@dzhechkov/harness-core 0.7.11 → 0.8.1

package/src/amendment-trace.ts

@@ -26,6 +26,17 @@ export interface AmendmentRow {
 export type AmendmentVerdict =
   | 'resolved'
   | 'placeholder'
+  /**
+   * The plan RETRACTED this amendment and named its successor. A first-class outcome, never a
+   * failure: a plan is allowed to change its mind, and until 2026-08-25 this checker had no concept
+   * of it at all (`grep superseded` over this file returned nothing), so a legitimately retracted
+   * amendment read as `unnamed` and failed the run. C6 has accepted the form since it was written —
+   * this is the half of the contract that was missing here.
+   *
+   * Honest limit, stated in ADR-001: nothing verifies that the named successor EXISTS, or that the
+   * retraction was justified. Refusing retraction outright is what produced the false failures.
+   */
+  | 'superseded'
   | 'unnamed'
   | 'no-file-named'
   | 'file-missing'
@@ -94,7 +105,11 @@ export function normalizeTestId(s: string): string {
  * `features/ha-consilium/03.5_ideation_report.md` — is deliberately NOT a row: counting a legend as
  * an amendment would open this feature by falsely accusing a feature that did nothing wrong.
  */
-const ROW_START = /^(?:[-*]\s+\*{0,2}AM-(\d+)|\|\s*\*{0,2}AM-(\d+))/gm;
+// The bullet is OPTIONAL, and `AM-CP-N` is a row like any other. MEASURED 2026-08-25: requiring a
+// bullet drops 104 of the corpus's 347 real amendment rows out of the check entirely, and a
+// bullet-less row made this tool return `not-established` — which the pipeline's own gate text calls
+// "NEVER a pass". C6 has always treated the bullet as optional; this is that half of the contract.
+const ROW_START = /^(?:[-*|]\s*)?\*{0,2}AM-(?:CP-)?(\d+)/gm;
 
 /** The `## Amendments` section body, or null when the document has none (acid case A5). */
 export function amendmentSection(md: string): string | null {
@@ -131,10 +146,15 @@ export function parseAmendments(md: string): AmendmentRow[] {
   return rows;
 }
 
+/** `superseded by AM-N` / `AM-CP-N` — the retraction form C6 has always accepted. */
+const SUPERSEDED = /superseded by AM-(?:CP-)?\d+/i;
+
 /** `→ test \`a\`` and the two-id shape `→ tests \`a\` and \`b\`` — both are in the corpus. */
 function extractTestIds(raw: string): string[] {
   const out: string[] = [];
-  const re = /→\s*tests?\s+`([^`]+)`(?:\s*(?:and|и)\s*`([^`]+)`)?/g;
+  // Both arrows. C6 accepted `->` from the start and this file only accepted `→`, so an ASCII row
+  // read as `unnamed` here while passing there — an accident of two authors, not a decision.
+  const re = /(?:\u2192|->)\s*tests?\s+`([^`]+)`(?:\s*(?:and|и)\s*`([^`]+)`)?/g;
   for (let m = re.exec(raw); m !== null; m = re.exec(raw)) {
     if (m[1]) out.push(m[1].trim());
     if (m[2]) out.push(m[2].trim());
@@ -148,7 +168,7 @@ function extractTestIds(raw: string): string[] {
  * successive shell-written extractors returned 108, 111 and 13 rows over the identical corpus.
  */
 function extractFile(raw: string): string | null {
-  const m = /→\s*tests?\s+`[^`]+`(?:\s*(?:and|и)\s*`[^`]+`)?[\s\S]{0,40}?\bin\s+`([^`]+)`/.exec(raw);
+  const m = /(?:\u2192|->)\s*tests?\s+`[^`]+`(?:\s*(?:and|и)\s*`[^`]+`)?[\s\S]{0,40}?\bin\s+`([^`]+)`/.exec(raw);
   return m && m[1] ? m[1].trim() : null;
 }
 
@@ -158,6 +178,12 @@ export function resolveAmendments(
 ): AmendmentResolution[] {
   const out: AmendmentResolution[] = [];
   for (const row of rows) {
+    // A retraction is checked BEFORE the missing-pointer branch: a row that says it was superseded
+    // is not a row that forgot its test.
+    if (SUPERSEDED.test(row.raw)) {
+      out.push({ id: row.id, testId: null, file: row.file, verdict: 'superseded', detail: 'the plan retracted this amendment and named its successor' });
+      continue;
+    }
     if (row.testIds.length === 0) {
       out.push({
         id: row.id,
@@ -219,6 +245,7 @@ function resolveOne(
 const ZERO_COUNTS: Record<AmendmentVerdict, number> = {
   resolved: 0,
   placeholder: 0,
+  superseded: 0,
   unnamed: 0,
   'no-file-named': 0,
   'file-missing': 0,
@@ -282,7 +309,10 @@ export function decideAmendmentOutcome(input: {
     );
   }
   for (const r of input.resolutions) {
-    if (r.verdict !== 'resolved') reasons.push(`${r.id} → ${r.verdict}: ${r.detail}`);
+    // `superseded` is an OUTCOME, not a defect: the plan retracted the amendment and said so. It is
+    // reported in the counts and never becomes a reason, which is the whole point — refusing
+    // retraction is what produced the false failures this change removes.
+    if (r.verdict !== 'resolved' && r.verdict !== 'superseded') reasons.push(`${r.id} → ${r.verdict}: ${r.detail}`);
   }
   return { outcome: reasons.length > 0 ? 'fail' : 'pass', exit: reasons.length > 0 ? 1 : 0, reasons, counts };
 }

package/src/book-kb.ts

@@ -16,6 +16,8 @@ import { existsSync, mkdirSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
 import { createRequire } from 'node:module';
 
