@gtrabanco/pi-agentic-workflow 0.37.0 → 5.0.0-canary.20261102.1

package/README.md

@@ -326,9 +326,9 @@ dialog.
 
 - Verified against the peer floor Pi 0.99.1 (2026-09-29) (`pi install`, package skills, friendly
   command registration, routed set/clear, settings console round-trip, `sendUserMessage`
-  with prompt template expansion). Also verified against Pi 1.2.0 (2026-10-14) via a local
+  with prompt template expansion). Also verified against Pi 1.5.0 (2026-11-02) via a local
   two-leg `tsc --noEmit` run (legs `0.99.1` + `latest`, the `latest` leg resolving to pi
-  1.2.0; COMPAT-OK); continuously against the
+  1.5.0; COMPAT-OK); continuously against the
   `latest` dist-tag by the `pi-compat-guard` PR gate (the leg is a moving tripwire,
   not a pinned version — a breaking release shows red here first).
 - The package declares Pi as a peer dependency; it bundles no copy of Pi.

package/dist/extension/factory.d.ts

@@ -2,7 +2,6 @@ import type { LoadedConfig } from "../config/load.js";
 import type { Catalogue } from "../routing/catalogue.js";
 import type { Router } from "../routing/dispatch.js";
 import { dirtyWorktreeWarning, receiptGuard } from "./receipt-guard.js";
-import { mergeGuard } from "./merge-guard.js";
 import type { ExtensionSurface, InvocationContext, ModelRef, RoutingControls } from "../routing/types.js";
 import type { HintStore } from "../routing/state.js";
 /**
@@ -55,14 +54,12 @@ export interface ExtensionHandle<M extends ModelRef = ModelRef> {
     catalogue: Catalogue;
     /**
      * The Pi-free predicates the adapter (`index.ts`) binds to Pi's lifecycle
-     * events: the inline-receipt block guard, the merge guard (owner-only
-     * merges, issue #278), and the dirty-worktree notice. They travel with the
-     * handle so the entry stays a thin translation layer and the decisions are
-     * unit-tested with no session (issues #182, #278).
+     * events: the inline-receipt block guard and the dirty-worktree notice. They
+     * travel with the handle so the entry stays a thin translation layer and the
+     * decisions are unit-tested with no session (issue #182).
      */
     guards: {
         receiptGuard: typeof receiptGuard;
-        mergeGuard: typeof mergeGuard;
         dirtyWorktreeWarning: typeof dirtyWorktreeWarning;
     };
 }

package/dist/extension/factory.js

@@ -2,7 +2,6 @@ import { loadConfig } from "../config/load.js";
 import { readCatalogue } from "../routing/catalogue.js";
 import { createRouter } from "../routing/dispatch.js";
 import { dirtyWorktreeWarning, receiptGuard } from "./receipt-guard.js";
-import { mergeGuard } from "./merge-guard.js";
 import { ADVANCE_COMMAND, SETTINGS_COMMAND, SETTINGS_COMMAND_ALIAS } from "../routing/types.js";
 import { registerAdvanceCommand } from "./conductor-command.js";
 import { createProfileStateStore, stateFilePath } from "../routing/state.js";
@@ -79,5 +78,5 @@ export function createExtension(deps) {
         description: "Show and configure per-command model routing",
         handler: settingsHandler,
     });
-    return { router, catalogue, guards: { receiptGuard, mergeGuard, dirtyWorktreeWarning } };
+    return { router, catalogue, guards: { receiptGuard, dirtyWorktreeWarning } };
 }

