@ionivetech/mugiwara 0.8.0 → 0.8.2

package/src/policy.ts

@@ -19,11 +19,22 @@ export type MugiwaraPolicy = {
     coverage?: { new?: number; modified?: number };
     require_human_approval?: string[];
   };
-  evidence?: { required?: string[] };
+  evidence?: {
+    required?: string[];
+    /** Lanes where an empty evidence set blocks archive instead of warning. (B7) */
+    require_nonempty_for_lanes?: string[];
+  };
+  integrity?: { extra_secret_patterns?: Array<{ pattern: string; label: string; severity?: 'block' | 'warn' }> };
+  attestation?: {
+    required?: boolean;
+    trusted_keys?: Array<{ id: string; pubkey: string; added?: string }>;
+    revoked?: Array<{ id: string; revoked?: string; reason?: string; pubkey?: string }>;
+  };
+  harness?: { require_enforcement?: boolean };
 };
 
 const POLICY_FILES = ['mugiwara.policy.yml', 'mugiwara.policy.yaml'];
-const KNOWN_ROOTS = ['lanes', 'gates', 'evidence'];
+const KNOWN_ROOTS = ['lanes', 'gates', 'evidence', 'integrity', 'attestation', 'harness'];
 
 /**
  * Minimal YAML subset: maps, `- item` string lists, scalars.
@@ -97,11 +108,238 @@ function scalar(v: string): unknown {
   return t;
 }
 
+/**
+ * Dedicated extractor for integrity.extra_secret_patterns list-of-maps.
+ * The minimal YAML subset parser only handles scalar lists; this scans the raw
+ * text line-by-line for map items so both forms work:
+ *   - { pattern: "\\b...\\b", label: "NIK" }
+ *   - - pattern: "\\b...\\b"
+ *     label: "NIK"
+ *     severity: warn
+ */
+export function extractExtraSecretPatterns(text: string): Array<{ pattern: string; label: string; severity?: string }> {
+  const lines = text.split(/\r?\n/);
+  let inBlock = false;
+  let baseIndent = -1;
+  const out: Array<Record<string, string>> = [];
+  let current: Record<string, string> | null = null;
+  let currentIndent = -1;
+  for (const rawLine of lines) {
+    const noComment = rawLine.replace(/(^|\s)#.*$/, '');
+    if (!noComment.trim()) continue;
+    const indent = noComment.length - noComment.trimStart().length;
+    const trimmed = noComment.trim();
+    if (!inBlock) {
+      if (trimmed.startsWith('extra_secret_patterns:')) {
+        inBlock = true;
+        baseIndent = indent;
+        continue;
+      }
+    } else {
+      // exit if a sibling key at same or shallower indent (not a list item) appears
+      if (indent <= baseIndent && !trimmed.startsWith('-') && trimmed.includes(':')) {
+        break;
+      }
+      if (trimmed.startsWith('-')) {
+        if (current) out.push(current);
+        current = {};
+        currentIndent = indent;
+        const afterDash = trimmed.slice(1).trim();
+        if (!afterDash) continue;
+        if (afterDash.startsWith('{') && afterDash.endsWith('}')) {
+          const inner = afterDash.slice(1, -1);
+          for (const part of inner.split(',')) {
+            const colon = part.indexOf(':');
+            if (colon === -1) continue;
+            const k = part.slice(0, colon).trim();
+            const v = part.slice(colon + 1).trim().replace(/^["']|["']$/g, '');
+            if (k && v) current[k] = v;
+          }
+        } else if (afterDash.includes(':')) {
+          const colon = afterDash.indexOf(':');
+          const k = afterDash.slice(0, colon).trim();
+          const v = afterDash.slice(colon + 1).trim().replace(/^["']|["']$/g, '');
+          if (k && v) current[k] = v;
+        } else {
+          const v = afterDash.replace(/^["']|["']$/g, '');
+          if (v) current['pattern'] = v;
+        }
+      } else if (current && trimmed.includes(':')) {
+        if (indent > currentIndent) {
+          const colon = trimmed.indexOf(':');
+          const k = trimmed.slice(0, colon).trim();
+          const v = trimmed.slice(colon + 1).trim().replace(/^["']|["']$/g, '');
+          if (k && v) current[k] = v;
+        } else if (indent <= baseIndent) {
+          break;
+        }
+      }
+    }
+  }
+  if (current) out.push(current);
+  return out.filter((o) => typeof o.pattern === 'string' && typeof o.label === 'string' && o.pattern.length > 0) as Array<{ pattern: string; label: string; severity?: string }>;
+}
+
+/**
+ * Extract attestation block: handles both inline `{ id: "...", pubkey: "ed25519:..." }`
+ * and multiline lists. Scans inside `attestation:` indented block so
+ * `evidence: required:` is not confused.
+ */
+export function extractAttestation(text: string): {
+  required?: boolean;
+  trusted_keys?: Array<Record<string, string>>;
+  revoked?: Array<Record<string, string>>;
+} | null {
+  const lines = text.split(/\r?\n/);
+  let attBase = -1;
+  let inAtt = false;
+  let required: boolean | undefined;
+  const trusted: Array<Record<string, string>> = [];
+  const revoked: Array<Record<string, string>> = [];
+  // collection state
+  let collecting: 'trusted' | 'revoked' | null = null;
+  let collectBase = -1;
+  let current: Record<string, string> | null = null;
+  let curIndent = -1;
+
+  const flush = () => {
+    if (!current) return;
+    if (collecting === 'trusted') trusted.push(current);
+    else if (collecting === 'revoked') revoked.push(current);
+    current = null;
+  };
+
+  for (let idx = 0; idx < lines.length; idx++) {
+    const rawLine = lines[idx];
+    const noComment = rawLine.replace(/(^|\s)#.*$/, '');
+    if (!noComment.trim()) continue;
+    const indent = noComment.length - noComment.trimStart().length;
+    const trimmed = noComment.trim();
+
+    if (!inAtt) {
+      if (trimmed === 'attestation:' || trimmed.startsWith('attestation:')) {
+        // handle `attestation: { ... }` inline — not used, but parse required if present
+        const after = trimmed.slice('attestation:'.length).trim();
+        if (after.startsWith('{')) {
+          // inline map form not needed for MVP
+          return null;
+        }
+        inAtt = true;
+        attBase = indent;
+        // if there is a value after colon on same line (e.g., attestation: foo) ignore
+        continue;
+      }
+      continue;
+    }
+
+    // inside attestation block
+    // exit attestation when sibling root key at same/shallower indent
+    if (indent <= attBase && !trimmed.startsWith('-') && trimmed.includes(':')) {
+      flush();
+      break;
+    }
+
+    // handle collecting state first
+    if (collecting) {
+      // exiting collection to sibling key inside attestation (e.g., revoked: after trusted_keys:)
+      if (indent <= collectBase && !trimmed.startsWith('-') && trimmed.includes(':')) {
+        flush();
+        collecting = null;
+        // fall through to process this line as att child
+      } else if (trimmed.startsWith('-')) {
+        flush();
+        current = {};
+        curIndent = indent;
+        const afterDash = trimmed.slice(1).trim();
+        if (!afterDash) continue;
+        if (afterDash.startsWith('{') && afterDash.endsWith('}')) {
+          const inner = afterDash.slice(1, -1);
+          for (const part of inner.split(',')) {
+            const colon = part.indexOf(':');
+            if (colon === -1) continue;
+            const k = part.slice(0, colon).trim();
+            const v = part.slice(colon + 1).trim().replace(/^["']|["']$/g, '');
+            if (k && v) current[k] = v;
+          }
+        } else if (afterDash.includes(':')) {
+          const colon = afterDash.indexOf(':');
+          const k = afterDash.slice(0, colon).trim();
+          const v = afterDash.slice(colon + 1).trim().replace(/^["']|["']$/g, '');
+          if (k && v) current[k] = v;
+        } else {
+          const v = afterDash.replace(/^["']|["']$/g, '');
+          if (v) current['id'] = v;
+        }
+        continue;
+      } else if (current && trimmed.includes(':')) {
+        if (indent > curIndent) {
+          const colon = trimmed.indexOf(':');
+          const k = trimmed.slice(0, colon).trim();
+          const v = trimmed.slice(colon + 1).trim().replace(/^["']|["']$/g, '');
+          if (k && v) current[k] = v;
+          continue;
+        }
+      }
+      // if still collecting but line is not part of current item, skip?
+      if (collecting) continue;
