its-magic 0.1.2-38 → 0.1.2-40

package/template/docs/engineering/runbook.md

@@ -313,6 +313,7 @@ binding before backlog/acceptance writes.
 - Regression: `tests/intake_evidence_fixtures_test.py` (R-0055 **AC-8** matrix tiers A/B),
   invoked from `tests/run-tests.ps1` / `tests/run-tests.sh` §26k.
 - **Packaged installs (BUG-0001 / DEC-0063)**: `intake_evidence_validate.py`, `intake_evidence_lib.py`, and `intake_bug_routing_guard.py` are mirrored under `template/scripts/` and listed in `docs/engineering/context/installer-owned-paths.manifest` so fresh install and `upgrade` copy them to the consumer’s `scripts/`. Drift guard: `python scripts/check_intake_template_parity.py --repo .` (also §26N in `tests/run-tests.*`). **Release (S0060)**: operator notes `handoffs/releases/S0060-release-notes.md` (gate summary + verify steps).
+- **US-0084**: `remote_config_summary.py` and `guard_installer_publish.py` use the same **`template/scripts/`** mirror + manifest rows; npm **`package.json` `files`** also lists the active copies for publish.
 - **Installer completeness gate (BUG-0003 / DEC-0066)**: post-install invariant checks every path in `[required_install_script_paths]` from `docs/engineering/context/installer-owned-paths.manifest`. Missing paths fail closed with `INSTALL_COMPLETENESS_FAILED` and `INSTALL_REQUIRED_SCRIPT_MISSING:<path>`. Remediation: update manifest parity (active + `template/`), ensure required script exists under `template/scripts/`, keep install/clean ownership paired, then rerun `its-magic --mode missing|upgrade` (or `python installer.py --validate-install-completeness --target <repo>` for direct diagnostics).
 - **Guided** and **low-touch** (`INTAKE_GUIDED_MODE=0`) share the **same** pre-persistence
   validation pipeline; mandatory pack evidence is never skipped.
@@ -816,6 +817,36 @@ Operator troubleshooting:
   - Replace with env-var reference fields (`tokenEnv`, `passwordEnv`,
     `privateKeyPathEnv`, ...).
 
+### Published npm `installer.sh` / POSIX dash (US-0084)
+
+- **Symptom**: `set: Illegal option -` on an early line when running `its-magic` or
+  `sh installer.sh` on Debian/Ubuntu (**`/bin/sh`** → **dash**).
+- **Common causes**: bash-only `set` options (`pipefail`, `-o errexit`, `-u` bundles)
+  on the **unconditional** startup path, or **CRLF** line endings in the file that
+  ships from npm.
+- **`sh` vs `bash`**: the Unix CLI path uses **`sh` + `installer.sh`** (**BUG-0004** /
+  **DEC-0068**). Do not assume bash for the first lines of **`installer.sh`**.
+- **Remediation**:
+  - Upgrade to an **its-magic** build that includes **US-0084** (LF + POSIX guards).
+  - Normalize to **LF** only (e.g. `dos2unix installer.sh`, or fix checkout —
+    root **`.gitattributes`** uses `*.sh text eol=lf`).
+  - Reinstall from npm after verifying maintainer gates:
+    `python scripts/guard_installer_publish.py` (also **`npm run guard:installer`**
+    / **`prepublishOnly`**).
+- **Normative**: **`docs/engineering/architecture.md`** **`# US-0084`**.
+
+### Automated checks (US-0084)
+
+- `python tests/installer_shell_bug0004_test.py` — CR/LF rejection, forbidden
+  `set` tokens, optional **`dash -n`** when **`dash`** is on **`PATH`**.
+- `python scripts/guard_installer_publish.py` — same checks for publish/CI
+  (**`prepublishOnly`**).
+- `python scripts/remote_config_summary.py` — with **`REMOTE_EXECUTION=1`**,
+  read-only summary of **`REMOTE_CONFIG`** (default **`.cursor/remote.json`**);
+  stdout is **names-only** (no secret values). **`DEC-0070`**: when
+  **`REMOTE_EXECUTION=0`**, the helper exits **0** and skips validation
+  (stderr skip reason).
+
 ## Runtime QA autopilot contract (US-0065 / DEC-0047)
 
