arcane-cli 1.11.1 → 1.11.3

package/dist/assets/.arcane/governance/git-conventions.md

@@ -704,8 +704,8 @@ Agent-authored commits MUST include trailers in the commit message footer. Human
 | `Agent`        | Yes         | `claude`, `copilot`, `codex`          | The runtime that executed — always resolvable from the tool itself. |
 | `Persona`      | Conditional | `kellar`, `merlin`                    | The roster identity operated as. Present only when a roster exists and one was assigned; omit entirely otherwise — never guess. |
 | `Role`         | Conditional | `CTO / Architecture Lead`             | Derived **only** from `Persona`'s roster entry (`AgentDefinition.role`, reached via the roster entry's `definition` pointer — see `agent-loader.ts`), never typed by hand. Present only when `Persona` is present; a `Role` value not sourced from the actual roster file is a defect, not a stylistic choice — see the grading-probe example below. |
-| `Model`        | Yes         | `claude-opus-4-20250918`, `gpt-4o`    | Self-reported by the runtime. |
-| `Model-Source` | Yes         | `self-reported`                       | Marks that `Model` (and `Agent`) is self-reported, not independently verified — currently the only defined value. Exists because a fabricated `Model`/author trailer once survived eight PRs and human review undetected; the field makes that limitation visible instead of silently trusted. |
+| `Model`        | Yes         | `claude-opus-4-20250918`, `gpt-4o`, `withheld` | Self-reported by the runtime. `withheld` only when the runtime forbids disclosing it (see below). |
+| `Model-Source` | Yes         | `self-reported`, `withheld-by-runtime` | `self-reported` marks that `Model` (and `Agent`) is self-reported, not independently verified. `withheld-by-runtime` marks that the runtime forbids disclosing the model, so `Model` is `withheld` on purpose (`Agent` and `Provider` remain self-reported in that case). The `Model-Source` field exists because a fabricated `Model`/author trailer once survived eight PRs and human review undetected; the field makes that limitation visible instead of silently trusted. |
 | `Provider`     | Yes         | `anthropic`, `openai`                 | |
 | `Task-Type`    | Optional    | `docs`, `code`, `review`, `marketing`  | |
 | `Approval`     | Optional    | `interactive`, `batch`, `post-review`  | |
@@ -715,6 +715,8 @@ Agent-authored commits MUST include trailers in the commit message footer. Human
 | `Session`      | Optional    | `session-01`                           | |
 | `Rollback-Ref` | Optional    | path or commit to the pre-change state | |
 
+**When the runtime withholds the model.** Some agent runtimes forbid writing a model identifier into commits. In that case write `Model: withheld` and `Model-Source: withheld-by-runtime`, and nothing else in their place. `Agent` and `Provider` stay required, because the tool and the company are still known; only the model name is held back. Never guess or infer a model name to fill the field. Use these two values only when the runtime's own instructions explicitly forbid disclosing the model. Not knowing the model is not the same as being forbidden to say it: an agent that cannot determine its model asks the operator before committing, and never writes `withheld` as a fallback. A runtime that can name its model writes it, with `Model-Source: self-reported`.
+
 **Grading probe for whether a session actually inherited this rule** (not a hypothetical — this exact question surfaced a real gap before this split existed): *"What does `Role: developer` in a commit trailer resolve from?"* The wrong answer is "the agent roster" stated with confidence. The correct behavior is to check — read `.arcane/agents.yaml` if it exists, resolve the acting persona's `AgentDefinition.role` — and if no roster exists or the value can't be traced to a real entry, omit the `Role` trailer rather than typing a plausible-sounding guess.
 
