@dougharness/cli 1.2.0 → 1.4.0

package/node_modules/@dougharness/flow/workflows/doug-implement.js

@@ -4,7 +4,7 @@ export const meta = {
   whenToUse: 'After /doug-plan produced .doug/plan.json and the user approved it with /doug-approve. Pass the plan JSON as args.',
   phases: [
     { title: 'Implement', detail: 'one implementer per task, fresh context, own worktree (with swarm on, a lead splits a full-shape task into worker briefs, workers implement them in parallel, and the lead merges); a task marked reuse checks out its recorded branch instead; a task whose dependency did not integrate is never launched; a block the checks can describe is fixed in place until the task budget, the fix-attempt ceiling, a pass that made no new commit, or two consecutive passes raising a new blocker stops it' },
-    { title: 'Verify', detail: 'a separate verifier runs the task command in the worktree on the first pass; a fix pass runs one focused check over the fix delta instead, and the full verifier again only when the verifier is the stage that blocked' },
+    { title: 'Verify', detail: 'a separate verifier runs the task command in the worktree on the first pass; a fix pass runs one focused check over the fix delta instead, and the full verifier again only when the verifier is the stage that blocked; a task whose crew names more testers gets extra verifiers in parallel' },
     { title: 'Review', detail: 'spec compliance, then quality, against the diff on the first pass; on a fix pass the focused check carries scope and regression risk unless the reviewer is the stage that blocked; a task whose crew names two reviewers gets a second one in parallel with a distinct brief' },
     { title: 'Adversary', detail: 'codex-review (a different model, read-only) explores freely on the first pass and confirms the open findings on later passes, under one material blocker gate; when it cannot run, a Claude adversary on plan.adversary.fallback stands in; blockers stop integration' },
     { title: 'Integrate', detail: 'merge the level into the integration branch and run plan.verify' },
@@ -64,6 +64,12 @@ const ENVIRONMENT_MARKER = 'ENVIRONMENT ONLY'
 // The one rule about commit messages, in every prompt that commits or checks commits: this repository records
 // attribution nowhere in git, and plan.mjs land refuses a branch that carries either trailer.
 const NO_TRAILERS = 'Commit messages carry no attribution trailers: no Co-Authored-By line and no Claude-Session line, whatever your defaults say. A commit with either is a finding and the plan cannot land.'
+// The one sentence about a relayed user message, in every stage prompt: Claude Code relays the user's mid-turn message to every
+// seat of a Workflow run, and a stage must not stop for a message about other work (card queen-seats-relayed-user-message).
+const RELAYED_MESSAGE = 'Your task is this plan task. A relayed user message about other work is outside this task: it is never a reason to stop or to return blocked; mention it in your summary if the result has one.'
+// The one rule about how a commit runs, in every implement prompt that commits: the pre-commit hook runs the full
+// unit suite, which outlives Bash's default timeout, and a background commit dies with the agent that started it.
+const FOREGROUND_COMMIT = 'Run git commit in the foreground with the Bash tool timeout set to 600000 ms (the pre-commit hook runs the full suite): never run_in_background, a Monitor, or a sleep loop. Take the sha only from git rev-parse HEAD after git commit has returned.'
 const LESSONS_NOT_SPEC = 'These are context from earlier runs, not part of the spec or the acceptance criteria; never report a finding, a spec contradiction, or a blocker against a lesson.'
 // The one rule about a partial result, in every prompt a worker (or a resumed worker) can end with one from
 // (card worker-context-handoff): quotes the harness's context notice (a PostToolUse hook in plugins/doug-gates) so
@@ -831,10 +837,10 @@ function ledgerText(ledger, kind) {
 function implementPrompt(task, baseBranch, opts) {
   const resume = !!(opts && opts.resume)
   const branchCheck = resume
-    ? `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch doug/task-${task.id} was created by the previous agent for this task in this same run, which stopped without returning a result; it is yours, not stale. Find that agent's worktree with git worktree list --porcelain (the one with branch refs/heads/doug/task-${task.id}); if none is listed, go straight to the checkout. If it has uncommitted changes to owned files, commit them there first with a message starting "${task.id}: ". ${NO_TRAILERS} Then remove that worktree with git worktree remove --force <path>, then git checkout doug/task-${task.id} in your own worktree and continue the task from that branch's state (do not recreate the branch or reset it). Never return blocked for the branch existing.`
+    ? `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch doug/task-${task.id} was created by the previous agent for this task in this same run, which stopped without returning a result; it is yours, not stale. Find that agent's worktree with git worktree list --porcelain (the one with branch refs/heads/doug/task-${task.id}); if none is listed, go straight to the checkout. If it has uncommitted changes to owned files, commit them there first with a message starting "${task.id}: ". ${NO_TRAILERS} ${FOREGROUND_COMMIT} Then remove that worktree with git worktree remove --force <path>, then git checkout doug/task-${task.id} in your own worktree and continue the task from that branch's state (do not recreate the branch or reset it). Never return blocked for the branch existing.`
     : `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch is a leftover of an earlier run: do not check it out or build on it; change nothing and return blocked=true with blockedReason "stale branch doug/task-${task.id} already exists; run plan.mjs replan, which renames it".`
   return [
-    `You are implementing exactly one task from an approved plan. Work only in your own git worktree.`,
+    `You are implementing exactly one task from an approved plan. Work only in your own git worktree. ${RELAYED_MESSAGE}`,
     ``,
     `Plan: ${plan.title}`,
     `Goal: ${plan.goal}`,
@@ -854,7 +860,7 @@ function implementPrompt(task, baseBranch, opts) {
     `   A fresh worktree has no installed dependencies: if the verification command needs them, run the project's install command first${plan.install ? ` (${plan.install})` : ''}. Installing is not a file change you own; do not commit lockfile changes it makes.`,
     `2. Touch no file outside your owned list. If the task cannot be done without another file, stop and report blocked=true with the reason.`,
     `3. Run the verification command before finishing and report each command with its real exit status. Never report a command you did not run.`,
-    `4. Commit your work on the branch with a message starting "${task.id}: ". ${NO_TRAILERS}`,
+    `4. Commit your work on the branch with a message starting "${task.id}: ". ${NO_TRAILERS} ${FOREGROUND_COMMIT}`,
     `5. Return the structured result. filesTouched must come from git, not memory, and commit must be the output of git rev-parse HEAD in your worktree after that commit.`,
     `6. ${PARTIAL_RULE}`,
   ].join('\n')
@@ -862,7 +868,7 @@ function implementPrompt(task, baseBranch, opts) {
 
