@codedology/code-forge 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -6,6 +6,64 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.10.0] — 2026-10-13
+
+### Added
+
+- `keys.cache_hours` (1–24 h, default 8) and `keys set --op … --cache-hours <n>` set how long a key read from 1Password
+  stays cached; a lower value shortens an existing cached key at the next read, `keys set --op` refuses an invalid value
+  and other readers warn and use 8 h (B84, #14).
+- `keys list` and `doctor` warn when a cached 1Password key has less than 1 hour left, and `jev ask` prints a re-link
+  command (`code-forge keys set jev --op <ref>`, the ref shell-quoted when needed) when the cached key expired and
+  1Password did not answer; the key index keeps the `op://` reference (B85, #14).
+- `src/proof/junit.mjs`: a fail-closed JUnit XML reader and RED/GREEN classifier for `proof red-green` (no DTD or
+  entities, 8 MiB cap, only failed assertions count as RED; a SwiftPM bare failure needs a matching XCTest console
+  line); used by `proof.runners` from B87 (B86, #7).
+- `proof.runners`: `proof red-green` proves a non-`node:test` file through the matching runner's argv and its JUnit
+  report; the list is frozen in the run snapshot, validated by rule 17 `proof-runners-invalid`, and the row carries
+  `runner`, `env_keys` and `failed_tests` (B87, #7).
+- `swift` adapter for `proof.runners`: anchored `{test_filter}` (file base name or `Suite/test` case), reads the XCTest
+  report and its Swift Testing sibling, `swiftc` compile errors give `RED_INVALID compile`; opt-in live check
+  `CODE_FORGE_LIVE_SWIFT=1` verified on Swift 6.3.3 (B88, #7).
+- PHP red→green through the `junit` adapter, verified live on Laravel 13 with PHPUnit 12 and Pest 4
+  (`CODE_FORGE_LIVE_PHP=1`); captured reports replace the hand-written PHP fixtures (B89, #7).
+- The `xcodebuild` adapter for `proof.runners`: `xcode` keys, `{only_testing}` and `{result_bundle}` tokens, a precheck
+  for full Xcode and an available simulator (`xcode-missing`, `destination-unavailable`), a fail-closed `xcresulttool`
+  reader, and `RED_INVALID compile` for a build failure; fixtures captured from Xcode 26.6 (B102, #7).
+- A live `xcodebuild` red→green check on an iOS simulator (`CODE_FORGE_LIVE_XCODE=1`), verified with Xcode 26.6 on an
+  iPhone 17 simulator; it skips with a reason without full Xcode or an available simulator (B103, #7).
+- `review.routes`: size-based review routing. A file with at least `min_lines` lines is reviewed (L2) or judged (L3) by
+  the rule's model, with its own session timeout and second level; one signed `review.route` row per routed level;
+  config rule 18 `review-routes-invalid` (B90, #10).
+- A `## test-quality` section in review packets lists the lines of a test file that read a source file and assert on its
+  text; every reviewer lens gets one rule to judge those lines (a hint, not a finding); recheck packets get the rule but
+  no section (B92, #10).
+- `coder.sandbox` with `profile: workspace|toolchain|full` and `add_dirs`: `toolchain` gives the Codex coder one
+  `--add-dir` per entry, `full` runs it with `-s danger-full-access` and `doctor` warns; entries that are, hold or sit
+  inside a protected dir (home, `~/.ssh`, `~/.codex`, `~/.code-forge`, the run temp root, …) are refused
+  `sandbox-dir-refused` after symlinks are followed; the key is fixed for the run and `forge spawn --role coder --run`
+  refuses a changed live value `sandbox-changed` (B93, #10).
+
+### Changed
+
+- A timed-out review session is a broken result like a schema miss: at a packet's second broken result the second level
+  (`review.second_levels.<level>`, or a routed rule's `second`) is tried once in the same ticket;
+  `review.session_timeout` notes carry `packet_hash` and are signed, and `review.schema_fallback` gains `trigger:
+  schema|timeout` (B91, #10).
+- The skill sends ONE fix message per block: after the coder's first COMPLETE it waits for every `review-file` ticket
+  and the block's tests, then sends every failing test and every open finding together; a later finding waits for the
+  next round, and the per-file round cap still counts per file (B94, #10).
+- `block waive` and `block reopen` are human-only: they ask for a yes at a terminal, have no `--yes`, exit 2 and record
+  nothing with stdin or stdout not a terminal, and refuse a bad id, path, control character, unowned file or unknown
+  finding before asking; an autopilot grant does not change this; the prompt does not prove a human, since a
+  pseudo-terminal passes it (B80, #10).
