@nathapp/nax 0.67.0-canary.7 → 0.67.0

package/dist/nax.js

@@ -17156,7 +17156,8 @@ var init_schemas_infra = __esm(() => {
   PromptsConfigSchema = exports_external.object({
     overrides: exports_external.record(exports_external.string().refine((key) => ["no-test", "test-writer", "implementer", "verifier", "single-session", "tdd-simple"].includes(key), {
       message: "Role must be one of: no-test, test-writer, implementer, verifier, single-session, tdd-simple"
-    }), exports_external.string().min(1, "Override path must be non-empty")).optional()
+    }), exports_external.string().min(1, "Override path must be non-empty")).optional(),
+    behavioralGuardrails: exports_external.enum(["off", "lite", "strict"]).default("lite")
   });
   ProjectProfileSchema = exports_external.object({
     language: exports_external.enum(["typescript", "javascript", "go", "rust", "python", "ruby", "java", "kotlin", "php"]).optional(),
@@ -17550,7 +17551,7 @@ var init_schemas3 = __esm(() => {
         maxReplanAttempts: 3
       }
     }),
-    prompts: PromptsConfigSchema.optional(),
+    prompts: PromptsConfigSchema.default({ behavioralGuardrails: "lite" }),
     generate: GenerateConfigSchema.optional(),
     project: ProjectProfileSchema.optional(),
     debate: DebateConfigSchema.optional().default(() => ({
@@ -22600,6 +22601,15 @@ var init_conventions = __esm(() => {
   ]);
   DEFAULT_SEPARATED_TEST_DIRS = Object.freeze(["test/unit", "test/integration"]);
 });
+
+// src/test-runners/classifier.ts
+function createTestFileClassifier(resolved) {
+  const { regex } = resolved;
+  if (regex.length === 0)
+    return () => false;
+  return (path) => regex.some((re) => re.test(path));
+}
+
 // src/test-runners/detect/cache.ts
 function cachePath(workdir) {
   return `${workdir}/.nax/cache/test-patterns.json`;
@@ -24156,6 +24166,32 @@ var init_ac_parser = __esm(() => {
 });
 
 // src/test-runners/index.ts
+var exports_test_runners = {};
+__export(exports_test_runners, {
+  resolveTestFilePatterns: () => resolveTestFilePatterns,
+  resolveReviewExcludePatterns: () => resolveReviewExcludePatterns,
+  parseTestOutput: () => parseTestOutput,
+  parseTestFailures: () => parseTestFailures,
+  parseBunTestOutput: () => parseBunTestOutput,
+  isTestFileByPatterns: () => isTestFileByPatterns,
+  isTestFile: () => isTestFile,
+  globsToTestRegex: () => globsToTestRegex,
+  globsToPathspec: () => globsToPathspec,
+  formatFailureSummary: () => formatFailureSummary,
+  findPackageDir: () => findPackageDir,
+  extractTestDirs: () => extractTestDirs,
+  detectTestFilePatterns: () => detectTestFilePatterns,
+  detectManifestFrameworksFromPackageJson: () => detectManifestFrameworksFromPackageJson,
+  detectFramework: () => detectFramework,
+  createTestFileClassifier: () => createTestFileClassifier,
+  buildTestFrameworkHint: () => buildTestFrameworkHint,
+  analyzeTestExitCode: () => analyzeTestExitCode,
+  _resolverDeps: () => _resolverDeps,
+  DEFAULT_TS_DERIVE_SUFFIXES: () => DEFAULT_TS_DERIVE_SUFFIXES,
+  DEFAULT_TEST_FILE_PATTERNS: () => DEFAULT_TEST_FILE_PATTERNS,
+  DEFAULT_SEPARATED_TEST_DIRS: () => DEFAULT_SEPARATED_TEST_DIRS,
+  DEFAULT_SCAN_TEST_DIRS: () => DEFAULT_SCAN_TEST_DIRS
+});
 var init_test_runners = __esm(() => {
   init_conventions();
   init_detect2();
@@ -29086,13 +29122,14 @@ isolation scope: You may modify both src/ and test/ files. Write failing tests F
 }
 
