@nurix/etna 0.19.34 → 0.19.35

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "e3c1231e3373",
+    "fingerprint": "22a721cdaeb5",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/CLAUDE.md

@@ -21,7 +21,7 @@ Invoke the `maintenance` agent whenever the docs look like they need it — not
 
 ## Workflows
 
-Three peer modes plus a Completion step — enter wherever the user's thinking already is. Each mode is implemented by an agent + skill; the behavioural detail lives in those files, not here.
+Three peer modes plus Verification and Completion — enter wherever the user's thinking already is. Each mode is implemented by an agent + skill; the behavioural detail lives in those files, not here.
 
 | Mode | Enter when | Implemented by | Exits to |
 | --- | --- | --- | --- |
@@ -33,18 +33,19 @@ Three peer modes plus a Completion step — enter wherever the user's thinking a
 
 **On Plan Completion:**
 
-1. Freeze the plan — `Status: Complete`, fill the Completed date. The file is now frozen.
-2. Flip the feature LLD to `status: active`; extend it in place with the how-it-works sections; confirm its `owns:` globs against the actual code.
-3. The `boundary` and `test-plan` skills must already have gated this plan before its first implementation step — see Ownership, Boundaries & Documentation.
-4. Derive/update the behavioral checklist at `docs/tests/{feature}.md` via the `documentation` skill (a truth document — present-tense, referencing the LLD's promises, restating no intent), then run the affected test suite + the project's e2e smoke gate and record the results in the changelog entry.
+1. **The verification gate passes first** — discharge every row of the plan's Test Obligations, driving the real surface before pinning tests (see Verification). A plan with outstanding obligations does not reach `Status: Complete`, whatever the code does.
+2. Freeze the plan — `Status: Complete`, fill the Completed date. The file is now frozen.
+3. Flip the feature LLD to `status: active`; extend it in place with the how-it-works sections; confirm its `owns:` globs against the actual code.
+4. The `boundary` and `test-plan` skills must already have gated this plan before its first implementation step — see Ownership, Boundaries, Verification & Documentation.
+5. Derive/update the behavioral checklist at `docs/tests/{feature}.md` via the `documentation` skill (a truth document — present-tense, referencing the LLD's promises, restating no intent), and record the gate's results in the changelog entry.
 
 **On Brainstorm Close** (when a session ends, not when a plan completes): close + harvest is the skill's `stop` procedure — converge, a user-approved harvest manifest, apply, then a uselessness test; conclusions disperse by scope (architecture docs, decision records, backlog), the record moves from `docs/research/{topic}-brainstorm/` to `docs/history/brainstorms/{topic}/`, and the user decides whether the moved folder is deleted or committed.
 
 ---
 
-## Ownership, Boundaries & Documentation
+## Ownership, Boundaries, Verification & Documentation
 
-These three mechanisms work in tandem to keep the repo self-updating and to prevent half-finished changes: **ownership** routes an edit to the canonical doc before the code is touched, the **boundary** check reads both sides of every contract a change participates in so one side never ships alone, and **documentation** updates close the loop so the next session inherits the truth. Skipping any leg breaks the other two.
+These four mechanisms work in tandem to keep the repo self-updating and to prevent half-finished changes: **ownership** routes an edit to the canonical doc before the code is touched, the **boundary** check reads both sides of every contract a change participates in so one side never ships alone, **verification** proves the change works in the product before it is called done, and **documentation** updates close the loop so the next session inherits the truth. Skipping any leg breaks the others.
 
