@christang/keel 5.64.0 → 5.66.0

package/assets/bootstrap/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- keel:start version=5.64.0 -->
+<!-- keel:start version=5.66.0 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.64.0",
+  "version": "5.66.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.64.0",
+  "version": "5.66.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.64.0",
+  "version": "5.66.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/scripts/validate_plugin.py

@@ -38,8 +38,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.64.0"
-PROTOCOL_VERSION = "5.64.0"
+PACKAGE_VERSION = "5.66.0"
+PROTOCOL_VERSION = "5.66.0"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 # Mirrors KEEL_PACKAGE_NAME in scripts/install_to_repo.py, one of the two
@@ -17027,6 +17027,42 @@ STANDING_AUTHORIZATION_ACTIONS = (
 )
 
 
+def run_node_expression(root: Path, expression: str) -> str:
+    """Evaluate a Node expression with `root` as the working directory.
+
+    The declaration set is read from the module that defines it rather than by
+    regexing its source: a regex over the source would be a second copy of the
+    same literal the check exists to remove, one level down (issue #143).
+    """
+    result = subprocess.run(
+        ["node", "-e", expression],
+        cwd=root,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+        capture_output=True,
+        check=False,
+    )
+    return result.stdout
+
+
+def config_header_problem(names: list, flat_header: str) -> str:
+    """The one rule for "the header names every declaration", or "" when it does.
+
+    Returns the diagnostic naming the missing declaration. Deliberately reports
+    no count: a count tells an author that two numbers differ, and the name tells
+    them which line to write.
+    """
+    for name in names:
+        if name not in flat_header:
+            return (
+                f"keel/config.yaml's header does not name the `{name}` "
+                "declaration, so a project reading it would never learn it may "
+                "write one. Add it to the header's list."
+            )
+    return ""
+
+
 def write_authorize_config(repo: Path, body: str) -> None:
     (repo / "keel").mkdir(parents=True, exist_ok=True)
     (repo / "keel" / "config.yaml").write_text(body, encoding="utf-8")
@@ -18117,11 +18153,27 @@ def validate_delegation_resident_text_scenario() -> int:
     # M1 — the config header counts its declarations correctly.
     config = ROOT / "keel/config.yaml"
     cfg = flat(config)
-    if re.sub(r"\s+", " ", "Five independent declarations") in cfg:
-        report("delegation-resident-text: the config header still says five declarations.")
+    # Derived from the module that reads the declarations, not restated here. The
+    # literal this replaces had been hand-bumped twice, and the second bump was
+    # found by a red suite run in a scenario named for something else (#143).
+    declarations = [
+        name
+        for name in run_node_expression(
+            ROOT,
+            "process.stdout.write("
+            "require('./src/core/config.js').CONFIG_DECLARATIONS.join(','))",
+        ).strip().split(",")
+        if name
+    ]
+    if not declarations:
+        report(
+            "delegation-resident-text: src/core/config.js exports no declaration "
+            "list, so the header cannot be checked against what Keel reads."
+        )
         return 1
-    if re.sub(r"\s+", " ", "Six independent declarations") not in cfg:
-        report("delegation-resident-text: the config header does not name six declarations.")
+    header_problem = config_header_problem(declarations, cfg)
+    if header_problem:
+        report(f"delegation-resident-text: {header_problem}")
         return 1
     if "delegation" not in cfg:
         report("delegation-resident-text: the config header does not document delegation.")
@@ -28459,6 +28511,236 @@ def validate_a_claim_names_what_would_falsify_it_scenario() -> int:
     return 0
 
