its-magic 0.1.2-38 → 0.1.2-40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "its-magic",
-  "version": "0.1.2-38",
+  "version": "0.1.2-40",
   "description": "its-magic - AI dev team workflow for Cursor.",
   "license": "MIT",
   "bin": {
@@ -17,10 +17,14 @@
     "scripts/intake_bug_routing_guard.py",
     "scripts/check_intake_template_parity.py",
     "scripts/materialize_codebase_map.py",
+    "scripts/remote_config_summary.py",
+    "scripts/guard_installer_publish.py",
     "bin/its-magic.js",
     "bin/postinstall.js"
   ],
   "scripts": {
+    "guard:installer": "python scripts/guard_installer_publish.py",
+    "prepublishOnly": "npm run guard:installer",
     "postinstall": "node bin/postinstall.js",
     "release:patch": "npm version patch && npm publish",
     "release:minor": "npm version minor && npm publish",

package/scripts/check_intake_template_parity.py

@@ -12,6 +12,7 @@ INTAKE_TEMPLATE_PAIRS: tuple[tuple[str, str], ...] = (
     ("scripts/intake_evidence_validate.py", "template/scripts/intake_evidence_validate.py"),
     ("scripts/intake_evidence_lib.py", "template/scripts/intake_evidence_lib.py"),
     ("scripts/intake_bug_routing_guard.py", "template/scripts/intake_bug_routing_guard.py"),
+    ("scripts/intake_bug_resume_brief_refresh.py", "template/scripts/intake_bug_resume_brief_refresh.py"),
     ("scripts/check_intake_template_parity.py", "template/scripts/check_intake_template_parity.py"),
 )
 

package/scripts/guard_installer_publish.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Prepublish / CI guard: installer.sh LF + POSIX-safe startup tokens (US-0084 / AC-2)."""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+INSTALLER_SH = ROOT / "installer.sh"
+
+FORBIDDEN_TOKENS = (
+    "set -euo",
+    "set -o pipefail",
+    "set -eu -o pipefail",
+    "set -o errexit",
+    "set -o nounset",
+)
+
+
+def main() -> int:
+    if not INSTALLER_SH.is_file():
+        print("guard_installer_publish: installer.sh missing", file=sys.stderr)
+        return 1
+    data = INSTALLER_SH.read_bytes()
+    if b"\r" in data:
+        print(
+            "guard_installer_publish: CR/LF (\\r) bytes found in installer.sh — "
+            "use LF only; see docs/engineering/runbook.md (US-0084).",
+            file=sys.stderr,
+        )
+        return 1
+    text = data.decode("utf-8", errors="replace")
+    for token in FORBIDDEN_TOKENS:
+        if token in text:
+            print(
+                f"guard_installer_publish: forbidden startup token {token!r} in installer.sh",
+                file=sys.stderr,
+            )
+            return 1
+    dash = shutil.which("dash")
+    if dash:
+        r = subprocess.run(
+            [dash, "-n", str(INSTALLER_SH)],
+            cwd=ROOT,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        if r.returncode != 0:
+            print(
+                "guard_installer_publish: dash -n installer.sh failed:\n"
+                + (r.stderr or r.stdout or ""),
+                file=sys.stderr,
+            )
+            return 1
+    else:
+        print(
+            "guard_installer_publish: dash not on PATH; skipping dash -n "
+            "(Python CRLF + token checks still enforced).",
+            file=sys.stderr,
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/intake_evidence_lib.py

@@ -1,6 +1,6 @@
 """
 Deterministic intake evidence validation
-(US-0078 / US-0083 / DEC-0060 / DEC-0067 / R-0055).
+(US-0078 / US-0083 / DEC-0060 / DEC-0067 / R-0055 / BUG-0007 / R-0066).
 
 Consumes a logical intake_evidence bundle (dict). PO workflows MUST run this
 gate before mutating backlog/acceptance; failures are fail-closed.
@@ -202,6 +202,77 @@ def _row_uses_equivalent_evidence(row: dict[str, Any]) -> bool:
     return bool(str(row.get("equivalent_evidence_ref") or "").strip())
 
 
+def _norm_answer_ref_quoted_user_text(value: Any) -> str:
+    """Normalize quoted_user_text for BUG-0007 duplicate detection (DEC-0060 strip parity)."""
+    if value is None:
+        return ""
+    return str(value).strip()
+
+
+def _row_exempt_from_answer_ref_topic_distinctness(row: dict[str, Any]) -> bool:
+    """BUG-0007: alternate satisfaction paths do not participate in answer_ref blob reuse checks."""
+    return _row_uses_equivalent_evidence(row)
+
+
+def _validate_answer_ref_topic_distinctness(
+    bundle: dict[str, Any],
+    required: list[str],
+    by_key: dict[str, dict[str, Any]],
+    res: ValidationResult,
+) -> None:
+    """
+    BUG-0007 / R-0066: distinct required topic_key rows must not reuse the same
+    quoted_user_text under satisfied_by=answer_ref (normalized), except exempt rows.
+    """
+    norm_to_topics: dict[str, list[str]] = {}
+    for k in required:
+        row = by_key.get(k)
+        if not row:
+            continue
+        sat = (row.get("satisfied_by") or "").strip()
+        if sat != "answer_ref":
+            continue
+        if _row_exempt_from_answer_ref_topic_distinctness(row):
+            continue
+        irid = _row_run_id(bundle, row)
+        tit = _row_turn(row)
+        if irid is None or tit is None:
+            continue
+        qraw = row.get("quoted_user_text")
+        qtxt = "" if qraw is None else str(qraw)
+        ref = (row.get("ref") or "").strip()
+        if not ref or not verify_ie_ref(
+            ref,
+            intake_run_id=irid,
+            turn_index=int(tit),
+            topic_key=k,
+            satisfied_by=sat,
+            quoted_user_text=qtxt,
+        ):
+            continue
+        norm = _norm_answer_ref_quoted_user_text(qraw)
+        norm_to_topics.setdefault(norm, []).append(k)
+
+    dup_groups: list[str] = []
+    for norm, topics in norm_to_topics.items():
+        uniq = sorted(set(topics))
+        if len(uniq) < 2:
+            continue
+        dup_groups.append("text=" + repr(norm[:120]) + " topics=" + ",".join(uniq))
+
+    if dup_groups:
+        res.ok = False
+        res.add_code("INTAKE_ANSWER_REF_NOT_TOPIC_DISTINCT")
+        res.diagnostics.append(
+            "Remediation: distinct required topics must not reuse the same quoted_user_text "
+            "under satisfied_by=answer_ref (BUG-0007 / R-0066). Duplicates: "
+            + "; ".join(dup_groups)
+            + ". Use per-topic answers, or an allowed alternate path "
+            "(evidence_source=equivalent_evidence_ref + equivalent_evidence_ref, "
+            "delegation_ref per DEC-0067 / US-0083, or assumption_confirmation_ref on the row)."
+        )
+
+
 def _candidate_story_ids(bundle: dict[str, Any]) -> set[str]:
     out: set[str] = set()
 
@@ -527,6 +598,8 @@ def validate_intake_evidence(
                 res.missing_topics.append(k)
     res.missing_topics = sorted(set(res.missing_topics))
 
+    _validate_answer_ref_topic_distinctness(bundle, required, by_key, res)
+
     # US-0081 / DEC-0064: first/new/broad intake requires complete-plan coverage contract.
     if pack == "first-intake-pack":
         _validate_plan_coverage_contract(bundle, res)
@@ -668,6 +741,32 @@ def self_test() -> None:
     assert d0.ok and d1.ok
     assert d0.primary_codes == d1.primary_codes
 
