@lamentis/naome 1.1.0 → 1.1.1

package/Cargo.lock

@@ -76,7 +76,7 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "naome-cli"
-version = "1.1.0"
+version = "1.1.1"
 dependencies = [
  "naome-core",
  "serde_json",
@@ -84,7 +84,7 @@ dependencies = [
 
 [[package]]
 name = "naome-core"
-version = "1.1.0"
+version = "1.1.1"
 dependencies = [
  "serde",
  "serde_json",

package/bin/naome-node.js

@@ -513,6 +513,7 @@ async function runFreshInstall() {
   patchInstalledMachineOwnedIntegrity();
   ensureBuiltInVerificationChecks();
   patchManifestDate();
+  ensureCompleteUpgradeState(null);
   ensureArchiveDirectory();
   takeoverExistingAgents();
   ensureLocalOnlySourceControlBoundary();

package/crates/naome-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-cli"
-version = "1.1.0"
+version = "1.1.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/crates/naome-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-core"
-version = "1.1.0"
+version = "1.1.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/crates/naome-core/src/route.rs

@@ -109,13 +109,19 @@ pub fn evaluate_route(
                         .to_string();
             }
             "auto_commit_completed_task_then_create_isolated_task_worktree" => {
-                let before = git_head(root)?;
+                let worktree_name_head = task_worktree_name_head(root)?;
+                preflight_isolated_task_worktree(root, prompt, &worktree_name_head)?;
+                let before = Some(worktree_name_head.clone());
                 git_add_completed_task_paths(root)?;
                 git_commit(root, "chore(naome): baseline completed task")?;
                 let after = git_head(root)?;
                 journal_entry =
                     append_task_journal(root, "route_auto_baseline", before, after.clone())?;
-                let created = create_isolated_task_worktree(root, prompt)?;
+                let created = create_isolated_task_worktree_with_name_head(
+                    root,
+                    prompt,
+                    &worktree_name_head,
+                )?;
                 task_root = PathBuf::from(&created.path);
                 mutation_performed = true;
                 executed_actions.push("commit_task_baseline".to_string());
@@ -147,6 +153,8 @@ pub fn evaluate_route(
                 user_message = "NAOME baselined the harness refresh and completed task, then admitted the next task.".to_string();
             }
             "auto_commit_harness_refresh_then_create_isolated_task_worktree" => {
+                let worktree_name_head = task_worktree_name_head(root)?;
+                preflight_isolated_task_worktree(root, prompt, &worktree_name_head)?;
                 let Some(split) = harness_refresh_with_unrelated_diff(root)? else {
                     return Err(NaomeError::new(
                         "Unable to split harness refresh paths from unrelated dirty paths.",
@@ -154,7 +162,11 @@ pub fn evaluate_route(
                 };
                 git_stage_only_paths(root, &split.harness_paths)?;
                 git_commit(root, "chore(naome): baseline harness refresh")?;
-                let created = create_isolated_task_worktree(root, prompt)?;
+                let created = create_isolated_task_worktree_with_name_head(
+                    root,
+                    prompt,
+                    &worktree_name_head,
+                )?;
                 task_root = PathBuf::from(&created.path);
                 mutation_performed = true;
                 executed_actions.push("commit_harness_refresh_baseline".to_string());
@@ -848,10 +860,19 @@ fn git_commit(root: &Path, message: &str) -> Result<(), NaomeError> {
 }
 
 fn create_isolated_task_worktree(root: &Path, prompt: &str) -> Result<RouteWorktree, NaomeError> {
+    let name_head = task_worktree_name_head(root)?;
+    create_isolated_task_worktree_with_name_head(root, prompt, &name_head)
+}
+
+fn create_isolated_task_worktree_with_name_head(
+    root: &Path,
+    prompt: &str,
+    name_head: &str,
+) -> Result<RouteWorktree, NaomeError> {
     let base_head = git_head(root)?.ok_or_else(|| {
         NaomeError::new("Cannot create task worktree because the repository has no HEAD.")
     })?;
-    let short_head = base_head.chars().take(12).collect::<String>();
+    let short_head = name_head.chars().take(12).collect::<String>();
     let slug = prompt_slug(prompt);
     let common_git_dir = git_common_dir(root)?;
     let worktree_base = common_git_dir.join("naome").join("worktrees");
@@ -900,6 +921,48 @@ fn create_isolated_task_worktree(root: &Path, prompt: &str) -> Result<RouteWorkt
     ))
 }
 
+fn preflight_isolated_task_worktree(
+    root: &Path,
+    prompt: &str,
+    name_head: &str,
+) -> Result<(), NaomeError> {
+    let short_head = name_head.chars().take(12).collect::<String>();
+    let slug = prompt_slug(prompt);
+    let common_git_dir = git_common_dir(root)?;
+    let worktree_base = common_git_dir.join("naome").join("worktrees");
+    fs::create_dir_all(&worktree_base)?;
+    let worktree_count = existing_naome_task_worktree_count(&worktree_base)?;
+    if worktree_count >= MAX_NAOME_TASK_WORKTREES {
+        return Err(NaomeError::new(format!(
+            "Too many NAOME task worktrees are present ({worktree_count}). Finish or remove old task worktrees before creating another isolated task worktree."
+        )));
+    }
+
+    for attempt in 1..100 {
+        let suffix = if attempt == 1 {
+            String::new()
+        } else {
+            format!("-{attempt}")
+        };
+        let name = format!("{slug}-{short_head}{suffix}");
+        let branch = format!("naome/task/{name}");
+        let path = worktree_base.join(&name);
+        if !path.exists() && !git_branch_exists(root, &branch)? {
+            return Ok(());
+        }
+    }
+
+    Err(NaomeError::new(
+        "Cannot create a unique NAOME task worktree after 99 attempts.",
+    ))
+}
+
+fn task_worktree_name_head(root: &Path) -> Result<String, NaomeError> {
+    git_head(root)?.ok_or_else(|| {
+        NaomeError::new("Cannot create task worktree because the repository has no HEAD.")
+    })
+}
+
 fn existing_naome_task_worktree_count(worktree_base: &Path) -> Result<usize, NaomeError> {
     let mut count = 0;
     for entry in fs::read_dir(worktree_base)? {

package/crates/naome-core/src/task_state.rs

@@ -1469,10 +1469,10 @@ fn validate_commit_gate(
         .get("status")
         .and_then(Value::as_str)
         .unwrap_or("invalid");
-    if status == "complete" && completed_task_harness_refresh_diff(root)?.is_some() {
-        if is_safe_harness_refresh_diff(&changed_paths) {
-            return Ok(());
-        }
+    if status == "complete" && is_deterministic_harness_refresh_diff(&changed_paths) {
+        validate_pending_upgrade(task_state, root, errors)?;
+        validate_completed_task_for_harness_refresh(task_state, root, &staged_entries, errors)?;
+        return Ok(());
     }
 
     if status == "complete" {
@@ -1525,6 +1525,49 @@ fn validate_commit_gate(
     Ok(())
 }
 
+fn validate_completed_task_for_harness_refresh(
+    task_state: &Value,
+    root: &Path,
+    staged_entries: &[ChangedEntry],
+    errors: &mut Vec<String>,
+) -> Result<(), NaomeError> {
+    validate_active_task(task_state.get("activeTask"), errors);
+    validate_active_task_references(task_state.get("activeTask"), root, errors, Some("complete"))?;
+    if !task_state.get("blocker").is_some_and(Value::is_null) {
+        errors.push("complete task state must have blocker set to null.".to_string());
+    }
+
+    let Some(active_task) = task_state.get("activeTask") else {
+        return Ok(());
+    };
+
+    let check_ids = read_verification_check_ids(root, errors)?;
+    validate_required_check_ids(active_task, &check_ids, errors);
+
+    let mut validation_errors = Vec::new();
+    validate_complete_task_against_entries(
+        active_task,
+        root,
+        &check_ids,
+        staged_entries,
+        &mut validation_errors,
+    )?;
+
+    let staged_harness_paths = task_diff_from_entries(active_task, staged_entries).outside_paths;
+    let allowed_scope_error = format!(
+        "Changed files outside allowedPaths: {}",
+        staged_harness_paths.join(", ")
+    );
+
+    errors.extend(
+        validation_errors
+            .into_iter()
+            .filter(|error| error != &allowed_scope_error),
+    );
+
+    Ok(())
+}
+
 fn validate_push_gate(task_state: &Value, errors: &mut Vec<String>) {
     let status = task_state
         .get("status")
@@ -1598,8 +1641,11 @@ fn is_safe_harness_refresh_path(path: &str) -> bool {
     is_packaged_machine_owned_path(path) || is_repair_support_path(path)
 }
 
-fn is_safe_harness_refresh_diff(changed_paths: &[String]) -> bool {
+fn is_deterministic_harness_refresh_diff(changed_paths: &[String]) -> bool {
     !changed_paths.is_empty()
+        && changed_paths
+            .iter()
+            .any(|path| is_packaged_machine_owned_path(path) || is_repair_archive_path(path))
         && changed_paths
             .iter()
             .all(|path| is_safe_harness_refresh_path(path))

package/crates/naome-core/tests/route.rs

@@ -662,6 +662,57 @@ fn execute_route_refuses_to_create_more_than_max_isolated_worktrees() {
         .contains("Too many NAOME task worktrees are present"));
 }
 
+#[test]
+fn execute_route_preflights_worktree_before_completed_task_baseline() {
+    let repo =
+        TestRepo::completed_task_with_unrelated_user_edit("route-completed-worktree-preflight");
+    let before_head = repo.git_stdout(&["rev-parse", "HEAD"]);
+    let before_status = repo.git_status_short();
+    let common_dir = repo.git_stdout(&["rev-parse", "--git-common-dir"]);
+    let worktree_root = repo.path().join(common_dir).join("naome").join("worktrees");
+    fs::create_dir_all(&worktree_root).unwrap();
+    for index in 0..25 {
+        fs::create_dir_all(worktree_root.join(format!("stale-{index}"))).unwrap();
+    }
+
+    let error = evaluate_route(
+        repo.path(),
+        "Add another line to README as a new task.",
+        RouteOptions {
+            execute: true,
+            evaluation: EvaluationOptions::offline(),
+        },
+    )
+    .unwrap_err();
+
+    assert!(error
+        .to_string()
+        .contains("Too many NAOME task worktrees are present"));
+    assert_eq!(repo.git_stdout(&["rev-parse", "HEAD"]), before_head);
+    assert_eq!(repo.git_status_short(), before_status);
+}
+
+#[test]
+fn execute_route_uses_preflighted_worktree_name_after_completed_task_baseline() {
+    let repo = TestRepo::completed_task_with_unrelated_user_edit("route-worktree-name-preflight");
+    let before_head = repo.git_stdout(&["rev-parse", "HEAD"]);
+    let before_short = &before_head[..12];
+
+    let route = evaluate_route(
+        repo.path(),
+        "Add another line to README as a new task.",
+        RouteOptions {
+            execute: true,
+            evaluation: EvaluationOptions::offline(),
+        },
+    )
+    .unwrap();
+
+    let worktree = route.worktree.expect("route should create a worktree");
+    assert!(worktree.branch.contains(before_short));
+    assert!(worktree.path.contains(before_short));
+}
+
 #[test]
 fn dry_route_plans_harness_refresh_split_before_completed_task_baseline() {
     let repo = TestRepo::completed_task_with_harness_refresh_diff("route-dry-harness-refresh");

package/crates/naome-core/tests/task_state.rs

@@ -222,6 +222,146 @@ fn commit_gate_allows_staged_harness_refresh_split_from_completed_task() {
     assert!(report.errors.is_empty(), "{:#?}", report.errors);
 }
 
