@nurix/etna 0.20.10 → 0.20.11

package/data/catalog/rules/cloudflare.md

@@ -1,3 +1,11 @@
+---
+paths:
+  - "**/wrangler.*"
+  - "**/.dev.vars*"
+  - "**/worker/**"
+  - "**/workers/**"
+  - "**/src/**/*.ts"
+---
 # Cloudflare Worker
 
 Conventions for Cloudflare Workers — `wrangler.jsonc` setup, vars and secrets, and code shape (dispatch, errors, modules, WebSockets). Schema design doctrine is the `schema-design` skill.

package/data/catalog/rules/database.md

@@ -1,3 +1,13 @@
+---
+paths:
+  - "**/*.sql"
+  - "**/migrations/**"
+  - "**/drizzle/**"
+  - "**/drizzle.config.*"
+  - "**/schema.ts"
+  - "**/schema/**"
+  - "**/db/**"
+---
 # Database
 
 Naming and the fixed column vocabulary for relational schemas in **every** Nurix project — one concept, one name, everywhere. Written for SQLite / Cloudflare D1 + Drizzle; a Postgres project keeps the same column names and semantics with native types (`uuid`, `timestamptz`, `boolean`). **Design doctrine — what earns a table, state vs. logs, junctions, FK policy, uniqueness traps — is the `schema-design` skill; consult it before any schema change.**

package/data/catalog/rules/frontend.md

@@ -1,3 +1,13 @@
+---
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.ts"
+  - "**/*.css"
+  - "**/*.html"
+  - "**/tailwind.config.*"
+  - "**/vite.config.*"
+---
 # Frontend
 
 Tailwind v4 + shadcn-based UI conventions for **web** apps — styling, the `@nurix/components` library, the `design.md` token artifact, and design-skill routing — plus the TypeScript conventions every package compiles under.

package/data/catalog/rules/pnpm.md

@@ -1,3 +1,12 @@
+---
+paths:
+  - "**/package.json"
+  - "**/pnpm-workspace.yaml"
+  - "**/pnpm-lock.yaml"
+  - "**/.npmrc"
+  - "**/tsconfig*.json"
+  - "**/turbo.json"
+---
 # pnpm — `@nurix/*` Workspaces: naming, boundaries, and consuming
 
 How a `@nurix/*` repo is **named**, **structured**, and how its packages are **consumed** — every repo takes the workspace shape, single-package frontends included. Publishing and CLI design live in the `nustack` skill, not here — no `nustack` skill in the runtime ⇒ ask before crossing the publish boundary.

package/data/catalog/rules/react-native.md

@@ -1,3 +1,13 @@
+---
+paths:
+  - "**/app.json"
+  - "**/app.config.*"
+  - "**/eas.json"
+  - "**/metro.config.*"
+  - "**/babel.config.*"
+  - "**/app/**"
+  - "**/*.tsx"
+---
 # React Native + Expo
 
 How mobile apps are built — distilled from a hand-crafted reference app, the gold standard for *style*. The rule is **scale-aware**: a few-screen app takes the lean form, a feature/auth-heavy app the full form; where a section offers both, the graduation trigger is stated.

package/data/catalog/rules/rust-desktop.md

@@ -1,3 +1,11 @@
+---
+paths:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+  - "**/Cargo.lock"
+  - "**/tauri.conf.json"
+  - "**/src-tauri/**"
+---
 # Rust Desktop Apps (Tauri 2)
 
 How native desktop apps are built: a **Rust core + web-frontend** shell — the cargo/JS dual workspace, the Rust↔TS contract seam, native-capability handling, and signed distribution. This rule governs everything on the **Rust and OS side of the webview boundary**; the webview UI is a normal web app, unchanged by being hosted in a webview. Scale-aware: a single-window tool with no native capabilities skips §2's workspace and §4's actor (graduation trigger in §2); a capability-rich app (audio, permissions, background work, sibling processes) takes the full shape.

package/data/catalog/rules/temporal.md

@@ -1,3 +1,12 @@
+---
+paths:
+  - "**/workflows/**"
+  - "**/activities/**"
+  - "**/*.workflow.ts"
+  - "**/*.activity.ts"
+  - "**/worker.ts"
+  - "**/temporal/**"
+---
 # Temporal
 
 Workflow and activity conventions for Temporal-backed services — the determinism boundary, file layout, registration, retry defaults, and starting workflows.

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "0fa183cce9ee",
+    "fingerprint": "7d6e2acfe663",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/CLAUDE.md

@@ -33,14 +33,15 @@ Three peer modes, then a verification gate and a Completion step — enter where
 
 > Brainstorm entry needs a **basis** — a reference document or a one-shot brain dump; drip-sized asks (a bug fix, one button) are too small and get redirected. A **pillar** is a recorded strategic principle from a past brainstorm: in-progress sessions live under `docs/research/`, harvested ones under `docs/history/brainstorms/`, harvested doctrine under `docs/architecture/`. The LLD is the feature doc itself — `docs/features/{feature}.md`, design intent first, extended in place at Completion.
 
-> **Two stops, and only two.** The work between them runs without asking. The **plan pass** ends at a finished plan — written, boundary-checked, amendments folded, both ledgers in place — shown once; a plan that still owes a gate is not finished and is not shown as finished. The **build pass** ends at a discharged gate — the code written, driven, fixed, pinned, every ledger row in its Outcome cell — and stops before the freeze. What the user decides is the gated plan (stop 1) and the freeze-and-commit (stop 2); running a gate is never a question put to the user.
+> **Two stops, and only two.** The work between them runs without asking. The **plan pass** ends at a finished plan — written, boundary-checked, amendments folded, both ledgers in place — shown once; a plan that still owes a gate is not finished and is not shown as finished. The **build pass** ends at a discharged gate — the code written, driven, fixed, pinned, every ledger row in its Outcome cell, the plan's documents certified (`Polygraph:` written) — and stops before the freeze. What the user decides is the gated plan (stop 1) and the freeze-and-commit (stop 2); running a gate is never a question put to the user.
 
 > **The lightweight lane:** a change touching one module, **at most ~10 files, none on a contract-heavy surface** (db schema, wire envelopes, auth, events, env/config — the `boundary` skill's list), and under about **three days'** work skips the modes above entirely — the ad-hoc regime of `.claude/rules/testing.md` applies: make the change, drive it, then pin it in the same unit of work if it alters promised behavior, cover it with a changelog row. The predicate is mechanical; when in doubt, the `boundary` diff scan is the tiebreak, not self-assessment.
 
 **On Plan Completion:**
 
-1. **The verification gate is the tail of the build pass, never a separate ask** **[override]** — the moment the unit's code is written the session opens it: drives the real surface, fixes what driving finds, pins once, discharges. What is the user's call is the freeze and the commit — "commit" / "ship it" triggers step 2, not the gate, which has already run. This keeps the runtime's finish-the-task default inside the build and removes it from the freeze. The gate requires the plan's Test Obligations ledger to exist (proof the plan gates ran) and discharges every row into its **Outcome** cell, driving the real surface before pinning tests — `.claude/rules/testing.md`. A plan with outstanding obligations stays open, whatever the code does.
-2. **Discharge, then freeze — in one edit.** Discharge the Doc Obligations ledger (every row into exactly one outcome: **updated** — the doc now states what the code does; **owes nothing**, with the reason; **blocked** — → a backlog item, so the debt outlives the frozen plan), fill the Completed date, and flip `Status: Complete` **in the same edit**: the flip freezes the file instantly, so anything left for a second edit is unreachable. For each discharged row's doc: flip `status: active` if it was `draft`, extend it in place, and confirm its `owns:` globs against the actual code — the ledger, not memory, says how many docs that is.
+1. **The verification gate is the tail of the build pass, never a separate ask** **[override]** — the moment the unit's code is written the session opens it: drives the real surface, fixes what driving finds, pins once, discharges. What is the user's call is the freeze and the commit — "commit" / "ship it" triggers step 3, not the gates, which have already run. This keeps the runtime's finish-the-task default inside the build and removes it from the freeze. The gate requires the plan's Test Obligations ledger to exist (proof the plan gates ran) and discharges every row into its **Outcome** cell, driving the real surface before pinning tests — `.claude/rules/testing.md`. A plan with outstanding obligations stays open, whatever the code does.
+2. **Certify the documents — the polygraph gate, still inside the build pass.** Once every Doc Obligations row has its outcome, run the `polygraph` skill in gate mode over the docs the plan touched (every row discharged **updated**, plus every `Spec:` doc): claim by claim against the code, corrections applied, and the plan's `Gates:` line rewritten from `Polygraph: pending` to `Polygraph: passed YYYY-MM-DD (…)`. A plan that touched no document writes `Polygraph: owes nothing — {reason}` by hand instead. A plan frozen while the segment still reads `pending` raises a `needs-session:` queue row and fails CI — the gate is a judgment obligation, enforced the same way as the doc ledger, never a wall.
+3. **Discharge, then freeze — in one edit.** Discharge the Doc Obligations ledger (every row into exactly one outcome: **updated** — the doc now states what the code does; **owes nothing**, with the reason; **blocked** — → a backlog item, so the debt outlives the frozen plan), fill the Completed date, and flip `Status: Complete` **in the same edit**: the flip freezes the file instantly, so anything left for a second edit is unreachable. For each discharged row's doc: flip `status: active` if it was `draft`, extend it in place, and confirm its `owns:` globs against the actual code — the ledger, not memory, says how many docs that is.
 3. Record the gate's results in the changelog entry, and confirm every section of `docs/tests/{feature}.md` carries its `Pinned:` trace — the checklist itself is authored at the gate (step 1), not written up afterwards.
 
