@christang/keel 5.3.1 → 5.3.4

package/scripts/validate_plugin.py

@@ -37,8 +37,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.3.1"
-PROTOCOL_VERSION = "5.3.1"
+PACKAGE_VERSION = "5.3.4"
+PROTOCOL_VERSION = "5.3.4"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 OPENSPEC_CONFIG_PATH = Path("openspec/config.yaml")
@@ -50,7 +50,6 @@ OPENSPEC_SURFACE_OVERLAY_END = "<!-- keel:openspec-surface-overlay:end -->"
 
 SKILL_TARGETS = {"claude", "codex", "opencode"}
 HOOK_TARGETS = {"claude"}
-KEEL_HOOK_NAME = "keel-gate"
 AGENT_TARGETS: set[str] = set()
 ADAPTER_TARGETS = {"claude", "codex", "opencode"}
 AGENT_PROTOCOL_TARGETS = {"codex", "opencode"}
@@ -415,6 +414,17 @@ def validate_npm_package(errors: list[str]) -> None:
             errors.append(f"bin/keel.js missing required CLI support: {required}")
 
 
+# Path expressions rooted at a tree the retirement check above requires to be
+# absent. `src/core` and `src/skills` are live, so only the retired `src`
+# children are listed.
+RETIRED_PATH_EXPRESSIONS = (
+    r'ROOT\s*/\s*"dist"',
+    r'ROOT\s*/\s*"src"\s*/\s*"assets"',
+    r'ROOT\s*/\s*"src"\s*/\s*"hooks"',
+    r'ROOT\s*/\s*"src"\s*/\s*"adapters"',
+)
+
+
 def validate_paths(errors: list[str]) -> None:
     for directory in REQUIRED_DIRECTORIES:
         if not (ROOT / directory).is_dir():
@@ -448,6 +458,43 @@ def validate_paths(errors: list[str]) -> None:
                 f"retired custom distribution path must be removed: {retired}"
             )
 
+    # Every Keel marker that carries a version is a shipped claim about which
+    # version this is. Derive the set from the markers that exist rather than a
+    # fixed list, because a fixed list is the next thing to fall behind — which
+    # is exactly how the `.codex/` overlays sat four versions back unnoticed.
+    for marker_file in sorted(ROOT.rglob("*")):
+        if not marker_file.is_file() or not marker_file.suffix in (".md", ".json"):
+            continue
+        relative = marker_file.relative_to(ROOT).as_posix()
+        if relative.startswith(("node_modules/", "openspec/changes/archive/", "keel/archive/")):
+            continue
+        try:
+            text = marker_file.read_text(encoding="utf-8")
+        except (UnicodeDecodeError, OSError):
+            continue
+        for found in re.findall(r"keel:[a-z-]+(?::end)?\s+version=([0-9][^\s>]*)", text):
+            if found != PACKAGE_VERSION:
+                errors.append(
+                    "shipped version marker disagrees with the package version "
+                    f"{PACKAGE_VERSION}: {relative} says {found}"
+                )
+
+    # Asserting the trees are gone is not enough: a check that still resolves a
+    # path into one of them can only ever find nothing, and rglob over a missing
+    # directory yields no error, so the check reports success forever. Naming a
+    # retired tree in a string literal is fine — that is how the checks above
+    # state what must not exist; building a Path into one is not.
+    validator_source = (ROOT / "scripts" / "validate_plugin.py").read_text(
+        encoding="utf-8"
+    )
+    for line_number, line in enumerate(validator_source.splitlines(), start=1):
+        if any(re.search(pattern, line) for pattern in RETIRED_PATH_EXPRESSIONS):
+            errors.append(
+                "validator resolves a path under a retired distribution tree, "
+                "so the check it feeds can only iterate nothing: "
+                f"scripts/validate_plugin.py:{line_number}: {line.strip()}"
+            )
+
 
 def extract_managed_block(content: str) -> str | None:
     start_match = MANAGED_START_RE.search(content)
@@ -571,10 +618,20 @@ def validate_templates(errors: list[str]) -> None:
                     f"{template['name']} includes forbidden content: {forbidden}"
                 )
 
+    # What actually ships is whatever package.json declares, so derive the roots
+    # from there rather than naming a tree that can retire out from under the
+    # check the way `src/assets` and `dist` did.
+    packaged_roots = [
+        ROOT / entry
+        for entry in json.loads(
+            (ROOT / "package.json").read_text(encoding="utf-8")
+        ).get("files", [])
+        if (ROOT / entry).is_dir()
+    ]
+
     active_task_placeholders = [
         path.relative_to(ROOT).as_posix()
-        for base in (ROOT / "src" / "assets", ROOT / "dist")
-        if base.exists()
+        for base in packaged_roots
         for path in base.rglob("keel/TASK.md")
     ]
     if active_task_placeholders:
@@ -585,18 +642,9 @@ def validate_templates(errors: list[str]) -> None:
 
     backlog_assets = [
         path.relative_to(ROOT).as_posix()
-        for base in (ROOT / "src" / "assets", ROOT / "dist")
-        if base.exists()
+        for base in packaged_roots
         for path in base.rglob("keel/backlog/*")
     ]
-    backlog_assets.extend(
-        path.relative_to(ROOT).as_posix()
-        for path in (
-            ROOT / "src" / "assets" / "shared" / "backlog",
-            ROOT / "dist" / "shared" / "assets" / "backlog",
-        )
-        if path.exists()
-    )
     if backlog_assets:
         errors.append(
             "package must not include keel backlog assets: "
@@ -606,7 +654,6 @@ def validate_templates(errors: list[str]) -> None:
 
 def validate_openspec_schema(errors: list[str]) -> None:
     source_root = ROOT / "assets" / "openspec" / "schemas" / OPENSPEC_SCHEMA_NAME
-    dist_root = source_root
     required_files = [
         "schema.yaml",
         "templates/proposal.md",
@@ -615,13 +662,12 @@ def validate_openspec_schema(errors: list[str]) -> None:
         "templates/tasks.md",
     ]
 
-    for root_name, root in (("source", source_root), ("dist", dist_root)):
-        for relative in required_files:
-            if not (root / relative).is_file():
-                errors.append(
-                    f"OpenSpec {root_name} schema missing file: "
-                    f"{root.relative_to(ROOT).as_posix()}/{relative}"
-                )
+    for relative in required_files:
+        if not (source_root / relative).is_file():
+            errors.append(
+                "OpenSpec source schema missing file: "
+                f"{source_root.relative_to(ROOT).as_posix()}/{relative}"
+            )
 
     schema_path = source_root / "schema.yaml"
     tasks_template_path = source_root / "templates" / "tasks.md"
@@ -717,33 +763,11 @@ def validate_openspec_schema(errors: list[str]) -> None:
                     f"{forbidden}"
                 )
 
-    if source_root.is_dir() and dist_root.is_dir():
-        source_files = {
-            path.relative_to(source_root).as_posix(): path.read_text(encoding="utf-8")
-            for path in sorted(source_root.rglob("*"))
-            if path.is_file()
-        }
-        dist_files = {
-            path.relative_to(dist_root).as_posix(): path.read_text(encoding="utf-8")
-            for path in sorted(dist_root.rglob("*"))
-            if path.is_file()
-        }
-        if source_files != dist_files:
-            missing = sorted(set(source_files) - set(dist_files))
-            unexpected = sorted(set(dist_files) - set(source_files))
-            changed = sorted(
-                path
-                for path in set(source_files) & set(dist_files)
-                if source_files[path] != dist_files[path]
-            )
-            errors.append(
-                "OpenSpec dist schema differs from source"
-                + (
-                    f"; missing={missing}, unexpected={unexpected}, changed={changed}"
-                    if missing or unexpected or changed
-                    else ""
-                )
-            )
+    # A source-versus-dist comparison stood here, but `dist_root` was assigned
+    # `source_root`, so it diffed a directory against itself and could not fail.
+    # The pair that really needs comparing — this packaged copy against the
+    # repo-local one OpenSpec resolves — is asserted by
+    # `invalidation-authoring-surface`.
 