 
+def validate_a_negation_is_not_a_marker_scenario() -> int:
+    """Issue #144: `Not resolved here:` was read as `Resolved here:`.
+
+    The marker scan's `\\b` sits at the space inside the negation, so a finding
+    that said in as many words it was *not* resolved here had the next word read
+    as its resolution evidence — a dismissal read as a repair, then refused for
+    lacking repair evidence. 5.42.0 established that a quoted marker is a
+    quotation; a negated one is the same class and was not covered.
+    """
+    label = "a-negation-is-not-a-marker"
+
+    def findings_task(findings: str) -> str:
+        return "\n".join(
+            [
+                "- [x] 1.1 Findings probe",
+                "  - Owner: claude",
+                "  - Mode: implementation",
+                "  - Covers:",
+                "    - E1: the task proves its own behavior",
+                "  - Read:",
+                "    - README.md",
+                "  - Touch:",
+                "    - src/example.js",
+                "  - Verify:",
+                "    - Strategy: vertical-tdd",
+                "    - M1: node test.js asserts the public behavior",
+                "  - Evidence:",
+                "    - Contract: pending",
+                "    - M1: pass. node test.js reported the behavior.",
+                "    - M1.red: fail. the behavior did not exist.",
+                "    - M1.green: pass.",
+                "    - Review:",
+                "      - Status: pass",
+                "      - Acceptance check: the behavior is proven.",
+                "      - Scope check: only Touch changed.",
+                f"      - Findings: {findings}",
+                "    - Blocker: none",
+                "    - Reauthorizations: none",
+            ]
+        )
+
+    with tempfile.TemporaryDirectory(prefix="keel-negation-") as raw:
+        root = Path(raw)
+
+        def complete(name: str, findings: str) -> dict:
+            repo = root / name
+            write_gate_fixture(repo, tasks=findings_task(findings))
+            run_keel(
+                repo, "gate", "task-start", "--change", "demo", "--task", "1.1",
+                "--record", "--json",
+            )
+            done = run_keel(
+                repo, "gate", "task-complete", "--change", "demo", "--task", "1.1",
+                "--json",
+            )
+            try:
+                return json.loads(done.stdout)
+            except json.JSONDecodeError:
+                return {"status": "unparsed", "problems": [{"message": done.stdout[:400]}]}
+
+        # M1 — the text that produced #144, verbatim in shape.
+        negated = complete(
+            "negated",
+            "one, still open. The count is derivable from the declarations the "
+            "module reads. Not resolved here: it is a different module and would "
+            "be scope expansion. Durable owner: https://example.com/issues/1",
+        )
+        if negated.get("status") != "pass":
+            report(
+                f"{label}: names neither a check nor a path — a finding saying it "
+                "was *not* resolved here, closing with a durable owner, was "
+                f"refused; {problem_codes(negated)!r} {problem_text(negated)!r}."
+            )
+            return 1
+        if "resolution evidence" in problem_text(negated).lower():
+            report(
+                f"{label}: the negated phrase still produced a resolution-evidence "
+                f"diagnostic; {problem_text(negated)!r}."
+            )
+            return 1
+
+        # M2 — the positive control, in all three opening positions. Without it
+        # the narrowing could pass by recognizing no marker anywhere.
+        for name, findings in (
+            ("opens-value", "Resolved here: M9"),
+            ("after-break", "one, and it was fixed.\n        Resolved here: M9"),
+            ("after-stop", "one, and it was fixed. Resolved here: M9"),
+        ):
+            payload = complete(name, findings)
+            if payload.get("status") == "pass":
+                report(
+                    f"{label}: stopped recognizing a real marker ({name}) — a "
+                    "`Resolved here:` naming a check this task does not declare "
+                    "completed cleanly."
+                )
+                return 1
+            if "M9" not in problem_text(payload):
+                report(
+                    f"{label}: stopped recognizing a real marker ({name}) — the "
+                    f"refusal does not name the cited check; {problem_text(payload)!r}."
+                )
+                return 1
+
+        # M3 — a marker that opens no clause is refused, not ignored, and the
+        # refusal names the rule so the author is not told to add what they wrote.
+        swallowed = complete(
+            "swallowed", "one, and the fix was Resolved here: M1 in passing"
+        )
+        if swallowed.get("status") == "pass":
+            report(
+                f"{label}: a finding whose only marker opens no clause completed "
+                "cleanly, so it carried no disposition and nothing said so."
+            )
+            return 1
+        # Asserted on the whole phrase, not the word: `opens` alone matches
+        # inside `openspec`, which the same diagnostic already prints, and the
+        # assertion was vacuous until this was tightened.
+        if "opens its clause" not in problem_text(swallowed).lower():
+            report(
+                f"{label}: does not name the opening requirement — an author "
+                "whose sentence visibly contains a marker is told to add a "
+                f"disposition; {problem_text(swallowed)!r}."
+            )
+            return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
+def validate_a_count_is_derived_from_what_it_counts_scenario() -> int:
+    """Issue #143: the header assertion restated a set as an English numeral.
+
+    It had been hand-bumped twice, and the second bump was discovered by a red
+    suite run in a scenario whose name has nothing to do with what was changed.
+    An assertion about a set belongs to the set: read it from the module that
+    defines it, and name the member that is missing rather than a count.
+    """
+    label = "a-count-is-derived-from-what-it-counts"
+
+    def declared_names(root: Path) -> list[str]:
+        result = run_node_expression(
+            root,
+            "process.stdout.write("
+            "require('./src/core/config.js').CONFIG_DECLARATIONS.join(','))",
+        )
+        return [name for name in result.strip().split(",") if name]
+
+    names = declared_names(ROOT)
+    if not names:
+        report(
+            f"{label}: the assertion is a literal — `src/core/config.js` exports "
+            "no declaration list, so nothing the header is checked against comes "
+            "from the code that reads it."
+        )
+        return 1
+    for expected in (
+        "fast_check",
+        "authorize",
+        "precedents",
+        "triage",
+        "delegation",
+        "full_mode_paths",
+    ):
+        if expected not in names:
+            report(
+                f"{label}: the exported declaration list omits {expected!r}, so "
+                f"the header is not checked for it; got {names!r}."
+            )
+            return 1
+
+    header = (ROOT / "keel/config.yaml").read_text(encoding="utf-8")
+    flat_header = re.sub(r"\s+", " ", header)
+    for name in names:
+        if name not in flat_header:
+            report(
+                f"{label}: keel/config.yaml's header does not name {name!r}, "
+                "which is the declaration a new project would never learn it may "
+                "write."
+            )
+            return 1
+
+    # The derivation is proved by feeding the check a member the header cannot
+    # contain. Without this the whole scenario is satisfied by a list that
+    # happens to agree with a header nobody compared it to.
+    missing = config_header_problem(names + ["invented_declaration"], flat_header)
+    if not missing:
+        report(
+            f"{label}: the assertion is a literal — a declaration absent from "
+            "the header produced no failure, so the check is not reading the "
+            "exported list."
+        )
+        return 1
+    if "invented_declaration" not in missing:
+        report(
+            f"{label}: the failure does not name the missing declaration; got "
+            f"{missing!r}."
+        )
+        return 1
+    if re.search(r"\b(?:four|five|six|seven)\b", missing, re.IGNORECASE):
+        report(
+            f"{label}: still says six declarations — the failure reports a "
+            f"count rather than the missing name; got {missing!r}."
+        )
+        return 1
+
+    # A header naming every declaration while miscounting them in prose passes:
+    # membership is the checkable property, and a count is a lossy restatement.
+    miscounted = flat_header.replace(
+        "Six independent declarations", "Five independent declarations"
+    )
+    if miscounted == flat_header:
+        report(f"{label}: the header's prose count could not be located to vary it.")
+        return 1
+    if config_header_problem(names, miscounted):
+        report(
+            f"{label}: still says six declarations — a header naming all of them "
+            "while miscounting them in prose was refused."
+        )
+        return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
 SCENARIOS: tuple = (
     ("stateless-continuity", validate_stateless_continuity_scenario),
     ("core-gates", validate_core_gates_scenario),
@@ -28817,6 +29099,14 @@ SCENARIOS: tuple = (
         "a-claim-names-what-would-falsify-it",
         validate_a_claim_names_what_would_falsify_it_scenario,
     ),
+    (
+        "a-negation-is-not-a-marker",
+        validate_a_negation_is_not_a_marker_scenario,
+    ),
+    (
+        "a-count-is-derived-from-what-it-counts",
+        validate_a_count_is_derived_from_what_it_counts_scenario,
+    ),
 )
 
