@christang/keel 5.3.7 → 5.3.9

package/assets/bootstrap/AGENTS.md

@@ -1,8 +1,8 @@
-<!-- keel:start version=5.3.7 -->
+<!-- keel:start version=5.3.9 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.
-- Obey the selected task capsule: `keel gate task-start` before implementing, record its fingerprint in Evidence `Contract`, and pass `keel gate task-complete` before checking complete. Touch bounds product writes; the change's own dir is exempt. On Claude a passing `task-start` guards it by default (`--no-guard` opts out).
+- Obey the selected task capsule: `keel gate task-start` before implementing, `--record` its fingerprint to Evidence `Contract`, which `task-complete` requires, before checking complete. Touch bounds product writes; the change's own dir is exempt. On Claude a passing `task-start` guards it by default (`--no-guard` opts out).
 - One current agent owns writes; helpers return read-only report/evidence only. No commit, sync, or archive without explicit authorization.
 - Native plugin projections (SessionStart context) are disposable views, never authority; without the plugin or hook, run the commands manually.
 - Keel skills and hooks come from the `keel` native plugin (`codex plugin add` / `claude plugin install`); `keel --init` owns only the OpenSpec schema, overlays, and this bootstrap.

package/assets/openspec/schemas/keel-spec-driven/schema.yaml

@@ -75,7 +75,10 @@ artifacts:
       Every executable task MUST be a checkbox authored in the compact v4 form
       from the template: Covers, Touch, Verify (Strategy plus ordered M<n>
       public checks), and an Evidence anchor with its Contract line, per-check
-      results, semantic Review, and Blocker state. Omitted fields inherit
+      results, semantic Review, and Blocker state. `task-start --record` writes
+      the compiled fingerprint into that Contract line, and task-complete
+      refuses a task that recorded none: without an anchor there is nothing for
+      completion to compare against, so the task has no drift detection. Omitted fields inherit
       versioned keel-task-capsule/v1 defaults: Owner is the current Keel
       agent, Mode is implementation, Read is the change artifacts plus
       discovered repository context, Acceptance derives from the resolved

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.3.7",
+  "version": "5.3.9",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.3.7",
+  "version": "5.3.9",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.3.7",
+  "version": "5.3.9",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/scripts/pretooluse-guard.js

@@ -5,8 +5,10 @@
 // file edits while an explicit keel/guard.json manifest is active. Absence of
 // the manifest allows everything silently; a present-but-untrusted manifest
 // fails closed. The hook never writes state, never spawns the keel CLI, and
-// always exits 0 — denial is expressed only through hook output. Paths that
-// resolve outside the repository root are not product writes and pass through.
+// always exits 0 — denial is expressed only through hook output. The
+// repository is the guard's scope: a path resolving outside it is not a product
+// write and passes through, decided before the manifest is read so that no
+// manifest state can reach it.
 
 const crypto = require("crypto");
 const fs = require("fs");
@@ -116,12 +118,27 @@ function main() {
   }
   const repo =
     typeof event.cwd === "string" && event.cwd ? event.cwd : process.cwd();
-  const manifestPath = path.join(repo, "keel", "guard.json");
-  if (!fs.existsSync(manifestPath)) return 0;
 
   const pathField = FILE_EDIT_TOOLS.get(event.tool_name);
   if (!pathField) return 0;
 
+  // The repository is the guard's scope, so this boundary is settled before the
+  // manifest is read at all. It needs only the event's cwd and target, so no
+  // manifest state — absent, invalid, drifted, or completed — has anything to
+  // say about a path outside it. Deciding it here rather than further down is
+  // what stops a branch added to the manifest section from denying a file the
+  // guard never protected; that ordering has already failed twice.
+  const target = event.tool_input ? event.tool_input[pathField] : null;
+  if (typeof target !== "string" || !target) return 0;
+  const relative = path.relative(repo, path.resolve(repo, target));
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    return 0;
+  }
+  const candidate = relative.replace(/\\/g, "/");
+
+  const manifestPath = path.join(repo, "keel", "guard.json");
+  if (!fs.existsSync(manifestPath)) return 0;
+
   let manifest = null;
   try {
     manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
@@ -144,14 +161,6 @@ function main() {
   // stop the one thing the completion gate is waiting for. Derived from the
   // manifest's existing `change` field, so no manifest shape changes.
   const recordPrefix = `openspec/changes/${manifest.change}/`;
-
-  const target = event.tool_input ? event.tool_input[pathField] : null;
-  if (typeof target !== "string" || !target) return 0;
-  const relative = path.relative(repo, path.resolve(repo, target));
-  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
-    return 0;
-  }
-  const candidate = relative.replace(/\\/g, "/");
   if (candidate.startsWith(recordPrefix)) return 0;
 
   for (const entry of manifest.authority) {

package/scripts/validate_plugin.py

@@ -37,8 +37,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.3.7"
-PROTOCOL_VERSION = "5.3.7"
+PACKAGE_VERSION = "5.3.9"
+PROTOCOL_VERSION = "5.3.9"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 # Mirrors KEEL_PACKAGE_NAME in scripts/install_to_repo.py, one of the two
@@ -3509,6 +3509,11 @@ def task_contract_fixture(
         "  - Stop Rules:\n"
         "    - Stop on failure.\n"
         "  - Evidence:\n"
+        # Emitted unconditionally rather than through `evidence`, which callers
+        # override to control the M-entries. Completion requires a recorded
+        # fingerprint, and `--record` rewrites this line in place, so a caller
+        # that customizes its evidence must not be able to drop the anchor.
+        "    - Contract: pending\n"
         f"{evidence_lines}"
         "    - Review:\n"
         "      - Status: pending\n"
@@ -3545,7 +3550,7 @@ def invalidation_repo(root: Path, name: str, section: str | None) -> Path:
     # A real Contract anchor, so the missing-section case can prove that a
     # failing authoring gate leaves the anchor untouched rather than merely
     # failing earlier for want of one.
-    body = task_contract_fixture(evidence=("Contract: pending", "M1: pending"))
+    body = task_contract_fixture()
     body = body.replace(INVALIDATES_NONE, "" if section is None else section)
     write_text(repo / "openspec/changes/demo/tasks.md", body)
     return repo
@@ -3781,7 +3786,7 @@ def validate_anchor_reverification_bound_scenario() -> int:
         repo = Path(raw_tmp) / "repo"
         repo.mkdir()
         live = repo / "openspec/changes/demo/tasks.md"
-        write_text(live, task_contract_fixture(evidence=("Contract: pending", "M1: pending")))
+        write_text(live, task_contract_fixture())
 
         recorded = run_keel(
             repo, "gate", "task-start", "--change", "demo", "--task", "1.1",
@@ -3993,6 +3998,7 @@ def validate_durable_owner_vocabulary_scenario() -> int:
                 )
             )
             write_text(tasks_path, fixture)
+            record_contract_anchor(repo, "demo")
             result = run_keel(
                 repo, "gate", "task-complete", "--change", "demo", "--task", "1.1", "--json"
             )
@@ -4138,6 +4144,7 @@ def validate_regression_check_tag_scenario() -> int:
 
         def complete(fixture: str) -> dict:
             write_text(tasks_path, fixture)
+            record_contract_anchor(repo, "demo")
             result = run_keel(
                 repo, "gate", "task-complete", "--change", "demo", "--task", "1.1", "--json"
             )
@@ -4654,12 +4661,39 @@ def task_capsule_compact_fixture() -> str:
         "  - Stop Rules:\n"
         "    - Stop on failure.\n"
         "  - Evidence:\n"
+        # Completion requires a recorded fingerprint here, so the anchor line
+        # must exist for `--record` to rewrite in place. See
+        # record_contract_anchor.
+        "    - Contract: pending\n"
         "    - M1: pending\n"
         "  - Stop if:\n"
         "    - Requires files outside Touch.\n"
     )
 
 
+def record_contract_anchor(repo: Path, change: str, task: str = "1.1") -> bool:
+    """Run `task-start --record` so a fixture can reach completion.
+
+    Completion refuses a task whose `Contract` anchor holds no compiled
+    fingerprint (issue #30), so a scenario that only wanted to exercise
+    task-complete still has to start the task first. That is the real loop, not
+    a workaround: a task that was never started is not a task being completed.
+    """
+    result = run_keel(
+        repo,
+        "gate",
+        "task-start",
+        "--change",
+        change,
+        "--task",
+        task,
+        "--record",
+        "--no-guard",
+        "--json",
+    )
+    return result.returncode == 0
+
+
 def validate_non_concrete_verify_diagnostic_scenario() -> int:
     """A compact v4 task whose Verify carries an unfilled token must be told so.
 
@@ -5098,6 +5132,475 @@ def fill_template_slots(text: str, comments: str = "strip") -> str:
         text = collapsed
 
 
+def validate_guard_scope_is_the_repository_scenario() -> int:
+    """Issue #31: a decision needing no manifest sat downstream of reading one.
+
+    Whether a target lies outside the repository is computable from the event's
+    cwd and target path alone, but the invalid-manifest denial ran first, so a
+    corrupt `keel/guard.json` denied writes to files the guard never protected.
+    The precedence is what is asserted here, not the passthrough: a scenario
+    checking only that an out-of-repo path passes under a valid manifest would
+    have passed before this change too.
+    """
+    hook = ROOT / "plugins/keel/scripts/pretooluse-guard.js"
+    if not hook.is_file():
+        report(f"guard-scope-is-the-repository: missing hook {hook}.")
+        return 1
+
+    with tempfile.TemporaryDirectory(prefix="keel-guard-scope-") as raw:
+        root = Path(raw)
+        repo = root / "repo"
+        outside = root / "scratch"
+        outside.mkdir(parents=True)
+        write_text(repo / "src/feature.js", "// product\n")
+        # A live spec, so the Covers source lands outside the record layer and
+        # authority drift can actually fire. Drifting the change's own tasks.md
+        # produces no drift at all, because the record layer exempts it.
+        live = repo / "openspec/specs/demo-cap/spec.md"
+        write_text(
+            live,
+            "# demo-cap\n\n## Purpose\n\nFixture.\n\n"
+            "### Requirement: The system emits a feed status\n"
+            "The system SHALL emit the recorded feed status.\n\n"
+            "#### Scenario: A status is emitted\n"
+            "- **WHEN** the feed runs\n- **THEN** the status is recorded\n",
+        )
+        write_text(
+            repo / "openspec/changes/demo/tasks.md",
+            "# Tasks\n\n## Invalidates\n\n- None.\n\n"
+            "- [ ] 1.1 Exercise the guard\n"
+            "  - Covers:\n    - demo-cap / The system emits a feed status\n"
+            "  - Touch:\n    - src/feature.js\n"
+            "  - Verify:\n    - Strategy: evidence-first\n    - M1: node test.js\n"
+            "  - Evidence:\n    - Contract: pending\n    - M1: pending\n"
+            "    - Review:\n      - Status: pending\n"
+            "      - Acceptance check: pending\n      - Scope check: pending\n"
+            "      - Findings: pending\n    - Blocker: none\n",
+        )
+        started = run_keel(
+            repo, "gate", "task-start", "--change", "demo", "--task", "1.1",
+            "--record", "--json",
+        )
+        if started.returncode != 0:
+            report("guard-scope-is-the-repository: the fixture did not start.")
+            report((started.stdout or started.stderr).strip())
+            return 1
+        manifest_path = repo / "keel/guard.json"
+        manifest_text = manifest_path.read_text(encoding="utf-8")
+        hashed = [
+            item["path"] for item in json.loads(manifest_text).get("authority", [])
+        ]
+        if "openspec/specs/demo-cap/spec.md" not in hashed:
+            report(
+                "guard-scope-is-the-repository: the fixture hashed no authority "
+                f"outside the change directory, so drift cannot fire: {hashed}."
+            )
+            return 1
+
+        def decide(target: Path) -> str:
+            event = json.dumps({
+                "cwd": str(repo),
+                "tool_name": "Edit",
+                "tool_input": {"file_path": str(target)},
+            })
+            result = subprocess.run(
+                ["node", str(hook)],
+                input=event,
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace",
+                check=False,
+            )
+            out = (result.stdout or "").strip()
+            if not out:
+                return "allow"
+            payload = json.loads(out)["hookSpecificOutput"]
+            return payload.get("permissionDecisionReason", "deny")
+
+        def expect(label: str, target: Path, allow: bool, needle: str = "") -> bool:
+            verdict = decide(target)
+            if allow:
+                if verdict != "allow":
+                    report(f"guard-scope-is-the-repository: {label} was denied.")
+                    report(f"  {verdict}")
+                    return False
+                return True
+            if verdict == "allow":
+                report(f"guard-scope-is-the-repository: {label} was allowed.")
+                return False
+            if needle and needle not in verdict:
+                report(
+                    f"guard-scope-is-the-repository: {label} was denied for the "
+                    f"wrong reason; expected {needle!r}."
+                )
+                report(f"  {verdict}")
+                return False
+            return True
+
+        scratch = outside / "notes.md"
+        # M2 — the in-repository denials must survive the reordering.
+        checks = [
+            expect("an in-Touch write", repo / "src/feature.js", True),
+            expect(
+                "an in-repository path outside Touch",
+                repo / "other.js",
+                False,
+                "outside Touch",
+            ),
+            expect(
+                "the guarded change's own records",
+                repo / "openspec/changes/demo/notes.md",
+                True,
+            ),
+            expect("an out-of-repository write", scratch, True),
+        ]
+
+        # M1, first half — genuine authority drift.
+        write_text(live, live.read_text(encoding="utf-8") + "\nDRIFTED\n")
+        checks.append(
+            expect("an in-Touch write under drift", repo / "src/feature.js", False, "drift")
+        )
+        checks.append(
+            expect("an out-of-repository write under drift", scratch, True)
+        )
+
+        # M1, second half — the corrupt manifest, which is the reported defect.
+        manifest_path.write_text("{ not json", encoding="utf-8")
+        checks.append(
+            expect("an out-of-repository write under a corrupt manifest", scratch, True)
+        )
+        checks.append(
+            expect(
+                "an in-repository write under a corrupt manifest",
+                repo / "src/feature.js",
+                False,
+                "invalid",
+            )
+        )
+        if not all(checks):
+            return 1
+    if "guard-scope-is-the-repository" not in {name for name, _ in SCENARIOS}:
+        report(
+            "guard-scope-is-the-repository: the scenario registry does not "
+            "include it."