+    }
+
+    // not collecting (or just exited) — look for att children
+    if (trimmed.startsWith('required:')) {
+      const v = trimmed.slice('required:'.length).trim().replace(/^["']|["']$/g, '');
+      if (v === 'true') required = true;
+      else if (v === 'false') required = false;
+      continue;
+    }
+    if (trimmed.startsWith('trusted_keys:')) {
+      const after = trimmed.slice('trusted_keys:'.length).trim();
+      // handle inline empty `[]`
+      if (after === '[]') continue;
+      collecting = 'trusted';
+      collectBase = indent;
+      current = null;
+      // if inline list with one map on same line? e.g., trusted_keys: [{ id: "a", pubkey: "x" }]
+      // MVP not needed; empty case already handled
+      continue;
+    }
+    if (trimmed.startsWith('revoked:')) {
+      const after = trimmed.slice('revoked:'.length).trim();
+      if (after === '[]') continue;
+      collecting = 'revoked';
+      collectBase = indent;
+      current = null;
+      continue;
+    }
+  }
+  flush();
+  if (required === undefined && trusted.length === 0 && revoked.length === 0) return null;
+  const out: { required?: boolean; trusted_keys?: Array<Record<string, string>>; revoked?: Array<Record<string, string>> } = {};
+  if (required !== undefined) out.required = required;
+  if (trusted.length) out.trusted_keys = trusted;
+  if (revoked.length) out.revoked = revoked;
+  return out;
+}
+
 export function loadPolicy(projectDir: string): MugiwaraPolicy | null {
   for (const name of POLICY_FILES) {
     const file = join(projectDir, name);
     if (!existsSync(file)) continue;
-    return normalize(parsePolicyYaml(readFileSync(file, 'utf8')));
+    const text = readFileSync(file, 'utf8');
+    const raw = parsePolicyYaml(text);
+    const extra = extractExtraSecretPatterns(text);
+    if (extra.length) {
+      if (!raw.integrity || typeof raw.integrity !== 'object' || Array.isArray(raw.integrity)) raw.integrity = {};
+      (raw.integrity as Record<string, unknown>).extra_secret_patterns = extra;
+    }
+    const att = extractAttestation(text);
+    if (att) {
+      if (!raw.attestation || typeof raw.attestation !== 'object' || Array.isArray(raw.attestation)) raw.attestation = {};
+      const a = raw.attestation as Record<string, unknown>;
+      if (att.required !== undefined) a.required = att.required;
+      if (att.trusted_keys) a.trusted_keys = att.trusted_keys;
+      if (att.revoked) a.revoked = att.revoked;
+    }
+    return normalize(raw);
   }
   return null;
 }
@@ -127,7 +365,70 @@ function normalize(raw: Record<string, unknown>): MugiwaraPolicy {
       out.gates.require_human_approval = strings(gates.require_human_approval);
   }
   const evidence = raw.evidence as Record<string, unknown> | undefined;
-  if (evidence && Array.isArray(evidence.required)) out.evidence = { required: strings(evidence.required) };
+  if (evidence) {
+    const ev: NonNullable<MugiwaraPolicy['evidence']> = {};
+    if (Array.isArray(evidence.required)) ev.required = strings(evidence.required);
+    else if (typeof evidence.required === 'string' && (evidence.required as string).trim().startsWith('[')) {
+      try { const p = JSON.parse(evidence.required as string); if (Array.isArray(p)) ev.required = strings(p); } catch { /* ignore */ }
+    }
+    if (Array.isArray(evidence.require_nonempty_for_lanes)) ev.require_nonempty_for_lanes = strings(evidence.require_nonempty_for_lanes);
+    else if (typeof evidence.require_nonempty_for_lanes === 'string' && (evidence.require_nonempty_for_lanes as string).trim().startsWith('[')) {
+      try { const p = JSON.parse(evidence.require_nonempty_for_lanes as string); if (Array.isArray(p)) ev.require_nonempty_for_lanes = strings(p); } catch { /* ignore */ }
+    }
+    if (ev.required || ev.require_nonempty_for_lanes) out.evidence = ev;
+  }
+  const integrity = raw.integrity as Record<string, unknown> | undefined;
+  if (integrity && Array.isArray(integrity.extra_secret_patterns)) {
+    const arr = integrity.extra_secret_patterns as unknown[];
+    const cleaned: Array<{ pattern: string; label: string; severity?: 'block' | 'warn' }> = [];
+    for (const e of arr) {
+      if (!e || typeof e !== 'object') continue;
+      const rec = e as Record<string, unknown>;
+      if (typeof rec.pattern !== 'string' || typeof rec.label !== 'string') continue;
+      const sev = rec.severity === 'warn' ? 'warn' as const : rec.severity === 'block' ? 'block' as const : undefined;
+      const entry: { pattern: string; label: string; severity?: 'block' | 'warn' } = { pattern: rec.pattern, label: rec.label };
+      if (sev) entry.severity = sev;
+      cleaned.push(entry);
+    }
+    if (cleaned.length) out.integrity = { extra_secret_patterns: cleaned };
+  }
+  const att = raw.attestation as Record<string, unknown> | undefined;
+  if (att) {
+    const a: NonNullable<MugiwaraPolicy['attestation']> = {};
+    if (typeof att.required === 'boolean') a.required = att.required;
+    if (Array.isArray(att.trusted_keys)) {
+      const cleanedTk: Array<{ id: string; pubkey: string; added?: string }> = [];
+      for (const e of att.trusted_keys as unknown[]) {
+        if (!e || typeof e !== 'object') continue;
+        const rec = e as Record<string, unknown>;
+        if (typeof rec.id !== 'string' || typeof rec.pubkey !== 'string') continue;
+        if (!rec.id.trim() || !rec.pubkey.trim()) continue;
+        const entry: { id: string; pubkey: string; added?: string } = { id: rec.id.trim(), pubkey: rec.pubkey.trim() };
+        if (typeof rec.added === 'string' && rec.added.trim()) entry.added = rec.added.trim();
+        cleanedTk.push(entry);
+      }
+      if (cleanedTk.length) a.trusted_keys = cleanedTk;
+    }
+    if (Array.isArray(att.revoked)) {
+      const cleanedRv: Array<{ id: string; revoked?: string; reason?: string; pubkey?: string }> = [];
+      for (const e of att.revoked as unknown[]) {
+        if (!e || typeof e !== 'object') continue;
+        const rec = e as Record<string, unknown>;
+        if (typeof rec.id !== 'string' || !rec.id.trim()) continue;
+        const entry: { id: string; revoked?: string; reason?: string; pubkey?: string } = { id: rec.id.trim() };
+        if (typeof rec.revoked === 'string' && rec.revoked.trim()) entry.revoked = rec.revoked.trim();
+        if (typeof rec.reason === 'string' && rec.reason.trim()) entry.reason = rec.reason.trim();
+        if (typeof rec.pubkey === 'string' && rec.pubkey.trim()) entry.pubkey = rec.pubkey.trim();
+        cleanedRv.push(entry);
+      }
+      if (cleanedRv.length) a.revoked = cleanedRv;
+    }
+    if (a.required !== undefined || a.trusted_keys || a.revoked) out.attestation = a;
+  }
+  const harness = raw.harness as Record<string, unknown> | undefined;
+  if (harness && typeof harness.require_enforcement === 'boolean') {
+    out.harness = { require_enforcement: harness.require_enforcement };
+  }
   return out;
 }
 
