@mc-and-his-agents/loom-installer 0.1.112 → 0.1.113

package/payload/plugin/loom/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py

@@ -4336,6 +4336,28 @@ def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
             if pr_template:
                 (target / ".github" / "PULL_REQUEST_TEMPLATE.md").write_text("## Summary\n", encoding="utf-8")
 
+        attach_only_forbidden_patterns = (
+            ".loom/work-items/**",
+            ".loom/progress/**",
+            ".loom/status/current.md",
+            ".loom/reviews/**",
+            ".loom/specs/**",
+        )
+
+        def matches_forbidden(path: str, pattern: str) -> bool:
+            if pattern.endswith("/**"):
+                prefix = pattern[:-3]
+                return path == prefix or path.startswith(prefix + "/")
+            return path == pattern
+
+        def forbidden_match(path: object) -> str | None:
+            if not isinstance(path, str):
+                return None
+            for pattern in attach_only_forbidden_patterns:
+                if matches_forbidden(path, pattern):
+                    return pattern
+            return None
+
         deep_target = tmp_root / "deep-existing"
         write_repo(deep_target, validation_entry=True, pr_template=True, workflow_doc=True)
         deep_dry_payload, deep_dry_error = load_command_json(
@@ -4356,6 +4378,8 @@ def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
             intent = deep_dry_payload.get("adoption_intent")
             risk = deep_dry_payload.get("risk_summary")
             planned = deep_dry_payload.get("planned_writes")
+            required = deep_dry_payload.get("required_carriers")
+            forbidden = deep_dry_payload.get("forbidden_authored_carriers")
             detected = deep_dry_payload.get("detected_repository_mode")
             write = deep_dry_payload.get("write")
             if not isinstance(intent, dict) or intent.get("effective") != "attach-only":
@@ -4364,6 +4388,18 @@ def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
                 failures.append(Failure("deep-existing-bootstrap", "`deep-existing dry-run` must report preserved repo-owned truth risk"))
             if not isinstance(planned, list) or not planned:
                 failures.append(Failure("deep-existing-bootstrap", "`deep-existing dry-run` must report planned write targets"))
+            else:
+                for item in planned:
+                    if isinstance(item, dict):
+                        pattern = forbidden_match(item.get("path"))
+                        if pattern:
+                            failures.append(Failure("deep-existing-bootstrap", f"`deep-existing dry-run` planned write must not match forbidden carrier `{pattern}`"))
+            if not isinstance(required, list) or not required:
+                failures.append(Failure("deep-existing-bootstrap", "`deep-existing dry-run` must report required carriers"))
+            if not isinstance(forbidden, list) or {
+                item.get("path") for item in forbidden if isinstance(item, dict)
+            } != set(attach_only_forbidden_patterns):
+                failures.append(Failure("deep-existing-bootstrap", "`deep-existing dry-run` must report the full attach-only forbidden carrier list"))
             if not isinstance(detected, dict) or detected.get("scenario_key") != "complex-existing":
                 failures.append(Failure("deep-existing-bootstrap", "`deep-existing dry-run` must report detected repository mode"))
             if not isinstance(write, dict) or write.get("enabled") is not False:
@@ -4391,6 +4427,7 @@ def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
             recommended = deep_payload.get("recommended_adoption")
             verification = deep_payload.get("verification")
             governance_surface = deep_payload.get("governance_surface")
+            repo_interface_path = deep_target / ".loom/companion/repo-interface.json"
             if not isinstance(recommended, dict) or recommended.get("path") != "deep-existing-repo":
                 failures.append(Failure("deep-existing-bootstrap", "`deep-existing bootstrap` must select `recommended_adoption.path = deep-existing-repo`"))
             run = deep_payload.get("run")
@@ -4413,12 +4450,79 @@ def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
                 ".loom/work-items/INIT-0001.md",
                 ".loom/progress/INIT-0001.md",
                 ".loom/status/current.md",
+                ".loom/reviews/INIT-0001.json",
+                ".loom/specs/INIT-0001/spec.md",
             ):
                 if (deep_target / forbidden).exists():
                     failures.append(Failure("deep-existing-bootstrap", f"`deep-existing bootstrap` must not generate `{forbidden}`"))
