@popovych.co/witness 0.14.1 → 0.14.3

package/dist/history.js

@@ -17,10 +17,20 @@ export function contentAtSha(root, rel, sha) {
     }
     return undefined;
 }
+// D160 audit note: a batched `git log --name-only` replacement for the per-plan
+// `git log -1` below was written and REVERTED — merge commits print no name list and
+// multi-path pathspecs change history simplification, so the batch disagreed with the
+// per-file shape in both directions (a different pin than `witness diff` resolves — the
+// exact second derivation this row exists to forbid). The per-plan spawn cost on idle
+// `next`/`status` turns is accepted and recorded in Open / deferred.
 export function baseForSpec(root, canon, specId, excludePlanId) {
     const candidates = canon.docs.filter((d) => d.meta.type === 'plan' &&
         d.meta.parent === specId &&
         typeof d.meta['derives-from'] === 'string' &&
+        // D160. A withdrawn plan is not a realization: counting an abandoned plan's pin as
+        // the base would report `delta: none` for content nothing ever implemented, and
+        // would hide the spec from the plan queue that keys on this same derivation.
+        String(d.meta.status) !== 'abandoned' &&
         d.meta.id !== excludePlanId);
     if (candidates.length === 0)
         return { kind: 'empty' };

package/dist/matcher.js

@@ -35,7 +35,15 @@ export function sourceTags(root, excludes) {
         if (skip.some((re) => re.test(rel)))
             continue;
         const abs = join(root, rel);
-        if (!existsSync(abs) || statSync(abs).size > MAX_SCAN_BYTES)
+        if (!existsSync(abs))
+            continue;
+        // D159 (#23). The listing is paths, not files: `--cached` includes a gitlink
+        // (submodule, mode 160000) and `--others` a symlink to a directory (skills-add
+        // wiring) — both stat as directories whose size clears the cap, and readFileSync
+        // threw EISDIR. Same isFile() guard codePromptBody applies to untracked paths;
+        // first shipped as a hand patch in a consumer's npx cache, upstreamed here.
+        const st = statSync(abs);
+        if (!st.isFile() || st.size > MAX_SCAN_BYTES)
             continue;
         const content = readFileSync(abs, 'utf8');
         if (content.includes('\0'))

package/dist/reviewed.js

@@ -1,9 +1,9 @@
 import { createHash } from 'node:crypto';
-import { existsSync } from 'node:fs';
+import { existsSync, lstatSync, readlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { canonicalJson, canonicalSha, planContentSha } from './sha.js';
 import { changedFiles } from './evidence.js';
-import { git } from './gitio.js';
+import { git, tryGit } from './gitio.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from './journal.js';
 import { findById } from './scan.js';
 // Row 96a. The reviewed identity is the DIFF the battery read: the base commit plus the
@@ -20,10 +20,39 @@ import { findById } from './scan.js';
 // Deleted paths carry an explicit marker: `hash-object` throws on a missing file, and
 // dropping the path silently would make "this file is gone" invisible to the identity.
 const DELETED_BLOB = '(deleted)';
+// D161 (#27, corrected by the audit's F1/F4). A changed path can be a symlink, a gitlink
+// (submodule) or another non-file — entries `hash-object` fatals on or mis-hashes. Each
+// gets the value git itself would store, so every reviewable change moves the identity
+// and nothing else does:
+//  - symlink: the target STRING is git's blob — hash-object would FOLLOW the link and a
+//    retarget between byte-identical (or dangling) targets would vanish (F4);
+//  - inner repo: its HEAD — but only when the path IS its own repo. A cwd-based rev-parse
+//    walks upward and answers with the OUTER head for a plain directory, moving the
+//    identity on every commit and re-arming settled gates over identical diffs (F1);
+//  - staged gitlink with an uninitialized dir: the staged pointer itself;
+//  - anything else: a constant marker, like DELETED_BLOB, so presence still counts.
+function blobOf(runRoot, rel) {
+    const abs = join(runRoot, rel);
+    const st = lstatSync(abs, { throwIfNoEntry: false });
+    if (!st)
+        return DELETED_BLOB;
+    if (st.isSymbolicLink())
+        return `(link)${readlinkSync(abs)}`;
+    if (st.isFile())
+        return git(runRoot, 'hash-object', '--', rel);
+    if (existsSync(join(abs, '.git'))) {
+        const inner = tryGit(abs, 'rev-parse', 'HEAD');
+        if (inner.ok)
+            return `(gitlink)${inner.out}`;
+    }
+    const staged = tryGit(runRoot, 'ls-files', '--stage', '--', rel);
+    if (staged.ok && staged.out.startsWith('160000 ')) {
+        return `(gitlink)${staged.out.split(/\s+/)[1]}`;
+    }
+    return '(non-file)';
+}
 export function diffReviewedSha(runRoot, base) {
-    const pairs = changedFiles(runRoot, base).map((rel) => existsSync(join(runRoot, rel))
-        ? `${rel}\0${git(runRoot, 'hash-object', '--', rel)}`
-        : `${rel}\0${DELETED_BLOB}`);
+    const pairs = changedFiles(runRoot, base).map((rel) => `${rel}\0${blobOf(runRoot, rel)}`);
     return sha256([base, '\n', pairs.sort().join('\n')]);
 }
 // Row 95: implement's identity is the diff AND the plan, because the battery reads both —