 ### Vendored Framework Trailers

package/dist/assets/.arcane/spells/spell-close-session.md

@@ -197,7 +197,14 @@ Rules:
    - Skip this entire step for local-only and read-only sessions.
    - Resolve `<remote>` and `<trunk>` from observed Git/provider state: use the usable authenticated remote selected in step 9 and the merged PR's target branch (falling back to that remote's default branch). Never assume `origin` or `main`.
    - Verify through the detected provider that the PR is merged before changing branches.
-   - Then confirm each issue the PR's body closes is closed (`gh issue view <number> --json state` on GitHub). A merge closes only the issue directly after each closing keyword, so list any issue still open under the closure report's `## ⚠ Needs you`, or close it with a comment naming the merged PR.
+   - Then confirm each issue the PR closed is closed. That is every issue its body names after a closing keyword, every issue named after a closing keyword in its commit messages (`git log <base>..<merge-sha> --format=%B`), and every issue GitHub links to it (`gh pr view <number> --json closingIssuesReferences`). Check each one's state with `gh issue view <number> --json state,stateReason`. If GraphQL is unavailable, use REST: `gh api repos/<owner>/<repo>/issues/<number> --jq '.state,.state_reason'` for the state. Then treat as linked every issue that follows a closing keyword in the PR body (ignore any negation) and any issue the PR references whose `closed` event (`gh api repos/<owner>/<repo>/issues/<number>/events`) falls within a minute of the PR's `merged_at`. A merge closes every issue that directly follows a closing keyword, even inside a negation: "does not close #N" closes #N. List any issue still open under the closure report's `## ⚠ Needs you`, or, once the diff check below passes, close it with a comment naming the merged PR.
+   - **A closed issue is not evidence its change shipped.** For each issue above, confirm the merged diff contains the change that issue asked for:
+     - Read the issue (`gh issue view <number> --json title,body`, or REST), then the diff (`gh pr diff <number>`).
+     - Name the file that carries the requested change. If you cannot name one, treat the change as missing.
+     - A diff that touches only tracking files (`FEEDBACK.md`, the journal, the handoff, `CHANGELOG.md`, `.arcane/delegations.json`) never counts as the change.
+     - Reopen the issue only when all of these hold: its `closed` event falls within a minute of this PR's merge; its state reason is `completed`; and the change is not already on `<trunk>` from an earlier PR (`git log <trunk> --grep '#<number>'`). When they hold, reopen the issue with a comment naming the merged PR and listing what is missing, or which part, if only part shipped.
+     - When you cannot reopen it (permissions), list it under the closure report's `## ⚠ Needs you` instead.
+     - Never report such an issue as done.
    - **Determine the isolation primitive first (ARC-028 R8).** Run both of these and compare:
      ```bash
      git rev-parse --path-format=absolute --git-common-dir

package/dist/assets/.arcane/spells/spell-commit-work.md

@@ -125,8 +125,8 @@ Workflow:
    Agent: [runtime/tool name only -- claude, copilot, codex -- never a persona name]
    Persona: [roster identity operated as, ONLY if a roster exists (.arcane/agents.yaml) and one was assigned this session -- omit entirely otherwise, never guess]
    Role: [Persona's own AgentDefinition.role value, resolved from the roster -- never typed by hand. Present only if Persona is present]
-   Model: [model identifier, e.g., claude-opus-4-20250918]
-   Model-Source: [self-reported -- currently the only defined value; marks Model/Agent as self-reported, not independently verified]
+   Model: [model identifier, e.g., claude-opus-4-20250918 -- or `withheld` when the runtime forbids disclosing it]
+   Model-Source: [self-reported -- marks Model/Agent as self-reported, not independently verified; or withheld-by-runtime, paired with Model: withheld -- see git-conventions.md, "When the runtime withholds the model"]
    Provider: [anthropic or openai]
    Vendor: [arcane-cli, for vendored scaffold/update commits]
    Vendor-Version: [programmatically derived installed package version, when available]

