cclaw-cli 7.0.6 → 7.1.0

package/dist/config.d.ts

@@ -1,4 +1,6 @@
-import type { CclawConfig, FlowTrack, HarnessId, LanguageRulePack } from "./types.js";
+import type { CclawConfig, FlowTrack, HarnessId, LanguageRulePack, TddCommitMode } from "./types.js";
+export declare const TDD_COMMIT_MODES: readonly ["managed-per-slice", "agent-required", "checkpoint-only", "off"];
+export declare const DEFAULT_TDD_COMMIT_MODE: TddCommitMode;
 export declare const DEFAULT_TDD_TEST_PATH_PATTERNS: readonly string[];
 export declare const DEFAULT_TDD_TEST_GLOBS: readonly string[];
 export declare const DEFAULT_TDD_PRODUCTION_PATH_PATTERNS: readonly string[];
@@ -16,6 +18,7 @@ export declare class InvalidConfigError extends Error {
 }
 export declare function configPath(projectRoot: string): string;
 export declare function createDefaultConfig(harnesses?: HarnessId[], _defaultTrack?: FlowTrack): CclawConfig;
+export declare function resolveTddCommitMode(config: Pick<CclawConfig, "tdd"> | null | undefined): TddCommitMode;
 export declare function detectLanguageRulePacks(_projectRoot: string): Promise<LanguageRulePack[]>;
 export declare function readConfig(projectRoot: string, _options?: ReadConfigOptions): Promise<CclawConfig>;
 export interface WriteConfigOptions {

package/dist/config.js

@@ -6,8 +6,16 @@ import { exists, writeFileSafe } from "./fs-utils.js";
 import { HARNESS_IDS } from "./types.js";
 const CONFIG_PATH = `${RUNTIME_ROOT}/config.yaml`;
 const HARNESS_ID_SET = new Set(HARNESS_IDS);
-const ALLOWED_CONFIG_KEYS = new Set(["version", "flowVersion", "harnesses"]);
+const ALLOWED_CONFIG_KEYS = new Set(["version", "flowVersion", "harnesses", "tdd"]);
 const SUPPORTED_HARNESSES_TEXT = HARNESS_IDS.join(", ");
+export const TDD_COMMIT_MODES = [
+    "managed-per-slice",
+    "agent-required",
+    "checkpoint-only",
+    "off"
+];
+const TDD_COMMIT_MODE_SET = new Set(TDD_COMMIT_MODES);
+export const DEFAULT_TDD_COMMIT_MODE = "managed-per-slice";
 // Kept for runtime modules that use these defaults directly.
 export const DEFAULT_TDD_TEST_PATH_PATTERNS = [
     "**/*.test.*",
@@ -30,7 +38,9 @@ export class InvalidConfigError extends Error {
 function configFixExample() {
     return `harnesses:
   - claude
-  - cursor`;
+  - cursor
+tdd:
+  commitMode: managed-per-slice`;
 }
 function configValidationError(configFilePath, reason) {
     return new InvalidConfigError(`Invalid cclaw config at ${configFilePath}: ${reason}\n` +
@@ -48,9 +58,19 @@ export function createDefaultConfig(harnesses = DEFAULT_HARNESSES, _defaultTrack
     return {
         version: CCLAW_VERSION,
         flowVersion: FLOW_VERSION,
-        harnesses: [...new Set(harnesses)]
+        harnesses: [...new Set(harnesses)],
+        tdd: {
+            commitMode: DEFAULT_TDD_COMMIT_MODE
+        }
     };
 }
+export function resolveTddCommitMode(config) {
+    const raw = config?.tdd?.commitMode;
+    if (typeof raw === "string" && TDD_COMMIT_MODE_SET.has(raw)) {
+        return raw;
+    }
+    return DEFAULT_TDD_COMMIT_MODE;
+}
 function assertOnlySupportedKeys(parsed, fullPath) {
     const unknownKeys = Object.keys(parsed).filter((key) => !ALLOWED_CONFIG_KEYS.has(key));
     if (unknownKeys.length === 0)
@@ -84,6 +104,10 @@ export async function readConfig(projectRoot, _options = {}) {
         !Array.isArray(parsed.harnesses)) {
         throw configValidationError(fullPath, `"harnesses" must be an array`);
     }
+    if (Object.prototype.hasOwnProperty.call(parsed, "tdd") &&
+        !isRecord(parsed.tdd)) {
+        throw configValidationError(fullPath, `"tdd" must be an object when provided`);
+    }
     const rawHarnesses = Array.isArray(parsed.harnesses) ? parsed.harnesses : DEFAULT_HARNESSES;
     const normalizedHarnesses = [];
     for (const harness of rawHarnesses) {
@@ -103,17 +127,32 @@ export async function readConfig(projectRoot, _options = {}) {
     const flowVersion = typeof parsed.flowVersion === "string" && parsed.flowVersion.trim().length > 0
         ? parsed.flowVersion
         : FLOW_VERSION;
+    const parsedTdd = isRecord(parsed.tdd) ? parsed.tdd : {};
+    const rawCommitMode = parsedTdd.commitMode;
+    if (rawCommitMode !== undefined &&
+        (typeof rawCommitMode !== "string" || !TDD_COMMIT_MODE_SET.has(rawCommitMode))) {
+        throw configValidationError(fullPath, `"tdd.commitMode" must be one of: ${TDD_COMMIT_MODES.join(", ")}`);
+    }
+    const commitMode = typeof rawCommitMode === "string"
+        ? rawCommitMode
+        : DEFAULT_TDD_COMMIT_MODE;
     return {
         version,
         flowVersion,
-        harnesses: normalizedHarnesses
+        harnesses: normalizedHarnesses,
+        tdd: {
+            commitMode
+        }
     };
 }
 export async function writeConfig(projectRoot, config, _options = {}) {
     const serialisable = {
         version: config.version,
         flowVersion: config.flowVersion,
-        harnesses: config.harnesses
+        harnesses: config.harnesses,
+        tdd: {
+            commitMode: resolveTddCommitMode(config)
+        }
     };
     await writeFileSafe(configPath(projectRoot), stringify(serialisable));
 }

