@christang/keel 5.2.4 → 5.3.1

package/assets/bootstrap/AGENTS.md

@@ -1,8 +1,8 @@
-<!-- keel:start version=5.2.4 -->
+<!-- keel:start version=5.3.1 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.
-- Obey the selected task capsule: `keel gate task-start` before implementing, record its fingerprint in the task Evidence `Contract` line, and pass `keel gate task-complete` before checking complete. Touch is the write boundary; on Claude a passing `task-start` guards it by default (`--no-guard`/`keel guard clear` opt out).
+- Obey the selected task capsule: `keel gate task-start` before implementing, record its fingerprint in Evidence `Contract`, and pass `keel gate task-complete` before checking complete. Touch is the write boundary for product files; on Claude a passing `task-start` guards it by default (`--no-guard`/`keel guard clear` opt out).
 - One current agent owns writes; helpers return read-only report/evidence only. No commit, sync, or archive without explicit authorization.
 - Native plugin projections (SessionStart context) are disposable views, never authority; without the plugin or hook, run the commands manually.
 - Keel skills and hooks come from the `keel` native plugin (`codex plugin add` / `claude plugin install`); `keel --init` owns only the OpenSpec schema, overlays, and this bootstrap.

package/assets/openspec/schemas/keel-spec-driven/templates/tasks.md

@@ -40,7 +40,11 @@
     - Blocker: none
 
 <!-- Exceptional boundaries are declared only when they differ from defaults:
-     - Mode: diagnose-only (with `Touch: none`) or plan-first
+     - Mode: diagnose-only or repo-action (both with `Touch: none`), or plan-first.
+       repo-action is for a task whose whole effect is an authorized
+       repository-level action — a commit, a tag — and which writes no worktree
+       file; it is the one mode that may commit, and it still may not push,
+       sync, archive, or mark tasks complete
      - Read: additional required starting context beyond the base set
      - Acceptance: a task-specific observable delta the Covers authority does not express
      - Execution recommendation / Rationale: advisory notes for the current agent

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.2.4",
+  "version": "5.3.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.2.4",
+  "version": "5.3.1",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.2.4",
+  "version": "5.3.1",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/scripts/pretooluse-guard.js

@@ -84,6 +84,29 @@ function pathAllowed(candidate, touch) {
   });
 }
 
+// A checked task keeps its records writable so it can finish the Evidence its
+// completion gate requires, but earns no further product authorization. Byte
+// hashing used to enforce this by accident, since ticking the box changed
+// tasks.md; now it is stated. An unreadable or unmatched tasks.md is not read as
+// checked — every gate that compiles the capsule catches that, and denying
+// product writes on a parse miss would trade a real capability for a guess.
+function taskIsChecked(repo, manifest) {
+  const file = path.join(
+    repo, "openspec", "changes", manifest.change, "tasks.md"
+  );
+  let content = "";
+  try {
+    content = fs.readFileSync(file, "utf8");
+  } catch {
+    return false;
+  }
+  const id = manifest.task.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = content.match(
+    new RegExp(`^\\s*-\\s*\\[([ xX])\\]\\s*${id}(?![0-9.])`, "m")
+  );
+  return Boolean(match && match[1].toLowerCase() === "x");
+}
+
 function main() {
   let event = {};
   try {
@@ -114,8 +137,30 @@ function main() {
     return 0;
   }
   const pointer = `${manifest.change}#${manifest.task}`;
+  // The record layer: the guarded change's own directory holds the records the
+  // task produces — its checkbox, Evidence, and Review — not the product it
+  // changes. `keel gate task-complete` already refuses to attribute this
+  // directory as an outside-Touch failure, so denying it here made the guard
+  // stop the one thing the completion gate is waiting for. Derived from the
+  // manifest's existing `change` field, so no manifest shape changes.
+  const recordPrefix = `openspec/changes/${manifest.change}/`;
+
+  const target = event.tool_input ? event.tool_input[pathField] : null;
+  if (typeof target !== "string" || !target) return 0;
+  const relative = path.relative(repo, path.resolve(repo, target));
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    return 0;
+  }
+  const candidate = relative.replace(/\\/g, "/");
+  if (candidate.startsWith(recordPrefix)) return 0;
 
   for (const entry of manifest.authority) {
+    // Same boundary: bytes under the guarded change's own directory are
+    // records, and the capsule fingerprint — which carries no checkbox state
+    // and no Evidence values — is what separates a record write from a
+    // contract change. `keel guard status` and `keel gate task-complete`
+    // compile the capsule and compare it; this hook cannot, and must not guess.
+    if (entry.path.replace(/\\/g, "/").startsWith(recordPrefix)) continue;
     const file = path.join(repo, entry.path);
     let fresh = null;
     try {
@@ -134,13 +179,17 @@ function main() {
     }
   }
 
-  const target = event.tool_input ? event.tool_input[pathField] : null;
-  if (typeof target !== "string" || !target) return 0;
-  const relative = path.relative(repo, path.resolve(repo, target));
-  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+  if (taskIsChecked(repo, manifest)) {
+    deny(
+      `Keel write guard: ${pointer} is checked complete, so it authorizes no `
+        + `further product writes — ${candidate} is denied. Its own `
+        + `${recordPrefix} records stay writable so the task can finish its `
+        + "Evidence. Run `keel guard clear`, then authorize the next task "
+        + "explicitly with `keel gate task-start`."
+    );
     return 0;
   }
-  const candidate = relative.replace(/\\/g, "/");
+
   if (pathAllowed(candidate, manifest.touch)) return 0;
 
   deny(

package/scripts/validate_plugin.py

@@ -37,8 +37,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.2.4"
-PROTOCOL_VERSION = "5.2.4"
+PACKAGE_VERSION = "5.3.1"
+PROTOCOL_VERSION = "5.3.1"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 OPENSPEC_CONFIG_PATH = Path("openspec/config.yaml")
@@ -99,7 +99,11 @@ RESIDENT_BLOCKS = [
             "keel gate task-start",
             "task capsule",
             "fingerprint",
-            "Touch is the write boundary",
+            # Prose, not a command: this sentence is the one that has actually
+            # been reworded under byte pressure, so it is matched as a topic —
+            # Touch and a `bound…` word in one statement. The other prose
+            # entries stay literal until one of them needs the same freedom.
+            re.compile(r"Touch\b[^\n]*\bbound", re.IGNORECASE),
             "read-only report/evidence",
             "native plugin",
             "keel --init",
@@ -491,9 +495,9 @@ def strip_template_checksum(content: str) -> tuple[str, str | None]:
     return "".join(kept), checksum
 
