@christang/keel 5.2.2 → 5.2.4

package/scripts/validate_plugin.py

@@ -37,8 +37,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.2.2"
-PROTOCOL_VERSION = "5.2.2"
+PACKAGE_VERSION = "5.2.4"
+PROTOCOL_VERSION = "5.2.4"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 OPENSPEC_CONFIG_PATH = Path("openspec/config.yaml")
@@ -3713,6 +3713,924 @@ def task_capsule_compact_fixture() -> str:
     )
 
 
+def validate_non_concrete_verify_diagnostic_scenario() -> int:
+    """A compact v4 task whose Verify carries an unfilled token must be told so.
+
+    Regression for issue #7 example 1: the compact/expanded decision reads
+    isConcrete(Verify), so one unfilled token used to select the expanded v3
+    required-field set and report fields the author never declared.
+    """
+    v3_only_fields = (
+        "Owner",
+        "Read",
+        "Commands",
+        "Acceptance",
+        "Candidate Boundary",
+        "Report",
+    )
+    with tempfile.TemporaryDirectory(prefix="keel-non-concrete-verify-") as raw_tmp:
+        repo = Path(raw_tmp)
+        # A bare token in prose. The reporter's own case wrote it inside an
+        # inline code span, which the inline-code-is-concrete scenario now
+        # covers as legitimately filled; what must still be reported is a token
+        # standing unfenced in the text.
+        task = task_capsule_compact_fixture().replace(
+            "    - M1: node test.js\n",
+            "    - M1: node test.js writes ledger/scan-log/<date>.md\n",
+        )
+        write_text(repo / "openspec/changes/demo/tasks.md", task)
+        started = run_keel(
+            repo,
+            "gate",
+            "task-start",
+            "--change",
+            "demo",
+            "--task",
+            "1.1",
+            "--json",
+        )
+        payload = json.loads(started.stdout)
+        problems = payload.get("problems", [])
+        codes = {problem.get("code") for problem in problems}
+        if "non-concrete-verify" not in codes:
+            report(
+                "non-concrete-verify-diagnostic: an unfilled token in Verify did "
+                "not produce the non-concrete-verify diagnostic."
+            )
+            report(started.stdout.strip())
+            return 1
+        named = [
+            problem
+            for problem in problems
+            if problem.get("code") == "non-concrete-verify"
+            and "<date>" in problem.get("message", "")
+        ]
+        if not named:
+            report(
+                "non-concrete-verify-diagnostic: the diagnostic did not name the "
+                "matched token."
+            )
+            report(started.stdout.strip())
+            return 1
+        leaked = sorted(
+            field
+            for problem in problems
+            if problem.get("code") == "missing-field"
+            for field in v3_only_fields
+            if problem.get("message", "").startswith(f"{field} must be concrete")
+        )
+        if leaked:
+            report(
+                "non-concrete-verify-diagnostic: expanded v3 fields were still "
+                f"reported as missing: {', '.join(leaked)}."
+            )
+            report(started.stdout.strip())
+            return 1
+        # A task with no Verify at all is a genuine expanded v3 task and must
+        # keep its existing required-field diagnostics.
+        bare = task_capsule_compact_fixture()
+        for block in (
+            "  - Verify:\n    - Strategy: evidence-first\n    - M1: node test.js\n",
+        ):
+            bare = bare.replace(block, "")
+        write_text(repo / "openspec/changes/bare/tasks.md", bare)
+        bare_started = run_keel(
+            repo,
+            "gate",
+            "task-start",
+            "--change",
+            "bare",
+            "--task",
+            "1.1",
+            "--json",
+        )
+        bare_payload = json.loads(bare_started.stdout)
+        bare_codes = {
+            problem.get("code") for problem in bare_payload.get("problems", [])
+        }
+        if "non-concrete-verify" in bare_codes:
+            report(
+                "non-concrete-verify-diagnostic: a task with no Verify was "
+                "reported as carrying an unfilled token."
+            )
+            report(bare_started.stdout.strip())
+            return 1
+    if "non-concrete-verify-diagnostic" not in {name for name, _ in SCENARIOS}:
+        report(
+            "non-concrete-verify-diagnostic: the scenario registry does not "
+            "include it."
+        )
+        return 1
+    report("non-concrete-verify-diagnostic scenario passed.")
+    return 0
+
+
+def validate_inline_code_is_concrete_scenario() -> int:
+    """Unfilled-token forms inside inline code spans are documented patterns.
+
+    Regression for issue #7 example 1: the reporter's Verify wrote a filename
+    pattern inside backticks and it was still judged unfilled. The exemption
+    covers every token form, not only angle brackets, because prose naming the
+    keywords is equally common — see
+    keel/archive/follow-ups/2026-07-27-unfilled-token-keywords.md.
+    """
+    fenced_m1 = (
+        "    - M1: node test.js writes `ledger/scan-log/<date>.md`, skips a "
+        "`TODO` marker, and leaves `TBD` rows alone\n"
+    )
+    bare_m1 = "    - M1: node test.js writes ledger/scan-log/<date>.md\n"
+    with tempfile.TemporaryDirectory(prefix="keel-inline-code-") as raw_tmp:
+        repo = Path(raw_tmp)
+        write_text(
+            repo / "openspec/changes/fenced/tasks.md",
+            task_capsule_compact_fixture().replace(
+                "    - M1: node test.js\n", fenced_m1
+            ),
+        )
+        fenced = run_keel(
+            repo, "gate", "task-start", "--change", "fenced", "--task", "1.1", "--json"
+        )
+        if fenced.returncode != 0:
+            report(
+                "inline-code-is-concrete: token forms inside inline code spans "
+                "were still judged unfilled."
+            )
+            report((fenced.stdout or fenced.stderr).strip())
+            return 1
+        # The same token outside inline code must still be caught, otherwise the
+        # exemption has swallowed the check it is narrowing.
+        write_text(
+            repo / "openspec/changes/bare/tasks.md",
+            task_capsule_compact_fixture().replace(
+                "    - M1: node test.js\n", bare_m1
+            ),
+        )
+        bare = run_keel(
+            repo, "gate", "task-start", "--change", "bare", "--task", "1.1", "--json"
+        )
+        bare_codes = {
+            problem.get("code")
+            for problem in json.loads(bare.stdout).get("problems", [])
+        }
+        if "non-concrete-verify" not in bare_codes:
+            report(
+                "inline-code-is-concrete: a bare token outside inline code was "
+                "no longer reported as unfilled."
+            )
+            report(bare.stdout.strip())
+            return 1
+        # Stripping runs after the emptiness test, so a field that is entirely
+        # one code span must not read as empty.
+        write_text(
+            repo / "openspec/changes/whole/tasks.md",
+            task_capsule_compact_fixture()
+            .replace("    - M1: node test.js\n", "    - M1: `node test.js`\n")
+            .replace("    - src/feature.js\n", "    - `src/feature.js`\n"),
+        )
+        whole = run_keel(
+            repo, "gate", "task-start", "--change", "whole", "--task", "1.1", "--json"
+        )
+        if whole.returncode != 0:
+            report(
+                "inline-code-is-concrete: a field whose whole value is one "
+                "inline code span was judged empty."
+            )
+            report((whole.stdout or whole.stderr).strip())
+            return 1
+    if "inline-code-is-concrete" not in {name for name, _ in SCENARIOS}:
+        report("inline-code-is-concrete: the scenario registry does not include it.")
+        return 1
+    report("inline-code-is-concrete scenario passed.")
+    return 0
+
+
+def validate_covers_separator_collision_scenario() -> int:
+    """Issue #7 example 2: a requirement name containing the hierarchy separator.
+
+    Both spellings the reporter tried must fail loudly and say why. Keeping the
+    slash over-segments the reference, which used to compile to an unlinked
+    legacy-task-reference and PASS; removing it resolves nothing and used to
+    give a generic message.
+    """
+    collide = "Continue or downgrade or switch/window criteria"
+
+    def spec(requirement: str) -> str:
+        return (
+            "# cap\n\n## Purpose\nDemo.\n\n"
+            f"### Requirement: {requirement}\nText.\n\n"
+            "#### Scenario: Criteria cover three outcomes\n"
+            "- **WHEN** a thing\n- **THEN** another\n"
+        )
+
+    def tasks(reference: str) -> str:
+        return task_capsule_compact_fixture().replace(
+            "    - E1: Public behavior passes.\n", f"    - {reference}\n"
+        )
+
+    with tempfile.TemporaryDirectory(prefix="keel-covers-collision-") as raw_tmp:
+        repo = Path(raw_tmp)
+        write_text(repo / "openspec/specs/collide-cap/spec.md", spec(collide))
+        write_text(repo / "openspec/specs/clean-cap/spec.md", spec("Plain name"))
+
+        def start(change: str, reference: str):
+            write_text(repo / f"openspec/changes/{change}/tasks.md", tasks(reference))
+            result = run_keel(
+                repo, "gate", "task-start", "--change", change, "--task", "1.1",
+                "--json",
+            )
+            return json.loads(result.stdout)
+
+        # The reporter's correct spelling: over-segmented, capability is real.
+        kept = start(
+            "kept",
+            f"collide-cap / {collide} / Criteria cover three outcomes",
+        )
+        kept_messages = " ".join(
+            problem.get("message", "") for problem in kept.get("problems", [])
+        )
+        kept_kinds = {
+            entry.get("kind")
+            for entry in kept.get("contract", {})
+            .get("capsule", {})
+            .get("authority", [])
+        }
+        if kept.get("status") != "fail" or "legacy-task-reference" in kept_kinds:
+            report(
+                "covers-separator-collision: an over-segmented reference to a "
+                "real capability still degraded to a free-text reference."
+            )
+            report(json.dumps(kept.get("problems"), ensure_ascii=False))
+            return 1
+        if collide not in kept_messages or "separator" not in kept_messages:
+            report(
+                "covers-separator-collision: the over-segmented diagnostic did "
+                "not name the colliding requirement."
+            )
+            report(kept_messages)
+            return 1
+        # The reporter's fallback spelling: resolves to nothing.
+        trimmed = start(
+            "trimmed",
+            "collide-cap / Continue or downgrade or switchwindow criteria"
+            " / Criteria cover three outcomes",
+        )
+        trimmed_messages = " ".join(
+            problem.get("message", "") for problem in trimmed.get("problems", [])
+        )
+        if collide not in trimmed_messages:
+            report(
+                "covers-separator-collision: the unresolved diagnostic did not "
+                "name the colliding requirement."
+            )
+            report(trimmed_messages)
+            return 1
+        # A capability with no collision keeps the plain wording.
+        plain = start(
+            "plain", "clean-cap / No such requirement / No such scenario"
+        )
+        plain_messages = " ".join(
+            problem.get("message", "") for problem in plain.get("problems", [])
+        )
+        if "separator" in plain_messages:
+            report(
+                "covers-separator-collision: a capability with no colliding "
+                "name still received the separator hint."