             fact_chain = deep_payload.get("fact_chain")
             if not isinstance(fact_chain, dict) or fact_chain.get("mode") != "repo-native attach-only":
                 failures.append(Failure("deep-existing-bootstrap", "`deep-existing bootstrap` must keep `fact_chain.mode = repo-native attach-only`"))
+            if repo_interface_path.exists():
+                repo_interface = json.loads(repo_interface_path.read_text(encoding="utf-8"))
+                host_truth = repo_interface.get("host_truth_locators")
+                if not isinstance(host_truth, dict) or set(host_truth.keys()) != {"work_item", "project_status", "review", "closeout"}:
+                    failures.append(Failure("deep-existing-bootstrap", "`deep-existing bootstrap` repo-interface must declare attach-only host truth locators"))
+
+        poisoned_files_target = tmp_root / "deep-existing-poison-files"
+        if deep_target.exists() and (deep_target / ".loom/bin/loom_init.py").exists():
+            shutil.copytree(deep_target, poisoned_files_target)
+            (poisoned_files_target / ".loom/reviews").mkdir(parents=True, exist_ok=True)
+            (poisoned_files_target / ".loom/specs/EXISTING").mkdir(parents=True, exist_ok=True)
+            (poisoned_files_target / ".loom/reviews/EXISTING.json").write_text("{}", encoding="utf-8")
+            (poisoned_files_target / ".loom/specs/EXISTING/spec.md").write_text("# Existing Spec\n", encoding="utf-8")
+            poisoned_payload, poisoned_error = load_command_json(
+                root,
+                [
+                    "python3",
+                    str(poisoned_files_target / ".loom/bin/loom_init.py"),
+                    "verify",
+                    "--target",
+                    str(poisoned_files_target),
+                ],
+            )
+            if poisoned_error:
+                failures.append(Failure("deep-existing-bootstrap", f"`attach-only forbidden file verify` failed: {poisoned_error}"))
+            else:
+                errors_text = json.dumps(poisoned_payload.get("errors", []), ensure_ascii=False) if poisoned_payload else ""
+                if poisoned_payload.get("ok") is not False:
+                    failures.append(Failure("deep-existing-bootstrap", "`attach-only forbidden file verify` must fail closed"))
+                if "forbidden authored carrier" not in errors_text or "second truth chain" not in errors_text:
+                    failures.append(Failure("deep-existing-bootstrap", "`attach-only forbidden file verify` must explain the second truth-chain risk"))
+
+        poisoned_decl_target = tmp_root / "deep-existing-poison-declarations"
+        if deep_target.exists() and (deep_target / ".loom/bin/loom_init.py").exists():
+            shutil.copytree(deep_target, poisoned_decl_target)
+            init_result_path = poisoned_decl_target / ".loom/bootstrap/init-result.json"
+            manifest_path = poisoned_decl_target / ".loom/bootstrap/manifest.json"
+            init_result = json.loads(init_result_path.read_text(encoding="utf-8"))
+            init_result.setdefault("planned_writes", []).append(
+                {"path": ".loom/work-items/POISON.md", "kind": "work-item", "owner": "loom"}
+            )
+            init_result_path.write_text(json.dumps(init_result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+            manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+            manifest.setdefault("artifacts", []).append(
+                {"path": ".loom/progress/POISON.md", "kind": "progress", "source": "generated"}
+            )
+            manifest_path.write_text(json.dumps(manifest, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+            poisoned_payload, poisoned_error = load_command_json(
+                root,
+                [
+                    "python3",
+                    str(poisoned_decl_target / ".loom/bin/loom_init.py"),
+                    "verify",
+                    "--target",
+                    str(poisoned_decl_target),
+                ],
+            )
+            if poisoned_error:
+                failures.append(Failure("deep-existing-bootstrap", f"`attach-only forbidden declaration verify` failed: {poisoned_error}"))
+            else:
+                errors_text = json.dumps(poisoned_payload.get("errors", []), ensure_ascii=False) if poisoned_payload else ""
+                if poisoned_payload.get("ok") is not False:
+                    failures.append(Failure("deep-existing-bootstrap", "`attach-only forbidden declaration verify` must fail closed"))
+                if "planned_writes" not in errors_text or "manifest.artifacts" not in errors_text:
+                    failures.append(Failure("deep-existing-bootstrap", "`attach-only forbidden declaration verify` must name poisoned declaration sources"))
 
