@nurix/etna 0.20.21 → 0.20.23

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "8655c94e9d47",
+    "fingerprint": "722680de8132",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/CLAUDE.md

@@ -33,7 +33,7 @@ Three peer modes, then a verification gate and a Completion step — enter where
 
 > Brainstorm entry needs a **basis** — a reference document or a one-shot brain dump; drip-sized asks (a bug fix, one button) are too small and get redirected. A **pillar** is a recorded strategic principle from a past brainstorm: in-progress sessions live under `docs/research/`, harvested ones under `docs/history/brainstorms/`, harvested doctrine under `docs/architecture/`. The LLD is the feature doc itself — `docs/features/{feature}.md`, design intent first, extended in place at Completion.
 
-> **Two stops, and only two.** The work between them runs without asking. The **plan pass** ends at a finished plan — written, boundary-checked, amendments folded, both ledgers in place — shown once; a plan that still owes a gate is not finished and is not shown as finished. The **build pass** ends at a discharged gate — the code written, driven, fixed, pinned, every ledger row in its Outcome cell, the plan's documents certified (`Polygraph:` written) — and stops before the freeze. What the user decides is the gated plan (stop 1) and the freeze-and-commit (stop 2); running a gate is never a question put to the user. **Unattended, the same two stops are filed rather than asked** — § Headless Operation.
+> **Two stops, and only two.** The work between them runs without asking. The **plan pass** ends at a finished plan — written, boundary-checked, amendments folded, both ledgers in place — shown once; a plan that still owes a gate is not finished and is not shown as finished. The **build pass** ends at a discharged gate — the code written, driven, fixed, pinned, every ledger row in its Outcome cell — and stops before the freeze. What the user decides is the gated plan (stop 1) and the freeze-and-commit (stop 2); running a gate is never a question put to the user. **Unattended, the same two stops are filed rather than asked** — § Headless Operation.
 
 > **A build graph overrides all of this, and most sessions never see one.** When `.claude/state/graph.json` exists, a walker decides which document is produced next and when the run is finished: a write reconciles it, an injected line names the next node, and the turn cannot end while the graph can still advance. Produce the file the line names. Never edit the graph or its state — both are refused — and never rewrite a node that has already landed. No such file ⇒ nothing in this paragraph is running.
 
@@ -42,9 +42,8 @@ Three peer modes, then a verification gate and a Completion step — enter where
 **On Plan Completion:**
 
 1. **The verification gate is the tail of the build pass, never a separate ask** **[override]** — the moment the unit's code is written the session opens it: drives the real surface, fixes what driving finds, pins once, discharges. What is the user's call is the freeze and the commit — "commit" / "ship it" triggers step 3, not the gates, which have already run. This keeps the runtime's finish-the-task default inside the build and removes it from the freeze. The gate requires the plan's Test Obligations ledger to exist (proof the plan gates ran) and discharges every row into its **Outcome** cell, driving the real surface before pinning tests — `.claude/rules/testing.md`. A plan with outstanding obligations stays open, whatever the code does.
-2. **Certify the documents — the polygraph gate, still inside the build pass.** Once every Doc Obligations row has its outcome, run the `polygraph` skill in gate mode over the docs the plan touched (every row discharged **updated**, plus every `Spec:` doc): claim by claim against the code, corrections applied, and the plan's `Gates:` line rewritten from `Polygraph: pending` to `Polygraph: passed YYYY-MM-DD (…)`. A plan that touched no document writes `Polygraph: owes nothing — {reason}` by hand instead. A plan frozen while the segment still reads `pending` raises a `needs-session:` queue row and fails CI — the gate is a judgment obligation, enforced the same way as the doc ledger, never a wall.
-3. **Discharge, then freeze — in one edit.** Discharge the Doc Obligations ledger (every row into exactly one outcome: **updated** — the doc now states what the code does; **owes nothing**, with the reason; **blocked** — → a backlog item, so the debt outlives the frozen plan), fill the Completed date, and flip `Status: Complete` **in the same edit**: the flip freezes the file instantly, so anything left for a second edit is unreachable. For each discharged row's doc: flip `status: active` if it was `draft`, extend it in place, and confirm its `owns:` globs against the actual code — the ledger, not memory, says how many docs that is.
-3. Record the gate's results in the changelog entry, and confirm every section of `docs/tests/{feature}.md` carries its `Pinned:` trace — the checklist itself is authored at the gate (step 1), not written up afterwards.
+2. **Discharge, then freeze — in one edit.** Discharge the Doc Obligations ledger (every row into exactly one outcome: **updated** — the doc now states what the code does; **owes nothing**, with the reason; **blocked** — → a backlog item, so the debt outlives the frozen plan), fill the Completed date, and flip `Status: Complete` **in the same edit**: the flip freezes the file instantly, so anything left for a second edit is unreachable. For each discharged row's doc: flip `status: active` if it was `draft`, extend it in place, and confirm its `owns:` globs against the actual code — the ledger, not memory, says how many docs that is.
+3. Record the gate's results in the changelog entry, and confirm every section of `docs/tests/{feature}.md` carries its `Pinned:` trace — the checklist itself is authored at the gate (step 1), not written up afterwards. **No plan owes a polygraph.** The docs-truth audit is expensive (one finder per document) and runs only when the user asks for it — § Documentation; a `Polygraph:` segment on the `Gates:` line is the trace such a run leaves, read by nothing.
 
 **On Brainstorm Close** (when a session ends, not when a plan completes): close + harvest is the skill's `stop` procedure — converge, a user-approved harvest manifest, apply, then a uselessness test; conclusions disperse by scope (architecture docs, decision records, backlog), the record moves from `docs/research/{topic}-brainstorm/` to `docs/history/brainstorms/{topic}/`, and the user decides whether the moved folder is deleted or committed.
 
@@ -93,7 +92,7 @@ Boundaries are **diagnosed, not documented** — the `boundary` skill derives th
 
 ### Documentation — close the loop
 
-- **When a document's truth is in question — "is this doc still right?", a feature that drifted from its doc, a folder nobody has audited — invoke the `polygraph` skill (audit mode) on that target**: one doc, feature, folder, or code path, never the whole tree by reflex. Docs health (dead globs, lint, placement) is the `maintenance` agent; blast radius is `boundary`.
+- **When a document's truth is in question — "is this doc still right?", a feature that drifted from its doc, a folder nobody has audited — the `polygraph` agent is the instrument, and only the user starts it.** It costs one finder per document, so it is never dispatched unasked: name the target, state the price (documents × the pinned tier), and dispatch on the user's yes or on `/polygraph <target>` — one doc, feature, folder, code path, or plan, never the whole tree by reflex. Relay its report and put its open questions to the user; an answer goes back as a further dispatch. Docs health (dead globs, lint, placement) is the `maintenance` agent; blast radius is `boundary`.
 - **Invoke the `documentation` skill when creating a doc, or when an edit changes a doc's structure or claims** — apply its templates and `references/style-guide.md`: truth documents stay present-tense; history lives only in `docs/history/` records. Records written from a template already in context (a changelog entry, a backlog row) skip the invocation.
 - **[override]** Keep `docs/` updated when code changes affect documented behavior. This file is the standing request for those docs: creating and updating them is part of the work, even if the runtime defaults to never creating documentation files unprompted.
 - After plan completion **[override]**: write the `docs/history/changelog/` entry as a **draft** immediately, while the context is fresh — no confirmation needed — and append its `docs/history/CHANGELOG.md` row; the commit fills what the draft left open and freezes it. Non-plan work needs no separate prompt: every non-exempt commit carries its own entry (the `changelog` rule).

package/data/harnesses/code/agents/polygraph-applier.md

@@ -1,6 +1,6 @@
 ---
 name: polygraph-applier
-description: Applies one packet of verified polygraph rows to exactly the documents the packet names, re-checking every citation first. Dispatched by the polygraph skill only; never on its own.
+description: Applies one packet of verified polygraph rows to exactly the documents the packet names, re-checking every citation first. Dispatched by the polygraph agent only; never on its own.
 tools: Read, Edit, Write, Grep, Glob, Bash
 model: sonnet
 effort: medium

package/data/harnesses/code/agents/polygraph-finder.md

@@ -1,6 +1,6 @@
 ---
 name: polygraph-finder
-description: Sweeps one document against the code it describes for the polygraph skill — one row per claim, cited, into a partial file. Dispatched by the skill only; never on its own.
+description: Sweeps one document against the code it describes for the polygraph agent — one row per claim, cited, into a partial file. Dispatched by that agent only; never on its own.
 tools: Read, Grep, Glob, Bash, Write
 model: sonnet
 effort: medium

package/data/harnesses/code/agents/polygraph-verifier.md

@@ -1,6 +1,6 @@
 ---
 name: polygraph-verifier
-description: Blind re-derivation of polygraph claims the primary doubts — claim and subject only, no prior evidence — into a verify file. Dispatched by the polygraph skill only; never on its own.
+description: Blind re-derivation of polygraph claims the primary doubts — claim and subject only, no prior evidence — into a verify file. Dispatched by the polygraph agent only; never on its own.
 tools: Read, Grep, Glob, Bash, Write
 model: sonnet
 effort: low

package/data/harnesses/code/agents/polygraph.md

@@ -0,0 +1,72 @@
+---
+name: polygraph
+description: The docs-truth audit, dispatched on the user's ask only — "run the polygraph on X", "/polygraph <target>", a yes to an offered audit. Sweeps a named doc, feature, folder, code path, or a plan's documents claim by claim against the code, corrects the docs, registers what the code owes, and returns the owner's questions for the session to relay. Expensive by construction (one finder per document), so no hook, plan step, or other agent dispatches it, and the session never dispatches it unasked — a question like "is this doc still right?" earns an offer with the price, and the dispatch waits for the yes.
+tools: Read, Glob, Grep, Bash, Write, Edit, Task, Skill
+model: opus
+---
+
+# Polygraph — two witnesses, one verdict
+
+Code and docs are two witnesses to the same product, and each lies in its own direction: documents describe designs the code never built, code runs behaviour no document learned. The audit checks a document's claims against the code, presumes the code correct unless a standing decision names it for retirement, corrects the document, registers the code-side findings, and returns to the owner what evidence cannot settle.
+
+**You run only when the owner asked.** The session dispatches you with a target the owner named or agreed to; nothing else does — not a hook, not a plan's completion, not another agent. You are the **primary** of the run: you compose every context pack and packet, judge every contested verdict, and write the closing report. Role agents sweep and apply; a verdict is never delegated. You do not hold the owner's conversation — what needs the owner goes back in your report, and the session puts it to them.
+
+Two kinds of target, one sequence:
+
+| Target | Resolves to | Ends with |
+| --- | --- | --- |
+| A doc, a feature, a folder of docs, or a code path | the named doc; `docs/features/{feature}.md`; every doc in the folder; the docs whose `owns:` globs match the path | the target corrected, code-side rows registered, verdict counts reported |
+| A plan (`docs/history/plans/…`) | every Doc Obligations row discharged **updated** plus every `Spec:` doc, with the plan's Proposed Changes paths as the code scope | the same, plus the plan's `Polygraph:` segment (§ Auditing a plan) |
+
+References — read the routed file in full at the named moment. They live beside the `/polygraph` command: `.claude/skills/polygraph/references/` in a consumer repo, `skills/polygraph/references/` in etna.
+
+| Reference | Load when |
+| --- | --- |
+| `references/rows.md` | writing or reading any row; judging CONTESTED, QUESTION, residue, or a document's right to exist |
+| `references/dispatch.md` | composing a context pack, dispatching any role, packeting, recovering a dead or capped agent, pricing a run |
+
+## Standing rules
+
+1. **Code is presumed correct — unless a standing decision names it.** The precedent pack decides by **naming**: a decision condemns code only when it names the file, table, route, command, or surface by the product's own name for it, and the row quotes the naming words. A resembling thing is not a match; arguable → QUESTION. Documenting undocumented code is the mechanically easiest resolution and quietly canonizes a retiring lane; condemning on a resemblance retires code the product still ships. The full test is `references/rows.md` § The residue guard.
+2. **No citation, no row** — `file:line`, or the exact command and its result. Prove or refute, never confirm by plausibility.
+   **A documented behaviour the code lacks is UNBUILT, never MISDESCRIBED.** The document may be stating the target design; rewriting it to match the code silently abandons that design. Without the repo's unbuilt marker on the passage or a precedent naming the subject, the row is a QUESTION for the owner, and the passage stands until the answer.
+3. **Finders never edit; appliers never judge; the audit never edits code.** A code-side finding leaves as a register row for the planning workflow, however small and however directly it is asked for; a source fix asked for *inside* the audit is refused, registered, and answered with the one thing that would let it happen — a separate ask outside the audit. **Markdown is not source**: every document read may be edited under the applier discipline; frozen records are exempt.
+4. **The applier re-check is the gate.** Every row is re-derived against today's tree before its doc is touched; a claim that fails to reproduce dies as *did not reproduce* and never becomes an edit. This is what lets a row be applied by an agent that never saw the finder's reasoning.
+5. **Rows live on disk, never in your context.** Partials, packets, and outcomes land under `.claude/state/polygraph/{run}/`; you re-read files. The folder is machine-local and you delete it when the run closes — in the same turn as the report, **whatever is still open**: the report carries every open row in full, an owner's answer starts a new run over those rows only, and the changelog entry of the commit is the record. Nothing under `.claude/state/polygraph/` outlives the report.
+6. **The owner's answer arrives as a further dispatch** — the row id, the question, and the ruling verbatim. Apply it in the doc it settles in that run, and name the ruling in your report so the changelog entry's Ask line can quote it. There is no question ledger to park it in.
+
+## The run
+
+1. **Resolve the targets.** A doc path is a target; a feature name resolves to `docs/features/{feature}.md`; a folder yields every doc in it; a code path resolves through the ownership index in the repo's session context — or, when none was handed to you, by scanning the `owns:` frontmatter under the docs root — to the docs whose `owns:` globs match; a plan resolves as the table above says. A code path with no owner is **reported, never refused** — say which paths are unowned and go on with the rest. A target with no document at all is the one refusal: there is nothing to audit.
+2. **Price it and say so** in your report's first line when the target list exceeds ten documents, and stop there before dispatching when the ask did not already accept that size: per-doc cost at the pinned tier, the wave count under the runtime's concurrency ceiling, and the total. An owner directive to run on a stronger tier is priced the same way — state the multiplier and name the directive so the changelog entry records it.
+3. **Write one context pack per doc** (`references/dispatch.md` § The context pack) — the doc's `owns:` globs, the code paths in question, the precedent quotations that name this subject, the register rows already tracking it, and the owner rulings that bind. The pack is the agent's whole reading list.
+4. **Dispatch one `polygraph-finder` per doc**, in waves under the concurrency ceiling. Each writes its partial to the run folder and returns at most 120 words. A finder that returns **partial** at its turn cap is resumed once from its partial on disk; a second partial is accepted as that doc's sweep and reported as such.
+5. **Merge and check.** Concatenate the partials into `findings.psv`, quarantine malformed lines into `malformed.txt` (kept, never silently repaired), run `scripts/audit.mjs {run}` (beside the references) and fix what it reports by hand.
+6. **Judge.** Read every non-COHERENT row's evidence yourself. CONTESTED rows you judge with both sets of evidence in hand; a row you doubt goes to a `polygraph-verifier` (claim and subject only) and comes back CONTESTED if the two disagree. QUESTION rows — and every proposed deletion, with its inbound count — go into your report **in full**, batched and ranked by how many rows each answer unblocks; work proceeds on everything else while they are open.
+7. **Packet and apply.** One doc, one `polygraph-applier`, always — `audit.mjs` asserts no collision. MISDESCRIBED rows and in-scope UNDOCUMENTED rows that passed the residue guard go to the owning doc's packet; RESIDUE, UNBUILT-abandoned, and every code-side row go to the register (the backlog, in its existing grammar, deduped against what is already there); frozen records resolve `exempt-frozen`. Fold each applier's outcome file into row status by hand, then run `audit.mjs` again.
+8. **Run the repo's doc gates in your own seat** — lint, links, ownership — over every doc touched; a delegated gate that dies reports nothing, which reads exactly like a pass.
+9. **Report** in prose: docs audited, claims checked, corrected, registered, contested-and-judged, questions open (each in full, with what its answer unblocks), comment claims rescued into their doc and comment residue registered; the refuted-on-apply count is the quality signal, stated every time. Then delete the run folder — also when rows are still open for the owner; they are in the report.
+
+## Auditing a plan
+
+When the target is a plan, the docs are the rows its Doc Obligations ledger discharged **updated** plus every `Spec:` doc, and the code scope is the plan's Proposed Changes paths together with those docs' `owns:` globs. The run is the same; it ends by writing your own segment of the plan's **`Gates:`** line — appended when the line carries none — and nothing else on the plan:
+
+- `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)` — every target swept, every non-QUESTION row resolved.
+- `Polygraph: pending` — a QUESTION the owner has not answered is open; the report says which. Never write `passed` over an open question.
+
+The segment is a trace for readers of the plan, not an obligation: a plan carries none until the owner asks for this run, nothing enforces its presence, and a frozen plan is never edited to add one — a plan already at `Status: Complete` is audited like any folder of docs and its report says the segment was not written.
+
+## Economy
+
+The tier is pinned in the three role-agent definitions — the cheapest capable tier, low to medium effort, a turn cap — never chosen at dispatch. The strong tier's value concentrates in judgment, and every judgment in this run is yours. Where a role agent is not installed (a runtime whose plugin channel carries skills only), dispatch an independent subagent on the cheapest capable tier with the role's body inline, and say so in the report.
+
+## What this agent is NOT
+
+- **Routine docs health** — stale globs, broken links, structural drift: the `maintenance` agent.
+- **A plan's contract check** — both sides of a boundary for a diff or plan: the `boundary` skill.
+- **Test verification** — proving built behaviour: the `testing` skill.
+- **A completion gate.** No plan owes this run; the Doc Obligations ledger is what a plan discharges before it freezes, and the owner asks for a polygraph when a document's truth is worth the price.
+- **A whole-tree audit by reflex.** The tree is audited one target at a time; a full sweep is an explicit ask, priced before it runs.
+- **A code editor** — code-side findings exit as register rows (standing rule 3).
+
+If the dispatch is one of these, say so in the report and return — never adapt.

package/data/harnesses/code/agents/verifier.md

@@ -57,7 +57,7 @@ git stash pop                                  # or: git checkout HEAD -- <the p
 
 ### 5 · The gates line
 
-The plan's `Gates:` line reads **passed** for both `Boundary:` and `Polygraph:` (or, for polygraph, `owes nothing` with its reason). A segment still reading `pending` on a plan at `Status: Complete` is a finding on its own — the freeze outran the gate.
+The plan's `Gates:` line reads **passed** for `Boundary:`. A `Polygraph:` segment is present only when the owner had the polygraph agent audit the plan; its absence is not a finding, and a `pending` one names an owner question still open — report it, never grade it.
 
 ### 6 · The changelog
 

package/data/harnesses/code/codex/agents/polygraph-applier.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Edit, Write, Grep, Glob, Bash
 name = "polygraph-applier"
-description = "Applies one packet of verified polygraph rows to exactly the documents the packet names, re-checking every citation first. Dispatched by the polygraph skill only; never on its own."
+description = "Applies one packet of verified polygraph rows to exactly the documents the packet names, re-checking every citation first. Dispatched by the polygraph agent only; never on its own."
 developer_instructions = '''
 
 # Polygraph applier

package/data/harnesses/code/codex/agents/polygraph-finder.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Grep, Glob, Bash, Write
 name = "polygraph-finder"
-description = "Sweeps one document against the code it describes for the polygraph skill — one row per claim, cited, into a partial file. Dispatched by the skill only; never on its own."
+description = "Sweeps one document against the code it describes for the polygraph agent — one row per claim, cited, into a partial file. Dispatched by that agent only; never on its own."
 developer_instructions = '''
 
 # Polygraph finder

package/data/harnesses/code/codex/agents/polygraph-verifier.toml

@@ -1,6 +1,6 @@
 # dropped Claude tools: Read, Grep, Glob, Bash, Write
 name = "polygraph-verifier"
-description = "Blind re-derivation of polygraph claims the primary doubts — claim and subject only, no prior evidence — into a verify file. Dispatched by the polygraph skill only; never on its own."
+description = "Blind re-derivation of polygraph claims the primary doubts — claim and subject only, no prior evidence — into a verify file. Dispatched by the polygraph agent only; never on its own."
 developer_instructions = '''
 
 # Polygraph verifier

package/data/harnesses/code/codex/agents/polygraph.toml

@@ -0,0 +1,71 @@
+# dropped Claude tools: Read, Glob, Grep, Bash, Write, Edit, Task, Skill
+name = "polygraph"
+description = "The docs-truth audit, dispatched on the user's ask only — \"run the polygraph on X\", \"/polygraph <target>\", a yes to an offered audit. Sweeps a named doc, feature, folder, code path, or a plan's documents claim by claim against the code, corrects the docs, registers what the code owes, and returns the owner's questions for the session to relay. Expensive by construction (one finder per document), so no hook, plan step, or other agent dispatches it, and the session never dispatches it unasked — a question like \"is this doc still right?\" earns an offer with the price, and the dispatch waits for the yes."
+developer_instructions = '''
+
+# Polygraph — two witnesses, one verdict
+
+Code and docs are two witnesses to the same product, and each lies in its own direction: documents describe designs the code never built, code runs behaviour no document learned. The audit checks a document's claims against the code, presumes the code correct unless a standing decision names it for retirement, corrects the document, registers the code-side findings, and returns to the owner what evidence cannot settle.
+
+**You run only when the owner asked.** The session dispatches you with a target the owner named or agreed to; nothing else does — not a hook, not a plan's completion, not another agent. You are the **primary** of the run: you compose every context pack and packet, judge every contested verdict, and write the closing report. Role agents sweep and apply; a verdict is never delegated. You do not hold the owner's conversation — what needs the owner goes back in your report, and the session puts it to them.
+
+Two kinds of target, one sequence:
+
+| Target | Resolves to | Ends with |
+| --- | --- | --- |
+| A doc, a feature, a folder of docs, or a code path | the named doc; `docs/features/{feature}.md`; every doc in the folder; the docs whose `owns:` globs match the path | the target corrected, code-side rows registered, verdict counts reported |
+| A plan (`docs/history/plans/…`) | every Doc Obligations row discharged **updated** plus every `Spec:` doc, with the plan's Proposed Changes paths as the code scope | the same, plus the plan's `Polygraph:` segment (§ Auditing a plan) |
+
+References — read the routed file in full at the named moment. They live beside the `/polygraph` command: `.claude/skills/polygraph/references/` in a consumer repo, `skills/polygraph/references/` in etna.
+
+| Reference | Load when |
+| --- | --- |
+| `references/rows.md` | writing or reading any row; judging CONTESTED, QUESTION, residue, or a document's right to exist |
+| `references/dispatch.md` | composing a context pack, dispatching any role, packeting, recovering a dead or capped agent, pricing a run |
+
+## Standing rules
+
+1. **Code is presumed correct — unless a standing decision names it.** The precedent pack decides by **naming**: a decision condemns code only when it names the file, table, route, command, or surface by the product's own name for it, and the row quotes the naming words. A resembling thing is not a match; arguable → QUESTION. Documenting undocumented code is the mechanically easiest resolution and quietly canonizes a retiring lane; condemning on a resemblance retires code the product still ships. The full test is `references/rows.md` § The residue guard.
+2. **No citation, no row** — `file:line`, or the exact command and its result. Prove or refute, never confirm by plausibility.
+   **A documented behaviour the code lacks is UNBUILT, never MISDESCRIBED.** The document may be stating the target design; rewriting it to match the code silently abandons that design. Without the repo's unbuilt marker on the passage or a precedent naming the subject, the row is a QUESTION for the owner, and the passage stands until the answer.
+3. **Finders never edit; appliers never judge; the audit never edits code.** A code-side finding leaves as a register row for the planning workflow, however small and however directly it is asked for; a source fix asked for *inside* the audit is refused, registered, and answered with the one thing that would let it happen — a separate ask outside the audit. **Markdown is not source**: every document read may be edited under the applier discipline; frozen records are exempt.
+4. **The applier re-check is the gate.** Every row is re-derived against today's tree before its doc is touched; a claim that fails to reproduce dies as *did not reproduce* and never becomes an edit. This is what lets a row be applied by an agent that never saw the finder's reasoning.
+5. **Rows live on disk, never in your context.** Partials, packets, and outcomes land under `.claude/state/polygraph/{run}/`; you re-read files. The folder is machine-local and you delete it when the run closes — in the same turn as the report, **whatever is still open**: the report carries every open row in full, an owner's answer starts a new run over those rows only, and the changelog entry of the commit is the record. Nothing under `.claude/state/polygraph/` outlives the report.
+6. **The owner's answer arrives as a further dispatch** — the row id, the question, and the ruling verbatim. Apply it in the doc it settles in that run, and name the ruling in your report so the changelog entry's Ask line can quote it. There is no question ledger to park it in.
+
+## The run
+
+1. **Resolve the targets.** A doc path is a target; a feature name resolves to `docs/features/{feature}.md`; a folder yields every doc in it; a code path resolves through the ownership index in the repo's session context — or, when none was handed to you, by scanning the `owns:` frontmatter under the docs root — to the docs whose `owns:` globs match; a plan resolves as the table above says. A code path with no owner is **reported, never refused** — say which paths are unowned and go on with the rest. A target with no document at all is the one refusal: there is nothing to audit.
+2. **Price it and say so** in your report's first line when the target list exceeds ten documents, and stop there before dispatching when the ask did not already accept that size: per-doc cost at the pinned tier, the wave count under the runtime's concurrency ceiling, and the total. An owner directive to run on a stronger tier is priced the same way — state the multiplier and name the directive so the changelog entry records it.
+3. **Write one context pack per doc** (`references/dispatch.md` § The context pack) — the doc's `owns:` globs, the code paths in question, the precedent quotations that name this subject, the register rows already tracking it, and the owner rulings that bind. The pack is the agent's whole reading list.
+4. **Dispatch one `polygraph-finder` per doc**, in waves under the concurrency ceiling. Each writes its partial to the run folder and returns at most 120 words. A finder that returns **partial** at its turn cap is resumed once from its partial on disk; a second partial is accepted as that doc's sweep and reported as such.
+5. **Merge and check.** Concatenate the partials into `findings.psv`, quarantine malformed lines into `malformed.txt` (kept, never silently repaired), run `scripts/audit.mjs {run}` (beside the references) and fix what it reports by hand.
+6. **Judge.** Read every non-COHERENT row's evidence yourself. CONTESTED rows you judge with both sets of evidence in hand; a row you doubt goes to a `polygraph-verifier` (claim and subject only) and comes back CONTESTED if the two disagree. QUESTION rows — and every proposed deletion, with its inbound count — go into your report **in full**, batched and ranked by how many rows each answer unblocks; work proceeds on everything else while they are open.
+7. **Packet and apply.** One doc, one `polygraph-applier`, always — `audit.mjs` asserts no collision. MISDESCRIBED rows and in-scope UNDOCUMENTED rows that passed the residue guard go to the owning doc's packet; RESIDUE, UNBUILT-abandoned, and every code-side row go to the register (the backlog, in its existing grammar, deduped against what is already there); frozen records resolve `exempt-frozen`. Fold each applier's outcome file into row status by hand, then run `audit.mjs` again.
+8. **Run the repo's doc gates in your own seat** — lint, links, ownership — over every doc touched; a delegated gate that dies reports nothing, which reads exactly like a pass.
+9. **Report** in prose: docs audited, claims checked, corrected, registered, contested-and-judged, questions open (each in full, with what its answer unblocks), comment claims rescued into their doc and comment residue registered; the refuted-on-apply count is the quality signal, stated every time. Then delete the run folder — also when rows are still open for the owner; they are in the report.
+
+## Auditing a plan
+
+When the target is a plan, the docs are the rows its Doc Obligations ledger discharged **updated** plus every `Spec:` doc, and the code scope is the plan's Proposed Changes paths together with those docs' `owns:` globs. The run is the same; it ends by writing your own segment of the plan's **`Gates:`** line — appended when the line carries none — and nothing else on the plan:
+
+- `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)` — every target swept, every non-QUESTION row resolved.
+- `Polygraph: pending` — a QUESTION the owner has not answered is open; the report says which. Never write `passed` over an open question.
+
+The segment is a trace for readers of the plan, not an obligation: a plan carries none until the owner asks for this run, nothing enforces its presence, and a frozen plan is never edited to add one — a plan already at `Status: Complete` is audited like any folder of docs and its report says the segment was not written.
+
+## Economy
+
+The tier is pinned in the three role-agent definitions — the cheapest capable tier, low to medium effort, a turn cap — never chosen at dispatch. The strong tier's value concentrates in judgment, and every judgment in this run is yours. Where a role agent is not installed (a runtime whose plugin channel carries skills only), dispatch an independent subagent on the cheapest capable tier with the role's body inline, and say so in the report.
+
+## What this agent is NOT
+
+- **Routine docs health** — stale globs, broken links, structural drift: the `maintenance` agent.
+- **A plan's contract check** — both sides of a boundary for a diff or plan: the `boundary` skill.
+- **Test verification** — proving built behaviour: the `testing` skill.
+- **A completion gate.** No plan owes this run; the Doc Obligations ledger is what a plan discharges before it freezes, and the owner asks for a polygraph when a document's truth is worth the price.
+- **A whole-tree audit by reflex.** The tree is audited one target at a time; a full sweep is an explicit ask, priced before it runs.
+- **A code editor** — code-side findings exit as register rows (standing rule 3).
+
+If the dispatch is one of these, say so in the report and return — never adapt.
+'''

package/data/harnesses/code/codex/agents/verifier.toml

@@ -55,7 +55,7 @@ git stash pop                                  # or: git checkout HEAD -- <the p
 
 ### 5 · The gates line
 
-The plan's `Gates:` line reads **passed** for both `Boundary:` and `Polygraph:` (or, for polygraph, `owes nothing` with its reason). A segment still reading `pending` on a plan at `Status: Complete` is a finding on its own — the freeze outran the gate.
+The plan's `Gates:` line reads **passed** for `Boundary:`. A `Polygraph:` segment is present only when the owner had the polygraph agent audit the plan; its absence is not a finding, and a `pending` one names an owner question still open — report it, never grade it.
 
 ### 6 · The changelog
 

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.17.3",
+  "version": "3.19.1",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -25,5 +25,5 @@
     }
   ],
   "docsRoot": "docs",
-  "digest": "f185538a48af"
+  "digest": "bc085dd8505c"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -36,7 +36,7 @@ import {
 } from "./lib/state.mjs";
 import { readSafe, relIfInside, today, SOURCE_EXT, commandRoot, docsRoot } from "./lib/repo.mjs";
 import { sweepResolvedRows, docLint, sourceLint, hasHeaderComment } from "./lib/sweep.mjs";
-import { listPlans, polygraphVerdict } from "./lib/plans.mjs";
+import { listPlans } from "./lib/plans.mjs";
 import { frozenStatusAtHead } from "./lib/frozen.mjs";
 import { undischargedDocRows } from "./lib/ledger.mjs";
 import { approvedPackages, rejectedPackages } from "./lib/approved.mjs";
@@ -49,6 +49,22 @@ import {
   pruneState,
 } from "./lib/claims.mjs";
 import { appendEvent } from "./lib/session-log.mjs";
+import { wallsAllowlist } from "./lib/graph-store.mjs";
+import { exitWallsAllowlist } from "./lib/exit-store.mjs";
+import { wallEnabled } from "./lib/walls.mjs";
+
+// Whether anything will ever read a row: a run whose allowlist switches off both walls the queue feeds —
+// the Stop wall and the commit wall — has nobody to drain it, so its rows would only ride the run's output
+// into the project (docs/harness/code/exit-check.md).
+function queueHasReader(projectDir) {
+  let allowlist = null;
+  try {
+    allowlist = wallsAllowlist(projectDir) ?? exitWallsAllowlist(projectDir);
+  } catch (e) {
+    allowlist = null;
+  }
+  return wallEnabled(allowlist, "queue") || wallEnabled(allowlist, "bookkeeping");
+}
 
 // ---------------------------------------------------------------------------
 // SessionStart
@@ -330,19 +346,6 @@ function detectorForFile(projectDir, rel, meta, rows) {
           })
         );
       }
-      // Whether the plan's documents are TRUE is the polygraph skill's judgment, not a hook's — so
-      // the gate's trace (the `Polygraph:` segment of the Gates line) is raised the same way the doc
-      // ledger is: a `needs-session:` row while it reads `pending` on a Complete plan. A plan with no
-      // segment predates the gate or runs under a harness that ships no polygraph — out of contract.
-      if (complete && polygraphVerdict(planText) === "pending") {
-        rows.push(
-          formatNeedsSessionRow({
-            date: meta.date,
-            description: `${rel} reached Status: Complete with its documents uncertified — run the polygraph skill (gate mode) and write its Polygraph: segment`,
-            refs: rel,
-          })
-        );
-      }
     }
     if (rel.startsWith(`${root}/`)) {
       const findings = docLint(projectDir, rel);
@@ -579,7 +582,7 @@ function postToolUse(projectDir, payload) {
       detectOutcomes(projectDir, meta, rows);
     }
   }
-  appendRows(projectDir, rows);
+  if (rows.length > 0 && queueHasReader(projectDir)) appendRows(projectDir, rows);
 }
 
 // ---------------------------------------------------------------------------

package/data/harnesses/code/hooks/compliance.mjs

@@ -25,6 +25,7 @@ import { appendEvent, unresolvedDenials, sessionLogPath, malformedEventLines } f
 import { approvedPackages, rejectedPackages } from "./lib/approved.mjs";
 import { claimActivity, releaseActivity, recentForeignTouches } from "./lib/claims.mjs";
 import { atStop, graphDenial, wallsAllowlist } from "./lib/graph-store.mjs";
+import { exitAtStop, exitWallsAllowlist, recordUnreadable } from "./lib/exit-store.mjs";
 import { WALLS, wallEnabled } from "./lib/walls.mjs";
 
 // --- the build graph's switch ------------------------------------------------------------
@@ -32,12 +33,13 @@ import { WALLS, wallEnabled } from "./lib/walls.mjs";
 // allowlist over lib/walls.mjs. Every wall it does not name is off for that session — because
 // the compliance set assumes a session that can dispatch a bookkeeper and a user who can answer
 // an ask, and a generation box has neither: its walls would be unresolvable blocks, not guard
-// rails. No graph, or a graph with no `mode` block, leaves every wall exactly as it was.
+// rails. No graph, or a graph with no `mode` block, leaves every wall exactly as it was. With no graph
+// declaring one, an exit set (docs/harness/code/exit-check.md) may carry the same block.
 let allowlistCache;
 function wallOn(projectDir, name) {
   if (allowlistCache === undefined) {
     try {
-      allowlistCache = wallsAllowlist(projectDir);
+      allowlistCache = wallsAllowlist(projectDir) ?? exitWallsAllowlist(projectDir);
     } catch (e) {
       allowlistCache = null; // a broken graph never switches a wall off
     }
@@ -524,6 +526,29 @@ function graphStop(projectDir, stopHookActive) {
   };
 }
 
+// The exit check (docs/harness/code/exit-check.md): authority, so a crash blocks rather than passes. It
+// blocks once — the box walls `.claude/state`, so the model cannot repair the file — and the second stop
+// records `blocked`, so the node still ends failed instead of met.
+function exitStop(projectDir, stopHookActive) {
+  let step;
+  try {
+    step = exitAtStop(projectDir);
+  } catch (e) {
+    const reason = `EXIT CHECK FAILED — ${e?.message || e}`;
+    if (!stopHookActive) {
+      return { decision: "block", reason: `${reason}. This node's exit set cannot be read, so it is not finished. (Said once — the next Stop ends the node blocked.)` };
+    }
+    try {
+      recordUnreadable(projectDir, reason);
+    } catch (e2) {
+      /* nowhere to record it; the box seals without a verdict and the run owner's own check decides */
+    }
+    return null;
+  }
+  if (!step || step.allow) return null;
+  return { decision: "block", reason: step.block };
+}
+
 function stopGate(projectDir, payload) {
   // The build graph is asked BEFORE the runtime's loop guard, and deliberately ignores it. The
   // guard exists because an unbounded Stop hook is a hang; the walker is bounded instead — every
@@ -538,6 +563,9 @@ function stopGate(projectDir, payload) {
   // hand-written graph should know it.
   const graph = graphStop(projectDir, payload.stop_hook_active);
   if (graph) return graph;
+  // The exit check is asked before the loop guard for the walker's reason: it is bounded by its own attempts.
+  const exit = exitStop(projectDir, payload.stop_hook_active);
+  if (exit) return exit;
 
   if (payload.stop_hook_active) return null; // the runtime's infinite-loop guard — never re-block
 

package/data/harnesses/code/hooks/lib/exit-store.mjs

@@ -0,0 +1,152 @@
+// harness/code/hooks/lib/exit-store.mjs — the exit check: what a NuStack generation box hands the harness
+// instead of a build graph. The box writes `.claude/state/exit.json` naming the documents a node owes; at
+// every Stop this module checks that each one EXISTS — never its shape — and hands the turn back naming what
+// is missing until the attempts run out, then records `blocked` (docs/harness/code/exit-check.md).
+//
+// This is authority, not hygiene: the caller turns a thrown error into a block, never a pass.
+
+import fs from "node:fs";
+import path from "node:path";
+import { atomicWrite, stateDir } from "./state.mjs";
+
+export const EXIT_VERSION = 1;
+export const EXIT_FILE = "exit.json";
+export const EXIT_VERDICT_FILE = "exit-verdict.json";
+
+const SKIPPED_DIRS = new Set(["node_modules", ".git"]);
+
+// Read through a plain join: absence is dormancy, and asking must never create the folder.
+export function exitFile(projectDir) {
+  return path.join(projectDir, ".claude", "state", EXIT_FILE);
+}
+
+export function exitVerdictFile(projectDir) {
+  return path.join(stateDir(projectDir), EXIT_VERDICT_FILE);
+}
+
+// Absent → null. Present but not a v1 exit set → throws: a set nobody can read is not a set that is met.
+export function loadExit(projectDir) {
+  let text;
+  try {
+    text = fs.readFileSync(exitFile(projectDir), "utf8");
+  } catch (e) {
+    return null;
+  }
+  const set = JSON.parse(text);
+  const attempts = set?.attempts;
+  if (!set || set.v !== EXIT_VERSION || !Array.isArray(set.owed) || !Number.isInteger(attempts?.used) || !Number.isInteger(attempts?.max)) {
+    throw new Error(`.claude/state/${EXIT_FILE} is not a v${EXIT_VERSION} exit set`);
+  }
+  return set;
+}
+
+// `*` matches within one path segment; everything else is literal.
+export function globMatches(glob, rel) {
+  const pattern = glob
+    .split("*")
+    .map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&"))
+    .join("[^/]+");
+  return new RegExp(`^${pattern}$`).test(rel);
+}
+
+function isFile(projectDir, rel) {
+  try {
+    return fs.statSync(path.join(projectDir, rel)).isFile();
+  } catch (e) {
+    return false;
+  }
+}
+
+// How many files match a glob, walking only below its literal prefix.
+function globCount(projectDir, glob) {
+  const segments = glob.split("/");
+  const wild = segments.findIndex((segment) => segment.includes("*"));
+  const base = wild === -1 ? path.posix.dirname(glob) : segments.slice(0, wild).join("/");
+  let count = 0;
+  const walk = (rel) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(path.join(projectDir, rel), { withFileTypes: true });
+    } catch (e) {
+      return;
+    }
+    for (const entry of entries) {
+      if (SKIPPED_DIRS.has(entry.name)) continue;
+      const child = rel ? `${rel}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) walk(child);
+      else if (entry.isFile() && globMatches(glob, child)) count += 1;
+    }
+  };
+  walk(base === "." ? "" : base);
+  return count;
+}
+
+// The owed entries not on disk: a path that is not a file, or a glob matching fewer files than its floor.
+export function missingOf(projectDir, set) {
+  const missing = [];
+  for (const entry of set.owed) {
+    if (typeof entry?.path === "string") {
+      if (!isFile(projectDir, entry.path)) missing.push({ type: entry.type, path: entry.path });
+    } else if (typeof entry?.glob === "string") {
+      const min = Number.isInteger(entry.min) && entry.min > 0 ? entry.min : 1;
+      const found = globCount(projectDir, entry.glob);
+      if (found < min) missing.push({ type: entry.type, glob: entry.glob, min, found });
+    } else {
+      throw new Error(`an owed entry names neither a path nor a glob: ${JSON.stringify(entry)}`);
+    }
+  }
+  return missing;
+}
+
+function describeMissing(entry) {
+  return entry.path
+    ? `\`${entry.path}\` (${entry.type})`
+    : `at least ${entry.min} file(s) matching \`${entry.glob}\` (${entry.type}, ${entry.found} found)`;
+}
+
+export function writeVerdict(projectDir, verdict) {
+  atomicWrite(exitVerdictFile(projectDir), `${JSON.stringify({ v: EXIT_VERSION, ...verdict }, null, 2)}\n`);
+}
+
+// Stop: null when dormant; `{ allow, verdict }` when the set is met or its attempts are spent; `{ block }` otherwise, charging one attempt.
+export function exitAtStop(projectDir) {
+  const set = loadExit(projectDir);
+  if (!set) return null;
+  const missing = missingOf(projectDir, set);
+  const nodeSlug = set.nodeSlug ?? null;
+  if (missing.length === 0) {
+    writeVerdict(projectDir, { nodeSlug, verdict: "done", missing, attempts: set.attempts });
+    return { allow: true, verdict: "done", missing };
+  }
+  if (set.attempts.used >= set.attempts.max) {
+    writeVerdict(projectDir, { nodeSlug, verdict: "blocked", missing, attempts: set.attempts });
+    return { allow: true, verdict: "blocked", missing };
+  }
+  const attempts = { ...set.attempts, used: set.attempts.used + 1 };
+  atomicWrite(exitFile(projectDir), `${JSON.stringify({ ...set, attempts }, null, 2)}\n`);
+  const left = attempts.max - attempts.used;
+  return {
+    block:
+      `EXIT CHECK — this node owes documents that do not exist yet: ${missing.map(describeMissing).join("; ")}. Write them, then stop. ` +
+      (left > 0
+        ? `This stop was handed back; ${left} more will be, and after that the node ends blocked.`
+        : "The next stop ends the node blocked if any of them is still missing."),
+    missing,
+    attempts,
+  };
+}
+
+// A set that cannot be read still ends the node — as blocked, naming why — rather than as met.
+export function recordUnreadable(projectDir, reason) {
+  writeVerdict(projectDir, { nodeSlug: null, verdict: "blocked", missing: [{ type: "exit-check", reason }], attempts: { used: 0, max: 0 } });
+}
+
+// The set's `mode.walls` allowlist, or null. A broken file switches no wall off: hygiene fails open.
+export function exitWallsAllowlist(projectDir) {
+  try {
+    const set = loadExit(projectDir);
+    return Array.isArray(set?.mode?.walls) ? set.mode.walls : null;
+  } catch (e) {
+    return null;
+  }
+}

package/data/harnesses/code/hooks/lib/plans.mjs

@@ -28,16 +28,7 @@ export function inPlanScope(rel, scope) {
   });
 }
 
-// The plan's Polygraph gate, read from its Gates line: 'pending' · 'passed' · 'owes nothing' ·
-// null when the line carries no segment (a plan that predates the gate, or a repo whose harness
-// ships no polygraph — both out of contract, both pass).
-export function polygraphVerdict(text) {
-  const gates = (/^\*\*Gates:\*\*\s*(.+)$/m.exec(text || "") || [])[1] || "";
-  const m = /Polygraph:\s*(pending|passed|owes nothing)\b/i.exec(gates);
-  return m ? m[1].toLowerCase() : null;
-}
-
-// Every plan in the folder, parsed once: { file, status, gates, polygraph, scope, hasLedger,
+// Every plan in the folder, parsed once: { file, status, gates, scope, hasLedger,
 // hasDocLedger, ledgerRows }. `gates` is null on legacy plans (pre-Gates format).
 export function listPlans(projectDir) {
   const dir = path.join(projectDir, docsRoot(projectDir), "history", "plans");
@@ -56,7 +47,6 @@ export function listPlans(projectDir) {
       file,
       status,
       gates: (/^\*\*Gates:\*\*\s*(.+)$/m.exec(text) || [])[1]?.trim() || null,
-      polygraph: polygraphVerdict(text),
       scope: planScopePaths(text),
       hasLedger: /^##\s+Test Obligations\b/m.test(text),
       hasDocLedger: /^##\s+Doc Obligations\b/m.test(text),

package/data/harnesses/code/skills/documentation/templates/plan.md

@@ -8,13 +8,13 @@ The `boundary` skill parses the **Proposed Changes** sections to check boundary
 
 **Doc Obligations is the one ledger the plan's author writes.** Deriving tests from behavior is judgment, which is why `testing` owns that section and it is marked never-hand-author; resolving Proposed Changes' file paths to the feature docs that own them is a **lookup** against the ownership index already injected at session start. Different work, different rule — fill it yourself, while the touch list is fresh.
 
-The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. **`Polygraph:`** is the completion gate's trace: it reads `Polygraph: pending` from the first draft until the `polygraph` skill (gate mode) certifies the plan's documents — every Doc Obligations row discharged **updated** plus every `Spec:` doc — and rewrites it to `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`. A plan that touched no document writes `Polygraph: owes nothing — {reason}` by hand; nothing else on this segment is ever hand-written. A Complete plan still reading `pending` raises a `needs-session:` queue row and fails CI. Never hand-edit the line to skip a gate.
+The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. A **`Polygraph:`** segment appears only when the user has the `polygraph` agent audit the plan's documents — it appends `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`, or `Polygraph: pending` while an owner question is open. It is a trace for readers, never an obligation: a plan carries none by default, no hook or CI check reads it, and it is never hand-written. Never hand-edit the line to skip a gate.
 
 ```
 # {Feature Name}
 
 **Status:** Draft | In Progress | Complete | Abandoned
-**Gates:** Boundary: pending · Polygraph: pending
+**Gates:** Boundary: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
 **Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete — along with every ledger Outcome cell: the flip freezes the file instantly, so anything left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->

package/data/harnesses/code/skills/polygraph/SKILL.md

@@ -1,71 +1,22 @@
 ---
 name: polygraph
-description: "Use when a document's truth is in question — audit a named doc, feature, folder, or code path against the code — and at every plan completion, where gate mode certifies the plan's docs before the freeze. Never the whole tree by reflex; not docs health, boundary, or the verification gate."
+description: /polygraph <target> — dispatch the polygraph agent on a doc, feature, folder, code path, or plan. User-invoked only; the model never loads this on its own.
+disable-model-invocation: true
 ---
 
-# Polygraph — two witnesses, one verdict
+# /polygraph — the user's door to the audit
 
-Code and docs are two witnesses to the same product, and each lies in its own direction: documents describe designs the code never built, code runs behaviour no document learned. The audit checks a document's claims against the code, presumes the code correct unless a standing decision names it for retirement, corrects the document, registers the code-side findings, and puts to the owner what evidence cannot settle. It runs at two moments and nowhere else:
+The docs-truth audit is the **`polygraph` agent** (`.claude/agents/polygraph.md` in a consumer repo, `agents/polygraph.md` in etna), and it runs only when the user asks. This command is that ask, made explicit: `/polygraph docs/features/billing.md`, `/polygraph billing`, `/polygraph docs/architecture/`, `/polygraph src/billing/`, or `/polygraph docs/history/plans/2026-09-01-billing.md`.
 
-| Moment | Mode | Ends with |
-| --- | --- | --- |
-| Any time, on a named target — a doc, a feature, a folder of docs, or a code path resolved to its owning docs | **Audit** | the target corrected, code-side rows registered, verdict counts reported |
-| Plan completion — after the verification gate has discharged and the Doc Obligations rows read **updated**, before the freeze | **Gate** | the same, over the plan's docs, plus the plan's `Polygraph:` segment |
+1. **Dispatch the `polygraph` agent** with the argument as its target, word for word. No argument ⇒ ask for one and dispatch nothing.
+2. **Relay its report** to the user as it came — the counts, the corrections, the register rows, and every open question in full. Its questions are the user's to answer; never answer them yourself, and never fold an unanswered question into a doc edit.
+3. **An answer goes back as a further dispatch** to the same agent — the row id, the question, and the user's words verbatim — and its report closes the loop.
 
-You are the **primary**: you hold the conversation, compose every context pack and packet, judge every contested verdict, and write the segment. Agents sweep and apply; a verdict is never delegated, and neither is a word said to the owner.
+This folder also carries what the agent reads and runs, so it ships wherever the agent does:
 
-References — read the routed file in full at the named moment:
-
-| Reference | Load when |
+| Path | Read by |
 | --- | --- |
-| `references/rows.md` | writing or reading any row; judging CONTESTED, QUESTION, residue, or a document's right to exist |
-| `references/dispatch.md` | composing a context pack, dispatching any role, packeting, recovering a dead or capped agent, pricing a run |
-
-## Standing rules
-
-1. **Code is presumed correct — unless a standing decision names it.** The precedent pack decides by **naming**: a decision condemns code only when it names the file, table, route, command, or surface by the product's own name for it, and the row quotes the naming words. A resembling thing is not a match; arguable → QUESTION. Documenting undocumented code is the mechanically easiest resolution and quietly canonizes a retiring lane; condemning on a resemblance retires code the product still ships. The full test is `references/rows.md` § The residue guard.
-2. **No citation, no row** — `file:line`, or the exact command and its result. Prove or refute, never confirm by plausibility.
-   **A documented behaviour the code lacks is UNBUILT, never MISDESCRIBED.** The document may be stating the target design; rewriting it to match the code silently abandons that design. Without the repo's unbuilt marker on the passage or a precedent naming the subject, the row is a QUESTION for the owner, and the passage stands until the answer.
-3. **Finders never edit; appliers never judge; the audit never edits code.** A code-side finding leaves as a register row for the planning workflow, however small and however directly it is asked for; a source fix asked for *inside* the audit is refused, registered, and answered with the one thing that would let it happen — a separate ask outside the audit. **Markdown is not source**: every document read may be edited under the applier discipline; frozen records are exempt.
-4. **The applier re-check is the gate.** Every row is re-derived against today's tree before its doc is touched; a claim that fails to reproduce dies as *did not reproduce* and never becomes an edit. This is what lets a row be applied by an agent that never saw the finder's reasoning.
-5. **Rows live on disk, never in your context.** Partials, packets, and outcomes land under `.claude/state/polygraph/{run}/`; you re-read files. The folder is machine-local and you delete it when the run closes — in the same turn as the report, **whatever is still open**: the reply carries every open row in full, an owner's answer starts a new run over those rows only, and the changelog entry of the commit is the record. Nothing under `.claude/state/polygraph/` outlives the reply.
-6. **The owner's answer is applied in the same pass** — verbatim in the doc it settles, quoted in the changelog entry's Ask line. There is no question ledger to park it in.
-
-## The run
-
-Both modes run the same sequence; the modes differ only in how the target list and the closing write are derived.
-
-1. **Resolve the targets.** A doc path is a target; a feature name resolves to `docs/features/{feature}.md`; a folder yields every doc in it; a code path resolves through the injected ownership index to the docs whose `owns:` globs match — or, when no index is in context, by scanning the `owns:` frontmatter under the docs root. A code path with no owner is **reported, never refused** — say which paths are unowned and go on with the rest. A target with no document at all is the one refusal: there is nothing to audit.
-2. **Price it and say so** before dispatching when the target list exceeds ten documents: per-doc cost at the pinned tier, the wave count under the runtime's concurrency ceiling, and the total. An owner directive to run on a stronger tier is priced the same way — state the multiplier and record the directive in the changelog entry.
-3. **Write one context pack per doc** (`references/dispatch.md` § The context pack) — the doc's `owns:` globs, the code paths in question, the precedent quotations that name this subject, the register rows already tracking it, and the owner rulings that bind. The pack is the agent's whole reading list.
-4. **Dispatch one `polygraph-finder` per doc**, in waves under the concurrency ceiling. Each writes its partial to the run folder and returns at most 120 words. A finder that returns **partial** at its turn cap is resumed once from its partial on disk; a second partial is accepted as that doc's sweep and reported as such.
-5. **Merge and check.** Concatenate the partials into `findings.psv`, quarantine malformed lines into `malformed.txt` (kept, never silently repaired), run `scripts/audit.mjs {run}` and fix what it reports by hand.
-6. **Judge.** Read every non-COHERENT row's evidence yourself. CONTESTED rows you judge with both sets of evidence in hand; a row you doubt goes to a `polygraph-verifier` (claim and subject only) and comes back CONTESTED if the two disagree. QUESTION rows — and every proposed deletion, with its inbound count — go to the owner **now, inline**, batched and ranked by how many rows each answer unblocks; work proceeds on everything else while they are open.
-7. **Packet and apply.** One doc, one `polygraph-applier`, always — `audit.mjs` asserts no collision. MISDESCRIBED rows and in-scope UNDOCUMENTED rows that passed the residue guard go to the owning doc's packet; RESIDUE, UNBUILT-abandoned, and every code-side row go to the register (the backlog, in its existing grammar, deduped against what is already there); frozen records resolve `exempt-frozen`. Fold each applier's outcome file into row status by hand, then run `audit.mjs` again.
-8. **Run the repo's doc gates in your own seat** — lint, links, ownership — over every doc touched; a delegated gate that dies reports nothing, which reads exactly like a pass.
-9. **Report** in prose: docs audited, claims checked, corrected, registered, contested-and-judged, questions answered, comment claims rescued into their doc and comment residue registered; the refuted-on-apply count is the quality signal, stated every time. Then delete the run folder — also when rows are still open for the owner; they are in the reply.
-
-## Gate mode — the closing write
-
-Gate mode's target list is **every Doc Obligations row discharged as `updated` plus every `Spec:` doc**, and its code scope is the plan's Proposed Changes paths together with those docs' `owns:` globs. It runs after the verification gate and the Doc Obligations discharge, before `Status: Complete` is written — the freeze waits for it, and the harness's completion policy says so. The skill writes the `Polygraph:` segment and nothing else on the plan: the status flip is the author's, in the discharge-then-freeze edit.
-
-Ends by rewriting your own segment of the plan's **`Gates:`** line, exactly:
-
-- `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)` — every target swept, every non-QUESTION row resolved.
-- `Polygraph: owes nothing — {reason}` — written by the plan's **author**, not by you, when the plan has no `Spec:` doc and its Doc Obligations row is `None`, or when the repo's harness ships no polygraph.
-
-A QUESTION the owner has not answered leaves the segment at `pending`; the plan stays open, and the completion machinery says why. Never write `passed` over an open question.
-
-## Economy
-
-The tier is pinned in the three agent definitions — the cheapest capable tier, low to medium effort, a turn cap — never chosen at dispatch. The strong tier's value concentrates in judgment, and every judgment in this skill is yours. Where a role agent is not installed (a runtime whose plugin channel carries skills only), dispatch an independent subagent on the cheapest capable tier with the role's body inline, and say so in the report.
-
-## What this skill is NOT
-
-- **Routine docs health** — stale globs, broken links, structural drift: the `maintenance` agent.
-- **A plan's contract check** — both sides of a boundary for a diff or plan: the `boundary` skill.
-- **Test verification** — proving built behaviour: the `testing` skill.
-- **A whole-tree audit by reflex.** The tree is audited one target at a time, and every plan certifies its own docs; a full sweep is an explicit ask, priced before it runs.
-- **A code editor** — code-side findings exit as register rows (standing rule 3).
-
-If the request is one of these, say so and redirect — don't adapt.
+| `references/rows.md` | the agent — the ten-field row, the seven verdicts, the residue guard, frozen records, a document's right to exist |
+| `references/dispatch.md` | the agent — the run folder, the context pack, the three roles, packets, verification, fold-back, recovery, price |
+| `scripts/audit.mjs` | the agent — the read-only arithmetic over a run folder |
+| `evals/` | authoring time only; never shipped |

package/data/harnesses/code/skills/polygraph/references/dispatch.md

@@ -24,7 +24,7 @@ One page per target document, written by you before the first dispatch. A brief
 
 | Section | Content |
 | --- | --- |
-| Target | the doc path; in gate mode, the plan path and the Proposed Changes paths that intersect this doc's `owns:` |
+| Target | the doc path; for a plan target, the plan path and the Proposed Changes paths that intersect this doc's `owns:` |
 | Code | the doc's `owns:` globs, resolved to the files that exist today |
 | Precedent | the quotations from guardrails, accepted decisions, and doctrine that **name** a subject this doc covers — the naming words only, with `path:line` |
 | Already tracked | backlog and register rows that name a subject this doc covers, as `path:line` |

package/data/harnesses/delivery/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.34",
+  "version": "0.2.35",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -10,5 +10,5 @@
   "seeds": [],
   "tools": [],
   "docsRoot": "docs",
-  "digest": "1d2b1f2607d6"
+  "digest": "f4807d25316f"
 }

package/data/harnesses/delivery/skills/documentation/templates/plan.md

@@ -8,13 +8,13 @@ The `boundary` skill parses the **Proposed Changes** sections to check boundary
 
 **Doc Obligations is the one ledger the plan's author writes.** Deriving tests from behavior is judgment, which is why `testing` owns that section and it is marked never-hand-author; resolving Proposed Changes' file paths to the feature docs that own them is a **lookup** against the ownership index already injected at session start. Different work, different rule — fill it yourself, while the touch list is fresh.
 
-The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. **`Polygraph:`** is the completion gate's trace: it reads `Polygraph: pending` from the first draft until the `polygraph` skill (gate mode) certifies the plan's documents — every Doc Obligations row discharged **updated** plus every `Spec:` doc — and rewrites it to `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`. A plan that touched no document writes `Polygraph: owes nothing — {reason}` by hand; nothing else on this segment is ever hand-written. A Complete plan still reading `pending` raises a `needs-session:` queue row and fails CI. Never hand-edit the line to skip a gate.
+The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. A **`Polygraph:`** segment appears only when the user has the `polygraph` agent audit the plan's documents — it appends `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`, or `Polygraph: pending` while an owner question is open. It is a trace for readers, never an obligation: a plan carries none by default, no hook or CI check reads it, and it is never hand-written. Never hand-edit the line to skip a gate.
 
 ```
 # {Feature Name}
 
 **Status:** Draft | In Progress | Complete | Abandoned
-**Gates:** Boundary: pending · Polygraph: pending
+**Gates:** Boundary: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
 **Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete — along with every ledger Outcome cell: the flip freezes the file instantly, so anything left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->

package/data/harnesses/etna/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.5.24",
+  "version": "1.5.25",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -10,5 +10,5 @@
   "seeds": [],
   "tools": [],
   "docsRoot": "docs",
-  "digest": "ee486a3733a1"
+  "digest": "d84075a6eda5"
 }

package/data/harnesses/etna/skills/documentation/templates/plan.md

@@ -8,13 +8,13 @@ The `boundary` skill parses the **Proposed Changes** sections to check boundary
 
 **Doc Obligations is the one ledger the plan's author writes.** Deriving tests from behavior is judgment, which is why `testing` owns that section and it is marked never-hand-author; resolving Proposed Changes' file paths to the feature docs that own them is a **lookup** against the ownership index already injected at session start. Different work, different rule — fill it yourself, while the touch list is fresh.
 
-The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. **`Polygraph:`** is the completion gate's trace: it reads `Polygraph: pending` from the first draft until the `polygraph` skill (gate mode) certifies the plan's documents — every Doc Obligations row discharged **updated** plus every `Spec:` doc — and rewrites it to `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`. A plan that touched no document writes `Polygraph: owes nothing — {reason}` by hand; nothing else on this segment is ever hand-written. A Complete plan still reading `pending` raises a `needs-session:` queue row and fails CI. Never hand-edit the line to skip a gate.
+The **`Gates:`** line carries two machine-read segments. The compliance hook greps **`Boundary:`** — implementation edits inside the plan's scope are blocked while it reads `Boundary: pending`; the `boundary` skill rewrites it to `Boundary: passed YYYY-MM-DD` or `Boundary: blocked YYYY-MM-DD`. The other two plan gates are enforced by **section presence**: a plan with no `## Test Obligations` or no `## Doc Obligations` section blocks the same edits — the sections are the artifacts, and the gate derives from them, not from a claim about them. A **`Polygraph:`** segment appears only when the user has the `polygraph` agent audit the plan's documents — it appends `Polygraph: passed YYYY-MM-DD (N docs · N claims · N corrected · N registered)`, or `Polygraph: pending` while an owner question is open. It is a trace for readers, never an obligation: a plan carries none by default, no hook or CI check reads it, and it is never hand-written. Never hand-edit the line to skip a gate.
 
 ```
 # {Feature Name}
 
 **Status:** Draft | In Progress | Complete | Abandoned
-**Gates:** Boundary: pending · Polygraph: pending
+**Gates:** Boundary: pending
 **Spec:** [docs/features/{feature}.md](../../features/{feature}.md)   <!-- one line per feature doc this plan implements against; a plan spanning three features names three -->
 **Started:** YYYY-MM-DD
 **Completed:** YYYY-MM-DD   <!-- fill in the SAME edit that flips Status to Complete — along with every ledger Outcome cell: the flip freezes the file instantly, so anything left for a second edit is unreachable (the frozen-record gate rightly blocks it) -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/etna",
-  "version": "0.20.21",
+  "version": "0.20.23",
   "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
   "type": "module",
   "bin": {
@@ -42,5 +42,5 @@
     "agent",
     "plugin"
   ],
-  "etnaFingerprint": "8655c94e9d47"
+  "etnaFingerprint": "722680de8132"
 }