@appchy/jarvis 0.1.85 → 0.1.87

package/dist/bin.js

@@ -10114,7 +10114,7 @@ import { createRequire as createRequire2 } from "module";
 var _require = createRequire2(import.meta.url);
 var VERSION2 = _require("../package.json").version ?? "0.0.0";
 var IS_DEV = String(_require("../package.json").name ?? "").endsWith("-dev");
-var SHA = "f9f9db3";
+var SHA = "bf7fe32";
 var BUILT = "2026-09-11";
 var BUILD = SHA ?? "source";
 var BUILD_LABEL = `${SHA ? `${VERSION2} (${SHA}${BUILT ? ` ${BUILT}` : ""})` : `${VERSION2} (source)`}${IS_DEV ? " \u2014 development build" : ""}`;

package/harness/harness/config.py

@@ -548,12 +548,11 @@ def _validate(cfg: dict) -> None:
         # would commit files nobody asked about. Refused at load, where it is one
         # message, rather than at the commit, where it is a surprise in somebody's
         # history.
-        if Path(p).is_absolute() or ".." in Path(p).parts:
+        if _escapes(p):
             raise ConfigError(f"git.paths entry {p!r} must be repo-relative and stay "
                               f"inside the repo")
     shard = cfg["coverage"]["shard"]
-    if (not isinstance(shard, str) or not shard.strip()
-            or Path(shard).is_absolute() or ".." in Path(shard).parts):
+    if not isinstance(shard, str) or not shard.strip() or _escapes(shard):
         raise ConfigError("coverage.shard must be a repo-relative directory where "
                           "test runners drop their evidence, e.g. \".work/coverage\"")
     at = cfg["wrap"]["at_percent"]
@@ -587,6 +586,19 @@ def _validate(cfg: dict) -> None:
                           "session up, or null to remind without naming one")
 
 
+def _escapes(value: str) -> bool:
+    """Could this path reach outside the repo it is written in?
+
+    Every path a repo names in its config is joined onto the repo root, so an
+    absolute one silently becomes the whole answer and a `..` walks out. One reader
+    for the question, because the two places that ask it — what a board write
+    commits, and where the runners drop their evidence — would otherwise each carry
+    their own copy of the same two conditions.
+    """
+    p = Path(value)
+    return p.is_absolute() or ".." in p.parts
+
+
 def load(repo: Path) -> dict:
     """The merged config for a repo. Missing file → the defaults, which is a
     working configuration and not an error: a fresh install must run."""
@@ -1425,7 +1437,13 @@ def _cmd_config_write(args) -> int:
         # and refusing to remove it would leave the only tool that can fix it
         # refusing on the grounds that the thing being fixed is broken.
         parts = [seg for seg in dotted.split(".") if seg]
-        if args["_verb"] != "unset" or not _present(raw, parts):
+        # `not parts` is the empty key, and it is the one thing this branch must not
+        # take for a repair: `_present` answers True for a path of no segments — the
+        # file trivially "contains" nothing — so an empty name walked straight past
+        # the check and into `parts[-1]`, which is an IndexError traceback on the
+        # command an installer shells out to. A key that names nothing is refused
+        # with the message the loader already wrote for it.
+        if args["_verb"] != "unset" or not parts or not _present(raw, parts):
             raise
         unknown = True
 

package/harness/harness/coverage.py

@@ -90,9 +90,16 @@ def cmd_coverage(args) -> int:
         return 0
 
     only = args.get("feature")
-    rows, totals = [], {"declared": 0, "built": 0, "proven": 0, "failed": 0,
-                        "todo": 0, "gap": 0, "ahead": 0, "eyes": 0, "unbuilt": 0,
-                        "unlevelled": 0}
+    # `built` is every criterion TICKED, and `provable` is the run-provable part of
+    # it — built minus the ones only a person can settle. They were one number under
+    # the name `built`, holding the value of `provable`, and that single misnomer is
+    # what produced both of the report's disagreements: the table's `built` column
+    # printed one of them while the ratio underneath divided by the other, and the
+    # roadmap line read `declared - built` and so counted every criterion a person
+    # had already looked at as behaviour nobody had written.
+    rows, totals = [], {"declared": 0, "built": 0, "provable": 0, "proven": 0,
+                        "failed": 0, "todo": 0, "gap": 0, "ahead": 0,
+                        "unlevelled": 0, "eyes": 0}
     mismatched = []
 
