@mrciphersmith/keryx 0.2.153 → 0.2.155

package/dist/core.js

@@ -11098,6 +11098,103 @@ async function readAcCriteria(cwd, dir) {
   }
   return ids;
 }
+var AC_LINE_PATTERN = /^(\s*)[-*]\s*(AC\d+)\s*:\s?(.*)$/i;
+var HEADING_PATTERN = /^\s*#/;
+function detectEol(content) {
+  return content.includes(`\r
+`) ? `\r
+` : `
+`;
+}
+function splitAcLines(content) {
+  if (content.length === 0) {
+    return [];
+  }
+  const lines = [];
+  let index = 0;
+  while (index < content.length) {
+    const newlineIndex = content.indexOf(`
+`, index);
+    if (newlineIndex === -1) {
+      lines.push({ text: content.slice(index), eol: "" });
+      break;
+    }
+    const hasCr = newlineIndex > index && content[newlineIndex - 1] === "\r";
+    lines.push({
+      text: hasCr ? content.slice(index, newlineIndex - 1) : content.slice(index, newlineIndex),
+      eol: hasCr ? `\r
+` : `
+`
+    });
+    index = newlineIndex + 1;
+  }
+  return lines;
+}
+function renderAcLines(lines) {
+  return lines.map((line) => line.text + line.eol).join("");
+}
+function acBlockEnd(lines, start) {
+  let end = start + 1;
+  while (end < lines.length) {
+    const line = lines[end];
+    if (line.text.trim() === "")
+      break;
+    if (HEADING_PATTERN.test(line.text))
+      break;
+    if (AC_LINE_PATTERN.test(line.text))
+      break;
+    if (!/^\s/.test(line.text))
+      break;
+    end += 1;
+  }
+  return end;
+}
+async function writeAcCriterion(cwd, dir, criterion, text) {
+  const file = acPath(cwd, dir);
+  const content = await pathExists(file) ? await readFile2(file, "utf8") : "";
+  const lines = splitAcLines(content);
+  const rendered = `- ${criterion}: ${text}`;
+  let previousText;
+  let matchedIndex = -1;
+  let lastBlockEnd = -1;
+  let index = 0;
+  while (index < lines.length) {
+    const line = lines[index];
+    const match = line.text.match(AC_LINE_PATTERN);
+    if (!match?.[2]) {
+      index += 1;
+      continue;
+    }
+    const end = acBlockEnd(lines, index);
+    lastBlockEnd = end;
+    if (match[2].toUpperCase() === criterion) {
+      if (end > index + 1) {
+        throw new Error(`${criterion} spans more than one line; edit acceptance-criteria.md directly and run ` + '`keryx flow ac update <id> --reason "..."`.');
+      }
+      matchedIndex = index;
+      previousText = (match[3] ?? "").trim();
+    }
+    index = end;
+  }
+  if (matchedIndex >= 0) {
+    const existing = lines[matchedIndex];
+    lines[matchedIndex] = { text: rendered, eol: existing.eol };
+  } else if (lastBlockEnd >= 0) {
+    const precedingIndex = lastBlockEnd - 1;
+    const preceding = lines[precedingIndex];
+    let newEol = preceding.eol;
+    if (newEol === "") {
+      const fallbackEol = detectEol(content);
+      preceding.eol = fallbackEol;
+      newEol = fallbackEol;
+    }
+    lines.splice(lastBlockEnd, 0, { text: rendered, eol: newEol });
+  } else {
+    lines.push({ text: rendered, eol: detectEol(content) });
+  }
+  await writeFileAtomic(file, renderAcLines(lines));
+  return { previousText };
+}
 async function acChecksum(cwd, dir) {
   const content = await readFile2(acPath(cwd, dir), "utf8");
   const normalized = content.replace(/\r\n/g, `
@@ -12072,6 +12169,37 @@ async function reviewGate(input) {
   return { name: "review", status: verdict.status, detail: verdict.detail };
 }
 
+// src/flow/identity.ts
+function resolveSignerIdentity(input) {
+  const stated = input.stated?.trim();
+  if (stated) {
+    return { value: stated, basis: "stated", source: "`--signed-by` flag" };
+  }
+  const env = input.env?.trim();
+  if (env) {
+    return { value: env, basis: "stated", source: "KERYX_ACTOR environment variable" };
+  }
+  const git = input.gitIdentity?.trim();
+  if (git) {
+    return {
+      value: git,
+      basis: "derived",
+      source: "git config user.email in this checkout \u2014 this is who RAN the command, which is not " + "necessarily who signed. Pass --signed-by to record the actual signer."
+    };
+  }
+  return {
+    value: null,
+    basis: "unknown",
+    source: "no --signed-by flag, KERYX_ACTOR environment variable, or readable git identity"
+  };
+}
+function ownerIdentity(name, source) {
+  return { value: name, basis: "stated", source };
+}
+function describeIdentity(identity) {
+  return `${identity.value ?? "unknown"} [${identity.basis}]`;
+}
+
 // src/review/flow-move.ts
 init_fs();
 import { readdir as readdir4, readFile as readFile6, rename as rename2 } from "fs/promises";
@@ -12312,9 +12440,27 @@ function flowStateSchema() {
           review: {
             type: "boolean",
             description: "Written by `flow init`. When true, `flow complete` fails unless the flow's latest ingested review round is clean: every finding at or above the severity floor carries a terminal disposition with the evidence that disposition requires, the round ran against the PR head, no external PR comment is unanswered, and the verifier's stats are recorded."
+          },
+          owner: {
+            type: "boolean",
+            description: "Written by `flow init`. When true, `flow complete` fails the owner gate with a named reason while no owner is set, and passes it once one is. Absent on packages created before the gate existed, which report the gate `skipped` rather than `fail`."
           }
         }
       },
+      owner: {
+        $ref: "#/definitions/identity",
+        description: "The human accountable for this flow, or absent if one was never set. Never inferred: only ever written by an explicit `--owner` on `flow init` or `flow owner set`, so `basis` is always `stated`."
+      },
+      signatures: {
+        type: "array",
+        description: "Append-only signing record for `flow ac confirm` and a passing `flow complete`. Absent means never signed under this field's existence.",
+        items: { $ref: "#/definitions/flowSignature" }
+      },
+      completionAttempts: {
+        type: "array",
+        description: "flow 291: append-only record of every `flow complete` attempt's gate outcomes \u2014 every gate evaluated, passing, failing and skipped alike \u2014 written on every attempt from now on, pass or fail. Absent means no attempt has been recorded under this field's existence (including every flow.json written before it existed).",
+        items: { $ref: "#/definitions/completionAttempt" }
+      },
       acConfirmed: {
         type: "object",
         description: "Per-AC confirmation records keyed by AC id (e.g. AC1).",
@@ -12439,6 +12585,79 @@ function flowStateSchema() {
             }
           }
         }
+      },
+      identity: {
+        type: "object",
+        description: "flow 289: a claim about who is behind a value, and how it was obtained \u2014 never a proof. `basis` is `stated` (given explicitly by a flag or environment variable), `derived` (read from something like the local git configuration; NEVER promoted to stated), or `unknown` (nothing was available; `value` is then null).",
+        additionalProperties: false,
+        required: ["value", "basis", "source"],
+        properties: {
+          value: { type: ["string", "null"] },
+          basis: { type: "string", enum: ["stated", "derived", "unknown"] },
+          source: { type: "string", description: "Exactly where this value came from, or why there is none." }
+        }
+      },
+      flowSignature: {
+        type: "object",
+        description: "flow 289: one append-only signature on an AC confirmation or a passing completion. Never mutated once written.",
+        additionalProperties: true,
+        required: ["at", "kind", "identity", "acChecksum"],
+        properties: {
+          at: { type: "string" },
+          kind: { type: "string", enum: ["ac-confirm", "complete"] },
+          identity: { $ref: "#/definitions/identity" },
+          criterion: { type: "string", description: "The AC id signed. Present only for kind ac-confirm." },
+          acChecksum: {
+            type: ["string", "null"],
+            description: "The acceptance-criteria checksum in force at signing time."
+          },
+          headCommit: {
+            type: "string",
+            description: "The commit the completion gates evaluated, when known. Present only for kind complete."
+          }
+        }
+      },
+      completionAttempt: {
+        type: "object",
+        description: "flow 291: one `flow complete` attempt, on the record \u2014 every gate it evaluated, whether the attempt passed overall, and the AC checksum in force. Never mutated once written.",
+        additionalProperties: true,
+        required: ["at", "gates", "passed", "acChecksum"],
+        properties: {
+          at: { type: "string" },
+          gates: {
+            type: "array",
+            items: { $ref: "#/definitions/gateOutcome" }
+          },
+          passed: { type: "boolean" },
+          acChecksum: {
+            type: ["string", "null"],
+            description: "The acceptance-criteria checksum in force when this attempt ran."
