@lamentis/naome 1.3.5 → 1.3.7

package/Cargo.lock

@@ -76,7 +76,7 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "naome-cli"
-version = "1.3.5"
+version = "1.3.7"
 dependencies = [
  "naome-core",
  "serde_json",
@@ -84,7 +84,7 @@ dependencies = [
 
 [[package]]
 name = "naome-core"
-version = "1.3.5"
+version = "1.3.7"
 dependencies = [
  "serde",
  "serde_json",

package/README.md

@@ -84,8 +84,9 @@ naome commit -m "type(scope): summary"
 
 `naome sync` installs or repairs the local harness files. It does not run a
 hidden full-repository quality scan. It also migrates any active legacy
-task-state into the task ledger automatically. If quality policy is newly
-seeded, run `naome quality init --baseline` deliberately; use `--deep` or
+task-state into the local task ledger automatically and untracks local
+`.naome/tasks/` runtime folders from Git. If quality policy is newly seeded,
+run `naome quality init --baseline` deliberately; use `--deep` or
 `--deep-baseline` only when you want expensive repository-wide checks.
 
 ## Repository Docs
@@ -111,7 +112,7 @@ The main local policy files are:
   quality policy.
 - `.naome/repository-structure.json` for path role, module, and directory
   structure policy.
-- `.naome/task-state.json` for active task state and proof.
+- `.naome/task-state.json` for the compact committed active task projection.
 
 Product defaults stay generic. Repository-specific policy belongs in the local
 `.naome/` config files.

package/crates/naome-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-cli"
-version = "1.3.5"
+version = "1.3.7"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/crates/naome-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-core"
-version = "1.3.5"
+version = "1.3.7"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/crates/naome-core/src/git.rs

@@ -1,4 +1,3 @@
-use std::fs;
 use std::path::Path;
 use std::process::Command;
 
@@ -6,7 +5,7 @@ use crate::models::NaomeError;
 use crate::paths;
 
 pub fn changed_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
-    let ignored_patterns = read_naomeignore_patterns(root);
+    let ignored_patterns = paths::naomeignore_patterns(root);
     let output = Command::new("git")
         .args(["status", "--porcelain=v1", "-z", "-uall"])
         .current_dir(root)
@@ -57,27 +56,3 @@ pub fn changed_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
     paths.dedup();
     Ok(paths)
 }
-
-fn read_naomeignore_patterns(root: &Path) -> Vec<String> {
-    let Ok(content) = fs::read_to_string(root.join(".naomeignore")) else {
-        return Vec::new();
-    };
-
-    let mut patterns = content
-        .lines()
-        .map(str::trim)
-        .filter(|line| !line.is_empty() && !line.starts_with('#') && !line.starts_with('!'))
-        .map(normalize_ignore_pattern)
-        .collect::<Vec<_>>();
-    patterns.push(".naome/cache/**".to_string());
-    patterns
-}
-
-fn normalize_ignore_pattern(pattern: &str) -> String {
-    let normalized = pattern.trim_start_matches("./").replace('\\', "/");
-    if normalized.ends_with('/') {
-        format!("{normalized}**")
-    } else {
-        normalized
-    }
-}

package/crates/naome-core/src/information_architecture.rs

@@ -36,12 +36,6 @@ const CLASSES: &[(&str, &str, &str, &str)] = &[
         "commit",
         "restore_from_repository_or_package",
     ),
-    (
-        "durable_task_ledger",
-        "Committed task intent, scope, and lifecycle records.",
-        "commit",
-        "restore_from_repository",
-    ),
     (
         "generated_projection",
         "Compatibility views generated from durable state.",
@@ -67,23 +61,18 @@ const CLASSES: &[(&str, &str, &str, &str)] = &[
         "restore_from_repository",
     ),
 ];
-struct RuleSeed {
-    path_pattern: &'static str,
-    class: &'static str,
-}
-
-const RULES: &[RuleSeed] = &[
-    RuleSeed { path_pattern: ".naome/tmp/**", class: "local_runtime_state" },
-    RuleSeed { path_pattern: ".naome/task-state.json", class: "generated_projection" },
-    RuleSeed { path_pattern: ".naome/tasks/active.json", class: "durable_task_ledger" },
-    RuleSeed { path_pattern: ".naome/tasks/*/task.json", class: "durable_task_ledger" },
-    RuleSeed { path_pattern: ".naome/tasks/*/events.jsonl", class: "durable_task_ledger" },
-    RuleSeed { path_pattern: ".naome/tasks/*/proofs/*.json", class: "run_evidence" },
-    RuleSeed { path_pattern: ".naome/manifest.json", class: "durable_project_state" },
-    RuleSeed { path_pattern: ".naome/verification.json", class: "durable_project_state" },
-    RuleSeed { path_pattern: ".naome/repository-quality*.json", class: "durable_project_state" },
-    RuleSeed { path_pattern: "docs/naome/**", class: "durable_project_state" },
-    RuleSeed { path_pattern: "packages/naome/templates/naome-root/**", class: "durable_project_state" },
+const RULES: &[(&str, &str)] = &[
+    (".naome/tmp/**", "local_runtime_state"),
+    (".naome/task-state.json", "generated_projection"),
+    (".naome/tasks/**", "local_runtime_state"),
+    (".naome/manifest.json", "durable_project_state"),
+    (".naome/verification.json", "durable_project_state"),
+    (".naome/repository-quality*.json", "durable_project_state"),
+    ("docs/naome/**", "durable_project_state"),
+    (
+        "packages/naome/templates/naome-root/**",
+        "durable_project_state",
+    ),
 ];
 pub fn information_architecture_report() -> InformationArchitectureReport {
     InformationArchitectureReport {
@@ -95,7 +84,7 @@ pub fn information_architecture_report() -> InformationArchitectureReport {
             .collect(),
         rules: RULES
             .iter()
-            .map(|rule| rule_from_class(rule.path_pattern, rule.class))
+            .map(|(path_pattern, class)| rule_from_class(path_pattern, class))
             .collect(),
     }
 }
@@ -104,8 +93,8 @@ pub fn classify_information_path(path: &str) -> InformationPathClassification {
     let path = normalize_path(path);
     let class_id = RULES
         .iter()
-        .find(|rule| matches_information_rule(&path, rule.path_pattern))
-        .map(|rule| rule.class)
+        .find(|(pattern, _)| matches_information_rule(&path, pattern))
+        .map(|(_, class)| *class)
         .unwrap_or("product_source");
     let class = class_by_id(class_id);
     InformationPathClassification {