 function reusePrompt(task, baseBranch) {
   return [
-    `You are starting a task from a branch that already passed verification, review, and the adversary on an earlier pass of this plan. Do not implement anything and do not edit any file; the checks run again on this branch after you.`,
+    `You are starting a task from a branch that already passed verification, review, and the adversary on an earlier pass of this plan. Do not implement anything and do not edit any file; the checks run again on this branch after you. ${RELAYED_MESSAGE}`,
     ``,
     `Plan: ${plan.title}`,
     `Task ${task.id}: ${task.title}`,
@@ -885,10 +891,10 @@ function reusePrompt(task, baseBranch) {
 function leadPrompt(task, baseBranch, opts) {
   const resume = !!(opts && opts.resume)
   const branchCheck = resume
-    ? `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch doug/task-${task.id} was created by the previous agent for this task in this same run, which stopped without returning a result; it is yours, not stale. Find that agent's worktree with git worktree list --porcelain (the one with branch refs/heads/doug/task-${task.id}); if none is listed, go straight to the checkout. If it has uncommitted changes to owned files, commit them there first with a message starting "${task.id}: ". ${NO_TRAILERS} Then remove that worktree with git worktree remove --force <path>, then git checkout doug/task-${task.id} in your own worktree and continue the task from that branch's state (do not recreate the branch or reset it). Never return blocked for the branch existing.`
+    ? `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch doug/task-${task.id} was created by the previous agent for this task in this same run, which stopped without returning a result; it is yours, not stale. Find that agent's worktree with git worktree list --porcelain (the one with branch refs/heads/doug/task-${task.id}); if none is listed, go straight to the checkout. If it has uncommitted changes to owned files, commit them there first with a message starting "${task.id}: ". ${NO_TRAILERS} ${FOREGROUND_COMMIT} Then remove that worktree with git worktree remove --force <path>, then git checkout doug/task-${task.id} in your own worktree and continue the task from that branch's state (do not recreate the branch or reset it). Never return blocked for the branch existing.`
     : `   Before that, if git rev-parse --verify --quiet refs/heads/doug/task-${task.id} succeeds, the branch is a leftover of an earlier run: do not check it out or build on it; change nothing and return blocked=true with blockedReason "stale branch doug/task-${task.id} already exists; run plan.mjs replan, which renames it".`
   return [
-    `You are the lead of a swarm for exactly one task of an approved plan. You split the task into worker briefs; you do not implement anything and you edit no file. Work only in your own git worktree.`,
+    `You are the lead of a swarm for exactly one task of an approved plan. You split the task into worker briefs; you do not implement anything and you edit no file. Work only in your own git worktree. ${RELAYED_MESSAGE}`,
     ``,
     `Plan: ${plan.title}`,
     `Goal: ${plan.goal}`,
@@ -920,7 +926,7 @@ function workerPrompt(task, brief, n, lead) {
   // to and what is not its business; the task it belongs to still owns only the files its own brief lists below.
   const siblings = (Array.isArray(lead.briefs) ? lead.briefs : []).filter(b => b.id !== brief.id)
   return [
-    `You are worker ${n} of a swarm implementing one part of task ${task.id} from an approved plan. You get one brief, the files it owns, and a verification command; the other parts are other workers' business. Work only in your own git worktree.`,
+    `You are worker ${n} of a swarm implementing one part of task ${task.id} from an approved plan. You get one brief, the files it owns, and a verification command; the other parts are other workers' business. Work only in your own git worktree. ${RELAYED_MESSAGE}`,
     ``,
     `Plan: ${plan.title}`,
     `Goal: ${plan.goal}`,
@@ -944,7 +950,7 @@ function workerPrompt(task, brief, n, lead) {
     `   A fresh worktree has no installed dependencies: if the verification command needs them, run the project's install command first${plan.install ? ` (${plan.install})` : ''}. Installing is not a file change you own; do not commit lockfile changes it makes.`,
     `2. Touch no file outside your owned list. If the brief cannot be done without another file, stop and report blocked=true with a blockedReason that names exactly what you need - the file, the symbol or interface, or the decision - because the lead may re-brief you once on it; a vague reason wastes that chance.`,
     `3. Run the verification command before finishing and report each command with its real exit status. Never report a command you did not run.`,
-    `4. Commit your work on the branch with a message starting "${task.id}: w${n} ". ${NO_TRAILERS}`,
+    `4. Commit your work on the branch with a message starting "${task.id}: w${n} ". ${NO_TRAILERS} ${FOREGROUND_COMMIT}`,
     `5. Return the structured result. filesTouched must come from git diff --name-only ${lead.branch}...HEAD, and commit must be the output of git rev-parse HEAD in your worktree after that commit.`,
     `6. ${PARTIAL_RULE}`,
   ].join('\n')
@@ -955,7 +961,7 @@ function workerPrompt(task, brief, n, lead) {
 // left an orphan - it defaults to `workers` for the plain, no-rebrief case where the two are the same list.
 function leadMergePrompt(task, lead, workers, baseBranch, allWorkers = workers) {
   return [
-    `You are the lead of the swarm for task ${task.id}. The workers have committed; merge their branches into the task branch and hand it to the checks. Work only in the git worktree you were started in, on branch ${lead.branch}, and never edit anything under the repository root. The lead's worktree (${lead.worktreePath}) may have been removed, so do not cd into it. First git checkout ${lead.branch} there; if git refuses because the branch is checked out in another worktree, that worktree is a leftover under .claude/worktrees: find it with git worktree list --porcelain, remove it with git worktree remove --force <path>, and check out again. If the branch does not exist, create it from ${baseBranch} with git checkout -b ${lead.branch} ${baseBranch} (the lead commits nothing, so the task branch is the base).`,
+    `You are the lead of the swarm for task ${task.id}. The workers have committed; merge their branches into the task branch and hand it to the checks. Work only in the git worktree you were started in, on branch ${lead.branch}, and never edit anything under the repository root. The lead's worktree (${lead.worktreePath}) may have been removed, so do not cd into it. First git checkout ${lead.branch} there; if git refuses because the branch is checked out in another worktree, that worktree is a leftover under .claude/worktrees: find it with git worktree list --porcelain, remove it with git worktree remove --force <path>, and check out again. If the branch does not exist, create it from ${baseBranch} with git checkout -b ${lead.branch} ${baseBranch} (the lead commits nothing, so the task branch is the base). ${RELAYED_MESSAGE}`,
