@christang/keel 5.2.0 → 5.2.1

package/assets/bootstrap/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- keel:start version=5.2.0 -->
+<!-- keel:start version=5.2.1 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.

package/assets/openspec/schemas/keel-spec-driven/templates/design.md

@@ -21,7 +21,7 @@ Ordinary narrative stays unnumbered. -->
 ## Hidden Knowledge / Assumptions
 
 <!-- Accepted hidden-knowledge assumptions from risk-triggered grill or domain
-profiles. Critical assumptions use A<n>, record Basis, and name Resolve by or a
+lenses. Critical assumptions use A<n>, record Basis, and name Resolve by or a
 durable Owner. Put compressed recovery context here when future sessions need
 it; keel/HANDOFF.md should only point to durable owners. Use "None." when empty. -->
 

package/bin/keel.js

@@ -47,7 +47,7 @@ const {
 const PACKAGE_ROOT = path.resolve(__dirname, "..");
 const PACKAGE_JSON = require(path.join(PACKAGE_ROOT, "package.json"));
 const INSTALL_SCRIPT = path.join(PACKAGE_ROOT, "scripts", "install_to_repo.py");
-const DEFAULT_UPDATE_SOURCE = "github:TanglmChris/keel";
+const DEFAULT_UPDATE_SOURCE = "@christang/keel";
 const VALID_TARGETS = new Set(["claude", "codex", "opencode", "both"]);
 const KEEL_SKILLS = [
   "keel-align-expectations",
@@ -378,8 +378,8 @@ function parseArgs(argv) {
     if (arg === "--profile" || arg.startsWith("--profile=")) {
       fail(
         "--profile is no longer supported: web, hardware, and hardware-dsl "
-          + "guidance is bundled with the keel-align-expectations skill as "
-          + "on-demand references"
+          + "guidance is now user-authored lenses in keel/lenses/*.md "
+          + "(scaffold with `keel lenses add`)"
       );
     }
     if (arg === "--repo") {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/scripts/install_to_repo.py

@@ -1010,7 +1010,7 @@ def main() -> int:
     parser.add_argument(
         "--profile",
         action="append",
-        help="Obsolete in v4; domain references are bundled with keel-align-expectations.",
+        help="Obsolete; domain guidance is now user-authored lenses in keel/lenses/*.md.",
     )
     args = parser.parse_args()
 
@@ -1019,8 +1019,8 @@ def main() -> int:
         if args.profile:
             print(
                 "Install failed: --profile is no longer supported; web, hardware, "
-                "and hardware-dsl guidance is bundled with the "
-                "keel-align-expectations skill as on-demand references",
+                "and hardware-dsl guidance is now user-authored lenses in "
+                "keel/lenses/*.md (scaffold with `keel lenses add`)",
                 file=sys.stderr,
             )
             return 1

package/scripts/validate_plugin.py

@@ -37,8 +37,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.2.0"
-PROTOCOL_VERSION = "5.2.0"
+PACKAGE_VERSION = "5.2.1"
+PROTOCOL_VERSION = "5.2.1"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 OPENSPEC_CONFIG_PATH = Path("openspec/config.yaml")
@@ -1750,23 +1750,23 @@ def validate_authoring_continuity_scenario() -> int:
     return 0
 
 
-def validate_domain_profiles_scenario() -> int:
+def validate_domain_lenses_scenario() -> int:
     plugin_skills_root = ROOT / PLUGIN_ROOT / "skills"
     if not (plugin_skills_root / "keel-align-expectations/SKILL.md").is_file():
-        report("domain-profiles scenario plugin misses the alignment skill")
+        report("domain-lenses scenario plugin misses the alignment skill")
         return 1
     lenses_root = ROOT / "assets/lenses"
     for template in ("web.md", "hardware.md", "hardware-dsl.md"):
         if not (lenses_root / template).is_file():
             report(
-                "domain-profiles scenario misses the shipped lens template: "
+                "domain-lenses scenario misses the shipped lens template: "
                 f"{template}"
             )
             return 1
     for legacy_skill in LEGACY_PROFILE_SKILLS:
         if (plugin_skills_root / legacy_skill).exists():
             report(
-                f"domain-profiles scenario plugin packages a legacy profile: {legacy_skill}"
+                f"domain-lenses scenario plugin packages a legacy profile: {legacy_skill}"
             )
             return 1
 
@@ -1776,20 +1776,20 @@ def validate_domain_profiles_scenario() -> int:
         repo.mkdir()
         install = run_keel(repo, "--install", "--target", "codex")
         if install.returncode != 0:
-            report("domain-profiles scenario default install failed:")
+            report("domain-lenses scenario default install failed:")
             report((install.stderr or install.stdout).strip())
             return 1
         if (repo / TARGET_SKILL_ROOTS["codex"]).exists():
             report(
-                "domain-profiles scenario thin install copied Keel skill trees; "
+                "domain-lenses scenario thin install copied Keel skill trees; "
                 "skills are plugin-owned in v4."
             )
             return 1
 
         rejected = run_keel(repo, "--install", "--target", "codex", "--profile", "web")
         rejected_text = (rejected.stderr or "") + (rejected.stdout or "")
-        if rejected.returncode == 0 or "bundled" not in rejected_text:
-            report("domain-profiles scenario still accepts --profile.")
+        if rejected.returncode == 0 or "keel/lenses" not in rejected_text:
+            report("domain-lenses scenario still accepts --profile.")
             report(rejected_text.strip())
             return 1
 
@@ -1801,7 +1801,7 @@ def validate_domain_profiles_scenario() -> int:
             or "Keel profiles" in doctor_text
         ):
             report(
-                "domain-profiles scenario doctor still reports profile state or "
+                "domain-lenses scenario doctor still reports profile state or "
                 "misses the native plugin surface."
             )
             report(doctor_text.strip())
@@ -1814,11 +1814,11 @@ def validate_domain_profiles_scenario() -> int:
             else ""
         )
         if uninstall.returncode != 0 or "keel:start" in agents_text:
-            report("domain-profiles scenario uninstall left the managed bootstrap.")
+            report("domain-lenses scenario uninstall left the managed bootstrap.")
             report((uninstall.stderr or uninstall.stdout).strip())
             return 1
 
-    report("domain-profiles scenario passed.")
+    report("domain-lenses scenario passed.")
     return 0
 
 
@@ -2396,6 +2396,42 @@ def validate_update_pack_install_scenario() -> int:
     return 0
 
 
+def validate_update_default_registry_scenario() -> int:
+    with tempfile.TemporaryDirectory(prefix="keel-update-default-") as raw_tmp:
+        tmp = Path(raw_tmp)
+        update = run_keel(tmp, "--update", "--dry-run")
+        if update.returncode != 0:
+            report("update-default-registry scenario keel --update --dry-run failed:")
+            report((update.stderr or update.stdout).strip())
+            return 1
+
+        pack_plan = (
+            "would run npm pack" in update.stdout
+            or "would run npm.cmd pack" in update.stdout
+        )
+        if not pack_plan:
+            report("update-default-registry scenario did not report a pack plan.")
+            report(update.stdout.strip())
+            return 1
+        if "@christang/keel" not in update.stdout:
+            report(
+                "update-default-registry scenario default source is not the "
+                "published registry package @christang/keel."
+            )
+            report(update.stdout.strip())
+            return 1
+        if "github:" in update.stdout:
+            report(
+                "update-default-registry scenario default source is a git-type "
+                "spec; self-update must default to the registry package."
+            )
+            report(update.stdout.strip())
+            return 1
+
+    report("update-default-registry scenario passed.")
+    return 0
+
+
 def run_keel_hook(repo: Path, event: dict) -> subprocess.CompletedProcess[str]:
     env = dict(os.environ)
     env["KEEL_CLI"] = str(ROOT / "bin/keel.js")
@@ -2642,7 +2678,7 @@ def validate_cli_scenario() -> int:
         if (
             update.returncode != 0
             or not pack_plan
-            or "github:TanglmChris/keel" not in update.stdout
+            or "@christang/keel" not in update.stdout
             or not install_plan
         ):
             report("cli scenario keel --update did not report global CLI update plan.")
@@ -5184,6 +5220,107 @@ def validate_core_gates_scenario() -> int:
     return 0
 
 
+def validate_scope_rename_attribution_scenario() -> int:
+    rename_task = (
+        "# Tasks\n\n"
+        "- [ ] 1.1 Complete behavior\n"
+        "  - Owner: keel-agent\n"
+        "  - Mode: implementation\n"
+        "  - Covers:\n"
+        "    - E1: public behavior\n"
+        "  - Read:\n"
+        "    - README.md\n"
+        "  - Touch:\n"
+        "    - src/renamed-from.js\n"
+        "    - src/renamed-to.js\n"
+        "    - openspec/changes/demo/tasks.md\n"
+        "  - Commands:\n"
+        "    - M1: node test.js\n"
+        "  - Acceptance:\n"
+        "    - Public behavior passes.\n"
+        "  - Autonomy boundary:\n"
+        "    - Default: hard-stop\n"
+        "    - Pre-authorized fallback: none\n"
+        "  - Coupling: none\n"
+        "  - Candidate Boundary:\n"
+        "    - One complete candidate reaches M1.\n"
+        "  - Stop Rules:\n"
+        "    - Stop on final assertion failure.\n"
+        "  - Evidence:\n"
+        "    - M1: passed\n"
+        "    - Review:\n"
+        "      - Status: pass\n"
+        "      - Acceptance check: public behavior reviewed\n"
+        "      - Scope check: Touch reviewed semantically\n"
+        "      - Findings: none\n"
+        "    - Blocker: none\n"
+        "  - Stop if:\n"
+        "    - Requires files outside Touch.\n"
+        "  - Report:\n"
+        "    - Summary\n"
+    )
+    with tempfile.TemporaryDirectory(prefix="keel-scope-rename-") as raw_tmp:
+        repo = Path(raw_tmp)
+        write_text(repo / "openspec/changes/demo/tasks.md", rename_task)
+        write_text(repo / "src/renamed-from.js", "module.exports = 1;\n")
+        write_text(repo / "README.md", "readme\n")
+        for args in (
+            ["init", "--quiet"],
+            ["config", "user.email", "keel@example.invalid"],
+            ["config", "user.name", "Keel Fixture"],
+            ["add", "."],
+            ["commit", "--quiet", "-m", "baseline"],
+        ):
+            result = subprocess.run(
+                ["git", *args], cwd=repo, capture_output=True, text=True
+            )
+            if result.returncode != 0:
+                report("scope-rename scenario git setup failed:")
+                report((result.stderr or result.stdout).strip())
+                return 1
+        # A staged rename whose old and new paths are both in Touch must not be a
+        # false outside-Touch failure (git reports it as one `old -> new` entry).
+        moved = subprocess.run(
+            ["git", "mv", "src/renamed-from.js", "src/renamed-to.js"],
+            cwd=repo,
+            capture_output=True,
+            text=True,
+        )
+        if moved.returncode != 0:
+            report("scope-rename scenario git mv failed:")
+            report((moved.stderr or moved.stdout).strip())
+            return 1
+        completed = run_keel(
+            repo,
+            "gate",
+            "task-complete",
+            "--change",
+            "demo",
+            "--task",
+            "1.1",
+            "--base",
+            "HEAD",
+            "--json",
+        )
+        payload = json.loads(completed.stdout or "{}")
+        outside = " ".join(
+            problem.get("message", "") for problem in payload.get("problems", [])
+        )
+        if (
+            completed.returncode != 0
+            or payload.get("status") != "pass"
+            or "outside" in outside.lower()
+        ):
+            report(
+                "scope-rename scenario reported a false outside-touch failure for a "
+                "git mv rename whose old and new paths are both in Touch."
+            )
+            report((completed.stderr or completed.stdout).strip())
+            return 1
+    report("scope-rename scenario passed.")
+    return 0
+
+
 def validate_target_capability_adapters_scenario() -> int:
     capability_keys = (
         "continuity.start",
@@ -9950,6 +10087,7 @@ def validate_doctor_openspec_honesty_scenario() -> int:
 SCENARIOS: tuple = (
     ("stateless-continuity", validate_stateless_continuity_scenario),
     ("core-gates", validate_core_gates_scenario),
+    ("scope-rename-attribution", validate_scope_rename_attribution_scenario),
     ("target-capability-adapters", validate_target_capability_adapters_scenario),
     ("native-runtime-projection", validate_native_runtime_projection_scenario),
     ("target-surface", validate_target_surface_scenario),
@@ -9957,7 +10095,7 @@ SCENARIOS: tuple = (
     ("expectation-slice-gates", validate_expectation_slice_gates_scenario),
     ("expectation-completion-gates", validate_expectation_completion_gates_scenario),
     ("authoring-continuity", validate_authoring_continuity_scenario),
-    ("domain-profiles", validate_domain_profiles_scenario),
+    ("domain-lenses", validate_domain_lenses_scenario),
     ("skill-portability-policy", validate_skill_portability_policy_scenario),
     ("version-alignment", validate_version_alignment_scenario),
     ("openspec-surface-overlay", validate_openspec_surface_overlay_scenario),
@@ -9965,6 +10103,7 @@ SCENARIOS: tuple = (
     ("cli", validate_cli_scenario),
     ("doctor-openspec-honesty", validate_doctor_openspec_honesty_scenario),
     ("update-pack-install", validate_update_pack_install_scenario),
+    ("update-default-registry", validate_update_default_registry_scenario),
     ("task-contract-core", validate_task_contract_core_scenario),
     ("task-capsule", validate_task_capsule_scenario),
     ("task-verification-strategies", validate_task_verification_strategies_scenario),

package/src/core/gates.js

@@ -237,7 +237,16 @@ function gitPaths(repo) {
   return status.stdout
     .split(/\r?\n/)
     .filter(Boolean)
-    .map((line) => line.slice(3).trim().replace(/\\/g, "/"));
+    .flatMap((line) => {
+      // A staged rename/copy is one porcelain line, `R  old -> new`; attribute
+      // both endpoints so a rename whose old and new paths are in Touch is not
+      // a false outside-Touch failure. Every other line carries one path.
+      const entry = line.slice(3).trim().replace(/\\/g, "/");
+      const arrow = entry.indexOf(" -> ");
+      return arrow === -1
+        ? [entry]
+        : [entry.slice(0, arrow), entry.slice(arrow + 4)];
+    });
 }
 
 function touchEntries(task, contract = null) {