 
 def validate_skill_docs(errors: list[str]) -> None:
@@ -946,18 +970,17 @@ def snapshot_files(root: Path) -> dict[str, str]:
     return snapshot
 
 
-def packaged_openspec_schema_install_paths() -> list[str]:
-    schema_root = (
-        ROOT
-        / "dist"
-        / "shared"
-        / "assets"
-        / "openspec"
-        / "schemas"
-        / OPENSPEC_SCHEMA_NAME
+def packaged_openspec_schema_install_paths(root: Path | None = None) -> list[str]:
+    # The root the installer itself reads (install_to_repo.openspec_schema_actions),
+    # which raises on the same condition. A validator that answered `[]` here left
+    # six install/uninstall/clear assertions iterating nothing and reporting pass.
+    schema_root = root if root is not None else (
+        ROOT / "assets" / "openspec" / "schemas" / OPENSPEC_SCHEMA_NAME
     )
     if not schema_root.is_dir():
-        return []
+        raise FileNotFoundError(
+            f"packaged OpenSpec schema root is missing: {schema_root}"
+        )
 
     return [
         (OPENSPEC_SCHEMA_ROOT / path.relative_to(schema_root)).as_posix()
@@ -1758,7 +1781,7 @@ def validate_authoring_continuity_scenario() -> int:
             change_root / "specs/demo/spec.md",
             "## ADDED Requirements\n",
         )
-        write_text(change_root / "tasks.md", "# Tasks\n\n## Tasks\n")
+        write_text(change_root / "tasks.md", "# Tasks\n\n## Invalidates\n\n- None.\n\n## Tasks\n")
         invalid = run_keel(invalid_repo, "context", "--json")
         invalid_payload = json.loads(invalid.stdout)
         if (
@@ -2462,22 +2485,6 @@ def validate_update_default_registry_scenario() -> int:
     return 0
 
 
-def run_keel_hook(repo: Path, event: dict) -> subprocess.CompletedProcess[str]:
-    env = dict(os.environ)
-    env["KEEL_CLI"] = str(ROOT / "bin/keel.js")
-    return subprocess.run(
-        ["node", str(ROOT / "dist" / "claude" / "hooks" / KEEL_HOOK_NAME / "keel-gate.js")],
-        cwd=repo,
-        env=env,
-        input=json.dumps(event),
-        text=True,
-        encoding="utf-8",
-        errors="replace",
-        capture_output=True,
-        check=False,
-    )
-
-
 def gate_task(
     *,
     checked: bool,
@@ -2527,7 +2534,9 @@ def write_gate_fixture(repo: Path, tasks: str, design: str = "## Context\n\nfixt
     change = repo / "openspec/changes/demo"
     write_text(
         change / "tasks.md",
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
+        "## Invalidates\n\n"
+        "- None.\n\n"
         "## Expectation Coverage\n\n"
         "- E1:\n"
         "  - Covered by: 1.1\n\n"
@@ -2625,7 +2634,7 @@ def validate_cli_scenario() -> int:
 
         write_text(
             repo / "openspec/changes/status-drift/tasks.md",
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "## Tasks\n\n"
             "- [x] A1 implementation **未提交**\n\n"
             "## Execution Status\n\n"
@@ -2648,7 +2657,7 @@ def validate_cli_scenario() -> int:
 
         write_text(
             repo / "openspec/changes/status-drift/tasks.md",
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "> Boundary: tasks.md is the source for the current change's slice checklist and logical completion only. Completion state is only `[x]` / `[ ]`; progress and the default next slice are derived from the checklist. Do not record commit hashes, branch/merge state, dirty/uncommitted state, or manually computed completion counts. Durable work state belongs in OpenSpec; HANDOFF is only an explicit pointer override.\n\n"
             "## Tasks\n\n"
             "- [x] A1 implementation\n\n"
@@ -2666,7 +2675,7 @@ def validate_cli_scenario() -> int:
 
         write_text(
             repo / "openspec/changes/archive/2026-07-09-finished/tasks.md",
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [x] A1 implementation\n\n"
             "## Evidence\n\n"
             "- Scope check: pre-existing dirty paths were not attributed to this task.\n",
@@ -2862,7 +2871,7 @@ def validate_stateless_continuity_scenario() -> int:
 
         write_text(
             repo / "openspec/changes/other/tasks.md",
-            "# Tasks\n\n- [ ] 1.1 Other task\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Other task\n",
         )
         write_text(
             repo / "keel/HANDOFF.md",
@@ -2922,7 +2931,7 @@ def validate_stateless_continuity_scenario() -> int:
 
         write_text(
             tasks_path,
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [x] 1.1 First slice\n"
             "- [x] 1.2 Second slice\n",
         )
@@ -3042,7 +3051,7 @@ def validate_stateless_continuity_scenario() -> int:
         stale_repo.mkdir()
         write_text(
             stale_repo / "openspec/changes/current/tasks.md",
-            "# Tasks\n\n- [ ] 1.1 Current task\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Current task\n",
         )
         write_text(
             stale_repo / "keel/HANDOFF.md",
@@ -3067,7 +3076,7 @@ def validate_stateless_continuity_scenario() -> int:
 
         write_text(
             stale_repo / "openspec/changes/current/tasks.md",
-            "# Tasks\n\n- [x] 1.1 Current task\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [x] 1.1 Current task\n",
         )
         write_text(
             stale_repo / "keel/HANDOFF.md",
@@ -3094,7 +3103,7 @@ def validate_stateless_continuity_scenario() -> int:
 
         write_text(
             stale_repo / "openspec/changes/current/tasks.md",
-            "# Tasks\n\n- [ ] 1.1 Current task\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Current task\n",
         )
         write_text(
             stale_repo / "keel/HANDOFF.md",
@@ -3439,7 +3448,7 @@ def task_contract_fixture(
     command_lines = "".join(f"    - {item}\n" for item in commands)
     evidence_lines = "".join(f"    - {item}\n" for item in evidence)
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Exercise task contract\n"
         "  - Owner: keel-agent\n"
         f"  - Mode: {mode}\n"
@@ -3476,6 +3485,794 @@ def task_contract_fixture(
     )
 
 
+# task-start requires a change to declare what it invalidates, so every fixture
+# that expects to start a task carries the cheapest legitimate answer. Scenarios
+# exercising the declaration itself replace this block.
+INVALIDATES_NONE = "## Invalidates\n\n- None.\n\n"
+
+
+INVALIDATION_ENTRIES = (
+    '- I1: "Touch is the write boundary" — assets/bootstrap/AGENTS.md.'
+    " Updated by: 1.1\n"
+    '- I2: "does not accept a GitHub issue URL" —'
+    " keel/archive/follow-ups/note.md."
+    " Discard reason: archive notes are historical evidence.\n"
+    '- I3: "the suite is not portable" — README.md.'
+    " Durable owner: https://example.invalid/issues/1\n"
+)
+
+
+def invalidation_repo(root: Path, name: str, section: str | None) -> Path:
+    repo = root / name
+    # A real Contract anchor, so the missing-section case can prove that a
+    # failing authoring gate leaves the anchor untouched rather than merely
+    # failing earlier for want of one.
+    body = task_contract_fixture(evidence=("Contract: pending", "M1: pending"))
+    body = body.replace(INVALIDATES_NONE, "" if section is None else section)
+    write_text(repo / "openspec/changes/demo/tasks.md", body)
+    return repo
+
+
+def validate_task_start_invalidation_scenario() -> int:
+    label = "task-start-invalidation"
+
+    def gate(repo: Path, *extra: str) -> tuple[subprocess.CompletedProcess[str], dict]:
+        result = run_keel(
+            repo, "gate", "task-start", ".",
+            "--change", "demo", "--task", "1.1", "--json", *extra,
+        )
+        payload = json.loads(result.stdout) if result.stdout.strip() else {}
+        return result, payload
+
+    def codes(payload: dict) -> set[str]:
+        return {item.get("code") for item in payload.get("problems", [])}
+
+    def messages(payload: dict) -> str:
+        return " ".join(item.get("message", "") for item in payload.get("problems", []))
+
+    with tempfile.TemporaryDirectory(
+        prefix="keel-invalidation-", ignore_cleanup_errors=True
+    ) as raw:
+        tmp = Path(raw)
+
+        # A change that never answered the question cannot start, and the
+        # refusal writes nothing — the guard manifest and the Contract anchor
+        # are both withheld, so a failed authoring gate leaves no state behind.
+        missing = invalidation_repo(tmp, "missing", None)
+        tasks_before = (missing / "openspec/changes/demo/tasks.md").read_text(
+            encoding="utf-8"
+        )
+        result, payload = gate(missing, "--record")
+        if (
+            payload.get("status") != "fail"
+            or "invalidation-declaration" not in codes(payload)
+        ):
+            report(f"{label} accepted a change with no invalidation section.")
+            report(repr(payload.get("problems")))
+            return 1
+        if (missing / "keel/guard.json").exists():
+            report(f"{label} wrote a guard manifest for a failing authoring gate.")
+            return 1
+        if (missing / "openspec/changes/demo/tasks.md").read_text(
+            encoding="utf-8"
+        ) != tasks_before:
+            report(f"{label} recorded a Contract anchor for a failing gate.")
+            return 1
+
+        none_repo = invalidation_repo(tmp, "none", INVALIDATES_NONE)
+        _, none_payload = gate(none_repo, "--no-guard")
+        if none_payload.get("status") != "pass":
+            report(f"{label} refused a legitimate declaration of nothing.")
+            report(repr(none_payload.get("problems")))
+            return 1
+
+        full_repo = invalidation_repo(
+            tmp, "full", "## Invalidates\n\n" + INVALIDATION_ENTRIES + "\n"
+        )
+        _, full_payload = gate(full_repo, "--no-guard")
+        if full_payload.get("status") != "pass":
+            report(f"{label} refused well-formed entries covering all three closures.")
+            report(repr(full_payload.get("problems")))
+            return 1
+
+        # The declaration is change-level bookkeeping, not task authority: two
+        # changes whose tasks are byte-identical must compile the same capsule
+        # however differently they answered this question.
+        none_print = none_payload.get("contract", {}).get("fingerprint", {}).get("value")
+        full_print = full_payload.get("contract", {}).get("fingerprint", {}).get("value")
+        if not none_print or none_print != full_print:
+            report(
+                f"{label} let the invalidation section move the capsule "
+                f"fingerprint: {none_print} vs {full_print}"
+            )
+            return 1
+
+        # A location list only ever names files the author already recalled,
+        # which is the failure this section exists to prevent, so an entry
+        # without the searchable wording is refused.
+        no_phrase = invalidation_repo(
+            tmp,
+            "no-phrase",
+            "## Invalidates\n\n- I1: AGENTS.md and README.md. Updated by: 1.1\n\n",
+        )
+        _, no_phrase_payload = gate(no_phrase, "--no-guard")
+        if (
+            no_phrase_payload.get("status") != "fail"
+            or "I1" not in messages(no_phrase_payload)
+        ):
+            report(f"{label} accepted an entry with no searchable phrase.")
+            report(repr(no_phrase_payload.get("problems")))
+            return 1
+
+        unclosed = invalidation_repo(
+            tmp,
+            "unclosed",
+            '## Invalidates\n\n- I1: "Touch is the write boundary" — AGENTS.md.\n\n',
+        )
+        _, unclosed_payload = gate(unclosed, "--no-guard")
+        if (
+            unclosed_payload.get("status") != "fail"
+            or "I1" not in messages(unclosed_payload)
+        ):
+            report(f"{label} accepted an entry that never closed.")
+            report(repr(unclosed_payload.get("problems")))
+            return 1
+
+        unknown_owner = invalidation_repo(
+            tmp,
+            "unknown-task",
+            '## Invalidates\n\n- I1: "Touch is the write boundary" — AGENTS.md.'
+            " Updated by: 9.9\n\n",
+        )
+        _, unknown_payload = gate(unknown_owner, "--no-guard")
+        if unknown_payload.get("status") != "fail":
+            report(f"{label} accepted an updater task that does not exist.")
+            return 1
+
+        if not codes(payload):
+            report(f"{label} reported a failure with no problem code.")
+            return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
+SCHEMA_COPY_PAIRS = (
+    (
+        "openspec/schemas/keel-spec-driven/templates/tasks.md",
+        "assets/openspec/schemas/keel-spec-driven/templates/tasks.md",
+    ),
+    (
+        "openspec/schemas/keel-spec-driven/schema.yaml",
+        "assets/openspec/schemas/keel-spec-driven/schema.yaml",
+    ),
+)
+
+
+def validate_anchor_reverification_bound_scenario() -> int:
+    label = "anchor-reverification-bound"
+
+    # The fingerprint is described as recompiled and compared at resume,
+    # projection, and completion, with no stated bound. It holds while the
+    # change is live: the capsule records each authority's source as a path
+    # under the change directory, and archiving renames that directory. An
+    # unstated boundary reads as no boundary, so demonstrate where it is.
+    with tempfile.TemporaryDirectory(prefix="keel-anchor-bound-") as raw_tmp:
+        repo = Path(raw_tmp) / "repo"
+        repo.mkdir()
+        live = repo / "openspec/changes/demo/tasks.md"
+        write_text(live, task_contract_fixture(evidence=("Contract: pending", "M1: pending")))
+
+        recorded = run_keel(
+            repo, "gate", "task-start", "--change", "demo", "--task", "1.1",
+            "--record", "--json",
+        )
+        payload = json.loads(recorded.stdout)
+        if payload.get("status") != "pass":
+            report(f"{label} could not record an anchor on a live change.")
+            report(json.dumps(payload.get("problems", []), indent=2))
+            return 1
+        anchor = payload["contract"]["fingerprint"]["value"]
+
+        # Live: recompiling reproduces the recorded value, which is the
+        # guarantee the resident protocol states.
+        again = json.loads(
+            run_keel(
+                repo, "gate", "task-start", "--change", "demo", "--task", "1.1", "--json"
+            ).stdout
+        )
+        if again["contract"]["fingerprint"]["value"] != anchor:
+            report(f"{label} a live anchor did not recompile to its recorded value.")
+            return 1
+
+        # Archived: the gate refuses to select the change at all, so the bound
+        # is enforced rather than merely documented.
+        archived = repo / "openspec/changes/archive/2026-07-28-demo/tasks.md"
+        write_text(archived, live.read_text(encoding="utf-8"))
+        refused = run_keel(
+            repo, "gate", "task-start",
+            "--change", "archive/2026-07-28-demo", "--task", "1.1",
+        )
+        if refused.returncode == 0 or "invalid change name" not in (
+            refused.stderr + refused.stdout
+        ):
+            report(
+                f"{label} the gate accepted an archived change; the bound this "
+                "documents is supposed to be enforced, not advisory."
+            )
+            report((refused.stderr or refused.stdout).strip())
+            return 1
+
+        # And the reason the refusal is right: compiling the archived copy
+        # directly yields a different fingerprint, because each authority's
+        # `source` names the directory the task now lives in.
+        probe = subprocess.run(
+            [
+                "node", "-e",
+                "const {loadTaskContract}=require(process.argv[1]);"
+                "const c=loadTaskContract(process.argv[2],'archive/2026-07-28-demo','1.1');"
+                "process.stdout.write(c.contract.fingerprint.value);",
+                str(ROOT / "src/core/task-contract.js"),
+                str(repo),
+            ],
+            text=True, encoding="utf-8", capture_output=True, check=False,
+        )
+        if probe.returncode != 0:
+            report(f"{label} could not compile the archived copy directly.")
+            report((probe.stderr or probe.stdout).strip())
+            return 1
+        if probe.stdout.strip() == anchor:
+            report(
+                f"{label} the archived copy reproduced the anchor, so the "
+                "documented bound no longer describes reality — revisit the "
+                "protocol wording rather than relaxing this check."
+            )
+            return 1
+
+    # And the resident protocol must say where the guarantee stops.
+    resident = (ROOT / "AGENTS.md").read_text(encoding="utf-8")
+    if "while its change is live" not in resident:
+        report(
+            f"{label} the resident protocol describes recompilation without "
+            "stating that it holds while the change is live."
+        )
+        return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_authoring_surface_owner_and_tags_scenario() -> int:
+    label = "authoring-surface-owner-and-tags"
+
+    # Both rules this change adds widen what a gate accepts. An author only
