@joshuafolkken/kit 1.978.0 → 1.998.0

package/scripts/rules/delivered-rules.ts

@@ -3,15 +3,14 @@ import { hook_decision, type GuardRun, type TranscriptGuardSpec } from '#scripts
 import { lane_guard_policy } from '#scripts/lane/lane-guard-policy'
 import { time_batch_guard, type GuardedCall } from '#scripts/time-runtime/time-batch-guard'
 import { bash_triggers } from './bash-triggers'
+import { direct_filing } from './direct-filing'
 import { early_heartbeat } from './early-heartbeat'
 import { file_body } from './file-body'
 import { filing_cap } from './filing-cap'
 import { gh_api } from './gh-api'
 import { git_force } from './git-force'
 import { implementation_cut } from './implementation-cut'
-import { issue_bug_label_rule } from './issue-bug-label'
 import { issue_fold } from './issue-fold'
-import { issue_scout } from './issue-scout'
 import { josh_git_bare } from './josh-git-bare'
 import { lane_background } from './lane-background'
 import { lane_carry_conflict } from './lane-carry-conflict'
@@ -135,9 +134,9 @@ type MeasuredRule = Omit<DeliveredRule, 'is_trigger'> & {
 const STAMP_PREFIX = 'josh-rule-guard-'
 
 // **`is_issue_filing` and `on_bash_command` moved to `bash-triggers.ts`** (joshuafolkken/kit#2119):
-// three rows now share the filing trigger — the WIP cap, the scout gate and the per-run filing cap —
-// and the last two live in their own modules, which could not import the enumeration back to reach a
-// private function of it. `on_bash_command` went with it because those modules build their own rows.
+// three rows share the filing trigger — the WIP cap, the per-run filing cap and the fold — and the
+// last two live in their own modules, which could not import the enumeration back to reach a private
+// function of it. `on_bash_command` went with it because those modules build their own rows.
 const { is_issue_filing, on_bash_command } = bash_triggers
 
 // The whole of the WIP cap, in the shape a refusal can carry: the count, the refusal, the two
@@ -239,8 +238,8 @@ const ISSUE_COMMENTS_REASON =
 	"except for two answers that are not the run's to make: work a comment reassigns to another " +
 	'Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a ' +
 	'reason to exist stops the run with a `confirmation` Telegram. The procedure is ' +
-	'`.claude/skills/workflow-commands/SKILL.md` → "An Issue\'s comments are part of the Issue". It ' +
-	'fires once per run and cannot repeat on the call in hand.'
+	'`.claude/skills/workflow-commands/SKILL.md` → "An Issue\'s comments are part of the Issue". ' +
+	'Every body-only read is refused until the comments are read.'
 