+          }
+        }
+      },
+      gateOutcome: {
+        type: "object",
+        description: "flow 291: the outcome of one gate `flow complete` evaluated during one attempt.",
+        additionalProperties: true,
+        required: ["name", "status", "detail"],
+        properties: {
+          name: {
+            type: "string",
+            enum: [
+              "acceptance-criteria",
+              "pull-request",
+              "main-merge",
+              "tasks",
+              "health",
+              "security",
+              "review",
+              "base-branch",
+              "owner"
+            ]
+          },
+          status: { type: "string", enum: ["pass", "fail", "skipped"] },
+          detail: { type: "string" }
+        }
       }
     }
   };
@@ -13303,6 +13522,36 @@ function recordAttempt(task, outcome, at, detail) {
   task.attempts = attempts;
   return attempts;
 }
+var BLANK_OWNER_MESSAGE = '--owner requires a non-blank name, e.g. --owner "Alex Smith"';
+var AC_CRITERION_NAME_PATTERN = /^AC\d+$/i;
+var AC_TEXT_SELF_PREFIX_PATTERN = /^-?\s*AC\d+\s*:/i;
+function validateCriterionName(raw) {
+  const trimmed = raw.trim();
+  if (!AC_CRITERION_NAME_PATTERN.test(trimmed)) {
+    throw new Error(`--criterion must name "AC" followed by a number, e.g. AC7 (got "${raw}").`);
+  }
+  return trimmed.toUpperCase();
+}
+function validateCriterionText(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    throw new Error("--text must not be empty.");
+  }
+  if (raw.includes(`
+`) || raw.includes("\r")) {
+    throw new Error("--text must fit on one line (no line breaks) \u2014 acceptance-criteria.md uses one line per ACn.");
+  }
+  if (AC_TEXT_SELF_PREFIX_PATTERN.test(trimmed)) {
+    throw new Error('--text must not carry its own "- ACn:" prefix \u2014 `flow ac update --criterion` adds that prefix itself.');
+  }
+  return trimmed;
+}
+function validateSingleLineReason(reason) {
+  if (reason.includes(`
+`) || reason.includes("\r")) {
+    throw new Error("--reason must fit on one line (no line breaks) \u2014 it is written as a single `journal.md` bullet.");
+  }
+}
 function createFlowService(deps) {
   const now = () => deps.now().toISOString();
   async function load(cwd, id) {
@@ -13338,6 +13587,9 @@ function createFlowService(deps) {
       if (!input.title && !input.issue) {
         throw new Error('flow init requires --title "<problem>" or --issue <url>');
       }
+      if (input.owner !== undefined && !input.owner.trim()) {
+        throw new Error(BLANK_OWNER_MESSAGE);
+      }
       const trackerReady = deps.tracker ? await deps.tracker.detect() : false;
       const tracker = trackerReady ? deps.tracker : null;
       const issueRef = input.issue && deps.tracker ? deps.tracker.parseRef(input.issue) : null;
@@ -13368,7 +13620,7 @@ function createFlowService(deps) {
         const createdAt = now();
         const flow = {
           schemaVersion: 1,
-          gates: { tasks: true, review: true },
+          gates: { tasks: true, review: true, owner: true },
           id,
           slug,
           title,
@@ -13383,6 +13635,7 @@ function createFlowService(deps) {
           acConfirmed: {},
           pr: { url: null },
           ...input.baseBranch === undefined ? {} : { baseBranch: input.baseBranch },
+          ...input.owner?.trim() ? { owner: ownerIdentity(input.owner.trim(), "`--owner` flag on `flow init`") } : {},
           tasks: DEFAULT_TASKS.map((task) => ({ ...task, status: "todo" })),
           history: [{ at: createdAt, event: "created" }]
         };
@@ -13424,6 +13677,22 @@ function createFlowService(deps) {
     async next({ cwd, id }) {
       return nextTask((await load(cwd, id)).flow.tasks);
     },
+    async ownerSet({ cwd, id, owner, reason }) {
+      if (!owner?.trim()) {
+        throw new Error(BLANK_OWNER_MESSAGE);
+      }
+      if (!reason?.trim()) {
+        throw new Error('flow owner set requires --reason "<why>"');
+      }
+      return mutate(cwd, id, async ({ dir, flow }) => {
+        await assertAcIntact(cwd, dir, flow);
