@smartmemory/compose 0.2.56-beta → 0.2.58-beta

package/lib/feature-writer.js

@@ -63,6 +63,52 @@ const COMPLEXITIES = new Set(['S', 'M', 'L', 'XL']);
 // produced feature.json. Same vocab the ideabox uses (low|medium|high).
 const IMPACTS = new Set(['low', 'medium', 'high']);
 
+// COMP-TRIAGE-5: front-of-pipeline scope-estimation vocab. `lane` drives which
+// phases get skipped; `estimateSource` records whether the lane came from the
+// front estimator, the doc-reading refinement, or an escalation bump.
+const LANES = new Set(['trivial', 'standard', 'complex']);
+const ESTIMATE_SOURCES = new Set(['front', 'refined', 'escalated']);
+
+// ---------------------------------------------------------------------------
+// validateFeatureFields — shared field-shape guard
+// ---------------------------------------------------------------------------
+
+/**
+ * Validate the subset of feature.json fields that carry a fixed vocabulary or
+ * range. Called from both addRoadmapEntry (below) and the build write path
+ * (lib/build.js) so neither can bypass the guard the way the old inline
+ * `COMPLEXITIES.has` check — scoped only to addRoadmapEntry — allowed
+ * `complexity: String(triageResult.tier)` (e.g. "0".."4") to reach disk via a
+ * raw provider write.
+ *
+ * Every field is optional; only fields present on `fields` are checked.
+ * Throws a plain Error (matching addRoadmapEntry's existing signaling) on the
+ * first violation found.
+ *
+ * @param {object} fields
+ * @param {string} [fields.complexity]     one of S|M|L|XL
+ * @param {number} [fields.triageTier]     integer 0-4
+ * @param {string} [fields.lane]           one of trivial|standard|complex
+ * @param {string} [fields.estimateSource] one of front|refined|escalated
+ */
+export function validateFeatureFields(fields) {
+  if (fields.complexity !== undefined && !COMPLEXITIES.has(fields.complexity)) {
+    throw new Error(`feature-writer: invalid complexity "${fields.complexity}"`);
+  }
+  if (fields.triageTier !== undefined &&
+      (!Number.isInteger(fields.triageTier) || fields.triageTier < 0 || fields.triageTier > 4)) {
+    throw new Error(`feature-writer: invalid triageTier "${fields.triageTier}" — must be an integer 0-4`);
+  }
+  if (fields.lane !== undefined && !LANES.has(fields.lane)) {
+    throw new Error(`feature-writer: invalid lane "${fields.lane}" — must be one of ${[...LANES].join(', ')}`);
+  }
+  if (fields.estimateSource !== undefined && !ESTIMATE_SOURCES.has(fields.estimateSource)) {
+    throw new Error(
+      `feature-writer: invalid estimateSource "${fields.estimateSource}" — must be one of ${[...ESTIMATE_SOURCES].join(', ')}`
+    );
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -75,11 +121,25 @@ function validateCode(code) {
   }
 }
 
+// AUDIT-19: a writer result must never carry the full regenerated ROADMAP.
+// roundtripGuard now returns only small diagnostic fields, but a persistent
+// idempotency-cache entry written before that change can still hold
+// roundtrip.canonical (the entire markdown), so re-sanitize on the way out —
+// covering both the fresh and cache-hit paths, and any future roundtrip writer.
+// No-op for results that don't carry roundtrip.canonical.
+function sanitizeWriterResult(result) {
+  if (result && result.roundtrip && typeof result.roundtrip === 'object' && 'canonical' in result.roundtrip) {
+    const { canonical, ...safe } = result.roundtrip;
+    return { ...result, roundtrip: safe };
+  }
+  return result;
+}
+
 function maybeIdempotent(args, fn) {
   if (args.idempotency_key) {
-    return checkOrInsert(args.cwd, args.idempotency_key, fn).then(({ result }) => result);
+    return checkOrInsert(args.cwd, args.idempotency_key, fn).then(({ result }) => sanitizeWriterResult(result));
   }
-  return Promise.resolve().then(fn);
+  return Promise.resolve().then(fn).then(sanitizeWriterResult);
 }
 
 // ---------------------------------------------------------------------------
@@ -101,6 +161,9 @@ function maybeIdempotent(args, fn) {
  * @param {string} [args.triageTimestamp]  COMP-ROADMAP-PLAN: triage cache stamp
  * @param {string} [args.plannedBy]        COMP-ROADMAP-PLAN: originating plan session
  * @param {string} [args.impact]           COMP-ROADMAP-PLAN: low | medium | high
+ * @param {string} [args.lane]             COMP-TRIAGE-5: trivial | standard | complex
+ * @param {number} [args.triageTier]       COMP-TRIAGE-5: integer 0-4
+ * @param {string} [args.estimateSource]   COMP-TRIAGE-5: front | refined | escalated
  * @param {boolean} [args.force]
  * @param {string} [args.idempotency_key]
  */
@@ -113,9 +176,11 @@ export async function addRoadmapEntry(cwd, args) {
   validateCode(args.code);
   if (!args.description) throw new Error('feature-writer: description is required');
   if (!args.phase) throw new Error('feature-writer: phase is required');
-  if (args.complexity && !COMPLEXITIES.has(args.complexity)) {
-    throw new Error(`feature-writer: invalid complexity "${args.complexity}"`);
-  }
+  // COMP-TRIAGE-5: complexity/triageTier/lane/estimateSource shape validation
+  // lives in the shared validateFeatureFields guard so the build write path
+  // (lib/build.js) can call the same check and can't bypass it the way the
+  // old inline `COMPLEXITIES.has` (scoped only to this function) allowed.
+  validateFeatureFields(args);
   const status = args.status ?? 'PLANNED';
   if (!STATUSES.has(status)) {
     throw new Error(`feature-writer: invalid status "${status}"`);
@@ -166,6 +231,10 @@ export async function addRoadmapEntry(cwd, args) {
     if (args.triageTimestamp !== undefined) feature.triageTimestamp = args.triageTimestamp;
     if (args.plannedBy !== undefined) feature.plannedBy = args.plannedBy;
     if (args.impact !== undefined) feature.impact = args.impact;
+    // COMP-TRIAGE-5: front-of-pipeline scope-estimation fields.
+    if (args.lane !== undefined) feature.lane = args.lane;
+    if (args.triageTier !== undefined) feature.triageTier = args.triageTier;
+    if (args.estimateSource !== undefined) feature.estimateSource = args.estimateSource;
 
     let roundtrip = null;
     if (isLocalProvider(provider)) {
@@ -263,8 +332,8 @@ function readRoadmapBase(roadmapPath) {
 //
 // Blocks only on fixed-point divergence (a visibly churning rendered view);
 // losslessness is surfaced by the validator (Task 6 / validate_project), not
-// blocked here. The full RoundtripResult — including lossless + diffs — is still
-// returned for callers to inspect.
+// blocked here. Return only the small diagnostic fields; `canonical` is the full
+// regenerated ROADMAP and must not leak into MCP writer results.
 async function roundtripGuard(cwd, provider, mutate, { force, label }) {
   const current = await provider.listFeatures();
   const projected = mutate(current.map(f => ({ ...f })));
@@ -286,7 +355,12 @@ async function roundtripGuard(cwd, provider, mutate, { force, label }) {
     err.code = 'ROUNDTRIP_NOT_FIXED_POINT';
     throw err;
   }
-  return rt;
+  return {
+    fixedPoint: rt.fixedPoint,
+    lossless: rt.lossless,
+    passes: rt.passes,
+    diffs: rt.diffs,
+  };
 }
 