 // The reading of the call itself — which spellings carry a body inline, and what the shell does to
 // the value — is `shell-body-trigger.ts`, beside its own cases, as is the refusal text. A row states
@@ -295,26 +294,24 @@ const DELIVERED_RULES: ReadonlyArray<DeliveredRule> = [
 	// before any of those speak; on a first-party filing it is silent (the owners match), so `wip-cap`
 	// still speaks first, exactly as before. It fires on every occurrence (`git-force.ts`).
 	third_party_write.ROW,
+	// **A hand-built filing is refused on every occurrence** (joshuafolkken/kit#2808) and pointed at
+	// `josh issue:file`, which runs the scout, the lint, the labels, the `## Origin` check and
+	// `epic:bundle` itself. It claims the direct call only, so the rows below — which trigger on the
+	// `issue:file` call — never overlap it.
+	direct_filing.ROW,
 	{
 		id: 'wip-cap',
 		is_trigger: on_bash_command(is_issue_filing),
 		reason: WIP_CAP_REASON,
 		keeps: on_bash_command(counts_open_issues),
 	},
-	// **Three rows share the filing trigger** (joshuafolkken/kit#2119), listed after `wip-cap` so the
-	// backlog count still speaks first: `issue-scout` refuses a filing the run has not scouted (once per
-	// run, stood down once the scout is on the tail), and `filing-cap` refuses every filing past the
-	// per-run ceiling. Each is a real instance of the admissible overlap the comment on `delivery`
-	// describes — the losing rule's delivery is still correct one reissue later — so a scout-less,
-	// over-cap filing is delivered `wip-cap`, then `issue-scout`, then `filing-cap` across its reissues.
-	issue_scout.ROW,
+	// **Two more rows share the filing trigger** (joshuafolkken/kit#2119, joshuafolkken/kit#2213), listed
+	// after `wip-cap` so the backlog count still speaks first: `filing-cap` refuses every filing past
+	// the per-run ceiling, and `issue-fold` refuses a *second* filing the run has not folded. Each is a
+	// real instance of the admissible overlap the comment on `delivery` describes — the losing rule's
+	// delivery is still correct one reissue later — so an unfolded, over-cap second filing is delivered
+	// `wip-cap`, then `filing-cap`, then `issue-fold` across its reissues.
 	filing_cap.ROW,
-	// **`issue-fold` shares the same filing trigger** (joshuafolkken/kit#2213), listed after
-	// `filing-cap`: it refuses a *second* filing the run has not folded, once per run, stood down off
-	// the tail when the run has already folded or has filed nothing earlier. It is another instance of
-	// the admissible overlap — the losing rule's delivery is still correct one reissue later — so a
-	// scout-less, unfolded, over-cap second filing is delivered `wip-cap`, then `issue-scout`, then
-	// `filing-cap`, then `issue-fold` across its reissues.
 	issue_fold.ROW,
 	{
 		id: 'issue-comments',
@@ -541,13 +538,9 @@ const DELIVERED_RULES: ReadonlyArray<DeliveredRule> = [
 	rule_body_guard.ROW,
 	// **The generic oracle-consulted rows, one per oracle that declared a firing point**
 	// (joshuafolkken/kit#2324). Each refuses the action the oracle governs when the run has not run that
-	// oracle's command first, stood down once it has — `issue-scout`'s shape read from the registry
-	// rather than hand-written. Listed last so an oracle whose firing point overlaps a filing
-	// (`issue:lint`) delivers on the reissue, after `wip-cap` / `issue-scout` / `filing-cap` /
-	// `issue-fold` have each had their turn. The non-overlapping firing point (`pkg:scout` on a package
-	// add) claims a command no row above matches.
+	// oracle's command first, stood down once it has. Listed last; the one firing point left
+	// (`pkg:scout` on a package add) claims a command no row above matches.
 	...oracle_consulted.ROWS,
-	issue_bug_label_rule.ROW,
 ]
 
 // A turn that issued more than this many calls is a turn that batched. The guard counts turns that
@@ -703,10 +696,13 @@ function is_first_delivery(
 // **It is a trade, and the other side is named rather than hidden**: an arm allowed inside that window
 // that really does run is not recorded either, so a second one before it fires goes uncaught. A missing
 // record loses one detection; a wrong one blocks every arm until it expires.
-// **Both extras hang off `is_first_delivery`, and a row declares at most one.** `decide` is for a
-// recurring rule (joshuafolkken/kit#1570); `already_satisfied` is for a once-per-run rule the run can
-// satisfy earlier (joshuafolkken/kit#1905), where the earlier act stands the delivery down before the
-// once-per-run record is spent. A row with neither takes `is_first_delivery` unchanged.
+// **Both extras replace `is_first_delivery`, and a row declares at most one.** `decide` is for a
+// recurring rule (joshuafolkken/kit#1570); `already_satisfied` is for a precondition the run satisfies
+// with an earlier act (joshuafolkken/kit#1905), and that act is the only way past it: the row refuses
+// every candidate call until the act is on the tail (joshuafolkken/kit#2807). Once per run, the
+// reissue went through with the precondition still unmet — a guard that passed precisely the run that
+// skipped the procedure. Repeating cannot wedge a run that obeys, because the stand-down answers first.
+// A row with neither takes `is_first_delivery` unchanged.
 function delivery_decision(rule: DeliveredRule): TranscriptGuardSpec['should_block'] {
 	const { decide, already_satisfied } = rule
 
@@ -719,7 +715,7 @@ function delivery_decision(rule: DeliveredRule): TranscriptGuardSpec['should_blo
 		run: GuardRun,
 	): boolean {
 		if (already_satisfied?.(tail, call) === true) return false
-		if (decide === undefined) return is_first_delivery(tail, call, delivered_at_ms, run)
+		if (decide === undefined) return true
 