 **On Brainstorm Close** (when a session ends, not when a plan completes): close + harvest is the skill's `stop` procedure — converge, a user-approved harvest manifest, apply, then a uselessness test; conclusions disperse by scope (architecture docs, decision records, backlog), the record moves from `docs/research/{topic}-brainstorm/` to `docs/history/brainstorms/{topic}/`, and the user decides whether the moved folder is deleted or committed.
@@ -78,6 +79,7 @@ Boundaries are **diagnosed, not documented** — the `boundary` skill derives th
 
 ### Documentation — close the loop
 
+- **When a document's truth is in question — "is this doc still right?", a feature that drifted from its doc, a folder nobody has audited — invoke the `polygraph` skill (audit mode) on that target**: one doc, feature, folder, or code path, never the whole tree by reflex. Docs health (dead globs, lint, placement) is the `maintenance` agent; blast radius is `boundary`.
 - **Invoke the `documentation` skill when creating a doc, or when an edit changes a doc's structure or claims** — apply its templates and `references/style-guide.md`: truth documents stay present-tense; history lives only in `docs/history/` records. Records written from a template already in context (a changelog entry, a backlog row) skip the invocation.
 - **[override]** Keep `docs/` updated when code changes affect documented behavior. This file is the standing request for those docs: creating and updating them is part of the work, even if the runtime defaults to never creating documentation files unprompted.
 - After plan completion **[override]**: write the `docs/history/changelog/` entry as a **draft** immediately, while the context is fresh — no confirmation needed — and append its `docs/history/CHANGELOG.md` row; the commit fills what the draft left open and freezes it. Non-plan work needs no separate prompt: every non-exempt commit carries its own entry (the `changelog` rule).
@@ -130,7 +132,7 @@ The single policy for sub-agent dispatch — when to fan out, at what tier, and
 - **A dispatch is scoped to minutes and read before anything else starts.** One file, one sweep — never a build. The dispatching agent reads the result before moving on, and never leaves a sub-agent as the only thing running while it does something else: a sub-agent's state is invisible until someone looks, so an hour-long dispatch that dies is discovered an hour late, with nothing to show for the hour.
 - **Small or judgment work stays inline.** A task finishable in a handful of tool calls is faster done than briefed. **Never delegate judgment by reflex** — a second opinion is for a high-stakes call or an explicit request.
 - **A delegated result is a report, not verifiable ground truth** — verify load-bearing results directly.
-- **Tiers**: mechanical fan-out → the cheapest capable tier; judgment-heavy delegation → the session's standard tier; the strongest tier **only** on explicit user request. The session itself defaults to the standard tier, entering the strongest only by explicit user switch. Model names live in Runtime Notes.
+- **Tiers**: mechanical fan-out → the cheapest capable tier; judgment-heavy delegation → the session's standard tier; the strongest tier **only** on explicit user request. The session itself defaults to the standard tier, entering the strongest only by explicit user switch. Model names live in Runtime Notes. **A rostered agent whose definition pins `model:` and `effort:` is dispatched at that pin** — the pin is the tier decision, made once at authoring; a skill that dispatches such an agent never re-picks per dispatch, and a session running hot cannot drag it up.
 - **An explicit user directive about tier, cost, or delegation overrides this section.**
 
 ---

package/data/harnesses/code/agents/polygraph-applier.md

@@ -0,0 +1,24 @@
+---
+name: polygraph-applier
+description: Applies one packet of verified polygraph rows to exactly the documents the packet names, re-checking every citation first. Dispatched by the polygraph skill only; never on its own.
+tools: Read, Edit, Write, Grep, Glob, Bash
+model: sonnet
+effort: medium
+maxTurns: 15
+---
+
+# Polygraph applier
+
+You are an APPLIER in a truth audit. You receive the path of a **packet** and the path of its **context pack**. The packet names your editable docs (`doc:` lines) and your rows, with any bounce notes — read them; a bounced row's note says exactly what is wrong and where.
+
+1. Read the pack, then the packet. Each row is quoted in full inside the packet; never open the run's findings file to find your rows.
+2. **Re-check each row's citations against today's tree before editing.** This re-check is the audit's real gate: a claim that does not reproduce resolves `refuted-on-apply`, never as an edit that bends the doc to a stale claim.
+3. Edit **only** the docs your packet names. A fix that belongs in another doc is `needs-cross-doc`, naming that file precisely — your note is how the row is re-routed. Frozen records (completed plans, changelog entries, archived docs) are `exempt-frozen`. A subject awaiting an owner ruling is `blocked-on-question`, no edit.
+4. Style: present tense; no history narration; the repo's unbuilt-marker convention is the only sanctioned qualifier; preserve frontmatter and tooling metadata. Run the repo's doc lint over every doc touched, with repo-root-relative paths, and fix blocking findings.
+5. Write `apply-{doc}.psv` beside the packet — `id|outcome|note`, outcome ∈ `applied` · `needs-cross-doc` · `refuted-on-apply` · `exempt-frozen` · `blocked-on-question` · `skipped`.
+
+**The audit never edits code.** A row whose fix is a source change — a comment, a rename, a bug — is `skipped` with a note for the register; markdown anywhere, package and root READMEs included, is yours. Rulings in the pack outrank every recorded decision.
+
+Tree state: re-check every citation against today's tree before acting. READ-ONLY outside the packet's docs and your outcome file. Read budget: the pack and the packet are your reading list — grep before you read; never read a file over 20 KB without a line range; read a file once; one shell block per question.
+
+Return **at most 120 words**: counts per outcome, docs touched, the lint result, and anything for the register.

package/data/harnesses/code/agents/polygraph-finder.md

@@ -0,0 +1,31 @@
+---
+name: polygraph-finder
+description: Sweeps one document against the code it describes for the polygraph skill — one row per claim, cited, into a partial file. Dispatched by the skill only; never on its own.
+tools: Read, Grep, Glob, Bash, Write
+model: sonnet
+effort: medium
+maxTurns: 25
+---
+
+# Polygraph finder
+
+You are a FINDER in a truth audit. You receive the path of a **context pack** and the path of your **partial file**; the pack is your whole reading list, and the partial is your one write.
+
+Docs state the target design; code is presumed correct unless a standing decision **names** it for retirement — the pack's precedent section decides, and a match means the precedent names your subject (quote the naming words into evidence; a resembling thing is not a match; unsure → QUESTION).
+
+1. Read the pack in full. It names the document, its `owns:` globs resolved to today's files, the precedent quotations, the register rows already tracking this subject, and the rulings that bind.
+2. Read the document once, whole — it is the one file you always read in full. Then check each claim it makes against the code: grep for the mechanism, open the passage with a line range, cite `file:line`.
+3. Write one row per claim to the partial file, **no header**, exactly ten pipe-separated fields: `id|subject|claim|evidence|counter_evidence|verdict|confidence|depends_on|status|resolution`. A literal `|` becomes `¦`, a newline `; `. Verdicts: `COHERENT` (emit at the unit you audited, so coverage is countable) · `MISDESCRIBED` · `UNDOCUMENTED` · `UNBUILT` · `RESIDUE` · `CONTESTED` · `QUESTION`. `id` is `{doc-stem}-NNN`; `status` is `open`; `resolution` is empty; `confidence` is an honest 0–1.
+4. Sweep the other direction once: code inside the `owns:` globs that no claim in the document covers is an `UNDOCUMENTED` row — after the precedent test.
+
+Rules that bind every row:
+
+- **No citation, no row** — `file:line`, or the exact command and its result. Prove or refute; never confirm by plausibility.
+- **A negative claim about a long document quotes the passage you read** — the sentence you believe wrong, or the section where the missing statement should live. Unsupported negative claims are the dominant false-positive class.
+- **An already-tracked finding is skipped** unless your evidence adds something new; cite the register row as `already-registered: path:line` in `counter_evidence`.
+- **A document that should not exist** — its subject gone, its authority absorbed by a sibling — is one `QUESTION` row proposing deletion or merge, with the inbound-reference count.
+- **Rulings in the pack outrank every recorded decision.**
+
+Tree state: re-check every citation against today's tree before writing it. **READ-ONLY everywhere except your partial file.** Read budget: the pack is your reading list — read nothing outside it without naming in your return why the pack was insufficient. Grep before you read; never read a file over 20 KB without a line range; read a file once. Compose one shell block per question, not one call per file — your turn cap is your tool budget.
+
+Return **at most 120 words**: the partial's path, the row count, up to three findings, and limitations. Findings go in the file, never in the return.