 
-def validate_resident_blocks(errors: list[str]) -> None:
+def validate_resident_blocks(errors: list[str], root: Path = ROOT) -> None:
     for block in RESIDENT_BLOCKS:
-        path = ROOT / block["path"]
+        path = root / block["path"]
         if not path.is_file():
             errors.append(f"{block['name']} is missing: {block['path']}")
             continue
@@ -519,9 +523,24 @@ def validate_resident_blocks(errors: list[str]) -> None:
                 f"budget is {max_lines}"
             )
 
+        # A required entry is one of two kinds, and they mean different things.
+        # A literal names a command, marker, or identifier: if the block no
+        # longer contains it exactly, it is telling a reader to run something
+        # that does not exist, so the check must fail. A pattern states a topic
+        # in prose: the concepts must remain, the wording may move — which it
+        # must be free to, because this block is under a line and byte budget
+        # and gets rewritten to fit.
         for required in block["required"]:
-            if required not in managed_block:
-                errors.append(f"{block['name']} missing required topic: {required}")
+            if isinstance(required, str):
+                if required not in managed_block:
+                    errors.append(
+                        f"{block['name']} missing required literal: {required}"
+                    )
+            elif not required.search(managed_block):
+                errors.append(
+                    f"{block['name']} missing required topic: "
+                    f"{required.pattern}"
+                )
 
         lowered = managed_block.lower()
         for forbidden in RESIDENT_FORBIDDEN_SNIPPETS:
@@ -1082,6 +1101,17 @@ def validate_skill_portability_policy_scenario() -> int:
     return 0
 
 
+def posix_paths(text: str) -> str:
+    """Fold path separators so an assertion does not encode the host's spelling.
+
+    Keel prints these paths through the host's path joiner, so the same doctor
+    line reads `.claude\\commands\\opsx` on Windows and `.claude/commands/opsx`
+    on a POSIX runner. Assertions state the forward-slash form and normalize the
+    captured output, rather than branching on the platform or accepting both.
+    """
+    return (text or "").replace("\\", "/")
+
+
 def validate_target_surface_scenario() -> int:
     with tempfile.TemporaryDirectory(prefix="keel-surface-") as raw_tmp:
         tmp = Path(raw_tmp)
@@ -1098,9 +1128,9 @@ def validate_target_surface_scenario() -> int:
             claude_doctor.returncode != 0
             or "Target surface:" not in claude_doctor.stdout
             or "OpenSpec commands: ok" not in claude_doctor.stdout
-            or ".claude\\commands\\opsx" not in claude_doctor.stdout
+            or ".claude/commands/opsx" not in posix_paths(claude_doctor.stdout)
             or "OpenSpec action skills: ok" not in claude_doctor.stdout
-            or ".claude\\skills" not in claude_doctor.stdout
+            or ".claude/skills" not in posix_paths(claude_doctor.stdout)
             or "bootstrap: ok" not in claude_doctor.stdout
             or "CLAUDE import: ok" not in claude_doctor.stdout
             or "native plugin runtime: manual" not in claude_doctor.stdout
@@ -1130,9 +1160,9 @@ def validate_target_surface_scenario() -> int:
         if (
             codex_doctor.returncode != 0
             or "OpenSpec commands: ok" not in codex_doctor.stdout
-            or codex_prompt_dir not in codex_doctor.stdout
+            or posix_paths(codex_prompt_dir) not in posix_paths(codex_doctor.stdout)
             or "OpenSpec action skills: ok" not in codex_doctor.stdout
-            or ".codex\\skills" not in codex_doctor.stdout
+            or ".codex/skills" not in posix_paths(codex_doctor.stdout)
             or "bootstrap: ok" not in codex_doctor.stdout
             or "native plugin runtime: manual" not in codex_doctor.stdout
             or "Target capabilities (codex):" not in codex_doctor.stdout
@@ -1173,9 +1203,9 @@ def validate_target_surface_scenario() -> int:
         if (
             opencode_doctor.returncode != 0
             or "OpenSpec commands: ok" not in opencode_doctor.stdout
-            or ".opencode\\commands" not in opencode_doctor.stdout
+            or ".opencode/commands" not in posix_paths(opencode_doctor.stdout)
             or "OpenSpec action skills: ok" not in opencode_doctor.stdout
-            or ".opencode\\skills" not in opencode_doctor.stdout
+            or ".opencode/skills" not in posix_paths(opencode_doctor.stdout)
             or "bootstrap: ok" not in opencode_doctor.stdout
             or "native plugin: manual" not in opencode_doctor.stdout
             or "Target capabilities (opencode):" not in opencode_doctor.stdout
@@ -7024,8 +7054,11 @@ def validate_native_plugin_marketplaces_scenario() -> int:
     codex = shutil.which("codex")
     claude = claude_cli()
     if codex is None or claude is None:
-        report("native-plugin-marketplaces requires codex and claude CLIs.")
-        return 1
+        return skip_scenario(
+            "native-plugin-marketplaces",
+            "requires the codex and claude CLIs, which are not installed; it "
+            "probes native marketplace behavior no CI runner provides",
+        )
 
     with tempfile.TemporaryDirectory(prefix="keel-native-market-") as raw_tmp:
         tmp = Path(raw_tmp)
@@ -10129,8 +10162,11 @@ def validate_native_plugin_install_matrix_scenario() -> int:
     codex = shutil.which("codex")
     claude = claude_cli()
     if codex is None or claude is None:
-        report("native-plugin-install-matrix requires codex and claude CLIs.")
-        return 1
+        return skip_scenario(
+            "native-plugin-install-matrix",
+            "requires the codex and claude CLIs, which are not installed; it "
+            "probes native install behavior no CI runner provides",
+        )
 
     expected_version = json.loads(
         (ROOT / "package.json").read_text(encoding="utf-8")
@@ -10367,6 +10403,623 @@ def expect_guard_allow(
     return 0
 
