@nurix/etna 0.19.89 → 0.19.91

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "f3094aa08430",
+    "fingerprint": "b52694cf6295",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/CLAUDE.md

@@ -139,7 +139,7 @@ Defaults — ❌ prohibitions hold unless the user explicitly asks otherwise;
 - ❌ **Branches & Worktrees [override]** – Never self-create git branches or worktrees; commit straight to the checked-out branch. This replaces any built-in "branch first on the default branch" default. Exception: when the user asks for a pull request, create the branch the PR requires before committing its changes.
 - ❌ **Protected Files** – Once per session, if `docs/operations/protected-files.md` exists, read it and never modify any path it lists; never modify `AGENTS.md` (harness-regenerated) or `protected-files.md` itself.
 - ✅ **Browser Automation** – If the runtime provides browser automation, use it freely; no need to ask first. If it doesn't — or the executing agent can't hold the browser connection (see Runtime Notes) — return a browser-verification checklist (URLs, actions, expected outcomes) for the orchestrating session or the user to run.
-- ✅ **Bookkeeping** — hooks silently append doc-debt rows to `docs/operations/bookkeeping.md`; the commit hook blocks while unresolved rows remain — dispatch the `bookkeeper` agent to drain the queue. The queue is a queue, never an archive: a drained row is **deleted**, so a fully drained file holds no rows at all.
+- ✅ **Bookkeeping** — hooks silently append doc-debt rows to `docs/operations/bookkeeping.md`; the commit hook blocks while unresolved rows remain — dispatch the `bookkeeper` agent to drain the queue. The queue is a queue, never an archive: a drained row is **deleted**, so a fully drained file holds no rows at all. **Every row is a cache of a condition, not a record of an event** — the session-start sweep re-tests each row against the repo and deletes the ones whose condition has died, `waived:` rows included, so the file empties itself as the work lands. What the sweep cannot re-test ages out instead: **a `waived:` row is unresolved once `expires=` passes**, which returns the wall and re-summons the bookkeeper to re-judge the reason. A waiver defers a finding; it never makes one immortal.
 - ✅ **Cleanup removes the cause, not the record of it.** When the user asks for something to be deleted or cleaned up, the ask is for the underlying condition to be gone. Deleting the record while the condition survives is worse than doing nothing — it destroys the only evidence the debt exists. The order is fixed: **read what the record is masking** (a `waived:` row, an `UNBUILT:` marker, a `status:` flag, a lint suppression — each asserts something is fine; check whether that is still true), **fix the condition**, **then delete the record**. Reversing it backfires concretely: a deleted waiver's finding is re-appended by the detector as an `auto:` row, which *fails* the commit wall the `waived:` row passed.
 - ✅ **Delegation** — when to fan out, tiers, and trust are § Delegation.
 - ⚠️ **Plans** – Plans are created directly in `docs/history/plans/` (see Workflows). Once `Status: Complete` or `Status: Abandoned`, the file is frozen — never edited. Abandoning a plan whose code was committed first converts its undischarged Test Obligations into backlog items (the `testing` rule). If scope changes after completion, write a new dated plan that links back to the old one.

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.10.12",
+  "version": "3.10.14",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "8b4f074b1311"
+  "digest": "98eb07166e9f"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -26,11 +26,13 @@ import {
   formatNeedsSessionRow,
   appendRows,
   resolveRows,
-  unexpiredWaivers,
+  waiverCovers,
   stateDir,
   recordTouched,
 } from "./lib/state.mjs";
-import { frozenStatus } from "./lib/frozen.mjs";
+import { readSafe, relIfInside, today, SOURCE_EXT, commandRoot } from "./lib/repo.mjs";
+import { listPlans } from "./lib/plans.mjs";
+import { frozenStatusAtHead } from "./lib/frozen.mjs";
 import { approvedPackages, rejectedPackages } from "./lib/approved.mjs";
 import {
   recordSession,
@@ -42,24 +44,6 @@ import {
 } from "./lib/claims.mjs";
 import { appendEvent } from "./lib/session-log.mjs";
 
