devlyn-cli 4.2.26 → 4.3.3

package/bin/skill-history.json

@@ -43,6 +43,7 @@
       "3be2ec1243eb28f779b170e469dfb65555a92dc08b3d927b8973cbd49308125d",
       "3c58989be2f943896810ef709fb115171420a918dfaadc43ea47940fa8ebc7ed",
       "3c81c575cc43d70488865b440204cb399091405d9b7f81dbf047a32d3d5ac045",
+      "3cb043970432281f3c2c3c7ec813c4721221ca18ff227e94ef204f2ef2178044",
       "3cd398df22e666fdd2e0f253c5a7464bca62bceefe3737d28a5ef95b75cb3a33",
       "3e39fbe29d0bd607f4ad940f4ca40f9abf82d468e418d0362fb0fd4fa6812475",
       "3e5135877e733f1dcff3b747444228f5eece7cb047956c87a3af02a485cfaad9",
@@ -79,6 +80,7 @@
       "69a3fa5c1e7c5358cf7571936c8c09f5cc1d13999c8490ac10533af2091c4226",
       "6a523474b70ba99aff5472020cdde9ca1e7c91f8ee65db03c9e712adfac6d31d",
       "6d1a5458b23196b6f6fde6b7e9dc097ed173cb5914de439e512a032ca1892812",
+      "6e70044cab5a3fb1f78b7148c2111e4298ce8f5f8e902220430ca316bb61255d",
       "6fa2b5e089dcd00613c6e9800d2e763da9e5b2c80e6a7ef5d54d5ad7113e8399",
       "71fb125e20420d6f3fcd3396093fcdc8d552bab9626c3cbd962351e0d19adac8",
       "725395f70eec7e2ceae1f3aa122893433923b098a1e0d6202dd410979ef4eea0",
@@ -145,6 +147,7 @@
       "d3b40b9f0e15bf90ca557c0198a8fe5ff1d046b9aaa54b181c743d8e006f9c34",
       "d424feceffc005f220e33a19cac73f33bd40d120cc14da33725b8a990704bcf6",
       "d7388e36d76647a89ce52de615271928cf9fc78f980df399d2bc2e6d6675ec82",
+      "d85fa24b9b2c439742c9a62d5d4e07a031a1cfe6024bbc06f98eff7063424179",
       "dac3da11ea5686382f5c9892a0b8e4ec25e625e5946283d8e2ad944aa84e1df2",
       "db867d1fd98058bb20e41e942abd95f08fbaa9465928025f69f0a0308fa71514",
       "dd0bfdfd2db0b5f9ddef75d1b9ce3247698739fc551d292366dccd506fef6a36",
@@ -319,6 +322,7 @@
       "0dc69c20434966015176d83baa6f95b3421f9e13d0b1bd608a22f0560eae1049",
       "0fe9b270d670f70da9d2535969b6117684b7c1517806b3029ebaf9624da8006c",
       "1582c202d361af927c2d0843d4bcb72ccc98a0a2a9d8344d118d680f70f7e1e4",
+      "19207315f23c9a12bf2ced0e4e79bb7dfdc7cc5d0c9dd94095d9c6dfe1e8fea8",
       "1d8c3bd31c8b755acd0c3c9f416acb5024dfa99fbf5e2c14d8d6df00a24fe9b4",
       "300d1af60cc53285935dc4b5b370e157707218d844a4303b96d7826eef36ed43",
       "302b1a6c109087dce02ed6af184d6aeeca6cecfd40ebe638beecf8bdf21cf59c",
@@ -357,6 +361,7 @@
       "d6433bf0f96dd9dd485c3623885255738654674b3e23cfcc1a2cfd24f3cda96e",
       "db8d921aabf0d04811b55465a3757c62c4b39631aebaf6eecc994ca241cfbe56",
       "e25da746dc37b2e82c658a28d9481fd69741151045683eee2119582ddaf731cd",
+      "e47a2ce766ae81fa0870e0a8dfbfe737311de69ce620e92217abbe4c532e3c8b",
       "e929f76c15349f1b9bc1e84e0a3e9e48e916168d79270e0f4a36ea8eab9b5388",
       "f2243cc4150e225961825f6097b0cf38166c291dcf58127516ceee841f7ed4c8",
       "fa536198d539a3c85f54dda74d0d78716ac6e6849e733bdadecc8605511eac37",

