halfcycle 0.3.27 → 0.3.29

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.27",
+  "version": "0.3.29",
   "description": "Halfcycle Method bundle — resolution-stub slash commands, remote method-delivery registration, and governance-hook wiring for a Halfcycle engagement repo. It ships NO worker role files: a project's roles are authored from that project's own recorded decisions at orchestration kickoff (FX-2, W3-F-27).",
   "commands": [
     {

package/README.md

@@ -130,7 +130,7 @@ Five layers, one direction, a loop at the bottom.
 | **L1** | Decide | The product spec, drafted then interrogated, with nothing left hand-waved. |
 | **L2** | Write it down | Architecture, a diagram, and the rules the system must never break, named so later work cites them. Diagram and prose must agree. |
 | **L3** | Slice it | Phases that actually close. Oversized work gets split. Assumptions get labelled as assumptions. |
-| **gate** | | **The readiness audit.** Eight checks over everything decided so far, each one a command that runs against your own repository rather than an opinion. Too many red is a hard stop. |
+| **gate** | | **The readiness audit.** Eight checks over everything decided so far. Your session runs each one against your own repository and Halfcycle judges the answers — the documents this review reads never leave your machine. Too many red is a hard stop. |
 | **L4** | Design it | Feature specs. Every claim about existing code anchored to a real file and line or not asserted. A fresh reviewer that has never seen the spec, never the same one twice. |
 | **L5** | Build it | Ordered work, then coordinator and worker agents in parallel. Checks on the real changes, an anti-tautology pass over the tests, reachability, and a cold walk of the deployed product by somebody who did not build it. |
 
@@ -150,7 +150,9 @@ This matters enough to be specific about.
 
 **Source excerpts are off, at both ends, for every engagement today.** The wire format does have a field for them, so the honest version of this is a conditional statement rather than a flat one, and it rests on three things rather than on our good intentions: your runner does not attach an excerpt unless you turn a flag on, and that flag is off by default; anything that does arrive for an engagement that has not opted in is stripped on our side before the checks or any model see it; and there is no way to opt in today, because nothing in the product can set that flag. If that ever changes, our privacy policy changes with it, and it is the policy — not this paragraph — that states the guarantee.
 
-**A promise, for the day a check does need to read something you wrote.** No route in the product does this today — there is nothing to submit anything to, and we would rather say so than let a paragraph imply otherwise. When one exists, what you send it will be read and not kept: the finding and its evidence persist, the source does not, and training or benchmarking on it is foreclosed. It is written here now, labelled as a commitment rather than a feature, so the promise is public before the mechanism is.
+**What the readiness audit submits, and what it never carries.** `halfcycle_submit_findings` is how your session sends the audit's answers: a probe's status, a count, a repo-relative path, a short name. Never a file body, a diff or a source excerpt — the wire carries no field for prose, so a path or a name is the most it can carry. What Halfcycle keeps is what your session submitted, the judgement it reached, and which account and machine sign-in the submission came from; the documents themselves never reach it.
+
+**A promise, for the day a check does need to read something you wrote:** what you send it will be read and not kept: the finding and its evidence persist, the source does not, and training or benchmarking on it is foreclosed. It is written here now, labelled as a commitment rather than a feature, so the promise is public before the mechanism is.
 
 **Nothing method-shaped is left behind.** The runbooks, templates and question sets reach the session that asks for them, scoped to the step you are on, and are never at rest in your repository.
 

package/bin/bin.bundle.mjs

@@ -14530,7 +14530,7 @@ config(en_default());
 
 // ../core/dist/guard-record.js
 var severitySchema = external_exports.enum(["info", "warn", "block"]);
-var channelSchema = external_exports.enum(["stable", "candidate", "rented"]);
+var channelSchema = external_exports.enum(["stable", "candidate", "rented", "withdrawn"]);
 var matcherKindSchema = external_exports.enum(["grep", "ast", "integrationTest", "llm"]);
 var matcherConfigSchema = external_exports.record(external_exports.string(), external_exports.unknown());
 var grepMatcherSchema = external_exports.object({ kind: external_exports.literal("grep"), config: matcherConfigSchema }).strict();
@@ -14997,6 +14997,18 @@ var artefactRefSchema = external_exports.object({
   name: external_exports.string(),
   parent: external_exports.string()
 }).strict();
+var coverageSchema = external_exports.object({
+  asked: external_exports.number().int().nonnegative(),
+  answered: external_exports.number().int().nonnegative()
+}).strict().superRefine((coverage, ctx) => {
+  if (coverage.answered > coverage.asked) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["answered"],
+      message: "answered cannot be more than asked"
+    });
+  }
+});
 var artefactRecordSchema = stateRecordEnvelopeSchema.extend({
   recordKind: external_exports.literal("artefact"),
   artefactRef: artefactRefSchema,
@@ -15035,7 +15047,8 @@ var gateRecordSchema = stateRecordEnvelopeSchema.extend({
   gateKind: gateKindSchema,
   verdict: gateVerdictSchema,
   actor: external_exports.string(),
-  outcomeReason: external_exports.string().max(2e3).optional()
+  outcomeReason: external_exports.string().max(2e3).optional(),
+  coverage: coverageSchema.optional()
 }).strict().superRefine((rec, ctx) => {
   const issue2 = outcomeReasonIssue(rec.verdict, rec.outcomeReason);
   if (issue2) {
@@ -15048,7 +15061,8 @@ var interventionRecordSchema = stateRecordEnvelopeSchema.extend({
   mechanism: mechanismSchema,
   severity: severitySchema,
   disposition: dispositionSchema,
-  summary: external_exports.string().max(2e3)
+  summary: external_exports.string().max(2e3),
+  coverage: coverageSchema.optional()
 }).strict();
 var stateRecordSchema = external_exports.discriminatedUnion("recordKind", [
   artefactRecordSchema,

package/dist/bin.js

@@ -18,7 +18,7 @@ import { z as z2 } from "zod";
 // ../core/dist/guard-record.js
 import { z } from "zod";
 var severitySchema = z.enum(["info", "warn", "block"]);
-var channelSchema = z.enum(["stable", "candidate", "rented"]);
+var channelSchema = z.enum(["stable", "candidate", "rented", "withdrawn"]);
 var matcherKindSchema = z.enum(["grep", "ast", "integrationTest", "llm"]);
 var matcherConfigSchema = z.record(z.string(), z.unknown());
 var grepMatcherSchema = z.object({ kind: z.literal("grep"), config: matcherConfigSchema }).strict();
@@ -336,6 +336,20 @@ var coeFindingResponseSchema = z4.object({
   mappedPatternRef: z4.string().nullable(),
   createdAt: utcIso86012
 }).strict();
+var operatorFindingResponseSchema = z4.object({
+  // The finding just recorded.
+  finding: coeFindingResponseSchema,
+  // Every finding recorded for that phase, oldest first, including this one.
+  phaseFindings: z4.array(coeFindingResponseSchema),
+  // Whether the phase's finding rate was recalculated to include this finding.
+  figuresRecomputed: z4.boolean()
+}).strict();
+var phaseNotOnRecordRefusalSchema = wireErrorSchema.extend({
+  // Always this value for this refusal.
+  error: z4.literal("PhaseNotOnRecord"),
+  // The phases that can take a finding, sorted.
+  phases: z4.array(z4.string())
+}).strict();
 var phaseEntryDecisionSchema = z4.discriminatedUnion("decision", [
   z4.object({
     decision: z4.literal("entry-condition-met"),
@@ -491,6 +505,18 @@ var artefactRefSchema = z5.object({
   name: z5.string(),
   parent: z5.string()
 }).strict();
+var coverageSchema = z5.object({
+  asked: z5.number().int().nonnegative(),
+  answered: z5.number().int().nonnegative()
+}).strict().superRefine((coverage, ctx) => {
+  if (coverage.answered > coverage.asked) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      path: ["answered"],
+      message: "answered cannot be more than asked"
+    });
+  }
+});
 var artefactRecordSchema = stateRecordEnvelopeSchema.extend({
   recordKind: z5.literal("artefact"),
   artefactRef: artefactRefSchema,
@@ -529,7 +555,8 @@ var gateRecordSchema = stateRecordEnvelopeSchema.extend({
   gateKind: gateKindSchema,
   verdict: gateVerdictSchema,
   actor: z5.string(),
-  outcomeReason: z5.string().max(2e3).optional()
+  outcomeReason: z5.string().max(2e3).optional(),
+  coverage: coverageSchema.optional()
 }).strict().superRefine((rec, ctx) => {
   const issue = outcomeReasonIssue(rec.verdict, rec.outcomeReason);
   if (issue) {
@@ -542,7 +569,8 @@ var interventionRecordSchema = stateRecordEnvelopeSchema.extend({
   mechanism: mechanismSchema,
   severity: severitySchema,
   disposition: dispositionSchema,
-  summary: z5.string().max(2e3)
+  summary: z5.string().max(2e3),
+  coverage: coverageSchema.optional()
 }).strict();
 var stateRecordSchema = z5.discriminatedUnion("recordKind", [
   artefactRecordSchema,
@@ -1493,6 +1521,11 @@ function mcpEndpointUrl(origin) {
   return `${origin.trim().replace(/\/+$/, "")}${MCP_ENDPOINT_PATH}`;
 }
 
+// dist/project-page.js
+function projectPageUrl(engagementId) {
+  return isEngagementId(engagementId) ? `${DASHBOARD_URL}/${encodeURIComponent(engagementId)}` : void 0;
+}
+
 // dist/merge-settings.js
 function isHalfcycleEntry(entry, halfcycleCommands) {
   return entry.hooks.some((h) => halfcycleCommands.has(h.command));
@@ -2507,12 +2540,14 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, a
   const previous = previousPinForEngagement(targetRepoRoot, engagementId);
   const carried = nonEmpty(accountId) ?? nonEmpty(previous?.accountId);
   const installedAt = nonEmpty(previous?.installedAt) ?? (/* @__PURE__ */ new Date()).toISOString();
+  const projectPage = projectPageUrl(engagementId);
   const pin = {
     version,
     engagementId,
     engagementType,
     installedAt,
-    ...carried !== void 0 ? { accountId: carried } : {}
+    ...carried !== void 0 ? { accountId: carried } : {},
+    ...projectPage !== void 0 ? { projectPage } : {}
   };
   const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
   writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
@@ -2840,11 +2875,25 @@ import { createServer } from "node:http";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 var LOOPBACK_PORT_ENV = "HALFCYCLE_LOOPBACK_PORT";
 var DEFAULT_STILL_WAITING_MS = 15e3;
-function completionPage(result) {
+var COMPLETION_REDIRECT_SECONDS = 2;
+function onwardTarget(engagementId) {
+  const projectPage = projectPageUrl(engagementId);
+  if (projectPage !== void 0) {
+    return { href: projectPage, label: "Go to your project's page" };
+  }
+  return { href: DASHBOARD_URL, label: "Go to your projects" };
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function completionPage(result, engagementId) {
   const approved = result === LOOPBACK_RESULT.APPROVED;
   const headline = approved ? "Signed in. You can close this tab and return to your terminal." : "Sign-in declined. Nothing was created. You can close this tab.";
-  const successLink = approved ? `<p><a href="${DASHBOARD_URL}" style="color:#19d3ff">Go to your projects</a></p>` : "";
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Halfcycle</title></head><body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0a0a0a;color:#fafafa;font:16px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif"><div style="max-width:26rem;padding:2rem;text-align:center"><p>${headline}</p>${successLink}</div></body></html>`;
+  const onward = approved ? onwardTarget(engagementId) : null;
+  const href = onward === null ? "" : escapeHtml(onward.href);
+  const refresh = onward === null ? "" : `<meta http-equiv="refresh" content="${COMPLETION_REDIRECT_SECONDS};url=${href}">`;
+  const successLink = onward === null ? "" : `<p><a href="${href}" style="color:#19d3ff">${escapeHtml(onward.label)}</a></p>`;
+  return '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="referrer" content="no-referrer">' + refresh + `<title>Halfcycle</title></head><body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0a0a0a;color:#fafafa;font:16px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif"><div style="max-width:26rem;padding:2rem;text-align:center"><p>${headline}</p>${successLink}</div></body></html>`;
 }
 function isLoopbackPeer(remoteAddress) {
   if (remoteAddress === void 0)
@@ -2859,7 +2908,7 @@ function statesMatch(presented, expected) {
     return false;
   return timingSafeEqual(a, b);
 }
-function createCallbackHandler(state, onCallback) {
+function createCallbackHandler(state, onCallback, engagementId) {
   return (req, res) => {
     if (!isLoopbackPeer(req.socket.remoteAddress)) {
       res.writeHead(403).end();
@@ -2883,7 +2932,7 @@ function createCallbackHandler(state, onCallback) {
     const declared = url.searchParams.get(LOOPBACK_QUERY_RESULT);
     const result = declared === LOOPBACK_RESULT.DECLINED ? LOOPBACK_RESULT.DECLINED : LOOPBACK_RESULT.APPROVED;
     res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-    res.end(completionPage(result));
+    res.end(completionPage(result, engagementId));
     onCallback({ result });
   };
 }
@@ -2902,7 +2951,7 @@ function requestedPort(env) {
   }
   return { port };
 }
-async function bindLoopback(env = process.env) {
+async function bindLoopback(env = process.env, engagementId) {
   const wanted = requestedPort(env);
   if ("problem" in wanted)
     return { bound: false, reason: wanted.problem };
@@ -2914,7 +2963,7 @@ async function bindLoopback(env = process.env) {
       deliver(callback);
     else
       pending = callback;
-  }));
+  }, engagementId));
   const bindProblem = await new Promise((resolve4) => {
     const onError = (err) => {
       resolve4(`${err.code ?? "bind failed"} on ${LOOPBACK_REDIRECT_HOST}:${wanted.port}`);
@@ -3171,7 +3220,7 @@ async function signIn(serviceUrl, deps = {}) {
   }
   write(`[halfcycle] Halfcycle needs an account before it can ${deps.reason ?? DEFAULT_SIGN_IN_REASON} \u2014 signing you in through your browser.
 `);
-  const bind = await bindLoopback(env);
+  const bind = await bindLoopback(env, deps.onwardEngagementId);
   let closed = false;
   const closeListener = async () => {
     if (bind.bound && !closed) {
@@ -3950,8 +3999,14 @@ async function createOwnedEngagement(serviceUrl, targetRepo, deps = {}) {
   }
 }
 var JOIN_REFUSED_LOCAL_REMEDY = "No credential was minted and nothing was written. This repository is pinned to that engagement by .halfcycle/bundle.json \u2014 check that the id in it is the one you meant. To start a NEW engagement here instead, remove that file and re-run.";
+var JOIN_SIGN_IN_REASON = "join an existing project";
 async function joinPinnedEngagement(serviceUrl, engagementId, targetRepo, deps = {}) {
-  let credential = await confirmActingIdentity(serviceUrl, await obtainCredential(serviceUrl, deps), { kind: "join", targetRepo, engagementId }, deps);
+  const signInDeps = {
+    ...deps,
+    reason: deps.reason ?? JOIN_SIGN_IN_REASON,
+    onwardEngagementId: engagementId
+  };
+  let credential = await confirmActingIdentity(serviceUrl, await obtainCredential(serviceUrl, signInDeps), { kind: "join", targetRepo, engagementId }, signInDeps);
   for (; ; ) {
     try {
       return {
@@ -3979,7 +4034,7 @@ async function joinPinnedEngagement(serviceUrl, engagementId, targetRepo, deps =
       if (err.status !== 401) {
         throw err;
       }
-      const replacement = await replaceRefusedCredential(serviceUrl, credential, deps);
+      const replacement = await replaceRefusedCredential(serviceUrl, credential, signInDeps);
       if (replacement === null) {
         throw new SignInRefused(`join-${err.status}`, `${err.serverMessage} ${refusedCredentialRemedy(credential.source)} No credential was minted and nothing was written.`);
       }