@iceinvein/agent-skills 0.22.0 → 0.23.1

package/skills/magpie/scripts/setup-cmd.ts

@@ -1,19 +1,20 @@
-import { appendFile, mkdir, rm, writeFile } from 'node:fs/promises'
-import { join } from 'node:path'
+import { appendFile, mkdir, realpath, rm, stat, writeFile } from 'node:fs/promises'
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { fetchPr } from './gh.ts'
 import { buildIncrementalContext, findPreviousRun } from './incremental.ts'
+import { diffSha256, localBranchDiff, localBranchMeta } from './local-diff.ts'
 import { filterDiff, loadPathFilterConfig } from './path-filter.ts'
 import { type Deps, defaultDeps, preflight, renderInstallHint } from './preflight.ts'
 import { shardDiff } from './shard.ts'
+import { writeTarget } from './target.ts'
 import { detectMissingTests } from './tests-check.ts'
-import { createWorktree } from './worktree.ts'
+import { createWorktree, removeWorktree } from './worktree.ts'
 
 export type RunSetupInput = {
   runDir: string
-  prNumber: number
   repoPath: string
   deps?: Deps
-}
+} & ({ mode: 'pr'; prNumber: number } | { mode: 'local'; baseRef?: string; intentFile?: string })
 
 async function logLine(runDir: string, entry: Record<string, unknown>): Promise<void> {
   await appendFile(join(runDir, 'log.jsonl'), `${JSON.stringify({ ...entry, ts: Date.now() })}\n`)
@@ -21,20 +22,58 @@ async function logLine(runDir: string, entry: Record<string, unknown>): Promise<
 
 export async function runSetup(input: RunSetupInput): Promise<number> {
   const deps = input.deps ?? defaultDeps()
-  await mkdir(input.runDir, { recursive: true })
-  await mkdir(join(input.runDir, 'findings'), { recursive: true })
-  await mkdir(join(input.runDir, 'screen'), { recursive: true })
-  await mkdir(join(input.runDir, 'state'), { recursive: true })
+  // Absolute so target.json and every git call agree on the repo whatever the cwd.
+  const repoPath = resolve(input.repoPath)
+  // Resolved once so the inside-repo guard checks the same path mkdir creates:
+  // left raw, the OS would follow `..` through a symlink the guard resolved textually.
+  const runDir = resolve(input.runDir)
+  if (input.mode === 'local') {
+    const repoStat = await stat(repoPath).catch((err: NodeJS.ErrnoException) => {
+      if (err.code === 'ENOENT') return null
+      throw err
+    })
+    if (repoStat === null) {
+      process.stderr.write(`magpie: --repo ${repoPath} does not exist\n`)
+      return 2
+    }
+    if (!repoStat.isDirectory()) {
+      process.stderr.write(`magpie: --repo ${repoPath} is not a directory\n`)
+      return 2
+    }
+    // Checked before any mkdir: a --repo below the root would otherwise let a
+    // run dir elsewhere in the repo pass the guard below and be created there.
+    const top = await gitToplevel(deps.git, repoPath)
+    if (!top.ok) {
+      process.stderr.write(`magpie: ${top.error}\n`)
+      return 2
+    }
+    if ((await realpath(repoPath)) !== (await realpath(top.root))) {
+      process.stderr.write(`magpie: --repo ${repoPath} is not the repository root ${top.root}\n`)
+      return 2
+    }
+    // Local mode reviews the repo in place, so a run dir inside it would be
+    // written to and its rollback would delete the caller's files.
+    if (await isWithin(runDir, top.root)) {
+      process.stderr.write(
+        `magpie: run dir ${runDir} is inside the repository under review ${top.root}\n`,
+      )
+      return 2
+    }
+  }
+  await mkdir(runDir, { recursive: true })
+  await mkdir(join(runDir, 'findings'), { recursive: true })
+  await mkdir(join(runDir, 'screen'), { recursive: true })
+  await mkdir(join(runDir, 'state'), { recursive: true })
 
