@bolloon/bolloon-agent 0.1.0

package/src/bollharness/.boll/deploy-allowlist.yaml

@@ -0,0 +1,38 @@
+# deploy-allowlist.yaml — project-level config for scripts/deploy-guard.ts
+#
+# Default state: empty protected_hosts list = no enforcement. The hook
+# reads, sees an empty list, exits 0 on every command.
+#
+# TO ACTIVATE: add your production host(s) below with approved_commands
+# regex patterns. Once a host is declared, any Bash command that touches
+# it and does NOT match an approved pattern will be BLOCKED (exit 2).
+#
+# This is the opposite polarity from issue-adapter.yaml: deploy-guard is
+# high-stakes (accidental push to prod is costly) so it's fail-closed
+# AFTER declaration; but declaration itself is opt-in (nobody wants a
+# fresh harness install to suddenly refuse every ssh command).
+#
+# See scripts/deploy-guard.ts module docstring for full schema.
+
+protected_hosts: []
+
+# Example (uncomment and adapt):
+#
+# protected_hosts:
+#   - host: 203.0.113.42
+#     label: "production backend"
+#     reason: |
+#       Direct mutation breaks systemd-managed deploys.
+#       Only approved path is: bash scripts/deploy.sh
+#     approved_commands:
+#       - pattern: '^bash\s+scripts/deploy\.sh(\s+--(dry-run|yes))*\s*$'
+#       - pattern: '^ssh\s+[^|;&]*journalctl[^|;&]*$'     # read-only diagnostics
+#       - pattern: '^ssh\s+[^|;&]*systemctl\s+status.*$'
+#
+#   - host: 198.51.100.7
+#     label: "bridge VPS"
+#     reason: |
+#       Direct scp/rsync leaves orphan worktrees. Only approved path is
+#       git pull via ssh (see related issue in docs/issues/).
+#     approved_commands:
+#       - pattern: '^ssh\s+[^|;&]*git\s+(pull|fetch|status)[^|;&]*$'

package/src/bollharness/.boll/inbox/schema/message-v1.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bollharness.local/.boll/inbox/schema/message-v1.json",
+  "title": "bollharness inbox message v1",
+  "description": "ADR-H9 §4 sealed message-v1 schema. 任何 .boll/inbox/**/*.md 写入由 inbox-validate.ts 用本 schema 校验 yaml frontmatter；不合规 mv 到 .boll/inbox/quarantine/。Schema frozen，新增字段走 ADR-H9.x v1→v2 migration（§9 不向后兼容）。",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["sender", "sender_pid", "ts", "msg_id", "kind", "priority", "related_h"],
+  "properties": {
+    "sender": {
+      "description": "发送窗口；子→主走 window-Hx；主→子 ack 时填 main，路径仍写到 window-Hx/acks/",
+      "type": "string",
+      "enum": ["main", "window-h0", "window-h1", "window-h2", "window-h3", "window-h4", "window-h5", "window-h6", "window-h8", "window-h9"]
+    },
+    "sender_pid": {
+      "description": "发送窗口 CC pid（防伪 / race 排查）",
+      "type": "integer",
+      "minimum": 1
+    },
+    "ts": {
+      "description": "ISO-8601 + 时区，例 2026-04-28T14:30:00+08:00",
+      "type": "string",
+      "format": "date-time"
+    },
+    "ts_unix": {
+      "description": "可选 unix 时间戳（秒）；inject-on-start / poll / mtime delta 计算便利字段（PLAN-H9 §4.8 WP-08 DoD 机器证据）",
+      "type": "number",
+      "minimum": 0
+    },
+    "msg_id": {
+      "description": "幂等 ID，格式 <sender-prefix>-YYYYMMDD-HHMMSS-<rand 3-12 字符>；sender-prefix = main 或 h0..h9",
+      "type": "string",
+      "pattern": "^(main|h[0-9])-[0-9]{8}-[0-9]{6}-[a-z0-9]{3,12}$"
+    },
+    "kind": {
+      "description": "progress=进度 / block=阻塞需主窗口介入 / done=完工 / question=待解答 / ack=回执",
+      "type": "string",
+      "enum": ["progress", "block", "done", "question", "ack"]
+    },
+    "priority": {
+      "description": "P0=立刻 wake 主窗口 / P1=正常队列 / P2=可延后",
+      "type": "string",
+      "enum": ["P0", "P1", "P2"]
+    },
+    "related_h": {
+      "description": "harness 拓扑 H 编号；H7 已撤销不允许（参 ADR-H9 §3 注释 + symptoms.md §4.3）",
+      "type": "string",
+      "enum": ["H0", "H1", "H2", "H3", "H4", "H5", "H6", "H8", "H9"]
+    },
+    "related_wp": {
+      "description": "可选；格式 WP-Hx-NN 例 WP-H9-01",
+      "type": "string",
+      "pattern": "^WP-H[0-9]-[0-9]{2}$"
+    },
+    "ack_required": {
+      "description": "是否要求主窗口回执；默认 false。priority=P0 强制 true（schema if/then 拒收 P0+false 组合）；kind=ack 永远 false",
+      "type": "boolean",
+      "default": false
+    },
+    "ack_for": {
+      "description": "kind=ack 时必填，引用被 ack 的消息 msg_id",
+      "type": "string",
+      "pattern": "^(main|h[0-9])-[0-9]{8}-[0-9]{6}-[a-z0-9]{3,12}$"
+    },
+    "proposal_ref": {
+      "description": "可选；引用 .boll/proposals/* 路径（ADR-H9 §4 双写规则：message body 不复制 proposal 内容，只引用路径）",
+      "type": "string",
+      "pattern": "^\\.boll/proposals/[A-Za-z0-9._/-]+\\.md$"
+    }
+  },
+  "allOf": [
+    {
+      "description": "kind=ack 强制 ack_for 必填且 ack_required=false（ack 不再 ack，防递归回环）",
+      "if": {
+        "properties": {"kind": {"const": "ack"}},
+        "required": ["kind"]
+      },
+      "then": {
+        "required": ["ack_for"],
+        "properties": {
+          "ack_required": {"const": false}
+        }
+      }
+    },
+    {
+      "description": "priority=P0 强制 ack_required=true（防 P0 静默丢失）",
+      "if": {
+        "properties": {"priority": {"const": "P0"}},
+        "required": ["priority"]
+      },
+      "then": {
+        "required": ["ack_required"],
+        "properties": {
+          "ack_required": {"const": true}
+        }
+      }
+    }
+  ]
+}

package/src/bollharness/.boll/issue-adapter.yaml

@@ -0,0 +1,31 @@
+# issue-adapter.yaml — project-level config for scripts/guard-feedback.ts
+#
+# Default state: disabled. Turn on by setting enabled: true and declaring
+# at least one route or guard. Leaving this file as-is = pure noop (the
+# hook reads, sees enabled: false, exits 0 silently).
+#
+# See scripts/guard-feedback.ts module docstring for full schema.
+
+enabled: false
+
+# When enabled, point fragments_dir to where your context fragments live.
+# Each fragment is a markdown file that gets injected into Claude's context
+# when the matching file is edited.
+fragments_dir: scripts/fragments
+
+# routes: file-glob → fragment-name pairs
+# Example:
+#   routes:
+#     - pattern: "backend/**/*.ts"
+#       fragment: "backend-conventions.md"
+routes: []
+
+# guards: file-glob → script pairs. Scripts exit non-zero on failure.
+# Example:
+#   guards:
+#     - path_pattern: "backend/**"
+#       script: scripts/checks/check_api_types.ts
+guards: []
+
+# Where to append JSONL metric events. Can be relative to project root or absolute.
+metrics_file: .boll/state/metrics/guard-events.jsonl

package/src/bollharness/.boll/plugins/boll-mode-toolkit/contracts/mode-contract.md

@@ -0,0 +1,85 @@
+# boll vNext Mode Contract
+
+> Companion to `../03-design.md` §7. Addresses Phase 1 §6.3 (mode collapse — brainstorm / build / verify / release not first-class). Grounded in Phase 2 §1.1 (CC Plan Mode), §3.2 (Cursor checkpoints), §3.7 synthesis ("mode is runtime state, not prose").
+
+The mode is **the** runtime state variable. It lives at `.boll/state/mode` as a single word. Every hook, every capability check, and every review binding reads that file to decide what is allowed.
+
+## Four modes
+
+| Mode | Purpose | Tool profile | Allowed transitions |
+|---|---|---|---|
+| `plan` | brainstorm, explore, write a plan, ask clarifying questions | read-only: Read, Glob, Grep, Bash(git log:\*), WebFetch, WebSearch, AskUserQuestion | → build |
+| `build` | make code changes against an approved plan | Read + Write + Edit + Bash(scoped) | → verify, ← plan |
+| `verify` | run tests, inspect diffs, accumulate evidence, no new edits | Read + Bash(test:\*) + Bash(git diff:\*) | → release, ← build |
+| `release` | commit / push / deploy / retire assets | Write + Bash(git commit:\*) + Bash(git push:\*) + Bash(deploy:\*) | → plan (new run) |
+
+Mode is set by: (1) explicit user command (`/mode build`), (2) plan-approval gate (plan → build), (3) verify-gate pass (verify → release), or (4) auto-reset to `plan` after release. **No prompt text ever sets mode.**
+
+## Default value when absent
+
+If `.boll/state/mode` does not exist when the router reads it, the router treats the mode as `legacy` (pass-through) and lazily creates the file with content `legacy`. The default is enforced at read time; no runtime state file is ever committed.
+
+## Per-mode capability profile
+
+Each mode maps to a tool allowlist and a review binding. `capability-router.ts` (see `../hooks/capability-router.ts`) reads `.boll/state/mode` on every `PreToolUse` and denies tool calls that do not fit the current mode's profile.
+
+### `plan`
+
+- **Permits:** Read, Glob, Grep, WebFetch, WebSearch, AskUserQuestion, Bash(git log:\*), Bash(git status), Bash(git diff:\*)
+- **Denies:** Edit, Write, Bash(git commit:\*), Bash(git push:\*), Bash(rm:\*), Bash(deploy:\*), Edit-like MCP tools, SendMessage to execution agents
+- **Emits:** on transition out of plan, one evidence packet (`kind: gate`) with the plan file's sha256 and the human approver's id
+- **Typical duration:** minutes to hours
+- **Compact behavior:** tiny kernel reload; plan file itself is the resume pointer
+
+### `build`
+
+- **Permits:** plan's permissions + Edit, Write, Bash(npx jest:\*), Bash(npm test:\*), Bash(cargo check:\*), subagent spawn (executor)
+- **Denies:** Bash(git push:\*), Bash(git commit:\*) (commits happen at release), Bash(deploy:\*), Bash(rm:\*) unless path in `/tmp/`, SendMessage outside run
+- **Emits:** per-edit step evidence (`kind: step`); at transition to verify, one gate packet
+- **Typical duration:** hours
+- **Compact behavior:** kernel + pointer to current run.json; evidence files are the durable state
+
+### `verify`
+
+- **Permits:** Read, Glob, Grep, Bash(git diff:\*), Bash(test:\*), reviewer subagent spawn
+- **Denies:** Edit, Write, Bash(git commit:\*), Bash(git push:\*), Bash(deploy:\*)
+- **Emits:** one `merge_ready` packet at transition to release
+- **Typical duration:** minutes
+- **Compact behavior:** verify should not outlast a single compact window; if it does, the verify run aborts and re-starts from the last gate packet
+
+### `release`
+
+- **Permits:** Bash(git commit:\*), Bash(git push:\*), Bash(deploy:\*), asset retirement via `/retire` command
+- **Denies:** Edit (code changes) — if a change is needed, mode must return to `build`
+- **Emits:** release-level evidence packet with commit sha and (if applicable) deploy id
+- **Typical duration:** minutes
+- **Compact behavior:** out of scope; release does not survive compact — it either completes or aborts
+
+## Transition gates
+
+| From | To | Gate |
+|---|---|---|
+| plan | build | human approval of plan file (design-review binding in `review-contract.yaml`) |
+| build | verify | gate packet exists and passes `verify-gate.ts` schema check |
+| verify | release | `merge_ready` packet exists, CI green, all UNKNOWNs resolved or explicitly deferred |
+| release | plan | automatic on release success; new run.json is created |
+| any | plan | allowed (abort current run — produces an abort packet with reason) |
+
+## What mode is **not**
+
+- Mode is not a prompt string. CLAUDE.md-vnext does not describe modes — it points the model at `.boll/state/mode` and the router hook does the rest.
+- Mode is not a skill. `lead` skill's 0–8 gate state machine (Phase 1 §3.4) is an example of mode-as-prose; it is **retired** (see `../03-design.md` §12 matrix).
+- Mode is not per-subagent. Subagents inherit the parent run's mode; a subagent cannot self-elevate.
+- Mode is not per-team. Parallel runs each have their own `.boll/state/<run-id>/mode` file.
+
+## Multi-task parallelism under the mode model
+
+The brief requires parallel-multitask support. The mode contract supports parallelism with one rule:
+
+> **Parallel runs share nothing except the repo.** Each parallel run gets a unique run_id, its own `.boll/state/<run-id>/mode`, its own evidence tree, and its own subagent context. Mode is per-run, not global.
+
+Two builds can run simultaneously on disjoint file paths. If they intersect, the second run's `PreToolUse` on a conflicting path is denied by `capability-router.ts` reading a file-lock table at `.boll/state/locks.json`. No prompt-level "don't step on each other" rule.
+
+## What the human sees
+
+The mode name is rendered in the session status line by a SessionStart hook. Nothing else needs to remind the model — the router and the verify-gate do.