         full_target = tmp_root / "full-bootstrap"
         write_repo(full_target, validation_entry=False, pr_template=False, workflow_doc=False)
@@ -4489,6 +4593,8 @@ def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
                 ".loom/work-items/INIT-0001.md",
                 ".loom/progress/INIT-0001.md",
                 ".loom/status/current.md",
+                ".loom/reviews/INIT-0001.json",
+                ".loom/specs/INIT-0001/spec.md",
             ):
                 if not (explicit_full_target / required).exists():
                     failures.append(Failure("deep-existing-bootstrap", f"`explicit execution-control bootstrap sample` must generate `{required}`"))

package/payload/plugin/loom/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_init.py

@@ -46,6 +46,55 @@ SCAFFOLD_PROFILES = (
     "execution-control",
     "strong-governance",
 )
+ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS = (
+    {
+        "path": ".loom/work-items/**",
+        "reason": "attach-only preserves host-owned work item truth",
+        "remediation": "migrate the item to a host truth locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+    {
+        "path": ".loom/progress/**",
+        "reason": "attach-only preserves host-owned recovery/progress truth",
+        "remediation": "migrate recovery state to a host truth locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+    {
+        "path": ".loom/status/current.md",
+        "reason": "attach-only preserves host-owned project status truth",
+        "remediation": "migrate status to a host truth locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+    {
+        "path": ".loom/reviews/**",
+        "reason": "attach-only preserves host-owned PR review or guardian truth",
+        "remediation": "migrate review truth to a host truth locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+    {
+        "path": ".loom/specs/**",
+        "reason": "attach-only does not author Loom spec truth unless the repo explicitly upgrades intent",
+        "remediation": "migrate spec truth to a host locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+)
+ATTACH_ONLY_HOST_TRUTH_LOCATORS = {
+    "work_item": {
+        "host_surface": "github_issue",
+        "locator": "repo-owned issue tracker",
+        "mode": "host_truth_locator",
+    },
+    "project_status": {
+        "host_surface": "github_project",
+        "locator": "repo-owned project board or status system",
+        "mode": "host_truth_locator",
+    },
+    "review": {
+        "host_surface": "pull_request_review_or_guardian",
+        "locator": "repo-owned PR review, guardian, or review gate",
+        "mode": "host_truth_locator",
+    },
+    "closeout": {
+        "host_surface": "pull_request_metadata_and_issue_state",
+        "locator": "repo-owned PR metadata plus issue state",
+        "mode": "host_truth_locator",
+    },
+}
 
 RUNTIME_ARTIFACT_SOURCES = {
     ".loom/bin/loom_init.py": RUNTIME_SOURCE,
@@ -751,6 +800,160 @@ def profile_writes_artifacts(profile: str) -> bool:
     return profile not in {"observe-only", "skill-install-only"}
 