     for md in sorted(scan_features(root)):
@@ -117,15 +124,27 @@ def cmd_coverage(args) -> int:
         # number that can only go up by deleting the promise. It comes out of the
         # ratio and is reported beside it, exactly as the unbuilt roadmap is.
         eyes = {ac for ac in built if levels[ac][0] == "eyes-on"}
+        # A criterion that declares NO level is not run-provable either — it is
+        # UNKNOWN, and the two are not the same thing. It used to fall through to
+        # the denominator, so an unannotated promise was silently assumed to be one
+        # a run could settle, and the ratio quietly counted an unanswered question
+        # as a question with an answer. Whichever way that assumption goes it is a
+        # guess, and a guess inside the one number this repo is judged by is worth
+        # more than the tidiness of a default. It comes out and is NAMED, the way
+        # every other set-aside here is, so the number that remains is only what
+        # somebody actually declared could be settled by a run.
+        unknown = {ac for ac in built if levels[ac][0] is None}
         # The two ways the spec and the evidence disagree, and they point opposite
         # ways. `gap` is a promise claimed with nothing to show. `ahead` is a
         # promise a passing test already keeps while the spec still says nobody
         # built it — the doc trailing the code, which no report used to count.
-        gap = built - passed - failed - todo - eyes
+        # An `unknown` is neither: until it says what would settle it, there is no
+        # bar to find it short of, and reporting it twice buries the one fix that
+        # unblocks it.
+        gap = built - passed - failed - todo - eyes - unknown
         ahead = passed - built
-        provable = built - eyes
-        proven = (built & passed) - eyes
-
+        provable = built - eyes - unknown
+        proven = (built & passed) - eyes - unknown
         for ac in sorted(declared):
             level = levels[ac][0]
             complaint = _wrong_level(level, runners.get(f"{name}/{ac}", set())) if level else None
@@ -133,21 +152,24 @@ def cmd_coverage(args) -> int:
                 mismatched.append(f"{name}/{ac}: {complaint}")
 
         totals["declared"] += len(declared)
-        totals["built"] += len(provable)
+        totals["built"] += len(built)
+        totals["provable"] += len(provable)
         totals["proven"] += len(proven)
         totals["failed"] += len(failed)
         totals["todo"] += len(built & todo)
         totals["gap"] += len(gap)
         totals["ahead"] += len(ahead)
+        # BUILT ones only. A level on behaviour nobody has written is a prediction,
+        # which is why `lint` exempts the unbuilt too — counting them here would
+        # report a number nobody can act on beside one they can.
+        totals["unlevelled"] += len(unknown)
+        # COUNTED, not derived. It used to be read back as `built - provable`,
+        # which held while `eyes` was the only thing coming out of the ratio and
+        # silently absorbed the unlevelled the moment they came out too — reporting
+        # "settled by eyes" over criteria nobody had looked at.
         totals["eyes"] += len(eyes)
-        # COUNTED, not derived from `declared - built`. An eyes-on criterion is
-        # built and comes out of the ratio, so subtracting the ratio's denominator
-        # reported every one of them as behaviour nobody had written yet.
-        totals["unbuilt"] += len(declared - built)
-        totals["unlevelled"] += sum(1 for ac in declared if levels[ac][0] is None)
-        # The column is the ratio's own denominator. Counting all of `built` here
-        # while the ratio counted `provable` made the table disagree with the number
-        # printed under it, by exactly the eyes-on criteria.
+        # The column is the ratio's own denominator, so it counts what the ratio
+        # divides by and not everything ticked.
         rows.append((name, len(provable), len(proven), len(eyes),
                      len(built & todo), len(declared - built),
                      sorted(failed), sorted(gap), sorted(ahead)))
@@ -189,16 +211,30 @@ def cmd_coverage(args) -> int:
               f"{unbuilt:>8}   {note}")
 