+import { describeNativeDep, exerciseSqliteOpen, probeNativeDep } from './native-dep-probe.js';
+
 /** A digitized Knowledge Unit as stored in the book KB. */
 export interface BookKU {
   readonly book: string;            // ISBN or book slug (the immutable upstream key)
@@ -64,6 +66,11 @@ const SCHEMA = `CREATE VIRTUAL TABLE IF NOT EXISTS book_knowledge USING fts5(
 );`;
 
 async function openDb(projectRoot: string, dbPath?: string): Promise<NativeDb | { error: string }> {
+  const verdict = probeNativeDep(projectRoot, 'better-sqlite3', exerciseSqliteOpen, 'sqlite-open');
+  if (verdict.state === 'absent') {
+    return { error: 'better-sqlite3 not installed in project (run: dz setup --memory agentdb)' };
+  }
+  if (verdict.state === 'unusable') return { error: describeNativeDep(verdict) };
   let sqliteUrl: string;
   try {
     const req = createRequire(join(projectRoot, 'package.json'));
@@ -71,6 +78,16 @@ async function openDb(projectRoot: string, dbPath?: string): Promise<NativeDb |
   } catch {
     return { error: 'better-sqlite3 not installed in project (run: dz setup --memory agentdb)' };
   }
+  // The probe above absorbs the DEPENDENCY failures — absent, or present-but-unloadable — which is
+  // what cross-family review (F2) required: those are instrument failures and must be RETURNED.
+  //
+  // What follows must still THROW, and that is deliberate. `dz recall --books` distinguishes two
+  // states by throw-vs-return, and collapsing them loses a shipped honesty contract (measured
+  // 2026-08-27, `books-recall-honesty.test.ts`):
+  //   throws   -> the STORE ITSELF is unreadable  -> exit 1, naming the path and a cure
+  //   {error}  -> the INSTRUMENT did not run      -> exit 3 under --semantic, never a clean 0-hit
+  // A corrupted `books.sqlite` is the first state. Wrapping it into `{error}` made a corrupt store
+  // read as a missing instrument and exit 0 — a false clean pass over unreadable data.
   const path = dbPath ?? bookKbPath(projectRoot);
   mkdirSync(dirname(path), { recursive: true });
   const { default: Database } = (await import(sqliteUrl)) as { default: new (p: string) => NativeDb };

