@cratylus/canon 0.2.0 → 0.4.0

package/dist/hooks/purview-guardrail.js

@@ -0,0 +1,302 @@
+// purview-guardrail — the gate that makes a ROLE CONTRACT scoreable.
+//
+// A role value now states the arrow the position is over the ladder
+// `intent ≺ C ≺ spec ≺ artifact`, and an act whose domain or codomain falls outside
+// that arrow is delegated NECESSARILY. Declared, that is a steer. This cell is the
+// bound: it refuses, before the call fires, an act the holder's own contract puts
+// outside its arrow.
+//
+// WHY A SECOND CELL RATHER THAN A SECOND RUBRIC LEG. One gate, one contract. The
+// stance guard judges `autonomy` — whether the agent collapsed into order-taking — and
+// this one judges `role`. They score different declarations, at different moments, and
+// `gates` in the stance manifest is keyed by OWNING CELL precisely so a second guarded
+// dimension is a second entry rather than an append to somebody else's prompt. The
+// judge BACKEND is shared, exactly as the pre-hook shares it: one judge, two contracts.
+//
+// IT QUOTES THE AGENT'S OWN PROJECTED CONTRACT, and that is the design decision worth
+// stating. The rubric carries no role text and names no agent. The worker reads the
+// `## Role` section out of the persona's own deployed Target and hands it to the judge
+// as the law to score against, so the gate scores WHAT THE CORPUS DECLARES rather than
+// an author's opinion about good behaviour — and a corpus that mints a sixth role gets
+// it judged with no edit here. This is the lesson the stance guard learned the
+// expensive way: its allowlist drifted and left `architect` and `kino` unjudged while
+// every agent in the corpus composed the fragment it claimed to enforce.
+//
+// WHAT IT BLOCKS is what the arrow excludes, and nothing else:
+//   · a dispatch to a builder for a piece no planner decomposed, from a holder whose
+//     arrow does not write spec — the architect skipping the middle rung;
+//   · a write to the substrate by a holder whose arrow does not write artifact;
+//   · a dispatch whose prompt is the operator's literal words rather than a cut piece
+//     — the same dispatch-echo the stance guard catches at turn end, refused here
+//     because at this moment the contract that convicts it is the ROLE's.
+// WHAT IT PASSES: a dispatch to a planner, a dispatch to an assayer, READING anything,
+// and writing whatever the arrow reserves. Reading is never a block — the architect's
+// contract makes an artifact read a descent, but a read is cheap to undo and a gate
+// that fires on one would wedge every legitimate orientation.
+//
+// FAIL-OPEN, EVIDENCE-CHECKED, RE-ENTRY-CAPPED — all three inherited from the sibling
+// pre-hook, which is also the structural model for the worker. A block whose cited span
+// is not literally in the payload is DISCARDED: a fabricated block is not a lesser
+// error than a missed one.
+export const purviewGuardrail = {
+    id: 'purview-guardrail',
+    residue: 'structural-refusal ↾ mid-turn act ∉ role-arrow · deny-before-fire ⟨descent ⟨write(artifact) ∉ writes⟩ · skipped-rung ⟨dispatch(build) ∄ decomposition⟩ · dispatch-echo ⟨literal-words ≠ cut-piece⟩⟩ · pass ⟨read · act ∈ reserves · dispatch ↦ plan ∨ assay⟩ · law = the HOLDER-projected role-section ⟨quoted verbatim · ¬ authored-opinion⟩ · shared judge-backend ⟨sibling⟩ · fail-open ∧ evidence-checked ∧ re-entry-capped',
+    substrate: 'harness',
+    order: 1,
+    events: ['subagent.dispatch.pre', 'tool.use.pre'],
+    entry: 'purview-guardrail.sh',
+    timeout: 60,
+    refs: [],
+    workers: [
+        {
+            filename: 'purview-guardrail.sh',
+            targetPath: 'packages/canon/targets/guardrail/purview-guardrail.sh',
+            executable: true,
+            content: `#!/usr/bin/env sh
+# purview-guardrail — a PreToolUse hook that STRUCTURALLY REFUSES, before the call
+# fires, a mid-turn act that falls outside the arrow the agent's OWN role contract
+# declares.
+#
+# THE LAW IS NOT IN THIS FILE AND NOT IN THE RUBRIC. It is the \`## Role\` section of
+# the persona's deployed Target, read at run time and handed to the judge as the
+# contract to score against. No role text, no agent name and no behavioural opinion is
+# hard-coded anywhere in this gate.
+#
+# SAFETY MODEL (mirrors both siblings):
+#   - SCOPE-ENROLLED by PRESENCE. A persona carrying a stance manifest is judged; every
+#     other scope is silent. No allowlist — the projection that places a persona enrolls
+#     it, and nothing central lists anybody.
+#   - CONTRACT-ENROLLED, one step further. A persona whose Target carries no \`## Role\`
+#     section has no arrow to be outside of, so it is allowed. A gate cannot convict
+#     against a law that was never declared.
+#   - FAILS OPEN. Any error (no jq, no Target, judge failure) -> exit 0.
+#   - EVIDENCE-CHECKED. A BLOCK must quote a span that is literally present in the
+#     payload; a citation that is not there is a fabricated block and is DISCARDED.
+#   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice.
+#
+# INPUT  : Claude Code PreToolUse hook JSON on stdin.
+# OUTPUT : on a purview breach -> a deny decision on stdout + exit 0.
+#          otherwise -> no stdout + exit 0.
+#
+# POSIX sh. Depends on: jq. Missing jq -> fail open.
+
+set -eu
+
+# The sibling Stop hook's deployed dir owns the SHARED judge backend, resolved from
+# this script's own location exactly as the pre-hook resolves it — every hooks root
+# holds the hook dirs as siblings, so this derivation is true at every site this file
+# can land.
+SELF_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+HOOKS_ROOT="$(dirname -- "$SELF_DIR")"
+JUDGE_DIR="\${STANCE_GUARD_DIR:-$HOOKS_ROOT/stance-guardrail}"
+NEUTRAL_ROOT="$(dirname -- "$(dirname -- "$HOOKS_ROOT")")/.agents"
+RUBRIC="\${PURVIEW_RUBRIC:-$NEUTRAL_ROOT/purview-guardrail/purview-judge-prompt.md}"
+JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $JUDGE_DIR/stance-judge.sh}"
+LOG="\${PURVIEW_GUARD_LOG:-$SELF_DIR/misses.log}"
+
+trap 'exit 0' EXIT
+
+allow() { exit 0; }
+note() { printf '%s\\n' "$1" >> "$LOG" 2>/dev/null || true; }
+
+input="$(cat)"
+[ -n "$input" ] || allow
+command -v jq >/dev/null 2>&1 || allow
+
+cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
+[ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
+
+# --- scope gate: the persona's OWN stance manifest -------------------------------------------
+stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
+[ -n "$stance_scope" ] || allow
+manifest="$stance_scope/stance/manifest.json"
+[ -f "$manifest" ] || allow
+agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
+[ -n "$agent_type" ] || allow
+
+# --- the LAW: this persona's own projected role contract -------------------------------------
+# A persona scope is \`<root>/agent/personas/<name>\` and the Target it was projected
+# from is \`<root>/agent/agents/<name>.md\` — two levels out and back down, the same
+# shape of derivation the judge path above uses. Overridable for test rigs.
+AGENT_ROOT="$(dirname -- "$(dirname -- "$stance_scope")")"
+AGENT_MD="\${PURVIEW_AGENT_MD:-$AGENT_ROOT/agents/$agent_type.md}"
+[ -f "$AGENT_MD" ] || allow
+contract="$(awk '/^## Role$/{f=1;next} /^## /{f=0} f' "$AGENT_MD" 2>/dev/null || true)"
+# A contract that is a BARE TOKEN states no arrow, so there is nothing to be outside
+# of. Only a multi-line contract is scoreable, and saying so here is what keeps the
+# gate from inventing a law for a corpus that has not declared one.
+[ "$(printf '%s\\n' "$contract" | grep -c '[^[:space:]]')" -ge 2 ] || allow
+
+# --- extract the judged payload, branched by act ---------------------------------------------
+tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
+[ -n "$tool_name" ] || allow
+
+case "$tool_name" in
+	Agent|SendMessage|Task)
+		body="$(printf '%s' "$input" | jq -r '.tool_input.prompt // .tool_input.message // .tool_input.description // ""' 2>/dev/null || true)"
+		target="$(printf '%s' "$input" | jq -r '.tool_input.subagent_type // .tool_input.agent // .tool_input.name // ""' 2>/dev/null || true)"
+		act="DISPATCH to \\\`\${target:-unnamed}\\\` (codomain: the spec this delegate will build from)"
