@nurix/etna 0.19.89 → 0.19.90

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "f3094aa08430",
+    "fingerprint": "8d6f9b80d64d",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/CLAUDE.md

@@ -139,7 +139,7 @@ Defaults — ❌ prohibitions hold unless the user explicitly asks otherwise;
 - ❌ **Branches & Worktrees [override]** – Never self-create git branches or worktrees; commit straight to the checked-out branch. This replaces any built-in "branch first on the default branch" default. Exception: when the user asks for a pull request, create the branch the PR requires before committing its changes.
 - ❌ **Protected Files** – Once per session, if `docs/operations/protected-files.md` exists, read it and never modify any path it lists; never modify `AGENTS.md` (harness-regenerated) or `protected-files.md` itself.
 - ✅ **Browser Automation** – If the runtime provides browser automation, use it freely; no need to ask first. If it doesn't — or the executing agent can't hold the browser connection (see Runtime Notes) — return a browser-verification checklist (URLs, actions, expected outcomes) for the orchestrating session or the user to run.
-- ✅ **Bookkeeping** — hooks silently append doc-debt rows to `docs/operations/bookkeeping.md`; the commit hook blocks while unresolved rows remain — dispatch the `bookkeeper` agent to drain the queue. The queue is a queue, never an archive: a drained row is **deleted**, so a fully drained file holds no rows at all.
+- ✅ **Bookkeeping** — hooks silently append doc-debt rows to `docs/operations/bookkeeping.md`; the commit hook blocks while unresolved rows remain — dispatch the `bookkeeper` agent to drain the queue. The queue is a queue, never an archive: a drained row is **deleted**, so a fully drained file holds no rows at all. **Every row is a cache of a condition, not a record of an event** — the session-start sweep re-tests each row against the repo and deletes the ones whose condition has died, `waived:` rows included, so the file empties itself as the work lands. What the sweep cannot re-test ages out instead: **a `waived:` row is unresolved once `expires=` passes**, which returns the wall and re-summons the bookkeeper to re-judge the reason. A waiver defers a finding; it never makes one immortal.
 - ✅ **Cleanup removes the cause, not the record of it.** When the user asks for something to be deleted or cleaned up, the ask is for the underlying condition to be gone. Deleting the record while the condition survives is worse than doing nothing — it destroys the only evidence the debt exists. The order is fixed: **read what the record is masking** (a `waived:` row, an `UNBUILT:` marker, a `status:` flag, a lint suppression — each asserts something is fine; check whether that is still true), **fix the condition**, **then delete the record**. Reversing it backfires concretely: a deleted waiver's finding is re-appended by the detector as an `auto:` row, which *fails* the commit wall the `waived:` row passed.
 - ✅ **Delegation** — when to fan out, tiers, and trust are § Delegation.
 - ⚠️ **Plans** – Plans are created directly in `docs/history/plans/` (see Workflows). Once `Status: Complete` or `Status: Abandoned`, the file is frozen — never edited. Abandoning a plan whose code was committed first converts its undischarged Test Obligations into backlog items (the `testing` rule). If scope changes after completion, write a new dated plan that links back to the old one.

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.10.12",
+  "version": "3.10.13",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "8b4f074b1311"
+  "digest": "e58c5f75136f"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -126,15 +126,117 @@ function openPlanLines(projectDir) {
   return lines;
 }
 