package/src/bollharness/.boll/plugins/boll-review-toolkit/contracts/evidence-packet-schema.json

@@ -0,0 +1,102 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bollharness.local/schemas/evidence-packet-v1.json",
+  "title": "boll vNext Evidence Packet",
+  "description": "Canonical shape of a completion / verification evidence packet. Every evidence file under .boll/evidence/<run-id>/ MUST validate against this schema. Referenced by ../hooks/verify-gate.ts. Addresses Phase 1 §2.7 / §3.1 / open-question A.7 (no explicit completion-evidence artifact existed). Grounded in Phase 2 §4.4 (PRM) and §3.8 (closure = commit + packet).",
+  "type": "object",
+  "required": ["packet_id", "run_id", "step_id", "mode", "kind", "created_at", "author", "claims", "evidence", "digest"],
+  "additionalProperties": false,
+  "properties": {
+    "packet_id": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "sha256 of the canonical-JSON serialization of this packet with digest omitted."
+    },
+    "run_id": {
+      "type": "string",
+      "pattern": "^[0-9a-zA-Z_-]{8,64}$"
+    },
+    "step_id": {
+      "type": "string",
+      "description": "Stable per-step identifier: step number or sub-task id. For run-level packets (MERGE_READY), use 'FINAL'."
+    },
+    "mode": {
+      "type": "string",
+      "enum": ["plan", "build", "verify", "release"]
+    },
+    "kind": {
+      "type": "string",
+      "enum": ["step", "gate", "merge_ready", "retire"],
+      "description": "step = per-edit evidence; gate = mode-transition gate; merge_ready = run-level completion; retire = asset retirement packet."
+    },
+    "created_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "author": {
+      "type": "object",
+      "required": ["kind", "id"],
+      "properties": {
+        "kind": {"enum": ["model", "hook", "human"]},
+        "id": {"type": "string", "description": "model name, hook script path, or human user id"}
+      }
+    },
+    "claims": {
+      "type": "array",
+      "minItems": 1,
+      "description": "What the author says was accomplished. Plain strings.",
+      "items": {"type": "string", "minLength": 4, "maxLength": 240}
+    },
+    "evidence": {
+      "type": "array",
+      "minItems": 1,
+      "description": "Concrete substantiation per claim. Every claim must have ≥1 matching evidence entry.",
+      "items": {
+        "type": "object",
+        "required": ["claim_index", "type", "ref"],
+        "additionalProperties": false,
+        "properties": {
+          "claim_index": {"type": "integer", "minimum": 0},
+          "type": {
+            "type": "string",
+            "enum": ["commit_sha", "test_result", "file_hash", "command_output", "external_link", "human_attestation"]
+          },
+          "ref": {"type": "string", "description": "commit sha / test name / file path / url / attestation id"},
+          "summary": {"type": "string", "maxLength": 240},
+          "pass": {"type": "boolean", "description": "only for test_result / command_output"}
+        }
+      }
+    },
+    "blockers": {
+      "type": "array",
+      "description": "Known issues that should block closure at the current mode. Empty = no blockers declared.",
+      "items": {
+        "type": "object",
+        "required": ["severity", "note"],
+        "properties": {
+          "severity": {"enum": ["info", "warn", "block"]},
+          "note": {"type": "string", "minLength": 4, "maxLength": 480},
+          "owner": {"type": "string"}
+        }
+      }
+    },
+    "unknowns": {
+      "type": "array",
+      "description": "Explicit UNKNOWNs the author cannot resolve. Surfacing them here is required — silent omission is a verify-gate fail (Phase 1 §6.1 affordance failure).",
+      "items": {"type": "string", "minLength": 4, "maxLength": 480}
+    },
+    "predecessors": {
+      "type": "array",
+      "description": "packet_ids this packet builds on (forms the run's evidence DAG).",
+      "items": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+    },
+    "digest": {
+      "type": "object",
+      "required": ["algorithm", "value"],
+      "properties": {
+        "algorithm": {"const": "sha256"},
+        "value": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+      }
+    }
+  }
+}

