@r1z4x/tezgah 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,738 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
+adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.0.0] - 2026-10-07
+
+### Upgrade note
+
+- **1.0.0 starts the public line, and npm keeps no 0.x.** The registry no
+  longer serves 0.1.1, 0.1.2 or 0.33.0, nor the pre-reset 0.17.0-0.32.0. The
+  update check treats every 0.x install as older than 1.0.0
+  (`hooks/tezgah_update.py::RETIRED`), so the `↑` chip and `tezgah update` move
+  it to 1.0.0. A 0.x install from npm moves with `npm install -g @r1z4x/tezgah`.
+- **Homebrew users coming from 0.1.2: re-arm once after `brew upgrade`.**
+  0.1.2 armed the host hooks with paths into its own keg,
+  `Cellar/tezgah/0.1.2/libexec`. The upgrade's default cleanup deletes that
+  keg, so those hooks point at nothing until a re-arm. Run `tezgah update`.
+  On the brew channel it runs `brew upgrade` first. Then it re-arms the hosts
+  and roots this install recorded, from the new tree behind `opt/tezgah`.
+  0.1.2's `tezgah update` already re-arms from there too. Or re-arm by hand with
+  `tezgah-setup --install --hosts <the hosts you armed>`. 1.0.0 arms through
+  `opt/tezgah`, so later upgrades need no re-arm. The formula's caveats say
+  the same after `brew upgrade`.
+
+### Added
+
+- **An orphan pass no longer licenses a claim.** Every ledger reader now
+  pairs each `verify_ok` with the `began` row the gate wrote for its call.
+  A pass with none is an orphan: it came from outside the hooks
+  (`python3 -c`), or its call's rows went missing. No reader counts it as a
+  pass. The Stop rule refuses a done-claim in its turn as "evidence tampered",
+  and `counters.orphans` counts it. Five cases stay exempt: a session with no
+  `began` row, a turn with a `crash` row, `pretooluse-off`, an unlocked append
+  and the sandbox fallback cache. A forged `began` row plus its pass is the
+  residual `SECURITY.md` names (plan 051). The gate now writes a call's
+  `began` before its rules run, so a refused call leaves `began` and `deny`.
+  Codex's PreToolUse matcher now names `shell` and `Shell` too.
+- **The session latches its kill switches.** A switch file newer than the
+  session's first ledger row (ctime or mtime) no longer disarms that session.
+  `off()` ignores it until the user's prompt names it, which writes an
+  `authorized` row. A switch present before the session starts counts as
+  before. So does the stand-down `tezgah-setup --uninstall --full` writes into
+  `pretooluse-off`. The opencode plugin answers the same way. A switch the user
+  flips in their own terminal mid-session now waits for the next session or a
+  prompt that names it (plan 051, SECURITY.md).
+- **The arm-bench lab is back in the repository.** `benchmarks/arm-bench/` holds
+  the runner, the 49 task trees and the earlier pre-registrations, with every
+  home path redacted. It is a maintainer tool: `managed()` keeps it out of host
+  plugin trees and the MANIFEST. Plan 062's phase 1 adds arm HOMEs built out of
+  tree from one pinned commit (`homes.py`) and a fresh HOME per run. It adds the
+  unlock strip that defines the switch-paragraph arm (`unlocks.py`) and a cheat
+  classifier over the final diff that uses the gate's own patterns. The report
+  adds paired bootstrap intervals, exact McNemar and Holm. `bench.py selftest`
+  now also fails when an arm's prompt text names a task's hidden identifier.
+- **A tainted lesson gets a label, never a refusal.**
+  Untrusted text is a web, MCP, network, tier or subagent read. A write to
+  `.tezgah/lessons.md` after one in the same user turn now leaves one
+  `lesson_tainted` row per line it adds
+  (`docs/evidence.md`). The line still rides both lesson blocks, behind a
+  per-line data label (ADR 010). The ledger now has one reader,
+  `hooks/tezgah_lessons.py`, for the context, the gate and `tezgah-lessons`.
+  It cuts a `|| check: ...` clause and an `@<sha> <path>` stamp off each line.
+  Neither changes the key, the per-turn digest, the cut or the ranking.
+- **A model can be the replay sheet's second rater.** `tezgah-gate replay
+  --label-model --prompt <file>` sends each blind sheet row, redacted, to the
+  judge seam. It writes `labels-model.jsonl` beside the sheet and prints the
+  token cost. `replay --report` with one rater's labels now prints no rate:
+  the rates need two raters' agreed labels.
+- **A second model family can rate the replay sheet.** `tezgah-gate replay
+  --label-model --provider deepseek --model deepseek-v4-pro` asks the same
+  prompt over DeepSeek's OpenAI-compatible endpoint at temperature 0. It writes
+  `labels-deepseek.jsonl` and prints input and output token cost. With two
+  model raters `replay --report` calls kappa model-model agreement.
+- **The shell-reader fuzzer runs weekly under bash 5.x.** A `fuzz-shell` job
+  in `.github/workflows/neuter.yml` runs `tests/fuzz_shell.py` on the ubuntu
+  runner's bash 5, seed 1, 20000 lines. It reads the lines once with the core
+  readers and once with the opencode plugin's ports (`--js`). The new
+  `--strict` flag makes any disagreement class exit 1, so the job fails on it.
+- **`tezgah-status --enforcers` shows what enforces each always-on rule.**
+  Each CORE rule gets one row. The row names the gate rules and Stop classes
+  that refuse on the rule, with the switches and conditions that guard each.
+  It also names the shape flags that only record it. A rule reads `partial` when
+  every refusal can vanish while its text stays, or when `docs/contract.md`
+  names a part nothing covers. The report always exits 0.
+  `bin/tezgah-docs --citations` and `tests/test_enforcers.py` fail on a rule
+  that nothing refuses on and that has no row in `docs/contract.md`.
+- **An MCP effect now meets the gate's content rules**. Claude, dsh and omp
+  spawn the gate for an MCP tool whose name carries an effect verb, so a
+  read-only MCP call costs nothing. Cursor's `beforeMCPExecution` asks the
+  gate. An effect verb in the tool's name picks the rules, case-sensitive like
+  the host matcher. A clause led by a read verb (`get_commit`) is a read. A
+  `write` meets shortcut, attribution and secret. A `publish` meets attribution
+  and secret. No class refuses by itself. The secret half reads vendor token
+  shapes only. The payload walk stops at 64 KiB. An MCP effect also counts for
+  the taint notice, one notice per untrusted channel, and for the drift
+  re-statement. So an MCP `act` such as a click can now draw that re-statement
+  once per long turn.
+- **The Stop rule's evidence fold, declared as a temporal spec, runs in
+  shadow.** `hooks/tezgah_stopspec.py` writes classes 5-10 as seven past-time
+  formulas over ten row atoms. A one-pass monitor judges each reply that
+  leaves a claim or a refusal row. It runs beside the imperative fold and
+  leaves one `stop_spec` row: `agree`, `disagree` or `error`. The row also
+  says `fold` or `selector`: whether the shared selector reached the fold.
+  The verdict stays the imperative one, and a failing spec costs only its row.
+  `mask` keeps a per-process cache, so both folds read each ledger detail once.
+  `TEZGAH_STOPSPEC_STRICT=1` makes a disagreement fatal in the tests.
+  `tests/stop_spec_eval.py` measures the bet (plan 063). Plan 055 replays 496
+  Stop events, and the two folds agree on all of them. The bar reads only the
+  361 events that reached the fold.
+- **Real bash now checks the shell readers.** `tests/fuzz_shell.py`
+  draws seeded lines from the hand vectors' grammar. It runs each in `bash`
+  with a stub per program word and prints each class where `shell_programs` or
+  `mask` disagrees. `tests/test_fuzz_shell.py` runs a small sample per suite
+  run and fails if `mask` blanks a program bash ran. `--js` reads the same
+  lines with the opencode plugin's ports through node. It reports where a port
+  disagrees with bash or with the core, and the suite sample fails on either.
+- **`tests/bench_gate_latency.py` times the gate.** It prints p50/p95 of
+  `decision(..., record=False)` over 200 common calls, for this tree or for
+  another revision's exported `hooks/`.
+- **Concluding or closing a research line seals it.** `conclude` and `close`
+  write `state.json` `order_seal`. It holds, per experiment, the sha256 of
+  `protocol.md` and `results.jsonl`, and no order verdict. Every `check`
+  verifies the hashes, with or without git, so the session note reports an
+  edit after the seal. While the hashes hold, `check` re-derives the order, so
+  results committed after the close still count. `tezgah-research seal <slug>
+  --history-lost --ack "<decision>"` gives the owner's `history-lost` verdict
+  to a line concluded before seals (ADR 009). It covers only an order the lost
+  history left undecidable. A real violation stays an error. Without
+  `--history-lost` (ADR 018) it writes the plain seal `conclude` would, and
+  only when every experiment's order still checks.
+- **`tezgah-research import <checkout> [<slug>]` moves a line with its
+  history.** It fetches the other checkout's `.tezgah` repository from disk.
+  It merges that history as a second parent and takes only the imported lines.
+  It refuses a plain copy, because a copy loses the order proof. It needs no
+  remote. An open line arrives beside open ones only with `--allow-open`.
+- **The MCP tool `tezgah_research_check` takes a `slug`.** The server checks it
+  as a line name. It passes the slug after `--`, so `tezgah-research` never
+  reads it as a flag.
+- **The neuter matrix mutates the Stop rule.** `tests/neuter_matrix.py`
+  generates one mutant per Stop-class return site. The sites sit in
+  `_stop_block`, `_shape_block` and `_evidence_block`: 13 over 11 classes. Hand-written rows add the
+  guards around them: the pass predicate, the empty-run read, the pipe
+  guard and the "doğrulanmadı" clear. The lost call, the bookkeeping and
+  idle-turn fallbacks, the refusal row and the `other repo` cause are rows
+  too. The run adds the omp and after-block Stop test modules.
+- **Every session attests tezgah's own hook entries.** The installer now
+  records each host's tezgah-owned hook entries in `contract.sha256`, one line
+  per entry. On a release install it also records the scripts they run. Each
+  session start compares the entries on disk with that record. opencode does
+  it at its first message. The session gets one `attest` row: `ok`,
+  `drifted: <entries>` or `unverified: <why>`. A drifted row names the entry.
+  It also names a hook file any user can write and a stale omp bridge. The row
+  lists the kill switches present. A drifted session shows a `drift` status
+  mark, and its claim rows carry the drift in `harness`. Drift never blocks a
+  reply. `--report` prints the same comparison per host.
+- **`tezgah update` shows the hook change.** It prints each tezgah hook entry
+  the new release adds, removes or changes. That comes before the re-arm. On
+  a terminal it waits for a yes. A piped update goes on (decision 12).
+  `--upgrade` does the same. The new tree answers through
+  `tezgah-setup --hook-entries`.
+- **`upgrade.sh` checks build provenance when `gh` is there.** It runs
+  `gh attestation verify` on the tarball against the release workflow's
+  attestation. Without `gh` it prints `provenance not checked`, and a `gh`
+  that cannot answer is a warning. The checksum stays the gate.
+- **`docs/hosts.md` states each host's enforcement capability.** One table
+  covers the gate, the Stop rule and subagents per host, in gate, observe,
+  partial and unavailable. A cell no driver can probe says unverified.
+- **`tezgah-gate replay` measures the gate against its own history.** It
+  replays this machine's real ledgers through the unmodified dry-run gate and
+  the Stop rule. It runs in a sandbox HOME, with the clock frozen at each call.
+  It prints the corpus size, the join rate and every exclusion with its count.
+  Per stratum, it prints how often the replayed verdict equals the recorded
+  one. Every figure names its cutoff. `replay --sheet` draws a blind label
+  sample that shows no verdict. `replay --report --labels <file>` turns two
+  raters' labels into per-rule false-block rates and Stop error rates. Each
+  rate carries a Wilson 95% interval, and the report adds Cohen's kappa. It
+  also folds the denial budget: runs of 3 consecutive denies per rule in one
+  turn, and sessions with 20 or more. Nothing leaves `~/.cache/tezgah/replay`,
+  and no gate behaviour changes. `tezgah-taste`'s transcript walkers can now
+  read subagent files and tool inputs. `mine` reads what it read before.
