@cleocode/core 2026.10.27 → 2026.11.1-canary.10

package/templates/CLEO-INJECTION.md

@@ -1,6 +1,6 @@
 # CLEO Protocol
 
-Version: 2.24.24 | CLI-only dispatch | `cleo <command> [args]`
+Version: 2.25.9 | CLI-only dispatch | `cleo <command> [args]`
 
 <!-- CLEO-INJECTION:section=session-start -->
 ## Universal protocol
@@ -40,7 +40,7 @@ Everything else is one command away — print a section with `cleo briefing inje
 1. `cleo current` or `cleo next` → pick task
 2. `cleo focus {id}` → orient: identity + blockers + ready wave + docs + brain context
 3. Check authority, coverage, and source evidence; do the work
-4. Record verification evidence, then `cleo complete {id}` → mark done
+4. Close it. PR work: work on a branch, open a PR whose body has `Closes: T#### AC1,AC2` (`Refs:` for partial delivery), get a non-author per-AC verdict (`cleo review verdict`), merge on green `CI`; the merge sweep closes the task (ADR-099). No-PR work: `cleo done {id} --plan`, record what it names, then `cleo complete {id}`
 5. `cleo next` → continue or end session
 
 Discovery: `cleo find "query"` to search (default page 20; `--limit 0` for all), `cleo list --parent <id>` for direct children only — never bare `cleo list` for browsing. Create: `cleo add --type task --parent <epicId> --title "..." --acceptance "..."` (`--acceptance` is required on every task). Before editing a symbol: `cleo nexus impact <symbol>`; an empty footprint alone never establishes `NONE`.
@@ -55,8 +55,9 @@ Discovery: `cleo find "query"` to search (default page 20; `--limit 0` for all),
 | Task acceptance criterion contains "test" | Propose an `AcceptanceGate` with `kind:"test"` via `cleo req add` |
 | Session token budget ≈ 80% consumed | Run `cleo session end --note "..."` and hand off |
 | Multiple related tasks ready in parallel | Run `cleo orchestrate ready <epicId>` for the wave set |
-| About to call `cleo complete` | `cleo done <id> --plan`, record what it names, then complete |
-| Writing a canonical doc (spec/adr/research/handoff/note/llm-readme) | Use `cleo docs add --type <kind> --slug <kebab-handle>` — NEVER raw fs write to `.cleo/adrs/`, `.cleo/research/`, `.cleo/agent-outputs/`, or `docs/` |
+| Before merging a PR | `cleo done --from-merge <pr> --dry-run` checks its `Closes:`/`Refs:` lines against the store |
+| No-PR work, about to call `cleo complete` | `cleo done <id> --plan`, record what it names, then complete |
+| Writing a canonical doc (spec/adr/research/handoff/note/llm-readme) | Update the existing doc first (`cleo docs update <slug>`); else `cleo docs add --type <kind> --slug <kebab-handle>` — NEVER raw fs write to `.cleo/adrs/`, `.cleo/research/`, `.cleo/agent-outputs/`, or `docs/` |
 | Reading an ADR/spec/research note/handoff | `cleo docs fetch <slug>` — never grep the filesystem for canonical docs |
 | New device, restore or migration; known repo "Not inside a CLEO project"; unreachable registry path; nexus `ENOENT` | `cleo doctor global-delivery` (hub + skills resolve; `--repair`), `cleo doctor projects` (dry run; `--apply`/`--rollback <id>`), `cleo doctor project-identity`, `cleo doctor --all-projects`, `cleo nexus projects clean --orphans --dry-run` (`--dry-run` mandatory: it deletes moved projects), `cleo doctor credentials`; report. Never delete rows of projects that may have moved |
 <!-- /CLEO-INJECTION:section=triggers -->
@@ -71,7 +72,7 @@ Discovery: `cleo find "query"` to search (default page 20; `--limit 0` for all),
 | Start session | `cleo session start --scope global --name "<what you are doing>"` (both flags are REQUIRED) |
 | End session | `cleo session end --note "..."` |
 
-Sessions are terminal-bound: to the agent harness, pane, tab, CI job or ssh login, and to a known single-agent harness process (Kimi, aider, …) across its `bash -c` calls; in a human's tab it gets its own identity and runs `cleo session start` itself. Other hosts (orchestrators, IDE extension hosts, `opencode serve`, daemons) identify nobody: multi-agent hosts and multi-step scripts set `CLEO_SESSION_ID` (or `CLEO_AGENT_ID` in a long-lived host only) per agent. `E_SESSION_UNBOUND` → bind via `cleo session start`, `cleo session resume <id>` or `CLEO_SESSION_ID=<id>`, or pass `--session <id>`; separate one-shot `ssh host 'cleo …'` calls must export `CLEO_SESSION_ID`. Claude Code adopts a session a human started in its tab; Agent-tool subagents inherit the parent's `CLAUDE_CODE_SESSION_ID`, so they act in the parent's session.
+Sessions are terminal-bound: to the agent harness, pane, tab, CI job or ssh login, and to a known single-agent harness process (Kimi, aider, …) across its `bash -c` calls; in a human's tab it gets its own identity and runs `cleo session start` itself. Other hosts (orchestrators, IDE extension hosts, `opencode serve`, daemons) identify nobody: multi-agent hosts and multi-step scripts set `CLEO_SESSION_ID` (or `CLEO_AGENT_ID` in a long-lived host only) per agent. `E_SESSION_UNBOUND` → bind via `cleo session start`, `cleo session resume <id>` or `CLEO_SESSION_ID=<id>`, or pass `--session <id>`; separate one-shot `ssh host 'cleo …'` calls must export `CLEO_SESSION_ID`. Claude Code adopts a session a human started in its tab; Agent-tool subagents inherit the parent's `CLAUDE_CODE_SESSION_ID`: each sets `CLEO_AGENT_ID=<name>` to get its own session and claims; while two or more named agents are live and the parent key has no session of its own, an unnamed mutation is refused with `E_SESSION_AMBIGUOUS`.
 <!-- /CLEO-INJECTION:section=session-commands -->
 
 <!-- CLEO-INJECTION:section=output-contract -->
@@ -89,7 +90,7 @@ Sessions are terminal-bound: to the agent harness, pane, tab, CI job or ssh logi
 
 **READ/MUTATE nesting differs:** mutations are FLAT; reads nest: `cleo show` uses `/data/task/status`, NEVER `/data/status`. Unresolvable pointers fail with `E_FIELD_NOT_FOUND` and list valid pointers; use those instead of guessing. `cleo verify` returns the full `verification` object at `--field /data/verification`.
 