 		return decide(call, run, !will_batch_guard_refuse(tail, call, run), delivered_at_ms)
 	}
@@ -776,11 +772,11 @@ const delivered_rules = {
 	DELIVERED_RULES,
 	EARLY_HEARTBEAT_REASON: early_heartbeat.EARLY_HEARTBEAT_REASON,
 	FILE_BODY_REASON: file_body.FILE_BODY_REASON,
+	DIRECT_FILING_REASON: direct_filing.DIRECT_FILING_REASON,
 	FILING_CAP_REASON: filing_cap.FILING_CAP_REASON,
 	GIT_FORCE_REASON: git_force.GIT_FORCE_REASON,
 	ISSUE_COMMENTS_REASON,
 	ISSUE_FOLD_REASON: issue_fold.ISSUE_FOLD_REASON,
-	ISSUE_SCOUT_REASON: issue_scout.ISSUE_SCOUT_REASON,
 	LANE_INTERACTIVE_ASK_REASON: lane_interactive_ask.LANE_INTERACTIVE_ASK_REASON,
 	LANE_PARK_REASON: lane_park.LANE_PARK_REASON,
 	MEASURED_RULES,

package/scripts/rules/direct-filing.ts

@@ -0,0 +1,38 @@
+import { bash_triggers } from './bash-triggers'
+
+// The `direct-filing` row of `delivered-rules.ts` (joshuafolkken/kit#2808). Filing an Issue owes a
+// duplicate scout, a body lint, the classification / depth / `route:` labels, a `## Origin` on a
+// cross-repository filing and an `epic:bundle` afterwards — steps spread over as many documents, each
+// with its own guard, and joshuafolkken/kit#2805 ran two of them and skipped the rest. `josh issue:file`
+// runs them all in one command, so a hand-built `gh api …/issues` / `gh issue create` filing is refused
+// outright and pointed there; the step-by-step guards that used to sit on the direct call went with it.
+
+const DIRECT_FILING_REASON =
+	'⛔ direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path> ' +
+	'--depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>]`, never with `gh api …/issues` ' +
+	'or `gh issue create`. The command runs every filing step in order — the duplicate scout, the body ' +
+	'lint and its classification labels, the depth and `route:` labels, the `## Origin` check when filing ' +
+	'into another repository, and `epic:bundle` after the create — so none of them is a step to remember. ' +
+	'When the scout prints candidates it holds the filing: read each, then reissue with `--distinct <N,…>` ' +
+	'for the ones that are separate deliverables. Reference: `docs/josh-commands.md` → "`josh issue:file`". ' +
+	'**This rule fires on every occurrence, not once per run.**'
+
+function is_any_filing(command: string): boolean {
+	return bash_triggers.is_direct_filing(command) || bash_triggers.is_issue_filing(command)
+}
+
+// `decide` returns true so it refuses every occurrence. Keeping the rule is filing through the command;
+// the trigger is the violation itself, so the occasion it governs is a filing in either spelling
+// (`reaches`, the `run-tail` shape).
+const ROW = {
+	id: 'direct-filing',
+	is_trigger: bash_triggers.on_bash_command(bash_triggers.is_direct_filing),
+	reason: DIRECT_FILING_REASON,
+	decide: (): boolean => true,
+	keeps: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
+	reaches: bash_triggers.on_bash_command(is_any_filing),
+}
+
+const direct_filing = { DIRECT_FILING_REASON, ROW }
+
+export { direct_filing }

package/scripts/rules/filing-cap.ts

@@ -21,7 +21,9 @@ import { tail_commands } from './tail-commands'
 // **A guard-refused filing does not count.** Claude Code writes a denied call to the transcript as a
 // `tool_use` block with an errored `tool_result`, so the WIP cap's own reissue would otherwise
 // double-count one Issue — the same exclusion `investigation-reads.ts` makes for a refused read
-// (joshuafolkken/kit#1764). The filing is counted only where its result carried no guard refusal.
+// (joshuafolkken/kit#1764). **Nor does one `issue:file` held itself** (joshuafolkken/kit#2808): a lint
+// problem or an unacknowledged duplicate exits non-zero having filed nothing, and the reissue is the
+// same Issue. The filing is counted only where its result did not fail.
 
 const FILING_CAP = 10
 // The current call is not yet on the tail, so the count read there is of filings *already* made. At
@@ -31,8 +33,9 @@ const CAP_REACHED = FILING_CAP
 interface TailFilings {
 	// The `tool_use` id of every filing on the tail.
 	filing_ids: Array<string>
-	// Each result's id mapped to the guard that refused it, and `''` for a result no guard refused.
-	refusals: Map<string, string>
+	// The id of every result that came back as a failure — a guard refusal, or `issue:file` holding the
+	// filing itself (a lint problem, an unacknowledged duplicate), which files nothing either.
+	failures: Set<string>
 }
 
 function is_filing_use(block: Block): boolean {
@@ -42,7 +45,7 @@ function is_filing_use(block: Block): boolean {
 }
 
 function collect_block(block: Block, found: TailFilings): void {
-	if (block.result_id !== '') found.refusals.set(block.result_id, block.refusal_guard)
+	if (block.result_id !== '' && block.is_error === true) found.failures.add(block.result_id)
 	if (is_filing_use(block)) found.filing_ids.push(block.id)
 }
 
