@jesdi/skills 0.0.45 → 0.0.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jesdi/skills",
-  "version": "0.0.45",
+  "version": "0.0.47",
   "description": "jesdi's agent skills (content package consumed by @jesdi/skills-cli)",
   "license": "MIT",
   "repository": {

package/skills/implement-spec/ARCHITECTURE.md

@@ -98,8 +98,10 @@ and do not know about the run, except `driver_run.py`, which the three deciding
 ### Work is never dropped
 
 - A role that commits keeps its tree after a timeout or an interrupt; its rerun continues from it.
-- A read-only role (reviewer, correctness, final-reviewer, pr-writer) has no work to keep. When it changes its slot, the
-  driver restores the slot and runs the review one more time (`Run.read_only`).
+- A read-only role (reviewer, correctness, final-reviewer, pr-writer) has no work to keep. When it changes its slot or
+  the shared git config, the driver restores them and runs the review one more time (`Run.read_only`). The config is
+  a byte copy taken before the role (`driver_review.shared_config`): every worktree reads that one file, so a key a
+  role writes there, such as a `core.worktree` on a temp directory, breaks git in all of them.
 - A slot with uncommitted work of an interrupted or parked ticket is kept for that ticket (`driver_state.kept`).
 - A blocked ticket keeps its slot when the slot is not clean.
 

