create-agent-rig 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -11,6 +11,66 @@ Numbering is ordinary semver — **additive is a minor, a fix is a patch** — s
 that "I only take minors" remains a usable policy; 0.3.2 shipped additive
 content as a patch by the owner's call and stays recorded as one.
 
+## 0.7.1
+
+**The gate could not be run on work that has no queue item.** `pr-ship` names
+owner-directed work and hotfixes with no item as a legitimate path — step 4
+tells the fan-out to declare it and have the reviewer skip the item-contract
+check openly. Step 1 then made that path unexecutable: it called
+`revalidate.mjs` with an unconditional `--ticket`, and the script refused
+without one. A newly scaffolded project inherited a rulebook that contradicted
+itself at the one checkpoint before every PR, so the first hotfix in a fresh rig
+had nothing it was allowed to do. Found downstream while integrating published
+0.7.0.
+
+A patch: no file is added or removed, no new dependency, and the public CLI of
+the generator is untouched. What changes is one flag on one internal script and
+the skill step that calls it.
+
+### Fixed
+
+- **`revalidate.mjs` BEFORE_PR now has two modes, and neither is inferred.**
+  `--ticket <key>` is unchanged, including the mandatory claim comparison.
+  `--owner-directed` runs the same default-branch drift comparison for work
+  with no item, reaching no tracker, no adapter and no claim record — so it
+  needs no tracker credentials. Passing both flags, or neither, is exit 1: a
+  mode chosen by absence is a mode nobody reviewed.
+
+  It is not a lighter checkpoint. A default-branch change under a path the
+  branch touches, or one a `check-premises` record cited, holds with the same
+  exit 2. What it drops is the claim comparison, because work with no item has
+  no claim to compare, and it records `ticket: null` rather than inventing an
+  id.
+
+  **Four refusals keep it from becoming a bypass** — exit 1, nothing
+  journalled: when the run carries an unresolved `revalidationHold`, when the
+  run declares a take-up, when the branch touches a tracked
+  `.rig/claims/*.json` in any direction (added, modified, removed or renamed),
+  and at `BEFORE_CLOSE`. The first is the one that makes re-running a held or
+  `UNVERIFIABLE` ticketed call in this mode a refusal rather than a way past
+  it; the run's stop inputs are read fail-closed, so an unreadable
+  `state.json` refuses instead of reading as an empty run.
+
+  An owner-directed HOLD is answered the same way a ticketed one is, with
+  `revalidate.mjs outcome` at the same point, passing `--owner-directed`
+  instead of `--ticket`. It addresses the detection by mode, since that
+  detection carries no ticket to name.
+
+  ⚠ Its stated limits, because a governance mode is trusted as far as it is
+  described. Nothing can prove an item does not exist. With no `RIG_RUN_DIR`
+  there is no run state, so the hold and take-up refusals cannot fire — the
+  command says so on stdout and in `evidence.runState` rather than reporting a
+  clean check. The claim refusal reads the branch diff, so a record already on
+  the default branch or not yet committed is not seen. And `--base` is the sole
+  authority for the verdict here, the claim comparison that would otherwise
+  survive a wrong base being absent.
+
+- **`pr-ship` step 1 states both paths**, and step 4 now spells the words the
+  fan-out is launched with — `no item — owner-directed` — and says that this
+  skips the item-contract check and **nothing else**: the checks, the routing,
+  the security, code and prose/governance reviews, the coverage check and the
+  DoD all still run.
+
 ## 0.7.0
 
 **A durable claim record under the revalidation 0.6.2 already had, and the
@@ -56,6 +116,31 @@ a patch is the case the rule exists to prevent.
   was allowed on the original surface too — and it is unchanged by this
   release.
 
+- **A shell command the two shell guards cannot read is refused, where it used
+  to be allowed.** `guard-bash` and `block-no-verify` read the `command` a hook
+  hands them on a shell tool, and asked only whether it was a string. A command
+  that was **there** in some other container — an array of argv words, an
+  object — failed that test and returned _allow_ before the kill switch was ever
+  consulted, so restating a forbidden command in another shape stepped over an
+  armed brake. Those two guards now decide the three outcomes in one shared
+  place: an **absent** command still allows, because there is nothing to judge;
+  a **string** is inspected as before; a command that is present in a shape they
+  cannot read is **refused**, naming the shape they expected.
+
+  ⚠ The scope is those two guards, and it is narrow on purpose — it is **not** a
+  repository-wide ruling on the word `command`. `guard-secret-file` reads an
+  `apply_patch` `command` that is a _list of strings_, exactly the shape this
+  contract calls unreadable, and it is right to; routing a third guard through
+  the same place without checking what its tool actually sends would start
+  refusing input another guard exists to read.
+
+  ⚠ Two further limits. This changes only the unreadable case — the name-exact
+  bound described just above is untouched, and an absent field remains fail-open
+  on purpose, since a guard that blocked when handed nothing would be turned off
+  within the hour. And the **edit** surfaces are not part of this: what
+  `.claude/hooks/lib/edit-input.mjs` does with a `tool_input` it cannot read is
+  unchanged by this release.
+
 - **An adapter it cannot read is `UNVERIFIABLE`, not a stack trace.** A
   revalidation whose queue adapter could not be reached exited on a raw Node
   stack trace, which a caller could read as noise rather than as a hold. It now

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agent-rig",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Scaffold a new project with an agent operating system (rules, gates, hooks) and a runnable code skeleton",
   "keywords": [
     "create",

package/templates/agent-os/universal/.agents/skills/pr-ship/SKILL.md

@@ -57,13 +57,66 @@ blockers.
    confidently-wrong reviews. Everything below is scoped to this diff.
 
    Then, on the fetched ref, ask whether the branch is still the branch the run
-   took up:
+   took up. **Two paths, and you state which one — the command infers neither.**
+   A branch that is a queue item's take-up:
 
    ```sh
    node .claude/scripts/revalidate.mjs --point BEFORE_PR --ticket <item-id> --base origin/<default>
    ```
 