package/crates/naome-core/src/install_plan.rs

@@ -81,11 +81,13 @@ pub fn install_plan(harness_version: impl Into<String>) -> InstallPlan {
         ".naome/bin/naome-rust*",
         ".naome/cache/",
         ".naome/task-journal.jsonl",
+        ".naome/tasks/",
     ];
     git_exclude_entries.extend_from_slice(LOCAL_ONLY_MACHINE_OWNED_PATHS);
 
     let mut git_untrack_paths = LOCAL_ONLY_MACHINE_OWNED_PATHS.to_vec();
     git_untrack_paths.extend_from_slice(LOCAL_NATIVE_BINARY_PATHS);
+    git_untrack_paths.push(".naome/tasks");
 
     InstallPlan {
         schema: "naome.install-plan.v1",

package/crates/naome-core/src/lib.rs

@@ -9,6 +9,7 @@ mod journal;
 mod models;
 mod paths;
 mod quality;
+mod repo_paths;
 mod repository_model;
 mod route;
 mod task_ledger;

package/crates/naome-core/src/paths.rs

@@ -1,9 +1,36 @@
+use std::fs;
+use std::path::Path;
+
+pub fn naomeignore_patterns(root: &Path) -> Vec<String> {
+    let Ok(content) = fs::read_to_string(root.join(".naomeignore")) else {
+        return Vec::new();
+    };
+
+    let mut patterns = content
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty() && !line.starts_with('#') && !line.starts_with('!'))
+        .map(normalize_ignore_pattern)
+        .collect::<Vec<_>>();
+    patterns.push(".naome/cache/**".to_string());
+    patterns
+}
+
 pub fn matches_any(path: &str, patterns: &[String]) -> bool {
     patterns
         .iter()
         .any(|pattern| matches_pattern(path, pattern))
 }
 
+fn normalize_ignore_pattern(pattern: &str) -> String {
+    let normalized = pattern.trim_start_matches("./").replace('\\', "/");
+    if normalized.ends_with('/') {
+        format!("{normalized}**")
+    } else {
+        normalized
+    }
+}
+
 fn matches_pattern(path: &str, pattern: &str) -> bool {
     let normalized_path = path.replace('\\', "/");
     let normalized_pattern = pattern.replace('\\', "/");

package/crates/naome-core/src/quality/scanner/repo_paths.rs

@@ -4,36 +4,10 @@ use std::path::Path;
 use std::process::Command;
 
 use crate::models::NaomeError;
+use crate::repo_paths::{collect_tracked_and_untracked_paths, RepoPathFallback};
 
 pub(crate) fn collect_repo_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
-    let output = Command::new("git")
-        .args([
-            "ls-files",
-            "-z",
-            "--cached",
-            "--others",
-            "--exclude-standard",
-        ])
-        .current_dir(root)
-        .output();
-    if let Ok(output) = output {
-        if output.status.success() {
-            let mut paths = output
-                .stdout
-                .split(|byte| *byte == 0)
-                .filter(|entry| !entry.is_empty())
-                .map(|entry| String::from_utf8_lossy(entry).replace('\\', "/"))
-                .collect::<Vec<_>>();
-            paths.sort();
-            paths.dedup();
-            return Ok(paths);
-        }
-    }
-
-    let mut paths = Vec::new();
-    collect_files_recursive(root, root, &mut paths)?;
-    paths.sort();
-    Ok(paths)
+    collect_tracked_and_untracked_paths(root, RepoPathFallback::Filesystem)
 }
 
 pub(super) fn added_lines_by_path(
@@ -103,25 +77,6 @@ pub(super) fn tracked_blob_hashes(root: &Path) -> Result<HashMap<String, String>
     Ok(hashes)
 }
 
-fn collect_files_recursive(
-    root: &Path,
-    dir: &Path,
-    paths: &mut Vec<String>,
-) -> Result<(), NaomeError> {
-    for entry in fs::read_dir(dir)? {
-        let entry = entry?;
-        let path = entry.path();
-        if path.is_dir() {
-            collect_files_recursive(root, &path, paths)?;
-        } else if path.is_file() {
-            if let Ok(relative) = path.strip_prefix(root) {
-                paths.push(relative.to_string_lossy().replace('\\', "/"));
-            }
-        }
-    }
-    Ok(())
-}
-
 fn untracked_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
     let output = Command::new("git")
         .args(["ls-files", "--others", "--exclude-standard", "-z"])