+            )
+            report(plain_messages)
+            return 1
+        # Free text that merely contains slashes is not a spec reference.
+        free = start("free", "E1: writes a/b/c and passes")
+        free_kinds = {
+            entry.get("kind")
+            for entry in free.get("contract", {})
+            .get("capsule", {})
+            .get("authority", [])
+        }
+        if free.get("status") != "pass" or free_kinds != {"legacy-task-reference"}:
+            report(
+                "covers-separator-collision: free text containing slashes was "
+                "no longer accepted as a legacy reference."
+            )
+            report(json.dumps(free.get("problems"), ensure_ascii=False))
+            return 1
+    if "covers-separator-collision" not in {name for name, _ in SCENARIOS}:
+        report(
+            "covers-separator-collision: the scenario registry does not include it."
+        )
+        return 1
+    report("covers-separator-collision scenario passed.")
+    return 0
+
+
+def validate_unresolved_authority_names_field_scenario() -> int:
+    """Issue #7 example 3: the diagnostic must name what it actually reads.
+
+    The check reads only the task's `Pre-authorized fallback:` line. The old
+    wording said "documented design authority", which sent authors to design.md
+    where the answer usually already was.
+    """
+    with tempfile.TemporaryDirectory(prefix="keel-unresolved-authority-") as raw:
+        repo = Path(raw)
+        # design.md documents Q1 and an authorized fallback in prose, which is
+        # exactly the state the reporter was in when the message misdirected.
+        write_text(
+            repo / "openspec/changes/demo/design.md",
+            "## Questions\n\nQ1 — Should the widget retry on timeout?\n\n"
+            "Authorized fallback: retry twice with backoff, then stop.\n",
+        )
+        without = task_capsule_compact_fixture().replace(
+            "    - E1: Public behavior passes.\n", "    - Q1\n"
+        )
+        write_text(repo / "openspec/changes/demo/tasks.md", without)
+        result = run_keel(
+            repo, "gate", "task-start", "--change", "demo", "--task", "1.1", "--json"
+        )
+        payload = json.loads(result.stdout)
+        messages = [
+            problem.get("message", "")
+            for problem in payload.get("problems", [])
+            if problem.get("code") == "unresolved-authority"
+        ]
+        if not messages:
+            report(
+                "unresolved-authority-names-field: a Q reference with no "
+                "authorized fallback produced no unresolved-authority diagnostic."
+            )
+            report(result.stdout.strip())
+            return 1
+        message = messages[0]
+        required = ("Autonomy boundary:", "Pre-authorized fallback:", "design.md")
+        missing = [needle for needle in required if needle not in message]
+        if missing:
+            report(
+                "unresolved-authority-names-field: the diagnostic omitted "
+                f"{', '.join(missing)}."
+            )
+            report(message)
+            return 1
+        if "documented design authority" in message:
+            report(
+                "unresolved-authority-names-field: the diagnostic still points "
+                "at design.md as the thing to add."
+            )
+            report(message)
+            return 1
+        # Doing literally what the message asks must clear it.
+        with_fallback = without.replace(
+            "    - Pre-authorized fallback: none\n",
+            "    - Pre-authorized fallback: retry twice with backoff then stop;"
+            " evidence is the retry log\n",
+        )
+        write_text(repo / "openspec/changes/fixed/tasks.md", with_fallback)
+        write_text(
+            repo / "openspec/changes/fixed/design.md",
+            "## Questions\n\nQ1 — Should the widget retry on timeout?\n",
+        )
+        fixed = run_keel(
+            repo, "gate", "task-start", "--change", "fixed", "--task", "1.1", "--json"
+        )
+        if fixed.returncode != 0:
+            report(
+                "unresolved-authority-names-field: following the diagnostic did "
+                "not clear it."
+            )
+            report((fixed.stdout or fixed.stderr).strip())
+            return 1
+    if "unresolved-authority-names-field" not in {name for name, _ in SCENARIOS}:
+        report(
+            "unresolved-authority-names-field: the scenario registry does not "
+            "include it."
+        )
+        return 1
+    report("unresolved-authority-names-field scenario passed.")
+    return 0
+
+
+def validate_dev_only_plugin_source_scoping_scenario() -> int:
+    """Issue #6: plugins/keel/ exists only in Keel's own repository.
+
+    In a consuming project the source check is permanently `missing` and the
+    next line told the author to install a plugin they had just installed.
+    """
+    with tempfile.TemporaryDirectory(prefix="keel-dev-only-scope-") as raw:
+        consumer = Path(raw)
+        init = run_keel(consumer, "--init", "--target", "claude")
+        if init.returncode != 0:
+            report("dev-only-plugin-source-scoping: keel --init failed.")
+            report((init.stderr or init.stdout).strip())
+            return 1
+        doctor = run_keel(consumer, "--doctor")
+        out = doctor.stdout or ""
+        if "native plugin source" in out:
+            report(
+                "dev-only-plugin-source-scoping: a consuming project was still "
+                "shown the development-only plugin source check."
+            )
+            report(out)
+            return 1
+        if "install the plugin if it is missing" in out:
+            report(
+                "dev-only-plugin-source-scoping: a consuming project was still "
+                "told to install an already-installed plugin."
+            )
+            report(out)
+            return 1
+        if "plugin source" in out:
+            report(
+                "dev-only-plugin-source-scoping: the plugin source clause "
+                "leaked into a consuming project's capability lines."
+            )
+            report(out)
+            return 1
+        # Keel's own repository must keep the check, which is where it means
+        # something: the manifest and the CLI have to agree before release.
+        own = run_keel(ROOT, "--doctor")
+        if "native plugin source" not in (own.stdout or ""):
+            report(
+                "dev-only-plugin-source-scoping: Keel's own repository lost the "
+                "plugin source check."
+            )
+            report((own.stdout or own.stderr).strip())
+            return 1
+    if "dev-only-plugin-source-scoping" not in {name for name, _ in SCENARIOS}:
+        report(
+            "dev-only-plugin-source-scoping: the scenario registry does not "
+            "include it."
+        )
+        return 1
+    report("dev-only-plugin-source-scoping scenario passed.")
+    return 0
+
+
+def validate_source_repo_bootstrap_skip_scenario() -> int:
+    """Issue #9: `keel --install` must not overwrite Keel's own AGENTS.md.
+
+    Keel's repository AGENTS.md carries the full protocol that four scenarios
+    assert on; the packaged asset is the shorter consumer bootstrap. Writing it
+    here drops those sections and turns the repository red.
+    """
+    managed = re.compile(
+        r"<!--\s*keel:start.*?<!--\s*keel:end\s*-->", re.DOTALL
+    )
+
+    def block(path: Path) -> str:
+        found = managed.search(path.read_text(encoding="utf-8"))
+        return found.group(0) if found else ""
+
+    own_agents = ROOT / "AGENTS.md"
+    before = block(own_agents)
+    if not before:
+        report("source-repo-bootstrap-skip: Keel's AGENTS.md has no managed block.")
+        return 1
+    result = run_keel(ROOT, "--install", "--target", "claude")
+    if result.returncode != 0:
+        report("source-repo-bootstrap-skip: keel --install failed in Keel's repo.")
+        report((result.stderr or result.stdout).strip())
+        return 1
+    if block(own_agents) != before:
+        report(
+            "source-repo-bootstrap-skip: keel --install rewrote Keel's own "
+            "AGENTS.md managed block."
+        )
+        return 1
+    if "skip AGENTS.md" not in (result.stdout or ""):
+        report(
+            "source-repo-bootstrap-skip: the skip was silent; it must be "
+            "reported explicitly."
+        )
+        report((result.stdout or "").strip())
+        return 1
+    # A consuming project must still receive the bootstrap.
+    with tempfile.TemporaryDirectory(prefix="keel-bootstrap-consumer-") as raw:
+        consumer = Path(raw)
+        installed = run_keel(consumer, "--install", "--target", "claude")
+        if installed.returncode != 0:
+            report(
+                "source-repo-bootstrap-skip: keel --install failed in a "
+                "consuming project."
+            )
+            report((installed.stderr or installed.stdout).strip())
+            return 1
+        asset_block = block(ROOT / "assets/bootstrap/AGENTS.md")
+        if block(consumer / "AGENTS.md") != asset_block:
+            report(
+                "source-repo-bootstrap-skip: a consuming project did not "
+                "receive the packaged bootstrap block."
+            )
+            return 1
+    if "source-repo-bootstrap-skip" not in {name for name, _ in SCENARIOS}:
+        report(
+            "source-repo-bootstrap-skip: the scenario registry does not include it."
+        )
+        return 1
+    report("source-repo-bootstrap-skip scenario passed.")
+    return 0
+
+
+TRACKER_OWNER = "https://github.com/TanglmChris/keel/issues/12"
+
+
+def tracker_owner_tasks(findings: str, closure: str) -> str:
+    """One complete, checked task plus one Expectation Coverage closure line."""
+    return (
+        "# Tasks\n\n"
+        "## Expectation Coverage\n\n"
+        "- E1:\n"
+        f"  - {closure}\n\n"
+        "## 1. Work\n\n"
+        "- [x] 1.1 Complete behavior\n"
+        "  - Owner: keel-agent\n"
+        "  - Mode: implementation\n"
+        "  - Covers:\n"
+        "    - E1: public behavior\n"
+        "  - Read:\n"
+        "    - README.md\n"
+        "  - Touch:\n"
+        "    - src/feature.js\n"
+        "  - Commands:\n"
+        "    - M1: node test.js\n"
+        "  - Acceptance:\n"
+        "    - Public behavior passes.\n"
+        "  - Autonomy boundary:\n"
+        "    - Default: hard-stop\n"
+        "    - Pre-authorized fallback: none\n"
+        "  - Coupling: none\n"
+        "  - Candidate Boundary:\n"
+        "    - One candidate.\n"
+        "  - Stop Rules:\n"
+        "    - Stop on failure.\n"
+        "  - Evidence:\n"
+        "    - M1: passed\n"
+        "    - Review:\n"
+        "      - Status: pass\n"
+        "      - Acceptance check: reviewed\n"
+        "      - Scope check: reviewed\n"
+        f"      - Findings: {findings}\n"
+        "    - Blocker: none\n"
+        "  - Stop if:\n"
+        "    - Scope expands.\n"
+        "  - Report:\n"
+        "    - Summary\n"
+    )
+
+
+def validate_tracker_durable_owner_scenario() -> int:
+    """Issue #12: an issue tracker is a durable follow-up owner.
+
+    The gate enumerated three repository-local forms, so a project whose
+    declared follow-up owner is an issue tracker had to write a local note per
+    finding whose only job was to be a shape the gate recognized. The tracker
+    form is now accepted in both places a durable owner is required, and every
+    previously accepted form still passes.