+    # benefits if the shipped surface says so, so the template, the artifact
+    # instruction the CLI hands back, and the resident protocol each state them.
+    template = (
+        ROOT / "openspec/schemas/keel-spec-driven/templates/tasks.md"
+    ).read_text(encoding="utf-8")
+    resident = (ROOT / "AGENTS.md").read_text(encoding="utf-8")
+
+    # Read the instruction the way an author receives it — through the CLI in a
+    # repository Keel installed — rather than from the schema file it is
+    # composed from, so a change that never reaches the author is a failure.
+    with tempfile.TemporaryDirectory(prefix="keel-authoring-surface-") as raw_tmp:
+        repo = Path(raw_tmp) / "repo"
+        repo.mkdir()
+        install = run_keel(repo, "--install")
+        if install.returncode != 0:
+            report(f"{label} keel --install failed.")
+            report((install.stderr or install.stdout).strip())
+            return 1
+        created = run_openspec(repo, "new", "change", "surface-probe")
+        if created is None:
+            report(f"{label} skipped: the openspec CLI is not on PATH.")
+            return 3
+        if created.returncode != 0:
+            report(f"{label} could not scaffold a change to read the instruction.")
+            report((created.stderr or created.stdout).strip())
+            return 1
+        instructions = run_openspec(
+            repo, "instructions", "tasks", "--change", "surface-probe"
+        )
+        if instructions is None or instructions.returncode != 0:
+            report(f"{label} could not read the tasks artifact instruction.")
+            if instructions is not None:
+                report((instructions.stderr or instructions.stdout).strip())
+            return 1
+        instruction = instructions.stdout
+
+    for surface, text in (("tasks template", template), ("tasks instruction", instruction)):
+        for needle in (
+            "regression",
+            "at least one check untagged",
+        ):
+            if needle not in text:
+                report(f"{label} {surface} does not describe the tag: {needle}")
+                return 1
+        # D6 — the wording trap: red and green accompany the bare label.
+        if "in addition to" not in text.lower():
+            report(
+                f"{label} {surface} still reads as though `.red`/`.green` "
+                "replace the bare M<n> Evidence rather than accompanying it."
+            )
+            return 1
+        if "repo-relative path that exists" not in text:
+            report(
+                f"{label} {surface} does not state the existing-path owner form."
+            )
+            return 1
+        if "HANDOFF" not in text:
+            report(f"{label} {surface} does not state that HANDOFF is refused.")
+            return 1
+
+    for needle in (
+        "regression-only-strategy",
+        "in addition to the bare",
+        "any repo-relative path that exists",
+    ):
+        if needle not in resident:
+            report(f"{label} resident protocol does not state: {needle}")
+            return 1
+
+    for local, packaged in SCHEMA_COPY_PAIRS:
+        if (ROOT / local).read_text(encoding="utf-8") != (
+            ROOT / packaged
+        ).read_text(encoding="utf-8"):
+            report(f"{label} schema copies diverge: {local} vs {packaged}")
+            return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_durable_owner_vocabulary_scenario() -> int:
+    label = "durable-owner-vocabulary"
+
+    # The accepted owner forms are shape checks: a gate cannot resolve a URL or
+    # confirm an archive path is the right one. A repo-relative path is the one
+    # form it can actually check, so refusing it drew the line in the least
+    # defensible place.
+    with tempfile.TemporaryDirectory(prefix="keel-owner-vocab-") as raw_tmp:
+        repo = Path(raw_tmp) / "repo"
+        repo.mkdir()
+        tasks_path = repo / "openspec/changes/demo/tasks.md"
+        write_text(repo / "openspec/FOLLOWUP.md", "# Follow-ups\n")
+        write_text(repo / "keel/HANDOFF.md", "pointer\n")
+        write_text(repo / "keel/archive/notes/2026-07-28-example.md", "note\n")
+
+        def invalidation_start(closure: str) -> dict:
+            write_text(
+                tasks_path,
+                task_contract_fixture().replace(
+                    "## Invalidates\n\n- None.\n\n",
+                    '## Invalidates\n\n- I1: "the wording that is now wrong" '
+                    f"— somewhere in the repo. {closure}\n\n",
+                ),
+            )
+            result = run_keel(
+                repo, "gate", "task-start", "--change", "demo", "--task", "1.1", "--json"
+            )
+            return json.loads(result.stdout)
+
+        def completion(findings: str) -> dict:
+            fixture = (
+                task_contract_fixture(evidence=("M1: check exercised.",))
+                .replace("- [ ] 1.1", "- [x] 1.1")
+                .replace("      - Status: pending\n", "      - Status: pass\n")
+                .replace(
+                    "      - Acceptance check: pending\n",
+                    "      - Acceptance check: behavior proven through the public CLI.\n",
+                )
+                .replace(
+                    "      - Scope check: pending\n",
+                    "      - Scope check: writes stayed inside Touch.\n",
+                )
+                .replace(
+                    "      - Findings: pending\n", f"      - Findings: {findings}\n"
+                )
+            )
+            write_text(tasks_path, fixture)
+            result = run_keel(
+                repo, "gate", "task-complete", "--change", "demo", "--task", "1.1", "--json"
+            )
+            return json.loads(result.stdout)
+
+        def close(closure: str) -> dict:
+            write_text(
+                tasks_path,
+                task_contract_fixture(evidence=("M1: check exercised.",))
+                .replace("- [ ] 1.1", "- [x] 1.1")
+                .replace("      - Status: pending\n", "      - Status: pass\n")
+                .replace(
+                    "      - Acceptance check: pending\n",
+                    "      - Acceptance check: proven.\n",
+                )
+                .replace("      - Scope check: pending\n", "      - Scope check: inside Touch.\n")
+                .replace("      - Findings: pending\n", "      - Findings: none\n")
+                + f"\n## Expectation Coverage\n\n- E1: the expectation. {closure}\n",
+            )
+            write_text(repo / "openspec/changes/demo/proposal.md", "# Proposal\n")
+            write_text(repo / "openspec/changes/demo/design.md", "## Context\n\nfixture\n")
+            write_text(
+                repo / "openspec/changes/demo/specs/demo/spec.md",
+                "## ADDED Requirements\n",
+            )
+            result = run_keel(
+                repo, "gate", "change-close", "--change", "demo", "--action", "sync", "--json"
+            )
+            return json.loads(result.stdout)
+
+        # M1 — an existing repo path closes an entry in all three shared places.
+        ledger = "Durable owner: openspec/FOLLOWUP.md"
+        payload = invalidation_start(ledger)
+        if payload.get("status") != "pass":
+            report(f"{label} refused a repo ledger as an invalidation owner.")
+            report(json.dumps(payload.get("problems", []), indent=2))
+            return 1
+
+        payload = completion(f"the IDE shell contract gap. {ledger}")
+        if payload.get("status") != "pass":
+            report(f"{label} refused a repo ledger as a Findings owner.")
+            report(json.dumps(payload.get("problems", []), indent=2))
+            return 1
+
+        payload = close(ledger)
+        if any(
+            item.get("code") == "expectation-closure"
+            for item in payload.get("problems", [])
+        ):
+            report(f"{label} refused a repo ledger as an Expectation Coverage owner.")
+            report(json.dumps(payload.get("problems", []), indent=2))
+            return 1
+
+        # And a path with no file behind it is refused, distinguishably.
+        payload = invalidation_start("Durable owner: openspec/NOT-THERE.md")
+        codes = {item.get("code") for item in payload.get("problems", [])}
+        messages = " ".join(
+            item.get("message", "") for item in payload.get("problems", [])
+        )
+        if (
+            payload.get("status") != "fail"
+            or "invalidation-owner-missing" not in codes
+            or "openspec/NOT-THERE.md" not in messages
+        ):
+            report(f"{label} accepted a durable owner with no file behind it.")
+            report(json.dumps(payload.get("problems", []), indent=2))
+            return 1
+
+        # M2 — the pointer override is still not an owner, although it exists.
+        payload = invalidation_start("Durable owner: keel/HANDOFF.md")
+        messages = " ".join(
+            item.get("message", "") for item in payload.get("problems", [])
+        )
+        if payload.get("status") != "fail" or "HANDOFF" not in messages:
+            report(f"{label} accepted keel/HANDOFF.md as a durable owner.")
+            report(json.dumps(payload.get("problems", []), indent=2))
+            return 1
+
+        # A refusal names the forms it accepts, including the new one.
+        payload = invalidation_start("no closure at all")
+        messages = " ".join(
+            item.get("message", "") for item in payload.get("problems", [])
+        )
+        for expected in ("Durable owner:", "repo-relative path that exists", "Discard reason:"):
+            if expected not in messages:
+                report(f"{label} refusal does not name the accepted form: {expected}")
+                report(messages)
+                return 1
+
+        # M3 — every previously accepted form still closes.
+        for closure in (
+            "Durable owner: openspec/changes/demo/proposal.md",
+            "Durable owner: keel/archive/notes/2026-07-28-example.md",
+            "Durable owner: https://github.com/TanglmChris/keel/issues/20",
+            "Discard reason: it stands as written.",
+        ):
+            write_text(repo / "openspec/changes/demo/proposal.md", "# Proposal\n")
+            payload = invalidation_start(closure)
+            if payload.get("status") != "pass":
+                report(f"{label} dropped a previously accepted form: {closure}")
+                report(json.dumps(payload.get("problems", []), indent=2))
+                return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def regression_tag_fixture(
+    commands: tuple[str, ...],
+    evidence: tuple[str, ...],
+    *,
+    strategy: str = "vertical-tdd",
+) -> str:
+    return (
+        task_contract_fixture(commands=commands, evidence=evidence)
+        .replace(
+            "  - Commands:\n",
+            f"  - Verification Strategy: {strategy}\n  - Commands:\n",
+        )
+        .replace("      - Status: pending\n", "      - Status: pass\n")
+        .replace(
+            "      - Acceptance check: pending\n",
+            "      - Acceptance check: behavior proven through the public CLI.\n",
+        )
+        .replace(