-Mutations (`add`, `add-batch`, `update`, `complete`, `delete`) return `{count, created[], updated[], deleted[], ids[]}`: use `/data/created/0`, `/data/updated/0`, `/data/deleted/0`, `/data/count` (`ids[]` is deprecated). Deletion is a soft archive: `cleo delete <id> --cascade` includes descendants; `--force` alone orphans children and permits dependents; without either, parents with children are rejected.
+Mutations (`add`, `add-batch`, `update`, `complete`, `delete`, `cancel`, `restore`) return `{count, created[], updated[], deleted[], ids[]}`: use `/data/created/0`, `/data/updated/0`, `/data/deleted/0`, `/data/count` (`ids[]` is deprecated). Deletion is a soft archive: `cleo delete <id> --cascade` includes descendants; `--force` alone orphans children and permits dependents; without either, parents with children are rejected.
 <!-- /CLEO-INJECTION:section=output-contract -->
 
 <!-- CLEO-INJECTION:section=error-handling -->
@@ -103,7 +104,6 @@ Check exit code (`0` = success) and `"success"` in JSON output after every comma
 | 6 | `E_VALIDATION` | Check field lengths |
 | 10 | `E_PARENT_NOT_FOUND` | `cleo exists <id>` |
 | 80 | `E_LIFECYCLE_GATE_FAILED` | Unproven evidence gates (strict): `cleo done <id> --plan`, record what it names, retry. Names a planning-stage parent epic: tell the lead; never change `lifecycle.stageGate` |
-| 83 | `E_IVTR_INCOMPLETE` | Legacy IVTR state on the task (strict); no command clears it now: tell the lead |
 | — | `E_EVIDENCE_MISSING` / `E_EVIDENCE_INSUFFICIENT` | `cleo verify … --evidence <atoms>` with every atom kind the gate needs (e.g. `commit:<sha>` + `files:<list>` for `implemented`) |
 | — | `E_EVIDENCE_TESTS_FAILED` / `E_EVIDENCE_TOOL_FAILED` | Fix the source or failing tests, then re-verify |
 | — | `E_EVIDENCE_TOOL_VACUOUS` | Tool exited 0 but provably checked nothing (e.g. `tsc` without `-b` on a references-only tsconfig); run it in a covering mode |
@@ -121,18 +121,7 @@ Missing output is equally inconclusive; teardown may hang after commit. **Never
 <!-- CLEO-INJECTION:section=pre-complete-gate -->
 ## Pre-Complete Gate Ritual (ADR-051 — evidence required)
 
-Before `cleo complete <id>`, every gate requires programmatic evidence validated against git, files or tools: `cleo verify T### --gate <gate> --evidence "<atoms>"`. Bare `cleo verify --all` rejects with `E_EVIDENCE_MISSING`.
-
-| gate | evidence that satisfies it |
-|------|----------------------------|
-| `implemented` | `commit:<sha>;files:path/a.ts,path/b.ts` — or `pr:<number>` with `files:<changed-paths>`, or `decision:<id>` for decision-only tasks |
-| `testsPassed` | `ci:<pr>` if merged and `evidence.ciSatisfies`; else `tool:test-affected` (needs `testing.affectedCommand`), changed-file `test-run:<json>`, or `tool:test` |
-| `qaPassed` | `ci:<pr>` likewise, else `tool:lint;tool:typecheck` or a `qa-run:<json>` per check |
-| `documented` | `files:docs/spec.md` |
-| `securityPassed` | `tool:security-scan` |
-| `cleanupDone` | `note:removed dead branches` |
-
-Name the acceptance criteria each result proves: `cleo verify T1234 --gate implemented --evidence "commit:abc123;files:src/fix.ts;satisfies:T1234#AC1"`. Record `testsPassed` and `qaPassed` separately with actual verification results and explicit criterion links. Documentation-only PRs cannot implement a code-fix task; changed criteria require fresh evidence, and a child waiver does not waive parent criteria. Then `cleo complete T###` re-validates every hard atom (commit reachable, file sha256, test-run hash); tampering → `E_EVIDENCE_STALE`. Typed gates, `pr:` rules, tool timeouts and the audited owner override: `cleo briefing inject --section evidence`. Typed gates execute only via `cleo verify --run`.
+PR work: the merge sweep records `pr:`, `ci:` and reviewer-bound `satisfies:` when it closes a PR's `Closes:` tasks, so no agent step follows the merge (ADR-099). No-PR work, typed gates no CI job runs, and PRs merged before the sweep: `cleo done <id> --plan`, then record each gate it names with `cleo verify T### --gate <gate> --evidence "<atoms>;satisfies:T####AC1"` (bare `cleo verify --all` rejects with `E_EVIDENCE_MISSING`), then `cleo complete T###`, which re-validates every hard atom (tampering → `E_EVIDENCE_STALE`). Record `testsPassed` and `qaPassed` separately with actual verification results and explicit criterion links. Documentation-only PRs cannot implement a code-fix task; changed criteria require fresh evidence, and a child waiver does not waive parent criteria. Atoms per gate, typed gates (`cleo verify --run`), `pr:` rules and the audited owner override: `cleo briefing inject --section evidence`.
 
 Anti-patterns: completing without running tests · self-attesting without programmatic proof · running tests by hand, then again via `tool:test` · modifying files between `cleo verify` and `cleo complete`.
 <!-- /CLEO-INJECTION:section=pre-complete-gate -->

package/templates/CLEO-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLEO Protocol — on-demand reference
 
-Version: 2.24.24 | Companion to the always-loaded `CLEO-INJECTION.md` core
+Version: 2.25.9 | Companion to the always-loaded `CLEO-INJECTION.md` core
 
 Not injected into agent context. Print one section with `cleo briefing inject --section <name>`; tier-2 spawn prompts embed this whole file. Section names are the `CLEO-INJECTION:section` markers below.
 