+    # BUG-0007: same quoted_user_text across multiple answer_ref required topics fails
+    dup_txt = "synthetic blob echoed for every topic"
+    dup_rows = []
+    for i, key in enumerate(small):
+        dup_rows.append(
+            {
+                "topic_key": key,
+                "satisfied_by": "answer_ref",
+                "quoted_user_text": dup_txt,
+                "intake_run_id": rid,
+                "turn_index": 300 + i,
+                "ref": build_ie_ref(rid, 300 + i, key, "answer_ref", dup_txt),
+            }
+        )
+    dup_bundle = {
+        "selected_pack": "small-intake-pack",
+        "intake_run_id": rid,
+        "asked_topics": list(small),
+        "missing_topics": [],
+        "assumptions_confirmed": "(none)",
+        "topic_coverage": dup_rows,
+    }
+    dup_res = validate_intake_evidence(dup_bundle)
+    assert not dup_res.ok
+    assert "INTAKE_ANSWER_REF_NOT_TOPIC_DISTINCT" in dup_res.primary_codes
+
     # First-intake full-plan coverage contract (US-0081 / DEC-0064)
     first = PACK_REQUIRED_KEYS["first-intake-pack"]
     first_rows = []

package/scripts/remote_config_summary.py

@@ -0,0 +1,243 @@
+#!/usr/bin/env python3
+"""
+Summarize .cursor/remote.json for operators (US-0084 / US-0064 alignment).
+
+Stdout: non-secret labels and env-reference names only (no key material).
+Stderr: errors and skip reasons.
+
+Exit codes:
+  0 OK or REMOTE_EXECUTION=0 skip (DEC-0070)
+  1 usage / CLI error
+  2 config missing or unreadable
+  3 invalid JSON
+  4 schema / contract mismatch vs runbook remote.json contract
+  5 reserved (unused; DEC-0070 maps REMOTE_EXECUTION=0 to 0)
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+ENV_VAR_NAME = re.compile(r"^[A-Z][A-Z0-9_]*$")
+ALLOWED_TYPES = frozenset({"docker", "ssh", "vm"})
+AUTH_MODES = frozenset({"none", "env"})
+
+
+def _truthy_remote_execution(raw: str | None) -> bool:
+    if raw is None:
+        return False
+    return raw.strip() in {"1", "true", "TRUE", "yes", "YES", "on", "ON"}
+
+
+def _parse_args(argv: list[str]) -> tuple[argparse.Namespace, list[str]]:
+    p = argparse.ArgumentParser(description=__doc__.split("\n\n")[0], add_help=True)
+    p.add_argument(
+        "--config",
+        default=None,
+        help="Path to remote JSON (default: REMOTE_CONFIG env or .cursor/remote.json)",
+    )
+    return p.parse_known_args(argv)
+
+
+def _config_path(explicit: str | None) -> Path:
+    if explicit:
+        return Path(explicit).expanduser()
+    env = os.environ.get("REMOTE_CONFIG")
+    if env:
+        return Path(env).expanduser()
+    return Path(".cursor/remote.json")
+
+
+def _validate_env_ref(name: str, value: Any, prefix: str) -> str | None:
+    if not isinstance(value, str):
+        return f"{prefix}: {name} must be a string env-reference name"
+    if not ENV_VAR_NAME.match(value):
+        return f"{prefix}: {name} must look like an env var name (A-Z_0-9)"
+    return None
+
+
+def validate_and_summarize(path: Path, data: dict[str, Any]) -> tuple[list[str], list[str]]:
+    """Return (stdout_lines, error_messages)."""
+    errs: list[str] = []
+    out: list[str] = []
+    out.append(f"remote_config={path.as_posix()}")
+
+    if not isinstance(data.get("version"), int):
+        errs.append("[REMOTE_CONFIG_ERROR] root.version: expected integer")
+    if not isinstance(data.get("defaultTarget"), str) or not data["defaultTarget"]:
+        errs.append("[REMOTE_CONFIG_ERROR] root.defaultTarget: expected non-empty string")
+    targets = data.get("targets")
+    if not isinstance(targets, list) or not targets:
+        errs.append("[REMOTE_CONFIG_ERROR] root.targets: expected non-empty array")
+
+    if errs:
+        return out, errs
+
+    by_id: dict[str, dict[str, Any]] = {}
+    for i, t in enumerate(targets):
+        prefix = f"targets[{i}]"
+        if not isinstance(t, dict):
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}: expected object")
+            continue
+        tid = t.get("id")
+        if not isinstance(tid, str) or not tid:
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.id: expected non-empty string")
+        ttype = t.get("type")
+        if ttype not in ALLOWED_TYPES:
+            errs.append(
+                f"[REMOTE_CONFIG_ERROR] {prefix}.type: expected one of {sorted(ALLOWED_TYPES)}"
+            )
+        if not isinstance(t.get("enabled"), bool):
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.enabled: expected boolean")
+        if not isinstance(t.get("host"), str) or not t["host"]:
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.host: expected non-empty string")
+        port = t.get("port")
+        if not isinstance(port, int) or not (1 <= port <= 65535):
+            errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.port: expected integer 1..65535")