 // Audit-log writes are best-effort: a failed append must NOT roll back a

package/lib/lane-gate.js

@@ -0,0 +1,200 @@
+// lib/lane-gate.js
+//
+// COMP-TRIAGE-5 — E3 (Estimate → Execute → Expand) front-of-pipeline scope
+// estimation + verification-gated escalation. Two entry points, extracted from
+// build.js runBuild/executeShipStep so they are unit-testable in isolation:
+//
+//   applyFrontTriage()  — E3 "Estimate": derive the lane from the RAW REQUEST
+//                         before any design/plan/blueprint doc is read, and
+//                         persist validated feature fields (closing the
+//                         complexity: String(tier) bypass at build.js:997/1006).
+//
+//   maybeEscalateLane() — E3 "Expand": on a failed ship-time test gate, escalate
+//                         the lane so the NEXT build runs wider — persist the
+//                         escalated lane + a widened profile + a bounded counter
+//                         and drop a resume checkpoint. STOP → human handoff.
+//                         Re-entry is via re-invocation reading the escalated
+//                         lane, NOT inline runBuild surgery.
+
+import { writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import {
+  estimateScope,
+  tierToComplexity,
+  floorProfileToLane,
+  runTriage,
+  tierToLane,
+  narrowerLane,
+} from './triage.js';
+import { validateFeatureFields } from './feature-writer.js';
+import { escalate } from './escalation.js';
+
+// Docs that make a doc-reading refinement meaningful. Absent all three, runTriage
+// would see zero files and return tier 0 ('trivial') — which is "no signal", not
+// "confirmed simple", and must NOT be allowed to narrow away the front safety clamp.
+const REFINEMENT_DOCS = ['design.md', 'plan.md', 'blueprint.md'];
+
+/**
+ * E3 Estimate. Runs before spec load. Derives {tier, profile, lane} from the raw
+ * request (doc-free) and persists validated fields through the shared validator
+ * (so the tier can no longer be stringified into `complexity`). Returns the
+ * values runBuild needs to toggle skip_if.
+ *
+ * @param {object} a
+ * @param {string} a.featureCode
+ * @param {string} [a.request]        raw task text (opts.description); falls back to the code
+ * @param {object} a.provider         build provider (getFeature/createFeature/putFeature)
+ * @param {object|null} a.cachedFeature  already-fetched feature.json, or null
+ * @returns {Promise<{buildProfile:object, tier:number, lane:string, tierLabel:string, rationale:string, cachedFeature:object}>}
+ */
+export async function applyFrontTriage({ featureCode, request, provider, cachedFeature, cwd, featuresDir }) {
+  // The CLI build path does not thread a description into opts, so fall back to
+  // the feature's own persisted description before the (signal-free) code string —
+  // otherwise every CLI build would classify the code and land low-confidence.
+  const req = request ?? cachedFeature?.description ?? featureCode;
+  const front = estimateScope(req);
+  let tier = front.tier;
+  let lane = front.lane;
+  let buildProfile = front.profile;
+  let estimateSource = 'front';
+
+  // E3 refinement (narrow-only): once design/plan/blueprint docs exist, a
+  // doc-reading pass may CONFIRM a smaller scope than the raw request implied —
+  // but it may only narrow the front lane, never widen it (widening is the
+  // escalation path's job). Gated on doc existence so a doc-less tier-0 read
+  // cannot undo the front safety clamp.
+  if (cwd && featuresDir) {
+    const dir = resolve(cwd, featuresDir, featureCode);
+    const hasDocs = REFINEMENT_DOCS.some((f) => existsSync(join(dir, f)));
+    if (hasDocs) {
+      try {
+        const refined = await runTriage(featureCode, { cwd, featuresDir });
+        const narrowed = narrowerLane(lane, tierToLane(refined.tier));
+        if (narrowed !== lane) {
+          lane = narrowed;
+          tier = refined.tier;
+          buildProfile = floorProfileToLane(refined.profile, narrowed);
+          estimateSource = 'refined';
+        }
+      } catch {
+        /* triage read failed — keep the front estimate */
+      }
+    }
+  }
+
+  const fields = {
+    complexity: tierToComplexity(tier),
+    triageTier: tier,
+    lane,
+    estimateSource,
+    profile: buildProfile,
+    triageTimestamp: new Date().toISOString(),
+  };
