harness-everything 0.47.3 → 0.47.5

package/plugins/harness-everything/skills/tdd/scripts/quality-gate.js

@@ -239,6 +239,163 @@ function evaluateSource(source, errors, prefix) {
   return { source: clone(source), traced: valid ? 1 : 0, total: 1, percentage: valid ? 100 : 0 };
 }
 
+// SOURCE_DEFECT and SOURCE_CONFLICT must quote the assertions they blame and
+// compare each with the observed value from the run. Sources are identified by
+// their declared authoritative path.
+const EXPECT_ASSERTION = /^expect\((.*?)\)\s*\.\s*(?:toEqual|toStrictEqual|toBe)\s*\((.*)\)$/;
+const ASSERT_ASSERTION = /^assert\s*\.\s*(?:equal|strictEqual|deepEqual|deepStrictEqual)\s*\((.*)\)$/;
+
+function jsonLiteral(text) {
+  const literal = text.trim();
+  const single = /^'([^'"\\]*)'$/.exec(literal);
+  try {
+    return { checkable: true, value: JSON.parse(single ? `"${single[1]}"` : literal) };
+  } catch (error) {
+    return { checkable: false };
+  }
+}
+
+// Splits an argument list on commas at depth 0, outside string literals.
+// Returns null when brackets or strings are unbalanced. Not a general parser.
+function splitTopLevelArguments(text) {
+  const parts = [];
+  let depth = 0;
+  let quote = null;
+  let current = '';
+  for (let index = 0; index < text.length; index += 1) {
+    const ch = text[index];
+    if (quote) {
+      current += ch;
+      if (ch === '\\') {
+        current += text[index + 1] ?? '';
+        index += 1;
+      } else if (ch === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') {
+      quote = ch;
+    } else if ('([{'.includes(ch)) {
+      depth += 1;
+    } else if (')]}'.includes(ch)) {
+      depth -= 1;
+      if (depth < 0) return null;
+    } else if (ch === ',' && depth === 0) {
+      parts.push(current);
+      current = '';
+      continue;
+    }
+    current += ch;
+  }
+  if (quote !== null || depth !== 0) return null;
+  parts.push(current);
+  return parts;
+}
+
+// The literal expected value pinned by a quoted assertion, for the recognised
+// shapes only. Anything else (identifiers, constructors, prose, negated or
+// resolved modifiers) is not checkable. One trailing ';' is tolerated.
+function quotedExpectedValue(assertion) {
+  if (typeof assertion !== 'string') return { checkable: false };
+  const text = assertion.trim().replace(/;$/, '').trim();
+  const expectCall = EXPECT_ASSERTION.exec(text);
+  if (expectCall) return jsonLiteral(expectCall[2]);
+  const assertCall = ASSERT_ASSERTION.exec(text);
+  if (!assertCall) return { checkable: false };
+  // assert.equal(actual, expected[, message]): the expected value is the second argument.
+  const args = splitTopLevelArguments(assertCall[1]);
+  if (!args || (args.length !== 2 && args.length !== 3)) return { checkable: false };
+  return jsonLiteral(args[1]);
+}
+
+// Returns the sourceEvidence status. VERIFIED means two quoted literals from
+// different sources disagree (SOURCE_CONFLICT only). A quote/observed mismatch
+// alone shows the implementation differs from the source, not that the source
+// is defective, so SOURCE_DEFECT is always REVIEWER_REQUIRED.
+function evaluateSourceEvidence(requirement, declaredSources, errors, prefix) {
+  const label = requirement.sourceValidity;
+  const evidence = requirement.sourceEvidence;
+  if (!Array.isArray(evidence) || evidence.length === 0) {
+    errors.push(`${prefix}.sourceEvidence must quote the assertions for ${label}`);
+    return undefined;
+  }
+  const declaredPaths = declaredSources.filter(isObject).map(source => source.path);
+  const entries = [];
+  const checkable = new Map();
+  evidence.forEach((entry, index) => {
+    const entryPrefix = `${prefix}.sourceEvidence[${index}]`;
+    if (!isObject(entry)) {
+      errors.push(`${entryPrefix} must be an object`);
+      return;
+    }
+    if (!declaredPaths.includes(entry.source)) errors.push(`${entryPrefix}.source must name a declared authoritative source path`);
+    if (!nonEmpty(entry.assertion)) errors.push(`${entryPrefix}.assertion must quote the exact assertion text`);
+    if (!('expected' in entry)) errors.push(`${entryPrefix}.expected is required`);
+    if (!('observed' in entry)) errors.push(`${entryPrefix}.observed is required`);
+    if (declaredPaths.includes(entry.source) && nonEmpty(entry.assertion) && 'expected' in entry && 'observed' in entry) {
+      const quoted = quotedExpectedValue(entry.assertion);
+      if (quoted.checkable && !equal(quoted.value, entry.expected)) {
+        errors.push(`${entryPrefix}.expected does not match the value in the quoted assertion`);
+        return;
+      }
+      checkable.set(entry, quoted.checkable);
+      entries.push(entry);
+    }
+  });
+  let status;
+  const mismatched = entries.filter(entry => !equal(entry.expected, entry.observed));
+  if (mismatched.length === 0) {
+    errors.push(`${prefix}.sourceEvidence must compare a quoted assertion with a failing observed value before blaming the source`);
+  } else if (label === 'SOURCE_DEFECT') {
+    // No independent corroboration exists for a single source, so the reviewer decides.
+    status = 'REVIEWER_REQUIRED';
+  }
+  if (label === 'SOURCE_CONFLICT') {
+    if (new Set(entries.map(entry => entry.source)).size < 2) {
+      errors.push(`${prefix}.sourceEvidence must quote assertions from at least two distinct authoritative sources`);
+    }
+    // A conflict needs two sources constraining the same contract subject;
+    // unequal expectations about unrelated targets are not a conflict.
+    const subjects = new Map();
+    evidence.forEach((entry, index) => {
+      if (!entries.includes(entry)) return;
+      const entryPrefix = `${prefix}.sourceEvidence[${index}]`;
+      if (!nonEmpty(entry.subject)) {
+        errors.push(`${entryPrefix}.subject must name the contract target the assertion constrains`);
+      } else if (!assertionNamesSubject(entry.assertion, entry.subject.trim())) {
+        errors.push(`${entryPrefix}.subject must appear as a whole target in the quoted assertion`);
+      } else {
+        subjects.set(entry, entry.subject.trim());
+      }
+    });
+    const sameSubjectPairs = [];
+    for (const a of subjects.keys()) {
+      for (const b of subjects.keys()) {
+        if (a !== b && a.source !== b.source && subjects.get(a) === subjects.get(b)) sameSubjectPairs.push([a, b]);
+      }
+    }
+    const disagreeing = sameSubjectPairs.filter(([a, b]) => !equal(a.expected, b.expected));
+    if (subjects.size >= 2 && sameSubjectPairs.length === 0) {
+      errors.push(`${prefix}.sourceEvidence must quote assertions from two sources about the same subject; unequal expectations about unrelated targets are not a SOURCE_CONFLICT`);
+    } else if (sameSubjectPairs.length && disagreeing.length === 0) {
+      errors.push(`${prefix}.sourceEvidence expected values must disagree across sources; agreeing expectations with a failing observed value are NON_CONFORMANT`);
+    } else if (disagreeing.length) {
+      // Only a disagreement between two literal quotes is verified; a quote that
+      // cannot be read mechanically goes to the reviewer without an error.
+      status = disagreeing.some(([a, b]) => checkable.get(a) && checkable.get(b)) ? 'VERIFIED' : 'REVIEWER_REQUIRED';
+    }
+  }
+  return status;
+}
+
+// True when `subject` appears in `assertion` as a whole target: `list.head`
+// matches `expect(list.head)` but not `expect(list.head.value)`.
+function assertionNamesSubject(assertion, subject) {
+  const escaped = subject.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(?<![\\w$.])${escaped}(?![\\w$.\\[])`).test(assertion);
+}
+
 function scoreDimensions(dimensions) {
   let weighted = 0;
   let appliedWeight = 0;
@@ -323,6 +480,10 @@ function evaluateRequirement(requirement, index, errors) {
   if (requirement.sourceValidity === 'SOURCE_CONFLICT' && declaredSources.some(source => !isObject(source) || source.status !== 'AUTHORITATIVE')) {
     errors.push(`${prefix}.SOURCE_CONFLICT may only identify authoritative sources`);
   }
+  let sourceEvidenceStatus;
+  if (['SOURCE_DEFECT', 'SOURCE_CONFLICT'].includes(requirement.sourceValidity)) {
+    sourceEvidenceStatus = evaluateSourceEvidence(requirement, declaredSources, errors, prefix);
+  }
 
