@lamentis/naome 1.0.1 → 1.1.0

package/crates/naome-core/src/task_state.rs

@@ -6,6 +6,7 @@ use std::process::Command;
 use serde_json::Value;
 
 use crate::harness_health::{validate_harness_health, HarnessHealthOptions};
+use crate::install_plan::MACHINE_OWNED_PATHS;
 use crate::models::NaomeError;
 
 const CONTROL_STATE_PATH: &str = ".naome/task-state.json";
@@ -65,6 +66,30 @@ struct ChangedEntry {
     status: String,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CompletedTaskHarnessRefreshDiff {
+    pub harness_paths: Vec<String>,
+    pub task_paths: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct HarnessRefreshWithUnrelatedDiff {
+    pub harness_paths: Vec<String>,
+    pub unrelated_paths: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct HarnessRefreshDiff {
+    pub harness_paths: Vec<String>,
+    pub unrelated_paths: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CompletedTaskCommitDiff {
+    pub task_paths: Vec<String>,
+    pub unrelated_paths: Vec<String>,
+}
+
 pub fn validate_task_state(
     root: &Path,
     options: TaskStateOptions,
@@ -175,6 +200,128 @@ pub fn validate_task_state(
     Ok(report)
 }
 
+pub fn completed_task_commit_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
+    Ok(completed_task_commit_diff(root)?
+        .map(|diff| diff.task_paths)
+        .unwrap_or_default())
+}
+
+pub fn completed_task_commit_diff(
+    root: &Path,
+) -> Result<Option<CompletedTaskCommitDiff>, NaomeError> {
+    let mut read_errors = Vec::new();
+    let Some(task_state) = read_json(root, ".naome/task-state.json", &mut read_errors)? else {
+        return Ok(None);
+    };
+    if !read_errors.is_empty()
+        || task_state.get("status").and_then(Value::as_str) != Some("complete")
+    {
+        return Ok(None);
+    }
+    let Some(active_task) = task_state.get("activeTask") else {
+        return Ok(None);
+    };
+
+    let allowed_paths = string_array(active_task.get("allowedPaths")).unwrap_or_default();
+    let mut task_entries = Vec::new();
+    let mut unrelated_paths = Vec::new();
+    for entry in read_git_changed_entries(root)? {
+        if entry.path == CONTROL_STATE_PATH || matches_any_pattern(&entry.path, &allowed_paths) {
+            task_entries.push(entry);
+        } else {
+            unrelated_paths.push(entry.path);
+        }
+    }
+
+    if task_entries.is_empty() {
+        return Ok(None);
+    }
+
+    let mut errors = Vec::new();
+    validate_task_state_shape(&task_state, &mut errors);
+    validate_active_task(Some(active_task), &mut errors);
+    validate_pending_upgrade(&task_state, root, &mut errors)?;
+    validate_active_task_references(Some(active_task), root, &mut errors, Some("complete"))?;
+    if !task_state.get("blocker").is_some_and(Value::is_null) {
+        errors.push("complete task state must have blocker set to null.".to_string());
+    }
+    let check_ids = read_verification_check_ids(root, &mut errors)?;
+    validate_required_check_ids(active_task, &check_ids, &mut errors);
+    validate_complete_task_against_entries(
+        active_task,
+        root,
+        &check_ids,
+        &task_entries,
+        &mut errors,
+    )?;
+    if !errors.is_empty() {
+        return Ok(None);
+    }
+
+    let mut task_paths: Vec<String> = task_entries
+        .into_iter()
+        .map(|entry| entry.path)
+        .collect::<HashSet<_>>()
+        .into_iter()
+        .collect();
+    task_paths.sort();
+    unrelated_paths.sort();
+
+    Ok(Some(CompletedTaskCommitDiff {
+        task_paths,
+        unrelated_paths,
+    }))
+}
+
+pub fn harness_refresh_diff(root: &Path) -> Result<Option<HarnessRefreshDiff>, NaomeError> {
+    let changed_paths = read_git_changed_paths(root)?;
+    let has_repair_signal = changed_paths
+        .iter()
+        .any(|path| is_packaged_machine_owned_path(path) || is_repair_archive_path(path));
+    if !has_repair_signal {
+        return Ok(None);
+    }
+
+    let mut harness_paths = Vec::new();
+    let mut unrelated_paths = Vec::new();
+
+    for path in changed_paths {
+        if is_safe_harness_refresh_path(&path) {
+            harness_paths.push(path);
+        } else {
+            unrelated_paths.push(path);
+        }
+    }
+
+    if harness_paths.is_empty() {
+        return Ok(None);
+    }
+
+    harness_paths.sort();
+    unrelated_paths.sort();
+
+    Ok(Some(HarnessRefreshDiff {
+        harness_paths,
+        unrelated_paths,
+    }))
+}
+
+pub fn harness_refresh_with_unrelated_diff(
+    root: &Path,
+) -> Result<Option<HarnessRefreshWithUnrelatedDiff>, NaomeError> {
+    let Some(diff) = harness_refresh_diff(root)? else {
+        return Ok(None);
+    };
+    if diff.unrelated_paths.is_empty() {
+        return Ok(None);
+    }
+
+    Ok(Some(HarnessRefreshWithUnrelatedDiff {
+        harness_paths: diff.harness_paths,
+        unrelated_paths: diff.unrelated_paths,
+    }))
+}
+
 fn validate_harness_health_gate(
     root: &Path,
     options: &TaskStateOptions,
@@ -677,7 +824,23 @@ fn validate_proof_evidence_covers_changed_paths(
         return Ok(());
     }
 
