@dougharness/cli 1.2.0 → 1.3.0

package/node_modules/@dougharness/flow/scripts/autopilot.mjs

@@ -10,7 +10,8 @@
 //   autopilot.mjs filed <id> --kind <follow-up|user> [--from <card>] --position "<text>"
 //   autopilot.mjs caps [--usd <n>] [--wall <min>] [--context <pct>]
 //   autopilot.mjs pick [--max <n>]            JSON { launch, needsPlan, held, alone }; a held line per held card on stderr
-//   autopilot.mjs queen-args <id> --kind <flow|hand>   writes .doug/.state/reports/<id>/queen-args.json, prints its path
+//   autopilot.mjs queen-args <id> --kind <flow|hand> [--with <id,id,...>]   writes .doug/.state/reports/<id>/queen-args.json and the per-card queen.js beside it, prints both paths (args, then queen.js)
+//   autopilot.mjs agent-types --kind <flow|hand>   prints the agent types that queen spawns, one per line
 //   autopilot.mjs launched <id> --run <wf_id> --kind <flow|hand> --worktree <abs> --args-file <path>
 //   autopilot.mjs report --run <wf_id> --file <result.json>   saves the queen's report, prints land|resume|ask
 //   autopilot.mjs resumed <id> --run <wf_id>
@@ -18,13 +19,13 @@
 //   autopilot.mjs end
 // --dir <d> names the project (default cwd). Exit 0 done; 1 no run or unknown card; 2 bad usage.
 import { execFileSync } from "node:child_process";
-import { copyFileSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
+import { copyFileSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadModels } from "../lib/models.mjs";
 import { AUTOPILOT_FILE, STEPS, readAutopilot } from "../lib/autopilot-view.mjs";
 import { contextThreshold } from "../lib/context.mjs";
-import { classifyNotification, pickCards, workersMax } from "../lib/coordinator.mjs";
+import { classifyNotification, pickCards, queenLabel, renameQueenMeta, workersMax } from "../lib/coordinator.mjs";
 import { nextReadyCards } from "../lib/board.mjs";
 import { planFor, reportPathFor } from "../lib/plan.mjs";
 
@@ -313,7 +314,39 @@ switch (cmd) {
     const out = join(dir, ".doug/.state/reports", id, "queen-args.json");
     mkdirSync(dirname(out), { recursive: true });
     writeFileSync(out, JSON.stringify(args) + "\n");
-    process.stdout.write(out + "\n");
+    const flying = (readAutopilot(dir)?.cards ?? []).filter((c) => ["running", "done", "landing"].includes(c.state)).map((c) => c.id);
+    const batch = String(opts.with ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+    const srcFile = join(dirname(fileURLToPath(import.meta.url)), "..", "workflows", kind === "hand" ? "card-queen.js" : "doug-implement.js");
+    let renamed;
+    try {
+      renamed = renameQueenMeta(readFileSync(srcFile, "utf8"), { kind, label: queenLabel(id, [...flying, ...batch]) });
+    } catch (e) {
+      fail(`cannot build the per-card queen from ${srcFile}: ${e.message}`);
+    }
+    const script = join(dirname(out), "queen.js");
+    rmSync(script, { force: true });
+    writeFileSync(script, renamed);
+    process.stdout.write(out + "\n" + script + "\n");
+    break;
+  }
+  case "agent-types": {
+    const kind = need("kind");
+    if (kind !== "flow" && kind !== "hand") usage("--kind must be flow or hand");
+    const wf = join(dirname(fileURLToPath(import.meta.url)), "..", "workflows", kind === "hand" ? "card-queen.js" : "doug-implement.js");
+    let src;
+    try {
+      src = readFileSync(wf, "utf8");
+    } catch (e) {
+      fail(`cannot read ${wf}: ${e.message}`);
+    }
+    if (kind === "hand") {
+      const m = src.match(/const AGENT_TYPES = \{([^}]*)\}/);
+      if (!m) fail("AGENT_TYPES not found in card-queen.js");
+      src = m[1];
+    }
+    const types = [...new Set([...src.matchAll(kind === "hand" ? /'(doug-flow:[\w-]+)'/g : /agentType: '([^']+)'/g)].map((x) => x[1]))];
+    if (types.length === 0) fail("no agent types found");
+    process.stdout.write(types.join("\n") + "\n");
     break;
   }
   case "launched": {

package/node_modules/@dougharness/flow/scripts/memory.mjs

@@ -97,7 +97,11 @@
 //                                                 0); --dry-run applies nothing but still runs the LLM pass and
 //                                                 prints what would happen. Cost is measured from the same local
 //                                                 transcripts cost.mjs reads, falling back to the CLI's own
-//                                                 cost estimate. Needs Node >=22.16 (node:sqlite).
+//                                                 cost estimate. For each appended lesson with no CLAUDE.md home
+//                                                 it prints `claude-md candidate for lesson <id>: <command>`
+//                                                 (edits file under .doug/.state/learn/claude-md-candidates/,
+//                                                 nothing under --dry-run) or `... dropped: <reason>`; --json
+//                                                 carries claudeMd and claudeMdDropped. Needs Node >=22.16 (node:sqlite).
 //   memory.mjs reflect --hand <card-id> [dir] --commit <sha> [--rounds <n>] [--review "<R<n> or <card-id>/R<n>>=<class>[: <reason>]"]...
 //                       [--harmful <id>]... [--note <text>] [--claude-bin <path>] [--model <name>] [--max-usd <n>] [--dry-run] [--json]
 //                                                 (card memory-every-session) the same pass for a hand landing:
@@ -776,6 +780,14 @@ try {
         for (const r of result.rejected) {
           process.stdout.write(`  rejected ${r.text ? JSON.stringify(r.text) : "(no text)"}: ${r.reason}\n`);
         }
+        for (const c of result.claudeMd || []) {
+          process.stdout.write(
+            result.dryRun
+              ? `claude-md candidate for lesson ${c.lessonId} (dry run, not written)\n`
+              : `claude-md candidate for lesson ${c.lessonId}: ${c.command}\n`
+          );
+        }
+        for (const d of result.claudeMdDropped || []) process.stdout.write(`claude-md candidate for lesson ${d.lessonId} dropped: ${d.reason}\n`);
       }
       break;
     }

