@lamentis/naome 1.2.0 → 1.2.1

package/crates/naome-core/src/route.rs

@@ -1,25 +1,32 @@
-use std::collections::{BTreeSet, HashMap};
-use std::fs;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-use serde::Serialize;
-use serde_json::Value;
+use std::path::Path;
 
 use crate::decision::{evaluate_decision, EvaluationOptions};
-use crate::git;
-use crate::harness_health::{validate_harness_health, HarnessHealthOptions};
-use crate::install_plan::{LOCAL_NATIVE_BINARY_PATHS, LOCAL_ONLY_MACHINE_OWNED_PATHS};
 use crate::intent::{evaluate_intent, IntentDecision};
-use crate::journal::{append_task_journal, TaskJournalEntry};
+use crate::journal::TaskJournalEntry;
 use crate::models::{Decision, NaomeError};
-use crate::paths;
-use crate::quality::{check_repository_quality, QualityMode};
-use crate::task_state::{
-    completed_task_commit_paths, completed_task_harness_refresh_diff, harness_refresh_diff,
-    harness_refresh_with_unrelated_diff, validate_task_state, TaskStateMode, TaskStateOptions,
+use serde::Serialize;
+mod builtin_checks;
+mod builtin_context;
+mod builtin_integrity;
+mod builtin_require;
+mod context;
+mod execution;
+mod execution_baselines;
+mod execution_support;
+mod execution_tasks;
+mod git_ops;
+mod quality_gate;
+mod quality_gate_config;
+mod quality_gate_snapshot;
+mod worktree;
+mod worktree_files;
+mod worktree_plan;
+
+use self::context::{
+    can_create_task, discarded_actions, required_context_for_intent, required_context_for_route,
+    winning_rule, would_mutate,
 };
-use crate::verification_contract::validate_verification_contract;
+use self::execution::{execute_route_policy, RouteExecution};
 
 const MAX_NAOME_TASK_WORKTREES: usize = 25;
 
@@ -87,219 +94,27 @@ pub fn evaluate_route(
     let initial_decision = evaluate_decision(root, options.evaluation)?;
     let intent = evaluate_intent(root, prompt, options.evaluation)?;
     let repo_state_before = intent.repo_state.clone();
-    let mut mutation_performed = false;
-    let mut executed_actions = Vec::new();
-    let mut journal_entry = None;
-    let mut user_message = intent.user_message.clone();
-    let mut task_root = root.to_path_buf();
-    let mut worktree = None;
-    let mut route_allowed = intent.allowed;
-    let mut human_options = intent.human_options.clone();
-
+    let mut execution = RouteExecution::from_intent(root, &intent);
     if options.execute {
-        match intent.policy_action.as_str() {
-            "auto_commit_completed_task_then_create_new_task" => {
-                let before = git_head(root)?;
-                git_add_completed_task_paths(root)?;
-                git_commit(root, "chore(naome): baseline completed task")?;
-                let after = git_head(root)?;
-                journal_entry =
-                    append_task_journal(root, "route_auto_baseline", before, after.clone())?;
-                mutation_performed = true;
-                executed_actions.push("commit_task_baseline".to_string());
-                user_message =
-                    "NAOME baselined the completed task and is ready to create the next task."
-                        .to_string();
-            }
-            "auto_commit_completed_task_then_create_isolated_task_worktree" => {
-                let worktree_name_head = task_worktree_name_head(root)?;
-                preflight_isolated_task_worktree(root, prompt, &worktree_name_head)?;
-                let before = Some(worktree_name_head.clone());
-                git_add_completed_task_paths(root)?;
-                git_commit(root, "chore(naome): baseline completed task")?;
-                let after = git_head(root)?;
-                journal_entry =
-                    append_task_journal(root, "route_auto_baseline", before, after.clone())?;
-                let created = create_isolated_task_worktree_with_name_head(
-                    root,
-                    prompt,
-                    &worktree_name_head,
-                )?;
-                task_root = PathBuf::from(&created.path);
-                mutation_performed = true;
-                executed_actions.push("commit_task_baseline".to_string());
-                executed_actions.push("create_task_worktree".to_string());
-                user_message = format!(
-                    "NAOME baselined the completed task and created an isolated task worktree at {}. Continue the new task there; unrelated user edits remain untouched in the original worktree.",
-                    created.path
-                );
-                worktree = Some(created);
-            }
-            "auto_commit_harness_refresh_then_completed_task_then_create_new_task" => {
-                let Some(split) = completed_task_harness_refresh_diff(root)? else {
-                    return Err(NaomeError::new(
-                        "Unable to split harness refresh paths from completed task diff.",
-                    ));
-                };
-                git_stage_only_paths(root, &split.harness_paths)?;
-                git_commit(root, "chore(naome): baseline harness refresh")?;
-                executed_actions.push("commit_harness_refresh_baseline".to_string());
-
-                let before = git_head(root)?;
-                git_add_completed_task_paths(root)?;
-                git_commit(root, "chore(naome): baseline completed task")?;
-                let after = git_head(root)?;
-                journal_entry =
-                    append_task_journal(root, "route_auto_baseline", before, after.clone())?;
-                mutation_performed = true;
-                executed_actions.push("commit_task_baseline".to_string());
-                user_message = "NAOME baselined the harness refresh and completed task, then admitted the next task.".to_string();
-            }
-            "auto_commit_harness_refresh_then_create_isolated_task_worktree" => {
-                let worktree_name_head = task_worktree_name_head(root)?;
-                preflight_isolated_task_worktree(root, prompt, &worktree_name_head)?;
-                let Some(split) = harness_refresh_with_unrelated_diff(root)? else {
-                    return Err(NaomeError::new(
-                        "Unable to split harness refresh paths from unrelated dirty paths.",
-                    ));
-                };
-                git_stage_only_paths(root, &split.harness_paths)?;
-                git_commit(root, "chore(naome): baseline harness refresh")?;
