amsd-pipeline-shared 0.5.39 → 0.5.41

package/orchestrations/prompts/templates/set-fidelity-check.json

@@ -1,6 +1,6 @@
 {
   "id": "set-fidelity-check",
-  "version": 1,
+  "version": 2,
   "seams": [],
   "layer": "engine",
   "description": "A judge reads a codeline's minted roster and reusable prompts against the ticket they were minted for and reports what is geared to that ticket rather than to the codeline.",
@@ -8,11 +8,11 @@
     "__CODELINE__",
     "__TICKET_KEY__",
     "__TICKET_TITLE__",
-    "__ROSTER__",
-    "__PROMPTS__"
+    "__ROSTER__"
   ],
   "$why": [
-    "v1 (operator, 2026-10-24: \"We need some post pause 1 checkpoints to ensure no contamination in codeline level prompts and profiles\"): run 13's roster named every agent after the ticket's subject and ~half its reusable prompts described that one ticket; the sets are cached per codeline and reused for every later story. Judged by an agent, not a word list; run by the pre-launch of the leg after pause 1 and reported at pause 1."
+    "v1 (operator, 2026-10-24: \"We need some post pause 1 checkpoints to ensure no contamination in codeline level prompts and profiles\"): run 13's roster named every agent after the ticket's subject and ~half its reusable prompts described that one ticket; the sets are cached per codeline and reused for every later story. Judged by an agent, not a word list; run by the pre-launch of the leg after pause 1 and reported at pause 1.",
+    "v2 (live, 2026-10-24): a codeline's whole prompt set in one call was 908 KB and the judge answered about its own context limit; the prompts are judged one by one by the pipeline's own reviewer as they are built (each copy records its judges), so this judge reads the roster only."
   ],
-  "body": "You judge what a pipeline minted for ONE codeline and will REUSE for every later story on it: its agent roster (names and briefs) and\nits reusable agent prompts. They were minted while this ticket was in scope:\n\nTicket __TICKET_KEY__: __TICKET_TITLE__\nCodeline: __CODELINE__\n\nTHE ROSTER (each agent: name, kind, brief):\n__ROSTER__\n\nTHE PROMPTS (each: id, then its body):\n__PROMPTS__\n\nReport every place where the roster or a prompt is geared to THIS ticket rather than to the codeline: an agent named after the\nticket's subject, component or key; a brief or prompt that takes this ticket's subject, components, files or requirements as its\nsubject or as standing instruction, so that an implementer on a DIFFERENT story of this codeline would be misled. A mention of the\nticket's subject or files only as a marked example of the codeline's conventions is not geared. Quote the words. Report nothing you\ncannot quote. Answer in the structured form you are given; `geared` is empty when nothing is geared."
+  "body": "You judge the agent roster a pipeline minted for ONE codeline and will REUSE for every later story on it: its agents' names and\nbriefs. It was minted while this ticket was in scope:\n\nTicket __TICKET_KEY__: __TICKET_TITLE__\nCodeline: __CODELINE__\n\nTHE ROSTER (each agent: name, kind, brief):\n__ROSTER__\n\nReport every agent that is geared to THIS ticket rather than to the codeline: named after the ticket's subject, component or key, or\nbriefed so that it takes this ticket's subject, components, files or requirements as its subject or as standing instruction — an\nimplementer on a DIFFERENT story of this codeline would be misled. A mention of the ticket's subject or files only as a marked example\nof the codeline's conventions is not geared. Quote the words. Report nothing you cannot quote. Answer in the structured form you are\ngiven; `geared` is empty when nothing is geared."
 }

package/orchestrations/prompts/templates/survey-review.json

@@ -9,22 +9,23 @@
     "",
     "Live 2026-08-17: the survey reported a codeline in_scope on a file that codeline does not",
     "have, and an implementer was briefed to apply that codeline's fix in a repository with no",
-    "such code. A validator was written to strip false paths, and it SILENTLY REWROTE the survey \u2014",
+    "such code. A validator was written to strip false paths, and it SILENTLY REWROTE the survey —",
     "worse than reporting, and removed. A generated prompt already gets an adversarial reviewer",
     "before anything inherits it (prompt-review); the survey needs the same and had none.",
     "",
     "SCOPE IS DELIBERATELY NARROW, for the reason prompt-review's is: it judges CHECKABLE CLAIMS",
     "ABOUT THE REPOSITORIES, never whether the survey looked hard enough or chose well. A reviewer",
-    "invited to improve judgement rewrites correct surveys."
+    "invited to improve judgement rewrites correct surveys.",
+    "v2 (run 14, 2026-10-24): read INSIDE the mint before any project prompt exists (the estate survey's review; the mint's test-ownership policy), so a never-minted project could not be minted. Bootstrap layer: rendered from the template there, as the registry's bootstrap seams are; the builder still makes the project's own copy for the seams that read it later."
   ],
   "id": "survey-review",
-  "version": 1,
-  "layer": "project",
+  "version": 2,
+  "layer": "bootstrap",
   "description": "Falsifies what an estate survey claims about the codelines, before a roster is minted from it.",
   "seams": [
     "survey-review"
   ],
-  "body": "You are reviewing an ESTATE SURVEY. A roster of agents is about to be minted from it, and every\nclaim below will be inherited as a brief and re-checked by nothing.\n\nTHE SURVEY UNDER REVIEW:\n__SURVEY_BLOCK__\n\nTHE CODELINES IN SCOPE, and where each is checked out:\n__CODELINE_BLOCK__\n\nTHE WORK THE PROJECT WAS ASKED TO DO:\n__TICKET_BLOCK__\n\n__TOOL_LINE__\n\n# What is in scope\n\nONE QUESTION ONLY: does the survey state anything about these repositories that is FALSE?\n\nA claim is in scope when you can check it by opening a repository. Open them and check.\n\n- a file named in `filesRead` that the codeline does not contain\n- a file, module, function or symbol said to exist where it does not\n- a claim attributed to the WRONG codeline \u2014 the commonest and most damaging error, because the\n  brief built from it sends an implementer into a repository that has no such code\n- a dependency, script, framework or command the codeline does not declare\n- a codeline reported in_scope on evidence that belongs to a different one\n\nA codeline reported no_work_found or not_investigated is making a WEAK claim, not a false one.\nCheck it only if you can show the work plainly does reach it.\n\n# What is NOT in scope\n\nDo not judge whether the survey looked hard enough, chose the right focus, or recommended the\nright team. Do not propose better wording. Do not supply a FIX SITE of your own \u2014 naming which\nfile to edit is not yours to say here any more than it was the surveyor's, and a fix site you add\nfor a repository you swept from the outside is how one codeline's file ends up in another's work.\n\n# Evidence\n\nFor each finding, say what you CHECKED and what you FOUND, naming the repository and the path you\nopened. A finding without a check is an opinion, and an opinion about a survey is not a defect.\n\nIf every claim checks out, return no findings. An empty finding list from a review that RAN is the\ncorrect answer for a sound survey.\n",
+  "body": "You are reviewing an ESTATE SURVEY. A roster of agents is about to be minted from it, and every\nclaim below will be inherited as a brief and re-checked by nothing.\n\nTHE SURVEY UNDER REVIEW:\n__SURVEY_BLOCK__\n\nTHE CODELINES IN SCOPE, and where each is checked out:\n__CODELINE_BLOCK__\n\nTHE WORK THE PROJECT WAS ASKED TO DO:\n__TICKET_BLOCK__\n\n__TOOL_LINE__\n\n# What is in scope\n\nONE QUESTION ONLY: does the survey state anything about these repositories that is FALSE?\n\nA claim is in scope when you can check it by opening a repository. Open them and check.\n\n- a file named in `filesRead` that the codeline does not contain\n- a file, module, function or symbol said to exist where it does not\n- a claim attributed to the WRONG codeline — the commonest and most damaging error, because the\n  brief built from it sends an implementer into a repository that has no such code\n- a dependency, script, framework or command the codeline does not declare\n- a codeline reported in_scope on evidence that belongs to a different one\n\nA codeline reported no_work_found or not_investigated is making a WEAK claim, not a false one.\nCheck it only if you can show the work plainly does reach it.\n\n# What is NOT in scope\n\nDo not judge whether the survey looked hard enough, chose the right focus, or recommended the\nright team. Do not propose better wording. Do not supply a FIX SITE of your own — naming which\nfile to edit is not yours to say here any more than it was the surveyor's, and a fix site you add\nfor a repository you swept from the outside is how one codeline's file ends up in another's work.\n\n# Evidence\n\nFor each finding, say what you CHECKED and what you FOUND, naming the repository and the path you\nopened. A finding without a check is an opinion, and an opinion about a survey is not a defect.\n\nIf every claim checks out, return no findings. An empty finding list from a review that RAN is the\ncorrect answer for a sound survey.\n",
   "placeholders": [
     "__CODELINE_BLOCK__",
     "__SURVEY_BLOCK__",
@@ -34,5 +35,5 @@
   "mayBeEmpty": [
     "__SURVEY_BLOCK__"
   ],
-  "$whyMayBeEmpty": "Declared 2026-08-27 by sweeping the CLASS rather than the instance, after three runs died on it one placeholder at a time. Every call site for these writes an explicit empty branch \u2014 the story is not being split, attempt one carries no forced-retry note, no documentation was fetched, the persona prefix is optional \u2014 so absence is a real state, which is the renderer's own test. Placeholders supplied by a lookup that may FAIL (`x || ''`) are deliberately NOT here: for those, empty means broken, and declaring them would hide the blank-brief defect the renderer exists to surface. Unanimity is required \u2014 one deliberate branch among several defensive lookups is not a licence."
+  "$whyMayBeEmpty": "Declared 2026-08-27 by sweeping the CLASS rather than the instance, after three runs died on it one placeholder at a time. Every call site for these writes an explicit empty branch — the story is not being split, attempt one carries no forced-retry note, no documentation was fetched, the persona prefix is optional — so absence is a real state, which is the renderer's own test. Placeholders supplied by a lookup that may FAIL (`x || ''`) are deliberately NOT here: for those, empty means broken, and declaring them would hide the blank-brief defect the renderer exists to surface. Unanimity is required — one deliberate branch among several defensive lookups is not a licence."
 }

package/orchestrations/prompts/templates/test-ownership.json

@@ -1,7 +1,7 @@
 {
   "id": "test-ownership",
-  "layer": "project",
-  "version": 1,
+  "layer": "bootstrap",
+  "version": 2,
   "description": "Who owns the tests. ONE policy per MODE, rendered into the mint (what a brief may claim), the writer and the reviewer, so no agent holds a belief another contradicts.",
   "$why": [
     "This lived as a heredoc in claude.sh — the WRITER's prompt builder — and nowhere else.",
@@ -23,7 +23,8 @@
     "spec-mode-runner.js ('a dedicated agent of this pipeline writes the tests'), so every greenfield brief",
     "disowned its stories' test files; the roster reviewer then found, correctly, that no stage in a greenfield",
     "run authors feature tests, and blocked the roster on every cycle. In greenfield the implementer owns the",
-    "test files its stories declare. The mode picks the body; the mint renders it from here."
+    "test files its stories declare. The mode picks the body; the mint renders it from here.",
+    "v2 (run 14, 2026-10-24): read INSIDE the mint before any project prompt exists (the estate survey's review; the mint's test-ownership policy), so a never-minted project could not be minted. Bootstrap layer: rendered from the template there, as the registry's bootstrap seams are; the builder still makes the project's own copy for the seams that read it later."
   ],
   "placeholders": [],
   "bodies": {

package/orchestrations/scripts/lib/engine-prompt.js

@@ -202,6 +202,10 @@ function templateLayerOf(id) {
   try {
     const own = JSON.parse(fs.readFileSync(path.join(templatesDir(), `${id}.json`), 'utf8'));
     if (own && own.layer === 'project') return 'project';
+    // A TEMPLATE THAT DECLARES ITSELF BOOTSTRAP runs inside the mint, before this project's prompt layer exists (survey-review,
+    // test-ownership: read by the estate survey and the roster mint), and renders from the template as the registry's bootstrap
+    // seams do — run 14, 2026-10-24: a project never minted could not be minted ("project-authority prompt missing")
+    if (own && own.layer === 'bootstrap') return 'bootstrap';
   } catch { /* no template of that id here: the registry decides, as before */ }
   const registryPath = path.join(__dirname, '..', '..', 'agents', 'invocation-profiles.json');
   let reg;

package/orchestrations/scripts/lib/prelaunch.js

@@ -330,9 +330,13 @@ function checklist({ env, results }) {
 /**
  * NOTHING MINTED FOR A CODELINE IS GEARED TO THE TICKET (operator, 2026-10-24: "post pause 1 checkpoints to ensure no contamination in
  * codeline level prompts and profiles"). After pause 1 the Agents phase has minted each codeline's roster and prompt set, which are kept
- * and reused for every later story on that codeline. A judge agent (template set-fidelity-check, the given `judge` call) reads each
- * codeline's roster and prompts against the ticket and quotes what is geared to it; anything quoted is RED, naming the codeline, the
- * file and the words. Not run when the launch gives no judge (a £0 leg) — then NOT-YET, never GREEN by silence.
+ * and reused for every later story on that codeline. Two parts, each what it needs to be:
+ *   - the ROSTER: a judge agent (template set-fidelity-check, the given `judge` call) reads each codeline's agents against the ticket and
+ *     quotes what is geared to it;
+ *   - the PROMPTS: every recorded copy must carry the record of the reviewer that judged it (judgedWith — the pipeline's own prompt review,
+ *     whose rule is a prompt narrowed to one story); a copy with no record is the exact gap that let run 13's ticket-geared prompts through,
+ *     and is RED by name. (A whole set in one judge call was 908 KB and the judge answered about its context, not the prompts.)
+ * Anything quoted or unjudged is RED, naming the codeline and the words or files. No judge given (a £0 leg): RED, never green by silence.
  */
 const SET_FIDELITY_SCHEMA = { type: 'object', required: ['geared'], properties: { geared: { type: 'array', items: { type: 'object',
   required: ['where', 'quote', 'why'], properties: { where: { type: 'string' }, quote: { type: 'string' }, why: { type: 'string' } } } } } };
@@ -343,26 +347,33 @@ async function setFidelity({ install, projectConfigDir, ticket, codelines = [],
   const rows = []; let examined = 0;
   for (const codeline of codelines) {
     const rp = b.recordedPromptsDir(projectConfigDir, codeline); const mi = b.mintedSnapshotDir(projectConfigDir, codeline);
-    const prompts = fs.existsSync(rp) ? fs.readdirSync(rp).filter((n) => n.endsWith('.json')).sort().map((n) => { const d = readJson(path.join(rp, n), {}); return `=== ${n} ===\n${d.body || Object.values(d.bodies || {}).join('\n')}`; }) : [];
+    const promptFiles = fs.existsSync(rp) ? fs.readdirSync(rp).filter((n) => n.endsWith('.json')).sort() : [];
+    // a generated copy (authority project) with no judging record; a verbatim copy (authority template / copied) carries none by design
+    const unjudged = promptFiles.filter((n) => { const d = readJson(path.join(rp, n), {}); return d && d.authority === 'project' && !d.judgedWith; });
     let roster = '(none recorded)';
     try {
       const ag = readJson(path.join(mi, 'roster.json'), {}).agents || {}; const pr = (readJson(path.join(mi, 'agent-profiles.json'), {}).profiles) || {};
       const names = Object.keys(ag);
       if (names.length) roster = names.map((n) => `- ${n} [${(ag[n] || {}).kind || ''}]\n${String(pr[n] || (ag[n] || {}).persona || '(no brief)')}`).join('\n\n');
     } catch { /* judged as recorded */ }
-    if (!prompts.length && roster === '(none recorded)') { rows.push({ codeline, examined: false, geared: [] }); continue; }
-    const prompt = renderEngineTemplate('set-fidelity-check', { __CODELINE__: codeline, __TICKET_KEY__: ticket.key || '', __TICKET_TITLE__: ticket.title || '',
-      __ROSTER__: roster, __PROMPTS__: prompts.join('\n\n') || '(none recorded)' });
-    const out = await judge({ prompt, schema: SET_FIDELITY_SCHEMA, codeline });
+    if (!promptFiles.length && roster === '(none recorded)') { rows.push({ codeline, examined: false, geared: [], unjudged: [] }); continue; }
+    let geared = [];
+    if (roster !== '(none recorded)') {
+      const prompt = renderEngineTemplate('set-fidelity-check', { __CODELINE__: codeline, __TICKET_KEY__: ticket.key || '', __TICKET_TITLE__: ticket.title || '', __ROSTER__: roster });
+      const out = await judge({ prompt, schema: SET_FIDELITY_SCHEMA, codeline });
+      geared = (out && Array.isArray(out.geared)) ? out.geared : null;
+    }
     examined += 1;
-    rows.push({ codeline, examined: true, geared: (out && Array.isArray(out.geared)) ? out.geared : null });
+    rows.push({ codeline, examined: true, geared, unjudged });
   }
   const unjudged = rows.filter((r) => r.examined && r.geared === null).map((r) => r.codeline);
   const geared = rows.filter((r) => r.examined && Array.isArray(r.geared) && r.geared.length);
-  const ok = examined > 0 && !unjudged.length && !geared.length;
+  const unjudgedPrompts = rows.filter((r) => r.examined && r.unjudged.length);
+  const ok = examined > 0 && !unjudged.length && !geared.length && !unjudgedPrompts.length;
   const why = [geared.length && geared.map((r) => `${r.codeline}: ${r.geared.length} geared — ${r.geared.slice(0, 3).map((g) => `${g.where}: "${String(g.quote).slice(0, 80)}"`).join('; ')}`).join('; '),
+    unjudgedPrompts.length && unjudgedPrompts.map((r) => `${r.codeline}: ${r.unjudged.length} prompt copy(ies) no reviewer is recorded to have judged: ${r.unjudged.slice(0, 4).join(', ')}`).join('; '),
     unjudged.length && `no verdict for ${unjudged.join(', ')}`, !examined && 'nothing minted to examine'].filter(Boolean).join('; ');
-  return res('set-fidelity', ok, ok ? `${examined} codeline set(s) judged against ${ticket.key}: nothing geared to the ticket` : why, { rows });
+  return res('set-fidelity', ok, ok ? `${examined} codeline set(s) judged against ${ticket.key}: no agent geared to the ticket, every prompt copy judged by the reviewer` : why, { rows });
 }
 
 /** The set-fidelity judge a LIVE launch gives setFidelity: the prompt-review seam's own model, ladder and tools (seam-invocation), through the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amsd-pipeline-shared",
-  "version": "0.5.39",
+  "version": "0.5.41",
   "description": "The AMSD pipeline's shared components, one source for the bash pipeline and its Claude workflows: the model-call gateway (llm-handler.sh — retry, ladder, self-heal, cost) and the libraries it runs.",
   "license": "UNLICENSED",
   "bin": {