-   It runs the existing revalidation chain against the tracked, versioned
+   Owner-directed work or a hotfix that has **no item** — the case step 4 below
+   already tells you to declare to the reviewers:
+
+   ```sh
+   node .claude/scripts/revalidate.mjs --point BEFORE_PR --owner-directed --base origin/<default>
+   ```
+
+   🔴 **The second path is not a lighter checkpoint, and it is never a skip.**
+   It runs the same `main:<path>` comparison and holds on the same exit 2; what
+   it drops is the claim comparison, because work with no item has no claim to
+   compare. It resolves no queue config, so it reaches no tracker and needs no
+   credentials. Passing both flags, or neither, is exit 1.
+
+   **Four refusals** — exit 1, nothing journalled — keep it from being the way
+   around a claim or revalidation failure. It is refused when this run carries
+   an **unresolved revalidation hold** (what the ticketed path writes when it
+   holds or answers `UNVERIFIABLE`), when this run **declares a take-up**, when
+   the branch **touches a tracked `.rig/claims/*.json`** in any direction —
+   added, modified, removed or renamed — and at `BEFORE_CLOSE`. So re-running a
+   held ticketed call in this mode does not get past it: resolve the hold with
+   `outcome` instead.
+
+   ⚠ **What those refusals do not cover**, because a governance mode is trusted
+   exactly as far as it is described:
+
+   - **With no `RIG_RUN_DIR` there is no run state to read**, so the hold and
+     take-up refusals cannot fire — and nothing is journalled. The command says
+     so on stdout and in `evidence.runState`; it is not evidence that neither
+     exists. An attended gate run is exactly this shape, so read that line.
+   - The claim refusal reads the **branch diff**, so a claim record already on
+     the default branch, or written and not committed, is not seen.
+   - **`--base` is the sole authority for the verdict here**, the claim
+     comparison that would otherwise survive a wrong base being absent. Pass
+     the fetched `origin/<default>`, not a local copy and not `HEAD`.
+   - Nothing can prove an item does not exist. The rest is your word, recorded
+     as such, with `ticket: null` and no invented id.
+
+   Pinned in the generator's `test/template/owner-directed-revalidation.test.ts`
+   (absent in a generated rig) › "refuses when this run carries an unresolved
+   revalidation hold", › "refuses when the declared run already carries a
+   take-up", › "refuses when the branch RENAMES a claim record — the case
+   --diff-filter=AM could not see" and › "says out loud that an undeclared run
+   checked neither the hold nor the take-up".
+
+   **Exit 2 here is a HOLD with the same shape as the ticketed one**, and the
+   same two-step remedy: re-read the default branch on each named path, then
+   record what the re-read concluded — `node .claude/scripts/revalidate.mjs
+   outcome --point BEFORE_PR --owner-directed --action-changed <true | false>
+   --note '…'` — and come back through step 0. The owner-directed detection
+   carries no ticket, so `--owner-directed` is how the outcome addresses it;
+   the ticketed `--ticket <item-id>` form below cannot match it and is refused.
+
+   The ticketed path runs the existing revalidation chain against the tracked, versioned
    `.rig/claims/<item-id>.json`: the content-blind `scope` fingerprint set is
    authoritative here, while `takeUps` / `updatedAt` remain evidence only. It
    also names what the default branch changed since this branch forked on paths
@@ -71,14 +124,18 @@ blockers.
    journals one `revalidation` event at `point: BEFORE_PR`; **exit code 2 is a HOLD**, with one blocker per named source: re-read the item, or the default
    branch on that path, record what the re-read concluded —
    `node .claude/scripts/revalidate.mjs outcome --point BEFORE_PR --ticket <item-id> --action-changed <true | false> --note '…'`
-   — and come back through step 0. A hold with no outcome is counted by the
-   report as a re-read the run skipped. A missing, untracked, unreadable or
+   — and come back through step 0. **That `--ticket` form is this path's, not
+   both paths'** — the owner-directed detection carries no ticket for it to
+   name, and its own `--owner-directed` outcome is written out above. A hold
+   with no outcome, in either mode, is counted by the report as a re-read the
+   run skipped. A missing, untracked, unreadable or
    unsupported claim is `UNVERIFIABLE`, exits 2, and stops automatic progress;
    so is a tracker whose adapter the command cannot READ, which means the
    question was never put rather than that the claim record is unreadable.
    Neither is ever read as a pass. Exit 1 is the command refusing (unknown
-   point, no ticket, a base that is not a revision, or a queue config that does
-   not resolve): fix the call or the config — the message says which. Its limits are its own header's; the
+   point, neither mode or both, a base that is not a revision, or a queue config
+   that does not resolve — plus, on the owner-directed path, the four refusals
+   above): fix the call or the config — the message says which. Its limits are its own header's; the
    cited-path set is a labelled assumption, not a recorded fact. Pinned in the
    generator's `test/template/revalidate.test.ts` (absent in a generated rig) ›
    "continues when only updatedAt moved and still reports the marker evidence"
@@ -182,9 +239,13 @@ blockers.
    **Whatever you launch, pass it the text of the queue item this branch
    implements.** A reviewer given only a diff cannot check the change against
    what was asked: a cold context has no way to know, and reconstructing it from
-   the PR description would mean trusting the run under review. If there is no
-   item — owner-directed work, a hotfix — say so when launching, and the
-   reviewer skips that check openly instead of guessing at it.
+   the PR description would mean trusting the run under review. When there is
+   no item — owner-directed work, a hotfix — launch every reviewer with the
+   words **`no item — owner-directed`** instead. That skips the item-contract
+   check, openly, and **nothing else**: the checks, the routing, the security,
+   code and prose/governance reviews, the coverage check and the DoD all still
+   run. It is one check narrower than a ticketed fan-out, not a cheaper gate,
+   and the same words are what step 1's `--owner-directed` call records.
 
    🔴 **The triggers below are lane-independent and may only ADD.** They read
    *what the code does*; the router reads *paths*, and a path cannot say that a

package/templates/agent-os/universal/.claude/scripts/revalidate.mjs

@@ -5,6 +5,62 @@
  * run took up?
  *
  *   node .claude/scripts/revalidate.mjs --point BEFORE_PR --ticket <id> [--base origin/master] [--config <queue.json>] [--json]
+ *   node .claude/scripts/revalidate.mjs --point BEFORE_PR --owner-directed [--base origin/master] [--json]
+ *
+ * BEFORE_PR has two mutually exclusive modes and neither is inferred (RP-94):
+ * `--ticket` for a branch that is an item's take-up, `--owner-directed` for
+ * owner-directed work or a hotfix that has no item — the path `pr-ship` step 4
+ * already named while step 1 could not execute it. Passing both, or neither,
+ * is exit 1 — owner-directed-revalidation.test.ts › "refuses both modes at
+ * once: exit 1, stderr only, nothing journaled" and › "refuses neither mode:
+ * exit 1, and the message names both ways forward".
+ *
+ * Owner-directed mode runs the `main:<path>` comparison below and nothing
+ * else. It resolves no queue config, so no tracker or adapter is reached and
+ * no credential is needed — owner-directed-revalidation.test.ts › "needs no
+ * tracker credentials: an adapter name that cannot resolve is never reached".
+ * A `hold` there is the same exit 2 as the ticketed path's — › "HOLDs when the
+ * default branch moved under a path the branch touches".
+ *
+ * FOUR refusals keep it from becoming a way around the claim chain — exit 1,
+ * nothing journalled, each with its own test in that file:
+ *
+ * - an unresolved `revalidationHold` in this run's state, which is what the
+ *   ticketed path writes when it holds or answers UNVERIFIABLE — › "refuses
+ *   when this run carries an unresolved revalidation hold";
+ * - a take-up this run declares — › "refuses when the declared run already
+ *   carries a take-up";
+ * - a tracked `.rig/claims/*.json` this branch touches, added, modified,
+ *   removed or renamed — › "refuses when the branch diff adds a tracked claim
+ *   record", › "refuses when the branch diff modifies a tracked claim record",
+ *   › "refuses when the branch RENAMES a claim record — the case
+ *   --diff-filter=AM could not see" and › "refuses when the branch DELETES its
+ *   claim record";
+ * - `BEFORE_CLOSE` — › "refuses owner-directed at BEFORE_CLOSE — the mode
+ *   exists for BEFORE_PR only".
+ *
+ * The first of those is the one this mode most needs, and the first version
+ * shipped without it: a ticketed call that had already held was re-run here and
+ * exited 0 with nothing in the repository changed.
+ *
+ * ⚠ Its limits, stated because the mode is a governance surface. What makes a
+ * call owner-directed is the CALLER's word plus those four refusals: nothing
+ * here can prove an item does not exist. Three specific gaps, each measured
+ * rather than reasoned:
+ *
+ * - with no `RIG_RUN_DIR` there is no run state, so the hold and take-up
+ *   refusals have nothing to read and cannot fire — and nothing is journalled
+ *   either. The result says so in `evidence.runState`, and the report on
+ *   stdout says so out loud — › "says out loud that an undeclared run checked
+ *   neither the hold nor the take-up".
+ * - the claim refusal reads the branch DIFF, so a claim record already on the
+ *   default branch, or written but not committed, is not seen.
+ * - `--base` decides more here than the verdict. The claim comparison that
+ *   would otherwise survive a wrong base is absent, AND the claim-touch refusal
+ *   reads the same `mergeBase..HEAD` range — so `--base HEAD` empties the
+ *   branch diff and disarms that refusal as well as reporting `continue`. Pass
+ *   the up-to-date `origin/<default>`; `pr-ship` step 1 refreshes it, since
+ *   this script never talks to a remote itself.
  *
  * One existing checkpoint chain, with one authoritative durable baseline:
  *
@@ -45,18 +101,33 @@
  * "re-reads each dependant's state, and names one the tracker no longer
  * offers") for the loop's write-back.
  *
- * `outcome --point <P> --ticket <id> --action-changed true|false [--note …]`
- * (AR-136) is the second half of the evidence: after the re-read, it appends a
- * `revalidation-outcome` record whose `answers` is the seq of the latest
- * `revalidation` for that ticket and point in this run — the join a report
- * needs, made by the writer rather than guessed by the reader. It refuses
- * without a run, without a matching revalidation, and with any word but
- * `true`/`false`, and writes nothing then. The typed resolution names the
- * stable detection id and clears only the matching run-level hold. Exit 2 on
- * `hold` or `unverifiable`, 0 on `continue`, and 1 when the call cannot be
- * acted on (unknown point, no ticket, a base that is not a revision — or, on
- * the paths that reach it, a queue config that does not resolve) — and then
- * nothing is journalled, because a refusal is not an answer.
+ * `outcome --point <P> {--ticket <id> | --owner-directed} --action-changed
+ * true|false [--note …]` (AR-136, extended by RP-94) is the second half of the
+ * evidence: after the re-read, it appends a `revalidation-outcome` record whose
+ * `answers` is the seq of the latest matching `revalidation` at that point in
+ * this run — the join a report needs, made by the writer rather than guessed by
+ * the reader.
+ *
+ * **Which revalidation it matches depends on the mode, and the two never
+ * cross.** `--ticket` matches by key and skips owner-directed detections
+ * outright; `--owner-directed` matches by `mode`, because such a detection
+ * carries `ticket: null` and cannot be addressed by key — and a ticketed
+ * `--ticket null` must not answer it either. Pinned in the generator's
+ * `test/template/owner-directed-revalidation.test.ts` (absent in a generated
+ * rig) › "answers an owner-directed hold with an owner-directed outcome", ›
+ * "refuses a ticketed outcome aimed at an owner-directed detection" and ›
+ * "refuses an owner-directed outcome when a ticketed hold is the only one this
+ * run carries — and leaves that hold latched".
+ *
+ * It refuses without a run, without a matching revalidation, and with any word
+ * but `true`/`false`, and writes nothing then. The typed resolution names the
+ * stable detection id and clears only the matching run-level hold — and only a
+ * hold whose id it actually names, which is why an owner-directed outcome
+ * cannot release a ticketed one. Exit 2 on `hold` or `unverifiable`, 0 on
+ * `continue`, and 1 when the call cannot be acted on (unknown point, neither
+ * mode or both, a base that is not a revision — or, on the paths that reach it,
+ * a queue config that does not resolve) — and then nothing is journalled,
+ * because a refusal is not an answer.
  *
  * ⚠ It reads `<base>` as it is in this checkout and never updates the remote
  * ref itself; `pr-ship` step 1 does that before calling this. A stale ref
@@ -66,17 +137,24 @@
  */
 