     t = totals
-    rate = f"{100 * t['proven'] // t['built']}%" if t["built"] else "—"
-    print(f"\n  BUILT COVERAGE  {t['proven']}/{t['built']} = {rate} "
-          f"— of the RUN-PROVABLE promises this app keeps, how many a run proves\n"
+    # Every count the tail reports is DERIVED from the three the loop kept, because
+    # a total that can be worked out and is stored anyway is a total that can
+    # disagree with the ones it was worked out from.
+    eyes, unbuilt = t["eyes"], t["declared"] - t["built"]
+    rate = f"{100 * t['proven'] // t['provable']}%" if t["provable"] else "—"
+    # THE CAVEAT RIDES THE HEADLINE, never a paragraph below it. Criteria with no
+    # level come out of both halves of this ratio, so every one of them makes the
+    # number look BETTER — and a figure that improves when somebody fails to
+    # annotate is one an unattended run can raise by doing nothing. It cannot be
+    # fixed by putting them back: in counts them as run-provable, out counts them
+    # as impossible, and both are guesses at the question the level exists to
+    # answer. So the ratio stays over what is actually known and refuses to be read
+    # alone while anything is unknown.
+    incomplete = (f" · INCOMPLETE: {t['unlevelled']} unlevelled, in neither half"
+                  if t["unlevelled"] else "")
+    print(f"\n  BUILT COVERAGE  {t['proven']}/{t['provable']} = {rate}{incomplete}\n"
+          f"  — of the RUN-PROVABLE promises this app keeps, how many a run proves\n"
           f"  {t['gap']} claimed with nothing to show · {t['todo']} declared-but-unwritten · "
           f"{t['failed']} failing\n")
-    print(f"  Settled by eyes, not by a run: {t['eyes']}. A look is a level, not an\n"
+    print(f"  Settled by eyes, not by a run: {eyes}. A look is a level, not an\n"
           f"  excuse — no assertion is evidence about weight, colour or rhythm — so\n"
           f"  these sit beside the ratio with the dated ✔ in the feature file as their\n"
           f"  evidence, never inside it.\n")
-    print(f"  Not built yet: {t['unbuilt']} of {t['declared']} promises. "
+    print(f"  Not built yet: {unbuilt} of {t['declared']} promises. "
           f"That is a roadmap, NOT a coverage hole —\n"
           f"  an unticked criterion is behaviour nobody has written, so counting it\n"
           f"  against coverage measures ambition rather than honesty.\n")
@@ -217,7 +253,11 @@ def cmd_coverage(args) -> int:
             print(f"    {complaint}")
         print()
     if t["unlevelled"]:
-        print(f"  {t['unlevelled']} criteria declare no level, so nothing can check the test that\n"
-              "  claims them — and they count as run-provable by default, which for a\n"
-              "  look is the wrong default.\n")
+        print(f"  {t['unlevelled']} BUILT criterion(s) declare no level, so nothing can check the\n"
+              "  test that claims them. They are OUT of the ratio above rather than\n"
+              "  counted as run-provable: until a criterion says what could settle it,\n"
+              "  neither answer is knowable, and a guess belongs outside the number.\n"
+              "  Annotate each with one of e2e / integration / unit / eyes-on to bring\n"
+              "  it back in — and a task may not complete while a criterion it covers\n"
+              "  is still unlevelled.\n")
     return 0

package/harness/harness/epic.py

@@ -196,10 +196,15 @@ def cmd_epic_move(args) -> int:
     # `epic.md` removed, so an epic promoted out of one arrives with nothing to
     # write — and reading it anyway raised after the folders had already moved,
     # leaving a half-moved tree no CLI command could put back.
-    md = dest / "epic.md"
-    if md.is_file():
+    #
+    # The model owns that fact and is asked for it, rather than re-stat'ing the
+    # moved path: `release` asks the same question the same way, and two
+    # implementations of "does this epic have a plan doc" is one more than there
+    # should be. The move relocates the file rather than replacing it, so what was
+    # read before it is still true after.
+    if epic.planned:
         rewrite_file(
-            md,
+            dest / "epic.md",
             lambda d: d.update({"updated": date.today().isoformat()}),
             EPIC_FM_ORDER,
         )

package/harness/harness/gate.py

@@ -33,7 +33,8 @@ from pathlib import Path
 
 from .tree import die, find_work_root
 from .frontmatter import as_list, parse_frontmatter, rewrite_file, split_frontmatter
-from .model import locate, missing
+from .lint import AC_LEVELS, feature_ac_levels
+from .model import locate, locate_feature, missing
 from .shard import _load_run
 from . import events, git, peers
 from .autonomy import tier_of
@@ -510,6 +511,7 @@ def cmd_verify(args) -> int:
     _print_report(results, sha)
     if name:
         print(f"  recorded on '{name}'")
+        _warn_unlevelled(root, name)
     return 0 if ok else 1
 
 
@@ -565,6 +567,32 @@ def _last_verify(task) -> tuple:
     return passed, sha, when
 
 
+def _warn_unlevelled(root, name: str) -> None:
+    """Say at VERIFY what will REFUSE at complete — the same fact, twice, early.
+
+    Warning here and refusing there is deliberate and is not the warn-instead-of-
+    refuse pattern the module docstring argues against: nothing is decided on this
+    warning, and skipping it changes no outcome. It exists because the refusal is
+    cheap to satisfy and expensive to meet for the first time at the finish line —
+    an unattended run that learns at `complete` has already spent the work, while
+    one that learns at `verify` can annotate the spec inside the same shift.
+    """
+    task = locate(root, name)
+    if not task or not task.covers:
+        return
+    feature = (task.owner or "").split("/")[-1]
+    md = locate_feature(root, feature)
+    if not md:
+        return
+    levels = feature_ac_levels(md.read_text())
+    unlevelled = [ac for ac in task.covers
+                  if ac in levels and levels[ac][0] is None]
+    if unlevelled:
+        print(f"\n  WARN  {', '.join(unlevelled)} declare no level — `complete` will "
+              f"refuse\n        until each says what could settle it. Annotate them in "
+              f"`product/{feature}.md`\n        with one of {', '.join(AC_LEVELS)}.")
+
+
 def gate(root, task, accept: str = "", owner: str = "") -> list:
     """Every reason this task may NOT be called complete. Empty means it may.
 
@@ -652,8 +680,28 @@ def gate(root, task, accept: str = "", owner: str = "") -> list:
         proven = _load_run(root.parent).proven
         seen = _observed_acs(task)
         feature = (task.owner or "").split("/")[-1]
+        # WHAT COULD SETTLE IT, before whether anything did. A criterion with no
+        # declared level is not a criterion a run can be judged against: `coverage`
+        # cannot say whether a passing test is the right KIND of evidence for it,
+        # and `_wrong_level` — the check that catches a unit test claiming what only
+        # a person can see — has nothing to compare. So the two questions are asked
+        # in order, and the second is not worth asking first: "no evidence" on an
+        # unlevelled criterion is unanswerable rather than false, and reporting it
+        # as a gap sends somebody looking for a test when the missing thing is the
+        # bar. Scoped to what this task COVERS, never the whole feature file: a task
+        # is answerable for the promises it took, and refusing on a neighbour's
+        # would make the board incompletable by anyone but the last person to touch
+        # the spec.
+        levels = feature_ac_levels(md.read_text()) if (
+            md := locate_feature(root, feature)) else {}
         for ac in task.covers:
             cid = f"{feature}/{ac}" if feature else ac
+            if ac in levels and levels[ac][0] is None:
+                reasons.append(
+                    f"{ac} declares no level, so nothing can check the test that "
+                    f"claims it — annotate it in `product/{feature}.md` with one of "
+                    f"{', '.join(AC_LEVELS)}")
+                continue
             if proven.get(cid) == "passed" or ac in seen:
                 continue
             reasons.append(f"{ac} has no evidence — no passing coverage binding "

package/harness/harness/git.py

@@ -665,16 +665,6 @@ def _push(repo) -> tuple:
                    f"`{cli()} sync` sends it when you can reach {remote}.")
 
 
-#: Git's own complaint, wherever it sits in the stream. It is extracted rather than
-#: read off the first line because the first lines are a fetch banner and a progress
-#: counter — and the counter carries no newline, so `Rebasing (1/1)error: could not
-#: apply …` arrives as ONE line with the reason buried at the end of it. Measured
-#: under four concurrent board writes: three refusals in a row explained themselves
-#: as "From /tmp/…/origin", "warning: fetch updated the current branch head.." and
-#: "Rebasing (1/4)." — three non-answers to the only question being asked.
-_COMPLAINT = re.compile(r"(?:error|fatal): (.+)")
-
-
 def _why_no_rebase(err: str) -> str:
     """Why the rebase onto the moved branch did not run, in the caller's terms.
 
@@ -693,9 +683,7 @@ def _why_no_rebase(err: str) -> str:
                 "the way of rebasing onto it — nothing was moved or stashed. They "
                 "may be yours or another board write that has not committed yet; "
                 "commit what is yours and the next board write pushes both")
-    m = _COMPLAINT.search(err or "")
-    return ("the branch moved and the rebase onto it did not apply: "
-            f"{m.group(1).strip()[:200] if m else _tail(err)}")
+    return f"the branch moved and the rebase onto it did not apply: {_tail(err)}"
 
