@nurix/etna 0.15.5 → 0.15.7

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "fcd26215a41d",
+    "fingerprint": "ea9d56be1c3e",
     "plugins": {
         "code": "code",
         "kb-agi": "kb-agi",

package/data/harnesses/re/CLAUDE.md

@@ -1,7 +1,7 @@
 # Product Reverse-Engineering — Orchestrator
 
 This is the **policy** half of the `re` harness. The plugin ships the capabilities (11
-dimension-dumper agents + 3 `re-*` rules, one per pipeline phase); this file drives them. Together they reverse-engineer a
+dimension-dumper agents + 4 `re-*` rules, one per mode); this file drives them. Together they reverse-engineer a
 product across every surface it exposes and dump a structured, provenance-tracked corpus into
 `research/<target>/`.
 
@@ -81,8 +81,11 @@ method · confidence · completeness · gaps) + `raw/`, obeying `.claude/rules/r
   is authorized, **dispatch the non-browser dumpers in the background (`run_in_background`) and drive
   the gated browser session in the main session concurrently** — they don't contend (Chrome belongs to
   the main session; the dumpers use WebFetch/curl), so the whole of Ingestion runs in parallel.
-- **Shared seam** — bundle/session/wire each contribute to the canonical `raw/api-path-catalog.md`
-  with a `source:` column; don't triplicate.
+- **Shared seam** — **seed the two shared files `dimensions/_shared/{api-path-catalog.md,
+  feature-flags.md}` (empty, with a header) once, before the dumper fan-out**; bundle/session/wire/
+  distribution then each *append* a `source:`-tagged section to the same physical file (never their own
+  copy). One owner dimension per static asset; a second mine of the same asset is one source, not
+  corroboration (`re-ingestion` §6).
 
 Validate each return (`_summary.md` + provenance present). A `blocked`/`partial` return is recorded,
 not blindly re-run.
@@ -101,19 +104,35 @@ high→fact, low/single-source→tentative, conflict→flagged. The four rollups
 
 ---
 
-## Mode 4 — Self-correction (the harness improves itself, never silently)
-
-Read the finished run (scope verdict, plan, every dimension `_summary.md`, the rollups) and detect
-where the harness under-delivered (method ≠ planned, missing artifacts, low completeness, blocked
-where predicted available). Write **one** file — `research/<target>/04-self-correction-proposal.md`
-— an ordered table of proposed fixes, each routed to its target file (`re-discovery` /
-`re-ingestion` / `re-evaluation` / an agent), with severity, an
-additive/structural flag, and a `research/<target>/…` evidence anchor.
-
-**Approval gate:** present the table and STOP — nothing is applied. The user accepts / rejects /
-defers per item. Then the **main session** (not a sub-agent) applies accepted items, flips each row
-to APPLIED, and logs the change. Promote only what the *next, different* target would also hit;
-prefer additive edits; structural edits are flagged, never auto-applied.
+## Mode 4 — Self-correction (the run corrects itself; the harness improves only on approval)
+
+Mode 4 is a loop, not a one-shot. Follow `.claude/rules/re-self-correction.md` — it carries the
+**defect checklist** (A), the **measurement rubric** (B), and the **iterate-or-propose loop** (C).
+Three stages, driven by the **main session** (not a sub-agent):
+
+1. **Inspect** the finished run (scope verdict, plan, every dimension `_summary.md`, the rollups)
+   against the **built-in defect checklist** → a concrete list of *behavioral defects* in the prior
+   steps (mode · defect · severity · evidence anchor · within-run|harness-changing).
+2. **Measure** the run against the **rubric** → a `/100` score + vibe band. Always — every iteration,
+   including the final one; the self-correcting step ALWAYS evaluates the current run.
+3. **Iterate-or-propose**, splitting each defect by one test — *does the fix require editing a `re-*`
+   rule or an agent?*
+   - **No → within-run:** the main session **auto-iterates** (no approval), re-running the cheapest
+     affected Mode 1–3 steps on THIS target and re-measuring each round. The loop is **capable of ≥5
+     iterations** and **stops on regression** (a clear score drop → revert to the best prior run),
+     **convergence** (no within-run defects left), or the cap. **Read-only / no-cost only** — any fix
+     needing a Pass-2 / credit-spend / state-change / credential action goes through the
+     explicit-confirmation gate, never the auto-loop.
+   - **Yes → harness-changing:** accumulate into `research/<target>/04-self-correction-proposal.md`
+     (the shape is in `re-self-correction.md`: run measurement · iteration ledger · defect list ·
+     within-run fixes applied · the approval-gated harness-change table).
+
+**Approval gate (unchanged):** present the harness-change table + the iteration ledger and STOP —
+nothing in the harness is applied. The user accepts / rejects / defers per item. Then the **main
+session** (not a sub-agent) applies accepted items, flips each row to APPLIED, and logs the change.
+Promote only what the *next, different* target would also hit; prefer additive edits; structural edits
+are flagged, never auto-applied. (For a batch, additionally roll up into a cross-target synthesis that
+promotes only patterns ≥2 *independent* targets hit — a homogeneous batch's 6/6 is one vote, not six.)
 