+        const previous = flow.owner?.value ?? null;
+        const next = ownerIdentity(owner.trim(), "`--owner` flag on `flow owner set`");
+        flow.owner = next;
+        const detail = `${previous ?? "not set"} -> ${next.value} (${reason.trim()})`;
+        return save(cwd, dir, flow, previous === null ? "owner-set" : "owner-changed", detail);
+      });
+    },
     async freeze({ cwd, id }) {
       return mutate(cwd, id, async ({ dir, flow }) => {
         assertTransition(flow.status, "ready");
@@ -13534,7 +13803,7 @@ function createFlowService(deps) {
         return save(cwd, dir, flow, "task-attempt", `${task.id}: ${outcome} (attempt ${attempts.count})${detail?.trim() ? ` \u2014 ${detail.trim()}` : ""}`);
       });
     },
-    async acConfirm({ cwd, id, criterion, note }) {
+    async acConfirm({ cwd, id, criterion, note, signedBy, signedByEnv, gitIdentity }) {
       return mutate(cwd, id, async ({ dir, flow }) => {
         await assertAcIntact(cwd, dir, flow);
         const known = await readAcCriteria(cwd, dir);
@@ -13542,24 +13811,50 @@ function createFlowService(deps) {
         if (!known.includes(target)) {
           throw new Error(`Unknown criterion ${target}. Known: ${known.join(", ")}`);
         }
-        flow.acConfirmed[target] = { at: now(), ...note ? { note } : {} };
-        return save(cwd, dir, flow, "ac-confirmed", `${target}${note ? `: ${note}` : ""}`);
+        const at = now();
+        flow.acConfirmed[target] = { at, ...note ? { note } : {} };
+        const identity = resolveSignerIdentity({ stated: signedBy, env: signedByEnv, gitIdentity });
+        flow.signatures = [
+          ...flow.signatures ?? [],
+          { at, kind: "ac-confirm", identity, criterion: target, acChecksum: flow.acChecksum }
+        ];
+        return save(cwd, dir, flow, "ac-confirmed", `${target}${note ? `: ${note}` : ""} (signed: ${describeIdentity(identity)})`);
       });
     },
-    async acUpdate({ cwd, id, reason }) {
+    async acUpdate({ cwd, id, reason, criterion, text }) {
       if (!reason?.trim()) {
         throw new Error('flow ac update requires --reason "<why the criteria changed>"');
       }
+      validateSingleLineReason(reason);
+      if (criterion === undefined !== (text === undefined)) {
+        throw new Error("flow ac update requires --criterion and --text together, or neither " + '(pass --reason "<why>" alone to re-freeze the file as already edited).');
+      }
+      const normalizedCriterion = criterion !== undefined ? validateCriterionName(criterion) : undefined;
+      const normalizedText = text !== undefined ? validateCriterionText(text) : undefined;
       return mutate(cwd, id, async ({ dir, flow }) => {
+        let detail = reason.trim();
+        if (normalizedCriterion !== undefined && normalizedText !== undefined) {
+          const known = await readAcCriteria(cwd, dir);
+          const highest = known.reduce((max, ac) => Math.max(max, Number(ac.slice(2)) || 0), 0);
+          const nextUnused = `AC${highest + 1}`;
+          if (!known.includes(normalizedCriterion) && normalizedCriterion !== nextUnused) {
+            const requestedNumber = Number(normalizedCriterion.slice(2));
+            const gapNote = requestedNumber < highest ? ` ${normalizedCriterion} is a gap in the numbering \u2014 this command cannot fill a gap; edit ` + 'acceptance-criteria.md directly and re-freeze with `flow ac update <id> --reason "..."` (no --criterion/--text).' : "";
+            throw new Error(`--criterion ${normalizedCriterion} is neither an existing criterion ` + `(${known.join(", ") || "none yet"}) nor the next unused one; the next number is ${nextUnused}.` + `${gapNote} Use an existing ACn to replace its text, or ${nextUnused} to add a new criterion.`);
+          }
+          const { previousText } = await writeAcCriterion(cwd, dir, normalizedCriterion, normalizedText);
+          detail = `${normalizedCriterion}: "${previousText ?? "(new)"}" -> "${normalizedText}" (${reason.trim()})`;
+        }
         flow.acChecksum = await acChecksum(cwd, dir);
         flow.acConfirmed = {};
-        return save(cwd, dir, flow, "ac-updated", reason);
+        return save(cwd, dir, flow, "ac-updated", detail);
       });
     },
     async acReseal({ cwd, id, reason }) {
       if (!reason?.trim()) {
         throw new Error('flow ac reseal requires --reason "<why the checksum is stale>"');
       }
+      validateSingleLineReason(reason);
       return mutate(cwd, id, async ({ dir, flow }) => {
         if (!flow.acChecksum) {
           throw new Error("flow ac reseal: the criteria are not frozen yet, so there is no checksum to re-seal.");
@@ -13604,7 +13899,15 @@ function createFlowService(deps) {
         return save(cwd, dir, flow, "implemented", detail);
       });
     },
-    async complete({ cwd, id, comment, mergedCommit }) {
+    async complete({
+      cwd,
+      id,
+      comment,
+      mergedCommit,
+      signedBy,
+      signedByEnv,
+      gitIdentity
+    }) {
       const dir = await resolveFlowDir(cwd, id);
       return withFileLock(flowLockPath(cwd, dir), async () => {
         let flow = await readFlow(cwd, dir);
@@ -13628,6 +13931,7 @@ function createFlowService(deps) {
         } catch {
           gates.push(unevaluableGate("acceptance-criteria"));
         }
+        let evaluatedHeadCommit = mergedCommit ?? undefined;
         if (mergedCommit) {
           const merge = deps.mainMergeGate ? await deps.mainMergeGate(cwd, mergedCommit) : await verifyCommitOnMain(cwd, mergedCommit);
           gates.push({ name: "main-merge", status: merge.status, detail: merge.detail });
@@ -13635,6 +13939,9 @@ function createFlowService(deps) {
           gates.push({ name: "pull-request", status: "fail", detail: "no PR recorded" });
         } else if (deps.tracker && await deps.tracker.detect()) {
           const pr = await deps.tracker.prStatus(flow.pr.url);
+          if (typeof pr.headSha === "string" && pr.headSha !== "") {
+            evaluatedHeadCommit ??= pr.headSha;
+          }
           gates.push(pr.exists && pr.checksGreen === true ? { name: "pull-request", status: "pass", detail: "PR exists, checks green" } : {
             name: "pull-request",
             status: "fail",
@@ -13649,6 +13956,7 @@ function createFlowService(deps) {
         }
         gates.push(await baseBranchCondition(cwd, flow, mergedCommit ?? undefined, flow.pr.url && deps.tracker && await deps.tracker.detect() ? (await deps.tracker.prStatus(flow.pr.url)).baseRefName : undefined, commitContainedIn));
         gates.push(taskGate(flow));
+        gates.push(ownerGate(flow));
         try {
           gates.push(await reviewGate({
             cwd,
@@ -13678,15 +13986,46 @@ function createFlowService(deps) {
           }
         }
         const passed = gates.every((gate) => gate.status !== "fail");
+        let tamperDetail;
+        try {
+          await assertAcIntact(cwd, dir, flow);
+        } catch (error) {
+          tamperDetail = error instanceof Error ? error.message : String(error);
+        }
+        const recordedGates = tamperDetail === undefined ? gates : [
+          ...gates,
+          {
+            name: "acceptance-criteria",
+            status: "fail",
+            detail: `acceptance criteria changed after this attempt's gates were evaluated, before it could be ` + `recorded: ${tamperDetail}`
+          }
+        ];
+        const recordedPassed = tamperDetail === undefined && passed;
+        flow.completionAttempts = [
+          ...flow.completionAttempts ?? [],
+          { at: now(), gates: recordedGates, passed: recordedPassed, acChecksum: flow.acChecksum }
+        ];
+        flow = await save(cwd, dir, flow, "completion-attempt-recorded", tamperDetail !== undefined ? `attempt ${flow.completionAttempts.length}: acceptance criteria tampered \u2014 ${tamperDetail}` : `attempt ${flow.completionAttempts.length}: ${recordedPassed ? "passed" : "failed"}`);
         let issueComment = null;
         let commented = false;
-        if (passed) {
+        if (recordedPassed) {
           if (mergedCommit) {
             flow.merged = { commit: mergedCommit, ref: "origin/main", at: now() };
           }
-          const warnNote = healthWarnNote(gates);
+          const completionIdentity = resolveSignerIdentity({ stated: signedBy, env: signedByEnv, gitIdentity });
+          flow.signatures = [
+            ...flow.signatures ?? [],
+            {
+              at: now(),
+              kind: "complete",
+              identity: completionIdentity,
+              acChecksum: flow.acChecksum,
+              ...evaluatedHeadCommit ? { headCommit: evaluatedHeadCommit } : {}
+            }
+          ];
+          const warnNote = healthWarnNote(recordedGates);
           flow = await transition(cwd, dir, flow, "done", "done", warnNote ? `all gates passed (${warnNote})` : "all gates passed");
-          issueComment = buildIssueComment(flow, gates);
+          issueComment = buildIssueComment(flow, recordedGates);
           if (comment && flow.source.type === "github-issue" && flow.source.ref && deps.tracker) {
             const ref = deps.tracker.parseRef(flow.source.ref);
             if (ref && await deps.tracker.detect()) {
@@ -13694,10 +14033,10 @@ function createFlowService(deps) {
             }
           }
         } else {
-          const failed = gates.filter((gate) => gate.status === "fail");
+          const failed = recordedGates.filter((gate) => gate.status === "fail");
           flow = await transition(cwd, dir, flow, "in-progress", "completion-failed", failed.map((gate) => `${gate.name}: ${gate.detail}`).join(" | "));
         }
-        return { flow, gates, passed, issueComment, commented };
+        return { flow, gates: recordedGates, passed: recordedPassed, issueComment, commented };
       });
     },
     async block({ cwd, id, reason }) {
@@ -13932,6 +14271,23 @@ function taskGate(flow) {
   }
   return { name: "tasks", status: "fail", detail: reasons.join("; ") };
 }
+function ownerGate(flow) {
+  if (!flow.gates?.owner) {
+    return {
+      name: "owner",
+      status: "skipped",
+      detail: "owner gate not enabled for this package (created before the gate); " + "flows created by this keryx version opt in automatically"
+    };
+  }
+  if (!flow.owner?.value) {
+    return {
+      name: "owner",
+      status: "fail",
+      detail: 'no owner set; run `keryx flow owner set <id> --owner "<name>" --reason "<why>"`'
+    };
+  }
+  return { name: "owner", status: "pass", detail: `owner: ${flow.owner.value}` };
+}
 async function isPlaceholderAc(cwd, dir) {
   const content = await Bun.file(acPath(cwd, dir)).text();
   return content.includes("<replace with a hard, verifiable criterion");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.153",
+  "version": "0.2.155",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {
@@ -45,7 +45,7 @@
     "typecheck": "tsc --noEmit",
     "typecheck:scripts": "tsc --project tsconfig.scripts.json --noEmit",
     "test": "bun test",
-    "test:core": "bun test src/cli src/core src/shell-source-audits.test.ts src/assets/ src/capability/ src/commands/ src/contracts/ src/ctx/ src/eval/ src/flow/ src/forgetting/ src/gdgraph/ src/gdskills/ src/health/ src/job/ src/lib/ src/mcp/ src/memory/ src/metrics/ src/retention/ src/review/ src/sac/ src/security/ src/standard/ src/sync/ src/testing/ src/wiki/",
+    "test:core": "bun test src/cli src/core src/shell-source-audits.test.ts src/acp/ src/assets/ src/capability/ src/commands/ src/contracts/ src/ctx/ src/eval/ src/flow/ src/forgetting/ src/gdgraph/ src/gdskills/ src/governance/ src/health/ src/job/ src/lib/ src/mcp/ src/memory/ src/metrics/ src/retention/ src/review/ src/sac/ src/security/ src/standard/ src/sync/ src/testing/ src/trigger/ src/wiki/",
     "test:client:terminal": "bun test src/tui/ src/commands/shell",
     "test:client:streaming": "bun test src/harness/provider/",
     "test:client:cancel-resume": "bun test src/harness/run/ src/harness/resume/ src/harness/session/ src/session/ src/bus/ src/commands/sessions",

package/src/gdskills/bundled/rules/core/definition-of-done.mdc

@@ -93,7 +93,9 @@ not done either.
 When a frozen criterion genuinely conflicts with the bar — it asks for
 something that cannot be delivered without failing a clause — the criterion is
 not quietly reworded to match what was built. It changes through
-`keryx flow ac update <id> --reason "<why>"`, with the conflict as the reason,
+`keryx flow ac update <id> --reason "<why>"` (or `--criterion ACn --text
+"<criterion>" --reason "<why>"` to rewrite the line itself), with the conflict
+as the reason,
 per `.metaproject/skills/gdskills/orchestration/flow-orchestrator/SKILL.md`.
 Rewriting a criterion to describe the work is how a flow loses the only record
 of what it set out to do.

package/src/gdskills/bundled/skills/orchestration/flow-orchestrator/SKILL.md

@@ -60,7 +60,7 @@ CLI-owned files:
 - task status - only through `keryx flow task done ...`.
 - task attempt counts - only through `keryx flow task attempt ...`.
 - frozen acceptance criteria changes - only through
-  `keryx flow ac update <id> --reason "<why>"`.
+  `keryx flow ac update <id> --reason "<why>"` (or `--criterion ACn --text "…"`; unused arguments are refused).
 
 Agent-editable files:
 
@@ -199,7 +199,7 @@ keryx flow init --issue <url>
 or:
 
 ```bash
-keryx flow init --title "<short formalized problem>" --base "<branch the work must land on>"
+keryx flow init --title "<short formalized problem>" --base "<branch the work must land on>" [--owner "<name>"]
 ```
 
 5. Run `keryx flow status <id>` and read the flow package.
@@ -631,7 +631,7 @@ keryx flow complete <id>
 
 Completion is allowed only after the PR merge has been confirmed. The merge
 target must be the base branch captured when the flow was created; do not
-silently retarget or close against another branch.
+silently retarget or close against another branch. Flows created since the owner gate fail completion while no owner is set (`keryx flow owner set <id> --owner "<name>" --reason "<why>"`); `ac confirm` and `flow complete` append a signature — `--signed-by "<name>"` names the signer, otherwise `KERYX_ACTOR` or the local git identity is recorded, as a claim.
 
 If gates fail, the CLI returns the flow to `in-progress`. Add a journal note,
 create fix tasks, and repeat Phase 2.
@@ -688,7 +688,7 @@ Stop and re-read this skill if you are thinking:
 |---|---|
 | "The worker's reply reads like it finished, so the task is done." | The STATUS protocol says read the `STATUS:` line first and never infer the outcome from prose. A reply without one is `NEEDS_CONTEXT` — a confident-sounding summary is exactly what an unusable result looks like. |
 | "`DONE_WITH_CONCERNS` is still done, so I can move on." | Every concern goes into `journal.md` and gets an explicit continue-or-fix decision before `flow task done`. Concerns dropped at the task boundary are invisible by the completion report, which is where they would have mattered. |
-| "The acceptance criterion no longer matches what we built, so I'll reword it." | Frozen AC changes only through `keryx flow ac update <id> --reason "<why>"`. Rewriting a criterion to fit the implementation makes the flow pass a gate it actually failed, and leaves no record that it moved. |
+| "The acceptance criterion no longer matches what we built, so I'll reword it." | Frozen AC changes only through `keryx flow ac update <id> --reason "<why>"`, or `--criterion ACn --text "<criterion>" --reason "<why>"` to rewrite the line itself. Rewriting a criterion to fit the implementation makes the flow pass a gate it actually failed, and leaves no record that it moved. |
 | "`flow.json` is just a file — editing one field is faster than the CLI." | `flow.json`, status transitions, task status and attempt counts are CLI-owned. A hand-written field desynchronises the durable state from the flow's own history, and the CLI's next gate check reads yours, not reality. |
 | "Tests pass and the review is clean, so I'll open the PR and complete the flow." | Phase 4 stops and asks the user how the flow should end; not every flow wants a PR. And completion requires a confirmed merge into the base branch captured at creation — not a green local run. |
 | "The worker returned BLOCKED twice — faster if I implement this task myself." | The implementer never self-accepts and the orchestrator never implements. Block the flow, escalate one concise question, then unblock and re-dispatch. Doing the work here erases the boundary the whole flow model rests on. |