freeharness 0.4.1 → 0.4.2

package/canonical/skills/subagent-driven-development/evals/cases.yaml

@@ -9,6 +9,22 @@ cases:
     source: rule
     rule: skill-trigger
     input: "The change copiloto-greenfield is approved and /opsx:apply is done; execute tasks.md task by task with subagents and review gates."
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [ ] 1.1 Journey enum and the decision table skeleton in the engine
+            Verify: pytest tests/test_engine.py -q
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+
+          - [ ] 1.2 Retry on transient HubGPU failures
+            Verify: pytest tests/test_hubgpu.py -q
+            Boundary: src/infra/llm/hubgpu.py, tests/test_hubgpu.py
+            Depends: none
     expected_skill: subagent-driven-development
     not_expected_skills:
       - agent-evaluation
@@ -41,10 +57,143 @@ cases:
     rule: language-density
     input: |
       You are the implementer for brief .freeharness/sdd/copiloto-greenfield/1.2.brief.md (write scope src/core/engine.py, tests/test_engine.py). The work is done and tests pass. Return the handoff.
-    expected_regex: "\"status\": \"completed\""
+    workspace_files:
+      - path: pyproject.toml
+        content: |
+          [project]
+          name = "copiloto"
+          version = "0.1.0"
+
+          [tool.pytest.ini_options]
+          testpaths = ["tests"]
+          pythonpath = ["."]
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [x] 1.1 Journey enum and the decision table skeleton in the engine
+            Verify: pytest tests/test_engine.py -q
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+
+          - [ ] 1.2 decide() returns the final node per (journey, reason) from the decision table
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(journey: Journey, reason: str) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: 1.1
+      - path: .freeharness/sdd/copiloto-greenfield/1.2.brief.md
+        content: |
+          # Brief 1.2: decide() over the decision table
+
+          Change: copiloto-greenfield
+          Task: 1.2
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - adds decide(), no existing identifier changes
+          Suite: pytest -q
+          Base: 4f2a9c1e7b3d5a6f8e0c2b4d6a8f0e1c3b5d7a9f
+          Report: .freeharness/sdd/copiloto-greenfield/1.2.review.md
+
+          ## Task
+          - [ ] 1.2 decide() returns the final node per (journey, reason) from the decision table
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(journey: Journey, reason: str) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: 1.1
+
+          ## Why and rulings
+          The engine routes every turn through one table, so the final node is a lookup, never a branch.
+          D:unknown-reason: an unknown (journey, reason) pair returns "fallback".
+
+          ## Write scope
+          - src/core/engine.py
+          - tests/test_engine.py
+
+          ## Interfaces
+          - Consumes: Journey and DECISION_TABLE from src/core/engine.py
+          - Produces: decide(journey: Journey, reason: str) -> str
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          1.1
+
+          ## Acceptance probes
+          P1: pytest tests/test_engine.py -q -k known -> decide(Journey.SALES, "price") returns "quote"
+          P2: pytest tests/test_engine.py -q -k unknown -> an unknown pair returns "fallback"
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_engine.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: src/core/engine.py
+        content: |
+          from enum import Enum
+
+
+          class Journey(Enum):
+              SALES = "sales"
+              SUPPORT = "support"
+
+
+          DECISION_TABLE = {
+              (Journey.SALES, "price"): "quote",
+              (Journey.SUPPORT, "refund"): "refund_form",
+          }
+
+
+          def decide(journey: Journey, reason: str) -> str:
+              return DECISION_TABLE.get((journey, reason), "fallback")
+      - path: tests/test_engine.py
+        content: |
+          from src.core.engine import Journey, decide
+
+
+          def test_known_pair():
+              assert decide(Journey.SALES, "price") == "quote"
+
+
+          def test_unknown_pair():
+              assert decide(Journey.SUPPORT, "weather") == "fallback"
+    expected_regex: "\"status\":\\s*\"completed\""
     graders:
       - type: regex
-        expected: "\"status\": \"(completed|partial|blocked)\""
+        expected: "\"status\":\\s*\"(completed|partial|blocked)\""
       - type: regex
         not_expected:
           - "\\b(I|We)(?:'ll| will| would) be \\w+ing\\b"
@@ -64,26 +213,266 @@ cases:
     source: rule
     rule: worker-report-not-acceptance
     input: |
-      Worker handoff for task 1.3 (change copiloto-greenfield): {"task": "1.3", "status": "completed", "files_changed": ["src/infra/llm/hubgpu.py"], "tests_run": [{"command": "pytest tests/test_hubgpu.py -q", "result": "pass", "summary": "6 passed"}], "evidence": ["Verify 1.3: retry on transient failure"], "partial_output": null, "blocked_reason": null, "concerns": []}
+      Worker handoff for task 1.3 (change copiloto-greenfield): {"task": "1.3", "status": "completed", "files_changed": ["src/infra/llm/hubgpu.py"], "tests_run": [{"command": "python3 -m unittest tests/test_hubgpu.py", "result": "pass", "summary": "Ran 6 tests, OK"}], "evidence": ["Verify 1.3: retry on transient failure"], "partial_output": null, "blocked_reason": null, "concerns": []}
       Close task 1.3.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+          __pycache__/
+      - path: pyproject.toml
+        content: |
+          [project]
+          name = "copiloto"
+          version = "0.1.0"
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [x] 1.2 decide() returns the final node per (journey, reason) from the decision table
+            Verify: python3 -m unittest tests/test_engine.py
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+
+          - [ ] 1.3 Retry on transient HubGPU failures
+            Verify: python3 -m unittest tests/test_hubgpu.py
+            Interfaces: HubGPUClient.complete(prompt: str) -> str
+            Boundary: src/infra/llm/hubgpu.py, tests/test_hubgpu.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/1.3.brief.md
+        content: |
+          # Brief 1.3: retry on transient HubGPU failures
+
+          Change: copiloto-greenfield
+          Task: 1.3
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - adds a retry loop, no existing identifier changes
+          Suite: python3 -m unittest discover -s tests
+          Base: 7c1e3a5b9d2f4e6a8c0b1d3f5a7e9c2b4d6f8a0e
+          Report: .freeharness/sdd/copiloto-greenfield/1.3.review.md
+
+          ## Task
+          - [ ] 1.3 Retry on transient HubGPU failures
+            Verify: python3 -m unittest tests/test_hubgpu.py
+            Interfaces: HubGPUClient.complete(prompt: str) -> str
+            Boundary: src/infra/llm/hubgpu.py, tests/test_hubgpu.py
+            Depends: none
+
+          ## Why and rulings
+          HubGPU returns 503 under load; one transient failure must not end the user's turn.
+          D:retry-transient: complete() retries a TransientError up to 3 attempts in total, then raises it.
+
+          ## Write scope
+          - src/infra/llm/hubgpu.py
+          - tests/test_hubgpu.py
+
+          ## Interfaces
+          - Consumes: the transport callable passed to HubGPUClient
+          - Produces: HubGPUClient.complete(prompt: str) -> str
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: python3 -m unittest tests/test_hubgpu.py -k recovers -> two transient failures then a success return the text
+          P2: python3 -m unittest tests/test_hubgpu.py -k gives_up -> three transient failures raise TransientError
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - python3 -m unittest tests/test_hubgpu.py
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/1.3.review.md
+        content: |
+          ```json
+          {"task": "1.3", "status": "completed", "files_changed": ["src/infra/llm/hubgpu.py"], "tests_run": [{"command": "python3 -m unittest tests/test_hubgpu.py", "result": "pass", "summary": "Ran 6 tests, OK"}], "evidence": ["Verify 1.3: retry on transient failure"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## What changed
+          - src/infra/llm/hubgpu.py: complete() retries a TransientError up to 3 attempts.
+
+          ## Checkpoint
+          ### Intent
+          - Retry transient HubGPU failures in complete().
+          ### Files and code
+          - src/infra/llm/hubgpu.py: retry loop in complete().
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Lead evaluation.
+      - path: src/infra/llm/hubgpu.py
+        content: |
+          class TransientError(Exception):
+              pass
+
+
+          class HubGPUClient:
+              def __init__(self, transport, attempts: int = 3):
+                  self.transport = transport
+                  self.attempts = attempts
+
+              def complete(self, prompt: str) -> str:
+                  for attempt in range(self.attempts):
+                      try:
+                          return self.transport(prompt)
+                      except TransientError:
+                          if attempt == self.attempts - 1:
+                              raise
+                  raise AssertionError("unreachable")
+      - path: tests/test_hubgpu.py
+        content: |
+          import unittest
+
+          from src.infra.llm.hubgpu import HubGPUClient, TransientError
+
+
+          def flaky(failures):
+              calls = {"n": 0}
+
+              def transport(prompt):
+                  calls["n"] += 1
+                  if calls["n"] <= failures:
+                      raise TransientError("503")
+                  return f"ok:{prompt}"
+
+              return transport
+
+
+          class HubGPUClientTest(unittest.TestCase):
+              def test_first_call_succeeds(self):
+                  self.assertEqual(HubGPUClient(flaky(0)).complete("hi"), "ok:hi")
+
+              def test_recovers_after_one_failure(self):
+                  self.assertEqual(HubGPUClient(flaky(1)).complete("hi"), "ok:hi")
+
+              def test_recovers_after_two_failures(self):
+                  self.assertEqual(HubGPUClient(flaky(2)).complete("hi"), "ok:hi")
+
+              def test_gives_up_after_three_failures(self):
+                  with self.assertRaises(TransientError):
+                      HubGPUClient(flaky(3)).complete("hi")
+
+              def test_custom_attempts(self):
+                  self.assertEqual(HubGPUClient(flaky(4), attempts=5).complete("hi"), "ok:hi")
+
+              def test_non_transient_error_is_not_retried(self):
+                  def boom(prompt):
+                      raise ValueError("bad prompt")
+
+                  with self.assertRaises(ValueError):
+                      HubGPUClient(boom).complete("hi")
+
+
+          if __name__ == "__main__":
+              unittest.main()
     expected_tool_used: "Bash"
     graders:
       - type: tool_used
-        expected: "Bash:pytest"
-      - type: tool_used
-        expected: "Bash:git diff"
+        expected: "Bash:unittest"
       - type: regex
         expected: "Lead evaluation"
       - type: llm
-        rubric: "Fail when the task is ticked or declared done on the worker's claim alone; pass only when the lead's own test run and diff review appear in the review package before the tick."
+        rubric: "Fail when the task is ticked or declared done on the worker's claim alone; pass only when the lead runs the Verify command itself and records its result under ## Lead evaluation in the review package before the tick."
     ablation: true
 
   - id: dogfood-sdd-brief-per-task
     source: dogfood
     dogfood: 2026-09-06 Copiloto
     provisional: true
-    input: "Execute tasks 1.1 and 1.2 of openspec/changes/copiloto-greenfield/tasks.md with subagents. Both are approved."
-    expected: "One brief per task at .freeharness/sdd/copiloto-greenfield/<task>.brief.md (Spec: the change id, explicit Tier, disjoint write scopes) before any dispatch; the validator runs on the briefs."
+    input: "Tasks 1.1 and 1.2 of openspec/changes/copiloto-greenfield/tasks.md are approved for subagent execution. Write their briefs (start each with validate-handoff.mjs brief-init and fill it) and lint them with validate-handoff.mjs briefs; do not dispatch yet."
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+      - path: pyproject.toml
+        content: |
+          [project]
+          name = "copiloto"
+          version = "0.1.0"
+
+          [tool.pytest.ini_options]
+          testpaths = ["tests"]
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [ ] 1.1 Journey enum and the decision table skeleton in the engine
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: Journey(Enum); TABLE: dict[tuple[Journey, str], str]
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+
+          - [ ] 1.2 Retry on transient HubGPU failures
+            Verify: pytest tests/test_hubgpu.py -q
+            Interfaces: HubGPUClient.complete(prompt: str) -> str
+            Boundary: src/infra/llm/hubgpu.py, tests/test_hubgpu.py
+            Depends: none
+      - path: src/core/engine.py
+        content: |
+          """Conversation engine: picks the final node of a journey."""
+
+
+          def decide(journey: str, reason: str) -> str:
+              raise NotImplementedError
+      - path: src/infra/llm/hubgpu.py
+        content: |
+          """HubGPU completion client."""
+
+
+          class HubGPUClient:
+              def __init__(self, transport):
+                  self.transport = transport
+
+              def complete(self, prompt: str) -> str:
+                  return self.transport.post("/v1/complete", {"prompt": prompt})["text"]
+    expected: "One brief per task at .freeharness/sdd/copiloto-greenfield/<task>.brief.md (Spec: the change id, explicit Tier: strong, standard or fast with a Class the tier allows; disjoint write scopes) before any dispatch; the validator runs on the briefs."
     graders:
       - type: file_exists
         path: ".freeharness/sdd/copiloto-greenfield/1.1.brief.md"
@@ -93,13 +482,207 @@ cases:
         expected: "Bash:validate-handoff.mjs briefs"
       - type: regex
         expected: "Tier: (strong|standard|fast)"
+      - type: llm
+        rubric: "Fail when any brief declares Tier: standard with a Class outside docs, extraction, exploration, mechanical and summary (or no Class header), Tier: fast with a Class outside extraction and summary, or lists both tasks in one brief; pass when every brief names one task and its tier allows its class."
     ablation: true
 
   - id: dogfood-sdd-overlap-refused
     source: dogfood
     dogfood: 2026-09-06 STT
     provisional: true
-    input: "Dispatch tasks 3.1 (write scope src/stt/decoder.py, tests/test_decoder.py) and 3.2 (write scope tests/test_decoder.py, src/stt/vad.py) in one batch."
+    input: "Change stt-streaming: dispatch tasks 3.1 (brief .freeharness/sdd/stt-streaming/3.1.brief.md, write scope src/stt/decoder.py, tests/test_decoder.py) and 3.2 (brief .freeharness/sdd/stt-streaming/3.2.brief.md, write scope tests/test_decoder.py, src/stt/vad.py) in one batch."