+            "      - Scope check: pending\n",
+            "      - Scope check: writes stayed inside Touch.\n",
+        )
+        .replace("      - Findings: pending\n", "      - Findings: none\n")
+    )
+
+
+def validate_regression_check_tag_scenario() -> int:
+    label = "regression-check-tag"
+
+    # A regression check asserts that something already green is still green, so
+    # it has no honest red. Requiring one leaves an author fabricating evidence
+    # or folding the guard into the behavior check; the tag is the third option.
+    with tempfile.TemporaryDirectory(prefix="keel-regression-tag-") as raw_tmp:
+        repo = Path(raw_tmp) / "repo"
+        repo.mkdir()
+        tasks_path = repo / "openspec/changes/demo/tasks.md"
+
+        def complete(fixture: str) -> dict:
+            write_text(tasks_path, fixture)
+            result = run_keel(
+                repo, "gate", "task-complete", "--change", "demo", "--task", "1.1", "--json"
+            )
+            return json.loads(result.stdout)
+
+        def start(fixture: str) -> dict:
+            write_text(tasks_path, fixture)
+            result = run_keel(
+                repo, "gate", "task-start", "--change", "demo", "--task", "1.1", "--json"
+            )
+            return json.loads(result.stdout)
+
+        mixed_commands = (
+            "M1: behavior reaches the public interface",
+            "M2 (regression): the existing suite stays green",
+        )
+
+        # M1 — a tagged check completes without red/green, and the untagged one
+        # still needs both.
+        payload = complete(
+            regression_tag_fixture(
+                mixed_commands,
+                (
+                    "M1: behavior exercised.",
+                    "M1.red: failed before the implementation.",
+                    "M1.green: passed after.",
+                    "M2: existing suite still green.",
+                ),
+            )
+        )
+        if payload.get("status") != "pass":
+            report(f"{label} refused a tagged regression check that needs no red.")
+            report(json.dumps(payload.get("problems", []), indent=2))
+            return 1
+
+        # D5 — the exemption is from red-green, not from evidence.
+        payload = complete(
+            regression_tag_fixture(
+                mixed_commands,
+                (
+                    "M1: behavior exercised.",
+                    "M1.red: failed before the implementation.",
+                    "M1.green: passed after.",
+                    "M2: pending",
+                ),
+            )
+        )
+        if payload.get("status") != "fail" or not any(
+            "M2" in item.get("message", "")
+            for item in payload.get("problems", [])
+        ):
+            report(f"{label} completed a tagged check with no evidence at all.")
+            report(json.dumps(payload, indent=2))
+            return 1
+
+        # M2 — the strategy cannot be emptied out by tagging every check.
+        payload = start(
+            regression_tag_fixture(
+                (
+                    "M1 (regression): the existing suite stays green",
+                    "M2 (regression): the golden files stay byte-identical",
+                ),
+                ("M1: pending", "M2: pending"),
+            )
+        )
+        codes = {item.get("code") for item in payload.get("problems", [])}
+        if payload.get("status") != "fail" or "regression-only-strategy" not in codes:
+            report(
+                f"{label} accepted a red-green strategy whose every check is tagged."
+            )
+            report(json.dumps(payload, indent=2))
+            return 1
+
+        # M3 — an untagged check emits no tag key, so its capsule and fingerprint
+        # are byte-identical to what they were before the tag existed.
+        payload = start(
+            regression_tag_fixture(
+                ("M1: behavior reaches the public interface",),
+                ("M1: pending",),
+            )
+        )
+        entries = (
+            payload.get("contract", {})
+            .get("capsule", {})
+            .get("verification", {})
+            .get("commands", [])
+        )
+        if payload.get("status") != "pass" or [sorted(entry) for entry in entries] != [
+            ["check", "label"]
+        ]:
+            report(
+                f"{label} changed the compiled shape of an untagged check, which "
+                "moves every recorded contract fingerprint."
+            )
+            report(json.dumps(entries, indent=2))
+            return 1
+
+        # And a tagged check does declare itself in the capsule, so the exemption
+        # is a visible term of the contract rather than a silent skip.
+        payload = start(
+            regression_tag_fixture(mixed_commands, ("M1: pending", "M2: pending"))
+        )
+        tagged = next(
+            (
+                entry
+                for entry in payload.get("contract", {})
+                .get("capsule", {})
+                .get("verification", {})
+                .get("commands", [])
+                if entry.get("label") == "M2"
+            ),
+            None,
+        )
+        if not tagged or tagged.get("regression") is not True:
+            report(f"{label} did not record the regression tag in the capsule.")
+            report(json.dumps(payload.get("contract", {}), indent=2))
+            return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_packaged_schema_derivation_scenario() -> int:
+    label = "packaged-schema-derivation"
+
+    # The helper derives the consumer-repo paths every install/uninstall/clear
+    # assertion iterates. When its root stopped existing it returned an empty
+    # list, so those loops compared nothing and reported success. Anchor it to
+    # what the installer really writes, and make emptiness a failure here.
+    try:
+        packaged_openspec_schema_install_paths(ROOT / "no-such-packaged-root")
+    except FileNotFoundError as error:
+        if "no-such-packaged-root" not in str(error):
+            report(f"{label} missing-root failure does not name the path it expected.")
+            report(str(error))
+            return 1
+    else:
+        report(
+            f"{label} returned a set for a missing packaged root instead of failing; "
+            "an absent root must not silently empty its callers' assertions."
+        )
+        return 1
+
+    derived = packaged_openspec_schema_install_paths()
+    if not derived:
+        report(
+            f"{label} derived no packaged schema paths, so every assertion that "
+            "iterates them verifies nothing."
+        )
+        return 1
+
+    with tempfile.TemporaryDirectory(prefix="keel-packaged-schema-") as raw_tmp:
+        repo = Path(raw_tmp) / "repo"
+        repo.mkdir()
+        install = run_keel(repo, "--install")
+        if install.returncode != 0:
+            report(f"{label} keel --install failed.")
+            report((install.stderr or install.stdout).strip())
+            return 1
+
+        schema_root = repo / OPENSPEC_SCHEMA_ROOT
+        installed = sorted(
+            path.relative_to(repo).as_posix()
+            for path in schema_root.rglob("*")
+            if path.is_file()
+        )
+        if installed != sorted(derived):
+            report(
+                f"{label} derived paths do not match what keel --install wrote."
+            )
+            report(f"derived:   {sorted(derived)}")
+            report(f"installed: {installed}")
+            return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_invalidation_authoring_surface_scenario() -> int:
+    label = "invalidation-authoring-surface"
+
+    # The two schema copies are the repo-local one OpenSpec resolves and the
+    # packaged one `keel --init` writes. This is the only check that asserts they
+    # agree: compact-task-authoring used to imply it through a projection loop
+    # rooted at trees that no longer exist, so it compared nothing and has since
+    # been removed.
+    for local, packaged in SCHEMA_COPY_PAIRS:
+        local_text = (ROOT / local).read_text(encoding="utf-8")
+        packaged_text = (ROOT / packaged).read_text(encoding="utf-8")
+        if local_text != packaged_text:
+            report(f"{label} schema copies diverge: {local} vs {packaged}")
+            return 1
+
+    template = (
+        ROOT / "openspec/schemas/keel-spec-driven/templates/tasks.md"
+    ).read_text(encoding="utf-8")
+    for marker in ("## Invalidates", "- None.", "- I1:"):
+        if marker not in template:
+            report(f"{label} tasks template lacks the invalidation section: {marker}")
+            return 1
+
+    schema = (
+        ROOT / "openspec/schemas/keel-spec-driven/schema.yaml"
+    ).read_text(encoding="utf-8")
+    for marker in ("## Invalidates", "Updated by:", "Discard reason:"):
+        if marker not in schema:
+            report(
+                f"{label} authoring instruction does not describe the "
+                f"invalidation section: {marker}"
+            )
+            return 1
+
+    resident = resident_session_start_section(ROOT / "AGENTS.md")
+    agents = (ROOT / "AGENTS.md").read_text(encoding="utf-8")
+    if resident is None:
+        report(f"{label} resident AGENTS.md has no Session Start section.")
+        return 1
+    for marker in ("## Invalidates", "## Expectation Coverage"):
+        if marker not in agents:
+            report(f"{label} resident protocol does not name {marker}.")
+            return 1
+
+    # An author who scaffolds and fills in the tasks must not additionally have
+    # to discover this section, so the template's own answer has to satisfy the
+    # gate. Placeholders are filled generically; the assertion is narrow on
+    # purpose — no invalidation problem may survive.
+    filled = re.sub(r"<!--[\s\S]*?-->", "", template)
+    filled = filled.replace("<strategy>", "evidence-first")
+    filled = re.sub(r"<[^<>\n]+>", "concrete authored value", filled)
+    with tempfile.TemporaryDirectory(
+        prefix="keel-invalidation-surface-", ignore_cleanup_errors=True
+    ) as raw:
+        repo = Path(raw) / "scaffold"
+        write_text(repo / "openspec/changes/demo/tasks.md", filled)
+        started = run_keel(
+            repo, "gate", "task-start", ".",
+            "--change", "demo", "--task", "1.1", "--json", "--no-guard",
+        )
+        payload = json.loads(started.stdout) if started.stdout.strip() else {}
+        offenders = [
+            item for item in payload.get("problems", [])
+            if str(item.get("code", "")).startswith("invalidation-")
+        ]
+        if offenders:
+            report(
+                f"{label} a filled-in scaffold still fails the invalidation "
+                "gate, so the template's own answer is not usable."
+            )
+            report(repr(offenders))
+            return 1
+
+    report(f"{label} scenario passed.")
+    return 0
+
+
 def validate_task_contract_core_scenario() -> int:
     with tempfile.TemporaryDirectory(prefix="keel-task-contract-") as raw_tmp:
         repo = Path(raw_tmp)
@@ -3720,7 +4517,7 @@ def task_capsule_expanded_fixture() -> str:
 