package/skills/implement-spec/README.md

@@ -100,7 +100,7 @@ A ticket is ready when each ticket in its **Blocked by** line is merged and no r
 1. **test-writer** (`prompts/test-writer.md`). It writes one black-box test for each criterion through the Seam and commits them red. Those files are locked. A ticket with Seam `none — refactor` has no test-writer.
 2. **implementer** (`prompts/implementer.md`). It starts from that commit and makes the locked tests green. It makes the gate (`--gate`) green on its final commit before it reports DONE or DONE_WITH_CONCERNS.
 3. **Gate.** The driver runs `--gate` on the ticket tip.
-4. **Review.** The driver compares each locked file of the ticket with the test-writer commit. A file that differs is a critical finding `locked file changed: <path>`. A locked file of a merged ticket that the ticket changed since its merge base with the PR branch is a critical `fixture` finding `the ticket changed the locked file of a merged ticket: <path>`, so it goes to a correction (see **Before a correction**). Then the **reviewer** (`prompts/reviewer.md`) runs, and for a ticket with a **Risk** line the **correctness** pass (`prompts/correctness.md`) runs at the same time in the same slot.
+4. **Review.** The driver compares each locked file of the ticket with the test-writer commit. A file that differs is a critical finding `locked file changed: <path>`. A locked file of a merged ticket that the ticket changed since its merge base with the PR branch is a critical `fixture` finding `the ticket changed the locked file of a merged ticket: <path>`, so it goes to a correction (see **Before a correction**). Then the **reviewer** (`prompts/reviewer.md`) runs, and for a ticket with a **Risk** line the **correctness** pass (`prompts/correctness.md`) runs at the same time in the same slot. A read-only role (reviewer, correctness, final-reviewer, pr-writer) leaves its slot and the git config as it found them: all worktrees share one config, and one key written there, such as a `core.worktree` on a temp directory, breaks git in each of them. To run a check off the slot, a reviewer reads the driver's gate record or makes its own `git worktree add --detach` copy and removes it. After read-only roles, the driver checks the slot and the shared config (`git rev-parse --git-common-dir`, then `config`) against what they were before. When one of them changed, the driver restores it, writes `a read-only role broke its rule: ...` to the ledger, and runs the review one more time; a second change blocks the ticket.
 5. **Merge.** The driver merges the reviewed tip into the PR branch with git plumbing, then deletes the ticket branch. A conflict goes to the **conflict** agent (`prompts/conflict.md`) once. Its resolution may change no locked file of the ticket. A second conflict blocks the ticket.
    **The landing check.** Merges are serial. Before the PR branch moves, the driver compares the tree that is about to land (the ticket tip of a fast-forward, or the merge commit) with the PR tip: each locked file of each merged ticket must be the same tree entry in both: the same blob with the same mode, so a file that became a symlink is a difference. A file that only one of them has is a difference. A file that the landing ticket lists in its own `locked` is not checked: the test-writer of a later ticket can add a test to a file that an earlier ticket locked, and must list that file. A test-writer report that changes such a file and does not list it is rejected, with the usual one rerun. The review finds such a change first; the landing check catches a change that no review saw, for example of a ticket that merged after the last review. A difference refuses the landing: the ticket is BLOCKED with `locked file changed: <path>` in the ledger, the PR branch does not move, and no fix round runs. The PR branch moves only from the tip that the check read; when another hand moved the branch in between, the driver makes the merge, the check and the gate again, one time. Only that case starts the landing again: a refused landing and a red merge gate block the ticket. The second try runs no conflict agent, so a conflict there blocks the ticket, and so does a branch that moved again.
    **Before a correction.** A test-writer that corrects locked tests (after `overrule-test`, or for a `fixture` finding or a `test` finding on a locked file) starts from the locked versions: the driver puts back each locked file of the ticket and each locked file of a merged ticket that the ticket changed, commits them in one commit of its own, and the ledger names each file. A file of a merged ticket goes back to the version of the PR branch. The commit keeps the tree of the next fixer and of the gate clean, whatever files the correction commits. The correction's prompt names the restored files: when a test in one of them fails only because the ticket changed an interface that the test uses, the correction updates the file to the new interface, keeps what each test asserts, and lists the file in `locked`.
@@ -178,7 +178,7 @@ Every report has `status` (`DONE`, `DONE_WITH_CONCERNS`, `NEEDS_CONTEXT`, `BLOCK
 |---|---|---|---|
 | test-writer | `prompts/test-writer.md` | `locked` (test file paths), `red` (`test`, `line`) | The driver reads a test node id `<file>::<test>` in `locked` as its file. With DONE: one commit, one locked file and one red line or more. Each locked path is in a commit that the role made. Each `line` is in the log. A locked file of a merged ticket that the role changed is in `locked`. A correction (after `overrule-test`, or for a review finding) changes only the files that it lists in `locked` and the files that the driver restored before it. When the gate is red on the restore commit, a DONE correction lists a restored file in `locked`. |
 | implementer | `prompts/implementer.md` | `green` | With DONE: one commit or more. |
-| reviewer | `prompts/reviewer.md` | `findings` (`severity`, `file`, `line`, `title`, `evidence`, `kind`), `mutations` (`test`, `file`, `line`, `red`); `commits` is empty | In the first review of a tip: `mutations` is required, with a proof for each locked test file (`test` is `<locked file>::<test name>`). Each `red` is in the log. |
+| reviewer | `prompts/reviewer.md` | `findings` (`severity`, `file`, `line`, `title`, `evidence`, `kind`), `mutations` (`test`, `file`, `line`, `red`); `commits` is empty | In a full review (one with no fix range: round 1, and the review after a test-writer correction): `mutations` is required, with a proof for each locked test file (`test` is `<locked file>::<test name>`). Each `red` is in the log. |
 | correctness | `prompts/correctness.md` | the same as the reviewer; `commits` is empty | `mutations` is optional. |
 | fixer | `prompts/fixer.md` | `green`, `ticket` | With DONE: one commit or more. |
 | final-reviewer | `prompts/final-reviewer.md` | `findings` | None. |
@@ -207,7 +207,7 @@ Answer with `--answer <question id>=<option id>` on the next run, or through the
 | Check | Where it lives |
 |---|---|
 | Locked tests with a demonstrated red | `driver_report.py` `_proof_errors`: each red line of the test-writer report must be in its log. `driver_review.py` `locked_findings`: a locked file of the ticket that differs from the test-writer commit is a critical finding, before each review. `driver_review.py` `merged_changes`: a locked file of a merged ticket that the ticket changed is a critical `fixture` finding, before each review. `driver_merge.py` `refused`, called from `driver.py` `_checked_landing` under the merge lock: a locked file of a merged ticket that differs between the PR tip and the tree that is about to land refuses the landing, so a later ticket cannot change the locked test of an earlier one. `driver_report.py` `_merged_errors` rejects a test-writer report that changes such a file and does not list it. |
-| One mutation proof for each locked test | `prompts/reviewer.md` asks for one proof for each locked test. `driver_report.py` `_locked_errors` and `_proof_errors` reject a first review with no proof for a locked test file, or with a red line that is not in the log. `driver_review.py` `follow` finds the proofs that a fix makes due again. |
+| One mutation proof for each locked test | `prompts/full-review.md`, the note of each full review, names the locked test files that need a proof. `driver_report.py` `_locked_errors` and `_proof_errors` reject a full review with no proof for a locked test file, or with a red line that is not in the log. `driver_review.py` `follow` finds the proofs that a fix makes due again. |
 | One independent correctness pass for each risky ticket | `driver_fixloop.py` `_review` adds the pass for a ticket with a **Risk** line. `driver_agents.py` `correctness_entry` picks the entry of another provider, and `load_models` stops the run when there is none or its CLI is not on PATH. |
 | One full gate for each candidate | `driver_gate.py` `run`, called from `driver_run.py` `Run.gate`: one record for each commit the driver is about to trust. Green is exit 0 on a tree that is clean before and after, with HEAD not moved. |
 | Post-merge check on the PR branch | `driver.py` `_checked_landing`: a merge commit is gated before the PR branch moves to it. A fast-forward of a gated tip uses the record of that tip. `driver_final.py` `_review_until_reviewed` gates the tip again after the tidy and after the fix batch. |
@@ -217,7 +217,7 @@ The driver enforces the mutation proof for each locked test file, not for each l
 ## Known limits
 
