@nurix/etna 0.19.70 → 0.19.72

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "c39e1157ed11",
+    "fingerprint": "25655144dce0",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/agents/maintenance.md

@@ -59,7 +59,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/code/codex/agents/maintenance.toml

@@ -57,7 +57,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.8.4",
+  "version": "3.9.3",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "cfd0df4274c4"
+  "digest": "9aba7c8ce3db"
 }

package/data/harnesses/code/hooks/check-ownership.mjs

@@ -1,22 +1,57 @@
-// harness/code/hooks/check-ownership.mjs — CI backstop: every owns: glob must match at least one
-// file, unless an unexpired `waived:` dead-glob row in docs/operations/bookkeeping.md covers it
-// (the waiver names the glob verbatim). Exit 1 on any unwaived dead glob.
+// harness/code/hooks/check-ownership.mjs — CI backstop for docs/features/ ownership. Two checks,
+// one walk of the tree:
+//
+//   1. dead-glob         — every owns: glob matches at least one file
+//   2. ownership-overlap — no two feature docs claim a common file at EQUAL specificity, which
+//                          leaves "most specific wins" unable to pick an owner
+//
+// Either is silenced by an unexpired `waived:` row in docs/operations/bookkeeping.md naming its
+// kind plus the offending glob (dead-glob) or the shared path (ownership-overlap) verbatim.
+// Exit 1 on anything unwaived.
+//
+// A glob at strictly HIGHER specificity carving a sub-path out of a broader `**` is the designed
+// layering, not a conflict — only an exact tie is reported.
 
-import { deadGlobs } from "./lib/ownership.mjs";
+import { deadGlobs, listRepoFiles, overlaps } from "./lib/ownership.mjs";
 import { readQueue, unexpiredWaivers } from "./lib/state.mjs";
 
 const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const today = new Date().toISOString().slice(0, 10);
 
-const dead = deadGlobs(projectDir);
-const waivers = unexpiredWaivers(readQueue(projectDir), "dead-glob", today);
-const unwaived = dead.filter((d) => !waivers.some((w) => w.body.includes(d.glob)));
+const files = listRepoFiles(projectDir);
+const queue = readQueue(projectDir);
 
-if (unwaived.length === 0) {
-  console.log(`check-ownership: OK (${dead.length} dead glob(s), all waived or none)`);
+const dead = deadGlobs(projectDir, files);
+const deadWaivers = unexpiredWaivers(queue, "dead-glob", today);
+const unwaivedDead = dead.filter((d) => !deadWaivers.some((w) => w.body.includes(d.glob)));
+
+const conflicts = overlaps(projectDir, files);
+const overlapWaivers = unexpiredWaivers(queue, "ownership-overlap", today);
+const unwaivedOverlaps = conflicts.filter((c) => !overlapWaivers.some((w) => w.body.includes(c.example)));
+
+if (unwaivedDead.length === 0 && unwaivedOverlaps.length === 0) {
+  console.log(
+    `check-ownership: OK (${dead.length} dead glob(s), ${conflicts.length} equal-specificity overlap(s), all waived or none)`,
+  );
   process.exit(0);
 }
-console.error(`check-ownership: ${unwaived.length} unwaived dead owns: glob(s):`);
-for (const d of unwaived) console.error(`  ${d.glob} → ${d.doc}`);
-console.error("Fix the owning doc's owns: frontmatter, or add a `waived:` dead-glob row with reason + expires=.");
+
+if (unwaivedDead.length > 0) {
+  console.error(`check-ownership: ${unwaivedDead.length} unwaived dead owns: glob(s):`);
+  for (const d of unwaivedDead) console.error(`  ${d.glob} → ${d.doc}`);
+  console.error("Fix the owning doc's owns: frontmatter, or add a `waived:` dead-glob row with reason + expires=.");
+}
+
+if (unwaivedOverlaps.length > 0) {
+  console.error(`check-ownership: ${unwaivedOverlaps.length} unwaived equal-specificity overlap(s):`);
+  for (const c of unwaivedOverlaps) {
+    console.error(`  ${c.example}`);
+    console.error(`    ${c.a.glob} → ${c.a.doc}`);
+    console.error(`    ${c.b.glob} → ${c.b.doc}`);
+  }
+  console.error(
+    "Narrow one doc's glob so a single owner wins, or add a `waived:` ownership-overlap row naming the shared path with reason + expires=.",
+  );
+}
+
 process.exit(1);

package/data/harnesses/code/hooks/lib/ownership.mjs

@@ -242,3 +242,60 @@ export function deadGlobs(projectDir, repoFiles) {
   }
   return dead;
 }
+
+// Specificity of an owns: glob as a (literal, wildcard) segment tuple. The ownership rule is
+// "most specific wins", so a glob at strictly higher specificity legitimately carves a sub-path
+// out of a broader `**` — that is the designed layering, never a conflict. Only an exact tie
+// leaves the owner ambiguous, which is what `overlaps()` reports.
+export function specificity(glob) {
+  let literal = 0;
+  let wildcard = 0;
+  for (const segment of String(glob).split("/")) {
+    if (segment === "") continue;
+    if (segment.includes("*") || segment.includes("?")) wildcard++;
+    else literal++;
+  }
+  return { literal, wildcard };
+}
+
+// Two globs are equally specific when both tuple components match.
+export function sameSpecificity(a, b) {
+  return a.literal === b.literal && a.wildcard === b.wildcard;
+}
+
+// Cross-doc equal-specificity ownership conflicts: two globs from DIFFERENT feature docs that
+// match a common file at the same specificity, so "most specific wins" cannot pick an owner and
+// the path is doubly owned. Returns [{ a: {doc, glob}, b: {doc, glob}, example }].
+//
+// This is the mechanical half of a rule the harness has always stated and never checked — the
+// `documentation` skill's frontmatter reference calls an equal-specificity overlap "an ownership
+// conflict to resolve", and the `maintenance` agent is told to flag one. Without this, both had
+// to be enforced by eye.
+export function overlaps(projectDir, repoFiles) {
+  const files = repoFiles || listRepoFiles(projectDir);
+  const owners = [];
+  for (const entry of scanFeatureDocs(projectDir)) {
+    if (entry.status === "deprecated") continue;
+    for (const glob of entry.owns) {
+      const re = globToRegExp(glob);
+      owners.push({ doc: entry.doc, glob, spec: specificity(glob), files: files.filter((f) => re.test(f)) });
+    }
+  }
+  return pairOverlaps(owners);
+}
+
+// The pure core of `overlaps()`, split out so tests can feed synthetic owners without a repo tree.
+export function pairOverlaps(owners) {
+  const found = [];
+  for (let i = 0; i < owners.length; i++) {
+    for (let j = i + 1; j < owners.length; j++) {
+      const a = owners[i];
+      const b = owners[j];
+      if (a.doc === b.doc) continue;
+      if (!sameSpecificity(a.spec, b.spec)) continue;
+      const example = a.files.find((f) => b.files.includes(f));
+      if (example) found.push({ a: { doc: a.doc, glob: a.glob }, b: { doc: b.doc, glob: b.glob }, example });
+    }
+  }
+  return found;
+}

package/data/harnesses/code/skills/documentation/templates/behavioral-checklist.md