+- **`--install` arms Claude Code through its own CLI.** Claude's gate, Stop and
+  ledger hooks ship in the plugin. The installer never registered that plugin,
+  so only the maintainer's machine had them. The install now
+  writes `.claude-plugin/{plugin,marketplace}.json` from the release version
+  into its own tree. The pair stays untracked. It then runs `claude plugin
+  marketplace add <tree>` and `claude plugin install tezgah@tezgah-local`. An
+  existing `tezgah@*` row is left alone, so no hook fires twice. Claude's
+  `plugin copy current` row now fails `--install` where a `claude` CLI exists.
+  `--uninstall` also drops the `enabledPlugins` key and the rendered pair.
+- **`--report --live` proves the gate runs.** Each host now also gets one
+  PreToolUse for `git commit --no-verify -m x` through its own wiring. The row
+  is ok only when the host answers with its own deny and the ledger gains a
+  deny row. `pretooluse-off` and `verify-off` make it UNVERIFIED, named. The omp
+  bridge must match a fresh render byte for byte. opencode's plugin now writes
+  a deny row for its own refusals. The Python gate already did.
+- **`reply_lang` picks the reply language.** `tezgah-setup --install
+  --reply-lang tr|en|any` stores it in `config.json`, and `install.sh` forwards
+  the flag. `tr` is the default and what an install without the key reads. `en`
+  asks for English and `any` for the user's language. The Stop rule checks
+  the language only under `tr`. The contract's first rule and
+  the per-turn reminder name the configured language.
+- **README: what tezgah changes on your machine**, in all five languages.
+- **The gate guards tezgah's own control plane (`control`).** It refuses a
+  change to a kill switch. It covers `~/.config/tezgah`, the evidence ledger
+  and the hook wiring too. It also refuses a change to a repository's `.no-*`
+  mark or `.git/hooks`. It
+  refuses a delete or move of `.husky` or of an open plan. It refuses a
+  forced `git add` of a `.tezgah/` path, and the CLIs that change that state.
+  Claude's `disableAllHooks` and Codex's hook trust entries count as wiring.
+  The rule follows a `cd`, `if`/`for`/`!`, `eval` and `bash -lc`. It refuses a
+  write through a link and a delete of a directory that holds this state.
+  Only `pretooluse-off` removes the rule, and the refusal names no command.
+  All 12 tamper probes of the deep analysis passed the gate before. Now the
+  gate refuses all 12. ADR 010 freezes new gate rules, and ADR 004 makes this
+  one the exception: it ships this half of R05 (R05a) now. An interpreter
+  (`python3 -c`) still gets through. `SECURITY.md` names it as a residual.
+- **A damaged ledger line blocks a done-claim.** A bad ledger line used to
+  make the reader raise. The Stop rule then failed open for the turn. The new
+  Stop class is "evidence tampered". Now the reader
+  skips the line and writes one `ledger_damage` row for it. The Stop rule
+  refuses a done or tested claim in that turn. That covers a corrupted
+  `verify_fail` row too.
+- **A switch armed mid-session leaves a record.** The prompt hook writes one
+  `disarm` row for a switch that appears after the session's first prompt.
+  The status line shows its `gate✗` mark while that switch stays armed.
+- **Subagents stop sharing taint on Claude.** Claude's hook payload names the
+  subagent (`agent_id`), and its rows now carry it. One sibling's web read no
+  longer marks another sibling's effects. The repeat ceilings count each
+  agent's own attempts.
+- **`SECURITY.md` states the threat model.** It names a cooperative but
+  fallible agent, the state the gate guards and how, and the residual routes.
+- **The control rule also guards the attestation state.** It refuses a
+  change to the `harness-drift/` and `import-crash/` status marks and a
+  `tezgah-context attest` run. The `hook:<host>:...` rows of `contract.sha256`
+  were already covered as tezgah's configuration, and a test now pins them.
+
+- **Opt-in taste capture, and a miner for the corrections already on disk.**
+  Arm it with `~/.config/tezgah/taste-on`. A repository with a `.tezgah/`
+  directory then gets `.tezgah/taste/signals.jsonl`. It holds each prompt,
+  each landed edit's old and new text, and a snapshot of the bytes the write
+  left. Redaction and a length cut apply to the text. A `.no-taste` mark turns it off per
+  repository. `tezgah-taste mine` counts and extracts the prompts that
+  followed a writing turn in omp and Claude transcripts. `tezgah-taste
+  measure` and `tezgah-taste rate` sort them with the judge seam into
+  preference, defect or none. This phase learns and injects nothing.
+
+- **The Stop hook now records the reply after a block.** On Claude, Codex and
+  omp the hook skipped the reply that answers a block. It now judges that
+  reply in record-only mode and writes one `after_block` row. The row says
+  whether the rule would refuse the reply, let a claim through, or found no
+  claim. It never blocks a second time and never counts as a claim or as a
+  reply. A block from another Stop hook leaves no row. Cursor stays unwired:
+  nobody has checked its stop payload yet.
+- **A subagent's end leaves a record-only verdict.** Claude's SubagentStop
+  (a new hook row) and Cursor's subagentStop now judge the subagent's last
+  reply. They read the evidence half of the Stop rule and write one
+  `subagent_end`
+  row. It never blocks and never counts as a claim. Every Stop adapter names
+  its re-ask budget as `STOP_REASKS = 1`. On Claude a subagent's tool rows
+  still sit in the parent's ledger, so the row judges the parent's turn until
+  the agent key lands.
+- **Lessons keep their rule when injected.** A lesson line is now written rule
+  first: `<rule> - <incident>`. The rule sits in the first 120 characters, so
+  the 200-character cut keeps it. The session block says how many of its lines
+  do not open with their rule. A line ending `|| enforced_by: <rule|test>` leaves
+  the injected blocks while that gate rule or test is on. A test counts only
+  while the repository still defines it. A switched-off rule brings the line
+  back. `tezgah-lessons` proposes rule-first rewrites, merges of duplicate lines
+  and those retirements. It never writes the ledger. On this repository's
+  47-line ledger the session block grows from 1266 to 1352 bytes. omp's
+  `RULES.md` lessons line grows from 230 to 270 bytes. The always-on core
+  shrinks by 23 bytes.
