ai-engineering-loop 1.0.13 → 1.0.14

package/.agents/devil-advocate.md

@@ -28,7 +28,7 @@ Do not ask for Maker rationale.
 
 Report Spec and Standards as separate findings. Do not rerank one axis with the other. A change can pass Spec and fail Standards, or the reverse. Do not spawn children to split axes.
 
-**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC. BLOCKER or HIGH only for a real AC breach or runtime defect.
+**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC, happy-path-only suite vs written failure table. BLOCKER or HIGH only for a real AC breach or runtime defect.
 
 **Standards** (`axis: "standards"`): `.ai-engineering-loop/conventions.md` plus the smell baseline below. Judgement calls: severity MEDIUM or LOW. Set `hardConvention: true` only when conventions.md states a hard rule that this hunk violates. A smell that hides an AC defect is Spec, not Standards.
 

package/.agents/judge.md

@@ -16,7 +16,7 @@ Use only paths in the spawn prompt: Goal Contract, verification evidence, Findin
 
 AC source is the Goal Contract **file** only. Chat `setuju` and the parent transcript are not AC. Do not PASS because the parent agreed in chat. `CONTEXT_ISOLATION_ONLY` does not relax this.
 
-ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, or is only a source grep.
+ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, is only a source grep, or is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error rows.
 
 ## Axes
 

package/.agents/workflows/ai-engineering-loop.md

@@ -5,7 +5,7 @@ description: Run the AI Engineering Loop on Antigravity (init, status, refresh,
 
 Follow `policies/review-budget.md`. Parent is Maker plus orchestrator. Do not use `browser_subagent`.
 
-Stage 1: if the user asks for ideas, list a short menu and wait; do not implement. Grill if the task is ambiguous (`core/grill-policy.md`), then freeze the Goal Contract file. Chat agreement is not freeze. On `adapter_type: dot`, that grill includes `task-impact-inquiry` (Antigravity skill under `~/.gemini/config/skills/`); do not run a second interview. Use `.ai-engineering-loop/glossary.md`. Name test seams. Maker: TDD at those seams (`policies/tdd-policy.md`). Bugs: red repro first (`core/root-cause-analysis.md`). Mid-loop stop: `core/handoff-policy.md`.
+Stage 1: if the user asks for ideas, list a short menu and wait; do not implement. Grill if the task is ambiguous (`core/grill-policy.md`), then freeze the Goal Contract file. Chat agreement is not freeze. On `adapter_type: dot`, that grill includes `task-impact-inquiry` (Antigravity skill under `~/.gemini/config/skills/`); do not run a second interview. Use `.ai-engineering-loop/glossary.md`. Name test seams. AC is a failure table (happy, empty/omit, boundary, sibling, error). One red test per AC row. Do not freeze sunny-path-only. Maker: TDD at those seams (`policies/tdd-policy.md`): one red test per AC row. Bugs: red repro first (`core/root-cause-analysis.md`). Mid-loop stop: `core/handoff-policy.md`.
 
 If `invoke_subagent` (or Task) exists, spawn `devil-advocate` then `judge` as siblings. Wait for each child. Do not run them in the background. Use `general-purpose` only if the named type is rejected.
 

package/.claude/agents/devil-advocate.md

@@ -29,7 +29,7 @@ Do not ask for Maker rationale.
 
 Report Spec and Standards as separate findings. Do not rerank one axis with the other. A change can pass Spec and fail Standards, or the reverse. Do not spawn children to split axes.
 
-**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC. BLOCKER or HIGH only for a real AC breach or runtime defect.
+**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC, happy-path-only suite vs written failure table. BLOCKER or HIGH only for a real AC breach or runtime defect.
 
