changeledger 0.8.0 → 0.10.0

package/src/viewer/public/view-renderers.js

@@ -1,8 +1,49 @@
 import { cssIdent } from './security.js';
 import { html, nothing, svg } from './templates.js';
+import { splitGraduationHistory } from './view-parts.js';
 
 const clip = (s, n) => (s.length > n ? `${s.slice(0, n - 1)}…` : s);
 
+// Plain-text excerpt for spec cards: strips the leading graduation-history
+// blockquote, picks the first prose paragraph (skipping headings, remaining
+// blockquotes and code fences) and removes inline Markdown syntax. The result
+// is interpolated as text (lit-html), never as HTML.
+function firstProseParagraph(text) {
+  const paragraphs = String(text ?? '').split(/\n\s*\n/);
+  for (const para of paragraphs) {
+    const trimmed = para.trim();
+    if (!trimmed) continue;
+    if (/^#{1,6}\s/.test(trimmed)) continue;
+    if (/^>/.test(trimmed)) continue;
+    if (/^```/.test(trimmed)) continue;
+    return trimmed;
+  }
+  return '';
+}
+
+function stripMarkdown(text) {
+  return text
+    .replace(/`([^`]*)`/g, '$1')
+    .replace(/\*\*([^*]+)\*\*/g, '$1')
+    .replace(/__([^_]+)__/g, '$1')
+    .replace(/\*([^*]+)\*/g, '$1')
+    .replace(/_([^_]+)_/g, '$1')
+    .replace(/\[([^\]]*)\]\([^)]*\)/g, '$1')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+export function specExcerpt(body, maxLen = 160) {
+  const { after } = splitGraduationHistory(body);
+  return clip(stripMarkdown(firstProseParagraph(after)), maxLen);
+}
+
+// Most recently updated truth first.
+export function sortSpecsByUpdated(specs) {
+  const time = (s) => Date.parse(s?.updated || '') || 0;
+  return [...specs].sort((a, b) => time(b) - time(a));
+}
+
 export function graphSvg(changes) {
   if (!changes.length) {
     return html`<p class="empty">No changes match the current filters.</p>`;
@@ -79,17 +120,19 @@ export function graphSvg(changes) {
 }
 
 export function specsListHtml(specs, fmtDateTime) {
-  return specs.length
-    ? specs.map(
-        (s, i) => html`<div class="spec-card" data-i=${i}>
-          <div class="spec-title">${s.title}</div>
-          <div class="card-meta">
-            <span title=${s.updated || ''}>${fmtDateTime(s.updated)}</span>
-            ${(s.tags || []).map((t) => html`<span class="pill">${t}</span>`)}
-          </div>
-        </div>`,
-      )
-    : html`<p class="empty">No specs yet. Truth graduates here as changes complete.</p>`;
+  if (!specs.length) {
+    return html`<p class="empty">No specs yet. Truth graduates here as changes complete.</p>`;
+  }
+  return sortSpecsByUpdated(specs).map(
+    (s, i) => html`<div class="spec-card" data-i=${i}>
+      <div class="spec-title">${s.title}</div>
+      <div class="card-meta">
+        <span title=${s.updated || ''}>${fmtDateTime(s.updated)}</span>
+        ${(s.tags || []).map((t) => html`<span class="pill">${t}</span>`)}
+      </div>
+      <p class="spec-excerpt">${specExcerpt(s.body)}</p>
+    </div>`,
+  );
 }
 
 export function fmtDuration(ms) {
@@ -111,15 +154,86 @@ function barRows(items, label, value, fmt = (v) => v) {
   );
 }
 
