@appchy/jarvis 0.1.132 → 0.1.133

package/dist/bin.js

@@ -10402,7 +10402,7 @@ import { createRequire as createRequire2 } from "module";
 var _require = createRequire2(import.meta.url);
 var VERSION2 = _require("../package.json").version ?? "0.0.0";
 var IS_DEV = String(_require("../package.json").name ?? "").endsWith("-dev");
-var SHA = "361e631";
+var SHA = "9b15888";
 var BUILT = "2026-09-12";
 var BUILD = SHA ?? "source";
 var BUILD_LABEL = `${SHA ? `${VERSION2} (${SHA}${BUILT ? ` ${BUILT}` : ""})` : `${VERSION2} (source)`}${IS_DEV ? " \u2014 development build" : ""}`;

package/harness/harness/config.py

@@ -167,6 +167,16 @@ DEFAULTS = {
     # interpolated. A repo may run anything it likes; what it may not do is get a
     # `;` to mean `;`.
     "verify": {},
+    # How much open work an epic and a cut may hold before the board says so. Counted in
+    # OPEN tasks, because what is hard to plan together or to close is what is still owed.
+    # Neither is a gate: an epic past its ceiling warns and a written `one_goal:` answers
+    # it; a cut past its ceiling is flagged as owing a reshape and nothing is refused or
+    # routed. The numbers are a repo's own — a harness serving repos of very different
+    # sizes cannot know them — and these are only what a repo that sets nothing gets.
+    "ceilings": {
+        "epic": 8,
+        "cut": 15,
+    },
     "autonomy": {
         # The highest `tier:` an unattended run acts on ALONE. Default 2 — a
         # scheduled shift does ordinary work and stops at the irreversible.
@@ -458,6 +468,12 @@ def _validate(cfg: dict) -> None:
                     f"without a shell (shell=False), so shell operators would be "
                     f"passed as literal arguments. Put the composition in a script "
                     f"and call that.")
+    for key in ("epic", "cut"):
+        value = cfg["ceilings"][key]
+        # `bool` is an `int` in Python, and `true` is not a number of tasks.
+        if not isinstance(value, int) or isinstance(value, bool) or value < 1:
+            raise ConfigError(f"ceilings.{key} must be a whole number of open tasks, 1 or more "
+                              f"(got {value!r}) — 0 would flag every {key} that holds any open work")
     ceiling = cfg["autonomy"]["ceiling"]
     if not isinstance(ceiling, int) or isinstance(ceiling, bool) or not 0 <= ceiling <= 3:
         raise ConfigError("autonomy.ceiling must be an integer 0–3 (the highest "
@@ -650,6 +666,10 @@ def apply(cfg: dict) -> None:
     gate.VERIFY = dict(cfg["verify"])
     task.PLANS_DIR = cfg["plans"]["dir"]
     autonomy.CEILING = cfg["autonomy"]["ceiling"]
+    # Read through `tree` by the lint and the model, never imported by name, so binding it
+    # here is what makes a repo's own number the one in force.
+    tree.EPIC_TASK_CEILING = cfg["ceilings"]["epic"]
+    tree.CUT_TASK_CEILING = cfg["ceilings"]["cut"]
     # `shift` reads the ceiling it was imported with, so bind it there too — a
     # module-level `from … import CEILING` captures the value, not the name.
     shift.CEILING = cfg["autonomy"]["ceiling"]

package/harness/harness/epic.py

@@ -6,6 +6,7 @@ from .frontmatter import rewrite_file
 from .model import epic_home, locate_epic, locate_version
 from .scaffold import _check_covers_ref, _check_kebab, _check_unused, _scaffold_epic
 from .generate import _sync
+from .lint import say_ceiling
 from . import events, links
 
 
@@ -210,6 +211,9 @@ def cmd_epic_move(args) -> int:
         )
     print(f"pulled epic '{name}' ({was}) -> {rel(dest, root)}  "
           f"with {len(moved)} task(s)")
+    # A whole epic arriving is the likeliest way a cut goes past its ceiling in one
+    # move, so it is told exactly as filing or placing a single task is.
+    say_ceiling(root, version.name)
     _sync(root)
     return 0
 #: Headings whose content is a STATEMENT ABOUT THE WORLD rather than a plan for one

package/harness/harness/lint.py

@@ -13,7 +13,7 @@ from .tree import (
 )
 from .frontmatter import as_list, parse_frontmatter, split_frontmatter
 from . import tree as _tree
-from .model import locate_feature, scan, scan_features, scan_filed
+from .model import locate_feature, locate_version, scan, scan_features, scan_filed
 from .registry import code_vocabulary, locate_domain
 
 #: The MCP server this repo names as its graph engine, bound by `config.apply`.
@@ -591,6 +591,17 @@ def ceiling_note(version) -> str:
             f"its version.md")
 
 
+def say_ceiling(root, version_name: str) -> None:
+    """Tell whoever just added work to a cut that it is past its ceiling, if it is.
+
+    One home for every command that lands work in a cut — filing a task, placing one,
+    moving a whole epic — so a new way in cannot forget to say it."""
+    landed = locate_version(root, version_name)
+    note = ceiling_note(landed) if landed else ""
+    if note:
+        print(f"note: {note}")
+
+
 def print_lint(root: Path):
     for w in lint_warnings(root):
         print(f"  WARN  {w}", file=sys.stderr)

package/harness/harness/shift.py

@@ -27,6 +27,7 @@ from .tree import BLOCKED, BUCKETS, die, find_work_root, rel
 from .frontmatter import rewrite_file
 from .model import locate, record_session, scan
 from .generate import _sync
+from .lint import ceiling_note
 from .epic import plans_held
 from . import autonomy, events, holders, links, peers
 # The ceiling is read through the MODULE, never bound in with `from … import`.
@@ -251,7 +252,14 @@ def cmd_status(args) -> int:
     # every epic plan and cannot be undone — so this announces and never acts, and it
     # quotes the price so the decision is made with it visible rather than after.
     ready = [v for v in s["versions"] if v.finishable()]
-    print(f"WAITING ON YOU  ({len(waiting) + len(ready)})")
+    # A cut past its ceiling owes a reshape, and where its work goes is a person's call —
+    # so it waits on them HERE, beside a finished cut nobody has closed, rather than only
+    # scrolling past as a warning after some unrelated write. Same sentence as the
+    # warning, from the one function that words it.
+    full = [v for v in live if v.over_ceiling()]
+    print(f"WAITING ON YOU  ({len(waiting) + len(ready) + len(full)})")
+    for v in full:
+        print(f"  {ceiling_note(v)}")
     for v in ready:
         plans, size, held = plans_held(v)
         cost = ""
@@ -264,7 +272,7 @@ def cmd_status(args) -> int:
     for t, q in waiting[:8]:
         parts = q.split("  ")
         print(f"  {t.name}: {'  '.join(parts[2:]) if len(parts) > 2 else q}")
-    if not waiting and not ready:
+    if not waiting and not ready and not full:
         print("  nothing — the shift is not blocked on you.")
 
     # One read of the record, shared by every section below. It is a `git log`

package/harness/harness/task.py

@@ -15,6 +15,7 @@ from .registry import code_vocabulary
 from .scaffold import _check_kebab, _check_owner_ref, _check_priority, _check_unused, _scaffold_handoff, _scaffold_task
 from .epic import _bucketed, cmd_epic_move, epic_for_task
 from .generate import _sync
+from .lint import say_ceiling
 from .gate import delivery_gate, report_gate
 from .autonomy import _open_questions, derive_tier
 from . import events
@@ -122,6 +123,12 @@ def cmd_new(args) -> int:
                   epic=epic.name)
     print(f"created {rel(folder / 'task.md', root)}  ({home})")
     print(f"        tier {tier} — {tier_why}")
+    # Filing into a full cut is never refused and never re-routed: where this task
+    # belongs is a planning call. What the caller is owed is the fact, addressed to
+    # them as a `note:` — which a door relaying the harness's words hands to an agent,
+    # rather than leaving it in the board-wide warnings nobody filing over a tool sees.
+    if version_name:
+        say_ceiling(root, version_name)
     _sync(root)
     return 0
 def cmd_place(args) -> int:
@@ -198,6 +205,9 @@ def cmd_place(args) -> int:
     if restored:
         events.append(root, "restored", name, to=f"{version.name}/{epic.name}")
     print(f"{'restored' if restored else 'placed'} '{name}' -> {rel(dest, root)}")
+    # Placing is a person arranging a cut on purpose, and a pre-planned cut is legal —
+    # so it is told, never stopped, exactly as filing is.
+    say_ceiling(root, version.name)
     _sync(root)
     return 0
 

