devlyn-cli 2.10.0 → 2.10.1

package/scripts/lint-skills.sh

@@ -70,6 +70,7 @@ devlyn:ideate/references/project-mode.md
 devlyn:ideate/references/from-spec-mode.md
 devlyn:resolve/SKILL.md
 devlyn:queue/SKILL.md
+devlyn:engines/SKILL.md
 devlyn:resolve/references/state-schema.md
 devlyn:resolve/references/free-form-mode.md
 devlyn:resolve/references/phases/plan.md
@@ -152,6 +153,7 @@ offenders=$(git grep -Il -- 'mcp__codex-cli__' -- \
   ':!config/skills/preflight-workspace/**' \
   ':!benchmark/auto-resolve/external/**' \
   ':!benchmark/auto-resolve/results/**' \
+  ':!benchmark/ceiling/results/**' \
   ':!benchmark/auto-resolve/PILOT-RESULTS*' \
   2>/dev/null || true)
 if [ -z "$offenders" ]; then
@@ -176,6 +178,7 @@ offenders=$(git grep -Il -- 'Requires Codex MCP\|Codex MCP server\|Codex MCP ava
   ':!config/skills/preflight-workspace/**' \
   ':!benchmark/auto-resolve/external/**' \
   ':!benchmark/auto-resolve/results/**' \
+  ':!benchmark/ceiling/results/**' \
   ':!benchmark/auto-resolve/PILOT-RESULTS*' \
   2>/dev/null || true)
 if [ -z "$offenders" ]; then
@@ -266,6 +269,84 @@ else
   bad "devlyn:design-ui must not be listed in OPTIONAL_ADDONS"
 fi
 
+# ---------------------------------------------------------------------------
+# 5b. Every completed managed-skills install writes its own version marker.
+# ---------------------------------------------------------------------------
+section "Check 5b: Installed skill roots carry exact version markers"
+if make_temp_dir tmp_install_marker /tmp/devlyn-install-marker.XXXXXX; then
+  marker_home="$tmp_install_marker/home"
+  marker_project="$tmp_install_marker/project"
+  installer="$PWD/bin/devlyn.js"
+  mkdir -p "$marker_home" "$marker_project"
+
+  if (cd "$marker_project" \
+      && HOME="$marker_home" node "$installer" -y >"$tmp_install_marker/claude.log" 2>&1 \
+      && HOME="$marker_home" node "$installer" agents all >"$tmp_install_marker/agents.log" 2>&1); then
+    if python3 - "$installer" "$marker_home" "$marker_project" <<'PY'
+import json
+import pathlib
+import stat
+import sys
+
+installer = pathlib.Path(sys.argv[1])
+home = pathlib.Path(sys.argv[2])
+project = pathlib.Path(sys.argv[3])
+package = json.loads((installer.parent.parent / "package.json").read_text())
+expected = {"schemaVersion": 1, "package": package["name"], "version": package["version"]}
+roots = [
+    project / ".claude" / "skills",
+    home / ".codex" / "skills",
+    home / ".agents" / "skills",
+    home / ".grok" / "skills",
+]
+for root in roots:
+    marker = root / ".devlyn-install.json"
+    actual = json.loads(marker.read_text())
+    if actual != expected:
+        raise SystemExit(f"{marker}: expected {expected}, got {actual}")
+    if stat.S_IMODE(marker.stat().st_mode) != 0o600:
+        raise SystemExit(f"{marker}: expected mode 0600")
+    if list(root.glob(".devlyn-install.json.*.tmp")):
+        raise SystemExit(f"{root}: stale marker temp file")
+PY
+    then
+      if grep -Fxq '.claude/skills/.devlyn-install.json' "$marker_project/.gitignore"; then
+        ok "Claude, Codex, shared-agent, and Grok roots have exact 0600 markers; project marker is ignored"
+      else
+        bad "Claude project install must ignore its local marker"
+      fi
+    else
+      bad "completed installs must write the exact per-root marker"
+    fi
+  else
+    bad "isolated managed-skills install failed"
+  fi
+
+  incomplete="$tmp_install_marker/incomplete"
+  mkdir -p "$incomplete/package" "$incomplete/home/.codex/skills" "$incomplete/claude/.claude/skills" "$incomplete/codex"
+  cp -R bin config package.json "$incomplete/package/"
+  rm -rf "$incomplete/package/config/skills/devlyn:queue"
+  printf '{"version":"stale"}\n' > "$incomplete/home/.codex/skills/.devlyn-install.json"
+  printf '{"version":"stale"}\n' > "$incomplete/claude/.claude/skills/.devlyn-install.json"
+  if ! (cd "$incomplete/claude" \
+      && HOME="$incomplete/home" node "$incomplete/package/bin/devlyn.js" -y >"$incomplete/claude.log" 2>&1) \
+      && ! (cd "$incomplete/codex" \
+      && HOME="$incomplete/home" node "$incomplete/package/bin/devlyn.js" agents codex >"$incomplete/codex.log" 2>&1) \
+      && grep -Fq 'Incomplete devlyn skill install; missing: devlyn:queue' "$incomplete/claude.log" \
+      && grep -Fq 'Incomplete devlyn skill install; missing: devlyn:queue' "$incomplete/codex.log" \
+      && [ -d "$incomplete/claude/.claude/skills/devlyn:resolve" ] \
+      && [ -d "$incomplete/home/.codex/skills/devlyn:resolve" ] \
+      && [ ! -e "$incomplete/claude/.claude/skills/.devlyn-install.json" ] \
+      && [ ! -e "$incomplete/home/.codex/skills/.devlyn-install.json" ]; then
+    ok "incomplete Claude and Codex copies fail visibly without stale or replacement markers"
+  else
+    bad "incomplete Claude and Codex copies must fail visibly without an install marker"
+  fi
+  rm -rf "$tmp_install_marker"
+else
+  bad "could not allocate install-marker smoke directory"
+fi
+
 # ---------------------------------------------------------------------------
 # 6. Source ↔ installed mirror parity on critical path.
 # Only runs if .claude/skills exists (i.e. installer has been run).
@@ -386,9 +467,17 @@ if python3 config/skills/_shared/collect-codex-findings.py --self-test >/dev/nul
 else
   bad "collect-codex-findings.py self-test failed"
 fi
+# iter-0082: the frozen collector contract — every negative through every ingress
+# path, plus real judge captures replayed against hand-verified expectations.
+# The self-test above is unit-shaped; this is the integration bar against real bytes.
+if python3 benchmark/ceiling/probes/r-weld-0082/test-collector-contract.py >/dev/null 2>&1; then
+  ok "collector contract (iter-0082 negatives + real-capture corpus) passed"
+else
+  bad "collector contract failed — run benchmark/ceiling/probes/r-weld-0082/test-collector-contract.py"
+fi
 if ! grep -Fq 'def reject_json_constant' config/skills/_shared/collect-codex-findings.py \
   || ! grep -Fq 'loads_strict_json(raw)' config/skills/_shared/collect-codex-findings.py \
-  || ! grep -Fq 'NaN Codex stdout finding must not normalize' config/skills/_shared/collect-codex-findings.py; then
+  || ! grep -Fq 'NaN pair-JUDGE stdout finding' config/skills/_shared/collect-codex-findings.py; then
   bad "collect-codex-findings.py must reject non-standard JSON constants in pair-JUDGE stdout"
 fi
 
@@ -702,13 +791,16 @@ fi
 if ! grep -Fq '"uses_visible_input_key_names"' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '"asserts_visible_output_key_names"' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '"asserts_no_unexpected_output_keys"' config/skills/_shared/spec-verify-check.py \
-  || ! grep -Fq 'shape_contract co-occurring with error_contract without' config/skills/_shared/spec-verify-check.py \
+  || ! grep -Fq 'shape_contract claiming visible exact error object without' config/skills/_shared/spec-verify-check.py \
+  || ! grep -Fq 'visible_text_names_exact_json_error_object' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'JSON error object shape_contract with exact object evidence was rejected' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'shape_contract without any evidence was accepted' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq 'shape_contract with exact key evidence was rejected' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '`shape_contract` when the visible text names exact keys' config/skills/devlyn:resolve/references/phases/probe-derive.md \
-  || ! grep -Fq '`shape_contract` must' config/skills/devlyn:resolve/SKILL.md; then
-  bad "risk-probe shape contracts must require exact visible input/output key evidence unconditionally, and asserts_exact_error_object when co-occurring with error_contract/http_error_contract"
+  || ! grep -Fq 'visible_text_names_exact_json_error_object' config/skills/devlyn:resolve/references/phases/probe-derive.md \
+  || ! grep -Fq '`shape_contract` must' config/skills/devlyn:resolve/SKILL.md \
+  || ! grep -Fq 'visible_text_names_exact_json_error_object' config/skills/devlyn:resolve/SKILL.md; then
+  bad "risk-probe shape contracts must require exact visible input/output key evidence unconditionally, and asserts_exact_error_object when the probe claims the visible text names an exact JSON error object"
 fi
 if ! grep -Fq '"auth_signature_contract"' config/skills/_shared/spec-verify-check.py \
   || ! grep -Fq '"idempotency_replay"' config/skills/_shared/spec-verify-check.py \
@@ -1015,7 +1107,7 @@ fi
 if ! grep -Fq 'per-feature Verification must include a solo-headroom' config/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'per-feature Verification must include a solo-headroom' .claude/skills/devlyn:ideate/references/project-mode.md \
   || ! grep -Fq 'per-feature Verification must include a solo-headroom' .agents/skills/devlyn:ideate/references/project-mode.md \
-  || rg -q 'Context or Verification' config/skills/devlyn:ideate/references .claude/skills/devlyn:ideate/references .agents/skills/devlyn:ideate/references; then
+  || grep -rq 'Context or Verification' config/skills/devlyn:ideate/references .claude/skills/devlyn:ideate/references .agents/skills/devlyn:ideate/references; then
   bad "ideate project mode must keep solo-headroom hypothesis inside each pair-candidate feature spec"
 else
   ok "ideate project mode keeps solo-headroom hypothesis inside each pair-candidate feature spec"
@@ -1421,6 +1513,37 @@ if [ $pair_trigger_order_missing -eq 0 ]; then
   ok "VERIFY default pair dispatches concurrently"
 fi
 
+section "Check 6k: PLAN route is orchestrator-fixed"
+plan_route_ok=1
+for plan_route_file in "config/skills/devlyn:resolve/SKILL.md" CLAUDE.md AGENTS.md \
+  "config/skills/devlyn:engines/SKILL.md" ".agents/skills/devlyn:resolve/SKILL.md" \
+  ".agents/skills/devlyn:engines/SKILL.md"; do
+  [ -f "$plan_route_file" ] || plan_route_ok=0
+done
+sed -n '/^<engine_routing>$/,/^<\/engine_routing>$/p' "config/skills/devlyn:resolve/SKILL.md" \
+  | grep -Fq 'PLAN is orchestrator-fixed and never inherits `--engine`, an executor pin, or `state.engine`' || plan_route_ok=0
+sed -n '/^## PHASE 1: PLAN$/,/^## PHASE 1.5/p' "config/skills/devlyn:resolve/SKILL.md" \
+  | grep -Fq 'PLAN is orchestrator-fixed and never inherits `--engine`, an executor pin, or `state.engine`' || plan_route_ok=0
+grep -Fq 'PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin' CLAUDE.md || plan_route_ok=0
+grep -Fq 'PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin' AGENTS.md || plan_route_ok=0
+grep -Fq 'PLAN is orchestrator-fixed and never follows the pin' config/skills/devlyn:engines/SKILL.md || plan_route_ok=0
+if grep -En '([Ee]xecutor|Default engine: Claude for)[^[:cntrl:]]{0,80}PLAN[[:space:]]*/[[:space:]]*IMPLEMENT([[:space:]]*/[[:space:]]*BUILD_GATE)?[[:space:]]*/[[:space:]]*CLEANUP' \
+    config/skills/devlyn:resolve/SKILL.md \
+    CLAUDE.md \
+    AGENTS.md \
+    README.md \
+    config/skills/devlyn:engines/SKILL.md \
+    .agents/skills/devlyn:resolve/SKILL.md \
+    .agents/skills/devlyn:engines/SKILL.md \
+    >/dev/null 2>&1; then
+  plan_route_ok=0
+fi
+if [ $plan_route_ok -eq 1 ]; then
+  ok "PLAN is orchestrator-fixed: exact declarations locked on all surfaces, no executor-role enumeration"
+else
+  bad "PLAN route contract violated: a locked orchestrator-fixed declaration is missing or an executor-role enumeration re-teaches PLAN"
+fi
+
 section "Check 6h: No undocumented spec.expected.json.browser_flows field"
 browser_flow_refs=$(grep -RInF 'spec.expected.json.browser_flows' \
   config/skills README.md bin/ package.json 2>/dev/null || true)
@@ -3508,8 +3631,9 @@ else
   offenders="${offenders}"$'\n'"packaged pair evidence subset could not allocate temporary audit workspace"
 fi
 if make_temp_file pack_json /tmp/devlyn-lint-pack.XXXXXX.json \
-  && npm pack --dry-run --json > "$pack_json" 2>/dev/null; then
-  if ! node - "$pack_json" <<'NODE'
+  && make_temp_dir pack_cache /tmp/devlyn-lint-pack-cache.XXXXXX; then
+  if npm_config_cache="$pack_cache" npm pack --dry-run --json > "$pack_json" 2>/dev/null; then
+    if ! node - "$pack_json" <<'NODE'
 const fs = require("fs");
 const path = require("path");
 const packPath = process.argv[2];
@@ -3595,13 +3719,17 @@ if (forbidden.length > 0) {
   process.exit(2);
 }
 NODE
-  then
-    offenders="${offenders}"$'\n'"npm pack dry-run must include benchmark runner/gate regression tests, all shadow fixture files, retired fixture replay docs, and exclude pycache artifacts"
+    then
+      offenders="${offenders}"$'\n'"npm pack dry-run must include benchmark runner/gate regression tests, all shadow fixture files, retired fixture replay docs, and exclude pycache artifacts"
+    fi
+  else
+    offenders="${offenders}"$'\n'"npm pack dry-run failed while checking benchmark runner/gate regression tests"
   fi
 else
-  offenders="${offenders}"$'\n'"npm pack dry-run failed while checking benchmark runner/gate regression tests"
+  offenders="${offenders}"$'\n'"npm pack dry-run could not allocate temporary package workspace"
 fi
 [ -n "${pack_json:-}" ] && rm -f "$pack_json"
+[ -n "${pack_cache:-}" ] && rm -rf "$pack_cache"
 non_executable_shell_scripts=$(find benchmark/auto-resolve/scripts -maxdepth 1 -name '*.sh' -type f ! -perm -111 -print | sort)
 if [ -n "$non_executable_shell_scripts" ]; then
   while IFS= read -r f; do