package/crates/naome-core/src/repo_paths.rs

@@ -0,0 +1,76 @@
+use std::fs;
+use std::path::Path;
+use std::process::Command;
+
+use crate::models::NaomeError;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum RepoPathFallback {
+    Empty,
+    Filesystem,
+}
+
+pub(crate) fn collect_tracked_and_untracked_paths(
+    root: &Path,
+    fallback: RepoPathFallback,
+) -> Result<Vec<String>, NaomeError> {
+    let output = Command::new("git")
+        .args([
+            "ls-files",
+            "-z",
+            "--cached",
+            "--others",
+            "--exclude-standard",
+        ])
+        .current_dir(root)
+        .output();
+
+    if let Ok(output) = output {
+        if output.status.success() {
+            return Ok(sorted_unique_paths(
+                output
+                    .stdout
+                    .split(|byte| *byte == 0)
+                    .filter(|entry| !entry.is_empty())
+                    .map(|entry| String::from_utf8_lossy(entry).replace('\\', "/"))
+                    .collect(),
+            ));
+        }
+    }
+
+    match fallback {
+        RepoPathFallback::Empty => Ok(Vec::new()),
+        RepoPathFallback::Filesystem => collect_filesystem_paths(root),
+    }
+}
+
+fn collect_filesystem_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
+    let mut paths = Vec::new();
+    collect_files_recursive(root, root, &mut paths)?;
+    Ok(sorted_unique_paths(paths))
+}
+
+fn collect_files_recursive(
+    root: &Path,
+    dir: &Path,
+    paths: &mut Vec<String>,
+) -> Result<(), NaomeError> {
+    for entry in fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        if path.is_dir() {
+            collect_files_recursive(root, &path, paths)?;
+        } else if path.is_file() {
+            if let Ok(relative) = path.strip_prefix(root) {
+                paths.push(relative.to_string_lossy().replace('\\', "/"));
+            }
+        }
+    }
+    Ok(())
+}
+
+fn sorted_unique_paths(mut paths: Vec<String>) -> Vec<String> {
+    paths.sort();
+    paths.dedup();
+    paths
+}

package/crates/naome-core/src/repository_model/path_scan.rs

@@ -1,32 +1,11 @@
 use std::collections::BTreeSet;
 use std::path::Path;
-use std::process::Command;
 
 use crate::models::NaomeError;
+use crate::repo_paths::{collect_tracked_and_untracked_paths, RepoPathFallback};
 
 pub(super) fn collect_repo_paths(root: &Path) -> Result<Vec<String>, NaomeError> {
-    let output = Command::new("git")
-        .args([
-            "ls-files",
-            "-z",
-            "--cached",
-            "--others",
-            "--exclude-standard",
-        ])
-        .current_dir(root)
-        .output()?;
-    if !output.status.success() {
-        return Ok(Vec::new());
-    }
-    let mut paths = output
-        .stdout
-        .split(|byte| *byte == 0)
-        .filter(|entry| !entry.is_empty())
-        .map(|entry| String::from_utf8_lossy(entry).replace('\\', "/"))
-        .collect::<Vec<_>>();
-    paths.sort();
-    paths.dedup();
-    Ok(paths)
+    collect_tracked_and_untracked_paths(root, RepoPathFallback::Empty)
 }
 
 pub(super) fn evidence(paths: &[String], markers: &[&str]) -> Vec<String> {

package/crates/naome-core/src/task_ledger/write.rs

@@ -21,12 +21,18 @@ pub(super) fn validate_task_state_projection_is_current(
     if !read::active_path(root).is_file() {
         return Ok(());
     }
+    if super::local_runtime_ledger_is_ignored(root) {
+        return Ok(());
+    }
     let Some(legacy) = read::read_legacy_task_state(root)? else {
         return Ok(());
     };
     let Some(rendered) = render::render_from_ledger(root)? else {
         return Ok(());
     };
+    if super::legacy_completed_projection_covers_local_runtime_ledger(&rendered.state, &legacy) {
+        return Ok(());
+    }
     if legacy != rendered.state {
         errors.push(".naome/task-state.json is stale relative to .naome/tasks/. Run node .naome/bin/naome.js task render-state --write --json before completion or commit.".to_string());
     }

package/crates/naome-core/src/task_ledger.rs

@@ -10,6 +10,7 @@ use std::path::Path;
 use serde_json::Value;
 
 use crate::models::NaomeError;
+use crate::paths;
 
 pub use model::{TaskLedgerProjection, TaskLedgerStatus};
 
@@ -21,10 +22,21 @@ pub fn migrate_task_state_to_ledger(
 }
 
 pub fn read_task_state_projection(root: &Path) -> Result<Option<Value>, NaomeError> {
-    if let Some(projection) = render::render_from_ledger(root)? {
+    let legacy = read::read_legacy_task_state(root)?;
+    if legacy.is_some() && local_runtime_ledger_is_ignored(root) {
+        return Ok(legacy);
+    }
+    let rendered = render::render_from_ledger(root)?;
+    if let (Some(projection), Some(legacy_state)) = (&rendered, &legacy) {
+        if legacy_completed_projection_covers_local_runtime_ledger(&projection.state, legacy_state)
+        {
+            return Ok(Some(legacy_state.clone()));
+        }
+    }
+    if let Some(projection) = rendered {
         return Ok(Some(projection.state));
     }
-    read::read_legacy_task_state(root)
+    Ok(legacy)
 }
 
 pub fn render_task_state_from_ledger(
@@ -46,3 +58,39 @@ pub(crate) fn validate_task_state_projection_is_current(
 ) -> Result<(), NaomeError> {
     write::validate_task_state_projection_is_current(root, errors)
 }
+
+pub(crate) fn legacy_completed_projection_covers_local_runtime_ledger(
+    rendered: &Value,
+    legacy: &Value,
+) -> bool {
+    if state_status(legacy) != Some("complete") || state_status(rendered) != Some("complete") {
+        return false;
+    }
+
+    let Some(legacy_task) = legacy.get("activeTask") else {
+        return false;
+    };
+    let Some(rendered_task) = rendered.get("activeTask") else {
+        return false;
+    };
+
+    has_compact_proof_evidence(legacy_task) && !has_compact_proof_evidence(rendered_task)
+}
+
+pub(crate) fn local_runtime_ledger_is_ignored(root: &Path) -> bool {
+    let ignored_patterns = paths::naomeignore_patterns(root);
+    paths::matches_any(".naome/tasks/active.json", &ignored_patterns)
+}
+
+fn state_status(state: &Value) -> Option<&str> {
+    state.get("status").and_then(Value::as_str)
+}
+
+fn has_compact_proof_evidence(active_task: &Value) -> bool {
+    ["proofResults", "proofBatches"].iter().any(|field| {
+        active_task
+            .get(*field)
+            .and_then(Value::as_array)
+            .is_some_and(|entries| !entries.is_empty())
+    })
+}

package/crates/naome-core/src/task_state/util.rs

@@ -43,18 +43,7 @@ pub(super) fn require_string_array(
     field_name: &str,
     errors: &mut Vec<String>,
 ) {
-    let Some(values) = value.and_then(Value::as_array) else {
-        errors.push(format!("{field_name} must be a non-empty string array."));
-        return;
-    };
-
-    if values.is_empty()
-        || values
-            .iter()
-            .any(|entry| !entry.as_str().is_some_and(is_non_empty_string))
-    {
-        errors.push(format!("{field_name} must be a non-empty string array."));
-    }
+    require_string_array_shape(value, field_name, errors, false);
 }
 
 pub(super) fn require_string_array_allow_empty(
@@ -62,16 +51,31 @@ pub(super) fn require_string_array_allow_empty(
     field_name: &str,
     errors: &mut Vec<String>,
 ) {
+    require_string_array_shape(value, field_name, errors, true);
+}
+
+fn require_string_array_shape(
+    value: Option<&Value>,
+    field_name: &str,
+    errors: &mut Vec<String>,
+    allow_empty: bool,
+) {
+    let label = if allow_empty {
+        "string array"
+    } else {
+        "non-empty string array"
+    };
     let Some(values) = value.and_then(Value::as_array) else {
-        errors.push(format!("{field_name} must be a string array."));
+        errors.push(format!("{field_name} must be a {label}."));
         return;
     };
 
-    if values
+    let invalid_empty = !allow_empty && values.is_empty();
+    let invalid_entry = values
         .iter()
-        .any(|entry| !entry.as_str().is_some_and(is_non_empty_string))
-    {
-        errors.push(format!("{field_name} must be a string array."));
+        .any(|entry| !entry.as_str().is_some_and(is_non_empty_string));
+    if invalid_empty || invalid_entry {
+        errors.push(format!("{field_name} must be a {label}."));
     }
 }
 

package/crates/naome-core/tests/decision.rs

@@ -7,7 +7,7 @@ use serde_json::json;
 
 mod repo_support;
 
-use repo_support::TestRepo;
+use repo_support::{minimal_task_state, TestRepo};
 
 static ENV_LOCK: Mutex<()> = Mutex::new(());
 
@@ -193,13 +193,5 @@ fn online_checks_use_explicit_node_binary_from_environment() {
 }
 
 fn completed_without_proof_state() -> serde_json::Value {
-    json!({
-        "status": "complete",
-        "activeTask": {
-            "id": "readme-task",
-            "allowedPaths": ["README.md"],
-            "requiredCheckIds": ["diff-check"],
-            "proofResults": []
-        }
-    })
+    minimal_task_state("complete", "readme-task", "README.md", "diff-check")
 }

package/crates/naome-core/tests/information_architecture.rs

@@ -21,17 +21,14 @@ fn classifies_naome_information_by_restore_source() {
     assert_eq!(local.restore_policy, "recreate_on_demand");
 
     let proof = classify_information_path(".naome/tasks/readme-task/proofs/diff-check.json");
-    assert_eq!(proof.class, "run_evidence");
-    assert_eq!(proof.commit_policy, "prefer_compact_release_evidence");
-    assert_eq!(
-        proof.restore_policy,
-        "restore_from_ci_or_task_ledger_when_audited"
-    );
+    assert_eq!(proof.class, "local_runtime_state");
+    assert_eq!(proof.commit_policy, "never_commit");
+    assert_eq!(proof.restore_policy, "recreate_on_demand");
 
     let task = classify_information_path(".naome/tasks/readme-task/task.json");
-    assert_eq!(task.class, "durable_task_ledger");
-    assert_eq!(task.commit_policy, "commit");
-    assert_eq!(task.restore_policy, "restore_from_repository");
+    assert_eq!(task.class, "local_runtime_state");
+    assert_eq!(task.commit_policy, "never_commit");
+    assert_eq!(task.restore_policy, "recreate_on_demand");
 }
 
 #[test]
@@ -54,5 +51,5 @@ fn reports_information_architecture_contract_for_agents() {
     assert!(report
         .rules
         .iter()
-        .any(|rule| rule.path_pattern == ".naome/tasks/*/proofs/*.json"));
+        .any(|rule| rule.path_pattern == ".naome/tasks/**" && rule.class == "local_runtime_state"));
 }

package/crates/naome-core/tests/install_plan.rs

@@ -30,6 +30,7 @@ fn install_plan_includes_git_exclude_and_untrack_policy() {
         .contains(&".naome/task-journal.jsonl"));
     assert!(plan.git_exclude_entries.contains(&".naome/archive/"));
     assert!(plan.git_exclude_entries.contains(&".naome/cache/"));
+    assert!(plan.git_exclude_entries.contains(&".naome/tasks/"));
     assert!(plan.git_exclude_entries.contains(&".naome/bin/naome-rust*"));
     assert!(plan
         .git_exclude_entries
@@ -39,6 +40,7 @@ fn install_plan_includes_git_exclude_and_untrack_policy() {
         .contains(&".naome/bin/check-harness-health.js"));
     assert!(plan.git_untrack_paths.contains(&".naome/archive"));
     assert!(plan.git_untrack_paths.contains(&".naome/cache"));
+    assert!(plan.git_untrack_paths.contains(&".naome/tasks"));
     assert!(plan.git_untrack_paths.contains(&".naome/bin/naome-rust"));
     assert!(plan
         .git_untrack_paths

