fdeops 3.27.0 → 3.28.0

package/bin/lib/trust.js

@@ -3,7 +3,7 @@
 function createTrustApi(deps) {
   const {
     fs, path, readClean, readEng, parseMdTable, sectionBody, SIGNAL_LEDGER, memoryDirtyManual,
-    stripTemplateNoise, stripLegendLines,
+    stripTemplateNoise, stripLegendLines, extractRisks,
   } = deps
 
   // phase / trust / top risk / freshness - identical heuristic for status + dashboard.
@@ -129,27 +129,7 @@ function createTrustApi(deps) {
   }
 
   function countOpenRisks(eng) {
-    const md = readClean(eng, 'risks.md')
-    const body = md.split(/^#{1,6}\s+Retired\b/im)[0] || md
-    let n = 0
-    for (const raw of body.split('\n')) {
-      const t = raw.trim()
-      if (!t || t.startsWith('<!--') || /^#{1,6}\s/.test(t)) continue
-      if (/risk\s*\|\s*status|mitigation/i.test(t) || /^\|?[\s|:-]+$/.test(t)) continue
-      // Bullet risk with substance (skip empty "- " stubs). The bullet marker
-      // must be followed by space: "**Status:** open · closed" is a legend, and
-      // counting it as a risk reported one open risk on an empty register.
-      if (/^[-*]\s/.test(t)) {
-        if (t.replace(/^[-*]\s+/, '').trim()) n++
-        continue
-      }
-      // Table row: first cell must have risk text (day-1 "| | open | |" placeholders don't count).
-      if (/^\|/.test(t) && t.length > 12) {
-        const riskCell = t.split('|').map(c => c.trim())[1] || ''
-        if (riskCell) n++
-      }
-    }
-    return n
+    return extractRisks(eng).length
   }
 
   function nextActionLine(ctx) {
@@ -166,7 +146,7 @@ function createTrustApi(deps) {
   function computeSignals(eng) {
     // readClean, not readEng: status/dashboard echo topRisk and stakeholder lines
     // to the terminal and the rendered HTML - a <private> risk must never surface.
-    const ctx = readClean(eng, 'context.md'); const stake = readClean(eng, 'stakeholders.md'); const risks = readClean(eng, 'risks.md')
+    const ctx = readClean(eng, 'context.md'); const stake = readClean(eng, 'stakeholders.md')
     // Prefer structured tokens from stakeholders + CLI ledger (ledger survives wipes)
     const signalText = stake + '\n' + readClean(eng, SIGNAL_LEDGER)
     const phase = parsePhase(ctx)
@@ -215,11 +195,7 @@ function createTrustApi(deps) {
       trust = sLines.some(l => /\bred\b/i.test(l)) ? 'RED'
         : sLines.some(l => /amber|gone quiet|routing around|escalat/i.test(l)) ? 'amber' : 'new'
     }
-    const topRisk = (risks.split('\n').find(l => {
-      const t = l.trim()
-      return /^[-|]/.test(t) && t.length > 20 && !/^\|?[-\s|]+$/.test(t) &&
-        !/risk\s*\|\s*status|mitigation/i.test(t) && !t.startsWith('<!--')
-    }) || '').replace(/\|/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 80)
+    const topRisk = (extractRisks(eng)[0]?.text || '').replace(/\s+/g, ' ').trim().slice(0, 80)
     // Prefer trust trigger / memory warn over a random risk line; always keep mem.warn available
     const reason = (trustReason || mem.warn) ? (trustReason || mem.warn) : topRisk
     // What the triage line is actually quoting. A risk bullet printed under

package/bin/lib/value-ledger.js

@@ -26,6 +26,7 @@ function evidenceSource(evidence) {
 }
 
 function valueState({ measured, accepted, acceptanceStatus, evidence }) {
+  if (withdrawalMention({ measured, accepted, acceptanceStatus, evidence })) return 'claimed'
   if (!measured || PENDING_CELL_RE.test(measured)) return 'unmeasured'
   if (!acceptanceName(accepted) || !evidenceSource(evidence)) return 'claimed'
   // Explicit status is authoritative when the column exists. Unknown values
@@ -37,4 +38,48 @@ function valueState({ measured, accepted, acceptanceStatus, evidence }) {
   return 'accepted'
 }
 
-module.exports = { PENDING_CELL_RE, acceptanceName, evidenceSource, valueState }
+// These checks flag explicit conflicts for human review. They do not authenticate
+// approval, infer delegation, or revoke history when the current signer changes.
+function withdrawalMention(row) {
+  return [row.measured, row.accepted, row.acceptanceStatus, row.evidence].filter(Boolean).some(value => {
+    const text = String(value)
+      .replace(/\[source:[^\]]*\]/gi, '')
+      .replace(/\S*[/\\]\S*/g, '') // artifact names are sources, not withdrawal events
+      .replace(/\b(?:not|never)\s+(?:been\s+)?(?:withdrawn|retracted|revoked|superseded)\b/gi, '')
+    // A withdrawn result is different from a result counting revoked tokens.
+    return /^(?:withdrawn|retracted|revoked|superseded)(?:\s*:|\s*$)/i.test(text.trim()) ||
+      /\b(?:approval|acceptance|evidence|measurement|result|assertion)\b[^.;\n]{0,40}\b(?:withdrawn|retracted|revoked|superseded)\b/i.test(text) ||
+      /\b(?:withdrawn|retracted|revoked|superseded|retracts?|withdraws?)\b[^.;\n]{0,25}\b(?:approval|acceptance|evidence|measurement|result|assertion)\b/i.test(text)
+  })
+}
+
+function scopeIssue(row, goal) {
+  const rowPromise = String(row.promised || '')
+  const goalLine = String(goal).match(/^(?:\*\*)?(?:Done when|Acceptance check):(?:\*\*)?\s*(.*)$/im)
+  const scopeSpecified = /\b(?:production|staging|synthetic|slides?|demo|prototype|poc)\b/i.test(rowPromise)
+  const promise = scopeSpecified ? rowPromise : `${rowPromise} ${goalLine ? goalLine[1] : goal}`
+  const acceptance = String(row.accepted || '')
+  const limited = acceptance.match(/\b(staging|slides?(?: design)?|demo|prototype|poc)\s+only\b/i)
+  if (limited) {
+    const scope = limited[1].toLowerCase()
+    const matchingGoal = scope.startsWith('slide') ? /\bslides?\b/i.test(promise) : new RegExp('\\b' + scope + '\\b', 'i').test(promise)
+    if (!matchingGoal || /\b(?:production|clinical use|go.live)\b/i.test(promise)) return 'approval scope is limited; review against the promised outcome'
+  }
+  const measured = String(row.measured || '')
+  const productionUntested = measured.split(/[;.\n]/).some(clause => /\bproduction\b/i.test(clause) && /\b(?:not|never|untested|unmeasured|pending)\b/i.test(clause))
+  if (/\bproduction\b/i.test(promise) && /\b(?:staging|synthetic|prototype|poc)\b/i.test(measured) && (!/\bproduction\b/i.test(measured) || productionUntested)) return 'measurement scope differs from production promise; review required'
+  return ''
+}
+
+function reconcileValueRows(rows, goal = '') {
+  const key = row => String(row.slice || '').trim().toLowerCase()
+  const withdrawn = new Set(rows.filter(withdrawalMention).map(key).filter(Boolean))
+  return rows.map(row => {
+    let acceptanceIssue = scopeIssue(row, goal)
+    if (withdrawalMention(row)) acceptanceIssue = 'withdrawal recorded; review current acceptance'
+    else if (withdrawn.has(key(row))) acceptanceIssue = 'conflicting withdrawal for this slice; review history before relying on acceptance'
+    return acceptanceIssue ? { ...row, acceptanceIssue, state: row.state === 'unmeasured' ? 'unmeasured' : 'claimed' } : row
+  })
+}
+
+module.exports = { PENDING_CELL_RE, acceptanceName, evidenceSource, valueState, reconcileValueRows }

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "3.27.0",
+  "version": "3.28.0",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage → propose → apply). Zero runtime dependencies.",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.27.0",
+  "version": "3.28.0",
   "description": "Client delivery tools for Forward Deployed Engineers. One @fde skill, local Markdown engagement records, and an offline dashboard for decisions, evidence, approvals, and next actions.",
   "bin": {
     "fdeops": "bin/install.js",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "3.27.0",
+  "version": "3.28.0",
   "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code. You confirm; then it lands in .fde/ on your laptop.",
   "author": {
     "name": "Subash Natarajan",

package/skills/fde/references/audit.md

@@ -4,11 +4,11 @@
 
 **Read first:** `context.md` if it exists - otherwise start cold. The point of this phase is to establish ground truth, not assume it.
 
-## Method - part 1: read everything that exists (you do this work)
+## Method - part 1: inspect the inherited record (you do this work)
 
 Before forming any opinion:
 
-1. **Inherit the paper.** Any previous `.fde/`, docs, README claims, ADRs, ticket history the FDE can export. Read it all - the previous FDE's decisions are evidence, not verdicts.
+1. **Inherit the paper.** Start with `fde resume` and inventory the available docs, ADRs, ticket exports and operational handoff. Do not recursively load `.fde/` or raw transcripts. List the claims and unknowns, then use `fde recall <specific topic>` to retrieve bounded evidence for each consequential claim. Review the relevant source when an excerpt is insufficient; keep unrelated history on disk. Previous decisions are evidence, not verdicts.
 2. **Run the discover scans** (see `discover.md` part 1: churn, test gaps, "temporary" grep, AI components). On a takeover, add:
 ```bash
 git log --format="%an" | sort | uniq -c | sort -rn | head   # who actually built this
@@ -55,7 +55,7 @@ Build without a plan in an inherited system is the fastest path to the second in
 
 ## Principles
 
-- Read everything that exists before forming any opinion.
+- Inventory the record; verify consequential claims through targeted, bounded retrieval before forming an opinion.
 - "It should work" is not "it works." Verify.
 - The most dangerous systems are the ones everyone assumes someone else understands.
 - Don't build until `audit.md`, `terrain.md`, `reality.md` are written.

package/skills/fde/references/debrief.md

@@ -30,7 +30,7 @@
    - `signer: Priya` (she can say yes; lands in `success.md`)
    - `next: send one-pager before Thursday 9am`
    - unprefixed lines stay context color only
-4. Show the **REVIEW** block first (decided / asked / open / next / signer). That is the one screen to confirm. File routing stays underneath.
+4. After editing, run `fde debrief --review` to show the pending proposal without replacing it. Show the **REVIEW** block first (decided / asked / open / next / signer). That is the one screen to confirm. File routing stays underneath.
 5. In **chat**, after that REVIEW, present a four-row card and omit empty rows:
    - Decided
    - Asked / open
@@ -74,3 +74,15 @@ Read back the 2-3 most consequential captures in one breath - so the FDE can cor
 - Verbatim quote outranks paraphrase; hesitation outranks quote.
 - Signals move on evidence, never on vibe alone.
 - A meeting with no decisions and no actions - say so; that is a finding.
+
+## Delivery rows and repeated updates
+
+For a measured or promised slice, use a reviewed structured line:
+
+```text
+delivery: Replay|risk-mitigation|zero duplicates|zero duplicates on staging|pending|[source: transcript:42]|pending
+```
+
+The seven fields are Slice, Bucket, Promised, Measured, Accepted by, Evidence, Rollback. Keep unknowns `pending`; never infer approval. This lands in the value ledger during the same confirmed apply. A `delivery:` line without pipes stays a narrative note. Incorrect field counts refuse the write rather than shifting the meaning of cells.
+
+A sourced statement already in the record triggers a replay warning. Before applying, compare newer facts and the current next action. Remove repeated statements from the proposal if this is an accidental re-import. Only after the engineer explicitly confirms an intentional repeat, apply with `fde debrief --apply --allow-replay`. This does not silently deduplicate history and does not authenticate sources.