claude-company 0.2.3 → 0.2.5

package/company/witnesses.json

@@ -244,7 +244,34 @@
       "regex": false,
       "why": "Bare builtin-spawn BLOCK path - regression means built-in spawns silently inherit the session model (the live incident)",
       "added_at": "2026-07-22T15:24:05Z"
+    },
+    {
+      "id": "W-029",
+      "task": "spawn-depth-shipping",
+      "file": ".claude/settings.json",
+      "must_contain": "CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH",
+      "regex": false,
+      "why": "Auto-update-era guard: template must ship spawn depth 2 or every install silently flattens to depth 1 on the next Claude Code",
+      "added_at": "2026-07-22T18:50:20Z"
+    },
+    {
+      "id": "W-030",
+      "task": "test-infra-fixes",
+      "file": "tests/hooks/run_tests.sh",
+      "must_contain": "unittest discover",
+      "regex": false,
+      "why": "CI calls this runner; reverting to a direct exec silently drops CI from 224 hook tests back to 103 with no other symptom",
+      "added_at": "2026-07-26T17:30:00Z"
+    },
+    {
+      "id": "W-031",
+      "task": "test-infra-fixes",
+      "file": "tests/cli/test_cli.sh",
+      "must_contain": "--json --silent",
+      "regex": false,
+      "why": "Without --silent the npm prepare banner corrupts the pack JSON and all 10 pack-manifest assertions die as false MISSING, turning the local gate red",
+      "added_at": "2026-07-26T17:30:00Z"
     }
   ],
-  "checksum": "5789e76d6242c45d3e82f0ca3da8895c3e19753e2b88100fe8a44e6f38b6615f"
+  "checksum": "a2bf1d5ece833826945887fde2d32814011ffa242c6916cd31fa05cfab5c3d17"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-company",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "An AI software company you drop into your repo - hierarchical, hard-gated SDLC for Claude Code",
   "license": "MIT",
   "author": "redomic",
@@ -20,7 +20,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/devmesh-in/claude-company.git"
+    "url": "https://github.com/devmesh-in/claude-company"
   },
   "homepage": "https://github.com/devmesh-in/claude-company",
   "scripts": {
@@ -44,6 +44,7 @@
     "!company/specs/**",
     "!company/briefs/**",
     "!company/change-requests/**",
+    "!company/state/**",
     "docs/",
     "LICENSE",
     "README.md"

package/company/state/DECISIONS.md

@@ -1,22 +0,0 @@
-# DECISIONS - owner escalations and outcomes
-
-_Questions only the owner may answer (money, invariants, deploys, scope,
-business policy), with what was decided and when. Agents run on tagged
-fallbacks until a row lands here._
-
-| # | Date | Question | Decision | Affects |
-|---|---|---|---|---|
-| 1 | 2026-07-09 | Adopt model tiering (developer/QA to sonnet)? | VETOED - every role stays opus | models.json |
-| 2 | 2026-07-09 | Program scope from the framework research | Hard-gate-fitting features only; lessons loop + loop workers DEFERRED | program plan |
-| 3 | 2026-07-10 | Adoption program delivery (waves 1-3, PRs 27/33/34/32/35) | ACCEPTED - owner authorized end-to-end merge; CEO merged and verified integrated main | whole repo |
-| 4 | 2026-07-10 | delegation-enforcement delivery (5 layers + tracking gate, PR #49, issues #42-#47) | ACCEPTED - owner: "merge everything and close out"; merged f9e5dae, integrated main verified (213+31 green), witnesses W-011..W-013 | hooks, doctrine, settings |
-| 5 | 2026-07-10 | Enforcement design direction | Owner REJECTED budgets/role bans twice; approved principle-derived gates (mechanism 5 + written-record consistency) and demanded low-token injection + GitHub tracking gate | all future gate design |
-| 6 | 2026-07-15 | cli-update delivery (update subcommand + provenance manifest, PR #57, issues #54-#56) | ACCEPTED - owner: "test it, the merge it to main"; CEO re-tested end-to-end (edit kept, .new written, deleted file restored, config untouched), merged 7726c99, integrated main verified (213 hooks + 40 CLI + 56 engine green), witnesses W-014..W-016 | CLI, installer, frozen registry |
-| 7 | 2026-07-15 | cli-self-update delivery (update refreshes the CLI first via npx handoff, PR #60, issue #59) | ACCEPTED - owner: "push to main, then to npm"; merged a09b463, integrated main verified (213 + 57 green), witnesses W-017..W-018 | CLI driver |
-| 8 | 2026-07-15 | Release v0.2.0 to npm (tag v0.2.0 at 5913374; notes: PR #57/#60 bodies) | PUBLISHED 2026-07-15 by the OWNER manually from the clean tag clone (link-based npm 2FA - publishes are always owner-manual or git-CI, never agent-run). Registry verified: dist-tags.latest 0.2.0. Semver minor | npm registry |
-| 9 | 2026-07-15 | DevMesh migration (owner: "use claude-company on this WITHOUT breaking custom changes... preserve DevMesh specific context") | DELIVERED - umbrella root git-initialized (machinery only), primitive company ported to company/, all customizations preserved, stale docs archived (nothing deleted). Verification: invariants gate PASS, 6 frozen surfaces probe-blocked. Found+fixed upstream #67/#68 | DevMesh polyrepo |
-| 10 | 2026-07-15 | Release v0.2.1 to npm (patch: #64 enforcer arming, #67 merger fix + field-heal, #68 record-leak) | PREPPED by CEO (bump PR + tag on merge); publish is the owner's button per standing rule (link-based 2FA). SUPERSEDED by v0.2.2 (#12) before publish - registry never received 0.2.1 | npm registry |
-| 11 | 2026-07-22 | model-routing-arming delivery (builtins enforcement + wiring gate + migration + Workflow doctrine, PR #77, issues #74-#76) | ACCEPTED - owner: "merge everything and give command to push to npm"; CEO merged cd07fb6, integrated main verified (hooks 222 + npm 61 + engine 111 green, gates stamped), live enforcement certified (contradict/bare exit 2, match 0, dormancy probe red), witnesses W-026/W-027/W-028 | hooks, models.json, installer, doctrine |
-| 12 | 2026-07-22 | Release v0.2.2 to npm (rolls up unpublished 0.2.1 + #77 model-routing arming) | PREPPED by CEO; owner pushed tag v0.2.2 (at ad3dda8) but publish SUPERSEDED by v0.2.3 (#14) which adds #83 - registry goes 0.2.0 -> 0.2.3 directly | npm registry |
-| 13 | 2026-07-23 | spawn-depth-shipping delivery (CC 2.1.21 depth-1 flattening; template env + installer env merge + guards, PR #83, issues #79-#82) | ACCEPTED - owner: "merge it"; merged 6061814, CEO independent verification (224/61/123 green, merge probes, byte-identity), witness W-029 | template settings, installer, tests |
-| 14 | 2026-07-23 | Release v0.2.3 to npm (v0.2.2 content + #83 spawn-depth) | PREPPED by CEO per owner direction ("change to v0.2.3"); owner tags v0.2.3 at the release-PR merge commit and publishes from a clean tag clone (link-based 2FA, owner-manual); notes: PR #77/#83 bodies | npm registry |

package/company/state/RESUME.md

@@ -1,156 +0,0 @@
-# RESUME / HANDOFF - read this first
-
-_The restart point. Sessions die; work must not. The CEO updates this after
-every spawn, merge, CR decision, and agent report. If a session died mid-flight,
-check each worktree's git log before respawning - work may be complete on disk
-without a report._
-
-## 1. Program state at handoff
-
-Adoption program SHIPPED 2026-07-10. Merged: #27 (wave 1), #33 (wave 2 enforce, ex-#29), #34 (wave 2 doctrine,
-ex-#30), #32 (wave 3), #35 (close-out). Integrated main verified: 147 hook
-tests + 31 CLI green, witness registry 9/9, gates_detect proposes
-witnesses/models/tests/audit. Owner acceptance recorded (DECISIONS #3).
