@agentsfleet/orly 0.9.4 → 0.10.1

package/AGENTS.md

@@ -144,7 +144,7 @@ Guards fire pre-hoc regardless of lifecycle stage. Override: `<GATE>: SKIPPED pe
 | write auth-flow / token-minting files | `write_auth` | `dispatch/write_auth.md` — auth invariants; reads the product repo's `docs/AUTH.md` before · 🟣 delegated (product repo). |
 | write published docs / OpenAPI prose | `write_documentation` | `dispatch/write_documentation.md` → `docs/DOCUMENTATION_RULES.md` before narrower guides; page, fragment, API, changelog scopes differ · 🟣 delegated to repository pre-commit checks. |
 | write a changelog entry | `write_changelog` | `dispatch/write_changelog.md` — changelog voice (one headline, no marketing words, `**Bold lead-noun**` bullets, history append-only); reads `docs/CHANGELOG_VOICE.md` · 🤔 judgment-only. |
-| write/update a PR or MR body or its session notes | `write_pr_description` | `dispatch/write_pr_description.md` — append numbered `Session notes`, `Review`, and `Make`; measured fenced diagrams; review dispositions; commands with real output. |
+| write/update a PR or MR body or its session notes | `write_pr_description` | `dispatch/write_pr_description.md` — append numbered `Session notes`, `Review`, and `Make`; measured fenced diagrams; visual evidence from the lane's own artifacts; review dispositions; commands with real output. |
 | claim "tests pass / ready / shipping" | `verify` | `dispatch/verify.md` — verification tiers (`make` canonical; package-scoped runners are **not** verification), done-message glyph format · 🤔 judgment-only, `VERIFY GATE: <target> skipped per environment constraint (reason: ...)` only when genuinely unrunnable. |
 | name a stream/channel/Redis namespace/queue/RPC/Postgres schema, or describe a flow | `name_architecture` | `dispatch/name_architecture.md` — architecture-consult discipline; grep relevant `docs/architecture/` (chat brainstorming counts) · **no override** — doc wins until reconciled. |
 | run a lifecycle stage (open→close a stream, worktree setup, milestone bootstrap) | `lifecycle` | `dispatch/lifecycle.md` — stage runbooks: CHORE(open/close) checklists, PLAN expansions, spec discipline, deferral format, pre-PR gates, LAND · 🤔 judgment-only. |

package/audits/design-tokens.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# design-tokens.sh — enforce design-system token discipline across
-# ui/packages/{app,website}/**/*.tsx.
+# design-tokens.sh — enforce design-system token discipline and flat fills
+# across the app, website, and shared design system.
 #
 # Dispatch façade: dispatch/write_ts_adhere_bun.md (Design Tokens / DESIGN TOKEN GATE)
 # Fires in: CONFORM (via `make harness-verify` in `agentsfleet`).
@@ -62,6 +62,23 @@ PATTERNS=(
   '(text|bg|border)-(red|blue|green|yellow|purple|indigo|violet|pink|orange|gray|slate|zinc|neutral)-[0-9]:::use semantic tokens (text-destructive, text-error, text-success, …)'
 )
 