 Generated-project validation requires runtime proof, not static checks alone.

package/template/docs/engineering/runtime-connectivity.md

@@ -32,3 +32,23 @@ For each enabled target include:
 - Do not write inline credentials/tokens/private keys.
 - Only env reference names are permitted in connectivity artifacts.
 - Redact auth details in handoffs and release outputs.
+
+## Dev/QA remote profiles vs `release-targets.json` (US-0084)
+
+Use this table to map **where you run tests** to the **US-0064** release/QA
+connectivity model (**no parallel schema**). Cursor/dev **`REMOTE_CONFIG`** is
+documented in the runbook; it complements, not replaces, **`release-targets.json`**.
+
+| Operator path | Maps in `release-targets.json` | Scratchpad / dev config |
+|---------------|----------------------------------|-------------------------|
+| **WSL** | Local Linux on the same machine — not a separate target row by default. | Usually **`REMOTE_EXECUTION=0`**. Cite **environment label** **`WSL`** in QA evidence. |
+| **Bare SSH Linux** | **`ssh-server`**: `hostEnv`, `userEnv`, `authEnv`, `remoteCommand`, `runtime`, ingress. | **`REMOTE_EXECUTION=1`**, **`REMOTE_CONFIG=.cursor/remote.json`** (see **`.cursor/scratchpad.md`**). |
+| **Docker-over-SSH** | **`ssh-server.dockerOverSsh`**: `dockerHostEnv`, `dockerContextEnv`, `composeFile`, `service`. | Same scratchpad keys; operator sets **`DOCKER_HOST`** / context using **env names** only in docs. |
+
+### `docker_over_ssh` (operator summary)
+
+When **`dockerOverSsh.enabled`** is true on **`ssh-server`**, connectivity flows
+through SSH to a host where Docker commands run; **`dockerHostEnv`** and
+**`dockerContextEnv`** name the operator env vars (values never pasted into
+artifacts). **`composeFile`** and **`service`** identify the stack slice. Full
+fields remain in **`docs/engineering/release-targets.json`** and **DEC-0044**.

package/template/docs/engineering/us-0084-remote-e2e.md

@@ -0,0 +1,39 @@
+# US-0084 — Minimal remote sanity path (Windows → WSL or SSH Linux)
+
+Sprint **S0069** / story **US-0084**. This is a short operator walkthrough; normative
+contracts live in **`docs/engineering/architecture.md`** **`# US-0084`**,
+**`docs/engineering/release-targets.json`**, and **`docs/engineering/runtime-connectivity.md`**
+(**US-0064**).
+
+## Path A — WSL (local Linux on the Windows machine)
+
+1. Install/launch **WSL** and open a Linux shell in the repo (or clone the repo inside WSL).
+2. Ensure **Node.js** and **Python 3** are available on **PATH** (same as host runbook).
+3. Run **`npm pack`** / local **`its-magic`** or **`sh installer.sh --target <repo> --mode missing --create`** from the package root.
+4. Run **`python tests/installer_shell_bug0004_test.py`** and your stack’s **`TEST_COMMAND`** (from merged runbook / scratchpad).
+5. Evidence: set **environment label** **`WSL`** in QA handoffs; **`REMOTE_EXECUTION=0`** is typical (no **`.cursor/remote.json`** validation required).
+
+## Path B — SSH to a Linux host
+
+1. SSH into the Linux machine; clone or sync the repo there.
+2. Run the same **`sh`/`dash`** installer and **`python`** tests as on native Linux.
+3. For **release/QA connectivity** semantics, align with **`ssh-server`** in
+   **`docs/engineering/release-targets.json`** (`hostEnv`, `userEnv`, `authEnv`, …).
+4. For **Cursor/dev remote** validation, set **`REMOTE_EXECUTION=1`** and
+   **`REMOTE_CONFIG=.cursor/remote.json`** on the merged scratchpad; run
+   **`python scripts/remote_config_summary.py`** — stdout must list **names only**
+   (no keys/passwords).
+5. Evidence: cite **`ssh:<hostEnv>`** (the **env var name**, not the host value) plus
+   **environment label**; never paste private key material.
+
+## Path C — Docker-over-SSH
+
+1. Follow **Path B** on the SSH host; enable **`dockerOverSsh`** patterns per
+   **`runtime-connectivity.md`** (**`dockerHostEnv`**, **`dockerContextEnv`**, **`composeFile`**, **`service`**).
+2. Set operator **`DOCKER_HOST`** / context per your platform; document **env names**
+   only in handoffs.
+
+## Related
+
+- **`tests/run-tests.sh`** / **`tests/run-tests.ps1`** — **H1–H5** (**US-0084** / AC-10).
+- **`python scripts/guard_installer_publish.py`** — publish-time LF + POSIX guard.

