jules-orchestrator-kit 0.70.0 → 0.71.0

package/CHANGELOG.md

@@ -5,6 +5,40 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.71.0] - 2026-09-05
+*A blanket is not a check, and silence is not a suite.*
+
+A fourth cold-start trial, against v0.70.0 on four repositories nobody here chose. Seven findings, and this is the first trial where every one of them held: no quoted output was fabricated, and all four repository SHAs matched. Two of them prove entries in this file wrong, which is recorded below rather than quietly amended.
+
+The two worst were the two halves of the same sentence — a gate that approves against nothing, and a gate that rejects what is fine.
+
+### Fixed
+- **A Command That Printed Nothing Was An Oracle (`src/ops/test-collection.mjs`, `src/wizard-init.mjs`)**: `pnpm -r test` on a workspace whose packages declare no test script exits 0 and writes **zero bytes** on stdout and stderr. Measured on `unjs/unimport`: `init` chose it, and `agentctl check` returned `APPROVED (Exit 0)` with an advisory that it could not tell a full suite from a command that ran nothing. The collection floor is one-sided on purpose — an unrecognised runner states no count and passes, because hard-redding every runner not on the list would be worse than the hole it closes — but an unrecognised runner still *prints*. Zero bytes is not a dialect the list has yet to learn; it is a command that ran nothing, and it is now the one absence that decides. v0.69.0 claimed `init` already rejected this candidate: it did not, because `probeVerdict` sorted no-output into `silent` (the forgiving bucket) rather than `empty`, so the exact command that verdict was introduced to reject was the one case it waved through. The rule reads the command as well as the output, and both halves are required: `tsc --noEmit`, `node --check`, `go vet` and `python3 -m compileall` also exit 0 in silence, and two of those are commands this kit writes itself for a repository with no suite yet — keying on silence alone hard-redded every one of them, which is the same first-run rejection of correct code the floor is otherwise careful to avoid. So a command that is *recognisably* a suite invocation and printed nothing ran no suite, while a checker that printed nothing did what it promised. Resolved once, in `producedNoOutput` and `looksLikeTestSuiteCommand`, and consumed by both the floor and the probe.
+- **Python Was Verified Against A Different Copy Of Itself (`src/stack-detector.mjs`)**: `python3 -m pytest` puts the *working directory* on `sys.path`, which is the fix for a module at the root and no help at all when the package lives under `src/` — there, `import iniconfig` finds nothing locally and falls through to site-packages. Measured on `pytest-dev/iniconfig` with `_parse.py` gutted to `return False`: 49 tests passed and the gate returned `APPROVED (Exit 0)`. The suite really did run, so no amount of counting collected tests can see it; only the import path can. A `src/` layout is now detected by the `__init__.py` under it and the oracle is written as `PYTHONPATH=src python3 -m pytest`, which puts the working tree first whether or not the package is also installed.
+- **Ordinary Work On A Test File Was A CRITICAL Block (`src/security.mjs`)**: `assertionsSeen === 0 && (unreadable.length > 0 || examined > 0)` decided `UNREADABLE`, and that `|| examined > 0` threw away the distinction the whole apparatus exists to draw. `ASSERTION_SHAPED` and `unreadable[]` were built to separate *"assertion-shaped lines were present and none parsed"* from *"there were no assertions in these lines at all"*. Collapsed together, **any** changed substantive line in a test file with no recognised assertion became a `CRITICAL` rejection: renaming a test function did it, and so did adding `import os`. The tell was in the finding itself — `file: null`, `line: null`, no sample, because `unreadable` was empty — so the guard blocked while holding no evidence of anything, and advised a **pytest** repository that its assertion library might be unsupported, from a list that names pytest. Worse, the remedy it printed was `verify.tamperGuard: "warn"`, which switches the real checks off along with the blanket. `UNREADABLE` now requires its evidence. Nothing is weakened: a removed or rewritten assertion is a recognised assertion line, raises `assertionsSeen`, and never reached this branch.
+- **The Scaffold Failed The Repository's Own Linter (`src/config.mjs`, `src/wizard-init.mjs`, `src/stack-detector.mjs`)**: `init` wrapped every generated string in double quotes — valid YAML, idiomatic nowhere. Measured on `unjs/unimport`: following the README verbatim produced **40 eslint errors** (`yaml/quotes`, `yaml/plain-scalar`) across `.agent/config.yml` and `.agent/jules.yml`, so a newcomer's first `agentctl check` was a hard red on files `agentctl init` had written a minute earlier, in a repository that was green before. Two causes, and the second was the better one. `yamlScalar` now emits a plain scalar where YAML permits one and single quotes where it does not, which is simply how YAML is written — a glob beginning with `*` stays quoted, because a leading star is an alias reference. That took it from 40 errors to 16. The remaining 16 came from a single generated comment beginning with the word `global`, which ESLint reads as the `/* global a, b */` directive in any language it has a parser for, YAML included — so it declared globals named after each English word of the sentence and then reported them as unused. The sentence leads with the key it explains instead. Nothing in either fix is specific to eslint or to that repository, and the emitter rule lives in one place that both writers use. Measured again on the same clone: 40 errors to 0.
+- **A Test-Integrity Failure Told The Operator To Rotate Their Keys (`bin/agentctl.mjs`)**: `TEST_DIALECT_UNREADABLE` was missing from `INTEGRITY_TYPES`, so the one finding that is most obviously not a secret fell through to the exit-6 secret branch. The screen printed `Phase [SECRETS (test integrity — no secret found)] : ❌ FAIL` and then `💡 Remediation Hint (Exit 6 Secret Leak Prevented) • High-entropy credential or secret detected in patch • rotate any exposed keys immediately` — two statements about the same run, contradicting each other in the same output. v0.67.0 fixed the phase label and left the hint; v0.69.0 recorded the hint as already correct without measuring it. It has its own branch now, and it is derived from `onlyIntegrityFindings` rather than tested independently, so a run carrying both an unreadable file and a real tampering finding gets the tampering advice instead of falling past both into the secret branch — which is the shape of the original hole.
+- **`task create -p` Blocked Forever In A Real Terminal (`src/wizard-task.mjs`)**: the README advertises `task create -p "..."` as the way to *"skip straight to review"*. Interactivity was decided by `isTTY` alone and `-p` was consulted only by the TODO-import branch, so in a terminal the advertised quickstart stopped at `? Task Title` and waited for a keypress that never came — then asked for the instructions it had already been handed. v0.69.0 recorded this as not reproduced, correctly, from a non-TTY run: the headless path never asks, so the defect was invisible exactly where it was measured. `-p` now means the headless path everywhere, and the regression test supplies no answers at all, because only an assertion that nothing is asked could have caught a hang.
+
+### Added
+- **A Test Renamed Out Of Its Runner's Discovery Is Its Own Finding (`src/security.mjs`)**: pytest collects `test_*` and Go collects `Test*`, so `def test_totals` becoming `def totals` deletes the test from every future run while leaving it in the file, fully written, assertions intact — and every count in the guard stays level. This was previously caught only as a side effect of the blanket removed above. `TEST_DEREGISTERED` names it, explains that the runner collects by name, and is waivable as `--allow-test-change deregistration` like every other kind. Exact on the remainder: `test_totals` → `totals` is a de-registration, `test_totals` → `test_totals_rounded` is a rename and stays silent.
+- **A Loosened Run No Longer Looks Like A Strict One (`bin/agentctl.mjs`)**: every escape hatch turns a check off and the report said so nowhere — `agentctl check --allow-test-change expectation` over a rewritten expectation printed a phase list byte-identical to a clean, unloosened `APPROVED`. A reviewer, a CI log, or the author a week later could not tell that a check had been waived. An `⚠️ OVERRIDES ACTIVE` block now names each active flag, plus `verify.required: false` and `verify.tamperGuard: "warn"`, and it prints on approval as well as rejection, because approval is the case where it is load-bearing.
+- **Eleven More Cases In The Policy Contract (`src/guard-policy.mjs`)**: five innocent edits for the work that was being rejected — adding an import, a multi-line test rename, a docstring, a type annotation, a Go fixture — four de-registration canaries across both name-driven runners, six silent-run canaries and five silent *static gates* that must keep passing — the counterweight, without which the silence rule would hard-red every honest checker. 42 canaries, 21 innocent edits, 4 de-registrations, 6 silent runs, 5 static gates.
+- **The Innocent-Edit Contract Measures The Verdict (`test/assertion-dialects.test.mjs`, `scripts/guard-reach-check.mjs`)**: it asserted only that no *violation* was produced, and `UNREADABLE` is a status rather than a violation — so the whole list stayed green for two releases while `scanDiff` returned `CRITICAL` and the gate rejected the change. Every innocent edit is now also asserted through `scanDiff`. Anything that can end a run has to be measured where the run ends.
+
+### Also Fixed
+- **The Loosening Flags Reached One Phase And Not The Next (`src/engine.mjs`)**: `scanDiff` is given `allowTestChanges` and honours it; the `assert:test-integrity` verify stage received only its own stage object and re-ran the same guard with none of them. So an override was accepted by one phase and ignored by the next — `--allow-test-change deregistration` turned `SECRETS` green and then failed the run at anti-tamper, having already told the operator to pass the flag they had just passed. Found while testing the new kind, not reported by the trial. This is the eighth time in this project's history that one rule has been written in one place while another kept the old answer.
+
+- **The Manifest Parser Truncated Any Value Containing A Hash (`src/config.mjs`)**: `parseYaml` opened a comment at the first `#` on a line, quoted or not — so `verify.test: 'pytest -k "not #slow"'` was read as `pytest -k "not`, and the gate ran a command the operator never wrote while reporting on it as if they had. A URL fragment did the same. Comment-stripping is now quote-aware and follows the YAML rule that a `#` opens a comment only at the start of a line or after whitespace, and `coerce` undoes the `''` escape that `yamlScalar` emits. Pre-existing, and it mattered more the moment this release added an emitter: a writer and a reader in one module that disagree about the same file is this project's recurring defect with both halves in view. `YAML_ROUNDTRIP_CASES` pins 19 values — hashes, colons, leading stars, apostrophes, the empty string, and the words YAML would otherwise read as booleans — through both a key and a list item.
+
+### Corrections To Earlier Entries
+Two `### Not Reproduced` claims in **[0.69.0]** were wrong, and both were wrong in the same way — measured somewhere the defect could not appear.
+
+- *"The `TEST_DIALECT_UNREADABLE` remediation copy was already correct."* It was not. v0.67.0 had fixed the phase label, not the hint, and the two were on screen together. Reproduced verbatim on `pytest-dev/iniconfig` and fixed above.
+- *"`task create -p` did not block on a prompt."* True without a TTY and false with one. Reproduced under `script(1)` and fixed above.
+
+One finding in the fourth trial quoted output that does not reproduce: its `--allow-test-change expectation` case shows `APPROVED (Exit 0)`, where the run rejects at `Exit 4` because the reporter's own `sed` genuinely breaks the dotenv suite — the same fixture artefact this project has hit in every trial. The finding itself, that no override leaves a trace in the report, held and is fixed above.
+
 ## [0.70.0] - 2026-09-05
 *A session that has not finished is not a session that passed.*
 
