@popovych.co/witness 0.14.3 → 0.14.5

package/dist/verdict.js

@@ -103,7 +103,7 @@ function resolveDocPath(segments, body) {
 function safeRel(rel) {
     return !isAbsolute(rel) && !normalize(rel).split(/[\\/]/).includes('..');
 }
-function resolveCodeAnchor(anchor, root, canon) {
+function resolveCodeAnchor(anchor, root, files, canon) {
     if (/[:#]L?\d+$/.test(anchor))
         return 'line numbers refused — they drift across revisions; use file#symbol';
     const [file = '', symbol] = anchor.split('#', 2);
@@ -114,8 +114,18 @@ function resolveCodeAnchor(anchor, root, canon) {
     // from two trees. Code paths keep the reviewed tree, which is the thing under judgment.
     const isCanon = canon !== undefined && canon.dirs.some((d) => file === d || file.startsWith(`${d}/`));
     const abs = join(isCanon ? canon.root : root, file);
-    if (!existsSync(abs) || !statSync(abs).isFile())
-        return `no file ${file} in the reviewed tree`;
+    if (!existsSync(abs) || !statSync(abs).isFile()) {
+        // D162 (issue #29). The coverage floor counts every path the diff lists, so every one
+        // of them must be anchorable or the floor is unsatisfiable by construction: a submodule
+        // pointer is a directory, a deleted file is nothing, a symlink can point at a directory
+        // — and each is reviewed content, its hunk in the prompt. The bare path resolves; a
+        // symbol still needs a file body to be found in.
+        if (!files.includes(file))
+            return `no file ${file} in the reviewed tree`;
+        if (symbol === undefined)
+            return undefined;
+        return `${file} is a changed path with no file body in the reviewed tree (a submodule pointer, a deleted file, or a directory) — anchor it by bare path`;
+    }
     if (symbol !== undefined) {
         const re = new RegExp(`\\b${symbol.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
         if (!re.test(readFileSync(abs, 'utf8')))
@@ -172,6 +182,10 @@ export function resolveAnchor(anchor, reviewed) {
             return undefined;
         if (!safeRel(scope))
             return `omission scope escapes the reviewed tree: ${scope}`;
+        // D162: a changed path is reviewed content even when nothing is left on disk (a deleted
+        // file's un-migrated export is an omission scoped exactly there).
+        if (reviewed.kind === 'tree' && reviewed.files.includes(scope))
+            return undefined;
         return existsSync(join(reviewed.root, scope))
             ? undefined
             : `omission scope "${scope}" is no file or directory in the reviewed tree`;
@@ -180,7 +194,7 @@ export function resolveAnchor(anchor, reviewed) {
         const canon = reviewed.canonRoot !== undefined && reviewed.canonDirs !== undefined
             ? { root: reviewed.canonRoot, dirs: reviewed.canonDirs }
             : undefined;
-        return resolveCodeAnchor(anchor, reviewed.root, canon);
+        return resolveCodeAnchor(anchor, reviewed.root, reviewed.files, canon);
     }
     const segments = anchor.split(' > ');
     if (!segments[0].startsWith('#')) {

package/dist/version.js

@@ -1,5 +1,5 @@
 import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 // The one home for "which version of witness is which". install.ts parsed the pin to
 // decide whether a payload was only a pin apart (row 102 killed that rule) and check.ts
 // re-declared the same regex inline — one question answered in two places, which is the
@@ -44,7 +44,11 @@ export const NPX_LATEST = 'npx -y @popovych.co/witness@latest';
 // reader itself lived in the shell — the same split rows 93, 95 and 96 keep naming. The
 // single readFileSync is the exception to this file's no-I/O rule and the only one it
 // may ever have.
+//
+// Row 163. The path goes through fileURLToPath, never `URL.pathname`: a pathname is URL
+// syntax — `/C:/…` on Windows, which readFileSync resolved to `C:\C:\…`, and `%20` for a
+// space on every platform — so the read threw ENOENT and every journal stamp died with it.
 export function version() {
-    const pkg = JSON.parse(readFileSync(join(new URL('.', import.meta.url).pathname, '..', 'package.json'), 'utf8'));
+    const pkg = JSON.parse(readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
     return pkg.version;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@popovych.co/witness",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "Evidence-gated spec-driven development pipeline for AI coding agents: brainstorm to PR in six stages, where specs are state, plans are motion, and no transition passes without evidence. Drives from Claude Code or Pi.",
   "keywords": [
     "spec-driven-development",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "witness",
   "description": "Spec-driven development with evidence gates: brainstorm → PR through six stages and five gates. Skills author, the pinned witness CLI writes state and witnesses evidence; gates stop where judgment is owed.",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "author": {
     "name": "Kostiantyn Popovych"
   },

package/plugin/commands/witness.md

@@ -10,7 +10,7 @@ The CLI decides, you act. If `$ARGUMENTS` contains `--manual`, append `--manual`
 Resolve the CLI once:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
 ```
 
 If the repo has no `witness.config.yaml`, run `$WITNESS init` first (one bootstrap commit), then proceed. If init or any verb refuses on a dirty tree, the human commits or cleans it — **never `git commit` yourself, anywhere, at any stage**: the CLI makes its own state commits, and the ship phase makes the sole code commit.

package/plugin/hooks/session-dashboard.sh

@@ -3,4 +3,4 @@
 # context). Silent everywhere that isn't a witness repo; failures swallowed:
 # session start must never hang or die on this.
 [ -f witness.config.yaml ] || exit 0
-${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3} 2>/dev/null || true
+${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5} 2>/dev/null || true

package/plugin/skills/witness-brainstorm/SKILL.md

@@ -15,7 +15,7 @@ witness: ends in a confirmed scope recap, writes no document. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-decompose/SKILL.md

@@ -10,7 +10,7 @@ description: Slice a witness effort's confirmed recap into vertical spec slices,
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-design/SKILL.md

@@ -16,7 +16,7 @@ No text copied verbatim; the design-critic lens is new material. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-implement/SKILL.md

@@ -15,7 +15,7 @@ tests carry the parent spec's tag in their NAME. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-plan/SKILL.md

@@ -15,7 +15,7 @@ parent's criteria. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-ship/SKILL.md

@@ -15,7 +15,7 @@ model can. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.3}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/prompts/code-reviewer.md

@@ -51,7 +51,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/drift-reviewer.md

@@ -27,7 +27,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document. A `## Valid anchors` menu precedes the reviewed content — copy anchors from it verbatim; never paraphrase a heading.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/plan-critic.md

@@ -24,7 +24,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document. A `## Valid anchors` menu precedes the reviewed content — copy anchors from it verbatim; never paraphrase a heading.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/pr-test.md

@@ -84,7 +84,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/silent-failure-hunter.md

@@ -132,7 +132,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/slicing-critic.md

@@ -33,7 +33,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document. A `## Valid anchors` menu precedes the reviewed content — copy anchors from it verbatim; never paraphrase a heading.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/type-design.md

@@ -100,7 +100,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty: