2; exit 1; }
 CHECK_HEAD=$(gh pr view "$PR_NUMBER" --json headRefOid --jq '.headRefOid')
@@ -107,8 +116,14 @@ echo "BABYSIT: ci=green revision=$CHECK_HEAD"
 
 ```bash
 set -euo pipefail
-PIPELINES=$(glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/pipelines" --paginate | jq -sc 'add') \
-  || { echo "BABYSIT: pipeline fetch incomplete; reset quiet polls" >&2; exit 1; }
+PIPELINE_STATUS=0
+PIPELINES=$(glab api "projects/$PROJ_ENC/merge_requests/$MR_IID/pipelines" --paginate | jq -sc 'add') || PIPELINE_STATUS=$?
+printf '%s' "$PIPELINES" | jq -e 'type == "array" and length > 0 and all(.[];
+  (.id | type == "number") and (.sha | type == "string") and (.status | type == "string"))' >/dev/null \
+  || { printf 'BABYSIT: invalid pipeline response (exit %s); reset quiet polls\n%s\n' "$PIPELINE_STATUS" "$PIPELINES" >&2; exit 1; }
+printf '%s' "$PIPELINES" | jq -r '.[] | "pipeline \(.id) | \(.status) | \(.web_url // "URL not reported")"'
+[ "$PIPELINE_STATUS" -eq 0 ] \
+  || { printf 'BABYSIT: pipeline fetch incomplete (exit %s); reset quiet polls\n' "$PIPELINE_STATUS" >&2; exit 1; }
 printf '%s' "$PIPELINES" | jq -e --arg revision "$POLL_HEAD" \
   '[.[] | select(.sha == $revision)] | sort_by(.id) | last | .status == "success"' >/dev/null \
   || { echo "BABYSIT: current revision has no successful pipeline; reset quiet polls" >&2; exit 1; }

package/src/review_poll.test.ts

@@ -30,7 +30,11 @@ else if(args[0]==="pr" && args[1]==="view") {
   else { const prior=(await Bun.file(process.env.POLL_CALLS).text()).split("\\n").filter(x=>x.includes("headRefOid")).length; console.log((process.env.POLL_MODE==="changed" && prior>1) || (process.env.POLL_MODE==="changed-check" && prior>2) ? "changed-revision" : process.env.POLL_HEAD); }
 } else if(args[0]==="pr" && args[1]==="checks") {
   if(process.env.POLL_STATE==="fetch-failed"){console.error("temporary fetch refusal");process.exit(2);}
-  console.log(JSON.stringify(process.env.POLL_STATE==="empty" ? [] : [{name:"tests",state:"SUCCESS",bucket:process.env.POLL_STATE==="failed" ? "fail" : "pass",link:"https://example.invalid/check"}]));
+  const state=process.env.POLL_STATE;
+  const bucket=state==="failed" ? "fail" : state==="pending" ? "pending" : "pass";
+  console.log(JSON.stringify(state==="empty" ? [] : state==="malformed-check" ? [{name:"tests"}] : [{name:"tests",state:bucket==="pass" ? "SUCCESS" : bucket==="fail" ? "FAILURE" : "IN_PROGRESS",bucket,link:"https://example.invalid/check"}]));
+  if(state==="failed") process.exit(1);
+  if(state==="pending") process.exit(8);
 } else if(args[0]==="api") {
   if(process.env.POLL_MODE==="fetch-failed" && args[1].includes("/issues/")){console.error("temporary summary refusal");process.exit(2);}
   const revision=process.env.POLL_MODE==="stale" ? "old-revision" : process.env.POLL_HEAD;
@@ -75,7 +79,7 @@ for (const mode of ["fetch-failed", "malformed", "changed", "changed-check", "st
   });
 }
 
-for (const state of ["empty", "fetch-failed", "failed"]) {
+for (const state of ["empty", "fetch-failed", "failed", "pending", "malformed-check"]) {
   test(`${state} check discovery stays incomplete`, () => {
     const result = poll("complete", state);
     expect(result.code).not.toBe(0);
@@ -84,6 +88,17 @@ for (const state of ["empty", "fetch-failed", "failed"]) {
   });
 }
 
+for (const state of ["failed", "pending"]) {
+  test(`${state} GitHub checks retain job details despite nonzero status`, () => {
+    const result = poll("complete", state);
+    expect(result.code).not.toBe(0);
+    expect(result.output).toContain("tests |");
+    expect(result.output).toContain("https://example.invalid/check");
+    expect(result.output).toContain(state === "failed" ? "FAILURE | fail" : "IN_PROGRESS | pending");
+    expect(result.output).not.toContain("check fetch incomplete");
+  });
+}
+
 function gitlabPoll(mode = "complete", state = "green") {
   const root = newRepository();
   const tools = join(root, "tools");
@@ -105,7 +120,7 @@ else if(args[0]==="mr") {
   if(process.env.POLL_MODE==="fetch-failed" && endpoint.endsWith("/notes")){console.error("temporary summary refusal");process.exit(2);}
   if(endpoint.endsWith("/pipelines")) {
     if(process.env.POLL_STATE==="fetch-failed"){console.error("temporary pipeline refusal");process.exit(2);}
-    console.log(JSON.stringify(process.env.POLL_STATE==="empty" ? [] : [{id:3,sha:process.env.POLL_HEAD,status:process.env.POLL_STATE==="failed" ? "failed" : "success"}]));
+    console.log(JSON.stringify(process.env.POLL_STATE==="empty" ? [] : [{id:3,sha:process.env.POLL_HEAD,status:process.env.POLL_STATE==="failed" ? "failed" : process.env.POLL_STATE==="pending" ? "running" : "success",web_url:"https://example.invalid/pipeline"}]));
   } else if(process.env.POLL_MODE==="malformed") console.log(JSON.stringify({message:"not review evidence"}));
   else {
     const note=id=>({id,author:{username:"greptile"},body:id===1 ? "first-page finding" : "second-page finding",type:null});
@@ -148,7 +163,7 @@ for (const mode of ["fetch-failed", "malformed", "changed", "changed-check"]) {
   });
 }
 
-for (const state of ["empty", "fetch-failed", "failed"]) {
+for (const state of ["empty", "fetch-failed", "failed", "pending"]) {
   test(`GitLab ${state} pipeline discovery stays incomplete`, () => {
     const result = gitlabPoll("complete", state);
     expect(result.code).not.toBe(0);
@@ -156,3 +171,12 @@ for (const state of ["empty", "fetch-failed", "failed"]) {
     expect(result.output).not.toContain("ci=green");
   });
 }
+
+for (const state of ["failed", "pending"]) {
+  test(`GitLab ${state} pipeline retains its state and link`, () => {
+    const result = gitlabPoll("complete", state);
+    expect(result.code).not.toBe(0);
+    expect(result.output).toContain(`pipeline 3 | ${state === "failed" ? "failed" : "running"}`);
+    expect(result.output).toContain("https://example.invalid/pipeline");
+  });
+}

package/src/scanner_snapshot.test.ts

@@ -0,0 +1,82 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdirSync, readdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { cleanupTemporaryDirectories, git, newRepository, ROOT, temporaryDirectory } from "./gates_test_support";
+import { UNSCOPED_ENVIRONMENT } from "./git_env";
+
+const SCOPED_AUDITS = ["ufs.sh", "logging.sh", "rust-error.sh", "deinit-pairs.sh", "sql-mod.sh", "design-tokens.sh"];
+const SOURCE = "lib/odd 'quoted.ts";
+const CLEAN = "export const MESSAGE = 'staged';\n";
+const BAD = 'export function first() { return "duplicate value"; }\nexport function second() { return "duplicate value"; }\n';
+const CHECKOUT = "checkout-index";
+const TIMEOUT_MS = 30_000;