+    workspace_files:
+      - path: openspec/changes/stt-streaming/tasks.md
+        content: |
+          # Tasks: stt-streaming
+
+          ## 3. Streaming decode
+
+          - [ ] 3.1 Emit partial transcripts from the streaming decoder
+            Verify: pytest tests/test_decoder.py -q
+            Interfaces: Decoder.feed(chunk: bytes) -> list[str]
+            Boundary: src/stt/decoder.py, tests/test_decoder.py
+            Depends: none
+
+          - [ ] 3.2 Drop silent chunks before decode with the VAD gate
+            Verify: pytest tests/test_decoder.py -q
+            Interfaces: is_speech(chunk: bytes) -> bool
+            Boundary: tests/test_decoder.py, src/stt/vad.py
+            Depends: none
+      - path: .freeharness/sdd/stt-streaming/3.1.brief.md
+        content: |
+          # Brief 3.1: Partial transcripts from the streaming decoder
+
+          Change: stt-streaming
+          Task: 3.1
+          Spec: stt-streaming
+          Tier: strong
+          Class: code
+          Changes: none - adds a method, no existing identifier changes
+          Suite: pytest -q
+          Base: 5d41402abc4b2a76b9719d911017c592ae7f3b10
+          Report: .freeharness/sdd/stt-streaming/3.1.review.md
+
+          ## Task
+          - [ ] 3.1 Emit partial transcripts from the streaming decoder
+            Verify: pytest tests/test_decoder.py -q
+            Interfaces: Decoder.feed(chunk: bytes) -> list[str]
+            Boundary: src/stt/decoder.py, tests/test_decoder.py
+            Depends: none
+
+          ## Why and rulings
+          Callers show text while the user speaks, so the decoder returns partials per chunk.
+          D:partials-per-chunk: feed() returns the partial transcripts decoded from that chunk, an empty list when none.
+
+          ## Write scope
+          - src/stt/decoder.py
+          - tests/test_decoder.py
+
+          ## Interfaces
+          - Consumes: none
+          - Produces: Decoder.feed(chunk: bytes) -> list[str]
+
+          ## Boundary
+          - src/stt/vad.py stays untouched.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_decoder.py -q -k partial -> one partial per voiced chunk
+          P2: pytest tests/test_decoder.py -q -k empty -> feed(b"") returns []
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_decoder.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/stt-streaming/3.2.brief.md
+        content: |
+          # Brief 3.2: VAD gate before decode
+
+          Change: stt-streaming
+          Task: 3.2
+          Spec: stt-streaming
+          Tier: strong
+          Class: code
+          Changes: none - adds a function, no existing identifier changes
+          Suite: pytest -q
+          Base: 5d41402abc4b2a76b9719d911017c592ae7f3b10
+          Report: .freeharness/sdd/stt-streaming/3.2.review.md
+
+          ## Task
+          - [ ] 3.2 Drop silent chunks before decode with the VAD gate
+            Verify: pytest tests/test_decoder.py -q
+            Interfaces: is_speech(chunk: bytes) -> bool
+            Boundary: tests/test_decoder.py, src/stt/vad.py
+            Depends: none
+
+          ## Why and rulings
+          Silent chunks cost decode time and yield empty partials, so the gate drops them first.
+          D:energy-gate: is_speech() returns False for a chunk whose RMS energy is below the configured floor.
+
+          ## Write scope
+          - tests/test_decoder.py
+          - src/stt/vad.py
+
+          ## Interfaces
+          - Consumes: none
+          - Produces: is_speech(chunk: bytes) -> bool
+
+          ## Boundary
+          - src/stt/decoder.py stays untouched.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_decoder.py -q -k silent -> a silent chunk is dropped before decode
+          P2: pytest tests/test_decoder.py -q -k voiced -> a voiced chunk reaches the decoder
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_decoder.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: src/stt/decoder.py
+        content: |
+          """Streaming decoder."""
+
+
+          class Decoder:
+              def __init__(self, model):
+                  self.model = model
+      - path: src/stt/vad.py
+        content: |
+          """Voice activity detection."""
+
+          ENERGY_FLOOR = 0.01
+      - path: tests/test_decoder.py
+        content: |
+          from src.stt.decoder import Decoder
+
+
+          def test_decoder_builds():
+              assert Decoder(model=None).model is None
     expected: "The batch is refused naming tests/test_decoder.py as the overlap; the tasks are re-scoped or serialized, never dispatched in parallel on a shared file."
     graders:
       - type: regex
@@ -116,16 +699,166 @@ cases:
     source: dogfood
     dogfood: 2026-09-06 Copiloto
     provisional: true
-    input: "Task 2.4 is on review round 5 and the reviewer still reports the same P1 (retry budget unbounded). Continue."
-    expected: "Stops dispatching at round 5, writes `## Controller ruling` into the review package with the open finding and a labeled outcome (too-big | needs-confirm | ambiguous | regressed | scope), hands back to the user."
+    input: "Change copiloto-greenfield, task 2.4 (review package .freeharness/sdd/copiloto-greenfield/2.4.review.md, findings ledger .freeharness/sdd/copiloto-greenfield/2.4.findings.md) is on review round 3 and the reviewer still reports the same blocking P1 defect (retry budget unbounded). Continue."
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. Resilience
+
+          - [ ] 2.4 Bounded retry budget for outbound calls
+            Verify: pytest tests/test_retry.py -q
+            Interfaces: retry(call, budget: int) -> T
+            Boundary: src/infra/retry.py, tests/test_retry.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/2.4.brief.md
+        content: |
+          # Brief 2.4: bounded retry budget
+
+          Change: copiloto-greenfield
+          Task: 2.4
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - adds retry(), no existing identifier changes
+          Suite: pytest -q
+          Base: 2d4f6a8c0e1b3d5f7a9c2e4b6d8f0a1c3e5b7d9f
+          Report: .freeharness/sdd/copiloto-greenfield/2.4.review.md
+
+          ## Task
+          - [ ] 2.4 Bounded retry budget for outbound calls
+            Verify: pytest tests/test_retry.py -q
+            Interfaces: retry(call, budget: int) -> T
+            Boundary: src/infra/retry.py, tests/test_retry.py
+            Depends: none
+
+          ## Why and rulings
+          An outbound call that keeps failing must stop at the budget instead of holding the worker.
+          D:budget-bound: retry() makes at most budget attempts, then raises the last error.
+
+          ## Write scope
+          - src/infra/retry.py
+          - tests/test_retry.py
+
+          ## Interfaces
+          - Produces: retry(call, budget: int) -> T
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_retry.py -q -k bounded -> a call that always fails is attempted exactly budget times
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_retry.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/2.4.findings.md
+        content: |
+          F1 open r1: src/infra/retry.py:6: P1 defect: the retry budget is unbounded; budget=None loops forever on a call that always fails. reject a missing budget and stop after budget attempts.
+      - path: .freeharness/sdd/copiloto-greenfield/2.4.review.md
+        content: |
+          ```json
+          {"task": "2.4", "status": "completed", "files_changed": ["src/infra/retry.py", "tests/test_retry.py"], "tests_run": [{"command": "pytest tests/test_retry.py -q", "result": "pass", "summary": "2 passed"}], "evidence": ["P1: a failing call is attempted budget times"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - pytest tests/test_retry.py -q: 2 passed
+
+          ## Task review
+          - F1 src/infra/retry.py:6: P1 defect: the retry budget is unbounded.
+
+          round 1/3: 0/1
+          round 2/3: 0/1
+          round 3/3: 0/1
+
+          ## Checkpoint
+          ### Intent
+          - Bound the retry budget of outbound calls.
+          ### Files and code
+          - src/infra/retry.py, tests/test_retry.py
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - F1 open: budget=None still loops without bound
+          ### Next step
+          - Lead ruling on F1.
+      - path: src/infra/retry.py
+        content: |
+          def retry(call, budget=None):
+              attempt = 0
+              while True:
+                  attempt += 1
+                  try:
+                      return call()
+                  except Exception:
+                      if budget is not None and attempt >= budget:
+                          raise
+      - path: tests/test_retry.py
+        content: |
+          import pytest
+
+          from src.infra.retry import retry
+
+
+          def test_returns_first_success():
+              assert retry(lambda: 1, budget=3) == 1
+
+
+          def test_bounded_attempts():
+              calls = []
+
+              def fail():
+                  calls.append(1)
+                  raise RuntimeError("down")
+
+              with pytest.raises(RuntimeError):
+                  retry(fail, budget=3)
+              assert len(calls) == 3
+    expected: "Stops dispatching after round 3, writes `## Controller ruling` into the review package with the open finding and its ruling, hands back to the user."
     graders:
       - type: regex
         expected: "## Controller ruling"
-      - type: regex
-        expected: "too-big|needs-confirm|ambiguous|regressed|scope"
       - type: tool_used
         not_expected:
-          - "Agent:round 6"
+          - "Agent:round 4"
     ablation: true
 
   - id: rule-why-digest-citation
@@ -136,6 +869,126 @@ cases:
       reads "R:1.2.1: keep E3 as the default." The diff summary shows the implementer switched
       the default from E3 to E4. The worker handoff carries "concerns": []. Grade this diff
       against the brief's rulings and write the reviewer finding.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [ ] 1.2 Engine selection reads the configured engine and falls back to the default
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: select_engine(config: dict) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/1.2.brief.md
+        content: |
+          # Brief 1.2: engine selection with a default
+
+          Change: copiloto-greenfield
+          Task: 1.2
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - adds select_engine(), DEFAULT_ENGINE keeps its value
+          Suite: pytest -q
+          Base: 5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d
+          Report: .freeharness/sdd/copiloto-greenfield/1.2.review.md
+
+          ## Task
+          - [ ] 1.2 Engine selection reads the configured engine and falls back to the default
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: select_engine(config: dict) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+
+          ## Why and rulings
+          The default engine is the one the cost model was measured on; changing it is the owner's call.
+          R:1.2.1: keep E3 as the default.
+          D:configured-wins: a configured engine in config["engine"] overrides the default.
+
+          ## Write scope
+          - src/core/engine.py
+          - tests/test_engine.py
+
+          ## Interfaces
+          - Produces: select_engine(config: dict) -> str
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_engine.py -q -k default -> select_engine({}) returns "E3"
+          P2: pytest tests/test_engine.py -q -k configured -> select_engine({"engine": "E5"}) returns "E5"
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_engine.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/1.2.review.md
+        content: |
+          ```json
+          {"task": "1.2", "status": "completed", "files_changed": ["src/core/engine.py", "tests/test_engine.py"], "tests_run": [{"command": "pytest tests/test_engine.py -q", "result": "pass", "summary": "2 passed"}], "evidence": ["P1: select_engine({}) returns the default", "P2: a configured engine wins"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## What changed
+          - src/core/engine.py: select_engine() reads config["engine"]; DEFAULT_ENGINE is "E4".
+          - tests/test_engine.py: default and configured cases.
+
+          ## Checkpoint
+          ### Intent
+          - Engine selection with a default.
+          ### Files and code
+          - src/core/engine.py, tests/test_engine.py
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Task review.
+      - path: src/core/engine.py
+        content: |
+          DEFAULT_ENGINE = "E4"
+
+
+          def select_engine(config: dict) -> str:
+              return config.get("engine") or DEFAULT_ENGINE
     expected_regex: "P0"
     graders:
       - type: regex
@@ -150,11 +1003,51 @@ cases:
     source: rule
     rule: reviewer-cap
     input: |
-      Task 2.4 review, round 1. Four reviewers are queued for one dispatch message
+      Change copiloto-greenfield, task 2.4 review, round 1 (review package
+      .freeharness/sdd/copiloto-greenfield/2.4.review.md). Four reviewers are queued for one dispatch message
       (python-reviewer, database-reviewer, security-reviewer, pr-reviewer with the mle lens)
       against the diff;
       no user ask for more than three is recorded in the review package. State the dispatch
       plan for this round.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. Accounts
+
+          - [ ] 2.4 Login route backed by the accounts repository, with a ranking model for suspicious logins
+            Verify: pytest tests/test_login.py -q
+            Interfaces: AccountsRepo.find_by_email(email: str) -> Account | None
+            Boundary: src/db/accounts.py, src/api/login.py, src/ml/risk.py, tests/test_login.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/2.4.review.md
+        content: |
+          ```json
+          {"task": "2.4", "status": "completed", "files_changed": ["src/db/accounts.py", "src/api/login.py", "src/ml/risk.py", "tests/test_login.py"], "tests_run": [{"command": "pytest tests/test_login.py -q", "result": "pass", "summary": "7 passed"}], "evidence": ["P1: a known email with the right password logs in", "P2: a risk score over 0.8 asks for a second factor"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - git diff --stat: 4 files changed, 212 insertions
+          - pytest tests/test_login.py -q: 7 passed
+          - Verdict: accepted for review.
+
+          ## Review plan, round 1
+          - Queued: python-reviewer, database-reviewer, security-reviewer, pr-reviewer (mle lens).
+
+          ## Checkpoint
+          ### Intent
+          - Login route over the accounts repository with a risk score.
+          ### Files and code
+          - src/db/accounts.py, src/api/login.py, src/ml/risk.py, tests/test_login.py
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Task review.
     expected_regex: "second round|three reviewer"
     graders:
       - type: regex
@@ -174,17 +1067,115 @@ cases:
     input: |
       Change copiloto-greenfield, task 2.1, implementer role. The brief is approved and the
       next step is to dispatch it as `impl-2.1`. Proceed.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. Decisions
+
+          - [ ] 2.1 Map each (journey, reason) pair to its final node in decide()
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(journey: str, reason: str) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/2.1.brief.md
+        content: |
+          # Brief 2.1: Final node per journey and reason
+
+          Change: copiloto-greenfield
+          Task: 2.1
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Changes: decide
+          Suite: pytest -q
+          Base: 3f9d2c41a7b8e5d6f0a1b2c3d4e5f60718293a4b
+          Report: .freeharness/sdd/copiloto-greenfield/2.1.review.md
+
+          ## Task
+          - [ ] 2.1 Map each (journey, reason) pair to its final node in decide()
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(journey: str, reason: str) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+
+          ## Why and rulings
+          Every journey ends through one table, so decide() reads it instead of branching.
+          D:final-node-table: decide() returns the final node from the (journey, reason) table and raises KeyError for an unknown pair.
+
+          ## Write scope
+          - src/core/engine.py
+          - tests/test_engine.py
+
+          ## Interfaces
+          - Consumes: none
+          - Produces: decide(journey: str, reason: str) -> str
+
+          ## Boundary
+          - src/api/ stays untouched.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_engine.py -q -k known_pair -> decide("onboarding", "timeout") returns "handoff"
+          P2: pytest tests/test_engine.py -q -k unknown_pair -> an unknown pair raises KeyError
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_engine.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/ledger.jsonl
+        content: ""
+      - path: src/core/engine.py
+        content: |
+          """Conversation engine: picks the final node of a journey."""
+
+
+          def decide(journey: str, reason: str) -> str:
+              raise NotImplementedError
     expected_regex: "impl-2_1"
     graders:
       - type: tool_used
         expected: "Bash:validate-handoff.mjs name"
-      - type: regex
-        expected: "impl-2_1"
+      - type: tool_used
+        expected: "Agent:Dispatch: impl-2_1"
       - type: regex
         not_expected:
           - "Agent:impl-2\\.1"
       - type: llm
-        rubric: "Fail when the dispatch uses the dotted name impl-2.1 or skips the name check before dispatching; pass when the lead runs validate-handoff.mjs name first and dispatches with the corrected form impl-2_1."
+        rubric: "Grade the dispatch name only; the outcome of the dispatched work is not graded. Fail when the answer shows a dispatch under the dotted name impl-2.1; pass when the dispatch it reports uses the corrected name impl-2_1 or it names no dotted dispatch."
     ablation: true
 
   - id: rule-reply-contract
@@ -195,6 +1186,41 @@ cases:
       12,000 characters of prose and names no review file. Reply B is the JSON handoff block
       followed by the line ".freeharness/sdd/copiloto-greenfield/1.2.review.md". Which reply is
       the correct one to send to the caller, and what does the correct reply contain?
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [ ] 1.2 decide() returns the final node per (journey, reason) from the decision table
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(journey: Journey, reason: str) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/1.2.review.md
+        content: |
+          ```json
+          {"task": "1.2", "status": "completed", "files_changed": ["src/core/engine.py", "tests/test_engine.py"], "tests_run": [{"command": "pytest tests/test_engine.py -q", "result": "pass", "summary": "9 passed"}], "evidence": ["Verify 1.2: decide() returns final_node per (journey, reason) table"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## What changed
+          - src/core/engine.py: decide() looks the pair up in DECISION_TABLE.
+          - tests/test_engine.py: known and unknown pairs.
+
+          ## Checkpoint
+          ### Intent
+          - decide() over the decision table.
+          ### Files and code
+          - src/core/engine.py, tests/test_engine.py
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Lead evaluation.
     expected_regex: "\\.freeharness/sdd/copiloto-greenfield/1\\.2\\.review\\.md"
     graders:
       - type: regex
@@ -206,3 +1232,2454 @@ cases:
         not_expected:
           - "reply a is (the )?correct"
     ablation: true
+
+  - id: rule-no-blocking-accepted
+    source: rule
+    rule: blocking-definition
+    input: |
+      Task 2.2 (change copiloto-greenfield), round 1 review. The task reviewer returned three
+      open findings, recorded in the ledger .freeharness/sdd/copiloto-greenfield/2.2.findings.md,
+      and the gate is the next step:
+      src/api/routes.py:41: P1 hardening: the retry loop has no jitter. add jitter.
+      src/api/routes.py:88: P2 refactor: duplicated header parsing. extract a helper.
+      src/api/models.py:12: P2 refactor: a stale alias. drop it.
+      The probes all passed. State the lead's next steps.
+    workspace_files:
+      - path: openspec/config.yaml
+        content: |
+          schema: spec-driven
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. API
+
+          - [ ] 2.2 Orders route retries the upstream inventory call
+            Verify: pytest tests/test_routes.py -q
+            Interfaces: GET /orders/{id} -> OrderOut
+            Boundary: src/api/routes.py, src/api/models.py, tests/test_routes.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/2.2.brief.md
+        content: |
+          # Brief 2.2: orders route retries the inventory call
+
+          Change: copiloto-greenfield
+          Task: 2.2
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - adds a retry around the inventory call, no existing identifier changes
+          Suite: pytest -q
+          Base: 8e0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a
+          Report: .freeharness/sdd/copiloto-greenfield/2.2.review.md
+
+          ## Task
+          - [ ] 2.2 Orders route retries the upstream inventory call
+            Verify: pytest tests/test_routes.py -q
+            Interfaces: GET /orders/{id} -> OrderOut
+            Boundary: src/api/routes.py, src/api/models.py, tests/test_routes.py
+            Depends: none
+
+          ## Why and rulings
+          The inventory service drops one call in a hundred; the orders page must survive one drop.
+          D:retry-twice: the route retries the inventory call twice on a connection error, then returns 503.
+
+          ## Write scope
+          - src/api/routes.py
+          - src/api/models.py
+          - tests/test_routes.py
+
+          ## Interfaces
+          - Produces: GET /orders/{id} -> OrderOut
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_routes.py -q -k one_drop -> one connection error then a success returns 200
+          P2: pytest tests/test_routes.py -q -k three_drops -> three connection errors return 503
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_routes.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/2.2.findings.md
+        content: |
+          F1 open r1: src/api/routes.py:41: P1 hardening: the retry loop has no jitter. add jitter.
+          F2 open r1: src/api/routes.py:88: P2 refactor: duplicated header parsing. extract a helper.
+          F3 open r1: src/api/models.py:12: P2 refactor: a stale alias. drop it.
+      - path: .freeharness/sdd/copiloto-greenfield/2.2.review.md
+        content: |
+          ```json
+          {"task": "2.2", "status": "completed", "files_changed": ["src/api/routes.py", "src/api/models.py", "tests/test_routes.py"], "tests_run": [{"command": "pytest tests/test_routes.py -q", "result": "pass", "summary": "5 passed"}], "evidence": ["P1: one drop then a success returns 200", "P2: three drops return 503"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - pytest tests/test_routes.py -q: 5 passed
+          - P1, P2: pass
+          - Verdict: accepted for review.
+
+          ## Task review
+          - src/api/routes.py:41: P1 hardening: the retry loop has no jitter. add jitter.
+          - src/api/routes.py:88: P2 refactor: duplicated header parsing. extract a helper.
+          - src/api/models.py:12: P2 refactor: a stale alias. drop it.
+
+          ## Checkpoint
+          ### Intent
+          - Orders route retries the inventory call.
+          ### Files and code
+          - src/api/routes.py, src/api/models.py, tests/test_routes.py
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Gate.
+    expected_regex: "follow-up"
+    graders:
+      - type: regex
+        flags: i
+        expected: "follow-up"
+      - type: regex
+        flags: i
+        not_expected:
+          - "\\b(dispatch|open|start)\\w* (a )?(fix round|round 2)\\b"
+          - "Agent:fix-2_2"
+      - type: llm
+        rubric: "Fail when a fix round opens for a P1 hardening or P2 refactor finding; pass when the lead runs the gate, sees no blocking line, accepts the task and records the three findings as follow-ups with openspec follow-up add at task close."
+    ablation: true
+
+  - id: rule-rereview-outside-round-diff
+    source: rule
+    rule: round-diff-scope
+    input: |
+      Task 2.3 (change copiloto-greenfield), scoped re-review of round 2. The fresh re-reviewer
+      was given the findings ledger, the round-diff output and the probes, and returned one new
+      finding: src/core/engine.py:9: P1 defect: normalize() drops a trailing empty field. The
+      round diff changes only decide() in that file; normalize() is untouched by it. Apply the
+      gate rules.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. Engine rules
+
+          - [ ] 2.3 decide() maps an unknown reason to the fallback node and normalizes the input row first
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(row: str) -> str; normalize(row: str) -> list[str]
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/2.3.brief.md
+        content: |
+          # Brief 2.3: decide() fallback for an unknown reason
+
+          Change: copiloto-greenfield
+          Task: 2.3
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - decide() gains a fallback branch, no identifier changes
+          Suite: pytest -q
+          Base: 3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c
+          Report: .freeharness/sdd/copiloto-greenfield/2.3.review.md
+
+          ## Task
+          - [ ] 2.3 decide() maps an unknown reason to the fallback node and normalizes the input row first
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(row: str) -> str; normalize(row: str) -> list[str]
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+
+          ## Why and rulings
+          An unknown reason used to raise KeyError and end the turn; it must route to the fallback node.
+          D:fallback: decide() returns "fallback" for a reason the table lacks.
+
+          ## Write scope
+          - src/core/engine.py
+          - tests/test_engine.py
+
+          ## Interfaces
+          - Produces: decide(row: str) -> str
+
+          ## Boundary
+          - normalize() keeps its behavior.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_engine.py -q -k unknown -> decide("sales;weather") returns "fallback"
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_engine.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/2.3.findings.md
+        content: |
+          F1 open r1: src/core/engine.py:14: P1 defect: decide() raises KeyError for a reason the table lacks. return "fallback".
+      - path: .freeharness/sdd/copiloto-greenfield/2.3.review.md
+        content: |
+          ```json
+          {"task": "2.3", "status": "completed", "files_changed": ["src/core/engine.py", "tests/test_engine.py"], "tests_run": [{"command": "pytest tests/test_engine.py -q", "result": "pass", "summary": "2 passed"}], "evidence": ["P1: decide(\"sales;weather\") returns fallback"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - pytest tests/test_engine.py -q: 2 passed
+
+          round 1/3: 0/1
+
+          ## Fix round 2
+          - F1: decide() returns "fallback" for an unknown reason.
+
+          ## Checkpoint
+          ### Intent
+          - decide() routes an unknown reason to the fallback node.
+          ### Files and code
+          - src/core/engine.py: decide() uses DECISION_TABLE.get with a fallback.
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - KeyError on an unknown reason; fixed in decide().
+          ### Open work
+          - (none)
+          ### Next step
+          - Scoped re-review of round 2.
+      - path: .freeharness/sdd/copiloto-greenfield/rounds/2.3-r2/absent.txt
+        content: ""
+      - path: .freeharness/sdd/copiloto-greenfield/rounds/2.3-r2/src/core/engine.py
+        content: |
+          DECISION_TABLE = {
+              ("sales", "price"): "quote",
+              ("support", "refund"): "refund_form",
+          }
+
+
+          def normalize(row: str) -> list[str]:
+              fields = row.split(";")
+              return [f.strip().lower() for f in fields if f.strip()]
+
+
+          def decide(row: str) -> str:
+              journey, reason = normalize(row)[:2]
+              return DECISION_TABLE[(journey, reason)]
+      - path: .freeharness/sdd/copiloto-greenfield/rounds/2.3-r2/tests/test_engine.py
+        content: |
+          from src.core.engine import decide
+
+
+          def test_known_pair():
+              assert decide("sales;price") == "quote"
+      - path: src/core/engine.py
+        content: |
+          DECISION_TABLE = {
+              ("sales", "price"): "quote",
+              ("support", "refund"): "refund_form",
+          }
+
+
+          def normalize(row: str) -> list[str]:
+              fields = row.split(";")
+              return [f.strip().lower() for f in fields if f.strip()]
+
+
+          def decide(row: str) -> str:
+              journey, reason = normalize(row)[:2]
+              return DECISION_TABLE.get((journey, reason), "fallback")
+      - path: tests/test_engine.py
+        content: |
+          from src.core.engine import decide
+
+
+          def test_known_pair():
+              assert decide("sales;price") == "quote"
+
+
+          def test_unknown_reason():
+              assert decide("sales;weather") == "fallback"
+    expected_regex: "follow-up"
+    graders:
+      - type: regex
+        flags: i
+        expected: "follow-up"
+      - type: regex
+        flags: i
+        not_expected:
+          - "\\b(dispatch|open|start)\\w* (a )?round 3\\b"
+          - "Agent:fix-2_3-r3"
+      - type: llm
+        rubric: "Fail when the finding opens a round 3; pass when the lead records it as a follow-up because the round diff does not change the code it names and it is not a P0, with no further fix round for it."
+    ablation: true
+
+  - id: rule-split-oversized-task
+    source: rule
+    rule: task-sizing
+    input: |
+      Change copiloto-greenfield, task 3.2 of tasks.md: "Add the retry policy". Its write scope
+      would be src/infra/retry.py, src/infra/backoff.py, src/infra/clock.py, src/core/engine.py
+      and src/api/routes.py, plus tests. Prepare the dispatch.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 3. Resilience
+
+          - [ ] 3.2 Add the retry policy
+            Verify: pytest tests/test_retry.py tests/test_engine.py tests/test_routes.py -q
+            Interfaces: RetryPolicy(max_attempts: int, backoff: Backoff, clock: Clock); RetryPolicy.run(fn) -> T
+            Boundary: src/infra/retry.py, src/infra/backoff.py, src/infra/clock.py, src/core/engine.py, src/api/routes.py, tests/test_retry.py, tests/test_engine.py, tests/test_routes.py
+            Depends: none
+      - path: src/core/engine.py
+        content: |
+          """Conversation engine: picks the final node of a journey."""
+
+
+          def decide(journey: str, reason: str) -> str:
+              raise NotImplementedError
+      - path: src/api/routes.py
+        content: |
+          """HTTP routes."""
+
+
+          def post_message(engine, payload: dict) -> dict:
+              return {"node": engine.decide(payload["journey"], payload["reason"])}
+    expected_regex: "3\\.2\\.1"
+    graders:
+      - type: regex
+        expected: "3\\.2\\.1"
+      - type: regex
+        flags: i
+        expected: "sub-task|split"
+      - type: regex
+        not_expected:
+          - "Split: refused"
+      - type: llm
+        rubric: "Fail when one brief lists all five source files without a split, or the lead writes Split: refused for work that can be divided; pass when the lead splits the task into sub-tasks 3.2.1, 3.2.2 and so on, each with a brief of at most three source files and one behavior, and notes the split in the first sub-task's review package."
+    ablation: true
+
+  - id: rule-route-docs-standard
+    source: rule
+    rule: dispatch-routing
+    input: |
+      Change copiloto-greenfield, task 4.1: rewrite the INSTALL.md section on the retry policy
+      from the merged spec (one file, no code). Write the brief header and name the dispatch
+      target.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 4. Documentation
+
+          - [ ] 4.1 Rewrite the INSTALL.md retry policy section from the merged spec
+            Verify: grep -n "## Retry policy" INSTALL.md
+            Boundary: INSTALL.md
+            Depends: none
+      - path: openspec/specs/retry-policy/spec.md
+        content: |
+          # retry-policy
+
+          ### Requirement: Bounded retries
+          A transient upstream failure SHALL be retried at most 3 times with exponential backoff starting at 200 ms.
+      - path: INSTALL.md
+        content: |
+          # Install
+
+          ## Retry policy
+          Failed calls are retried forever.
+    expected_regex: "Tier: standard"
+    graders:
+      - type: regex
+        expected: "Tier: standard"
+      - type: regex
+        expected: "Class: docs"
+      - type: regex
+        expected: "implementer"
+      - type: regex
+        not_expected:
+          - "implementer-high"
+          - "Effort: high"
+      - type: llm
+        rubric: "Fail when the docs brief runs on strong or at high effort or targets a separate high-effort agent; pass when it declares Tier: standard, Class: docs, Effort: medium (or none) and dispatches the implementer agent."
+    ablation: true
+
+  - id: rule-route-security-high
+    source: rule
+    rule: dispatch-routing
+    input: |
+      Change copiloto-greenfield, task 5.1: add input validation for the untrusted webhook
+      payload that gates the admin route (an auth boundary). Write the brief header and name
+      the dispatch target.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 5. Admin webhook
+
+          - [ ] 5.1 Validate the untrusted webhook payload before it reaches the admin route
+            Verify: pytest tests/test_webhook.py -q
+            Interfaces: parse_webhook(body: bytes) -> WebhookEvent
+            Boundary: src/api/webhook.py, tests/test_webhook.py
+            Depends: none
+      - path: src/api/webhook.py
+        content: |
+          """Webhook entry point; the event decides who reaches the admin route."""
+          import json
+
+
+          def parse_webhook(body: bytes) -> dict:
+              return json.loads(body)
+    expected_regex: "Effort: high"
+    graders:
+      - type: regex
+        expected: "implementer"
+      - type: regex
+        not_expected:
+          - "implementer-high"
+      - type: regex
+        expected: "Class: security"
+      - type: regex
+        expected: "Tier: strong"
+      - type: regex
+        expected: "Effort: high"
+      - type: llm
+        rubric: "Fail when the security brief runs on standard, at medium effort, or targets a separate high-effort agent; pass when it declares Class: security, Tier: strong and Effort: high, carries an allow-side probe and a corpus probe, and dispatches the single implementer agent with effort high passed as the dispatch effort."
+    ablation: true
+
+  - id: rule-route-code-standard
+    source: rule
+    rule: dispatch-routing
+    input: |
+      Change copiloto-greenfield, task 2.3: add a `jitterMs` option to the HTTP client in
+      src/http/client.ts, following the existing `timeoutMs` handling in src/http/timeout.ts.
+      One source file plus its test, no shared fixture, first dispatch of the task. The
+      acceptance probes are: a call with jitterMs 0 behaves as before, and a call with
+      jitterMs 50 waits between 0 and 50 ms. Write the brief header and name the dispatch
+      target.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. HTTP client
+
+          - [ ] 2.3 Add a jitterMs option to the HTTP client, following the timeoutMs handling
+            Verify: npx vitest run test/http/client.test.ts
+            Interfaces: ClientOptions.jitterMs?: number
+            Boundary: src/http/client.ts, test/http/client.test.ts
+            Depends: none
+      - path: src/http/timeout.ts
+        content: |
+          export interface TimeoutOptions {
+            timeoutMs?: number;
+          }
+
+          export function withTimeout<T>(work: Promise<T>, opts: TimeoutOptions = {}): Promise<T> {
+            const ms = opts.timeoutMs ?? 0;
+            if (ms <= 0) return work;
+            return Promise.race([
+              work,
+              new Promise<T>((_, reject) => setTimeout(() => reject(new Error(`timeout after ${ms} ms`)), ms)),
+            ]);
+          }
+      - path: src/http/client.ts
+        content: |
+          import { withTimeout, type TimeoutOptions } from "./timeout";
+
+          export interface ClientOptions extends TimeoutOptions {
+            baseUrl: string;
+          }
+
+          export async function get(path: string, opts: ClientOptions): Promise<Response> {
+            return withTimeout(fetch(new URL(path, opts.baseUrl)), opts);
+          }
+      - path: test/http/client.test.ts
+        content: |
+          import { describe, expect, it, vi } from "vitest";
+          import { get } from "../../src/http/client";
+
+          describe("get", () => {
+            it("rejects after timeoutMs", async () => {
+              vi.stubGlobal("fetch", () => new Promise(() => {}));
+              await expect(get("/x", { baseUrl: "http://localhost", timeoutMs: 5 })).rejects.toThrow("timeout after 5 ms");
+            });
+          });
+    expected_regex: "Route: C1-C7"
+    graders:
+      - type: regex
+        expected: "Class: code"
+      - type: regex
+        expected: "Tier: standard"
+      - type: regex
+        expected: "Route: C1-C7"
+      - type: llm
+        rubric: "Fail when the brief runs a Class: code task on standard without a Route: C1-C7 line, or the route reason does not name the followed pattern; pass when it declares Class: code, Tier: standard, a Route: C1-C7 line naming the existing function it follows, and dispatches the implementer agent."
+    ablation: true
+
+  - id: rule-route-code-strong
+    source: rule
+    rule: dispatch-routing
+    input: |
+      Change copiloto-greenfield, task 3.4: fix loadPolicy() in packages/core/src/policy.ts so
+      an environment entry that omits timeoutMs gets DEFAULT_TIMEOUT_MS from the same file
+      instead of undefined. The fix stays inside the function body: the signature, the Policy
+      type and every caller are unchanged, and the repository holds no existing defaulting
+      code to follow. One source file plus its test, first dispatch of the task. Write the
+      brief header and name the dispatch target.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 3. Policy
+
+          - [ ] 3.4 loadPolicy() fills a missing timeoutMs with DEFAULT_TIMEOUT_MS
+            Verify: npx vitest run packages/core/test/policy.test.ts
+            Interfaces: loadPolicy(file: string, env: string): Policy (unchanged)
+            Boundary: packages/core/src/policy.ts, packages/core/test/policy.test.ts
+            Depends: none
+      - path: packages/core/src/policy.ts
+        content: |
+          import { readFileSync } from "node:fs";
+
+          export const DEFAULT_TIMEOUT_MS = 5000;
+
+          export interface Policy {
+            retries: number;
+            timeoutMs: number;
+          }
+
+          export function loadPolicy(file: string, env: string): Policy {
+            const all = JSON.parse(readFileSync(file, "utf8")) as Record<string, Policy>;
+            return all[env];
+          }
+      - path: packages/core/test/policy.test.ts
+        content: |
+          import { mkdtempSync, writeFileSync } from "node:fs";
+          import { tmpdir } from "node:os";
+          import { join } from "node:path";
+          import { describe, expect, it } from "vitest";
+          import { loadPolicy } from "../src/policy";
+
+          describe("loadPolicy", () => {
+            it("returns the entry of the named environment", () => {
+              const file = join(mkdtempSync(join(tmpdir(), "policy-")), "policy.json");
+              writeFileSync(file, JSON.stringify({ dev: { retries: 2, timeoutMs: 100 } }));
+              expect(loadPolicy(file, "dev")).toEqual({ retries: 2, timeoutMs: 100 });
+            });
+          });
+    expected_regex: "Tier: strong"
+    graders:
+      - type: regex
+        expected: "Class: code"
+      - type: regex
+        expected: "Tier: strong"
+      - type: regex
+        flags: m
+        not_expected:
+          - "^Route:"
+      - type: llm
+        rubric: "Fail when the single-file fix with no existing pattern to follow runs on standard or carries a Route: line; pass when it declares Class: code and Tier: strong with no Route: line and dispatches the implementer agent."
+    ablation: true
+
+  - id: rule-brief-init-skeleton
+    source: rule
+    rule: brief-init
+    input: |
+      Change copiloto-greenfield is approved and /opsx:apply is done. Start task 2.1 of its
+      tasks.md: write the brief and get it ready for dispatch.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+      - path: pyproject.toml
+        content: |
+          [project]
+          name = "copiloto"
+          version = "0.1.0"
+
+          [tool.pytest.ini_options]
+          testpaths = ["tests"]
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [x] 1.1 Journey enum and the decision table skeleton in the engine
+            Verify: pytest tests/test_engine.py -q
+            Boundary: src/core/engine.py, tests/test_engine.py
+
+          ## 2. Decisions
+
+          - [ ] 2.1 Map each (journey, reason) pair to its final node in decide()
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(journey: str, reason: str) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: 1.1
+      - path: src/core/engine.py
+        content: |
+          """Conversation engine: picks the final node of a journey."""
+          from enum import Enum
+
+
+          class Journey(Enum):
+              ONBOARDING = "onboarding"
+              BILLING = "billing"
+
+
+          TABLE: dict[tuple[Journey, str], str] = {}
+
+
+          def decide(journey: str, reason: str) -> str:
+              raise NotImplementedError
+      - path: tests/test_engine.py
+        content: |
+          from src.core.engine import Journey
+
+
+          def test_journeys():
+              assert Journey("billing") is Journey.BILLING
+    expected_regex: "brief-init"
+    graders:
+      - type: tool_used
+        expected: "Bash:validate-handoff.mjs brief-init"
+      - type: llm
+        rubric: "Fail when the lead types the brief by hand or writes its own ## Run rules section; pass when it runs validate-handoff.mjs brief-init copiloto-greenfield 2.1 and fills only the <fill: ...> placeholders the skeleton leaves."
+    ablation: true
+
+  - id: rule-route-fix-round-climb
+    source: rule
+    rule: route-climb
+    input: |
+      Change copiloto-greenfield, task 2.3: its brief declares Tier: standard, Class: code and
+      a Route: C1-C7 line. Fix round 1 left one blocking P1 defect open and the gate printed
+      "1 blocking". Prepare fix round 2 and name the tier of its dispatch.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. HTTP client
+
+          - [ ] 2.3 Add a jitterMs option to the HTTP client, following the timeoutMs handling
+            Verify: npx vitest run test/http/client.test.ts
+            Interfaces: ClientOptions.jitterMs?: number
+            Boundary: src/http/client.ts, test/http/client.test.ts
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/2.3.brief.md
+        content: |
+          # Brief 2.3: jitterMs option for the HTTP client
+
+          Change: copiloto-greenfield
+          Task: 2.3
+          Spec: copiloto-greenfield
+          Tier: standard
+          Class: code
+          Route: C1-C7 - adds one option following the timeoutMs handling in src/http/timeout.ts; no shared fixture; first dispatch
+          Read: src/http/timeout.ts
+          Changes: none - adds an option, no existing identifier changes
+          Suite: npx vitest run
+          Base: 9b2e4c7d1a0f3e5b8c6d2a4f1e3b5c7d9a0b2c4e
+          Report: .freeharness/sdd/copiloto-greenfield/2.3.review.md
+
+          ## Task
+          - [ ] 2.3 Add a jitterMs option to the HTTP client, following the timeoutMs handling
+            Verify: npx vitest run test/http/client.test.ts
+            Interfaces: ClientOptions.jitterMs?: number
+            Boundary: src/http/client.ts, test/http/client.test.ts
+            Depends: none
+
+          ## Why and rulings
+          Retries from many clients line up without jitter, so each call may wait a random delay first.
+          D:jitter-before-call: get() waits a random delay in [0, jitterMs] before the request starts; jitterMs 0 or absent waits nothing.
+
+          ## Write scope
+          - src/http/client.ts
+          - test/http/client.test.ts
+
+          ## Interfaces
+          - Consumes: withTimeout(work, opts) from src/http/timeout.ts
+          - Produces: ClientOptions.jitterMs?: number
+
+          ## Boundary
+          - src/http/timeout.ts stays untouched.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: npx vitest run test/http/client.test.ts -t "jitterMs 0" -> the call behaves as before, no delay
+          P2: npx vitest run test/http/client.test.ts -t "jitterMs 50" -> the call waits between 0 and 50 ms
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - npx vitest run test/http/client.test.ts
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/2.3.findings.md
+        content: |
+          F1 open r1: src/http/client.ts:11: P1 defect: the jitter delay runs inside withTimeout, so jitterMs 50 with timeoutMs 40 rejects before the request is sent. wait the jitter before calling withTimeout.
+      - path: .freeharness/sdd/copiloto-greenfield/2.3.review.md
+        content: |
+          ```json
+          {"task": "2.3", "status": "completed", "files_changed": ["src/http/client.ts", "test/http/client.test.ts"], "tests_run": [{"command": "npx vitest run test/http/client.test.ts", "result": "pass", "summary": "3 passed"}], "evidence": ["P1: jitterMs 0 adds no delay", "P2: jitterMs 50 waits 0 to 50 ms"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - npx vitest run test/http/client.test.ts: 3 passed
+
+          round 1/3: 0/1
+
+          ## Checkpoint
+          ### Intent
+          - jitterMs option on get()
+          ### Files and code
+          - src/http/client.ts, test/http/client.test.ts
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - F1 open: jitter runs inside the timeout window
+          ### Next step
+          - fix round 2
+      - path: src/http/timeout.ts
+        content: |
+          export interface TimeoutOptions {
+            timeoutMs?: number;
+          }
+
+          export function withTimeout<T>(work: Promise<T>, opts: TimeoutOptions = {}): Promise<T> {
+            const ms = opts.timeoutMs ?? 0;
+            if (ms <= 0) return work;
+            return Promise.race([
+              work,
+              new Promise<T>((_, reject) => setTimeout(() => reject(new Error(`timeout after ${ms} ms`)), ms)),
+            ]);
+          }
+      - path: src/http/client.ts
+        content: |
+          import { withTimeout, type TimeoutOptions } from "./timeout";
+
+          export interface ClientOptions extends TimeoutOptions {
+            baseUrl: string;
+            jitterMs?: number;
+          }
+
+          const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+          export async function get(path: string, opts: ClientOptions): Promise<Response> {
+            return withTimeout(sleep(Math.random() * (opts.jitterMs ?? 0)).then(() => fetch(new URL(path, opts.baseUrl))), opts);
+          }
+      - path: test/http/client.test.ts
+        content: |
+          import { describe, expect, it, vi } from "vitest";
+          import { get } from "../../src/http/client";
+
+          describe("get", () => {
+            it("rejects after timeoutMs", async () => {
+              vi.stubGlobal("fetch", () => new Promise(() => {}));
+              await expect(get("/x", { baseUrl: "http://localhost", timeoutMs: 5 })).rejects.toThrow("timeout after 5 ms");
+            });
+          });
+    expected_regex: "--round 2"
+    graders:
+      - type: tool_used
+        expected: "Bash:validate-handoff.mjs route"
+      - type: regex
+        expected: "--round 2"
+      - type: regex
+        flags: i
+        expected: "Tier:\\s*strong"
+      - type: llm
+        rubric: "Fail when fix round 2 of the standard code task dispatches on standard or keeps the Route: line; pass when the lead runs validate-handoff.mjs route with --round 2, rewrites the brief to the printed Tier: strong without the Route: line, runs round-base 2 and dispatches the implementer on strong."
+    ablation: true
+
+  - id: rule-band-parallel-trees
+    source: rule
+    rule: band-parallel-trees
+    input: |
+      Change orbit-ledger has six independent tasks left (3.1 to 3.6), each with a write scope of its
+      own under src/ledger/ and no file shared with another. The default band applies and no user ask
+      for a wider band is recorded in the review package. The project root is this workspace (task
+      trees go under .worktrees/orbit-ledger/<task>) and installs with npm ci. Write and lint the
+      briefs of the tasks this round dispatches, then give the dispatch plan for the round.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+          node_modules/
+      - path: package.json
+        content: |
+          {
+            "name": "orbit-ledger",
+            "version": "1.0.0",
+            "private": true,
+            "type": "module",
+            "scripts": {
+              "test": "node --test test/"
+            }
+          }
+      - path: package-lock.json
+        content: |
+          {
+            "name": "orbit-ledger",
+            "version": "1.0.0",
+            "lockfileVersion": 3,
+            "requires": true,
+            "packages": {
+              "": {
+                "name": "orbit-ledger",
+                "version": "1.0.0"
+              }
+            }
+          }
+      - path: openspec/changes/orbit-ledger/tasks.md
+        content: |
+          # Tasks: orbit-ledger
+
+          ## 3. Ledger operations
+
+          - [ ] 3.1 Open an account with an initial balance
+            Verify: node --test test/accounts.test.ts
+            Boundary: src/ledger/accounts.ts, test/accounts.test.ts
+            Depends: none
+
+          - [ ] 3.2 Post a double-entry journal line
+            Verify: node --test test/entries.test.ts
+            Boundary: src/ledger/entries.ts, test/entries.test.ts
+            Depends: none
+
+          - [ ] 3.3 Running balance per account
+            Verify: node --test test/balances.test.ts
+            Boundary: src/ledger/balances.ts, test/balances.test.ts
+            Depends: none
+
+          - [ ] 3.4 Currency conversion at the posting date rate
+            Verify: node --test test/fx.test.ts
+            Boundary: src/ledger/fx.ts, test/fx.test.ts
+            Depends: none
+
+          - [ ] 3.5 CSV export of a period
+            Verify: node --test test/export.test.ts
+            Boundary: src/ledger/export.ts, test/export.test.ts
+            Depends: none
+
+          - [ ] 3.6 Close a period and lock its entries
+            Verify: node --test test/close.test.ts
+            Boundary: src/ledger/close.ts, test/close.test.ts
+            Depends: none
+      - path: src/ledger/types.ts
+        content: |
+          export interface Entry {
+            account: string;
+            amountCents: number;
+            postedAt: string;
+          }
+    expected_regex: "validate-handoff\\.mjs tree"
+    graders:
+      - type: regex
+        expected: "validate-handoff\\.mjs tree"
+      - type: regex
+        flags: im
+        expected: "(?:Tree:|^[ \\t]*\\|)[^\\n]*\\.worktrees/orbit-ledger/(?:3[._]\\d|<task>|\\{task\\}|\\$\\{?task\\}?)"
+      - type: regex
+        expected: "Setup:"
+      - type: tool_used
+        expected: "Bash:validate-handoff.mjs briefs"
+      - type: regex
+        flags: i
+        not_expected:
+          - "\\b(five|six|5|6) (implementers|dispatches|tasks)\\b(?:(?!\\b(recorded|queue|queued|second|next)\\b).){0,80}\\b(in flight|at once|in parallel|together)\\b"
+      - type: llm
+        rubric: "Fail when the plan has five or more implementers in flight with no recorded user ask for a wider band, or when a parallel brief carries no Tree: line or no Setup: line; pass when at most 4 tasks are dispatched at once, the rest wait for a later wave, each brief is checked with validate-handoff.mjs tree, names its own tree and a Setup:, and the set is checked with validate-handoff.mjs briefs."
+    ablation: true
+
+  - id: rule-serial-no-tree
+    source: rule
+    rule: serial-no-tree
+    input: |
+      Change orbit-ledger has one task left, 3.6, and no other implementer was in flight while it
+      ran. Its brief .freeharness/sdd/orbit-ledger/3.6.brief.md ran it in the main tree, and its
+      review package .freeharness/sdd/orbit-ledger/3.6.review.md is accepted: the lead evaluation
+      passed and the gate printed no blocking line. The project root is this workspace. The commit
+      message is written to .freeharness/sdd/orbit-ledger/3.6.msg.txt. Tick the task in tasks.md
+      and land it.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+          node_modules/
+      - path: package.json
+        content: |
+          {
+            "name": "orbit-ledger",
+            "version": "1.0.0",
+            "private": true,
+            "type": "module",
+            "scripts": {
+              "test": "node --test test/"
+            }
+          }
+      - path: openspec/changes/orbit-ledger/tasks.md
+        content: |
+          # Tasks: orbit-ledger
+
+          ## 3. Ledger operations
+
+          - [x] 3.1 Open an account with an initial balance
+          - [x] 3.2 Post a double-entry journal line
+          - [x] 3.3 Running balance per account
+          - [x] 3.4 Currency conversion at the posting date rate
+          - [x] 3.5 CSV export of a period
+          - [ ] 3.6 Close a period and lock its entries
+            Verify: node --test test/close.test.ts
+            Interfaces: closePeriod(period: string, entries: Entry[]): ClosedPeriod
+            Boundary: src/ledger/close.ts, test/close.test.ts
+            Depends: 3.2
+      - path: .freeharness/sdd/orbit-ledger/3.6.brief.md
+        content: |
+          # Brief 3.6: close a period and lock its entries
+
+          Change: orbit-ledger
+          Task: 3.6
+          Spec: orbit-ledger
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - adds closePeriod(), no existing identifier changes
+          Suite: npm test
+          Tree: none - the one implementer in flight runs in the main tree
+          Base: 5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d
+          Report: .freeharness/sdd/orbit-ledger/3.6.review.md
+
+          ## Task
+          - [ ] 3.6 Close a period and lock its entries
+            Verify: node --test test/close.test.ts
+            Interfaces: closePeriod(period: string, entries: Entry[]): ClosedPeriod
+            Boundary: src/ledger/close.ts, test/close.test.ts
+            Depends: 3.2
+
+          ## Why and rulings
+          A closed period must not change after the books are reported.
+          D:frozen: closePeriod() returns the period's entries frozen, so a later write throws.
+
+          ## Write scope
+          - src/ledger/close.ts
+          - test/close.test.ts
+
+          ## Interfaces
+          - Consumes: Entry from src/ledger/types.ts
+          - Produces: closePeriod(period: string, entries: Entry[]): ClosedPeriod
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          3.2
+
+          ## Acceptance probes
+          P1: node --test test/close.test.ts -> closePeriod keeps only the entries posted in the period
+          P2: node --test test/close.test.ts -> a write to a closed entry throws
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - node --test test/close.test.ts
+      - path: .freeharness/sdd/orbit-ledger/3.6.review.md
+        content: |
+          ```json
+          {"task": "3.6", "status": "completed", "files_changed": ["src/ledger/close.ts", "test/close.test.ts"], "tests_run": [{"command": "node --test test/close.test.ts", "result": "pass", "summary": "2 passed"}], "evidence": ["P1: only the period's entries are kept", "P2: a write to a closed entry throws"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - node --test test/close.test.ts: 2 passed
+          - P1, P2: pass
+          - gate: 0 blocking, 0 follow-up
+          - Verdict: accepted.
+
+          ## Checkpoint
+          ### Intent
+          - Close a period and lock its entries.
+          ### Files and code
+          - src/ledger/close.ts, test/close.test.ts
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Commit.
+      - path: .freeharness/sdd/orbit-ledger/3.6.msg.txt
+        content: |
+          feat(ledger): close a period and lock its entries
+      - path: src/ledger/close.ts
+        content: |
+          import type { Entry } from "./types.ts";
+
+          export interface ClosedPeriod {
+            period: string;
+            entries: readonly Entry[];
+          }
+
+          export function closePeriod(period: string, entries: Entry[]): ClosedPeriod {
+            const kept = entries.filter((e) => e.postedAt.startsWith(period)).map((e) => Object.freeze({ ...e }));
+            return { period, entries: Object.freeze(kept) };
+          }
+      - path: src/ledger/types.ts
+        content: |
+          export interface Entry {
+            account: string;
+            amountCents: number;
+            postedAt: string;
+          }
+      - path: test/close.test.ts
+        content: |
+          import { test } from "node:test";
+          import assert from "node:assert/strict";
+          import { closePeriod } from "../src/ledger/close.ts";
+
+          const entries = [
+            { account: "cash", amountCents: 100, postedAt: "2026-10-03" },
+            { account: "cash", amountCents: 200, postedAt: "2026-11-01" },
+          ];
+
+          test("closePeriod keeps only the entries posted in the period", () => {
+            assert.deepEqual(closePeriod("2026-10", entries).entries, [entries[0]]);
+          });
+
+          test("a write to a closed entry throws", () => {
+            const [entry] = closePeriod("2026-10", entries).entries;
+            assert.throws(() => {
+              (entry as { amountCents: number }).amountCents = 0;
+            });
+          });
+    expected_regex: "validate-handoff\\.mjs commit"
+    graders:
+      - type: tool_used
+        expected: "Bash:validate-handoff.mjs commit"
+      - type: tool_used
+        not_expected:
+          - "Bash:validate-handoff.mjs commit --tree"
+          - "Bash:validate-handoff.mjs commit .freeharness/sdd/orbit-ledger/3.6.review.md -F .freeharness/sdd/orbit-ledger/3.6.msg.txt --tree"
+          - "Bash:validate-handoff.mjs tree"
+          - "Bash:git worktree add"
+      - type: regex
+        not_expected:
+          - "validate-handoff\\.mjs commit[^\\n]*(?<!\\bwithout|\\bno)[ \\t]--tree(?:[ \\t]+[^\\s-]|=)"
+          - "validate-handoff\\.mjs tree\\b"
+          - "git worktree add"
+      - type: llm
+        rubric: "Fail when the lead creates a worktree for the lone task or lands it with commit --tree; pass when the task, run in the main tree, is landed with the plain validate-handoff.mjs commit."
+    ablation: true
+
+  - id: rule-commit-by-path
+    source: rule
+    rule: commit-by-path
+    input: |
+      Change copiloto-greenfield, task 2.5 is accepted: the gate printed no blocking line and the
+      lead's own probes passed. The report is .freeharness/sdd/copiloto-greenfield/2.5.review.md and
+      the commit message is written to .freeharness/sdd/copiloto-greenfield/2.5.msg.txt. Tick the
+      task in tasks.md and commit it.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+          __pycache__/
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. API
+
+          - [x] 2.4 Orders route retries the upstream inventory call
+            Verify: pytest tests/test_routes.py -q
+            Boundary: src/api/routes.py, tests/test_routes.py
+            Depends: none
+
+          - [ ] 2.5 Health endpoint reports the inventory dependency
+            Verify: pytest tests/test_health.py -q
+            Interfaces: GET /health -> {"status": str, "inventory": str}
+            Boundary: src/api/health.py, tests/test_health.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/2.5.review.md
+        content: |
+          ```json
+          {"task": "2.5", "status": "completed", "files_changed": ["src/api/health.py", "tests/test_health.py"], "tests_run": [{"command": "pytest tests/test_health.py -q", "result": "pass", "summary": "2 passed"}], "evidence": ["P1: /health reports inventory up", "P2: /health reports inventory down"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - pytest tests/test_health.py -q: 2 passed
+          - P1, P2: pass
+          - gate: 0 blocking, 0 follow-up
+          - Verdict: accepted.
+
+          ## Checkpoint
+          ### Intent
+          - Health endpoint reports the inventory dependency.
+          ### Files and code
+          - src/api/health.py, tests/test_health.py
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Commit.
+      - path: .freeharness/sdd/copiloto-greenfield/2.5.msg.txt
+        content: |
+          feat(api): health endpoint reports the inventory dependency
+      - path: src/api/health.py
+        content: |
+          def health(inventory_up: bool) -> dict:
+              return {"status": "ok", "inventory": "up" if inventory_up else "down"}
+      - path: tests/test_health.py
+        content: |
+          from src.api.health import health
+
+
+          def test_inventory_up():
+              assert health(True)["inventory"] == "up"
+
+
+          def test_inventory_down():
+              assert health(False)["inventory"] == "down"
+      - path: src/api/routes.py
+        content: |
+          def get_order(order_id: str) -> dict:
+              return {"id": order_id}
+    expected_regex: "validate-handoff\\.mjs commit"
+    graders:
+      - type: tool_used
+        expected: "Bash:validate-handoff.mjs commit"
+      - type: tool_used
+        not_expected:
+          - "Bash:git add"
+          - "Bash:git commit"
+      - type: llm
+        rubric: "Grade the command shape only. Fail when the lead stages or commits with git add or git commit; pass when the commit goes through validate-handoff.mjs commit with the review package, -F with the message file and --lead with the ticked tasks.md, which commits the report's files and the lead's path by path."
+    ablation: true
+
+  - id: rule-refuse-unscoped-brief
+    source: rule
+    rule: changed-term-check
+    input: |
+      Change copiloto-greenfield, task 3.4: rename the config key retry_budget to retry_limit.
+      The draft brief .freeharness/sdd/copiloto-greenfield/3.4.brief.md declares "Changes: retry_budget"
+      and a write scope of src/infra/retry.py only,
+      while tests/test_config.py and docs/CONFIG.md also name retry_budget and no Unaffected line
+      covers them. The briefs check refuses the brief. State the lead's next step.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 3. Resilience
+
+          - [ ] 3.4 Rename the config key retry_budget to retry_limit
+            Verify: pytest tests/test_retry.py -q
+            Interfaces: RetryConfig.retry_limit: int
+            Boundary: src/infra/retry.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/3.4.brief.md
+        content: |
+          # Brief 3.4: Rename the retry budget config key
+
+          Change: copiloto-greenfield
+          Task: 3.4
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Changes: retry_budget
+          Suite: pytest -q
+          Base: 7c4a8d09ca3762af61e59520943dc26494f8941b
+          Report: .freeharness/sdd/copiloto-greenfield/3.4.review.md
+
+          ## Task
+          - [ ] 3.4 Rename the config key retry_budget to retry_limit
+            Verify: pytest tests/test_retry.py -q
+            Interfaces: RetryConfig.retry_limit: int
+            Boundary: src/infra/retry.py
+            Depends: none
+
+          ## Why and rulings
+          The key counts attempts, not time, so retry_limit names it.
+          D:no-alias: the old key retry_budget is removed, never kept as an alias.
+
+          ## Write scope
+          - src/infra/retry.py
+
+          ## Interfaces
+          - Consumes: none
+          - Produces: RetryConfig.retry_limit: int
+
+          ## Boundary
+          - Files outside the write scope stay untouched.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_retry.py -q -k limit -> RetryConfig(retry_limit=3) stops after 3 attempts
+          P2: grep -rn retry_budget src/ -> no match
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_retry.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: src/infra/retry.py
+        content: |
+          """Retry configuration."""
+          from dataclasses import dataclass
+
+
+          @dataclass
+          class RetryConfig:
+              retry_budget: int = 3
+      - path: tests/test_retry.py
+        content: |
+          from src.infra.retry import RetryConfig
+
+
+          def test_default_attempts():
+              assert RetryConfig() == RetryConfig()
+      - path: tests/test_config.py
+        content: |
+          from src.infra.retry import RetryConfig
+
+
+          def test_config_key():
+              assert RetryConfig(retry_budget=5).retry_budget == 5
+      - path: docs/CONFIG.md
+        content: |
+          # Configuration
+
+          - retry_budget: attempts before a call fails (default 3).
+    expected_regex: "Unaffected:"
+    graders:
+      - type: regex
+        expected: "Unaffected:"
+      - type: llm
+        rubric: "Fail when the lead dispatches the refused brief, overrides the check, or leaves the scope and the Unaffected lines as they were; pass when the lead dispatches nothing yet and either adds tests/test_config.py and docs/CONFIG.md to the write scope or adds an Unaffected: line with a reason for each, then reruns the briefs check."
+    ablation: true
+
+  - id: rule-verify-only
+    source: rule
+    rule: verify-only
+    input: |
+      You are the implementer for brief .freeharness/sdd/copiloto-greenfield/1.4.brief.md. Its
+      header reads "Suite: npm test" and its Verify section lists "node --test test/engine.test.js".
+      The work is done. Return the handoff and state which commands you ran.
+    workspace_files:
+      - path: package.json
+        content: |
+          {
+            "name": "copiloto-engine",
+            "version": "0.1.0",
+            "private": true,
+            "scripts": {
+              "test": "node --test"
+            }
+          }
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [ ] 1.4 decide() returns the fallback node for an unknown reason
+            Verify: node --test test/engine.test.js
+            Interfaces: decide(journey, reason) -> string
+            Boundary: src/engine.js, test/engine.test.js
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/1.4.brief.md
+        content: |
+          # Brief 1.4: fallback node for an unknown reason
+
+          Change: copiloto-greenfield
+          Task: 1.4
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - decide() gains a fallback, no identifier changes
+          Suite: npm test
+          Base: 6c8e0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f
+          Report: .freeharness/sdd/copiloto-greenfield/1.4.review.md
+
+          ## Task
+          - [ ] 1.4 decide() returns the fallback node for an unknown reason
+            Verify: node --test test/engine.test.js
+            Interfaces: decide(journey, reason) -> string
+            Boundary: src/engine.js, test/engine.test.js
+            Depends: none
+
+          ## Why and rulings
+          An unknown reason must route to the fallback node instead of returning undefined.
+          D:fallback: decide() returns "fallback" for a pair the table lacks.
+
+          ## Write scope
+          - src/engine.js
+          - test/engine.test.js
+
+          ## Interfaces
+          - Produces: decide(journey, reason) -> string
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: node --test test/engine.test.js -> the unknown-reason test passes with "fallback"
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - node --test test/engine.test.js
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: src/engine.js
+        content: |
+          const DECISION_TABLE = new Map([
+            ["sales:price", "quote"],
+            ["support:refund", "refund_form"],
+          ]);
+
+          function decide(journey, reason) {
+            return DECISION_TABLE.get(`${journey}:${reason}`) ?? "fallback";
+          }
+
+          module.exports = { decide };
+      - path: test/engine.test.js
+        content: |
+          const test = require("node:test");
+          const assert = require("node:assert");
+          const { decide } = require("../src/engine.js");
+
+          test("a known pair returns its node", () => {
+            assert.strictEqual(decide("sales", "price"), "quote");
+          });
+
+          test("an unknown reason returns the fallback node", () => {
+            assert.strictEqual(decide("sales", "weather"), "fallback");
+          });
+    expected_regex: "node --test test/engine\\.test\\.js"
+    graders:
+      - type: tool_used
+        expected: "Bash:node --test test/engine.test.js"
+      - type: tool_used
+        not_expected:
+          - "Bash:npm test"
+      - type: regex
+        not_expected:
+          - "\"command\": \"npm test\""
+      - type: llm
+        rubric: "Fail when the reply or tests_run shows the Suite: command run or claimed; pass when tests_run lists only the Verify commands and the lead is left to run the suite."
+    ablation: true
+
+  - id: rule-authorized-round-cap
+    source: rule
+    rule: round-cap
+    input: |
+      Change copiloto-greenfield: its proposal.md run authorization holds "Rounds: 5". Task 1.2
+      is after fix round 3 and the task reviewer still reports one blocking finding; the gate
+      printed "1 blocking". State the lead's next step.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+          __pycache__/
+      - path: pyproject.toml
+        content: |
+          [project]
+          name = "copiloto"
+          version = "0.1.0"
+
+          [tool.pytest.ini_options]
+          testpaths = ["tests"]
+          pythonpath = ["."]
+      - path: openspec/changes/copiloto-greenfield/proposal.md
+        content: |
+          # Proposal: copiloto-greenfield
+
+          ## Why
+          The assistant needs a deterministic engine core before the LLM layer lands.
+
+          ## What Changes
+          - A decision-table engine in src/core/engine.py.
+
+          ## Run authorization
+          Rounds: 5
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Engine
+
+          - [ ] 1.2 decide() returns the final node per (journey, reason) from the decision table
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(journey: str, reason: str) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/1.2.brief.md
+        content: |
+          # Brief 1.2: decide() over the decision table
+
+          Change: copiloto-greenfield
+          Task: 1.2
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - adds decide(), no existing identifier changes
+          Suite: pytest -q
+          Base: 1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a
+          Report: .freeharness/sdd/copiloto-greenfield/1.2.review.md
+
+          ## Task
+          - [ ] 1.2 decide() returns the final node per (journey, reason) from the decision table
+            Verify: pytest tests/test_engine.py -q
+            Interfaces: decide(journey: str, reason: str) -> str
+            Boundary: src/core/engine.py, tests/test_engine.py
+            Depends: none
+
+          ## Why and rulings
+          The engine routes every turn through one table, so the final node is a lookup, never a branch.
+          D:case-fold: decide() matches journey and reason case-insensitively.
+
+          ## Write scope
+          - src/core/engine.py
+          - tests/test_engine.py
+
+          ## Interfaces
+          - Produces: decide(journey: str, reason: str) -> str
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: pytest tests/test_engine.py -q -k case -> decide("Sales", "PRICE") returns "quote"
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - pytest tests/test_engine.py -q
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/1.2.findings.md
+        content: |
+          F1 open r3: src/core/engine.py:9: P1 defect: decide() folds the reason but not the journey, so decide("Sales", "PRICE") returns "fallback". fold both keys.
+      - path: .freeharness/sdd/copiloto-greenfield/1.2.review.md
+        content: |
+          ```json
+          {"task": "1.2", "status": "completed", "files_changed": ["src/core/engine.py", "tests/test_engine.py"], "tests_run": [{"command": "pytest tests/test_engine.py -q", "result": "pass", "summary": "2 passed"}], "evidence": ["P1: decide(\"Sales\", \"PRICE\") checked"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - pytest tests/test_engine.py -q: 2 passed
+
+          round 1/5: 1/1
+          round 2/5: 1/1
+          round 3/5: 1/1
+
+          ## Checkpoint
+          ### Intent
+          - decide() over the decision table, case-insensitive.
+          ### Files and code
+          - src/core/engine.py, tests/test_engine.py
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - F1 open: the journey key is not folded
+          ### Next step
+          - Fix round 4.
+      - path: src/core/engine.py
+        content: |
+          DECISION_TABLE = {
+              ("sales", "price"): "quote",
+              ("support", "refund"): "refund_form",
+          }
+
+
+          def decide(journey: str, reason: str) -> str:
+              key = (journey, reason.lower())
+              return DECISION_TABLE.get(key, "fallback")
+      - path: tests/test_engine.py
+        content: |
+          from src.core.engine import decide
+
+
+          def test_known_pair():
+              assert decide("sales", "price") == "quote"
+
+
+          def test_reason_case():
+              assert decide("sales", "PRICE") == "quote"
+    expected_regex: "round-base"
+    graders:
+      - type: llm
+        rubric: "Fail when the lead stops to ask before the authorized cap or opens round 6; pass when the lead runs round-base 4 and dispatches fix round 4 without asking."
+    ablation: true
+
+  - id: rule-base-finding-follow-up
+    source: rule
+    rule: digest-discipline
+    input: |
+      Change copiloto-greenfield: task 1.3 was accepted with a P1 defect tagged [base] and a P1
+      hardening still open in its findings ledger; its task close has not recorded them yet. The
+      lead closes 1.3 and then writes the brief for task 1.4, whose write scope overlaps the files
+      of both findings. State what the lead does with the two findings and what the 1.4 "Why and
+      rulings" section holds.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+          __pycache__/
+      - path: pyproject.toml
+        content: |
+          [project]
+          name = "copiloto"
+          version = "0.1.0"
+
+          [tool.pytest.ini_options]
+          testpaths = ["tests"]
+          pythonpath = ["."]
+      - path: openspec/config.yaml
+        content: |
+          schema: spec-driven
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. LLM client
+
+          - [x] 1.3 Retry on transient HubGPU failures
+            Verify: pytest tests/test_hubgpu.py -q
+            Boundary: src/infra/llm/hubgpu.py, tests/test_hubgpu.py
+            Depends: none
+
+          - [ ] 1.4 Stream partial completions from HubGPU
+            Verify: pytest tests/test_hubgpu.py -q
+            Interfaces: HubGPUClient.stream(prompt: str) -> Iterator[str]
+            Boundary: src/infra/llm/hubgpu.py, tests/test_hubgpu.py
+            Depends: 1.3
+      - path: .freeharness/sdd/copiloto-greenfield/1.3.findings.md
+        content: |
+          F1 open r1: src/infra/llm/hubgpu.py:14: P1 defect [base]: complete() drops the upstream error body when it re-raises, so the log shows only "503". keep the body on the raised error.
+          F2 open r1: src/infra/llm/hubgpu.py:12: P1 hardening: the retry loop has no backoff between attempts. sleep with backoff between attempts.
+      - path: .freeharness/sdd/copiloto-greenfield/1.3.review.md
+        content: |
+          ```json
+          {"task": "1.3", "status": "completed", "files_changed": ["src/infra/llm/hubgpu.py", "tests/test_hubgpu.py"], "tests_run": [{"command": "pytest tests/test_hubgpu.py -q", "result": "pass", "summary": "3 passed"}], "evidence": ["P1: two transient failures then a success return the text", "P2: three transient failures raise TransientError"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - pytest tests/test_hubgpu.py -q: 3 passed
+          - gate: 0 blocking, 2 follow-up
+          - Verdict: accepted.
+
+          ## Checkpoint
+          ### Intent
+          - Retry transient HubGPU failures.
+          ### Files and code
+          - src/infra/llm/hubgpu.py, tests/test_hubgpu.py
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Task close.
+      - path: src/infra/llm/hubgpu.py
+        content: |
+          class TransientError(Exception):
+              pass
+
+
+          class HubGPUClient:
+              def __init__(self, transport, attempts: int = 3):
+                  self.transport = transport
+                  self.attempts = attempts
+
+              def complete(self, prompt: str) -> str:
+                  for attempt in range(self.attempts):
+                      try:
+                          return self.transport(prompt)
+                      except TransientError:
+                          if attempt == self.attempts - 1:
+                              raise TransientError("503")
+                  raise AssertionError("unreachable")
+      - path: tests/test_hubgpu.py
+        content: |
+          import pytest
+
+          from src.infra.llm.hubgpu import HubGPUClient, TransientError
+
+
+          def flaky(failures):
+              calls = {"n": 0}
+
+              def transport(prompt):
+                  calls["n"] += 1
+                  if calls["n"] <= failures:
+                      raise TransientError("503 upstream busy")
+                  return f"ok:{prompt}"
+
+              return transport
+
+
+          def test_first_call_succeeds():
+              assert HubGPUClient(flaky(0)).complete("hi") == "ok:hi"
+
+
+          def test_recovers_after_two_failures():
+              assert HubGPUClient(flaky(2)).complete("hi") == "ok:hi"
+
+
+          def test_gives_up_after_three_failures():
+              with pytest.raises(TransientError):
+                  HubGPUClient(flaky(3)).complete("hi")
+    expected_regex: "openspec follow-up add"
+    graders:
+      - type: regex
+        flags: im
+        not_expected:
+          - "^\\s*-?\\s*(D:[a-z0-9-]+|R:\\d+(\\.\\d+)+):[^\\n]*(\\[base\\]|hardening)"
+      - type: llm
+        rubric: "Fail when the 1.4 brief carries either finding as a ruling, a design decision or a write-scope obligation; pass when the lead closes 1.3 by running openspec follow-up add once for each finding and the 1.4 digest and write scope hold neither."
+    ablation: true
+
+  - id: rule-reviewer-shape-follow-up
+    source: rule
+    rule: evidence-blocking
+    input: |
+      Change copiloto-greenfield, task 2.2 (Class: security): every brief probe passes at HEAD,
+      the corpus probe loses no deny of the base, and the task reviewer reports one P1 on a new
+      quoting shape it wrote itself, which no probe, scenario or corpus line covers. State the
+      lead's next step.
+    workspace_files:
+      - path: openspec/config.yaml
+        content: |
+          schema: spec-driven
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. Guard
+
+          - [ ] 2.2 The config guard denies a destructive Bash command on the harness config directory
+            Verify: node --test test/config-guard.test.mjs
+            Interfaces: hooks/config-guard.mjs reads a PreToolUse payload on stdin and prints a deny verdict
+            Boundary: hooks/config-guard.mjs, test/config-guard.test.mjs, test/fixtures/guard-corpus.jsonl
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/2.2.brief.md
+        content: |
+          # Brief 2.2: config guard denies destructive commands on the config directory
+
+          Change: copiloto-greenfield
+          Task: 2.2
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: security
+          Effort: high
+          Changes: none - adds the guard hook, no existing identifier changes
+          Suite: node --test test/
+          Base: 0d2f4a6c8e0b2d4f6a8c0e2b4d6f8a0c2e4b6d8f
+          Report: .freeharness/sdd/copiloto-greenfield/2.2.review.md
+
+          ## Task
+          - [ ] 2.2 The config guard denies a destructive Bash command on the harness config directory
+            Verify: node --test test/config-guard.test.mjs
+            Interfaces: hooks/config-guard.mjs reads a PreToolUse payload on stdin and prints a deny verdict
+            Boundary: hooks/config-guard.mjs, test/config-guard.test.mjs, test/fixtures/guard-corpus.jsonl
+            Depends: none
+
+          ## Why and rulings
+          A worker's Bash command must never remove the harness config directory.
+          D:deny-rm: a Bash command whose words remove ~/.claude or a path under it gets a deny verdict.
+
+          ## Write scope
+          - hooks/config-guard.mjs
+          - test/config-guard.test.mjs
+          - test/fixtures/guard-corpus.jsonl
+
+          ## Interfaces
+          - Produces: hooks/config-guard.mjs prints {"decision":"deny","reason":...} for a denied payload, nothing otherwise
+
+          ## Boundary
+          - No other hook changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: node hooks/config-guard.mjs < test/fixtures/rm-claude.json -> prints a deny verdict
+          P2: node hooks/config-guard.mjs < test/fixtures/ls-claude.json -> prints nothing (allow)
+          P3: node test/replay-corpus.mjs test/fixtures/guard-corpus.jsonl -> every deny line of the base still denies
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+          - A probe of a guard verdict runs the hook through node on a payload file, never the probed command typed into Bash.
+
+          ## Verify
+          - node --test test/config-guard.test.mjs
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/2.2.review.md
+        content: |
+          ```json
+          {"task": "2.2", "status": "completed", "files_changed": ["hooks/config-guard.mjs", "test/config-guard.test.mjs", "test/fixtures/guard-corpus.jsonl"], "tests_run": [{"command": "node --test test/config-guard.test.mjs", "result": "pass", "summary": "6 passed"}], "evidence": ["P1: rm-claude.json prints a deny verdict", "P2: ls-claude.json prints nothing", "P3: corpus replay keeps every deny of the base"], "partial_output": null, "blocked_reason": null, "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - node --test test/config-guard.test.mjs: 6 passed
+          - P1 deny, P2 allow, P3 corpus: no deny of the base lost
+          - Verdict: accepted for review.
+
+          Review tier: strong - S1 class security
+
+          ## Task review
+          - Probes P1 to P3 pass at HEAD.
+          - hooks/config-guard.mjs:9: P1 defect: a command word split by an empty quote pair, r''m -rf ~/.claude, passes the guard. reproducer: a payload file whose tool_input.command is r''m -rf ~/.claude, fed to node hooks/config-guard.mjs, prints nothing. join quoted fragments before matching.
+
+          ## Checkpoint
+          ### Intent
+          - Config guard denies destructive commands on the config directory.
+          ### Files and code
+          - hooks/config-guard.mjs, test/config-guard.test.mjs, test/fixtures/guard-corpus.jsonl
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - (none)
+          ### Next step
+          - Gate the task review.
+      - path: hooks/config-guard.mjs
+        content: |
+          import fs from "node:fs";
+
+          const payload = JSON.parse(fs.readFileSync(0, "utf8"));
+          const command = String(payload?.tool_input?.command ?? "");
+          const words = command.split(/\s+/);
+          const removes = words[0] === "rm" || words[0] === "rmdir";
+          const config = words.some((w) => w === "~/.claude" || w.startsWith("~/.claude/"));
+          if (removes && config) {
+            process.stdout.write(JSON.stringify({ decision: "deny", reason: "removes the config directory" }));
+          }
+      - path: test/fixtures/guard-corpus.jsonl
+        content: |
+          {"command": "rm -rf ~/.claude", "verdict": "deny"}
+          {"command": "rm ~/.claude/settings.json", "verdict": "deny"}
+          {"command": "ls ~/.claude", "verdict": "allow"}
+      - path: test/fixtures/rm-claude.json
+        content: |
+          {"tool_name": "Bash", "tool_input": {"command": "rm -rf ~/.claude"}}
+      - path: test/fixtures/ls-claude.json
+        content: |
+          {"tool_name": "Bash", "tool_input": {"command": "ls ~/.claude"}}
+      - path: test/replay-corpus.mjs
+        content: |
+          import fs from "node:fs";
+          import { spawnSync } from "node:child_process";
+
+          let lost = 0;
+          for (const line of fs.readFileSync(process.argv[2], "utf8").split("\n").filter(Boolean)) {
+            const { command, verdict } = JSON.parse(line);
+            const input = JSON.stringify({ tool_name: "Bash", tool_input: { command } });
+            const out = spawnSync("node", ["hooks/config-guard.mjs"], { input, encoding: "utf8" }).stdout;
+            const got = out.includes("\"deny\"") ? "deny" : "allow";
+            if (got !== verdict) {
+              lost++;
+              console.log(`MISMATCH ${command}: ${got}`);
+            }
+          }
+          console.log(lost ? `corpus: ${lost} mismatch` : "corpus: ok");
+          process.exitCode = lost ? 1 : 0;
+      - path: test/config-guard.test.mjs
+        content: |
+          import test from "node:test";
+          import assert from "node:assert";
+          import { spawnSync } from "node:child_process";
+
+          const verdict = (command) =>
+            spawnSync("node", ["hooks/config-guard.mjs"], { input: JSON.stringify({ tool_name: "Bash", tool_input: { command } }), encoding: "utf8" }).stdout;
+
+          test("rm -rf of the config directory is denied", () => assert.match(verdict("rm -rf ~/.claude"), /"deny"/));
+          test("rm of a config file is denied", () => assert.match(verdict("rm ~/.claude/settings.json"), /"deny"/));
+          test("rmdir of the config directory is denied", () => assert.match(verdict("rmdir ~/.claude"), /"deny"/));
+          test("listing the config directory is allowed", () => assert.equal(verdict("ls ~/.claude"), ""));
+          test("rm elsewhere is allowed", () => assert.equal(verdict("rm -rf build"), ""));
+          test("an empty command is allowed", () => assert.equal(verdict(""), ""));
+    expected_regex: "follow-up"
+    graders:
+      - type: regex
+        not_expected:
+          - "validate-handoff\\.mjs round-base"
+      - type: llm
+        rubric: "Fail when the lead opens a fix round for the reviewer-constructed shape; pass when the lead records it as a follow-up with its reproducer and accepts the task without a round."
+    ablation: true
+
+  - id: rule-round-cap-remove-addition
+    source: rule
+    rule: round-cap-removal
+    input: |
+      Change copiloto-greenfield, no run authorization: task 1.4 is after fix round 3 and its
+      only open blocking finding sits on a chdir resolver that no brief scenario or design
+      decision asked for. State the lead's next step.
+    workspace_git: true
+    workspace_files:
+      - path: .gitignore
+        content: |
+          .freeharness/
+          .worktrees/
+          node_modules/
+      - path: package.json
+        content: |
+          {
+            "name": "copiloto-cli",
+            "version": "0.1.0",
+            "private": true,
+            "type": "module",
+            "scripts": {
+              "test": "node --test"
+            }
+          }
+      - path: openspec/config.yaml
+        content: |
+          schema: spec-driven
+      - path: openspec/changes/copiloto-greenfield/proposal.md
+        content: |
+          # Proposal: copiloto-greenfield
+
+          ## Why
+          The CLI must find its config file the same way from every entry point.
+
+          ## What Changes
+          - configPath() resolves --config first, then <project root>/copiloto.json.
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. CLI
+
+          - [ ] 1.4 configPath() resolves --config first, then the project root's copiloto.json
+            Verify: node --test test/paths.test.mjs
+            Interfaces: configPath(argv: string[], root: string) -> string
+            Boundary: src/cli/paths.mjs, test/paths.test.mjs
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/1.4.brief.md
+        content: |
+          # Brief 1.4: configPath() resolution order
+
+          Change: copiloto-greenfield
+          Task: 1.4
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: code
+          Effort: medium
+          Changes: none - adds configPath(), no existing identifier changes
+          Suite: npm test
+          Base: 9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c
+          Report: .freeharness/sdd/copiloto-greenfield/1.4.review.md
+
+          ## Task
+          - [ ] 1.4 configPath() resolves --config first, then the project root's copiloto.json
+            Verify: node --test test/paths.test.mjs
+            Interfaces: configPath(argv: string[], root: string) -> string
+            Boundary: src/cli/paths.mjs, test/paths.test.mjs
+            Depends: none
+
+          ## Why and rulings
+          Every entry point must read the same config file.
+          D:order: configPath() returns the --config value when given, else <root>/copiloto.json.
+
+          ## Write scope
+          - src/cli/paths.mjs
+          - test/paths.test.mjs
+
+          ## Interfaces
+          - Produces: configPath(argv: string[], root: string) -> string
+
+          ## Boundary
+          - No other module changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: node --test test/paths.test.mjs -> --config x.json returns x.json
+          P2: node --test test/paths.test.mjs -> no flag returns <root>/copiloto.json
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - node --test test/paths.test.mjs
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/1.4.findings.md
+        content: |
+          F1 fixed r1: src/cli/paths.mjs:5: P1 defect: --config=x.json is not read. accept the = form.
+          F2 open r3: src/cli/paths.mjs:12: P1 defect: resolveFromChdir() reads INIT_CWD before the root, so a run from a subdirectory picks a stray copiloto.json. drop the INIT_CWD lookup.
+      - path: .freeharness/sdd/copiloto-greenfield/1.4.review.md
+        content: |
+          ```json
+          {"task": "1.4", "status": "completed", "files_changed": ["src/cli/paths.mjs", "test/paths.test.mjs"], "tests_run": [{"command": "node --test test/paths.test.mjs", "result": "pass", "summary": "3 passed"}], "evidence": ["P1: --config x.json returns x.json", "P2: no flag returns the root copiloto.json"], "partial_output": null, "blocked_reason": null, "concerns": ["added resolveFromChdir() so a run from a subdirectory finds the config"]}
+          ```
+
+          ## Lead evaluation
+          - node --test test/paths.test.mjs: 3 passed
+
+          round 1/3: 1/1
+          round 2/3: 0/1
+          round 3/3: 0/1
+
+          ## Checkpoint
+          ### Intent
+          - configPath() resolution order.
+          ### Files and code
+          - src/cli/paths.mjs: configPath() and resolveFromChdir(); test/paths.test.mjs
+          ### Decisions
+          - resolveFromChdir() added for subdirectory runs.
+          ### Errors and fixes
+          - --config= form fixed in round 1.
+          ### Open work
+          - F2 open: resolveFromChdir() picks a stray config
+          ### Next step
+          - Lead ruling at the round cap.
+      - path: src/cli/paths.mjs
+        content: |
+          import fs from "node:fs";
+          import path from "node:path";
+
+          export function configPath(argv, root) {
+            const i = argv.findIndex((a) => a === "--config" || a.startsWith("--config="));
+            if (i >= 0) return argv[i].includes("=") ? argv[i].split("=")[1] : argv[i + 1];
+            return resolveFromChdir(root) ?? path.join(root, "copiloto.json");
+          }
+
+          export function resolveFromChdir(root) {
+            const cwd = process.env.INIT_CWD;
+            const candidate = cwd ? path.join(cwd, "copiloto.json") : null;
+            return candidate && fs.existsSync(candidate) ? candidate : null;
+          }
+      - path: test/paths.test.mjs
+        content: |
+          import test from "node:test";
+          import assert from "node:assert";
+          import { configPath } from "../src/cli/paths.mjs";
+
+          test("--config value wins", () => assert.equal(configPath(["--config", "x.json"], "/r"), "x.json"));
+          test("--config= form wins", () => assert.equal(configPath(["--config=x.json"], "/r"), "x.json"));
+          test("no flag falls back to the root file", () => assert.equal(configPath([], "/r"), "/r/copiloto.json"));
+    expected_regex: "remove the addition"
+    graders:
+      - type: regex
+        not_expected:
+          - "round-base \\S+ 4"
+      - type: llm
+        rubric: "Fail when the lead stops to ask the owner or opens round 4; pass when the lead rules remove the addition, briefs sub-task 1.4.1 to remove the resolver and records the resolver as a follow-up without asking."
+    ablation: true
+
+  - id: rule-guard-false-positive
+    source: rule
+    rule: guard-false-positive
+    input: |
+      Change copiloto-greenfield, task 1.3, fix round 2: the worker returned blocked with
+      needs-confirm because the config guard denied its Verify line
+      "cd packages/cli && node --import tsx --test test/sdd-guard.test.ts", which names no
+      guarded path. State the lead's next step.
+    workspace_files:
+      - path: openspec/config.yaml
+        content: |
+          schema: spec-driven
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 1. Guard
+
+          - [ ] 1.3 The SDD guard allows a test command that names no guarded path
+            Verify: cd packages/cli && node --import tsx --test test/sdd-guard.test.ts
+            Interfaces: sddGuard(command: string) -> "allow" | "deny"
+            Boundary: packages/cli/src/sdd-guard.ts, packages/cli/test/sdd-guard.test.ts
+            Depends: none
+      - path: .freeharness/sdd/copiloto-greenfield/1.3.brief.md
+        content: |
+          # Brief 1.3: SDD guard allows unguarded test commands
+
+          Change: copiloto-greenfield
+          Task: 1.3
+          Spec: copiloto-greenfield
+          Tier: strong
+          Class: security
+          Effort: high
+          Changes: none - narrows the deny match, no identifier changes
+          Suite: npm test
+          Base: 4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8c0e2b
+          Report: .freeharness/sdd/copiloto-greenfield/1.3.review.md
+
+          ## Task
+          - [ ] 1.3 The SDD guard allows a test command that names no guarded path
+            Verify: cd packages/cli && node --import tsx --test test/sdd-guard.test.ts
+            Interfaces: sddGuard(command: string) -> "allow" | "deny"
+            Boundary: packages/cli/src/sdd-guard.ts, packages/cli/test/sdd-guard.test.ts
+            Depends: none
+
+          ## Why and rulings
+          The guard denied every command that mentioned a test file, which stopped workers on their own Verify lines.
+          D:guarded-paths: sddGuard() denies only a command naming .claude/settings.json or .claude/hooks.
+
+          ## Write scope
+          - packages/cli/src/sdd-guard.ts
+          - packages/cli/test/sdd-guard.test.ts
+
+          ## Interfaces
+          - Produces: sddGuard(command: string) -> "allow" | "deny"
+
+          ## Boundary
+          - No other guard changes.
+
+          ## Depends
+          none
+
+          ## Acceptance probes
+          P1: cd packages/cli && node --import tsx --test test/sdd-guard.test.ts -> a test command naming no guarded path is allowed
+          P2: cd packages/cli && node --import tsx --test test/sdd-guard.test.ts -> a command writing .claude/settings.json is denied
+          P3: cd packages/cli && node --import tsx --test --test-name-pattern corpus test/sdd-guard.test.ts -> every deny line of the guard corpus still denies
+
+          ## Project rules
+          - Artifacts (code, comments, docs, tests, reports) in English; no bold markdown anywhere.
+
+          ## Verify
+          - cd packages/cli && node --import tsx --test test/sdd-guard.test.ts
+
+          ## Run rules
+          - Build before tests (`npm run build` at the repo root, or `-w freeharness` for the CLI package; after a canonical/ edit, `npm run bundle:canonical -w freeharness` first); a Verify item testing a bundled or built file is preceded by its rebuild command, which the worker runs.
+          - Run tests in the foreground and wait for the exit code; give any run that may exceed two minutes an explicit Bash timeout (up to 600000 ms), since the tool moves a longer foreground command to the background, and never use run_in_background for tests.
+          - A command denied by a permission prompt or a guard ends the step: reply blocked with `needs-confirm`; never retry it verbatim and never reach the same effect through another tool.
+          - Never pipe test output through `tail` or `head`; keep the full output.
+          - One idle notification ends a wait; never wait on a finished background run.
+          - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
+          - The reply is the JSON block plus the report path, under 8,000 characters.
+          - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
+          - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
+          - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
+          - The handoff guard measures the comment share of every edited source file and fails one over 30% (grown-only when the file was over at the base); keep comments to the why and the share in line with the surrounding code.
+          - Reply and report in English; every comment, docstring, test title and doc passage passes the HEAD-reader test: no task numbers, ruling ids, round or review references (the `commit` field of a PROVENANCE row is the one convention that names the task).
+          - Never `git stash`, `git checkout --` or `git reset` in the shared working tree; prove RED by writing the tests first or against a temp copy of the pre-change file.
+          - Never write the git index: no `git add`, `git rm`, `git mv`, `git commit`; delete a file with a plain `rm` and claim it in `files_changed`.
+          - Never run the `Suite:` command; run only the `## Verify` commands (the lead runs the full suite).
+          - A failing test or a regression the task did not expect is handled with the systematic-debugging skill (reproduce, isolate, root fix, verify) before any code change.
+          - The report ends with `## Checkpoint` holding six subsections with these exact headings in this order: `### Intent`, `### Files and code`, `### Decisions` (decisions with the approaches tried and rejected), `### Errors and fixes`, `### Open work`, `### Next step`; terse `- ` lines, `(none)` when empty, at most 8,000 characters (target 4,000); on a fix round it is the complete merged state, never an appended delta.
+
+          ## Handoff
+          Write the review package to the Report path: the JSON handoff block first
+          (reference/handoff.md), then the report body, then the checkpoint. Return only the JSON
+          block and the report path to the caller. Never dispatch subagents. Other implementers
+          write in the same tree, so never `git stash`, `git checkout --` or `git reset` here: prove
+          a failing test by writing it first, or against a temp copy of the file. On a stop
+          condition, return `blocked` with the stop token and one line of detail.
+      - path: .freeharness/sdd/copiloto-greenfield/1.3.findings.md
+        content: |
+          F1 open r1: packages/cli/src/sdd-guard.ts:4: P1 defect: a command naming .claude/hooks under a quoted path is allowed, failing P2. match the path after unquoting.
+      - path: .freeharness/sdd/copiloto-greenfield/1.3.review.md
+        content: |
+          ```json
+          {"task": "1.3", "status": "blocked", "files_changed": ["packages/cli/src/sdd-guard.ts", "packages/cli/test/sdd-guard.test.ts"], "tests_run": [{"command": "cd packages/cli && node --import tsx --test test/sdd-guard.test.ts", "result": "unavailable", "summary": "denied by the config guard"}], "evidence": ["P1: not run, the Verify line was denied", "P2: not run, the Verify line was denied", "P3: not run, the Verify line was denied"],"partial_output": null, "blocked_reason": "needs-confirm: the config guard denied the Verify line cd packages/cli && node --import tsx --test test/sdd-guard.test.ts", "concerns": []}
+          ```
+
+          ## Lead evaluation
+          - Round 1: 3 passed; Verdict: accepted for review.
+
+          round 1/3: 0/1
+
+          ## Fix round 2
+          - F1: the guard unquotes the command before matching .claude/hooks.
+          - Verify line denied by the config guard; returned blocked with needs-confirm.
+
+          ## Checkpoint
+          ### Intent
+          - The SDD guard allows unguarded test commands and denies guarded paths, quoted or not.
+          ### Files and code
+          - packages/cli/src/sdd-guard.ts: unquote before matching; packages/cli/test/sdd-guard.test.ts: quoted-path case.
+          ### Decisions
+          - (none)
+          ### Errors and fixes
+          - (none)
+          ### Open work
+          - Verify not run: the config guard denied the line.
+          ### Next step
+          - Rerun Verify.
+      - path: .freeharness/sdd/copiloto-greenfield/rounds/1.3-r2/absent.txt
+        content: ""
+      - path: .freeharness/sdd/copiloto-greenfield/rounds/1.3-r2/packages/cli/src/sdd-guard.ts
+        content: |
+          const GUARDED = [".claude/settings.json", ".claude/hooks"];
+
+          export function sddGuard(command: string): "allow" | "deny" {
+            return GUARDED.some((p) => command.includes(p)) ? "deny" : "allow";
+          }
+      - path: .freeharness/sdd/copiloto-greenfield/rounds/1.3-r2/packages/cli/test/sdd-guard.test.ts
+        content: |
+          import test from "node:test";
+          import assert from "node:assert";
+          import { sddGuard } from "../src/sdd-guard.ts";
+
+          test("a test command naming no guarded path is allowed", () => assert.equal(sddGuard("node --test test/x.test.ts"), "allow"));
+          test("a write to the settings file is denied", () => assert.equal(sddGuard("echo x > .claude/settings.json"), "deny"));
+          test("corpus: every deny line still denies", () => {
+            for (const c of ["echo x > .claude/settings.json", "cp x .claude/hooks/pre.sh"]) assert.equal(sddGuard(c), "deny", c);
+          });
+      - path: packages/cli/src/sdd-guard.ts
+        content: |
+          const GUARDED = [".claude/settings.json", ".claude/hooks"];
+
+          export function sddGuard(command: string): "allow" | "deny" {
+            const plain = command.replace(/["']/g, "");
+            return GUARDED.some((p) => plain.includes(p)) ? "deny" : "allow";
+          }
+      - path: packages/cli/test/sdd-guard.test.ts
+        content: |
+          import test from "node:test";
+          import assert from "node:assert";
+          import { sddGuard } from "../src/sdd-guard.ts";
+
+          test("a test command naming no guarded path is allowed", () => assert.equal(sddGuard("node --test test/x.test.ts"), "allow"));
+          test("a write to the settings file is denied", () => assert.equal(sddGuard("echo x > .claude/settings.json"), "deny"));
+          test("corpus: every deny line still denies", () => {
+            for (const c of ["echo x > .claude/settings.json", "cp x .claude/hooks/pre.sh"]) assert.equal(sddGuard(c), "deny", c);
+          });
+          test("a quoted hooks path is denied", () => assert.equal(sddGuard("rm '.claude/hooks/x.sh'"), "deny"));
+    expected_regex: "(?<!\\bto )\\b(?:re-?ran|re-?run(?:s|ning)?|ran\\b[^\\n]{0,80}?\\bmyself|runs?\\b[^\\n]{0,80}?\\bitself)\\b[\\s\\S]{0,300}?\\b(?:pass(?:ed|es)?|fail(?:ed|s|ure)?|exit(?:ed|s)?|error|cannot find|not found)\\b"
+    graders:
+      - type: regex
+        flags: i
+        expected: "(?<!\\bto )\\b(?:re-?ran|re-?run(?:s|ning)?|ran\\b[^\\n]{0,80}?\\bmyself|runs?\\b[^\\n]{0,80}?\\bitself)\\b[\\s\\S]{0,300}?\\b(?:pass(?:ed|es)?|fail(?:ed|s|ure)?|exit(?:ed|s)?|error|cannot find|not found)\\b"
+      - type: regex
+        flags: i
+        expected: "follow-up"
+      - type: regex
+        not_expected:
+          - "validate-handoff\\.mjs round-base"
+          - "## Controller ruling"
+          - "R:1\\.3\\.\\d"
+      - type: llm
+        rubric: "Fail when the lead opens the next round, writes a controller ruling or a new R: id; pass when the lead reruns the denied line itself and states its result, re-dispatches the same round only to rerun Verify without round-base, and records the denied shape once as a follow-up. The rerun's outcome is not graded: in this workspace the line may fail (no tsx is installed) or pass."
+    ablation: true
+
+  - id: rule-guard-probe-payload
+    source: rule
+    rule: probe-payload
+    input: |
+      Change copiloto-greenfield, task 4.1, security brief for a config-guard task: the hook
+      must deny a destructive Bash command such as "rm -rf ~/.claude". Write the acceptance
+      probe that checks the deny verdict.
+    workspace_files:
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 4. Config guard
+
+          - [ ] 4.1 The config guard hook denies a destructive Bash command on the harness config directory
+            Verify: node --test test/config-guard.test.mjs
+            Interfaces: hooks/config-guard.mjs reads a PreToolUse payload on stdin and prints a deny verdict
+            Boundary: hooks/config-guard.mjs, test/config-guard.test.mjs, test/fixtures/
+            Depends: none
+      - path: hooks/config-guard.mjs
+        content: |
+          import fs from "node:fs";
+
+          const payload = JSON.parse(fs.readFileSync(0, "utf8"));
+          const command = String(payload?.tool_input?.command ?? "");
+          if (/^rm\s/.test(command) && command.includes("~/.claude")) {
+            process.stdout.write(JSON.stringify({ decision: "deny", reason: "removes the config directory" }));
+          }
+    expected_regex: "\\.json"
+    graders:
+      - type: regex
+        expected: "(\\bnode\\s[^\\n]*\\.json|\\.json[^\\n]*\\|\\s*node\\b)"
+      - type: regex
+        expected: "\\.json"
+      - type: tool_used
+        not_expected:
+          - "Bash:rm -rf"
+      - type: llm
+        rubric: "Fail when a probe types the probed command into Bash; pass when every guard-verdict probe feeds a payload file to the hook through node."
+    ablation: true