package/dist/assets/.arcane/spells/spell-create-pull-request.md

@@ -162,7 +162,7 @@ Documentation-only PR. No functional code changed.
 <Same as above — include only when this PR is one epic of a tracked program.> · category: docs
 ```
 
-**Closing issues: one keyword per issue.** GitHub reads a closing keyword only for the issue reference directly after it, so `Closes #A and #B` closes #A and leaves #B open. In either template, write one keyword per issue, each in its own sentence: `Closes #A. Closes #B.` (the same for `Fixes` and `Resolves`), never `Closes #A and #B`. Write `Part of #N` for an issue this PR does not finish.
+**Closing issues: one keyword per issue.** GitHub reads a closing keyword only for the issue reference directly after it, so `Closes #A and #B` closes #A and leaves #B open. In either template, write one keyword per issue, each in its own sentence: `Closes #A. Closes #B.` (the same for `Fixes` and `Resolves`), never `Closes #A and #B`. Write `Part of #N` for an issue this PR does not finish. Never put a closing keyword (close, closes, closed, fix, fixes, fixed, resolve, resolves, resolved) directly before an issue you do not mean to close, including in a negation: "does not close #N" closes #N. Write `Refs #N` or `Part of #N` instead.
 
 **About `## For the record`** — include it **only when this PR is one epic of a tracked program**
 (one with a `docs/plans/<slug>/PLAN.md`); omit the heading entirely otherwise, since an empty
@@ -230,7 +230,7 @@ so they need no edit.
 - If no reviewers were resolved (none passed, or names the provider could not match): `⚠ No reviewers assigned — add them in the PR or re-run with --reviewers`.
 - If `--draft`: note it was created as a draft.
 - Delete the body temp file (`<git-dir>/arcane-pr-body.md`) once the PR is confirmed created and verified.
-- **Issues the body closes:** list each one by number. The PR has not merged yet, so add one line to the `Needs you` block: `After merging <PR URL>, confirm #A and #B are closed (gh issue view <number> --json state)`. `spell-close-session` step 10 runs the same check once it confirms the merge. Never assume the merge closed them.
+- **Issues the body closes:** list each one by number, and any issue linked to the PR in GitHub's sidebar. The PR has not merged yet, so add one line to the `Needs you` block: `After merging <PR URL>, confirm #A and #B are closed (gh issue view <number> --json state)`. `spell-close-session` step 10 runs the same check once it confirms the merge, and that the merged diff contains each issue's requested change. Never assume the merge closed them, or that a closed issue's change shipped.
 - **Branch topology** — per the generated state diagrams convention (rule 8, ARC-036), built only from
   Step 1's already-gathered branch name and commit list (`git log origin/<target>..HEAD --format="%h %s" --reverse`).
   Skip entirely (the applicability guard) if that commit list is empty — Step 0.4 already stops before

package/dist/assets/.arcane/spells/spell-feedback.md

@@ -19,7 +19,13 @@ Collect and record feedback to improve the Arcane workflow.
 
 ## Flush Mode (`--flush`)
 
-If the argument is `--flush`, skip Steps 1–5 entirely. Scan `FEEDBACK.md` for improvement items marked `<!-- upstream: queued -->`, and for each one run Step 6's filing flow (genericize, confirm, file or re-queue) without re-collecting feedback. Report how many were filed, re-queued, and how many remain.
+If the argument is `--flush`, skip Steps 1–5 entirely. Scan `FEEDBACK.md` for improvement items marked `<!-- upstream: queued -->`, and for each one run Step 6's filing flow (genericize, confirm, file or re-queue) without re-collecting feedback. Report how many were filed, how many were re-queued, and how many queued items remain in `FEEDBACK.md`, then end with a table of every issue the run created, so the operator can tell this run's issues from older ones:
+
+| Issue | URL | `FEEDBACK.md` heading |
+|---|---|---|
+| #<number> | <issue URL> | <the item's entry heading, e.g. `## Feedback — spell-review (2026-10-04)`> |
+
+Write `No issues created` instead of the table when the run filed nothing.
 
 The user's input describes what to give feedback on. If no argument is provided, ask one question: _"What part of the workflow or AI assistance do you want to give feedback on?"_ and wait.
 
@@ -123,9 +129,9 @@ For each framework-shaped item:
 
 1. **Genericize.** Strip anything identifying this specific consumer: venture/business names, org tokens, machine names, hub or local paths. Write "a consumer repo session" instead of naming the actual venture, generalize file paths to their relative form. The finding must read the same whether it came from this repo or any other arcane user's.
 2. **Check `gh`.** If unauthenticated or offline, skip straight to the fallback below.
-3. **Disclosure confirm.** Print the exact issue title and body that will be filed publicly on `{ARCANE_UPSTREAM_REPO}`, and ask for the literal word `disclose` — same discipline as `spell-manifest`'s disclosure gate; this is the same kind of act (private observation → public issue). Anything else is a decline, not an error.
-4. **File.** On `disclose`: `gh issue create --repo {ARCANE_UPSTREAM_REPO} --title "<title>" --body "<genericized body>"`. Report the issue URL.
-5. **Fallback.** If `gh` is unavailable, offline, or the operator declines: append `<!-- upstream: queued -->` to that item's line in `FEEDBACK.md`. Never block the rest of the session on this — queuing is a complete, valid outcome. The next `spell-feedback` run (or `spell-feedback --flush`) re-offers every queued item.
+3. **Disclosure confirm.** Print a first line that names the target repository in full (`owner/repo`, the resolved `{ARCANE_UPSTREAM_REPO}`) and says a public issue will be created there, then the exact issue title and body that will be filed, and ask for the literal word `disclose` — same discipline as `spell-manifest`'s disclosure gate; this is the same kind of act (private observation → public issue). Anything else is a decline, not an error.
+4. **File.** On `disclose`: `gh issue create --repo {ARCANE_UPSTREAM_REPO} --title "<title>" --body "<genericized body>"`. Report the issue URL, then replace that item's `<!-- upstream: queued -->` marker in `FEEDBACK.md`, if it has one, with `<!-- upstream: filed <issue URL> (<YYYY-MM-DD>) -->`. A filed item still marked `queued` is offered again by the next `--flush`, which risks a duplicate public issue.
+5. **Fallback.** If `gh` is unavailable, offline, or the operator declines: append `<!-- upstream: queued -->` to that item's line in `FEEDBACK.md`, unless the line already carries it. Never block the rest of the session on this — queuing is a complete, valid outcome. The next `spell-feedback` run (or `spell-feedback --flush`) re-offers every queued item.
 
 Maintainer side is unchanged: GitHub issues are arcane's normal public intake; triage into arcane's own `IDEAS.md`/`DECISIONS.md` happens in arcane sessions like any other issue. This spell never writes to a hub's venture books and never reads `ventures/registry.json` — framework feedback and venture ideas are different channels on purpose (venture ideas → hub books → `spell-manifest`; framework lessons → here → arcane's GitHub).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-cli",
-  "version": "1.11.1",
+  "version": "1.11.3",
   "description": "Arcane framework CLI — scaffold and manage governance files in consuming repositories",
   "keywords": [
     "arcane",