package/src/bollharness/.boll/plugins/boll-review-toolkit/contracts/review-contract.yaml

@@ -0,0 +1,247 @@
+# boll vNext Review Contract
+# Companion to ../03-design.md §8. Addresses Phase 1 §6.2 (capability-delivery contradiction),
+# §3.3 (review-agent-gatekeeper matcher-miss), §3.1 (review-agent-isolation.md).
+# Grounded in Phase 2 §3.8 (closure = commit + packet), §2.1 (Codex review-pane pattern).
+#
+# A review-contract binding declares WHAT a review does. Each review mode is one of:
+#   pane      — reviewer is a diff pane + evidence packet produced by a tool (no agent spawn)
+#   subagent  — reviewer is a read-only subagent with strict tool whitelist
+#   human     — human is the reviewer; harness packages the evidence
+#
+# The single source of truth. No review happens outside a binding that parses as this schema.
+#
+# Evidence packet schema reference: `./evidence-packet-schema.json` (plugin-relative;
+#   co-located in this plugin's contracts/ directory per WP-037 packaging).
+#   Every `outputs.evidence_packet` below must conform to that schema; verify-gate.ts
+#   (WP-024) validates producer- and consumer-side agreement.
+#
+# Per-binding `active` field: true = binding is live; false = binding is present
+# but inert (parses, references the schema, but triggers no gate yet). WP-022
+# activates only `design-review` and `retirement-review` (the two human-gated
+# bindings); `default-build-review` and `merge-ready-review` ship as inactive
+# placeholders, activated later by WP-026 and WP-027 respectively.
+
+schema_version: 1
+evidence_packet_schema_ref: ./evidence-packet-schema.json
+
+# ── ADR-H5 §3 INV-H5-1: line_caps schema 化 ──
+# 把散落在 ADR-H0/H1/H3/H4 共 4 处的行数硬限收口为顶层字段。各 cap 数值由
+# source_adr 决定（H5 仅做收口聚合 + ref 指针，不重新定义数值）。
+# 红线（INV-H5-1）：增加新 cap 项必须在原始 ADR 中先有"≤N 行"明文规定。
+line_caps:
+  - id: adr-h-series
+    glob: "docs/decisions/ADR-H*.md"
+    max_lines: 300
+    source_adr: "ADR-H0 §H0.2"
+  - id: plan-h-series
+    glob: "docs/decisions/PLAN-H*.md"
+    max_lines: 500
+    source_adr: "ADR-H0 §H0.2"
+  - id: lead-skill-h-segment
+    glob: ".boll/skills/lead/SKILL.md"
+    max_lines: 220
+    source_adr: "ADR-H1 受管资产 + ADR-H4 INV-H4-1"
+  - id: memory-master-index
+    glob: "~/.boll/projects/-Users-nature------boll/memory/MEMORY.md"
+    max_lines: 200
+    source_adr: "ADR-H3 INV-H3-2 v1.1"
+
+# ── ADR-H5 §5 inflation 规则（3 条）──
+# 把 ADR-H0 §H0.2 行数限额 + H0.3 执检分离 + H0.4 自指禁止
+# 升级到 schema-level 字段（CC 直接读，不再 prompt-level 70%）。
+inflation:
+  no_grow_now_clean_later: true            # 规则 1: 不接受"merge 后下个 PR 拆"理由
+  drafter_reviewer_must_differ_session: true  # 规则 2: 起草人 ≠ reviewer 同 session
+  h0_self_check_segment_required: true     # 规则 3: 任何 ADR-Hx 必含 §H0 自检段
+
+# ── ADR-H6 §3 INV-H6-1: state 清单 schema 化 ──
+# 把 .boll/state + .boll/proposals + .boll/guard + .boll/log + .boll/inbox + .boll/evidence
+# 等 state 资产收口为顶层清单。kind: dynamic / archived / append-only / managed-by-other-h
+# 红线（INV-H6-1）：新增 state 资产路径必须先在原始 ADR 中宣告归属 owner。
+state_inventory:
+  - id: state-mode
+    path: ".boll/state/mode"
+    kind: dynamic
+    owner: boll-mode-toolkit
+  - id: state-run
+    path: ".boll/state/run.json"
+    kind: dynamic
+    owner: boll-mode-toolkit
+  - id: state-locks
