@lamentis/naome 1.0.2 → 1.1.0

package/crates/naome-core/tests/task_state.rs

@@ -106,10 +106,10 @@ fn accepts_complete_task_with_scoped_diff_and_notice() {
     let report = validate_task_state(repo.path(), TaskStateOptions::default()).unwrap();
 
     assert!(report.errors.is_empty(), "{:#?}", report.errors);
-    assert!(report
-        .notices
-        .join("\n")
-        .contains("Next task admission is blocked"));
+    let notices = report.notices.join("\n");
+    assert!(notices.contains("Task is complete and verified"));
+    assert!(notices.contains("NAOME intent can baseline it automatically"));
+    assert!(!notices.contains("commit_task_baseline"));
 }
 
 #[test]
@@ -187,6 +187,65 @@ fn commit_gate_allows_install_baseline_with_gitignore_and_project_owned_paths()
     assert!(report.errors.is_empty(), "{:#?}", report.errors);
 }
 
+#[test]
+fn commit_gate_allows_staged_harness_refresh_split_from_completed_task() {
+    let repo = TaskFixture::new(complete_task_state(json!({
+        "allowedPaths": ["README.md"],
+        "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))]
+    })));
+    repo.install_healthy_harness();
+    repo.init_git();
+    repo.write("README.md", "# Task result\n");
+    repo.write("AGENTS.md", "# Agent Instructions\n\nUpdated by sync.\n");
+    repo.write_json(
+        ".naome/manifest.json",
+        json!({
+            "name": "naome",
+            "harnessVersion": "1.1.0",
+            "profile": "standard",
+            "machineOwned": MACHINE_OWNED_PATHS,
+            "projectOwned": PROJECT_OWNED_PATHS,
+            "integrity": {}
+        }),
+    );
+    repo.git(["add", "AGENTS.md", ".naome/manifest.json"]);
+
+    let report = validate_task_state(
+        repo.path(),
+        TaskStateOptions {
+            mode: TaskStateMode::CommitGate,
+            ..TaskStateOptions::default()
+        },
+    )
+    .unwrap();
+
+    assert!(report.errors.is_empty(), "{:#?}", report.errors);
+}
+
+#[test]
+fn commit_gate_ignores_unstaged_user_edits_outside_completed_task_scope() {
+    let repo = TaskFixture::new(complete_task_state(json!({
+        "allowedPaths": ["README.md"],
+        "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))]
+    })));
+    repo.write("USER.md", "user baseline\n");
+    repo.init_git();
+    repo.write("README.md", "# Task result\n");
+    repo.write("USER.md", "user local edit\n");
+    repo.git(["add", "README.md", ".naome/task-state.json"]);
+
+    let report = validate_task_state(
+        repo.path(),
+        TaskStateOptions {
+            mode: TaskStateMode::CommitGate,
+            ..TaskStateOptions::default()
+        },
+    )
+    .unwrap();
+
+    assert!(report.errors.is_empty(), "{:#?}", report.errors);
+}
+
 #[test]
 fn progress_accepts_implementing_task_with_scoped_diff_without_proof() {
     let repo = TaskFixture::new(json!({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "MIT",
   "type": "module",

package/templates/naome-root/.naome/bin/check-harness-health.js

@@ -9,17 +9,18 @@ const nativeBinaryRelativePath = process.platform === "win32" ? ".naome/bin/naom
 const nativeBinaryName = process.platform === "win32" ? "naome.exe" : "naome";
 