 
+RECORD_LAYER_SPEC = (
+    "# demo-cap Specification\n\n"
+    "## Purpose\n"
+    "Fixture capability for the record-layer scenario.\n\n"
+    "## Requirements\n"
+    "### Requirement: Guarded behavior holds\n"
+    "The guarded feature MUST keep its public behavior.\n\n"
+    "#### Scenario: Guarded public behavior passes\n"
+    "- **WHEN** the guarded feature runs\n"
+    "- **THEN** it passes\n"
+)
+
+
+def record_layer_tasks(checked: bool = False, touch: str = "src/feature.js") -> str:
+    box = "x" if checked else " "
+    return (
+        "# Tasks\n\n"
+        f"- [{box}] 1.1 Exercise guarded feature\n"
+        "  - Covers:\n"
+        "    - demo-cap / Guarded behavior holds / Guarded public behavior passes\n"
+        "  - Touch:\n"
+        f"    - {touch}\n"
+        "  - Verify:\n"
+        "    - Strategy: evidence-first\n"
+        "    - M1: node test.js\n"
+        "  - Evidence:\n"
+        "    - M1: pending\n"
+    )
+
+
+def mode_fixture_tasks(mode: str, touch: str) -> str:
+    return (
+        "# Tasks\n\n"
+        "- [ ] 1.1 Establish the version baseline\n"
+        f"  - Mode: {mode}\n"
+        "  - Covers:\n"
+        "    - E1: the repository carries its first commit\n"
+        "  - Touch:\n"
+        f"    - {touch}\n"
+        "  - Verify:\n"
+        "    - Strategy: evidence-first\n"
+        "    - M1: git rev-parse HEAD resolves and git log reports one commit\n"
+        "  - Evidence:\n"
+        "    - Contract: pending\n"
+        "    - M1: pending\n"
+    )
+
+
+def validate_runner_skip_accounting_scenario() -> int:
+    """Issue #10: the suite could not pass anywhere the native CLIs are absent.
+
+    Two of seventy scenarios probe native runtimes and used to `return 1` when
+    the CLI was missing, so no CI runner could ever go green. A skip must be
+    reported and counted, never conflated with a pass or a failure.
+    """
+    label = "runner-skip-accounting"
+    runner = str(ROOT / "scripts/validate_plugin.py")
+
+    def run_registry(results: str) -> subprocess.CompletedProcess[str]:
+        """Drive run_all over synthetic scenario results in a child process.
+
+        run_all dispatches each scenario as its own subprocess, which reads the
+        real registry from disk, so a substituted registry would be ignored.
+        The accounting is the behavior under test, so the process fan-out is
+        replaced with fixed (name, code, output) triples instead.
+        """
+        program = (
+            "import sys\n"
+            f"src = open({runner!r}, encoding='utf-8').read()\n"
+            "ns = {'__name__': 'v', '__file__': %r}\n" % runner
+            + "exec(compile(src, %r, 'exec'), ns)\n" % runner
+            + f"results = {results}\n"
+            "ns['SCENARIOS'] = tuple((n, None) for n, _, _ in results)\n"
+            "ns['run_baseline'] = lambda: 0\n"
+            "ns['run_scenario_processes'] = lambda names, jobs: results\n"
+            "sys.exit(ns['run_all'](2))\n"
+        )
+        return subprocess.run(
+            [sys.executable, "-c", program],
+            capture_output=True, text=True, encoding="utf-8", errors="replace",
+            cwd=str(ROOT),
+        )
+
+    # A skipping scenario must not fail the run, must be named, and must be
+    # excluded from the verified count; a failing one must still fail it.
+    both = run_registry(
+        "[('fake-skip', 3, 'fake-skip scenario skipped: the frob CLI\\n'),"
+        " ('fake-pass', 0, 'fake-pass scenario passed.\\n')]"
+    )
+    out = (both.stdout or "") + (both.stderr or "")
+    if both.returncode != 0:
+        report(f"{label}: a skipping scenario must not fail the run.")
+        report(out.strip())
+        return 1
+    for needle in ("fake-skip", "skipped", "the frob CLI", "plus 1 scenario"):
+        if needle not in out:
+            report(f"{label}: the summary must report {needle!r}; got:\n{out.strip()}")
+            return 1
+    if "fake-pass" in out.split("passed:")[-1]:
+        report(f"{label}: a passing scenario must not be listed as skipped.")
+        report(out.strip())
+        return 1
+
+    mixed = run_registry(
+        "[('fake-skip', 3, 'fake-skip scenario skipped: the frob CLI\\n'),"
+        " ('fake-fail', 1, 'fake-fail scenario failed.\\n')]"
+    )
+    mixed_out = (mixed.stdout or "") + (mixed.stderr or "")
+    if mixed.returncode == 0 or "failed for: fake-fail" not in mixed_out:
+        report(
+            f"{label}: a skip beside a failure must still fail the run and name "
+            "the failure."
+        )
+        report(mixed_out.strip())
+        return 1
+    if "fake-skip" in mixed_out.split("failed for:")[-1]:
+        report(f"{label}: a skipped scenario must not be named as a failure.")
+        report(mixed_out.strip())
+        return 1
+
+    # The two real native-runtime scenarios must take the skip path, not fail,
+    # when their CLI cannot be resolved.
+    for name in ("native-plugin-marketplaces", "native-plugin-install-matrix"):
+        blinded = subprocess.run(
+            [sys.executable, runner, "--scenario", name],
+            capture_output=True, text=True, encoding="utf-8", errors="replace",
+            cwd=str(ROOT),
+            env={**os.environ, "PATH": str(ROOT), "PATHEXT": ""},
+        )
+        blinded_out = (blinded.stdout or "") + (blinded.stderr or "")
+        if blinded.returncode != 3 or "skipped" not in blinded_out:
+            report(
+                f"{label}: {name} must exit 3 with a reported skip when its CLI "
+                f"cannot be resolved; got {blinded.returncode}."
+            )
+            report(blinded_out.strip())
+            return 1
+        if "codex" not in blinded_out:
+            report(f"{label}: {name}'s skip does not name the runtime it needed.")
+            report(blinded_out.strip())
+            return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def sibling_scope_tasks(sibling_checked: bool, sibling_touch: str) -> str:
+    """Two tasks: 1.1 owns `shared.js`, 1.2 is the one being completed."""
+
+    def task(task_id: str, title: str, checked: bool, touch: str) -> str:
+        mark = "x" if checked else " "
+        return (
+            f"- [{mark}] {task_id} {title}\n"
+            "  - Covers:\n"
+            "    - E1: public behavior\n"
+            "  - Touch:\n"
+            + "".join(f"    - {entry}\n" for entry in touch.split(","))
+            + "  - Verify:\n"
+            "    - Strategy: evidence-first\n"
+            "    - M1: node test.js\n"
+            "  - Evidence:\n"
+            "    - M1: verified\n"
+            "    - Review:\n"
+            "      - Status: pass\n"
+            "      - Acceptance check: reviewed\n"
+            "      - Scope check: reviewed\n"
+            "      - Findings: none\n"
+            "    - Blocker: none\n"
+        )
+
+    return (
+        "# Tasks\n\n"
+        "## 1. Work\n\n"
+        + task("1.1", "Own the shared file", sibling_checked, sibling_touch)
+        + "\n"
+        + task("1.2", "Own its own file", False, "src/mine.js")
+        + "\n## Expectation Coverage\n\n- None.\n"
+    )
+
+
+def validate_completed_sibling_attribution_scenario() -> int:
+    """Issue #13 item 2: a finished task's uncommitted work blamed the next one.
+
+    `--base HEAD` cannot tell who wrote a path, so a sibling that already passed
+    its own completion gate had its files attributed to whoever ran next. The
+    workaround — commit per task — was correct but implicit, and the diagnostic
+    named a file the author never touched.
+    """
+    label = "completed-sibling-attribution"
+
+    def complete(sibling_checked: bool, sibling_touch: str = "src/shared.js"):
+        with tempfile.TemporaryDirectory(prefix="keel-sibling-scope-") as raw:
+            repo = Path(raw)
+            for name in ("src/shared.js", "src/mine.js", "src/stray.js"):
+                write_text(repo / name, "// base\n")
+            write_text(
+                repo / "openspec/changes/demo/tasks.md",
+                sibling_scope_tasks(sibling_checked, sibling_touch),
+            )
+            for args in (
+                ["init", "--quiet"],
+                ["-c", "user.email=t@e", "-c", "user.name=t", "add", "-A"],
+                [
+                    "-c", "user.email=t@e", "-c", "user.name=t",
+                    "commit", "--quiet", "-m", "base",
+                ],
+            ):
+                done = subprocess.run(
+                    ["git", *args], cwd=repo, capture_output=True, text=True
+                )
+                if done.returncode != 0:
+                    report(f"{label}: git {args[0]} failed: {done.stderr}")
+                    return None
+            # The sibling's work and an undeclared stray, both uncommitted.
+            write_text(repo / "src/shared.js", "// sibling's uncommitted work\n")