+    """
+    with tempfile.TemporaryDirectory(prefix="keel-tracker-owner-") as raw:
+        repo = Path(raw)
+        tasks = repo / "openspec/changes/demo/tasks.md"
+        write_text(repo / "openspec/changes/demo/proposal.md", "# Proposal\n")
+        write_text(
+            repo / "openspec/changes/demo/specs/demo/spec.md",
+            "## ADDED Requirements\n",
+        )
+
+        def complete(findings: str, closure: str = "Covered by: 1.1"):
+            write_text(tasks, tracker_owner_tasks(findings, closure))
+            return run_keel(
+                repo, "gate", "task-complete",
+                "--change", "demo", "--task", "1.1", "--json",
+            )
+
+        def close(closure: str):
+            write_text(tasks, tracker_owner_tasks("none", closure))
+            return run_keel(
+                repo, "gate", "change-close",
+                "--change", "demo", "--action", "sync", "--json",
+            )
+
+        tracker = complete(f"stale local note; owner {TRACKER_OWNER}")
+        if tracker.returncode != 0:
+            report(
+                "tracker-durable-owner: a finding owned by an absolute tracker "
+                "reference was still refused."
+            )
+            report((tracker.stderr or tracker.stdout).strip())
+            return 1
+
+        unowned = complete("stale local note that names no owner at all")
+        unowned_payload = json.loads(unowned.stdout) if unowned.stdout else {}
+        message = " ".join(
+            problem.get("message", "")
+            for problem in unowned_payload.get("problems", [])
+            if problem.get("code") == "finding-owner"
+        )
+        if unowned.returncode != 3 or "http" not in message:
+            report(
+                "tracker-durable-owner: an unowned finding must still fail, and "
+                "the error must list the tracker form among the accepted ones."
+            )
+            report((unowned.stderr or unowned.stdout).strip())
+            return 1
+
+        handoff = complete("stale local note; owner keel/HANDOFF.md")
+        if handoff.returncode != 3:
+            report(
+                "tracker-durable-owner: keel/HANDOFF.md must still be refused "
+                "as a finding owner."
+            )
+            report((handoff.stderr or handoff.stdout).strip())
+            return 1
+
+        archived = complete("stale local note; owner keel/archive/follow-ups/x.md")
+        if archived.returncode != 0:
+            report(
+                "tracker-durable-owner: the pre-existing keel/archive owner form "
+                "regressed."
+            )
+            report((archived.stderr or archived.stdout).strip())
+            return 1
+
+        closed_by_tracker = close(f"Durable owner: {TRACKER_OWNER}")
+        if closed_by_tracker.returncode != 0:
+            report(
+                "tracker-durable-owner: change-close refused an Expectation "
+                "Coverage durable owner naming a tracker reference."
+            )
+            report((closed_by_tracker.stderr or closed_by_tracker.stdout).strip())
+            return 1
+
+        closed_by_task = close("Covered by: 1.1")
+        if closed_by_task.returncode != 0:
+            report(
+                "tracker-durable-owner: the pre-existing Covered by closure "
+                "regressed at change-close."
+            )
+            report((closed_by_task.stderr or closed_by_task.stdout).strip())
+            return 1
+
+        closed_unowned = close("pending")
+        if closed_unowned.returncode != 3:
+            report(
+                "tracker-durable-owner: change-close must still reject an E1 "
+                "with no coverage, owner, or discard reason."
+            )
+            report((closed_unowned.stderr or closed_unowned.stdout).strip())
+            return 1
+
+    if "tracker-durable-owner" not in {name for name, _ in SCENARIOS}:
+        report("tracker-durable-owner: the scenario registry does not include it.")
+        return 1
+    report("tracker-durable-owner scenario passed.")
+    return 0
+
+
+def validate_guard_manifest_ignored_scenario() -> int:
+    """Issue #11: the guard manifest was written but declared ignorable nowhere.
+
+    Every gate run left an untracked `keel/guard.json` in the project, and
+    because completion attributes working-tree paths against Touch, that is a
+    permanent exception the author re-adjudicates at every completion.
+    """
+    with tempfile.TemporaryDirectory(prefix="keel-guard-ignore-") as raw:
+        project = Path(raw)
+        init = run_keel(project, "--install", "--target", "claude")
+        if init.returncode != 0:
+            report("guard-manifest-ignored: keel --install failed.")
+            report((init.stderr or init.stdout).strip())
+            return 1
+        ignore_path = project / "keel/.gitignore"
+        if not ignore_path.is_file():
+            report(
+                "guard-manifest-ignored: keel --install did not scaffold "
+                "keel/.gitignore."
+            )
+            return 1
+        declared = ignore_path.read_text(encoding="utf-8")
+        if "guard.json" not in declared:
+            report(
+                "guard-manifest-ignored: the scaffolded keel/.gitignore does "
+                "not declare the guard manifest."
+            )
+            report(declared)
+            return 1
+
+        # git must actually honour the declaration: initialize a repository,
+        # write a manifest through a passing task-start, and confirm the path
+        # never appears in porcelain status.
+        if subprocess.run(
+            ["git", "init", "--quiet"], cwd=project, capture_output=True
+        ).returncode != 0:
+            report("guard-manifest-ignored: git init failed in the fixture.")
+            return 1
+        write_text(
+            project / "openspec/changes/demo/tasks.md",
+            tracker_owner_tasks("none", "Covered by: 1.1").replace(
+                "- [x] 1.1", "- [ ] 1.1"
+            ),
+        )
+        started = run_keel(
+            project, "gate", "task-start",
+            "--change", "demo", "--task", "1.1", "--json",
+        )
+        if started.returncode != 0 or not (project / "keel/guard.json").is_file():
+            report(
+                "guard-manifest-ignored: the fixture did not produce a guard "
+                "manifest to test the declaration against."
+            )
+            report((started.stderr or started.stdout).strip())
+            return 1
+        status = subprocess.run(
+            ["git", "status", "--short", "--untracked-files=all"],
+            cwd=project, capture_output=True, encoding="utf-8",
+        )
+        if "guard.json" in (status.stdout or ""):
+            report(
+                "guard-manifest-ignored: git still reports the guard manifest "
+                "after a gate run, so the declaration does not take effect."
+            )
+            report(status.stdout or "")
+            return 1
+
+        # Scaffold once: a project's own file is never rewritten.
+        own = "# mine\nguard.json\nscratch/\n"
+        write_text(ignore_path, own)
+        again = run_keel(project, "--install", "--target", "claude")
+        if again.returncode != 0 or ignore_path.read_text(encoding="utf-8") != own:
+            report(
+                "guard-manifest-ignored: a second install overwrote the "
+                "project's own keel/.gitignore."
+            )
+            report((again.stderr or again.stdout).strip())
+            return 1
+
+    if not (ROOT / "keel/.gitignore").is_file():
+        report(
+            "guard-manifest-ignored: Keel's own repository does not declare "
+            "the guard manifest ignorable."
+        )
+        return 1
+    if "guard-manifest-ignored" not in {name for name, _ in SCENARIOS}:
+        report("guard-manifest-ignored: the scenario registry does not include it.")
+        return 1
+    report("guard-manifest-ignored scenario passed.")
+    return 0
+
+
+def validate_guard_status_is_not_enforcement_scenario() -> int:
+    """Issue #14: `Guard: started` means the manifest was written.
+
+    Authors read it as "writes are being checked now". The two came apart when a
+    session kept plugin state that predated a marketplace switch: the manifest
+    was valid and keel's PreToolUse hook never ran. Keel cannot observe the hook
+    from the repository, so the result must say so rather than imply otherwise.
+    """
+    needles = ("enforcement", "runtime hook", "cannot observe")
+    # Assertive claims only: the honest sentence legitimately denies that a
+    # written manifest proves anything, so a bare "writes are checked" substring
+    # would match the denial itself.
+    forbidden = (
+        "enforcement is active",
+        "enforcement is live",
+        "writes are guarded",
+    )
+    with tempfile.TemporaryDirectory(prefix="keel-guard-honesty-") as raw:
+        project = Path(raw)
+        write_text(
+            project / "openspec/changes/demo/tasks.md",
+            tracker_owner_tasks("none", "Covered by: 1.1").replace(
+                "- [x] 1.1", "- [ ] 1.1"
+            ),
+        )
+        started = run_keel(
+            project, "guard", "start",
+            "--change", "demo", "--task", "1.1", "--json",
+        )
+        if started.returncode != 0:
+            report("guard-status-is-not-enforcement: keel guard start failed.")
+            report((started.stderr or started.stdout).strip())
+            return 1
+        for label, result in (
+            ("start", started),
+            (
+                "status",
+                run_keel(project, "guard", "status", "--json"),
+            ),
+        ):
+            payload = json.loads(result.stdout) if result.stdout else {}
+            warnings = " ".join(payload.get("warnings", []))
+            missing = [needle for needle in needles if needle not in warnings]
+            if missing:
+                report(
+                    f"guard-status-is-not-enforcement: keel guard {label} does "
+                    "not state that the status describes the manifest and that "
+                    "enforcement depends on a runtime hook Keel cannot observe; "
+                    f"missing {missing}."
+                )
+                report(result.stdout or result.stderr or "")
+                return 1
+            if not payload.get("status"):
+                report(
+                    f"guard-status-is-not-enforcement: keel guard {label} lost "
+                    "its status value."
+                )
+                return 1
+            human = run_keel(
+                project,
+                "guard",
+                *(("start", "--change", "demo", "--task", "1.1", "--force")
+                  if label == "start" else ("status",)),
+            )
+            if "runtime hook" not in (human.stdout or ""):
+                report(
+                    f"guard-status-is-not-enforcement: the human-readable keel "
+                    f"guard {label} output omits the enforcement boundary."
+                )
+                report(human.stdout or human.stderr or "")
+                return 1
+            for phrase in forbidden:
+                if phrase in warnings or phrase in (human.stdout or ""):
+                    report(
+                        f"guard-status-is-not-enforcement: keel guard {label} "
+                        f"asserts observed enforcement: {phrase!r}."
+                    )
+                    return 1
+        # The pre-existing durability statement must survive alongside it.
+        status_payload = json.loads(
+            run_keel(project, "guard", "status", "--json").stdout
+        )
+        if not any(
+            "durable authority" in warning
+            for warning in status_payload.get("warnings", [])
+        ):
+            report(
+                "guard-status-is-not-enforcement: the existing durable-authority "
+                "statement was dropped."
+            )
+            return 1
+    if "guard-status-is-not-enforcement" not in {name for name, _ in SCENARIOS}:
+        report(
+            "guard-status-is-not-enforcement: the scenario registry does not "
+            "include it."
+        )
+        return 1
+    report("guard-status-is-not-enforcement scenario passed.")
+    return 0
+
+
+def validate_source_repo_cli_resolution_scenario() -> int:
+    """Issue #13 item 3: a bare `keel` runs the installed package.
+
+    When the repository under change *is* Keel, gate commands verify the
+    installed CLI rather than the working tree, and the failure mode is a
+    silently stale result rather than an error. One dogfood round was lost to
+    two spurious problems reported by a stale global CLI.
+    """
+    own = run_keel(ROOT, "--doctor")
+    out = own.stdout or ""
+    if "node bin/keel.js" not in out:
+        report(
+            "source-repo-cli-resolution: Keel's own repository is not told to "
+            "run gate commands through its own entry point."
+        )
+        report(out)
+        return 1
+    # The local entry point needs an explicit repository argument; an author
+    # who copies the hint without it gets an unrelated failure.
+    hint = next(
+        (line for line in out.splitlines() if "node bin/keel.js" in line), ""
+    )
+    # The line must be advisory: it describes a hazard, not a repository
+    # failure, so it must never push doctor toward a non-ok verdict.
+    for needle in ("gate", ".", "advisory"):
+        if needle not in hint:
+            report(
+                "source-repo-cli-resolution: the hint does not name a usable "
+                f"invocation, or is not advisory; missing {needle!r} in: {hint}"
+            )
+            return 1
+    with tempfile.TemporaryDirectory(prefix="keel-cli-resolution-") as raw:
+        consumer = Path(raw)
+        init = run_keel(consumer, "--init", "--target", "claude")
+        if init.returncode != 0:
+            report("source-repo-cli-resolution: keel --init failed.")
+            report((init.stderr or init.stdout).strip())
+            return 1
+        consumer_doctor = run_keel(consumer, "--doctor")
+        if "node bin/keel.js" in (consumer_doctor.stdout or ""):
+            report(
+                "source-repo-cli-resolution: a consuming project was shown a "
+                "hazard that exists only in Keel's own repository."
+            )
+            report(consumer_doctor.stdout or "")
+            return 1
+    if "source-repo-cli-resolution" not in {name for name, _ in SCENARIOS}:
+        report(
+            "source-repo-cli-resolution: the scenario registry does not "
+            "include it."
+        )
+        return 1
+    report("source-repo-cli-resolution scenario passed.")
+    return 0
+
+
 def validate_task_capsule_scenario() -> int:
     with tempfile.TemporaryDirectory(prefix="keel-task-capsule-") as raw_tmp:
         repo = Path(raw_tmp)
@@ -4887,14 +5805,19 @@ def validate_core_gates_scenario() -> int:
         (completion_repo / "openspec/changes/other/proposal.md").unlink()
         (completion_repo / "openspec/specs/demo-spec/spec.md").unlink()
 
-        # Explicit --record replaces exactly the selected task's literal
-        # pending Contract anchor; a non-pending or missing anchor refuses
-        # loudly writing nothing; without the flag the gate stays read-only.
+        # Explicit --record replaces the selected task's Contract anchor
+        # whatever it currently holds, so reauthorizing a task whose authority
+        # changed needs no manual edit; a no-op re-record writes nothing, only
+        # a missing anchor refuses, and without the flag the gate stays
+        # read-only.
         record_repo = root / "record-anchor"
         record_repo.mkdir()
         record_tasks = record_repo / "openspec/changes/demo/tasks.md"
 
-        def record_task(anchor: str) -> str:
+        def record_task(anchor: str, extra_touch: bool = False) -> str:
+            touch = "    - src/feature.js\n"
+            if extra_touch:
+                touch += "    - src/extra.js\n"
             return (
                 "# Tasks\n\n"
                 "- [ ] 1.1 Record behavior\n"
@@ -4905,8 +5828,8 @@ def validate_core_gates_scenario() -> int:
                 "  - Read:\n"
                 "    - README.md\n"
                 "  - Touch:\n"
-                "    - src/feature.js\n"
-                "    - openspec/changes/demo/tasks.md\n"
+                + touch
+                + "    - openspec/changes/demo/tasks.md\n"
                 "  - Commands:\n"
                 "    - M1: node test.js\n"
                 "  - Acceptance:\n"
@@ -4951,8 +5874,15 @@ def validate_core_gates_scenario() -> int:
             report("core-gates scenario --record on a pending anchor failed.")
             report((recorded.stderr or recorded.stdout).strip())
             return 1
+        recorded_result = json.loads(recorded.stdout)
+        if recorded_result.get("record", {}).get("status") != "recorded":
+            report(
+                "core-gates scenario --record over a pending anchor must "
+                "report the outcome as recorded."
+            )
+            return 1
         fingerprint = (
-            json.loads(recorded.stdout)
+            recorded_result
             .get("contract", {})
             .get("fingerprint", {})
             .get("value", "")
@@ -4993,23 +5923,67 @@ def validate_core_gates_scenario() -> int:
             )
             return 1
 
-        before_refusal = record_tasks.read_bytes()
+        before_noop = record_tasks.read_bytes()
+        noop = run_keel(
+            record_repo, "gate", "task-start",
+            "--change", "demo", "--task", "1.1", "--no-guard", "--record",
+            "--json",
+        )
+        noop_result = json.loads(noop.stdout) if noop.stdout else {}
+        if (
+            noop.returncode != 0
+            or noop_result.get("record", {}).get("status") != "unchanged"
+            or noop_result.get("warnings")
+            or record_tasks.read_bytes() != before_noop
+        ):
+            report(
+                "core-gates scenario --record over an anchor that already "
+                "carries the compiled fingerprint must report unchanged, "
+                "warn about nothing, and write nothing."
+            )
+            report((noop.stderr or noop.stdout).strip())
+            return 1
+
+        # Reauthorization: the task authority changes, so the recorded anchor
+        # is now stale and --record must replace it rather than refuse.
