create-agent-rig 0.10.1 → 1.0.1

package/templates/agent-os/universal/.claude/hooks/lib/edit-input.mjs

@@ -4,7 +4,11 @@
  * Claude sends Write/Edit fields directly. Codex sends an apply_patch command,
  * so added lines are returned for ordinary edits. A move is different: the
  * destination receives the existing file too, so guards inspect the resulting
- * content instead of only the patch additions when inspection succeeds.
+ * content instead of only the patch additions when inspection succeeds. A
+ * removal — a `*** Delete File:` section, or the source half of a
+ * `*** Move to:` — also becomes its own fragment, `removes: true`, `fragment:
+ * ''` (RP-214): the path stops existing, which a guard judging paths still
+ * needs to see even though there is no text to inspect.
  *
  * Inspection is bounded globally per patch: sources, hunks, output, splices,
  * comparisons, sections and path components.
@@ -240,6 +244,21 @@ function patchFragments(command, payloadCwd) {
   let current = null;
   let patchRefusal = null;
 
+  // RP-214: one counter, spent on every path this section resolves — the
+  // destination (or the removed path, for a Delete File section) and, for a
+  // Move, the source too (below). Still one forward pass, still the same
+  // bound.
+  const overPathComponentBudget = (value) => {
+    budget.pathComponents += String(value ?? '').replaceAll('\\', '/').split('/').length;
+    return budget.pathComponents > MAX_PATCH_PATH_COMPONENTS;
+  };
+  const pathComponentRefusal = () => ({
+    filePath: '',
+    fragment: '',
+    inspectionRefusal: `apply_patch destination path component count exceeds the ${MAX_PATCH_PATH_COMPONENTS}-component inspection limit`,
+    appliesToAll: true,
+  });
+
   const flush = () => {
     if (current !== null) {
       budget.sections += 1;
@@ -254,16 +273,8 @@ function patchFragments(command, payloadCwd) {
         return false;
       }
       const destinationPath = current.moveTo ?? current.sourcePath;
-      budget.pathComponents += String(destinationPath ?? '')
-        .replaceAll('\\', '/')
-        .split('/').length;
-      if (budget.pathComponents > MAX_PATCH_PATH_COMPONENTS) {
-        patchRefusal = {
-          filePath: '',
-          fragment: '',
-          inspectionRefusal: `apply_patch destination path component count exceeds the ${MAX_PATCH_PATH_COMPONENTS}-component inspection limit`,
-          appliesToAll: true,
-        };
+      if (overPathComponentBudget(destinationPath)) {
+        patchRefusal = pathComponentRefusal();
         current = null;
         return false;
       }
@@ -274,12 +285,58 @@ function patchFragments(command, payloadCwd) {
           fragment: '',
           inspectionRefusal: 'patch destination is outside the repository or cannot be resolved safely',
           appliesToAll: true,
+          // RP-214: a Delete File section has no destination — only the
+          // removed path itself — so this refusal is about a removal too;
+          // carry the flag so a guard that must not treat a removal as a
+          // write (guard-secret-file) can still tell the two apart.
+          ...(current.removes ? { removes: true } : {}),
+        });