+        if not isinstance(t.get("workspaceRoot"), str) or not t["workspaceRoot"]:
+            errs.append(
+                f"[REMOTE_CONFIG_ERROR] {prefix}.workspaceRoot: expected non-empty string"
+            )
+        auth = t.get("auth")
+        if auth is not None:
+            if not isinstance(auth, dict):
+                errs.append(f"[REMOTE_CONFIG_ERROR] {prefix}.auth: expected object")
+            else:
+                mode = auth.get("mode")
+                if mode not in AUTH_MODES:
+                    errs.append(
+                        f"[REMOTE_CONFIG_ERROR] {prefix}.auth.mode: expected one of {sorted(AUTH_MODES)}"
+                    )
+                elif mode == "env":
+                    env_keys = (
+                        "tokenEnv",
+                        "passwordEnv",
+                        "privateKeyPathEnv",
+                        "usernameEnv",
+                    )
+                    any_ref = False
+                    for k in env_keys:
+                        if k not in auth:
+                            continue
+                        any_ref = True
+                        err = _validate_env_ref(k, auth[k], f"{prefix}.auth")
+                        if err:
+                            errs.append(f"[REMOTE_CONFIG_ERROR] {err}")
+                    if not any_ref:
+                        errs.append(
+                            f"[REMOTE_CONFIG_ERROR] {prefix}.auth: mode=env requires at least one *Env field"
+                        )
+        if isinstance(tid, str) and tid:
+            by_id[tid] = t
+
+    default = data["defaultTarget"]
+    if default not in by_id:
+        errs.append(
+            f"[REMOTE_CONFIG_ERROR] defaultTarget={default!r} not found in targets[].id"
+        )
+    elif not by_id[default].get("enabled"):
+        errs.append(
+            f"[REMOTE_CONFIG_ERROR] defaultTarget={default!r} must reference an enabled target"
+        )
+
+    if errs:
+        return out, errs
+
+    out.append(f"defaultTarget={data['defaultTarget']}")
+    for t in targets:
+        assert isinstance(t, dict)
+        tid = t["id"]
+        parts = [
+            f"id={tid}",
+            f"type={t['type']}",
+            f"enabled={t['enabled']!s}",
+            f"host={t['host']}",
+            f"port={t['port']}",
+            f"workspaceRoot={t['workspaceRoot']}",
+        ]
+        auth = t.get("auth")
+        if isinstance(auth, dict):
+            parts.append(f"auth.mode={auth.get('mode')}")
+            for k in (
+                "tokenEnv",
+                "passwordEnv",
+                "privateKeyPathEnv",
+                "usernameEnv",
+            ):
+                if k in auth and isinstance(auth[k], str):
+                    parts.append(f"auth.{k}={auth[k]}")
+        out.append("target:" + " ".join(parts))
+
+    return out, []
+
+
+def main(argv: list[str] | None = None) -> int:
+    args, rest = _parse_args(argv or sys.argv[1:])
+    if rest:
+        print(
+            f"[REMOTE_CONFIG_SUMMARY] unknown arguments: {' '.join(rest)}",
+            file=sys.stderr,
+        )
+        return 1
+    if not _truthy_remote_execution(os.environ.get("REMOTE_EXECUTION")):
+        print(
+            "[REMOTE_CONFIG_SUMMARY] REMOTE_EXECUTION!=1: skip validation/summary "
+            "(zero overhead; DEC-0070 / US-0084).",
+            file=sys.stderr,
+        )
+        return 0
+
+    path = _config_path(args.config)
+    if not path.is_file():
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: file missing or unreadable. "
+            "Fix: create config or set REMOTE_EXECUTION=0.",
+            file=sys.stderr,
+        )
+        return 2
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except OSError as e:
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: read failed ({e}). Fix: permissions/path.",
+            file=sys.stderr,
+        )
+        return 2
+    try:
+        data = json.loads(raw)
+    except json.JSONDecodeError as e:
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: invalid JSON ({e}). Fix: syntax.",
+            file=sys.stderr,
+        )
+        return 3
+    if not isinstance(data, dict):
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: expected JSON object at root.",
+            file=sys.stderr,
+        )
+        return 4
+
+    lines, errs = validate_and_summarize(path, data)
+    if errs:
+        for line in errs:
+            print(line, file=sys.stderr)
+        print(
+            f"[REMOTE_CONFIG_ERROR] {path}: contract check failed. "
+            "Fix: align with docs/engineering/runbook.md remote contract (US-0084).",
+            file=sys.stderr,
+        )
+        return 4
+    for line in lines:
+        print(line)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/template/.cursor/commands/auto.md