 - **A `codex` agent cannot commit.** A role that commits (test-writer, implementer, fixer, conflict) on an `openai` entry runs with `--sandbox workspace-write`, and that sandbox cannot run `git commit`. In the default `models.json` this is the second implementer entry, so fix rounds 3 and 4 fail. What to do: give a `--models` file with no `openai` entry in the `implementer`, `test-writer`, `fixer` and `conflict` lists.
-- **A `codex` reviewer cannot make a mutation proof.** A reviewer on an `openai` entry runs with `--sandbox read-only` and cannot make the temporary edit. The default `models.json` has such an entry first for the reviewer, and the first review needs the proofs. What to do: give a `--models` file whose reviewer list starts with an `anthropic` entry.
+- **A `codex` reviewer cannot make a mutation proof.** A reviewer on an `openai` entry runs with `--sandbox read-only` and cannot make the temporary edit. The default `models.json` has such an entry first for the reviewer, and each full review needs the proofs. What to do: give a `--models` file whose reviewer list starts with an `anthropic` entry.
 - **The correctness pass reads a tree that the reviewer changes.** The two agents share one slot, and the reviewer makes temporary edits. `prompts/correctness.md` tells the pass to read from git at the reviewed commit and to run no tests. It reads only the spec, the ticket and the findings file from the working tree, because git can lack them: `.agent/` is ignored. That rule is the only guard: the driver cannot enforce it, so a pass that ignores it can report a false finding and start a fix round. What to do: when a correctness finding looks wrong, compare it with `git show <reviewed commit>:<file>` before you rule on it.
 - **A ticket that is not merged stops the end of run.** While one ticket is BLOCKED, there is no tidy and no final review of the merged tickets.
 - **A published PR branch keeps its history.** See "End of run".

package/skills/implement-spec/driver.py

@@ -26,6 +26,7 @@ import driver_answers
 import driver_decisions
 import driver_final
 import driver_fixloop
+import driver_gate
 import driver_graph
 import driver_legacy
 import driver_merge
@@ -109,7 +110,7 @@ def _run_roles(ticket: Ticket, slot_number: int, run: Run) -> None:
     values = {**_prompt_values(ticket, slot, run), "locked": " ".join(entry["locked"])}
     for role in roles:
         run.state.ticket(number, phase=DURING.get(role, "review"))
-        values["start_sha"] = start
+        values.update(start_sha=start, gate_record=os.path.relpath(driver_gate.record_path(OUT / number, start), slot))
         # A test-writer on a ticket that has locked tests is the correction after a ruling.
         check = {"correction": role == "test-writer" and bool(entry["test_writer_sha"])}
         if check["correction"] and (restored := run.restore_locked_files(number, slot)):

package/skills/implement-spec/driver_final.py

@@ -26,6 +26,7 @@ from pathlib import Path
 
 import driver_agents
 import driver_decisions
+import driver_gate
 import driver_merge
 import driver_review
 import driver_tidy
@@ -325,7 +326,7 @@ def _review(run: Run, final: dict, tip: str) -> None:
     """One round of the final review on `tip`: the full review, or after it the scoped one."""
     done, folder = final["round"], OUT / FINAL
     values = {**_prompt_values(run), "start_sha": tip, "range": f"{final['reviewed'] or final['onto']}..{tip}",
-              "gate": str(folder / f"gate-{tip[:7]}.log"), "review_diff": str(REVIEW_DIFF),
+              "gate": str(driver_gate.record_path(folder, tip)), "review_diff": str(REVIEW_DIFF),
               "ledger": str(OUT / "ledger.md"), "minors": _minor_findings(), "reviewed": str(final["reviewed"]),
               "rulings": "\n".join(driver_decisions.rulings(run.state.read()["run"]["questions"])),
               "findings": str(folder / f"findings-{done - 1}.json")}
@@ -441,7 +442,7 @@ def _write_body(run: Run, final: dict, tickets: list[Ticket]) -> Path:
         raise Blocked("the pr skill is missing: the PR body follows it; install it with "
                       "`npx skills add mattpocock/skills --skill pr`")
     values = {**_prompt_values(run), "start_sha": tip, "range": f"{final['onto']}..{tip}",
-              "gate": str(OUT / FINAL / f"gate-{tip[:7]}.log"), "pr_skill": str(method), "facts": facts}
+              "gate": str(driver_gate.record_path(OUT / FINAL, tip)), "pr_skill": str(method), "facts": facts}
     with during("the PR body"):
         report = run.read_only(FINAL, ".", run.pr, tip, lambda: run.agent("pr-writer", FINAL, ".", values))
     body.write_text(f"{report['body'].strip()}\n\n{facts}")

package/skills/implement-spec/driver_fixloop.py

@@ -11,6 +11,7 @@ from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass, field
 
 import driver_agents
+import driver_gate
 import driver_merge
 import driver_review
 import driver_slots
@@ -39,9 +40,11 @@ class Job:
         """The values of a prompt; `review` is the round whose findings the agent reads."""
         entry = self.run.state.read()["tickets"][self.ticket.number]
         findings = os.path.relpath(OUT / self.ticket.number / f"findings-{review}.json", self.slot)
+        gate = os.path.relpath(driver_gate.record_path(OUT / self.ticket.number, self.tip), self.slot)
         return {**self.values, "start_sha": self.tip, "from_sha": self.previous, "round": str(self.round),
                 "locked": " ".join(entry["locked"]), "test_writer_sha": str(entry["test_writer_sha"] or ""),
-                "findings": findings, "proofs": " ".join(f"{file}:{line}" for file, line in sorted(self.again))}
+                "findings": findings, "gate_record": gate,
+                "proofs": " ".join(f"{file}:{line}" for file, line in sorted(self.again))}
 
 
 def entry(models: dict[str, list[str]], round: int) -> str:
@@ -63,12 +66,12 @@ def _run_reviewers(job: Job, cast: list[tuple[str, str]], locked: list[str]) ->
     errors: dict[str, str] = {}
 
     def call(role: str, entry: str) -> dict:
-        # The first review of a tip must give a mutation proof for each locked test.
-        first_review = not job.previous and role == "reviewer"
+        # A full review (no fix range) must give a mutation proof for each locked test file; the prompt names them.
+        full = not job.previous and role == "reviewer"
+        notes = ["rereview"] if job.previous else ["full-review"] if full else []
         try:
             return job.run.agent(role, job.ticket.number, job.slot, values, entry=entry, fix_round=job.round,
-                                 notes=["rereview"] if job.previous else [],
-                                 check={"round": 1, "locked": locked} if first_review else {},
+                                 notes=notes, check={"full": True, "locked": locked} if full else {},
                                  alone=lambda: len(running) == 1)
         except Blocked as blocked:
             errors[role] = f"the {role}: {blocked}"

package/skills/implement-spec/driver_gate.py

@@ -25,12 +25,16 @@ def _after(slot: str, commit: str) -> str:
     return "not clean\n" + "".join(f"    {line}\n" for line in status.splitlines()).rstrip("\n") if status else "clean"
 
 
+def record_path(folder: Path, commit: str) -> Path:
+    return folder / f"gate-{commit[:7]}.log"
+
+
 def run(command: str, slot: str, folder: Path, pr_branch: str) -> tuple[bool, Path]:
     """Gate the HEAD of `slot`. Returns (green, the record)."""
     commit = head(slot)
     status = git(slot, "status", "--short").stdout
     folder.mkdir(parents=True, exist_ok=True)
-    record = folder / f"gate-{commit[:7]}.log"
+    record = record_path(folder, commit)
     # The cache of compiled Python stays out of the slot, so the gate leaves the tree clean.
     env = dict(os.environ, IMPLEMENT_SPEC_BASE=pr_branch, PYTHONPYCACHEPREFIX=str(folder.parent.resolve() / "pycache"))
     with record.open("w") as out:

package/skills/implement-spec/driver_report.py

@@ -1,6 +1,6 @@
 """Report validation: validate(role, path, context) -> list of errors, empty when the report is accepted.
 
-context: repo (slot path), branch, start (HEAD when the role started), log, round (1 = first review), locked,
+context: repo (slot path), branch, start (HEAD when the role started), log, full (a full review: no fix range), locked,
   correction (a test-writer corrects locked tests), restored (locked files the driver put back before it),
   restore_red (the gate is red on the commit of that restore),
   owners (ticket numbers, for the final fix batch), merged (locked files of merged tickets, not its own), pr (tip)."""
@@ -93,14 +93,14 @@ def _proof_errors(report: dict, context: dict) -> list[str]:
     errors = []
     if lines and not all(_seen(line, Path(context["log"]).read_text(errors="replace")) for line in lines):
         errors.append(RED)
-    if context.get("round") == 1 and "findings" in report and "mutations" not in report:
-        errors.append("mutations: required in round 1")
+    if context.get("full") and "findings" in report and "mutations" not in report:
+        errors.append("mutations: required in a full review")
     return errors
 
 
 def _locked_errors(report: dict, context: dict) -> list[str]:
-    """In the first review, each locked test file has a mutation proof (`mutations[].test` is `<file>::<test>`)."""
-    if context.get("round") != 1 or "findings" not in report:
+    """In a full review, each locked test file has a mutation proof (`mutations[].test` is `<file>::<test>`)."""
+    if not context.get("full") or "findings" not in report:
         return []
     tests = [proof["test"] for proof in report.get("mutations", [])]
     return [f"mutations: no mutation proof for the locked test file {path}" for path in context.get("locked", [])