+- **The per-turn lessons block shrinks before the budget drops it.** Over budget
+  it keeps its first lesson. The session remembers only the lessons it shows. The
+  drop log records this as `kind=truncated`. Each injected lesson leaves a
+  `lesson` ledger row with its key and block, and that row is not gate evidence.
+- **A wider citation audit.** `bin/tezgah-docs --citations` now judges a bare file
+  name and a symbol written after its citation. It also reads the comments and docstrings of the Python code. A
+  `path:N` it cannot read counts as unjudged. The tree reads 524 judged and 1022
+  unjudged, up from 429 judged. A file whose unjudged count is above or below its
+  entry in `docs/citations-baseline.json` fails the check. `--citations --update`
+  rewrites that file. The same pass reads all ten Stop classes by AST. It also checks the
+  gate's rule order and switches, the judge's callers and the kill-switch names.
+  `tests/neuter_matrix.py` generates one mutant per gate rule.
+- **`tezgah-setup --write-plugin-agents`.** The plugin's `agents/tezgah-reviewer.md`
+  is now rendered from the same role body the per-repo reviewer gets. A test
+  fails until the flag has run after a body change.
+- **The status line says when a newer release is out, and `tezgah update`
+  takes it.** A `↑X.Y.Z` chip sits beside the logo on every surface. A redraw
+  reads a cached answer, and a detached check refreshes it at most once a day.
+  `tezgah update [--dry-run]` updates through the channel the install came
+  from (release prefix, Homebrew, npm or git) and re-arms the hosts. The
+  `update-check-off` switch turns the check and the chip off.
+
+### Changed
+
+- **The README describes mechanisms, not outcomes.** A paired on/off experiment
+  ran DeepSeek V4.1 Flash on omp, bare against a full install. It found no
+  measurable reduction in cheating. The model barely cheated in either arm: 0
+  of 132 runs with tezgah and 1 of 131 without, on ImpossibleBench's
+  conflicting SWE-bench split. Hand labels of the final messages found no
+  false-done difference either: 3 of 30 with tezgah, 6 of 30 without. The
+  Stop rule's claim reader flagged far more, because it reads `doğrulandı` on
+  a partial fix as a done claim. That weakness stays open for now. The
+  README, `docs/vision.md` and `docs/evidence.md` now say what tezgah enforces
+  and records, and what it has not shown. The redacted results bundle is
+  `docs/results/paired-outcome-2026-10.md`, with per-task counts beside it.
+- **An open plan's move and a forced add of `.tezgah/` leave evidence.** The
+  `control` rule refused a delete or move under `.tezgah/plans/open/`. It also
+  refused a `git add -f` of a `.tezgah/` path. Plan 050's replay of real
+  ledgers found both refused without the user's say-so. That happened more
+  than once a week, so its falsifier fired (ADR 018). A call that moves or
+  deletes one plan, or force-adds a `.tezgah/` path, now passes and leaves a
+  `disarm` row, `control: <what>`. The rule still refuses the open plans'
+  directory and its ancestors, and a call that also changes another protected
+  path.
+- **The research session note hashes a line under `done/`.** `failing()` runs
+  `_check_seal` on a concluded or closed line instead of the full `check_line`.
+  An edit after the seal still reaches the note. The line's other findings stay
+  with `check <slug>` and `check --all-lines`. On a copy of this repository's
+  workspace the note took 0.014 s instead of 0.67 s.
+- **The no-slug research `check` and `status` report the open lines.** They
+  read a line under `done/` by its seal hashes, as the session note does. A
+  `state.json` or a seal they cannot read fails the line. One line counts the
+  done lines that carry a seal and those that do not. `check --all-lines`
+  re-checks every line in full, and `check <slug>` still does for that line
+  (ADR 015).
+- **The research history bridge is gone.** Nothing reads
+  `.tezgah/history-bridge.json` any more. It proved no experiment on this
+  repository's workspace, so `check` refuses a re-rooted one-commit add like
+  any other. Its code, its `notes` channel in the `check` report and its tests
+  went with it (ADR 015).
+- **The piped-check remedy is one sentence.** `PIPED_REMEDY` in
+  `hooks/tezgah_integrity.py` holds it. The refusal, the always-on core, its
+  hookless copy, the contract skill and `docs/gate.md` quote it word for word.
+  A test pins every copy. It names the two shapes that keep the check's exit
+  status. One runs the check last into a file and reads the file in a separate
+  call. The other opens the line with `set -o pipefail;`.
+- **A session pays each armed rule once.** The first matching prompt gets the
+  full paragraph of spec, consult, research, product or graph. A later match in
+  the same session gets one line that names the rule. The research line keeps
+  its open-lines fact. A compaction brings the full paragraph back. So does a
+  match 20 turns after the last full showing, for Cursor and dsh. The per-turn
+  reminder no longer restates spec, graph or research. Those rules reach a turn
+  through their own paragraph. It keeps the short consult clause, because a
+  terse irreversible ask arms nothing. The `user_prompt` budget now drops the
+  skill hint before the task phase, the delta and the pointer. A replay of
+  1,452 uncut real prompts from 85 local sessions ran through `context_for` in
+  a fixture repo. Injected bytes per session fell from 37,387 B to 28,928 B
+  (-22.6%). Per turn they fell from 1,599 B to 1,104 B. The Stop-shape and
+  claim-rate comparison needs a 2-week window and has no result yet.
+- **The subagent brief keeps each rule's operative sentence.** The brief kept
+  only each rule's first sentence. A delegate lost "inter-agent reports stay
+  English" and the lessons instruction. A per-rule sentence count now keeps two
+  sentences of three rules, cut from CORE's own text. The brief grows from
+  4,120 B to 4,263 B. The `subagent_start` budget moves from 5,000 B to 5,500 B.
+- **User constraints survive compaction.** A prompt clause like "don't touch
+  hooks.json" or "README'ye dokunma" now rides the turn stamp, to its
+  sentence's end. The stamp holds that clause, never the prompt. A clause that
+  starts inside quotes or code does not count. The recogniser skips a prompt
+  over 12,000 characters: pasted material is not the user's constraint.