+
+### Fixed
+
+- The JUnit reader accepts the real SwiftPM 6.3 bare XCTest failure (`message="failure"`), not only `failed`; captured
+  Swift reports replace the hand-written fixtures (B88, #7).
+- A missing class in Laravel 13's JSON-escaped AI-agent console summary is now read as `import`, not `error` (B89, #7).
+
 ## [0.9.0] — 2026-10-12
 
 ### Added

package/README.md

@@ -8,10 +8,27 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 > `examples/` have all landed (`docs/reference/blocks.json` lists every build block). What changed
 > in each version is in [CHANGELOG.md](CHANGELOG.md).
 
-## What's new in 0.8
+## What's new in 0.9
 
 In the next release:
 
+- **Choose how long a 1Password key stays cached (B84).** Set `keys.cache_hours` (1 to 24, default 8) in `.code-forge.yml`, or `keys set <name> --op <ref> --cache-hours <n>` for one key. A lower value shortens keys that are already cached at the next read.
+- **Warnings before a cached key runs out (B85).** `keys list` and `doctor` warn when a 1Password key has less than 1 hour left. When the cached key expired and 1Password does not answer, `jev ask` prints the exact command to re-link it: `code-forge keys set jev --op <ref>`.
+- **A test report reader for red-green proof (B86).** code-forge can now read a JUnit XML test report (XCTest, Swift Testing, PHPUnit, Pest, pytest). A missing, broken or empty report, or an error that is not a failed assertion, never counts as red. B87 connects it to `proof red-green`.
+- **Red-green proof for any test runner (B87).** A new `proof.runners` list in `.code-forge.yml` names a runner per test-file glob: an adapter (`junit` or `swift`), an argv with `{test_file}`, `{test_id}`, `{test_filter}` and `{report}`, optional `env` and `timeout_s`. `proof red-green` runs that argv and reads its JUnit report, so PHPUnit, Pest, XCTest or pytest tests can be proven. The list is fixed at `run start`; a bad entry refuses the proof and never falls back to `node:test`.
+- **Red-green proof for Swift (B88).** A `proof.runners` entry with `adapter: swift` runs `swift test --parallel --filter {test_filter} --xunit-output {report}` and reads both the XCTest and the Swift Testing reports. The test filter is anchored, so a similar suite or test name is never picked up. A test that does not compile at base is `RED_INVALID compile` (a test of a new API needs the human waiver). Checked live with Swift 6.3.3 and Xcode 26.6.
+- **Red-green proof for PHP (B89).** A `proof.runners` entry with `adapter: junit` and `[php, artisan, test, "{test_file}", --filter, "{test_filter}", --log-junit, "{report}"]` proves PHPUnit and Pest tests in a Laravel app. A test of a class the block added is `RED_INVALID import`, also when Laravel prints its AI-agent JSON summary. Checked live with PHP 8.4, Laravel 13, PHPUnit 12 and Pest 4.
+- **Red-green proof for Xcode projects (B102).** A `proof.runners` entry with `adapter: xcodebuild` and an `xcode` object (`scheme`, `destination`, `test_target`) proves XCTest and Swift Testing tests through `xcodebuild test` on a simulator or on macOS. code-forge checks first that full Xcode and the simulator are there, runs only the named suite with `-only-testing`, and reads the result bundle. A build failure is `RED_INVALID compile`. code-forge never boots, creates or deletes a simulator.
+- **Xcode red-green checked live (B103).** An opt-in live check (`CODE_FORGE_LIVE_XCODE=1`) proves XCTest and Swift Testing tests red→green through `xcodebuild test` on an iPhone simulator. It skips with a reason when full Xcode or a simulator is missing. Verified with Xcode 26.6.
+- **Big files go to a big-context reviewer (B90).** Set `review.routes` once, for example `{min_lines: 400, model: <id>, session_timeout_s: 900}`. Files with that many lines get that model and timeout. No more editing `.code-forge.yml` per file. Each routed file gets a signed `review.route` row.
+- **Timeouts reach the second level (B91).** A timeout now counts as a broken result, like an answer that fails the schema. At the second broken result on one file, the second-level model is tried at once, in the same ticket. You no longer wait for a second ticket.
