@mc-and-his-agents/loom-installer 0.1.24 → 0.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "9ade7b1664d19d46002d8122e8c3eabba7cf6bf4",
+  "source_commit": "b3b72c7a74674319f0a7432487fc0e3cbf012b4f",
   "source_ref": "main",
-  "built_at": "2026-04-26T23:38:43+08:00",
+  "built_at": "2026-04-26T23:56:30+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -618,8 +618,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/governance_surface.py",
@@ -628,13 +628,13 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_init.py",
@@ -1203,8 +1203,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/governance_surface.py",
@@ -1213,13 +1213,13 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_init.py",
@@ -1818,8 +1818,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/governance_surface.py",
@@ -1828,13 +1828,13 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_init.py",
@@ -2433,8 +2433,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/governance_surface.py",
@@ -2443,13 +2443,13 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_init.py",
@@ -3053,8 +3053,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/governance_surface.py",
@@ -3063,13 +3063,13 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_init.py",
@@ -3668,8 +3668,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/governance_surface.py",
@@ -3678,13 +3678,13 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_init.py",
@@ -4283,8 +4283,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/governance_surface.py",
@@ -4293,13 +4293,13 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_init.py",
@@ -4898,8 +4898,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/governance_surface.py",
@@ -4908,13 +4908,13 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_init.py",
@@ -5513,8 +5513,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/governance_surface.py",
@@ -5523,13 +5523,13 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_init.py",
@@ -6128,8 +6128,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/fact_chain_support.py",
-      "bytes": 19586,
-      "sha256": "9ba73a76710189a2306f3ced374ea99c7ef43d4df10f25fef929e874b006fa22"
+      "bytes": 19933,
+      "sha256": "0e215e1c83443c8688c984241a8008e5b419f68b8838eecbcfb695857e212923"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/governance_surface.py",
@@ -6138,13 +6138,13 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 285470,
-      "sha256": "e834612a8da8cd22cc13679b61529bc0074d0399004f4e4f45540d6b8f314c9a"
+      "bytes": 287428,
+      "sha256": "48bf635cb9fb4f28b38309a81ecb67a48b489d72f83c4907d972230481848ddb"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",
-      "bytes": 296133,
-      "sha256": "e8bc02d131b1007889b7f9b394b5b2d605c8bf790ba1baccc37da1e6aecbf46c"
+      "bytes": 296151,
+      "sha256": "f74afa96460de82ef279ec78a0468906ca1db26b867a4fc810025164ae8f7146"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_init.py",

package/payload/plugin/loom/skills/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/plugin/loom/skills/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-init/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-init/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-merge-ready/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-pre-review/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-resume/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-retire/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-review/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-review/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors

package/payload/skills/loom-spec-review/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -131,6 +131,7 @@ def parse_key_value_section(
         return {}, [f"{relative_path}: missing section `{section_name}`"]
 
     values: dict[str, str] = {}
+    seen: dict[str, str] = {}
     for raw_line in lines:
         stripped = raw_line.strip()
         if not stripped:
@@ -143,7 +144,15 @@ def parse_key_value_section(
         if label not in field_map:
             errors.append(f"{relative_path}: unexpected field `{label}` in `{section_name}`")
             continue
-        values[field_map[label]] = _clean_value(match.group(2))
+        canonical = field_map[label]
+        if canonical in seen:
+            errors.append(
+                f"{relative_path}: duplicate field `{label}` in `{section_name}` "
+                f"(canonical `{canonical}` already set by `{seen[canonical]}`)"
+            )
+            continue
+        seen[canonical] = label
+        values[canonical] = _clean_value(match.group(2))
 
     for label, canonical in field_map.items():
         if canonical not in values:

package/payload/skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py

@@ -2211,6 +2211,43 @@ def check_demo_fact_chain(root: Path) -> list[Failure]:
         failures.append(Failure("demo-fact-chain", detail))
     if report and report.get("fact_chain", {}).get("entry_points", {}).get("status_surface") != ".loom/status/current.md":
         failures.append(Failure("demo-fact-chain", "demo fact chain must point status_surface to `.loom/status/current.md`"))
+    with tempfile.TemporaryDirectory(prefix="loom-check-metadata-spoof-") as tmp:
+        spoof_target = Path(tmp) / "new-project"
+        shutil.copytree(target, spoof_target)
+        work_item_path = spoof_target / ".loom/work-items/INIT-0001.md"
+        work_item_text = work_item_path.read_text(encoding="utf-8")
+        work_item_path.write_text(
+            work_item_text.replace(
+                "- Goal: Bootstrap the first executable Loom path for this repository\n",
+                "- Goal: wrong spoofed goal\n- Goal: Bootstrap the first executable Loom path for this repository\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        _, spoof_errors = inspect_fact_chain(spoof_target)
+        if not any("duplicate field `Goal`" in error for error in spoof_errors):
+            failures.append(Failure("demo-fact-chain", "fact-chain parser must reject duplicate canonical metadata fields"))
+
+        runtime_spoof_target = Path(tmp) / "runtime-spoof"
+        shutil.copytree(target, runtime_spoof_target)
+        status_path = runtime_spoof_target / ".loom/status/current.md"
+        status_text = status_path.read_text(encoding="utf-8")
+        status_path.write_text(
+            status_text.replace(
+                "- Run Entry: not_applicable\n",
+                "- Run Entry: wrong-spoofed-run\n- Run Entry: not_applicable\n",
+                1,
+            ),
+            encoding="utf-8",
+        )
+        payload, error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "fact-chain", "--target", str(runtime_spoof_target)],
+        )
+        if error:
+            failures.append(Failure("demo-fact-chain", f"`flow fact-chain` metadata spoof sample failed unexpectedly: {error}"))
+        elif payload.get("result") != "block":
+            failures.append(Failure("demo-fact-chain", "`flow fact-chain` must not legacy-fallback past duplicate Runtime Evidence fields"))
     return failures
 
 

package/payload/skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py

@@ -2643,7 +2643,7 @@ def build_default_review_prompt(
 
 def load_fact_chain_report(target_root: Path, output_relative: str) -> tuple[dict[str, Any], list[str]]:
     report, errors = inspect_fact_chain(target_root, output_relative)
-    if errors and all("Runtime Evidence" in message for message in errors):
+    if errors and all("missing section `Runtime Evidence`" in message for message in errors):
         report, errors = inspect_fact_chain_legacy(target_root, output_relative)
     if errors:
         return {}, errors