package/src/feature-adr-checkpoints.ts

@@ -497,6 +497,113 @@ export const TRAINPAIR_PRIVACY_NOTE =
 /** Coerce a stage input/output to text: strings pass through; objects serialize to JSON;
  * an unserializable value degrades to String(v) — buildTrainingPair NEVER throws (capture
  * is non-blocking by contract). */
+/** Marker pair of the operator-profile block (feature operator-profile, ADR-001 Decision 5).
+ * DELIBERATE LOCAL COPIES of profile.ts's PROFILE_MARKER_START/END: this module stays import-free
+ * so the workflow can mirror it inline. `test/profile-redaction.test.ts` pins the pairs equal. */
+export const TP_PROFILE_MARKER_START = '<!-- dz:profile:start -->';
+export const TP_PROFILE_MARKER_END = '<!-- dz:profile:end -->';
+
+/** What a redacted block is replaced with — visible in the dataset, so a missing profile is
+ * distinguishable from a never-present one. */
+export const TP_PROFILE_REDACTED = '[dz:profile REDACTED]';
+
+/**
+ * Strip every operator-profile block from `text` BEFORE a training pair is persisted.
+ *
+ * Why here and not "the guard already says never write the profile into a project": training-pair
+ * capture records the FULL prompt as the model received it into `.dz/fa-training/`, which is
+ * deliberately NOT gitignored — so a profile injected into context would reach a committable
+ * directory, and the never-in-a-project guard would be defeated through this path (ADR-001
+ * Decision 5, exit 3). Redaction at the single assembly seam closes it for capture AND backfill.
+ *
+ * Semantics: every complete `start…end` span is replaced (markers included) with
+ * {@link TP_PROFILE_REDACTED}. A START marker with no matching END fails CLOSED — everything from
+ * the marker to the end of the text is dropped (over-redaction is a lost training sample;
+ * under-redaction is a personal-data leak). Text without markers passes through byte-identical.
+ * Works on JSON-stringified payloads too: the marker literals contain no characters JSON escapes.
+ */
+export function redactProfileBlock(text: string): string {
+  if (typeof text !== 'string' || text === '') return typeof text === 'string' ? text : '';
+  let out = '';
+  let rest = text;
+  for (;;) {
+    const start = rest.indexOf(TP_PROFILE_MARKER_START);
+    if (start === -1) return out + rest;
+    out += rest.slice(0, start) + TP_PROFILE_REDACTED;
+    const end = rest.indexOf(TP_PROFILE_MARKER_END, start + TP_PROFILE_MARKER_START.length);
+    if (end === -1) return out; // unterminated block: fail closed, drop the tail
+    rest = rest.slice(end + TP_PROFILE_MARKER_END.length);
+  }
+}
+
+/**
+ * Deep redaction over an already-PARSED training-pair payload — the PERSIST-SIDE half of CF-6.
+ *
+ * Why a second entry point next to {@link redactProfileBlock}: the DEFAULT-ON capture in the
+ * canonical workflow builds its pair with an INLINE mirror of buildTrainingPair and hands the
+ * serialised JSON to `dz feature-adr-record` — a path that never passes through the core builder.
+ * Redacting at the builder alone therefore guarded the path that does NOT run (Codex cross-family
+ * finding, 2026-08-28: guard 1 defeated through guard 3, one seam further down — the exact shape
+ * ADR-001 Decision 5 names). This function runs inside `decideRecordWrite` (run-records.ts), the
+ * one decision every witnessed training-pair write funnels through, so a FUTURE pair builder is
+ * covered without patching its caller.
+ *
+ * Semantics: every string leaf (keys included) goes through {@link redactProfileBlock} — same
+ * fail-closed rule on an unterminated block; arrays and plain objects are walked; numbers,
+ * booleans and null pass through untouched. A payload with no markers anywhere round-trips to a
+ * deep-equal value.
+ *
+ * Two mechanics, both cross-family findings (2026-08-28), both load-bearing:
+ *
+ * - Rebuilt objects have a NULL prototype, so every JSON key — `__proto__` included — lands as an
+ *   OWN property. The previous `{}` + assignment invoked the inherited `__proto__` SETTER for a
+ *   payload like `{"slug":"s","stage":"code","__proto__":{"input":"i","output":"o"}}`: the result
+ *   then INHERITED input/output (the shape check passed) while serialization dropped them — an
+ *   invalid pair reported `written`. With own-key reconstruction the JSON keys round-trip exactly
+ *   and that payload fails the shape check honestly.
+ * - The walk is ITERATIVE (explicit stack), not recursive: ~5000 nested arrays is a ~10 KB payload
+ *   that passes JSON.parse and sits under the line cap, but a recursive map hit RangeError before
+ *   any size guard — a throw escaping a seam whose callers promise non-blocking verdicts. The
+ *   iterative walk chose over a caught-RangeError→`refused` wrapper because it keeps the honest
+ *   outcome for deep-but-valid payloads (they get redacted and judged on their merits) instead of
+ *   refusing them at an arbitrary engine-dependent depth. A repeated container is walked once and
+ *   reused (WeakMap), so a shared or cyclic reference can never loop the walk either.
+ */
+export function redactTrainingPayload(v: unknown): unknown {
+  if (typeof v === 'string') return redactProfileBlock(v);
+  if (v === null || typeof v !== 'object') return v;
+  const makeDst = (src: object): Record<string, unknown> | unknown[] =>
+    Array.isArray(src) ? new Array(src.length) : (Object.create(null) as Record<string, unknown>);
+  const dstOf = new WeakMap<object, Record<string, unknown> | unknown[]>();
+  const root = makeDst(v);
+  dstOf.set(v, root);
+  const stack: object[] = [v];
+  const walkChild = (child: unknown): unknown => {
+    if (typeof child === 'string') return redactProfileBlock(child);
+    if (child === null || typeof child !== 'object') return child;
+    let dst = dstOf.get(child);
+    if (dst === undefined) {
+      dst = makeDst(child);
+      dstOf.set(child, dst);
+      stack.push(child);
+    }
+    return dst;
+  };
+  while (stack.length > 0) {
+    const src = stack.pop()!;
+    const dst = dstOf.get(src)!;
+    if (Array.isArray(src)) {
+      const arr = dst as unknown[];
+      for (let i = 0; i < src.length; i++) arr[i] = walkChild(src[i]);
+    } else {
+      const obj = dst as Record<string, unknown>;
+      // null prototype ⇒ this assignment defines an OWN property even for the key '__proto__'
+      for (const [key, value] of Object.entries(src)) obj[redactProfileBlock(key)] = walkChild(value);
+    }
+  }
+  return root;
+}
+
 function coerceText(v: unknown): string {
   if (typeof v === 'string') return v;
   if (v === null || v === undefined) return '';
@@ -526,8 +633,10 @@ export function buildTrainingPair(opts: {
   captureMode?: unknown;
   resumed?: unknown;
 }): TrainingPair {
-  let input = coerceText(opts.input);
-  let output = coerceText(opts.output);
+  // Operator-profile redaction FIRST — before the oversize guard, so the truncation hashes are
+  // hashes of the redacted text and the full-text fnv1a64 never fingerprints personal data.
+  let input = redactProfileBlock(coerceText(opts.input));
+  let output = redactProfileBlock(coerceText(opts.output));
   let truncated: TrainingPairTruncation | null = null;
   if (input.length + output.length > TRAINPAIR_MAX_IO_CHARS) {
     truncated = { inputChars: input.length, outputChars: output.length, inputHash: fnv1a64(input), outputHash: fnv1a64(output) };