package/skills/implement-spec/driver_review.py

@@ -7,6 +7,8 @@ A mutation proof is keyed by (production file, line); the line is the one the fi
 from __future__ import annotations
 
 import re
+from pathlib import Path
+
 import driver_agents
 from driver_slots import git, head, names, on_branch
 from driver_tickets import Ticket
@@ -135,3 +137,23 @@ def disturbed(slot: str, branch: str, tip: str) -> str:
         return f"the slot is no longer on {branch} at {tip[:7]}"
     left = [line[3:] for line in git(slot, "status", "--porcelain").stdout.splitlines()]
     return f"the tree is not as the review found it: {', '.join(left)}" if left else ""
+
+
+def _read(config: Path) -> bytes:
+    return config.read_bytes() if config.exists() else b""
+
+
+def shared_config(slot: str) -> tuple[Path, bytes]:
+    """(the git config file that every worktree of the repository shares, its bytes)."""
+    common = git(slot, "rev-parse", "--path-format=absolute", "--git-common-dir").stdout.strip()
+    return Path(common, "config"), _read(Path(common, "config"))
+
+
+def restore_config(before: tuple[Path, bytes]) -> str:
+    """"" when the shared git config is still `before` (from `shared_config`), else write it back and say so.
+    One worktree that writes the config breaks git in all of them, as a core.worktree on a gone directory does."""
+    config, data = before
+    if _read(config) == data:
+        return ""
+    config.write_bytes(data)
+    return f"the shared git config {config} changed"

package/skills/implement-spec/driver_run.py

@@ -120,15 +120,15 @@ class Run:
     def read_only(self, number: str, slot: str, branch: str, tip: str, review: Callable[[], T]) -> T:
         """Run `review` (read-only agents) and return its result. A review that changes the slot runs once more."""
         for last in (False, True):
-            error = ""
+            error, config = "", driver_review.shared_config(slot)
             try:
                 result = review()
             except Blocked as blocked:
                 error = str(blocked)
             except Halted:
-                _restore_if_changed(number, slot, branch, tip, runs_again=False)
+                _restore_if_changed(number, slot, branch, tip, config, runs_again=False)
                 raise
-            left = _restore_if_changed(number, slot, branch, tip, runs_again=not (error or last))
+            left = _restore_if_changed(number, slot, branch, tip, config, runs_again=not (error or last))
             if error or not left:
                 break
         if error or left:
@@ -182,15 +182,21 @@ class Run:
         return paths
 
 
-def _restore_if_changed(number: str, slot: str, branch: str, tip: str, runs_again: bool) -> str:
-    """After read-only agents: "" when the slot is as it was; else restore it and return what they left."""
-    left = driver_review.disturbed(slot, branch, tip)
-    if left:
+def _restore_if_changed(number: str, slot: str, branch: str, tip: str, config: tuple[Path, bytes],
+                        runs_again: bool) -> str:
+    """After read-only agents: "" when the slot and the shared git config (`driver_review.shared_config` before
+    them) are as they were; else restore both and return what they left."""
+    # The config first: a bad core.worktree in it breaks the git commands of the slot check.
+    changed = driver_review.restore_config(config)
+    moved = driver_review.disturbed(slot, branch, tip)
+    if moved:
         driver_review.restore(slot, branch, tip)
-        where, what = ("slot 1", "the final review") if number == FINAL else ("the slot", "the review")
-        again = f" and runs {what} again" if runs_again else ""
-        ledger(f"{_owner(number)}: a read-only role broke its rule: {left}; the driver restored {where} to "
-               f"{tip[:7]}{again}.")
+    left = "; ".join(filter(None, (changed, moved)))
+    if left:
+        where = ("slot 1" if number == FINAL else "the slot") + f" to {tip[:7]}"
+        restored = " and ".join(filter(None, ("the shared git config" if changed else "", where if moved else "")))
+        again = f" and runs {'the final review' if number == FINAL else 'the review'} again" if runs_again else ""
+        ledger(f"{_owner(number)}: a read-only role broke its rule: {left}; the driver restored {restored}{again}.")
     return left
 
