create-agent-rig 0.9.1 → 0.10.0

package/templates/agent-os/universal/.claude/rules/workflow.md

@@ -7,7 +7,9 @@ Red → Green → Refactor, in that order, every time:
 1. **Red** — write the test that describes the behavior; run it; watch it fail.
    Use the `test-writer` agent for this step: it writes the failing test and is
    scoped so it cannot "helpfully" write the implementation too.
-2. **Green** — the minimum implementation that makes the test pass.
+2. **Green** — the minimum implementation that makes the test pass. Use the
+   `implementation-agent` for this step: it starts from the failing test and
+   never edits a test to reach green.
 3. **Refactor** — clean up with the tests staying green.
 
 No implementation before its failing test exists. A bug fix starts with a test
@@ -34,9 +36,14 @@ that reproduces the bug.
 The session that wrote the code is measurably worse at reviewing it: it
 carries its own reasoning in context and will not challenge its own decisions
 the way a cold reader does. That is *why* `code-reviewer` is a separate
-subagent with a fresh context, and why the `pr-ship` gate fans reviewers out
-instead of self-checking. This isolation is load-bearing, not ceremony — do
-not "optimise" it away by reviewing in the authoring session.
+subagent with a fresh context. **The `pr-ship` skill, which fans reviewers
+out automatically, ships only with the opt-in workflow layer** (`init
+--layer workflow`; `AGENTS.md`'s "The opt-in workflow layer" section) —
+without it, the session itself dispatches `code-reviewer` (and
+`security-scanner`/`prose-reviewer` when their triggers fire) directly,
+before opening or merging a PR. Either way, this isolation is load-bearing,
+not ceremony — do not "optimise" it away by reviewing in the authoring
+session.
 
 A reviewer whose definition pins its model is never dispatched with a call-site
 `model`: which model reads a change is the routing policy's decision, not the
@@ -61,6 +68,13 @@ travels one path to merge, in this order:
    | `fast-path` | documentation outside the rulebook, and derived files under those same two rules | `prose-reviewer` |
    | `model` | everything else, including anything unclassifiable | `code-reviewer`, **always** |
 
+   **`.claude/scripts/decision-router.mjs` ships with the opt-in workflow
+   layer** (`init --layer workflow`; `AGENTS.md`'s "The opt-in workflow layer"
+   section). Without it, this table is still the rule — it is just applied by
+   a human or the session rather than by the script, and the safe default on
+   any doubt is `model`, exactly as the script's own refusal-to-decide reads
+   below.
+
    `.claude/scripts/decision-router.mjs` decides this from the **committed**
    diff's paths — an uncommitted edit is not routed — and **risk flags escalate
    ahead of all three**: a file under a declared elevated path, a dependency
@@ -70,8 +84,8 @@ travels one path to merge, in this order:
    so it never reaches the prose lane; `.md`/`.mdx` files and test paths that
    provision nothing are inert, so a README inside an elevated directory does
    not escalate on that ground alone. **Rulebook paths are exempt from that
-   carve-out** — `CLAUDE.md`, anything under `.claude/`, and the decision
-   records under `docs/decisions/`, which are extracted rationale and reviewed
+   carve-out** — `CLAUDE.md`, `AGENTS.md`, anything under `.claude/`, and the
+   decision records under `docs/decisions/`, which are extracted rationale and reviewed
    like the rules they explain. The inert set is otherwise those two extensions
    and test paths exactly — **not** the router's own notion of prose, which is
    `.md`/`.txt`. Neither set contains the other, and reconciling them breaks a
@@ -96,19 +110,29 @@ travels one path to merge, in this order:
      parsing, file handling, or outbound calls;
    - `prose-reviewer` when it touches the documents that instruct agents — a
      rule file, a skill, an agent spec, a decision record under
-     `docs/decisions/`, `CLAUDE.md`, the README. In this layer the prose *is*
+     `docs/decisions/`, `CLAUDE.md`, `AGENTS.md`, the README. In this layer the prose *is*
      the implementation, and it fails the same way code does: silently, in the
      direction of false confidence;
-   - an infrastructure review when it touches infrastructure (the stack layer
-     names the reviewing agent for the target).
-
-   The `pr-ship` skill drives this fan-out and returns a SHIP / HOLD verdict
-   with named blockers; blocking findings are resolved, not argued with.
+   - any additional review a repository rule explicitly names for the touched
+     surface.
+
+   **The `pr-ship` skill ships only with the opt-in workflow layer**
+   (`init --layer workflow`) and, where installed, drives this fan-out and
+   returns a SHIP / HOLD verdict with named blockers. **Without the layer,
+   the session itself drives the same fan-out** — dispatch each reviewer the
+   table and the triggers above name, read every verdict, and resolve every
+   blocking finding the same way `pr-ship` would; nothing about the review
+   floor changes with or without the skill. Blocking findings are resolved,
+   not argued with, either way.
 
    **A verdict is a block, not a sentence.** Every gate ends its report with one
-   fenced `json` block of the shape `.claude/scripts/lib/verdict.mjs` defines,
-   and `pr-ship` runs `node .claude/scripts/verdict.mjs check` on each answer
-   **before** it decides anything from it. A report that does not parse — no
+   fenced `json` block of the shape `.claude/scripts/lib/verdict.mjs` defines
+   (Core — `verdict.mjs` and its two dependencies ship unconditionally,
+   `docs/decisions/workflow-layer-split.md` explains why), and `node
+   .claude/scripts/verdict.mjs check` runs on each answer **before** anything
+   is decided from it — `pr-ship` runs it when the layer is installed; the
+   session runs the same command by hand otherwise. A report that does not
+   parse — no
    block, a word no gate returns, a blocker naming no rule, a stop naming no
    blocker — is `incomplete`: the reviewer did not answer, which is neither a
    pass nor a stop. Reading it as a pass is the failure the check exists to
@@ -118,13 +142,14 @@ travels one path to merge, in this order:
 3. **Merge — on an explicit, non-lazy criterion.** Do not trust a watcher
    command that can exit before the checks have even registered. Confirm that
    the **required** check completed successfully **for this commit** — a list
-   that is merely "not failing yet" is not a pass. The concrete command is
-   stack-specific and lives in `stack/*`; the criterion here does not name one.
+   that is merely "not failing yet" is not a pass. The concrete command is the
+   repository's documented check command when it names one; otherwise query
+   the hosting service's check runs by the exact head SHA.
 
-**Post-merge tail:** verify the deployed surface is healthy (the target's
-post-deploy verdict — `autonomy.md`), then update `PLAN.md` (close the task,
-record any follow-up in a queue). Merge is not the finish line; a healthy
-runtime and an honest plan are.
+**Post-merge tail:** update `PLAN.md` (close the task, record any follow-up in
+a queue). When the repository's own documentation declares a runtime or other
+operational surface, run the health check it documents. Merge is not the finish
+line; the queue and every declared operational check must reflect reality.
 
 ## PR policy
 
@@ -141,7 +166,7 @@ A change is done when **all** of these hold:
 - [ ] A test written first demonstrates the new behavior (and failed before the change)
 - [ ] The full test suite is green — nothing skipped, nothing weakened
 - [ ] Lint and typecheck are clean
-- [ ] Layer boundaries respected (no new cross-layer imports; core still pure)
+- [ ] Repository-specific invariants and declared boundaries remain satisfied
 - [ ] No secrets, credentials, or personal data in code, config, or fixtures
 - [ ] Docs touched by the change (README, rules) are updated
 - [ ] The autonomy tier of the change was checked and honored (`autonomy.md`)

package/templates/agent-os/universal/.claude/scripts/decision-router.mjs

@@ -1193,7 +1193,7 @@ if (invokedDirectly()) {
     process.stderr.write(
       'decision-router: nothing in this project declares an elevated path, so the ' +
         '`elevated-path` risk flag cannot be evaluated and no lane can be trusted. Add an ' +
-        '`elevated-paths` block to CLAUDE.md or a rule file. Nothing was routed — treat ' +
+        '`elevated-paths` block to AGENTS.md or a rule file. Nothing was routed — treat ' +
         'this as the expensive lane, never as a cheap one.\n',
     );
     process.exit(1);

package/templates/agent-os/universal/.claude/scripts/detect-missed-gate.mjs

@@ -36,15 +36,18 @@ import { dirname, join } from 'node:path';
  * detecting. Reading the declaration removes that failure mode instead of
  * monitoring it.
  *
- * `CLAUDE.md` carries the project's own paths; each stack layer's rule file
- * carries the ones that only exist in that shape (`infra/` comes from the
- * infrastructure layer, and a project without one must not declare it). Seeding
- * every path in one place would declare directories that do not exist in half the
- * targets — and a gate declared over a missing directory reports "clean" while
- * looking nowhere.
+ * `AGENTS.md` carries the project's own paths — it is the canonical rulebook
+ * since RP-186, and `CLAUDE.md` is a short shim that imports it and declares
+ * no block of its own; reading both costs nothing when a not-yet-migrated
+ * rig still carries the full text in `CLAUDE.md`. Each stack layer's rule
+ * file carries the ones that only exist in that shape (`infra/` comes from
+ * the infrastructure layer, and a project without one must not declare it).
+ * Seeding every path in one place would declare directories that do not
+ * exist in half the targets — and a gate declared over a missing directory
+ * reports "clean" while looking nowhere.
  */
 export const readDeclaredPaths = (projectRoot, { readFile = readFileSync, listDir = null } = {}) => {
-  const sources = [join(projectRoot, 'CLAUDE.md')];
+  const sources = [join(projectRoot, 'AGENTS.md'), join(projectRoot, 'CLAUDE.md')];
   try {
     const rulesDir = join(projectRoot, '.claude', 'rules');
     const entries = listDir ? listDir(rulesDir) : readdirSync(rulesDir);
@@ -52,7 +55,7 @@ export const readDeclaredPaths = (projectRoot, { readFile = readFileSync, listDi
       if (entry.endsWith('.md')) sources.push(join(rulesDir, entry));
     }
   } catch {
-    // no rules directory — CLAUDE.md alone then
+    // no rules directory — AGENTS.md and CLAUDE.md alone then
   }
 
   const declared = [];
@@ -396,7 +399,7 @@ export const sweep = ({ prs = [], elevatedPaths = [], epoch = null } = {}) => {
     findings.push({
       kind: 'no-elevated-paths-declared',
       why:
-        'CLAUDE.md declares no `elevated-paths` block, so this sweep cannot tell ' +
+        'AGENTS.md declares no `elevated-paths` block, so this sweep cannot tell ' +
         'an elevated merge from an ordinary one. Until it does, "no findings" ' +
         'means "did not look".',
       actions: ['journal-line', 'escalation-issue'],

package/templates/agent-os/universal/.claude/scripts/doctor.mjs

@@ -208,6 +208,66 @@ export const manifestFilesOf = (root) => {
   return files;
 };
 
+/** The closed set `layers.json` names today — the only strings `layersOf` ever echoes back. */
+const KNOWN_LAYERS = ['process', 'workflow'];
+
+/**
+ * Which `layers.json` layer(s) this rig recorded installing (RP-180), or
+ * `null` when there is no manifest to read at all — a third answer, not a
+ * guess: `report()` prints nothing about layers in that case rather than
+ * claiming either "Core only" or "every layer".
+ *
+ * A manifest with no `layers` key (every release before RP-180) means "every
+ * layer" — the CLI's own default (`packages/cli/src/lib/manifest.ts`,
+ * `LEGACY_LAYERS`), restated here rather than imported: this script ships
+ * standalone into a generated rig and has no access to the CLI package.
+ *
+ * RP-180 round 3 security review: a PRESENT `layers` is filtered down to
+ * {@link KNOWN_LAYERS} and deduplicated — never echoed as typed, and never
+ * widened to "every layer" just because it failed to parse as a clean array.
+ * A committed manifest is untrusted input read by a script whose own output
+ * lands on a terminal: an unknown or non-string entry is dropped rather than
+ * printed, and a `layers` field that is present but not a usable array (the
+ * wrong type, or an array with nothing recognisable in it) reports as
+ * `[]` — the caller's own "nothing to say" — never silently promoted back to
+ * "every layer", which is reserved for the field's TRUE ABSENCE. Bounded
+ * work regardless of the array's length: filter + `Set` is one pass, and the
+ * result can never hold more than {@link KNOWN_LAYERS}'s own two entries, so
+ * a manifest naming the same layer 100,000 times costs no more render-time
+ * output than naming it once.
+ *
+ * ⚠ **Exported for this file's own tests only — not a stable contract.**
+ * Round 4 changed this function's own return shape (`string[] | null` to
+ * `{ known, unrecognisedCount }`) to carry the unrecognised count out to
+ * `report()`; a caller outside this module that had come to depend on the
+ * OLD shape would have broken silently. `report()`'s own return value
+ * (`layers: string[] | null`, `layersUnrecognisedCount: number`) is the
+ * stable, documented surface — read that, or the rendered/`--json` output,
+ * never this function's return value directly.
+ */
+export const layersOf = (root) => {
+  const parsed = readJson(path.join(root, ...MANIFEST_REL.split('/')));
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+  if (!Object.prototype.hasOwnProperty.call(parsed, 'layers')) {
+    return { known: [...KNOWN_LAYERS], unrecognisedCount: 0 };
+  }
+  const { layers } = parsed;
+  if (!Array.isArray(layers)) return { known: [], unrecognisedCount: 0 };
+  const known = new Set();
+  let unrecognisedCount = 0;
+  // One pass, bounded regardless of the array's length: a manifest naming
+  // the same junk entry 100,000 times reports the same one count, never
+  // grows the output, and the entry itself is counted, never echoed.
+  for (const entry of layers) {
+    if (typeof entry === 'string' && KNOWN_LAYERS.includes(entry)) known.add(entry);
+    else unrecognisedCount += 1;
+  }
+  return { known: [...known], unrecognisedCount };
+};
+
+/** `workflow` reads as experimental everywhere doctor names it; every other layer is plain. */
+const layerLabel = (layer) => (layer === 'workflow' ? `${layer} (experimental)` : layer);
+
 /**
  * The files directly in `dir`: `{ names, unreadable }`, or `null` when the
  * directory itself cannot be listed. One entry that cannot be stat'ed (a dangling
@@ -307,9 +367,29 @@ export const report = (root) => {
   const all = [...problems, ...audited.hooks];
   const audit = { verdict: verdictOf(all.map((r) => r.mark)), hooks: all };
   const absent = scopes.filter((scope) => !scope.present && scope.dir !== HOOKS_DIR).map((scope) => scope.dir);
+  const layerInfo = layersOf(root);
+  // `layers` is untrusted committed input, exactly like an exemption reason
+  // or a hook's own relative path elsewhere in this report — printed only
+  // through `printable`, never raw, and an unrecognised entry is COUNTED,
+  // never echoed. An empty `known` list (but a non-null result) means the
+  // field was PRESENT and had nothing recognisable in it, which reads
+  // differently from "nothing to say" and is worth its own line. A MIXED
+  // manifest (a known layer alongside junk) says both: the known layer by
+  // name, and that something else was there and dropped.
+  const layersLine = (() => {
+    if (layerInfo === null) return null;
+    const { known, unrecognisedCount } = layerInfo;
+    const suffix =
+      unrecognisedCount > 0
+        ? ` (+${unrecognisedCount} unrecognised ${unrecognisedCount === 1 ? 'entry' : 'entries'})`
+        : '';
+    if (known.length === 0) return `**layers:** (unrecognised — see ${MANIFEST_REL})`;
+    return `**layers:** ${printable(known.map(layerLabel).join(', '))}${printable(suffix)}`;
+  })();
   const lines = [
     `**doctor** — verdict: ${audit.verdict}`,
     '',
+    ...(layersLine !== null ? [layersLine, ''] : []),
     // Names come from the file system, reasons from a repo file; both are
     // stripped of control bytes here, once, where they reach the terminal.
     ...audit.hooks.map((hook) => `- ${hook.mark} · ${printable(hook.rel)} — ${printable(hook.detail)}`),
@@ -320,7 +400,14 @@ export const report = (root) => {
     `_Not checked by this script — still yours (${UNCHECKED.length}):_`,
     ...UNCHECKED.map((item) => `- ${item}`),
   ];
-  return { ...audit, scopes, unchecked: UNCHECKED, rendered: lines.join('\n') };
+  return {
+    ...audit,
+    scopes,
+    layers: layerInfo === null ? null : layerInfo.known,
+    layersUnrecognisedCount: layerInfo === null ? 0 : layerInfo.unrecognisedCount,
+    unchecked: UNCHECKED,
+    rendered: lines.join('\n'),
+  };
 };
 
 const invokedDirectly = () => {
@@ -347,7 +434,18 @@ if (invokedDirectly()) {
   const result = report(root);
   process.stdout.write(
     args.includes('--json')
-      ? `${JSON.stringify({ verdict: result.verdict, hooks: result.hooks, scopes: result.scopes, unchecked: result.unchecked }, null, 2)}\n`
+      ? `${JSON.stringify(
+          {
+            verdict: result.verdict,
+            hooks: result.hooks,
+            scopes: result.scopes,
+            layers: result.layers,
+            layersUnrecognisedCount: result.layersUnrecognisedCount,
+            unchecked: result.unchecked,
+          },
+          null,
+          2,
+        )}\n`
       : `${result.rendered}\n`,
   );
   process.exit(result.verdict === 'STOP' ? 1 : 0);

package/templates/agent-os/universal/.claude/scripts/lib/claim-records.mjs

@@ -439,14 +439,225 @@ const committedObjectOf = (projectRoot, path) => {
   }
 };
 