@@ -45,6 +79,8 @@ A third cold-start trial against v0.68.0. Twelve findings; six reproduced, and t
 - **The Egress Guard Could Not See `.js` (`test/egress-allowlist.test.mjs`)**: the scan collected `.mjs` only, so `bin/init.js` — published as the `jules-init` binary — sat outside the boundary entirely. Harmless as it stands, but the guard's whole purpose is that a reviewer can trust the boundary without reading every commit.
 
 ### Not Reproduced
+> **Corrected in [0.71.0]:** two of the claims below were wrong — the `TEST_DIALECT_UNREADABLE` remediation copy and `task create -p`. Both were measured where the defect could not appear. See the corrections section of that release.
+
 Six of the twelve did not hold, and five quoted terminal output that does not exist anywhere in the shipped code. `--allow-test-change expectation` propagates correctly through both phases and returns `APPROVED`; `--allow-test-change removal` allows deleting a dead test alongside its dead function, also `APPROVED` — both reported failures were a test suite genuinely broken by the reporter's own edit, which is the same fixture artefact this project has hit repeatedly. `agentctl plan approve --dry-run` errors with *"Session ID is required"* rather than printing the quoted *"Plan Approved Successfully!"*. `task create -p` did not block on a prompt. A protected `package.json` is the design, and the gate already prints `To allow protected files in this run, pass: agentctl gate --allow-protected` — the finding stated there were no flag hints in the output. The `TEST_DIALECT_UNREADABLE` remediation copy was already correct: *"Exit 6 Test Integrity Violation — no secret was found"*, not the quoted *"Secret Leak Prevented"*. And `pnpm -r test` exits 0 on pnpm 10.33.4 rather than the reported `ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT` — the real defect there was worse than the one reported, and is fixed above.
 
 ### Added

package/README.md

@@ -208,7 +208,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **1255 unit tests across 173 suites**, green on every supported platform.
+* **Verified Test Suite:** Tested with **1299 unit tests across 174 suites**, green on every supported platform.
 
 <br/>
 

package/ROADMAP_V1.md

@@ -11,15 +11,24 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 ## 📌 Release Milestones Overview
 
 ```
- v0.70.0 (Current Stable) ──► v0.71.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
- (Not Finished Is Not Passed) (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
+ v0.71.0 (Current Stable) ──► v0.72.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
+ (A Blanket Is Not A Check)   (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
 ```
 
 ---
 
-## ✅ Shipped Milestones (v0.20.0 – v0.70.0)
+## ✅ Shipped Milestones (v0.20.0 – v0.71.0)
 
 
+### v0.71.0: A Blanket Is Not A Check
+- [x] **Silence Is Not A Suite (`src/ops/test-collection.mjs`, `src/wizard-init.mjs`)** — a command that claims to run tests and prints nothing ran none; a static gate that prints nothing did its job.
+- [x] **Python Verified Against The Working Tree (`src/stack-detector.mjs`)** — a `src/` layout resolved its imports to site-packages, and broken code passed 49 tests.
+- [x] **`UNREADABLE` Requires Its Evidence (`src/security.mjs`)** — adding an import to a test file was a CRITICAL block.
+- [x] **A Test Renamed Out Of Discovery Is Its Own Finding (`src/security.mjs`)** — `TEST_DEREGISTERED`, waivable like every other kind.
+- [x] **The Scaffold Passes A Repository's Own YAML Linter (`src/config.mjs`)** — 40 eslint errors on files `init` had just written.
+- [x] **A Loosened Run Says So (`bin/agentctl.mjs`)** — an override left no trace in the report at all.
+- [x] **`task create -p` Skips The Questions (`src/wizard-task.mjs`)** — the advertised quickstart blocked forever in a real terminal.
+
 ### v0.70.0: Not Finished Is Not Passed
 - [x] **An Unfinished Session Is Not COMPLETED (`src/engine.mjs`)** — terminal, blocked and timed-out are three verdicts, not one.
 - [x] **The Retry Carries The Failure (`src/session-ops.mjs`)** — it was reading four fields the API does not return.

package/bin/agentctl.mjs

@@ -425,6 +425,31 @@ async function main() {
       } else {
         console.log(`\n🛡️ agentctl Safety Gate Audit Results (Base: ${values.base}, Mode: ${selectedMode})`);
         console.log(`-----------------------------------------------------`);
+        // A loosened run must not be able to pass for a strict one.
+        //
+        // Every escape hatch here turns a check off, and the report said so
+        // nowhere: `agentctl check --allow-test-change expectation` over a
+        // rewritten expectation printed a phase list byte-identical to a clean,
+        // unloosened APPROVED. Anyone reading the output afterwards — a
+        // reviewer, a CI log, the author a week later — could not tell that a
+        // check had been waived, which makes the waiver invisible exactly where
+        // it matters most. Printed before the phases, and on approval as well
+        // as rejection, because an approval is the case where it is load-bearing.
+        const overrides = [];
+        if (values["allow-protected"]) overrides.push("--allow-protected (protected paths permitted)");
+        if (values["allow-unreadable-tests"]) overrides.push("--allow-unreadable-tests (unreadable dialect permitted)");
+        if (values["allow-test-modifications"]) overrides.push("--allow-test-modifications (every tamper check waived)");
+        if (values["allow-test-change"]) {
+          const kinds = [].concat(values["allow-test-change"]).join(", ");
+          overrides.push(`--allow-test-change ${kinds} (tamper check waived: ${kinds})`);
+        }
+        if (config.verify?.required === false) overrides.push("verify.required: false (nothing is executed)");
+        if (config.verify?.tamperGuard === "warn") overrides.push('verify.tamperGuard: "warn" (unreadable dialects report only)');
+        if (overrides.length > 0) {
+          console.log(`  ⚠️  OVERRIDES ACTIVE — this run is not a strict pass:`);
+          for (const o of overrides) console.log(`       • ${o}`);
+          console.log(`-----------------------------------------------------`);
+        }
         for (const p of res.phases) {
           const status = p.ok ? "✅ PASS" : "❌ FAIL";
           // Test tampering shares this phase, and its exit code, with the
@@ -472,13 +497,32 @@ async function main() {
           // arrive under the same phase and the same code.
           const secretsPhase = res.phases.find((p) => p.phase === "secrets" && !p.ok);
           const findingTypes = new Set((secretsPhase?.findings || []).map((f) => f.type));
+          // `TEST_DIALECT_UNREADABLE` belongs in this set and was missing from
+          // it, so the one finding that is *most* obviously not a secret fell
+          // through to the secret hint: the report printed
+          // "Phase [SECRETS (test integrity — no secret found)] : ❌ FAIL" and
+          // then told the operator a high-entropy credential had leaked and to
+          // rotate their keys. v0.67.0 fixed the phase label and left the hint;
+          // v0.69.0 recorded the hint as already correct without measuring it.
+          // Both statements were about the same screen, and they contradicted
+          // each other on it.
           const INTEGRITY_TYPES = new Set([
             "TEST_TAMPERING_DETECTED",
+            "TEST_DIALECT_UNREADABLE",
             "EDGE_RUNTIME_VIOLATION",
             "CROSS_PACKAGE_BOUNDARY_VIOLATION",
           ]);
           const onlyIntegrityFindings =
             findingTypes.size > 0 && [...findingTypes].every((t) => INTEGRITY_TYPES.has(t));
+          // An unreadable dialect is not a weakened assertion either, and the
+          // integrity hint tells the operator to restore an assertion that no
+          // finding names. Split by what is actually present — and derived from
+          // `onlyIntegrityFindings` rather than tested independently, so a run
+          // carrying both an unreadable file and a real tampering finding gets
+          // the tampering advice instead of falling past both into the secret
+          // branch, which is how this hole was shaped the first time.
+          const onlyUnreadableDialect =
+            onlyIntegrityFindings && [...findingTypes].every((t) => t === "TEST_DIALECT_UNREADABLE");
 