 
@@ -274,7 +280,7 @@ def _attempts(run: Run, role: str, number: str, slot: str, values: dict[str, str
     folder.mkdir(parents=True, exist_ok=True)
     report, log, prompt = (folder / f"{role}-{fix_round}{suffix}" for suffix in (".json", ".log", ".prompt.md"))
     report_in_slot = os.path.relpath(report, slot)  # the agent works in its slot
-    context = {"repo": slot, "branch": values["branch"], "start": values["start_sha"], "log": str(log), "round": 0,
+    context = {"repo": slot, "branch": values["branch"], "start": values["start_sha"], "log": str(log),
                "template": template or role, **(check or {})}
     argv = _command(run, role, entry, os.path.relpath(prompt, slot), report_in_slot)
     text = _first_prompt(context["template"], values, notes, report_in_slot)

package/skills/implement-spec/prompts/correctness.md

@@ -32,4 +32,6 @@ Write one JSON report at {report}. When your sandbox is read-only, give the JSON
 }
 ```
 
+Run git as plain `git` in this worktree, and leave the git config as it is: all worktrees read one shared config, and one key written there, such as a `core.worktree`, breaks git in each of them. So never set GIT_DIR or GIT_WORK_TREE, and never write with `git config`.
+The gate record of the driver for {start_sha} is {gate_record}.
 Never run `git stash`, never reset, and never check out another branch: worktrees share one stash and one ref store.

package/skills/implement-spec/prompts/final-reviewer.md

@@ -12,7 +12,7 @@ Minor findings that the ticket reviews left for this review, each with its findi
 Rulings of the operator:
 {rulings}
 
-Review the range with the method of the review-diff skill in the file above, with the spec as its spec path. The gate of that method is done: check that the gate record names {start_sha}, a clean status and exit 0, and run the gate yourself only when it does not.
+Review the range with the method of the review-diff skill in the file above, with the spec as its spec path. The gate of that method is done: check that the gate record names {start_sha}, a clean status and exit 0, and run the gate yourself, in a copy as below, only when it does not.
 Decide for each minor finding in the list whether it is still true at {start_sha}; report each one that is, with the severity it has now. A ruling is settled: do not report what a ruling accepted.
 Give each finding a severity (critical, important or minor), the file and line, a title, the evidence, and a kind: `code`, `test`, or `fixture`.
 Do not commit. Leave the branch and the tree as you found them.
@@ -33,4 +33,6 @@ Write one JSON report at {report} that matches this schema:
 }
 ```
 
+Run git as plain `git` in this worktree, and leave the git config as it is: all worktrees read one shared config, and one key written there, such as a `core.worktree`, breaks git in each of them. So never set GIT_DIR or GIT_WORK_TREE, and never write with `git config`.
+To run a check off this worktree, read the gate record of the driver, {gate}, or make a copy with `git worktree add --detach <temp dir> {start_sha}`, run the check there, and remove the copy with `git worktree remove --force <temp dir>` before you report.
 Never run `git stash`, never reset, and never check out another branch: worktrees share one stash and one ref store.

package/skills/implement-spec/prompts/full-review.md

@@ -0,0 +1,2 @@
+
+This is a full review of {start_sha}: give one mutation proof or more for each of these locked test files: {locked}

package/skills/implement-spec/prompts/pr-writer.md

@@ -28,4 +28,5 @@ Write one JSON report at {report} that matches this schema:
 }
 ```
 
+Run git as plain `git` in this worktree, and leave the git config as it is: all worktrees read one shared config, and one key written there, such as a `core.worktree`, breaks git in each of them. So never set GIT_DIR or GIT_WORK_TREE, and never write with `git config`.
 Never run `git stash`, never reset, and never check out another branch: worktrees share one stash and one ref store.

package/skills/implement-spec/prompts/reviewer.md

@@ -8,7 +8,7 @@ Locked files: {locked}
 Test-writer report, when the ticket has a test-writer: {writer_report}
 
 Check the diff against the ticket and the spec, then for quality. Check that each criterion has a locked test. Test each suspicion that the ticket names in its Suspicions line.
-In round 1, for each locked test, break the production line the test protects, run the test, print its failing output, then revert the edit. A test that stays green is a critical finding. Run again each mutation that the test-writer report names in `concerns`.
+To make a mutation proof for a locked test, break the production line the test protects, run the test, print its failing output, then revert the edit. The end of this prompt names the proofs that this review needs. A test that stays green is a critical finding. Run again each mutation that the test-writer report names in `concerns`.
 A mutation proof is keyed to its test and its production line: a later round repeats it only when that line changed.
 In `mutations`, give for each proof the test as `<locked file>::<test name>`, the production file and line, and one failure line copied exactly from the output you printed.
 Give each finding a severity (critical, important or minor), the file and line, a title, the evidence, and a kind: `fixture` when a locked test encodes a stale path, format or setup detail; `test` when a test is weak or missing, as a locked test that stays green when you break the line it protects; `code` for anything else. The test-writer corrects each `fixture` finding and each critical or important `test` finding on a locked file, and the fixer gets the rest.
@@ -26,9 +26,11 @@ Write one JSON report at {report}. When your sandbox is read-only, give the JSON
     "files": {"type": "array", "items": {"type": "string"}},
     "concerns": {"type": "array", "items": {"type": "string"}},
     "findings": {"type": "array", "items": {"type": "object", "required": ["severity", "file", "line", "title", "evidence", "kind"], "properties": {"severity": {"enum": ["critical", "important", "minor"]}, "file": {"type": "string"}, "line": {"type": "integer"}, "title": {"type": "string", "minLength": 1}, "evidence": {"type": "string", "minLength": 1}, "kind": {"enum": ["code", "fixture", "test"]}}}},
-    "mutations": {"description": "Required in the first review of a tip: one proof or more for each locked test file, with `test` as `<locked file>::<test name>`. A review scoped to a fix gives the proofs that it names.", "type": "array", "items": {"type": "object", "required": ["test", "file", "line", "red"], "properties": {"test": {"type": "string", "minLength": 1}, "file": {"type": "string", "minLength": 1}, "line": {"type": "integer"}, "red": {"type": "string", "minLength": 1}}}}
+    "mutations": {"description": "Required in a full review: one proof or more for each locked test file, with `test` as `<locked file>::<test name>`. A review scoped to a fix gives the proofs that it names.", "type": "array", "items": {"type": "object", "required": ["test", "file", "line", "red"], "properties": {"test": {"type": "string", "minLength": 1}, "file": {"type": "string", "minLength": 1}, "line": {"type": "integer"}, "red": {"type": "string", "minLength": 1}}}}
   }
 }
 ```
 