+            write_text(repo / "src/stray.js", "// nobody declared this\n")
+            result = run_keel(
+                repo, "gate", "task-complete",
+                "--change", "demo", "--task", "1.2", "--base", "HEAD", "--json",
+            )
+            return json.loads(result.stdout) if result.stdout else {}
+
+    owned = complete(sibling_checked=True)
+    if owned is None:
+        return 1
+    outside = [
+        item.get("message", "")
+        for item in owned.get("problems", [])
+        if item.get("code") == "outside-touch"
+    ]
+    if any("src/shared.js" in message for message in outside):
+        report(
+            f"{label}: a completed sibling's declared file was still attributed "
+            f"to the selected task: {outside}"
+        )
+        return 1
+    if not any("src/stray.js" in message for message in outside):
+        report(
+            f"{label}: a path no task declares must still fail: {outside}"
+        )
+        return 1
+    warnings = " ".join(owned.get("warnings", []))
+    if "src/shared.js" not in warnings or "1.1" not in warnings:
+        report(
+            f"{label}: the exclusion must be reported, naming the path and the "
+            f"completed task that declares it; got {owned.get('warnings')}"
+        )
+        return 1
+
+    unchecked = complete(sibling_checked=False)
+    if unchecked is None:
+        return 1
+    unchecked_outside = [
+        item.get("message", "")
+        for item in unchecked.get("problems", [])
+        if item.get("code") == "outside-touch"
+    ]
+    if not any("src/shared.js" in message for message in unchecked_outside):
+        report(
+            f"{label}: an unchecked sibling's Touch must grant nothing: "
+            f"{unchecked_outside}"
+        )
+        return 1
+
+    no_touch = complete(sibling_checked=True, sibling_touch="none")
+    if no_touch is None:
+        return 1
+    none_outside = [
+        item.get("message", "")
+        for item in no_touch.get("problems", [])
+        if item.get("code") == "outside-touch"
+    ]
+    if not any("src/shared.js" in message for message in none_outside):
+        report(
+            f"{label}: a sibling whose Touch is none must contribute no claim: "
+            f"{none_outside}"
+        )
+        return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_resident_topic_matching_scenario() -> int:
+    """Issue #15 item 1: required entries were named topics, matched as prose.
+
+    The bootstrap is under a line and byte budget, so its wording gets rewritten
+    to fit — and every rewrite of a pinned sentence failed the check that was
+    supposed to prove only that the topic was still covered.
+    """
+    label = "resident-topic-matching"
+    source = (ROOT / "assets/bootstrap/AGENTS.md").read_text(encoding="utf-8")
+    original = "Touch is the write boundary for product files;"
+    if original not in source:
+        report(
+            f"{label}: the fixture's anchor sentence is not in the bootstrap; "
+            "update this scenario alongside the wording."
+        )
+        return 1
+
+    def errors_for(text: str) -> list[str]:
+        with tempfile.TemporaryDirectory(prefix="keel-resident-topic-") as raw:
+            root = Path(raw)
+            write_text(root / "assets/bootstrap/AGENTS.md", text)
+            found: list[str] = []
+            validate_resident_blocks(found, root)
+            return found
+
+    def touch_errors(text: str) -> list[str]:
+        return [item for item in errors_for(text) if "Touch" in item or "bound" in item]
+
+    baseline = errors_for(source)
+    if baseline:
+        report(f"{label}: the unmodified bootstrap must pass: {baseline}")
+        return 1
+
+    # A rewording that keeps both concepts in one statement must pass.
+    reworded = source.replace(
+        original, "Touch bounds product writes, not the task's own records;"
+    )
+    if touch_errors(reworded):
+        report(
+            f"{label}: a rewording that keeps the topic was rejected: "
+            f"{touch_errors(reworded)}"
+        )
+        return 1
+
+    # Deleting the statement must still fail.
+    deleted = source.replace(original, "")
+    if not touch_errors(deleted):
+        report(f"{label}: deleting the boundary statement did not fail the check.")
+        return 1
+
+    # Mentioning only one of the topic's words must not satisfy it.
+    partial = source.replace(original, "Touch the files you declared;")
+    if not touch_errors(partial):
+        report(
+            f"{label}: a statement mentioning only Touch, with no boundary "
+            "concept, satisfied the topic."
+        )
+        return 1
+
+    # A renamed command must still fail, and be reported as a literal.
+    renamed = source.replace("keel context", "keel status")
+    literal_errors = [item for item in errors_for(renamed) if "keel context" in item]
+    if not literal_errors:
+        report(f"{label}: renaming a required command did not fail the check.")
+        return 1
+    if not any("literal" in item for item in literal_errors):
+        report(
+            f"{label}: a missing command must be reported as a missing literal, "
+            f"distinguishably from a missing topic: {literal_errors}"
+        )
+        return 1
+    if any("literal" in item for item in touch_errors(deleted)):
+        report(
+            f"{label}: a missing topic must not be reported as a missing "
+            f"literal: {touch_errors(deleted)}"
+        )
+        return 1
+
+    if (ROOT / "assets/bootstrap/AGENTS.md").read_text(encoding="utf-8") != source:
+        report(f"{label}: the shipped bootstrap was left modified.")
+        return 1
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_repo_action_mode_scenario() -> int:
+    """Issue #8 example 2: a repository action had no legal contract.
+
+    A task whose whole effect is the repository's first commit writes no
+    worktree file, so it has no concrete Touch; it is not diagnose-only,
+    because it has real side effects needing evidence; and `Touch: none` was
+    accepted for no other mode. The author was forced to name a path the task
+    did not write, which then tripped the drift defect in example 1.
+    """
+    label = "repo-action-mode"
+
+    def compile_task(repo: Path, mode: str, touch: str):
+        write_text(repo / "openspec/changes/demo/tasks.md", mode_fixture_tasks(mode, touch))
+        return run_keel(
+            repo, "gate", "task-start",
+            "--change", "demo", "--task", "1.1", "--no-guard", "--json",
+        )
+
+    with tempfile.TemporaryDirectory(prefix="keel-repo-action-") as raw:
+        repo = Path(raw)
+
+        started = compile_task(repo, "repo-action", "none")
+        if started.returncode != 0:
+            report(f"{label}: `Mode: repo-action` with `Touch: none` was rejected.")
+            report((started.stderr or started.stdout).strip())
+            return 1
+        capsule = json.loads(started.stdout).get("contract", {}).get("capsule", {})
+        prohibitions = capsule.get("prohibitions", [])
+        if capsule.get("mode") != "repo-action":
+            report(f"{label}: the capsule did not record the repo-action mode.")
+            return 1
+        if "must not write product files" not in prohibitions:
+            report(
+                f"{label}: repo-action must prohibit product writes; got "
+                f"{prohibitions}."
+            )
+            return 1
+        if "must not commit" in prohibitions:
+            report(
+                f"{label}: repo-action must be the mode that may commit; got "
+                f"{prohibitions}."
+            )
+            return 1
+
+        # Every other mode keeps the commit prohibition.
+        for mode, touch in (
+            ("implementation", "src/feature.js"),
+            ("plan-first", "src/feature.js"),
+            ("diagnose-only", "none"),
+        ):
+            other = compile_task(repo, mode, touch)
+            if other.returncode != 0:
+                report(f"{label}: `Mode: {mode}` regressed and no longer compiles.")
+                report((other.stderr or other.stdout).strip())
+                return 1
+            other_capsule = (
+                json.loads(other.stdout).get("contract", {}).get("capsule", {})
+            )
+            if "must not commit" not in other_capsule.get("prohibitions", []):
+                report(f"{label}: `Mode: {mode}` lost the commit prohibition.")
+                return 1
+            product_write_prohibited = (
+                "must not write product files"
+                in other_capsule.get("prohibitions", [])
+            )
+            if product_write_prohibited != (mode == "diagnose-only"):
+                report(
+                    f"{label}: `Mode: {mode}` changed its product-write "