+readonly GRADIENT_REGEX='(repeating-)?(linear|radial|conic)-gradient[[:space:]]*\('
+
+# Consumers may select a font role, but only the design system defines it.
+check_font_ownership() {
+  local f="$1"
+  case "$f" in ui/packages/design-system/*) return ;; esac
+  awk '
+    {
+      source = $0
+      gsub(/font-family[[:space:]]*:[[:space:]]*var\(--ff-(sans|mono|display)\)/, "")
+      invalid = /font-family[[:space:]]*:|fontFamily[[:space:]]*:[[:space:]]*["\047]|--(ff|font)-(sans|mono|display)[[:space:]]*:|font-\[/
+      if (FILENAME ~ /^ui\/packages\/app\// && /font-display|DisplayXL|DisplayLG/) invalid = 1
+      if (invalid) printf "%s:%d:%s\n", FILENAME, FNR, source
+    }
+  ' "$f"
+}
+
 # ── File scope ───────────────────────────────────────────────────────────
 in_scope() {
   local f="$1"
@@ -70,8 +87,17 @@ in_scope() {
     *tests/e2e/*) return 1 ;;
     ui/packages/app/*.tsx|ui/packages/app/*.jsx) return 0 ;;
     ui/packages/website/*.tsx|ui/packages/website/*.jsx) return 0 ;;
-    ui/packages/app/**/*.tsx|ui/packages/app/**/*.jsx) return 0 ;;
-    ui/packages/website/**/*.tsx|ui/packages/website/**/*.jsx) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+in_gradient_scope() {
+  local f="$1"
+  case "$f" in
+    *.test.*|*.spec.*|*/tests/*|*/coverage/*|*/dist/*|*/.next/*|*/node_modules/*) return 1 ;;
+    ui/packages/app/*.css|ui/packages/app/*.js|ui/packages/app/*.jsx|ui/packages/app/*.mjs|ui/packages/app/*.ts|ui/packages/app/*.tsx) return 0 ;;
+    ui/packages/website/*.css|ui/packages/website/*.js|ui/packages/website/*.jsx|ui/packages/website/*.mjs|ui/packages/website/*.ts|ui/packages/website/*.tsx) return 0 ;;
+    ui/packages/design-system/*.css|ui/packages/design-system/*.js|ui/packages/design-system/*.jsx|ui/packages/design-system/*.mjs|ui/packages/design-system/*.ts|ui/packages/design-system/*.tsx) return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -79,12 +105,14 @@ in_scope() {
 case "$MODE" in
   --staged|staged)
     FILES=$(git diff --cached --name-only --diff-filter=ACMRT 2>/dev/null || true)
+    GRADIENT_CANDIDATES="$FILES"
     ;;
   --all|all)
     # `git ls-files` reports the index, which includes staged content —
     # so pre-commit-style invocations see staged-but-not-committed files
     # without needing a `--staged` flag.
     FILES=$(git ls-files -- 'ui/packages/app/*.tsx' 'ui/packages/app/*.jsx' 'ui/packages/website/*.tsx' 'ui/packages/website/*.jsx' 2>/dev/null || true)
+    GRADIENT_CANDIDATES=$(git ls-files -- ui/packages/app ui/packages/website ui/packages/design-system 2>/dev/null || true)
     ;;
   *)
     echo "usage: $0 [--all|--staged]" >&2
@@ -127,10 +155,34 @@ if [ "${#SCOPED_FILES[@]}" -gt 0 ]; then
   done
 fi
 
+GRADIENT_FILES=()
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  [ ! -f "$f" ] && continue
+  in_gradient_scope "$f" || continue
+  GRADIENT_FILES+=("$f")
+  while IFS= read -r match; do
+    [ -z "$match" ] && continue
+    printf '%s\n  -> define fonts in design-system tokens.css; use sans for app UI and mono for technical values\n' "$match"
+    SEEN_FILES_LIST="${SEEN_FILES_LIST}${f}"$'\n'
+    FAIL=1
+  done < <(check_font_ownership "$f")
+done <<< "$GRADIENT_CANDIDATES"
+
+if [ "${#GRADIENT_FILES[@]}" -gt 0 ]; then
+  while IFS= read -r match; do
+    [ -z "$match" ] && continue
+    f="${match%%:*}"
+    printf '%s\n  -> use a solid design-system color token; gradients are forbidden\n' "$match"
+    SEEN_FILES_LIST="${SEEN_FILES_LIST}${f}"$'\n'
+    FAIL=1
+  done < <(grep -nHE "$GRADIENT_REGEX" "${GRADIENT_FILES[@]}" 2>/dev/null || true)
+fi
+
 FILES_WITH_VIOLATIONS=$(printf '%s' "$SEEN_FILES_LIST" | sort -u | grep -c . || true)
 
 if [ "$FAIL" = "0" ]; then
-  echo "OK: design-token discipline — no arbitraries that have a token equivalent (mode=$MODE)"
+  echo "OK: design-token discipline — named utilities and flat fills verified (mode=$MODE)"
   exit 0
 fi
 

package/core/operating-model.md

@@ -148,7 +148,7 @@ Guards fire pre-hoc regardless of lifecycle stage. Override: `<GATE>: SKIPPED pe
 | write auth-flow / token-minting files | `write_auth` | `dispatch/write_auth.md` — auth invariants; reads the product repo's `docs/AUTH.md` before · 🟣 delegated (product repo). | <!-- oracle-packs:domain.auth -->
 | write published docs / OpenAPI prose | `write_documentation` | `dispatch/write_documentation.md` → `docs/DOCUMENTATION_RULES.md` before narrower guides; page, fragment, API, changelog scopes differ · 🟣 delegated to repository pre-commit checks. | <!-- oracle-packs:domain.documentation -->
 | write a changelog entry | `write_changelog` | `dispatch/write_changelog.md` — changelog voice (one headline, no marketing words, `**Bold lead-noun**` bullets, history append-only); reads `docs/CHANGELOG_VOICE.md` · 🤔 judgment-only. | <!-- oracle-packs:domain.changelog -->
-| write/update a PR or MR body or its session notes | `write_pr_description` | `dispatch/write_pr_description.md` — append numbered `Session notes`, `Review`, and `Make`; measured fenced diagrams; review dispositions; commands with real output. | <!-- oracle-packs:universal.authoring -->
+| write/update a PR or MR body or its session notes | `write_pr_description` | `dispatch/write_pr_description.md` — append numbered `Session notes`, `Review`, and `Make`; measured fenced diagrams; visual evidence from the lane's own artifacts; review dispositions; commands with real output. | <!-- oracle-packs:universal.authoring -->
 | claim "tests pass / ready / shipping" | `verify` | `dispatch/verify.md` — verification tiers (`make` canonical; package-scoped runners are **not** verification), done-message glyph format · 🤔 judgment-only, `VERIFY GATE: <target> skipped per environment constraint (reason: ...)` only when genuinely unrunnable. | <!-- oracle-packs:product.agentsfleet -->
 | name a stream/channel/Redis namespace/queue/RPC/Postgres schema, or describe a flow | `name_architecture` | `dispatch/name_architecture.md` — architecture-consult discipline; grep relevant `docs/architecture/` (chat brainstorming counts) · **no override** — doc wins until reconciled. | <!-- oracle-packs:universal.authoring -->
 | run a lifecycle stage (open→close a stream, worktree setup, milestone bootstrap) | `lifecycle` | `dispatch/lifecycle.md` — stage runbooks: CHORE(open/close) checklists, PLAN expansions, spec discipline, deferral format, pre-PR gates, LAND · 🤔 judgment-only. |

package/dispatch/write_changelog.md

@@ -40,8 +40,10 @@ a gate skip.
   names, money amounts stay verbatim.
 - **Internal cleanup** gets aggressive trimming, not a paragraph.
 - **History is archived, not rewritten** — past entries are an immutable record.
-- **Rate constants** stay pinned across the three files (`tenant_billing.zig`,
-  `rates.ts`, `rates.mdx`) — a changelog money/rate claim must match all three.
+- **Rate constants** are pinned by `cross_runtime_rates.rs`, which reads the
+  app and Command-Line Interface (CLI) mirrors against the Rust constant. A
+  changelog money or rate claim must match those, and `rates.mdx` in the docs
+  repository, which no test can reach.
 
 ## Required output (self-audit line before committing the changelog)
 

package/dispatch/write_pr_description.md

@@ -84,6 +84,37 @@ their numbers:
    0.003-0.005ms        0.1ms        1.0ms      12-21ms
 ```
 
+## Visual evidence
+
+A change to a surface a person looks at, or a failure a picture explains faster
+than a paragraph, carries the picture. A reviewer who can see the wall, the
+dialog or the red run decides in seconds what a description makes them
+reconstruct.
+
+**Take it from what already ran, not from a staged pose.** A lane that failed
+has already produced the image: `gh run download <id> -n <artifact>` yields
+Playwright's `test-failed-*.png`, its `trace.zip` and its `error-context.md`.
+Those are measured evidence of the state under review. A browser driven by hand
+is the fallback, for a surface no lane photographs.
+
+**Screenshot the claim, not the neighbourhood.** One image per assertion, and
+the assertion named in the caption — "one tile, not two" beats "the fleets
+page". Never crop a failure out of a frame that contained it.
+
+**Attaching is the author's step, and say so rather than pretending.** No forge
+accepts an image upload to a pull-request body over its command-line interface;
+`gh` and `glab` both have no such call. So the agent hands the file to the
+person and the person drags it in. What the agent MUST do in the body is make
+the evidence retrievable without the image: name the run id, the artifact and
+the path inside it, and quote the decisive line. A body that says
+`error-context.md:27 records unexpected value "hidden"` survives a screenshot
+nobody attached; a body that says "see screenshot" does not.
+
+**A before/after belongs in a fence, not in two images**, when the difference is
+countable — the diagram rules above already cover it, and a diagram diffs
+better than a pair of pictures. Use images for what only rendering shows:
+alignment, spacing, contrast, what a person actually sees.
+
 ## Review
 
 Lead with the review result. Record every finding with P0, P1, or P2 severity,
@@ -142,6 +173,11 @@ a green pipeline.
 <Useful measured diagram, at most 78 columns.>
 ```
 
+<Visual evidence, when a surface changed or a picture explains a failure:
+each image named with the assertion it carries and with the run, artifact and
+path it came from, plus the decisive line quoted so the claim survives an
+image nobody attached.>
+
 ## Review
 
 <P0/P1/P2 entries with dispositions, No findings., or not-run reason.>

package/docs/CHANGELOG_VOICE.md

@@ -14,5 +14,5 @@ Editing `~/Projects/docs/changelog.mdx` or any other Mintlify `<Update>` block.
 - **Internal cleanup / refactor entries get the most aggressive trimming.** One lead paragraph + one bullet list. Skip "Test coverage" sections unless the test count is the headline. Indy's exact direction: *"Keep internal code cleanup, refactor to a minimal."*
 - **Never drop load-bearing facts.** Error codes (`UZ-AUTH-003`), endpoint paths + method + body shape + status code, env var names + defaults, schema column / table names, CLI subcommand + flag names, migration steps, money amounts. Tighten prose, not meaning.
 - **Historical entries are archives.** Brevity-pass them; never rewrite the past. A typo correction (e.g. `$0.001` → `$0.01` when it was never true) is allowed and must be called out in the commit message.
-- **Rate constants flow through three pinned files only:** `rustd/crates/afd_billing/src/nanos.rs`, `ui/packages/website/src/lib/rates.ts`, `~/Projects/docs/snippets/rates.mdx`. Bumping a rate requires a paired Pull Request (PR) across the docs repo — there is no automated guard. In `*.mdx`, use `import { STARTER_CREDIT, EVENT_RATE, STAGE_RATE } from "/snippets/rates.mdx"` instead of hand-typing `$5`.
+- **Rate constants stay pinned across the runtime surfaces, and a test says so.** `rustd/crates/afd_billing/tests/cross_runtime_rates.rs` reads `ui/packages/app/lib/types.ts` and `cli/src/constants/billing.ts` and fails when either drifts from `rustd/crates/afd_billing/src/nanos.rs` — a test beside the constant it defends, not a gate nothing invokes. Public docs are the one surface it cannot reach: when a rate changes, update `~/Projects/docs/snippets/rates.mdx` in a paired Pull Request (PR). In `*.mdx`, import its named values rather than hand-typing money amounts.
 - **The Mintlify reference Indy pasted (May 1 / May 8 entries) is canonical voice.** Mirror its rhythm, not its product nouns.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.9.4",
+  "version": "0.10.1",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/registry.json

@@ -296,10 +296,6 @@
     "product.agentsfleet": {
       "extensions": [],
       "managed_files": [
-        {
-          "source": "audits/cross-tier-rates.sh",
-          "target": "audits/cross-tier-rates.sh"
-        },
         {
           "source": "audits/design-tokens.sh",
           "target": "audits/design-tokens.sh"

package/audits/cross-tier-rates.sh

@@ -1,105 +0,0 @@
-#!/usr/bin/env bash
-# cross-tier-rates.sh — pin numeric parity of the rate constants
-# across the daemon + three TypeScript surfaces.
-#
-# RULE UFS extension. The shipped billing surface depends on these constants
-# having identical numeric values everywhere they appear:
-#
-#   RUN_NANOS_PER_SEC         — per-second run rate (both postures) in nanos
-#
-# Two free-trial constants were pinned here and are both gone. FREE_TRIAL_END_MS
-# went when the boundary moved onto the tenant row; FREE_TRIAL_STAGE_NANOS went
-# when the trial mechanism was removed outright, because a rate that could
-# silently price a metered slice to zero was worth deleting rather than
-# guarding. The free allowance is wallet credit now — a balance, not a rate —
-# so there is no cross-tier number to pin for it.
-#
-# Files (one definition site per constant per file):
-#
-#   rustd/crates/afd_billing/src/nanos.rs   — server enforces the charge
-#   ui/packages/website/src/lib/rates.ts    — pricing page display
-#   ui/packages/app/lib/types.ts            — dashboard display
-#   cli/src/constants/billing.ts    — `agentsfleet doctor --json` billing block
-#
-# A drift between any two = a billing-display lie or a server-vs-CLI disagreement.
-# The daemon is the source of truth (server enforces); the three TS surfaces echo it.
-#
-# Fires in: make harness-verify, make harness-verify-all.
-# Exits 0 clean, 1 on any drift.
-
-set -euo pipefail
-
-ROOT="$(git rev-parse --show-toplevel)"
-cd "$ROOT"
-
-readonly NAMES=(
-  RUN_NANOS_PER_SEC
-)
-
-readonly FILES=(
-  rustd/crates/afd_billing/src/nanos.rs
-  ui/packages/website/src/lib/rates.ts
-  ui/packages/app/lib/types.ts
-  cli/src/constants/billing.ts
-)
-
-# Extract the numeric value bound to `name` in `file`. Matches definition
-# sites only — `^(pub |export )?const NAME` — not usages elsewhere in the
-# file. Normalises: strips underscores (Zig `1_000_000`, TS `1_000_000`),
-# strips the bigint `n` suffix (TS `1_000_000n`), trims whitespace.
-extract_value() {
-  local file="$1" name="$2"
-  grep -E "^[[:space:]]*(pub |export )?const ${name}\\b" "$file" 2>/dev/null \
-    | head -1 \
-    | sed -E "s|.*=[[:space:]]*||; s|[;,].*||; s|//.*||; s|[[:space:]_n]||g"
-}
-
-FAIL=0
-violations=()
-
-printf "audit-cross-tier-rates: pinning %d constants across %d files\n" \
-  "${#NAMES[@]}" "${#FILES[@]}"
-
-for name in "${NAMES[@]}"; do
-  expected=""
-  expected_file=""
-  for file in "${FILES[@]}"; do
-    if [[ ! -f "$file" ]]; then
-      violations+=("MISSING_FILE: $file")
-      FAIL=1
-      continue
-    fi
-    val="$(extract_value "$file" "$name")"
-    if [[ -z "$val" ]]; then
-      violations+=("MISSING_CONST: $name not defined in $file")
-      FAIL=1
-      continue
-    fi
-    if [[ -z "$expected" ]]; then
-      expected="$val"
-      expected_file="$file"
-      continue
-    fi
-    if [[ "$val" != "$expected" ]]; then
-      violations+=("DRIFT: $name = $val in $file vs $expected in $expected_file")
-      FAIL=1
-    fi
-  done
-  if [[ -n "$expected" ]]; then
-    printf "  OK   %-26s = %s\n" "$name" "$expected"
-  fi
-done
-
-if [[ $FAIL -ne 0 ]]; then
-  printf "\nFAIL: cross-tier rate drift detected:\n" >&2
-  for v in "${violations[@]}"; do
-    printf "  %s\n" "$v" >&2
-  done
-  printf "\nFix: align all four files on the canonical Zig value\n" >&2
-  printf "     (rustd/crates/afd_billing/src/nanos.rs is the server-side enforcer).\n" >&2
-  exit 1
-fi
-
-printf "OK:   all %d rate constants pin across %d files\n" \
-  "${#NAMES[@]}" "${#FILES[@]}"
-exit 0