 import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { withoutGitLocation } from './git-env.mjs';
 import { readRun, recordEvent } from './run-journal.mjs';
-import { clearRevalidationHold, readState, recordRevalidationHold } from './run-state.mjs';
+import {
+  clearRevalidationHold,
+  readState,
+  readStateForSelection,
+  recordRevalidationHold,
+} from './run-state.mjs';
 import { POINTS as ALL_POINTS, REVALIDATES } from './lib/revalidation-points.mjs';
 import { takeUpEvidenceOf } from './queue/core.mjs';
 import { loadConfig, optionsWithPlanPath, resolveAdapter } from './queue/index.mjs';
 import { projectRootOfConfig } from './queue/index.mjs';
 import {
+  CLAIM_SCHEMA_VERSION,
   revalidateClaim,
   targetShaOf,
   unverifiableResult,
@@ -95,6 +173,7 @@ const parseArgs = (argv) => {
     outcome: false,
     point: null,
     ticket: null,
+    ownerDirected: false,
     base: 'origin/master',
     config: null,
     json: false,
@@ -105,6 +184,7 @@ const parseArgs = (argv) => {
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (i === 0 && arg === 'outcome') args.outcome = true;
+    else if (arg === '--owner-directed') args.ownerDirected = true;
     else if (arg === '--json') args.json = true;
     else if (arg === '--action-changed') args.actionChanged = argv[++i] ?? null;
     else if (arg === '--note') args.note = argv[++i] ?? null;
@@ -300,6 +380,79 @@ const answerUnverifiable = ({ runDir, ticket, point, json }, operation, cause) =
   process.exit(2);
 };
 
+/**
+ * A tracked claim record, by repository-relative path (RP-94).
+ *
+ * ⚠ It is a SECOND spelling of the path `claimPathFor` builds, and the two are
+ * kept in step by `test/template/owner-directed-revalidation.test.ts` (absent
+ * in a generated rig) › "matches the path claimPathFor actually builds, from
+ * the repository root and from a nested rig root" — a correspondence check
+ * rather than a comment asking the next reader to remember. The leading
+ * `(^|/)` is why a rig whose root sits below the git root is still matched;
+ * this mode resolves no queue config, so it cannot ask where that root is.
+ */
+const CLAIM_RECORD = /(^|\/)\.rig\/claims\/[^/]+\.json$/;
+
+const OWNER_DIRECTED = 'owner-directed';
+
+/**
+ * The BEFORE_PR verdict for work that has no item (RP-94).
+ *
+ * It carries the SAME `main:<path>` drift decision the ticketed path reaches —
+ * this mode drops the claim comparison because there is no claim, and drops
+ * nothing else. `ticket` is `null` rather than a placeholder: a record naming
+ * an item that does not exist is worse than one that admits it has none, and
+ * every reader downstream distinguishes them by that field.
+ *
+ * Pinned in the generator's `test/template/owner-directed-revalidation.test.ts`
+ * — absent in a generated rig — › "runs BEFORE_PR with no item and no claim
+ * when the default branch did not move under the branch" and › "HOLDs when the
+ * default branch moved under a path the branch touches".
+ */
+const ownerDirectedResult = ({ point, base, mergeBase, cited, changed, now, runDeclared }) => {
+  const source = changed.map((path) => `main:${path}`);
+  const held = source.length > 0;
+  return {
+    schemaVersion: CLAIM_SCHEMA_VERSION,
+    // 🔴 `mergeBase` is in the hash, and it is what keeps this id from being a
+    // CONSTANT. Without it the digest was `{mode, point, source}` alone — the
+    // same value for every `continue` that has ever run, and the same for any
+    // two holds naming the same paths. `revalidation-report.mjs` flattens every
+    // run into one typed-resolution index, so one `--action-changed false`
+    // recorded last week would mark a genuine hold today as already answered:
+    // the metric the report exists to produce, quietly wrong. It stays stable
+    // across RETRIES of the same checkpoint on the same branch, which is the
+    // property `answerUnverifiable`'s identity has and the one that matters.
+    id: createHash('sha256')
+      .update(JSON.stringify({ mode: OWNER_DIRECTED, point, mergeBase, source }))
+      .digest('hex'),
+    ticket: null,
+    mode: OWNER_DIRECTED,
+    point,
+    checkpoint: point,
+    result: held ? 'CHANGED' : 'CURRENT',
+    changed: held,
+    source,
+    action: held ? 'hold' : 'continue',
+    movedFingerprintSet: [],
+    sourcePointer: null,
+    evidence: {
+      claim: 'not compared: owner-directed work has no item, so there is no claim record',
+      tracker: 'not read: owner-directed mode resolves no queue adapter',
+      // 🔴 "Could not check" is recorded as itself, never as "checked and
+      // clean". With no run directory the hold and take-up refusals have
+      // nothing to read, and a reader who saw only `continue` would take the
+      // pair for having passed.
+      runState: runDeclared
+        ? 'read fail-closed: no unresolved revalidation hold, no declared take-up'
+        : 'NOT read: no RIG_RUN_DIR, so neither the revalidation hold nor the take-up was checked',
+    },
+    observedAt: now,
+    task: { changed: null, from: null, to: null },
+    main: { base, mergeBase, cited, changed },
+  };
+};
+
 /** Every adapter call in this script goes through here, or it can still crash. */
 const readAdapter = async (operation, read, context) => {
   try {
@@ -332,7 +485,31 @@ if (invokedDirectly()) {
   if (!known.includes(args.point)) {
     refuse(`unknown point: ${args.point ?? '(none)'}. This script knows ${known.join(', ')}.`);
   }
-  if (!args.ticket) refuse('--ticket is required: the item whose take-up this branch is.');
+  // RP-94. BEFORE_PR has two modes, and neither is ever inferred. `pr-ship`
+  // already named owner-directed work with no item as a legitimate path while
+  // this script refused every call without `--ticket`, so that path could not
+  // be walked at all. The mode is now stated at the call site — silence is a
+  // refusal, not a default, because a mode chosen by absence is a mode nobody
+  // reviewed.
+  if (args.ticket && args.ownerDirected) {
+    refuse(
+      '--ticket and --owner-directed are mutually exclusive: a branch that is an item\'s ' +
+        'take-up is not owner-directed work. Pass exactly one.',
+    );
+  }
+  if (args.ownerDirected) {
+    if (args.point !== 'BEFORE_PR') {
+      refuse(
+        `--owner-directed is a BEFORE_PR mode only; ${args.point} compares the claim record ` +
+          'itself and still needs --ticket.',
+      );
+    }
+  } else if (!args.ticket) {
+    refuse(
+      '--ticket is required: the item whose take-up this branch is. For owner-directed ' +
+        'work or a hotfix that has no item, pass --owner-directed instead.',
+    );
+  }
 
