@ericrisco/rsc 4.0.4 → 4.0.5

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.0.4",
+  "version": "4.0.5",
   "counts": {
     "skills": 274,
     "agents": 34,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "4.0.4",
+  "version": "4.0.5",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {

package/skills/asdd/SKILL.md

@@ -61,7 +61,7 @@ Every spec answers four questions, and `spec:gate` refuses one dated 2026-11-03
 
 Tier 2, a contradiction with a recorded decision, a gap that would make the build unsafe, or no convergence in 3 rounds: the task goes to the **decision queue** (`## Decision queue` in `progress/<slug>.md`) with its evidence, and the agent **continues with the independent tasks**. The run never waits at 2 a.m. for an answer.
 
-Every entry carries a kind, one line each:
+Every entry carries a kind, one line each, in exactly this form (no bold, no other bullet):
 
 ```markdown
 - [blocking] Q3 — <what must be decided>, <evidence>, <task>
@@ -102,6 +102,8 @@ Autopilot does not stop the run for questions — it **parks**: real ambiguity,
 - `implement` parks `blocking` items and continues with the independent tasks.
 - `ship` lands by the rule below.
 
+**Never hand the turn back mid-run.** No "¿sigo?" / "shall I continue?": not between phases, not while reviewers run. Background reviewers are waited for (their completion notice, or run them in the foreground); ending the turn to wait ends a headless run. A later "continue" from the person resumes the run; it is **not** approval for a tier-2 merge, which needs an explicit yes to that merge.
+
 **Landing — there is always a legal path.** A remote exists → open a PR; self-merge only when `rsc risk` says tier 0-1, CI is green and no `blocking` entry is open; `review-after` entries go into the PR body. No remote → **park**: leave the branch committed, write the explainer, the open entries and the exact merge command for the human into `progress/<slug>.md`, and stop. Never merge locally around the branch guard: when `rsc main status` says `closed: true`, the guard denies it.
 
 Narrate in the `orient` voice: name each stage as it passes and show its artifact, one line each.

package/skills/implement/SKILL.md

@@ -115,7 +115,7 @@ review of the task, this first one included. Round 1 is the task's first review,
 | --- | --- |
 | 0 | none — the controls (e) still run |
 | 1 | one fresh-context reviewer; frozen brief in `references/per-task-review.md` |
-| 2 | the three refuters (`refuter-correctness` · `refuter-security` · `refuter-tests`) in parallel, as `../review/SKILL.md` runs them; then `review ledger panel <slug>/<task> --lenses correctness,security,tests` — the push gate checks it |
+| 2 | the three refuters (`refuter-correctness` · `refuter-security` · `refuter-tests`) in parallel, as `../review/SKILL.md` runs them; then `review ledger panel <slug>/<task> --lenses correctness,security,tests` — the push gate checks it. Wait for every reviewer inside the turn; never end the turn to ask whether to continue |
 
 Every reviewer gets the **spec**, the **diff as a file** (`scripts/review-package <BASE> <HEAD>`, BASE
 = the task's *recorded* base sha, never `HEAD~1`), the **surrounding code** at that sha (not just the

package/targets/claude.js

@@ -45,6 +45,8 @@ export function hookWiringOf(entry) {
 // plus the legacy cat-form) from settings.json, across all events. User hooks and
 // other settings are preserved. Empty event arrays (and an empty hooks object) are
 // pruned so we don't leave noise behind.
+const ATTRIBUTION_MARKER = '.rsc/attribution-default';
+
 export function unwireHook(paths) {
   // The bootstrap lives in the COMMITTED tree, so leaving it behind does not just orphan a file the
   // way a stray `.rsc/` entry would — it leaves an executable in something the user pushes. Nothing
@@ -62,7 +64,18 @@ export function unwireHook(paths) {
   if (!existsSync(file)) return removed;
   let settings;
   try { settings = JSON.parse(readFileSync(file, 'utf8')); } catch { return removed; }
-  if (!settings.hooks) return removed;
+  // wireHook's attribution default goes back out with it — only when wireHook wrote it (the marker)
+  // and it is still untouched. The same value set by the person before rsc stays theirs.
+  const marker = join(paths.projectRoot, ATTRIBUTION_MARKER);
+  const a = settings.attribution;
+  const ours = existsSync(marker) && a && Object.keys(a).length === 2 && a.commit === '' && a.pr === '';
+  if (ours) delete settings.attribution;
+  try { rmSync(marker, { force: true }); } catch { /* cleanup never fails the uninstall */ }
+  if (!settings.hooks) {
+    if (!ours) return removed;
+    writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');
+    return [...removed, file];
+  }
   for (const event of Object.keys(settings.hooks)) {
     settings.hooks[event] = (settings.hooks[event] || []).filter((e) => {
       const s = hookWiringOf(e);
@@ -319,6 +332,15 @@ export function wireHook(paths, sourceMd, policy = {}) {
   }
   if (!settings.hooks.PreToolUse.length) delete settings.hooks.PreToolUse;
 
+  // Authorship is the responsible person, never an AI trailer (constitution P8). Claude Code's own
+  // default adds a Co-Authored-By line to commits and a footer to PRs, and the 4.0.4 run had to rebase
+  // them out by hand. Empty strings hide both. A choice already in the file is the person's and stays.
+  if (settings.attribution === undefined && settings.includeCoAuthoredBy === undefined) {
+    settings.attribution = { commit: '', pr: '' };
+    mkdirSync(join(paths.projectRoot, '.rsc'), { recursive: true });
+    writeFileSync(join(paths.projectRoot, ATTRIBUTION_MARKER), '');
+  }
+
   mkdirSync(dirname(file), { recursive: true });
   writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');