@@ -18,6 +18,8 @@ Required: **Conventions**, at least one numbered behavior section, **Failure Rep
 - **State each section's trace.** `Pinned:` names the suite test that now guards it, or says `driven only` **with the reason** — an unmarked section is indistinguishable from an unexamined one.
 - **State each section's `AC:` keys.** Where the repo carries a keyed acceptance-criteria source, each section names the keys it proves, so the chain from criterion to checklist to suite test survives the last hop; the gate reports coverage and backlogs uncovered keys. `none — not AC-mapped` is the honest line where no keyed source exists.
 - **A known-failing assertion stays written as the contract.** A checklist states what the feature promises; the *run* records the failure and the backlog carries the defect. Never soften an assertion to make a run go green.
+- **Each driven section carries a dated `Driven` line** — `Driven {YYYY-MM-DD} · PASS|FAIL ({environment}).` plus the evidence the assertion turned on. It is the only thing separating a promise someone verified from a promise someone typed, and its date is what makes staleness visible: a section still carrying last quarter's date next to a surface rewritten since is the file telling you it was not re-driven. `FAIL` is stamped and kept, with the backlog item it raised; a section blocked rather than driven says `NOT DRIVEN — {what blocked it}`.
+- **The file is maintained by whoever drives it.** Nothing else watches it — a checklist owns no code, so no ownership glob implicates it and no hook fires when the surface underneath it changes. Retiring dead sections and repairing traces is part of running the gate, not a separate cleanup someone schedules.
 
 ```
 # {Feature} Test Plan
@@ -44,7 +46,8 @@ Each step is an action; each **Assert** is the observable it must produce.
 - [ ] **Assert**: {the observable, with exact literals}
 - [ ] **Assert**: {the persistence claim, where the behavior writes something}
 
-> Pinned: `{tests/path/to/file.test.ts}` — or `driven only — {why no durable test is bought}`
+> Driven {YYYY-MM-DD} · PASS ({environment}). {the evidence — the literal observed, the row that moved}
+> Pinned: `{tests/path/to/file.test.ts}` — or `driven only — {why no durable test is bought}` — or `none yet — {the test this section owes}`
 > AC: {the acceptance-criteria keys this section proves} — or `none — not AC-mapped`
 
 ### 2. {The next behavior}

package/data/harnesses/code/skills/testing/SKILL.md

@@ -151,6 +151,8 @@ When writing or discharging a ledger row, name the stratum, not just the altitud
 Runs only when the user triggers the verification gate (constraints — preconditions, verdict-inline, tier, honesty — are `.claude/rules/testing.md` § The gate). **Drive the real thing first, then pin what must not regress**: driving finds the defects that matter to a user, and shows which behaviors are worth the permanent cost of a test.
 
 1. **Write the checklist** — derive or update `docs/tests/{feature}.md` from the ledger and the LLD's promises (the `documentation` skill's `templates/behavioral-checklist.md`; one `**Assert**` per observable). Derived before the driving it is the script; derived after, it is merely a report with nothing to trace tests back to.
+
+   **The gate owns these files, not just their first draft.** Whoever drives a checklist maintains it in the same pass — nothing else in the repo is watching, because a checklist owns no code and no `owns:` glob implicates it, so a surface can be rewritten under a checklist and every hook stays silent. Before driving, reconcile the file against the surface you are about to drive: **retire** sections whose behavior no longer exists (delete them — a checklist is a truth document, and the history lives in git), **add** sections for behavior shipped since the last run, and **repair every `Pinned:` trace**, because a trace naming a test that no longer exists is worse than no trace — it reports coverage that cannot fail. A section you cannot pin says `none yet` and names the test it owes. **Never soften an assertion to make the run green**: the checklist states what the feature promises, the run records what happened, and the backlog carries the difference.
 2. **Drive the real surface** — browser automation for web UI (the `/test` runner skill where the repo wires it), the actual CLI binary, HTTP against the running worker. **A failing checklist assertion is never softened to make a run green** — record the defect, send it to the backlog. Where the runtime offers no browser automation, emit the browser-verification checklist for the user to run; their report is the rung's verdict and `Status: Complete` waits for it.
 3. **Pin the durable behaviors** as suite tests per `testing.md`, naming each test's stratum (§ Bridge). **A pinned test must pass from a cold shell** — `pnpm test` with no dev server hand-started, no seeded state assumed beyond what the suite builds for itself. A test whose oracle is "fetch the server I happen to have running" is a driven check wearing a test's name: it goes red the moment the session ends (on Workers, `@cloudflare/vitest-pool-workers` is the self-contained harness; an Express app is driven via `supertest`, never a port). Before discharging, run the suite once from a clean shell — a suite that needs the session's environment discharges nothing. A test is a permanent maintenance cost, bought deliberately:
 
@@ -163,4 +165,8 @@ Runs only when the user triggers the verification gate (constraints — precondi
    A driven check is evidence, not an artifact — it proves the change works today and leaves nothing behind; that is why this rung exists.
 4. **Run the affected suite**, plus the project's e2e smoke gate where one is wired.
 5. **Discharge every ledger row into exactly one outcome**: **satisfied** (test green, or driven check passed), **owes nothing** (with the reason — compiler-guarded, covered elsewhere), or **blocked** (missing infrastructure named, row converted to a backlog item). **Open by re-reading the ledger from the plan file on disk, never from conversation memory** — a context-held copy is how rows get missed. **Write each row's outcome into its `Outcome` cell in the plan file** — exactly `satisfied`, `owes nothing — {reason}`, or `blocked → backlog` — because the Stop wall and CI read that cell, and a row left unexamined blocks completion.
-6. **Report results honestly, including failures**; record which test now guards each checklist section (`Pinned:` traces) and each section's `AC:` line where the repo carries a keyed acceptance-criteria source, closing with the coverage count — `AC coverage: {n}/{m}; uncovered: {keys} → backlog`. Completion steps — freezing the plan, the changelog entry — are the root policy file's, not yours.
+6. **Report results honestly, including failures**; record which test now guards each checklist section (`Pinned:` traces) and each section's `AC:` line where the repo carries a keyed acceptance-criteria source, closing with the coverage count — `AC coverage: {n}/{m}; uncovered: {keys} → backlog`.
+
+   **Stamp every section you drove, in the file, before reporting.** One line per section: `Driven {YYYY-MM-DD} · PASS|FAIL ({environment}).` followed by the evidence — the literal observed, the row version, the request body, whatever the assertion turned on. A section left unstamped since an earlier run keeps that run's older date, which is the signal that it was not re-driven. **A `FAIL` is stamped `FAIL` and stays** — with the backlog item it raised — because a corpus of driven records that has never recorded a failure is either describing a flawless product or being written by someone who already knew the answer, and a reader cannot tell which. Where the driving was blocked rather than failed, say `NOT DRIVEN — {what blocked it}`; an unexamined section and a passing one must never look alike.
+
+   Completion steps — freezing the plan, the changelog entry — are the root policy file's, not yours.

package/data/harnesses/delivery/agents/maintenance.md

@@ -59,7 +59,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/delivery/codex/agents/maintenance.toml

@@ -57,7 +57,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/delivery/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.8",
+  "version": "0.2.11",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "bfd105b1ff3c"
+  "digest": "ea0919582c83"
 }

package/data/harnesses/delivery/skills/documentation/templates/behavioral-checklist.md

@@ -18,6 +18,8 @@ Required: **Conventions**, at least one numbered behavior section, **Failure Rep
 - **State each section's trace.** `Pinned:` names the suite test that now guards it, or says `driven only` **with the reason** — an unmarked section is indistinguishable from an unexamined one.
 - **State each section's `AC:` keys.** Where the repo carries a keyed acceptance-criteria source, each section names the keys it proves, so the chain from criterion to checklist to suite test survives the last hop; the gate reports coverage and backlogs uncovered keys. `none — not AC-mapped` is the honest line where no keyed source exists.
 - **A known-failing assertion stays written as the contract.** A checklist states what the feature promises; the *run* records the failure and the backlog carries the defect. Never soften an assertion to make a run go green.
+- **Each driven section carries a dated `Driven` line** — `Driven {YYYY-MM-DD} · PASS|FAIL ({environment}).` plus the evidence the assertion turned on. It is the only thing separating a promise someone verified from a promise someone typed, and its date is what makes staleness visible: a section still carrying last quarter's date next to a surface rewritten since is the file telling you it was not re-driven. `FAIL` is stamped and kept, with the backlog item it raised; a section blocked rather than driven says `NOT DRIVEN — {what blocked it}`.
+- **The file is maintained by whoever drives it.** Nothing else watches it — a checklist owns no code, so no ownership glob implicates it and no hook fires when the surface underneath it changes. Retiring dead sections and repairing traces is part of running the gate, not a separate cleanup someone schedules.
 
 ```
 # {Feature} Test Plan
@@ -44,7 +46,8 @@ Each step is an action; each **Assert** is the observable it must produce.
 - [ ] **Assert**: {the observable, with exact literals}
 - [ ] **Assert**: {the persistence claim, where the behavior writes something}
 
-> Pinned: `{tests/path/to/file.test.ts}` — or `driven only — {why no durable test is bought}`
+> Driven {YYYY-MM-DD} · PASS ({environment}). {the evidence — the literal observed, the row that moved}
+> Pinned: `{tests/path/to/file.test.ts}` — or `driven only — {why no durable test is bought}` — or `none yet — {the test this section owes}`
 > AC: {the acceptance-criteria keys this section proves} — or `none — not AC-mapped`
 
 ### 2. {The next behavior}

package/data/harnesses/etna/agents/maintenance.md

@@ -59,7 +59,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/etna/codex/agents/maintenance.toml

@@ -57,7 +57,7 @@ The ownership source of truth is the **union of every feature doc's `owns:` fron
 For each `owns:` glob across the feature docs:
 
 - Verify the glob matches existing files. Report globs matching nothing, deleted paths, and orphaned docs.
-- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). Surface as a question.
+- Flag **equal-specificity overlaps** — two feature docs whose `owns:` globs claim the same paths at the same specificity (an ambiguous owner). `node .claude/hooks/check-ownership.mjs` reports these mechanically alongside dead globs (`overlaps()` in `lib/ownership.mjs`); a glob at strictly higher specificity carving out of a broader `**` is the designed layering and is never flagged. Surface a real overlap as a question — narrowing someone's glob is an author's call, not remediation.
 - **Stamp `type:` where missing.** Every doc carries a `type:` genre key (enum = the `documentation` skill's template names); docs predating the key are stamped mechanically — the genre is readable from placement and shape (a `docs/features/` doc is `type: feature`, an AD is `type: architecture-decision`). Stamping is remediation, not a question; an ambiguous genre is backlogged instead.
 
 For each code symbol or path a doc explicitly **names** (function/export/route/type):

package/data/harnesses/etna/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.4.7",
+  "version": "1.4.10",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "593183c2c83c"
+  "digest": "a3ff16dda3c2"
 }

package/data/harnesses/etna/skills/documentation/templates/behavioral-checklist.md

@@ -18,6 +18,8 @@ Required: **Conventions**, at least one numbered behavior section, **Failure Rep
 - **State each section's trace.** `Pinned:` names the suite test that now guards it, or says `driven only` **with the reason** — an unmarked section is indistinguishable from an unexamined one.
 - **State each section's `AC:` keys.** Where the repo carries a keyed acceptance-criteria source, each section names the keys it proves, so the chain from criterion to checklist to suite test survives the last hop; the gate reports coverage and backlogs uncovered keys. `none — not AC-mapped` is the honest line where no keyed source exists.
 - **A known-failing assertion stays written as the contract.** A checklist states what the feature promises; the *run* records the failure and the backlog carries the defect. Never soften an assertion to make a run go green.
+- **Each driven section carries a dated `Driven` line** — `Driven {YYYY-MM-DD} · PASS|FAIL ({environment}).` plus the evidence the assertion turned on. It is the only thing separating a promise someone verified from a promise someone typed, and its date is what makes staleness visible: a section still carrying last quarter's date next to a surface rewritten since is the file telling you it was not re-driven. `FAIL` is stamped and kept, with the backlog item it raised; a section blocked rather than driven says `NOT DRIVEN — {what blocked it}`.
+- **The file is maintained by whoever drives it.** Nothing else watches it — a checklist owns no code, so no ownership glob implicates it and no hook fires when the surface underneath it changes. Retiring dead sections and repairing traces is part of running the gate, not a separate cleanup someone schedules.
 
 ```
 # {Feature} Test Plan
@@ -44,7 +46,8 @@ Each step is an action; each **Assert** is the observable it must produce.
 - [ ] **Assert**: {the observable, with exact literals}
 - [ ] **Assert**: {the persistence claim, where the behavior writes something}
 
-> Pinned: `{tests/path/to/file.test.ts}` — or `driven only — {why no durable test is bought}`
+> Driven {YYYY-MM-DD} · PASS ({environment}). {the evidence — the literal observed, the row that moved}
+> Pinned: `{tests/path/to/file.test.ts}` — or `driven only — {why no durable test is bought}` — or `none yet — {the test this section owes}`
 > AC: {the acceptance-criteria keys this section proves} — or `none — not AC-mapped`
 
 ### 2. {The next behavior}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.70",
+    "version": "0.19.72",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -42,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "c39e1157ed11"
+    "etnaFingerprint": "25655144dce0"
 }