package/data/harnesses/code/agents/polygraph-verifier.md

@@ -0,0 +1,20 @@
+---
+name: polygraph-verifier
+description: Blind re-derivation of polygraph claims the primary doubts — claim and subject only, no prior evidence — into a verify file. Dispatched by the polygraph skill only; never on its own.
+tools: Read, Grep, Glob, Bash, Write
+model: sonnet
+effort: low
+maxTurns: 12
+---
+
+# Polygraph verifier
+
+You are a VERIFIER in a truth audit. You receive a **queue file** of items — `id`, `subject`, `claim` — deliberately with no prior evidence, reasoning, or verdict, and the path of your **output file**.
+
+1. Read the queue. For each item, re-derive the claim from the tree: find the mechanism, read the passage with a line range, decide.
+2. Judge each: `CONFIRMED` (true as stated) · `REFUTED` (false) · `ADJUSTED` (true in substance, wrong in a particular — say which). Cite exactly, `file:line`.
+3. Write the output file, one line per item: `id|check|confidence|citations|note`. A literal `|` becomes `¦`.
+
+**A wrong confirmation is worse than an honest REFUTED.** Never infer from the claim's wording what the finder saw; derive from the tree. Read budget: grep before you read; never read a file over 20 KB without a line range; read a file once; one shell block per question. READ-ONLY everywhere except your output file.
+
+Return **at most 120 words**: the file path and counts per check.

package/data/harnesses/code/codex/agents/polygraph-applier.toml

@@ -0,0 +1,21 @@
+# dropped Claude tools: Read, Edit, Write, Grep, Glob, Bash
+name = "polygraph-applier"
+description = "Applies one packet of verified polygraph rows to exactly the documents the packet names, re-checking every citation first. Dispatched by the polygraph skill only; never on its own."
+developer_instructions = '''
+
+# Polygraph applier
+
+You are an APPLIER in a truth audit. You receive the path of a **packet** and the path of its **context pack**. The packet names your editable docs (`doc:` lines) and your rows, with any bounce notes — read them; a bounced row's note says exactly what is wrong and where.
+
+1. Read the pack, then the packet. Each row is quoted in full inside the packet; never open the run's findings file to find your rows.
+2. **Re-check each row's citations against today's tree before editing.** This re-check is the audit's real gate: a claim that does not reproduce resolves `refuted-on-apply`, never as an edit that bends the doc to a stale claim.
+3. Edit **only** the docs your packet names. A fix that belongs in another doc is `needs-cross-doc`, naming that file precisely — your note is how the row is re-routed. Frozen records (completed plans, changelog entries, archived docs) are `exempt-frozen`. A subject awaiting an owner ruling is `blocked-on-question`, no edit.
+4. Style: present tense; no history narration; the repo's unbuilt-marker convention is the only sanctioned qualifier; preserve frontmatter and tooling metadata. Run the repo's doc lint over every doc touched, with repo-root-relative paths, and fix blocking findings.
+5. Write `apply-{doc}.psv` beside the packet — `id|outcome|note`, outcome ∈ `applied` · `needs-cross-doc` · `refuted-on-apply` · `exempt-frozen` · `blocked-on-question` · `skipped`.
+
+**The audit never edits code.** A row whose fix is a source change — a comment, a rename, a bug — is `skipped` with a note for the register; markdown anywhere, package and root READMEs included, is yours. Rulings in the pack outrank every recorded decision.
+
+Tree state: re-check every citation against today's tree before acting. READ-ONLY outside the packet's docs and your outcome file. Read budget: the pack and the packet are your reading list — grep before you read; never read a file over 20 KB without a line range; read a file once; one shell block per question.
+
+Return **at most 120 words**: counts per outcome, docs touched, the lint result, and anything for the register.
+'''

package/data/harnesses/code/codex/agents/polygraph-finder.toml

@@ -0,0 +1,28 @@
+# dropped Claude tools: Read, Grep, Glob, Bash, Write
+name = "polygraph-finder"
+description = "Sweeps one document against the code it describes for the polygraph skill — one row per claim, cited, into a partial file. Dispatched by the skill only; never on its own."
+developer_instructions = '''
+
+# Polygraph finder
+
+You are a FINDER in a truth audit. You receive the path of a **context pack** and the path of your **partial file**; the pack is your whole reading list, and the partial is your one write.
+
+Docs state the target design; code is presumed correct unless a standing decision **names** it for retirement — the pack's precedent section decides, and a match means the precedent names your subject (quote the naming words into evidence; a resembling thing is not a match; unsure → QUESTION).
+
+1. Read the pack in full. It names the document, its `owns:` globs resolved to today's files, the precedent quotations, the register rows already tracking this subject, and the rulings that bind.
+2. Read the document once, whole — it is the one file you always read in full. Then check each claim it makes against the code: grep for the mechanism, open the passage with a line range, cite `file:line`.
+3. Write one row per claim to the partial file, **no header**, exactly ten pipe-separated fields: `id|subject|claim|evidence|counter_evidence|verdict|confidence|depends_on|status|resolution`. A literal `|` becomes `¦`, a newline `; `. Verdicts: `COHERENT` (emit at the unit you audited, so coverage is countable) · `MISDESCRIBED` · `UNDOCUMENTED` · `UNBUILT` · `RESIDUE` · `CONTESTED` · `QUESTION`. `id` is `{doc-stem}-NNN`; `status` is `open`; `resolution` is empty; `confidence` is an honest 0–1.
+4. Sweep the other direction once: code inside the `owns:` globs that no claim in the document covers is an `UNDOCUMENTED` row — after the precedent test.
+
+Rules that bind every row:
+
+- **No citation, no row** — `file:line`, or the exact command and its result. Prove or refute; never confirm by plausibility.
+- **A negative claim about a long document quotes the passage you read** — the sentence you believe wrong, or the section where the missing statement should live. Unsupported negative claims are the dominant false-positive class.
+- **An already-tracked finding is skipped** unless your evidence adds something new; cite the register row as `already-registered: path:line` in `counter_evidence`.
+- **A document that should not exist** — its subject gone, its authority absorbed by a sibling — is one `QUESTION` row proposing deletion or merge, with the inbound-reference count.
+- **Rulings in the pack outrank every recorded decision.**
+
+Tree state: re-check every citation against today's tree before writing it. **READ-ONLY everywhere except your partial file.** Read budget: the pack is your reading list — read nothing outside it without naming in your return why the pack was insufficient. Grep before you read; never read a file over 20 KB without a line range; read a file once. Compose one shell block per question, not one call per file — your turn cap is your tool budget.
+
+Return **at most 120 words**: the partial's path, the row count, up to three findings, and limitations. Findings go in the file, never in the return.
+'''

package/data/harnesses/code/codex/agents/polygraph-verifier.toml

@@ -0,0 +1,17 @@
+# dropped Claude tools: Read, Grep, Glob, Bash, Write
+name = "polygraph-verifier"
+description = "Blind re-derivation of polygraph claims the primary doubts — claim and subject only, no prior evidence — into a verify file. Dispatched by the polygraph skill only; never on its own."
+developer_instructions = '''
+
+# Polygraph verifier
+
+You are a VERIFIER in a truth audit. You receive a **queue file** of items — `id`, `subject`, `claim` — deliberately with no prior evidence, reasoning, or verdict, and the path of your **output file**.
+
+1. Read the queue. For each item, re-derive the claim from the tree: find the mechanism, read the passage with a line range, decide.
+2. Judge each: `CONFIRMED` (true as stated) · `REFUTED` (false) · `ADJUSTED` (true in substance, wrong in a particular — say which). Cite exactly, `file:line`.
+3. Write the output file, one line per item: `id|check|confidence|citations|note`. A literal `|` becomes `¦`.
+
+**A wrong confirmation is worse than an honest REFUTED.** Never infer from the claim's wording what the finder saw; derive from the tree. Read budget: grep before you read; never read a file over 20 KB without a line range; read a file once; one shell block per question. READ-ONLY everywhere except your output file.
+
+Return **at most 120 words**: the file path and counts per check.
+'''

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.14.8",
+  "version": "3.15.1",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -25,5 +25,5 @@
     }
   ],
   "docsRoot": "docs",
-  "digest": "5de54f6b1a71"
+  "digest": "b00642c1a47d"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -36,7 +36,7 @@ import {
 } from "./lib/state.mjs";
 import { readSafe, relIfInside, today, SOURCE_EXT, commandRoot, docsRoot } from "./lib/repo.mjs";
 import { sweepResolvedRows, docLint, hasHeaderComment } from "./lib/sweep.mjs";
-import { listPlans } from "./lib/plans.mjs";
+import { listPlans, polygraphVerdict } from "./lib/plans.mjs";
 import { frozenStatusAtHead } from "./lib/frozen.mjs";
 import { undischargedDocRows } from "./lib/ledger.mjs";
 import { approvedPackages, rejectedPackages } from "./lib/approved.mjs";
@@ -312,7 +312,8 @@ function detectorForFile(projectDir, rel, meta, rows) {
     if (rel.startsWith(`${root}/history/plans/`)) {
       const planText = readSafe(path.join(projectDir, rel));
       resolveRows(projectDir, (row) => row.kind === "needs-session" && row.body.includes(rel));
-      if (/^\*\*Status:\*\*\s*Complete\b/m.test(planText) && undischargedDocRows(planText).length > 0) {
+      const complete = /^\*\*Status:\*\*\s*Complete\b/m.test(planText);
+      if (complete && undischargedDocRows(planText).length > 0) {
         rows.push(
           formatNeedsSessionRow({
             date: meta.date,
@@ -321,6 +322,19 @@ function detectorForFile(projectDir, rel, meta, rows) {
           })
         );
       }
+      // Whether the plan's documents are TRUE is the polygraph skill's judgment, not a hook's — so
+      // the gate's trace (the `Polygraph:` segment of the Gates line) is raised the same way the doc
+      // ledger is: a `needs-session:` row while it reads `pending` on a Complete plan. A plan with no
+      // segment predates the gate or runs under a harness that ships no polygraph — out of contract.
+      if (complete && polygraphVerdict(planText) === "pending") {
+        rows.push(
+          formatNeedsSessionRow({
+            date: meta.date,
+            description: `${rel} reached Status: Complete with its documents uncertified — run the polygraph skill (gate mode) and write its Polygraph: segment`,
+            refs: rel,
+          })
+        );
+      }
     }
     if (rel.startsWith(`${root}/`)) {
       const findings = docLint(projectDir, rel);

package/data/harnesses/code/hooks/lib/plans.mjs

@@ -28,7 +28,16 @@ export function inPlanScope(rel, scope) {
   });
 }
 
-// Every plan in the folder, parsed once: { file, status, gates, scope, hasLedger,
+// The plan's Polygraph gate, read from its Gates line: 'pending' · 'passed' · 'owes nothing' ·
+// null when the line carries no segment (a plan that predates the gate, or a repo whose harness
+// ships no polygraph — both out of contract, both pass).
+export function polygraphVerdict(text) {
+  const gates = (/^\*\*Gates:\*\*\s*(.+)$/m.exec(text || "") || [])[1] || "";
+  const m = /Polygraph:\s*(pending|passed|owes nothing)\b/i.exec(gates);
+  return m ? m[1].toLowerCase() : null;
+}
+
+// Every plan in the folder, parsed once: { file, status, gates, polygraph, scope, hasLedger,
 // hasDocLedger, ledgerRows }. `gates` is null on legacy plans (pre-Gates format).
 export function listPlans(projectDir) {
   const dir = path.join(projectDir, docsRoot(projectDir), "history", "plans");
@@ -47,6 +56,7 @@ export function listPlans(projectDir) {
       file,
       status,
       gates: (/^\*\*Gates:\*\*\s*(.+)$/m.exec(text) || [])[1]?.trim() || null,
+      polygraph: polygraphVerdict(text),
       scope: planScopePaths(text),
       hasLedger: /^##\s+Test Obligations\b/m.test(text),
       hasDocLedger: /^##\s+Doc Obligations\b/m.test(text),

package/data/harnesses/code/rules/cloudflare.md

@@ -1,3 +1,11 @@
+---
+paths:
+  - "**/wrangler.*"
+  - "**/.dev.vars*"
+  - "**/worker/**"
+  - "**/workers/**"
+  - "**/src/**/*.ts"
+---
 # Cloudflare Worker
 
 Conventions for Cloudflare Workers — `wrangler.jsonc` setup, vars and secrets, and code shape (dispatch, errors, modules, WebSockets). Schema design doctrine is the `schema-design` skill.

package/data/harnesses/code/rules/database.md

@@ -1,3 +1,13 @@
+---
+paths:
+  - "**/*.sql"
+  - "**/migrations/**"
+  - "**/drizzle/**"
+  - "**/drizzle.config.*"
+  - "**/schema.ts"
+  - "**/schema/**"
+  - "**/db/**"
+---
 # Database
 
 Naming and the fixed column vocabulary for relational schemas in **every** Nurix project — one concept, one name, everywhere. Written for SQLite / Cloudflare D1 + Drizzle; a Postgres project keeps the same column names and semantics with native types (`uuid`, `timestamptz`, `boolean`). **Design doctrine — what earns a table, state vs. logs, junctions, FK policy, uniqueness traps — is the `schema-design` skill; consult it before any schema change.**

package/data/harnesses/code/rules/frontend.md

@@ -1,3 +1,13 @@
+---
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/*.ts"
+  - "**/*.css"
+  - "**/*.html"
+  - "**/tailwind.config.*"
+  - "**/vite.config.*"
+---
 # Frontend
 
 Tailwind v4 + shadcn-based UI conventions for **web** apps — styling, the `@nurix/components` library, the `design.md` token artifact, and design-skill routing — plus the TypeScript conventions every package compiles under.

package/data/harnesses/code/rules/pnpm.md

@@ -1,3 +1,12 @@
+---
+paths:
+  - "**/package.json"
+  - "**/pnpm-workspace.yaml"
+  - "**/pnpm-lock.yaml"
+  - "**/.npmrc"
+  - "**/tsconfig*.json"
+  - "**/turbo.json"
+---
 # pnpm — `@nurix/*` Workspaces: naming, boundaries, and consuming
 
 How a `@nurix/*` repo is **named**, **structured**, and how its packages are **consumed** — every repo takes the workspace shape, single-package frontends included. Publishing and CLI design live in the `nustack` skill, not here — no `nustack` skill in the runtime ⇒ ask before crossing the publish boundary.

package/data/harnesses/code/skills/documentation/references/instruction-style.md

@@ -4,7 +4,7 @@ The shared style for every file an agent obeys — a `CLAUDE.md`, a rule, an age
 
 ## The test for every line
 
-An instruction file is paid for whenever it loads, scaled by its load class: `CLAUDE.md` and rules load on **every turn of every session** — the most expensive prose in a repo per word; an agent definition loads per dispatch, a skill per invocation. The bar is not "is this true?" but **"must this be in front of the agent whenever this file loads?"** Measure weight in tokens, not lines; trim biggest-first on every edit.
+An instruction file is paid for whenever it loads, scaled by its load class: `CLAUDE.md` and unscoped rules load on **every turn of every session** — the most expensive prose in a repo per word; a `paths:`-scoped rule loads on those same terms from its first matching file read on; an agent definition loads per dispatch, a skill per invocation. The bar is not "is this true?" but **"must this be in front of the agent whenever this file loads?"** Measure weight in tokens, not lines; trim biggest-first on every edit.
 
 **Rewriting, the test is armor vs. narration.** A reason clause either blocks a move an agent would otherwise make — the failure is counter-intuitive, the wrong fix looks correct, or the rule reads as arbitrary tidiness and gets "improved away" — or it explains the self-evident. Ask of each: *does the forbidden move look correct to an agent mid-task?* Keep the first kind, cut the second. **A constraint may lose its explanation; it may never lose its existence** — compression is fewer words for the same constraints, so a passage that cannot shrink without dropping one stays long.
 

package/data/harnesses/code/skills/documentation/templates/plan.md

@@ -8,13 +8,13 @@ The `boundary` skill parses the **Proposed Changes** sections to check boundary
 
 **Doc Obligations is the one ledger the plan's author writes.** Deriving tests from behavior is judgment, which is why `testing` owns that section and it is marked never-hand-author; resolving Proposed Changes' file paths to the feature docs that own them is a **lookup** against the ownership index already injected at session start. Different work, different rule — fill it yourself, while the touch list is fresh.
 
-The **`Gates:`** line carries one machine-read segment. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. Never hand-edit the line to skip a gate.
+The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. **`Polygraph:`** is the completion gate's trace: it reads `Polygraph: pending` from the first draft until the `polygraph` skill (gate mode) certifies the plan's documents — every Doc Obligations row discharged **updated** plus every `Spec:` doc — and rewrites it to `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`. A plan that touched no document writes `Polygraph: owes nothing — {reason}` by hand; nothing else on this segment is ever hand-written. A Complete plan still reading `pending` raises a `needs-session:` queue row and fails CI. Never hand-edit the line to skip a gate.
 
 ```
 # {Feature Name}
 
 **Status:** Draft | In Progress | Complete | Abandoned
-**Gates:** Boundary: pending
+**Gates:** Boundary: pending · Polygraph: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
 **Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete — along with every ledger Outcome cell: the flip freezes the file instantly, so anything left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->

package/data/harnesses/code/skills/polygraph/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: polygraph
+description: "Use when a document's truth is in question — audit a named doc, feature, folder, or code path against the code — and at every plan completion, where gate mode certifies the plan's docs before the freeze. Never the whole tree by reflex; not docs health, boundary, or the verification gate."
+---
+
+# Polygraph — two witnesses, one verdict
+
+Code and docs are two witnesses to the same product, and each lies in its own direction: documents describe designs the code never built, code runs behaviour no document learned. The audit checks a document's claims against the code, presumes the code correct unless a standing decision names it for retirement, corrects the document, registers the code-side findings, and puts to the owner what evidence cannot settle. It runs at two moments and nowhere else:
+
+| Moment | Mode | Ends with |
+| --- | --- | --- |
+| Any time, on a named target — a doc, a feature, a folder of docs, or a code path resolved to its owning docs | **Audit** | the target corrected, code-side rows registered, verdict counts reported |
+| Plan completion — after the verification gate has discharged and the Doc Obligations rows read **updated**, before the freeze | **Gate** | the same, over the plan's docs, plus the plan's `Polygraph:` segment |
+
+You are the **primary**: you hold the conversation, compose every context pack and packet, judge every contested verdict, and write the segment. Agents sweep and apply; a verdict is never delegated, and neither is a word said to the owner.
+
+References — read the routed file in full at the named moment:
+
+| Reference | Load when |
+| --- | --- |
+| `references/rows.md` | writing or reading any row; judging CONTESTED, QUESTION, residue, or a document's right to exist |
+| `references/dispatch.md` | composing a context pack, dispatching any role, packeting, recovering a dead or capped agent, pricing a run |
+
+## Standing rules
+
+1. **Code is presumed correct — unless a standing decision names it.** The precedent pack decides by **naming**: a decision condemns code only when it names the file, table, route, command, or surface by the product's own name for it, and the row quotes the naming words. A resembling thing is not a match; arguable → QUESTION. Documenting undocumented code is the mechanically easiest resolution and quietly canonizes a retiring lane; condemning on a resemblance retires code the product still ships. The full test is `references/rows.md` § The residue guard.
+2. **No citation, no row** — `file:line`, or the exact command and its result. Prove or refute, never confirm by plausibility.
+   **A documented behaviour the code lacks is UNBUILT, never MISDESCRIBED.** The document may be stating the target design; rewriting it to match the code silently abandons that design. Without the repo's unbuilt marker on the passage or a precedent naming the subject, the row is a QUESTION for the owner, and the passage stands until the answer.
+3. **Finders never edit; appliers never judge; the audit never edits code.** A code-side finding leaves as a register row for the planning workflow, however small and however directly it is asked for; a source fix asked for *inside* the audit is refused, registered, and answered with the one thing that would let it happen — a separate ask outside the audit. **Markdown is not source**: every document read may be edited under the applier discipline; frozen records are exempt.
+4. **The applier re-check is the gate.** Every row is re-derived against today's tree before its doc is touched; a claim that fails to reproduce dies as *did not reproduce* and never becomes an edit. This is what lets a row be applied by an agent that never saw the finder's reasoning.
+5. **Rows live on disk, never in your context.** Partials, packets, and outcomes land under `.claude/state/polygraph/{run}/`; you re-read files. The folder is machine-local and you delete it when the run closes — in the same turn as the report, **whatever is still open**: the reply carries every open row in full, an owner's answer starts a new run over those rows only, and the changelog entry of the commit is the record. Nothing under `.claude/state/polygraph/` outlives the reply.
+6. **The owner's answer is applied in the same pass** — verbatim in the doc it settles, quoted in the changelog entry's Ask line. There is no question ledger to park it in.
+
+## The run
+
+Both modes run the same sequence; the modes differ only in how the target list and the closing write are derived.
+
+1. **Resolve the targets.** A doc path is a target; a feature name resolves to `docs/features/{feature}.md`; a folder yields every doc in it; a code path resolves through the injected ownership index to the docs whose `owns:` globs match — or, when no index is in context, by scanning the `owns:` frontmatter under the docs root. A code path with no owner is **reported, never refused** — say which paths are unowned and go on with the rest. A target with no document at all is the one refusal: there is nothing to audit.
+2. **Price it and say so** before dispatching when the target list exceeds ten documents: per-doc cost at the pinned tier, the wave count under the runtime's concurrency ceiling, and the total. An owner directive to run on a stronger tier is priced the same way — state the multiplier and record the directive in the changelog entry.
+3. **Write one context pack per doc** (`references/dispatch.md` § The context pack) — the doc's `owns:` globs, the code paths in question, the precedent quotations that name this subject, the register rows already tracking it, and the owner rulings that bind. The pack is the agent's whole reading list.
+4. **Dispatch one `polygraph-finder` per doc**, in waves under the concurrency ceiling. Each writes its partial to the run folder and returns at most 120 words. A finder that returns **partial** at its turn cap is resumed once from its partial on disk; a second partial is accepted as that doc's sweep and reported as such.
+5. **Merge and check.** Concatenate the partials into `findings.psv`, quarantine malformed lines into `malformed.txt` (kept, never silently repaired), run `scripts/audit.mjs {run}` and fix what it reports by hand.
+6. **Judge.** Read every non-COHERENT row's evidence yourself. CONTESTED rows you judge with both sets of evidence in hand; a row you doubt goes to a `polygraph-verifier` (claim and subject only) and comes back CONTESTED if the two disagree. QUESTION rows — and every proposed deletion, with its inbound count — go to the owner **now, inline**, batched and ranked by how many rows each answer unblocks; work proceeds on everything else while they are open.
+7. **Packet and apply.** One doc, one `polygraph-applier`, always — `audit.mjs` asserts no collision. MISDESCRIBED rows and in-scope UNDOCUMENTED rows that passed the residue guard go to the owning doc's packet; RESIDUE, UNBUILT-abandoned, and every code-side row go to the register (the backlog, in its existing grammar, deduped against what is already there); frozen records resolve `exempt-frozen`. Fold each applier's outcome file into row status by hand, then run `audit.mjs` again.
+8. **Run the repo's doc gates in your own seat** — lint, links, ownership — over every doc touched; a delegated gate that dies reports nothing, which reads exactly like a pass.
+9. **Report** in prose: docs audited, claims checked, corrected, registered, contested-and-judged, questions answered; the refuted-on-apply count is the quality signal, stated every time. Then delete the run folder — also when rows are still open for the owner; they are in the reply.
+
+## Gate mode — the closing write
+
+Gate mode's target list is **every Doc Obligations row discharged as `updated` plus every `Spec:` doc**, and its code scope is the plan's Proposed Changes paths together with those docs' `owns:` globs. It runs after the verification gate and the Doc Obligations discharge, before `Status: Complete` is written — the freeze waits for it, and the harness's completion policy says so. The skill writes the `Polygraph:` segment and nothing else on the plan: the status flip is the author's, in the discharge-then-freeze edit.
+
+Ends by rewriting your own segment of the plan's **`Gates:`** line, exactly:
+
+- `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)` — every target swept, every non-QUESTION row resolved.
+- `Polygraph: owes nothing — {reason}` — written by the plan's **author**, not by you, when the plan has no `Spec:` doc and its Doc Obligations row is `None`, or when the repo's harness ships no polygraph.
+
+A QUESTION the owner has not answered leaves the segment at `pending`; the plan stays open, and the completion machinery says why. Never write `passed` over an open question.
+
+## Economy
+
+The tier is pinned in the three agent definitions — the cheapest capable tier, low to medium effort, a turn cap — never chosen at dispatch. The strong tier's value concentrates in judgment, and every judgment in this skill is yours. Where a role agent is not installed (a runtime whose plugin channel carries skills only), dispatch an independent subagent on the cheapest capable tier with the role's body inline, and say so in the report.
+
+## What this skill is NOT
+
+- **Routine docs health** — stale globs, broken links, structural drift: the `maintenance` agent.
+- **A plan's contract check** — both sides of a boundary for a diff or plan: the `boundary` skill.
+- **Test verification** — proving built behaviour: the `testing` skill.
+- **A whole-tree audit by reflex.** The tree is audited one target at a time, and every plan certifies its own docs; a full sweep is an explicit ask, priced before it runs.
+- **A code editor** — code-side findings exit as register rows (standing rule 3).
+
+If the request is one of these, say so and redirect — don't adapt.

package/data/harnesses/code/skills/polygraph/references/dispatch.md