+- **Test-quality hint (B92).** A test that reads a source file and checks its text is a weak test. The review packet now lists those lines for the reviewer. The reviewer decides if it is a problem. The list is a hint, not a finding.
+- **More room for the Codex coder (B93).** New setting `coder.sandbox`. With `profile: toolchain`, the Codex coder may also write to the folders you list in `add_dirs`, such as a build cache. With `profile: full`, the Codex sandbox is off and `doctor` warns you. Secret folders like `~/.ssh` are always refused. The setting is fixed for the whole run.
+- **One fix round per block (B94).** The skill now waits for every review and test of a block. Then it sends the coder ONE fix message with every failing test and every open finding. It never sends findings one at a time.
+- **Waive and reopen ask you at a terminal (B80).** `block waive` and `block reopen` now ask the human for a yes in their own terminal. There is no `--yes`. With no terminal they record nothing. The prompt is a speed bump, not proof of a human: a pseudo-terminal passes it.
+
+In 0.9.0:
+
 - **A lost review state is rebuilt, not reset.** When the review state file of a file is gone (for example, macOS cleaned its temp folder), the worker rebuilds it from the signed ledger and writes a `review.state_restored` row. Rounds, open findings and stops stay as they were. If the ledger cannot rebuild it, the ticket is refused as `review-state-lost`, not `tampered` (#15).
 - **Review state no longer lives in the temp folder.** It is saved under `~/.code-forge/runs/<run>/review-state/`, so a temp cleanup or a worker restart does not touch it. A state file from an older run is moved there once, after a check against its signed anchor. `code-forge doctor` warns when a state file of an active run is missing and says whether the ledger can rebuild it (#15).
 - **Waiving every finding is a real way out.** A file whose signed review on its current content left findings, all cleared by accepted waivers, now counts as reviewed (`reviewed_by_waiver`, never approved). `block close` writes one signed `gate.review_waived_all` row for it. A critical still needs a human waiver, and a finding with an unknown severity does too (#9).
@@ -28,6 +45,8 @@ In the next release:
 - **The review exits, in one place (B76).** `skill/references/review.md` §5, `code.md` and `docs/how-it-works.md` name the ways out of a stopped file in order: fix and the human's `block reopen`, `review-file --answers`, `block waive`, re-decompose. They also say `block attempt` never resets review state and that a lost state file is rebuilt from the ledger.
 - **`review-file --fresh` fails closed (B83).** When a cached result cannot be put back, the ticket gets a refused `fresh-restore-failed` marker (or keeps its claim), so the worker does not run it by itself. `block reopen` clears it. Messages name the error code only.
 
+## What's new in 0.8
+
 In 0.8.0:
 
 - **Run only the tests a block touches.** `block open --tests <paths>` names the block's test
@@ -257,7 +276,7 @@ code-forge validate                 # loads and validates .code-forge.yml
 code-forge resolve L1                # {provider, model, effort, fallback, cli} for a level
 code-forge doctor --quick            # config + links + key resolution only
 code-forge list                      # what is installed where, and whether it still resolves
-code-forge keys list                 # NAME / SOURCE / BACKEND / EXPIRES — never a value
+code-forge keys list                 # NAME / SOURCE / BACKEND / EXPIRES — never a value; WARN under 1 h left
 code-forge models                    # the model catalog per provider
 code-forge --help                    # every verb, one per line
 code-forge version
@@ -291,7 +310,7 @@ usage line.
 | `validate` | `code-forge validate [--file <path>]` |
 | `resolve` | `code-forge resolve <L0\|L1\|L2\|L3>` |
 | `run` | `code-forge run start [--cwd <dir>] [--run <id>] [--engine <e>] [--worker-pid <pid>]` · `run start --reattach --run <id> [--worker-pid <pid>]` · `run status --run <id>` (with spent and budget USD) · `run reload --run <id>` (re-read `.code-forge.yml` mid-run) · `run end --run <id>` |
-| `block` | `code-forge block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code\|docs\|contract]` · `block attempt\|rebase <id> --run <r>` · `block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews]` · `block claim <id> <path> --run <r>` · `block stop <id> --run <r> --reason <text>` · `block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (human-only) |
+| `block` | `code-forge block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code\|docs\|contract]` · `block attempt\|rebase <id> --run <r>` · `block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews]` · `block claim <id> <path> --run <r>` · `block stop <id> --run <r> --reason <text>` · `block waive <id> <finding-id> --run <r> --file <path> --reason <text>` · `block reopen <id> --run <r> --file <path> --reason <text>` (both human-only: you run them in your own terminal, they ask for a yes, and there is no `--yes`) |
 | `worker` | `code-forge worker --run <id> [--cwd <dir>] [--poll-ms <n>] [--once]` — started detached by `run start`, never by a coder |
 | `review` | `code-forge review [--base <ref>] [--files <path…>] [--acceptance <file> \| --intent "<text>"] [--run <id>] [--max <seconds>] [--json] [--keep-run]` — review only: no coder, no proof, never closes a block |
 | `review-file` | `code-forge review-file <path> --block <id> [--run <id>]` (enqueue) · `review-file --wait <ticket> [--max <seconds>s]` (poll, default 90s; still running at `--max` prints `status: pending, reason: wait_timeout`) |
@@ -300,10 +319,10 @@ usage line.