   const scoring = scoringDetails(dimensions);
   const score = scoreDimensions(dimensions);
@@ -347,6 +508,8 @@ function evaluateRequirement(requirement, index, errors) {
     sourceConformance: requirement.sourceConformance || null,
     sourceValidity: requirement.sourceValidity || null,
     ...(requirement.sourceNotes ? { sourceNotes: requirement.sourceNotes } : {}),
+    ...(requirement.sourceEvidence ? { sourceEvidence: clone(requirement.sourceEvidence) } : {}),
+    ...(sourceEvidenceStatus ? { sourceEvidenceStatus } : {}),
     dimensions,
     skippedTests,
     flakyTests: Array.isArray(requirement.flakyTests) ? clone(requirement.flakyTests) : [],
@@ -432,6 +595,7 @@ function printSummary(report) {
   console.log('Requirements:');
   for (const requirement of report.requirements) {
     console.log(`- ${requirement.requirementId} [${requirement.testProfile}]: ${requirement.result} ${requirement.score}%`);
+    if (requirement.sourceEvidenceStatus) console.log(`- ${requirement.requirementId} sourceEvidence: ${requirement.sourceEvidenceStatus}`);
   }
   console.log('Dimensions:');
   for (const name of DIMENSIONS) {
@@ -472,4 +636,4 @@ function runCli(argv) {
 
 if (require.main === module) process.exit(runCli(process.argv));
 
-module.exports = { DIMENSIONS, REQUIRED_CLASSES, VERSION, evaluateEvidence, runCli };
+module.exports = { DIMENSIONS, REQUIRED_CLASSES, VERSION, evaluateEvidence, quotedExpectedValue, runCli };

package/plugins/harness-everything/skills/zoom-out/SKILL.md

@@ -4,7 +4,7 @@ description: "Reflect-first circuit breaker - after 3 failures, stop edits, rebu
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.40.0
+  version: 0.47.5
 ---
 
 # Zoom Out (Circuit Breaker)

package/plugins/harness-everything/skills/zoom-out/references/circuit-breaker.md

@@ -33,6 +33,7 @@ flowchart TD
   - "Same decision class" means the same acceptance decision under the same trust assumptions, possibly at different sites. "Same directory" or "validation" is too broad. Count a repeated or renamed finding once, and treat missing history as unknown, not zero.
   - Phase 2 here means: list every finding so far by decision class, state the acceptance clause each violates, and inventory every site (callers, state readers, Stop consumers) that makes the same decision. Findings that map to no acceptance clause stay `unresolved` for the owner instead of becoming new fixes.
   - RESUME by using the inventory to choose the smallest justified correction (which may be one shared fix, or no code change), then re-trace one normal end-to-end acceptance path. Unresolved findings need scope adjudication, not speculative repairs.
+  - Whoever applies the fixes counts too. Before fixing review round 2 or later on one feature, classify each new finding against the decision classes of earlier rounds. A class that also appeared in the previous round MUST trigger Phase 2 before any edit; do not wait for the reviewer to name the pattern.
   - A one-shot reviewer cannot see the previous round on its own. The packet carries the current acceptance anchor, a link to the previous comparable report with its revision, the prior finding IDs and dispositions, and the fix made since.
 - **Goal Drift**: Execution strays far from the initial task objective.
 - **User Instruction**: The user requests a step back ("zoom out", "step back", "stop and think").