   const preResult = await preflight(deps)
   if (!preResult.ok) {
-    await logLine(input.runDir, { stage: 'setup', status: 'error', missing: preResult.missing })
+    await logLine(runDir, { stage: 'setup', status: 'error', missing: preResult.missing })
     process.stderr.write(`magpie: missing dependencies:\n${renderInstallHint(preResult.missing)}\n`)
-    await cleanup(input.runDir)
+    await cleanup(runDir)
     return 3
   }
   if (preResult.missingOptional.length > 0) {
-    await logLine(input.runDir, {
+    await logLine(runDir, {
       stage: 'preflight',
       status: 'done',
       missingOptional: preResult.missingOptional,
@@ -43,77 +82,230 @@ export async function runSetup(input: RunSetupInput): Promise<number> {
       `magpie: optional dependency unavailable, some stages will be skipped:\n${renderInstallHint(preResult.missingOptional)}\n`,
     )
   } else {
-    await logLine(input.runDir, { stage: 'preflight', status: 'done' })
+    await logLine(runDir, { stage: 'preflight', status: 'done' })
   }
 
-  const fetched = await fetchPr({
-    ghBin: deps.gh,
-    gitBin: deps.git,
-    prNumber: input.prNumber,
-    runDir: input.runDir,
-    cwd: input.repoPath,
-  })
-  if (!fetched.ok) {
-    await logLine(input.runDir, { stage: 'fetch-pr', status: 'error', error: fetched.error })
-    process.stderr.write(`magpie: ${fetched.error}\n`)
-    await cleanup(input.runDir)
-    return 4
+  const diffExit =
+    input.mode === 'local'
+      ? await writeLocalDiff(runDir, deps.git, repoPath, input.baseRef, input.intentFile)
+      : await writePrDiff(runDir, deps, repoPath, input.prNumber)
+  if (diffExit !== 0) {
+    await cleanup(runDir)
+    return diffExit
   }
-  await logLine(input.runDir, {
-    stage: 'fetch-pr',
-    status: 'done',
-    source: fetched.source,
-    ...(fetched.mergeBase ? { mergeBase: fetched.mergeBase } : {}),
-  })
-  // Sidecar so the report can say where the diff came from without re-parsing
-  // log.jsonl, the same way incremental.json carries the incremental context.
-  await writeFile(
-    join(input.runDir, 'diff-source.json'),
-    `${JSON.stringify({ source: fetched.source, mergeBase: fetched.mergeBase ?? null }, null, 2)}\n`,
-  )
 
-  await applyPathFilter(input.runDir, input.repoPath)
+  await applyPathFilter(runDir, repoPath)
 
   try {
-    await runShard(input.runDir)
+    await runShard(runDir)
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err)
-    await logLine(input.runDir, { stage: 'shard', status: 'error', error: message })
+    await logLine(runDir, { stage: 'shard', status: 'error', error: message })
     process.stderr.write(`magpie: ${message}\n`)
-    await cleanup(input.runDir)
+    await cleanup(runDir)
     return 6
   }
 
-  await runTestsCheck(input.runDir)
+  await runTestsCheck(runDir)
 
-  await detectIncrementalReview(input.runDir, input.prNumber)
+  if (input.mode === 'local') {
+    await logLine(runDir, { stage: 'setup', status: 'done', root: repoPath })
+    return 0
+  }
+
+  await detectIncrementalReview(runDir, input.prNumber)
 
-  const prJson = (await Bun.file(join(input.runDir, 'pr.json')).json()) as { headRefName: string }
+  const prJson = (await Bun.file(join(runDir, 'pr.json')).json()) as { headRefName: string }
   const branch = prJson.headRefName
 