 // src/prompts/sections/role-task.ts
-function buildRoleTaskSection(roleOrVariant, variant, testCommand, isolation, noTestJustification) {
+function buildRoleTaskSection(roleOrVariant, variant, testCommand, isolation, noTestJustification, storyId) {
   if ((roleOrVariant === "standard" || roleOrVariant === "lite") && variant === undefined) {
-    return buildRoleTaskSection("implementer", roleOrVariant, testCommand, isolation);
+    return buildRoleTaskSection("implementer", roleOrVariant, testCommand, isolation, noTestJustification, storyId);
   }
   const role = roleOrVariant;
   const testCmd = testCommand ?? "";
   const frameworkHint = buildTestFrameworkHint(testCmd);
+  const commitMsg = storyId ? `feat(${storyId}): <description>` : "feat: <description>";
   if (role === "no-test") {
     const justification = noTestJustification ?? "No behavioral changes \u2014 tests not required";
     return `# Role: Implementer (No Tests)
@@ -29103,7 +29140,7 @@ Instructions:
 - Implement the change as described in the story
 - Do NOT create or modify test files
 - Justification for no tests: ${justification}
-- When done, stage and commit ALL changed files with: git commit -m 'feat: <description>'
+- When done, stage and commit ALL changed files with: git commit -m '${commitMsg}'
 - Goal: change implemented, no test files created or modified, all changes committed`;
   }
   if (role === "implementer") {
@@ -29111,62 +29148,78 @@ Instructions:
     if (v === "standard") {
       return `# Role: Implementer
 
-Your task: make failing tests pass.
+Your task: make the failing tests pass by writing real source code.
 
-Instructions:
-- Implement source code in src/ to make tests pass
-- Do NOT modify test files \u2014 three narrow lint/contract/sibling exceptions exist; see the escape valve section in the rectification prompt if you encounter one
-- Run tests frequently to track progress
-- When all tests are green, stage and commit ALL changed files with: git commit -m 'feat: <description>'
-- Goal: all tests green, all changes committed`;
+Workflow:
+1. Read every failing test in scope. The tests are the contract \u2014 understand what each one asserts before editing source.
+2. Run the scoped test files once to establish the baseline (which fail, which pass, and why).
+3. Implement source code in the package's source location (the project context names it).
+4. After each meaningful change, re-run only the scoped test files \u2014 never the full suite.
+5. When all scoped tests pass, stage and commit ALL changed files: \`git commit -m '${commitMsg}'\`.
+
+Rules:
+- Do NOT modify test files. Three narrow exceptions: (a) a lint-only fix to a test, (b) a contract drift where the test imports a removed/renamed symbol, (c) a sibling test file rename forced by your source change. Name which exception applies in the commit body before editing any test file.
+- Goal: every acceptance criterion covered by at least one passing test; all changes committed.`;
     }
     return `# Role: Implementer (Lite)
 
-Your task: Make the failing tests pass AND add any missing test coverage.
+Your task: make the failing tests pass AND fill any test coverage gaps an earlier session left.
 
-Context: A test-writer session has already created test files with failing tests and possibly minimal stubs in src/. Your job is to make those tests pass by implementing the real logic.
+Context: A test-writer session has already created tests and may have added minimal stubs in the package's source location. Your job is to (a) replace stubs with real implementations and (b) confirm every AC has test coverage before committing.
 
-Instructions:
-- Start by running the existing tests to see what's failing
-- Implement source code in src/ to make all failing tests pass
-- You MAY add additional tests if you find gaps in coverage
-- Replace any stubs with real implementations
+Workflow:
+1. Run the existing scoped tests to see which fail and why (assertion failure vs import error).
+2. Read each failing test. Note which ACs they cover and which they DON'T.
+3. Replace stubs with real implementations. A stub is one of: a type-only declaration, a function returning a placeholder/throwing "not implemented", or a const placeholder.
+4. If any AC has no test, add one before implementing \u2014 do not implement uncovered behavior.
+5. Re-run only the scoped test files after each meaningful change.
+6. When all scoped tests pass, stage and commit ALL changed files: \`git commit -m '${commitMsg}'\`.
+
+Rules:
+- Three test-modification exceptions apply (lint-only fix, contract drift, sibling rename). Name the exception in the commit body before editing any test the test-writer wrote.
 - ${frameworkHint}
-- When all tests are green, stage and commit ALL changed files with: git commit -m 'feat: <description>'
-- Goal: all tests green, all criteria met, all changes committed`;
+- Goal: every AC has at least one passing test; all stubs replaced with real logic; all changes committed.`;
   }
   if (role === "test-writer") {
     if (isolation === "lite") {
       return `# Role: Test-Writer (Lite)
 
-Your task: Write failing tests for the feature. You may create minimal stubs to support imports.
+Your task: write failing tests AND minimal stubs that let the tests compile.
 
