create-agent-rig 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -14,6 +14,60 @@ second recorded departure; its own entry states the direction and the reason,
 and this paragraph deliberately does not restate them — a numbering rule with
 two copies of its exceptions is the shape 0.8.0 exists to remove.
 
+## 1.0.1
+
+**1.0.1 is a patch on the 1.0 line.** It closes guard gaps an unattended run
+could use to rewrite the rulebook, fixes a `doctor` side effect, and moves the
+reviewer tier of both harnesses to newer models. The 1.0 contract is
+unchanged: no flag, JSON shape, exit code, verdict or outcome word, and no
+manifest key is added, removed or renamed.
+
+### Changed
+
+- **The Claude reviewer tier runs on Opus 5.5.** `code-reviewer`,
+  `security-scanner` and `failure-diagnostician` route to `claude-opus-5-5`
+  (was `claude-opus-5`), effort `high` unchanged (RP-232).
+- **The Codex reviewer tier runs on GPT-6 Sol.** The same three roles route to
+  `gpt-6-sol` (was `gpt-5.6-sol`), reasoning effort `high` unchanged. Under
+  ChatGPT-account auth, Codex CLI 0.156.1 dispatched it and 0.154.0 rejected
+  the model id; versions in between were not tested (RP-233).
+
+### Fixed
+
+- **`guard-rulebook` judges the paths an `apply_patch` removes.** A
+  `*** Delete File:` section, and the source of a `*** Move to:`, were never
+  judged, so an armed unattended run could delete or move a rulebook file —
+  including the guard itself (RP-214).
+- **A miscased rulebook path is recognised.** `.Codex/config.toml` or
+  `.AGENTS/…` passed where the lowercase spelling was refused, and on a
+  case-insensitive filesystem the write landed on the real file. A miscased
+  allow-list entry is refused like its canonical spelling (RP-215).
+- **A Win32 trailing dot or space in a path component no longer hides a
+  rulebook path.** Windows strips them, so `.claude./settings.json` is
+  `.claude/settings.json` (RP-243).
+- **A Win32 verbatim or device path no longer hides a rulebook path.**
+  `\\?\C:\…`, `\\.\C:\…` and a `..` run above the drive root are judged as the
+  plain path Windows writes to. A UNC or other device-namespace path that does
+  not resolve under the repository root is refused while unattended rather
+  than judged as outside the rulebook (RP-244). One case stays open: when the
+  repository root is itself spelled as a UNC admin share, the local drive
+  spelling of the same file is not caught (RP-246).
+- **`doctor` no longer leaves an unattended flag in your home directory.** Its
+  guard fixture armed the flag in the invoking user's real `~/.claude` as well
+  as in its temporary home, and never cleared it (RP-238).
+- **The workflow layer's seed declares the revalidation contract elevated.**
+  `.rig/revalidation.json` was already protected from an unattended edit but
+  was missing from the `elevated-paths` seed, so the gate sweep could not see a
+  merge that rewrote it (RP-217).
+
+### Generator repository (not a rig-facing change)
+
+- The evidence-pointer check resolves a directory-qualified citation against
+  that exact path instead of any file with the same name (RP-216).
+- The package-manager CLI-start test bounds its child process and reports a
+  timeout as one (RP-212); a credential-masking test no longer serialises 41
+  fixture rewrites, which made it time out under sibling disk load (RP-218).
+
 ## 1.0.0
 
 **The harness-configuration contract is frozen.** Nothing here changes what a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agent-rig",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Configure an agent operating system (rules, gates, hooks) for Claude Code and Codex in a new or existing repository — no application scaffolding",
   "keywords": [
     "agent",

package/packages/cli/dist/integrations/doctor-guards.js

@@ -48,12 +48,13 @@ const root=fs.mkdtempSync(path.join(os.tmpdir(),'rig-guard-fixtures-'));
 const parent=path.resolve(os.tmpdir()),resolved=path.resolve(root);
 if(!resolved.startsWith(parent+path.sep)||!path.basename(resolved).startsWith('rig-guard-fixtures-'))throw new Error('unsafe fixture root');
 let code=1;
+let flag,env;
 try {
  const home=path.join(root,'home'); fs.mkdirSync(path.join(root,'.claude','agents'),{recursive:true});
  fs.writeFileSync(path.join(root,'.claude','agents','code-reviewer.md'),'---\nmodel: gpt-5.6-sol\n---\n');
- const env={...process.env,HOME:home,APPDATA:home,CLAUDE_PROJECT_DIR:root};
+ env={...process.env,HOME:home,APPDATA:home,CLAUDE_PROJECT_DIR:root};
  const unattended=path.join(source,'.claude','scripts','unattended-flag.mjs');
- const flag=await import(url.pathToFileURL(unattended).href); flag.writeUnattended({item:'fixture',runDir:root,allow:[]},env);
+ flag=await import(url.pathToFileURL(unattended).href); flag.writeUnattended({item:'fixture',runDir:root,allow:[]},env);
  const run=(rel,input)=>cp.spawnSync(process.execPath,[path.join(source,...rel.split('/'))],{cwd:root,env,input:JSON.stringify(input),encoding:'utf8',timeout:5000,maxBuffer:8192}).status;
  const pre=(tool_input)=>({hook_event_name:'PreToolUse',tool_name:tool_input.command?'Bash':'Write',tool_input});
  const cases=[
@@ -69,7 +70,10 @@ try {
   ['.claude/hooks/guard-subagent-model.mjs',{hook_event_name:'PreToolUse',tool_name:'Agent',tool_input:{subagent_type:'code-reviewer'}},true]
  ];
  for(const [rel,input,allowed] of cases){const status=run(rel,input);if(allowed ? status!==0 : status!==2){code=1;break;} code=0;}
-} finally { fs.rmSync(resolved,{recursive:true,force:true}); }
+} finally {
+ try { if(flag&&typeof flag.clearUnattended==='function') flag.clearUnattended(env); } catch {}
+ fs.rmSync(resolved,{recursive:true,force:true});
+}
 process.exitCode=code;
 })().catch(()=>{process.exitCode=1;});
 `;

package/templates/agent-os/subagent-routing.json

@@ -1,6 +1,6 @@
 {
   "claudeModels": {
-    "claude-opus-5": ["low", "medium", "high", "xhigh", "max"],
+    "claude-opus-5-5": ["low", "medium", "high", "xhigh", "max"],
     "claude-sonnet-5": ["low", "medium", "high", "xhigh", "max"]
   },
   "unnamed": {
@@ -21,16 +21,16 @@
       "codex": { "model": "gpt-5.6-terra", "effort": "high" }
     },
     "code-reviewer": {
-      "claude": { "model": "claude-opus-5", "effort": "high" },
-      "codex": { "model": "gpt-5.6-sol", "effort": "high" }
+      "claude": { "model": "claude-opus-5-5", "effort": "high" },
+      "codex": { "model": "gpt-6-sol", "effort": "high" }
     },
     "security-scanner": {
-      "claude": { "model": "claude-opus-5", "effort": "high" },
-      "codex": { "model": "gpt-5.6-sol", "effort": "high" }
+      "claude": { "model": "claude-opus-5-5", "effort": "high" },
+      "codex": { "model": "gpt-6-sol", "effort": "high" }
     },
     "failure-diagnostician": {
-      "claude": { "model": "claude-opus-5", "effort": "high" },
-      "codex": { "model": "gpt-5.6-sol", "effort": "high" }
+      "claude": { "model": "claude-opus-5-5", "effort": "high" },
+      "codex": { "model": "gpt-6-sol", "effort": "high" }
     }
   }
 }

package/templates/agent-os/universal/.claude/agents/code-reviewer.md

@@ -2,7 +2,7 @@
 name: code-reviewer
 description: Reviews a completed change against the checklist before a PR is opened or merged. Use after any non-trivial implementation work, and always before opening a PR that reaches the `model` lane — everything the two cheap lanes do not claim (code, a rulebook document, an unclassifiable path, a derived artifact git does not report as drift, or anything a risk flag escalated), decided by `decision-router.mjs` where the opt-in workflow layer is installed, or by the same rule applied by hand otherwise. Blocking findings must be resolved, not argued with.
 tools: Read, Grep, Glob, Bash
-model: claude-opus-5
+model: claude-opus-5-5
 effort: high
 ---
 

package/templates/agent-os/universal/.claude/agents/failure-diagnostician.md

@@ -2,7 +2,7 @@
 name: failure-diagnostician
 description: Use when a check is red or a run crashed and the cause is not obvious, or to reproduce a claimed defect/historical finding on the current default branch before work is planned on it.
 tools: Read, Grep, Glob, Bash
-model: claude-opus-5
+model: claude-opus-5-5
 effort: high
 ---
 

package/templates/agent-os/universal/.claude/agents/security-scanner.md

@@ -2,7 +2,7 @@
 name: security-scanner
 description: Scans a change for security issues. MUST be used when a change touches authentication, authorization, secrets or configuration, input parsing, file handling, or any new outbound call. Findings gate the PR.
 tools: Read, Grep, Glob, Bash
-model: claude-opus-5
+model: claude-opus-5-5
 effort: high
 ---
 

package/templates/agent-os/universal/.claude/hooks/guard-rulebook.mjs

@@ -28,7 +28,8 @@
 //      names the flag; an edit outside the rulebook still passes. Refusing to
 //      inspect is not allowing (`.claude/rules/invariants.md`).
 //
-// Limits — each stated here and each measured in the generator's
+// Limits — each stated here and, unless it is marked untested, measured in
+// the generator's
 // `test/template/guard-rulebook.test.ts` (absent in a generated rig), by the
 // test named beside it:
 //   - it sees one edit at a time, as text, before it lands — a rulebook file
@@ -62,17 +63,46 @@
 //     prefix (`.`, `.claude/`, `.claude/scripts/`) makes the flag unreadable
 //     and the guard refuses — › "a flag whose allow-list widens the rulebook is
 //     unreadable, so `--allow .` cannot disarm it";
+//   - a miscased payload path is judged against the rulebook's CANONICAL
+//     spelling (`unattended-flag.mjs`'s `canonicalRulebookPath`), but an
+//     `allow` entry never is — a miscased entry authorizes nothing, including
+//     the one prefix deliberately withheld as an allow root
+//     (`.claude/scripts/`) and the board selector, refused regardless of case
+//     — › "guard-rulebook: an allow-list entry is judged by its literal
+//     spelling, not the one the payload folds to (RP-215 round 2)";
 //   - fail-open on its own errors and on a payload it cannot parse — › "allows
 //     an empty payload object" and › "allows non-JSON stdin" — and fail-closed
 //     on a flag it cannot read — › "blocks a rulebook edit when the flag exists
 //     but cannot be read, and names the file": the guard targets drift, not an
-//     adversary.
+//     adversary;
+//   - a `//`-prefixed normalised path is refused rather than resolved while
+//     armed exactly when it does not relativise under any comparison root —
+//     a repository root spelled as a plain path can never strip a UNC admin
+//     share or a device path with no drive letter (`\\?\Volume{GUID}\…`), but
+//     a root that is itself UNC-spelled (`CLAUDE_PROJECT_DIR` as
+//     `\\server\share\repo`) strips a payload path genuinely under it, and
+//     such a path is judged normally instead — › "guard-rulebook: an
+//     unjudgeable UNC/device-namespace path is refused, not silently allowed
+//     (RP-244 round 2)" and › "guard-rulebook: a `//`-prefixed path is
+//     refused only when it resolves under no repository root (RP-244
+//     round 3)". The same refusal covers a MultiEdit past the fragment cap
+//     (the `appliesToAll` global refusal) aimed at such a path, not only the
+//     ordinary per-fragment case — › "guard-rulebook: a MultiEdit global
+//     refusal is not exempt from the `//`-prefix refusal (RP-244 round 3)";
+//   - the reverse direction is untested and left as a design limit: when the
+//     repository root is itself spelled as a UNC admin share
+//     (`\\host\X$\…`), the LOCAL DRIVE spelling of the same file (`X:\…`) is
+//     never placed against it — `relativeTo` strips a `//`-prefixed payload
+//     path from a `//`-rooted comparison root, not a drive-letter one from
+//     it — so such a payload path is judged normally rather than refused as
+//     unjudgeable, and a rulebook edit reaching the guard that way is not
+//     caught. Tracked as RP-246.
 //
 // The rule it enforces is stated in `.claude/rules/autonomy.md`, "Never".
 import { realpathSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { editFragments } from './lib/edit-input.mjs';
-import { RULEBOOK_PREFIXES, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
+import { RULEBOOK_PREFIXES, canonicalRulebookPath, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
 import { readHookInput } from './lib/hook-input.mjs';
 
 export { RULEBOOK_PREFIXES, isRulebookPath };
@@ -134,10 +164,38 @@ export const isAllowed = (rel, allow) =>
 // otherwise, the same way `canonicalRoot`/`comparisonRoots` above seed both
 // spellings of the checkout root. Every other edit surface never sets it, so
 // this is a no-op for them.
-const protectedRelative = (roots, filePath, rawFilePath) =>
-  [...new Set([filePath, rawFilePath, canonicalPath(filePath)].filter((spelling) => typeof spelling === 'string' && spelling !== ''))]
-    .flatMap((spelling) => roots.map((root) => relativeTo(root, spelling)))
-    .find(isRulebookPath);
+//
+// RP-215 round 2: the return value is the CANONICAL rulebook spelling
+// (`canonicalRulebookPath`), not the candidate that matched it. `isAllowed`
+// and the `.claude/queue.board` carve-out below both compare this result
+// against literal allow-list entries, so a miscased entry (`.Claude/`,
+// `.claude/Scripts/`) never matches — only the path is canonicalised, never
+// the allow-list. See the generator's `test/template/guard-rulebook.test.ts` (absent in a generated rig) ›
+// "guard-rulebook: an allow-list entry is judged by its literal spelling,
+// not the one the payload folds to (RP-215 round 2)".
+const protectedRelative = (roots, filePath, rawFilePath) => {
+  const candidates = [...new Set([filePath, rawFilePath, canonicalPath(filePath)].filter((spelling) => typeof spelling === 'string' && spelling !== ''))]
+    .flatMap((spelling) => roots.map((root) => relativeTo(root, spelling)));
+  for (const candidate of candidates) {
+    const canonical = canonicalRulebookPath(candidate);
+    if (canonical !== undefined) return canonical;
+  }
+  return undefined;
+};
+
+// RP-244 round 3: a `//`-prefixed normalised path is undecidable ONLY when it
+// does not relativise under any comparison root — reusing `relativeTo`, the
+// same comparison `protectedRelative` above already makes, rather than a
+// second implementation. A UNC-spelled repository root (`CLAUDE_PROJECT_DIR`
+// itself a `\\server\share\repo` spelling) maps to the same `//`-prefixed
+// shape a payload path under it normalises to, so `relativeTo` CAN strip it —
+// and a path that strips cleanly is judged normally, not refused as
+// unjudgeable, whether or not it lands inside the rulebook.
+const isUnjudgeablePath = (roots, filePath) => {
+  if (typeof filePath !== 'string' || !filePath.startsWith('//')) return false;
+  const file = toPosix(filePath);
+  return !roots.some((root) => relativeTo(root, filePath) !== file);
+};
 
 function main() {
   const input = readHookInput();
@@ -154,8 +212,28 @@ function main() {
   );
   if (globalRefusal) {
     if (globalRefusal.filePath) {
+      // No `rawFilePath` argument here: the only `appliesToAll` refusal that
+      // carries a non-empty `filePath` at all is the MultiEdit fragment-cap
+      // refusal (`edit-input.mjs`), and it never sets `rawFilePath` — so
+      // there is nothing a third argument would add for this call site.
       const rel = protectedRelative(comparisonRoots, globalRefusal.filePath);
-      if (rel === undefined) return 0;
+      if (rel === undefined) {
+        // RP-244 round 3: `rel === undefined` used to read as "outside the
+        // rulebook, never judged" unconditionally — exactly the reading the
+        // per-fragment block below already proved wrong for a `//`-prefixed
+        // path that resolves under no comparison root. A global refusal
+        // carrying such a path is refused the same way, instead of exiting 0
+        // before `isUnjudgeablePath` is ever consulted.
+        if (!isUnjudgeablePath(comparisonRoots, globalRefusal.filePath)) return 0;
+        const mode = readUnattended(unattendedEnv);
+        if (!mode.on) return 0;
+        process.stderr.write(
+          `BLOCKED — "${globalRefusal.filePath}" could not be resolved against the repository root: ` +
+            'a UNC or device-namespace path is refused rather than judged while unattended. ' +
+            'Write through the repository path instead.\n',
+        );
+        return 2;
+      }
     }
     const mode = readUnattended(unattendedEnv);
     if (!mode.on) return 0;
@@ -165,25 +243,60 @@ function main() {
     );
     return 2;
   }
+  // RP-244 round 2: `normalisePath` (`edit-input.mjs`) maps a UNC or other
+  // device-namespace spelling to a `//`-prefixed result — `relativeTo` can
+  // only strip a path that starts with the literal repository root, and a
+  // `//`-prefixed path never does, on any platform or root. That is not
+  // "outside the rulebook": it is undecidable, and undecidable is refused,
+  // not allowed, while armed (`.claude/rules/invariants.md`, "The remedy
+  // belongs to the refusal"). RP-244 round 3: "does not relativise under any
+  // comparison root" replaces the plain `startsWith('//')` check — a
+  // UNC-spelled repository root makes a payload path under it decidable, so
+  // it is judged normally rather than refused as unjudgeable.
+  const unjudgeable = fragments.find(({ filePath }) => isUnjudgeablePath(comparisonRoots, filePath));
+
   const paths = [];
   for (const { filePath, rawFilePath } of fragments) {
     if (typeof filePath !== 'string' || filePath === '') continue;
     const rel = protectedRelative(comparisonRoots, filePath, rawFilePath);
     if (rel !== undefined && !paths.includes(rel)) paths.push(rel);
   }
-  if (paths.length === 0) return 0; // nothing under the rulebook: never judged
+  if (paths.length === 0 && !unjudgeable) return 0; // nothing under the rulebook: never judged
 
   const mode = readUnattended(unattendedEnv);
   if (!mode.on) return 0; // attended session
 
   if (mode.unreadable) {
+    // RP-244 round 3: `paths[0] ?? unjudgeable.filePath` used to print "is
+    // part of the rulebook" even when `paths` was empty and only an
+    // unjudgeable `//`-prefixed path put this branch on the table — a claim
+    // this guard never established. An unjudgeable path gets the same
+    // "could not be resolved" reason it gets everywhere else in this file.
+    const target = paths[0];
+    if (target === undefined) {
+      process.stderr.write(
+        `BLOCKED — "${unjudgeable.filePath}" could not be resolved against the repository root, ` +
+          `and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
+          'Refusing to inspect is not allowing: fix it, or clear this checkout with `node .claude/scripts/unattended-flag.mjs off --root "$PWD"`, then retry.\n',
+      );
+      return 2;
+    }
     process.stderr.write(
-      `BLOCKED — "${paths[0]}" is part of the rulebook and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
+      `BLOCKED — "${target}" is part of the rulebook and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
         'Refusing to inspect is not allowing: fix it, or clear this checkout with `node .claude/scripts/unattended-flag.mjs off --root "$PWD"`, then retry.\n',
     );
     return 2;
   }
 
+  if (unjudgeable) {
+    process.stderr.write(
+      `BLOCKED — "${unjudgeable.filePath}" could not be resolved against the repository root: ` +
+        'a UNC or device-namespace path is refused rather than judged while unattended. ' +
+        'Write through the repository path instead.\n',
+    );
+    return 2;
+  }
+
   const refused = paths.filter(
     (rel) => rel === '.claude/queue.board' || !isAllowed(rel, mode.allow),
   );

package/templates/agent-os/universal/.claude/hooks/guard-secret-file.mjs

@@ -99,7 +99,11 @@ function main() {
   const editTools = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply_patch']);
   if (!editTools.has(input?.tool_name)) return 0;
 
-  const fragments = editFragments(input);
+  // RP-214: `editFragments` also reports a removal (a Delete File section, or
+  // the source half of a Move) as its own fragment, `removes: true` — deleting
+  // a credential file is not writing one, so this guard never judges those,
+  // including an inspection refusal attached to one.
+  const fragments = editFragments(input).filter(({ removes }) => !removes);
   const globalRefusal = fragments.find(
     ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
   );

package/templates/agent-os/universal/.claude/hooks/lib/edit-input.mjs

@@ -4,7 +4,11 @@
  * Claude sends Write/Edit fields directly. Codex sends an apply_patch command,
  * so added lines are returned for ordinary edits. A move is different: the
  * destination receives the existing file too, so guards inspect the resulting
- * content instead of only the patch additions when inspection succeeds.
+ * content instead of only the patch additions when inspection succeeds. A
+ * removal — a `*** Delete File:` section, or the source half of a
+ * `*** Move to:` — also becomes its own fragment, `removes: true`, `fragment:
+ * ''` (RP-214): the path stops existing, which a guard judging paths still
+ * needs to see even though there is no text to inspect.
  *
  * Inspection is bounded globally per patch: sources, hunks, output, splices,
  * comparisons, sections and path components.
@@ -240,6 +244,21 @@ function patchFragments(command, payloadCwd) {
   let current = null;
   let patchRefusal = null;
 
+  // RP-214: one counter, spent on every path this section resolves — the
+  // destination (or the removed path, for a Delete File section) and, for a
+  // Move, the source too (below). Still one forward pass, still the same
+  // bound.
+  const overPathComponentBudget = (value) => {
+    budget.pathComponents += String(value ?? '').replaceAll('\\', '/').split('/').length;
+    return budget.pathComponents > MAX_PATCH_PATH_COMPONENTS;
+  };
+  const pathComponentRefusal = () => ({
+    filePath: '',
+    fragment: '',
+    inspectionRefusal: `apply_patch destination path component count exceeds the ${MAX_PATCH_PATH_COMPONENTS}-component inspection limit`,
+    appliesToAll: true,
+  });
+
   const flush = () => {
     if (current !== null) {
       budget.sections += 1;
@@ -254,16 +273,8 @@ function patchFragments(command, payloadCwd) {
         return false;
       }
       const destinationPath = current.moveTo ?? current.sourcePath;
-      budget.pathComponents += String(destinationPath ?? '')
-        .replaceAll('\\', '/')
-        .split('/').length;
-      if (budget.pathComponents > MAX_PATCH_PATH_COMPONENTS) {
-        patchRefusal = {
-          filePath: '',
-          fragment: '',
-          inspectionRefusal: `apply_patch destination path component count exceeds the ${MAX_PATCH_PATH_COMPONENTS}-component inspection limit`,
-          appliesToAll: true,
-        };
+      if (overPathComponentBudget(destinationPath)) {
+        patchRefusal = pathComponentRefusal();
         current = null;
         return false;
       }
@@ -274,6 +285,22 @@ function patchFragments(command, payloadCwd) {
           fragment: '',
           inspectionRefusal: 'patch destination is outside the repository or cannot be resolved safely',
           appliesToAll: true,
+          // RP-214: a Delete File section has no destination — only the
+          // removed path itself — so this refusal is about a removal too;
+          // carry the flag so a guard that must not treat a removal as a
+          // write (guard-secret-file) can still tell the two apart.
+          ...(current.removes ? { removes: true } : {}),
+        });
+      } else if (current.removes) {
+        // RP-214: `*** Delete File: <path>` used to flush only the SECTION
+        // BEFORE it and never turn the removed path itself into a fragment —
+        // resolved the same way every other verb resolves its path, through
+        // `repositoryPatchPath` and the same budgets above, in this same pass.
+        fragments.push({
+          filePath: destination.resolved,
+          rawFilePath: destination.raw,
+          fragment: '',
+          removes: true,
         });
       } else {
         const moved = current.moveTo
@@ -285,6 +312,31 @@ function patchFragments(command, payloadCwd) {
         // through a guarded prefix that is itself a symlink/junction to
         // somewhere else inside the checkout.
         fragments.push({ filePath: destination.resolved, rawFilePath: destination.raw, ...moved });
+
+        if (current.moveTo) {
+          // RP-214: a Move's SOURCE stops existing too — it is a removal the
+          // line above never surfaced, because `current.moveTo ?? …`
+          // resolves only the destination. One more path through the same
+          // resolver and the same budgets, still inside this one flush.
+          if (overPathComponentBudget(current.sourcePath)) {
+            patchRefusal = pathComponentRefusal();
+            current = null;
+            return false;
+          }
+          const source = repositoryPatchPath(current.sourcePath, budget);
+          fragments.push(
+            source === null
+              ? {
+                  filePath: '',
+                  fragment: '',
+                  inspectionRefusal:
+                    'patch destination is outside the repository or cannot be resolved safely',
+                  appliesToAll: true,
+                  removes: true,
+                }
+              : { filePath: source.resolved, rawFilePath: source.raw, fragment: '', removes: true },
+          );
+        }
       }
       current = null;
     }
@@ -303,7 +355,17 @@ function patchFragments(command, payloadCwd) {
       current.moveTo = move[1];
       continue;
     }
-    if (/^\*\*\* (?:Delete File|End Patch)/.test(line)) {
+    // RP-214: a Delete File section becomes its own fragment — `removes:
+    // true`, resolved through the same path the other verbs use — instead of
+    // only flushing whatever section came before it.
+    const del = /^\*\*\* Delete File: (.+)$/.exec(line);
+    if (del) {
+      if (!flush()) break;
+      current = { sourcePath: del[1], moveTo: null, additions: [], hunks: [], activeHunk: null, removes: true };
+      if (!flush()) break;
+      continue;
+    }
+    if (/^\*\*\* End Patch/.test(line)) {
       if (!flush()) break;
       continue;
     }
@@ -486,9 +548,88 @@ function inspectionRefusal(current, reason) {
   return { fragment: current.additions.join('\n'), inspectionRefusal: reason };
 }
 
+// RP-244: a Win32 verbatim (`\\?\`) or device-namespace (`\\.\`) prefix, in
+// any slash mix, names the plain drive (or UNC) path underneath it. The
+// backslash-to-slash conversion below would collapse the leading `//` these
+// prefixes depend on, so they are stripped first. Anchored at the very start:
+// a prefix check, not a scan, which keeps this inside the fail-open
+// bounded-work rule.
+//
+// RP-244 round 2: `[\\/]+` (not `[\\/]`) after the `?`/`.` marker, so a
+// doubled separator still strips. A DRIVE match (`\\?\C:\…`) is the only case
+// that yields a plain, prefix-free spelling — every other two-separator input
+// (verbatim UNC, plain UNC, a device path with no drive letter such as
+// `\\?\Volume{GUID}\…`) is judged as UNDECIDABLE by a repository root spelled
+// as a plain path, so it keeps a leading `//` instead, with its remainder
+// normalised as ABSOLUTE (clamped at root) rather than relative — a relative
+// normalisation let a crafted run of `../` segments do unbounded work instead
+// of collapsing at the root.
+const WIN32_VERBATIM_UNC_PREFIX = /^[\\/]{2}[?.][\\/]+UNC(?:[\\/]+|$)/i;
+const WIN32_VERBATIM_DRIVE_PREFIX = /^[\\/]{2}[?.][\\/]+([A-Za-z]:)/;
+// RP-244 round 3: a drive letter followed immediately by a separator — the
+// drive ROOT, as opposed to the drive-RELATIVE `C:foo\bar` spelling below,
+// which carries no separator there. `slashed` has already had every
+// backslash converted to `/` by the time this is applied, so only the
+// forward-slash form is checked.
+const DRIVE_ROOT_PREFIX = /^[A-Za-z]:\//;
+// RP-244 round 4: a drive letter with NO separator immediately following —
+// the DRIVE-RELATIVE spelling, which Win32 resolves against the current
+// directory of that drive rather than the drive root, so (unlike
+// DRIVE_ROOT_PREFIX above) it has no root of its own to clamp at. Mutually
+// exclusive with DRIVE_ROOT_PREFIX by construction: one requires a `/`
+// immediately after the colon, this one requires there is none (including
+// end of string, for a bare `C:`).
+const DRIVE_RELATIVE_PREFIX = /^[A-Za-z]:(?!\/)/;
+
+// RP-244 round 3: the DRIVE branch below and the plain fallback both used to
+// run `path.posix.normalize` over the drive letter and its remainder
+// TOGETHER, relatively — so a leading `..` walked straight past the drive
+// letter (`C:/../Users/…` normalised to the relative `Users/…`, not clamped
+// at `C:/`) instead of stopping at the root the way Win32 does, and a long
+// run of `../` segments did unbounded relative work instead of the linear
+// work an absolute normalisation does. Splitting the drive off first and
+// normalising only the remainder, ABSOLUTE, fixes both: `path.posix.normalize`
+// clamps an absolute `..` run at `/` instead of carrying it past the drive.
+//
+// RP-244 round 4: the drive-RELATIVE case (no separator after the colon) got
+// the same together-normalisation treatment via the plain `else` branch below
+// — `path.posix.normalize` reads a leading `C:..` segment as an ordinary
+// filename, not the literal `..`, so a second `..` cancelled it and the
+// drive marker vanished from the result (`C:../../a/b` → `a/b`). Splitting
+// the drive off here too and normalising the remainder alone — RELATIVELY,
+// never absolutely, since a drive-relative spelling has no root to clamp
+// at — keeps a `..` in the remainder from ever reaching back far enough to
+// cancel the marker itself; an empty remainder (a bare `C:`) is left as-is
+// rather than turned into `C:.`, unchanged from before this round.
+function clampAtDriveRoot(slashed) {
+  if (DRIVE_ROOT_PREFIX.test(slashed)) {
+    return slashed.slice(0, 2) + path.posix.normalize(slashed.slice(2));
+  }
+  if (DRIVE_RELATIVE_PREFIX.test(slashed)) {
+    const remainder = slashed.slice(2);
+    return remainder === '' ? slashed : slashed.slice(0, 2) + path.posix.normalize(remainder);
+  }
+  return path.posix.normalize(slashed);
+}
+
 function normalisePath(value) {
-  const slashed = String(value ?? '').trim().replaceAll('\\', '/');
-  return slashed === '' ? '' : path.posix.normalize(slashed);
+  const raw = String(value ?? '').trim();
+  if (raw === '') return '';
+  const driveMatch = WIN32_VERBATIM_DRIVE_PREFIX.exec(raw);
+  if (driveMatch) {
+    const slashed = raw.replace(WIN32_VERBATIM_DRIVE_PREFIX, '$1').replaceAll('\\', '/');
+    return slashed === '' ? '' : clampAtDriveRoot(slashed);
+  }
+  const uncMatch = WIN32_VERBATIM_UNC_PREFIX.exec(raw);
+  if (uncMatch || /^[\\/]{2}/.test(raw)) {
+    const rest = (uncMatch ? raw.slice(uncMatch[0].length) : raw.slice(2)).replaceAll('\\', '/');
+    // Absolute normalisation, not relative: clamps a leading `../` run at the
+    // root instead of carrying it through — the outer `'/' +` restores the
+    // `//` marker that `path.posix.normalize` collapses to one.
+    return '/' + path.posix.normalize('/' + rest);
+  }
+  const slashed = raw.replaceAll('\\', '/');
+  return slashed === '' ? '' : clampAtDriveRoot(slashed);
 }
 
 function canonicalPatchPath(value) {

package/templates/agent-os/universal/.claude/scripts/unattended-flag.mjs

@@ -104,9 +104,137 @@ export const RULEBOOK_PREFIXES = Object.freeze([
   '.rig/revalidation.json',
 ]);
 
-/** Is this repo-relative path part of the rulebook? */
-export const isRulebookPath = (rel) =>
-  RULEBOOK_PREFIXES.some((prefix) => rel === prefix || rel.startsWith(prefix));
+// Case-folded once at module load, for the same comparison every caller shares
+// — never re-derived per call, and never used anywhere but inside
+// `isWidening` below (`canonicalRulebookPath` folds its own comparison from
+// `RULEBOOK_PREFIX_SEGMENTS` instead).
+const FOLDED_RULEBOOK_PREFIXES = RULEBOOK_PREFIXES.map((prefix) => prefix.toLowerCase());
+
+/**
+ * The canonical rulebook spelling of a repo-relative path, or `undefined`
+ * when it names no rulebook prefix at all. Case-insensitive on the PREFIX
+ * match only — NTFS and default APFS resolve a miscased spelling
+ * (`.Codex/config.toml`) to the same file as the canonical one, and this
+ * comparison is what a directory this checkout has never created yet (or
+ * any path on a case-sensitive filesystem) reaches, exactly as spelled by
+ * the caller — see the generator's `test/template/guard-rulebook.test.ts`
+ * (absent in a generated rig) › "guard-rulebook: blocks a miscased
+ * rulebook path even when the guarded directory does not exist on disk yet
+ * (RP-215)" › "blocks a Write to .Codex/config.toml when .codex/ is absent
+ * from the checkout".
+ *
+ * RP-215 round 2: the returned spelling replaces only the matched prefix
+ * characters with `RULEBOOK_PREFIXES`' own spelling — the remainder of the
+ * path (and any allow-list entry) keeps whatever case it was written in.
+ * This is the one place a path is re-cased; every comparison downstream
+ * (`isAllowed`, the `.claude/queue.board` carve-out in `guard-rulebook.mjs`)
+ * takes this canonical value and stays a literal, case-sensitive match —
+ * canonicalising the PATH, never folding the ALLOW-LIST, is what keeps a
+ * miscased allow entry (`.Claude/`, `.claude/Scripts/`) from ever matching
+ * anything, including the one prefix deliberately withheld as an allow root
+ * (`.claude/scripts/`, `isWidening`).
+ *
+ * RP-243: before the fold above, a trailing run of `.`/` ` is stripped from
+ * a path component — `.codex./config.toml` folds the same as
+ * `.codex/config.toml` — except a component made entirely of dots (`.`,
+ * `..`), left untouched so a traversal segment is never collapsed into an
+ * empty name. Only the PATH is normalised this way, never an allow-list
+ * entry — the same asymmetry as the case fold above.
+ *
+ * RP-243 round 2: only the components the matched prefix itself spans are
+ * normalised — bounded by the longest `RULEBOOK_PREFIXES` entry's own
+ * segment count, computed once below — so a component beyond that span
+ * keeps its literal spelling and the canonical path returns it raw. See the
+ * generator's `test/template/unattended-flag.test.ts` (absent in a
+ * generated rig) › "isRulebookPath: a trailing dot or space on a path
+ * component is judged the same as the component with it stripped (RP-243)".
+ */
+const stripTrailingDotsAndSpaces = (component) => {
+  if (/^\.+$/.test(component)) return component;
+  let end = component.length;
+  while (end > 0) {
+    const code = component.charCodeAt(end - 1);
+    if (code !== 46 /* '.' */ && code !== 32 /* ' ' */) break;
+    end -= 1;
+  }
+  return end === component.length ? component : component.slice(0, end);
+};
+
+/**
+ * `RULEBOOK_PREFIXES` split into segments once, at module load — a directory
+ * entry (`.claude/hooks/`) drops its trailing slash first, so both forms
+ * yield the segment names a path's own `/`-split components are compared
+ * against. `directory` records whether the entry itself ended in `/`: a
+ * directory entry needs an exact fold-match on every one of its segments
+ * plus something after them; a file entry (`CLAUDE.md`, `.rig/revalidation.json`)
+ * is matched with a `startsWith` on its last segment — see the generator's
+ * `test/template/unattended-flag.test.ts` (absent in a generated rig) ›
+ * "isRulebookPath: a path continuing past a matched FILE entry is still a rulebook path (round 3 regression)".
+ */
+const RULEBOOK_PREFIX_SEGMENTS = RULEBOOK_PREFIXES.map((prefix) => {
+  const directory = prefix.endsWith('/');
+  const segments = (directory ? prefix.slice(0, -1) : prefix).split('/');
+  const foldedSegments = segments.map((segment) => segment.toLowerCase());
+  return { prefix, directory, foldedSegments, length: segments.length };
+});
+
+// The most components any single entry's match can ever need to inspect —
+// never re-derived per call, and the only thing that bounds how many of a
+// path's own components `canonicalRulebookPath` normalises.
+const MAX_PREFIX_SEGMENTS = RULEBOOK_PREFIX_SEGMENTS.reduce(
+  (max, entry) => Math.max(max, entry.length),
+  0,
+);
+
+export const canonicalRulebookPath = (rel) => {
+  const components = rel.split('/');
+  const headCount = Math.min(components.length, MAX_PREFIX_SEGMENTS);
+  const normalisedHead = new Array(headCount);
+  const foldedHead = new Array(headCount);
+  for (let i = 0; i < headCount; i += 1) {
+    normalisedHead[i] = stripTrailingDotsAndSpaces(components[i]);
+    foldedHead[i] = normalisedHead[i].toLowerCase();
+  }
+  for (const entry of RULEBOOK_PREFIX_SEGMENTS) {
+    const { directory, foldedSegments, length: segmentCount, prefix } = entry;
+    if (components.length < segmentCount) continue;
+    let leadingMatches = true;
+    for (let i = 0; i < segmentCount - 1; i += 1) {
+      if (foldedHead[i] !== foldedSegments[i]) {
+        leadingMatches = false;
+        break;
+      }
+    }
+    if (!leadingMatches) continue;
+    const lastFolded = foldedHead[segmentCount - 1];
+    const lastSegment = foldedSegments[segmentCount - 1];
+    if (directory) {
+      if (lastFolded !== lastSegment) continue;
+      if (components.length === segmentCount) continue; // no trailing slash, nothing after
+      if (components.length === segmentCount + 1 && components[segmentCount] === '') {
+        return prefix; // the path itself ends with the literal trailing slash
+      }
+      return prefix + components.slice(segmentCount).join('/');
+    }
+    // File entry: the last spanned component is compared folded+normalised,
+    // same as every other component this function inspects; anything past
+    // it — the rest of that component, and every component after it — is
+    // returned exactly as written.
+    if (lastFolded === lastSegment) {
+      if (components.length === segmentCount) return prefix;
+      return `${prefix}/${components.slice(segmentCount).join('/')}`;
+    }
+    if (lastFolded.startsWith(lastSegment)) {
+      const extra = normalisedHead[segmentCount - 1].slice(lastSegment.length);
+      if (components.length === segmentCount) return prefix + extra;
+      return `${prefix}${extra}/${components.slice(segmentCount).join('/')}`;
+    }
+  }
+  return undefined;
+};
+
+/** Is this repo-relative path part of the rulebook? See `canonicalRulebookPath`. */
+export const isRulebookPath = (rel) => canonicalRulebookPath(rel) !== undefined;
 
 /**
  * Does this allow entry widen the rulebook? It is unsafe when it is an
@@ -116,14 +244,25 @@ export const isRulebookPath = (rel) =>
  * protected script paths sit under `.claude/scripts/`; a narrower path such as
  * `.claude/scripts/queue/` is an ordinary allow entry and does not widen it.
  * `src/` also does not widen it because the guard judges nothing there.
+ *
+ * RP-215 round 2: the entry is case-folded once before either comparison —
+ * the allow side now folds like the path side (`canonicalRulebookPath`) — so
+ * a miscased entry (`.Claude/`, `.claude/Scripts/`) is judged exactly like its
+ * canonical spelling instead of slipping through as ordinary, harmless text;
+ * see the generator's `test/template/unattended-flag.test.ts` (absent in a
+ * generated rig) › "isWidening: a miscased allow entry must be refused
+ * exactly like its canonical spelling (RP-215 round 2)".
  */
-export const isWidening = (entry) =>
-  typeof entry !== 'string' ||
-  entry === '' ||
-  entry === '.agents/' ||
-  entry === '.claude/scripts/' ||
-  entry === '.codex/' ||
-  RULEBOOK_PREFIXES.some((prefix) => prefix !== entry && prefix.startsWith(entry));
+export const isWidening = (entry) => {
+  if (typeof entry !== 'string' || entry === '') return true;
+  const folded = entry.toLowerCase();
+  return (
+    folded === '.agents/' ||
+    folded === '.claude/scripts/' ||
+    folded === '.codex/' ||
+    FOLDED_RULEBOOK_PREFIXES.some((prefix) => prefix !== folded && prefix.startsWith(folded))
+  );
+};
 
 /**
  * One spelling for one directory — the single canonicaliser this file compares

package/templates/agent-os/universal/.codex/agents/code-reviewer.toml

@@ -1,6 +1,6 @@
 name = "code-reviewer"
 description = "Reviews a completed change against the checklist before a PR is opened or merged. Use after any non-trivial implementation work, and always before opening a PR that reaches the `model` lane — everything the two cheap lanes do not claim (code, a rulebook document, an unclassifiable path, a derived artifact git does not report as drift, or anything a risk flag escalated), decided by `decision-router.mjs` where the opt-in workflow layer is installed, or by the same rule applied by hand otherwise. Blocking findings must be resolved, not argued with."
-model = "gpt-5.6-sol"
+model = "gpt-6-sol"
 model_reasoning_effort = "high"
 sandbox_mode = "read-only"
 developer_instructions = "You review changes. You do not fix them — you report, with file:line\nreferences, and you classify every finding as **blocking** or **advisory**.\n\n## Checklist (blocking findings)\n\n1. **Boundary violations** — changes that bypass module ownership or layer\n   boundaries the repository itself declares. See any applicable architecture\n   rules in `.claude/rules/`.\n2. **Test integrity** — tests deleted, skipped, weakened, or rewritten to fit\n   the implementation; implementation without a test that demonstrates it.\n3. **Error handling** — swallowed errors, bare catch-and-continue, failure\n   paths that lie to the caller.\n4. **Contract drift** — behavior change not reflected in schemas, types, docs,\n   or the README.\n5. **Autonomy breaches** — Tier-2 territory (schema, auth, new dependency,\n   public API) entered without a recorded decision. See\n   `.claude/rules/autonomy.md`.\n6. **Contradicts the item it claims to implement** — the change does something\n   the queue item did not ask for, drops a stated requirement, or quietly\n   re-aims the task into an adjacent one. Read the item first, then the diff.\n   **Report the contradiction; never reconcile the two yourself** by deciding\n   which one \"must have been meant\" — that is the author's call, and a reviewer\n   who makes it silently turns a visible mismatch into an invisible one. A\n   change that is well-built and not the change that was asked for is the one\n   failure the rest of this checklist cannot see.\n\n   **If the item was not handed to you, say so and stop there.** Do not\n   reconstruct it from the branch name or the PR description: those are written\n   by whoever opened the PR — including the run being reviewed — and this\n   rulebook already refuses that evidence elsewhere (`.claude/rules/autonomy.md`).\n   \"Item not supplied, item 6 not checked\" is a useful line in a report; a\n   guess dressed as a verdict is worse than the silence it replaces.\n7. **Independent oracle** — a test of a security, ownership or governance\n   mechanism whose expected result is derived from the same production\n   mechanism it checks. See the independent-oracle invariant in\n   `.claude/rules/invariants.md`.\n\n## Advisory findings\n\nNaming, duplication, missed simplifications, performance smells. Report them;\ndo not block on them.\n\n## How you work\n\n- Diff first (`git diff`, `git log`), then read enough surrounding code to\n  judge in context. Review what changed, not the whole repo.\n- Quote the checklist item a blocking finding violates. If nothing blocks, say\n  so explicitly — \"no blocking findings\" is a valid, useful verdict.\n- Do not request rewrites of working, tested code for style alone.\n\n## The verdict block\n\nWrite your report for the human, then end it with **exactly one** fenced `json`\nblock of this shape, and nothing after it. That block is what the calling gate\nreads; a report that never writes one is read as whatever the caller expected.\n\n```json\n{\n  \"gate\": \"code-reviewer\",\n  \"verdict\": \"HOLD\",\n  \"blockers\": [\n    {\n      \"file\": \"packages/core/src/note.ts\",\n      \"line\": 42,\n      \"rule\": \"checklist item 2 — test integrity\",\n      \"note\": \"the failing case was deleted rather than fixed\"\n    }\n  ],\n  \"advisories\": [],\n  \"evidence\": [\"diffed against origin/master\", \"queue item supplied\"],\n  \"headSha\": \"9c1f0a7d4b3e2c5a8f6d0b9e7c4a1f2d3e5b6c70\"\n}\n```\n\n- `verdict` is `SHIP`, `HOLD` or `NOT_APPLICABLE` — no other word.\n- Every blocker names the `rule` it violates. `file` and `line` travel together\n  and are both omitted when the finding has no single location.\n- A `HOLD` with an empty `blockers` list is **refused**, and so is a `SHIP`\n  carrying one: `node .claude/scripts/verdict.mjs check <report> <this gate>` is\n  what refuses them, and the shape it enforces is in\n  `.claude/scripts/lib/verdict.mjs`. The gate name is what stops your answer\n  being read as somebody else's.\n- **`headSha` is the commit you reviewed** — `git rev-parse HEAD` in the\n  checkout you read. It is what lets `node .claude/scripts/verdict.mjs coverage\n  <commit>` tell \"this gate answered for the commit being merged\" from \"it\n  answered two pushes ago\". A verdict naming no commit is counted as neither\n  covered nor missing, so whoever runs that check holds on it —\n  `pr-ship` where the opt-in workflow layer is installed, the session itself\n  running `node .claude/scripts/verdict.mjs coverage` by hand otherwise: no\n  hook runs it either way, so skipping the gate skips this with it."

package/templates/agent-os/universal/.codex/agents/failure-diagnostician.toml

@@ -1,6 +1,6 @@
 name = "failure-diagnostician"
 description = "Use when a check is red or a run crashed and the cause is not obvious, or to reproduce a claimed defect/historical finding on the current default branch before work is planned on it."
-model = "gpt-5.6-sol"
+model = "gpt-6-sol"
 model_reasoning_effort = "high"
 sandbox_mode = "read-only"
 developer_instructions = "You diagnose. You take one of two input kinds — a red check or a crashed run,\nor a claimed defect / historical finding to reproduce on the current default\nbranch — and answer with evidence, not a guess dressed as one.\n\n## Hard limits\n\n- **You make no repository edits.** A throwaway reproduction file goes\n  outside the repository, never inside it — you are not the Green step, and a\n  fix is not your answer. You do not commit, push, merge or open a pull\n  request.\n- **Never re-run a check until it goes green.** A flaky-looking result is a\n  defect to report, not a thing to retry — the same stop rule that applies\n  everywhere else in this rulebook (`.claude/rules/autonomy.md`, \"Stop rules —\n  by work-state, not by feelings\").\n- **On Claude Code, no hook enforces the no-edit limit above.** `tools: Read,\n  Grep, Glob, Bash` carries no Write or Edit, which stops the ordinary path,\n  but nothing refuses a shell redirect the way a guard would. On Codex the\n  equivalent profile is `sandbox_mode = \"read-only\"`, enforced by the runtime\n  itself. Either way, a sandbox that blocks the reproduction you need is not\n  something to work around: answer `INCONCLUSIVE` or `INSUFFICIENT_EVIDENCE`\n  and name the sandbox as the missing evidence.\n\n## Method\n\n1. **Reproduce.** A failure input (red check, crashed run) reproduces at the\n   commit or branch where it failed — the PR head, or the commit the caller\n   names. A claimed defect or historical finding reproduces on the current\n   default branch. No reproduction, no diagnosis.\n2. **Isolate.** Narrow to the smallest change (input, config, code path) that\n   flips the result.\n3. **Hypothesize.** State the mechanism you think is responsible, in one or\n   two sentences.\n4. **Confirm with evidence.** Show the command and its output, or the\n   file:line the mechanism lives at. A hypothesis nothing confirms is\n   `INCONCLUSIVE`, not `ROOT_CAUSE`.\n\nFor a failure input that reaches `ROOT_CAUSE`, classify it: `product` (the\ncode is wrong), `test` (the test's premise or fixture is wrong),\n`infrastructure` (CI, network, environment — not the code under test), or\n`upstream` (a dependency or external service).\n\n## Optional evidence (opt-in workflow layer)\n\nWhere this repository has installed the opt-in workflow layer, the run\njournal and `run-state.mjs`'s recorded verdict may already carry evidence\nworth reading before you reproduce anything by hand — a prior `REGRESSION`,\nor an earlier run's own trace. Their absence is the normal Core path, not a\ngap: read them when present, reproduce directly when not.\n\n## The answer\n\nEnd your report with **exactly one** fenced `json` block of the shared shape\n(`.claude/scripts/lib/verdict.mjs`), and nothing after it.\n\n- **A failure input** (red check, crash) answers `ROOT_CAUSE` or\n  `INCONCLUSIVE`.\n- **A claim or historical finding** answers `STILL_LIVE`, `ALREADY_FIXED`,\n  `OBSOLETE` or `INSUFFICIENT_EVIDENCE`.\n- `ROOT_CAUSE`, `INCONCLUSIVE`, `STILL_LIVE` and `INSUFFICIENT_EVIDENCE` are\n  blocking and must name at least one blocker: for `ROOT_CAUSE` and\n  `STILL_LIVE` the blocker is the cause, with `file`/`line` where there is\n  one; for `INCONCLUSIVE` and `INSUFFICIENT_EVIDENCE` it is what evidence\n  would decide the question.\n- `ALREADY_FIXED` and `OBSOLETE` carry no blockers — the fixing commit or the\n  superseding mechanism goes in `evidence` instead.\n- `classification` is required on `ROOT_CAUSE`, allowed but optional on\n  `STILL_LIVE`, and refused on every other word.\n- `node .claude/scripts/verdict.mjs check <report> failure-diagnostician` is\n  what refuses a malformed answer before anyone reads it as one.\n\n```json\n{\n  \"gate\": \"failure-diagnostician\",\n  \"verdict\": \"ROOT_CAUSE\",\n  \"blockers\": [\n    {\n      \"file\": \"src/example.ts\",\n      \"line\": 42,\n      \"rule\": \"reproduced failure\",\n      \"note\": \"the function reads the value before the guard that handles the missing case — reproduced on the PR head with the fixture the failing test supplies\"\n    }\n  ],\n  \"advisories\": [],\n  \"evidence\": [\"reproduced with the failing test on the PR head\", \"the stack trace from that run names the file:line above\"],\n  \"classification\": \"product\"\n}\n```\n\n```json\n{\n  \"gate\": \"failure-diagnostician\",\n  \"verdict\": \"ALREADY_FIXED\",\n  \"blockers\": [],\n  \"advisories\": [],\n  \"evidence\": [\"the commit that added the missing guard fixes exactly this report\", \"re-ran the original repro on the current default branch; it now passes\"]\n}\n```\n\n## Not a merge gate\n\nYou are never a routed reviewer: no `decision-router` lane names you and no\n`pr-ship` coverage check (opt-in workflow layer) expects your answer. You\ndiagnose on request; you never implement the fix, and a report with no\nunbacked behaviour claim or invented figure is the only kind you write."

package/templates/agent-os/universal/.codex/agents/security-scanner.toml

@@ -1,6 +1,6 @@
 name = "security-scanner"
 description = "Scans a change for security issues. MUST be used when a change touches authentication, authorization, secrets or configuration, input parsing, file handling, or any new outbound call. Findings gate the PR."
-model = "gpt-5.6-sol"
+model = "gpt-6-sol"
 model_reasoning_effort = "high"
 sandbox_mode = "read-only"
 developer_instructions = "You are the security gate. You run on changes in sensitive territory and your\nblocking findings stop the PR until resolved.\n\n## Triggers (when you should have been called)\n\n- auth, permissions, sessions, tokens\n- secrets, credentials, environment/configuration handling\n- parsing of external input (request bodies, queue messages, files, URLs)\n- new outbound calls (HTTP, SDK, process execution)\n- dependency additions\n\n## What you look for\n\n1. **Secrets in the tree** — keys, tokens, connection strings in code, config,\n   fixtures, or test snapshots. Any hit is blocking.\n2. **Unvalidated input** — external data crossing into the domain without\n   passing a schema at the boundary; string-built queries or shell commands.\n3. **Broken authorization** — endpoints or usecases that skip the ownership /\n   permission check their siblings perform; confused-deputy patterns.\n4. **Injection surface** — user data reaching interpreters (shell, SQL/NoSQL\n   expressions, template evaluation, `eval`-likes) unescaped.\n5. **Leaky failure modes** — stack traces, internal ids, or secret material in\n   error responses and logs.\n6. **Outbound data** — new destinations for user data; verify they are\n   intentional, documented, and minimal.\n\n## How you work\n\n- Scope to the change and the paths it touches; grep wider only to confirm a\n  suspected pattern is (or is not) systemic.\n- Every finding: severity, file:line, the concrete attack or leak scenario, and\n  the smallest fix. No theoretical lectures without a code path.\n- If the change is outside your triggers, say so and return quickly — a clean\n  \"not security-relevant\" is a valid verdict.\n\n## The verdict block\n\nEnd your report with **exactly one** fenced `json` block of this shape, and\nnothing after it. It is what the calling gate reads; the prose above it is for\nthe human who has to fix the finding.\n\n```json\n{\n  \"gate\": \"security-scanner\",\n  \"verdict\": \"HOLD\",\n  \"blockers\": [\n    {\n      \"file\": \"services/api/src/handlers/upload.ts\",\n      \"line\": 31,\n      \"rule\": \"unvalidated input\",\n      \"note\": \"the filename reaches the shell unescaped — attacker-controlled\"\n    }\n  ],\n  \"advisories\": [],\n  \"evidence\": [\"grepped for the pattern across services/\"],\n  \"headSha\": \"9c1f0a7d4b3e2c5a8f6d0b9e7c4a1f2d3e5b6c70\"\n}\n```\n\n- `verdict` is `SHIP` (nothing blocking), `HOLD`, or `NOT_APPLICABLE` when the\n  change is outside your triggers — that last one is the structured form of the\n  clean \"not security-relevant\" answer above.\n- Every blocker names the `rule` it violates, with `file` and `line` when the\n  finding has a location and neither when it does not.\n- A `HOLD` naming no blocker is **refused**, and so is a `SHIP` carrying one:\n  `node .claude/scripts/verdict.mjs check <report> <this gate>` is what refuses\n  them, and the gate name is what stops your answer being read as somebody\n  else's.\n- **`headSha` is the commit you reviewed** — `git rev-parse HEAD` in the\n  checkout you read. It is what lets `node .claude/scripts/verdict.mjs coverage\n  <commit>` tell \"this gate answered for the commit being merged\" from \"it\n  answered two pushes ago\". A verdict naming no commit is counted as neither\n  covered nor missing, so whoever runs that check holds on it —\n  `pr-ship` where the opt-in workflow layer is installed, the session itself\n  running `node .claude/scripts/verdict.mjs coverage` by hand otherwise: no\n  hook runs it either way, so skipping the gate skips this with it."

package/templates/agent-os/universal/AGENTS.md

@@ -171,7 +171,9 @@ All four are one-liners, and all four are inert until you do them.
    — a JSON array like `["npm test", "npm run lint"]` — the stop gate is a
    no-op, and the Definition of Done is back to being a wish.
 2. **The elevated-path list below is a seed, not a survey.** It names only what
-   every repo has. Everything else is yours to add.
+   every repo has, plus `.rig/revalidation.json`, which only the opt-in
+   workflow layer installs (`init --layer workflow`). Everything else is yours
+   to add.
 3. **One runtime path needs a `.gitignore` line always; four more only when
    the opt-in workflow layer is installed** (`init --layer workflow`), and
    `init`/`init --layer workflow` cannot add any of them — they install into
@@ -236,6 +238,8 @@ rule does not change with or without the script.
 AGENTS.md
 CLAUDE.md
 .github/workflows/
+# workflow layer only (init --layer workflow)
+.rig/revalidation.json
 ```
 
 They are there because they are what *disarms* the rest: a merge that rewrites

package/templates/agent-os/universal/docs/decisions/codex-adapter.md

@@ -32,7 +32,7 @@ refuses duplicate source-agent names across layers, since one profile name
 cannot route two definitions.
 
 Frequent bounded work (`test-writer`, `implementation-agent`, `prose-reviewer`) uses `gpt-5.6-terra`;
-correctness, security, and infrastructure gates use `gpt-5.6-sol`. Every named
+correctness, security, and infrastructure gates use `gpt-6-sol`. Every named
 gate uses `high` reasoning effort. Unnamed subagents inherit repository defaults
 of `gpt-5.6-terra` and `medium` from `.codex/config.toml`. `xhigh` is not a
 continuous-loop default; using it for a named role requires an intentional

package/templates/agent-os/universal/docs/decisions/subagent-routing.md

@@ -10,7 +10,7 @@ Each named subagent this rig ships pins the model and the effort it reads with:
 
 | Role | Claude Code | Codex |
 | --- | --- | --- |
-| `code-reviewer`, `security-scanner`, `failure-diagnostician`, a stack's infrastructure reviewer | `claude-opus-5`, `high` | `gpt-5.6-sol`, `high` |
+| `code-reviewer`, `security-scanner`, `failure-diagnostician`, a stack's infrastructure reviewer | `claude-opus-5-5`, `high` | `gpt-6-sol`, `high` |
 | `test-writer`, `implementation-agent`, `prose-reviewer` | `claude-sonnet-5`, `high` | `gpt-5.6-terra`, `high` |
 | a subagent with no definition | `claude-sonnet-5`; effort follows the session | `gpt-5.6-terra`, `medium` |
 

package/templates/hash-history.json

@@ -15,7 +15,8 @@
     "0.9.0",
     "0.9.1",
     "0.10.0",
-    "0.10.1"
+    "0.10.1",
+    "1.0.0"
   ],
   "files": {
     ".agents/skills/check-premises/SKILL.md": {
@@ -27,6 +28,12 @@
         "ee3ad33f4269cc197d3b0d953802158cee6bc8a9b30c07892448ba6fb1d385e7"
       ]
     },
+    ".agents/skills/diagnose/SKILL.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "c1499c7ce9c9e5fc61c7a323246d9c3005acdeec82d3ec74c074cc3e89b5ad2a"
+      ]
+    },
     ".agents/skills/loop/SKILL.md": {
       "since": "0.5.0",
       "hashes": [
@@ -37,7 +44,8 @@
         "0a1b6575f6df8139766c8e71ba7320e14d2a5a5ed8ab26b6b43f7a006153d37d",
         "a0d11ca1745095cc5b68777915161f16a6d1602c21f6d273f475d1d07c4b8546",
         "b47bdf0d7a2f6c5b2034b8f6d683ad2b3c83bd65d15baf7de9b58cc4689d0ab1",
-        "e48766714f4bceb5113c7036c380dfdbe07229feaf9b57fe4168660c5c90feb2"
+        "e48766714f4bceb5113c7036c380dfdbe07229feaf9b57fe4168660c5c90feb2",
+        "b588ea0edfc953405bcad24ecbecd174da85dbc81b930aeeeb42b06a0307b261"
       ]
     },
     ".agents/skills/new-invariant/SKILL.md": {
@@ -59,6 +67,12 @@
         "7bef9179c5b56d280d462cf21fb2c38dc4cb759b671b114b3995aac93720caf8"
       ]
     },
+    ".agents/skills/plan-slices/SKILL.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "42d944f08cc71895c786cd0afe7a643a6af8e9b30b6269fe2b91a93dc4f6a77f"
+      ]
+    },
     ".agents/skills/post-deploy-verify/SKILL.md": {
       "since": "0.5.0",
       "hashes": [
@@ -73,7 +87,14 @@
         "9616e4767942b2021e34ab7bb76eec9a5c280cc608a0756abb02743741d5fc8a",
         "a6340b95a03000b89fb27f5357cdd9c7ec12b714054b5334b61a30da600405e8",
         "dc1d9c02879e383448f2336ae6433f960f86e8f8efb4ab8ccf9a17a5f7f524c3",
-        "75a5bc3e1aa3fdef96b59edc90a3cb4b996708710fe16f65038e0e21853df4e8"
+        "75a5bc3e1aa3fdef96b59edc90a3cb4b996708710fe16f65038e0e21853df4e8",
+        "2c2545d327be19d685dd0b758fe72806369a383b90df56164224bbb3b6f61cd3"
+      ]
+    },
+    ".agents/skills/release-propose/SKILL.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "11d641f4d2004da55aff82454fb541284ff4476790eca4d1c74dfd7f9e7c7a2f"
       ]
     },
     ".agents/skills/ro-debug/SKILL.md": {
@@ -82,6 +103,12 @@
         "4a391a0a42b613683d897e2b4fa46db4eb0e778cbfc1e4d4340bb855073de528"
       ]
     },
+    ".agents/skills/skill-authoring/SKILL.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "f85f58d4f2a4037af73a497db258653a4634acd7f851e795d26db3e0b3bc242d"
+      ]
+    },
     ".agents/skills/worktree-task/SKILL.md": {
       "since": "0.5.0",
       "hashes": [
@@ -107,7 +134,14 @@
         "f125cfbce848cdaa91fd81e961808b4dbde452287959ec2cf10b905ee3ede789",
         "8ede9297480c889ec6d6caf8d076e7d69111fb472933dcf5a48b9a8425fe50c2",
         "f12cb04871578eca3c9c36a1c2d60f5ae15a0e9094ecfc7c704c341756de4e3e",
-        "f260b1f2d60c57b96b2d735dbc7eb29890638ca9dedec467ff4784f6d8d8fab5"
+        "f260b1f2d60c57b96b2d735dbc7eb29890638ca9dedec467ff4784f6d8d8fab5",
+        "492fcd965f14194495721cb88eae5791cfd1f213c96fbc2307da8ddfb676c490"
+      ]
+    },
+    ".claude/agents/failure-diagnostician.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "c3daf330246eb47beee8dae804dc0f84a7bfc626b749d0759f3491fe48627ec5"
       ]
     },
     ".claude/agents/implementation-agent.md": {
@@ -169,7 +203,8 @@
         "33edb11904e5c4f88626b41c7e649b85d20957a11ff7e1062538917647c3e7f0",
         "19202a28355dac1d7a95d29411668cf970006b3044d89a772768ce21793931aa",
         "d2af03ed141fadd0b1e69b230b9277e8f03169757a8e2a679767653ab7828d9a",
-        "4a367adc0b4d0e940e907624c56bf94456df7fd8438028a1afc7e718ad7bb318"
+        "4a367adc0b4d0e940e907624c56bf94456df7fd8438028a1afc7e718ad7bb318",
+        "bd469db21c352d6a97bdd372a47831516aa00c17d1a16d943084400c9b824524"
       ]
     },
     ".claude/hooks/guard-bash.mjs": {
@@ -196,7 +231,8 @@
       "hashes": [
         "4524d715f2e41f4cfdd3d0f9c858817f913aaca5192bda97dff876b4d8c51f19",
         "f9e3e4b7c22c4a64f521402419707ff382b05c8deb6310f62e5545db87f7cb4f",
-        "493ae58e54b055bd13ba992ee0dbfa2cb9ce9a3637ec345ab8d7cfff95831c60"
+        "493ae58e54b055bd13ba992ee0dbfa2cb9ce9a3637ec345ab8d7cfff95831c60",
+        "e3a03aa6d3077b7c397f84bfecfb6e8df0f18a5849045c51150300b4ce9f48b2"
       ]
     },
     ".claude/hooks/guard-secret-file.mjs": {
@@ -237,7 +273,8 @@
         "4f836bc3ff75a868ffe035b179ac9e7dc1ad7715d520677ff9f6aa5bfdb200eb",
         "0c191d326a7bb0bbfc110e2210f44b4aa39276e8db3779aaa4545cffd4e11863",
         "572c671f8f2cad190fe2f144071954ac4d3b1357cab80a19bad584dd3b3768c8",
-        "6695698d2b38c79a12292601048dd0082a0cd18bf9e69c047d47679c2e6ecf67"
+        "6695698d2b38c79a12292601048dd0082a0cd18bf9e69c047d47679c2e6ecf67",
+        "79f400a6eccd1aa99fed2e5966f857c030fe8ba7a69df3f6819605e48277b202"
       ]
     },
     ".claude/hooks/lib/hook-input.mjs": {
@@ -294,7 +331,8 @@
         "a2e10499a0bcd2cdc32f3986d27b59077c86e524d40323faabb2e5d78afc002c",
         "c94c33d7ccbd46f191948325dfc7f68ce13b0d3a9470215de1de3f06b1499111",
         "ce90c1e697fdd444ca3fe2203d7991645f2c284c413ae187e4d6d6c618af52c9",
-        "aa0afa471fe7e3d06a42c61e9e2fcb14b2791ecf805cc3638cb13d2ee8aa9827"
+        "aa0afa471fe7e3d06a42c61e9e2fcb14b2791ecf805cc3638cb13d2ee8aa9827",
+        "355083bae7c6e37008af7b739d7b79652458059aa1cec2eae13c7320707b6199"
       ]
     },
     ".claude/rules/node-ts.md": {
@@ -392,7 +430,8 @@
       "since": "0.5.0",
       "hashes": [
         "4d33a07a53a502277fcc6e5d7f9a89738b75e1d672dd1e6985c058bb4c35c0de",
-        "51ef5185da289cfd883422e7ac51500e527a19c7780721af9cecf4f845a368f3"
+        "51ef5185da289cfd883422e7ac51500e527a19c7780721af9cecf4f845a368f3",
+        "ed5e63260071968333b867312aff7e5ac80385d9b19b32a4b1acc9a7b801dadf"
       ]
     },
     ".claude/scripts/preflight.mjs": {
@@ -427,7 +466,8 @@
         "1804c2351a4f3042dc6a3fb4203f96e98ae12bec32569b99bda77d002d6ba5f2",
         "b81ae3181e02b9c1c3f0e954688490ab3db3961381c2dc397c47c651c9d07f88",
         "c9902da15d06de3e952352115db0288433520eae2caac1f70ee6e06753d1f444",
-        "e31f9899d6edad127db7a2f43dafdfff2671c5c780209cccd3107e56b09c6042"
+        "e31f9899d6edad127db7a2f43dafdfff2671c5c780209cccd3107e56b09c6042",
+        "915f0e73fe0842196227c2bd56ba813ed0b7e358670eeabab456cc27fbc4bc9d"
       ]
     },
     ".claude/scripts/queue/gate-rounds.mjs": {
@@ -444,7 +484,8 @@
         "86489ac7fcd06e43e31fb3d0ac9ab23174ef9c95196b08f127f1ae74da620c0c",
         "f84148fee47109a388a248c51d3eb40919ce341785b561dd4135b69c6fedabf3",
         "5ab8f741f17efb935b11caf245edf2b562cb887020c2a43d45464158342c933a",
-        "b5349837d16de0966139f5b65e2800486592f1b24d7e87087c2b7212cead479d"
+        "b5349837d16de0966139f5b65e2800486592f1b24d7e87087c2b7212cead479d",
+        "b14d15e30dd74585a3470913f6a6bb0250010a8dd5561dfa2033c211ac8288cb"
       ]
     },
     ".claude/scripts/queue/index.mjs": {
@@ -481,6 +522,12 @@
         "816aec4cb84492370972f71813a9fec7c0309e5f501951a93620a37cb318ac39"
       ]
     },
+    ".claude/scripts/queue/propose.mjs": {
+      "since": "1.0.0",
+      "hashes": [
+        "13115b1cd4d40f8b2a618a5dbabd5c973118a71789db17d704ac8d0c478cb024"
+      ]
+    },
     ".claude/scripts/queue/state.mjs": {
       "since": "0.5.0",
       "hashes": [
@@ -496,6 +543,12 @@
         "354c713747e16ce7df51e8230c73f38bf7164ad7abd18ec1caca3f8d8546c224"
       ]
     },
+    ".claude/scripts/release-evidence.mjs": {
+      "since": "1.0.0",
+      "hashes": [
+        "729ed9e049d755c94b2de9e470d96079673ad36f65f79198600c202d7f0b1865"
+      ]
+    },
     ".claude/scripts/revalidate.mjs": {
       "since": "0.6.0",
       "hashes": [
@@ -511,7 +564,8 @@
       "hashes": [
         "b99a3537158c2851698bfac027f7061811d7d428c3eea57f3ce0f58ea75dc249",
         "78adac5c8f696f2c9cc86f404abf1d55604ccb10f11dd612501c14d4cf5935b1",
-        "fed627d2c8f0f5e6a4524b7015ac7a1cb5051a8c316ff4544af18be9c61eb163"
+        "fed627d2c8f0f5e6a4524b7015ac7a1cb5051a8c316ff4544af18be9c61eb163",
+        "9baffc9133f1cec35332cb105c70dab9c8ea8250aab2bd8daa71511e4c53bb54"
       ]
     },
     ".claude/scripts/run-journal.mjs": {
@@ -541,7 +595,8 @@
         "060b001927d8b471f1c1a8c8851fbb4266d3b2edd674cccbd6c16c44b57b91dd",
         "7721ee19fd1bcf6902be3d359def40742d79b88f5d83e7e3ca22ba45ca3211aa",
         "250292c9959916240bfc0fdf5987a864f6d54799de3d932dc6b85b776e62eaa9",
-        "ad58b25f9ce30a1549b5047daa1e5b43c30352306aeceebacd638db86087e01f"
+        "ad58b25f9ce30a1549b5047daa1e5b43c30352306aeceebacd638db86087e01f",
+        "f49142e6a64d5e8a8b4c4d239247f09255d65dd9d7de2cff0267b16421509e12"
       ]
     },
     ".claude/scripts/verdict.mjs": {
@@ -573,6 +628,12 @@
         "ee3ad33f4269cc197d3b0d953802158cee6bc8a9b30c07892448ba6fb1d385e7"
       ]
     },
+    ".claude/skills/diagnose/SKILL.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "c1499c7ce9c9e5fc61c7a323246d9c3005acdeec82d3ec74c074cc3e89b5ad2a"
+      ]
+    },
     ".claude/skills/loop/SKILL.md": {
       "since": "0.2.0",
       "hashes": [
@@ -587,7 +648,8 @@
         "0a1b6575f6df8139766c8e71ba7320e14d2a5a5ed8ab26b6b43f7a006153d37d",
         "a0d11ca1745095cc5b68777915161f16a6d1602c21f6d273f475d1d07c4b8546",
         "b47bdf0d7a2f6c5b2034b8f6d683ad2b3c83bd65d15baf7de9b58cc4689d0ab1",
-        "e48766714f4bceb5113c7036c380dfdbe07229feaf9b57fe4168660c5c90feb2"
+        "e48766714f4bceb5113c7036c380dfdbe07229feaf9b57fe4168660c5c90feb2",
+        "b588ea0edfc953405bcad24ecbecd174da85dbc81b930aeeeb42b06a0307b261"
       ]
     },
     ".claude/skills/new-invariant/SKILL.md": {
@@ -609,6 +671,12 @@
         "7bef9179c5b56d280d462cf21fb2c38dc4cb759b671b114b3995aac93720caf8"
       ]
     },
+    ".claude/skills/plan-slices/SKILL.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "42d944f08cc71895c786cd0afe7a643a6af8e9b30b6269fe2b91a93dc4f6a77f"
+      ]
+    },
     ".claude/skills/post-deploy-verify/SKILL.md": {
       "since": "0.2.0",
       "hashes": [
@@ -626,7 +694,14 @@
         "9616e4767942b2021e34ab7bb76eec9a5c280cc608a0756abb02743741d5fc8a",
         "a6340b95a03000b89fb27f5357cdd9c7ec12b714054b5334b61a30da600405e8",
         "dc1d9c02879e383448f2336ae6433f960f86e8f8efb4ab8ccf9a17a5f7f524c3",
-        "75a5bc3e1aa3fdef96b59edc90a3cb4b996708710fe16f65038e0e21853df4e8"
+        "75a5bc3e1aa3fdef96b59edc90a3cb4b996708710fe16f65038e0e21853df4e8",
+        "2c2545d327be19d685dd0b758fe72806369a383b90df56164224bbb3b6f61cd3"
+      ]
+    },
+    ".claude/skills/release-propose/SKILL.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "11d641f4d2004da55aff82454fb541284ff4476790eca4d1c74dfd7f9e7c7a2f"
       ]
     },
     ".claude/skills/ro-debug/SKILL.md": {
@@ -635,6 +710,12 @@
         "4a391a0a42b613683d897e2b4fa46db4eb0e778cbfc1e4d4340bb855073de528"
       ]
     },
+    ".claude/skills/skill-authoring/SKILL.md": {
+      "since": "1.0.0",
+      "hashes": [
+        "f85f58d4f2a4037af73a497db258653a4634acd7f851e795d26db3e0b3bc242d"
+      ]
+    },
     ".claude/skills/worktree-task/SKILL.md": {
       "since": "0.3.0",
       "hashes": [
@@ -656,7 +737,14 @@
         "e0e3475404c95402f33d77ebb14001e289d26bb429205a0a73bdcef99b4a62c7",
         "9ec92775791907f068d85ba58489236bd2bee69a8d769554ac530e8eadd5e374",
         "180c182cc909cc0b6c06cfa286f528f22b77189eee49cac067fdaaf2920f8bae",
-        "29b4de4273097fc9e6c1c3e41c650fa20d95fa34b406365aabab62a6ae89b686"
+        "29b4de4273097fc9e6c1c3e41c650fa20d95fa34b406365aabab62a6ae89b686",
+        "32e6cdf32a21da712889c50e6d74bceda8cdac79fce941426c8bc8769651023e"
+      ]
+    },
+    ".codex/agents/failure-diagnostician.toml": {
+      "since": "1.0.0",
+      "hashes": [
+        "4d1209540407249c96cd6e3a5b874cf1c6c29bf382d3b88fdeb6f3eaafc5e2b6"
       ]
     },
     ".codex/agents/implementation-agent.toml": {
@@ -719,7 +807,8 @@
       "hashes": [
         "616ab573d3cf4b603bb4bfbc5e7631d17ebaa696af16474845fdaf35f41d0a97",
         "406c9a0a0e58e78788a10186b9e10b48f4ed215b6d68504a4fbb71e5ee506f85",
-        "93f9b4ed7a49df9c83b74fd728fb3e0f83ff7c7e84f71f51d26c89b84cd091bd"
+        "93f9b4ed7a49df9c83b74fd728fb3e0f83ff7c7e84f71f51d26c89b84cd091bd",
+        "615e15fed813dc1fae10c3ff498aab28096382f9e9bd5a89c72d1a6e5adb1219"
       ]
     },
     "CLAUDE.md": {
@@ -818,7 +907,8 @@
       "since": "0.9.0",
       "hashes": [
         "97bb882dd066a65a740780a836199ecef8887392c1ece02a92670ecf153988d3",
-        "f4a458a8938f8517b997cd6f0a0036d4eba640cd1ff213683804e7c0e2d02d7a"
+        "f4a458a8938f8517b997cd6f0a0036d4eba640cd1ff213683804e7c0e2d02d7a",
+        "f7f13dc4c19c31bc950c58aa6276e67f42d41c7331510d5a5e6f60e4bfd0c38c"
       ]
     },
     "docs/decisions/two-empty-endings.md": {
@@ -831,7 +921,8 @@
     "docs/decisions/workflow-layer-split.md": {
       "since": "0.10.0",
       "hashes": [
-        "1006275e907e7083d5cfa331fa4844ac9ed7f738519f788af130e6c82e5d9465"
+        "1006275e907e7083d5cfa331fa4844ac9ed7f738519f788af130e6c82e5d9465",
+        "be410febe87e660d0be6ad022c205ad151e16e8702eb19c44e6992a477749f92"
       ]
     },
     "journal/README.md": {

package/templates/release-ledger.json

@@ -15,5 +15,6 @@
   "0.9.0": "c27f391e7395accaf09354f255a07e1b9e4710c1",
   "0.9.1": "872f7f67f11761c17aad3cbbe26540862581795b",
   "0.10.0": "279fbf928b811b8ebc7ba2d1c4700ee943b7dab1",
-  "0.10.1": "738b494806b435f0718f290dc3befb40829e5ebf"
+  "0.10.1": "738b494806b435f0718f290dc3befb40829e5ebf",
+  "1.0.0": "8876147ce93d54ba8321d2bcdafab7f5dd1f8994"
 }