@aperant/framework 0.8.1 → 0.8.4

package/dist/cli/verify-proof/trust.d.mts

@@ -0,0 +1,70 @@
+/**
+ * Compute a stable manifest hash for TOFU + audit lines.
+ * @param {DriverManifest} manifest
+ * @returns {string}
+ */
+export function manifestSha256(manifest: DriverManifest): string;
+/**
+ * Read the TOFU lock file. Returns an empty object if missing or malformed.
+ * @param {string} projectDir
+ * @returns {Record<string, {manifest_sha256: string, artifact_digest?: string, approved_at: string, trust_tier: string}>}
+ */
+export function readTofuLock(projectDir: string): Record<string, {
+    manifest_sha256: string;
+    artifact_digest?: string;
+    approved_at: string;
+    trust_tier: string;
+}>;
+/**
+ * Persist a TOFU lock file (atomic-ish: write + rename not used since we
+ * append-only to a tiny JSON; conflicting writes from parallel agents
+ * would clobber an entry but `.aperant/driver-tofu.json` is per-project,
+ * not per-agent).
+ *
+ * @param {string} projectDir
+ * @param {Record<string, unknown>} tofu
+ */
+export function writeTofuLock(projectDir: string, tofu: Record<string, unknown>): void;
+/**
+ * Build the canonical TOFU key for a (driver, version) pair. The hash is
+ * NOT part of the key — the value's manifest_sha256 + artifact_digest
+ * detect drift.
+ * @param {string} driverId
+ * @param {string} version
+ * @returns {string}
+ */
+export function tofuKey(driverId: string, version: string): string;
+/**
+ * Read the project's policy file. Returns the default policy if missing.
+ * @param {string} projectDir
+ * @returns {{mode: 'first_party_only' | 'allowlist', allowed: string[], denied: string[]}}
+ */
+export function readPolicy(projectDir: string): {
+    mode: "first_party_only" | "allowlist";
+    allowed: string[];
+    denied: string[];
+};
+/**
+ * Decide whether a driver invocation is allowed.
+ *
+ * @param {DriverManifest} manifest
+ * @param {ReturnType<typeof readTofuLock>} tofu
+ * @param {ReturnType<typeof readPolicy>} policy
+ * @returns {{decision: 'allow' | 'deny' | 'requires_approval', reason: string, expected_manifest_sha256?: string}}
+ */
+export function decide(manifest: DriverManifest, tofu: ReturnType<typeof readTofuLock>, policy: ReturnType<typeof readPolicy>): {
+    decision: "allow" | "deny" | "requires_approval";
+    reason: string;
+    expected_manifest_sha256?: string;
+};
+/**
+ * Persist a one-time approval for a (driver, version) pair into the TOFU
+ * lock. The caller is responsible for actually prompting the user; this
+ * function just writes the entry.
+ *
+ * @param {string} projectDir
+ * @param {DriverManifest} manifest
+ */
+export function recordApproval(projectDir: string, manifest: DriverManifest): void;
+export type DriverManifest = import("@aperant/driver-sdk").DriverManifest;
+//# sourceMappingURL=trust.d.mts.map

package/dist/cli/verify-proof/trust.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.mts","sourceRoot":"","sources":["../../../src/cli/verify-proof/trust.mjs"],"names":[],"mappings":"AA+BA;;;;GAIG;AACH,yCAHW,cAAc,GACZ,MAAM,CAKlB;AAED;;;;GAIG;AACH,yCAHW,MAAM,GACJ,MAAM,CAAC,MAAM,EAAE;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,CAAC,CAUxH;AAED;;;;;;;;GAQG;AACH,0CAHW,MAAM,QACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAMjC;AAED;;;;;;;GAOG;AACH,kCAJW,MAAM,WACN,MAAM,GACJ,MAAM,CAIlB;AAED;;;;GAIG;AACH,uCAHW,MAAM,GACJ;IAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAC,CAgBzF;AAED;;;;;;;GAOG;AACH,iCALW,cAAc,QACd,UAAU,CAAC,OAAO,YAAY,CAAC,UAC/B,UAAU,CAAC,OAAO,UAAU,CAAC,GAC3B;IAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;CAAC,CAwDjH;AAED;;;;;;;GAOG;AACH,2CAHW,MAAM,YACN,cAAc,QAYxB;6BAjKY,OAAO,qBAAqB,EAAE,cAAc"}