 ---
 

package/data/harnesses/re/agents/deployed-client-bundle.md

@@ -27,6 +27,12 @@ the endpoints it will call, and the flags it gates behind.
    pull every `<script src>` and `<link rel=modulepreload>`. Vite/Next ship hashed
    `/assets/*.js` and `/_next/static/chunks/*.js`. Grab the entry chunk + the largest vendor
    chunk; `curl -s <chunk-url> -o raw/.work/<name>.js`. Note `Content-Length` per chunk.
+   **Bound this — do NOT exhaustively fetch every lazy chunk.** The route table and the GraphQL/op
+   registry live in the entry + `_app` + a registry chunk; grab those plus the largest few vendor
+   chunks (cap ~40 chunks / ~5 MB / 90 s), and record the rest as a `gap`. Fetching all lazy chunks
+   (often 90+, multi-MB) can run 3–4× a sibling dumper and read as hung. **Per §8, write a
+   `status: partial` `_summary.md` from the entry/manifest chunks BEFORE the wider fetch loop**, then
+   enrich and flip to `complete`.
 2. **Check for source maps FIRST.** Grep each chunk for `//# sourceMappingURL=`. If present,
    fetch the `.map` and reassemble original sources (`npx source-map-explorer` or unpack
    `sourcesContent` from the JSON map). A live map flips you to `method: source-map-reassembly,
@@ -35,13 +41,16 @@ the endpoints it will call, and the flags it gates behind.
    manifests (`__BUILD_MANIFEST`, `/_next/static/.../_buildManifest.js`), lazy-import chunk maps.
    `grep -oE '"/[a-z][a-z0-9/:_-]*"'` over the de-minified source, then de-dup → `raw/route-table.md`.
 4. **API-path catalog (SHARED seam — §6).** Mine fetch/axios base URLs and path literals
-   (`/api/`, `/graphql`, `${API_BASE}` template fragments). Write rows to the **shared**
-   `raw/api-path-catalog.md` with a `source: bundle` column — do NOT invent a private name; the
-   `session` and `wire-capture` dumps append to the same file so evaluation can run its three-way
-   diff. A path here that `session`/`wire` never hit is a dormant/unshipped route (a finding).
+   (`/api/`, `/graphql`, `${API_BASE}` template fragments). **Append** rows to the **one physical
+   shared file** `research/<target>/dimensions/_shared/api-path-catalog.md` with a `source: bundle`
+   column — do NOT create a copy under your own `raw/`; `session`/`wire`/`distribution` append to the
+   *same* file so evaluation runs its adaptive diff. A path here that `session`/`wire` never hit is a
+   dormant/unshipped route (a finding). **You OWN the app-API bundle mine** (re-ingestion §6): when
+   `source:none` and no machine spec is served, other dimensions cite your catalog by path and do not
+   re-mine the same bundle (a second mine is one source, never corroboration).
 5. **Feature flags (SHARED).** Find flag SDK keys and flag literals (LaunchDarkly `client-side-id`,
    Statsig/Flagsmith/PostHog keys, `flags[` / `isEnabled('...')` / `experiment` string literals).
-   Write to the **shared** `raw/feature-flags.md` with `source: bundle`.
+   **Append** to the shared `research/<target>/dimensions/_shared/feature-flags.md` with `source: bundle`.
 6. **Embedded env config.** Grep `VITE_`, `NEXT_PUBLIC_`, `REACT_APP_`, `import.meta.env`,
    `window.__ENV__`. **Field-names only — REDACT every value** to `<REDACTED:env-value>` per §7
    (publishable keys, analytics IDs, base URLs are field-name-worthy; treat any value as a secret
@@ -73,17 +82,20 @@ gaps: [<unmined chunks, absent source maps, obfuscated route tables, ...>]
 
 Then Method / Findings (framework, build tool, route count, endpoint count — tables) / Inferences
 (public-vs-gated routes, the backend the SPA expects, which third-party SDKs are wired) / Open
-questions / Artifacts. Plus the `raw/` files named in `re-discovery` Part C (deployed-client-bundle):
-`raw/{route-table.md, api-path-catalog.md, feature-flags.md, env-config.md, bundle-map.md}` —
-each prose artifact carrying the `<!-- source: ... · captured_at: ... · method: ... -->` line.
+questions / Artifacts. Dimension-private `raw/` files: `raw/{route-table.md, env-config.md,
+bundle-map.md}` — each prose artifact carrying the `<!-- source: ... · captured_at: ... · method: ... -->`
+line; the API-path catalog and feature flags are **appended to the shared
+`dimensions/_shared/{api-path-catalog.md, feature-flags.md}`**, which your `_summary.md` Artifacts list
+*links* (not duplicates).
 