-    let changed_paths = read_task_diff(active_task, root)?;
+    let entries = read_git_changed_entries(root)?;
+    validate_proof_evidence_covers_changed_entries(active_task, &entries, errors)
+}
+
+fn validate_proof_evidence_covers_changed_entries(
+    active_task: &Value,
+    entries: &[ChangedEntry],
+    errors: &mut Vec<String>,
+) -> Result<(), NaomeError> {
+    let Some(proofs) = active_task.get("proofResults").and_then(Value::as_array) else {
+        return Ok(());
+    };
+    if proofs.is_empty() {
+        return Ok(());
+    }
+
+    let changed_paths = task_diff_from_entries(active_task, entries);
     let evidence_paths: HashSet<String> = proofs
         .iter()
         .flat_map(|proof| {
@@ -945,7 +1108,16 @@ fn validate_changed_paths(
     root: &Path,
     errors: &mut Vec<String>,
 ) -> Result<(), NaomeError> {
-    let diff = read_task_diff(active_task, root)?;
+    let entries = read_git_changed_entries(root)?;
+    validate_changed_entries(active_task, &entries, errors)
+}
+
+fn validate_changed_entries(
+    active_task: &Value,
+    entries: &[ChangedEntry],
+    errors: &mut Vec<String>,
+) -> Result<(), NaomeError> {
+    let diff = task_diff_from_entries(active_task, entries);
     if !diff.outside_paths.is_empty() {
         errors.push(format!(
             "Changed files outside allowedPaths: {}",
@@ -1000,10 +1172,14 @@ struct TaskDiff {
 
 fn read_task_diff(active_task: &Value, root: &Path) -> Result<TaskDiff, NaomeError> {
     let entries = read_git_changed_entries(root)?;
+    Ok(task_diff_from_entries(active_task, &entries))
+}
+
+fn task_diff_from_entries(active_task: &Value, entries: &[ChangedEntry]) -> TaskDiff {
     let allowed_paths = string_array(active_task.get("allowedPaths")).unwrap_or_default();
     let diff_paths: Vec<String> = entries
-        .into_iter()
-        .map(|entry| entry.path)
+        .iter()
+        .map(|entry| entry.path.clone())
         .filter(|path| path != CONTROL_STATE_PATH)
         .collect();
     let outside_paths = diff_paths
@@ -1012,10 +1188,10 @@ fn read_task_diff(active_task: &Value, root: &Path) -> Result<TaskDiff, NaomeErr
         .cloned()
         .collect();
 