 
+def forbidden_authored_carriers(profile: str) -> list[dict[str, str]]:
+    if profile != "attach-only":
+        return []
+    return [dict(carrier) for carrier in ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS]
+
+
+def required_carriers_for_profile(artifacts: list[dict[str, str]], profile: str) -> list[dict[str, str]]:
+    if profile in {"observe-only", "skill-install-only"}:
+        return []
+    return [
+        {
+            "path": artifact["path"],
+            "kind": artifact["kind"],
+            "owner": write_owner_for_path(artifact["path"]),
+        }
+        for artifact in artifacts
+        if isinstance(artifact.get("path"), str) and isinstance(artifact.get("kind"), str)
+    ]
+
+
+def normalize_relative_path(raw_path: object) -> str | None:
+    if not isinstance(raw_path, str) or not raw_path:
+        return None
+    normalized = raw_path.replace("\\", "/")
+    while normalized.startswith("./"):
+        normalized = normalized[2:]
+    if normalized.startswith("/") or normalized.startswith("../") or "/../" in normalized:
+        return None
+    return normalized
+
+
+def matches_forbidden_authored_carrier(relative_path: str, pattern: str) -> bool:
+    if pattern.endswith("/**"):
+        prefix = pattern[:-3]
+        return relative_path == prefix or relative_path.startswith(prefix + "/")
+    return relative_path == pattern
+
+
+def forbidden_authored_carrier_for_path(relative_path: str) -> dict[str, str] | None:
+    for carrier in ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS:
+        pattern = carrier["path"]
+        if matches_forbidden_authored_carrier(relative_path, pattern):
+            return carrier
+    return None
+
+
+def collect_forbidden_authored_carrier_declarations(result: dict[str, object]) -> list[dict[str, str]]:
+    declarations: list[dict[str, str]] = []
+
+    def add(raw_path: object, source: str) -> None:
+        relative = normalize_relative_path(raw_path)
+        if relative is None:
+            return
+        carrier = forbidden_authored_carrier_for_path(relative)
+        if carrier is not None:
+            declarations.append({"path": relative, "pattern": carrier["path"], "source": source})
+
+    for key in ("initial_artifacts", "planned_writes"):
+        entries = result.get(key)
+        if isinstance(entries, list):
+            for entry in entries:
+                if isinstance(entry, dict):
+                    add(entry.get("path"), key)
+    work_items = result.get("initial_work_items")
+    if isinstance(work_items, list):
+        for work_item in work_items:
+            if not isinstance(work_item, dict):
+                continue
+            artifacts = work_item.get("artifacts")
+            if isinstance(artifacts, list):
+                for artifact in artifacts:
+                    add(artifact, "initial_work_items.artifacts")
+    write = result.get("write")
+    if isinstance(write, dict):
+        touched = write.get("touched")
+        if isinstance(touched, list):
+            for path in touched:
+                add(path, "write.touched")
+    return declarations
+
+
+def collect_forbidden_authored_carrier_files(target_root: Path) -> list[dict[str, str]]:
+    found: list[dict[str, str]] = []
+    for carrier in ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS:
+        pattern = carrier["path"]
+        if pattern.endswith("/**"):
+            prefix = pattern[:-3]
+            base = target_root / prefix
+            if not base.exists():
+                continue
+            if base.is_file():
+                found.append({"path": prefix, "pattern": pattern, "source": "filesystem"})
+                continue
+            for path in sorted(candidate for candidate in base.rglob("*") if candidate.is_file()):
+                found.append(
+                    {
+                        "path": path.relative_to(target_root).as_posix(),
+                        "pattern": pattern,
+                        "source": "filesystem",
+                    }
+                )
+            continue
+        exact = target_root / pattern
+        if exact.exists():
+            found.append({"path": pattern, "pattern": pattern, "source": "filesystem"})
+    return found
+
+
+def collect_forbidden_manifest_declarations(target_root: Path) -> list[dict[str, str]]:
+    manifest_path = target_root / ".loom/bootstrap/manifest.json"
+    if not manifest_path.exists():
+        return []
+    try:
+        manifest = read_json(manifest_path)
+    except json.JSONDecodeError:
+        return []
+    artifacts = manifest.get("artifacts")
+    declarations: list[dict[str, str]] = []
+    if not isinstance(artifacts, list):
+        return declarations
+    for artifact in artifacts:
+        if not isinstance(artifact, dict):
+            continue
+        relative = normalize_relative_path(artifact.get("path"))
+        if relative is None:
+            continue
+        carrier = forbidden_authored_carrier_for_path(relative)
+        if carrier is not None:
+            declarations.append({"path": relative, "pattern": carrier["path"], "source": "manifest.artifacts"})