package/crates/naome-core/tests/quality_structure_support/mod.rs

@@ -1,3 +1,5 @@
+#![allow(dead_code)]
+
 use std::fs;
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -126,31 +128,10 @@ impl StructureFixture {
 #[allow(dead_code)]
 impl StructureFixture {
     pub fn write_structure_config(&self, overrides: serde_json::Value) {
-        let mut config = json!({
-            "schema": "naome.repository-structure.v1",
-            "version": 1,
-            "status": "ready",
-            "enabledAdapters": [],
-            "sourceRoots": ["src/**"],
-            "testRoots": ["tests/**", "test/**"],
-            "docsRoots": ["docs/**"],
-            "generatedRoots": ["**/generated/**"],
-            "artifactRoots": ["dist/**", "build/**"],
-            "moduleRoots": ["src/**"],
-            "allowedRootFiles": ["README.md", "LICENSE", "package.json", "Cargo.toml"],
-            "directoryRoleRules": [],
-            "layerRules": [],
-            "ignoredPaths": [],
-            "disabledChecks": [],
-            "changedCodePolicy": "block",
-            "debtPolicy": "report",
-            "limits": {
-                "maxDirectoryFiles": 40,
-                "maxPathDepth": 10,
-                "maxDirectoryRoles": 2,
-                "maxDumpingGroundFiles": 8
-            }
-        });
+        let mut config: serde_json::Value = serde_json::from_str(include_str!(
+            "../../../../templates/naome-root/.naome/repository-structure.json"
+        ))
+        .unwrap();
         merge(&mut config, overrides);
         self.write(
             ".naome/repository-structure.json",

package/crates/naome-core/tests/repo_support/mod.rs

@@ -14,10 +14,8 @@ pub use routes::{
     try_route_readme_task,
 };
 pub use verification_values::{
-    change_type, check_missing_last_verified_fixture, diff_check,
+    change_type, check_missing_last_verified_fixture, diff_check, minimal_task_state,
     placeholder_verification_contract_fixture, quality_check, repo_docs_verification_fixture,
-    repository_quality_config_source,
-    repository_quality_config_value, repository_semantic_check,
-    semantic_repository_quality_fixture_source,
-    verification_value,
+    repository_quality_config_source, repository_quality_config_value, repository_semantic_check,
+    semantic_repository_quality_fixture_source, verification_value,
 };

package/crates/naome-core/tests/repo_support/repo_helpers.rs

@@ -3,6 +3,7 @@ use std::fs;
 use serde_json::json;
 
 use super::repo::TestRepo;
+use super::verification_values::minimal_task_state;
 
 impl TestRepo {
     pub fn product_quality_repo(name: &str) -> Self {
@@ -69,15 +70,7 @@ impl TestRepo {
     pub fn write_implementing_task_state(&self, allowed_path: &str, check_id: &str) {
         self.write_naome_json(
             "task-state.json",
-            json!({
-                "status": "implementing",
-                "activeTask": {
-                    "id": "rust-task",
-                    "allowedPaths": [allowed_path],
-                    "requiredCheckIds": [check_id],
-                    "proofResults": []
-                }
-            }),
+            minimal_task_state("implementing", "rust-task", allowed_path, check_id),
         );
     }
 

package/crates/naome-core/tests/repo_support/verification.rs

@@ -15,14 +15,7 @@ impl TestRepo {
         self.write_naome_json("upgrade-state.json", json!({ "status": "complete" }));
         self.write_naome_json(
             "verification.json",
-            json!({
-                "schema": "naome.verification.v1",
-                "version": 1,
-                "status": "ready",
-                "checks": [diff_check(vec!["README.md"])],
-                "changeTypes": [],
-                "releaseGates": []
-            }),
+            verification_value("ready", vec![diff_check(vec!["README.md"])], vec![]),
         );
         self.write_naome_json("task-state.json", task_state);
     }

package/crates/naome-core/tests/repo_support/verification_values.rs

@@ -74,28 +74,30 @@ pub fn verification_value(
     })
 }
 
-pub fn repository_quality_config_value() -> serde_json::Value {
+pub fn minimal_task_state(
+    status: &str,
+    task_id: &str,
+    allowed_path: &str,
+    check_id: &str,
+) -> serde_json::Value {
     json!({
-        "schema": "naome.repository-quality.v1",
-        "version": 1,
-        "status": "ready",
-        "limits": {
-            "maxFileLines": 450,
-            "maxNewFileLines": 300,
-            "maxDiffAddedLines": 180,
-            "maxFunctionLines": 100,
-            "maxTopLevelSymbols": 30,
-            "duplicateBlockLines": 10,
-            "nearDuplicateSimilarity": 0.9
-        },
-        "enabledAdapters": [],
-        "disabledChecks": [],
-        "ignoredPaths": [],
-        "generatedPaths": [],
-        "pathRules": []
+        "status": status,
+        "activeTask": {
+            "id": task_id,
+            "allowedPaths": [allowed_path],
+            "requiredCheckIds": [check_id],
+            "proofResults": []
+        }
     })
 }
 
+pub fn repository_quality_config_value() -> serde_json::Value {
+    serde_json::from_str(include_str!(
+        "../../../../templates/naome-root/.naome/repository-quality.json"
+    ))
+    .unwrap()
+}
+
 pub fn repository_quality_config_source() -> String {
     format!(
         "{}\n",

package/crates/naome-core/tests/task_ledger.rs

@@ -190,6 +190,70 @@ fn task_state_validation_reports_stale_rendered_projection_when_ledger_exists()
     }));
 }
 