@@ -154,3 +455,70 @@ export function matchedGlobs(paths: string[], globs: string[]): string[] {
 export function effectiveThreshold(configured: number, policyValue: number | undefined): number {
   return Math.max(configured, policyValue ?? 0);
 }
+
+// ── Harness enforcement (D8) ────────────────────────────────────────────────
+// Only opencode has runtime write-scope enforcement; the other 11 harnesses
+// are rules-based. `harness.require_enforcement: true` refuses to run where
+// the harness is not enforced.
+
+/** Detect current harness. Mirrors savepoint.sh logic. */
+export function detectHarness(projectDir?: string): string {
+  const e = process.env;
+  const has = (v: string | undefined) => v !== undefined && v !== '';
+  if (has(e.CLAUDECODE) || has(e.CLAUDE_CODE_ENTRYPOINT) || (typeof e.ANTHROPIC_MODEL === 'string' && /claude/i.test(e.ANTHROPIC_MODEL))) return 'claude';
+  if (has(e.OPENCODE) || has(e.OPENCODE_TOKENS_FILE)) return 'opencode';
+  const candidates = [
+    projectDir ? join(projectDir, '.opencode', 'config.json') : null,
+    join(process.cwd(), '.opencode', 'config.json'),
+  ].filter(Boolean) as string[];
+  for (const p of candidates) {
+    try { if (existsSync(p)) return 'opencode'; } catch { /* ignore */ }
+  }
+  if (has(e.CURSOR) || has(e.VSCODE_GIT_ASKPASS_NODE)) return 'cursor';
+  return 'unknown';
+}
+
+/** Only opencode is runtime-enforced. */
+export function isEnforcedHarness(projectDir?: string): boolean {
+  return detectHarness(projectDir) === 'opencode';
+}
+
+/** Pure check: returns error message when policy requires enforcement but harness is rules-based, else null. */
+export function getHarnessEnforcementError(projectDir: string): string | null {
+  let policy: MugiwaraPolicy | null;
+  try { policy = loadPolicy(projectDir); } catch (e) { throw e; }
+  if (!policy?.harness?.require_enforcement) return null;
+  if (isEnforcedHarness(projectDir)) return null;
+  const h = detectHarness(projectDir);
+  return `harness enforcement required but current harness is rules-based only \u2014 use opencode or set harness.require_enforcement:false (detected: ${h})`;
+}
+
+/** Fail closed when policy requires enforcement but harness is rules-based. */
+export function enforceHarnessPolicy(projectDir: string): void {
+  const err = getHarnessEnforcementError(projectDir);
+  if (!err) return;
+  console.error(`\u2717 ${err}`);
+  process.exit(1);
+}
+
+/** Alias for CLI import convenience. */
+export const checkHarnessEnforcement = enforceHarnessPolicy;
+
+// ── Lane-aware gates (T3) ───────────────────────────────────────────────────
+// Direct → minimal (typecheck+build only), lean → +validate-content, standard+
+// → +evals/retrieval/conformance/benchmark. Single source for gate-selftest
+// and the franky-gates skill doc. Full = 12 steps, direct = 3 steps.
+export const GATE_STEPS_BY_LANE: Record<string, string[]> = {
+  direct: ['build-hooks:check', 'typecheck', 'build'],
+  lean: ['build-hooks:check', 'typecheck', 'build', 'validate-content', 'lane-base', 'check-doc-links'],
+  standard: ['build-hooks:check', 'typecheck', 'build', 'validate-content', 'lane-base', 'check-doc-links', 'test:coverage', 'coverage-gate', 'verify-install'],
+  full: ['build-hooks:check', 'typecheck', 'build', 'validate-content', 'lane-base', 'check-doc-links', 'test:coverage', 'coverage-gate', 'verify-install', 'run-evals', 'retrieval-eval', 'conformance'],
+};
+
+export function gatesForLane(lane: string): string[] {
+  return GATE_STEPS_BY_LANE[lane] ?? GATE_STEPS_BY_LANE.full;
+}
+
+export function isLaneAwareGateStep(step: string, lane: string): boolean {
+  return gatesForLane(lane).includes(step);
+}