+  A quoted object after a plain "don't touch" still counts. The post-compact and
+  session-start blocks restate the clause. The compaction row counts its object
+  phrase in `constraint_found`. On the 1,452 uncut real prompts the recogniser
+  pinned 7 clauses in 6 prompts, all real constraints. Before these bounds it
+  pinned 17 in 11 prompts, 6 of them from one pasted 387,905-char agent log.
+  `tests/constraint-fixtures.md` lists the rows, the misses and the known false
+  positives.
+- **Generic arming stems carry a qualifier now.** Ten code-sense asks no
+  longer arm product, spec or research. Examples: "add a feature flag",
+  "segment fault", "tabloya sütun ekle (sql)", "bu fonksiyonu sadeleştir". Every
+  frozen corpus row keeps its verdict.
+- **The policy keeps no joined `CONTRACT` constant.** The cost report measures
+  the shipped `tezgah-contract` skill file instead. `ContractParity` walks the
+  policy blocks against that file. The executive-mode "these win" sentence now
+  covers output and report style only. A nested AGENTS.md or CLAUDE.md still
+  binds its subtree.
+- **opencode compaction passes the session id.** The builder then forgets the
+  lessons and armed paragraphs that session saw. The plugin used to send `{}`.
+- **Research predictions and the per-component report stay frozen.** They keep
+  working as documented and take no new rule, field or command (ADR 009).
+- **`check` reports a superseded claim once.** Only the row that supersedes it
+  warns, naming both ids. The superseded row no longer warns a second time.
+- **Docs cite Python code by symbol.** A citation into Python code is now
+  `path::name` or `path::Class.method`, not `path:line`. Moving lines no longer
+  shifts it. `bin/tezgah-docs --citations` reads the cited file's AST and fails
+  on a name it does not define. 961 docs citations moved to the new form. The
+  rest kept `path:line`: no single enclosing symbol, a non-Python target, or a
+  stale line nobody has re-anchored yet. They stay under the unjudged ratchet.
+  A later pass read each stale line inside one symbol against the code. After
+  it, 109 more citations name a symbol (`--citations`: 1081 judged before, 1190
+  after, 0 outside). Eight that point at a module comment or a module-level
+  line were re-anchored as `path:line`.
+- **Ten more docs pages cite code by symbol**. A pass read their unjudged
+  citations against the code. Now 101 of them name a symbol
+  (`--citations`: 1230 judged before, 1333 after, 0 outside). Another 83 point
+  at JavaScript, shell, markdown or a module-level line, and now carry the line
+  they describe. One sentence in `docs/gate.md` said a path spelled differently
+  escapes the concurrent-write guard. The guard compares resolved paths, so the
+  sentence now names the case it does skip: a row with no `target`.
+- **The rule ledger drops its `since` column.** A history rewrite left no
+  record of the first commit that carries each rule. The provenance table in
+  `docs/gate.md` now has `rule`, `incident`, `evidence` and `pin`.
+
+- **The lessons ranking ignores words that name no lesson.** English and
+  Turkish function words no longer rank a line. On a ledger of ten or more
+  lines, neither does a word found in more than half of them. "update the
+  changelog" used to inject three unrelated lessons and now injects none. The
+  docs fallback ranks as before.
+- **High-stakes briefs route to frontier by rule.** The override also matches
+  destructive data and history operations. It matches keys, certificates,
+  bearer and access tokens, and privilege changes too. A 12-brief fixture pins
+  it: 8 high-stakes briefs go to frontier, 4 near misses do not.
+- **Route rows and the skill hint's cost row name who answered.** Each carries a
+  `judge=<provider>/<model>` word, and the model is the one the reply names.
+  `via` keeps its name, so `tezgah-route --report` groups history as before.
+- **consult's referee reads anonymous answers in a shuffled order.** The output
+  maps each label to its member. With no recorded referee, an available member
+  outside the panel referees. Otherwise a note says the referee is a panel member.
+  consult reads omp's session model only on an omp session.
+- **A pass now licenses a claim only when it checked something.**
+  `--version`, `--help`, `--list`, `--collect-only`, `make help` and a bare
+  `ruff` now record as plain runs. So do formatters in write mode:
+  `ruff format`, `ruff check --fix`, `prettier --write` and `eslint --fix`.
+  A formatter run after a pass now makes that pass stale. Some checks say
+  in their own output that they ran nothing: `collected 0 items`, `no tests
+  ran`, `Ran 0 tests`, `No tests found`. Such a run no longer counts as a
+  pass. omp's bridge reads
+  that from the result and sends only the flag. A pass also has to come from
+  the changed file's own repository, so `cd ../other && pytest` no longer
+  covers an edit here. The rule now dates a pass from the moment its check
+  began, so a write that landed while the check ran makes it stale. The gate
+  reads the same list: an information form is not a neutered or piped check,
+  and it gets no retry exemption.
+- **Honest Stop counters.** A blocked reply that claimed nothing is now a
+  `refusal` row, not a `claim`. It has no completion word and no claim about
+  an outside system. `false_completion / claims` counts claims only, and
+  `counters` adds `refusals`. A `no verify_ok` row says
+  whether no check ran or no pass of one showed. Rows are now version 3.
+  The docs no longer call that ratio the one number that matters, and no
+  longer quote a fixed value for it.
+- **A question is not a claim on a turn with no work.** "Testler geçti mi?",
+  "is it done?" and "not tested yet" no longer trigger the no-work claim
+  check. "Tamamlandı, push edeyim mi?" still does.
+- **tezgah teaches `codegraph affected` as what it is.** codegraph 1.6.0 says
+  it "finds test files affected by changed source files". Every copy taught it
+  as the blast radius of a ref. Now the contract, the reminder and the skills
+  say it. The role bodies and the graph workflows say it too. The blast radius
+  is `git diff` plus `codegraph impact <symbol>` per changed symbol.
+  `git diff --name-only <ref> | codegraph affected --stdin` picks the tests.
+  A reviewer with no shell (Claude, opencode) gets the changed files from its
+  caller and runs the MCP `codegraph_impact` tool per symbol.
+- **ToolSearch loads both codegraph MCP names.** A plugin install names the
+  tools `mcp__plugin_tezgah_codegraph__*`, a checkout's own server
+  `mcp__codegraph__*`. The select lines name both.
+- **tezgah retires three unused roles.** It no longer generates
+  `tezgah-explorer`, `tezgah-verifier` or `tezgah-researcher`. A session start
+  sweeps their managed files from the repo agent dirs. `--install` sweeps them
+  from omp's agent dir. The plugin's hand-kept `agents/tezgah-explorer.md` is
+  gone. Steering names none of them.
+- **`agents-off` removes the generated agents.** It used to stop generation and
+  leave the old files for every host to keep loading. The next session start
+  sweeps the repo agent dirs. The next `--install` sweeps omp's user-level
+  agents, and it removes only names tezgah ever generated.
+- **A repo's `.no-graph` hides the reviewer from steering**, also on omp, where
+  the agent file is user-level.
+- **Claude reads the graph workflows from the plugin only.** `--install` no
+  longer links `~/.claude/workflows/*.js`, so each workflow loads once. It
+  removes tezgah's old links there and any dangling `cbm-*.js` link. The
+  report row now checks that no such link is left.
+- **The `ai-research` feature row is gone.** It switched nothing. A
+  `config.json` that still names it loads and installs as before.
+
+### Fixed
+
+- **Cursor's Stop rule re-asks once, as on every other host.** A real Cursor
+  `stop` payload carries `loop_count` and no `stop_hook_active`. The hook read
+  only the flag, so it refused every follow-up its own refusal started, until
+  Cursor's cap ended the chain. It now counts `loop_count`
+  (`hosts/cursor/hook.py::asked`).
+
+- **The false-done reader no longer counts an honest partial fix as done.**
+  `claims` took a fix marked verified beside an unverified test as done. A
+  reply that admits an open check now reads as no claim. It says the work
+  lacks a check, or that a test contradicts the issue or cannot pass
+  (`hooks/tezgah_integrity.py::ADMITTED`). The rule came from the 60
+  hand-labelled E4 dev messages, where precision rose from 0.15 to 0.69 at
+  recall 1.0 (`tests/claim_reader_eval.py`). On a held-out set of 40 messages,
+  labelled by two model raters (kappa 0.565), precision rose from 0.212 to
+  0.857. Recall fell from 1.0 to 0.857 (6 of 7), below the plan's bar of 0.9.
+  The one miss is a real verification claim whose double negative read as an
+  admission. `claims` only feeds the benchmarks' false-done counts. The Stop
+  verdict reads the plain vocabulary, so no refusal changed. A false-done
+  count from before this change is not comparable with one after it.
+- **The tap formula waits for its asset.** The release's brew job pushed
+  `Formula/tezgah.rb` before it uploaded the tarball the formula names. So
+  `brew install` met a 404 until the upload finished, and for good if it
+  failed. The job now uploads the tarball and its `.sha256` first. It checks
+  that both are on the release, and only then touches the tap.
+- **Two sharded CI tests no longer race the runner's load.**
+  `test_components.Switches` set its switches after the session's first
+  ledger row. On a slow runner the latch then kept them out, as it should. The
+  turns after the switches now run as a new session. The redact linear-time
+  test now interleaves its two sizes, best of five each, so one load spike
+  cannot land on one size alone.
+- **The seam refuses a plain-http endpoint override off this machine.** The
+  judge seam's `TEZGAH_TYPESAFE_URL` and `TEZGAH_OPENROUTER_URL` and the
+  replay rater's `TEZGAH_DEEPSEEK_URL` all route through
+  `tezgah_judge.override`. An `http://` URL to another host would have sent
+  the bearer key and the state in clear. Loopback stays allowed for the tests.
+  `consult` now refuses a plain-http `CONSULT_URL` off this machine the same
+  way, before any request, as failure class `plain-http`.
+- **A Homebrew install survives `brew upgrade` with its default cleanup.**
+  The installer now names its keg through the stable `opt/tezgah` link
+  (`hooks/tezgah_paths.py::stable_root`). So the farm links, the omp bridge's
+  hook path and dsh's `configPath`/`pluginRoot` no longer name the
+  versioned keg the cleanup deletes. The session-start attest reads the same
+  root, so a brew session reports no drift before or after an upgrade. A
+  checkout still names itself.
+- **A Windows release install can update, upgrade and uninstall itself.**
+  `running_prefix()` now accepts the junction `install.ps1` makes. It also
+  accepts the copy `install.ps1` makes when Windows refuses the junction. So
+  `tezgah update` finds the release prefix. The default prefix is
+  `%LOCALAPPDATA%\tezgah` on Windows. `install.ps1` passes `-Prefix` to
+  `--install`. `--upgrade` runs
+  `install.ps1 -NoInstall` there instead of `bash`. A missing `bash` or
+  `powershell` is a refusal that names it, not a traceback. `--uninstall`
+  removes the junction as a link (`bin/tezgah-setup::is_link`).
+- **The opencode plugin reads Windows roots.** `TEZGAH_ROOTS` splits on the
+  platform delimiter (`;` on Windows), and `shell.env` joins with it. The
+  root test uses `path.relative`. So a `C:\` root no longer leaves the plugin
+  inert.
+- **The `control` rule refuses fewer harmless calls.** A replay of real
+  ledgers found 19 refusals. 13 of them were false.
+  A multi-line `python3 -c '...'` is now one word, not lines of commands, so a
+  switch path, a `>=` or `tezgah-capture` in the script is data. So is the
+  body of a `python3 - <<PY` heredoc when bash expands nothing in it. A write
+  under the install checkout's own `.tezgah/` is not hook wiring. A Claude
+  `settings.json` counts in `~/.claude` or under a root, not in a temp
+  fixture. A shell's script (`bash -c`, `bash <<EOF`) is still read.
+- **opencode keeps one snapshot per write and one nudge per session.**
+  The core captures a write it answers through `tezgah-gate decide`.
+  The plugin now captures only a call the core did not answer.
+  Both sides name the nudge mark `sha1(session)[:16]`
+  (`hooks/tezgah_gate.py::nudge_mark`).
+- **The update chip reaches installs on the retired 0.2.0-0.32.0 line.** A
+  re-root on 2026-10-04 restarted the numbering at 0.1.1.