-const today = () => new Date().toISOString().slice(0, 10);
-
-function readSafe(file) {
-  try {
-    return fs.readFileSync(file, "utf8");
-  } catch (e) {
-    return "";
-  }
-}
-
-function readJsonSafe(file) {
-  try {
-    return JSON.parse(fs.readFileSync(file, "utf8"));
-  } catch (e) {
-    return null;
-  }
-}
-
 // ---------------------------------------------------------------------------
 // SessionStart
 // ---------------------------------------------------------------------------
@@ -79,7 +63,12 @@ function detectPackageManager(projectDir) {
 }
 
 function harnessLine(projectDir) {
-  const marker = readJsonSafe(path.join(projectDir, ".claude", "harness.json"));
+  let marker = null;
+  try {
+    marker = JSON.parse(readSafe(path.join(projectDir, ".claude", "harness.json")));
+  } catch (e) {
+    /* absent or unparseable — no line */
+  }
   if (!marker || !marker.version) return null;
   const structure = readSafe(path.join(projectDir, "docs", "structure.md"));
   const stamped = (/harness-version:\s*([\w.-]+)/.exec(frontmatter(structure) || structure) || [])[1];
@@ -104,65 +93,178 @@ function memoryLine(projectDir) {
 }
 
 function openPlanLines(projectDir) {
-  const dir = path.join(projectDir, "docs", "history", "plans");
-  let entries;
-  try {
-    entries = fs.readdirSync(dir).filter((f) => f.endsWith(".md"));
-  } catch (e) {
-    return [];
-  }
-  const lines = [];
-  for (const file of entries) {
-    const text = readSafe(path.join(dir, file));
-    const status = (/^\*\*Status:\*\*\s*(.+)$/m.exec(text) || [])[1]?.trim();
-    if (!status || /Complete|Abandoned/.test(status)) continue;
-    const gates = (/^\*\*Gates:\*\*\s*(.+)$/m.exec(text) || [])[1]?.trim();
-    const ledgerRows = (text.match(/^\|\s*\d+\s*\|/gm) || []).length;
-    const parts = [`Open plan: ${file} (${status}`];
-    if (gates) parts.push(` · Gates: ${gates}`);
-    if (ledgerRows) parts.push(` · ledger: ${ledgerRows} rows`);
-    lines.push(parts.join("") + ")");
-  }
-  return lines;
+  return listPlans(projectDir)
+    .filter((p) => !/Complete|Abandoned/.test(p.status))
+    .map((p) => {
+      const parts = [`Open plan: ${p.file} (${p.status}`];
+      if (p.gates) parts.push(` · Gates: ${p.gates}`);
+      if (p.ledgerRows) parts.push(` · ledger: ${p.ledgerRows} rows`);
+      return parts.join("") + ")";
+    });
+}
+
+// --- the re-verification sweep ---------------------------------------------------------------
+//
+// THE QUEUE IS DERIVED, NOT ACCUMULATED. Every finding here is recomputable from the repo, so a row
+// is a cache of a condition rather than a record of an event — and a cache nothing invalidates is
+// an archive. Before any wall reads the queue, each row is re-tested against the repo as it is NOW,
+// and a row whose condition has died is deleted.
+//
+// THIS RUNS OVER `waived:` ROWS TOO, WHICH IS THE POINT. A waiver defers a finding; it does not
+// make the finding immortal. Without this, waiving was strictly WORSE than leaving a row alone —
+// the one existing resolver filtered `kind === "auto"`, so waiving a self-clearing row opted it out
+// of its own return path forever. The condition, not the row's kind, decides.
+//
+// A kind with no verifier here is not swept — it ages out through `expires=` instead. Add a
+// verifier whenever a finding becomes mechanically checkable; silence is the only failure mode
+// this file has, so a verifier that is unsure must return false and leave the row standing.
+const ROW_VERIFIERS = {
+  // "<rel> lacks its file-path header comment" — dead once the header is there (or the file is gone).
+  "header-missing": (projectDir, body) => {
+    const m = /·\s+header-missing\s+·\s+(\S+)\s+lacks/.exec(body);
+    if (!m) return false;
+    const rel = m[1];
+    if (!fs.existsSync(path.join(projectDir, rel))) return true;
+    return hasHeaderComment(projectDir, rel);
+  },
+
+  // "owns: glob `<glob>` in <doc> matches no files" — dead once the glob matches something again.
+  "dead-glob": (projectDir, body, ctx) => {
+    const m = /`([^`]+)`/.exec(body);
+    if (!m) return false;
+    const re = globToRegExp(m[1]);
+    return ctx.repoFiles.some((f) => re.test(f));