package/dist/cli/verify-proof/trust.mjs

@@ -0,0 +1,174 @@
+/**
+ * trust.mjs — driver trust enforcement (TOFU lock + policy file + decision).
+ *
+ * Implements ID-03:
+ *   - 4 trust tiers: first_party_signed (default-allow), community_verified,
+ *     community_unverified, local_unverified.
+ *   - Default policy: only first_party_signed auto-runs.
+ *   - Non-first-party drivers require one-time user approval; approval is
+ *     bound to a TOFU lock at .aperant/driver-tofu.json keyed by
+ *     {driver_id, version, manifest_sha256, artifact_digest}. Any drift
+ *     re-prompts.
+ *
+ * The audit log (audit.mjs) writes one line per decision (allow/deny).
+ * The execution layer (exec.mjs) enforces structured-only local_command.
+ *
+ * This module is decision-only: it does NOT prompt the user. The caller
+ * (workflow runner / apt-tools driver doctor) decides whether to invoke
+ * the prompt UX, then calls recordApproval() to persist the TOFU entry.
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+/**
+ * @typedef {import('@aperant/driver-sdk').DriverManifest} DriverManifest
+ */
+const TOFU_PATH = '.aperant/driver-tofu.json';
+const POLICY_PATH = '.aperant/policy.json';
+/**
+ * Compute a stable manifest hash for TOFU + audit lines.
+ * @param {DriverManifest} manifest
+ * @returns {string}
+ */
+export function manifestSha256(manifest) {
+    const stable = JSON.stringify(manifest, Object.keys(manifest).sort());
+    return createHash('sha256').update(stable).digest('hex');
+}
+/**
+ * Read the TOFU lock file. Returns an empty object if missing or malformed.
+ * @param {string} projectDir
+ * @returns {Record<string, {manifest_sha256: string, artifact_digest?: string, approved_at: string, trust_tier: string}>}
+ */
+export function readTofuLock(projectDir) {
+    const path = join(resolve(projectDir), TOFU_PATH);
+    if (!existsSync(path))
+        return {};
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Persist a TOFU lock file (atomic-ish: write + rename not used since we
+ * append-only to a tiny JSON; conflicting writes from parallel agents
+ * would clobber an entry but `.aperant/driver-tofu.json` is per-project,
+ * not per-agent).
+ *
+ * @param {string} projectDir
+ * @param {Record<string, unknown>} tofu
+ */
+export function writeTofuLock(projectDir, tofu) {
+    const path = join(resolve(projectDir), TOFU_PATH);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(tofu, null, 2) + '\n', 'utf-8');
+}
+/**
+ * Build the canonical TOFU key for a (driver, version) pair. The hash is
+ * NOT part of the key — the value's manifest_sha256 + artifact_digest
+ * detect drift.
+ * @param {string} driverId
+ * @param {string} version
+ * @returns {string}
+ */
+export function tofuKey(driverId, version) {
+    return `${driverId}@${version}`;
+}
+/**
+ * Read the project's policy file. Returns the default policy if missing.
+ * @param {string} projectDir
+ * @returns {{mode: 'first_party_only' | 'allowlist', allowed: string[], denied: string[]}}
+ */
+export function readPolicy(projectDir) {
+    const path = join(resolve(projectDir), POLICY_PATH);
+    const defaults = { mode: 'first_party_only', allowed: [], denied: [] };
+    if (!existsSync(path))
+        return defaults;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        return {
+            mode: parsed.mode === 'allowlist' ? 'allowlist' : 'first_party_only',
+            allowed: Array.isArray(parsed.allowed) ? parsed.allowed : [],
+            denied: Array.isArray(parsed.denied) ? parsed.denied : [],
+        };
+    }
+    catch {
+        return defaults;
+    }
+}
+/**
+ * Decide whether a driver invocation is allowed.
+ *
+ * @param {DriverManifest} manifest
+ * @param {ReturnType<typeof readTofuLock>} tofu
+ * @param {ReturnType<typeof readPolicy>} policy
+ * @returns {{decision: 'allow' | 'deny' | 'requires_approval', reason: string, expected_manifest_sha256?: string}}
+ */
+export function decide(manifest, tofu, policy) {
+    const tier = manifest.trust?.tier;
+    const driverId = manifest.driverId;
+    const version = manifest.version;
+    // Policy denylist always wins.
+    if (policy.denied.includes(driverId)) {
+        return { decision: 'deny', reason: `policy denies driver ${driverId}` };
+    }
+    // first_party_signed: default-allow under either policy mode (unless
+    // explicitly denied above).
+    if (tier === 'first_party_signed') {
+        return { decision: 'allow', reason: 'first_party_signed driver — default allow' };
+    }
+    // first_party_only mode blocks every other tier.
+    if (policy.mode === 'first_party_only') {
+        return {
+            decision: 'deny',
+            reason: `policy.mode=first_party_only blocks ${tier} driver`,
+        };
+    }
+    // allowlist mode: require explicit allow entry AND a valid TOFU lock.
+    if (!policy.allowed.includes(driverId)) {
+        return {
+            decision: 'deny',
+            reason: `policy.mode=allowlist but ${driverId} not in allowed[]`,
+        };
+    }
+    // Check TOFU lock.
+    const key = tofuKey(driverId, version);
+    const entry = tofu[key];
+    const currentHash = manifestSha256(manifest);
+    if (!entry) {
+        return {
+            decision: 'requires_approval',
+            reason: `no TOFU entry for ${key} — first run requires approval`,
+            expected_manifest_sha256: currentHash,
+        };
+    }
+    if (entry.manifest_sha256 !== currentHash) {
+        return {
+            decision: 'requires_approval',
+            reason: `TOFU manifest_sha256 drift for ${key} — driver changed since approval, re-prompt required`,
+            expected_manifest_sha256: currentHash,
+        };
+    }
+    return { decision: 'allow', reason: `TOFU entry valid for ${key}` };
+}
+/**
+ * Persist a one-time approval for a (driver, version) pair into the TOFU
+ * lock. The caller is responsible for actually prompting the user; this
+ * function just writes the entry.
+ *
+ * @param {string} projectDir
+ * @param {DriverManifest} manifest
+ */
+export function recordApproval(projectDir, manifest) {
+    const tofu = readTofuLock(projectDir);
+    const key = tofuKey(manifest.driverId, manifest.version);
+    tofu[key] = {
+        manifest_sha256: manifestSha256(manifest),
+        artifact_digest: manifest.trust?.integrity?.artifact_digest,
+        approved_at: new Date().toISOString(),
+        trust_tier: manifest.trust?.tier,
+    };
+    writeTofuLock(projectDir, tofu);
+}
+//# sourceMappingURL=trust.mjs.map