 ## Return value
 
 Return a one-paragraph headline of what the deployed shell reveals — framework + build tool, route
 count, the shape of the API surface it calls, whether source maps were shipped (and the confidence
-that implies). **Cross-checks:** flag that `raw/api-path-catalog.md` and `raw/feature-flags.md` are
-the SHARED seam artifacts (§6) — `session` and `wire-capture` write to the same files with
-`source: session | wire`, and evaluation owns the static-vs-observed three-way diff. Surface any
+that implies). **Cross-checks:** flag that `dimensions/_shared/api-path-catalog.md` and
+`dimensions/_shared/feature-flags.md` are the SHARED seam artifacts (§6, one physical file each) —
+`session`/`wire`/`distribution` append to the same files with `source: session | wire | distribution`,
+and evaluation owns the adaptive static-vs-observed diff. Surface any
 endpoint or flag that looks authed/internal but is statically declared in the unauth bundle — that
 gap is the dimension's highest-value output.
 

package/data/harnesses/re/agents/distribution-artifacts.md

@@ -46,9 +46,10 @@ Then dispatch by artifact type (do all that apply):
 - **CLI.** Install / fetch and harvest help text: `<cli> --help`, `<cli> help`, and per-subcommand
   `<cli> <sub> --help`. The subcommand tree **is** an API catalog. → `raw/cli-catalog.md`.
 
-For each, **also** harvest the API surface and feature flags into the **shared seam artifacts**
-(contract §6): `raw/api-path-catalog.md` with a `source: distribution` column, and `raw/feature-flags.md`
-if flags ship. Digest large bundles (counts + shape + one redacted sample), never paste (§5).
+For each, **also** harvest the API surface and feature flags by **appending** to the **shared seam
+artifacts** (contract §6, one physical file each): `dimensions/_shared/api-path-catalog.md` with a
+`source: distribution` column, and `dimensions/_shared/feature-flags.md` if flags ship — never a private
+copy. Digest large bundles (counts + shape + one redacted sample), never paste (§5).
 
 ## Output
 
@@ -78,16 +79,16 @@ inference vs. fact), **Open questions** (EULA-restricted decompilation, missing
 
 Then write the per-type raw files that apply — `raw/{extension-manifest.md, electron-asar-map.md,
 mobile-strings.md, cli-catalog.md}` (each with the `<!-- source · captured_at · method -->`
-metadata line) — plus `raw/api-path-catalog.md` (`source: distribution`) and, if flags ship,
-`raw/feature-flags.md`.
+metadata line) — plus **appends** to the shared `dimensions/_shared/api-path-catalog.md`
+(`source: distribution`) and, if flags ship, `dimensions/_shared/feature-flags.md`.
 
 ## Return value
 
 Return a **one-paragraph headline** of what the shipped client reveals — its declared hosts,
 permission surface, embedded vendor SDKs, and how much richer (or not) it is than the web app.
-The API paths and feature flags you wrote feed the **seam rule (§6)**: flag `raw/api-path-catalog.md`
-with `source: distribution` so evaluation can three-way-diff it against `deployed-client-bundle`
-(`source: bundle`), `session`, and `wire-capture`. The hosts and SDK list cross-check
+The API paths and feature flags you appended feed the **seam rule (§6)**: your
+`dimensions/_shared/api-path-catalog.md` rows carry `source: distribution` so evaluation can run its
+adaptive diff against `deployed-client-bundle` (`source: bundle`), `session`, and `wire-capture`. The hosts and SDK list cross-check
 **infra-backend-fingerprint** (a host the binary calls that DNS/CT didn't surface is a finding);
 the runtime hosts also seed **wire-capture** targets (the binary says what it *might* call; the
 capture says what it *does*).

package/data/harnesses/re/agents/infra-backend-fingerprint.md

@@ -86,7 +86,7 @@ per §5):
 Return a **one-paragraph headline** of the reconstructed backend — origin cloud, edge CDN, email +
 AI + payments providers, and the most interesting CT-leaked host (`staging.`/`internal.`/`admin.`).
 Cross-check against siblings: the CSP `connect-src` and CT-found `api.<target>` host should match the
-**`raw/api-path-catalog.md`** seam (§6) produced by `deployed-client-bundle`/`session`/`wire-capture`
+**`dimensions/_shared/api-path-catalog.md`** seam (§6) produced by `deployed-client-bundle`/`session`/`wire-capture`
 — flag a host in your fingerprint that none of them ever hit as a dormant/internal surface, and flag
 a vendor named in `sub-processors.md` (e.g. an AI provider) that no other dimension surfaced. Note
 any CT-leaked host worth a `wire-capture` or `deployed-client-bundle` follow-up.

package/data/harnesses/re/agents/session.md

@@ -41,10 +41,20 @@ Under `research/<target>/dimensions/session/`:
 - `captures/p0-surface.md`, `p1-auth.md`, and per-phase narratives (P2 core action, P3
   streaming, P4 runtime/state, P5 iteration) — decoded, opinionated, per `re-ingestion` §9.5.
 - `raw/*.json` — verbatim endpoint captures with `_meta` + `_decoded_fields`, **all secrets
-  redacted** (`re-ingestion` §9.5). Digest bodies >50KB.
+  redacted** (`re-ingestion` §9.5). Digest bodies >50KB. App API paths + flags you observe **append
+  to the shared `dimensions/_shared/{api-path-catalog.md, feature-flags.md}` with `source: session`**
+  (re-ingestion §6) — and the folded rung-1 wire tap appends there as `source: wire`.
 - `curls.md` — reproducible commands per endpoint, auth model documented (`re-ingestion` §9.5).
+- **Visual / surface map** — `captures/screens/` is preferred *when screenshots are available*; when
+  they are **not** (no image tool, or the app holds a persistent connection that never reaches
+  page-idle), a textual `captures/surface-map.md` is the **accepted substitute** that satisfies the
+  §9.5 visual-map requirement — and you record the visual-coverage gap in the `_summary.md` `gaps:`
+  frontmatter (a known constraint, not a silent miss).
 - `_summary.md` — a short bridge file in the standard dump shape pointing into the above, so
-  the synthesis step can treat session like any other dimension.
+  the synthesis step can treat session like any other dimension. Its frontmatter additionally carries
+  **`write_side_observed: <true|false>`** and **`pass2: <not-applicable | offered-pending |
+  declined-by-user | deferred | done>`** (§9.2) so Evaluation renders the write-side gap once,
+  machine-readably; a deferred Pass 2 may add an optional `captures/pass2-followup.md`.
 
 ## Return value
 A one-paragraph headline (the auth model + transport + the single most load-bearing wire

package/data/harnesses/re/agents/wire-capture.md

@@ -72,9 +72,11 @@ Then the captures + raw artifacts (per `re-discovery` Part C (wire-capture)):
 - `raw/flows.json` — verbatim-but-**redacted and digested** flows, each with the `_meta` header
   (incl. `kind`, `byte_length`, `redactions[]`, and the **chosen rung + authorization**), `body`,
   `_decoded`. Digest large captures (schema + one redacted sample + counts), never paste megabytes.
-- `raw/api-path-catalog.md` — the **shared-surface artifact** (§6): every row carries
-  `source: wire`. Use this exact filename so evaluation can three-way diff it against `bundle` and
-  `session` rows.
+- `dimensions/_shared/api-path-catalog.md` — the **shared-surface artifact** (§6, one physical file):
+  **append** rows carrying `source: wire` to it (never a private copy), so evaluation can run its
+  adaptive diff against `bundle`/`session`/`distribution` rows. When `wire-capture` is folded into
+  `session` (the common path — §7.1), `session` owns this append; a standalone `wire-capture` appends
+  directly.
 - `curls.md` — reproducer `curl` skeletons with all credentials replaced by placeholders.
 
 ## Return value

package/data/harnesses/re/harness.json

@@ -1,6 +1,6 @@
 {
   "name": "re",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "epoch": null,
-  "digest": "790ded87e841"
+  "digest": "8d5fbcaab511"
 }

package/data/harnesses/re/rules/re-discovery.md

@@ -146,6 +146,7 @@ The three named **cases** are presets over this vector — a target can light se
 (Liveblocks = source:full + runtime:reachable + auth:obtainable + presence:rich → nearly all
 dimensions). Rules:
 - **`auth:obtainable` is a hint, not actionable** — the harness never self-signs-up; it only counts as `have-login` if the *user* hands over a session.
+- **A *claimed* login is `auth:claimed` (confidence medium), not `auth:have-login` (high), until a cheap live probe confirms it.** A user saying "I'm logged in" — or a session being merely *expected* — is not proof: profiles expire, a fresh tab may not restore an in-memory token, and a deep-link can bounce to a login wall while the root looks authed. Grade `auth:claimed` until Discovery (or the `session` agent's first step) navigates the app and confirms an **authenticated surface** (a dashboard, a populated `viewer`/`/me`, a token in the store) — only then promote to `have-login`. Grading a claimed login `high` lets a session collapse to `blocked` after dispatch, with the wasted dispatch hidden behind a confident grade.
 - **Dimension-level access overrides the target headline** for method selection (a Case-1 target can still have a Case-3 session dimension).
 - Method swaps on axis *value*: `source:full` ⇒ `clone-and-map`; `source:partial` ⇒ `source-map-reassembly`; `runtime:reachable + source:none` ⇒ `bundle-string-mine` + wire-capture.
 
@@ -172,6 +173,11 @@ Discovery records the resolved vector in the `access_grade` frontmatter of `00-r
 > **Deferred (available on request, not built):** `external-reputation` (G2/Reddit/HN — the only
 > "what others say" surface) and `hiring-intel` (job posts leak the backend stack). Strong
 > candidates, declined for this iteration. Re-add via self-correction if a run needs them.
+> **Conditional trigger:** when `community` returns **no first-party feedback loop** (no public
+> issues/roadmap/changelog/forum — feedback funnelled to a gated channel), flag `external-reputation`
+> as **recommended-for-this-run** in `00-recon-plan.md`, so the user-sentiment blind spot is a surfaced
+> choice rather than a silent gap (the `community` user-pain claims are then capped at tentative —
+> re-evaluation closed-feedback cap).
 
 An **absent** dimension is a finding — record it with its evidence; never silently drop it.
 