+  },
+
+  // "<rel> is a frozen record and carries uncommitted modifications" — dead once it is committed.
+  // Immutability begins at commit, so the finding exists only while the edit is still in flight.
+  "frozen-record-edited": (projectDir, body) => {
+    const m = /·\s+frozen-record-edited\s+·\s+(\S+)\s+is a frozen record/.exec(body);
+    if (!m) return false;
+    const rel = m[1];
+    if (!fs.existsSync(path.join(projectDir, rel))) return true;
+    const res = spawnSync("git", ["diff", "--quiet", "HEAD", "--", rel], { cwd: projectDir, timeout: 5000 });
+    // status 0 = no uncommitted modifications. A git failure leaves the row standing.
+    return res.status === 0;
+  },
+
+  // "<src> changed; owning doc <doc> may need an update" — dead once the doc is newer than the
+  // source that implicated it, which is the same freshness test the drift report already applies.
+  "doc-implicated": (projectDir, body) => {
+    const m = /·\s+doc-implicated\s+·\s+(\S+)\s+changed;\s+owning doc\s+(\S+?)\s+may need/.exec(body);
+    if (!m) return false;
+    const [, src, doc] = m;
+    const mtime = (rel) => {
+      try {
+        return fs.statSync(path.join(projectDir, rel)).mtimeMs;
+      } catch (e) {
+        return null;
+      }
+    };
+    const docTime = mtime(doc);
+    const srcTime = mtime(src);
+    if (docTime === null) return false; // the doc is gone — a real finding, not a resolved one
+    if (srcTime === null) return true; // the source is gone; nothing implicates the doc any more
+    return docTime >= srcTime;
+  },
+
+  // "<rel> has N doc-lint finding(s)" — dead once a re-run comes back clean (or the doc is gone).
+  "doc-lint": (projectDir, body) => {
+    const m = /·\s+doc-lint\s+·\s+(\S+)\s+has/.exec(body);
+    if (!m) return false;
+    if (!fs.existsSync(path.join(projectDir, m[1]))) return true;
+    return docLint(projectDir, m[1]).length === 0;
+  },
+
+  // "<rel> is not linked from docs/README.md" — dead once the index names it (or it is gone).
+  "index-row-missing": (projectDir, body) => {
+    const m = /·\s+index-row-missing\s+·\s+(\S+)\s+is not linked/.exec(body);
+    if (!m) return false;
+    if (!fs.existsSync(path.join(projectDir, m[1]))) return true;
+    return readSafe(path.join(projectDir, "docs", "README.md")).includes(path.basename(m[1]));
+  },
+
+  // "<rel> declares `<name>` (package-rejected)" — dead once the manifest drops the package
+  // or the table stops rejecting it.
+  "package-rejected": (projectDir, body) => {
+    const m = /·\s+package-rejected\s+·\s+(\S+)\s+declares\s+`([^`]+)`/.exec(body);
+    if (!m) return false;
+    const [, rel, name] = m;
+    let manifest;
+    try {
+      manifest = JSON.parse(readSafe(path.join(projectDir, rel)));
+    } catch (e) {
+      return !fs.existsSync(path.join(projectDir, rel)); // gone ⇒ resolved; unparseable ⇒ standing
+    }
+    const declared = { ...manifest.dependencies, ...manifest.devDependencies };
+    if (!(name in declared)) return true;
+    return !rejectedPackages(projectDir).has(name);
+  },
+
+  // Retired detector kinds — the harness no longer raises these, so a standing row caches a
+  // condition nothing can re-derive. Swept unconditionally — but only machine-raised rows: a
+  // note: or waived: row whose free text merely mentions the phrase is a human's, not ours.
+  "doc-placement": (projectDir, body, ctx, row) => row.kind === "auto",
+  "boundary-scan-suggested": (projectDir, body, ctx, row) => row.kind === "auto",
+};
+
+// Delete every row — `auto:` or `waived:` — whose condition no longer holds. Returns the count.
+export function sweepResolvedRows(projectDir, repoFiles) {
+  const ctx = { repoFiles: repoFiles || listRepoFiles(projectDir) };
+  return resolveRows(projectDir, (row) => {
+    if (row.kind === "needs-session") return false; // a human judgment, never swept mechanically
+    for (const [kind, verify] of Object.entries(ROW_VERIFIERS)) {
+      if (!row.body.includes(kind)) continue;
+      try {
+        return verify(projectDir, row.body, ctx, row);
+      } catch (e) {
+        return false; // never delete a row because a verifier threw
+      }
+    }
+    return false;
+  });
 }
 
