@ps-neko/nekowork 0.2.0-alpha.0 → 0.2.0-alpha.2

package/README.md

@@ -10,18 +10,18 @@ pushes, or deploys on its own.
 
 ## Status
 
-**Phase A skeleton** (2026-05-27). The 4 public verbs work via delegation to
-`@ps-neko/nekowork-cli` in the monorepo. To publish this package
-independently, the verify-pr code path needs to be moved into this package —
-see [HANDOFF-PACKAGE-SPLIT.md](./HANDOFF-PACKAGE-SPLIT.md).
-
-For the full alpha-stage product today, install:
+**Published alpha** (`@ps-neko/nekowork`, alpha dist-tag). This package is the
+published slim verification gate. Install with:
 
 ```bash
-npm i -g @ps-neko/nekowork-cli@alpha
+npm i -g @ps-neko/nekowork
 ```
 
-## Quickstart (once Phase A is complete)
+The fuller legacy and power-user surface lives in the internal
+`@ps-neko/nekowork-harness` package (not separately published). See
+[HANDOFF-PACKAGE-SPLIT.md](./HANDOFF-PACKAGE-SPLIT.md) for the split history.
+
+## Quickstart
 
 ```bash
 # right after your AI tool changes some files:
@@ -39,7 +39,7 @@ whether the change is safe to merge.
 | `check` | Probe environment readiness (Node version, git repo, etc.) |
 | `verify-pr` | Scan working-tree diff. Produce REPORT.md + .nekowork/decision.json |
 | `report` | Render an existing decision.json to a human-readable REPORT.md |
-| `apply` | Apply a stored .diff iff decision.json says `apply_allowed: true` |
+| `apply` | Session-based compatibility apply. Requires a completed work cycle (SHIP_READY marker + cleared Human Gate). NOT driven by verify-pr's decision.json. See [ADVANCED.md](../nekowork-cli/docs/ADVANCED.md). |
 
 Anything else (`ask`, `plan`, `team`, `work`, `ship`, `build`, `auto`,
 `pr-prep`, `review`, ...) belongs to `@ps-neko/nekowork-harness` (legacy and
@@ -50,9 +50,16 @@ power-user surface). The slim package rejects those verbs with a redirect.
 1. Your AI tool writes the code. `nekowork` never writes it for you.
 2. `verify-pr` runs a fixed set of risk rules over the diff — same diff, same
    verdict, every time. **No LLM gets to "vote" the result.**
-3. It saves the evidence into a `REPORT.md` you can read.
+3. It saves the evidence into a `REPORT.md` you can read, and writes
+   `.nekowork/decision.json` with informational verdict fields (`merge_allowed`,
+   `apply_allowed`). **verify-pr itself does not apply changes.**
 4. You decide at the Human Gate — approve, or don't.
-5. Only then can `apply` apply the diff. No auto-commit. No auto-push.
+
+> verify-pr itself does not apply changes. Session-based apply is part of the
+> compatibility workflow and requires SHIP_READY and a cleared Human Gate.
+
+No auto-commit. No auto-push. `apply` is a separate, session-based compatibility
+step — it is not triggered by `decision.json`.
 
 ## Docs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ps-neko/nekowork",
-  "version": "0.2.0-alpha.0",
+  "version": "0.2.0-alpha.2",
   "description": "Local verification gate for AI-written code diffs. Deterministic rules decide the verdict, never the LLM. No auto-commit, push, or deploy — you decide at the Human Gate.",
   "keywords": [
     "ai-code-review",
@@ -38,11 +38,11 @@
     "README.md",
     "LICENSE"
   ],
-  "dependencies": {},
   "scripts": {
     "smoke": "node scripts/cli.js --version && node scripts/cli.js verify-pr --help",
     "smoke:reject": "! node scripts/cli.js team 2>/dev/null",
     "test": "node --test tests/unit/*.test.js",
     "bench:rules": "node scripts/benchmark/rules.js"
-  }
-}
+  },
+  "dependencies": {}
+}

package/scripts/lib/diff-parser.js

@@ -208,7 +208,7 @@ export function getGitDiff(opts = {}) {
     if (ls.status !== 0) {
       throw new Error(`git ls-files exited ${ls.status}: ${ls.stderr || ''}`);
     }
-    const tracked = (ls.stdout || '').split('\n').map(s => s.trim()).filter(Boolean);
+    const tracked = (ls.stdout || '').split('\n').map(s => s.trim()).filter(Boolean).filter(p => !isSelfOutput(p));
     let stdout = synthesizeFilesAsDiff(cwd, tracked);
     if (includeUntracked) stdout += synthesizeUntrackedDiff(cwd);
     return parseDiff(appendIncluded(stdout));
@@ -248,10 +248,20 @@ export function getGitDiff(opts = {}) {
   return parseDiff(appendIncluded(stdout));
 }
 
+/**
+ * verify-pr writes its own output to `REPORT.md` and `.nekowork/**`. Those are
+ * the tool's product, not "changes to verify" — scanning them would re-flag the
+ * secret/risk text stored in its own evidence on the next run (self-
+ * contamination). Exclude them from every synthesized diff.
+ */
+function isSelfOutput(relPath) {
+  return relPath === 'REPORT.md' || relPath.startsWith('.nekowork/');
+}
+
 function synthesizeUntrackedDiff(cwd) {
   const ls = spawnSync('git', ['ls-files', '--others', '--exclude-standard'], { cwd, encoding: 'utf8', windowsHide: true });
   if (ls.status !== 0 || !ls.stdout) return '';
-  const files = ls.stdout.split('\n').map(s => s.trim()).filter(Boolean);
+  const files = ls.stdout.split('\n').map(s => s.trim()).filter(Boolean).filter(p => !isSelfOutput(p));
   return synthesizeFilesAsDiff(cwd, files);
 }
 

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 HARNESS contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.