+                    "prohibition."
+                )
+                return 1
+
+        # repo-action means no worktree writes, so a concrete Touch contradicts it.
+        with_touch = compile_task(repo, "repo-action", "src/feature.js")
+        with_touch_problems = (
+            json.loads(with_touch.stdout).get("problems", [])
+            if with_touch.stdout
+            else []
+        )
+        touch_message = " ".join(
+            item.get("message", "")
+            for item in with_touch_problems
+            if item.get("code") == "invalid-touch"
+        )
+        if with_touch.returncode == 0 or "Touch: none" not in touch_message:
+            report(
+                f"{label}: repo-action with a concrete Touch must fail with a "
+                "diagnostic naming the `Touch: none` it requires."
+            )
+            report((with_touch.stderr or with_touch.stdout).strip())
+            return 1
+
+        unsupported = compile_task(repo, "repo-actions", "none")
+        unsupported_message = " ".join(
+            item.get("message", "")
+            for item in (
+                json.loads(unsupported.stdout).get("problems", [])
+                if unsupported.stdout
+                else []
+            )
+            if item.get("code") == "unsupported-mode"
+        )
+        missing = [
+            mode
+            for mode in ("implementation", "diagnose-only", "plan-first", "repo-action")
+            if mode not in unsupported_message
+        ]
+        if unsupported.returncode == 0 or missing:
+            report(
+                f"{label}: the unsupported-mode diagnostic must list every "
+                f"supported mode; missing {missing}."
+            )
+            report((unsupported.stderr or unsupported.stdout).strip())
+            return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_touch_guard_record_layer_scenario() -> int:
+    """Issue #8: the guard denied what the completion gate already forgives.
+
+    `scopeProblems` exempts the selected change's own `openspec/changes/<change>/`
+    directory from outside-Touch attribution, but the guard denied writes there
+    and treated the byte hash of that change's tasks.md as authority, so ticking
+    a checkbox or appending Evidence locked the task out of its own bookkeeping.
+    """
+    label = "touch-guard-record-layer"
+    with tempfile.TemporaryDirectory(prefix="keel-record-layer-") as raw:
+        repo = Path(raw)
+        tasks = repo / "openspec/changes/demo/tasks.md"
+        spec = repo / "openspec/specs/demo-cap/spec.md"
+        write_text(tasks, record_layer_tasks())
+        write_text(spec, RECORD_LAYER_SPEC)
+        write_text(repo / "openspec/changes/other/tasks.md", "# Tasks\n")
+        write_text(repo / "keel/archive/follow-ups/note.md", "# Note\n")
+
+        started = run_keel(
+            repo, "guard", "start", "--change", "demo", "--task", "1.1", "--json"
+        )
+        if started.returncode != 0:
+            report(f"{label}: guard start failed on the fixture.")
+            report((started.stderr or started.stdout).strip())
+            return 1
+        manifest = json.loads(started.stdout).get("manifest", {})
+        authority = [entry.get("path") for entry in manifest.get("authority", [])]
+        if not any(item == "openspec/specs/demo-cap/spec.md" for item in authority):
+            report(
+                f"{label}: the fixture does not record an authority file outside "
+                f"the change directory, so the negative case is untested: {authority}"
+            )
+            return 1
+
+        # The record layer: writable although Touch never named it.
+        if expect_guard_allow(repo, tasks, f"{label} record write"):
+            return 1
+        # A record write already made must not lock the task out of its product
+        # writes — this is the drift half of the reported defect.
+        write_text(tasks, record_layer_tasks().replace("M1: pending", "M1: done"))
+        if expect_guard_allow(repo, repo / "src/feature.js", f"{label} after record write"):
+            return 1
+
+        # The layer is exactly this change's directory, nothing wider.
+        if expect_guard_deny(
+            repo,
+            repo / "openspec/changes/other/tasks.md",
+            ["outside Touch"],
+            f"{label} other change",
+        ):
+            return 1
+        if expect_guard_deny(
+            repo,
+            repo / "keel/archive/follow-ups/note.md",
+            ["outside Touch"],
+            f"{label} archive tree",
+        ):
+            return 1
+
+        # Authority outside the change directory still hashes and still denies.
+        write_text(spec, RECORD_LAYER_SPEC.replace("it passes", "it passes twice"))
+        if expect_guard_deny(
+            repo,
+            repo / "src/feature.js",
+            ["authority drift"],
+            f"{label} real authority drift",
+        ):
+            return 1
+        write_text(spec, RECORD_LAYER_SPEC)
+
+        status = run_keel(repo, "guard", "status", "--json")
+        status_payload = json.loads(status.stdout) if status.stdout else {}
+        codes = [item.get("code") for item in status_payload.get("problems", [])]
+        if status_payload.get("status") != "active" or codes:
+            report(
+                f"{label}: guard status reported {status_payload.get('status')!r} "
+                f"with problems {codes} after a record write; a checkbox or "
+                "Evidence write is not authority drift."
+            )
+            return 1
+
+        # A real contract edit in the same file must still hard-stop, through the
+        # fingerprint rather than through byte hashing.
+        write_text(tasks, record_layer_tasks(touch="src/other.js"))
+        drifted = run_keel(repo, "guard", "status", "--json")
+        drifted_codes = [
+            item.get("code")
+            for item in (json.loads(drifted.stdout) if drifted.stdout else {}).get(
+                "problems", []
+            )
+        ]
+        if "fingerprint-drift" not in drifted_codes:
+            report(
+                f"{label}: editing the task's Touch line did not report "
+                f"fingerprint drift; got {drifted_codes}."
+            )
+            return 1
+
+        # Once checked, product writes stop but the task can still finish its
+        # own records — the completion gate requires that Evidence.
+        write_text(tasks, record_layer_tasks(checked=True))
+        if expect_guard_deny(
+            repo,
+            repo / "src/feature.js",
+            ["checked complete"],
+            f"{label} completed product write",
+        ):
+            return 1
+        if expect_guard_allow(repo, tasks, f"{label} completed record write"):
+            return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
 def validate_touch_write_guard_scenario() -> int:
     with tempfile.TemporaryDirectory(
         prefix="keel-touch-guard-", ignore_cleanup_errors=True
@@ -11156,18 +11809,32 @@ def validate_touch_guard_drift_scenario() -> int:
                 "Exercise guarded feature", "Exercise guarded feature differently"
             ),
         )
-        if expect_guard_deny(
-            repo,
-            repo / "src/feature.js",
-            ["drift", "demo", "1.1", "keel guard start"],
-            "touch-guard-drift authority edit",
+        # A contract edit inside the guarded change's own directory is caught
+        # where the capsule is compiled, not at the next write: the hook cannot
+        # compile, so it cannot separate this from a checkbox or Evidence write
+        # in the same file. It therefore allows the write and `guard status`
+        # reports the drift. Authority *outside* that directory still denies at
+        # write time — see the touch-guard-record-layer scenario.
+        if expect_guard_allow(
+            repo, repo / "src/feature.js", "touch-guard-drift contract edit"
         ):
             return 1
         status = run_keel(repo, "guard", "status", "--json")
-        if status.returncode != 3 or json.loads(status.stdout).get("status") != "drifted":
+        status_payload = json.loads(status.stdout) if status.stdout else {}
+        if status.returncode != 3 or status_payload.get("status") != "drifted":
             report("touch-guard-drift: status did not report drifted.")
             report((status.stderr or status.stdout).strip())
             return 1
+        if not any(
+            item.get("code") == "fingerprint-drift"
+            for item in status_payload.get("problems", [])
+        ):
+            report(
+                "touch-guard-drift: the contract edit was not reported as "
+                "fingerprint drift by the check that compiles the capsule."
+            )
+            report(status.stdout or "")
+            return 1
 