 | `author` | `code-forge author --job plan\|harden --brief <file> [--facts <file>] [--draft <file>] [--answers <file>] [--out <file>] [--run <id>] [--timeout <seconds>]` |
 | `facts` | `code-forge facts --brief <file> [--sources <path>…] [--out <file>] [--run <id>] [--timeout <seconds>]` |
 | `plan` | `code-forge plan check <plan-file> [--facts <sheet>] [--slug <slug>]` — every block's level must be the lane recorded by `jev ask lane --block <id>`; prints `lanes: B1 L1 (rules) · …` |
-| `proof` | `code-forge proof tier --file <path> --risk <0-3> [--security] [--cwd <dir>]` · `proof export <block> --run <r> [--remove]` · `proof lock\|unlock\|restore <block> --run <r>` · `proof red-green <block> --run <r> --test <file[::case]> [--mechanism revert\|assertion-deletion]` |
+| `proof` | `code-forge proof tier --file <path> --risk <0-3> [--security] [--cwd <dir>]` · `proof export <block> --run <r> [--remove]` · `proof lock\|unlock\|restore <block> --run <r>` · `proof red-green <block> --run <r> --test <file[::case]> [--mechanism revert\|assertion-deletion]` (a non-`node:test` file runs through its `proof.runners` entry) |
 | `gates` | `code-forge gates detect\|run\|secret-scan\|safe-edit\|scope\|acceptance\|transcript-grep --cwd <dir> …` |
 | `jev` | `code-forge jev ask <question-id> --state <file> [--cwd <dir>] [--slug <slug>] [--key-ref <ref>] [--block <id>] [--plan <file>] [--rules]` — `--rules` answers `lane`, `risk` or `security_sensitive` without Jev; writes to the project's ledger slug |
-| `keys` | `code-forge keys list \| set <name> [--op <item-id\|link\|op://ref>] \| test <name> [--ref <ref>] \| remove <name>` |
+| `keys` | `code-forge keys list \| set <name> [--op <item-id\|link\|op://ref> [--cache-hours <1-24>]] \| test <name> [--ref <ref>] \| remove <name>` |
 | `ledger` | `code-forge ledger tail --slug <slug> [--n\|-n <count>]` · `ledger calibration --slug <slug> [--question <id>]` · `ledger outcome --slug <slug> --pr <n> --ci red\|green\|reverted` · `ledger outcome --slug <slug> --scan-git [--cwd <dir>] [--days <n>]` · `ledger add coder --run <r> --block <b> --usd <n> [--note "..."]` |
 | `report` | `code-forge report --slug <slug> [--json] [--export <dir>]` — 13 sections, then the spend per run (open blocks included) and the total |
 | `models` | `code-forge models [--refresh --from-cli-caches]` |
@@ -326,8 +345,8 @@ CLI verbs like any other and every one of them is exercised by this package's ow
   `doctor` always prints this line — the signature is not a defense against an attacker who
   already runs code as you, and no part of code-forge claims otherwise.
 - **Keys never reach a coder process.** Provider and Jev keys resolve only inside the worker or the
-  orchestrator's own CLI calls (`env:<NAME>` → OS keychain → 1Password, cached briefly → ask at
-  setup only). `keys list`/`keys test` never print a value; every stdout/stderr path is redacted.
+  orchestrator's own CLI calls (`env:<NAME>` → OS keychain → 1Password, cached for
+  `keys.cache_hours`: default 8 h, at most 24 h → ask at setup only). `keys list`/`keys test` never print a value; every stdout/stderr path is redacted.
 - **A forbidden-command list** stops a coder from starting its own worker, waiving a review, or
   running other orchestrator-only actions — rendered into each provider's own deny-list mechanism
   (`--disallowedTools` for Claude, an execpolicy rules file plus prose for Codex).