package/src/feature-adr-routing.ts

@@ -1321,9 +1321,36 @@ export function isSafeCodexId(id: string): boolean {
  * unquoted, so a malformed `args.codexModel` could corrupt or extend the command the agent runs.
  * Reject anything that is not a plain id, and single-quote it anyway.
  */
-export function codexProbeCommand(id: string): string | null {
+/**
+ * Which binary bounds a dispatched run. `timeout(1)` is GNU coreutils and is NOT on macOS; brew's
+ * coreutils installs it as `gtimeout`.
+ *
+ * An ALLOWLIST rather than a free string, because this value is interpolated into a shell command.
+ *
+ * MEASURED 2026-08-25 (field report, and reproduced here): with neither binary present the dispatch
+ * exits 127 and cross-family QE — a NAMED safety property, that the model which wrote the code must
+ * not review it — silently did not happen for a whole run.
+ *
+ * Deliberately NOT the portable `perl -e 'alarm N; exec @ARGV'` the report proposed: MEASURED on
+ * this machine, that form exits **142** (SIGALRM kills the exec'd process) while GNU timeout exits
+ * **124**, and `classifyCodexQeOutcome` keys `timeout` on `exit === 124` — a rule its own comment
+ * says wins over every content rule. The suggested remedy would have silently reclassified every
+ * timeout as a tool error. A remedy that breaks the classifier is worse than the defect.
+ */
+export const TIMEOUT_BINS: Readonly<Record<string, true>> = { timeout: true, gtimeout: true };
+
+/** The requested timeout binary if it is one we allow, else the default. Never a free string. */
+export function timeoutBinOrDefault(bin: unknown): string {
+  const b = typeof bin === 'string' ? bin : '';
+  return TIMEOUT_BINS[b] === true ? b : 'timeout';
+}
+
+export function codexProbeCommand(id: string, timeoutBin?: string): string | null {
   if (!isSafeCodexId(id)) return null;
-  return "timeout 60 codex exec -m '" + id + "' 'Reply with exactly: OK'";
+  // `< /dev/null` is not cosmetic: without it `codex exec` waits on stdin forever (measured
+  // 2026-08-19, 45 minutes lost). It was present in the workflow mirror and MISSING here — a drift
+  // invisible to the suite because this function is not in the lift test's function list.
+  return timeoutBinOrDefault(timeoutBin) + " 60 codex exec -m '" + id + "' 'Reply with exactly: OK' < /dev/null";
 }
 
 export interface CodexProbeOutput {
@@ -1396,6 +1423,9 @@ export function parseCodexExecResult(text: string | null | undefined): CodexExec
 