   const runDir = process.env.RIG_RUN_DIR || null;
 
@@ -342,16 +519,27 @@ if (invokedDirectly()) {
       refuse(`--action-changed must be true or false, got ${args.actionChanged ?? '(none)'}.`);
     }
     const { events } = readRun({ runDir });
+    // RP-94. An owner-directed detection carries `ticket: null`, so it cannot
+    // be addressed by key — `String(null)` would also match a literal ticket
+    // named "null". It is addressed by MODE instead, which is the only thing
+    // that distinguishes it. Without this, a `hold` the owner-directed path
+    // returned had no way to be answered at all: the skill's stated exit-2
+    // remedy was a command the script refused, which is the same shape of
+    // contradiction RP-94 exists to remove.
+    const subject = args.ownerDirected ? `${OWNER_DIRECTED} work` : args.ticket;
     const target = [...events]
       .reverse()
       .find(
         (e) =>
           e.kind === 'revalidation' &&
-          String(e.data?.ticket) === String(args.ticket) &&
-          e.data?.point === args.point,
+          e.data?.point === args.point &&
+          (args.ownerDirected
+            ? e.data?.mode === OWNER_DIRECTED
+            : e.data?.mode !== OWNER_DIRECTED &&
+              String(e.data?.ticket) === String(args.ticket)),
       );
     if (!target) {
-      refuse(`no revalidation of ${args.ticket} at ${args.point} in ${runDir} for this outcome to answer.`);
+      refuse(`no revalidation of ${subject} at ${args.point} in ${runDir} for this outcome to answer.`);
     }
     const now = new Date().toISOString();
     const actionRequired = args.actionChanged === 'true';
@@ -364,7 +552,10 @@ if (invokedDirectly()) {
         actionRequired,
         driftOrigin: 'unknown',
         resolvedAt: now,
-        ticket: args.ticket,
+        // `null`, never a placeholder, for the same reason the detection this
+        // answers carries none.
+        ticket: args.ownerDirected ? null : args.ticket,
+        ...(args.ownerDirected ? { mode: OWNER_DIRECTED } : {}),
         point: args.point,
         actionChanged: actionRequired,
         note: args.note,
@@ -376,11 +567,181 @@ if (invokedDirectly()) {
     process.stdout.write(
       args.json
         ? `${JSON.stringify(record, null, 2)}\n`
-        : `revalidation-outcome: ${args.ticket} at ${args.point} answers seq ${target.seq} — actionChanged ${args.actionChanged}\n`,
+        : `revalidation-outcome: ${subject} at ${args.point} answers seq ${target.seq} — actionChanged ${args.actionChanged}\n`,
     );
     process.exit(0);
   }
 
+  if (args.ownerDirected) {
+    // RP-94. BEFORE_PR for work that has no item: the same main-vs-branch drift
+    // comparison, with no tracker, no adapter and no claim record.
+    //
+    // 🔴 It sits ABOVE the queue-config resolution on purpose. "This mode reads
+    // no tracker" has to be a property of the control flow rather than a
+    // promise in a comment — nothing below this block runs, so a missing
+    // credential or an adapter name that does not resolve cannot reach it.
+    // Pinned by › "needs no tracker credentials: an adapter name that cannot
+    // resolve is never reached".
+    //
+    // The refusals below are what keep the mode from becoming a way around the
+    // claim chain, and every one is decided BEFORE anything is journalled: a
+    // refusal is not an answer, so it leaves no revalidation record behind.
+    //
+    // 🔴 Read FAIL-CLOSED. `readState` is the permissive reader and its own
+    // header forbids exactly this use — "a corrupt file there may be hiding a
+    // persisted stop" — so an unreadable run refuses here instead of reading as
+    // "this run declares nothing". The first version used `readState`, and a
+    // truncated `state.json` carrying a take-up was measured continuing.
+    let state = {};
+    if (runDir) {
+      try {
+        state = readStateForSelection(runDir);
+      } catch (error) {
+        refuse(
+          `--owner-directed refused: this run's state could not be read (${runDir}): ` +
+            `${error.message}. An unreadable run may be hiding a stop.`,
+        );
+      }
+    }
+
+    // 🔴 The refusal this mode most needs, and the one its first version did
+    // not have. A ticketed BEFORE_PR that holds or comes back UNVERIFIABLE
+    // latches `revalidationHold`; re-running the same checkpoint here was
+    // MEASURED exiting 0 with nothing in the repository changed — the exact
+    // bypass RP-94 names. Neither other refusal can fire in that state, and
+    // that is structural rather than unlucky: `takeUps` is never populated on
+    // the default `plan-md` adapter at all, and the commonest hold is a
+    // MISSING claim record, which is precisely when the branch writes none.
+    // This one is adapter-independent because `recordRevalidationHold` is.
+    const hold = state.revalidationHold;
+    if (hold) {
+      // A malformed hold still refuses — it is a hold either way — but it must
+      // not print `undefined at undefined`, which reads as a broken command
+      // rather than as the stop it is.
+      const describe = (value, fallback) => (typeof value === 'string' ? value : fallback);
+      refuse(
+        `--owner-directed refused: this run carries an unresolved revalidation hold ` +
+          `(${describe(hold.ticket, 'an unnamed item')} at ` +
+          `${describe(hold.checkpoint, 'an unnamed checkpoint')}, ` +
+          `${describe(hold.result, 'result unrecorded')}, detection ` +
+          `${describe(hold.detectionId, 'unrecorded')}). ` +
+          'Resolve it with `revalidate.mjs outcome`; re-running the checkpoint in the other ' +
+          'mode is not a resolution, it is the bypass this mode refuses.',
+      );
+    }
+
+    const takeUps = state.takeUps;
+    // A present-but-unreadable take-up record is a refusal, not an empty one:
+    // `Object.keys` answers `[]` for a number and for a list, which would turn
+    // "this cannot be read" into "there is nothing here".
+    if (
+      takeUps !== undefined &&
+      (typeof takeUps !== 'object' || takeUps === null || Array.isArray(takeUps))
+    ) {
+      refuse(
+        `--owner-directed refused: this run's take-up record is not readable ` +
+          `(takeUps is ${Array.isArray(takeUps) ? 'a list' : typeof takeUps}, expected an object).`,
+      );
+    }
+    const takenUp = Object.keys(takeUps ?? {});
+    if (takenUp.length > 0) {
+      refuse(
+        `--owner-directed refused: this run already declares a take-up (${takenUp.join(', ')}). ` +
+          'A run holding an item revalidates with --ticket; owner-directed is for work with none.',
+      );
+    }
+
+    let mergeBase;
+    try {
+      mergeBase = git(['merge-base', args.base, 'HEAD']).trim();
+    } catch (error) {
+      refuse(
+        `--base ${args.base} is not a revision this checkout can compare against: ${error.message}`,
+      );
+    }
+
+    // Any claim record this branch TOUCHES, in either direction.
+    //
+    // 🔴 `--no-renames`, and no `--diff-filter`, because both narrower forms
+    // were measured letting a claim record through. `--diff-filter=AM` reports
+    // NOTHING for `git mv .rig/claims/RP-1.json .rig/claims/RP-2.json` — git
+    // calls it `R100` — so a branch that demonstrably ends up carrying a claim
+    // record passed the check. And a branch that DELETES its claim makes the
+    // ticketed call `UNVERIFIABLE`, so excluding `D` left the deletion on the
+    // bypass path rather than out of scope. `--no-renames` splits a rename back
+    // into its delete and its add, which is what puts both halves in front of
+    // the filter. Match the CLASS — "this branch touched the claim store" —
+    // rather than enumerating the statuses that class can wear.
+    const claimsTouched = pathsOf(
+      git(['diff', '--name-only', '--no-renames', '-z', mergeBase, 'HEAD']),
+    ).filter((path) => CLAIM_RECORD.test(path));
+    if (claimsTouched.length > 0) {
+      refuse(
+        `--owner-directed refused: this branch touches tracked claim records ` +
+          `(${claimsTouched.join(', ')}). A branch that writes, moves or removes a claim is ` +
+          "an item's take-up; revalidate it with --ticket.",
+      );
+    }
+
+    const branchPaths = pathsOf(git(['diff', '--name-only', '-z', mergeBase, 'HEAD']));
+    const mainPaths = pathsOf(git(['diff', '--name-only', '-z', mergeBase, args.base]));
+    const cited = [...new Set([...branchPaths, ...citedByPremises(runDir)])];
+    const mainChanged = mainPaths.filter((path) => cited.includes(path));
+    const result = ownerDirectedResult({
+      point: args.point,
+      base: args.base,
+      mergeBase,
+      cited,
+      changed: mainChanged,
+      now: new Date().toISOString(),
+      runDeclared: Boolean(runDir),
+    });
+
+    if (runDir) {
+      recordEvent({ runDir, kind: 'revalidation', data: result, now: result.observedAt });
+      // 🔴 No run-level revalidation hold is recorded here, and the reason is
+      // NOT the one first written down. That said "a hold written here could
+      // never be cleared" — which stopped being true the moment `outcome
+      // --owner-directed` computed the very id `clearRevalidationHold` matches
+      // on. The real reason is narrower: `recordRevalidationHold` requires a
+      // string ticket, and this mode has none to give it without inventing
+      // one, which is the thing the whole mode refuses to do.
+      //
+      // ⚠ **State the asymmetry rather than let a reader assume symmetry.** A
+      // ticketed hold has TWO stops — the exit code, and a latch that
+      // `queue/index.mjs` and `unresolvedBlockingDetectionOf` both read (the
+      // latter also requires a string ticket, so it skips this one). An
+      // owner-directed hold has ONE: the exit code below. A caller who ignores
+      // it is not stopped a second time. Widening the latch to a ticketless
+      // hold is a run-state schema change — Tier 2, and not this hotfix's.
+    }
+
+    if (args.json) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    } else {
+      const detail = result.source.length > 0 ? ` — ${result.source.join(', ')}` : '';
+      process.stdout.write(
+        `revalidate ${args.point}: ${OWNER_DIRECTED} (no item) ${result.action}${detail}\n`,
+      );
+      if (!runDir) {
+        // Loud, on the normal path, not only in the JSON: a run this command
+        // could not inspect must not read as a run it inspected and cleared.
+        process.stdout.write(
+          '  ⚠ no RIG_RUN_DIR: the revalidation-hold and take-up refusals were NOT checked,\n' +
+            '    and nothing was journalled. This is not evidence that neither exists.\n',
+        );
+      }
+      if (result.action === 'hold') {
+        process.stdout.write(
+          '  re-read the default branch on those paths before opening or updating the PR,\n' +
+            '  then record what the re-read concluded:\n' +
+            `    node .claude/scripts/revalidate.mjs outcome --point ${args.point} --owner-directed --action-changed <true | false>\n`,
+        );
+      }
+    }
+    process.exit(result.action === 'hold' ? 2 : 0);
+  }
+
   const projectRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
   const configPath = args.config ?? join(projectRoot, '.claude', 'queue.json');
   // 🔴 The queue CONFIG, not the tracker behind it. `readAdapter` covers every

package/templates/agent-os/universal/.claude/skills/pr-ship/SKILL.md

@@ -57,13 +57,66 @@ blockers.
    confidently-wrong reviews. Everything below is scoped to this diff.
 
    Then, on the fetched ref, ask whether the branch is still the branch the run
-   took up:
+   took up. **Two paths, and you state which one — the command infers neither.**
+   A branch that is a queue item's take-up:
 
    ```sh
    node .claude/scripts/revalidate.mjs --point BEFORE_PR --ticket <item-id> --base origin/<default>
    ```
 