 Context: You are session 1 of a multi-session workflow. An implementer will follow to make your tests pass.
 
-Instructions:
-- Create test files in test/ directory that cover all acceptance criteria
-- Tests must fail initially (RED phase) \u2014 do NOT implement real logic
+Workflow:
+1. Re-read the acceptance criteria above.
+2. Create test files in the location the project uses for tests.
+3. Create stubs in the package's source location so the tests can import and compile. A stub is one of: a type/interface declaration, a function returning a placeholder/throwing "not implemented" (no more than 3 lines of body), or a const placeholder. If a stub body needs real logic, you have crossed into implementer territory \u2014 stop.
+4. For each AC: at least one success-path test and one boundary/failure-path test.
+5. Run the new test files. Confirm tests compile (stubs work) AND fail with ASSERTION failures \u2014 NOT import errors or compile errors. A test that errors before reaching its assertion does not prove the behavior is missing.
+
+Rules:
+- Stubs are NOT implementations. The implementer in the next session writes real logic.
+- Each test name describes ONE behavior. Use AC IDs in test names when available (e.g. \`it('AC4: throws Division by zero when b === 0')\`).
+- Assert on observable outputs.
 - ${frameworkHint}
-- You MAY read src/ files and import types/interfaces from them
-- You MAY create minimal stubs in src/ (type definitions, empty functions) so tests can import and compile
-- Write clear test names that document expected behavior
-- Focus on behavior, not implementation details
-- Goal: comprehensive failing test suite with compilable imports, ready for implementation`;
+- Goal: comprehensive failing test suite that compiles, with stubs \u22643 lines each, ready for implementation.`;
     }
     return `# Role: Test-Writer
 
-Your task: Write comprehensive failing tests for the feature.
+Your task: write failing tests that pin down every acceptance criterion. An implementer will follow.
 
-Context: You are session 1 of a multi-session workflow. An implementer will follow to make your tests pass.
+Context: You are session 1 of a multi-session workflow.
 
-Instructions:
-- Create test files in test/ directory that cover all acceptance criteria
-- Tests must fail initially (RED phase) \u2014 the feature is not yet implemented
-- Do NOT create or modify any files in src/
+Workflow:
+1. Re-read the acceptance criteria above.
+2. Create test files in the location the project uses for tests (project context names it).
+3. For each AC: write at least one test for the success path AND at least one for a boundary/failure path (zero, empty, negative, missing, throws). ACs worded as "throws X" require a test asserting the throw.
+4. Run the new test files. Confirm every test fails with an ASSERTION failure \u2014 NOT an import error, compile error, or runtime crash before assertion. A test that errors before reaching its assertion does not prove the behavior is missing.
+
+Rules:
+- Do NOT create or modify any source files. Read source for types/interfaces only.
+- Each test name describes ONE behavior; each test asserts ONE behavior. When the AC has a number or ID, prefix the test name (e.g. \`it('AC4: throws Division by zero when b === 0')\`).
+- Assert on observable outputs (return values, thrown errors, file contents, log output, boundary state). Do not assert on private helpers, internal call counts, or implementation-level mocks unless the AC requires it.
 - ${frameworkHint}
-- Write clear test names that document expected behavior
-- Focus on behavior, not implementation details
-- Goal: comprehensive failing test suite ready for implementation`;
+- Goal: every AC has at least one failing test that fails at assertion time and clearly documents what the implementer must build.`;
   }
   if (role === "verifier") {
     return `# Role: Verifier
@@ -29187,45 +29240,59 @@ Instructions:
   if (role === "single-session") {
     return `# Role: Single-Session
 
-Your task: Write tests AND implement the feature in a single focused session.
+Your task: write tests AND implement the feature in one session.
 