@@ -0,0 +1,80 @@
+# Dispatch — packs, roles, packets, recovery, price
+
+Load when: composing a context pack, dispatching any role, packeting rows, recovering a dead or turn-capped agent, or pricing a run.
+
+## The run folder
+
+`.claude/state/polygraph/{YYYY-MM-DD-slug}/` — machine-local, never tracked, deleted when the run closes:
+
+```
+partials/{doc}.psv      one per finder — its whole output, no header
+findings.psv            the merge, header first — the working copy
+malformed.txt           quarantined lines, kept
+packets/{doc}.txt       one per applier: `doc: {path}` then row ids and bounce notes
+verify-{group}.psv      id|check|confidence|citations|note
+apply-{doc}.psv         id|outcome|note
+packs/{doc}.md          the context pack each finder and applier reads
+```
+
+Work items pass through files, never through a dispatch call's arguments — a resumed agent may not carry arguments, and one that dies on a missing argument dies before it reads anything.
+
+## The context pack — the agent's whole reading list
+
+One page per target document, written by you before the first dispatch. A brief that sends an agent to the charter, the backlog, the ownership index, or the findings file hands it a 500 KB read to extract 2 KB of fact — and hands the same read to every other agent in the wave. The pack carries the 2 KB:
+
+| Section | Content |
+| --- | --- |
+| Target | the doc path; in gate mode, the plan path and the Proposed Changes paths that intersect this doc's `owns:` |
+| Code | the doc's `owns:` globs, resolved to the files that exist today |
+| Precedent | the quotations from guardrails, accepted decisions, and doctrine that **name** a subject this doc covers — the naming words only, with `path:line` |
+| Already tracked | backlog and register rows that name a subject this doc covers, as `path:line` |
+| Rulings | owner answers that bind this subject, verbatim |
+| Read budget | the two clauses below, verbatim |
+
+The two clauses every pack carries:
+
+> Tree state: re-check every citation against today's tree before acting; a claim that fails to reproduce dies as *did not reproduce* — never becomes an edit. READ-ONLY everywhere except your one output file.
+
+> Read budget: the pack is your reading list — read nothing outside it without naming in your return why the pack was insufficient. Grep before you read; never read a file over 20 KB without a line range; read a file once. Compose one shell block per question, not one call per file.
+
+## The roles
+
+| Role | Agent | Receives | Writes | Returns |
+| --- | --- | --- | --- | --- |
+| Finder | `polygraph-finder` | the pack path, the partial path | `partials/{doc}.psv` — one row per claim, ten fields, no header | ≤ 120 words: the file path, row count, up to three findings, limitations |
+| Verifier | `polygraph-verifier` | a queue of `id`, `subject`, `claim` — no evidence, no verdict | `verify-{group}.psv` | ≤ 120 words: the file path and counts per check |
+| Applier | `polygraph-applier` | the packet path, the pack path | the packet's docs; `apply-{doc}.psv` | ≤ 120 words: counts per outcome, docs touched, lint result, anything for the register |
+
+Each agent definition carries its role's doctrine and its turn cap; a dispatch names the target and the paths and nothing else. **Findings go in the file, never in the return** — every word returned is re-billed on every later turn of the session.
+
+Where the runtime has no such agent installed, dispatch an independent subagent on the cheapest capable tier with the agent file's body pasted in as its brief, and say so in the report.
+
+## Packets — one doc, one applier
+
+Routing is judgment, so you compose packets by hand; `audit.mjs` asserts the one mechanical invariant: **no document appears in two packets** — appliers run in parallel, and two agents in one file silently lose each other's edits.
+
+**Packet by the doc the fix belongs in, not the doc a row's evidence cites.** A row's citations say where the *evidence* lives; the fix usually belongs elsewhere, and a bounced row's `needs-cross-doc` note says exactly where. A row with no derivable doc goes to the owner — never into a packet "to see what the agent makes of it".
+
+By verdict: QUESTION and `depends_on` rows → the owner, inline. CONTESTED → you, with both sets of evidence. RESIDUE, and any row whose subject is a source file — a stale comment included — → the register. Everything else → the owning doc's packet.
+
+## Verification — budgeted by what it caught
+
+- **The applier re-check is the law.** In the proving run it killed more false positives than every other mechanism combined.
+- **Blind re-derivation is discretionary.** Send a row *you* doubt — claim and subject only. As a mandatory stage it refuted nothing: finders' self-doubt is conservative, and the errors live in the confident pile, which is where your own read of the evidence looks. Disagreement makes the row CONTESTED; a verification never overwrites a verdict.
+
+## Fold-back
+
+After each applier returns, its outcomes become row state by your own edit, then `audit.mjs` checks the arithmetic:
+
+- `applied` · `registered` · `exempt-frozen` → `resolved`, the resolution stamped with how.
+- `refuted-on-apply` → `resolved`, resolution `did not reproduce`. A legitimate death; its count is the quality signal you report.
+- `needs-cross-doc` · `blocked-on-question` · `skipped` → stays open — repacket, or hold for the answer.
+- COHERENT rows close when recorded; they carry no work.
+
+## Recovery
+
+**The file on disk is the recovery unit, never the wave.** A dead agent costs its remainder; read what landed and relaunch only that. A finder that returns **partial** at its turn cap is resumed once from its partial — a second partial is accepted as that doc's sweep and named as such in the report. Every dispatch names its output file and a time bound; an agent past its bound with no file is dead — relaunch it, never wait on it, and never let one runaway agent hold the run. Gates — lint, links, ownership — run in your own seat.
+
+## Price
+
+State before dispatching, whenever a run exceeds ten documents or an owner directive names a tier: the per-doc cost at the pinned tier, the wave count under the concurrency ceiling, and the total; for a stronger tier, the multiplier and both totals. The directive and the estimate go in the changelog entry.

package/data/harnesses/code/skills/polygraph/references/rows.md

@@ -0,0 +1,57 @@
+# Rows — the row, the verdicts, the residue guard
+
+Load when: writing or reading any row, judging a CONTESTED or QUESTION row, deciding whether a subject is residue, or ruling on a document's right to exist.
+
+## The row
+
+Pipe-delimited, one row per claim, **ten fields**, header line first. A literal `|` inside text is written `¦`; a newline becomes `; `.
+
+```
+id|subject|claim|evidence|counter_evidence|verdict|confidence|depends_on|status|resolution
+```
+
+| Field | Content |
+| --- | --- |
+| `id` | `{DOC}-{NNN}` — the target document's stem and a running number, unique within the run |
+| `subject` | the stable key — a file, table, route, command, or surface |
+| `claim` | one sentence: what is asserted true or false |
+| `evidence` | verbose support — `file:line` citations or the exact command and its result. **No citation, no row.** A verdict leaning on a precedent quotes the precedent's naming words here |
+| `counter_evidence` | what cuts the other way, including `already-registered: path:line` for a known item |
+| `verdict` | one of the seven below |
+| `confidence` | 0.0–1.0, honest — a signal that tells the primary where to look, never a routing key |
+| `depends_on` | empty, or the owner question the row waits on, as the question's own words in brief |
+| `status` | `open` · `resolved` · `reopened` |
+| `resolution` | how it closed — `applied` · `registered` · `did not reproduce` · `answered` · `exempt-frozen` — empty while open |
+
+**A negative claim about a long document quotes the passage read** — the sentence believed wrong, or the section where the missing statement should live. Unsupported negative claims are the dominant false-positive class, and they concentrate in the longest documents.
+
+## The seven verdicts
+
+| Verdict | Meaning | Disposition |
+| --- | --- | --- |
+| `COHERENT` | doc and code agree — emitted at the audited unit so coverage is countable; closed when recorded | none |
+| `MISDESCRIBED` | the doc is wrong about built behaviour | an applier fixes the doc |
+| `UNDOCUMENTED` | code no doc claims — judged against the precedent pack **first**: condemned code is RESIDUE, never a documentation gap | an applier documents it in the owning doc |
+| `UNBUILT` | a documented design with no code behind it — decided-unbuilt (the repo's marker convention), abandoned, or a document that should die; only the owner distinguishes the last two, so suspecting either makes the row a QUESTION | the marker |
+| `RESIDUE` | code a standing decision condemns by name — running, even load-bearing, and still retiring | a register row, never a doc edit |
+| `CONTESTED` | the evidence conflicts — a verifier and a finder disagree, or a claim has no code to arbitrate and a sibling document says otherwise | the primary judges with both sets of evidence in hand |
+| `QUESTION` | only the owner can resolve it — intent, not evidence, is what is missing | asked inline, answered in the same pass |
+
+A disposition is the verdict's default; where the primary overrides it, the resolution says so. **A verification never overwrites a verdict** — disagreement makes the row CONTESTED.
+
+## The residue guard
+
+Before an UNDOCUMENTED row becomes a doc edit, its subject is tested against the precedent pack — the one place the audit can silently undo the repo's own decisions. The test is **naming**: a precedent matches only when it names the subject — the file, table, route, command, or surface by the product's own name for it — and the row quotes the naming words into `evidence`. A precedent describing a *resembling* thing is not a match; shared adjectives ("legacy", "old export lane") are not a match; a misread pronoun is not a match. Unsure → QUESTION, never a silent RESIDUE.
+
+The asymmetry runs both ways. A missed match resurfaces: the register is owner-read, and an UNDOCUMENTED row that should have been RESIDUE is caught when the owner reads the doc it produced. A false match does not: it retires code the product still ships and withholds its documentation — worse than the disease. When in doubt, ask.
+
+## Frozen records and code
+
+- **Frozen records are exempt** — a completed plan, a changelog entry, an archived document resolves `exempt-frozen`; its claims were true when frozen and the tree does not correct history.
+- **The audit never edits code.** A code-side finding — a bug, a stale source comment, the unbuilt, residue — exits as a register row for the planning workflow, however small the edit and however directly it is asked for. **Markdown is not source**: every document read may be edited under the applier discipline, package and root READMEs included; the line is doc versus code, not proximity to `src/`.
+
+## A document's right to exist
+
+A wholly stale document passes a sentence-by-sentence audit one true sentence at a time, so a finder that reads a document whose subject is gone, whose authority another doc has absorbed, or whose content belongs inside a sibling emits **one QUESTION row proposing deletion or merge**, carrying the inbound-reference count (who links here, which index rows list it, which ownership globs it claims). Deletion is owner-approved, always. An approved deletion removes the file, repoints every inbound reference to the surviving authority, and leaves **no redirect stub** — an annotation, a banner, or a status flag left in the reading path is not a source of truth however carefully the surviving sentences are hedged. A document whose subject survives but whose content is wrong is MISDESCRIBED, not a deletion candidate.
+
+**Abandonment has no marker.** A design decided against is not owed: its claims come **out** of every marker that carried them rather than being reworded inside one, and the document survives as the record of a decision not to build, its status saying so. The tell that this went wrong: a reader finishes the paragraph still expecting the feature.

package/data/harnesses/code/skills/polygraph/scripts/audit.mjs

@@ -0,0 +1,113 @@
+// skills/polygraph/scripts/audit.mjs - The audit's one script, and it is READ-ONLY: it validates
+// the run's findings file, cross-checks verifier and applier outcome files against the rows, and
+// asserts the packet-collision invariant. It never writes a byte — the primary holds the pen;
+// this holds the arithmetic. A checker that is wrong emits a wrong warning; a script that acted
+// on its own verdicts could destroy a refutation with no tally, which is the defect class this
+// replaces.
+//
+// Usage: node audit.mjs <run-dir>     (the run folder holding findings.psv)
+// Exit:  0 clean · 1 findings to read · 2 unusable input
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const HEADER = 'id|subject|claim|evidence|counter_evidence|verdict|confidence|depends_on|status|resolution';
+const FIELDS = HEADER.split('|').length; // 10
+const VERDICTS = new Set(['COHERENT', 'MISDESCRIBED', 'UNDOCUMENTED', 'UNBUILT', 'RESIDUE', 'CONTESTED', 'QUESTION']);
+const STATUSES = new Set(['open', 'resolved', 'reopened']);
+const RESOLVING = new Set(['applied', 'exempt-frozen', 'refuted-on-apply']);
+const STAYING = new Set(['needs-cross-doc', 'blocked-on-question', 'skipped']);
+const CHECKS = new Set(['CONFIRMED', 'REFUTED', 'ADJUSTED']);
+
+const run = process.argv[2];
+if (!run || !existsSync(run) || !statSync(run).isDirectory()) { console.error('usage: node audit.mjs <run-dir>'); process.exit(2); }
+const findingsPath = join(run, 'findings.psv');
+if (!existsSync(findingsPath)) { console.error(`no findings file at ${findingsPath}`); process.exit(2); }
+
+const problems = [];   // schema violations and cross-check disagreements → exit 1
+const notes = [];      // informational — never fails the run
+
+// ---- parse + validate the working file -------------------------------------------------------
+const lines = readFileSync(findingsPath, 'utf8').split('\n');
+if (lines[0].trim() !== HEADER) { console.error(`bad or missing header line in ${findingsPath}`); process.exit(2); }
+
+const rows = new Map(); // id → { verdict, status, resolution, line }
+for (let n = 1; n < lines.length; n++) {
+  const line = lines[n];
+  if (!line.trim()) continue;
+  const p = line.split('|');
+  const at = `line ${n + 1}`;
+  if (p.length !== FIELDS) { problems.push(`${at}: ${p.length} fields, expected ${FIELDS}`); continue; }
+  const [id, , claim, evidence, , verdict, confidence, , status, resolution] = p;
+  if (!id.trim()) { problems.push(`${at}: empty id`); continue; }
+  if (rows.has(id)) problems.push(`${at} (${id}): duplicate id — first seen at line ${rows.get(id).line}`);
+  if (!VERDICTS.has(verdict)) problems.push(`${at} (${id}): unknown verdict "${verdict}"`);
+  const conf = Number(confidence);
+  if (!(conf >= 0 && conf <= 1)) problems.push(`${at} (${id}): confidence "${confidence}" outside 0..1`);
+  if (!STATUSES.has(status)) problems.push(`${at} (${id}): unknown status "${status}"`);
+  if (status === 'resolved' && !resolution.trim())
+    problems.push(`${at} (${id}): resolved with an empty resolution — how did it close?`);
+  if (!claim.trim() || !evidence.trim())
+    problems.push(`${at} (${id}): empty ${!claim.trim() ? 'claim' : 'evidence'} — no citation, no row`);
+  rows.set(id, { verdict, status, resolution, line: n + 1 });
+}
+
+// ---- cross-check outcome files against row status --------------------------------------------
+const files = readdirSync(run).filter((f) => f.endsWith('.psv'));
+
+// apply-*.psv → id|outcome|note
+for (const f of files.filter((f) => f.startsWith('apply-'))) {
+  for (const line of readFileSync(join(run, f), 'utf8').split('\n')) {
+    if (!line.trim()) continue;
+    const [id, outcome] = line.split('|').map((s) => (s ?? '').trim());
+    const row = rows.get(id);
+    if (!row) { problems.push(`${f}: outcome for unknown row "${id}"`); continue; }
+    if (!RESOLVING.has(outcome) && !STAYING.has(outcome)) { problems.push(`${f} (${id}): unknown outcome "${outcome}"`); continue; }
+    if (RESOLVING.has(outcome) && row.status === 'open')
+      problems.push(`${f} (${id}): outcome "${outcome}" but the row is still open — the fold missed it`);
+  }
+}
+
+// verify-*.psv → id|check|confidence|citations|note ; disagreement across files is a finding
+const seenChecks = new Map(); // id → { check, file }
+for (const f of files.filter((f) => f.startsWith('verify-'))) {
+  for (const line of readFileSync(join(run, f), 'utf8').split('\n')) {
+    if (!line.trim()) continue;
+    const [id, check] = line.split('|').map((s) => (s ?? '').trim());
+    const row = rows.get(id);
+    if (!row) { problems.push(`${f}: verification of unknown row "${id}"`); continue; }
+    if (!CHECKS.has(check)) { problems.push(`${f} (${id}): unknown check "${check}" — CONFIRMED/REFUTED/ADJUSTED only`); continue; }
+    const earlier = seenChecks.get(id);
+    if (earlier && earlier.check !== check)
+      problems.push(`${id}: two verifiers disagree — ${earlier.check} in ${earlier.file}, ${check} in ${f} → the row is CONTESTED, judge it`);
+    else seenChecks.set(id, { check, file: f });
+    if (check === 'REFUTED' && row.verdict !== 'CONTESTED' && row.status !== 'reopened')
+      notes.push(`${id}: a verifier REFUTED this row and it is neither CONTESTED nor reopened — judged already, or missed?`);
+  }
+}
+
+// packets/*.txt → `doc: path` lines; no doc in two packets
+const packetsDir = join(run, 'packets');
+if (existsSync(packetsDir)) {
+  const claims = new Map(); // doc → packet file
+  for (const f of readdirSync(packetsDir).filter((f) => f.endsWith('.txt'))) {
+    for (const line of readFileSync(join(packetsDir, f), 'utf8').split('\n')) {
+      const m = /^doc:\s*(.+)$/.exec(line.trim());
+      if (!m) continue;
+      const doc = m[1].trim();
+      if (claims.has(doc)) problems.push(`packets: "${doc}" claimed by both ${claims.get(doc)} and ${f} — two appliers in one file lose edits`);
+      else claims.set(doc, f);
+    }
+  }
+}
+
+// ---- report -----------------------------------------------------------------------------------
+const total = rows.size;
+const resolved = [...rows.values()].filter((r) => r.status === 'resolved').length;
+const hist = {};
+for (const r of rows.values()) hist[r.verdict] = (hist[r.verdict] || 0) + 1;
+console.log(`rows: ${total} · resolved: ${resolved} · open: ${total - resolved}`);
+console.log(`verdicts: ${Object.entries(hist).map(([k, v]) => `${k} ${v}`).join(' · ') || 'none'}`);
+for (const n of notes) console.log(`~ ${n}`);
+for (const p of problems) console.log(`✗ ${p}`);
+console.log(problems.length ? `${problems.length} finding(s) to read` : 'clean');
+process.exit(problems.length ? 1 : 0);

package/data/harnesses/delivery/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -10,5 +10,5 @@
   "seeds": [],
   "tools": [],
   "docsRoot": "docs",
-  "digest": "e7b3bec5e759"
+  "digest": "688776066c84"
 }

package/data/harnesses/delivery/skills/documentation/references/instruction-style.md

@@ -4,7 +4,7 @@ The shared style for every file an agent obeys — a `CLAUDE.md`, a rule, an age
 
 ## The test for every line
 
-An instruction file is paid for whenever it loads, scaled by its load class: `CLAUDE.md` and rules load on **every turn of every session** — the most expensive prose in a repo per word; an agent definition loads per dispatch, a skill per invocation. The bar is not "is this true?" but **"must this be in front of the agent whenever this file loads?"** Measure weight in tokens, not lines; trim biggest-first on every edit.
+An instruction file is paid for whenever it loads, scaled by its load class: `CLAUDE.md` and unscoped rules load on **every turn of every session** — the most expensive prose in a repo per word; a `paths:`-scoped rule loads on those same terms from its first matching file read on; an agent definition loads per dispatch, a skill per invocation. The bar is not "is this true?" but **"must this be in front of the agent whenever this file loads?"** Measure weight in tokens, not lines; trim biggest-first on every edit.
 
 **Rewriting, the test is armor vs. narration.** A reason clause either blocks a move an agent would otherwise make — the failure is counter-intuitive, the wrong fix looks correct, or the rule reads as arbitrary tidiness and gets "improved away" — or it explains the self-evident. Ask of each: *does the forbidden move look correct to an agent mid-task?* Keep the first kind, cut the second. **A constraint may lose its explanation; it may never lose its existence** — compression is fewer words for the same constraints, so a passage that cannot shrink without dropping one stays long.
 

package/data/harnesses/delivery/skills/documentation/templates/plan.md

@@ -8,13 +8,13 @@ The `boundary` skill parses the **Proposed Changes** sections to check boundary
 
 **Doc Obligations is the one ledger the plan's author writes.** Deriving tests from behavior is judgment, which is why `testing` owns that section and it is marked never-hand-author; resolving Proposed Changes' file paths to the feature docs that own them is a **lookup** against the ownership index already injected at session start. Different work, different rule — fill it yourself, while the touch list is fresh.
 
-The **`Gates:`** line carries one machine-read segment. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. Never hand-edit the line to skip a gate.
+The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. **`Polygraph:`** is the completion gate's trace: it reads `Polygraph: pending` from the first draft until the `polygraph` skill (gate mode) certifies the plan's documents — every Doc Obligations row discharged **updated** plus every `Spec:` doc — and rewrites it to `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`. A plan that touched no document writes `Polygraph: owes nothing — {reason}` by hand; nothing else on this segment is ever hand-written. A Complete plan still reading `pending` raises a `needs-session:` queue row and fails CI. Never hand-edit the line to skip a gate.
 
