feature-factory 0.7.0 → 0.7.1

package/WORKFLOW.md

@@ -887,7 +887,14 @@ The first successful seed is the **ratification point** for two decisions:
   per-merge proof and verification are what keep that safe.
 - `test_plan` — the exact executable commands authorized to prove the slice. Each non-empty entry is
   one complete, independently sufficient command string that must be supplied verbatim as one
-  `--test-cmd` value. A slice with a non-empty `test_plan` is not `review_ready` until one ratified
+  `--test-cmd` value. Each entry is executed as argv split on single spaces with no shell, so a shell
+  operator, a quote that groups an argument, a substitution or a redirection is inert payload or a hard
+  failure rather than syntax, and seeding refuses an entry it cannot execute that way. Entries
+  are alternatives, not a sequence: a slice needing several commands to run in order names one script
+  committed in the repository. `argv[0]` is resolved against the repository when the plan is seeded, before
+  any slice has implemented anything, so a script the work itself creates cannot be `argv[0]`: name an
+  interpreter that already resolves and pass the script as an argument, as in `sh scripts/verify-all.sh`.
+  A slice with a non-empty `test_plan` is not `review_ready` until one ratified
   command exits zero. A slice with an **empty** `test_plan` is exempt. That exemption is a decision for
   the engineer at Gate 2, so decide it in the plan and present it: there is no flag that waives tests at
   observation time.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feature-factory",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Durable, observed control plane for /feature runs. Host-agnostic: no opencode dependency.",
   "type": "module",
   "license": "MIT",

package/state/review-archive.js

@@ -25,8 +25,20 @@ export function attemptArchiveRef(ref, attempt) {
   return join(dir === "." ? "" : dir, `${stem}.attempt-${attempt}.json`);
 }
 
+// An archive has nothing to preserve: its content is already the frozen copy. Handed one anyway --
+// run 1551 reported an archive path back as `--review-ref`, and the suffix was appended twice, leaving
+// `spec-writer.attempt-1.attempt-1.json` beside the real archive with identical bytes. Harmless to
+// state, because the live record is untouched and `createOnly` protects the genuine archive, but the
+// reviews directory is the one place an operator reads to reconstruct why a run blocked, and a file
+// naming an attempt of an attempt invites them to look for a second verdict that does not exist.
+//
+// Instruction, not enforcement, and a no-op rather than a refusal: this module must never fail the
+// step that earned the verdict, which is the contract stated at the top of this file.
+const ARCHIVE_REF = /\.attempt-\d+\.json$/u;
+
 export async function archiveReviewAttempt(runDir, ref) {
   if (typeof ref !== "string" || !ref.trim()) return null;
+  if (ARCHIVE_REF.test(ref)) return null;
   let record;
   try {
     record = JSON.parse(readFileSync(join(runDir, ref), "utf8"));