@@ -32,7 +32,7 @@ Output detail (ADR-086): `--output count` counts the returned rows, agreeing wit
 | Preview batch before inserting | `cleo add-batch --file tasks.json --parent <epicId> --dry-run` |
 | Batch from stdin | `echo '[...]' \| cleo add-batch --file - --parent <epicId>` |
 
-Acceptance input normalizes identically across add, update, batch and saga creation: string arrays in JSON parameters; for `--acceptance`, a JSON-array string or the documented pipe-delimited form. Array entries preserve literal pipes and quoted unions. Strings are trimmed and blank strings omitted; nonstring entries or malformed explicit JSON arrays reject the whole mutation. An explicit `[]` on update requests a clear; omitted acceptance stays unchanged. Normalized criteria still obey policy and immutability, including `--reason` for locked changes. Invalid stored criteria are diagnostic failures; never split historical records without original-input provenance and a guarded repair receipt.
+Acceptance input normalizes identically across add, update, batch and saga creation: string arrays in JSON parameters; for `--acceptance`, a JSON-array string or the documented pipe-delimited form. Array entries preserve literal pipes and quoted unions. Strings are trimmed and blank strings omitted; nonstring entries or malformed explicit JSON arrays reject the whole mutation. An explicit `[]` on update requests a clear; omitted acceptance stays unchanged. Normalized criteria still obey policy and immutability, including `--reason` for locked changes. A criterion that belongs to another task moves, never waived: `cleo req move <id> AC<n> --to <task>` gives it to the target as its next `AC<n>`, keeping its uid and history (the source records a move, and the lock treats it as moved, not weakened) with an `ac_moved` audit row on both tasks; it is refused for a done target and for a criterion with recorded evidence (T14200). Invalid stored criteria are diagnostic failures; never split historical records without original-input provenance and a guarded repair receipt.
 
 Explicit `critical` priority on add/update requires a dependency or a nonempty `--depends-waiver`; updates check the resulting dependency set. CLI flags, JSON params, and SDK calls share this policy. Explicit severity changes use the project's signing identity: a nonempty `ownerPubkeys` allowlist restricts signers; an absent or empty list keeps the existing opt-in policy. Unreadable or malformed authority is an explicit configuration failure. Committed severity, duplicate-bypass, and dependency-waiver evidence lives in the task transaction audit. Historical filesystem attestations alone do not prove a task committed. Dry-run creates no committed attestation; failed writes leave no committed receipt.
 
@@ -264,7 +264,18 @@ Before dispatch, assert these required sections: `## Task Identity` · `## File
 <!-- CLEO-INJECTION:section=evidence -->
 ## Evidence reference (ADR-051 · ADR-061)
 
-A merged PR and green CI provide provenance. For `implemented`, pair `pr:<number>` with `files:<changed-paths>`; CLEO checks task linkage, complete changed-file coverage, and the actual merge commit's bytes. Documentation and research tasks may use appropriate documentary artifacts. The receipt retains criterion hashes, artifact paths, and result references. A valid child completion leaves any parent with unproven criteria open.
+| gate | evidence that satisfies it |
+|------|----------------------------|
+| `implemented` | `commit:<sha>;files:path/a.ts,path/b.ts` — or `pr:<number>` with `files:<changed-paths>`, or `decision:<id>` for decision-only tasks |
+| `testsPassed` | `tool:test-affected` (needs `testing.affectedCommand`), changed-file `test-run:<json>`, `tool:test`, or `ci:<pr>` for a PR merged before the sweep (needs `evidence.ciSatisfies`) |
+| `qaPassed` | `tool:lint;tool:typecheck`, a `qa-run:<json>` per check, or `ci:<pr>` likewise |
+| `documented` | `files:docs/spec.md` |
+| `securityPassed` | `tool:security-scan` |
+| `cleanupDone` | `note:removed dead branches` |
+
+Name the acceptance criteria each result proves with `satisfies:`, e.g. `cleo verify T1234 --gate testsPassed --evidence "tool:test-affected;satisfies:T1234#AC1"` (no-PR work; a PR's criteria are bound by its `Closes:` line and the reviewer's verdicts).
+
+A merged PR closes the tasks its body names (`Closes: T#### AC1,AC2`; `Refs:` binds ACs without closing) once `CI` is green on its exact head and a non-author reviewer recorded `met` for each AC on that head (`cleo review verdict`). The merge sweep then records `pr:<n>;files:<changed paths>` and `ci:<n>` with those `satisfies:` links; the PR text never waives an AC (ADR-099). Preview with `cleo done --from-merge <pr> --dry-run`. For a hand-recorded `implemented`, pair `pr:<number>` with `files:<changed-paths>`; CLEO checks task linkage, complete changed-file coverage, and the actual merge commit's bytes. Documentation and research tasks may use appropriate documentary artifacts. The receipt retains criterion hashes, artifact paths, and result references. A valid child completion leaves any parent with unproven criteria open.
 
 | Exit | Code | Fix |
 |:----:|------|-----|
@@ -338,21 +349,37 @@ The evidence run is the one run. Start with `cleo done <id> --plan`, which picks
 
 ### `pr:<number>` retroactive atom (T9764)
 
-`pr:` proves merge provenance, not completion. CLEO checks actual `mergeCommit`, task linkage and changed files; incomplete inventories or unavailable merge artifacts remain unverified. Fetch the merge commit before `files:` evidence. Task `files` must intersect its diff; prose mentions cannot establish scope. Explicit research/spike and documentation scope retain documentary evidence. Such a task owes `verification.requiredGatesByKind` for its kind (default: the required gates without `testsPassed`/`qaPassed`, T14001), but any non-document path its work touches restores the full code gates: `files:` paths, a `pr:` atom's changed files (a legacy atom without them counts as code), a `commit:` diff, any branch whose name cites the task (`task/`, `feat/`, `fix/`, …), default-branch commits whose subject cites it (merges, squash merges, direct commits), and merged PRs from such a branch. Work CLEO cannot inspect (no origin default branch, a failed GitHub lookup, an unreadable commit) counts as code, and `cleo complete` and `cleo done --plan` say why. A README, LICENSE or CHANGELOG counts as a document only when bare or with a document extension, and a bare `.txt` never does.
+`pr:` proves merge provenance, not completion. Work that shipped under another task's PR is credited with that PR plus `satisfies:<id>#AC<n>` for the criteria it delivers (T14094): each named criterion must name files the PR changed and must predate its merge; a task another task fully covers is closed with `cleo cancel <id> --reason "covered by T<n>"` and `cleo relates add <id> T<n> duplicates "<reason>"`. CLEO checks actual `mergeCommit`, task linkage and changed files; incomplete inventories or unavailable merge artifacts remain unverified. Fetch the merge commit before `files:` evidence. Task `files` must intersect its diff; prose mentions cannot establish scope. Explicit research/spike and documentation scope retain documentary evidence. Such a task owes `verification.requiredGatesByKind` for its kind (default: the required gates without `testsPassed`/`qaPassed`, T14001), but any non-document path its work touches restores the full code gates: `files:` paths, a `pr:` atom's changed files (a legacy atom without them counts as code), a `commit:` diff, any branch whose name cites the task (`task/`, `feat/`, `fix/`, …), default-branch commits whose subject cites it (merges, squash merges, direct commits), and merged PRs from such a branch. Work CLEO cannot inspect (no origin default branch, a failed GitHub lookup, an unreadable commit) counts as code, and `cleo complete` and `cleo done --plan` say why. A README, LICENSE or CHANGELOG counts as a document only when bare or with a document extension, and a bare `.txt` never does.
 
 A task PR merged into an integration branch is a component: `pr:<component>@<integration>` (and `ci:<component>@<integration>`) takes the merge commit and CI from the integration PR that landed it, and the task linkage and changed files from the component PR — only its files that survive the integration merge, never the whole integration diff (T12671). `cleo done` derives this from either PR number. A file a later change also edited still counts while the component's own hunks apply to the landed version. A component that only deleted files implements with `pr:<component>@<integration>;note:<deleted paths>`, because a deletion has no bytes for `files:`. A PR merged directly into the default branch that only deleted files implements with `pr:<number>;note:<deleted paths>` (T14024). Its note is a comma-separated list of the deleted paths, optionally after a label ending at the first `:` — `note:dropped old schema: db/schema.ts, db/relations.ts`; there is no other prose in it. Every listed path must be one the PR deleted (absent from its merged tree) that is still absent at HEAD; a path it did not delete, or one that exists again at HEAD, is refused by name, and the refusal quotes the paths it parsed. Every `note:` atom in that evidence write is read as such a list, so do not add a second, explanatory note: its words are refused as paths the PR did not delete. Put the explanation in the label instead. The component form's note stays free-form.
 
 Several `pr:` atoms in one write read each `files:` path at the merge of the latest cited PR that changed it (T12848). An earlier PR is proven by a listed file read at its own merge, or by one whose read version still carries that PR's own hunks, the same rule as for components (T14025). When a later cited PR rewrote or reverted every listed hunk, the write is refused naming each file and the PR whose merge it is read at; list a file only that PR changed among those cited, or record it in its own `cleo verify` write.
 
+### Per-criterion receipt (T14199)
+
+A criterion of a code task that an owner decision or a stored document meets is covered with a receipt, never a waiver: `cleo verify <id> --criterion --evidence 'decision:<id>;satisfies:<id>#AC<n>'` (or `files:<document paths>` in place of the decision). It binds that one criterion in the AC-coverage gate and sets no gate: `implemented`, `testsPassed` and `qaPassed` still owe their code evidence. A criterion that names a code path (the T14065 token rule) is refused with `E_CRITERION_NAMES_CODE`, naming the token, as are code files, gate atoms (`commit:`, `pr:`, `tool:` …), several criteria in one receipt, and child-task or typed criteria. Each receipt writes a `criterion.receipt` audit-log entry.
+
 ### `ci:<number>` merge-commit CI atom (D11149 · T12742)
 
-With `evidence.ciSatisfies: true`, `ci:<number>` attests `testsPassed`/`qaPassed` from the required checks (`evidence.ciChecks`) green on the merged PR's merge commit, or on a final PR head whose tree equals it. When a concurrency group CANCELLED (or skipped) the merge commit's own push run, a later default-branch commit's green `push` run may stand in (T12742). That run proves the DESCENDANT's tree, not the merge tree, so it counts only when all of these hold: no merge-commit run or job failed; the PR's final head has a green latest `pull_request` run for every stood-in check; the commit descends from the merge commit and is one of the first 10 first-parent commits within 7 days; NO commit between them, merge commits included, touched the PR's changed files, a pinned workflow file or `.github/actions`; and it is the first candidate with a decisive verdict. A red first decisive candidate refuses, and a pending one refuses with "wait for <sha>"; only cancelled, skipped or never-started runs move on. The atom records `descendantSha`, `descendantRange` and `descendantPrHeadSha`, and `cleo complete` re-fetches both runs' latest attempts, because a re-run can turn a completed check red. A WORKSPACE-WIDE change (one a targeted `test-run:` cannot speak for: the lockfile, a root config, a path outside every package) has one more route (owner decision D11192, T14032): when the merge commit is not green and no descendant above stands in, a green `push` run of every required check (and the gates' jobs) on the default branch's CURRENT HEAD stands in, whatever the merge commit's run concluded (a secrets job red on a re-run) and even when later commits touched the PR's files, because it tests the merged change as it is now, like the `test-run:` stand-in (T13673). The run must descend from the merge commit and be on HEAD itself, or on a first-parent commit that differs from HEAD only in documentation (nothing a test reads moved, T13784); a red or pending decisive run refuses, and a scoped change never takes this route. The atom records `workspaceWide` and `descendantSha`, and `cleo complete` re-fetches that push run. A PR that edits a pinned workflow file is attested by default-branch `push` runs only (T13174): its own `pull_request` runs executed the edited workflow and are never consulted, so the PR-head conditions drop and the atom records `mainOnly`. Until main's push run on the merge commit (or a stand-in under the rule above) finishes, `ci:<pr>` refuses with a wait message; a whole-suite local run is never the fallback. Such an edit is attested by the workflow it introduces, so review the workflow edit itself: a hollowed job (a step that runs nothing) would attest itself green, and the job globs only catch a removed or renamed job. A required job skipped by its change filter counts only through `evidence.ciChecks.covering` (T13175): rules such as `{ "paths": ["scripts/**"], "jobs": ["Scripts Tests"] }` declare which jobs cover which paths, and the skip is accepted when every changed path matches a rule whose jobs ran and succeeded. A cancelled, failed, pending or missing required job never counts as a skip. A merge-commit failure whose base passed refuses; the refusal blames the PR only for a first-attempt run that started before any later default-branch commit landed, and says a re-run or late run may have failed on something that changed after the merge, such as secrets (T14026).
+With `evidence.ciSatisfies: true`, `ci:<number>` attests `testsPassed`/`qaPassed` from the required checks (`evidence.ciChecks`) green on the merged PR's merge commit, or on a final PR head whose tree equals it. When a concurrency group CANCELLED (or skipped) the merge commit's own push run, a later default-branch commit's green `push` run may stand in (T12742). That run proves the DESCENDANT's tree, not the merge tree, so it counts only when all of these hold: no merge-commit run or job failed; the PR's final head has a green latest `pull_request` run for every stood-in check; the commit descends from the merge commit and is one of the first 10 first-parent commits within 7 days; NO commit between them, merge commits included, touched the PR's changed files, a pinned workflow file or `.github/actions`; and it is the first candidate with a decisive verdict. A red first decisive candidate refuses, and a pending one refuses with "wait for <sha>"; only cancelled, skipped or never-started runs move on. The atom records `descendantSha`, `descendantRange` and `descendantPrHeadSha`, and `cleo complete` re-fetches both runs' latest attempts, because a re-run can turn a completed check red. A WORKSPACE-WIDE change (one a targeted `test-run:` cannot speak for: the lockfile, a root config, a path outside every package) has one more route (owner decision D11192, T14032): when the merge commit is not green and no descendant above stands in, a green `push` run of every required check (and the gates' jobs) on the default branch's CURRENT HEAD stands in, whatever the merge commit's run concluded (a secrets job red on a re-run) and even when later commits touched the PR's files, because it tests the merged change as it is now, like the `test-run:` stand-in (T13673). The run must descend from the merge commit and be on HEAD itself, or on a first-parent commit that differs from HEAD only in documentation (nothing a test reads moved, T13784); a red or pending decisive run refuses. The atom records `workspaceWide` and `descendantSha`, and `cleo complete` re-fetches that push run. A SCOPED change takes the same current-HEAD route (owner decision D11241, T14434) under three conditions: the merge commit's red or cancelled run is not the PR's (cancelled or skipped, inherited from main, red only on the flaky-quarantine budget, or failed with no test run), the PR's final head had a green `pull_request` run of every required check, and every hunk the PR added is still present at the stand-in commit and at HEAD. It runs today's CI definition, so a later change to `ci.yml` no longer blocks it. A failure that is the PR's, a red PR head or a rewritten hunk still refuses, and the refusal names what closes the task instead: a `test-run:` (or `tool:test-affected`) and a `qa-run:` (or `tool:lint;tool:typecheck`) recorded on the default branch after the merge. The atom records `currentHead` and `descendantPrHeadSha`, and `cleo complete` re-fetches both runs. While only the green HEAD run is missing, the merge sweep keeps the task waiting and re-checks it each sweep; `cleo done --from-merge <pr>` re-checks at once. A PR that edits a pinned workflow file is attested by default-branch `push` runs only (T13174): its own `pull_request` runs executed the edited workflow and are never consulted, so the PR-head conditions drop and the atom records `mainOnly`. Until main's push run on the merge commit (or a stand-in under the rule above) finishes, `ci:<pr>` refuses with a wait message; a whole-suite local run is never the fallback. Such an edit is attested by the workflow it introduces, so review the workflow edit itself: a hollowed job (a step that runs nothing) would attest itself green, and the job globs only catch a removed or renamed job. A required job skipped by CI's own change filter counts as CI's verdict that the change touches nothing it tests (T14260), but only when the diff is entirely outside the package code roots (`packages/`, `crates/`, where CI's `code` filter runs the unit shards for every file, templates included) and the required checks are green; the atom records `filterSkippedJobs`. A cancelled, failed, pending or missing required job never counts as a skip. A merge-commit failure whose base passed refuses; the refusal blames the PR only for a first-attempt run that started before any later default-branch commit landed, and says a re-run or late run may have failed on something that changed after the merge, such as secrets (T14026).
 
 Required checks: explicit configuration or target repository protection. `release.prRequiredWorkflows: []` requires no checks; it proves neither testing nor review. `.cleo/cache/evidence/pr-<num>.json` retains provenance and changed files; obsolete versions reject. Use `tool:test-affected` when `testing.affectedCommand` is configured (a full `tool:test` then only for root-config changes, which affected planning refuses), otherwise a targeted `test-run:<json>` or `tool:test`, plus appropriate QA tools, linking each result to verified criteria.
 
+**Merged work with no required CI (T14163).** `pr:<n>` proves provenance only: it never satisfies `testsPassed` or `qaPassed`, with or without required workflows; tests need a run. A change whose only paths outside every workspace package are the root `package.json` (dependency fields only) and `pnpm-lock.yaml` is otherwise workspace-wide, so with no `ci:` route only the whole suite would speak for it. After the merge it is scoped instead: a targeted `test-run:` recorded on the default branch after the merge (the T13673 stand-in) covers it when it passes a test file in every package whose lockfile importer the merge changed, the root importer counting as every package, plus their dependents and the change's own packages. The stand-in names the importers (`manifestScoped`). Anything the lockfile diff cannot attribute to a changed importer (settings, overrides, catalogs, a package no changed importer reaches), any other root `package.json` field such as `scripts`, and other lockfiles keep the change workspace-wide.
+
+### `deploy:` probed-deployment atom (T14083)
+
+`deploy:<provider>/<deploymentId>@<sha>|<probe-url>` proves a deployment of `<sha>` (e.g. `deploy:railway/dpl_9f3c@1a2b3c4d|https://api.example.com/health`). At verify CLEO itself runs one bounded GET of the probe URL (10 s, first 64 KiB of the body): it must return 2xx and name the deployed SHA (full or a 7+ character prefix) in an `X-Commit` or `X-Version` response header or in the body. A probe naming no SHA is refused with that fix, and a bare 2xx never stands in. A probe URL whose path or query names the SHA is refused before it is sent, since an endpoint that echoes its request would name it without proving which build is live; a 5xx, a timeout, an unreachable host or a probe naming another commit is refused too. The atom records the status, probe time and a sha256 of the body read, and the deployed SHA resolved in git. That SHA must contain the task's implemented commits (an ancestor or a patch-equivalent copy, the T13003 rule); `cleo complete` re-checks that containment only and never re-probes. For `railway`, CLEO also asks Railway's API, with the user's own token from the environment (`RAILWAY_API_TOKEN`, sent as Bearer, or `RAILWAY_TOKEN`, a project token; read at verify, never stored), that the deployment exists, is the live one, and was built from exactly that commit; any mismatch refuses and names the deployment and both commits (T14091). For other providers, or without a credential, the probe alone stands and the atom records `providerCheck: { verified: false, reason }`.
+
+The atom satisfies only the gates the project lists in `evidence.deploySatisfies` (e.g. `"evidence": { "deploySatisfies": ["documented"] }`). There is no default mapping: unset or empty, `deploy:` is refused and satisfies nothing, and it never stands for `testsPassed` unless that gate is listed.
+
+### `ci-run:` repeated run in CI (T14149)
+
+A criterion that needs a heavy or repeated run (e.g. "50 consecutive runs pass") is proven in CI, never waived or run on the owner's machine. Dispatch `gh workflow run repeat-run.yml -f test=<repo-relative test file> -f runs=50` on the default branch; it runs that file N times and fails on the first failing run. Then record `ci-run:<runId>` in the same write as the gate's other evidence, e.g. `cleo verify T### --gate testsPassed --evidence "ci:<pr>;ci-run:<runId>;satisfies:T####AC2"`. CLEO reads the run from GitHub: it must be `repeat-run.yml`, dispatched on the default branch, with its latest attempt green. Its uploaded report must match its title (same test file, count and commit, every run green). Its commit must contain the task's implemented work. The repeated test must be a file the task changed, or one a linked criterion names. `ci-run:` links criteria; it never satisfies `testsPassed` on its own. `cleo complete` re-reads the run and refuses a newer attempt that is not green.
+
 ### CLEO config and generated clients in targeted test evidence (T13778 · T13783)
 
-A change to CLEO's own config (`.cleo/project-context.json`, `.cleo/config.json`) never makes a change workspace-wide. `tool:config-schema` validates those files against CLEO's schema, and a targeted run covers the rest, composed in one write: `--evidence "test-run:<report>;tool:config-schema"` (or `qa-run:` receipts for `qaPassed`). Neither stands alone. A test-run that left config to config-schema needs it, and a config-schema result on a change with other paths needs another result for them, so a config edit never hides an untested source change. For an already-merged change, name the task's own merge: `commit:<sha>;tool:config-schema` (a commit recorded on its `implemented` gate) or `pr:<n>;tool:config-schema`; any other commit is refused, and after the merge config-schema never carries the change's code files. When a change edits `.cleo/project-context.json`, evidence reads its test, lint and typecheck commands from the default branch's copy, so a change cannot relax its own checks. Untracked files under `.cleo/rcasd/` and `.claude/`, or matched by the default branch's `evidence.scopeExcludes`, are session state and not part of the change; every other untracked file counts.
+A change to CLEO's own config (`.cleo/project-context.json`, `.cleo/config.json`) never makes a change workspace-wide. `tool:config-schema` validates those files against CLEO's schema, and a targeted run covers the rest, composed in one write: `--evidence "test-run:<report>;tool:config-schema"` (or `qa-run:` receipts for `qaPassed`). Neither stands alone. A test-run that left config to config-schema needs it, and a config-schema result on a change with other paths needs another result for them, so a config edit never hides an untested source change. For an already-merged change, name the task's own merge: `commit:<sha>;tool:config-schema` (a commit recorded on its `implemented` gate) or `pr:<n>;tool:config-schema`; any other commit is refused, and after the merge config-schema never carries the change's code files. When a change edits `.cleo/project-context.json`, evidence reads its test, lint and typecheck commands from the default branch's copy, so a change cannot relax its own checks. A change is its commits against the default branch plus uncommitted tracked edits, including staged and `git add -N` files. An untracked file never widens it: `cleo done --plan` names each one under `untrackedSetAside`, the evidence records them, and `cleo complete` refuses that evidence once one is committed. Stage a new file the task created (`git add`, or `git add -N`) before the run so it counts.
 
 Generated clients and seed data (owner decision, T13783): `evidence.typecheckOnlyDependents` lists repo globs, read from the default branch only and never guessed from names (a generated client: `lib/api-zod/**`; seed or data files: `lib/db/src/seed-data/**`, T13786; a catch-all glob such as `**` is ignored with a warning). A changed package whose every changed path matches is typecheck-only (test files edited beside the data are left out of that judgement and must be run), and a package that depends on the change ONLY through typecheck-only packages owes a typecheck instead of a test file: a whole-project `tool:typecheck`, or a qa-run typecheck receipt whose roots hold it, in the same `testsPassed` write. The trust boundary: the typecheck proves the dependent still compiles against the regenerated code, not that its behaviour is unchanged. A dependent whose own source changed, or that also depends on another changed package, still owes tests, and the run must pass every changed package's tests and every edited test file. A typecheck or lint `tool:` result is never a test run: it neither carries `testsPassed` alone nor exempts scoped evidence from post-merge supersession.
 <!-- /CLEO-INJECTION:section=evidence -->

package/templates/cleo-gitignore

@@ -58,10 +58,9 @@
 !adrs/
 !adrs/**
 
-# Step 5: Allow RCASD lifecycle provenance directory
-# Structure: rcasd/{epic#}/research/, consensus/, architecture/, specs/, contributions/
-!rcasd/
-!rcasd/**
+# Step 5 (T14277): .cleo/rcasd/ is NOT allowed. A lifecycle stage is recorded
+# in the store; new files under rcasd/ stay ignored, and the legacy files git
+# already tracks stay tracked (ignore rules never untrack a file).
 
 # Step 6: Allow agent-outputs directory
 !agent-outputs/

package/templates/config.template.json

@@ -92,7 +92,7 @@
     "suppressDuration": 0
   },
 
-  "orchestrator": {
+  "orchestrate": {
     "contextThresholds": {
       "warning": 70,
       "critical": 80

package/templates/git-hooks/legacy-hashes.json

@@ -11,7 +11,8 @@
     "52046b0d489bf6f3ef00e5a4c4b09a4cc1a25531ee70ae07dfad55ff6e2d26dc",
     "5ad02ab6d7f5b515a219af8f7d058b6e1a0d4e3f1d730b9147bce64b7a96a7b4",
     "dfec66f4d0a420dfce49d142995b3554a2af44b25b140f2cb6acc739a3fde89e",
-    "f809a52be3f180c6d6913597460b480f12307f7036f87cdf7a42a0010ade7013"
+    "f809a52be3f180c6d6913597460b480f12307f7036f87cdf7a42a0010ade7013",
+    "9bf703257c82b714bf1e861558a3ab9aed0522f89036a30c249258e12f17e792"
   ],
   "pre-push": [
     "8a48d9672f27ae1ea9ebc40d7181ab737a1889e32b451594ba30ac7c2558c07c",
@@ -20,5 +21,9 @@
     "eb78947e1aba2bd4e4d5aa010093aa5a927fde0acda7f7d704d41cd4851a3cfb",
     "f6e39d6fb79fed8c6e0bca0edb43fb9421e6a0cae52b0fe1163a8839caf50389",
     "faa0799ac981d6f45876794e6701f58bb88e7180c92af31fcfb1e99766dc47ce"
+  ],
+  "post-merge": [
+    "975b8d8fb7328ddcf85599db302dd91c8363e53e183b1bb85a106a4914d8e5db",
+    "cf004b55a63c5ea9f9f5ef5a7f4a177e39241600ebe363ea09223e0a58538290"
   ]
 }

package/templates/git-hooks/post-checkout

@@ -0,0 +1,28 @@
+#!/bin/sh
+# CLEO_MANAGED_HOOK v1
+# Post-checkout: start a detached incremental NEXUS refresh (T12349), so the code
+# graph follows the checkout with no manual step. One refresh runs at a time
+# per project; a burst of events while it runs coalesces into one follow-up.
+# Git ignores this hook's exit status, and nothing here can block git.
+#
+# Installation: Automatically installed via `cleo init` and `cleo upgrade`
+
+# Start the refresh unless it is off: CLEO_NEXUS_AUTO_REINDEX=off, git config
+# cleo.nexusAutoReindex=false (`cleo nexus hooks uninstall`), a linked
+# worktree (the index tracks the main checkout), or no cleo on PATH. Plain git
+# reads only; the refresh is detached, so git never waits for it.
+cleo_nexus_refresh() {
+  [ "${CLEO_NEXUS_AUTO_REINDEX:-}" != "off" ] || return 1
+  [ "$(git config --bool --get cleo.nexusAutoReindex 2>/dev/null)" != "false" ] || return 1
+  [ "$(git rev-parse --path-format=absolute --git-dir 2>/dev/null)" = \
+    "$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)" ] || return 1
+  command -v cleo >/dev/null 2>&1 || return 1
+  (cleo nexus auto-reindex </dev/null >/dev/null 2>&1 &) >/dev/null 2>&1
+}
+
+# $3 is 1 for a branch checkout, 0 for a file checkout (HEAD unchanged).
+[ "${3:-1}" = "0" ] || cleo_nexus_refresh
+
+# A hook that was here before CLEO runs last, with the same arguments and stdin.
+if [ -x "$0.cleo-chained" ]; then exec "$0.cleo-chained" "$@"; fi
+exit 0

package/templates/git-hooks/post-commit

@@ -0,0 +1,27 @@
+#!/bin/sh
+# CLEO_MANAGED_HOOK v1
+# Post-commit: start a detached incremental NEXUS refresh (T12349), so the code
+# graph follows the checkout with no manual step. One refresh runs at a time
+# per project; a burst of events while it runs coalesces into one follow-up.
+# Git ignores this hook's exit status, and nothing here can block git.
+#
+# Installation: Automatically installed via `cleo init` and `cleo upgrade`
+
+# Start the refresh unless it is off: CLEO_NEXUS_AUTO_REINDEX=off, git config
+# cleo.nexusAutoReindex=false (`cleo nexus hooks uninstall`), a linked
+# worktree (the index tracks the main checkout), or no cleo on PATH. Plain git
+# reads only; the refresh is detached, so git never waits for it.
+cleo_nexus_refresh() {
+  [ "${CLEO_NEXUS_AUTO_REINDEX:-}" != "off" ] || return 1
+  [ "$(git config --bool --get cleo.nexusAutoReindex 2>/dev/null)" != "false" ] || return 1
+  [ "$(git rev-parse --path-format=absolute --git-dir 2>/dev/null)" = \
+    "$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)" ] || return 1
+  command -v cleo >/dev/null 2>&1 || return 1
+  (cleo nexus auto-reindex </dev/null >/dev/null 2>&1 &) >/dev/null 2>&1
+}
+
+cleo_nexus_refresh
+
+# A hook that was here before CLEO runs last, with the same arguments and stdin.
+if [ -x "$0.cleo-chained" ]; then exec "$0.cleo-chained" "$@"; fi
+exit 0

package/templates/git-hooks/post-merge

@@ -1,25 +1,45 @@
 #!/bin/sh
 # CLEO_MANAGED_HOOK v1
-# Post-merge: start a background NEXUS reindex after a merge into the base
-# branch (T14010). Off unless `cleo nexus reindex-on-merge --enable` set the
-# cleo.nexusReindexOnMerge git config marker. Both checks below are plain git
-# reads, so a disabled project, or a merge on any other branch, starts no
-# process at all. Never blocks or fails the merge.
+# Post-merge: start a detached incremental NEXUS refresh (T12349), so the code
+# graph follows the checkout with no manual step. One refresh runs at a time
+# per project; a burst of events while it runs coalesces into one follow-up.
+# Git ignores this hook's exit status, and nothing here can block git.
 #
-# Installation: Automatically installed via `cleo init`
+# Installation: Automatically installed via `cleo init` and `cleo upgrade`
 
-[ "$(git config --bool --get cleo.nexusReindexOnMerge 2>/dev/null)" = "true" ] || exit 0
-branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || exit 0
-base=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null)
-base=${base#origin/}
-if [ -z "$base" ]; then
-  if git show-ref --verify --quiet refs/heads/main; then
-    base=main
-  elif git show-ref --verify --quiet refs/heads/master; then
-    base=master
+# Start the refresh unless it is off: CLEO_NEXUS_AUTO_REINDEX=off, git config
+# cleo.nexusAutoReindex=false (`cleo nexus hooks uninstall`), a linked
+# worktree (the index tracks the main checkout), or no cleo on PATH. Plain git
+# reads only; the refresh is detached, so git never waits for it.
+cleo_nexus_refresh() {
+  [ "${CLEO_NEXUS_AUTO_REINDEX:-}" != "off" ] || return 1
+  [ "$(git config --bool --get cleo.nexusAutoReindex 2>/dev/null)" != "false" ] || return 1
+  [ "$(git rev-parse --path-format=absolute --git-dir 2>/dev/null)" = \
+    "$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)" ] || return 1
+  command -v cleo >/dev/null 2>&1 || return 1
+  (cleo nexus auto-reindex </dev/null >/dev/null 2>&1 &) >/dev/null 2>&1
+}
+
+if ! cleo_nexus_refresh; then
+  # Off: the opt-in reindex after a merge into the base branch (T14010) still
+  # runs when `cleo nexus reindex-on-merge --enable` set cleo.nexusReindexOnMerge.
+  if [ "$(git config --bool --get cleo.nexusReindexOnMerge 2>/dev/null)" = "true" ] &&
+    branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null); then
+    base=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null)
+    base=${base#origin/}
+    if [ -z "$base" ]; then
+      if git show-ref --verify --quiet refs/heads/main; then
+        base=main
+      elif git show-ref --verify --quiet refs/heads/master; then
+        base=master
+      fi
+    fi
+    if [ -n "$base" ] && [ "$branch" = "$base" ] && command -v cleo >/dev/null 2>&1; then
+      (cleo nexus reindex-on-merge >/dev/null 2>&1 &) >/dev/null 2>&1
+    fi
   fi
 fi
-[ -n "$base" ] && [ "$branch" = "$base" ] || exit 0
-command -v cleo >/dev/null 2>&1 || exit 0
-(cleo nexus reindex-on-merge >/dev/null 2>&1 &) >/dev/null 2>&1
+
+# A hook that was here before CLEO runs last, with the same arguments and stdin.
+if [ -x "$0.cleo-chained" ]; then exec "$0.cleo-chained" "$@"; fi
 exit 0

package/templates/git-hooks/post-rewrite

@@ -0,0 +1,27 @@
+#!/bin/sh
+# CLEO_MANAGED_HOOK v1
+# Post-rewrite (amend, rebase): start a detached incremental NEXUS refresh (T12349), so the code
+# graph follows the checkout with no manual step. One refresh runs at a time
+# per project; a burst of events while it runs coalesces into one follow-up.
+# Git ignores this hook's exit status, and nothing here can block git.
+#
+# Installation: Automatically installed via `cleo init` and `cleo upgrade`
+
+# Start the refresh unless it is off: CLEO_NEXUS_AUTO_REINDEX=off, git config
+# cleo.nexusAutoReindex=false (`cleo nexus hooks uninstall`), a linked
+# worktree (the index tracks the main checkout), or no cleo on PATH. Plain git
+# reads only; the refresh is detached, so git never waits for it.
+cleo_nexus_refresh() {
+  [ "${CLEO_NEXUS_AUTO_REINDEX:-}" != "off" ] || return 1
+  [ "$(git config --bool --get cleo.nexusAutoReindex 2>/dev/null)" != "false" ] || return 1
+  [ "$(git rev-parse --path-format=absolute --git-dir 2>/dev/null)" = \
+    "$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)" ] || return 1
+  command -v cleo >/dev/null 2>&1 || return 1
+  (cleo nexus auto-reindex </dev/null >/dev/null 2>&1 &) >/dev/null 2>&1
+}
+
+cleo_nexus_refresh
+
+# A hook that was here before CLEO runs last, with the same arguments and stdin.
+if [ -x "$0.cleo-chained" ]; then exec "$0.cleo-chained" "$@"; fi
+exit 0

package/templates/git-hooks/pre-commit

@@ -3,6 +3,7 @@
 # Pre-commit guardrails:
 #   1. Reject SQLite WAL/SHM files (data corruption risk).
 #   2. Block commits when core CLEO files are gitignored (data integrity).
+#   3. Refuse CLEO runtime state staged at ANY path (T14189).
 #
 # Installation: Automatically installed via `cleo init`
 
@@ -44,18 +45,49 @@ if [ -n "$IGNORED_CORE" ]; then
   exit 1
 fi
 
-# ── 3. Block staging of T5158/ADR-013 §9 data-safety files ────────────
-# tasks.db / brain.db / config.json / project-info.json must NEVER be
-# staged — risks data loss on branch switch (SQLite WAL/JSON sync).
-DATA_SAFETY_STAGED=$(git diff --cached --name-only | grep -E '^\.cleo/(tasks\.db|brain\.db|config\.json|project-info\.json)$' || true)
+# ── 3. Block staging of CLEO runtime state at ANY path (T14189) ─────
+# cleo.db / brain.db / tasks.db (and their WAL files), project-info.json
+# carrying a "projectId", and a config.json byte-identical to
+# .cleo/config.json must NEVER be committed: ADR-013 §9 (T5158 data-loss
+# vector), and T14189 (a cleo call inside a git hook once staged .cleo state
+# files into this index as ROOT paths). `cleo doctor` runs the same rule.
+LEAKED=""
+CLEO_CONFIG_BLOB=""
+if [ -f .cleo/config.json ]; then
+  CLEO_CONFIG_BLOB=$(git hash-object .cleo/config.json 2>/dev/null || true)
+fi
+STAGED_RAW=$(git -c core.quotePath=false diff --cached --raw --no-abbrev --no-renames --diff-filter=d)
+TAB=$(printf '\t')
+while IFS= read -r line; do
+  [ -n "$line" ] || continue
+  meta=${line%%"$TAB"*}
+  path=${line#*"$TAB"}
+  blob=$(echo "$meta" | awk '{print $4}')
+  case "${path##*/}" in
+    cleo.db|cleo.db-wal|cleo.db-shm|cleo.db-journal|\
+    brain.db|brain.db-wal|brain.db-shm|brain.db-journal|\
+    tasks.db|tasks.db-wal|tasks.db-shm|tasks.db-journal)
+      LEAKED="$LEAKED $path" ;;
+    project-info.json)
+      if git cat-file -p "$blob" 2>/dev/null | grep -q '"projectId"'; then
+        LEAKED="$LEAKED $path"
+      fi ;;
+    config.json)
+      if [ "$path" = ".cleo/config.json" ] || { [ -n "$CLEO_CONFIG_BLOB" ] && [ "$blob" = "$CLEO_CONFIG_BLOB" ]; }; then
+        LEAKED="$LEAKED $path"
+      fi ;;
+  esac
+done <<EOF_STAGED
+$STAGED_RAW
+EOF_STAGED
 
-if [ -n "$DATA_SAFETY_STAGED" ]; then
-  echo "ERROR: Refusing to commit T5158/ADR-013 §9 data-safety files:"
-  echo "$DATA_SAFETY_STAGED"
+if [ -n "$LEAKED" ]; then
+  echo "ERROR: Refusing to commit CLEO runtime state (ADR-013 §9, T14189):"
+  for f in $LEAKED; do echo "  $f"; done
   echo ""
-  echo "These files are runtime state that must never be tracked in git."
-  echo "Commiting them re-opens the T5158 data-loss vector (SQLite WAL/"
-  echo "JSON sync gets corrupted on branch switch)."
-  echo "To fix: git rm --cached <file>"
+  echo "These are .cleo runtime files (databases, project identity, config)"
+  echo "that must never be tracked; committing them re-opens the T5158"
+  echo "data-loss vector."
+  echo "To fix: git reset -q --$LEAKED"
   exit 1
 fi

package/templates/workflows/README.md

@@ -10,7 +10,7 @@ resolved at scaffold/upgrade time against the local project context,
 Contract boundary: these four templates are portable CLEO consumer tooling.
 The cleocode repository's own `.github/workflows/*.yml` files are dogfood-only
 owner CI unless a shipped CLEO installer renders them into a consumer project.
-See `docs/release/consumer-workflow-hook-contract.md` for the T10476 taxonomy.
+See `docs/spec/consumer-workflow-hook-contract.md` for the T10476 taxonomy.
 
 ## Template files