+  // Throws on any invalid field — this is the guard the raw provider write bypassed.
+  validateFeatureFields(fields);
+
+  let updated;
+  if (!cachedFeature) {
+    updated = await provider.createFeature(featureCode, {
+      code: featureCode,
+      description: req,
+      status: 'PLANNED',
+      ...fields,
+    });
+  } else {
+    updated = await provider.putFeature(featureCode, { ...cachedFeature, ...fields });
+  }
+
+  return {
+    buildProfile,
+    tier,
+    lane,
+    tierLabel: fields.complexity,
+    rationale: front.rationale,
+    cachedFeature: updated,
+  };
+}
+
+/**
+ * E3 Expand. On a failed ship-time test gate, escalate the lane so the next build
+ * runs wider. Bounded via escalationCount; on STOP or exhausted ladder, writes a
+ * checkpoint and hands off to a human. Best-effort — the caller never blocks ship
+ * on this. Only acts on features that went through front triage (have a `lane`).
+ *
+ * @param {object} a
+ * @param {string} a.featureCode
+ * @param {object} a.provider        build provider
+ * @param {string} [a.featureDir]    dir to write the escalation checkpoint into
+ * @param {string|null} [a.currentPhase]  optional live phase (unused for reEntry today; see escalation.js)
+ * @returns {Promise<{action:'none'|'escalate'|'stop', [from]:string, [to]:string, [reEntryPhase]:string, [escalationCount]:number}>}
+ */
+export async function maybeEscalateLane({ featureCode, provider, featureDir, currentPhase = null }) {
+  const feature = await provider.getFeature(featureCode);
+  // Only features that went through the front seam carry a lane — never escalate
+  // a feature that never opted into lane-based execution.
+  if (!feature?.lane) return { action: 'none' };
+
+  const lane = feature.lane;
+  const escalationCount = feature.escalationCount ?? 0;
+  const decision = escalate({ gate: 'test', passed: false }, lane, escalationCount, currentPhase);
+
+  if (decision === 'STOP') {
+    writeCheckpoint(featureDir, { featureCode, lane, decision: 'STOP', reEntryPhase: null, escalationCount });
+    return { action: 'stop', lane, escalationCount };
+  }
+  if (!decision) return { action: 'none' };
+
+  // Widen the profile to match the ESCALATED lane (not always full) so lane and
+  // profile stay consistent and each rung actually adds phases.
+  const widenedProfile = floorProfileToLane(feature.profile ?? {}, decision.nextLane);
+  validateFeatureFields({ lane: decision.nextLane, estimateSource: 'escalated' });
+  // Write the checkpoint BEFORE stamping triageTimestamp so the checkpoint file's
+  // mtime is older than the stamp — otherwise isTriageStale would treat the just-
+  // escalated feature as stale on the next build and overwrite the escalation.
+  writeCheckpoint(featureDir, {
+    featureCode,
+    lane: decision.nextLane,
+    decision: 'escalate',
+    reEntryPhase: decision.reEntryPhase,
+    escalationCount: escalationCount + 1,
+  });
+  await provider.putFeature(featureCode, {
+    ...feature,
+    lane: decision.nextLane,
+    estimateSource: 'escalated',
+    escalationCount: escalationCount + 1,
+    profile: widenedProfile,
+    triageTimestamp: new Date().toISOString(),
+  });
+  return {
+    action: 'escalate',
+    from: lane,
+    to: decision.nextLane,
+    reEntryPhase: decision.reEntryPhase,
+    escalationCount: escalationCount + 1,
+  };
+}
+
+function writeCheckpoint(featureDir, { featureCode, lane, decision, reEntryPhase, escalationCount }) {
+  if (!featureDir) return;
+  try {
+    mkdirSync(featureDir, { recursive: true });
+    const lines = [
+      `# COMP-TRIAGE-5 Escalation Checkpoint — ${featureCode}`,
+      '',
+      `- Decision: ${decision}`,
+      `- Lane: ${lane}`,
+      reEntryPhase ? `- Re-enter at phase: ${reEntryPhase}` : '- Re-enter: n/a (STOP — human handoff)',
+      `- Escalation count: ${escalationCount}`,
+      '- Trigger: ship-time test gate failed (E3 Expand)',
+      '',
+      decision === 'STOP'
+        ? 'Escalation bound reached. A human should investigate before re-running.'
+        : `Re-run \`compose build ${featureCode}\` — it reads the escalated lane and runs the heavier phases.`,
+      '',
+    ];
+    writeFileSync(join(featureDir, 'escalation-checkpoint.md'), lines.join('\n'), 'utf-8');
+  } catch {
+    /* best-effort — a checkpoint failure must never break the build */
+  }
+}