package/node_modules/@dougharness/flow/scripts/plan.mjs

@@ -265,7 +265,7 @@ async function attachCodeContext(plan, dir, provider) {
   }
 }
 
-const SETTABLE = ["install", "baseBranch", "integrationBranch", "integrationWorktree", "adversary.command", "adversary.fallback", "card", "fixAttempts", "swarm", "workerCheck"];
+const SETTABLE = ["install", "baseBranch", "integrationBranch", "integrationWorktree", "adversary.command", "adversary.fallback", "card", "fixAttempts", "swarm", "workerCheck", "crew.testers"];
 
 const [cmd, ...argsRaw] = process.argv.slice(2);
 // --card=<id> is the same as --card <id>.
@@ -520,6 +520,10 @@ switch (cmd) {
       // Card swarm-topology (candidate 3): a deterministic per-worker check before the merge, behind the swarm opt-in.
       if (!/^(on|off|true|false)$/i.test(value.trim())) fail(`plan.mjs set workerCheck: the value must be on or off, got ${JSON.stringify(value)}`, 2);
       next.workerCheck = /^(on|true)$/i.test(value.trim());
+    } else if (key === "crew.testers") {
+      // Card crew-tester-seat: how many verifier seats run in parallel per full-shape task.
+      if (!/^[1-9]\d*$/.test(value.trim())) fail(`plan.mjs set crew.testers: the value must be a positive integer, got ${JSON.stringify(value)}`, 2);
+      next.crew = { ...(plan.crew && typeof plan.crew === "object" && !Array.isArray(plan.crew) ? plan.crew : {}), testers: Number(value.trim()) };
     } else if (key === "fixAttempts") {
       if (!/^\d+$/.test(value)) fail(`plan.mjs set fixAttempts: the value must be a non-negative integer, got ${JSON.stringify(value)}`, 2);
       next.fixAttempts = Number(value);

package/node_modules/@dougharness/flow/skills/doug-next/SKILL.md

@@ -104,7 +104,7 @@ Each card still runs its track unchanged (research when needed, tester, coder, r
 
 The queue approval stands for each flow-track card's plan approval: the lead puts plan.mjs show in the chat and runs plan.mjs approve itself. A card runs by hand unless its goal asks for a swarm. A hand card whose goal asks for a swarm follows doug-hand's 2b swarm branch, with the queue approval standing for its plan approval. Follow-ups are filed to Backlog as section 6 says, without a question. On every queen notification the lead measures the session's cost with cost.mjs --session <id> and checks every cap.
 