-Instructions:
-- Phase 1: Write comprehensive tests (test/ directory)
-- Phase 2: Implement to make all tests pass (src/ directory)
+Workflow:
+1. Read the acceptance criteria. For each AC, plan one success-path test and one boundary/failure test.
+2. Create test files in the location the project uses for tests. Cover every AC.
+3. Run the tests to confirm they fail with ASSERTION failures \u2014 NOT import errors or compile errors. A test that errors before reaching its assertion does not prove the behavior is missing.
+4. Implement source code in the package's source location to make the tests pass.
+5. After each meaningful change, re-run only the scoped test files \u2014 never the full suite.
+6. When all scoped tests pass, stage and commit ALL changed files: \`git commit -m '${commitMsg}'\`.
+
+Rules:
+- Each test name describes ONE behavior; use AC IDs when available.
+- Assert on observable outputs.
 - ${frameworkHint}
-- Run tests frequently throughout implementation
-- When all tests are green, stage and commit ALL changed files with: git commit -m 'feat: <description>'
-- Goal: all tests passing, all changes committed, full story complete`;
+- Goal: every AC has at least one passing test; all changes committed.`;
   }
   if (role === "batch") {
-    const verifyCmdLine = testCmd ? `  - Verify all tests pass: ${testCmd}` : "  - Verify all tests pass using your project's test command";
+    const verifyCmdLine = testCmd ? `  - Re-run only the scoped test files after each meaningful change: ${testCmd}` : "  - Re-run only the scoped test files after each meaningful change";
     return `# Role: Batch Implementer
 
-Your task: Implement each story in order using TDD \u2014 write tests first, then implement, then verify.
+Your task: implement each story in order using TDD \u2014 write tests first, then implement, then commit per story.
 
-Instructions:
-- Process each story in order (Story 1, Story 2, \u2026)
-- For each story:
-  - Write failing tests FIRST covering the acceptance criteria
-  - Run tests to confirm they fail (RED phase)
-  - Implement the minimum code to make tests pass (GREEN phase)
-${verifyCmdLine}
-  - Commit the story with its story ID in the commit message: git commit -m 'feat(<story-id>): <description>'
+Per-story workflow (RED \u2192 GREEN):
+1. RED \u2014 write failing tests in the location the project uses for tests covering the story's ACs (success + boundary).
+2. RED \u2014 run the new test files. Confirm assertion failures \u2014 NOT import errors or compile errors. A test that errors before reaching its assertion does not prove the behavior is missing.
+3. GREEN \u2014 implement source code in the package's source location.
+4. GREEN \u2014 re-run only the scoped test files after each meaningful change.
+5. Commit the story with its ID: \`git commit -m 'feat(<story-id>): <description>'\`.
+
+Rules:
+- One commit per story \u2014 never bundle stories.
+- Process stories in order (Story 1, Story 2, \u2026).
+- Each test name describes ONE behavior; use AC IDs when available.
 - ${frameworkHint}
-- Do NOT commit multiple stories together \u2014 each story gets its own commit
-- Goal: all stories implemented, all tests passing, each story committed with its story ID`;
+${verifyCmdLine}
+- Goal: every story implemented with passing tests; one commit per story tagged with the story ID.`;
   }
   return `# Role: TDD-Simple
 
-Your task: Write failing tests FIRST, then implement to make them pass.
+Your task: write failing tests FIRST, then implement in one session.
 
-Instructions:
-- RED phase: Write failing tests FIRST for the acceptance criteria
-- RED phase: Run the tests to confirm they fail
-- GREEN phase: Implement the minimum code to make tests pass
-- REFACTOR phase: Refactor while keeping tests green
-- When all tests are green, stage and commit ALL changed files with: git commit -m 'feat: <description>'
-- Goal: all tests passing, feature complete, all changes committed`;
+Workflow (RED \u2192 GREEN \u2192 REFACTOR):
+1. RED \u2014 write failing tests in the location the project uses for tests covering every AC (success + boundary).
+2. RED \u2014 run the tests. Confirm they fail with ASSERTION failures \u2014 NOT import errors or compile errors. A test that errors before reaching its assertion does not prove the behavior is missing.
+3. GREEN \u2014 implement minimum source code in the package's source location to make the tests pass.
+4. GREEN \u2014 re-run only the scoped test files after each meaningful change.
+5. REFACTOR \u2014 clean up while keeping tests green. No new behavior; no expanded scope.
+6. Stage and commit ALL changed files: \`git commit -m '${commitMsg}'\`.
+
+Rules:
+- Each test name describes ONE behavior; use AC IDs when available.
+- ${frameworkHint}
+- Goal: every AC covered by passing tests; refactor complete; all changes committed.`;
 }
 var init_role_task = __esm(() => {
   init_test_runners();
@@ -29457,6 +29524,97 @@ function buildSelfVerificationSection(role, input) {
 }
 var CHECK_HEADER = "# Self-Verification Gate";
 