@@ -9,12 +9,30 @@ description: "its-magic auto: deterministic continuation orchestrator."
 - tech-lead
 
 ## Execution model
-- `/auto` is an orchestrator only. It must not execute phase work directly.
-- For each phase, spawn a fresh subagent context for that phase role.
+- `/auto` is a **spawn-only orchestrator**: it schedules materialization, spawns
+  fresh **phase-role** subagents, and verifies phase boundaries—it **must not**
+  execute lifecycle phase work, perform phase-role duties, or author **phase
+  deliverables** in the orchestrator context.
+- For each phase, **spawn a fresh subagent** for that phase’s canonical role;
+  phase output must arrive only via artifacts and handoff files (no in-turn
+  orchestrator execution of that phase).
 - Phase context transfer happens only through artifacts and handoff files.
 - Scope is process/workflow orchestration only. Do not claim runtime product
   orchestration changes.
 
+## Spawn-boundary integrity (BUG-0006)
+
+- **Forbidden**: treating the orchestrator turn as the executor of a lifecycle
+  phase (for example running **`architecture`**, **`execute`**, **`qa`**, or any
+  other **`phase_id`** in the orchestrator instead of spawning the required
+  subagent).
+- **Fail fast** with **`AUTO_ORCHESTRATOR_PHASE_EXECUTION`**. **Remediation**:
+  stop; spawn a **fresh** subagent for the canonical **`phase_id`** and **`role`**
+  per the phase→role matrix (**DEC-0051**); do not merge phase output into
+  orchestrator turns. **Distinct from** **`PHASE_CONTEXT_ISOLATION_VIOLATION`**
+  (wrong writer / isolation break) and **`RUNTIME_PROOF_*`** / **`PHASE_ROLE_*`**
+  families—do not overload those codes for a missing-spawn violation.
+
 ## Full specification (US-0080 / DEC-0062)
 