 def task_capsule_compact_fixture() -> str:
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Exercise task contract\n"
         "  - Covers:\n"
         "    - E1: Public behavior passes.\n"
@@ -4263,7 +5060,7 @@ TRACKER_OWNER = "https://github.com/TanglmChris/keel/issues/12"
 def tracker_owner_tasks(findings: str, closure: str) -> str:
     """One complete, checked task plus one Expectation Coverage closure line."""
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "## Expectation Coverage\n\n"
         "- E1:\n"
         f"  - {closure}\n\n"
@@ -4369,6 +5166,9 @@ def validate_tracker_durable_owner_scenario() -> int:
             report((handoff.stderr or handoff.stdout).strip())
             return 1
 
+        # The archive path must now exist to own anything: a note nobody wrote
+        # owns nothing, and a path is the one owner form a gate can check.
+        write_text(repo / "keel/archive/follow-ups/x.md", "follow-up note\n")
         archived = complete("stale local note; owner keel/archive/follow-ups/x.md")
         if archived.returncode != 0:
             report(
@@ -5167,7 +5967,7 @@ def validate_task_capsule_scenario() -> int:
 
         close_task = (
             completion_task
-            .replace("# Tasks\n\n", "# Tasks\n\n## Expectation Coverage\n\n"
+            .replace("# Tasks\n\n## Invalidates\n\n- None.\n\n", "# Tasks\n\n## Invalidates\n\n- None.\n\n## Expectation Coverage\n\n"
                      "- E1:\n  - Covered by: 1.1\n\n## 1. Work\n\n")
             .replace("- [ ] 1.1", "- [x] 1.1")
         )
@@ -5227,7 +6027,7 @@ def validate_core_gates_scenario() -> int:
         tasks_path = repo / "openspec/changes/demo/tasks.md"
         write_text(
             tasks_path,
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [ ] 1.1 Incomplete task\n"
             "  - Owner: keel-agent\n",
         )
@@ -5262,7 +6062,7 @@ def validate_core_gates_scenario() -> int:
 