-export function metricsHtml(metrics = {}) {
+// Hand-rolled SVG bar chart for throughput: one bar per day, a date label and
+// the numeric count both drawn as text so the value is visible without a
+// tooltip (no charting dependency — same precedent as `graphSvg`).
+function throughputSvg(tp) {
+  if (!tp.length) return html`<p class="empty">No closed changes yet.</p>`;
+
+  const width = 640;
+  const height = 180;
+  const padTop = 22;
+  const padBottom = 30;
+  const padSide = 12;
+  const plotWidth = Math.max(1, width - padSide * 2);
+  const plotHeight = Math.max(1, height - padTop - padBottom);
+  const max = Math.max(1, ...tp.map((t) => t.count));
+  const slot = plotWidth / tp.length;
+  const barWidth = Math.max(2, Math.min(48, slot - 8));
+
+  const bars = tp.map((t, i) => {
+    const barHeight = (t.count / max) * plotHeight;
+    const x = padSide + i * slot + (slot - barWidth) / 2;
+    const y = height - padBottom - barHeight;
+    return svg`<g class="tp-bar">
+        <rect class="tp-rect" x=${x} y=${y} width=${barWidth} height=${barHeight}></rect>
+        <text class="tp-value" x=${x + barWidth / 2} y=${Math.max(12, y - 6)} text-anchor="middle">${t.count}</text>
+        <text class="tp-date" x=${x + barWidth / 2} y=${height - padBottom + 16} text-anchor="middle">${t.date}</text>
+      </g>`;
+  });
+
+  return html`<svg
+    class="throughput-svg"
+    viewBox=${`0 0 ${width} ${height}`}
+    height=${height}
+    role="img"
+    aria-label="Throughput per day"
+  >
+    <line
+      class="tp-axis"
+      x1=${padSide}
+      y1=${height - padBottom}
+      x2=${width - padSide}
+      y2=${height - padBottom}
+    ></line>
+    ${bars}
+  </svg>`;
+}
+
+function metricsTable(rows, columnLabel, labelOf) {
+  return rows.length
+    ? html`<table class="grid">
+        <thead>
+          <tr><th>${columnLabel}</th><th>Closed</th><th>Avg cycle</th></tr>
+        </thead>
+        <tbody>
+          ${rows.map(
+            (r) => html`<tr>
+              <td>${labelOf(r)}</td>
+              <td class="mono">${r.closed}</td>
+              <td class="mono">${fmtDuration(r.avgCycleMs)}</td>
+            </tr>`,
+          )}
+        </tbody>
+      </table>`
+    : html`<p class="empty">No closed changes yet.</p>`;
+}
+
+export function metricsHtml(metrics = {}, totalChanges = 0) {
+  if (!totalChanges) {
+    return html`<p class="empty">No changes match the current filters.</p>`;
+  }
+
   const wip = metrics.wip || {};
   const wipTotal = Object.values(wip).reduce((a, b) => a + b, 0);
   const cards = [
     ['Closed', metrics.count ?? 0],
-    ['Avg cycle', fmtDuration(metrics.avgCycleMs)],
-    ['Median cycle', fmtDuration(metrics.medianCycleMs)],
+    ['Cycle p50', fmtDuration(metrics.p50CycleMs)],
+    ['Cycle p85', fmtDuration(metrics.p85CycleMs)],
     ['WIP', wipTotal],
     ['Blocked time', fmtDuration(metrics.blockedMs)],
+    ['Validation wait', fmtDuration(metrics.validationWaitMs)],
+    ['Review retries', metrics.reviewRetries ?? 0],
   ].map(
     ([label, val]) =>
       html`<div class="metric-card">
@@ -140,15 +254,6 @@ export function metricsHtml(metrics = {}) {
       )
     : html`<p class="empty">No data yet.</p>`;
 