package/dist/verbs/next.js

@@ -8,6 +8,8 @@ import { findById, loadCanon, plannableParent } from '../scan.js';
 import { designArtifactCurrent, designPending, designUnseen } from '../design.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from '../journal.js';
 import { diffReviewedSha, effortOf, effortReviewedSha, effortSpecs, effortWrites, implementReviewedSha, planPairSha } from '../reviewed.js';
+import { baseForSpec } from '../history.js';
+import { canonicalSha } from '../sha.js';
 import { changedFiles, diffBase, evidenceForDiff, isTestPath } from '../evidence.js';
 import { SESSION_DEFAULT, stagePin } from '../model.js';
 import { handoffLine, relayLine, resolveDriver, resolveJudge } from '../harness.js';
@@ -345,7 +347,10 @@ export function readyChoice(canon, ready) {
                     ? {
                         why: flat
                             ? 'the dependency graph does not distinguish these — ranked by ui flag, then by id'
-                            : `${n} of the ${ready.length} ready specs depend on it directly; planning it later means re-planning them`,
+                            // D160 (#25, cosmetic): the count is direct dependents across all of canon
+                            // (human-checkable in frontmatter, D121) — not a subset of the ready list,
+                            // so the sentence must not claim one.
+                            : `${n} canon doc(s) depend on it directly; planning it later means re-planning them`,
                         judgeFirst: 'which slice matters this week. This ranks the dependency graph, which is all the CLI can see — product priority outranks it',
                     }
                     : {
@@ -623,23 +628,24 @@ export function computeNext(root, ctx, canon, cfg) {
         const s = String(doc.meta.status);
         return doc.meta.type === 'plan' ? s === 'done' : s === 'live' || doc.meta.type === 'principles';
     };
-    // D157. A spec is queued when the plan gate would accept it as a parent AND someone owes
-    // it a plan. `approved` is owed by definition (decompose just passed). `live` is owed
-    // only while a live effort that wrote it owns zero non-abandoned plans — efforts never
-    // auto-terminate, so without that clause every finished spec would queue forever.
+    // D157/D160. A spec is queued when the plan gate would accept it as a parent AND its
+    // content has moved past the last plan's pin — the same base derivation `witness diff`
+    // prints, because the effort ledger is not a readiness signal: an amendment can be
+    // realized by a plan booked under a different effort (issue #25), and a plan count of
+    // zero proves nothing either way. No pin at all means never realized, which is owed.
     // Reaching this rung proves decompose is settled: rung 6 returns first otherwise.
-    const owedByEffort = (id) => efforts.some((e) => {
-        const w = effortWrites(root, e.slug);
-        if (!w.has(id))
-            return false;
-        return !plans.some((p) => w.has(String(p.meta.id)) && String(p.meta.status) !== 'abandoned');
-    });
+    const unrealizedDelta = (d) => {
+        const base = baseForSpec(root, canon, String(d.meta.id));
+        return base.kind === 'empty' || base.sha !== canonicalSha(d.meta, d.body);
+    };
     const planless = canon.docs
         .filter((d) => d.meta.type === 'spec' && plannableParent(d))
-        .filter((d) => String(d.meta.status) === 'approved' || owedByEffort(String(d.meta.id)))
         .filter((d) => !plans.some((p) => String(p.meta.parent) === String(d.meta.id) &&
         !['done', 'abandoned'].includes(String(p.meta.status))))
         .filter((d) => (d.meta.depends ?? []).every(ready))
+        // last on purpose: the only filter that costs a subprocess — the in-memory ones above
+        // discard for free, and all four are pure predicates over an intersection
+        .filter(unrealizedDelta)
         .map((d) => String(d.meta.id)).sort();
     if (planless.length > 0) {
         // A spec whose plan write can actually be booked outranks one that needs a new effort

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@popovych.co/witness",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "Evidence-gated spec-driven development pipeline for AI coding agents: brainstorm to PR in six stages, where specs are state, plans are motion, and no transition passes without evidence. Drives from Claude Code or Pi.",
   "keywords": [
     "spec-driven-development",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "witness",
   "description": "Spec-driven development with evidence gates: brainstorm → PR through six stages and five gates. Skills author, the pinned witness CLI writes state and witnesses evidence; gates stop where judgment is owed.",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "author": {
     "name": "Kostiantyn Popovych"
   },

package/plugin/commands/witness.md

@@ -10,7 +10,7 @@ The CLI decides, you act. If `$ARGUMENTS` contains `--manual`, append `--manual`
 Resolve the CLI once:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
 ```
 
 If the repo has no `witness.config.yaml`, run `$WITNESS init` first (one bootstrap commit), then proceed. If init or any verb refuses on a dirty tree, the human commits or cleans it — **never `git commit` yourself, anywhere, at any stage**: the CLI makes its own state commits, and the ship phase makes the sole code commit.

package/plugin/hooks/session-dashboard.sh

@@ -3,4 +3,4 @@
 # context). Silent everywhere that isn't a witness repo; failures swallowed:
 # session start must never hang or die on this.
 [ -f witness.config.yaml ] || exit 0
-${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.1} 2>/dev/null || true
+${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3} 2>/dev/null || true

package/plugin/skills/witness-brainstorm/SKILL.md

@@ -15,7 +15,7 @@ witness: ends in a confirmed scope recap, writes no document. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-decompose/SKILL.md

@@ -10,7 +10,7 @@ description: Slice a witness effort's confirmed recap into vertical spec slices,
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-design/SKILL.md

@@ -16,7 +16,7 @@ No text copied verbatim; the design-critic lens is new material. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-implement/SKILL.md

@@ -15,7 +15,7 @@ tests carry the parent spec's tag in their NAME. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-plan/SKILL.md

@@ -15,7 +15,7 @@ parent's criteria. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-ship/SKILL.md

@@ -15,7 +15,7 @@ model can. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.1}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.