package/dist/extension/index.js

@@ -296,16 +296,8 @@ export default function extension(pi) {
     // names the script that proves the receipt landed (issue #182). The guard
     // itself filters to `bash`, so every tool call is checked — nesting it under
     // one tool name would make the block unreachable for the calls it exists for.
-    //
-    // Merges are owner-only (issue #278): `gh pr merge`, the `gh api` merge
-    // endpoints, and `git merge` are blocked before anything else runs — a
-    // review waiver is not merge authorization. Read-only git (`merge-tree`,
-    // `merge-base`) and rebases pass; the reason hands the PR URL to the owner.
     pi.on("tool_call", (event, ctx) => {
         const command = "command" in event.input && typeof event.input.command === "string" ? event.input.command : undefined;
-        const merge = guards.mergeGuard({ toolName: event.toolName, command });
-        if (merge.block)
-            return merge;
         const receipt = guards.receiptGuard({ toolName: event.toolName, command });
         if (receipt.block)
             return receipt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gtrabanco/pi-agentic-workflow",
-  "version": "0.37.0",
+  "version": "5.0.0-canary.20261102.1",
   "description": "Pi package: canonical agentic-workflow skills, friendly slash commands, and per-command model routing.",
   "keywords": [
     "pi-package",
@@ -43,25 +43,26 @@
   },
   "scripts": {
     "build": "tsc",
+    "build:deps": "bun run --cwd ../agentic-workflow-schema build",
     "bundle:skills": "bun scripts/bundle-skills.mjs",
     "clean:skills": "bun scripts/bundle-skills.mjs --clean",
     "test": "bun run bundle:skills && tsc && bun test test/*.test.mjs",
     "test:node": "bun run bundle:skills && tsc && node --test test/*.test.mjs",
-    "prepublishOnly": "bun run build && bun run bundle:skills && bun run test",
+    "prepublishOnly": "bun run build:deps && bun run build && bun run bundle:skills && bun run test",
     "postpack": "bun run clean:skills",
     "mutation": "bun run bundle:skills && bun scripts/mutation-check.mjs",
-    "prepare": "bun run build && bun run bundle:skills"
+    "prepare": "bun run build:deps && bun run build && bun run bundle:skills"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.99.1",
     "@earendil-works/pi-tui": "*"
   },
   "dependencies": {
-    "@gtrabanco/agentic-workflow": "0.5.0",
-    "@gtrabanco/agentic-workflow-schema": "4.9.0"
+    "@gtrabanco/agentic-workflow": "5.0.0-canary.20261102.1",
+    "@gtrabanco/agentic-workflow-schema": "5.0.0-canary.20261102.1"
   },
   "devDependencies": {
-    "@types/node": "24.13.3",
-    "typescript": "6.0.3"
+    "@types/node": "26.6.6",
+    "typescript": "7"
   }
 }

package/skills/audit-docs/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: audit-docs
 user-invocable: true
-version: 2.2.0
+version: 4.10.0
 argument-hint: "[--fix]"
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT

package/skills/audit-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: audit-pr
 user-invocable: true
-version: 5.6.3
+version: 4.10.0
 argument-hint: <pr-number> (optional — defaults to the current branch's PR)
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
@@ -50,6 +50,12 @@ independently evaluates only the delivery gates below.
   this skill and cannot be inherited from docs or an earlier session
 ✓ No review pass was composed or reconstructed: a missing/stale receipt is a
   blocker, never a prompt to re-run review axes from this skill
+✓ **Every AC links a demonstration artifact (S3, S7).** Read the unit doc's
+  `## Acceptance criteria` (or `## Specs` S# + `## Acceptance criteria` in
+  the re-cut shape). For each AC, verify it links a demonstration:
+  a passing test with output, a UI capture, a reproduced command output.
+  An AC without a demonstration is a **BLOCKER** — the PR's body must render
+  it. A PR whose ACs lack demonstrations never reaches the merge gate.
 ✓ Closure integrity was evaluated and its result stated explicitly: pass /
   blocker / n-a (fix-governed PRs are always n-a; never skipped
   silently)
@@ -77,6 +83,11 @@ first on purpose).
 everything the SPEC promised is present, traceable, and green. A missing or stale
 receipt is a blocker routed back to `/review-change`, never re-litigated here.
 
+**Cost-scaling invariant (S7).** Reviewers dig into code only when evidence is
+absent or contradicts — so review cost scales with the change, not the project.
+The non-technical approver (human layer) validates demonstrations; the merge
+gate (technical layer) validates evidence linkage. Same evidence, two readings.
+
 ## Scope
 
 The whole pull request: the branch vs. the default base, **plus** its SPEC and

package/skills/discover-repository-state/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: discover-repository-state
 user-invocable: true
-version: 1.2.2
+version: 4.10.0
 description: >
   Discover repository evidence and write a frozen Normalized Repository State.
   Produces verified repository evidence and keeps facts, decisions, planned