package/dist/content/core-agents.js

@@ -156,6 +156,7 @@ export function sliceBuilderProtocol() {
         "### Invariants",
         "- Produce failing RED evidence (or cite the delegated RED artifact) **before** production edits.",
         "- Stay inside the slice contract: `claimedPaths`, acceptance mapping, and forbidden-change lists from the parent.",
+        "- When `tdd.commitMode=managed-per-slice`, do **not** hand-edit git state for slice files (no manual `git add/commit` on claimed paths). Let `.cclaw/hooks/slice-commit.mjs` own per-slice commits.",
         "- After GREEN, refactor inline **or** record deferred refactor via the same `--refactor-outcome` mechanics the controller specifies.",
         "- Own the prose slice summary at `<artifacts-dir>/tdd-slices/S-<id>.md` yourself.",
         "",

package/dist/content/hooks.d.ts

@@ -2,6 +2,7 @@ export declare function startFlowScript(): string;
 export declare function cancelRunScript(): string;
 export declare function stageCompleteScript(): string;
 export declare function delegationRecordScript(): string;
+export declare function sliceCommitScript(): string;
 export declare function runHookCmdScript(): string;
 export { claudeHooksJsonWithObservation as claudeHooksJson } from "./observe.js";
 export { cursorHooksJsonWithObservation as cursorHooksJson } from "./observe.js";

package/dist/content/hooks.js

@@ -200,6 +200,7 @@ export function stageCompleteScript() {
 export function delegationRecordScript() {
     return `#!/usr/bin/env node
 import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
 import fs from "node:fs/promises";
 import path from "node:path";
 import process from "node:process";
@@ -1189,6 +1190,101 @@ async function runRepair(args, json) {
   }
 }
 
+async function runSliceCommitIfNeeded(root, row, runId) {
+  if (
+    row.stage !== "tdd" ||
+    row.agent !== "slice-builder" ||
+    row.status !== "completed" ||
+    row.phase !== "doc"
+  ) {
+    return { ok: true, skipped: true };
+  }
+  const sliceId = typeof row.sliceId === "string" ? row.sliceId.trim() : "";
+  const spanId = typeof row.spanId === "string" ? row.spanId.trim() : "";
+  if (sliceId.length === 0 || spanId.length === 0) {
+    return { ok: true, skipped: true };
+  }
+  const helperPath = path.join(root, RUNTIME_ROOT, "hooks", "slice-commit.mjs");
+  if (!(await exists(helperPath))) {
+    return { ok: true, skipped: true };
+  }
+  const helperArgs = [
+    helperPath,
+    "--json",
+    "--quiet",
+    "--slice=" + sliceId,
+    "--span-id=" + spanId,
+    "--run-id=" + runId
+  ];
+  if (typeof row.taskId === "string" && row.taskId.trim().length > 0) {
+    helperArgs.push("--task-id=" + row.taskId.trim());
+  }
+  if (Array.isArray(row.claimedPaths) && row.claimedPaths.length > 0) {
+    helperArgs.push("--claimed-paths=" + row.claimedPaths.join(","));
+  }
+  if (Array.isArray(row.evidenceRefs) && row.evidenceRefs.length > 0) {
+    const title = String(row.evidenceRefs[0] || "").trim();
+    if (title.length > 0) {
+      helperArgs.push("--title=" + title.slice(0, 120));
+    }
+  }
+
+  return await new Promise((resolve) => {
+    const child = spawn(process.execPath, helperArgs, {
+      cwd: root,
+      env: process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let out = "";
+    let err = "";
+    child.stdout.on("data", (chunk) => {
+      out += String(chunk ?? "");
+    });
+    child.stderr.on("data", (chunk) => {
+      err += String(chunk ?? "");
+    });
+    child.on("error", (error) => {
+      resolve({
+        ok: false,
+        errorCode: "slice_commit_failed",
+        details: {
+          message: error instanceof Error ? error.message : String(error)
+        }
+      });
+    });
+    child.on("close", (code) => {
+      let payload = null;
+      const trimmed = out.trim();
+      if (trimmed.length > 0) {
+        try {
+          payload = JSON.parse(trimmed);
+        } catch {
+          payload = null;
+        }
+      }
+      if (code === 0) {
+        resolve({ ok: true, payload });
+        return;
+      }
+      const payloadCode =
+        payload && typeof payload === "object" && typeof payload.errorCode === "string"
+          ? payload.errorCode
+          : "slice_commit_failed";
+      resolve({
+        ok: false,
+        errorCode: payloadCode,
+        details:
+          payload && typeof payload === "object"
+            ? payload
+            : {
+              stderr: err.trim(),
+              stdout: out.trim()
+            }
+      });
+    });
+  });
+}
+
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   const json = args.json !== undefined;
@@ -1573,6 +1669,23 @@ async function main() {
     }
   }
 
