@dzhechkov/harness-core 0.5.1 → 0.5.3

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "6aa58226ed2a38314929b9c93f1251932e9713c276bedb1006885757a0b0d59c"
+        "sha256": "1790811c8031105b1f281ecaff8a2e5b66a33ac9a323cbe63fb0caae67835b0d"
       },
       {
         "path": "README.md",
@@ -609,19 +609,19 @@
       },
       {
         "path": "dist/index.d.ts",
-        "sha256": "b5cc2034f02ea6c33a4e5a3c7009c5ba8357a3db35e6ee8e626ad5043b456d44"
+        "sha256": "837b65bceef392d58a8b85257443e796c8da7219e2c7d5749df952ff4ba9a7d9"
       },
       {
         "path": "dist/index.d.ts.map",
-        "sha256": "4ab8fac26790b7cfc5b87ce715cb9ded2cce5fe16e1791ad255c421adb67dba7"
+        "sha256": "2c88a22a96119c8ed14d67c1830bd85857e0c43f8a730951c1279ec9442decd6"
       },
       {
         "path": "dist/index.js",
-        "sha256": "b67b9d7ea154657908e3f6c3a42c7156c34c769f0ba67dc462e8833cd1cd0f2c"
+        "sha256": "5c208320312a34f0e4d09b2cea3d50a057253771a67b60a0ee0d0907a382546c"
       },
       {
         "path": "dist/index.js.map",
-        "sha256": "55ef43a95452bd6e288f41a856283fc296c27a5ac489aa81832ff62605d25730"
+        "sha256": "262dd0fca9a734cc81ba33c215adb9ef88b343ee56091c017abda45c68bc2508"
       },
       {
         "path": "dist/learning-backend.d.ts",
@@ -649,11 +649,11 @@
       },
       {
         "path": "dist/loop-blobs.generated.js",
-        "sha256": "64c2189b94ec500649defd76ced51742807ebf7dba6ec3f4d68cc0ada6f86c6b"
+        "sha256": "115740b3c04b6e906e135eb9d1e462ae4197cdba558d4eb620e29e541b4de288"
       },
       {
         "path": "dist/loop-blobs.generated.js.map",
-        "sha256": "8fe4553cb49e6440c3c2453e9e5a0aa0827829e250670afa33ba1cd9e7ccf0e0"
+        "sha256": "2cbadd2514704ccf6cfbf7e44fc50cad3d3701bc91b98651015896ebe209449a"
       },
       {
         "path": "dist/loop-lint.d.ts",
@@ -713,11 +713,11 @@
       },
       {
         "path": "dist/loop-render.js",
-        "sha256": "7fe2978192efae0c77f1b5da355fef75d035a2dd847b0111ae8f4e11c57af082"
+        "sha256": "49b8fc106dee22095dc02c43e224de52b9026dbf77d2f2e2654219a776017a09"
       },
       {
         "path": "dist/loop-render.js.map",
-        "sha256": "79b8f649aab8bb4b7614cd35b24d4c102ca566ea1b7eb3b06fa35e4079b0becc"
+        "sha256": "170a7cdafb569ce8d9d1bd7c63ab83d4689cd3b1ed8a1f02536f5affd9dd6d5f"
       },
       {
         "path": "dist/loop-run-semantics.d.ts",
@@ -737,19 +737,19 @@
       },
       {
         "path": "dist/loop-trace.d.ts",
-        "sha256": "b9eaa43bfc3cd4c80274c27410abd307d85c57d1952ca4563b93bbf87fa81de7"
+        "sha256": "bd228e00e217a99ee7f192c9e87d4e1c794c8ffb52323b77b87ee93f601f013a"
       },
       {
         "path": "dist/loop-trace.d.ts.map",
-        "sha256": "df095cb1ae2aa32df0286c29da55aae3fa5bd277f8242a2b3fb14d3e3069585a"
+        "sha256": "4c37b21c750133def0498c6d1b0fddfb2525500ced4dc58634ae1234425337d3"
       },
       {
         "path": "dist/loop-trace.js",
-        "sha256": "96345388c0efa6f05388fed69ceb54e17e9edac9124cf06745e8a5cd3bc486e4"
+        "sha256": "83f2afea542e80bf09f9ccf9a56a9d352111a8a3cd7744bf8f2ccad84d796c6a"
       },
       {
         "path": "dist/loop-trace.js.map",
-        "sha256": "6ce9f923b87ee9ae53c3a9a758609bde70decf039440e863ced8b407fc574366"
+        "sha256": "93a3007d6a7a906344f8f85272aef1928811997d331202171558763ab917b9d6"
       },
       {
         "path": "dist/managed-hooks.d.ts",
@@ -1439,6 +1439,22 @@
         "path": "dist/trace-bundle.js.map",
         "sha256": "9aafc5fe1b5f3bc878b063b94c7d3a89e4459f999c357252928d7b5498a8a5f7"
       },
+      {
+        "path": "dist/trace-corroborate.d.ts",
+        "sha256": "ebc36a47e4f8359eb7359a1e1697e9a135b2a281ecb1f795e99da7f9476f7f4c"
+      },
+      {
+        "path": "dist/trace-corroborate.d.ts.map",
+        "sha256": "7a2f343525b6585d0cd54644282bc49b741baffd066ebff0f023c036b622e6f8"
+      },
+      {
+        "path": "dist/trace-corroborate.js",
+        "sha256": "1b78df722776f6e253e3d0babb90c8557b5d733528125c793b7519ec724db96b"
+      },
+      {
+        "path": "dist/trace-corroborate.js.map",
+        "sha256": "7c95e98228f86fda4f4503b04efaf149466f9bd78fbb549a8aad49c8a4f3b7ab"
+      },
       {
         "path": "dist/upgrade.d.ts",
         "sha256": "b256da4de28359110f1ff791d6e6ed1e91339c1cd32d6e222048066b1ee9e0d3"
@@ -1505,19 +1521,19 @@
       },
       {
         "path": "dist/workflow-run.d.ts",
-        "sha256": "9ab363920599845c6d7b895d7c79217c8eb547752f5a440c14841cec41d8d03a"
+        "sha256": "94d154db3feb9676e515fc04129ac299f967ff46b8a7daedc51ec201f7eb5259"
       },
       {
         "path": "dist/workflow-run.d.ts.map",
-        "sha256": "998e470015beb24d24b0510e435d327786295c8c735bc145f9b7ec068f243e63"
+        "sha256": "0bda62d918a427203c946a0d6ec9fdb67a2223573939bc358fa9d48545e34361"
       },
       {
         "path": "dist/workflow-run.js",
-        "sha256": "7877d5dcda3394aae5349a8b935d6cae67b0ba822e9a155d69f3476bca129ab4"
+        "sha256": "c5d24bc9e5a8731ecd9e83e0fc3c3bac02421b76028906b20d2a113f04efbe59"
       },
       {
         "path": "dist/workflow-run.js.map",
-        "sha256": "5832275f40d831d58f18f0dd99434157ccb98f56ad689b4d10a373cbbd4f177d"
+        "sha256": "f9a9a320dde4bae0d6f6b0b2e7c03c08127e452f7fa7e00d78ea9f9b816bc6e7"
       },
       {
         "path": "dist/workflows.d.ts",
@@ -1537,7 +1553,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "317e79f0d14348171eee5ca0d0666ecfb98a4ad05bd438f6c9478686fcadad96"
+        "sha256": "f44d3dd18b5332681d861707c5644b1cbb027b217b9fda07a0b8510b6346d1a8"
       },
       {
         "path": "src/__tests__/golden-baseline.test.ts",
@@ -1689,7 +1705,7 @@
       },
       {
         "path": "src/index.ts",
-        "sha256": "6e6ebced34cfe7be2d69ccd257ca4382d312910c75164a6eb2248f6ced652a7a"
+        "sha256": "b741c4477d04f5fdb88f88601b8528f56e9b1fdc6a849dece4af157a81c0fe57"
       },
       {
         "path": "src/learning-backend.ts",
@@ -1697,7 +1713,7 @@
       },
       {
         "path": "src/loop-blobs.generated.ts",
-        "sha256": "21ca2d73e0833cf70120a06d970b68e7c7e9ba39698b93c390d89b7d5655852c"
+        "sha256": "929be36a3c9fd2cf3ba6e6b7328dd8d7928d9c031c38bb62880ba234c9553334"
       },
       {
         "path": "src/loop-lint.ts",
@@ -1713,7 +1729,7 @@
       },
       {
         "path": "src/loop-render.ts",
-        "sha256": "f6cd7fbc071b59804cd0a7f2ea37e2ebd80fe347806b338f618e11508bcf8301"
+        "sha256": "69d0daac70fda89235352be2cc2e40bcfe62651aedab8056c1919ed062d4a75b"
       },
       {
         "path": "src/loop-run-semantics.ts",
@@ -1721,7 +1737,7 @@
       },
       {
         "path": "src/loop-trace.ts",
-        "sha256": "26b22b86c80307158d78e587d27b9a09cd597f5a491c8046c3aebb8dabd6c654"
+        "sha256": "ea7d5b64c7805fd4622e7a892e0e3f1f03e4fdbb883f5fe377fcd64330775330"
       },
       {
         "path": "src/managed-hooks.ts",
@@ -1891,6 +1907,10 @@
         "path": "src/trace-bundle.ts",
         "sha256": "fec8d04a083f96f21d65a0dc1f131cb3cca6101c05f2cadcf540027c2a2a8774"
       },
+      {
+        "path": "src/trace-corroborate.ts",
+        "sha256": "28a872378dce68940237a99e8ffe57d3da049cccb0ffc315fbddf8ba65e80ee8"
+      },
       {
         "path": "src/upgrade.ts",
         "sha256": "8cc9e9e222149f711183980bfad317713aad0ecfa9fcff923dd3c93865b6966b"
@@ -1909,7 +1929,7 @@
       },
       {
         "path": "src/workflow-run.ts",
-        "sha256": "36a7e633dbd7bde8a15f8e0a426bda7c308d67194a21094621654a7022b99c87"
+        "sha256": "f1aaf39fcb5088afe3c63185c05a0d22f0507d29c342e3024836f46e3996d430"
       },
       {
         "path": "src/workflows.ts",
@@ -2135,6 +2155,14 @@
         "path": "test/feature-adr-workflow-twin-drift.test.ts",
         "sha256": "2b43ee26290b1617fc8b4a5ae81d7958dac0761041e63cd4d544383db628fa80"
       },
+      {
+        "path": "test/feature-adr-workflow-write-discipline.test.ts",
+        "sha256": "f491c12d9bb0a361095e9ec7cab216b60ea51f1c839256b8b4476bf0f8d5f4ca"
+      },
+      {
+        "path": "test/feature-adr-write-discipline.test.ts",
+        "sha256": "e44795d46da74d4f21bf6817d3884f1428f8adfd814c5174490c9c372299932e"
+      },
       {
         "path": "test/files-whitelist-guard.test.ts",
         "sha256": "c6dbf3388dfb1129e5954aeca3ccf3c6a7fccfe33e4530efe76b8d364e11f906"
@@ -2173,11 +2201,11 @@
       },
       {
         "path": "test/fixtures/workflow-run/discrimination.capture-obligation.json",
-        "sha256": "0a8d4ea5c160aa4e08e39a439907948dfeb92b622e42bf4bdd578c9a05848c45"
+        "sha256": "f20a7850a3313d5bb2431d81e8717694f2edf4cda5c67133c0b80d7549e2cbab"
       },
       {
         "path": "test/fixtures/workflow-run/discrimination.loop.js",
-        "sha256": "842d2425c72b12356512ebcfe66fe7f878f58daee947bbdd8ef1f2c908c748a7"
+        "sha256": "2bc8d4bd9c2bf15a3522d00b01a18611ef973f4b9e71ef5c1894ea72628294a8"
       },
       {
         "path": "test/fixtures/workflow-run/discrimination.loop.plan.json",
@@ -2261,7 +2289,7 @@
       },
       {
         "path": "test/helpers/workflow-run-harness.ts",
-        "sha256": "f4b88439e1319490d6bcff87f507d8f01a8ab11469057a7060693df70dbe8802"
+        "sha256": "95d04dbdb46e7f1fac3f6cfd5ec7705579a436ea7118823e11cb752da7f9adea"
       },
       {
         "path": "test/import-upsert.test.ts",
@@ -2341,7 +2369,7 @@
       },
       {
         "path": "test/mutation-registry.json",
-        "sha256": "a0f9cf5a77de387993d9c1860458469ab3015c26e6f7242aa170802ae0a85fc4"
+        "sha256": "e9ccae5e13df6370a8564326e5766aa1e03973c595bfdf73765d54191acf98c4"
       },
       {
         "path": "test/named-lock.test.ts",
@@ -2483,10 +2511,22 @@
         "path": "test/target-resolution.test.ts",
         "sha256": "146881c6848a59663fbbd070631af0f3c93f5bfa668958144bac70e2d5c7f7d0"
       },
+      {
+        "path": "test/trace-attestation.test.ts",
+        "sha256": "f4888117c97180797e6437abc1ef0c6aa1f1e48ee7c2df33d60a65e8bf11b35c"
+      },
       {
         "path": "test/trace-bundle.test.ts",
         "sha256": "66e784bd3f1344350e55b0003f5558f6cea388481fd339515b49c4c761de0af7"
       },
+      {
+        "path": "test/trace-corroborate.test.ts",
+        "sha256": "9e845bb448c1300966e76a030b2b0d88c3aa3cf666d85b58ddd981e15d4dcd85"
+      },
+      {
+        "path": "test/trace-qe-round1.test.ts",
+        "sha256": "7790c41628d7223a45aa61977511d1ddd6cd2cd8dc2dfdcdd248bb25c2effeca"
+      },
       {
         "path": "test/trusttier-schema.test.ts",
         "sha256": "430a5bb7ee5e1caf671db98e1b1833c64fb9b2b5cb4eefb5acc3675bb3529aee"
@@ -2581,5 +2621,5 @@
       }
     ]
   },
-  "signature": "AtFRrhU6YrSlhrDCz6wRYmcBBHu/biIsWsVRsilh18s4Af3rVsETZFDPvqw0yIxtkvCVu7jNOxs8XcC+fhQ0Bg=="
+  "signature": "R3nVNMcmCTbA+LwIEgj7iHl0wRbP6sUhatIOb7LHm+vjOfMu8U1PnEpVr0k3dGIjiKdtr7Z5Io11Om9iknZPDw=="
 }

package/README.md

@@ -20,7 +20,7 @@ and any other consumer.