package/template/scripts/check_intake_template_parity.py

@@ -12,6 +12,7 @@ INTAKE_TEMPLATE_PAIRS: tuple[tuple[str, str], ...] = (
     ("scripts/intake_evidence_validate.py", "template/scripts/intake_evidence_validate.py"),
     ("scripts/intake_evidence_lib.py", "template/scripts/intake_evidence_lib.py"),
     ("scripts/intake_bug_routing_guard.py", "template/scripts/intake_bug_routing_guard.py"),
+    ("scripts/intake_bug_resume_brief_refresh.py", "template/scripts/intake_bug_resume_brief_refresh.py"),
     ("scripts/check_intake_template_parity.py", "template/scripts/check_intake_template_parity.py"),
 )
 

package/template/scripts/guard_installer_publish.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Prepublish / CI guard: installer.sh LF + POSIX-safe startup tokens (US-0084 / AC-2)."""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+INSTALLER_SH = ROOT / "installer.sh"
+
+FORBIDDEN_TOKENS = (
+    "set -euo",
+    "set -o pipefail",
+    "set -eu -o pipefail",
+    "set -o errexit",
+    "set -o nounset",
+)
+
+
+def main() -> int:
+    if not INSTALLER_SH.is_file():
+        print("guard_installer_publish: installer.sh missing", file=sys.stderr)
+        return 1
+    data = INSTALLER_SH.read_bytes()
+    if b"\r" in data:
+        print(
+            "guard_installer_publish: CR/LF (\\r) bytes found in installer.sh — "
+            "use LF only; see docs/engineering/runbook.md (US-0084).",
+            file=sys.stderr,
+        )
+        return 1
+    text = data.decode("utf-8", errors="replace")
+    for token in FORBIDDEN_TOKENS:
+        if token in text:
+            print(
+                f"guard_installer_publish: forbidden startup token {token!r} in installer.sh",
+                file=sys.stderr,
+            )
+            return 1
+    dash = shutil.which("dash")
+    if dash:
+        r = subprocess.run(
+            [dash, "-n", str(INSTALLER_SH)],
+            cwd=ROOT,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        if r.returncode != 0:
+            print(
+                "guard_installer_publish: dash -n installer.sh failed:\n"
+                + (r.stderr or r.stdout or ""),
+                file=sys.stderr,
+            )
+            return 1
+    else:
+        print(
+            "guard_installer_publish: dash not on PATH; skipping dash -n "
+            "(Python CRLF + token checks still enforced).",
+            file=sys.stderr,
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/template/scripts/intake_bug_resume_brief_refresh.py