           // Exit 3 is also what a strictTestLock tamper verdict returns, so the
           // code alone cannot pick the hint — a scope remediation for a rewritten
@@ -504,6 +548,16 @@ async function main() {
               if (firstError) console.log(`   • Last attempt error: ${firstError}`);
               console.log(`   • Review error fingerprints via: agentctl doctor\n`);
             }
+          } else if (onlyUnreadableDialect) {
+            console.log(`💡 Remediation Hint (Exit ${res.code} Unreadable Test Dialect — no secret was found):`);
+            console.log(`   • Nothing leaked. The guard could not recognise the assertions in a changed test`);
+            console.log(`     file, so it could not check that file for tampering — and a check that examined`);
+            console.log(`     nothing does not get to say APPROVED.`);
+            console.log(`   • Best: report the dialect so it gets covered. The guard knows Node, pytest, Go,`);
+            console.log(`     Rust, JUnit, RSpec, PHPUnit, Minitest, XCTest, chai and node-tap.`);
+            console.log(`   • Or say so on the record:  verify.tamperGuard: "warn"  in .agent/config.yml`);
+            console.log(`   • Or allow this one run:    agentctl check --allow-unreadable-tests`);
+            console.log(`   • Nothing needs rotating: this exit code is shared with the secret scanner.\n`);
           } else if (onlyIntegrityFindings) {
             console.log(`💡 Remediation Hint (Exit ${res.code} Test Integrity Violation — no secret was found):`);
             console.log(`   • The diff weakens or removes verification rather than leaking a credential.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.70.0",
+  "version": "0.71.0",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/scripts/guard-reach-check.mjs

@@ -42,10 +42,10 @@
  * Exit codes: 0 = every guard reachable, 1 = a guard has gone silent.
  */
 
-import { checkTestTampering, checkScope } from "../src/security.mjs";
+import { checkTestTampering, checkScope, scanDiff } from "../src/security.mjs";
 import { isTestPath } from "../src/test-paths.mjs";
 import { normalizeScope } from "../src/config.mjs";
-import { parseCollectedTests } from "../src/ops/test-collection.mjs";
+import { parseCollectedTests, checkCollectionFloor } from "../src/ops/test-collection.mjs";
 import {
   TEST_PATH_CASES,
   TAMPER_CANARIES,
@@ -53,6 +53,9 @@ import {
   PREDICATE_MUTANTS,
   EMPTY_RUN_CANARIES,
   COUNTED_RUN_CANARIES,
+  SILENT_RUN_CANARIES,
+  SILENT_STATIC_GATES,
+  DEREGISTRATION_CANARIES,
   SCOPE_CANARIES,
   INNOCENT_EDITS,
   UNREADABLE_DIALECTS,
@@ -154,13 +157,53 @@ const canaryResults = new Map();
   add("canaries: assertion rules parsed an assertion", noAssertions.length === 0, noAssertions.length ? noAssertions.join(", ") : "assertionsSeen > 0 on every assertion finding");
 }
 
+{
+  const missed = DEREGISTRATION_CANARIES.filter(
+    (c) => !(checkTestTampering(canaryDiff(c)).violations || []).some((v) => v.type === "TEST_DEREGISTERED")
+  );
+  add(
+    "canaries: a test renamed out of discovery is caught",
+    missed.length === 0,
+    missed.length ? missed.map((c) => `${c.id} (${c.why})`).join("; ") : `${DEREGISTRATION_CANARIES.length} de-registrations reported`
+  );
+}
+
+{
+  // Zero bytes on both streams is the one absence that decides. Measured
+  // through the floor rather than the parser: the parser answers "no count
+  // stated", and it is the floor that has to refuse to certify against it.
+  const passed = SILENT_RUN_CANARIES.filter(
+    (c) => checkCollectionFloor({ ok: true, stdout: c.stdout, stderr: c.stderr, command: c.command }).ok !== false
+  );
+  add(
+    "policy: a command that printed nothing verified nothing",
+    passed.length === 0,
+    passed.length ? passed.map((c) => c.id).join(", ") : `${SILENT_RUN_CANARIES.length} silent runs refused`
+  );
+
+  // And the counterweight: a checker that succeeds in silence is doing its job.
+  const redded = SILENT_STATIC_GATES.filter(
+    (c) => checkCollectionFloor({ ok: true, stdout: "", stderr: "", command: c.command }).ok === false
+  );
+  add(
+    "policy: a silent static gate is not a silent suite",
+    redded.length === 0,
+    redded.length ? `${redded.map((c) => c.id).join(", ")} hard-redded` : `${SILENT_STATIC_GATES.length} static gates still pass`
+  );
+}
+
 // --- 3. The opposite failure: flagging what is innocent ---------------------
 {
   const noisy = [];
   for (const e of INNOCENT_EDITS) {
     const res = checkTestTampering(canaryDiff(e));
     const types = (res.violations || []).map((v) => v.type);
-    if (types.length > 0) noisy.push(`${e.id} → ${JSON.stringify(types)} (${e.why})`);
+    if (types.length > 0) noisy.push(`${e.id} \u2192 ${JSON.stringify(types)} (${e.why})`);
+    // The verdict, not just the violation list. `UNREADABLE` is a status, so
+    // this check stayed green for two releases while the gate rejected every
+    // edit below on a CRITICAL finding.
+    const scan = scanDiff(canaryDiff(e));
+    if (!scan.ok) noisy.push(`${e.id} \u2192 gate rejected: ${JSON.stringify((scan.findings || []).map((f) => f.type))}`);
   }
   add(
     "innocent edits stay silent",

package/src/config.mjs

@@ -205,7 +205,13 @@ const BLOCKED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function coerce(val) {
   if (!val) return "";
-  if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+  if (val.startsWith("'") && val.endsWith("'") && val.length >= 2) {
+    // `''` is how a single-quoted YAML scalar escapes a quote, and it is what
+    // `yamlScalar` emits. Reading the quotes off without undoing the escape
+    // meant the emitter and the parser disagreed about the same file.
+    return val.slice(1, -1).replace(/''/g, "'");
+  }
+  if (val.startsWith('"') && val.endsWith('"') && val.length >= 2) {
     return val.slice(1, -1);
   }
   if (val === "true") return true;
@@ -315,6 +321,86 @@ export function normalizeScope(parsed = {}) {
   };
 }
 