package/dist/cli/verify-proof/trust.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.mjs","sourceRoot":"","sources":["../../../src/cli/verify-proof/trust.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD;;GAEG;AAEH,MAAM,SAAS,GAAG,2BAA2B,CAAA;AAC7C,MAAM,WAAW,GAAG,sBAAsB,CAAA;AAE1C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAQ;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACrE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAAU;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAA;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,UAAU,EAAE,IAAI;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAA;IACjD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,QAAQ,EAAE,OAAO;IACxC,OAAO,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,UAAU;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACtE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAA;IACtC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QACtD,OAAO;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB;YACpE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC5D,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACzD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,QAAQ,CAAA;IAChB,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAA;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;IAEhC,+BAA+B;IAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,QAAQ,EAAE,EAAE,CAAA;IACxE,CAAC;IAED,qEAAqE;IACrE,4BAA4B;IAC5B,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAA;IAClF,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACxC,OAAO;YACN,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,uCAAuC,IAAI,SAAS;SAC5D,CAAA;IACF,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO;YACN,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,6BAA6B,QAAQ,mBAAmB;SAChE,CAAA;IACF,CAAC;IAED,mBAAmB;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IAE5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO;YACN,QAAQ,EAAE,mBAAmB;YAC7B,MAAM,EAAE,qBAAqB,GAAG,gCAAgC;YAChE,wBAAwB,EAAE,WAAW;SACrC,CAAA;IACF,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,WAAW,EAAE,CAAC;QAC3C,OAAO;YACN,QAAQ,EAAE,mBAAmB;YAC7B,MAAM,EAAE,kCAAkC,GAAG,sDAAsD;YACnG,wBAAwB,EAAE,WAAW;SACrC,CAAA;IACF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,GAAG,EAAE,EAAE,CAAA;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,UAAU,EAAE,QAAQ;IAClD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IACxD,IAAI,CAAC,GAAG,CAAC,GAAG;QACX,eAAe,EAAE,cAAc,CAAC,QAAQ,CAAC;QACzC,eAAe,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,eAAe;QAC3D,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI;KAChC,CAAA;IACD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;AAChC,CAAC"}