-                let created = create_isolated_task_worktree_with_name_head(
-                    root,
-                    prompt,
-                    &worktree_name_head,
-                )?;
-                task_root = PathBuf::from(&created.path);
-                mutation_performed = true;
-                executed_actions.push("commit_harness_refresh_baseline".to_string());
-                executed_actions.push("create_task_worktree".to_string());
-                user_message = format!(
-                    "NAOME baselined the harness refresh and created an isolated task worktree at {}. Continue the new task there; unrelated user edits remain untouched in the original worktree.",
-                    created.path
-                );
-                worktree = Some(created);
-            }
-            "auto_commit_harness_refresh_then_create_new_task" => {
-                let Some(diff) = harness_refresh_diff(root)? else {
-                    return Err(NaomeError::new(
-                        "Unable to find deterministic harness refresh paths.",
-                    ));
-                };
-                if !diff.unrelated_paths.is_empty() {
-                    return Err(NaomeError::new(
-                        "Harness refresh baseline expected no unrelated dirty paths.",
-                    ));
-                }
-                git_stage_only_paths(root, &diff.harness_paths)?;
-                git_commit(root, "chore(naome): baseline harness refresh")?;
-                mutation_performed = true;
-                executed_actions.push("commit_harness_refresh_baseline".to_string());
-                user_message = "NAOME baselined the harness refresh and is ready to create the next task in the same worktree.".to_string();
-            }
-            "auto_commit_harness_refresh_baseline" => {
-                let Some(split) = harness_refresh_diff(root)? else {
-                    return Err(NaomeError::new(
-                        "Unable to find deterministic harness refresh paths.",
-                    ));
-                };
-                git_stage_only_paths(root, &split.harness_paths)?;
-                git_commit(root, "chore(naome): baseline harness refresh")?;
-                mutation_performed = true;
-                executed_actions.push("commit_harness_refresh_baseline".to_string());
-                user_message = "NAOME baselined the deterministic harness refresh and left unrelated user edits untouched.".to_string();
-            }
-            "auto_commit_upgrade_baseline_then_create_new_task" => {
-                git_add_all(root)?;
-                git_commit(root, "chore(naome): baseline setup")?;
-                mutation_performed = true;
-                executed_actions.push("commit_upgrade_baseline".to_string());
-                user_message =
-                    "NAOME baselined the setup changes and is ready to create the next task."
-                        .to_string();
-            }
-            "commit_task_baseline" => {
-                let before = git_head(root)?;
-                git_add_completed_task_paths(root)?;
-                git_commit(root, "chore(naome): baseline completed task")?;
-                let after = git_head(root)?;
-                journal_entry =
-                    append_task_journal(root, "naome_commit_baseline", before, after.clone())?;
-                mutation_performed = true;
-                executed_actions.push("commit_task_baseline".to_string());
-                user_message =
-                    "NAOME baselined the completed task and is ready for the next request."
-                        .to_string();
-            }
-            "commit_upgrade_baseline" => {
-                git_add_all(root)?;
-                git_commit(root, "chore(naome): baseline setup")?;
-                mutation_performed = true;
-                executed_actions.push("commit_upgrade_baseline".to_string());
-            }
-            "create_isolated_task_worktree" => {
-                let created = create_isolated_task_worktree(root, prompt)?;
-                task_root = PathBuf::from(&created.path);
-                mutation_performed = true;
-                executed_actions.push("create_task_worktree".to_string());
-                user_message = format!(
-                    "NAOME created an isolated task worktree at {}. Continue the new task there; unrelated user edits remain untouched in the original worktree.",
-                    created.path
-                );
-                worktree = Some(created);
-            }
-            "commit_user_diff_with_quality_gate" => {
-                let paths = git::changed_paths(root)?;
-                executed_actions.push("run_user_diff_quality_gate".to_string());
-                match run_user_diff_quality_gate(root, &paths) {
-                    Ok(check_ids) => {
-                        git_stage_only_paths(root, &paths)?;
-                        git_commit(root, "chore(user): baseline verified user changes")?;
-                        mutation_performed = true;
-                        executed_actions.push("commit_user_diff".to_string());
-                        user_message = format!(
-                            "NAOME quality gates passed ({}) and committed only the current user-owned changed paths.",
-                            check_ids.join(", ")
-                        );
-                    }
-                    Err(error) => {
-                        route_allowed = false;
-                        human_options = vec!["review_unowned_diff".to_string()];
-                        user_message = format!(
-                            "NAOME user-diff quality gate failed, so no commit was created. {error}"
-                        );
-                    }
-                }
-            }
-            "create_new_task" | "create_new_task_without_auto_baseline"
-                if repo_state_before == "ready_for_task"
-                    && initial_decision
-                        .task
-                        .as_ref()
-                        .map(|task| task.status.clone())
-                        .as_deref()
-                        .is_some_and(|status| status == "complete") =>
-            {
-                journal_entry =
-                    append_task_journal(root, "external_baseline", None, git_head(root)?)?;
-                if journal_entry.is_some() {