-  const tp = metrics.throughput || [];
-  const tpBars = tp.length
-    ? barRows(
-        tp,
-        (t) => html`<span class="mono">${t.date}</span>`,
-        (t) => t.count,
-      )
-    : html`<p class="empty">No closed changes yet.</p>`;
-
   const aging = metrics.aging || [];
   const agingRows = aging.length
     ? html`<ul class="git-commits">
@@ -160,32 +265,39 @@ export function metricsHtml(metrics = {}) {
     : html`<p class="empty">Nothing in progress.</p>`;
 
   const byType = metrics.byType || [];
-  const typeRows = byType.length
-    ? html`<table class="grid">
-        <thead>
-          <tr><th>Type</th><th>Closed</th><th>Avg cycle</th></tr>
-        </thead>
-        <tbody>
-          ${byType.map(
-            (t) => html`<tr>
-              <td><span class="type-tag" style=${`--type-color: var(--${cssIdent(t.type)})`}>${t.type}</span></td>
-              <td class="mono">${t.closed}</td>
-              <td class="mono">${fmtDuration(t.avgCycleMs)}</td>
-            </tr>`,
-          )}
-        </tbody>
-      </table>`
-    : html`<p class="empty">No closed changes yet.</p>`;
+  const typeRows = metricsTable(
+    byType,
+    'Type',
+    (t) =>
+      html`<span class="type-tag" style=${`--type-color: var(--${cssIdent(t.type)})`}>${t.type}</span>`,
+  );
+
+  const byOwner = metrics.byOwner || [];
+  const ownerRows = metricsTable(byOwner, 'Owner', (o) =>
+    o.owner === 'unassigned' ? html`<span class="muted">Unassigned</span>` : o.owner,
+  );
 
   return html`
     <div class="metrics-cards">${cards}</div>
-    ${wipChips.length ? html`<div class="detail-meta">${wipChips}</div>` : nothing}
-    <h3 class="metrics-h">Avg time in status (lead time per stage)</h3>
-    <div>${leadBars}</div>
-    <h3 class="metrics-h">Throughput (closed per day)</h3>
-    <div>${tpBars}</div>
-    <h3 class="metrics-h">Aging — in progress</h3>
-    ${agingRows}
-    <h3 class="metrics-h">By type</h3>
-    ${typeRows}`;
+    <div class="metrics-grid">
+      <section class="metrics-panel">
+        <h3 class="metrics-h">Throughput (closed per day)</h3>
+        ${throughputSvg(metrics.throughput || [])}
+      </section>
+      <section class="metrics-panel">
+        <h3 class="metrics-h">Avg time in status (lead time per stage)</h3>
+        <div>${leadBars}</div>
+      </section>
+      <section class="metrics-panel">
+        <h3 class="metrics-h">Aging — in progress</h3>
+        ${wipChips.length ? html`<div class="detail-meta">${wipChips}</div>` : nothing}
+        ${agingRows}
+      </section>
+      <section class="metrics-panel">
+        <h3 class="metrics-h">By type</h3>
+        ${typeRows}
+        <h3 class="metrics-h">By owner</h3>
+        ${ownerRows}
+      </section>
+    </div>`;
 }

package/src/viewer/server/router.mjs

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { gitRefs } from '../../git.mjs';
-import { publicDir } from '../../paths.mjs';
+import { packageRoot, publicDir } from '../../paths.mjs';
 import { loadRepoAsync } from '../../repo.mjs';
 import {
   applyConfigMigration,
@@ -49,10 +49,21 @@ function vendorFile(route) {
 const MIME = {
   '.html': 'text/html; charset=utf-8',
   '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
   '.css': 'text/css; charset=utf-8',
   '.json': 'application/json; charset=utf-8',
 };
 
+// The pure metrics module is shared verbatim between the CLI and the browser:
+// the client dynamic-imports it so filtered metrics reuse the exact same
+// computation as the server payload (no reimplementation). `lifecycle.mjs` is
+// its only relative import, so both must be reachable under the same route
+// prefix for the browser's module resolution to find it. Neither file is
+// under `publicDir`; this is a narrow, explicit allowlist rather than opening
+// up the rest of `src/` the way `publicDir` static assets are.
+const SHARED_MODULES_DIR = path.join(packageRoot, 'src');
+const SHARED_MODULES = new Set(['metrics.mjs', 'lifecycle.mjs']);
+
 // Defensive headers for a local-only UI: never sniff types, never cache, and
 // forbid embedding in a frame (clickjacking).
 const SECURITY_HEADERS = {
@@ -215,6 +226,13 @@ export function createRequestListener(cwd, localOnly, token) {
         return;
       }
 