+    return declarations
+
+
+def attach_only_forbidden_carrier_errors(target_root: Path, result: dict[str, object]) -> list[str]:
+    findings = (
+        collect_forbidden_authored_carrier_declarations(result)
+        + collect_forbidden_manifest_declarations(target_root)
+        + collect_forbidden_authored_carrier_files(target_root)
+    )
+    errors: list[str] = []
+    seen: set[tuple[str, str, str]] = set()
+    for finding in findings:
+        key = (finding["source"], finding["path"], finding["pattern"])
+        if key in seen:
+            continue
+        seen.add(key)
+        errors.append(
+            "attach-only forbidden authored carrier detected in "
+            f"{finding['source']}: `{finding['path']}` matches `{finding['pattern']}`; "
+            "this would create a second truth chain. Migrate it to the host truth locator, delete it, "
+            "or explicitly rerun bootstrap with `--intent execution-control`."
+        )
+    return errors
+
+
 def adoption_intent_payload(adoption_path: str, intake: dict[str, object]) -> dict[str, object]:
     requested = str(intake.get("adoption_intent", UNSPECIFIED_ADOPTION_INTENT))
     source = str(intake.get("adoption_intent_source", "unspecified"))
@@ -1170,6 +1373,7 @@ def intentionally_absent_targets(adoption_path: str, profile: str) -> list[dict[
             {"path": ".loom/work-items/**", "reason": "attach-only preserves host-owned work item truth"},
             {"path": ".loom/progress/**", "reason": "attach-only preserves host-owned recovery truth"},
             {"path": ".loom/status/current.md", "reason": "attach-only does not author Loom status truth"},
+            {"path": ".loom/reviews/**", "reason": "attach-only preserves host-owned review truth"},
             {"path": ".loom/specs/**", "reason": "attach-only does not author Loom execution specs"},
         ]
     if adoption_path == "defer":
@@ -1235,6 +1439,7 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
         bootstrap_mode=True,
         scenario_override=scenario,
     )
+    initial_artifact_list = initial_artifacts(target_root, install_pr_template, adoption_path, profile)
     result = {
         "schema_version": "loom-init-output/v1",
         "generator": {
@@ -1322,7 +1527,7 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
                 },
             }
         ),
-        "initial_artifacts": initial_artifacts(target_root, install_pr_template, adoption_path, profile),
+        "initial_artifacts": initial_artifact_list,
         "initial_work_items": initial_work_items(scenario, target_root, adoption_path, install_pr_template, profile),
         "validation_and_closing": {
             "validation_entry": "python3 .loom/bin/loom_init.py verify --target .",
@@ -1346,7 +1551,7 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
                 ]
             ),
             "clean_state": (
-                "all generated attach-only Loom artifacts are readable, verified, and do not introduce Loom-owned recovery/status placeholders"
+                "all generated attach-only Loom artifacts are readable, verified, and do not introduce Loom-authored work/progress/status/review/spec truth carriers"
                 if attach_only
                 else "all generated light-governance artifacts are readable, verified, and do not introduce Loom-owned work/progress/status carriers"
                 if profile == "light-governance"
@@ -1356,7 +1561,7 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
                 [
                     "the target repo has a readable root rule entry and attached repo companion entry",
                     "the attach-only bootstrap metadata and repo-local validation path are verifiable",
-                    "the bootstrap manifest does not declare Loom-owned recovery/status carriers for this path",
+                    "the bootstrap manifest, init-result, planned writes, and filesystem do not expose forbidden Loom-authored truth carriers",
                 ]
                 if attach_only
                 else [
@@ -1386,7 +1591,13 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
     }
     result["adoption_intent"] = adoption_intent_payload(adoption_path, intake)
     result["planned_writes"] = planned
+    result["required_carriers"] = required_carriers_for_profile(initial_artifact_list, profile)
     result["intentionally_absent"] = intentionally_absent_targets(adoption_path, profile)
+    result["forbidden_authored_carriers"] = forbidden_authored_carriers(profile)
+    scaffold_profile = result.get("scaffold_profile")
+    if isinstance(scaffold_profile, dict):
+        scaffold_profile["required_carriers"] = result["required_carriers"]
+        scaffold_profile["forbidden_authored_carriers"] = result["forbidden_authored_carriers"]
     result["upgrade_triggers"] = upgrade_triggers(deferred if isinstance(deferred, list) else [], profile)
     result["risk_summary"] = risk_summary(adoption_path, intake, planned)
     return result
@@ -1626,8 +1837,8 @@ def companion_manifest_payload() -> dict[str, object]:
     }
 