@@ -183,6 +189,12 @@ See git history / the source playbook for the full strategy text; in brief:
 - **docs** — prefer in-repo docs, then `llms.txt`/`llms-full.txt`, then crawl; organize by section.
 - **packages** — per public package: registry metadata, `exports` map + `.d.ts` type surface, health.
 - **api** — fetch the spec verbatim, build an endpoint catalog (auth, envelope, pagination, webhooks).
+  **Grade the method from a RETRIEVED artifact, never a label.** Before grading `openapi-verbatim`,
+  actually fetch the candidate spec URL and confirm a **parseable JSON/YAML body** — a docs page merely
+  *titled* "OpenAPI" with no served `spec.json` (or a `/swagger` that 403s) is `docs-reconstructed`
+  (capped medium), and Discovery must pre-grade it that way so the plan matches reality. **A
+  sibling-declared host/op/route count is a coverage checklist (a floor), never a ceiling** — every
+  dumper expands from sibling-mined hosts/routes and records the predicted-vs-found delta.
   **NEW fold-in:** also probe MCP/tool surfaces — `/.well-known/mcp`, an MCP server manifest, a
   function-calling tool schema, an LLM "actions" file — and write `raw/tool-catalog.md` (an MCP tool
   list *is* an API catalog; it lives here, not in its own dimension).
@@ -190,7 +202,10 @@ See git history / the source playbook for the full strategy text; in brief:
   matrix, target market.
 - **community** — *first-party only*: changelog cadence + direction, issue/discussion themes, blog.
 - **session** — the deepest, opt-in, user-gated dimension; delegates to the session playbook in
-  `re-ingestion` §9 (3-pass, P0–P6, captures/raw/curls).
+  `re-ingestion` §9 (3-pass, P0–P6, captures/raw/curls). For any `auth:have-login`/`auth:claimed`
+  target, Discovery **seeds the Pass-2 decision** (`pass2: offered-pending | declined-by-user |
+  deferred`) into `00-recon-plan.md`, so a Pass-1-only (read-only) session is a *recorded choice*, not a
+  silent omission of the write surface (re-ingestion §9.2).
 
 ## 8 — deployed-client-bundle — `deployed-client-bundle`
 
@@ -198,15 +213,22 @@ See git history / the source playbook for the full strategy text; in brief:
 (marketing) and `session` (authenticated). Works on closed SaaS with no repo and no login.
 
 **Detection:** an app subdomain (`app.<target>.*`) or SPA route serves a JS bundle;
-`sourceMappingURL` present; a `/assets/*.js` graph.
+`sourceMappingURL` present; a `/assets/*.js` graph. **Two cheap Discovery probes pre-grade the method
+and surface a leak early:** (a) does an entry chunk's `sourceMappingURL` resolve to a `.map`-200? →
+pre-grade `source-map-reassembly` (confidence high — original `src/` recovers). (b) probe a few
+bootstrap-config paths (`/config`, `/backend/config/*`, `/env.json`, a runtime-config endpoint) — a
+200 here is both a method pre-grade and a possible unauth config/secret leak (a finding).
 
 **Strategy:** fetch the main bundle(s); string-mine the **route table**, the **API-path catalog**
-(→ shared `raw/api-path-catalog.md`, `source: bundle`), **feature flags** (→ shared
-`raw/feature-flags.md`), embedded **env config** (`VITE_*`, `NEXT_PUBLIC_*`, public keys —
-field-names only, redact values), and reassemble **source maps** if shipped (`method:
-source-map-reassembly`, confidence high). Digest huge bundles, don't paste.
+(→ append to the shared `dimensions/_shared/api-path-catalog.md`, `source: bundle` — re-ingestion §6),
+**feature flags** (→ shared `dimensions/_shared/feature-flags.md`), embedded **env config** (`VITE_*`,
+`NEXT_PUBLIC_*`, public keys — field-names only, redact values), and reassemble **source maps** if
+shipped (`method: source-map-reassembly`, confidence high). Digest huge bundles, don't paste. This
+dimension **owns** the app-API bundle mine — other dimensions cite its catalog by path, never re-mine
+the same bundle (re-ingestion §6).
 
-**Artifacts:** `_summary.md` + `raw/{route-table.md, api-path-catalog.md, feature-flags.md, env-config.md, bundle-map.md}`.
+**Artifacts:** `_summary.md` + `raw/{route-table.md, env-config.md, bundle-map.md}` + appends to the
+shared `dimensions/_shared/{api-path-catalog.md, feature-flags.md}`.
 
 ## 9 — infra-backend-fingerprint — `infra-backend-fingerprint`
 
@@ -236,7 +258,17 @@ structured XHRs worth a tap, AND the appropriate ethics rung is authorized.
 2. HAR export → `wire-har`;
 3. mitmproxy (**gated, opt-in, user-run, first-party traffic only**) → `wire-mitmproxy`.
 
-**Artifacts:** `_summary.md` + `captures/wire-narrative.md` + `raw/{flows.json (redacted/digested), api-path-catalog.md (source: wire)}` + `curls.md`. Record the chosen rung + authorization in `_meta`.
+**Fold note (common path):** when there is no separate non-browser client, wire-capture **folds into
+`session`** (which owns the browser singleton), **never into a curl/WebFetch dumper** (a non-browser
+dumper cannot run rung-1's in-page tap, and routing it there yields zero `source: wire` rows —
+re-ingestion §7.1). The folded rung-1 *is* the interceptor `session` installs; its observed paths
+append to the shared `dimensions/_shared/api-path-catalog.md` as `source: wire`. A folded wire-capture
+still leaves a one-paragraph `_summary.md` (`status: folded`, naming the fold target) — never a silent
+drop.
+
+**Artifacts:** `_summary.md` + `captures/wire-narrative.md` + `raw/flows.json (redacted/digested)` +
+appends to shared `dimensions/_shared/api-path-catalog.md (source: wire)` + `curls.md`. Record the
+chosen rung + authorization in `_meta`.
 
