freeharness 0.4.2 → 0.4.3

package/canonical/skills/subagent-driven-development/evals/cases.yaml

@@ -142,7 +142,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -302,7 +302,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -567,7 +567,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -644,7 +644,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -769,7 +769,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -940,7 +940,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -1137,7 +1137,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -1318,7 +1318,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -1463,7 +1463,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -1712,7 +1712,7 @@ cases:
       - type: regex
         expected: "Effort: high"
       - type: llm
-        rubric: "Fail when the security brief runs on standard, at medium effort, or targets a separate high-effort agent; pass when it declares Class: security, Tier: strong and Effort: high, carries an allow-side probe and a corpus probe, and dispatches the single implementer agent with effort high passed as the dispatch effort."
+        rubric: "Fail when the security brief runs on standard, at medium effort, or targets a separate high-effort agent; pass when it declares Class: security, Tier: strong and Effort: high, carries an allow-side probe, and dispatches the single implementer agent with effort high passed as the dispatch effort."
     ablation: true
 
   - id: rule-route-code-standard
@@ -2003,7 +2003,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -2558,7 +2558,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -2699,7 +2699,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -2860,7 +2860,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -3067,7 +3067,7 @@ cases:
         rubric: "Fail when the 1.4 brief carries either finding as a ruling, a design decision or a write-scope obligation; pass when the lead closes 1.3 by running openspec follow-up add once for each finding and the 1.4 digest and write scope hold neither."
     ablation: true
 
-  - id: rule-reviewer-shape-follow-up
+  - id: rule-reviewer-shape-wontfix
     source: rule
     rule: evidence-blocking
     input: |
@@ -3151,7 +3151,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -3256,13 +3256,142 @@ cases:
           test("listing the config directory is allowed", () => assert.equal(verdict("ls ~/.claude"), ""));
           test("rm elsewhere is allowed", () => assert.equal(verdict("rm -rf build"), ""));
           test("an empty command is allowed", () => assert.equal(verdict(""), ""));
-    expected_regex: "follow-up"
+    expected_regex: "wontfix"
     graders:
       - type: regex
         not_expected:
           - "validate-handoff\\.mjs round-base"
+          - "openspec follow-up add"
+      - type: llm
+        rubric: "Fail when the lead opens a fix round or records a follow-up for the reviewer-constructed quoting shape; pass when the lead closes it as wontfix citing the threat budget and accepts the task without a round."
+    ablation: true
+
+  - id: rule-reviewer-shape-follow-up
+    source: rule
+    rule: evidence-blocking
+    input: |
+      Change copiloto-greenfield, task 2.5 (Class: security): every brief probe passes at HEAD,
+      and the task reviewer reports one P1 on a secret shape it wrote itself, a fine-grained
+      github_pat_ token that the memory redaction keeps, which no probe or spec scenario
+      covers. State the lead's next step.
+    workspace_files:
+      - path: openspec/config.yaml
+        content: |
+          schema: spec-driven
+      - path: openspec/changes/copiloto-greenfield/tasks.md
+        content: |
+          # Tasks: copiloto-greenfield
+
+          ## 2. Memory
+
+          - [ ] 2.5 The memory sanitizer redacts a classic GitHub token before an observation is stored
+            Verify: node --test test/redact.test.mjs
+            Interfaces: src/redact.mjs exports redact(text: string) -> string
+            Boundary: src/redact.mjs, test/redact.test.mjs
+            Depends: none
+      - path: src/redact.mjs
+        content: |
+          const GITHUB_TOKEN = /\bgh[pousr]_[A-Za-z0-9]{36}\b/g;
+
+          export function redact(text) {
+            return String(text).replace(GITHUB_TOKEN, "[REDACTED]");
+          }
+    expected_regex: "openspec follow-up add"
+    graders:
+      - type: regex
+        expected: "openspec follow-up add"
+      - type: regex
+        not_expected:
+          - "validate-handoff\\.mjs round-base"
+      - type: llm
+        rubric: "Fail when the lead opens a fix round for the reviewer-constructed secret shape or closes it as wontfix; pass when the lead records it as a hardening follow-up carrying the reproducer and accepts the task without a round."
+    ablation: true
+
+  - id: rule-security-review-no-trigger
+    source: rule
+    rule: security-review-trigger
+    input: |
+      Change cost-report-columns: task 1.1 is accepted, task 1.2 waits for its task review, and
+      the branch diff touches only packages/cli/src/cli/cost.ts, packages/cli/test/cost.test.ts and
+      Documents/ADVANCED.md. State the reviewers the lead dispatches for the task review of 1.2 and
+      for the final branch review.
+    workspace_files:
+      - path: openspec/config.yaml
+        content: |
+          schema: spec-driven
+      - path: openspec/changes/cost-report-columns/tasks.md
+        content: |
+          # Tasks: cost-report-columns
+
+          ## 1. Cost report
+
+          - [x] 1.1 cost report prints a cache-read column
+            Verify: node --test packages/cli/test/cost.test.ts
+            Boundary: packages/cli/src/cli/cost.ts, packages/cli/test/cost.test.ts
+            Depends: none
+          - [ ] 1.2 Documents/ADVANCED.md describes the cache-read column
+            Verify: node --test packages/cli/test/cost.test.ts
+            Boundary: Documents/ADVANCED.md
+            Depends: 1.1
+      - path: packages/cli/src/cli/cost.ts
+        content: |
+          export function costRow(row: { model: string; input: number; cacheRead: number }): string {
+            return `${row.model}\t${row.input}\t${row.cacheRead}`;
+          }
+    expected_regex: "trigger"
+    graders:
+      - type: regex
+        not_expected:
+          - "subagent_type\\W+security-reviewer"
+          - "review-(final|\\d+_\\d+)-r\\d+-security"
+      - type: llm
+        rubric: "Fail when the lead dispatches security-reviewer in a task review or at the final branch review; pass when the lead plans the task review and the final branch review without security-reviewer because the diff touches no item of the trigger list."
+    ablation: true
+
+  - id: rule-security-p0-blocks
+    source: rule
+    rule: evidence-blocking
+    input: |
+      Change memory-capture, final branch review: every brief probe passes at HEAD, and
+      security-reviewer reports one P0 with a reproducer: the rules capture stores a classic
+      ghp_ token unredacted in an observation title (src/capture.mjs:4; a Bash event whose command
+      is git push https://ghp_<36 characters>@github.com/o/r is stored with that command as its
+      title). State the lead's next step.
+    workspace_files:
+      - path: openspec/config.yaml
+        content: |
+          schema: spec-driven
+      - path: openspec/changes/memory-capture/tasks.md
+        content: |
+          # Tasks: memory-capture
+
+          ## 1. Capture
+
+          - [x] 1.1 The rules capture stores a Bash event as an observation titled by its command
+            Verify: node --test test/capture.test.mjs
+            Interfaces: src/capture.mjs exports observationOf(event) -> { title, narrative }
+            Boundary: src/capture.mjs, test/capture.test.mjs
+            Depends: none
+      - path: src/capture.mjs
+        content: |
+          import { redact } from "./redact.mjs";
+
+          export function observationOf(event) {
+            return { title: String(event.command).slice(0, 200), narrative: redact(String(event.output ?? "")) };
+          }
+      - path: src/redact.mjs
+        content: |
+          const GITHUB_TOKEN = /\bgh[pousr]_[A-Za-z0-9]{36}\b/g;
+
+          export function redact(text) {
+            return String(text).replace(GITHUB_TOKEN, "[REDACTED]");
+          }
+    expected_regex: "round-base"
+    graders:
+      - type: regex
+        expected: "validate-handoff\\.mjs round-base"
       - type: llm
-        rubric: "Fail when the lead opens a fix round for the reviewer-constructed shape; pass when the lead records it as a follow-up with its reproducer and accepts the task without a round."
+        rubric: "Fail when the lead closes the P0 as wontfix, records it only as a follow-up or accepts the branch with it open; pass when the lead rules it blocking and opens a fix round for it with round-base and a fix dispatch."
     ablation: true
 
   - id: rule-round-cap-remove-addition
@@ -3371,7 +3500,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.
@@ -3536,7 +3665,7 @@ cases:
           - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
           - The reply is the JSON block plus the report path, under 8,000 characters.
           - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+          - Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
           - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
           - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
           - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.

package/canonical/skills/subagent-driven-development/reference/brief.md

@@ -23,15 +23,17 @@ the base removes, changes or inserts a line above the base file's last 5 lines,
 replacing a closing line and appending entries pass. Briefs
 dispatched together have disjoint scopes, and `scripts/validate-handoff.mjs briefs` refuses
 the batch on overlap. The lead names the new brief files plus every brief file still in
-flight, never the workspace directory: a directory argument skips the set checks, since the
-workspace also holds landed briefs.
+flight, never the workspace directory: a directory argument skips the set checks
+(`tree-required`, resource overlap, manifest parallelism, the band and `tree-absent`),
+since the workspace also holds landed briefs; `tree-path` and `setup-missing` stay
+per-brief checks and run on each brief either way.
 
 `Tier` and `Class` route the dispatch. `docs`, `extraction`, `exploration` and
 `mechanical` (documentation, extraction, exploration, mechanical edits such as matrix
 rows, renames, one-line values and transcription of complete plan text) run on `standard`
 or `strong`; `summary` runs on `fast`, `standard` or `strong`, and `extraction` also on
-`fast`; `security` (a task that changes a security boundary: a guard, a hook verdict, an
-auth or secret path, input validation of untrusted payloads) and `complex` (a parser or
+`fast`; `security` (a change to the memory sanitizer or redaction, the git guard deny list, the
+config guard path judgment, or a datastore delete path; no task owes a hostile-input test) and `complex` (a parser or
 state machine, concurrency, a cross-file contract, or a task that reached the round cap
 before) run on `strong` with `Effort: high` only; `code` (a code change that is neither
 `security` nor `complex`) runs on `strong`, or on `standard` only with a `Route:` header
@@ -52,9 +54,9 @@ scope; its entries count in the reading set. The size bounds are at most 3 write
 files outside test and fixture directories and a reading set under 60,000 tokens at 4
 bytes per token. `Ceiling` is optional, right after `Split` and `Read`: a positive
 integer, the per-task cache-read token ceiling summed across every dispatch of the task
-(impl, review and fix rounds alike), at or below the task's class ceiling: 60,000,000 for
-`security` and `complex`, 50,000,000 for task `final` and 25,000,000 for any other task,
-or the owner's `Ceiling <class>:` value in the change's run authorization (reference/loop.md).
+(impl, review and fix rounds alike), at or below the task's class ceiling: 50,000,000 for
+task `final` and 25,000,000 for any other task, `security` and `complex` alike, or the
+owner's `Ceiling <class>:` value in the change's run authorization (reference/loop.md).
 The header only lowers the class ceiling; `briefs` and `budget` refuse one above it.
 
 `Route: C1-C7 - <reason>` is required on, and allowed only on, a brief with `Tier:
@@ -101,12 +103,12 @@ line without a reason), `changes-short <term>` (a term under 3 characters) and
 check covers tests only, so a production file the plan missed is still found by reading
 the design.
 
-`Key-list` is optional, right after `Changes`: `Key-list: <key>[, <key>...]`, one sibling
+`Key-list` is optional, placed after `Changes:` and its `Unaffected:` lines and before `Suite:`: `Key-list: <key>[, <key>...]`, one sibling
 key per JSON object the task adds a key to. `briefs` also searches each `Changes` term
 regex-escaped, and fails `changes-unscoped key-list:<key> <path>` for an uncovered test that
 pins an exact key list naming the sibling (`Object.keys(` then a `deepEqual` array quoting it).
 
-`Suite` is required, right after `Changes` and its `Unaffected:` lines: the project's
+`Suite` is required, after `Changes`, its `Unaffected:` lines and any `Key-list:`: the project's
 full-suite command. The worker never runs it and runs only the `## Verify` commands;
 `briefs` refuses a brief without it (`suite-missing`).
 
@@ -136,11 +138,11 @@ fails `scope`.
 The `## Acceptance probes` section holds 1 to 12 lines `P<n>: <command, input or
 observable> -> <expected verdict or outcome>`, written by the lead from the spec
 scenarios and the design's edge cases before the dispatch. A `security` or `complex`
-brief carries a probe whose expected outcome is an allow or a pass, and a probe that runs
-a corpus, fixture replay or generator command over the changed behavior. A probe of a
+brief carries a probe whose expected outcome is an allow or a pass. A probe of a
 guard or hook verdict runs the hook through node on a payload file (the hook reading the
 payload on stdin), never the probed command typed into Bash, so the session's own
-permission layer never judges the probe: `node <hook>.mjs < payload.json -> <verdict>`. The
+permission layer never judges the probe: `node <hook>.mjs < payload.json -> <verdict>`. A guard carries one allow probe and one deny
+probe, each run this way. The
 `## Project rules` section holds 1 to 20 lines, since the workers run without CLAUDE.md:
 the project CLAUDE.md invariants and protected boundaries that bear on the write scope,
 plus the artifact rules every worker follows.
@@ -216,7 +218,7 @@ name test files, never a package's `npm test`, which the handoff guard reads as
 - Never run the CLI, a hook or a worker against the real HOME; tests use a fake HOME.
 - The reply is the JSON block plus the report path, under 8,000 characters.
 - The reply and the report's first fenced json block follow this skeleton exactly: `{"task":"...","status":"completed|partial|blocked","files_changed":[...],"tests_run":[{"command":"...","result":"pass|fail|unavailable","summary":"..."}],"evidence":[...],"partial_output":null,"blocked_reason":null,"concerns":[]}`; the report file opens with it inside a ```json fence.
-- Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name plus every corpus, fixture replay or generator probe and cites each other probe as `P<n>: carried from round <n-1>`.
+- Cite every acceptance probe id (`P1:` ...) in `evidence` with its observed outcome; the first dispatch runs and cites every probe, and a fix round re-runs the probes its open findings name and cites each other probe as `P<n>: carried from round <n-1>`.
 - An environment override (HOME, XDG_*) is set in the same shell command as the program it applies to; a separate export does not persist between tool calls.
 - Edit files only with the Edit and Write tools, never through a Bash heredoc, `sed -i` or an interpreter script.
 - Write a helper or probe script with the Write tool and run it as `node <file>`; a probe that makes a fake HOME write its `.claude/settings.json` or hooks runs from such a script, since the config guard refuses a Bash line naming those paths.

package/canonical/skills/subagent-driven-development/reference/handoff.md

@@ -138,30 +138,44 @@ tree, while the brief, the report and the ledger stay under the main root's
 - `tree-leak <path>`: the worker wrote the main tree instead of its own. Reported for a
   write-scope path that differs in the main tree from its HEAD (an untracked file counts;
   `--lead` paths are excepted), and with `--agent` for an Edit, MultiEdit, Write or
-  NotebookEdit path or a Bash write target under the main root outside the tree and outside
-  `<root>/.freeharness/`, or naming the report's change directory `<root>/.freeharness/sdd/<change>/`
-  itself or a path in it (a Bash removal there included; only a tool write to the report is
-  spared), and for a git command that writes the main tree's index. It returns to the worker
-  as a round.
+  NotebookEdit path under the main root outside the tree and outside `<root>/.freeharness/`,
+  or in the report's change directory `<root>/.freeharness/sdd/<change>/` (only a tool write
+  to the report is spared), and for a git command that writes the main tree's index. It
+  returns to the worker as a round.
 - `NOTE tree-cwd <command>`: with `--agent`, a Bash command that ran in a directory
   outside the tree, typically one missing the `cd <Tree> &&` prefix. A note, not a
   failure: the lead reads the command and judges whether it touched the main tree.
 
 The change directory holds the ledger, the findings and the round copies the guard trusts,
-so with `--agent` and without `--tree` a write there fails too. Only an Edit, MultiEdit,
-Write or NotebookEdit write to the report is spared, and only while the report is a regular
-file with one link at scan time: a symlink or hard link there would spare the file it shares.
-A Bash write target (the report included), a link created at the report name, a copy or move
-naming the directory itself, or a Bash removal of the directory or a path in it fails as
-`bash-write <path>`, and a tool path as
+so with `--agent` and without `--tree` a tool write there fails too. Only an Edit,
+MultiEdit, Write or NotebookEdit write to the report is spared, and only while the report is
+a regular file with one link at scan time: a symlink or hard link there would spare the file
+it shares. Any other tool path there fails as
 - `workspace-write <path>`: an Edit, MultiEdit, Write or NotebookEdit path in the report's
   change directory other than a spared report. The path prints from the main root; every other
   `.freeharness/` path, another change's directory included, stays free.
 
-A command behind `env -C`, `env --chdir`, `sudo -D` or `sudo --chdir` is judged from the
-shell's own directory; the option's directory is noted, never resolved, so a relative write
-target behind it also prints `NOTE bash-write-unresolved <target>` and the option can only add
-lines.
+The transcript check is literal: the diff guards and the lead's diff read are the controls,
+and the scan only reports. It splits a Bash command on `;`, `&&`, `||` and `|` and each
+part on whitespace, reads no quoting, no interpreter body and no file system, and fails only
+- `index-write <command>`: a literal `git` command word (past assignments and wrapper words
+  such as `sudo -u me` or `env`) followed, after its global options, by a
+  subcommand that writes the index or HEAD (`add`, `rm`, `mv`, `commit`, `stash`, `reset`,
+  `restore --staged`, `checkout --`, `apply --index`, `switch`, `merge`, `rebase`,
+  `cherry-pick`, `pull`, `update-index`) whose directory is the tree; a temporary repository
+  stays free.
+- `suite-run`: a Bash command that contains the brief's `Suite:` command.
+
+Every other Bash finding is a note:
+- `NOTE bash-path <path>`: a Bash command naming a path in the change directory or, with
+  `--tree`, under the main root outside the tree, its git admin dir and its `.freeharness/`,
+  or writing (a redirect, `tee`, `sed -i`, `cp`, `mv`, `install`, `rm`, `touch`, `ln`; an `mv`
+  source included, a `cp`, `install` or `ln` source only named) a path in the tree or its admin dir outside the write
+  scope and `.freeharness/`, or outside the tree. The lead reads it against the diff.
+- `NOTE scan-capped <count>`: the lines past the fifty one kind prints.
+- `NOTE transcript-unavailable <no-ledger|no-line|outside-projects|foreign-path|unreadable>`,
+  `NOTE transcript-truncated <agent_id>` and `NOTE transcript-tree-unresolved <error>`: the transcript
+  was not found, not read in full, or the tree not resolved by git.
 
 `scripts/validate-handoff.mjs recover <transcript.jsonl> <report> [--force]` rebuilds the handoff
 when a dispatch ends without a clean reply. Recovery reads only assistant-authored text:

package/canonical/skills/subagent-driven-development/reference/loop.md

@@ -7,23 +7,22 @@ Brief sizing and the budget, dispatch names, the handoff guards, fix rounds, the
 - Sizing, before every brief: a brief covers one behavior (the scenarios of one requirement, or one cohesive part), with at most 3 write-scope files outside test and fixture directories and a reading set (write-scope files plus the `Read:` header's entries) under 60,000 tokens at 4 bytes per token. A file over 1,500 lines is named by range (`path:120-340`) or symbol (`path#symbolName`, counted as 200 lines) in the write scope or `Read:`. A task above a bound is split into sub-tasks `<task>.<n>` (`2.4.1`, `2.4.2`), each with its own brief, dispatch, review and acceptance; the first sub-task's review package carries a `## Split` note naming the sub-tasks and the behavior each owns, and the parent is ticked in `tasks.md` only when every sub-task is accepted. `Split: refused - <reason>` is written only when the work cannot be divided; `validate-handoff.mjs briefs` refuses an oversized brief without it.
 - Pin grep: `briefs` searches each `Changes:` term plain and regex-escaped and, with `Key-list:`, finds exact key-list pins; the lead still greps by hand for a pinned count (a bare number) and puts each hit in the write scope or an `Unaffected:` line; a brief that changes a USAGE line or skill text runs content.test.ts in its Verify.
 - Changed terms: `Changes:` names every identifier and literal value the task changes, and `validate-handoff.mjs briefs` refuses a brief whose write scope, Verify commands or `Unaffected:` lines miss a test that names one. The check covers tests only, so the lead still adds the production files a plan missed by reading the design.
-- Class ceilings: `budget` stops a task at its class ceiling of cache-read tokens: 60,000,000 for a `security` or `complex` task, 50,000,000 for task `final` and 25,000,000 for any other task. The class is `security` or `complex` when a brief declaring the task carries that `Class:` (the higher ceiling when both appear). It trips when the total plus a reserve, the median of the task's dispatches (the lower middle value for an even count), reaches the ceiling, so a typical next dispatch never crosses it. The output names the source of the ceiling: `class <class> default`, `class <class> authorized`, `brief <file>` or `flag`.
+- Class ceilings: `budget` stops a task at its class ceiling of cache-read tokens: 50,000,000 for task `final` and 25,000,000 for any other task, `security` and `complex` alike. The class is `security` or `complex` when a brief declaring the task carries that `Class:` (the higher ceiling when both appear). It trips when the total plus a reserve, the median of the task's dispatches (the lower middle value for an even count), reaches the ceiling, so a typical next dispatch never crosses it. The output names the source of the ceiling: `class <class> default`, `class <class> authorized`, `brief <file>` or `flag`.
 - Run authorization: the owner may set the ceilings and the round cap in one section of the change's `proposal.md` under the exact heading `## Run authorization`, approved with the proposal: `Ceiling <class>: <n>` (`<class>` one of `security`, `complex`, `final`, `other`; `<n>` a positive integer) and `Rounds: <1-9>`, each key at most once. Without it the class defaults and a cap of 3 rounds apply; a malformed section fails `budget`, `briefs` and `round-base` naming proposal.md and the line: `duplicate-section` (a second such heading), `near-miss-heading` (a `## Run authorization` heading in another case or with more words), `unknown-line` (any other non-blank line in the section), `duplicate-key` or `bad-value`. Only the owner edits it; the lead never raises a ceiling or the cap.
 - A brief's `Ceiling:` header only lowers the class ceiling: the highest one among the task's briefs applies at or below it, and one above it fails `budget` and `briefs`. `--ceiling` on `budget` overrides every other source and is the owner's to pass.
 
 ## Dispatch names
 
-- Write `_` for `.` because the Agent tool rejects a dot in a name; the ledger stores the dotted id and reads role, task and round through the slug.
+- Write `_` for `.` because the ledger and the `Dispatch:` line use the underscore form and `validate-handoff.mjs name` enforces it; the ledger stores the dotted id and reads role, task and round through the slug.
 - The lens slug is lowercase letters, digits and hyphens (`review-final-r1-lenses-b`); any other character leaves role and task null in the ledger.
 
 ## Guards before the reviewer
 
 - Run `validate-handoff.mjs handoff <report> --base <Base> --brief <brief.md> --agent <agent_id>`, where `<agent_id>` is the id the Agent tool result returns, adding `--in-flight <brief.md>` for every other brief still running so a peer's files are not charged to this worker, and `--lead <path>` for the lead's own paths (the change's `tasks.md`, any review package outside `.freeharness/`) so they are not charged either.
 - A `claimed-unchanged`, `changed-unclaimed`, `scope`, `peer-scope` or `lead-path` failure, a `probe-missing`, or a `checkpoint-missing` or `checkpoint-oversized` failure returns to the worker as findings (a round), never straight to the reviewer; `peer-scope` means the worker claimed a file another dispatch owns, `lead-path` means it claimed one of the lead's own paths, neither ever worth passing on.
-- With `--agent`, the command also scans the worker's transcript and fails `bash-write <path>` (a Bash command wrote a file in the tree) or `bash-write <interpreter>` (an interpreter body wrote in the tree), `workspace-write <path>` (a tool write into the change directory in a shared-tree run), `index-write <command>` (a git command wrote the index or HEAD) and `suite-run` (the worker ran the brief's `Suite:` command). It prints these NOTE lines: `NOTE bash-write-unresolved <target>` (a write target the scan could not resolve), `NOTE transcript-unavailable <no-ledger|no-line|outside-projects|foreign-path|unreadable>` (a ledger path for the agent was not scanned; `foreign-path` names a file other than `agent-<agent_id>.jsonl` in a `subagents` directory, and every accepted path is still scanned), `NOTE transcript-truncated` (only part of the transcript was read), `NOTE transcript-tree-unresolved <error>` (git named no working tree, so the current directory stands in for it) and `NOTE bash-write-budget` (the scan's filesystem or path budget ran out, so later targets were placed by their text alone or left unresolved).
+- With `--agent`, the command also scans the worker's transcript literally and fails `index-write <command>` (a git command wrote the index or HEAD), `suite-run` (the worker ran the brief's `Suite:` command), `workspace-write <path>` (a tool write into the change directory in a shared-tree run) and the tree checks (`tree-path`, `tree-leak <path>`). It prints these NOTE lines: `NOTE bash-path <path>` (a Bash command named a path in the change directory or outside the tree, or wrote a path outside the write scope; the lead reads it against the diff), `NOTE tree-cwd <command>` (a Bash command ran in a directory outside the tree), `NOTE scan-capped <count>` (the lines past the fifty one kind prints), `NOTE transcript-unavailable <no-ledger|no-line|outside-projects|foreign-path|unreadable>` (a ledger path for the agent was not scanned; `foreign-path` names a file other than `agent-<agent_id>.jsonl` in a `subagents` directory, and every accepted path is still scanned), `NOTE transcript-truncated <agent_id>` (only part of the transcript was read) and `NOTE transcript-tree-unresolved <error>` (git named no working tree, so the current directory stands in for it).
 - Each of these failures returns to the worker as a round, like the other guard failures. The lead may rule a false positive (for example a fixture generator run inside the tree on purpose): it reads the command in the transcript and writes a ruling line in the review package before the reviewer runs, never a silent pass.
-- Threat model: the transcript scan is a visibility layer over the diff guards (`claimed-unchanged`, `changed-unclaimed`, `scope`, `tree-leak`) for the owner's own subagents; tree isolation and the lead's diff read stay the controls. Padding, symlink and quoting or tokenizer shapes against the scan close as wontfix, a follow-up and never a round. The brief, the findings ledger and the review package are written by the lead and are trusted input: a parser that reads only them owes no hostile-input size or timing test; the change ledger and the transcripts stay untrusted.
-- Evidence test: on a `security` or `complex` task a P1 blocks only when it fails a brief probe, a spec scenario, or the corpus probe against the base (a deny the base prints that the task's code no longer prints); a shape the reviewer constructs is `hardening` with its reproducer, recorded as a follow-up.
+- Threat budget: security work covers four threats: a secret or private-tagged text stored in memory and replayed, a history-destroying git command, a subagent writing live configuration or deleting a protected datastore, and a subagent writing outside its task scope. Constructed bypass shapes (quoting, tokenizer, wrapper, expansion, heredoc, alias), hostile multi-MiB input, symlink, FIFO and forged `.git` shapes, races with other local processes and proxy or environment edge cases are out of scope: a finding of such a shape closes as wontfix on sight, citing this budget, and is never a follow-up or a round. A shape a reviewer constructs inside the four threats that no probe covers is `hardening` with its reproducer, recorded as a follow-up, never a round. A security finding blocks only as a P0 of an in-scope threat or a P1 `defect` against a kept requirement with a reproducer. `security-reviewer` runs only when the diff touches the memory sanitizer or its secret redaction, the git guard deny list, the config guard path judgment, a settings-merge, uninstall or cleanup path that touches a datastore or a foreign hook entry, a new network call from a hook or the memory engine, or harvested third-party content entering `canonical/`; it runs at most once per change, at the final branch review, never in a task review. A `security` task, or a final-review fix loop opened by a security finding, asks the owner after 2 fix rounds with a blocking finding still open, whatever the round cap. No task owes a hostile-input test.
 - Guard false positive: a worker that returns `blocked` with `needs-confirm` because the config or git guard denied a Verify or probe line that names no guarded path is answered by the lead rerunning that line itself in the task's tree, then re-dispatching the same round only to rerun Verify and write a completed report, with no code change, no new ruling id and no `round-base` call; the denied shape is recorded once as a follow-up. A line that names a guarded path keeps the stop: the owner opens the config-edit window or the task is re-scoped.
 - `transcript-unavailable` with `no-ledger` or `no-line` happens when the dispatch has no ledger line (the other reasons are listed above): the lead dispatches from the repository root so the hooks find the project.
 

package/canonical/skills/subagent-driven-development/reference/workspace.md

@@ -15,8 +15,8 @@ The run-start step and the validator inventory of the subagent-driven-developmen
 The validator `scripts/validate-handoff.mjs` has fourteen subcommands:
 
 - `brief-init <change> <task>`: writes `.freeharness/sdd/<change>/<task>.brief.md` from the task's line and annotation lines in `openspec/changes/<change>/tasks.md` and the template in reference/brief.md, with `Change:`, `Spec:`, `Task:`, `Base:` and `Report:` set, `## Run rules` and `## Handoff` copied, and one `<fill: ...>` line for every other header and section, then prints `OK brief-init <path>`; refuses `task-shape`, `tasks-missing`, `task-unknown`, `template-missing`, `workspace-escape` (the workspace directory resolves outside the project root), `brief-exists` and `brief-unwritable`, and `briefs` fails `placeholder-left <name>` while a placeholder remains.
-- `briefs <dir|file...> [--band small|medium|large]`: headers, one task id, routing class and `Effort:`, size bounds, probes, `## Project rules`, digest budget, write-scope overlap; over the named brief files also the set checks `tree-required`, `tree-path`, `tree-absent`, `setup-missing`, `resource-overlap`, `manifest-parallel` and `band <count> over <cap>` (small when `--band` is absent); a directory argument skips the set checks with `NOTE briefs-dir <count>`.
-- `handoff <file> [--base <sha>] [--brief <brief.md>] [--in-flight <brief.md>]... [--lead <path>]... [--agent <agent_id>] [--tree <path>]`: schema plus the diff guards; `--base` adds `staged` and `base-not-ancestor`; `--lead` excludes the lead's own paths; `--brief` adds `probe-missing`, `checkpoint-missing` and `checkpoint-oversized`; `--agent` scans the worker's transcript for `bash-write`, `workspace-write`, `index-write` and `suite-run`; `--tree` reads the task's tree and adds `tree-leak`.
+- `briefs <dir|file...> [--band small|medium|large]`: headers, one task id, routing class and `Effort:`, size bounds, probes, `## Project rules`, digest budget, write-scope overlap; over the named brief files also the set checks `tree-required`, `tree-path`, `tree-absent`, `setup-missing`, `resource-overlap`, `manifest-parallel` and `band <count> over <cap>` (small when `--band` is absent); a directory argument skips `tree-required`, `resource-overlap`, `manifest-parallel`, `band` and `tree-absent` with `NOTE briefs-dir <count>`, while `tree-path` and `setup-missing` stay per-brief.
+- `handoff <file> [--base <sha>] [--brief <brief.md>] [--in-flight <brief.md>]... [--lead <path>]... [--agent <agent_id>] [--tree <path>]`: schema plus the diff guards; `--base` adds `staged` and `base-not-ancestor`; `--lead` excludes the lead's own paths; `--brief` adds `probe-missing`, `checkpoint-missing` and `checkpoint-oversized`; `--agent` checks the worker's transcript literally for `workspace-write`, `index-write` and `suite-run`, noting `bash-path` and `NOTE tree-cwd` (a Bash command ran outside the tree); `--tree` reads the task's tree and adds `tree-leak`.
 - `budget <ledger.jsonl> <task> [--ceiling <n>]`: the total, the median reserve and the class ceiling with its source (reference/loop.md).
 - `ledger <change-dir>`.
 - `recover <transcript.jsonl> <report> [--force]`.