@christang/keel 5.2.4 → 5.3.0

package/assets/bootstrap/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- keel:start version=5.2.4 -->
+<!-- keel:start version=5.3.0 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.

package/assets/openspec/schemas/keel-spec-driven/templates/tasks.md

@@ -40,7 +40,11 @@
     - Blocker: none
 
 <!-- Exceptional boundaries are declared only when they differ from defaults:
-     - Mode: diagnose-only (with `Touch: none`) or plan-first
+     - Mode: diagnose-only or repo-action (both with `Touch: none`), or plan-first.
+       repo-action is for a task whose whole effect is an authorized
+       repository-level action — a commit, a tag — and which writes no worktree
+       file; it is the one mode that may commit, and it still may not push,
+       sync, archive, or mark tasks complete
      - Read: additional required starting context beyond the base set
      - Acceptance: a task-specific observable delta the Covers authority does not express
      - Execution recommendation / Rationale: advisory notes for the current agent

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.2.4",
+  "version": "5.3.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.2.4",
+  "version": "5.3.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.2.4",
+  "version": "5.3.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/scripts/pretooluse-guard.js

@@ -84,6 +84,29 @@ function pathAllowed(candidate, touch) {
   });
 }
 
+// A checked task keeps its records writable so it can finish the Evidence its
+// completion gate requires, but earns no further product authorization. Byte
+// hashing used to enforce this by accident, since ticking the box changed
+// tasks.md; now it is stated. An unreadable or unmatched tasks.md is not read as
+// checked — every gate that compiles the capsule catches that, and denying
+// product writes on a parse miss would trade a real capability for a guess.
+function taskIsChecked(repo, manifest) {
+  const file = path.join(
+    repo, "openspec", "changes", manifest.change, "tasks.md"
+  );
+  let content = "";
+  try {
+    content = fs.readFileSync(file, "utf8");
+  } catch {
+    return false;
+  }
+  const id = manifest.task.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = content.match(
+    new RegExp(`^\\s*-\\s*\\[([ xX])\\]\\s*${id}(?![0-9.])`, "m")
+  );
+  return Boolean(match && match[1].toLowerCase() === "x");
+}
+
 function main() {
   let event = {};
   try {
@@ -114,8 +137,30 @@ function main() {
     return 0;
   }
   const pointer = `${manifest.change}#${manifest.task}`;
+  // The record layer: the guarded change's own directory holds the records the
+  // task produces — its checkbox, Evidence, and Review — not the product it
+  // changes. `keel gate task-complete` already refuses to attribute this
+  // directory as an outside-Touch failure, so denying it here made the guard
+  // stop the one thing the completion gate is waiting for. Derived from the
+  // manifest's existing `change` field, so no manifest shape changes.
+  const recordPrefix = `openspec/changes/${manifest.change}/`;
+
+  const target = event.tool_input ? event.tool_input[pathField] : null;
+  if (typeof target !== "string" || !target) return 0;
+  const relative = path.relative(repo, path.resolve(repo, target));
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    return 0;
+  }
+  const candidate = relative.replace(/\\/g, "/");
+  if (candidate.startsWith(recordPrefix)) return 0;
 
   for (const entry of manifest.authority) {
+    // Same boundary: bytes under the guarded change's own directory are
+    // records, and the capsule fingerprint — which carries no checkbox state
+    // and no Evidence values — is what separates a record write from a
+    // contract change. `keel guard status` and `keel gate task-complete`
+    // compile the capsule and compare it; this hook cannot, and must not guess.
+    if (entry.path.replace(/\\/g, "/").startsWith(recordPrefix)) continue;
     const file = path.join(repo, entry.path);
     let fresh = null;
     try {
@@ -134,13 +179,17 @@ function main() {
     }
   }
 