-Parallel cards: up to `workers.max` cards (default 3) run at once, each under its own queen, a background run in the card's own worktree, and main only coordinates. Main picks with `node "${CLAUDE_PLUGIN_ROOT}/scripts/autopilot.mjs" pick` up to workers.max cards that are disjoint: for hand cards, goals that name no common path and components that differ; for flow cards, plans whose owned files do not overlap. Flow cards in `needsPlan` get one `doug-flow:planner` each, all in one message, on the plan row, each writing `.doug/plans/<id>.json` and validating it with `plan.mjs validate --card <id>`. For each planned card main runs `plan.mjs set card <id> --card <id>`, `plan.mjs set integrationBranch doug/<id> --card <id>`, and `plan.mjs set integrationWorktree .claude/worktrees/doug-integration-<id> --card <id>`, puts `plan.mjs show --card <id>` in the chat, and runs `plan.mjs approve --card <id>`, because the queue approval stands for it; then main picks again. A flow card gets section 1's move and a hand card gets doug-hand step 2's class, move, and condition open, before its launch. A flow queen is `Workflow({ name: "doug-flow:doug-implement", args: <plan.mjs json --card <id>> })`; a hand queen is `Workflow({ scriptPath: "${CLAUDE_PLUGIN_ROOT}/workflows/card-queen.js", args })` with args `{ card, options, models, repoRoot, worktreePath }`, the worktreePath being `<repoRoot>/.claude/worktrees/card-<id>`. To launch a queen, main runs `node "${CLAUDE_PLUGIN_ROOT}/scripts/autopilot.mjs" queen-args <id> --kind <flow|hand>`, which writes `.doug/.state/reports/<id>/queen-args.json` and prints its path; then the Workflow call with that file's JSON as args; then `autopilot.mjs launched <id> --run <wf_id> --kind <flow|hand> --worktree <abs> --args-file <path>`, the flow worktree being `<repoRoot>/<the plan's integrationWorktree>`, because that value is relative. Main starts all the Workflow calls in one message, and it never briefs, builds, or reviews a queen card. Each queen's report arrives in that run's task-notification `<result>`, not in the Workflow tool's return, and main pipes it through `autopilot.mjs report --run <wf_id> --file .doug/.state/briefs/<id>-result.json`, the queen's result saved there, which prints land, resume, or ask. Land means the landing steps below; resume relaunches the queen with `resumeFromRunId` and the saved `queen-args.json`, then runs `autopilot.mjs resumed <id> --run <new wf_id>`, once, and a second resume is ask; ask stops that card and asks the user. Main lands one card at a time: a flow card with `plan.mjs done --card <id>` then `plan.mjs land --card <id>`, a hand card with `plan.mjs land-card <id> --branch card/<id> --worktree <abs>`. After each landing main runs `board.mjs move`, the run-report skill with `cost.mjs <wf_id> --report <per-card report path>`, which is `.doug/.state/reports/<id>/last-report.json` for a flow card and `.doug/.state/reports/<id>/card-report.json` for a hand card, and `autopilot.mjs lock-wait <id> --ms <n>`, where n is the `lockWaitMs` line that `plan.mjs land` or `land-card` printed, and the landing commit carries the card's plan `.doug/plans/<id>.json`. A resume never replans. When a queen's run needs the user, main asks while the other queens keep running. A cap reached launches no new queen and lets the in-flight ones finish. In manual or accept-edits mode every queen launch prompts, and the Workflow allow rule or "Yes, and don't ask again" runs n queens unattended (docs/research/parallel-cards-research.md section 4). A card tagged swarm (or `swarm: true`, or whose goal says to run it as a swarm) and a decision card run alone, as today, after the in-flight queens finish; `/doug-next <id>` by hand is unchanged.
+Parallel cards: up to `workers.max` cards (default 3) run at once, each under its own queen, a background run in the card's own worktree, and main only coordinates. Main picks with `node "${CLAUDE_PLUGIN_ROOT}/scripts/autopilot.mjs" pick` up to workers.max cards that are disjoint: for hand cards, goals that name no common path and components that differ; for flow cards, plans whose owned files do not overlap. Flow cards in `needsPlan` get one `doug-flow:planner` each, all in one message, on the plan row, each writing `.doug/plans/<id>.json` and validating it with `plan.mjs validate --card <id>`. For each planned card main runs `plan.mjs set card <id> --card <id>`, `plan.mjs set integrationBranch doug/<id> --card <id>`, and `plan.mjs set integrationWorktree .claude/worktrees/doug-integration-<id> --card <id>`, puts `plan.mjs show --card <id>` in the chat, and runs `plan.mjs approve --card <id>`, because the queue approval stands for it; then main picks again. A flow card gets section 1's move and a hand card gets doug-hand step 2's class, move, and condition open, before its launch. A flow queen is `Workflow({ scriptPath: <the queen.js path>, args: <plan.mjs json --card <id>> })`, the queen.js being the per-card copy of `workflows/doug-implement.js` that `autopilot.mjs queen-args` writes to `.doug/.state/reports/<id>/queen.js`; a hand queen is `Workflow({ scriptPath: <the queen.js path>, args })`, the per-card copy of `workflows/card-queen.js` at the same path, with args `{ card, options, models, repoRoot, worktreePath }`, the worktreePath being `<repoRoot>/.claude/worktrees/card-<id>`. Before any queen launch, main runs `node "${CLAUDE_PLUGIN_ROOT}/scripts/autopilot.mjs" agent-types --kind <flow|hand>`, which prints the agent types that queen spawns, one per line, and compares each name with the agent types its own session lists; when one is missing it launches no queen and tells the user to run /reload-plugins or restart. To launch a queen, main runs `node "${CLAUDE_PLUGIN_ROOT}/scripts/autopilot.mjs" queen-args <id> --kind <flow|hand> --with <the other ids launched in the same message>`, which writes `.doug/.state/reports/<id>/queen-args.json` and the per-card `.doug/.state/reports/<id>/queen.js`, whose run name is `<short id> card-queen` or `<short id> flow-queen`, and prints both paths; then `Workflow({ scriptPath: <the queen.js path>, args })` with that file's JSON as args; then `autopilot.mjs launched <id> --run <wf_id> --kind <flow|hand> --worktree <abs> --args-file <path>`, the flow worktree being `<repoRoot>/<the plan's integrationWorktree>`, because that value is relative. Main starts all the Workflow calls in one message, and it never briefs, builds, or reviews a queen card. Each queen's report arrives in that run's task-notification `<result>`, not in the Workflow tool's return, and main pipes it through `autopilot.mjs report --run <wf_id> --file .doug/.state/briefs/<id>-result.json`, the queen's result saved there, which prints land, resume, or ask. Land means the landing steps below; resume relaunches the same `.doug/.state/reports/<id>/queen.js` with `resumeFromRunId` and the saved `queen-args.json`, then runs `autopilot.mjs resumed <id> --run <new wf_id>`, once, and a second resume is ask; ask stops that card and asks the user. Main lands one card at a time: a flow card with `plan.mjs done --card <id>` then `plan.mjs land --card <id>`, a hand card with `plan.mjs land-card <id> --branch card/<id> --worktree <abs>`. After each landing main runs `board.mjs move`, the run-report skill with `cost.mjs <wf_id> --report <per-card report path>`, which is `.doug/.state/reports/<id>/last-report.json` for a flow card and `.doug/.state/reports/<id>/card-report.json` for a hand card, and `autopilot.mjs lock-wait <id> --ms <n>`, where n is the `lockWaitMs` line that `plan.mjs land` or `land-card` printed, and the landing commit carries the card's plan `.doug/plans/<id>.json`. A resume never replans. When a queen's run needs the user, main asks while the other queens keep running. A cap reached launches no new queen and lets the in-flight ones finish. In manual or accept-edits mode every queen launch prompts, and the Workflow allow rule or "Yes, and don't ask again" runs n queens unattended (docs/research/parallel-cards-research.md section 4). A card tagged swarm (or `swarm: true`, or whose goal says to run it as a swarm) and a decision card run alone, as today, after the in-flight queens finish; `/doug-next <id>` by hand is unchanged.
 
