devflow-kit 3.9.0 → 3.11.0

package/dist/cli/commands/compliance.js

@@ -2,11 +2,14 @@
  * devflow compliance — Enable, disable, set, and check status of the compliance feature.
  *
  * CLI-layer module; pure helpers in src/core/compliance.ts,
- *   I/O orchestration in src/targets/claude-code/compliance-install.ts.
+ *   I/O orchestration in src/targets/claude-code/curation-install.ts (the one converge
+ *   for both axes) and compliance-install.ts (the compliance artifacts it composes).
  * Compliance is manifest-group (like proxy), not config.json-gated.
  * Per-artifact failures are warn-not-throw, so one failed artifact never aborts the rest.
- * Enable/disable each converge BOTH artifacts unconditionally, so neither is left
- *   half-converged.
+ * Every change of the switch (enable, disable, --set, interactive enable) writes the switch,
+ *   runs the one converge, and only after a clean converge records which variants are installed.
+ * With compliance off the command fails closed (AC-28): it exits non-zero when an installed
+ *   prompt may still post, and prints no success line.
  * The evidence-policy lines (--status, and the --enable/--set suggestion) come
  *   from src/core/evidence-policy.ts, the seam onto the package's own resolvers;
  *   the CLI prints the keys to add to .devflow/project.json and never writes it
@@ -18,10 +21,14 @@ import * as path from 'path';
 import * as p from '@clack/prompts';
 import color from 'picocolors';
 import { COMPLIANCE_FRAMEWORKS, normalizeFrameworks, parseFrameworkList, } from '../../core/compliance.js';
+import { openBackupSessionOrFail, runWithBackupReport } from './backup-session.js';
 import { frameworkChoices, FRAMEWORK_SELECT_MESSAGE } from './compliance-prompts.js';
 import { COMPLIANCE_SKILL_TOKENS } from '../../core/compliance-compose.js';
 import { evidencePolicyStatusLine, evidencePolicySuggestion, formatEvidencePolicyUnavailable, loadEvidencePolicyModule, loadSettingsModule, repoComplianceStatusLines, } from '../../core/evidence-policy.js';
+import { postingStatus, readInstalledVariants } from '../../core/installed-variants.js';
+import { withManifestLock } from '../../core/manifest-lock.js';
 import { readManifest, writeManifest } from '../../core/manifest.js';
+import { applyVariantToggle, describePostingLeft, describeVariantConverge, readRunningVersion, } from '../../targets/claude-code/curation-install.js';
 import { convergeFromManifest } from '../../targets/claude-code/compliance-install.js';
 import { validateRuleShadow, validateSkillShadow } from '../../targets/claude-code/installer.js';
 import { getClaudeDirectory, getDevFlowDirectory, } from '../../targets/claude-code/claude-paths.js';
@@ -67,7 +74,7 @@ export function resolveComplianceCliAction(current, action, setFrameworks) {
                 messages: [
                     {
                         level: 'success',
-                        text: 'Compliance disabled — rule removed, frameworks remembered for re-enable',
+                        text: 'Compliance disabled — the rule and every posting step removed, frameworks remembered for re-enable',
                     },
                 ],
             };
@@ -118,10 +125,12 @@ async function skillInstalled(claudeDir) {
         return false;
     }
 }
+/** The installed compliance rule file. */
+const complianceRuleFile = (claudeDir) => path.join(claudeDir, 'rules', 'devflow', 'compliance.md');
 /** Returns true if the compliance rule file exists at the install target. */
 async function ruleInstalled(claudeDir) {
     try {
-        await fs.access(path.join(claudeDir, 'rules', 'devflow', 'compliance.md'));
+        await fs.access(complianceRuleFile(claudeDir));
         return true;
     }
     catch {
@@ -156,10 +165,153 @@ async function skillShadowState(devflowDir) {
         return 'none';
     }
 }
+/** The `Posting:` line of `--status`: the install record read against the machine's compliance switch (AC-31). */
+export function postingStatusLine(record, complianceEnabled) {
+    const status = postingStatus(readInstalledVariants(record), complianceEnabled);
+    const shown = status === 'installed' ? color.green(status) : status === 'not installed' ? color.dim(status) : color.yellow(status);
+    return `Posting:    ${shown}`;
+}
+/**
+ * Write the switch under the manifest lock, into the manifest read inside the lock, so a field
+ * that another devflow run wrote since this command first read the manifest is kept. A lock that
+ * cannot be taken, or is lost before the write, writes nothing. Null when the switch is on disk,
+ * otherwise the reason it is not. Never throws.
+ */
+async function recordComplianceSwitch(devflowDir, nextState) {
+    try {
+        const locked = await withManifestLock(devflowDir, {}, async (lock) => {
+            const current = await readManifest(devflowDir);
+            if (current === null)
+                return 'no readable install manifest';
+            if (!(await lock.stillHeld()))
+                return 'the install manifest lock was lost';
+            await writeManifest(devflowDir, {
+                ...current,
+                features: { ...current.features, compliance: nextState },
+                updatedAt: new Date().toISOString(),
+            });
+            return null;
+        });
+        return locked.ok ? locked.value : 'the install manifest lock could not be taken';
+    }
+    catch (err) {
+        return String(err);
+    }
+}
+/**
+ * Apply one change of the compliance switch: write the switch, run the one converge for both
+ * axes, and only after a clean converge record which variants are installed (the toggle helper
+ * does that last step). Every change of the enabled value converges, `--set` and interactive enable
+ * included, and a `--set` that only changes the frameworks converges too, so the stamp follows.
+ *
+ * Fail closed on the off side: with compliance off, a converge that cannot prove every installed
+ * compliance-armed prompt holds the compliance-off file is an error that lists the files, a
+ * toggle that cannot converge at all (a version skew, or no manifest) says that posting steps remain
+ * installed until `devflow init`, and a compliance rule that is still installed is an error that
+ * names the file. None of them prints the success text. A skipped prompt converge still converges
+ * the compliance skill and rule, which do not depend on the installed version. On the enable side
+ * the skip is a warning, and a rule that is wanted and still not installed is a second warning.
+ * A reference that the converge could not refresh, a linked folder for example, is an error that
+ * names it, with exit 1, and the switch stays recorded as on.
+ *
+ * Returns a result and never throws; the caller prints the messages and sets the exit code. The
+ * record of the backup session prints once, as the change returns (an exit-1 result included),
+ * ahead of the messages.
+ */
+export function applyComplianceChange(opts) {
+    return runWithBackupReport(opts.backups, () => applyChange(opts));
+}
+async function applyChange(opts) {
+    const { claudeDir, devflowDir, manifest, action, setFrameworks, runningVersion, packageRoot, warn, backups } = opts;
+    const resolved = resolveComplianceCliAction(manifest.features.compliance, action, setFrameworks);
+    // normalizeFrameworks deduplicates (e.g. --set gdpr,GDPR → [gdpr]).
+    const nextState = {
+        enabled: resolved.nextState.enabled,
+        frameworks: normalizeFrameworks(resolved.nextState.frameworks),
+    };
+    // The switch comes first: whatever the converge does next, the machine's choice is on disk.
+    const notRecorded = await recordComplianceSwitch(devflowDir, nextState);
+    if (notRecorded !== null) {
+        return {
+            nextState: manifest.features.compliance,
+            messages: [{ level: 'error', text: `Could not record the compliance switch, so nothing was changed: ${notRecorded}` }],
+            exitCode: 1,
+        };
+    }
+    const outcome = await applyVariantToggle({
+        claudeDir,
+        devflowDir,
+        axis: 'compliance',
+        enabled: nextState.enabled,
+        runningVersion,
+        warn,
+        packageRoot,
+        backups,
+    });
+    if (outcome.kind === 'skipped') {
+        // The compliance skill and rule do not depend on the installed version, so they converge
+        // whatever the prompt converge did. The converge warns per item and never throws.
+        await convergeFromManifest({
+            claudeDir,
+            devflowDir,
+            manifest: { features: { compliance: nextState, rules: manifest.features.rules } },
+            warn,
+            backups,
+        });
+        if (!nextState.enabled) {
+            return { nextState, messages: [{ level: 'error', text: outcome.message }], exitCode: 1 };
+        }
+        const ruleNote = manifest.features.rules && !(await ruleInstalled(claudeDir))
+            ? [{ level: 'warn', text: 'The compliance rule was not installed. Run `devflow init`.' }]
+            : [];
+        return { nextState, messages: [...resolved.messages, ...ruleNote, { level: 'warn', text: outcome.message }], exitCode: 0 };
+    }
+    const { posting } = outcome.result;
+    if (!nextState.enabled && posting.kind !== 'clear') {
+        return {
+            nextState,
+            messages: [
+                { level: 'error', text: 'Compliance is recorded as off, but the install may still post to GitHub or a tracker.' },
+                ...describePostingLeft(posting).map((text) => ({ level: 'error', text })),
+            ],
+            exitCode: 1,
+        };
+    }
+    // A failed rule removal is only a warning inside the converge. The line that says the rule is
+    // removed prints only when it is gone.
+    if (!nextState.enabled && (await ruleInstalled(claudeDir))) {
+        return {
+            nextState,
+            messages: [{
+                    level: 'error',
+                    text: `Compliance is recorded as off, but the compliance rule could not be removed: ${complianceRuleFile(claudeDir)}. ` +
+                        'Fix the cause in the warning above, or delete the file. Then run `devflow compliance --disable` again.',
+                }],
+            exitCode: 1,
+        };
+    }
+    const referenceFailures = outcome.result.references.failures;
+    if (nextState.enabled && referenceFailures.length > 0) {
+        return {
+            nextState,
+            messages: [{
+                    level: 'error',
+                    text: 'Compliance is recorded as on, but some installed references were not refreshed: ' +
+                        `${referenceFailures.join('; ')}. Replace any link in the cause with a real folder. Then run the command again.`,
+                }],
+            exitCode: 1,
+        };
+    }
+    const messages = [...resolved.messages];
+    const changed = describeVariantConverge(outcome.result, 'compliance', nextState.enabled);
+    if (changed !== null)
+        messages.push({ level: 'info', text: `Installed prompts: ${changed}` });
+    return { nextState, messages, exitCode: 0 };
+}
 export const complianceCommand = new Command('compliance')
     .description('Enable, disable, or configure the compliance feature')
-    .option('--enable', 'Enable compliance (restores previously selected frameworks)')
-    .option('--disable', 'Disable compliance (rule removed; frameworks remembered for re-enable)')
+    .option('--enable', 'Enable compliance (restores previously selected frameworks and installs the steps that post evidence and summaries to GitHub or a tracker)')
+    .option('--disable', 'Disable compliance (rule and every step that posts evidence or summaries to GitHub or a tracker removed; frameworks remembered for re-enable)')
     .option('--status', 'Show compliance state: manifest, installed artifacts, shadow presence, and the evidence policy for the current repository')
     .option('--set <list>', 'Set active frameworks (comma-separated IDs); enables compliance. Use --set "" for zero frameworks (generic controls only)')
     .action(async (options) => {
@@ -169,8 +321,8 @@ export const complianceCommand = new Command('compliance')
     if (!hasFlag) {
         p.intro(color.bgCyan(color.white(' Compliance ')));
         const validIds = COMPLIANCE_FRAMEWORKS.map(fw => `${fw.id} — ${fw.hint}`).join('\n  ');
-        p.note(`${color.cyan('devflow compliance --enable')}   Enable compliance (restores prior frameworks)\n` +
-            `${color.cyan('devflow compliance --disable')}  Disable compliance (frameworks remembered)\n` +
+        p.note(`${color.cyan('devflow compliance --enable')}   Enable compliance (restores prior frameworks; installs the posting steps)\n` +
+            `${color.cyan('devflow compliance --disable')}  Disable compliance (removes the posting steps; frameworks remembered)\n` +
             `${color.cyan('devflow compliance --status')}   Show current state and installed artifacts\n` +
             `${color.cyan('devflow compliance --set <ids>')} Set active frameworks and enable\n\n` +
             `Valid framework IDs:\n  ${validIds}`, 'Usage');
@@ -228,6 +380,7 @@ export const complianceCommand = new Command('compliance')
                     ? color.yellow(' (withheld — rules disabled)')
                     : '') +
                 (isRuleShadowed ? color.green(' [shadowed]') : ''),
+            postingStatusLine(manifest.installedVariants, current.enabled),
             '',
             // The repository in cwd, resolved by the package's own resolver with the
             // compliance state already read above (D-POLICY-CJS-SEAM). Bounded: at most
@@ -277,23 +430,23 @@ export const complianceCommand = new Command('compliance')
     else {
         action = 'disable';
     }
-    const resolved = resolveComplianceCliAction(current, action, setFrameworks);
-    // Converge artifacts (always converge, never short-circuit)
-    await convergeFromManifest({
+    // The session comes before the first change. Without a shipped set the command changes nothing.
+    const backups = await openBackupSessionOrFail({ claudeDir, devflowDir });
+    if (backups === null)
+        return;
+    // Write the switch, converge both axes, record the installed variants (applyComplianceChange).
+    const applied = await applyComplianceChange({
         claudeDir,
         devflowDir,
-        manifest: { features: { compliance: resolved.nextState, rules: manifest.features.rules } },
+        manifest,
+        action,
+        setFrameworks,
+        runningVersion: await readRunningVersion(),
         warn: (msg) => p.log.warn(msg),
+        backups,
     });
-    // Persist to manifest — normalizeFrameworks deduplicates (e.g. --set gdpr,GDPR → [gdpr])
-    manifest.features.compliance = {
-        enabled: resolved.nextState.enabled,
-        frameworks: normalizeFrameworks(resolved.nextState.frameworks),
-    };
-    manifest.updatedAt = new Date().toISOString();
-    await writeManifest(devflowDir, manifest);
     // Emit messages
-    for (const msg of resolved.messages) {
+    for (const msg of applied.messages) {
         switch (msg.level) {
             case 'success':
                 p.log.success(msg.text);
@@ -301,18 +454,25 @@ export const complianceCommand = new Command('compliance')
             case 'warn':
                 p.log.warn(msg.text);
                 break;
+            case 'error':
+                p.log.error(msg.text);
+                break;
             default:
                 p.log.info(msg.text);
                 break;
         }
     }
-    if (resolved.nextState.enabled && !manifest.features.rules) {
+    if (applied.exitCode !== 0) {
+        process.exitCode = applied.exitCode;
+        return;
+    }
+    if (applied.nextState.enabled && !manifest.features.rules) {
         p.log.info(color.dim('Note: compliance rule withheld (rules disabled) — ' +
             'run `devflow rules --enable` to install the stamped rule'));
     }
     // Suggest the team file compliance now implies. Printed, never written:
     // .devflow/project.json is team-owned (D-POLICY-NO-WRITE).
-    if (resolved.nextState.enabled) {
+    if (applied.nextState.enabled) {
         const policyModule = loadEvidencePolicyModule();
         const settingsModule = loadSettingsModule();
         if (!policyModule.ok) {
@@ -322,7 +482,7 @@ export const complianceCommand = new Command('compliance')
             p.log.warn(formatEvidencePolicyUnavailable(settingsModule.error));
         }
         else {
-            const suggestion = evidencePolicySuggestion(resolved.nextState, policyModule.value, settingsModule.value);
+            const suggestion = evidencePolicySuggestion(applied.nextState, policyModule.value, settingsModule.value);
             if (suggestion !== null)
                 p.note(suggestion, 'Evidence policy');
         }

package/dist/cli/commands/curation.js

@@ -9,7 +9,8 @@ import { loadShippedAgentDefaults } from '../../core/agent-models.js';
 import { readMachineFeature, writeMachineFeature } from '../../core/feature-switch.js';
 import { loadSettingsModule, narrowedSwitchLabel, personalConfigTrackedWarning } from '../../core/evidence-policy.js';
 import { getClaudeDirectory, getDevFlowDirectory } from '../../targets/claude-code/claude-paths.js';
-import { applyCurationToggle, describeCurationConverge, installedScriptsSkew, readRunningVersion, } from '../../targets/claude-code/curation-install.js';
+import { openBackupSessionOrFail, runWithBackupReport } from './backup-session.js';
+import { applyVariantToggle, describeCurationConverge, describePostingLeft, installedScriptsSkew, readRunningVersion, } from '../../targets/claude-code/curation-install.js';
 import { getLedgerRoot } from '../../core/ledger-root.js';
 import { AREA_PAUSE_NOTICE } from '../../core/area-pause-notice.js';
 import { probeTrackedArea } from '../../core/tracked-areas.js';
@@ -643,27 +644,33 @@ async function handleClear() {
 /**
  * Make the installed prompts match the switch just written
  * (D-LEARNING-VARIANT-INSTALL): the curation-on or curation-off commands and
- * agents, and the apply-decisions skill. The same convergence `devflow init` runs,
- * followed by reapplying the saved agent model mapping so `devflow agents`
- * overrides survive.
+ * agents, and the apply-decisions skill. The one converge for both axes that
+ * `devflow init` and `devflow compliance` run, followed by reapplying the saved
+ * agent model mapping so `devflow agents` overrides survive.
  *
  * Warn-not-fail: the switch itself is already recorded, and either mismatch is
  * safe (an on variant is still gated at run time, an off variant loads no
- * decisions), so a problem here never changes the exit code.
+ * decisions), so a problem here never changes the exit code. A compliance-off
+ * machine that still has a prompt that posts is a warning here too: the fail-closed
+ * exit belongs to `devflow compliance`, which changes that axis.
  *
  * Answers whether the converge ran, which means the installed files are the ones
  * this CLI writes. The toggle moves the ledger folder only then: under version skew
  * (or when that could not be told) it moves nothing.
  */
-async function convergeInstalledVariants(enabled) {
+export async function convergeInstalledVariants(enabled, backups) {
     try {
-        const outcome = await applyCurationToggle({
+        // The record of the session prints when the toggle returns or throws, ahead of the warning
+        // below, so a file moved aside before a failure is still named.
+        const outcome = await runWithBackupReport(backups, async () => applyVariantToggle({
             claudeDir: getClaudeDirectory(),
             devflowDir: getDevFlowDirectory(),
-            curation: enabled,
+            axis: 'curation',
+            enabled,
             runningVersion: await readRunningVersion(),
             warn: (msg) => p.log.warn(msg),
-        });
+            backups,
+        }));
         if (outcome.kind === 'skipped') {
             p.log.warn(outcome.message);
             return 'not-converged';
@@ -671,6 +678,8 @@ async function convergeInstalledVariants(enabled) {
         const changed = describeCurationConverge(outcome.result, enabled);
         if (changed !== null)
             p.log.info(color.dim(`Installed prompts: ${changed}`));
+        for (const line of describePostingLeft(outcome.result.posting))
+            p.log.warn(line);
         return 'converged';
     }
     catch (err) {
@@ -716,13 +725,17 @@ async function tryMoveForToggle(ledgerRoot) {
  * tries the shared move with no wait. Only `--disable` drains, skew included.
  */
 async function handleToggle(enabled) {
+    // The session comes before the first change. Without a shipped set the toggle changes nothing.
+    const backups = await openBackupSessionOrFail({ claudeDir: getClaudeDirectory(), devflowDir: getDevFlowDirectory() });
+    if (backups === null)
+        return;
     const recorded = await writeMachineFeature(getDevFlowDirectory(), 'curation', enabled);
     if (!recorded.ok) {
         p.log.error(`Devflow is not installed on this machine — run ${color.cyan('devflow init')} first`);
         process.exitCode = 1;
         return;
     }
-    const converged = await convergeInstalledVariants(enabled);
+    const converged = await convergeInstalledVariants(enabled, backups);
     const ledgerRoot = await getLedgerRoot();
     const shownSkip = converged === 'converged' && ledgerRoot ? await tryMoveForToggle(ledgerRoot) : null;
     if (enabled) {

package/dist/cli/commands/gate-level-prompts.js

@@ -31,23 +31,18 @@ import { DEFAULT_GATE_LEVEL, GATE_LEVELS, MALFORMED_GATE_LEVEL_READS_AS, parseGa
 /** Message shown on the gate level select prompt. */
 export const GATE_LEVEL_SELECT_MESSAGE = 'Gate level for this machine';
 /**
- * The one-line effect of each level, as the select hint and the catalogue show it.
- * Each hint says what its level does. GATE_LEVEL_EFFECT in gates.ts says which commands
- * read the level. Change a hint when what a level does changes. A command that reads the
- * level and has no rule that changes a phase leaves the hints true, so it changes
- * GATE_LEVEL_EFFECT alone. One test pins the exact text of both tables, so a change to
- * either fails it until you check the other table and update the pin; further rows check
- * the clauses the two tables share (the lint pack level, the levels that run fewer review
- * focuses and the levels that skip Polish). The clauses that lean skips Harden on a
- * docs-only diff, that standard and lean run one Evaluate pass and that standard and lean
- * apply severity tiers in /resolve have no facet row in `tests/gate-level-prompts.test.ts`:
- * the docs guard checks each at every doc site, against its row in the /implement or
- * /resolve level reference.
+ * One short line for each level, as the select hint and the catalogue show it.
+ * clack never wraps a note or a hint, so a hint stays within 60 characters and holds no line
+ * break (a guard in `tests/gate-level-prompts.test.ts` holds both). The full effects of each
+ * level live in GATE_LEVEL_EFFECT in gates.ts, in `devflow gates` and in the docs.
+ * Change a hint when the level it names changes how much it checks; then check
+ * GATE_LEVEL_EFFECT and update the pin. The comment on GATE_LEVEL_EFFECT holds the full
+ * update rule, the pin and the list of clauses that the two tables share.
  */
 export const GATE_LEVEL_HINTS = Object.freeze({
-    full: 'the most checking: every review focus, the full planning shape and Polish',
-    standard: 'fewer review focuses and planning agents, no Polish in /implement and /resolve, severity tiers in /resolve, and one Evaluate pass in /implement (the default)',
-    lean: 'the least checking, and no Polish in /implement and /resolve; /resolve also applies severity tiers; /implement also runs one Evaluate pass, has Validate run the project lint pack, and skips Harden on a docs-only diff',
+    full: 'the most checking: every review focus, and Polish',
+    standard: 'fewer review focuses, no Polish; the default',
+    lean: 'the least checking: no Polish, Validate runs the lint pack',
 });
 /** Build clack select options for the gate level list, most to least checking. */
 export function gateLevelChoices() {
@@ -55,12 +50,24 @@ export function gateLevelChoices() {
 }
 /**
  * Format a padded level catalogue suitable for a clack note body.
- * Produces: `  standard  fewer review focuses and planning agents, no Polish in /implement and /resolve, severity tiers in /resolve, and one Evaluate pass in /implement (the default)`
+ * Produces: `  standard  fewer review focuses, no Polish; the default`
  */
 export function formatGateLevelCatalogue() {
     const width = Math.max(...GATE_LEVELS.map(level => level.length));
     return 'Levels:\n' + GATE_LEVELS.map(level => `  ${level.padEnd(width)}  ${GATE_LEVEL_HINTS[level]}`).join('\n');
 }
+// ── Where the stored level was found ───────────────────────────────────────────
+/**
+ * Where init found the stored machine gate level:
+ *
+ *   manifest    in the manifest init reads (or nowhere, on a first install or after
+ *               --reset): the seed holds it
+ *   rejected    in a manifest that readManifest() refuses, read raw: init keeps the
+ *               level as stored while it replaces that manifest
+ *   unreadable  nowhere: the manifest cannot be read at all, or stores a level that cannot be
+ *               written back as JSON, so what it stored is unknown
+ */
+export const STORED_GATE_LEVEL_ORIGINS = Object.freeze(['manifest', 'rejected', 'unreadable']);
 /** `features.gateLevel` of a raw manifest, exactly as stored; `undefined` for an absent key. */
 function rawGateLevelOf(raw) {
     const features = raw.features;
@@ -228,17 +235,24 @@ export function describeGateLevel(stored) {
 export function gateLevelPromptSeed(stored, origin = 'manifest') {
     return appliedLevel(classifyGateLevel(stored, origin));
 }
-/** The "Current setting" lines of the prompt note, from the stored value and where it was found. */
+/** The "Current setting" lines of the prompt note, from the stored value and where it was found. Each line fits the 72 columns the note allows. */
 function currentSettingLines(stored, origin) {
     switch (origin) {
         case 'manifest':
             return `Current setting: ${describeGateLevel(stored)}`;
         case 'rejected':
-            return `Current setting: ${describeGateLevel(stored)}\n` +
-                'It comes from a manifest that devflow rejects. Init replaces that manifest and keeps this level unless you choose another.';
+            return [
+                `Current setting: ${describeGateLevel(stored)}`,
+                'It comes from a manifest that devflow rejects.',
+                'Init replaces that manifest and keeps this level',
+                'unless you choose another.',
+            ].join('\n');
         case 'unreadable':
-            return 'Current setting: unknown\n' +
-                `The stored gate level cannot be read, so ${DEFAULT_GATE_LEVEL} applies until you choose a level.`;
+            return [
+                'Current setting: unknown',
+                `The stored gate level cannot be read, so ${DEFAULT_GATE_LEVEL} applies`,
+                'until you choose a level.',
+            ].join('\n');
         default: {
             const exhaustive = origin;
             return exhaustive;
@@ -320,10 +334,10 @@ export function buildClackGateLevelPrompts() {
 export async function runGateLevelStep(opts) {
     const { stored, storedOrigin = 'manifest', prompts } = opts;
     prompts.note(`${currentSettingLines(stored, storedOrigin)}\n\n` +
-        'Sets how much checking /code-review, /plan and /implement apply on this\n' +
-        'machine. A personal "gateLevel" in a repository\'s .devflow/config.json\n' +
-        'overrides it in that repository. Change it later with\n' +
-        'devflow gates --set <level>.\n\n' +
+        'Sets how much checking /code-review, /plan, /implement and /resolve\n' +
+        'apply on this machine. A personal "gateLevel" in a repository\'s\n' +
+        '.devflow/config.json overrides it in that repository. Change it later\n' +
+        'with devflow gates --set <level>.\n\n' +
         formatGateLevelCatalogue(), 'Gate level');
     const outcome = await prompts.selectLevel({
         message: GATE_LEVEL_SELECT_MESSAGE,

package/dist/cli/commands/gates.js

@@ -39,16 +39,14 @@ export const GATE_LEVEL_MEANINGS = Object.freeze({
 /**
  * Which commands read the level today; each later command that reads it updates this text.
  *
- * The init prompt says what each level does in GATE_LEVEL_HINTS (gate-level-prompts.ts).
- * Change the hints too when what a level does changes. A command that reads the level and
- * has no rule that changes a phase leaves the hints true, so it changes this text alone.
+ * The init prompt gives each level one short line in GATE_LEVEL_HINTS (gate-level-prompts.ts);
+ * this text and the docs hold the full effects. Change the hints too when a level changes
+ * how much it checks. A command that reads the level and has no rule that changes a phase
+ * leaves the hints true, so it changes this text alone.
  * One test pins the exact text of both tables, so a change to either fails it until you
  * check the other table and update the pin; further rows check the clauses the two tables
  * share (the lint pack level, the levels that run fewer review focuses and the levels that
- * skip Polish). The clauses that lean skips Harden on a docs-only diff, that standard
- * and lean run one Evaluate pass and that standard and lean apply severity tiers in /resolve
- * have no facet row in `tests/gate-level-prompts.test.ts`: the docs guard checks each at
- * every doc site, against its row in the /implement or /resolve level reference.
+ * skip Polish).
  */
 export const GATE_LEVEL_EFFECT = '/code-review and /plan read the level: standard and lean run fewer review focuses and fewer planning agents. At lean, /implement has Validate run the project\'s lint pack. /implement and /resolve also read the level and name it in their report; at standard and lean they skip Polish, and full keeps it. At lean, /implement skips Harden on a docs-only diff. At standard and lean, /implement runs one Evaluate pass and at most one Fix round. At standard and lean, /resolve applies severity tiers: it fixes or escalates every security finding, fixes CRITICAL, HIGH and severe MEDIUM findings in the branch\'s own code, fixes prose-only MEDIUM findings with text edits alone, and sends lower findings and pre-existing non-security findings to one backlog issue.';
 const MACHINE_MANIFEST_NAME = 'manifest.json';