@@ -345,7 +364,8 @@ CLI verbs like any other and every one of them is exercised by this package's ow
   the warnings and the command list off. Every field is listed in [docs/privacy.md](docs/privacy.md).
 - **No mutation testing.** Neither this package's own tests nor the product it ships run mutation
   testing (Ricardo's ruling R14/Q16, 2026-09-25). Proof is plain unit and feature tests with exact
-  assertions, plus a red→green runner that proves a new test fails before the fix and passes after.
+  assertions, plus a red→green runner that proves a new test fails before the fix and passes after (`node:test`
+  built in; any other runner through a `proof.runners` entry that writes a JUnit report).
 
 ## Configuration reference
 
@@ -364,6 +384,7 @@ new in 0.5, `autopilot.min_confidence` in 0.6):
 | `review.multimodel_for_docs` | `false` | let docs and contract blocks use multimodel review too |
 | `review.allow_open_book_codex` | `false` | let Codex run reviewer, judge, System 2 and plan author anyway |
 | `review.session_timeout_s` | `300` | a review session that runs longer is killed and retried once |
+| `review.routes` | none | big files go to another model: a file with at least `min_lines` lines is reviewed by the rule's `model`, with its own `session_timeout_s` and `second` level |
 | `review.parallel_tickets` | `3` | review tickets the worker runs at once (1 to 16); `1` reviews one file at a time |
 | `review.provider_concurrency` | anthropic `4`, openai `2`, xai `2` | review sessions at once per provider |
 | `autopilot.min_confidence` | `0.7` | the lowest delegate confidence that is acted on; below it the question goes to you |

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 88,
+  "block_count": 102,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -1239,6 +1239,390 @@
         "B76"
       ],
       "note": "root-added 2026-10-12; B75 leftovers (plans/reviews/b75/r3.txt a-d); a failed link-back writes a refused fresh-restore-failed marker or keeps the claim; a kept claim holds the ticket; block reopen clears claims"
+    },
+    "B84": {
+      "title": "keys.cache_hours and keys set --cache-hours set the 1Password cache time",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "schema/code-forge.schema.json",
+        "docs/reference/config.md",
+        "src/keys/store.mjs",
+        "src/cli/keys.mjs",
+        "src/cli/jev.mjs",
+        "src/doctor/local.mjs",
+        "src/worker/loop.mjs",
+        "test/keys/cache-hours.test.mjs",
+        "test/keys/cli.test.mjs",
+        "test/config/schema-coverage.test.mjs",
+        "test/config/schema.test.mjs",
+        "docs/getting-started.md",
+        "docs/how-it-works.md",
+        "skill/references/security.md",
+        "README.md"
+      ],
+      "depends_on": [
+        "B83"
+      ],
+      "note": "root-added 2026-10-12; issue #14 part 1 (plans/keys-cache/plan.md); 1-24 h, default 8; a lower value shortens a cached key at the next read; bad config refuses set --op, warns elsewhere"
+    },
+    "B85": {
+      "title": "key expiry warnings and the re-link line",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/keys/store.mjs",
+        "src/cli/keys.mjs",
+        "src/cli/jev.mjs",
+        "src/doctor/local.mjs",
+        "test/keys/expiry-warn.test.mjs",
+        "docs/getting-started.md",
+        "docs/how-it-works.md",
+        "skill/references/security.md",
+        "README.md"
+      ],
+      "depends_on": [
+        "B84"
+      ],
+      "note": "root-added 2026-10-12; issue #14 part 2 (plans/keys-cache/plan.md); index keeps the op ref; WARN under 1 h in keys list and doctor; jev ask prints the re-link line when the cache expired and 1Password fails; refs shell-quoted"
+    },
+    "B86": {
+      "title": "fail-closed JUnit XML report reader for proof red-green",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/proof/junit.mjs",
+        "test/proof/junit.test.mjs",
+        "test/fixtures/junit/xctest.xml",
+        "test/fixtures/junit/swift-testing.xml",
+        "test/fixtures/junit/phpunit.xml",
+        "test/fixtures/junit/pest.xml",
+        "test/fixtures/junit/pytest.xml",
+        "skill/references/proof.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B85"
+      ],