 **Standards** (`axis: "standards"`): `.ai-engineering-loop/conventions.md` plus the smell baseline below. Judgement calls: severity MEDIUM or LOW. Set `hardConvention: true` only when conventions.md states a hard rule that this hunk violates. A smell that hides an AC defect is Spec, not Standards.
 

package/.claude/agents/judge.md

@@ -17,7 +17,7 @@ Use only paths in the spawn prompt: Goal Contract, verification evidence, Findin
 
 AC source is the Goal Contract **file** only. Chat `setuju` and the parent transcript are not AC. Do not PASS because the parent agreed in chat. `CONTEXT_ISOLATION_ONLY` does not relax this.
 
-ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, or is only a source grep.
+ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, is only a source grep, or is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error rows.
 
 ## Axes
 

package/.claude/skills/ai-engineering-loop/SKILL.md

@@ -32,8 +32,8 @@ Claude Code talks to strict proxies (including Kiro). Follow this exactly:
 Parent session is Maker plus orchestrator. Spawn Devil's Advocate and Judge as **siblings**, not nested.
 
 1. Stage 0: `npx ai-engineering-loop sync-hosts` then `npx ai-engineering-loop status` (init or refresh if missing or stale). Read `.ai-engineering-loop/glossary.md`. If sync-hosts copied files, tell the user a new session is needed for updated skill text; keep going with this session.
-2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes the four-pillar blast radius (state, sibling, approval, queues). Do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms.
-3. Stages 2-4: Maker in the parent. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`). Surgical diff.
+2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes the four-pillar blast radius (state, sibling, approval, queues). Do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms. AC is a failure table (happy, empty/omit, boundary, sibling, error). One red test per AC row. Do not freeze sunny-path-only.
+3. Stages 2-4: Maker in the parent. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`): one red test per AC row. Surgical diff.
 4. Stage 5: run commands from `.ai-engineering-loop/verification.md`. Keep command, exit code, stdout, test counts. Vague "seems green" is invalid.
 5. Write artifacts, then spawn. Before Devil's Advocate:
    - Write `git diff` to a file (for example `.ai-engineering-loop/tasks/current.diff`).

package/.gemini/skills/ai-engineering-loop/SKILL.md

@@ -25,8 +25,8 @@ Canonical mode ids: `TRUE_INDEPENDENT_AGENT`, `ISOLATED_AGENT_INSTANCE`, `FRESH_
 ## Loop
 
 1. Stage 0: `npx ai-engineering-loop sync-hosts` then `npx ai-engineering-loop status` (init or refresh if missing or stale). Read `.ai-engineering-loop/glossary.md`. If sync-hosts copied files, tell the user a new session is needed for updated skill text; keep going with this session.
-2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes `task-impact-inquiry` (this host: `~/.gemini/config/skills/task-impact-inquiry`); do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms.
-3. Stages 2-4: Maker in the parent. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`). Surgical diff.
+2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes `task-impact-inquiry` (this host: `~/.gemini/config/skills/task-impact-inquiry`); do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms. AC is a failure table (happy, empty/omit, boundary, sibling, error). One red test per AC row. Do not freeze sunny-path-only.
+3. Stages 2-4: Maker in the parent. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`): one red test per AC row. Surgical diff.
 4. Stage 5: run commands from `.ai-engineering-loop/verification.md`. Keep command, exit code, stdout, test counts. Vague "seems green" is invalid.
 5. Write artifacts, then spawn. Before Devil's Advocate:
    - Write `git diff` to a file (for example `.ai-engineering-loop/tasks/current.diff`).

package/.grok/agents/devil-advocate.md

@@ -30,7 +30,7 @@ Do not ask for Maker rationale.
 
 Report Spec and Standards as separate findings. Do not rerank one axis with the other. A change can pass Spec and fail Standards, or the reverse. Do not spawn children to split axes.
 
-**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC. BLOCKER or HIGH only for a real AC breach or runtime defect.
+**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC, happy-path-only suite vs written failure table. BLOCKER or HIGH only for a real AC breach or runtime defect.
 