 

package/src/core/config.js

@@ -68,6 +68,21 @@ function classifyAuthorizationEntry(entry) {
 // and the declaration must still be correct after both.
 const DELEGATION_TIERS = ["routine", "standard", "deep"];
 
+// Every declaration this module reads, in the order the file documents them. One
+// list, so an assertion about the set can be derived from the set instead of
+// restating it: the header check used to pin an English numeral and had been
+// hand-bumped twice, each time discovered by a red suite run in a scenario named
+// for something else (issue #143). Adding a declaration now costs a header line
+// and an entry here, and nothing has to agree about a number.
+const CONFIG_DECLARATIONS = [
+  "fast_check",
+  "authorize",
+  "precedents",
+  "triage",
+  "delegation",
+  "full_mode_paths",
+];
+
 const CONFIG_RELATIVE_PATH = path.join("keel", "config.yaml");
 
 // The declarations share keel/config.yaml with fast_check, so the reader stays
@@ -533,6 +548,7 @@ function triageIssue(repo, labels, issue = null) {
 module.exports = {
   CONFIG_RELATIVE_PATH,
   DELEGATION_TIERS,
+  CONFIG_DECLARATIONS,
   STANDING_AUTHORIZATION_ACTIONS,
   SCOPED_AUTHORIZATION_ACTIONS,
   readFullModePaths,