package/harness/presets/appchy/PRESET.md

@@ -329,7 +329,16 @@ design is done ONCE for a whole goal; at one or two tasks there is no "whole goa
 - **Under the floor with real depth behind it → cut the tasks, don't merge.** An epic whose Plan lists
   five slices and has one folder is *under-cut*. An epic with **zero** tasks is the worst case: a goal
   nobody has cut work for has not been planned, only wished.
-- **The floor is a floor, not a target.** A long-running epic at nine tasks is fine.
+- **The floor is a floor, and there is a ceiling too.** Past **8 open tasks** an epic warns: it is no
+  longer a goal anybody plans together. Split it along its goals, or say why its size is deliberate in
+  `one_goal:`. Open tasks only — a long-running epic whose work has mostly shipped is fine at any size.
+  (This bullet used to say "a long-running epic at nine tasks is fine", which the ceiling made false.)
+- **A cut has a ceiling of 15 open tasks, summed across its epics, and a full cut is FLAGGED — never
+  refused, never routed.** Filing into one still lands where you filed it; the board then says a
+  reshape is owed until somebody resolves it — a later cut, or a reshaped epic — so the cut that closes
+  is not a half-built one. **That call is a person's: an agent parks it rather than moving work.** A cut
+  planned big on purpose says why in `one_goal:` in its `version.md`. The number of epics is not
+  bounded, only the sum. Both numbers are a repo's to set, under `ceilings` in its config.
 
 **Merging epics is prose work, not folder work.** Moving the folders takes one `mv`; what matters is
 that the surviving `epic.md` absorbs every settled call from the ones being dissolved *before* their

package/harness/schema/work.config.schema.json

@@ -185,6 +185,25 @@
       "default": {},
       "description": "Commands run to verify work, by name — e.g. {\"test\": \"<this repo's test command>\"}. Free-form because toolchains differ, and naming one here would ship a bias. EXECUTED by `work verify` and required by the completion gate: a task cannot reach complete/ without a passing record. Each is split with shlex and run with shell=False, so shell operators (&&, ||, ;, |, >, $(), backticks) are REFUSED at load rather than passed to the first binary as literal arguments — put the composition in a script and call that."
     },
+    "ceilings": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "How much OPEN work an epic and a cut may hold before the board says so. Neither is a gate: an epic past its ceiling warns and a written `one_goal:` answers it; a cut past its ceiling is flagged as owing a reshape — move work to a later cut, or reshape an epic — and nothing is refused or routed, because where a task belongs is a person's call.",
+      "properties": {
+        "epic": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 8,
+          "description": "Open tasks an epic may hold before it warns that it is no longer a goal anybody plans together."
+        },
+        "cut": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 15,
+          "description": "Open tasks a cut may hold, summed across its epics, before it is flagged as owing a reshape. The number of epics is not bounded, only this sum."
+        }
+      }
+    },
     "autonomy": {
       "type": "object",
       "additionalProperties": false,

package/harness/test_work.py

@@ -6645,6 +6645,10 @@ def test_every_shipped_default_is_mechanics_or_nothing():
         # On by default like its two siblings, and for their reason: a hook the
         # harness ships is its own mechanics, not a fact about somebody's setup.
         "hooks.pre_tool_use.enabled",
+        # How big the harness's own tiers may get before it says so — its model, like
+        # the autonomy ceiling beside it. The numbers were chosen against live counts
+        # across four boards, and a repo that disagrees sets its own.
+        "ceilings.epic", "ceilings.cut",
     }
     shipped = set()
 
@@ -9005,6 +9009,197 @@ def test_the_readme_never_shows_an_archived_item():
         finally:
             os.environ.pop("WORK_DIR")
 