package/skills/execute-phase/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: execute-phase
 user-invocable: true
-version: 6.5.0
+version: 4.10.0
 argument-hint: <NN-slug> [P<k>|step] [--max-attempts N] [--force]
 allowed-tools: [Bash, Read, Edit, Write, MultiEdit]
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
@@ -43,11 +43,16 @@ if bun is not installed) and the
 ✓ Unit doc read and step selected (explicit P<k> or first unfinished)
 ✓ Step executed and committed (one commit per step, conventional format)
 ✓ Evidence rows updated (command → exit/digest → output → verified-by)
+  — each row carries the command, observed output (reproduced, not typed by
+  hand), and the verifying-by credit. (S5 — claim-evidence loop: mandatory
+  reproduction, loop-until-green inside the same turn)
 ✓ Progress log updated with a dated `YYYY-MM-DD HH:MM` entry that names the
   phase id (what, commit, next)
 ✓ Memory boundary ran — the phase's outcome saved under `unit/<NN-slug>/doc`,
   or the mirror marked pending when the layer is degraded
 ✓ Diff guard passed (on implement steps) — see `diff-guard` in PREFLIGHT.md
+✓ Self-audit box (S9 d): every claim the persist introduces was re-derived
+  with pasted output before the commit lands.
 ✓ → Next: block printed as the absolute last output
 ```
 
@@ -133,14 +138,51 @@ work. For `implement` steps: write tests-first where they pay (core/domain,
 orchestration — record the failing red run's command, exit, and failing test
 names before implementation), then green. UI/adapter glue may test after.
 
-### 5. Post-step
+### 5. Claim-evidence loop (S5 — before post-step)
+
+Before running post-step, verify every claim the step's repair introduces. This
+is the repairer-owned verification that prevents the unit 79 F50-class failure
+(closed gate-green with an unreproduced figure "170" without re-deriving via
+`git diff --numstat`).
+
+1. **Claim ledger.** Enumerate every claim: each new figure, cross-reference,
+   "X is now Y"; in code: each behavior the step declares.
+2. **Mandatory reproduction.** Re-derive the figure with the command, resolve
+   the reference with grep, reproduce the behavior. Paste command + observed
+   output into the claim table — never type the expected result by hand.
+3. **Loop until green.** red → repair → re-run, *inside the same turn*, until
+   every claim verifies.
+4. **Admission rule.** If no command can verify the sentence, it is not a
+   claim, it is an opinion, and it does not get written.
+
+Output:
+
+```
+| claim | command | output | status |
+|---|---|---|---|
+| <claim> | `<command>` | `<observed output>` | ✓ |
+```
+
+The row shape is published grammar (`evidence-row@1` in
+`@gtrabanco/agentic-workflow-schema`), so a row missing its command, its
+observed output or a ✓/✗ verdict is a shape violation rather than a style nit.
+
+**Bounded checkpoint (S13/S14).** The claim-evidence loop is only paid if it is
+cheap: `node scripts/test-route.mjs --check <changed path>` names the minimal
+suite a path needs, so an intermediate verification costs seconds instead of the
+full gate. An unmatched path answers `route: full-suite` — never fewer tests —
+and the full gate stays what the merge gate and CI run.
+
+### 6. Post-step
 
 1. **Diff guard** (implement steps only): run `bun scripts/diff-guard.mjs --base
    <last-step-commit> --unit <unit>` — paste the block verbatim. **BREACH → STOP**
    (re-triage or record exception). Anti-gaming: **NEVER shrink a diff by deleting
    comments, blank lines, docs or tests.**
 2. **Evidence rows**: one row per AC satisfied — `| AC | command | exit/digest |
-   output (≤2 lines) | verified-by |`. Append to the Evidence section.
+   output (≤2 lines, reproduced via command, not typed by hand) | verified-by |`
+   — append to the Evidence section. The evidence row is a *reproduced receipt*,
+   not an assertion (S5: mandatory reproduction extends to doc artifacts).
 3. **Progress log**: append a dated entry —
    `YYYY-MM-DD HH:MM — <what was done> → <commit sha> — next: <what is next>`.
 4. **Memory boundary** — this step is a phase transition. Follow
@@ -153,7 +195,7 @@ names before implementation), then green. UI/adapter glue may test after.
 5. **Commit**: `git add <changed files>` then `git commit -m "<type>(<scope>):
    <step-summary>"` — run it, paste the SHA.
 
-### 6. Red gate (repair loop)
+### 7. Red gate (repair loop)
 
 After each step: run the project's verification gate (type-check + tests + build).
 
@@ -173,7 +215,7 @@ After each step: run the project's verification gate (type-check + tests + build
     · continue atomically → /execute-phase <unit> <P<k>>
   ```
 
