fdeops 3.21.0 → 3.22.0

package/README.md

@@ -6,6 +6,8 @@ You're on a customer site. The AI coding agent writes code in their repo. This k
 
 Notes stay on your laptop. Their repo stays theirs. You confirm before anything is written down.
 
+Keep the coding pack you already use. Install this next to it. FDEOps is the client work. The other pack writes the code.
+
 <img width="1536" height="1024" alt="fdeops" src="https://github.com/user-attachments/assets/2bcb8739-55ee-445d-8a1a-8b38433b7b58" />
 
 ---

package/bin/check.js

@@ -409,6 +409,28 @@ for (const f of exampleFiles) {
 }
 ok('examples walkthrough files')
 
+// The examples are the first .fde/ a newcomer reads. They must pass the kit's
+// own doctor, or the kit is telling people to do what its showcase does not.
+// Tolerated: things a frozen reference copy cannot have (an owner, a memory
+// git, a fresh trust signal).
+{
+  const { spawnSync } = require('child_process')
+  const tolerated = /no \.owner|not git-versioned|trust signal is STALE/
+  for (const ex of fs.readdirSync(path.join(root, 'examples'))) {
+    const eng = path.join(root, 'examples', ex, '.fde')
+    if (!fs.existsSync(eng)) continue
+    const r = spawnSync(process.execPath, [path.join(root, 'bin', 'fde.js'), 'doctor'], {
+      encoding: 'utf8',
+      env: { ...process.env, FDEOPS_ENGAGEMENT: eng, HOME: fs.mkdtempSync(path.join(require('os').tmpdir(), 'fdeops-check-')) },
+    })
+    const issues = (r.stdout || '').split('\n')
+      .map(l => l.match(/^\s+\d+\.\s+(.*)$/)).filter(Boolean).map(m => m[1])
+      .filter(i => !tolerated.test(i))
+    if (issues.length) fail(`examples/${ex} fails its own doctor:\n    - ${issues.join('\n    - ')}`)
+    else ok(`examples/${ex} passes fde doctor`)
+  }
+}
+
 if (fs.existsSync(path.join(root, 'tasks', 'plan.md'))) {
   fail('tasks/plan.md should not be in public tree (move to docs/internal)')
 }

package/bin/fde.js

@@ -1515,8 +1515,8 @@ function smartProposeText(input) {
       out.push(`decision: ${bare.replace(/^decided:\s+/i, '')}`)
       continue
     }
-    if (/^(decision|risk|delivery|contact|next):\s*/i.test(bare)) {
-      let routed = bare.replace(/^(decision|risk|delivery|contact|next):\s*/i, (m, t) => `${t.toLowerCase()}: `)
+    if (/^(decision|risk|delivery|contact|next|signer):\s*/i.test(bare)) {
+      let routed = bare.replace(/^(decision|risk|delivery|contact|next|signer):\s*/i, (m, t) => `${t.toLowerCase()}: `)
       if (/^contact:/i.test(routed) && !/\[signal:(red|amber|green)\]/i.test(routed)) {
         const sig = inferContactSignal(routed)
         if (sig) routed = routed.replace(/\s*$/, ` [signal:${sig}]`)
@@ -1524,6 +1524,12 @@ function smartProposeText(input) {
       out.push(routed)
       continue
     }
+    // Sentence-level: a signer named mid-paragraph gets its own routed line and
+    // the original stays as context, so nothing is invented or lost.
+    for (const sentence of bare.split(/(?<=[.!?])\s+/)) {
+      const who = signerFromLine(sentence)
+      if (who) { out.push(`signer: ${who}`); break }
+    }
     if (/^(next action|follow-?ups?|action items?|todo):\s*/i.test(bare) ||
         /\b(next action|walk in with|follow up with)\b/i.test(bare)) {
       const next = bare.replace(/^(next action|follow-?ups?|action items?|todo):\s*/i, '').trim()
@@ -1549,6 +1555,56 @@ function smartProposeText(input) {
   return out.join('\n') + (out.length ? '\n' : '')
 }
 
+// "Priya signs off" is the most expensive sentence in a kickoff and used to land
+// in context.md as a note. signer: fills the success.md line the whole kit
+// keys on, and logs the person as a contact so prep/status can see them.
+const SIGNER_RX = /^(?<who>[A-Z][\w.'-]+(?:\s+[A-Z][\w.'-]+){0,3}(?:\s*\([^)]{1,40}\))?)\s+(?:signs?(?:\s+off)?|approves|has (?:the )?final say|can say yes|owns the decision|is the (?:sponsor|signer|decision[- ]maker))\b/
+
+function signerFromLine(text) {
+  const t = String(text || '').trim()
+  const m = t.match(SIGNER_RX)
+  if (!m) return ''
+  const who = m.groups.who.trim()
+  // "Staging exists" / "The API is slow" also match "Capital Word + verb"; a
+  // sentence-initial common noun is not a person.
+  if (/^(The|This|That|It|We|They|Staging|Budget|Prod|Production|Nobody|Someone|Everyone)\b/.test(who)) return ''
+  return who
+}
+
+function setSigner(eng, who) {
+  ensureMemoryGit(eng)
+  const p = path.join(eng, 'success.md')
+  let md = readEng(eng, 'success.md')
+  if (!md) md = '# Success definition\n\n'
+  const norm = (s) => String(s).replace(/\s+/g, ' ').trim().toLowerCase()
+  const line = /^\*\*Stakeholder who signs off:\*\*\s*(.*)$/m
+  const m = md.match(line)
+  if (m && !m[1].trim()) {
+    md = md.replace(line, `**Stakeholder who signs off:** ${who}`)
+  } else if (m) {
+    // Whole-name compare against the primary and every "also named" line under
+    // it: "Sam" must not vanish inside "Samantha", and re-applying must not
+    // stack duplicates.
+    const start = md.indexOf(m[0]) + m[0].length
+    const alsoNamed = []
+    for (const l of md.slice(start).split('\n').slice(1)) {
+      const a = l.match(/^- also named:\s*(.+)$/)
+      if (!a) break
+      alsoNamed.push(a[1])
+    }
+    const known = [m[1], ...alsoNamed].map(norm)
+    if (known.includes(norm(who))) return false
+    // A second, different name is a fact worth keeping next to the first, not
+    // a silent overwrite - who signs is exactly the thing people argue about.
+    const block = [m[0], ...alsoNamed.map(a => `- also named: ${a}`)].join('\n')
+    md = md.replace(block, `${block}\n- also named: ${who}`)
+  } else {
+    md = md.replace(/\n*$/, `\n\n**Stakeholder who signs off:** ${who}\n`)
+  }
+  withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
+  return true
+}
+
 function setNextAction(eng, text) {
   ensureMemoryGit(eng)
   const bullet = `- ${stripControlChars(String(text).replace(/^[-*]\s+/, '').trim())}`
@@ -1665,7 +1721,7 @@ function readSealedProposal(eng) {
 function routeDebriefInput(eng, input, { dry, force, sealed = [] }) {
   const d = new Date()
   const date = d.toISOString().slice(0, 10)
-  const counts = { decision: 0, risk: 0, delivery: 0, contact: 0, next: 0 }
+  const counts = { decision: 0, risk: 0, delivery: 0, contact: 0, next: 0, signer: 0 }
   const ctxLines = []
   let nextAction = ''
   ensureMemoryGit(eng)
@@ -1678,8 +1734,8 @@ function routeDebriefInput(eng, input, { dry, force, sealed = [] }) {
   for (const raw of routable.split('\n')) {
     let line = raw.trim()
     if (!line) continue
-    const bare = line.replace(/^[-*+]\s+/, '').replace(/^\*\*(decision|risk|delivery|contact|next):?\*\*:?\s*/i, '$1: ')
-    const m = bare.match(/^(decision|risk|delivery|contact|next):\s*(.+)$/i)
+    const bare = line.replace(/^[-*+]\s+/, '').replace(/^\*\*(decision|risk|delivery|contact|next|signer):?\*\*:?\s*/i, '$1: ')
+    const m = bare.match(/^(decision|risk|delivery|contact|next|signer):\s*(.+)$/i)
     if (m) {
       const type = m[1].toLowerCase()
       let body = m[2]
@@ -1688,6 +1744,18 @@ function routeDebriefInput(eng, input, { dry, force, sealed = [] }) {
         console.error(`skipped ${type} line - looks like a ${hit}. Redact it, or re-run with --force.`)
         continue
       }
+      if (type === 'signer') {
+        const who = body.replace(/\s+signs?(?:\s+off)?\b.*$/i, '').trim() || body.trim()
+        if (dry) {
+          console.log(`→ success.md  **Stakeholder who signs off:** ${previewLine(who)}`)
+          console.log(`→ stakeholders.md  ${previewLine(datedEntry(eng, date, `${who} signs off`))}`)
+        } else {
+          setSigner(eng, who)
+          appendLogEntry(eng, 'contact', datedEntry(eng, date, `${who} signs off`), { skipCommit: true })
+        }
+        counts.signer++
+        continue
+      }
       if (type === 'next') {
         if (dry) console.log(`→ context.md ## Next action  - ${previewLine(body)}`)
         else nextAction = body
@@ -1760,7 +1828,7 @@ function cmdDebrief(args) {
     if (smart) {
     const { proposePath, clean, blocks } = writeProposal(eng, smartProposeText(input))
     console.log('SMART PROPOSE (heuristic - review before apply; no new facts invented beyond line rewrites)\n')
-    console.log('Prefix vocabulary (lines that route): decision:  risk:  delivery:  contact:  next:')
+    console.log('Prefix vocabulary (lines that route): decision:  risk:  delivery:  contact:  next:  signer:')
     console.log('Everything else → context.md. Keep the prefixes; the preview gate stays.\n')
     routeDebriefInput(eng, clean, { dry: true, force, sealed: blocks })
     if (!apply) {
@@ -1776,7 +1844,7 @@ function cmdDebrief(args) {
   const { counts, ctxLines, privateBlocks } = routeDebriefInput(eng, input, { dry, force, sealed })
   if (!dry) {
     const hash = commitMemory(eng, 'debrief', {
-      files: ['decisions.md', 'risks.md', 'delivery.md', 'stakeholders.md', 'context.md', SIGNAL_LEDGER],
+      files: ['decisions.md', 'risks.md', 'delivery.md', 'stakeholders.md', 'success.md', 'context.md', SIGNAL_LEDGER],
     })
     try { fs.unlinkSync(path.join(eng, DEBRIEF_PROPOSE)) } catch (_) {}
     try { fs.unlinkSync(path.join(eng, DEBRIEF_PRIVATE)) } catch (_) {}
@@ -1784,7 +1852,7 @@ function cmdDebrief(args) {
     if (hash) console.log(`memory @${hash}`)
   }
   const plural = {
-    decision: 'decisions', risk: 'risks', delivery: 'deliveries', contact: 'contacts', next: 'next actions',
+    decision: 'decisions', risk: 'risks', delivery: 'deliveries', contact: 'contacts', next: 'next actions', signer: 'signers',
   }
   const parts = Object.keys(counts).filter(t => counts[t])
     .map(t => `${counts[t]} ${counts[t] === 1 ? (t === 'next' ? 'next action' : t) : plural[t]}`)
@@ -2176,6 +2244,66 @@ function findDuplicateOpenRisks(eng) {
   return [...byKey.values()].filter(g => g.length >= 2)
 }
 
+// The bound client repo moved and delivery.md did not. This is the one place
+// the CLI can catch "we shipped code and told the record nothing" without AI:
+// registry gives the workspace(s) bound to this engagement, git gives commits
+// newer than the last dated delivery line. Local reads only.
+// Only dates that stamp an entry count: a ledger row's Date cell, a dated
+// bullet, a dated heading. "trial night 2026-06-02" inside a Measured cell is a
+// promise, not a receipt - and a future promise must not hide today's commits.
+function latestDeliveryEntry(md) {
+  const today = new Date().toISOString().slice(0, 10)
+  let latest = { date: '', line: '' }
+  for (const raw of stripTemplateNoise(md).split('\n')) {
+    const t = raw.trim()
+    const m = t.match(/^[-*]\s*\[(\d{4}-\d{2}-\d{2})\]/) ||
+      t.match(/^#{1,6}\s+\[?(\d{4}-\d{2}-\d{2})(?:\]|\b)/) ||
+      t.match(/^\|\s*(\d{4}-\d{2}-\d{2})\s*\|/)
+    if (!m || m[1] > today) continue
+    if (m[1] >= latest.date) latest = { date: m[1], line: t }
+  }
+  return latest
+}
+
+function silentCommitIssues(eng) {
+  const slug = path.basename(path.dirname(eng))
+  const workspaces = readRegistry().filter(r => r.slug === slug).map(r => r.workspace)
+  if (!workspaces.length) return []
+  const entry = latestDeliveryEntry(readClean(eng, 'delivery.md'))
+  const lastDelivery = entry.date
+  const out = []
+  for (const ws of workspaces) {
+    let st
+    try { st = fs.statSync(ws) } catch (_) { continue }
+    if (!st.isDirectory()) continue
+    // The memory folder is itself a git repo; never lint it as the client repo.
+    if (path.resolve(ws) === path.resolve(eng) || path.resolve(ws) === path.dirname(path.resolve(eng))) continue
+    if (sh('git rev-parse --is-inside-work-tree', ws) !== 'true') continue
+    // Memory git knows the exact moment that entry was written; dates in the
+    // file are day-grained and would miss a commit made later the same day.
+    // Pickaxe on the entry text, not the file: a later status edit to
+    // delivery.md must not become the cutoff and hide commits before it.
+    const raw = entry.line
+      ? sh(`git log -1 --format=%cI -S${JSON.stringify(entry.line)} -- delivery.md`, eng)
+      : ''
+    // git --since is inclusive at second grain; a commit in the same second as
+    // the receipt is the receipt's own work, not a silent one.
+    const stamp = raw && !Number.isNaN(Date.parse(raw)) ? new Date(Date.parse(raw) + 1000).toISOString() : ''
+    const since = stamp ? `--since="${stamp}"`
+      : lastDelivery ? `--since="${lastDelivery} 23:59:59"`
+        : "--since='30 days ago'"
+    const commits = sh(`git log ${since} --format=%h -- .`, ws).split('\n').filter(Boolean).length
+    if (!commits) continue
+    const where = path.basename(ws)
+    out.push(
+      lastDelivery
+        ? `${commits} commit(s) in ${where} since the last delivery line (${lastDelivery}) - code moved, ledger did not; log the receipt or say why nothing shipped`
+        : `${commits} commit(s) in ${where} in 30d and delivery.md has no dated line - code moved, ledger did not; fde log delivery "slice | bucket | promised | measured | accepted | evidence | rollback"`
+    )
+  }
+  return out
+}
+
 // Deterministic fieldbook hygiene - shared by doctor + session TRIAGE.
 // Silent when clean OR brand-new (no dated work yet). Never auto-rewrites.
 // High-value moments: week-start (via triage), ship/close, after real work accrues.
@@ -2246,9 +2374,11 @@ function collectDoctorIssues(eng) {
       'duplicate ## Next action headings in context.md - fill the first (template) section and remove extras; triage reads the last non-empty'
     )
   }
-  if ((s.phase === 'close' || s.phase === 'ship') && s.openRisks > 0) {
+  // Open, owned risks are normal mid-ship (triage already shows the count every
+  // session). The gate is close: nothing still live when you call the embed done.
+  if (s.phase === 'close' && s.openRisks > 0) {
     issues.push(
-      `phase is ${s.phase} with ${s.openRisks} open risk(s) - retire, hand off, or move still-live ones before calling the embed done`
+      `phase is close with ${s.openRisks} open risk(s) - retire, hand off, or move still-live ones before calling the embed done`
     )
   }
   if (s.phase === 'close' || s.phase === 'ship') {
@@ -2268,6 +2398,7 @@ function collectDoctorIssues(eng) {
         `phase is ${s.phase} with AI in scope but no eval receipt (evals.md Verdict or delivery Eval / Ship receipts) - required before green ship/close`
       )
     }
+    issues.push(...silentCommitIssues(eng))
   }
   const dupes = findDuplicateOpenRisks(eng)
   if (dupes.length) {

package/bin/lib/trust.js

@@ -194,6 +194,9 @@ function createTrustApi(deps) {
     }) || '').replace(/\|/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 80)
     // Prefer trust trigger / memory warn over a random risk line; always keep mem.warn available
     const reason = (trustReason || mem.warn) ? (trustReason || mem.warn) : topRisk
+    // What the triage line is actually quoting. A risk bullet printed under
+    // "trust:" read as a stakeholder problem that did not exist.
+    const reasonKind = mem.warn && trustReason === mem.warn ? 'memory' : trustReason ? 'trust' : mem.warn ? 'memory' : topRisk ? 'risk' : ''
     const openRisks = countOpenRisks(eng)
     const nextAction = nextActionLine(ctx)
     let updated = 'never', ageDays = Infinity
@@ -203,7 +206,7 @@ function createTrustApi(deps) {
     } catch (_) {}
     const dirty = memoryDirtyManual(eng)
     return {
-      phase, trust, signalAge, stale, topRisk, reason, memoryWarn: mem.warn,
+      phase, trust, signalAge, stale, topRisk, reason, reasonKind, memoryWarn: mem.warn,
       dirtyFiles: dirty, openRisks, nextAction, updated, ageDays,
     }
   }
@@ -215,9 +218,9 @@ function createTrustApi(deps) {
     const lines = [
       `TRIAGE  [${label.padEnd(6)}]  phase:${phase}  updated:${s.updated}  open risks:${s.openRisks}`,
     ]
-    if (s.reason) {
-      const age = s.signalAge != null ? ` (${s.signalAge}d old${s.stale ? ', STALE - reconfirm' : ''})` : ''
-      lines.push(`  trust: ${s.reason}${age}`)
+    if (s.reason && s.reasonKind !== 'memory') {
+      const age = s.reasonKind === 'trust' && s.signalAge != null ? ` (${s.signalAge}d old${s.stale ? ', STALE - reconfirm' : ''})` : ''
+      lines.push(`  ${s.reasonKind === 'risk' ? 'top risk' : 'trust'}: ${s.reason}${age}`)
     }
     // Always surface corruption / unreadable memory - even when trust still reads green
     if (s.memoryWarn) lines.push(`  memory: ${s.memoryWarn}`)

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "3.21.0",
+  "version": "3.22.0",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage → propose → apply). Zero runtime dependencies.",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.21.0",
+  "version": "3.22.0",
   "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code: who can say yes, what went live, whether they signed off. Dated markdown on your laptop. You confirm each write.",
   "bin": {
     "fdeops": "bin/install.js",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "3.21.0",
+  "version": "3.22.0",
   "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code. You confirm; then it lands in .fde/ on your laptop.",
   "author": {
     "name": "Subash Natarajan",

package/skills/fde/SKILL.md

@@ -42,6 +42,8 @@ On someone else's site the work is not "write code, remember later." Every chang
 
 A throwaway file can skip the loop. Bound client work cannot.
 
+**Skip is loud.** Bound + a change that will ship + no this-turn line in `delivery.md` = not done. Say that. Do not call it shipped. A coding pack may write the function; `@fde` still owns done.
+
 ## Human surface vs agent plumbing
 
 **FDE (human):** `@fde` + English, or `/brief` `/discover` `/plan` `/ship` `/outcome` `/close` `/debrief` `/prep` `/trust` `/receipts` `/readout`. Never a skill catalog.
@@ -196,8 +198,8 @@ Ready to build with no `terrain.md` / plan: discover or plan first. Takeover wit
 
 - Never ask the FDE to pick a phase. That's your job.
 - Same six stages at any scale. Overlays carry the industry. Greenfield and brownfield change the first move inside ship, not the map.
-- Ground loop on a bound client: name → characterise → prove on their staging → go live → log. Do not hand their repo to a generic coding pack.
-- Do not call a change done until the signer in `success.md` can reject it on staging they operate.
+- Ground loop on a bound client: name → characterise → prove on their staging → go live → log. A coding pack may write the function. `@fde` still owns done. When they disagree, their repo and the signer win.
+- Do not call a change done until the signer in `success.md` can reject it on staging they operate. No this-turn receipt in `delivery.md` is a failed test, not a note to write later.
 - Read `context.md` before speaking. One sharp question - never a barrage.
 - Never invent people, meetings, or numbers - `unknown - ask:` beats a polished lie.
 - Every phase ends with its artifact written. No artifact, no "done."

package/skills/fde/references/debrief.md

@@ -11,7 +11,8 @@
 ## Honest contract (read once)
 
 - The `fde` CLI is **local, deterministic, no AI**. `--smart` is a **gate + writer**, not a brain.
-- It keeps lines that already have `decision:` / `risk:` / `delivery:` / `contact:` / `next:` prefixes, plus a thin keyword pass (e.g. "we agreed", person+verb lines, "open question").
+- It keeps lines that already have `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` prefixes, plus a thin keyword pass (e.g. "we agreed", person+verb lines, "open question", "X signs off").
+- `signer: Priya` fills **Stakeholder who signs off** in `success.md` and logs Priya as a contact. The CLI proposes it when a sentence says someone signs off / approves / has final say. If the notes name who can say yes and the proposal does not carry a `signer:` line, add one - that is the most expensive sentence in the meeting.
 - Real messy notes without prefixes often route **0 useful lines** - everything else lands as a context dump. That is expected. **You are the router:** rewrite `.debrief-propose` with type prefixes, then `--apply`.
 - `.debrief-propose` is raw lines only (no routing annotations). "Edit if mis-routed" means **rewrite the line with the right prefix**, not leave a comment in the file.
 
@@ -25,6 +26,7 @@
    - `decision: agreed chargebacks stay phase 2 - Priya`
    - `risk: legal may reopen scope if we slip the SOW date`
    - `contact: Priya pushed hard on Friday deck [signal:amber]`
+   - `signer: Priya` (she can say yes; lands in `success.md`)
    - `next: send one-pager before Thursday 9am`
    - unprefixed lines stay context color only
 4. Show the **proposed** routing in plain language (what would become decisions, risks, contacts, next).
@@ -43,7 +45,7 @@ If `--smart` is unavailable or you already have clean prefixes:
    - **Stakeholder signals** - tone shifts with evidence → green/amber/red
    - **Risks** - new / confirmed / retired
    - **Open questions** - what to chase next
-2. Format lines as `decision:` / `risk:` / `delivery:` / `contact:` / `next:` (contacts may end with `[signal:green|amber|red]`).
+2. Format lines as `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` (contacts may end with `[signal:green|amber|red]`).
 3. Show that structured version to the FDE for confirmation.
 4. Pipe to `fde debrief` (or write a file and run it).
 

package/skills/fde/references/ingest.md

@@ -31,7 +31,7 @@ List what you can actually call **this session**:
 3. **Stage** - `fde ingest stage [--source NAME] [--title TEXT] [file|-]` writes raw text into `<engagement>/.inbox/` (outside the memory git ledger).
 4. **List** (optional) - `fde ingest list` shows staged items when you need an id or filename.
 5. **Propose** - `fde ingest propose <id-or-filename>` runs the debrief `--smart` path on the staged body (+ provenance line). Opens `.debrief-propose`.
-6. **Rewrite prefixes** - same as debrief: lines without `decision:` / `risk:` / `delivery:` / `contact:` / `next:` need **you** to rewrite before showing the FDE. `--smart` is a gate, not a brain.
+6. **Rewrite prefixes** - same as debrief: lines without `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` need **you** to rewrite before showing the FDE. `--smart` is a gate, not a brain.
 7. **Show** the proposed routing in plain language. Wait for confirm.
 8. **Apply** - on FDE confirm only → `fde ingest apply` (= `fde debrief --apply`). On reject → stop; ask what to change.
 

package/skills/fde/references/ship.md

@@ -56,6 +56,10 @@ Each change is independently revertible.
 - [ ] Rollback named: revert this change, or something more specific
 - [ ] No dependency on an unmerged change (if dependent, state it and land in order)
 - [ ] `Kill if` is written - the observation that stops this change
+- [ ] Before-receipt captured: the failing output, number, or screen as it is today, dated in `delivery.md`, before you change anything
+- [ ] Open PRs and uncommitted work in the area checked (`gh pr list`, `gh pr diff <n> --name-only`); overlap goes to `decisions.md` before you start
+
+Your coding pack writes the function. This skill owns done. When they disagree with this repo, the repo wins.
 
 **The loop.** In this order:
 
@@ -72,7 +76,7 @@ Read existing code in the area (search before creating)
 
 **Prove it on their staging.** A green check on your laptop is not delivery.
 
-- Run **their** test command, on **their** CI, with **their** fixtures. Write the command and the result in `delivery.md`. You do not add a runner they will not keep. If you have not run their command in this turn, you cannot write that it passed. Last session's green, "should pass," and "looks correct" are not a receipt.
+- Run **their** test command, on **their** CI, with **their** fixtures. Write the command and the result in `delivery.md` in this turn. You do not add a runner they will not keep. If you have not run their command in this turn, you cannot write that it passed. Last session's green, "should pass," and "looks correct" are not a receipt. Missing this-turn line = not proven. Same as a failing test.
 - If the signer in `success.md` cannot reject this on a screen they already use, it is not proven.
 - Staging they operate beats a local demo. If you have no staging: `unknown - ask:` who owns an environment, then stop pretending it shipped.
 - **Monday-shaped data.** Staging that is empty, synthetic, or last quarter is not next Tuesday. Before go-live, write what staging is missing (volume, PII, the batch that only runs in prod, the account that only exists in the warehouse) and what that means for the kill test. If the signer cannot reject it on a screen they already operate, with data that looks like next Tuesday, it is not proven.