+Run git as plain `git` in this worktree, and leave the git config as it is: all worktrees read one shared config, and one key written there, such as a `core.worktree`, breaks git in each of them. So never set GIT_DIR or GIT_WORK_TREE, and never write with `git config`.
+To run a check off this worktree, read the gate record of the driver, {gate_record}, or make a copy with `git worktree add --detach <temp dir> {start_sha}`, run the check there, and remove the copy with `git worktree remove --force <temp dir>` before you report.
 Never run `git stash`, never reset, and never check out another branch: worktrees share one stash and one ref store.

package/skills/implement-spec/tests/test_fixloop.py

@@ -506,16 +506,38 @@ def test_a_first_review_proves_each_locked_file_and_a_second_bad_report_blocks(t
     assert "feat: 01 rows" not in rig.pr_subjects()
 
 
+def test_a_full_review_after_a_correction_names_each_locked_file_that_needs_a_proof(tmp_path):
+    """Issue #92: the full review after a correction in a later round must prove each locked file, not only round 1."""
+    two = ("tests/test_01.py", "tests/test_01b.py")
+    first = {**tw("01"), "files": {path: "def test_x():\n    assert 0\n" for path in two}}
+    first["report"] = {**first["report"], "files": list(two), "locked": list(two)}
+    proofs = [dict(test=f"{path}::test_x", file="demo/export.py", line=1, red=f"FAILED {path}::test_x") for path in two]
+    both = lambda found=(): {"stdout": "".join(p["red"] + "\n" for p in proofs),
+                             "report": {**review("01", found)["report"], "mutations": proofs}}
+    vacuous = finding("VACUOUS", "critical", kind="test", file="tests/test_01.py")
+    correction = {**first, "files": {"tests/test_01.py": "# stronger\n"}, "commit": "test: 01 stronger test"}
+    correction["report"] = {**first["report"], "files": ["tests/test_01.py"], "locked": ["tests/test_01.py"]}
+    rig = Inside(tmp_path).run(plan(**{"01/test-writer": [first, correction], "01/fixer": [fix("01", 1)],
+                                       "01/reviewer": [both([STUCK]), review("01", [vacuous], lines=()), both()]}))
+    assert rig.code == 0, rig.ledger()
+    order = [call["role"] for call in rig.calls("01")]
+    assert order == ["test-writer", "implementer", "reviewer", "fixer", "reviewer", "test-writer", "reviewer"]
+    due = "give one mutation proof or more for each of these locked test files: tests/test_01.py tests/test_01b.py\n"
+    initial, again, full = (call["prompt"] for call in rig.calls("01", "reviewer"))
+    assert due in initial and due in full, full
+    assert "In round 1" not in full and due not in again
+
+
 def test_the_locked_file_rule_is_for_the_first_review_only(tmp_path):
     report = dict(status="DONE", commits=[], files=[], concerns=[], findings=[], mutations=[])
     path = tmp_path / "reviewer-0.json"
     path.write_text(json.dumps(report))
     context = {"repo": ".", "branch": "main", "start": "HEAD", "log": str(path), "locked": ["tests/a.py", "tests/b.py"]}
-    assert driver_report.validate("reviewer", str(path), {**context, "round": 0}) == []
-    assert driver_report.validate("reviewer", str(path), {**context, "round": 1}) == [
+    assert driver_report.validate("reviewer", str(path), context) == []
+    assert driver_report.validate("reviewer", str(path), {**context, "full": True}) == [
         "mutations: no mutation proof for the locked test file tests/a.py",
         "mutations: no mutation proof for the locked test file tests/b.py"]
-    assert driver_report.validate("correctness", str(path), {**context, "round": 0}) == []
+    assert driver_report.validate("correctness", str(path), context) == []
 
 
 def test_a_timed_out_read_only_role_is_restored_only_when_no_other_agent_is_in_the_slot(tmp_path):
@@ -562,6 +584,23 @@ def test_a_second_review_that_changes_the_slot_blocks_the_ticket_with_the_slot_c
     assert slot_state(rig) == ("", rig.sha("01", "implementer")) and "feat: 01 rows" not in rig.pr_subjects()
 