 
-def repo_interface_payload() -> dict[str, object]:
-    return {
+def repo_interface_payload(profile_name: str = "execution-control") -> dict[str, object]:
+    payload: dict[str, object] = {
         "schema_version": "loom-repo-interface/v2",
         "companion_entry": ".loom/companion/README.md",
         "repo_specific_requirements": {"review": [], "merge_ready": [], "closeout": []},
@@ -1648,6 +1859,9 @@ def repo_interface_payload() -> dict[str, object]:
             "status_locator": ".loom/companion/releases/status.json",
         },
     }
+    if profile_name == "attach-only":
+        payload["host_truth_locators"] = ATTACH_ONLY_HOST_TRUTH_LOCATORS
+    return payload
 
 
 def repo_interop_payload() -> dict[str, object]:
@@ -1924,6 +2138,10 @@ def scaffold_target(
     profile_name = str(profile.get("name")) if isinstance(profile, dict) else "execution-control"
     writes_light_loop = profile_name in {"light-governance", "execution-control", "strong-governance"}
     writes_work_item_carriers = profile_has_work_item_carriers(profile_name)
+    if profile_name == "attach-only":
+        forbidden_errors = attach_only_forbidden_carrier_errors(target_root, result)
+        if forbidden_errors:
+            raise RuntimeError("; ".join(forbidden_errors))
 
     writes: list[tuple[Path, str | dict[str, object], str]] = [
         (target_root / ".loom/README.md", render_loom_readme(result), "text"),
@@ -1933,7 +2151,7 @@ def scaffold_target(
         (target_root / ".loom/bootstrap/capability-map.md", render_capability_map(result), "text"),
         (target_root / ".loom/companion/README.md", render_companion_readme(result), "text"),
         (target_root / ".loom/companion/manifest.json", companion_manifest_payload(), "json"),
-        (target_root / ".loom/companion/repo-interface.json", repo_interface_payload(), "json"),
+        (target_root / ".loom/companion/repo-interface.json", repo_interface_payload(profile_name), "json"),
         (target_root / ".loom/companion/interop.json", repo_interop_payload(), "json"),
         (target_root / ".loom/companion/checkpoints.md", render_companion_checkpoints(), "text"),
         (target_root / ".loom/companion/review.md", render_companion_review(), "text"),
@@ -2118,7 +2336,9 @@ def verify_target(target_root: Path, output_path: Path) -> list[str]:
             "adoption_intent",
             "detected_repository_mode",
             "risk_summary",
+            "required_carriers",
             "planned_writes",
+            "forbidden_authored_carriers",
             "deferred_capabilities",
             "upgrade_triggers",
             "fact_chain",
@@ -2188,6 +2408,12 @@ def verify_target(target_root: Path, output_path: Path) -> list[str]:
             for forbidden in (".loom/work-items/INIT-0001.md", ".loom/progress/INIT-0001.md", ".loom/status/current.md"):
                 if forbidden in declared_generated:
                     errors.append(f"deep-existing-repo bootstrap must not declare generated carrier `{forbidden}`")
+            forbidden_profile = result.get("forbidden_authored_carriers")
+            if not isinstance(forbidden_profile, list) or {
+                str(item.get("path")) for item in forbidden_profile if isinstance(item, dict)
+            } != {carrier["path"] for carrier in ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS}:
+                errors.append("attach-only init-result must declare the full `forbidden_authored_carriers` profile list")
+            errors.extend(attach_only_forbidden_carrier_errors(target_root, result))
         if profile_name == "light-governance":
             declared_generated = {
                 artifact.get("path")

package/payload/plugin/loom/skills/loom-pre-review/.loom-runtime/loom-adopt/SKILL.md

@@ -57,7 +57,7 @@ description: 负责把仓库接入 Loom 的初始化场景入口。Use when Code
 2. `judge`
    - 判断这是 `新项目`、`小型既有仓库` 还是 `复杂既有仓库`
    - 消费或输出 `adoption_intent`；当 intent 不明确且写入会创建重执行控制面时，先停在 decision prompt / dry-run，不静默写入
-   - 输出 `scaffold_profile`，并按该 profile 列出 required、planned 与 intentionally absent carriers
+   - 输出 `scaffold_profile`，并按该 profile 列出 required、planned、intentionally absent 与 forbidden authored carriers
    - 输出本轮启用能力、暂不启用能力、升级触发条件、source locator、write target 与 validation command
 3. `write`
    - 只有用户要求实际落盘时才执行 `bootstrap --write`

package/payload/plugin/loom/skills/loom-pre-review/.loom-runtime/loom-init/SKILL.md

@@ -66,7 +66,7 @@ description: Loom 的 root entry。负责初始化新项目或既有仓库，并
 
 `--intent` 用来表达采用意图，而不是仓库静态分类。未显式给出 intent 时，dry-run 仍会输出推荐路径、风险摘要和计划写入载体；如果实际写入会创建重执行控制面，必须先显式选择 `execution-control` 或 `strong-governance`。
 
-每个 intent 会收敛到一个 `scaffold_profile`。`observe-only` 与 `skill-install-only` 不写 adoption carriers；`attach-only` 只写 companion/read surfaces；`light-governance` 写 companion、review/spec 与 PR 最小闭环但不写 Loom-owned work/progress/status；`execution-control` 与 `strong-governance` 才写 Loom-owned execution carriers。
+每个 intent 会收敛到一个 `scaffold_profile`。`observe-only` 与 `skill-install-only` 不写 adoption carriers；`attach-only` 只写 companion/read surfaces，并显式禁止 `.loom/work-items/**`、`.loom/progress/**`、`.loom/status/current.md`、`.loom/reviews/**`、`.loom/specs/**` 等 Loom-authored truth carriers；`light-governance` 写 companion、review/spec 与 PR 最小闭环但不写 Loom-owned work/progress/status；`execution-control` 与 `strong-governance` 才写 Loom-owned execution carriers。
 
 ## 1. 读取顺序
 

package/payload/plugin/loom/skills/loom-pre-review/.loom-runtime/loom-init/contract.json

@@ -35,7 +35,9 @@
       "adoption_intent",
       "detected_repository_mode",
       "risk_summary",
+      "required_carriers",
       "planned_writes",
+      "forbidden_authored_carriers",
       "deferred_capabilities",
       "upgrade_triggers",
       "fact_chain",

package/payload/plugin/loom/skills/loom-pre-review/.loom-runtime/loom-init/references/output-contract.md

@@ -35,6 +35,8 @@
   - `writes_artifacts`
   - `writes_work_item_carriers`
   - `description`
+  - `required_carriers`
+  - `forbidden_authored_carriers`
 - 本轮启用的能力清单
 - 每项能力分别映射到哪些 `governance`、`harness`、`templates`、`adoption` 规则
 - 这次采用的是最小装配、轻量 retrofit 还是更完整装配
@@ -59,7 +61,9 @@
 
