@mc-and-his-agents/loom-installer 0.1.90 → 0.1.91

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.90",
+  "version": "0.1.91",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,12 +2,12 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "v0.9.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "cd1adc22024297ebad30ac2790fc4d022e04e99f",
+  "source_commit": "c54096e7bc9d501d8d0021081b3c499b148063e1",
   "source_ref": "main",
-  "built_at": "2026-05-09T22:41:55+08:00",
+  "built_at": "2026-05-09T23:13:49+08:00",
   "version_context": {
     "repo_version": "v0.9.0",
-    "installer_package_version": "0.1.90",
+    "installer_package_version": "0.1.91",
     "plugin_surface_version": "0.4.0",
     "host_adapter_version": "1.0.0",
     "skills_registry_version": "1.5.0",
@@ -808,8 +808,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
@@ -1533,8 +1533,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-build/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-build/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2258,8 +2258,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2983,8 +2983,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3713,8 +3713,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4438,8 +4438,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5163,8 +5163,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5888,8 +5888,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
@@ -6613,8 +6613,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -7338,8 +7338,8 @@
     },
     {
       "path": "plugin/loom/skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -7748,8 +7748,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
@@ -8438,8 +8438,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
@@ -9163,8 +9163,8 @@
     },
     {
       "path": "skills/loom-build/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-build/.loom-runtime/shared/scripts/loom_flow.py",
@@ -9888,8 +9888,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
@@ -10613,8 +10613,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
@@ -11343,8 +11343,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
@@ -12068,8 +12068,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -12793,8 +12793,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
@@ -13518,8 +13518,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
@@ -14243,8 +14243,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -14968,8 +14968,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 617050,
-      "sha256": "2f8476df0e153c5f0472d54beed75ed32f3c537515e97e194b1b77413473475f"
+      "bytes": 623808,
+      "sha256": "4d9bfc198f19e5491d8eb72f1eac3a0360450b4be0b70ae2663a9c40ca21dc0b"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",

package/payload/plugin/loom/skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py

@@ -11188,6 +11188,143 @@ def check_dynamic_tool_live_availability_contract(root: Path) -> list[Failure]:
     return failures
 