+        )
+        return 1
+    report("guard-scope-is-the-repository scenario passed.")
+    return 0
+
+
+def validate_completion_requires_a_recorded_anchor_scenario() -> int:
+    """Issue #30: an unrecorded anchor made the drift guarantee conditional.
+
+    `anchoredFingerprint` returns null for a non-digest value and completion
+    then skipped the comparison entirely, so a task with `Contract: pending`
+    passed with zero problems. It could be implemented against one contract,
+    have its Touch or Verify rewritten mid-flight, and complete clean — purely
+    by never running `task-start --record`. 5.3.7 closed the inference path;
+    this closes the explicitly named one.
+    """
+    header = "# Tasks\n\n## Invalidates\n\n- None.\n\n"
+
+    def task(contract: str) -> str:
+        return (
+            "- [ ] 1.1 Exercise task contract\n"
+            "  - Covers:\n"
+            "    - E1: Public behavior passes.\n"
+            "  - Touch:\n"
+            "    - src/feature.js\n"
+            "  - Verify:\n"
+            "    - Strategy: evidence-first\n"
+            "    - M1: node test.js asserts the recorded feed status\n"
+            "  - Evidence:\n"
+            f"    - Contract: {contract}\n"
+            "    - M1: the suite passed\n"
+            "    - Review:\n"
+            "      - Status: pass\n"
+            "      - Acceptance check: behavior asserted at the interface\n"
+            "      - Scope check: only Touch files changed\n"
+            "      - Findings: none\n"
+            "    - Blocker: none\n"
+        )
+
+    with tempfile.TemporaryDirectory(prefix="keel-anchor-required-") as raw:
+        repo = Path(raw)
+        write_text(repo / "openspec/changes/unrecorded/tasks.md", header + task("pending"))
+
+        def gate(change: str, stage: str) -> dict:
+            return json.loads(
+                run_keel(
+                    repo,
+                    "gate",
+                    stage,
+                    "--change",
+                    change,
+                    "--task",
+                    "1.1",
+                    "--json",
+                ).stdout
+            )
+
+        payload = gate("unrecorded", "task-complete")
+        if payload.get("status") == "pass":
+            report(
+                "completion-requires-a-recorded-anchor: an explicitly named task "
+                "with `Contract: pending` passed task-complete, so the "
+                "fingerprint comparison still compares nothing."
+            )
+            return 1
+        named = [
+            problem.get("message", "")
+            for problem in payload.get("problems", [])
+            if problem.get("code") == "missing-contract-anchor"
+        ]
+        if not named:
+            report(
+                "completion-requires-a-recorded-anchor: the task did not pass, "
+                "but no missing-contract-anchor diagnostic explained why."
+            )
+            for problem in payload.get("problems", []):
+                report(f"  {problem.get('code')}: {problem.get('message')}")
+            return 1
+        for needle in ("Contract", "--record"):
+            if needle not in named[0]:
+                report(
+                    "completion-requires-a-recorded-anchor: the diagnostic did "
+                    f"not name {needle}."
+                )
+                report(named[0])
+                return 1
+        # Doing what the diagnostic asks must clear it. The fingerprint is the
+        # one this task actually compiles to, so the anchor comparison that
+        # follows is a real comparison rather than a shape check.
+        started = gate("unrecorded", "task-start")
+        fingerprint = started.get("contract", {}).get("fingerprint", {}).get("value")
+        if not fingerprint:
+            report(
+                "completion-requires-a-recorded-anchor: task-start returned no "
+                "fingerprint to record."
+            )
+            return 1
+        if any(
+            problem.get("code") == "missing-contract-anchor"
+            for problem in started.get("problems", [])
+        ):
+            report(
+                "completion-requires-a-recorded-anchor: task-start reported the "
+                "missing anchor, but it runs before one can exist."
+            )
+            return 1
+        write_text(
+            repo / "openspec/changes/recorded/tasks.md",
+            header + task(f"keel-task-capsule/v1 sha256:{fingerprint}"),
+        )
+        recorded = gate("recorded", "task-complete")
+        if recorded.get("status") != "pass":
+            report(
+                "completion-requires-a-recorded-anchor: recording the anchor did "
+                "not clear the refusal."
+            )
+            for problem in recorded.get("problems", []):
+                report(f"  {problem.get('code')}: {problem.get('message')}")
+            return 1
+    if "completion-requires-a-recorded-anchor" not in {name for name, _ in SCENARIOS}:
+        report(
+            "completion-requires-a-recorded-anchor: the scenario registry does "
+            "not include it."
+        )
+        return 1
+    report("completion-requires-a-recorded-anchor scenario passed.")
+    return 0
+
+
+def validate_task_body_ends_at_heading_scenario() -> int:
+    """Issue #29: a change-level section was read as the last task's Evidence.
+
+    parseTasks gave a task every line up to the next task or EOF, and a `##`
+    heading did not stop it, so `## Invalidates` and `## Expectation Coverage`
+    landed in whichever field was open last. That made the two checks look
+    contradictory: `invalidation-phrase` requires the searchable wording in
+    double quotes, while the concreteness test rejects an angle-bracket slot
+    outside inline code, so an entry quoting wording that carries one could
+    satisfy neither. They were never in conflict — the parser only made them
+    appear so.
+    """
+    slot = "<" + "n" + ">"
+    header = "# Tasks\n\n"
+
+    def task(number: str, contract: str) -> str:
+        return (
+            f"- [ ] {number} Exercise task contract\n"
+            "  - Covers:\n"
+            "    - E1: Public behavior passes.\n"
+            "  - Touch:\n"
+            "    - src/feature.js\n"
+            "  - Verify:\n"
+            "    - Strategy: evidence-first\n"
+            "    - M1: node test.js asserts the recorded feed status\n"
+            "  - Evidence:\n"
+            f"    - Contract: {contract}\n"
+            "    - M1: the suite passed\n"
+            "    - Review:\n"
+            "      - Status: pass\n"
