@mc-and-his-agents/loom-installer 0.1.37 → 0.1.39

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "e6175667069a99b5a49ea9758f71ffe4961f899b",
+  "source_commit": "a0094e42a22f72429dccc3f437df2d86b084544d",
   "source_ref": "main",
-  "built_at": "2026-04-27T15:59:30+08:00",
+  "built_at": "2026-04-27T16:28:18+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -624,17 +624,17 @@
     {
       "path": "plugin/loom/skills/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
@@ -1214,17 +1214,17 @@
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
@@ -1834,17 +1834,17 @@
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2454,17 +2454,17 @@
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3079,17 +3079,17 @@
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3699,17 +3699,17 @@
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4319,17 +4319,17 @@
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4939,17 +4939,17 @@
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5559,17 +5559,17 @@
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -6179,17 +6179,17 @@
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/fact_chain_support.py",
       "bytes": 21748,
-      "sha256": "8ec28a37277dbf4e6e0af5965cf98da4ec3e8a0b29cb325309c08b22ab976a91"
+      "sha256": "e5c52cda01f1107cafcd00bf2d37feaa167f1acd5152fc8f41f28ee3255a7d52"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/governance_surface.py",
-      "bytes": 56941,
-      "sha256": "fcd116cdadbe674f13fbe841e5af86d8bb48fe6c924305949ea1ed1abc955d44"
+      "bytes": 57013,
+      "sha256": "902bba15e9da421b9a48a051940a67a2b019cd14b938d8acd2679c760734b2f5"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 338798,
-      "sha256": "6c31df1995034f10c7dd769b5c174a3e580f3078e586d53faa6b9994c3d7bb98"
+      "bytes": 340603,
+      "sha256": "8affea751d682b3bcb0fd975652b7c09c9af2cebe5a7dd069d0e64a3e9ce6858"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",

package/payload/plugin/loom/skills/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/plugin/loom/skills/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-init/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-init/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-init/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-merge-ready/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-merge-ready/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-pre-review/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-pre-review/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-resume/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-resume/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-retire/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-retire/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-review/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-review/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-review/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")

package/payload/skills/loom-spec-review/.loom-runtime/shared/scripts/fact_chain_support.py

@@ -195,12 +195,12 @@ def resolve_repo_relative_path(target_root: Path, relative: str, *, label: str)
     if candidate_raw.is_absolute():
         return None, [f"{label} must be repo-relative, got absolute path: {locator}"]
     if ".." in candidate_raw.parts:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     candidate = (target_root / candidate_raw).resolve()
     try:
         candidate.relative_to(target_root.resolve())
     except ValueError:
-        return None, [f"{label} must stay inside the target repository and within the target root: {locator}"]
+        return None, [f"{label} must stay within the target root and inside the target repository: {locator}"]
     return candidate, []
 
 

package/payload/skills/loom-spec-review/.loom-runtime/shared/scripts/governance_surface.py

@@ -481,8 +481,8 @@ def locator_boundary_error(raw_locator: object, *, label: str) -> str:
     locator = raw_locator.strip()
     locator_path = Path(locator)
     if locator_path.is_absolute() or ".." in locator_path.parts:
-        return f"{label} must stay within the repository root: {locator}"
-    return f"{label} must stay within the repository root: {locator}"
+        return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
+    return f"{label} must stay within the repository root and must stay inside the repository: {locator}"
 
 
 def resolve_locator(root: Path, raw_locator: object) -> tuple[str | None, Path | None]:

package/payload/skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py

@@ -6422,6 +6422,44 @@ def check_adversarial_adoption_fixture(root: Path) -> list[Failure]:
         if payload.get("status") != "block" or not any("must stay inside" in error for error in errors):
             failures.append(Failure("adversarial-adoption", "registry executable and manifest paths must not escape the runtime root"))
 
+        fact_chain_escape = base / "fact-chain-error-anchor"
+        (fact_chain_escape / ".loom/bootstrap").mkdir(parents=True)
+        write_json(
+            fact_chain_escape / ".loom/bootstrap/init-result.json",
+            {
+                "schema_version": "loom-init-output/v1",
+                "fact_chain": {
+                    "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
+                    "mode": "work-item + recovery-entry + derived status-surface",
+                    "entry_points": {
+                        "current_item_id": "INIT-0001",
+                        "work_item": "../outside.md",
+                        "recovery_entry": ".loom/progress/INIT-0001.md",
+                        "status_surface": ".loom/status/current.md",
+                    }
+                },
+            },
+        )
+        _, errors = inspect_fact_chain(fact_chain_escape)
+        if not any("must stay within the target root" in error for error in errors):
+            failures.append(Failure("adversarial-adoption", "fact-chain path-boundary errors must expose a stable target-root anchor"))
+
+        shadow_anchor_errors = governance_surface_module.validate_shadow_surface(
+            root=base,
+            surface="review",
+            entry={
+                "summary": "review parity",
+                "loom_locator": ".loom/shadow/review-loom.json",
+                "repo_locator": "../outside.json",
+            },
+        )
+        if not any(
+            "must stay inside the repository" in error
+            and "must stay within the repository root" in error
+            for error in shadow_anchor_errors
+        ):
+            failures.append(Failure("adversarial-adoption", "shadow surface path-boundary errors must expose a stable repository anchor"))
+
         spec_contract_target = base / "spec-contract"
         (spec_contract_target / ".loom/specs/INIT-0001").mkdir(parents=True)
         (spec_contract_target / ".loom/specs/INIT-0001/spec.md").write_text("bootstrap spec\n", encoding="utf-8")