-    Ok(TaskDiff {
+    TaskDiff {
         diff_paths,
         outside_paths,
-    })
+    }
 }
 
 fn validate_complete_task(
@@ -1051,9 +1227,8 @@ fn validate_complete_task(
 
     let check_ids = read_verification_check_ids(root, errors)?;
     validate_required_check_ids(active_task, &check_ids, errors);
-    validate_proof_results(active_task, &check_ids, root, errors)?;
-    validate_changed_paths(active_task, root, errors)?;
-    validate_proof_evidence_covers_changed_paths(Some(active_task), root, errors)?;
+    let entries = read_git_changed_entries(root)?;
+    validate_complete_task_against_entries(active_task, root, &check_ids, &entries, errors)?;
 
     if errors.len() == error_start {
         add_completed_task_diff_notice(root, notices)?;
@@ -1062,6 +1237,19 @@ fn validate_complete_task(
     Ok(())
 }
 
+fn validate_complete_task_against_entries(
+    active_task: &Value,
+    root: &Path,
+    check_ids: &HashSet<String>,
+    entries: &[ChangedEntry],
+    errors: &mut Vec<String>,
+) -> Result<(), NaomeError> {
+    validate_proof_results(active_task, check_ids, root, errors)?;
+    validate_changed_entries(active_task, entries, errors)?;
+    validate_proof_evidence_covers_changed_entries(active_task, entries, errors)?;
+    Ok(())
+}
+
 fn validate_progress(
     task_state: &Value,
     root: &Path,
@@ -1268,7 +1456,11 @@ fn validate_commit_gate(
     errors: &mut Vec<String>,
     notices: &mut Vec<String>,
 ) -> Result<(), NaomeError> {
-    let changed_paths = read_git_changed_paths(root)?;
+    let staged_entries = read_git_staged_changed_entries(root)?;
+    let changed_paths: Vec<String> = staged_entries
+        .iter()
+        .map(|entry| entry.path.clone())
+        .collect();
     if changed_paths.is_empty() {
         return Ok(());
     }
@@ -1277,16 +1469,35 @@ fn validate_commit_gate(
         .get("status")
         .and_then(Value::as_str)
         .unwrap_or("invalid");
+    if status == "complete" && completed_task_harness_refresh_diff(root)?.is_some() {
+        if is_safe_harness_refresh_diff(&changed_paths) {
+            return Ok(());
+        }
+    }
+
     if status == "complete" {
         validate_active_task(task_state.get("activeTask"), errors);
         validate_active_task_references(task_state.get("activeTask"), root, errors, Some(status))?;
-        validate_complete_task(
-            task_state.get("activeTask"),
-            task_state.get("blocker"),
-            root,
-            errors,
-            notices,
-        )?;
+        if !task_state.get("blocker").is_some_and(Value::is_null) {
+            errors.push("complete task state must have blocker set to null.".to_string());
+        }
+        if let Some(active_task) = task_state.get("activeTask") {
+            let check_ids = read_verification_check_ids(root, errors)?;
+            validate_required_check_ids(active_task, &check_ids, errors);
+            validate_complete_task_against_entries(
+                active_task,
+                root,
+                &check_ids,
+                &staged_entries,
+                errors,
+            )?;
+            if errors.is_empty() {
+                notices.push(format!(
+                    "Commit gate accepted task-owned staged paths: {}.",
+                    changed_paths.join(", ")
+                ));
+            }
+        }
         return Ok(());
     }
 
@@ -1341,15 +1552,15 @@ fn format_dirty_diff_admission_blocker(
     );
 
     if is_harness_repair_diff(root, changed_paths)? {
-        return Ok(format!("{prefix} These look like completed Harness Repair changes. Ask the user to choose exactly one: commit_repair_baseline, review_repair_diff, cancel_repair_baseline. Do not commit without explicit user selection."));
+        return Ok(format!("{prefix} These look like completed Harness Repair changes. Run NAOME intent for the next natural-language request before deciding whether to baseline, review, or cancel the repair diff."));
     }
 
     if is_completed_task_diff(task_state, changed_paths) {
-        return Ok(format!("{prefix} These look like completed task changes. Ask the user to choose exactly one: commit_task_baseline, review_task_diff, request_task_changes, cancel_task_changes. Do not commit without explicit user selection."));
+        return Ok(format!("{prefix} These look like completed task changes. Run NAOME intent for the next natural-language request; deterministic policy can baseline a valid completed task before creating the next task."));
     }
 