+#[test]
+fn commit_gate_allows_staged_harness_refresh_after_completed_task_is_baselined() {
+    let repo = TaskFixture::new(complete_task_state(json!({
+        "allowedPaths": ["README.md"],
+        "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))]
+    })));
+    repo.install_healthy_harness();
+    repo.write("README.md", "# Completed task result\n");
+    repo.init_git();
+    repo.write("AGENTS.md", "# Agent Instructions\n\nUpdated by sync.\n");
+    repo.write_json(
+        ".naome/manifest.json",
+        json!({
+            "name": "naome",
+            "harnessVersion": "1.1.1",
+            "profile": "standard",
+            "machineOwned": MACHINE_OWNED_PATHS,
+            "projectOwned": PROJECT_OWNED_PATHS,
+            "integrity": {}
+        }),
+    );
+    repo.git(["add", "AGENTS.md", ".naome/manifest.json"]);
+
+    let report = validate_task_state(
+        repo.path(),
+        TaskStateOptions {
+            mode: TaskStateMode::CommitGate,
+            ..TaskStateOptions::default()
+        },
+    )
+    .unwrap();
+
+    assert!(report.errors.is_empty(), "{:#?}", report.errors);
+}
+
+#[test]
+fn commit_gate_rejects_harness_refresh_when_completed_task_proof_is_missing() {
+    let repo = TaskFixture::new(complete_task_state(json!({
+        "allowedPaths": ["README.md"],
+        "proofResults": []
+    })));
+    repo.install_healthy_harness();
+    repo.write("README.md", "# Completed task result\n");
+    repo.init_git();
+    repo.write("AGENTS.md", "# Agent Instructions\n\nUpdated by sync.\n");
+    repo.git(["add", "AGENTS.md"]);
+
+    let report = validate_task_state(
+        repo.path(),
+        TaskStateOptions {
+            mode: TaskStateMode::CommitGate,
+            ..TaskStateOptions::default()
+        },
+    )
+    .unwrap();
+
+    assert!(
+        report
+            .errors
+            .iter()
+            .any(|error| error.contains("activeTask.proofResults missing proof result: diff-check")),
+        "{:#?}",
+        report.errors
+    );
+}
+
+#[test]
+fn commit_gate_rejects_harness_refresh_with_pending_upgrade_state() {
+    let repo = TaskFixture::new(complete_task_state(json!({
+        "allowedPaths": ["README.md"],
+        "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))]
+    })));
+    repo.install_healthy_harness();
+    repo.write("README.md", "# Completed task result\n");
+    repo.init_git();
+    repo.write("AGENTS.md", "# Agent Instructions\n\nUpdated by sync.\n");
+    repo.write_json(
+        ".naome/upgrade-state.json",
+        json!({
+            "status": "needs_agent_upgrade",
+            "fromVersion": "1.1.0",
+            "toVersion": "1.1.1",
+            "pending": ["manual-step"],
+            "completed": []
+        }),
+    );
+    repo.git(["add", "AGENTS.md", ".naome/upgrade-state.json"]);
+
+    let report = validate_task_state(
+        repo.path(),
+        TaskStateOptions {
+            mode: TaskStateMode::CommitGate,
+            ..TaskStateOptions::default()
+        },
+    )
+    .unwrap();
+
+    assert!(
+        report
+            .errors
+            .iter()
+            .any(|error| error.contains("NAOME upgrade is pending")),
+        "{:#?}",
+        report.errors
+    );
+}
+
+#[test]
+fn commit_gate_rejects_support_only_harness_refresh_after_completed_task_is_baselined() {
+    let repo = TaskFixture::new(complete_task_state(json!({
+        "allowedPaths": ["README.md"],
+        "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))]
+    })));
+    repo.install_healthy_harness();
+    repo.write("README.md", "# Completed task result\n");
+    repo.init_git();
+    repo.write_json(
+        ".naome/upgrade-state.json",
+        json!({
+            "status": "complete",
+            "fromVersion": null,
+            "toVersion": "1.1.1",
+            "pending": [],
+            "completed": []
+        }),
+    );
+    repo.git(["add", ".naome/upgrade-state.json"]);
+
+    let report = validate_task_state(
+        repo.path(),
+        TaskStateOptions {
+            mode: TaskStateMode::CommitGate,
+            ..TaskStateOptions::default()
+        },
+    )
+    .unwrap();
+
+    assert!(!report.errors.is_empty(), "{:#?}", report.errors);
+}
+
 #[test]
 fn commit_gate_ignores_unstaged_user_edits_outside_completed_task_scope() {
     let repo = TaskFixture::new(complete_task_state(json!({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "MIT",
   "type": "module",

package/templates/naome-root/.naome/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "naome",
-  "harnessVersion": "1.1.0",
+  "harnessVersion": "1.1.1",
   "profile": "standard",
   "installedAt": null,
   "machineOwned": [

package/templates/naome-root/.naome/upgrade-state.json

@@ -1,7 +1,7 @@
 {
   "status": "complete",
   "fromVersion": null,
-  "toVersion": "1.1.0",
+  "toVersion": "1.1.1",
   "pending": [],
   "completed": []
 }