+        anchor_line = f"keel-task-capsule/v1 sha256:{fingerprint}"
+        write_text(record_tasks, record_task(anchor_line, extra_touch=True))
+        before_rerecord = record_tasks.read_text(encoding="utf-8").splitlines()
         rerecord = run_keel(
             record_repo, "gate", "task-start",
             "--change", "demo", "--task", "1.1", "--no-guard", "--record",
             "--json",
         )
+        rerecord_result = json.loads(rerecord.stdout) if rerecord.stdout else {}
+        new_fingerprint = (
+            rerecord_result.get("contract", {}).get("fingerprint", {}).get("value", "")
+        )
+        after_rerecord = record_tasks.read_text(encoding="utf-8").splitlines()
+        rerecord_changed = [
+            (old, new)
+            for old, new in zip(before_rerecord, after_rerecord)
+            if old != new
+        ]
         if (
-            rerecord.returncode != 3
+            rerecord.returncode != 0
+            or rerecord_result.get("record", {}).get("status") != "rerecorded"
+            or fingerprint not in rerecord_result.get("record", {}).get("previous", "")
+            or not new_fingerprint
+            or new_fingerprint == fingerprint
+            or len(before_rerecord) != len(after_rerecord)
+            or len(rerecord_changed) != 1
+            or rerecord_changed[0][1]
+            != f"    - Contract: keel-task-capsule/v1 sha256:{new_fingerprint}"
             or not any(
-                problem.get("code") == "record-refused"
-                for problem in json.loads(rerecord.stdout).get("problems", [])
+                fingerprint in warning
+                for warning in rerecord_result.get("warnings", [])
             )
-            or record_tasks.read_bytes() != before_refusal
         ):
             report(
-                "core-gates scenario --record on an already-recorded anchor "
-                "must refuse deterministically and write nothing."
+                "core-gates scenario --record over a stale recorded anchor "
+                "must replace exactly that line with the new fingerprint, "
+                "report the outcome as rerecorded with the replaced value, "
+                "and warn naming the fingerprint it replaced."
             )
             report((rerecord.stderr or rerecord.stdout).strip())
             return 1
@@ -9110,12 +10084,16 @@ def validate_thin_native_install_scenario() -> int:
             report(uncertain_text.strip())
             return 1
 
-        # --- Case E: doctor reports the missing native plugin with remediation ---
+        # --- Case E: doctor reports the native plugin runtime with remediation ---
+        # These repos consume Keel, so the runtime line and its install
+        # remediation must appear, while the plugin *source* check must not:
+        # plugins/keel/ exists only in Keel's own repository and `keel --init`
+        # never creates it, so reporting it here is a permanent unactionable
+        # `missing`. See the dev-only-plugin-source-scoping scenario.
         doctor = run_keel(repo, "--doctor")
         doctor_text = (doctor.stdout or "") + (doctor.stderr or "")
         if (
-            "native plugin source" not in doctor_text
-            or "native plugin runtime" not in doctor_text
+            "native plugin runtime" not in doctor_text
             or "keel@<marketplace>" not in doctor_text
         ):
             report(
@@ -9124,14 +10102,21 @@ def validate_thin_native_install_scenario() -> int:
             )
             report(doctor_text.strip())
             return 1
+        if "native plugin source" in doctor_text:
+            report(
+                "thin-native-install doctor reported the development-only "
+                "plugin source check in a consuming project."
+            )
+            report(doctor_text.strip())
+            return 1
         missing_repo = tmp / "no-plugin"
         missing_repo.mkdir()
         missing_doctor = run_keel(missing_repo, "--doctor")
         missing_text = (missing_doctor.stdout or "") + (missing_doctor.stderr or "")
-        if "plugin source absent" not in missing_text:
+        if "plugin source" in missing_text:
             report(
-                "thin-native-install doctor does not diagnose an absent native "
-                "plugin source."
+                "thin-native-install doctor diagnosed a plugin source outside "
+                "Keel's own repository."
             )
             report(missing_text.strip())
             return 1
@@ -10400,6 +11385,31 @@ SCENARIOS: tuple = (
     ("fast-pre-push-hooks", validate_fast_pre_push_hooks_scenario),
     ("fast-pre-push-doctor", validate_fast_pre_push_doctor_scenario),
     ("verify-layer-tag", validate_verify_layer_tag_scenario),
+    (
+        "non-concrete-verify-diagnostic",
+        validate_non_concrete_verify_diagnostic_scenario,
+    ),
+    ("inline-code-is-concrete", validate_inline_code_is_concrete_scenario),
+    ("covers-separator-collision", validate_covers_separator_collision_scenario),
+    (
+        "unresolved-authority-names-field",
+        validate_unresolved_authority_names_field_scenario,
+    ),
+    (
+        "dev-only-plugin-source-scoping",
+        validate_dev_only_plugin_source_scoping_scenario,
+    ),
+    (
+        "source-repo-bootstrap-skip",
+        validate_source_repo_bootstrap_skip_scenario,
+    ),
+    ("tracker-durable-owner", validate_tracker_durable_owner_scenario),
+    ("guard-manifest-ignored", validate_guard_manifest_ignored_scenario),
+    (
+        "guard-status-is-not-enforcement",
+        validate_guard_status_is_not_enforcement_scenario,
+    ),
+    ("source-repo-cli-resolution", validate_source_repo_cli_resolution_scenario),
     ("task-contract-core", validate_task_contract_core_scenario),
     ("task-capsule", validate_task_capsule_scenario),
     ("task-verification-strategies", validate_task_verification_strategies_scenario),