+            "      - Acceptance check: behavior asserted at the interface\n"
+            "      - Scope check: only Touch files changed\n"
+            "      - Findings: none\n"
+            "    - Blocker: none\n"
+        )
+
+    # The entry quotes stale wording carrying an unfilled slot, which is exactly
+    # what issue #16 asks an invalidation to quote. A stray Contract line sits
+    # in the trailing section to prove the anchor search stops at the heading.
+    sections = (
+        "\n## Invalidates\n\n"
+        f'- I1: "an unresolved Q{slot} without an authorized fallback blocks '
+        'implementation" — the schema prose. Updated by: 1.1\n'
+        "    - Contract: keel-task-capsule/v1 sha256:" + "b" * 64 + "\n"
+        "\n## Expectation Coverage\n\n"
+        f"- E1: Every Q{slot} reference resolves Covered by: 1.1\n"
+    )
+    body = header + task("1.1", "pending") + "\n## 2. Second group\n\n" + task(
+        "2.1", "pending"
+    )
+
+    with tempfile.TemporaryDirectory(prefix="keel-task-extent-") as raw:
+        repo = Path(raw)
+        write_text(repo / "openspec/changes/demo/tasks.md", body + sections)
+        started = run_keel(
+            repo, "gate", "task-start", "--change", "demo", "--task", "2.1", "--json"
+        )
+        payload = json.loads(started.stdout)
+        problems = payload.get("problems", [])
+        if payload.get("status") != "pass":
+            report(
+                "task-body-ends-at-heading: the last task did not pass task-start "
+                "with a trailing section quoting an unfilled slot."
+            )
+            for problem in problems:
+                report(f"  {problem.get('code')}: {problem.get('message')}")
+            return 1
+        # The same run proves the phrase check is satisfied: an entry the phrase
+        # check rejected would have produced invalidation-phrase above.
+        malformed = body + (
+            "\n## Invalidates\n\n"
+            "- I1: the schema prose is stale. Updated by: 1.1\n"
+        )
+        write_text(repo / "openspec/changes/unquoted/tasks.md", malformed)
+        unquoted = json.loads(
+            run_keel(
+                repo,
+                "gate",
+                "task-start",
+                "--change",
+                "unquoted",
+                "--task",
+                "2.1",
+                "--json",
+            ).stdout
+        )
+        if not any(
+            problem.get("code") == "invalidation-phrase"
+            for problem in unquoted.get("problems", [])
+        ):
+            report(
+                "task-body-ends-at-heading: an unquoted invalidation entry was "
+                "accepted, so the phrase check is no longer being satisfied by "
+                "the quoted one."
+            )
+            return 1
+        # A group heading must not be appended to the preceding task's field.
+        first = json.loads(
+            run_keel(
+                repo, "gate", "task-start", "--change", "demo", "--task", "1.1", "--json"
+            ).stdout
+        )
+        evidence = json.dumps(first)
+        if "Second group" in evidence:
+            report(
+                "task-body-ends-at-heading: the group heading leaked into the "
+                "preceding task's fields."
+            )
+            return 1
+        # --record must anchor the last task's own Contract line, not the stray
+        # one planted in the trailing section.
+        recorded = run_keel(
+            repo,
+            "gate",
+            "task-start",
+            "--change",
+            "demo",
+            "--task",
+            "2.1",
+            "--record",
+            "--json",
+        )
+        if recorded.returncode != 0:
+            report("task-body-ends-at-heading: --record failed on the last task.")
+            report((recorded.stdout or recorded.stderr).strip())
+            return 1
+        written = (repo / "openspec/changes/demo/tasks.md").read_text(
+            encoding="utf-8"
+        )
+        after_heading = written.split("## Invalidates", 1)[1]
+        if "b" * 64 not in after_heading:
+            report(
+                "task-body-ends-at-heading: --record overwrote the Contract line "
+                "planted inside the trailing section."
+            )
+            return 1
+        # The extent change must move no fingerprint: an anchor that shifted
+        # would drift every live change in every consumer repo at once. Pinned
+        # rather than merely measured, so a future extent change cannot move one
+        # silently. A deliberate capsule-shape change will fail here too — that
+        # is the point; it should be looked at, not absorbed.
+        pinned = {
+            "1.1": "2f723a8778160a2d51cd91e34255bf19f2c654fa23cdcd7b013915727a541d17",
+            "2.1": "5e0481362b06992d0317c91d34bbd5d6746fb9c1fee47566060f61fbba7cbf05",
+        }
+        plain = (
+            "# Tasks\n\n"
+            + task("1.1", "pending")
+            + "\n## 2. Second group\n\n"
+            + task("2.1", "pending")
+            + '\n## Invalidates\n\n- I1: "the schema prose is stale here" — the '
+            "schema. Updated by: 1.1\n\n## Expectation Coverage\n\n"
+            "- E1: Covered by: 1.1\n"
+        )
+        write_text(repo / "openspec/changes/pinned/tasks.md", plain)
+        for task_id, expected in pinned.items():
+            payload = json.loads(
+                run_keel(
+                    repo,
+                    "gate",
+                    "task-start",
+                    "--change",
+                    "pinned",
+                    "--task",
+                    task_id,
+                    "--json",
+                ).stdout
+            )
+            actual = (
+                payload.get("contract", {}).get("fingerprint", {}).get("value")
+            )
+            if actual != expected:
+                report(
+                    "task-body-ends-at-heading: the compiled fingerprint for "
+                    f"task {task_id} moved. Expected {expected}, got {actual}. "
+                    "An extent or capsule-shape change that moves an anchor "
+                    "drifts every live change in every consumer repo."
+                )
+                return 1
+    if "task-body-ends-at-heading" not in {name for name, _ in SCENARIOS}:
+        report(
+            "task-body-ends-at-heading: the scenario registry does not include it."
+        )
+        return 1
+    report("task-body-ends-at-heading scenario passed.")
+    return 0
+
+
 TASKS_TEMPLATE_RELATIVE = "schemas/keel-spec-driven/templates/tasks.md"
 
 
@@ -5876,6 +6379,7 @@ def tracker_owner_tasks(findings: str, closure: str) -> str:
         "  - Stop Rules:\n"
         "    - Stop on failure.\n"
         "  - Evidence:\n"
+        "    - Contract: pending\n"
         "    - M1: passed\n"
         "    - Review:\n"
         "      - Status: pass\n"
@@ -5910,6 +6414,7 @@ def validate_tracker_durable_owner_scenario() -> int:
 
         def complete(findings: str, closure: str = "Covered by: 1.1"):
             write_text(tasks, tracker_owner_tasks(findings, closure))
+            record_contract_anchor(repo, "demo")
             return run_keel(
                 repo, "gate", "task-complete",
                 "--change", "demo", "--task", "1.1", "--json",
@@ -6331,6 +6836,7 @@ def validate_task_capsule_scenario() -> int:
             repo / "openspec/changes/demo/tasks.md",
             completion_task,
         )
+        record_contract_anchor(repo, "demo")
         completed = run_keel(
             repo,
             "gate",
@@ -7025,6 +7531,10 @@ def validate_core_gates_scenario() -> int:
                 "  - Stop Rules:\n"
                 "    - Stop on final assertion failure.\n"
                 "  - Evidence:\n"
+                # Read at call time, so every variant below carries the anchor
+                # recorded once for this fixture. Evidence is not in the capsule,
+                # so one fingerprint is correct for all of them.
+                f"    - Contract: {completion_anchor}\n"
                 f"    - M1: {evidence}\n"
                 "    - Review:\n"
                 f"      - Status: {review_status}\n"
@@ -7038,6 +7548,19 @@ def validate_core_gates_scenario() -> int:
                 "    - Summary\n"
             )
 
