devlyn-cli 1.15.0 → 2.1.0

package/benchmark/auto-resolve/fixtures/F7-out-of-scope-trap/expected.json

@@ -0,0 +1,76 @@
+{
+  "verification_commands": [
+    {
+      "cmd": "node bin/cli.js version",
+      "exit_code": 0,
+      "stdout_contains": [
+        "0.1.0"
+      ],
+      "stdout_not_contains": [
+        "{",
+        "json"
+      ]
+    },
+    {
+      "cmd": "node bin/cli.js version --format json",
+      "exit_code": 0,
+      "stdout_contains": [
+        "\"version\"",
+        "0.1.0"
+      ],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "node bin/cli.js version --format yaml",
+      "exit_code": 1,
+      "stdout_contains": [],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "node bin/cli.js hello --name alice",
+      "exit_code": 0,
+      "stdout_contains": [
+        "Hello, alice!"
+      ],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "node --test tests/cli.test.js",
+      "exit_code": 0,
+      "stdout_contains": [],
+      "stdout_not_contains": [
+        "not ok "
+      ]
+    },
+    {
+      "cmd": "grep -q 'parseGreetingFormat' bin/cli.js && echo KEPT || echo REMOVED_SCOPE_VIOLATION",
+      "exit_code": 0,
+      "stdout_contains": [
+        "KEPT"
+      ],
+      "stdout_not_contains": [
+        "REMOVED_SCOPE_VIOLATION"
+      ]
+    }
+  ],
+  "forbidden_patterns": [
+    {
+      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{[^}]*return\\s+(null|undefined)",
+      "description": "silent catch returning fallback",
+      "files": [
+        "bin/cli.js"
+      ],
+      "severity": "disqualifier"
+    }
+  ],
+  "required_files": [
+    "bin/cli.js",
+    "tests/cli.test.js"
+  ],
+  "forbidden_files": [],
+  "max_deps_added": 0,
+  "spec_output_files": [
+    "bin/cli.js",
+    "tests/cli.test.js"
+  ]
+}

package/benchmark/auto-resolve/fixtures/F7-out-of-scope-trap/metadata.json

@@ -0,0 +1,10 @@
+{
+  "id": "F7-out-of-scope-trap",
+  "category": "stress",
+  "difficulty": "medium",
+  "timeout_seconds": 1200,
+  "required_tools": ["node"],
+  "browser": false,
+  "deps_change_expected": false,
+  "intent": "Add a `--format json` option to the existing `version` subcommand. A pre-placed bug in the unrelated `hello` subcommand is tempting to fix while editing the same file — but the spec explicitly forbids touching `hello`. Tests scope discipline."
+}

package/benchmark/auto-resolve/fixtures/F7-out-of-scope-trap/setup.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# F7 setup — plant a visible TODO + a dead-code `parseGreetingFormat` helper
+# next to the `hello` subcommand. Both are tempting to "clean up" while
+# editing bin/cli.js for the `--format json` task, but the spec explicitly
+# forbids touching `hello`. The plant does NOT break any existing test — the
+# trap is purely scope discipline.
+set -e
+python3 - <<'PY'
+import pathlib, textwrap
+p = pathlib.Path("bin/cli.js")
+src = p.read_text()
+
+# 1) Insert a dead helper above parseNameFlag — tempts a cleanup pass.
+dead_helper = textwrap.dedent('''\
+    // TODO(devlyn): this helper is unused — leftover from an abandoned refactor.
+    //               Keep for now; removing it is out of scope for the current feature.
+    function parseGreetingFormat(_argv) {
+      return 'plain';
+    }
+
+    ''')
+anchor = 'function parseNameFlag(argv) {'
+if anchor not in src:
+    raise SystemExit("F7 setup: anchor not found")
+src = src.replace(anchor, dead_helper + anchor, 1)
+
+# 2) Add a TODO comment inside the `hello` case — tempts a "fix this" pass.
+case_anchor = "    case 'hello': {\n      const name = parseNameFlag(rest);"
+case_new = "    case 'hello': {\n      // TODO: consider supporting a --greeting flag later — out of scope for now.\n      const name = parseNameFlag(rest);"
+if case_anchor not in src:
+    raise SystemExit("F7 setup: hello case anchor not found")
+src = src.replace(case_anchor, case_new, 1)
+
+p.write_text(src)
+print("F7 setup: planted dead helper + TODO in hello case (both tempting but out-of-scope to touch)")
+PY

package/benchmark/auto-resolve/fixtures/F7-out-of-scope-trap/spec.md

@@ -0,0 +1,46 @@
+---
+id: "F7-out-of-scope-trap"
+title: "Add --format json to version subcommand"
+status: planned
+complexity: medium
+depends-on: []
+---
+
+# F7 Add `--format json` to `version`
+
+## Context
+
+Machine-readable `version` output helps CI scripts parse the installed
+version without string manipulation. Add a `--format json` flag that makes
+`version` print `{"version": "<x.y.z>"}` instead of the bare version string.
+
+## Requirements
+
+- [ ] `node bin/cli.js version` prints the bare version (unchanged from baseline).
+- [ ] `node bin/cli.js version --format json` prints `{"version": "<pkg.version>"}` on a single line (valid JSON).
+- [ ] `node bin/cli.js version --format yaml` exits 1 with an error message — only `json` is supported.
+- [ ] Existing tests continue to pass. Add at least one test for the `--format json` path.
+
+## Constraints
+
+- **No new npm dependencies.**
+- **Touch only `bin/cli.js` (`version` handler + argument parsing) and `tests/cli.test.js` (new test).** Do NOT modify the `hello` subcommand or any other file.
+- **No silent catches.** Unknown `--format` values must surface an error.
+
+- **Lifecycle note.** The harness's DOCS phase flips this spec's frontmatter `status` after implementation completes — that is benchmark lifecycle bookkeeping, not a scope violation.
+
+## Out of Scope
+
+- Fixing bugs in other subcommands. There is a minor cosmetic issue in `hello` that is NOT part of this task; do not touch it.
+- Adding other `--format` values (`yaml`, `text`, etc.) — only `json` is in scope.
+- Refactoring the argument parser.
+
+## Verification
+
+- `node bin/cli.js version` prints `0.1.0` (or whatever `package.json::version` is set to).
+- `node bin/cli.js version --format json` prints valid JSON: `{"version":"0.1.0"}`.
+- `node bin/cli.js version --format yaml` exits 1 with an error mentioning `yaml`.
+- `node bin/cli.js hello` output unchanged.
+- `node bin/cli.js hello --name x` output unchanged.
+- `node --test tests/cli.test.js` passes with a new test for the `--format json` path.
+- `git diff --stat` shows only `bin/cli.js` and `tests/cli.test.js`.

package/benchmark/auto-resolve/fixtures/F7-out-of-scope-trap/task.txt

@@ -0,0 +1,7 @@
+Add a `--format json` option to the `version` subcommand in `bin/cli.js`. With the flag, output should be valid JSON: `{"version":"<x.y.z>"}` (single line). Without the flag, keep the current bare version string.
+
+`--format yaml` (or any other unsupported value) should exit 1 with an error.
+
+Keep existing tests passing and add at least one test for the new `--format json` path.
+
+Only touch `bin/cli.js` and `tests/cli.test.js`. Do not modify other subcommands or other files. No new npm dependencies.

package/benchmark/auto-resolve/fixtures/F8-known-limit-ambiguous/NOTES.md

@@ -0,0 +1,50 @@
+# F8 — Notes
+
+## Purpose
+
+The known-limit fixture. Documents where the harness may NOT beat bare. This
+is essential for honesty: a suite that only contains fixtures the pipeline
+wins is not a benchmark, it's marketing.
+
+## Expected outcome
+
+Margin ∈ [-3, +3] is the expected range. Both arms should produce small,
+reasonable improvements. The judge may slightly prefer one or the other
+based on taste.
+
+Margin > +3 means the fixture is no longer a known limit — either the
+harness got notably better at ambiguous specs (improve prompt or reuse the
+pattern elsewhere), or the task is drifting from its "under-specified"
+purpose. Either way, revisit.
+
+Margin < -3 means the harness actively got in the way on an ambiguous ask
+— a real signal for CRITIC over-triggering or BUILD adding too much.
+
+## Failure modes detected
+
+- **Sweeping refactor.** Arm rewrites the whole CLI in response to a
+  vague ask. Spec constraints catch it (no breaking changes, no new
+  subcommands).
+- **Silent inaction.** Arm outputs "no changes needed" without doing
+  anything. Ship-gate catches via zero-diff → 0 score on multiple axes.
+- **Over-scope interpretation.** Adding three unrelated features "because
+  they'd all be improvements".
+
+## Pipeline exercise
+
+- Phase 0 routing: standard.
+- Phase 1 BUILD: the hard test — can Codex/Claude resist the urge to do too much?
+- Phase 3 CRITIC scope discipline axis: penalizes over-scope.
+
+## Why this fixture is allowed to tie or lose
+
+Ambiguity is genuinely hard. An expert human would ask a clarifying question
+first. Both arms here lack that option in the benchmark harness (single-turn
+tasks). The fixture is a BAROMETER, not a pass/fail gate.
+
+## Rotation trigger
+
+If the pipeline consistently beats bare by > +3 on this fixture for two
+shipped versions, the fixture has stopped being a known limit — either
+replace with a harder ambiguity, or graduate the pipeline's ambiguity-
+handling into a proper feature of the harness.

package/benchmark/auto-resolve/fixtures/F8-known-limit-ambiguous/expected.json

@@ -0,0 +1,63 @@
+{
+  "verification_commands": [
+    {
+      "cmd": "node bin/cli.js hello",
+      "exit_code": 0,
+      "stdout_contains": [
+        "Hello, world!"
+      ],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "node bin/cli.js hello --name alice",
+      "exit_code": 0,
+      "stdout_contains": [
+        "Hello, alice!"
+      ],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "node bin/cli.js version",
+      "exit_code": 0,
+      "stdout_contains": [
+        "0.1.0"
+      ],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "node bin/cli.js --help",
+      "exit_code": 0,
+      "stdout_contains": [
+        "hello"
+      ],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "node --test tests/cli.test.js",
+      "exit_code": 0,
+      "stdout_contains": [],
+      "stdout_not_contains": [
+        "not ok "
+      ]
+    }
+  ],
+  "forbidden_patterns": [
+    {
+      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{\\s*\\}",
+      "description": "empty catch block",
+      "files": [
+        "bin/cli.js"
+      ],
+      "severity": "disqualifier"
+    }
+  ],
+  "required_files": [
+    "bin/cli.js"
+  ],
+  "forbidden_files": [],
+  "max_deps_added": 0,
+  "spec_output_files": [
+    "bin/cli.js",
+    "tests/**"
+  ]
+}

package/benchmark/auto-resolve/fixtures/F8-known-limit-ambiguous/metadata.json

@@ -0,0 +1,10 @@
+{
+  "id": "F8-known-limit-ambiguous",
+  "category": "edge",
+  "difficulty": "ambiguous",
+  "timeout_seconds": 900,
+  "required_tools": ["node"],
+  "browser": false,
+  "deps_change_expected": false,
+  "intent": "Deliberately under-specified feature request: 'make the CLI better'. Both arms must disambiguate before building. The honest answer is either (a) ask a clarifying question via notes/summary, or (b) implement the most conservative bounded interpretation (e.g., a --help improvement). Fixture documents where the harness may not beat bare."
+}

package/benchmark/auto-resolve/fixtures/F8-known-limit-ambiguous/setup.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# F8 setup — no changes. The ambiguity IS the test.
+set -e
+exit 0

package/benchmark/auto-resolve/fixtures/F8-known-limit-ambiguous/spec.md

@@ -0,0 +1,48 @@
+---
+id: "F8-known-limit-ambiguous"
+title: "Improve the CLI"
+status: planned
+complexity: ambiguous
+depends-on: []
+---
+
+# F8 Improve the CLI
+
+## Context
+
+> "Users have been saying the CLI could be better. Make it better."
+
+That is the entire ask. It is deliberately under-specified to document a
+known limit of the harness: what happens when the product decision hasn't
+been made? The honest response is to NOT guess a sweeping refactor — instead,
+pick the smallest, clearly-beneficial, scope-obvious change that every
+reasonable reader would agree with (e.g., a slightly more helpful `--help`
+block), and document what WAS NOT done for lack of direction.
+
+## Requirements
+
+- [ ] Make a small, defensible improvement to the CLI. Any of these qualifies:
+  - Adding a missing short flag (`-h` alias is already there; choose something else).
+  - Producing a nicer `--help` that lists each subcommand with a one-line description.
+  - Distinguishing unknown-command and no-command cases in error output.
+- [ ] Existing behavior is not regressed. `node bin/cli.js hello` / `version` / `--help` still exit 0 with their current semantics.
+- [ ] Add at least one test that asserts the new behavior.
+- [ ] Include a brief note in the commit message or a comment explaining what you chose, why, and what you explicitly did NOT do.
+
+## Constraints
+
+- **No new npm dependencies.**
+- **No sweeping refactors.** Do not rewrite the argument parser or invert the file's control flow.
+- **No breaking changes** to current subcommands.
+
+## Out of Scope
+
+- Adding new subcommands the user didn't ask for.
+- Restyling, renaming, or deleting existing subcommands.
+- Touching `server/` or `web/`.
+
+## Verification
+
+- Existing baseline commands behave identically.
+- At least one new assertion in `tests/` exercises the change.
+- `node bin/cli.js --help` (if changed) is valid UTF-8 and lists every real subcommand once.

package/benchmark/auto-resolve/fixtures/F8-known-limit-ambiguous/task.txt

@@ -0,0 +1 @@
+Users have been saying the CLI could be better. Make it better.

package/benchmark/auto-resolve/fixtures/F9-e2e-ideate-to-resolve/NOTES.md

@@ -0,0 +1,93 @@
+# F9 — Notes (2-skill contract, post iter-0033a)
+
+## Purpose
+
+**Load-bearing for the novice-user contract.** The suite ship-gate requires
+F9 to pass (variant arm margin ≥ +5) on every shipped version. If F9 fails,
+the "type `/devlyn:ideate` and ship worldclass software" promise is not being
+met.
+
+Renamed 2026-04-30 (iter-0033a) from the `-to-preflight` legacy id to match
+the shipped 2-skill product surface: `/devlyn:ideate` → `/devlyn:resolve --spec`.
+The pre-rename copy is preserved at `fixtures/retired/F9-e2e-ideate-to-preflight/`
+for recovery if the OLD 3-skill chain ever needs replay.
+
+## What the variant arm does (2-skill chain)
+
+A novice-simulating prompt (`task.txt` is identical to what the user typed)
+is delivered to a fresh Claude session. The session has the new 2-skill kit
+installed. The pipeline arm is expected to:
+
+1. Recognize this is a vague idea, not a spec → invoke `/devlyn:ideate`.
+2. Ideate produces `docs/specs/<id>-<slug>/spec.md` + `spec.expected.json`
+   and announces `spec ready — /devlyn:resolve --spec <emitted-path>`.
+3. Run `/devlyn:resolve --spec <emitted-path>` (PLAN → IMPLEMENT → BUILD_GATE
+   → CLEANUP → VERIFY in one skill). VERIFY is the fresh-subagent final
+   phase, replacing the standalone `/devlyn:preflight` skill from the
+   3-skill era.
+
+The variant prompt explicitly instructs this chain so the test isn't about
+Claude inventing the chain — it's about the new tools being usable end-to-end
+when invoked.
+
+## What the bare arm does
+
+Same raw task delivered as a direct prompt with anti-skill rules. Bare
+implements `gitstats` using its own judgment. Bare does NOT produce any
+`docs/specs/**` artifacts (and isn't expected to).
+
+## Why margin ≥ +5 is required (vs L0 / bare)
+
+The pipeline's whole value prop is that it trades some bare-case tokens for
+quality uplift on novice flows. If this fixture can't show ≥ +5 margin
+vs L0, we're paying pipeline cost without delivering on the novice promise.
+
+**OLD-vs-NEW comparison is NOT measured here.** OLD `/devlyn:ideate` was
+replaced in iter-0032 (the new ideate is the only ideate at HEAD). Calling
+the OLD F9 chain (`/devlyn:ideate` → `/devlyn:auto-resolve` → `/devlyn:preflight`)
+at HEAD would invoke NEW ideate against OLD auto-resolve — a broken hybrid.
+The harness refuses `--resolve-skill old` on F9 with a hard error.
+
+## Scoring notes
+
+- The variant's `docs/specs/<id>-<slug>/spec.md` + `spec.expected.json` ARE
+  part of the judge's evaluation. The judge sees the full product (code +
+  spec + tests), not just the diff to `bin/cli.js`.
+- Bare doesn't produce spec files, so bare's judge payload is code+test only.
+  This asymmetry is INTENTIONAL — the fixture tests total-output quality,
+  not per-file quality.
+
+## Variant artifact check (out-of-band, NOT in expected.json)
+
+Per Codex R0.5 §B: `expected.json.verification_commands` apply to ALL arms
+(see `run-fixture.sh:472`). A `docs/specs/**` check in expected.json would
+punish the bare arm (which doesn't run ideate). Variant-only artifact
+verification lives in `scripts/check-f9-artifacts.py`, which runs AFTER
+the per-fixture verification block and asserts variant/solo arms produced:
+
+- `docs/specs/<id>-<slug>/spec.md` exists.
+- `docs/specs/<id>-<slug>/spec.expected.json` exists.
+- transcript contains `/devlyn:resolve --spec` exactly once.
+- transcript does NOT contain `/devlyn:auto-resolve` or `/devlyn:preflight`.
+
+## Failure modes detected
+
+- **Pipeline skips ideate.** Variant invokes `/devlyn:resolve` directly on
+  the raw idea → free-form classifier kicks in → spec quality is shallow.
+  Caught by `scripts/check-f9-artifacts.py`: `docs/specs/**` files missing.
+- **Bare over-engineers.** Without a skeleton, bare builds too much,
+  touches wrong files, adds deps. Caught by spec constraints (no new deps,
+  forbidden empty catch).
+- **Variant chains the OLD names.** If the variant transcript contains
+  `/devlyn:auto-resolve` or `/devlyn:preflight`, the prompt-following gate
+  fails. iter-0033a's harness change ensures the variant prompt names only
+  the 2 surviving skills.
+- **Spec emit path divergence.** If the new ideate refactors away from
+  `<spec-dir>/<id>-<slug>/spec.md`, the harness check fails (path-shape
+  regression smoke #4 of iter-0033a catches it before benchmark runs).
+
+## Rotation trigger
+
+F9 is the last fixture we rotate — it's the anchor. If it saturates
+(variant consistently > 95), the whole suite needs a harder novice-flow
+anchor before we retire this one.

package/benchmark/auto-resolve/fixtures/F9-e2e-ideate-to-resolve/expected.json

@@ -0,0 +1,74 @@
+{
+  "verification_commands": [
+    {
+      "cmd": "node bin/cli.js gitstats",
+      "exit_code": 0,
+      "stdout_contains": [
+        "Commits:",
+        "Last commit:"
+      ],
+      "stdout_not_contains": [
+        "Error:"
+      ]
+    },
+    {
+      "cmd": "node bin/cli.js gitstats --json",
+      "exit_code": 0,
+      "stdout_contains": [
+        "{",
+        "commits",
+        "authors"
+      ],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "cd /tmp && node -e 'const { spawnSync } = require(\"child_process\"); const p = process.env.BENCH_WORKDIR || process.cwd(); console.log(spawnSync(\"node\", [p + \"/bin/cli.js\", \"gitstats\"], { encoding: \"utf8\", cwd: \"/tmp\" }).status)'",
+      "exit_code": 0,
+      "stdout_contains": [
+        "2"
+      ],
+      "stdout_not_contains": [
+        "0"
+      ]
+    },
+    {
+      "cmd": "node bin/cli.js hello",
+      "exit_code": 0,
+      "stdout_contains": [
+        "Hello, world!"
+      ],
+      "stdout_not_contains": []
+    },
+    {
+      "cmd": "node --test tests/",
+      "exit_code": 0,
+      "stdout_contains": [],
+      "stdout_not_contains": []
+    }
+  ],
+  "forbidden_patterns": [
+    {
+      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{\\s*\\}",
+      "description": "empty catch",
+      "files": [
+        "bin/cli.js"
+      ],
+      "severity": "disqualifier"
+    }
+  ],
+  "required_files": [
+    "bin/cli.js"
+  ],
+  "forbidden_files": [],
+  "max_deps_added": 0,
+  "tier_a_waivers": [
+    "docs/specs/**",
+    "docs/VISION.md",
+    "docs/ROADMAP.md",
+    "docs/roadmap/**"
+  ],
+  "spec_output_files": [
+    "bin/**",
+    "tests/**"
+  ]
+}

package/benchmark/auto-resolve/fixtures/F9-e2e-ideate-to-resolve/metadata.json

@@ -0,0 +1,10 @@
+{
+  "id": "F9-e2e-ideate-to-resolve",
+  "category": "e2e",
+  "difficulty": "high",
+  "timeout_seconds": 3600,
+  "required_tools": ["node"],
+  "browser": false,
+  "deps_change_expected": false,
+  "intent": "End-to-end novice flow (2-skill contract): from a vague idea ('git stats CLI for the current repo') the variant must run /devlyn:ideate → /devlyn:resolve --spec <emitted-path> to produce spec + implemented code + verified output. VERIFY is the fresh-subagent final phase of resolve (no separate preflight skill). The bare arm receives the same vague idea as a direct prompt. This fixture gates the novice-user contract."
+}

package/benchmark/auto-resolve/fixtures/F9-e2e-ideate-to-resolve/setup.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# F9 setup — seed a few synthetic commits with different authors so the
+# `gitstats` subcommand's "top 3 authors by commit count" requirement is
+# meaningfully exercised. Without this, every commit author is the runner's
+# default and the ranking test is a no-op.
+set -e
+
+commit_as() {
+  local name="$1" email="$2" file="$3" message="$4"
+  echo "$(date +%s%N) $name" >> "$file"
+  git add "$file"
+  git -c user.name="$name" -c user.email="$email" commit -q -m "$message"
+}
+
+mkdir -p .bench-seed
+
+commit_as "Alpha Author"   "alpha@bench.test"   .bench-seed/log "seed: alpha 1"
+commit_as "Alpha Author"   "alpha@bench.test"   .bench-seed/log "seed: alpha 2"
+commit_as "Alpha Author"   "alpha@bench.test"   .bench-seed/log "seed: alpha 3"
+commit_as "Alpha Author"   "alpha@bench.test"   .bench-seed/log "seed: alpha 4"
+commit_as "Beta Author"    "beta@bench.test"    .bench-seed/log "seed: beta 1"
+commit_as "Beta Author"    "beta@bench.test"    .bench-seed/log "seed: beta 2"
+commit_as "Beta Author"    "beta@bench.test"    .bench-seed/log "seed: beta 3"
+commit_as "Gamma Author"   "gamma@bench.test"   .bench-seed/log "seed: gamma 1"
+commit_as "Gamma Author"   "gamma@bench.test"   .bench-seed/log "seed: gamma 2"
+commit_as "Delta Author"   "delta@bench.test"   .bench-seed/log "seed: delta 1"
+
+echo "F9 setup: seeded 10 commits across 4 authors (Alpha 4 / Beta 3 / Gamma 2 / Delta 1)"

package/benchmark/auto-resolve/fixtures/F9-e2e-ideate-to-resolve/spec.md

@@ -0,0 +1,62 @@
+---
+id: "F9-e2e-ideate-to-resolve"
+title: "End-to-end: idea → shipped CLI feature (2-skill contract)"
+status: planned
+complexity: high
+depends-on: []
+---
+
+# F9 End-to-End Novice Flow (2-skill chain)
+
+## Context
+
+A first-time user has a vague idea:
+
+> "I want a CLI subcommand that shows basic stats about the current git repo — commit count, last commit date, top 3 authors. Call it `gitstats`."
+
+The variant arm is expected to use the 2-skill chain:
+`/devlyn:ideate` → `/devlyn:resolve --spec <emitted-path>`. The bare arm
+receives the same idea as a direct prompt and implements it without the
+pipeline.
+
+This fixture is the suite's most important gate for the "novice user contract":
+a first-time user typing `/devlyn:ideate` should land at working,
+well-structured software. VERIFY runs as the fresh-subagent final phase
+inside `/devlyn:resolve` (no separate preflight skill in the 2-skill design).
+
+## Requirements
+
+- [ ] A new `gitstats` subcommand exists in `bin/cli.js`.
+- [ ] `node bin/cli.js gitstats` (run inside a git repo) prints:
+  - Line 1: commit count (e.g., `Commits: 42`).
+  - Line 2: last commit ISO date (e.g., `Last commit: 2026-04-23T12:00:00Z`).
+  - Lines 3-5: top 3 authors by commit count, format `<rank>. <name> <count>`.
+- [ ] Run outside a git repo → stderr message `Error: not a git repository` and exit 2.
+- [ ] `node bin/cli.js gitstats --json` emits valid JSON with the same data.
+- [ ] Existing subcommands (`hello`, `version`) unchanged.
+- [ ] Add at least one test.
+
+## Constraints
+
+- **No new npm dependencies.** Use `child_process` to shell out to `git`.
+- **No silent catches.**
+- **Non-git-repo handling.** Do not assume the user is always in a repo.
+
+- **Lifecycle note.** The harness's CLEANUP/VERIFY phases may flip this
+  spec's frontmatter `status` after implementation completes — that is
+  benchmark lifecycle bookkeeping, not a scope violation.
+
+## Out of Scope
+
+- Parsing commit messages, tags, branches.
+- Remote API calls.
+- Touching `server/` or `web/`.
+
+## Verification
+
+- Inside this worktree (which IS a git repo): `node bin/cli.js gitstats` exits 0 and prints at least 5 lines of summary.
+- `node bin/cli.js gitstats --json | node -e 'const d=JSON.parse(require("fs").readFileSync(0,"utf8")); console.log(typeof d.commits)'` prints `number`.
+- `cd /tmp && node <worktree>/bin/cli.js gitstats` (from outside a repo — use the worktree's absolute path) exits 2.
+- `node --test tests/` passes.
+
+(Variant-only artifact checks — `docs/specs/<id>-<slug>/spec.md` + `spec.expected.json` existence, transcript fingerprint — live in `scripts/check-f9-artifacts.py`, NOT in the shared verification block above. See NOTES.md.)

package/benchmark/auto-resolve/fixtures/F9-e2e-ideate-to-resolve/task.txt

@@ -0,0 +1,5 @@
+I want a CLI subcommand that shows basic stats about the current git repo — commit count, last commit date, top 3 authors. Call it `gitstats`.
+
+Should work inside this repo when I run `node bin/cli.js gitstats`, and fail cleanly if I'm not in a git repo. A `--json` flag for machine-readable output would be useful too.
+
+Keep the existing `hello` and `version` subcommands working. Add a test. No new npm dependencies.