 **Standards** (`axis: "standards"`): `.ai-engineering-loop/conventions.md` plus the smell baseline below. Judgement calls: severity MEDIUM or LOW. Set `hardConvention: true` only when conventions.md states a hard rule that this hunk violates. A smell that hides an AC defect is Spec, not Standards.
 

package/.grok/agents/judge.md

@@ -18,7 +18,7 @@ Use only paths in the spawn prompt: Goal Contract, verification evidence, Findin
 
 AC source is the Goal Contract **file** only. Chat `setuju` and the parent transcript are not AC. Do not PASS because the parent agreed in chat. `CONTEXT_ISOLATION_ONLY` does not relax this.
 
-ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, or is only a source grep.
+ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, is only a source grep, or is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error rows.
 
 ## Axes
 

package/.grok/skills/ai-engineering-loop/SKILL.md

@@ -45,8 +45,8 @@ Run `npx ai-engineering-loop <command>` in the target repo. Do not commit unless
 ### `/ai-engineering-loop [task]`
 
 1. Stage 0: `npx ai-engineering-loop sync-hosts` then `npx ai-engineering-loop status` (init/refresh if missing or stale). Read `.ai-engineering-loop/glossary.md`. If sync-hosts copied files, tell the user a new session is needed for updated skill text; keep going with this session.
-2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes the four-pillar blast radius (state, sibling, approval, queues). Do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms.
-3. Stages 2–4: Maker work in the **parent**. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`). Surgical diff. Parent may be the Maker; do not spawn Maker as a child if you still need to spawn DA/Judge afterward from the same parent.
+2. Stage 1: Goal Contract (`core/goal-contract.md`). If the user asks for ideas, list a short menu and wait; do not implement. If the task is ambiguous and the user can answer, grill first (`core/grill-policy.md`): design tree, recommended answers, do not ask look-up facts. Skip grill if the contract is already frozen or the user waived it. On `adapter_type: dot`, that grill includes the four-pillar blast radius (state, sibling, approval, queues). Do not run a second interview. Chat agreement is not freeze: every user-visible decision must be a numbered AC in the Goal Contract file. Freeze before any production edit. Name test seams. Use glossary terms. AC is a failure table (happy, empty/omit, boundary, sibling, error). One red test per AC row. Do not freeze sunny-path-only.
+3. Stages 2–4: Maker work in the **parent**. Bugs: red repro first (`core/root-cause-analysis.md`). Features: TDD at named seams (`policies/tdd-policy.md`): one red test per AC row. Surgical diff. Parent may be the Maker; do not spawn Maker as a child if you still need to spawn DA/Judge afterward from the same parent.
 4. Stage 5: run verification from `.ai-engineering-loop/verification.md`. Keep command, exit code, stdout, test counts. Vague "seems green" is invalid.
 5. Write artifacts to disk so children do not need parent chat:
    - Goal Contract path

package/README.md

@@ -6,7 +6,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/egagofur/ai-engineering-loop/pulls)
 [![AI Engineering](https://img.shields.io/badge/AI-Engineering%20Loop-orange.svg)](https://github.com/egagofur/ai-engineering-loop)
-[![Release](https://img.shields.io/badge/release-v1.0.13-purple.svg)](https://github.com/egagofur/ai-engineering-loop/releases)
+[![Release](https://img.shields.io/badge/release-v1.0.14-purple.svg)](https://github.com/egagofur/ai-engineering-loop/releases)
 