-   It runs the existing revalidation chain against the tracked, versioned
+   Owner-directed work or a hotfix that has **no item** — the case step 4 below
+   already tells you to declare to the reviewers:
+
+   ```sh
+   node .claude/scripts/revalidate.mjs --point BEFORE_PR --owner-directed --base origin/<default>
+   ```
+
+   🔴 **The second path is not a lighter checkpoint, and it is never a skip.**
+   It runs the same `main:<path>` comparison and holds on the same exit 2; what
+   it drops is the claim comparison, because work with no item has no claim to
+   compare. It resolves no queue config, so it reaches no tracker and needs no
+   credentials. Passing both flags, or neither, is exit 1.
+
+   **Four refusals** — exit 1, nothing journalled — keep it from being the way
+   around a claim or revalidation failure. It is refused when this run carries
+   an **unresolved revalidation hold** (what the ticketed path writes when it
+   holds or answers `UNVERIFIABLE`), when this run **declares a take-up**, when
+   the branch **touches a tracked `.rig/claims/*.json`** in any direction —
+   added, modified, removed or renamed — and at `BEFORE_CLOSE`. So re-running a
+   held ticketed call in this mode does not get past it: resolve the hold with
+   `outcome` instead.
+
+   ⚠ **What those refusals do not cover**, because a governance mode is trusted
+   exactly as far as it is described:
+
+   - **With no `RIG_RUN_DIR` there is no run state to read**, so the hold and
+     take-up refusals cannot fire — and nothing is journalled. The command says
+     so on stdout and in `evidence.runState`; it is not evidence that neither
+     exists. An attended gate run is exactly this shape, so read that line.
+   - The claim refusal reads the **branch diff**, so a claim record already on
+     the default branch, or written and not committed, is not seen.
+   - **`--base` is the sole authority for the verdict here**, the claim
+     comparison that would otherwise survive a wrong base being absent. Pass
+     the fetched `origin/<default>`, not a local copy and not `HEAD`.
+   - Nothing can prove an item does not exist. The rest is your word, recorded
+     as such, with `ticket: null` and no invented id.
+
+   Pinned in the generator's `test/template/owner-directed-revalidation.test.ts`
+   (absent in a generated rig) › "refuses when this run carries an unresolved
+   revalidation hold", › "refuses when the declared run already carries a
+   take-up", › "refuses when the branch RENAMES a claim record — the case
+   --diff-filter=AM could not see" and › "says out loud that an undeclared run
+   checked neither the hold nor the take-up".
+
+   **Exit 2 here is a HOLD with the same shape as the ticketed one**, and the
+   same two-step remedy: re-read the default branch on each named path, then
+   record what the re-read concluded — `node .claude/scripts/revalidate.mjs
+   outcome --point BEFORE_PR --owner-directed --action-changed <true | false>
+   --note '…'` — and come back through step 0. The owner-directed detection
+   carries no ticket, so `--owner-directed` is how the outcome addresses it;
+   the ticketed `--ticket <item-id>` form below cannot match it and is refused.
+
+   The ticketed path runs the existing revalidation chain against the tracked, versioned
    `.rig/claims/<item-id>.json`: the content-blind `scope` fingerprint set is
    authoritative here, while `takeUps` / `updatedAt` remain evidence only. It
    also names what the default branch changed since this branch forked on paths
@@ -71,14 +124,18 @@ blockers.
    journals one `revalidation` event at `point: BEFORE_PR`; **exit code 2 is a HOLD**, with one blocker per named source: re-read the item, or the default
    branch on that path, record what the re-read concluded —
    `node .claude/scripts/revalidate.mjs outcome --point BEFORE_PR --ticket <item-id> --action-changed <true | false> --note '…'`
-   — and come back through step 0. A hold with no outcome is counted by the
-   report as a re-read the run skipped. A missing, untracked, unreadable or
+   — and come back through step 0. **That `--ticket` form is this path's, not
+   both paths'** — the owner-directed detection carries no ticket for it to
+   name, and its own `--owner-directed` outcome is written out above. A hold
+   with no outcome, in either mode, is counted by the report as a re-read the
+   run skipped. A missing, untracked, unreadable or
    unsupported claim is `UNVERIFIABLE`, exits 2, and stops automatic progress;
    so is a tracker whose adapter the command cannot READ, which means the
    question was never put rather than that the claim record is unreadable.
    Neither is ever read as a pass. Exit 1 is the command refusing (unknown
-   point, no ticket, a base that is not a revision, or a queue config that does
-   not resolve): fix the call or the config — the message says which. Its limits are its own header's; the
+   point, neither mode or both, a base that is not a revision, or a queue config
+   that does not resolve — plus, on the owner-directed path, the four refusals
+   above): fix the call or the config — the message says which. Its limits are its own header's; the
    cited-path set is a labelled assumption, not a recorded fact. Pinned in the
    generator's `test/template/revalidate.test.ts` (absent in a generated rig) ›
    "continues when only updatedAt moved and still reports the marker evidence"
@@ -182,9 +239,13 @@ blockers.
    **Whatever you launch, pass it the text of the queue item this branch
    implements.** A reviewer given only a diff cannot check the change against
    what was asked: a cold context has no way to know, and reconstructing it from
-   the PR description would mean trusting the run under review. If there is no
-   item — owner-directed work, a hotfix — say so when launching, and the
-   reviewer skips that check openly instead of guessing at it.
+   the PR description would mean trusting the run under review. When there is
+   no item — owner-directed work, a hotfix — launch every reviewer with the
+   words **`no item — owner-directed`** instead. That skips the item-contract
+   check, openly, and **nothing else**: the checks, the routing, the security,
+   code and prose/governance reviews, the coverage check and the DoD all still
+   run. It is one check narrower than a ticketed fan-out, not a cheaper gate,
+   and the same words are what step 1's `--owner-directed` call records.
 
    🔴 **The triggers below are lane-independent and may only ADD.** They read
    *what the code does*; the router reads *paths*, and a path cannot say that a

