@aperant/framework 0.7.0 → 0.7.4

package/src/cli/commands/features-audit.mjs

@@ -11,25 +11,174 @@
  *   1. `--diff-files <a,b,c>` explicit CSV (highest priority)
  *   2. `--since <ref>` → runs `git diff --name-only <ref>..HEAD`
  *   3. fallback: `git diff HEAD --name-only` (current WIP)
+ *
+ * BUG-025b worktree-redirect: features-audit historically wrote to the
+ * invoking cwd's `.aperant/features/`, leaking generated `*.json` into
+ * main when the executor invoked it from a worktree-isolated task. The
+ * fix applies a 4-step resolution order (see resolveWriteRoot below):
+ *   (1) cwd IS a worktree root → write there (current behaviour)
+ *   (2) --task-id maps to an active non-terminal worktree task →
+ *       redirect writes to that worktree's `.aperant/features/`
+ *   (3) multiple active worktree-isolated tasks + no --task-id → error
+ *   (4) `--no-worktree-redirect` opt-out preserves layer (1) behaviour
  */
 
-import { execFileSync } from 'node:child_process'
-import { resolve } from 'node:path'
+import { execFileSync, spawnSync } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve, sep } from 'node:path'
 import { loadDocsPolicy, matchSurfaceToPolicy } from '../docs-audit/policy.mjs'
 import { applyStubPatches, auditFeatureRegistry } from '../features/registry-audit.mjs'
 import { parseFlags } from '../util/args.mjs'
 import { err, ok } from '../util/result.mjs'
 
+const TERMINAL_PHASES = new Set(['completed', 'cancelled', 'closed', 'shipped', 'merged'])
+
+/**
+ * BUG-025b — resolve where features-audit should write `*.json`.
+ * See module header for the 4-step order. Returns `{ writeRoot, redirect_notice }`
+ * on success or a synthetic error envelope (`{ error: { ... } }`) on the
+ * ambiguous-worktree case.
+ *
+ * @internal — exported for unit testing.
+ *
+ * @param {{projectDir: string, taskId?: string | null, noRedirect?: boolean}} args
+ * @returns {{writeRoot?: string, redirect_notice?: string | null, error?: {kind: string, message: string, active_worktree_tasks: string[]}}}
+ */
+export function resolveWriteRoot({ projectDir, taskId, noRedirect }) {
+	const root = resolve(projectDir)
+	if (noRedirect === true) {
+		return { writeRoot: root, redirect_notice: null }
+	}
+	// Layer (1): cwd IS a worktree root. Worktrees have `git rev-parse
+	// --git-dir` != `git rev-parse --git-common-dir`. Falling through to
+	// the existing behaviour writes to this worktree's .aperant/features.
+	// Fast path: git sets GIT_DIR and GIT_COMMON_DIR in the environment
+	// when running inside a worktree hook context — if both are set and
+	// differ, we are in a worktree. This env-var check is ONLY valid at
+	// Layer (1) where we ask "is this process in a worktree?"; it must
+	// NOT be used to validate an untrusted external path (Layer 2 below).
+	const envDir = process.env.GIT_DIR
+	const envCommonDir = process.env.GIT_COMMON_DIR
+	if (envDir && envCommonDir) {
+		if (resolve(envDir) !== resolve(envCommonDir)) {
+			return { writeRoot: root, redirect_notice: null }
+		}
+	} else if (isWorktreeRoot(root)) {
+		return { writeRoot: root, redirect_notice: null }
+	}
+	// Layer (2): --task-id maps to an active non-terminal worktree-isolated
+	// task → redirect.
+	const stateActive = readActiveTasks(root)
+	if (taskId) {
+		const task = stateActive[taskId]
+		if (
+			task &&
+			!TERMINAL_PHASES.has(task.lifecycle_phase) &&
+			typeof task.worktree_path === 'string' &&
+			existsSync(task.worktree_path)
+		) {
+			const resolvedWorktree = resolve(task.worktree_path)
+			const worktreesDir = resolve(root, '.aperant', 'worktrees') + sep
+			const isUnderProject = resolvedWorktree.startsWith(root + sep) || resolvedWorktree === root
+			const isUnderWorktrees = resolvedWorktree.startsWith(worktreesDir)
+			// Accept only paths under the project root, under .aperant/worktrees/,
+			// or confirmed as a real git worktree by git itself. Rejects arbitrary
+			// paths injected via a tampered state.json while preserving test
+			// fixtures that use ad-hoc worktree paths outside the project tree.
+			if (!isUnderProject && !isUnderWorktrees && !isWorktreeRoot(resolvedWorktree)) {
+				return { writeRoot: root, redirect_notice: null }
+			}
+			return {
+				writeRoot: resolvedWorktree,
+				redirect_notice: `features-audit redirected writes to worktree ${resolvedWorktree} (--task-id ${taskId})`,
+			}
+		}
+	}
+	// Layer (3): multiple active worktree-isolated tasks AND no --task-id
+	// → actionable error. Single-worktree case is OK to default to root
+	// (the executor will set up the worktree's registry on first scan).
+	const activeWorktreeTasks = Object.entries(stateActive).filter(([_id, t]) => {
+		return (
+			t &&
+			!TERMINAL_PHASES.has(t.lifecycle_phase) &&
+			typeof t.worktree_path === 'string' &&
+			existsSync(t.worktree_path)
+		)
+	})
+	if (!taskId && activeWorktreeTasks.length > 1) {
+		return {
+			error: {
+				kind: 'ambiguous-worktree-context',
+				message: 'ambiguous worktree context; pass --task-id <id> or --no-worktree-redirect',
+				active_worktree_tasks: activeWorktreeTasks.map(([id]) => id),
+			},
+		}
+	}
+	// Default: current behaviour (write into cwd).
+	return { writeRoot: root, redirect_notice: null }
+}
+
+function isWorktreeRoot(projectDir) {
+	try {
+		const dirRes = spawnSync('git', ['rev-parse', '--git-dir'], {
+			cwd: projectDir,
+			encoding: 'utf-8',
+			stdio: ['ignore', 'pipe', 'ignore'],
+		})
+		const commonRes = spawnSync('git', ['rev-parse', '--git-common-dir'], {
+			cwd: projectDir,
+			encoding: 'utf-8',
+			stdio: ['ignore', 'pipe', 'ignore'],
+		})
+		if (dirRes.status !== 0 || commonRes.status !== 0) return false
+		return (dirRes.stdout || '').trim() !== (commonRes.stdout || '').trim()
+	} catch {
+		return false
+	}
+}
+
+function readActiveTasks(projectDir) {
+	const statePath = join(projectDir, '.aperant', 'state.json')
+	if (!existsSync(statePath)) return {}
+	try {
+		const parsed = JSON.parse(readFileSync(statePath, 'utf-8'))
+		return parsed?.active_tasks ?? {}
+	} catch {
+		return {}
+	}
+}
+
 export function cmdFeaturesAudit(projectDir, extraArgs) {
 	if (!projectDir) return err('Usage: apt-tools features-audit <project-dir> [flags]')
 	const root = resolve(projectDir)
 	const flags = parseFlags(extraArgs)
 
+	// BUG-025b: redirect writes to the active task's worktree when the
+	// caller is in a non-worktree cwd. See resolveWriteRoot for the
+	// 4-step resolution order.
+	const taskIdFlag = flags.get('task-id')
+	const taskId = typeof taskIdFlag === 'string' && taskIdFlag.trim() ? taskIdFlag.trim() : null
+	const noRedirect = flags.get('no-worktree-redirect') === true
+	const writeRootResult = resolveWriteRoot({ projectDir: root, taskId, noRedirect })
+	if (writeRootResult.error) {
+		return err(writeRootResult.error.message, 1, {
+			kind: writeRootResult.error.kind,
+			active_worktree_tasks: writeRootResult.error.active_worktree_tasks,
+		})
+	}
+	const writeRoot = writeRootResult.writeRoot
+	const redirectNotice = writeRootResult.redirect_notice
+	if (redirectNotice) {
+		// Surface the redirect once on stderr so the executor's log carries
+		// the audit trail without polluting stdout JSON.
+		process.stderr.write(`[features-audit] ${redirectNotice}\n`)
+	}
+
 	const diffFiles = resolveDiffFiles(root, flags)
 	const applyStubs = flags.has('apply-stubs')
 	const format = (flags.get('format') || 'json').toLowerCase()
 