 The lead keeps the run's state file, `.doug/.state/autopilot.json` (uncommitted), current through `node "${CLAUDE_PLUGIN_ROOT}/scripts/autopilot.mjs"`, which the live pane and the board's Autopilot panel (`doug board serve`) read:
 

package/node_modules/@dougharness/flow/skills/research/SKILL.md

@@ -21,7 +21,7 @@ The session model never researches itself; it asks the questions and writes the
 
 ## One researcher or several
 
-One question, one researcher. Several independent questions get several researchers in the same message, in parallel, each with one distinct question and told not to answer the others'; their answers merge into one note. A request or card that names a crew of researchers (`crew: { "researchers": 2 }` in the plan's terms) gets that many, each with its own question. Do not give two researchers the same question: a disagreement between two guesses is not a check. Each question names the budget (at most 6 WebSearch plus WebFetch calls, research.maxFetches) and lists the raw URLs to try, in priority order.
+One question, one researcher. Several independent questions get several researchers in the same message, in parallel, each with one distinct question and told not to answer the others'; their answers merge into one note. A request or card that names a crew of researchers (`crew: { "researchers": 2 }` in the plan's terms) gets that many, each with its own question. Do not give two researchers the same question: a disagreement between two guesses is not a check. Each question names the budget (at most 6 WebSearch plus WebFetch calls, research.maxFetches) and lists the raw URLs to try, in priority order. Each researcher brief asks exactly one question; a brief that reads an external system and then compares it with this repository asks two. A comparison with this repository's code is its own question for its own researcher, never appended to a question about an external system. Every researcher brief names where to read, the raw URLs in priority order or the directories and files of a downloaded tree, and its turn budget: at most 40 tool calls (the researcher agent's maxTurns), stopping with at least 5 to spare to return what it has. On 2026-10-13 two of the three memory-research-tencentdb researchers, each briefed to read an external codebase and then compare it with Doug, ran into the 30-turn cap and returned a half sentence with no findings.
 
 ## The note
 

package/node_modules/@dougharness/flow/workflows/card-queen.js

@@ -30,6 +30,7 @@ const STOP_REASONS = [
   "setup-failed",
   "tester-red-claim-missing",
   "reviewer-blocker-open",
+  "reviewer-major-open",
   "gate-red-twice",
 ];
 // The Models-table row each seat runs on. setup, gate and commit have no sourced row; cheap is a choice.
@@ -102,6 +103,22 @@ const BRIEF_RULES = {
     text: "Commit without Co-Authored-By or Claude-Session trailers.",
     seats: ["commit"],
   },
+  "commit-foreground": {
+    text: "Run git commit in the foreground with the Bash tool timeout set to 600000 ms: the pre-commit hook runs the full unit suite and takes over the 2-minute default.",
+    seats: ["commit"],
+  },
+  "commit-no-background": {
+    text: "Never use run_in_background, a Monitor, or a sleep loop for git commit: a background commit dies when your seat ends. Wait for the command to return.",
+    seats: ["commit"],
+  },
+  "commit-sha-from-git-log": {
+    text: "Report the sha only from git log -1 --format=%H after git commit has returned; never report a sha you did not read from it.",
+    seats: ["commit"],
+  },
+  "gate-no-git-writes": {
+    text: "Run the gate commands only. Never run git add, git commit, or any other command that writes to git; the commit seat is the only seat that commits.",
+    seats: ["gate"],
+  },
   "leave-plan-anchor-out": {
     text: "Leave .doug/plan.json and .doug/anchor.md out of the commit unless the card is about them.",
     seats: ["commit"],
@@ -532,6 +549,9 @@ function validate(state, hb) {
     }
     case "gate": {
       checkCmds(hb.commands, "commands", errs, true);
+      if (Array.isArray(hb.commands) && hb.commands.some((c) => c && isStr(c.command) && GIT_WRITE_RE.test(c.command))) {
+        errs.push("gate seat must not run git add or git commit");
+      }
       if (!nonBlank(hb.gateLine)) errs.push("gateLine must be a non-empty string");
       if (hb.lockWaitMs !== undefined && hb.lockWaitMs !== null && !Number.isInteger(hb.lockWaitMs)) {
         errs.push("lockWaitMs must be an integer or null");
@@ -551,6 +571,9 @@ function validate(state, hb) {
 