+#[test]
+fn ignored_local_runtime_ledger_does_not_stale_committed_projection() {
+    let repo = TestRepo::new("ignored-runtime-ledger");
+    repo.init_git();
+    repo.write_file(".naomeignore", ".naome/archive/\n.naome/tasks/\n");
+    repo.write_file("README.md", "# Baseline\n");
+    repo.write_base_harness(Some(idle_state()));
+    repo.git(&["add", "."]);
+    repo.git(&["commit", "-m", "baseline"]);
+    let head = repo.git_stdout(&["rev-parse", "HEAD"]);
+    repo.write_complete_ledger(&head);
+    repo.write_naome_json("task-state.json", compact_complete_state(&head));
+    repo.write_file("README.md", "# Changed\n");
+
+    let report = validate_task_state(repo.path(), TaskStateOptions::default()).unwrap();
+
+    assert!(report.errors.is_empty(), "{:?}", report.errors);
+}
+
+#[test]
+fn compact_completed_task_state_survives_incomplete_local_runtime_ledger() {
+    let repo = TestRepo::new("compact-over-runtime-ledger");
+    repo.init_git();
+    repo.write_file("README.md", "# Baseline\n");
+    repo.write_base_harness(Some(idle_state()));
+    repo.git(&["add", "."]);
+    repo.git(&["commit", "-m", "baseline"]);
+    let head = repo.git_stdout(&["rev-parse", "HEAD"]);
+    repo.write_naome_json("task-state.json", compact_complete_state(&head));
+    repo.write_file(
+        ".naome/tasks/active.json",
+        &format_json(object([
+            ("schema", json!("naome.task-ledger-active.v1")),
+            ("version", json!(1)),
+            ("primaryTaskId", json!("old-local-task")),
+            (
+                "worklanes",
+                json!([{ "id": "default", "taskId": "old-local-task", "status": "active" }]),
+            ),
+        ])),
+    );
+    repo.write_file(
+        ".naome/tasks/old-local-task/task.json",
+        &format_json(task_spec_record_with_id(&head, "old-local-task")),
+    );
+    repo.write_file(
+        ".naome/tasks/old-local-task/events.jsonl",
+        concat!(
+            "{\"schema\":\"naome.task-ledger-event.v1\",\"type\":\"status\",\"status\":\"implementing\",\"recordedAt\":\"2026-05-08T00:00:01.000Z\"}\n",
+            "{\"schema\":\"naome.task-ledger-event.v1\",\"type\":\"status\",\"status\":\"complete\",\"recordedAt\":\"2026-05-08T00:00:02.000Z\"}\n"
+        ),
+    );
+    repo.write_file("README.md", "# Changed\n");
+
+    let projected = read_task_state_projection(repo.path()).unwrap().unwrap();
+
+    assert_eq!(
+        projected["activeTask"]["proofBatches"][0]["proofs"][0]["checkId"],
+        "diff-check"
+    );
+    let report = validate_task_state(repo.path(), TaskStateOptions::default()).unwrap();
+    assert!(report.errors.is_empty(), "{:?}", report.errors);
+}
+
 trait LedgerHarness {
     fn write_base_harness(&self, task_state: Option<Value>);
     fn write_complete_ledger(&self, admission_head: &str);
@@ -298,10 +362,14 @@ fn compact_active_task(admission_head: &str) -> Value {
 }
 
 fn task_spec_record(admission_head: &str) -> Value {
+    task_spec_record_with_id(admission_head, "readme-task")
+}
+
+fn task_spec_record_with_id(admission_head: &str, task_id: &str) -> Value {
     object([
         ("schema", json!("naome.task-ledger-task.v1")),
         ("version", json!(1)),
-        ("id", json!("readme-task")),
+        ("id", json!(task_id)),
         ("request", json!("Update README.")),
         ("userPrompt", user_prompt()),
         ("admission", admission_record(admission_head)),

package/crates/naome-core/tests/task_state_compact_support/states.rs

@@ -129,14 +129,16 @@ fn base_state(admission_head: &str, proof_payload: Value) -> Value {
     task.as_object_mut()
         .unwrap()
         .extend(proof_payload.as_object().unwrap().clone());
-    json!({
-        "schema": "naome.task-state.v2",
-        "version": 2,
-        "status": "complete",
-        "activeTask": task,
-        "blocker": null,
-        "updatedAt": T0
-    })
+    let mut state: Value = serde_json::from_str(include_str!(
+        "../../../../templates/naome-root/.naome/task-state.json"
+    ))
+    .unwrap();
+    state["schema"] = json!("naome.task-state.v2");
+    state["version"] = json!(2);
+    state["status"] = json!("complete");
+    state["activeTask"] = task;
+    state["updatedAt"] = json!(T0);
+    state
 }
 
 fn proof(check_id: &str, command: &str, cwd: &str) -> Value {

package/crates/naome-core/tests/task_state_support/states.rs

@@ -13,14 +13,14 @@ pub fn complete_task_state(overrides: Value) -> Value {
 }
 
 fn task_state_record(status: &str, active_task: Value, updated_at: Value) -> Value {
-    json!({
-        "schema": "naome.task-state.v1",
-        "version": 1,
-        "status": status,
-        "activeTask": active_task,
-        "blocker": null,
-        "updatedAt": updated_at
-    })
+    let mut state: Value = serde_json::from_str(include_str!(
+        "../../../../templates/naome-root/.naome/task-state.json"
+    ))
+    .unwrap();
+    state["status"] = json!(status);
+    state["activeTask"] = active_task;
+    state["updatedAt"] = updated_at;
+    state
 }
 
 pub fn active_task(overrides: Value) -> Value {

package/crates/naome-core/tests/workflow_support/mod.rs

@@ -1,3 +1,5 @@
+#![allow(dead_code)]
+
 use std::fs;
 use std::path::{Path, PathBuf};
 use std::process::Command;

package/installer/flows.js

@@ -1,3 +1,5 @@
+import { posix } from "node:path";
+
 import { ensureArchiveDirectory, copyTemplateFile, walk } from "./filesystem.js";
 import {
   ensureBuiltInVerificationChecks,
@@ -19,7 +21,7 @@ import { printError } from "./output.js";
 import { compareVersions } from "./version.js";
 import { confirmAgentsTakeover, takeoverExistingAgents } from "./agents.js";
 
