@nurix/etna 0.20.11 → 0.20.13

package/data/catalog/rules/testing.md

@@ -60,7 +60,7 @@ Test packages install at `latest` — outside the approved-packages pin set. Fak
 
 - **Suite, not scripts.** Tests live in the canonical test tree — `tests/` mirroring `src/`, or the convention the repo already uses — named `<subject>.test.ts`; shared fixtures, factories, and helpers in `tests/helpers/` (or the suite's existing shared home).
 - **Wire the canonical command.** `"test"` in `package.json` runs the whole unit suite (`vitest run`); e2e under `"test:e2e"`. A repo where `pnpm test` / `npm test` doesn't run the suite is misconfigured — fix the wiring, **never** route around it.
-- **Unit and E2E trees stay separate.** Vitest/Jest suites in `tests/`; Playwright/Maestro suites in `e2e/` with their own config — **never** mixed into the unit runner's glob.
+- **Unit and E2E trees stay separate.** Vitest/Jest suites in `tests/`; Playwright/Maestro suites in `e2e/` with their own config — **never** mixed into the unit runner's glob. The e2e config **owns its world** — it builds, seeds, and boots the app itself (a `webServer` block or equivalent), so a journey passes from a cold shell like any other test and "the world was not running" is never why one did not run.
 - **The real-renderer stratum is a third tree** — `tests/rendered/` under the unit runner's *browser mode*, its own config, kept to geometry regressions that shipped and the composition assertions a component library cannot make alone. It is not a second component suite; anything a simulated DOM can prove stays in `tests/component/`.
 - **No test doubles for what you own.** Prefer real instances — in-memory SQLite for drizzle, the actual Express app via `supertest` — over mocks; mock **only** true externals (network via `msw`, time via the runner's fake timers).
 - **Determinism.** No real network, no real time, no shared mutable state between tests; every test **must** pass alone, in any order, **and from a cold shell** — never against a hand-started dev server (Workers: `@cloudflare/vitest-pool-workers`; Express: `supertest` against the app instance).

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "7d6e2acfe663",
+    "fingerprint": "0eb49820003e",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/CLAUDE.md

@@ -35,6 +35,8 @@ Three peer modes, then a verification gate and a Completion step — enter where
 
 > **Two stops, and only two.** The work between them runs without asking. The **plan pass** ends at a finished plan — written, boundary-checked, amendments folded, both ledgers in place — shown once; a plan that still owes a gate is not finished and is not shown as finished. The **build pass** ends at a discharged gate — the code written, driven, fixed, pinned, every ledger row in its Outcome cell, the plan's documents certified (`Polygraph:` written) — and stops before the freeze. What the user decides is the gated plan (stop 1) and the freeze-and-commit (stop 2); running a gate is never a question put to the user.
 
+> **A build graph overrides all of this, and most sessions never see one.** When `.claude/state/graph.json` exists, a walker decides which document is produced next and when the run is finished: a write reconciles it, an injected line names the next node, and the turn cannot end while the graph can still advance. Produce the file the line names. Never edit the graph or its state — both are refused — and never rewrite a node that has already landed. No such file ⇒ nothing in this paragraph is running.
+
 > **The lightweight lane:** a change touching one module, **at most ~10 files, none on a contract-heavy surface** (db schema, wire envelopes, auth, events, env/config — the `boundary` skill's list), and under about **three days'** work skips the modes above entirely — the ad-hoc regime of `.claude/rules/testing.md` applies: make the change, drive it, then pin it in the same unit of work if it alters promised behavior, cover it with a changelog row. The predicate is mechanical; when in doubt, the `boundary` diff scan is the tiebreak, not self-assessment.
 
 **On Plan Completion:**
@@ -71,7 +73,7 @@ Boundaries are **diagnosed, not documented** — the `boundary` skill derives th
 
 ### Test obligations — specify before implementing
 
-**Then, still in the plan pass, invoke the `testing` skill (plan-gate mode)** — after `boundary`'s amendments are folded, ordered second. It derives the tests the plan owes from its Proposed Changes and the owning LLD, and writes the **Test Obligations** ledger into the plan (one row per promised behavior: layer · target file · oracle · fixtures · an empty **Outcome** cell the verification gate fills). It writes no test files — the ledger is what the verification gate discharges, and because it lives in the plan file it survives dispatch to an executor that sees only the plan. On a boundary **BLOCK** it does not run — re-plan first. Layer rules and the e2e altitude gate live in the skill. **The Doc Obligations table is the author's, filled in the same pass** — a lookup against the ownership index, not a skill run; the hook blocks implementation edits while either section is missing.
+**Then, still in the plan pass, invoke the `testing` skill (plan-gate mode)** — after `boundary`'s amendments are folded, ordered second. It derives the tests the plan owes from its Proposed Changes and the owning LLD, and writes the **Test Obligations** ledger into the plan (one row per promised behavior: layer · target file · oracle · fixtures · an empty **Outcome** cell the verification gate fills). It writes no test files — the ledger is what the verification gate discharges, and because it lives in the plan file it survives dispatch to an executor that sees only the plan. On a boundary **BLOCK** it does not run — re-plan first. Layer rules live in the skill — on a rendered surface every user-observable promise is owed as its surface's journey, and component tests are residual. **The Doc Obligations table is the author's, filled in the same pass** — a lookup against the ownership index, not a skill run; the hook blocks implementation edits while either section is missing.
 
 ### Verification — prove before completing
 

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.15.1",
+  "version": "3.16.1",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -25,5 +25,5 @@
     }
   ],
   "docsRoot": "docs",
-  "digest": "b00642c1a47d"
+  "digest": "3a8ab65bd90f"
 }

package/data/harnesses/code/hooks/build-graph.mjs

@@ -0,0 +1,64 @@
+// harness/code/hooks/build-graph.mjs — the build-graph walker's Claude Code adapter (PostToolUse).
+//
+// A file was written. Reconcile the declared paths against the disk, and if the graph can now
+// advance, tell the model what to produce next. That is the whole job: the deciding lives in
+// `lib/graph.mjs`, the reading and writing in `lib/graph-store.mjs`, and this file is the six
+// lines that turn a hook payload into a call and a call into stdout.
+//
+// PostToolUse only. The Stop side of the walker lives in `compliance.mjs`, because the runtime
+// runs every hook of an event in parallel — two Stop hooks that both block leave which reason
+// the model sees up to a race, and the walker's `mode.walls` already needs compliance to read
+// the graph.
+//
+// DORMANT BY ABSENCE: no `.claude/state/graph.json` ⇒ this prints nothing, writes nothing, and
+// creates no state. Every harness install ships it; only a run that was handed a graph notices.
+
+import fs from "node:fs";
+import path from "node:path";
+import { readStdin, resolveProjectDir } from "./lib/ownership.mjs";
+import { afterWrite } from "./lib/graph-store.mjs";
+
+function main() {
+  const raw = readStdin();
+  let payload = {};
+  try {
+    payload = raw ? JSON.parse(raw) : {};
+  } catch (e) {
+    payload = {};
+  }
+  if (payload.hook_event_name && payload.hook_event_name !== "PostToolUse") return;
+
+  const projectDir = resolveProjectDir(payload);
+  const step = afterWrite(projectDir);
+  if (!step) return; // dormant
+
+  // An invalid graph is never a silent no-op. The Stop wall blocks on the same reason, so a run
+  // handed a broken graph hears about it twice rather than generating in the dark.
+  const context = step.refusal
+    ? `BUILD GRAPH REFUSED — \`.claude/state/graph.json\` exists but ${step.refusal}. Nothing is being steered: fix the graph or remove it. The walker is dormant only when the file is ABSENT, never when it is wrong.`
+    : step.line;
+  if (!context) return;
+
+  process.stdout.write(
+    JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: context } })
+  );
+}
+
+try {
+  main();
+} catch (e) {
+  // Fail open, and leave a trace: a walker that crashes must not take the session with it, but a
+  // walker that stopped steering silently is a run nobody knows went unguided.
+  try {
+    const dir = path.join(process.env.CLAUDE_PROJECT_DIR || process.cwd(), ".claude", "state");
+    fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(path.join(dir, "hook-failures.log"), `${new Date().toISOString()} build-graph.mjs ${e?.message || e}\n`);
+  } catch (e2) {
+    /* truly nowhere to write — fail open stays absolute */
+  }
+} finally {
+  // NEVER process.exit() here. Node does not flush pending async stdout writes on exit, so an
+  // injection larger than the pipe buffer is severed mid-write and arrives as unparseable JSON —
+  // which reads downstream as "no steer" rather than as an error. (awareness.mjs, same note.)
+  process.exitCode = 0;
+}

