freeharness 0.4.2 → 0.4.3

package/canonical/hooks/freeharness-cost-tracker.mjs

@@ -611,7 +611,7 @@ function pointerLine(file) {
  * A task worktree checks out openspec/changes/ but not the gitignored workspace, so its records belong to the main worktree.
  * Only a directory lexically under a real `<main>/.worktrees/` maps, so a forged `.git` can name only a root that already holds it, and a symlinked `.worktrees` cannot pull an outside tree in.
  * @param {string} dir Real path of a directory holding a project marker.
- * @returns {string | null} Real path of the main worktree; null on any read or parse failure.
+ * @returns {string | null} Real path of the main worktree; null on any read or parse failure, when the directory is not under `<main>/.worktrees/`, or when the main worktree holds no project marker.
  */
 export function mainWorktreeOf(dir) {
   try {
@@ -1262,7 +1262,7 @@ function sessionTags(root, sessionId, signals) {
   return { change, changes, task: brief?.task ?? null, tier: brief?.tier ?? null, task_class: brief?.task_class ?? "untagged" };
 }
 
-const MEM_DATA_DIR_KEYS = ["FREE_MEM_DATA_DIR", "CLAUDE_MEM_DATA_DIR"];
+const MEM_DATA_DIR_KEYS = ["FREE_MEM_DATA_DIR"];
 const BOM = 0xfeff;
 
 function expandMemHome(p, home) {
@@ -1270,14 +1270,6 @@ function expandMemHome(p, home) {
   return p.startsWith("~/") ? path.join(home, p.slice(2)) : p;
 }
 
-function isMemDirectory(p) {
-  try {
-    return fs.statSync(p).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
 /** Keys as the engine reads them: BOM dropped, `env` first. */
 function readMemSettings(file) {
   try {
@@ -1296,34 +1288,29 @@ export function resolveMemoryDataDir(env, home) {
     if (typeof env[key] === "string" && env[key]) return expandMemHome(env[key], home);
   }
   const freeDir = path.join(home, ".free-mem");
-  const legacyDir = path.join(home, ".claude-mem");
-  const defaults = [path.resolve(freeDir), path.resolve(legacyDir)];
-  for (const dir of [freeDir, legacyDir]) {
-    const s = readMemSettings(path.join(dir, "settings.json"));
-    for (const key of MEM_DATA_DIR_KEYS) {
-      const value = s ? s[key] : undefined;
-      if (typeof value !== "string" || !value) continue;
-      const target = expandMemHome(value, home);
-      // A seeded default is not a redirect; honoring it would pin the directory choice.
-      if (!defaults.includes(path.resolve(target))) return target;
-    }
+  const defaults = [path.resolve(freeDir), path.resolve(home, ".claude-mem")];
+  const s = readMemSettings(path.join(freeDir, "settings.json"));
+  for (const key of MEM_DATA_DIR_KEYS) {
+    const value = s ? s[key] : undefined;
+    if (typeof value !== "string" || !value) continue;
+    const target = expandMemHome(value, home);
+    // A seeded or hand-copied default is no redirect; honoring it would pin the directory choice.
+    if (!defaults.includes(path.resolve(target))) return target;
   }
-  return isMemDirectory(freeDir) || !isMemDirectory(legacyDir) ? freeDir : legacyDir;
+  return freeDir;
 }
 
-/** A resolver error falls back to the legacy default directory. */
+/** A resolver error falls back to the default directory. */
 function memoryDataDir() {
   try {
     return resolveMemoryDataDir(process.env, os.homedir());
   } catch {
-    return path.join(os.homedir(), ".claude-mem");
+    return path.join(os.homedir(), ".free-mem");
   }
 }
 
-/** `free-mem.db` when present, else the `claude-mem.db` an unmigrated engine still writes. */
 function memoryDatabase(dataDir) {
-  const db = path.join(dataDir, "free-mem.db");
-  return fs.existsSync(db) ? db : path.join(dataDir, "claude-mem.db");
+  return path.join(dataDir, "free-mem.db");
 }
 
 /** The `sqlite3` binary from an absolute PATH entry only, never a bare name handed to the child process's PATH search. */

package/canonical/hooks/freeharness-precompact.mjs

@@ -252,7 +252,7 @@ export function skeletonFromFacts(facts, payload, opts = {}) {
 }
 
 // The engine's data-dir and port rule; an emitted hook cannot import the engine.
-const MEM_DATA_DIR_KEYS = ["FREE_MEM_DATA_DIR", "CLAUDE_MEM_DATA_DIR"];
+const MEM_DATA_DIR_KEYS = ["FREE_MEM_DATA_DIR"];
 const BOM = 0xfeff;
 
 function expandMemHome(p, home) {
@@ -260,14 +260,6 @@ function expandMemHome(p, home) {
   return p.startsWith("~/") ? path.join(home, p.slice(2)) : p;
 }
 