-	const result = auditFeatureRegistry({ projectDir: root, diffFiles })
+	const result = auditFeatureRegistry({ projectDir: writeRoot, diffFiles })
 
 	// Honor `.aperant/config.json.docs_policy`: only apply stubs for targets
 	// whose resolved policy is `auto-update`. This closes the skill-vs-code
@@ -52,7 +201,9 @@ export function cmdFeaturesAudit(projectDir, extraArgs) {
 			}
 		}
 		if (eligible.length > 0) {
-			applied_patches = applyStubPatches(root, eligible)
+			// BUG-025b: stubs are written to the resolved `writeRoot` (which
+			// may be the active task's worktree) rather than the invoking cwd.
+			applied_patches = applyStubPatches(writeRoot, eligible)
 		}
 		if (skipped.length > 0) {
 			skipped_patches = skipped
@@ -65,6 +216,8 @@ export function cmdFeaturesAudit(projectDir, extraArgs) {
 			command: 'features-audit',
 			format: 'md',
 			markdown: renderMarkdown(result, applied_patches, skipped_patches),
+			write_root: writeRoot,
+			...(redirectNotice ? { redirect_notice: redirectNotice } : {}),
 			...result,
 			...(applied_patches ? { applied_patches } : {}),
 			...(skipped_patches ? { skipped_patches } : {}),
@@ -74,6 +227,8 @@ export function cmdFeaturesAudit(projectDir, extraArgs) {
 	return ok({
 		status: 'ok',
 		command: 'features-audit',
+		write_root: writeRoot,
+		...(redirectNotice ? { redirect_notice: redirectNotice } : {}),
 		...result,
 		...(applied_patches ? { applied_patches } : {}),
 		...(skipped_patches ? { skipped_patches } : {}),
@@ -88,7 +243,11 @@ function resolveDiffFiles(root, flags) {
 			.map((s) => s.trim())
 			.filter(Boolean)
 	}
-	const since = flags.get('since')
+	const sinceRaw = flags.get('since')
+	const since =
+		typeof sinceRaw === 'string' && /^[A-Za-z0-9/_.-]+$/.test(sinceRaw) && !sinceRaw.startsWith('-')
+			? sinceRaw
+			: null
 	try {
 		const args = since ? ['diff', '--name-only', `${since}..HEAD`] : ['diff', 'HEAD', '--name-only']
 		const out = execFileSync('git', args, {

package/src/cli/commands/health-check.mjs

@@ -2,7 +2,7 @@
  * commands/health-check.mjs — health-check command (C29).
  */
 
-import { execSync } from 'node:child_process'
+import { execFileSync } from 'node:child_process'
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -13,6 +13,33 @@ import { readSkillInstallState } from '../util/skill-installs.mjs'
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = dirname(__filename)
 