 
+def check_live_validation_only_guardrail_contract(root: Path) -> list[Failure]:
+    failures: list[Failure] = []
+
+    def write_json_local(path: Path, payload: object) -> None:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(json.dumps(payload, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+
+    docs = {
+        "docs/evidence/v0.10.0-release-readiness.md": [
+            "validation-only shadow parity mismatch",
+            "explicit blocking opt-in",
+            "owner、fallback、override path、authority-of-truth 与 live evidence",
+            "单个 adopted repo smoke",
+        ],
+        "docs/evidence/live-smoke-profile.md": [
+            "--include-blocking-shadow",
+            "not sufficient blocking-upgrade evidence on its own",
+            "不得把 `orchestration-live` 提升为普通 PR 的默认 blocking gate",
+        ],
+        "docs/methodology/harness/closeout-gate.md": [
+            "shadow parity` 默认不进入 closeout 阻断面",
+            "owner、fallback、override path 与 authority-of-truth",
+        ],
+        "docs/evidence/validations/validation-v0.10-live-validation-only-guardrail.md": [
+            "validation-only shadow parity mismatch returns `warn`",
+            "explicit blocking opt-in",
+            "single adopted repo live smoke run is not sufficient",
+        ],
+    }
+    for relative, anchors in docs.items():
+        path = root / relative
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError as exc:
+            failures.append(Failure("live-validation-only-guardrail", f"`{relative}` is unreadable: {exc}"))
+            continue
+        for anchor in anchors:
+            if anchor not in text:
+                failures.append(Failure("live-validation-only-guardrail", f"`{relative}` must mention `{anchor}`"))
+
+    missing_target = Path("/tmp/loom-missing-live-target")
+    unavailable_payload, error = load_command_json(
+        root,
+        ["python3", "tools/loom_flow.py", "live-smoke", "run", "--target", str(missing_target), "--item", "INIT-0001"],
+    )
+    if error:
+        failures.append(Failure("live-validation-only-guardrail", f"`live-smoke run` unavailable sample failed: {error}"))
+    else:
+        require_live_smoke_payload(
+            failures,
+            category="live-validation-only-guardrail",
+            context="unavailable-live-smoke-guardrail",
+            payload=unavailable_payload,
+            expected_operation="run",
+        )
+        if not isinstance(unavailable_payload, dict) or unavailable_payload.get("result") != "warn":
+            failures.append(Failure("live-validation-only-guardrail", "missing target live smoke must warn"))
+
+    dry_run_payload, error = load_command_json(
+        root,
+        [
+            "python3",
+            "tools/loom_flow.py",
+            "live-smoke",
+            "run",
+            "--target",
+            str(root / "examples/new-project"),
+            "--dry-run",
+            "--include-blocking-shadow",
+        ],
+    )
+    if error:
+        failures.append(Failure("live-validation-only-guardrail", f"`live-smoke run --include-blocking-shadow --dry-run` failed: {error}"))
+    else:
+        require_live_smoke_payload(
+            failures,
+            category="live-validation-only-guardrail",
+            context="dry-run-live-smoke-guardrail",
+            payload=dry_run_payload,
+            expected_operation="run",
+        )
+        command_plan = dry_run_payload.get("command_plan")
+        if not isinstance(command_plan, list):
+            failures.append(Failure("live-validation-only-guardrail", "dry-run live smoke must include command_plan"))
+        else:
+            blocking_steps = [step for step in command_plan if isinstance(step, dict) and step.get("id") == "shadow-parity-blocking"]
+            if len(blocking_steps) != 1:
+                failures.append(Failure("live-validation-only-guardrail", "dry-run live smoke must include exactly one explicit blocking shadow step when requested"))
+            elif "not sufficient blocking-upgrade evidence on its own" not in str(blocking_steps[0].get("description") or ""):
+                failures.append(Failure("live-validation-only-guardrail", "blocking shadow step must say it is not sufficient blocking-upgrade evidence on its own"))
+
+    example_target = root / "examples/new-project"
+    with tempfile.TemporaryDirectory(prefix="loom-live-validation-guardrail-") as tmp:
+        mismatch_target = Path(tmp) / "shadow-mismatch"
+        shutil.copytree(example_target, mismatch_target)
+        shadow_payload = load_json_file(mismatch_target / ".loom/shadow/review-repo.json")
+        if isinstance(shadow_payload, dict):
+            shadow_payload["source_sha256"] = {"native/status/review.json": "0" * 64}
+            write_json_local(mismatch_target / ".loom/shadow/review-repo.json", shadow_payload)
+
+        warn_payload, warn_error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(mismatch_target), "--surface", "review"],
+        )
+        if warn_error:
+            failures.append(Failure("live-validation-only-guardrail", f"`shadow-parity` validation-only mismatch sample failed: {warn_error}"))
+        else:
+            require_shadow_parity_payload(
+                failures,
+                category="live-validation-only-guardrail",
+                context="validation-only-shadow-mismatch",
+                payload=warn_payload,
+                expected_reports=1,
+            )
+            if not isinstance(warn_payload, dict) or warn_payload.get("result") != "warn":
+                failures.append(Failure("live-validation-only-guardrail", "validation-only shadow mismatch must warn"))
+
+        block_payload, block_error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(mismatch_target), "--surface", "review", "--blocking"],
+        )
+        if block_error:
+            failures.append(Failure("live-validation-only-guardrail", f"`shadow-parity --blocking` mismatch sample failed: {block_error}"))
+        else:
+            require_shadow_parity_payload(
+                failures,
+                category="live-validation-only-guardrail",
+                context="blocking-shadow-mismatch",
+                payload=block_payload,
+                expected_reports=1,
+            )
+            if not isinstance(block_payload, dict) or block_payload.get("result") != "block":
+                failures.append(Failure("live-validation-only-guardrail", "blocking shadow mismatch must block"))
+
+    return failures
+
+
 def fake_event_evidence(
     *,
     event_id: str,
@@ -12301,6 +12438,7 @@ def collect_failures(root: Path) -> list[Failure]:
     failures.extend(check_live_smoke_foundation_contract(root))
     failures.extend(check_host_adapter_live_drift_contract(root))
     failures.extend(check_dynamic_tool_live_availability_contract(root))
+    failures.extend(check_live_validation_only_guardrail_contract(root))
     failures.extend(check_structured_event_evidence_contract(root))
     failures.extend(check_deferred_roadmap_tree_contract(root))
     failures.extend(check_execution_budget_fixture_contract(root))
@@ -12313,7 +12451,7 @@ def collect_failures(root: Path) -> list[Failure]:
 
 
 def print_report(root: Path, failures: list[Failure]) -> None:
-    categories_checked = 31
+    categories_checked = 32
     if not failures:
         print(f"loom_check: OK ({root})")
         print(f"checked {categories_checked} surfaces")

package/payload/plugin/loom/skills/loom-build/.loom-runtime/shared/scripts/loom_check.py

@@ -11188,6 +11188,143 @@ def check_dynamic_tool_live_availability_contract(root: Path) -> list[Failure]:
     return failures
 
 
+def check_live_validation_only_guardrail_contract(root: Path) -> list[Failure]:
+    failures: list[Failure] = []
+
+    def write_json_local(path: Path, payload: object) -> None:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(json.dumps(payload, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+
+    docs = {
+        "docs/evidence/v0.10.0-release-readiness.md": [
+            "validation-only shadow parity mismatch",
+            "explicit blocking opt-in",
+            "owner、fallback、override path、authority-of-truth 与 live evidence",
+            "单个 adopted repo smoke",
+        ],
+        "docs/evidence/live-smoke-profile.md": [
+            "--include-blocking-shadow",
+            "not sufficient blocking-upgrade evidence on its own",
+            "不得把 `orchestration-live` 提升为普通 PR 的默认 blocking gate",
+        ],
+        "docs/methodology/harness/closeout-gate.md": [
+            "shadow parity` 默认不进入 closeout 阻断面",
+            "owner、fallback、override path 与 authority-of-truth",
+        ],
+        "docs/evidence/validations/validation-v0.10-live-validation-only-guardrail.md": [
+            "validation-only shadow parity mismatch returns `warn`",
+            "explicit blocking opt-in",
+            "single adopted repo live smoke run is not sufficient",
+        ],
+    }
+    for relative, anchors in docs.items():
+        path = root / relative
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError as exc:
+            failures.append(Failure("live-validation-only-guardrail", f"`{relative}` is unreadable: {exc}"))
+            continue
+        for anchor in anchors:
+            if anchor not in text:
+                failures.append(Failure("live-validation-only-guardrail", f"`{relative}` must mention `{anchor}`"))
+
+    missing_target = Path("/tmp/loom-missing-live-target")
+    unavailable_payload, error = load_command_json(
+        root,
+        ["python3", "tools/loom_flow.py", "live-smoke", "run", "--target", str(missing_target), "--item", "INIT-0001"],
+    )
+    if error:
+        failures.append(Failure("live-validation-only-guardrail", f"`live-smoke run` unavailable sample failed: {error}"))
+    else:
+        require_live_smoke_payload(
+            failures,
+            category="live-validation-only-guardrail",
+            context="unavailable-live-smoke-guardrail",
+            payload=unavailable_payload,
+            expected_operation="run",
+        )
+        if not isinstance(unavailable_payload, dict) or unavailable_payload.get("result") != "warn":
+            failures.append(Failure("live-validation-only-guardrail", "missing target live smoke must warn"))
+
+    dry_run_payload, error = load_command_json(
+        root,
+        [
+            "python3",
+            "tools/loom_flow.py",
+            "live-smoke",
+            "run",
+            "--target",
+            str(root / "examples/new-project"),
+            "--dry-run",
+            "--include-blocking-shadow",
+        ],
+    )
+    if error:
+        failures.append(Failure("live-validation-only-guardrail", f"`live-smoke run --include-blocking-shadow --dry-run` failed: {error}"))
+    else:
+        require_live_smoke_payload(
+            failures,
+            category="live-validation-only-guardrail",
+            context="dry-run-live-smoke-guardrail",
+            payload=dry_run_payload,
+            expected_operation="run",
+        )
+        command_plan = dry_run_payload.get("command_plan")
+        if not isinstance(command_plan, list):
+            failures.append(Failure("live-validation-only-guardrail", "dry-run live smoke must include command_plan"))
+        else:
+            blocking_steps = [step for step in command_plan if isinstance(step, dict) and step.get("id") == "shadow-parity-blocking"]
+            if len(blocking_steps) != 1:
+                failures.append(Failure("live-validation-only-guardrail", "dry-run live smoke must include exactly one explicit blocking shadow step when requested"))
+            elif "not sufficient blocking-upgrade evidence on its own" not in str(blocking_steps[0].get("description") or ""):
+                failures.append(Failure("live-validation-only-guardrail", "blocking shadow step must say it is not sufficient blocking-upgrade evidence on its own"))
+
+    example_target = root / "examples/new-project"
+    with tempfile.TemporaryDirectory(prefix="loom-live-validation-guardrail-") as tmp:
+        mismatch_target = Path(tmp) / "shadow-mismatch"
+        shutil.copytree(example_target, mismatch_target)
+        shadow_payload = load_json_file(mismatch_target / ".loom/shadow/review-repo.json")
+        if isinstance(shadow_payload, dict):
+            shadow_payload["source_sha256"] = {"native/status/review.json": "0" * 64}
+            write_json_local(mismatch_target / ".loom/shadow/review-repo.json", shadow_payload)
+
+        warn_payload, warn_error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(mismatch_target), "--surface", "review"],
+        )
+        if warn_error:
+            failures.append(Failure("live-validation-only-guardrail", f"`shadow-parity` validation-only mismatch sample failed: {warn_error}"))
+        else:
+            require_shadow_parity_payload(
+                failures,
+                category="live-validation-only-guardrail",
+                context="validation-only-shadow-mismatch",
+                payload=warn_payload,
+                expected_reports=1,
+            )
+            if not isinstance(warn_payload, dict) or warn_payload.get("result") != "warn":
+                failures.append(Failure("live-validation-only-guardrail", "validation-only shadow mismatch must warn"))
+
+        block_payload, block_error = load_command_json(
+            root,
+            ["python3", "tools/loom_flow.py", "shadow-parity", "--target", str(mismatch_target), "--surface", "review", "--blocking"],
+        )
+        if block_error:
+            failures.append(Failure("live-validation-only-guardrail", f"`shadow-parity --blocking` mismatch sample failed: {block_error}"))
+        else:
+            require_shadow_parity_payload(
+                failures,
+                category="live-validation-only-guardrail",
+                context="blocking-shadow-mismatch",
+                payload=block_payload,
+                expected_reports=1,
+            )
+            if not isinstance(block_payload, dict) or block_payload.get("result") != "block":
+                failures.append(Failure("live-validation-only-guardrail", "blocking shadow mismatch must block"))
+
+    return failures
+
+
 def fake_event_evidence(
     *,
     event_id: str,
@@ -12301,6 +12438,7 @@ def collect_failures(root: Path) -> list[Failure]:
     failures.extend(check_live_smoke_foundation_contract(root))
     failures.extend(check_host_adapter_live_drift_contract(root))
     failures.extend(check_dynamic_tool_live_availability_contract(root))
+    failures.extend(check_live_validation_only_guardrail_contract(root))
     failures.extend(check_structured_event_evidence_contract(root))
     failures.extend(check_deferred_roadmap_tree_contract(root))
     failures.extend(check_execution_budget_fixture_contract(root))
@@ -12313,7 +12451,7 @@ def collect_failures(root: Path) -> list[Failure]:
 
 
 def print_report(root: Path, failures: list[Failure]) -> None:
-    categories_checked = 31
+    categories_checked = 32
     if not failures:
         print(f"loom_check: OK ({root})")
         print(f"checked {categories_checked} surfaces")