 // ---- next ----
 
+// git add / git commit at the start of a command or after a shell separator, global options (-C <path>, -c k=v, --flag) allowed before the verb.
+const GIT_WRITE_RE = /(?:^|[;&|(\n]\s*)git(?:\s+(?:-[Cc]\s+(?:"[^"]*"|'[^']*'|\S+)|--[\w-]+(?:=\S+)?))*\s+(?:add|commit)\b/;
+
 function stopWith(s, reason, detail) {
   const seat = s.pending;
   const state = {
@@ -670,12 +693,21 @@ function next(state, handBack) {
         mutations: cp(H.mutationResults),
       };
       const blockers = findings.filter((f) => f.severity === "blocker");
-      if (blockers.length === 0) return advance(s, "gate", "ok", { acc });
+      // An evidenced major gets the same one fix pass; a major without evidence and a minor stay advisory.
+      const majors = findings.filter((f) => f.severity === "major" && nonBlank(f.evidence));
+      if (blockers.length === 0 && majors.length === 0) return advance(s, "gate", "ok", { acc });
       if (s.counters.fixPasses >= 1) {
+        if (blockers.length > 0) {
+          return stopWith(
+            { ...s, acc },
+            "reviewer-blocker-open",
+            "blocker still open after one fix pass: " + blockers.map((f) => f.id).join(", "),
+          );
+        }
         return stopWith(
           { ...s, acc },
-          "reviewer-blocker-open",
-          "blocker still open after one fix pass: " + blockers.map((f) => f.id).join(", "),
+          "reviewer-major-open",
+          "major with evidence still open after one fix pass: " + majors.map((f) => f.id).join(", "),
         );
       }
       return advance(s, buildSeat(s), "blockers", {
@@ -801,7 +833,14 @@ let s = initialState(args.card, args.options)
 let a = currentAction(s)
 while (a.kind === 'seat') {
   phase(PHASE_TITLES[a.seat])
-  const hb = await agent(briefPrompt(a.brief, { repoRoot: args.repoRoot, worktreePath: args.worktreePath }), seatOpts(a.seat, a.brief))
+  let hb
+  try {
+    hb = await agent(briefPrompt(a.brief, { repoRoot: args.repoRoot, worktreePath: args.worktreePath }), seatOpts(a.seat, a.brief))
+  } catch (err) {
+    // The runtime throws after repeated schema-validation failures; a null hand-back lets the contract stop with agent-null.
+    log('card-queen: ' + a.seat + ' seat agent() threw: ' + (err && err.message ? err.message : String(err)))
+    hb = null
+  }
   ;({ state: s, action: a } = next(s, hb))
 }
 return { ...a.report, history: s.history }