package/lib/triage.js

@@ -174,6 +174,150 @@ function deriveProfile(signals) {
   };
 }
 
+// ---------------------------------------------------------------------------
+// Front-seam scope estimation (doc-free)
+// ---------------------------------------------------------------------------
+
+// Lane order, smaller index = smaller scope / more conservative.
+const LANE_ORDER = { trivial: 0, standard: 1, complex: 2 };
+
+// Verbs that denote a single, well-defined action. Presence (+ an explicit
+// file path) is what earns 'high' confidence; absence (+ no path) is what
+// earns 'low' confidence and triggers the safety clamp.
+const UNAMBIGUOUS_VERB_RE =
+  /\b(fix(?:e[ds]|ing)?|renam(?:e[ds]?|ing)|add(?:ed|s|ing)?|remov(?:e[ds]?|ing)|delet(?:e[ds]?|ing)|updat(?:e[ds]?|ing)|creat(?:e[ds]?|ing)|implement(?:ed|s|ing)?|refactor(?:ed|s|ing)?|bump(?:ed|s|ing)?|patch(?:ed|es|ing)?|mov(?:e[ds]?|ing)|extract(?:ed|s|ing)?|replac(?:e[ds]?|ing)|revert(?:ed|s|ing)?|rewrit(?:e|es|ing)|rewrote)\b/i;
+
+/**
+ * Map a triage tier (0-4) to a coarse lane.
+ *
+ * @param {number} tier
+ * @returns {'trivial'|'standard'|'complex'}
+ */
+export function tierToLane(tier) {
+  if (tier <= 1) return 'trivial';
+  if (tier === 2) return 'standard';
+  return 'complex';
+}
+
+/**
+ * Clamp a lane up to at least `minimum` (never narrows).
+ *
+ * @param {string} lane
+ * @param {string} minimum
+ * @returns {string}
+ */
+function clampLaneMin(lane, minimum) {
+  return LANE_ORDER[lane] < LANE_ORDER[minimum] ? minimum : lane;
+}
+
+/**
+ * Estimate scope from request text alone — the DOC-FREE front seam.
+ *
+ * Unlike `runTriage`, this never reads plan.md/blueprint.md/design.md (or
+ * any file at all). It derives the same `signals` shape `deriveProfile`
+ * expects purely from the request text and caller-supplied repo-signal
+ * hints, so it can run before any design doc exists — before the genesis
+ * phase, at feature-creation time.
+ *
+ * @param {string} request - Free-text feature/bug request description.
+ * @param {{ files?: string[] }} [repoSignals] - Candidate file paths the
+ *   request plausibly touches (caller-supplied, e.g. from a git-diff or
+ *   grep hint). Minimal shape: `{ files: string[] }`.
+ * @returns {{ tier: number, profile: object, lane: 'trivial'|'standard'|'complex', confidence: 'high'|'medium'|'low', rationale: string }}
+ */
+// Reconcile the tier-derived profile with the (possibly clamped) lane so the two
+// never disagree. The safety clamp raises the LANE, but skip_if is driven by the
+// PROFILE — without this floor a clamped-to-standard lane would still skip
+// verification, defeating the clamp. Standard keeps verification; complex keeps
+// every phase; trivial is left as deriveProfile set it.
+export function floorProfileToLane(profile, lane) {
+  if (lane === 'complex') {
+    return { needs_prd: true, needs_architecture: true, needs_verification: true, needs_report: true };
+  }
+  if (lane === 'standard') {
+    return { ...profile, needs_verification: true };
+  }
+  return { ...profile };
+}
+
+export function estimateScope(request, repoSignals = {}) {
+  const text = request ?? '';
+  const hintedFiles = Array.isArray(repoSignals?.files) ? repoSignals.files : [];
+
+  const textPaths = extractFilePaths(text);
+  const uniquePaths = new Set([...textPaths, ...hintedFiles]);
+  const pathList = [...uniquePaths];
+
+  const taskCount = countTasks(text);
+  const securityPaths = anyMatch(pathList, SECURITY_PATTERNS);
+  const corePaths = anyMatch(pathList, CORE_PATTERNS);
+
+  const signals = {
+    fileCount: uniquePaths.size,
+    securityPaths,
+    corePaths,
+    taskCount,
+    hasDesignDoc: false,
+  };
+
+  const { tier, profile, rationale } = deriveProfile(signals);
+
+  let lane = tierToLane(tier);
+  // Belt-and-suspenders: a security/core path hit must never resolve below
+  // 'standard', independent of how deriveProfile's own tier logic evolves.
+  if (securityPaths || corePaths) {
+    lane = clampLaneMin(lane, 'standard');
+  }
+
+  const hasPaths = uniquePaths.size > 0;
+  const hasUnambiguousVerb = UNAMBIGUOUS_VERB_RE.test(text);
+  let confidence;
+  if (hasPaths && hasUnambiguousVerb) {
+    confidence = 'high';
+  } else if (!hasPaths && !hasUnambiguousVerb) {
+    confidence = 'low';
+  } else {
+    confidence = 'medium';
+  }
+
+  // Safety clamp: under-scoping is the only dangerous error. Low confidence
+  // (no named paths, no clear verb) can never resolve to 'trivial'.
+  if (confidence === 'low') {
+    lane = clampLaneMin(lane, 'standard');
+  }
+
+  return { tier, profile: floorProfileToLane(profile, lane), lane, confidence, rationale };
+}
+
+/**
+ * Map a triage tier to a persisted complexity label.
+ *
+ * @param {number} tier - 0-4
+ * @returns {'S'|'M'|'L'|'XL'}
+ */
+export function tierToComplexity(tier) {
+  if (tier <= 1) return 'S';
+  if (tier === 2) return 'M';
+  if (tier === 3) return 'L';
+  return 'XL';
+}
+
+/**
+ * Return the more conservative (smaller-scope) of two lanes.
+ * Order: trivial < standard < complex.
+ *
+ * Used by refinement/escalation call sites to enforce "narrow-only" — a
+ * later pass may only shrink scope, never widen it (widening is
+ * escalation's job, via `lib/escalation.js`, not refinement's).
+ *
+ * @param {'trivial'|'standard'|'complex'} a
+ * @param {'trivial'|'standard'|'complex'} b
+ * @returns {'trivial'|'standard'|'complex'}
+ */
+export function narrowerLane(a, b) {
+  return LANE_ORDER[a] <= LANE_ORDER[b] ? a : b;
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartmemory/compose",
-  "version": "0.2.56-beta",
+  "version": "0.2.58-beta",
   "description": "Structured AI dev pipeline — goal-to-product orchestration with gates, iteration loops, and feature lifecycle management.",
   "author": "SmartMemory",
   "license": "MIT",

