@ngockhoale/ukit 3.4.39 → 3.4.40

package/CHANGELOG.md

@@ -9,6 +9,13 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.40 - 2026-10-12
+
+**Completion Gate: a read-only request no longer owes `impact-evidence` it can never produce.**
+- Root cause: a `READ_ONLY` contract (analysis of Markdown/logs/prompt text, read-only production inspection) carried `impact-evidence`, satisfied only by a source-read receipt. Answers drawn from docs, logs or text already in the prompt yield none, so Stop demanded further tool activity and looped into the loop breaker.
+- Fix: for `READ_ONLY` with no named target files and no attempted write, `impact-evidence` is not applicable. A named target still needs its read; any attempted write (unauthorized side effect) keeps the obligation; mutation orders keep write/verification/operation proof.
+- Regressions: `tests/hooks/completionGateRequestScope.test.js` (cross-request scope after an edit request, read-only inspection, missing contract, unauthorized write). Test allowlist gains the runtime-only `docs/AI_HANDOFF/RUN.md` cursor reference.
+
 ## 3.4.39 - 2026-10-12
 
 **Completion Gate: unrelated compound commands no longer erase authoritative git evidence; seals honour operation freshness.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.39",
+  "version": "3.4.40",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -3413,6 +3413,16 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   const operationalTask = operationStatus !== null;
   const missingEvidence = evidence.filter((item) => !evidenceSatisfied(item, effectiveLedger, state, { cwd }));
   if (operationalTask && !operationStatus.complete && !missingEvidence.includes('operation-verification')) missingEvidence.push('operation-verification');
+  // A READ_ONLY request's deliverable is the reply: it may be answered from Markdown, logs or
+  // text already in the prompt, none of which yields a source-read receipt, so impact-evidence
+  // is NOT_APPLICABLE to it when no target files were named (request-scoped — never inherited from an earlier edit request in
+  // the same session). Any attempted write keeps the obligation: an unauthorized side effect
+  // of a read-only request is never treated as irrelevant.
+  if (routeSummary.executionContract?.taskKind === 'READ_ONLY' && effectiveLedger.writeAttempted !== true
+    && !(Array.isArray(routeSummary.expectedSourceFiles) && routeSummary.expectedSourceFiles.length > 0)) {
+    const at = missingEvidence.indexOf('impact-evidence');
+    if (at !== -1) missingEvidence.splice(at, 1);
+  }
   const releaseMissing = releasePublicationMissing(state, effectiveLedger, cwd);
   if (releaseMissing) missingEvidence.push(releaseMissing);
   // TASK-009 (BL-011): the bug-fix floor. On a `playbookId: bug-fix` route a