arcane-cli 0.33.6 → 0.33.8

package/dist/assets/.arcane/governance/universal-agent-rules.md

@@ -19,7 +19,7 @@ See also: [[README]], [[DECISIONS]], [[governance/git-conventions|Git Convention
 
 2. **No root commands without justification. Enforcement: explicitly advisory prose (ARC-023) — depends on judgment about what justifies root scope; no script inspects generated commands for root usage before they run.** Do not generate or suggest commands that run as root unless explicitly scoped and justified. The agent runtime should run as a dedicated non-root user by design. See [[security/hardening-checklist|Hardening Checklist]].
 
-3. **No secrets on the command line. Enforcement: explicitly advisory prose (ARC-023) — no secret-scanner exists in this repo yet (tracked as future work, BC-30), so no mechanical check catches a violation.** Never pass API keys, tokens, or secrets on the command line, in chat, or in config files. Use SecretRef (env vars) and `read -s` for interactive input.
+3. **No secrets on the command line. Enforcement: explicitly advisory prose (ARC-023) for the command-line/chat case this rule is really about — a secret only ever typed there, never written to a file, is invisible to any file scanner by construction, so no mechanical check catches that. The narrower config-file case is stronger: BC-30 shipped a repo-wide credential-pattern scan (`src/modules/secrets-scan.ts`, executable check) enforced at both pre-commit (`doctor:leaks`) and CI, catching a secret that lands in any committed file. (Corrected 2026-09-02, LH-08 — this previously claimed no scanner existed at all, which stopped being true once BC-30 shipped.)** Never pass API keys, tokens, or secrets on the command line, in chat, or in config files. Use SecretRef (env vars) and `read -s` for interactive input.
 
 4. **This is a production system. Enforcement: explicitly advisory prose (ARC-023) — the no-shortcuts and rollback-plan requirements depend on engineering judgment; no check evaluates whether a rollback plan exists.** No "fix it later" shortcuts. No experimental changes without rollback plans.
 

package/dist/assets/.github/prompts/spell-check-drift.prompt.md

@@ -46,6 +46,7 @@ Concrete detectors to run (in addition to general contradiction/stale-date check
 - **Journal chronology** — journal entries and their dates must be in sane order. Flag out-of-order entries, duplicate session numbers, and any future or otherwise contradictory dates.
 - **Done vs. carry-forward consistency** — items marked done must not still appear as open or carry-forward items, and items listed as open/carry-forward must not also be marked done elsewhere.
 - **Decision-ID existence** — decision IDs referenced in TODO, journal, or other docs must exist in `DECISIONS.md`, and the IDs in the decisions log must be sequential and unique (no gaps that imply a missing entry, no duplicates).
+- **Shipped-state staleness** (LH-08; only when this repo has its own `scripts/check-stale-claims.ts` — Arcane's own repo, or one that adopted the same convention; skip gracefully otherwise) — run `npm run check:stale-claims -- --report` and triage its Class B output (occurrences of "not yet built"/"not yet supported"/"tracked as future work" and similar phrases in shipped or living content): each hit is a prompt to verify the claim against the real tree, not proof of staleness by itself. Class A (`ARC-NNN (Status)` claims vs. `DECISIONS.md`) is already a separate, mechanically-enforced CI gate — do not re-litigate its findings here, only Class B needs this judgment pass.
 - **Canonical vs. installed-copy parity** — for every managed root file that has a canonical counterpart under `src/assets/`, compare bytes first. If bytes differ, normalize `CRLF` and lone `CR` to `LF` in both files and compare again:
   - If normalized content differs, report **real content drift** with normal severity grading.
   - If normalized content matches, report **line-ending-only drift** separately. Do not count these paths as real content findings and do not include them in severity totals or the Go / No-Go decision.

package/dist/assets/.github/prompts/spell-close-session.prompt.md

@@ -69,6 +69,8 @@ Workflow:
 
 4b. **Register unfinished, task-bearing work on a durable surface (session handoff durability, ARC-040) before the handoff is written.** Enumerate: an incomplete `Active task`, the `Next concrete action`, and any content that would otherwise live only in `Notes` because it has no other durable home. For each, resolve the sink from `tracking_mode` (per ARC-032): `internal` → the appropriate `TODO.md` (root or venture book); `external` → a work item via the configured `external_provider`, falling back to `TODO.md` when tracker tooling is unavailable this session. Write or update the entry, then carry its location into step 5b so the handoff fields below can name it. Skip this step entirely when nothing is unfinished — a fully clean close has nothing to register.
 
+4c. **Follow-up promotion sweep (LH-09; only when this repo has its own `scripts/check-followups.ts` — Arcane's own repo, or one that adopted the same convention; skip gracefully otherwise).** Run `npm run check:followups` (or the closest journal-scoped equivalent) and check whether this session's own journal entry or closure notes contain a deferral phrase ("filed as a separate", "follow-up", "out of scope", "not fixed here", "left open", "deferred", "revisit", "future work") with no tracker token nearby (`TODO`, `IDEAS`, `Q-NNN`, `ARC-NNN`, `EF-NN`, `RCA-NNN`, a PR URL) and no explicit `(untracked: <reason>)` opt-out. Promote each real hit to `TODO.md`/`IDEAS.md` before writing the handoff, or add the opt-out inline. Report-only tool — a hit is a prompt to check, not proof of an untracked gap; skip anything that's already tracked elsewhere in the same document.
+
 5. **Update [ai-context/system-prompt-context.md](../../ai-context/system-prompt-context.md).**
    - If priorities, environment state, or agent rules changed during the session, update the file to reflect current reality.
    - If no changes are needed, skip this step.

package/dist/assets/.github/prompts/spell-commit-work.prompt.md

@@ -74,6 +74,7 @@ Workflow:
    - Is this part of a larger initiative or a standalone change?
    - **Commit-splitting heuristic:** within one author partition, if the changes span clearly unrelated concerns (e.g., a feature change + an unrelated refactor + a dependency bump), recommend splitting them into multiple focused commits, each with its own message, rather than a single mixed commit. A single commit is fine when one author's changes serve one purpose. When splitting, stage and commit each concern separately.
    - **Wiki-link check:** For any new `.md` files being committed, verify each has at least one outbound `[[...]]` wiki-link connecting it to the knowledge graph. Orphaned docs (no outbound links) break Obsidian's graph view. If missing, add a `Related:` or `See also:` line before committing. See the CLAUDE.md wiki-link conventions for the correct format.
+   - **TODO linkage assist (LH-09; only when this repo has its own `TODO.md` convention with backticked paths):** run `git diff --cached --name-only` and check whether any staged path also appears backticked in an open (`- [ ]`) `TODO.md` item. If so, print a one-line reminder naming the matching item so the author can close or update it in the same commit — advisory only, never blocks the commit.
 
 4.5. **Resolve execution authority before any commit or merge command:**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-cli",
-  "version": "0.33.6",
+  "version": "0.33.8",
   "description": "Arcane framework CLI — scaffold and manage governance files in consuming repositories",
   "keywords": [
     "arcane",
@@ -47,6 +47,8 @@
     "check:adr-references": "tsx scripts/check-distributed-adr-references.ts",
     "check:version-bump": "tsx scripts/check-version-bump.ts",
     "check:citations": "tsx scripts/check-citations.ts --report",
+    "check:stale-claims": "tsx scripts/check-stale-claims.ts --check",
+    "check:followups": "tsx scripts/check-followups.ts",
     "check:review-round": "tsx scripts/check-review-round.ts",
     "doctor:leaks": "tsx src/index.ts doctor --leaks",
     "prepare": "husky"