package/dist/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aperant",
-  "version": "0.8.1",
+  "version": "0.8.4",
   "description": "AI coding framework — composable skills for planning, executing, verifying, and reviewing code with any LLM provider. Works as Claude Code commands, Codex tasks, or programmatically.",
   "author": {
     "name": "Mikalsen AI",
@@ -25,6 +25,7 @@
     "skills/apt",
     "skills/apt-author-skill",
     "skills/apt-bootstrap",
+    "skills/apt-caveman",
     "skills/apt-classify",
     "skills/apt-close-task",
     "skills/apt-create-docs",
@@ -35,6 +36,7 @@
     "skills/apt-docs",
     "skills/apt-execute",
     "skills/apt-fan-out",
+    "skills/apt-handoff",
     "skills/apt-improve",
     "skills/apt-mockup",
     "skills/apt-pause",

package/dist/plugin/agents/apt-planner.md

@@ -32,7 +32,8 @@ Before planning, discover project context:
 <environment>
 - **Working directory:** The project root
 - **apt-tools:** Always invoke as `node packages/framework/bin/apt-tools.mjs`
-- **Task directory:** Provided in the spawn prompt as `task_dir`. ALL artifacts (spec.md, implementation_plan.json) are written here, NOT to project root.
+- **Task directory:** Provided in the spawn prompt as `task_dir`. It MUST be an absolute path under the main repo's `.aperant/tasks/{task-id}/`. ALL artifacts (spec.md, implementation_plan.json) are written here, NOT to project root and NOT to a worktree-local `.aperant/tasks/` directory.
+- **Worktree path:** If provided, use it only for code investigation/editing context. Do not derive artifact paths from it.
 - **Config:** `.aperant/config.json` — project preferences
 - **State:** `.aperant/state.json` — execution state
 </environment>
@@ -43,7 +44,7 @@ Before planning, discover project context:
 
 1. Read `CLAUDE.md` and `AGENTS.md` if they exist — extract conventions, stack, constraints
 2. Run `node packages/framework/bin/apt-tools.mjs state .` to understand current project state
-3. Parse the task description and task_dir from the spawn prompt
+3. Parse the task description and task_dir from the spawn prompt. If task_dir is relative, resolve the real main repo path first instead of writing under the current worktree.
 
 ## 2. Assess Complexity
 
@@ -211,7 +212,7 @@ If unable to enumerate (network unavailable, action docs unclear), flag it expli
 
 ## 4. Write Specification
 
-The spec.md content format **branches on track** (Pocock adoption ID-05,
+The spec.md content format **branches on track** (ID-05,
 Fast Path Guarantee). QUICK-routed tasks keep the existing 4-section
 shape; STANDARD/DEEP/COMPLEX tasks get a PRD-shaped artifact that
 survives the task as a second-consumer document.
@@ -344,7 +345,7 @@ fix it now, not later.
 
 ## 5. Create Implementation Plan
 
-Subtask schema branches on track (Pocock adoption ID-05 — Fast Path Guarantee).
+Subtask schema branches on track.
 
 ### 5.A. QUICK track / SIMPLE complexity — legacy flat subtask schema
 

package/dist/plugin/skills/apt/SKILL.md

@@ -386,18 +386,27 @@ Parse `task_id`, `task_dir`, and (if present) `worktree.worktree_path` / `worktr
 Important nuances:
 - `task_dir` is an **absolute path** under the main repo's `.aperant/tasks/{task-id}/`. All spec/plan/progress artifacts live there and are shared across worktrees.
 - `apt-tools` commands still receive the **project root** as `<project-dir>` — they coordinate state through the main repo's `.aperant/`. The worktree only affects *code editing* cwd.
-- When spawning an agent, set its `cwd` (or prefix its Bash calls with `cd {worktree_path} &&`) to the worktree. Pass `worktree_path` in the agent's context so it knows where it is.
+- When spawning an agent, set its `cwd` (or prefix its Bash calls with `cd {worktree_path} &&`) to the worktree for code reads/edits. Pass `worktree_path` in the agent's context so it knows where code work happens.
+- Planner artifact safety: do **not** spawn `apt-planner` with host-level worktree isolation that gives it a separate copied repo. The planner must write `spec.md` and `implementation_plan.json` to the absolute main-repo `task_dir` from `task create`; `.aperant/tasks/**` is gitignored, so artifacts written under a disposable worktree can be invisible to git and lost when that worktree is cleaned.
 - If no `worktree` block is returned, proceed in the project root as before.
 
