godpowers 3.13.0 → 3.13.1

package/CHANGELOG.md

@@ -7,6 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.13.1] - 2026-06-16
+
+Maintenance release that drives a full self-audit (`codeaudit.md`) to zero: one
+High finding, plus the Medium and Low findings, fixed across runtime correctness,
+security hardening, the test gate, documentation, and de-duplication. No public
+command, agent, workflow, or recipe surface changes (counts stay 120 / 40 / 13 / 44).
+
+### Fixed
+- **Ledger record loss under concurrency (ERR-001):** `lib/evidence.js`
+  `appendJsonlAtomic` did a read-modify-write of the whole ledger, so two
+  concurrent `verify`/`outcome check` processes lost each other's records and
+  every append was O(n). It now uses `fs.appendFileSync` (O_APPEND), mirroring
+  `lib/events.js`; a concurrency regression test asserts 8 writers x 25 records
+  all survive.
+- **Buffer-overflow verdicts (ERR-003):** a `maxBuffer` (ENOBUFS) overflow was
+  recorded as a plain command failure; it is now surfaced distinctly. The 16 MB
+  cap is the named constant `MAX_OUTPUT_BYTES`.
+- **Doc accuracy:** `SECURITY.md` no longer recommends the non-existent
+  `npm install --verify` (use `npm audit signatures`); the stale
+  `ARCHITECTURE-MAP.md` counts are regenerated and now machine-guarded.
+
+### Security
+- **Advisory hook (SEC-001):** `hooks/pre-tool-use.sh` is reframed as a
+  best-effort typo guard (not a security boundary) and now normalizes whitespace
+  and matches common destructive-command variants (`rm -fr`, `-r -f`, `./`
+  prefix, `git push -f`/`--force-with-lease`). Covered by `scripts/test-hooks.js`.
+- **Disk-sourced verifier (SEC-002):** `outcome check` now announces the verifier
+  command and its `goal.json` source path before executing, so running it in an
+  untrusted cloned repo cannot silently run a planted command.
+- **Ledger secrets (SEC-003):** the human-readable `LEDGER-LOG.md` command echo
+  masks obvious secret shapes; `SECURITY.md` documents that `.godpowers/ledger/`
+  may capture command output.
+- **Codex sandbox (SEC-004):** `SECURITY.md` documents the Codex
+  `sandbox_mode = "workspace-write"` install default.
+
+### Changed
+- **Test gate (TEST-001/002/003):** `coverage:lib` now enforces `--branches 75`;
+  new `scripts/test-runtime-audit.js` raises `runtime-audit.js` line coverage
+  68.8% -> 77.8%; `scripts/test-router.js` no longer shares cumulative state and
+  cleans up its temp dirs.
+- **De-duplication (ARC-001/002, QUAL-001/002):** the five `*-sync` modules share
+  `lib/sync-fs.js`; the ANSI logger moves to `lib/cli-log.js` and `slugify` to
+  `lib/text-util.js`; `installer-args.parseArgs` is now table-driven (was a
+  358-line function); `state.STATE_FILE` is the canonical state-file constant and
+  `artifact-map.js`'s scope is documented accurately.
+- **Re-audit follow-ups (ARC-003, QUAL-003, DOC-004/005, ERR-004, TEST-005):** a
+  fresh self-audit of the above confirmed no regressions and closed the residual
+  gaps: `installer-core.js` now imports the shared logger; `dashboard.js`/
+  `planning-systems.js` use `sync-fs`; the `lib/README` module catalog is complete
+  and guarded by a completeness check; the corrupt-state error is typed
+  (`err.code = 'CORRUPT_STATE'`) instead of message-matched; and the hook tests
+  assert each warning's text, not just its exit code.
+
 ## [3.13.0] - 2026-06-16
 
 ### Changed

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-3.13.0-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-3.13.1-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -30,8 +30,13 @@ Godpowers makes AI coding accountable: every serious run should leave disk
 state, artifacts, validation gates, host guarantees, and a next action. Code is
 only one output. The project memory and proof trail matter too.
 
-Version 3.13.0 makes the default greenfield arc (`/god-mode`) miss less. The
-one-shot `full-arc` workflow now runs a whole-codebase code audit after the
+Version 3.13.1 is a maintenance release that drives a full self-audit to zero:
+the runtime ledger no longer loses verification records under concurrent writes,
+the `outcome check` verifier and the pre-tool-use hook are hardened, the
+`*-sync` modules share one filesystem helper, the argument parser is table-driven,
+branch coverage is now gated, and the architecture map is kept in lockstep by a
+machine guard. Version 3.13.0 makes the default greenfield arc (`/god-mode`) miss
+less. The one-shot `full-arc` workflow now runs a whole-codebase code audit after the
 build (so it catches what the per-slice reviews missed in AI-generated code) and
 a documentation pass after harden (so the shipped product has docs verified
 against the code, not vibes). The arc goes build, code-audit, deploy, observe,
@@ -329,14 +334,14 @@ dependency to the main `godpowers` package:
 
 ```bash
 npx godpowers mcp-info --project=.
-npx -y -p godpowers@3.13.0 -p @godpowers/mcp@3.13.0 godpowers-mcp serve --project=.
+npx -y -p godpowers@3.13.1 -p @godpowers/mcp@3.13.1 godpowers-mcp serve --project=.
 ```
 
 The companion exposes `status`, `next`, `gate_check`, `lint_artifact`, and
 `trace_requirement`. Host registration is opt-in:
 
 ```bash
-npx -y -p godpowers@3.13.0 -p @godpowers/mcp@3.13.0 godpowers-mcp setup --host=codex --project=. --write
+npx -y -p godpowers@3.13.1 -p @godpowers/mcp@3.13.1 godpowers-mcp setup --host=codex --project=. --write
 ```
 
 See [MCP Companion](docs/mcp.md) for package boundaries and setup details.

package/RELEASE.md

@@ -1,41 +1,41 @@
-# Godpowers 3.13.0 Release
+# Godpowers 3.13.1 Release
 
 > Status: Prepared
 > Date: 2026-06-16
 
-[DECISION] Godpowers 3.13.0 is a minor release that hardens the default greenfield arc. The one-shot `full-arc` workflow run by `/god-mode` now audits the whole codebase after the build and writes verified documentation after harden, so a long-running idea-to-production run ships audited and documented without a separate manual pass.
-[DECISION] No new skill, agent, workflow, or recipe surface is added: both new steps reuse existing agents (`god-debt-assessor`, `god-docs-writer`). Surface counts are unchanged from 3.12.1.
-[DECISION] This release keeps `core` as the omitted installer profile, keeps `--profile=full` as the complete compatibility surface, and keeps the full 3.1.0-3.12.1 surface (fusion + codeauditor-grade audit + remediation loop).
+[DECISION] Godpowers 3.13.1 is a maintenance release that drives a full self-audit (`codeaudit.md`, codeauditor-grade, nine weighted dimensions) to zero. It fixes one High finding plus the Medium and Low findings across runtime correctness, security hardening, the test gate, documentation, and de-duplication.
+[DECISION] No new skill, agent, workflow, or recipe surface is added or removed. Surface counts are unchanged from 3.13.0: 120 slash commands, 40 specialist agents, 13 workflows, 44 recipes.
+[DECISION] This release keeps `core` as the omitted installer profile, keeps `--profile=full` as the complete compatibility surface, and keeps the full 3.1.0-3.13.0 surface (fusion + codeauditor-grade audit + remediation loop + audited/documented greenfield arc).
 