 ### Ownership — route before editing
 
@@ -65,7 +66,15 @@ Boundaries are **diagnosed, not documented** — the `boundary` skill derives th
 
 ### Test obligations — specify before implementing
 
-**After `boundary` passes and its amendments are folded, invoke the `test-plan` skill** — same plan gate, ordered second. It derives the tests the plan owes from its Proposed Changes and the owning LLD, and writes a **Test Obligations** section into the plan (one row per promised behavior: layer · target file · oracle · fixtures). It writes no test files — the tests land *with* the code at implementation time (the suite-first guardrail), and the manifest is the checklist that work satisfies. This makes obligations survive dispatch to an executor that sees only the plan file, and lets a later doc-health pass prove the tests match the promises. On a boundary **BLOCK** it does not run — re-plan first. The three-moment split (gate → implementation → Completion checklist), the layer rules, and the e2e altitude gate live in the skill.
+**After `boundary` passes and its amendments are folded, invoke the `test-plan` skill** — same plan gate, ordered second. It derives the tests the plan owes from its Proposed Changes and the owning LLD, and writes a **Test Obligations** section into the plan (one row per promised behavior: layer · target file · oracle · fixtures). It writes no test files — the tests land at the verification gate, and the manifest is the ledger that gate discharges. This makes obligations survive dispatch to an executor that sees only the plan file, and lets a later doc-health pass prove the tests match the promises. On a boundary **BLOCK** it does not run — re-plan first. The three-moment split (gate → verification → Completion checklist), the layer rules, and the e2e altitude gate live in the skill.
+
+### Verification — prove before completing
+
+**Deferring tests is what keeps the build loop fast, and the ledger is what makes deferring safe.** A plan-driven build writes no test files while the code is taking shape; the obligations accumulate in the plan and are discharged in one pass at the **verification gate** — triggered when the user says the work is ready to verify, and mandatory before a plan reaches `Status: Complete`. The gate, the two regimes, the mechanism ladder, and what earns a durable test are `.claude/rules/verification.md`.
+
+- **Only a plan may defer.** A bug fix and any ad-hoc change ship their test immediately — deferral needs a ledger and a gate, and non-plan work has neither.
+- **Drive the real surface before pinning tests.** Browser automation for web UI, the real CLI, HTTP against the running worker; the suite pins what must not regress afterward.
+- **The gate runs in the main session.** Verification is never delegated — see the Browser Automation guardrail and Runtime Notes.
 
 ### Documentation — close the loop
 
@@ -120,9 +129,10 @@ When a plan's implementation surfaces work that is important but outside the pla
 
 Defaults — ❌ prohibitions hold unless the user explicitly asks otherwise; ✅ and ⚠️ items are standing policy:
 
-- ✅ **Tests — suite-first.** Tests ship with every change to product code or behavior, built as one maintained suite, never as one-off scripts. Framework choice, test-tree placement, and shared fixtures/helpers are `.claude/rules/testing.md` — the repo's existing runner and layout always win.
-  - **What gets tests**: a new feature ships with tests for the behavior its LLD promises; a bug fix ships with a regression test that fails before the fix and passes after.
-  - **Discipline**: run the affected part of the suite before declaring work complete and report results honestly. When an LLD or plan intentionally changes behavior, updating the affected tests to the new contract is part of the change — the ban is on weakening, skipping, or deleting a test to mask an unexplained failure.
+- ✅ **Verification — batched at a gate, not continuous.** A plan-driven build loop ships code without accompanying test files; the tests and the driven checks land together at the **verification gate**, which the user triggers and which is mandatory before a plan reaches `Status: Complete`. The gate, the mechanism ladder, and what earns a durable test are `.claude/rules/verification.md`; framework, test-tree placement, and shared fixtures stay `.claude/rules/testing.md` — the repo's existing runner and layout always win.
+  - **Only a plan defers**: a bug fix and any ad-hoc change ship their test immediately — a regression test that fails before the change and passes after. Deferral needs the Test Obligations ledger and the gate that discharges it, and non-plan work has neither.
+  - **Drive before pinning**: prove the change in the real product first — browser automation for web UI, the real CLI, HTTP against the running worker — then pin as suite tests only the behaviors that must not regress.
+  - **Discipline**: run the affected part of the suite at the gate and report results honestly. When an LLD or plan intentionally changes behavior, updating the affected tests to the new contract is part of the change — the ban is on weakening, skipping, or deleting a test to mask an unexplained failure.
   - **Throwaway checks are not tests**: temporary verification scripts go to scratch space and are deleted, never committed into the test tree.
 - ❌ **Dependencies** – Never upgrade frameworks, libraries, or dependencies.
 - ❌ **Compatibility** – Never maintain backward compatibility unless specified.