-const legacyCodexHookPaths = [
+const legacyOptionalHookPaths = [
   ".codex/config.toml",
   ".codex/hooks.json",
   ".naome/bin/codex-hook-io.js",
@@ -63,10 +65,14 @@ export async function runExistingInstall(ctx, existingInstall) {
     }
 
     ensureArchiveDirectory(ctx);
-    await runRepair(ctx, existingInstall.version, { fromVersion: existingInstall.version });
+    await runRepair(ctx, existingInstall.version, {
+      existingManifest: existingInstall.manifest,
+      fromVersion: existingInstall.version,
+      retireLegacyOptionalHooks: true,
+    });
   } else {
     ensureArchiveDirectory(ctx);
-    await runRepair(ctx, existingInstall.version);
+    await runRepair(ctx, existingInstall.version, { existingManifest: existingInstall.manifest });
   }
 }
 
@@ -89,14 +95,57 @@ async function runRepair(ctx, version, options = {}) {
   ensureBuiltInVerificationChecks(ctx);
   ensureTestingProofHarnessSections(ctx);
   ensureRepositoryStructurePolicyFiles(ctx);
-  removeLegacyCodexHookFiles(ctx, `repair-${version}`);
+  removeRetiredMachineOwnedFiles(ctx, options.existingManifest, `repair-${version}`, {
+    extraPaths: options.retireLegacyOptionalHooks ? legacyOptionalHookPaths : [],
+  });
   refreshManifestHealthMetadata(ctx);
   ensureCompleteUpgradeState(ctx, options.fromVersion ?? null);
   ensureLocalOnlySourceControlBoundary(ctx);
 }
 
-function removeLegacyCodexHookFiles(ctx, archiveDirName) {
-  for (const relativePath of legacyCodexHookPaths) {
+function removeRetiredMachineOwnedFiles(ctx, manifest, archiveDirName, options = {}) {
+  const currentOwnedPaths = new Set([
+    ...ctx.machineOwnedPaths,
+    ...ctx.projectOwnedPaths,
+    ...ctx.localOnlyMachineOwnedPaths,
+    ctx.nativeBinaryRelativePath,
+  ].filter(Boolean));
+  const retiredPaths = [
+    ...(Array.isArray(manifest?.machineOwned) ? manifest.machineOwned : []),
+    ...(Array.isArray(options.extraPaths) ? options.extraPaths : []),
+  ];
+
+  for (const relativePath of [...new Set(retiredPaths)]) {
+    if (!isSafeManifestPath(relativePath)) {
+      const pathLabel = String(relativePath);
+      ctx.skipped.push(pathLabel);
+      ctx.unsafeSkipped.push(pathLabel);
+      continue;
+    }
+
+    if (currentOwnedPaths.has(relativePath)) {
+      continue;
+    }
+
     removeLegacyHarnessFile(ctx, relativePath, archiveDirName);
   }
 }
+
+function isSafeManifestPath(relativePath) {
+  if (
+    typeof relativePath !== "string" ||
+    relativePath.length === 0 ||
+    relativePath.includes("\0") ||
+    relativePath.includes("\\") ||
+    relativePath.includes(":")
+  ) {
+    return false;
+  }
+
+  if (posix.isAbsolute(relativePath)) {
+    return false;
+  }
+
+  const normalizedPath = posix.normalize(relativePath);
+  return normalizedPath === relativePath && normalizedPath !== "." && !normalizedPath.startsWith("../");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.3.5",
+  "version": "1.3.7",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "Apache-2.0",
   "type": "module",
@@ -10,7 +10,6 @@
     "ai",
     "harness",
     "repository",
-    "codex",
     "claude"
   ],
   "repository": {

package/templates/naome-root/.naome/manifest.json

@@ -8,12 +8,12 @@
     ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
     ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
     "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",
-    "docs/naome/agent-workflow.md": "sha256:2fd1fd02eb6849133b9e8227421914580b1c469a60388a063c1b6ed48016b48d",
+    "docs/naome/agent-workflow.md": "sha256:cbef6dee1543b4c74111f8dc23e81a5bf092a9585a342504678bfc9c9d0655ea",
     "docs/naome/context-economy.md": "sha256:3ed5075815ecf4ada46a5e65438769310307c35759fcd46b13dc0b96e02bebd9",
     "docs/naome/execution.md": "sha256:bfc5d55838942ec8e3d790b59e3c634ff5bf6a2298265cef3dca9788a097eafb",
     "docs/naome/first-run.md": "sha256:1466ce8c65e19a1514885f917db14e8a772350e3f6d1c03a66326963365919e1",
     "docs/naome/index.md": "sha256:07ef776f49130319a5280bdb3ae38af22141708253f38eb983a4336fbae1b25a",
-    "docs/naome/task-ledger.md": "sha256:ac637a31abdd13eee15a49086594e63f5c88fe12a5cf621b227310788ae7e583",
+    "docs/naome/task-ledger.md": "sha256:6ca7222c80079b4662fb718d3c71d686770646f1fa52b83b0e90aed1c5a1101b",
     "docs/naome/upgrade.md": "sha256:2c60f0441bbd98bd528d109b30a7ded4b0ad55d61ffb9f52edac9e93b7999cb1"
   },
   "machineOwned": [

package/templates/naome-root/.naomeignore

@@ -3,3 +3,4 @@
 
 .naome/archive/
 .naome/cache/
+.naome/tasks/

package/templates/naome-root/docs/naome/agent-workflow.md

@@ -110,22 +110,20 @@ Use this workflow after first-run intake is complete.
 1. Identify changed files.
 2. Match them against `.naome/verification.json`.
 3. Run the required checks when available.
-4. Prefer ledger-backed task updates. `naome sync` migrates active legacy
+4. Prefer local ledger-backed task updates. `naome sync` migrates active legacy
    task-state automatically; if a legacy-only active task is still present, run
    `node .naome/bin/naome.js task migrate-ledger --write --json` before adding
    completion proof.
-5. Record proof as compact `proofPathSets` and `proofBatches` in
-   `.naome/tasks/<task-id>/task.json` when many checks share evidence paths.
-   Use `.naome/tasks/<task-id>/proofs/` only when separate per-check files are
-   needed for parallel writers or durable audit detail. If legacy compatibility
-   work is unavoidable, use the same compact fields in `.naome/task-state.json`
-   and include every changed in-scope path reported by git in expanded proof
-   evidence.
+5. Record proof as compact `proofPathSets` and `proofBatches` in the local
+   ledger when many checks share evidence paths. Use local per-check proof files
+   only when separate writers need them during the run. The committed release
+   artifact is `.naome/task-state.json`; include every changed in-scope path
+   reported by git in expanded proof evidence.
 6. Run `node .naome/bin/naome.js task render-state --write --json` before
    external compatibility checks. Do not hand-edit the rendered projection when
    `.naome/tasks/active.json` exists.
-7. Do not list `.naome/task-state.json` or `.naome/tasks/` as task scope or
-   proof evidence.
+7. Do not list `.naome/task-state.json` or local task runtime folders as task
+   scope or proof evidence.
 8. Stop tracked long-running processes or mark them explicitly allowed in
    `.naome/processes.json`.
 9. Set task status to `complete` in the ledger event stream or legacy task

package/templates/naome-root/docs/naome/architecture.md

@@ -8,16 +8,16 @@ Status: Uninitialized
 
 ## Known Boundaries
 
-- NAOME information falls into durable project state, durable task ledger,
-  generated projection, local runtime state, run evidence, and product source.
+- NAOME information falls into durable project state, generated projection,
+  local runtime state, run evidence, and product source.
 - Durable project state is committed repository or package state needed to
   reinstall or reconstruct the harness.
-- `.naome/task-state.json` is a generated compatibility projection when
-  `.naome/tasks/active.json` exists. Render it from the ledger instead of
-  hand-editing it.
-- `.naome/tmp/` is local runtime state and must not be committed.
-- Per-check proof files are run evidence. Prefer compact ledger proof batches
-  when many release checks share the same evidence paths.
+- `.naome/task-state.json` is the committed compact task-state projection.
+- `.naome/tmp/` and `.naome/tasks/` are local runtime state and must not be
+  committed.
+- Per-check proof files are local run evidence. Prefer compact proof batches in
+  the committed task-state projection when many release checks share the same
+  evidence paths.
 
 ## Assumed Boundaries
 

package/templates/naome-root/docs/naome/task-ledger.md

@@ -1,8 +1,9 @@
 # Task Ledger
 
-NAOME task state is moving from one mutable aggregate file to a canonical task
-ledger. The compatibility file `.naome/task-state.json` remains supported, but
-new deterministic task tooling can use `.naome/tasks/` as the source of truth.
+NAOME task state is moving from one mutable aggregate file to a local task
+ledger. The compatibility file `.naome/task-state.json` remains the compact
+committed projection, while `.naome/tasks/` is machine-local runtime state for
+efficient task updates.
 
 ## Layout
 
@@ -33,9 +34,10 @@ new deterministic task tooling can use `.naome/tasks/` as the source of truth.
 ## Compatibility
 
 Existing `naome.task-state.v1` and `naome.task-state.v2` files remain valid. If
-`.naome/tasks/active.json` exists, NAOME readers build a canonical task model
-from the ledger and render a `naome.task-state.v2` projection. If no ledger is
-present, readers fall back to `.naome/task-state.json`.
+a current local ledger exists, NAOME readers build a canonical task model from
+it and render a `naome.task-state.v2` projection. If no local ledger is present,
+or an older local completed ledger lacks proof detail that the committed compact
+projection still has, readers fall back to `.naome/task-state.json`.
 
 Use this command when an external tool needs the compatibility file refreshed:
 
@@ -44,21 +46,22 @@ node .naome/bin/naome.js task render-state --write --json
 ```
 
 `naome sync` automatically splits an active legacy `task-state` file into the
-ledger layout. The explicit command remains available for repair or tests:
+local ledger layout. The explicit command remains available for repair or
+tests:
 
 ```text
 node .naome/bin/naome.js task migrate-ledger --write --json
 ```
 
 After `.naome/tasks/active.json` exists, `.naome/task-state.json` is a rendered
-compatibility projection. NAOME gates reject a stale projection and report the
-render command instead of accepting hand-edited aggregate state.
+compatibility projection. NAOME gates reject a stale active projection and
+report the render command instead of accepting hand-edited aggregate state.
 
 ## Conflict Policy
 
-`.naome/tasks/` is NAOME control state. It is not task feature scope and is not
-required as proof evidence. Gates ignore ledger control files when checking
-whether product changes stay inside `allowedPaths`.
+`.naome/tasks/` is local NAOME runtime state. It is ignored, untracked by
+`naome sync`, and not task feature scope or proof evidence. Gates ignore ledger
+control files when checking whether product changes stay inside `allowedPaths`.
 
 The intended long-term model is:
 
@@ -76,8 +79,8 @@ instead of all competing for `.naome/task-state.json`.
 ## Information Policy
 
 Use `node .naome/bin/naome.js workflow information --path <path> --json` before
-changing NAOME control files whose retention is unclear. Durable configuration,
-templates, task specs, and task events are restored from repository or package
-state. `.naome/task-state.json` is generated from durable state. `.naome/tmp/`
-is local runtime state. Per-check proof files are run evidence; compact release
-proof batches keep release diffs readable without losing verification coverage.
+changing NAOME control files whose retention is unclear. Durable configuration
+and templates are restored from repository or package state.
+`.naome/task-state.json` is the committed compact task projection. `.naome/tmp/`
+and `.naome/tasks/` are local runtime state. Compact release proof batches keep
+release diffs readable without tracking per-task runtime folders.