 Long prose, expanded mode semantics, and **Steps 1–13** detail live in

package/template/.cursor/commands/execute.md

@@ -152,6 +152,12 @@ parity for listed paths: **`python scripts/check_token_cost_parity.py --repo .`*
      fail fast with `REMOTE_CONNECTIVITY_CONFIG_INVALID`.
    - Never expose secrets in execution outputs; only sanitized endpoint data and
      env-reference names are allowed.
+17b. Remote evidence cues (US-0084):
+   - When `REMOTE_EXECUTION=1`, cite an **environment label** in
+     `handoffs/dev_to_qa.md` (e.g. `WSL`, `ssh:SSH_HOST` as the **env var name**,
+     `dockerOverSsh`) and state **where tests ran** (local vs remote host).
+   - Do not paste private keys, tokens, or resolved secret **values**; use
+     `python scripts/remote_config_summary.py` for a names-only summary when needed.
 18. Runtime QA autopilot execution contract (US-0065 / DEC-0047):
    - Treat runtime verification as mandatory for generated-project scope; static
      checks alone are not sufficient evidence for PASS readiness.

package/template/.cursor/commands/intake.md

@@ -21,6 +21,7 @@ description: "its-magic intake: clarify idea and capture story + acceptance."
 - `docs/product/backlog.md`
 - `docs/product/acceptance.md`
 - `handoffs/po_to_tl.md`
+- `handoffs/resume_brief.md` (required on successful **`/intake bug`** persistence — **DEC-0069** / **BUG-0005**)
 - Optional (when enabled): `docs/engineering/compatibility-report.md`
 - Optional (when enabled): `docs/engineering/component-scope.md`
 
@@ -41,7 +42,7 @@ description: "its-magic intake: clarify idea and capture story + acceptance."
 - For artifact mutations, enforce deterministic single-writer scope:
   - establish writer identity (`writer_id`) and run identity (`intake_run_id`),
   - bind writes to target artifacts (`backlog`, `acceptance`, `vision`,
-    `po_to_tl`) for this run.
+    `po_to_tl`, and when persisting bugs: `resume_brief` per **DEC-0069**) for this run.
 - Drift guard semantics:
   - self-write changes from the same `(writer_id, intake_run_id)` are valid and
     must not trigger concurrent-writer blockers,
@@ -73,6 +74,7 @@ description: "its-magic intake: clarify idea and capture story + acceptance."
   - `INTAKE_REQUIRED_TOPIC_MISSING`
   - `INTAKE_REQUIRED_PACK_INCOMPLETE`
   - `INTAKE_ASSUMPTION_CONFIRMATION_REQUIRED`
+  - `INTAKE_ANSWER_REF_NOT_TOPIC_DISTINCT` (**BUG-0007** / **R-0066** — see **Truthfulness** below)
   - `INTAKE_PERSISTENCE_BLOCKED`
 - Remediation guidance surface (mandatory on block):
   - list `missing_topics`,
@@ -127,6 +129,24 @@ and assumption binding. **Do not** mutate `docs/product/backlog.md` or
   (**AC-5**, **AC-6**).
 - **Grandfathering**: legacy intake rows remain valid for read/display; the **next** intake-driven
   mutation must supply full **US-0078** evidence or the write is blocked (**DEC-0060** §5).
+- Truthfulness / anti-echo (**BUG-0007** / **R-0066**): `INTAKE_ANSWER_REF_NOT_TOPIC_DISTINCT` when
+  the same normalized `quoted_user_text` is reused across distinct required `topic_key` rows under
+  `satisfied_by=answer_ref` without an exempt path (`evidence_source=equivalent_evidence_ref` +
+  `equivalent_evidence_ref`, `delegation_ref` per **DEC-0067** / **US-0083**, or
+  `assumption_confirmation_ref` on the row). Canonical **`ie:`** integrity (**DEC-0060**) does not
+  prove a topic was actually elicited.
+
+## Truthfulness: `asked_topics` and `topic_coverage` (BUG-0007 / US-0083 / DEC-0060 / DEC-0067)
+
+- **`asked_topics`** may list a required `topic_key` only when a **user-visible question** was posed
+  **or** a **DEC-0060**-allowed alternate applies: **`delegation_ref`** (**DEC-0067**, **US-0083**),
+  **`evidence_source=equivalent_evidence_ref`** with **`equivalent_evidence_ref`**, or
+  **`assumption_confirmation_ref`** (row-level and/or bundle-level assumption binding per the gate
+  contract above).
+- **Forbidden**: fabricating **`topic_coverage`** by echoing **one** user or bug-report blob into
+  **`quoted_user_text`** on **every** required key as **`answer_ref`** solely to satisfy structure.
+  The validator rejects that pattern under **`INTAKE_ANSWER_REF_NOT_TOPIC_DISTINCT`** (see
+  **`docs/engineering/architecture.md`** **`# BUG-0007`**).
 