+      } else if (current.removes) {
+        // RP-214: `*** Delete File: <path>` used to flush only the SECTION
+        // BEFORE it and never turn the removed path itself into a fragment —
+        // resolved the same way every other verb resolves its path, through
+        // `repositoryPatchPath` and the same budgets above, in this same pass.
+        fragments.push({
+          filePath: destination.resolved,
+          rawFilePath: destination.raw,
+          fragment: '',
+          removes: true,
         });
       } else {
         const moved = current.moveTo
           ? movedFragment(current, budget)
           : { fragment: current.additions.join('\n') };
-        fragments.push({ filePath: destination, ...moved });
+        // RP-60: `rawFilePath` is the lexical repo-relative spelling, taken
+        // before symlink resolution — carried alongside the resolved
+        // `filePath` so a guard can still see a patch destination named
+        // through a guarded prefix that is itself a symlink/junction to
+        // somewhere else inside the checkout.
+        fragments.push({ filePath: destination.resolved, rawFilePath: destination.raw, ...moved });
+
+        if (current.moveTo) {
+          // RP-214: a Move's SOURCE stops existing too — it is a removal the
+          // line above never surfaced, because `current.moveTo ?? …`
+          // resolves only the destination. One more path through the same
+          // resolver and the same budgets, still inside this one flush.
+          if (overPathComponentBudget(current.sourcePath)) {
+            patchRefusal = pathComponentRefusal();
+            current = null;
+            return false;
+          }
+          const source = repositoryPatchPath(current.sourcePath, budget);
+          fragments.push(
+            source === null
+              ? {
+                  filePath: '',
+                  fragment: '',
+                  inspectionRefusal:
+                    'patch destination is outside the repository or cannot be resolved safely',
+                  appliesToAll: true,
+                  removes: true,
+                }
+              : { filePath: source.resolved, rawFilePath: source.raw, fragment: '', removes: true },
+          );
+        }
       }
       current = null;
     }
@@ -298,7 +355,17 @@ function patchFragments(command, payloadCwd) {
       current.moveTo = move[1];
       continue;
     }
-    if (/^\*\*\* (?:Delete File|End Patch)/.test(line)) {
+    // RP-214: a Delete File section becomes its own fragment — `removes:
+    // true`, resolved through the same path the other verbs use — instead of
+    // only flushing whatever section came before it.
+    const del = /^\*\*\* Delete File: (.+)$/.exec(line);
+    if (del) {
+      if (!flush()) break;
+      current = { sourcePath: del[1], moveTo: null, additions: [], hunks: [], activeHunk: null, removes: true };
+      if (!flush()) break;
+      continue;
+    }
+    if (/^\*\*\* End Patch/.test(line)) {
       if (!flush()) break;
       continue;
     }
@@ -481,9 +548,88 @@ function inspectionRefusal(current, reason) {
   return { fragment: current.additions.join('\n'), inspectionRefusal: reason };
 }
 