+/**
+ * A YAML scalar quoted only as much as YAML requires.
+ *
+ * The scaffold wrapped every generated string in double quotes, which is valid
+ * YAML and idiomatic nowhere. On a repository that lints its own YAML that is a
+ * hard red on the kit's own files: measured on `unjs/unimport`, following the
+ * README verbatim produced 40 eslint errors — `yaml/quotes` and
+ * `yaml/plain-scalar` — across `.agent/config.yml` and `.agent/jules.yml`, so a
+ * newcomer's very first `agentctl check` failed on output `agentctl init` had
+ * just written, in a repository that was green a minute earlier. Teaching a new
+ * user that the gate is broken is the most expensive thing this tool can do.
+ *
+ * Nothing here is specific to eslint or to that repository. Emitting a plain
+ * scalar where YAML permits one, and single quotes where it does not, is simply
+ * how YAML is written; the linters that check it are agreeing with the spec.
+ *
+ * The quoting test is deliberately conservative — anything that could change
+ * meaning unquoted gets quotes. A glob beginning with a star stays quoted,
+ * because a leading `*` is an alias reference; `pnpm -r test` does not, because
+ * there is nothing in it to misread.
+ */
+const YAML_NEEDS_QUOTES =
+  /^$|^[-?:,[\]{}#&*!|>'"%@`]|^\s|\s$|:\s|\s#|:$|[\n\r\t]|^(?:true|false|yes|no|on|off|null|~)$/i;
+
+export function yamlScalar(value) {
+  const s = value === null || value === undefined ? "" : String(value);
+  if (!YAML_NEEDS_QUOTES.test(s) && !/^[+-]?(?:\d[\d_]*)(?:\.[\d_]*)?(?:[eE][+-]?\d+)?$/.test(s)) return s;
+  return `'${s.replace(/'/g, "''")}'`;
+}
+
+/**
+ * Can a quoted scalar begin at this offset?
+ *
+ * A quote character is only an opening quote where a value may start — after
+ * `key:`, after a `-` list marker, at the head of a flow collection, or at the
+ * start of the line. Anywhere else it is an ordinary apostrophe, and treating
+ * `test: it's fine` as an unterminated string would swallow the rest of it.
+ */
+function opensQuotedScalar(line, i) {
+  return /(?:^\s*|:\s+|-\s+|[[{,]\s*)$/.test(line.slice(0, i));
+}
+
+/**
+ * Strip a trailing `#` comment without cutting into a quoted scalar.
+ *
+ * `rawLine.indexOf("#")` stood here, which is not the YAML rule twice over: a
+ * `#` opens a comment only when it begins the line or follows whitespace, and
+ * never inside quotes. So any configured value containing a hash was silently
+ * truncated on the way in — `test: 'pytest -k "not #slow"'` became
+ * `test: 'pytest -k "not`, and the gate then ran a command the user never
+ * wrote. Silent truncation of a verification command is the worst shape this
+ * file can produce, because every later phase reports on whatever did run.
+ *
+ * It matters more now that `yamlScalar` exists: an emitter and a parser that
+ * disagree about the same file is this project's recurring defect with both
+ * halves in one module.
+ */
+function stripYamlComment(rawLine) {
+  let quote = null;
+  for (let i = 0; i < rawLine.length; i++) {
+    const ch = rawLine[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") {
+        i++;
+      } else if (ch === quote) {
+        // `''` is an escaped quote inside a single-quoted scalar, not the end.
+        if (quote === "'" && rawLine[i + 1] === "'") i++;
+        else quote = null;
+      }
+      continue;
+    }
+    if ((ch === '"' || ch === "'") && opensQuotedScalar(rawLine, i)) {
+      quote = ch;
+      continue;
+    }
+    if (ch === "#" && (i === 0 || /\s/.test(rawLine[i - 1]))) return rawLine.slice(0, i);
+  }
+  return rawLine;
+}
+
 /**
  * Indent-stack zero-dependency YAML parser with prototype pollution protection.
  */
@@ -331,8 +417,7 @@ export function parseYaml(src) {
   const lines = src.split("\n");
 
   for (let rawLine of lines) {
-    const commentIdx = rawLine.indexOf("#");
-    const line = commentIdx !== -1 ? rawLine.slice(0, commentIdx) : rawLine;
+    const line = stripYamlComment(rawLine);
     const trimmed = line.trim();
     if (!trimmed) continue;
 

package/src/engine.mjs

@@ -459,7 +459,28 @@ export async function gate(opts = {}) {
       let assertMetrics = {};
 
       if (isAssertion) {
-        const assertRes = runAssertion(stage, root);
+        // The loosening flags have to reach here too.
+        //
+        // `scanDiff` above is given `allowTestChanges` and honours it, while
+        // the `assert:test-integrity` stage received only its own stage object
+        // and re-ran the same guard with none of them. So an override was
+        // accepted by one phase and ignored by the next: `--allow-test-change
+        // deregistration` turned the SECRETS phase green and then failed the
+        // run at the anti-tamper stage, with a flag hint the operator had
+        // already followed. One rule, two places, and the second kept the old
+        // answer — for the eighth time in this project's history, which is why
+        // the regression test asserts the verdict a caller receives rather
+        // than the behaviour of either site.
+        const assertRes = runAssertion(
+          {
+            ...stage,
+            allowTestModifications: opts.allowTestModifications === true,
+            allowTestChanges: opts.allowTestChanges,
+            tamperGuard: trustedVerify.tamperGuard,
+            allowUnreadableTests: opts.allowUnreadableTests === true,
+          },
+          root
+        );
         durationMs = assertRes.metrics?.durationMs ?? (Date.now() - startTime);
         stdoutRedacted = assertRes.stdout || "";
         stderrRedacted = assertRes.stderr || "";

