create-agent-rig 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -14,6 +14,53 @@ second recorded departure; its own entry states the direction and the reason,
 and this paragraph deliberately does not restate them — a numbering rule with
 two copies of its exceptions is the shape 0.8.0 exists to remove.
 
+## 0.9.1
+
+**A patch, numbered by the owner.** Every entry corrects existing behaviour;
+two of them (RP-182, RP-59) do it by recording or reporting something new.
+Nothing is added to what `create`, `init` or `upgrade` install beyond the
+corrected files, the contract version stays `1.0`, and the application
+skeletons remain deprecated and scheduled for removal in 0.10.0 exactly as
+0.9.0 announced.
+
+### Fixed
+
+- **`init` records the files it kept.** When `init` finds a payload path
+  already present and leaves it alone, the manifest now records that file's
+  hash under `kept`, so a later `upgrade` can say whether the file is
+  unchanged or edited since `init` found it instead of reporting it with no
+  history (RP-182). A manifest with nothing kept is written exactly as
+  before.
+- **`memory load` passes Memory a deadline of its own.** A `load` that names
+  no `--timeout-ms` gets `--timeout-ms 45000` appended, below the rig's 60 s
+  kill. A well-formed `--timeout-ms <value>` pair raises that kill to the
+  value plus 15 s when that is above 60 s, capped at Node's timer limit of
+  2 147 483 647 ms; any other spelling passes through unchanged. `doctor`'s
+  arguments are untouched. The README example adds `--cwd .`, which the Memory
+  owner names as part of Memory's own contract (RP-183).
+- **`reconcile-external-prs.mjs` works on a `gh` that does not serve
+  `authorAssociation`** from `gh pr list`: the association is fetched
+  separately and kept only when it answers for the same pull request, and a
+  failed lookup leaves those pull requests untrusted rather than failing the
+  sweep. A failure now names the one cause the evidence shows, with terminal
+  control sequences and credential shapes removed from the detail (RP-99).
+- **The queue reports a Blocks link the ticket body says was removed but the
+  tracker still carries** — a body line of the form
+  `The Blocks link A -> B is removed` — as a `link-contradicted-by-body`
+  hygiene finding (RP-59).
+- **A Jira triage proposal with a long `change` is filed, not refused by the
+  tracker.** Jira rejects a summary over 255 characters; the summary is now
+  cut to fit and the full text stays in the description (RP-121).
+
+### Generator CI (not a rig-facing change)
+
+Test-fixture cleanup goes through one bounded-retry helper, and an audit holds
+every other recursive removal and every in-repository fixture to a written
+reason. The four child-process time bounds are measured inside the child, and
+the package-manager CLI-start cases carry their own measured budget. The e2e
+installs run in a vitest group of their own, so they no longer compete with
+the template tests on the Windows full-suite runner (RP-158).
+
 ## 0.9.0
 
 **The harness ↔ Memory boundary is executable, and the rig is a consumer of

package/README.md

@@ -65,7 +65,13 @@ it does not. Each conflict names the file, why it was kept, and the path to the
 new version so you can diff it yourself.
 
 How it knows: `create` and `init` write `.claude/.rig-manifest.json` — the rig
-version plus a hash per installed file. **Commit it**; without it in the
+version plus a hash per installed file. A file `init` found already in place and
+left alone is recorded separately, under `kept`, with the hash of the bytes it
+found, and never as the rig's (`packages/cli/test/init.test.ts` › "records what
+it kept, with the sha256 of the bytes actually on disk — never in `files`"). An
+`upgrade` conflict on such a file says it was kept by init and whether it was
+edited since (`packages/cli/test/upgrade.test.ts` › "says "edited since"
+instead, once the disk sha no longer matches what init recorded"). **Commit it**; without it in the
 repository the command is blind on CI and on a colleague's machine. Rigs
 installed before 0.4.0 have no manifest, so the package also carries the hashes
 of every release whose published commit is on record (0.2.0 onward — 0.1.0's
@@ -112,7 +118,7 @@ Both bins answer the same handshake, and the rig consumes Memory only through it
 ```sh
 npx create-agent-rig@latest --version --json          # {"schemaVersion":1,"name":"create-agent-rig","version":"…","contractVersion":"1.0"}
 npx create-agent-rig@latest memory doctor --json      # handshake first, then Memory's doctor, answer passed through unchanged
-npx create-agent-rig@latest memory load --json           # same, for load; every argument after the verb goes to Memory verbatim
+npx create-agent-rig@latest memory load --json --cwd .   # same, for load (`--cwd`: Memory's own contract, per its owner — RP-183); arguments pass to Memory verbatim, plus `--timeout-ms 45000` when you name none
 ```
 
 `memory` reads the manifest above, runs Memory's `--version --json`, and only

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agent-rig",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Scaffold a new project with an agent operating system (rules, gates, hooks) and a runnable code skeleton",
   "keywords": [
     "create",

package/packages/cli/dist/commands/init.js

@@ -1,4 +1,4 @@
-import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { access, lstat, mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { settingsForInstalledHooks } from '../lib/init-settings.js';
 import { mapConcurrent } from '../lib/copy-tree.js';
@@ -158,17 +158,40 @@ export async function initProject(repoDir, options) {
     const written = actions.filter(({ verdict }) => verdict === 'written').map(({ rel }) => rel);
     const skipped = actions.filter(({ verdict }) => verdict === 'skipped').map(({ rel }) => rel);
     if (!options.dryRun)
-        await recordInstall(repoDir, written, contents);
+        await recordInstall(repoDir, written, skipped, contents);
     return { written, skipped, plannedCount };
 }
+/**
+ * The text of a regular file, or `null` for anything else at that path — a
+ * directory, a symlink, a file this process cannot read. `kept` records only
+ * bytes that are the file itself: hashing through a link would put the hash of
+ * something outside the repository into a committed manifest, and a read that
+ * throws here would abort the install after every other file was written.
+ */
+async function readRegularFile(abs) {
+    try {
+        if (!(await lstat(abs)).isFile())
+            return null;
+        return await readFile(abs, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Record what was installed, so a later `upgrade` can tell a file it wrote
  * from a file the user owns.
  *
- * Only files actually **written** are recorded. A file `init` kept is
- * somebody else's — claiming it here would let the next upgrade replace a
- * user's own document with the rig's. Earlier entries are preserved: a re-run
- * writes nothing and must not therefore un-remember everything.
+ * Only files actually **written** are recorded in `files`. A file `init` kept
+ * is somebody else's — claiming it there would let the next upgrade replace a
+ * user's own document with the rig's. It is recorded in `kept` instead, with
+ * the sha256 of the bytes found on disk (RP-182): not a claim of ownership, a
+ * record that the rig saw the file and left it — so the next upgrade can say
+ * "kept by init, unchanged since" or "edited since" rather than only "not a
+ * version this rig ever released". A path already in `files` is never moved to
+ * `kept` by a later run that skips it: the rig wrote those bytes. Earlier
+ * entries are preserved: a re-run writes nothing and must not therefore
+ * un-remember everything.
  *
  * 🔴 **`kind`, `project` and `stacks` are preserved, not rewritten.** Reached
  * inside a rig `create` produced, this used to stamp `kind: 'init'`,
@@ -196,12 +219,24 @@ export async function initProject(repoDir, options) {
  * leaves is a `create` rig whose `CLAUDE.md` was deleted, and this function is
  * what makes that case safe.
  */
-async function recordInstall(repoDir, written, contents) {
+async function recordInstall(repoDir, written, skipped, contents) {
     const previous = await readManifest(repoDir);
     const name = projectNameFor(repoDir);
     const files = { ...(previous?.files ?? {}) };
     for (const rel of written)
         files[rel] = sha256(contents.get(rel) ?? '');
+    const kept = { ...(previous?.kept ?? {}) };
+    for (const rel of written)
+        delete kept[rel];
+    for (const rel of skipped) {
+        if (files[rel] !== undefined)
+            continue; // the rig wrote it once; still its bytes to vouch for
+        const found = await readRegularFile(path.join(repoDir, rel));
+        if (found === null)
+            delete kept[rel];
+        else
+            kept[rel] = sha256(found);
+    }
     const manifest = {
         version: await packageVersion(),
         kind: previous?.kind ?? 'init',
@@ -211,6 +246,7 @@ async function recordInstall(repoDir, written, contents) {
         project: previous?.project ?? { name, scope: name, region: '' },
         stacks: previous?.stacks ?? [],
         files,
+        ...(Object.keys(kept).length > 0 ? { kept } : {}),
     };
     await writeManifest(repoDir, manifest);
 }

package/packages/cli/dist/commands/memory.js

@@ -3,7 +3,11 @@
 // resolves the executable from the machine subsystem manifest `setup` wrote
 // (RP-147), performs `--version --json` first, refuses a foreign contract
 // major with exit 4 before doctor/load ever run, and otherwise hands the verb
-// and its arguments to Memory verbatim and returns Memory's answer unchanged.
+// and its arguments to Memory and returns Memory's answer unchanged. The one
+// thing it adds to the arguments: a `load` that names no `--timeout-ms` gets
+// Memory's default internal deadline appended (`deadlinesFor`, RP-183);
+// everything the caller wrote passes through verbatim, and `doctor` is never
+// touched.
 //
 // What it never does, by construction: import Memory code, read Memory's
 // storage tree, or reinterpret a doctor/load payload — the only Memory bytes
@@ -22,8 +26,62 @@
 import { execFileRunner } from './setup.js';
 import { MEMORY_CONTRACT_MAJOR, SubsystemsError, handshake, readSubsystemsManifest, subsystemsManifestPath, } from '../lib/subsystems.js';
 const MEMORY_VERBS = ['doctor', 'load'];
-/** doctor/load do real work; the caller-supplied `--timeout-ms` is Memory's own bound. */
+/**
+ * The outer deadline: the rig kills the Memory child after this many ms. It is
+ * the consumer's bound, and it should not be the one that fires first — a kill
+ * leaves no JSON answer behind. So `load` always carries an INTERNAL deadline
+ * as well (RP-183): Memory's own `--timeout-ms`, which per the Memory owner
+ * (RP-183, Jira) it answers with a typed result instead of being killed.
+ * `doctor` accepts no such flag per the same source — its args are never
+ * touched. Pinned in packages/cli/test/memory.test.ts, "RP-183".
+ */
 const VERB_TIMEOUT_MS = 60_000;
+/** Memory's default internal deadline when the caller names none. */
+const DEFAULT_MEMORY_TIMEOUT_MS = 45_000;
+/**
+ * Headroom the outer deadline keeps above an explicit internal one. Sized per
+ * the Memory owner (RP-183, Jira): Memory's Windows cleanup may return up to
+ * 10 s after its own deadline fired; the rest is spawn overhead. The rig does
+ * not measure that lag itself.
+ */
+const OUTER_MARGIN_MS = 15_000;
+/**
+ * The largest delay `execFile`'s timer can hold: Node clamps a larger
+ * `setTimeout` to ONE millisecond, which would make the outer kill fire first
+ * — the inversion this whole helper exists to prevent. A caller who asks for
+ * more than ~24.8 days gets this ceiling as the outer deadline.
+ */
+const MAX_TIMER_MS = 2_147_483_647;
+const TIMEOUT_FLAG = '--timeout-ms';
+/** Memory's own grammar for the value: a positive integer, milliseconds. */
+const TIMEOUT_VALUE = /^[1-9][0-9]*$/;
+/**
+ * The verb's argument list and outer deadline. `load` with no `--timeout-ms`
+ * gets the default appended; a caller-owned flag — any spelling — passes
+ * through verbatim, and only a well-formed `--timeout-ms <value>` pair can
+ * raise the outer deadline above it. Memory owns the refusal of a malformed
+ * value, so the rig neither corrects nor drops one.
+ */
+const deadlinesFor = (verb, args) => {
+    if (verb !== 'load')
+        return { args: [...args], timeoutMs: VERB_TIMEOUT_MS };
+    const at = args.findIndex((arg) => arg === TIMEOUT_FLAG || arg.startsWith(`${TIMEOUT_FLAG}=`));
+    if (at === -1) {
+        return {
+            args: [...args, TIMEOUT_FLAG, String(DEFAULT_MEMORY_TIMEOUT_MS)],
+            timeoutMs: VERB_TIMEOUT_MS,
+        };
+    }
+    const value = args[at] === TIMEOUT_FLAG ? args[at + 1] : undefined;
+    const internal = value !== undefined && TIMEOUT_VALUE.test(value) ? Number(value) : null;
+    // A digit string too long for a safe integer — or for a double at all —
+    // still lands on the ceiling: `Number` yields a huge float or Infinity, and
+    // `Math.min` with the ceiling holds either.
+    const timeoutMs = internal !== null
+        ? Math.min(Math.max(VERB_TIMEOUT_MS, internal + OUTER_MARGIN_MS), MAX_TIMER_MS)
+        : VERB_TIMEOUT_MS;
+    return { args: [...args], timeoutMs };
+};
 const jsonLine = (payload) => `${JSON.stringify(payload)}\n`;
 const isVerb = (verb) => MEMORY_VERBS.includes(verb);
 export async function runMemory(options) {
@@ -106,8 +164,9 @@ export async function runMemory(options) {
             stderr: `memory: the handshake did not answer as the manifest promised (${result.reason}); ${options.verb} was not run\n`,
         };
     const [command, script] = entry.invocation;
-    const answer = await run(command, [script, options.verb, ...options.args], {
-        timeoutMs: VERB_TIMEOUT_MS,
+    const deadlines = deadlinesFor(options.verb, options.args);
+    const answer = await run(command, [script, options.verb, ...deadlines.args], {
+        timeoutMs: deadlines.timeoutMs,
     });
     if (answer.spawnError)
         return {

package/packages/cli/dist/commands/upgrade.js

@@ -315,17 +315,34 @@ export async function planUpgrade(repoDir, options = {}) {
                 nextFiles[file.rel] = recorded;
         }
         else {
+            // A path `init` found and left alone carries its provenance in `kept`
+            // (RP-182): the reason can then say what happened to the file since,
+            // instead of only that no release ever shipped these bytes. It names no
+            // version — `manifest.version` is rewritten by every upgrade, so it is
+            // not the version of the init that kept the file.
+            const kept = recorded === undefined ? manifest?.kept?.[file.rel] : undefined;
+            const keptReason = (since) => `kept by init (already here, not the rig's bytes), ${since} since — treated as yours`;
             actions.push({
                 rel: file.rel,
                 verdict: 'conflict',
-                reason: recorded === undefined
-                    ? 'not a version this rig ever released — treated as yours'
-                    : 'edited since it was installed',
+                reason: kept !== undefined
+                    ? keptReason(sha256(current) === kept ? 'unchanged' : 'edited')
+                    : recorded === undefined
+                        ? 'not a version this rig ever released — treated as yours'
+                        : 'edited since it was installed',
                 templatePath: file.source,
             });
-            // deliberately NOT recorded: the rig does not own these bytes
+            // deliberately NOT recorded in `files`: the rig does not own these bytes
         }
     }
+    // `kept` travels forward untouched, minus every path the plan now vouches
+    // for in `files` — a kept file that turned out to be a released version, or
+    // is byte-identical to this release, has become the rig's to manage.
+    const nextKept = {};
+    for (const [rel, hash] of Object.entries(manifest?.kept ?? {})) {
+        if (nextFiles[rel] === undefined)
+            nextKept[rel] = hash;
+    }
     // With no manifest, "there is a rig here" has to be *recognised*, not
     // assumed from a file existing: `CLAUDE.md` and `.claude/settings.json` are
     // in the install set and in nearly every repository ever opened by an agent.
@@ -352,6 +369,7 @@ export async function planUpgrade(repoDir, options = {}) {
             project,
             stacks: [...stacks],
             files: nextFiles,
+            ...(Object.keys(nextKept).length > 0 ? { kept: nextKept } : {}),
         },
     };
 }

package/packages/cli/dist/index.js

@@ -48,8 +48,10 @@ Also: create-agent-rig setup --memory-root <checkout> [--memory-ref <sha>] [--dr
 Also: create-agent-rig memory <doctor|load> [args…]
   Run a Memory verb through the registered executable: the --version --json
   handshake first (a foreign contract major exits 4 and the verb never runs),
-  then the verb and its arguments verbatim, Memory's answer passed through
-  unchanged. No manifest answers unsupported/absent (exit 0); an invalid
+  then the verb and its arguments, Memory's answer passed through unchanged.
+  Your arguments go to Memory as written; a load that names no --timeout-ms
+  gets --timeout-ms 45000 appended (Memory's own deadline, kept under the rig's
+  60 s bound). No manifest answers unsupported/absent (exit 0); an invalid
   invocation exits 2.`;
 async function runSetup(rawArgs) {
     let values;
@@ -318,7 +320,8 @@ async function main() {
     }
     if (process.argv[2] === 'memory') {
         // The consumer path of the RP-19 handshake: manifest → `--version --json`
-        // → exit 4 on a foreign major → doctor/load passed through verbatim.
+        // → exit 4 on a foreign major → doctor/load passed through (`load` gains a
+        // default `--timeout-ms` when the caller names none — commands/memory.ts).
         const [verb = '', ...args] = process.argv.slice(3);
         const result = await runMemory({ verb, args });
         process.stdout.write(result.stdout);

package/packages/cli/dist/lib/manifest.js

@@ -91,20 +91,38 @@ export function parseManifest(raw) {
         return null;
     if (!isStringRecord(m.files))
         return null;
+    // Present in a shape this reader does not accept voids the manifest, exactly
+    // as `files` does; absent is every manifest written before the field existed.
+    if (m.kept !== undefined && !isStringRecord(m.kept))
+        return null;
     return {
         version: m.version,
         kind: m.kind,
         project: { name: project.name, scope: project.scope, region: project.region },
         stacks: [...m.stacks],
         files: { ...m.files },
+        ...(m.kept !== undefined ? { kept: { ...m.kept } } : {}),
     };
 }
-/** Stable bytes: sorted paths, so a re-run produces no diff of its own. */
+const sortedRecord = (record) => {
+    const sorted = {};
+    for (const rel of Object.keys(record).sort())
+        sorted[rel] = record[rel];
+    return sorted;
+};
+/**
+ * Stable bytes: sorted paths, so a re-run produces no diff of its own. An
+ * empty `kept` is omitted, not written as `{}` — a manifest that kept nothing
+ * must serialise byte-identical to one written before the key existed.
+ */
 export function serializeManifest(manifest) {
-    const files = {};
-    for (const rel of Object.keys(manifest.files).sort())
-        files[rel] = manifest.files[rel];
-    return `${JSON.stringify({ ...manifest, files }, null, 2)}\n`;
+    const { kept, ...rest } = manifest;
+    const body = {
+        ...rest,
+        files: sortedRecord(manifest.files),
+        ...(kept !== undefined && Object.keys(kept).length > 0 ? { kept: sortedRecord(kept) } : {}),
+    };
+    return `${JSON.stringify(body, null, 2)}\n`;
 }
 export async function readManifest(repoDir) {
     try {

package/templates/agent-os/universal/.claude/scripts/queue/core.mjs

@@ -485,6 +485,18 @@ export const hygieneOf = (ticket, { owner = null } = {}) => {
     };
   }
 
+  const removed = removedDependencyIn(body, ticket);
+  if (removed) {
+    return {
+      kind: 'link-contradicted-by-body',
+      id: ticket.id,
+      why:
+        `body line ${removed.line} declares "The Blocks link ${removed.source} -> ` +
+        `${removed.target} is removed", but that dependency is still carried in ` +
+        `${removed.direction}. Reconcile the declaration and link before relying on either`,
+    };
+  }
+
   return null;
 };
 
@@ -502,6 +514,37 @@ export const hygieneOf = (ticket, { owner = null } = {}) => {
  */
 const BLOCKER_IN_BODY = /^[-*\t ]{0,4}(?:blocked by|depends on|blocker)[ \t:]{0,8}[#A-Za-z0-9]/im;
 