 /** Mode-A wall-clock bound. Run 3 measured 146 s; 600 s is ~4× headroom and still bounded. */
 export const CODEX_REVIEW_TIMEOUT_SECONDS = 600;
+
+/** The `codex exec` wall-clock bound. Mirrors the workflow's own constant (field report 27). */
+export const CODEX_EXEC_TIMEOUT_SECONDS = 280;
 /** MEASURED (probe 0.3): `codex review` accepts and echoes `reasoning effort: high`. */
 export const CODEX_REVIEW_DEFAULT_EFFORT = 'high';
 /** The sentinel a wrapper returns when the command hit its `timeout` — distinct from CODEX_UNAVAILABLE. */
@@ -1427,6 +1457,22 @@ export interface CodexReviewCommandInput {
   readonly ref?: string | null;
   readonly modelId?: string | null;
   readonly reasoning?: string | null;
+  /**
+   * Which binary bounds the run — `timeout` (default) or `gtimeout` on a mac with brew coreutils.
+   * An INPUT rather than a platform sniff inside the builder, so the function stays pure and every
+   * pinned command string in the tests stays byte-identical when it is omitted.
+   */
+  readonly timeoutBin?: string | null;
+  /**
+   * The repo the review must run IN. Field report 27: `codex review` was dispatched with no working
+   * directory at all, so it ran in the SESSION cwd — on a run against an external checkout it read a
+   * different tree, resolved `--uncommitted` / `--base` against the wrong git repo, and still exited 0
+   * with a `Grade:` line that the pipeline recorded as a verdict. `codex review` has NO `-C` flag
+   * (MEASURED on codex-cli 0.149.1: `codex exec --help` carries `-C, --cd <DIR>`, `codex review --help`
+   * does not), so the working directory can only be set by a `cd` prefix. Omitted ⇒ no prefix, which
+   * keeps every previously pinned command string byte-identical.
+   */
+  readonly repo?: string | null;
   /**
    * Accepted and DELIBERATELY IGNORED. MEASURED 2026-08-21: every scope flag refuses a positional
    * prompt — `--commit`, `--base <BRANCH>` and `--uncommitted` each exit 2 with
@@ -1457,6 +1503,44 @@ export interface CodexReviewCommandResult {
  * Default scope is `uncommitted` (probe 0.4b: it and `--base HEAD` reviewed the identical uncommitted
  * diff, and `uncommitted` needs no ref, so it has no ref-injection surface at all).
  */
+/** Shell-quote one argument. A repo path may contain a space; it must never contain a command. */
+function codexSq(s: string): string {
+  return "'" + String(s).replace(/'/g, "'\\''") + "'";
+}
+
+/**
+ * The `cd <repo> && ` prefix, or `''` when no repo was named. Empty is not a silent default — it is
+ * the pre-2026-08-25 behaviour, preserved so an omitted `repo` keeps every pinned string identical.
+ */
+function codexCd(repo: string): string {
+  return repo === '' ? '' : 'cd ' + codexSq(repo) + ' && ';
+}
+
+/**
+ * The `codex exec` dispatch, built as a pure string so the working directory is pinned by a test
+ * rather than by whichever directory the dispatching agent happened to stand in (field report 27).
+ * `-C` is real on codex-cli 0.149.1 and MEASURED: `-C <this repo>` answered in 4.6 s exit 0, while
+ * `-C /tmp` exited 1 with "Not inside a trusted directory" — so the flag genuinely changes the tree,
+ * and a non-git target is a LOUD failure rather than a quiet read of the wrong one.
+ */
+export function codexExecCommand(input: {
+  readonly modelId?: string | null;
+  readonly prompt?: string | null;
+  readonly timeoutBin?: string | null;
+  readonly timeoutSeconds?: number | null;
+  readonly repo?: string | null;
+}): string | null {
+  const o = input || {};
+  const modelId = String(o.modelId === undefined || o.modelId === null ? '' : o.modelId);
+  if (!isSafeCodexId(modelId)) return null;
+  const raw = Number(o.timeoutSeconds);
+  const seconds = raw === raw && raw !== Infinity && raw > 0 ? Math.floor(raw) : CODEX_EXEC_TIMEOUT_SECONDS;
+  const repo = String(o.repo === undefined || o.repo === null ? '' : o.repo);
+  const cd = repo === '' ? '' : ' -C ' + codexSq(repo);
+  return timeoutBinOrDefault(o.timeoutBin) + ' ' + seconds + ' codex exec' + cd
+    + ' -m ' + codexSq(modelId) + ' ' + codexSq(String(o.prompt === undefined || o.prompt === null ? '' : o.prompt)) + ' < /dev/null';
+}
+
 export function codexReviewCommand(input: CodexReviewCommandInput): CodexReviewCommandResult {
   const o = input || ({} as CodexReviewCommandInput);
   const scope = o.scope === undefined || o.scope === null || o.scope === '' ? 'uncommitted' : String(o.scope);
@@ -1477,7 +1561,8 @@ export function codexReviewCommand(input: CodexReviewCommandInput): CodexReviewC
   }
   const raw = Number(o.timeoutSeconds);
   const seconds = raw === raw && raw !== Infinity && raw > 0 ? Math.floor(raw) : CODEX_REVIEW_TIMEOUT_SECONDS;
-  let cmd = 'timeout ' + seconds + " codex review -c model='" + modelId + "' -c model_reasoning_effort='" + effort + "'";
+  const repo = String(o.repo === undefined || o.repo === null ? '' : o.repo);
+  let cmd = codexCd(repo) + timeoutBinOrDefault(o.timeoutBin) + ' ' + seconds + " codex review -c model='" + modelId + "' -c model_reasoning_effort='" + effort + "'";
   if (scope === 'commit') cmd += " --commit '" + ref + "'";
   else if (scope === 'base') cmd += " --base '" + ref + "'";
   else cmd += ' --uncommitted';
@@ -1662,7 +1747,7 @@ export function gradeFromReviewFindings(findings: readonly CodexQeFinding[] | nu
  * The LOCKED decline taxonomy. A `kind` outside this set is a bug, not a new case — which is why
  * {@link codexQeDeclineReason} throws on one rather than rendering something plausible.
  */
-export const CODEX_QE_DECLINE_KINDS: readonly string[] = ['timeout', 'no-verdict', 'tool-error', 'unusable-output', 'unavailable', 'over-ceiling'];
+export const CODEX_QE_DECLINE_KINDS: readonly string[] = ['timeout', 'no-verdict', 'tool-error', 'unusable-output', 'unavailable', 'over-ceiling', 'wrong-tree'];
 
 export interface ClassifyCodexQeInput {
   readonly exit?: number | null;
@@ -1675,6 +1760,49 @@ export interface ClassifyCodexQeInput {
    * that was never wrapped (a saved fixture, a file on disk), where content is all there is.
    */
   readonly signalExpected?: boolean;
+  /**
+   * The files the dispatch DECLARED it would review. Used only by the wrong-tree rule below; absent
+   * ⇒ that rule cannot fire and the classifier behaves exactly as it did before field report 27.
+   */
+  readonly declaredFiles?: readonly string[] | null;
+}
+
+/**
+ * Did the reviewer fail to FIND the very files it was told to read?
+ *
+ * A review dispatched into the wrong working directory does not error: the paths simply are not
+ * there, the model says so in prose, and the command still exits 0 — often with a `Grade:` line,
+ * which the pipeline then records as a verdict about code nobody read.
+ *
+ * The rule is deliberately narrow, because a review of a file-handling module may legitimately
+ * DISCUSS "No such file or directory" — a mention is not a claim. So it fires only when one LINE
+ * carries both the not-found phrase and one of the declared paths. With no declared paths there is
+ * nothing to discriminate against and the rule stays silent rather than guessing.
+ */
+export function codexReviewMissedItsFiles(body: string | null | undefined, declaredFiles?: readonly string[] | null): boolean {
+  const text = String(body === undefined || body === null ? '' : body);
+  const files = Array.isArray(declaredFiles) ? declaredFiles.filter((f) => typeof f === 'string' && f !== '') : [];
+  if (text === '' || files.length === 0) return false;
+  // Only quotes, whitespace and a colon may sit between the path and the failure. Prose may not —
+  // and that single restriction is what separates "the tool could not open this path" from "this
+  // finding is ABOUT this path": a review finding always names its file, so anything looser marks
+  // every file-handling review as wrong-tree. (Codex, gpt-5.6-sol, on the first version of this
+  // function: the finding line "- [P2] Do not swallow file not found - src/io.ts:42" plus a stated
+  // grade C was classified wrong-tree, discarding a valid cross-family verdict and falling back to
+  // same-family QE — the guard against a false-clean review destroying a true one.)
+  const GAP = '["\'\u2018\u2019\u201c\u201d\u0060(\\[\\s:,]{0,4}';
+  const NOT_FOUND = 'no such file or directory|file not found|not found|does not exist|is not present|cannot be found';
+  const VERB = '(?:cannot|can\'t|could not|couldn\'t|unable to|failed to|error(?: while)?)\\s+(?:open|read|find|access|stat|locate|load)';
+  for (const f of files) {
+    const q = f.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const shapes = [
+      q + GAP + '(?:' + NOT_FOUND + ')',          // src/io.ts: No such file or directory
+      '(?:' + NOT_FOUND + ')' + GAP + q,          // No such file or directory: src/io.ts
+      VERB + GAP + q,                             // cannot open 'src/io.ts'
+    ];
+    for (const shape of shapes) if (new RegExp(shape, 'i').test(text)) return true;
+  }
+  return false;
 }
 
 /**
@@ -1711,6 +1839,10 @@ export function classifyCodexQeOutcome(input: ClassifyCodexQeInput): { kind: str
   } else if (exit !== 0) {
     return { kind: 'tool-error' };
   }
+  // BEFORE the grade rule, and deliberately so: a wrong-tree review usually DOES state a grade, and
+  // that grade is the most dangerous output this pipeline can produce — a clean letter about code
+  // nobody read, recorded while crossFamilyQe.happened stays true.
+  if (codexReviewMissedItsFiles(body, input ? input.declaredFiles : null)) return { kind: 'wrong-tree' };
   if (grade !== null) return { kind: 'verdict' };
   return { kind: 'no-verdict' };
 }
@@ -1750,6 +1882,9 @@ export function codexQeDeclineReason(kind: string | null | undefined, detail?: C
   const exit = d.exit === undefined || d.exit === null ? '?' : String(d.exit);
   const chars = d.chars === undefined || d.chars === null ? '?' : String(d.chars);
   const extra = d.detail === undefined || d.detail === null || String(d.detail) === '' ? 'no detail' : String(d.detail);
+  if (canonical === 'wrong-tree') {
+    return 'codex reported that the declared file(s) do not exist — the review ran in the WRONG working directory and its verdict is about a tree nobody asked for; ' + files + ' file(s) declared, exit ' + exit + ' (' + extra + ')';
+  }
   if (canonical === 'timeout') {
     return 'codex review timed out after ' + elapsed + 's on scope ' + ref + ' (' + files + ' files) — NARROW the scope (this is reconnaissance cost, not thinking time)';
   }
@@ -1763,7 +1898,11 @@ export function codexQeDeclineReason(kind: string | null | undefined, detail?: C
     return 'codex exec unusable — ' + (d.reason === undefined || d.reason === null || String(d.reason) === '' ? 'codex exec returned no text' : String(d.reason));
   }
   if (canonical === 'unavailable') {
-    return 'codex not used — ' + (d.reason === undefined || d.reason === null || String(d.reason) === '' ? 'codex exec reported it could not run' : String(d.reason));
+    // The detail is the ONE field that carries the shell error, and this branch used to drop it
+    // while `tool-error` right above rendered it — an asymmetry that made the field report's
+    // "codex exec reported it could not run" unfixable blind. Same `extra`, same shape.
+    const why = d.reason === undefined || d.reason === null || String(d.reason) === '' ? 'codex exec reported it could not run' : String(d.reason);
+    return 'codex not used — ' + why + (extra === 'no detail' ? '' : ' (' + extra + ')');
   }
   if (canonical === 'over-ceiling') {
     return 'prompt is ' + chars + ' chars / unscoped — refused before dispatch';
@@ -1804,12 +1943,12 @@ export interface CodexReviewResult {
  * wrapper and calls {@link classifyCodexQeOutcome} directly with `signalExpected: true`, so a
  * swallowed sentinel there is a `tool-error` and never a pass. A wiring test pins that.
  */
-export function parseCodexReviewResult(text: string | null | undefined): CodexReviewResult {
+export function parseCodexReviewResult(text: string | null | undefined, declaredFiles?: readonly string[] | null): CodexReviewResult {
   const sig = parseCodexReviewSignal(text);
   const findings = parseCodexReviewFindings(sig.body);
   const stated = parseCodexGrade(sig.body);
   const grade = stated !== null ? stated : gradeFromReviewFindings(findings);
-  const outcome = classifyCodexQeOutcome({ exit: sig.exit, body: sig.body, grade: grade, findings: findings, signalExpected: sig.signalPresent });
+  const outcome = classifyCodexQeOutcome({ exit: sig.exit, body: sig.body, grade: grade, findings: findings, signalExpected: sig.signalPresent, declaredFiles: declaredFiles === undefined ? null : declaredFiles });
   const kind = outcome.kind === 'unusable-output' ? 'empty' : outcome.kind;
   const ok = kind === 'verdict';
   const reason = ok ? null : codexQeDeclineReason(kind, { elapsedSeconds: sig.elapsedSeconds, exit: sig.exit, chars: sig.body.length });