package/src/guard-policy.mjs

@@ -454,6 +454,57 @@ export const SCOPE_CANARIES = [
  * from never showed it.
  */
 export const INNOCENT_EDITS = [
+  // Everything below this comment was a CRITICAL rejection until v0.71.0.
+  //
+  // Not through any rule that examined them: `UNREADABLE` was reached whenever
+  // a test file had changed lines and none of them parsed as an assertion, so
+  // the verdict was the same for a repository speaking an unsupported dialect
+  // and for one where the edit simply was not an assertion. Adding an import
+  // was a CRITICAL block. The finding carried no file, no line and no sample,
+  // because there was nothing to name — and it advised a pytest repository
+  // that its assertion library might be unsupported, from a list naming pytest.
+  //
+  // These are ordinary work. Every one of them has to be silent.
+  {
+    id: "add-import/pytest",
+    file: "testing/test_iniconfig.py",
+    context: "# fixtures",
+    removed: [],
+    added: ["import os"],
+    why: "adding an import to a test file is not an assertion and not tampering",
+  },
+  {
+    id: "rename-test-multiline/pytest",
+    file: "testing/test_iniconfig.py",
+    context: "# parsing",
+    removed: ["def test_parse_strips_inline_comments() -> None:"],
+    added: ["def test_parse_strips_inline_comments_from_continuations() -> None:"],
+    why: "still collected by pytest, so nothing left the run",
+  },
+  {
+    id: "docstring/pytest",
+    file: "testing/test_iniconfig.py",
+    context: "# parsing",
+    removed: ['    """Check comments."""'],
+    added: ['    """Check that inline comments are stripped."""'],
+    why: "prose about the test, not a value it asserts",
+  },
+  {
+    id: "type-annotation/pytest",
+    file: "testing/test_iniconfig.py",
+    context: "# fixtures",
+    removed: ["def make_config(data):"],
+    added: ["def make_config(data: str) -> IniConfig:"],
+    why: "a helper's signature, typed; no claim changed",
+  },
+  {
+    id: "add-fixture/go",
+    file: "calc_test.go",
+    context: "// helpers",
+    removed: [],
+    added: ["var cases = []int{1, 2, 3}"],
+    why: "test data added, nothing asserted or unasserted",
+  },
   // Renaming a test is one of the most ordinary edits there is. On the
   // one-line form the name blanked to the same shape as its replacement, the
   // two paired, and the pair was reported as a rewritten expectation.
@@ -598,6 +649,129 @@ export const INNOCENT_EDITS = [
  * will always end somewhere; what must never happen again is that the edge
  * is silent.
  */
+/**
+ * Renames that delete a test from the run without deleting a line of it.
+ *
+ * pytest collects `test_*`, Go collects `Test*`. For those runners the name is
+ * the registration, so `def test_totals` → `def totals` removes the test as
+ * completely as deleting the file, and every count in the tamper guard stays
+ * level: nothing removed, nothing weakened, nothing rewritten.
+ *
+ * These were caught only as a side effect of the blanket that rejected every
+ * unrecognised edit to a test file — which also rejected adding an import, and
+ * whose printed remedy switched the real checks off. They are their own
+ * finding now, so narrowing that blanket costs nothing.
+ */
+export const DEREGISTRATION_CANARIES = [
+  {
+    id: "pytest/underscore",
+    file: "tests/test_totals.py",
+    context: "# totals",
+    removed: ["def test_totals_round_to_cents():"],
+    added: ["def totals_round_to_cents():"],
+    why: "pytest collects by the test_ prefix, so this test no longer runs",
+  },
+  {
+    id: "pytest/camel",
+    file: "tests/test_totals.py",
+    context: "# totals",
+    removed: ["def testTotals():"],
+    added: ["def Totals():"],
+    why: "the prefix is what registers it, in either spelling",
+  },
+  {
+    id: "go/test",
+    file: "calc_test.go",
+    context: "// totals",
+    removed: ["func TestTotals(t *testing.T) {"],
+    added: ["func Totals(t *testing.T) {"],
+    why: "go test collects by the Test prefix",
+  },
+  {
+    id: "go/benchmark",
+    file: "calc_test.go",
+    context: "// totals",
+    removed: ["func BenchmarkTotals(b *testing.B) {"],
+    added: ["func Totals(b *testing.B) {"],
+    why: "the same rule for the other collected prefixes",
+  },
+];
+
+/**
+ * A verification command that exits 0 having written nothing at all.
+ *
+ * The one absence that is evidence. The floor is otherwise deliberately
+ * one-sided — an unrecognised runner states no count and passes, because
+ * hard-redding every runner not on the list would be worse than the hole it
+ * closes — but an unrecognised runner still prints something. Zero bytes on
+ * both streams is a command that ran nothing, and `pnpm -r test` on a
+ * workspace whose packages declare no test script is exactly that: it was
+ * indistinguishable from a full suite by every signal the gate had.
+ */
+export const SILENT_RUN_CANARIES = [
+  { id: "pnpm -r test", command: "pnpm -r test", stdout: "", stderr: "" },
+  { id: "npm test", command: "npm test", stdout: "", stderr: "" },
+  { id: "yarn workspaces test", command: "yarn workspaces foreach run test", stdout: "", stderr: "" },
+  { id: "pytest", command: "python3 -m pytest", stdout: "", stderr: "" },
+  { id: "go test", command: "go test ./...", stdout: "", stderr: "" },
+  { id: "whitespace is not output", command: "npm test", stdout: "  \n", stderr: "\n" },
+];
+
+/**
+ * Honest static gates that print nothing, and must keep passing.
+ *
+ * The counterweight, and the reason the rule above reads the command as well
+ * as the output. `tsc --noEmit`, `node --check`, `go vet` and `compileall`
+ * all exit 0 in silence when they succeed — that is what success looks like
+ * for a checker — and two of them are commands this kit writes itself for a
+ * repository that has no suite yet. A rule keyed on silence alone hard-redded
+ * every one of them, which is exactly the first-run rejection of correct code
+ * that the collection floor is otherwise so careful to avoid.
+ */
+export const SILENT_STATIC_GATES = [
+  { id: "tsc", command: "tsc --noEmit" },
+  { id: "node --check", command: "node --check index.js" },
+  { id: "go vet", command: "go vet ./..." },
+  { id: "compileall", command: "python3 -m compileall -q ." },
+  { id: "generated parse gate", command: "node --check src/index.mjs" },
+];
+
+/**
+ * Values that must survive a trip through the emitter and back.
+ *
+ * `yamlScalar` writes the manifests and `parseYaml` reads them, and a pair
+ * like that disagreeing about one character is this project's recurring
+ * defect with both halves in a single module. The parser opened a comment at
+ * the first `#` on a line, quoted or not, so `verify.test` containing a hash
+ * was silently truncated on the way in and the gate ran a command the user
+ * never wrote — reporting on it as if it were theirs.
+ *
+ * The corpus is the hard cases on purpose: hashes, colons, leading stars,
+ * apostrophes, the empty string, and the words YAML would otherwise read as
+ * booleans.
+ */
+export const YAML_ROUNDTRIP_CASES = [
+  "pnpm -r test",
+  "PYTHONPATH=src python3 -m pytest",
+  'pytest -k "not #slow"',
+  "has #hash",
+  "# leading hash",
+  "a: b",
+  "**/*.pem",
+  "**/.env.*",
+  ".github/**",
+  "",
+  "true",
+  "yes",
+  "1.5",
+  "it's fine",
+  "it's #1",
+  "O'Brien",
+  "agent/",
+  "  leading space",
+  "trailing space  ",
+];
+
 export const UNREADABLE_DIALECTS = [
   {
     id: "hspec",

package/src/ops/test-collection.mjs

@@ -111,6 +111,56 @@ const GO_RAN_SOMETHING = /^(?:(?:ok|FAIL)\s+(?!\d+\s)\S+|---\s+(?:PASS|FAIL|SKIP
  *   `count` is null when no recognised runner stated one — which is not a
  *   finding, only an absence of evidence.
  */
+/**
+ * Did the command write nothing at all, on either stream?
+ *
+ * This is the one absence that is evidence rather than the lack of it. The
+ * one-sided floor exists because an unrecognised runner states no count, and
+ * hard-redding every runner not on the list would be worse than the hole it
+ * closes. But an unrecognised runner still *prints*: dots, a summary line,
+ * a package name, something. Zero bytes on both streams is not a dialect the
+ * list has yet to learn — it is a command that ran nothing.
+ *
+ * `pnpm -r test` on a workspace whose packages declare no test script is the
+ * shape that made this necessary: it exits 0, writes nothing anywhere, and
+ * was indistinguishable from a full suite by every signal the gate had.
+ *
+ * Resolved here and consumed in two places — the gate's floor and `init`'s
+ * oracle probe — because writing the rule once in each is how this project
+ * has repeatedly ended up with two answers to one question.
+ */
+export function producedNoOutput(stdout = "", stderr = "") {
+  return `${stdout || ""}${stderr || ""}`.trim() === "";
+}
+
+/**
+ * Does this command claim to run a test suite?
+ *
+ * Silence alone cannot carry the verdict, and the first version of this rule
+ * assumed it could. `node --check index.js`, `tsc --noEmit`, `go vet ./...`
+ * and `python3 -m compileall -q .` all exit 0 having printed nothing — and
+ * they are honest static gates, two of which this kit writes itself for
+ * repositories that have no suite yet. Failing on silence alone hard-redded
+ * every one of them, which is the same first-run rejection of correct code
+ * that the whole collection floor is careful to avoid.
+ *
+ * Nothing in the *output* separates `pnpm -r test` from `tsc --noEmit`; both
+ * are empty. The difference is in what the command says it is. So this reads
+ * the command, the same way `isPlaceholderTestScript` does: a command that is
+ * recognisably a suite invocation and printed nothing ran no suite, while a
+ * static checker that printed nothing did exactly what it promised.
+ *
+ * One-sided in the safe direction, like everything else here. An unrecognised
+ * command is not treated as a suite, so an unusual runner keeps its advisory
+ * pass rather than becoming a hard red.
+ */
+const TEST_SUITE_COMMAND =
+  /(?:^|\s|\/)(?:pytest|jest|vitest|mocha|ava|karma|jasmine|nyc|c8|tap|tape|rspec|minitest|phpunit|behave|nose2?|ginkgo|gotestsum|nextest)\b|\b(?:go|cargo|swift|dart|flutter|deno|bun|dotnet|mix|lein|sbt|gradlew?|mvn)\s+test\b|\bunittest\b|-m\s+(?:pytest|unittest)\b|\bnode\s+--test\b|(?:^|&&|;|\|)\s*(?:npm|pnpm|yarn|bun|npx)\b[^&;|]*?\btest\b/;
+
+export function looksLikeTestSuiteCommand(cmd) {
+  return typeof cmd === "string" && TEST_SUITE_COMMAND.test(cmd);
+}
+
 export function parseCollectedTests(stdout = "", stderr = "") {
   const text = `${stdout || ""}\n${stderr || ""}`;
   if (!text.trim()) return { count: null, runner: null };
@@ -168,6 +218,30 @@ export function checkCollectionFloor(testResult, opts = {}) {
     return { ok: true, count: null, runner: null, reason: null };
   }
 