     if is_naome_baseline_diff(changed_paths) {
-        return Ok(format!("{prefix} These look like completed NAOME install or upgrade changes. Ask the user to choose exactly one: commit_upgrade_baseline, review_diff_first, cancel_upgrade_baseline. Do not commit without explicit user selection."));
+        return Ok(format!("{prefix} These look like completed NAOME install or upgrade changes. Run NAOME intent for the next natural-language request; deterministic policy can baseline setup before creating the next task."));
     }
 
     Ok(format!("{prefix} Ask the user to choose exactly one: review_task_diff, request_task_changes, cancel_task_changes. Do not start new feature work or commit without explicit user selection."))
@@ -1379,6 +1590,21 @@ fn is_repair_support_path(path: &str) -> bool {
         || is_repair_archive_path(path)
 }
 
+fn is_packaged_machine_owned_path(path: &str) -> bool {
+    MACHINE_OWNED_PATHS.iter().any(|owned| *owned == path)
+}
+
+fn is_safe_harness_refresh_path(path: &str) -> bool {
+    is_packaged_machine_owned_path(path) || is_repair_support_path(path)
+}
+
+fn is_safe_harness_refresh_diff(changed_paths: &[String]) -> bool {
+    !changed_paths.is_empty()
+        && changed_paths
+            .iter()
+            .all(|path| is_safe_harness_refresh_path(path))
+}
+
 fn is_repair_archive_path(path: &str) -> bool {
     path.starts_with(".naome/archive/repair-")
 }
@@ -1500,10 +1726,74 @@ fn add_completed_task_diff_notice(
         return Ok(());
     }
 
-    notices.push(format!("Next task admission is blocked until the completed task diff is resolved. Changed paths: {}. Ask the user to choose exactly one: commit_task_baseline, review_task_diff, request_task_changes, cancel_task_changes. Do not start new feature work until one option is resolved.", changed_paths.join(", ")));
+    notices.push(format!("Task is complete and verified. Changed paths: {}. NAOME intent can baseline it automatically before the next distinct task; only surface human choices when intent blocks or the user explicitly asks to review, revise, cancel, or commit.", changed_paths.join(", ")));
     Ok(())
 }
 
+pub fn completed_task_harness_refresh_diff(
+    root: &Path,
+) -> Result<Option<CompletedTaskHarnessRefreshDiff>, NaomeError> {
+    let mut read_errors = Vec::new();
+    let Some(task_state) = read_json(root, ".naome/task-state.json", &mut read_errors)? else {
+        return Ok(None);
+    };
+    if !read_errors.is_empty() {
+        return Ok(None);
+    }
+    if task_state.get("status").and_then(Value::as_str) != Some("complete") {
+        return Ok(None);
+    }
+    let Some(active_task) = task_state.get("activeTask") else {
+        return Ok(None);
+    };
+
+    let allowed_paths = string_array(active_task.get("allowedPaths")).unwrap_or_default();
+    let mut harness_paths = Vec::new();
+    let mut task_paths = Vec::new();
+    let mut other_paths = Vec::new();
+
+    for path in read_git_changed_paths(root)? {
+        if path == CONTROL_STATE_PATH {
+            continue;
+        }
+        if matches_any_pattern(&path, &allowed_paths) {
+            task_paths.push(path);
+        } else if is_safe_harness_refresh_path(&path) {
+            harness_paths.push(path);
+        } else {
+            other_paths.push(path);
+        }
+    }
+
+    if task_paths.is_empty() || harness_paths.is_empty() || !other_paths.is_empty() {
+        return Ok(None);
+    }
+
+    let report = validate_task_state(
+        root,
+        TaskStateOptions {
+            mode: TaskStateMode::State,
+            harness_health: None,
+        },
+    )?;
+    let allowed_scope_error = format!(
+        "Changed files outside allowedPaths: {}",
+        harness_paths.join(", ")
+    );
+    if report
+        .errors
+        .iter()
+        .all(|error| error == &allowed_scope_error)
+    {
+        Ok(Some(CompletedTaskHarnessRefreshDiff {
+            harness_paths,
+            task_paths,
+        }))
+    } else {
+        Ok(None)
+    }
+}
+
 fn read_git_changed_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
     Ok(read_git_changed_entries(root)?
         .into_iter()
@@ -1511,6 +1801,21 @@ fn read_git_changed_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
         .collect())
 }
 
+fn read_git_staged_changed_entries(root: &Path) -> Result<Vec<ChangedEntry>, NaomeError> {
+    let output = Command::new("git")
+        .args(["diff", "--name-status", "--cached", "-z"])
+        .current_dir(root)
+        .output()?;
+    if !output.status.success() {
+        return Err(NaomeError::new(format!(
+            "git diff --name-status --cached -z failed: {}",
+            command_output(&output)
+        )));
+    }
+
+    Ok(parse_name_status_output(&output.stdout))
+}
+
 fn read_git_changed_entries(root: &Path) -> Result<Vec<ChangedEntry>, NaomeError> {
     let git_check = run_git(root, ["rev-parse", "--is-inside-work-tree"])?;
     if !git_check.status.success() {

package/crates/naome-core/tests/decision.rs

@@ -1,10 +1,10 @@
 use std::fs;
-use std::sync::Mutex;
 use std::path::{Path, PathBuf};
 use std::process::Command;
+use std::sync::Mutex;
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use naome_core::{evaluate_decision, EvaluationOptions};
+use naome_core::{evaluate_decision, format_decision, EvaluationOptions};
 use serde_json::json;
 
 static ENV_LOCK: Mutex<()> = Mutex::new(());
@@ -62,6 +62,11 @@ fn completed_task_diff_returns_baseline_choices() {
         .allowed_actions
         .contains(&"request_task_changes".to_string()));
     assert_eq!(decision.changed_paths, vec!["README.md"]);
+
+    let human_output = format_decision(&decision, "next");
+    assert!(human_output.contains("Intent routing"));
+    assert!(!human_output.contains("Allowed actions:"));
+    assert!(!human_output.contains("commit_task_baseline"));
 }
 
 #[test]
@@ -82,10 +87,7 @@ fn idle_unowned_diff_blocks_new_feature_work() {
     let decision = evaluate_decision(repo.path(), EvaluationOptions::offline()).unwrap();
 
     assert_eq!(decision.state, "dirty_unowned_diff");
-    assert_eq!(
-        decision.allowed_actions,
-        vec!["review_unowned_diff", "clear_or_commit_unowned_diff"]
-    );
+    assert_eq!(decision.allowed_actions, vec!["review_unowned_diff"]);
     assert_eq!(decision.changed_paths, vec!["README.md"]);
 }
 

package/crates/naome-core/tests/install_plan.rs

@@ -21,15 +21,24 @@ fn install_plan_marks_machine_docs_and_bins_local_only() {
 }
 
 #[test]
-fn install_plan_includes_gitignore_and_untrack_policy() {
+fn install_plan_includes_git_exclude_and_untrack_policy() {
     let plan = install_plan("1.0.0");
 
-    assert!(plan.gitignore_entries.contains(&".naome/archive/"));
-    assert!(plan.gitignore_entries.contains(&".naome/bin/naome-rust*"));
     assert!(plan
         .gitignore_entries
+        .contains(&".naome/task-journal.jsonl"));
+    assert!(plan.git_exclude_entries.contains(&".naome/archive/"));
+    assert!(plan.git_exclude_entries.contains(&".naome/bin/naome-rust*"));
+    assert!(plan
+        .git_exclude_entries
+        .contains(&".naome/task-journal.jsonl"));
+    assert!(plan
+        .git_exclude_entries
         .contains(&".naome/bin/check-harness-health.js"));
     assert!(plan.git_untrack_paths.contains(&".naome/archive"));
     assert!(plan.git_untrack_paths.contains(&".naome/bin/naome-rust"));
+    assert!(plan
+        .git_untrack_paths
+        .contains(&".naome/task-journal.jsonl"));
     assert!(plan.git_untrack_paths.contains(&"docs/naome/first-run.md"));
 }