package/data/harnesses/code/harness.json

@@ -1,11 +1,11 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.5.3",
+  "version": "3.5.5",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
-  "digest": "ca685ff63d77"
+  "digest": "f909d2dbf258"
 }

package/data/harnesses/code/rules/general.md

@@ -22,6 +22,7 @@ Runtime versions, the canonical package list, and GitHub Actions pins — the wo
 | `@reduxjs/toolkit` | ^2.11.2 | State management | `zustand`, `jotai` |
 | `react-redux` | ^9.2.0 | Redux React bindings | — |
 | `axios` | ^1.13.2 | HTTP requests | `fetch` |
+| `@microsoft/fetch-event-source` | ^2.0.1 | SSE over POST — streaming agent output | hand-rolled `getReader()` loops, `EventSource` |
 | `date-fns` | ^4.1.0 | Date formatting | `moment`, `dayjs` |
 | `@dnd-kit/core` | ^6.3.1 | Drag and drop | `react-beautiful-dnd` |
 | `@xyflow/react` | ^12.11.0 | Node-based flow charts | `reactflow`, `react-flow-renderer` |

package/data/harnesses/code/rules/testing.md

@@ -1,6 +1,6 @@
 # Testing
 
-Test technology and placement — framework per stack, suite layout, mocking policy; the suite-first policy (what gets tests, run-and-report discipline) is the harness `CLAUDE.md` Tests guardrail, not here. Framework choice is **never** ad hoc and never the user's problem mid-task: detect the stack, use its row; if the repo already has a runner, that runner wins — **never** introduce a second framework beside it.
+Test technology and placement — framework per stack, suite layout, mocking policy; **when** a test is written and how work is proven is [`verification.md`](verification.md), not here. Framework choice is **never** ad hoc and never the user's problem mid-task: detect the stack, use its row; if the repo already has a runner, that runner wins — **never** introduce a second framework beside it.
 
 ## Frameworks by stack
 

package/data/harnesses/code/rules/verification.md

@@ -0,0 +1,51 @@
+# Verification
+
+**When** work is proven and **by what mechanism** — the gate, the two regimes, and the ladder of ways to drive a change. Framework choice, suite layout, and mocking policy are [`testing.md`](testing.md); the plan-gate obligation manifest is the `test-plan` skill. This rule owns the moment, not the technology.
+
+## Two regimes
+
+**Deferral is a property of plans, not of code.** A plan carries a Test Obligations ledger and a gate that discharges it; nothing else does, so nothing else may defer.
+
+| Regime | During the work | Proven |
+| --- | --- | --- |
+| **Plan-driven build** | No test files. Code only — the loop stays fast | At the verification gate, before `Status: Complete` |
+| **Bug fix** | The regression test ships with the fix | Immediately — it fails before the change, passes after |
+| **Ad-hoc / non-plan change** | The test ships with the change | Immediately, same discipline as a bug fix |
+
+- **A bug fix cannot defer, because its central property is only observable at fix time** — "fails before, passes after" is unprovable once the fix is already in the tree.
+- **Ad-hoc work cannot defer, because there is no ledger to defer into.** An obligation recorded nowhere is an obligation forgotten; the plan file is the only durable home, so work without a plan pays as it goes.
+
+## The gate
+
+**The gate is a discrete step, not a background habit** — it runs when the user says the work is ready to verify, or when a plan's implementation is complete. It is **mandatory before a plan reaches `Status: Complete`**: a plan with outstanding obligations is not complete, whatever the code does.
+
+- **The gate runs in the main session, never delegated.** A sub-agent cannot hold a browser connection (`CLAUDE.md` § Runtime Notes), so a delegated gate silently degrades from *driving the product* to *describing how someone else could*. Fan-out may prepare fixtures or draft test bodies; the driving and the verdict stay inline.
+- **The plan's Test Obligations table is the checklist.** Every row is discharged — satisfied, or restated with the reason it owes nothing after all. A row left unexamined blocks the gate.
+- **Report what happened, including failures.** A gate that reports green while a suite is red is worse than no gate; state the failing test and its output.
+
+## The mechanism ladder
+
+**Drive the real thing first, then pin what must not regress.** Ordering matters: driving finds the defects that matter to a user, and shows which behaviors are worth the permanent cost of a test.
+
+| Rung | Mechanism | Proves |
+| --- | --- | --- |
+| 1 | **Drive the real surface** — browser automation for web UI, the actual CLI binary, HTTP against the running worker | The change works in the product, against real wiring |
+| 2 | **Pin the durable behaviors** as suite tests per [`testing.md`](testing.md) | The behavior survives the next change |
+| 3 | **Run the affected suite + the project's e2e smoke gate** | Nothing else broke |
+
+- **Browser automation is the default for a web surface, and needs no permission to use** — a rendered page driven through real interaction is the only oracle that catches wiring, styling, and state defects together. Where the runtime offers none, the gate emits a browser-verification checklist (URLs, actions, expected outcomes) for the user to run, and says so rather than claiming verification.
+- **A driven check is evidence, not an artifact.** It proves the change works today; it leaves nothing behind. That is why rung 2 exists.
+
+## What earns a durable test
+
+**A test is a permanent maintenance cost, so it is bought deliberately** — the ledger names behaviors, and the gate decides which of them are worth pinning.
+
+| Earns a suite test | Verified by driving alone |
+| --- | --- |
+| A promise an LLD makes about the feature's contract | Layout, spacing, copy — restated by a test, not protected by one |
+| A bug that occurred once — its regression test | A one-off migration or backfill's output |
+| An error path, race, or idempotency guarantee | Behavior a type or the compiler already makes unshippable |
+
+- **A behavior that is compiler-guarded owes no test** — if it cannot ship green-but-broken, a test adds cost and no safety.
+- **Never weaken, skip, or delete a test to mask an unexplained failure.** When a plan or LLD intentionally changes behavior, updating the affected tests to the new contract is part of that change.
+- **Throwaway checks are not tests.** Temporary scripts written to drive a change live in scratch space and are deleted — never committed into the test tree.

package/data/harnesses/code/skills/test-plan/SKILL.md

@@ -16,10 +16,10 @@ Testing spans three moments in the plan lifecycle. This skill owns **only the fi
 | Moment | Artifact | Owner |
 | --- | --- | --- |
 | **Plan gate** (here, after boundary) | Test Obligations section written into the plan | this skill |
-| **Implementation** | the obligated tests, green in the same commits as the code | the implementer (standing guardrail — this skill never pre-empts it) |
-| **Completion** | behavioral checklist at `docs/tests/{feature}.md`; run affected suite + the project's e2e smoke gate; note in changelog | the `documentation` skill + Completion steps |
+| **Verification gate** (before `Status: Complete`) | the obligated tests written and green, plus the driven checks against the real surface | the implementer at the gate (`.claude/rules/verification.md`) |
+| **Completion** | behavioral checklist at `docs/tests/{feature}.md`; record the gate's results in the changelog | the `documentation` skill + Completion steps |
 
-Writing tests *before* the code they cover either fabricates implementation coupling (labels/routes/copy the plan hasn't fixed) or leaves the suite red on the shared branch for the plan's whole duration. Neither is acceptable — so the gate emits obligations, and the tests land *with* the code.
+Writing tests *before* the code they cover either fabricates implementation coupling (labels/routes/copy the plan hasn't fixed) or leaves the suite red on the shared branch for the plan's whole duration. Writing them *during* the build loop taxes every iteration for behavior still in flux. So the plan gate emits obligations, the build loop stays free of test files, and the manifest is discharged in one pass at the verification gate.
 
 ## Contract sources
 

package/data/harnesses/delivery/CLAUDE.md

@@ -72,7 +72,7 @@ Three peer modes plus a Completion step — enter wherever the user's thinking a
 
 ## Prompt Artifacts — eval-first
 
-**[override]** The suite-first testing posture of the `code` harness is reframed: here the suite is the eval set.
+**[override]** The gated-verification posture of the `code` harness is reframed: here the suite discharged at the gate is the eval set.
 
 - **A prompt ships with its golden set.** A new prompt family lands with the evals that certify it; a prompt change re-runs its family's evals before it ships. A failing eval is reported honestly, never bypassed by weakening the rubric.
 - **Certification is per tier.** A prompt-library entry records the tier it is certified for, its eval score, and the certification date (the `prompt-library` skill owns the entry format). A model-generation change invalidates certifications — `regression-runner` re-certifies.

package/data/harnesses/delivery/harness.json

@@ -7,5 +7,5 @@
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
-  "digest": "4b2d95b7b13a"
+  "digest": "e56f5cf91025"
 }

package/data/harnesses/etna/CLAUDE.md

@@ -152,7 +152,7 @@ When a plan's implementation surfaces work that is important but outside the pla
 
 ❌ prohibitions hold unless the user explicitly asks otherwise; ✅ and ⚠️ items are standing policy:
 
-- ❌ **Tests** — etna is a markdown-authoring repo plus a small CLI with no test suite; never generate, update, or modify test files unless the user explicitly asks. (The `code` harness ships a suite-first posture for the projects it governs — that is a shipped rule, not etna's own.)
+- ❌ **Tests** — etna is a markdown-authoring repo plus a small CLI with no test suite; never generate, update, or modify test files unless the user explicitly asks. (The `code` harness ships a gated-verification posture for the projects it governs — that is a shipped rule, not etna's own.)
 - ❌ **Dependencies** — never upgrade frameworks, libraries, or dependencies.
 - ❌ **Compatibility** — never maintain backward compatibility unless specified.
 - ❌ **Branches & Worktrees [override]** — never self-create git branches or worktrees; commit straight to the checked-out branch. This replaces any built-in "branch first on the default branch" default. Exception: when the user asks for a pull request, create the branch the PR requires before committing its changes.

package/data/harnesses/etna/harness.json

@@ -1,11 +1,11 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
-  "digest": "c7f202566db9"
+  "digest": "4a94c1c4b34c"
 }

package/data/harnesses/etna/rules/general.md

@@ -22,6 +22,7 @@ Runtime versions, the canonical package list, and GitHub Actions pins — the wo
 | `@reduxjs/toolkit` | ^2.11.2 | State management | `zustand`, `jotai` |
 | `react-redux` | ^9.2.0 | Redux React bindings | — |
 | `axios` | ^1.13.2 | HTTP requests | `fetch` |
+| `@microsoft/fetch-event-source` | ^2.0.1 | SSE over POST — streaming agent output | hand-rolled `getReader()` loops, `EventSource` |
 | `date-fns` | ^4.1.0 | Date formatting | `moment`, `dayjs` |
 | `@dnd-kit/core` | ^6.3.1 | Drag and drop | `react-beautiful-dnd` |
 | `@xyflow/react` | ^12.11.0 | Node-based flow charts | `reactflow`, `react-flow-renderer` |

package/data/harnesses/etna/rules/testing.md

@@ -1,6 +1,6 @@
 # Testing
 
-Test technology and placement — framework per stack, suite layout, mocking policy; the suite-first policy (what gets tests, run-and-report discipline) is the harness `CLAUDE.md` Tests guardrail, not here. Framework choice is **never** ad hoc and never the user's problem mid-task: detect the stack, use its row; if the repo already has a runner, that runner wins — **never** introduce a second framework beside it.
+Test technology and placement — framework per stack, suite layout, mocking policy; **when** a test is written and how work is proven is [`verification.md`](verification.md), not here. Framework choice is **never** ad hoc and never the user's problem mid-task: detect the stack, use its row; if the repo already has a runner, that runner wins — **never** introduce a second framework beside it.
 
 ## Frameworks by stack
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.34",
+    "version": "0.19.35",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {