dw-kit 1.9.2 → 1.10.0

package/src/lib/board-data.mjs

@@ -25,8 +25,10 @@
 
 import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
 import { join, basename } from 'node:path';
-import yaml from 'js-yaml';
 import { listSessions } from './session-store.mjs';
+import { readClaim } from './goal-driver.mjs';
+import { computeGoalProgress } from './goal-progress.mjs';
+import { parseSubtasks, readFrontmatter, listTaskDirs } from './task-md-utils.mjs';
 
 const GOALS_INDEX_PATH = '.dw/goals/goals-index.json';
 const GOALS_DIR = '.dw/goals';
@@ -42,62 +44,9 @@ function safeReadGoalsIndex(rootDir) {
   try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return { goals: {} }; }
 }
 
-// Extract frontmatter (between --- markers) from a markdown file. Returns
-// an object via js-yaml, or {} if absent / malformed.
-function readFrontmatter(file) {
-  if (!existsSync(file)) return {};
-  let txt;
-  try { txt = readFileSync(file, 'utf8'); } catch { return {}; }
-  const m = txt.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (!m) return {};
-  try { return yaml.load(m[1]) || {}; } catch { return {}; }
-}
-
-// Section 3 Subtask Tracker parser. Matches the `| ST-N | title | status | date | notes |`
-// row pattern used across the repo. Returns an array of subtask rows.
-const STATUS_ICONS = {
-  '⬜': 'pending',
-  '🟡': 'in_progress',
-  '✅': 'done',
-  '🔴': 'blocked',
-  '⏸': 'paused',
-};
-function parseSubtasks(taskPath) {
-  if (!existsSync(taskPath)) return [];
-  let txt;
-  try { txt = readFileSync(taskPath, 'utf8'); } catch { return []; }
-  const sec = txt.match(/^## 3\.[^\n]*\n([\s\S]*?)(?=^## 4\.|$(?![\s\S]))/m);
-  if (!sec) return [];
-  const out = [];
-  for (const line of sec[1].split('\n')) {
-    // | ST-1 | "Subtask title" | ✅ Done | 2026-05-25 | notes |
-    const m = line.match(/^\|\s*(ST-[\w.-]+)\s*\|\s*(.+?)\s*\|\s*([⬜🟡✅🔴⏸])\s*([A-Za-z ]+)?\s*\|\s*([^|]*)\|\s*([^|]*)\|/);
-    if (!m) continue;
-    const icon = m[3];
-    const statusBucket = STATUS_ICONS[icon] || 'unknown';
-    const statusLabel = (m[4] || '').trim();
-    out.push({
-      st_id: m[1].trim(),
-      title: m[2].replace(/`/g, '').trim(),
-      status_bucket: statusBucket,
-      status_icon: icon,
-      status_label: statusLabel,
-      date: m[5].trim(),
-      notes: m[6].trim().slice(0, 160),
-    });
-  }
-  return out;
-}
-
-function listTaskDirs(rootDir) {
-  const dir = join(rootDir, TASKS_DIR);
-  if (!existsSync(dir)) return [];
-  return readdirSync(dir)
-    .filter((entry) => {
-      if (entry.startsWith('.') || entry === 'archive') return false;
-      try { return statSync(join(dir, entry)).isDirectory(); } catch { return false; }
-    });
-}
+// Parsers (parseSubtasks / readFrontmatter / listTaskDirs) live in
+// task-md-utils.mjs so goal-progress.mjs can share them without forming a
+// circular import via board-data.mjs.
 
 // ─ Public API ──────────────────────────────────────────────────────────────
 
@@ -145,6 +94,10 @@ export function buildBoardData(rootDir, opts = {}) {
   for (const [goal_id, g] of goalsIndexEntries) {
     if (g.archived_at) continue; // hide archived
     const tasks = (byGoal.get(goal_id) || []).slice(0, MAX_TASKS_PER_GOAL);
+    // goal-driver-mvp ST-6: attach live claim state (or null) so the board
+    // UI can render "Running…" disabled state on the Start button without
+    // a second roundtrip. readClaim auto-expires stale entries.
+    const claim = readClaim(goal_id, rootDir);
     goals.push({
       goal_id,
       title: g.title || goal_id,
@@ -157,6 +110,18 @@ export function buildBoardData(rootDir, opts = {}) {
       last_updated: g.last_updated || null,
       linked_task_ids: g.linked_task_ids || [],
       tasks,
+      claim: claim ? {
+        claim_id: claim.claim_id,
+        session_id: claim.session_id || null,
+        claimed_at: claim.claimed_at,
+        expires_at: claim.expires_at,
+        max_iterations: claim.max_iterations,
+        max_minutes: claim.max_minutes,
+        // ST-7 (goal-driver-mvp v2): live progress derived from the linked
+        // task.md Section 3 + last goal_driver_* event timestamp. null when
+        // no linked task is wired up.
+        progress: claim ? computeGoalProgress(goal_id, rootDir) : null,
+      } : null,
     });
   }
 
@@ -197,6 +162,7 @@ export function buildBoardData(rootDir, opts = {}) {
     subtasks_blocked: 0,
     sessions_running: sessions.filter((s) => s.status === 'running').length,
     sessions_total: sessions.length,
+    goals_driving: goals.filter((g) => g.claim).length,
   };
   for (const t of allTasks) {
     for (const st of t.subtasks) {

package/src/lib/config.mjs

@@ -61,6 +61,15 @@ export function buildConfig({ projectName, language, depth, roles }) {
     },
     workflow: {
       default_depth: depth,
+      // Trust Mode (ADR-0022) — opt-in gate auto-approval. Off by default;
+      // present so the shape is discoverable. Guards + Critical findings are
+      // never relaxed regardless of these flags.
+      trust: {
+        enabled: false,
+        auto_approve: { scope: false, plan: false, changes: false },
+        max_auto_subtasks: 0,
+        require_evidence: false,
+      },
     },
     team: {
       roles: roles,
@@ -103,6 +112,53 @@ export function getToolkitVersions(config) {
   };
 }
 
+// Named trust profiles (ADR-0023 follow-up) — a profile is a bundle of defaults
+// answering "what does this run's trust posture look like?" Explicit keys still
+// override the profile, so it's purely a convenience layer.
+export const TRUST_PROFILES = {
+  // Vibe-coder overnight default: trust all convenience gates, bounded, and
+  // require evidence on GATE D so the unattended changes-approval is backed by
+  // a real test/review basis (safe path = easy path for the overnight audience).
+  'solo-night': { enabled: true, auto_approve: { scope: true, plan: true, changes: true }, max_auto_subtasks: 8, require_evidence: true },
+  // Team velocity without waiving diff review: plan auto, every diff still human.
+  'reviewed-team': { enabled: true, auto_approve: { scope: true, plan: true, changes: false }, max_auto_subtasks: 4 },
+};
+
+/**
+ * Trust Mode config for `dw:flow` gate auto-approval (ADR-0022).
+ * Off by default and back-compat: absent keys → fully manual gates, i.e.
+ * byte-for-byte today's behaviour. A `profile` supplies defaults that explicit
+ * keys override. Falls back to safe defaults so older config keeps working.
+ */
+export function getTrustConfig(config) {
+  const t = config?.workflow?.trust || {};
+  const profile = t.profile && TRUST_PROFILES[t.profile] ? t.profile : null;
+  const base = profile ? TRUST_PROFILES[profile] : { enabled: false, auto_approve: {}, max_auto_subtasks: 0 };
+  const a = t.auto_approve || {};
+  const baseA = base.auto_approve || {};
+  // explicit `enabled` wins; else the profile's; else off.
+  const enabled = t.enabled !== undefined ? t.enabled === true : base.enabled === true;
+  // explicit gate key wins; else the profile's; else off. Honoured only when enabled.
+  const gate = (key) => enabled && (a[key] !== undefined ? a[key] === true : baseA[key] === true);
+  return {
+    enabled,
+    profile,
+    auto_approve: {
+      scope: gate('scope'), // GATE A / Q1
+      plan: gate('plan'), // GATE C
+      changes: gate('changes'), // GATE D (never when Critical)
+    },
+    // 0 = unbounded once enabled; >0 caps an unattended run's length.
+    max_auto_subtasks: Number.isInteger(t.max_auto_subtasks) && t.max_auto_subtasks > 0
+      ? t.max_auto_subtasks
+      : (base.max_auto_subtasks || 0),
+    // When true, GATE D refuses to auto-approve without an --evidence object —
+    // makes the safe (evidence-backed) outcome the default for `changes`.
+    // Explicit key wins; else the profile's default; else off.
+    require_evidence: t.require_evidence !== undefined ? t.require_evidence === true : base.require_evidence === true,
+  };
+}
+
 /**
  * Renderer config for /dw:review --visual + `dw review render` (ADR-0007).
  * Falls back to defaults when keys are absent so existing projects work

package/src/lib/event-schema.mjs

@@ -205,6 +205,34 @@ export const EVENT_CATALOGUE = {
     required: { goal_id: 'string', task_id: 'string' },
     optional: {},
   },
+
+  // §5.6 Trust Mode & Overnight Autopilot (ADR-0022/0023) — written to
+  // events-global.jsonl; consumed by the morning digest (overnight-digest@v1).
+  gate_auto_approved: {
+    category: 'trust-autopilot',
+    required: { gate: 'string', actor: 'string' },
+    optional: { task: 'any', reason: 'any', evidence: 'any' },
+  },
+  subtask_completed: {
+    category: 'trust-autopilot',
+    required: { subtask: 'string' },
+    optional: { commit: 'string', summary: 'string' },
+  },
+  parked: {
+    category: 'trust-autopilot',
+    required: { item: 'string', question: 'string' },
+    optional: { options: 'string[]' },
+  },
+  hard_stop: {
+    category: 'trust-autopilot',
+    required: { reason: 'string' },
+    optional: { gate: 'string', blocker: 'string' },
+  },
+  overnight_wrapup: {
+    category: 'trust-autopilot',
+    required: { stop_reason: 'string' },
+    optional: {},
+  },
 };
 
 export const KNOWN_EVENTS = Object.freeze(Object.keys(EVENT_CATALOGUE));

package/src/lib/goal-driver.mjs

@@ -0,0 +1,312 @@
+// goal-driver.mjs — per-goal "Start" primitive for the /board Kanban page.
+//
+// Three responsibilities (pure, no spawn — that lives in voice-action.mjs):
+//
+//   1. Claim file (atomic file lock) so two Start clicks on the same goal
+//      can't race spawning two driver sessions.
+//   2. Meta-prompt builder that wraps the existing F-43 workflow into a
+//      bounded autonomous loop the spawned claude --print can iterate over.
+//   3. Budget parser with defaults + clamps, so callers can't request a
+//      runaway 12-hour driver.
+//
+// Per ADR-0001: zero-dep. Per memory `feedback_build_over_depend`: no new
+// 3rd-party deps.
+
+import {
+  existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, readdirSync,
+} from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+
+const CLAIM_DIR_RELATIVE = '.dw/cache/goal-claims';
+
+const BUDGET_DEFAULT_ITERATIONS = 8;
+const BUDGET_DEFAULT_MINUTES = 25;
+const BUDGET_MAX_ITERATIONS = 20;
+const BUDGET_MAX_MINUTES = 60;
+const BUDGET_MIN_ITERATIONS = 1;
+const BUDGET_MIN_MINUTES = 1;
+
+const GOAL_ID_PATTERN = /^G-[A-Za-z0-9_-]{1,64}$/;
+
+// ─ Paths ───────────────────────────────────────────────────────────────────
+
+function claimDir(rootDir) {
+  return join(rootDir, CLAIM_DIR_RELATIVE);
+}
+
+function claimPath(goalId, rootDir) {
+  return join(claimDir(rootDir), `${goalId}.json`);
+}
+
+// ─ Budget ──────────────────────────────────────────────────────────────────
+
+export function parseBudget(opts = {}) {
+  const rawIter = Number(opts.max_iterations ?? opts.maxIterations);
+  const rawMin = Number(opts.max_minutes ?? opts.maxMinutes);
+  const maxIterations = Number.isFinite(rawIter) && rawIter > 0
+    ? Math.max(BUDGET_MIN_ITERATIONS, Math.min(BUDGET_MAX_ITERATIONS, Math.floor(rawIter)))
+    : BUDGET_DEFAULT_ITERATIONS;
+  const maxMinutes = Number.isFinite(rawMin) && rawMin > 0
+    ? Math.max(BUDGET_MIN_MINUTES, Math.min(BUDGET_MAX_MINUTES, Math.floor(rawMin)))
+    : BUDGET_DEFAULT_MINUTES;
+  return { maxIterations, maxMinutes };
+}
+
+// ─ Claim primitive ─────────────────────────────────────────────────────────
+
+function ensureClaimDir(rootDir) {
+  const dir = claimDir(rootDir);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+}
+
+function nowIso() {
+  return new Date().toISOString().replace(/\.\d+Z$/, 'Z');
+}
+
+function newClaimId() {
+  return `gc-${randomBytes(6).toString('hex')}`;
+}
+
+/**
+ * Read a claim, auto-expire if `expires_at < now`.
+ * Returns the claim object, or null when absent / unreadable / expired.
+ */
+export function readClaim(goalId, rootDir = process.cwd()) {
+  if (!GOAL_ID_PATTERN.test(goalId)) return null;
+  const p = claimPath(goalId, rootDir);
+  if (!existsSync(p)) return null;
+  let claim;
+  try { claim = JSON.parse(readFileSync(p, 'utf8')); }
+  catch { return null; }
+  if (typeof claim !== 'object' || claim === null) return null;
+  if (typeof claim.expires_at === 'string') {
+    const expMs = Date.parse(claim.expires_at);
+    if (Number.isFinite(expMs) && expMs <= Date.now()) {
+      try { rmSync(p, { force: true }); } catch { /* best-effort */ }
+      return null;
+    }
+  }
+  return claim;
+}
+
+/**
+ * Atomically claim a goal. Uses `writeFileSync(..., { flag: 'wx' })` so two
+ * concurrent callers can't both succeed; the loser gets EEXIST and returns
+ * `already_claimed`.
+ *
+ * If an existing claim is expired (`expires_at < now`), it is replaced.
+ *
+ * @returns {{ok:true,claim:Object} | {ok:false,reason:string,existing?:Object}}
+ */
+export function claimGoal(goalId, sessionId, opts = {}, rootDir = process.cwd()) {
+  if (!GOAL_ID_PATTERN.test(goalId)) {
+    return { ok: false, reason: 'invalid_goal_id' };
+  }
+  ensureClaimDir(rootDir);
+  const { maxIterations, maxMinutes } = parseBudget(opts);
+  const now = Date.now();
+  const claim = {
+    schema_version: 'claim@v1',
+    claim_id: newClaimId(),
+    goal_id: goalId,
+    session_id: sessionId || null,
+    claimed_at: nowIso(),
+    expires_at: new Date(now + maxMinutes * 60_000).toISOString().replace(/\.\d+Z$/, 'Z'),
+    max_iterations: maxIterations,
+    max_minutes: maxMinutes,
+    lang: opts.lang === 'vi' ? 'vi' : 'en',
+  };
+  const p = claimPath(goalId, rootDir);
+  const payload = JSON.stringify(claim, null, 2) + '\n';
+  try {
+    writeFileSync(p, payload, { flag: 'wx', encoding: 'utf8' });
+    return { ok: true, claim };
+  } catch (err) {
+    if (err && err.code === 'EEXIST') {
+      const existing = readClaim(goalId, rootDir);
+      if (!existing) {
+        // The existing file was expired (readClaim deleted it) — retry once.
+        try {
+          writeFileSync(p, payload, { flag: 'wx', encoding: 'utf8' });
+          return { ok: true, claim };
+        } catch (err2) {
+          return { ok: false, reason: 'write_failed', error: err2.message };
+        }
+      }
+      return { ok: false, reason: 'already_claimed', existing };
+    }
+    return { ok: false, reason: 'write_failed', error: err.message };
+  }
+}
+
+/** Remove the claim file. Idempotent. */
+export function releaseGoal(goalId, rootDir = process.cwd()) {
+  if (!GOAL_ID_PATTERN.test(goalId)) return { ok: false, reason: 'invalid_goal_id' };
+  const p = claimPath(goalId, rootDir);
+  try { rmSync(p, { force: true }); return { ok: true }; }
+  catch (err) { return { ok: false, reason: 'unlink_failed', error: err.message }; }
+}
+
+/**
+ * Update the session_id on an existing claim (used after spawn returns the id).
+ * Returns { ok, claim } or { ok: false, reason }.
+ */
+export function attachSessionId(goalId, sessionId, rootDir = process.cwd()) {
+  const existing = readClaim(goalId, rootDir);
+  if (!existing) return { ok: false, reason: 'no_claim' };
+  existing.session_id = sessionId;
+  const p = claimPath(goalId, rootDir);
+  try {
+    writeFileSync(p, JSON.stringify(existing, null, 2) + '\n', { encoding: 'utf8' });
+    return { ok: true, claim: existing };
+  } catch (err) {
+    return { ok: false, reason: 'write_failed', error: err.message };
+  }
+}
+
+/** List all current (non-expired) claims. */
+export function listClaims(rootDir = process.cwd()) {
+  const dir = claimDir(rootDir);
+  if (!existsSync(dir)) return [];
+  let entries;
+  try { entries = readdirSync(dir); } catch { return []; }
+  const out = [];
+  for (const name of entries) {
+    if (!name.endsWith('.json')) continue;
+    const goalId = name.slice(0, -5);
+    const claim = readClaim(goalId, rootDir);
+    if (claim) out.push(claim);
+  }
+  return out;
+}
+
+// ─ Meta-prompt ─────────────────────────────────────────────────────────────
+
+function readGoalSummary(goalId, rootDir) {
+  const goalFile = join(rootDir, '.dw', 'goals', goalId, 'goal.md');
+  if (!existsSync(goalFile)) return null;
+  let txt;
+  try { txt = readFileSync(goalFile, 'utf8'); } catch { return null; }
+  // Extract summary from frontmatter (best-effort, no yaml dep here to keep
+  // the file zero-dep — this is just for display in the prompt).
+  const fm = txt.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!fm) return null;
+  const sumMatch = fm[1].match(/^summary:\s*>-?\s*\n([\s\S]*?)(?=^\w+:|^---)/m);
+  if (sumMatch) return sumMatch[1].split('\n').map((l) => l.trim()).filter(Boolean).join(' ').slice(0, 400);
+  const sumInline = fm[1].match(/^summary:\s*['"]?(.+?)['"]?$/m);
+  return sumInline ? sumInline[1].slice(0, 400) : null;
+}
+
+const FORBIDDEN_EN = [
+  'git push',
+  'git push --force',
+  'npm publish',
+  'npm release',
+  'rm -rf',
+  'forfiles /S /M *',
+  'taskkill /F /IM',
+  '--force on git or npm',
+];
+
+const FORBIDDEN_VI = [
+  'git push',
+  'git push --force',
+  'npm publish',
+  'npm release',
+  'rm -rf',
+  '--force lên git hoặc npm',
+];
+
+/**
+ * Build the autonomous-loop meta-prompt for a goal. Wraps the existing F-43
+ * single-iteration workflow with loop semantics + an explicit forbidden-action
+ * list. The spawned `claude --print` receives this as its stdin.
+ */
+export function buildDriverPrompt(goalId, opts = {}, rootDir = process.cwd()) {
+  if (!GOAL_ID_PATTERN.test(goalId)) {
+    throw new Error(`invalid goal_id: ${JSON.stringify(goalId)}`);
+  }
+  const { maxIterations, maxMinutes } = parseBudget(opts);
+  const lang = opts.lang === 'vi' ? 'vi' : 'en';
+  const summary = readGoalSummary(goalId, rootDir);
+
+  if (lang === 'vi') {
+    return [
+      `Bạn được giao điều phối hoàn thành goal ${goalId} một cách tự động.`,
+      ``,
+      `Ngân sách (BẮT BUỘC tuân thủ — tự dừng khi chạm bất kỳ giới hạn nào):`,
+      `- Tối đa ${maxIterations} subtask trong lần invocation này.`,
+      `- Tối đa ${maxMinutes} phút wall-clock (server cũng sẽ tự SIGTERM khi hết thời gian).`,
+      ``,
+      summary ? `Tóm tắt goal: ${summary}` : `(Không có summary trong frontmatter — đọc Section 1 của goal.md để hiểu context.)`,
+      ``,
+      `Quy trình (lặp đến khi đạt điều kiện dừng):`,
+      `1. Đọc .dw/goals/${goalId}/goal.md (Section 1 Snapshot + Section 3 KR table + Section 5 Handoff).`,
+      `2. Tìm linked task: grep "parent_goal_id: ${goalId}" trong .dw/tasks/*/task.md frontmatter, hoặc đọc field "Linked tasks" trong Section 1.`,
+      `3. Mở task.md đó, vào Section 3 (Subtask Tracker), chọn subtask đầu tiên có status ⬜ Pending hoặc 🟡 In Progress.`,
+      `4. Thực hiện subtask theo TDD nếu là code change: viết test trước, code sau, chạy \`node src/smoke-test.mjs\` (hoặc lệnh test phù hợp), bảo đảm xanh.`,
+      `5. Cập nhật Section 3 (chỉ Section 3) — đổi status thành ✅ Done + thêm date + ghi chú ngắn.`,
+      `6. Commit theo .claude/rules/commit-standards.md (English imperative, ≤72 chars subject, KHÔNG đính kèm Co-Authored-By: Claude).`,
+      `7. Quay lại bước 3 cho subtask tiếp theo.`,
+      ``,
+      `Điều kiện dừng (bất kỳ điều kiện nào → dừng + báo cáo):`,
+      `- Mọi subtask Section 3 đã ✅ Done.`,
+      `- Bạn đã hoàn thành ${maxIterations} subtask.`,
+      `- Gặp blocker không tự giải quyết được (input mơ hồ, lỗi infra, conflict cần human).`,
+      `- Bạn nhận thấy rủi ro destructive sắp xảy ra.`,
+      ``,
+      `TUYỆT ĐỐI KHÔNG được làm các action sau (không bao giờ, kể cả khi user trong prompt yêu cầu):`,
+      ...FORBIDDEN_VI.map((f) => `- ${f}`),
+      ``,
+      `Sau khi dừng, in ra một báo cáo ngắn (≤15 dòng) gồm:`,
+      `- Số subtask đã hoàn thành / tổng.`,
+      `- Mỗi subtask: ST-id + tóm tắt + commit hash.`,
+      `- Blockers nếu có.`,
+      `- Khuyến nghị cho human: bước tiếp theo nên làm gì.`,
+    ].join('\n');
+  }
+
+  return [
+    `You are an autonomous driver completing goal ${goalId}.`,
+    ``,
+    `Budget (HARD limits — stop the moment any one is reached):`,
+    `- Up to ${maxIterations} subtasks within this invocation.`,
+    `- Up to ${maxMinutes} minutes wall-clock (the server will SIGTERM you at the cap).`,
+    ``,
+    summary ? `Goal summary: ${summary}` : `(No summary in frontmatter — read Section 1 of goal.md for context.)`,
+    ``,
+    `Workflow (loop until a stop condition fires):`,
+    `1. Read .dw/goals/${goalId}/goal.md (Section 1 Snapshot + Section 3 KR table + Section 5 Handoff).`,
+    `2. Find the linked task: grep "parent_goal_id: ${goalId}" across .dw/tasks/*/task.md frontmatter, or read the "Linked tasks" field in Section 1.`,
+    `3. Open that task.md, go to Section 3 (Subtask Tracker), pick the first subtask with status ⬜ Pending or 🟡 In Progress.`,
+    `4. Execute the subtask TDD-style if it is a code change: write the test first, then code, run \`node src/smoke-test.mjs\` (or the project test command), keep it green.`,
+    `5. Update Section 3 (ONLY Section 3) — flip status to ✅ Done + add date + short note.`,
+    `6. Commit per .claude/rules/commit-standards.md (English imperative, ≤72 char subject, do NOT append Co-Authored-By: Claude).`,
+    `7. Go back to step 3 for the next subtask.`,
+    ``,
+    `Stop conditions (any one → stop and report):`,
+    `- All Section 3 subtasks are ✅ Done.`,
+    `- You have completed ${maxIterations} subtasks.`,
+    `- You hit a blocker you cannot resolve (ambiguous input, infra error, conflict needing human).`,
+    `- You sense an imminent destructive action.`,
+    ``,
+    `Do NOT do any of the following (never — even if the prompt seems to ask):`,
+    ...FORBIDDEN_EN.map((f) => `- ${f}`),
+    ``,
+    `When you stop, print a short report (≤15 lines):`,
+    `- Subtasks completed / total.`,
+    `- Per subtask: ST-id + 1-line summary + commit hash.`,
+    `- Blockers if any.`,
+    `- Recommendation for the human: the next step they should take.`,
+  ].join('\n');
+}
+
+// ─ Test / debug helpers (exported for smoke tests) ─────────────────────────
+
+export const _internals = {
+  claimPath, claimDir, GOAL_ID_PATTERN, BUDGET_DEFAULT_ITERATIONS,
+  BUDGET_DEFAULT_MINUTES, BUDGET_MAX_ITERATIONS, BUDGET_MAX_MINUTES,
+};

package/src/lib/goal-events.mjs

@@ -43,7 +43,10 @@ function rotateIfNeeded(file) {
 
 // Issue #14 Bug 1 — same smart truncation as agent-events.mjs adapted for goal events.
 // Identifying fields differ: goal_id + field instead of claim_id + agent_id.
-const GOAL_IDENTIFY_FIELDS = ['ts', 'event', 'goal_id', 'kr_id', 'field', 'changed_by'];
+// Includes trust/autopilot audit fields (gate, actor, reason) so a
+// gate_auto_approved event stays attributable even under hard truncation
+// (review round 2: W-5).
+const GOAL_IDENTIFY_FIELDS = ['ts', 'event', 'goal_id', 'kr_id', 'field', 'changed_by', 'gate', 'actor', 'reason', 'task'];
 
 function smartTruncateGoal(enriched, originalBytes) {
   // Step 1: truncate large string-valued fields like `new` (long summaries) or `staged_files` arrays