ai-engineering-loop 1.0.12 → 1.0.14

package/.agents/devil-advocate.md

@@ -28,7 +28,7 @@ Do not ask for Maker rationale.
 
 Report Spec and Standards as separate findings. Do not rerank one axis with the other. A change can pass Spec and fail Standards, or the reverse. Do not spawn children to split axes.
 
-**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC. BLOCKER or HIGH only for a real AC breach or runtime defect.
+**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC, happy-path-only suite vs written failure table. BLOCKER or HIGH only for a real AC breach or runtime defect.
 
 **Standards** (`axis: "standards"`): `.ai-engineering-loop/conventions.md` plus the smell baseline below. Judgement calls: severity MEDIUM or LOW. Set `hardConvention: true` only when conventions.md states a hard rule that this hunk violates. A smell that hides an AC defect is Spec, not Standards.
 

package/.agents/judge.md

@@ -14,6 +14,10 @@ Finish in at most 4 tool calls, then emit the verdict. Read the Finding Ledger a
 
 Use only paths in the spawn prompt: Goal Contract, verification evidence, Finding Ledger. Ignore Maker optimism and reviewer tone. Disposition never overrides Validity plus Severity.
 
+AC source is the Goal Contract **file** only. Chat `setuju` and the parent transcript are not AC. Do not PASS because the parent agreed in chat. `CONTEXT_ISOLATION_ONLY` does not relax this.
+
+ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, is only a source grep, or is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error rows.
+
 ## Axes
 
 Do not merge Spec and Standards into one ranking.

package/.agents/workflows/ai-engineering-loop.md

@@ -5,7 +5,7 @@ description: Run the AI Engineering Loop on Antigravity (init, status, refresh,
 
 Follow `policies/review-budget.md`. Parent is Maker plus orchestrator. Do not use `browser_subagent`.
 
-Stage 1: grill if the task is ambiguous (`core/grill-policy.md`), then freeze the Goal Contract. On `adapter_type: dot`, that grill includes `task-impact-inquiry` (Antigravity skill under `~/.gemini/config/skills/`); do not run a second interview. Use `.ai-engineering-loop/glossary.md`. Name test seams. Maker: TDD at those seams (`policies/tdd-policy.md`). Bugs: red repro first (`core/root-cause-analysis.md`). Mid-loop stop: `core/handoff-policy.md`.
+Stage 1: if the user asks for ideas, list a short menu and wait; do not implement. Grill if the task is ambiguous (`core/grill-policy.md`), then freeze the Goal Contract file. Chat agreement is not freeze. On `adapter_type: dot`, that grill includes `task-impact-inquiry` (Antigravity skill under `~/.gemini/config/skills/`); do not run a second interview. Use `.ai-engineering-loop/glossary.md`. Name test seams. AC is a failure table (happy, empty/omit, boundary, sibling, error). One red test per AC row. Do not freeze sunny-path-only. Maker: TDD at those seams (`policies/tdd-policy.md`): one red test per AC row. Bugs: red repro first (`core/root-cause-analysis.md`). Mid-loop stop: `core/handoff-policy.md`.
 
 If `invoke_subagent` (or Task) exists, spawn `devil-advocate` then `judge` as siblings. Wait for each child. Do not run them in the background. Use `general-purpose` only if the named type is rejected.
 

package/.claude/agents/devil-advocate.md

@@ -29,7 +29,7 @@ Do not ask for Maker rationale.
 
 Report Spec and Standards as separate findings. Do not rerank one axis with the other. A change can pass Spec and fail Standards, or the reverse. Do not spawn children to split axes.
 
-**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC. BLOCKER or HIGH only for a real AC breach or runtime defect.
+**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC, happy-path-only suite vs written failure table. BLOCKER or HIGH only for a real AC breach or runtime defect.
 