+      if (route.startsWith('/shared/')) {
+        const shared = sharedModuleFile(route);
+        if (shared) send(res, 200, MIME['.mjs'], fs.readFileSync(shared));
+        else send(res, 404, 'text/plain', 'Not found');
+        return;
+      }
+
       const vendor = vendorFile(route);
       if (vendor) {
         if (fs.existsSync(vendor)) send(res, 200, MIME['.js'], fs.readFileSync(vendor));
@@ -239,7 +257,10 @@ export function createRequestListener(cwd, localOnly, token) {
   };
 }
 
-export function staticFile(route) {
+// Resolves `route` to a file under `root`, refusing anything that decodes,
+// resolves, or (post-symlink) realpaths outside of it. Shared by the public
+// static assets and the narrower shared-module allowlist below.
+function assetFile(root, route) {
   let decoded;
   try {
     decoded = decodeURIComponent(route);
@@ -249,16 +270,29 @@ export function staticFile(route) {
   if (decoded.includes('\0')) return null;
 
   const rel = decoded.replace(/^\/+/, '');
-  const file = path.resolve(publicDir, rel);
-  if (!isInsidePath(publicDir, file)) return null;
+  const file = path.resolve(root, rel);
+  if (!isInsidePath(root, file)) return null;
   if (!fs.existsSync(file) || !fs.statSync(file).isFile()) return null;
 
-  const realPublic = fs.realpathSync(publicDir);
+  const realRoot = fs.realpathSync(root);
   const realFile = fs.realpathSync(file);
-  if (!isInsidePath(realPublic, realFile)) return null;
+  if (!isInsidePath(realRoot, realFile)) return null;
   return file;
 }
 
+export function staticFile(route) {
+  return assetFile(publicDir, route);
+}
+
+// Serves only the whitelisted shared modules — never arbitrary files under
+// `src/` — even though containment is checked the same way as public assets.
+export function sharedModuleFile(route) {
+  if (!route.startsWith('/shared/')) return null;
+  const name = route.slice('/shared/'.length);
+  if (!SHARED_MODULES.has(name)) return null;
+  return assetFile(SHARED_MODULES_DIR, `/${name}`);
+}
+
 function isInsidePath(root, target) {
   const rel = path.relative(path.resolve(root), path.resolve(target));
   return rel === '' || (rel && !rel.startsWith('..') && !path.isAbsolute(rel));

package/templates/config.yml

@@ -3,7 +3,7 @@
 
 # Schema version — used to detect and migrate outdated configurations.
 # Run `changeledger config migrate --dry-run` to inspect available migrations.
-schema_version: 1
+schema_version: 2
 
 # Language for generated documentation CONTENT. Structure (headings, keys, enums)
 # is always English. See `changeledger context spec`.
@@ -23,6 +23,7 @@ release:
     audit: none
     refactor: none
     chore: none
+    quick: patch
 
 # Optional Definition of Ready path/command hints. When present, tasks that
 # reference CRs should name at least one target and one verification matching
@@ -58,3 +59,8 @@ types:
     review_required: true
   chore:
     stages: [request, plan]
+  # Small, reversible, single-concern work with no persistent-truth or public
+  # surface impact. If scope grows mid-execution, discard and recreate under
+  # the correct type — see `changeledger context spec`.
+  quick:
+    stages: [request, log]