+		;;
+	Write|Edit|MultiEdit|NotebookEdit)
+		body="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .tool_input.notebook_path // ""' 2>/dev/null || true)"
+		act="WRITE to the substrate (codomain: artifact)"
+		;;
+	*)
+		# DEFENCE IN DEPTH. \`tool.use.pre\` fires on every tool on a harness with no
+		# subject selector; these two classes are the only acts this contract can
+		# convict, and a read is deliberately not one of them.
+		allow ;;
+esac
+
+[ -n "\${body:-}" ] || allow
+
+payload="=== THE HOLDER'S DECLARED CONTRACT (agent: $agent_type) ===
+$contract
+=== THE ACT ABOUT TO FIRE ===
+$act
+$body"
+
+# --- loop-safety: never deny an identical tool_input twice ----------------------------------
+session_id="$(printf '%s' "$input" | jq -r '.session_id // "nosession"' 2>/dev/null || echo nosession)"
+sig="$(printf '%s' "$input" | jq -c '.tool_input' 2>/dev/null | cksum | cut -d' ' -f1 2>/dev/null || echo 0)"
+seen="\${TMPDIR:-/tmp}/.purview-pre-$session_id-$sig"
+[ -f "$seen" ] && allow
+
+# --- judge (SHARED backend, OWN rubric) -----------------------------------------------------
+if [ -n "\${PURVIEW_EMIT_PAYLOAD:-}" ]; then
+	jq -cn --arg r "$RUBRIC" --arg p "$payload" '{rubric:$r, payload:$p}'
+	exit 0
+fi
+if [ -n "\${PURVIEW_VERDICT_FILE:-}" ]; then
+	verdict="$(cat "\${PURVIEW_VERDICT_FILE}" 2>/dev/null || true)"
+	[ -n "$verdict" ] || {
+		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-empty tool=$tool_name agent=$agent_type"
+		allow
+	}
+else
+	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
+		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=$agent_type"
+		allow
+	}
+fi
+
+decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
+[ "$decision" = "BLOCK" ] || allow
+
+reason="$(printf '%s\\n' "$verdict" | sed -n 's/^REASON:[[:space:]]*//p' | head -1)"
+[ -n "$reason" ] || reason="This act falls outside the arrow your role contract declares."
+
+# --- EVIDENCE CHECK: the cited span must be literally in the payload -------------------------
+# A block naming a span the payload does not contain is a hallucinated block, and a
+# fabricated refusal is not a lesser error than a missed one. Same rule, same reason as
+# the turn-end sibling.
+cited="$(printf '%s\\n' "$verdict" | sed -n 's/^SPAN:[[:space:]]*//p' | head -1)"
+if [ -n "$cited" ]; then
+	printf '%s' "$payload" | grep -qF -- "$cited" || {
+		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) evidence-fail tool=$tool_name agent=$agent_type span=$cited"
+		allow
+	}
+fi
+
+: > "$seen" 2>/dev/null || true
+
+feedback="PURVIEW GUARDRAIL — denied this $tool_name call: it falls outside the arrow your own \\
+role contract declares. $reason  Delegation is a THEOREM of that arrow, not an option: an act whose \\
+domain or codomain lies outside it goes to the role that owns it — a decomposition to a planner, a \\
+build to an implementer, an artifact reading to an assayer. Hand it over and carry on with what the \\
+contract reserves. (Legitimate and NOT blocked here: reading anything, dispatching to a planner or an \\
+assayer, and performing any act the contract's own \\\`reserves\\\` clause names.)"
+
+jq -cn --arg r "$feedback" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$r}}'
+exit 0
+`,
+        },
+        {
+            filename: 'purview-judge-prompt.md',
+            targetPath: 'packages/canon/targets/guardrail/purview-judge-prompt.md',
+            executable: false,
+            // NEUTRAL, exactly as the stance rubric is, and for a stronger reason here: this
+            // rubric carries no corpus content at all. It is a procedure for scoring a
+            // contract supplied at run time, so it is the same bytes for any corpus that
+            // declares a role arrow — which is what makes the neutral root its right home
+            // rather than a convenience.
+            shared: true,
+            content: `# Purview judge — does this act fall outside the agent's declared arrow?
+
+You are a PURVIEW JUDGE. You are given two things:
+
+1. **THE HOLDER'S DECLARED CONTRACT** — the \`## Role\` section of the agent's own definition,
+   verbatim. It states an arrow of the form \`reads⟨…⟩ → writes⟨…⟩\` over a ladder of
+   representational layers, the acts the arrow **reserves**, and often a named defect.
+2. **THE ACT ABOUT TO FIRE** — either a DISPATCH (the delegate prompt) or a WRITE (the path).
+
+Your one job: decide whether the act falls **outside** that arrow. You judge conformance to the
+contract you were handed. You do **not** judge whether the contract is wise, whether the act is a
+good idea, or whether the code is any good.
+
+## The law is the contract, not your opinion
+
+Every rule you apply must be readable **in the supplied contract**. If the contract does not exclude
+the act, the act passes — however unwise it looks to you. An agent is entitled to the whole of what
+its arrow permits, and a gate that convicts on an unwritten rule is worse than no gate, because it
+teaches the agent to distrust a law it can read.
+
+Read the arrow first, then the \`reserves\` clause, then the rest.
+
+## How to read an arrow
+
+\`reads⟨A · B⟩ → writes⟨C⟩\` means: the agent may consume layers A and B, and may produce layer C.
+The ladder runs \`intent ≺ C ≺ spec ≺ artifact\` from most abstract to least, where \`C\` is the
+durative concept lattice — the design.
+
+An act has a **domain** (the layer it consumes) and a **codomain** (the layer it produces):
+
+- a DISPATCH produces a **spec** — the delegate's instructions are the layer being written;
+- a WRITE to a source or config file produces an **artifact**;
+- reading anything at all produces **nothing**, and is never a breach.
+
+An act is **outside the arrow** when its codomain is not in the contract's \`writes\` set. That is the
+whole test, and it is mechanical.
+
+## What to BLOCK
+
+- **A write whose codomain is \`artifact\` by a holder whose \`writes\` set excludes \`artifact\`.**
+  The contract usually names this: \`descent\`. The path in the payload is the evidence.
+- **A dispatch whose codomain is \`spec\` by a holder whose \`writes\` set excludes \`spec\`.** This is
+  the skipped rung: a holder that writes only the design has handed a delegate a spec that no
+  spec-writing role produced. The prompt is the evidence.
+- **A dispatch whose prompt is the operator's literal words rather than a piece the agent cut.** The
+  contract that convicts this is the same clause: a dispatch is a spec, and transcription is not
+  authorship. Evidence is the prompt reading as relayed instructions rather than a bounded piece
+  with its own acceptance.
+
+## What to PASS — and these are the majority
+
+- **Any read.** Reading is outside the test by construction. Even where a contract calls
+  artifact-reading a descent, that is a standing discipline, not a mid-turn refusal.
+- **A dispatch to a role the contract explicitly routes to.** Contracts name their delegations
+  (\`⟨C → spec⟩ ↦ plan\`, \`⟨artifact → C⟩ ↦ assay\`). Handing work to a named delegate is the arrow
+  WORKING.
+- **Any act the \`reserves\` clause names**, whatever it is.
+- **A write by a holder whose \`writes\` set includes \`artifact\`.** Most agents in most corpora
+  build. Do not read a contract's other clauses as narrowing an arrow that plainly permits the act.
+- **Anything you are unsure about.** Fail toward PASS. A missed breach costs one wrong act; a
+  fabricated block costs the agent's trust in a law it can read for itself, and it wedges work.
+
+## Output
+
+Emit **only** this block, nothing before or after:
+
+\`\`\`
+VERDICT: BLOCK|PASS
+REASON: <one sentence naming the clause of the contract the act falls outside, and the codomain that put it there>
+SPAN: <a short literal substring copied from the payload that shows the act — omit this line entirely when the verdict is PASS>
+\`\`\`
+
+\`SPAN\` is checked against the payload character for character. If you cannot copy a literal span out
+of the payload, you do not have the evidence for a BLOCK, and the verdict is PASS.
+`,
+        },
+    ],
+};
+//# sourceMappingURL=purview-guardrail.js.map

package/dist/hooks/purview-guardrail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purview-guardrail.js","sourceRoot":"","sources":["../../src/hooks/purview-guardrail.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,oFAAoF;AACpF,mFAAmF;AACnF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,iFAAiF;AACjF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,+EAA+E;AAC/E,sFAAsF;AACtF,yEAAyE;AACzE,EAAE;AACF,+DAA+D;AAC/D,qFAAqF;AACrF,0EAA0E;AAC1E,gFAAgF;AAChF,sFAAsF;AACtF,kFAAkF;AAClF,0EAA0E;AAC1E,uFAAuF;AACvF,sFAAsF;AACtF,oFAAoF;AACpF,8DAA8D;AAC9D,EAAE;AACF,sFAAsF;AACtF,wFAAwF;AACxF,mFAAmF;AACnF,2BAA2B;AAE3B,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,mBAAmB;IACvB,OAAO,EACL,iaAAia;IACna,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,uDAAuD;YACnE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Jd;SACI;QACD;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,KAAK;YACjB,iFAAiF;YACjF,2EAA2E;YAC3E,6EAA6E;YAC7E,8EAA8E;YAC9E,6BAA6B;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Ed;SACI;KACF;CACF,CAAC"}

package/dist/hooks/stance-guardrail-pre.js

@@ -46,9 +46,9 @@ export const stanceGuardrailPre = {
 #   ambiguity, a substantive intent-extracted dispatch.
 #
 # SAFETY MODEL (mirrors stance-guardrail):
-#   - OFF BY DEFAULT (git config agentfactory.stanceGuard true).
-#   - AGENT-SCOPED (agent_type in the allowlist; default: nico mav). agent_type is
-#     present only for subagents / --agent mode; a top-level session call fails open.
+#   - SCOPE-ENROLLED, exactly as its twin: a scope carrying a stance manifest is judged and
+#     every other scope is silent. No repo opt-in, no allowlist — the projection that places a
+#     persona also enrolls it, and declining the guard means declining the persona.
 #   - FAILS OPEN. Any error (no jq, judge failure, bad input) -> exit 0 (allow the call).
 #   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice (there is no
 #     stop_hook_active analog for PreToolUse), so it can never wedge a call.
@@ -98,27 +98,22 @@ input="$(cat)"
 [ -n "$input" ] || allow
 command -v jq >/dev/null 2>&1 || allow  # no jq -> cannot parse -> fail open
 
-# --- opt-in gate (off by default) -----------------------------------------------------------
-# Per-repo, lives in .git/config, never checked in. Resolve relative to the hook's cwd.
+# The per-repo opt-in is GONE, for the reason its twin states: it asked whether a guard may run in
+# a DIRECTORY, and a stance belongs to the agent, not the checkout. \`cwd\` survives it — the worker
+# still runs where the session runs.
 cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 [ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
-enabled="$(git config --bool agentfactory.stanceGuard 2>/dev/null || echo false)"
-[ "$enabled" = "true" ] || allow
-
-# --- agent-scope gate -----------------------------------------------------------------------
-# Only enforce for the configured agents (default: the principal-self agents).
-# agent_type is present only for a subagent / --agent tool call; absent for the top-level
-# session -> fail open (unless STANCE_GUARD_AGENTS=*), exactly like the Stop guard.
-agent_type="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
-allowlist="\${STANCE_GUARD_AGENTS:-$(git config agentfactory.stanceGuardAgents 2>/dev/null || echo 'nico mav')}"
-if [ "$allowlist" != "*" ]; then
-	[ -n "$agent_type" ] || allow  # cannot identify the agent -> fail open
-	in_scope=false
-	for a in $allowlist; do
-		[ "$a" = "$agent_type" ] && in_scope=true && break
-	done
-	[ "$in_scope" = true ] || allow
-fi
+
+# --- scope gate: the persona's OWN stance manifest -------------------------------------------
+# The twin of the turn-end guard's gate, and inverted for the same reason: an allowlist here was
+# a runtime self-filter over an enrollment the corpus already derives, and it had drifted the way
+# such a list always drifts. Presence of a manifest in this persona's own scope IS enrollment.
+# Absent → silence, never an error, so an unenrolled launch is untouched.
+stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
+[ -n "$stance_scope" ] || allow
+manifest="$stance_scope/stance/manifest.json"
+[ -f "$manifest" ] || allow
+agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
 
 # --- extract the judged payload, branched by tool -------------------------------------------
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"

package/dist/hooks/stance-guardrail-pre.js.map

@@ -1 +1 @@
-{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKd;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Jd;SACI;KACF;CACF,CAAC"}

package/dist/hooks/stance-guardrail.js

@@ -49,8 +49,13 @@ export const stanceGuardrail = {
 #     electing the session's objective is supplying intent, not sequencing — the operator's to own
 #
 # SAFETY MODEL:
-#   - OFF BY DEFAULT. Does nothing unless the repo opts in (git config agentfactory.stanceGuard true).
-#   - AGENT-SCOPED. Only fires for agents on the allowlist (default: nico, mav — the principal-self agents).
+#   - SCOPE-ENROLLED. Fires for a scope carrying a stance manifest, and for no other. Enrollment
+#     is PRESENCE: the projection places a manifest in each persona's own scope, so composing the
+#     cell enrolls the persona and nothing central lists anybody. A bare launch carries the
+#     dispatcher and no manifest, and is therefore silent by placement.
+#   - NO REPO OPT-IN. There was one, per-repo in .git/config, and it asked the wrong question:
+#     whether a guard may run in a DIRECTORY. The off switch is launching \`omp\` rather than a
+#     persona — declining to BE the agent, instead of being it unjudged.
 #   - FAILS OPEN, BUT NEVER SILENTLY-CLEAN. Any error → exit 0 (allow stop): a guardrail that
 #     wedges work on its own flakiness is worse than a missed block. But once the guard is
 #     ENABLED and in scope, a failure that prevents judging (no transcript, judge unreachable)
@@ -85,6 +90,9 @@ JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $SELF_DIR/stance-judge.sh}"
 # a host and point outside a sandboxed deploy, which is the class of bug that put
 # \`\$HOME/.claude\` in the sibling worker and made it read another harness's tree.
 NEUTRAL_ROOT="$(dirname -- "$(dirname -- "$(dirname -- "$SELF_DIR")")")/.agents"
+# The DEFAULT rubric. A persona's own manifest may name another — that is the
+# strategy seam: one opinionated implementation, each persona free to bind a
+# different contract without the dispatcher learning anything about either.
 RUBRIC="\${STANCE_RUBRIC:-$NEUTRAL_ROOT/stance-guardrail/stance-judge-prompt.md}"
 
 # A Stop hook must never break a session. Trap any unexpected error → allow the stop.
@@ -102,6 +110,15 @@ allow_stop() { exit 0; }  # emit nothing; the agent is permitted to stop.
 # turn. Reached only AFTER the opt-in and allowlist checks, so a repo that never enabled
 # the guard stays silent.
 dark() {
+	# THE HEARTBEAT, and the reason the log is worth keeping. A VERDICT row and a
+	# DARK row are both evidence the guard RAN; only an EMPTY log means it never
+	# did. Recording judged turns alone made "not judged" and "no session" read
+	# identically — measured on a live host: an endpoint behind the advisor role
+	# accepted connections and never answered, and five hours of one session were
+	# unjudged while leaving no trace whatsoever to notice it by.
+	if [ -n "\${verdict_log:-}" ]; then
+		printf 'DARK\\t\\t%s\\n' "\$1" >> "\$verdict_log" 2>/dev/null || true
+	fi
 	printf 'STANCE GUARDRAIL — DARK: %s. This turn was NOT judged; the absence of a block is an absence of a verdict, not a clean one.\\n' "\$1"
 	exit 0
 }
@@ -138,32 +155,55 @@ verdict_log="$state_dir/$session.verdicts"
 block_count="$(cat "$count_file" 2>/dev/null || echo 0)"
 case "$block_count" in *[!0-9]*) block_count=0 ;; esac
 
-# --- opt-in gate (off by default) -----------------------------------------------------------
-# Per-repo, lives in .git/config, never checked in. A fresh clone is opted out.
-# Resolve relative to the hook's cwd (the project), which is where the flag lives.
+# The per-repo opt-in is GONE, and its absence is the point. It answered "may a guard run in this
+# DIRECTORY", which is a category error: a stance is a property of the agent, not of the checkout
+# it happens to be standing in. Worse, it made the stance OPTIONAL AT RUNTIME for an agent already
+# launched as itself — the ambient form, when the whole reason this harness half exists is that
+# identity alone erodes. The off switch is launching \`omp\` instead of \`mav\`: declining to be the
+# persona, rather than being it unjudged.
 cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 [ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
-enabled="$(git config --bool agentfactory.stanceGuard 2>/dev/null || echo false)"
-[ "$enabled" = "true" ] || allow_stop
-
-# --- agent-scope gate -----------------------------------------------------------------------
-# Only enforce the stance for the configured agents (the principal-self agents by default).
-# agent_type identifies the agent (verified by an introspective-hook capture): it is PRESENT for an
-# --agent / @mention launch — top-level INCLUDED (a session started as @nico reports agent_type=nico)
-# — and for every SubagentStop; it is ABSENT only for a DEFAULT top-level session (plain claude, no
-# --agent). When absent we do NOT enforce: a session that never declared itself a principal should not
-# get the principal rubric. STANCE_GUARD_AGENTS=* overrides to enforce on everyone (a blunt instrument).
-agent_type="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
-allowlist="\${STANCE_GUARD_AGENTS:-$(git config agentfactory.stanceGuardAgents 2>/dev/null || echo 'nico mav')}"
-
-if [ "$allowlist" != "*" ]; then
-	[ -n "$agent_type" ] || allow_stop  # cannot identify the agent → fail open
-	in_scope=false
-	for a in $allowlist; do
-		[ "$a" = "$agent_type" ] && in_scope=true && break
-	done
-	[ "$in_scope" = true ] || allow_stop
-fi
+
+# --- scope gate: the persona's OWN stance manifest -------------------------------------------
+# COMPOSITION IS THE SCOPE, NOT A RUNTIME SELF-FILTER — MODEL.md's ENFORCED clause, and this
+# gate used to violate it outright. It read an allowlist, \`nico mav\` by default and overridable
+# by \`STANCE_GUARD_AGENTS\`, which is precisely the runtime self-filter that clause forbids: a
+# module asking WHO IS RUNNING rather than being placed where only the right launch reaches it.
+#
+# It had already drifted, in the direction such a list always drifts. Every agent in the corpus
+# composes \`handoff\`, so \`Binding.agents\` DERIVES all six as bound, and six persona scopes are
+# deployed to prove it — while the list enforced two. \`architect\` and \`kino\` held principal
+# authority and were never once judged, and nothing surfaced the gap because the two facts were
+# written in different languages in different files.
+#
+# Enrollment is now PRESENCE. Each bound persona's projection lands a manifest in that persona's
+# own scope, and the dispatcher — which lives in that same scope and therefore already knows it
+# — passes it in the envelope. A manifest means enrolled, and carries THIS agent's contract: its
+# rubric, its moments, its handoff laws. No manifest means not enrolled, which is silence rather
+# than an error, so a plain session that never declared itself anything stays untouched exactly
+# as it was. Adding a persona enrolls it; adding a gated dimension edits one persona's manifest;
+# neither is a line in this file.
+stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
+[ -n "$stance_scope" ] || allow_stop
+manifest="$stance_scope/stance/manifest.json"
+[ -f "$manifest" ] || allow_stop
+
+# The persona's own contract, each field falling back to the shipped default. A manifest that
+# names nothing still enrolls: presence is the assertion, the fields are the refinement.
+agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
+manifest_rubric="$(jq -r '.rubric // empty' "$manifest" 2>/dev/null || true)"
+# An OVERRIDE that does not resolve is a defect and goes DARK — a persona that asked to be judged
+# against its own contract and is silently judged against someone else's has been mis-scored, not
+# spared. The DEFAULT is not checked here: a judge backend need not read the file at all (the
+# fixture judge does not), and refusing to run because a path the manifest never named is absent
+# would fail closed on a case the manifest made no claim about.
+case "$manifest_rubric" in
+	'') ;;
+	/*) RUBRIC="$manifest_rubric" ;;
+	*) RUBRIC="$stance_scope/stance/$manifest_rubric" ;;
+esac
+[ -z "$manifest_rubric" ] || [ -f "$RUBRIC" ] || \\
+	dark "the rubric named by $manifest is not readable at '\$RUBRIC'"
 
 # --- extract the last assistant turn from the transcript ------------------------------------
 transcript="$(printf '%s' "$input" | jq -r '.transcript_path // empty' 2>/dev/null || true)"
@@ -500,7 +540,24 @@ if [ -n "$evidence" ] && [ "\${#evidence}" -ge 12 ]; then
 # 3/5 on identical payloads — i.e. the record of WHY a turn was blocked was reconstructible only
 # by a non-deterministic process. Appended, never rotated by this hook; the state dir is tmp.
 printf '%s\\t%s\\t%s\\n' "$decision" "$evidence" "$reason" >> "$verdict_log" 2>/dev/null || true
-	if ! printf '%s' "$asst_close" | tr '\\n' ' ' | grep -qF "$evidence"; then
+	# NORMALIZED ON BOTH SIDES, and with \`--\`, because this check had two ways to
+	# throw away a correct block — and both of them fired on the SAME shape, which is
+	# the one shape this guard most exists to catch.
+	#
+	# 1. \`grep -qF "$evidence"\` with no \`--\`: an evidence span opening with a markdown
+	#    bullet is read as an OPTION. \`grep: invalid option -- ' '\`, non-zero, block
+	#    discarded. A tail-enumeration collapse IS a bullet list, so its evidence always
+	#    begins \`- \`, and the rule could never convict the shape it was written for.
+	# 2. A judge quoting several bullets joins them with spaces and drops the markers,
+	#    so a verbatim-substring test fails on punctuation while every word is present.
+	#
+	# The proposition worth authenticating is that the judge quoted THIS TURN'S WORDS,
+	# not that it reproduced its list syntax. So both sides are flattened the same way:
+	# newlines to spaces, runs of whitespace to one, list markers dropped. Symmetric, so
+	# nothing is accepted on one side that would be rejected on the other.
+	ev_norm="$(printf '%s' "$evidence" | tr '\\n' ' ' | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^[-*][[:space:]]//' -e 's/ [-*] / /g')"
+	close_norm="$(printf '%s' "$asst_close" | tr '\\n' ' ' | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^[-*][[:space:]]//' -e 's/ [-*] / /g')"
+	if ! printf '%s' "$close_norm" | grep -qF -- "$ev_norm"; then
 		printf 'stance-guardrail: DISCARDING block — judge quoted a span that is not in the turn'"'"'s CLOSE (mid-turn preamble, or confabulated): %s\\n' "$evidence" >&2
 		allow_stop
 	fi

package/dist/hooks/stance-guardrail.js.map

@@ -1 +1 @@
-{"version":3,"file":"stance-guardrail.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAG5D,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,EAAE,EAAE,kBAAkB;IACtB,OAAO,EACL,8UAA8U;IAChV,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,KAAK,EAAE,qBAAqB;IAC5B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,qBAAqB;YAC/B,UAAU,EAAE,sDAAsD;YAClE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+jBd;SACI;QACD;YACE,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,kDAAkD;YAC9D,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFd;SACI;QACD;YACE,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,yDAAyD;YACrE,UAAU,EAAE,KAAK;YACjB,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsNX,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyLV;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"stance-guardrail.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAG5D,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,EAAE,EAAE,kBAAkB;IACtB,OAAO,EACL,8UAA8U;IAChV,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,KAAK,EAAE,qBAAqB;IAC5B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,qBAAqB;YAC/B,UAAU,EAAE,sDAAsD;YAClE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwnBd;SACI;QACD;YACE,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,kDAAkD;YAC9D,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFd;SACI;QACD;YACE,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,yDAAyD;YACrE,UAAU,EAAE,KAAK;YACjB,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsNX,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyLV;SACI;KACF;CACF,CAAC"}

package/dist/plan-states.d.ts

@@ -1,14 +1,14 @@
 /** The plan-layout state folders, in task-file lifecycle order. */
 export declare const PLAN_STATES: readonly ["pending", "ready", "active", "completed"];
 /** `frontier(P)` — the states a shard sits in when the plan is workable AT it
- *  (praxis: `{ t | state(t) ∈ { ready, active } }`, where the plan IS, not merely
+ *  (`{ t | state(t) ∈ { ready, active } }`, where the plan IS, not merely
  *  what is dispatchable). A subset of {@link PLAN_STATES} and not derivable from
  *  their ORDER: `pending` is open too, and is not frontier. */
 export declare const PLAN_FRONTIER: readonly ["ready", "active"];
 /**
  * The plan-tier dotfile MARKERS whose only home is here.
  *
- * A relation with no on-disk carrier is not readable — the reading `praxis.sh`
+ * A relation with no on-disk carrier is not readable — the reading `plan-set.sh`
  * states in its own words when it explains why `.landed` exists ("exactly parallel
  * to `.superseded-by`"). These are the two markers a reader of the plan set needs
  * that have no other TypeScript home: `.superseded-by` already has one
@@ -16,7 +16,7 @@ export declare const PLAN_FRONTIER: readonly ["ready", "active"];
  *
  * `.ruling-owed` is the third carrier this corpus has minted on that reading, and
  * it carries the concept the corpus ALREADY signifies as a ruling owed — "a
- * decision nobody has taken", which the `praxis` cell distinguishes from a
+ * decision nobody has taken", which the retired praxis cell distinguished from a
  * dependency ("a dep waits itself out, a ruling needs a human"). At the SHARD tier
  * that concept is `ruling-owed(t)`, and it gates `ready`; at the
  * PLAN tier it had no carrier at all, so a fork the principal cannot resolve —

package/dist/plan-states.js

@@ -12,7 +12,7 @@
 /** The plan-layout state folders, in task-file lifecycle order. */
 export const PLAN_STATES = ['pending', 'ready', 'active', 'completed'];
 /** `frontier(P)` — the states a shard sits in when the plan is workable AT it
- *  (praxis: `{ t | state(t) ∈ { ready, active } }`, where the plan IS, not merely
+ *  (`{ t | state(t) ∈ { ready, active } }`, where the plan IS, not merely
  *  what is dispatchable). A subset of {@link PLAN_STATES} and not derivable from
  *  their ORDER: `pending` is open too, and is not frontier. */
 export const PLAN_FRONTIER = [
@@ -22,7 +22,7 @@ export const PLAN_FRONTIER = [
 /**
  * The plan-tier dotfile MARKERS whose only home is here.
  *
- * A relation with no on-disk carrier is not readable — the reading `praxis.sh`
+ * A relation with no on-disk carrier is not readable — the reading `plan-set.sh`
  * states in its own words when it explains why `.landed` exists ("exactly parallel
  * to `.superseded-by`"). These are the two markers a reader of the plan set needs
  * that have no other TypeScript home: `.superseded-by` already has one
@@ -30,7 +30,7 @@ export const PLAN_FRONTIER = [
  *
  * `.ruling-owed` is the third carrier this corpus has minted on that reading, and
  * it carries the concept the corpus ALREADY signifies as a ruling owed — "a
- * decision nobody has taken", which the `praxis` cell distinguishes from a
+ * decision nobody has taken", which the retired praxis cell distinguished from a
  * dependency ("a dep waits itself out, a ruling needs a human"). At the SHARD tier
  * that concept is `ruling-owed(t)`, and it gates `ready`; at the
  * PLAN tier it had no carrier at all, so a fork the principal cannot resolve —

package/dist/roles/architect.d.ts

@@ -0,0 +1,2 @@
+import type { RoleCell } from './hold.js';
+export declare const architectRole: RoleCell;