-                    mutation_performed = true;
-                    executed_actions.push("journal_external_task_baseline".to_string());
-                }
-            }
-            _ => {}
-        }
+        execute_route_policy(
+            root,
+            prompt,
+            &initial_decision,
+            &intent,
+            &repo_state_before,
+            &mut execution,
+        )?;
     }
 
-    let next_decision = evaluate_decision(&task_root, options.evaluation)?;
+    let next_decision = evaluate_decision(&execution.task_root, options.evaluation)?;
     let can_create_task = can_create_task(&intent, &next_decision, options.execute);
     let required_context = required_context_for_route(&intent, &next_decision);
     let mut internal_notes = intent.internal_notes.clone();
     internal_notes.push(format!("route_execute:{}", options.execute));
-    if mutation_performed {
+    if execution.mutation_performed {
         internal_notes.push("route_mutation_performed:true".to_string());
     }
-    if worktree.is_some() {
+    if execution.worktree.is_some() {
         internal_notes.push("route_task_root:isolation_worktree".to_string());
     }
 
@@ -309,17 +124,17 @@ pub fn evaluate_route(
         repo_state_before,
         prompt_intent: intent.prompt_intent.clone(),
         policy_action: intent.policy_action.clone(),
-        allowed: route_allowed,
-        mutation_performed,
-        executed_actions,
+        allowed: execution.route_allowed,
+        mutation_performed: execution.mutation_performed,
+        executed_actions: execution.executed_actions,
         can_create_task,
-        user_message,
-        human_options,
+        user_message: execution.user_message,
+        human_options: execution.human_options,
         internal_notes,
         required_context,
-        task_root: task_root.to_string_lossy().to_string(),
-        worktree,
-        journal_entry,
+        task_root: execution.task_root.to_string_lossy().to_string(),
+        worktree: execution.worktree,
+        journal_entry: execution.journal_entry,
         next_decision,
         intent,
     })
@@ -348,991 +163,3 @@ pub fn explain_route(
         intent,
     })
 }
-
-fn can_create_task(intent: &IntentDecision, decision: &Decision, execute: bool) -> bool {
-    let creation_intent = matches!(
-        intent.policy_action.as_str(),
-        "create_new_task"
-            | "create_new_task_without_auto_baseline"
-            | "auto_commit_completed_task_then_create_new_task"
-            | "auto_commit_completed_task_then_create_isolated_task_worktree"
-            | "auto_commit_harness_refresh_then_completed_task_then_create_new_task"
-            | "auto_commit_harness_refresh_then_create_new_task"
-            | "auto_commit_harness_refresh_then_create_isolated_task_worktree"
-            | "auto_commit_upgrade_baseline_then_create_new_task"
-            | "create_isolated_task_worktree"
-    );
-    if !creation_intent || decision.state != "ready_for_task" || decision.blocked {
-        return false;
-    }
-
-    execute
-        || matches!(
-            intent.policy_action.as_str(),
-            "create_new_task" | "create_new_task_without_auto_baseline"
-        )
-}
-
-fn winning_rule(intent: &IntentDecision) -> String {
-    match intent.policy_action.as_str() {
-        "block_unsafe_intent" => "unsafe_intent_precedence",
-        "block_auto_baseline_due_to_no_commit" => "no_commit_blocks_auto_baseline",
-        "continue_current_task_without_commit" => "no_commit_continues_active_task",
-        "review_task_diff" | "review_diff_first" | "review_current_task_diff" => {
-            "explicit_review_overrides_auto_baseline"
-        }
-        "cancel_task_changes" | "cancel_upgrade_baseline" | "cancel_current_task" => {
-            "explicit_cancel_overrides_auto_baseline"
-        }
-        "auto_commit_completed_task_then_create_new_task" => {
-            "completed_task_valid_new_task_auto_baseline"
-        }
-        "auto_commit_completed_task_then_create_isolated_task_worktree" => {
-            "completed_task_valid_with_unrelated_dirty_worktree"
-        }
-        "auto_commit_harness_refresh_then_completed_task_then_create_new_task" => {
-            "completed_task_harness_refresh_split_auto_baseline"
-        }
-        "auto_commit_harness_refresh_then_create_new_task" => {
-            "pure_harness_refresh_new_task_auto_baseline"
-        }
-        "auto_commit_harness_refresh_then_create_isolated_task_worktree" => {
-            "dirty_repo_harness_refresh_worktree_isolation"
-        }
-        "auto_commit_harness_refresh_baseline" => "dirty_repo_harness_refresh_repair_baseline",
-        "auto_commit_upgrade_baseline_then_create_new_task" => "setup_diff_new_task_auto_baseline",
-        "reopen_completed_task_revision" | "continue_current_task" => {
-            "current_task_revision_continues_task"
-        }
-        "answer_status_only" => "status_request_read_only",
-        "create_new_task" | "create_new_task_without_auto_baseline" => "ready_repo_new_task",
-        "create_isolated_task_worktree" => "dirty_repo_new_task_worktree_isolation",
-        "commit_user_diff_with_quality_gate" => "explicit_user_diff_commit_quality_gate",
-        _ => "fallback_policy",
-    }
-    .to_string()
-}
-
-fn discarded_actions(intent: &IntentDecision) -> Vec<String> {
-    let Some(actions_note) = intent
-        .internal_notes
-        .iter()
-        .find(|note| note.starts_with("internal_allowed_actions:"))
-    else {
-        return Vec::new();
-    };
-    let selected = selected_internal_action(&intent.policy_action);
-    actions_note
-        .trim_start_matches("internal_allowed_actions:")
-        .split(',')
-        .filter(|action| !action.is_empty() && Some(*action) != selected.as_deref())
-        .map(ToString::to_string)
-        .collect()
-}
-
-fn selected_internal_action(policy_action: &str) -> Option<String> {
-    match policy_action {
-        "auto_commit_completed_task_then_create_new_task"
-        | "auto_commit_completed_task_then_create_isolated_task_worktree"
-        | "commit_task_baseline" => Some("commit_task_baseline".to_string()),
-        "auto_commit_harness_refresh_then_create_new_task"
-        | "auto_commit_harness_refresh_then_create_isolated_task_worktree"
-        | "auto_commit_harness_refresh_baseline" => Some("commit_upgrade_baseline".to_string()),