+// --- the re-verification sweep ---------------------------------------------------------------
+//
+// THE QUEUE IS DERIVED, NOT ACCUMULATED. Every finding here is recomputable from the repo, so a row
+// is a cache of a condition rather than a record of an event — and a cache nothing invalidates is
+// an archive. Before any wall reads the queue, each row is re-tested against the repo as it is NOW,
+// and a row whose condition has died is deleted.
+//
+// THIS RUNS OVER `waived:` ROWS TOO, WHICH IS THE POINT. A waiver defers a finding; it does not
+// make the finding immortal. Without this, waiving was strictly WORSE than leaving a row alone —
+// the one existing resolver filtered `kind === "auto"`, so waiving a self-clearing row opted it out
+// of its own return path forever. The condition, not the row's kind, decides.
+//
+// A kind with no verifier here is not swept — it ages out through `expires=` instead. Add a
+// verifier whenever a finding becomes mechanically checkable; silence is the only failure mode
+// this file has, so a verifier that is unsure must return false and leave the row standing.
+const ROW_VERIFIERS = {
+  // "<rel> lacks its file-path header comment" — dead once the header is there (or the file is gone).
+  "header-missing": (projectDir, body) => {
+    const m = /·\s+header-missing\s+·\s+(\S+)\s+lacks/.exec(body);
+    if (!m) return false;
+    const rel = m[1];
+    if (!fs.existsSync(path.join(projectDir, rel))) return true;
+    return hasHeaderComment(projectDir, rel);
+  },
+
+  // "owns: glob `<glob>` in <doc> matches no files" — dead once the glob matches something again.
+  "dead-glob": (projectDir, body, ctx) => {
+    const m = /`([^`]+)`/.exec(body);
+    if (!m) return false;
+    const re = globToRegExp(m[1]);
+    return ctx.repoFiles.some((f) => re.test(f));
+  },
+
+  // "<rel> is a frozen record and carries uncommitted modifications" — dead once it is committed.
+  // Immutability begins at commit, so the finding exists only while the edit is still in flight.
+  "frozen-record-edited": (projectDir, body) => {
+    const m = /·\s+frozen-record-edited\s+·\s+(\S+)\s+is a frozen record/.exec(body);
+    if (!m) return false;
+    const rel = m[1];
+    if (!fs.existsSync(path.join(projectDir, rel))) return true;
+    const res = spawnSync("git", ["diff", "--quiet", "HEAD", "--", rel], { cwd: projectDir, timeout: 5000 });
+    // status 0 = no uncommitted modifications. A git failure leaves the row standing.
+    return res.status === 0;
+  },
+
+  // "<src> changed; owning doc <doc> may need an update" — dead once the doc is newer than the
+  // source that implicated it, which is the same freshness test the drift report already applies.
+  "doc-implicated": (projectDir, body) => {
+    const m = /·\s+doc-implicated\s+·\s+(\S+)\s+changed;\s+owning doc\s+(\S+?)\s+may need/.exec(body);
+    if (!m) return false;
+    const [, src, doc] = m;
+    const mtime = (rel) => {
+      try {
+        return fs.statSync(path.join(projectDir, rel)).mtimeMs;
+      } catch (e) {
+        return null;
+      }
+    };
+    const docTime = mtime(doc);
+    const srcTime = mtime(src);
+    if (docTime === null) return false; // the doc is gone — a real finding, not a resolved one
+    if (srcTime === null) return true; // the source is gone; nothing implicates the doc any more
+    return docTime >= srcTime;
+  },
+};
+
+// Delete every row — `auto:` or `waived:` — whose condition no longer holds. Returns the count.
+export function sweepResolvedRows(projectDir, repoFiles) {
+  const ctx = { repoFiles: repoFiles || listRepoFiles(projectDir) };
+  return resolveRows(projectDir, (row) => {
+    if (row.kind === "needs-session") return false; // a human judgment, never swept mechanically
+    for (const [kind, verify] of Object.entries(ROW_VERIFIERS)) {
+      if (!row.body.includes(kind)) continue;
+      try {
+        return verify(projectDir, row.body, ctx);
+      } catch (e) {
+        return false; // never delete a row because a verifier threw
+      }
+    }
+    return false;
+  });
+}
+
 // Compute drift facts once; write the full report, return the one-line banner.
 function driftBanner(projectDir) {
   const repoFiles = listRepoFiles(projectDir);
+  // Re-verify before counting: the walls must act on conditions that are live NOW, not on rows
+  // that happen to still be written down.
+  const swept = sweepResolvedRows(projectDir, repoFiles);
   const dead = deadGlobs(projectDir, repoFiles);
   const queueRows = readQueue(projectDir);
   const counts = countRows(queueRows);
   const waivers = unexpiredWaivers(queueRows, "dead-glob", today());
   const unwaivedDead = dead.filter((d) => !waivers.some((w) => w.body.includes(d.glob)));
 