-  const target = event.tool_input ? event.tool_input[pathField] : null;
-  if (typeof target !== "string" || !target) return 0;
-  const relative = path.relative(repo, path.resolve(repo, target));
-  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+  if (taskIsChecked(repo, manifest)) {
+    deny(
+      `Keel write guard: ${pointer} is checked complete, so it authorizes no `
+        + `further product writes — ${candidate} is denied. Its own `
+        + `${recordPrefix} records stay writable so the task can finish its `
+        + "Evidence. Run `keel guard clear`, then authorize the next task "
+        + "explicitly with `keel gate task-start`."
+    );
     return 0;
   }
-  const candidate = relative.replace(/\\/g, "/");
+
   if (pathAllowed(candidate, manifest.touch)) return 0;
 
   deny(

package/scripts/validate_plugin.py

@@ -37,8 +37,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.2.4"
-PROTOCOL_VERSION = "5.2.4"
+PACKAGE_VERSION = "5.3.0"
+PROTOCOL_VERSION = "5.3.0"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 OPENSPEC_CONFIG_PATH = Path("openspec/config.yaml")
@@ -10367,6 +10367,294 @@ def expect_guard_allow(
     return 0
 
 
+RECORD_LAYER_SPEC = (
+    "# demo-cap Specification\n\n"
+    "## Purpose\n"
+    "Fixture capability for the record-layer scenario.\n\n"
+    "## Requirements\n"
+    "### Requirement: Guarded behavior holds\n"
+    "The guarded feature MUST keep its public behavior.\n\n"
+    "#### Scenario: Guarded public behavior passes\n"
+    "- **WHEN** the guarded feature runs\n"
+    "- **THEN** it passes\n"
+)
+
+
+def record_layer_tasks(checked: bool = False, touch: str = "src/feature.js") -> str:
+    box = "x" if checked else " "
+    return (
+        "# Tasks\n\n"
+        f"- [{box}] 1.1 Exercise guarded feature\n"
+        "  - Covers:\n"
+        "    - demo-cap / Guarded behavior holds / Guarded public behavior passes\n"
+        "  - Touch:\n"
+        f"    - {touch}\n"
+        "  - Verify:\n"
+        "    - Strategy: evidence-first\n"
+        "    - M1: node test.js\n"
+        "  - Evidence:\n"
+        "    - M1: pending\n"
+    )
+
+
+def mode_fixture_tasks(mode: str, touch: str) -> str:
+    return (
+        "# Tasks\n\n"
+        "- [ ] 1.1 Establish the version baseline\n"
+        f"  - Mode: {mode}\n"
+        "  - Covers:\n"
+        "    - E1: the repository carries its first commit\n"
+        "  - Touch:\n"
+        f"    - {touch}\n"
+        "  - Verify:\n"
+        "    - Strategy: evidence-first\n"
+        "    - M1: git rev-parse HEAD resolves and git log reports one commit\n"
+        "  - Evidence:\n"
+        "    - Contract: pending\n"
+        "    - M1: pending\n"
+    )
+
+
+def validate_repo_action_mode_scenario() -> int:
+    """Issue #8 example 2: a repository action had no legal contract.
+
+    A task whose whole effect is the repository's first commit writes no
+    worktree file, so it has no concrete Touch; it is not diagnose-only,
+    because it has real side effects needing evidence; and `Touch: none` was
+    accepted for no other mode. The author was forced to name a path the task
+    did not write, which then tripped the drift defect in example 1.
+    """
+    label = "repo-action-mode"
+
+    def compile_task(repo: Path, mode: str, touch: str):
+        write_text(repo / "openspec/changes/demo/tasks.md", mode_fixture_tasks(mode, touch))
+        return run_keel(
+            repo, "gate", "task-start",
+            "--change", "demo", "--task", "1.1", "--no-guard", "--json",
+        )
+
+    with tempfile.TemporaryDirectory(prefix="keel-repo-action-") as raw:
+        repo = Path(raw)
+
+        started = compile_task(repo, "repo-action", "none")
+        if started.returncode != 0:
+            report(f"{label}: `Mode: repo-action` with `Touch: none` was rejected.")
+            report((started.stderr or started.stdout).strip())
+            return 1
+        capsule = json.loads(started.stdout).get("contract", {}).get("capsule", {})
+        prohibitions = capsule.get("prohibitions", [])
+        if capsule.get("mode") != "repo-action":
+            report(f"{label}: the capsule did not record the repo-action mode.")
+            return 1
+        if "must not write product files" not in prohibitions:
+            report(
+                f"{label}: repo-action must prohibit product writes; got "
+                f"{prohibitions}."
+            )
+            return 1
+        if "must not commit" in prohibitions:
+            report(
+                f"{label}: repo-action must be the mode that may commit; got "
+                f"{prohibitions}."
+            )
+            return 1
+
+        # Every other mode keeps the commit prohibition.
+        for mode, touch in (
+            ("implementation", "src/feature.js"),
+            ("plan-first", "src/feature.js"),
+            ("diagnose-only", "none"),
+        ):
+            other = compile_task(repo, mode, touch)
+            if other.returncode != 0:
+                report(f"{label}: `Mode: {mode}` regressed and no longer compiles.")
+                report((other.stderr or other.stdout).strip())
+                return 1
+            other_capsule = (
+                json.loads(other.stdout).get("contract", {}).get("capsule", {})
+            )
+            if "must not commit" not in other_capsule.get("prohibitions", []):
+                report(f"{label}: `Mode: {mode}` lost the commit prohibition.")
+                return 1
+            product_write_prohibited = (
+                "must not write product files"
+                in other_capsule.get("prohibitions", [])
+            )
+            if product_write_prohibited != (mode == "diagnose-only"):
+                report(
+                    f"{label}: `Mode: {mode}` changed its product-write "
+                    "prohibition."
+                )
+                return 1
+
+        # repo-action means no worktree writes, so a concrete Touch contradicts it.
+        with_touch = compile_task(repo, "repo-action", "src/feature.js")
+        with_touch_problems = (
+            json.loads(with_touch.stdout).get("problems", [])
+            if with_touch.stdout
+            else []
+        )
+        touch_message = " ".join(
+            item.get("message", "")
+            for item in with_touch_problems
+            if item.get("code") == "invalid-touch"
+        )
+        if with_touch.returncode == 0 or "Touch: none" not in touch_message:
+            report(
+                f"{label}: repo-action with a concrete Touch must fail with a "
+                "diagnostic naming the `Touch: none` it requires."
+            )
+            report((with_touch.stderr or with_touch.stdout).strip())
+            return 1
+
+        unsupported = compile_task(repo, "repo-actions", "none")
+        unsupported_message = " ".join(
+            item.get("message", "")
+            for item in (
+                json.loads(unsupported.stdout).get("problems", [])
+                if unsupported.stdout
+                else []
+            )
+            if item.get("code") == "unsupported-mode"
+        )
+        missing = [
+            mode
+            for mode in ("implementation", "diagnose-only", "plan-first", "repo-action")
+            if mode not in unsupported_message
+        ]
+        if unsupported.returncode == 0 or missing:
+            report(
+                f"{label}: the unsupported-mode diagnostic must list every "
+                f"supported mode; missing {missing}."
+            )
+            report((unsupported.stderr or unsupported.stdout).strip())
+            return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_touch_guard_record_layer_scenario() -> int:
+    """Issue #8: the guard denied what the completion gate already forgives.
+
+    `scopeProblems` exempts the selected change's own `openspec/changes/<change>/`
+    directory from outside-Touch attribution, but the guard denied writes there
+    and treated the byte hash of that change's tasks.md as authority, so ticking
+    a checkbox or appending Evidence locked the task out of its own bookkeeping.
+    """
+    label = "touch-guard-record-layer"
+    with tempfile.TemporaryDirectory(prefix="keel-record-layer-") as raw:
+        repo = Path(raw)
+        tasks = repo / "openspec/changes/demo/tasks.md"
+        spec = repo / "openspec/specs/demo-cap/spec.md"
+        write_text(tasks, record_layer_tasks())
+        write_text(spec, RECORD_LAYER_SPEC)
+        write_text(repo / "openspec/changes/other/tasks.md", "# Tasks\n")
+        write_text(repo / "keel/archive/follow-ups/note.md", "# Note\n")
+
+        started = run_keel(
+            repo, "guard", "start", "--change", "demo", "--task", "1.1", "--json"
+        )
+        if started.returncode != 0:
+            report(f"{label}: guard start failed on the fixture.")
+            report((started.stderr or started.stdout).strip())
+            return 1
+        manifest = json.loads(started.stdout).get("manifest", {})
+        authority = [entry.get("path") for entry in manifest.get("authority", [])]
+        if not any(item == "openspec/specs/demo-cap/spec.md" for item in authority):
+            report(
+                f"{label}: the fixture does not record an authority file outside "
+                f"the change directory, so the negative case is untested: {authority}"
+            )
+            return 1
+
+        # The record layer: writable although Touch never named it.
+        if expect_guard_allow(repo, tasks, f"{label} record write"):
+            return 1
+        # A record write already made must not lock the task out of its product
+        # writes — this is the drift half of the reported defect.
+        write_text(tasks, record_layer_tasks().replace("M1: pending", "M1: done"))
+        if expect_guard_allow(repo, repo / "src/feature.js", f"{label} after record write"):
+            return 1
+
+        # The layer is exactly this change's directory, nothing wider.
+        if expect_guard_deny(
+            repo,
+            repo / "openspec/changes/other/tasks.md",
+            ["outside Touch"],
+            f"{label} other change",
+        ):
+            return 1
+        if expect_guard_deny(
+            repo,
+            repo / "keel/archive/follow-ups/note.md",
+            ["outside Touch"],
+            f"{label} archive tree",
+        ):
+            return 1
+
+        # Authority outside the change directory still hashes and still denies.
+        write_text(spec, RECORD_LAYER_SPEC.replace("it passes", "it passes twice"))
+        if expect_guard_deny(
+            repo,
+            repo / "src/feature.js",
+            ["authority drift"],
+            f"{label} real authority drift",
+        ):
+            return 1
+        write_text(spec, RECORD_LAYER_SPEC)
+
+        status = run_keel(repo, "guard", "status", "--json")
+        status_payload = json.loads(status.stdout) if status.stdout else {}
+        codes = [item.get("code") for item in status_payload.get("problems", [])]
+        if status_payload.get("status") != "active" or codes:
+            report(
+                f"{label}: guard status reported {status_payload.get('status')!r} "
+                f"with problems {codes} after a record write; a checkbox or "
+                "Evidence write is not authority drift."
+            )
+            return 1
+
+        # A real contract edit in the same file must still hard-stop, through the
+        # fingerprint rather than through byte hashing.
+        write_text(tasks, record_layer_tasks(touch="src/other.js"))
+        drifted = run_keel(repo, "guard", "status", "--json")
+        drifted_codes = [
+            item.get("code")
+            for item in (json.loads(drifted.stdout) if drifted.stdout else {}).get(
+                "problems", []
+            )
+        ]
+        if "fingerprint-drift" not in drifted_codes:
+            report(
+                f"{label}: editing the task's Touch line did not report "
+                f"fingerprint drift; got {drifted_codes}."
+            )
+            return 1
+
+        # Once checked, product writes stop but the task can still finish its
+        # own records — the completion gate requires that Evidence.
+        write_text(tasks, record_layer_tasks(checked=True))
+        if expect_guard_deny(
+            repo,
+            repo / "src/feature.js",
+            ["checked complete"],
+            f"{label} completed product write",
+        ):
+            return 1
+        if expect_guard_allow(repo, tasks, f"{label} completed record write"):
+            return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
 def validate_touch_write_guard_scenario() -> int:
     with tempfile.TemporaryDirectory(
         prefix="keel-touch-guard-", ignore_cleanup_errors=True
@@ -11156,18 +11444,32 @@ def validate_touch_guard_drift_scenario() -> int:
                 "Exercise guarded feature", "Exercise guarded feature differently"
             ),
         )
-        if expect_guard_deny(
-            repo,
-            repo / "src/feature.js",
-            ["drift", "demo", "1.1", "keel guard start"],
-            "touch-guard-drift authority edit",
+        # A contract edit inside the guarded change's own directory is caught
+        # where the capsule is compiled, not at the next write: the hook cannot
+        # compile, so it cannot separate this from a checkbox or Evidence write
+        # in the same file. It therefore allows the write and `guard status`
+        # reports the drift. Authority *outside* that directory still denies at
+        # write time — see the touch-guard-record-layer scenario.
+        if expect_guard_allow(
+            repo, repo / "src/feature.js", "touch-guard-drift contract edit"
         ):
             return 1
         status = run_keel(repo, "guard", "status", "--json")
-        if status.returncode != 3 or json.loads(status.stdout).get("status") != "drifted":
+        status_payload = json.loads(status.stdout) if status.stdout else {}
+        if status.returncode != 3 or status_payload.get("status") != "drifted":
             report("touch-guard-drift: status did not report drifted.")
             report((status.stderr or status.stdout).strip())
             return 1
+        if not any(
+            item.get("code") == "fingerprint-drift"
+            for item in status_payload.get("problems", [])
+        ):
+            report(
+                "touch-guard-drift: the contract edit was not reported as "
+                "fingerprint drift by the check that compiles the capsule."
+            )
+            report(status.stdout or "")
+            return 1
 