     PARTIAL_NEVER_MERGED,
     ``,
     `Task ${task.id}: ${task.title}`,
@@ -982,7 +988,7 @@ function leadMergePrompt(task, lead, workers, baseBranch, allWorkers = workers)
 function leadRebriefPrompt(task, lead, workers, blockedWorkers) {
   const finished = workers.filter(w => !w.blocked)
   return [
-    `You are the lead of the swarm for task ${task.id}. One or more workers are blocked; you get one chance to re-brief the unfinished pieces. You implement nothing and edit no file. Work read-only from the repository root you were started in. Do not cd into the lead's worktree (it may have been removed), create no branch, and edit nothing. Read a finished worker's committed files with \`git show <commit>:<path>\` or \`git show <commit>\`.`,
+    `You are the lead of the swarm for task ${task.id}. One or more workers are blocked; you get one chance to re-brief the unfinished pieces. You implement nothing and edit no file. Work read-only from the repository root you were started in. Do not cd into the lead's worktree (it may have been removed), create no branch, and edit nothing. Read a finished worker's committed files with \`git show <commit>:<path>\` or \`git show <commit>\`. ${RELAYED_MESSAGE}`,
     ``,
     `Plan: ${plan.title}`,
     `Goal: ${plan.goal}`,
@@ -1017,7 +1023,7 @@ function fixPrompt(task, r, pass, baseBranch, ledger, brief) {
     ? `Work only in the git worktree you were started in, on branch ${r.impl.branch}: the task's earlier worktree (${r.impl.worktreePath}) was removed when its level integrated. First run git checkout ${r.impl.branch} there; if git refuses because the branch is checked out in another worktree, that worktree is a leftover under .claude/worktrees: find it with git worktree list --porcelain, remove it with git worktree remove --force <path>, and check out again. Create no branch, and never edit anything under the repository root.`
     : `Work only in the existing worktree ${r.impl.worktreePath} on branch ${r.impl.branch}: cd there first, create no worktree and no branch, and never edit anything under the repository root.`
   const lines = [
-    `You are fixing your own task after its checks blocked it. This is fix attempt ${pass - 1} of ${fixAttempts} for task ${task.id}. ${where}`,
+    `You are fixing your own task after its checks blocked it. This is fix attempt ${pass - 1} of ${fixAttempts} for task ${task.id}. ${where} ${RELAYED_MESSAGE}`,
     ``,
     `Plan: ${plan.title}`,
     `Task ${task.id}: ${task.title}`,
@@ -1048,7 +1054,7 @@ function fixPrompt(task, r, pass, baseBranch, ledger, brief) {
   lines.push(`1. Touch no file outside your owned list. If a finding can only be met by changing another file, stop and return blocked=true with the reason.`)
   lines.push(`2. Do not delete, skip, or weaken any test to make a check pass; make the code satisfy it. If that is impossible within the spec, return blocked=true and say why.`)
   lines.push(`3. Run the verification command before finishing; it must pass. Report every command with its real exit status and never one you did not run.`)
-  lines.push(`4. Commit on ${r.impl.branch} with a message starting "${task.id}: fix ". Do not amend or rewrite earlier commits. A pass that ends with no new commit stops the task. ${NO_TRAILERS}`)
+  lines.push(`4. Commit on ${r.impl.branch} with a message starting "${task.id}: fix ". Do not amend or rewrite earlier commits. A pass that ends with no new commit stops the task. ${NO_TRAILERS} ${FOREGROUND_COMMIT}`)
   lines.push(`5. Return the structured result with taskId="${task.id}", branch="${r.impl.branch}", worktreePath${r.worktreeGone ? ' = the absolute path of your worktree (git rev-parse --show-toplevel)' : `="${r.impl.worktreePath}"`}, filesTouched from git diff --name-only ${baseBranch}...HEAD, commit from git rev-parse HEAD after your commit, blocked=false.`)
   lines.push(`6. ${PARTIAL_RULE}`)
   return lines.join('\n')
@@ -1065,7 +1071,7 @@ function resumePrompt(task, prev, handoff, baseBranch, brief) {
   const completed = (Array.isArray(handoff.completed) ? handoff.completed : []).join('; ') || '(none)'
   const remaining = (Array.isArray(handoff.remaining) ? handoff.remaining : []).join('; ')
   return [
-    `You are resuming ${who} after the previous worker stopped partway through at the harness's context notice. Work only in the existing worktree ${prev.worktreePath} on branch ${prev.branch}: cd there first, create no worktree and no branch, and never edit anything under the repository root.`,
+    `You are resuming ${who} after the previous worker stopped partway through at the harness's context notice. Work only in the existing worktree ${prev.worktreePath} on branch ${prev.branch}: cd there first, create no worktree and no branch, and never edit anything under the repository root. ${RELAYED_MESSAGE}`,
     ``,
     `Plan: ${plan.title}`,
     brief ? `Brief ${brief.id}: ${brief.title}` : `Task ${task.id}: ${task.title}`,
@@ -1081,7 +1087,7 @@ function resumePrompt(task, prev, handoff, baseBranch, brief) {
     `Rules:`,
     `1. Touch no file outside your owned list. If the work cannot be done without another file, stop and report blocked=true with the reason.`,
     `2. Run the verification command before finishing and report each command with its real exit status. Never report a command you did not run.`,
-    `3. Commit your work on ${prev.branch} with a message starting "${task.id}: resume ". ${NO_TRAILERS}`,
+    `3. Commit your work on ${prev.branch} with a message starting "${task.id}: resume ". ${NO_TRAILERS} ${FOREGROUND_COMMIT}`,
     `4. ${PARTIAL_RULE}`,
     `5. Return the structured result. filesTouched must come from git diff --name-only ${baseBranch}...HEAD, and commit must be the output of git rev-parse HEAD in your worktree after that commit.`,
   ].join('\n')
@@ -1101,7 +1107,7 @@ function supervisePrompt(task, r, attempts, ledger, signals) {
     ].join('\n')
   })
   return [
-    `You are the supervisor of task ${task.id}'s fix loop. The loop is stalled: ${stalls.join('; ')}. Read the passes and the ledger below and write a brief for the next fix pass: what was tried, what failed each time, and two or three alternative directions drawn from this evidence, each different from what the passes tried.`,
+    `You are the supervisor of task ${task.id}'s fix loop. The loop is stalled: ${stalls.join('; ')}. Read the passes and the ledger below and write a brief for the next fix pass: what was tried, what failed each time, and two or three alternative directions drawn from this evidence, each different from what the passes tried. ${RELAYED_MESSAGE}`,
     ``,
     `Plan: ${plan.title}`,
     `Task ${task.id}: ${task.title}`,
@@ -1125,9 +1131,10 @@ function supervisePrompt(task, r, attempts, ledger, signals) {
   ].join('\n')
 }
 
