@popovych.co/witness 0.14.0 → 0.14.2

package/dist/drive.js

@@ -47,11 +47,12 @@ export function classifyAction(action, root) {
     if (line.includes('merge PR') || (action.note?.includes('merge PR') ?? false)) {
         return { kind: 'merge', line: action.note?.includes('merge PR') ? action.note : line };
     }
-    // `witness check` is computeNext's terminal answer. It carries two states that the
-    // action alone cannot tell apart — nothing to route, and canon errors that stopped
-    // routing early — so idle PRINTS the line rather than swallowing it: a human who sees
-    // `drive: idle — witness check` runs the verb that distinguishes them. Spawning a
-    // session to guess would burn a context on a diagnosis one command answers.
+    // `witness check` is computeNext's terminal answer in two states: canon errors that
+    // stopped routing early (bare line), and an exhausted ladder (line + a "nothing is
+    // owed" note, D157). Idle PRINTS the line rather than swallowing it: a human who sees
+    // `drive: idle — witness check` runs the verb, and the note has already told the
+    // routed session which state it is in. Spawning a session to guess would burn a
+    // context on a diagnosis one command answers.
     if (line === 'witness check' && action.stage === undefined)
         return { kind: 'idle' };
     return { kind: 'spawn', home: action.home ?? root, stage: action.stage, target: action.target, model: action.model };

package/dist/gates/plan.js

@@ -3,7 +3,7 @@ import { serializeDoc } from '../fm.js';
 import { canonicalSha, short } from '../sha.js';
 import { latestRecap } from '../journal.js';
 import { baseForSpec } from '../history.js';
-import { findById } from '../scan.js';
+import { findById, plannableParent } from '../scan.js';
 import { effortOf, planPairSha } from '../reviewed.js';
 import { validateDoc } from '../schemas.js';
 import { registerGate } from '../gate.js';
@@ -29,9 +29,7 @@ registerGate({
         const schemaProblems = validateDoc(plan.meta, plan.body).map((x) => `${x.field}:${x.rule}`);
         checks.push({ name: 'schema', ok: schemaProblems.length === 0, detail: schemaProblems.slice(0, 5).join(' · ') });
         const parentStatus = String(parent.meta.status);
-        const parentOk = parent.meta.type === 'principles'
-            ? parentStatus === 'approved'
-            : parentStatus === 'approved' || parentStatus === 'live';
+        const parentOk = plannableParent(parent);
         checks.push({ name: 'parent-approved', ok: parentOk,
             detail: `${String(parent.meta.id)} is ${parentStatus}` });
         const parentSha = canonicalSha(parent.meta, parent.body);

package/dist/gitio.js

@@ -2,11 +2,17 @@ import { execFileSync } from 'node:child_process';
 import { dirname } from 'node:path';
 import { canonPaths } from './config.js';
 import { ok, refuse, v } from './refusal.js';
+// D158 (#20). A reviewer-bound diff is legitimately multi-megabyte and Node's spawnSync
+// default is 1 MiB, which crashed ship/gate as `spawnSync git ENOBUFS` — and, worse,
+// silently truncated every tryGit consumer into a wrong answer. Sized like reviewer.ts's
+// 64 MiB and ship.ts's 16 MiB; V8's string ceiling bounds any sync read regardless.
+const GIT_MAX_BUFFER = 256 * 1024 * 1024;
 export function git(root, ...args) {
     return execFileSync('git', args, {
         cwd: root,
         encoding: 'utf8',
         stdio: ['ignore', 'pipe', 'pipe'],
+        maxBuffer: GIT_MAX_BUFFER,
     }).replace(/\n$/, '');
 }
 export function tryGit(root, ...args) {

package/dist/matcher.js

@@ -35,7 +35,15 @@ export function sourceTags(root, excludes) {
         if (skip.some((re) => re.test(rel)))
             continue;
         const abs = join(root, rel);
-        if (!existsSync(abs) || statSync(abs).size > MAX_SCAN_BYTES)
+        if (!existsSync(abs))
+            continue;
+        // D159 (#23). The listing is paths, not files: `--cached` includes a gitlink
+        // (submodule, mode 160000) and `--others` a symlink to a directory (skills-add
+        // wiring) — both stat as directories whose size clears the cap, and readFileSync
+        // threw EISDIR. Same isFile() guard codePromptBody applies to untracked paths;
+        // first shipped as a hand patch in a consumer's npx cache, upstreamed here.
+        const st = statSync(abs);
+        if (!st.isFile() || st.size > MAX_SCAN_BYTES)
             continue;
         const content = readFileSync(abs, 'utf8');
         if (content.includes('\0'))

package/dist/runner.js

@@ -43,7 +43,10 @@ export function criteriaExcludes(cfg) {
 }
 export function execCommand(runRoot, ctx, cmd) {
     try {
-        const out = execSync(cmd, { cwd: runRoot, env: ctx.env, stdio: 'pipe' });
+        // D158. Suite stdout is unbounded and only the last 4000 chars are kept — but at
+        // Node's 1 MiB default a chatty GREEN suite threw ENOBUFS into the catch and read
+        // as a failed lane. 64 MiB: the same bound the reviewer spawn uses.
+        const out = execSync(cmd, { cwd: runRoot, env: ctx.env, stdio: 'pipe', maxBuffer: 64 * 1024 * 1024 });
         return { exitZero: true, output: String(out).slice(-4000) };
     }
     catch (e) {

package/dist/scan.js

@@ -45,6 +45,13 @@ export function criteriaOwner(canon, id) {
 export function findById(canon, id) {
     return canon.docs.find((d) => d.meta.id === id);
 }
+// D157. The one derivation of "this doc can parent a plan today". `verbs/next.ts`'s
+// queue and `gates/plan.ts`'s parent check both consume it; a second derivation is the
+// drift that left `next` refusing to emit the exact command the gate accepts (issue #21).
+export function plannableParent(doc) {
+    const s = String(doc.meta.status);
+    return doc.meta.type === 'principles' ? s === 'approved' : s === 'approved' || s === 'live';
+}
 export function findCycle(canon, extra) {
     const deps = new Map();
     for (const d of canon.docs) {

package/dist/verbs/next.js

@@ -4,7 +4,7 @@ import { EXIT } from '../cli.js';
 import { loadConfig } from '../config.js';
 import { pendingTxn } from '../txn.js';
 import { primaryRoot } from '../gitio.js';
-import { findById, loadCanon } from '../scan.js';
+import { findById, loadCanon, plannableParent } from '../scan.js';
 import { designArtifactCurrent, designPending, designUnseen } from '../design.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from '../journal.js';
 import { diffReviewedSha, effortOf, effortReviewedSha, effortSpecs, effortWrites, implementReviewedSha, planPairSha } from '../reviewed.js';
@@ -425,6 +425,22 @@ function liveOwner(root, efforts, ...ids) {
         .map((id) => efforts.find((e) => effortWrites(root, e.slug).has(id))?.slug)
         .find((slug) => slug !== undefined);
 }
+// D157. The queue offered `<spec>-plan-1` unconditionally, which amends a DONE plan the
+// moment a spec earns a second slice. An abandoned id is re-authorable — `write` returns
+// it to draft — so the lowest abandoned suffix is offered back; otherwise the first
+// unused one. When this runs, the spec's plans are all done or abandoned by filter B.
+function nextPlanId(plans, spec) {
+    const suffixed = plans
+        .map((p) => ({ id: String(p.meta.id), status: String(p.meta.status) }))
+        .filter((p) => p.id.startsWith(`${spec}-plan-`))
+        .map((p) => ({ n: Number(p.id.slice(`${spec}-plan-`.length)), status: p.status }))
+        .filter((p) => Number.isInteger(p.n) && p.n > 0);
+    const abandoned = suffixed.filter((p) => p.status === 'abandoned').map((p) => p.n);
+    if (abandoned.length > 0)
+        return `${spec}-plan-${Math.min(...abandoned)}`;
+    const taken = suffixed.map((p) => p.n);
+    return `${spec}-plan-${taken.length > 0 ? Math.max(...taken) + 1 : 1}`;
+}
 // The stage rides with the line: routing to a recap is BRAINSTORM work, and a caller that
 // kept its own `stage: 'plan'` would hand the plan skill a recap command to run.
 function planWriteAction(root, efforts, planId, parentId, target) {
@@ -607,8 +623,20 @@ export function computeNext(root, ctx, canon, cfg) {
         const s = String(doc.meta.status);
         return doc.meta.type === 'plan' ? s === 'done' : s === 'live' || doc.meta.type === 'principles';
     };
+    // D157. A spec is queued when the plan gate would accept it as a parent AND someone owes
+    // it a plan. `approved` is owed by definition (decompose just passed). `live` is owed
+    // only while a live effort that wrote it owns zero non-abandoned plans — efforts never
+    // auto-terminate, so without that clause every finished spec would queue forever.
+    // Reaching this rung proves decompose is settled: rung 6 returns first otherwise.
+    const owedByEffort = (id) => efforts.some((e) => {
+        const w = effortWrites(root, e.slug);
+        if (!w.has(id))
+            return false;
+        return !plans.some((p) => w.has(String(p.meta.id)) && String(p.meta.status) !== 'abandoned');
+    });
     const planless = canon.docs
-        .filter((d) => d.meta.type === 'spec' && String(d.meta.status) === 'approved')
+        .filter((d) => d.meta.type === 'spec' && plannableParent(d))
+        .filter((d) => String(d.meta.status) === 'approved' || owedByEffort(String(d.meta.id)))
         .filter((d) => !plans.some((p) => String(p.meta.parent) === String(d.meta.id) &&
         !['done', 'abandoned'].includes(String(p.meta.status))))
         .filter((d) => (d.meta.depends ?? []).every(ready))
@@ -617,9 +645,9 @@ export function computeNext(root, ctx, canon, cfg) {
         // A spec whose plan write can actually be booked outranks one that needs a new effort
         // opened first — stalling the whole pipeline on a recap while runnable work sits behind
         // it is a worse answer, and alphabetical order alone does not know the difference.
-        const spec = planless.find((s) => liveOwner(root, efforts, `${s}-plan-1`, s) !== undefined)
+        const spec = planless.find((s) => liveOwner(root, efforts, nextPlanId(plans, s), s) !== undefined)
             ?? planless[0];
-        const act = planWriteAction(root, efforts, `${spec}-plan-1`, spec, spec);
+        const act = planWriteAction(root, efforts, nextPlanId(plans, spec), spec, spec);
         if (planless.length <= 1)
             return act;
         // The note said `multiple ready — choose: a b c`, which is a list, not a ranking: it
@@ -653,7 +681,11 @@ export function computeNext(root, ctx, canon, cfg) {
             return { line: `witness start ${String(plan.meta.id)}`, target: String(plan.meta.id) };
         }
     }
-    return { line: 'witness check' };
+    // Rule B — the ladder is exhausted. Same line as rule A (canon errors, the early
+    // return above) but a different state; the note is what tells them apart on screen
+    // (D157 — the missing note is what turned issue #21 from a one-command diagnosis
+    // into a filed bug).
+    return { line: 'witness check', ...noteOf('nothing is owed — no effort, spec or plan has a next step; a clean check confirms it') };
 }
 // Exported for `drive`, which claims a flow with the same `--flow` semantics `next` has:
 // a claim that refuses when false. A second copy of these three refusals would be a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@popovych.co/witness",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Evidence-gated spec-driven development pipeline for AI coding agents: brainstorm to PR in six stages, where specs are state, plans are motion, and no transition passes without evidence. Drives from Claude Code or Pi.",
   "keywords": [
     "spec-driven-development",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "witness",
   "description": "Spec-driven development with evidence gates: brainstorm → PR through six stages and five gates. Skills author, the pinned witness CLI writes state and witnesses evidence; gates stop where judgment is owed.",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "author": {
     "name": "Kostiantyn Popovych"
   },

package/plugin/commands/witness.md

@@ -10,7 +10,7 @@ The CLI decides, you act. If `$ARGUMENTS` contains `--manual`, append `--manual`
 Resolve the CLI once:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.0}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
 ```
 
 If the repo has no `witness.config.yaml`, run `$WITNESS init` first (one bootstrap commit), then proceed. If init or any verb refuses on a dirty tree, the human commits or cleans it — **never `git commit` yourself, anywhere, at any stage**: the CLI makes its own state commits, and the ship phase makes the sole code commit.

package/plugin/hooks/session-dashboard.sh

@@ -3,4 +3,4 @@
 # context). Silent everywhere that isn't a witness repo; failures swallowed:
 # session start must never hang or die on this.
 [ -f witness.config.yaml ] || exit 0
-${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.0} 2>/dev/null || true
+${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2} 2>/dev/null || true

package/plugin/skills/witness-brainstorm/SKILL.md

@@ -15,7 +15,7 @@ witness: ends in a confirmed scope recap, writes no document. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.0}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-decompose/SKILL.md

@@ -10,7 +10,7 @@ description: Slice a witness effort's confirmed recap into vertical spec slices,
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.0}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-design/SKILL.md

@@ -16,7 +16,7 @@ No text copied verbatim; the design-critic lens is new material. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.0}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-implement/SKILL.md

@@ -15,7 +15,7 @@ tests carry the parent spec's tag in their NAME. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.0}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-plan/SKILL.md

@@ -15,7 +15,7 @@ parent's criteria. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.0}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-ship/SKILL.md

@@ -15,7 +15,7 @@ model can. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.0}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.