-        "auto_commit_harness_refresh_then_completed_task_then_create_new_task" => {
-            Some("commit_task_baseline".to_string())
-        }
-        "auto_commit_upgrade_baseline_then_create_new_task" | "commit_upgrade_baseline" => {
-            Some("commit_upgrade_baseline".to_string())
-        }
-        other if other.starts_with("review_") || other.starts_with("cancel_") => {
-            Some(other.to_string())
-        }
-        _ => None,
-    }
-}
-
-fn would_mutate(intent: &IntentDecision) -> bool {
-    matches!(
-        intent.policy_action.as_str(),
-        "auto_commit_completed_task_then_create_new_task"
-            | "auto_commit_completed_task_then_create_isolated_task_worktree"
-            | "auto_commit_upgrade_baseline_then_create_new_task"
-            | "auto_commit_harness_refresh_then_completed_task_then_create_new_task"
-            | "auto_commit_harness_refresh_then_create_new_task"
-            | "auto_commit_harness_refresh_then_create_isolated_task_worktree"
-            | "auto_commit_harness_refresh_baseline"
-            | "create_isolated_task_worktree"
-            | "commit_task_baseline"
-            | "commit_upgrade_baseline"
-            | "commit_user_diff_with_quality_gate"
-    )
-}
-
-fn required_context_for_route(intent: &IntentDecision, decision: &Decision) -> Vec<String> {
-    let mut context = required_context_for_intent(intent);
-    if decision.state == "ready_for_task" {
-        push_unique(&mut context, "docs/naome/agent-workflow.md");
-        push_unique(&mut context, "docs/naome/testing.md");
-        push_unique(&mut context, ".naome/verification.json");
-    }
-    context
-}
-
-fn required_context_for_intent(intent: &IntentDecision) -> Vec<String> {
-    let mut context = intent.required_context.clone();
-    match intent.policy_action.as_str() {
-        "create_new_task" | "create_new_task_without_auto_baseline" => {
-            push_unique(&mut context, "docs/naome/agent-workflow.md");
-            push_unique(&mut context, "docs/naome/testing.md");
-            push_unique(&mut context, ".naome/verification.json");
-            push_unique(&mut context, "docs/naome/architecture.md");
-        }
-        "create_isolated_task_worktree" => {
-            push_unique(&mut context, "docs/naome/agent-workflow.md");
-            push_unique(&mut context, "docs/naome/testing.md");
-            push_unique(&mut context, ".naome/verification.json");
-            push_unique(&mut context, "docs/naome/architecture.md");
-        }
-        "auto_commit_completed_task_then_create_new_task"
-        | "auto_commit_completed_task_then_create_isolated_task_worktree"
-        | "auto_commit_harness_refresh_then_create_new_task"
-        | "auto_commit_harness_refresh_then_create_isolated_task_worktree"
-        | "auto_commit_harness_refresh_baseline"
-        | "auto_commit_harness_refresh_then_completed_task_then_create_new_task"
-        | "reopen_completed_task_revision"
-        | "review_task_diff"
-        | "cancel_task_changes"
-        | "block_auto_baseline_due_to_no_commit" => {
-            push_unique(&mut context, "docs/naome/execution.md");
-            push_unique(&mut context, ".naome/task-state.json");
-        }
-        "answer_status_only" => {
-            push_unique(&mut context, "docs/naome/index.md");
-        }
-        "repair_harness_only" => {
-            push_unique(&mut context, ".naome/manifest.json");
-            push_unique(&mut context, "docs/naome/index.md");
-        }
-        _ => {}
-    }
-    context
-}
-
-fn push_unique(context: &mut Vec<String>, value: &str) {
-    if !context.iter().any(|entry| entry == value) {
-        context.push(value.to_string());
-    }
-}
-
-fn git_head(root: &Path) -> Result<Option<String>, NaomeError> {
-    let output = Command::new("git")
-        .args(["rev-parse", "HEAD"])
-        .current_dir(root)
-        .output()?;
-    if !output.status.success() {
-        return Ok(None);
-    }
-    Ok(Some(
-        String::from_utf8_lossy(&output.stdout).trim().to_string(),
-    ))
-}
-
-fn git_add_all(root: &Path) -> Result<(), NaomeError> {
-    let output = Command::new("git")
-        .args(["add", "-A"])
-        .current_dir(root)
-        .output()?;
-    if output.status.success() {
-        Ok(())
-    } else {
-        Err(NaomeError::new(command_output(&output)))
-    }
-}
-
-fn git_add_completed_task_paths(root: &Path) -> Result<(), NaomeError> {
-    let paths = completed_task_commit_paths(root)?;
-    if paths.is_empty() {
-        return Err(NaomeError::new(
-            "No task-owned paths are available to commit.",
-        ));
-    }
-    git_stage_only_paths(root, &paths)
-}
-
-fn git_stage_only_paths(root: &Path, paths: &[String]) -> Result<(), NaomeError> {
-    let output = Command::new("git")
-        .args(["reset", "-q", "--", "."])
-        .current_dir(root)
-        .output()?;
-    if !output.status.success() {
-        return Err(NaomeError::new(command_output(&output)));
-    }
-    git_add_paths(root, paths)
-}
-
-fn git_add_paths(root: &Path, paths: &[String]) -> Result<(), NaomeError> {
-    if paths.is_empty() {
-        return Ok(());
-    }
-    let mut args = vec!["add", "--"];
-    args.extend(paths.iter().map(String::as_str));
-    let output = Command::new("git").args(args).current_dir(root).output()?;
-    if output.status.success() {
-        Ok(())
-    } else {
-        Err(NaomeError::new(command_output(&output)))
-    }
-}
-
-fn run_user_diff_quality_gate(
-    root: &Path,
-    changed_paths: &[String],
-) -> Result<Vec<String>, NaomeError> {
-    if changed_paths.is_empty() {
-        return Err(NaomeError::new("No changed paths are available to commit."));
-    }
-    let verification = read_head_verification(root)?;
-    let checks = verification_checks(&verification);
-    let check_ids = user_diff_check_ids(&verification, changed_paths, &checks)?;
-
-    let initial_paths = sorted_path_set(changed_paths);
-    let mut previous_snapshot = changed_path_snapshot(root, changed_paths)?;
-    for _ in 0..3 {
-        validate_changed_text_whitespace(root, changed_paths)?;
-
-        for check_id in &check_ids {
-            let Some(check) = checks.get(check_id.as_str()) else {
-                return Err(NaomeError::new(format!(
-                    "Quality check {check_id} is referenced but not defined."
-                )));
-            };
-            run_quality_check(root, check_id, check)?;
-        }
-
-        let current_paths = git::changed_paths(root)?;
-        let current_set = sorted_path_set(&current_paths);
-        if current_set != initial_paths {
-            return Err(NaomeError::new(format!(
-                "Quality checks changed the diff path set from [{}] to [{}].",
-                initial_paths.iter().cloned().collect::<Vec<_>>().join(", "),
-                current_set.iter().cloned().collect::<Vec<_>>().join(", ")
-            )));
-        }
-
-        validate_changed_text_whitespace(root, changed_paths)?;
-        if let Some(check) = checks.get("diff-check") {
-            run_quality_check(root, "diff-check", check)?;
-        }
-        let current_paths = git::changed_paths(root)?;
-        let current_set = sorted_path_set(&current_paths);
-        if current_set != initial_paths {
-            return Err(NaomeError::new(format!(
-                "Quality checks changed the diff path set from [{}] to [{}].",
-                initial_paths.iter().cloned().collect::<Vec<_>>().join(", "),
-                current_set.iter().cloned().collect::<Vec<_>>().join(", ")
-            )));
-        }
-
-        let next_snapshot = changed_path_snapshot(root, changed_paths)?;
-        if next_snapshot == previous_snapshot {
-            return Ok(check_ids);
-        }
-        previous_snapshot = next_snapshot;
-    }
-
-    Err(NaomeError::new(
-        "Quality checks did not stabilize the user-owned diff after three runs.",
-    ))
-}
-
-fn validate_changed_text_whitespace(
-    root: &Path,
-    changed_paths: &[String],
-) -> Result<(), NaomeError> {
-    for relative_path in changed_paths {
-        let path = root.join(relative_path);
-        if !path.is_file() {
-            continue;
-        }
-        let Ok(content) = fs::read_to_string(&path) else {
-            continue;
-        };
-        for (index, line) in content.lines().enumerate() {
-            if line.ends_with(' ') || line.ends_with('\t') {
-                return Err(NaomeError::new(format!(
-                    "{relative_path}:{} has trailing whitespace.",
-                    index + 1
-                )));
-            }
-        }
-    }
-    Ok(())
-}
-
-fn read_head_verification(root: &Path) -> Result<Value, NaomeError> {
-    let output = Command::new("git")
-        .args(["show", "HEAD:.naome/verification.json"])
-        .current_dir(root)
-        .output()?;
-
-    if !output.status.success() {
-        return Err(NaomeError::new(
-            "No committed NAOME verification profile is available for user-diff quality gating.",
-        ));
-    }
-
-    Ok(serde_json::from_slice(&output.stdout)?)
-}
-
-#[derive(Debug, Clone)]
-struct QualityCheck {
-    command: String,
-    cwd: String,
-}
-
-fn verification_checks(verification: &Value) -> HashMap<&str, QualityCheck> {
-    let mut checks = HashMap::new();
-    let Some(items) = verification.get("checks").and_then(Value::as_array) else {
-        return checks;
-    };
-
-    for item in items {
-        let Some(id) = item.get("id").and_then(Value::as_str) else {
-            continue;
-        };
-        let Some(command) = item.get("command").and_then(Value::as_str) else {
-            continue;
-        };
-        let cwd = item
-            .get("cwd")
-            .and_then(Value::as_str)
-            .unwrap_or(".")
-            .to_string();
-        checks.insert(
-            id,
-            QualityCheck {
-                command: command.to_string(),
-                cwd,
-            },
-        );
-    }
-
-    checks
-}
-
-fn user_diff_check_ids(
-    verification: &Value,
-    changed_paths: &[String],
-    checks: &HashMap<&str, QualityCheck>,
-) -> Result<Vec<String>, NaomeError> {
-    let mut ids = Vec::new();
-    if checks.contains_key("diff-check") {
-        push_unique_string(&mut ids, "diff-check");
-    }
-    if checks.contains_key("naome-harness-health") {
-        push_unique_string(&mut ids, "naome-harness-health");
-    }
-
-    let Some(change_types) = verification.get("changeTypes").and_then(Value::as_array) else {
-        return Err(NaomeError::new(
-            "No quality coverage is configured for user-owned changed paths.",
-        ));
-    };
-
-    if change_types.is_empty() {
-        return Err(NaomeError::new(
-            "No quality coverage is configured for user-owned changed paths.",
-        ));
-    }
-
-    let mut uncovered_paths = Vec::new();
-
-    for change_type in change_types {
-        let patterns = string_array(change_type.get("paths"));
-        if patterns.is_empty()
-            || !changed_paths
-                .iter()
-                .any(|path| paths::matches_any(path, &patterns))
-        {
-            continue;
-        }
-
-        for check_id in string_array(change_type.get("requiredChecks")) {
-            push_unique_string(&mut ids, &check_id);
-        }
-    }
-
-    for path in changed_paths {
-        let covered = change_types.iter().any(|change_type| {
-            let patterns = string_array(change_type.get("paths"));
-            !patterns.is_empty() && paths::matches_any(path, &patterns)
-        });
-        if !covered {
-            uncovered_paths.push(path.clone());
-        }
-    }
-
-    if !uncovered_paths.is_empty() {
-        return Err(NaomeError::new(format!(
-            "No quality coverage is configured for changed path(s): {}.",
-            uncovered_paths.join(", ")
-        )));
-    }
-
-    if ids.is_empty() {
-        return Err(NaomeError::new(
-            "No quality checks are configured for these changed paths.",
-        ));
-    }
-
-    Ok(ids)
-}
-
-fn sorted_path_set(paths: &[String]) -> BTreeSet<String> {
-    paths.iter().cloned().collect()
-}
-
-fn changed_path_snapshot(
-    root: &Path,
-    changed_paths: &[String],
-) -> Result<Vec<(String, Option<Vec<u8>>)>, NaomeError> {
-    let mut snapshot = Vec::new();
-    for relative_path in changed_paths {
-        let path = root.join(relative_path);
-        let content = if path.is_file() {
-            Some(fs::read(&path)?)
-        } else {
-            None
-        };
-        snapshot.push((relative_path.clone(), content));
-    }
-    snapshot.sort_by(|left, right| left.0.cmp(&right.0));
-    Ok(snapshot)
-}
-
-fn string_array(value: Option<&Value>) -> Vec<String> {
-    value
-        .and_then(Value::as_array)
-        .map(|items| {
-            items
-                .iter()
-                .filter_map(Value::as_str)
-                .map(ToString::to_string)
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
-fn push_unique_string(values: &mut Vec<String>, value: &str) {
-    if !values.iter().any(|item| item == value) {
-        values.push(value.to_string());
-    }
-}
-
-fn run_quality_check(root: &Path, check_id: &str, check: &QualityCheck) -> Result<(), NaomeError> {
-    match check_id {
-        "installer-tests" => require_builtin_quality_check(
-            check_id,
-            check,
-            "npm run test:naome-installer",
-        ),
-        "rust-build" => require_builtin_quality_check(check_id, check, "npm run build:rust"),
-        "decision-engine-tests" => {
-            require_builtin_quality_check(check_id, check, "npm run test:decision-engine")
-        }
-        "package-dry-run" => require_builtin_quality_check(check_id, check, "npm run pack:dry-run"),
-        "diff-check" => {
-            require_builtin_quality_check(check_id, check, "git diff --check")?;
-            let output = Command::new("git")
-                .args(["diff", "--check"])
-                .current_dir(root)
-                .output()?;
-
-            if output.status.success() {
-                Ok(())
-            } else {
-                Err(NaomeError::new(command_output(&output)))
-            }
-        }
-        "naome-harness-health" => {
-            require_builtin_quality_check(
-                check_id,
-                check,
-                "node .naome/bin/check-harness-health.js",
-            )?;
-            run_harness_health_check(root)
-        }
-        "dogfood-health" => {
-            require_builtin_quality_check(check_id, check, "npm run dogfood:health")?;
-            run_harness_health_check(root)
-        }
-        "task-state-check" => {
-            require_builtin_quality_check(check_id, check, "npm run check:task-state")?;
-            run_template_task_state_check(root)
-        }
-        "verification-contract-check" => {
-            require_builtin_quality_check(
-                check_id,
-                check,
-                "npm run check:verification-contract",
-            )?;
-            run_template_verification_contract_check(root)
-        }
-        "context-budget-check" => {
-            require_builtin_quality_check(check_id, check, "npm run check:context-budget")?;
-            run_context_budget_check(root)
-        }
-        "repository-quality-check" => {
-            require_builtin_quality_check_any(
-                check_id,
-                check,
-                &[
-                    "naome quality check --changed",
-                    "node .naome/bin/naome.js quality check --changed",
-                    "npm run check:repository-quality",
-                ],
-            )?;
-            run_repository_quality_check(root)
-        }
-        _ => Err(NaomeError::new(format!(
-            "Quality check {check_id} is not a built-in safe check; NAOME will not execute repository-controlled verification commands."
-        ))),
-    }
-}
-
-fn require_builtin_quality_check_any(
-    check_id: &str,
-    check: &QualityCheck,
-    expected_commands: &[&str],
-) -> Result<(), NaomeError> {
-    if check.cwd == "."
-        && expected_commands
-            .iter()
-            .any(|expected_command| check.command == *expected_command)
-    {
-        return Ok(());
-    }
-
-    Err(NaomeError::new(format!(
-        "Quality check {check_id} has an unsafe command or cwd; expected one of [{}] with cwd `.`.",
-        expected_commands
-            .iter()
-            .map(|command| format!("`{command}`"))
-            .collect::<Vec<_>>()
-            .join(", ")
-    )))
-}
-
-fn require_builtin_quality_check(
-    check_id: &str,
-    check: &QualityCheck,
-    expected_command: &str,
-) -> Result<(), NaomeError> {
-    if check.cwd == "." && check.command == expected_command {
-        return Ok(());
-    }
-
-    Err(NaomeError::new(format!(
-        "Quality check {check_id} has an unsafe command or cwd; expected command `{expected_command}` with cwd `.`."
-    )))
-}
-
-fn run_repository_quality_check(root: &Path) -> Result<(), NaomeError> {
-    let report = check_repository_quality(root, QualityMode::Changed)?;
-    if report.ok {
-        return Ok(());
-    }
-
-    let details = report
-        .violations
-        .iter()
-        .take(20)
-        .map(|violation| {
-            let location = violation
-                .line
-                .map(|line| format!("{}:{line}", violation.path))
-                .unwrap_or_else(|| violation.path.clone());
-            format!("{location} {}: {}", violation.check_id, violation.message)
-        })
-        .collect::<Vec<_>>()
-        .join("\n");
-    Err(NaomeError::new(format!(
-        "repository-quality-check failed with {} violation(s).\n{}",
-        report.violations.len(),
-        details
-    )))
-}
-
-fn run_harness_health_check(root: &Path) -> Result<(), NaomeError> {
-    let errors = validate_harness_health(
-        root,
-        HarnessHealthOptions {
-            expected_integrity: packaged_harness_integrity()?,
-            ..HarnessHealthOptions::default()
-        },
-    )?;
-    if errors.is_empty() {
-        Ok(())
-    } else {
-        Err(NaomeError::new(errors.join("\n")))
-    }
-}
-
-fn packaged_harness_integrity() -> Result<std::collections::HashMap<String, String>, NaomeError> {
-    const CHECKER: &str =
-        include_str!("../../../templates/naome-root/.naome/bin/check-harness-health.js");
-    let start_marker = "const expectedMachineOwnedIntegrity = Object.freeze({";
-    let start = CHECKER
-        .find(start_marker)
-        .ok_or_else(|| NaomeError::new("Packaged harness integrity block is missing."))?;
-    let body_start = start + start_marker.len();
-    let end = CHECKER[body_start..]