 ## What's in this release
 
-- [DECISION] `full-arc` gains a `code-audit` job (`god-debt-assessor`, `mode: post-build-audit`) that runs after `build` and before `deploy`/`harden`. It gives the whole AI-generated codebase a scored, prioritized audit that catches issues the per-slice `god-spec-reviewer` + `god-quality-reviewer` reviews cannot see across files.
-- [DECISION] `full-arc` gains a `docs` job (`god-docs-writer`, `mode: product-docs-verify`) that runs after `harden` and before `launch`. It writes the project documentation and verifies every claim against the code (drift detected) before the product ships.
-- [DECISION] Dependencies were rewired: `deploy` and `harden` now `need` `code-audit`; `launch` now `needs` `docs`. The greenfield arc is build, code-audit, deploy, observe, harden, docs, launch, final-sync. The `full-arc` plan goes from 11 to 13 steps.
-- [DECISION] `GOD-ORCHESTRATOR-RUNBOOK` documents the audit and docs positions in the greenfield arc.
-- [DECISION] 120 slash commands, 40 specialist agents, 13 executable workflows, 44 intent recipes, and the full fusion + audit surface remain available.
+- [DECISION] Runtime correctness: `lib/evidence.js` `appendJsonlAtomic` now appends with `fs.appendFileSync` (O_APPEND) instead of a read-modify-write, so concurrent `verify`/`outcome check` processes no longer lose ledger records and the append is no longer O(n) (ERR-001). A `maxBuffer` overflow is surfaced distinctly instead of as a plain failure (ERR-003).
+- [DECISION] Security hardening: the pre-tool-use hook is reframed as a best-effort advisory typo guard and matches more destructive-command variants (SEC-001); `outcome check` announces a disk-sourced verifier before running it (SEC-002); the `LEDGER-LOG.md` command echo masks obvious secret shapes and `SECURITY.md` documents the ledger and Codex-sandbox trust boundaries (SEC-003, SEC-004); `SECURITY.md` replaces the non-existent `npm install --verify` with `npm audit signatures` (DOC-002).
+- [DECISION] Test gate: `coverage:lib` now enforces `--branches 75` (TEST-001); a new `scripts/test-runtime-audit.js` raises `lib/runtime-audit.js` line coverage from 68.8% to 77.8% (TEST-002); `scripts/test-router.js` no longer shares cumulative state across tests and cleans up its temp dirs (TEST-003); new `scripts/test-hooks.js`, `scripts/test-cli-log.js`, and `scripts/test-text-util.js` cover the new code.
+- [DECISION] De-duplication: the five `*-sync` modules share `lib/sync-fs.js`; the ANSI logger moves to `lib/cli-log.js` and `slugify` to `lib/text-util.js`; `installer-args.parseArgs` is now table-driven (ARC-001, QUAL-001, QUAL-002).
+- [DECISION] Documentation: `ARCHITECTURE-MAP.md` counts are regenerated and now machine-guarded by `scripts/test-doc-surface-counts.js`; `state.STATE_FILE` is the canonical state-file constant and `artifact-map.js`'s scope is documented accurately (DOC-001, DOC-003, ARC-002).
+- [DECISION] Re-audit follow-ups: a fresh self-audit confirmed no regressions and closed the residual gaps it found - `installer-core.js` imports the shared logger (QUAL-003); `dashboard.js`/`planning-systems.js` consume `sync-fs` (ARC-003); the `lib/README` module catalog is complete and now guarded by a completeness check (DOC-004); the ledger-append comment is corrected (DOC-005); the corrupt-state error is typed rather than message-matched (ERR-004); and the hook tests assert each warning's text (TEST-005).
 
 ## Changes
 
-- [DECISION] `package.json`, `package-lock.json`, and `packages/mcp/package.json` now publish the 3.13.0 version.
-- [DECISION] `workflows/full-arc.yaml` adds the `code-audit` and `docs` jobs and rewires `deploy`/`harden`/`launch` dependencies. No lib change.
-- [DECISION] CHANGELOG, RELEASE notes, README, roadmap, reference, architecture, and the MCP docs now reflect 3.13.0. SECURITY supported-version table adds the `3.13.x` row and moves `3.12.x` to security fixes only.
+- [DECISION] `package.json`, `package-lock.json`, and `packages/mcp/package.json` now publish the 3.13.1 version.
+- [DECISION] New runtime modules `lib/sync-fs.js`, `lib/cli-log.js`, and `lib/text-util.js` (lib module count 87 -> 90). No public command/agent/workflow/recipe surface change.
+- [DECISION] CHANGELOG, RELEASE notes, README, roadmap, reference, architecture, and the architecture map now reflect 3.13.1. The SECURITY supported-version table already carries the `3.13.x` row.
 
 ## Validation
 
-- [DECISION] `npm run lint` passed with 29 static checks (agent contract + size + refs intact).
-- [DECISION] `node tests/integration/full-arc.test.js`, `node scripts/test-workflow-runner.js`, and `node scripts/test-agent-refs.js` passed: `full-arc` plans to 13 steps with a valid DAG and both `god-debt-assessor` and `god-docs-writer` are real agents.
-- [DECISION] `npm run release:check` passed `coverage:lib` above the 90 percent line floor for `lib/**/*.js`.
-- [DECISION] `npm run release:check` passed `npm audit --omit=dev` with 0 vulnerabilities.
-- [DECISION] `npm run release:check` passed public surface docs for version 3.13.0 with 120 skills, 40 agents, 13 workflows, and 44 recipes.
+- [DECISION] `npm test` passed all command groups.
+- [DECISION] `npm run release:check` passed `coverage:lib` above the 90 percent line floor and the new 75 percent branch floor for `lib/**/*.js`.
+- [DECISION] `npm run release:check` passed `npm audit --omit=dev` with 0 vulnerabilities and `git diff --check`.
+- [DECISION] `npm run release:check` passed public surface docs for version 3.13.1 with 120 skills, 40 agents, 13 workflows, and 44 recipes.
 - [DECISION] `npm run release:check` passed root and `@godpowers/mcp` package contents.
 
 ## Upgrade
 
-- [DECISION] Use `npm install -g godpowers@3.13.0` or `npx godpowers@3.13.0`.
-- [DECISION] No migration is required. Existing projects are unaffected; the change only adds steps to the greenfield one-shot arc, which now takes longer in exchange for an audited and documented product.
+- [DECISION] Use `npm install -g godpowers@3.13.1` or `npx godpowers@3.13.1`.
+- [DECISION] No migration is required. Existing projects are unaffected; the changes are internal correctness, security, test-gate, and maintainability fixes with no surface change.
 
 ## Notes
 
-- [DECISION] The publish targets are npm `godpowers@3.13.0`, npm `@godpowers/mcp@3.13.0`, and GitHub release `https://github.com/aihxp/godpowers/releases/tag/v3.13.0`.
+- [DECISION] The publish targets are npm `godpowers@3.13.1`, npm `@godpowers/mcp@3.13.1`, and GitHub release `https://github.com/aihxp/godpowers/releases/tag/v3.13.1`.
 - [DECISION] The tag-triggered GitHub publish workflow remains the preferred npm path because it publishes with provenance. This release has not been tagged or published to npm yet.

package/bin/install.js

@@ -21,6 +21,7 @@ const { describeProfiles } = require('../lib/install-profiles');
 const commandFamilies = require('../lib/command-families');
 const identity = require('../lib/package-identity');
 const cliDispatch = require('../lib/cli-dispatch');
+const { log, success, warn, error } = require('../lib/cli-log');
 
 const VERSION = identity.PACKAGE_VERSION;
 
@@ -29,22 +30,6 @@ const BANNER = `
   Ship fast. Ship right. Ship everything.
 `;
 
-function log(msg) {
-  console.log(`  ${msg}`);
-}
-
-function success(msg) {
-  console.log(`  \x1b[32m+\x1b[0m ${msg}`);
-}
-
-function warn(msg) {
-  console.log(`  \x1b[33m!\x1b[0m ${msg}`);
-}
-
-function error(msg) {
-  console.error(`  \x1b[31mx\x1b[0m ${msg}`);
-}
-
 function showHelp() {
   console.log(BANNER);
   log('Usage: npx godpowers [command] [options]\n');

package/hooks/pre-tool-use.sh

@@ -1,52 +1,64 @@
 #!/usr/bin/env bash
-# Godpowers PreToolUse Safety Hook
-# Runs before destructive tool calls in a Godpowers project.
-# Warns on: rm -rf, git reset --hard, force push to main, deleting .godpowers/,
-# and irreversible public release actions.
+# Godpowers PreToolUse advisory hook (best-effort, NOT a security boundary).
+#
+# Warns before some common destructive command spellings when run inside a
+# Godpowers project: deleting .godpowers/, git reset --hard, force push,
+# npm publish, gh release create. It matches command text heuristically after
+# normalizing whitespace, so it tolerates spacing and short-flag variants
+# (rm -fr, -r -f, ./ prefix, trailing slash, push -f). It is still deliberately
+# conservative and is easily bypassed by uncommon spellings, quoting, aliases,
+# or a child process that does the deletion. Treat it as a typo guard that buys
+# a confirmation prompt, not as a guarantee. See SECURITY.md.
 
 set -euo pipefail
 
-TOOL_NAME="${CLAUDE_TOOL_NAME:-}"
 TOOL_INPUT="${CLAUDE_TOOL_INPUT:-}"
 
 if [ ! -d ".godpowers" ]; then
   exit 0
 fi
 
-# Pattern matches that should warn
-case "$TOOL_INPUT" in
-  *"rm -rf .godpowers"*)
-    echo "WARNING: About to delete the .godpowers/ directory."
-    echo "This destroys all PROGRESS, PRD, ARCH, ROADMAP, and other artifacts."
-    echo "If this is intentional, confirm in chat before proceeding."
-    exit 1
-    ;;
-  *"git reset --hard"*)
-    echo "WARNING: git reset --hard discards uncommitted work."
-    echo "If you have artifacts not yet committed, they will be lost."
-    echo "Consider git stash first."
-    exit 1
-    ;;
-  *"git push --force"*)
-    echo "WARNING: Force pushing. If pushing to main/master, this can"
-    echo "destroy collaborators' work."
-    exit 1
-    ;;
-  *"npm publish"*)
-    echo "WARNING: npm publish is a public release action."
-    echo "Confirm release checklist, repo-doc-sync, repo-surface-sync,"
-    echo "release-surface-sync, package contents, and installer smoke first."
-    exit 1
-    ;;
-  *"gh release create"*)
-    echo "WARNING: gh release create publishes public release notes."
-    echo "Confirm README, badges, CHANGELOG, RELEASE, package, tag, and npm version agree."
-    exit 1
-    ;;
-  *"rm -rf node_modules"*)
-    # Allowed: this is just cache
-    exit 0
-    ;;
-esac
+# Collapse tabs and runs of spaces so spacing variants normalize to one form.
+norm="$(printf '%s' "$TOOL_INPUT" | tr '\t' ' ' | tr -s ' ')"
+
+matches() {
+  printf '%s' "$norm" | grep -Eq -- "$1"
+}
+
+# rm targeting .godpowers (optional ./ or / prefix, optional trailing slash)
+# that carries a recursive flag in any spelling: -rf, -fr, -r -f, -R, --recursive.
+if matches 'rm( +-[a-zA-Z]+)* +\.?/?\.godpowers(/|$| )' && matches ' -[a-zA-Z]*[rR]|--recursive'; then
+  echo "WARNING: About to delete the .godpowers/ directory."
+  echo "This destroys all PROGRESS, PRD, ARCH, ROADMAP, and other artifacts."
+  echo "If this is intentional, confirm in chat before proceeding."
+  exit 1
+fi
+
+if matches 'git +reset +--hard'; then
+  echo "WARNING: git reset --hard discards uncommitted work."
+  echo "If you have artifacts not yet committed, they will be lost."
+  echo "Consider git stash first."
+  exit 1
+fi
+
+# git push with a force flag: --force, --force-with-lease, or a standalone -f.
+if matches 'git +push +' && matches '(--force(-with-lease)?| -f( |$))'; then
+  echo "WARNING: Force pushing. If pushing to main/master, this can"
+  echo "destroy collaborators' work."
+  exit 1
+fi
+
+if matches 'npm +publish'; then
+  echo "WARNING: npm publish is a public release action."
+  echo "Confirm release checklist, repo-doc-sync, repo-surface-sync,"
+  echo "release-surface-sync, package contents, and installer smoke first."
+  exit 1
+fi
+
+if matches 'gh +release +create'; then
+  echo "WARNING: gh release create publishes public release notes."
+  echo "Confirm README, badges, CHANGELOG, RELEASE, package, tag, and npm version agree."
+  exit 1
+fi
 
 exit 0

package/lib/README.md

@@ -28,6 +28,7 @@ package-level integrations.
 | `cost-tracker.js` | Track token and cost estimates from event streams. |
 | `atomic-write.js` | Write load-bearing files through temp-file validation and atomic rename. |
 | `fs-async.js` | Promise-based file read/write helpers for non-blocking runtime paths. |
+| `sync-fs.js` | Shared project-relative read/write/exists/readJson helpers for the `*-sync` modules. |
 
 ## Events and observability
 
@@ -38,12 +39,17 @@ package-level integrations.
 | `otel-exporter.js` | Export Godpowers events in an OpenTelemetry-shaped format. |
 | `runtime-audit.js` | Audit runtime health and expected project state. |
 | `runtime-test.js` | Provide runtime checks used by package tests. |
+| `evidence.js` | Enforced producer of executed/attested verification records, the state.json rollup, gate events, reflections, memory, lessons, and outcome loops. |
+| `evidence-import.js` | Import an existing `.mythify/` ledger into `.godpowers/ledger/`. |
+| `work-report.js` | Render the verification play-by-play from the evidence ledger. |
+| `adoption-metrics.js` | Derive adoption and outcome metrics from event streams. |
 
 ## Routing and execution
 
 | Module | Purpose |
 |--------|---------|
 | `router.js` | Resolve user intent to skills, agents, recipes, and workflows. |
+| `quarterback.js` | Entry router that classifies a prompt into a play and refuses new work when the project is on red. |
 | `command-families.js` | Define UX command families, status views, decision ladders, and trigger precedence helpers. |
 | `recipes.js` | Load and validate routing recipes. |
 | `workflow-parser.js` | Parse workflow YAML into executable steps. |
@@ -59,7 +65,7 @@ package-level integrations.
 
 | Module | Purpose |
 |--------|---------|
-| `artifact-map.js` | Centralize canonical artifact paths for dashboards, gates, and helpers. |
+| `artifact-map.js` | Tier gate artifact map: the per-tier required artifacts and state steps used by dashboards, gates, and doc-count checks. (Module-local paths stay in their owning module; `state.json` is named via `state.STATE_FILE`.) |
 | `artifact-linter.js` | Check artifacts for required labels, evidence, and domain precision. |
 | `artifact-diff.js` | Compare artifact changes for review and release workflows. |
 | `gate.js` | Run executable artifact gates for Phase 1 tier completion checks. |
@@ -98,6 +104,7 @@ package-level integrations.
 | `drift-detector.js` | Detect context drift between artifacts and implementation. |
 | `impact.js` | Summarize expected impact of proposed changes. |
 | `linkage.js` | Connect artifacts, stories, and implementation files. |
+| `requirements.js` | Track which PRD requirements are done, in progress, or untouched from disk evidence. |
 | `multi-repo-detector.js` | Detect multi-repository workspaces. |
 | `reverse-sync.js` | Reflect implementation changes back into artifacts. |
 | `review-required.js` | Decide when review gates should block progress. |
@@ -111,6 +118,9 @@ package-level integrations.
 | `installer-files.js` | File-copy helpers shared by the installer and its tests. |
 | `installer-args.js` | Parse `bin/install.js` arguments and subcommands. |
 | `cli-dispatch.js` | Dispatch local CLI helper commands such as status, quick-proof, gate, dogfood, and extension-scaffold. |
+| `cli-log.js` | Shared ANSI console logger (log/success/warn/error) for the binary and CLI dispatch. |
+| `text-util.js` | Small shared string helpers (the canonical `slugify`). |
+| `mcp-info.js` | Render read-only MCP companion setup instructions for `npx godpowers mcp-info`. |
 | `install-profiles.js` | Select smaller role-specific slash-command install surfaces. |
 | `surface-profile.js` | Preview and apply runtime command surface profile switches after install. |
 | `installer-runtimes.js` | Map supported runtimes to their config directories. |

package/lib/artifact-map.js

@@ -1,5 +1,11 @@
 /**
  * Shared tier artifact map for dashboard, gates, and documentation checks.
+ *
+ * Scope: this owns the per-tier *gate artifacts* (which files a tier requires
+ * and the state step it maps to). It is not a flat registry of every
+ * `.godpowers/...` path: module-local artifacts (a sync module's log file, the
+ * evidence ledger) live in their owning module, and `state.json` is named via
+ * `state.STATE_FILE`.
  */
 
 const TIER_ARTIFACTS = {

package/lib/cli-dispatch.js

@@ -5,25 +5,10 @@
 const gate = require('./gate');
 const identity = require('./package-identity');
 const stateAdvance = require('./state-advance');
+const { log, success, warn, error } = require('./cli-log');
 
 const VERSION = identity.PACKAGE_VERSION;
 
-function log(msg) {
-  console.log(`  ${msg}`);
-}
-
-function success(msg) {
-  console.log(`  \x1b[32m+\x1b[0m ${msg}`);
-}
-
-function warn(msg) {
-  console.log(`  \x1b[33m!\x1b[0m ${msg}`);
-}
-
-function error(msg) {
-  console.error(`  \x1b[31mx\x1b[0m ${msg}`);
-}
-
 function runAutomationCommand(opts) {
   const automation = require('./automation-providers');
   const result = opts.command === 'automation-setup'
@@ -501,7 +486,20 @@ function runOutcomeCommand(opts) {
       projectRoot
     });
   } else if (action === 'check') {
-    payload = evidence.outcome.check(opts.outcomeSlug, { projectRoot });
+    payload = evidence.outcome.check(opts.outcomeSlug, {
+      projectRoot,
+      // SEC-002: announce the disk-sourced verifier before it runs, so running
+      // `outcome check` inside an untrusted cloned repo cannot silently execute
+      // a planted command. Goes to stderr so it never corrupts --json on stdout.
+      notice: ({ verifier, source }) => {
+        const rel = relLedger({ project: projectRoot }, source) || source;
+        process.stderr.write(
+          `  notice: outcome '${opts.outcomeSlug}' runs a verifier loaded from ${rel}\n` +
+          `          command: ${verifier}\n` +
+          `          (.godpowers/ledger/ carries executable state; only run 'outcome check' in repos you trust)\n`
+        );
+      }
+    });
   } else if (action === 'stop') {
     payload = evidence.outcome.stop(opts.outcomeSlug, opts.reason || undefined, { projectRoot });
   } else {
@@ -626,11 +624,22 @@ const COMMAND_RUNNERS = {
 
 function runCommand(opts) {
   const runner = COMMAND_RUNNERS[opts.command];
-  if (runner) {
+  if (!runner) return false;
+  try {
     runner(opts);
-    return true;
+  } catch (err) {
+    // ERR-002: a corrupt state.json throws from state.read(). Surface the
+    // helpful message as a clean one-liner with a non-zero exit instead of a
+    // raw stack trace. Match the typed error code (ERR-004), not the message
+    // prose. Re-throw anything else so genuine bugs still surface.
+    if (err && err.code === 'CORRUPT_STATE') {
+      error(err.message);
+      process.exitCode = 1;
+    } else {
+      throw err;
+    }
   }
-  return false;
+  return true;
 }
 
 module.exports = {

package/lib/cli-log.js

@@ -0,0 +1,24 @@
+/**
+ * Shared ANSI console logger for the installer binary and CLI dispatch (QUAL-002).
+ *
+ * bin/install.js and lib/cli-dispatch.js previously defined these four helpers
+ * verbatim. They now share one copy so the prefix/colour convention lives once.
+ */
+
+function log(msg) {
+  console.log(`  ${msg}`);
+}
+
+function success(msg) {
+  console.log(`  \x1b[32m+\x1b[0m ${msg}`);
+}
+
+function warn(msg) {
+  console.log(`  \x1b[33m!\x1b[0m ${msg}`);
+}
+
+function error(msg) {
+  console.error(`  \x1b[31mx\x1b[0m ${msg}`);
+}
+
+module.exports = { log, success, warn, error };

package/lib/dashboard.js

@@ -17,6 +17,7 @@ const repoDocSync = require('./repo-doc-sync');
 const repoSurfaceSync = require('./repo-surface-sync');
 const hostCapabilities = require('./host-capabilities');
 const artifactMap = require('./artifact-map');
+const { read: readText, exists } = require('./sync-fs');
 
 const GOD_DIR = '.godpowers';
 const PRD_PATH = artifactMap.requiredArtifactsForTier('prd')[0].path;
@@ -25,16 +26,6 @@ const CHECKPOINT_PATH = '.godpowers/CHECKPOINT.md';
 const SYNC_LOG_PATH = '.godpowers/SYNC-LOG.md';
 const REVIEW_PATH = '.godpowers/REVIEW-REQUIRED.md';
 
-function exists(projectRoot, relPath) {
-  return fs.existsSync(path.join(projectRoot, relPath));
-}
-
-function readText(projectRoot, relPath) {
-  const file = path.join(projectRoot, relPath);
-  if (!fs.existsSync(file)) return '';
-  return fs.readFileSync(file, 'utf8');
-}
-
 function mtimeMs(projectRoot, relPath) {
   const file = path.join(projectRoot, relPath);
   if (!fs.existsSync(file)) return null;

package/lib/evidence.js

@@ -10,8 +10,9 @@
  * Adaptations from the upstream Node engine (see .provenance.json):
  *   - Mythify's plan/step context becomes Godpowers' arc/substep context.
  *   - The .mythify/ state dir becomes .godpowers/ledger/.
- *   - The jsonl append goes through lib/atomic-write.js (temp + rename) so a
- *     torn record is never visible.
+ *   - The jsonl append uses O_APPEND (fs.appendFileSync) so concurrent writers
+ *     never clobber each other's records; a torn line from an interleaved large
+ *     write is tolerated by the reader, which skips unparseable records.
  *
  * What this adds on top of the upstream engine (the Godpowers integration):
  *   1. .godpowers/ledger/verifications.jsonl: append-only, Mythify-shape record,
@@ -61,6 +62,9 @@ const events = require('./events');
 const TAIL_CHARS = 4000;
 const DEFAULT_TIMEOUT_SECONDS = 300;
 const DIAGNOSTICS_LIMIT = 1000;
+// Cap on captured stdout/stderr per verify command. Exceeding it makes
+// spawnSync raise ENOBUFS and truncate output, so the verdict is unreliable.
+const MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
 
 // Substeps whose close gate requires an executed, verified:true record (the
 // runtime/executable-gated tiers). Other substeps (planning, repo, observe,
@@ -161,19 +165,33 @@ function slugify(text) {
     .slice(0, 40);
 }
 
+// SEC-003: mask obvious secret shapes before echoing a command into the
+// human-readable LEDGER-LOG.md. The durable verifications.jsonl record keeps the
+// exact command (it is the audit source of truth); this only protects the log
+// echo. Output tails can still carry secrets, so SECURITY.md documents that
+// .godpowers/ledger/ may capture sensitive output.
+function redactSecrets(text) {
+  return String(text == null ? '' : text)
+    .replace(/\bgh[pousr]_[A-Za-z0-9]{16,}\b/g, 'gh*_***REDACTED***')
+    .replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, 'sk-***REDACTED***')
+    .replace(/\bAKIA[0-9A-Z]{16}\b/g, 'AKIA***REDACTED***')
+    .replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, 'xox*-***REDACTED***')
+    .replace(/(--?(?:token|password|passwd|secret|api[-_]?key)[=\s])\S+/gi, '$1***REDACTED***');
+}
+
 // ---------------------------------------------------------------------------
-// Ledger append (atomic, via lib/atomic-write.js) and tolerant read
+// Ledger append (O_APPEND) and tolerant read
 // ---------------------------------------------------------------------------
 
 function appendJsonlAtomic(file, record) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
-  let existing = '';
-  try {
-    existing = fs.readFileSync(file, 'utf8');
-  } catch (_) {
-    existing = '';
-  }
-  atomic.writeFileAtomic(file, existing + JSON.stringify(record) + '\n');
+  // O_APPEND: each record is written at EOF in a single positioned write, so
+  // two concurrent writers never overwrite each other's record. The previous
+  // read-concat-rewrite was last-writer-wins (it lost records under concurrent
+  // invocation) and rewrote the whole file on every append (O(n) per record).
+  // A torn line from an interleaved oversized write is tolerated by readJsonl,
+  // which skips unparseable records. Mirrors the append in lib/events.js.
+  fs.appendFileSync(file, JSON.stringify(record) + '\n');
   return file;
 }
 
@@ -255,18 +273,27 @@ function runCommand(command, timeoutSeconds) {
     shell: true,
     encoding: 'utf8',
     timeout: Math.round(timeoutSeconds * 1000),
-    maxBuffer: 16 * 1024 * 1024
+    maxBuffer: MAX_OUTPUT_BYTES
   });
   const durationSeconds = Number(process.hrtime.bigint() - startedAt) / 1e9;
   let stdoutTail = tail(run.stdout);
   let stderrTail = tail(run.stderr);
   const timedOut = Boolean(run.error && run.error.code === 'ETIMEDOUT');
+  const bufferOverflow = Boolean(run.error && run.error.code === 'ENOBUFS');
   let exitCode;
   let verified;
   if (timedOut) {
     exitCode = -1;
     verified = false;
     stderrTail = stderrTail + (stderrTail ? '\n' : '') + `(timed out after ${timeoutSeconds} seconds)`;
+  } else if (bufferOverflow) {
+    // Output exceeded the capture buffer: spawnSync truncated stdout/stderr, so
+    // we cannot trust the exit status. Surface this distinctly rather than
+    // folding it into a plain command failure.
+    exitCode = -1;
+    verified = false;
+    stderrTail = stderrTail + (stderrTail ? '\n' : '') +
+      `(output exceeded ${Math.round(MAX_OUTPUT_BYTES / (1024 * 1024))} MB buffer; output truncated and verdict unreliable)`;
   } else if (typeof run.status === 'number') {
     exitCode = run.status;
     verified = exitCode === 0;
@@ -280,7 +307,7 @@ function runCommand(command, timeoutSeconds) {
         : 'command did not produce an exit code';
     stderrTail = stderrTail + (stderrTail ? '\n' : '') + `(${reason})`;
   }
-  return { exitCode, verified, durationSeconds, stdoutTail, stderrTail, timedOut };
+  return { exitCode, verified, durationSeconds, stdoutTail, stderrTail, timedOut, bufferOverflow };
 }
 
 // ---------------------------------------------------------------------------
@@ -449,7 +476,7 @@ function verify(command, opts = {}) {
   appendRecord(projectRoot, record);
   appendLog(
     projectRoot,
-    `verify ${record.verified ? 'PASS' : 'FAIL'} substep=${context.substep || '-'} exit=${record.exit_code} cmd=\`${command}\``
+    `verify ${record.verified ? 'PASS' : 'FAIL'} substep=${context.substep || '-'} exit=${record.exit_code} cmd=\`${redactSecrets(command)}\``
   );
 
   const rollup = rollUp(projectRoot, opts.substep, record);
@@ -818,6 +845,15 @@ function outcomeCheck(name, opts = {}) {
   if (goal.status !== 'active') return { ran: false, reason: `outcome-${goal.status}`, goal };
   if (!goal.verifier) return { ran: false, reason: 'no-verifier', goal };
 
+  // SEC-002: the verifier is a shell command read from goal.json on disk, not
+  // from a live flag, so `outcome check` in a cloned untrusted repo would
+  // otherwise execute a planted command silently. Surface what is about to run
+  // and where it came from before executing. The notice is informational; the
+  // CLI passes one that prints to stderr.
+  if (typeof opts.notice === 'function') {
+    opts.notice({ verifier: goal.verifier, source: outcomeGoalPath(projectRoot, slug) });
+  }
+
   const result = verify(goal.verifier, {
     substep: goal.substep || undefined,
     claim: goal.title,
@@ -901,6 +937,7 @@ module.exports = {
   DEFAULT_TIMEOUT_SECONDS,
   // Internals exposed for tests and the re-sync script.
   _runCommand: runCommand,
+  _redactSecrets: redactSecrets,
   _toStateCommand: toStateCommand,
   _substepContext: substepContext,
   _rollUp: rollUp,