 | `cost-ledger` | `deriveCostLedger`, `buildCostLedger`, `verifyCostLedgerReport`, `stageCostAggregates`, `renderCostLedger`, `writeCostLedgerJsonl`, `COST_LEDGER_SCOPE` | Per-stage cost ledger behind `dz usage --by-stage`. A feature-adr run reports ONE number; this joins the workflow's own `stageLabel()` strings to the per-agent transcripts the harness already writes, so a run becomes an itemized receipt. POST-HOC DERIVER, not a writer — no workflow edit, and a KILLED run is still derivable. The invariant: `accounted + unaccounted === runTotal` and `accounted + doubleAttributed === Σ stages`, RAW integer equality (rounding happens exactly once, per sample, at extraction), re-derived from the emitted report by `verifyCostLedgerReport` — the writer clamps, the verifier enforces. A mismatch is a NAMED defect (`Unaccounted`, `DoubleAttributed`, `ForeignSample`, `MissingStageTranscript`, `MalformedRecord`), never a rounding remainder, so `epsilon` defaults to 0. The run total comes from the run's transcript DIRECTORY LISTING, NOT the record's own `totalTokens` — that field is exactly `Σ workflowProgress[].tokens` in 29 of 29 recorded runs (MEASURED), so an invariant against it can never fail. Both sides share ONE estimator with `dz usage` (`weightedTokensOf`). `stageCostAggregates` is a pure feed-forward reader for auto-cost routing that EXCLUDES non-reconciling runs; wiring it into routing is deliberately out of scope. HONEST SCOPE, printed by every surface: local transcript ESTIMATES, not billed amounts — it catches ATTRIBUTION errors, NOT pricing errors; `hasKnownPricing` marks rows priced by the sonnet-class fallback. `INSUFFICIENT_DATA` is a distinct verdict, never collapsed into `BALANCED` |
 | `compounding` | `mulberry32`, `bootstrapDelta`, `decidePromotion`, `assembleCompoundingReport` | Pure learning-loop payoff engine behind `dz compounding`: seeded deterministic bootstrap (conservative nearest-rank lower-95), promotion that refuses non-finite/malformed input and anything under 5 samples per arm, and dz-native measurements (pool write-only ratio, guard trajectory by RATE, replay readiness over unique untruncated prompt events). A gate without data says INSUFFICIENT_DATA — never a verdict. Compaction keeps the newest query-bearing rows verbatim and aggregates ONLY the rest (read totals are invariant across compactions). Also reports EVENT-CHAIN health of the evidence logs it computed from (`evidenceLogs` in, `instrumentation.chains` out) — verified / defect kinds / uncovered pre-chain prefix, with no logs handed in producing no line at all rather than a vacuous "clean" |
 | `event-chain` | `fnv1a32`, `nextChainFields`, `appendChainedLines`, `chainRewrite`, `guardedRewrite`, `verifyEventChain`, `EVENT_CHAIN_SCOPE` | Pure hash-chain over the two learning-evidence logs (`.dz/recall-usage.jsonl`, `.dz/guard-audit.jsonl`): each appended record carries `seq` + `prevHash` (FNV-1a over the previous line AS WRITTEN, so key order cannot make writer and verifier disagree), derived from the LAST LINE ONLY so a per-prompt hook stays O(1). `verifyEventChain` names eight classes — `BrokenLink`, `DuplicateSeq`, `NonMonotonicSeq`, `TornTail`, `DoubleCounted`, `LedgerImbalance`, `MalformedLedger`, `ClaimInterrupted`. The last four exist because a rewriter must not be able to certify itself: the compaction ledger's arithmetic (`Σ weight + dropped === source`, `dropped ∈ [0, source]`) is enforced with NO clamps in the verifier (the clamp belongs to the writer), a damaged ledger line is a defect rather than a silently-disabled check, and a claim that never reached its `throughSeq` — because the segment restarted or the file ended — is reported instead of escaping through the discontinuity. `guardedRewrite` is the concurrency guard for any whole-file rewrite: exclusive lock, plus a re-read of the live file after computing the new text and BEFORE the rename, so a concurrent append aborts the attempt and is folded into a bounded retry rather than overwritten (it narrows the read→rename window; it cannot close it, and says so). Records written before chaining existed stay LEGAL and are counted as an uncovered `preChainPrefix`; an unreadable tail never blocks a write (fresh MARKED segment — an unreadable tail WINDOW is distinguished from an empty file — and the appender starts on a new line so one torn write cannot eat the next record); an unmarked restart is reported once and then re-anchored, so one incident is one defect instead of a cascade. HONEST SCOPE, carried in every result and printed by every surface: corruption detection for our own bugs — FNV-1a is not cryptography, its collisions are constructible, the threat model has no adversary, and a regression test fails if the module regrows tamper-proofing vocabulary |
-| `feature-adr-checkpoints` | `checkpointInputHash`, `decideCheckpointResume`, `parseCheckpointRead`, `serializeCheckpoint`, `fnv1a64`, `CKPT_SCHEMA_VERSION`, `STAGE_ARTIFACTS` | The PURE half of feature-adr's durable per-stage checkpoints (`features/<slug>/.fa-state/checkpoints.jsonl`): a dead L/XL run — or the standard stop-after-plan re-invoke — resumes completed stages instead of re-spending them. Resume = INPUT-identity (64-bit salted FNV over a schema-versioned JSON tuple incl. upstream stage results) + presence of EVERY tier-required artifact; a stale-input hash never resumes in ANY mode (`force` relaxes only the artifact probe — the tested load-bearing property). HONEST SCOPE: it does NOT fingerprint the working tree (a crash-resume legitimately sees the dead run's uncommitted writes) — after manual edits use `resume:'never'` and re-QE. Null results are never persisted or resumable; a stage-identifiable corrupt record ERASES its older entry (last-wins holds for corruption too); the code stage's persist predicate is now an ALLOWLIST (`codeCheckpointPersistAllowed` + `codeStageResultShapeValid`, ADR-003 Condition 3): ONLY `landed` on a barrier-required run and `synchronous` on a non-barrier run may be checkpointed — inconclusive, not-landed, garbage and a mislabeled `synchronous` are all refused, and the `landing-v2` hash token makes every pre-protocol code checkpoint stale. The workflow mirrors this inline (wiring-guarded); RU: чекпоинт после каждой дорогой стадии — упавший ран возобновляется, а не пере-тратит завершённое |
+| `feature-adr-checkpoints` | `checkpointInputHash`, `decideCheckpointResume`, `parseCheckpointRead`, `serializeCheckpoint`, `fnv1a64`, `CKPT_SCHEMA_VERSION`, `STAGE_ARTIFACTS`, `DESIGN_SUBSTAGES`, `designStageKey`, `decideDesignFanResume`, `parseArtifactProbe` | The PURE half of feature-adr's durable per-stage checkpoints (`features/<slug>/.fa-state/checkpoints.jsonl`): a dead L/XL run — or the standard stop-after-plan re-invoke — resumes completed stages instead of re-spending them. Resume = INPUT-identity (64-bit salted FNV over a schema-versioned JSON tuple incl. upstream stage results) + presence of EVERY tier-required artifact; a stale-input hash never resumes in ANY mode (`force` relaxes only the artifact probe — the tested load-bearing property). HONEST SCOPE: it does NOT fingerprint the working tree (a crash-resume legitimately sees the dead run's uncommitted writes) — after manual edits use `resume:'never'` and re-QE. Null results are never persisted or resumable; a stage-identifiable corrupt record ERASES its older entry (last-wins holds for corruption too); the code stage's persist predicate is now an ALLOWLIST (`codeCheckpointPersistAllowed` + `codeStageResultShapeValid`, ADR-003 Condition 3): ONLY `landed` on a barrier-required run and `synchronous` on a non-barrier run may be checkpointed — inconclusive, not-landed, garbage and a mislabeled `synchronous` are all refused, and the `landing-v2` hash token makes every pre-protocol code checkpoint stale. **Since 0.5.3 the design fan is checkpointed PER SIBLING** (`design:requirements` / `adr` / `qcsd` / `architecture` via `designStageKey`), so one dead agent no longer discards three finished siblings, and a fix to one step's instructions invalidates that step alone. What may be CONSUMED is judged separately from what may be WRITTEN: `decideDesignFanResume` returns a named reason (`substage-missing` / `artifact-missing` / `probe-not-established` / `ok`) and the workflow REFUSES at the Step-5/6 boundary rather than planning off a partial design. The artifact half is judged against a POST-RUN probe that never prints filenames (`[ -f <exact rel> ]` per required artifact) — a listing is a list of filenames, and a file whose NAME ends in a newline was measured satisfying the requirement for the real file. `parseArtifactProbe` then validates the WHOLE transcript, because the probe is relayed by a model: an agent that merely NARRATES the expected output emits the token byte-identically. Inconclusive is never a pass. The workflow mirrors this inline (wiring-guarded); RU: чекпоинт после каждой дорогой стадии — упавший ран возобновляется, а не пере-тратит завершённое; веер проектирования — по каждому участнику отдельно, а неполный веер получает отказ, а не запись в лог |
 | `discrimination-gate` | `planDiscriminationCheck`, `classifyExecutionEvidence`, `classifyDiscrimination`, `DiscriminationVerdict`, `BaseOutcome`, `TipOutcome`, `ExecutionEvidence`, `CannotIsolateReason`, `DiscriminationFinding`, `MeasurementValid`, `PrimaryAction` | The PURE §42 test-discrimination engine behind `dz discrimination-check`: it plans the pre-feature worktree check and classifies the observations the executor feeds back. **Every trust verdict is gated on execution evidence** (ADR-001, feature wave1-instrument-repair): `classifyExecutionEvidence` turns one captured run into `{exitCode, runner, failureKind, testsExecuted, targetSeen}` off the MEASURED vitest / node --test output shapes (reusing `mutation-gate`'s single regex family), and a row whose outcome VALUE is not backed by that evidence degrades to `CANNOT_ISOLATE` with a typed reason instead of minting trust. **Seven verdicts** (was four): `DISCRIMINATES` (assertion-red at base, evidenced) · `DISCRIMINATES_VIA_ERROR` (evidenced load error at base + evidenced pass at TIP) · `NON_DISCRIMINATING` (evidenced pass at base — a proven false green) · `TEST_FILE_ABSENT` (the named check is not a regular file — stat+isFile, before any worktree) · `LOAD_ERROR_AT_BOTH_REVS` (could not execute at EITHER rev — zero signal) · `FAILS_AT_TIP` (the feature's own test is red WITH the feature) · `CANNOT_ISOLATE` (no established observation; reason ∈ no-execution-evidence | unrecognised-runner-output | no-tests-executed | inconsistent-evidence | tip-control-missing | tip-evidence-missing | timeout). The result carries `findings[]` (one per distinct non-clean verdict — the scalar `aggregate` can only name the worst), plus two ORTHOGONAL axes: `measurementValid` (did the instrument measure at all: `true | false | 'partial'`) and `primaryAction` (the single most urgent operator repair). PARSE-NEVER-SYNTHESIZE: an outcome contradicted by its own evidence is rejected as `inconsistent-evidence`, never reinterpreted. HONEST SCOPE: the bar is "a recognized runner demonstrably executed the named test", NOT resistance to an output-imitating runner; recognising vitest/node --test shapes is in scope, CHOOSING the runner is not. The singular `finding` remains as a DEPRECATED one-release alias for `findings[0] ?? null`. RU: вердикт доверия теперь требует доказательства исполнения — «упало» без доказательства больше не считается доказательством |