 **Standards** (`axis: "standards"`): `.ai-engineering-loop/conventions.md` plus the smell baseline below. Judgement calls: severity MEDIUM or LOW. Set `hardConvention: true` only when conventions.md states a hard rule that this hunk violates. A smell that hides an AC defect is Spec, not Standards.
 

package/.claude/agents/judge.md

@@ -15,6 +15,10 @@ Finish in at most 4 tool calls, then emit the verdict. Read the Finding Ledger a
 
 Use only paths in the spawn prompt: Goal Contract, verification evidence, Finding Ledger. Ignore Maker optimism and reviewer tone. Disposition never overrides Validity plus Severity.
 
+AC source is the Goal Contract **file** only. Chat `setuju` and the parent transcript are not AC. Do not PASS because the parent agreed in chat. `CONTEXT_ISOLATION_ONLY` does not relax this.
+
+ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, is only a source grep, or is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error rows.
+
 ## Axes
 
 Do not merge Spec and Standards into one ranking.

package/.claude/skills/ai-engineering-loop/SKILL.md

@@ -32,8 +32,8 @@ Claude Code talks to strict proxies (including Kiro). Follow this exactly:
 Parent session is Maker plus orchestrator. Spawn Devil's Advocate and Judge as **siblings**, not nested.
 
 1. Stage 0: `npx ai-engineering-loop sync-hosts` then `npx ai-engineering-loop status` (init or refresh if missing or stale). Read `.ai-engineering-loop/glossary.md`. If sync-hosts copied files, tell the user a new session is needed for updated skill text; keep going with this session.
-2. Stage 1: Goal Contract (`core/goal-contract.md`). If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes the four-pillar blast radius (state, sibling, approval, queues). Do not run a second interview. Freeze before any production edit. Name test seams. Use glossary terms.
-3. Stages 2-4: Maker in the parent. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`). Surgical diff.
+2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes the four-pillar blast radius (state, sibling, approval, queues). Do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms. AC is a failure table (happy, empty/omit, boundary, sibling, error). One red test per AC row. Do not freeze sunny-path-only.
+3. Stages 2-4: Maker in the parent. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`): one red test per AC row. Surgical diff.
 4. Stage 5: run commands from `.ai-engineering-loop/verification.md`. Keep command, exit code, stdout, test counts. Vague "seems green" is invalid.
 5. Write artifacts, then spawn. Before Devil's Advocate:
    - Write `git diff` to a file (for example `.ai-engineering-loop/tasks/current.diff`).

package/.gemini/skills/ai-engineering-loop/SKILL.md

@@ -25,8 +25,8 @@ Canonical mode ids: `TRUE_INDEPENDENT_AGENT`, `ISOLATED_AGENT_INSTANCE`, `FRESH_
 ## Loop
 
 1. Stage 0: `npx ai-engineering-loop sync-hosts` then `npx ai-engineering-loop status` (init or refresh if missing or stale). Read `.ai-engineering-loop/glossary.md`. If sync-hosts copied files, tell the user a new session is needed for updated skill text; keep going with this session.
-2. Stage 1: Goal Contract (`core/goal-contract.md`). If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes `task-impact-inquiry` (this host: `~/.gemini/config/skills/task-impact-inquiry`); do not run a second interview. Freeze before any production edit. Name test seams. Use glossary terms.
-3. Stages 2-4: Maker in the parent. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`). Surgical diff.
+2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes `task-impact-inquiry` (this host: `~/.gemini/config/skills/task-impact-inquiry`); do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms. AC is a failure table (happy, empty/omit, boundary, sibling, error). One red test per AC row. Do not freeze sunny-path-only.
+3. Stages 2-4: Maker in the parent. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`): one red test per AC row. Surgical diff.
 4. Stage 5: run commands from `.ai-engineering-loop/verification.md`. Keep command, exit code, stdout, test counts. Vague "seems green" is invalid.
 5. Write artifacts, then spawn. Before Devil's Advocate:
    - Write `git diff` to a file (for example `.ai-engineering-loop/tasks/current.diff`).

package/.grok/agents/devil-advocate.md

@@ -30,7 +30,7 @@ Do not ask for Maker rationale.
 
 Report Spec and Standards as separate findings. Do not rerank one axis with the other. A change can pass Spec and fail Standards, or the reverse. Do not spawn children to split axes.
 
-**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC. BLOCKER or HIGH only for a real AC breach or runtime defect.
+**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC, happy-path-only suite vs written failure table. BLOCKER or HIGH only for a real AC breach or runtime defect.
 
 **Standards** (`axis: "standards"`): `.ai-engineering-loop/conventions.md` plus the smell baseline below. Judgement calls: severity MEDIUM or LOW. Set `hardConvention: true` only when conventions.md states a hard rule that this hunk violates. A smell that hides an AC defect is Spec, not Standards.
 

package/.grok/agents/judge.md

@@ -16,6 +16,10 @@ Finish in at most 4 tool calls, then emit the verdict. Read the Finding Ledger a
 
 Use only paths in the spawn prompt: Goal Contract, verification evidence, Finding Ledger. Ignore Maker optimism and reviewer tone. Disposition never overrides Validity plus Severity.
 
+AC source is the Goal Contract **file** only. Chat `setuju` and the parent transcript are not AC. Do not PASS because the parent agreed in chat. `CONTEXT_ISOLATION_ONLY` does not relax this.
+
+ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, is only a source grep, or is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error rows.
+
 ## Axes
 
 Do not merge Spec and Standards into one ranking.

package/.grok/skills/ai-engineering-loop/SKILL.md

@@ -45,8 +45,8 @@ Run `npx ai-engineering-loop <command>` in the target repo. Do not commit unless
 ### `/ai-engineering-loop [task]`
 
 1. Stage 0: `npx ai-engineering-loop sync-hosts` then `npx ai-engineering-loop status` (init/refresh if missing or stale). Read `.ai-engineering-loop/glossary.md`. If sync-hosts copied files, tell the user a new session is needed for updated skill text; keep going with this session.
-2. Stage 1: Goal Contract (`core/goal-contract.md`). If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes the four-pillar blast radius (state, sibling, approval, queues). Do not run a second interview. Freeze before any production edit. Name test seams. Use glossary terms.
-3. Stages 2–4: Maker work in the **parent**. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`). Surgical diff. Parent may be the Maker; do not spawn Maker as a child if you still need to spawn DA/Judge afterward from the same parent.
+2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes the four-pillar blast radius (state, sibling, approval, queues). Do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms. AC is a failure table (happy, empty/omit, boundary, sibling, error). One red test per AC row. Do not freeze sunny-path-only.
+3. Stages 2–4: Maker work in the **parent**. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`): one red test per AC row. Surgical diff. Parent may be the Maker; do not spawn Maker as a child if you still need to spawn DA/Judge afterward from the same parent.
 4. Stage 5: run verification from `.ai-engineering-loop/verification.md`. Keep command, exit code, stdout, test counts. Vague "seems green" is invalid.
 5. Write artifacts to disk so children do not need parent chat:
    - Goal Contract path

package/README.md

@@ -6,7 +6,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/egagofur/ai-engineering-loop/pulls)
 [![AI Engineering](https://img.shields.io/badge/AI-Engineering%20Loop-orange.svg)](https://github.com/egagofur/ai-engineering-loop)
-[![Release](https://img.shields.io/badge/release-v1.0.12-purple.svg)](https://github.com/egagofur/ai-engineering-loop/releases)
+[![Release](https://img.shields.io/badge/release-v1.0.14-purple.svg)](https://github.com/egagofur/ai-engineering-loop/releases)
 
 **A Reusable, Framework-Agnostic AI Engineering Operating System for Autonomous Coding Agents**
 
@@ -64,10 +64,10 @@ The 8-stage loop stays one OS. These techniques sit **inside** existing stages (
 
 | Stage | Technique | Spec |
 |---|---|---|
-| 1 | Grill until the design-tree frontier is empty, then freeze the Goal Contract. Skip if already frozen, waived, or headless with testable AC. | `core/grill-policy.md` |
+| 1 | Grill until the design-tree frontier is empty, then freeze the Goal Contract. Idea requests: menu, wait, then grill the pick. Chat `setuju` is not freeze; user-visible decisions must be numbered AC in the contract file. AC is a **failure table** (happy, empty/omit, boundary, sibling, error), not sunny path only. | `core/grill-policy.md` |
 | 1 | Ubiquitous language in `.ai-engineering-loop/glossary.md`; load-bearing choices in `.ai-engineering-loop/adrs/` | `core/repo-config-schema.md` |
 | 2 | Bugs: red repro → minimise → hypothesise → instrument → fix | `core/root-cause-analysis.md` |
-| 4–5 | Red-green at named **seams**; no implementation-coupled or tautological tests | `policies/tdd-policy.md` |
+| 4–5 | Red-green at named **seams**; failure table (not happy path only); coverage is a map; no grep/tautology | `policies/tdd-policy.md` |
 | 6–7 | Spec vs Standards reported separately. Standards BLOCKER/HIGH iterate only when `hardConvention` is true | `policies/finding-policy.md` |
 | any | Mid-loop stop writes `.ai-engineering-loop/tasks/handoff.md` | `core/handoff-policy.md` |
 

package/agents/judge.md

@@ -49,7 +49,8 @@ flowchart LR
 
 ### Step 2: Goal Contract Compliance Audit
 - Cross-reference every Acceptance Criterion (AC-1 through AC-N) from the [Goal Contract](file:///Users/egagofur/Development/work/ai-engineering-loop/core/goal-contract.md).
-- Verify that automated tests exist that explicitly exercise and prove each criterion.
+- Verify that automated tests exist that explicitly exercise and prove each criterion, including non-happy-path rows in the failure table.
+- A happy-path-only suite while the contract lists empty, boundary, sibling, or error rows is `ITERATE`.
 - Verify that no out-of-scope files were touched and technical constraints were respected.
 
 ### Step 3: Finding Triage & Evidence Verification

package/agents/maker.md

@@ -28,7 +28,7 @@ flowchart LR
 3. **Test-Driven Engineering** ([TDD Policy](file:///Users/egagofur/Development/work/ai-engineering-loop/policies/tdd-policy.md)):
    - Red before green at the Goal Contract's named seams only.
    - Tests observe public behavior, use glossary terms, and never assert implementation details.
-   - Cover the AC slice in play: happy path, negative edge, null/empty, boundary. Vertical slices, not all-tests-then-all-code.
+   - Cover the AC slice in play: happy path, empty/omit, boundary, sibling/isolation, error/denied. One red test per AC row. Vertical slices, not all-tests-then-all-code.
 4. **Addressing Reviewer Findings**:
    - In subsequent iterations, ingest findings from the [Devil's Advocate](file:///Users/egagofur/Development/work/ai-engineering-loop/agents/devil-advocate.md) and directives from the [Judge](file:///Users/egagofur/Development/work/ai-engineering-loop/agents/judge.md).
    - Fix validated issues surgically.

package/agents/shared/devil-advocate.body.md

@@ -22,7 +22,7 @@ Do not ask for Maker rationale.
 
 Report Spec and Standards as separate findings. Do not rerank one axis with the other. A change can pass Spec and fail Standards, or the reverse. Do not spawn children to split axes.
 
-**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC. BLOCKER or HIGH only for a real AC breach or runtime defect.
+**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC, happy-path-only suite vs written failure table. BLOCKER or HIGH only for a real AC breach or runtime defect.
 
 **Standards** (`axis: "standards"`): `.ai-engineering-loop/conventions.md` plus the smell baseline below. Judgement calls: severity MEDIUM or LOW. Set `hardConvention: true` only when conventions.md states a hard rule that this hunk violates. A smell that hides an AC defect is Spec, not Standards.
 

package/agents/shared/judge.body.md

@@ -8,6 +8,10 @@ Finish in at most 4 tool calls, then emit the verdict. Read the Finding Ledger a
 
 Use only paths in the spawn prompt: Goal Contract, verification evidence, Finding Ledger. Ignore Maker optimism and reviewer tone. Disposition never overrides Validity plus Severity.
 
+AC source is the Goal Contract **file** only. Chat `setuju` and the parent transcript are not AC. Do not PASS because the parent agreed in chat. `CONTEXT_ISOLATION_ONLY` does not relax this.
+
+ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, is only a source grep, or is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error rows.
+
 ## Axes
 
 Do not merge Spec and Standards into one ranking.

package/bin/ai-engineering-loop.js

@@ -21,7 +21,7 @@ const {
   formatHostSyncReport
 } = require('../lib/sync-hosts.js');
 
-const VERSION = '1.0.12';
+const VERSION = '1.0.14';
 const CWD = process.cwd();
 const CONTEXT_DIR = path.join(CWD, '.ai-engineering-loop');
 
@@ -275,7 +275,7 @@ function generateContextFiles(rootDir, discovery, trigger = 'init', impact = 'IN
 
   // 0. metadata.json (Baseline)
   const metadataJson = {
-    contextVersion: '1.0.12',
+    contextVersion: '1.0.14',
     generatedAt: new Date().toISOString(),
     repositoryRevision: currentRevision,
     projectProfile: discovery.profile,

package/core/goal-contract.md

@@ -29,9 +29,15 @@ Every Goal Contract MUST adhere to the following schema in Markdown or structure
 [Explain what changes for the real-world actor (e.g. Employee, Admin, Customer, System). Describe the before/after lifecycle state transition.]
 
 ## 3. Acceptance Criteria (AC)
-- [ ] AC-1: [Exact, testable statement with expected outcome]
-- [ ] AC-2: [Exact, testable statement with expected outcome]
-- [ ] AC-3: [Edge case or boundary behavior explicitly specified]
+Each AC is one row that can **fail**. Happy path alone is not a contract (`policies/tdd-policy.md`).
+
+| AC | Input / actor | Expected at seam | Must fail if missing |
+|---|---|---|---|
+| AC-1 | Happy path | [observable] | [what would still look green] |
+| AC-2 | Empty / omitted field | [observable] | [what would still look green] |
+| AC-3 | Boundary | [observable] | [what would still look green] |
+| AC-4 | Sibling / isolation (if domain has siblings) | [observable] | [what would still look green] |
+| AC-5 | Error / denied / locked | [observable] | [what would still look green] |
 
 ## 4. Technical Constraints
 - [Architecture]: [Preserve existing patterns, layer boundaries, dependency conventions]
@@ -77,6 +83,9 @@ Every Goal Contract MUST adhere to the following schema in Markdown or structure
    - Neither the Maker Agent nor the Devil's Advocate Agent may alter Acceptance Criteria during an iteration loop to make tests pass or bypass critique.
 3. **Contract Amendments**:
    - If during implementation a fundamental contradiction or impossible requirement is discovered, the agent must trigger **Human Escalation**. Only a human user may amend the Goal Contract.
+4. **Chat is not the contract**:
+   - Parent-transcript `setuju` does not freeze AC.
+   - Every user-visible grill decision (order of pages, enable flags, layout) MUST appear as AC-1..N in the contract file before Maker starts.
 
 ---
 
@@ -100,3 +109,6 @@ Every single item listed under `Acceptance Criteria` must map to at least one co
 - **The Parallel Glossary**: Using 20 words for a concept that already has a term in `glossary.md`.
 - **The Missing Constraint**: Failing to declare out-of-scope files, leading to arbitrary refactoring of adjacent legacy modules.
 - **The Self-Serving Goal**: Modifying acceptance criteria post-hoc when tests fail rather than fixing the underlying implementation.
+- **The Chat Contract**: Treating "setuju" in the parent transcript as AC. The file is the contract.
+- **The Wrong Artifact**: Tests pass on a `/tmp` build while the sample the user opens omits the feature.
+- **The Happy-Path Contract**: Only the sunny case is an AC. Coverage % is not a substitute for a failure table.

package/core/grill-policy.md

@@ -21,6 +21,30 @@ Skip grill (write the Goal Contract from what is already known) when any of thes
 
 Do not interview the user for **facts** you can look up (files, scripts, types, git). Look them up. Grill only **decisions**.
 
+## Idea and menu requests
+
+If the user asks for ideas, a feature catalog, or "what should we add" without naming one task:
+
+1. Do not implement.
+2. Do not freeze a Goal Contract.
+3. List at most five options. Mark one recommended. Wait for a pick.
+4. After they pick, grill that one task, then freeze.
+
+`/ai-engineering-loop` on an idea request still stays this loop: menu, then grill. Do not switch to a parallel brainstorm product.
+
+## Freeze gate
+
+Chat `setuju`, `lanjut`, `ok`, or "looks good" is **not** a freeze.
+
+Before Maker starts:
+
+1. Every accepted grill decision that changes user-visible output is a numbered AC in the Goal Contract **file** (page order, enable flags, layout, copy, numbering).
+2. Each of those ACs names the artifact to inspect (sample path, command, seam).
+3. Write `.ai-engineering-loop/tasks/goal-contract.md` (or the path this repo uses). Show the AC list.
+4. Freeze only after that file exists and contains those ACs.
+
+If a decision was agreed in chat and is missing from the file, the contract is not frozen. Do not start Maker.
+
 ## DOT adapter (`adapter_type: dot`)
 
 On DOT repositories, grill is **one** session that includes the four-pillar blast radius from Antigravity skill `task-impact-inquiry` (`~/.gemini/config/skills/task-impact-inquiry/SKILL.md`). Do not run that skill as a second interview after grill.
@@ -56,12 +80,14 @@ The grill is done when the frontier is empty: every branch visited, nothing sile
 ## What the grill must settle
 
 - Objective and business outcome
-- Acceptance criteria that can fail a test
+- Acceptance criteria that can fail a test, as a **failure table** (not happy path only)
 - Out of scope
 - Test **seams** (public interfaces to observe; prefer existing seams; fewer is better)
 - Glossary terms to use (read and update `.ai-engineering-loop/glossary.md`)
 - Hard decisions that belong in an ADR under `.ai-engineering-loop/adrs/`
 
+A Goal Contract with only the sunny path is not frozen. Include at least: happy path, empty/omitted input, one boundary, one isolation/sibling (when the domain has siblings), one error/denied path. DOT four-pillar rows count toward this table.
+
 ## Invariants
 
 - No production code edits during grill.

package/core/judge-policy.md

@@ -52,13 +52,19 @@ The Judge renders decisions based strictly on **Validity + Severity**, then **re
   3. Zero open `VALID + BLOCKER` or `VALID + HIGH` findings.
   4. Any `INVALID` findings are formally dismissed with counter-evidence.
   5. Any `VALID + MEDIUM/LOW` findings are documented as tradeoffs.
+  6. AC source is **only** the Goal Contract file given to the Judge. Chat agreement is not an AC. `CONTEXT_ISOLATION_ONLY` does not relax this.
+  7. Evidence is for the artifact the AC names (sample path, seam, verification command). A `/tmp` build is not proof of a different user-facing file.
+  8. Source `grep` of implementation files is not AC proof (`policies/tdd-policy.md`).
 
 ---
 
 ### Verdict 2: `ITERATE`
 - **Conditions**:
-  1. One or more `VALID + BLOCKER` or `VALID + HIGH` findings exist.
-  2. Active iteration count $< \text{MAX\_ITERATIONS}$ (default 3).
+  1. One or more `VALID + BLOCKER` or `VALID + HIGH` findings exist (Spec, or Standards with `hardConvention: true`).
+  2. Active iteration count is below MAX_ITERATIONS (default 3).
+  3. Maker or verification cites chat agreement for behavior that is not an AC in the Goal Contract file.
+  4. Evidence is for the wrong artifact, is source-grep only, or does not map to written AC ids.
+  5. The suite is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error AC rows.
 - **Maker Directive**: The Maker must adopt the concrete alternative diff or provide an equivalent verified architectural resolution, authoring regression unit tests.
 
 ---

package/core/verification-loop.md

@@ -22,7 +22,7 @@ A verification `PASS` is **strictly invalid** without concrete execution evidenc
 5. **`stdout` & `stderr`**: Raw machine logs captured from execution.
 6. **`timeoutStatus`**: Must be `"COMPLETED"` (not timed out or backgrounded without completion).
 7. **`testCounts`**: Explicit counts of passed, failed, and skipped tests.
-8. **`assertionEvidence`**: Specific assertion proof matching the active Goal Contract's Acceptance Criteria, observed at a named test seam.
+8. **`assertionEvidence`**: Specific assertion proof matching the active Goal Contract's Acceptance Criteria, observed at a named test seam. Must include a non-happy-path AC when the contract has a failure table. Coverage percent is not assertionEvidence.
 
 ```json
 {
@@ -61,3 +61,5 @@ The Verification Gate immediately halts and returns to the Maker if:
 - Exit code is non-zero.
 - The command was sent to the background and not verified to completion.
 - Test logs contain zero passing assertions for new acceptance criteria.
+- assertionEvidence maps only to a happy path while the Goal Contract lists empty, boundary, sibling, or error AC rows.
+- The only new "test" is a source grep or a coverage percentage.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-engineering-loop",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "A reusable, framework-agnostic AI Engineering Operating System for autonomous coding agents.",
   "main": "bin/ai-engineering-loop.js",
   "bin": {

package/policies/tdd-policy.md

@@ -14,19 +14,39 @@ No test is written at an unconfirmed seam. If the contract omitted seams and gri
 
 The test reads like a specification of behavior at the seam. Names use `.ai-engineering-loop/glossary.md`. The test survives an internal rewrite. Expected values come from the Goal Contract or a known-good literal, not from re-running the implementation.
 
+## Failure table
+
+The Goal Contract's AC-1..N **are** the test list. Each row is one red test at the named seam. Do not invent a parallel "comprehensive suite" of only positive cases.
+
+Default rows unless the contract marked them N/A with one sentence:
+
+1. Happy path
+2. Empty / omitted / null
+3. Boundary (min, max, off-by-one, locked vs open)
+4. Sibling / isolation (other entities in the same parent must not change)
+5. Error / denied / unauthorized / invalid input
+
+Do not stop after the first green test. A suite that never asserts a failure mode does not cover the feature.
+
 ## Loop
 
-1. **Red.** Write one failing test for one AC slice. Confirm it fails for the right reason.
+1. **Red.** Write one failing test for one AC row. Confirm it fails for the right reason.
 2. **Green.** Write the smallest production change that passes that test.
-3. Repeat one slice at a time (vertical). Do not write the whole suite first.
-4. After slices covering AC-1..N, run the full verification commands in `.ai-engineering-loop/verification.md` and keep the Evidence Contract.
+3. Repeat one row at a time (vertical). Do not write the whole suite first.
+4. After AC-1..N are green, run the full verification commands in `.ai-engineering-loop/verification.md` and keep the Evidence Contract.
+5. **Coverage as a map, not a score.** If a coverage command exists, use the report to find branches that map to a written AC and are still untested. Add tests only for those. Do not chase 90% with tautological asserts. Line coverage without a failure table is invalid evidence.
+6. **Mutation (optional).** If `.ai-engineering-loop/verification.md` names a mutation tool (Stryker, mutmut, PIT, cargo-mutants), run it on the files this task touched. Surviving mutants on an AC path are ITERATE. Do not add mutation as a new stage or a global 90% gate.
+7. **Property-based (optional).** When the input space is broad (ids, dates, strings, amounts), one property per invariant beats a pile of copied positives. Not required for every task.
 