package/templates/hash-history.json

@@ -8,7 +8,8 @@
     "0.5.0",
     "0.6.0",
     "0.6.1",
-    "0.6.2"
+    "0.6.2",
+    "0.7.0"
   ],
   "files": {
     ".agents/skills/check-premises/SKILL.md": {
@@ -24,7 +25,8 @@
         "eb52ef41269018107534d8dc2f552c57698e1677a1e76b5e666b5d09c007cac0",
         "47922b182915cb92696f851174f2e88c4ae8c67dc119ef39a3a597ef1300fab5",
         "57f6add0504db45e7577474f97705fe474310e4cd3310cdb348a2c64eabe88cd",
-        "18f4300de4c4c7ea380d726fb109fa224da950ef0a4cea5015ab1d408b823be5"
+        "18f4300de4c4c7ea380d726fb109fa224da950ef0a4cea5015ab1d408b823be5",
+        "0a1b6575f6df8139766c8e71ba7320e14d2a5a5ed8ab26b6b43f7a006153d37d"
       ]
     },
     ".agents/skills/new-invariant/SKILL.md": {
@@ -56,7 +58,8 @@
       "since": "0.5.0",
       "hashes": [
         "a2fb0d03c65701af9d2d69cbcb2582ae573f097b1e1071eb2916e5e4f7832b37",
-        "9616e4767942b2021e34ab7bb76eec9a5c280cc608a0756abb02743741d5fc8a"
+        "9616e4767942b2021e34ab7bb76eec9a5c280cc608a0756abb02743741d5fc8a",
+        "a6340b95a03000b89fb27f5357cdd9c7ec12b714054b5334b61a30da600405e8"
       ]
     },
     ".agents/skills/ro-debug/SKILL.md": {
@@ -117,7 +120,8 @@
       "hashes": [
         "c7c86de47b601dcb594ba8d8e23b5624ef8d47dafeddbc1aadd351c72e051d83",
         "ece5a81db41bd48695a1a009239837b682d247baf6d19214eaa859a7519ab246",
-        "1646ed80de5268a886a2e861124cb3b871fa46df1857991a645667601f52253b"
+        "1646ed80de5268a886a2e861124cb3b871fa46df1857991a645667601f52253b",
+        "3d7bcbccd9a163f076bd1d8cc63021b7c8605d1cb1df24a3536db3e57c1d7630"
       ]
     },
     ".claude/hooks/dod-checks.json": {
@@ -143,7 +147,8 @@
         "4d396f412fc53094188b14348c5af4e79c7542a182630c20c4687d79899c5b0e",
         "e7a513216ebbceaa7f11ec8fb611de8bb5d5925dfdfd75b779dcb7c0ee6e83cc",
         "78047f42dda65076dd2cdb73ad530553db3d4a6f3ea7f0729590ac7286323cb1",
-        "5782d91c6c54155ad8bf3e107b6574b3ad4c97baa7be673a5ed252c70b387300"
+        "5782d91c6c54155ad8bf3e107b6574b3ad4c97baa7be673a5ed252c70b387300",
+        "5ffaba69ffc9b6c39cd3c97c4f29b44627416d55793b50aa1a26ffe5efc45497"
       ]
     },
     ".claude/hooks/guard-core-purity.mjs": {
@@ -151,7 +156,8 @@
       "hashes": [
         "e36fbb92ee8395c6686fef582f29f2701747074b3b781bed42fe068f5c000bd7",
         "282faa364c2d152808cd92ff7e39da26fd0549a5b2d0af9711d3453be2c666eb",
-        "4bdd9a38b1aa4050c109f7809ef924be4d411f5720b6030d57c5264ce3df556d"
+        "4bdd9a38b1aa4050c109f7809ef924be4d411f5720b6030d57c5264ce3df556d",
+        "15de3ae9a6007270f7b10d71ff9940160aadabd8f5b0995662fc324c483807e5"
       ]
     },
     ".claude/hooks/guard-rulebook.mjs": {
@@ -175,7 +181,8 @@
       "hashes": [
         "93d4fa0fd1c18261cc8ef2b1ae2abe3a0200cc4b5a7b1d1d4ae433ca92c514b1",
         "8deda7061122b69d72e708222ef2d38a971bb713269ec7fd1ca3440fe0a1150f",
-        "df325e672793e06b8315e64b59a329775d110fc166176074ff3bb8dea557c561"
+        "df325e672793e06b8315e64b59a329775d110fc166176074ff3bb8dea557c561",
+        "60959520dbe326880d284c9e2b76a2a89f72b981ea6a2cb76e2a252b1233bdfc"
       ]
     },
     ".claude/hooks/inject-rules.mjs": {
@@ -197,7 +204,8 @@
     ".claude/hooks/lib/hook-input.mjs": {
       "since": "0.6.2",
       "hashes": [
-        "c40320d90e9585a52026e074e399b6883a0dfed704115b28e8da4dea284cf85f"
+        "c40320d90e9585a52026e074e399b6883a0dfed704115b28e8da4dea284cf85f",
+        "3be3d4af4a25536d2a2bac0441a1370be7efafb5f8aa737b195bdce77db0091b"
       ]
     },
     ".claude/queue.json": {
@@ -237,14 +245,16 @@
         "518d9b3d7cbae50f30c86d33b2b4bbea11ab3ba6cfef270876e92604b2af5f50",
         "389484f0846c3dd8207c0f41bd56409103fbcc7f58b94b1bf4bd1d81b5af0e87",
         "a2e10499a0bcd2cdc32f3986d27b59077c86e524d40323faabb2e5d78afc002c",
-        "c94c33d7ccbd46f191948325dfc7f68ce13b0d3a9470215de1de3f06b1499111"
+        "c94c33d7ccbd46f191948325dfc7f68ce13b0d3a9470215de1de3f06b1499111",
+        "ce90c1e697fdd444ca3fe2203d7991645f2c284c413ae187e4d6d6c618af52c9"
       ]
     },
     ".claude/rules/node-ts.md": {
       "since": "0.2.0",
       "hashes": [
         "3db68a4280cc30655be56fed9385179c378f560f3df55e21952a24066427e845",
-        "be3b7bf901ef250b5957a37815b9a339083f7a8c4ecc866aeb12e3a0797c3c09"
+        "be3b7bf901ef250b5957a37815b9a339083f7a8c4ecc866aeb12e3a0797c3c09",
+        "b74979a3a1e57b69a6e1b3ee2d0cf9fc671d4487c411dc947e9ad0a47ac56dd1"
       ]
     },
     ".claude/rules/workflow.md": {
@@ -285,12 +295,24 @@
         "b022399f287cdce1bcb07329c0aab44bf99714b5f0515f274c962f41ea072b86"
       ]
     },
+    ".claude/scripts/lib/claim-records.mjs": {
+      "since": "0.7.0",
+      "hashes": [
+        "acb1d5702a826832977e7eb01b76c50cab19292528901f1b33693e561dbb0a24"
+      ]
+    },
     ".claude/scripts/lib/gate-coverage.mjs": {
       "since": "0.6.0",
       "hashes": [
         "1ef7f355071a747d8a8d9cd5e2072a19fe3d8c11a0e2a5f884d95a33fb95f12d"
       ]
     },
+    ".claude/scripts/lib/revalidation-evidence.mjs": {
+      "since": "0.7.0",
+      "hashes": [
+        "513369213374cf2c5415c7d5ea1f6d5c67300c77cec7af3e9190e710b156969f"
+      ]
+    },
     ".claude/scripts/lib/revalidation-points.mjs": {
       "since": "0.6.0",
       "hashes": [
@@ -305,6 +327,12 @@
         "60fab2cc9f2028bccf6139e6a744406b4a86a9039d1367f3cef409902e9b327d"
       ]
     },
+    ".claude/scripts/lib/shell-tools.mjs": {
+      "since": "0.7.0",
+      "hashes": [
+        "402428f4b2c4e507652d775e43b26c1e0a74aadb2cedec3156ac186af17d667a"
+      ]
+    },
     ".claude/scripts/lib/verdict.mjs": {
       "since": "0.5.0",
       "hashes": [
@@ -318,7 +346,8 @@
         "21083ff7baeebf8aedbdf85679a353f671276a9e0201a58a8235ae63f55f081c",
         "ceb6d35fa028f9c5e5e2d5965c627095d5ba80c37191a584627b4bc645b6be15",
         "efa193dc543237d82dcb371fa1df6483ccd43c1db88d0e218f5d89769564974c",
-        "bed44df40412a7edac96914de21edc796df604ddc275ff1a02764dfcc4d4ede7"
+        "bed44df40412a7edac96914de21edc796df604ddc275ff1a02764dfcc4d4ede7",
+        "b3893c365de37ef6d9d04ab933296b9fcf09a0886197d7e12313fa63eacdbd89"
       ]
     },
     ".claude/scripts/queue/as-of.mjs": {
@@ -340,7 +369,8 @@
         "214f36e39f3809da5a121f404005d16a694280ca672ed10150b1b07d47912f6a",
         "d8a5916bae71efcc6a21978af713112c9ec33a7554fd07f5978bdf2c3633b560",
         "1804c2351a4f3042dc6a3fb4203f96e98ae12bec32569b99bda77d002d6ba5f2",
-        "b81ae3181e02b9c1c3f0e954688490ab3db3961381c2dc397c47c651c9d07f88"
+        "b81ae3181e02b9c1c3f0e954688490ab3db3961381c2dc397c47c651c9d07f88",
+        "c9902da15d06de3e952352115db0288433520eae2caac1f70ee6e06753d1f444"
       ]
     },
     ".claude/scripts/queue/gate-rounds.mjs": {