 ### Step 3: Spawn Planner Agent
 
 **If `spawn_agent` is true (STANDARD/DEEP):**
 
-Print phase marker BEFORE spawning:
+Print the phase rail BEFORE spawning. Render the panel verbatim — branch glyphs `┌─ │ └─`, status glyphs `✓` (done) / `●` (active) / `○` (pending), one phase per row, inline metrics on completed rows when available:
+
 ```
 [APT] Phase 1/N — Planning (spawning apt-planner agent)
+┌─ Phase rail: {short task name} ───────────────────
+│  Phase 1 Plan       ●  spawning apt-planner
+│  Phase 2 Execute    ○
+│  Phase 3 Verify     ○
+│  Phase 4 Review     ○
+└───────────────────────────────────────────────────
 ```
-(N = total pipeline phases: e.g. plan+execute+verify+review = 4, discuss+plan+… = 5)
+
+(N = total pipeline phases: e.g. plan+execute+verify+review = 4, discuss+plan+… = 5. Keep the `[APT] Phase X/N` header line — it's the backward-compat marker that external grep tooling relies on. The rail panel sits directly below it.)
 
 You **MUST** use the `Task` tool to spawn `apt-planner` — do NOT write
 `spec.md` or `implementation_plan.json` inline using the `Write` tool. The
@@ -414,8 +423,9 @@ Spawn `apt-planner` via Task tool with context:
 ```
 Task: {task_description}
 Task ID: {task_id}
-Task Dir: {task_dir}
+Task Dir: {task_dir}  # absolute path under the main repo, not under worktree_path
 Track: {track}
+Worktree Path: {worktree_path or "none"}
 
 <files_to_read>
 - CLAUDE.md (if exists)
@@ -423,7 +433,7 @@ Track: {track}
 - Any brainstorm notes at .aperant/context/notes/{task_id}-brainstorm.md
 </files_to_read>
 
-Write spec.md and implementation_plan.json to {task_dir}/
+Write spec.md and implementation_plan.json to {task_dir}/. Do not write plan artifacts to `{worktree_path}/.aperant/tasks/...` or any relative `.aperant/tasks/...` path.
 ```
 
 After the agent returns, emit a token running-total line:
@@ -445,9 +455,32 @@ The user's chosen option has a `pipeline` array (e.g. `["plan", "execute", "veri
 **execution_mode = "auto":**
 Auto-chain without waiting. STANDARD and DEEP auto pipelines both follow Plan → execute → verify → review (DEEP additionally leads with discuss).
 
-Each phase transition MUST emit a status marker for visibility:
+Each phase transition MUST emit a status marker AND re-render the phase rail showing the updated state for ALL phases. The rail is the user's primary signal — render it verbatim, do not summarize or skip.
+
 ```
 [APT] Phase {current}/{total} — {name} (spawning {agent})
+┌─ Phase rail: {short task name} ───────────────────
+│  Phase 1 Plan       ✓  {N} subtasks
+│  Phase 2 Execute    ●  spawning apt-executor
+│  Phase 3 Verify     ○
+│  Phase 4 Review     ○
+└───────────────────────────────────────────────────
+```
+
+Metric conventions per phase row (omit metrics on `○` pending rows):
+- **Plan ✓**: `N subtasks`
+- **Execute ✓**: `N commits, K tests` (or `N/M subtasks` mid-execute on `●`)
+- **Verify ✓**: `APPROVED a/b/c/d` (completeness/correctness/quality/coverage)
+- **Review ✓**: `APPROVE a/b/c/d/e/f, K findings fixed` (or `request-changes, K open`)
+- **Ship ✓**: `PR #N` (the SHIPPED collapsed variant — see below)
+
+When ship completes (lifecycle `shipped-pending-merge` + PR URL exists), collapse to the SHIPPED variant:
+
+```
+┌─ {short task name} ────────────────────── ✅ SHIPPED
+│  Plan ✓ Execute ✓ Verify ✓ Review ✓ Ship ✓
+│  PR #{N}: {url}
+└───────────────────────────────────────────────────
 ```
 
 Full auto-chain sequence (STANDARD = 4 phases, DEEP = 5 phases):
@@ -460,6 +493,42 @@ Full auto-chain sequence (STANDARD = 4 phases, DEEP = 5 phases):
 After EACH agent returns, emit the token running-total line (same pattern
 as Step 3: `tokens tally` then print `[APT] Tokens: input+output = total`).
 
