@sabaiway/agent-workflow-kit 14.4.2 → 14.4.3

package/CHANGELOG.md

@@ -4,6 +4,21 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 14.4.3 — cleanup after the two splits: one false doc pointer, a test title, a list order, comments and whitespace; nothing the kit decides, prints or records changes
+
+**Six small review findings from the review-state and core-evidence splits are fixed.** The only shipped doc change is in
+`references/modes/commit-guard.md`: it now says the fingerprint argv lives in `core-evidence-tree.mjs` and that the
+`core-evidence.mjs` facade re-exports it. The earlier text named the facade as its home. Everything else is one
+test title, one list order, comments and whitespace.
+
+- **Tests.** In `tools/review-state.test.mjs`, the block that runs `--check` and proves a later ungrounded receipt
+  outranks an earlier grounded SHIP no longer carries the name `backendReceiptStatus`. In
+  `test/package-content.test.mjs`, `tools/grounding.mjs` sits under the AD-038 pair comment again, and two comments
+  use a real em dash instead of the literal `\u2014` escape. The `cleanState` helper in `tools/review-state-judge.test.mjs`
+  loses a stray indent, and a blank line before a closing brace in `tools/core-evidence-tree.test.mjs` is gone.
+- **Sources.** The first-line comments of `review-state-build.mjs`, `review-state-flow.mjs` and `review-state-render.mjs`
+  use the em dash the other modules use, and `core-evidence-store-read.mjs` loses a doubled blank line.
+
 ## 14.4.2 — `core-evidence.mjs` becomes a facade over six leaves; nothing the tool decides, prints or records changes (AD-150)
 
 **The core-evidence writer is now six small modules behind its old entry point.** `tools/core-evidence.mjs` was one

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '14.4.2'
+  version: '14.4.3'
 ---
 
 # agent-workflow-kit

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "14.4.2",
+  "version": "14.4.3",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "14.4.2",
+  "version": "14.4.3",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",

package/references/modes/commit-guard.md

@@ -24,7 +24,7 @@ Run `node ${CLAUDE_SKILL_DIR}/tools/commit-guard.mjs --check [--cwd <dir>]` —
 
 **Boundary — what «the commit captures the tree» means for submodules.** The guard proves the SUPERPROJECT commit captures the SUPERPROJECT working tree. A superproject commit stores a submodule as a gitlink OID and never captures its file content — that content is the submodule's own commit boundary. The dirty-submodule refusal is therefore a best-effort COURTESY beyond the guard's boundary, and its completeness is bounded by what the submodule itself reports: a file held behind a `skip-worktree` / `assume-unchanged` bit in the SUBMODULE's own index is invisible to the submodule's status and so to this refusal. Deepening the nested probe was tried and abandoned — three consecutive review rounds each produced a new way for it to answer wrongly — so the honest contract is the boundary, not a completeness claim. Tracked as its own class.
 
-**Stated residual — the payload flags close the config-blind class.** The fingerprint argv in the ONE node home, `core-evidence.mjs`, carries `--no-textconv --ignore-submodules=none` beside `--no-ext-diff`; both bash twins are parity-pinned to that set for their fingerprint and review-payload diffs, so host textconv and submodule-ignore configuration cannot hide staged bytes. Refusal 2 remains the fail-closed backstop for any DIRTY index whose staged content the payload still cannot see: it names making the change visible to `git diff --cached` and re-running the final gate, without guessing a flag or configuration key.
+**Stated residual — the payload flags close the config-blind class.** The fingerprint argv in the ONE node home, `core-evidence-tree.mjs` (re-exported by the `core-evidence.mjs` facade), carries `--no-textconv --ignore-submodules=none` beside `--no-ext-diff`; both bash twins are parity-pinned to that set for their fingerprint and review-payload diffs, so host textconv and submodule-ignore configuration cannot hide staged bytes. Refusal 2 remains the fail-closed backstop for any DIRTY index whose staged content the payload still cannot see: it names making the change visible to `git diff --cached` and re-running the final gate, without guessing a flag or configuration key.
 
 **Human residual (stated, accepted):** `git commit --no-verify` bypasses any pre-commit hook — a self-discipline mechanism, not a security boundary.
 

package/tools/core-evidence-store-read.mjs

@@ -41,7 +41,6 @@ const isNonEmptyString = (v) => typeof v === 'string' && v.length > 0;
 const HEX64_RE = /^[0-9a-f]{64}$/;
 const HEX40_RE = /^[0-9a-f]{40}$/;
 
-
 export const validateEvidenceRecord = (record) => {
   if (!isPlainObject(record)) return { ok: false, reason: 'record is not an object' };
   if (record.schema !== EVIDENCE_SCHEMA_VERSION) {

package/tools/review-state-build.mjs

@@ -1,4 +1,4 @@
-// review-state-build.mjs - read-only git plumbing and buildState.
+// review-state-build.mjs — read-only git plumbing and buildState.
 
 import { lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';

package/tools/review-state-flow.mjs

@@ -1,4 +1,4 @@
-// review-state-flow.mjs - plan-adoption coverage and the armed-flow arms.
+// review-state-flow.mjs — plan-adoption coverage and the armed-flow arms.
 
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';

package/tools/review-state-render.mjs

@@ -1,4 +1,4 @@
-// review-state-render.mjs - the human report and the mask advisory line.
+// review-state-render.mjs — the human report and the mask advisory line.
 
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';