+    path: ".boll/state/locks.json"
+    kind: dynamic
+    owner: boll-mode-toolkit
+  - id: state-completion-proposal
+    path: ".boll/state/completion-proposal.json"
+    kind: dynamic
+    owner: boll-review-toolkit
+  - id: state-risk-snapshot
+    path: ".boll/state/risk-snapshot.json"
+    kind: dynamic
+    owner: risk-tracker
+  - id: state-round-verdicts
+    path: ".boll/state/round{1-5}-verdicts/"
+    kind: archived
+    owner: harness-review-history
+  - id: state-archived-dir
+    path: ".boll/state/_archived/"
+    kind: archived
+    owner: ADR-H6
+  - id: proposals-self-evolution
+    path: ".boll/proposals/"
+    kind: append-only
+    owner: vNext-self-evolution
+    note: "265 文件; 只增不删"
+  - id: guard-loop-counter
+    path: ".boll/guard/"
+    kind: append-only
+    owner: harness-guard
+    note: "11321 文件; 活工具态非污染（H 系列调研 #4 认知修正）"
+  - id: log-self-symptoms
+    path: ".boll/log/harness-self-symptoms.md"
+    kind: append-only
+    owner: H 系列
+  - id: log-hook-ledger
+    path: ".boll/log/hook/"
+    kind: append-only
+    owner: 各 hook
+  - id: inbox-mailbox
+    path: ".boll/inbox/"
+    kind: managed-by-other-h
+    owner: ADR-H9
+    note: "main/quarantine/schema/window-h{0-6,8,9}"
+  - id: evidence-packets
+    path: ".boll/evidence/"
+    kind: managed-by-other-h
+    owner: 各 PLAN
+
+# ── ADR-H6 §3 INV-H6-2: state 健康度指标 schema 化 ──
+# 红线（INV-H6-2）：每条指标必须给出可执行 check 命令；不接受"靠人脑感知"。
+state_health_indicators:
+  - id: schema-validity
+    desc: "dynamic JSON 文件 JSON parse 通过 + 必填字段非空"
+    check: "npx ts-node -e 'import * as json from \"json\"; [json.parse(require(\"fs\").readFileSync(p,\"utf8\")) for p in [\".boll/state/run.json\", \".boll/state/locks.json\", \".boll/state/completion-proposal.json\", \".boll/state/risk-snapshot.json\"]]'"
+  - id: top-level-no-noise
+    desc: ".boll/state/ 顶层无 .DS_Store / 未归档 archived 文件 / 临时文件"
+    check: "ls .boll/state/.DS_Store .boll/state/*archived*.json 2>/dev/null | wc -l"
+    expect: 0
+  - id: inbox-unread-volume
+    desc: ".boll/inbox/main/unread/ ≤50 文件（H9 ADR 红线复用）"
+    check: "ls .boll/inbox/main/unread/ 2>/dev/null | wc -l"
+    expect_max: 50
+
+bindings:
+
+  - id: default-build-review
+    active: true                           # WP-026 activation — default build closures require pane packet
+    applies_when:
+      mode: build
+      task_kind: code_change
+    reviewer:
+      type: pane
+      produces: evidence-packet:kind=gate
+    inputs:
+      - diff: git_diff_against_main
+      - tests: required_tests_for_changed_files
+      - packet: previous_step_evidence
+    outputs:
+      - evidence_packet:
+          mode: build
+          kind: gate
+          claims:
+            - "diff is small enough to review (< 400 lines changed or ≥ 1 reviewer attestation)"
+            - "all changed files have at least one test that exercises the change OR a blocker entry"
+      - blockers_surface: top_level
+    gating:
+      blocks_mode_transition_to: verify
+      bypass_requires: human_attestation
+
+  - id: merge-ready-review
+    active: true                           # WP-027 activation — merge-ready gating + reviewer subagent installed
+    applies_when:
+      mode: verify
+      transition_target: release
