@christang/keel 5.3.1 → 5.3.4

package/assets/bootstrap/AGENTS.md

@@ -1,8 +1,8 @@
-<!-- keel:start version=5.3.1 -->
+<!-- keel:start version=5.3.4 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.
-- Obey the selected task capsule: `keel gate task-start` before implementing, record its fingerprint in Evidence `Contract`, and pass `keel gate task-complete` before checking complete. Touch is the write boundary for product files; on Claude a passing `task-start` guards it by default (`--no-guard`/`keel guard clear` opt out).
+- Obey the selected task capsule: `keel gate task-start` before implementing, record its fingerprint in Evidence `Contract`, and pass `keel gate task-complete` before checking complete. Touch bounds product writes; the change's own dir is exempt. On Claude a passing `task-start` guards it by default (`--no-guard` opts out).
 - One current agent owns writes; helpers return read-only report/evidence only. No commit, sync, or archive without explicit authorization.
 - Native plugin projections (SessionStart context) are disposable views, never authority; without the plugin or hook, run the commands manually.
 - Keel skills and hooks come from the `keel` native plugin (`codex plugin add` / `claude plugin install`); `keel --init` owns only the OpenSpec schema, overlays, and this bootstrap.

package/assets/openspec/schemas/keel-spec-driven/schema.yaml

@@ -93,8 +93,15 @@ artifacts:
       Verify selects the least-cost strategy that still proves the resolved
       Acceptance: vertical-tdd, regression-first, characterization,
       snapshot-characterization, rendered-behavior, or evidence-first.
-      Red-green strategies record per-label `.red` and `.green` Evidence for
-      the same check before completion.
+      Red-green strategies record per-label `.red` and `.green` Evidence in
+      addition to the bare `M<n>` Evidence, which is always required; all three
+      must be concrete before completion. An `M<n>` may carry a comma-separated
+      tag set after its label, drawn from `fast`, `full`, and `regression`.
+      `fast`/`full` marks which checks the fast inner-loop pre-push runs.
+      `regression` marks a check asserting that something already green stays
+      green: it has no honest red, so it is exempt from `.red`/`.green` while
+      still needing its bare `M<n>` Evidence, and a red-green strategy must keep
+      at least one check untagged.
       The Task Authoring Gate requires every relevant critical expectation to
       be covered by a slice, deferred to a durable owner, or explicitly
       discarded with rationale before the slice can be selected for execution.
@@ -137,10 +144,25 @@ artifacts:
       Review with Status, Acceptance check, Scope check, and Findings. Status is
       one of pass, passed, complete, completed, ok, or done. Findings
       are `none` or carry a durable owner — a `Discard reason:`/`Discard
-      rationale:` prefix, a `keel/archive/…` path, or an existing
-      `openspec/changes/…` artifact; `keel/HANDOFF.md` is never the owner.
-      tasks.md ends with a `## Expectation Coverage` section that change-close
-      requires: one `- E<n>: <expectation> Covered by: <task ids>` line per
+      rationale:` prefix, an absolute `https://…` reference, or any
+      repo-relative path that exists, named after `Durable owner:` so it reads
+      as the owner rather than a file the finding mentions;
+      `keel/HANDOFF.md` is never the owner.
+      tasks.md carries two change-level sections beside its tasks.
+      `## Invalidates` is required by task-start, before any task of the
+      change runs: one `- I<n>: "the wording that is now wrong" — where it lives.`
+      line per statement this change makes stale, closed by `Updated by: <task
+      ids>` naming tasks of this change, a `Durable owner:`, or a `Discard
+      reason:`, or `- None.` when the change makes no existing statement wrong.
+      A `Durable owner:` is an absolute `https://…` reference or any
+      repo-relative path that exists; a path with no file behind it is refused,
+      and `keel/HANDOFF.md` is a pointer override rather than an owner.
+      Quote the wording a reader would search for rather than only listing
+      files, because the text that goes stale is the text the author was not
+      already holding in mind; naming it while tasks are authored is what lets
+      the affected paths be declared in Touch instead of forcing a
+      reauthorization mid-task. `## Expectation Coverage` is required by
+      change-close: one `- E<n>: <expectation> Covered by: <task ids>` line per
       critical expectation (or a `Durable owner:` / `Discard reason:` closure),
       or `- None.` when the change has no critical expectations.
     requires:

package/assets/openspec/schemas/keel-spec-driven/templates/tasks.md

@@ -20,10 +20,16 @@
          rendered-behavior, or evidence-first. Each M<n> check must prove the
          resolved Acceptance through the public interface, not build-only or
          shape-only evidence. Red-green strategies record per-label `.red` and
-         `.green` Evidence entries for the same check before completion. An M<n>
-         check may carry an optional (fast) or (full) layer tag after its label
-         (e.g. `M1 (fast): …`) marking which checks the fast inner-loop pre-push
-         runs; an untagged check is full and change-close still needs every
+         `.green` Evidence entries IN ADDITION TO the bare `M<n>` entry, which
+         is always required; all three must be concrete before completion.
+         An M<n> check may carry an optional comma-separated tag set after its
+         label, drawn from fast, full, and regression (e.g. `M1 (fast): …`,
+         `M2 (regression): …`, `M3 (fast, regression): …`). fast/full marks
+         which checks the fast inner-loop pre-push runs; an untagged check is
+         full. regression marks a check that asserts something already green
+         stays green: it has no honest red, so it is exempt from `.red`/`.green`
+         but still needs its bare `M<n>` Evidence, and a red-green strategy must
+         keep at least one check untagged. change-close still needs every
          M<n>'s Evidence. -->
     - Strategy: <strategy>
     - M1: <public behavior check>
@@ -32,7 +38,7 @@
     - M1: pending
     - Review:
       <!-- Status: one of pass, passed, complete, completed, ok, done -->
-      <!-- Findings: none, or carry a durable owner — a "Discard reason:"/"Discard rationale:" prefix, a keel/archive/… path, or an existing openspec/changes/… artifact; not keel/HANDOFF.md -->
+      <!-- Findings: none, or carry a durable owner — a "Discard reason:"/"Discard rationale:" prefix, an absolute https://… reference, or any repo-relative path that exists (keel/archive/…, an openspec/changes/… artifact, or the repository's own ledger) named after "Durable owner:"; not keel/HANDOFF.md, which is a pointer override -->
       - Status: pending
       - Acceptance check: pending
       - Scope check: pending
@@ -76,10 +82,27 @@
       - Findings: pending
     - Blocker: none
 
+## Invalidates
+
+<!-- task-start requires this section before any task of this change runs, so
+     the statements this change makes stale can be named while their paths can
+     still be declared in Touch instead of forcing a reauthorization later.
+     Each entry quotes the wording a reader would SEARCH for — not just the
+     files you already remembered, because the text that goes stale is the text
+     you were not thinking about — then says where it lives, then closes:
+     `Updated by: 1.1` (tasks of this change), `Durable owner: <url or path>`
+     — an absolute https:// reference, or any repo-relative path that exists;
+     keel/HANDOFF.md is refused — or `Discard reason: why it stands`. Use `- None.` when this change makes
+     no existing statement wrong.
+
+     - I1: "the exact wording that is now wrong" — where that wording lives. Updated by: 1.1
+     -->
+- None.
+
 ## Expectation Coverage
 
 <!-- change-close requires this section. One line per critical expectation:
      `- E1: the expectation Covered by: 1.1` (task ids that own it), or a
-     `Durable owner: openspec/changes/<change>/tasks.md` / `Discard reason: why`
-     closure. Use `- None.` only when the change has no critical expectations. -->
+     `Durable owner: <url or any repo-relative path that exists>` /
+     `Discard reason: why` closure. Use `- None.` only when the change has no critical expectations. -->
 - None.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.3.1",
+  "version": "5.3.4",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.3.1",
+  "version": "5.3.4",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.3.1",
+  "version": "5.3.4",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/scripts/session-start.js

@@ -15,6 +15,11 @@ const fs = require("fs");
 const path = require("path");
 const { spawnSync } = require("child_process");
 