 ## Forbidden tests
 
 - **Implementation-coupled:** mocks internal collaborators, tests private methods, or asserts through a side channel (raw DB) instead of the seam.
 - **Tautological:** expected value is computed the same way as the code (`expect(add(a,b)).toBe(a+b)`).
+- **Source grep:** `grep -q 'featureFlag' src/file` is not a test of the AC. Prove behavior at the named seam or on the named artifact.
+- **Happy-path only:** every test is a success case while the contract listed empty, boundary, sibling, or error rows.
+- **Coverage theater:** raising percent with `toBeDefined()`, snapshot-without-oracle, or tests that cannot fail.
 - **Horizontal slicing:** all tests first, then all implementation.
 
 ## Evidence
 
-Stage 5 still requires command, exit code 0, stdout, test counts, and assertionEvidence mapped to AC ids. "We did TDD" is not evidence. A red-then-green story without logs is invalid.
+Stage 5 still requires command, exit code 0, stdout, test counts, and assertionEvidence mapped to AC ids. "We did TDD" is not evidence. A red-then-green story without logs is invalid. assertionEvidence must cite at least one non-happy-path AC when the failure table has one.

package/tests/skill-host-compat.test.js

@@ -206,6 +206,63 @@ test('Host skills Stage 0 runs sync-hosts before status', () => {
   }
 });
 
+test('Grill freeze gate and idea menu are in the loop, not a parallel product', () => {
+  const grill = readRepo('core/grill-policy.md');
+  assert.match(grill, /Idea and menu requests/);
+  assert.match(grill, /Do not implement/);
+  assert.match(grill, /is \*\*not\*\* a freeze/);
+  assert.match(grill, /numbered AC/);
+  const contract = readRepo('core/goal-contract.md');
+  assert.match(contract, /Chat is not the contract/);
+  assert.match(contract, /The Chat Contract/);
+  assert.match(contract, /The Wrong Artifact/);
+  const judge = readRepo('agents/shared/judge.body.md');
+  assert.match(judge, /Goal Contract \*\*file\*\* only/);
+  assert.match(judge, /source grep/);
+  const tdd = readRepo('policies/tdd-policy.md');
+  assert.match(tdd, /Source grep/);
+  for (const rel of [
+    '.claude/skills/ai-engineering-loop/SKILL.md',
+    '.grok/skills/ai-engineering-loop/SKILL.md',
+    '.gemini/skills/ai-engineering-loop/SKILL.md',
+    '.agents/workflows/ai-engineering-loop.md'
+  ]) {
+    const text = readRepo(rel);
+    assert.match(text, /list a short menu and wait/, rel);
+    assert.match(text, /Chat agreement is not freeze/, rel);
+  }
+});
+
+test('Failure table is required to freeze, TDD, verify, and Judge', () => {
+  const grill = readRepo('core/grill-policy.md');
+  assert.match(grill, /failure table/);
+  assert.match(grill, /sunny path is not frozen/);
+  const contract = readRepo('core/goal-contract.md');
+  assert.match(contract, /The Happy-Path Contract/);
+  assert.match(contract, /Empty \/ omitted field/);
+  const tdd = readRepo('policies/tdd-policy.md');
+  assert.match(tdd, /Coverage as a map, not a score/);
+  assert.match(tdd, /Happy-path only/);
+  assert.match(tdd, /Coverage theater/);
+  const verif = readRepo('core/verification-loop.md');
+  assert.match(verif, /non-happy-path AC/);
+  const judge = readRepo('agents/shared/judge.body.md');
+  assert.match(judge, /happy-path-only/);
+  const da = readRepo('agents/shared/devil-advocate.body.md');
+  assert.match(da, /happy-path-only suite vs written failure table/);
+  for (const rel of [
+    '.claude/skills/ai-engineering-loop/SKILL.md',
+    '.grok/skills/ai-engineering-loop/SKILL.md',
+    '.gemini/skills/ai-engineering-loop/SKILL.md',
+    '.agents/workflows/ai-engineering-loop.md'
+  ]) {
+    const text = readRepo(rel);
+    assert.match(text, /failure table/, rel);
+    assert.match(text, /One red test per AC row/, rel);
+    assert.match(text, /Do not freeze sunny-path-only/, rel);
+  }
+});
+
 test('Host skills absorb grill, TDD, glossary, and two-axis review without splitting the loop', () => {
   for (const rel of [
     '.claude/skills/ai-engineering-loop/SKILL.md',