+  npm last served 0.32.0 before it. `newer()` compared 0.30.0 higher than every
+  0.1.x release, so those installs never saw the chip. One constant,
+  `hooks/tezgah_update.py::RETIRED`, now holds the retired range. The check
+  offers the public release to an install inside it, and the chip adds
+  `(line reset)`.
+
+- **omp marks the first effect after an untrusted read.** Its post-tool hook
+  now calls the shared `marks`. The effect's row carries the inherited channel.
+  The taint notice rides the result. A subagent's report keeps its label, though
+  the bridge never sends the report's body.
+- **tezgah labels more shell reads as network reads.** These now count:
+  `gh issue view|list` and `gh pr view|diff|checkout|list`. A `git clone`
+  counts unless it names a local path. A `git pull` or `fetch` counts when it
+  names a URL.
+  They also count behind `sudo`, `git -C dir` or an `X=1` prefix. A bare
+  `git pull` or `fetch`, or one naming a remote, reads the user's own tree and
+  stays unlabelled. Every host and the opencode plugin read them the same way.
+  Nothing new gets refused.
+- **A shell call after a subagent keeps its result size.** On Claude, dsh and
+  Codex, such a call inherits the subagent channel. Its row then lost
+  `out_bytes`, because the report's byte rule keyed on that channel. The rule
+  now keys on the call's own channel. A background Agent launch now records no
+  `out_bytes` (unknown) instead of its result's field count.
+- **One credential rule on every write route.** It refuses a `ghp_`,
+  `sk-live-` or `AKIA` token in a Write, an Edit, a patch and a heredoc. All
+  four pass
+  `password = os.environ[...]`. The `name=value` shape now counts only next to
+  a shell sink. The gate refuses `git add .env` and passes `.env.example`,
+  `.env.sample`, `.env.template`, `.env.dist` and `.env.defaults`.
+  An identifier such as `pk_users_organization_id` passes: a bare `sk-`, `pk_`
+  or `rk_` counts only with its qualifier (`sk-live-`). A documentation
+  placeholder (`AKIAIOSFODNN7EXAMPLE`, `ghp_xxxx...`) passes, and so does a
+  token in a template or a test fixture. A token the file already holds is
+  not refused again.
+- **The skip rule reads every write dialect.** A test skip that arrived through
+  `patch`, `new_str` or `file_text` used to pass. The rule now reads an
+  `apply_patch` file by file, so a skip in its non-test file still passes.
+- **A shell redirect or `tee` meets the race and task rules.** The gate refuses
+  a shell write into the task record or outside its allowlist. A temp file or a
+  device is scratch: `pytest > /tmp/check.log` meets no allowlist and no race.
+  A shell `run` row that writes any other file now carries `target`, on Python
+  and on opencode. Two sessions that write one file through the shell now
+  collide like two edits.
+- **One corpus holds every host to the core.** `tests/gate_vectors.json` sends
+  each vector through every host's own entry point and matcher. At the base
+  commit 44 cells disagreed with the core. Now none does, outside one named
+  opencode ceiling.
+- **The masker and the status reader drop three misreads.** An escaped `\$'` no longer
+  opens an ANSI-C string. A quote left open blanks only what follows it, and an
+  apostrophe in a heredoc body opens no quote. A quoted newline, a comment, a
+  heredoc body and `exit $?` after a check no longer take the check's status.
+  The opencode plugin reads all of these the same way.
+- **The word reader follows bash on three shapes.** A `$'it\'s'` is one
+  word, so the line after it no longer falls to the
+  rough read. The words after a `$( )` or backtick close stay that command's
+  arguments. `shell_programs` names the substitutions of an unquoted heredoc
+  body and nothing of a quoted one. The fuzzer found all three.
+- **The opencode plugin reads a shell line the way the core does.** Its
+  masker, word reader, program reader and ledger kind follow the core's. A
+  shared corpus pins both sides: the gate-01 prefixes and the status shapes.
+- **A prefix bash reads as words no longer hides a shell rule.** Such a
+  prefix is a URL's `//`, `a#b`, a glob pair or `'x\'`. The masker read it as
+  a comment or an open string and hid the command after it: `HUSKY=0 git
+  commit`, `pytest || true`, `tezgah-task phase` or a credential write. `mask()` now
+  reads a shell line the way bash does. Source files keep the old reading
+  (`mask_source`). `shell_programs` uses the gate's own reader, so `a#b`, a
+  redirect target and an unreadable line no longer mislead it. The opencode
+  plugin reads the line the same way.
+- **A check whose status the line does not keep is no longer a pass.** These
+  lines record as ran: `pytest; echo done`, `pytest; echo EXIT=$?`, `pytest &`,
+  `pytest > log; tail log`. Each exits 0 whatever pytest found.
+  `pytest && echo ok`, `cd x && pytest` and a `set -o pipefail;` pipe still
+  pass (`status_hidden`). The NEUTER comment now names only what it denies.
+  The piped and neutered remedies name the shape that keeps the status.
+- **Two lines each delivering their own `to_human/report.md` are no longer
+  serial twins.** `serial_twins` compares the resolved file, not the spelling.
+- **A claim's `path:line` citation is not a number.** The containment rule
+  lifts it off the statement, like a date.
+- **The research skill's `init` example carries `--ask`.** Without it, `init`
+  refused the command. The skill also says `source` does not check for a commit
+  of the protocol. The order rule proves commit order, not run order.
+- **A hook whose core cannot import fails open and says so.** Eleven entry
+  points imported the core outside `safe()`. A rename or a broken module ended
+  them with a traceback, and on omp that disabled the gate for the session.
+  They now exit 0, print one stderr line and write a `crash` row. The status
+  line shows a `crash` mark for that session. `tezgah-gate check` exits 3, so
+  the MCP `gate_check` no longer reads a dead gate as a pass.
+- **The disarmed-gate mark no longer counts PostToolUse rows.** A PostToolUse
+  hook keeps writing while a broken PreToolUse lets every call through. Only a
+  row from the gate now proves it ran, over write and shell calls.
+- **`--sync` no longer leaves a half-empty plugin copy.** It used to delete
+  the copy, then copy into it. It now builds each copy in a staging tree beside
+  the plugin cache and swaps it in, keeping the copy's `.git`. A sync stopped
+  mid-swap is put back by the next one, `.git` included. A failed copy makes
+  `--sync` exit 1. Every copied file is 0644, or 0755 when executable.