+      "note": "root-added 2026-10-13; issue #7 part 1 (plans/red-green/plan.md); hand-written reader, no DTD/entities, 8 MiB cap, O_NOFOLLOW|O_NONBLOCK; RED only on assertion failures; SwiftPM bare failure needs a matching XCTest console line; not wired into proof yet (B87)"
+    },
+    "B87": {
+      "title": "proof.runners: prove non-node:test files through a runner argv and its JUnit report",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/proof/runners.mjs",
+        "src/proof/red-green.mjs",
+        "src/cli/proof.mjs",
+        "src/config/validate.mjs",
+        "schema/code-forge.schema.json",
+        "src/state/config-snapshot.mjs",
+        "src/state/block.mjs",
+        "src/state/run.mjs",
+        "src/proof/junit.mjs",
+        "docs/concepts.md",
+        "docs/how-it-works.md",
+        "docs/tutorial-first-test.md",
+        "docs/reference/config.md",
+        "skill/references/proof.md",
+        "skill/references/code.md",
+        "README.md",
+        "test/proof/runners.test.mjs",
+        "test/proof/red-green.test.mjs",
+        "test/proof/junit.test.mjs",
+        "test/config/validate.test.mjs",
+        "test/config/schema-coverage.test.mjs",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B86"
+      ],
+      "note": "root-added 2026-10-13; issue #7 part 2 (plans/red-green/plan.md, C-D1=a); runners frozen in the run snapshot; argv only, GIT_* stripped; rule 17 proof-runners-invalid; no-hook match refused exit 2; env_keys names only; swift runs as junit until B88"
+    },
+    "B88": {
+      "title": "swift adapter for proof.runners, checked live with swift test",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/proof/runners.mjs",
+        "src/proof/junit.mjs",
+        "src/proof/red-green.mjs",
+        "test/proof/swift-adapter.test.mjs",
+        "test/proof/swift-live.test.mjs",
+        "test/proof/junit.test.mjs",
+        "test/proof/runners.test.mjs",
+        "test/fixtures/junit/xctest.xml",
+        "test/fixtures/junit/xctest-pass.xml",
+        "test/fixtures/junit/xctest-none.xml",
+        "test/fixtures/junit/swift-testing.xml",
+        "test/fixtures/junit/swift-testing-pass.xml",
+        "test/fixtures/junit/swift-testing-none.xml",
+        "test/fixtures/junit/swift-testing-crash.xml",
+        "test/fixtures/junit/pest.xml",
+        "test/fixtures/junit/pytest.xml",
+        "skill/references/proof.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B87"
+      ],
+      "note": "root-added 2026-10-13; issue #7 part 3 (plans/red-green/plan.md §1.3); live VERIFIED Swift 6.3.3 / Xcode 26.6 / macOS 26 arm64; real SwiftPM bare failure is message=\"failure\"; --parallel needed for the XCTest report; filters anchored; swiftc compile shapes; B87 r3 leftovers folded in"
+    },
+    "B89": {
+      "title": "PHP red-green through the junit adapter, checked live on Laravel (PHPUnit and Pest)",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "test/proof/laravel-live.test.mjs",
+        "test/fixtures/junit/phpunit.xml",
+        "test/fixtures/junit/phpunit-pass.xml",
+        "test/fixtures/junit/phpunit-new-class.xml",
+        "test/fixtures/junit/phpunit-full.xml",
+        "test/fixtures/junit/pest.xml",
+        "test/fixtures/junit/pest-pass.xml",
+        "test/fixtures/junit/pest-new-class.xml",
+        "src/proof/red-parse.mjs",
+        "test/proof/red-parse.test.mjs",
+        "test/proof/junit.test.mjs",
+        "skill/references/proof.md",
+        "docs/how-it-works.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B88"
+      ],
+      "note": "root-added 2026-10-13; issue #7 part 4 (plans/red-green/plan.md §1.4); live VERIFIED PHP 8.4.25, Laravel 13.35.0, PHPUnit 12.5.39, Pest 4.7.8 through php artisan test; red-parse reads Laravel 13's JSON-escaped agent console (folded-in candidate B108); no <warning> seen"
+    },
+    "B102": {
+      "title": "The xcodebuild adapter for proof.runners: Xcode precheck, -only-testing, result bundle reader",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/proof/xcresult.mjs",
+        "src/proof/runners.mjs",
+        "src/proof/junit.mjs",
+        "src/config/validate.mjs",
+        "schema/code-forge.schema.json",
+        "docs/reference/config.md",
+        "skill/references/proof.md",
+        "test/proof/xcodebuild-adapter.test.mjs",
+        "test/proof/runners.test.mjs",
+        "test/config/schema-coverage.test.mjs",
+        "test/skill/structure.test.mjs",
+        "test/fixtures/xcresult/bare-fail.json",
+        "test/fixtures/xcresult/build-failed.console",
+        "test/fixtures/xcresult/build-failed.json",
+        "test/fixtures/xcresult/build-for-testing-failed.console",
+        "test/fixtures/xcresult/near-names.json",
+        "test/fixtures/xcresult/swift-testing-case.json",
+        "test/fixtures/xcresult/swift-testing-noparens.json",
+        "test/fixtures/xcresult/swift-testing-pass.json",
+        "test/fixtures/xcresult/swift-testing.console",
+        "test/fixtures/xcresult/swift-testing.json",
+        "test/fixtures/xcresult/thrown.console",
+        "test/fixtures/xcresult/thrown.json",
+        "test/fixtures/xcresult/xctest-case.json",
+        "test/fixtures/xcresult/xctest-pass.json",
+        "test/fixtures/xcresult/xctest.console",
+        "test/fixtures/xcresult/xctest.json"
+      ],
+      "depends_on": [
+        "B89"
+      ],
+      "note": "root-added 2026-10-13; issue #7 part 5 (plans/red-green/plan.md §1.6); fixtures captured from Xcode 26.6 (17F113), iPhone 17 simulator iOS 26.5, xcresulttool schema 0.1.0; Swift Testing -only-testing needs (); exit 0 with no test, no bundle, an unreadable bundle or an out-of-scope test is RED_INVALID error; parameterized Swift Testing, repetitions, multi-destination, Runtime Warning and Expected Failure make the bundle unreadable (fail closed)"
+    },
+    "B103": {
+      "title": "A live xcodebuild red-green check on an iOS simulator, opt-in",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "test/proof/xcodebuild-live.test.mjs",
+        "skill/references/proof.md",
+        "docs/how-it-works.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B102"
+      ],
+      "note": "root-added 2026-10-13; issue #7 part 6 (plans/red-green/plan.md §1.6); live VERIFIED Xcode 26.6 (17F113), iPhone 17 simulator iOS 26.5; XCTest and Swift Testing, file and case runs RED assertion → GREEN, new function RED_INVALID compile, ghost destination destination-unavailable; live JSON matched the B102 fixtures (kept)"
+    },
+    "B90": {
+      "title": "Size-based review routing: review.routes",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/route.mjs",
+        "src/worker/loop.mjs",
+        "src/worker/ticket.mjs",
+        "src/config/validate.mjs",
+        "schema/code-forge.schema.json",
+        "docs/reference/config.md",
+        "skill/references/review.md",
+        "docs/how-it-works.md",
+        "docs/review-only.md",
+        "test/review/route.test.mjs",
+        "test/config/validate-routes.test.mjs",
+        "test/config/validate.test.mjs",
+        "test/config/schema-coverage.test.mjs",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B103"
+      ],
+      "note": "root-added 2026-10-13; issue #10 item 4 (plans/iteration/plan.md B90); rule 18 review-routes-invalid; signed review.route rows before the first session, once per ticket; no routes = byte-equal to 8fadc12"
+    },
+    "B91": {
+      "title": "Two broken results (schema or timeout) move a packet to the second level",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/review/session-retry.mjs",
+        "src/review/schema-fallback.mjs",
+        "src/review/engine.mjs",
+        "src/review/fixloop.mjs",
+        "src/autopilot/binnacle.mjs",
+        "skill/references/review.md",
+        "docs/how-it-works.md",
+        "docs/review-only.md",
+        "test/review/broken-fallback.test.mjs",
+        "test/review/schema-fallback.test.mjs",
+        "test/worker/schema-fallback-wiring.test.mjs",
+        "test/autopilot/binnacle.test.mjs",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B90"
+      ],
+      "note": "root-added 2026-10-13; issue #10 (plans/iteration/plan.md B91); review.session_timeout notes carry packet_hash and are signed; review.schema_fallback gains trigger schema|timeout; no second level = as before plus packet_hash"
+    },
+    "B92": {
+      "title": "Test-quality hint: a test that reads source text is listed for the reviewer",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/review/test-quality.mjs",
+        "src/review/engine.mjs",
+        "src/review/lenses/A.md",
+        "src/review/lenses/B.md",
+        "src/review/lenses/full.md",
+        "src/review/lenses/quick.md",
+        "src/review/lenses/recheck.md",
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "skill/templates/coder-brief.md",
+        "docs/how-it-works.md",
+        "test/review/test-quality.test.mjs",
+        "test/review/fixloop.test.mjs",
+        "test/review/route.test.mjs",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B91"
+      ],
+      "note": "root-added 2026-10-13; issue #10 item 3 (plans/iteration/plan.md B92); a pure detector lists test lines that read a source file and assert on its text; the packet gets a ## test-quality hint section, the lens rule tells the reviewer to judge it; rechecks get the rule but no section; lens A/B order test sorted (flake fixed)"
+    },
+    "B93": {
+      "title": "coder.sandbox: a run-fixed sandbox profile for the Codex coder",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/engines/builders/codex.mjs",
+        "src/session/spawn.mjs",
+        "src/cli/spawn.mjs",
+        "src/engines/sandbox-dirs.mjs",
+        "src/state/config-snapshot.mjs",
+        "src/state/run.mjs",
+        "schema/code-forge.schema.json",
+        "src/config/validate.mjs",
+        "docs/reference/config.md",
+        "src/doctor/probes.mjs",
+        "src/doctor/index.mjs",
+        "skill/references/adapters/subprocess.md",
+        "skill/references/security.md",
+        "docs/brief-mode.md",
+        "docs/how-it-works.md",
+        "test/engines/sandbox-profile.test.mjs",
+        "test/config/validate.test.mjs",
+        "test/config/schema-coverage.test.mjs",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B92"
+      ],
+      "note": "root-added 2026-10-13; issue #10 item 1 (plans/iteration/plan.md B93); profiles workspace (default, today's argv), toolchain (--add-dir per entry), full (danger-full-access, doctor WARN); refused dirs checked after a per-component symlink walk with native realpath; rule 19 sandbox-dir-refused, rule 20 sandbox-dirs-unused (WARN); immutable key; spawn --role coder --run checks the snapshot (sandbox-changed)"
+    },
+    "B94": {
+      "title": "Skill: one fix round per block",
+      "wave": 14,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "skill/references/code.md",
+        "skill/references/review.md",
+        "skill/references/adapters/solo.md",
+        "skill/references/adapters/claude-code.md",
+        "skill/references/adapters/subprocess.md",
+        "docs/how-it-works.md",
+        "test/skill/structure.test.mjs",
+        "docs/concepts.md",
+        "docs/brief-mode.md",
+        "docs/autopilot.md",
+        "skill/references/ledger.md"
+      ],
+      "depends_on": [
+        "B93"
+      ],
+      "note": "root-added 2026-10-13; issue #10 item 5 (plans/iteration/plan.md B94); skill and docs only; the full rule word for word in code.md §4, solo.md §3 step 7 and how-it-works; one fixed pointer sentence in the other docs; the per-file cap counts per file"
+    },
+    "B80": {
+      "title": "Human-only verbs: waive and reopen ask at a terminal",
+      "wave": 14,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "docs/concepts.md",
+        "docs/getting-started.md",
+        "docs/how-it-works.md",
+        "docs/tutorial-first-test.md",
+        "skill/references/adapters/claude-code.md",
+        "skill/references/adapters/solo.md",
+        "skill/references/code.md",
+        "skill/references/ledger.md",
+        "skill/references/proof.md",
+        "skill/references/review.md",
+        "skill/references/security.md",
+        "src/cli/block.mjs",
+        "src/review/gate-check.mjs",
+        "src/review/reopen.mjs",
+        "src/review/verb-forms.mjs",
+        "src/util/forbidden.mjs",
+        "test/cli/block-human-confirm.test.mjs",
+        "test/cli/status.test.mjs",
+        "test/helpers/human-confirm.mjs",
+        "test/review/answers.test.mjs",
+        "test/review/close-gate.test.mjs",
+        "test/review/gate-check.test.mjs",
+        "test/review/reopen.test.mjs",
+        "test/review/waived-all.test.mjs",
+        "test/skill/structure.test.mjs",
+        "test/state/block-end.test.mjs"
+      ],
+      "depends_on": [
+        "B94"
+      ],
+      "note": "root-added 2026-10-13; issue #10 owner item 1 (plans/iteration/plan.md B80, D1 = a); block waive and block reopen ask the human for a yes at a terminal, no --yes, no terminal exits 2 and records nothing; pre-checks run before the question; a pseudo-terminal passes the check (honest limit in security.md §3); D1 (b) is a later option"
     }
   }
 }