-function isMemDirectory(p) {
-  try {
-    return fs.statSync(p).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
 /** Keys as the engine reads them: BOM dropped, `env` first. */
 function readMemSettings(file) {
   try {
@@ -291,27 +283,24 @@ export function resolveMemoryDataDir(env, home) {
     if (typeof env[key] === "string" && env[key]) return expandMemHome(env[key], home);
   }
   const freeDir = path.join(home, ".free-mem");
-  const legacyDir = path.join(home, ".claude-mem");
-  const defaults = [path.resolve(freeDir), path.resolve(legacyDir)];
-  for (const dir of [freeDir, legacyDir]) {
-    const s = readMemSettings(path.join(dir, "settings.json"));
-    for (const key of MEM_DATA_DIR_KEYS) {
-      const value = s ? s[key] : undefined;
-      if (typeof value !== "string" || !value) continue;
-      const target = expandMemHome(value, home);
-      // A seeded default is not a redirect; honoring it would pin the directory choice.
-      if (!defaults.includes(path.resolve(target))) return target;
-    }
+  const defaults = [path.resolve(freeDir), path.resolve(home, ".claude-mem")];
+  const s = readMemSettings(path.join(freeDir, "settings.json"));
+  for (const key of MEM_DATA_DIR_KEYS) {
+    const value = s ? s[key] : undefined;
+    if (typeof value !== "string" || !value) continue;
+    const target = expandMemHome(value, home);
+    // A seeded or hand-copied default is no redirect; honoring it would pin the directory choice.
+    if (!defaults.includes(path.resolve(target))) return target;
   }
-  return isMemDirectory(freeDir) || !isMemDirectory(legacyDir) ? freeDir : legacyDir;
+  return freeDir;
 }
 
 /** The worker port: env (empty is unset), then the data dir's settings, else the default; pure over (env, home). */
 export function resolveWorkerPort(env, home) {
-  const fromEnv = memPort(env.FREE_MEM_WORKER_PORT || env.CLAUDE_MEM_WORKER_PORT);
+  const fromEnv = memPort(env.FREE_MEM_WORKER_PORT);
   if (fromEnv !== null) return fromEnv;
   const s = readMemSettings(path.join(resolveMemoryDataDir(env, home), "settings.json"));
-  const fromSettings = s ? memPort(s.FREE_MEM_WORKER_PORT ?? s.CLAUDE_MEM_WORKER_PORT) : null;
+  const fromSettings = s ? memPort(s.FREE_MEM_WORKER_PORT) : null;
   return fromSettings ?? defaultWorkerPort();
 }
 

package/canonical/hooks/freeharness-sdd-context.mjs

@@ -664,7 +664,7 @@ function workerOff() {
 }
 
 // The engine's data-dir and port rule, as in freeharness-precompact.mjs, a separate emitted script.
-const MEM_DATA_DIR_KEYS = ["FREE_MEM_DATA_DIR", "CLAUDE_MEM_DATA_DIR"];
+const MEM_DATA_DIR_KEYS = ["FREE_MEM_DATA_DIR"];
 const BOM = 0xfeff;
 
 function expandMemHome(p, home) {
@@ -672,14 +672,6 @@ function expandMemHome(p, home) {
   return p.startsWith("~/") ? path.join(home, p.slice(2)) : p;
 }
 
-function isMemDirectory(p) {
-  try {
-    return fs.statSync(p).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
 /** Keys as the engine reads them: BOM dropped, `env` first. */
 function readMemSettings(file) {
   try {
@@ -703,27 +695,24 @@ export function resolveMemoryDataDir(env, home) {
     if (typeof env[key] === "string" && env[key]) return expandMemHome(env[key], home);
   }
   const freeDir = path.join(home, ".free-mem");
-  const legacyDir = path.join(home, ".claude-mem");
-  const defaults = [path.resolve(freeDir), path.resolve(legacyDir)];
-  for (const dir of [freeDir, legacyDir]) {
-    const s = readMemSettings(path.join(dir, "settings.json"));
-    for (const key of MEM_DATA_DIR_KEYS) {
-      const value = s ? s[key] : undefined;
-      if (typeof value !== "string" || !value) continue;
-      const target = expandMemHome(value, home);
-      // A seeded default is not a redirect; honoring it would pin the directory choice.
-      if (!defaults.includes(path.resolve(target))) return target;
-    }
+  const defaults = [path.resolve(freeDir), path.resolve(home, ".claude-mem")];
+  const s = readMemSettings(path.join(freeDir, "settings.json"));
+  for (const key of MEM_DATA_DIR_KEYS) {
+    const value = s ? s[key] : undefined;
+    if (typeof value !== "string" || !value) continue;
+    const target = expandMemHome(value, home);
+    // A seeded or hand-copied default is no redirect; honoring it would pin the directory choice.
+    if (!defaults.includes(path.resolve(target))) return target;
   }
-  return isMemDirectory(freeDir) || !isMemDirectory(legacyDir) ? freeDir : legacyDir;
+  return freeDir;
 }
 