-const objectOf = (projectRoot, raw) =>
-  execFileSync('git', ['-C', projectRoot, 'hash-object', '--stdin'], {
+// RP-190: `--path <relativePath>` makes `hash-object` apply the same clean
+// filter git itself would apply when staging that path — including the
+// built-in CRLF-to-LF normalisation `core.autocrlf=true` performs on commit.
+// Windows defaults `core.autocrlf` to `true`, so a checkout that
+// re-materializes a tracked (LF-committed) claim record smudges it back to
+// CRLF in the worktree; a bare `hash-object --stdin` (no `--path`) hashes
+// those CRLF bytes literally, which can never equal the LF blob `HEAD:<path>`
+// names, and the integrity check below reported "diverges" for a file whose
+// CONTENT never changed. `--path` makes this comparison ask git's own
+// question — "would `git add` at this path produce the committed blob" —
+// instead of a byte-literal one: an edit git itself would see as a
+// modification at this path still yields a different blob and still holds.
+// LIMIT: the answer is now git's, so it follows this repository's attributes
+// and configuration — a clean filter configured for the path decides what
+// counts as "unmodified", exactly as it does for `git status`.
+// Pinned in the generator's (absent in a generated rig)
+// `test/template/revalidate.test.ts` › "does not report UNVERIFIABLE when a
+// checkout re-materializes the tracked claim as CRLF", and in the generator's
+// (absent in a generated rig) `test/template/revalidate.test.ts` › "still
+// holds on a genuine content change to the tracked claim under
+// core.autocrlf=true".
+const objectOf = (projectRoot, raw, relativePath) =>
+  execFileSync('git', ['-C', projectRoot, 'hash-object', '--path', relativePath, '--stdin'], {
     encoding: 'utf8',
     env: withoutGitLocation(),
     input: raw,
     stdio: ['pipe', 'pipe', 'ignore'],
   }).trim();
 
+/**
+ * At `BEFORE_CLOSE`, `targetSha` is resolved right after this item's OWN PR
+ * merged and was fetched — so it almost always differs from the value the
+ * claim recorded at take-up, even when nothing else landed on the default
+ * branch. This asks a narrower question than "did the target move": did it
+ * move by EXACTLY the one commit that IS `mergeCommit` — the SHA the CALLER
+ * vouches for as this item's own merge (resolved from the tracker's own PR
+ * metadata, e.g. `gh pr view <pr> --json mergeCommit -q .mergeCommit.oid`,
+ * never guessed from anything inside this function) — AND that this exact
+ * checkout's own tree is what that merge commit actually shipped.
+ *
+ * This decides identity, never text. An earlier version matched the moved
+ * commit's SUBJECT LINE against the ticket id in parentheses; a review gate
+ * found that unsound on two counts — an empty commit message silently
+ * disappeared from a naive `git log` line count, and ANY commit merely
+ * mentioning the ticket (a stray doc commit, a revert of the real merge)
+ * satisfied a text match without having merged anything. Nothing here reads a
+ * commit message any more.
+ *
+ * A LATER review gate found the SHA-identity version still unsound:
+ * `mergeCommit` is pure caller attestation — the only check tying it to
+ * anything was `toSha === mergeCommit`, which a lazy or hostile
+ * `--merge-commit "$(git rev-parse origin/master)"` satisfies trivially, no
+ * matter what actually advanced the target. Conditions 5, 6 and 7 below are
+ * the fix: a LOCAL binding to `HEAD` in `projectRoot` that nothing but the
+ * actual checkout can satisfy. Condition 2 stays load-bearing on its own —
+ * it is the only place `mergeCommit` is ever compared against the REAL
+ * target advance (`toSha`); conditions 3 and 4 check `fromSha`/`toSha`
+ * without reading `mergeCommit` at all, so a caller could otherwise name a
+ * commit that is not the target's tip yet still shares HEAD's tree, and
+ * nothing past condition 2 would catch it.
+ *
+ * True only when ALL of:
+ * 1. `fromSha`, `toSha` and `mergeCommit` are each a syntactically valid git
+ *    object id, and `fromSha !== toSha`;
+ * 2. `toSha === mergeCommit` — the target's current tip literally IS the SHA
+ *    the caller named, not merely a commit somewhere in the range that
+ *    mentions the item;
+ * 3. `fromSha` is a git-ancestor of `toSha` (`merge-base --is-ancestor`) — a
+ *    target that moved BACKWARDS (a rewind, a force-push) is never exempted,
+ *    no matter what `mergeCommit` claims;
+ * 4. `git rev-list --count fromSha..toSha` is exactly `1` — counting commits,
+ *    not lines of text, so a foreign commit sharing the window with the real
+ *    merge (whether or not IT carries an empty message) still holds;
+ * 5. `mergeCommit` is neither `HEAD` nor an ancestor of it, in `projectRoot`
+ *    — `HEAD` must still be the genuine PRE-merge checkout (the loop's own
+ *    task branch, not yet fast-forwarded onto the merge). Without this, a
+ *    checkout already sitting on the merge would compare its tree against
+ *    itself and pass vacuously;
+ * 6. `fromSha` IS an ancestor of `HEAD` — `HEAD`'s own history must descend
+ *    from the same baseline the target advanced from, so a tree match can
+ *    only mean "this checkout's work is what the merge shipped", never a
+ *    coincidence from an unrelated checkout that happens to hold the same
+ *    files;
+ * 7. `git rev-parse mergeCommit^{tree}` equals `git rev-parse HEAD^{tree}` —
+ *    the exempted commit's TREE is byte-identical to this checkout's own
+ *    tree. A foreign commit whose tree DIFFERS is refused by this condition;
+ *    a stale squash (the target moved before it landed) carries that extra
+ *    content and is refused the same way. This condition judges CONTENT,
+ *    never provenance: a commit built by any other route that happens to
+ *    carry the exact byte-identical tree — meaning the target's content
+ *    really is exactly what this run's own merge would have produced — is
+ *    indistinguishable from a genuine squash merge and IS exempted. That is
+ *    judged correct, not a gap: what is being protected is the target's
+ *    content, not the mechanism that produced it.
+ *
+ * Any other shape — no `mergeCommit` supplied, a mismatch, a non-ancestor
+ * `fromSha`, more than one commit in range, `HEAD` already at or past the
+ * merge, `HEAD` not descended from `fromSha`, a tree mismatch, or git itself
+ * failing to resolve any of the above — returns false, and the caller keeps
+ * treating the target movement as scope drift exactly as it did before this
+ * existed. The false side is the safe default: this function only ever makes
+ * `scopeMoved` MORE permissive, never less, and every path that cannot prove
+ * "this SHA is my own merge, and this checkout IS the work it merged" falls
+ * back to holding.
+ *
+ * ⚠ What this function still CANNOT prove: it stops a LAZY or MISTAKEN
+ * `--merge-commit`, not an adversary who controls the run. `HEAD` is this
+ * run's own checkout — a hostile run can move it (`git checkout`,
+ * `git reset`) to whatever it likes before calling this, and `targetShaOf`
+ * (below) reads a local ref (`origin/HEAD`/`master`/`main`) a hostile run has
+ * already had every opportunity to rewrite. Every input here is something the
+ * SAME process that calls this function could have fabricated; the binding
+ * only raises the cost of an honest mistake, it does not authenticate the
+ * caller.
+ *
+ * Pinned in the generator's `test/template/revalidate.test.ts`
+ * — absent in a generated rig — › "the item's own REAL squash merge (actual
+ * file content, not an empty commit), nothing foreign, correctly named by
+ * --merge-commit", › "no --merge-commit supplied at all, even though the
+ * target moved by exactly one commit that would otherwise exempt it", › "a
+ * --merge-commit that does not match the target's new tip (the old recorded
+ * baseline sha)", › "a foreign commit plus the real merge in the same range,
+ * --merge-commit correctly naming the real one", › "an empty-message commit
+ * landing before the real merge, --merge-commit correctly naming the real
+ * one (a commit COUNT still catches it even though its subject line is
+ * blank)", › "a foreign EMPTY commit ahead of the genuine squash still holds
+ * — only the commit COUNT refuses it (conditions 2, 3, 5, 6 and 7 all pass
+ * on their own)", › "holds when content also drifted even though --merge-commit
+ * correctly identifies the target advance", › "rejects a target that moved
+ * backward off the recorded baseline, even though the final commit alone
+ * would look like a correct single-commit identity match", › "only exempts
+ * at BEFORE_CLOSE — the identical own-merge shape still holds on claim:scope
+ * at BEFORE_PR", › "a single FOREIGN commit named as --merge-commit does not
+ * exempt it — reproduces the gate-hold attack and proves it now holds", ›
+ * "a FABRICATED --merge-commit sharing HEAD's tree, correctly rooted at the
+ * baseline, but naming a commit the target never actually advanced to,
+ * still holds (condition 2 is load-bearing on its own)", › "HEAD already at
+ * the merge commit is vacuous, and still holds (a fast-forwarded checkout
+ * must not self-satisfy the exemption)", › "a squash merge of a branch that
+ * was NOT up to date still holds, even with a correctly-named
+ * --merge-commit (acceptable: the safe side)", › "a tree that matches by
+ * coincidence but shares no ancestry with the recorded baseline still holds
+ * (lineage, not just content)", › "a --merge-commit that is well-formed but
+ * names no object this repository has holds (git failure is the safe side,
+ * not a crash)", › "a foreign commit landed by another route is exempted
+ * when its tree is byte-identical to HEAD's (condition 7 judges content,
+ * not provenance)", › "pins evidence.ownMergeAdvance on the genuine
+ * own-merge case" and › "carries no evidence.ownMergeAdvance when content
+ * also drifted (the `!scopeContentMoved &&` conjunct only ever governs
+ * whether this evidence is emitted, never the verdict — content drift
+ * already holds on its own)".
+ */
+const isAncestorOf = (projectRoot, ancestor, descendant) => {
+  try {
+    execFileSync('git', ['-C', projectRoot, 'merge-base', '--is-ancestor', ancestor, descendant], {
+      env: withoutGitLocation(),
+      stdio: ['ignore', 'ignore', 'ignore'],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const revParseOrNull = (projectRoot, revision) => {
+  try {
+    return execFileSync('git', ['-C', projectRoot, 'rev-parse', '--verify', revision], {
+      encoding: 'utf8',
+      env: withoutGitLocation(),
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return null;
+  }
+};
+
+const isOwnMergeAdvance = (projectRoot, fromSha, toSha, mergeCommit) => {
+  if (
+    !GIT_OBJECT_ID.test(fromSha ?? '') ||
+    !GIT_OBJECT_ID.test(toSha ?? '') ||
+    !GIT_OBJECT_ID.test(mergeCommit ?? '') ||
+    fromSha === toSha ||
+    toSha !== mergeCommit
+  ) {
+    return false;
+  }
+  if (!isAncestorOf(projectRoot, fromSha, toSha)) return false;
+  let count;
+  try {
+    count = execFileSync(
+      'git',
+      ['-C', projectRoot, 'rev-list', '--count', `${fromSha}..${toSha}`],
+      {
+        encoding: 'utf8',
+        env: withoutGitLocation(),
+        stdio: ['ignore', 'pipe', 'ignore'],
+      },
+    ).trim();
+  } catch {
+    return false;
+  }
+  if (count !== '1') return false;
+
+  // The non-attestable part: bind the exempted commit to THIS checkout, not
+  // merely to the caller's say-so. See the doc comment above for what
+  // conditions 5-7 prove and what they still cannot.
+  const head = revParseOrNull(projectRoot, 'HEAD');
+  if (head === null) return false;
+  // 5. Vacuity guard — HEAD must be the genuine pre-merge checkout.
+  if (head === mergeCommit || isAncestorOf(projectRoot, mergeCommit, head)) return false;
+  // 6. Lineage guard — HEAD must descend from the same recorded baseline.
+  if (!isAncestorOf(projectRoot, fromSha, head)) return false;
+  // 7. The actual content binding.
+  const mergeTree = revParseOrNull(projectRoot, `${mergeCommit}^{tree}`);
+  const headTree = revParseOrNull(projectRoot, `${head}^{tree}`);
+  if (mergeTree === null || headTree === null) return false;
+  return mergeTree === headTree;
+};
+
 const readClaim = (projectRoot, path) => {
   const raw = readRepositoryFile(projectRoot, path, {
     label: 'claim record',
@@ -586,6 +797,7 @@ export const revalidateClaim = ({
   point,
   claimedState = 'in-progress',
   targetSha,
+  mergeCommit = null,
   allowCreate = false,
   isResume = false,
 }) => {
@@ -708,7 +920,7 @@ export const revalidateClaim = ({
   let claim;
   try {
     const read = readClaim(projectRoot, path);
-    if (objectOf(projectRoot, read.raw) !== committedObject) {
+    if (objectOf(projectRoot, read.raw, pointer) !== committedObject) {
       throw new Error('tracked claim worktree content diverges from its committed Git version');
     }
     claim = read.parsed;
@@ -745,9 +957,24 @@ export const revalidateClaim = ({
     pairedFacts,
   });
 
-  const scopeMoved =
-    claim.fingerprints.scope.value !== current.scope.value ||
-    claim.fingerprints.scope.targetSha !== current.scope.targetSha;
+  const scopeContentMoved = claim.fingerprints.scope.value !== current.scope.value;
+  const scopeTargetMoved = claim.fingerprints.scope.targetSha !== current.scope.targetSha;
+  // The only widening this change makes: a target that moved by nothing but
+  // this item's own squash merge is not scope drift. Content drift and
+  // commentary drift (below) stay hold-authoritative no matter what moved the
+  // target, and this only ever runs at BEFORE_CLOSE — BEFORE_PR has no merge
+  // of its own yet to exempt.
+  const scopeTargetIsOwnMerge =
+    point === 'BEFORE_CLOSE' &&
+    scopeTargetMoved &&
+    !scopeContentMoved &&
+    isOwnMergeAdvance(
+      projectRoot,
+      claim.fingerprints.scope.targetSha,
+      current.scope.targetSha,
+      mergeCommit,
+    );
+  const scopeMoved = scopeContentMoved || (scopeTargetMoved && !scopeTargetIsOwnMerge);
   const commentaryMoved = claim.fingerprints.commentary.value !== current.commentary.value;
   const movedFingerprintSet = [
     ...(scopeMoved ? ['scope'] : []),
@@ -763,6 +990,9 @@ export const revalidateClaim = ({
     evidence: {
       claim: pointer,
       ...(commentaryMoved && point !== 'BEFORE_CLOSE' ? { observedFingerprintSet: ['commentary'] } : {}),
+      ...(scopeTargetIsOwnMerge
+        ? { ownMergeAdvance: { from: claim.fingerprints.scope.targetSha, to: current.scope.targetSha } }
+        : {}),
     },
     identity: fingerprintIdentity(current),
   });

package/templates/agent-os/universal/.claude/scripts/queue/state.mjs

@@ -138,7 +138,7 @@ export const recordCompletedTier = ({ changedFiles, projectRoot, statePath, runD
   if (!declared || declared.length === 0) {
     throw new Error(
       'nothing in this project declares an elevated path, so no tier can be ' +
-        'computed: add an `elevated-paths` block to CLAUDE.md or a rule file. ' +
+        'computed: add an `elevated-paths` block to AGENTS.md or a rule file. ' +
         'Treating the absence as `normal` would ration on a declaration that ' +
         'does not exist.',
     );
@@ -157,7 +157,7 @@ export const recordCompletedTier = ({ changedFiles, projectRoot, statePath, runD
   // and silently relocating it would make it useless.
   //
   // Note the asymmetry, which is deliberate: the DECLARATION is read from the
-  // given `projectRoot` (the worktree's own `CLAUDE.md` is the rulebook the
+  // given `projectRoot` (the worktree's own `AGENTS.md` is the rulebook the
   // change was written against), while the STATE goes to the checkout that
   // outlives the task.
   const file = statePath ?? join(mainCheckoutRoot(projectRoot), '.claude', 'queue.state.json');

package/templates/agent-os/universal/.claude/scripts/reconcile-external-prs.mjs

@@ -22,9 +22,10 @@ import { dirname, join } from 'node:path';
 // Imported, never copied: one home for the elevated declaration and one home for
 // the lane rule. A second copy of either would drift, and each copy would keep
 // passing on its own.
-// `readDeclaredPaths` unions CLAUDE.md with every .claude/rules/*.md declaration,
-// so this sweep sees exactly what the gate sweep sees — including the paths a
-// stack layer contributes for its own shape.
+// `readDeclaredPaths` unions AGENTS.md (the canonical rulebook since RP-186)
+// and CLAUDE.md with every .claude/rules/*.md declaration, so this sweep sees
+// exactly what the gate sweep sees — including the paths a stack layer
+// contributes for its own shape.
 import { elevatedPathsIn, laneOf, readDeclaredPaths } from './detect-missed-gate.mjs';
 // The one credential vocabulary (`guard-secret-file`, the commit sweep and this
 // diagnostic all read it): a second list of token shapes here would drift.