package/src/core/gates.js

@@ -672,7 +672,24 @@ function transientOwnerMessage(candidate) {
 // swallow and changes nothing about why this one is narrow. The match is
 // global because each resolved claim owes its own evidence; checking only the
 // first would let a second one assert itself for free.
-const RESOLVED_HERE = /\bresolved here\s*:[ \t]*(\S*)/gi;
+// A marker is a disposition only where it OPENS its clause: the start of the
+// value, a line break, or sentence-ending punctuation may precede it, and a word
+// may not. `Not resolved here:` contains the marker and means its opposite, and a
+// `\b` boundary sat happily at the space inside it — the negation was read as a
+// resolution claim and the next word, `it`, as its evidence, so a dismissal was
+// read as a repair and then refused for lacking repair evidence (issue #144).
+// Quoting was the first way a marker could appear without being one (5.42.0);
+// negating it is the second.
+//
+// Written as a lookbehind so the captures keep reading from the same offsets —
+// every rule here is positional, and a rule that shortened the text would move
+// what they read.
+const CLAUSE_OPENING = "(?<=^|[\\n.;:!?\u2014\u2013])[ \\t]*";
+
+const RESOLVED_HERE = new RegExp(
+  `${CLAUSE_OPENING}resolved here\\s*:[ \\t]*(\\S*)`,
+  "gi"
+);
 
 // Resolution evidence is deliberately narrower than a durable owner. An
 // `http`/`https` reference says someone else will do the work later, which is
@@ -714,8 +731,24 @@ function resolutionEvidenceVerdict(repo, value, commands, change) {
 // next token, so a shortened text would move what they read. The original is
 // kept for anything reported back, since a diagnostic quoting the blanked copy
 // would show the author a sentence with holes in it.
-const DISPOSITION_MARKER =
-  /\b(?:resolved here|durable owner|discard (?:reason|rationale))\s*:/gi;
+// The same opening rule, for the same reason. Narrowing only the capture would
+// leave a negated marker counted as a disposition being *present* while it
+// supplied no evidence — a finding accepted as disposed with nothing behind it,
+// which is worse than either half of the defect alone.
+// The marker vocabulary wherever it appears, with no opening rule. Two different
+// questions are asked of this text and they need different patterns. *Blanking* a
+// marker inside a quoted span asks "is this marker text?" — and inside a span the
+// character before it is a backtick, so an opening rule would refuse to blank it
+// and the quotation would survive into the recognition scan. *Recognizing* a
+// disposition asks "does this marker open a clause?", which is the narrower
+// question `DISPOSITION_MARKER` below answers.
+const MARKER_VOCABULARY =
+  /(?:resolved here|durable owner|discard (?:reason|rationale))\s*:/gi;
+
+const DISPOSITION_MARKER = new RegExp(
+  `${CLAUSE_OPENING}(?:resolved here|durable owner|discard (?:reason|rationale))\\s*:`,
+  "gi"
+);
 
 function withoutQuotedMarkers(text) {
   return String(text || "").replace(/`[^`\n]*`/g, (span) =>
@@ -725,7 +758,7 @@ function withoutQuotedMarkers(text) {
     // span would destroy the very path the rule exists to read. Measured: the
     // first draft of this function did exactly that, and both the backticked
     // owner path and the backticked resolution path started failing.
-    span.replace(DISPOSITION_MARKER, (marker) => " ".repeat(marker.length))
+    span.replace(MARKER_VOCABULARY, (marker) => " ".repeat(marker.length))
   );
 }
 
@@ -1269,6 +1302,16 @@ function completionChecks(repo, task, contract = null, changeVerify = null, chan
             + "must still do is `Durable owner:` naming "
             + `${DURABLE_OWNER_FORMS}; one deliberately not being done is a `
             + "`Discard reason:`/`Discard rationale:` prefix."
+            // Said only where a marker is visibly present and was not counted,
+            // which is the one case where "carry a disposition" reads as a
+            // contradiction of what the author can see they wrote.
+            + (mentionsUnopenedMarker(scannable)
+              ? " A marker counts only where it opens its clause — after the "
+                + "start of the value, a line break, or sentence-ending "
+                + "punctuation. This text mentions one mid-sentence, so it was "
+                + "read as prose; move it to the start of its own clause, or "
+                + "keep it as prose and add the disposition separately."
+              : "")
         )
       );
     }
@@ -1276,6 +1319,15 @@ function completionChecks(repo, task, contract = null, changeVerify = null, chan
   return { problems, reviewProblems };
 }
 
+// Whether the text names a disposition marker somewhere that is not a clause
+// opening. Used only to add a sentence to a refusal, never to accept anything:
+// a marker mid-sentence stays prose, and this is what tells its author why.
+function mentionsUnopenedMarker(text) {
+  const body = String(text || "");
+  if (!new RegExp(MARKER_VOCABULARY.source, "i").test(body)) return false;
+  return !new RegExp(DISPOSITION_MARKER.source, "i").test(body);
+}
+
 function taskComplete(repo, options) {
   const selection = loadSelection(repo, options);
   const task = selection.selected[0];