+
+# ---------------------------------------------------------------------------
+# A cut has a ceiling — and an epic does too.
+#
+# Nothing bounded how much a board may describe. mixbrix filed 73 items in one day
+# and reached 690; this repo's own cut 02 reached 24 open. Founder's calls,
+# 2026-09-12: count OPEN tasks, 8 per epic and 15 per cut by default, per repo. An
+# epic past its ceiling warns and a written `one_goal:` answers it. A cut past its
+# ceiling is FLAGGED as owing a reshape — never refused and never routed, because
+# where a task belongs is a planning call: "it should be resolved and either be in a
+# new cut or the epic, depends on the task … to make sure we dont land a half baked
+# cut".
+# ---------------------------------------------------------------------------
+
+
+def _open_epic(v: Path, name: str, queued: int = 0, done: int = 0, one_goal: str = ""):
+    e = _epic(v, name, owner="quality", one_goal=one_goal)
+    for bucket, n in (("queue", queued), ("complete", done)):
+        for i in range(n):
+            _task(e / bucket, f"{name}-{bucket}-{i}")
+    return e
+
+
+def _ceiling_warnings(root: Path, needle: str) -> list:
+    return [w for w in lint.lint_warnings(root) if needle in w]
+
+
+def test_an_epic_warns_only_once_it_is_past_its_ceiling_of_open_tasks():
+    # AT the ceiling is legal; one past it is not. Asserted side by side, because an
+    # off-by-one here is the difference between a guard and a nag.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp, "26-cut")
+        _open_epic(v, "at-the-ceiling", queued=8)
+        _open_epic(v, "one-past-it", queued=9)
+        warned = _ceiling_warnings(Path(tmp), "open task(s)")
+        assert not any("at-the-ceiling" in w for w in warned), warned
+        assert any("one-past-it" in w for w in warned), warned
+
+
+def test_finished_work_does_not_count_against_an_epic():
+    # An epic whose work has mostly shipped is not hard to plan together. Counting
+    # finished tasks would warn on every long-lived goal about work nobody is still
+    # doing — which is why this bound counts OPEN tasks while the floor counts all.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp, "26-cut")
+        _open_epic(v, "mostly-shipped", queued=3, done=20)
+        assert not _ceiling_warnings(Path(tmp), "open task(s)")
+
+
+def test_an_epic_that_wrote_why_its_size_is_deliberate_is_not_warned():
+    # The same written escape the floor and the region cap already honour — not a
+    # fourth mechanism. An empty one would exempt nothing, as it does for those.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp, "26-cut")
+        _open_epic(v, "big-on-purpose", queued=12, one_goal="one migration, cut in steps")
+        assert not _ceiling_warnings(Path(tmp), "open task(s)")
+
+
+def test_a_cut_is_flagged_when_its_SUMMED_open_tasks_pass_its_ceiling():
+    # Two epics of eight and seven: neither warns on its own, and the cut is exactly
+    # full. One more open task anywhere and the cut owes a reshape. Epic COUNT is not
+    # bounded — only the sum — so splitting an epic can never make this worse.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp)
+        v = _tree(tmp, "26-cut")
+        _open_epic(v, "half-a", queued=8)
+        _open_epic(v, "half-b", queued=7)
+        assert model.locate_version(root, "26-cut").over_ceiling() == 0
+        _open_epic(v, "one-more", queued=1, done=5)
+        assert model.locate_version(root, "26-cut").over_ceiling() == 1
+        assert len(_ceiling_warnings(root, "past its ceiling")) == 1
+        assert not _ceiling_warnings(root, "open task(s)"), "no single epic is past 8"
+
+
+def _full_cut(v: Path) -> Path:
+    """Two epics at exactly their ceiling of eight: neither warns on its own, and the
+    cut is one past its ceiling of fifteen. Returns the first, to file into."""
+    first = _open_epic(v, "a", queued=8)
+    _open_epic(v, "b", queued=8)
+    return first
+
+
+def test_the_cut_flag_names_both_ways_out_and_whose_call_it_is():
+    # A flag that only says "too many" leaves the reader to invent the remedy, and the
+    # remedy an agent invents is moving work around — exactly the call that is not
+    # its to make.
+    with tempfile.TemporaryDirectory() as tmp:
+        _full_cut(_tree(tmp, "26-cut"))
+        [flag] = _ceiling_warnings(Path(tmp), "past its ceiling")
+        assert "later cut" in flag and "reshape an epic" in flag, flag
+        assert "person's call" in flag, flag
+
+
+def test_filing_into_a_full_cut_is_never_refused_and_never_rerouted():
+    # The founder's call in one assertion: the item lands exactly where it was filed.
+    # A refusal mid-sweep is what sessions route around, and a silent reroute decides
+    # which half of a goal ships.
+    with tempfile.TemporaryDirectory() as tmp:
+        full = _full_cut(_tree(tmp, "26-cut"))
+        with _work_dir(tmp) as root:
+            assert model.locate_version(root, "26-cut").over_ceiling() == 1
+            assert task.cmd_new({"name": "one-more-thing", "epic": "a"}) == 0
+            assert (full / "queue" / "one-more-thing" / "task.md").is_file()
+            assert model.locate_version(root, "26-cut").over_ceiling() == 2
+
+
+def test_placing_a_whole_epic_into_a_full_cut_is_told_too():
+    # A whole epic arriving is the likeliest way a cut goes past its ceiling in one
+    # move, and it runs through a different command from filing a single task.
+    import io, contextlib
+    with tempfile.TemporaryDirectory() as tmp:
+        _full_cut(_tree(tmp, "26-cut"))
+        later = Path(tmp) / "versions" / "27-next"
+        later.mkdir(parents=True)
+        (later / "version.md").write_text(
+            "---\ncreated: 2026-08-01\norder: 27\noutcome: y\n---\n\n# Next\n")
+        _open_epic(later, "arriving", queued=2)
+        out = io.StringIO()
+        with _work_dir(tmp), contextlib.redirect_stdout(out):
+            assert task.cmd_place({"name": "arriving", "version": "26-cut"}) == 0
+        assert "note: cut 26-cut: 18 open tasks, 3 past its ceiling" in out.getvalue(), \
+            out.getvalue()
+
+
+def test_a_cut_that_wrote_why_its_size_is_deliberate_is_not_flagged():
+    # Planning a big release in advance stays legal. What the flag exists for is
+    # accretion, and the difference is recorded rather than guessed.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp)
+        v = _tree(tmp, "26-cut")
+        md = v / "version.md"
+        md.write_text(md.read_text().replace(
+            "---\n\n# Cut", 'one_goal: "planned as one release on purpose"\n---\n\n# Cut'))
+        _full_cut(v)
+        assert model.locate_version(root, "26-cut").over_ceiling() == 0
+        assert not _ceiling_warnings(root, "past its ceiling")
+
+
+def test_a_released_cut_owes_no_reshape():
+    with tempfile.TemporaryDirectory() as tmp:
+        _full_cut(_tree(tmp, "26-cut", released="2026-09-01"))
+        assert model.locate_version(Path(tmp), "26-cut").over_ceiling() == 0
+
+
+def test_list_and_the_readme_show_a_full_cut_beside_its_status():
+    # Being full is not a status — a cut can be planned or current and still owe a
+    # reshape — so it is printed beside the badge rather than replacing it.
+    import io, contextlib
+    with tempfile.TemporaryDirectory() as tmp:
+        _full_cut(_tree(tmp, "26-cut"))
+        out = io.StringIO()
+        with _work_dir(tmp) as root:
+            with contextlib.redirect_stdout(out):
+                report.cmd_list({})
+            generate._sync(root)
+        assert "over its ceiling by 1" in out.getvalue(), out.getvalue()
+        assert "Over its ceiling by 1" in (root / "README.md").read_text()
+
+
+def test_a_repo_sets_its_own_ceilings_and_every_reader_honours_them():
+    # The harness serves repos of very different sizes, so the numbers are config.
+    # Read THROUGH THE MODULE: a `from .tree import` would capture the shipped default
+    # and quietly ignore the repo's own, which is the drift the harness keeps finding.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp)
+        _full_cut(_tree(tmp, "26-cut"))
+        assert model.locate_version(root, "26-cut").over_ceiling() == 1
+        cfg = copy.deepcopy(config.DEFAULTS)
+        cfg["ceilings"] = {"epic": 5, "cut": 20}
+        config.apply(cfg)
+        try:
+            assert model.locate_version(root, "26-cut").over_ceiling() == 0
+            assert len(_ceiling_warnings(root, "open task(s)")) == 2, "8 open is past a ceiling of 5"
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_ceiling_must_be_a_positive_whole_number():
+    # A ceiling of 0 flags every cut with any work in it, and a string never compares
+    # — so it is refused at load, naming the key, rather than discovered later as a
+    # board that warns about everything or about nothing.
+    for key in ("epic", "cut"):
+        for bad in (0, -1, "15", 1.5, True):
+            with tempfile.TemporaryDirectory() as tmp:
+                repo = _repo_with_config(tmp, {"ceilings": {key: bad}})
+                try:
+                    config.load(repo)
+                    assert False, f"accepted ceilings.{key} = {bad!r}"
+                except config.ConfigError as e:
+                    assert f"ceilings.{key}" in str(e) and f"every {key} " in str(e), e
+
 if __name__ == "__main__":
     tests = [v for k, v in sorted(globals().items())
              if k.startswith("test_") and callable(v)]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.132",
+  "version": "0.1.133",
   "description": "Jarvis — local AI coding assistant CLI",
   "private": false,
   "type": "module",