package/templates/contract/agent-contexts/audit.md

@@ -0,0 +1,22 @@
+# Read-Only Audit Delegate
+
+This is a self-contained delegated context. It replaces the ChangeLedger core
+for this role; do not run `changeledger context` or load another ChangeLedger
+context.
+
+This is a post-review inspection of a change already sitting in
+`in-validation`, waiting for human acceptance. The review gate already ran;
+you do not repeat it and you do not move the change. This role is read-only:
+do not modify files, do not change Git state, do not mutate the ledger, do not
+change status, do not add Log entries, and do not delegate any part of the
+work.
+
+Inspect the selected change, every `CRn`, the actual diff, tests and Git
+history against what the document claims. Contrast criteria, code and
+evidence; note any drift, residue or unresolved risk.
+
+Return findings and evidence only — file:line references, what you confirmed,
+what you could not confirm. Do not decide or state whether the change should
+be accepted, sent back or blocked, and do not name or suggest a lifecycle
+command: that decision belongs to the human waiting at `in-validation`, not to
+this role.

package/templates/contract/agent-contexts/implementation.md

@@ -0,0 +1,18 @@
+# Implementation Delegate
+
+This is a self-contained delegated context. It replaces the ChangeLedger core
+for this role; do not run `changeledger context` or load another ChangeLedger
+context.
+
+Implement only the bounded assignment in the delegation prompt and follow the
+selected change's Specification and Plan exactly. With `tdd=on`, write the
+failing test for each assigned criterion, make it pass, then refactor.
+
+Modify only the files assigned in the delegation prompt. You share the worktree:
+do not revert or overwrite others' work; stop and report any overlap instead of
+resolving it silently. Do not change Git state, mutate the ledger or delegate
+any part of the work. Lifecycle, tasks, Log, review and integration remain the
+orchestrator's responsibility.
+
+Return the files changed, criteria covered, tests run and their results, plus
+any overlap or uncertainty. The orchestrator integrates and records the work.

package/templates/contract/agent-contexts/investigation.md

@@ -0,0 +1,14 @@
+# Investigation Delegate
+
+This is a self-contained delegated context. It replaces the ChangeLedger core
+for this role; do not run `changeledger context` or load another ChangeLedger
+context.
+
+Answer only the investigation question and ownership boundary in the delegation
+prompt. This role is read-only: do not modify files, Git state or the ledger, and
+do not delegate any part of the work.
+
+Inspect the smallest useful surface. Return concrete findings and evidence such
+as file:line references, constraints, risks and a root-cause statement when
+applicable. State what could not be determined. Do not implement fixes or create
+ChangeLedger artifacts.

package/templates/contract/agent-contexts/review.md

@@ -0,0 +1,22 @@
+# Independent Review Delegate
+
+This is a self-contained delegated context. It replaces the ChangeLedger core
+for this role; do not run `changeledger context` or load another ChangeLedger
+context.
+
+Review with clean context and do not trust the implementer's summary. This role
+is read-only: do not modify files, Git state or the ledger, do not record the
+verdict, and do not delegate any part of the work.
+
+Inspect the selected change, every `CRn`, every Plan task, tests, the actual diff
+and absence of TODO/FIXME, dead code or unrelated residue. Confirm tasks are
+true rather than merely checked off and that implementation did not drift from
+the authorized document.
+
+Deep security, SAST and lint belong to dedicated tools. You may run them
+read-only and report their evidence; ChangeLedger does not reimplement them.
+
+Return per-criterion PASS/FAIL evidence and one recommended outcome: pass,
+fail-retry with a reason for a fixable defect inside scope, or fail-block with a
+reason when correction needs scope or product judgment. The orchestrator alone
+records the verdict.

package/templates/contract/agent-prompts/audit.md

@@ -0,0 +1,37 @@
+# Delegation skeleton — role: audit
+
+Fill every `{{placeholder}}` before handing this prompt to the subagent. Delete
+guidance in parentheses. The auditor is a read-only inspection of a change
+already sitting in `in-validation`, waiting for human acceptance; it is not a
+review and never moves the change.
+
+---
+
+You are a READ-ONLY AUDIT delegate. Do not delegate any part of this to
+another agent; execute it yourself.
+
+Why this is delegated: {{reason}} (independent inspection after review already
+passed and the change is waiting for a human at `in-validation`).
+
+Your prompt identifies you as a ChangeLedger delegate. As your only
+ChangeLedger load, run `changeledger agent-context audit {{change_id}}` and
+read it through its END sentinel; do not load the orchestrator core.
+
+Change under audit: {{change_id}}.
+
+Boundaries — expressed by effect, not by tool name: do not modify any file, do
+not change Git state, and do not mutate the ledger. You inspect and report
+only; the review gate already ran, so do not issue a verdict and do not name
+or suggest a lifecycle command.
+
+Expected output: {{expected_output}} (findings and evidence — file:line
+references, what was confirmed, what could not be, and any drift or residue).
+
+Difficulty or risk that set the model choice: {{difficulty_or_risk}}.
+
+Return to the orchestrator or the human waiting at `in-validation` the
+findings and evidence above; you never move the change.
+
+Integration criterion: {{integration}} (how the orchestrator or human uses the
+findings, e.g. it informs the human's accept/reject decision at
+`in-validation`).

package/templates/contract/agent-prompts/implementation.md

@@ -0,0 +1,42 @@
+# Delegation skeleton — role: implementation
+
+Fill every `{{placeholder}}` before handing this prompt to the subagent. Delete
+guidance in parentheses. The delegate writes code within a bounded ownership; the
+orchestrator keeps the ledger and integration.
+
+---
+
+You are an IMPLEMENTATION delegate. Do not delegate any part of this to another
+agent; execute it yourself.
+
+Why this is delegated: {{reason}} (why a separate agent, e.g. a disjoint write
+set that parallelizes safely, a sufficient cheaper model for well-specified
+execution).
+
+Your prompt identifies you as a ChangeLedger delegate. As your only ChangeLedger
+load, run `changeledger agent-context implementation {{change_id}}` and read it
+through its END sentinel; do not load the orchestrator core. It supplies the
+selected change with its acceptance criteria and Plan.
+
+If that command does not resolve the change, or the working tree does not
+contain its document, stop and report instead of proceeding: never reconstruct
+the change from memory, and never continue from another base.
+
+Files you own: {{files}} (the only paths you may modify).
+
+Boundaries — expressed by effect, not by tool name: modify only the files under
+your ownership above; do not revert or overwrite anyone else's work; if you find
+your change overlaps another change's surface, stop and report it instead of
+resolving it silently. Do not mutate the ledger — status, task, log, review and
+graduation transitions are the orchestrator's; you implement and report.
+
+Expected output: {{expected_output}} (the code plus the tests that prove the
+cited criteria, red-green; state which criteria you covered).
+
+Difficulty or risk that set the model choice: {{difficulty_or_risk}}.
+
+Return to the orchestrator only what changed and how it was verified — the files
+touched, the tests run and their result, and any overlap you hit.
+
+Integration criterion: {{integration}} (how the orchestrator merges/verifies your
+work, e.g. it re-runs the full gate and records the ledger transitions).

package/templates/contract/agent-prompts/investigation.md

@@ -0,0 +1,41 @@
+# Delegation skeleton — role: investigation
+
+Fill every `{{placeholder}}` before handing this prompt to the subagent. Delete
+guidance in parentheses. This is a read-only inquiry: the delegate answers a
+question, it does not change anything.
+
+---
+
+You are an INVESTIGATION delegate. Do not delegate any part of this to another
+agent; execute it yourself.
+
+Why this is delegated: {{reason}} (why a separate agent, e.g. protect main
+context, parallelize an independent question, bring a stronger model to hard
+analysis).
+
+Question you own: {{question}} (the single question or area to investigate;
+state it concretely).
+
+Your prompt identifies you as a ChangeLedger delegate. As your only ChangeLedger
+load, run `changeledger agent-context investigation {{change_id}}` and read it
+through its END sentinel; do not load the orchestrator core. There may be no
+change yet: work without a change id. If the optional id below is empty, omit it
+from the command.
+
+Optional selected change: {{change_id}} (leave empty when investigating before a
+change exists).
+
+Boundaries — expressed by effect, not by tool name: do not modify any file, do
+not change Git state, and do not mutate the ledger (no status, task, log, review
+or graduation). Inspect and read only.
+
+Expected output: {{expected_output}} (what the answer must contain, e.g. a
+file:line map, a root-cause statement, a constraints/risks list).
+
+Difficulty or risk that set the model choice: {{difficulty_or_risk}}.
+
+Return to the orchestrator only findings/data — no narrative, no fixes. State
+clearly what you could not determine.
+
+Integration criterion: {{integration}} (how the orchestrator will use the answer,
+e.g. it feeds the Investigation stage of the change).

package/templates/contract/agent-prompts/review.md

@@ -0,0 +1,36 @@
+# Delegation skeleton — role: review
+
+Fill every `{{placeholder}}` before handing this prompt to the subagent. Delete
+guidance in parentheses. The reviewer is a fresh, clean-context, read-only check;
+the orchestrator alone records the verdict.
+
+---
+
+You are an INDEPENDENT REVIEW delegate with clean context. Do not delegate any
+part of this to another agent; execute it yourself.
+
+Why this is delegated: {{reason}} (independence is a correctness requirement, not
+an optimization — a fresh reviewer that does not trust the implementer's summary).
+
+Your prompt identifies you as a ChangeLedger delegate. As your only ChangeLedger
+load, run `changeledger agent-context review {{change_id}}` and read it through
+its END sentinel; do not load the orchestrator core. Use the inspection
+checklist that agent-context gives you.
+
+Change under review: {{change_id}}.
+
+Boundaries — expressed by effect, not by tool name: do not modify any file, do
+not change Git state, and do not mutate the ledger. You inspect and report only;
+you never record the verdict — the orchestrator does that.
+
+Expected output: {{expected_output}} (per-criterion PASS/FAIL with concrete
+evidence, plus any drift or residue found).
+
+Difficulty or risk that set the model choice: {{difficulty_or_risk}}.
+
+Return to the orchestrator a single recommended verdict — one of pass, fail-retry
+with a reason, or fail-block with a reason — with the evidence behind it. The
+orchestrator records it.
+
+Integration criterion: {{integration}} (how the orchestrator acts on the verdict,
+e.g. it records pass and moves the change to in-validation).

package/templates/contract/budgets.yml

@@ -0,0 +1,16 @@
+{
+  "base": {
+    "core": { "target": { "lines": 125, "bytes": 7500 }, "hard": { "lines": 140, "bytes": 9000 } },
+    "spec": { "target": { "lines": 280, "bytes": 12000 }, "hard": { "lines": 310, "bytes": 13500 } },
+    "implement": { "target": { "lines": 185, "bytes": 8500 }, "hard": { "lines": 205, "bytes": 10000 } },
+    "review": { "target": { "lines": 70, "bytes": 3500 }, "hard": { "lines": 85, "bytes": 4500 } },
+    "release": { "target": { "lines": 45, "bytes": 2500 }, "hard": { "lines": 60, "bytes": 3500 } }
+  },
+  "agent": { "target": { "lines": 45, "bytes": 2000 }, "hard": { "lines": 60, "bytes": 3000 } }
+  ,"overlays": {
+    "blocked": { "target": { "lines": 70, "bytes": 3000 }, "hard": { "lines": 84, "bytes": 3600 } },
+    "in-validation": { "target": { "lines": 45, "bytes": 1700 }, "hard": { "lines": 54, "bytes": 2040 } },
+    "done": { "target": { "lines": 90, "bytes": 3500 }, "hard": { "lines": 108, "bytes": 4200 } },
+    "discarded": { "target": { "lines": 40, "bytes": 1300 }, "hard": { "lines": 48, "bytes": 1560 } }
+  }
+}