arcane-cli 0.33.7 → 0.33.9

package/dist/assets/.arcane/governance/universal-agent-rules.md

@@ -136,6 +136,12 @@ See also: [[README]], [[DECISIONS]], [[governance/git-conventions|Git Convention
     [[governance/git-conventions#content-verified-branch-deletion-todomd-merged-branch-cleanup-finding|Content-Verified
     Branch Deletion]] already applies to branches specifically.
 
+25. **Never quote a denylisted token, even when documenting its removal. Enforcement: explicitly advisory prose (ARC-023) — the org-token gate itself is a CI-only executable check; nothing local catches an agent re-typing the flagged string, which is exactly the failure mode this rule addresses.** A privacy-denylist gate (e.g. `ARCANE_ORG_TOKENS`, ARC-031) can only scan for the literal string it's configured to catch — it cannot tell "quoting a leak to explain the fix" from "the leak itself." Confirmed live: a real client name leaked into shipped content, was fixed, and the commit message describing that fix quoted the same name while narrating its removal — retriggering the identical CI failure minutes later. When describing a leak or its removal, name the class of thing that leaked ("a real client name," "an internal machine name") rather than repeating the flagged string, in commit messages, journals, and any other content a portability gate scans.
+
+26. **A zero-match search is evidence about the pattern, not the thing. Enforcement: explicitly advisory prose (ARC-023) — recognizing that a search's own shape (case sensitivity, exact wording, scope) can produce a false negative depends on agent judgment; no check re-runs a prior search with a different shape before a conclusion is accepted.** Concluding "X doesn't exist" or "X is still true" from one grep, one case-sensitive match attempt, or one narrowly-worded query treats the search as if it were exhaustive. Confirmed live: a case-sensitive grep for a lowercase term missed a real match spelled with a capital letter, producing an on-the-record false "still open" conclusion about an item that had, in fact, already shipped. Before stating an absence as fact, run at least one differently-shaped search (case-insensitive, a synonym, a broader scope) and say which searches actually ran, rather than reporting the first search's silence as the answer.
+
+27. **Dispatched-agent supervision: review the diff, not the summary. Enforcement: explicitly advisory prose (ARC-023) — no subagent registry or diff-review gate ships in this repo; supervising a dispatched agent's actual output, rather than trusting its self-report, depends on the dispatching agent's own judgment.** A dispatched agent's summary describes what it intended to do, not necessarily what it did — verify by reading its actual changes before reporting the work as complete. When multiple agents edit concurrently, assign at most one agent per file to avoid silently-overwritten or merge-conflicting work. A dispatched agent may override an instruction it was given after independently verifying that instruction is wrong for the situation at hand — but it must say so explicitly on the record, not silently substitute its own judgment.
+
 ---
 
 ## Client-Specific Instruction Locations

package/dist/assets/.github/prompts/spell-close-session.prompt.md

@@ -69,6 +69,8 @@ Workflow:
 
 4b. **Register unfinished, task-bearing work on a durable surface (session handoff durability, ARC-040) before the handoff is written.** Enumerate: an incomplete `Active task`, the `Next concrete action`, and any content that would otherwise live only in `Notes` because it has no other durable home. For each, resolve the sink from `tracking_mode` (per ARC-032): `internal` → the appropriate `TODO.md` (root or venture book); `external` → a work item via the configured `external_provider`, falling back to `TODO.md` when tracker tooling is unavailable this session. Write or update the entry, then carry its location into step 5b so the handoff fields below can name it. Skip this step entirely when nothing is unfinished — a fully clean close has nothing to register.
 
+4c. **Follow-up promotion sweep (LH-09; only when this repo has its own `scripts/check-followups.ts` — Arcane's own repo, or one that adopted the same convention; skip gracefully otherwise).** Run `npm run check:followups` (or the closest journal-scoped equivalent) and check whether this session's own journal entry or closure notes contain a deferral phrase ("filed as a separate", "follow-up", "out of scope", "not fixed here", "left open", "deferred", "revisit", "future work") with no tracker token nearby (`TODO`, `IDEAS`, `Q-NNN`, `ARC-NNN`, `EF-NN`, `RCA-NNN`, a PR URL) and no explicit `(untracked: <reason>)` opt-out. Promote each real hit to `TODO.md`/`IDEAS.md` before writing the handoff, or add the opt-out inline. Report-only tool — a hit is a prompt to check, not proof of an untracked gap; skip anything that's already tracked elsewhere in the same document.
+
 5. **Update [ai-context/system-prompt-context.md](../../ai-context/system-prompt-context.md).**
    - If priorities, environment state, or agent rules changed during the session, update the file to reflect current reality.
    - If no changes are needed, skip this step.

package/dist/assets/.github/prompts/spell-commit-work.prompt.md

@@ -74,6 +74,7 @@ Workflow:
    - Is this part of a larger initiative or a standalone change?
    - **Commit-splitting heuristic:** within one author partition, if the changes span clearly unrelated concerns (e.g., a feature change + an unrelated refactor + a dependency bump), recommend splitting them into multiple focused commits, each with its own message, rather than a single mixed commit. A single commit is fine when one author's changes serve one purpose. When splitting, stage and commit each concern separately.
    - **Wiki-link check:** For any new `.md` files being committed, verify each has at least one outbound `[[...]]` wiki-link connecting it to the knowledge graph. Orphaned docs (no outbound links) break Obsidian's graph view. If missing, add a `Related:` or `See also:` line before committing. See the CLAUDE.md wiki-link conventions for the correct format.
+   - **TODO linkage assist (LH-09; only when this repo has its own `TODO.md` convention with backticked paths):** run `git diff --cached --name-only` and check whether any staged path also appears backticked in an open (`- [ ]`) `TODO.md` item. If so, print a one-line reminder naming the matching item so the author can close or update it in the same commit — advisory only, never blocks the commit.
 
 4.5. **Resolve execution authority before any commit or merge command:**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-cli",
-  "version": "0.33.7",
+  "version": "0.33.9",
   "description": "Arcane framework CLI — scaffold and manage governance files in consuming repositories",
   "keywords": [
     "arcane",
@@ -48,6 +48,7 @@
     "check:version-bump": "tsx scripts/check-version-bump.ts",
     "check:citations": "tsx scripts/check-citations.ts --report",
     "check:stale-claims": "tsx scripts/check-stale-claims.ts --check",
+    "check:followups": "tsx scripts/check-followups.ts",
     "check:review-round": "tsx scripts/check-review-round.ts",
     "doctor:leaks": "tsx src/index.ts doctor --leaks",
     "prepare": "husky"