+#### Consent-driven --spar-gates auto-inject (FRAMEWORK-RFC-001)
+
+The route envelope carries the consent signal deterministically — do NOT
+re-read `.aperant/config.local.json` from prompt-space. Two envelope fields
+drive the decision, both emitted by `route.mjs` per spec §4.10:
+
+1. **`envelope.spar_inject_gates`** — present only on the flag-override path
+   (explicit `--quick` / `--deep` / `--debug`) when consent is on AND the
+   user did NOT pass an explicit `--spar-gates`. Value is `"plan"` (STANDARD)
+   or `"plan,execute"` (DEEP). When set, append `--spar-gates <value>` to
+   the chained `/apt:run` invocation. **Do NOT recompute** — the deterministic
+   contract lives in code, not prompt-space.
+
+2. **`envelope.spar_consent`** — present on the host-LLM classify path.
+   Shape: `{ enabled: boolean, partner: string|null, user_passed_explicit_gates: boolean }`.
+   After you (the host model) pick a track via Step 0c:
+   - **Track === QUICK or DEBUG: do NOT inject.** QUICK is Fast-Path-exempt
+     (CLAUDE.md Fast Path Guarantee); DEBUG produces no spec/plan to spar
+     against.
+   - **Track === STANDARD** AND `spar_consent.enabled === true` AND
+     `spar_consent.user_passed_explicit_gates === false`: append
+     `--spar-gates plan` to the `/apt:run` invocation.
+   - **Track === DEEP** AND `spar_consent.enabled === true` AND
+     `spar_consent.user_passed_explicit_gates === false`: append
+     `--spar-gates plan,execute` to the `/apt:run` invocation.
+   - `user_passed_explicit_gates === true`: the user already supplied
+     `--spar-gates` — do NOT double-inject. Their flag is already in the
+     dispatched invocation.
+
+If `envelope.spar_consent` is absent (consent never configured) AND
+`envelope.spar_inject_gates` is absent, do NOT inject. The signal is
+**deterministic** — Step 4 reads ONLY the envelope fields above. Do NOT
+re-read `.aperant/config.local.json` from prompt-space; the
+consent-resolution helper is wired into `route.mjs` and the envelope is
+the canonical contract. The structural test grep-locks this invariant.
+
 **execution_mode = "step" or "research":**
 After each stage in the pipeline, show result and ask before proceeding:
 ```

package/dist/plugin/skills/apt-caveman/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: apt:caveman
+description: "Ultra-compressed communication mode — toggle terse 'smart caveman' output to cut token usage ~75% while keeping full technical accuracy"
+apt-skill-version: {{APT_VERSION}}
+stage: ops
+intent: configure
+when_to_use: "The user invokes /apt:caveman, or says 'caveman mode', 'talk like caveman', 'be brief', 'less tokens'. Toggles a persistent terse output mode. Off with 'stop caveman' or 'normal mode'."
+user_invocable: true
+internal: false
+spawns_agent: false
+agent_name: null
+task_context: none
+default_execution_mode: auto
+execution_modes:
+  - auto
+allowed-tools: ""
+argument-hint: "apt:caveman"
+gates: []
+---
+
+Respond terse like smart caveman. All technical substance stay. Only fluff die.
+
+## Persistence
+
+ACTIVE EVERY RESPONSE once triggered. No revert after many turns. No filler drift. Still active if unsure. Off only when user says "stop caveman" or "normal mode".
+
+## Rules
+
+Drop: articles (a/an/the), filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging. Fragments OK. Short synonyms (big not extensive, fix not "implement a solution for"). Abbreviate common terms (DB/auth/config/req/res/fn/impl). Strip conjunctions. Use arrows for causality (X -> Y). One word when one word enough.
+
+Technical terms stay exact. Code blocks unchanged. Errors quoted exact.
+
+Pattern: `[thing] [action] [reason]. [next step].`
+
+Not: "Sure! I'd be happy to help you with that. The issue you're experiencing is likely caused by..."
+Yes: "Bug in auth middleware. Token expiry check use `<` not `<=`. Fix:"
+
+### Examples
+
+**"Why React component re-render?"**
+
+> Inline obj prop -> new ref -> re-render. `useMemo`.
+
+**"Explain database connection pooling."**
+
+> Pool = reuse DB conn. Skip handshake -> fast under load.
+
+## Auto-Clarity Exception
+
+Drop caveman temporarily for: security warnings, irreversible action confirmations, multi-step sequences where fragment order risks misread, user asks to clarify or repeats question. Resume caveman after clear part done.
+
+Example — destructive op:
+
+> **Warning:** This will permanently delete all rows in the `users` table and cannot be undone.
+>
+> ```sql
+> DROP TABLE users;
+> ```
+>
+> Caveman resume. Verify backup exist first.
+
+## Boundaries
+
+Code, commits, PRs: write normal (full sentences in commit bodies / PR descriptions). Only conversational output is compressed. `stop caveman` / `normal mode` reverts.

package/dist/plugin/skills/apt-debug/SKILL.md

@@ -22,7 +22,7 @@ gates: []
 <objective>
 Debug an issue using the scientific method: observe symptoms, form hypotheses, test them systematically, and reach a conclusion. State persists across context resets via `.aperant/debug/{session-id}/DEBUG.md`.
 
-**Diagnose-discipline posture loader (Pocock adoption AC10).** You MUST
+**Diagnose-discipline posture loader.** You MUST
 load `appendices/diagnose-discipline.md` into reasoning context at
 session start. It carries the 6-phase loop (Reproduce → Minimise →
 Hypothesise → Instrument → Fix → Regression-test) and the **Phase-1
@@ -61,12 +61,44 @@ reproduction, so loading this appendix is non-trivial.
 ## 1. Initialize or Resume Session
 
 Parse `$ARGUMENTS`:
-- **New session:** Generate session ID from timestamp (`debug-YYYYMMDD-HHmm`)
-- **`--resume <session-id>`:** Read existing `.aperant/debug/{session-id}/DEBUG.md` and continue from last state
-- **`--resume` (no id):** Find the most recent session in `.aperant/debug/` and resume it
+- **New session:** resolve a canonical task id (see 1a below), then use it as the `{session-id}` for the debug working directory.
+- **`--resume <session-id>`:** Read existing `.aperant/debug/{session-id}/DEBUG.md` and continue from last state. Skip Section 1a — the session id is already canonical.
+- **`--resume` (no id):** Find the most recent session in `.aperant/debug/` and resume it. Skip Section 1a.
 
 If resuming, read DEBUG.md and skip to the current phase (observe/hypothesize/test/conclude).
 
+### 1a. Resolve canonical task id (idempotent — new sessions only)
+
+DEBUG now produces a canonical state.active_tasks record so `/apt:ship` can find the task via the lite ship profile once the fix is committed. The body owns idempotency because `apt-tools task create` does NOT guard against existing ids (see spec §3 R8).
+
+Two invocation paths converge here:
+
+- **Router path** (`/apt` → `/apt:debug`): the router has already called `task create` and injected `task_id` into your skill context.
+- **Direct path** (`/apt:debug foo`): no `task_id` in context — you create one now.
+
+Sequence:
+
+1. **If `task_id` is present in skill context** (router path):
+   ```bash
+   apt-tools task get . --id {task_id}
+   ```
+   - If exit 0 AND the returned record has `track === "DEBUG"` → reuse, skip the create call. Adopt `task_id` as `{session-id}`.
+   - Else (record missing OR wrong track) → call:
+     ```bash
+     apt-tools task create . --description "$ARGUMENTS" --track DEBUG --id {task_id}
+     ```
+     Adopt the id as `{session-id}`.
+
+2. **If no `task_id` in skill context** (direct path):
+   ```bash
+   apt-tools task create . --description "$ARGUMENTS" --track DEBUG
+   ```
+   Parse the generated `task_id` from the envelope and adopt it as `{session-id}`. The canonical id replaces the legacy `debug-YYYYMMDD-HHmm` form.
+
+The debug working dir at `.aperant/debug/{session-id}/` stays — that working artifact is preserved (per spec §3 R7). The canonical task record at `.aperant/tasks/{task-id}/` is created in parallel by `task create`, and both share the same id.
+
+### 1b. Create debug working directory
+
 ```bash
 mkdir -p .aperant/debug/{session-id}
 mkdir -p .aperant/debug/{session-id}/checkpoints