         write_text(
             tasks_path,
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [ ] 1.1 Complete executable task\n"
             "  - Owner: keel-agent\n"
             "  - Mode: implementation\n"
@@ -5412,7 +6212,7 @@ def validate_core_gates_scenario() -> int:
             findings: str = "none",
         ) -> str:
             return (
-                "# Tasks\n\n"
+                "# Tasks\n\n## Invalidates\n\n- None.\n\n"
                 "- [ ] 1.1 Complete behavior\n"
                 "  - Owner: keel-agent\n"
                 "  - Mode: implementation\n"
@@ -5531,7 +6331,7 @@ def validate_core_gates_scenario() -> int:
         )
         write_text(
             completion_repo / "openspec/changes/follow-up/tasks.md",
-            "# Tasks\n\n- [ ] 1.1 Own the finding\n",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Own the finding\n",
         )
         owned_finding = run_keel(
             completion_repo,
@@ -5849,7 +6649,7 @@ def validate_core_gates_scenario() -> int:
             if extra_touch:
                 touch += "    - src/extra.js\n"
             return (
-                "# Tasks\n\n"
+                "# Tasks\n\n## Invalidates\n\n- None.\n\n"
                 "- [ ] 1.1 Record behavior\n"
                 "  - Owner: keel-agent\n"
                 "  - Mode: implementation\n"
@@ -6067,7 +6867,7 @@ def validate_core_gates_scenario() -> int:
         def close_task(checked: bool, review_status: str = "pass") -> str:
             mark = "x" if checked else " "
             return (
-                "# Tasks\n\n"
+                "# Tasks\n\n## Invalidates\n\n- None.\n\n"
                 "## Expectation Coverage\n\n"
                 "- E1:\n"
                 "  - Covered by: 1.1\n\n"
@@ -6226,7 +7026,7 @@ def validate_core_gates_scenario() -> int:
 
 def validate_scope_rename_attribution_scenario() -> int:
     rename_task = (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Complete behavior\n"
         "  - Owner: keel-agent\n"
         "  - Mode: implementation\n"
@@ -6429,7 +7229,7 @@ def validate_target_capability_adapters_scenario() -> int:
 
             write_text(
                 repo / "openspec/changes/demo/tasks.md",
-                "# Tasks\n\n- [ ] 1.1 Incomplete\n  - Owner: keel-agent\n",
+                "# Tasks\n\n## Invalidates\n\n- None.\n\n- [ ] 1.1 Incomplete\n  - Owner: keel-agent\n",
             )
             gate = run_keel(
                 repo,
@@ -6855,6 +7655,31 @@ def session_start_context(result: subprocess.CompletedProcess[str]) -> str | Non
     return output.get("additionalContext")
 
 
+# The projection is delivered through additionalContext, which the host injects
+# into the agent and never renders for the human. Every branch must therefore
+# carry the instruction to relay it, including — especially — the degraded ones,
+# because a projection nobody sees is a projection nobody checks.
+SESSION_START_DISCLOSURE = "to the user in your first reply"
+
+# A host loads its plugins once per session, so the projection can be absent for
+# reasons no repository check can see. The resident protocol is the carrier of
+# last resort and must state the same obligation without trading away the
+# continuity rules it already carried.
+RESIDENT_SESSION_START_REQUIRED = (
+    SESSION_START_DISCLOSURE,
+    "keel context",
+    "never infer continuity from native memory",
+)
+
+
+def resident_session_start_section(path: Path) -> str | None:
+    text = path.read_text(encoding="utf-8")
+    match = re.search(
+        r"^## Session Start$(.*?)^## ", text, re.MULTILINE | re.DOTALL
+    )
+    return match.group(1) if match else None
+
+
 def validate_native_plugin_session_start_scenario() -> int:
     real_cli = f'node "{ROOT / "bin/keel.js"}"'
     codex_event = {"hook_event_name": "SessionStart", "source": "startup"}
@@ -6902,6 +7727,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             or "demo#1.1" not in codex_context
             or "task-start" not in codex_context
             or "disposable" not in codex_context
+            or SESSION_START_DISCLOSURE not in codex_context
         ):
             report(
                 "native-plugin-session-start ready projection lacks concise "
@@ -6913,6 +7739,24 @@ def validate_native_plugin_session_start_scenario() -> int:
                 report("native-plugin-session-start projection overstepped.")
                 return 1
 
+        idle_repo = tmp / "idle"
+        (idle_repo / "openspec/changes").mkdir(parents=True)
+        idle_result = run_session_start_hook(
+            idle_repo, codex_event, keel_cli=real_cli
+        )
+        idle_context = session_start_context(idle_result)
+        if (
+            idle_result.returncode != 0
+            or not idle_context
+            or "idle" not in idle_context
+            or SESSION_START_DISCLOSURE not in idle_context
+        ):
+            report(
+                "native-plugin-session-start idle projection did not disclose "
+                "its status to the user: " + repr(idle_context)
+            )
+            return 1
+
         ambiguous_repo = tmp / "ambiguous"
         ambiguous_repo.mkdir()
         for change in ("alpha", "beta"):
@@ -6929,6 +7773,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             or not ambiguous_context
             or "ambiguous" not in ambiguous_context
             or "keel context" not in ambiguous_context
+            or SESSION_START_DISCLOSURE not in ambiguous_context
             or "alpha#1.1" in ambiguous_context
         ):
             report(
@@ -6958,6 +7803,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             or not missing_context
             or "missing or incompatible" not in missing_context
             or "keel context" not in missing_context
+            or SESSION_START_DISCLOSURE not in missing_context
         ):
             report("native-plugin-session-start missing-CLI fallback failed.")
             report(repr(missing_context))
@@ -6980,6 +7826,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             malformed_result.returncode != 0
             or not malformed_context
             or "malformed" not in malformed_context
+            or SESSION_START_DISCLOSURE not in malformed_context
         ):
             report("native-plugin-session-start malformed-output fallback failed.")
             report(repr(malformed_context))
@@ -7005,6 +7852,7 @@ def validate_native_plugin_session_start_scenario() -> int:
             hang_result.returncode != 0
             or not hang_context
             or "failed or timed out" not in hang_context
+            or SESSION_START_DISCLOSURE not in hang_context
         ):
             report("native-plugin-session-start timeout fallback failed.")
             report(repr(hang_context))
@@ -7025,6 +7873,21 @@ def validate_native_plugin_session_start_scenario() -> int:
         )
         return 1
 
+    resident = resident_session_start_section(ROOT / "AGENTS.md")
+    if resident is None:
+        report(
+            "native-plugin-session-start resident AGENTS.md has no Session "
+            "Start section."
+        )
+        return 1
+    for needle in RESIDENT_SESSION_START_REQUIRED:
+        if needle not in resident:
+            report(
+                "native-plugin-session-start resident Session Start section is "
+                f"missing: {needle}"
+            )
+            return 1
+
     report("native-plugin-session-start scenario passed.")
     return 0
 