-
-## 2. Next actions, in order
-
-000. model-routing-arming SHIPPED 2026-07-22 (PR #77 merged cd07fb6,
-   closes #74-#76; acceptance DECISIONS #11; witnesses W-026 wiring
-   assertion / W-027 merge byte-identity / W-028 bare-builtin block).
-   Integrated main verified by CEO: hooks 222 OK, npm 61, update
-   engine 111, --check 0, trace 21/21 after citation fix, live
-   certification (contradict/bare exit 2, match 0; dormancy probe:
-   Task|Agent group stripped -> --check exit 1 + fix-it). Worktree
-   and task branch removed; brief+spec archived to shipped/.
-   RELEASE 0.2.2 PREPPED (task release-0.2.2-closeout, quick): rolls
-   up unpublished 0.2.1 + #77. Release PR carries version bump,
-   trace-citation fix (test-side FR/BR citations + new
-   test_template_and_doctrine_shipped covering FR-MRA-01/11/12),
-   paperwork archive, DECISIONS #11/#12, board sync. AWAITING OWNER:
-   merge release PR if session dies before merge, then tag v0.2.2 at
-   its merge commit and publish from a clean tag clone (memory:
-   npm-publish-owner-only; registry still on 0.2.0). Near-miss worth
-   remembering: a .format arg mismatch made the wrong-override path
-   fail OPEN until the live replay caught it - pinned by
-   test_builtin_spawn_wrong_override_blocked.
-00. provenance-shipping SHIPPED 2026-07-15 (PR #65, d624cc3, closes #64;
-   witnesses W-019/W-020, 20/20): fresh installs now ship
-   company/provenance.json (enforcer armed by default); update NEVER
-   auto-arms, prints one notice line. Owner field audit found the gap.
-   PENDING OWNER BUTTON: 0.2.1 patch release to npm (0.2.0 on the
-   registry still has the gap - fresh 0.2.0 installs stay dormant).
-   Same flow as 0.2.0: bump PR, tag, owner publishes from clean tag
-   clone (memory: npm-publish-owner-only). Field guidance given: owner's
-   research repo stays disarmed until they create provenance.json after
-   Jul 28; gitignore data/ to stop stop_gate churn from training jobs.
-0. cli-update SHIPPED 2026-07-15: PR #57 merged (7726c99, closes #54-#56),
-   owner acceptance DECISIONS #6, witnesses W-014..W-016 recorded (16/16),
-   spec+brief archived to shipped/, worktree+branch removed, integrated main
-   verified (hooks 213 OK, npm 40, engine 56, gates stamped green).
-   Close-out PR from chore/cli-update-closeout in flight if session died -
-   check that branch before redoing. WORRIES has 3 rows from this task
-   (merge heredoc duplication P2, python3 spawn-per-file P3, fail-open
-   emission P3).
-0b. delegation-gate exploration DONE 2026-07-15: NOT an issue - md/json and
-   company//.claude//docs//.github/ paths are exempt via guard_spec.is_source
-   (proven by sandbox probes + field behavior). Two P3 edges in WORRIES
-   (extensionless files count as source; guard_tests gates md under tests/).
-0c. cli-self-update SHIPPED 2026-07-15: PR #60 merged (a09b463, closes
-   #59), acceptance DECISIONS #7, witnesses W-017..W-018 (18/18),
-   integrated main 213+57 green. Worktree+branch removed.
-0d. v0.2.0 PUBLISHED to npm 2026-07-15 (DECISIONS #8): tag v0.2.0 at
-   5913374, owner published manually from the clean tag clone. FIELD
-   LESSON (memory npm-publish-owner-only.md): owner npm 2FA is
-   LINK-BASED - no OTP codes exist; publishes are ALWAYS owner-manual or
-   git-CI, agent only prepares (bump PR, tag, clean tag clone, verified
-   placeholder gates.config). NEVER publish from the working checkout -
-   local gates.config wiring fails the placeholder test. Witnesses
-   W-017/18 landed via PR #62 (fab01e1). Candidate next: publish via CI
-   workflow (owner hinted "or through git ci"), #36, #37, tarball ships
-   repo board state (P3 hygiene, install never copies it), roadmap
-   #1-#11.
