greprag 5.74.0 → 5.74.2

package/skill/mechanic/SKILL.md

@@ -24,8 +24,10 @@ license: MIT
 > the MOMENT it happens: `greprag fix spawn --type <type> "<one unit>"` emits a
 > FIX chip for exactly that unit (never absorb adjacent friction). The chip's
 > contract: identify the exact friction → make the smallest durable root-cause
-> fix → explain the friction and fix in human terms → STOP for human approval
-> before merge/push/deploy/archive/cleanup. `greprag mechanic friction` (routing to
+> fix → explain the friction and fix in human terms → checkpoint → hand it to
+> the mission delivery owner. A full-goal chip with no live parent becomes that
+> owner and follows `.greprag/delivery.json`; no second lifecycle approval is
+> introduced. `greprag mechanic friction` (routing to
 > a live Mechanic) and `greprag fix log` (queueing) are RETIRED as reflexes —
 > `fix log` survives for audit/design-input notes; this skill's queue-digestion
 > method still applies to the EXISTING backlog and to audit notes. A chip titled
@@ -53,7 +55,7 @@ The Mechanic keeps the harness healthy. The loop is **friction → fix → repai
 **Autonomy = blast radius** (not repair-vs-not). Don't route every repair through the operator — gate by what can be affected:
 - **Tier 0 — inert / instantly-reversible, zero reach → just do it, report.** Author schemas **born-shadow** (logs only, injects nothing until armed), record/close/delete existing fixes, fix skill/doc text you own, ADR entries, record audit/design notes. Born-shadow makes authoring free — nothing fires until graduation.
 - **Tier 1 — local code, test-covered, reversible → do it, commit, report.** Contained to the repo, green on its own tests, no prod/fleet/external reach.
-- **Tier 2 — real reach or hard to undo → confirm first.** ARM a schema (shadow→active = fleet-wide inject), any deny/transform, prod/deploy/secrets/money/external, untested load-bearing code, deleting what you didn't author, editing a file a peer is live in.
+- **Tier 2 — reach outside the authorized coding mission or hard to undo → confirm first.** ARM a schema (shadow→active = fleet-wide inject), any deny/transform, secrets/money/external communication, untested load-bearing code, deleting claimed user work, or editing a file a peer is actively changing. Ordinary repo-scoped push/deploy/release already implied by a full-goal mission is governed by the Delivery Profile, not this gate.
 
 The seam: **author freely (shadow), arm deliberately (operator).** Full doctrine: `docs/mechanic-repairs.md` D10.
 
@@ -78,13 +80,13 @@ Same gate the hourly compactor applies at write-time — Mechanic and compactor
 
 ## Hard rules
 
-- **Tier-2 actions need explicit confirm** (arm/graduate, deny/transform, prod·secrets·external, deleting what you didn't author). Tier 0/1 don't — just do + report.
+- **Tier-2 actions need explicit confirm** (arm/graduate, deny/transform, secrets·money·external communication, deleting claimed user work). Ordinary profile-declared repo delivery does not. Tier 0/1 just do + report.
 - **Removal-first repair.** Remove the offending text, gate, control, duplicated doctrine, or wrong boundary before adding new guidance. Add prose or controls only when no removal action can solve the friction; never wrap bad doctrine in explanatory caveats when deleting the bad boundary fixes it.
 - **Bulk is fine for Tier-0 when the set is named aloud** (clearing verified-stale / noise fixes); never bulk a Tier-2 action.
 - **Never edit `~/.claude/docs/chip-spawn.md` without confirm.** Global rules are sticky.
 - **Cross-project carve-out.** Default to the current project (resolved via `greprag fix list`). The Phase 0 census MAY read sibling queues to show where fixes piled up; *draining* one requires the operator to name it, and every `add`/`delete` against it MUST carry `--project <that-project>`. Never touch a sibling silently.
 - **Harness scope is mandatory.** Friction carries its source harness (`claude-code`, `codex`, `opencode`). Repairs to hooks/skills/watchers must target that harness with `greprag mechanic install ... --harness <name>`. In a Codex session, default to `--harness codex`; use `--harness all` only for deliberately portable mechanisms.
-- **Coordinate with peer Mechanics before repo gates.** Assume other Mechanic chips or repair sessions may be active in the same repo. Before merging, pushing, deploying, publishing, tagging, or cutting a release, inspect live peers/worktrees and coordinate ownership/status with them. Classify dirty repository state before crossing the boundary: intentional deploy work, peer-owned work, user-owned work, or stale/discardable residue. Sweep intentional dirt into the boundary; block only on unknown ownership, overlapping peer work, or unproven stale residue. If another Mechanic owns overlapping files, surfaces, or release scope, stop and get an explicit handoff/confirmation before taking over, merging, or shipping their patch. A `send_message_to_thread` call, `greprag send`, stored row, or completed empty turn is not proof of coordination; require an actual peer response or another verifiable status signal, and report unconfirmed peers as a caveat. Do not treat a clean current checkout as proof the whole repo is clear.
+- **Coordinate with peer Mechanics before repo gates.** Assume other Mechanic chips or repair sessions may be active in the same repo. Before merging, pushing, deploying, publishing, tagging, or cutting a release, inspect live peers/worktrees and coordinate ownership/status with them. Classify dirty repository state as intentional mission work, peer-owned, user-owned, stale/discardable, or unknown. Include ready peer checkpoints. If no peer claims remaining dirt, assess sensitivity and staleness, preserve a recoverable copy when warranted, then adopt or discard it so production continues. Overlapping live work is coordinated into one delivery owner; silence is a caveat, not a permanent stop. Do not treat a clean current checkout as proof the whole repo is clear.
 
 ## Codex Mechanic chip handoff
 
@@ -97,12 +99,12 @@ Inspect Codex behavior only far enough to correct those GrepRAG surfaces or to
 report a precise external blocker. Codex owns native task creation, worktrees,
 permissions, Git, and task lifecycle. Do not create another child or use an
 internal subagent unless the parent explicitly changes that assignment.
-Landing (adr/codex-landing-doctrine.md): a `MECHANIC: <Mission>` chip replies
-to its LEAD, which owns merge, archive, and cleanup. A `FIX: <friction>`
-mission (from `greprag fix spawn`) also stops for human approval after making
-the fix: it explains the exact friction, the change made, why it works, and the
-checks run. It must not land, archive, or clean up its selected workspace
-before approval.
+Landing (adr/codex-landing-doctrine.md): a `MECHANIC: <Mission>` or
+`FIX: <friction>` chip replies to its LEAD with the commit, exact friction,
+change, reason, checks, and cleanup parameters. The LEAD is the delivery owner
+and integrates without another human approval. If no live parent exists and
+the chip itself carries the full-goal mission, it becomes delivery owner and
+follows `.greprag/delivery.json` through verification.
 
 ABOUT TO dispatch or replace a visible Codex chip? STOP — load
 `codex-chip-spawn` first and create the child with Codex Desktop's native

package/skill/templates/chip-spawn.md

@@ -105,6 +105,6 @@ Chips never `npm link` from the worktree — dangling symlinks silently break th
 
 ## Parent merge discipline — prune at the merge (HARD RULE)
 
-When you (the parent) merge a chip branch — via `/commit` or raw `git merge` — prune in the same breath: junction guard (`~/.claude/skills/commit/guard-junctions.sh <worktree>`), `git worktree remove .claude/worktrees/<slug>`, and `git branch -d chip/<slug>` once merged. Deferred cleanup = stale worktrees piling up (field state 2026-06-10: 3 leftovers). Multi-chip missions: worktree dies at the feature-branch merge; the branch lives until the master merge (chip-leader Phase 4).
+When you (the parent) merge a chip branch — through the canonical commit path or a profile-declared merge — prune in the same breath: junction guard (`~/.claude/skills/commit/guard-junctions.sh <worktree>`), `git worktree remove .claude/worktrees/<slug>`, and `git branch -d chip/<slug>` once merged. Deferred cleanup = stale worktrees piling up (field state 2026-06-10: 3 leftovers). Multi-chip missions: worktree dies at the integration-branch merge; the branch lives until the configured default-branch merge (chip-leader Phase 4).
 
-**Exception — FIX chips stop for approval.** A `greprag fix spawn` mission is the source of truth for FIX behavior. `fix spawn` detects usable Git history and emits `workspaceMode`: Git uses an isolated worktree; non-Git, unavailable Git, or no commit uses the project-local task with serialized writes. Dispatch honors that mode without trying a worktree first. The FIX chip identifies the exact friction, makes the smallest durable root-cause fix, explains the friction and fix in human terms, reports checks, then stops for human approval. It does not land, archive, or clean up the selected workspace before approval.
+**FIX chips use the same delivery owner.** A `greprag fix spawn` mission is the source of truth for FIX behavior. `fix spawn` detects usable Git history and emits `workspaceMode`: Git uses an isolated worktree; non-Git, unavailable Git, or no commit uses the project-local task with serialized writes. Dispatch honors that mode without trying a worktree first. The FIX chip identifies the exact friction, makes the smallest durable root-cause fix, verifies and checkpoints it, then reports the commit/result and cleanup parameters to the parent delivery owner. It creates no human landing gate. If no live parent exists and the chip carries the full-goal mission, it becomes delivery owner and follows the repo profile.

package/skill/templates/codex-chip-spawn.md

@@ -184,13 +184,17 @@ recap/Capture/doc-pointer/stateful injection, `env` bootstrap/deps/scripts, and
 `code` product/source behavior. Repo writes use the selected workspace mode;
 data-only repair rows and diagnosis need no writable task. The chip identifies
 the exact friction, makes the smallest durable root-cause fix, explains the
-friction and fix in human terms, reports checks, then stops for human approval.
+friction and fix in human terms, verifies and checkpoints it, then hands the
+commit/result to the parent delivery owner without a second human approval
+gate. With no live parent and a full-goal mission, it becomes delivery owner
+and follows the repo profile.
 Removal comes first: remove offending text, gates, controls, duplicated
 doctrine, and wrong boundaries before adding new guidance. Add prose or
 controls only when no removal action can solve the friction; never wrap bad
 doctrine in explanatory caveats when deleting the bad boundary fixes it.
-It must not land, archive, or clean up selected workspace state before
-approval.
+As a child, it does not independently land, archive, or clean up selected
+workspace state; the parent delivery owner does that immediately after
+integration. The no-live-parent full-goal fallback owns those actions itself.
 
 ## After spawning