+const TOOL_MODE = 0o755;
+
+afterEach(cleanupTemporaryDirectories);
+
+async function runScan(project: string, leaf: string, failPreflight = false) {
+  const tools = temporaryDirectory();
+  const scratch = temporaryDirectory();
+  const calls = join(tools, "calls.jsonl");
+  const realGit = Bun.which("git")!;
+  mkdirSync(join(tools, "bin"));
+  writeFileSync(join(tools, "bin/git"), `#!${process.execPath}
+const args = Bun.argv.slice(2);
+const file = Bun.file(process.env.SNAPSHOT_CALLS);
+await Bun.write(file, (await file.exists() ? await file.text() : "") + JSON.stringify(args) + "\\n");
+if (process.env.FAIL_PREFLIGHT === "1" && args.includes("--quiet")) process.exit(2);
+const result = Bun.spawnSync([process.env.REAL_GIT, ...args], { stdin: "inherit", stdout: "inherit", stderr: "inherit" });
+process.exit(result.exitCode);
+`, { mode: TOOL_MODE });
+  const result = Bun.spawnSync(["/bin/bash", join(ROOT, "audits", leaf), "--staged"], {
+    cwd: project, env: { ...UNSCOPED_ENVIRONMENT, PATH: `${join(tools, "bin")}:${process.env.PATH}`, TMPDIR: scratch,
+      SNAPSHOT_CALLS: calls, REAL_GIT: realGit, FAIL_PREFLIGHT: failPreflight ? "1" : "0" },
+    stdout: "pipe", stderr: "pipe", timeout: TIMEOUT_MS,
+  });
+  const commands: string[][] = (await Bun.file(calls).text()).trim().split("\n").map((line) => JSON.parse(line));
+  return { code: result.exitCode, output: result.stdout.toString() + result.stderr.toString(),
+    checkouts: commands.filter((args) => args[0] === CHECKOUT).length, leftovers: readdirSync(scratch) };
+}
+
+test.each(SCOPED_AUDITS)("%s skips repository checkout for a documentation-only index", async (leaf) => {
+  const project = newRepository();
+  await Bun.write(join(project, "README.md"), "Changed documentation.\n");
+  git(project, "add", "README.md");
+  const result = await runScan(project, leaf);
+  expect(result.code, result.output).toBe(0);
+  expect(result.checkouts).toBe(0);
+  expect(result.leftovers).toEqual([]);
+});
+
+test.each([true, false])("relevant source snapshot checks staged bytes with violation %s", async (badIndex) => {
+  const project = newRepository();
+  await Bun.write(join(project, SOURCE), badIndex ? BAD : CLEAN);
+  git(project, "add", SOURCE);
+  await Bun.write(join(project, SOURCE), badIndex ? CLEAN : BAD);
+  const result = await runScan(project, "ufs.sh");
+  expect(result.code, result.output).toBe(badIndex ? 1 : 0);
+  expect(result.checkouts).toBe(1);
+  expect(result.leftovers).toEqual([]);
+});
+
+test("a failed staged filename query refuses instead of reporting an empty scope", async () => {
+  const project = newRepository();
+  const result = await runScan(project, "ufs.sh", true);
+  expect(result.code).toBe(2);
+  expect(result.output).toContain("cannot select staged audit files");
+  expect(result.checkouts).toBe(0);
+  expect(result.leftovers).toEqual([]);
+});
+
+test("a deleted source path needs no repository checkout", async () => {
+  const project = newRepository();
+  await Bun.write(join(project, SOURCE), CLEAN);
+  git(project, "add", SOURCE);
+  git(project, "commit", "-qm", "test: seed source");
+  git(project, "rm", SOURCE);
+  const result = await runScan(project, "ufs.sh");
+  expect(result.code, result.output).toBe(0);
+  expect(result.checkouts).toBe(0);
+  expect(result.leftovers).toEqual([]);
+});