@@ -55,18 +58,18 @@ function collect_line(line: string, found: TailFilings): void {
 }
 
 function scan_tail(tail: string): TailFilings {
-	const found: TailFilings = { filing_ids: [], refusals: new Map<string, string>() }
+	const found: TailFilings = { filing_ids: [], failures: new Set<string>() }
 
 	for (const line of tail.split('\n')) collect_line(line, found)
 
 	return found
 }
 
-// How many Issues the run has already filed, counting only filings no guard refused.
+// How many Issues the run has already filed, counting only filings whose result did not fail.
 function prior_filing_count(tail: string): number {
-	const { filing_ids, refusals } = scan_tail(tail)
+	const { filing_ids, failures } = scan_tail(tail)
 
-	return filing_ids.filter((id) => (refusals.get(id) ?? '') === '').length
+	return filing_ids.filter((id) => !failures.has(id)).length
 }
 
 // A person's prompt: a `user` line carrying no tool result. Tool results ride `user` lines too, so the
@@ -126,6 +129,7 @@ const filing_cap = {
 	ROW,
 	current_turn,
 	decide,
+	is_prompt_line,
 	prior_filing_count,
 	turn_filing_count,
 }

package/scripts/rules/issue-citation.ts

@@ -171,6 +171,28 @@ function bare_references(message: string): ReadonlyArray<string> {
 	return [...new Set(found)]
 }
 
+// Every reference the prompt carries, each as written — `#N` or `owner/repo#N` — with none of the
+// citation exclusions applied: a number pasted inside a fence or a quote is still the person's.
+function prompt_references(prompt: string): ReadonlySet<string> {
+	const found = new Set<string>()
+
+	for (const match of prompt.matchAll(ISSUE_NUMBER)) {
+		found.add(repo_prefix(prompt, match.index) + match[0])
+	}
+
+	return found
+}
+
+// **A number the person's prompt already carried is quoted, not cited** (joshuafolkken/kit#2819). A
+// pasted log from another repository holds its own `#1`…`#7`; `issue:cite` would link them to this
+// repository's unrelated Issues, so following the refusal would make the reply wrong. Only the exact
+// reference the prompt wrote is exempt, so a bare `#N` the run brought in itself is still refused.
+function unquoted_references(message: string, prompt: string): ReadonlyArray<string> {
+	const quoted = prompt_references(prompt)
+
+	return bare_references(message).filter((reference) => !quoted.has(reference))
+}
+
 function has_bare_reference(message: string): boolean {
 	return bare_references(message).length > 0
 }
@@ -237,6 +259,13 @@ function linkify(message: string, slug: string): string {
 	return out.join('\n')
 }
 
-const issue_citation = { bare_references, cite_arguments, has_bare_reference, linkify, prose_lines }
+const issue_citation = {
+	bare_references,
+	cite_arguments,
+	has_bare_reference,
+	linkify,
+	prose_lines,
+	unquoted_references,
+}
 
 export { issue_citation }

package/scripts/rules/issue-fold.ts

@@ -15,8 +15,8 @@ import { tail_commands } from './tail-commands'
 // binds. The input is mechanical — has the run filed before, did it fold — so it is a delivered rule
 // rather than resident prose.
 //
-// **It is `issue-scout`'s shape, not `filing-cap`'s.** Once per run with an `already_satisfied`
-// stand-down read off the tail: a filing with no prior filing is stood down (nothing to fold), and so
+// **It is `issue-scout`'s shape, not `filing-cap`'s.** Refused until an `already_satisfied`
+// stand-down read off the tail answers: a filing with no prior filing is stood down (nothing to fold), and so
 // is one the run has already folded. The refusal hands over the command rather than asking the run to
 // "fold first". **No new predicate**: the filing trigger is `bash_triggers.is_issue_filing`, and the
 // prior-filing count is `filing_cap.prior_filing_count`, both reused verbatim.
@@ -55,8 +55,8 @@ const ISSUE_FOLD_REASON =
 	'"<title>" …` — `fold` means file one Issue covering them, `separate` means file them apart ' +
 	'(separable findings whose combined size clears the split guide), and the default is `fold`. Add ' +
 	'`--not-separable` when they are really one deliverable. The procedure is ' +
-	'`.claude/skills/workflow-commands/split-assessment.md` → "The question". It fires once per run ' +
-	'and cannot repeat on the call in hand.'
+	'`.claude/skills/workflow-commands/split-assessment.md` → "The question". Every later filing is ' +
+	'refused until the fold is on the transcript.'
 