 **A Reusable, Framework-Agnostic AI Engineering Operating System for Autonomous Coding Agents**
 
@@ -64,10 +64,10 @@ The 8-stage loop stays one OS. These techniques sit **inside** existing stages (
 
 | Stage | Technique | Spec |
 |---|---|---|
-| 1 | Grill until the design-tree frontier is empty, then freeze the Goal Contract. Idea requests: menu, wait, then grill the pick. Chat `setuju` is not freeze; user-visible decisions must be numbered AC in the contract file. | `core/grill-policy.md` |
+| 1 | Grill until the design-tree frontier is empty, then freeze the Goal Contract. Idea requests: menu, wait, then grill the pick. Chat `setuju` is not freeze; user-visible decisions must be numbered AC in the contract file. AC is a **failure table** (happy, empty/omit, boundary, sibling, error), not sunny path only. | `core/grill-policy.md` |
 | 1 | Ubiquitous language in `.ai-engineering-loop/glossary.md`; load-bearing choices in `.ai-engineering-loop/adrs/` | `core/repo-config-schema.md` |
 | 2 | Bugs: red repro → minimise → hypothesise → instrument → fix | `core/root-cause-analysis.md` |
-| 4–5 | Red-green at named **seams**; no implementation-coupled or tautological tests | `policies/tdd-policy.md` |
+| 4–5 | Red-green at named **seams**; failure table (not happy path only); coverage is a map; no grep/tautology | `policies/tdd-policy.md` |
 | 6–7 | Spec vs Standards reported separately. Standards BLOCKER/HIGH iterate only when `hardConvention` is true | `policies/finding-policy.md` |
 | any | Mid-loop stop writes `.ai-engineering-loop/tasks/handoff.md` | `core/handoff-policy.md` |
 

package/agents/judge.md

@@ -49,7 +49,8 @@ flowchart LR
 
 ### Step 2: Goal Contract Compliance Audit
 - Cross-reference every Acceptance Criterion (AC-1 through AC-N) from the [Goal Contract](file:///Users/egagofur/Development/work/ai-engineering-loop/core/goal-contract.md).
-- Verify that automated tests exist that explicitly exercise and prove each criterion.
+- Verify that automated tests exist that explicitly exercise and prove each criterion, including non-happy-path rows in the failure table.
+- A happy-path-only suite while the contract lists empty, boundary, sibling, or error rows is `ITERATE`.
 - Verify that no out-of-scope files were touched and technical constraints were respected.
 
 ### Step 3: Finding Triage & Evidence Verification

package/agents/maker.md

@@ -28,7 +28,7 @@ flowchart LR
 3. **Test-Driven Engineering** ([TDD Policy](file:///Users/egagofur/Development/work/ai-engineering-loop/policies/tdd-policy.md)):
    - Red before green at the Goal Contract's named seams only.
    - Tests observe public behavior, use glossary terms, and never assert implementation details.
-   - Cover the AC slice in play: happy path, negative edge, null/empty, boundary. Vertical slices, not all-tests-then-all-code.
+   - Cover the AC slice in play: happy path, empty/omit, boundary, sibling/isolation, error/denied. One red test per AC row. Vertical slices, not all-tests-then-all-code.
 4. **Addressing Reviewer Findings**:
    - In subsequent iterations, ingest findings from the [Devil's Advocate](file:///Users/egagofur/Development/work/ai-engineering-loop/agents/devil-advocate.md) and directives from the [Judge](file:///Users/egagofur/Development/work/ai-engineering-loop/agents/judge.md).
    - Fix validated issues surgically.

package/agents/shared/devil-advocate.body.md

@@ -22,7 +22,7 @@ Do not ask for Maker rationale.
 
 Report Spec and Standards as separate findings. Do not rerank one axis with the other. A change can pass Spec and fail Standards, or the reverse. Do not spawn children to split axes.
 
-**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC. BLOCKER or HIGH only for a real AC breach or runtime defect.
+**Spec** (`axis: "spec"`): Goal Contract acceptance criteria, correctness, error handling, security, concurrency, tests that fail to prove an AC, happy-path-only suite vs written failure table. BLOCKER or HIGH only for a real AC breach or runtime defect.
 
 **Standards** (`axis: "standards"`): `.ai-engineering-loop/conventions.md` plus the smell baseline below. Judgement calls: severity MEDIUM or LOW. Set `hardConvention: true` only when conventions.md states a hard rule that this hunk violates. A smell that hides an AC defect is Spec, not Standards.
 

package/agents/shared/judge.body.md

@@ -10,7 +10,7 @@ Use only paths in the spawn prompt: Goal Contract, verification evidence, Findin
 
 AC source is the Goal Contract **file** only. Chat `setuju` and the parent transcript are not AC. Do not PASS because the parent agreed in chat. `CONTEXT_ISOLATION_ONLY` does not relax this.
 
-ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, or is only a source grep.
+ITERATE if verification is missing, vague, non-zero, proves a different artifact than the AC names, is only a source grep, or is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error rows.
 
 ## Axes
 

package/bin/ai-engineering-loop.js

@@ -21,7 +21,7 @@ const {
   formatHostSyncReport
 } = require('../lib/sync-hosts.js');
 
-const VERSION = '1.0.13';
+const VERSION = '1.0.14';
 const CWD = process.cwd();
 const CONTEXT_DIR = path.join(CWD, '.ai-engineering-loop');
 
@@ -275,7 +275,7 @@ function generateContextFiles(rootDir, discovery, trigger = 'init', impact = 'IN
 
   // 0. metadata.json (Baseline)
   const metadataJson = {
-    contextVersion: '1.0.13',
+    contextVersion: '1.0.14',
     generatedAt: new Date().toISOString(),
     repositoryRevision: currentRevision,
     projectProfile: discovery.profile,

package/core/goal-contract.md

@@ -29,9 +29,15 @@ Every Goal Contract MUST adhere to the following schema in Markdown or structure
 [Explain what changes for the real-world actor (e.g. Employee, Admin, Customer, System). Describe the before/after lifecycle state transition.]
 
 ## 3. Acceptance Criteria (AC)
-- [ ] AC-1: [Exact, testable statement with expected outcome]
-- [ ] AC-2: [Exact, testable statement with expected outcome]
-- [ ] AC-3: [Edge case or boundary behavior explicitly specified]
+Each AC is one row that can **fail**. Happy path alone is not a contract (`policies/tdd-policy.md`).
+
+| AC | Input / actor | Expected at seam | Must fail if missing |
+|---|---|---|---|
+| AC-1 | Happy path | [observable] | [what would still look green] |
+| AC-2 | Empty / omitted field | [observable] | [what would still look green] |
+| AC-3 | Boundary | [observable] | [what would still look green] |
+| AC-4 | Sibling / isolation (if domain has siblings) | [observable] | [what would still look green] |
+| AC-5 | Error / denied / locked | [observable] | [what would still look green] |
 
 ## 4. Technical Constraints
 - [Architecture]: [Preserve existing patterns, layer boundaries, dependency conventions]
@@ -105,3 +111,4 @@ Every single item listed under `Acceptance Criteria` must map to at least one co
 - **The Self-Serving Goal**: Modifying acceptance criteria post-hoc when tests fail rather than fixing the underlying implementation.
 - **The Chat Contract**: Treating "setuju" in the parent transcript as AC. The file is the contract.
 - **The Wrong Artifact**: Tests pass on a `/tmp` build while the sample the user opens omits the feature.
+- **The Happy-Path Contract**: Only the sunny case is an AC. Coverage % is not a substitute for a failure table.

package/core/grill-policy.md

@@ -80,12 +80,14 @@ The grill is done when the frontier is empty: every branch visited, nothing sile
 ## What the grill must settle
 
 - Objective and business outcome
-- Acceptance criteria that can fail a test
+- Acceptance criteria that can fail a test, as a **failure table** (not happy path only)
 - Out of scope
 - Test **seams** (public interfaces to observe; prefer existing seams; fewer is better)
 - Glossary terms to use (read and update `.ai-engineering-loop/glossary.md`)
 - Hard decisions that belong in an ADR under `.ai-engineering-loop/adrs/`
 