+  const sliceCommitResult = await runSliceCommitIfNeeded(root, clean, runId);
+  if (!sliceCommitResult.ok) {
+    emitErrorJson(
+      sliceCommitResult.errorCode || "slice_commit_failed",
+      sliceCommitResult.details || {},
+      json
+    );
+    return;
+  }
+  if (
+    sliceCommitResult.payload &&
+    typeof sliceCommitResult.payload === "object" &&
+    typeof sliceCommitResult.payload.commitSha === "string"
+  ) {
+    event.sliceCommitSha = sliceCommitResult.payload.commitSha;
+  }
+
   await persistEntry(root, runId, clean, event);
 
   process.stdout.write(JSON.stringify({ ok: true, event }, null, 2) + "\\n");
@@ -1581,6 +1694,9 @@ async function main() {
 void main();
 `;
 }
+export function sliceCommitScript() {
+    return internalHelperScript("slice-commit", "slice-commit", "Usage: node " + RUNTIME_ROOT + "/hooks/slice-commit.mjs --slice=<S-N> --span-id=<span-id> [--task-id=<T-id>] [--title=<text>] [--run-id=<run-id>] [--claimed-paths=<path1,path2,...>] [--claimed-path=<path> ...] [--json] [--quiet]");
+}
 export function runHookCmdScript() {
     return `: << 'CMDBLOCK'
 @echo off

package/dist/content/stages/tdd.js

@@ -52,7 +52,7 @@ export const TDD = {
             "Controller never writes production code or per-slice prose — the delegated worker does. Record routing decisions; cite `wave-status` before redundant slice questions.",
             "Discover existing tests and commands before RED; run a system-wide impact check (callbacks, state, interfaces, contracts) before GREEN.",
             "RED must fail for the right reason; capture logs. GREEN must run the full relevant suite, not a narrow subset.",
-            "Before calling a slice done, run verification-before-completion (command + PASS/FAIL + commit SHA or no-VCS attestation).",
+            "Before calling a slice done, run verification-before-completion (command + PASS/FAIL + durable commit evidence: managed-per-slice git commits when `.git` is present, or explicit no-VCS attestation + hash).",
             "Integration-overseer must complete with PASS/PASS_WITH_GAPS when fan-out closes a wave unless the controller emits `cclaw_integration_overseer_skipped` for a documented heuristic skip.",
             "Investigation discipline + behavior anchor in this skill govern evidence: cite commands and paths, not pasted source dumps.",
         ],
@@ -72,7 +72,7 @@ export const TDD = {
             { id: "tdd_red_test_written", description: "Failing tests exist before implementation changes." },
             { id: "tdd_green_full_suite", description: "Full relevant suite passes in GREEN state." },
             { id: "tdd_refactor_completed", description: "Refactor pass completed with behavior preservation verified." },
-            { id: "tdd_verified_before_complete", description: "Fresh verification evidence includes test command, explicit pass/fail status, and a durable ref: commit SHA when `.git` is present or explicit no-VCS attestation + hash when not." },
+            { id: "tdd_verified_before_complete", description: "Fresh verification evidence includes test command + explicit pass/fail status; when `tdd.commitMode=managed-per-slice` and `.git` exists, closed slices must be backed by real git commits, otherwise provide explicit no-VCS attestation + hash." },
             { id: "tdd_iron_law_acknowledged", description: "Iron Law acknowledgement is explicit (`Acknowledged: yes`) before implementation proceeds." },
             { id: "tdd_watched_red_observed", description: "Watched-RED Proof records at least one observed failing test with ISO timestamp evidence." },
             { id: "tdd_slice_cycle_complete", description: "Vertical Slice Cycle records RED, GREEN, and REFACTOR phases per active slice." },
@@ -89,7 +89,7 @@ export const TDD = {
             "REFACTOR coverage: separate `phase=refactor|refactor-deferred` rows or `refactorOutcome` folded into GREEN as the hook documents.",
             "`tdd-slices/S-<id>.md` kept current with the builder span; phase events remain the ground truth for lint auto-render blocks.",
             "`event: slice-completed` umbrella rows tie RED/GREEN timestamps to the builder once that writer runs on the repo.",
-            "Fresh verification (command + PASS/FAIL + commit SHA or no-VCS reason + hash); Iron Law acknowledgement; acceptance mapping + traceability IDs.",
+            "Fresh verification (command + PASS/FAIL + managed-per-slice commit proof from git log when `.git` exists, or no-VCS reason + hash); Iron Law acknowledgement; acceptance mapping + traceability IDs.",
         ],
         inputs: ["approved plan slice", "spec acceptance criterion", "test harness configuration", "coding standards and constraints"],
         requiredContext: ["plan artifact", "spec artifact", "existing test patterns", "affected contracts and state boundaries"],
@@ -135,7 +135,7 @@ export const TDD = {
             { section: "REFACTOR Notes", required: true, validationRule: "What changed, why, behavior preservation confirmed." },
             { section: "Traceability", required: true, validationRule: "Plan task ID and spec criterion linked." },
             { section: "Iron Law Acknowledgement", required: true, validationRule: "Must include `Acknowledged: yes` and list exceptions (or `None`)." },
-            { section: "Verification Ladder", required: true, validationRule: "Per-slice verification tier (static, command, behavioral, human) with evidence captured for the highest tier reached this turn. Must include command + PASS/FAIL + commit SHA when VCS is present, or explicit no-vcs reason plus content/artifact hash/config override." },
+            { section: "Verification Ladder", required: true, validationRule: "Per-slice verification tier (static, command, behavioral, human) with evidence captured for the highest tier reached this turn. Must include command + PASS/FAIL and durable commit evidence: managed-per-slice git commit proof when VCS is present, or explicit no-vcs reason plus content/artifact hash/config override." },
             { section: "TDD Blocker Taxonomy", required: false, validationRule: "When blocked, classify as NO_SOURCE_CONTEXT, NO_TEST_SURFACE, NO_IMPLEMENTABLE_SLICE, RED_NOT_EXPRESSIBLE, or NO_VCS_MODE; include blockedBecause, missingInputs, recommendedRoute, nextCommand, and resumeCriteria." }
         ]
     },

package/dist/install.js

@@ -13,7 +13,7 @@ import { cancelCommandContract, cancelCommandSkillMarkdown } from "./content/can
 import { subagentDrivenDevSkill, parallelAgentsSkill } from "./content/subagents.js";
 import { sessionHooksSkillMarkdown } from "./content/session-hooks.js";
 import { ironLawsSkillMarkdown } from "./content/iron-laws.js";
-import { stageCompleteScript, startFlowScript, cancelRunScript, runHookCmdScript, delegationRecordScript, opencodePluginJs, claudeHooksJson, codexHooksJson, cursorHooksJson } from "./content/hooks.js";
+import { stageCompleteScript, startFlowScript, cancelRunScript, runHookCmdScript, delegationRecordScript, sliceCommitScript, opencodePluginJs, claudeHooksJson, codexHooksJson, cursorHooksJson } from "./content/hooks.js";
 import { nodeHookRuntimeScript } from "./content/node-hooks.js";
 import { META_SKILL_NAME, usingCclawSkillMarkdown } from "./content/meta-skill.js";
 import { ARTIFACT_TEMPLATES, CURSOR_GUIDELINES_RULE_MDC, CURSOR_WORKFLOW_RULE_MDC, RULEBOOK_MARKDOWN, buildRulesJson } from "./content/templates.js";
@@ -692,6 +692,7 @@ async function writeHooks(projectRoot, config) {
     await writeFileSafe(path.join(hooksDir, "run-hook.mjs"), bundledHookRuntime ?? nodeHookRuntimeScript(hookRuntimeOptions));
     await writeFileSafe(path.join(hooksDir, "run-hook.cmd"), runHookCmdScript());
     await writeFileSafe(path.join(hooksDir, "delegation-record.mjs"), delegationRecordScript());
+    await writeFileSafe(path.join(hooksDir, "slice-commit.mjs"), sliceCommitScript());
     const opencodePluginSource = opencodePluginJs();
     await writeFileSafe(path.join(hooksDir, "opencode-plugin.mjs"), opencodePluginSource);
     try {
@@ -701,6 +702,7 @@ async function writeHooks(projectRoot, config) {
             "run-hook.mjs",
             "run-hook.cmd",
             "delegation-record.mjs",
+            "slice-commit.mjs",
             "opencode-plugin.mjs",
             "cancel-run.mjs"
         ]) {

package/dist/internal/advance-stage.js

@@ -18,6 +18,7 @@ import { DelegationTimestampError, DispatchCapError, DispatchClaimedPathProtecte
 import { parsePlanSplitWavesArgs, runPlanSplitWaves } from "./plan-split-waves.js";
 import { runWaveStatusCommand } from "./wave-status.js";
 import { runCohesionContractCommand } from "./cohesion-contract-stub.js";
+import { runSliceCommitCommand } from "./slice-commit.js";
 /**
  * Subcommands that mutate or consult flow-state.json via the CLI runtime.
  * They all require the sha256 sidecar to match before continuing so a
@@ -35,7 +36,7 @@ const GUARD_ENFORCED_SUBCOMMANDS = new Set([
 export async function runInternalCommand(projectRoot, argv, io) {
     const [subcommand, ...tokens] = argv;
     if (!subcommand) {
-        io.stderr.write("cclaw internal requires a subcommand: advance-stage | start-flow | cancel-run | rewind | verify-flow-state-diff | verify-current-state | envelope-validate | tdd-red-evidence | tdd-loop-status | early-loop-status | compound-readiness | runtime-integrity | hook | flow-state-repair | waiver-grant | plan-split-waves | wave-status | cohesion-contract\n");
+        io.stderr.write("cclaw internal requires a subcommand: advance-stage | start-flow | cancel-run | rewind | verify-flow-state-diff | verify-current-state | envelope-validate | tdd-red-evidence | tdd-loop-status | early-loop-status | compound-readiness | runtime-integrity | hook | slice-commit | flow-state-repair | waiver-grant | plan-split-waves | wave-status | cohesion-contract\n");
         return 1;
     }
     try {
@@ -81,6 +82,9 @@ export async function runInternalCommand(projectRoot, argv, io) {
         if (subcommand === "hook") {
             return await runHookCommand(projectRoot, parseHookArgs(tokens), io);
         }
+        if (subcommand === "slice-commit") {
+            return await runSliceCommitCommand(projectRoot, tokens, io);
+        }
         if (subcommand === "flow-state-repair") {
             return await runFlowStateRepair(projectRoot, parseFlowStateRepairArgs(tokens), io);
         }
@@ -96,7 +100,7 @@ export async function runInternalCommand(projectRoot, argv, io) {
         if (subcommand === "cohesion-contract") {
             return await runCohesionContractCommand(projectRoot, tokens, io);
         }
-        io.stderr.write(`Unknown internal subcommand: ${subcommand}. Expected advance-stage | start-flow | cancel-run | rewind | verify-flow-state-diff | verify-current-state | envelope-validate | tdd-red-evidence | tdd-loop-status | early-loop-status | compound-readiness | runtime-integrity | hook | flow-state-repair | waiver-grant | plan-split-waves | wave-status | cohesion-contract\n`);
+        io.stderr.write(`Unknown internal subcommand: ${subcommand}. Expected advance-stage | start-flow | cancel-run | rewind | verify-flow-state-diff | verify-current-state | envelope-validate | tdd-red-evidence | tdd-loop-status | early-loop-status | compound-readiness | runtime-integrity | hook | slice-commit | flow-state-repair | waiver-grant | plan-split-waves | wave-status | cohesion-contract\n`);
         return 1;
     }
     catch (err) {

package/dist/internal/slice-commit.d.ts

@@ -0,0 +1,7 @@
+import type { Writable } from "node:stream";
+interface InternalIo {
+    stdout: Writable;
+    stderr: Writable;
+}
+export declare function runSliceCommitCommand(projectRoot: string, tokens: string[], io: InternalIo): Promise<number>;
+export {};

package/dist/internal/slice-commit.js

@@ -0,0 +1,296 @@
+import { execFile } from "node:child_process";
+import path from "node:path";
+import { promisify } from "node:util";
+import { readConfig, resolveTddCommitMode } from "../config.js";
+import { readDelegationLedger } from "../delegation.js";
+import { exists } from "../fs-utils.js";
+const execFileAsync = promisify(execFile);
+function parseCsv(raw) {
+    return raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+}
+function normalizePathLike(value) {
+    const slashes = value.replace(/\\/gu, "/");
+    const withoutDot = slashes.replace(/^\.\//u, "");
+    return withoutDot.replace(/\/+$/u, "");
+}
+function parseSliceCommitArgs(tokens) {
+    let sliceId = "";
+    let spanId = "";
+    let taskId;
+    let title;
+    let runId;
+    const claimedPaths = [];
+    let json = false;
+    let quiet = false;
+    for (let i = 0; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        const next = tokens[i + 1];
+        const valueFrom = (flag) => {
+            if (token.startsWith(`${flag}=`))
+                return token.slice(flag.length + 1);
+            if (token === flag && next && !next.startsWith("--")) {
+                i += 1;
+                return next;
+            }
+            throw new Error(`${flag} requires a value.`);
+        };
+        if (token === "--json") {
+            json = true;
+            continue;
+        }
+        if (token === "--quiet") {
+            quiet = true;
+            continue;
+        }
+        if (token.startsWith("--slice=") || token === "--slice") {
+            sliceId = valueFrom("--slice").trim();
+            continue;
+        }
+        if (token.startsWith("--span-id=") || token === "--span-id") {
+            spanId = valueFrom("--span-id").trim();
+            continue;
+        }
+        if (token.startsWith("--task-id=") || token === "--task-id") {
+            taskId = valueFrom("--task-id").trim();
+            continue;
+        }
+        if (token.startsWith("--title=") || token === "--title") {
+            title = valueFrom("--title").trim();
+            continue;
+        }
+        if (token.startsWith("--run-id=") || token === "--run-id") {
+            runId = valueFrom("--run-id").trim();
+            continue;
+        }
+        if (token.startsWith("--claimed-paths=") || token === "--claimed-paths") {
+            claimedPaths.push(...parseCsv(valueFrom("--claimed-paths")));
+            continue;
+        }
+        if (token.startsWith("--claimed-path=") || token === "--claimed-path") {
+            const one = valueFrom("--claimed-path").trim();
+            if (one.length > 0)
+                claimedPaths.push(one);
+            continue;
+        }
+        throw new Error(`Unknown flag for internal slice-commit: ${token}`);
+    }
+    if (sliceId.length === 0) {
+        throw new Error("internal slice-commit requires --slice=<S-N>.");
+    }
+    if (spanId.length === 0) {
+        throw new Error("internal slice-commit requires --span-id=<span-id>.");
+    }
+    return {
+        sliceId,
+        spanId,
+        taskId,
+        title,
+        runId,
+        claimedPaths,
+        json,
+        quiet
+    };
+}
+function output(io, args, payload, channel = "stdout") {
+    if (args.quiet && channel === "stdout")
+        return;
+    const writer = channel === "stdout" ? io.stdout : io.stderr;
+    if (args.json) {
+        writer.write(`${JSON.stringify(payload)}\n`);
+        return;
+    }
+    const message = typeof payload.message === "string"
+        ? payload.message
+        : JSON.stringify(payload);
+    writer.write(`${message}\n`);
+}
+function parsePorcelainPaths(raw) {
+    const out = [];
+    for (const line of raw.split(/\r?\n/gu)) {
+        const trimmed = line.trimEnd();
+        if (trimmed.length < 4)
+            continue;
+        // porcelain line shape: XY<space><path>
+        const status = trimmed.slice(0, 2);
+        if (status === "??") {
+            const p = normalizePathLike(trimmed.slice(3).trim());
+            if (p.length > 0)
+                out.push(p);
+            continue;
+        }
+        let p = trimmed.slice(3).trim();
+        const renameIdx = p.indexOf(" -> ");
+        if (renameIdx >= 0) {
+            p = p.slice(renameIdx + 4);
+        }
+        p = normalizePathLike(p.replace(/^"/u, "").replace(/"$/u, ""));
+        if (p.length > 0)
+            out.push(p);
+    }
+    return [...new Set(out)];
+}
+function matchesClaimedPath(changedPath, claimedPaths) {
+    const changed = normalizePathLike(changedPath);
+    return claimedPaths.some((rawClaimed) => {
+        const claimed = normalizePathLike(rawClaimed);
+        if (claimed.length === 0)
+            return false;
+        if (changed === claimed)
+            return true;
+        return changed.startsWith(`${claimed}/`);
+    });
+}
+async function resolveClaimedPathsFromLedger(projectRoot, args) {
+    const ledger = await readDelegationLedger(projectRoot);
+    const matches = ledger.entries.filter((entry) => entry.stage === "tdd" &&
+        entry.agent === "slice-builder" &&
+        entry.sliceId === args.sliceId &&
+        entry.spanId === args.spanId &&
+        (!args.runId || entry.runId === args.runId) &&
+        Array.isArray(entry.claimedPaths) &&
+        entry.claimedPaths.length > 0);
+    matches.sort((a, b) => {
+        const aTs = a.ts ?? a.startTs ?? "";
+        const bTs = b.ts ?? b.startTs ?? "";
+        return aTs < bTs ? 1 : aTs > bTs ? -1 : 0;
+    });
+    const fromLedger = matches[0]?.claimedPaths ?? [];
+    return [...new Set(fromLedger.map((p) => normalizePathLike(p)).filter((p) => p.length > 0))];
+}
+export async function runSliceCommitCommand(projectRoot, tokens, io) {
+    let args;
+    try {
+        args = parseSliceCommitArgs(tokens);
+    }
+    catch (err) {
+        io.stderr.write(`cclaw internal slice-commit: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    const config = await readConfig(projectRoot).catch(() => null);
+    const commitMode = resolveTddCommitMode(config);
+    if (commitMode !== "managed-per-slice") {
+        output(io, args, {
+            ok: true,
+            skipped: true,
+            reason: "commit-mode-not-managed",
+            commitMode,
+            message: `slice-commit skipped: commitMode=${commitMode}`
+        });
+        return 0;
+    }
+    const gitPresent = await exists(path.join(projectRoot, ".git"));
+    if (!gitPresent) {
+        output(io, args, {
+            ok: true,
+            skipped: true,
+            reason: "no-git",
+            message: "slice-commit skipped: .git is missing"
+        });
+        return 0;
+    }
+    const claimedPaths = args.claimedPaths.length > 0
+        ? [...new Set(args.claimedPaths.map((p) => normalizePathLike(p)).filter((p) => p.length > 0))]
+        : await resolveClaimedPathsFromLedger(projectRoot, args);
+    if (claimedPaths.length === 0) {
+        output(io, args, {
+            ok: false,
+            errorCode: "slice_commit_claimed_paths_missing",
+            details: {
+                sliceId: args.sliceId,
+                spanId: args.spanId
+            },
+            message: `slice_commit_claimed_paths_missing: no claimed paths for ${args.sliceId}/${args.spanId}`
+        }, "stderr");
+        return 2;
+    }
+    const { stdout: statusRaw } = await execFileAsync("git", ["status", "--porcelain", "-uall"], {
+        cwd: projectRoot
+    });
+    const changedPaths = parsePorcelainPaths(statusRaw);
+    if (changedPaths.length === 0) {
+        output(io, args, {
+            ok: true,
+            skipped: true,
+            reason: "no-changes",
+            message: `slice-commit skipped: no working-tree changes for ${args.sliceId}`
+        });
+        return 0;
+    }
+    const pathDrift = changedPaths.filter((p) => !matchesClaimedPath(p, claimedPaths));
+    if (pathDrift.length > 0) {
+        output(io, args, {
+            ok: false,
+            errorCode: "slice_commit_path_drift",
+            details: {
+                sliceId: args.sliceId,
+                spanId: args.spanId,
+                claimedPaths,
+                driftPaths: pathDrift
+            },
+            message: `slice_commit_path_drift: ${pathDrift.join(", ")}`
+        }, "stderr");
+        return 2;
+    }
+    const changedInClaim = changedPaths.filter((p) => matchesClaimedPath(p, claimedPaths));
+    if (changedInClaim.length === 0) {
+        output(io, args, {
+            ok: true,
+            skipped: true,
+            reason: "claimed-paths-unchanged",
+            message: `slice-commit skipped: no changes within claimed paths for ${args.sliceId}`
+        });
+        return 0;
+    }
+    try {
+        await execFileAsync("git", ["add", "--", ...claimedPaths], {
+            cwd: projectRoot
+        });
+        const taskPart = args.taskId && args.taskId.length > 0 ? args.taskId : "task";
+        const titlePart = args.title && args.title.length > 0 ? args.title : "slice update";
+        const header = `${args.sliceId}/${taskPart}: ${titlePart}`;
+        const body = [
+            `span-id: ${args.spanId}`,
+            `run-id: ${args.runId ?? "unknown"}`,
+            "phase-cycle: red->green->refactor->doc"
+        ].join("\n");
+        await execFileAsync("git", ["commit", "-m", header, "-m", body], {
+            cwd: projectRoot
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (/nothing to commit/iu.test(message)) {
+            output(io, args, {
+                ok: true,
+                skipped: true,
+                reason: "nothing-to-commit",
+                message: `slice-commit skipped: nothing to commit for ${args.sliceId}`
+            });
+            return 0;
+        }
+        output(io, args, {
+            ok: false,
+            errorCode: "slice_commit_failed",
+            details: { message },
+            message: `slice_commit_failed: ${message}`
+        }, "stderr");
+        return 1;
+    }
+    const { stdout: shaStdout } = await execFileAsync("git", ["rev-parse", "HEAD"], {
+        cwd: projectRoot
+    });
+    const commitSha = shaStdout.trim();
+    output(io, args, {
+        ok: true,
+        commitSha,
+        sliceId: args.sliceId,
+        spanId: args.spanId,
+        claimedPaths,
+        changedPaths: changedInClaim,
+        message: `slice commit created for ${args.sliceId}: ${commitSha}`
+    });
+    return 0;
+}

package/dist/tdd-verification-evidence.js

@@ -1,13 +1,86 @@
+import { execFile } from "node:child_process";
 import path from "node:path";
+import { promisify } from "node:util";
+import { readConfig, resolveTddCommitMode } from "./config.js";
+import { readDelegationLedger } from "./delegation.js";
 import { exists } from "./fs-utils.js";
+const execFileAsync = promisify(execFile);
 export const TEST_COMMAND_HINT_PATTERN = /\b(?:npm test|npm run test(?::[\w:-]+)?|pnpm test|pnpm [\w:-]*test[\w:-]*|yarn test|yarn [\w:-]*test[\w:-]*|bun test|bun run test(?::[\w:-]+)?|vitest|jest|pytest|go test|cargo test|mvn test|gradle test|\.\/gradlew test|dotnet test)\b/iu;
 export const SHA_WITH_LABEL_PATTERN = /\b(?:sha|commit)(?:\s*[:=]|\s+)\s*[0-9a-f]{7,40}\b/iu;
 export const PASS_STATUS_PATTERN = /\b(?:pass|passed|green|ok)\b/iu;
 export const NO_VCS_ATTESTATION_PATTERN = /\b(?:no[-_ ]?vcs|no git|not a git repo|vcs\s*[:=]\s*none)\b/iu;
 export const NO_VCS_HASH_PATTERN = /\b(?:content|artifact)[-_ ]?hash\s*[:=]\s*(?:sha256:)?[0-9a-f]{16,64}\b|\bsha256\s*[:=]\s*[0-9a-f]{16,64}\b/iu;
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+function hasRefactorCoverage(entries) {
+    const phases = new Set(entries
+        .filter((e) => e.status === "completed" && typeof e.phase === "string")
+        .map((e) => e.phase));
+    if (phases.has("refactor") || phases.has("refactor-deferred")) {
+        return true;
+    }
+    const greenWithOutcome = entries.find((entry) => entry.status === "completed" &&
+        entry.phase === "green" &&
+        entry.refactorOutcome &&
+        (entry.refactorOutcome.mode === "inline" || entry.refactorOutcome.mode === "deferred"));
+    if (!greenWithOutcome?.refactorOutcome)
+        return false;
+    if (greenWithOutcome.refactorOutcome.mode === "inline")
+        return true;
+    const rationale = greenWithOutcome.refactorOutcome.rationale;
+    if (typeof rationale === "string" && rationale.trim().length > 0)
+        return true;
+    if (!Array.isArray(greenWithOutcome.evidenceRefs))
+        return false;
+    return greenWithOutcome.evidenceRefs.some((ref) => typeof ref === "string" && ref.trim().length > 0);
+}
+function collectClosedSlices(entries, runId) {
+    const bySlice = new Map();
+    for (const entry of entries) {
+        if (entry.runId !== runId)
+            continue;
+        if (entry.stage !== "tdd")
+            continue;
+        if (entry.status !== "completed")
+            continue;
+        if (typeof entry.sliceId !== "string" || entry.sliceId.length === 0)
+            continue;
+        if (typeof entry.spanId !== "string" || entry.spanId.length === 0)
+            continue;
+        const bySpan = bySlice.get(entry.sliceId) ?? new Map();
+        const rows = bySpan.get(entry.spanId) ?? [];
+        rows.push(entry);
+        bySpan.set(entry.spanId, rows);
+        bySlice.set(entry.sliceId, bySpan);
+    }
+    const closedSlices = new Set();
+    for (const [sliceId, bySpan] of bySlice.entries()) {
+        for (const rows of bySpan.values()) {
+            const phases = new Set(rows
+                .filter((row) => row.status === "completed" && typeof row.phase === "string")
+                .map((row) => row.phase));
+            const hasRed = phases.has("red");
+            const hasGreen = phases.has("green");
+            const hasDoc = phases.has("doc");
+            if (hasRed && hasGreen && hasDoc && hasRefactorCoverage(rows)) {
+                closedSlices.add(sliceId);
+                break;
+            }
+        }
+    }
+    return [...closedSlices].sort();
+}
+async function hasManagedCommitForSlice(projectRoot, sliceId) {
+    const grep = `^${escapeRegex(sliceId)}/`;
+    const { stdout } = await execFileAsync("git", ["log", "--format=%s%n%b", "--grep", grep], { cwd: projectRoot });
+    return stdout.trim().length > 0;
+}
 export async function validateTddVerificationEvidence(projectRoot, evidence, options = {}) {
     const normalized = evidence.trim();
-    const mode = "auto";
+    const config = await readConfig(projectRoot).catch(() => null);
+    const commitMode = resolveTddCommitMode(config);
+    const mode = commitMode === "off" ? "disabled" : "auto";
     const gitPresent = await exists(path.join(projectRoot, ".git"));
     const issues = [];
     if (options.requireCommand !== false && !TEST_COMMAND_HINT_PATTERN.test(normalized)) {
@@ -16,16 +89,34 @@ export async function validateTddVerificationEvidence(projectRoot, evidence, opt
     if (options.requirePassStatus !== false && !PASS_STATUS_PATTERN.test(normalized)) {
         issues.push("GREEN repair needed: include explicit success status (for example `PASS` or `GREEN`).");
     }
-    const hasSha = SHA_WITH_LABEL_PATTERN.test(normalized);
-    const hasNoVcs = NO_VCS_ATTESTATION_PATTERN.test(normalized);
-    if (mode === "auto" && gitPresent && !hasSha) {
-        issues.push("must include a commit SHA token prefixed with `sha` or `commit` (for example `sha: abc1234`).");
-    }
-    else if (mode === "auto" && !gitPresent && !hasSha && !hasNoVcs) {
-        issues.push("must include either a commit SHA or an explicit no-VCS attestation (for example `no-vcs: project has no .git directory`).");
+    if (mode !== "disabled" && commitMode === "managed-per-slice" && gitPresent) {
+        const ledger = await readDelegationLedger(projectRoot).catch(() => null);
+        if (ledger && typeof ledger.runId === "string" && ledger.runId.length > 0) {
+            const closedSlices = collectClosedSlices(ledger.entries, ledger.runId);
+            const missing = [];
+            for (const sliceId of closedSlices) {
+                const hasCommit = await hasManagedCommitForSlice(projectRoot, sliceId).catch(() => false);
+                if (!hasCommit) {
+                    missing.push(sliceId);
+                }
+            }
+            if (missing.length > 0) {
+                issues.push(`managed-per-slice commit check failed: missing git commit(s) for closed slice(s): ${missing.join(", ")}.`);
+            }
+        }
     }
-    else if (mode === "auto" && !gitPresent && hasNoVcs && !NO_VCS_HASH_PATTERN.test(normalized)) {
-        issues.push("NO_VCS_MODE repair needed: include a content/artifact hash for no-VCS TDD evidence (for example `artifact-hash: sha256:<hash>`).");
+    else if (mode === "auto") {
+        const hasSha = SHA_WITH_LABEL_PATTERN.test(normalized);
+        const hasNoVcs = NO_VCS_ATTESTATION_PATTERN.test(normalized);
+        if (gitPresent && !hasSha) {
+            issues.push("must include a commit SHA token prefixed with `sha` or `commit` (for example `sha: abc1234`).");
+        }
+        else if (!gitPresent && !hasSha && !hasNoVcs) {
+            issues.push("must include either a commit SHA or an explicit no-VCS attestation (for example `no-vcs: project has no .git directory`).");
+        }
+        else if (!gitPresent && hasNoVcs && !NO_VCS_HASH_PATTERN.test(normalized)) {
+            issues.push("NO_VCS_MODE repair needed: include a content/artifact hash for no-VCS TDD evidence (for example `artifact-hash: sha256:<hash>`).");
+        }
     }
     return { ok: issues.length === 0, issues, mode, gitPresent };
 }

package/dist/types.d.ts

@@ -161,10 +161,22 @@ export interface ReviewLoopConfig {
     externalSecondOpinion?: ReviewLoopExternalSecondOpinionConfig;
 }
 export type VcsMode = "git-with-remote" | "git-local-only" | "none";
+export type TddCommitMode = "managed-per-slice" | "agent-required" | "checkpoint-only" | "off";
+export interface TddConfig {
+    /**
+     * Commit ownership model for closed TDD slices.
+     * - managed-per-slice: cclaw-generated hook performs one commit per closed slice.
+     * - agent-required: worker/controller must create the commit outside cclaw.
+     * - checkpoint-only: coarse-grained checkpoints are allowed (no per-slice enforcement).
+     * - off: skip commit-shape enforcement.
+     */
+    commitMode?: TddCommitMode;
+}
 export interface CclawConfig {
     version: string;
     flowVersion: string;
     harnesses: HarnessId[];
+    tdd?: TddConfig;
 }
 export interface TransitionRule {
     from: FlowStage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cclaw-cli",
-  "version": "7.0.6",
+  "version": "7.1.0",
   "description": "Installer-first flow toolkit for coding agents",
   "type": "module",
   "bin": {