package/node_modules/@dougharness/flow/workflows/doug-implement.js

@@ -4,7 +4,7 @@ export const meta = {
   whenToUse: 'After /doug-plan produced .doug/plan.json and the user approved it with /doug-approve. Pass the plan JSON as args.',
   phases: [
     { title: 'Implement', detail: 'one implementer per task, fresh context, own worktree (with swarm on, a lead splits a full-shape task into worker briefs, workers implement them in parallel, and the lead merges); a task marked reuse checks out its recorded branch instead; a task whose dependency did not integrate is never launched; a block the checks can describe is fixed in place until the task budget, the fix-attempt ceiling, a pass that made no new commit, or two consecutive passes raising a new blocker stops it' },
-    { title: 'Verify', detail: 'a separate verifier runs the task command in the worktree on the first pass; a fix pass runs one focused check over the fix delta instead, and the full verifier again only when the verifier is the stage that blocked' },
+    { title: 'Verify', detail: 'a separate verifier runs the task command in the worktree on the first pass; a fix pass runs one focused check over the fix delta instead, and the full verifier again only when the verifier is the stage that blocked; a task whose crew names more testers gets extra verifiers in parallel' },
     { title: 'Review', detail: 'spec compliance, then quality, against the diff on the first pass; on a fix pass the focused check carries scope and regression risk unless the reviewer is the stage that blocked; a task whose crew names two reviewers gets a second one in parallel with a distinct brief' },
     { title: 'Adversary', detail: 'codex-review (a different model, read-only) explores freely on the first pass and confirms the open findings on later passes, under one material blocker gate; when it cannot run, a Claude adversary on plan.adversary.fallback stands in; blockers stop integration' },
     { title: 'Integrate', detail: 'merge the level into the integration branch and run plan.verify' },
@@ -64,6 +64,9 @@ const ENVIRONMENT_MARKER = 'ENVIRONMENT ONLY'
 // The one rule about commit messages, in every prompt that commits or checks commits: this repository records
 // attribution nowhere in git, and plan.mjs land refuses a branch that carries either trailer.
 const NO_TRAILERS = 'Commit messages carry no attribution trailers: no Co-Authored-By line and no Claude-Session line, whatever your defaults say. A commit with either is a finding and the plan cannot land.'
+// The one rule about how a commit runs, in every implement prompt that commits: the pre-commit hook runs the full
+// unit suite, which outlives Bash's default timeout, and a background commit dies with the agent that started it.
+const FOREGROUND_COMMIT = 'Run git commit in the foreground with the Bash tool timeout set to 600000 ms (the pre-commit hook runs the full suite): never run_in_background, a Monitor, or a sleep loop. Take the sha only from git rev-parse HEAD after git commit has returned.'
 const LESSONS_NOT_SPEC = 'These are context from earlier runs, not part of the spec or the acceptance criteria; never report a finding, a spec contradiction, or a blocker against a lesson.'
 // The one rule about a partial result, in every prompt a worker (or a resumed worker) can end with one from
 // (card worker-context-handoff): quotes the harness's context notice (a PostToolUse hook in plugins/doug-gates) so
@@ -831,7 +834,7 @@ function ledgerText(ledger, kind) {
 function implementPrompt(task, baseBranch, opts) {
   const resume = !!(opts && opts.resume)
   const branchCheck = resume
-    ? `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch doug/task-${task.id} was created by the previous agent for this task in this same run, which stopped without returning a result; it is yours, not stale. Find that agent's worktree with git worktree list --porcelain (the one with branch refs/heads/doug/task-${task.id}); if none is listed, go straight to the checkout. If it has uncommitted changes to owned files, commit them there first with a message starting "${task.id}: ". ${NO_TRAILERS} Then remove that worktree with git worktree remove --force <path>, then git checkout doug/task-${task.id} in your own worktree and continue the task from that branch's state (do not recreate the branch or reset it). Never return blocked for the branch existing.`
+    ? `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch doug/task-${task.id} was created by the previous agent for this task in this same run, which stopped without returning a result; it is yours, not stale. Find that agent's worktree with git worktree list --porcelain (the one with branch refs/heads/doug/task-${task.id}); if none is listed, go straight to the checkout. If it has uncommitted changes to owned files, commit them there first with a message starting "${task.id}: ". ${NO_TRAILERS} ${FOREGROUND_COMMIT} Then remove that worktree with git worktree remove --force <path>, then git checkout doug/task-${task.id} in your own worktree and continue the task from that branch's state (do not recreate the branch or reset it). Never return blocked for the branch existing.`
     : `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch is a leftover of an earlier run: do not check it out or build on it; change nothing and return blocked=true with blockedReason "stale branch doug/task-${task.id} already exists; run plan.mjs replan, which renames it".`
   return [
     `You are implementing exactly one task from an approved plan. Work only in your own git worktree.`,
@@ -854,7 +857,7 @@ function implementPrompt(task, baseBranch, opts) {
     `   A fresh worktree has no installed dependencies: if the verification command needs them, run the project's install command first${plan.install ? ` (${plan.install})` : ''}. Installing is not a file change you own; do not commit lockfile changes it makes.`,
     `2. Touch no file outside your owned list. If the task cannot be done without another file, stop and report blocked=true with the reason.`,
     `3. Run the verification command before finishing and report each command with its real exit status. Never report a command you did not run.`,
-    `4. Commit your work on the branch with a message starting "${task.id}: ". ${NO_TRAILERS}`,
+    `4. Commit your work on the branch with a message starting "${task.id}: ". ${NO_TRAILERS} ${FOREGROUND_COMMIT}`,
     `5. Return the structured result. filesTouched must come from git, not memory, and commit must be the output of git rev-parse HEAD in your worktree after that commit.`,
     `6. ${PARTIAL_RULE}`,
   ].join('\n')
@@ -885,7 +888,7 @@ function reusePrompt(task, baseBranch) {
 function leadPrompt(task, baseBranch, opts) {
   const resume = !!(opts && opts.resume)
   const branchCheck = resume
-    ? `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch doug/task-${task.id} was created by the previous agent for this task in this same run, which stopped without returning a result; it is yours, not stale. Find that agent's worktree with git worktree list --porcelain (the one with branch refs/heads/doug/task-${task.id}); if none is listed, go straight to the checkout. If it has uncommitted changes to owned files, commit them there first with a message starting "${task.id}: ". ${NO_TRAILERS} Then remove that worktree with git worktree remove --force <path>, then git checkout doug/task-${task.id} in your own worktree and continue the task from that branch's state (do not recreate the branch or reset it). Never return blocked for the branch existing.`
+    ? `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch doug/task-${task.id} was created by the previous agent for this task in this same run, which stopped without returning a result; it is yours, not stale. Find that agent's worktree with git worktree list --porcelain (the one with branch refs/heads/doug/task-${task.id}); if none is listed, go straight to the checkout. If it has uncommitted changes to owned files, commit them there first with a message starting "${task.id}: ". ${NO_TRAILERS} ${FOREGROUND_COMMIT} Then remove that worktree with git worktree remove --force <path>, then git checkout doug/task-${task.id} in your own worktree and continue the task from that branch's state (do not recreate the branch or reset it). Never return blocked for the branch existing.`
     : `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch is a leftover of an earlier run: do not check it out or build on it; change nothing and return blocked=true with blockedReason "stale branch doug/task-${task.id} already exists; run plan.mjs replan, which renames it".`
   return [
     `You are the lead of a swarm for exactly one task of an approved plan. You split the task into worker briefs; you do not implement anything and you edit no file. Work only in your own git worktree.`,
@@ -944,7 +947,7 @@ function workerPrompt(task, brief, n, lead) {
     `   A fresh worktree has no installed dependencies: if the verification command needs them, run the project's install command first${plan.install ? ` (${plan.install})` : ''}. Installing is not a file change you own; do not commit lockfile changes it makes.`,
     `2. Touch no file outside your owned list. If the brief cannot be done without another file, stop and report blocked=true with a blockedReason that names exactly what you need - the file, the symbol or interface, or the decision - because the lead may re-brief you once on it; a vague reason wastes that chance.`,
     `3. Run the verification command before finishing and report each command with its real exit status. Never report a command you did not run.`,
-    `4. Commit your work on the branch with a message starting "${task.id}: w${n} ". ${NO_TRAILERS}`,
+    `4. Commit your work on the branch with a message starting "${task.id}: w${n} ". ${NO_TRAILERS} ${FOREGROUND_COMMIT}`,
     `5. Return the structured result. filesTouched must come from git diff --name-only ${lead.branch}...HEAD, and commit must be the output of git rev-parse HEAD in your worktree after that commit.`,
     `6. ${PARTIAL_RULE}`,
   ].join('\n')
@@ -1048,7 +1051,7 @@ function fixPrompt(task, r, pass, baseBranch, ledger, brief) {
   lines.push(`1. Touch no file outside your owned list. If a finding can only be met by changing another file, stop and return blocked=true with the reason.`)
   lines.push(`2. Do not delete, skip, or weaken any test to make a check pass; make the code satisfy it. If that is impossible within the spec, return blocked=true and say why.`)
   lines.push(`3. Run the verification command before finishing; it must pass. Report every command with its real exit status and never one you did not run.`)
-  lines.push(`4. Commit on ${r.impl.branch} with a message starting "${task.id}: fix ". Do not amend or rewrite earlier commits. A pass that ends with no new commit stops the task. ${NO_TRAILERS}`)
+  lines.push(`4. Commit on ${r.impl.branch} with a message starting "${task.id}: fix ". Do not amend or rewrite earlier commits. A pass that ends with no new commit stops the task. ${NO_TRAILERS} ${FOREGROUND_COMMIT}`)
   lines.push(`5. Return the structured result with taskId="${task.id}", branch="${r.impl.branch}", worktreePath${r.worktreeGone ? ' = the absolute path of your worktree (git rev-parse --show-toplevel)' : `="${r.impl.worktreePath}"`}, filesTouched from git diff --name-only ${baseBranch}...HEAD, commit from git rev-parse HEAD after your commit, blocked=false.`)
   lines.push(`6. ${PARTIAL_RULE}`)
   return lines.join('\n')
@@ -1081,7 +1084,7 @@ function resumePrompt(task, prev, handoff, baseBranch, brief) {
     `Rules:`,
     `1. Touch no file outside your owned list. If the work cannot be done without another file, stop and report blocked=true with the reason.`,
     `2. Run the verification command before finishing and report each command with its real exit status. Never report a command you did not run.`,
-    `3. Commit your work on ${prev.branch} with a message starting "${task.id}: resume ". ${NO_TRAILERS}`,
+    `3. Commit your work on ${prev.branch} with a message starting "${task.id}: resume ". ${NO_TRAILERS} ${FOREGROUND_COMMIT}`,
     `4. ${PARTIAL_RULE}`,
     `5. Return the structured result. filesTouched must come from git diff --name-only ${baseBranch}...HEAD, and commit must be the output of git rev-parse HEAD in your worktree after that commit.`,
   ].join('\n')
@@ -1125,9 +1128,10 @@ function supervisePrompt(task, r, attempts, ledger, signals) {
   ].join('\n')
 }
 