+        completion_anchor = "pending"
+        write_text(completion_tasks, completion_task("pending", "pass"))
+        if not record_contract_anchor(completion_repo, "demo"):
+            report("core-gates scenario could not record the completion anchor.")
+            return 1
+        recorded_line = re.search(
+            r"-\s*Contract:\s*(.+)", completion_tasks.read_text(encoding="utf-8")
+        )
+        if not recorded_line:
+            report("core-gates scenario found no recorded Contract anchor.")
+            return 1
+        completion_anchor = recorded_line.group(1).strip()
+
         write_text(completion_tasks, completion_task("pending", "pass"))
         missing_evidence = run_keel(
             completion_repo,
@@ -7840,6 +8363,7 @@ def validate_scope_rename_attribution_scenario() -> int:
         "  - Stop Rules:\n"
         "    - Stop on final assertion failure.\n"
         "  - Evidence:\n"
+        "    - Contract: pending\n"
         "    - M1: passed\n"
         "    - Review:\n"
         "      - Status: pass\n"
@@ -7883,6 +8407,7 @@ def validate_scope_rename_attribution_scenario() -> int:
             report("scope-rename scenario git mv failed:")
             report((moved.stderr or moved.stdout).strip())
             return 1
+        record_contract_anchor(repo, "demo")
         completed = run_keel(
             repo,
             "gate",
@@ -9244,6 +9769,7 @@ def validate_task_verification_strategies_scenario() -> int:
 
         def run_completion(fixture: str) -> subprocess.CompletedProcess[str]:
             write_text(tasks_path, fixture)
+            record_contract_anchor(repo, "demo")
             return run_keel(
                 repo,
                 "gate",
@@ -9983,6 +10509,7 @@ def _goal_task_block(
             "  - Stop Rules:",
             "    - stop on failure",
             "  - Evidence:",
+            "    - Contract: pending",
         ]
     )
     if filled:
@@ -10686,6 +11213,7 @@ def validate_native_goal_gate_order_scenario() -> int:
 
         # 4. With evidence and a passing Review recorded, task-complete passes.
         write_text(tasks_path, _goal_tasks_file([_goal_task_block(filled=True)]))
+        record_contract_anchor(repo, "sample-change")
         completed = run_keel(
             repo, "gate", "task-complete",
             "--change", "sample-change", "--task", "1.1", "--json",
@@ -11249,6 +11777,7 @@ def validate_single_task_goal_real_tasks_scenario() -> int:
                     [_goal_task_block(strategy=strategy, filled=True, redgreen=redgreen)]
                 ),
             )
+            record_contract_anchor(repo, "sample-change")
             done = run_keel(
                 repo, "gate", "task-complete",
                 "--change", "sample-change", "--task", "1.1", "--json", env=env,
@@ -11544,6 +12073,7 @@ def _single_task_matrix_target(target: str, root: Path) -> int:
             ]
         ),
     )
+    record_contract_anchor(repo, "sample-change")
     done = run_keel(repo, "gate", "task-complete", "--change", "sample-change", "--task", "1.1", "--json", env=env)
     if done.returncode != 0:
         report("native-single-task-matrix %s could not complete with evidence." % target)
@@ -13768,6 +14298,15 @@ SCENARIOS: tuple = (
         "task-complete-selection-requires-a-started-task",
         validate_task_complete_selection_requires_a_started_task_scenario,
     ),
+    ("task-body-ends-at-heading", validate_task_body_ends_at_heading_scenario),
+    (
+        "completion-requires-a-recorded-anchor",
+        validate_completion_requires_a_recorded_anchor_scenario,
+    ),
+    (
+        "guard-scope-is-the-repository",
+        validate_guard_scope_is_the_repository_scenario,
+    ),
     ("spec-template-validates", validate_spec_template_validates_scenario),
     (
         "tasks-template-red-green-example",

package/src/core/gates.js

@@ -110,10 +110,29 @@ function loadSelection(repo, options, requireTask = true) {
 // of the task they just finished. A task that has started records a fingerprint
 // in its Evidence `Contract` anchor, so that anchor is what makes the inference
 // safe — and without one there is nothing for completion to compare against.
+function hasRecordedAnchor(selection, task) {
+  const plan = contractAnchorPlan(selection, task);
+  return Boolean(plan && anchoredFingerprint(plan.previous));
+}
+
+// A task that recorded no anchor has no drift detection at all while presenting
+// as fully gated: completion skipped the comparison rather than reporting that
+// it had nothing to compare. Recording is already the documented step; this is
+// what makes the guarantee unconditional instead of aspirational.
+function missingAnchorProblem(selection, task) {
+  if (hasRecordedAnchor(selection, task)) return null;
+  return problem(
+    "missing-contract-anchor",
+    `${selection.change}#${task.id} records no compiled fingerprint in its `
+      + "Evidence `Contract` anchor, so completion has nothing to compare and "
+      + "the task has no drift detection. Run `keel gate task-start --record` "
+      + "for this task, which rewrites the anchor in place, then complete it."
+  );
+}
+
 function unstartedInferenceProblem(selection) {
   const task = selection.selected[0];
-  const plan = contractAnchorPlan(selection, task);
-  if (plan && anchoredFingerprint(plan.previous)) return null;
+  if (hasRecordedAnchor(selection, task)) return null;
   const checked = [...selection.tasks].filter((item) => item.checked).pop();
   return problem(
     "ambiguous-completion-selection",
@@ -131,11 +150,9 @@ function unstartedInferenceProblem(selection) {
 
 function contractAnchorPlan(selection, task) {
   const lines = selection.content.split("\n");
-  const index = selection.tasks.findIndex((item) => item.id === task.id);
-  const end =
-    index + 1 < selection.tasks.length
-      ? selection.tasks[index + 1].line
-      : lines.length;
+  // The task carries its own extent, so the anchor search cannot reach a
+  // `- Contract:` line sitting in a trailing change-level section.
+  const end = task.endLine !== undefined ? task.endLine : lines.length;
   for (let cursor = task.line; cursor < end; cursor += 1) {
     const match = lines[cursor].match(/^(\s*)-\s*Contract:\s*(.*?)(\r?)$/);
     if (match) {
@@ -585,6 +602,10 @@ function completionChecks(repo, task, contract = null) {
 function taskComplete(repo, options) {
   const selection = loadSelection(repo, options);
   const task = selection.selected[0];
+  // Selection ambiguity short-circuits, because the gate does not know which
+  // task the caller meant and evaluating the wrong one is the defect. A named
+  // task is not ambiguous: its missing anchor is one problem among however many
+  // else it has, so it joins the list rather than hiding the rest.
   if (!options.task) {
     const ambiguous = unstartedInferenceProblem(selection);
     if (ambiguous) {
@@ -603,6 +624,8 @@ function taskComplete(repo, options) {
   const usableContract = contract.diagnostics.length === 0 ? contract : null;
   const checks = completionChecks(repo, task, usableContract);
   checks.problems.push(...contract.diagnostics);
+  const missingAnchor = missingAnchorProblem(selection, task);
+  if (missingAnchor) checks.problems.push(missingAnchor);
   const scope = scopeEvidence(
     repo,
     task,

package/src/core/task-contract.js

@@ -68,7 +68,21 @@ function parseTasks(content) {
     });
   }
   for (let index = 0; index < tasks.length; index += 1) {
-    const end = index + 1 < tasks.length ? tasks[index + 1].line : lines.length;
+    // A task body ends at the next task or the next `##` heading, whichever
+    // comes first. Without the heading bound a change-level section such as
+    // `## Invalidates` was appended to whichever field was open last — the
+    // Evidence, in every shipped template — so a token quoted there made the
+    // Evidence non-concrete and the gate blamed a task that was fine.
+    const nextTask =
+      index + 1 < tasks.length ? tasks[index + 1].line : lines.length;
+    let end = nextTask;
+    for (let cursor = tasks[index].line + 1; cursor < nextTask; cursor += 1) {
+      if (/^\s*##\s/.test(lines[cursor])) {
+        end = cursor;
+        break;
+      }
+    }
+    tasks[index].endLine = end;
     const bodyLines = lines.slice(tasks[index].line, end);
     tasks[index].body = bodyLines.join("\n");
     tasks[index].fields = new Map();