 ## Bug issue routing (US-0079 / DEC-0061)
 
@@ -138,6 +158,12 @@ and assumption binding. **Do not** mutate `docs/product/backlog.md` or
   - Append **`### BUG-#### — Title`** under **`## Bug issues (canonical)`** with **Status**, **`environment`**, **`steps_to_reproduce`**, **`expected`**, **`actual`**, **`evidence_refs`**.
   - Add matching **`- [ ]` / `- [x]`** row under **`## Bug acceptance (canonical)`**, sorted by id.
   - Run **`python scripts/bug_issue_validate.py --backlog docs/product/backlog.md --check-acceptance`** before completing the handoff.
+  - **Resume brief refresh (DEC-0069 / BUG-0005)**: immediately after successful bug persistence and backlog/acceptance validation **PASS**, run the atomic writer (temp file + replace — idempotent latest-pointer upsert):
+    - `python scripts/intake_bug_resume_brief_refresh.py --bug-id BUG-#### --backlog docs/product/backlog.md --resume-brief handoffs/resume_brief.md --intake-boundary-utc <RFC3339Z>`  
+    - Optional: `--orchestrator-run-id`, `--intake-evidence handoffs/intake_evidence/....json`, `--sprint-id` when known.  
+    - Exit non-zero → **`INTAKE_RESUME_BRIEF_*`** family — do not claim intake complete; fix backlog/brief contradiction or supply valid boundary UTC.  
+    - Post-condition: **`intended_resume_phase` / `resolved_start_phase` = `discovery`**, **`resolution_source=resume_brief`**, **`bug_id`** matches persisted row, so **`/auto`** without **`start-from`** does not false-trigger **`RESUME_BRIEF_STALE`** for a stale pre-intake **`intake`** target.  
+    - Optional audit: `python scripts/intake_bug_resume_brief_refresh.py --bug-id BUG-#### --backlog docs/product/backlog.md --resume-brief handoffs/resume_brief.md --validate-file` (no write).
 
 ## Steps
 1. Determine intake mode from `.cursor/scratchpad.md`:
@@ -283,7 +309,8 @@ and assumption binding. **Do not** mutate `docs/product/backlog.md` or
 - Intake mutations must also comply with
   `docs/engineering/artifact-ownership-policy.md`.
 - Intake may mutate only intake-owned scopes (`vision`, `backlog`, `acceptance`,
-  `po_to_tl`) for target story context.
+  `po_to_tl`, and **`handoffs/resume_brief.md`** only via the **DEC-0069** bug-intake
+  completion path / `intake_bug_resume_brief_refresh.py`) for target story context.
 - Any attempted delete/rewrite of non-intake-owned sections fails closed with
   `PHASE_OWNERSHIP_VIOLATION`.
 - If an override-authorized path is configured for an artifact but required