+  // A command that says it runs a suite, and printed nothing, ran no suite.
+  //
+  // Both halves are required. Silence alone would hard-red `tsc --noEmit` and
+  // `python3 -m compileall`, which are honest static gates this kit generates
+  // itself; the command shape alone would say nothing, because a real suite
+  // prints. Together they are decidable, and they are exactly `pnpm -r test`
+  // on a workspace whose packages declare no test script.
+  if (looksLikeTestSuiteCommand(testResult.command) && producedNoOutput(testResult.stdout, testResult.stderr)) {
+    return {
+      ok: false,
+      count: 0,
+      runner: null,
+      silent: true,
+      reason:
+        `The verification command ${testResult.command ? `${JSON.stringify(testResult.command)} ` : ""}` +
+        `exited 0 and wrote nothing at all — no test names, no summary, no count. ` +
+        `Every test runner prints something, so this command ran no suite, and approving this change ` +
+        `would certify nothing. A workspace command such as \`pnpm -r test\` does this when no package ` +
+        `declares a test script. Point verify.test at the suite that covers this repository ` +
+        `(often the root script rather than the recursive one), or — if this repository intentionally ` +
+        `uses only the scope and secret phases — set verify.required: false, which says so on the record.`,
+    };
+  }
+
   const { count, runner } = parseCollectedTests(testResult.stdout, testResult.stderr);
 
   // Deliberately one-sided: only a *stated* zero fails, because failing on

package/src/security.mjs

@@ -1875,6 +1875,51 @@ function splitTrailingMessage(clean) {
   return { head: clean.slice(0, lastComma), msg: tail };
 }
 
+/**
+ * Test declarations that a runner finds by the *name* of the function.
+ *
+ * pytest collects `def test_*`, Go collects `func Test*`, and unittest and
+ * Minitest collect `def test_*` off the case class. For those runners the
+ * name is not prose — it is the registration. Renaming `test_totals` to
+ * `totals` deletes the test from the run as completely as removing the file,
+ * and the diff shows a rename.
+ *
+ * Only these name-driven runners are listed. `it("...")`, `#[test]` and
+ * `@Test` register by call, attribute or annotation, so renaming what they
+ * declare removes nothing, and the ordinary rename rules already cover them.
+ */
+const NAME_REGISTERED_DECLS = [
+  { lang: "python", re: /^\s*(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/, discovered: /^test/i },
+  { lang: "go", re: /^\s*func\s+([A-Za-z_]\w*)\s*\(/, discovered: /^(?:Test|Benchmark|Fuzz|Example)/ },
+];
+
+/**
+ * The declared name on this line, and whether the runner would collect it.
+ *
+ * @returns {{ name: string, collected: boolean }|null}
+ */
+function declaredTestName(text) {
+  for (const rule of NAME_REGISTERED_DECLS) {
+    const m = rule.re.exec(text);
+    if (m) return { name: m[1], collected: rule.discovered.test(m[1]) };
+  }
+  return null;
+}
+
+/**
+ * Is `after` the same declaration as `before` with its discovery prefix gone?
+ *
+ * Exact on the remainder, deliberately. `test_totals` → `totals` is a
+ * de-registration; `test_totals` → `test_totals_rounded` is a rename and must
+ * stay silent, which is the false red this check exists alongside rather than
+ * instead of.
+ */
+function isDeregistration(before, after) {
+  if (!before.collected || after.collected) return false;
+  const stripped = before.name.replace(/^test[_-]?/i, "").replace(/^(?:Test|Benchmark|Fuzz|Example)/, "");
+  return stripped.length > 0 && stripped === after.name;
+}
+
 // A test declaration whose first argument is the test's name. The name is
 // prose about the test, not a value the test asserts — `test("adds", ...)`
 // renamed to `test("adds positives", ...)` is the rename the diff says it is.
@@ -2211,6 +2256,7 @@ export const TAMPER_KINDS = new Map([
   ["ASSERTION_REMOVAL", "removal"],
   ["ASSERTION_WEAKENED", "weakening"],
   ["ASSERTION_EXPECTATION_CHANGED", "expectation"],
+  ["TEST_DEREGISTERED", "deregistration"],
 ]);
 
 /** Every kind name, for CLI validation and help text. */
@@ -2406,7 +2452,7 @@ export function checkTestTampering(diffOrText = "", options = {}) {
     }
 
     if (!fileAssertions.has(currentFile)) {
-      fileAssertions.set(currentFile, { removed: [], added: 0, addedTexts: [], removedSpecific: [], addedSpecific: 0, hunks: [], examined: 0, recognised: 0, unreadable: [] });
+      fileAssertions.set(currentFile, { removed: [], added: 0, addedTexts: [], removedSpecific: [], addedSpecific: 0, hunks: [], examined: 0, recognised: 0, unreadable: [], declRemoved: [], declAdded: [] });
     }
     const fileStats = fileAssertions.get(currentFile);
     if (pendingHunk) {
@@ -2419,6 +2465,10 @@ export function checkTestTampering(diffOrText = "", options = {}) {
       const deletedText = line.slice(1);
       if (hunk) hunk.lines.push({ kind: "-", text: deletedText, oldNo: currentOldLineNo, newNo: null });
       countExamined(fileStats, deletedText);
+      if (!isCommentLine(deletedText)) {
+        const decl = declaredTestName(deletedText);
+        if (decl) fileStats.declRemoved.push({ ...decl, line: currentOldLineNo, text: deletedText });
+      }
       if (!isCommentLine(deletedText) && ASSERTION_PATTERN.test(deletedText)) {
         fileStats.removed.push({ line: currentOldLineNo, text: deletedText });
         if (isSpecificAssertion(deletedText)) {
@@ -2430,6 +2480,10 @@ export function checkTestTampering(diffOrText = "", options = {}) {
       const addedText = line.slice(1);
       if (hunk) hunk.lines.push({ kind: "+", text: addedText, oldNo: null, newNo: currentNewLineNo });
       countExamined(fileStats, addedText);
+      if (!isCommentLine(addedText)) {
+        const decl = declaredTestName(addedText);
+        if (decl) fileStats.declAdded.push({ ...decl, line: currentNewLineNo, text: addedText });
+      }
       let isVacuous = false;
 
       // Check skip injections
@@ -2563,6 +2617,40 @@ export function checkTestTampering(diffOrText = "", options = {}) {
     }
   }
 
+  // A test renamed out of its runner's discovery convention.
+  //
+  // pytest collects `test_*` and nothing else, so `def test_totals` becoming
+  // `def totals` deletes the test from every future run while leaving it in
+  // the file, fully written, with all its assertions intact. Every count in
+  // this guard stays level: nothing was removed, weakened or rewritten.
+  //
+  // Until now this was caught only by accident, as a side effect of the
+  // blanket that blocked every unrecognised edit to a test file — which also
+  // blocked adding an import, and whose printed remedy (`tamperGuard: "warn"`)
+  // switched off the real checks along with the blanket. Narrowing that blanket
+  // is what makes this its own finding, with its own name and its own remedy.
+  for (const [file, stats] of fileAssertions.entries()) {
+    const takenAdds = new Set();
+    for (const before of stats.declRemoved || []) {
+      if (!before.collected) continue;
+      const idx = (stats.declAdded || []).findIndex((after, i) => !takenAdds.has(i) && isDeregistration(before, after));
+      if (idx === -1) continue;
+      takenAdds.add(idx);
+      const after = stats.declAdded[idx];
+      violations.push({
+        file,
+        line: after.line ?? before.line,
+        type: "TEST_DEREGISTERED",
+        reason:
+          `Test Tamper Guard: ${JSON.stringify(before.name)} was renamed to ${JSON.stringify(after.name)} in ${file}` +
+          `${after.line ? `:${after.line}` : ""}. The runner collects tests by name, so the test still exists in ` +
+          `the file and no longer runs — the same effect as deleting it, with none of the signs. ` +
+          `If the test is genuinely obsolete, delete it; if it is being turned into a helper, say so with ` +
+          `--allow-test-change deregistration.`,
+      });
+    }
+  }
+
   for (const [file, stats] of fileAssertions.entries()) {
     // An expectation that was rewritten rather than removed.
     //
@@ -2668,10 +2756,33 @@ export function checkTestTampering(diffOrText = "", options = {}) {
   // assertion, is not the same as "checked and clean" — it is the state where
   // this guard has nothing to say. Saying nothing and saying "approved" have
   // to look different, which is the whole reason `status` exists.
+  // `unreadable` is the evidence, and it is required.
+  //
+  // `|| examined > 0` used to stand here, and it threw away the distinction
+  // this whole apparatus exists to draw. `ASSERTION_SHAPED` and `unreadable[]`
+  // were built to separate "assertion-shaped lines were present and none of
+  // them parsed" — a dialect the guard cannot read — from "there were no
+  // assertions in these lines at all", which is most ordinary work on a test
+  // file. That clause collapsed the two, so *any* changed substantive line in
+  // a test file with no recognised assertion became a CRITICAL block:
+  // measured on `pytest-dev/iniconfig`, renaming a test function did it, and
+  // so did adding `import os`.
+  //
+  // The tell was in the finding itself: it carried `file: null`, `line: null`
+  // and no sample, because `unreadable` was empty — the guard blocked while
+  // holding no evidence of anything, and advised a pytest repository that its
+  // assertion library might be unsupported, from a list that names pytest.
+  //
+  // Nothing is weakened by requiring the evidence. A removed or rewritten
+  // assertion is a recognised assertion line, so it raises `assertionsSeen`
+  // and goes to the ordinary removal and weakening checks; it never reached
+  // this branch. What is lost is only the blanket, and a blanket that fires
+  // on `import os` teaches its way around itself: the remedy it printed was
+  // `tamperGuard: "warn"`, which switches the real guard off too.
   const status =
     reported.length > 0
       ? "FAIL"
-      : assertionsSeen === 0 && (unreadable.length > 0 || examined > 0)
+      : assertionsSeen === 0 && unreadable.length > 0
         ? "UNREADABLE"
         : examined > 0
           ? "PASS"

package/src/stack-detector.mjs

@@ -1,6 +1,7 @@
 import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
 import { join, relative } from "node:path";
 import { whichBinary } from "./provider-readiness.mjs";
+import { yamlScalar } from "./config.mjs";
 
