devlyn-cli 4.1.0 → 4.2.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devlyn-cli",
-  "version": "4.1.0",
-  "description": "Loop & harness engineering for AI coding agents (Claude Code, Codex, and any AGENTS.md-driven agent) — take intent to shipped, engineer-quality software hands-free with phase-gated pipelines and agent orchestration",
+  "version": "4.2.0",
+  "description": "Loop & harness engineering for AI coding agents (Claude Code, Codex, and any AGENTS.md-driven agent) — core engineering principles for CLAUDE.md/AGENTS.md and a loop designer that splits one intent into tasks agents drain hands-free",
   "homepage": "https://github.com/fysoul17/devlyn-cli#readme",
   "bin": {
     "devlyn": "bin/devlyn.js"
@@ -39,7 +39,6 @@
     "loop-engineering",
     "agent-orchestration",
     "prompt-engineering",
-    "code-review",
     "devlyn",
     "developer-tools",
     "automation",

package/config/commit-conventions.md

@@ -1,28 +0,0 @@
-# Commit Conventions
-
-Use conventional commits: `<type>: <description>` (scope optional: `<type>(<scope>): <description>`)
-
-| Type       | Use for                                              |
-|------------|------------------------------------------------------|
-| `feat`     | New feature                                          |
-| `fix`      | Bug fix                                              |
-| `chore`    | Routine tasks (deps, non-production changes)         |
-| `docs`     | Documentation updates                                |
-| `style`    | Code style only (formatting, spacing)                |
-| `refactor` | Restructuring (no fix or feature)                    |
-| `perf`     | Performance improvements                             |
-| `test`     | Adding or updating tests                             |
-| `build`    | Build system or dependency changes                   |
-| `ci`       | CI/CD pipeline updates                               |
-| `revert`   | Reverting a previous commit                          |
-| `temp`     | Temporary changes (not for long-term merge)          |
-
-## Examples
-
-```
-feat: add user authentication
-fix: resolve null pointer in auth middleware
-refactor(api): simplify request validation
-docs: update API usage guide
-chore: upgrade next.js to v16.2
-```

package/config/skills/_shared/adapters/README.md

@@ -1,74 +0,0 @@
-# Per-engine prompt adapters
-
-This folder is the LLM-specific delta layer. The harness's canonical phase prompts (in each skill's `references/phases/<phase>.md`) stay model-neutral and outcome-first. Each adapter file in this folder is a **small delta header** that gets injected BEFORE the canonical body when the phase runs against that specific engine.
-
-## Why adapters exist
-
-Anthropic and OpenAI publish official prompt-engineering guides for their flagship models. The two guides converge on outcome-first + decision rules + mechanical validation but **diverge on tactics** (XML structure vs stop-rules format, literal interpretation vs decision-rule phrasing, self-check pattern vs validation-tool primacy). A single canonical prompt can't hit both ceilings.
-
-The split:
-- **Canonical body** (in `<skill>/references/phases/`) = the contract: goal, output format, invariants, common-ground rules from both guides.
-- **Adapter header** (here) = the per-engine elaboration: model-specific guidance from that engine's official guide.
-
-This is also the load-bearing piece for **multi-LLM evolution**. When Qwen / Gemini / Gemma are added (Mission 2/3), each gets its own adapter file here. The canonical body never moves.
-
-## Format
-
-Each adapter is a single markdown file named `<engine>.md`, matching the `--engine` selector value (e.g. `claude.md`, `codex.md`). Structure:
-
-```markdown
-# <Engine> adapter
-
-> Source: <official-prompt-engineering-guide URL>
-
-## Identity
-1-2 lines telling the model who it is + which guide governs.
-
-## Output discipline
-Verbosity, formatting, length conventions specific to this model.
-
-## Tool-use posture
-When to use tools, when to reason, parallel/sequential preferences.
-
-## Effort and autonomy
-Optional. Model-specific guidance for effort levels or autonomous-vs-interactive runs when the vendor guide calls this out.
-
-## Validation pattern
-How this model verifies its work — mechanical-first vs self-check, etc.
-
-## Anti-patterns
-Specific patterns the official guide warns about for this model.
-```
-
-Keep each section to ≤ 8 lines. Adapters are deltas, not full prompts. If an adapter grows past ~80 lines, the content probably belongs in canonical body.
-
-## Role-scoped and non-agentic adapters
-
-Adapters may add two more sections beyond the base format:
-
-- **`## Role eligibility`** — fixed ASCII fields, one per line: `executor: yes|no`, `pair_judge: yes|no`. Absent section = eligible for both roles (every adapter shipped before iter-0051). Present only when a backend is structurally unable or not certified for a role — e.g. a completion-only local model has no tool/file-edit access, so it declares `executor: no`. `_shared/engine-preflight.md` and `/devlyn-engines` read this section as a structured marker, not prose, so it validates mechanically.
-- **`## Invocation`** — for backends called over an API or CLI backends with non-default invocation contracts: the concrete request shape (endpoint, JSON body, timeout) and the adapter-declared availability probe (`_shared/engine-preflight.md#role-resolution`'s "an adapter may declare a different probe" hook).
-
-## When to add a new adapter
-
-A new adapter file ships when:
-1. A new LLM is integrated into the pipeline (the engine is now invocable).
-2. An official prompt-engineering guide for that LLM exists (or a vendor-recommended pattern set).
-3. An empirical A/B shows the adapter's specific guidance lifts that model's performance over the canonical body alone.
-
-Not all models need adapters. If a model performs well on the canonical body without delta, ship without one.
-
-## What NOT to put here
-
-- ❌ Universal rules (those go in canonical body or `_shared/runtime-principles.md`).
-- ❌ Iter-history annotations (`*(iter-0020: F4 evidence...)*` style).
-- ❌ Full phase prompts (defeats the decoupling).
-- ❌ Per-task or per-spec content (adapters are model-scope, not task-scope).
-
-## Runtime injection
-
-A skill's phase invocation prepends the resolved engine's adapter file to the canonical body before sending. Mechanism is left to each skill (a `_shared/adapter-inject.sh` helper may land in a later iter); for now, skills consume the adapter file by direct read at phase-spawn time.
-
-## Standing rule
-
-Any iter that touches an adapter file MUST cite the corresponding official guide as part of acceptance: "guide section X.Y says Z, this change applies Z." Generic preferences ("feels cleaner") are rejected.

package/config/skills/_shared/adapters/grok.md

@@ -1,100 +0,0 @@
-# Grok adapter
-
-## Role eligibility
-
-executor: no
-pair_judge: yes
-
-Certification status: the pair-judge seat is wired, reachable, and probe-capable, but not emission-certified; isolation has three independent invariants — tool callability, MCP connection/enumeration, and context injection — and only P-0080-C can certify them; the doctor cannot. Before this change, the shipped recipe connected 65 MCP tools and injected both an MCP reminder and a plugin-skills reminder into the judge's conversation; a durable `pair grok` pin remains gated on follow-up emission registration and the standing seat-fitness rule.
-
-## Invocation
-
-**Availability probe**: `command -v grok >/dev/null 2>&1`; record
-`grok --version` as evidence. The probe is necessary, not sufficient: auth or
-wrapper failures after it passes are the same fail-closed availability class as
-a failed probe (`BLOCKED:grok-unavailable` for an explicit route; an automatic
-escalation remains a reported solo skip).
-
-```bash
-# $ISO_HOME = ephemeral dir seeded with a copied auth.json + agent_id, and a
-#   config.toml containing:
-#   [plugins]
-#   disabled = ["telegram", "vercel"]
-#   enabled = []
-#
-#   [skills]
-#   ignore = ["~/.agents", "~/.claude", "~/.cursor"]
-#   plus $ISO_HOME/hooks/anchor-guard.json. grok reads that file as JSON, not
-#   through a shell, so its "command" must carry an ALREADY-EXPANDED path:
-#   {"hooks":{"PreToolUse":[{"hooks":[{"type":"command",
-#     "command":"python3 /abs/path/to/_shared/grok-anchor-guard.py","timeout":10}]}]}}
-# $NEUTRAL  = empty dir outside any git repo
-# $REPO     = absolute repo root (redirects MUST be absolute — cwd is $NEUTRAL)
-cd "$NEUTRAL"
-HOME="$NEUTRAL" ZDOTDIR="$NEUTRAL" GROK_HOME="$ISO_HOME" \
-DEVLYN_PROBE_ANCHOR="<the bare anchor, derived exactly as the --allow rule below>" \
-GROK_CLAUDE_MCPS_ENABLED=false GROK_CURSOR_MCPS_ENABLED=false \
-GROK_CLAUDE_SKILLS_ENABLED=false GROK_CURSOR_SKILLS_ENABLED=false \
-GROK_CLAUDE_HOOKS_ENABLED=false GROK_CURSOR_HOOKS_ENABLED=false \
-GROK_CLAUDE_AGENTS_ENABLED=false GROK_CLAUDE_RULES_ENABLED=false \
-GROK_MEMORY=0 \
-python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- grok -p "<judge prompt>" \
-  --permission-mode dontAsk --no-memory \
-  --tools "read_file,grep,list_dir,run_terminal_cmd" \
-  --disallowed-tools "Agent,use_tool,search_tool" \
-  --allow 'Bash(<the bare anchor>)' \
-  --reasoning-effort medium \
-  --output-format streaming-messages-json \
-  > "$REPO/.devlyn/grok-judge.stdout" 2> "$REPO/.devlyn/grok-judge.stderr"
-```
-
-Copy `auth.json` into `$ISO_HOME` for every run and seed its `config.toml` with
-the shown `[plugins]` and `[skills] ignore` entries and its
-`hooks/anchor-guard.json` with the shown `PreToolUse` entry. Before launch, create
-`$NEUTRAL/.zshenv` containing `export HOME=<the operator's real home>`.
-Both overrides are needed because grok scans `~/.claude.json` from `$HOME`,
-while zsh reads rc files from `$ZDOTDIR`, which is exported in some environments.
-`$NEUTRAL` and `$ISO_HOME` must be on paths that do not embed a project or repo identifier.
-`--permission-mode plan` is forbidden headless because it silently blocks
-all tools and returns an empty review; `--always-approve` is banned because it
-auto-approves writes. `--tools` and `--disallowed-tools` are headless-only (the
-TUI warns and ignores them); when both are present, the disallow list wins and
-removes tools entirely rather than merely gating execution.
-
-Never use `--json-schema` for the pair judge: measured runs degraded the
-tool-use loop (2/3 made zero tool calls and fabricated findings), and a
-`Cancelled` run emitted a PASS-shaped payload after its schema had failed.
-
-The judge prompt must name the exact permitted command(s). Derive the prompt
-anchor and allow-list string identically from one source, in this precedence:
-the backticked commands in the spec's `## Verification` bullets;
-otherwise the repo's existing test/CLI runner. If none exists, the probe
-obligation does not arise and a static review is correct for that spec.
-The documented `Bash(<command>)` form matches the exact command or its prefix;
-the trailing ` *` form fails a no-argument command.
-Under `dontAsk`, every allow shape tested for a chained command — including an
-exact full-string rule for the chain — returned `PermissionCancelled`, so the
-mandatory dominance-loss anchor must run unchained with the allow rule scoped
-to that bare anchor.
-
-Grok's deny semantics are not Claude-parity: reaching the permission mode's
-auto-deny silently truncates the review at exit 0. On the configured, measured
-path the `PreToolUse` hook above keeps the judge from reaching it — the hook runs
-at step 1, before the rules and before the mode policy, and returns the denial as
-a model-visible `tool_result`.
-It admits the bare anchor and anchor-plus-argv, and vetoes any character that
-could start a second command, so `verify.md`'s bounded input variations survive
-while chaining does not. The hook fails open, so the collector rejection remains
-the fail-closed floor: treat it as `BLOCKED` for
-`verify.pair.emission-contract`, never PASS. After a non-timeout spawn, run:
-
-```bash
-python3 "$DEVLYN_SHARED_DIR/collect-codex-findings.py" \
-  --devlyn-dir "$REPO/.devlyn" \
-  --stdout-file grok-judge.stdout
-```
-
-On exit 124, write `.devlyn/verify.pair.timeout.json` with
-`{"engine": "grok", "budget_seconds": 600}` before merge. A budget abort can
-leave the stream truncated before its terminal `result` record; that capture
-stays `TIMEOUT` at merge, never a pair PASS.