 /** The worker port: env (empty is unset), then the data dir's settings, else the default; pure over (env, home). */
 export function resolveWorkerPort(env, home) {
-  const fromEnv = memPort(env.FREE_MEM_WORKER_PORT || env.CLAUDE_MEM_WORKER_PORT);
+  const fromEnv = memPort(env.FREE_MEM_WORKER_PORT);
   if (fromEnv !== null) return fromEnv;
   const s = readMemSettings(path.join(resolveMemoryDataDir(env, home), "settings.json"));
-  const fromSettings = s ? memPort(s.FREE_MEM_WORKER_PORT ?? s.CLAUDE_MEM_WORKER_PORT) : null;
+  const fromSettings = s ? memPort(s.FREE_MEM_WORKER_PORT) : null;
   return fromSettings ?? defaultWorkerPort();
 }
 

package/canonical/hooks/hooks.config-guard.claude-code.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "FreeHarness config guard for Claude Code (rules capability). Merged additively into settings.json. PreToolUse on Edit|Write|MultiEdit|Bash: denies writes to live harness configuration, which runs code or loads instructions in every session, unless <project>/.freeharness/allow-config-edit (or ~/.claude/freeharness/allow-config-edit) exists and is younger than --ttl minutes (240 minutes; a numeric epoch-ms or ISO body sets an explicit expiry). The live set is judged by location at the written and the real path: settings.json and settings.local.json inside a .claude dir, any .mcp.json, ~/.claude.json, ~/.claude/CLAUDE.md, everything under ~/.claude/plugins and under the hooks dir of a .claude, .freeharness, ~/.claude/freeharness or freeharness-plugin dir, a plugin's hooks/hooks.json, the marker, and the dirs whose removal takes one of them (CLAUDE_CONFIG_DIR gets every ~/.claude rule); a project CLAUDE.md, a settings.json, hooks.json or hook source elsewhere and a copy in the temp root outside the home and project pass. Bash is judged per simple command (split on ;, &&, ||, |, & and newlines) from the payload cwd moved by each literal cd, pushd or popd: a simple command naming a live path is a write, denied by default, unless its command word is on a closed read-only list (cat, grep, jq, ls, ...) and no redirect targets the path; reads and quoted mentions pass, and a command longer than 16,384 characters or one that cannot be split is a write when its raw text names a protected path. The deny reason names at most 10 targets followed by \"and N more\", the marker and the `touch` one-liners for the user; a deny output of 16,384 bytes or more is replaced by a short reason naming no payload text. `freeharness init`/`update` set and remove their own marker. The entry carries onFailure \"block\", so a guard hook that cannot start, crashes or times out blocks the tool call on Claude Code 2.1.295 and later; a missing node then blocks every Edit, Write and Bash call until node is installed or the entry is removed by hand, and the switches below are read inside node, so they cannot help when node is missing. The same hook runs a git guard independent of the marker: history-destroying git commands (reset --hard, --keep or --merge; push with --force, -f or a + refspec that no --force-with-lease covers, and push --mirror, --delete/-d, --prune or a :refspec, which a lease never excuses; branch -D, -M, -C, -f or --force; clean -f; checkout -- <path>, checkout ., checkout <tree> <path>, checkout -f or -B; switch --discard-changes, -f or -C; restore without --staged alone; stash drop/clear; reflog expire; filter-branch; worktree remove --force) and git config that can add an alias or run code (set through -c, --config-env, GIT_CONFIG_* variables or git config: alias.*, include.*, help.autocorrect, clean.requireForce, core.pager, core.fsmonitor and every key outside a safe list) are denied from the model whatever the marker says, and the user runs an intended one with the `!` prefix; nesting deeper than 8 levels or an internal error denies with a reason naming no payload text; a value bound earlier on the line substitutes into git verb, option and operand slots before the check, interpreter code counts as git only with a process-spawning call and a git word, sed, grep and awk scripts are data, and an unknown expansion in the command-word slot or an xargs {} placeholder in one fails closed; every other git command, a git command inside a quoted argument, push --force-with-lease, object-writing plumbing (commit-tree, mktree, hash-object) and worktree remove --force under the temp root pass; FREEHARNESS_HOOK_GIT_GUARD=off disables only the git guard. Deny reasons render invisible and control characters as \\u{XXXX} escapes and cap each echoed fragment at 200 characters with an ellipsis. Disable the whole hook: FREEHARNESS_HOOK_CONFIG_GUARD=off or remove this entry.",
+  "$comment": "FreeHarness config guard for Claude Code (rules capability). Merged additively into settings.json. PreToolUse on Edit|Write|MultiEdit|Bash: denies writes to live harness configuration, which runs code or loads instructions in every session, unless <project>/.freeharness/allow-config-edit (or ~/.claude/freeharness/allow-config-edit) exists and is younger than --ttl minutes (240 minutes; a numeric epoch-ms or ISO body sets an explicit expiry). The live set is judged by location at the written and the real path: settings.json and settings.local.json inside a .claude dir, any .mcp.json, ~/.claude.json, ~/.claude/CLAUDE.md, everything under ~/.claude/plugins and under the hooks dir of a .claude, .freeharness, ~/.claude/freeharness or freeharness-plugin dir, a plugin's hooks/hooks.json, the marker, and the dirs whose removal takes one of them (CLAUDE_CONFIG_DIR gets every ~/.claude rule); a project CLAUDE.md, a settings.json, hooks.json or hook source elsewhere and a copy in the temp root outside the home and project pass. Bash is judged per simple command (split on ;, &&, ||, |, & and newlines) from the payload cwd moved by each literal cd, pushd or popd: only a literal writer naming a live path denies: an output redirect target, a tee, sed -i, perl -i, an rm or touch operand, a cp or install destination, any mv operand, a literal inline python, node, perl or ruby write, and the literal string of sh -c, judged as a command of its own; any other command, a word holding an expansion, a heredoc body and code fed on stdin allow, and a command longer than 16,384 characters or one that cannot be split allows unjudged. The deny reason names at most 10 targets followed by \"and N more\", the marker and the `touch` one-liners for the user. `freeharness init`/`update` set and remove their own marker. The guard is a second layer under Claude Code's permission layer and the entry carries no onFailure, so a guard hook that cannot start, crashes or times out allows the tool call, and a missing node leaves every Edit, Write and Bash call to the permission layer alone. The same hook runs a git guard independent of the marker: history-destroying git commands (reset --hard, --keep or --merge; push with --force, -f or a + refspec that no --force-with-lease covers, and push --mirror, --delete/-d, --prune or a :refspec, which a lease never excuses; branch -D, -M, -C, -f or --force; clean -f; checkout -- <path>, checkout ., checkout <tree> <path>, checkout -f or -B; switch --discard-changes, -f or -C; restore without --staged alone; stash drop/clear; reflog expire; filter-branch; worktree remove --force) and git config that can add an alias or run code (set through -c, --config-env, GIT_CONFIG_* variables or git config: alias.*, include.*, help.autocorrect, clean.requireForce, core.pager, core.fsmonitor and every key outside a safe list) are denied from the model whatever the marker says, and the user runs an intended one with the `!` prefix; nesting deeper than 8 levels is not judged as git, and an unreadable payload, a non-string command or an internal error allows; a value bound earlier on the line substitutes into git verb, option and operand slots before the check, interpreter code counts as git only with a process-spawning call and a git word, and sed, grep and awk scripts are data; every other git command, a git command inside a quoted argument, push --force-with-lease, object-writing plumbing (commit-tree, mktree, hash-object) and worktree remove --force under the temp root pass; FREEHARNESS_HOOK_GIT_GUARD=off disables only the git guard. Deny reasons render invisible and control characters as \\u{XXXX} escapes and cap each echoed fragment at 200 characters with an ellipsis, so the whole hook output stays under 16,384 bytes. Disable the whole hook: FREEHARNESS_HOOK_CONFIG_GUARD=off or remove this entry.",
   "hooks": {
     "PreToolUse": [
       {
@@ -7,8 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PROJECT_DIR}/.freeharness/hooks/freeharness-config-guard.mjs\" --ttl 240",
-            "onFailure": "block"
+            "command": "node \"${CLAUDE_PROJECT_DIR}/.freeharness/hooks/freeharness-config-guard.mjs\" --ttl 240"
           }
         ]
       }

package/canonical/hooks/hooks.memory-guard.claude-code.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "FreeHarness PreToolUse memory guard for Claude Code. Merged additively into <project>/.claude/settings.json. Denies hand-written memory .md writes (the free-mem plugin owns memory; saves output tokens). The entry carries onFailure \"block\", so a guard hook that cannot start, crashes or times out blocks the tool call on Claude Code 2.1.295 and later; a missing node then blocks every Write, Edit and MultiEdit call until node is installed or the entry is removed by hand.",
+  "$comment": "FreeHarness PreToolUse memory guard for Claude Code. Merged additively into <project>/.claude/settings.json. Denies hand-written memory .md writes (the free-mem plugin owns memory; saves output tokens). The guard is a second layer under Claude Code's permission layer and the entry carries no onFailure, so a guard hook that cannot start, crashes or times out allows the tool call; a payload that is not a JSON object or a field that is not a string is judged as nothing.",
   "hooks": {
     "PreToolUse": [
       {
@@ -7,8 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PROJECT_DIR}/.freeharness/hooks/freeharness-memory-guard.mjs\"",
-            "onFailure": "block"
+            "command": "node \"${CLAUDE_PROJECT_DIR}/.freeharness/hooks/freeharness-memory-guard.mjs\""
           }
         ]
       }

package/canonical/skills/code-review/SKILL.md

@@ -20,7 +20,7 @@ Audit changes against the active `openspec/specs/` and the assigned task:
 Inspect the git diff (`git diff --stat`) and dispatch applicable reviewer subagents in parallel:
 - Python / FastAPI / Async changes -> dispatch `python-reviewer`
 - Migrations / Schemas / SQL / Vector search -> dispatch `database-reviewer`
-- Boundary changes / Secrets / Auth / Tool defs -> dispatch `security-reviewer`
+- Memory sanitizer or redaction, git guard deny list, config guard path judgment, a settings-merge, uninstall or cleanup path touching a datastore or a foreign hook entry, a new network call from a hook or the engine, harvested third-party content entering `canonical/` -> dispatch `security-reviewer`, only on this trigger list, at most once per change, at the final branch review, never in a task review; a diff touching none of them skips it
 - Change-quality lenses (comments, tests, error handling, types, simplification, silent failures, mle) -> dispatch `pr-reviewer` with the lenses selected below
 
 Lens selection from the diff (for `pr-reviewer`): `comments` when a hunk adds or changes comments or docstrings; `tests` when test files change or new behavior lands without a test file in the diff; `errors` + `silent` when the diff contains try/except, catch, fallback, default-on-error, retry, or optional chaining; `types` for new or changed classes, dataclasses, Pydantic models, TypeScript types or interfaces; `mle` when the diff touches prompts, models, evals or RAG pipelines (reads the recorded eval result and the eval-plan thresholds, never runs an evaluation); `simplify` always, but only after the other lenses are clean. The user may restrict the set (`comments tests errors types simplify silent mle`, default all). Scope is explicit, never guessed: `git diff --name-only` (working tree), `git diff <base>...HEAD` (branch), or `gh pr diff <n>` (PR). Diffs above ~300 lines or a `parallel` request split into two `pr-reviewer` lens groups: `comments+simplify+types` and `tests+errors+silent+mle`, never one dispatch per lens. Skip the review when the PR is closed, a draft, trivially mechanical, or already reviewed by this harness; say so.
@@ -39,7 +39,7 @@ Aggregate reports from all subagents.
 - The review passes when `validate-handoff.mjs gate` reports no blocking finding (the Blocking bullet below); every other finding is recorded as a follow-up.
 - Finding types: every finding carries one of `defect`, `hardening`, `refactor`, `test-gap`, `docs`, `design`; `defect` only when the current behavior violates a spec requirement, a documented contract or a behavior the owner has stated; a follow-up's own `Expected:` line alone never makes it a defect.
 - Deferral: a finding left unfixed is recorded with `openspec follow-up add <change-id> '<text>' --type <type> --expected '<...>' --current '<...>' --impact '<...>' --from <task>`, never as prose, the type and the expected, current and impact context taken from the finding; pass every value single-quoted (a `'` written as `'\''`) because finding text may quote shell syntax that double quotes would expand.
-- Blocking: a finding is blocking when it is a P0, or a P1 `defect` introduced by the task's diff (it does not reproduce at the task's `Base:` for a task review, or at the round base for a re-review) or one that fails a brief probe or a spec scenario, or, on a `security` or `complex` task, a P1 of any type introduced by the diff that fails a brief probe, a spec scenario or the corpus probe against the base. The reviewer tags a P1 `defect` that reproduces at the base `[base]`; a `[base]` finding is never blocking. Only blocking findings open a fix round; every other finding is a follow-up recorded at task close. A non-blocking `docs` or `test-gap` finding, or a comment fix, may ride round 1 when a blocking finding opened it and the fix stays inside the write scope, never a later round. A blocking finding whose fix lies outside the write scope gets a controller ruling and a new brief, never a round. The gate cannot tell that a finding meets the evidence test (the `subagent-driven-development` skill's reference/loop.md): on a `security` or `complex` task the lead retypes such a P1 to `defect` through a written ruling line before running `gate`, so it blocks.
+- Blocking: a finding is blocking when it is a P0, or a P1 `defect` introduced by the task's diff (it does not reproduce at the task's `Base:` for a task review, or at the round base for a re-review) or one that fails a brief probe or a spec scenario. The reviewer tags a P1 `defect` that reproduces at the base `[base]`; a `[base]` finding is never blocking. Only blocking findings open a fix round; every other finding is a follow-up recorded at task close. A non-blocking `docs` or `test-gap` finding, or a comment fix, may ride round 1 when a blocking finding opened it and the fix stays inside the write scope, never a later round. A blocking finding whose fix lies outside the write scope gets a controller ruling and a new brief, never a round. The rule is the same whatever the task's class; the lead retypes a finding only through a written ruling line. A security finding of an out-of-scope shape (the `subagent-driven-development` skill's reference/loop.md threat budget) closes as wontfix on sight and is never a follow-up or a round. A security finding blocks only as a P0 of an in-scope threat or a P1 `defect` against a kept requirement with a reproducer; a shape constructed inside the four threats that no probe covers is `hardening` with its reproducer, a follow-up, never a round; a `security` task, or a final-review fix loop opened by a security finding, asks the owner after 2 fix rounds with a blocking finding still open.
 - Gate: after every review run `validate-handoff.mjs gate <findings.md>` over the ledger (the `subagent-driven-development` skill's `scripts/`): it prints each `open` line as `blocking` or `follow-up` with the reason and exits non-zero when any is blocking; a round opens only for a blocking line, and with none the review is accepted.
 - Scoped re-review: before each fix dispatch run `validate-handoff.mjs round-base <brief.md> <n>` (the round base), then give the fresh re-reviewer only the ledger, the output of `validate-handoff.mjs round-diff <brief.md> <n>` and the probes; it judges only the round diff, and a finding on code the round diff does not change is a follow-up unless it is a P0; from round 2 on the re-reviewer adds only a P0 with a reproducer on the round diff, every other new finding being a follow-up.
 Clean review outcome feeds directly into `verification-before-completion`.

package/canonical/skills/code-review/evals/cases.yaml

@@ -737,7 +737,7 @@ cases:
         expected: "\\[P0[^\\]\\n]*\\][^\\n]*?eval-plan\\.md:\\d+|eval-plan\\.md:\\d+:\\s*P0"
       - type: regex
         flags: i
-        expected: "eval[- ]gate"
+        expected: "recall_at_k_min|recall(?:_at_k)?[^\\n]*?0\\.81"
       - type: tool_used
         expected: "Agent"
       - type: llm

package/canonical/skills/subagent-driven-development/SKILL.md

@@ -18,8 +18,8 @@ The primary session is the lead: it dispatches, evaluates and rules; it never wr
 </workspace>
 
 <dispatch>
-1. Brief: start `<task>.brief.md` with `validate-handoff.mjs brief-init <change> <task>` and fill every `<fill: ...>` placeholder it leaves (the template stays the source of the fixed parts; `briefs` refuses one left); one task id per brief and per dispatch, never a batch. Header `Spec:` is the OpenSpec change id, never a copied spec; `Tier:` is explicit on every dispatch. Route by `Class:`: `docs`, `extraction`, `exploration` and `mechanical` (documentation, extraction, exploration, mechanical edits such as matrix rows, renames, one-line values and transcription of complete plan text) run on standard or strong; `summary` on fast, standard or strong, and `extraction` also on fast; `security` (a task that changes a security boundary: a guard, a hook verdict, an auth or secret path, input validation of untrusted payloads) and `complex` (a parser or state machine, concurrency, a cross-file contract, or a task that reached the round cap before; a validator tokenizer or collector edit routes as `complex` unless it changes a verdict a legitimate worker command reaches; lead-written files owe no hostile-input tests) run on strong with `Effort: high` only; `code` (a code change that is neither `security` nor `complex`) runs on strong, or on standard only with `Route: C1-C7 - <reason>` per `reference/brief.md`; any other class, or none, runs on strong only. A fast brief's reading set stays under 100,000 tokens at 4 bytes per token; the validator checks the class, never that bound. A fix round's tier and effort are what `validate-handoff.mjs route <brief> --round <n> [--p0] [--security]` prints (`--p0` or `--security` for a round carrying such a finding), and `round-base` given the same flags refuses a brief below them. `Effort:` is `medium` (default) or `high`, `high` on strong only. Write scope names every file the worker may touch. Read reference/loop.md when a brief is written: the sizing bounds and the split rule, the fixture scope, the grep for statements pinning a changed value, and the class ceilings.
-2. Probes and project rules: before the dispatch write `## Acceptance probes` (1 to 12 lines, `P<n>: <command, input or observable> -> <expected outcome>`) from the spec scenarios and the design's edge cases; a `security` or `complex` brief carries one probe expecting an allow or a pass and one corpus, fixture replay or generator probe. Fill `## Project rules` (1 to 20 lines) from the project CLAUDE.md invariants and protected boundaries that bear on the write scope plus the artifact rules; workers run without CLAUDE.md, so the section is their only copy. A probe of a guard or hook verdict runs the hook through node on a payload file (reference/brief.md).
+1. Brief: start `<task>.brief.md` with `validate-handoff.mjs brief-init <change> <task>` and fill every `<fill: ...>` placeholder it leaves (the template stays the source of the fixed parts; `briefs` refuses one left); one task id per brief and per dispatch, never a batch. Header `Spec:` is the OpenSpec change id, never a copied spec; `Tier:` is explicit on every dispatch. Route by `Class:`: `docs`, `extraction`, `exploration` and `mechanical` (documentation, extraction, exploration, mechanical edits such as matrix rows, renames, one-line values and transcription of complete plan text) run on standard or strong; `summary` on fast, standard or strong, and `extraction` also on fast; `security` (a change to the memory sanitizer or redaction, the git guard deny list, the config guard path judgment, or a datastore delete path; no task owes a hostile-input test) and `complex` (a parser or state machine, concurrency, a cross-file contract, or a task that reached the round cap before) run on strong with `Effort: high` only; `code` (a code change that is neither `security` nor `complex`) runs on strong, or on standard only with `Route: C1-C7 - <reason>` per `reference/brief.md`; any other class, or none, runs on strong only. A fast brief's reading set stays under 100,000 tokens at 4 bytes per token; the validator checks the class, never that bound. A fix round's tier and effort are what `validate-handoff.mjs route <brief> --round <n> [--p0] [--security]` prints (`--p0` or `--security` for a round carrying such a finding), and `round-base` given the same flags refuses a brief below them. `Effort:` is `medium` (default) or `high`, `high` on strong only. Write scope names every file the worker may touch. Read reference/loop.md when a brief is written: the sizing bounds and the split rule, the fixture scope, the grep for statements pinning a changed value, and the class ceilings.
+2. Probes and project rules: before the dispatch write `## Acceptance probes` (1 to 12 lines, `P<n>: <command, input or observable> -> <expected outcome>`) from the spec scenarios and the design's edge cases; a `security` or `complex` brief carries one probe expecting an allow or a pass. Fill `## Project rules` (1 to 20 lines) from the project CLAUDE.md invariants and protected boundaries that bear on the write scope plus the artifact rules; workers run without CLAUDE.md, so the section is their only copy. A probe of a guard or hook verdict runs the hook through node on a payload file, and a guard's probes are one allow and one deny, each run through a payload file (reference/brief.md).
 3. Disjoint write scopes: run `validate-handoff.mjs briefs` over the dispatch; any overlap refuses the whole batch naming the file, so no two implementers in flight share a file.
 4. Dispatch a fresh `implementer` agent with the brief path, the report path and the interfaces earlier tasks produced; nothing from the session history. On every implementer, test-writer and fix dispatch the per-dispatch model is the brief's `Tier:` resolved through `reference/tiers.md` (the alias the tier maps to; never a model name in this skill) and the per-dispatch effort is the brief's `Effort:` (`medium` when absent); the agent frontmatter is never the source of a brief's effort. An omitted per-dispatch model falls back to the implementer agent's tier. A per-dispatch effort overrides the frontmatter effort. A team dispatch inherits the session effort, except a plugin-defined agent spawned by name, which keeps its own; the agent frontmatter effort applies to plain subagent dispatches. The implementer follows `test-driven-development`; dispatch `test-writer` for the RED step when the failing tests are non-trivial. Record `Base:` (`git rev-parse HEAD`) before dispatching. Reviewers and implementers are never resumed: every review, re-review and fix round is a fresh dispatch. Dispatch every implementer, test-writer and reviewer through the Agent tool without `name`: the prompt's first line is `Dispatch: <dispatch-name>` and the Agent tool `description` repeats it. A named dispatch launches as a teammate when agent teams are enabled, at the session effort by the team rule above and with no SubagentStop until shutdown; without `name` it stays a plain subagent.
 5. Band of implementers in flight: small, at most 4 (the default); medium, at most 8; large, at most 12, only on the user's ask recorded in the review package with the latest quota reading under 50%. Medium or large only when the median accepted-task duration in the ledger exceeds four times the lead's service time per task. At most 16 dispatches of any role in flight. Every implementer runs in its own worktree whenever more than one is in flight. Read reference/trees.md when more than one implementer is in flight.
@@ -47,7 +47,7 @@ On a missing, empty or block-less reply the first step is `validate-handoff.mjs
 </acceptance>
 
 <fix_loop>
-- Blocking: a finding is blocking when it is a P0, or a P1 `defect` introduced by the task's diff (it does not reproduce at the task's `Base:` for a task review, or at the round base for a re-review) or one that fails a brief probe or a spec scenario, or, on a `security` or `complex` task, a P1 of any type introduced by the diff that fails a brief probe, a spec scenario or the corpus probe against the base. The reviewer tags a P1 `defect` that reproduces at the base `[base]`; a `[base]` finding is never blocking. Only blocking findings open a fix round; every other finding is a follow-up recorded at task close. A non-blocking `docs` or `test-gap` finding, or a comment fix, may ride round 1 when a blocking finding opened it and the fix stays inside the write scope, never a later round. A blocking finding whose fix lies outside the write scope gets a controller ruling and a new brief, never a round. The lead retypes a finding only through a written ruling line. The gate cannot tell that a finding meets the evidence test (reference/loop.md): on a `security` or `complex` task the lead retypes such a P1 to `defect` through a written ruling line before running `gate`, so it blocks.
+- Blocking: a finding is blocking when it is a P0, or a P1 `defect` introduced by the task's diff (it does not reproduce at the task's `Base:` for a task review, or at the round base for a re-review) or one that fails a brief probe or a spec scenario. The reviewer tags a P1 `defect` that reproduces at the base `[base]`; a `[base]` finding is never blocking. The rule is the same whatever the task's class. Only blocking findings open a fix round; every other finding is a follow-up recorded at task close. A non-blocking `docs` or `test-gap` finding, or a comment fix, may ride round 1 when a blocking finding opened it and the fix stays inside the write scope, never a later round. A blocking finding whose fix lies outside the write scope gets a controller ruling and a new brief, never a round. The lead retypes a finding only through a written ruling line.
 - Ledger and gate: `<task>.findings.md` holds one line per finding, `F<n> <open|fixed|rejected|follow-up> r<round>: <reviewer contract line>`, written only by the lead. After every review run `validate-handoff.mjs gate <findings.md>`: it prints each `open` line as `blocking` or `follow-up` with the reason and exits non-zero when any is blocking; with no blocking line the task is accepted.
 - A fix round = one fix dispatch + one scoped re-review. Before each fix dispatch run `validate-handoff.mjs round-base <brief.md> <n>`, the round-cap check (it refuses `round-cap <n> over <cap>`), which copies the write-scope files under `rounds/<task>-r<n>/`. Every round dispatches a fresh `implementer` given the brief, the review package and `<task>.findings.md` (the ledger), on the tier and effort `route` prints for the round (dispatch rule 1; strong from round 3 on, never frontier, which is reserved for the agentic-architect role (dispatch rule 10)). Read reference/loop.md when a fix dispatch is written: the fix prompt order and the task state.
 - Re-review: a fresh re-reviewer is given only the ledger, the output of `validate-handoff.mjs round-diff <brief.md> <n>` and the probes; it returns a status for each open id and any new findings (from round 2 on only a P0 with a reproducer on the round diff; any other is a follow-up), and judges only the round diff: a finding on code the round diff does not change is a follow-up unless it is a P0.
@@ -63,5 +63,5 @@ On a missing, empty or block-less reply the first step is `validate-handoff.mjs
 </completion>
 
 <stop_conditions>
-Stop and ask the user only for: an irreversible or destructive operation; a security-sensitive action; a merge or push outside the change branch, or a publish; a task flagged "Ask first" in the proposal; the round cap or the class ceiling of the run authorization (the circuit breaker); a plan so broken that every path forward is a guess. Ceilings and the round cap come only from the owner (proposal.md `## Run authorization`, or `--ceiling`); the lead never raises them, and stops for neither below them. A cap with every finding ruled "remove the addition" is no stop. Everything else is a ruling, written down, and the run continues.
+Stop and ask the user only for: an irreversible or destructive operation; a security-sensitive action; a merge or push outside the change branch, or a publish; a task flagged "Ask first" in the proposal; the round cap or the class ceiling of the run authorization (the circuit breaker); a plan so broken that every path forward is a guess. Ceilings and the round cap come only from the owner (proposal.md `## Run authorization`, or `--ceiling`); the lead never raises them. They are the only budget and round stops: below them the lead stops only for a `security` task, or a final-review fix loop opened by a security finding, after 2 fix rounds with a blocking finding still open, whatever the round cap. A cap with every finding ruled "remove the addition" is no stop. Everything else is a ruling, written down, and the run continues.
 </stop_conditions>