 /**
  * The Python interpreter to invoke, by whatever name this machine has it under.
@@ -31,11 +32,48 @@ function pythonBin(env = process.env) {
  * Falls back to the bare console script only when no interpreter can be found
  * to host the module.
  */
-export function pytestCmd(env = process.env) {
+export function pytestCmd(env = process.env, root = null) {
+  const prefix = root && isSrcLayout(root) ? "PYTHONPATH=src " : "";
   for (const name of ["python3", "python", "py"]) {
-    if (whichBinary(name, env)) return `${name} -m pytest`;
+    if (whichBinary(name, env)) return `${prefix}${name} -m pytest`;
+  }
+  return `${prefix}pytest`;
+}
+
+/**
+ * Does this repository keep its package under `src/` rather than at the root?
+ *
+ * The sibling of the bug above, and a worse one. `-m` puts the *working
+ * directory* on `sys.path` — which is the fix for a module at the root, and
+ * no help at all when the package lives in `src/`. There, `import iniconfig`
+ * finds nothing in the working directory and falls through to whatever is
+ * installed in site-packages. The suite then runs green against a *different
+ * copy of the library than the one in the diff*: measured on `pytest-dev/
+ * iniconfig`, `_parse.py` gutted to `return False`, 49 tests passed, and the
+ * gate returned APPROVED (Exit 0).
+ *
+ * That is this project's worst failure shape — a check that examined
+ * something other than the thing under review, reporting a pass — and no
+ * amount of counting collected tests can see it, because the tests really
+ * did run. Only the import path can.
+ *
+ * `PYTHONPATH=src` is the ordinary spelling and puts the working tree first
+ * whether or not the package is also installed. Leading assignments are
+ * peeled into the child's environment by `runCommand`, so this needs no shell.
+ *
+ * Keyed on `__init__.py` under `src/`, which is the marker of a Python
+ * package and not of a Rust, C or JavaScript `src/` directory.
+ */
+export function isSrcLayout(root) {
+  const src = join(root, "src");
+  if (!existsSync(src)) return false;
+  try {
+    return readdirSync(src, { withFileTypes: true }).some(
+      (e) => e.isDirectory() && existsSync(join(src, e.name, "__init__.py"))
+    );
+  } catch (_) {
+    return false;
   }
-  return "pytest";
 }
 
 /**
@@ -234,7 +272,7 @@ export function oracleCandidates(root = process.cwd(), detected = "") {
     } catch (_) {}
   }
   if (has("pytest.ini") || has("pyproject.toml") || has("setup.py") || has("tox.ini") || has("setup.cfg")) {
-    push(pytestCmd());
+    push(pytestCmd(process.env, root));
   }
   if (has("Cargo.toml")) push("cargo test");
   if (has("go.mod")) push("go test ./...");
@@ -386,7 +424,7 @@ export function detectPolyglotStack(projectRoot = process.cwd()) {
   }
   if (existsSync(join(projectRoot, "pyproject.toml")) || existsSync(join(projectRoot, "requirements.txt")) || existsSync(join(projectRoot, "setup.py"))) {
     const triggerFile = existsSync(join(projectRoot, "pyproject.toml")) ? "pyproject.toml" : existsSync(join(projectRoot, "requirements.txt")) ? "requirements.txt" : "setup.py";
-    return { ...container, stack: "python", testCmd: pytestCmd(), buildCmd: `${pythonBin()} -m compileall -q .`, triggerFile };
+    return { ...container, stack: "python", testCmd: pytestCmd(process.env, projectRoot), buildCmd: `${pythonBin()} -m compileall -q .`, triggerFile };
   }
   if (existsSync(join(projectRoot, "mix.exs"))) {
     return { ...container, stack: "mix", testCmd: "mix test", buildCmd: "mix compile", triggerFile: "mix.exs" };
@@ -470,7 +508,7 @@ export function detectPolyglotStack(projectRoot = process.cwd()) {
     }
     const pyFile = rootFiles.find((f) => f.endsWith(".py"));
     if (pyFile) {
-      return { ...container, stack: "python", testCmd: pytestCmd(), buildCmd: `${pythonBin()} -m compileall -q .`, triggerFile: pyFile };
+      return { ...container, stack: "python", testCmd: pytestCmd(process.env, projectRoot), buildCmd: `${pythonBin()} -m compileall -q .`, triggerFile: pyFile };
     }
   } catch (_) {}
 
@@ -966,19 +1004,19 @@ export function bootstrapZeroTestRepo(root = process.cwd(), options = {}) {
     try {
       let rawConfig = readFileSync(configPath, "utf-8");
       if (/^\s*test:\s*.*$/m.test(rawConfig)) {
-        rawConfig = rawConfig.replace(/^\s*test:\s*.*$/m, `  test: "${testCmd}"`);
+        rawConfig = rawConfig.replace(/^\s*test:\s*.*$/m, () => `  test: ${yamlScalar(testCmd)}`);
       } else if (/^\s*verify:\s*$/m.test(rawConfig)) {
-        rawConfig = rawConfig.replace(/^\s*verify:\s*$/m, `verify:\n  test: "${testCmd}"`);
+        rawConfig = rawConfig.replace(/^\s*verify:\s*$/m, () => `verify:\n  test: ${yamlScalar(testCmd)}`);
       } else {
-        rawConfig += `\nverify:\n  test: "${testCmd}"\n`;
+        rawConfig += `\nverify:\n  test: ${yamlScalar(testCmd)}\n`;
       }
       if (detected.buildCmd && /^\s*build:\s*["']?["']?\s*$/m.test(rawConfig)) {
-        rawConfig = rawConfig.replace(/^\s*build:\s*.*$/m, `  build: "${detected.buildCmd}"`);
+        rawConfig = rawConfig.replace(/^\s*build:\s*.*$/m, () => `  build: ${yamlScalar(detected.buildCmd)}`);
       }
       writeFileSync(configPath, rawConfig, "utf-8");
     } catch (_) {}
   } else {
-    const cfg = `version: 1\nprovider: jules\ntier: free\nverify:\n  test: "${testCmd}"\n  build: "${detected.buildCmd || ""}"\nlimits:\n  diff_kb: 75\n  daily_tasks: 15\n  repair_attempts: 3\nbranch_prefix: agent/\nbase_branch: main\n`;
+    const cfg = `version: 1\nprovider: jules\ntier: free\nverify:\n  test: ${yamlScalar(testCmd)}\n  build: ${yamlScalar(detected.buildCmd || "")}\nlimits:\n  diff_kb: 75\n  daily_tasks: 15\n  repair_attempts: 3\nbranch_prefix: agent/\nbase_branch: main\n`;
     writeFileSync(configPath, cfg, "utf-8");
   }
 