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:1aa302d2-c2eb-59e7-aed3-a0dae8f57f06",
+  "serialNumber": "urn:uuid:7704887c-bf54-5e11-9e00-50ee977f324d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-31T16:31:35.736Z",
+    "timestamp": "2026-11-03T02:46:23.147Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.47.3"
+        "version": "0.47.5"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.47.3",
+      "bom-ref": "pkg:npm/harness-everything@0.47.5",
       "name": "harness-everything",
-      "version": "0.47.3",
-      "purl": "pkg:npm/harness-everything@0.47.3"
+      "version": "0.47.5",
+      "purl": "pkg:npm/harness-everything@0.47.5"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.47.3",
+      "ref": "pkg:npm/harness-everything@0.47.5",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/tdd/SKILL.md

@@ -4,7 +4,7 @@ description: "Drive Standard Tasks (Tier 2) with Test-Driven Development (RED/GR
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.13.0
+  version: 0.47.5
 ---
 
 # Test-Driven Development

package/tdd/fixtures/quality-scenarios.json

@@ -8,8 +8,16 @@
     { "name": "weighted integration failure", "mutation": "the 0.15 positive dimension scores zero", "expectedScore": 85, "expectedResult": "FAIL" },
     { "name": "weighted unit failure", "mutation": "unit determinism is N/A and the 0.15 positive dimension scores zero", "expectedScore": 83.33, "expectedResult": "FAIL" },
     { "name": "NON_CONFORMANT", "mutation": "sourceConformance = NON_CONFORMANT", "expectedResult": "FAIL" },
-    { "name": "SOURCE_DEFECT", "mutation": "sourceValidity = SOURCE_DEFECT and sourceNotes is present", "expectedResult": "PASS" },
-    { "name": "SOURCE_CONFLICT", "mutation": "sourceValidity = SOURCE_CONFLICT with a traced additional source", "expectedResult": "FAIL" },
+    { "name": "SOURCE_DEFECT", "mutation": "sourceValidity = SOURCE_DEFECT, sourceNotes is present, and sourceEvidence quotes the defective assertion against the observed value; sourceEvidenceStatus is REVIEWER_REQUIRED, never VERIFIED, because a single-source mismatch does not prove the source is wrong", "expectedResult": "PASS" },
+    { "name": "SOURCE_DEFECT without sourceEvidence", "mutation": "sourceValidity = SOURCE_DEFECT with sourceNotes but no sourceEvidence", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT", "mutation": "sourceValidity = SOURCE_CONFLICT with a traced additional source and sourceEvidence quoting both sources", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT without sourceEvidence", "mutation": "sourceValidity = SOURCE_CONFLICT with two authoritative sources but no sourceEvidence", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT node-versus-value", "mutation": "sourceValidity = SOURCE_CONFLICT citing only expect(list.head.value).toEqual(1) from one spec, observed value is an Element object", "expectedEvidence": "REJECTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT agreeing expectations", "mutation": "sourceValidity = SOURCE_CONFLICT with two sources expecting the same value and a failing observed value; the mismatch is implementation behaviour", "expectedEvidence": "REJECTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT two-source evidence", "mutation": "sourceValidity = SOURCE_CONFLICT with two authoritative sources quoting disagreeing expectations for the same subject list.head and a failing observed value; one quote (toBeInstanceOf) is not mechanically checkable, so sourceEvidenceStatus is REVIEWER_REQUIRED and the unresolved conflict gate stays closed", "expectedEvidence": "ACCEPTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT relabelled expected", "mutation": "sourceValidity = SOURCE_CONFLICT with two authoritative sources quoting the identical assertion expect(list.head).toEqual(1) but expected values 1 and 3; each expected must match its quoted literal, so the second entry is rejected", "expectedEvidence": "REJECTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT verified literal disagreement", "mutation": "sourceValidity = SOURCE_CONFLICT with two authoritative sources quoting expect(list.head.value).toBe(1) and expect(list.head.value).toBe('1') with matching expected values 1 and '1' and a failing observed value; sourceEvidenceStatus is VERIFIED and the unresolved conflict gate stays closed", "expectedEvidence": "ACCEPTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT unrelated assertions", "mutation": "sourceValidity = SOURCE_CONFLICT quoting expect(foo).toEqual(1) from one source and expect(bar).toEqual(3) from another; unequal expectations about different subjects", "expectedEvidence": "REJECTED", "expectedResult": "FAIL" },
     { "name": "malformed input", "mutation": "requirements is not an array", "expectedResult": "FAIL" },
     { "name": "unexpected input", "mutation": "one unexpectedInput check is FAIL", "expectedResult": "FAIL" },
     { "name": "error handling", "mutation": "one errorHandling check is SKIPPED", "expectedResult": "FAIL" },