 ## 11 — distribution-artifacts — `distribution-artifacts`
 
@@ -253,7 +285,7 @@ route/API/flag catalog from the desktop client (often richer than web). **mobile
 keys**). **CLI** — help text/subcommands = an API catalog. Read the artifact's EULA first (see
 `re-ingestion` §7.2); never silently decompile a restrictively-licensed binary.
 
-**Artifacts:** `_summary.md` + `raw/{extension-manifest.md, electron-asar-map.md, mobile-strings.md, cli-catalog.md}` (whichever apply) + `raw/api-path-catalog.md` (source: distribution).
+**Artifacts:** `_summary.md` + `raw/{extension-manifest.md, electron-asar-map.md, mobile-strings.md, cli-catalog.md}` (whichever apply) + appends to shared `dimensions/_shared/api-path-catalog.md` (source: distribution).
 
 ---
 

package/data/harnesses/re/rules/re-evaluation.md

@@ -23,6 +23,23 @@ coherent picture, **weighted by how each claim was obtained**, with disagreement
 `distribution-artifacts` are mutually independent and independent of marketing. **`website` and
 `docs` are NOT independent** for *feature claims* (docs often restate marketing) — two of them
 agreeing is still one source. A bundle-declared route + a session-observed route ARE independent.
+**Same artifact ⇒ one source.** Two dimensions that string-mine the *same* static asset (one bundle /
+one spec / one binary) are **one source** — never a band-bump — even when they report different
+counts; the divergent counts are a **reported range, not a flagged conflict** (`deployed-client-bundle`
+278 vs `website` 361 over one bundle is one finding with a range, not corroboration and not a conflict).
+
+**Closed-feedback confidence cap.** When the `community` dimension finds **no first-party feedback
+loop** (no public issues / roadmap / changelog / forum — feedback funnelled to a gated channel), its
+user-pain / most-requested-feature claims are **inference-from-changelog only → capped at
+`low`/tentative**, never promoted on changelog frequency alone. The surface that *would* corroborate
+user sentiment is `external-reputation` (a deferred dimension) — flag it as recommended-for-this-run
+when this cap fires (see re-discovery Part C deferred-dimension trigger).
+
+**Write-side-unobserved cap.** A `session` dimension carrying `write_side_observed: false` (a
+Pass-1-only run) has observed feature *existence/gating* but **not** feature *execution behavior*. Any
+marketed generate/submit/launch *behavior* claim therefore stays **tentative and is never promoted to
+fact** from marketing/docs alone — render the write-side gap **once** from the frontmatter flag, not
+re-hedged per rollup.
 
 **Presentation mapping:** high → stated as fact; low/single-source → hedged as tentative;
 conflicted → flagged. (This is the "lighter" form of the provenance-weighting — done inline in the
@@ -58,11 +75,19 @@ prose, not via a separate `claims.yaml`.)
 # <Target> — Data Model & API / SDK Surface
 ## Core entities          (domain objects + relations; ER-style — when the runtime exposes an RBAC verb
                            taxonomy, derive the entity set from it: `X_CREATE/VIEW/EDIT/DELETE` ⇒ entity X)
-## Integration surface    (SDK/packages public API · REST/HTTP catalog · realtime/wire protocol — flag
-                           where the app's OWN API differs from the published/developer API; that split is common)
+## Integration surface    (SDK/packages public API · REST/HTTP catalog · realtime/wire protocol)
+## Published-vs-app-own API diff  (emit WHENEVER the target publishes a developer/partner/MCP API —
+                            common for mature SaaS, but not universal. The app the SPA runs on is frequently
+                            a different, broader, differently-authed API than the published one: list ops the
+                            app uses that the public API omits, AND public ops the app never calls — both are
+                            findings. If there is NO published API, say so explicitly: "no published API — the
+                            app surface is the only surface" is itself the finding, not an empty section.)
 ## Auth & tenancy model   (token type, where it lives, scope expression)
-## Three-way API-path diff (the seam rule: bundle-declared vs session-observed vs wire-observed —
-                            dormant/unshipped routes are findings)
+## API-path diff (adaptive, N-way over the runtime sources present)  (the seam rule: bundle-declared vs
+                            session-observed vs wire-observed. Title it for the sources ACTUALLY run —
+                            enumerate only those lanes; an absent lane [session blocked / wire folded] is a
+                            recorded gap, NOT a structural hole to apologize for. Dormant/unshipped routes
+                            are findings.)
 ## Cross-dimension reconciliation  (published surface [api/packages/docs] vs observed wire [session/
                             wire-capture]; document drift — published=fact, observed-drift=tentative)
 ## Open questions

package/data/harnesses/re/rules/re-ingestion.md

@@ -19,15 +19,28 @@ This contract generalizes the source playbook's three-format contract (`captures
 ## 1. Folder layout
 
 ```
-research/<target>/dimensions/<dimension>/
-├── _summary.md        ← decoded narrative + provenance frontmatter (human + machine read this)
-└── raw/               ← verbatim artifacts (the reproducer reads these)
+research/<target>/dimensions/
+├── _shared/           ← cross-dimension seam artifacts, ONE physical copy (see §6)
+│   ├── api-path-catalog.md
+│   └── feature-flags.md
+└── <dimension>/
+    ├── _summary.md    ← decoded narrative + provenance frontmatter (human + machine read this)
+    └── raw/           ← verbatim artifacts, DIMENSION-PRIVATE (the reproducer reads these)
 ```
 