+  // A waiver becomes a wall the day it expires, so the queue says so a week ahead — the deferral
+  // ending should be a date somebody saw coming, not a commit that suddenly blocks.
+  const soon = new Date(Date.now() + 7 * 864e5).toISOString().slice(0, 10);
+  const expiringSoon = queueRows
+    .filter((r) => r.kind === "waived")
+    .map((r) => {
+      const d = (/expires=(\d{4}-\d{2}-\d{2})/.exec(r.body) || [])[1];
+      if (!d || d < today() || d > soon) return null;
+      // Drop the row's own raised-date prefix and its reason tail — the expiry and the finding are
+      // what a reader is scanning for here.
+      const finding = r.body.replace(/^\d{4}-\d{2}-\d{2}\s+·\s+/, "").split(" · reason:")[0];
+      return `expires ${d} · ${finding.slice(0, 120)}`;
+    })
+    .filter(Boolean)
+    .sort();
+
   // A queued dead-glob row covered by an unexpired waiver is resolved history — drop it,
   // so waiving a finding class actually empties the rows it supersedes.
   resolveRows(projectDir, (row) => {
@@ -174,7 +276,10 @@ function driftBanner(projectDir) {
     `## Docs older than owned code (${staleDocs.length})`,
     ...staleDocs.map((d) => `- ${d}`),
     "",
-    `## Bookkeeping queue (${counts.unresolved} unresolved: ${counts.auto} auto · ${counts.note} note · ${counts.needsSession} needs-session · ${counts.waived} waived)`,
+    `## Bookkeeping queue (${counts.unresolved} unresolved: ${counts.auto} auto · ${counts.note} note · ${counts.needsSession} needs-session · ${counts.expiredWaived} expired-waived; ${counts.waived} waived total, ${swept} swept as resolved this session)`,
+    ...(expiringSoon.length
+      ? ["", `## Waivers expiring within 7 days (${expiringSoon.length})`, ...expiringSoon.map((w) => `- ${w}`)]
+      : []),
   ].join("\n");
   try {
     fs.writeFileSync(path.join(stateDir(projectDir), "drift-report.md"), report + "\n");

package/data/harnesses/code/hooks/check-bookkeeping-clean.mjs

@@ -13,7 +13,12 @@ if (counts.unresolved === 0) {
 }
 console.error(
   `check-bookkeeping-clean: ${counts.unresolved} unresolved row(s) in docs/operations/bookkeeping.md ` +
-    `(${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session). ` +
-    "Drain them (bookkeeper agent), resolve them, or convert to waived: with reason + expires=."
+    `(${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session, ` +
+    `${counts.expiredWaived} expired-waived). ` +
+    "Drain them (bookkeeper agent), resolve them, or convert to waived: with reason + expires=. " +
+    (counts.expiredWaived > 0
+      ? "An expired waiver is a deferral that ran out: re-judge whether its reason still holds — " +
+        "re-waive with a fresh date only if it does, and never by default."
+      : "")
 );
 process.exit(1);

package/data/harnesses/code/hooks/compliance.mjs

@@ -567,8 +567,11 @@ function stopGate(projectDir, payload) {
     return {
       decision: "block",
       reason:
-        `${counts.unresolved} unresolved bookkeeping rows from this session (${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session) in docs/operations/bookkeeping.md. ` +
+        `${counts.unresolved} unresolved bookkeeping rows from this session (${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session, ${counts.expiredWaived} expired-waived) in docs/operations/bookkeeping.md. ` +
         "Dispatch the `bookkeeper` agent to drain them, resolve them now, or convert to `waived:` rows with reason + expiry. " +
+        (counts.expiredWaived > 0
+          ? "An expired waiver is a deferral that ran out — re-judge whether its reason still holds rather than re-waiving by default. "
+          : "") +
         "If implementation of the open plan is complete, also report it and offer the verification gate — never run it unbidden.",
     };
   }

package/data/harnesses/code/hooks/lib/state.mjs

@@ -5,7 +5,10 @@
 //   - note: {YYYY-MM-DD} · {area} · {context} → lands-in: {owning doc | backlog | memory} | sid=…
 //   - needs-session: {YYYY-MM-DD} · {what could not be grounded} → main session resolves | refs={ts}
 //   - waived: {YYYY-MM-DD} · {what is deferred} · reason: {why} → expires={YYYY-MM-DD}
-// Unresolved = auto + note + needs-session. waived: rows are resolved history until expires= passes.
+// Unresolved = auto + note + needs-session + EXPIRED waived. A `waived:` row is resolved history
+// only while its expires= date is in the future; past it, the deferral is over and the wall returns.
+// Rows are also re-verified against the repo before the walls read them (awareness.mjs's sweep),
+// so a row whose condition died is deleted rather than waiting for its date.
 
 import fs from "node:fs";
 import path from "node:path";
@@ -14,7 +17,7 @@ export const QUEUE_PATH = ["docs", "operations", "bookkeeping.md"];
 
 export const QUEUE_HEADER = `# Bookkeeping
 
-The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to \`waived:\`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the \`documentation\` skill's \`templates/bookkeeping.md\`. A \`waived:\` row carries \`expires=\` and is PR-reviewable history.
+The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to \`waived:\`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the \`documentation\` skill's \`templates/bookkeeping.md\`.\n\n**Every row is a cache of a condition, not a record of an event.** A session-start sweep re-tests each row against the repo and deletes the ones whose condition has died — \`waived:\` rows included, because a waiver defers a finding and never makes one immortal. What the sweep cannot mechanically re-test ages out instead: a \`waived:\` row carries \`expires=\`, is PR-reviewable history until that date, and counts as **unresolved** past it — which returns the wall and re-summons the bookkeeper to re-judge whether the reason still holds.
 `;
 
 export function queueFile(projectDir) {
@@ -113,15 +116,30 @@ export function readQueue(projectDir) {
 }
 
 // Counts by kind; `unresolved` is the number the walls act on.
-export function countRows(rows) {
-  const c = { auto: 0, note: 0, needsSession: 0, waived: 0 };
+//
+// AN EXPIRED WAIVER IS AN UNRESOLVED ROW. A waiver is a time-boxed deferral, so `expires=` is the
+// whole difference between deferring a finding and burying it — and until this counted, the date
+// was decorative: nothing but the dead-glob allowlist ever read it, so an expired waiver passed
+// every wall forever. Counting it here is what makes the deferral end, and what re-summons the
+// bookkeeper, whose own instructions already say to re-check a waiver's reason and demote a dead
+// one to `needs-session:`. The reviewer existed; this is the trigger it never had.
+//
+// A waiver with NO `expires=` is malformed and counts as expired — the grammar requires the date,
+// and treating an absent one as "never expires" would make the omission the cheapest way to write
+// a permanent waiver.
+export function countRows(rows, today = new Date().toISOString().slice(0, 10)) {
+  const c = { auto: 0, note: 0, needsSession: 0, waived: 0, expiredWaived: 0 };
   for (const row of rows) {
     if (row.kind === "auto") c.auto += 1;
     else if (row.kind === "note") c.note += 1;
     else if (row.kind === "needs-session") c.needsSession += 1;
-    else if (row.kind === "waived") c.waived += 1;
+    else if (row.kind === "waived") {
+      c.waived += 1;
+      const expires = (/expires=(\d{4}-\d{2}-\d{2})/.exec(row.body) || [])[1];
+      if (!expires || expires < today) c.expiredWaived += 1;
+    }
   }
-  c.unresolved = c.auto + c.note + c.needsSession;
+  c.unresolved = c.auto + c.note + c.needsSession + c.expiredWaived;
   return c;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/etna",
-  "version": "0.19.89",
+  "version": "0.19.90",
   "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
   "type": "module",
   "bin": {
@@ -42,5 +42,5 @@
     "agent",
     "plugin"
   ],
-  "etnaFingerprint": "f3094aa08430"
+  "etnaFingerprint": "8d6f9b80d64d"
 }