+// src/prompts/sections/behavioral-guardrails.ts
+function buildBehavioralGuardrailsSection(role, level, _variant, _isolation) {
+  if (level === "off" || role === "verifier" || role === "no-test") {
+    return null;
+  }
+  if (role === "test-writer") {
+    return buildTestWriterGuardrails(level);
+  }
+  if (role === "single-session" || role === "tdd-simple" || role === "batch") {
+    return buildCombinedGuardrails(level);
+  }
+  return buildImplementerGuardrails(level);
+}
+function buildTestWriterGuardrails(level) {
+  const lines = [
+    "# Behavioral Guardrails",
+    "",
+    "- Simplicity: write tests that cover the acceptance criteria. No tests for behaviors the story does not require.",
+    "- Surgical: do not modify source files beyond the stub allowance in the Isolation Rules above. Do not add tests for unrelated existing code."
+  ];
+  if (level === "strict") {
+    lines.push("- State Assumptions: when the story is ambiguous, pick an interpretation, proceed, and document the choice in the commit body under `Assumptions:`. Do not invent requirements; do not silently choose when the story is genuinely under-specified \u2014 note it.");
+  }
+  return lines.join(`
+`);
+}
+function buildCombinedGuardrails(level) {
+  if (level === "lite") {
+    return `# Behavioral Guardrails
+
+- Simplicity (tests): write tests that cover the acceptance criteria only. No tests for behaviors the story does not require.
+- Simplicity (source): write the minimum source code that makes the tests pass. No speculative abstractions, configurability, or error handling for scenarios that cannot occur.
+- Surgical: every changed line must trace to the story. Do not refactor adjacent code, reformat unrelated files, or rename symbols beyond what the story requires.
+- Anti-cheat: do not weaken assertions, catch-and-swallow exceptions in tests, or add tautological assertions to coerce a green run.
+- Orphans: remove imports/variables/helpers that YOUR changes made unused. Do not delete pre-existing dead code.
+- Commit: include the story ID when known \u2014 \`feat(<story-id>): <description>\`.`;
+  }
+  return `# Behavioral Guardrails
+
+## Simplicity (Tests)
+Write tests that cover the acceptance criteria only. No tests for behaviors the story does not require. Every test you add is a constraint the implementer must satisfy \u2014 do not over-constrain with speculative behavior.
+
+## Simplicity (Source)
+Write the minimum source code that makes the tests pass. Every line you add is a line someone else must read, understand, and maintain. Do not add speculative abstractions, configurability, or error handling for scenarios that cannot occur given the story's constraints.
+
+## Surgical
+Every changed line must trace directly to a story requirement or a failing test. Do not refactor adjacent code, reformat unrelated files, or rename symbols beyond what the story requires. Reviewers will flag any change that cannot be linked to a specific requirement.
+
+## Anti-cheat
+Do not weaken assertions, catch-and-swallow exceptions in tests, or add tautological assertions to coerce a green run. A green test suite achieved by weakening tests is not a passing implementation \u2014 it is a failing one with hidden evidence.
+
+## Orphans
+Remove imports, variables, and helpers that YOUR changes made unused. Do not delete pre-existing dead code that was already there before your changes.
+
+## Commit
+Include the story ID when known \u2014 \`feat(<story-id>): <description>\`.
+
+## State Assumptions
+When the story is ambiguous, pick an interpretation, proceed, and document the choice in the commit body under \`Assumptions:\`. Do not invent requirements; do not silently choose when the story is genuinely under-specified \u2014 note it.`;
+}
+function buildImplementerGuardrails(level) {
+  if (level === "lite") {
+    return `# Behavioral Guardrails
+
+- Simplicity: write the minimum code that makes the tests pass. No speculative abstractions, configurability, or error handling for scenarios that cannot occur.
+- Surgical: every changed line must trace to the story. Do not refactor adjacent code, reformat unrelated files, or rename symbols beyond what the story requires.
+- Anti-cheat: do not weaken assertions, catch-and-swallow exceptions in tests, or add tautological assertions to coerce a green run.
+- Orphans: remove imports/variables/helpers that YOUR changes made unused. Do not delete pre-existing dead code.
+- Commit: include the story ID when known \u2014 \`feat(<story-id>): <description>\`.`;
+  }
+  return `# Behavioral Guardrails
+
+## Simplicity
+Write the minimum code that makes the tests pass. Every line you add is a line someone else must read, understand, and maintain. Do not add speculative abstractions, configurability, or error handling for scenarios that cannot occur given the story's constraints. If it isn't required by a test or acceptance criterion, don't write it.
+
+## Surgical
+Every changed line must trace directly to a story requirement or a failing test. Do not refactor adjacent code, reformat unrelated files, or rename symbols beyond what the story requires. Reviewers will flag any change that cannot be linked to a specific requirement.
+
+## Anti-cheat
+Do not weaken assertions, catch-and-swallow exceptions in tests, or add tautological assertions to coerce a green run. A green test suite achieved by weakening tests is not a passing implementation \u2014 it is a failing one with hidden evidence.
+
+## Orphans
+Remove imports, variables, and helpers that YOUR changes made unused. Do not delete pre-existing dead code that was already there before your changes.
+
+## Commit
+Include the story ID when known \u2014 \`feat(<story-id>): <description>\`.
+
+## State Assumptions
+When the story is ambiguous, pick an interpretation, proceed, and document the choice in the commit body under \`Assumptions:\`. Do not invent requirements; do not silently choose when the story is genuinely under-specified \u2014 note it.`;
+}
+
 // src/prompts/sections/index.ts
 var init_sections2 = __esm(() => {
   init_hermetic();
@@ -29614,6 +29772,12 @@ class TddPromptBuilder {
       if (hermeticSection)
         acc.add(this.s("hermetic", hermeticSection));
     }
+    const guardrailLevel = this.loaderConfig_?.prompts?.behavioralGuardrails ?? "lite";
+    const guardrailVariant = this.options.variant;
+    const guardrailIsolation = this.options.isolation;
+    const guardrails = buildBehavioralGuardrailsSection(this.role, guardrailLevel, guardrailVariant, guardrailIsolation);
+    if (guardrails)
+      acc.add(this.s("guardrails", guardrails));
     if (this.role !== "verifier") {
       const selfVerify = buildSelfVerificationSection(this.role, this.selfVerification_);
       if (selfVerify)
@@ -29650,7 +29814,7 @@ class TddPromptBuilder {
     }
     const variant = this.options.variant;
     const isolation = this.options.isolation;
-    return buildRoleTaskSection(this.role, variant, this.testCommand_, isolation, this.noTestJustification_);
+    return buildRoleTaskSection(this.role, variant, this.testCommand_, isolation, this.noTestJustification_, this.story_?.id);
   }
 }
 var init_tdd_builder = __esm(() => {
@@ -36082,11 +36246,6 @@ function makePassResult(storyId, strategy, opts = {}) {
   };
 }
 