 // The enumeration row itself, so `delivered-rules.ts` spreads one entry rather than restating the
 // trigger and reason it already single-sources here. Once per run with the stand-down above.

package/scripts/rules/last-prompt.ts

@@ -0,0 +1,79 @@
+import { json_value } from '#scripts/lib/json-value'
+import { time_reported_failure } from '#scripts/time-runtime/time-reported-failure'
+import { z } from 'zod'
+import { filing_cap } from './filing-cap'
+
+// The text of the person's last prompt on a transcript tail — what the stop guard's citation row
+// reads to tell a `#N` the person quoted from one the run brought in itself (joshuafolkken/kit#2819).
+//
+// **A prompt is `filing_cap`'s prompt line, minus what the harness wrote there.** A skill's body is a
+// `user` line with no tool result too, but it carries `isMeta`; a background task's completion notice
+// and a subagent's hand-back carry an `origin` whose `kind` is not `human`. Each is the harness
+// speaking, not the person — and a notice can name the very Issue the run filed — so only a line with
+// no `origin` (an SDK prompt) or a `human` one is read.
+//
+// **A workflow invocation quotes nothing.** `fullrun #2819` names this repository's own Issue, so a
+// bare `#2819` in that run's report is a citation slip like any other, and the prompt yields no text —
+// a resumed lane child's prompt included, since it ends on the same invocation.
+
+const WORKFLOW_KEYWORDS: ReadonlySet<string> = new Set([
+	'kickoff',
+	'fullrun',
+	'halfrun',
+	'backlogrun',
+])
+const NO_PROMPT = ''
+const HUMAN_ORIGIN = 'human'
+// The word before the prompt's last one — where a trailing `fullrun #N` puts its keyword.
+const KEYWORD_BEFORE_ARGUMENT = -2
+
+const PROMPT_LINE_SCHEMA = z.object({
+	isMeta: z.boolean().nullish(),
+	origin: z.object({ kind: z.string().nullish() }).nullish(),
+	message: z.object({ content: z.unknown() }),
+})
+
+type PromptLine = z.infer<typeof PROMPT_LINE_SCHEMA>
+
+function is_person(line: PromptLine): boolean {
+	if (line.isMeta === true) return false
+
+	return line.origin === null || line.origin === undefined || line.origin.kind === HUMAN_ORIGIN
+}
+
+// The prompt line's text, or `undefined` when the harness wrote it or it does not read as one.
+function person_text(line: string): string | undefined {
+	const parsed = PROMPT_LINE_SCHEMA.safeParse(json_value.parse_or_undefined(line))
+
+	if (!parsed.success || !is_person(parsed.data)) return undefined
+
+	return time_reported_failure.result_text(parsed.data.message.content)
+}
+
+// A keyword opening the prompt is what a person types; a keyword before its one trailing argument is a
+// lane child's resume prompt, whose preamble ends on `fullrun #N` (`lane-child-invocation.ts`).
+function is_invocation(prompt: string): boolean {
+	const words = prompt.trim().split(/\s+/u)
+
+	return [words.at(0), words.at(KEYWORD_BEFORE_ARGUMENT)].some((word) =>
+		WORKFLOW_KEYWORDS.has(word ?? NO_PROMPT),
+	)
+}
+
+function prompt_line_text(line: string): string | undefined {
+	return filing_cap.is_prompt_line(line) ? person_text(line) : undefined
+}
+
+// The last person prompt on the tail; '' when none is on it or it is an invocation.
+function prompt_text(tail: string): string {
+	const text = tail
+		.split('\n')
+		.map((line) => prompt_line_text(line))
+		.findLast((one) => one !== undefined)
+
+	return text === undefined || is_invocation(text) ? NO_PROMPT : text
+}
+
+const last_prompt = { prompt_text }
+
+export { last_prompt }

package/scripts/rules/oracle-consulted.ts

@@ -11,8 +11,8 @@ import { tail_commands } from './tail-commands'
 // `DeliveredRule` for each such oracle — refused when the run performs the governed action without
 // having run the oracle's command earlier, stood down once it has.
 //
-// **It is `issue-scout`'s shape, generalized.** Each generated row is once per run with an
-// `already_satisfied` stand-down read off the tail — refuse the governed call, hand back the command,
+// **It is `issue-scout`'s shape, generalized.** Each generated row refuses until its
+// `already_satisfied` stand-down reads the command off the tail — refuse the governed call, hand back the command,
 // stand down once that command is on the tail. What `issue-scout` and `issue-fold` hand-wrote per
 // oracle, this reads from the registry: the refusal is assembled from the oracle's decision, command,
 // answer vocabulary and single source, so no oracle carries a hand-written refusal of its own. **No new
@@ -51,8 +51,8 @@ function reason_for(oracle: Oracle, firing_point: FiringPoint): string {
 		`⛔ decision oracle not consulted: this is ${firing_point.describes}, but the run has not run ` +
 		`\`${command_line(oracle)}\` first — the oracle that decides ${oracle.decision.toLowerCase()}. ` +
 		`It answers ${oracle.vocabulary.join(' | ')}; single source ${oracle.single_source}. Reissue ` +
-		`after running it and reading its verdict. It fires once per run and cannot repeat on the call ` +
-		`in hand.`
+		`after running it and reading its verdict. Every such call is refused until that command is on ` +
+		`the transcript.`
 	)
 }
 

package/scripts/rules/oracle-firing.ts

@@ -1,4 +1,3 @@
-import { bash_triggers } from './bash-triggers'
 import { decision_oracle } from './decision-oracle'
 import { shell_segments } from './shell-segments'
 
@@ -32,9 +31,10 @@ function is_package_add(command: string): boolean {
 	return shell_segments.segments_of(command).some((segment) => PACKAGE_ADD.test(segment))
 }
 
-// The two firing points wired — the oracles whose governed call can be named without guessing: the
-// package add and the Issue filing. The rest declare why none can be named, so the unenforced oracles
-// are visible rather than silently missing.
+// The firing point wired — the oracle whose governed call can be named without guessing: the package
+// add. The Issue filing's `issue:lint` point left with joshuafolkken/kit#2808, when `josh issue:file`
+// began running the lint itself. The rest declare why none can be named, so the unenforced oracles are
+// visible rather than silently missing.
 const FIRING: ReadonlyMap<string, FiringPoint> = new Map([
 	[
 		'pkg:scout',
@@ -43,13 +43,6 @@ const FIRING: ReadonlyMap<string, FiringPoint> = new Map([
 			governs: is_package_add,
 		},
 	],
-	[
-		'issue:lint',
-		{
-			describes: 'an Issue-filing call (`gh api …/issues`, `gh issue create`)',
-			governs: bash_triggers.is_issue_filing,
-		},
-	],
 ])
 
 // The reason an oracle names no firing point, in three recurring shapes plus the one-off reasons for
@@ -66,9 +59,12 @@ const SELF = 'the command is itself the governed act; there is no earlier call t
 const LATEST_SCOPE_REASON =
 	'the run it governs (`pnpm josh latest`) is already gated at its point of use by the latest-gate; ' +
 	'a firing here would double-gate it'
-const EPIC_BUNDLE_REASON =
-	'it runs after a filing to place it, and that filing is already gated by `issue-scout`; it has no ' +
-	'earlier call of its own'
+// `josh issue:file` runs the scout, the lint and `epic:bundle` itself, and a filing made any other way
+// is refused by the `direct-filing` row (joshuafolkken/kit#2808) — so none of the three has a call left
+// to gate before.
+const FILING_STEP_REASON =
+	'`pnpm josh issue:file` runs it as one of its filing steps, and a direct filing is refused by the ' +
+	'`direct-filing` delivered rule; there is no separate call left to gate'
 const RELEASE_SCOPE_REASON =
 	'it reads the release owed *after* `pnpm josh followup` has merged (`git_followup_pending`), so it ' +
 	'trails the merge rather than gating it; a firing on `followup` would gate a check that must run ' +
@@ -84,8 +80,9 @@ const NOT_NAMED: ReadonlyMap<string, string> = new Map([
 	['latest:scope', LATEST_SCOPE_REASON],
 	['run:hold', SELF],
 	['cost:cut', READ],
-	['epic:bundle', EPIC_BUNDLE_REASON],
-	['issue:scout', 'the filing it governs is already gated by the `issue-scout` delivered rule'],
+	['epic:bundle', FILING_STEP_REASON],
+	['issue:scout', FILING_STEP_REASON],
+	['issue:lint', FILING_STEP_REASON],
 	[
 		'issue:fold',
 		'the second filing it governs is already gated by the `issue-fold` delivered rule',