package/data/harnesses/code/hooks/compliance.mjs

@@ -24,6 +24,38 @@ import { undischargedRows } from "./lib/ledger.mjs";
 import { appendEvent, unresolvedDenials, sessionLogPath, malformedEventLines } from "./lib/session-log.mjs";
 import { approvedPackages, rejectedPackages } from "./lib/approved.mjs";
 import { claimActivity, releaseActivity, recentForeignTouches } from "./lib/claims.mjs";
+import { atStop, graphDenial, wallsAllowlist } from "./lib/graph-store.mjs";
+import { WALLS, wallEnabled } from "./lib/walls.mjs";
+
+// --- the build graph's switch ------------------------------------------------------------
+// A run handed a build graph (docs/harness/code/build-graph.md) may declare `mode.walls`, an
+// allowlist over lib/walls.mjs. Every wall it does not name is off for that session — because
+// the compliance set assumes a session that can dispatch a bookkeeper and a user who can answer
+// an ask, and a generation box has neither: its walls would be unresolvable blocks, not guard
+// rails. No graph, or a graph with no `mode` block, leaves every wall exactly as it was.
+let allowlistCache;
+function wallOn(projectDir, name) {
+  if (allowlistCache === undefined) {
+    try {
+      allowlistCache = wallsAllowlist(projectDir);
+    } catch (e) {
+      allowlistCache = null; // a broken graph never switches a wall off
+    }
+  }
+  return wallEnabled(allowlistCache, name);
+}
+
+// The graph's own wall: a landed node is written once, and the graph and its state are machinery.
+// It answers with decision("deny", …) and NEVER deny() — a steer is not a failure, and a logged
+// denial in a generation box would need a `resolved` line nobody is there to write.
+function graphGate(projectDir, rel) {
+  try {
+    const reason = graphDenial(projectDir, rel);
+    return reason ? decision("deny", reason) : null;
+  } catch (e) {
+    return null; // the walker never becomes an outage
+  }
+}
 
 function decision(permissionDecision, reason) {
   return {
@@ -63,7 +95,7 @@ function protectedPaths(projectDir) {
 }
 
 function fileGate(projectDir, rel, sessionId) {
-  const frozen = frozenStatusAtHead(projectDir, rel);
+  const frozen = wallOn(projectDir, "frozen-record") ? frozenStatusAtHead(projectDir, rel) : { frozen: false };
   if (frozen.frozen) {
     return deny(
       projectDir,
@@ -74,15 +106,22 @@ function fileGate(projectDir, rel, sessionId) {
     );
   }
 
-  if (protectedPaths(projectDir).includes(rel)) {
+  if (wallOn(projectDir, "protected-file") && protectedPaths(projectDir).includes(rel)) {
     return deny(projectDir, sessionId, "protected-file", rel, `BLOCKED — protected file. \`${rel}\` is on the protected list.`);
   }
 
+  // Before the claim ask and outside the plan gate's `inDocs` skip — the graph's own files live
+  // under .claude/, which that branch deliberately excludes.
+  const graphWall = graphGate(projectDir, rel);
+  if (graphWall) return graphWall;
+
   // The file half of the claim board: a path another LIVE session touched minutes ago belongs to
   // someone else right now. Advisory by design — one ask per sibling per session, never a wall —
   // this is the presence protocol ("git status archaeology") moved into the gate that fires anyway.
   try {
-    const holder = recentForeignTouches(projectDir, sessionId).find((f) => f.paths.some((p) => p.rel === rel));
+    const holder = wallOn(projectDir, "foreign-claim")
+      ? recentForeignTouches(projectDir, sessionId).find((f) => f.paths.some((p) => p.rel === rel))
+      : null;
     if (holder) {
       const recent = holder.paths.find((p) => p.rel === rel);
       appendEvent(projectDir, sessionId, "coord", "file-claim", rel, `touched ${recent.ageMin}m ago by sid=${holder.sid8}`);
@@ -99,7 +138,7 @@ function fileGate(projectDir, rel, sessionId) {
   }
 
   const inDocs = rel.startsWith(`${docsRoot(projectDir)}/`) || rel.startsWith(".claude/") || rel.endsWith(".md");
-  if (!inDocs && SOURCE_EXT.test(rel)) {
+  if (!inDocs && SOURCE_EXT.test(rel) && wallOn(projectDir, "plan-gate")) {
     for (const plan of openGatedPlans(projectDir)) {
       // The gate binds the plan's own paths, so disjoint plans run in parallel.
       // A scopeless plan stays repo-wide — fail closed.
@@ -167,7 +206,7 @@ function commitGate(projectDir, sessionId) {
     .filter(Boolean);
   const allRenames = nameStatus.length > 0 && nameStatus.every((line) => line.startsWith("R"));
   const root = docsRoot(projectDir);
-  if (staged.length > 0 && !stagedExempt(projectDir, staged) && !allRenames) {
+  if (wallOn(projectDir, "changelog") && staged.length > 0 && !stagedExempt(projectDir, staged) && !allRenames) {
     if (!staged.some((f) => f.startsWith(`${root}/history/changelog/`))) {
       return deny(
         projectDir,
@@ -184,7 +223,9 @@ function commitGate(projectDir, sessionId) {
   // action that clears it. The read goes through `liveRows` first: a gate tests conditions at gate
   // time, never a cached record of them — a row whose condition died since the last sweep must not
   // wall anything. Pure by design; the detector's next sweep deletes what this filtered out.
-  const { blocking, unrelated } = rowsBlockingCommit(liveRows(projectDir, readQueue(projectDir)), staged);
+  const { blocking, unrelated } = wallOn(projectDir, "bookkeeping")
+    ? rowsBlockingCommit(liveRows(projectDir, readQueue(projectDir)), staged)
+    : { blocking: [], unrelated: [] };
   if (blocking.length > 0) {
     const shown = blocking.slice(0, 8);
     const lines = shown.map(({ row, hits }) =>
@@ -221,6 +262,7 @@ function commitGate(projectDir, sessionId) {
 const PKG_SPEC = /^(@[a-z0-9~-][\w.-]*\/)?[a-z0-9~-][\w.-]*(@[\w.^~*<>=|x-]+)?$/;
 
 function packageGate(projectDir, command, sessionId) {
+  if (!wallOn(projectDir, "package-table")) return null;
   const m = new RegExp(
     String.raw`(?:^|\n|&&|;|\|)\s*(?:sudo\s+)?(?:pnpm|npm|yarn|bun)\s+(?:add|install|i)(?=\s|$)([^&;|\n]*)`
   ).exec(command);
@@ -288,6 +330,7 @@ function bashGate(projectDir, command, sessionId) {
   if (!command) return null;
 
   if (statement(String.raw`git\s+commit\b`).test(command)) {
+    if (!wallOn(projectDir, "commit-claim")) return commitGate(projectDir, sessionId);
     // The claim board serializes the commit sequence: disjoint files do not make disjoint
     // commits — every session writes the same branch through the same index, so one committer
     // at a time. A held claim is a plain wait (no denied/resolved pair to resolve — the retry
@@ -313,7 +356,7 @@ function bashGate(projectDir, command, sessionId) {
   }
 
   // `git branch <name>` creates; flag-led forms (--show-current, --list, -d, -vv) query or manage
-  if (statement(String.raw`git\s+(checkout\s+-b|switch\s+-c|branch\s+(?!-)\S+|worktree\s+add)`).test(command)) {
+  if (wallOn(projectDir, "branch-worktree") && statement(String.raw`git\s+(checkout\s+-b|switch\s+-c|branch\s+(?!-)\S+|worktree\s+add)`).test(command)) {
     return askOnce(
       projectDir,
       sessionId,
@@ -323,6 +366,7 @@ function bashGate(projectDir, command, sessionId) {
   }
 
   if (
+    wallOn(projectDir, "live-command") &&
     statement(String.raw`wrangler(?:@\S+)?\b.*(\bd1\s+execute\b.*--remote|\bsecret\s+(put|bulk)\b|\bdeploy\b)`).test(command) &&
     !/--dry-run\b|--local\b/.test(command)
   ) {
@@ -366,7 +410,11 @@ function bashWriteScreen(projectDir, command, sessionId) {
   for (const target of bashWriteTargets(command)) {
     const rel = relIfInside(projectDir, target);
     if (!rel) continue;
-    const frozen = frozenStatusAtHead(projectDir, rel);
+    // A shell write is still a write: the build graph's wall runs here too, or `cat > docs/prd.md`
+    // over a landed node ships green while the Edit tool is refused.
+    const graphWall = graphGate(projectDir, rel);
+    if (graphWall) return graphWall;
+    const frozen = wallOn(projectDir, "frozen-record") ? frozenStatusAtHead(projectDir, rel) : { frozen: false };
     if (frozen.frozen) {
       return deny(
         projectDir,
@@ -376,7 +424,7 @@ function bashWriteScreen(projectDir, command, sessionId) {
         `BLOCKED — frozen record. \`${rel}\` is committed history and is never edited (${frozen.reason}) — a shell write is still a write. A correction is a new dated entry that links back.`
       );
     }
-    if (protectedPaths(projectDir).includes(rel)) {
+    if (wallOn(projectDir, "protected-file") && protectedPaths(projectDir).includes(rel)) {
       return deny(
         projectDir,
         sessionId,
@@ -443,7 +491,54 @@ function planHasChangelogEntry(projectDir, planRel) {
   return names.some((name) => name.endsWith(".md") && readSafe(path.join(dir, name)).includes(slug));
 }
 
+// The Stop half of the build-graph walker. Blocks with the next injection line while the graph
+// can still advance, allows the moment it is terminal, and answers null when no graph exists —
+// which is every session in every repo that was never handed one.
+function graphStop(projectDir, stopHookActive) {
+  let step;
+  try {
+    step = atStop(projectDir);
+  } catch (e) {
+    return null; // the walker never becomes an outage
+  }
+  if (!step) return null;
+  if (step.refusal) {
+    // A refusal the model cannot repair (the wall denies writes to the graph) must not become an
+    // unbreakable Stop loop: say it once, loudly, and let the second Stop through. Fixing the
+    // graph is the run owner's job, not the model's — so this branch, alone in this function,
+    // honours the runtime's loop guard.
+    if (stopHookActive) return null;
+    return {
+      decision: "block",
+      reason:
+        `BUILD GRAPH REFUSED — \`.claude/state/graph.json\` exists but ${step.refusal}. Nothing is being steered. ` +
+        "Fix the graph or remove it: the walker is dormant only when that file is ABSENT, never when it is wrong. (Said once — the next Stop passes.)",
+    };
+  }
+  if (!step.line) return null;
+  return {
+    decision: "block",
+    reason:
+      `${step.line} The build graph decides this run's order and completion — ${step.terminal.summary} ` +
+      "Write the file the line names; the run ends by itself when the graph is complete, blocked, or out of attempts.",
+  };
+}
+
 function stopGate(projectDir, payload) {
+  // The build graph is asked BEFORE the runtime's loop guard, and deliberately ignores it. The
+  // guard exists because an unbounded Stop hook is a hang; the walker is bounded instead — every
+  // block charges an attempt on the node it names, so a model that answers "done" spends that
+  // node's budget and the run ends `exhausted`. Honouring the flag would leave the walker able to
+  // steer exactly once per turn chain and then go quiet with documents still owed, which is the
+  // liveness hole the whole design exists to close.
+  //
+  // Consequence, and it is deliberate: while a graph is live the first block flips
+  // `stop_hook_active` for the rest of the chain, so the four sub-walls below are suspended until
+  // the graph is terminal. A generation box wants exactly that; a human session running a
+  // hand-written graph should know it.
+  const graph = graphStop(projectDir, payload.stop_hook_active);
+  if (graph) return graph;
+
   if (payload.stop_hook_active) return null; // the runtime's infinite-loop guard — never re-block
 
   // The Stop wall is scoped to this session's own rows (plus sid-less ones) — a concurrent
@@ -456,7 +551,7 @@ function stopGate(projectDir, payload) {
     readQueue(projectDir).filter((row) => !/\bsid=/.test(row.body) || row.body.includes(`sid=${payload.session_id}`))
   );
   const counts = countRows(mine);
-  if (counts.unresolved > 0 && !bookkeeperDispatched(payload.transcript_path)) {
+  if (wallOn(projectDir, "queue") && counts.unresolved > 0 && !bookkeeperDispatched(payload.transcript_path)) {
     return {
       decision: "block",
       reason:
@@ -472,7 +567,7 @@ function stopGate(projectDir, payload) {
   // Open gate denials wall the stop: silence after a block is the one ending the log exists to
   // make impossible. Resolution appends to the log — retried-ok is machinery-written on a
   // successful retry; waived/disclosed are the session's hand-written, auditable claims.
-  const openDenials = unresolvedDenials(projectDir, payload.session_id);
+  const openDenials = wallOn(projectDir, "open-denials") ? unresolvedDenials(projectDir, payload.session_id) : [];
   if (openDenials.length > 0) {
     const rel = path.relative(projectDir, sessionLogPath(projectDir, payload.session_id));
     // A resolution that doesn't parse reads to the session as "my resolution didn't count"
@@ -502,7 +597,7 @@ function stopGate(projectDir, payload) {
   // The Test Obligations ledger IS walled per row: the Outcome cell lives in the plan file, so the
   // only way past this block is reading the file — a context-held copy of the ledger is exactly
   // how rows get missed. (Tables without an Outcome column are legacy and pass; see lib/ledger.)
-  for (const rel of completed) {
+  for (const rel of wallOn(projectDir, "ledger") ? completed : []) {
     const rows = undischargedRows(readSafe(path.join(projectDir, rel)));
     if (rows.length > 0) {
       return {
@@ -514,7 +609,9 @@ function stopGate(projectDir, payload) {
     }
   }
 
-  const undocumented = completed.filter((rel) => !planHasChangelogEntry(projectDir, rel));
+  const undocumented = wallOn(projectDir, "changelog-entry")
+    ? completed.filter((rel) => !planHasChangelogEntry(projectDir, rel))
+    : [];
   if (undocumented.length > 0) {
     return {
       decision: "block",

package/data/harnesses/code/hooks/hooks.json

@@ -11,7 +11,7 @@
       { "matcher": "", "hooks": [ { "type": "command", "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/awareness.mjs\"", "timeout": 10 } ] }
     ],
     "PostToolUse": [
-      { "matcher": "Edit|Write|MultiEdit|Bash", "hooks": [ { "type": "command", "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/awareness.mjs\"", "timeout": 10 } ] }
+      { "matcher": "Edit|Write|MultiEdit|Bash", "hooks": [ { "type": "command", "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/awareness.mjs\"", "timeout": 10 }, { "type": "command", "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/build-graph.mjs\"", "timeout": 10 } ] }
     ],
     "PreToolUse": [
       { "matcher": "Edit|Write|MultiEdit|Bash", "hooks": [ { "type": "command", "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/compliance.mjs\"", "timeout": 10 } ] }

package/data/harnesses/code/hooks/lib/graph-store.mjs

@@ -0,0 +1,183 @@
+// harness/code/hooks/lib/graph-store.mjs — the build-graph walker: the filesystem half.
+//
+// `lib/graph.mjs` decides; this module reads and writes. It exists because the Claude Code side
+// of the walker has TWO entry points — the PostToolUse adapter (`build-graph.mjs`) and the Stop
+// wall inside `compliance.mjs` — and a walker whose two triggers disagreed about how state is
+// loaded would be worse than no walker at all.
+//
+// Everything here fails toward dormancy: no graph file, an unreadable one, a crash mid-scan —
+// none of them may block a session that never asked for a build graph.
+
+import fs from "node:fs";
+import path from "node:path";
+import { graphFile, graphStateFile, atomicWrite, GRAPH_FILE, GRAPH_STATE_FILE } from "./state.mjs";
+import { readGraph, reconcile, rebuildState, initialState, nextEligible, inProgress, select, isTerminal, normalizeGraphPath, STATE_VERSION } from "./graph.mjs";
+
+// The two paths the model may never write, spelled once.
+export const GRAPH_PATHS = [`.claude/state/${GRAPH_FILE}`, `.claude/state/${GRAPH_STATE_FILE}`];
+
+// Absent → { present: false }: dormancy, and the caller does nothing at all.
+// Present but unparseable → { present: true, refusal }: loud, never silent.
+export function loadGraph(projectDir) {
+  let text;
+  try {
+    text = fs.readFileSync(graphFile(projectDir), "utf8");
+  } catch (e) {
+    return { present: false };
+  }
+  const parsed = readGraph(text, projectDir);
+  if (!parsed.ok) return { present: true, refusal: parsed.reason };
+  return { present: true, graph: parsed.graph };
+}
+
+// Read every DECLARED path off the disk. Never the tool's argument: `bash` writes files too, a
+// single command writes several, and an argument naming a path proves nothing about what landed.
+export function observe(projectDir, graph) {
+  return graph.nodes.map((node) => {
+    const full = path.join(projectDir, node.path);
+    try {
+      const text = fs.readFileSync(full, "utf8");
+      return { path: node.path, exists: true, bytes: Buffer.byteLength(text, "utf8"), text };
+    } catch (e) {
+      return { path: node.path, exists: false };
+    }
+  });
+}
+
+// An unreadable or version-mismatched state file is REBUILT from the disk, never refused: the
+// graph plus the files that exist are the whole truth, and the state file is only a cache of
+// counters. Refusing here would strand a run over a byte nobody can repair.
+export function loadState(projectDir, graph, observed) {
+  let parsed = null;
+  try {
+    parsed = JSON.parse(fs.readFileSync(graphStateFile(projectDir), "utf8"));
+  } catch (e) {
+    parsed = null;
+  }
+  if (!parsed || typeof parsed !== "object" || parsed.v !== STATE_VERSION || !parsed.nodes || typeof parsed.nodes !== "object") {
+    return { state: rebuildState(graph, observed, parsed), rebuilt: true };
+  }
+  return { state: parsed, rebuilt: false };
+}
+
+export function saveState(projectDir, state) {
+  atomicWrite(graphStateFile(projectDir), `${JSON.stringify(state, null, 2)}\n`);
+}
+
+// --- the two triggers ---------------------------------------------------------------------
+
+// PostToolUse: a write happened. Reconcile the disk, then steer only when there is somewhere new
+// to steer — a node still in progress gets silence, which is what keeps a six-edit document from
+// spending six attempts.
+//
+// `writes` counts EVENTS, not files: one shell command that writes three files is one write,
+// because the cap exists to bound the session, not to audit the filesystem.
+export function afterWrite(projectDir) {
+  const loaded = loadGraph(projectDir);
+  if (!loaded.present) return null;
+  if (loaded.refusal) return { refusal: loaded.refusal };
+  const graph = loaded.graph;
+
+  const observed = observe(projectDir, graph);
+  const before = loadState(projectDir, graph, observed);
+  const running = inProgress(graph, before.state);
+  let state = reconcile(graph, before.state, observed);
+  state.writes = (state.writes || 0) + 1;
+
+  const terminal = isTerminal(graph, state);
+  if (terminal.terminal) {
+    saveState(projectDir, state);
+    return { graph, state, terminal, line: terminal.summary };
+  }
+
+  // Still working on the node it was told to produce — say nothing.
+  const stillRunning = inProgress(graph, state);
+  if (stillRunning && running && stillRunning.id === running.id) {
+    saveState(projectDir, state);
+    return { graph, state, terminal, line: null };
+  }
+
+  const next = nextEligible(graph, state);
+  if (!next) {
+    saveState(projectDir, state);
+    return { graph, state, terminal, line: null };
+  }
+  const picked = select(graph, state, next.id);
+  saveState(projectDir, picked.state);
+  return { graph, state: picked.state, terminal, line: picked.line };
+}
+
+// Stop: the model is trying to end its turn. While the graph can still advance, it does not get
+// to — and the block CHARGES an attempt on the node it names, which is the whole reason the loop
+// terminates: a model that answers "done" three times spends the node's budget and the run ends
+// `exhausted` instead of circling forever.
+//
+// This deliberately ignores the runtime's `stop_hook_active` loop guard (the caller checks the
+// graph before consulting it). The guard exists because an unbounded Stop hook is a hang; this
+// one is bounded by maxAttempts × nodes and by maxWrites, so the guard would only cost the
+// walker its liveness — it would steer exactly once per turn chain and then go quiet with nodes
+// still owed.
+export function atStop(projectDir) {
+  const loaded = loadGraph(projectDir);
+  if (!loaded.present) return null;
+  if (loaded.refusal) return { refusal: loaded.refusal };
+  const graph = loaded.graph;
+
+  const observed = observe(projectDir, graph);
+  const before = loadState(projectDir, graph, observed);
+  let state = reconcile(graph, before.state, observed);
+
+  const terminal = isTerminal(graph, state);
+  if (terminal.terminal) {
+    saveState(projectDir, state);
+    return { graph, state, terminal, line: null };
+  }
+
+  const target = inProgress(graph, state) || nextEligible(graph, state);
+  if (!target) {
+    saveState(projectDir, state);
+    return { graph, state, terminal, line: null };
+  }
+  const picked = select(graph, state, target.id);
+  saveState(projectDir, picked.state);
+  return { graph, state: picked.state, terminal: isTerminal(graph, picked.state), line: picked.line };
+}
+
+// --- the walls the graph owns ---------------------------------------------------------------
+
+// A done node is frozen, and the graph and its state are machinery. Returns a deny REASON (the
+// caller wraps it in its own runtime's envelope) or null.
+//
+// Note what this never does: append a `denied` event to the session gate log. A steer is not a
+// failure, and in a generation box nobody is there to write the `resolved` line that a logged
+// denial would need — the Stop wall would block forever on the walker's own refusals.
+export function graphDenial(projectDir, rel) {
+  const target = normalizeGraphPath(rel, projectDir);
+  if (!target) return null;
+  if (GRAPH_PATHS.includes(target)) {
+    return `BLOCKED — build-graph machinery. \`${target}\` is the run's graph or its state; the walker owns both. Write the document the injected line names instead.`;
+  }
+  const loaded = loadGraph(projectDir);
+  if (!loaded.present || loaded.refusal) return null;
+  const graph = loaded.graph;
+  const node = graph.nodes.find((n) => n.path === target);
+  if (!node) return null;
+  const observed = observe(projectDir, graph);
+  const { state } = loadState(projectDir, graph, observed);
+  const settled = reconcile(graph, state, observed);
+  if (settled.nodes[node.id]?.status !== "done") return null;
+  return `BLOCKED — frozen by the build graph. \`${target}\` is node \`${node.id}\`, which has already landed; the graph's outputs are written once. If it is genuinely wrong, the run's owner edits the graph, not the model.`;
+}
+
+// `mode.walls` is an allowlist over the gate ids in lib/walls.mjs: when a graph declares one,
+// every wall it does not name is off for the session. No `mode` block at all ⇒ every wall on,
+// which is what every repo without a graph already has.
+//
+// The reason a generation box wants this: the compliance set assumes a session that can dispatch
+// a bookkeeper and a user who can answer an ask. A box has neither, so its walls would be
+// unresolvable blocks rather than guard rails.
+export function wallsAllowlist(projectDir) {
+  const loaded = loadGraph(projectDir);
+  if (!loaded.present || loaded.refusal || !loaded.graph.mode) return null;
+  return loaded.graph.mode.walls;
+}

package/data/harnesses/code/hooks/lib/graph.mjs

@@ -0,0 +1,360 @@
+// harness/code/hooks/lib/graph.mjs — the build-graph walker: the pure half.
+//
+// A build graph names the documents a run owes, the edges between them, and the caps that bound
+// it. This module decides WHAT happens next; it never touches the filesystem, the transcript, or
+// the clock beyond an injected timestamp — every adapter (Claude Code's hooks here, OpenCode's
+// plugin in Apollo's generation box) hands it what it read and applies what it returns.
+//
+// The division is the point: one library decides, several runtimes carry the decision, and the
+// two can never disagree about what "done" means. The export set below is a cross-repo contract
+// (Apollo imports this file from the installed `.claude/hooks/lib/graph.mjs`) — a rename is a
+// versioned change, not a refactor, and `tests/parity.test.mjs` pins it.
+//
+// Absence is dormancy; invalidity is a loud refusal. No graph file ⇒ nothing here ever runs. A
+// graph that exists but does not parse is never silently ignored — `readGraph` answers a typed
+// refusal the adapter surfaces.
+
+import path from "node:path";
+
+export const GRAPH_VERSION = 1;
+export const STATE_VERSION = 1;
+export const DEFAULT_MAX_ATTEMPTS = 3;
+export const DEFAULT_MAX_WRITES = 200;
+
+// pending → in_progress → done | failed. `failed` is derived, never authored: a node that is not
+// done once it has spent its attempts can no longer advance, and saying so is what lets the run
+// end instead of circling.
+export const STATUSES = ["pending", "in_progress", "done", "failed"];
+
+// --- paths ------------------------------------------------------------------------------------
+
+// Graph paths, tool arguments and disk scans must compare as one spelling: `./docs/prd.md`,
+// `docs//prd.md` and an absolute path inside the project all name the same node. Pure string math
+// plus path.relative — no filesystem.
+export function normalizeGraphPath(p, projectDir) {
+  if (typeof p !== "string") return null;
+  let s = p.trim().split("\\").join("/");
+  if (!s) return null;
+  if (projectDir && path.isAbsolute(s)) {
+    const rel = path.relative(projectDir, path.resolve(s));
+    if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) return null;
+    s = rel.split(path.sep).join("/");
+  }
+  if (path.isAbsolute(s)) return null;
+  s = path.posix.normalize(s);
+  while (s.startsWith("./")) s = s.slice(2);
+  while (s.endsWith("/")) s = s.slice(0, -1);
+  if (!s || s === "." || s.startsWith("../")) return null;
+  return s;
+}
+
+// --- reading the graph ------------------------------------------------------------------------
+
+const refuse = (reason) => ({ ok: false, reason });
+
+function positiveInt(value, fallback) {
+  if (value === undefined || value === null) return fallback;
+  return Number.isInteger(value) && value > 0 ? value : null;
+}
+
+// Unknown keys are ignored by design, so a v:1 writer can add a field (a `docType` check, say)
+// without every installed harness refusing the graph it has always been able to walk.
+function readValidate(value, id) {
+  if (value === undefined || value === null) return { value: null };
+  if (typeof value !== "object" || Array.isArray(value)) return { error: "`validate` is not an object" };
+  const out = {};
+  if (value.minBytes !== undefined && value.minBytes !== null) {
+    if (!Number.isInteger(value.minBytes) || value.minBytes < 0) return { error: "`validate.minBytes` is not a non-negative integer" };
+    out.minBytes = value.minBytes;
+  }
+  if (value.headings !== undefined && value.headings !== null) {
+    if (!Array.isArray(value.headings) || value.headings.some((h) => typeof h !== "string" || !h.trim())) {
+      return { error: "`validate.headings` is not a list of non-empty strings" };
+    }
+    out.headings = value.headings.map((h) => h.trim());
+  }
+  return { value: Object.keys(out).length ? out : null };
+}
+
+// Depth-first colouring; returns the cycle as a readable chain, or null.
+function findCycle(nodes, byId) {
+  const state = new Map();
+  const stack = [];
+  let found = null;
+  const visit = (id) => {
+    if (found) return;
+    const colour = state.get(id);
+    if (colour === "done") return;
+    if (colour === "open") {
+      found = [...stack.slice(stack.indexOf(id)), id];
+      return;
+    }
+    state.set(id, "open");
+    stack.push(id);
+    for (const dep of byId.get(id).deps) visit(dep);
+    stack.pop();
+    state.set(id, "done");
+  };
+  for (const node of nodes) visit(node.id);
+  return found;
+}
+
+// text → { ok: true, graph } | { ok: false, reason }. Never throws: an adapter calls this on
+// whatever bytes were on disk.
+export function readGraph(text, projectDir) {
+  let raw;
+  try {
+    raw = JSON.parse(String(text ?? ""));
+  } catch (e) {
+    return refuse(`it is not valid JSON (${e?.message || e})`);
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return refuse("it is not a JSON object");
+  if (raw.v !== GRAPH_VERSION) {
+    return refuse(`its version is ${JSON.stringify(raw.v)}, and this harness reads v${GRAPH_VERSION} graphs only`);
+  }
+  if (!Array.isArray(raw.nodes) || raw.nodes.length === 0) return refuse("`nodes` is missing or empty");
+
+  const nodes = [];
+  const byId = new Map();
+  const byPath = new Map();
+  for (const [i, entry] of raw.nodes.entries()) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return refuse(`node #${i + 1} is not an object`);
+    const id = typeof entry.id === "string" ? entry.id.trim() : "";
+    if (!id) return refuse(`node #${i + 1} has no \`id\``);
+    if (byId.has(id)) return refuse(`two nodes share the id \`${id}\``);
+    const nodePath = normalizeGraphPath(entry.path, projectDir);
+    if (!nodePath) return refuse(`node \`${id}\` has no usable \`path\` (it must be relative and inside the project)`);
+    if (byPath.has(nodePath)) return refuse(`nodes \`${byPath.get(nodePath)}\` and \`${id}\` both claim \`${nodePath}\``);
+    const rawDeps = entry.deps === undefined || entry.deps === null ? [] : entry.deps;
+    if (!Array.isArray(rawDeps) || rawDeps.some((d) => typeof d !== "string" || !d.trim())) {
+      return refuse(`node \`${id}\` has a \`deps\` entry that is not a node id`);
+    }
+    const validate = readValidate(entry.validate, id);
+    if (validate.error) return refuse(`node \`${id}\`: ${validate.error}`);
+    const node = { id, path: nodePath, deps: rawDeps.map((d) => d.trim()), validate: validate.value };
+    byId.set(id, node);
+    byPath.set(nodePath, id);
+    nodes.push(node);
+  }
+
+  for (const node of nodes) {
+    for (const dep of node.deps) {
+      if (dep === node.id) return refuse(`node \`${node.id}\` depends on itself`);
+      if (!byId.has(dep)) return refuse(`node \`${node.id}\` depends on \`${dep}\`, which no node declares`);
+    }
+  }
+  const cycle = findCycle(nodes, byId);
+  if (cycle) return refuse(`the nodes form a cycle: ${cycle.join(" → ")}`);
+
+  const maxAttempts = positiveInt(raw.maxAttempts, DEFAULT_MAX_ATTEMPTS);
+  if (maxAttempts === null) return refuse("`maxAttempts` is not a positive integer");
+  const maxWrites = positiveInt(raw.maxWrites, DEFAULT_MAX_WRITES);
+  if (maxWrites === null) return refuse("`maxWrites` is not a positive integer");
+
+  let mode = null;
+  if (raw.mode !== undefined && raw.mode !== null) {
+    if (typeof raw.mode !== "object" || Array.isArray(raw.mode)) return refuse("`mode` is not an object");
+    const walls = raw.mode.walls;
+    if (walls !== undefined && walls !== null) {
+      if (!Array.isArray(walls) || walls.some((w) => typeof w !== "string")) return refuse("`mode.walls` is not a list of wall names");
+      mode = { walls: walls.map((w) => w.trim()).filter(Boolean) };
+    } else {
+      mode = { walls: null };
+    }
+  }
+
+  return { ok: true, graph: { v: GRAPH_VERSION, nodes, maxAttempts, maxWrites, mode } };
+}
+
+// --- state ------------------------------------------------------------------------------------
+
+export function initialState(graph, runId) {
+  const nodes = {};
+  for (const node of graph.nodes) nodes[node.id] = { status: "pending", attempts: 0 };
+  return { v: STATE_VERSION, runId: runId ?? null, writes: 0, nodes };
+}
+
+// Every entry point starts here: a state carried across a graph edit (a node added, one renamed)
+// is completed rather than refused, and a foreign key is dropped rather than walked.
+function cloneState(graph, state) {
+  const next = { v: STATE_VERSION, runId: state?.runId ?? null, writes: Number.isInteger(state?.writes) ? state.writes : 0, nodes: {} };
+  for (const node of graph.nodes) {
+    const cell = state?.nodes?.[node.id];
+    const status = STATUSES.includes(cell?.status) ? cell.status : "pending";
+    next.nodes[node.id] = { status, attempts: Number.isInteger(cell?.attempts) ? cell.attempts : 0 };
+    if (cell?.writtenAt) next.nodes[node.id].writtenAt = cell.writtenAt;
+    if (cell?.lastError) next.nodes[node.id].lastError = cell.lastError;
+  }
+  return next;
+}
+
+// The structural gate: exists, non-empty, big enough, carries the headings the graph asked for.
+// Semantic quality is never this module's business — it decides whether a node LANDED, not
+// whether what landed is any good.
+function validationFailure(node, observation) {
+  const text = typeof observation.text === "string" ? observation.text : null;
+  const bytes = Number.isInteger(observation.bytes) ? observation.bytes : text === null ? null : Buffer.byteLength(text, "utf8");
+  if (bytes === null) return null;
+  if (bytes === 0) return "the file is empty";
+  const minBytes = node.validate?.minBytes;
+  if (Number.isInteger(minBytes) && bytes < minBytes) return `the file is ${bytes} bytes, under the ${minBytes} the graph requires`;
+  const headings = node.validate?.headings;
+  if (headings?.length) {
+    if (text === null) return "the file could not be read to check its headings";
+    const missing = headings.filter((h) => !text.includes(h));
+    if (missing.length) return `it is missing ${missing.map((h) => `"${h}"`).join(", ")}`;
+  }
+  return null;
+}
+
+// `observed` is what the adapter found on disk for the DECLARED paths — never a tool argument,
+// because a shell command writes files too and names none of them in a way a hook can trust.
+// Absent from the list (or `exists: false`) means the file is not there: the node is untouched.
+export function reconcile(graph, state, observed, now = new Date().toISOString()) {
+  const next = cloneState(graph, state);
+  const seen = new Map();
+  for (const entry of observed || []) {
+    if (!entry || entry.exists === false) continue;
+    const p = normalizeGraphPath(entry.path);
+    if (p) seen.set(p, entry);
+  }
+  for (const node of graph.nodes) {
+    const cell = next.nodes[node.id];
+    if (cell.status === "done") continue; // a done node is frozen — its file is never re-judged
+    const observation = seen.get(node.path);
+    if (!observation) continue;
+    const failure = validationFailure(node, observation);
+    if (failure) {
+      if (cell.status === "in_progress") cell.status = "pending";
+      cell.lastError = failure;
+      continue;
+    }
+    cell.status = "done";
+    delete cell.lastError;
+    if (!cell.writtenAt) cell.writtenAt = now;
+  }
+  // Derived, and derived last: a node that is not done and has spent its attempts can never
+  // advance again. Saying so here is what turns "the model keeps not writing it" into a
+  // terminal run instead of an unbounded loop.
+  for (const node of graph.nodes) {
+    const cell = next.nodes[node.id];
+    if (cell.status !== "done" && cell.attempts >= graph.maxAttempts) cell.status = "failed";
+  }
+  return next;
+}
+
+// The corrupt-state path, and Apollo's resume path: derive a state from the disk. `prev` carries
+// only the attempt counters — a resumed run must not get its budget back.
+export function rebuildState(graph, observed, prev = null) {
+  const base = initialState(graph, prev?.runId ?? null);
+  if (prev?.nodes) {
+    for (const node of graph.nodes) {
+      const attempts = prev.nodes[node.id]?.attempts;
+      if (Number.isInteger(attempts) && attempts > 0) base.nodes[node.id].attempts = attempts;
+    }
+  }
+  return reconcile(graph, base, observed);
+}
+
+// --- selection --------------------------------------------------------------------------------
+
+// Declaration order is the tie-break, so a graph reads top to bottom and two runs of the same
+// graph pick the same node.
+export function nextEligible(graph, state) {
+  const s = cloneState(graph, state);
+  for (const node of graph.nodes) {
+    const cell = s.nodes[node.id];
+    if (cell.status !== "pending") continue;
+    if (cell.attempts >= graph.maxAttempts) continue;
+    if (node.deps.some((dep) => s.nodes[dep]?.status !== "done")) continue;
+    return node;
+  }
+  return null;
+}
+
+// The node the model was last told to produce and has not finished.
+export function inProgress(graph, state) {
+  const s = cloneState(graph, state);
+  return graph.nodes.find((node) => s.nodes[node.id].status === "in_progress") || null;
+}
+
+export function injectionLine(node) {
+  return `Now generate ${node.id} at ${node.path}.`;
+}
+
+// One selection, one attempt — never one write, one attempt. A document built by six edits spends
+// one attempt; a turn that ends without landing the document spends the next one. That is what
+// makes "the model keeps almost doing it" a bounded condition.
+export function select(graph, state, id) {
+  const next = cloneState(graph, state);
+  const node = graph.nodes.find((n) => n.id === id) || null;
+  if (!node) return { state: next, node: null, line: null };
+  const cell = next.nodes[id];
+  cell.status = "in_progress";
+  cell.attempts = cell.attempts + 1;
+  return { state: next, node, line: injectionLine(node) };
+}
+
+// --- termination ------------------------------------------------------------------------------
+
+// Nodes that can never run because something they depend on failed — transitively.
+function unreachable(graph, state) {
+  const failed = new Set(graph.nodes.filter((n) => state.nodes[n.id].status === "failed").map((n) => n.id));
+  const blocked = new Set();
+  let moved = true;
+  while (moved) {
+    moved = false;
+    for (const node of graph.nodes) {
+      if (failed.has(node.id) || blocked.has(node.id)) continue;
+      if (state.nodes[node.id].status === "done") continue;
+      if (node.deps.some((dep) => failed.has(dep) || blocked.has(dep))) {
+        blocked.add(node.id);
+        moved = true;
+      }
+    }
+  }
+  return { failed: [...failed], blocked: [...blocked] };
+}
+
+// The run ends when nothing can advance — and the outcome says WHY, because "the box stopped" and
+// "the box finished" must never look alike to the coordinator reading the seal.
+export function isTerminal(graph, state) {
+  const s = cloneState(graph, state);
+  const remaining = graph.nodes.filter((n) => s.nodes[n.id].status !== "done");
+  if (remaining.length === 0) {
+    return { terminal: true, outcome: "complete", summary: `The build graph is complete — all ${graph.nodes.length} node(s) landed.` };
+  }
+
+  const overWrites = s.writes > graph.maxWrites;
+  if (!overWrites) {
+    const running = inProgress(graph, s);
+    if (running) {
+      return { terminal: false, outcome: null, summary: `In progress: ${running.id} at ${running.path}.` };
+    }
+    const next = nextEligible(graph, s);
+    if (next) {
+      return { terminal: false, outcome: null, summary: `Next: ${next.id} at ${next.path}.` };
+    }
+  }
+
+  const { failed, blocked } = unreachable(graph, s);
+  if (overWrites) {
+    return {
+      terminal: true,
+      outcome: "exhausted",
+      summary: `The build graph is exhausted — ${s.writes} writes passed the cap of ${graph.maxWrites} with ${remaining.map((n) => n.id).join(", ")} still owed.`,
+    };
+  }
+  if (blocked.length) {
+    return {
+      terminal: true,
+      outcome: "blocked",
+      summary: `The build graph is blocked — ${blocked.join(", ")} can never run because ${failed.join(", ")} failed.`,
+    };
+  }
+  return {
+    terminal: true,
+    outcome: "exhausted",
+    summary: `The build graph is exhausted — ${failed.join(", ")} spent ${graph.maxAttempts} attempt(s) without landing.`,
+  };
+}

package/data/harnesses/code/hooks/lib/state.mjs

@@ -335,6 +335,23 @@ export function stateDir(projectDir) {
   return dir;
 }
 
+// The build graph's two machine-local files. Named here so every reader — the walker's adapters,
+// the compliance gates, a composer writing a graph before any session has run — spells them once.
+export const GRAPH_FILE = "graph.json";
+export const GRAPH_STATE_FILE = "build-graph-state.json";
+
+// The graph is READ from a plain join: a composer may drop it in before any hook has run, and
+// asking for it must never create the folder (absence is the walker's dormancy signal).
+export function graphFile(projectDir) {
+  return path.join(projectDir, ".claude", "state", GRAPH_FILE);
+}
+
+// The state file is WRITTEN, so its accessor goes through stateDir() — which lays down the
+// folder's `*` .gitignore on first use.
+export function graphStateFile(projectDir) {
+  return path.join(stateDir(projectDir), GRAPH_STATE_FILE);
+}
+
 // Session-scoped ask memory: an `ask` gate fires once per (session, class); after the user has
 // answered it once, repeats in the same session pass silently (the runtime's own permission
 // prompts still apply). Records live in .claude/state/asked.tsv — machine-local, self-ignored.

package/data/harnesses/code/hooks/lib/walls.mjs

@@ -0,0 +1,34 @@
+// harness/code/hooks/lib/walls.mjs — the wall vocabulary.
+//
+// One name per gate the compliance module can refuse or ask at, in one place, because a build
+// graph's `mode.walls` is an allowlist over exactly these strings. A name that drifts from the
+// id the code passes to `deny()` silently switches a wall off — `tests/parity.test.mjs` asserts
+// the two sets agree, so a rename fails there rather than in a generation box at 3am.
+//
+// The first ten are PreToolUse gate ids as recorded in the session log; the last four name Stop
+// sub-walls that had no id at all until `mode.walls` needed to talk about them.
+export const WALLS = [
+  "frozen-record",
+  "protected-file",
+  "plan-gate",
+  "changelog",
+  "bookkeeping",
+  "package-table",
+  "foreign-claim",
+  "branch-worktree",
+  "live-command",
+  "commit-claim",
+  "queue",
+  "open-denials",
+  "ledger",
+  "changelog-entry",
+];
+
+// The build graph's own denials are deliberately absent: they are not skippable, because they
+// are the graph enforcing itself. A name in this list is a name a graph can switch off.
+
+// `allowlist` is null when no graph declares one — every wall on, today's behaviour.
+export function wallEnabled(allowlist, name) {
+  if (!Array.isArray(allowlist)) return true;
+  return allowlist.includes(name);
+}

package/data/harnesses/code/rules/testing.md

@@ -60,7 +60,7 @@ Test packages install at `latest` — outside the approved-packages pin set. Fak
 
 - **Suite, not scripts.** Tests live in the canonical test tree — `tests/` mirroring `src/`, or the convention the repo already uses — named `<subject>.test.ts`; shared fixtures, factories, and helpers in `tests/helpers/` (or the suite's existing shared home).
 - **Wire the canonical command.** `"test"` in `package.json` runs the whole unit suite (`vitest run`); e2e under `"test:e2e"`. A repo where `pnpm test` / `npm test` doesn't run the suite is misconfigured — fix the wiring, **never** route around it.
-- **Unit and E2E trees stay separate.** Vitest/Jest suites in `tests/`; Playwright/Maestro suites in `e2e/` with their own config — **never** mixed into the unit runner's glob.
+- **Unit and E2E trees stay separate.** Vitest/Jest suites in `tests/`; Playwright/Maestro suites in `e2e/` with their own config — **never** mixed into the unit runner's glob. The e2e config **owns its world** — it builds, seeds, and boots the app itself (a `webServer` block or equivalent), so a journey passes from a cold shell like any other test and "the world was not running" is never why one did not run.
 - **The real-renderer stratum is a third tree** — `tests/rendered/` under the unit runner's *browser mode*, its own config, kept to geometry regressions that shipped and the composition assertions a component library cannot make alone. It is not a second component suite; anything a simulated DOM can prove stays in `tests/component/`.
 - **No test doubles for what you own.** Prefer real instances — in-memory SQLite for drizzle, the actual Express app via `supertest` — over mocks; mock **only** true externals (network via `msw`, time via the runner's fake timers).
 - **Determinism.** No real network, no real time, no shared mutable state between tests; every test **must** pass alone, in any order, **and from a cold shell** — never against a hand-started dev server (Workers: `@cloudflare/vitest-pool-workers`; Express: `supertest` against the app instance).

package/data/harnesses/code/skills/testing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: testing
-description: "The test-lifecycle skill — three modes. Plan-gate mode: after `boundary` passes, derives the tests a plan owes and writes the Test Obligations ledger into the plan (a row per behavior: layer, target file, oracle, fixtures); writes no test files. Placement mode: layered test strategy — which ownership strata the application has, where a test lives and what it may assert; use for any testing-strategy, test-architecture, test-pyramid, or 'unit/integration/e2e?' question, even if 'layer' is never said. Gate mode: executes the verification gate — derives the behavioral checklist, drives the real surface (browser automation, the real CLI, HTTP; the `/test` runner where wired), pins durable behaviors, discharges every ledger row. Triggers on 'test plan', 'testing strategy', 'test architecture', 'test layers', 'where should this test live', 'run the verification gate'."
+description: "The test-lifecycle skill — three modes. Plan-gate mode: after `boundary` passes, derives the tests a plan owes and writes the Test Obligations ledger into the plan (a row per behavior: layer, target file, oracle, fixtures); writes no test files. Placement mode: layered test strategy — which ownership strata the application has, where a test lives and what it may assert (on a rendered surface every user-observable promise lives in the surface's journey; component tests are residual); use for any testing-strategy, test-architecture, test-pyramid, or 'unit/integration/e2e?' question, even if 'layer' is never said. Gate mode: executes the verification gate — derives the behavioral checklist, drives the real surface (browser automation, the real CLI, HTTP; the `/test` runner where wired), pins durable behaviors, discharges every ledger row. Triggers on 'test plan', 'testing strategy', 'test architecture', 'test layers', 'where should this test live', 'run the verification gate'."
 ---
 
 # Testing — Ledger, Layers, Gate
@@ -30,9 +30,9 @@ You derive the tests an implementation plan owes and pin them into the plan as a
 
 ### Layer assignment
 
-Assign each behavior the **cheapest layer that can prove it**, then name the oracle. The ledger altitudes are `unit` / `component` / `integration` / `e2e` (strata mapping: § Bridge below); **integration is the default for server behavior** — a route/handler against a real in-memory datastore via the app instance. Error paths, races, and idempotency are obligations too, and belong at **integration** with injected faults (network mock, fake timers, forced constraint) — never e2e.
+Assign each behavior the **cheapest layer that can prove it**, then name the oracle. The ledger altitudes are `unit` / `component` / `integration` / `e2e` (strata mapping: § Bridge below). **Integration is the default for server behavior** — a route/handler against a real in-memory datastore via the app instance; server-side error paths, races, and idempotency belong there with injected faults (network mock, fake timers, forced constraint). **A journey is the default for a rendered surface** — any promise a user could observe in a real browser (what a screen shows over real rows, what a click changes, where navigation lands and what the URL carries, what a refused or failed request shows) is owed at layer 8 as `extend journey <surface>`, never as a component test; the surface's own fault paths (a 500 on load, a 400 on submit) stay in the journey too, injected at the app's own endpoint from the browser. What a rendered surface still owes below the browser is enumerated in § Placement discipline: a pure derivation with real branches (layer 6), a regression pin for a state the journey world cannot reach (layer 7), the wire's error taxonomy (layer 5), and geometry that shipped wrong (7b).
 
-**The e2e altitude gate:** an e2e obligation is earned **only** when the behavior genuinely spans processes no single-process test can exercise together. Density is one scenario per cross-process journey, not per feature — prefer **"extend scenario `<name>`"** over **"new scenario"**. **Refuse to emit any e2e obligation while the project's e2e smoke gate is not wired in CI** — emit a **blocked** row naming the missing gate instead.
+**The journey world is a precondition, not an excuse.** A rendered surface owes its journeys whether or not the repo's e2e config boots today. If it does not — no config, a world pointed at a deleted package, a job parked in CI — the plan's **first** obligation row is wiring it (`e2e · <config> · the world builds, seeds, boots and one journey passes from a cold shell`), and every journey row names it as a dependency. Emitting `blocked` rows in place of journeys and routing the promises down to component tests is the failure this rule exists to stop: a broken world that nothing obliges anyone to fix stays broken, and every UI promise for months lands in a simulated DOM. Density is one spec file per surface and one `test()` per user journey, carrying as many assertions as the journey has observable steps — prefer **"extend journey `<surface>`"** over a new file.
 
 ### Run (plan-gate)
 
@@ -41,7 +41,7 @@ Assign each behavior the **cheapest layer that can prove it**, then name the ora
 1. **Build the behavior list** from Proposed Changes + the LLD's promises + HIGH/CRITICAL boundary findings. Note compiler-guarded behaviors — they owe **no** test.
 2. **Assign layer + oracle** per behavior; cheapest proving layer wins.
 3. **Map to a target file** per `testing.md`; name fixtures/factories and fault injection; use the repo-standard fake-data source.
-4. **Apply the e2e altitude gate**; downgrade everything else to integration.
+4. **Route by surface**: a user-observable promise on a rendered surface → `e2e` (its surface's journey, with the world-wiring row first if the world does not boot); server behavior → `integration`; only what § Placement discipline keeps below the browser → `component` / `unit`.
 5. **Emit the Test Obligations section into the plan** (an executor dispatched with only the plan sees nothing else), plus a one-line chat summary:
 
    ```
@@ -76,9 +76,9 @@ The maximum form, for a full-stack application. Each layer names what only it ca
 | 4 | **Contract artifact** | Nothing behavioral. Typed fixtures / interception handlers **compiled from the provider's own types**, exported for every consumer-side test | The typechecker — drift from the provider is a compile error | No runner; a module the provider owns |
 | 5 | **Client data** | The consumer's half of the wire: error taxonomy, parsing, byte fidelity, stream reassembly, retry/abort | Intercepted network serving layer-4 artifacts; no DOM | `msw`-class interception |
 | 6 | **View logic** | Pure presentation derivations: grouping, ordering, status vocabularies, formatting | Table-driven equality | Plain runner |
-| 7 | **Component / surface** | Interaction orchestration — what a user action changes on screen: buffer lifecycle, optimistic states, error surfaces | Rendered output a user can observe; network answered by layer 4 | DOM testing-library class + interception |
+| 7 | **Component / surface** | **Residual on any stack that has layer 8.** Regression pins for what the journey world cannot reach: a state only a fixture the world lacks can produce, a flow behind an external system (a GitHub installation, an AI reply), an orchestration detail no user step exposes (a debounce, a buffer surviving an abort) | Rendered output a user can observe; network answered by layer 4 | DOM testing-library class + interception — never the default home of a UI promise |
 | 7b | **Rendered composition** | Defects only a real rendering engine produces: geometry (overlap, clipping, a container that grows when a panel opens), the theme cascade where your tokens meet a component library's, focus order and accessible names through a third-party primitive | Measurement in a real browser engine — `getBoundingClientRect`, computed style, the accessibility tree | Real-renderer component runner (the unit runner's browser mode), **never** a simulated DOM |
-| 8 | **System smoke** | Composition only — the layers are actually stacked: the build serves, auth flows end to end, one write round-trips | A real browser or real binary against the really-running app | Browser/process driver class; 3–5 journeys, zero variants |
+| 8 | **Journeys** | Everything a user can observe on a rendered surface: what a screen shows over real rows, what an action changes, where navigation lands and what the URL carries, what a refused or failed request shows, a create-then-delete round trip — and composition: the build serves, auth flows end to end | A real browser (or the real binary/wire, for a stack that renders nothing) against the really-running app over a seeded world; faults injected at the app's own endpoints | Browser/process driver class; **one spec file per surface**, one test per user journey, variants wherever a user can see them |
 
 Layer 4 is the hinge. Every layer ≥5 runs on the assumption that layers 1–3 are green — and the artifact makes that assumption *enforceable*: when the provider's response type changes, the fixture stops compiling, and every consumer test fails at typecheck before it runs. A consumer-side test that hand-writes a wire response has smuggled unverified layer-3 knowledge upward; route it through the artifact.
 
@@ -88,7 +88,7 @@ Layer 4 is the hinge. Every layer ≥5 runs on the assumption that layers 1–3
 
 | Application shape | Strata present |
 | --- | --- |
-| Full-stack web app | all eight |
+| Full-stack web app | all eight — 8 is the home of every UI promise, 7 is residual |
 | Backend-only service | 1, 2, 3, 8 |
 | CLI | 2, 3 (the CLI's argv/stdout contract), 8 |
 | Frontend on a third-party API | 4 (derived from the API's published spec), 5, 6, 7, 8 |
@@ -98,16 +98,16 @@ Derive the stack first, then place tests: a placement argument that starts "this
 
 ### Placement discipline
 
-- **Two conditions put a test below a real browser; both must hold.** *(a)* Its assertion names a **product promise**, not a construction detail — litmus: would it survive a total visual redesign that changes no behavior? `not.toHaveProperty("taskMode")` survives; `classList.contains("w-24")` does not. *(b)* The defect it catches can **originate below the layout engine** — a wrong wire path, a dropped field, a state-machine bug, a wrong string. Fail either and the honest home is 7b or 8.
+- **Three conditions put a UI test below a real browser; all must hold.** *(a)* Its assertion names a **product promise**, not a construction detail — litmus: would it survive a total visual redesign that changes no behavior? `not.toHaveProperty("taskMode")` survives; `classList.contains("w-24")` does not. *(b)* The defect it catches can **originate below the layout engine** — a wrong wire path, a dropped field, a state-machine bug, a wrong string. *(c)* **The surface's journey cannot reach it** — the state needs a fixture the seeded world lacks, an external system, or an orchestration detail no user step exposes. Fail (a) or (b) and the honest home is 7b; fail (c) and the home is the journey, as one more assertion.
 - **Geometry may never be asserted in a runner without a layout engine.** There is no valid proxy: a class token is not a width, and a test that pretends otherwise is simultaneously brittle and blind. When the only available runner simulates the DOM, the behavior is driven and pinned at 7b — never approximated.
 - **An assertion provable at two layers is misplaced — it belongs at the lower one.** The duplication check is mechanical, not judgment.
-- **Behavior variants sink to the cheapest layer that owns them** — almost always 2 or 6. A variant at layer 3 pays wire tax on a domain test; a variant at layer 8 is a placement failure below, by definition.
-- **One representative path upward.** Layer 3 keeps one happy path per route plus exhaustive coverage of *contract edges only*; layer 8 keeps 3–5 journeys total.
+- **Behavior variants sink to the cheapest layer that owns them** — a derivation's variants to 6, a rule's to 2. A variant a user can *see* (a second sort order, a filtered roster, a refused form) belongs in the journey that shows it, as one more assertion, not as a component case. A variant at layer 3 pays wire tax on a domain test.
+- **One representative path upward for the server; the whole surface for the browser.** Layer 3 keeps one happy path per route plus exhaustive coverage of *contract edges only*. Layer 8 keeps one spec per surface covering everything a user can reach in the seeded world — the count is set by the surface, never by a cap. A cap on journeys is what pushes UI promises into a simulated DOM, and a simulated DOM talks to a hand-written fake of the wire, so a route rename or an envelope change passes it green.
 - **7b stays small by construction.** It holds geometry regressions that actually shipped and the handful of composition assertions a component library's contract cannot make alone (the theme cascade, the accessible name through its primitive). It is not a second component suite — a behavior that a simulated DOM can prove has no business paying a browser's price.
 - **External systems enter as modeled fakes, not spies.** A fake implements the port's semantics so tests assert resulting state; a spy only proves methods were called, which passes just as happily with the bytes swapped.
 - **Failure localization is the payoff to protect.** One defect turns exactly one layer red, at its owner. When a single change reddens several layers, at most one of those tests was correctly placed — treat the rest as findings.
 