@@ -0,0 +1,303 @@
+#!/usr/bin/env python3
+"""
+Atomic refresh of handoffs/resume_brief.md after successful /intake bug persistence (DEC-0069 / BUG-0005).
+
+Idempotent: same inputs yield the same latest-pointer section. Uses temp file + os.replace for atomicity.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import sys
+import tempfile
+from pathlib import Path
+
+import bug_issue_lib as bi
+import bug_issue_validate as biv
+
+
+def bug_status(backlog_text: str, bug_id: str) -> str | None:
+    section = bi.extract_bug_section(backlog_text)
+    if not section:
+        return None
+    for issue in bi.parse_bug_issues(section):
+        if issue.bug_id == bug_id:
+            return issue.status
+    return None
+
+
+def upsert_latest_orchestration_pointer(full_text: str, latest_block: str) -> str:
+    """Replace ## Latest orchestration pointer section or insert after # Resume Brief."""
+    latest_block = latest_block.rstrip("\n") + "\n"
+    lines = full_text.splitlines(keepends=True)
+    if not lines:
+        return "# Resume Brief\n\n" + latest_block
+
+    out: list[str] = []
+    i = 0
+    replaced = False
+    while i < len(lines):
+        line = lines[i]
+        if line.startswith("## Latest orchestration pointer"):
+            out.append(latest_block)
+            i += 1
+            while i < len(lines) and not lines[i].startswith("## "):
+                i += 1
+            replaced = True
+            continue
+        out.append(line)
+        i += 1
+
+    if replaced:
+        return "".join(out)
+
+    text = "".join(lines)
+    stripped = text.lstrip("\n")
+    if stripped.startswith("# Resume Brief"):
+        return text.rstrip("\n") + "\n\n" + latest_block
+    return "# Resume Brief\n\n" + latest_block + text.lstrip("\n")
+
+
+def build_latest_pointer_markdown(
+    *,
+    bug_id: str,
+    intake_boundary_utc: str,
+    orchestrator_run_id: str | None,
+    intake_evidence_ref: str | None,
+    sprint_id: str | None,
+) -> str:
+    orch = orchestrator_run_id if orchestrator_run_id else "(unknown)"
+    ev = intake_evidence_ref if intake_evidence_ref else "(none)"
+    spr = sprint_id if sprint_id else "(none)"
+    return f"""## Latest orchestration pointer — post-bug-intake (DEC-0069)
+
+- **Boundary**: successful **`/intake bug`** persistence (**`US-0045`**) — **`intake_boundary_utc={intake_boundary_utc}`**
+- **`bug_id`**: **`{bug_id}`** — must remain **`OPEN`** in **`docs/product/backlog.md`** (authority); this refresh is rejected if backlog shows **DONE**
+- **Intake evidence ref**: `{ev}`
+- **`orchestrator_run_id`**: `{orch}` (boundary metadata when known; optional at intake)
+- **Contract**: default **`/auto`** continuation targets **`discovery`** for this OPEN bug (not a stale pre-intake **`intake`** resume target)
+
+## Current status
+
+- **Active bug**: **`{bug_id}`** — **OPEN** per **`docs/product/backlog.md`** at refresh time
+
+## Intended resume phase
+
+`discovery`
+
+## Resume target
+
+- bug_id={bug_id}
+- story_id=(none)
+- sprint_id={spr}
+- boundary=post-bug-intake (**DEC-0069**)
+
+## Latest auto breadcrumb seed
+
+- requested_start_from=(none)
+- resolved_start_phase=discovery
+- resolution_source=resume_brief
+- resolution_status=resolved
+- stop_reason=intake_complete
+- stop_phase=intake
+- next_scheduled_phase=discovery
+- bug_id={bug_id}
+- story_id=(none)
+- sprint_id={spr}
+- orchestrator_run_id={orch}
+- intake_boundary_utc={intake_boundary_utc}