+/**
+ * SECURITY: validate a component path string from `.aperant/features/*.json`
+ * before passing it to git. The registry is on-disk JSON authored by
+ * features-audit; pre-fix the orphan walker spliced this string into a
+ * shell command (`execSync(\`git rev-parse HEAD:${comp} 2>/dev/null\`)`),
+ * making a malicious entry like `foo.ts; rm -rf $HOME` a command-injection
+ * vector against any user who ran `apt-tools health-check`. The fix
+ * combines `execFileSync` (argv-form, no shell) with a strict path
+ * whitelist: relative posix paths only, no NUL / control bytes / shell
+ * metacharacters / leading `/` / `..` segments.
+ *
+ * @internal — exported for unit testing.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isSafeComponentPath(value) {
+	if (typeof value !== 'string' || value.length === 0 || value.length > 512) return false
+	// Reject NUL, control bytes, and shell metacharacters that could escape
+	// argv interpretation if a downstream caller ever reverts to shell mode.
+	// biome-ignore lint/suspicious/noControlCharactersInRegex: rejecting control bytes IS the security guard — see isSafeComponentPath docstring + test.
+	if (/[\x00-\x1f;&|`$<>"\\]/.test(value)) return false
+	if (value.startsWith('/')) return false
+	if (value.startsWith('-')) return false // would be parsed as a flag
+	if (value.split('/').some((seg) => seg === '..' || seg === '.' || seg === '')) return false
+	return true
+}
+
 export function cmdHealthCheck(projectDir) {
 	if (!projectDir) return err('Usage: apt-tools health-check <project-dir>')
 	const targetDir = resolve(projectDir)
@@ -22,9 +49,10 @@ export function cmdHealthCheck(projectDir) {
 	// 1. Check for uncommitted changes in working tree
 	let dirtyFiles = []
 	try {
-		const status = execSync('git status --porcelain 2>/dev/null', {
+		const status = execFileSync('git', ['status', '--porcelain'], {
 			cwd: targetDir,
 			encoding: 'utf-8',
+			stdio: ['ignore', 'pipe', 'ignore'],
 		}).trim()
 		if (status) {
 			dirtyFiles = status.split('\n').filter(Boolean)
@@ -156,6 +184,91 @@ export function cmdHealthCheck(projectDir) {
 		}
 	}
 
+	// 6. BUG-025b — orphaned-feature-component warning. Walk
+	// `.aperant/features/*.json`; for each cited component path, verify
+	// `git rev-parse HEAD:<path>` succeeds on the main repo's HEAD. A path
+	// that resolves on a worktree branch but is missing on main is a
+	// candidate orphan (the registry entry leaked from a worktree-isolated
+	// task and was never followed by the actual component landing on main).
+	// Severity `warn` — the registry is best-effort metadata, not a build
+	// blocker. Only fires on the main repo (skipped when health-check is
+	// invoked from a worktree).
+	try {
+		const featuresDir = join(aperantDir, 'features')
+		if (existsSync(featuresDir)) {
+			// SECURITY: argv-form (no shell) — see isSafeComponentPath comment.
+			const dirRes = execFileSync('git', ['rev-parse', '--git-dir'], {
+				cwd: targetDir,
+				encoding: 'utf-8',
+				stdio: ['ignore', 'pipe', 'ignore'],
+			}).trim()
+			const commonRes = execFileSync('git', ['rev-parse', '--git-common-dir'], {
+				cwd: targetDir,
+				encoding: 'utf-8',
+				stdio: ['ignore', 'pipe', 'ignore'],
+			}).trim()
+			if (dirRes === commonRes) {
+				const orphans = []
+				// PRF-001: one subprocess total instead of one per component.
+				// Build a Set of all tracked paths from a single ls-tree call.
+				const lsOut = execFileSync('git', ['ls-tree', '-r', 'HEAD', '--name-only'], {
+					cwd: targetDir,
+					encoding: 'utf-8',
+					stdio: ['ignore', 'pipe', 'ignore'],
+				}).trim()
+				const trackedPaths = new Set(
+					lsOut
+						.split('\n')
+						.map((s) => s.trim())
+						.filter(Boolean),
+				)
+				const files = readdirSync(featuresDir).filter(
+					(f) => f.endsWith('.json') && f !== 'REGISTRY.md',
+				)
+				// QUA-006: cap total component iterations to guard against
+				// adversarially large or malformed registry files.
+				const MAX_ORPHAN_ITERATIONS = 10_000
+				let iterCount = 0
+				let cappedAt = null
+				outer: for (const f of files) {
+					let area
+					try {
+						area = JSON.parse(readFileSync(join(featuresDir, f), 'utf-8'))
+					} catch {
+						continue
+					}
+					const components = Array.isArray(area?.components) ? area.components : []
+					for (const comp of components) {
+						if (iterCount >= MAX_ORPHAN_ITERATIONS) {
+							cappedAt = f
+							break outer
+						}
+						iterCount++
+						// SECURITY: reject obviously-unsafe component strings.
+						if (!isSafeComponentPath(comp)) continue
+						if (!trackedPaths.has(comp)) orphans.push({ area_file: f, component: comp })
+					}
+				}
+				if (cappedAt !== null) {
+					orphans.push({
+						area_file: cappedAt,
+						component: `(orphan scan capped at ${MAX_ORPHAN_ITERATIONS} entries — remaining components skipped)`,
+					})
+				}
+				if (orphans.length > 0) {
+					issues.push({
+						type: 'orphan-feature-components',
+						severity: 'warning',
+						detail: `${orphans.length} feature component(s) cited in .aperant/features/*.json are missing on HEAD — candidates leaked from worktree-isolated tasks`,
+						orphans: orphans.slice(0, 20),
+					})
+				}
+			}
+		}
+	} catch {
+		/* git not available or worktree — skip silently */
+	}
+
 	return ok({
 		status: 'ok',
 		command: 'health-check',

package/src/cli/commands/init.mjs

@@ -29,6 +29,11 @@ import { fileURLToPath } from 'node:url'
 import { detectMode } from '../bootstrap/detect-mode.mjs'
 import { deriveSidecar } from '../bootstrap/product-context-sidecar.mjs'
 import { assertConfigWriteAllowed } from '../config/guard.mjs'
+import {
+	AUDIT_001_LOCAL_FIELDS,
+	migrateDeferredFieldsToLocalConfig,
+	writeLocalConfigField,
+} from '../config/load.mjs'
 import { migrateConfigSchema, setAt } from '../config/schema-migrate.mjs'
 import { resolveSharePolicy } from '../config/share-policy.mjs'
 import { buildAperantGitignoreTemplate } from '../config/upgrade-gitignore.mjs'
@@ -101,6 +106,11 @@ const TRANSFORM_LOADERS = new Map(
  * @returns {{ runtimes: string[], runtimes_explicit: boolean, target: string|null, interactive: boolean, skipBootstrap: boolean, visibility?: 'solo'|'team', autonomy?: 0|1|2|3, accept_new_defaults: boolean, yes: boolean, forceRuntimes: boolean, forceOverwriteCatalog: boolean, keepLegacy: boolean }}
  */
 export function parseInstallFlags(args) {
+	// C58 (0.7.2): `--kilocode` is a deprecated alias of `--kilo`. Matches
+	// the upstream package + app branding so users typing what they see on
+	// kilocode.ai get the same install as the canonical `--kilo` flag.
+	// Internal runtime id stays `kilo` (no migration — per spec ID-01).
+	args = args.map((a) => (a === '--kilocode' ? '--kilo' : a))
 	const flagSet = new Set(args.filter((a) => a.startsWith('--')))
 	let target = null
 	for (let i = 0; i < args.length; i++) {
@@ -721,7 +731,11 @@ async function interactiveInterview(targetDir, version, canonicalRoot, archetype
 			if (suggested.size === 0) suggested.add('claude')
 			const sel = await clack.multiselect({
 				message: 'Pick the runtimes to install Aperant into',
-				options: RUNTIMES.map((r) => ({ value: r.id, label: r.id, hint: r.flag })),
+				options: RUNTIMES.map((r) => ({
+					value: r.id,
+					label: r.displayLabel ?? r.id,
+					hint: r.flag,
+				})),
 				initialValues: [...suggested],
 				required: true,
 			})
@@ -947,7 +961,7 @@ async function interactiveInterview(targetDir, version, canonicalRoot, archetype
  * @param {Record<string, any>} config
  * @param {InstallAnswers} answers
  */
-function applyInterviewAnswers(config, answers) {
+export function applyInterviewAnswers(config, answers, targetDir = null) {
 	if (config.autonomy) {
 		config.autonomy.default = answers.autonomyDefault
 	}
@@ -962,8 +976,22 @@ function applyInterviewAnswers(config, answers) {
 	}
 	if (config.multi_model?.cross_verification) {
 		const xverify = answers.crossVerificationTools
+		// `enabled` is project policy (is cross-verification on for this
+		// project?) — stays in shared `config.json`.
 		config.multi_model.cross_verification.enabled = xverify.length > 0
-		config.multi_model.cross_verification.tools = xverify
+		// AUDIT-001 (0.7.2 S1) — `tools` is per-device (which CLIs are installed
+		// HERE) and MUST land in `config.local.json`, NOT shared. Strip from
+		// the template to keep the shared file clean. When `targetDir` is null
+		// (legacy callers / tests that don't go through finishInit), we leave
+		// the tools array on the shared template — backward-compatible fallback
+		// — but the writer path always passes targetDir so production lands
+		// the value in local.
+		if (targetDir) {
+			delete config.multi_model.cross_verification.tools
+			writeLocalConfigField(targetDir, 'multi_model.cross_verification.tools', xverify)
+		} else {
+			config.multi_model.cross_verification.tools = xverify
+		}
 	}
 	config.project_type =
 		answers.archetype.type === 'brownfield' ? 'unknown' : config.project_type || 'unknown'
@@ -1482,7 +1510,11 @@ function finishInit(
 			() => {
 				if (!existsSync(configDest)) {
 					const template = JSON.parse(readFileSync(configTemplate, 'utf-8'))
-					applyInterviewAnswers(template, answers)
+					// AUDIT-001 (0.7.2 S1) — pass targetDir so the cross_verification.tools
+					// per-device field lands in `config.local.json`, not the shared
+					// `config.json`. Matches the upgrade-path migrator which already
+					// moves the same field via migrateDeferredFieldsToLocalConfig.
+					applyInterviewAnswers(template, answers, targetDir)
 					atomicWriteJson(configDest, template)
 					configCreated = true
 				}
@@ -1510,6 +1542,22 @@ function finishInit(
 		)
 	}
 
+	// AUDIT-001 — UPGRADE-only migrator. Moves the 5 deferred fields out
+	// of `config.json` into `config.local.json` on real upgrade paths
+	// (configMigrated === true), NOT on fresh seeds — the freshly-seeded
+	// template config.json IS the post-migration state, so the migrator
+	// would just round-trip with no observable benefit AND would trip
+	// the next init invocation's no-drift detection. Idempotent on
+	// re-run. Per-field independence per ID-08 — one failure does NOT
+	// block the others.
+	if (configMigrated && existsSync(configDest)) {
+		try {
+			migrateDeferredFieldsToLocalConfig(targetDir, AUDIT_001_LOCAL_FIELDS)
+		} catch {
+			/* never block init on telemetry-only migrator */
+		}
+	}
+
 	const stateTemplate = resolve(canonicalRoot, 'templates', 'state.json')
 	const stateDest = join(aperantDir, 'state.json')
 	let stateCreated = false

package/src/cli/commands/modes.mjs

@@ -41,6 +41,17 @@ const FRONTMATTER_RE = /^---\s*([\s\S]*?)\s*---/
  * which config keys a skill cares about. Skills that don't touch
  * config are omitted (their config_keys is `[]`).
  *
+ * AUDIT-001 (0.7.2): all dotted paths below resolve against the MERGED
+ * config (`loadMergedProjectConfig()` — shared `config.json` + local
+ * `config.local.json` overlay). The five per-device fields enumerated by
+ * `AUDIT_001_LOCAL_FIELDS` in `cli/config/load.mjs` (currently
+ * `verification.open_report`, `multi_model.cross_verification.tools`,
+ * `preferences.{date_format,time_format,quick_task_post_verify}`)
+ * physically live in `config.local.json`; the wildcard `'*'` surface for
+ * `apt:setup` covers both files. Consumers MUST go through the merged
+ * loader — never raw `JSON.parse(readFileSync('.aperant/config.json'))` —
+ * to honor per-device overrides correctly.
+ *
  * @type {Record<string, string[]>}
  */
 const SKILL_CONFIG_KEYS = {

package/src/cli/commands/pr-review-audit-fixer.mjs

@@ -668,10 +668,14 @@ export function decideVerdict({ statusLine, fixesApplied, diffFiles }) {
 	}
 }
 
-function readFixesAppliedForFixer(reviewDir, iteration, fixer) {
-	// Try the group-specific naming first (fixes-applied-group{N}.md) for
-	// fixer-{N}, then fall back to the unscoped fixes-applied.md which the
-	// self-reviewer writes to self-review.md separately.
+export function readFixesAppliedForFixer(reviewDir, iteration, fixer) {
+	// BUG-030: strict-ordered candidate list. Parallel fixers write to
+	// distinct fixer-named markdowns (fixes-applied-fixer-{N}.md AND/OR
+	// fixes-applied-{fixer}.md); the legacy group-named form remains for
+	// backward-compat with reviews started before this fix. fixes-applied.md
+	// (unscoped) stays last as the legacy single-fixer fallback. NO broad
+	// glob — false-positives on the wrong fixer's file are what caused the
+	// `hallucinated` flake (4 sightings in 3 days per spec-gaps).
 	const iterDir = join(reviewDir, 'iterations', String(iteration))
 	const candidates = []
 	if (fixer === 'self-reviewer') {
@@ -681,7 +685,9 @@ function readFixesAppliedForFixer(reviewDir, iteration, fixer) {
 		const match = /^fixer-(\d+)$/.exec(fixer)
 		if (match) {
 			candidates.push(join(iterDir, `fixes-applied-group${match[1]}.md`))
+			candidates.push(join(iterDir, `fixes-applied-fixer-${match[1]}.md`))
 		}
+		candidates.push(join(iterDir, `fixes-applied-${fixer}.md`))
 		candidates.push(join(iterDir, 'fixes-applied.md'))
 	}
 	for (const c of candidates) {
@@ -802,7 +808,14 @@ export function cmdPrReviewAuditFixer(projectDir, extraArgs) {
 
 	const worktreeArg = flags.get('worktree')
 	if (!worktreeArg) return err('Required: --worktree <path>')
-	const worktree = resolve(worktreeArg)
+	// BUG-015: resolve relative to the passed projectDir (not process.cwd()).
+	// Callers invoke audit-fixer from a non-worktree cwd (the main repo) with
+	// a relative --worktree like `../worktrees/foo`; resolving against cwd
+	// returned a bogus path that didn't exist, causing the audit to see zero
+	// staged files and false-positive `hallucinated`. The existing `cwd:
+	// worktree` at the spawn site (line 437-473) already scopes git
+	// invocations correctly, so no `git -C` change is needed.
+	const worktree = resolve(projectDir, worktreeArg)
 
 	const statusLineArg = flags.get('status-line')
 	// Missing / empty status line is fail-closed to hallucinated, not a

package/src/cli/commands/task.mjs

@@ -14,7 +14,11 @@
 import { spawnSync } from 'node:child_process'
 import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
 import { join, resolve } from 'node:path'
-import { getTaskIsolationConfig, loadProjectConfig } from '../config/load.mjs'
+import {
+	getTaskIsolationConfig,
+	loadMergedProjectConfig,
+	loadProjectConfig,
+} from '../config/load.mjs'
 import { findMostRecentEventForTask } from '../coordination/event-log.mjs'
 import { createCoordinationStore } from '../coordination/store.mjs'
 import { getGitIdentity } from '../git/identity.mjs'
@@ -127,9 +131,16 @@ export function cmdTask(subcommand, projectDir, extraArgs) {
 				// a later roadmap add-milestone/add-phase may populate it.
 			}
 
