arcane-cli 0.32.3 → 0.32.4

package/dist/assets/.arcane/governance/cicd-standards.md

@@ -350,6 +350,31 @@ triggers), a change to a new top-level code directory outside `src/` triggers th
 fail-safe) but does **not** require it to pass before merge (branch policy is not) — the build can
 run, fail, and be ignored, or the PR can merge before it finishes.
 
+### Self-Hosted Agents
+
+Self-hosted agents consume **zero** hosted minutes (each org gets one free self-hosted
+parallel job) — the standard fallback when the Microsoft-hosted free grant (1800
+min/month) runs out mid-month. Hard-won rules for running them (origin: the Ordovica
+deploy incident, 2026-07-25 — three separate failures in one night):
+
+1. **Disable system sleep on the agent machine.** A napping agent drops mid-job with
+   "We stopped hearing from agent …" and kills the stage. On macOS:
+   `sudo pmset -a sleep 0` (display may still sleep; the system must not). Waking the
+   machine is not a fix — it will re-sleep 15 minutes later, mid-retry.
+2. **Keep hosted as a selectable fallback, not a hard switch.** Add an `agentPool`
+   pipeline parameter (`selfhosted` default / `hosted`) mapped to conditional `pool:`
+   blocks, so a downed agent machine never blocks an emergency deploy once hosted
+   minutes exist again.
+3. **Audit network reachability before the first deploy run.** Hosted agents reach
+   Azure-firewalled resources (Postgres, storage) via "Allow Azure services" rules;
+   a self-hosted machine does **not** — its public egress IP must be allowlisted
+   explicitly. If that IP is residential, expect it to rotate: when deploys suddenly
+   fail with `connect ETIMEDOUT <db-host>:5432`, check the firewall rule's IP first.
+4. **Audit tooling parity.** Hosted images preinstall the Azure CLI, pipx, etc.;
+   a self-hosted machine has whatever was installed by hand. Walk the pipeline's
+   tasks (AzureCLI@2 → `az`, Checkov → `pipx`/`pip`, …) before pointing it at the
+   new pool.
+
 ### Prospero's Responsibilities
 
 1. **Create and maintain all CI/CD pipelines** across Azure DevOps organizations

package/dist/assets/.github/instructions/agent-output.instructions.md

@@ -6,6 +6,25 @@ applyTo: "**"
 
 Source of truth: `.arcane/governance/git-conventions.md` → PR Standards → PR Requirements.
 
+## Runnable Code Fences Are Commitments
+
+Chat UIs (Claude Code, Copilot, etc.) render a one-click **Run button** on shell-tagged
+code fences (```` ```bash ````, ```` ```powershell ````). Treat that button as part of
+your output's meaning:
+
+- Only commands intended for **immediate execution on the current machine** may go in a
+  shell-tagged fence.
+- Reference, undo/revert, cleanup-someday, destructive-example, or
+  **run-on-a-different-machine** commands must use a ```` ```text ```` fence or inline
+  code, labeled "reference only — do not run here".
+- Surrounding prose ("only if you ever want to undo this…") does **not** make a runnable
+  fence safe — users click the button, not the paragraph.
+
+**Origin (2026-07-25, Ordovica):** an agent posted a "revert anytime"
+`firewall-rule delete` example in a runnable fence; it was accidentally executed twice,
+deleting a prod DB firewall rule mid-deploy and failing the pipeline's prod stage both
+times.
+
 ## PR Link Format
 
 All PR references in agent output **must** be clickable markdown links. Never write a bare `PR #NNN`.

package/dist/assets/.github/prompts/spell-full-cycle.prompt.md

@@ -151,8 +151,8 @@ Execute the `spell-review` workflow:
 1. Review the full diff (`git diff main...HEAD`).
 2. Check architecture compliance against `architecture.md`.
 3. Check for OWASP Top 10 security issues.
-4. Find a minimum of 3 issues or justify why fewer exist.
-5. Classify findings: HIGH / MEDIUM / LOW.
+4. Explicitly cover every lens — correctness, security, performance, tests, naming/clarity, architecture — and state "no issues" for any lens that is clean. There is no finding quota: zero findings is a valid outcome on a clean or small diff; never fabricate issues to hit one.
+5. Classify each real finding: HIGH / MEDIUM / LOW.
 6. **Gate:** If any HIGH severity finding exists, loop back to Phase 3 to fix it. MEDIUM and LOW findings are noted in the ship report but do not block. Maximum 2 review-fix loops before halting.
 
 Proceed automatically to Phase 6.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-cli",
-  "version": "0.32.3",
+  "version": "0.32.4",
   "description": "Arcane framework CLI — scaffold and manage governance files in consuming repositories",
   "keywords": [
     "arcane",