 Richer dimensions inherit the playbook contract (extra files, same `_summary.md` provenance):
 - **session**: `dimensions/session/{_summary.md, captures/p*.md, raw/*.json, curls.md}`
 - **wire-capture**: `dimensions/wire-capture/{_summary.md, captures/wire-narrative.md, raw/flows.json, curls.md}`
 
+Two layout rules the seam and the "absence is a finding" principle depend on:
+- **Shared-seam files live in `dimensions/_shared/`, one physical copy each — never under a single
+  dimension's `raw/`** (§6). Everything else under a dimension's `raw/` is **dimension-private by
+  default**; only the §6 allowlist (`api-path-catalog.md`, `feature-flags.md`) is shared.
+- **A folded or absent dimension still leaves a record.** When a dimension is folded into another or
+  is absent, write a one-paragraph `_summary.md` with `status: folded` (naming the fold target) or
+  `status: absent` (+ the cheap evidence). "An absent dimension is a finding" must be **materialized
+  as a file**, never a silent drop.
+
 ---
 
 ## 2. `_summary.md` — required shape (with provenance frontmatter)
@@ -115,19 +128,34 @@ readable, not a memory dump. Set `digested: true` context in the artifact's `_me
 
 `deployed-client-bundle` (static unauth SPA), `session` (authenticated browser runtime), and
 `wire-capture` (non-browser client) can all surface the same **API path catalog** and **feature
-flags**. To keep them consumable instead of triplicated:
-
-- Use **one canonical artifact name** across all three: `raw/api-path-catalog.md` and
-  `raw/feature-flags.md`, each row carrying a `source: bundle | session | wire` column.
-- Evaluation owns the **three-way diff** (static-declared vs browser-observed vs nonbrowser-observed)
-  in `data-model-api-surface.md`. A path that appears in `bundle` but never in `session`/`wire` is a
-  dormant/unshipped route — a finding, not noise.
+flags**. To keep them consumable instead of triplicated **N times** (a real run forked
+`api-path-catalog.md` up to 7×, and "two copies agree" then mis-reads as corroboration):
+
+- **One physical file, one canonical location, append-only.** The seam files live at
+  `dimensions/_shared/api-path-catalog.md` and `dimensions/_shared/feature-flags.md` — **Ingestion
+  seeds the two empty files (with a header) once, before the dumper fan-out.** Every contributing
+  dimension **appends a `source:`-tagged section** (`source: bundle | session | wire | distribution`)
+  and **never creates its own copy**; each dumper's `_summary.md` Artifacts list **links** the shared
+  file rather than duplicating it. **Shared-seam allowlist:** these two filenames are the *only*
+  shared/single-physical artifacts — every other `raw/*` is dimension-private.
+- Evaluation owns the **API-path diff** (an *adaptive N-way* diff over whichever runtime sources were
+  actually run — see re-evaluation template 3) in `data-model-api-surface.md`. A path that appears in
+  `bundle` but never in `session`/`wire` is a dormant/unshipped route — a finding, not noise.
+
+> **Same artifact ⇒ ONE source (never independent corroboration).** Two dimensions that string-mine
+> the *same* static asset (one bundle / one spec / one binary) are **one source** for the promotion
+> rule — never a confidence band-bump — and their divergent counts are a **reported range, not a
+> flagged conflict.** Name **one owner dimension per asset**: when `source:none` and no machine spec
+> is served, `deployed-client-bundle` **owns** the app-API bundle mine, and `api` is re-scoped to the
+> *published/partner* spec only (or marked `partial` if none is served) — the others **cite the owner
+> by path and do not re-mine**.
 
 > **Published API ≠ the app's own API.** A product's developer/REST/MCP surface (`api`/`docs`/`packages`
 > dims) is frequently *not* the API its own app runs on (`session`/`bundle` dims) — different protocol,
 > host, and operation set. Always diff the two: operations the app uses but the public API omits, **and**
 > public operations the app never calls, are both findings. The published surface is the integration
-> story; the runtime surface is the real architecture.
+> story; the runtime surface is the real architecture. When a published API exists, Evaluation emits
+> this split as a *named* output, not inline prose (re-evaluation template 3).
 
 ---
 
@@ -163,6 +191,14 @@ chosen rung in `_meta`:
    *user* installs the CA and routes their client — the agent only ingests exported flows. →
    `method: wire-mitmproxy`. Same explicit-authorization loop as session Pass-2.
 