 const expectedMachineOwnedIntegrity = Object.freeze({
-  "AGENTS.md": "sha256:ebe589ce85b43d4aa23014d8a26a49bd33dc52ef1bba68e4f63a7e86640be06a",
+  "AGENTS.md": "sha256:84ce882fa6798a144c8c74673d4304fc6bf235b1cc417f7649eea9f7461775de",
   ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
-  ".naome/bin/naome.js": "sha256:1b63729dc55730a826193d35cf78e755a991b356ac81b45f4aa3fcf24c8152fa",
+  ".naome/bin/naome.js": "sha256:7894690ad47700a9a5e7ecb5a94ba42c1a12e2637d2c9f41f0023b1bd8bd22b6",
   ".naome/bin/check-task-state.js": "sha256:43c02868072d0d13499aefba2e9a5ec9517d59539fd19ff0f11e3e4623a51b44",
   ".naome/bin/check-harness-health.js": "sha256:dce2a380022dd63d86bd762869debafbc635ab3d7e8fae985e2d429d8ee437ad",
   ".naome/task-contract.schema.json": "sha256:c806416d4944eaed6dc48b3760fd0dd5b9b5a7c9ab895697fe36b54c41c1332f",
-  "docs/naome/index.md": "sha256:75c4cdf9edcd46c83a619cbfc551e96cae35bcff694d955ebab4624125ae7f12",
+  "docs/naome/index.md": "sha256:d04691b25ed377c2a3aa2c56965d0db276539aeadcfdd2a2ec1be7ff7706dd6f",
   "docs/naome/first-run.md": "sha256:a1dd0bd17ec9d71955a473cd2c4a615538e89a7d81e8f4e1015a50ab9efe3558",
-  "docs/naome/agent-workflow.md": "sha256:5e5b26e7896f95a9154abcd133f08b33f84fddc679757ed15c043a91e319fb4e",
-  "docs/naome/execution.md": "sha256:3d67fd9922a66a66f79f920adbb24dcd47eefdfde835a5351a27ffed932dcfea",
-  "docs/naome/upgrade.md": "sha256:2c60f0441bbd98bd528d109b30a7ded4b0ad55d61ffb9f52edac9e93b7999cb1"
+  "docs/naome/agent-workflow.md": "sha256:43ba8a6814068e1b932b12a392de70b39841dc82df0acdaac459d6714c501b9d",
+  "docs/naome/execution.md": "sha256:ad66611b2878d1ba8fe05ddc4cfe9de7fd41de172a0de8295c36227a2700631a",
+  "docs/naome/upgrade.md": "sha256:2c60f0441bbd98bd528d109b30a7ded4b0ad55d61ffb9f52edac9e93b7999cb1",
+  ".naome/bin/naome-rust": "sha256:cc754ae59477577dfc0130cc21c286beaf3f19e2852278bb8f1e8724277eb44b"
 });
 
 function main() {

package/templates/naome-root/.naome/bin/check-task-state.js

@@ -9,17 +9,18 @@ const nativeBinaryRelativePath = process.platform === "win32" ? ".naome/bin/naom
 const nativeBinaryName = process.platform === "win32" ? "naome.exe" : "naome";
 
 const expectedMachineOwnedIntegrity = Object.freeze({
-  "AGENTS.md": "sha256:ebe589ce85b43d4aa23014d8a26a49bd33dc52ef1bba68e4f63a7e86640be06a",
+  "AGENTS.md": "sha256:84ce882fa6798a144c8c74673d4304fc6bf235b1cc417f7649eea9f7461775de",
   ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
-  ".naome/bin/naome.js": "sha256:1b63729dc55730a826193d35cf78e755a991b356ac81b45f4aa3fcf24c8152fa",
+  ".naome/bin/naome.js": "sha256:7894690ad47700a9a5e7ecb5a94ba42c1a12e2637d2c9f41f0023b1bd8bd22b6",
   ".naome/bin/check-task-state.js": "sha256:43c02868072d0d13499aefba2e9a5ec9517d59539fd19ff0f11e3e4623a51b44",
   ".naome/bin/check-harness-health.js": "sha256:dce2a380022dd63d86bd762869debafbc635ab3d7e8fae985e2d429d8ee437ad",
   ".naome/task-contract.schema.json": "sha256:c806416d4944eaed6dc48b3760fd0dd5b9b5a7c9ab895697fe36b54c41c1332f",
-  "docs/naome/index.md": "sha256:75c4cdf9edcd46c83a619cbfc551e96cae35bcff694d955ebab4624125ae7f12",
+  "docs/naome/index.md": "sha256:d04691b25ed377c2a3aa2c56965d0db276539aeadcfdd2a2ec1be7ff7706dd6f",
   "docs/naome/first-run.md": "sha256:a1dd0bd17ec9d71955a473cd2c4a615538e89a7d81e8f4e1015a50ab9efe3558",
-  "docs/naome/agent-workflow.md": "sha256:5e5b26e7896f95a9154abcd133f08b33f84fddc679757ed15c043a91e319fb4e",
-  "docs/naome/execution.md": "sha256:3d67fd9922a66a66f79f920adbb24dcd47eefdfde835a5351a27ffed932dcfea",
-  "docs/naome/upgrade.md": "sha256:2c60f0441bbd98bd528d109b30a7ded4b0ad55d61ffb9f52edac9e93b7999cb1"
+  "docs/naome/agent-workflow.md": "sha256:43ba8a6814068e1b932b12a392de70b39841dc82df0acdaac459d6714c501b9d",
+  "docs/naome/execution.md": "sha256:ad66611b2878d1ba8fe05ddc4cfe9de7fd41de172a0de8295c36227a2700631a",
+  "docs/naome/upgrade.md": "sha256:2c60f0441bbd98bd528d109b30a7ded4b0ad55d61ffb9f52edac9e93b7999cb1",
+  ".naome/bin/naome-rust": "sha256:cc754ae59477577dfc0130cc21c286beaf3f19e2852278bb8f1e8724277eb44b"
 });
 