@@ -7356,13 +8219,7 @@ def validate_expectation_alignment_real_tasks_scenario() -> int:
 
 
 def validate_compact_task_authoring_scenario() -> int:
-    source_root = (
-        ROOT / "src" / "assets" / "shared" / "openspec" / "schemas" / OPENSPEC_SCHEMA_NAME
-    )
     local_root = ROOT / "openspec" / "schemas" / OPENSPEC_SCHEMA_NAME
-    dist_root = (
-        ROOT / "dist" / "shared" / "assets" / "openspec" / "schemas" / OPENSPEC_SCHEMA_NAME
-    )
 
     which = run_openspec(ROOT, "schema", "which", OPENSPEC_SCHEMA_NAME, "--json")
     if which is None or which.returncode != 0:
@@ -7421,21 +8278,9 @@ def validate_compact_task_authoring_scenario() -> int:
             )
             return 1
 
-    for projection_root, label in ((dist_root, "dist"), (local_root, "repo-local")):
-        for source_file in sorted(source_root.rglob("*")):
-            if not source_file.is_file():
-                continue
-            relative = source_file.relative_to(source_root)
-            projected = projection_root / relative
-            if not projected.is_file() or (
-                source_file.read_text(encoding="utf-8")
-                != projected.read_text(encoding="utf-8")
-            ):
-                report(
-                    f"compact-task-authoring {label} projection diverges from "
-                    f"canonical source: {relative.as_posix()}"
-                )
-                return 1
+    # The projection loop that stood here compared against `src/assets` and
+    # `dist`, both retired, so it iterated nothing. `invalidation-authoring-surface`
+    # asserts the two copies that do exist are byte-identical.
 
     with tempfile.TemporaryDirectory(prefix="keel-compact-") as raw_tmp:
         repo = Path(raw_tmp) / "fixture"
@@ -7713,7 +8558,7 @@ def validate_native_runtime_projection_scenario() -> int:
 
     def projection_task(acceptance: str = "observable result") -> str:
         return (
-            "# Tasks\n\n"
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
             "- [ ] 1.1 Project selected behavior\n"
             "  - Owner: keel-agent\n"
             "  - Mode: implementation\n"
@@ -8307,7 +9152,7 @@ NATIVE_GOAL_VERSION = "keel-native-goal/v1"
 
 
 def _goal_tasks_file(blocks: list[str]) -> str:
-    return "# Tasks\n\n" + "\n\n".join(blocks) + "\n"
+    return "# Tasks\n\n## Invalidates\n\n- None.\n\n" + "\n\n".join(blocks) + "\n"
 
 
 def _goal_task_block(
@@ -8926,7 +9771,7 @@ def validate_fast_pre_push_doctor_scenario() -> int:
 
 def validate_verify_layer_tag_scenario() -> int:
     fixture = (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Exercise the verification-layer tag\n"
         "  - Covers:\n"
         "    - E1: Public behavior passes.\n"
@@ -9982,6 +10827,20 @@ def validate_thin_native_install_scenario() -> int:
             )
             return 1
 
+        # The bootstrap is the whole resident protocol a consumer gets, and the
+        # qualifier "for product files" left readers to infer what it excluded.
+        # The inference actually made was that tasks.md belongs in Touch.
+        if not re.search(r"Touch\b[^\n]*\bbound", block, re.IGNORECASE):
+            report("thin-native-install bootstrap does not state what Touch bounds.")
+            return 1
+        if not re.search(r"change'?s own dir|own change dir", block, re.IGNORECASE):
+            report(
+                "thin-native-install bootstrap does not name the record-write "
+                "exemption, so a consumer still infers that tasks.md belongs in "
+                "Touch."
+            )
+            return 1
+
         claude_text = (repo / "CLAUDE.md").read_text(encoding="utf-8")
         if claude_text.count("@AGENTS.md") != 1:
             report(
@@ -10319,7 +11178,7 @@ def validate_native_plugin_install_matrix_scenario() -> int:
 def guard_task_fixture(checked: bool = False) -> str:
     box = "x" if checked else " "
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         f"- [{box}] 1.1 Exercise guarded feature\n"
         "  - Covers:\n"
         "    - E1: Guarded public behavior passes.\n"
@@ -10419,7 +11278,7 @@ RECORD_LAYER_SPEC = (
 def record_layer_tasks(checked: bool = False, touch: str = "src/feature.js") -> str:
     box = "x" if checked else " "
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         f"- [{box}] 1.1 Exercise guarded feature\n"
         "  - Covers:\n"
         "    - demo-cap / Guarded behavior holds / Guarded public behavior passes\n"
@@ -10435,7 +11294,7 @@ def record_layer_tasks(checked: bool = False, touch: str = "src/feature.js") ->
 
 def mode_fixture_tasks(mode: str, touch: str) -> str:
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Establish the version baseline\n"
         f"  - Mode: {mode}\n"
         "  - Covers:\n"
@@ -10577,7 +11436,7 @@ def sibling_scope_tasks(sibling_checked: bool, sibling_touch: str) -> str:
         )
 
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "## 1. Work\n\n"
         + task("1.1", "Own the shared file", sibling_checked, sibling_touch)
         + "\n"
@@ -10701,7 +11560,7 @@ def validate_resident_topic_matching_scenario() -> int:
     """
     label = "resident-topic-matching"
     source = (ROOT / "assets/bootstrap/AGENTS.md").read_text(encoding="utf-8")
-    original = "Touch is the write boundary for product files;"
+    original = "Touch bounds product writes; the change's own dir is exempt."
     if original not in source:
         report(
             f"{label}: the fixture's anchor sentence is not in the bootstrap; "
@@ -11258,7 +12117,7 @@ def validate_touch_write_guard_scenario() -> int:
 
 def compaction_task_fixture() -> str:
     return (
-        "# Tasks\n\n"
+        "# Tasks\n\n## Invalidates\n\n- None.\n\n"
         "- [ ] 1.1 Exercise compaction continuity\n"
         "  - Covers:\n"
         "    - E1: Continuity survives compaction.\n"
@@ -11768,7 +12627,11 @@ def validate_touch_guard_surface_scenario() -> int:
                 report(f"touch-guard-surface: README lacks guard guidance: {needle}.")
                 return 1
         bootstrap = (ROOT / "assets/bootstrap/AGENTS.md").read_text(encoding="utf-8")
-        if "keel guard" not in bootstrap:
+        # The bootstrap must tell a consumer the guard exists and how to opt out;
+        # it no longer spends bytes naming `keel guard clear`, which `keel --help`
+        # and `keel guard status` carry. `--no-guard` is the flag it does name, so
+        # that one stays literal and a rename of it still fails here.
+        if "--no-guard" not in bootstrap or "guards it by default" not in bootstrap:
             report("touch-guard-surface: bootstrap does not mention the guard.")
             return 1
         registered = {name for name, _ in SCENARIOS}
@@ -12146,6 +13009,22 @@ SCENARIOS: tuple = (
     ("repo-action-mode", validate_repo_action_mode_scenario),
     ("runner-skip-accounting", validate_runner_skip_accounting_scenario),
     ("resident-topic-matching", validate_resident_topic_matching_scenario),
+    ("task-start-invalidation", validate_task_start_invalidation_scenario),
+    ("regression-check-tag", validate_regression_check_tag_scenario),
+    ("durable-owner-vocabulary", validate_durable_owner_vocabulary_scenario),
+    ("anchor-reverification-bound", validate_anchor_reverification_bound_scenario),
+    (
+        "authoring-surface-owner-and-tags",
+        validate_authoring_surface_owner_and_tags_scenario,
+    ),
+    (
+        "packaged-schema-derivation",
+        validate_packaged_schema_derivation_scenario,
+    ),
+    (
+        "invalidation-authoring-surface",
+        validate_invalidation_authoring_surface_scenario,
+    ),
     (
         "completed-sibling-attribution",
         validate_completed_sibling_attribution_scenario,