         restarted = run_keel(
             repo, "guard", "start", "--change", "demo", "--task", "1.1", "--json"
@@ -11184,30 +11486,41 @@ def validate_touch_guard_drift_scenario() -> int:
         ):
             return 1
 
+        # A fingerprint-neutral edit to the task's own file is a record write,
+        # not drift. This used to fail closed, which is the defect issue #8
+        # reports: appending Evidence blocked every following write.
         tasks_path.write_text(
             tasks_path.read_text(encoding="utf-8") + "\n", encoding="utf-8"
         )
-        if expect_guard_deny(
-            repo,
-            repo / "src/feature.js",
-            ["drift", "keel guard start"],
-            "touch-guard-drift cosmetic edit fails closed",
+        if expect_guard_allow(
+            repo, repo / "src/feature.js", "touch-guard-drift cosmetic edit"
         ):
             return 1
-        cosmetic = run_keel(
-            repo, "guard", "start", "--change", "demo", "--task", "1.1", "--json"
+        cosmetic = run_keel(repo, "guard", "status", "--json")
+        cosmetic_payload = json.loads(cosmetic.stdout) if cosmetic.stdout else {}
+        if cosmetic_payload.get("status") != "active" or cosmetic_payload.get(
+            "problems"
+        ):
+            report(
+                "touch-guard-drift: a fingerprint-neutral edit to the task's "
+                "own file was reported as a guard problem."
+            )
+            report(cosmetic.stdout or "")
+            return 1
+        restarted_cosmetic = run_keel(
+            repo, "guard", "start", "--change", "demo", "--task", "1.1",
+            "--force", "--json",
         )
-        if cosmetic.returncode != 0:
+        if restarted_cosmetic.returncode != 0:
             report("touch-guard-drift: cosmetic restart failed.")
+            report((restarted_cosmetic.stderr or restarted_cosmetic.stdout).strip())
             return 1
-        third = json.loads(cosmetic.stdout)["manifest"]["fingerprint"]["value"]
+        third = json.loads(restarted_cosmetic.stdout)["manifest"]["fingerprint"][
+            "value"
+        ]
         if third != second:
             report("touch-guard-drift: cosmetic edit drifted the capsule fingerprint.")
             return 1
-        if expect_guard_allow(
-            repo, repo / "src/feature.js", "touch-guard-drift cosmetic restart"
-        ):
-            return 1
 