-// src/verification/parser.ts
-var init_parser2 = __esm(() => {
-  init_test_runners();
-});
-
 // src/utils/process-kill.ts
 function killProcessGroup(pid, signal) {
   try {
@@ -36335,9 +36494,9 @@ async function regression(options) {
 }
 var _regressionRunnerDeps;
 var init_runners = __esm(() => {
+  init_test_runners();
   init_bun_deps();
   init_executor();
-  init_parser2();
   _regressionRunnerDeps = {
     sleep
   };
@@ -36633,8 +36792,8 @@ class ScopedStrategy {
 var DEFAULT_SMART_RUNNER_CONFIG, _scopedDeps;
 var init_scoped = __esm(() => {
   init_logger2();
-  init_conventions();
-  init_parser2();
+  init_test_runners();
+  init_test_runners();
   init_runners();
   init_smart_runner();
   DEFAULT_SMART_RUNNER_CONFIG = {
@@ -37080,7 +37239,8 @@ ${debateResult.output}`;
         story,
         failures: failureRecords,
         testCommand,
-        conventions: true
+        conventions: true,
+        guardrailLevel: config2.prompts.behavioralGuardrails
       });
       const rectPromise = Promise.resolve(rectPrompt);
       return (async () => {
@@ -37292,8 +37452,7 @@ var init_rectification_loop = __esm(() => {
   init_prompts();
   init_session_name();
   init_session_keeper();
-  init_parser2();
-  init_parser2();
+  init_test_runners();
   init_runners();
   _rectificationDeps = {
     agentManager: undefined,
@@ -37310,19 +37469,15 @@ __export(exports_verification, {
   shouldRetryRectification: () => shouldRetryRectification,
   scoped: () => scoped,
   runRetryLoop: () => runRetryLoop,
+  runRectificationLoop: () => runRectificationLoop,
   regression: () => regression,
-  parseTestOutput: () => parseTestOutput,
-  parseBunTestOutput: () => parseBunTestOutput,
   normalizeEnvironment: () => normalizeEnvironment,
   fullSuite: () => fullSuite,
-  formatFailureSummary: () => formatFailureSummary,
   executeWithTimeout: () => executeWithTimeout,
-  detectFramework: () => detectFramework,
   buildTestCommand: () => buildTestCommand,
   buildProgressivePromptPreamble: () => buildProgressivePromptPreamble,
   appendOpenHandlesFlag: () => appendOpenHandlesFlag,
   appendForceExitFlag: () => appendForceExitFlag,
-  analyzeTestExitCode: () => analyzeTestExitCode,
   _regressionRunnerDeps: () => _regressionRunnerDeps,
   _rectificationDeps: () => _rectificationDeps,
   _executorDeps: () => _executorDeps
@@ -37330,7 +37485,6 @@ __export(exports_verification, {
 var init_verification = __esm(() => {
   init_rectification_loop();
   init_executor();
-  init_parser2();
   init_runners();
 });
 
@@ -37359,7 +37513,8 @@ var init_full_suite_gate = __esm(() => {
       return { config: config2, testCmd: resolvedTestCmd, fullSuiteTimeout };
     },
     runTests: async (input, gateCtx) => {
-      const { executeWithTimeout: executeWithTimeout2, parseTestOutput: parseTestOutput2 } = await Promise.resolve().then(() => (init_verification(), exports_verification));
+      const { executeWithTimeout: executeWithTimeout2 } = await Promise.resolve().then(() => (init_verification(), exports_verification));
+      const { parseTestOutput: parseTestOutput2 } = await Promise.resolve().then(() => (init_test_runners(), exports_test_runners));
       const result = await executeWithTimeout2(gateCtx.testCmd, gateCtx.fullSuiteTimeout, undefined, {
         cwd: input.workdir
       });
@@ -40502,7 +40657,7 @@ function renderPrioritizedFailures(failedChecks, opts) {
 }
 
 class RectifierPromptBuilder {
-  static firstAttemptDelta(failedChecks, maxAttempts) {
+  static firstAttemptDelta(failedChecks, maxAttempts, guardrailLevel) {
     const parts = [];
     const attemptWord = maxAttempts === 1 ? "1 attempt" : `${maxAttempts} attempts`;
     parts.push(`Review failed after your implementation. Fix the following issues (${attemptWord} available before escalation):
@@ -40511,10 +40666,16 @@ class RectifierPromptBuilder {
     parts.push(`
 Fix in priority order. After fixing each priority, re-run the failing check(s) at that level to verify they pass before moving on. Do NOT change test files or test behavior \u2014 see the three narrow exceptions appended below. Commit your changes when all checks pass.`);
     parts.push(CONTRADICTION_ESCAPE_HATCH);
+    const guardrails = buildBehavioralGuardrailsSection("implementer", guardrailLevel ?? "lite");
+    if (guardrails) {
+      parts.push(`
+
+${guardrails}`);
+    }
     return parts.join(`
 `);
   }
-  static continuation(failedChecks, attempt, rethinkAtAttempt, urgencyAtAttempt) {
+  static continuation(failedChecks, attempt, rethinkAtAttempt, urgencyAtAttempt, guardrailLevel) {
     const parts = [];
     parts.push(`Your previous fix attempt did not resolve all issues. Here are the remaining failures:
 `);
@@ -40528,6 +40689,12 @@ Fix in priority order. After fixing each priority, re-run the failing check(s) a
       parts.push("\n**URGENT: This is your final attempt.** If you cannot fix all issues, emit `UNRESOLVED: <reason>` to escalate.\n");
     }
     parts.push(CONTRADICTION_ESCAPE_HATCH);
+    const guardrails = buildBehavioralGuardrailsSection("implementer", guardrailLevel ?? "lite");
+    if (guardrails) {
+      parts.push(`
+
+${guardrails}`);
+    }
     return parts.join(`
 `);
   }
@@ -40919,6 +41086,13 @@ ${basePrompt}`;
       parts.push(buildIsolationSection("implementer", opts.isolation, undefined));
       parts.push(`
 
+`);
+    }
+    const guardrails = buildBehavioralGuardrailsSection("implementer", opts.guardrailLevel ?? "lite");
+    if (guardrails) {
+      parts.push(guardrails);
+      parts.push(`
+
 `);
     }
     if (opts.conventions !== false) {
@@ -40975,7 +41149,7 @@ Fix the implementation (not the tests) to make all failing tests pass. Run the t
 var PRIORITY_BUCKETS, PRIORITY_ORDER;
 var init_rectifier_builder = __esm(() => {
   init_review();
-  init_verification();
+  init_test_runners();
   init_core3();
   init_sections2();
   init_rectifier_builder_helpers();
@@ -46911,11 +47085,6 @@ var init_types8 = __esm(() => {
       safety: "yellow",
       defaultSummary: "Story {{storyId}} is oversized ({{criteriaCount}} acceptance criteria) \u2014 decompose into smaller stories?"
     },
-    "story-ambiguity": {
-      defaultFallback: "continue",
-      safety: "green",
-      defaultSummary: "Story {{storyId}} requirements unclear \u2014 continue with best effort?"
-    },
     "review-gate": {
       defaultFallback: "continue",
       safety: "green",
@@ -48315,12 +48484,6 @@ async function checkPreMerge(context, config2, chain) {
   const response = await executeTrigger("pre-merge", context, config2, chain);
   return response.action === "approve";
 }
-async function checkStoryAmbiguity(context, config2, chain) {
-  if (!isTriggerEnabled("story-ambiguity", config2))
-    return true;
-  const response = await executeTrigger("story-ambiguity", context, config2, chain);
-  return response.action === "approve";
-}
 async function checkReviewGate(context, config2, chain) {
   if (!isTriggerEnabled("review-gate", config2))
     return true;
@@ -54481,20 +54644,6 @@ var init_plan_inputs = __esm(() => {
 });
 
 // src/pipeline/stages/execution-helpers.ts
-function isAmbiguousOutput(output) {
-  if (!output)
-    return false;
-  const ambiguityKeywords = [
-    "unclear",
-    "ambiguous",
-    "need clarification",
-    "please clarify",
-    "which one",
-    "not sure which"
-  ];
-  const lowerOutput = output.toLowerCase();
-  return ambiguityKeywords.some((keyword) => lowerOutput.includes(keyword));
-}
 function routeTddFailure(failureCategory, isLiteMode, ctx, reviewReason) {
   if (failureCategory === "isolation-violation") {
     if (!isLiteMode) {
@@ -54850,13 +54999,6 @@ Category: ${failureCategory ?? "unknown"}`,
     await cleanupSessionOnFailure(ctx);
     return { action: "escalate" };
   }
-  if (agentResult.success && _postRunDeps.isAmbiguousOutput(combinedOutput) && ctx.interaction && isTriggerEnabled("story-ambiguity", ctx.config)) {
-    const shouldContinue = await _postRunDeps.checkStoryAmbiguity({ featureName: ctx.prd.feature, storyId: ctx.story.id, reason: "Agent output suggests ambiguity" }, ctx.config, ctx.interaction);
-    if (!shouldContinue) {
-      logger.warn("execution", "Story ambiguity detected \u2014 escalating story", { storyId: ctx.story.id });
-      return { action: "escalate", reason: "Story ambiguity detected \u2014 needs clarification" };
-    }
-  }
   if (!isTdd) {
     await _postRunDeps.autoCommitIfDirty(ctx.workdir, "execution", "single-session", ctx.story.id);
   }
@@ -54879,8 +55021,6 @@ var init_post_run = __esm(() => {
   _postRunDeps = {
     detectMergeConflict,
     checkMergeConflict,
-    isAmbiguousOutput,
-    checkStoryAmbiguity,
     failAndClose,
     rollbackToRef,
     autoCommitIfDirty
@@ -55721,7 +55861,7 @@ class RegressionStrategy {
 var _regressionStrategyDeps, DeferredRegressionStrategy;
 var init_regression = __esm(() => {
   init_logger2();
-  init_parser2();
+  init_test_runners();
   init_runners();
   _regressionStrategyDeps = { runVerification: fullSuite };
   DeferredRegressionStrategy = class DeferredRegressionStrategy extends RegressionStrategy {
@@ -59020,7 +59160,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.67.0-canary.7",
+    version: "0.67.0",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -59115,8 +59255,8 @@ var init_version = __esm(() => {
   NAX_VERSION = package_default.version;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("d7511052"))
-        return "d7511052";
+      if (/^[0-9a-f]{6,10}$/.test("ffa2f392"))
+        return "ffa2f392";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -60323,10 +60463,9 @@ var _regressionDeps;
 var init_run_regression = __esm(() => {
   init_logger2();
   init_prd();
+  init_test_runners();
   init_git();
   init_verification();
-  init_rectification_loop();
-  init_runners();
   _regressionDeps = {
     runVerification: fullSuite,
     runRectificationLoop,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax",
-  "version": "0.67.0-canary.7",
+  "version": "0.67.0",
   "description": "AI Coding Agent Orchestrator — loops until done",
   "type": "module",
   "bin": {