 function main(argv) {

package/templates/naome-root/.naome/bin/naome.js

@@ -27,7 +27,7 @@ function main(argv) {
     return;
   }
 
-  if (command === "status" || command === "next") {
+  if (command === "status" || command === "next" || command === "intent" || command === "route" || command === "explain") {
     runNativeDecisionCommand(command, args);
     return;
   }
@@ -145,25 +145,92 @@ function commit(args) {
     fail("NAOME harness root not found. Run this inside a repository with .naome/task-state.json.");
   }
 
-  const message = parseCommitMessage(args) || defaultCommitMessage(root);
+  const message = parseCommitMessage(args);
   const taskState = readTaskState(root);
 
   if (taskState.status !== "complete") {
-    fail(`naome commit requires task-state status complete. Current status: ${taskState.status}.`);
+    const decision = readDecision(root);
+    if (isSetupBaselineDecision(decision)) {
+      commitBaseline(root, message || defaultSetupCommitMessage(decision), { taskScoped: false });
+      console.log(`NAOME committed ${decision.state} baseline.`);
+      return;
+    }
+
+    fail(`naome commit requires task-state status complete or a setup baseline diff. Current status: ${taskState.status}.`);
   }
 
-  runOrExit(root, [process.execPath, [join(root, ".naome", "bin", "check-task-state.js")]]);
+  const commitInfo = commitBaseline(root, message || defaultTaskCommitMessage(root), { taskScoped: true });
+  writeTaskJournal(root, "naome_commit_baseline", commitInfo);
+
+  console.log(`NAOME committed task ${taskState.activeTask?.id || "unknown"}.`);
+}
 
-  const changedPaths = readChangedPaths(root);
+function commitBaseline(root, message, options = {}) {
+  const changedPaths = options.taskScoped ? readTaskCommitPaths(root) : readChangedPaths(root);
   if (changedPaths.length === 0) {
     fail("Nothing to commit.");
   }
 
-  runGitOrExit(root, ["add", "-A", "--", "."]);
+  const before = gitHead(root);
+  runGitOrExit(root, ["add", "-A", "--", ...changedPaths]);
   runOrExit(root, [process.execPath, [join(root, ".naome", "bin", "check-task-state.js"), "--commit-gate"]]);
   runGitOrExit(root, ["commit", "-m", message]);
+  return { before, after: gitHead(root) };
+}
 
-  console.log(`NAOME committed task ${taskState.activeTask?.id || "unknown"}.`);
+function readTaskCommitPaths(root) {
+  const nativeBinary = resolveNativeDecisionBinary(root);
+  verifyNativeBinary(nativeBinary);
+  const result = spawnSync(nativeBinary, ["commit-paths", "--json"], {
+    cwd: root,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      NAOME_NODE_BIN: process.execPath
+    }
+  });
+  if (result.status !== 0) {
+    fail(`Cannot determine NAOME task commit paths: ${result.stderr.trim() || result.stdout.trim()}`);
+  }
+
+  try {
+    const paths = JSON.parse(result.stdout);
+    if (Array.isArray(paths) && paths.every((path) => typeof path === "string" && path.trim())) {
+      return paths;
+    }
+  } catch {
+    // Fall through to a deterministic failure.
+  }
+  fail("Cannot determine NAOME task commit paths: native output was not a path array.");
+}
+
+function writeTaskJournal(root, outcome, commitInfo) {
+  const nativeBinary = resolveNativeDecisionBinary(root);
+  verifyNativeBinary(nativeBinary);
+  const args = [
+    "journal-task",
+    "--outcome",
+    outcome,
+    "--json"
+  ];
+  if (commitInfo.before) {
+    args.push("--commit-before", commitInfo.before);
+  }
+  if (commitInfo.after) {
+    args.push("--commit-after", commitInfo.after);
+  }
+
+  const result = spawnSync(nativeBinary, args, {
+    cwd: root,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      NAOME_NODE_BIN: process.execPath
+    }
+  });
+  if (result.status !== 0) {
+    fail(`Cannot write NAOME task journal: ${result.stderr.trim() || result.stdout.trim()}`);
+  }
 }
 