-1. delegation-enforcement SHIPPED 2026-07-10 (PR #49, f9e5dae, closes
-   #42-#47; acceptance DECISIONS #4). Close-out PR in flight if session
-   died mid-close: witnesses W-011..W-013 recorded, brief archived to
-   shipped/, active-task cleared - check chore/delegation-closeout branch
-   state before redoing.
-2. THE NEW GATES ARE LIVE ON MAIN. Every feature/program dispatch now
-   requires, in active-task.json BEFORE work: "issues": [...] (GitHub,
-   PR mode) and "execution": "delegated"|"self" + "execution_why". The
-   context pin injects state every turn; self-built source needs an
-   auditor pass at the current tree before commit/close. Do not fight
-   the hooks - they are the product.
-3. Candidate next: #36 (audit ENOLOCK), #37 (stamp-root mismatch +
-   subagent worktree commits - CEO lands commits meanwhile), doc-sync of
-   README/docs if they inventory hooks (guard_provenance + context_pin
-   are new), or roadmap #1-#11.
-2. After merge: docs-librarian sync if docs cover hooks; witnesses via
-   witness_check.py --add from the lead's proposed markers.
-3. Then: #36 (audit ENOLOCK), #37 (stamp-root mismatch), or roadmap #1-#11.
-2. Deferred by owner (revisit on ask): lessons loop, loop workers, model
-   tiering, gates.local.config override (WORRIES row).
-3. Field lessons for spawn prompts: witness markers MUST be single-line
-   verbatim substrings (W-010 incident, PR #41); dispatched subagents
-   cannot commit in worktrees (#37) - plan for CEO landing; a stale MAIN
-   stamp blocks worktree commits - restamp main first.
-
-## 3. In flight
-
-| Agent | Task | Worktree | Last known state |
-|---|---|---|---|
-| developer | cli-self-update | .claude/worktrees/cli-self-update | Dispatched 2026-07-15; brief brief-cli-self-update.md; no-commit rule - check worktree git status for finished-on-disk work before respawning |
-
-## 4. Facts every spawn prompt needs
-
-- Gate suite for THIS repo, run directly:
-  `python3 -m unittest discover -s tests/hooks -q` AND `npm test`.
-- The tracked company/gates.config keeps its CONFIGURE-ME placeholders (it
-  ships to installs) - never commit real gate commands into it. The CEO
-  keeps an uncommitted local wiring (hooks + tests gates) for honest
-  stamps; rewire with gates_detect --write + hooks gate if lost.
-- Writing must stay hook-clean: straight quotes, ' - ', three dots.
-- All roles opus (owner veto on tiering). Never override models in spawns.
-- PR mode: origin=github.com/devmesh-in/claude-company, gh authed as
-  Redomic. Owner authorized CEO merges 2026-07-10 (recorded in DECISIONS).
-  Branch protection: 9 CI checks + strict up-to-date (use
-  `gh pr update-branch` when BEHIND).
-- NEVER manually delete a remote branch that is a stacked PR's base - it
-  CLOSES the child PRs (cost us #29/#30, recreated as #33/#34). Merge with
-  `gh pr merge --delete-branch` or retarget children first.
-- Hooks: Python 3.8 stdlib, fail open, import _common as c. guard_commit
-  now resolves the branch from the payload cwd (worktree commits work).
-- Witness registry: company/witnesses.json, mutate ONLY via
-  `python3 .claude/hooks/witness_check.py --add/--remove`.
-- Never `git add -A`; stage explicit paths; `Task: <slug>` trailer.
-
-## 5. Done log (chronological, compressed)
-
-- 2026-07-09: external framework deep research (3 explorers + design pass); plan
-  approved; tiering vetoed; lessons/workers deferred; issues #15-#25.
-- 2026-07-09: wave 1 built + verified (guard_secrets, cost_capture, models
-  gate); PR #27. Dogfooding found #26 (guard_commit worktree bug).
-- 2026-07-09: wave 2 built by two parallel leads + CEO verification +
-  auditor SHIP on both; PRs #29/#30 (later #33/#34). Auditor found #31.
-  Doctrine lead found #28.
-- 2026-07-10: wave 3 built + verified (RELEASE doctrine, /release,
-  acceptance record, postmortem); PR #32.
-- 2026-07-10: owner authorized end-to-end merge; stack merged
-  #27 -> #33 -> #34 -> #32 -> #35 (close-out: witnesses W-004..W-009,
-  briefs archived). Integrated main verified green. Program closed;
-  acceptance recorded.
-- 2026-07-10: follow-up pair shipped. docs-sync (docs-librarian): README +
-  docs/ synced with the program, new root CLAUDE.md - PR #39, closes #28.
-  adr-hardening (developer): guard_frozen blocks minting pre-accepted
-  ADRs - PR #38, closes #31. Close-outs #40/#41 (W-010; first marker was
-  line-wrapped and the witness gate itself caught it - fixed verbatim).
-  New bugs filed from integration: #36 (audit ENOLOCK), #37 (stamp-root
-  mismatch + subagent worktree-commit blocker). Witnesses 10/10 on main.
-- 2026-07-10: delegation-enforcement shipped (PR #49, issues #42-#47,
-  DECISIONS #4-#5). 5 layers + FR-DE-15 tracking gate; one tech-lead +
-  2 devs; CEO drill caught the porcelain dir-collapse dodge (-uall fix);
-  auditor SHIP after 1 coverage fix; 213+31 green x3. Witnesses
-  W-011..W-013. Field lessons: two-step cd-then-commit lets the CEO land
-  worktree commits (#37 workaround); strict up-to-date protection
-  silently defeats owner merge clicks when another PR lands first - use
-  gh pr update-branch and re-ask; the classifier will NEVER let the CEO
-  merge its own PR - plan the owner click into every delivery.

package/company/state/STATUS.md

@@ -1,52 +0,0 @@
-# STATUS - the current-truth board
-
-_Maintained by the CEO. Updated after every dispatch, merge, and CR decision._
-_Red stays red until proven green. Never average a status._
-
-_Last updated: 2026-07-22 - model-routing-arming SHIPPED (PR #77 merged cd07fb6, acceptance DECISIONS #11); release 0.2.2 prepped._
-
-## Active tasks
-
-| Task | Class | Lead/Agent | State | Gates | Notes |
-|---|---|---|---|---|---|
-| spawn-depth-shipping | quick | developer | SHIPPED 2026-07-23 (PR #83 merged 6061814, closes #79-#82) | 224 hooks + 61 CLI + 123 engine green (dev AND CEO reruns); integrated main stamped | Template ships env CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=2; install/update merge env additively (user pin survives - proven); witness W-029. NOT yet on npm - registry still 0.2.0; owner has v0.2.2 tag+publish pending, and this lands in the NEXT release after that. |
-| release-0.2.3 | release | CEO | BUMP PR IN FLIGHT | 224 hooks + 61 CLI + 123 engine green on main | Supersedes unpublished v0.2.2 (tag pushed, never published): 0.2.3 = 0.2.2 content + #83 spawn-depth. Owner buttons after merge: tag v0.2.3 at merge commit, publish from clean tag clone. Registry 0.2.0 -> 0.2.3 directly. DECISIONS #12-#14. |
-
-## Shipped (recent)
-
-| Task | Date | Evidence |
-|---|---|---|
-| model-routing-arming | 2026-07-22 | PR #77 merged cd07fb6 (closes #74-#76); acceptance DECISIONS #11; witnesses W-026/W-027/W-028; live certification: builtin contradict/bare spawn exit 2, match 0, dormancy probe turns --check red; migration: builtins merge lands on install AND update automatically. |
-
-## Wave position (programs only)
-
-| Wave | Workstreams | State | Exit criteria status |
-|---|---|---|---|
-| adoption program 1-3 | all | SHIPPED 2026-07-10 | PRs 27/33/34/32/35 merged; acceptance DECISIONS #3 |
-| follow-up pair | docs-sync + adr-hardening | SHIPPED 2026-07-10 | PRs 38/39/40/41 merged; #28 + #31 closed; witnesses 10/10 on main |
-| cli-update | single workstream | SHIPPED 2026-07-15 | PR #57 merged (7726c99, closes #54-#56); integrated main 213+40+56 green; witnesses W-014..W-016; acceptance DECISIONS #6 |
-| cli-self-update | single workstream | SHIPPED 2026-07-15 | PR #60 merged (a09b463, closes #59); integrated main 213+57 green; witnesses W-017..W-018 (landed via PR #62); acceptance DECISIONS #7 |
-| v0.2.0 npm release | release | PUBLISHED 2026-07-15 | PR #61 merged, tag v0.2.0 (5913374), owner published manually (link-based 2FA); registry latest=0.2.0; DECISIONS #8 |
-| provenance-shipping | quick fix | SHIPPED 2026-07-15 | PR #65 merged (d624cc3, closes #64); fresh installs arm the delegation enforcer, update never auto-arms; witnesses W-019/W-020; NOTE: 0.2.0 on npm still has the gap - 0.2.1 patch release recommended (owner button) |
-| settings-merger-fix | quick fix | SHIPPED 2026-07-15 | PR #69 merged (f17c3c4, closes #67); dedup per (matcher, command) in both engines; update HEALS broken field installs (hand-proven); witnesses W-021/W-022. DevMesh hand-patched meanwhile (its c1ecbf7) |
-| pack-leak-fix | quick fix | SHIPPED 2026-07-15 | PR #71 merged (d714892, closes #68); record trees scaffold empty + tarball negations; seeded negative test; witnesses W-023/W-024 |
-| devmesh-migration | consulting | DELIVERED 2026-07-15 | DevMesh polyrepo migrated to claude-company (its commits b3f0a47/7e08247/c1ecbf7): docs/team ported to company/, frozen registry live (6 surfaces probe-verified), make-gates mirrored, custom agents/skills/memory preserved, 2 upstream bugs found (#67/#68 - both now fixed) |
-
-## Open CRs
-
-_Next free CR number: CR-2._
-
-| CR | Surface | Status | Disposition |
-|---|---|---|---|
-| CR-UPD-1 | frozen-surfaces.json `always` list | APPROVED | Freeze install-manifest.json + .update-backups/**; CEO applies in the cli-update build PR (issue #56) |
-
-## Risks / decisions needed (owner-facing)
-
-1. Two bugs found while integrating, filed and open: #36 (audit gate
-   proposal fails ENOLOCK on lockfile-less repos) and #37 (guard_commit
-   stamp check reads the main checkout, not the commit's work tree - also
-   documents that dispatched subagents cannot commit in worktrees at all;
-   the CEO landed both commits this round). Both are small, scoped, and
-   good next tasks.
-2. Deferred by owner: lessons loop, loop workers, model tiering.
-   Pre-existing roadmap issues #1-#11 untouched.

package/company/state/WORRIES.md

@@ -1,26 +0,0 @@
-# WORRIES - the ledger of the un-acted-on
-
-_Things observed but not yet run down: integration traps, flake sources, spec
-ambiguities, anything that produced a surprise or a false-green. One row per
-worry, brutally terse. Add a row the moment you notice it. Read this at the
-start of every integration or audit step. A row graduates OUT when it becomes a
-filed CR, a STATUS risk, or a verified fix - delete it then. P0 blocks a
-wave/merge; P3 is polish._
-
-| P | Worry | What (one line) | CEO logic (one line) |
-|---|---|---|---|
-| P2 | gates.config template-vs-local tension | On the product repo itself, tracked gates.config must stay placeholder (ships to installs) so stop_gate/guard_commit need uncommitted local wiring - a papercut every session | Consider gates.local.config override in run-gates.sh; candidate issue after wave 2 |
-| P3 | costs.log accuracy limits | Multi-model stop intervals book tokens to the last model; sub-half-cent stops log est=$0.00 | Known limits from wave-1 report; revisit if spend reporting starts driving decisions |
-| P2 | staging stales a provenance audit | work_hash includes diff --cached, so git add AFTER the auditor pass stales the audit even with identical content | Auditor worry #2: doc the order (stage, then audit, then commit) in ORCHESTRATOR step 7 wording next doctrine touch; operational for now |
-| P3 | git -C evades guard_commit subcmd parse | guard_commit.git_subcmd treats -C <dir> as the subcommand token, so `git -C x commit` bypasses commit gates (pre-existing, Mode C inherits) | Anti-adversary, out of doctrine scope; candidate issue against guard_commit |
-| P3 | Mode D lacks worktree-cwd exemption | Stop close-gate block message reads wrong if a worktree session ever gets an active-task.json (moot today - file is untracked) | Auditor worry #3; per-spec (mirrors stop_gate); revisit only if worktree sessions gain task state |
-| P2 | session_start 60-line cap can hide digest | Saturated RESUME+STATUS could truncate the active-task + execution digest lines | Lead worry P2, inherited behavior; candidate tail-reservation tweak in session_start |
-| P2 | provenance audit verdict parser is substring-naive | guard_provenance.py:487 records do-not-ship if the literal phrase appears ANYWHERE in the audit payload - a dispatch prompt that names the verdict vocabulary poisons its own record (hit 3x on release-0.2.2) | Candidate fix: parse the verdict from the response's verdict line only, or match anchored '## Verdict:'; file issue next machinery pass; interim rule: never write the phrase in an auditor prompt |
-| P2 | guard_tests resolves test_scope from main checkout | Worktree builders cannot commit brief-granted test edits until the CEO sets test_scope in MAIN's active-task.json - has now blocked two workstreams (cli-update, model-routing-arming) | Candidate fix: resolve test_scope from the target worktree, or dispatch protocol sets it whenever a brief grants test dirs; follow-up brief |
-| P3 | models.json merge is now a THIRD duplicated heredoc | install.sh/update.sh byte-identical coupling grew (settings, CLAUDE block, now models.json builtins) - divergence risk compounds | Same root cause as existing heredoc row; the byte-identity witness candidate (lead proposal 3) mitigates; fold into any future extraction task |
-| P2 | update.sh duplicates install.sh merge heredocs | The three merges (settings/mcp/CLAUDE block) + CC_BLOCK are copied verbatim; a future install.sh merge change silently diverges update | cli-update lead worry; candidate fixture test asserting install and update produce identical merges; extraction forbidden this pass by additive-only brief |
-| P3 | update spawns python3 per file (~3x/file) | ~180 spawns for 61 files - seconds today, slow at scale | Candidate manifest.py hashtree batch subcommand; not blocking |
-| P3 | manifest emission fails open at install | lib/ or package.json missing -> no manifest, update runs bootstrap-safe forever (never clean "updated") | By design (safe); revisit only if field reports show chronic manifest-less installs |
-| P3 | extensionless files count as source | guard_spec.is_source flags any extensionless file outside company/.claude/docs/.github (e.g. Makefile, a bare "report") - a non-code agent writing one hits the execution gate | Found in owner-requested gate probe 2026-07-15; md/json/state are proven exempt; candidate: extensionless allowlist if it ever bites |
-| P3 | guard_tests gates md inside tests/ | Any write under a tests/ segment is blocked without test_scope regardless of extension, incl. tests/**/*.md (docs-librarian MODULE.md case) | Defensible (tests are the oracle) but extension-blind; candidate: exempt NON_SOURCE_EXT under tests/ if doc syncs start colliding |
-| P3 | background writers stale the gate stamp | Field report 2026-07-15: a training job writing untracked non-ignored files (data/) stales work_hash every turn - stop_gate demands gate reruns | By design (.gitignore IS the ignore mechanism); candidate one-line docs FAQ: gitignore background-process output dirs |