package/tdd/references/quality-model.md

@@ -2,6 +2,8 @@
 
 This model turns each source requirement into auditable evidence. The authoritative source remains the contract even when it appears wrong. Record a suspected documentation problem as `SOURCE_DEFECT`; record disagreement between traced sources as `SOURCE_CONFLICT`. Never reinterpret either into a passing implementation. If no authoritative source exists, use `INFERRED` and state the inference basis.
 
+Before declaring either outcome, `sourceEvidence` quotes the exact conflicting assertions, names each declared source by path, and compares each `expected` value with the `observed` value from the run. A `SOURCE_CONFLICT` needs at least two distinct sources whose expected values disagree about the same `subject` — the contract target each quoted assertion constrains, written as it appears in the quote (`list.head` is not `list.head.value`). Unequal expectations about unrelated targets are not a conflict. If the quoted expectations agree and the run still fails, the mismatch is in the implementation: record `NON_CONFORMANT`, not `SOURCE_CONFLICT`. Each `expected` must match a mechanically readable literal in the quoted assertion (`toEqual`, `toStrictEqual`, `toBe`, or `assert.*` with a JSON or single-quoted literal); otherwise the claim is marked `REVIEWER_REQUIRED` and the gate does not treat it as an established disagreement. `VERIFIED` applies only to a `SOURCE_CONFLICT` whose two quoted literals disagree. A `SOURCE_DEFECT` is always `REVIEWER_REQUIRED`, because a mismatch with the observed value does not prove the source is wrong; the implementation may be the one at fault.
+
 ## Profile contract
 
 Every requirement declares exactly one `testProfile`: `unit` or `integration`. The selected profile defines which case classes are applicable; the common scoring and source rules do not make every test use identical evidence.

package/tdd/schemas/quality-evidence.schema.json

@@ -149,6 +149,18 @@
         }
       ]
     },
+    "sourceEvidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "assertion", "expected", "observed"],
+      "properties": {
+        "source": { "type": "string", "minLength": 1 },
+        "subject": { "type": "string", "minLength": 1 },
+        "assertion": { "type": "string", "minLength": 1 },
+        "expected": {},
+        "observed": {}
+      }
+    },
     "requirement": {
       "type": "object",
       "additionalProperties": false,
@@ -161,6 +173,7 @@
         "sourceConformance": { "enum": ["PASS", "NON_CONFORMANT"] },
         "sourceValidity": { "enum": ["VALID", "SOURCE_DEFECT", "SOURCE_CONFLICT"] },
         "sourceNotes": { "type": "string", "minLength": 1 },
+        "sourceEvidence": { "type": "array", "items": { "$ref": "#/$defs/sourceEvidence" } },
         "skippedTests": { "type": "array" },
         "flakyTests": { "type": "array" },
         "naDeclarations": { "type": "array" },
@@ -186,6 +199,14 @@
         }
       },
       "allOf": [
+        {
+          "if": { "required": ["sourceValidity"], "properties": { "sourceValidity": { "enum": ["SOURCE_DEFECT", "SOURCE_CONFLICT"] } } },
+          "then": { "required": ["sourceEvidence"], "properties": { "sourceEvidence": { "minItems": 1 } } }
+        },
+        {
+          "if": { "required": ["sourceValidity"], "properties": { "sourceValidity": { "const": "SOURCE_CONFLICT" } } },
+          "then": { "properties": { "sourceEvidence": { "items": { "required": ["subject"] } } } }
+        },
         {
           "if": {
             "required": ["testProfile"],