+A Goal Contract with only the sunny path is not frozen. Include at least: happy path, empty/omitted input, one boundary, one isolation/sibling (when the domain has siblings), one error/denied path. DOT four-pillar rows count toward this table.
+
 ## Invariants
 
 - No production code edits during grill.

package/core/judge-policy.md

@@ -64,6 +64,7 @@ The Judge renders decisions based strictly on **Validity + Severity**, then **re
   2. Active iteration count is below MAX_ITERATIONS (default 3).
   3. Maker or verification cites chat agreement for behavior that is not an AC in the Goal Contract file.
   4. Evidence is for the wrong artifact, is source-grep only, or does not map to written AC ids.
+  5. The suite is happy-path-only while the Goal Contract lists empty, boundary, sibling, or error AC rows.
 - **Maker Directive**: The Maker must adopt the concrete alternative diff or provide an equivalent verified architectural resolution, authoring regression unit tests.
 
 ---

package/core/verification-loop.md

@@ -22,7 +22,7 @@ A verification `PASS` is **strictly invalid** without concrete execution evidenc
 5. **`stdout` & `stderr`**: Raw machine logs captured from execution.
 6. **`timeoutStatus`**: Must be `"COMPLETED"` (not timed out or backgrounded without completion).
 7. **`testCounts`**: Explicit counts of passed, failed, and skipped tests.
-8. **`assertionEvidence`**: Specific assertion proof matching the active Goal Contract's Acceptance Criteria, observed at a named test seam.
+8. **`assertionEvidence`**: Specific assertion proof matching the active Goal Contract's Acceptance Criteria, observed at a named test seam. Must include a non-happy-path AC when the contract has a failure table. Coverage percent is not assertionEvidence.
 
 ```json
 {
@@ -61,3 +61,5 @@ The Verification Gate immediately halts and returns to the Maker if:
 - Exit code is non-zero.
 - The command was sent to the background and not verified to completion.
 - Test logs contain zero passing assertions for new acceptance criteria.
+- assertionEvidence maps only to a happy path while the Goal Contract lists empty, boundary, sibling, or error AC rows.
+- The only new "test" is a source grep or a coverage percentage.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-engineering-loop",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "A reusable, framework-agnostic AI Engineering Operating System for autonomous coding agents.",
   "main": "bin/ai-engineering-loop.js",
   "bin": {

package/policies/tdd-policy.md

@@ -14,20 +14,39 @@ No test is written at an unconfirmed seam. If the contract omitted seams and gri
 
 The test reads like a specification of behavior at the seam. Names use `.ai-engineering-loop/glossary.md`. The test survives an internal rewrite. Expected values come from the Goal Contract or a known-good literal, not from re-running the implementation.
 
+## Failure table
+
+The Goal Contract's AC-1..N **are** the test list. Each row is one red test at the named seam. Do not invent a parallel "comprehensive suite" of only positive cases.
+
+Default rows unless the contract marked them N/A with one sentence:
+
+1. Happy path
+2. Empty / omitted / null
+3. Boundary (min, max, off-by-one, locked vs open)
+4. Sibling / isolation (other entities in the same parent must not change)
+5. Error / denied / unauthorized / invalid input
+
+Do not stop after the first green test. A suite that never asserts a failure mode does not cover the feature.
+
 ## Loop
 
-1. **Red.** Write one failing test for one AC slice. Confirm it fails for the right reason.
+1. **Red.** Write one failing test for one AC row. Confirm it fails for the right reason.
 2. **Green.** Write the smallest production change that passes that test.
-3. Repeat one slice at a time (vertical). Do not write the whole suite first.
-4. After slices covering AC-1..N, run the full verification commands in `.ai-engineering-loop/verification.md` and keep the Evidence Contract.
+3. Repeat one row at a time (vertical). Do not write the whole suite first.
+4. After AC-1..N are green, run the full verification commands in `.ai-engineering-loop/verification.md` and keep the Evidence Contract.
+5. **Coverage as a map, not a score.** If a coverage command exists, use the report to find branches that map to a written AC and are still untested. Add tests only for those. Do not chase 90% with tautological asserts. Line coverage without a failure table is invalid evidence.
+6. **Mutation (optional).** If `.ai-engineering-loop/verification.md` names a mutation tool (Stryker, mutmut, PIT, cargo-mutants), run it on the files this task touched. Surviving mutants on an AC path are ITERATE. Do not add mutation as a new stage or a global 90% gate.
+7. **Property-based (optional).** When the input space is broad (ids, dates, strings, amounts), one property per invariant beats a pile of copied positives. Not required for every task.
 
 ## Forbidden tests
 
 - **Implementation-coupled:** mocks internal collaborators, tests private methods, or asserts through a side channel (raw DB) instead of the seam.
 - **Tautological:** expected value is computed the same way as the code (`expect(add(a,b)).toBe(a+b)`).
 - **Source grep:** `grep -q 'featureFlag' src/file` is not a test of the AC. Prove behavior at the named seam or on the named artifact.
+- **Happy-path only:** every test is a success case while the contract listed empty, boundary, sibling, or error rows.
+- **Coverage theater:** raising percent with `toBeDefined()`, snapshot-without-oracle, or tests that cannot fail.
 - **Horizontal slicing:** all tests first, then all implementation.
 
 ## Evidence
 
-Stage 5 still requires command, exit code 0, stdout, test counts, and assertionEvidence mapped to AC ids. "We did TDD" is not evidence. A red-then-green story without logs is invalid.
+Stage 5 still requires command, exit code 0, stdout, test counts, and assertionEvidence mapped to AC ids. "We did TDD" is not evidence. A red-then-green story without logs is invalid. assertionEvidence must cite at least one non-happy-path AC when the failure table has one.

package/tests/skill-host-compat.test.js

@@ -233,6 +233,36 @@ test('Grill freeze gate and idea menu are in the loop, not a parallel product',
   }
 });
 
+test('Failure table is required to freeze, TDD, verify, and Judge', () => {
+  const grill = readRepo('core/grill-policy.md');
+  assert.match(grill, /failure table/);
+  assert.match(grill, /sunny path is not frozen/);
+  const contract = readRepo('core/goal-contract.md');
+  assert.match(contract, /The Happy-Path Contract/);
+  assert.match(contract, /Empty \/ omitted field/);
+  const tdd = readRepo('policies/tdd-policy.md');
+  assert.match(tdd, /Coverage as a map, not a score/);
+  assert.match(tdd, /Happy-path only/);
+  assert.match(tdd, /Coverage theater/);
+  const verif = readRepo('core/verification-loop.md');
+  assert.match(verif, /non-happy-path AC/);
+  const judge = readRepo('agents/shared/judge.body.md');
+  assert.match(judge, /happy-path-only/);
+  const da = readRepo('agents/shared/devil-advocate.body.md');
+  assert.match(da, /happy-path-only suite vs written failure table/);
+  for (const rel of [
+    '.claude/skills/ai-engineering-loop/SKILL.md',
+    '.grok/skills/ai-engineering-loop/SKILL.md',
+    '.gemini/skills/ai-engineering-loop/SKILL.md',
+    '.agents/workflows/ai-engineering-loop.md'
+  ]) {
+    const text = readRepo(rel);
+    assert.match(text, /failure table/, rel);
+    assert.match(text, /One red test per AC row/, rel);
+    assert.match(text, /Do not freeze sunny-path-only/, rel);
+  }
+});
+
 test('Host skills absorb grill, TDD, glossary, and two-axis review without splitting the loop', () => {
   for (const rel of [
     '.claude/skills/ai-engineering-loop/SKILL.md',