 function parseCommitMessage(args) {
@@ -181,12 +248,48 @@ function parseCommitMessage(args) {
   return null;
 }
 
-function defaultCommitMessage(root) {
+function defaultTaskCommitMessage(root) {
   const taskState = readTaskState(root);
   const taskId = taskState.activeTask?.id || "task";
   return `chore(naome): baseline ${taskId}`;
 }
 
+function defaultSetupCommitMessage(decision) {
+  return decision.state === "harness_repair_unbaselined"
+    ? "chore(naome): baseline harness repair"
+    : "chore(naome): baseline setup";
+}
+
+function readDecision(root) {
+  const nativeBinary = resolveNativeDecisionBinary(root);
+  verifyNativeBinary(nativeBinary);
+  const result = spawnSync(nativeBinary, ["status", "--json"], {
+    cwd: root,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      NAOME_NODE_BIN: process.execPath
+    }
+  });
+
+  if (result.status !== 0) {
+    fail(`Cannot read NAOME status: ${result.stderr.trim() || result.stdout.trim()}`);
+  }
+
+  try {
+    return JSON.parse(result.stdout);
+  } catch (error) {
+    fail(`Cannot parse NAOME status: ${error.message}`);
+  }
+}
+
+function isSetupBaselineDecision(decision) {
+  return decision && (
+    decision.state === "install_or_upgrade_unbaselined" ||
+    decision.state === "harness_repair_unbaselined"
+  );
+}
+
 function readTaskState(root) {
   const taskStatePath = join(root, ".naome", "task-state.json");
   try {
@@ -197,12 +300,25 @@ function readTaskState(root) {
 }
 
 function readChangedPaths(root) {
-  const result = runGit(root, ["status", "--porcelain"]);
-  if (result.status !== 0) {
-    fail(`git status failed: ${result.stderr.trim() || result.stdout.trim()}`);
+  const paths = new Set();
+  for (const args of [
+    ["diff", "--name-only", "-z"],
+    ["diff", "--name-only", "--cached", "-z"],
+    ["ls-files", "--others", "--exclude-standard", "-z"]
+  ]) {
+    const result = runGit(root, args);
+    if (result.status !== 0) {
+      fail(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim()}`);
+    }
+    for (const path of result.stdout.split("\0")) {
+      const normalized = path.trim();
+      if (normalized) {
+        paths.add(normalized);
+      }
+    }
   }
 
-  return result.stdout.split(/\r?\n/).filter((line) => line.trim().length > 0);
+  return Array.from(paths).sort();
 }
 
 function runOrExit(root, command) {
@@ -233,6 +349,14 @@ function runGit(root, args, options = {}) {
   });
 }
 
+function gitHead(root) {
+  const result = runGit(root, ["rev-parse", "HEAD"]);
+  if (result.status !== 0) {
+    return null;
+  }
+  return result.stdout.trim();
+}
+
 function findHarnessRoot(startPath) {
   let current = resolve(startPath);
 
@@ -254,6 +378,12 @@ function printHelp() {
   console.log("Usage:");
   console.log("  naome status [--json]");
   console.log("  naome next [--json]");
+  console.log("  naome intent --prompt-file <path> [--json]");
+  console.log("  naome intent --prompt <text> [--json]");
+  console.log("  naome route --prompt-file <path> [--execute] [--json]");
+  console.log("  naome route --prompt <text> [--execute] [--json]");
+  console.log("  naome explain --prompt-file <path> [--json]");
+  console.log("  naome explain --prompt <text> [--json]");
   console.log("  naome install");
   console.log("  naome sync");
   console.log("  naome commit -m \"type(scope): message\"");
@@ -290,7 +420,7 @@ function installOrSync(command, args) {
     process.exit(result.status === null ? 1 : result.status);
   }
 
-  const result = spawnSync("npm", ["create", "naome"], {
+  const result = spawnSync("npm", ["exec", "--yes", "@lamentis/naome", "--", command, ...args], {
     cwd: root,
     encoding: "utf8",
     stdio: "inherit"

package/templates/naome-root/.naome/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "naome",
-  "harnessVersion": "1.0.2",
+  "harnessVersion": "1.1.0",
   "profile": "standard",
   "installedAt": null,
   "machineOwned": [
@@ -30,16 +30,17 @@
     "docs/naome/testing.md"
   ],
   "integrity": {
-    "AGENTS.md": "sha256:ebe589ce85b43d4aa23014d8a26a49bd33dc52ef1bba68e4f63a7e86640be06a",
+    "AGENTS.md": "sha256:84ce882fa6798a144c8c74673d4304fc6bf235b1cc417f7649eea9f7461775de",
     ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
-    ".naome/bin/naome.js": "sha256:1b63729dc55730a826193d35cf78e755a991b356ac81b45f4aa3fcf24c8152fa",
+    ".naome/bin/naome.js": "sha256:7894690ad47700a9a5e7ecb5a94ba42c1a12e2637d2c9f41f0023b1bd8bd22b6",
     ".naome/bin/check-task-state.js": "sha256:43c02868072d0d13499aefba2e9a5ec9517d59539fd19ff0f11e3e4623a51b44",
     ".naome/bin/check-harness-health.js": "sha256:dce2a380022dd63d86bd762869debafbc635ab3d7e8fae985e2d429d8ee437ad",
     ".naome/task-contract.schema.json": "sha256:c806416d4944eaed6dc48b3760fd0dd5b9b5a7c9ab895697fe36b54c41c1332f",
-    "docs/naome/index.md": "sha256:75c4cdf9edcd46c83a619cbfc551e96cae35bcff694d955ebab4624125ae7f12",
+    "docs/naome/index.md": "sha256:d04691b25ed377c2a3aa2c56965d0db276539aeadcfdd2a2ec1be7ff7706dd6f",
     "docs/naome/first-run.md": "sha256:a1dd0bd17ec9d71955a473cd2c4a615538e89a7d81e8f4e1015a50ab9efe3558",
-    "docs/naome/agent-workflow.md": "sha256:5e5b26e7896f95a9154abcd133f08b33f84fddc679757ed15c043a91e319fb4e",
-    "docs/naome/execution.md": "sha256:3d67fd9922a66a66f79f920adbb24dcd47eefdfde835a5351a27ffed932dcfea",
-    "docs/naome/upgrade.md": "sha256:2c60f0441bbd98bd528d109b30a7ded4b0ad55d61ffb9f52edac9e93b7999cb1"
+    "docs/naome/agent-workflow.md": "sha256:43ba8a6814068e1b932b12a392de70b39841dc82df0acdaac459d6714c501b9d",
+    "docs/naome/execution.md": "sha256:ad66611b2878d1ba8fe05ddc4cfe9de7fd41de172a0de8295c36227a2700631a",
+    "docs/naome/upgrade.md": "sha256:2c60f0441bbd98bd528d109b30a7ded4b0ad55d61ffb9f52edac9e93b7999cb1",
+    ".naome/bin/naome-rust": "sha256:cc754ae59477577dfc0130cc21c286beaf3f19e2852278bb8f1e8724277eb44b"
   }
 }

package/templates/naome-root/.naome/upgrade-state.json

@@ -1,7 +1,7 @@
 {
   "status": "complete",
   "fromVersion": null,
-  "toVersion": "1.0.2",
+  "toVersion": "1.1.0",
   "pending": [],
   "completed": []
 }