         write_text(
             tasks_path,
@@ -11437,6 +11750,8 @@ SCENARIOS: tuple = (
     ("native-helper-targets", validate_native_helper_targets_scenario),
     ("native-single-task-matrix", validate_native_single_task_matrix_scenario),
     ("touch-write-guard", validate_touch_write_guard_scenario),
+    ("touch-guard-record-layer", validate_touch_guard_record_layer_scenario),
+    ("repo-action-mode", validate_repo_action_mode_scenario),
     ("touch-guard-drift", validate_touch_guard_drift_scenario),
     ("touch-guard-surface", validate_touch_guard_surface_scenario),
     ("plugin-compaction-continuity", validate_plugin_compaction_continuity_scenario),

package/src/core/guard.js

@@ -247,7 +247,13 @@ function guardStatus(repo) {
         + "reauthorize through `keel gate task-start` and `keel guard start`.",
     });
   }
+  // Bytes under the guarded change's own directory are records the task
+  // produces — checkbox, Evidence, Review — not authority it must not touch.
+  // The fingerprint comparison above already covers every part of that file
+  // the capsule reads, so hashing it here only reported progress as drift.
+  const recordPrefix = `openspec/changes/${manifest.change}/`;
   for (const entry of manifest.authority) {
+    if (entry.path.replace(/\\/g, "/").startsWith(recordPrefix)) continue;
     const file = path.join(repo, entry.path);
     if (!fs.existsSync(file) || sha256(fs.readFileSync(file)) !== entry.sha256) {
       problems.push({

package/src/core/task-contract.js

@@ -8,8 +8,17 @@ const SUPPORTED_MODES = new Set([
   "implementation",
   "diagnose-only",
   "plan-first",
+  // A task whose whole effect is an authorized repository-level action — the
+  // repository's first commit, a tag — writes no worktree file, so it has no
+  // concrete Touch to declare. It is not diagnose-only either: it has real side
+  // effects that need evidence. It is the one mode that may commit.
+  "repo-action",
 ]);
 
+// Modes whose contract is "no worktree writes", so `Touch: none` is required
+// rather than merely tolerated.
+const NO_WRITE_MODES = new Set(["diagnose-only", "repo-action"]);
+
 const UNFILLED_TOKEN = /(<[^>]+>|\bTODO\b|\bTBD\b|\bplaceholder\b)/i;
 
 function normalizeFieldText(value) {
@@ -241,16 +250,17 @@ function taskStartContractProblems(task) {
         code: "unsupported-mode",
         message:
           `Unsupported Mode \`${mode}\`; expected implementation, `
-          + "diagnose-only, or plan-first.",
+          + "diagnose-only, plan-first, or repo-action.",
       },
     ];
   }
-  if (mode === "diagnose-only") {
+  if (NO_WRITE_MODES.has(mode)) {
     if (touch.length !== 1 || touch[0].toLowerCase() !== "none") {
       return [
         {
           code: "invalid-touch",
-          message: "diagnose-only requires `Touch: none`.",
+          message: `${mode} writes no worktree file and requires `
+            + "`Touch: none`.",
         },
       ];
     }
@@ -819,13 +829,17 @@ function compileTaskContract(repo, change, task) {
     helperAuthority: "read-only-evidence-only",
     prohibitions: [
       "must not change Acceptance",
-      "must not commit",
+      // repo-action is the one mode whose authorized effect is the repository
+      // action itself, so it alone does not carry the commit prohibition.
+      // Whether the action it performed was the authorized one is a Review
+      // judgment; what the capsule fixes is the write posture.
+      ...(mode === "repo-action" ? [] : ["must not commit"]),
       "must not continue to another task",
       "must not mark tasks complete",
       "must not push",
       "must not sync or archive",
       "must not transfer Keel ownership",
-      ...(mode === "diagnose-only" ? ["must not write product files"] : []),
+      ...(NO_WRITE_MODES.has(mode) ? ["must not write product files"] : []),
     ],
   };
   if (resolved.diagnostics.length > 0) {