package/tdd/schemas/quality-report.schema.json

@@ -96,6 +96,8 @@
         "sourceConformance": { "enum": ["PASS", "NON_CONFORMANT", null] },
         "sourceValidity": { "enum": ["VALID", "SOURCE_DEFECT", "SOURCE_CONFLICT", null] },
         "sourceNotes": { "type": "string" },
+        "sourceEvidence": { "type": "array" },
+        "sourceEvidenceStatus": { "enum": ["VERIFIED", "REVIEWER_REQUIRED"], "description": "VERIFIED only for a SOURCE_CONFLICT whose two quoted literals disagree; SOURCE_DEFECT is always REVIEWER_REQUIRED." },
         "dimensions": { "$ref": "#/$defs/dimensions" },
         "skippedTests": { "type": "array" },
         "flakyTests": { "type": "array" },

package/tdd/scripts/quality-gate.js

@@ -239,6 +239,163 @@ function evaluateSource(source, errors, prefix) {
   return { source: clone(source), traced: valid ? 1 : 0, total: 1, percentage: valid ? 100 : 0 };
 }
 
+// SOURCE_DEFECT and SOURCE_CONFLICT must quote the assertions they blame and
+// compare each with the observed value from the run. Sources are identified by
+// their declared authoritative path.
+const EXPECT_ASSERTION = /^expect\((.*?)\)\s*\.\s*(?:toEqual|toStrictEqual|toBe)\s*\((.*)\)$/;
+const ASSERT_ASSERTION = /^assert\s*\.\s*(?:equal|strictEqual|deepEqual|deepStrictEqual)\s*\((.*)\)$/;
+
+function jsonLiteral(text) {
+  const literal = text.trim();
+  const single = /^'([^'"\\]*)'$/.exec(literal);
+  try {
+    return { checkable: true, value: JSON.parse(single ? `"${single[1]}"` : literal) };
+  } catch (error) {
+    return { checkable: false };
+  }
+}
+
+// Splits an argument list on commas at depth 0, outside string literals.
+// Returns null when brackets or strings are unbalanced. Not a general parser.
+function splitTopLevelArguments(text) {
+  const parts = [];
+  let depth = 0;
+  let quote = null;
+  let current = '';
+  for (let index = 0; index < text.length; index += 1) {
+    const ch = text[index];
+    if (quote) {
+      current += ch;
+      if (ch === '\\') {
+        current += text[index + 1] ?? '';
+        index += 1;
+      } else if (ch === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') {
+      quote = ch;
+    } else if ('([{'.includes(ch)) {
+      depth += 1;
+    } else if (')]}'.includes(ch)) {
+      depth -= 1;
+      if (depth < 0) return null;
+    } else if (ch === ',' && depth === 0) {
+      parts.push(current);
+      current = '';
+      continue;
+    }
+    current += ch;
+  }
+  if (quote !== null || depth !== 0) return null;
+  parts.push(current);
+  return parts;
+}
+
+// The literal expected value pinned by a quoted assertion, for the recognised
+// shapes only. Anything else (identifiers, constructors, prose, negated or
+// resolved modifiers) is not checkable. One trailing ';' is tolerated.
+function quotedExpectedValue(assertion) {
+  if (typeof assertion !== 'string') return { checkable: false };
+  const text = assertion.trim().replace(/;$/, '').trim();
+  const expectCall = EXPECT_ASSERTION.exec(text);
+  if (expectCall) return jsonLiteral(expectCall[2]);
+  const assertCall = ASSERT_ASSERTION.exec(text);
+  if (!assertCall) return { checkable: false };
+  // assert.equal(actual, expected[, message]): the expected value is the second argument.
+  const args = splitTopLevelArguments(assertCall[1]);
+  if (!args || (args.length !== 2 && args.length !== 3)) return { checkable: false };
+  return jsonLiteral(args[1]);
+}
+
+// Returns the sourceEvidence status. VERIFIED means two quoted literals from
+// different sources disagree (SOURCE_CONFLICT only). A quote/observed mismatch
+// alone shows the implementation differs from the source, not that the source
+// is defective, so SOURCE_DEFECT is always REVIEWER_REQUIRED.
+function evaluateSourceEvidence(requirement, declaredSources, errors, prefix) {
+  const label = requirement.sourceValidity;
+  const evidence = requirement.sourceEvidence;
+  if (!Array.isArray(evidence) || evidence.length === 0) {
+    errors.push(`${prefix}.sourceEvidence must quote the assertions for ${label}`);
+    return undefined;
+  }
+  const declaredPaths = declaredSources.filter(isObject).map(source => source.path);
+  const entries = [];
+  const checkable = new Map();
+  evidence.forEach((entry, index) => {
+    const entryPrefix = `${prefix}.sourceEvidence[${index}]`;
+    if (!isObject(entry)) {
+      errors.push(`${entryPrefix} must be an object`);
+      return;
+    }
+    if (!declaredPaths.includes(entry.source)) errors.push(`${entryPrefix}.source must name a declared authoritative source path`);
+    if (!nonEmpty(entry.assertion)) errors.push(`${entryPrefix}.assertion must quote the exact assertion text`);
+    if (!('expected' in entry)) errors.push(`${entryPrefix}.expected is required`);
+    if (!('observed' in entry)) errors.push(`${entryPrefix}.observed is required`);
+    if (declaredPaths.includes(entry.source) && nonEmpty(entry.assertion) && 'expected' in entry && 'observed' in entry) {
+      const quoted = quotedExpectedValue(entry.assertion);
+      if (quoted.checkable && !equal(quoted.value, entry.expected)) {
+        errors.push(`${entryPrefix}.expected does not match the value in the quoted assertion`);
+        return;
+      }
+      checkable.set(entry, quoted.checkable);
+      entries.push(entry);
+    }
+  });
+  let status;
+  const mismatched = entries.filter(entry => !equal(entry.expected, entry.observed));
+  if (mismatched.length === 0) {
+    errors.push(`${prefix}.sourceEvidence must compare a quoted assertion with a failing observed value before blaming the source`);
+  } else if (label === 'SOURCE_DEFECT') {
+    // No independent corroboration exists for a single source, so the reviewer decides.
+    status = 'REVIEWER_REQUIRED';
+  }
+  if (label === 'SOURCE_CONFLICT') {
+    if (new Set(entries.map(entry => entry.source)).size < 2) {
+      errors.push(`${prefix}.sourceEvidence must quote assertions from at least two distinct authoritative sources`);
+    }
+    // A conflict needs two sources constraining the same contract subject;
+    // unequal expectations about unrelated targets are not a conflict.
+    const subjects = new Map();
+    evidence.forEach((entry, index) => {
+      if (!entries.includes(entry)) return;
+      const entryPrefix = `${prefix}.sourceEvidence[${index}]`;
+      if (!nonEmpty(entry.subject)) {
+        errors.push(`${entryPrefix}.subject must name the contract target the assertion constrains`);
+      } else if (!assertionNamesSubject(entry.assertion, entry.subject.trim())) {
+        errors.push(`${entryPrefix}.subject must appear as a whole target in the quoted assertion`);
+      } else {
+        subjects.set(entry, entry.subject.trim());
+      }
+    });
+    const sameSubjectPairs = [];
+    for (const a of subjects.keys()) {
+      for (const b of subjects.keys()) {
+        if (a !== b && a.source !== b.source && subjects.get(a) === subjects.get(b)) sameSubjectPairs.push([a, b]);
+      }
+    }
+    const disagreeing = sameSubjectPairs.filter(([a, b]) => !equal(a.expected, b.expected));
+    if (subjects.size >= 2 && sameSubjectPairs.length === 0) {
+      errors.push(`${prefix}.sourceEvidence must quote assertions from two sources about the same subject; unequal expectations about unrelated targets are not a SOURCE_CONFLICT`);
+    } else if (sameSubjectPairs.length && disagreeing.length === 0) {
+      errors.push(`${prefix}.sourceEvidence expected values must disagree across sources; agreeing expectations with a failing observed value are NON_CONFORMANT`);
+    } else if (disagreeing.length) {
+      // Only a disagreement between two literal quotes is verified; a quote that
+      // cannot be read mechanically goes to the reviewer without an error.
+      status = disagreeing.some(([a, b]) => checkable.get(a) && checkable.get(b)) ? 'VERIFIED' : 'REVIEWER_REQUIRED';
+    }
+  }
+  return status;
+}
+
+// True when `subject` appears in `assertion` as a whole target: `list.head`
+// matches `expect(list.head)` but not `expect(list.head.value)`.
+function assertionNamesSubject(assertion, subject) {
+  const escaped = subject.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(?<![\\w$.])${escaped}(?![\\w$.\\[])`).test(assertion);
+}
+
 function scoreDimensions(dimensions) {
   let weighted = 0;
   let appliedWeight = 0;
@@ -323,6 +480,10 @@ function evaluateRequirement(requirement, index, errors) {
   if (requirement.sourceValidity === 'SOURCE_CONFLICT' && declaredSources.some(source => !isObject(source) || source.status !== 'AUTHORITATIVE')) {
     errors.push(`${prefix}.SOURCE_CONFLICT may only identify authoritative sources`);
   }
+  let sourceEvidenceStatus;
+  if (['SOURCE_DEFECT', 'SOURCE_CONFLICT'].includes(requirement.sourceValidity)) {
+    sourceEvidenceStatus = evaluateSourceEvidence(requirement, declaredSources, errors, prefix);
+  }
 
   const scoring = scoringDetails(dimensions);
   const score = scoreDimensions(dimensions);
@@ -347,6 +508,8 @@ function evaluateRequirement(requirement, index, errors) {
     sourceConformance: requirement.sourceConformance || null,
     sourceValidity: requirement.sourceValidity || null,
     ...(requirement.sourceNotes ? { sourceNotes: requirement.sourceNotes } : {}),
+    ...(requirement.sourceEvidence ? { sourceEvidence: clone(requirement.sourceEvidence) } : {}),
+    ...(sourceEvidenceStatus ? { sourceEvidenceStatus } : {}),
     dimensions,
     skippedTests,
     flakyTests: Array.isArray(requirement.flakyTests) ? clone(requirement.flakyTests) : [],
@@ -432,6 +595,7 @@ function printSummary(report) {
   console.log('Requirements:');
   for (const requirement of report.requirements) {
     console.log(`- ${requirement.requirementId} [${requirement.testProfile}]: ${requirement.result} ${requirement.score}%`);
+    if (requirement.sourceEvidenceStatus) console.log(`- ${requirement.requirementId} sourceEvidence: ${requirement.sourceEvidenceStatus}`);
   }
   console.log('Dimensions:');
   for (const name of DIMENSIONS) {
@@ -472,4 +636,4 @@ function runCli(argv) {
 
 if (require.main === module) process.exit(runCli(process.argv));
 
-module.exports = { DIMENSIONS, REQUIRED_CLASSES, VERSION, evaluateEvidence, runCli };
+module.exports = { DIMENSIONS, REQUIRED_CLASSES, VERSION, evaluateEvidence, quotedExpectedValue, runCli };

package/zoom-out/SKILL.md

@@ -4,7 +4,7 @@ description: "Reflect-first circuit breaker - after 3 failures, stop edits, rebu
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.40.0
+  version: 0.47.5
 ---
 
 # Zoom Out (Circuit Breaker)

package/zoom-out/references/circuit-breaker.md

@@ -33,6 +33,7 @@ flowchart TD
   - "Same decision class" means the same acceptance decision under the same trust assumptions, possibly at different sites. "Same directory" or "validation" is too broad. Count a repeated or renamed finding once, and treat missing history as unknown, not zero.
   - Phase 2 here means: list every finding so far by decision class, state the acceptance clause each violates, and inventory every site (callers, state readers, Stop consumers) that makes the same decision. Findings that map to no acceptance clause stay `unresolved` for the owner instead of becoming new fixes.
   - RESUME by using the inventory to choose the smallest justified correction (which may be one shared fix, or no code change), then re-trace one normal end-to-end acceptance path. Unresolved findings need scope adjudication, not speculative repairs.
+  - Whoever applies the fixes counts too. Before fixing review round 2 or later on one feature, classify each new finding against the decision classes of earlier rounds. A class that also appeared in the previous round MUST trigger Phase 2 before any edit; do not wait for the reviewer to name the pattern.
   - A one-shot reviewer cannot see the previous round on its own. The packet carries the current acceptance anchor, a link to the previous comparable report with its revision, the prior finding IDs and dispositions, and the fix made since.
 - **Goal Drift**: Execution strays far from the initial task objective.
 - **User Instruction**: The user requests a step back ("zoom out", "step back", "stop and think").