   const wt = await createWorktree({
     gitBin: deps.git,
-    repoPath: input.repoPath,
+    repoPath,
     branch,
-    runDir: input.runDir,
+    runDir: runDir,
   })
   if (!wt.ok) {
-    await logLine(input.runDir, { stage: 'worktree', status: 'error', error: wt.error })
+    await logLine(runDir, { stage: 'worktree', status: 'error', error: wt.error })
     process.stderr.write(`magpie: ${wt.error}\n`)
-    await cleanup(input.runDir)
+    await cleanup(runDir)
+    return 5
+  }
+  try {
+    await writeTarget(runDir, { mode: 'pr', root: resolve(runDir, 'worktree') })
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    await logLine(runDir, { stage: 'worktree', status: 'error', error: message })
+    process.stderr.write(`magpie: ${message}\n`)
+    // The worktree is registered in the caller's repo; deleting the dir alone would leave it listed.
+    const removed = await removeWorktree({
+      gitBin: deps.git,
+      repoPath,
+      worktreePath: wt.worktreePath,
+    })
+    if (!removed.ok) process.stderr.write(`magpie: ${removed.error}\n`)
+    await cleanup(runDir)
     return 5
   }
-  await logLine(input.runDir, { stage: 'setup', status: 'done', worktree: wt.worktreePath })
+  await logLine(runDir, { stage: 'setup', status: 'done', worktree: wt.worktreePath })
+  return 0
+}
+
+/** realpath of the nearest existing ancestor, with the not-yet-created tail re-appended. */
+async function realpathAllowingMissing(path: string): Promise<string> {
+  const absolute = resolve(path)
+  try {
+    return await realpath(absolute)
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException)?.code !== 'ENOENT') throw err
+    const parent = dirname(absolute)
+    if (parent === absolute) throw err
+    return join(await realpathAllowingMissing(parent), basename(absolute))
+  }
+}
+
+async function gitToplevel(
+  gitBin: string,
+  repoPath: string,
+): Promise<{ ok: true; root: string } | { ok: false; error: string }> {
+  const proc = Bun.spawn([gitBin, 'rev-parse', '--show-toplevel'], {
+    cwd: repoPath,
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ])
+  if ((await proc.exited) !== 0) {
+    return {
+      ok: false,
+      error: `--repo ${repoPath} is not inside a git work tree: ${stderr.trim()}`,
+    }
+  }
+  return { ok: true, root: stdout.trim() }
+}
+
+async function isWithin(path: string, root: string): Promise<boolean> {
+  const rel = relative(await realpathAllowingMissing(root), await realpathAllowingMissing(path))
+  return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))
+}
+
+async function writePrDiff(
+  runDir: string,
+  deps: Deps,
+  repoPath: string,
+  prNumber: number,
+): Promise<number> {
+  const fetched = await fetchPr({
+    ghBin: deps.gh,
+    gitBin: deps.git,
+    prNumber,
+    runDir,
+    cwd: repoPath,
+  })
+  if (!fetched.ok) {
+    await logLine(runDir, { stage: 'fetch-pr', status: 'error', error: fetched.error })
+    process.stderr.write(`magpie: ${fetched.error}\n`)
+    return 4
+  }
+  await logLine(runDir, {
+    stage: 'fetch-pr',
+    status: 'done',
+    source: fetched.source,
+    ...(fetched.mergeBase ? { mergeBase: fetched.mergeBase } : {}),
+  })
+  // Sidecar so the report can say where the diff came from without re-parsing
+  // log.jsonl, the same way incremental.json carries the incremental context.
+  await writeFile(
+    join(runDir, 'diff-source.json'),
+    `${JSON.stringify({ source: fetched.source, mergeBase: fetched.mergeBase ?? null }, null, 2)}\n`,
+  )
+  return 0
+}
+
+async function writeLocalDiff(
+  runDir: string,
+  gitBin: string,
+  repoPath: string,
+  baseRef: string | undefined,
+  intentFile: string | undefined,
+): Promise<number> {
+  const intentPath = intentFile === undefined ? null : resolve(intentFile)
+  if (intentPath !== null) {
+    const intentStat = await stat(intentPath).catch((err: NodeJS.ErrnoException) => {
+      if (err.code === 'ENOENT') return null
+      throw err
+    })
+    let error: string | null = null
+    if (intentStat === null) error = `intent file ${intentPath} does not exist`
+    else if (!intentStat.isFile()) error = `intent file ${intentPath} is not a file`
+    if (error !== null) {
+      await logLine(runDir, { stage: 'local-diff', status: 'error', error })
+      process.stderr.write(`magpie: ${error}\n`)
+      return 4
+    }
+  }
+  const diff = await localBranchDiff({
+    gitBin,
+    repoPath,
+    ...(baseRef !== undefined ? { baseRef } : {}),
+  })
+  if (!diff.ok) {
+    await logLine(runDir, { stage: 'local-diff', status: 'error', error: diff.error })
+    process.stderr.write(`magpie: ${diff.error}\n`)
+    return 4
+  }
+  await writeFile(join(runDir, 'diff.patch'), diff.diff)
+  const meta = await localBranchMeta({
+    gitBin,
+    repoPath,
+    baseRef: diff.baseRef,
+    mergeBase: diff.mergeBase,
+    head: diff.head,
+    intentFile: intentPath,
+  })
+  if (!meta.ok) {
+    await logLine(runDir, { stage: 'local-diff', status: 'error', error: meta.error })
+    process.stderr.write(`magpie: ${meta.error}\n`)
+    return 4
+  }
+  // Hash the raw diff: applyPathFilter rewrites diff.patch next, and handoff
+  // compares against a fresh raw diff, so a filtered hash would always read as stale.
+  await writeFile(
+    join(runDir, 'diff-source.json'),
+    `${JSON.stringify(
+      {
+        source: 'local',
+        mergeBase: diff.mergeBase,
+        baseRef: diff.baseRef,
+        head: diff.head,
+        diffSha256: diffSha256(diff.diff),
+      },
+      null,
+      2,
+    )}\n`,
+  )
+  await writeFile(join(runDir, 'local.json'), `${JSON.stringify(meta.meta, null, 2)}\n`)
+  await writeTarget(runDir, { mode: 'local', root: repoPath })
+  await logLine(runDir, {
+    stage: 'local-diff',
+    status: 'done',
+    mergeBase: diff.mergeBase,
+    baseRef: diff.baseRef,
+  })
   return 0
 }
 
 async function cleanup(runDir: string): Promise<void> {
+  // Names inside the run dir only: a local run's review root is the caller's repo.
   for (const name of [
     'worktree',
     'pr.json',
     'diff.patch',
     'diff.full.patch',
     'diff-source.json',
+    'local.json',
+    'target.json',
     'excluded-files.json',
     'shards',
     'incremental.json',

package/skills/magpie/scripts/status-cmd.ts

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises'
 import { join } from 'node:path'
+import { readTarget } from './target.ts'
 
 /** The resume ladder. Exported so `skill-lint` can assert that the diagnostic
  *  stage names SKILL.md logs (`filter`, `tests-check`, `shard-coverage`, ...) stay
@@ -15,6 +16,19 @@ export const ORDER = [
   'post',
 ] as const
 
+/** Local mode has no PR to report on or post to; it hands findings back instead. */
+export const LOCAL_ORDER = [
+  'setup',
+  'context',
+  'specialists',
+  'dedupe',
+  'critic',
+  'peer-review',
+  'handoff',
+] as const
+
+type Stage = (typeof ORDER)[number] | (typeof LOCAL_ORDER)[number]
+
 export type StatusResult = {
   /**
    * Highest stage the log says is behind us. A stage logged `skipped` counts:
@@ -22,12 +36,14 @@ export type StatusResult = {
    * has nothing to go back for, so treating it as unfinished would send a resume
    * to a stage with no remaining work.
    */
-  lastCompleted: (typeof ORDER)[number] | null
-  next: (typeof ORDER)[number] | 'cleanup'
+  lastCompleted: Stage | null
+  next: Stage | 'cleanup'
   error: string | null
 }
 
 export async function runStatus(runDir: string): Promise<StatusResult> {
+  const { mode } = await readTarget(runDir)
+  const ladder: readonly Stage[] = mode === 'local' ? LOCAL_ORDER : ORDER
   const text = await readFile(join(runDir, 'log.jsonl'), 'utf8').catch(() => '')
   let lastCompleted: StatusResult['lastCompleted'] = null
   let error: string | null = null
@@ -46,13 +62,13 @@ export async function runStatus(runDir: string): Promise<StatusResult> {
     }
     if (
       (status === 'done' || status === 'skipped') &&
-      (ORDER as readonly string[]).includes(stage)
+      (ladder as readonly string[]).includes(stage)
     ) {
-      lastCompleted = stage as StatusResult['lastCompleted']
+      lastCompleted = stage as Stage
     }
   }
-  const idx = lastCompleted ? ORDER.indexOf(lastCompleted) : -1
-  const nextStage = ORDER[idx + 1]
+  const idx = lastCompleted ? ladder.indexOf(lastCompleted) : -1
+  const nextStage = ladder[idx + 1]
   const next: StatusResult['next'] = nextStage ?? 'cleanup'
   return { lastCompleted, next, error }
 }

package/skills/magpie/scripts/target.ts

@@ -0,0 +1,56 @@
+import { existsSync } from 'node:fs'
+import { readFile, writeFile } from 'node:fs/promises'
+import { isAbsolute, join } from 'node:path'
+
+/** What a run reviews: a PR checked out in the run's worktree, or a local branch in place. */
+export type ReviewTarget = { mode: 'pr' | 'local'; root: string }
+
+function isMissingFile(err: unknown): boolean {
+  return (err as NodeJS.ErrnoException)?.code === 'ENOENT'
+}
+
+/**
+ * Runs from before local mode wrote no target.json; those are all PR runs.
+ * setup writes log.jsonl first, so a dir without it is a mistyped path, not an old run.
+ */
+export async function readTarget(runDir: string): Promise<ReviewTarget> {
+  const path = join(runDir, 'target.json')
+  let text: string
+  try {
+    text = await readFile(path, 'utf8')
+  } catch (err) {
+    if (!isMissingFile(err)) throw err
+    if (!existsSync(join(runDir, 'log.jsonl'))) {
+      throw new Error(`${runDir}: not a magpie run (no target.json or log.jsonl)`)
+    }
+    return { mode: 'pr', root: join(runDir, 'worktree') }
+  }
+  let raw: unknown
+  try {
+    raw = JSON.parse(text)
+  } catch (err) {
+    throw new Error(`${path}: not valid JSON (${err instanceof Error ? err.message : String(err)})`)
+  }
+  if (typeof raw !== 'object' || raw === null) {
+    throw new Error(`${path}: expected an object`)
+  }
+  const { mode, root } = raw as Record<string, unknown>
+  if (mode !== 'pr' && mode !== 'local') {
+    throw new Error(`${path}: mode must be "pr" or "local", got ${JSON.stringify(mode)}`)
+  }
+  if (typeof root !== 'string') {
+    throw new Error(`${path}: root must be a string, got ${JSON.stringify(root)}`)
+  }
+  // A relative root would resolve against whichever cwd a command runs in.
+  if (!isAbsolute(root)) throw new Error(`${path}: root must be an absolute path`)
+  return { mode, root }
+}
+
+export async function writeTarget(runDir: string, target: ReviewTarget): Promise<void> {
+  await writeFile(join(runDir, 'target.json'), `${JSON.stringify(target, null, 2)}\n`)
+}
+
+/** The directory findings are anchored against. */
+export async function reviewRoot(runDir: string): Promise<string> {
+  return (await readTarget(runDir)).root
+}

package/skills/magpie/scripts/types.ts

@@ -4,6 +4,7 @@ export const FOCUS_IDS = [
   'performance',
   'code-smells',
   'architecture',
+  'checks',
   'tests',
 ] as const
 export type FocusId = (typeof FOCUS_IDS)[number]

package/skills/magpie/skill.json

@@ -1,7 +1,7 @@
 {
   "name": "magpie",
-  "version": "0.13.1",
-  "description": "Interactive PR review pipeline. Runs five parallel specialist subagents (security, bugs, performance, code-smells, architecture), drops findings whose quoted evidence is not in the code, dedupes, runs critic subagents that re-check each finding against the worktree and set its risk label, peer-reviews via codex exec (falling back to a Claude second opinion when codex is unavailable), and serves an interactive HTML report for selecting or dismissing findings to post via gh, recording the outcome per finding as labels. Bundles a Bun CLI installed onto PATH via the skill's postinstall step. Use when the user asks to review a GitHub pull request. Splits oversized diffs into budgeted shards and rebuilds the diff from the local clone when gh pr diff refuses it.",
+  "version": "0.14.1",
+  "description": "Interactive PR review pipeline. Runs five parallel specialist subagents (security, bugs, performance, code-smells, architecture) plus a once-per-PR checks pass that finds tests and controls able to pass without proving their purpose, drops findings whose quoted evidence is not in the code, dedupes, runs critic subagents that re-check each finding against the worktree and set its risk label, peer-reviews via codex exec (falling back to a Claude second opinion when codex is unavailable), and serves an interactive HTML report for selecting or dismissing findings to post via gh, recording the outcome per finding as labels. Bundles a Bun CLI installed onto PATH via the skill's postinstall step. Use when the user asks to review a GitHub pull request. Local mode (setup --local) runs the same pipeline on the current branch's diff from its merge base, uncommitted and untracked work included, against the caller's live tree, with no server or posting, and hands the ranked findings back in the terminal for an implementing or orchestrating agent to address. Splits oversized diffs into budgeted shards and rebuilds the diff from the local clone when gh pr diff refuses it.",
   "author": "iceinvein",
   "type": "prompt",
   "tools": [

package/skills/scope-estimate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: scope-estimate
-description: Use when asked to scope, size or estimate a rebuild or respec of an existing system for a proposal or engagement, to map what a codebase does into a capability register, to turn capabilities into functional requirements and build slices, or to work out how long an agent-driven team (engineers x worktrees) takes to build it. Lighter than migrate: no store, no CLI gates, presentable docs plus a scheduler script so the numbers add up.
+description: "Use when asked to scope, size or estimate a rebuild or respec of an existing system for a proposal or engagement, to map what a codebase does into a capability register, to turn capabilities into functional requirements and build slices, or to work out how long an agent-driven team (engineers x worktrees) takes to build it. Lighter than migrate: no store, no CLI gates, presentable docs plus a scheduler script so the numbers add up."
 ---
 
 # Scope and estimate

package/skills/scope-estimate/skill.json

@@ -1,14 +1,25 @@
 {
   "name": "scope-estimate",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Scopes and estimates a rebuild or respec of an existing system for a proposal: read-only discovery agents write cited inventories, a capability register gives every capability a status and a proposed disposition, area agents turn it into sized functional requirements, and a bundled Bun scheduler groups them into slices and contracts-first work packages and schedules them across engineers x worktrees at fast, planning and floor rates. The scheduler refuses a plan that misses or double-counts a requirement or has a dependency cycle, so every figure in the docs comes from one reproducible run. Also covers current and target architecture pages, proposal review, and a two-week calibration before committing to a date. Lighter than migrate: no store and no phase gates.",
   "author": "iceinvein",
   "type": "prompt",
-  "tools": ["claude"],
-  "files": { "prompt": "SKILL.md" },
+  "tools": [
+    "claude"
+  ],
+  "files": {
+    "prompt": "SKILL.md"
+  },
   "bundle": {
-    "include": ["README.md", "references", "scripts", "templates"],
-    "exclude": ["scripts/__tests__/"]
+    "include": [
+      "README.md",
+      "references",
+      "scripts",
+      "templates"
+    ],
+    "exclude": [
+      "scripts/__tests__/"
+    ]
   },
   "install": {
     "claude": {

package/skills/sluice/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: sluice
 description: Use at the start of any request that changes code. Routes the work into one of four channels (bypass, fast, main, deep) by change shape, and applies only the rules that channel needs. Also use when asked to work faster or with less process.
+argument-hint: "[fast|main|deep] [<what to change>]"
 ---
 
 # Sluice
@@ -77,7 +78,9 @@ yourself wanting to skip the rule, or arguing that this one is the exception.
 - **Test first.** The test comes before the code; run it while it should
   still be failing, then write the least code that turns it green. Skip that
   watching step and a green result is only an unchecked guess. A test no
-  plausible change could turn red is not one you owe. `references/test-first.md`
+  plausible change could turn red is not one you owe. A changed existing test
+  is recorded with `status.sh tests-changed` before the handback.
+  `references/test-first.md`
 - **Root cause** before fix. A fix that only hides the symptom has not fixed
   anything. Three failed fixes point at the design, not your guesswork.
   `references/root-cause.md`
@@ -117,7 +120,8 @@ Escalate out loud. A `fast` task that turns out to need a new interface becomes
 `main`, and you say so with another `status.sh route` call in that message.
 Finishing quietly in the wrong channel is the failure this prevents; the same
 goes for dropping to a shallower one. Explicit instruction wins: "just do it"
-collapses to `fast`.
+collapses to `fast`, and a channel named when invoking (`/sluice main`) is that
+channel.
 
 ## Deep channel
 

package/skills/sluice/evals/README.md

@@ -1,6 +1,6 @@
 # sluice evals
 
-Nineteen cases for `claude plugin eval`. Twelve pin the routing decision: which
+Twenty-one cases for `claude plugin eval`. Fourteen pin the routing decision: which
 channel the run names, and whether the behaviour that channel owes actually
 happened. Seven pin what a deep run does after pre-flight, where the question is
 no longer which channel but whether the run keeps going.
@@ -17,6 +17,8 @@ no longer which channel but whether the run keeps going.
 | `announcement-reaches-the-ledger` | A flag that a surface test turns into a new export | `status.sh route main` before any write under `src/` and before any fast or deep route |
 | `fast-reads-the-unmentioned-convention` | Flags live in a table the prompt never names | The flag lands in the registry table and the generated `--help` |
 | `fast-verifies-before-handback` | A fast flag, then the handback | A passing `status.sh verify` after the last edit, before handing back |
+| `fast-updates-the-test-the-change-replaces` | A new summary line that an existing test pins the old form of | The test updated without asking; `status.sh tests-changed -- <suite>` after the last edit |
+| `fast-leaves-an-unrelated-red-test-alone` | The obvious edit to a shared helper turns the status test red | Status output kept by changing code, or a question; `tests/status.test.js` untouched |
 | `main-hunts-a-checkable-claim` | Main work whose intent states a checkable claim | bug-hunter on the diff once green; the `lastPage` remainder bug it proves, fixed test-first |
 | `main-skips-the-hunt-without-a-claim` | A new interface with nothing to check | No bug-hunter; one line saying the intent stated no checkable claim |
 
@@ -34,7 +36,7 @@ Execution, where the run is already past both stops:
 
 ## Running
 
-Eighteen cases scaffold a small Node repo and then change it, so they need the
+Twenty cases scaffold a small Node repo and then change it, so they need the
 scaffold flag and a tool grant. Pin the model, because the eval child does not
 inherit it, and pin the judge, because `--model` does not reach it and the
 `llm` graders otherwise run on Haiku. From the repo root:
@@ -244,6 +246,12 @@ commit is the agent working around the harness, so a deep score on this
 machine still depends on it; a Linux runner, where `git` is an ordinary binary,
 gives the clean read.
 
+`status.sh tests-changed` runs `git worktree add` under `$TMPDIR`, so in a
+macOS sandbox the proof itself may fail while
+`fast-updates-the-test-the-change-replaces`'s proof grader, which sees the call
+and not its exit, still passes. That is why both test-change cases are
+`sandboxSensitive`.
+
 **Fixed between the rerun and pass 2.**
 
 - `deep-run-blocks-on-a-real-decision` carried a second contract break: Task

package/skills/sluice/evals/fast-leaves-an-unrelated-red-test-alone/case.yaml

@@ -0,0 +1,4 @@
+schema_version: "1.1"
+name: fast-leaves-an-unrelated-red-test-alone
+context:
+  scaffold_script: fixture.sh