-function verifyPrompt(task, impl, baseBranch) {
+function verifyPrompt(task, impl, baseBranch, seat = 1) {
   return [
-    `You are a verifier. You did not write this code. Your job is to run it, not to read and approve it.`,
+    `You are a verifier. You did not write this code. Your job is to run it, not to read and approve it. ${RELAYED_MESSAGE}`,
+    ...(seat > 1 ? [`You are crew seat ${seat} of ${crewOf(task).testers} on this task: another verifier runs the same checks at the same time. Run the verification and acceptance commands yourself, and beyond them probe the behavior the spec implies that those commands may not cover: edge cases (empty, missing, boundary, and repeated input) and error paths (invalid input, a failing dependency). A defect you find is a finding even when every command passes.`] : []),
     ``,
     `Task ${task.id}: ${task.title}`,
     `Spec:`,
@@ -1160,7 +1167,7 @@ function verifyPrompt(task, impl, baseBranch) {
 function checkPrompt(task, impl, prevCommit, baseBranch, ledger) {
   const open = ledgerText(ledger, 'open')
   return [
-    `You are the single check on a fix pass for task ${task.id}. You did not write this code. The full verifier and reviewer already ran on an earlier pass, so your job is to run the commands again and to read only what the fix changed.`,
+    `You are the single check on a fix pass for task ${task.id}. You did not write this code. The full verifier and reviewer already ran on an earlier pass, so your job is to run the commands again and to read only what the fix changed. ${RELAYED_MESSAGE}`,
     ``,
     `Task ${task.id}: ${task.title}`,
     `Spec:`,
@@ -1194,7 +1201,7 @@ function checkPrompt(task, impl, prevCommit, baseBranch, ledger) {
 // The one check of a size-S task: the verifier's job and the reviewer's job in one agent on the verify row.
 function sizeCheckPrompt(task, impl, baseBranch) {
   return [
-    `You are the one check on size-S task ${task.id}: the verifier's job and the reviewer's job in one pass. You did not write this code. Run it, then read the diff ${baseBranch}...${impl.branch}. No separate verifier, reviewer, or adversary runs for this task; the adversary reviews the level's S tasks together on the integration branch after the merge, so what you miss reaches it.`,
+    `You are the one check on size-S task ${task.id}: the verifier's job and the reviewer's job in one pass. You did not write this code. Run it, then read the diff ${baseBranch}...${impl.branch}. No separate verifier, reviewer, or adversary runs for this task; the adversary reviews the level's S tasks together on the integration branch after the merge, so what you miss reaches it. ${RELAYED_MESSAGE}`,
     ``,
     `Task ${task.id}: ${task.title}`,
     `Spec:`,
@@ -1245,7 +1252,7 @@ function levelAdversaryPrompt(li, sReady, levelBase, confirming) {
     `DOUG_SPEC_EOF`,
   ].join('\n')
   return [
-    `Run the adversarial reviewer for level ${li} of the plan (its size-S tasks, merged on ${integrationBranch}) and relay its verdict. Do not review the code yourself and do not edit anything.`,
+    `Run the adversarial reviewer for level ${li} of the plan (its size-S tasks, merged on ${integrationBranch}) and relay its verdict. Do not review the code yourself and do not edit anything. ${RELAYED_MESSAGE}`,
     ``,
     `Run exactly this command with the Bash tool from the repository root (it pipes the spec on stdin; the timeout is ${adversary.timeoutMs} ms, so set the tool timeout at least that high):`,
     '```',
@@ -1261,7 +1268,7 @@ function levelAdversaryPrompt(li, sReady, levelBase, confirming) {
 function levelFallbackAdversaryPrompt(li, sReady, levelBase, why, confirming) {
   // Same scope as levelAdversaryPrompt (card flow-fallback-verify-scope): no verify list, the suite already ran at integrate.
   return [
-    `You are the adversarial reviewer for level ${li} of plan "${plan.title}", standing in for codex-review, which could not run (${why}). The size-S tasks below were merged into ${integrationBranch} with one focused check each and no adversary of their own. Your job is to refute them together, in worktree ${INTEGRATION_WORKTREE} (relative to the repository root); the diff is ${levelBase}...${integrationBranch}.`,
+    `You are the adversarial reviewer for level ${li} of plan "${plan.title}", standing in for codex-review, which could not run (${why}). The size-S tasks below were merged into ${integrationBranch} with one focused check each and no adversary of their own. Your job is to refute them together, in worktree ${INTEGRATION_WORKTREE} (relative to the repository root); the diff is ${levelBase}...${integrationBranch}. ${RELAYED_MESSAGE}`,
     ``,
     ...levelSpecLines(sReady),
     `Plan acceptance criteria:`,
@@ -1284,7 +1291,7 @@ function levelFallbackAdversaryPrompt(li, sReady, levelBase, why, confirming) {
 // reviewer reading spec line by line is likely to miss, so two reviewers do not file the same finding twice.
 function reviewPrompt(task, impl, baseBranch, seat = 1) {
   return [
-    `You are a reviewer. Review the diff ${baseBranch}...${impl.branch} in worktree ${impl.worktreePath} against the task spec. Two passes: spec compliance first, then quality. ${baseBranch} is this branch's base (an integration branch when the task follows an earlier level); files that already exist there are not this task's changes.`,
+    `You are a reviewer. Review the diff ${baseBranch}...${impl.branch} in worktree ${impl.worktreePath} against the task spec. Two passes: spec compliance first, then quality. ${baseBranch} is this branch's base (an integration branch when the task follows an earlier level); files that already exist there are not this task's changes. ${RELAYED_MESSAGE}`,
     ...(seat > 1 ? [
       ``,
       `You are reviewer ${seat} of ${seat}: another reviewer is reading this diff at the same time with the standard brief and will check the spec sentence by sentence and the owned-file list. Do not repeat that work. Concentrate on what a first reviewer is likely to miss: behavior on inputs the spec does not name, a test that passes for the wrong reason or asserts less than its name says, error paths and partial failure, concurrency and ordering, a call site elsewhere in the repository that the change silently breaks, and anything the spec implies but does not state. File only what you have shown; your findings are merged with the other reviewer's, and a duplicate collapses to one entry.`,
@@ -1346,7 +1353,7 @@ function adversaryPrompt(task, impl, baseBranch, pass, ledger) {
     `DOUG_SPEC_EOF`,
   ].join('\n')
   return [
-    `Run the adversarial reviewer for task ${task.id} and relay its verdict. Do not review the code yourself and do not edit anything.`,
+    `Run the adversarial reviewer for task ${task.id} and relay its verdict. Do not review the code yourself and do not edit anything. ${RELAYED_MESSAGE}`,
     ``,
     `Run exactly this command with the Bash tool (it pipes the spec on stdin; the timeout is ${adversary.timeoutMs} ms, so set the tool timeout at least that high):`,
     '```',
@@ -1394,7 +1401,7 @@ function fallbackAdversaryPrompt(task, impl, baseBranch, why, pass, ledger) {
   // Same scope as adversaryPrompt's Codex seat (card flow-fallback-verify-scope): the task's own verify only, not plan.verify.
   const verify = [task.verify].filter(Boolean)
   return [
-    `You are the adversarial reviewer for task ${task.id}, standing in for codex-review, which could not run (${why}). Your job is to refute the change on branch ${impl.branch} in worktree ${impl.worktreePath}; the diff is ${baseBranch}...${impl.branch}. ${baseBranch} is this branch's base (an integration branch when the task follows an earlier level); files that already exist there are not this task's changes. Do not edit any file.`,
+    `You are the adversarial reviewer for task ${task.id}, standing in for codex-review, which could not run (${why}). Your job is to refute the change on branch ${impl.branch} in worktree ${impl.worktreePath}; the diff is ${baseBranch}...${impl.branch}. ${baseBranch} is this branch's base (an integration branch when the task follows an earlier level); files that already exist there are not this task's changes. Do not edit any file. ${RELAYED_MESSAGE}`,
     ``,
     `Task ${task.id}: ${task.title}`,
     `Spec:`,
@@ -1425,7 +1432,7 @@ function integratePrompt(levelIndex, results, baseBranch, isLastLevel, keepWorkt
   const branches = results.map(r => r.impl.branch)
   const worktrees = results.map(r => r.impl.worktreePath)
   return [
-    `You are the integration owner for level ${levelIndex} of plan "${plan.title}".`,
+    `You are the integration owner for level ${levelIndex} of plan "${plan.title}". ${RELAYED_MESSAGE}`,
     `Integration branch: ${integrationBranch}. Never check it out in the user's main working tree; use a dedicated worktree so the user's checkout is left exactly as it was.`,
     PARTIAL_NEVER_MERGED,
     `Merge these task branches into it, in this order: ${branches.join(', ')}.`,
@@ -1990,13 +1997,41 @@ async function runAdversary(task, impl, pass, baseBranch, ledger, launch, stages
 }
 
 // ---- Crew (card crew-sizing) ---------------------------------------------------
-// A task (or the plan) declares how many reviewers and adversaries read it; default one each. More coders is a
+// A task (or the plan) declares how many reviewers, adversaries and testers read it; default one each. More coders is a
 // split into more tasks, never a shared worktree, so the crew has no coders row. Researchers run before planning
 // (the research skill) and are not launched here.
 function crewOf(task) {
   const src = { ...((plan.crew && typeof plan.crew === 'object') ? plan.crew : {}), ...((task && task.crew && typeof task.crew === 'object') ? task.crew : {}) }
   const n = v => (Number.isInteger(v) && v > 0 ? v : 1)
-  return { reviewers: n(src.reviewers), adversaries: n(src.adversaries) }
+  return { reviewers: n(src.reviewers), adversaries: n(src.adversaries), testers: n(src.testers) }
+}
+
+// One verification out of several tester seats (card crew-tester-seat): passed only when every seat that returned
+// passed, findings and commands concatenated so the ledger's fingerprint collapses a duplicate, and an acceptance
+// criterion (matched by text) ok only when every seat reporting it ok. A seat that returned nothing is dropped; when
+// no seat returned anything the stage returned nothing; one seat comes back unchanged.
+function mergeVerifies(seats) {
+  const got = seats.filter(Boolean)
+  if (!got.length) return null
+  if (got.length === 1 && seats.length === 1) return got[0]
+  const acceptance = []
+  for (const v of got) {
+    for (const a of (v.acceptance || [])) {
+      const at = acceptance.findIndex(x => x.text === a.text)
+      if (at < 0) acceptance.push({ ...a })
+      else if (acceptance[at].ok && !a.ok) acceptance[at] = { ...a }
+    }
+  }
+  return {
+    taskId: got[0].taskId,
+    passed: got.every(v => v.passed),
+    commandsRun: got.flatMap(v => v.commandsRun || []),
+    findings: got.flatMap(v => v.findings || []),
+    findingFiles: got.flatMap(v => v.findingFiles || []),
+    acceptance,
+    head: got[0].head,
+    seats: got.length,
+  }
 }
 