 
 def _message(item: str, rows: list) -> tuple:
@@ -779,9 +767,9 @@ def _events(record: str) -> list:
     who = (trailers.get(SESSION) or [""])[0]
     host = (trailers.get(MACHINE) or [""])[0]
     out = []
-    # How many of this kind have been handed out already, so the second `verified`
-    # in a commit gets the second body line rather than the first's.
-    taken: dict = {}
+    # One pool per kind, drawn from in order, so the second `verified` in a commit
+    # gets the second body line rather than the first's.
+    pools = {kind: iter(payloads) for kind, payloads in details.items()}
     for kind in kinds:
         e = {"ts": _utc(when), "event": kind, "name": item, "sha": sha[:12],
              "author": author}
@@ -789,11 +777,7 @@ def _events(record: str) -> list:
             e["by"] = who
         if host:
             e["machine"] = host
-        payloads = details.get(kind) or []
-        i = taken.get(kind, 0)
-        if i < len(payloads):
-            e.update(payloads[i])
-        taken[kind] = i + 1
+        e.update(next(pools.get(kind, iter(())), {}))
         out.append(e)
     return out
 
@@ -924,12 +908,31 @@ def cmd_sync(args=None) -> int:
     return 0 if pushed else 1
 
 
+#: Git saying what went wrong, wherever in its output that sits.
+_COMPLAINT = re.compile(r"(?:error|fatal): (.+)")
+
+
 def _tail(text: str) -> str:
-    """Git's first real complaint. The FIRST line, not the last: git follows a
-    `fatal:` with a paragraph of advice, and the closing line of that paragraph
-    ("…and the repository exists.") reads as gibberish on its own."""
-    for line in (text or "").splitlines():
-        line = line.strip()
-        if line and not line.startswith("hint:"):
-            return line[:200]
-    return "no reason given"
+    """Git's real complaint, in the words it used.
+
+    Never the LAST line: git follows a `fatal:` with a paragraph of advice, and the
+    closing line of that paragraph ("…and the repository exists.") reads as gibberish
+    on its own. And no longer the FIRST line either, because the first line is
+    routinely a banner — `To <url>` on a rejected push, `From <url>` on a fetch,
+    `Rebasing (1/4)` on a rebase — and the progress counter carries no newline, so
+    `Rebasing (1/1)error: could not apply …` arrives as ONE line with the reason
+    buried at the end of it.
+
+    Measured, both shapes: a rejected push explained itself as "To /tmp/…/o.git",
+    and three concurrent board writes explained their refusals as a fetch banner, a
+    warning and a progress counter — four non-answers to the only question being
+    asked. So the complaint is looked for first and the first line is the fallback,
+    which is what this always did and is still right when git leads with `fatal:`.
+    """
+    lines = [ln.strip() for ln in (text or "").splitlines()]
+    lines = [ln for ln in lines if ln and not ln.startswith("hint:")]
+    for line in lines:
+        found = _COMPLAINT.search(line)
+        if found:
+            return found.group(1).strip()[:200]
+    return lines[0][:200] if lines else "no reason given"

package/harness/harness/lint.py

@@ -481,6 +481,15 @@ def _coverage_lint(root: Path, s: dict) -> list:
     if not product_dir.is_dir():
         return warns
 
+    # THE QUESTION FIRST, then the evidence for it. Only a `shipped` feature is
+    # checked, so a repo with none has nothing to answer and the gathering below is
+    # pure waste — and it is not free: this runs after every board write, and the
+    # filed-cut half of it grows with every release and never shrinks.
+    shipped = [md for md in scan_features(root)
+               if parse_frontmatter(md.read_text()).get("state") == "shipped"]
+    if not shipped:
+        return warns
+
     covered: dict = {}
     # The cuts that have LEFT the board carry evidence too — a criterion delivered
     # by a task in a shipped cut is delivered. Reading the live board alone turned
@@ -500,10 +509,8 @@ def _coverage_lint(root: Path, s: dict) -> list:
     # matched nothing and this whole rollup was dead code wearing a passing
     # test. `scan_features` is now the single owner of that glob, so the next
     # layout change cannot leave one caller behind.)
-    for feature_md in scan_features(root):
+    for feature_md in shipped:
         text = feature_md.read_text()
-        if parse_frontmatter(text).get("state") != "shipped":
-            continue
         have = covered.get(feature_md.stem, set())
         for ac in sorted(_feature_ac_ids(text)):
             if ac not in have:

package/harness/harness/shard.py

@@ -41,8 +41,8 @@ class Run(NamedTuple):
     runners: dict
     #: The shard filenames actually read.
     shards: list
-    #: Source paths named by a shard that is no longer in the tree. Their claims
-    #: are not in `proven`.
+    #: Source paths from a shard NONE of whose sources are still in the tree.
+    #: Their claims are not in `proven`.
     stale: list
     #: Shards that never say what they ran. Their claims ARE in `proven` — there
     #: is nothing to check them against — and they are named so a reader knows it.
@@ -62,7 +62,7 @@ def _load_run(repo: Path) -> Run:
     `playwright.json`. A criterion bound at both levels reported whichever
     runner sorted last, which is the one thing this file exists not to do.
 