package/server/settings-routes.js

@@ -27,9 +27,16 @@ export function attachSettingsRoutes(app, { settingsStore, broadcastMessage }) {
   });
 
   app.post('/api/settings/reset', (req, res) => {
-    const section = req.body?.section || undefined;
-    const updated = settingsStore.reset(section);
-    broadcastMessage({ type: 'settingsUpdated', settings: updated });
-    res.json(updated);
+    try {
+      const section = req.body?.section || undefined;
+      const updated = settingsStore.reset(section);
+      broadcastMessage({ type: 'settingsUpdated', settings: updated });
+      res.json(updated);
+    } catch (err) {
+      // AUDIT-2: reset() can now throw if the write fails; surface it as JSON
+      // {error} (mirrors PATCH) so the client sees a failure instead of an
+      // unhandled 500 that apiCall's res.json() cannot parse.
+      res.status(500).json({ error: err.message });
+    }
   });
 }

package/server/settings-store.js

@@ -35,11 +35,23 @@ export class SettingsStore {
   }
 
   _save() {
+    // AUDIT-2: atomic write (temp + rename) so a partial/failed write can never
+    // truncate the live settings.json — the real file is only ever replaced by an
+    // atomic rename of a fully-written temp file. On failure the live file is left
+    // untouched (last-good), which keeps disk consistent with the in-memory
+    // rollback performed by update()/reset().
+    const tmp = `${this._file}.tmp-${process.pid}`;
     try {
       fs.mkdirSync(path.dirname(this._file), { recursive: true });
-      fs.writeFileSync(this._file, JSON.stringify(this._userSettings, null, 2), 'utf-8');
+      fs.writeFileSync(tmp, JSON.stringify(this._userSettings, null, 2), 'utf-8');
+      fs.renameSync(tmp, this._file);
     } catch (err) {
+      try { fs.rmSync(tmp, { force: true }); } catch { /* ignore cleanup failure */ }
       console.error('[settings] Failed to save settings:', err.message);
+      // Never report a save as successful when it did not reach disk. update()/
+      // reset() roll back in-memory state and rethrow; the routes surface it as an
+      // error response so the modal shows "Save failed" instead of "Saved".
+      throw new Error(`Failed to persist settings: ${err.message}`);
     }
   }
 
@@ -63,6 +75,7 @@ export class SettingsStore {
         gate_threshold: null, // null = off, number = min_score required
         weights: {},          // dimension weight overrides (must sum to 1.0 ± 0.01)
       },
+      governance: { phases: {} },
       // Claude thinking/effort controls. mode='tier' inherits the tier default
       // (critical → adaptive+xhigh, standard → adaptive+high, fast → off).
       // effort=null likewise inherits the tier default.
@@ -93,37 +106,61 @@ export class SettingsStore {
         weights: { ...defaults.health.weights, ...user.health?.weights },
       },
       thinking: { ...defaults.thinking, ...user.thinking },
+      governance: {
+        ...defaults.governance,
+        ...user.governance,
+        phases: { ...defaults.governance.phases, ...user.governance?.phases },
+      },
     };
   }
 