@@ -355,7 +385,8 @@
         "f473f0ee5fc469f47b2b21ee601310944faa1abed21942e97ed251aba826cd5d",
         "86489ac7fcd06e43e31fb3d0ac9ab23174ef9c95196b08f127f1ae74da620c0c",
         "f84148fee47109a388a248c51d3eb40919ce341785b561dd4135b69c6fedabf3",
-        "5ab8f741f17efb935b11caf245edf2b562cb887020c2a43d45464158342c933a"
+        "5ab8f741f17efb935b11caf245edf2b562cb887020c2a43d45464158342c933a",
+        "b5349837d16de0966139f5b65e2800486592f1b24d7e87087c2b7212cead479d"
       ]
     },
     ".claude/scripts/queue/index.mjs": {
@@ -364,7 +395,8 @@
         "cd149245dc29ef7489ae0e5394fa5a063dea2cc017bd3cbbface1ace6f8d7b46",
         "7db3c17b781e6876b4822afd09e6affa97e46607b63d443975d987daf1f14464",
         "9edd70b5960f367958e8e7500150b4edd285c99869cca803e40e0537d2d347b0",
-        "4cf917ac06708e1068dfe9f8bbebc9376c4748526bd669b9bea32929ba996d0a"
+        "4cf917ac06708e1068dfe9f8bbebc9376c4748526bd669b9bea32929ba996d0a",
+        "b4a0789be7ad4b401de872edb06665bca349048178b4dd6c5db848ca44f7c977"
       ]
     },
     ".claude/scripts/queue/jira.mjs": {
@@ -375,7 +407,8 @@
         "13c301f828d4402fcf81e7e0b2b1d22472cbdb50f6fd606770056af4ec215e51",
         "b8be5855809c0d44ece94858456098663296c17c5ad9abb1ea2cf1a8f48ca491",
         "3fc8ff9a06a2e22355a660a31e2943a97f50869f7e5726f768a7931d17b64b5b",
-        "f44203af187e855b9f738f8dbedfd313abf9d6a5cc29182fb46cd58d70698d7a"
+        "f44203af187e855b9f738f8dbedfd313abf9d6a5cc29182fb46cd58d70698d7a",
+        "c2f2af8ac5eadd8d35a15bcdeffe585e32c6f99b4e6ab9ace0f9d7fd9d694943"
       ]
     },
     ".claude/scripts/queue/plan-md.mjs": {
@@ -384,7 +417,8 @@
         "d137dad23f263b1a12b04b46625247fea648ded36d0fea7c5b4e4f2211a142eb",
         "07eab69bd86b19b7a1f01eb14efe4f8c007481806cbe029d4014fe9bf0703000",
         "27d7ae3832a32219d5c0ab136bc542388eb686e9f34053c3058104cdeea1574d",
-        "1320909605824b2cd1ff57878e463ef360463b2b175d2152638eda2dff72f5ea"
+        "1320909605824b2cd1ff57878e463ef360463b2b175d2152638eda2dff72f5ea",
+        "816aec4cb84492370972f71813a9fec7c0309e5f501951a93620a37cb318ac39"
       ]
     },
     ".claude/scripts/queue/state.mjs": {
@@ -403,14 +437,16 @@
       "since": "0.6.0",
       "hashes": [
         "32f847a2a3a5136cabcb42f6447da9f8cf98e2d20512212ee5201461128d7798",
-        "b62348a27bcaa1d62a0e4ddd53873fab6cb75f9af8e8c69d24f6ce81c592c4e3"
+        "b62348a27bcaa1d62a0e4ddd53873fab6cb75f9af8e8c69d24f6ce81c592c4e3",
+        "b151045e8083c398e94571b35dc9568dfa0102abcb847cdf764f6f694914d53e"
       ]
     },
     ".claude/scripts/revalidation-report.mjs": {
       "since": "0.6.0",
       "hashes": [
         "b99a3537158c2851698bfac027f7061811d7d428c3eea57f3ce0f58ea75dc249",
-        "78adac5c8f696f2c9cc86f404abf1d55604ccb10f11dd612501c14d4cf5935b1"
+        "78adac5c8f696f2c9cc86f404abf1d55604ccb10f11dd612501c14d4cf5935b1",
+        "fed627d2c8f0f5e6a4524b7015ac7a1cb5051a8c316ff4544af18be9c61eb163"
       ]
     },
     ".claude/scripts/run-journal.mjs": {
@@ -423,7 +459,8 @@
       "since": "0.5.0",
       "hashes": [
         "5682b4ef1e63b83e1398da4959d8b34f52aede38f896557c041687d101df015f",
-        "82c83fe9a66ff1a48c9e23fdfe84eef7da0de337c420e8d870085e7078d6f5e2"
+        "82c83fe9a66ff1a48c9e23fdfe84eef7da0de337c420e8d870085e7078d6f5e2",
+        "c502cefafdc720d178de685e8372d2c140cb2663517c9d88b5345a9f0c50d0de"
       ]
     },
     ".claude/scripts/stop-flag.mjs": {
@@ -454,7 +491,8 @@
         "48212660b2823725c2c9ee785ad739701e4c0e4733b275201a544df1abba28d0",
         "55a6938b4d9967291a26e93301e34e5ffdef74a88f8c773a4d11b5d87d864fff",
         "713718fbb2cda132f05665b29b8f1108a6305729b5e7c789d2053d117c13e08e",
-        "e588ab05bee707a099c80c9ea399008be31488e616f3db3c0598f66f3d1b3a52"
+        "e588ab05bee707a099c80c9ea399008be31488e616f3db3c0598f66f3d1b3a52",
+        "a180578d6e6de6a21900ff2f8a8ade2242170d16d2dd95574e5004435d870b9b"
       ]
     },
     ".claude/skills/check-premises/SKILL.md": {
@@ -475,7 +513,8 @@
         "eb52ef41269018107534d8dc2f552c57698e1677a1e76b5e666b5d09c007cac0",
         "47922b182915cb92696f851174f2e88c4ae8c67dc119ef39a3a597ef1300fab5",
         "57f6add0504db45e7577474f97705fe474310e4cd3310cdb348a2c64eabe88cd",
-        "18f4300de4c4c7ea380d726fb109fa224da950ef0a4cea5015ab1d408b823be5"
+        "18f4300de4c4c7ea380d726fb109fa224da950ef0a4cea5015ab1d408b823be5",
+        "0a1b6575f6df8139766c8e71ba7320e14d2a5a5ed8ab26b6b43f7a006153d37d"
       ]
     },
     ".claude/skills/new-invariant/SKILL.md": {
@@ -510,7 +549,8 @@
         "368a50be809f7be865d6d29ab3e54b9d69acd2ea3ba7929c0edeef161c2521b7",
         "75adb84414a330db621ff4f1363b3926f537133199236a9e25bb9880b935e02e",
         "a2fb0d03c65701af9d2d69cbcb2582ae573f097b1e1071eb2916e5e4f7832b37",
-        "9616e4767942b2021e34ab7bb76eec9a5c280cc608a0756abb02743741d5fc8a"
+        "9616e4767942b2021e34ab7bb76eec9a5c280cc608a0756abb02743741d5fc8a",
+        "a6340b95a03000b89fb27f5357cdd9c7ec12b714054b5334b61a30da600405e8"
       ]
     },
     ".claude/skills/ro-debug/SKILL.md": {
@@ -565,7 +605,14 @@
       "hashes": [
         "c676647d585ec87427545a391598706ecaa74dfe413a7e05877e336bf8942874",
         "89d999c068ef5b6e48913c15a165359e66b1f505b9f97c145d8c730cbf42d09a",
-        "1fc2fc35b04fa4ad0859841af72f45695bc346d1a1a9b20ba5d971d48888a910"
+        "1fc2fc35b04fa4ad0859841af72f45695bc346d1a1a9b20ba5d971d48888a910",
+        "fa9a34eb9f889910e55269b76172608b989d553583de38af34316a31f4ad570b"
+      ]
+    },
+    ".rig/revalidation.json": {
+      "since": "0.7.0",
+      "hashes": [
+        "312b59f80fcbcf2897ef80fb54be236fb6b2b1745f705dae8e66c58f0bbd3099"
       ]
     },
     "AGENTS.md": {
@@ -603,7 +650,14 @@
     "docs/decisions/codex-adapter.md": {
       "since": "0.5.0",
       "hashes": [
-        "30e55d866d9a2c7359e594181070c63b1974d9df36e000caf419229284303a2e"
+        "30e55d866d9a2c7359e594181070c63b1974d9df36e000caf419229284303a2e",
+        "ebf0ef61407944373c862d37e6a80d4965ece72304b931428c6b3fcc5d9527c4"
+      ]
+    },
+    "docs/decisions/content-blind-revalidation.md": {
+      "since": "0.7.0",
+      "hashes": [
+        "d640a152428ea4cc6a5f0a19be58e0d23f3a99c44b0ad0b72152ec7b48fe5bfd"
       ]
     },
     "docs/decisions/fail-open-guards.md": {

package/templates/release-ledger.json

@@ -8,5 +8,6 @@
   "0.5.0": "d78d0e77307a2be128de46ff4f64e3c146b5df2b",
   "0.6.0": "29ca0543368e922349945e52541a92b46ddcc5bd",
   "0.6.1": "f1d1e3dbd2161545d77ee5e7f90fa8e74b8a9f3e",
-  "0.6.2": "2a1fc8e10cd2b65deb5c95d937fd7de39f2c92a2"
+  "0.6.2": "2a1fc8e10cd2b65deb5c95d937fd7de39f2c92a2",
+  "0.7.0": "6589db36e1daa63a99ec595191db1cccf7373196"
 }