 // One review out of several: every seat must approve, and every seat's issues are kept, so a finding one reviewer
@@ -2159,19 +2194,21 @@ async function runChecks(task, impl, pass, baseBranch, ctx) {
     // The verifier, the reviewer, and the adversary are read-only and none reads another's result, so a first pass
     // launches them together; a null from any (skipped, or dead after retries) is that stage returning nothing.
     stages.push('verify')
-    stages.push('review')
     const crew = crewOf(task)
+    for (let seat = 2; seat <= crew.testers; seat++) stages.push(`verify-${seat}`)
+    stages.push('review')
     for (let seat = 2; seat <= crew.reviewers; seat++) stages.push(`review-${seat}`)
     const withAdversary = adversaryRequired(task)
     const advStages = []
     const pair = await parallel([
       () => launch(verifyPrompt(task, impl, baseBranch), agentOpts('verify', task, { label: `verify:${task.id}`, phase: 'Verify', agentType: 'doug-flow:verifier', schema: VERIFY_SCHEMA })),
+      ...Array.from({ length: crew.testers - 1 }, (_, i) => () => launch(verifyPrompt(task, impl, baseBranch, i + 2), agentOpts('verify', task, { label: `verify-${i + 2}:${task.id}`, phase: 'Verify', agentType: 'doug-flow:verifier', schema: VERIFY_SCHEMA }))),
       () => launch(reviewPrompt(task, impl, baseBranch), agentOpts('review', task, { label: `review:${task.id}`, phase: 'Review', agentType: 'doug-flow:reviewer', schema: REVIEW_SCHEMA })),
       ...Array.from({ length: crew.reviewers - 1 }, (_, i) => () => launch(reviewPrompt(task, impl, baseBranch, i + 2), agentOpts('review', task, { label: `review-${i + 2}:${task.id}`, phase: 'Review', agentType: 'doug-flow:reviewer', schema: REVIEW_SCHEMA }))),
       ...(withAdversary ? [() => runAdversaryCrew(task, impl, pass, baseBranch, ledger, launch, advStages)] : []),
     ])
-    ver = (pair && pair[0]) || null
-    rev = pair ? mergeReviews(pair.slice(1, 1 + crew.reviewers)) : null
+    ver = pair ? mergeVerifies(pair.slice(0, crew.testers)) : null
+    rev = pair ? mergeReviews(pair.slice(crew.testers, crew.testers + crew.reviewers)) : null
     stageResults.verify = ver
     stageResults.review = rev
     // The adversary no longer waits for verify and review (card flow-adversary-parallel, 2026-10-07): waiting
@@ -2179,7 +2216,7 @@ async function runChecks(task, impl, pass, baseBranch, ctx) {
     // integration still needs all three verdicts (isReady), and the ledger reads each stage's findings.
     if (withAdversary) {
       stages.push(...advStages)
-      adv = (pair && pair[1 + crew.reviewers]) || null
+      adv = (pair && pair[crew.testers + crew.reviewers]) || null
       stageResults.adversary = adv
     }
     blockingStage = !(ver && ver.passed) ? 'verify' : !(rev && rev.approve) ? 'review' : adversaryBlocked(adv) ? 'adversary' : null
@@ -2187,7 +2224,13 @@ async function runChecks(task, impl, pass, baseBranch, ctx) {
     const first = c.blocking || 'verify'
     if (first === 'verify') {
       stages.push('verify')
-      ver = await launch(verifyPrompt(task, impl, baseBranch), agentOpts('verify', task, { label: `verify:${task.id}${suffix}`, phase: 'Verify', agentType: 'doug-flow:verifier', schema: VERIFY_SCHEMA }))
+      const testers = crewOf(task).testers
+      for (let seat = 2; seat <= testers; seat++) stages.push(`verify-${seat}`)
+      const verifyOpts = seat => agentOpts('verify', task, { label: `verify${seat > 1 ? `-${seat}` : ''}:${task.id}${suffix}`, phase: 'Verify', agentType: 'doug-flow:verifier', schema: VERIFY_SCHEMA })
+      if (testers > 1) {
+        const seats = await parallel(Array.from({ length: testers }, (_, i) => () => launch(verifyPrompt(task, impl, baseBranch, i + 1), verifyOpts(i + 1))))
+        ver = mergeVerifies(seats || [])
+      } else ver = await launch(verifyPrompt(task, impl, baseBranch), verifyOpts(1))
       stageResults.verify = ver
       if (!(ver && ver.passed)) blockingStage = 'verify'
     } else if (first === 'review') {
@@ -2422,7 +2465,7 @@ async function runTask(task, baseBranch, resume) {
     const fellBack = (r.stages || []).includes('adversary-fallback')
     const crew = crewOf(task)
     const advAgents = adversaryRequired(task) ? (fellBack ? 1 : 0) + crew.adversaries : 0
-    const firstStage = blocking === 'adversary' ? advAgents : blocking === 'review' ? crew.reviewers : 1
+    const firstStage = blocking === 'adversary' ? advAgents : blocking === 'review' ? crew.reviewers : blocking === 'verify' ? crew.testers : 1
     const nextStages = firstStage + (blocking === 'check' ? 0 : 1) + (blocking === 'adversary' ? 0 : advAgents)
     const spent = measure()
     const passesDone = attempts.length

package/node_modules/@dougharness/gates/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "doug-gates",
   "displayName": "Doug Gates",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "Deterministic guardrails for Claude Code: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, a verification gate on Stop and on SubagentStop, a snapshot of the plan and session into the anchor before compaction and re-anchoring after it, and a run trace of subagents and tool calls. Configured by .doug/config.json.",
   "author": {
     "name": "Doug contributors"

package/node_modules/@dougharness/gates/lib/baseline.mjs

@@ -323,3 +323,26 @@ export function turnTreeStatus(cfg, start, current) {
     return null;
   }
 }
+
+// card stop-gate-read-only-turn-commits: turnTreeStatus for a turn that moved HEAD. Applies only when every path
+// committed between the record's head and HEAD is on preCommit.noTestPaths (same match rule as turnTreeStatus),
+// and then compares the remaining code paths as if HEAD had not moved. Fails closed (null: the caller verifies)
+// on a missing, empty or malformed list, a record head that is not a plausible sha or not an ancestor of HEAD
+// (rewritten history), a git failure, an empty committed set, or any committed path off the list. Never throws.
+export function turnTreeStatusHeadMoved(dir, cfg, start, current) {
+  try {
+    if (!start || !current || typeof start !== "object" || typeof current !== "object") return null;
+    const list = cfg && cfg.preCommit && cfg.preCommit.noTestPaths;
+    if (!Array.isArray(list) || list.length === 0 || !list.every((e) => typeof e === "string" && e !== "")) return null;
+    if (typeof start.head !== "string" || !GIT_SHA_RE.test(start.head)) return null;
+    if (typeof current.head !== "string" || !GIT_SHA_RE.test(current.head) || start.head === current.head) return null;
+    execFileSync("git", ["merge-base", "--is-ancestor", start.head, current.head], { cwd: dir, stdio: "ignore", timeout: 5000 }); // throws on exit != 0
+    const committed = committedSince(dir, start.head);
+    if (!Array.isArray(committed) || committed.length === 0) return null;
+    if (!committed.every((p) => list.some((e) => (e.endsWith("/") ? p.startsWith(e) : p === e)))) return null;
+    const status = turnTreeStatus(cfg, start, { ...current, head: start.head });
+    return status ? { ...status, exact: false } : null;
+  } catch {
+    return null;
+  }
+}

package/node_modules/@dougharness/gates/lib/block-ledger.mjs

@@ -9,6 +9,7 @@
 import { appendFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { changedFiles } from "./baseline.mjs";
+import { scanText } from "./secret-rules.mjs";
 
 export const BLOCKS_RELPATH = ".doug/.state/blocks.jsonl";
 
@@ -121,7 +122,7 @@ export function failingTestFilesFrom(output, dir) {
 // blockStop call that carries it out (stop-gate.mjs), so an unguarded throw here would fail the *whole gate*
 // open — the one outcome every hook reader must never risk (CLAUDE.md gotchas). Any failure classifies as
 // 'real', the least specific label, rather than ever propagating.
-export function classifyFinalBlock({ preVerificationProblems, evidenceProblemAdded, commandFailures, postCommandProblems, results, redByDesignClaimFiles, changedAtStart, dir, budgetDeadline }) {
+export function classifyFinalBlock({ countProblems, totalProblems, preVerificationProblems, evidenceProblemAdded, commandFailures, postCommandProblems, results, redByDesignClaimFiles, changedAtStart, dir, budgetDeadline }) {
   try {
     const failures = Array.isArray(commandFailures) ? commandFailures : [];
     const namedByCommand = failures.map((cf) => failingTestFilesFrom(cf.output, dir));
@@ -140,9 +141,12 @@ export function classifyFinalBlock({ preVerificationProblems, evidenceProblemAdd
       if (allNamed.every((f) => claimSet.has(f))) return "expected-red";
     }
 
+    // card block-ledger-failing-output: the test-count ratchet is the block's only problem.
     const timedOutOrDropped = (Array.isArray(results) ? results : []).some((r) => r.timedOut || r.skipped === "budget");
     if (timedOutOrDropped && allNamed.length === 0) return "load-timeout";
 
+    if (typeof countProblems === "number" && countProblems > 0 && totalProblems === countProblems) return "test-count";
+
     if (Array.isArray(changedAtStart) && !(typeof budgetDeadline === "number" && Date.now() >= budgetDeadline)) {
       const changedNow = changedFiles(dir);
       if (Array.isArray(changedNow)) {
@@ -159,14 +163,47 @@ export function classifyFinalBlock({ preVerificationProblems, evidenceProblemAdd
   }
 }
 
-// Appends one line to .doug/.state/blocks.jsonl: { hook, at, agent, reason, class, session }. `reason` is
+// card block-ledger-failing-output: the last 40 lines of a command's output, secret-scanned (a hit records
+// "[redacted: <rule>]", a scanner throw "[redacted: scan-error]"; skipped when secrets.enabled === false),
+// then capped at 4096 UTF-8 bytes keeping the end, never splitting a character. Never throws.
+export function redactText(text, secrets) {
+  try {
+    if (!(secrets && secrets.enabled === false)) {
+      const hit = scanText(text, secrets || {});
+      if (hit) return "[redacted: " + hit.rule + "]";
+    }
+    return text;
+  } catch {
+    return "[redacted: scan-error]";
+  }
+}
+
+export function outputTail(output, secrets) {
+  try {
+    let tail = String(output ?? "").trimEnd().split("\n").slice(-40).join("\n");
+    tail = redactText(tail, secrets);
+    const buf = Buffer.from(tail, "utf8");
+    if (buf.length > 4096) {
+      let start = buf.length - 4096;
+      while (start < buf.length && (buf[start] & 0xc0) === 0x80) start++;
+      tail = buf.subarray(start).toString("utf8");
+    }
+    return tail;
+  } catch {
+    return "";
+  }
+}
+
+// Appends one line to .doug/.state/blocks.jsonl: { hook, at, agent, reason, class, session }, plus the keys of
+// `record` ({ failures, cwd, tree }, card block-ledger-failing-output) when it is a plain object. `reason` is
 // reduced to its own first line here (message.split("\n")[0]) whatever the caller passes, so a multi-line
 // block message never leaks past its headline into the ledger. Call synchronously, right before each
 // blockStop/systemMessage in stop-gate.mjs — those each call process.exit(0) themselves, so anything queued
 // after them never runs. Never throws: an unwritable .doug/.state, or a blocks.jsonl path that is itself a
 // directory, just skips the line silently; the gate's own decision is unaffected either way.
-export function appendBlockLine(dir, { hook, agent, reason, class: cls, session }) {
+export function appendBlockLine(dir, { hook, agent, reason, class: cls, session, record }) {
   try {
+    const plain = record && typeof record === "object" && !Array.isArray(record) ? record : {};
     const line =
       JSON.stringify({
         hook,
@@ -175,6 +212,7 @@ export function appendBlockLine(dir, { hook, agent, reason, class: cls, session
         reason: String(reason).split("\n")[0],
         class: cls,
         session: session ?? null,
+        ...plain,
       }) + "\n";
     mkdirSync(join(dir, ".doug/.state"), { recursive: true });
     appendFileSync(join(dir, BLOCKS_RELPATH), line);

package/node_modules/@dougharness/gates/lib/docs-gate.mjs

@@ -2,7 +2,8 @@
 // (.githooks/pre-commit). A changed docs/**/*.md file does not by itself run the suite. When every changed path
 // is on preCommit.noTestPaths or is a docs .md (and at least one is a docs .md not on the list), the tracked
 // test files whose text names that doc (its repo-relative path, or its basename, which also covers a
-// join("docs", "decisions", "<basename>") spelling) decide: none -> { kind: "skip" }; some -> { kind:
+// join("docs", "decisions", "<basename>") spelling) decide; non-test code outside a tests/ directory counts a
+// doc as named only by its full repo-relative path (a basename in a comment is ignored): none -> { kind: "skip" }; some -> { kind:
 // "targeted", files } (repo-relative, sorted). Anything else, or any doubt, returns null: run the full gate.
 // Never throws (a throw would reach runHook, which fails open and would skip the gate).
 // CLI (used by .githooks/pre-commit): staged paths on stdin, the config JSON in DOUG_NO_TEST_CONFIG, cwd =
@@ -34,7 +35,8 @@ function validList(cfg) {
 // -> sorted test files naming any of `docs`, or null (unreadable tree, or a file that cannot be mapped to test
 // files names a doc).
 function namingTests(dir, docs, tracked) {
-  const needles = [...new Set(docs.flatMap((d) => [d, basename(d)]))];
+  const pathNeedles = [...new Set(docs)];
+  const wideNeedles = [...new Set(docs.flatMap((d) => [d, basename(d)]))];
   const found = [];
   for (const f of tracked) {
     const isTest = TEST_FILE.test(f);
@@ -43,6 +45,8 @@ function namingTests(dir, docs, tracked) {
     if (!isTest && !underTests && !code) continue;
     if (f.startsWith("docs/")) continue;
     const text = readFileSync(join(dir, f), "utf8");
+    // code outside tests/ names a doc only by its full repo-relative path; tests and test helpers also by basename
+    const needles = isTest || underTests ? wideNeedles : pathNeedles;
     if (!needles.some((n) => text.includes(n))) continue;
     if (!isTest) return null; // a helper or source file reads the doc: cannot be mapped to test files
     found.push(f);

package/node_modules/@dougharness/gates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/gates",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "private": true,
   "description": "Deterministic Claude Code hooks: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, stop gate, re-anchor after compaction.",
   "type": "module",