-        .find("\n});")
-        .map(|offset| body_start + offset)
-        .ok_or_else(|| NaomeError::new("Packaged harness integrity block is incomplete."))?;
-
-    let mut integrity = std::collections::HashMap::new();
-    for line in CHECKER[body_start..end].lines() {
-        let line = line.trim().trim_end_matches(',').trim();
-        if line.is_empty() {
-            continue;
-        }
-        let Some((path, hash)) = line.split_once(':') else {
-            return Err(NaomeError::new(format!(
-                "Packaged harness integrity entry is invalid: {line}"
-            )));
-        };
-        let path: String = serde_json::from_str(path.trim()).map_err(|error| {
-            NaomeError::new(format!(
-                "Packaged harness integrity path is invalid: {error}"
-            ))
-        })?;
-        let hash: String = serde_json::from_str(hash.trim()).map_err(|error| {
-            NaomeError::new(format!(
-                "Packaged harness integrity hash is invalid: {error}"
-            ))
-        })?;
-        integrity.insert(path, hash);
-    }
-
-    if integrity.is_empty() {
-        return Err(NaomeError::new(
-            "Packaged harness integrity block is empty.",
-        ));
-    }
-
-    Ok(integrity)
-}
-
-fn run_template_task_state_check(root: &Path) -> Result<(), NaomeError> {
-    let template_root = template_root(root);
-    let report = validate_task_state(
-        &template_root,
-        TaskStateOptions {
-            mode: TaskStateMode::State,
-            harness_health: Some(HarnessHealthOptions {
-                expected_integrity: packaged_harness_integrity()?,
-                allow_missing_archive: true,
-                ..HarnessHealthOptions::default()
-            }),
-        },
-    )?;
-    if report.errors.is_empty() {
-        Ok(())
-    } else {
-        Err(NaomeError::new(report.errors.join("\n")))
-    }
-}
-
-fn run_template_verification_contract_check(root: &Path) -> Result<(), NaomeError> {
-    let errors = validate_verification_contract(&template_root(root))?;
-    if errors.is_empty() {
-        Ok(())
-    } else {
-        Err(NaomeError::new(errors.join("\n")))
-    }
-}
-
-fn run_context_budget_check(root: &Path) -> Result<(), NaomeError> {
-    let template_root = template_root(root);
-    let mut context_files = vec![
-        template_root.join("AGENTS.md"),
-        template_root.join(".naomeignore"),
-    ];
-    context_files.extend(markdown_files(&template_root.join("docs").join("naome"))?);
-    context_files.sort();
-
-    let mut errors = Vec::new();
-    for path in context_files {
-        let content = fs::read_to_string(&path)?;
-        let line_count = count_lines(&content);
-        if line_count > 200 {
-            errors.push(format!(
-                "{}: {line_count} lines",
-                display_repo_path(root, &path)
-            ));
-        }
-    }
-
-    if errors.is_empty() {
-        Ok(())
-    } else {
-        Err(NaomeError::new(format!(
-            "NAOME context budget exceeded. Limit: 200 lines per file.\n{}",
-            errors.join("\n")
-        )))
-    }
-}
-
-fn template_root(root: &Path) -> PathBuf {
-    root.join("packages")
-        .join("naome")
-        .join("templates")
-        .join("naome-root")
-}
-
-fn markdown_files(dir: &Path) -> Result<Vec<PathBuf>, NaomeError> {
-    let mut files = Vec::new();
-    for entry in fs::read_dir(dir)? {
-        let entry = entry?;
-        let path = entry.path();
-        if path.is_dir() {
-            files.extend(markdown_files(&path)?);
-        } else if path.is_file() && path.extension().is_some_and(|extension| extension == "md") {
-            files.push(path);
-        }
-    }
-    Ok(files)
-}
-
-fn count_lines(content: &str) -> usize {
-    if content.is_empty() {
-        0
-    } else if content.ends_with('\n') {
-        content.split('\n').count() - 1
-    } else {
-        content.split('\n').count()
-    }
-}
-
-fn display_repo_path(root: &Path, path: &Path) -> String {
-    path.strip_prefix(root)
-        .unwrap_or(path)
-        .to_string_lossy()
-        .to_string()
-}
-
-fn git_commit(root: &Path, message: &str) -> Result<(), NaomeError> {
-    let output = Command::new("git")
-        .args(["commit", "-m", message])
-        .current_dir(root)
-        .output()?;
-    if output.status.success() {
-        Ok(())
-    } else {
-        Err(NaomeError::new(command_output(&output)))
-    }
-}
-
-fn create_isolated_task_worktree(root: &Path, prompt: &str) -> Result<RouteWorktree, NaomeError> {
-    let name_head = task_worktree_name_head(root)?;
-    create_isolated_task_worktree_with_name_head(root, prompt, &name_head)
-}
-
-fn create_isolated_task_worktree_with_name_head(
-    root: &Path,
-    prompt: &str,
-    name_head: &str,
-) -> Result<RouteWorktree, NaomeError> {
-    let base_head = git_head(root)?.ok_or_else(|| {
-        NaomeError::new("Cannot create task worktree because the repository has no HEAD.")
-    })?;
-    let short_head = name_head.chars().take(12).collect::<String>();
-    let slug = prompt_slug(prompt);
-    let common_git_dir = git_common_dir(root)?;
-    let worktree_base = common_git_dir.join("naome").join("worktrees");
-    fs::create_dir_all(&worktree_base)?;
-    let worktree_count = existing_naome_task_worktree_count(&worktree_base)?;
-    if worktree_count >= MAX_NAOME_TASK_WORKTREES {
-        return Err(NaomeError::new(format!(
-            "Too many NAOME task worktrees are present ({worktree_count}). Finish or remove old task worktrees before creating another isolated task worktree."
-        )));
-    }
-
-    for attempt in 1..100 {
-        let suffix = if attempt == 1 {
-            String::new()
-        } else {
-            format!("-{attempt}")
-        };
-        let name = format!("{slug}-{short_head}{suffix}");
-        let branch = format!("naome/task/{name}");
-        let path = worktree_base.join(&name);
-        if path.exists() || git_branch_exists(root, &branch)? {
-            continue;
-        }
-
-        let path_text = path.to_string_lossy().to_string();
-        let output = Command::new("git")
-            .args(["worktree", "add", "-b", &branch, &path_text, "HEAD"])
-            .current_dir(root)
-            .output()?;
-        if !output.status.success() {
-            return Err(NaomeError::new(command_output(&output)));
-        }
-
-        copy_local_harness_files(root, &path)?;
-
-        return Ok(RouteWorktree {
-            path: path_text,
-            branch,
-            base_head,
-            source_root: root.to_string_lossy().to_string(),
-        });
-    }
-
-    Err(NaomeError::new(
-        "Cannot create a unique NAOME task worktree after 99 attempts.",
-    ))
-}
-
-fn preflight_isolated_task_worktree(
-    root: &Path,
-    prompt: &str,
-    name_head: &str,
-) -> Result<(), NaomeError> {
-    let short_head = name_head.chars().take(12).collect::<String>();
-    let slug = prompt_slug(prompt);
-    let common_git_dir = git_common_dir(root)?;
-    let worktree_base = common_git_dir.join("naome").join("worktrees");
-    fs::create_dir_all(&worktree_base)?;
-    let worktree_count = existing_naome_task_worktree_count(&worktree_base)?;
-    if worktree_count >= MAX_NAOME_TASK_WORKTREES {
-        return Err(NaomeError::new(format!(
-            "Too many NAOME task worktrees are present ({worktree_count}). Finish or remove old task worktrees before creating another isolated task worktree."
-        )));
-    }
-
-    for attempt in 1..100 {
-        let suffix = if attempt == 1 {
-            String::new()
-        } else {
-            format!("-{attempt}")
-        };
-        let name = format!("{slug}-{short_head}{suffix}");
-        let branch = format!("naome/task/{name}");
-        let path = worktree_base.join(&name);
-        if !path.exists() && !git_branch_exists(root, &branch)? {
-            return Ok(());
-        }
-    }
-
-    Err(NaomeError::new(
-        "Cannot create a unique NAOME task worktree after 99 attempts.",
-    ))
-}
-
-fn task_worktree_name_head(root: &Path) -> Result<String, NaomeError> {
-    git_head(root)?.ok_or_else(|| {
-        NaomeError::new("Cannot create task worktree because the repository has no HEAD.")
-    })
-}
-
-fn existing_naome_task_worktree_count(worktree_base: &Path) -> Result<usize, NaomeError> {
-    let mut count = 0;
-    for entry in fs::read_dir(worktree_base)? {
-        let entry = entry?;
-        if entry.file_type()?.is_dir() {
-            count += 1;
-        }
-    }
-    Ok(count)
-}
-
-fn git_common_dir(root: &Path) -> Result<PathBuf, NaomeError> {
-    let output = Command::new("git")
-        .args(["rev-parse", "--git-common-dir"])
-        .current_dir(root)
-        .output()?;
-    if !output.status.success() {
-        return Err(NaomeError::new(command_output(&output)));
-    }
-
-    let value = String::from_utf8_lossy(&output.stdout).trim().to_string();
-    let path = PathBuf::from(value);
-    if path.is_absolute() {
-        Ok(path)
-    } else {
-        Ok(root.join(path))
-    }
-}
-
-fn git_branch_exists(root: &Path, branch: &str) -> Result<bool, NaomeError> {
-    let ref_name = format!("refs/heads/{branch}");
-    let output = Command::new("git")
-        .args(["show-ref", "--verify", "--quiet", &ref_name])
-        .current_dir(root)
-        .output()?;
-    match output.status.code() {
-        Some(0) => Ok(true),
-        Some(1) => Ok(false),
-        _ => Err(NaomeError::new(command_output(&output))),
-    }
-}
-
-fn copy_local_harness_files(source_root: &Path, worktree_root: &Path) -> Result<(), NaomeError> {
-    let mut paths = Vec::new();
-    paths.extend_from_slice(LOCAL_ONLY_MACHINE_OWNED_PATHS);
-    paths.extend_from_slice(LOCAL_NATIVE_BINARY_PATHS);
-
-    for relative_path in paths {
-        if relative_path == ".naome/archive" || relative_path == ".naome/task-journal.jsonl" {
-            continue;
-        }
-
-        let source = source_root.join(relative_path);
-        if !source.is_file() {
-            continue;
-        }
-        let destination = worktree_root.join(relative_path);
-        if let Some(parent) = destination.parent() {
-            fs::create_dir_all(parent)?;
-        }
-        fs::copy(&source, &destination)?;
-    }
-
-    Ok(())
-}
-
-fn prompt_slug(prompt: &str) -> String {
-    let mut slug = String::new();
-    let mut previous_dash = false;
-    for character in prompt.chars().flat_map(char::to_lowercase) {
-        if character.is_ascii_alphanumeric() {
-            slug.push(character);
-            previous_dash = false;
-        } else if !previous_dash && !slug.is_empty() {
-            slug.push('-');
-            previous_dash = true;
-        }
-
-        if slug.len() >= 40 {
-            break;
-        }
-    }
-
-    let slug = slug.trim_matches('-').to_string();
-    if slug.is_empty() {
-        "task".to_string()
-    } else {
-        slug
-    }
-}
-
-fn command_output(output: &std::process::Output) -> String {
-    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-    if !stderr.is_empty() {
-        return stderr;
-    }
-    String::from_utf8_lossy(&output.stdout).trim().to_string()
-}