   /** Validate and apply a partial settings update. */
   update(patch) {
     this._validate(patch);
+    // AUDIT-2: transactional apply — if the persist below fails, roll memory
+    // back so the store never reports a failed save while holding the change.
+    const prev = JSON.parse(JSON.stringify(this._userSettings));
     // Deep merge into user settings
-    for (const section of ['policies', 'iterations', 'models', 'ui', 'capabilities', 'health', 'thinking']) {
+    for (const section of ['policies', 'iterations', 'models', 'ui', 'capabilities', 'health', 'thinking', 'governance']) {
       if (patch[section]) {
         if (!this._userSettings[section]) this._userSettings[section] = {};
         if (section === 'iterations') {
           for (const [key, val] of Object.entries(patch.iterations)) {
             this._userSettings.iterations[key] = { ...this._userSettings.iterations[key], ...val };
           }
+        } else if (section === 'governance') {
+          this._userSettings.governance.phases = {
+            ...this._userSettings.governance.phases,
+            ...patch.governance.phases,
+          };
         } else {
           Object.assign(this._userSettings[section], patch[section]);
         }
       }
     }
-    this._save();
+    try {
+      this._save();
+    } catch (err) {
+      this._userSettings = prev;
+      throw err;
+    }
     return this.get();
   }
 
   /** Reset user overrides. If section given, reset only that section. */
   reset(section) {
+    const prev = JSON.parse(JSON.stringify(this._userSettings));
     if (section) {
       delete this._userSettings[section];
     } else {
       this._userSettings = {};
     }
-    this._save();
+    try {
+      this._save();
+    } catch (err) {
+      this._userSettings = prev;
+      throw err;
+    }
     return this.get();
   }
 
@@ -132,7 +169,7 @@ export class SettingsStore {
 
     // Reject unknown top-level keys
     for (const key of Object.keys(patch)) {
-      if (!['policies', 'iterations', 'models', 'ui', 'capabilities', 'health', 'thinking'].includes(key)) {
+      if (!['policies', 'iterations', 'models', 'ui', 'capabilities', 'health', 'thinking', 'governance'].includes(key)) {
         throw new Error(`Unknown settings section: ${key}`);
       }
     }
@@ -145,6 +182,17 @@ export class SettingsStore {
       }
     }
 
+    if (patch.governance) {
+      if (!patch.governance.phases || typeof patch.governance.phases !== 'object' || Array.isArray(patch.governance.phases)) {
+        throw new Error('Invalid governance.phases: must be an object');
+      }
+      for (const [phase, mode] of Object.entries(patch.governance.phases)) {
+        if (mode !== null && !validModes.has(mode)) {
+          throw new Error(`Invalid governance policy mode for ${phase}: ${mode}`);
+        }
+      }
+    }
+
     if (patch.iterations) {
       for (const [type, config] of Object.entries(patch.iterations)) {
         if (config.maxIterations !== undefined) {

package/dist/assets/channel-BwltV6wa.js

@@ -1 +0,0 @@
-import{ag as o,ah as n}from"./App-B4vuNX1g.js";const t=(a,r)=>o.lang.round(n.parse(a)[r]);export{t as c};

package/dist/assets/classDiagram-OUVF2IWQ-D4b7dksL.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-V7JOEXUC-CKNWOjmw.js";import{_ as i}from"./App-B4vuNX1g.js";import"./chunk-5VM5RSS4-BkOdBdcj.js";import"./chunk-XXDRQBXY-Ct9K5k9G.js";import"./chunk-VR4S4FIN-Bx3WjdJ3.js";import"./chunk-32BRIVSS-CLJH-LjM.js";import"./mobile-CNLMhdFP.js";import"./index-D4TlupB7.js";import"./graph-xkel59g2.js";var b={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{b as diagram};

package/dist/assets/classDiagram-v2-EOCWNBFH-D4b7dksL.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-V7JOEXUC-CKNWOjmw.js";import{_ as i}from"./App-B4vuNX1g.js";import"./chunk-5VM5RSS4-BkOdBdcj.js";import"./chunk-XXDRQBXY-Ct9K5k9G.js";import"./chunk-VR4S4FIN-Bx3WjdJ3.js";import"./chunk-32BRIVSS-CLJH-LjM.js";import"./mobile-CNLMhdFP.js";import"./index-D4TlupB7.js";import"./graph-xkel59g2.js";var b={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{b as diagram};