+// RP-244: a Win32 verbatim (`\\?\`) or device-namespace (`\\.\`) prefix, in
+// any slash mix, names the plain drive (or UNC) path underneath it. The
+// backslash-to-slash conversion below would collapse the leading `//` these
+// prefixes depend on, so they are stripped first. Anchored at the very start:
+// a prefix check, not a scan, which keeps this inside the fail-open
+// bounded-work rule.
+//
+// RP-244 round 2: `[\\/]+` (not `[\\/]`) after the `?`/`.` marker, so a
+// doubled separator still strips. A DRIVE match (`\\?\C:\…`) is the only case
+// that yields a plain, prefix-free spelling — every other two-separator input
+// (verbatim UNC, plain UNC, a device path with no drive letter such as
+// `\\?\Volume{GUID}\…`) is judged as UNDECIDABLE by a repository root spelled
+// as a plain path, so it keeps a leading `//` instead, with its remainder
+// normalised as ABSOLUTE (clamped at root) rather than relative — a relative
+// normalisation let a crafted run of `../` segments do unbounded work instead
+// of collapsing at the root.
+const WIN32_VERBATIM_UNC_PREFIX = /^[\\/]{2}[?.][\\/]+UNC(?:[\\/]+|$)/i;
+const WIN32_VERBATIM_DRIVE_PREFIX = /^[\\/]{2}[?.][\\/]+([A-Za-z]:)/;
+// RP-244 round 3: a drive letter followed immediately by a separator — the
+// drive ROOT, as opposed to the drive-RELATIVE `C:foo\bar` spelling below,
+// which carries no separator there. `slashed` has already had every
+// backslash converted to `/` by the time this is applied, so only the
+// forward-slash form is checked.
+const DRIVE_ROOT_PREFIX = /^[A-Za-z]:\//;
+// RP-244 round 4: a drive letter with NO separator immediately following —
+// the DRIVE-RELATIVE spelling, which Win32 resolves against the current
+// directory of that drive rather than the drive root, so (unlike
+// DRIVE_ROOT_PREFIX above) it has no root of its own to clamp at. Mutually
+// exclusive with DRIVE_ROOT_PREFIX by construction: one requires a `/`
+// immediately after the colon, this one requires there is none (including
+// end of string, for a bare `C:`).
+const DRIVE_RELATIVE_PREFIX = /^[A-Za-z]:(?!\/)/;
+
+// RP-244 round 3: the DRIVE branch below and the plain fallback both used to
+// run `path.posix.normalize` over the drive letter and its remainder
+// TOGETHER, relatively — so a leading `..` walked straight past the drive
+// letter (`C:/../Users/…` normalised to the relative `Users/…`, not clamped
+// at `C:/`) instead of stopping at the root the way Win32 does, and a long
+// run of `../` segments did unbounded relative work instead of the linear
+// work an absolute normalisation does. Splitting the drive off first and
+// normalising only the remainder, ABSOLUTE, fixes both: `path.posix.normalize`
+// clamps an absolute `..` run at `/` instead of carrying it past the drive.
+//
+// RP-244 round 4: the drive-RELATIVE case (no separator after the colon) got
+// the same together-normalisation treatment via the plain `else` branch below
+// — `path.posix.normalize` reads a leading `C:..` segment as an ordinary
+// filename, not the literal `..`, so a second `..` cancelled it and the
+// drive marker vanished from the result (`C:../../a/b` → `a/b`). Splitting
+// the drive off here too and normalising the remainder alone — RELATIVELY,
+// never absolutely, since a drive-relative spelling has no root to clamp
+// at — keeps a `..` in the remainder from ever reaching back far enough to
+// cancel the marker itself; an empty remainder (a bare `C:`) is left as-is
+// rather than turned into `C:.`, unchanged from before this round.
+function clampAtDriveRoot(slashed) {
+  if (DRIVE_ROOT_PREFIX.test(slashed)) {
+    return slashed.slice(0, 2) + path.posix.normalize(slashed.slice(2));
+  }
+  if (DRIVE_RELATIVE_PREFIX.test(slashed)) {
+    const remainder = slashed.slice(2);
+    return remainder === '' ? slashed : slashed.slice(0, 2) + path.posix.normalize(remainder);
+  }
+  return path.posix.normalize(slashed);
+}
+
 function normalisePath(value) {
-  const slashed = String(value ?? '').trim().replaceAll('\\', '/');
-  return slashed === '' ? '' : path.posix.normalize(slashed);
+  const raw = String(value ?? '').trim();
+  if (raw === '') return '';
+  const driveMatch = WIN32_VERBATIM_DRIVE_PREFIX.exec(raw);
+  if (driveMatch) {
+    const slashed = raw.replace(WIN32_VERBATIM_DRIVE_PREFIX, '$1').replaceAll('\\', '/');
+    return slashed === '' ? '' : clampAtDriveRoot(slashed);
+  }
+  const uncMatch = WIN32_VERBATIM_UNC_PREFIX.exec(raw);
+  if (uncMatch || /^[\\/]{2}/.test(raw)) {
+    const rest = (uncMatch ? raw.slice(uncMatch[0].length) : raw.slice(2)).replaceAll('\\', '/');
+    // Absolute normalisation, not relative: clamps a leading `../` run at the
+    // root instead of carrying it through — the outer `'/' +` restores the
+    // `//` marker that `path.posix.normalize` collapses to one.
+    return '/' + path.posix.normalize('/' + rest);
+  }
+  const slashed = raw.replaceAll('\\', '/');
+  return slashed === '' ? '' : clampAtDriveRoot(slashed);
 }
 
 function canonicalPatchPath(value) {
@@ -510,6 +656,11 @@ function repositoryPatchPath(value, budget) {
   const candidate = path.resolve(budget.patchCwd, patchPath);
   if (!isWithin(budget.repoRoot, candidate)) return null;
 
+  // RP-60: the lexical repo-relative spelling, fixed BEFORE any symlink in the
+  // path (a guarded prefix junctioned elsewhere inside the checkout, say) gets
+  // resolved away below. One extra string, computed once — not a new loop.
+  const raw = path.relative(budget.repoRoot, candidate).split(path.sep).join('/');
+
   let existing = candidate;
   const suffix = [];
   while (true) {
@@ -517,7 +668,7 @@ function repositoryPatchPath(value, budget) {
       const resolved = budget.resolvedDirectories.get(existing);
       const resolvedCandidate = path.resolve(resolved, ...suffix);
       if (!isWithin(budget.repoRoot, resolvedCandidate)) return null;
-      return path.relative(budget.repoRoot, resolvedCandidate).split(path.sep).join('/');
+      return { raw, resolved: path.relative(budget.repoRoot, resolvedCandidate).split(path.sep).join('/') };
     }
     try {
       const resolved = realpathSync(existing);
@@ -533,7 +684,7 @@ function repositoryPatchPath(value, budget) {
       }
       const resolvedCandidate = path.resolve(resolved, ...suffix);
       if (!isWithin(budget.repoRoot, resolvedCandidate)) return null;
-      return path.relative(budget.repoRoot, resolvedCandidate).split(path.sep).join('/');
+      return { raw, resolved: path.relative(budget.repoRoot, resolvedCandidate).split(path.sep).join('/') };
     } catch (error) {
       if (error?.code !== 'ENOENT') return null;
       try {

package/templates/agent-os/universal/.claude/rules/invariants.md

@@ -215,6 +215,39 @@ The invariants worth your slots are the ones you can finish this sentence about:
 *"the last time this went wrong, it cost us ___."* If you cannot finish it, you
 are guessing, and a guessed invariant is the one that will fire on honest work.
 
+## The independent-oracle invariant
+
+A test of a security, ownership or governance mechanism must not derive its expected result from the same production mechanism it checks.
+Check it against an independent oracle instead: an alternative
+implementation of the check, a mutation proof, or externally observable behaviour.
+
+⚠ **The independent-oracle invariant has parts 1 and 3 of the pattern above, and not part 2.** No hook enforces it: "is this expectation derived from the same production
+mechanism" is not decidable from a single diff fragment — it takes reading
+both the test and the code path it claims to verify, and judging which one
+stands in as the oracle. `code-reviewer` is where it is enforced, as a
+checklist item, never a hook — see the generator's
+`test/template/correspondence.test.ts` (absent in a generated rig) ›
+"the rule states the invariant and code-reviewer.md carries a matching checklist item".
+
+Why this earned its own name: a test that asks production's own logic what the
+right answer is cannot detect an under-approximation in that logic. Test and
+code are the same computation run twice, agreeing by construction — so the
+test passes, the reviewer sees a test that genuinely exercises the code, and
+CI is green, while the defect the test was written for goes straight through.
+
+The fix that came out of it is the worked example:
+`packages/cli/test/uninstall.test.ts` (absent in a generated rig),
+whose `expectImports` re-derives the import edges with a deliberately
+duplicated regex rather than importing production's own — its comment says
+"deliberately a second copy rather than an import of the private constant" —
+so the test can never be satisfied merely by production checking its own
+work.
+
+Scope: this applies going forward, to tests of security, ownership and
+governance mechanisms. The existing suite is not retrofitted wholesale — an
+existing test is corrected only where doing so is cheap and the derivation
+is demonstrably vacuous.
+
 ## About the hooks you were given
 
 Generator-authored rulebook artifacts — rules, hooks, skills, scripts and agent

package/templates/agent-os/universal/.claude/scripts/lib/verdict.mjs

@@ -73,6 +73,10 @@
  *    absence itself — `lib/gate-coverage.mjs` is the one that does, and it puts
  *    such a verdict in its own list rather than counting it either way. When
  *    present the value is a commit SHAPE, not free text: see `isCommitId`.
+ * 7. **`failure-diagnostician` answers in this shape and is not a merge gate.**
+ *    No `decision-router` lane names it and `pr-ship` coverage never expects an
+ *    answer from it — see `test/template/verdict.test.ts`
+ *    (absent in a generated rig) › "the diagnostician is never a routed reviewer".
  */
 
 /** Every word any gate in this rulebook may return. */
@@ -86,6 +90,14 @@ export const VERDICT_WORDS = Object.freeze([
   'UNVERIFIABLE',
   'UNMEASURED',
   'NOT_APPLICABLE',
+  // RP-195 slice 1: failure-diagnostician's own words, split by what it was
+  // asked to look at — a failure, or a claimed/historical finding.
+  'ROOT_CAUSE',
+  'INCONCLUSIVE',
+  'STILL_LIVE',
+  'ALREADY_FIXED',
+  'OBSOLETE',
+  'INSUFFICIENT_EVIDENCE',
 ]);
 
 /**
@@ -111,6 +123,15 @@ export const GATE_VOCABULARY = Object.freeze({
     'UNMEASURED',
   ]),
   'post-deploy-verify': Object.freeze(['HEALTHY', 'REGRESSION']),
+  // RP-195 slice 1 (design decision 1): the diagnostician's own words.
+  'failure-diagnostician': Object.freeze([
+    'ROOT_CAUSE',
+    'INCONCLUSIVE',
+    'STILL_LIVE',
+    'ALREADY_FIXED',
+    'OBSOLETE',
+    'INSUFFICIENT_EVIDENCE',
+  ]),
 });
 
 /**
@@ -126,6 +147,13 @@ export const BLOCKING_VERDICTS = Object.freeze([
   'PREMISE_FALSE',
   'UNVERIFIABLE',
   'UNMEASURED',
+  // RP-195 slice 1 (design decision 1): the cause, for ROOT_CAUSE and
+  // STILL_LIVE; the missing evidence, for INCONCLUSIVE and
+  // INSUFFICIENT_EVIDENCE. ALREADY_FIXED and OBSOLETE carry no blockers.
+  'ROOT_CAUSE',
+  'INCONCLUSIVE',
+  'STILL_LIVE',
+  'INSUFFICIENT_EVIDENCE',
 ]);
 
 /** The only keys a block may carry. */
@@ -136,8 +164,16 @@ const SHAPE_KEYS = Object.freeze([
   'advisories',
   'evidence',
   'headSha',
+  'classification',
 ]);
 
+/**
+ * The one optional key `failure-diagnostician` alone may carry (RP-195 slice
+ * 1, design decision 2): required on ROOT_CAUSE, optional on STILL_LIVE,
+ * refused on every other word and on every other gate.
+ */
+const CLASSIFICATIONS = Object.freeze(['product', 'test', 'infrastructure', 'upstream']);
+
 const FENCE = '```json';
 
 /** How much of one reviewer-written value a diagnosis will carry. */
@@ -443,6 +479,32 @@ export function parseVerdict(text) {
     }
   }
 
+  const classification = parsed.classification;
+  const hasClassification = classification !== undefined;
+  if (hasClassification) {
+    if (!isText(gate) || gate !== 'failure-diagnostician') {
+      problems.push(
+        '`classification` is refused here: only failure-diagnostician may carry it, and ' +
+          `this block names \`gate\` as ${safeForDiagnosis(gate)}.`,
+      );
+    } else if (verdict !== 'ROOT_CAUSE' && verdict !== 'STILL_LIVE') {
+      problems.push(
+        `\`classification\` is refused on ${safeForDiagnosis(verdict)} — only ROOT_CAUSE ` +
+          '(required) and STILL_LIVE (optional) may carry one.',
+      );
+    } else if (!CLASSIFICATIONS.includes(classification)) {
+      problems.push(
+        `\`classification\` is \`${safeForDiagnosis(classification)}\`, which is not one of: ` +
+          `${CLASSIFICATIONS.join(', ')}.`,
+      );
+    }
+  } else if (isText(gate) && gate === 'failure-diagnostician' && verdict === 'ROOT_CAUSE') {
+    problems.push(
+      'ROOT_CAUSE names no `classification`: it is required on this word — one of ' +
+        `${CLASSIFICATIONS.join(', ')}.`,
+    );
+  }
+
   if (problems.length > 0) return { ok: false, problems };
 