+// This text is injected into the agent and never rendered for the human, so
+// without an explicit instruction the projection reaches nobody who can catch
+// it being wrong. Every branch carries the same phrase, degraded ones included.
+const DISCLOSURE = "to the user in your first reply";
+
 const TIMEOUT_MS = Number(process.env.KEEL_HOOK_TIMEOUT_MS || 8000) || 8000;
 const MAX_REASONS = 3;
 const MAX_REASON_LENGTH = 300;
@@ -51,7 +56,8 @@ function runKeel(cwd, args) {
 function fallback(reason) {
   emit(
     `Keel hook fallback: ${reason} Run \`keel context\` manually; `
-      + "OpenSpec and Git remain the durable authority."
+      + "OpenSpec and Git remain the durable authority. Report this failure "
+      + `and that command ${DISCLOSURE}.`
   );
 }
 
@@ -145,6 +151,7 @@ function main() {
         + "does not guess among candidates."
     );
   }
+  lines.push(`- report this state ${DISCLOSURE}; it authorizes nothing.`);
   emit(lines.join("\n"));
   return 0;
 }

package/scripts/bump_version.js

@@ -74,8 +74,45 @@ function replaceInFile(relPath, replacements) {
   process.stdout.write(`  updated ${relPath}\n`);
 }
 
+// Every Keel marker carrying `version=` is a shipped claim about which version
+// this is, and they must all move together. Sweeping for the markers that exist
+// is what keeps a target from falling behind: the `.codex/` overlays sat four
+// versions back because only the surfaces something happened to touch got
+// refreshed, and nothing failed while they drifted.
+const MARKER_SKIP_PREFIXES = [
+  "node_modules",
+  ".git",
+  path.join("openspec", "changes", "archive"),
+  path.join("keel", "archive"),
+];
+
+function sweepVersionMarkers(dir, oldVersion, newVersion, touched) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    const relative = path.relative(ROOT, full);
+    if (MARKER_SKIP_PREFIXES.some((prefix) => relative.startsWith(prefix))) continue;
+    if (entry.isDirectory()) {
+      sweepVersionMarkers(full, oldVersion, newVersion, touched);
+      continue;
+    }
+    if (!/\.(md|json)$/.test(entry.name)) continue;
+    const content = fs.readFileSync(full, "utf8");
+    const updated = content.replace(
+      new RegExp(`(keel:[a-z-]+(?::end)?\\s+version=)${oldVersion.replace(/\./g, "\\.")}\\b`, "g"),
+      `$1${newVersion}`
+    );
+    if (updated !== content) {
+      fs.writeFileSync(full, updated);
+      touched.push(relative.split(path.sep).join("/"));
+    }
+  }
+}
+
 function prependChangelogEntry(newVersion) {
-  let content = fs.readFileSync(CHANGELOG_PATH, "utf8");
+  // Read line endings as the file has them: a CRLF checkout made the header
+  // comparison below fail after every version marker had already been written,
+  // leaving the repository half-bumped.
+  let content = fs.readFileSync(CHANGELOG_PATH, "utf8").replace(/\r\n/g, "\n");
   if (content.includes(`## ${newVersion} `) || content.includes(`## ${newVersion}\n`)) {
     process.stdout.write(`  keel/CHANGELOG.md already has a ${newVersion} entry\n`);
     return;
@@ -118,13 +155,14 @@ function main() {
     [`PACKAGE_VERSION = "${oldVersion}"`, `PACKAGE_VERSION = "${newVersion}"`],
     [`PROTOCOL_VERSION = "${oldVersion}"`, `PROTOCOL_VERSION = "${newVersion}"`],
   ]);
-  replaceInFile("AGENTS.md", [
-    [`v${oldVersion}`, `v${newVersion}`],
-    [`version=${oldVersion}`, `version=${newVersion}`],
-  ]);
-  replaceInFile("assets/bootstrap/AGENTS.md", [
-    [`version=${oldVersion}`, `version=${newVersion}`],
-  ]);
+  replaceInFile("AGENTS.md", [[`v${oldVersion}`, `v${newVersion}`]]);
+
+  const touched = [];
+  sweepVersionMarkers(ROOT, oldVersion, newVersion, touched);
+  for (const relative of touched) {
+    process.stdout.write(`  updated marker ${relative}\n`);
+  }
+
   prependChangelogEntry(newVersion);
 
   process.stdout.write(