package/dist/plugin/skills/apt-debug/appendices/diagnose-discipline.md

@@ -1,12 +1,3 @@
-<!--
-Adapted from Matt Pocock's MIT-licensed skill suite:
-https://github.com/mattpocock/skills/blob/main/skills/engineering/diagnose
-Licensed under MIT. Modifications: ported as an apt:debug posture loader
-so the 6-phase loop attaches to the existing 5-phase apt:debug body
-without forking apt:debug's control flow. Aligned with apt:debug's
-DEBUG.md state file and checkpoint conventions.
--->
-
 # Diagnose Discipline — apt:debug posture loader (6-phase loop)
 
 This appendix loads into `apt:debug`'s reasoning context as a posture
@@ -15,7 +6,7 @@ upgrade. The existing apt:debug body has 5 phases (Observe → Hypothesize
 symptom-gathering with reproduction. Open question #1 was verified — the
 gap is real, the appendix is non-trivial.
 
-This appendix carries the 6-phase Pocock discipline. The skill body
+This appendix carries the 6-phase Aperant discipline. The skill body
 loads it and uses Phase 1 (Reproduce) as a **hard prerequisite** before
 advancing from Observe to Hypothesize.
 
@@ -82,7 +73,7 @@ run on demand to trigger the failure.
 
 These are different mental modes. Minimise asks "what's the smallest
 thing that still fails?" — a reductive activity. Hypothesise asks
-"WHY does it fail?" — an explanatory activity. Pocock's discipline
+"WHY does it fail?" — an explanatory activity. the discipline
 separates them because skipping Phase 2 and going straight from "I can
 repro" to "here's why" tends to anchor on the first plausible cause
 and miss alternatives.

package/dist/plugin/skills/apt-discuss/SKILL.md

@@ -47,7 +47,7 @@ These are two postures of the same skill, not two different skills. The
 intent-detection step below decides which one to enter — same file, same
 artifact layout, different section populated.
 
-**Decision-lock posture loader (Pocock adoption ID-02 + ID-04 — AC11).**
+**Decision-lock posture loader (ID-02 + ID-04 — AC11).**
 When entering decision-lock posture, you MUST load
 `appendices/grill-discipline.md` into reasoning context. It carries the
 validated 100-token reframe sentence ("Your job is not to emit a plan;
@@ -60,7 +60,7 @@ source for the autonomy-aware rule; downstream skills (`apt:improve`,
 `apt:triage`) reference it rather than re-stating the policy. Brainstorm
 posture does NOT load this appendix.
 
-**Brainstorm posture zoom-out helper (Pocock adoption AC6 + AC11).**
+**Brainstorm posture zoom-out helper (AC6 + AC11).**
 When in brainstorm posture and the user's turn contains a zoom-out
 trigger phrase ("give me a broader picture", "I'm lost in this area",
 "explain how this fits", "what's the surrounding architecture", "zoom
@@ -565,9 +565,9 @@ Review-Auto is Auto Mode **plus one human checkpoint at the batch end**. It does
 
 Do NOT introduce per-decision staging ("show me D-01, wait, show me D-02, wait...") — that collapses review-auto into spaced interactive mode and defeats the point of joint reasoning up front. Do NOT skip the pause ("autonomy is high, let's just write it") — that collapses review-auto into auto. The one pause at the end is the whole identity of this mode.
 
-## 6.5. Grill Mode (`--grill` flag — Pocock `grill-with-docs` overlay)
+## 6.5. Grill Mode (`--grill` flag — Aperant `grill-with-docs` overlay)
 
-**Activate when:** the user invoked the skill with `--grill`. This is an **overlay**, not a mode — it stacks on top of whichever Section 6 mode is active (Interactive by default; combine with `--auto` etc. as desired). The overlay does two things: (1) it applies Pocock's 4 grill moves during decision resolution; (2) it fires inline writes to CONTEXT.md and ADRs as terms resolve and decisions pass the Nygard 3-gate.
+**Activate when:** the user invoked the skill with `--grill`. This is an **overlay**, not a mode — it stacks on top of whichever Section 6 mode is active (Interactive by default; combine with `--auto` etc. as desired). The overlay does two things: (1) it applies the 4 grill moves during decision resolution; (2) it fires inline writes to CONTEXT.md and ADRs as terms resolve and decisions pass the Nygard 3-gate.
 
 The discipline this overlay loads is already in [`appendices/grill-discipline.md`](./appendices/grill-discipline.md) — re-read the reframe sentence and the autonomy degradation table before each grill turn. **Do NOT duplicate that content here.** What follows is only the moves + writer-call instructions specific to the overlay.