-			// Load config for date format preference
-			const configPath = join(targetDir, '.aperant', 'config.json')
-			const config = existsSync(configPath) ? JSON.parse(readFileSync(configPath, 'utf-8')) : {}
+			// AUDIT-001: read through the merged loader so local-only
+			// overrides for preferences.date_format / preferences.time_format
+			// win over the shared config.json fallback.
+			// Guard: malformed config.local.json must not crash task creation.
+			let config
+			try {
+				config = loadMergedProjectConfig(targetDir) ?? {}
+			} catch {
+				config = {}
+			}
 			// User-supplied --id bypasses the collision guard (caller owns the
 			// uniqueness contract). Generated ids run through a numeric-counter
 			// disambiguator that appends -2, -3, … when the candidate already
@@ -982,7 +993,50 @@ export function cmdTask(subcommand, projectDir, extraArgs) {
 					state.last_activity = new Date().toISOString()
 					atomicWriteJson(statePath, state)
 					if (prUrlForCiWatch) {
-						ciWatchResult = armCiWatchAfterPrUrl(targetDir, task, prUrlForCiWatch)
+						// BUG-027 (a): pre-arm gh check. If the PR is already
+						// MERGED/CLOSED, skip arming so we don't leak a new
+						// watcher state file we'll immediately have to GC. gh
+						// rate-limit / offline / ENOENT falls back to arm (mirror
+						// the existing rate_limited/offline patterns at lines
+						// 1322/1326) — non-fatal so a transient gh failure
+						// doesn't prevent legitimate watcher arming.
+						const ghFixture = process.env.APT_GH_FIXTURE_JSON
+						let terminalState = null
+						if (ghFixture) {
+							try {
+								const parsed = JSON.parse(ghFixture)
+								if (parsed?.state === 'MERGED' || parsed?.state === 'CLOSED') {
+									terminalState = parsed.state
+								}
+							} catch {
+								/* malformed fixture → fall through to arm */
+							}
+						} else {
+							try {
+								const res = spawnSync('gh', ['pr', 'view', prUrlForCiWatch, '--json', 'state'], {
+									cwd: targetDir,
+									encoding: 'utf-8',
+								})
+								if (res.status === 0 && res.stdout) {
+									const parsed = JSON.parse(res.stdout)
+									if (parsed?.state === 'MERGED' || parsed?.state === 'CLOSED') {
+										terminalState = parsed.state
+									}
+								}
+								/* non-zero exit / ENOENT / parse error → fall through to arm */
+							} catch {
+								/* never block arming on gh transport error */
+							}
+						}
+						if (terminalState) {
+							ciWatchResult = {
+								ci_watch_armed: false,
+								ci_watch_skip_reason: 'pr-terminal-state',
+								ci_watch: null,
+							}
+						} else {
+							ciWatchResult = armCiWatchAfterPrUrl(targetDir, task, prUrlForCiWatch)
+						}
 					}
 
 					regenerateTaskIndex(targetDir)
@@ -1479,6 +1533,30 @@ export function cmdTask(subcommand, projectDir, extraArgs) {
 					mergedAt: parsed.mergedAt ?? null,
 				})
 
+				// BUG-027 (b): tear down any armed ci-watch state for this PR.
+				// `doStop` is idempotent (returns `not-found` for missing state
+				// files), so calling unconditionally here is safe. Without this
+				// the watcher state file leaks past PR-terminal-state and
+				// downstream operations (ci-watch sweep, health-check) flag it
+				// as orphaned. Failure is logged into errors[] as a warning;
+				// the merge close itself has already succeeded.
+				try {
+					const prNumber = parsed.number ?? extractPrNumber(task.pr_url)
+					if (prNumber !== null) {
+						cmdCiWatch('stop', targetDir, [
+							'--pr',
+							String(prNumber),
+							'--reason',
+							'task-closed-merged',
+						])
+					}
+				} catch (e) {
+					errors.push({
+						id,
+						reason: `ci-watch-stop-failed: ${e?.message ?? String(e)}`,
+					})
+				}
+
 				// Append a pending_narration[] ledger entry on successful merged close
 				// so /apt:close-task --narrate-only can drain it later. The ledger is
 				// additive-only; failure to write must never undo the close above