+    reviewer:
+      type: subagent
+      subagent_ref: reviewer            # see ../prompts/agent-reviewer.md
+      tools_whitelist:                   # CC frontmatter `tools:` list; enforced at capability layer
+        - Read
+        - Glob
+        - Grep
+        - Bash(git log:*)
+        - Bash(git diff:*)
+        - Bash(npx jest --collect-only:*)
+      forbidden_tools: [Edit, Write, Bash(rm:*), Bash(git push:*), SendMessage]
+      # Phase 1 open-question C.2: if delivery requires SendMessage, the runtime
+      # MUST re-spawn via a separate delivery tool; reviewer itself stays pure.
+    # ── ADR-H5 §3 INV-H5-2: 执检分离 binding 化 ──
+    # 把 ADR-H0 §H0.3 从 ad-hoc prompt 升级到 schema 字段。reviewer subagent 必须
+    # 来自白名单；verdict 文件路径必须匹配 evidence_path_pattern。
+    drafter_reviewer_separation:
+      required: true
+      rationale: "ADR-H0 §H0.3 执检分离 + ADR-038 D11.2"
+      evidence_path_pattern: "docs/decisions/tasks/PLAN-{plan}/WP-05/reviewer-verdict-*.md"
+      reviewer_subagent_whitelist:
+        - "pr-review-toolkit:code-reviewer"
+        - "boll-review-toolkit:reviewer"
+    inputs:
+      - all_step_packets: true
+      - all_gate_packets: true
+      - aggregate_diff: true
+    outputs:
+      - evidence_packet:
+          mode: verify
+          kind: merge_ready
+          must_include_unknowns: true   # Phase 1 §6.1 anti-affordance: hiding unknowns fails gate
+    gating:
+      blocks_mode_transition_to: release
+      requires_all:
+        - every_unknown_in_earlier_packets_resolved_or_explicitly_deferred
+        - no_blocker_of_severity_block
+        - aggregate_diff_ci_green
+      bypass_requires: human_attestation_with_reason_string
+
+  - id: design-review
+    active: true                           # WP-022 activation — human-gated, low-traffic
+    applies_when:
+      mode: plan
+      transition_target: build
+    reviewer:
+      type: human
+    inputs:
+      - plan_file_ref: true
+      - reasoning_trace: optional
+    outputs:
+      - evidence_packet:
+          mode: plan
+          kind: gate
+    gating:
+      blocks_mode_transition_to: build
+      bypass_requires: never            # plan → build is always human-gated
+
+  - id: retirement-review
+    active: true                           # WP-022 activation — human-gated, rare, high-blast-radius
+    applies_when:
+      operation: retire_asset
+    reviewer:
+      type: pane
+      produces: evidence-packet:kind=retire
+    inputs:
+      - asset_path: required
+      - usage_stats: last_90_days
+      - replaced_by: required_or_explicit_null
+    outputs:
+      - evidence_packet:
+          mode: release
+          kind: retire
+          claims:
+            - "asset was used fewer than N times in last 90 days OR replaced_by is non-null"
+            - "retire target is .boll/retired/<date>/ (not deleted)"
+    gating:
+      requires: human_attestation
+
+# Explicit non-bindings — work that is NOT a review:
+non_reviews:
+  - user_asks_claude_a_question        # Phase 1 §6.3 mode collapse — chat ≠ review
+  - brainstorm                          # plan mode does not auto-trigger review
+  - read_only_exploration               # no review until a change is proposed

package/src/bollharness/.boll/rules/backend-routes.md

@@ -0,0 +1,31 @@
+---
+paths:
+  - "backend/**"
+  - "server/**"
+  - "api/**"
+---
+
+# {{PROJECT_NAME}} Backend Routes (Template)
+
+> 这是一个 domain-specific 的路由索引 rule 模板。bollharness fork 时保留骨架，业务内容由 {{PROJECT_NAME}} 安装后填充。
+
+## 如何使用
+
+1. 安装 bollharness 后, 把 `{{PROJECT_NAME}}` 替换成你的项目名
+2. 把下表的示例行替换为你项目的真实路由
+3. `.boll/rules/backend-routes.md` 的作用是让 agent 在读 `backend/**` 文件时自动加载此索引, 避免 agent 凭记忆猜路由
+
+## 路由索引
+
+| 方法 | 路径 | 模块 | 说明 |
+|------|------|------|------|
+| GET | `/api/{{DOMAIN}}/health` | {{DOMAIN}}/health.ts | 健康检查 |
+| POST | `/api/{{DOMAIN}}/{{RESOURCE}}` | {{DOMAIN}}/routes.ts | 创建资源示例 |
+
+## 真相源声明
+
+本文件**不是**路由的真相源。真相源永远是实际的 FastAPI / Flask / Express router 代码。这份 rule 只是让 agent 有个检索起点。如果 rule 和代码冲突, 以代码为准, 并提醒修本文件。
+
+## 生成建议
+
+如果项目规模较大, 推荐用脚本自动生成这份 rule（例如 `npx ts-node scripts/gen_routes_rule.ts > .boll/rules/backend-routes.md`）而不是人工维护。

package/src/bollharness/.boll/rules/closure-semantics.md

@@ -0,0 +1,30 @@
+---
+paths:
+  - "docs/issues/**"
+  - "docs/decisions/ADR-030*"
+  - "src/scripts/hooks/**"
+---
+
+# Closure Semantics
+
+## Fixed 三层定义
+
+Issue 标记 "Fixed" 不等于"症状消失"。三个层级：
+
+| 层级 | 含义 | 标准 | 标记 |
+|------|------|------|------|
+| Level 1 | 症状消失 | 生产不报错了，但没有分析复发路径 | Runtime Fixed |
+| Level 2 | 复发路径关闭 | 修了根因，分析了复发路径，写了 prevention_status | **Fixed** |
+| Level 3 | 机制消灭 | Fixed + 有机械化 guard 自动检测防止复发 | Fixed + Guarded |
+
+## Issue Doc YAML Frontmatter 规范
+
+所有 `docs/issues/` 下的 issue 文档必须包含以下 frontmatter 字段：
+
+```yaml
+status: fixed|open|wont_fix           # 当前状态
+prevention_status: open|closed        # 复发预防是否闭环
+mechanism_layer: guard|test|type|convention  # 防护机制层级
+```
+
+详见: `docs/decisions/ADR-030-guard-signal-and-governance-reload.md`