   return {
@@ -457,6 +519,7 @@ export function parseVerdict(text) {
       // back without the key at all, so a caller can tell "answered for this
       // commit" from "said nothing about which commit".
       ...(headSha === undefined ? {} : { headSha }),
+      ...(hasClassification ? { classification } : {}),
     },
   };
 }

package/templates/agent-os/universal/.claude/scripts/queue/core.mjs

@@ -633,13 +633,12 @@ const clearsSpacing = (lastCompletedTier) =>
  * items with the whole suite green throughout, and its `budget` stop arriving "later
  * than it should have".
  *
- * Two is the cap because the second round is what verifies the first round's fixes.
- * A third is a decision for a human rather than another pass to buy — and the
- * refusal says only that the count is spent, never that the fixes "are not
- * converging": on one branch a granted third round found that round 2's fix had
- * opened the mirror of the bug it closed (AR-115).
+ * Three is the cap: the second round verifies the first round's fixes, and the
+ * third lets a round-2 fix be read once more before the item needs a human. A
+ * project that wants a different cap sets `options.maxGateRounds` instead of
+ * changing this default.
  */
-export const DEFAULT_MAX_GATE_ROUNDS = 2;
+export const DEFAULT_MAX_GATE_ROUNDS = 3;
 
 /**
  * Is this round allowed, and if not, what stops?

package/templates/agent-os/universal/.claude/scripts/queue/github-issues.mjs

@@ -144,6 +144,21 @@ const ghJson = (args) => JSON.parse(ghText(args));
 
 const FIELDS = 'number,title,body,state,labels,url,createdAt,updatedAt,comments';
 
+/**
+ * A `--state` (or triage) window that came back exactly at its cap: older
+ * items may have been left unread, and a window this shape cannot tell the
+ * difference from a repository that happens to have exactly `limit` items.
+ * See queue-github-pagination.test.ts (absent in a generated rig) ›
+ * "a --state %s window that comes back exactly at the limit is announced on
+ * stderr" and › "a triage window that comes back exactly at the cap (100) is
+ * announced on stderr".
+ */
+const announceCap = (label, limit) => {
+  process.stderr.write(
+    `github-issues: ${label} window capped at ${limit} issues — older ${label} items may be missing; raise limit\n`,
+  );
+};
+
 // --- the adapter contract ------------------------------------------------------
 
 /**
@@ -151,18 +166,42 @@ const FIELDS = 'number,title,body,state,labels,url,createdAt,updatedAt,comments'
  *
  * Deliberately queries fresh on every call and never caches: the queue changes as
  * the loop itself closes items and unblocks their dependents.
+ *
+ * Open and closed issues are read as two separate `--state` windows rather
+ * than one shared `--state all` window: a shared window lets closed history
+ * push an older open issue out of it, which used to be silent. See
+ * queue-github-pagination.test.ts (absent in a generated rig) › "keeps an
+ * older OPEN issue even when 100 CLOSED issues would fill a shared window".
  */
 export const listEligible = ({ limit = 100, issues = null } = {}) => {
-  const raw =
-    issues ?? ghJson(['issue', 'list', '--state', 'all', '--limit', String(limit), '--json', FIELDS]);
+  let raw;
+  let openIssues = null;
+  if (issues) {
+    raw = issues;
+  } else {
+    openIssues = ghJson(['issue', 'list', '--state', 'open', '--limit', String(limit), '--json', FIELDS]);
+    if (openIssues.length === limit) announceCap('open', limit);
+    const closedIssues = ghJson([
+      'issue',
+      'list',
+      '--state',
+      'closed',
+      '--limit',
+      String(limit),
+      '--json',
+      FIELDS,
+    ]);
+    if (closedIssues.length === limit) announceCap('closed', limit);
+    raw = [...openIssues, ...closedIssues];
+  }
   const states = Object.fromEntries(raw.map((issue) => [String(issue.number), issue.state]));
   const blocks = blocksIndex(raw);
-  return raw
-    .filter((issue) => String(issue.state ?? '').toUpperCase() !== 'CLOSED')
-    .map((issue) => {
-      const ticket = toTicket(issue, states);
-      return { ...ticket, blocks: blocks[ticket.id] ?? [] };
-    });
+  const eligible =
+    openIssues ?? raw.filter((issue) => String(issue.state ?? '').toUpperCase() !== 'CLOSED');
+  return eligible.map((issue) => {
+    const ticket = toTicket(issue, states);
+    return { ...ticket, blocks: blocks[ticket.id] ?? [] };
+  });
 };
 
 export const resolveBlockers = (ticket) => (ticket.blockedBy ?? []).filter((b) => !b.resolved);
@@ -293,12 +332,30 @@ export const triageItemFor = (proposal) => {
  * hand out nothing — "queue empty" and "nothing selectable";
  * twenty such stops must produce one proposal with a count of twenty.
  */
-/** The proposals on file, as `{ id, body }` — every `triage`-labelled issue. */
-export const listProposals = ({ existing = null } = {}) =>
-  (
-    existing ??
-    ghJson(['issue', 'list', '--label', 'triage', '--state', 'all', '--limit', '100', '--json', FIELDS])
-  ).map((issue) => ({ id: String(issue.number), body: issue.body }));
+/**
+ * The proposals on file, as `{ id, body }` — every `triage`-labelled issue.
+ * A window that comes back exactly at its cap is announced on stderr, same
+ * as `listEligible`'s.
+ */
+export const listProposals = ({ existing = null, limit = 100 } = {}) => {
+  let raw = existing;
+  if (!raw) {
+    raw = ghJson([
+      'issue',
+      'list',
+      '--label',
+      'triage',
+      '--state',
+      'all',
+      '--limit',
+      String(limit),
+      '--json',
+      FIELDS,
+    ]);
+    if (raw.length === limit) announceCap('triage', limit);
+  }
+  return raw.map((issue) => ({ id: String(issue.number), body: issue.body }));
+};
 
 export const proposeTriage = (rawProposal, { existing = null } = {}) => {
   const proposal = withAsOf(rawProposal);

package/templates/agent-os/universal/.claude/scripts/queue/propose.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+// The one repo-root-safe entry point for filing an improvement-triage
+// proposal (RP-209). It resolves its config, and through it the active
+// board's adapter and plan path, from its OWN location — exactly like
+// `index.mjs`'s `projectRoot` — so a session standing in a subdirectory
+// files into the project's real PLAN.md rather than a cwd-relative one
+// that happens not to exist there.
+//
+//   node .claude/scripts/queue/propose.mjs --file <proposal.json>
+//   node .claude/scripts/queue/propose.mjs --file -                # stdin
+//   node .claude/scripts/queue/propose.mjs --file <path> --config <queue.json>
+//
+// The proposal object is whatever the active adapter's `proposeTriage`
+// already accepts. The result prints as one JSON line on stdout; the
+// process exits 0 only when `ok === true`. When `RIG_RUN_DIR` is declared,
+// one `proposal` event is recorded in the run journal either way, so a
+// failed filing is journalled as a failure rather than going nowhere
+// silently.
+//
+// See the generator's test/template/queue-propose.test.ts (absent in a
+// generated rig).
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadConfig, optionsWithPlanPath, resolveAdapter } from './index.mjs';
+
+const parseArgs = (argv) => {
+  const args = { file: null, config: null };
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--file') args.file = argv[++i];
+    else if (argv[i] === '--config') args.config = argv[++i];
+  }
+  return args;
+};
+
+const readStdin = () =>
+  new Promise((resolve, reject) => {
+    const chunks = [];
+    process.stdin.on('data', (chunk) => chunks.push(chunk));
+    process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+    process.stdin.on('error', reject);
+  });
+
+const readProposalRaw = (file) => (file === '-' ? readStdin() : Promise.resolve(readFileSync(file, 'utf8')));
+
+/**
+ * Small, deliberately: the journal is a trace of the filing decision, not a
+ * second copy of the proposal or of the adapter's whole response.
+ */
+const journalDataFor = (result, reason) => {
+  const data = { ok: result?.ok === true };
+  if (result?.item?.fingerprint !== undefined) data.id = result.item.fingerprint;
+  if (result?.filed !== undefined) data.filed = result.filed;
+  if (result?.incremented !== undefined) data.incremented = result.incremented;
+  if (reason !== undefined) data.reason = reason;
+  return data;
+};
+
+const main = async () => {
+  const args = parseArgs(process.argv.slice(2));
+  if (!args.file) {
+    process.stderr.write('propose: --file <proposal.json> is required (or --file - for stdin).\n');
+    process.exit(1);
+  }
+
+  let raw;
+  try {
+    raw = await readProposalRaw(args.file);
+  } catch (error) {
+    process.stderr.write(`propose: could not read ${args.file}: ${error.message}\n`);
+    process.exit(1);
+  }
+
+  let proposal;
+  try {
+    proposal = JSON.parse(raw);
+  } catch (error) {
+    process.stderr.write(`propose: ${args.file} is not valid JSON: ${error.message}\n`);
+    process.exit(1);
+  }
+
+  // Resolved against this file's own URL, not the cwd — the same rule
+  // `index.mjs` follows, for the same reason: the CLI runs from the project
+  // root, from a worktree, and from a subdirectory the session happens to be
+  // standing in.
+  const scriptDir = dirname(fileURLToPath(import.meta.url));
+  const projectRoot = join(scriptDir, '..', '..', '..');
+  const configPath = args.config ?? join(projectRoot, '.claude', 'queue.json');
+
+  let result;
+  let reason;
+  try {
+    const config = loadConfig(configPath);
+    const adapter = await resolveAdapter(config.adapter ?? 'plan-md');
+    const options = optionsWithPlanPath(config.options, configPath);
+    result = await adapter.proposeTriage(proposal, options);
+    if (result?.ok !== true) reason = result?.why ?? 'proposeTriage returned ok: false';
+  } catch (error) {
+    reason = error.message ?? String(error);
+    result = { ok: false, reason };
+  }
+
+  const exitCode = result?.ok === true ? 0 : 1;
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (exitCode !== 0) process.stderr.write(`propose: ${reason}\n`);
+
+  const runDir = process.env.RIG_RUN_DIR;
+  if (runDir) {
+    let journal = null;
+    try {
+      journal = await import('../run-journal.mjs');
+      journal.recordEvent({
+        runDir,
+        kind: 'proposal',
+        data: journalDataFor(result, reason),
+        now: new Date().toISOString(),
+      });
+    } catch (error) {
+      const classify = journal?.isTraceExhausted;
+      if (typeof classify === 'function' && classify(error)) {
+        // The trace is over; the filing already happened and stands. Loud on
+        // stderr, exit code stays whatever the filing decided — mirrors the
+        // pattern in `index.mjs` and the `loop` skill's own journal section.
+        process.stderr.write(
+          `run journal: ${error.message}\n` +
+            `  the proposal result above was NOT recorded in ${runDir}. This run's ` +
+            "trace ends here; the filing above stands.\n",
+        );
+      } else {
+        process.stderr.write(`run journal: ${error.message}\n`);
+        process.exit(1);
+      }
+    }
+  }
+
+  process.exit(exitCode);
+};
+
+main();