 - `detected_repository_mode`：静态检测到的仓库模式和 scenario
 - `risk_summary`：是否会写入重执行控制面、是否保护 repo-owned truth、是否需要显式 intent
+- `required_carriers`：本 profile 必须落盘或保持可读的稳定载体
 - `planned_writes`：dry-run / write 即将落盘的稳定载体集合
+- `forbidden_authored_carriers`：本 profile 明确禁止生成、声明或保留的 Loom-authored truth carrier
 - `intentionally_absent`：因 attach-only、light-governance、observe-only 或 skill-install-only 而明确不生成的载体
 - 初始能力清单的承载位置
 - 首批 `Work Item` 或等价事项清单的承载位置
@@ -119,6 +123,8 @@
 - attach-only 必备工件是什么
 - 哪些 repo-native carriers 继续保留
 - 哪些 Loom-owned carriers 本轮不会生成
+- `forbidden_authored_carriers` 必须至少包含 `.loom/work-items/**`、`.loom/progress/**`、`.loom/status/current.md`、`.loom/reviews/**`、`.loom/specs/**`
+- verify 必须同时检查磁盘存在、`init-result` 声明、`planned_writes`、manifest artifacts 与 write touched，不得让 forbidden carrier 形成第二事实链
 
 `init-result` 只允许承接 locator-only 信息，不并行复制实时停点、下一步、阻断项或最近验证摘要。
 

package/payload/plugin/loom/skills/loom-pre-review/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md

@@ -57,9 +57,13 @@
 - `.loom/work-items/*`
 - `.loom/progress/*`
 - `.loom/status/current.md`
+- `.loom/reviews/*`
+- `.loom/specs/*`
 - Loom-owned recovery/status carriers 的 bootstrap placeholder
 - 对 branch / PR / worktree / merge / ruleset 的底层宿主重写
 
+若上述 Loom-authored carriers 已存在、被 `init-result` / manifest 声明为 generated，或出现在 attach-only planned writes 中，verify 必须 fail closed。执行者只能迁移到宿主 truth locator、删除 competing carrier，或显式升级 intent 到 `execution-control`。
+
 ## 6. 升级信号
 
 以下任一条件出现时，不应继续停留在 attach-only 默认路径：

package/payload/plugin/loom/skills/loom-pre-review/.loom-runtime/shared/references/adoption/repo-companion-contract.md

@@ -162,6 +162,7 @@
 - `policy_locators`
 - `hook_locators`
 - `release_targets`
+- `host_truth_locators`
 
 稳定约束：
 
@@ -171,8 +172,9 @@
 - `policy_locators` 只在 `v2` 合法
 - `hook_locators` 只在 `v2` 合法
 - `release_targets` 只在 `v2` 合法
+- `host_truth_locators` 只在 `v2` 合法，且只能声明宿主事实源 locator，例如 GitHub Issue、GitHub Project、PR review / guardian、PR metadata 与 issue state
 - `v2` 不改变 `repo_specific_requirements` 与 `specialized_gates` 的既有纪律
-- `v2` 不把 repo runtime state、review summary、validation status 或 retained host action result 写入 `repo-interface.json`
+- `v2` 不把 repo runtime state、progress/current stop、review verdict、review summary、validation status、closeout result 或 retained host action result 写入 `repo-interface.json`
 
 ### 4.3 通用字段纪律
 

package/payload/plugin/loom/skills/loom-pre-review/.loom-runtime/shared/scripts/governance_surface.py

@@ -352,6 +352,7 @@ REPO_INTERFACE_V2_KEYS = REPO_INTERFACE_V1_KEYS | {
     "policy_locators",
     "hook_locators",
     "release_targets",
+    "host_truth_locators",
 }
 DECLARED_LOCATOR_REQUIREMENTS = {"required", "optional", "advisory"}
 DECLARED_LOCATOR_OWNERS = {"repo", "repo-companion", "host", "host-adapter", "platform", "external-tool"}