-function verifyPrompt(task, impl, baseBranch) {
+function verifyPrompt(task, impl, baseBranch, seat = 1) {
   return [
     `You are a verifier. You did not write this code. Your job is to run it, not to read and approve it.`,
+    ...(seat > 1 ? [`You are crew seat ${seat} of ${crewOf(task).testers} on this task: another verifier runs the same checks at the same time. Run the verification and acceptance commands yourself, and beyond them probe the behavior the spec implies that those commands may not cover: edge cases (empty, missing, boundary, and repeated input) and error paths (invalid input, a failing dependency). A defect you find is a finding even when every command passes.`] : []),
     ``,
     `Task ${task.id}: ${task.title}`,
     `Spec:`,
@@ -1990,13 +1994,41 @@ async function runAdversary(task, impl, pass, baseBranch, ledger, launch, stages
 }
 
 // ---- Crew (card crew-sizing) ---------------------------------------------------
-// A task (or the plan) declares how many reviewers and adversaries read it; default one each. More coders is a
+// A task (or the plan) declares how many reviewers, adversaries and testers read it; default one each. More coders is a
 // split into more tasks, never a shared worktree, so the crew has no coders row. Researchers run before planning
 // (the research skill) and are not launched here.
 function crewOf(task) {
   const src = { ...((plan.crew && typeof plan.crew === 'object') ? plan.crew : {}), ...((task && task.crew && typeof task.crew === 'object') ? task.crew : {}) }
   const n = v => (Number.isInteger(v) && v > 0 ? v : 1)
-  return { reviewers: n(src.reviewers), adversaries: n(src.adversaries) }
+  return { reviewers: n(src.reviewers), adversaries: n(src.adversaries), testers: n(src.testers) }
+}
+
+// One verification out of several tester seats (card crew-tester-seat): passed only when every seat that returned
+// passed, findings and commands concatenated so the ledger's fingerprint collapses a duplicate, and an acceptance
+// criterion (matched by text) ok only when every seat reporting it ok. A seat that returned nothing is dropped; when
+// no seat returned anything the stage returned nothing; one seat comes back unchanged.
+function mergeVerifies(seats) {
+  const got = seats.filter(Boolean)
+  if (!got.length) return null
+  if (got.length === 1 && seats.length === 1) return got[0]
+  const acceptance = []
+  for (const v of got) {
+    for (const a of (v.acceptance || [])) {
+      const at = acceptance.findIndex(x => x.text === a.text)
+      if (at < 0) acceptance.push({ ...a })
+      else if (acceptance[at].ok && !a.ok) acceptance[at] = { ...a }
+    }
+  }
+  return {
+    taskId: got[0].taskId,
+    passed: got.every(v => v.passed),
+    commandsRun: got.flatMap(v => v.commandsRun || []),
+    findings: got.flatMap(v => v.findings || []),
+    findingFiles: got.flatMap(v => v.findingFiles || []),
+    acceptance,
+    head: got[0].head,
+    seats: got.length,
+  }
 }
 
 // One review out of several: every seat must approve, and every seat's issues are kept, so a finding one reviewer
@@ -2159,19 +2191,21 @@ async function runChecks(task, impl, pass, baseBranch, ctx) {
     // The verifier, the reviewer, and the adversary are read-only and none reads another's result, so a first pass
     // launches them together; a null from any (skipped, or dead after retries) is that stage returning nothing.
     stages.push('verify')
-    stages.push('review')
     const crew = crewOf(task)
+    for (let seat = 2; seat <= crew.testers; seat++) stages.push(`verify-${seat}`)
+    stages.push('review')
     for (let seat = 2; seat <= crew.reviewers; seat++) stages.push(`review-${seat}`)
     const withAdversary = adversaryRequired(task)
     const advStages = []
     const pair = await parallel([
       () => launch(verifyPrompt(task, impl, baseBranch), agentOpts('verify', task, { label: `verify:${task.id}`, phase: 'Verify', agentType: 'doug-flow:verifier', schema: VERIFY_SCHEMA })),
+      ...Array.from({ length: crew.testers - 1 }, (_, i) => () => launch(verifyPrompt(task, impl, baseBranch, i + 2), agentOpts('verify', task, { label: `verify-${i + 2}:${task.id}`, phase: 'Verify', agentType: 'doug-flow:verifier', schema: VERIFY_SCHEMA }))),
       () => launch(reviewPrompt(task, impl, baseBranch), agentOpts('review', task, { label: `review:${task.id}`, phase: 'Review', agentType: 'doug-flow:reviewer', schema: REVIEW_SCHEMA })),
       ...Array.from({ length: crew.reviewers - 1 }, (_, i) => () => launch(reviewPrompt(task, impl, baseBranch, i + 2), agentOpts('review', task, { label: `review-${i + 2}:${task.id}`, phase: 'Review', agentType: 'doug-flow:reviewer', schema: REVIEW_SCHEMA }))),
       ...(withAdversary ? [() => runAdversaryCrew(task, impl, pass, baseBranch, ledger, launch, advStages)] : []),
     ])
-    ver = (pair && pair[0]) || null
-    rev = pair ? mergeReviews(pair.slice(1, 1 + crew.reviewers)) : null
+    ver = pair ? mergeVerifies(pair.slice(0, crew.testers)) : null
+    rev = pair ? mergeReviews(pair.slice(crew.testers, crew.testers + crew.reviewers)) : null
     stageResults.verify = ver
     stageResults.review = rev
     // The adversary no longer waits for verify and review (card flow-adversary-parallel, 2026-10-07): waiting
@@ -2179,7 +2213,7 @@ async function runChecks(task, impl, pass, baseBranch, ctx) {
     // integration still needs all three verdicts (isReady), and the ledger reads each stage's findings.
     if (withAdversary) {
       stages.push(...advStages)
-      adv = (pair && pair[1 + crew.reviewers]) || null
+      adv = (pair && pair[crew.testers + crew.reviewers]) || null
       stageResults.adversary = adv
     }
     blockingStage = !(ver && ver.passed) ? 'verify' : !(rev && rev.approve) ? 'review' : adversaryBlocked(adv) ? 'adversary' : null
@@ -2187,7 +2221,13 @@ async function runChecks(task, impl, pass, baseBranch, ctx) {
     const first = c.blocking || 'verify'
     if (first === 'verify') {
       stages.push('verify')
-      ver = await launch(verifyPrompt(task, impl, baseBranch), agentOpts('verify', task, { label: `verify:${task.id}${suffix}`, phase: 'Verify', agentType: 'doug-flow:verifier', schema: VERIFY_SCHEMA }))
+      const testers = crewOf(task).testers
+      for (let seat = 2; seat <= testers; seat++) stages.push(`verify-${seat}`)
+      const verifyOpts = seat => agentOpts('verify', task, { label: `verify${seat > 1 ? `-${seat}` : ''}:${task.id}${suffix}`, phase: 'Verify', agentType: 'doug-flow:verifier', schema: VERIFY_SCHEMA })
+      if (testers > 1) {
+        const seats = await parallel(Array.from({ length: testers }, (_, i) => () => launch(verifyPrompt(task, impl, baseBranch, i + 1), verifyOpts(i + 1))))
+        ver = mergeVerifies(seats || [])
+      } else ver = await launch(verifyPrompt(task, impl, baseBranch), verifyOpts(1))
       stageResults.verify = ver
       if (!(ver && ver.passed)) blockingStage = 'verify'
     } else if (first === 'review') {
@@ -2422,7 +2462,7 @@ async function runTask(task, baseBranch, resume) {
     const fellBack = (r.stages || []).includes('adversary-fallback')
     const crew = crewOf(task)
     const advAgents = adversaryRequired(task) ? (fellBack ? 1 : 0) + crew.adversaries : 0
-    const firstStage = blocking === 'adversary' ? advAgents : blocking === 'review' ? crew.reviewers : 1
+    const firstStage = blocking === 'adversary' ? advAgents : blocking === 'review' ? crew.reviewers : blocking === 'verify' ? crew.testers : 1
     const nextStages = firstStage + (blocking === 'check' ? 0 : 1) + (blocking === 'adversary' ? 0 : advAgents)
     const spent = measure()
     const passesDone = attempts.length

package/node_modules/@dougharness/gates/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "doug-gates",
   "displayName": "Doug Gates",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Deterministic guardrails for Claude Code: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, a verification gate on Stop and on SubagentStop, a snapshot of the plan and session into the anchor before compaction and re-anchoring after it, and a run trace of subagents and tool calls. Configured by .doug/config.json.",
   "author": {
     "name": "Doug contributors"

package/node_modules/@dougharness/gates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/gates",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "private": true,
   "description": "Deterministic Claude Code hooks: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, stop gate, re-anchor after compaction.",
   "type": "module",