 | `feature-adr-routing` (landed barrier) | `sourceExpectedCodeTargets`, `validateExpectedTargetsBlock`, `codeLandedBarrierPlan`, `decideCodeLanding`, `codeLandedBarrierHasLanded`, `codeLandingProbeCmd`, `parseLandingSignal`, `verifyPreCodeBaseline`, `preCodeBaselineCaptureCmd`, `posixCksum`, `LANDING_PROTOCOL_VERSION`, `LANDING_HASH_TOKEN` | The PURE half of feature-adr's Step-7.5 Codex landing barrier (ADR-003, feature wave1-instrument-repair). Expected targets are SOURCED with an explicit precedence — a non-empty `args` override REPLACES the plan's `EXPECTED_CODE_TARGETS:` block (and narrowing to an all-unpollable set returns EMPTY with reason `override-unpollable`, never a silent fall-through), while Codex's own self-declared paths land in `scrapeDiagnostic` and can NEVER establish or match — the agent under test does not declare its own success criteria. An enabled barrier with no established target is `mode:'inconclusive'`, not the deleted `any-code-change` fallback that read an unrelated dirty file as landed. Landing is a DELTA, not dirtiness: `preCodeBaselineCaptureCmd` records `git hash-object` per pre-existing dirty path with a `count=/cksum=` trailer, `verifyPreCodeBaseline` refuses any truncated or edited baseline as `baseline-unverified` (a truncated baseline makes everything look landed), and a path counts only when it is absent from the baseline or its hash CHANGED. `parseLandingSignal` is the single normalization point — empty stdout is `probe-failure`, unparseable text is `malformed-signal`, and neither is ever a landing. RU: «файл грязный» ≠ «кодер его написал»; барьер теперь умеет сказать «не знаю» |
 | `feature-adr-training-pairs` (in `feature-adr-checkpoints`) | `buildTrainingPair`, `serializeTrainingPair`, `trainingPairPath`, `trainingPairAppendCmd`, `modelFamily`, `TRAINPAIR_SCHEMA_VERSION`, `TRAINPAIR_MAX_IO_CHARS`, `TRAINPAIR_PRIVACY_NOTE` | The PURE half of feature-adr TRAINING-PAIR capture (backlog 70e0f083): every checkpointed stage emits one SFT-ready JSONL record — STAGE INPUT (full prompt/context) → STAGE OUTPUT (artifact/result) → EVALUATION {QE grade, gradedBy, lessonsInjected} with provenance {model, FAMILY ∈ claude/codex, role} — to `.dz/fa-training/<slug>/<stage>.jsonl` (one file per stage), raw material for future local-model fine-tuning. FAMILY is load-bearing: the downstream dataset must honour the cross-model rule (QE pairs from a DIFFERENT family than the coder). Oversize guard: input+output over 48k chars is TRUNCATED with a named marker + full-text fnv1a64 — never silently dropped, never unbounded. A stage without a QE grade (router) records `grade:null` honestly. Deterministic: `ts` is passed in (the workflow fills it shell-side). Capture is default-ON in the workflow, opt-out `args.captureTrainingPairs:false`, non-blocking (a capture failure never fails the run). PRIVACY: pairs may contain target-repo code; the capture dir carries a README note; NOT gitignored by explicit owner decision. RU: тренировочные пары вход→выход→оценка с каждого прогона feature-adr — сырьё для будущей локальной модели |
@@ -206,7 +206,13 @@ pause or the file deliverable.
 
 ## Status
 
-`0.5.1` — published. **BEHAVIORAL:** `parseTrace` orders events by `seq`, not by file order (§42
+`0.5.3` — published. **BEHAVIORAL:** `decideDesignFanResume` takes the design fan's LIVE results, not
+the start-of-run checkpoint snapshot, and gained `artifacts` + `postRunListing`; `CKPT_SCHEMA_VERSION`
+is `fa-ckpt-3`, so every existing `.fa-state/checkpoints.jsonl` reads as no checkpoint and each
+in-flight feature re-runs router+design+plan once. Adds the per-sibling design checkpoint above and
+`parseArtifactProbe`. Full detail in [CHANGELOG.md](CHANGELOG.md).
+
+**0.5.1.** **BEHAVIORAL:** `parseTrace` orders events by `seq`, not by file order (§42
 `CANNOT_ISOLATE` semantics unchanged from 0.5.0) — a stored verdict computed over a non-sequential
 trace is not comparable with one computed here. Adds the plan enactor above, `qe-bridge.ts`
 (cross-family QE hand-off with reviewer isolation, 17-reason taxonomy) and `named-lock.ts`

package/dist/feature-adr-checkpoints.d.ts

@@ -49,7 +49,14 @@ export declare const CHECKPOINT_MAX_RESULT_CHARS = 12000;
 /** Checkpoint format/logic version — SALTED into every input hash. Bump it whenever the workflow's
  * stage semantics, prompts, or composite result shapes change: every pre-existing checkpoint then
  * hashes stale and re-runs, instead of an old-format entry resuming into new logic (Codex QE #5). */
-export declare const CKPT_SCHEMA_VERSION = "fa-ckpt-2";
+/**
+ * Bumped 'fa-ckpt-2' → 'fa-ckpt-3' on 2026-08-20: the `design` entry changed meaning. It used to be
+ * the ONE record for the whole parallel design fan; it is now a completeness marker sitting above
+ * four per-sibling records. A stale-format entry must hash stale rather than resume into new logic,
+ * so every in-flight `.fa-state/` re-runs router+design+plan once. That is the intended one-time
+ * price of the change, not an accident.