@@ -987,12 +1025,12 @@ export function bootstrapZeroTestRepo(root = process.cwd(), options = {}) {
     try {
       let rawJules = readFileSync(julesPath, "utf-8");
       if (/^\s*test_cmd:\s*.*$/m.test(rawJules)) {
-        rawJules = rawJules.replace(/^\s*test_cmd:\s*.*$/m, `test_cmd: "${testCmd}"`);
+        rawJules = rawJules.replace(/^\s*test_cmd:\s*.*$/m, () => `test_cmd: ${yamlScalar(testCmd)}`);
       } else {
-        rawJules += `\ntest_cmd: "${testCmd}"\n`;
+        rawJules += `\ntest_cmd: ${yamlScalar(testCmd)}\n`;
       }
       if (detected.buildCmd && /^\s*build_cmd:\s*["']?["']?\s*$/m.test(rawJules)) {
-        rawJules = rawJules.replace(/^\s*build_cmd:\s*.*$/m, `build_cmd: "${detected.buildCmd}"`);
+        rawJules = rawJules.replace(/^\s*build_cmd:\s*.*$/m, () => `build_cmd: ${yamlScalar(detected.buildCmd)}`);
       }
       writeFileSync(julesPath, rawJules, "utf-8");
     } catch (_) {}

package/src/wizard-init.mjs

@@ -1,12 +1,12 @@
 import { existsSync, readFileSync, writeFileSync, openSync, fsyncSync, closeSync, renameSync, mkdirSync, readdirSync } from "node:fs";
 import { join } from "node:path";
-import { parseYaml, TIER_PRESETS, VENDOR_TIERS, FALLBACK_TIER } from "./config.mjs";
+import { parseYaml, yamlScalar, TIER_PRESETS, VENDOR_TIERS, FALLBACK_TIER } from "./config.mjs";
 import { suggestProvider, detectAvailableProviders } from "./provider-readiness.mjs";
 import { detectDefaultBranch } from "./git.mjs";
 import { resolveWorkspaceBoundary, oracleCandidates } from "./stack-detector.mjs";
 import { PROFILE_NAMES, PROFILE_DESCRIPTIONS } from "./profiles.mjs";
 import { detectStackOracles, runVerificationProbe } from "./wizard-oracle.mjs";
-import { parseCollectedTests } from "./ops/test-collection.mjs";
+import { parseCollectedTests, producedNoOutput, looksLikeTestSuiteCommand } from "./ops/test-collection.mjs";
 import { select, multiSelect, input, confirm, spinner, isTTY } from "./tui.mjs";
 import { KIT_VERSION } from "./version.mjs";
 
@@ -201,6 +201,19 @@ export function planInit(root = process.cwd(), options = {}) {
     ? `\nlimits:\n  concurrency: ${limits.concurrency}\n  daily_tasks: ${limits.daily_tasks}\n  stagger_ms: ${limits.stagger_ms}\n  diff_kb: ${limits.diff_kb}\n`
     : "";
 
+  // A generated comment must not begin with an ESLint directive keyword.
+  //
+  // `global`, `globals`, `exported`, `eslint`, `eslint-disable` and friends are
+  // configuration when they open a comment — in any language ESLint has a
+  // parser for, YAML included. This template began a line with "global runs
+  // the ...", which ESLint read as `/* global runs, the, ... */`: a declaration
+  // of globals named after each word of the sentence. Measured on
+  // `unjs/unimport`, that produced 18 `no-unused-vars` errors quoting
+  // individual English words back at the user, on a file `init` had written
+  // thirty seconds earlier.
+  //
+  // The word is unavoidable — `global` is the name of the setting being
+  // explained — so the sentence leads with the key instead.
   const configYaml = `# Agent Orchestrator Kit Config (v${KIT_VERSION})
 # provider: jules | claude-code | codex | gemini-flash  (agentctl providers)
 version: 1
@@ -212,16 +225,16 @@ ${limitsBlock}
 verify:
   # minimal | standard | max  — see: agentctl profile --list
   profile: ${profile}
-  # global runs the repository's own commands; affected resolves changed files
-  # to their sub-projects and runs only those suites (monorepos)
+  # scope: global runs the commands this repository declares; affected
+  # resolves changed files to their sub-projects, running only those suites
   scope: ${verifyScope}
-  test: "${verify.test}"
+  test: ${yamlScalar(verify.test)}
   # How long a verification stage may run before the gate kills it (default
   # 300000). Raise it for a suite that legitimately takes longer.
   timeout_ms: 300000
-  build: "${verify.build}"
-  lint: "${verify.lint}"
-  typecheck: "${verify.typecheck}"
+  build: ${yamlScalar(verify.build)}
+  lint: ${yamlScalar(verify.lint)}
+  typecheck: ${yamlScalar(verify.typecheck)}
 
 presets:
 ${selectedPresets.map((p) => `  - ${p}`).join("\n")}
@@ -246,11 +259,11 @@ ${selectedPresets.map((p) => `  - ${p}`).join("\n")}
 
   const julesYaml = `# Google Jules Repository Configuration (Version 2)
 version: 2
-test_cmd: "${verify.test}"
-build_cmd: "${verify.build}"
+test_cmd: ${yamlScalar(verify.test)}
+build_cmd: ${yamlScalar(verify.build)}
 forbidden_paths:
-${forbiddenPaths.map((p) => `  - "${p}"`).join("\n")}
-allow_paths: ${allowPaths.length > 0 ? "\n" + allowPaths.map((p) => `  - "${p}"`).join("\n") : "[]"}
+${forbiddenPaths.map((p) => `  - ${yamlScalar(p)}`).join("\n")}
+allow_paths: ${allowPaths.length > 0 ? "\n" + allowPaths.map((p) => `  - ${yamlScalar(p)}`).join("\n") : "[]"}
 `;
 
   return {
@@ -330,8 +343,18 @@ export function loadPresets(root = process.cwd()) {
  * cost of rejecting a candidate is trying the next one, where at gate time it
  * would be a hard red on a repository that is fine.
  */
-function probeVerdict(probeRes) {
+function probeVerdict(probeRes, cmd) {
   if (!probeRes.ok) return "failed";
+  // Writing nothing at all is `empty`, not `silent`. The distinction is the
+  // whole point: `silent` is the forgiving bucket that keeps a command the
+  // guard could not read, and `pnpm -r test` landed in it because it prints
+  // no output to be unreadable. So the candidate this verdict was introduced
+  // to reject was the one case it waved through, and every repository
+  // scaffolded on such a workspace kept it.
+  // Same rule as the gate's floor, from the same predicate: a command that
+  // claims to run a suite and printed nothing ran none. A static gate that
+  // printed nothing did what it promised, so it keeps the forgiving verdict.
+  if (looksLikeTestSuiteCommand(cmd) && producedNoOutput(probeRes.stdout, probeRes.stderr)) return "empty";
   const { count } = parseCollectedTests(probeRes.stdout, probeRes.stderr);
   if (count === null) return "silent";
   return count > 0 ? "ran" : "empty";
@@ -341,7 +364,7 @@ async function resolveRunnableOracle(root, testCmd, options = {}) {
   if (!testCmd) return testCmd;
   const probeSp = spinner(`Probing oracle: ${testCmd}`, options);
   const probeRes = await runVerificationProbe(testCmd, root);
-  const verdict = probeVerdict(probeRes);
+  const verdict = probeVerdict(probeRes, testCmd);
   if (verdict === "ran") {
     probeSp.stop(`Oracle verified successfully (${probeRes.durationMs}ms)`);
     return testCmd;
@@ -364,7 +387,7 @@ async function resolveRunnableOracle(root, testCmd, options = {}) {
   for (const cand of alternates) {
     const altSp = spinner(`Trying ${cand}`, options);
     const altRes = await runVerificationProbe(cand, root);
-    const altVerdict = probeVerdict(altRes);
+    const altVerdict = probeVerdict(altRes, cand);
     if (altVerdict === "ran") {
       altSp.stop(`${cand} runs here (${altRes.durationMs}ms) — using it instead`);
       return cand;

package/src/wizard-task.mjs

@@ -261,7 +261,21 @@ ${fullPrompt}
  * @returns {Promise<{ ok: boolean, dryRun: boolean, taskFile: string, written: boolean, plan: object }>}
  */
 export async function runTaskCreateWizard(root = process.cwd(), options = {}) {
-  const interactive = options.interactive !== false && isTTY(options.stdin || process.stdin);
+  // `-p` is the documented way to skip the questions, so it has to skip them.
+  //
+  // README: "Pass the prompt to skip straight to review:
+  // npx jules-orchestrator-kit task create -p 'Refactor the invoice module'".
+  // Interactivity was decided by `isTTY` alone, and `-p` was consulted only by
+  // the TODO-import branch below — so in a real terminal the advertised
+  // quickstart stopped at "? Task Title" and waited for a keypress forever,
+  // then asked for the instructions it had already been handed.
+  //
+  // It looked fine under test because a non-TTY run takes the headless path and
+  // never asks. That is the same defect the flag itself has: one rule, two
+  // paths, and only the path nobody was watching kept the old answer. Making
+  // `-p` mean the headless path everywhere makes the two agree by construction.
+  const promptSupplied = typeof options.prompt === "string" && options.prompt.trim() !== "";
+  const interactive = options.interactive !== false && !promptSupplied && isTTY(options.stdin || process.stdin);
 
   let title = options.title;
   let promptText = options.prompt;