         restarted = run_keel(
             repo, "guard", "start", "--change", "demo", "--task", "1.1", "--json"
@@ -11184,30 +11851,41 @@ def validate_touch_guard_drift_scenario() -> int:
         ):
             return 1
 
+        # A fingerprint-neutral edit to the task's own file is a record write,
+        # not drift. This used to fail closed, which is the defect issue #8
+        # reports: appending Evidence blocked every following write.
         tasks_path.write_text(
             tasks_path.read_text(encoding="utf-8") + "\n", encoding="utf-8"
         )
-        if expect_guard_deny(
-            repo,
-            repo / "src/feature.js",
-            ["drift", "keel guard start"],
-            "touch-guard-drift cosmetic edit fails closed",
+        if expect_guard_allow(
+            repo, repo / "src/feature.js", "touch-guard-drift cosmetic edit"
         ):
             return 1
-        cosmetic = run_keel(
-            repo, "guard", "start", "--change", "demo", "--task", "1.1", "--json"
+        cosmetic = run_keel(repo, "guard", "status", "--json")
+        cosmetic_payload = json.loads(cosmetic.stdout) if cosmetic.stdout else {}
+        if cosmetic_payload.get("status") != "active" or cosmetic_payload.get(
+            "problems"
+        ):
+            report(
+                "touch-guard-drift: a fingerprint-neutral edit to the task's "
+                "own file was reported as a guard problem."
+            )
+            report(cosmetic.stdout or "")
+            return 1
+        restarted_cosmetic = run_keel(
+            repo, "guard", "start", "--change", "demo", "--task", "1.1",
+            "--force", "--json",
         )
-        if cosmetic.returncode != 0:
+        if restarted_cosmetic.returncode != 0:
             report("touch-guard-drift: cosmetic restart failed.")
+            report((restarted_cosmetic.stderr or restarted_cosmetic.stdout).strip())
             return 1
-        third = json.loads(cosmetic.stdout)["manifest"]["fingerprint"]["value"]
+        third = json.loads(restarted_cosmetic.stdout)["manifest"]["fingerprint"][
+            "value"
+        ]
         if third != second:
             report("touch-guard-drift: cosmetic edit drifted the capsule fingerprint.")
             return 1
-        if expect_guard_allow(
-            repo, repo / "src/feature.js", "touch-guard-drift cosmetic restart"
-        ):
-            return 1
 