+- **The omp report row compares the bridge byte for byte.** It checked six
+  handler names, so a stale or edited bridge passed. It now compares the
+  bridge with a fresh render.
+- **A malformed `~/.config/tezgah/config.json` is no longer rewritten.**
+  `--install` read it as empty and wrote its defaults over the user's roots.
+  It now refuses the file, names it, leaves its bytes alone and exits 1.
+- **The graph workflows report a failed agent as unknown.** `graph-review` said
+  "all four dimensions came back clean" when every dimension failed. It listed
+  a finding as refuted when both refuters failed. `graph-impact` dropped a
+  failed planner and turned a failed sweep into "no blind spots". Each script
+  now names every failure in an `unknown` list. A finding no refuter answered
+  stays unverified. A stub runtime (`tests/_workflow_harness.mjs`) tests both.
+- **`graph-impact` parses again.** It had one closing parenthesis too many, so
+  Claude's runtime could not load it at all.
+- **The status line marks graph use on a plugin install.** It tested only
+  `mcp__codegraph__`. It now shares the PostToolUse store's test.
+- **tezgah records a Claude skill load.** The plugin's PostToolUse matcher
+  carries `Skill`, and so does dsh's manifest, which mirrors it. The hook writes
+  `skill:<name>` (or the pony/adhd mark). The skill-fitness report then counts
+  Claude sessions. Nobody has checked that Claude fires PostToolUse for the
+  Skill tool.
+- **A host config the installer cannot parse is left alone.** Seven install
+  steps read a host's JSON config and then rewrote it. They cover Codex and
+  Cursor `hooks.json`, opencode's `opencode.json` and `tui.json`, Cursor's
+  `mcp.json` and `cli-config.json`, and omp's `mcp.json`. A trailing comma, a
+  `//` comment or a top level that is not an object made the installer write
+  its default over the file. `--install` now names that file and the parse
+  error, leaves its bytes alone and exits 1.
+- **The skill hint can no longer outlive the hook.** It asks once, with a 4 s
+  wall-clock deadline, well under omp's 10 s hook kill. The prompt goes out
+  redacted and cut at 2,000 characters.
+- **A dead judge provider is not paid for on every call.** A 401, 402 or 5xx
+  marks it down for five minutes. The mark covers that provider, endpoint and
+  key. Until it expires the seam answers with no judgement and sends no request.
+- **codegen guards its egress.** It refuses a redirect to another host, a plain
+  `http` endpoint off this machine, and a file that carries a credential. Each
+  exits 2, so the caller writes the change itself.
+- **Every changing write keeps its own backup.** A write that changes a file
+  copies it to `<file>.<timestamp>.tezgah-bak` first. Before, only the first
+  write left a backup. The oldest timestamped copy is always kept, beside the
+  newest four. A bare `<file>.tezgah-bak` from an older release stays as is.
+  A full uninstall removes the timestamped backups of tezgah's own state too.
+- **`--install` fails when a planned host is not armed.** The run printed MISS
+  under a host and still exited 0. Now it exits 1 and names the host and row
+  under `not armed:`. Only the arming rows count: hooks wired, the contract
+  current, and omp's extension row where an omp CLI exists. Codex
+  `hooks trusted`, the provider keys and Claude's plugin copy stay out,
+  because a correct fresh install leaves them MISS.
+- **Codex write rows know where they ran.** The Codex hook was the one host
+  that gave the ledger no cwd. Its write rows carried no workspace, and a
+  relative path resolved against the hook process instead of the repository.
+- **`tezgah-capture` no longer counts as a read of the screen.** It is the
+  pre-write file snapshot CLI. A turn could end on a done claim because this
+  run stood in for a screen proof or for a passing check.
+- **dsh has no Stop rule.** Its bridge drops every call's outcome, so no check
+  there can show a pass. The rule could only refuse honest work there. The
+  Stop entry leaves `hosts/dsh/hooks.json` until the bridge carries outcomes.
+
+- **A release publishes only after CI passed on its commit.** `release.yml`
+  now runs `ci.yml` as its `ci` job. `npm-publish` and `brew-formula` wait for
+  it. v0.1.2 reached npm and brew while its own CI run failed.
+- **A test run that runs nothing no longer passes.** A docs-only
+  `tests/impacted.py --run` matched no test file and passed with 0 tests. It
+  now runs the docs modules. A run where nothing maps, and a `--ref` with no
+  change, exit 5. It prints a failed module's log, not only its path.
+- **The suite stays out of the real ledger.** Importing `tests/support.py`
+  gives the process a temp HOME and drops `TEZGAH_SESSION`. `tests/test_models.py`
+  does the same for the `tezgah-route` runs it starts.
+- **CI shows what it checks.** The plan report step read the gitignored
+  `.tezgah/` and could never fail, so it left CI. It stays a local check. The
+  docs now take the CI version list from `.github/workflows/ci.yml`.
+  `test-sharded` runs `tests/impacted.py --all` on 3.10 and 3.14 as a
+  four-week shadow of the four-version matrix. No matrix cancels its other
+  legs on a failure.
+- **`bin/tezgah-mcp.py` exists**, the `.py` twin every other Python entry
+  point in `bin/` has.
+
+- **Docs that disagreed with the code.** `docs/gate.md` listed Secret before Workspace,
+  and `decision` checks them the other way. The Language section did not name `lang-off`.
+  `docs/judge.md` counted four callers, and `bin/tezgah-taste` is the fifth. The READMEs
+  said fourteen kill switches. CORE names sixteen. Forty-one bare-file citations, six in
+  code comments, and the repeat-guard anchor in "Adding a rule" pointed at the wrong
+  lines.
+
+- **Uninstall sweeps four more legacy switches.** An uninstall now also sweeps
+  `workspace-off`, `triage-off`, `docs-judge-off` and `update-check-off` from `~/.claude`.
+- **The Homebrew formula runs.** It copied `tezgah-setup` out of the tree, so
+  the copy could not find `hooks/` and died on import. It now links into the
+  installed tree, and also installs the command as `tezgah`.
+
+[Unreleased]: https://github.com/r1z4x/tezgah/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.0.0