+ */
+export declare const CKPT_SCHEMA_VERSION = "fa-ckpt-3";
 /** FNV-1a 32-bit over UTF-16 code units, hex-encoded (one pass; building block for the 64-bit form). */
 export declare function fnv1a(str: string): string;
 /** 64 bits from two independent FNV-1a passes (plain + salted). A single 32-bit hash admits
@@ -77,6 +84,64 @@ export interface ResumeDecision {
  * resumes in any mode — force skips only the artifact probe, never the input check (a checkpoint
  * for different inputs is a different feature). A malformed/null recorded result is treated as
  * no-checkpoint (Codex QE #8 — a null result must not resume as a real one). */
+/** The tier-active design sub-stages, in fan order. Namespaced keys are plain strings, so the
+ *  checkpoint parser's last-wins-per-stage rule and its malformed-line erase rule work unchanged. */
+export declare const DESIGN_SUBSTAGES: readonly ["requirements", "adr", "qcsd", "architecture"];
+export type DesignSubstage = (typeof DESIGN_SUBSTAGES)[number];
+/** `design:requirements`, … — the checkpoint stage key for one sibling. */
+export declare function designStageKey(sub: DesignSubstage | string): string;
+export interface DesignFanVerdict {
+    complete: boolean;
+    missingSubstages: string[];
+    missingArtifacts: string[];
+    /** Why the fan is not complete — 'ok' when it is. Never collapse 'probe-not-established' into
+     *  'ok': a gate that could not read its inputs is INCONCLUSIVE, and inconclusive is not a pass. */
+    reason: 'ok' | 'substage-missing' | 'artifact-missing' | 'probe-not-established';
+}
+/**
+ * SP-1 (completeness). The `design` stage may hand a value to Step 6 ONLY when every tier-required
+ * sibling produced a result AND every tier-required design artifact is on disk.
+ *
+ * This is the property the old all-or-nothing WRITE gate was implementing by accident, and the
+ * reason it must survive the split: a one-file probe once accepted a design missing its ADR and
+ * architecture (Codex QE #2). Splitting the write gate without keeping this would reopen that hole,
+ * so the two are landed together and tested together.
+ *
+ * It is deliberately a READ-side predicate. What may be WRITTEN (one sibling's completed work) and
+ * what may be CONSUMED (a whole design) are different questions; the previous code answered the
+ * second by crippling the first, which is how one dead agent discarded three finished artifacts.
+ */
+export declare function decideDesignFanResume(opts: {
+    /**
+     * The LIVE result of each required sibling, in `required` order — what the fan just returned.
+     *
+     * Round 1 of cross-family review graded this D and was right: the first version read the
+     * START-OF-RUN checkpoint snapshot instead. That snapshot is wrong in both directions. A sibling
+     * that succeeded THIS run is absent from it, and — the dangerous half — a stale non-null entry
+     * from a PREVIOUS run stays in it even when this run's retry returned null, so an incomplete
+     * design could be declared complete. That is the exact hole the old all-or-nothing write gate
+     * existed to prevent, reopened by reading the wrong source.
+     *
+     * The live result is authoritative and free: a sibling that returns non-null wrote its artifact,
+     * and a sibling that died returns null. Nothing needs to be re-probed to know that.
+     */
+    results: readonly unknown[];
+    required: readonly string[];
+    /** Every artifact the tier requires from this fan. Empty ⇒ the artifact half is not checked. */
+    artifacts: readonly string[];
+    /**
+     * A listing taken AFTER the fan ran — never the start-of-run one, which is why the parameter is
+     * named for that and not just `listing`. Rounds 2 and 3 pinned both halves of this:
+     *   • round 2 — fed the START-OF-RUN listing, the probe called every fresh M+ fan incomplete,
+     *     because a listing taken before the fan cannot contain what the fan is about to write;
+     *   • round 3 — with the probe removed entirely, a sibling that returns non-null having written
+     *     only its primary artifact (L-tier requirements writes 01_requirements.md and skips
+     *     02_research.md) was accepted, and Step 6 planned with no research behind it. A non-null
+     *     result is the agent's own word; it is not evidence that a file exists.
+     * `null` means the probe could not be read. That is INCONCLUSIVE, not clean.
+     */
+    postRunListing: ReadonlySet<string> | null;
+}): DesignFanVerdict;
 export declare function decideCheckpointResume(opts: {
     mode: ResumeMode;
     entry: CheckpointEntry | undefined;
@@ -259,4 +324,31 @@ export declare function codeCheckpointPersistAllowed(landingStatus: unknown, bar
  * hash-token invalidation, in case a hash somehow matches.
  */
 export declare function codeStageResultShapeValid(r: unknown): boolean;
+/**
+ * Parse the design artifact probe's stdout into "which required artifacts exist".
+ *
+ * The probe is relayed by a MODEL, not read from a pipe: the workflow sandbox cannot run a shell, so
+ * an agent runs the command and hands back what it saw. That makes the transcript forgeable in
+ * principle, and cross-family review round 7 showed it forgeable in PRACTICE by accident — an agent
+ * that narrates ("Expected output when present: HAVE:01_requirements.md … Actual stdout: …") emits a
+ * line identical to the real token, and a permissive parser took it for evidence. The gate then passed a
+ * design whose artifact did not exist, which is the one thing this gate exists to prevent.
+ *
+ * So the transcript is validated STRICTLY, not scanned: after trimming blank lines, the output must be
+ * exactly some subset of the known HAVE tokens followed by exactly one sentinel, and nothing else.
+ * Anything unexpected — narration, a second sentinel, a shell error, a code fence — makes the probe
+ * NOT ESTABLISHED (null), which is a refusal, never a pass.