package/template/.cursor/commands/qa.md

@@ -114,6 +114,11 @@ verify no unresolved blockers.
    - If remote connectivity config is incomplete for required remote checks,
      mark blocking with deterministic reason code
      `REMOTE_CONNECTIVITY_CONFIG_INVALID`.
+   - **US-0084**: when `REMOTE_EXECUTION=1`, expect **`handoffs/dev_to_qa.md`**
+     to carry an **environment label** (`WSL`, `ssh:<hostEnv>`, `dockerOverSsh`, …)
+     and **test locus** (local vs remote); reject evidence that pastes secret
+     values (keys/passwords) — **names-only** refs align with
+     `python scripts/remote_config_summary.py` output.
 13. Runtime QA autopilot contract (US-0065 / DEC-0047):
    - Runtime truth path is mandatory for generated-project QA:
      `startup -> readiness/connectivity -> log scan -> bounded retry -> verdict`.

package/template/.cursor/scratchpad.md

@@ -101,9 +101,13 @@ SPRINT_BULK_MAX_STORIES=5
 SPRINT_BULK_MAX_SPRINTS=3
 SPRINT_BULK_SELECTION=priority_then_backlog_order
 #
-# Remote execution
-# - REMOTE_EXECUTION: 0|1
-# - REMOTE_CONFIG: path to remote config
+# Remote execution (US-0084 / US-0064)
+# - REMOTE_EXECUTION: 0|1 — 0 skips remote.json validation (zero overhead; DEC-0070).
+# - REMOTE_CONFIG: path to dev/Cursor remote JSON (default .cursor/remote.json).
+#   Release/QA SSH/Docker connectivity fields live in docs/engineering/release-targets.json
+#   (ssh-server, dockerOverSsh); map WSL vs SSH vs Docker-over-SSH in
+#   docs/engineering/runtime-connectivity.md and docs/engineering/us-0084-remote-e2e.md.
+# - Summary helper (names-only stdout): python scripts/remote_config_summary.py
 REMOTE_EXECUTION=0
 REMOTE_CONFIG=.cursor/remote.json
 #

package/template/docs/engineering/artifact-ownership-policy.md

@@ -23,7 +23,7 @@ artifacts. Ordering policy and ownership policy are complementary:
 | `handoffs/release_queue.md` | target sprint row only | `release` | none |
 | `handoffs/release_notes.md` | latest pointer section | `release`, `refresh-context` | none |
 | `docs/engineering/state.md` | append-bottom checkpoints only | all delivery phases | none |
-| `handoffs/resume_brief.md` | current status/next-actions sections | `pause`, `resume`, `refresh-context`, `release` | none |
+| `handoffs/resume_brief.md` | current status/next-actions sections; latest-pointer upsert on **`/intake bug`** completion (**DEC-0069**) | `intake` (bug persistence path only), `pause`, `resume`, `refresh-context`, `release` | none |
 
 ## Non-destructive mutation rules
 

package/template/docs/engineering/context/installer-owned-paths.manifest

@@ -28,6 +28,8 @@ scripts/intake_evidence_lib.py
 scripts/intake_bug_routing_guard.py
 scripts/check_intake_template_parity.py
 scripts/materialize_codebase_map.py
+scripts/remote_config_summary.py
+scripts/guard_installer_publish.py
 scripts/enforce-triad-hot-surface.py
 .github/workflows
 README.md
@@ -52,6 +54,8 @@ scripts/intake_evidence_lib.py
 scripts/intake_bug_routing_guard.py
 scripts/check_intake_template_parity.py
 scripts/materialize_codebase_map.py
+scripts/remote_config_summary.py
+scripts/guard_installer_publish.py
 scripts/enforce-triad-hot-surface.py
 .github/workflows/ci.yml
 .github/workflows/deploy.yml
@@ -69,4 +73,6 @@ scripts/intake_evidence_lib.py
 scripts/intake_bug_routing_guard.py
 scripts/check_intake_template_parity.py
 scripts/materialize_codebase_map.py
+scripts/remote_config_summary.py
+scripts/guard_installer_publish.py
 scripts/enforce-triad-hot-surface.py