-    A SHARD OUTLIVES THE TEST THAT WROTE IT, so one whose `source` is no longer
+    A SHARD OUTLIVES THE TESTS THAT WROTE IT, so one none of whose `sources` are
     in the tree is set aside rather than read. It is a result about code this
     checkout does not have, and nothing rewrites it: a renamed or deleted spec
     would otherwise go on claiming `passed` forever, which is the same fault a
@@ -86,14 +86,26 @@ def _load_run(repo: Path) -> Run:
             data = json.loads(p.read_text())
         except Exception:
             continue
-        source = data.get("source")
-        if not isinstance(source, str) or source == "":
-            # COUNTED, AND NAMED. A runner that does not write a source cannot be
+        # A LIST, because one shard is one RUN and a run covers many files. It was
+        # a single `source` string, which no writer ever managed to fill: a vitest
+        # workspace has no one file to name, so every shard fell through to
+        # `unattributed` and the check has never once run. A field only a
+        # single-file runner could satisfy is a field that reads as absent for
+        # everybody else.
+        sources = data.get("sources")
+        sources = [s for s in sources if isinstance(s, str) and s] if isinstance(sources, list) else []
+        if not sources:
+            # COUNTED, AND NAMED. A runner that does not write its sources cannot be
             # checked, and dropping it would throw away real evidence to punish a
             # writer. Saying so is what lets somebody fix the writer.
             read.unattributed.append(p.name)
-        elif not (repo / source).exists():
-            read.stale.append(source)
+        elif not any((repo / s).exists() for s in sources):
+            # EVERY source gone, not merely one. A run spanning ten files where one
+            # was deleted still proved the other nine, and setting the whole shard
+            # aside would discard them to punish a rename. Only when nothing it ran
+            # is still in the tree is the shard a result about code this checkout
+            # does not have.
+            read.stale.extend(sources)
             continue
         read.shards.append(p.name)
         runner = data.get("runner") or "unknown"

package/harness/schema/work.config.schema.json

@@ -330,7 +330,7 @@
         "shard": {
           "type": "string",
           "default": ".work/coverage",
-          "description": "Where runners drop coverage shards. Gitignored on purpose — evidence is a fresh run, not a file somebody checked in."
+          "description": "Where runners drop coverage shards, repo-relative. Gitignored on purpose — evidence is a fresh run, not a file somebody checked in."
         }
       }
     },

package/harness/test_work.py

@@ -27,7 +27,7 @@ from harness.ids import LEDGER as L  # noqa: E402 — fixtures render in the rep
 from harness import (align, architecture, autonomy, branches, config, coverage, epic,  # noqa: E402
                      events, extend, frontmatter, gate, generate, git, ids, kickoff,
                      lint, model, peers, registry, report, safety, scaffold,
-                     shift, task, tree, version)
+                     shard, shift, task, tree, version)
 
 # `parse_argv` is the ENTRY's own concern, so it is loaded from work.py by path
 # rather than re-homed into a module just to make a test tidier.
@@ -1119,11 +1119,15 @@ def _shards(tmp: str, **byname: dict) -> Path:
 
 def _ran(repo: Path, name: str, source: str, covered: dict) -> Path:
     """One shard that names the file it ran. Returns that file's path so a test
-    can create it, or rename it away."""
+    can create it, or rename it away.
+
+    `sources` is a LIST on the shard — one run covers many files — and this helper
+    writes a single-entry one, which is the case these tests exercise: with one
+    source, "none of them survive" and "that one is gone" are the same event."""
     d = repo / ".work" / "coverage"
     d.mkdir(parents=True, exist_ok=True)
     (d / f"{name}.json").write_text(
-        json.dumps({"runner": "vitest", "source": source, "covered": covered}))
+        json.dumps({"runner": "vitest", "sources": [source], "covered": covered}))
     return repo / source
 
 
@@ -3263,6 +3267,59 @@ def test_a_promised_criterion_needs_evidence_a_run_or_a_person_produced():
             assert not any("AC-01" in r for r in reasons), reasons
 