+"""
+
+
+def extract_brief_bug_id(brief_text: str) -> str | None:
+    for line in brief_text.splitlines():
+        s = line.strip()
+        m = re.match(r"^-\s*bug_id=(BUG-\d{4})\s*$", s)
+        if m:
+            return m.group(1)
+    return None
+
+
+def validate_brief_open_bug_alignment(brief_text: str, backlog_text: str) -> list[str]:
+    """Writer-side guard: brief bug_id must match an OPEN row in backlog (US-0045)."""
+    errors: list[str] = []
+    bid = extract_brief_bug_id(brief_text)
+    if not bid:
+        errors.append("INTAKE_RESUME_BRIEF_PARSE_BUG_ID_MISSING")
+        return errors
+
+    st = bug_status(backlog_text, bid)
+    if st is None:
+        errors.append(f"INTAKE_RESUME_BRIEF_BACKLOG_BUG_UNKNOWN:{bid}")
+        return errors
+    if st != "OPEN":
+        errors.append(f"INTAKE_RESUME_BRIEF_BACKLOG_CONTRADICTION:{bid}:status={st}")
+    if "`discovery`" not in brief_text and "resolved_start_phase=discovery" not in brief_text:
+        errors.append("INTAKE_RESUME_BRIEF_DISCOVERY_PHASE_MISSING")
+    return errors
+
+
+def atomic_write(path: Path, content: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(
+        dir=path.parent,
+        prefix=".resume_brief_tmp_",
+        suffix=".md",
+    )
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8", newline="\n") as f:
+            f.write(content)
+        os.replace(tmp, path)
+    except Exception:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
+def _fail(code: str, detail: str = "") -> int:
+    msg = code
+    if detail:
+        msg += f": {detail}"
+    print(msg, file=sys.stderr)
+    return 1
+
+
+def self_test() -> int:
+    block = build_latest_pointer_markdown(
+        bug_id="BUG-0999",
+        intake_boundary_utc="2026-04-03T12:00:00Z",
+        orchestrator_run_id="auto-test",
+        intake_evidence_ref="handoffs/intake_evidence/x.json",
+        sprint_id="S0001",
+    )
+    old = "# Resume Brief\n\n## Latest orchestration pointer — old\n\n- x\n\n## Checkpoint\n\nkeep\n"
+    new = upsert_latest_orchestration_pointer(old, block)
+    if "keep" not in new:
+        return _fail("SELFTEST_FAILED", "lost tail section")
+    if "BUG-0999" not in new or "resolved_start_phase=discovery" not in new:
+        return _fail("SELFTEST_FAILED", "missing expected content")
+    if "## Latest orchestration pointer — old" in new:
+        return _fail("SELFTEST_FAILED", "old latest not replaced")
+    good_backlog = """## Bug issues (canonical)
+
+### BUG-0999 — T
+- Status: OPEN
+- environment: e
+- steps_to_reproduce: s
+- expected: x
+- actual: y
+- evidence_refs: z
+"""
+    errs = validate_brief_open_bug_alignment(new, good_backlog)
+    if errs:
+        return _fail("SELFTEST_FAILED", str(errs))
+    bad_backlog = good_backlog.replace("OPEN", "DONE")
+    errs2 = validate_brief_open_bug_alignment(new, bad_backlog)
+    if not any("CONTRADICTION" in e for e in errs2):
+        return _fail("SELFTEST_FAILED", "expected contradiction on DONE")
+    print("[INTAKE_BUG_RESUME_BRIEF_REFRESH_OK]")
+    return 0
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--bug-id", default="", help="Persisted BUG-#### id (required unless --self-test)")
+    ap.add_argument("--backlog", default="docs/product/backlog.md")
+    ap.add_argument("--resume-brief", default="handoffs/resume_brief.md")
+    ap.add_argument(
+        "--intake-boundary-utc",
+        default="",
+        help="RFC3339 UTC timestamp for intake completion boundary (required unless --validate-file)",
+    )
+    ap.add_argument("--orchestrator-run-id", default="", help="Optional orchestrator run id")
+    ap.add_argument("--intake-evidence", default="", help="Optional intake evidence path or ref")
+    ap.add_argument("--sprint-id", default="", help="Optional sprint id")
+    ap.add_argument("--dry-run", action="store_true", help="Print body only; do not write")
+    ap.add_argument("--validate-file", action="store_true", help="Validate existing brief vs backlog; no write")
+    ap.add_argument("--self-test", action="store_true")
+    args = ap.parse_args()
+    if args.self_test:
+        return self_test()
+
+    if not args.bug_id:
+        return _fail("INTAKE_RESUME_BRIEF_INVALID_BUG_ID", "missing --bug-id")
+    if not re.fullmatch(r"BUG-\d{4}", args.bug_id):
+        return _fail("INTAKE_RESUME_BRIEF_INVALID_BUG_ID", args.bug_id)
+
+    try:
+        backlog_text = Path(args.backlog).read_text(encoding="utf-8")
+    except OSError as e:
+        return _fail("INTAKE_RESUME_BRIEF_IO_ERROR", str(e))
+
+    berr, _ = biv.validate_backlog(backlog_text)
+    if berr:
+        for e in berr:
+            print(e, file=sys.stderr)
+        return _fail("INTAKE_RESUME_BRIEF_BACKLOG_INVALID", berr[0])
+
+    resume_path = Path(args.resume_brief)
+    if args.validate_file:
+        if not resume_path.is_file():
+            return _fail("INTAKE_RESUME_BRIEF_MISSING", str(resume_path))
+        brief_text = resume_path.read_text(encoding="utf-8")
+        bid_file = extract_brief_bug_id(brief_text)
+        if bid_file != args.bug_id:
+            return _fail(
+                "INTAKE_RESUME_BRIEF_BUG_ID_MISMATCH",
+                f"cli={args.bug_id} brief={bid_file}",
+            )
+        verr = validate_brief_open_bug_alignment(brief_text, backlog_text)
+        if verr:
+            for e in verr:
+                print(e, file=sys.stderr)
+            return 1
+        print("[INTAKE_RESUME_BRIEF_VALIDATE_OK]")
+        return 0
+
+    if not args.intake_boundary_utc.strip():
+        return _fail("INTAKE_RESUME_BRIEF_BOUNDARY_UTC_REQUIRED", "supply --intake-boundary-utc")
+
+    st = bug_status(backlog_text, args.bug_id)
+    if st is None:
+        return _fail("INTAKE_RESUME_BRIEF_BUG_NOT_FOUND", args.bug_id)
+    if st != "OPEN":
+        return _fail(
+            "INTAKE_RESUME_BRIEF_BACKLOG_CONTRADICTION",
+            f"{args.bug_id} must be OPEN for discovery default; got {st}",
+        )
+
+    block = build_latest_pointer_markdown(
+        bug_id=args.bug_id,
+        intake_boundary_utc=args.intake_boundary_utc,
+        orchestrator_run_id=args.orchestrator_run_id or None,
+        intake_evidence_ref=args.intake_evidence or None,
+        sprint_id=args.sprint_id or None,
+    )
+
+    prior = resume_path.read_text(encoding="utf-8") if resume_path.is_file() else ""
+    merged = upsert_latest_orchestration_pointer(prior, block)
+    verr = validate_brief_open_bug_alignment(merged, backlog_text)
+    if verr:
+        for e in verr:
+            print(e, file=sys.stderr)
+        return 1
+
+    if args.dry_run:
+        print(merged)
+        return 0
+
+    try:
+        atomic_write(resume_path, merged)
+    except OSError as e:
+        return _fail("INTAKE_RESUME_BRIEF_WRITE_FAILED", str(e))
+
+    print("[INTAKE_BUG_RESUME_BRIEF_REFRESH_OK]")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/template/scripts/intake_evidence_lib.py

@@ -1,6 +1,6 @@
 """
 Deterministic intake evidence validation
-(US-0078 / US-0083 / DEC-0060 / DEC-0067 / R-0055).
+(US-0078 / US-0083 / DEC-0060 / DEC-0067 / R-0055 / BUG-0007 / R-0066).
 
 Consumes a logical intake_evidence bundle (dict). PO workflows MUST run this
 gate before mutating backlog/acceptance; failures are fail-closed.
@@ -202,6 +202,77 @@ def _row_uses_equivalent_evidence(row: dict[str, Any]) -> bool:
     return bool(str(row.get("equivalent_evidence_ref") or "").strip())
 
 
+def _norm_answer_ref_quoted_user_text(value: Any) -> str:
+    """Normalize quoted_user_text for BUG-0007 duplicate detection (DEC-0060 strip parity)."""
+    if value is None:
+        return ""
+    return str(value).strip()
+
+
+def _row_exempt_from_answer_ref_topic_distinctness(row: dict[str, Any]) -> bool:
+    """BUG-0007: alternate satisfaction paths do not participate in answer_ref blob reuse checks."""
+    return _row_uses_equivalent_evidence(row)
+
+
+def _validate_answer_ref_topic_distinctness(
+    bundle: dict[str, Any],
+    required: list[str],
+    by_key: dict[str, dict[str, Any]],
+    res: ValidationResult,
+) -> None:
+    """
+    BUG-0007 / R-0066: distinct required topic_key rows must not reuse the same
+    quoted_user_text under satisfied_by=answer_ref (normalized), except exempt rows.
+    """
+    norm_to_topics: dict[str, list[str]] = {}
+    for k in required:
+        row = by_key.get(k)
+        if not row:
+            continue
+        sat = (row.get("satisfied_by") or "").strip()
+        if sat != "answer_ref":
+            continue
+        if _row_exempt_from_answer_ref_topic_distinctness(row):
+            continue
+        irid = _row_run_id(bundle, row)
+        tit = _row_turn(row)
+        if irid is None or tit is None:
+            continue
+        qraw = row.get("quoted_user_text")
+        qtxt = "" if qraw is None else str(qraw)
+        ref = (row.get("ref") or "").strip()
+        if not ref or not verify_ie_ref(
+            ref,
+            intake_run_id=irid,
+            turn_index=int(tit),
+            topic_key=k,
+            satisfied_by=sat,
+            quoted_user_text=qtxt,
+        ):
+            continue
+        norm = _norm_answer_ref_quoted_user_text(qraw)
+        norm_to_topics.setdefault(norm, []).append(k)
+
+    dup_groups: list[str] = []
+    for norm, topics in norm_to_topics.items():
+        uniq = sorted(set(topics))
+        if len(uniq) < 2:
+            continue
+        dup_groups.append("text=" + repr(norm[:120]) + " topics=" + ",".join(uniq))
+
+    if dup_groups:
+        res.ok = False
+        res.add_code("INTAKE_ANSWER_REF_NOT_TOPIC_DISTINCT")
+        res.diagnostics.append(
+            "Remediation: distinct required topics must not reuse the same quoted_user_text "
+            "under satisfied_by=answer_ref (BUG-0007 / R-0066). Duplicates: "
+            + "; ".join(dup_groups)
+            + ". Use per-topic answers, or an allowed alternate path "
+            "(evidence_source=equivalent_evidence_ref + equivalent_evidence_ref, "
+            "delegation_ref per DEC-0067 / US-0083, or assumption_confirmation_ref on the row)."
+        )
+
+
 def _candidate_story_ids(bundle: dict[str, Any]) -> set[str]:
     out: set[str] = set()
 
@@ -527,6 +598,8 @@ def validate_intake_evidence(
                 res.missing_topics.append(k)
     res.missing_topics = sorted(set(res.missing_topics))
 
+    _validate_answer_ref_topic_distinctness(bundle, required, by_key, res)
+
     # US-0081 / DEC-0064: first/new/broad intake requires complete-plan coverage contract.
     if pack == "first-intake-pack":
         _validate_plan_coverage_contract(bundle, res)
@@ -668,6 +741,32 @@ def self_test() -> None:
     assert d0.ok and d1.ok
     assert d0.primary_codes == d1.primary_codes
 
+    # BUG-0007: same quoted_user_text across multiple answer_ref required topics fails
+    dup_txt = "synthetic blob echoed for every topic"
+    dup_rows = []
+    for i, key in enumerate(small):
+        dup_rows.append(
+            {
+                "topic_key": key,
+                "satisfied_by": "answer_ref",
+                "quoted_user_text": dup_txt,
+                "intake_run_id": rid,
+                "turn_index": 300 + i,
+                "ref": build_ie_ref(rid, 300 + i, key, "answer_ref", dup_txt),
+            }
+        )
+    dup_bundle = {
+        "selected_pack": "small-intake-pack",
+        "intake_run_id": rid,
+        "asked_topics": list(small),
+        "missing_topics": [],
+        "assumptions_confirmed": "(none)",
+        "topic_coverage": dup_rows,
+    }
+    dup_res = validate_intake_evidence(dup_bundle)
+    assert not dup_res.ok
+    assert "INTAKE_ANSWER_REF_NOT_TOPIC_DISTINCT" in dup_res.primary_codes
+
     # First-intake full-plan coverage contract (US-0081 / DEC-0064)
     first = PACK_REQUIRED_KEYS["first-intake-pack"]
     first_rows = []