package/templates/naome-root/AGENTS.md

@@ -8,16 +8,16 @@ This repository uses NAOME as its coding-agent harness.
 2. Do not read any file or directory matched by `.naomeignore`.
 3. If `docs/naome/index.md` or `.naome/bin/check-harness-health.js` is missing,
    do not begin feature work. Install the NAOME CLI with
-   `npm install -g @lamentis/naome`, then run `naome sync` from the repository root. Then
-   restart this list.
+   `npm install -g @lamentis/naome`, then run `naome sync --check-update`
+   from the repository root. Then restart this list.
 4. Read `docs/naome/index.md`.
 5. Read `.naome/init-state.json`.
 6. Read `.naome/task-state.json`.
 7. Read `.naome/upgrade-state.json`.
 8. Run `node .naome/bin/check-harness-health.js`.
 9. If harness health fails, do not begin feature work. Repair the machine-owned
-   harness files with `naome sync`, or ask the user for one of the listed
-   repair decisions.
+   harness files with `naome update` followed by `naome sync`, or ask the user
+   for one of the listed repair decisions.
 10. If upgrade status is `needs_agent_upgrade`, do not begin feature work. Run
    or continue `docs/naome/upgrade.md`.
 11. If `initialized` is `false`, do not begin feature work. Run or continue the
@@ -30,15 +30,40 @@ This repository uses NAOME as its coding-agent harness.
 ## Core Rules
 
 - Prefer discovered repository facts over assumptions.
+- Do not look for generic root steering files such as `ARCHITECTURE.md` or
+  `docs/index.md` unless this repository's NAOME docs explicitly name them.
+  NAOME's default architecture and index files are
+  `docs/naome/architecture.md` and `docs/naome/index.md`.
 - Record only facts from this target repository or from the user. Do not import
   parent-workspace, outer-agent, chat, or unrelated repository instructions into
   this repository's NAOME docs.
 - Keep changes small and task-focused.
 - Read only the NAOME docs relevant to the current task.
 - Run Harness Health before Task Admission.
+- For natural-language work requests, prefer
+  `naome route --prompt-file <path> --execute --json` and follow its
+  `userMessage`, `humanOptions`, `requiredContext`, `taskRoot`, `worktree`, and
+  `canCreateTask` fields. If `taskRoot` differs from the current directory,
+  continue the task in `taskRoot`; the original worktree contains unrelated user
+  edits that must remain untouched. Pure deterministic harness refresh diffs
+  are baselined in the current worktree before task creation; they must not
+  create repair-loop task worktrees. Use `naome explain --prompt-file <path>
+  --json` only for debugging policy.
+- If route blocks or performs no mutation, do not fall back to raw `git commit`,
+  IDE commit, `git add`, or hook bypass commands. Only execute a commit when
+  NAOME route/commit performs it successfully or the user takes manual Git
+  ownership outside the agent task.
+- If the user explicitly asks to commit their own unowned changes, use NAOME
+  route so the configured quality gate runs first. NAOME commits only the exact
+  paths it evaluated, requires committed verification coverage for every path,
+  and rechecks the final stabilized diff before creating the commit.
+- Repair requests may baseline deterministic harness refresh files, but they
+  must leave unrelated user edits untouched unless the user explicitly takes
+  manual Git ownership.
 - Machine-owned NAOME command shims, schemas, workflow docs, archives, and
   native binaries may be local-only ignored files. Missing local-only files are
-  repaired with `naome sync`; they are not project context.
+  repaired with `naome update` followed by `naome sync`; they are not project
+  context.
 - Enforce Task Admission before accepting new feature work.
 - Do not start feature work while the git diff contains setup, upgrade,
   previous-task, or other unowned changes.

package/templates/naome-root/docs/naome/agent-workflow.md

@@ -5,29 +5,44 @@ Use this workflow after first-run intake is complete.
 ## Before Editing
 