-### 7. Whole-unit mode
+### 8. Whole-unit mode
 
 When invoked as `<NN-slug>` with no step: loop all remaining steps, one commit
 each. This is an **explicit operator choice only** — the lane's hand-offs
@@ -185,8 +227,8 @@ the full accumulated diff. On gate red at any step: repair that step (up to
 `--max-attempts`), then continue the loop. The close-out is part of the last
 step's completion: open the PR on `main` with `Closes #N`, write `- PR: <url>`
 into References, and settle the index row with `agentic-workflow roadmap
-<index> rowUpsert '<json>'` (`docs/features/ROADMAP.md`; a fix unit edits its
-`docs/fix/README.md` status cell — no `NN` column, no `rowUpsert`).
+<index> rowUpsert '<json>'` (`docs/ROADMAP.md`; a fix unit edits its row in that
+document's `## Fixes` table — no `NN` column, no `rowUpsert`).
 `bun scripts/roadmap-settle.mjs` exits 0 (#316).
 Terminal:
 
@@ -200,7 +242,7 @@ PR: <url>
   · merge gate after REVIEW-PASS → /audit-pr
 ```
 
-### 8. Descope guard
+### 9. Descope guard
 
 Before creating **any** issue while executing: classify with the descope test.
 A descope (moving an acceptance criterion or task out of scope) requires
@@ -221,6 +263,11 @@ These files must be loaded when their topic is active:
 
 ## Guardrails
 
+- The all-stages no-assumption rule binds every step here — **ask-don't-infer**,
+  owner `skills/unit-lane/references/DESIGN.md` (`ask-dont-infer@1`): an
+  expectation the tree, the docs, or a prior owner decision does not evidence
+  is asked, never invented.
+
 **Allowed:**
 - Only the triaged steps listed by the unit doc's Evidence header
 - Changes scoped to the acceptance criteria and step tasks
@@ -235,6 +282,14 @@ These files must be loaded when their topic is active:
   keep assertions at least as strong.
 - Never execute a step the triage skipped — the catalog is authoritative.
 - Never edit the unit doc's Acceptance criteria (that is re-triage with user consent).
+- Never write to `docs/LOGS.md` (S9 4b): LOGS.md must be pure code output —
+  no model writes it. The interim rule (until feature 41's
+  `autoLogSession: mechanical`) is append-only: a wrong past line gets a *new
+  correcting line*, never an edit. Machine-authored git-facts entries also
+  kill the "hand-tallied figure" class.
+- Self-audit box (S9 d): before committing, re-derive every claim the step's
+  persist introduces with pasted output. The turn does not end with unreproduced
+  claims.
 - Never expand scope beyond what Non-goals define — findings discovered during
   implementation never widen the unit.
 - Never invent an acceptance criterion — ask the user with concrete options.

package/skills/execute-phase/references/PREFLIGHT.md

@@ -69,8 +69,8 @@ appending to the unit doc's Evidence section.
 
 ### Own-status precondition (runs after the dependency closure is met, still before any edit)
 
-Read the unit doc's status from the roadmap (the five-state machine —
-`docs/features/ROADMAP.md` → Status legend):
+Read the unit doc's status from the location index (the five-state machine —
+`docs/ROADMAP.md` → Status legend):
 
 1. **`idea`** (or no triage block in the unit doc) → STOP, before any edit:
 

package/skills/fold-findings/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: fold-findings
 user-invocable: true
-version: 1.11.0
+version: 4.10.0
 argument-hint: [finding-id …]
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
@@ -34,6 +34,18 @@ skill fixes each root cause, never relabeling, deferring, or weakening its check
 ✓ 5. The closing `Folded: n/m · Disputed: k · Blocked: j[ · Replan: r]` tally
      and outcome-branched `→ Next:` block are printed as the ABSOLUTE last output.
      Every affected finding ID is named in that block, joined with ` + `.
+✓ 6. Claim-evidence loop ran: before committing, every claim the repair
+     introduces was reproduced with the command and observed output pasted
+     into the claim table (`claim | command | output | status`). Loop ran until
+     green inside the same turn. (S5)
+✓ 7. Class escalation checked: ≥ 2 folded rows sharing mechanism+axis
+     were escalated to one class-level fix-now finding. (S1)
+✓ 8. Evidence-bound check: every finding citation was verified — the cited
+     file:line exists and the snippet matches the working tree verbatim. (S10)
+✓ 9. Reviewer anti-invention check: new findings are grounded in
+     provably-changed bytes (git-computed) or a mis-run cited check. (S10)
+✓ 10. Net narration diff ≤ 0 per fold: lines deleted, not moved. (S10)
+✓ 11. Closure status printed: `closure: complete | open(n)`. (S4)
 ```
 
 Any unchecked box means the turn is not done.
@@ -73,8 +85,22 @@ Per Workflow conventions, read:
 2. Queue the carrier's open rows — a legacy `folded: no` row, a migrated row of
    `## Findings` (all of them are open); explicit IDs restrict the queue and leave
    other rows untouched. Group by root cause, verifier and rollback boundary.
-3. The project's verification gate and forge CLI (use the declared forge).
-4. Whether the branch has an open PR; this decides immediate push after commit.
+3. **Class escalation (S1).** After grouping: ≥ 2 folded rows sharing
+   mechanism+axis ⇒ one class-level fix-now finding whose repair targets the
+   *mechanism*, not a repeated instance. The two-cycle cap then means what it
+   was built to mean: a class the loop refuses to repair is a planning defect,
+   not more folds. Document the escalation as `F<next> (class: <mechanism>,
+   replaces F<a> + F<b> + …)` in the ledger.
+4. **Evidence-bound check (S10, from #218).** Before processing, verify every
+   finding's citation: the cited `file:line` exists and the snippet matches the
+   working tree verbatim. Wrong-citation and position-drift findings are
+   discarded mechanically — `refuted` with evidence, no cycle consumed.
+5. **Reviewer anti-invention check (S10, from #205).** Any new finding surfaced
+   during fold must be grounded in **provably-changed bytes** (git-computed) or
+   a **mis-run cited check** (the cited validator's own output contradicts it).
+   A finding without changed-bytes grounding is a report-note, never fix-now.
+6. The project's verification gate and forge CLI (use the declared forge).
+7. Whether the branch has an open PR; this decides immediate push after commit.
 
 ## Progressive loading — fold queue
 
@@ -87,6 +113,58 @@ code or the ledger:
 Both are normative and one hop from this file. Missing resource → stop; never
 infer a classification or fold procedure.
 
+## Claim-evidence loop (S5 — mandatory before commit)
+
+Before committing the fold fix, run the claim-evidence loop. This is not optional;
+a turn that writes without verifying its own claims is the exact failure class
+that produced unit 79's F49→F50→F51.
+
+1. **Claim ledger.** Enumerate every claim the repair introduces: each new
+   figure, cross-reference, "X is now Y"; in code: each behavior the fix
+   declares. Write one row per claim.
+2. **Mandatory reproduction.** Every claim is executed, never asserted:
+   re-derive the figure with the command, resolve the reference with grep,
+   reproduce the behavior. Paste command + observed output into the claim
+   table — never type the expected result by hand.
+3. **Loop until green.** red → repair → re-run, *inside the same turn*, until
+   every claim in the closure set verifies. The repairer's turn does not end
+   with unreproduced claims.
+4. **Admission rule.** If no command can verify the sentence, it is not a
+   claim, it is an opinion, and it does not get written. This extends the
+   repo's own tests-first rule to documentation artifacts.
+
+Output the claim table as:
+
+```
+## Claim-evidence table
+| claim | command | output | status |
+|---|---|---|---|
+| <claim text> | `<command>` | `<observed output>` | ✓ |```
+
+All rows must have `status: ✓`. A `status: ✗` row means the turn is not done
+— repair and re-run the claim.
+
+The row shape is published grammar, not convention (`evidence-row@1` in
+`@gtrabanco/agentic-workflow-schema`: `EVIDENCE_ROW_COLUMNS`,
+`EVIDENCE_ROW_VERDICTS`, `validateEvidenceRow`). A row whose claim is empty, whose
+command or output is not a backticked command/observation, or whose verdict is
+outside `✓ | ✗` is a shape violation — prose in the command cell is refused
+exactly like an empty one, because a typed expectation is the defect the shape
+exists to stop.
+
+## Closure status (S4, S11)
+
+At the end of the fold, print the closure status:
+
+```
+closure: complete | open(n)
+```
+
+- `complete` — all findings in the queue are resolved (folded, refuted, disputed, or replanned).
+- `open(n)` — n findings remain open (blockers that need user input). Print the count and the blocker IDs.
+
+Cycle-count stops being the health metric; closure is the invariant.
+
 ## Report — return exactly this structure (fixed output contract)
 
 Per finding, in processing order:
@@ -152,6 +230,10 @@ table: [`FOLD_PROCESS.md`](references/FOLD_PROCESS.md) §Batch classification.
 
 ## Guardrails
 
+- The all-stages no-assumption rule binds fold work — **ask-don't-infer**, owner
+  `skills/unit-lane/references/DESIGN.md` (`ask-dont-infer@1`): a repair the
+  evidence does not settle is researched and asked about, never assumed.
+
 Scope is the ledger (or explicit ID subset); unlisted discoveries are proposals
 for user triage. Batch only when one root-cause correction, validator set and
 rollback boundary own the rows: one commit/push, individual ticks/lines. Split
@@ -193,6 +275,36 @@ every declared grep and fails closed with `sweep-mismatch`, naming
 `file:line`, the regex and the observed count. A fold that changes such a
 surface and emits no declaration is a `workflow` finding at review.
 
+**Re-review skip default inversion (S9, feature 30).** The `RE-REVIEW-OPTIONAL/SKIPPED`
+branch shipped in feature 30 was never exercised once (11 cycles on docs-only
+changes). Fix: for docs-only batches with a green sweep declaration
+(#315's claim kind), **skip becomes the machine-decided default** — re-review
+requires recorded justification. Why safe *now*: the residual risk the default
+hedged (stale survivors) becomes a pre-commit failure once #315's sweep kind
+exists. The decision moves from human inertia (always yes) to machine rule
+(batch class + sweep green ⇒ skip).
+
+**Net narration diff ≤ 0 (S10 1).** Each fold must strictly decrease the defect
+surface. Add a computed check: the net narration diff per fold must be ≤ 0 —
+lines deleted, not moved. Measured by `git diff --numstat` over the fold's
+commit. This is the arithmetic that makes #307's "deterministic gates converge"
+possible.
+
+**Defect identity: mechanism, not file:line (S4).** Defect identity in the ledger
+moves from `file:line` to the *mechanism* (the site stays as evidence). When
+folding, group by mechanism+axis, not by file:line+axis. The same bug surfacing
+as F49, then F50, then F51 costs a full review cycle each time when grouped by
+file:line; grouped by mechanism, one class escalation fixes all three.
+
+**Per-file review state (S10 6, from #218; shipped as S16).** `review-state.json`
+per unit, single writer = `scripts/review-state.mjs`, model passes read-only: each
+file in the affecting-path inventory ends a cycle `reviewed@<sha>` or
+`skipped@<sha>` with a concrete reason; skips auto-invalidate when a later diff
+touches the file; coverage closure `inventory − reviewed − skipped = 0` is a
+mechanical receipt check. Run `node scripts/review-state.mjs check --unit <slug>`
+and paste the block — `closure: complete` exits 0, `closure: open(n)` exits 1 and
+is a blocker, never a note.
+
 ## Portability (agents other than Claude Code)
 
 Use explicit fallbacks when a primitive is absent: open named `SKILL.md` files in
@@ -251,8 +363,9 @@ decision to skip.
 |---|---|---|
 | freeze-batch (≥ 1 product-owned row) | `PRODUCT-ROUTE` | `/unit-lane <slug>` (feature) or `/unit-lane --fix <n>` (fix) when the router concludes `product` — the lane repairs the half through its `design` step, its `review` step re-judges it; the conclusion printed by `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed; discovery step the fold already ran) |
 | freeze-batch (≥ 1 replan-class row) | `REPLAN-ROUTE` | `/unit-lane <slug>` (feature) or `/unit-lane --fix <n>` (fix) when the router concludes `replan` — user confirms, the lane's `plan` step appends the phases and its `review` step gates, then `/execute-phase` on this unit; on `route: decision` stop and surface the decision to the user — the conclusion printed by `bun scripts/unit-route.mjs <unit>` (node fallback if bun is not installed; discovery step the fold already ran) |
-| `all-repair-in-place` + docs-only + no folded row severity `high` + prior consumer skip decision | `RE-REVIEW-SKIPPED` | skip — consumer has explicitly decided to skip the re-review |
-| `all-repair-in-place` + docs-only + no folded row severity `high` | `RE-REVIEW-OPTIONAL` | `/review-change` (default, delta mode) — or the consumer's recorded skip decision |
+| `all-repair-in-place` + docs-only + green sweep declaration + no folded row severity `high` | `RE-REVIEW-SKIPPED` | skip — green sweep (#315) + docs-only ⇒ skip is default (S9); re-review requires recorded justification |
+| `all-repair-in-place` + docs-only + no sweep declaration + no folded row severity `high` + prior consumer skip decision | `RE-REVIEW-SKIPPED` | skip — consumer has explicitly decided to skip the re-review |
+| `all-repair-in-place` + docs-only + no sweep declaration + no folded row severity `high` | `RE-REVIEW-OPTIONAL` | `/review-change` (default, delta mode) — or the consumer's recorded skip decision |
 | empty batch (class `none`) | `RE-REVIEW-OPTIONAL` | `/review-change` by default — safe: the head is unchanged |
 | anything else (behavioral surface or any folded row `high`) | `RE-REVIEW-REQUIRED (delta)` | `/review-change` — delta mode mandatory default |
 
@@ -264,7 +377,12 @@ decision to skip.
 - **Frozen-severity-`high` override.** A folded row whose frozen severity is
   `high` forces `RE-REVIEW-REQUIRED (delta)` even on a docs-only diff. Frozen
   fields are never edited to reach a branch.
-- **SKIPPED requires prior consumer decision (E-D2).** `RE-REVIEW-SKIPPED`
-  is printed only by a turn carrying an explicit prior consumer decision to
-  skip. A turn with no recorded prior consumer decision prints
+- **SKIPPED with sweep (S9).** `RE-REVIEW-SKIPPED` is printed when the batch
+  is docs-only + has a green sweep declaration (#315's claim kind), even
+  without a prior consumer decision. This is the default inversion: skip is
+  the machine-decided default for docs-only + sweep green. Prior consumer
+  decision is still accepted (backwards-compatible).
+- **SKIPPED without sweep (E-D2).** `RE-REVIEW-SKIPPED` requires an explicit
+  prior consumer decision when the batch is docs-only but has no sweep
+  declaration. A turn with no recorded prior consumer decision prints
   `RE-REVIEW-OPTIONAL` + the re-review default, **never** `RE-REVIEW-SKIPPED`.

package/skills/fold-findings/references/FOLD_PROCESS.md

@@ -78,7 +78,7 @@ hard-wrapped across several lines, never joined into one prose line.
 ## REPAIR-RECEIPT — fixed printed block (verbatim copy)
 
 Printed after the per-finding table and tally, as part of the ABSOLUTE-last
-output together with the branching `→ Next:` block. Six fields, always
+output together with the branching `→ Next:` block. Seven fields, always
 present:
 
 ```text
@@ -87,6 +87,12 @@ present:
 - Refuted/open: <F-ids joined ` + `, or `none`>
 - Gate: <command> → exit <n> at head <40-hex sha> · n/a when nothing was folded
 - Batch class: <all-repair-in-place | frozen (replan present) | frozen (product owner present) | none>
+- Closure: <complete | open(n)> · open names the blocker ids
 - Fold diff: <shortstat from a real `git diff` run> · none when nothing was folded
 - Branch: <RE-REVIEW-REQUIRED (delta) | RE-REVIEW-OPTIONAL | RE-REVIEW-SKIPPED | REPLAN-ROUTE | PRODUCT-ROUTE>
 ```
+
+The claim-evidence table the fold prints before this block (§ Claim-evidence
+loop in SKILL.md) is what makes `Closure:` a receipt rather than a claim: a row
+with `status: ✗` means the fold is not closed, and `Closure: complete` is only
+printable once every row reads ✓.

package/skills/init-workspace/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: init-workspace
 user-invocable: true
-version: 4.3.0
+version: 4.10.0
 argument-hint: <target-dir>
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
@@ -65,7 +65,8 @@ Inspect the target dir (`[target-dir]`, default cwd) before touching anything:
 - An existing **agent guide** (`AGENTS.md`, or a legacy `CLAUDE.md`), `docs/`,
   `.github/`? If so, **do not clobber** — check first whether it's an
   **agentic-workflow scaffold** (marker: an agent guide present *and* either
-  `docs/features/ROADMAP.md` or a `docs/workflow/` dir). If both markers are
+  `docs/ROADMAP.md` — or the pre-319 `docs/features/ROADMAP.md` — or a
+  `docs/workflow/` dir). If both markers are
   present, offer **upgrade** as the default action, alongside merge /
   adapt-in-place / abort — see **Upgrade mode** below. If an agent guide or
   `docs/` exists but the markers are absent (a foreign scaffold), stay in
@@ -166,11 +167,17 @@ loads exactly upgrade and skips bootstrap plus portability.
 
 ## Unit document conventions (the adaptive lane)
 
-The adaptive lane (feature 61) replaces the fixed pipeline with a single-unit-
-document model. Every NEW unit produces one `SPEC.md` under
-`docs/features/<NN>-<slug>/` with 14 sections: Objective, Why, User outcome, Acceptance criteria, Impact,
-Non-goals, Future cost, Applicable tests, Known pre-existing issues, Tasks,
-Evidence, Progress log, Next, References.
+The adaptive lane replaces the fixed pipeline with a single-unit-document model.
+Every NEW unit produces one `SPEC.md` under `docs/features/<NN>-<slug>/`, cut in
+the **`spec-by-reference`** shape the template ships: `Specs` (numbered `S#`, each
+quoting the requester's words verbatim), Impact, Non-goals, Future cost,
+Applicable tests, Known pre-existing issues, `Tasks` (each bullet linked to the
+`S#` it delivers), `Findings` (OPEN rows only), `Log` (append-only; `L1` is the
+request verbatim), Next, References. A unit opened before this shape keeps the
+legacy 14-section shape — Objective, Why, User outcome, Acceptance criteria,
+Impact, Non-goals, Future cost, Applicable tests, Known pre-existing issues,
+Tasks, Evidence, Progress log, Next, References — and is never rewritten to
+migrate.
 
 Conventions written into the project's AGENTS.md:
 
@@ -188,8 +195,8 @@ Conventions written into the project's AGENTS.md:
 
 These are written by bootstrap (fresh) and upgrade mode (additive-only for pre-
 lane installs). A pre-lane project gets only: the lane conventions section in
-AGENTS.md, the unit doc template under `docs/features/_TEMPLATE/`, and the
-docs-map row for the unit doc.
+AGENTS.md, the unit doc templates under `docs/features/_TEMPLATE/` and
+`docs/fix/_TEMPLATE/`, and the docs-map rows for them.
 
 ## Normalized Repository State
 

package/skills/init-workspace/references/BOOTSTRAP_WRITE.md

@@ -4,10 +4,11 @@
    the documentation map rows, architecture); write the **adaptive lane
    conventions** (unit document, triage, catalog steps, guards, evidence rows,
    dated progress log, closed commit format `type(scope): description`); keep
-   the `features/_TEMPLATE` + `ROADMAP`, the `fix/_TEMPLATE` + `README`, and
-   the `.github/` templates; keep `.agentic-workflow/hooks/` and activate only
-   the adapters explicitly accepted in the interview; prune unused doc folders
-   and map rows. Leave honest placeholders where the user hasn't decided — never
+   the documentation templates it ships — `features/_TEMPLATE` beside
+   `features/ROADMAP.md`, and `fix/_TEMPLATE` beside `fix/README.md` — and the
+   `.github/` templates; keep `.agentic-workflow/hooks/` and activate only the
+   adapters explicitly accepted in the interview; prune unused doc folders and
+   map rows. Leave honest placeholders where the user hasn't decided — never
    invent values.
 5. **Seed Normalized Repository State.** Copy
    `template/docs/workflow/REPOSITORY_STATE.md` to
@@ -21,9 +22,14 @@
    optional: an absent document means no project invariants are declared, not
    that the scaffold failed. If retained, add its documentation-map row and
    name the project's explicit architectural-decision authority.
-7. **Propagate the unit doc template.** Ensure
-   `docs/features/_TEMPLATE/SPEC.md` exists with all 14 sections sections.
-   This is the template used when creating new unit documents.
+7. **Propagate the unit doc templates.** Ensure both template folders exist and
+   are cut in the `spec-by-reference` shape the scaffold ships —
+   `docs/features/_TEMPLATE/SPEC.md` and `docs/fix/_TEMPLATE/SPEC.md` (`Specs`
+   with `S#` requirements, Impact, Non-goals, Future cost, Applicable tests,
+   Known pre-existing issues, `Tasks`, `Findings`, `Log`, Next, References).
+   These are the templates used when creating new unit documents; a unit opened
+   before this shape keeps the legacy 14-section shape and is never rewritten to
+   migrate.
 8. **Provision Serena — one consented question, then write.** Load
    [SERENA](SERENA.md) and ask its single consent question; one yes covers the
    tool install, the detected platform's MCP registration and the global trust