feature-factory 0.10.6 → 0.10.8

package/README.md

@@ -152,7 +152,7 @@ truncation, redaction, timeout, retry, cache, payload transport, or session beha
 
 ### Sandbox bootstrap
 
-Only the CLI executes configured `bootstrap`: once during fresh init after clone, containment, and PR-base observation but before manifest publication, and again on every explicit resume while the run remains parked. The exact configured string runs unchanged with `shell: true`, inherited environment and stdin, cwd exactly the selected sandbox, and child stdout and stderr both routed to CLI stderr. Init JSON stdout therefore remains exactly one response object. Bootstrap has its own configured timeout or independent `900000` millisecond default, with no retry and no use of the verify budget.
+Only the CLI executes configured `bootstrap`: once during fresh init after clone, containment, and PR-base observation but before manifest publication, and again on every explicit resume while the run remains parked. It also runs immediately before every configured `verify` execution, in the slice or integration worktree that verify runs in, so `verify` always sees bootstrap output installed from the tree it checks. The exact configured string runs unchanged with `shell: true`, inherited environment and stdin, cwd exactly the selected sandbox, and child stdout and stderr both routed to CLI stderr. Init JSON stdout therefore remains exactly one response object. Bootstrap has its own configured timeout or independent `900000` millisecond default, with no retry and no use of the verify budget.
 
 After every attempt, the CLI checks tracked worktree and index paths only and ignores untracked dependency output. Unobservable tracked state refuses before dirty tracked paths; dirty paths refuse before unavailable or nonzero exit, and diagnostics name exact repository-relative paths. A clean numeric zero stores paired `bootstrap_command` and `bootstrap_exit` manifest evidence. The command is exact; the exit is a non-negative integer or `null`. Ordinary transitions preserve the pair, and status output does not expose it.
 

package/WORKFLOW.md

@@ -723,8 +723,8 @@ Effective push-target capture and comparison are active through the package-owne
 
 | Entry | Declared input | Return shape | Failure meaning | Current behavior |
 |---|---|---|---|---|
-| `bootstrap` | Exact configured string as one shell command with `shell: true`, inherited environment and stdin, cwd exactly the selected sandbox, and child stdout and stderr both routed to CLI stderr. Each execution receives its own `bootstrap_timeout_ms`, independently `900000` when omitted. | Numeric exit status or unavailable `null`; output is visible on CLI stderr and never parsed | Clean zero succeeds; dirty or unobservable tracked state outranks unavailable or nonzero exit | Invoked by the CLI once during configured fresh init and again on every explicit configured resume; never invoked by resolver, merge verification or replay, direct repository verification, slice or Gate 3 observation, effective push, or publication. |
-| `verify` | Ordinary shell step in the exact integration-worktree cwd with inherited environment; no structured stdin or factory-specific payload is defined. Each attempt receives the full configured `verify_timeout_ms`, silently `900000` when omitted. | Exit status is authoritative; stdout and stderr are inherited, informational, and unparsed | Zero means success; non-zero means repository verification failed; no numeric child status means unavailable | Invoked after each newly recorded merge through `observe --repository-verify`, with at most two executions in that merge invocation. The timeout and retry never apply to resolver, slice, or Gate 3 commands. |
+| `bootstrap` | Exact configured string as one shell command with `shell: true`, inherited environment and stdin, cwd exactly the selected sandbox, and child stdout and stderr both routed to CLI stderr. Each execution receives its own `bootstrap_timeout_ms`, independently `900000` when omitted. | Numeric exit status or unavailable `null`; output is visible on CLI stderr and never parsed | Clean zero succeeds; dirty or unobservable tracked state outranks unavailable or nonzero exit | Invoked by the CLI once during configured fresh init, again on every explicit configured resume, and immediately before every configured `verify` execution in the tree that verify runs in: the slice worktree during slice observation, and the integration worktree for post-merge verify, its replay, and direct repository verification. Never invoked by the resolver, effective push, publication, or a replay that reuses recorded verify evidence. |
+| `verify` | Ordinary shell step in the exact integration-worktree cwd with inherited environment; no structured stdin or factory-specific payload is defined. Each attempt receives the full configured `verify_timeout_ms`, silently `900000` when omitted. | Exit status is authoritative; stdout and stderr are routed to CLI stderr, informational, and unparsed | Zero means success; non-zero means repository verification failed; no numeric child status means unavailable | Invoked after each newly recorded merge through `observe --repository-verify`, with at most two executions in that merge invocation. The timeout and retry never apply to resolver, slice, or Gate 3 commands. |
 | `publish` | Optional file candidate for the one Step 6 publishing selection. A nonblank inherited `FACTORY_PUBLISHING_COMMAND` selects its exact string; the same variable set empty or to whitespace selects the default; when the variable is unset this entry is selected if present, otherwise the default. A selected nondefault command runs as one shell step in `RUN_REPO` cwd, with no stdin or positional arguments and inherited environment plus exact `PR_BASE`, `FEATURE_BRANCH`, `PR_DRAFT`, `PR_TITLE`, and absolute `PR_BODY_FILE`. | Exit status is authoritative; the last nonempty stdout line must be an absolute HTTPS URL and becomes `PR_URL` | Zero plus that URL is recordable; any other result is indeterminate and parks before `factory pr` | The resolved selection replaces only `gh pr create`, after the factory-owned exact push and post-push identity guard. `factory pr` is unchanged and still records the URL. |
 | `publishing_identity` | No runtime input; read the value `status` reports for the run, recorded at init from `--publishing-identity` or the inherited `FACTORY_PUBLISHING_IDENTITY` | Exact case-sensitive string compared with the observed login | Absent at init refuses before any sandbox exists; mismatch or unobservable identity parks the run | Active at the three mandatory guards below; only a manifest written before 0.8.0 can report `null` and skip them. |
 
@@ -1527,6 +1527,18 @@ Per slice:
    not a detail to reconcile in your head. Omit `--test-cmd` and the slice is not `review_ready`
    unless its ratified `test_plan` is empty — the waiver comes from the plan, not from you.
 
+   When `.factory.json` declares `verify`, this step also runs it on the slice's commit, after the
+   ratified test command, and records the result as `repository_verify`. A declared `bootstrap` runs in
+   the slice worktree, which never received init's bootstrap output, immediately before that verify and
+   only when it will run; a bootstrap refusal is the evidence's blocked reason and the verify does not run. A failing repository verify makes the slice not `review_ready`, the
+   same as a failing test, so the review rejects and the slice retries; an empty `test_plan` does not
+   waive it. Its output appears on stderr: give the failing part of it (the lint, format, or test
+   failure) to the builder with the rejection, because otherwise the retry cannot see what to fix. This
+   is what keeps a one-line lint failure from surfacing only after merge, where it cannot be repaired.
+   When a merge's tree is byte-identical to the slice commit whose repository verify passed, the
+   post-merge verify reuses that result instead of running again, and its evidence names the slice commit
+   in `reused_from`; any other merge, such as one after a sibling merged, runs the verify as before.
+
    `BUILDER_REPORT` is a path and not the report. Write the builder's returned report to
    `BUILDER_REPORT=".factory/$R/artifacts/$SLICE_ID-builder-attempt-$SLICE_ATTEMPT.json"` and pass that path,
    which keeps the report beside the run's other evidence instead of in argv. It holds `status`, `slice`,
@@ -1706,7 +1718,7 @@ Gate 3 remains a fresh independent observation.
 
 ### Post-merge finding routing and repair journal
 
-Route a known post-merge failure before any next-wave action. A production defect parks top-level needs-human; after the external fix, explicitly resume the intact run.
+Route a known post-merge failure before any next-wave action. A production defect parks top-level needs-human. There is no in-band resume for it: production source is never repaired on the integration branch, and a configured command reruns only after a test-only repair. Say so in the reason, and name preserving the feature branch and starting a fresh run as the recovery; do not tell the operator to resume.
 Production source is never repaired on the integration branch. Unclassifiable,
 interrupted-unknown, invalid-config, unsafe dirty or moved replay, unobservable, journal-invalid, or
 repair-exhausted outcomes also terminalize. Clean unchanged repository-verification exhaustion follows

package/agents/spec-writer.md

@@ -49,6 +49,11 @@ Resolve every ambiguity so builders don't have to. Follow the repository's agent
 - Auth/role gating
 - Test plan: unit tests, and acceptance (which criterion maps to which test, and at what level)
 - **Class-wide work:** convert the research inventory into a closed implementation matrix — one row per sink/call site, each assigned an exact primitive/policy, a compatibility (preserve/migrate) or explicit exclusion decision, and a mapped test. No sink is left to the builder to discover.
+- **Document deliverables:** when the issue's deliverable is a specification, contract, or data artifact
+  rather than executable behavior, the brief specifies the content each AC requires and nothing more. Do
+  not expand "test vectors", "examples", or "fixtures" into an executable model, a validator, or an
+  exhaustive corpus unless a criterion says so; an edge case beyond the criteria gets a documented limit,
+  not new mechanism.
 
 ## Output contract
 

package/agents/work-reviewer.md

@@ -78,6 +78,35 @@ When the subject is a **class-wide** requirement — one that **cannot be establ
 - **Precedence for late discoveries:** a genuinely required sink, policy, compatibility decision, migration, or test that is missing is a **blocker no matter which review round surfaces it** — record it once in `required_fixes`, carry it into every later review, and REJECT until observed evidence proves it landed. Only *unrelated* new scope or *optional* extra depth on already-decided rows is a non-blocking note; a required in-scope omission is never downgraded to optional just because it appeared in a later round.
 - **Feasibility rule:** reject a brief whose required behavior cannot be implemented within its allowed mechanisms, dependencies, compatibility constraints, or explicit non-goals — for example, demanding grammar-complete or adversarial-input recognition while forbidding every parser, new dependency, or bounded implementation strategy. Surface the smallest explicit dependency, scope, or design decision needed before builders start; do not approve an impossible implementation envelope as "decision-complete."
 
+## Specification subjects (documents, contracts, data artifacts)
+
+When the deliverable is a document or a data artifact — a specification, a contract, a protocol or
+topology description, a fixture corpus — rather than executable behavior, the class-wide rules above do
+not apply beyond what the acceptance criteria require. For code the in-scope members already exist in the
+repository, so enumerating them ends. For a document the members are whatever it chooses to specify, and
+each answer creates new surface to review; exhaustive enumeration and the late-discovery precedence rule
+then turn every fix into the next round's findings. Three contract runs in a row inflated this way (130k
+lines of corpus JSON, 25k lines of test vectors with a validator inside a Markdown file, a 72 KB
+topology document with its own SQL schemas and a quarantine system).
+One boundary decides everything beyond the criteria, in both directions: **does the content commit an
+implementer to build, store, or conform to something?** Call that an obligation.
+- **The bar is the acceptance criteria, not completeness.** A behavior an AC requires that the document
+  omits or gets wrong is a BLOCKER, in any round.
+- **Missing depth is not a finding.** Do not ask for an obligation no AC requires — deeper design,
+  internal schemas, tuning values, or handling for rare edge cases. Note it at most; never block on it.
+- **Added obligation beyond the criteria is a finding.** A schema, mechanism, subsystem, executable model,
+  or corpus that no AC requires, and that an implementer would have to build, store, or conform to, is
+  unapproved scope expansion: require it removed or reduced to a documented limit, the same way unapproved
+  scope in a brief is rejected. A reviewer that stops asking for more while accepting whatever the builder
+  adds unprompted has not stopped the ratchet.
+- **Explanatory depth is neither.** Rationale, worked examples, and clarification of a required behavior
+  add no obligation; accept them without comment.
+- **A documented limit satisfies an edge case.** "X is out of scope" or "behavior is undefined for X" is
+  an acceptable answer unless an AC requires X to be handled.
+- **No executable models by default.** A validator, generator, exhaustive corpus, or test vectors is an
+  obligation like any other: required only when an AC asks for one. Judge whether what is specified is
+  correct and consistent.
+
 ## What to check, by subject
 
 - **`work-decomposer` satisfiability:** for every slice, check that its ratified `test_plan` can be made
@@ -116,6 +145,9 @@ When the subject is a **class-wide** requirement — one that **cannot be establ
   - Code comments follow the target repository's documented policy; do not invent a blanket ban.
   - **Slice discipline:** the diff stays within the slice's `paths` (out-of-lane edits are a finding).
   - The slice's `acceptance` is actually implemented. This is never waived.
+  - A present `repository_verify` that did not exit zero is a BLOCKER: the repository's own verify
+    (lint, format, full suite) fails on this commit and will fail again after merge, where it cannot be
+    repaired. Name the failing check in `required_fixes`. An empty `test_plan` does not waive it.
   - The observed tests cover that acceptance — **unless the slice's ratified `test_plan` is empty**,
     which the plan decided at Gate 2 and which the workflow and `deriveReviewReady` both honour. A
     docs-only slice reviewed against tests it was ratified not to have is rejected forever; that

package/bin/factory.js

@@ -394,16 +394,23 @@ function bootstrapOutcome(worktree, config, phase) {
 }
 
 
+// Enforcement (#376): verify runs on a tree bootstrap has just prepared, the same way in every place it runs.
+// Bootstrap output is untracked, so a slice worktree never had it and a merge that changes what bootstrap
+// installs was verified against the dependencies from init. A verify that does not execute runs no bootstrap.
+function bootstrapBeforeVerify(worktree, config, phase) {
+  return config?.bootstrapCommand ? bootstrapOutcome(worktree, config, phase).refusal : null;
+}
+
 function branchPoint(run) {
   const base = run.slices.find((slice) => Array.isArray(slice.depends_on) && slice.depends_on.length === 0)?.base_ref;
   if (!/^[0-9a-f]{40}$/u.test(base ?? "")) throw new CliError("first seeded root slice has no immutable 40-character base_ref");
   return base;
 }
 
-async function writeObservedEvidence({ repo, runDir, runId, subject, attempt, branch, baseRef, worktree, status, blockedReason, claim, testCommand, skipReason, shellCommand, testTimeoutMs }) {
+async function writeObservedEvidence({ repo, runDir, runId, subject, attempt, branch, baseRef, worktree, status, blockedReason, claim, testCommand, skipReason, shellCommand, testTimeoutMs, repositoryVerify = null, reused = null }) {
   const evidence = buildEvidence({
     subject, attempt, branch, baseRef, worktree, status, blockedReason, claim, runId,
-    testCommand, skipReason, shellCommand, testTimeoutMs,
+    testCommand, skipReason, shellCommand, testTimeoutMs, repositoryVerify, reused,
   });
   const ancestry = observeAncestry(worktree, baseRef, "HEAD");
   if (ancestry !== "ancestor") {
@@ -420,7 +427,8 @@ async function writeObservedEvidence({ repo, runDir, runId, subject, attempt, br
 
 function canonicalRepositoryVerifyEvidence(evidence, { runId, run, integration, verifyCommand }) {
   const baseRef = branchPoint(run);
-  const keys = Object.keys(evidence).sort();
+  // `repository_verify` is slice-only: null on test-verifier evidence, absent on evidence written before #372.
+  const keys = Object.keys(evidence).filter((key) => !["repository_verify", "reused_from"].includes(key)).sort();
   const commandNames = [
     "git rev-parse HEAD",
     `git --literal-pathspecs diff --name-only -z ${baseRef}...HEAD`,
@@ -438,7 +446,9 @@ function canonicalRepositoryVerifyEvidence(evidence, { runId, run, integration,
     && ((tests.observed === true && Number.isInteger(tests.exit))
       || (tests.observed === false && tests.exit === null));
   const reconciliation = evidence.claim_reconciliation;
-  return JSON.stringify(keys) === JSON.stringify([...EVIDENCE_KEYS].sort())
+  return JSON.stringify(keys) === JSON.stringify(EVIDENCE_KEYS.filter((key) => !["repository_verify", "reused_from"].includes(key)).sort())
+    && (evidence.repository_verify ?? null) === null
+    && (evidence.reused_from === undefined || sameTree(integration.worktree, evidence.reused_from, evidence.commit))
     && evidence.subject === "test-verifier" && evidence.run_id === runId
     && Number.isSafeInteger(evidence.attempt) && evidence.attempt >= 1
     && evidence.branch === run.branch && evidence.base_ref === baseRef
@@ -521,16 +531,37 @@ function repositoryVerifyRetrySafety(repo, run, mergeCommit) {
   return integration;
 }
 
-async function runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeCommit, verify, integration }) {
+// Enforcement (#374): a post-merge verify is skipped only when the merge's tree is byte-identical to a slice
+// commit whose own repository verify ran the same command green -- the same bytes already passed. A tree
+// equality also implies the same committed `.factory.json`, so command and timeout cannot differ.
+function sameTree(worktree, left, right) {
+  const tree = (sha) => git(worktree, ["rev-parse", "--verify", `${sha}^{tree}`]);
+  const [a, b] = [tree(left), tree(right)];
+  return a.ok && b.ok && a.stdout.trim() === b.stdout.trim();
+}
+
+function reusableSliceVerify({ runDir, runId, ref, worktree, mergeCommit, command }) {
+  let evidence;
+  try { evidence = readEvidence(runDir, ref, { runId }); } catch { return null; }
+  const verified = evidence.repository_verify;
+  if (!verified || verified.observed !== true || verified.exit !== 0 || verified.cmd !== command) return null;
+  if (!sameTree(worktree, evidence.commit, mergeCommit)) return null;
+  return { commit: evidence.commit, tests: { cmd: command, exit: 0, observed: true, skipped_reason: null } };
+}
+
+async function runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeCommit, verify, integration, reused = null }) {
   const baseRef = branchPoint(run);
   let attemptIntegration = integration;
   // False-green enforcement: one invocation gets at most two executions, never an unbounded recovery loop.
   for (let attempt = 1; attempt <= 2; attempt += 1) {
+    // Every execution is freshly bootstrapped, the retry included; a reused result executes nothing (#376).
+    const refusal = attempt === 1 && reused ? null : bootstrapBeforeVerify(attemptIntegration.worktree, verify, "post-merge verify");
+    if (refusal) throw new CliError(`${refusal} after recorded merge ${mergeCommit}; merged slice remains recorded; stop before advancing.`);
     const { evidence } = await writeObservedEvidence({
       repo, runDir, runId, subject: "test-verifier", attempt, branch: run.branch,
       baseRef, worktree: attemptIntegration.worktree, status: "completed", blockedReason: null,
       claim: null, testCommand: verify.command, skipReason: null, shellCommand: true,
-      testTimeoutMs: verify.timeoutMs,
+      testTimeoutMs: verify.timeoutMs, reused: attempt === 1 ? reused : null,
     });
     const classified = classifyRepositoryVerifyEvidence(runDir, {
       runId, run, integration: attemptIntegration, verifyCommand: verify.command,
@@ -544,7 +575,7 @@ async function runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeComm
   return null;
 }
 
-async function verifyRecordedMerge({ repo, runDir, runId, mergeCommit }) {
+async function verifyRecordedMerge({ repo, runDir, runId, mergeCommit, sliceEvidenceRef = null }) {
   const run = readRun(runDir);
   const integration = requireIntegrationWorktree(repo, run, run.worktree);
   if (integration.head !== mergeCommit) {
@@ -560,7 +591,9 @@ async function verifyRecordedMerge({ repo, runDir, runId, mergeCommit }) {
     throw error;
   }
   if (verify === null) return null;
-  return runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeCommit, verify, integration });
+  const reused = sliceEvidenceRef && reusableSliceVerify({ runDir, runId, ref: sliceEvidenceRef,
+    worktree: integration.worktree, mergeCommit, command: verify.command });
+  return runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeCommit, verify, integration, reused });
 }
 
 const HANDLERS = {
@@ -1090,7 +1123,7 @@ const HANDLERS = {
     // step needs it: `observe --base` is compared for exact equality against this value at
     // merge time. The skill previously said to read it from `factory status`, which does not
     // expose it — so the documented path could not be followed at all.
-    if (status === "merged") await verifyRecordedMerge({ repo, runDir, runId, mergeCommit: row.merge_commit });
+    if (status === "merged") await verifyRecordedMerge({ repo, runDir, runId, mergeCommit: row.merge_commit, sliceEvidenceRef: row.evidence_ref });
     // Slice attempts are budgeted the same way, so their rejected verdicts vanish the same way.
     const sliceReviewArchive = await archiveReviewAttempt(runDir, retryReviewRef ?? row.review_ref);
     await archiveReviewAttempt(runDir, retryEvidenceRef ?? row.evidence_ref);
@@ -1124,6 +1157,8 @@ const HANDLERS = {
         if (error instanceof RepositoryConfigError) throw new CliError(error.message);
         throw error;
       }
+      const refusal = bootstrapBeforeVerify(worktree, repositoryVerify, "repository verification");
+      if (refusal) throw new CliError(refusal);
     }
 
     let claim = null;
@@ -1166,6 +1201,14 @@ const HANDLERS = {
         + `expected ${JSON.stringify(slice.test_plan)}; received ${JSON.stringify(flags.testCmd)}`,
       );
     }
+    // A slice also runs the configured repository `verify`, read from its own committed config (#372).
+    let sliceVerify = null;
+    if (slice) {
+      try { sliceVerify = readRepositoryConfig(worktree, { optional: true }); } catch (error) {
+        if (error instanceof RepositoryConfigError) throw new CliError(error.message);
+        throw error;
+      }
+    }
     const skipReason = slice && slice.test_plan.length === 0
       ? `test_plan for '${subject}' was approved empty at slices-seed`
       : null;
@@ -1179,12 +1222,15 @@ const HANDLERS = {
       testCommand: flags.repositoryVerify ? repositoryVerify.command : flags.testCmd ? flags.testCmd.split(" ").filter(Boolean) : null,
       skipReason, shellCommand: flags.repositoryVerify === true,
       testTimeoutMs: flags.repositoryVerify ? repositoryVerify.timeoutMs : undefined,
+      repositoryVerify: sliceVerify && { command: sliceVerify.command, timeoutMs: sliceVerify.timeoutMs,
+        prepare: () => bootstrapBeforeVerify(worktree, sliceVerify, "slice observation") },
     });
     return emit(flags, {
       run_id: runId, subject, evidence_ref: evidenceRef(subject),
       review_ready: evidence.review_ready, files_changed: evidence.files_changed.length,
       tests: evidence.tests.observed ? `exit ${evidence.tests.exit}` : `skipped: ${evidence.tests.skipped_reason}`,
       ancestry, mismatches: evidence.claim_reconciliation.mismatches.map((entry) => entry.field),
+      repository_verify: evidence.repository_verify && (evidence.repository_verify.observed ? `exit ${evidence.repository_verify.exit}` : "not run"),
     });
   },
   async init(positional, flags) {

package/observe/index.js

@@ -14,7 +14,7 @@ export const EVIDENCE_KEYS = Object.freeze([
   "subject", "run_id", "attempt", "branch", "base_ref", "worktree", "status", "blocked_reason",
   "worktree_clean",
   "files_changed", "diff_stat", "diff_observed", "commands", "tests", "commit",
-  "observed_by", "review_ready", "claim_reconciliation",
+  "observed_by", "review_ready", "claim_reconciliation", "repository_verify", "reused_from",
 ]);
 
 export function git(cwd, args, { runner = spawnSync } = {}) {
@@ -109,7 +109,7 @@ export function observeAncestry(worktree, ancestor, descendant, options = {}) {
 // Attack 1: the test command is run here, by us, and its exit code is recorded
 // from the process rather than from anybody's report. `observed: false` means we
 // could not run it, which is not the same as a pass.
-export function runTests(worktree, command, { runner = spawnSync, skipReason = null, shellCommand = false, timeoutMs = DEFAULT_REPOSITORY_VERIFY_TIMEOUT_MS } = {}) {
+export function runTests(worktree, command, { runner = spawnSync, skipReason = null, shellCommand = false, timeoutMs = DEFAULT_REPOSITORY_VERIFY_TIMEOUT_MS, stdio = "inherit", env = process.env } = {}) {
   if (!command) {
     // Finding 1: defaulting a skip reason let omission manufacture review readiness.
     // Tests must be observed green or explicitly skipped with a caller-declared reason;
@@ -117,7 +117,7 @@ export function runTests(worktree, command, { runner = spawnSync, skipReason = n
     return { cmd: null, exit: null, observed: false, skipped_reason: skipReason };
   }
   const result = shellCommand
-    ? runner(command, [], { cwd: worktree, shell: true, stdio: "inherit", env: process.env, timeout: timeoutMs })
+    ? runner(command, [], { cwd: worktree, shell: true, stdio, env, timeout: timeoutMs })
     : runner(command[0], command.slice(1), { cwd: worktree, encoding: "utf8", shell: false });
   const exit = Number.isInteger(result?.status) ? result.status : null;
   return { cmd: shellCommand ? command : command.join(" "), exit, observed: exit !== null, skipped_reason: null };
@@ -133,6 +133,9 @@ export function deriveReviewReady(evidence) {
   // function alone; with the term only at write time, every mismatched record read back as
   // tampered and wedged its slice where `slice blocked` could never record it.
   if (evidence.claim_reconciliation?.mismatches?.length > 0) return false;
+  // Absent on evidence written before #372, and null when no `verify` is configured.
+  const verify = evidence.repository_verify;
+  if (verify && !(verify.observed === true && verify.exit === 0)) return false;
   // A tree with uncommitted changes cannot produce evidence about the commit it
   // claims, whatever the tests said.
   if (evidence.worktree_clean !== true) return false;
@@ -201,7 +204,7 @@ export function privilegedPaths(filesChanged) {
     || PRIVILEGED_EXACT.includes(file));
 }
 
-export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktree, status, blockedReason = null, claim = null, testCommand = null, skipReason = null, shellCommand = false, testTimeoutMs = DEFAULT_REPOSITORY_VERIFY_TIMEOUT_MS, options = {} }) {
+export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktree, status, blockedReason = null, claim = null, testCommand = null, skipReason = null, shellCommand = false, testTimeoutMs = DEFAULT_REPOSITORY_VERIFY_TIMEOUT_MS, repositoryVerify = null, reused = null, options = {} }) {
   // Cleanliness is established before anything else is observed, because every later
   // fact - the diff, the commit, and above all the test result - is only about the
   // recorded commit if the tree has nothing uncommitted in it.
@@ -209,9 +212,27 @@ export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktr
   const observation = observeWorktree(worktree, baseRef, options);
   // Tests are not run at all against a dirty tree: running them would produce a
   // result about bytes that are not going to merge.
-  const tests = cleanliness.clean
-    ? runTests(worktree, testCommand, { ...options, skipReason, shellCommand, timeoutMs: testTimeoutMs })
+  // `reused` carries a slice's green repository verify for a merge whose tree is byte-identical (#374).
+  const tests = cleanliness.clean && reused ? reused.tests : cleanliness.clean
+    ? runTests(worktree, testCommand, { ...options, skipReason, shellCommand, timeoutMs: testTimeoutMs,
+      // Output to stderr, stdin inherited: `slice merged --json` and `observe --json` stay one JSON object.
+      ...(shellCommand ? { stdio: ["inherit", 2, 2] } : {}) })
     : { cmd: testCommand ? (shellCommand ? testCommand : testCommand.join(" ")) : null, exit: null, observed: false, skipped_reason: null };
+  // Enforcement (false green, #372): a slice ran only its ratified test command, so the repository's
+  // configured `verify` (lint, format, full suite) first ran after merge, where production repair is
+  // forbidden and one Clippy warning parked a 13-slice run. The same suite now runs on the slice's commit.
+  // Skipped after a failing test run, which is already not review-ready; its output goes to stderr so
+  // `observe --json` stays one JSON object. A bootstrap refusal (#376) means the tree is not prepared, so the
+  // verify does not run and the refusal is the evidence's blocked reason.
+  // Bootstrap is the verify's own first step (#376 review): it runs only when the verify will, and after the
+  // ratified test, so nothing the test does can remove its output before the verify reads it.
+  const eligible = repositoryVerify && cleanliness.clean && !(tests.observed && tests.exit !== 0);
+  const bootstrapRefusal = eligible ? repositoryVerify.prepare?.() ?? null : null;
+  const verifyRuns = eligible && !bootstrapRefusal;
+  const verified = !repositoryVerify ? null : verifyRuns
+    ? (({ cmd, exit, observed }) => ({ cmd, exit, observed }))(runTests(worktree, repositoryVerify.command,
+      { ...options, shellCommand: true, timeoutMs: repositoryVerify.timeoutMs, stdio: ["ignore", 2, 2] }))
+    : { cmd: repositoryVerify.command, exit: null, observed: false };
 
   // Third round, finding 1: cleanliness was a pre-test snapshot, so a test that wrote
   // tracked files left the tree dirty while the evidence still claimed a clean HEAD -
@@ -242,7 +263,8 @@ export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktr
     base_ref: baseRef,
     worktree,
     status,
-    blocked_reason: blockedReason ?? cleanliness.reason ?? (stableUnderTest ? null : "worktree changed while the tests ran"),
+    blocked_reason: blockedReason ?? cleanliness.reason ?? bootstrapRefusal
+      ?? (stableUnderTest ? null : "worktree changed while the tests ran"),
     // Named for what it asserts: clean before the run, still clean after, and HEAD did
     // not move. A pre-test snapshot alone was not enough.
     worktree_clean: stableUnderTest,
@@ -255,6 +277,8 @@ export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktr
     observed_by: "orchestrator",
     review_ready: false,
     claim_reconciliation: { claimed: false, mismatches: [] },
+    repository_verify: verified,
+    ...(reused ? { reused_from: reused.commit } : {}),
   };
   evidence.claim_reconciliation = reconcileClaim(claim, evidence);
   evidence.review_ready = deriveReviewReady(evidence);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feature-factory",
-  "version": "0.10.6",
+  "version": "0.10.8",
   "description": "Durable, observed control plane for /feature runs. Host-agnostic: no opencode dependency.",
   "type": "module",
   "license": "MIT",