 1. Read `.naome/task-state.json` and `execution.md`.
-2. Run `node .naome/bin/naome.js status` and use its allowed actions as the
-   current machine-generated decision.
-3. Run `node .naome/bin/check-harness-health.js`.
-4. If harness health fails, do not start new feature work. Ask the user to
+2. For a natural-language user request, prefer
+   `node .naome/bin/naome.js route --prompt-file <path> --execute --json`.
+   Use its `userMessage`, `humanOptions`, `requiredContext`, and
+   `canCreateTask` fields instead of inventing routing or final-response text.
+   If route returns a `taskRoot` different from the current directory, continue
+   the task from that path and leave the original worktree untouched.
+3. Use `node .naome/bin/naome.js explain --prompt-file <path> --json` only when
+   debugging why a policy won.
+4. Run `node .naome/bin/naome.js status --json` when reporting state without
+   routing a new request.
+5. Run `node .naome/bin/check-harness-health.js`.
+6. If harness health fails, do not start new feature work. Ask the user to
    choose `repair_harness`, `review_harness_diff`, or
    `cancel_repair_baseline`.
-5. Run `node .naome/bin/check-task-state.js --admission`.
-6. If task admission fails, do not start new feature work.
-   When the block is completed NAOME install or upgrade changes, ask the user
-   to choose `commit_upgrade_baseline`, `review_diff_first`, or
-   `cancel_upgrade_baseline`.
-   When the block is a completed task diff, ask the user to choose
-   `commit_task_baseline`, `review_task_diff`, `request_task_changes`, or
-   `cancel_task_changes`.
-7. Record the passed admission check in `.naome/task-state.json` when starting
+7. Run `node .naome/bin/check-task-state.js --admission`.
+8. If task admission fails for a natural-language work request, use
+   `naome route --execute --json`. Route may baseline valid completed setup or
+   task diffs, create an isolated task worktree around unrelated user edits,
+   baseline pure harness refreshes in the current worktree, and rerun
+   admission. Ask the user only when `humanOptions` is non-empty,
+   route blocks as unsafe/ambiguous, or automatic baselining fails.
+9. If route blocks or returns no mutation, do not use raw `git commit`, IDE
+   commit, `git add`, or hook bypass commands as a fallback. Unowned changes
+   are user-owned unless NAOME route explicitly isolates around them or
+   baselines a deterministic harness/task diff. If the user explicitly asks to
+   commit their own unowned changes, route must run the configured quality gate
+   first, require committed verification coverage for every path, and commit
+   only the final stabilized paths it evaluated.
+10. Record the passed admission check in `.naome/task-state.json` when starting
    the task.
-8. Restate the task in concrete terms.
-9. Read `.naomeignore`.
-10. Exclude every path matched by `.naomeignore` from context gathering.
-11. Read the task-relevant NAOME docs.
-12. Inspect the existing code or docs before proposing changes.
-13. Read `testing.md` and `.naome/verification.json`.
-14. Identify the required proof before claiming success.
+11. Restate the task in concrete terms.
+12. Read `.naomeignore`.
+13. Exclude every path matched by `.naomeignore` from context gathering.
+14. Read only the `requiredContext` returned by route/status plus the smallest
+    task-relevant NAOME docs.
+15. Inspect the existing code or docs before proposing changes.
+16. Read `testing.md` and `.naome/verification.json`.
+17. Identify the required proof before claiming success.
 
 ## Instruction Boundaries
 
@@ -62,19 +77,25 @@ Use this workflow after first-run intake is complete.
 5. Do not list `.naome/task-state.json` as task scope or proof evidence.
 6. Set task state to `complete`.
 7. Run `node .naome/bin/check-task-state.js`.
-8. If the task-state check prints a next-task admission notice, report it to
-   the user with the exact listed options.
+8. If the task-state check prints a next-task admission notice, do not repeat
+   internal baseline options in the final response. Use the machine-generated
+   `userMessage` from route/status and mention `humanOptions` only when that
+   array is non-empty.
 9. If no rule matches or the task check fails, report the gap and ask for human
    review before claiming completion.
 10. Report changed files, exact commands, results, and remaining risk.
-11. Do not say there are no open gaps while the completed task diff still needs
-    a user baseline decision.
+11. Only ask the user for options when intent blocks, the user explicitly asks
+    to review/revise/cancel, or automatic baselining fails.
 
 ## Commit And Push
 
 - Prefer `naome commit -m "type(scope): summary"` for task baselines.
 - If `naome` is not on `PATH`, run
   `node .naome/bin/naome.js commit -m "type(scope): summary"`.
+- Never treat a blocked NAOME route as permission to run plain `git commit`.
+  A commit fallback is valid only when NAOME itself executed it successfully or
+  when the user explicitly leaves NAOME automation and owns the manual Git
+  action.
 - Manual `git commit` and IDE commits are guarded by local `.git/hooks` shims,
   but agents must still reconcile Git state because hooks can be bypassed.
 - If a user already committed the diff, compare current `HEAD`, task proof, and