         write_text(
             tasks_path,
@@ -11290,6 +11968,33 @@ def validate_validation_runner_scenario() -> int:
         report("validation-runner: README does not document the parallel runner.")
         return 1
 
+    # The full gate must actually run somewhere other than one author's machine:
+    # a workflow drives the same single entry point on push and pull request,
+    # and the release workflow keeps its own tag guard rather than becoming the
+    # suite's only runner.
+    workflow_path = ROOT / ".github/workflows/test.yml"
+    if not workflow_path.is_file():
+        report(
+            "validation-runner: no .github/workflows/test.yml, so the full gate "
+            "runs only in the local pre-push hook."
+        )
+        return 1
+    workflow = workflow_path.read_text(encoding="utf-8")
+    for needle in ("npm test", "npm ci", "pull_request", "push:", "ubuntu-latest"):
+        if needle not in workflow:
+            report(
+                "validation-runner: the full-gate workflow does not declare "
+                f"{needle!r}."
+            )
+            report(workflow)
+            return 1
+    publish = (ROOT / ".github/workflows/publish.yml").read_text(encoding="utf-8")
+    if "does not match package.json version" not in publish:
+        report(
+            "validation-runner: the release workflow lost its tag/version guard."
+        )
+        return 1
+
     # Behavioral: the parallel machinery preserves registry order, keeps a
     # passing scenario's buffered output, and fails loudly on a bad entry.
     ordered = run_scenario_processes(
@@ -11437,6 +12142,14 @@ SCENARIOS: tuple = (
     ("native-helper-targets", validate_native_helper_targets_scenario),
     ("native-single-task-matrix", validate_native_single_task_matrix_scenario),
     ("touch-write-guard", validate_touch_write_guard_scenario),
+    ("touch-guard-record-layer", validate_touch_guard_record_layer_scenario),
+    ("repo-action-mode", validate_repo_action_mode_scenario),
+    ("runner-skip-accounting", validate_runner_skip_accounting_scenario),
+    ("resident-topic-matching", validate_resident_topic_matching_scenario),
+    (
+        "completed-sibling-attribution",
+        validate_completed_sibling_attribution_scenario,
+    ),
     ("touch-guard-drift", validate_touch_guard_drift_scenario),
     ("touch-guard-surface", validate_touch_guard_surface_scenario),
     ("plugin-compaction-continuity", validate_plugin_compaction_continuity_scenario),
@@ -11553,6 +12266,19 @@ def validate_archive_overlay_hygiene(errors: list[str]) -> None:
         )
 
 
+# Exit code 3 means "this scenario did not run because an external runtime it
+# probes is absent". 0 is pass, 1 is fail, 2 is an unknown scenario or a usage
+# error, so conflating an unavailable runtime with either would hide both. The
+# reason is narrow on purpose: an inconvenient assertion, a hard fixture, or a
+# platform difference is a failure, never a skip.
+SKIPPED = 3
+
+
+def skip_scenario(label: str, reason: str) -> int:
+    report(f"{label} scenario skipped: {reason}")
+    return SKIPPED
+
+
 def run_baseline() -> int:
     errors: list[str] = []
     validate_manifest(errors)
@@ -11584,19 +12310,29 @@ def run_all(jobs: int) -> int:
     # completion, buffered output is replayed in registry order, and every
     # failure is named in one summary.
     failures = []
+    skipped = []
     if run_baseline() != 0:
         failures.append("baseline")
     ordered = run_scenario_processes([name for name, _ in SCENARIOS], jobs)
     for name, code, output in ordered:
         sys.stdout.write(output)
-        if code != 0:
+        if code == SKIPPED:
+            skipped.append(name)
+        elif code != 0:
             failures.append(name)
     if failures:
         report(f"validation --all failed for: {', '.join(failures)}")
         return 1
-    report(
-        f"validation --all passed: baseline plus {len(SCENARIOS)} scenarios."
+    # The verified count excludes skips, so the number that lands in evidence is
+    # the number actually run, and every skip is named with the run.
+    verified = len(SCENARIOS) - len(skipped)
+    summary = (
+        f"validation --all passed: baseline plus {verified} "
+        f"scenario{'' if verified == 1 else 's'}"
     )
+    if skipped:
+        summary += f", {len(skipped)} skipped: {', '.join(skipped)}"
+    report(f"{summary}.")
     return 0
 
 

package/src/core/gates.js

@@ -316,7 +316,30 @@ function pathAllowed(candidate, touch) {
   });
 }
 
-function scopeEvidence(repo, task, base, contract = null, change = null) {
+// A base comparison shows that a path changed, never who changed it. When a
+// task of the same change is already checked complete and declares the path in
+// its own Touch, blaming the selected task is a guess — and the wrong one often
+// enough that the per-task commit habit became an implicit requirement whose
+// diagnostic named a file the author never touched. Only a checked sibling
+// counts: an unchecked task's Touch is a plan, not a record.
+function completedSiblingOwners(tasks, selected) {
+  const owners = [];
+  for (const item of tasks || []) {
+    if (item.id === selected.id || !item.checked) continue;
+    const declared = touchEntries(item);
+    if (declared.length > 0) owners.push({ id: item.id, touch: declared });
+  }
+  return owners;
+}
+
+function scopeEvidence(
+  repo,
+  task,
+  base,
+  contract = null,
+  change = null,
+  tasks = null
+) {
   const dirtyPaths = gitPaths(repo);
   if (!base) {
     return {
@@ -358,17 +381,35 @@ function scopeEvidence(repo, task, base, contract = null, change = null) {
   // attributed as outside Touch. Other changes' directories, the archive tree,
   // and the specs/schemas trees stay attributable.
   const authoringPrefix = change ? `openspec/changes/${change}/` : null;
-  const outside = [...changed]
+  const owners = completedSiblingOwners(tasks, task);
+  const warnings = [];
+  const outside = [];
+  const candidates = [...changed]
     .map((item) => item.replace(/\\/g, "/"))
     .filter((item) => item !== "keel/guard.json")
     .filter((item) => !(authoringPrefix && item.startsWith(authoringPrefix)))
     .filter((item) => !pathAllowed(item, touch))
     .sort();
+  for (const item of candidates) {
+    const owner = owners.find((entry) => pathAllowed(item, entry.touch));
+    if (owner) {
+      // Reported, not silent: the comparison could not establish authorship,
+      // and resolving that in the selected task's favour is a judgment the
+      // author should see rather than a fact the gate discovered.
+      warnings.push(
+        `${item} is not attributed to this task: task ${owner.id} of the same `
+          + "change is checked complete and declares it in Touch. A base "
+          + "comparison cannot establish which task wrote it."
+      );
+      continue;
+    }
+    outside.push(item);
+  }
   return {
     problems: outside.map((item) =>
       problem("outside-touch", `Changed path is outside Touch: ${item}`)
     ),
-    warnings: [],
+    warnings,
   };
 }
 
@@ -481,7 +522,8 @@ function taskComplete(repo, options) {
     task,
     options.base,
     usableContract,
-    selection.change
+    selection.change,
+    selection.tasks
   );
   checks.problems.push(...scope.problems);
   const status =

package/src/core/guard.js

@@ -247,7 +247,13 @@ function guardStatus(repo) {
         + "reauthorize through `keel gate task-start` and `keel guard start`.",
     });
   }
+  // Bytes under the guarded change's own directory are records the task
+  // produces — checkbox, Evidence, Review — not authority it must not touch.
+  // The fingerprint comparison above already covers every part of that file
+  // the capsule reads, so hashing it here only reported progress as drift.
+  const recordPrefix = `openspec/changes/${manifest.change}/`;
   for (const entry of manifest.authority) {
+    if (entry.path.replace(/\\/g, "/").startsWith(recordPrefix)) continue;
     const file = path.join(repo, entry.path);
     if (!fs.existsSync(file) || sha256(fs.readFileSync(file)) !== entry.sha256) {
       problems.push({

package/src/core/task-contract.js

@@ -8,8 +8,17 @@ const SUPPORTED_MODES = new Set([
   "implementation",
   "diagnose-only",
   "plan-first",
+  // A task whose whole effect is an authorized repository-level action — the
+  // repository's first commit, a tag — writes no worktree file, so it has no
+  // concrete Touch to declare. It is not diagnose-only either: it has real side
+  // effects that need evidence. It is the one mode that may commit.
+  "repo-action",
 ]);
 
+// Modes whose contract is "no worktree writes", so `Touch: none` is required
+// rather than merely tolerated.
+const NO_WRITE_MODES = new Set(["diagnose-only", "repo-action"]);
+
 const UNFILLED_TOKEN = /(<[^>]+>|\bTODO\b|\bTBD\b|\bplaceholder\b)/i;
 
 function normalizeFieldText(value) {
@@ -241,16 +250,17 @@ function taskStartContractProblems(task) {
         code: "unsupported-mode",
         message:
           `Unsupported Mode \`${mode}\`; expected implementation, `
-          + "diagnose-only, or plan-first.",
+          + "diagnose-only, plan-first, or repo-action.",
       },
     ];
   }
-  if (mode === "diagnose-only") {
+  if (NO_WRITE_MODES.has(mode)) {
     if (touch.length !== 1 || touch[0].toLowerCase() !== "none") {
       return [
         {
           code: "invalid-touch",
-          message: "diagnose-only requires `Touch: none`.",
+          message: `${mode} writes no worktree file and requires `
+            + "`Touch: none`.",
         },
       ];
     }
@@ -819,13 +829,17 @@ function compileTaskContract(repo, change, task) {
     helperAuthority: "read-only-evidence-only",
     prohibitions: [
       "must not change Acceptance",
-      "must not commit",
+      // repo-action is the one mode whose authorized effect is the repository
+      // action itself, so it alone does not carry the commit prohibition.
+      // Whether the action it performed was the authorized one is a Review
+      // judgment; what the capsule fixes is the write posture.
+      ...(mode === "repo-action" ? [] : ["must not commit"]),
       "must not continue to another task",
       "must not mark tasks complete",
       "must not push",
       "must not sync or archive",
       "must not transfer Keel ownership",
-      ...(mode === "diagnose-only" ? ["must not write product files"] : []),
+      ...(NO_WRITE_MODES.has(mode) ? ["must not write product files"] : []),
     ],
   };
   if (resolved.diagnostics.length > 0) {