 
+def test_a_criterion_with_no_level_is_refused_before_it_is_asked_for_evidence():
+    # The two questions in order. "No evidence" on a criterion that never said what
+    # could settle it is unanswerable rather than false, and reporting it as a gap
+    # sends somebody hunting for a test when the missing thing is the bar.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha",
+              fm="priority: P1\ntier: 1\nowner: lesson\ncovers: [AC-01]\n",
+              body="# T\n")
+        with _work_dir(tmp) as root:
+            spec = root / "product" / "lesson.md"
+            spec.parent.mkdir(parents=True, exist_ok=True)
+            spec.write_text("---\ntype: feature\nstate: building\n---\n\n"
+                            "# Lesson\n\n- [x] AC-01: the card renders\n")
+            reasons = gate.gate(root, model.locate(root, "alpha"))
+            assert any("AC-01 declares no level" in r for r in reasons), reasons
+            assert not any("has no evidence" in r for r in reasons), reasons
+
+            # Annotated, and the gate moves on to the question it was blocking.
+            spec.write_text("---\ntype: feature\nstate: building\n---\n\n"
+                            "# Lesson\n\n- [x] AC-01 (unit): the card renders\n")
+            reasons = gate.gate(root, model.locate(root, "alpha"))
+            assert not any("declares no level" in r for r in reasons), reasons
+            assert any("AC-01 has no evidence" in r for r in reasons), reasons
+
+
+def test_a_run_still_counts_when_one_of_its_files_was_deleted():
+    # `sources` is a LIST because one run covers many files. Setting the whole
+    # shard aside because a single spec was renamed would discard the other nine
+    # files' real results to punish the rename.
+    with tempfile.TemporaryDirectory() as tmp:
+        repo = Path(tmp)
+        d = repo / ".work" / "coverage"
+        d.mkdir(parents=True)
+        (repo / "kept.test.ts").write_text("//")
+        (d / "vitest-pkg.json").write_text(json.dumps({
+            "runner": "vitest",
+            "sources": ["kept.test.ts", "gone.test.ts"],
+            "covered": {"lesson/AC-01": {"status": "passed"}},
+        }))
+        read = shard._load_run(repo)
+        assert read.proven.get("lesson/AC-01") == "passed", read.proven
+        assert read.unattributed == [], read.unattributed
+
+        # Every source gone is a different event: the result is about code this
+        # checkout does not have, so it is set aside rather than believed.
+        (repo / "kept.test.ts").unlink()
+        gone = shard._load_run(repo)
+        assert gone.proven == {}, gone.proven
+        assert sorted(gone.stale) == ["gone.test.ts", "kept.test.ts"], gone.stale
+
+
 def test_the_event_log_is_history_and_nothing_reads_it_for_state():
     # The line that must not blur. If a check ever needs a fact from the log, that
     # fact belongs in the tree instead — otherwise this becomes the central ledger
@@ -6382,7 +6439,7 @@ def _coverage_fixture(tmp: str, body: str, shard: dict = None) -> Path:
         d = root.parent / ".work" / "coverage"
         d.mkdir(parents=True)
         (d / "vitest.json").write_text(json.dumps(
-            {"source": "pkg/x.test.ts", "runner": "vitest", "covered": shard}))
+            {"sources": ["pkg/x.test.ts"], "runner": "vitest", "covered": shard}))
     return root
 
 
@@ -6719,7 +6776,7 @@ def test_a_repo_that_moves_its_coverage_shard_is_actually_read_there():
             elsewhere = root.parent / "build" / "evidence"
             elsewhere.mkdir(parents=True)
             (elsewhere / "vitest.json").write_text(json.dumps(
-                {"source": "pkg/x.test.ts", "runner": "vitest",
+                {"sources": ["pkg/x.test.ts"], "runner": "vitest",
                  "covered": {"viewer/AC-01": {"status": "passed"}}}))
 
             config.apply({**config.DEFAULTS,
@@ -6894,6 +6951,49 @@ def test_four_board_writes_racing_a_rejected_push_lose_nothing():
             config.apply(config.DEFAULTS)
 