 
+def test_a_reviewer_that_writes_the_shared_git_config_gets_it_restored_and_runs_once_more(tmp_path):
+    # Issue #94: a reviewer ran git with GIT_DIR on the real git dir and left core.worktree on a deleted temp dir.
+    rig = Inside(tmp_path)
+    shared = rig.repo / ".git" / "config"
+    config = shared.read_bytes()
+    gone = {"git": [["config", "core.worktree", str(tmp_path / "gone")]]}
+    rig.run(plan(**{"01/reviewer": [{**review("01"), **gone}, review("01")]}))
+    assert rig.code == 0, rig.ledger()
+    assert shared.read_bytes() == config
+    (line,) = rig.led("Ticket 01: a read-only role broke its rule:")
+    assert f"the shared git config {shared.resolve()} changed" in line
+    assert line.endswith("the driver restored the shared git config and runs the review again.")
+    tip, prompt = rig.sha("01", "implementer"), rig.prompt("reviewer-0")
+    assert len(rig.calls("01", "reviewer")) == 2 and rig.tip() == tip
+    assert f".agent/implement/01/gate-{tip[:7]}.log" in prompt and "never write with `git config`" in prompt
+
+
 def test_a_reviewer_that_times_out_starts_again_from_the_clean_tip(tmp_path):
     hang = {"files": {"demo/export.py": "mutated\n", "junk.txt": "x\n"}, "sleep": 60}
     rig = Inside(tmp_path).run(plan(**{"01/reviewer": [hang, review("01")]}), "--timeout", "reviewer=0.03")

package/skills/implement-spec/tests/test_report.py

@@ -1,7 +1,7 @@
 """Report validation acceptance tests, through driver_report.validate only.
 
 context is a dict: repo (slot path), branch, start (HEAD sha when the role started),
-log (the agent's log file), round (fix-loop round, default 0).
+log (the agent's log file), full (a full review of the reviewer).
 """
 import json
 import subprocess
@@ -45,7 +45,7 @@ def world(tmp_path):
     def check(role, report, **context):
         path = tmp_path / f"{role}-0.json"
         path.write_text(report if isinstance(report, str) else json.dumps(report))
-        ctx = {"repo": str(root), "branch": "ticket/01", "log": str(tmp_path / "agent.log"), "round": 0}
+        ctx = {"repo": str(root), "branch": "ticket/01", "log": str(tmp_path / "agent.log")}
         return validate(role, str(path), {**ctx, **context})
     return shas, check, tmp_path
 
@@ -151,12 +151,12 @@ def test_red_line_absent_from_the_log_is_a_violation(world):
 
 def test_reviewer_fields_and_mutation_proofs(world):
     shas, check, _ = world
-    assert check("reviewer", reviewer(), start=shas["impl"], round=1) == []
+    assert check("reviewer", reviewer(), start=shas["impl"], full=True) == []
     assert any("severity" in e for e in check("reviewer", reviewer(findings=[finding(severity="huge")]),
                                               start=shas["impl"]))
     assert any("kind" in e for e in check("reviewer", reviewer(findings=[finding(kind="style")]), start=shas["impl"]))
     no_proof = reviewer()
     del no_proof["mutations"]
-    assert any("mutations" in e for e in check("reviewer", no_proof, start=shas["impl"], round=1))
+    assert any("mutations" in e for e in check("reviewer", no_proof, start=shas["impl"], full=True))
     fake = reviewer(mutations=[{"test": "t", "file": "demo/export.py", "line": 2, "red": "never ran"}])
-    assert any("not found in log" in e for e in check("reviewer", fake, start=shas["impl"], round=1))
+    assert any("not found in log" in e for e in check("reviewer", fake, start=shas["impl"], full=True))

package/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-17T06:40:10.976Z",
+  "generatedAt": "2026-10-17T15:52:14.213Z",
   "skills": [
     {
       "name": "backlog",
@@ -46,8 +46,8 @@
     },
     {
       "name": "implement-spec",
-      "version": "0.1.21",
-      "hash": "sha256-ffca735547ff5f7664f80fe98071d1956f839858ee4f1964ef9b7957af41a4cc",
+      "version": "0.1.23",
+      "hash": "sha256-c0a64ae43e2ba3c2e100b4d0a78085fdab558f8ee4eda01d7ae15eb677b8dbb5",
       "description": "Implement a specification in code."
     },
     {