package/config/skills/_shared/harness-store.py

@@ -0,0 +1,202 @@
+"""Release identity and queue resource checks. Readers never write or create locks.
+
+The release verifier is CLI-1's bin/release.js, not a second manifest verifier.
+A Codex projection has .devlyn-harness-projection.json at its plugin root:
+{schemaVersion: 1, release: ReleaseRef, source: "native/codex/plugins/devlyn"}.
+Its complete regular-file tree (except that marker) must match that release subtree.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+
+PROJECTION = ".devlyn-harness-projection.json"
+CODEX_SOURCE = "native/codex/plugins/devlyn"
+
+
+class HarnessError(Exception):
+    pass
+
+
+def require(condition, message):
+    if not condition:
+        raise HarnessError(message)
+
+
+def read_json(path):
+    try:
+        return json.loads(Path(path).read_bytes())
+    except (OSError, ValueError) as exc:
+        raise HarnessError(f"{path}: {exc}") from exc
+
+
+def file_identity(path):
+    path = Path(path)
+    info = path.lstat()
+    require(path.is_file() and not path.is_symlink() and info.st_nlink == 1, f"not a regular resource: {path}")
+    return {"path": str(path), "sha256": hashlib.sha256(path.read_bytes()).hexdigest()}
+
+
+def release_ref(value):
+    require(isinstance(value, dict) and set(value) == {"package", "version", "digest", "root"}
+            and value["package"] == "devlyn-cli"
+            and all(isinstance(value[k], str) and value[k] and "\0" not in value[k] for k in ("version", "digest", "root"))
+            and re.fullmatch(r"[a-f0-9]{64}", value["digest"]) and Path(value["root"]).is_absolute(), "malformed release reference")
+    return value
+
+
+def verify_release(root):
+    root = Path(root)
+    # As harness-status verifies it: an npm-installed package keeps npm's own .bin shims, which are checked.
+    script = "const r=require(process.argv[1]);r.runJson(()=>r.verifyRelease(process.argv[2],{npmInstall:true}));"
+    result = subprocess.run(["node", "-e", script, str(root / "bin/release.js"), str(root)], capture_output=True, text=True, encoding="utf-8")
+    require(result.returncode == 0, f"release verification failed: {root}: {result.stderr.strip()}")
+    try:
+        release = release_ref(json.loads(result.stdout)["data"]["release"])
+    except (KeyError, ValueError, TypeError) as exc:
+        raise HarnessError(f"invalid release verifier result: {root}: {exc}") from exc
+    manifest = read_json(root / "release.json")
+    defaults = file_identity(root / manifest["principles"]["defaults"])
+    return {"schemaVersion": 1, "release": release, "defaults": defaults}
+
+
+def walk_error(error):
+    raise error  # os.walk otherwise silently skips unreadable projection directories.
+
+
+def resolve(skills):
+    """Resolve only this invoking skill's real ancestry; never search another install."""
+    skill = (Path(skills) / "devlyn-ideate").resolve()
+    for parent in (skill, *skill.parents):
+        marker = parent / PROJECTION
+        if marker.exists() or marker.is_symlink():
+            file_identity(marker)
+            projection = read_json(marker)
+            require(isinstance(projection, dict) and set(projection) == {"schemaVersion", "release", "source"}
+                    and type(projection["schemaVersion"]) is int and projection["schemaVersion"] == 1
+                    and projection["source"] == CODEX_SOURCE, f"malformed projection: {marker}")
+            ref = release_ref(projection["release"])
+            binding = verify_release(ref["root"])
+            require(binding["release"] == ref, f"projection release changed: {marker}")
+            source = Path(ref["root"]) / CODEX_SOURCE
+            require(skill == parent / "skills/devlyn-ideate", f"unexpected projection skill: {skill}")
+            expected = {p.relative_to(source) for p in source.rglob("*") if p.is_file()}
+            actual = set()
+            for directory, dirs, files in os.walk(parent, onerror=walk_error):
+                for name in dirs:
+                    require(not (Path(directory) / name).is_symlink(), f"projection directory link: {directory}/{name}")
+                for name in files:
+                    file = Path(directory) / name
+                    if file == marker:
+                        continue
+                    rel = file.relative_to(parent)
+                    actual.add(rel)
+                    require(rel in expected and file_identity(file)["sha256"] == file_identity(source / rel)["sha256"]
+                            and (os.name == "nt" or bool(file.stat().st_mode & 0o111) == bool((source / rel).stat().st_mode & 0o111)),
+                            f"projection resource changed: {file}")
+            require(actual == expected, f"projection file list changed: {parent}")
+            return binding
+        manifest = parent / "release.json"
+        if (manifest.exists() or manifest.is_symlink()) and skill in [parent / p / "devlyn-ideate" for p in
+                ("config/skills", "native/claude/skills", CODEX_SOURCE + "/skills")]:
+            return verify_release(parent)
+    return None
+
+
+def read_binding(common):
+    path = Path(common) / "devlyn-loops/harness.json"
+    if not path.exists() and not path.is_symlink():
+        return None
+    file_identity(path)
+    binding = read_json(path)
+    require(isinstance(binding, dict) and set(binding) == {"schemaVersion", "release", "defaults"}
+            and type(binding["schemaVersion"]) is int and binding["schemaVersion"] == 1, f"incompatible queue binding: {path}")
+    release_ref(binding["release"])
+    resource(binding["defaults"])
+    return binding
+
+
+def resource(value):
+    require(isinstance(value, dict) and set(value) == {"path", "sha256"}
+            and isinstance(value["path"], str) and "\0" not in value["path"] and Path(value["path"]).is_absolute()
+            and isinstance(value["sha256"], str) and re.fullmatch(r"[a-f0-9]{64}", value["sha256"]), "malformed resource binding")
+
+
+def recovery_argv(binding, argv):
+    return [sys.executable, str(Path(binding["release"]["root"]) / "config/skills/devlyn-ideate/scripts/queue.py"), *argv]
+
+
+def check_binding(binding, invoking):
+    if binding is None:
+        return
+    require(invoking is not None and binding["release"] == invoking["release"], "queue-release-mismatch")
+    require(binding == invoking, "queue defaults changed; restore the bound release")
+
+
+def packet_schema(packet):
+    require(isinstance(packet, dict), "task packet must be an object")
+    version = packet.get("schema_version", 1)
+    require(type(version) is int and version in (1, 2), f"incompatible task packet version: {version!r}")
+    if version == 1:
+        return
+    require("harness" in packet and isinstance(packet.get("methodology"), dict), "malformed packet v2 harness/methodology")
+    methodology = packet["methodology"]
+    require(set(methodology) == {"defaults", "projectInstructions"} and isinstance(methodology["projectInstructions"], list),
+            "malformed packet v2 methodology")
+    for entry in methodology["projectInstructions"]:
+        resource(entry)
+    if packet["harness"] is None:
+        defaults = methodology["defaults"]
+        require(packet.get("workerPrompt") is None and (defaults is None or (isinstance(defaults, dict) and defaults.get("source") == "skill")),
+                "legacy packet has release resources")
+        if defaults is not None:
+            resource({k: v for k, v in defaults.items() if k != "source"})
+        return
+    release_ref(packet["harness"])
+    defaults = methodology["defaults"]
+    require(isinstance(defaults, dict) and defaults.get("source") == "release", "packet has no verified release defaults source")
+    resource({k: v for k, v in defaults.items() if k != "source"})
+    resource(packet.get("workerPrompt"))
+
+
+def verify_packet(packet, path, skills):
+    packet_schema(packet)
+    if packet.get("schema_version", 1) == 1:
+        return  # Preserve v1 execution without upgrading its resources.
+    receipt = packet.get("receipt")
+    require(isinstance(receipt, str) and "\0" not in receipt and Path(receipt).is_absolute()
+            and Path(receipt).name == "receipt.json" and Path(receipt).parent.parent.name == "devlyn-completion"
+            and Path(receipt) == Path(path).with_name("receipt.json"),
+            "malformed packet receipt path")
+    binding = read_binding(Path(receipt).parent.parent.parent)
+    if packet["harness"] is None:
+        require(binding is None, "bound task packet has no harness/defaults source")
+        # An unbound installation's own defaults change with its normal updates: never gate acceptance or delivery on
+        # their bytes (queue.py checks only their presence, before a spawn).
+        return
+    require(binding is not None, "packet queue binding is missing; restore harness.json")
+    invoking = resolve(skills)
+    ref = packet["harness"]
+    require(invoking is not None and invoking["release"] == ref,
+            f"packet-release-mismatch; use {Path(ref['root']) / 'config/skills/devlyn-ideate/scripts/queue.py'}")
+    check_binding(binding, invoking)
+    defaults = {"source": "release", **binding["defaults"]}
+    require(packet["methodology"]["defaults"] == defaults, "packet defaults differ from queue binding")
+    expected_runner = [str(Path(ref["root"]) / "config/skills/devlyn-ideate/scripts/acceptance.py"),
+                       "run", "--packet", str(path)]
+    require(isinstance(packet.get("runner"), list) and packet["runner"][1:] == expected_runner, "packet runner differs from bound release")
+    prompt = packet["workerPrompt"]
+    require(prompt["path"] == str(Path(path).parent / "worker-prompt.md") and file_identity(prompt["path"]) == prompt,
+            "worker prompt changed or missing; restore the bound resource")
+    for entry in packet["methodology"]["projectInstructions"]:
+        name = Path(entry["path"]).name
+        require(name in ("CLAUDE.md", "AGENTS.md") and entry["path"] == str(Path(packet["worktree"]) / name),
+                "project instruction path escapes packet worktree")
+        committed = subprocess.run(["git", "-C", packet["worktree"], "cat-file", "blob", f"{packet['inputs_sha']}:{name}"], capture_output=True)
+        require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == entry["sha256"],
+                f"project instruction differs from inputs commit: {name}")

package/config/skills/_shared/task-completion.md

@@ -108,13 +108,16 @@ removes them. Preserve all other work and report anything left behind.
 
 Build in the task worktree's own default build directory, never in one
 another checkout builds in, even one build at a time: tools such as Cargo take
-one checkout's outputs as fresh for the other. When a Cargo workspace's
+one checkout's outputs as fresh for the other. When the shared repository-local
+Git config `devlyn.warmBuildDirs` is true, or it is unset and the Cargo workspace's
 Cargo.toml sets `[workspace.metadata.devlyn] warm-build-dirs = true`,
 allocation seeds that directory from a built checkout of the repository, so
 the first build does not rebuild every dependency; `build_dirs` in its result
 and receipt says what it did, and a skip means an ordinary cold build. The
-opt-in is the workspace's: seeding keeps dependency outputs that may hold the
-other checkout's paths, and those follow that checkout's later rebuilds. `warm-build-dirs.py <worktree>` does the same for a
+Git setting takes precedence on this machine: false disables and invalid values
+skip; global, system, include and per-worktree values are not consulted. Seeding
+keeps dependency outputs that may hold the other checkout's paths, and those
+follow that checkout's later rebuilds. `warm-build-dirs.py <worktree>` does the same for a
 worktree made without allocation. A warmed directory leaves with the worktree
 after merge, so a pending, failed or local-only task keeps it.
 

package/config/skills/_shared/warm-build-dirs.py

@@ -31,6 +31,9 @@ a crate that compiled a path in where the reading above does not see it) still n
 donor's files: when the donor rebuilds or removes them, the recipient can change behavior
 without a warning. That is why a workspace opts in, with `[workspace.metadata.devlyn]
 warm-build-dirs = true` in its Cargo.toml, once its dependencies do not use such paths.
+The repository's shared local Git config `devlyn.warmBuildDirs` overrides that opt-in on
+this machine: true enables, false disables, unset uses Cargo.toml, and invalid values skip.
+Global, system, include and per-worktree config values are not consulted.
 
 The donor is only read: its dev build lock is taken from an existing lock file opened read-only,
 without waiting, while the layouts are cloned. The whole operation has a time limit. Every skip
@@ -89,6 +92,14 @@ class Skip(Exception):
     """An expected reason not to warm; the build starts cold."""
 
 
+class CommandFailed(Skip):
+    """A command failed; retain its exit code and diagnostics for callers."""
+
+    def __init__(self, argv, result):
+        self.result = result
+        super().__init__(f"{' '.join(map(str, argv[:3]))} failed: {(result.stderr or result.stdout).strip()[-400:]}")
+
+
 class Unsafe(Exception):
     """A safety check failed; nothing was published and the donor was not written."""
 
@@ -120,7 +131,7 @@ def run(argv, *, cwd, deadline, env=None):
     except subprocess.TimeoutExpired as exc:
         raise TimeUp(f"{' '.join(map(str, argv[:3]))} timed out") from exc
     if result.returncode != 0:
-        raise Skip(f"{' '.join(map(str, argv[:3]))} failed: {(result.stderr or result.stdout).strip()[-400:]}")
+        raise CommandFailed(argv, result)
     return result.stdout
 
 
@@ -166,7 +177,19 @@ def no_symlink_between(root, path):
 def destination(work, deadline, stack):
     """The worktree's own Cargo target directory and a descriptor for its parent, when it can be warmed."""
     found = metadata(work, deadline)
-    if ((found.get("metadata") or {}).get("devlyn") or {}).get("warm-build-dirs") is not True:
+    setting = "git config --local devlyn.warmBuildDirs"
+    try:
+        enabled = git(work, "config", "--local", "--type=bool", "--get", "devlyn.warmBuildDirs", deadline=deadline)
+    except CommandFailed as exc:
+        if exc.result.returncode != 1:
+            error = (exc.result.stderr or exc.result.stdout or str(exc)).splitlines()[0]
+            raise Skip(f"cannot read {setting}: {error}") from exc
+        enabled = None
+    except OSError as exc:
+        raise Skip(f"cannot read {setting}: {exc}") from exc
+    if enabled == "false":
+        raise Skip(f"turned off: {setting} is false")
+    if enabled != "true" and ((found.get("metadata") or {}).get("devlyn") or {}).get("warm-build-dirs") is not True:
         raise Skip("not enabled: the workspace's Cargo.toml has no [workspace.metadata.devlyn] warm-build-dirs = true")
     if any(key in os.environ for key in REDIRECTS) and metadata(work, deadline, env=without_redirects()) != found:
         raise Skip("the target directory comes from this environment, which later commands may not share")
@@ -799,6 +822,78 @@ class WarmTests(unittest.TestCase):
         self.assertEqual([], list(self.staging.iterdir()))
         self.assertEqual("", self.git(self.work, "status", "--porcelain", "--untracked-files=all"))
 
+    @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
+    def test_local_git_true_seeds_without_cargo_opt_in(self):
+        self.write_fixture(workspace_metadata=None)
+        self.git(self.anchor, "config", "--local", "devlyn.warmBuildDirs", "true")
+        [result] = self.warm()
+        self.assertEqual("seeded", result["status"], result)
+        self.assertTrue((self.work / "target" / "debug" / "deps" / f"libserde-{'1' * 16}.rlib").is_file())
+        self.assert_nothing_left()
+
+    @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
+    def test_local_git_false_overrides_cargo_opt_in(self):
+        self.git(self.anchor, "config", "--local", "devlyn.warmBuildDirs", "false")
+        [result] = self.warm()
+        self.assertEqual("skipped", result["status"], result)
+        self.assertEqual("turned off: git config --local devlyn.warmBuildDirs is false", result["reason"])
+        self.assertFalse((self.work / "target").exists())
+        self.assert_nothing_left()
+
+    @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
+    def test_invalid_local_git_value_skips_with_git_error(self):
+        self.git(self.anchor, "config", "--local", "devlyn.warmBuildDirs", "invalid")
+        [result] = self.warm()
+        self.assertEqual("skipped", result["status"], result)
+        self.assertIn("git config --local devlyn.warmBuildDirs", result["reason"])
+        self.assertIn("fatal: bad boolean config value 'invalid' for 'devlyn.warmbuilddirs'", result["reason"])
+        self.assertFalse((self.work / "target").exists())
+        self.assert_nothing_left()
+
+    @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
+    def test_unset_local_git_value_uses_cargo_opt_in(self):
+        for opted_in in (False, True):
+            with self.subTest(opted_in=opted_in):
+                self.write_fixture(workspace_metadata={"devlyn": {"warm-build-dirs": opted_in}})
+                [result] = self.warm()
+                self.assertEqual("seeded" if opted_in else "skipped", result["status"], result)
+                if not opted_in:
+                    self.assertIn("not enabled", result["reason"])
+                self.assert_nothing_left()
+
+    @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
+    def test_other_git_config_failures_skip_with_first_error_line(self):
+        config = self.anchor / ".git" / "config"
+        config.write_text(config.read_text() + "\n[broken\nsecond bad line\n")
+        error = subprocess.run(["git", "-C", str(self.work), "config", "--local", "--type=bool",
+                                "--get", "devlyn.warmBuildDirs"], capture_output=True, text=True)
+        self.assertNotIn(error.returncode, (0, 1))
+        [result] = self.warm()
+        self.assertEqual("skipped", result["status"], result)
+        self.assertEqual(f"cannot read git config --local devlyn.warmBuildDirs: {error.stderr.splitlines()[0]}",
+                         result["reason"])
+        self.assertFalse((self.work / "target").exists())
+        self.assertEqual([], list(self.staging.iterdir()))
+
+    @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
+    def test_global_include_and_per_worktree_config_do_not_override_cargo(self):
+        global_config, included = self.root / "global-config", self.root / "included-config"
+        os.environ["GIT_CONFIG_GLOBAL"] = str(global_config)
+        self.git(self.anchor, "config", "--local", "include.path", str(included))
+        self.git(self.anchor, "config", "--local", "extensions.worktreeConfig", "true")
+        for opted_in in (False, True):
+            with self.subTest(opted_in=opted_in):
+                value = "false" if opted_in else "true"
+                for config in (global_config, included):
+                    config.write_text(f"[devlyn]\n\twarmBuildDirs = {value}\n")
+                self.git(self.work, "config", "--worktree", "devlyn.warmBuildDirs", value)
+                self.write_fixture(workspace_metadata={"devlyn": {"warm-build-dirs": opted_in}})
+                [result] = self.warm()
+                self.assertEqual("seeded" if opted_in else "skipped", result["status"], result)
+                if not opted_in:
+                    self.assertIn("not enabled", result["reason"])
+                self.assert_nothing_left()
+
     @unittest.skipIf(os.name == "nt", "warming is POSIX-only")
     def test_seeds_only_what_carries_over_and_never_writes_the_donor(self):
         before = self.snapshot(self.donor)

package/config/skills/devlyn-ideate/SKILL.md

@@ -94,10 +94,14 @@ A removed flag stops with its instruction and selects no other behavior.
 
 An absolute path to a package's `meta.md` is added as it is; anything else is planned first. Add with `python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" add '<absolute meta.md>'`, the only writer of a loop's queue file `docs/specs/<loop-id>/queue.md`; never edit one by hand. In every delivery mode add makes no commit on the checked-out branch and leaves the branch, the index and tracked files as they are: it holds the package and its rows at `refs/devlyn/captures/<loop-id>`, records the add and removes the package copies equal to that capture. Report the capture ref and its `git show` command, any `cleanup` entry, and that a revision needs a new loop id. A retry of the same add reports it as added, also once the copies are gone. Tasks start from committed state, a local loop from the branch it was added on and `auto`/`pr` from the remote base, so commit, and for `auto`/`pr` push, whatever the plan depends on. A pending legacy raw-intent row of `docs/specs/queue.md` is replaced in place by a package whose `## Intent` reproduces the row verbatim, added with `--materialize <line>`.
 
+Release-backed queues retain their verified release in `<git-common-dir>/devlyn-loops/harness.json` until all tasks, recovery and delivery settle. A different release refuses with the exact recovery argv; use it. Existing unfinished unbound queues and standalone installations remain legacy.
+
 ## status
 
 Run `python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" status --repo .` and report its counts, `next`, `blockers`, `warnings`, pending deliveries with their resume commands and any `cleanup` entry.
 
+For read-only consumers, `python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" inspect --repo . --json` returns the status summary plus `binding` and `compatibility`, without cleanup, locks or writes.
+
 ## drain
 
 `status`, `add` and `drain` write the repository's Git directory, and auto/pr delivery needs network access, so a sandboxed host runs them with escalation or full access.
@@ -112,7 +116,7 @@ Follow [loop.md](references/loop.md). The executor is the configured route, the
 Another engine needs an argv that starts one fresh non-interactive session able, without prompts, to edit, run commands and commit in its task worktree and to write the packet's submission file. `<prompt>` carries the absolute binding values, while `{packet}` stays literal for the drain to fill:
 
 ```text
-Execute the devlyn loop task packet {packet}: work only in its owned worktree under the installed instructions; meet its obligations, then write its submission and any review records as "Executor exchange" and "Review records" in <DEVLYN_SKILL_DIR>/references/loop.md specify. Set DEVLYN_SKILL_DIR=<DEVLYN_SKILL_DIR> and DEVLYN_SHARED_DIR=<DEVLYN_SHARED_DIR> from these literal values, never from your inherited environment. Never push, open a pull request or merge: the drain delivers.
+Execute the devlyn loop task packet {packet}: read its workerPrompt when present; read methodology.defaults.path when named and apply those verified defaults, with explicit user and native owner/project instructions taking precedence; work only in its owned worktree under the installed instructions; meet its obligations, then write its submission and any review records as "Executor exchange" and "Review records" in <DEVLYN_SKILL_DIR>/references/loop.md specify. Use the literal DEVLYN_SKILL_DIR and DEVLYN_SHARED_DIR bindings in workerPrompt when present; otherwise set DEVLYN_SKILL_DIR=<DEVLYN_SKILL_DIR> and DEVLYN_SHARED_DIR=<DEVLYN_SHARED_DIR> from these literal values. Never use inherited environment values. Never push, open a pull request or merge: the drain delivers.
 ```
 
 ```sh

package/config/skills/devlyn-ideate/references/loop.md

@@ -28,7 +28,7 @@ The host supplies the executor and maps its configured engine to the argv; the l
    - Local: the first task uses `--local-base <HEAD of the branch the loop was added on>`, the add record's branch, never whichever branch is checked out; that HEAD must descend from the manifest `base_sha`, or the task waits naming it. Instructions committed there before this first allocation are therefore used. Its receipt keeps that start, and a later task with no accepted predecessor reuses it, also after the first task failed; a fixed start is never recalculated. Later tasks use `--from-receipt <latest accepted receipt of the loop>`, which starts from that receipt's exact `source_sha`, never its terminal commit, current HEAD or workspace. Every prerequisite's accepted source must be an ancestor of that frontier; divergent dependencies need a planned integration task, because the driver never merges. A failure leaves the frontier unchanged.
    - `auto`/`pr`: `--start` the refreshed remote base, never an anchor-local commit, so no unpushed anchor commit reaches a task PR; push whatever the plan depends on. A task allocated while that base lacks `docs/specs/<loop-id>/` is the loop's carrier; a carrier that fails is never published, and the next task allocated becomes the carrier. The start must contain each prerequisite's merge commit, checked before allocation and again before every execution or resume. A squash merge needs no original-source ancestry. A refresh failure waits for restored remote access or the base ref. A missing merge before allocation waits for that merge to be restored on the remote base; an allocated baseline is immutable and needs a new loop or verified recovery of a never-executed allocation.
 4. **Commit scoped inputs** on the owned branch before any executor write, only what the allocation base lacks. A base without `docs/specs/<loop-id>/` gets the package directory from the capture with the loop's queue file, its settled rows keeping their marks (receipt-proven `[x]` and `[F]`, prerequisite-blocked `[F]`): a local loop's first task, or an `auto`/`pr` carrier, whose PR lands the package before tasks diverge. Otherwise a local task commits the base's queue file with the loop's receipt-proven terminal rows (typically a predecessor's `[x]`), every other byte unchanged, and an `auto`/`pr` task commits nothing, so its PR changes only its own row and its product. A base that already carries them gets no inputs commit; unrelated product commits stay out.
-5. **Exchange one packet.** Write `<receipt dir>/packet.json`, then run the executor. An executor that exits without writing its submission leaves its task active, waiting with the exit code and `executor.stderr`, and the next drain runs it again; one that cannot start keeps its allocation, packet and durable start/not-started log, waits for executable, permissions or workspace repair, and retries on the next drain.
+5. **Exchange one packet.** Verify the bound release, defaults, packet and worker prompt before execution or recovery; changed or missing resources refuse dispatch. Write `<receipt dir>/packet.json`, then run the executor. An executor that exits without writing its submission leaves its task active, waiting with the exit code and `executor.stderr`, and the next drain runs it again; one that cannot start keeps its allocation, packet and durable start/not-started log, waits for executable, permissions or workspace repair, and retries on the next drain.
 6. **Derive acceptance** with `acceptance.py accept`. It binds the committed contract to the packet digests; requires the candidate to be the owned branch head with HEAD checked out on that branch, to descend from the inputs, to leave the package (its queue file included) and `docs/specs/queue.md` untouched and to have a clean worktree; executes each declared command on that source, recording raw stdout/stderr and exit, timeout or spawn outcomes (a runner result is reused only when it is wholly clean — no reasons, so no failed check and no source change during its checks — for the same source and contract digests, with unchanged streams); evaluates the file and diff guards against the inputs; confirms the source is unchanged; checks review records; and writes `.devlyn/loop/acceptance.json`. Missing checks, missing review coverage and open binding findings cannot produce `[x]`, and acceptance weakening is not repair. This establishes command outcomes and evidence completeness, not a reviewer's semantic judgment; deliberate evidence forgery is outside the trust model.
 7. **Bind before terminal metadata.** `task-complete.py accept --receipt <receipt> --acceptance <worktree>/.devlyn/loop/acceptance.json` takes evidence custody and points the recovery ref at the source. Failed results are bound the same way; they never become a frontier or a publishable product.
 8. **Commit the terminal transition** under the queue lock: one commit whose sole parent is the bound source and whose only change is this task's row in `docs/specs/<loop-id>/queue.md` (`[x]`, or `[F] — <first reason> (receipt <id>)`), validated as the only legal transition. Then `task-complete.py attach --receipt <receipt> --commit <terminal> --file docs/specs/<loop-id>/queue.md` records it separately from the source and moves the recovery ref to it.
@@ -53,6 +53,14 @@ Expected task-local operational failures leave the selected task waiting with `<
 
 Package cleanup, parent pruning and report failures appear as diagnostics under `cleanup`, with retained paths and repair guidance; they do not change product acceptance or completed delivery. The next drain retries them.
 
+## Release binding and read-only consumers
+
+`<git-common-dir>/devlyn-loops/harness.json` is authoritative across linked worktrees: `{schemaVersion: 1, release: {package, version, digest, root}, defaults: {path, sha256}}`. Paths are absolute and hashes cover exact bytes. The queue lock covers binding before the first capture. An interrupted first add, unfinished tasks, recovery conflicts and pending delivery retain it; settlement removes it. A different release refuses with `recovery argv` as a JSON argv array, preserving the caller’s arguments. No caller substitutes another implementation.
+
+`queue.py inspect --repo <dir> --json` reads without cleanup, locks or writes. It returns the status summary plus `binding` (null for legacy) and `compatibility`: `compatible`, `legacy`, `reasons`, `recoveryArgv`, `taskPacket` ranges and `queueBinding` ranges. Incompatible or unreadable state is reported, never migrated. Apps should use this reader instead of `status`, which still reconciles cleanup. For a mismatch, `recoveryArgv` names the bound queue’s inspect invocation; use the same bound queue entry point for authorized add/drain operations.
+
+Codex projection writers place `.devlyn-harness-projection.json` at the copied plugin root, beside `skills` and `.codex-plugin`: `{schemaVersion: 1, release: <ReleaseRef>, source: "native/codex/plugins/devlyn"}`. The reader verifies the named release and every projected file’s bytes/mode against that subtree (excluding only the marker). Symlinked skill invocations resolve through their real path. Standalone installs and existing unfinished unbound queues retain legacy behavior; new legacy packets use v2 with a null release, and their `defaults` name the invoking installation's own `_shared/runtime-principles.md` (`source: "skill"`). No engine applicability is inferred from instruction filenames: bound queues use verified release defaults with native instructions taking precedence. Worker and runner paths point to the bound release, independent of a projection cache’s lifetime.
+
 ## Executor exchange
 
 The packet (`<receipt dir>/packet.json`) carries everything a fresh executor needs:
@@ -66,7 +74,9 @@ The packet (`<receipt dir>/packet.json`) carries everything a fresh executor nee
 | `requirements`, `review_requirements` | Requirement IDs and those needing review evidence. |
 | `shared_constraints` | The meta-prompt's `Constraints and exclusions`. |
 | `dependencies` | `{task, receipt, source_sha}` of each accepted prerequisite. |
-| `methodology` | `{path, sha256}` of the installed instruction files at the inputs commit. |
+| `schema_version`, `harness` | New packets use version 2 and the bound release reference, or null for legacy unbound queues. Existing v1 packets execute unchanged. |
+| `methodology` | `projectInstructions`: `{path, sha256}` of instruction bytes at the inputs commit. `defaults`: `{source: "release", path, sha256}` from the verified binding; for an unbound queue `{source: "skill", path, sha256}` of the installation's own `_shared/runtime-principles.md`. A task whose executor would get no principles at all (no defaults and no committed CLAUDE.md/AGENTS.md) waits with that reason instead of running. Read the named defaults; explicit user and native owner/project instructions take precedence. No native engine applicability is inferred from filenames. |
+| `workerPrompt` | `{path, sha256}` of the task’s worker instructions, or null for legacy unbound queues. Read it before working. |
 | `delivery` | `local-only`, `auto` or `pr`. |
 | `evidence_dir`, `runner` | Where loop evidence lives (`<worktree>/.devlyn/loop`, ignored by Git) and the runner argv. |
 | `submission`, `obligations` | Where to write the submission, and the completion obligations. |

package/config/skills/devlyn-ideate/references/plan-add.md

@@ -0,0 +1,12 @@
+# Planning and capture only
+
+This reference grants plan and add operations only. Never drain, implement, run an executor or deliver code from this planning session.
+
+Resolve this reference’s actual containing skill directory (the parent of `references`), resolving symlinks; bind it as `DEVLYN_SKILL_DIR`. Resolve its sibling `_shared` as `DEVLYN_SHARED_DIR`. Verify the loaded files; missing or conflicting source identity is `BLOCKED:skill-source-unresolved`. Never substitute another installation or inherited environment values.
+
+1. Inspect project facts and follow [elicitation.md](elicitation.md). Ask only when the unresolved answer changes authorized behavior, scope, data semantics, acceptance or delivery. Existing authorization remains effective. Under autonomous planning, use conventional, reversible defaults for ordinary details and record each assumption; material ambiguity stops affected work as needs-review with a concrete question. Independent authorized planning may continue.
+2. Write `docs/specs/<loop-id>/meta.md` and self-contained task contracts per [package-format.md](package-format.md). Preserve an input document unchanged and carry every substantive requirement into the package. Use this execution policy in the package: for ordinary details within authorized scope, follow established project conventions, otherwise the narrowest literal or conventional reading consistent with the request; choices must be low-consequence and reversible, recorded with their reasons. Material ambiguity means competing intended outcomes, unresolved persistent data/state semantics or public surface beyond the request; stop affected work as needs-review with a concrete question. Independent authorized work may continue. Never omit requested work or weaken acceptance. Set delivery from explicit restrictions or the project completion policy; without one GitHub origin, record local-only as an assumption, or ask when the user explicitly requested a PR/merge.
+3. Run `python3 "<DEVLYN_SKILL_DIR>/scripts/queue.py" check '<absolute meta.md>'` and repair until `VALID`. Plan stops here: report the path, tasks, dependencies and assumptions.
+4. When add is authorized, run `python3 "<DEVLYN_SKILL_DIR>/scripts/queue.py" add '<absolute meta.md>'`. It alone writes queue state, captures without committing on the checked-out branch and removes matching untracked package copies. Report the capture ref, its `git show` command and cleanup diagnostics. Revisions need a new loop id. A legacy pending row is materialized with `--materialize <line>` and its verbatim intent in the package.
+
+Report capture and stop. A separate authorized execution session owns drain.

package/config/skills/devlyn-ideate/scripts/acceptance.py

@@ -89,6 +89,11 @@ def load_packet(path):
     packet = read_json(path)
     if not isinstance(packet, dict) or PACKET_KEYS - set(packet):
         raise AcceptanceError(f"{path}: task packet lacks {sorted(PACKET_KEYS - set(packet if isinstance(packet, dict) else {}))}")
+    helper = shared("harness-store")
+    try:
+        helper["verify_packet"](packet, path, SKILLS)
+    except (helper["HarnessError"], OSError) as exc:
+        raise AcceptanceError(str(exc)) from exc
     return packet