-Layering makes cost **additive** — a new API behavior costs one layer-2 test and maybe a layer-3 edge, zero frontend tests; a new UI state costs one layer-7 test, zero backend tests. A flat suite pays N×M, because every top-layer path implicitly re-verifies every behavior beneath it.
+Layering makes cost **additive** — a new API behavior costs one layer-2 test and maybe a layer-3 edge, zero frontend tests; a new UI state costs one more assertion in its surface's journey, zero backend tests. A flat suite pays N×M, because every top-layer path implicitly re-verifies every behavior beneath it.
 
 ### The tree
 
@@ -119,10 +119,10 @@ tests/
   contract/    L4 — no runner; typed fixtures + interception handlers
   client/      L5 — plain unit runner
   view/        L6 — plain unit runner
-  component/   L7 — unit runner + DOM environment (per-file opt-in)
+  component/   L7 — unit runner + DOM environment (per-file opt-in); residual where e2e/ exists
   rendered/    L7b — the same runner in browser mode; a real engine, kept small
   helpers/     shared seeds, fakes, and builders — owned by no stratum
-e2e/           L8 — its own config, never mixed into the unit runner's glob
+e2e/           L8 — one spec per surface over a seeded world; its own config, never mixed into the unit runner's glob
 ```
 
 - **A stratum the app lacks gets no directory** — an empty `component/` in a backend service is a lie about the app's shape.
@@ -147,7 +147,7 @@ When writing or discharging a ledger row, name the stratum, not just the altitud
 
 1. **Derive the stack** from the application's real boundaries (storage? published wire? separate client? DOM?).
 2. **Place each behavior** by the litmus; name stratum, oracle, technology class; take the concrete framework and file placement from `testing.md`.
-3. **Flag violations, don't just place** — assertions provable lower, variants above 2/6, hand-written wire fixtures above layer 4, spies where fakes should model state, layer-8 variants.
+3. **Flag violations, don't just place** — assertions provable lower, derivation variants above 6, hand-written wire fixtures above layer 4, spies where fakes should model state, and UI promises pinned at 7 that the surface's journey can reach.
 4. **Report as a stratum map** — one line per stratum: exists/absent (why), what lives there, what is misplaced and where it moves. For a plan, feed the strata into the ledger's rows.
 
 ---
@@ -168,7 +168,7 @@ Runs as the tail of every build pass — the session opens it the moment the uni
    Cheap oracles have not stopped mattering — they stopped being a gate you pass before looking. Suites, the CLI binary, and HTTP against the running worker run in the same pass and are what the drive's findings get **pinned into** (rung 3). On a surface with no rendering — a CLI, a service, a library — this rung is its own real binary or real wire, and the visual clause simply does not apply.
 
    **A failing checklist assertion is never softened to make a run green** — record the defect, send it to the backlog.
-3. **Pin the durable behaviors — once, against the driven code** — as suite tests per `testing.md`, naming each test's stratum (§ Bridge). Pins are written after the drive and the fixes, never beside the first attempt: a pin written earlier is rewritten on every iteration and proves only that its author and the code agree. **Pinning is written inline, by the agent that drove** — it alone knows what the drive found and what each pin must therefore assert; a sub-agent briefed from the ledger row reproduces the row, not the finding. **A pinned test must pass from a cold shell** — `pnpm test` with no dev server hand-started, no seeded state assumed beyond what the suite builds for itself. A test whose oracle is "fetch the server I happen to have running" is a driven check wearing a test's name: it goes red the moment the session ends (on Workers, `@cloudflare/vitest-pool-workers` is the self-contained harness; an Express app is driven via `supertest`, never a port). Before discharging, run the suite once from a clean shell — a suite that needs the session's environment discharges nothing. A test is a permanent maintenance cost, bought deliberately:
+3. **Pin the durable behaviors — once, against the driven code** — as suite tests per `testing.md`, naming each test's stratum (§ Bridge). **On a rendered surface the pin is the surface's journey first**: the drive just performed *is* the journey, so write it down as the test against the seeded world, and reach for a component test only where § Placement discipline's third condition holds. Pins are written after the drive and the fixes, never beside the first attempt: a pin written earlier is rewritten on every iteration and proves only that its author and the code agree. **Pinning is written inline, by the agent that drove** — it alone knows what the drive found and what each pin must therefore assert; a sub-agent briefed from the ledger row reproduces the row, not the finding. **A pinned test must pass from a cold shell** — `pnpm test` with no dev server hand-started, no seeded state assumed beyond what the suite builds for itself. A test whose oracle is "fetch the server I happen to have running" is a driven check wearing a test's name: it goes red the moment the session ends (on Workers, `@cloudflare/vitest-pool-workers` is the self-contained harness; an Express app is driven via `supertest`, never a port). Before discharging, run the suite once from a clean shell — a suite that needs the session's environment discharges nothing. A test is a permanent maintenance cost, bought deliberately:
 
    | Earns a suite test | Verified by driving alone |
    | --- | --- |
@@ -176,9 +176,10 @@ Runs as the tail of every build pass — the session opens it the moment the uni
    | A bug that occurred once — its regression test | A one-off migration or backfill's output |
 | **A layout defect that shipped** — its geometry pin, at 7b, measured in a real engine | Layout a judged drive has looked at and found correct — looking is the proof, and a pin buys nothing until something breaks |
    | An error path, race, or idempotency guarantee | Behavior a type or the compiler already makes unshippable |
+   | A user-observable step of a surface — as an assertion in its journey | A same-branch table row: an `it.each` earns one row per branch or boundary, never one per literal |
 
-   A driven check is evidence, not an artifact — it proves the change works today and leaves nothing behind; that is why this rung exists.
-4. **Run the affected suite**, plus the project's e2e smoke gate where one is wired.
+   A driven check is evidence, not an artifact — it proves the change works today and leaves nothing behind; that is why this rung exists. Two hygiene rules hold at every pin: **a suite whose subject is no longer reachable from the product's entry points is deleted with the code path**, never repointed to keep it green; and **a case that asserts nothing beyond "it did not throw" is not a pin** — give it an assertion on resulting state or delete it.
+4. **Run the affected suite and the affected surface's journeys from a cold shell** — the e2e config builds, seeds and boots its own world, so "needs the world running" is never a reason a journey did not run.
 5. **Discharge every ledger row into exactly one outcome**: **satisfied** (test green, or driven check passed), **owes nothing** (with the reason — compiler-guarded, covered elsewhere), or **blocked** (missing infrastructure named, row converted to a backlog item). **Open by re-reading the ledger from the plan file on disk, never from conversation memory** — a context-held copy is how rows get missed. **Write each row's outcome into its `Outcome` cell in the plan file** — exactly `satisfied`, `owes nothing — {reason}`, or `blocked → backlog` — because the Stop wall and CI read that cell, and a row left unexamined blocks completion.
 6. **Report results honestly, including failures**; record which test now guards each checklist section (`Pinned:` traces) and each section's `AC:` line where the repo carries a keyed acceptance-criteria source, closing with the coverage count — `AC coverage: {n}/{m}; uncovered: {keys} → backlog`.
 

package/data/harnesses/etna/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.5.19",
+  "version": "1.5.20",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -10,5 +10,5 @@
   "seeds": [],
   "tools": [],
   "docsRoot": "docs",
-  "digest": "4cf950471dd8"
+  "digest": "4c5fe7575b80"
 }

package/data/harnesses/etna/rules/testing.md

@@ -60,7 +60,7 @@ Test packages install at `latest` — outside the approved-packages pin set. Fak
 
 - **Suite, not scripts.** Tests live in the canonical test tree — `tests/` mirroring `src/`, or the convention the repo already uses — named `<subject>.test.ts`; shared fixtures, factories, and helpers in `tests/helpers/` (or the suite's existing shared home).
 - **Wire the canonical command.** `"test"` in `package.json` runs the whole unit suite (`vitest run`); e2e under `"test:e2e"`. A repo where `pnpm test` / `npm test` doesn't run the suite is misconfigured — fix the wiring, **never** route around it.
-- **Unit and E2E trees stay separate.** Vitest/Jest suites in `tests/`; Playwright/Maestro suites in `e2e/` with their own config — **never** mixed into the unit runner's glob.
+- **Unit and E2E trees stay separate.** Vitest/Jest suites in `tests/`; Playwright/Maestro suites in `e2e/` with their own config — **never** mixed into the unit runner's glob. The e2e config **owns its world** — it builds, seeds, and boots the app itself (a `webServer` block or equivalent), so a journey passes from a cold shell like any other test and "the world was not running" is never why one did not run.
 - **The real-renderer stratum is a third tree** — `tests/rendered/` under the unit runner's *browser mode*, its own config, kept to geometry regressions that shipped and the composition assertions a component library cannot make alone. It is not a second component suite; anything a simulated DOM can prove stays in `tests/component/`.
 - **No test doubles for what you own.** Prefer real instances — in-memory SQLite for drizzle, the actual Express app via `supertest` — over mocks; mock **only** true externals (network via `msw`, time via the runner's fake timers).
 - **Determinism.** No real network, no real time, no shared mutable state between tests; every test **must** pass alone, in any order, **and from a cold shell** — never against a hand-started dev server (Workers: `@cloudflare/vitest-pool-workers`; Express: `supertest` against the app instance).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/etna",
-  "version": "0.20.11",
+  "version": "0.20.13",
   "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
   "type": "module",
   "bin": {
@@ -42,5 +42,5 @@
     "agent",
     "plugin"
   ],
-  "etnaFingerprint": "7d6e2acfe663"
+  "etnaFingerprint": "0eb49820003e"
 }