package/src/index.ts

@@ -81,6 +81,9 @@ export { stampCheckpointLine } from './checkpoint-stamp.js';
 export { TELEMETRY_VOCAB_VERSION, TELEMETRY_FIELDS, PROVISIONAL_TELEMETRY_FIELDS, LOCAL_FIELD_ALIASES, telemetryFieldFor } from './telemetry-vocabulary.js';
 export type { TelemetryField, FieldSource } from './telemetry-vocabulary.js';
 export { planLedgerBackfill, LEDGER_FILL_SOURCE, AMBIGUOUS, resolveLedgerRunId } from './ledger-backfill.js';
+// project-skills root resolution (field report doc-25b): the ONE builder behind both the Step-0
+// probe and the PS_GUIDANCE paragraph, so the two can never look at different roots again.
+export { projectSkillsOneRoot, projectSkillsProbeCommand } from './project-skills-root.js';
 export type { LedgerBackfillPlan, LedgerBackfillRow, RunCostFacts } from './ledger-backfill.js';
 export type { SweepResult, DriftedSkill, SyncResult, SyncCanonicalOptions } from './skill-drift.js';
 export { benchmarkSkill, benchmarkSkills, compareSkills } from './benchmark.js';
@@ -119,12 +122,18 @@ export {
 } from './qe-bridge.js';
 export type { BridgeFamily, BridgeFailureReason, BridgeFinding, BridgeSignoff, BridgeParse, BridgeParseOk, BridgeParseFail, BridgeChannels, BridgeAudit, ClaudeResultExtraction, NamedExtract, BridgePromptInput } from './qe-bridge.js';
 export type { PatternRecord, SessionRecord, LearningConfig, MemoryLearningConfig, LoadOptions, ConsolidateResult, ConsolidateOptions, SqliteBackendMode, RecallHit, SessionsSource, PruneNoiseResult, RemovePatternsResult, SnapshotStoreResult, ReinforcementState, ReinforcePatternResult, StoreStats, LessonDeltaReport, LessonDeltaRow, QuarantineState, PromoteResult, QuarantineExpiryCandidate } from './patterns.js';
-export { DEFAULT_REINFORCE_THRESHOLD, NoopLearningBackend, NativeReinforcementBackend, resolveLearningBackend, isLearningSignalBackend } from './learning-backend.js';
-export type { LearningSignalBackend, LearningSignalStats, LearningSample, SignalCandidate, EnhanceContext, TrainingResult, LearningBackendMode } from './learning-backend.js';
+export { DEFAULT_REINFORCE_THRESHOLD, NoopLearningBackend, NativeReinforcementBackend, resolveLearningBackend, isLearningSignalBackend, applyLearningSignals, applyLearningSignalsWithDelta, applyLearningSignalsWithTerms } from './learning-backend.js';
+export type { LearningSignalBackend, LearningSignalStats, LearningSample, SignalCandidate, EnhanceContext, TrainingResult, LearningBackendMode, RerankTerm } from './learning-backend.js';
+// lesson-bandit-rerank (I-8): the ACL's public surface only. The vendored engine class is
+// deliberately NOT exported — `selectArm`'s "pick one and commit" is authority this domain denies
+// the ranker, and a foreign, invariant-blind API has no business on our safety-critical seam.
+export { resolveBanditConfig, payoffTermsFor, recordReward, recordExposures, contextKeyFor, banditStats, renderBanditHealth, narrowBanditReport, loadBanditState, banditStatePath, banditStateDir, freshBanditEnvelope, makeRewardEvent, classifySignal, BANDIT_LOCK_NAME, BANDIT_STATE_SCHEMA } from './lesson-payoff.js';
+export type { ResolvedBanditConfig, RewardEvent, ExposureEvent, PayoffTerm, PayoffTerms, BanditStateEnvelope, BanditLoadReason, BanditRecallReport, BanditHealth, BanditWriteOutcome } from './lesson-payoff.js';
 export {
   DEFAULT_VECTOR_TIMEOUT_MS,
   DEFAULT_HARMONIZE_THRESHOLD,
   REINFORCE_RRF_CAP,
+  BANDIT_RRF_CAP,
   withVectorTimeout,
   isVectorNoise,
   patternVectorEntry,
@@ -173,7 +182,8 @@ export type {
   ReindexVectorReport,
   TeachGuardResult,
 } from './vector-tier.js';
-export { runSetup, generateHooksConfig, generateAgentdbWriter, writerVersionOf, AGENTDB_WRITER_VERSION } from './setup.js';
+export { runSetup, generateHooksConfig, generateAgentdbWriter, writerVersionOf, AGENTDB_WRITER_VERSION,
+  agentdbStorePath, agentdbMcpStorePath, agentdbStoreSeparationProblem } from './setup.js';
 export { statuslineData, readFeatureAdrState, writeFeatureAdrState, featureAdrStateDir, featureAdrStatePath } from './statusline.js';
 export type { StatuslineData, FeatureAdrState, WriteFeatureAdrStateInput } from './statusline.js';
 export { indexPatternsToAgentdb, resolveAgentdbPath, searchAgentdbPatterns, listAgentdbDzIds, resolveAgentdbEmbedder, cosineSimilarity, importVectorsToAgentdb, reindexAgentdbRows, bumpAgentdbUses, clearAgentdbQuarantine, deleteAgentdbByDzIds, readAgentdbRowsByTaskType, DZ_OWNED_TASK_TYPES } from './agentdb-index.js';
@@ -242,6 +252,11 @@ export {
   serializeTrainingPair,
   trainingPairPath,
   trainingPairAppendCmd,
+  // operator-profile (ADR-001 Decision 5): the profile block never reaches .dz/fa-training/.
+  redactProfileBlock,
+  TP_PROFILE_MARKER_START,
+  TP_PROFILE_MARKER_END,
+  TP_PROFILE_REDACTED,
   // wave1-instrument-repair (ADR-003 Condition 3): the persist allowlist + composite shape check.
   codeCheckpointPersistAllowed,
   codeStageResultShapeValid,
@@ -634,6 +649,11 @@ export {
   SCOPED_QE_PROMPT_MAX_CHARS,
   isSafeCodexRef,
   codexReviewCommand,
+  codexExecCommand,
+  codexReviewMissedItsFiles,
+  CODEX_EXEC_TIMEOUT_SECONDS,
+  timeoutBinOrDefault,
+  TIMEOUT_BINS,
   codexQeSignalCommand,
   scopedQePrompt,
   parseCodexReviewSignal,
@@ -677,6 +697,12 @@ export type {
   CodexQeDeclineDetail,
   CodexReviewResult,
 } from './feature-adr-routing.js';
+export {
+  PARSER_SAFE_REGION_START,
+  PARSER_SAFE_REGION_END,
+  checkParserSafeRegion,
+} from './parser-safe-region.js';
+export type { ParserSafeRegionVerdict, ParserSafeRegionRefusal } from './parser-safe-region.js';
 export {
   CLAUDE_USAGE_MODELS,
   computeUsage,
@@ -844,3 +870,29 @@ export { quiescenceProbeScript, decideWriterQuiescence, WQ_WINDOW_SECONDS, WQ_MA
 export type { WriterQuiescenceDecision } from './writer-quiescence.js';
 export { decideCadenceWindow, isoWeekOf, weeklyBuckets, guardRepeatDecay, buildCadenceReport, CADENCE_WINDOW_DAYS } from './cadence.js';
 export type { CadenceWindow, CadenceReport, CadenceWindowDecision } from './cadence.js';
+export { readQeRounds, countQeRounds, QE_ROUNDS_DEFAULT_CEILING } from './qe-rounds.js';
+export type { QeRound, QeFailedAttempt, QeRoundsReport, QeRoundsStatus } from './qe-rounds.js';
+export { describeStoreLocation, storeLocationLine } from './store-location.js';
+export type { StoreLocation, StoreOrigin } from './store-location.js';
+export { mergeStoreHits, sameStore, globalStoreRoot, storeCountLabel } from './store-merge.js';
+export type { HitOrigin, OriginTagged } from './store-merge.js';
+export { resolveTeachTarget, teachReasonPhrase, readTeachToConfig, TeachTargetError, TEACH_STORES } from './teach-target.js';
+export type { TeachStore, TeachReason, TeachTarget } from './teach-target.js';
+export { probeNativeDep, describeNativeDep, exerciseSqliteOpen } from './native-dep-probe.js';
+export type { NativeDepState, NativeDepVerdict } from './native-dep-probe.js';
+
+// Operator profile (feature operator-profile, ADR-001) — WHO the assistant is talking to: a
+// per-user 0600 store under homedir(), rendered into a marked block in ~/.claude/CLAUDE.md
+// (layer 2 — loaded in every project, no dz required). The register changes FORM, never FACTS.
+export {
+  renderProfileBlock, readProfile, writeProfile, validateProfile,
+  profileStorePath, claudeMdPath, syncProfileBlock, checkProfileDrift,
+  mergeProfileBlock, extractProfileBlock, wrapProfileBlock,
+  parseRegister, registerOwnerWord, profileAgeDays,
+  parseDomainList, domainListText, parseYesNo,
+  PROFILE_MARKER_START, PROFILE_MARKER_END, REGISTERS,
+} from './profile.js';
+export type {
+  Register, Domain, OperatorProfile, ProfileReadResult, ProfileSyncResult,
+  ProfileDriftVerdict, ProfileDriftResult,
+} from './profile.js';