package/scripts/rules/rule-body-guard.ts

@@ -22,16 +22,13 @@ import { tail_commands } from './tail-commands'
 // URL is stripped) all fail. What stays is the case the Issue names — writing rule prose into a rule
 // document.
 //
-// **No `decide`, so once per run.** The refusal changes what the run *knows* — that a new rule owes
-// question 0 and the ordering question — which is the shape `rule-delivery.md` says once-per-run is
-// right for: told once, the run applies it to every later rule it writes.
-//
 // **The stand-down is what turned the reminder into a check** (joshuafolkken/kit#2324). Until now the
 // row only *reminded* — it fired once and let the reissue through unconditionally, so "reissue and it
 // goes" meant a computable rule could still be written into prose with nothing having answered the two
 // questions. Now the pass condition is a *record*: the run has run `pnpm josh oracle:list` (question 0)
 // and `pnpm josh run:step` (the ordering question) earlier in the transcript. Both present, the edit is
-// stood down; either missing, it is refused. It passes on answering the questions, not on reading the
+// stood down; either missing, it is refused — on the reissue too, since a row with a stand-down
+// refuses until it is met (joshuafolkken/kit#2807). It passes on answering the questions, not on reading the
 // reminder. Keeping the rule is therefore running those two commands, which `keeps` names.
 
 // The two edit tools the `PreToolUse` matcher routes here. A `Write` carries the whole new file; an
@@ -133,7 +130,7 @@ function writes_rule_prose(
 }
 
 // The instruction in the shape a refusal can carry: what the edit is doing, the two questions it
-// skips, the commands that answer them, and the reissue every once-per-run delivery needs.
+// skips, the commands that answer them, and the reissue once they have run.
 const RULE_BODY_REASON =
 	'⛔ rule written into prose: this edit adds rule text to CLAUDE.md, a `prompts/**` doc or a skill ' +
 	'body. Before it lands, run the residency questions the addition skips. A rule whose answer is ' +
@@ -144,9 +141,9 @@ const RULE_BODY_REASON =
 	'sequencing rule moves into. Only a rule that is neither — not computable, not ordering — stays ' +
 	'prose, and then as a trigger-plus-pointer line rather than a second copy of its procedure. The ' +
 	'criterion is `prompts/collaboration-workflow/residency.md` (question 0 and the ordering question); ' +
-	'the delivery enumeration is `prompts/collaboration-workflow/rule-delivery.md`. This fires once per ' +
-	'run — once you have confirmed the rule can be neither an oracle nor an ordering step, reissue this ' +
-	'edit and it will go through.'
+	'the delivery enumeration is `prompts/collaboration-workflow/rule-delivery.md`. Every such edit is ' +
+	'refused until both commands are on the transcript — run them, confirm the rule can be neither an ' +
+	'oracle nor an ordering step, then reissue this edit.'
 
 // The two placement oracles the residency questions name: question 0 is `pnpm josh oracle:list`, the
 // ordering question is `pnpm josh run:step` (its degenerate pre-implementation form `run:next` counts

package/scripts/rules/stop-rules.ts

@@ -49,6 +49,8 @@ interface StopContext {
 	notified: boolean
 	// The turn's session-facing reply text.
 	message: string
+	// The person's last prompt — a `#N` it already carried is quoted, not cited (joshuafolkken/kit#2819).
+	prompt: string
 	// This stop already forced a continuation earlier in the prompt — the loop-breaker Claude Code
 	// documents, so a run that will not comply is not blocked forever.
 	stop_hook_active: boolean
@@ -136,8 +138,9 @@ const FILING_OFFER_REASON =
 	'⛔ filing offer: your reply offers to file an Issue instead of filing it. Filing into a ' +
 	'first-party repository is Tier A — the trigger is the judgement that it is worth filing, not the ' +
 	"run's progress (`.claude/skills/workflow-commands/SKILL.md` → §2i, `observation-filing.md`). Run " +
-	'`pnpm josh issue:scout "<title>"`, file it, run `pnpm josh epic:bundle <new>`, then end with the ' +
-	'one-line citation of what was filed — do not repeat your previous reply. If it is not worth filing ' +
+	'`pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2>` — it scouts, lints, labels and ' +
+	'runs `epic:bundle` itself — then end with the one-line citation of what was filed; do not repeat ' +
+	'your previous reply. If it is not worth filing ' +
 	'after all, say so in one line instead.'
 
 // **A headless parent's turn-end is its process's end** (joshuafolkken/kit#2437). Under `claude -p` the
@@ -241,8 +244,8 @@ function needs_release(context: StopContext): boolean {
 	return is_held_idle(context) && context.tree_clean
 }
 
-function citation_reason(message: string): string | undefined {
-	const references = issue_citation.bare_references(message)
+function citation_reason(context: StopContext): string | undefined {
+	const references = issue_citation.unquoted_references(context.message, context.prompt)
 	if (references.length === 0) return undefined
 
 	return build_citation_reason(references)
@@ -254,7 +257,7 @@ function citation_reason(message: string): string | undefined {
 function reply_reason(context: StopContext): string | undefined {
 	if (needs_filing(context)) return FILING_OFFER_REASON
 
-	return citation_reason(context.message) ?? language_reason(context)
+	return citation_reason(context) ?? language_reason(context)
 }
 
 // The headless wait holds past the loop-breaker until the spin bound is reached.

package/scripts/safe-chain/ci-installer-pin.ts

@@ -1,16 +1,14 @@
 import { createHash } from 'node:crypto'
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { execaSync } from 'execa'
 
-// The workflows that install safe-chain on the runner. Each carries the release and the installer's
-// SHA-256 as workflow-level env, so one pin per file moves every "Setup safe-chain" step at once
-// (joshuafolkken/kit#2711, joshuafolkken/kit#2765). A consumer has the first and the last, and
-// `josh sync` rewrites both from kit, so moving them anywhere but kit is harmless and short-lived.
-const WORKFLOW_PATHS = [
-	'.github/workflows/ci.yml',
-	'templates/workflows/ci.yml',
-	'.github/workflows/pr-classification.yml',
-]
+// Where the workflows that install safe-chain on the runner live. Each carries the release and the
+// installer's SHA-256 as workflow-level env, so one pin per file moves every "Setup safe-chain" step
+// at once (joshuafolkken/kit#2711, joshuafolkken/kit#2765). The directories are scanned rather than
+// a file list kept, so a workflow another package distributes — app-kit's `dast.yml` and `load.yml`
+// — moves with the rest (joshuafolkken/kit#2830); a file without the pin is never a target.
+const WORKFLOW_DIRECTORIES = ['.github/workflows', 'templates/workflows']
+const WORKFLOW_FILE_RE = /\.ya?ml$/u
 // `[ \t]` rather than `\s`: under the `m` flag `\s*` would run across line ends and swallow the
 // blank line that follows the env block.
 const VERSION_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_VERSION:[ \t]*)(?<value>\S+)[ \t]*$/mu
@@ -27,6 +25,15 @@ function installer_url(version: string): string {
 	return `https://github.com/AikidoSec/safe-chain/releases/download/${version}/install-safe-chain.sh`
 }
 
+function list_workflows(): Array<string> {
+	return WORKFLOW_DIRECTORIES.filter((directory) => existsSync(directory)).flatMap((directory) =>
+		readdirSync(directory)
+			.filter((file_name) => WORKFLOW_FILE_RE.test(file_name))
+			.toSorted((left, right) => left.localeCompare(right))
+			.map((file_name) => `${directory}/${file_name}`),
+	)
+}
+
 function extract_pinned_version(content: string): string | undefined {
 	return VERSION_RE.exec(content)?.groups?.[VALUE_GROUP]
 }
@@ -66,7 +73,7 @@ function write_pin(workflow_path: string, pin: InstallerPin): void {
 	writeFileSync(workflow_path, rewrite_pin(readFileSync(workflow_path, 'utf8'), pin), 'utf8')
 }
 
-function sync(latest: string, workflow_paths: ReadonlyArray<string> = WORKFLOW_PATHS): void {
+function sync(latest: string, workflow_paths: ReadonlyArray<string> = list_workflows()): void {
 	const targets = stale_workflows(latest, workflow_paths)
 	if (targets.length === 0) return
 
@@ -82,7 +89,7 @@ function sync(latest: string, workflow_paths: ReadonlyArray<string> = WORKFLOW_P
 }
 
 const ci_installer_pin = {
-	WORKFLOW_PATHS,
+	list_workflows,
 	installer_url,
 	extract_pinned_version,
 	rewrite_pin,

package/scripts/safe-chain/project-config.ts

@@ -146,4 +146,4 @@ function sync_project_config(root: string): boolean {
 
 const project_config = { merge_project_config, sync_project_config }
 
-export { project_config }
+export { project_config, PROJECT_CONFIG_FILE }