 // Compute drift facts once; write the full report, return the one-line banner.
 function driftBanner(projectDir) {
   const repoFiles = listRepoFiles(projectDir);
-  const dead = deadGlobs(projectDir, repoFiles);
+  // Re-verify before counting: the walls must act on conditions that are live NOW, not on rows
+  // that happen to still be written down.
+  const swept = sweepResolvedRows(projectDir, repoFiles);
+  const docs = scanFeatureDocs(projectDir);
+  const dead = deadGlobs(projectDir, repoFiles, docs);
   const queueRows = readQueue(projectDir);
   const counts = countRows(queueRows);
-  const waivers = unexpiredWaivers(queueRows, "dead-glob", today());
-  const unwaivedDead = dead.filter((d) => !waivers.some((w) => w.body.includes(d.glob)));
+  const unwaivedDead = dead.filter((d) => !waiverCovers(queueRows, "dead-glob", d.glob, today()));
 
   // A queued dead-glob row covered by an unexpired waiver is resolved history — drop it,
   // so waiving a finding class actually empties the rows it supersedes.
   resolveRows(projectDir, (row) => {
     if (row.kind !== "auto" || !row.body.includes("dead-glob")) return false;
     const m = /`([^`]+)`/.exec(row.body);
-    return !!m && waivers.some((w) => w.body.includes(`\`${m[1]}\``));
+    return !!m && waiverCovers(queueRows, "dead-glob", m[1], today());
   });
 
-  // Docs older than the code they own (doc mtime < newest owned-file mtime).
-  const staleDocs = [];
-  for (const entry of scanFeatureDocs(projectDir)) {
-    let docTime;
-    try {
-      docTime = fs.statSync(path.join(projectDir, entry.doc)).mtimeMs;
-    } catch (e) {
-      continue;
-    }
-    const res = entry.owns.map((g) => globToRegExp(g));
-    let newest = 0;
-    for (const file of repoFiles) {
-      if (!res.some((re) => re.test(file))) continue;
+  // Docs older than the code they own (doc mtime < newest owned-file mtime) — one stat per
+  // repo file, cached across docs, instead of docs × files stats.
+  const mtimes = new Map();
+  const mtimeOf = (rel) => {
+    if (!mtimes.has(rel)) {
       try {
-        newest = Math.max(newest, fs.statSync(path.join(projectDir, file)).mtimeMs);
+        mtimes.set(rel, fs.statSync(path.join(projectDir, rel)).mtimeMs);
       } catch (e) {
-        /* deleted between walk and stat */
+        mtimes.set(rel, null);
       }
     }
-    if (newest > docTime) staleDocs.push(entry.doc);
+    return mtimes.get(rel);
+  };
+  const staleDocs = [];
+  for (const entry of docs) {
+    const docTime = mtimeOf(entry.doc);
+    if (docTime === null) continue;
+    const res = entry.owns.map((g) => globToRegExp(g));
+    const stale = repoFiles.some((file) => res.some((re) => re.test(file)) && (mtimeOf(file) ?? 0) > docTime);
+    if (stale) staleDocs.push(entry.doc);
   }
 
   const report = [
@@ -174,7 +276,7 @@ function driftBanner(projectDir) {
     `## Docs older than owned code (${staleDocs.length})`,
     ...staleDocs.map((d) => `- ${d}`),
     "",
-    `## Bookkeeping queue (${counts.unresolved} unresolved: ${counts.auto} auto · ${counts.note} note · ${counts.needsSession} needs-session · ${counts.waived} waived)`,
+    `## Bookkeeping queue (${counts.unresolved} unresolved: ${counts.auto} auto · ${counts.note} note · ${counts.needsSession} needs-session · ${counts.expiredWaived} expired-waived; ${counts.waived} waived total, ${swept} swept as resolved this session)`,
   ].join("\n");
   try {
     fs.writeFileSync(path.join(stateDir(projectDir), "drift-report.md"), report + "\n");
@@ -196,16 +298,10 @@ function driftBanner(projectDir) {
 
 function sessionStart(projectDir, payload = {}) {
   // Stamp the session's start so gitless repos still have a "modified since" horizon for the
-  // outcome detector's fallback scan (dirtyPaths). The legacy shared stamp stays for its reader;
-  // the per-sid twin exists because two concurrent sessions clobber the shared one. Best-effort.
+  // outcome detector's fallback scan (dirtyPaths). Best-effort.
   const sid = payload.session_id;
-  const stamp = new Date().toISOString() + "\n";
   try {
-    fs.writeFileSync(path.join(stateDir(projectDir), "session-started"), stamp);
-    if (sid) {
-      const short = String(sid).replace(/[^a-zA-Z0-9-]/g, "").slice(0, 8);
-      fs.writeFileSync(path.join(stateDir(projectDir), `session-started-${short}`), stamp);
-    }
+    fs.writeFileSync(path.join(stateDir(projectDir), "session-started"), new Date().toISOString() + "\n");
   } catch (e) {
     /* the stamp is a convenience for the fallback; git repos never need it */
   }
@@ -245,6 +341,14 @@ function sessionStart(projectDir, payload = {}) {
   const memory = memoryLine(projectDir);
   if (memory) lines.push(memory);
   lines.push(...openPlanLines(projectDir).slice(0, 4));
+  // A gate that crashed or skipped a write left a trace here — surface the count so the
+  // failure log finally has its reader.
+  try {
+    const failures = readSafe(path.join(stateDir(projectDir), "hook-failures.log")).split("\n").filter(Boolean);
+    if (failures.length) lines.push(`Hook failures logged: ${failures.length} (.claude/state/hook-failures.log) — enforcement may have gaps.`);
+  } catch (e) {
+    /* the count is a convenience */
+  }
   try {
     const drift = driftBanner(projectDir);
     if (drift) lines.push(drift);
@@ -268,15 +372,6 @@ function sessionStart(projectDir, payload = {}) {
 // PostToolUse — the silent detector
 // ---------------------------------------------------------------------------
 
-const SOURCE_EXT = /\.(m?[jt]sx?|py|rs|go|rb|java|kt|swift|c|h|cpp|hpp|cs|sh|sql|css|scss|vue|svelte)$/;
-
-function relIfInside(projectDir, filePath) {
-  if (!filePath) return null;
-  const rel = path.relative(projectDir, path.resolve(projectDir, filePath));
-  if (rel.startsWith("..") || path.isAbsolute(rel)) return null;
-  return rel.split(path.sep).join("/");
-}
-
 // Spawn the installed doc-lint over one file; returns finding lines (empty when absent/clean).
 function docLint(projectDir, rel) {
   const script = path.join(projectDir, ".claude", "skills", "documentation", "scripts", "doc-lint.mjs");
@@ -336,20 +431,6 @@ function detectorForFile(projectDir, rel, meta, rows) {
         );
       }
     }
-    const segment = rel.split("/")[1];
-    if (rel.startsWith("docs/") && segment && !segment.endsWith(".md")) {
-      const structure = readSafe(path.join(projectDir, "docs", "structure.md"));
-      if (structure && !structure.includes(`${segment}/`) && !structure.includes(`docs/${segment}`)) {
-        rows.push(
-          formatAutoRow({
-            ...meta,
-            kind: "doc-placement",
-            description: `${rel} sits in a folder absent from docs/structure.md's authority map`,
-            action: "move the doc per the add-a-doc table, or record the new folder in structure.md",
-          })
-        );
-      }
-    }
     if (rel.startsWith("docs/features/") && !readSafe(path.join(projectDir, "docs", "README.md")).includes(path.basename(rel))) {
       rows.push(
         formatAutoRow({
@@ -384,24 +465,14 @@ function detectorForFile(projectDir, rel, meta, rows) {
         })
       );
     }
-    if (/(schema|init\.sql|migration|auth|webhook|\benv\b|wrangler)/i.test(rel)) {
-      rows.push(
-        formatAutoRow({
-          ...meta,
-          kind: "boundary-scan-suggested",
-          description: `${rel} is contract-heavy`,
-          action: "run the boundary skill scoped to the diff",
-        })
-      );
-    }
   }
 }
 
 function detectRenames(projectDir, command, meta, rows) {
   if (!/\bgit mv\b|\bmv\b/.test(command || "")) return;
-  const waivers = unexpiredWaivers(readQueue(projectDir), "dead-glob", today());
+  const queueRows = readQueue(projectDir);
   for (const { glob, doc } of deadGlobs(projectDir)) {
-    if (waivers.some((w) => w.body.includes(`\`${glob}\``))) continue;
+    if (waiverCovers(queueRows, "dead-glob", glob, today())) continue;
     rows.push(
       formatAutoRow({
         ...meta,
@@ -507,7 +578,9 @@ function detectOutcomes(projectDir, meta, rows) {
       }
     }
     if (rel.startsWith("docs/history/")) {
-      const frozen = frozenStatus(projectDir, rel);
+      // Frozen AT HEAD, not in the worktree: the completion flip makes a plan dirty+Complete in
+      // one edit, and the worktree predicate walled the very commit that ceremony requires.
+      const frozen = frozenStatusAtHead(projectDir, rel);
       if (frozen.frozen && !raised(`${rel} is a frozen record`)) {
         rows.push(
           formatAutoRow({
@@ -533,11 +606,10 @@ function postToolUse(projectDir, payload) {
   const rows = [];
   if (payload.tool_name === "Bash") {
     // A completed `git commit` releases the claim compliance took at PreToolUse — the `end` line
-    // is what lets a waiting session verify the actor finished. Root resolution mirrors the
-    // gate's: an explicit `cd` in the command wins, so cross-repo commits release where they claimed.
-    if (/(?:^|&&|;|\|)\s*(?:sudo\s+)?git\s+commit\b/.test(input.command || "")) {
-      const cdMatch = /(?:^|&&|;)\s*cd\s+"?([^"\s;&]+)"?/.exec(input.command || "");
-      const root = cdMatch && path.isAbsolute(cdMatch[1]) && fs.existsSync(cdMatch[1]) ? cdMatch[1] : projectDir;
+    // is what lets a waiting session verify the actor finished. Root resolution is the gate's own
+    // `commandRoot`, shared, so a claim and its release can never resolve to different repos.
+    if (/(?:^|\n|&&|;|\|)\s*(?:sudo\s+)?git\s+commit\b/.test(input.command || "")) {
+      const root = commandRoot(projectDir, payload, input.command);
       try {
         releaseActivity(root, "commit", payload.session_id);
         appendEvent(root, payload.session_id, "coord", "commit-claim", "released");

package/data/harnesses/code/hooks/check-bookkeeping-clean.mjs

@@ -13,7 +13,12 @@ if (counts.unresolved === 0) {
 }
 console.error(
   `check-bookkeeping-clean: ${counts.unresolved} unresolved row(s) in docs/operations/bookkeeping.md ` +
-    `(${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session). ` +
-    "Drain them (bookkeeper agent), resolve them, or convert to waived: with reason + expires=."
+    `(${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session, ` +
+    `${counts.expiredWaived} expired-waived). ` +
+    "Drain them (bookkeeper agent), resolve them, or convert to waived: with reason + expires=. " +
+    (counts.expiredWaived > 0
+      ? "An expired waiver is a deferral that ran out: re-judge whether its reason still holds — " +
+        "re-waive with a fresh date only if it does, and never by default."
+      : "")
 );
 process.exit(1);

package/data/harnesses/code/hooks/check-changelog-presence.mjs

@@ -3,15 +3,11 @@
 // judged mechanically: lockfile-only, harness-file-only, pure renames, changelog housekeeping,
 // or a bot author. Exit 1 when a non-exempt HEAD stages no entry.
 
-import { spawnSync } from "node:child_process";
-import path from "node:path";
+import { changelogExemptFile } from "./lib/exempt.mjs";
+import { git as gitAt } from "./lib/repo.mjs";
 
 const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-
-function git(args) {
-  const res = spawnSync("git", args, { cwd: projectDir, encoding: "utf8" });
-  return res.status === 0 ? (res.stdout || "").trim() : null;
-}
+const git = (args) => gitAt(projectDir, args);
 
 const nameStatus = git(["diff-tree", "--root", "--no-commit-id", "--name-status", "-r", "HEAD"]) || "";
 const entries = nameStatus
@@ -22,28 +18,11 @@ const entries = nameStatus
     return { status, file: files[files.length - 1] };
   });
 
-const LOCKFILES = /^(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|bun\.lockb?|Cargo\.lock)$/;
-const HARNESS_PREFIXES = [".claude/", ".agents/", ".codex/"];
-const HARNESS_FILES = [
-  "AGENTS.md",
-  "CLAUDE.md",
-  ".mcp.json",
-  ".vscode/settings.json",
-  ".prettierignore",
-  ".prettierrc.json",
-];
-
-const exemptFile = (f) =>
-  LOCKFILES.test(path.basename(f)) ||
-  HARNESS_PREFIXES.some((p) => f.startsWith(p)) ||
-  HARNESS_FILES.includes(f) ||
-  f.startsWith("docs/history/changelog/") ||
-  f === "docs/history/CHANGELOG.md";
 
 const author = git(["log", "-1", "--format=%an <%ae>"]) || "";
 const isBot = /\[bot\]|actions@github\.com/i.test(author);
 const allRenames = entries.length > 0 && entries.every((e) => e.status.startsWith("R"));
-const allExempt = entries.length === 0 || entries.every((e) => exemptFile(e.file));
+const allExempt = entries.length === 0 || entries.every((e) => changelogExemptFile(e.file));
 const hasEntry = entries.some((e) => e.file.startsWith("docs/history/changelog/") && e.file.endsWith(".md"));
 
 if (isBot || allRenames || allExempt || hasEntry) {

package/data/harnesses/code/hooks/check-completion-integrity.mjs

@@ -8,18 +8,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { frontmatter, field } from "./lib/ownership.mjs";
 import { undischargedRows } from "./lib/ledger.mjs";
+import { readSafe } from "./lib/repo.mjs";
 
 const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const plansDir = path.join(projectDir, "docs", "history", "plans");
 
-function readSafe(file) {
-  try {
-    return fs.readFileSync(file, "utf8");
-  } catch (e) {
-    return "";
-  }
-}
-
 let failures = 0;
 const fail = (msg) => {
   failures += 1;

package/data/harnesses/code/hooks/check-ownership.mjs

@@ -6,14 +6,14 @@
 //                          leaves "most specific wins" unable to pick an owner
 //
 // Either is silenced by an unexpired `waived:` row in docs/operations/bookkeeping.md naming its
-// kind plus the offending glob (dead-glob) or the shared path (ownership-overlap) verbatim.
+// kind plus the offending glob (dead-glob) or the shared path (ownership-overlap) in backticks.
 // Exit 1 on anything unwaived.
 //
 // A glob at strictly HIGHER specificity carving a sub-path out of a broader `**` is the designed
 // layering, not a conflict — only an exact tie is reported.
 
 import { deadGlobs, listRepoFiles, overlaps } from "./lib/ownership.mjs";
-import { readQueue, unexpiredWaivers } from "./lib/state.mjs";
+import { readQueue, waiverCovers } from "./lib/state.mjs";
 
 const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const today = new Date().toISOString().slice(0, 10);
@@ -22,12 +22,10 @@ const files = listRepoFiles(projectDir);
 const queue = readQueue(projectDir);
 
 const dead = deadGlobs(projectDir, files);
-const deadWaivers = unexpiredWaivers(queue, "dead-glob", today);
-const unwaivedDead = dead.filter((d) => !deadWaivers.some((w) => w.body.includes(d.glob)));
+const unwaivedDead = dead.filter((d) => !waiverCovers(queue, "dead-glob", d.glob, today));
 
 const conflicts = overlaps(projectDir, files);
-const overlapWaivers = unexpiredWaivers(queue, "ownership-overlap", today);
-const unwaivedOverlaps = conflicts.filter((c) => !overlapWaivers.some((w) => w.body.includes(c.example)));
+const unwaivedOverlaps = conflicts.filter((c) => !waiverCovers(queue, "ownership-overlap", c.example, today));
 
 if (unwaivedDead.length === 0 && unwaivedOverlaps.length === 0) {
   console.log(
@@ -39,7 +37,7 @@ if (unwaivedDead.length === 0 && unwaivedOverlaps.length === 0) {
 if (unwaivedDead.length > 0) {
   console.error(`check-ownership: ${unwaivedDead.length} unwaived dead owns: glob(s):`);
   for (const d of unwaivedDead) console.error(`  ${d.glob} → ${d.doc}`);
-  console.error("Fix the owning doc's owns: frontmatter, or add a `waived:` dead-glob row with reason + expires=.");
+  console.error("Fix the owning doc's owns: frontmatter, or add a `waived:` dead-glob row naming the glob in backticks, with reason + expires=.");
 }
 
 if (unwaivedOverlaps.length > 0) {
@@ -50,7 +48,7 @@ if (unwaivedOverlaps.length > 0) {
     console.error(`    ${c.b.glob} → ${c.b.doc}`);
   }
   console.error(
-    "Narrow one doc's glob so a single owner wins, or add a `waived:` ownership-overlap row naming the shared path with reason + expires=.",
+    "Narrow one doc's glob so a single owner wins, or add a `waived:` ownership-overlap row naming the shared path in backticks with reason + expires=.",
   );
 }