 ```
 # {Feature Name}
 
 **Status:** Draft | In Progress | Complete | Abandoned
-**Gates:** Boundary: pending
+**Gates:** Boundary: pending · Polygraph: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
 **Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete — along with every ledger Outcome cell: the flip freezes the file instantly, so anything left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->

package/data/harnesses/etna/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.5.18",
+  "version": "1.5.19",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -10,5 +10,5 @@
   "seeds": [],
   "tools": [],
   "docsRoot": "docs",
-  "digest": "8627c15bbc62"
+  "digest": "4cf950471dd8"
 }

package/data/harnesses/etna/skills/documentation/references/instruction-style.md

@@ -4,7 +4,7 @@ The shared style for every file an agent obeys — a `CLAUDE.md`, a rule, an age
 
 ## The test for every line
 
-An instruction file is paid for whenever it loads, scaled by its load class: `CLAUDE.md` and rules load on **every turn of every session** — the most expensive prose in a repo per word; an agent definition loads per dispatch, a skill per invocation. The bar is not "is this true?" but **"must this be in front of the agent whenever this file loads?"** Measure weight in tokens, not lines; trim biggest-first on every edit.
+An instruction file is paid for whenever it loads, scaled by its load class: `CLAUDE.md` and unscoped rules load on **every turn of every session** — the most expensive prose in a repo per word; a `paths:`-scoped rule loads on those same terms from its first matching file read on; an agent definition loads per dispatch, a skill per invocation. The bar is not "is this true?" but **"must this be in front of the agent whenever this file loads?"** Measure weight in tokens, not lines; trim biggest-first on every edit.
 
 **Rewriting, the test is armor vs. narration.** A reason clause either blocks a move an agent would otherwise make — the failure is counter-intuitive, the wrong fix looks correct, or the rule reads as arbitrary tidiness and gets "improved away" — or it explains the self-evident. Ask of each: *does the forbidden move look correct to an agent mid-task?* Keep the first kind, cut the second. **A constraint may lose its explanation; it may never lose its existence** — compression is fewer words for the same constraints, so a passage that cannot shrink without dropping one stays long.
 

package/data/harnesses/etna/skills/documentation/templates/plan.md

@@ -8,13 +8,13 @@ The `boundary` skill parses the **Proposed Changes** sections to check boundary
 
 **Doc Obligations is the one ledger the plan's author writes.** Deriving tests from behavior is judgment, which is why `testing` owns that section and it is marked never-hand-author; resolving Proposed Changes' file paths to the feature docs that own them is a **lookup** against the ownership index already injected at session start. Different work, different rule — fill it yourself, while the touch list is fresh.
 
-The **`Gates:`** line carries one machine-read segment. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. Never hand-edit the line to skip a gate.
+The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. **`Polygraph:`** is the completion gate's trace: it reads `Polygraph: pending` from the first draft until the `polygraph` skill (gate mode) certifies the plan's documents — every Doc Obligations row discharged **updated** plus every `Spec:` doc — and rewrites it to `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`. A plan that touched no document writes `Polygraph: owes nothing — {reason}` by hand; nothing else on this segment is ever hand-written. A Complete plan still reading `pending` raises a `needs-session:` queue row and fails CI. Never hand-edit the line to skip a gate.
 
 ```
 # {Feature Name}
 
 **Status:** Draft | In Progress | Complete | Abandoned
-**Gates:** Boundary: pending
+**Gates:** Boundary: pending · Polygraph: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
 **Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete — along with every ledger Outcome cell: the flip freezes the file instantly, so anything left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/etna",
-  "version": "0.20.10",
+  "version": "0.20.11",
   "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
   "type": "module",
   "bin": {
@@ -42,5 +42,5 @@
     "agent",
     "plugin"
   ],
-  "etnaFingerprint": "0fa183cce9ee"
+  "etnaFingerprint": "7d6e2acfe663"
 }