+> **Never fold a browser-rung into a non-browser (curl/WebFetch) dumper.** Rung 1 *is* a browser tap,
+> and the browser is a singleton owned by `session`/`wire-capture` — routing it to a curl dumper
+> produces zero `source: wire` rows (a real run did exactly this). When `wire-capture` is **folded**,
+> the rung-1 tap is the **in-page interceptor that `session` already installs**: `session` appends its
+> observed paths to `dimensions/_shared/api-path-catalog.md` as `source: wire`. A folded `wire-capture`
+> still leaves a one-paragraph `_summary.md` (`status: folded`, naming the fold target) per §1 —
+> "folded" is recorded, never silently dropped.
+
 > Wireshark / packet capture is explicitly **not** used: for HTTPS it yields only TLS ciphertext,
 > and a packet sweep of a third party is the bright line this harness will not cross.
 
@@ -179,6 +215,15 @@ A dump is complete when: `_summary.md` exists with full provenance frontmatter +
 every Finding is backed by a `raw/` artifact or inline value; `raw/` artifacts have `_meta` +
 decoding (large ones digested); redaction pass run; `gaps` recorded (never fabricated).
 
+**Summary-first + bounded, visible fan-out (never go silent long enough to look dead).** Write a
+`status: partial` `_summary.md` with whatever is mined so far **before** any long-tail fetch loop
+(downloading many chunks, crawling many pages, deep pagination), then enrich it in place and flip to
+`complete`. **Bound** every fan-out — cap it by count / total bytes / wall-time (e.g. ≤40 items or
+≤90 s) and record the remainder as a `gap` rather than fetching exhaustively; emit a progress note per
+batch. A dumper that fetches everything before writing anything can run many times longer than its
+siblings and read as hung to the orchestrator, forcing a needless salvage. Partial-but-finalized beats
+complete-but-silent.
+
 ---
 
 ## 9. The session dimension — logged-in browser-session playbook
@@ -225,6 +270,17 @@ completion event, server-side resolution of shorthand, ID/slug-generation, the r
 endpoint, and the full realtime event catalog. **Legitimate to skip** if the user opts out — leave
 write-side shapes as open questions; never fabricate them.
 
+> **Record the write-side decision as a machine flag, not re-derived prose.** A Pass-1-only run leaves
+> the *entire* write/generate/launch surface unobserved — feature *existence/gating* is solid, but
+> feature *execution behavior* rests on marketing/docs and must never be promoted to fact (this caveat
+> otherwise gets re-hedged across 3–4 rollups every cost-gated run). So the session `_summary.md`
+> frontmatter carries `write_side_observed: <true|false>` and `pass2: <not-applicable | offered-pending
+> | declined-by-user | deferred | done>` (this flag is the load-bearing part — it lets Evaluation render
+> the write-side gap *once*). When it would help a later run resume, optionally add
+> `captures/pass2-followup.md` listing the **exact cheapest-mode write actions + est. cost** that would
+> close the gap. Discovery seeds the `pass2:` decision in `00-recon-plan.md` for any `auth:have-login`
+> target.
+
 **Pass 3 — synthesis.** Walk the captures, pull each finding into the dimension's `_summary.md`,
 note the cleverest design choices, defaults imposed, performance characteristics, and open
 questions.
@@ -302,13 +358,21 @@ Under `research/<target>/dimensions/session/`:
   redacted) + `_decoded_fields`. Digest bodies > 50 KB into a structured summary.
 - **`curls.md`** — reproducible curl per endpoint, the auth model documented, a variables block,
   and an endpoint-catalog table.
-- **`captures/screens/`** (recommended) — one annotated screenshot per primary surface (each major nav
-  section), plus a short tour recording if useful. The fastest "what does it actually do" artifact for a
-  human reader, complementing the wire teardown — and the place the visual product map lives. Redact any
-  visible PII before saving.
+- **Visual / surface map** — `captures/screens/` (**preferred when available**): one annotated
+  screenshot per primary surface (each major nav section), redact visible PII before saving. **When
+  screenshot capture is unavailable** (e.g. the runtime lacks an image tool, or the app holds a
+  persistent connection that never reaches page-idle), a **textual `captures/surface-map.md` is the
+  accepted substitute** and satisfies this visual-map requirement — and the **visual-coverage gap is
+  recorded in the `gaps:` frontmatter** so Evaluation reads a *known constraint*, not a silent miss.
+- **`captures/pass2-followup.md`** (optional, when Pass 2 is deferred/declined and it would help a
+  later run resume) — the exact cheapest-mode write/generate actions + estimated cost that would close
+  the write-side gap (§9.2). The `write_side_observed`/`pass2` frontmatter flags are mandatory; this
+  file is the convenience.
 - **`_summary.md`** — the standard dimension bridge file (provenance frontmatter per §2) pointing
   into the above, so Evaluation treats session like any other dimension. `method: session-playbook`,
-  `confidence: low` for Pass-1-only/inferred.
+  `confidence: low` for Pass-1-only/inferred. **Session frontmatter additionally carries
+  `write_side_observed: <true|false>` and `pass2: <not-applicable | offered-pending | declined-by-user
+  | deferred | done>`** (§9.2) so Evaluation renders the write-side gap once, machine-readably.
 
 ### 9.6 Session ethics (binds hardest here — see §7 above)
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.15.5",
+    "version": "0.15.7",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {