create-agent-rig 0.5.0 → 0.6.0

package/templates/agent-os/universal/.codex/hooks.json

@@ -3,7 +3,7 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Write|Edit|apply_patch",
+        "matcher": "Write|Edit|MultiEdit|NotebookEdit|apply_patch",
         "hooks": [
           {
             "type": "command",
@@ -19,6 +19,11 @@
             "type": "command",
             "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-secret-file.mjs\"",
             "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBnAHUAYQByAGQALQBzAGUAYwByAGUAdAAtAGYAaQBsAGUALgBtAGoAcwAnADsAIAAmACAAbgBvAGQAZQAgACQAaABvAG8AawBQAGEAdABoADsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQA="
+          },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-rulebook.mjs\"",
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBnAHUAYQByAGQALQByAHUAbABlAGIAbwBvAGsALgBtAGoAcwAnADsAIAAmACAAbgBvAGQAZQAgACQAaABvAG8AawBQAGEAdABoADsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQA="
           }
         ]
       },

package/templates/agent-os/universal/AGENTS.md

@@ -86,7 +86,9 @@ them all; they are one rulebook.
   difference is worth keeping straight.
 - **Enforcement is mechanical.** `guard-core-purity` catches an impure edit to
   the core the moment it lands; `guard-web-boundary` keeps the frontend off the
-  backend; `guard-secret-file` refuses an edit that writes a credential — by the
+  backend; `guard-rulebook` refuses an edit to the rulebook itself from an
+  unattended run outside the item's allow-list (a flag file the `loop` skill
+  writes; attended sessions are untouched); `guard-secret-file` refuses an edit that writes a credential — by the
   file's name or by a value in its text, from the one vocabulary in
   `.claude/scripts/lib/secrets.mjs`; `block-no-verify` refuses pre-commit
   bypasses; `guard-bash` refuses

package/templates/agent-os/universal/CLAUDE.md

@@ -86,7 +86,9 @@ them all; they are one rulebook.
   difference is worth keeping straight.
 - **Enforcement is mechanical.** `guard-core-purity` catches an impure edit to
   the core the moment it lands; `guard-web-boundary` keeps the frontend off the
-  backend; `guard-secret-file` refuses an edit that writes a credential — by the
+  backend; `guard-rulebook` refuses an edit to the rulebook itself from an
+  unattended run outside the item's allow-list (a flag file the `loop` skill
+  writes; attended sessions are untouched); `guard-secret-file` refuses an edit that writes a credential — by the
   file's name or by a value in its text, from the one vocabulary in
   `.claude/scripts/lib/secrets.mjs`; `block-no-verify` refuses pre-commit
   bypasses; `guard-bash` refuses

package/templates/agent-os/universal/docs/decisions/gate-coverage.md

@@ -0,0 +1,83 @@
+# Why the fan-out is checked in `pr-ship`, and never in a hook
+
+The check lives in the `pr-ship` skill, step 5 ("Coverage"), and its rule is one
+sentence: *a merge is not gated by a fan-out whose reviewers did not all answer
+for the commit being merged.* This file explains why that check sits in a skill
+rather than in `guard-bash`. The hook version is the one that keeps being
+proposed, and a refusal nobody wrote down gets proposed again. It is not loaded
+into any session.
+
+## The shape that was refused
+
+The proposal: `guard-bash` denies a merge command unless the run journal holds a
+`SHIP` from every reviewer the router named, for the PR's head commit. It is the
+attractive version — mechanical, at the tool layer, impossible for a hurried
+session to skip.
+
+It was refused on four costs, each of them a rule this project already paid for.
+
+**1. It needs to recognise a merge command while the brake is off.** The kill
+switch can be coarse — it denies the network clients *as a class of binaries*,
+reading no merge semantics at all, while still allowing the wind-down it asks
+for — because a false block is cheap when the session is already stopped. `invariants.md` states that
+directly: match a rule's precision to the cost of a false positive. A merge gate
+runs during ordinary work, where a false block lands on the last step of finished
+work. The one attempt at enumerating merge routes was reverted, and what it cost
+is recorded where the attempt was made rather than restated here:
+`.claude/hooks/guard-bash.mjs`, the comment above `NETWORK_CLIENTS`.
+
+**2. It needs the head commit, inside a hook that must stay pure.** For
+`gh pr merge <number>` the head is only knowable over the network, and
+`guard-bash` records what an unbounded hook costs: killed by its own timeout, and
+a killed hook does not block — so **every** rule silently switched off, not just
+the new one.
+
+**3. It needs to parse the journal in a guard that fails open.** The journal
+reader refuses a malformed line by throwing, which is right for a reader and
+fatal for a fail-open guard: the throw resolves to *allow*, again for every rule
+at once. `stop-flag.mjs` is not the precedent it resembles — that is `existsSync`
+over a capped list of fixed paths, not a parse.
+
+**4. Its sweep half cannot exist.** The natural companion — audit merged PRs from
+outside — has nothing to read: the run directory is gitignored, and the sweep
+sees labels and PR bodies only.
+
+## And the reason the four costs were not worth paying
+
+Even fully built, the guard would read a file **the audited run wrote itself**.
+For the threat model a hook actually has — drift, not an adversary — that is
+tolerable, and it is why the skill-level check below is worth having at all. What
+it is not is the *guarantee* the hook version promised, and the four costs above
+were being paid for that word.
+
+## What was built instead
+
+`.claude/scripts/lib/gate-coverage.mjs` compares the three sets the journal already holds —
+routed, launched, answered — and `pr-ship` runs it through
+`verdict.mjs coverage <commit>` before its own verdict. It sits in the layer that
+already knows the head commit, is allowed to run git, and is allowed to throw.
+
+Two limits, and both are stated in the skill beside the step rather than only
+here:
+
+- with no `RIG_RUN_DIR` there is no journal, so the check says it was skipped and
+  exits 0 — an honest nothing, never a pass;
+- a session that skips `pr-ship` entirely skips this with it. That is the gap the
+  hook version was reaching for, and it stays open.
+
+So `CLAUDE.md` keeps its sentence unchanged: *no hook launches the gates, so "the
+gate ran" is a claim, not a guarantee.* What changed is narrower and worth
+having on its own — the driver can no longer accept a fan-out that did not
+answer, or one that answered about a commit two pushes ago.
+
+## The variant that removes self-report, and why it is not the default
+
+Running the reviewers as CI check runs is the only shape where the evidence is
+authored by something other than the audited run, and where the driver cannot
+skip the gate at all. It is not refused on its merits.
+
+It is refused **as a default for this layer**: everything under `.claude/` ships
+into every project this rulebook generates, so making it the shape would require
+a model credential in every generated project's CI and a per-PR cost, for
+projects that never asked for either. A project that wants that guarantee should
+adopt it deliberately; the check above is what every project gets.

package/templates/agent-os/universal/docs/decisions/two-empty-endings.md

@@ -13,9 +13,14 @@ why a parked cause outranks a holding one. It is not loaded into any session.
   by a condition that clears when _something else happens_: the elevated spacing
   (a normal item lands — or an elevated one whose paths were all documents, see
   `spacing-rations-mechanisms.md`), a blocker (its item closes), `in-progress`
-  (the other session finishes), a trigger (a human declares it).
-
-An empty queue wants refilling. A held one wants interleaving, or simply time.
+  (the other session finishes), a trigger (a human declares it), an owner (the
+  item is marked for another repository and a human moves or re-marks it —
+  AR-132), a `re-scope` item (a human rewrites it against the current code and
+  removes the label — AR-144), and a `deferred` item (it carries the `parked`
+  label and a human un-parks it — AR-144).
+
+An empty queue wants refilling. A held one wants interleaving, time, or — for a
+trigger or an owner — the human act the stop line names.
 Reporting the second as the first sends the owner to write tickets that already
 exist; reporting the first as the second tells them to wait for nothing.
 
@@ -23,14 +28,21 @@ exist; reporting the first as the second tells them to wait for nothing.
 
 Parked items are out of play and waiting on a human. They are not work this run
 can take, and they are not why the queue is empty — so they are named separately,
-by cause and count.
+by cause and count. An `obsolete` item (AR-144) is one of them: it waits on a
+human close with a comment naming the evidence, which the loop never writes.
+
+⚠ "Parked" here is the pile, not the `parked` **label**. The label (AR-144) means
+"valid work, deliberately not now" — takeable, held, freed by an un-park — so its
+cause is spelled `deferred`, and it is never in this pile. The two were named
+before each other existed; this note is the reconciliation rather than a rename,
+because the pile word runs through the stop line, the tests and this record.
 
 How that pile grows is the adapter's business, and the stop line does not guess:
 
 | adapter                                  | what lands in the parked pile                         |
 | ---------------------------------------- | ----------------------------------------------------- |
-| tracker-backed (`github-issues`, `jira`) | an escalated item and a filed proposal both stay open |
-| `plan-md`                                | only a `[triage]` line sitting in the Agent queue     |
+| tracker-backed (`github-issues`, `jira`) | an escalated item, a filed proposal (both stay open), and an item labelled `obsolete` (AR-144) |
+| `plan-md`                                | a `[triage]` or an `[obsolete]` line sitting in the Agent queue — nothing else, because a flat list has no per-item state |
 
 Under `plan-md` a filed proposal goes to the Operator queue, where selection
 never looks, and an escalation leaves **no mark on the queue at all** — a flat

package/templates/agent-os/universal/layers.json

@@ -15,6 +15,7 @@
     ".claude/hooks/gate-stop-dod.mjs",
     ".claude/hooks/inject-rules.mjs",
     ".claude/hooks/guard-secret-file.mjs",
+    ".claude/hooks/guard-rulebook.mjs",
     ".claude/hooks/lib/edit-input.mjs",
     ".claude/skills/pr-ship/SKILL.md",
     ".claude/skills/loop/SKILL.md",
@@ -35,11 +36,17 @@
     ".claude/scripts/decision-router.mjs",
     ".claude/scripts/reconcile-external-prs.mjs",
     ".claude/scripts/stop-flag.mjs",
+    ".claude/scripts/unattended-flag.mjs",
     ".claude/scripts/git-env.mjs",
     ".claude/scripts/preflight.mjs",
+    ".claude/scripts/doctor.mjs",
     ".claude/scripts/run-journal.mjs",
     ".claude/scripts/run-state.mjs",
     ".claude/scripts/verdict.mjs",
+    ".claude/scripts/revalidate.mjs",
+    ".claude/scripts/revalidation-report.mjs",
+    ".claude/scripts/lib/gate-coverage.mjs",
+    ".claude/scripts/lib/revalidation-points.mjs",
     ".claude/scripts/lib/verdict.mjs",
     ".claude/scripts/lib/secrets.mjs",
     ".claude/scripts/queue/core.mjs",
@@ -47,12 +54,14 @@
     ".claude/scripts/queue/github-issues.mjs",
     ".claude/scripts/queue/jira.mjs",
     ".claude/scripts/queue/index.mjs",
+    ".claude/scripts/queue/as-of.mjs",
     ".claude/scripts/queue/checkout.mjs",
     ".claude/scripts/queue/state.mjs",
     ".claude/scripts/queue/gate-rounds.mjs",
     ".claude/queue.json",
     "PLAN.md",
     "journal/README.md",
+    "docs/decisions/gate-coverage.md",
     "docs/decisions/fail-open-guards.md",
     "docs/decisions/codex-adapter.md",
     "docs/decisions/closing-a-task.md",