+ *
+ * What this does NOT do, named plainly: it cannot stop an agent that deliberately emits precisely the
+ * expected transcript and nothing else. That residual is the same trust the whole pipeline places in
+ * a relaying agent (the checkpoint reader and the Step-7.5 landing barrier share it). What it does do
+ * is make ACCIDENTAL forgery — the kind that actually happened — impossible rather than likely.
+ *
+ * @returns a Set of the required artifacts that exist, or `null` when the transcript is not trustworthy.
+ */
+export declare function parseArtifactProbe(opts: {
+    stdout: string | null | undefined;
+    sentinel: string;
+    required: readonly string[];
+}): Set<string> | null;
 //# sourceMappingURL=feature-adr-checkpoints.d.ts.map

package/dist/feature-adr-checkpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-adr-checkpoints.d.ts","sourceRoot":"","sources":["../src/feature-adr-checkpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;qGACqG;AACrG,eAAO,MAAM,YAAY,UAAU,CAAC;AAEpC;;0DAE0D;AAC1D,eAAO,MAAM,iBAAiB,8DAA+D,CAAC;AAC9F,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;8EAI8E;AAC9E,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAOlE,CAAC;AAEF,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;yFACyF;AACzF,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD;;qGAEqG;AACrG,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,wGAAwG;AACxG,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOzC;AAED;;kFAEkF;AAClF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;;;0DAO0D;AAC1D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAEpF;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAEnD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EACF,SAAS,GACT,eAAe,GACf,YAAY,GACZ,eAAe,GACf,aAAa,GACb,kBAAkB,CAAC;CACxB;AAED;;;;gFAIgF;AAChF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,eAAe,GAAG,SAAS,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/C,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9B,GAAG,cAAc,CAYjB;AAED;;gGAEgG;AAChG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAUpG;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;uBACuB;AACvB,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD;;;;;6FAK6F;AAC7F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CA6BtE;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;qEAEqE;AACrE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;6CAE6C;AAC7C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzE;AAwBD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,eAAe,GAAG,YAAY,CAAC;AAElF;;;;gDAIgD;AAChD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAIhH;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,gBAAgB,GAAG,YAAY,GAAG,qBAAqB,GAAG,cAAc,CAAC;AAEtH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;gGACgG;AAChG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,oBAAoB,CAoB1H;AAED,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD;;;;6DAI6D;AAC7D,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpD;;;qFAGqF;AACrF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAEpE;AAED,MAAM,WAAW,sBAAsB;IACrC,qFAAqF;IACrF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,iNAAiN;IACjN,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,sBAAsB,CAAC;IACnC,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACzC,WAAW,EAAE,SAAS,GAAG,UAAU,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;kFACkF;AAClF,eAAO,MAAM,sBAAsB,kpBACymB,CAAC;AAgB7oB;;;;;;sFAMsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;IACpD,UAAU,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,YAAY,CAwCf;AAED;qGACqG;AACrG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAOvE;AAED;;oCAEoC;AACpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CASxG;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD;;;;;;;;;;;;;0CAa0C;AAC1C,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyB/I;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,GAAG,OAAO,CAItG;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAQ7D"}
+{"version":3,"file":"feature-adr-checkpoints.d.ts","sourceRoot":"","sources":["../src/feature-adr-checkpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;qGACqG;AACrG,eAAO,MAAM,YAAY,UAAU,CAAC;AAEpC;;0DAE0D;AAC1D,eAAO,MAAM,iBAAiB,8DAA+D,CAAC;AAC9F,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;8EAI8E;AAC9E,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAOlE,CAAC;AAEF,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;yFACyF;AACzF,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD;;qGAEqG;AACrG;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,wGAAwG;AACxG,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOzC;AAED;;kFAEkF;AAClF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;;;0DAO0D;AAC1D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAEpF;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAEnD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EACF,SAAS,GACT,eAAe,GACf,YAAY,GACZ,eAAe,GACf,aAAa,GACb,kBAAkB,CAAC;CACxB;AAED;;;;gFAIgF;AAChF;qGACqG;AACrG,eAAO,MAAM,gBAAgB,0DAA2D,CAAC;AACzF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,MAAM,CAEnE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;uGACmG;IACnG,MAAM,EAAE,IAAI,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,uBAAuB,CAAC;CAClF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;IAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,gGAAgG;IAChG,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG,gBAAgB,CAoBnB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,eAAe,GAAG,SAAS,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/C,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9B,GAAG,cAAc,CAYjB;AAED;;gGAEgG;AAChG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAUpG;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;uBACuB;AACvB,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD;;;;;6FAK6F;AAC7F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CA6BtE;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;qEAEqE;AACrE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;6CAE6C;AAC7C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzE;AAwBD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,eAAe,GAAG,YAAY,CAAC;AAElF;;;;gDAIgD;AAChD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAIhH;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,gBAAgB,GAAG,YAAY,GAAG,qBAAqB,GAAG,cAAc,CAAC;AAEtH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;gGACgG;AAChG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,oBAAoB,CAoB1H;AAED,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD;;;;6DAI6D;AAC7D,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpD;;;qFAGqF;AACrF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAEpE;AAED,MAAM,WAAW,sBAAsB;IACrC,qFAAqF;IACrF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,iNAAiN;IACjN,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,sBAAsB,CAAC;IACnC,UAAU,EAAE,sBAAsB,CAAC;IACnC,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACzC,WAAW,EAAE,SAAS,GAAG,UAAU,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;kFACkF;AAClF,eAAO,MAAM,sBAAsB,kpBACymB,CAAC;AAgB7oB;;;;;;sFAMsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;IACpD,UAAU,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,YAAY,CAwCf;AAED;qGACqG;AACrG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAOvE;AAED;;oCAEoC;AACpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CASxG;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD;;;;;;;;;;;;;0CAa0C;AAC1C,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyB/I;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,GAAG,OAAO,CAItG;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAQ7D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAoBrB"}

package/dist/feature-adr-checkpoints.js

@@ -49,7 +49,14 @@ export const CHECKPOINT_MAX_RESULT_CHARS = 12_000;
 /** Checkpoint format/logic version — SALTED into every input hash. Bump it whenever the workflow's
  * stage semantics, prompts, or composite result shapes change: every pre-existing checkpoint then
  * hashes stale and re-runs, instead of an old-format entry resuming into new logic (Codex QE #5). */
-export const CKPT_SCHEMA_VERSION = 'fa-ckpt-2';
+/**
+ * Bumped 'fa-ckpt-2' → 'fa-ckpt-3' on 2026-08-20: the `design` entry changed meaning. It used to be
+ * the ONE record for the whole parallel design fan; it is now a completeness marker sitting above
+ * four per-sibling records. A stale-format entry must hash stale rather than resume into new logic,
+ * so every in-flight `.fa-state/` re-runs router+design+plan once. That is the intended one-time
+ * price of the change, not an accident.
+ */
+export const CKPT_SCHEMA_VERSION = 'fa-ckpt-3';
 /** FNV-1a 32-bit over UTF-16 code units, hex-encoded (one pass; building block for the 64-bit form). */
 export function fnv1a(str) {
     let h = 0x811c9dc5;
@@ -85,6 +92,51 @@ export function resumeMode(raw) {
  * resumes in any mode — force skips only the artifact probe, never the input check (a checkpoint
  * for different inputs is a different feature). A malformed/null recorded result is treated as
  * no-checkpoint (Codex QE #8 — a null result must not resume as a real one). */
+/** The tier-active design sub-stages, in fan order. Namespaced keys are plain strings, so the
+ *  checkpoint parser's last-wins-per-stage rule and its malformed-line erase rule work unchanged. */
+export const DESIGN_SUBSTAGES = ['requirements', 'adr', 'qcsd', 'architecture'];
+/** `design:requirements`, … — the checkpoint stage key for one sibling. */
+export function designStageKey(sub) {
+    return 'design:' + sub;
+}
+/**
+ * SP-1 (completeness). The `design` stage may hand a value to Step 6 ONLY when every tier-required
+ * sibling produced a result AND every tier-required design artifact is on disk.
+ *
+ * This is the property the old all-or-nothing WRITE gate was implementing by accident, and the
+ * reason it must survive the split: a one-file probe once accepted a design missing its ADR and
+ * architecture (Codex QE #2). Splitting the write gate without keeping this would reopen that hole,
+ * so the two are landed together and tested together.
+ *
+ * It is deliberately a READ-side predicate. What may be WRITTEN (one sibling's completed work) and
+ * what may be CONSUMED (a whole design) are different questions; the previous code answered the
+ * second by crippling the first, which is how one dead agent discarded three finished artifacts.
+ */
+export function decideDesignFanResume(opts) {
+    const missingSubstages = [];
+    opts.required.forEach((sub, i) => {
+        const r = opts.results[i];
+        if (r === null || r === undefined)
+            missingSubstages.push(sub);
+    });
+    const missingArtifacts = [];
+    let probeMissing = false;
+    if (opts.artifacts.length > 0) {
+        if (opts.postRunListing === null)
+            probeMissing = true;
+        else
+            for (const rel of opts.artifacts)
+                if (!opts.postRunListing.has(rel))
+                    missingArtifacts.push(rel);
+    }
+    // Substage first: a dead sibling explains its own missing artifacts, and naming the artifacts
+    // instead would send the operator looking for a file when the agent is what died.
+    const reason = missingSubstages.length > 0 ? 'substage-missing'
+        : probeMissing ? 'probe-not-established'
+            : missingArtifacts.length > 0 ? 'artifact-missing'
+                : 'ok';
+    return { complete: reason === 'ok', missingSubstages, missingArtifacts, reason };
+}
 export function decideCheckpointResume(opts) {
     if (opts.mode === 'never')
         return { resume: false, reason: 'mode-never' };
@@ -421,4 +473,56 @@ export function codeStageResultShapeValid(r) {
         return false;
     return v.landingStatus === 'landed' || v.landingStatus === 'genuinely-not-landed' || v.landingStatus === 'inconclusive' || v.landingStatus === 'synchronous';
 }
+/**
+ * Parse the design artifact probe's stdout into "which required artifacts exist".
+ *
+ * The probe is relayed by a MODEL, not read from a pipe: the workflow sandbox cannot run a shell, so
+ * an agent runs the command and hands back what it saw. That makes the transcript forgeable in
+ * principle, and cross-family review round 7 showed it forgeable in PRACTICE by accident — an agent
+ * that narrates ("Expected output when present: HAVE:01_requirements.md … Actual stdout: …") emits a
+ * line identical to the real token, and a permissive parser took it for evidence. The gate then passed a
+ * design whose artifact did not exist, which is the one thing this gate exists to prevent.
+ *
+ * So the transcript is validated STRICTLY, not scanned: after trimming blank lines, the output must be
+ * exactly some subset of the known HAVE tokens followed by exactly one sentinel, and nothing else.
+ * Anything unexpected — narration, a second sentinel, a shell error, a code fence — makes the probe
+ * NOT ESTABLISHED (null), which is a refusal, never a pass.
+ *
+ * What this does NOT do, named plainly: it cannot stop an agent that deliberately emits precisely the
+ * expected transcript and nothing else. That residual is the same trust the whole pipeline places in
+ * a relaying agent (the checkpoint reader and the Step-7.5 landing barrier share it). What it does do
+ * is make ACCIDENTAL forgery — the kind that actually happened — impossible rather than likely.
+ *
+ * @returns a Set of the required artifacts that exist, or `null` when the transcript is not trustworthy.
+ */
+export function parseArtifactProbe(opts) {
+    if (opts.stdout === null || opts.stdout === undefined)
+        return null;
+    const known = new Map();
+    for (const rel of opts.required)
+        known.set('HAVE:' + rel, rel);
+    const found = new Set();
+    let sentinels = 0;
+    for (const raw of String(opts.stdout).split('\n')) {
+        const line = raw.trim();
+        if (line === '')
+            continue;
+        if (line === opts.sentinel) {
+            sentinels++;
+            continue;
+        }
+        // A token AFTER the sentinel is as wrong as an unknown line: the command emits every check first.
+        if (sentinels > 0)
+            return null;
+        const rel = known.get(line);
+        if (rel === undefined)
+            return null;
+        found.add(rel);
+    }
+    // Exactly one. Zero means the command never completed (or never ran); two means something other
+    // than the command produced output, and there is no way to tell which half was real.
+    if (sentinels !== 1)
+        return null;
+    return found;
+}
 //# sourceMappingURL=feature-adr-checkpoints.js.map