 
+def test_config_unset_with_no_key_says_so_rather_than_throwing():
+    # The repair branch — `unset` may remove a key the schema does not know — took
+    # the empty key for one of those, because `_present` answers True for a path of
+    # no segments. It then indexed the last of zero parts, so the command an
+    # installer shells out to answered with an IndexError traceback.
+    with tempfile.TemporaryDirectory() as tmp:
+        repo = _repo_with_config(tmp, {"ids": {"prefix": "G"}})
+        for key in ("", ".", "  "):
+            try:
+                _cli(repo, "config", "unset", key)
+                assert False, f"unset {key!r} should refuse"
+            except SystemExit as e:
+                assert e.code, f"unset {key!r} exited 0"
+        assert json.loads((repo / ".claude" / "work.config.json").read_text()) == \
+            {"ids": {"prefix": "G"}}, "a refused unset changed the file"
+
+
+def test_asking_where_the_gates_stand_never_commits_the_board():
+    # `verify` writes the result of a run it EXECUTES, and two of its four doors
+    # execute nothing: `--async` starts a detached child that commits its own
+    # result, `--status` only reports. Both were driving a commit that swept up
+    # whatever the person had open in work/, as "docs(work): board edits" under no
+    # item — seen twice on this repo's own board in one session, while polling for a
+    # gate to finish, which is exactly the call a session repeats.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo_cli(tmp)
+            (repo / ".claude" / "work.config.json").write_text(json.dumps(
+                {"git": {"commit": True, "push": False, "remote": "origin",
+                         "paths": ["work"]},
+                 "verify": {"tests": "true"}}))
+            _git(repo, "add", "-A"); _git(repo, "commit", "-qm", "gates configured")
+            (repo / "work" / "product" / "README.md").write_text("a hand edit\n")
+            before = _git(repo, "rev-parse", "HEAD").stdout.strip()
+
+            _entry(repo, "verify", "--task", "alpha", "--status")
+            assert _git(repo, "rev-parse", "HEAD").stdout.strip() == before, \
+                "asking where the gates stand committed the board"
+            assert "work/product/README.md" in _git(repo, "status", "--porcelain").stdout
+        finally:
+            config.apply(config.DEFAULTS)
+
+
 if __name__ == "__main__":
     tests = [v for k, v in sorted(globals().items())
              if k.startswith("test_") and callable(v)]

package/harness/work.py

@@ -284,7 +284,7 @@ def main() -> int:
     # person happened to have open in `work/` at that moment, filed as
     # "docs(work): board edits" under no item, at a moment nobody chose. The pull
     # was already scoped this way; now both halves ask the same question.
-    if cmd not in git.WRITES or not git.enabled():
+    if not _writes(cmd, flags) or not git.enabled():
         return dispatch(cmd, pos, flags, cfg)
 
     # Pull → write → commit → push. The commit runs in a `finally`: a command that
@@ -314,6 +314,25 @@ def main() -> int:
         _say(note)
 
 
+def _writes(cmd: str, flags: dict) -> bool:
+    """Does THIS invocation change the board?
+
+    The command name answers it for all but one. `verify` writes the result of a run
+    it EXECUTES, and two of its four doors execute nothing: `--async` starts a
+    detached child that commits its own result, and `--status` only reports. Both
+    write to `work/.verify`, which is gitignored, so neither has anything of its own
+    to land — and both were driving a commit that swept up whatever the person had
+    open in `work/`, filed as "docs(work): board edits" under no item. Seen twice on
+    this repo's own board in one session, while polling for a gate to finish, which
+    is exactly the call a session repeats.
+    """
+    if cmd not in git.WRITES:
+        return False
+    if cmd == "verify" and (flags.get("async") or flags.get("status")):
+        return False
+    return True
+
+
 def _say(note: str) -> None:
     """A git note the caller has to see. stderr, because it is the difference
     between a write that is safe and one that is only safe on this machine — and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.85",
+  "version": "0.1.87",
   "description": "Jarvis — local AI coding assistant CLI",
   "private": false,
   "type": "module",
@@ -56,17 +56,17 @@
     "tsup": "^8.5.1",
     "typescript": "^5.7.0",
     "vitest": "^2.1.0",
-    "@jarvis/agents": "1.0.0",
     "@jarvis/anthropic": "1.0.0",
     "@jarvis/board": "0.1.0",
     "@jarvis/data": "0.1.0",
+    "@jarvis/logger": "1.0.0",
     "@jarvis/errors": "1.0.0",
     "@jarvis/rpc": "1.0.0",
-    "@jarvis/logger": "1.0.0",
     "@jarvis/types": "1.0.0",
     "@jarvis/typescript-config": "1.0.0",
     "@jarvis/ui": "0.1.0",
-    "@jarvis/vitest-config": "1.0.0"
+    "@jarvis/vitest-config": "1.0.0",
+    "@jarvis/agents": "1.0.0"
   },
   "scripts": {
     "dev": "tsx watch src/bin.ts start --foreground",