+// See test/template/queue.test.ts (absent in a generated rig) ›
+// "reports its carried outgoing Blocks link that its own body says was removed".
+const REMOVAL_ID = '(?:[A-Z][A-Z0-9_]{0,31}-[0-9]{1,16}|#[0-9]{1,16})';
+const REMOVED_DEPENDENCY = new RegExp(
+  `^[ \\t]{0,4}(?:[-*][ \\t]{1,4})?The[ \\t]{1,8}Blocks[ \\t]{1,8}link[ \\t]{1,8}` +
+    `(${REMOVAL_ID})[ \\t]{1,8}->[ \\t]{1,8}(${REMOVAL_ID})[ \\t]{1,8}is[ \\t]{1,8}removed` +
+    '(?=[ \\t]{0,8}(?:$|[.;(]))',
+  'i',
+);
+const dependencyId = (value) => String(value).replace(/^#/, '').toUpperCase();
+const removedDependencyIn = (body, ticket) => {
+  const ownId = dependencyId(ticket.id);
+  const outgoingIds = new Set((ticket.blocks ?? []).map(dependencyId));
+  const incomingIds = new Set((ticket.blockedBy ?? []).map((link) => dependencyId(link.id)));
+  const lines = body.split(/\r?\n/);
+  for (let index = 0; index < lines.length; index += 1) {
+    const match = REMOVED_DEPENDENCY.exec(lines[index]);
+    if (!match) continue;
+    const [, source, target] = match;
+    const outgoing =
+      dependencyId(source) === ownId &&
+      outgoingIds.has(dependencyId(target));
+    const incoming =
+      dependencyId(target) === ownId &&
+      incomingIds.has(dependencyId(source));
+    if (outgoing || incoming)
+      return { source, target, line: index + 1, direction: outgoing ? 'blocks' : 'blockedBy' };
+  }
+  return null;
+};
+
 /** The item saying, in its own words, that it was broken into other items. */
 const SPLIT_IN_BODY = /\b(?:split into|split up into|broken into|broken up into|superseded by|subtasks?:)/i;
 

package/templates/agent-os/universal/.claude/scripts/queue/jira.mjs

@@ -680,6 +680,23 @@ export const escalate = async (ticket, diagnosis, { env = process.env } = {}) =>
   return { ok: true };
 };
 
+/**
+ * Jira refuses a summary longer than this, and creates nothing: `400
+ * {"errors":{"summary":"Summary can't exceed 255 characters."}}` (RP-121). The
+ * summary is therefore a prefix; the full `change` stays in the description,
+ * where the fingerprint lives too, so the dedupe does not depend on the cut.
+ * The cut never leaves half of a surrogate pair behind. Pinned in
+ * `test/template/queue-jira.test.ts` › "bounds the POSTed summary so a
+ * 2186-character change still files, keeping the full text in the body".
+ */
+const MAX_SUMMARY_LENGTH = 255;
+
+const boundedSummary = (text) => {
+  if (text.length <= MAX_SUMMARY_LENGTH) return text;
+  const cut = text.slice(0, MAX_SUMMARY_LENGTH);
+  return /[\uD800-\uDBFF]$/.test(cut) ? cut.slice(0, -1) : cut;
+};
+
 /**
  * 🔴 INVARIANT 2: the agent never creates its own work. A proposal is labelled
  * `triage`, which `buildJql` excludes explicitly, and it never receives a ready
@@ -689,7 +706,7 @@ export const triageItemFor = (proposal) => {
   validateProposal(proposal);
   const fingerprint = fingerprintOf(proposal);
   return {
-    title: `proposal: ${proposal.change}`,
+    title: boundedSummary(`proposal: ${proposal.change}`),
     body: [
       `- finding — ${proposal.finding}`,
       `- part to change — ${proposal.part}`,

package/templates/agent-os/universal/.claude/scripts/reconcile-external-prs.mjs

@@ -26,6 +26,9 @@ import { dirname, join } from 'node:path';
 // so this sweep sees exactly what the gate sweep sees — including the paths a
 // stack layer contributes for its own shape.
 import { elevatedPathsIn, laneOf, readDeclaredPaths } from './detect-missed-gate.mjs';
+// The one credential vocabulary (`guard-secret-file`, the commit sweep and this
+// diagnostic all read it): a second list of token shapes here would drift.
+import { SECRET_VALUE_PATTERNS } from './lib/secrets.mjs';
 
 /**
  * The audit trail for work that already happened: a record born **closed**.
@@ -210,37 +213,261 @@ const parseArgs = (argv) => {
 
 const daysAgo = (n) => new Date(Date.now() - n * 86_400_000).toISOString().slice(0, 10);
 
-/** Same rule as the gate sweep: "could not look" must never render as "clean". */
-const fetchMergedPrs = (since) => {
-  try {
-    return JSON.parse(
-      execFileSync(
-        'gh',
-        [
-          'pr',
-          'list',
-          '--state',
-          'merged',
-          '--limit',
-          '100',
-          '--search',
-          `merged:>=${since}`,
-          '--json',
-          'number,title,body,headRefName,mergedAt,url,files,changedFiles,authorAssociation',
-        ],
-        { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] },
-      ),
-    );
-  } catch (error) {
-    process.stderr.write(
-      'lane reconciliation: could not list merged PRs — the `gh` CLI is missing, ' +
-        'unauthenticated, or the API is unreachable. No lane was reconciled; do not ' +
-        'record an empty `external lane` block from this run. Use --input <file> to ' +
-        'work offline.\n' +
-        `  ${String(error?.stderr ?? error?.message ?? error).trim().split('\n')[0]}\n`,
+// --- Acquisition (RP-99) --------------------------------------------------------
+//
+// Two calls, not one. `gh pr list --json` does not know `authorAssociation` on
+// every supported `gh` (2.71.2 answers `Unknown JSON field`), so the BASE
+// projection asks only for fields every `gh` has, and the association — the
+// trust signal — is fetched afterwards through one GraphQL query. When that
+// second step fails for any reason the base list is returned WITHOUT the field
+// and `reconcile()` treats those PRs as untrusted, and an answer is kept only
+// when it names the same pull request URL the base list did — see the
+// generator's test/template/reconcile-acquisition.test.ts (absent in a generated rig)
+// › "reconcile() treats a PR that lost authorAssociation to a failed enrichment as untrusted when it crosses an elevated path"
+// and › "drops an association whose answer names a different pull request URL — another host or repository never becomes trust".
+
+/** The base projection: fields every supported `gh` serves. */
+const BASE_FIELDS = ['number', 'title', 'body', 'headRefName', 'mergedAt', 'url', 'files', 'changedFiles'];
+/** What GitHub returns for `authorAssociation`: an upper-case enum word. */
+const ASSOCIATION_SHAPE = /^[A-Z_]{1,32}$/;
+const MAX_PRS = 100;
+
+/** The default runner: one `gh` child, stdout as text, a thrown error otherwise. */
+const execGh = (file, args) =>
+  execFileSync(file, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+
+/** A base record the rest of this script can read: an object with a positive PR number. */
+const isPrRecord = (row) =>
+  row !== null &&
+  typeof row === 'object' &&
+  !Array.isArray(row) &&
+  Number.isSafeInteger(row.number) &&
+  row.number > 0;
+
+/**
+ * The merged PRs since `since`, plus the warnings the acquisition produced.
+ *
+ * Throws only from the BASE list — the caller classifies that with
+ * `classifyAcquisitionFailure`. A parsed base list that is not an array is
+ * thrown with `notAnArray: true` (JSON.parse succeeded, so a SyntaxError would
+ * misdescribe it). Enrichment never throws: it degrades to a warning.
+ */
+export const fetchMergedPrs = (since, { exec = execGh } = {}) => {
+  const raw = exec('gh', [
+    'pr',
+    'list',
+    '--state',
+    'merged',
+    '--limit',
+    String(MAX_PRS),
+    '--search',
+    `merged:>=${since}`,
+    '--json',
+    BASE_FIELDS.join(','),
+  ]);
+  const parsed = JSON.parse(raw);
+  if (!Array.isArray(parsed)) {
+    throw Object.assign(new Error('gh pr list answered with something other than a JSON array'), {
+      notAnArray: true,
+    });
+  }
+
+  const warnings = [];
+  const prs = [];
+  for (const row of parsed.slice(0, MAX_PRS)) {
+    if (!isPrRecord(row)) {
+      warnings.push('a merged-PR record without a positive numeric `number` was dropped from the sweep');
+      continue;
+    }
+    // Copy the base fields only; whatever else `gh` returned does not travel.
+    const record = {};
+    for (const field of BASE_FIELDS) if (row[field] !== undefined) record[field] = row[field];
+    prs.push(record);
+  }
+  if (prs.length === 0) return { prs, warnings };
+
+  const associations = fetchAuthorAssociations(prs, exec);
+  if (associations === null) {
+    warnings.push(
+      'author association unavailable for this window — every external merge below is treated as untrusted origin',
     );
-    process.exit(1);
+    return { prs, warnings };
+  }
+  for (const pr of prs) {
+    const answer = associations.get(pr.number);
+    if (answer === undefined) continue;
+    // `gh api graphql` asks its own default host, not the remote's: an answer
+    // about another pull request must never lend its association to this one.
+    if (typeof pr.url !== 'string' || answer.url !== pr.url) {
+      warnings.push(`PR #${pr.number}: an author association whose pull request URL does not match the listed one was dropped`);
+      continue;
+    }
+    const value = answer.authorAssociation;
+    if (typeof value === 'string' && ASSOCIATION_SHAPE.test(value)) pr.authorAssociation = value;
+    else warnings.push(`PR #${pr.number}: an author association of an unexpected shape was dropped`);
   }
+  return { prs, warnings };
+};
+
+/**
+ * `number → { url, authorAssociation }` for the listed PRs through one GraphQL
+ * query, or `null` when the answer cannot be trusted: a failed call, unusable
+ * JSON, a repository name of an unexpected shape. Never throws.
+ */
+const fetchAuthorAssociations = (prs, exec) => {
+  try {
+    const repo = JSON.parse(exec('gh', ['repo', 'view', '--json', 'nameWithOwner']));
+    const nameWithOwner = typeof repo?.nameWithOwner === 'string' ? repo.nameWithOwner : '';
+    const parts = nameWithOwner.split('/');
+    if (parts.length !== 2 || !parts.every((part) => /^[A-Za-z0-9_.-]{1,100}$/.test(part))) return null;
+    const [owner, name] = parts;
+    const fields = prs
+      .map((pr) => `pr${pr.number}: pullRequest(number: ${pr.number}) { url authorAssociation }`)
+      .join(' ');
+    const query = `query { repository(owner: "${owner}", name: "${name}") { ${fields} } }`;
+    const answer = JSON.parse(exec('gh', ['api', 'graphql', '-f', `query=${query}`]));
+    const repository = answer?.data?.repository;
+    if (repository === null || typeof repository !== 'object') return null;
+    const out = new Map();
+    for (const pr of prs) {
+      const node = repository[`pr${pr.number}`];
+      if (node === null || typeof node !== 'object' || node.authorAssociation === undefined) continue;
+      out.set(pr.number, { url: node.url, authorAssociation: node.authorAssociation });
+    }
+    return out;
+  } catch {
+    return null;
+  }
+};
+
+// --- Failure diagnostics (RP-99) -----------------------------------------------
+
+const CAUSES = Object.freeze({
+  'gh-missing': 'the `gh` CLI could not be started (not installed, or not on PATH)',
+  'gh-unauthenticated': 'the `gh` CLI is not authenticated for this host — run `gh auth login`',
+  'api-unreachable': 'the GitHub API could not be reached',
+  'unsupported-projection': 'this `gh` version does not serve a field the sweep asked for',
+  'malformed-response': '`gh` answered, but not with the JSON array the sweep expects',
+  unknown: 'the cause is unknown',
+});
+const STDERR_UNAUTHENTICATED = /gh auth login|not logged in|HTTP 401|authentication required/i;
+const STDERR_UNREACHABLE =
+  /dial tcp|ENOTFOUND|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|HTTP 5\d\d|could not connect|connection refused/i;
+const STDERR_UNSUPPORTED = /Unknown JSON field/i;
+// ESC-led sequences (CSI, OSC and the single-character escapes); the
+// whitespace controls, which become a space where they sit next to whitespace
+// and a mark where they sit inside a run (so they cannot split a token into
+// pieces too short to match); and every other character a terminal would not
+// print as itself — the remaining C0/C1 controls except the line feed the next
+// step splits on, the invisible format characters (zero-width, bidi,
+// byte-order mark), the line and paragraph separators, and U+E000, the mark
+// they are all replaced with.
+// eslint-disable-next-line no-control-regex -- the pattern exists to remove these very bytes
+const TERMINAL_SEQUENCES = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-Z\\-_])/g;
+const WHITESPACE_CONTROLS = /[\t\v\f\r]/g;
+const WHITESPACE_CONTROLS_INSIDE_A_RUN = /(?<=\S)[\t\v\f\r]+(?=\S)/g;
+// eslint-disable-next-line no-control-regex -- likewise
+const HIDDEN_CHARACTERS = /[\x00-\x08\x0E-\x1F\x7F-\x9F\p{Cf}\p{Zl}\p{Zp}\uE000]/gu;
+const MARK = '\uE000';
+// No leading word boundary: a keyword glued to the word before must still be
+// found, and over-redacting prose is the safe way to be wrong here.
+const AUTHORIZATION_VALUE = /(?:Bearer|Basic|token)\s+[A-Za-z0-9._~+/=-]{8,}|Authorization:\s*[^\s]+(?:\s+[^\s]+)?/gi;
+const DIAGNOSTIC_CAP = 200;
+// Redaction runs on at most this much of the line, and the 200-character cut
+// comes after it: cutting first can shorten a token below what its pattern
+// needs and print the prefix. When the window itself cuts the line, the last
+// whitespace-free run is dropped before redaction, so no token is ever
+// shortened by a cut.
+const REDACTION_WINDOW = 4096;
+// A whitespace-free run that had a hidden character removed from it is masked
+// whole once what is left is at least this long — the shortest value the
+// vocabulary redacts, an authorization value. A removed character can glue a
+// token to the word before it or split it into pieces too short to match, and
+// neither can be told apart from honest text, so such a run is not trusted to
+// the patterns at all.
+const MARKED_RUN_MIN = 8;
+// A masked run that ended in one of these keywords takes the next run with it:
+// the value that followed the keyword can no longer be recognised on its own.
+const AUTHORIZATION_KEYWORD_END = /(?:bearer|basic|token|authorization:)$/i;
+
+/** `text` without its trailing whitespace-free run. One backward pass. */
+const dropTrailingRun = (text) => {
+  let end = text.length;
+  while (end > 0 && !/\s/.test(text[end - 1])) end -= 1;
+  return text.slice(0, end);
+};
+
+const redactPatterns = (text) => {
+  let out = text.replace(AUTHORIZATION_VALUE, '[redacted]');
+  for (const { pattern } of SECRET_VALUE_PATTERNS) {
+    out = out.replace(new RegExp(pattern.source, `${pattern.flags.replace('g', '')}g`), '[redacted]');
+  }
+  return out;
+};
+
+/**
+ * One printable line of a subprocess's stderr: no terminal sequences, control
+ * or invisible format characters, the first non-empty line only, every run a
+ * hidden character was removed from masked when it is long enough to be a
+ * credential, the credential shapes the shared vocabulary knows — plus HTTP
+ * authorization values — replaced by `[redacted]`, and then at most 200
+ * characters.
+ */
+export const sanitizeDiagnostic = (text) => {
+  const source = typeof text === 'string' ? text : String(text ?? '');
+  const marked = source
+    .replace(TERMINAL_SEQUENCES, MARK)
+    .replace(HIDDEN_CHARACTERS, MARK)
+    .replace(WHITESPACE_CONTROLS_INSIDE_A_RUN, MARK)
+    .replace(WHITESPACE_CONTROLS, ' ');
+  const line = marked.split('\n').find((candidate) => candidate.replaceAll(MARK, '').trim() !== '') ?? '';
+  const windowed = line.length > REDACTION_WINDOW ? dropTrailingRun(line.slice(0, REDACTION_WINDOW)) : line;
+  let maskNext = false;
+  const masked = windowed
+    .split(/(\s+)/)
+    .map((run) => {
+      if (run.trim() === '') return run;
+      const visible = run.replaceAll(MARK, '');
+      const hidden = run.includes(MARK) && visible.length >= MARKED_RUN_MIN;
+      const mask = hidden || maskNext;
+      maskNext = mask && AUTHORIZATION_KEYWORD_END.test(visible);
+      return mask ? '[redacted]' : visible;
+    })
+    .join('');
+  return redactPatterns(masked).trim().slice(0, DIAGNOSTIC_CAP);
+};
+
+/**
+ * The cause the evidence supports, and nothing more. `detail` is the sanitized
+ * first non-empty stderr line, whatever the cause, or `null` when there was none. An
+ * `unknown` failure with no stderr falls back to the error's own message; the
+ * other causes never do, because a parse error's message quotes `gh` output.
+ */
+export const classifyAcquisitionFailure = (error) => {
+  const stderr = typeof error?.stderr === 'string' ? error.stderr : '';
+  const detail = stderr.trim() === '' ? null : sanitizeDiagnostic(stderr);
+  if (error?.code === 'ENOENT') return { cause: 'gh-missing', detail };
+  if (error instanceof SyntaxError || error?.notAnArray === true) {
+    return { cause: 'malformed-response', detail };
+  }
+  if (STDERR_UNSUPPORTED.test(stderr)) return { cause: 'unsupported-projection', detail };
+  if (STDERR_UNAUTHENTICATED.test(stderr)) return { cause: 'gh-unauthenticated', detail };
+  if (STDERR_UNREACHABLE.test(stderr)) return { cause: 'api-unreachable', detail };
+  if (detail === null && typeof error?.message === 'string' && error.message.trim() !== '') {
+    return { cause: 'unknown', detail: sanitizeDiagnostic(error.message) };
+  }
+  return { cause: 'unknown', detail };
+};
+
+/** The message the CLI prints for a failed acquisition: one cause, named. */
+export const acquisitionFailureMessage = ({ cause, detail }) => {
+  const named = CAUSES[cause] ?? CAUSES.unknown;
+  return (
+    `lane reconciliation: could not list merged PRs — ${named}. ` +
+    'No lane was reconciled; do not record an empty `external lane` block from this run. ' +
+    'Use --input <file> to work offline.' +
+    (detail ? `\n  ${detail}` : '')
+  );
 };
 
 /**
@@ -267,9 +494,19 @@ const invokedDirectly = () => {
 if (invokedDirectly()) {
   const args = parseArgs(process.argv.slice(2));
   const projectRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
-  const prs = args.input
-    ? readInput(args.input, 'lane reconciliation')
-    : fetchMergedPrs(args.since ?? daysAgo(7));
+  let prs;
+  let warnings = [];
+  if (args.input) {
+    prs = readInput(args.input, 'lane reconciliation');
+  } else {
+    try {
+      ({ prs, warnings } = fetchMergedPrs(args.since ?? daysAgo(7)));
+    } catch (error) {
+      process.stderr.write(`${acquisitionFailureMessage(classifyAcquisitionFailure(error))}\n`);
+      process.exit(1);
+    }
+  }
+  for (const warning of warnings) process.stderr.write(`lane reconciliation: ${warning}\n`);
   // Lane sorting still works without a declaration; only the elevated marks go
   // missing, and they render as "no elevated path crossed" rather than lying.
   const elevatedPaths = readDeclaredPaths(projectRoot) ?? [];

package/templates/hash-history.json

@@ -11,7 +11,8 @@
     "0.6.2",
     "0.7.0",
     "0.7.1",
-    "0.8.0"
+    "0.8.0",
+    "0.9.0"
   ],
   "files": {
     ".agents/skills/check-premises/SKILL.md": {
@@ -29,7 +30,8 @@
         "57f6add0504db45e7577474f97705fe474310e4cd3310cdb348a2c64eabe88cd",
         "18f4300de4c4c7ea380d726fb109fa224da950ef0a4cea5015ab1d408b823be5",
         "0a1b6575f6df8139766c8e71ba7320e14d2a5a5ed8ab26b6b43f7a006153d37d",
-        "a0d11ca1745095cc5b68777915161f16a6d1602c21f6d273f475d1d07c4b8546"
+        "a0d11ca1745095cc5b68777915161f16a6d1602c21f6d273f475d1d07c4b8546",
+        "b47bdf0d7a2f6c5b2034b8f6d683ad2b3c83bd65d15baf7de9b58cc4689d0ab1"
       ]
     },
     ".agents/skills/new-invariant/SKILL.md": {
@@ -83,7 +85,8 @@
       "hashes": [
         "2286fbc01c0342b9bac9909890876c079615db5b398e3499a0f2fddb1a334098",
         "4c6241da56060b44e77f9b5f7a8cde7d2923bd605b8b9bae70d00329784c35be",
-        "03f87fbc976d8d65287b032ae3612511fc8f7e57772470b2282b660343fc32db"
+        "03f87fbc976d8d65287b032ae3612511fc8f7e57772470b2282b660343fc32db",
+        "5ec51bc08c9a934bfcbb2077fc7edce48c0e0cc3ed117d7dfc8a2895f2d9c01b"
       ]
     },
     ".claude/agents/code-reviewer.md": {
@@ -93,7 +96,8 @@
         "be3d2992d1f278dde46b555df1840b02f91403db1ec2fd4d489fb5efa940f019",
         "ec403373ef6bc0575d61c6ca11f82792817b272221fad8317ef6c45388b52628",
         "f125cfbce848cdaa91fd81e961808b4dbde452287959ec2cf10b905ee3ede789",
-        "8ede9297480c889ec6d6caf8d076e7d69111fb472933dcf5a48b9a8425fe50c2"
+        "8ede9297480c889ec6d6caf8d076e7d69111fb472933dcf5a48b9a8425fe50c2",
+        "f12cb04871578eca3c9c36a1c2d60f5ae15a0e9094ecfc7c704c341756de4e3e"
       ]
     },
     ".claude/agents/prose-reviewer.md": {
@@ -102,7 +106,8 @@
         "8d5762849afd328fdc1aabf053ad207f2e306e013665e3ff934b06cbb1bbda38",
         "0e4307cd9cf8ef723d79e98b1af46a34c6912a6aa925e2179d939cb83c8f2a44",
         "7e8eaa2b4af9d65e1d10bf50c32c1d138fb2f8b9ba6e6d0880cade0524324d9d",
-        "ed1c05d3938c0b4f277f1bf4af8641460def830569049ff0697c9bda14518b78"
+        "ed1c05d3938c0b4f277f1bf4af8641460def830569049ff0697c9bda14518b78",
+        "7aed3bfc955efc94bbeda3f866d25e2b253c88facaa2beed73939182a9f845b2"
       ]
     },
     ".claude/agents/security-scanner.md": {
@@ -110,13 +115,15 @@
       "hashes": [
         "43e5d59315483e369ad19f3070175f146e88deabd3a12dc09339ac4fac0f2aee",
         "e01467a38a0183be46ba45b05d44f663fbf4b139ceaecb91b5d096f3286a3fcd",
-        "844e215af7d80bd85f62ca937c79bea59c8d8cd7c97353937ce62f7747eb9df7"
+        "844e215af7d80bd85f62ca937c79bea59c8d8cd7c97353937ce62f7747eb9df7",
+        "7c0bc189521955f2d126bac0ff97ab4fa252b05067692a5a3bb6cda232ddfaa3"
       ]
     },
     ".claude/agents/test-writer.md": {
       "since": "0.2.0",
       "hashes": [
-        "333feef12383dea51791ae4923c44ba542438de793f0792fb51d96aa15b8b1b8"
+        "333feef12383dea51791ae4923c44ba542438de793f0792fb51d96aa15b8b1b8",
+        "fce976938fdd1154641e405a557b67161daa34cf84de9ad35fa14287d13b7f9c"
       ]
     },
     ".claude/hooks/block-no-verify.mjs": {
@@ -180,6 +187,12 @@
         "5bf2896ec5e5f94fab20b52cd22418a4392778b40744602a087e320eeca3f688"
       ]
     },
+    ".claude/hooks/guard-subagent-model.mjs": {
+      "since": "0.9.0",
+      "hashes": [
+        "345cbd5f43171adb01cd46ad485fb61299f7135c00ff4217765993551aca3b38"
+      ]
+    },
     ".claude/hooks/guard-web-boundary.mjs": {
       "since": "0.2.0",
       "hashes": [
@@ -202,7 +215,8 @@
       "hashes": [
         "4f836bc3ff75a868ffe035b179ac9e7dc1ad7715d520677ff9f6aa5bfdb200eb",
         "0c191d326a7bb0bbfc110e2210f44b4aa39276e8db3779aaa4545cffd4e11863",
-        "572c671f8f2cad190fe2f144071954ac4d3b1357cab80a19bad584dd3b3768c8"
+        "572c671f8f2cad190fe2f144071954ac4d3b1357cab80a19bad584dd3b3768c8",
+        "6695698d2b38c79a12292601048dd0082a0cd18bf9e69c047d47679c2e6ecf67"
       ]
     },
     ".claude/hooks/lib/hook-input.mjs": {
@@ -212,6 +226,12 @@
         "3be3d4af4a25536d2a2bac0441a1370be7efafb5f8aa737b195bdce77db0091b"
       ]
     },
+    ".claude/hooks/warn-subagent-routing.mjs": {
+      "since": "0.9.0",
+      "hashes": [
+        "b95165243ebb60264c78b82ce01407669457fe33c0bf86ff2a5c117963c6bc6d"
+      ]
+    },
     ".claude/queue.json": {
       "since": "0.3.0",
       "hashes": [
@@ -267,7 +287,8 @@
       "hashes": [
         "dbe8025e10583e03fee5056e88aa6b73e4399453711d9156d82528a02d6e0402",
         "9e60d0300e856a9b3f81ab748bf2c0a9de27233ad0aa58a8c7141413fa0f3cae",
-        "c8e9849a8fccd4e1e60b1ddc82937eb15aceb7f7c2afbd151b05e1bc966bfd2a"
+        "c8e9849a8fccd4e1e60b1ddc82937eb15aceb7f7c2afbd151b05e1bc966bfd2a",
+        "aa34a1eab572964b328ffa0044e96acb3e1c31491df0183460f06e5e6bba3b76"
       ]
     },
     ".claude/scripts/decision-router.mjs": {
@@ -352,7 +373,8 @@
         "ceb6d35fa028f9c5e5e2d5965c627095d5ba80c37191a584627b4bc645b6be15",
         "efa193dc543237d82dcb371fa1df6483ccd43c1db88d0e218f5d89769564974c",
         "bed44df40412a7edac96914de21edc796df604ddc275ff1a02764dfcc4d4ede7",
-        "b3893c365de37ef6d9d04ab933296b9fcf09a0886197d7e12313fa63eacdbd89"
+        "b3893c365de37ef6d9d04ab933296b9fcf09a0886197d7e12313fa63eacdbd89",
+        "37eeb4bdb50d7f6b1427bd02ec9815f39ad9142f35691ffadd8c0b626c6cdb00"
       ]
     },
     ".claude/scripts/queue/as-of.mjs": {
@@ -381,7 +403,8 @@
     ".claude/scripts/queue/gate-rounds.mjs": {
       "since": "0.5.0",
       "hashes": [
-        "7577674d5477cfc388594e4c301601e329d60741dfa0b2844be2cc94a3ab6283"
+        "7577674d5477cfc388594e4c301601e329d60741dfa0b2844be2cc94a3ab6283",
+        "deeb7a10772f906c7630bb3c295be1b61d7ebf0541b2a34debcb40c80e6d8f0e"
       ]
     },
     ".claude/scripts/queue/github-issues.mjs": {
@@ -401,7 +424,8 @@
         "7db3c17b781e6876b4822afd09e6affa97e46607b63d443975d987daf1f14464",
         "9edd70b5960f367958e8e7500150b4edd285c99869cca803e40e0537d2d347b0",
         "4cf917ac06708e1068dfe9f8bbebc9376c4748526bd669b9bea32929ba996d0a",
-        "b4a0789be7ad4b401de872edb06665bca349048178b4dd6c5db848ca44f7c977"
+        "b4a0789be7ad4b401de872edb06665bca349048178b4dd6c5db848ca44f7c977",
+        "19a04cdbdfd936213cea3a9a00a583a060a4a8d0356d6a6922ae1c2f593f16f1"
       ]
     },
     ".claude/scripts/queue/jira.mjs": {
@@ -481,7 +505,8 @@
       "hashes": [
         "060b001927d8b471f1c1a8c8851fbb4266d3b2edd674cccbd6c16c44b57b91dd",
         "7721ee19fd1bcf6902be3d359def40742d79b88f5d83e7e3ca22ba45ca3211aa",
-        "250292c9959916240bfc0fdf5987a864f6d54799de3d932dc6b85b776e62eaa9"
+        "250292c9959916240bfc0fdf5987a864f6d54799de3d932dc6b85b776e62eaa9",
+        "ad58b25f9ce30a1549b5047daa1e5b43c30352306aeceebacd638db86087e01f"
       ]
     },
     ".claude/scripts/verdict.mjs": {
@@ -498,7 +523,8 @@
         "55a6938b4d9967291a26e93301e34e5ffdef74a88f8c773a4d11b5d87d864fff",
         "713718fbb2cda132f05665b29b8f1108a6305729b5e7c789d2053d117c13e08e",
         "e588ab05bee707a099c80c9ea399008be31488e616f3db3c0598f66f3d1b3a52",
-        "a180578d6e6de6a21900ff2f8a8ade2242170d16d2dd95574e5004435d870b9b"
+        "a180578d6e6de6a21900ff2f8a8ade2242170d16d2dd95574e5004435d870b9b",
+        "44695f83e445c7da3257556a3decc70e79ef46d19da394d4d5dd4c9268c0b429"
       ]
     },
     ".claude/skills/check-premises/SKILL.md": {
@@ -521,7 +547,8 @@
         "57f6add0504db45e7577474f97705fe474310e4cd3310cdb348a2c64eabe88cd",
         "18f4300de4c4c7ea380d726fb109fa224da950ef0a4cea5015ab1d408b823be5",
         "0a1b6575f6df8139766c8e71ba7320e14d2a5a5ed8ab26b6b43f7a006153d37d",
-        "a0d11ca1745095cc5b68777915161f16a6d1602c21f6d273f475d1d07c4b8546"
+        "a0d11ca1745095cc5b68777915161f16a6d1602c21f6d273f475d1d07c4b8546",
+        "b47bdf0d7a2f6c5b2034b8f6d683ad2b3c83bd65d15baf7de9b58cc4689d0ab1"
       ]
     },
     ".claude/skills/new-invariant/SKILL.md": {
@@ -577,14 +604,16 @@
       "since": "0.5.0",
       "hashes": [
         "902dbace9532ec8e7a3c0cfd6ea0934227f087e345c0619923ec03512b26ba3e",
-        "55778d7fb9f778a33213590cc0a2dcf8e01026a1a93eed1c0f811ba4f1070721"
+        "55778d7fb9f778a33213590cc0a2dcf8e01026a1a93eed1c0f811ba4f1070721",
+        "5fbbb1431833692d56cd0d15249f1d024e53bb0ab63349842910a9fc90547f6a"
       ]
     },
     ".codex/agents/code-reviewer.toml": {
       "since": "0.5.0",
       "hashes": [
         "e0e3475404c95402f33d77ebb14001e289d26bb429205a0a73bdcef99b4a62c7",
-        "9ec92775791907f068d85ba58489236bd2bee69a8d769554ac530e8eadd5e374"
+        "9ec92775791907f068d85ba58489236bd2bee69a8d769554ac530e8eadd5e374",
+        "180c182cc909cc0b6c06cfa286f528f22b77189eee49cac067fdaaf2920f8bae"
       ]
     },
     ".codex/agents/prose-reviewer.toml": {
@@ -592,20 +621,29 @@
       "hashes": [
         "80b4631502d95c619ad060ce02cc8702b12574758ba7df8337ed63efa15d764d",
         "cfd516f72acdfd197c59ac3cbdd39d7b175976dbd3d9eef52825dfdc4f1e5b60",
-        "8687eacf0ad707a4f887e0714e82fca23fd005fa9ec8824faedfe99ca46333e1"
+        "8687eacf0ad707a4f887e0714e82fca23fd005fa9ec8824faedfe99ca46333e1",
+        "7c37e4dbd94980bee16396d0d46d97c5079e295d3eed4b3ed8f98d701e57b10d"
       ]
     },
     ".codex/agents/security-scanner.toml": {
       "since": "0.5.0",
       "hashes": [
         "9ee408789f237a0b55aac6a2472682a08f8696e1d1ff4918ea72766ac8535499",
-        "bc9aacca1ca3ed4ceac485f7cd1c6ff5a5405ac7be83419d6145499cc560ee91"
+        "bc9aacca1ca3ed4ceac485f7cd1c6ff5a5405ac7be83419d6145499cc560ee91",
+        "b529f02056948ff0ca179c96d9d47962c9c8064feccb68d3c970e7b1a2513fc9"
       ]
     },
     ".codex/agents/test-writer.toml": {
       "since": "0.5.0",
       "hashes": [
-        "bb89d93f57d70885d98cfbe428caa524e9c00e1ce30da235ed3318c1ba3c9606"
+        "bb89d93f57d70885d98cfbe428caa524e9c00e1ce30da235ed3318c1ba3c9606",
+        "ec9e61b2c16c97ed26d5bdda2b0f715a41b80c0af549d0f2bbb96d6ca4c4d8d7"
+      ]
+    },
+    ".codex/config.toml": {
+      "since": "0.9.0",
+      "hashes": [
+        "c41e34ef5c3bb606852269adeaf5678ce172dc7a7937514ac879152bbddea7f2"
       ]
     },
     ".codex/hooks.json": {
@@ -659,7 +697,8 @@
       "since": "0.5.0",
       "hashes": [
         "30e55d866d9a2c7359e594181070c63b1974d9df36e000caf419229284303a2e",
-        "ebf0ef61407944373c862d37e6a80d4965ece72304b931428c6b3fcc5d9527c4"
+        "ebf0ef61407944373c862d37e6a80d4965ece72304b931428c6b3fcc5d9527c4",
+        "46b68f9130d16a96278e03d0ddb14d99b678c5a239e4667aa79733e632e67505"
       ]
     },
     "docs/decisions/content-blind-revalidation.md": {
@@ -705,6 +744,12 @@
         "dc0c9f5988fc983eb5100a085e274691b1e88a3b54ab2797e00972c4d69d61c4"
       ]
     },
+    "docs/decisions/subagent-routing.md": {
+      "since": "0.9.0",
+      "hashes": [
+        "97bb882dd066a65a740780a836199ecef8887392c1ece02a92670ecf153988d3"
+      ]
+    },
     "docs/decisions/two-empty-endings.md": {
       "since": "0.5.0",
       "hashes": [

package/templates/release-ledger.json

@@ -11,5 +11,6 @@
   "0.6.2": "2a1fc8e10cd2b65deb5c95d937fd7de39f2c92a2",
   "0.7.0": "6589db36e1daa63a99ec595191db1cccf7373196",
   "0.7.1": "52e879b6c103f6ba70493007b6a6466c57ea9824",
-  "0.8.0": "870f9a3ecae2881908ece8ec3e2ac13f84f505f5"
+  "0.8.0": "870f9a3ecae2881908ece8ec3e2ac13f84f505f5",
+  "0.9.0": "c27f391e7395accaf09354f255a07e1b9e4710c1"
 }