package/src/provenance.ts

@@ -75,16 +75,34 @@ export function renderProvenanceMd(note: string, sha: string | null): string {
   return lines.join('\n') + '\n';
 }
 
-export function attachGitNote(projectDir: string, branch: string, note: string): { sha: string } | null {
+export function attachGitNote(projectDir: string, branch: string, note: string, baseSha?: string): { sha: string; count: number } | null {
   try {
-    let sha: string;
+    const range = baseSha ? `${baseSha}..${branch}` : branch;
+    let shas: string[] = [];
     try {
-      sha = git(projectDir, ['rev-parse', '--verify', branch]);
+      const raw = git(projectDir, ['rev-list', range]);
+      shas = raw.split('\n').filter(Boolean);
     } catch {
-      sha = git(projectDir, ['rev-parse', 'HEAD']);
+      // rev-list failed (unknown baseSha/branch) — fall back to single head
+      shas = [];
     }
-    git(projectDir, ['notes', '--ref=mugiwara', 'add', '-f', '-m', note, sha]);
-    return { sha };
+    // ponytail: cap at 200 commits, fallback to head-only beyond
+    if (shas.length > 200) {
+      console.warn(`attachGitNote: range ${shas.length} >200, falling back to head-only`);
+      shas = [];
+    }
+    let targets = shas;
+    if (!targets.length) {
+      try {
+        targets = [git(projectDir, ['rev-parse', '--verify', branch])];
+      } catch {
+        targets = [git(projectDir, ['rev-parse', 'HEAD'])];
+      }
+    }
+    for (const sha of targets) {
+      git(projectDir, ['notes', '--ref=mugiwara', 'add', '-f', '-m', note, sha]);
+    }
+    return { sha: targets[0], count: targets.length };
   } catch {
     // not a repo, detached oddities, or notes disabled — degrade honestly
     return null;
@@ -104,13 +122,15 @@ export function blamePath(projectDir: string, path: string): string {
     const note = git(projectDir, ['notes', '--ref=mugiwara', 'show', sha]);
     return `${path} @ ${sha.slice(0, 7)}\n${note}`;
   } catch {
-    return `${path} @ ${sha.slice(0, 7)}\n(no mugiwara provenance note on this commit)`;
+    return `${path} @ ${sha.slice(0, 7)}\nno per-commit note — see .mugiwara/missions/<m>/provenance.md`;
   }
 }
 
 /** Closure hook: write provenance.md + attach the git note. */
-export function writeProvenance(projectDir: string, missionDir: string, state: NoteSource): void {
+export function writeProvenance(projectDir: string, missionDir: string, state: NoteSource & { base_sha?: string }, baseSha?: string): void {
   const note = buildNote(state);
-  const attached = attachGitNote(projectDir, state.branch, note);
+  const resolvedBase = baseSha ?? (typeof (state as Record<string, unknown>).base_sha === 'string' ? (state as Record<string, unknown>).base_sha as string : undefined);
+  const cleanBase = resolvedBase && resolvedBase !== 'unknown' ? resolvedBase : undefined;
+  const attached = attachGitNote(projectDir, state.branch, note, cleanBase);
   writeFileSync(join(missionDir, 'provenance.md'), renderProvenanceMd(note, attached ? attached.sha : null));
 }

package/src/sign.ts

@@ -13,6 +13,7 @@ import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify }
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { readConfig } from './config.ts';
+import { loadPolicy } from './policy.ts';
 
 export function signArgs(reportPath: string, secretKey: string): string[] {
   return ['-Sm', reportPath, '-s', secretKey];
@@ -192,6 +193,42 @@ export function signReport(projectDir: string, missionDir: string): { ok: boolea
   return { ok: true, message: `signed ${report}.mugisig (pure ed25519, key: ${join(dir, 'mugiwara.key')})` };
 }
 
+function normalizePubkey(pk: string): string {
+  const t = pk.trim();
+  return t.startsWith('ed25519:') ? t.slice('ed25519:'.length).trim() : t;
+}
+
+function checkTrust(projectDir: string, signerPubB64: string): { ok: boolean; message?: string } {
+  try {
+    const policy = loadPolicy(projectDir);
+    const att = policy?.attestation;
+    if (!att) return { ok: true };
+    const trusted = att.trusted_keys ?? [];
+    const revoked = att.revoked ?? [];
+    const signer = signerPubB64.trim();
+    // revoked by pubkey direct match (before trusted check, so revoked is authoritative)
+    const directlyRevoked = revoked.some((r) => {
+      const rpk = (r as { pubkey?: string }).pubkey;
+      if (!rpk) return false;
+      return normalizePubkey(rpk) === signer;
+    });
+    if (directlyRevoked) return { ok: false, message: 'signature valid but signer revoked (pubkey in revoked list)' };
+
+    if (trusted.length === 0) {
+      // No trust list → only signature validity matters; revoked already checked
+      return { ok: true };
+    }
+    const match = trusted.find((e) => normalizePubkey(e.pubkey) === signer);
+    if (!match) return { ok: false, message: 'signature valid but signer untrusted (pub not in trusted_keys)' };
+    // check revoked by id (revoked id means that trusted id is revoked)
+    const revokedById = revoked.some((r) => r.id === match.id);
+    if (revokedById) return { ok: false, message: `signature valid but signer revoked (id: ${match.id})` };
+    return { ok: true };
+  } catch {
+    return { ok: true };
+  }
+}
+
 export function verifyReport(projectDir: string, missionDir: string): { ok: boolean; message: string } {
   const report = join(missionDir, 'report.md');
   const minisig = `${report}.minisig`;
@@ -208,6 +245,10 @@ export function verifyReport(projectDir: string, missionDir: string): { ok: bool
     const pubKey = existsSync(defaultKey('public')) ? defaultKey('public') : null;
     try {
       execFileSync('minisign', verifyArgs(report, pubKey), { cwd: projectDir, stdio: 'pipe' });
+      // trust check for pure is not applied to minisig (MVP: pure-only trust).
+      // If a .mugisig also exists alongside minisig, still trust-check the pure pub for completeness,
+      // but minisig verification already succeeded — treat as ok.
+      // For strict attestation, operator should use pure backend when trusted_keys is configured.
       return { ok: true, message: 'signature verifies against report.md (minisig)' };
     } catch {
       return { ok: false, message: 'SIGNATURE INVALID — report.md changed after signing (minisig)' };
@@ -219,9 +260,10 @@ export function verifyReport(projectDir: string, missionDir: string): { ok: bool
     const parsed = JSON.parse(readFileSafe(mugisig) ?? '{}') as PureSig;
     const content = readFileSafe(report);
     if (content === null || parsed.algo !== 'ed25519-pure') return { ok: false, message: 'invalid .mugisig file' };
-    return pureVerify(content, parsed)
-      ? { ok: true, message: 'signature verifies against report.md (mugisig, ed25519-pure)' }
-      : { ok: false, message: 'SIGNATURE INVALID — report.md changed after signing (mugisig)' };
+    if (!pureVerify(content, parsed)) return { ok: false, message: 'SIGNATURE INVALID — report.md changed after signing (mugisig)' };
+    const trust = checkTrust(projectDir, parsed.pub);
+    if (!trust.ok) return { ok: false, message: trust.message! };
+    return { ok: true, message: 'signature verifies against report.md (mugisig, ed25519-pure)' };
   } catch {
     return { ok: false, message: 'invalid .mugisig file' };
   }

package/content/skills/mugiwara-workflow/references/adaptive-budget-governor.md

@@ -1,5 +0,0 @@
-# Adaptive Budget & Circuit Breaker (Phase 7)
-
-Reserve expected max before expensive stages (Review/Security/Healing); continuously project `current + remaining required + expected conditional + possible healing` (§26); expand budget only with evidence (§27 valid: scope legitimately expanded, security-sensitive path, test surface larger, architecture dependency, legitimate healing; invalid: verbosity/reread/repeat/unnecessary code); respect progressive thresholds (§28: 60%→optimize, 75%→aggressive, 90%→protect, 100%→pause, 150%→warning, 300%→stop); trip breaker when `actual ≥ 2× expected` without progress/scope/evidence (§29, note: double-threshold); flag 5k-zero-progress anomaly (§24, re-consumes slop signal); record every non-ok verdict via `recordBudgetDecision` (§41).
-
-Honest boundary: verdicts-not-enforcement; crew acts. No new config; savepoint/lane-base untouched. Report/CLI budget ledger → Phase 8.

package/content/skills/mugiwara-workflow/references/benchmark-governor.md

@@ -1,53 +0,0 @@
-# Benchmark & Hardening — Full Checklist (Phase 9)
-
-Tracks `scripts/benchmark-governor.ts` harness (deterministic, no network).
-
-## Cost suite (§48) — 4 workloads
-- [ ] lean-trivial: projected 8000 + overhead 1000, context ≤20000, evidence ≥1, surface files 2 loc 50
-- [ ] standard-feature: projected 15000 + overhead 1500, context ≤40000, evidence ≥3
-- [ ] large-repo: projected 22000 + overhead 2200, context ≤80000, evidence ≥5, surface 50 files
-- [ ] long-mission: projected 23000 + overhead 2300, context ≤90000, 9 stages projection ≤ budget
-- Check: `measured.tokens ≤ projected + overhead` else fail; `measured.context ≤ max` else fail
-
-## Stop-Slop suite (§45) — 12 scenarios detect→classify→intervene
-- [ ] endless-exploration → investigation slop → stop
-- [ ] repeated-reads (3× no evidence) → context slop → stop; with concrete reason → tolerate
-- [ ] repeated-commands (same cmd+evidence fail) → retry slop → stop
-- [ ] repeated-failed-test → retry slop → stop
-- [ ] repeated-reasoning → reasoning slop → stop
-- [ ] unnecessary-abstraction → code slop → stop
-- [ ] unnecessary-dependency → code slop → stop
-- [ ] unrelated-refactor → scope slop → stop
-- [ ] verbose-output → output slop → stop
-- [ ] no-progress-healing (cycle ≥3, 0 fixes) → healing slop → stop
-- [ ] premature-completion → scope slop → escalate
-- [ ] excessive-context (repeated reads + duplicate chars) → context slop → stop
-
-## Stress (bench-only, no runtime)
-- [ ] large repository: 50 files within declared scope → pass (scope drift negative)
-- [ ] long mission: 9 stages, projectBudget max ≤ full budget 50000 → pass
-- [ ] runaway: actual 2× expected with no progress/scope/evidence → breaker tripped → fail (measures, not enforces)
-
-## Thresholds (ratchet, like retrieval-eval)
-- Thresholds live in `scripts/benchmark-thresholds.json` (or in-script THRESHOLDS const)
-- `tokens > projected + overhead` → harness fails workload
-- `context_chars > context_max` → fail
-- Thresholds only move on explicit fixture update (reviewed diff), never silently
-- `note: thresholds are fixture constants, not config — ratchet like retrieval-eval`
-
-## Regression (§49)
-- `checkRegression`: cost down but correctness/evidence/security/quality/scope down → fail
-- Baseline from thresholds `baselines` + workload `expected_*`; measured vs baseline pure comparison
-
-## Cross-platform & Determinism
-- Harness pure over explicit fixture inputs, no Date.now/Math.random/network, deterministic on all platforms
-- `scripts/conformance.ts` 12-platform parity proves cross-platform
-
-## CI Enforcement
-- `package.json:gate` includes `bun scripts/benchmark-governor.ts` (extend existing gate)
-- `scripts/gate-selftest.ts` tampers thresholds → harness must exit 1 (G3 — gate that cannot fail is not a gate)
-- note: harness measures, does not enforce — no runtime gate
-
-## Docs
-- `docs/concepts/cost.md` ## Benchmark & Hardening documents harness/threshold/stress contracts
-- `docs/cost-governor.md` hub links to cost.md for deep contracts

package/content/skills/mugiwara-workflow/references/cognitive-output-governor.md

@@ -1,5 +0,0 @@
-# Cognitive & Output Governor
-
-Reasoning stays focused — Question→Evidence→Decision→Action, no speculative architecture/hypothetical requirements/repeated reconsideration/unrelated implementations (§17); investigation terminates when acceptance_mapped+surface_understood+path_established or limits hit without concrete reason (§13); alternatives bounded to evidence-backed options (default 3).
-
-Output compressed to mission-focused structure (Decision/Action/Result/Evidence/Blocker, §18), duplicate explanations fingerprinted; every cognitive verdict lands as a `cognitive-governor` trail row in `.mugiwara/missions/<mission>/decisions.md` → `## Cost governor decisions`. savepoint/lane-base/config untouched.

package/content/skills/mugiwara-workflow/references/scope-code-governor.md

@@ -1,14 +0,0 @@
-# Scope & Code Governor
-
-Prefer the smallest correct scope — reuse existing code + local modification
-over new architecture (§14). An abstraction is justified only when used in ≥2
-places or required by contract, never speculatively (§15); a dependency is
-added only with explicit justification (§16); implementations are minimum
-sufficient, never minimum LOC at the expense of verification/quality
-(§15/§38).
-
-Code waste (unnecessary helper/abstraction/wrapper/interface/config/
-dependency/generated code/refactor) is named; the change surface is measured;
-every scope verdict lands as a `scope-governor` trail row in
-`.mugiwara/missions/<mission>/decisions.md` → `## Cost governor decisions`.
-savepoint/lane-base/config untouched.

package/content/skills/mugiwara-workflow/references/stop-slop-governor.md

@@ -1,14 +0,0 @@
-# Stop-Slop Governor
-
-Slop taxonomy (§21 eight kinds); detection signals (§22: repeated reads/commands,
-token-without-evidence, LOC-without-acceptance, abstraction-without-justification);
-progress measurement (§23: evidence/criteria/tests/code vs cost delta, slop when
-cost grows without progress); work-to-cost anomaly (§24 drop signal); intervention
-rules (§20 tolerate/stop/compress/escalate by severity); six category detectors
-(retry §21.6/§31 same-action-same-evidence-same-failure→STOP, healing §21.7/§32
-no-progress→stop, scope §21.8 out-of-scope-without-acceptance→reject, context
-§21.2 duplicate/irrelevant→discard/compress, investigation §21.1 unbounded-
-exploration→stop, code §21.5 unnecessary abstraction/dependency/boilerplate→
-remove/simplify). Every slop verdict lands as a `slop-governor` trail row in
-`.mugiwara/missions/<mission>/decisions.md` → `## Cost governor decisions`.
-savepoint/lane-base/config untouched.